Non-json client configs: no nesting-depth cap (json5/yaml resource spike) and silent big-integer rounding on rewrite (toml/json5/yaml) #1635

Client or integration

Other

Area

Other

Summary

While reviewing #1631/#1632, adversarial measurement passes found two classes of pre-existing exposure in the client-config rewrite pipeline for the non-json formats. Neither is introduced or enlarged by #1632 (which guards the json path); both exist on dev today for every first apply onto a foreign config file, and are reported here so they don't get lost.

1. No nesting-depth cap for json5/yaml (resource spike + raw error instead of structured refusal).
parseConfig has no depth guard for json5 and yaml (the json path gets one in the follow-up to #1632). Measured on Bun 1.3.14/JSC through the exact layers the writer calls (parseConfig → merge clone → serializeDocument): an openclaw json5 config nested 15,000 deep (bounded by the parser's own stack ceiling ~15,295) produces a ~450MB output string at ~1.1GB peak RSS in ~1s per management request; yaml accepts ~3,000 levels and drives the recursive renderYaml. Reachability requires local write access to a client config plus an authenticated management mutation — so a hardening issue, not an urgent vulnerability.

2. Big-integer literals silently rounded for toml/json5/yaml.
Bun.TOML.parse, Bun.JSON5.parse and Bun.YAML.parse all round 9007199254740993 to 9007199254740992, and the corresponding renderers write the rounded value back without refusal. A first apply onto e.g. a kimi config.toml holding session_id = 9007199254740993 as a sibling rewrites it to …992 and reports success — exactly the failure class the TOML inf/nan guard (and, since #1632, the json number scan) treats as "a silent value change is worse than a refusal". json5 additionally loses -0 (Bun.JSON5.stringify({a:-0}) → {a:0}) while non-finite values are safe there (JSON5 can represent Infinity).

Suggested direction, mirroring the json approach: per-format raw-text or post-parse round-trip checks that classify such files unsafe before any rewrite, plus a shared nesting ceiling. I'm happy to pick this up after #1632 and the depth-hardening follow-up PR land, if the direction is agreeable.

Reproduction

1. Depth (json5): bun -e 'const {parseConfig}=await import("./src/integrations/config-io.ts"); const t="[".repeat(15000)+"1"+"]".repeat(15000); console.log(parseConfig(t,"json5"))' → parses (no guard); feeding the parsed doc through the writer layers spikes RSS ~1.1GB.
2. Rounding (toml): create a kimi config with a sibling session_id = 9007199254740993, no opencodex block; enable the kimi integration → file now contains session_id = 9007199254740992, result ok.

Version

2.14.2 (reproduced against dev)

Operating system

macOS 26 (arm64), Bun 1.3.14

Provider and model

No response

Logs or error output

No response

Screenshots and supporting files

No response

Redacted configuration

No response

Checks

• I searched existing issues and documentation.
• I removed secrets, tokens, account details, request credentials, and personal data.