gh agent-task list --limit can request an arbitrary amount of memory and abort the process with "out of memory" #14988

Describe the bug

gh agent-task list crashes with an unrecoverable out-of-memory error when --limit is given a very large value.

The session list is allocated up front with a capacity equal to --limit, and each element is a fairly large struct, so the flag is multiplied into a huge reservation. A value of two billion asks for roughly 528 GB of memory, which the Go runtime cannot map, so it aborts the process with fatal error: runtime: out of memory.

This is a runtime fatal error rather than a panic, so it cannot be recovered from and the command produces no output at all.

The allocation happens before any request is made to the Copilot API, so the crash does not depend on the server.

Affected version

$ gh version
gh version 2.103.3-71-g736c68f67 (2026-11-07)
https://github.com/cli/cli/releases/latest

This is a build of trunk. The allocation was introduced in v2.80.0, and every release since then, up to and including v2.103.3, is affected.

Steps to reproduce the behavior

1. Run the command with a very large limit:

   gh agent-task list --limit 2000000000
   

2. View the output

3. See error

The command needs an OAuth token, which is the normal state after gh auth login.

Expected vs actual behavior

Expected: gh should report that the requested limit is out of range.

Actual: the Go runtime aborts with fatal error: runtime: out of memory.

Logs

fatal error: runtime: out of memory

runtime stack:
runtime.throw({0x1523e3c?, 0x2407?})
	runtime/panic.go:1243 +0x48
runtime.sysMapOS(0x101f27c00000, 0x7aef800000, {0x14efe9e, 0x4})
	runtime/mem_linux.go:175 +0x13b
runtime.sysMap(0x101f27c00000, 0x7aef800000, 0x2b01e48?, {0x14efe9e, 0x4})
	runtime/mem.go:275 +0x45
runtime.(*mheap).grow(0x2af1c40?, 0x3d77a05?)
	runtime/mheap.go:1625 +0x2be
runtime.(*mheap).allocSpan(0x2af1c40, 0x3d77a05, 0x0, 0x0)
	runtime/mheap.go:1290 +0x2b
runtime.systemstack(0x800000)
	runtime/asm_amd64.s:531 +0x4a

goroutine 1 gp=0x101f26db21e0 m=5 mp=0x101f26f00008 [running]:
...
github.com/cli/cli/v2/pkg/cmd/agent-task/capi.(*CAPIClient).ListLatestSessionsForViewer(0x1ed3e452540, {0x2956988, 0x2b08960}, 0x77359400)
	github.com/cli/cli/v2/pkg/cmd/agent-task/capi/sessions.go:224 +0x1e5
github.com/cli/cli/v2/pkg/cmd/agent-task/list.listRun(0x1ed3dddec00)
	github.com/cli/cli/v2/pkg/cmd/agent-task/list/list.go:86 +0x154
github.com/cli/cli/v2/pkg/cmd/agent-task/list.NewCmdList.func1(0x0?, {0x0?, 0x0?, 0x0?})
	github.com/cli/cli/v2/pkg/cmd/agent-task/list/list.go:51 +0x35
...
exit status 2

The size passed to sysMapOS is 0x7aef800000, which is 528,000,000,000 bytes, exactly two billion times the size of one session struct.