fix(codex): bound warmup response bodies

[luvs01]

Summary

• Bound successful Codex warmup SSE responses to 1 MiB of raw bytes and return a typed stream_too_large failure above the limit.
• Read non-2xx warmup bodies through the shared bounded-body helper with a 2 KiB cap, strict UTF-8 handling, and display-safe detail gating.
• Keep response cancellation non-blocking so a hostile or broken stream cancel callback cannot hold the warmup path open.

Exact base: cce29958ae62fc07f64631226eb8485584496b71
Exact head: 9589a7a0b7d177ee941f25cfa79ed9c23be901ef

Verification

• Bun 1.3.14: bun test --isolate --timeout 60000 tests/bounded-body.test.ts tests/cancel-body-on-abort.test.ts tests/codex-warmup.test.ts tests/warmup.test.ts — 52 pass, 0 fail, 131 assertions.
• Bun 1.4.0-canary.1: same command — 52 pass, 0 fail, 131 assertions.
• bun run typecheck — pass on both runtimes.
• bun run privacy:scan — pass on both runtimes.
• git diff --check — clean.
• Independent correctness/lifecycle review — CLEAN, no P0–P2 findings.
• Codex Security diff scan fcb01e0c-dffd-4771-9718-73eb65a5a3ba — CLEAN, complete coverage, snapshot digest 0ec14ede02b9fd4c0dbff9faaadd3eab8b2ec2478bbde80cf93309f385502515.
• The security-scanned patch and rebased exact-head patch have the same stable patch ID fbe53146e7d9934d4a65a28c34c7448e40701a5d.
• Full repository suite was not rerun; maintained exact-head cross-platform CI remains required.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed (no public configuration or CLI contract changed).
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Summary by CodeRabbit

• Bug Fixes

  • Warmup requests now safely limit streamed responses to 1 MiB.
  • Oversized streams return a clear stream_too_large error.
  • Error responses no longer expose excessive upstream details.
  • Timeout and cancellation handling is more reliable, including invalid timeout values.

• Tests

  • Added coverage for size limits, cancellation behavior, timeout validation, and protected error responses.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: a6705121-498e-45de-b050-6d7da8387a85

📥 Commits

Reviewing files that changed from the base of the PR and between cce2995 and 9589a7a.

📒 Files selected for processing (3)

• src/codex/warmup.ts
• tests/codex-warmup.test.ts
• tests/warmup.test.ts

---

📝 Walkthrough

Walkthrough

Warmup HTTP error bodies now use bounded reads, and SSE responses have a 1 MiB limit. Oversized streams return stream_too_large. Request timeouts are reused for body reads. Response bodies are canceled during cleanup. Tests cover size limits, cancellation, error redaction, and invalid timeouts.

Changes

Warmup response safety

Layer / File(s)	Summary
Bounded response processing src/codex/warmup.ts (lines 1-4, 35-46, 104-113), tests/codex-warmup.test.ts (lines 63-97)	CodexWarmupError.code includes stream_too_large. SSE processing rejects responses above 1 MiB and accepts a completed response at exactly 1 MiB. HTTP error details use bounded, signal-aware, fatal-UTF-8 reads.
Timeout and response cleanup src/codex/warmup.ts (lines 147-150, 165-188), tests/codex-warmup.test.ts (lines 118-122), tests/warmup.test.ts (lines 67-100)	The request and error-body read reuse one timeout signal. Response bodies are canceled while synchronous and asynchronous cancellation failures are suppressed. Tests cover negative timeout classification, oversized error responses, redacted upstream details, and cancellation.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 9589a

The PR bounds warmup response bodies and keeps cancellation non-blocking; no actionable merge-blocking risk remains after normal checks and review.

Possibly related PRs

• lidge-jun/opencodex#866: Modifies bounded HTTP response handling, cancellation, and fail-closed error processing.
• lidge-jun/opencodex#1095: Modifies SSE handling with bounded reads, cancellation, and oversized-stream behavior.
• lidge-jun/opencodex#1396: Adds bounded response reads with cancellation, timeout propagation, and oversized-response tests.

Suggested labels: bug

Suggested reviewers: lidge-jun

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: bounding warmup response bodies.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⏳ DRAFT

• review readiness checklist open (2/4 boxes ticked).

What to do

• Tick all four boxes in the PR description once you're done (currently 2/4).

Review readiness checklist

• ⬜ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

2/4 boxes ticked.

This PR stays in draft until every box above is ticked.

Hygiene

✅ Deterministic PR hygiene checks passed.

[luvs01]

@coderabbitai review

Please review exact head 9589a7a0b7d177ee941f25cfa79ed9c23be901ef.

[coderabbitai]

@luvs01 I will review pull request #1725 at exact head 9589a7a0b7d177ee941f25cfa79ed9c23be901ef.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[lidge-jun]

Solid hardening fix — bounding the warmup drain and reusing readBoundedResponseBody with the shared abort signal is exactly the shape we want, and the boundary/cancel tests are thorough. Keeping as draft pending the contributor readiness checklist and a maintainer-triggered full CI run (fork PRs can't start repository CI). Flagging for maintainer CI.