harden: bound the poll history and the timeout of actions run_watch #602

New issue

Closed

opened 2026-09-23 14:31:22 +00:00 by hexajon · 0 comments

hexajon commented

2026-09-23 14:31:22 +00:00

Owner

What

actionsRunWatch (internal/mcp/tools_actions_runs.go:98) appends one status line per poll to statusLines and returns them all at the end. The caller sets timeout_seconds and interval_seconds, and neither has an upper limit. A long timeout with a short interval grows the list, and the tool result, with no bound. The loop also waits with time.Sleep, so a cancelled request keeps polling until the next check.

Fix

Keep only a bounded tail of status lines, or record a line only when the status changes.
Wait on the request context, so a cancel stops the loop at once.

Acceptance

timeout_seconds stays as it is: 300 s default, set by the caller. run_watch is an intentional mirror of the CLI actions runs watch.
The returned summary has a bounded size for any timeout and interval.
A cancelled context ends the watch without a further poll.
Tests cover the three points, and the gate is green.

## What `actionsRunWatch` (`internal/mcp/tools_actions_runs.go:98`) appends one status line per poll to `statusLines` and returns them all at the end. The caller sets `timeout_seconds` and `interval_seconds`, and neither has an upper limit. A long timeout with a short interval grows the list, and the tool result, with no bound. The loop also waits with `time.Sleep`, so a cancelled request keeps polling until the next check. ## Fix - Keep only a bounded tail of status lines, or record a line only when the status changes. - Wait on the request context, so a cancel stops the loop at once. ## Acceptance - `timeout_seconds` stays as it is: 300 s default, set by the caller. `run_watch` is an intentional mirror of the CLI `actions runs watch`. - The returned summary has a bounded size for any timeout and interval. - A cancelled context ends the watch without a further poll. - Tests cover the three points, and the gate is green.

hexajon added the

severity/low

security

labels

2026-09-23 14:31:22 +00:00

hexajon referenced this issue from a pull request that will close it,

2026-09-24 14:00:06 +00:00

fix(mcp): bound the run_watch summary and stop the watch on cancel #613

hexajon referenced this issue from a commit

2026-09-24 14:00:08 +00:00

fix(mcp): bound the run_watch summary and stop the watch on cancel

hexajon closed this issue