From 74bacf024336cc034ed0ee66e2305ee08421781d Mon Sep 17 00:00:00 2001
From: aiirvizionz <david.lopezhuerta01@gmail.com>
Date: Sun, 9 Aug 2026 18:19:54 -0600
Subject: [PATCH] fix(cli): bound list stdin input

---
 bin/moshpit-name.mjs |  9 ++++++++-
 test/cli.test.mjs    | 12 ++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/bin/moshpit-name.mjs b/bin/moshpit-name.mjs
index 27e4523..4811f1e 100755
--- a/bin/moshpit-name.mjs
+++ b/bin/moshpit-name.mjs
@@ -252,7 +252,14 @@ if (sub === "list") {
   }
   if (limitFlags === 1) limit = parsedLimit;
 
-  const input = rest[0] === "-" || !rest.length ? await readStdin() : rest.join("\n");
+  let input;
+  if (rest[0] === "-" || !rest.length) {
+    const stdin = await readCommandStdin();
+    if (stdin.error) exitInputError(stdin.error);
+    input = stdin.lines.join("\n");
+  } else {
+    input = rest.join("\n");
+  }
   const parsed = parseTldList(input, limit);
   if (ndjson) {
     outNdjson(parsed.entries);
diff --git a/test/cli.test.mjs b/test/cli.test.mjs
index 2adb0f3..7dc6167 100644
--- a/test/cli.test.mjs
+++ b/test/cli.test.mjs
@@ -104,6 +104,18 @@ test("check bounds stdin bytes before emitting NDJSON", () => {
   assert.deepEqual(JSON.parse(result.stdout), { error: "stdin accepts at most 1 MiB" });
 });
 
+test("list bounds both explicit and implicit stdin", () => {
+  const input = Array.from({ length: MAX_BULK_TLDS + 1 }, (_, index) => `name${index}.eggs`).join("\n");
+  for (const args of [["list", "-", "--json"], ["list", "--json"]]) {
+    const result = run(args, input);
+    assert.equal(result.status, 1);
+    assert.equal(result.stderr, "");
+    assert.deepEqual(JSON.parse(result.stdout), {
+      error: `stdin accepts at most ${MAX_BULK_TLDS} non-empty lines`,
+    });
+  }
+});
+
 test("NDJSON output handles a downstream reader closing the pipe", async () => {
   const result = await new Promise((resolve, reject) => {
     const child = spawn(process.execPath, [BIN, "check", ".eggs", "--ndjson"], {