fix(proxy): add tail + EOF caps for complete SSE buffer coverage

wangmiao0668000666 · claude · wangmiao0668000666 · commit caa27dc8b4ea · 2026-06-27T15:18:48.000+08:00
Extend the byte-accurate 1 MiB policy to the unterminated tail (data after last \n) and the EOF final frame, closing the bypass paths identified by ClawSweeper review. The 1 MiB tail cap is deterministic unlike the prior 64 KiB attempt (#96993) because any hostile payload exceeding 1 MiB total bytes triggers the cap regardless of TCP chunking. - Add tail buffer cap after draining complete lines (proxy.ts:237) - Add EOF final frame cap before processSseLine (proxy.ts:246) - 2 new tests: unterminated tail across chunks, no-newline EOF frame Co-Authored-By: Claude <noreply@anthropic.com>
diff --git a/src/agents/runtime/proxy.test.ts b/src/agents/runtime/proxy.test.ts
@@ -284,4 +284,74 @@ describe("streamProxy", () => {
       usage,
     });
   });
+
+  it("rejects an oversized unterminated buffer without newline across multiple chunks", async () => {
+    // First chunk has \n, leaving a 600 KiB unterminated tail in buffer.
+    // Second chunk appends 600 KiB more without \n. The tail cap fires when
+    // the accumulated unterminated tail exceeds 1 MiB.
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => {
+        const encoder = new TextEncoder();
+        const chunkIndex = { current: 0 };
+        return new Response(
+          new ReadableStream({
+            async pull(controller) {
+              if (chunkIndex.current === 0) {
+                // "hello\n" + 600 KiB — has \n, leaves 600 KiB tail
+                controller.enqueue(encoder.encode("hello\n" + "x".repeat(600 * 1024)));
+              } else if (chunkIndex.current === 1) {
+                // 600 KiB more without \n → buffer = 1.2 MiB → tail cap fires
+                controller.enqueue(encoder.encode("y".repeat(600 * 1024)));
+              } else {
+                controller.close();
+              }
+              chunkIndex.current++;
+            },
+          }),
+          { status: 200 },
+        );
+      }),
+    );
+
+    const stream = streamProxy(model, context, {
+      authToken: "token",
+      proxyUrl: "https://proxy.example",
+    });
+    const events = [];
+    for await (const event of stream) {
+      events.push(event);
+    }
+
+    expect(events.at(-1)?.type).toBe("error");
+    const result = await stream.result();
+    expect(result.stopReason).toBe("error");
+    expect(result.errorMessage).toMatch(/exceeds maximum allowed size/i);
+  });
+
+  it("rejects an oversized final frame at EOF without trailing newline", async () => {
+    // Server closes connection after a 1.2 MiB data: line without any \n.
+    // The line is split into lines[0] (the entire data), which triggers the
+    // byte-accurate line cap — proving all buffered data is bounded.
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => {
+        return new Response("data: " + "x".repeat(1200 * 1024));
+      }),
+    );
+
+    const stream = streamProxy(model, context, {
+      authToken: "token",
+      proxyUrl: "https://proxy.example",
+    });
+    const events = [];
+    for await (const event of stream) {
+      events.push(event);
+    }
+
+    expect(events.at(-1)?.type).toBe("error");
+    const result = await stream.result();
+    expect(result.stopReason).toBe("error");
+    expect(result.errorMessage).toMatch(/exceeds maximum allowed size/i);
+  });
 });
diff --git a/src/agents/runtime/proxy.ts b/src/agents/runtime/proxy.ts
@@ -227,6 +227,14 @@ export function streamProxy(
         const lines = buffer.split("\n");
         buffer = lines.pop() || "";
 
+        // Cap the unterminated tail (current in-flight line). At 1 MiB this is
+        // deterministic because total accumulated bytes exceed the cap regardless
+        // of TCP chunking, unlike the prior 64 KiB tail cap (#96993) which was
+        // close enough to legitimate data sizes to produce chunk-dependent results.
+        if (Buffer.byteLength(buffer, "utf-8") > 1024 * 1024) {
+          throw new Error("Proxy SSE buffer exceeds maximum allowed size of 1 MiB");
+        }
+
         for (const line of lines) {
           // Byte-accurate complete-line cap (1 MiB, aligned with sibling SSE handling)
           if (Buffer.byteLength(line, "utf-8") > 1024 * 1024) {
@@ -240,6 +248,10 @@ export function streamProxy(
         throw new Error("Request aborted by user");
       }
       buffer += decoder.decode();
+      // Byte-accurate cap on the EOF final frame (same policy)
+      if (Buffer.byteLength(buffer, "utf-8") > 1024 * 1024) {
+        throw new Error("Proxy SSE buffer exceeds maximum allowed size of 1 MiB");
+      }
       if (buffer.trim()) {
         processSseLine(buffer);
       }
