feat(agent-harness): bound and sanitize model streams

[iscekic]

No new behavior — the new streaming support is not connected to a user-facing feature.

---

Summary

The server-only streamHarnessModel forwards Server-Sent Events (SSE) incrementally; boundedBody caps input at 1 mebibyte before decoding, and mediaType normalizes response types.
StreamEnvelope, StreamEvent, and StreamError validate OpenAI-compatible software development kit (SDK) data and errors while preserving provider extensions.
StreamContext requires caller-supplied cancellation signals and sanitized error callbacks; the mirrored, unexported SDK schema must stay aligned with SDK contract changes.

Files

• apps/web/src/lib/agent-harness/model-stream.ts — Added source, 153 lines. Counts cumulative bytes before strict 8-bit Unicode Transformation Format (UTF-8) decoding and raises PAYLOAD_TOO_LARGE above 1,048,576 bytes. Parses multiline SSE and ignores unknown fields or invalid retry values without buffering the complete response. Validates known fields, then re-encodes the original JavaScript Object Notation (JSON) value to retain unknown provider data. Preserves text, both reasoning forms, tool calls and signatures, identifiers, finish reasons, costs, and detailed or separate usage. Retains caller headers, copies only upstream request-id, and sets content-type: text/event-stream plus content-encoding: identity. Rejects unsuccessful responses with their original status; wrong media types or missing bodies on successful responses return sanitized 422 JSON. Cancels rejected bodies without forwarding their contents. Structured errors accept integer-compatible codes from 400–599; invalid codes become 422. Errors become terminal SSE events through failure; parsing and transport failures use errorStatus with 422 as the invalid-data fallback. After streaming starts, errors retain response status 200 and end the stream with sanitized events instead of another [DONE] marker. End-of-stream, [DONE], errors, and cancellation abort upstream work, cancel the reader, and release its lock. Caller signals also carry request cancellation and deadlines; empty and terminal-only output remain valid.
• apps/web/src/lib/agent-harness/model-stream.test.ts — Added tests, 230 lines. Covers incremental reads through the OpenAI-compatible SDK, multiline events, split UTF-8, usage, reasoning, tool extensions, headers, and completion markers. Covers exact and exceeded byte limits, malformed fields, structured errors, failed reads, invalid responses, empty output, cancellation, deadlines, and cleanup.

Tests: 1 file added — model-stream.test.ts (+230/−0 lines); the supplied report records 34 passing cases.
Generated: 0 files changed.

---

Verification

Manual and end-to-end verification: not run because this level adds an internal helper without an endpoint or complete user journey.
Authenticated proxy composition, billed dispatch, Worker deployment, and cross-client verification remain outside this level.

Visual Changes

Visual Changes: N/A

Reviewer Notes

Human steps

This level requires no human setup before or after merge.
Product pull request merges remain human-owned.

Recorded checks

• The supplied repair report records 34 passing Jest cases, including nine regression cases that failed before the repair.
• The report records passing scoped formatting, lint, and whitespace checks.
• The Jest run disables global setup and post-environment hooks; it does not verify a live provider or public endpoint.
• This description round did not rerun product checks. The evidence does not include repository-wide lint, tests, type checks, or builds.

Notes

• Runtime verification remains pending until the complete backend, browser, iOS, and Android integration reaches the stack tip.
• Font-scaling variants, including large text and dynamic type: owner-descoped.
• Light, dark, and other theme variants, including variant-only geometry: owner-descoped.
• Visual contrast, scaled-text layout, and screen-reader presentation checks: owner-descoped.

Stacked PRs — merge bottom to top. Each level shows only its own diff.

Runtime verification (E2E, user advocacy, simplify) runs on the tip PR over every level.
Every level keeps its own checks, its own bot review, and its own threads; each one is answered on its own PR.
Each level is its own deliverable: it builds and passes its own checks alone.
A finding on a level is repaired on that level, then carried upward with stack.sh forward.

1. shared-agent-harness-3bb0 — chore(agent-harness): register workspaces and enforce CI boundaries #5632
2. shared-agent-harness-3bb0-s2 — feat(agent-harness): define portable domain and snapshots #5637
3. shared-agent-harness-3bb0-s3 — feat(agent-harness): define commands tools and permission policy #5639
4. shared-agent-harness-3bb0-s4 — feat(agent-harness): share client state and cursor recovery #5643
5. shared-agent-harness-3bb0-s5 — feat(agent-harness): persist command intents and execution receipts #5647
6. shared-agent-harness-3bb0-s6 — feat(db): add harness ingress grants and retirement fences #5655
7. shared-agent-harness-3bb0-s7 — feat(agent-harness): deliver legacy history and project durable text #5659
8. shared-agent-harness-3bb0-s8 — feat(agent-harness): authorize durable grants and registered clients #5662
9. shared-agent-harness-3bb0-s9 — feat(agent-harness): fence retirement and retry payload cleanup #5667
10. shared-agent-harness-3bb0-s10 — feat(agent-harness): persist authoritative state in SQLite #5675
11. shared-agent-harness-3bb0-s11 — feat(agent-harness): admit durable runs and revisioned commands #5678
12. shared-agent-harness-3bb0-s12 — feat(agent-harness): recover queued runs and stream checkpointed steps #5688
13. shared-agent-harness-3bb0-s13 — feat(agent-harness): resolve interactions and dispatch tools sequentially #5693
14. shared-agent-harness-3bb0-s14 — feat(agent-harness): fence designated client tool execution #5697
15. shared-agent-harness-3bb0-s15 — feat(agent-harness): synchronize durable snapshots and legacy history #5701
16. shared-agent-harness-3bb0-s16 — feat(agent-harness): reuse authorized invitations with durable replay #5704
17. shared-agent-harness-3bb0-s17 — feat(integrations): bound repository transport for harness reads #5710
18. shared-agent-harness-3bb0-s18 — feat(integrations): expose bounded authorized repository reads #5714
19. shared-agent-harness-3bb0-s19 — feat(agent-harness): expose named authorized resource reads #5718
20. shared-agent-harness-3bb0-s20 — feat(sessions): bound history transport for harness reads #5724
21. shared-agent-harness-3bb0-s21 — feat(agent-harness): read scoped Cloud Agent context and progress #5726
22. shared-agent-harness-3bb0-s22 — fix(agent-harness): preserve ordered Cloud Agent dispatch identity #5731
23. shared-agent-harness-3bb0-s23 — feat(agent-harness): hand coding work to authorized Cloud Agent sessions #5733
24. shared-agent-harness-3bb0-s24 — feat(agent-harness): authorize scoped MCP gateway connections #5737
25. shared-agent-harness-3bb0-s25 — feat(agent-harness): bound MCP gateway transport in the Worker #5740
26. shared-agent-harness-3bb0-s26 — feat(agent-harness): execute validated remote MCP tools #5743
27. shared-agent-harness-3bb0-s27 — refactor(exa): share provider dispatch and usage recording #5746
28. shared-agent-harness-3bb0-s28 — feat(agent-harness): authorize bounded web provider requests #5747
29. shared-agent-harness-3bb0-s29 — feat(agent-harness): normalize web sources and preserve citations #5749
30. shared-agent-harness-3bb0-s30 — feat(agent-harness): define closed internal operation contracts #5753
31. shared-agent-harness-3bb0-s31 — feat(agent-harness): authorize internal maintenance operations #5754
32. shared-agent-harness-3bb0-s32 — feat(agent-harness): authorize named Kilo operation dispatch #5755
33. shared-agent-harness-3bb0-s33 — feat(agent-harness): authorize internal provider operations #5757
34. shared-agent-harness-3bb0-s34 — feat(agent-harness): secure the internal operations endpoint #5758
35. shared-agent-harness-3bb0-s35 — feat(agent-harness): bound and sanitize model streams #5767 ← this PR
36. shared-agent-harness-3bb0-s36 — feat(agent-harness): secure billed model inference #5776
37. shared-agent-harness-3bb0-s37 — test(agent-harness): cover model gateway security boundaries #5777 (tip)

[kilo-code-bot]

WARNING: close() is not idempotent and can throw on releaseLock()

cancel() always calls close(), which aborts signal before cancelling the reader. Aborting the pipeThrough signal rejects a pending reader.read() in pull(), so the catch path also await close(). The second call hits reader.releaseLock() after the lock is already released and throws TypeError, which can surface as an unhandled rejection during client disconnect.

Guard close() with a once-flag (and/or try/catch around releaseLock()) so cleanup is safe to invoke from both cancel and catch.

---

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/web/src/lib/agent-harness/model-stream.ts	101	close() is not idempotent; concurrent cancel/catch can releaseLock() twice

Files Reviewed (2 files)

• apps/web/src/lib/agent-harness/model-stream.ts - 1 issue
• apps/web/src/lib/agent-harness/model-stream.test.ts - 0 issues

Fix these issues in Kilo Cloud

---

_{Reviewed by grok-4.6 · Input: 159.6K · Output: 30.8K · Cached: 465.9K}

_{Review guidance: REVIEW.md from base branch shared-agent-harness-3bb0-s34}

[iscekic]

Closing: the owner stopped this workflow section. The branch is retained.