fix(provider): bound binary response reads

vincentkoc · vincentkoc · commit 79691d485847 · 2026-05-29T13:24:19.000+02:00
diff --git a/src/agents/provider-http-errors.test.ts b/src/agents/provider-http-errors.test.ts
@@ -6,9 +6,35 @@ import {
   extractProviderErrorInfo,
   extractProviderRequestId,
   ProviderHttpError,
+  readProviderBinaryResponse,
   readProviderJsonResponse,
 } from "./provider-http-errors.js";
 
+function createStreamingBinaryResponse(params: {
+  chunkCount: number;
+  chunkSize: number;
+  byte: number;
+}): { response: Response; getReadCount: () => number } {
+  let reads = 0;
+  const stream = new ReadableStream<Uint8Array>({
+    pull(controller) {
+      if (reads >= params.chunkCount) {
+        controller.close();
+        return;
+      }
+      reads += 1;
+      controller.enqueue(new Uint8Array(params.chunkSize).fill(params.byte));
+    },
+  });
+  return {
+    response: new Response(stream, {
+      status: 200,
+      headers: { "Content-Type": "audio/mpeg" },
+    }),
+    getReadCount: () => reads,
+  };
+}
+
 describe("provider error utils", () => {
   it("formats nested provider error details with request ids", async () => {
     const response = new Response(
@@ -147,4 +173,20 @@ describe("provider error utils", () => {
       "Provider catalog failed: malformed JSON response",
     );
   });
+
+  it("caps successful binary responses instead of buffering oversized bodies", async () => {
+    const streamed = createStreamingBinaryResponse({
+      chunkCount: 20,
+      chunkSize: 1024,
+      byte: 121,
+    });
+
+    await expect(
+      readProviderBinaryResponse(streamed.response, "Provider TTS failed", "audio", {
+        maxBytes: 2048,
+      }),
+    ).rejects.toThrow("Provider TTS failed: audio response exceeds 2048 bytes");
+
+    expect(streamed.getReadCount()).toBeLessThan(20);
+  });
 });
diff --git a/src/agents/provider-http-errors.ts b/src/agents/provider-http-errors.ts
@@ -1,10 +1,12 @@
 export { asFiniteNumber } from "../shared/number-coercion.js";
 import { redactSensitiveText } from "../logging/redact.js";
+import { readResponseWithLimit } from "../media/read-response-with-limit.js";
 import { normalizeOptionalString as trimToUndefined } from "../shared/string-coerce.js";
 export { asBoolean } from "../utils/boolean.js";
 export { normalizeOptionalString as trimToUndefined } from "../shared/string-coerce.js";
 
 const ERROR_BODY_METADATA_LIMIT = 500;
+const PROVIDER_BINARY_RESPONSE_MAX_BYTES = 16 * 1024 * 1024;
 
 export function asObject(value: unknown): Record<string, unknown> | undefined {
   return typeof value === "object" && value !== null && !Array.isArray(value)
@@ -321,9 +323,15 @@ export async function readProviderBinaryResponse(
   response: Response,
   label: string,
   kind = "binary",
+  opts?: {
+    maxBytes?: number;
+  },
 ): Promise<Uint8Array> {
   assertProviderBinaryResponseContent(response, label, kind);
-  const bytes = new Uint8Array(await response.arrayBuffer());
+  const maxBytes = opts?.maxBytes ?? PROVIDER_BINARY_RESPONSE_MAX_BYTES;
+  const bytes = await readResponseWithLimit(response, maxBytes, {
+    onOverflow: ({ maxBytes }) => new Error(`${label}: ${kind} response exceeds ${maxBytes} bytes`),
+  });
   if (bytes.byteLength === 0) {
     throw new Error(`${label}: malformed ${kind} response`);
   }
