fix(tool_def): bound aggregate JSON flag coercion

[chaliy]

Motivation

• Parsing attacker-controlled JSON for array/object-typed flags eagerly called serde_json::from_str and could expand a small input token into a very large serde_json::Value tree, bypassing Bashkit memory accounting and allowing an availability attack.

Description

• Add MAX_AGGREGATE_FLAG_JSON_BYTES = 64 * 1024 to cap eager aggregate JSON coercion in crates/bashkit/src/tool_def.rs.
• Introduce helper parse_aggregate_json_value(raw: &str) -> Option<serde_json::Value> which returns None when the raw byte length exceeds the cap and otherwise attempts serde_json::from_str.
• Route aggregate parsing through the helper in coerce_value, consume_array_value, and object-consumption paths so oversized JSON falls back to the existing raw-string behavior instead of being eagerly materialized.
• Add regression test test_parse_flags_large_json_array_stays_string asserting oversized JSON arrays are preserved as strings (so downstream serde/schema validation still produces type errors without unbounded allocation).

Testing

• Ran unit tests for the modified module with cargo test --lib tool_def, and the tool_def test suite passed (tests covering array/object coercion and the new regression test all succeeded).

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	12b0e69	Commit Preview URL	May 08 2026, 09:08 AM