[Quim Muntal (qmuntal)]

Summary

• Replace the overflow-prone len(extra)+len(suffix) capacity calculation in shell argv construction with slices.Concat(extra, suffix).
• Preserve the existing copy semantics while avoiding unchecked integer overflow in allocation size computation.

Fixes Size computation for allocation may overflow · Code scanning alert #1 · microsoft/agent-framework-go.

Validation

• go test -count=1 ./tool/shelltool

[Copilot]

Pull request overview

This PR hardens shell argv construction in shelltool by removing an integer-overflow-prone capacity calculation while keeping the “copy-on-combine” semantics (i.e., not aliasing the input slices).

Changes:

• Replaces the manual make(..., len(extra)+len(suffix)) capacity computation with a slices-based approach to avoid overflow in allocation size math.
• Simplifies combineArgv implementation used by both stateless and persistent shell argv construction.

Show a summary per file

File	Description
tool/shelltool/localshell.go	Updates argv combination to avoid allocation-size overflow during shell command invocation setup.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Low

[github-actions]

Cross-Repo Parity Review — PR #429

Result: Out of scope — no parity issues.

This PR only modifies the unexported combineArgv helper inside tool/shelltool/localshell.go, replacing a manual slice-append pattern with slices.Concat to fix a potential integer overflow in the capacity calculation. There are no changes to exported Go types, option structs, public methods, or observable runtime behavior.

No upstream .NET or Python parity check is required.

Generated by Go API Consistency Review Agent for #429 · 28.2 AIC · ⌖ 12.8 AIC · ⊞ 27.1K · ◷