fix: release bounded response resources

[Ingwannu]

Summary

• replace per-chunk races against long-lived abort/deadline promises with one replaceable current-read waiter, so completed response chunks become collectible while a fragmented body is still open
• preserve exact byte ceilings, EOF, timeout, abort-reason, late-rejection, and best-effort cancellation behavior for both bounded readers
• cancel rejected Devin GetChatMessage bodies once without waiting or replacing the original status error
• document the ownership decision in ADR-5830 and the transport inventory

Verification

• bun test tests/server/bounded-body.test.ts tests/providers/devin-hardening.test.ts — 106 passed, 0 failed
• bun run privacy:scan — passed
• all local checks ran in disposable homes under systemd limits; focused tests used CPUQuota=75%, MemoryHigh=1G, MemoryMax=1536M, MemorySwapMax=0, TasksMax=64, IOWeight=20
• repository typecheck was attempted with the same limits plus GOMAXPROCS=2; it remained within the cap but was stopped rather than occupying the host for several more minutes, so exact-head CI must supply that gate

Risk and compatibility

• no API or configuration shape changes
• cancellation remains best effort and never delays the primary Devin HTTP error
• no Go counterpart was identified: the changed bounded readers and Devin adapter are TypeScript-runtime paths

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Summary by CodeRabbit

• Bug Fixes
  • Failed chat requests now preserve and report the original HTTP error promptly, even when response cleanup fails or takes time.
  • Interrupted response reads handle aborts and timeouts more reliably while preserving existing timeout behavior and response limits.
  • Improved cleanup after failed requests and interrupted reads, including when cleanup fails or remains pending, to avoid retaining unnecessary response data.

[Ingwannu]

@lidge-jun @Wibias please prioritize review of this bounded-response retention fix. It closes a reproduced request-lifetime memory amplification path and an abandoned Devin response-body path; focused tests and privacy scan are green under the documented host limits. @codex review

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 56237940-0759-4d47-b0a3-1edcc3004ef1

📥 Commits

Reviewing files that changed from the base of the PR and between 61dfd02 and 9b7e58c.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 128d329d-2eea-4c1c-b49a-3ff6b774330a

📥 Commits

Reviewing files that changed from the base of the PR and between a9fccd0 and 61dfd02.

📒 Files selected for processing (1)

• src/lib/bounded-body.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

Bounded response readers now use interruptible waits for deadlines and aborts. Devin Cloud chat starts cancellation of non-OK response bodies before throwing the existing status-bearing CloudChatError. Tests and documentation cover both changes.

Changes

Bounded Response Ownership

Layer / File(s)	Summary
Interruptible bounded reads and ownership validation src/lib/bounded-body.ts, tests/server/bounded-body.test.ts, structure/decisions/ADR-0101-bounded-response-ownership.md, structure/transports/inventory.md	Bounded byte and text readers route deadlines and aborts through an interruptible read wait. Tests cover retention during pending reads, abort and timeout cancellation, and exact-cap EOF. The ADR and inventory document the approach and its limits.
Devin non-2xx response cancellation src/adapters/devin/cloud-direct/chat.ts, tests/providers/devin-hardening.test.ts, structure/transports/inventory.md	For non-OK responses, streamChatEvents starts body cancellation without waiting, then throws the existing CloudChatError. Tests cover cancellation that resolves, rejects, throws, or remains pending, and a bodyless response.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 61dfd

The bounded readers preserve the interruption outcome across reads, and Devin error handling starts best-effort body cancellation while retaining the status error. No concrete source-level merge risk is established; standard exact-head checks should still complete.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 61dfd

The changed readers retain their byte limits, deadlines, and cancellation behavior, while rejected Devin responses are now cancelled without delaying the original HTTP error. No security regression was established, but production caller coverage and comparison with the target branch remain incomplete.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — An untrusted upstream response can affect the resource use and outcome of its bounded read or Devin chat turn. The reviewed change does not establish a new route or greater credential authority; the available graph does not establish every production caller.

Trust Boundaries and Controls

• observed — The response stream is the untrusted input. Byte ceilings, caller aborts, text-reader deadlines, and best-effort cancellation constrain its handling. The raw-byte reader has an inactivity deadline only when its caller supplies one.

Resilience and Maintainability Implications

• observed — Focused tests exercise abort racing EOF, late read rejection, exact cancellation reason, and synchronous, rejected, or never-settling cancellation. Devin tests also assert that rejected HTTP bodies are not pulled and the original status error is preserved.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: releasing resources held by bounded response handling. It matches the bounded reader and Devin response-body cancellation work.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-25T09:53:08.700952Z	84b6fbb	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 84b6fbbb79

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[lidge-jun]

리뷰 · 우선순위 64 / 80

응답이 잘게 나뉘어 들어올 때, 이미 버퍼에 넣은 조각이 요청이 끝날 때까지 메모리에 남던 길을 끊는 PR이에요.

예전에는 조각이 하나 올 때마다, 그 읽기를 요청이 살아있는 동안 계속 기다리는 중단·시간제한과 같이 기다렸어요. 오래 사는 쪽에 붙은 연결이, 이미 다 읽은 조각(빈 조각 포함)을 요청이 끝날 때까지 붙잡았어요. 이제는 기다리는 자리가 하나예요. 시간 초과와 중단은 지금 그 자리만 끝내요. 읽기가 끝난 조각은 다음 조각을 받는 동안 치워질 수 있어요.

바이트 상한, 받은 양이 딱 맞으면 본문을 취소하지 않는 것, 시간 초과, 중단 이유, 읽기가 늦게 실패하는 것, 취소가 실패하거나 끝나지 않아도 원래 오류를 지키는 것은 테스트로 고정해 두었어요.

Devin 채팅이 HTTP 오류이면, 아무도 안 읽을 본문을 한 번 취소해요. 취소가 끝나길 기다리지 않고 원래 상태 코드 오류를 던져요. 취소가 거절되거나, 그 자리에서 예외가 나거나, 영원히 안 끝나도 상태 코드는 그대로예요. 본문이 없는 403도 상태 코드만 알려요.

기준 브랜치는 dev예요. 같은 주제로 닫을 다른 PR은 없어요.

tests/server/bounded-body.test.ts no promise accumulates a reaction per completed read - 테스트가 도는 동안 Promise.prototype.then을 통째로 갈아끼워요. 통과 조건은 한 프로미스에 then이 4번 이하예요. 4는 지금 Bun에서 센 횟수예요. 런타임이 같은 프로미스에 then을 한 번 더 붙이면, 누수가 없어도 이 테스트는 실패해요.

tests/server/bounded-body.test.ts completed chunks are collectible during a pending read - 조각 256개 중 4개까지 살아 있으면 통과예요. Bun.gc(true)에 기대고, ADR에도 엔진이 최근 조각 몇 개는 붙잡을 수 있다고 적혀 있어요. 다섯 개만 계속 붙잡는 누수는 이 테스트가 못 잡아요. 엔진이 스택에 다섯 개를 남기면, 누수가 없어도 실패해요.

PR 본문 - 결정 기록을 ADR-5830이라고 적었어요. 실제 파일은 structure/decisions/ADR-0101-bounded-response-ownership.md예요. 번호는 ADR-0100 다음이라 다른 기록과 겹치지 않아요. 본문만 옛 번호예요.

메인테이너의 판단이 필요한 지점

then 4번, 살아 있는 조각 4개. 이 두 눈금을 회귀 테스트로 둘지 정해 주세요. 눈금이 흔들리면 메모리 문제가 돌아왔는지, 런타임이 바뀌었는지 구분이 안 돼요.

실패한 Devin 응답은 취소를 시작만 해요. 오류는 바로 던지고, 취소가 끝날 때까지 기다리지 않아요. 전송 쪽이 취소를 미루면 그 본문은 그동안 남아요. 작성자는 빨리 던지는 쪽을 골랐고 ADR에 적었어요. 그 선택을 유지할지만 보면 돼요.

이 커밋의 저장소 타입체크는 끝까지 안 돌렸어요. 작성자는 호스트를 오래 잡지 않으려고 멈췄다고 했어요. 합치기 전에 CI 타입체크를 볼지 정하면 돼요.

너의 추천

고친 방향은 맞아요. 조각마다 오래 사는 프로미스에 연결을 달던 구조를, 지금 읽는 칸 하나로 바꾼 것이 이 누수의 수정이에요. 닫을 중복 PR은 없어요. PR 본문의 ADR-5830만 ADR-0101로 고치세요. 두 눈금 테스트는 남기되, 실패하면 실제 then 횟수와 살아 있는 조각 수를 메시지에 남기세요. 타입체크는 이 커밋 CI가 통과한 뒤에 합치세요.

이 댓글은 grok-bot이 작성했습니다

[lidge-jun]

Closing and reopening only to rebuild CI against dev after #5847 fixed the shared protocol-direct-encoders-chat failure; no change to this PR.

[lidge-jun]

Maintainer integration by the owner (MAINTAINERS.md 2026-09-06 rule), release round 2.66.0.

Exact-head evidence for 9b7e58c5571d094d489b04d592db6076e8b5de31: Cross-platform CI run 36132628820 (pull_request): success with every required job passed (macOS/Windows/privacy legs skipped by the workflow's path conditions for this diff); React Doctor, hygiene, enforce-target, CodeRabbit passed. Local union proof on dev 6975fc37fe merged with #5835, #5837 and #5826: bun run typecheck 0, the PRs' own tests plus layout/ratchet/parity tests 376 pass / 0 fail, structure:check passed; re-checked with git merge-tree against the current dev tip before merging. No review threads.