[LIghtJUNction]

Motivation

• The SSH-restricted shell previously invoked git receive-pack with inherited stdin and no aggregate byte or execution-time bounds, allowing authenticated users to push arbitrarily large or long-running packs and risk exhausting storage or processes.

Description

• Add a new configurable setting ssh_git_timeout_seconds to Config with a default of 120 seconds and load/validate it from the ssh section. (files: src/msgd/config.py, deploy/etc/msg-lmm-best/msg.conf).
• Replace the direct subprocess.run(...) call for git-receive-pack with a relayed, byte-counting pipe that enforces repo_max_request_bytes and kills the backend when the aggregate exceeds the limit. (file: src/msgd/sshaccess.py).
• Enforce a runtime bound by waiting on the receive-pack process with timeout=cfg.ssh_git_timeout_seconds and return a 504 on timeout. (file: src/msgd/sshaccess.py).
• Add a regression test that simulates oversized SSH receive input and verifies the code returns 413 and kills the backend, and update unit tests accordingly. (file: tests/test_sshaccess.py).

Testing

• Ran static checks with uv run ruff check . and the linting completed successfully.
• Ran the full unit test suite with uv run python -m unittest discover -s tests -v and the tests passed (with one unrelated external-valkey test skipped).

---

Codex Task

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-28T11:47:12.393249Z	1cbbe4c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[LIghtJUNction]

已被 #143 取代，关闭。旧补丁打在已删除的 src/msgd 上；现行 src/msg 的对应容量上限在分支 fix/capacity-recovery-20260928（head e77b53b），该分支已包含合并后的 #142。