fix(web-search): bound Anthropic sidecar SSE and error reads

[lidge-jun]

Summary

Carry #3839 with a 64 KiB accepted-byte bound for Anthropic web-search SSE and HTTP error bodies. Preserve complete prefix frames and discard unterminated tails at the cap. Regression fixtures cover exact/oversized chunks, HTTP 401/503 and reader cancellation that never settles.

Verification

• Cross-platform CI: all required per-chain jobs SUCCESS, exact top head f1b8f2d2f1edee55b68202469f86a5334710688d: Linux 4, macOS 2, gates, storage, API, all keyring/npm smokes and Docker. Overall run status is completed / success; this is not an assertion that every workflow job passed.
• Explicit user policy defers the six Windows test shards and macos control to one run on the final release-train head. They are excluded only from this per-chain LANDABLE decision. Windows keyring/npm smoke jobs remain required. Lower product CI is represented by the cumulative top-head result.
• Attempt 1 macOS 1/2 timed out before a test result in codex-inject-write-lock.test.ts. Main explicitly authorized retrying the failed job at the unchanged head. The required-job evidence above uses each job's latest attempt; earlier failure is retained in run history. Independent Astra diagnosis found no proven C-cache interaction, and the same-head macOS control passed that file.
• Local tests/typecheck/build/install: NOT RUN, explicitly prohibited for this train. Runtime verification is remote CI only.
• git diff --check: passed.
• Darwin, independent Astra high explorer: PASS for source/security review at the pinned layer head (byte bounds, detached cancellation and safe error projection).

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Manual dependent PR chain

Native stack: null. Review only this layer’s diff. Main integrates bottom-up after refreshing dev ancestry, live heads/bases, review threads and required gates. This task does not merge. The CI-tested cumulative top tree is the integration target; advancing dev requires another cascade and top-head verification.

Layer	Source	PR	Head
1	#3839	#3873	51b44371860b2ec933d66de1b68ca790be3b81fb
2	#3841	#3874	8eaa5641902b84bec6c97a94de6c2fe6d810c31d
3	#3863	#3875	91b54b79bc780011031b00354621cc9fcaef360e
4	#3860	#3876	abbdb227f385443228656c8440282187cb5dec75
5	#3252	#3878	f1b8f2d2f1edee55b68202469f86a5334710688d

---

Maintainer integration decision (MAINTAINERS.md, dev-only admin integration): @lidge-jun integrates lane C's manual chain (#3873 → #3874 → #3875 → #3876 → #3878) into dev bottom-up. Chain-top evidence at head f1b8f2d2f: Cross-platform CI run 34116228181, aggregate ci = success (attempt 2: macos 1/2 timed out at 20 min in attempt 1 after codex-inject-write-lock.test.ts with no output; independent diagnosis found no causal link to this chain and the same head's macos control passed those tests; the failed job alone was rerun and passed — no code change). Windows 6/6 and macos control also green on this head. Prospective merge tree of origin/dev@522ce5f8c + top = e0b0e5886 = tested tree. Independent source/security/GUI reviews PASS per PR bodies; screenshots from this run's dashboard-preview artifact. Local suites NOT RUN. Maintainer integration, not self-approval.

Summary by CodeRabbit

• New Features

  • Added an opt-in dashboard setting to open Codex without signing in.
  • Added a sub-agent fallback configuration editor with ordered models, polling interval, and save controls.
  • Added catalog-refresh status visibility in the dashboard.

• Improvements

  • Settings health information now loads without blocking the dashboard.
  • Sync and settings controls are disabled while changes are being saved.

• Bug Fixes

  • Limited processing of oversized search, vision, and error responses to prevent excessive buffering.
  • Preserved saved preferences and displayed errors when synchronization fails.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 0077eee0-0648-4f8e-99cd-d92a880f2d88

📥 Commits

Reviewing files that changed from the base of the PR and between 522ce5f and 51b4437.

📒 Files selected for processing (9)

• devlog/_plan/260907_lane_c/000_plan.md
• devlog/_plan/260907_lane_c/010_web_search.md
• devlog/_plan/260907_lane_c/020_vision.md
• devlog/_plan/260907_lane_c/030_health.md
• devlog/_plan/260907_lane_c/040_desktop.md
• devlog/_plan/260907_lane_c/050_fallback.md
• src/web-search/anthropic-executor.ts
• src/web-search/parse.ts
• tests/web-search/web-search-anthropic.test.ts

---

📝 Walkthrough

Walkthrough

Lane C adds roadmap documents for web search, vision, health, desktop, and sub-agent fallback work. It also implements 64KiB bounds and cancellation behavior for Anthropic web-search streams and error bodies, with regression tests.

Changes

Lane C roadmap

Layer / File(s)	Summary
Release-train roadmap devlog/_plan/260907_lane_c/000_plan.md	Documents dependent PR order, verification, ownership, rollback, escalation, audit notes, and append-only i18n rules.

Anthropic web-search bounds

Layer / File(s)	Summary
Bounded stream and error-body handling src/web-search/anthropic-executor.ts, src/web-search/parse.ts, devlog/_plan/260907_lane_c/010_web_search.md	Limits SSE and upstream error-body reads to 64KiB. It cancels readers without waiting and discards incomplete tail frames.
Boundary and cancellation regression coverage tests/web-search/web-search-anthropic.test.ts	Tests unterminated frames, complete prefix preservation, non-settling cancellation, and bounded 401/503 error-body reads.

Anthropic vision bounds

Layer / File(s)	Summary
Vision sidecar hardening contract devlog/_plan/260907_lane_c/020_vision.md	Documents the 64KiB vision SSE and error-body limits, cancellation behavior, incomplete-frame handling, and regression tests.

Startup-health snapshots

Layer / File(s)	Summary
Non-blocking settings health devlog/_plan/260907_lane_c/030_health.md	Documents cached or conservative settings health snapshots, stale diagnostics, background refreshes, dependency-injected reads, and coverage.

Codex Desktop authless preference

Layer / File(s)	Summary
Authless Codex Desktop setting devlog/_plan/260907_lane_c/040_desktop.md	Documents the opt-in setting, persistence, sync failure behavior, catalog state, localization, documentation, and tests.

Sub-agent fallback editor

Layer / File(s)	Summary
Fallback chain editor devlog/_plan/260907_lane_c/050_fallback.md	Documents fallback model editing, polling configuration, API loading and saving, session-cache persistence, localization, and regressions.

Estimated code review effort: 4 (Complex) | ~45 minutes

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/260907-c1-anthropic-search

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

리뷰 · 우선순위 70 / 80

이 PR은 #3839를 Lane C 맨 아래(base=dev)로 올린 캐리입니다. Anthropic web-search 사이드카 SSE와 HTTP error body에 64 KiB 상한을 겁니다. 완성된 prefix 프레임은 남기고, 상한에서 잘린 미완성 tail은 버립니다. 취소가 settle되지 않아도 호출자가 hang 하지 않도록 cancelReaderWithoutWaiting을 재사용합니다.

지금 dev의 src/web-search/anthropic-executor.ts는 Responses 파서(parse.ts의 MAX_SIDECAR_RESPONSE_BYTES = 64 * 1024)와 달리 Anthropic SSE buffer가 separator 없이 커질 수 있고, 실패 분기는 res.text()로 임의 크기 body를 읽습니다. 이 캐리는 같은 상수를 import하고, readBoundedText로 error body를 자른 뒤 SSE 루프에도 responseBytes 카운터를 넣습니다. parse.ts에서는 cancelReaderWithoutWaiting만 export로 엽니다.

테스트는 exact/oversized chunk와 never-settling cancel을 고정합니다. astra-high(Darwin) PASS. Lane C 전체 plan 문서(devlog/_plan/260907_lane_c/*)가 이 PR에 같이 들어 있지만, 제품 diff는 executor+parse+테스트로 작고 types/config 분할과 무관합니다. 체인 순서는 3873 → 3874 → 3875 → 3876 → 3878입니다. Cross-platform CI는 top head 8f8ac0d(run 34106956362)에서 한 번 도는 정책입니다.

anthropic-executor.ts parseAnthropicSidecarSSE - 64KiB 수락 후 cancel, 완성 프레임 보존·미완성 tail 폐기
anthropic-executor.ts readBoundedText - error body 상한. auth 메시지용 prefix만 사용
parse.ts cancelReaderWithoutWaiting export - Responses와 동일한 teardown 계약
web-search-anthropic.test.ts - exact/oversized/cancel 회귀
devlog _plan/260907_lane_c/* - 레인 전체 plan이 layer 1에 포함. 제품 스코프와 분리해 읽으면 됨

메인테이너의 판단이 필요한 지점

• top head CI(8f8ac0d / run 34106956362) 초록 후 bottom-up 머지할지
• 원본 fix(web-search): bound the Anthropic sidecar SSE and error bodies #3839 landed-via 시점
• lane plan 문서를 layer 1에 두는 관례를 계속할지(노이즈 vs 단일 출처)

너의 추천
Lane C 1층으로 머지하세요. Responses 사이드카와 같은 64KiB 계약을 Anthropic web-search에 맞추는 최소·정확한 캐리입니다. CI 확인 뒤 넣고 #3839는 landed-via로 닫은 다음 #3874로 이어가세요.

이 댓글은 grok-bot이 작성했습니다

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T11:55:04.616075Z	51b4437	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.