fix(v2): raise request body limit to 32 MiB by Nyattie · Pull Request #282 · ex-machina-co/opencode-anthropic-auth

Nyattie · 2026-09-29T20:51:59Z

Fixes #277.

MAX_REQUEST_BODY_BYTES was 10 MiB, but the Anthropic Messages API accepts 32 MB. opencode resends every image in a session's history each turn, so a handful of screenshots pushes the body past 10 MiB. The plugin throws before the request leaves, and because the throw comes from the http.request hook, opencode never sees a provider rejection. It can't compact its way out, so the session stays stuck.

This raises the limit to 32 MiB. Past that, opencode already trims old images at 25 MiB, and it treats Anthropic's 413 request_too_large as an overflow and compacts.

The other fix suggested in #277 was to pass oversized bodies through unchanged. That wouldn't work, because every OAuth request needs the rewrite.

Adds a test that rewrites a 12 MiB image body. It fails on the old limit
Updates the existing limit tests to 32 MiB
Adds a patch changeset

bun test (440 pass), bun run types and bun run lint are clean locally.

changeset-bot · 2026-09-29T20:52:06Z

🦋 Changeset detected

Latest commit: 506a687

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@ex-machina/opencode-anthropic-auth	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-09-29T20:52:13Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Advanced
Run ID: 5b7945d0-b877-4517-9488-9c758a0f3218

📥 Commits

Reviewing files that changed from the base of the PR and between 7ba6444 and 506a687.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Walkthrough

The maximum Anthropic request body size increases from 10 MiB to 32 MiB. Tests cover rewriting a 12 MiB image request while preserving image data, and update checks for oversized declared and reconstructed requests. A patch changeset records the limit increase.

Priority: ➖ Normal

Severity of issue fixed: Medium

Merge Risk: 🔵 Low · up to 7ba64

Only near-limit requests risk a provider 413 after rewriting. The issue is bounded, but the outgoing size should be capped if full near-limit support is expected.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 7ba64

Larger image requests can now proceed through the existing bounded rewrite path. This increases per-request processing demand, but the reviewed code retains its size limit and credential-routing checks. No security bypass was established.

Retained concerns

Low · security · inferred: Accepting bodies up to 32 MiB increases transient read and rewrite memory per concurrent request. The hook shows no aggregate body-read cap; whether callers can drive enough concurrent requests to create an availability issue is unresolved.

Security review details

Security Blast Radius

inferred — The larger accepted window applies to request rewriting and reconstructed alias lookup, but the available evidence does not establish direct external access to the host request hook.

Security Findings and Attack Paths

inferred — If a caller can induce sufficiently many concurrent large requests, the higher per-request read and rewrite allowance may increase process resource pressure. External reachability and host-level concurrency controls are unverified.

Trust Boundaries and Controls

observed — The increased allowance does not remove the hook’s provider, OAuth, trusted-origin, declared-length, or streamed-byte checks.

Resilience and Maintainability Implications

observed — Reconstructed alias lookup remains capped and applies the same body limit; successful and unsuccessful response paths retain lease-release handling.

Hardening Proposals

proposed — If host requests can arrive concurrently from untrusted sources, assess peak memory under 32 MiB reads and whether an aggregate in-flight body budget is warranted.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the primary change: increasing the request body limit to 32 MiB.
Description check	✅ Passed	The description is directly related to the changeset and explains the limit increase, affected image-heavy requests, tests, and validation results.
Linked Issues check	✅ Passed	The PR implements the coding requirement in `#277`. `src/index.ts` raises `MAX_REQUEST_BODY_BYTES` from 10 MiB to 32 MiB. The limit therefore no longer rejects requests at the issue's 10 MiB threshold. …
Out of Scope Changes check	✅ Passed	The changed files support `#277`. The source change raises the request limit. The test changes verify the new limit and OAuth request rewriting. The changeset documents the release change. No unrelated …
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: 04d789cb-f084-4e60-a398-760940bb8b2c

📥 Commits

Reviewing files that changed from the base of the PR and between 0e5ab09 and 7ba6444.

📒 Files selected for processing (3)

.changeset/roomy-images-fit.md
src/index.ts
src/tests/index.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

seaweeduk · 2026-10-01T23:01:05Z

been running this fix locally hope @eXamadeus can ship it as I was hitting the 10MB limit often without it and it was breaking my chats

The 10 MiB cap rejected image-heavy sessions that Anthropic accepts, since the Messages API limit is 32 MB. opencode resends every image in the history on each turn, so a few screenshots were enough to hit it. Because the error is thrown from the http.request hook, opencode never sees a provider rejection and cannot compact its way out, which left those sessions permanently stuck. Fixes ex-machina-co#277

greptile-apps · 2026-10-04T06:22:35Z

Confidence Score: 4/5

[Medium risk] Raises the request body size limit for API calls.

The PR appears safe to merge, with a non-blocking peak-memory concern for concurrent image-heavy requests.

Summary

The PR raises the OAuth request-body limit from 10 MiB to 32 MiB, adds an image-heavy rewrite test, updates limit fixtures, and adds a patch changeset.

The larger allowance increases potential peak memory use when image-heavy requests are rewritten concurrently.

_{Reviews (1) · Last reviewed commit: "fix(v2): raise request body limit to 32 ..."}

…-limit

iamhenry · 2026-10-08T18:16:48Z

Looking forward to this. Thank you so much.

coderabbitai Bot reviewed Sep 29, 2026

View reviewed changes

Comment thread src/index.ts Resolved

Nyattie force-pushed the fix/v2-request-body-limit branch from 7ba6444 to 506a687 Compare October 4, 2026 06:20

greptile-apps Bot reviewed Oct 4, 2026

View reviewed changes

Comment thread src/index.ts Resolved

tomdewildt added a commit to tomdewildt/opencode-anthropic-auth that referenced this pull request Oct 8, 2026

Merge pull request ex-machina-co#282 from Nyattie/fix/v2-request-body…

3b5c0e8

…-limit

eXamadeus approved these changes Oct 8, 2026

View reviewed changes

eXamadeus merged commit 44823b6 into ex-machina-co:v2/main Oct 8, 2026
3 checks passed

amadeus-ex-machina Bot mentioned this pull request Oct 8, 2026

chore(v2): version next package (next) #289

Merged

olobarius mentioned this pull request Oct 18, 2026

fix(core): recover sessions after HTTP 413 payload rejections anomalyco/opencode#53107

Open

OverHash mentioned this pull request Oct 29, 2026

Raise request body limit from 32MiB to 128MiB #307

Merged

Navigation Menu

Repository navigation

fix(v2): raise request body limit to 32 MiB - #282

fix(v2): raise request body limit to 32 MiB#282
eXamadeus merged 1 commit into
ex-machina-co:v2/mainfrom
Nyattie:fix/v2-request-body-limit

Nyattie commented Sep 29, 2026

Uh oh!

changeset-bot Bot commented Sep 29, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 29, 2026 •

edited

Loading

Review skipped

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

seaweeduk commented Oct 1, 2026

Uh oh!

greptile-apps Bot commented Oct 4, 2026 •

edited

Loading

Uh oh!

Uh oh!

iamhenry commented Oct 8, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

Nyattie commented Sep 29, 2026

Uh oh!

changeset-bot Bot commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

coderabbitai Bot commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Walkthrough

Security Architecture Review

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

seaweeduk commented Oct 1, 2026

Uh oh!

greptile-apps Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 4/5

Summary

Uh oh!

Uh oh!

iamhenry commented Oct 8, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

changeset-bot Bot commented Sep 29, 2026 •

edited

Loading

coderabbitai Bot commented Sep 29, 2026 •

edited

Loading

greptile-apps Bot commented Oct 4, 2026 •

edited

Loading