Expand description
The frozen limits. Every number a v1 peer is allowed to assume about the other side lives here, and nowhere else.
They are constants rather than configuration on purpose. A limit either side can tune is not a limit — it is a negotiation, and the frame that arrives while the two ends disagree is the one that gets through. Changing any of these is a protocol change: it needs a new major version, because a phone built against the old number will send a frame the daemon now refuses.
The byte counts are all measured over UTF-8 bytes, not characters. A
limit counted in chars is a limit an attacker picks the units of.
Constants§
- AGENT_
EVENT_ REPLAY_ EVENTS - The most events one run keeps for replay. A run that emits faster than the window can hold drops the oldest; a client that asks for a sequence older than the buffer is told to restart from the snapshot rather than handed a gap it cannot see.
- AGENT_
EVENT_ REPLAY_ WINDOW - How far back a reconnecting client may resume an agent run’s events.
- APPROVAL_
EXPIRY - How long a remote approval waits for a human before it denies itself.
- HEARTBEAT_
INTERVAL - How often a connected daemon announces it is still there.
- MAX_
AGENT_ PROMPT_ BYTES - The largest prompt one agent turn may carry.
- MAX_
CLOCK_ SKEW_ AHEAD - How far ahead of the receiver a frame’s
sentAtmay be. - MAX_
FRAME_ BYTES - The largest frame either side will read off the socket.
- MAX_
INCIDENTS - The most incidents one response may carry.
- MAX_
INSPECTION_ RESPONSE_ BYTES - The ceiling on a whole inspection response, applied after per-field
truncation, for the same reason
MAX_LOG_RESPONSE_BYTESexists: the per-item bounds multiplied out are much larger than anything worth sending. - MAX_
LOG_ LINES - The most log lines one response may carry, whatever was asked for.
- MAX_
LOG_ LINE_ BYTES - Where a single log line is cut. A service that writes a megabyte without a newline must not be able to fill the frame budget by itself.
- MAX_
LOG_ RESPONSE_ BYTES - The ceiling on a whole log response, applied after per-line truncation — 200 lines of 8 KiB would otherwise be 1.6 MiB.
- MAX_
PENDING_ COMMANDS - How many requests one device may have in flight.
- MAX_
PULL_ REQUESTS - The most pull requests one response may carry.
- MAX_
REQUEST_ AGE - How far in the past a frame’s
sentAtmay be before it is refused. - MAX_
SUMMARY_ BYTES - Where any single piece of prose on the inspection surface is cut — a run title, a pull request title, an incident title, a timeline detail.
- MAX_
TERMINAL_ CHUNK_ BYTES - The most raw PTY output carried in one frame, before base64.
- MAX_
TERMINAL_ DIMENSION - The widest and tallest a mirrored terminal may claim to be. A resize is
attacker-supplied arithmetic that reaches
ioctl, so it is bounded before it gets there rather than trusted. - MAX_
TERMINAL_ INPUT_ BYTES - The most keystroke data one input frame may carry.
- MAX_
TERMINAL_ STREAMS - How many terminals one device may have mirrored at once.
- MAX_
TIMELINE_ ENTRIES - The most timeline entries one response may carry.
- MAX_
WORKFLOW_ JOBS - The most jobs one workflow run’s response may carry.
- MAX_
WORKFLOW_ RUNS - The most workflow runs one response may carry, whatever was asked for.
- PRESENCE_
TIMEOUT - How long the platform waits before calling a device offline.
- RECONNECT_
BACKOFF_ CAP - The ceiling on the daemon’s reconnect backoff. Jittered by the connector, so a platform restart does not bring every daemon back in the same second.
- REQUEST_
ID_ DEDUP_ WINDOW - How long a request id is remembered for duplicate detection.
- SERVICE_
COMMAND_ TIMEOUT - How long a service action may take before the relay stops waiting.
- TERMINAL_
COALESCE_ INTERVAL - How long the daemon gathers PTY output before sending it.