@bitkyc08/opencodex 2.10.0 → 2.10.1

package/src/integrations/writer.ts

@@ -0,0 +1,492 @@
+/**
+ * Apply, disable and restore an opencodex provider block in a client's config.
+ *
+ * Everything here exists to keep one promise: a toggle can always be undone.
+ * That means every mutation snapshots first, writes atomically, and journals
+ * what it did — and that a mutation refuses rather than guesses whenever the
+ * file is not in a state we can reason about. A disable that deletes work the
+ * user did after us would be worse than never shipping the feature.
+ *
+ * Design of record: devlog/_plan/260802_client_toggle_api/030 and 031.
+ */
+import { dirname } from "node:path";
+import { EXPORT_CLIENTS, type ExportModel } from "../clients/config-export";
+import { isLoopbackHostname } from "../codex/inject";
+import type { OcxConfig } from "../types";
+import { PARSE_FAILED, defaultIntegrationIO, loadTarget, parseConfig, type IntegrationIO } from "./config-io";
+import { fingerprint, canonicalContribution, fragmentPathsOf, type OwnershipRecord } from "./ownership";
+import { createdContainerPaths, mergeContribution, removeFragments } from "./merge";
+import { INTEGRATION_CLIENTS, isLoopbackOnly, type IntegrationClientId } from "./registry";
+import { classifyIntegration, exportContextOf } from "./state";
+import type { IntegrationState } from "./state";
+import { serializeDocument, UnserializableValueError } from "./serialize";
+import { ClientPathError } from "../clients/config-export";
+import { matchesOperationResult, newOpId, type JournalEntry } from "./journal";
+import { createIntegrationStateStore, type IntegrationStateStore } from "./store";
+
+export type RefusalReason =
+  | "not_installed"
+  | "conflict"
+  | "unsafe"
+  | "non_loopback"
+  | "drift_requires_confirm"
+  | "snapshot_expired"
+  | "write_failed";
+
+export interface WriteOk {
+  ok: true;
+  changed: boolean;
+  state: IntegrationState;
+  clientId: IntegrationClientId;
+  opId?: string;
+  message: string;
+}
+
+export interface WriteRefused {
+  ok: false;
+  reason: RefusalReason;
+  state: IntegrationState;
+  clientId: IntegrationClientId;
+  message: string;
+  /** Absolute path of a recoverable snapshot, when one exists. */
+  snapshotPath?: string;
+  /** True when compensation itself failed and the file is intermediate. */
+  residual?: boolean;
+}
+
+export type WriteOutcome = WriteOk | WriteRefused;
+
+export interface IntegrationWriteInput {
+  clientId: IntegrationClientId;
+  models: readonly ExportModel[];
+  config: OcxConfig;
+  port: number;
+  env?: NodeJS.ProcessEnv;
+  home?: string;
+  store?: IntegrationStateStore;
+  io?: IntegrationIO;
+}
+
+export interface IntegrationRestoreInput extends IntegrationWriteInput {
+  opId: string;
+  confirmDrift?: boolean;
+}
+
+function refuse(
+  clientId: IntegrationClientId,
+  reason: RefusalReason,
+  state: IntegrationState,
+  message: string,
+  snapshotPath?: string,
+): WriteRefused {
+  return { ok: false, reason, state, clientId, message, ...(snapshotPath ? { snapshotPath } : {}) };
+}
+
+function messageOf(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+interface CommitArgs {
+  io: IntegrationIO;
+  store: IntegrationStateStore;
+  clientId: IntegrationClientId;
+  configPath: string;
+  before: string | null;
+  nextText: string | null;
+  record: OwnershipRecord | null;
+  priorRecord: OwnershipRecord | null;
+  entry: JournalEntry;
+  state: IntegrationState;
+  snapshotPath?: string;
+}
+
+/**
+ * Client file, then ownership record, then journal row.
+ *
+ * The row is last on purpose: a record without a row is a thin history, while
+ * a row without a record would advertise an operation the classifier cannot
+ * corroborate. If either bookkeeping step fails we put the file back AND
+ * restore the ownership the operation replaced.
+ */
+function commit(args: CommitArgs): WriteOutcome {
+  const { io, clientId, configPath } = args;
+  try {
+    if (args.nextText === null) io.removeFile(configPath);
+    else {
+      io.mkdirp(dirname(configPath));
+      io.writeText(configPath, args.nextText);
+    }
+  } catch (error) {
+    return refuse(clientId, "write_failed", args.state, messageOf(error), args.snapshotPath);
+  }
+  try {
+    if (args.record) io.putRecord(args.record);
+    else io.dropRecord(clientId);
+  } catch (error) {
+    return compensate(args, error, "could not record ownership");
+  }
+  try {
+    io.appendJournal(args.entry);
+  } catch (error) {
+    return compensate(args, error, "could not append the journal row");
+  }
+  return {
+    ok: true,
+    changed: true,
+    state: args.state,
+    clientId,
+    opId: args.entry.opId,
+    message: "ok",
+  };
+}
+
+function compensate(args: CommitArgs, cause: unknown, what: string): WriteRefused {
+  const { io, clientId, configPath } = args;
+  try {
+    if (args.before === null) io.removeFile(configPath);
+    else io.writeText(configPath, args.before);
+    if (args.priorRecord) io.putRecord(args.priorRecord);
+    else io.dropRecord(clientId);
+  } catch {
+    // Say so. A false "rolled back" is worse than the original error, because
+    // the user would stop looking for the file we left half-written.
+    return {
+      ok: false,
+      reason: "write_failed",
+      state: args.state,
+      clientId,
+      residual: true,
+      ...(args.snapshotPath ? { snapshotPath: args.snapshotPath } : {}),
+      message: `${what}, and the change could not be rolled back. The file or its ownership record is in an intermediate state; the backup is at ${args.snapshotPath ?? "(none)"}.`,
+    };
+  }
+  return refuse(clientId, "write_failed", args.state, `${what}; the change was rolled back. Cause: ${messageOf(cause)}`, args.snapshotPath);
+}
+
+function snapshotAbsPath(store: IntegrationStateStore, entry: JournalEntry): string | undefined {
+  const snapshot = store.readSnapshot(entry);
+  return snapshot.kind === "stored" ? snapshot.path : undefined;
+}
+
+/** Shared preflight: detect, gate, read, parse and classify. */
+function preflight(input: IntegrationWriteInput) {
+  const store = input.store ?? createIntegrationStateStore();
+  const io = input.io ?? defaultIntegrationIO(store);
+  const clientId = input.clientId;
+  const spec = INTEGRATION_CLIENTS[clientId];
+  const exportSpec = EXPORT_CLIENTS[clientId];
+  /*
+   * Resolution itself can refuse: a relative OPENCLAW_* selector is rejected
+   * because we cannot know the gateway's working directory. That is a refusal
+   * about the user's configuration, not an internal fault, so it must not
+   * escape as an exception — the collection route would answer 500 for the
+   * whole Integrations page because one client is misconfigured.
+   */
+  let configPath: string;
+  try {
+    configPath = spec.configPath(input.env, input.home);
+  } catch (error) {
+    if (!(error instanceof ClientPathError)) throw error;
+    return { failed: refuse(clientId, "unsafe", "unsafe", error.message) } as const;
+  }
+  store.retryPendingPrunes();
+
+  const target = loadTarget(io, configPath);
+  if (!target.ok) {
+    return {
+      failed: refuse(clientId, "unsafe", "unsafe",
+        target.why === "read-failed"
+          ? `${configPath} exists but could not be read`
+          : `${configPath} is not a regular file`),
+    } as const;
+  }
+  const before = target.before;
+  const parsed = parseConfig(before, exportSpec.format);
+  if (parsed === PARSE_FAILED) {
+    return { failed: refuse(clientId, "unsafe", "unsafe", `${configPath} could not be parsed`) } as const;
+  }
+  const contribution = exportSpec.buildContribution(exportContextOf(input));
+  // A record proves ownership of the file it was written FOR. Matching only by
+  // client id let a record for one home authorize a write to another whose
+  // bytes happened to hash the same — which deleted a config we never touched.
+  const stored = store.readRecords()[clientId] ?? null;
+  const record = stored && stored.clientId === clientId && stored.configPath === configPath
+    ? stored
+    : null;
+  // `configPath`/`clientId` are load-bearing, not decoration: a record proves
+  // ownership of ONE file, and the writer mutates whatever path resolves NOW.
+  // Without them a record written for another home directory would grant
+  // ownership here and disable would delete fragments it never wrote.
+  const classified = classifyIntegration({
+    fileText: before, fileIsRegular: true, parsed, record, contribution, configPath, clientId,
+  });
+  return { failed: undefined, store, io, clientId, spec, exportSpec, configPath, before, parsed, contribution, record, classified } as const;
+}
+
+export function applyIntegration(input: IntegrationWriteInput): WriteOutcome {
+  const pre = preflight(input);
+  if (pre.failed) return pre.failed;
+  const { store, io, clientId, spec, exportSpec, configPath, before, parsed, contribution, record, classified } = pre;
+
+  if (io.statKind(spec.detectDir(input.env, input.home)) !== "dir") {
+    return refuse(clientId, "not_installed", "absent", `${clientId} is not installed`);
+  }
+  if (isLoopbackOnly(clientId) && !isLoopbackHostname(input.config.hostname)) {
+    return refuse(clientId, "non_loopback", classified.state,
+      `${clientId} has nowhere to put the admission header a non-loopback bind requires, so a generated config would be rejected — and writing one by hand would not help either. Give it loopback access instead, through a tunnel or a local forwarder.`);
+  }
+  if (classified.state === "conflict") {
+    return refuse(clientId, "conflict", "conflict",
+      classified.reason === "foreign-edit"
+        ? `${configPath} changed after opencodex wrote it`
+        : `${configPath} already contains an opencodex block we did not write`);
+  }
+  /*
+   * `unsafe` from the classifier means the document is not one we may write
+   * through — today that is a container on our fragment path holding a
+   * non-object value the merge would replace with `{}`. Unreadable and
+   * unparseable files are caught earlier in preflight; this branch exists
+   * because the classifier can also refuse a file it CAN read.
+   */
+  if (classified.state === "unsafe") {
+    return refuse(clientId, "unsafe", "unsafe",
+      classified.reason === "blocked-container"
+        ? `${configPath} holds a value where opencodex would have to write a section, so applying would replace it`
+        : `${configPath} cannot be changed safely`);
+  }
+  if (classified.state === "current") {
+    return { ok: true, changed: false, state: "current", clientId, message: "already applied" };
+  }
+
+  // A stale refresh drops what the PREVIOUS record owned before merging: a
+  // model that left the catalog would otherwise stay behind as an orphan the
+  // new record no longer covers, and disable could never remove it.
+  /*
+   * The previous record's `createdContainers` has to travel with this removal.
+   * Without it the refresh leaves our own empty scaffolding behind in `base`,
+   * `createdContainerPaths` then sees the container already present and
+   * concludes the user owns it, and the replacement record forgets we made it
+   * — so a later disable strands it forever.
+   */
+  const base = classified.state === "stale" && record
+    ? removeFragments(parsed, record.fragmentPaths, new Set(record.createdContainers ?? [])).doc
+    : parsed;
+  // Computed against the document as it stands BEFORE the merge: afterwards
+  // every container exists and "did we create this?" is unanswerable.
+  const created = createdContainerPaths(base, contribution);
+  /*
+   * A document can hold a value its own format cannot round-trip through our
+   * renderers. That used to throw straight out of the writer and reach the
+   * user as a 500 with no path and no advice; it is a refusal like any other,
+   * and the file is untouched because this happens before any write.
+   */
+  let text: string;
+  try {
+    text = serializeDocument(mergeContribution(base, contribution), exportSpec.format);
+  } catch (error) {
+    if (!(error instanceof UnserializableValueError)) throw error;
+    return refuse(clientId, "unsafe", "unsafe",
+      `${configPath} contains something opencodex cannot rewrite safely (${error.message}), so it was left alone`);
+  }
+
+  // Compare-before-commit: someone may have written between classify and now.
+  const recheck = io.readText(configPath);
+  const rechecked = recheck.kind === "text" ? recheck.text : recheck.kind === "missing" ? null : undefined;
+  if (rechecked === undefined || rechecked !== before) {
+    return refuse(clientId, "conflict", "conflict", `${configPath} changed while applying`);
+  }
+
+  const opId = newOpId();
+  const snapshot = store.captureSnapshot(clientId, opId, before);
+  const at = new Date(io.now()).toISOString();
+  const entry: JournalEntry = {
+    opId, clientId, kind: classified.state === "stale" ? "refresh" : "apply", at, configPath,
+    snapshot, resultFingerprint: fingerprint(text), resultAbsent: false, priorRecord: record,
+  };
+  return commit({
+    io, store, clientId, configPath, before, nextText: text, state: "current",
+    priorRecord: record,
+    record: {
+      clientId, configPath, fileFingerprint: fingerprint(text),
+      blockFingerprint: fingerprint(canonicalContribution(contribution)),
+      fragmentPaths: fragmentPathsOf(contribution), createdContainers: created,
+      appliedAt: at, opId,
+    },
+    entry,
+    snapshotPath: snapshotAbsPath(store, entry),
+  });
+}
+
+export function disableIntegration(input: IntegrationWriteInput): WriteOutcome {
+  const pre = preflight(input);
+  if (pre.failed) return pre.failed;
+  const { store, io, clientId, exportSpec, configPath, before, parsed, record, classified } = pre;
+
+  if (classified.state === "absent") {
+    return { ok: true, changed: false, state: "absent", clientId, message: "not applied" };
+  }
+  if (classified.state === "conflict") {
+    return refuse(clientId, "conflict", "conflict",
+      classified.reason === "foreign-edit"
+        ? `${configPath} changed after opencodex wrote it; disabling would discard that edit`
+        : `${configPath} contains an opencodex block we did not write`);
+  }
+  /*
+   * `unsafe` reaches here the same way it reaches apply, and the code below
+   * dereferences `record` on the assumption that anything past this point is
+   * `current` or `stale`. A blocked container has no record, so disable threw
+   * a TypeError and the route answered 500 — the GUI locks the switch, but the
+   * CLI and direct API callers do not.
+   */
+  if (classified.state === "unsafe") {
+    return refuse(clientId, "unsafe", "unsafe",
+      classified.reason === "blocked-container"
+        ? `${configPath} holds a value where opencodex would have to read a section, so nothing can be removed safely`
+        : `${configPath} cannot be changed safely`);
+  }
+
+  // current | stale only: the file fingerprint still matches our record, so the
+  // recorded paths are exactly what we put there.
+  const { doc, removed } = removeFragments(
+    parsed,
+    record!.fragmentPaths,
+    new Set(record!.createdContainers ?? []),
+  );
+  if (!removed) {
+    return { ok: true, changed: false, state: "absent", clientId, message: "nothing to remove" };
+  }
+  let text: string;
+  try {
+    text = serializeDocument(doc, exportSpec.format);
+  } catch (error) {
+    if (!(error instanceof UnserializableValueError)) throw error;
+    return refuse(clientId, "unsafe", "unsafe",
+      `${configPath} contains something opencodex cannot rewrite safely (${error.message}), so nothing was removed`);
+  }
+
+  const recheck = io.readText(configPath);
+  const rechecked = recheck.kind === "text" ? recheck.text : recheck.kind === "missing" ? null : undefined;
+  if (rechecked === undefined || rechecked !== before) {
+    return refuse(clientId, "conflict", "conflict", `${configPath} changed while disabling`);
+  }
+
+  const opId = newOpId();
+  const snapshot = store.captureSnapshot(clientId, opId, before);
+  const at = new Date(io.now()).toISOString();
+  const entry: JournalEntry = {
+    opId, clientId, kind: "disable", at, configPath, snapshot,
+    resultFingerprint: fingerprint(text), resultAbsent: false, priorRecord: record,
+  };
+  return commit({
+    io, store, clientId, configPath, before, nextText: text, state: "absent",
+    record: null, priorRecord: record, entry,
+    snapshotPath: snapshotAbsPath(store, entry),
+  });
+}
+
+export function restoreIntegration(input: IntegrationRestoreInput): WriteOutcome {
+  const store = input.store ?? createIntegrationStateStore();
+  const io = input.io ?? defaultIntegrationIO(store);
+  const entry = store.findOperation(input.opId);
+  if (!entry) throw new Error(`unknown operation ${input.opId}`);
+  if (entry.clientId !== input.clientId) throw new Error("restore input names a different client than the operation");
+
+  const clientId = entry.clientId;
+  const resolvedPath = INTEGRATION_CLIENTS[clientId].configPath(input.env, input.home);
+  // Restore acts on the path the operation was journaled against. Resolving a
+  // different path here would let an operation recorded for one home delete a
+  // file in another.
+  const configPath = entry.configPath;
+  if (resolvedPath !== configPath) {
+    return refuse(clientId, "conflict", "conflict",
+      `that operation was recorded for ${configPath}, but this client now resolves to ${resolvedPath}`);
+  }
+  const snapshot = store.readSnapshot(entry);
+  if (snapshot.kind === "expired") {
+    return refuse(clientId, "snapshot_expired", "absent", "that backup has expired");
+  }
+  const backupHint = snapshot.kind === "stored" ? snapshot.path : undefined;
+
+  const target = loadTarget(io, configPath);
+  if (!target.ok) {
+    return refuse(clientId, "unsafe", "unsafe",
+      target.why === "read-failed"
+        ? `${configPath} exists but could not be read; the backup is at ${backupHint ?? "(none)"}`
+        : `${configPath} is not a regular file; the backup is at ${backupHint ?? "(none)"}`,
+      backupHint);
+  }
+  const current = target.before;
+
+  /*
+   * Drift: the file changed after the operation we are undoing.
+   *
+   * Through the shared matcher, because `fingerprint(current ?? "")` treated a
+   * MISSING file as an empty one — so restoring an operation whose result was
+   * absence, with the file still absent, read as drift and demanded a
+   * confirmation for edits nobody had made. The journal meanwhile offered the
+   * same row as Undo.
+   */
+  if (!matchesOperationResult(entry, current) && !input.confirmDrift) {
+    return refuse(clientId, "drift_requires_confirm", "conflict",
+      "this file changed after that operation; confirm to replace it (the current version is backed up first)");
+  }
+
+  // Restore is itself journaled and itself undoable: snapshot the CURRENT file
+  // first, so a confirmed drift-restore never destroys the newer edits.
+  const opId = newOpId();
+  const preSnapshot = store.captureSnapshot(clientId, opId, current);
+  const restoredText = snapshot.kind === "none" ? null : snapshot.text;
+
+  // Provenance is RESTORED, never re-derived: `priorRecord` described these
+  // exact bytes when the snapshot was taken. Re-deriving it from the file would
+  // mean guessing which entries are ours, and a wrong guess deletes a user's.
+  const restoredRecord = entry.priorRecord;
+  const fresh = EXPORT_CLIENTS[clientId].buildContribution(exportContextOf(input));
+  /*
+   * Does the restored record actually describe the restored bytes?
+   *
+   * It usually does — `priorRecord` was written for exactly this snapshot. But
+   * a CONFIRMED drift-restore snapshots the user's edited file first, and
+   * undoing that restore puts those edited bytes back while carrying a record
+   * that describes what opencodex had written. Overwriting the record's
+   * fingerprint with the restored bytes then laundered a foreign edit into
+   * owned content: the state read `current`, and a later disable deleted
+   * fields the user had added by hand.
+   */
+  const restoredFingerprint = restoredText === null ? "" : fingerprint(restoredText);
+  const recordDescribesBytes = restoredRecord !== null
+    && restoredRecord.fileFingerprint === restoredFingerprint;
+  const state: IntegrationState = restoredRecord === null
+    ? (restoredText === null ? "absent" : "conflict")
+    : !recordDescribesBytes
+      ? "conflict"
+      : restoredRecord.blockFingerprint === fingerprint(canonicalContribution(fresh))
+        ? "current"
+        : "stale";
+
+  const at = new Date(io.now()).toISOString();
+  const priorRecord = store.readRecords()[clientId] ?? null;
+  const restoreEntry: JournalEntry = {
+    opId, clientId, kind: "restore", at, configPath, snapshot: preSnapshot,
+    resultFingerprint: restoredText === null ? "" : fingerprint(restoredText),
+    resultAbsent: restoredText === null,
+    priorRecord,
+  };
+  return commit({
+    io, store, clientId, configPath, before: current, nextText: restoredText, state,
+    priorRecord,
+    /*
+     * Keep the record's ORIGINAL `fileFingerprint`. Restoring bytes it does not
+     * describe leaves the classifier reading `conflict`, which is the honest
+     * answer — we are no longer sure the block on disk is ours, and refusing
+     * is what stops a disable from deleting the user's edit.
+     */
+    record: restoredRecord === null ? null : {
+      ...restoredRecord,
+      appliedAt: at,
+      opId,
+    },
+    entry: restoreEntry,
+    snapshotPath: snapshotAbsPath(store, restoreEntry),
+  });
+}

package/src/lib/bounded-body.ts

@@ -7,6 +7,18 @@ export const BOUNDED_BODY_TIMEOUT_MS = 5_000;
 export interface BoundedBodyOptions {
 	/** Abort the read with this signal. Its reason is rethrown by identity. */
 	signal?: AbortSignal;
+	/**
+	 * Reject the returned promise with TypeError on malformed or truncated UTF-8
+	 * instead of replacing invalid bytes, including during timeout-path flushes.
+	 * Reader cancellation and lock release still run. Defaults to false.
+	 */
+	fatalUtf8?: boolean;
+	/**
+	 * Byte ceiling for retained body data. Defaults to BOUNDED_BODY_MAX_BYTES (64 KiB),
+	 * which suits error bodies; callers materializing whole success payloads (e.g. a
+	 * non-streaming upstream JSON completion) pass a larger explicit budget.
+	 */
+	maxBytes?: number;
 	/** Total wall-clock deadline. Exposed for focused tests. */
 	totalTimeoutMs?: number;
 	/** Deadline between non-empty raw chunks. Exposed for focused tests. */
@@ -33,6 +45,19 @@ export interface BoundedBodyResult {
 const TOTAL_TIMEOUT = Symbol("bounded body total timeout");
 const INACTIVITY_TIMEOUT = Symbol("bounded body inactivity timeout");
 
+/**
+ * Test-only instrumentation: how many times the retained buffer was reallocated
+ * during the most recent read. The accumulator grows geometrically, so this is
+ * logarithmic in the body size and independent of how many chunks the peer sends.
+ * The per-chunk array it replaced retained one object per chunk instead, which a
+ * fragmenting peer can inflate far past the payload ceiling — a property no
+ * correctness assertion can see, which is why it is observable here.
+ */
+let bufferGrowthsForTests = 0;
+export function boundedBodyBufferGrowthsForTests(): number {
+	return bufferGrowthsForTests;
+}
+
 function timeoutPromise(ms: number, value: symbol): { promise: Promise<symbol>; clear: () => void } {
 	let timer: ReturnType<typeof setTimeout> | undefined;
 	const promise = new Promise<symbol>((resolve) => {
@@ -56,8 +81,8 @@ function cancelWithoutWaiting(reader: ReadableStreamDefaultReader<Uint8Array>, r
 	}
 }
 
-function decodeUtf8(chunks: readonly Uint8Array[]): string {
-	const decoder = new TextDecoder();
+function decodeUtf8(chunks: readonly Uint8Array[], fatal: boolean): string {
+	const decoder = new TextDecoder("utf-8", { fatal });
 	let text = "";
 	for (const chunk of chunks) text += decoder.decode(chunk, { stream: true });
 	// Flush an incomplete trailing UTF-8 sequence deterministically.
@@ -93,8 +118,13 @@ export async function readBoundedResponseBody(
 	}
 
 	const reader = body.getReader();
-	const chunks: Uint8Array[] = [];
+	const maxBytes = options.maxBytes ?? BOUNDED_BODY_MAX_BYTES;
+	// Geometrically growing single buffer: per-chunk arrays would retain one object per
+	// transport chunk, which a hostile peer could inflate into metadata amplification far
+	// beyond the payload ceiling on large budgets.
+	let retained = new Uint8Array(Math.min(maxBytes, 64 * 1024));
 	let retainedBytes = 0;
+	bufferGrowthsForTests = 0;
 	let mustCancel = false;
 	let cancelReason: unknown;
 	const total = timeoutPromise(options.totalTimeoutMs ?? BOUNDED_BODY_TIMEOUT_MS, TOTAL_TIMEOUT);
@@ -134,7 +164,7 @@ export async function readBoundedResponseBody(
 					"TimeoutError",
 				);
 				return {
-					text: decodeUtf8(chunks),
+					text: decodeUtf8([retained.subarray(0, retainedBytes)], options.fatalUtf8 === true),
 					truncated: true,
 					timedOut: true,
 					totalTimedOut: outcome === TOTAL_TIMEOUT,
@@ -147,7 +177,7 @@ export async function readBoundedResponseBody(
 			const { value, done } = outcome as ReadableStreamReadResult<Uint8Array>;
 			if (done) {
 				return {
-					text: decodeUtf8(chunks),
+					text: decodeUtf8([retained.subarray(0, retainedBytes)], options.fatalUtf8 === true),
 					truncated: false,
 					timedOut: false,
 					totalTimedOut: false,
@@ -165,10 +195,10 @@ export async function readBoundedResponseBody(
 				INACTIVITY_TIMEOUT,
 			);
 
-			if (value.byteLength > BOUNDED_BODY_MAX_BYTES - retainedBytes) {
+			if (value.byteLength > maxBytes - retainedBytes) {
 				mustCancel = true;
 				cancelReason = new DOMException("Error body size limit reached", "QuotaExceededError");
-				chunks.length = 0;
+				retained = new Uint8Array(0);
 				retainedBytes = 0;
 				return {
 					text: "",
@@ -181,7 +211,15 @@ export async function readBoundedResponseBody(
 				};
 			}
 
-			chunks.push(value);
+			if (retainedBytes + value.byteLength > retained.length) {
+				const grown = new Uint8Array(
+					Math.min(maxBytes, Math.max(retained.length * 2, retainedBytes + value.byteLength)),
+				);
+				grown.set(retained.subarray(0, retainedBytes));
+				retained = grown;
+				bufferGrowthsForTests += 1;
+			}
+			retained.set(value, retainedBytes);
 			retainedBytes += value.byteLength;
 		}
 	} catch (error) {