Go SDK Commands.Run buffers unbounded stdout and stderr

[szybnev]

Problem

With github.com/tencentcloud/CubeSandbox/sdk/go v0.0.0-20260717090631-002e4049fff0, Sandbox.Commands().Run has no output limit or streaming callback. parseProcessStartStream appends every decoded stdout/stderr event to two strings.Builder values and returns only after the process ends.

A command controlled by untrusted input can therefore make the Go client allocate memory proportional to remote output before an application can truncate the returned strings. Limiting the final CommandResult is too late.

Relevant code: sdk/go/envd.go, parseProcessStartStream, currently around lines 245-313.

Expected API

Please provide one of:

• bounded command output options with a fail/truncate policy; or
• a streaming command API with stdout/stderr callbacks/readers and an explicit maximum frame/output size.

The decoder should reject oversized Connect envelopes before allocating their declared payload.

Current workaround

We still use the official SDK for client/sandbox lifecycle, PTY, files and snapshots, but had to bypass Commands.Run with a small application-owned decoder for the same /process.Process/Start Connect protocol:

• maximum Connect event: 1 MiB, checked before allocation;
• maximum combined decoded stdout+stderr: 512 KiB;
• compressed/end/error/exit-code events handled explicitly;
• oversized output leaves a mutating command in an unknown/recoverable state;
• no fork, replace directive or patched SDK is used.

We also wrap remaining SDK responses with bounded transports because several unary helpers decode directly from response bodies.

This workaround is intentionally temporary and duplicates private wire types because the public command API cannot enforce a memory bound.