fix(server): bound search and image response bodies

[luvs01]

Summary

• Add one bounded raw-byte response reader and use it for both the search relay (16 MiB) and OpenAI-compatible image relay (100 MiB).
• Stop and cancel upstream bodies as soon as the cap is exceeded, including declared and chunked/understated responses.
• Preserve arbitrary response bytes, status, and content type without text decoding or using a backing .buffer outside its view bounds.
• Keep one linked deadline across headers and body reads, preserving client aborts as 499 and post-header timeouts as 504.
• Record oversized image response status before returning 502, cancel pre-reader bodies, and preserve bodyless 204 responses.

Both relays previously called arrayBuffer() before enforcing their response limit. A large, stalled, or unbounded upstream body could therefore allocate beyond the intended cap or outlive the configured deadline.

Verification

• Bun 1.3.14: tests/bounded-body.test.ts + tests/server-search.test.ts — 45 passed, 0 failed.
• Focused image reader/relay regressions — 7 passed, 0 failed.
• bun run typecheck — passed on the final source.
• bun run privacy:scan — passed on the final source.
• git diff --check — passed.
• Two independent focused reviews found no actionable P0-P3 findings.
• Full bun run test was attempted once. On Windows/current dev, unrelated Codex user-identity/catalog/history tests failed before Bun 1.3.14 panicked after 1,123 seconds; the changed bounded-body/search/image tests did not fail. Exact-head GitHub CI is still required.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed. (No user-facing configuration or API contract change.)
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c8809727-3fb1-46ce-aa2a-0a53106136c3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The PR adds bounded raw-byte response reading and integrates it into the search relay. The reader preserves bytes, enforces a maximum size, propagates aborts, and cancels streams. Search handling maps oversized responses, timeouts, and client aborts to HTTP responses.

Changes

Bounded search response handling

Layer / File(s)	Summary
Bounded raw-byte reader src/lib/bounded-body.ts, tests/bounded-body.test.ts	Adds BoundedBytesOptions, BoundedBytesResult, and readBoundedResponseBytes. The reader preserves arbitrary bytes, enforces maxBytes, propagates abort reasons, handles missing bodies, and cancels streams safely. Tests cover normal reads, oversized bodies, aborts, and cancellation rejection handling.
Search relay integration src/server/search.ts, tests/server-search.test.ts	The search relay uses bounded, signal-aware body reads. It returns 502 for oversized responses, 504 for response timeouts, and 499 for client aborts. Tests verify status, content type, byte preservation, and upstream cancellation.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• lidge-jun/opencodex#866: Both changes modify src/lib/bounded-body.ts for bounded response-body handling.
• lidge-jun/opencodex#1155: Both changes modify search upstream response handling and bounded body consumption.

Suggested reviewers: lidge-jun, wibias

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title identifies the main server change of bounding search response bodies, although it also mentions image responses that are not changed.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⏳ DRAFT

• review readiness checklist open (2/4 boxes ticked).

What to do

• Tick all four boxes in the PR description once you're done (currently 2/4).

Review readiness checklist

• ⬜ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

2/4 boxes ticked.

This PR stays in draft until every box above is ticked.

[luvs01]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/bounded-body.ts`:
- Around line 145-148: Update the public contract documentation near the
bounded-body result, including the description of bytes, to state that bytes is
an exact-length view into internal storage and consumers must use its byteOffset
and byteLength rather than the underlying buffer; preserve the existing
zero-copy subarray return in the completion path.

In `@src/server/search.ts`:
- Around line 159-166: Update the oversized branch in the search response
handling flow to call upstream.recordOutcome with upstreamResponse.status before
returning formatErrorResponse. Preserve the existing status value as the
outcome, matching the success path and recordOutcome contract; do not introduce
a separate marker.
- Around line 171-175: Update the search handler around the upstream fetch and
catch flow to retain the response in a scope visible to its finally block,
preserving the existing req.signal.aborted-first 499/504 ordering. In the
finally cleanup, unconditionally cancel the retained upstream response body when
present, swallowing any rejection, alongside the existing sidecarExit() and
linkedSignal.cleanup() calls; keep normal reader cleanup behavior unchanged.

In `@tests/bounded-body.test.ts`:
- Around line 418-434: Strengthen the “raw byte cancellation rejection is
observed” test by adding a deliberately unhandled rejection through the same
process unhandledRejection listener and wait interval, then assert the listener
records that positive-control rejection before asserting the stream cancellation
path leaves unhandled empty. Keep the existing cleanup and cancellation
regression coverage intact, and verify the control works under the pinned test
runtime.

In `@tests/server-search.test.ts`:
- Around line 485-497: Export the existing SEARCH_RESPONSE_MAX_BYTES constant
from the production search module, then import and use it in the oversized
streaming response test instead of hardcoding 16 * 1024 * 1024. Build the test
chunks so the first fills the cap exactly and the next byte exceeds it, and
update the tail guard to check the chunk length before its byte value, matching
the bounded-body test pattern.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b042aea4-4b01-4138-8210-44d7250e4b4c

📥 Commits

Reviewing files that changed from the base of the PR and between 025c379 and b1f0bd1.

📒 Files selected for processing (4)

• src/lib/bounded-body.ts
• src/server/search.ts
• tests/bounded-body.test.ts
• tests/server-search.test.ts

[luvs01]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Wibias]

Please rebase this PR onto the latest dev (e8ce2b93dd3ef8074d96dee407704c5dc06e2699) before merge, then rerun the exact-head CI checks.