alkhttp/tasks/adapters/review-001-response-decode-fidelity.md at 12b35e2c5f8bb16217d937296ca6df9135318843

Files

T

glm-5.3-flash 12b35e2c5f docs(tasks): decompose review 001 remediation Units 1-5 into taskgraph tasks

21 review-001 tasks across server/adapters/client/gateway/websocket/infra,
chunked from the 7-unit remediation plan in
docs/reviews/001-initial-implementation-review.md.

- Scope split by mechanism, not one-per-finding: 15 tasks in generation 1
  (parallelizable), 6 sequenced after their file-sharing precursors
- Deliberately deferred until dependent fixes land: projection/doc
  fidelity partial (Unit 6 beyond dependency hygiene), coverage backfills
  (COV-01..07 via in-task acceptance for forward.rs), and per-finding
  minors (OAI-06/07, HY-02/04/06/10/11, CON-08)
- Cross-crate WS-12 (alkcall demux 4 GiB discard alloc) noted for filing
  in alkcall, not here

taskgraph: validate clean, no cycles, 6 generations

2026-08-29 07:10:15 +00:00

3.2 KiB

Raw Blame History

id, name, status, depends_on, scope, risk, impact, level, tags

name

status

depends_on

scope

risk

impact

level

Description

Review 001 findings on src/adapters/forward.rs's response-decode paths (forward, forward_stream), minus the SSE parser (its own task):

FWD-07: content_type.contains("application/json") (forward.rs:236) misses application/vnd.api+json, application/problem+json, etc. → vendor JSON decoded as a Value::Array of one Number per byte. No response size limit on any read path (json()/text()/bytes()) — a hostile upstream controls caller memory. forward_stream never checks content-type (200 HTML → empty stream, no error). Fix: mime-essence matching (application/.*+json suffix semantics), response size caps on all read paths, and a loud error for non-SSE content on a Sub op.
FWD-08 (forward.rs:104-126, :87-94): invalid credential values (control characters, typo'd header name) silently drop the header — the request goes out unauthenticated and the caller only sees the eventual upstream 401. Fail loudly at call time. (No leak risk today — nothing is logged; keep it that way.)
FWD-10 (forward.rs:215-227, :333-346): upstream error bodies discarded — surfaced message is only "HTTP {status}: {reason}"; upstream diagnostics never reach the caller and unconsumed bodies hinder connection reuse. Surface a bounded error-body echo on the error path; keep the HTTP_<status> mapping as is (correct).
FWD-12: byte-identical duplicates value_to_path_segment/ value_to_query (:133-151); forward's op_type parameter only toggles ACCEPT and its text/ branch would buffer an entire SSE stream if a Sub were ever routed here (currently unreachable, inviting misuse — remove or make safe); the unwrap_or_else(|_| "null") at :197 masks an unreachable serialization failure with a null body; SharedHttpClient::reload performs two separate ArcSwap::store calls.

Acceptance Criteria

application/vnd.api+json (and application/problem+json) decode as JSON, not byte arrays (test)
Response size cap enforced on JSON/text/binary read paths (test)
Non-SSE content-type on a Sub op produces a loud error, not an empty stream (test)
Invalid credential values fail loudly at call time (test), no credential material logged
Upstream 4xx/5xx bodies surface bounded in the error envelope (test)
Duplicate value_to_* helpers collapsed; text/ buffering branch removed or safe; reload atomic
forward.rs COV-01 uncovered regions (binary branch, auth arms, non-2xx mapping, content-type branches) substantially covered
cargo test and cargo clippy --all-targets -- -D warnings pass

References

docs/reviews/001-initial-implementation-review.md (Part D, FWD-07, FWD-08, FWD-10, FWD-12; Part I, COV-01)

Notes

Agent fills during implementation. Shares forward.rs with review-001-forward-url-safety (request side) and review-001-sse-parser — sequence those first or coordinate.

Summary

Filled on completion.

3.2 KiB Raw Blame History