@agentshouse/kit 0.1.0-alpha.5 → 0.1.0-alpha.6

package/README.md

@@ -10,7 +10,7 @@ On Linux `amd64` or `arm64` with a working Docker Engine, run the published,
 versioned bootstrap once:
 
 ```sh
-bash <(curl -fsSL https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.5/connect-linux.sh)
+bash <(curl -fsSL https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.6/connect-linux.sh)
 ```
 
 The release asset pins one immutable multi-architecture image digest. It creates

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentshouse/kit",
-  "version": "0.1.0-alpha.5",
+  "version": "0.1.0-alpha.6",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/house.js

@@ -480,6 +480,11 @@ export async function reportLogin(session, login, outcome, signal = session.sign
 
 const envelope = declarationReader("kit_acquire_rejected");
 
+function routineInput(value, declaration) {
+  if (typeof value !== "string" || Array.from(value).length > 20_000) envelope.refuse(declaration);
+  return value;
+}
+
 function acquiredRoute(value, declaration) {
   const route = envelope.plain(value, declaration);
   if (!Array.isArray(route.arguments)) envelope.refuse(`${declaration}.arguments`);
@@ -551,7 +556,7 @@ function acquiredRequest(acquired, declaration) {
       name: envelope.text(routine.name, `${declaration}.routine.name`, 256),
       version: envelope.positiveCount(routine.version, `${declaration}.routine.version`),
     },
-    payload: envelope.plain(request.payload, `${declaration}.request.payload`),
+    payload: routineInput(request.payload, `${declaration}.request.payload`),
     requested_by: envelope.text(
       request.requested_by,
       `${declaration}.request.requested_by`,