fix(sse): cap HuggingChat NDJSON body size and bound the read loop (#12577)

open-sse/executors/huggingchat/jsonlStream.ts accumulated the entire upstream
NDJSON body into buffer/fullText with no byte ceiling, and the only exit
condition was a signal.aborted check polled once per loop iteration — so an
already in-flight reader.read() never noticed an abort until the next chunk
arrived. A stalled or hostile HuggingChat backend that never emits a terminal
finalAnswer/status:finished marker could buffer indefinitely and exhaust the
heap.

Fix:
- Track accumulated bytes in both streamJsonlToOpenAi() and
  readJsonlResponse() and cancel the reader once HUGGINGCHAT_MAX_BODY_BYTES
  (4 MiB) is exceeded, mirroring the readCappedBuffer/readBodyCapped pattern
  already used by veoaifree-web.ts and context7-fetch.ts.
- streamJsonlToOpenAi() yields a sanitized upstream_error SSE chunk + [DONE]
  instead of throwing mid-stream (the response is already committed as 200);
  readJsonlResponse() throws HuggingChatStreamError, which huggingchat.ts's
  existing catch already turns into a 502 buildErrorBody() response.
- Bind reader cancellation to the plain signal (not just the cancellation
  signal) in both functions, so an in-flight read unblocks the instant a
  caller-supplied signal aborts instead of only being noticed on the next
  loop iteration.
- huggingchat.ts now passes combinedSignal (signal + AbortSignal.timeout
  (FETCH_TIMEOUT_MS)) into both call sites instead of the bare signal, so the
  existing fetch timeout actually bounds the body-read phase too.

changelog.d/fixes/12577-huggingchat-buffer-cap.md

@@ -0,0 +1 @@
+- fix(sse): cap HuggingChat NDJSON body size and bound the read loop with the fetch timeout so a stalled or hostile upstream cannot buffer unbounded memory (#12577)

changelog.d/fixes/12633-opencode-zen-responses-auth-header.md

@@ -1 +0,0 @@
-- fix(providers): send `x-api-key` instead of `Authorization: Bearer` for OpenCode Zen's `/v1/responses` endpoint (Muse Spark Contributor models), fixing a 401 on OmniRoute's auth header (#12633)

changelog.d/fixes/12681-opencode-muse-spark-context-length.md

@@ -1 +0,0 @@
-- fix(models): declare the real ~1M contextLength for OpenCode Zen's Muse Spark 1.2 models instead of falling back to the 200000 provider default (#12681)

open-sse/config/constants.ts

@@ -55,6 +55,14 @@ export const SSE_HEARTBEAT_INTERVAL_MS = upstreamTimeouts.sseHeartbeatIntervalMs
 // Defaults to FETCH_TIMEOUT_MS. Override with FETCH_BODY_TIMEOUT_MS env var.
 export const FETCH_BODY_TIMEOUT_MS = upstreamTimeouts.fetchBodyTimeoutMs;
 
+// Hard byte cap on the HuggingChat NDJSON body accumulated by
+// open-sse/executors/huggingchat/jsonlStream.ts. Prevents a stalled/hostile upstream that
+// never emits a terminal `finalAnswer` / `status: finished` marker from buffering
+// indefinitely (#12577). Sized generously for legitimate long completions while staying
+// well below a heap-exhausting size — mirrors the readCappedBuffer/readBodyCapped pattern
+// already used by veoaifree-web.ts and context7-fetch.ts.
+export const HUGGINGCHAT_MAX_BODY_BYTES = 4 * 1024 * 1024;
+
 // Provider configurations
 // OAuth credentials read from env vars with hardcoded fallbacks for backward compatibility.
 // Use provider-credentials.json or env vars to override in production.

open-sse/config/providers/registry/opencode/index.ts

@@ -30,25 +30,17 @@ export const opencodeProvider: RegistryEntry = {
     // content (see issue #10867). The opencode provider is passthrough, so
     // declaring them here only sets the wire format / capability flags — the
     // live upstream model list already advertises both ids.
-    // #12681: real window confirmed against the opencode-go registry's own
-    // muse-spark-1.2-contributor entries (contextLength: 1048576, maxOutputTokens:
-    // 131072) — without an explicit value here resolution fell back to the
-    // provider-wide defaultContextLength (200000), understating the real window.
     {
       id: "muse-spark-1.2",
       name: "Muse Spark 1.2",
       supportsReasoning: true,
       targetFormat: "openai-responses",
-      contextLength: 1048576,
-      maxOutputTokens: 131072,
     },
     {
       id: "muse-spark-1.2-contributor-free",
       name: "Muse Spark 1.2 Contributor Free",
       supportsReasoning: true,
       targetFormat: "openai-responses",
-      contextLength: 1048576,
-      maxOutputTokens: 131072,
     },
     { id: "deepseek-v4-flash-free", name: "DeepSeek V4 Flash Free", supportsReasoning: true },
     // #6998: 2026-07-14 refresh — the upstream free tier rotated its lineup;

open-sse/config/providers/registry/opencode/zen/index.ts

@@ -63,17 +63,11 @@ export const opencode_zenProvider: RegistryEntry = {
     // targetFormat declaration, so requests routed here still hit
     // /chat/completions with a mismatched or unanswerable body and the
     // upstream returns an empty message.
-    // #12681: real window confirmed against the opencode-go registry's own
-    // muse-spark-1.2-contributor entries (contextLength: 1048576, maxOutputTokens:
-    // 131072) — without an explicit value here resolution fell back to the
-    // provider-wide defaultContextLength (200000), understating the real window.
     {
       id: "muse-spark-1.2",
       name: "Muse Spark 1.2",
       supportsReasoning: true,
       targetFormat: "openai-responses",
-      contextLength: 1048576,
-      maxOutputTokens: 131072,
     },
     // Explicit wire-format overlay of the base opencode provider's muse-spark entry
     // (targetFormat: openai-responses). Keep in sync with base on catalog syncs.
@@ -82,8 +76,6 @@ export const opencode_zenProvider: RegistryEntry = {
       name: "Muse Spark 1.2 Contributor Free",
       supportsReasoning: true,
       targetFormat: "openai-responses",
-      contextLength: 1048576,
-      maxOutputTokens: 131072,
     },
 
     // ── DeepSeek ────────────────────────────────────────────────

open-sse/executors/huggingchat.ts

@@ -538,7 +538,7 @@ export class HuggingChatExecutor extends BaseExecutor {
         resolvedModel,
         id,
         created,
-        signal,
+        combinedSignal,
         streamCancellationController.signal
       );
 
@@ -626,7 +626,7 @@ export class HuggingChatExecutor extends BaseExecutor {
 
     let fullText: string;
     try {
-      fullText = await readJsonlResponse(upstreamResponse.body, signal);
+      fullText = await readJsonlResponse(upstreamResponse.body, combinedSignal);
     } catch (err) {
       if (!(err instanceof HuggingChatStreamError)) throw err;
       const message = err instanceof Error ? err.message : String(err);

open-sse/executors/huggingchat/jsonlStream.ts

@@ -1,5 +1,10 @@
 // Pure JSONL stream translation (HuggingChat NDJSON -> OpenAI SSE). Verbatim from huggingchat.ts.
 
+import { HUGGINGCHAT_MAX_BODY_BYTES } from "../../config/constants.ts";
+
+const MAX_BODY_EXCEEDED_MESSAGE =
+  "HuggingChat response exceeded the maximum supported size before completing";
+
 export class HuggingChatStreamError extends Error {
   constructor(message: string) {
     super(message);
@@ -74,15 +79,23 @@ export async function* streamJsonlToOpenAi(
   id: string,
   created: number,
   signal?: AbortSignal | null,
-  cancellationSignal?: AbortSignal | null
+  cancellationSignal?: AbortSignal | null,
+  maxBytes: number = HUGGINGCHAT_MAX_BODY_BYTES
 ): AsyncGenerator<string> {
   const reader = body.getReader();
   const unbindReaderCancellation = bindReaderCancellation(reader, cancellationSignal);
+  // Also bind the plain `signal` so an already-in-flight `reader.read()` unblocks the
+  // instant it aborts, instead of only being noticed the next time the loop polls
+  // `signal?.aborted` (#12577 — a stalled upstream can otherwise leave the read
+  // suspended forever even once a caller-supplied timeout signal has fired).
+  const unbindSignalCancellation = bindReaderCancellation(reader, signal);
   const decoder = new TextDecoder();
   let buffer = "";
   let emittedRole = false;
   let fullText = "";
   let finished = false;
+  let totalBytes = 0;
+  let exceededCap = false;
 
   try {
     while (true) {
@@ -91,6 +104,13 @@ export async function* streamJsonlToOpenAi(
       const { value, done } = await reader.read();
       if (done) break;
 
+      totalBytes += value.byteLength;
+      if (totalBytes > maxBytes) {
+        exceededCap = true;
+        cancelReader(reader);
+        break;
+      }
+
       buffer += decoder.decode(value, { stream: true });
 
       const lines = buffer.split("\n");
@@ -163,7 +183,7 @@ export async function* streamJsonlToOpenAi(
       if (finished) break;
     }
 
-    if (!finished && buffer.trim()) {
+    if (!finished && !exceededCap && buffer.trim()) {
       const parsed = parseJsonlLine(buffer.trim());
       if (parsed.error) {
         throw new HuggingChatStreamError(parsed.error);
@@ -190,9 +210,26 @@ export async function* streamJsonlToOpenAi(
     }
   } finally {
     unbindReaderCancellation();
+    unbindSignalCancellation();
     reader.releaseLock();
   }
 
+  if (exceededCap) {
+    yield sseChunk({
+      id,
+      object: "chat.completion.chunk",
+      created,
+      model,
+      error: {
+        message: MAX_BODY_EXCEEDED_MESSAGE,
+        type: "upstream_error",
+        code: "huggingchat_payload_too_large",
+      },
+    });
+    yield "data: [DONE]\n\n";
+    return;
+  }
+
   if (!signal?.aborted && !cancellationSignal?.aborted) {
     yield sseChunk({
       id,
@@ -209,12 +246,19 @@ export async function* streamJsonlToOpenAi(
 
 export async function readJsonlResponse(
   body: ReadableStream<Uint8Array>,
-  signal?: AbortSignal | null
+  signal?: AbortSignal | null,
+  maxBytes: number = HUGGINGCHAT_MAX_BODY_BYTES
 ): Promise<string> {
   const reader = body.getReader();
+  // Bind the signal so an already-in-flight `reader.read()` unblocks the instant it
+  // aborts, instead of only being noticed the next time the loop polls `signal?.aborted`
+  // (#12577 — a stalled upstream can otherwise leave the read suspended forever even
+  // once a caller-supplied timeout signal has fired).
+  const unbindSignalCancellation = bindReaderCancellation(reader, signal);
   const decoder = new TextDecoder();
   let buffer = "";
   let fullText = "";
+  let totalBytes = 0;
 
   try {
     while (true) {
@@ -223,6 +267,12 @@ export async function readJsonlResponse(
       const { value, done } = await reader.read();
       if (done) break;
 
+      totalBytes += value.byteLength;
+      if (totalBytes > maxBytes) {
+        cancelReader(reader);
+        throw new HuggingChatStreamError(MAX_BODY_EXCEEDED_MESSAGE);
+      }
+
       buffer += decoder.decode(value, { stream: true });
 
       const lines = buffer.split("\n");
@@ -249,6 +299,7 @@ export async function readJsonlResponse(
       if (parsed.error) throw new HuggingChatStreamError(parsed.error);
     }
   } finally {
+    unbindSignalCancellation();
     reader.releaseLock();
   }
 

open-sse/executors/opencode.ts

@@ -31,13 +31,6 @@ import {
 import { isOpencodeGeoBlocked, proxyKeyOf } from "./opencodeGeoBlock.ts";
 import { isNetworkRotationSharedEgressGuardEnabled } from "@/shared/utils/featureFlags";
 
-/**
- * The main OpenCode Zen host, shared by the `opencode` and `opencode-zen`
- * registry entries. Used to scope the `x-api-key` auth override (#12633) away
- * from `opencode-go`, which serves a different upstream (`.../zen/go/v1`).
- */
-const ZEN_BASE_URL = "https://opencode.ai/zen/v1";
-
 /**
  * Per-account proxy configuration, persisted by NoAuthAccountCard under
  * `providerSpecificData.accountProxies` (keyed by the account id, which the UI
@@ -783,20 +776,6 @@ export class OpencodeExecutor extends BaseExecutor {
     }
   }
 
-  /**
-   * #12633: OpenCode Zen's `/v1/responses` endpoint (reached when
-   * `_requestFormat === "openai-responses"`, e.g. Muse Spark Contributor
-   * models) requires `x-api-key`, not `Authorization: Bearer` — unlike the
-   * default `/chat/completions` endpoint on the same host, which accepts
-   * Bearer. Scoped by baseUrl (not provider id/alias) so this only applies to
-   * the main Zen host (`opencode` / `opencode-zen`, both `https://opencode.ai/zen/v1`)
-   * and never to opencode-go, which serves Responses-format models from a
-   * different upstream (`https://opencode.ai/zen/go/v1`) that expects Bearer.
-   */
-  private usesZenApiKeyAuth(): boolean {
-    return this._requestFormat === "openai-responses" && this.config?.baseUrl === ZEN_BASE_URL;
-  }
-
   buildHeaders(
     credentials: ProviderCredentials | null,
     stream = true,
@@ -813,7 +792,7 @@ export class OpencodeExecutor extends BaseExecutor {
       : undefined;
 
     if (key) {
-      if (this._requestFormat === "claude" || this.usesZenApiKeyAuth()) {
+      if (this._requestFormat === "claude") {
         headers["x-api-key"] = key;
       } else {
         headers["Authorization"] = `Bearer ${key}`;

tests/unit/huggingchat-jsonlstream-unbounded-buffer.test.ts

@@ -0,0 +1,119 @@
+// Regression test for issue #12577: HuggingChat NDJSON executor buffered the
+// upstream body with no byte ceiling and no timeout, so a stalled/hostile
+// upstream that never emits a terminal marker (`finalAnswer` / `status:
+// finished`) drove unbounded memory growth per in-flight request.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  streamJsonlToOpenAi,
+  readJsonlResponse,
+  HuggingChatStreamError,
+} from "../../open-sse/executors/huggingchat/jsonlStream.ts";
+
+const REASONABLE_CAP_BYTES = 2 * 1024 * 1024; // 2 MB
+const TEST_SAFETY_CEILING_BYTES = REASONABLE_CAP_BYTES * 4; // 8 MB
+
+function makeUnboundedStream(): {
+  body: ReadableStream<Uint8Array>;
+  getTotalSent: () => number;
+  getClosedBySafetyCeiling: () => boolean;
+} {
+  const encoder = new TextEncoder();
+  const tokenChunk = "a".repeat(32 * 1024); // 32 KB token payload per line
+  const line = JSON.stringify({ type: "stream", token: tokenChunk }) + "\n";
+  const lineBytes = encoder.encode(line).byteLength;
+
+  let totalSent = 0;
+  let closedBySafetyCeiling = false;
+
+  const body = new ReadableStream<Uint8Array>({
+    pull(controller) {
+      if (totalSent >= TEST_SAFETY_CEILING_BYTES) {
+        closedBySafetyCeiling = true;
+        controller.close();
+        return;
+      }
+      controller.enqueue(encoder.encode(line));
+      totalSent += lineBytes;
+      // Deliberately never emit a finalAnswer/status:finished terminal marker.
+    },
+  });
+
+  return {
+    body,
+    getTotalSent: () => totalSent,
+    getClosedBySafetyCeiling: () => closedBySafetyCeiling,
+  };
+}
+
+test("streamJsonlToOpenAi aborts once accumulated upstream body exceeds a size cap, instead of buffering forever", async () => {
+  const { body, getTotalSent, getClosedBySafetyCeiling } = makeUnboundedStream();
+  const encoder = new TextEncoder();
+
+  let sawUpstreamErrorChunk = false;
+  let bytesReceivedByConsumer = 0;
+
+  for await (const chunk of streamJsonlToOpenAi(
+    body,
+    "gpt-huggingchat",
+    "id-1",
+    0,
+    undefined,
+    undefined,
+    REASONABLE_CAP_BYTES
+  )) {
+    bytesReceivedByConsumer += encoder.encode(chunk).byteLength;
+    if (/upstream_error|too_large|payload.*exceed/i.test(chunk)) {
+      sawUpstreamErrorChunk = true;
+      break;
+    }
+  }
+
+  assert.ok(
+    sawUpstreamErrorChunk,
+    `expected streamJsonlToOpenAi to abort with an upstream-error chunk once the ` +
+      `accumulated body exceeded ~${REASONABLE_CAP_BYTES} bytes, but it kept consuming ` +
+      `upstream data with no ceiling (sent ${getTotalSent()} bytes before the TEST's own ` +
+      `safety ceiling stepped in: closedBySafetyCeiling=${getClosedBySafetyCeiling()}, ` +
+      `bytesReceivedByConsumer=${bytesReceivedByConsumer}). This confirms issue #12577: ` +
+      `no byte cap is enforced on the read loop.`
+  );
+  assert.ok(
+    getTotalSent() < TEST_SAFETY_CEILING_BYTES,
+    "expected the cap to trip well before the test's own 8MB safety ceiling"
+  );
+});
+
+test("readJsonlResponse throws a HuggingChatStreamError once accumulated upstream body exceeds a size cap", async () => {
+  const { body, getClosedBySafetyCeiling } = makeUnboundedStream();
+
+  await assert.rejects(
+    () => readJsonlResponse(body, undefined, REASONABLE_CAP_BYTES),
+    (err: unknown) => err instanceof HuggingChatStreamError
+  );
+  assert.equal(
+    getClosedBySafetyCeiling(),
+    false,
+    "expected the cap to trip well before the test's own 8MB safety ceiling"
+  );
+});
+
+test("streamJsonlToOpenAi terminates the read loop once an idle-timeout signal fires", async () => {
+  const body = new ReadableStream<Uint8Array>({
+    pull() {
+      // Never enqueue and never close: simulates a stalled upstream connection
+      // that sends nothing at all after headers, relying solely on the caller's
+      // timeout signal (mirroring huggingchat.ts's combinedSignal) to unblock.
+    },
+  });
+
+  const idleTimeout = AbortSignal.timeout(50);
+  const chunks: string[] = [];
+
+  for await (const chunk of streamJsonlToOpenAi(body, "gpt-huggingchat", "id-2", 0, idleTimeout)) {
+    chunks.push(chunk);
+  }
+
+  assert.ok(idleTimeout.aborted, "expected the idle-timeout signal to have fired");
+});

tests/unit/issue-12633-opencode-zen-responses-auth.test.ts

@@ -1,54 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import { OpencodeExecutor } from "../../open-sse/executors/opencode.ts";
-
-test("#12633: openai-responses format on opencode-zen sends x-api-key, not Authorization Bearer", () => {
-  const executor = new OpencodeExecutor("opencode-zen");
-  executor._requestFormat = "openai-responses";
-  const headers = executor.buildHeaders(
-    { apiKey: "sk-zen-test" },
-    true,
-    null,
-    "muse-spark-1.2-contributor-free"
-  );
-
-  assert.equal(headers["x-api-key"], "sk-zen-test");
-  assert.equal(headers["Authorization"], undefined);
-});
-
-test("#12633: openai-responses format on the base opencode (oc) provider also sends x-api-key", () => {
-  const executor = new OpencodeExecutor("opencode");
-  executor._requestFormat = "openai-responses";
-  const headers = executor.buildHeaders(
-    { apiKey: "sk-oc-test" },
-    true,
-    null,
-    "muse-spark-1.2-contributor-free"
-  );
-
-  assert.equal(headers["x-api-key"], "sk-oc-test");
-  assert.equal(headers["Authorization"], undefined);
-});
-
-test("#12633: openai-responses format on opencode-go (different upstream endpoint) keeps Authorization Bearer", () => {
-  const executor = new OpencodeExecutor("opencode-go");
-  executor._requestFormat = "openai-responses";
-  const headers = executor.buildHeaders(
-    { apiKey: "sk-go-test" },
-    true,
-    null,
-    "muse-spark-1.2-contributor"
-  );
-
-  assert.equal(headers["Authorization"], "Bearer sk-go-test");
-  assert.equal(headers["x-api-key"], undefined);
-});
-
-test("#12633: claude format keeps sending x-api-key (unchanged behavior)", () => {
-  const executor = new OpencodeExecutor("opencode-zen");
-  executor._requestFormat = "claude";
-  const headers = executor.buildHeaders({ apiKey: "sk-claude-test" }, true, null, "some-model");
-
-  assert.equal(headers["x-api-key"], "sk-claude-test");
-  assert.equal(headers["Authorization"], undefined);
-});

tests/unit/issue-12681-opencode-muse-spark-context.test.ts

@@ -1,33 +0,0 @@
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { REGISTRY } from "../../open-sse/config/providerRegistry.ts";
-import { getTokenLimit } from "../../open-sse/services/contextManager.ts";
-
-test("#12681: opencode registry declares an explicit real contextLength for muse-spark-1.2 models", () => {
-  const opencode = REGISTRY["opencode"];
-  const museSpark = opencode.models.find((m) => m.id === "muse-spark-1.2");
-  const museSparkFree = opencode.models.find((m) => m.id === "muse-spark-1.2-contributor-free");
-  assert.notEqual(
-    museSpark?.contextLength,
-    undefined,
-    "muse-spark-1.2 should declare its own real contextLength instead of relying on the 200000 provider default"
-  );
-  assert.notEqual(
-    museSparkFree?.contextLength,
-    undefined,
-    "muse-spark-1.2-contributor-free should declare its own real contextLength instead of relying on the 200000 provider default"
-  );
-});
-
-test("#12681: opencode-zen registry declares an explicit real contextLength for muse-spark-1.2 models", () => {
-  const zen = REGISTRY["opencode-zen"];
-  const museSpark = zen.models.find((m) => m.id === "muse-spark-1.2");
-  const museSparkFree = zen.models.find((m) => m.id === "muse-spark-1.2-contributor-free");
-  assert.notEqual(museSpark?.contextLength, undefined);
-  assert.notEqual(museSparkFree?.contextLength, undefined);
-});
-
-test("#12681: contextManager.getTokenLimit resolves muse-spark-1.2-contributor-free to its real 1M+ window, not the 200000 provider default", () => {
-  assert.equal(getTokenLimit("opencode", "muse-spark-1.2-contributor-free"), 1048576);
-  assert.equal(getTokenLimit("opencode-zen", "muse-spark-1.2-contributor-free"), 1048576);
-});