fix: reject unsafe bash env integers

steipete · steipete · commit a2595f16d486 · 2026-05-28T15:00:08.000-04:00
diff --git a/src/agents/bash-tools.shared.test.ts b/src/agents/bash-tools.shared.test.ts
@@ -35,6 +35,12 @@ describe("resolveSandboxWorkdir", () => {
     expect(readEnvInt("OPENCLAW_BASH_YIELD_MS", "PI_BASH_YIELD_MS")).toBeUndefined();
   });
 
+  it("ignores unsafe environment integers", () => {
+    vi.stubEnv("OPENCLAW_BASH_YIELD_MS", "9007199254740993");
+
+    expect(readEnvInt("OPENCLAW_BASH_YIELD_MS", "PI_BASH_YIELD_MS")).toBeUndefined();
+  });
+
   it("maps container root workdir to host workspace", async () => {
     await withTempDir(async (workspaceDir) => {
       const warnings: string[] = [];
diff --git a/src/agents/bash-tools.shared.ts b/src/agents/bash-tools.shared.ts
@@ -214,7 +214,7 @@ export function readEnvInt(key: string, legacyKey?: string) {
     return undefined;
   }
   const parsed = Number(trimmed);
-  return Number.isFinite(parsed) ? parsed : undefined;
+  return Number.isSafeInteger(parsed) ? parsed : undefined;
 }
 
 export function chunkString(input: string, limit = CHUNK_LIMIT) {

Original file line number	Diff line number	Diff line change
`@@ -214,7 +214,7 @@ export function readEnvInt(key: string, legacyKey?: string) {`
`214`	`214`	`return undefined;`
`215`	`215`	`}`
`216`	`216`	`const parsed = Number(trimmed);`
`217`		`- return Number.isFinite(parsed) ? parsed : undefined;`
	`217`	`+ return Number.isSafeInteger(parsed) ? parsed : undefined;`
`218`	`218`	`}`
`219`	`219`
`220`	`220`	`export function chunkString(input: string, limit = CHUNK_LIMIT) {`