{"record":{"id":"c04ed37afd9ba3c7","repo":"astrid-runtime/astrid","slug":"fuse-service-launch-exceeds-limit-c04ed3","errorCode":null,"errorMessage":"FUSE service launch exceeds limit","messagePattern":"FUSE service launch exceeds limit","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-storage-provider-fuse/src/service.rs","lineNumber":38,"sourceCode":"use crate::control::{KernelControlRequest, KernelControlResponse, bind_control_listener};\nuse crate::filesystem::{self, FuseBackgroundSession};\nuse crate::mountpoint;\n\nconst MAX_LAUNCH_BYTES: u64 = 64 * 1024;\nconst MAX_CONTROL_BYTES: usize = 64 * 1024;\nconst MAX_CALLBACK_BYTES: usize = 8 * 1024 * 1024;\nconst SERVICE_POLL: Duration = Duration::from_secs(1);\n\n/// Run the hidden target-free service mode.\npub(crate) async fn run() -> Result<()> {\n    let mut bytes = Vec::new();\n    std::io::stdin()\n        .lock()\n        .take(MAX_LAUNCH_BYTES + 1)\n        .read_to_end(&mut bytes)\n        .context(\"read target-free FUSE service launch\")?;\n    if bytes.len() as u64 > MAX_LAUNCH_BYTES {\n        bail!(\"FUSE service launch exceeds limit\");\n    }\n    let launch: StorageProviderServiceLaunchV1 =\n        serde_json::from_slice(&bytes).context(\"decode target-free FUSE service launch\")?;\n    run_launch(launch).await\n}\n\nasync fn run_launch(launch: StorageProviderServiceLaunchV1) -> Result<()> {\n    if launch.schema != STORAGE_FILESYSTEM_SERVICE_LAUNCH_SCHEMA_V1 {\n        bail!(\"unsupported FUSE service launch schema {}\", launch.schema);\n    }\n    validate_launch(&launch)?;\n    let challenge = storage_provider_service_ready_challenge(\n        &launch.parent.token,\n        STORAGE_FILESYSTEM_SERVICE_READY_SCHEMA_V1,\n        crate::PROVIDER_NAME,\n        launch.lease.mount_id.as_uuid(),\n        &launch.control_path,\n        &launch.lease.resource_path,","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-storage-provider-fuse/src/service.rs#L20-L56","documentation":"The FUSE service reads its launch configuration (JSON) from stdin, capping input at MAX_LAUNCH_BYTES by reading exactly one byte more. If the input exceeds the cap, run bails before attempting to decode, protecting the process from oversized or hostile launch payloads.","triggerScenarios":"Piping a launch JSON document larger than MAX_LAUNCH_BYTES into the service's stdin; a parent process accidentally feeding a log or binary blob instead of the launch config.","commonSituations":"Misconfigured supervisor piping the wrong file to stdin; an embedding tool serializing an unexpectedly huge token or config; concatenating multiple launch documents.","solutions":["Reduce the size of the launch payload (trim tokens, options, or embedded data)","Inspect what the parent process writes to stdin and fix the pipeline","Check MAX_LAUNCH_BYTES in service.rs and whether the payload legitimately needs a larger limit (code change)","Ensure only a single StorageProviderServiceLaunchV1 document is piped"],"exampleFix":"// before\ncat large-launch-and-logs.json | fuse-service\n// after\ncat launch.json | fuse-service   # single JSON doc within MAX_LAUNCH_BYTES","handlingStrategy":"validation","validationCode":"fn launch_fits_limit(json: &str, max_bytes: u64) -> bool {\n    (json.len() as u64) <= max_bytes\n}","typeGuard":null,"tryCatchPattern":"match service::run().await {\n    Err(e) if e.to_string().contains(\"launch exceeds limit\") => {\n        eprintln!(\"launch payload too large; trim config or raise MAX_LAUNCH_BYTES\");\n    }\n    other => other?,\n}","preventionTips":["Keep launch payloads small; avoid embedding large tokens or blobs","Pipe exactly one launch JSON document to stdin","Verify what the supervisor writes to the child's stdin","If payloads legitimately grew, raise MAX_LAUNCH_BYTES in a code change"],"tags":["fuse","limits","stdin","payload"],"backgroundTag":"payload-too-large","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}