fix(web-search): bound the Anthropic sidecar SSE and error bodies - #3839
fix(web-search): bound the Anthropic sidecar SSE and error bodies#3839luvs01 wants to merge 1 commit into
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
✅ Deterministic PR hygiene checks passed. |
⏳ DRAFT
What to do
Review readiness checklist
1/4 boxes ticked. This PR stays in draft until every box above is ticked. Hygiene✅ Deterministic PR hygiene checks passed. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Team Run ID: 📒 Files selected for processing (3)
Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review. 📝 WalkthroughWalkthroughThe Anthropic sidecar executor now bounds HTTP error-body reads and SSE input. It tracks accepted bytes, truncates oversized chunks, cancels readers without waiting, and drops unterminated tails. A regression test verifies bounded cancellation behavior. ChangesSidecar response bounds
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: ⚪ Minimal · up to Anthropic web-search sidecar responses now stop reading oversized error and unterminated SSE bodies at the existing limit, reducing memory exposure while retaining complete frames. The bounded behavior and cancellation path are covered, with no current merge-blocking risk identified. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
리뷰 · 우선순위 66 / 80이 PR은 Anthropic 웹검색 사이드카가 응답을 읽을 때 메모리가 한없이 커질 수 있던 구멍을 막는 수정이다. 지금 이번 변경은 그 두 곳을 같은 정책으로 맞춥니다. 라인 75 - 메인테이너의 판단이 필요한 지점
너의 추천 이 댓글은 grok-bot이 작성했습니다 |
`parseAnthropicSidecarSSE` folded frames only when it found a `\n\n` separator, and appended every decoded chunk to `buffer` until then. An upstream that streams without ever emitting a separator therefore grew the buffer for the whole response. The non-OK branch had the same shape: it read the untrusted error body with an unbounded `res.text()` just to build one auth-failure message. Reuse the existing `MAX_SIDECAR_RESPONSE_BYTES` cap and the reader-cancel helper that `parseSidecarSSE` already applies in the same folder, so both paths stop reading at the same 64 KiB bound. Frames folded before the cap are kept; only the unterminated tail is dropped. `cancelReaderWithoutWaiting` is exported for this, unchanged. The regression drives a stream that never terminates a frame and asserts the read is cancelled well before the producer finishes. It fails without the cap and passes with it.
c25bdab to
5d490f7
Compare
|
@coderabbitai review |
|
…carry #3839) [skip ci] fix(web-search): bound Anthropic sidecar SSE and error reads
|
Landed on |
lidge-jun
added
the
landed-via-maintainer
2 participants
Summary
Bound the Anthropic web-search sidecar's SSE and HTTP error-body reads to the existing 64 KiB
MAX_SIDECAR_RESPONSE_BYTESlimit. A response without a frame separator previously kept growing the parser buffer, and the HTTP failure path read the entire body withres.text().The parser retains complete frames received before the limit and discards the unfinished tail. It reuses the Responses sidecar's limit and non-blocking reader-cancellation helper without changing that helper's behavior.
Verification
Head
5d490f7c053f8eabdd2815b72b2ea5cdcf9cfa73, rebased ontodevd00615d5696a9c6b7f1a3006181e57569b012920.bun run test ./tests/web-search/ --timeout 60000: 176 passed, 0 failed across 10 files.bun run typecheck,bun run privacy:scan, andgit diff --check: passed.Full-suite validation remains outstanding. The prior review-ready attestation has been withdrawn; this PR stays draft until the remaining validation is complete. There is no UI change.
Checklist
Review readiness checklist