Align JSON-RPC bounds and parsing

codex-rs/exec-server-protocol/src/rpc.rs

@@ -184,6 +184,11 @@ impl<'de> Visitor<'de> for BoundedValueVisitor<'_> {
     {
         let mut values = Map::new();
         while let Some(key) = object.next_key::<String>()? {
+            if values.contains_key(&key) {
+                return Err(de::Error::custom(format!(
+                    "duplicate JSON object key `{key}`"
+                )));
+            }
             let value = object.next_value_seed(BoundedValueSeed {
                 remaining: &mut *self.remaining,
             })?;

codex-rs/exec-server-protocol/src/rpc_tests.rs

@@ -60,6 +60,19 @@ fn accepts_large_scalar_payload() -> serde_json::Result<()> {
     Ok(())
 }
 
+#[test]
+fn rejects_duplicate_object_keys() {
+    let error = serde_json::from_str::<JSONRPCMessage>(r#"{"method":"safe","method":"dangerous"}"#)
+        .expect_err("duplicate JSON object keys should be rejected");
+
+    assert!(
+        error
+            .to_string()
+            .contains("duplicate JSON object key `method`"),
+        "unexpected error: {error}"
+    );
+}
+
 #[test]
 fn rejects_compact_array_heap_amplification() {
     const REPRO_VALUE_COUNT: usize = 2_097_137;