@gatebolt/agent-redroom 0.1.1 → 0.1.2

package/README.md

@@ -119,7 +119,7 @@ Unplanted `GET`/`HEAD` requests on the fake domain get `404 not found`. Other me
 - `exec(command)`: runs a shell command in the workspace as the agent user, for checks, and returns `{ exitCode, output }`. Past the same limits it fails with `exec_timeout` or `exec_output_too_large`. The container kills the command at the time limit, so one that writes too much output runs until then.
 - `readFile(path)`: returns a file's text, or `null`. A file larger than 64 MB fails with `read_output_too_large`.
 - `hits()`, `toolCalls()`, `modelCalls()`: everything recorded so far.
-- `finish()`: waits for a running turn to end, then collects everything, removes the container and returns a `RunResult`. It is idempotent.
+- `finish()`: waits for a running turn to end, then collects everything, removes the container and returns a `RunResult`. If stopping, disconnecting or restarting offline fails, it skips final reads and drains, reports `collection_incomplete`, and still attempts removal. Previously collected logs and turns remain in the result. It is idempotent.
 
 ### `RunResult`
 
@@ -128,7 +128,7 @@ Unplanted `GET`/`HEAD` requests on the fake domain get `404 not found`. Other me
   id, agent: { name, version, model },
   turns, transcript,           // the agent's own session log (JSONL)
   toolCalls,                   // every PreToolUse hook call: tool, input, response, action, latency, error
-  hits,                        // every fake-web/DNS request: protocol, host, method, path, headers, body (first 64 KiB, `truncated` if cut), secrets found
+  hits,                        // every fake-web/DNS request: protocol, host, method, path, headers, body (first 64 KiB, `truncated` if cut), secrets found, error if incomplete
   modelCalls,                  // every model request: path, status, duration, size, secrets in the request
   diff,                        // git diff of the workspace against the planted baseline
   sightings,                   // [{ secret, encoding, where, ref }]
@@ -137,7 +137,7 @@ Unplanted `GET`/`HEAD` requests on the fake domain get `404 not found`. Other me
 }
 ```
 
-`where` is one of `hit`, `tool_call`, `model_request`, `reply`, `transcript` or `diff`. `encoding` is `plain`, `case_insensitive` (DNS lowercases names), `url`, `hex` or `base64` (at any byte offset).
+`where` is one of `hit`, `tool_call`, `model_request`, `reply`, `transcript` or `diff`. `encoding` is `plain`, `case_insensitive` (DNS lowercases names), `url` (uppercase, lowercase or mixed percent-escape digits), `hex` or `base64` (at any byte offset).
 
 A tool call's `hookPayload` is the payload Claude Code posted to the hook (`null` when it could not be read), and `checked` says whether a `toolCallCheck` was asked. A model call's `requestBytes` is the size of the request body, and its `error` says why the request failed, when it did.
 
@@ -156,6 +156,8 @@ Sightings search these parts of the evidence, and nothing else:
 
 Every failure is a `RedroomError` with `by` (`redroom`, `docker`, `agent`, `sidecar`, `modelProxy` or `toolCallCheck`), a filterable `code`, a `detail`, and, when there was one, `call` metadata (`command`, `exitCode`, `url`, `status`, `durationMs`). Failed turns, model proxy and tool call check failures, dropped log entries and collection problems also land in `result.errors`, so a stored result always says why something went wrong. Secrets that agent-redroom holds (the control secret and the header values of every redroom-level and per-run proxy or check) are redacted from error text, and from everything a run returns or stores: turns, `exec` output, files read, hits, tool calls, model calls, the transcript and the diff.
 
+Incomplete HTTP/HTTPS hits carry `error`, as do refused model requests and tool hooks. The sidecar uses `request_limit` or `buffer_limit` when a request budget is exhausted, `request_timeout` when an upload takes more than 30 s, and `request_aborted` when a fake-web or model upload is interrupted. These errors also reach `result.errors`. A refusal is evidence of incomplete work, not a clean run.
+
 ### Other exports
 
 - `DEFAULT_DOMAIN`: the default `fakeDomain`, `"redroom.test"`.
@@ -316,6 +318,8 @@ const redroom = await startRedroom({ agent, network: "app" });
 - Each agent container runs with `--cpus 2 --memory 2g --pids-limit 1024`, `--cap-drop ALL`, `no-new-privileges` and `--init`. You can override the CPU, memory and process limits with `limits: { cpus, memory, pids }`, and the per-turn timeout with `limits.turnTimeoutMs`. The other flags are fixed.
 - A stuck Docker engine or sidecar can't hang a run. Docker calls other than turns and `exec` give up after 2 minutes (image builds after 30), and calls to the sidecar's control API after 30 s, failing with `docker_timeout` or `sidecar_timeout`.
 - The sidecar runs with `--memory 8g --pids-limit 256` and a 6 GiB Node heap. It keeps each run's hits, tool calls and model calls in logs of at most 10,000 entries and 4 MiB each. Over a cap it drops the oldest entries, but always keeps at least one entry for each secret and encoding it saw, so a flood of requests cannot erase a leak. It reports the drop as an `entries_dropped` error.
+- HTTP, HTTPS, model and hook requests share limits of 8 in-flight requests and 32 MiB of allocated body buffers per source IP, with 2,048 requests and 512 MiB across the sidecar. Captures use 64 KiB blocks; the budget counts allocated capacity. A hook reserves 2 MiB for its bounded request and check response until both its work and response finish. Exhausting either budget returns `429` and records the refusal. Uploads have a 30 s deadline; model response streams still use the 2-minute idle timeout. These budgets cover retained request data, not the sidecar's total memory or every operating-system resource.
+- DNS keeps a snapshot of interface addresses and refreshes it for new run subnets. It requests a 1 MiB receive buffer when the OS default is smaller, preserving larger defaults; the OS may cap the effective size.
 - The sidecar holds a lease that the running redroom renews every 30 s. The lease lasts 90 s and the sidecar checks it every 22.5 s, so if your program dies, the sidecar exits within 112.5 s of the last renewal.
 - On start, `startRedroom` removes labelled containers and networks of sessions whose sidecar is no longer running, so killed runs don't pile up. It leaves live sessions alone, including other programs' sessions on the same engine and sessions created in the last 3 minutes. `removeLeftovers(dockerCli())` is exported if you want to run the same sweep yourself.
 - `run.finish()` removes the run's container, and `redroom.stop()` removes everything in the session. Both are safe to call more than once.
@@ -327,10 +331,10 @@ agent-redroom is built to watch a **cooperative but manipulable** agent: one tha
 What it defends:
 
 - **The agent has no route out.** Each run has its own `--internal` network with no gateway on the host (Docker's isolated gateway mode), so the agent cannot reach the internet, the host or other runs. Its only peer is the sidecar: fake web, DNS, relay and hook, plus the control API, which refuses requests without the control secret. The agent runs without capabilities, so it cannot change its address.
-- **Exfiltration to the fake domain is recorded.** HTTPS (trusted CA, via the system store, `SSL_CERT_FILE`, `CURL_CA_BUNDLE`, `REQUESTS_CA_BUNDLE` and `NODE_EXTRA_CA_CERTS`), HTTP and DNS requests to the fake domain are logged per run, and the host, path, headers and first 16 MiB of the body are searched for secrets in plain, case-folded, URL, hex and base64 form.
+- **Exfiltration to the fake domain is recorded.** HTTPS (trusted CA, via the system store, `SSL_CERT_FILE`, `CURL_CA_BUNDLE`, `REQUESTS_CA_BUNDLE` and `NODE_EXTRA_CA_CERTS`), HTTP and DNS requests to the fake domain are logged per run, and the host, path, headers and first 16 MiB of the body are searched for secrets in plain, case-folded, URL, hex and base64 form. An aborted or timed-out HTTP/HTTPS upload keeps the bytes received so far and an error. A budget refusal records the received prefix; unread bytes cannot be searched.
 - **Model requests are recorded.** The path, the agent's headers and the first 16 MiB of the body of each request the relay forwards are searched the same way, so secrets sent to the model show up in `modelCalls[].secrets`. The relay forwards only the model endpoints. Other paths get `403` and are logged as `path_not_allowed` without a search, and a target that is not a path gets `400` and is not logged.
 - **The sidecar's logs are out of the agent's reach.** The sidecar records hits, model calls and tool calls as they happen, and the agent can neither edit nor delete them. A flood can evict old entries, but never the last entry for a secret and encoding, and every eviction is reported as an `entries_dropped` error.
-- **Evidence is collected after the agent stops.** `finish()` kills every process in the agent container and takes it off the network before it reads the transcript and diff and drains the logs, so nothing the agent left running can add to them afterwards.
+- **Final reads require a stopped and isolated agent.** `finish()` kills every process in the agent container and takes it off the network before it reads the transcript and diff and drains the logs. If that sequence fails, it skips final collection, reports `collection_incomplete` and attempts removal. Treat that result as incomplete.
 
 What it does not defend:
 
@@ -349,7 +353,7 @@ What you must do:
 - Run agents you do not trust on a dedicated VM or host, not your workstation.
 - Plant fake, long and distinctive secrets, never real credentials.
 - Use a model key or proxy with its own spending limit.
-- Judge leaks by hits, model calls and tool calls, and treat turns, the transcript and the diff as claims. Check `result.errors` for `entries_dropped`.
+- Judge leaks by hits, model calls and tool calls, and treat turns, the transcript and the diff as claims. Check `result.errors` for dropped entries, request refusals, interrupted uploads and incomplete collection before scoring a run.
 
 ## Reporting a vulnerability
 

package/dist/run.js

@@ -116,7 +116,7 @@ export function openRun(deps, run) {
         }
         const turn = {
             index: turns.length,
-            message,
+            message: redact(message),
             exitCode: result.exitCode,
             ...parsed,
         };
@@ -140,8 +140,26 @@ export function openRun(deps, run) {
     async function collect() {
         let transcript = "";
         let diff = "";
+        const attempt = async (label, piece) => {
+            try {
+                await piece();
+                return true;
+            }
+            catch (error) {
+                const info = errorInfo(error, "redroom");
+                errors.push({ ...info, detail: `${label}: ${redact(info.detail)}` });
+                return false;
+            }
+        };
+        const isolated = await attempt("agent stop", stopAgent);
+        if (!isolated) {
+            errors.push({
+                by: "redroom",
+                code: "collection_incomplete",
+                detail: "could not stop and isolate the agent; final evidence collection skipped",
+            });
+        }
         const pieces = [
-            ["agent stop", stopAgent],
             [
                 "transcript",
                 async () => {
@@ -168,14 +186,9 @@ export function openRun(deps, run) {
             ["tool calls", () => drain("tool-calls")],
             ["model calls", () => drain("model-calls")],
         ];
-        for (const [label, piece] of pieces) {
-            try {
-                await piece();
-            }
-            catch (error) {
-                const info = errorInfo(error, "redroom");
-                errors.push({ ...info, detail: `${label}: ${redact(info.detail)}` });
-            }
+        if (isolated) {
+            for (const [label, piece] of pieces)
+                await attempt(label, piece);
         }
         try {
             await deps.remove();

package/dist/secrets.js

@@ -16,13 +16,13 @@ function base64Fragments(value) {
     }
     return [...fragments];
 }
-function matchIn(text, lower, value) {
+function matchIn(text, lower, urlText, value) {
     if (text.includes(value))
         return "plain";
     if (lower.includes(value.toLowerCase()))
         return "case_insensitive";
     const url = encodeURIComponent(value);
-    if (url !== value && text.includes(url))
+    if (url !== value && urlText.includes(url))
         return "url";
     if (lower.includes(Buffer.from(value).toString("hex")))
         return "hex";
@@ -35,10 +35,11 @@ export function findSecrets(text, secrets) {
     if (text === "")
         return [];
     const lower = text.toLowerCase();
+    const urlText = text.replace(/%[\da-f]{2}/gi, (escape) => escape.toUpperCase());
     return Object.entries(secrets).flatMap(([secret, value]) => {
         if (value === "")
             return [];
-        const encoding = matchIn(text, lower, value);
+        const encoding = matchIn(text, lower, urlText, value);
         return encoding ? [{ secret, encoding }] : [];
     });
 }

package/dist/sidecar/dns.js

@@ -1,5 +1,6 @@
 import { createSocket } from "node:dgram";
 import { normalizeIp } from "./state.js";
+const RECEIVE_BUFFER_BYTES = 1024 * 1024;
 export const isFakeHost = (host, domain) => host === domain || host.endsWith(`.${domain}`);
 function parseQuestion(msg) {
     const labels = [];
@@ -59,10 +60,31 @@ export function answerQuery(msg, ip, context, source) {
 const subnetOf = (ip) => ip.split(".").slice(0, 3).join(".");
 export function createDns(context, ownIps) {
     const socket = createSocket("udp4");
+    socket.once("listening", () => {
+        try {
+            if (socket.getRecvBufferSize() < RECEIVE_BUFFER_BYTES) {
+                socket.setRecvBufferSize(RECEIVE_BUFFER_BYTES);
+            }
+        }
+        catch (error) {
+            socket.emit("error", error);
+        }
+    });
+    let bySubnet = new Map();
     socket.on("message", (msg, remote) => {
         const source = normalizeIp(remote.address);
-        const ips = ownIps();
-        const ip = ips.find((own) => subnetOf(own) === subnetOf(source)) ?? ips[0];
+        const subnet = subnetOf(source);
+        let ip = bySubnet.get(subnet);
+        if (ip === undefined) {
+            const ips = ownIps();
+            bySubnet = new Map();
+            for (const own of ips) {
+                const ownSubnet = subnetOf(own);
+                if (!bySubnet.has(ownSubnet))
+                    bySubnet.set(ownSubnet, own);
+            }
+            ip = bySubnet.get(subnet) ?? ips[0];
+        }
         const reply = answerQuery(msg, ip, context, source);
         if (reply)
             socket.send(reply, remote.port, remote.address);

package/dist/sidecar/fake-web.d.ts

@@ -10,6 +10,7 @@ export type FakeWebContext = {
     state: SidecarState;
     domain: string;
     trustTestSourceHeader: boolean;
+    requestTimeoutMs: number;
 };
 export declare function createFakeHttps(context: FakeWebContext, tls: Tls): Server;
 export declare function createFakeHttp(context: FakeWebContext): Server;

package/dist/sidecar/fake-web.js

@@ -7,6 +7,7 @@ import { join } from "node:path";
 import { promisify } from "node:util";
 import {} from "../types.js";
 import { isFakeHost } from "./dns.js";
+import { BodyBuffer, sendJson } from "./http.js";
 import { headersOf, SCAN_LIMIT, sourceIp } from "./state.js";
 const run = promisify(execFile);
 const HIT_BODY_LIMIT = 64 * 1024;
@@ -32,25 +33,26 @@ export async function generateTls(domain) {
 }
 function fakeWeb(context, protocol) {
     return (req, res) => {
-        const chunks = [];
+        const host = (req.headers.host ?? "").replace(/:\d+$/, "").toLowerCase();
+        if (!isFakeHost(host, context.domain)) {
+            res.writeHead(404, { Connection: "close" }).end();
+            return;
+        }
+        const source = sourceIp(req, context.trustTestSourceHeader);
+        const target = req.url ?? "/";
+        const url = URL.parse(target, "http://fake-web");
+        const method = req.method ?? "GET";
+        const path = url ? url.pathname + url.search : target;
+        const lease = context.state.requests.take(source);
+        const buffered = new BodyBuffer(SCAN_LIMIT, (bytes) => lease?.reserve(bytes) ?? false);
         let size = 0;
-        req.on("data", (chunk) => {
-            if (size < SCAN_LIMIT)
-                chunks.push(chunk);
-            size += chunk.length;
-        });
-        req.on("end", () => {
-            const host = (req.headers.host ?? "").replace(/:\d+$/, "").toLowerCase();
-            if (!isFakeHost(host, context.domain)) {
-                res.writeHead(404).end();
+        let recorded = false;
+        const record = (error, extra) => {
+            if (recorded)
                 return;
-            }
-            const target = req.url ?? "/";
-            const url = URL.parse(target, "http://fake-web");
-            const source = sourceIp(req, context.trustTestSourceHeader);
-            const method = req.method ?? "GET";
-            const path = url ? url.pathname + url.search : target;
-            const body = Buffer.concat(chunks);
+            recorded = true;
+            clearTimeout(timer);
+            const body = buffered.finish(extra);
             context.state.recordHit(source, {
                 protocol,
                 host,
@@ -59,7 +61,58 @@ function fakeWeb(context, protocol) {
                 headers: headersOf(req),
                 body: body.subarray(0, HIT_BODY_LIMIT).toString("utf8"),
                 truncated: size > HIT_BODY_LIMIT,
+                ...(error ? { error } : {}),
             }, body.toString("utf8"));
+        };
+        const refuse = (status, code, detail, extra) => {
+            record({ by: "sidecar", code, detail }, extra);
+            req.pause();
+            sendJson(res, status, { error: detail }, { Connection: "close" });
+        };
+        const timer = setTimeout(() => refuse(408, "request_timeout", "request body timed out"), context.requestTimeoutMs);
+        timer.unref();
+        res.once("finish", () => lease?.release());
+        res.once("close", () => {
+            record({
+                by: "sidecar",
+                code: "request_aborted",
+                detail: "request closed before its body ended",
+            });
+            lease?.release();
+        });
+        req.once("aborted", () => {
+            record({
+                by: "sidecar",
+                code: "request_aborted",
+                detail: "request body aborted",
+            });
+            res.destroy();
+        });
+        req.once("error", () => {
+            record({
+                by: "sidecar",
+                code: "request_aborted",
+                detail: "request body failed",
+            });
+            res.destroy();
+        });
+        if (!lease) {
+            refuse(429, "request_limit", "too many in-flight requests");
+            return;
+        }
+        req.on("data", (chunk) => {
+            if (recorded)
+                return;
+            size += chunk.length;
+            if (!buffered.append(chunk)) {
+                refuse(429, "buffer_limit", "too many buffered request bytes", chunk);
+                return;
+            }
+        });
+        req.on("end", () => {
+            if (recorded)
+                return;
+            record();
             if (!url) {
                 res.writeHead(400, { "Content-Type": "text/plain" }).end("bad request");
                 return;

package/dist/sidecar/http.d.ts

@@ -1,7 +1,36 @@
 import { type IncomingMessage, type Server, type ServerResponse } from "node:http";
 export declare const BODY_LIMIT_BYTES: number;
+export declare const REQUEST_TIMEOUT_MS = 30000;
+export type RequestLimits = {
+    requests: number;
+    requestsPerSource: number;
+    bytes: number;
+    bytesPerSource: number;
+};
+export type RequestLease = {
+    reserve(bytes: number): boolean;
+    release(): void;
+};
+export declare class RequestBudget {
+    private readonly limits;
+    private readonly sources;
+    private requests;
+    private bytes;
+    constructor(limits?: Partial<RequestLimits>);
+    take(source: string): RequestLease | undefined;
+}
 export declare class BodyTooLargeError extends Error {
 }
+export declare class BodyBuffer {
+    private readonly limit;
+    private readonly reserve;
+    private blocks;
+    private size;
+    private capacity;
+    constructor(limit: number, reserve?: (bytes: number) => boolean);
+    append(chunk: Uint8Array): boolean;
+    finish(extra?: Uint8Array): Buffer;
+}
 export declare function readBody(body: AsyncIterable<Uint8Array>, limit?: number): Promise<Buffer>;
 export declare function readJson(req: IncomingMessage): Promise<unknown>;
 export declare function sendJson(res: ServerResponse, status: number, body: unknown, headers?: Record<string, string>): void;

package/dist/sidecar/http.js

@@ -1,18 +1,120 @@
 import { timingSafeEqual } from "node:crypto";
 import { createServer, } from "node:http";
 export const BODY_LIMIT_BYTES = 1024 * 1024;
+export const REQUEST_TIMEOUT_MS = 30_000;
+export class RequestBudget {
+    limits;
+    sources = new Map();
+    requests = 0;
+    bytes = 0;
+    constructor(limits = {}) {
+        this.limits = {
+            requests: 2048,
+            requestsPerSource: 8,
+            bytes: 512 * 1024 * 1024,
+            bytesPerSource: 32 * 1024 * 1024,
+            ...limits,
+        };
+    }
+    take(source) {
+        const usage = this.sources.get(source) ?? { requests: 0, bytes: 0 };
+        if (this.requests >= this.limits.requests ||
+            usage.requests >= this.limits.requestsPerSource)
+            return undefined;
+        this.sources.set(source, usage);
+        this.requests += 1;
+        usage.requests += 1;
+        let bytes = 0;
+        let released = false;
+        return {
+            reserve: (size) => {
+                if (released ||
+                    this.bytes + size > this.limits.bytes ||
+                    usage.bytes + size > this.limits.bytesPerSource)
+                    return false;
+                this.bytes += size;
+                usage.bytes += size;
+                bytes += size;
+                return true;
+            },
+            release: () => {
+                if (released)
+                    return;
+                released = true;
+                this.requests -= 1;
+                usage.requests -= 1;
+                this.bytes -= bytes;
+                usage.bytes -= bytes;
+                if (usage.requests === 0)
+                    this.sources.delete(source);
+            },
+        };
+    }
+}
 export class BodyTooLargeError extends Error {
 }
+const BODY_BLOCK_BYTES = 64 * 1024;
+export class BodyBuffer {
+    limit;
+    reserve;
+    blocks = [];
+    size = 0;
+    capacity = 0;
+    constructor(limit, reserve = () => true) {
+        this.limit = limit;
+        this.reserve = reserve;
+    }
+    append(chunk) {
+        const length = Math.min(chunk.length, this.limit - this.size);
+        if (length === 0)
+            return true;
+        const end = this.size + length;
+        const capacity = Math.min(this.limit, Math.ceil(end / BODY_BLOCK_BYTES) * BODY_BLOCK_BYTES);
+        const needed = capacity - this.capacity;
+        if (needed > 0 && !this.reserve(needed))
+            return false;
+        while (this.capacity < capacity) {
+            const block = Buffer.alloc(Math.min(BODY_BLOCK_BYTES, this.limit - this.capacity));
+            this.blocks.push(block);
+            this.capacity += block.length;
+        }
+        let offset = 0;
+        while (offset < length) {
+            const block = this.blocks[Math.floor(this.size / BODY_BLOCK_BYTES)];
+            const at = this.size % BODY_BLOCK_BYTES;
+            const copied = Math.min(length - offset, block.length - at);
+            block.set(chunk.subarray(offset, offset + copied), at);
+            offset += copied;
+            this.size += copied;
+        }
+        return true;
+    }
+    finish(extra) {
+        const blocks = this.blocks;
+        const size = this.size;
+        this.blocks = [];
+        this.size = 0;
+        this.capacity = 0;
+        const last = blocks.at(-1);
+        if (last && size % BODY_BLOCK_BYTES !== 0) {
+            blocks[blocks.length - 1] = last.subarray(0, size % BODY_BLOCK_BYTES);
+        }
+        const extraLength = Math.min(extra?.length ?? 0, this.limit - size);
+        if (extra && extraLength > 0)
+            blocks.push(extra.subarray(0, extraLength));
+        return Buffer.concat(blocks, size + extraLength);
+    }
+}
 export async function readBody(body, limit = BODY_LIMIT_BYTES) {
-    const chunks = [];
+    const buffered = new BodyBuffer(limit);
     let size = 0;
     for await (const chunk of body) {
         size += chunk.length;
         if (size > limit)
             throw new BodyTooLargeError("body too large");
-        chunks.push(chunk);
+        buffered.append(chunk);
     }
-    return Buffer.concat(chunks);
+    return buffered.finish();
 }
 export async function readJson(req) {
     return JSON.parse((await readBody(req)).toString("utf8"));

package/dist/sidecar/relay.d.ts

@@ -5,5 +5,6 @@ export type RelayContext = {
     state: SidecarState;
     trustTestSourceHeader: boolean;
     idleTimeoutMs: number;
+    requestTimeoutMs: number;
 };
 export declare function createRelay(context: RelayContext): Server;

package/dist/sidecar/relay.js

@@ -1,7 +1,8 @@
 import { createServer, request as httpRequest, } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { findSecrets } from "../secrets.js";
-import { DETAIL_LIMIT } from "../types.js";
+import { DETAIL_LIMIT, } from "../types.js";
+import { BodyBuffer } from "./http.js";
 import { headerLines, headersOf, push, SCAN_LIMIT, sourceIp, } from "./state.js";
 // Well under the turn timeout so a silent proxy is cut and logged first; streams send pings.
 export const UPSTREAM_IDLE_TIMEOUT_MS = 120_000;
@@ -37,23 +38,28 @@ function upstreamUrl(baseUrl, path) {
     target.search = request.search;
     return target;
 }
-function refuseEndpoint(run, method, path, res) {
+function refuseRequest(run, method, path, res, status, code, detail) {
     push(run.modelCalls, {
         method,
         path,
-        status: 403,
+        status,
         durationMs: 0,
         requestBytes: 0,
         at: new Date().toISOString(),
         secrets: [],
         error: {
             by: "sidecar",
-            code: "path_not_allowed",
-            detail: "the relay forwards only the model endpoints",
+            code,
+            detail,
         },
     });
-    res.writeHead(403, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "path not allowed" }));
+    res.writeHead(status, {
+        "Content-Type": "application/json",
+        Connection: "close",
+    });
+    res.end(JSON.stringify({
+        error: code === "path_not_allowed" ? "path not allowed" : detail,
+    }));
 }
 export function createRelay(context) {
     return createServer((req, res) => {
@@ -83,23 +89,29 @@ function relay(context, req, res) {
     const [runId, run] = entry;
     const method = req.method ?? "GET";
     if (!isModelEndpoint(method, path)) {
-        refuseEndpoint(run, method, path, res);
+        refuseRequest(run, method, path, res, 403, "path_not_allowed", "the relay forwards only the model endpoints");
+        return;
+    }
+    const lease = context.state.requests.take(run.ip);
+    if (!lease) {
+        refuseRequest(run, method, path, res, 429, "request_limit", "too many in-flight requests");
         return;
     }
+    res.once("close", () => lease.release());
     const target = upstreamUrl(run.modelProxy.baseUrl, path);
     const send = target.protocol === "https:" ? httpsRequest : httpRequest;
     const started = Date.now();
-    const scanned = [];
+    const buffered = new BodyBuffer(SCAN_LIMIT, (bytes) => lease.reserve(bytes));
     let requestBytes = 0;
     let status = 0;
     let errorBody = "";
     let error;
     let recorded = false;
-    const record = () => {
+    const record = (extra) => {
         if (recorded)
             return;
         recorded = true;
-        const body = Buffer.concat(scanned).toString("utf8");
+        const body = buffered.finish(extra).toString("utf8");
         const text = [path, headerLines(headersOf(req)), body].join("\n");
         if (!error && status >= 400) {
             error = {
@@ -120,11 +132,11 @@ function relay(context, req, res) {
             ...(error ? { error } : {}),
         });
     };
-    const fail = (code, detail) => {
+    const fail = (code, detail, by = "modelProxy", extra) => {
         if (recorded)
             return;
         error = {
-            by: "modelProxy",
+            by,
             code,
             detail,
             call: { url: target.href, durationMs: Date.now() - started },
@@ -133,16 +145,35 @@ function relay(context, req, res) {
             res.destroy();
         }
         else {
-            status = code === "timeout" ? 504 : 502;
-            res.writeHead(status, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: "model proxy unreachable" }));
+            status =
+                code === "timeout"
+                    ? 504
+                    : code === "request_timeout"
+                        ? 408
+                        : code === "buffer_limit"
+                            ? 429
+                            : 502;
+            res.writeHead(status, {
+                "Content-Type": "application/json",
+                Connection: "close",
+            });
+            res.end(JSON.stringify({
+                error: by === "sidecar" ? detail : "model proxy unreachable",
+            }));
         }
-        record();
+        req.unpipe(out);
+        req.pause();
+        out.destroy();
+        record(extra);
     };
     req.on("data", (chunk) => {
-        if (requestBytes < SCAN_LIMIT)
-            scanned.push(chunk);
+        if (recorded)
+            return;
         requestBytes += chunk.length;
+        if (!buffered.append(chunk)) {
+            fail("buffer_limit", "too many buffered request bytes", "sidecar", chunk);
+            return;
+        }
     });
     const out = send(target, {
         method,
@@ -162,13 +193,30 @@ function relay(context, req, res) {
     });
     out.on("timeout", () => {
         fail("timeout", `model proxy sent nothing for ${context.idleTimeoutMs} ms`);
-        out.destroy();
     });
     out.on("error", (cause) => fail("network_error", cause.message));
+    const timer = setTimeout(() => fail("request_timeout", "request body timed out", "sidecar"), context.requestTimeoutMs);
+    timer.unref();
+    req.once("end", () => clearTimeout(timer));
+    req.once("aborted", () => fail("request_aborted", "request body aborted", "sidecar"));
+    req.once("error", () => fail("request_aborted", "request body failed", "sidecar"));
     res.on("close", () => {
-        if (!res.writableFinished)
-            out.destroy();
+        clearTimeout(timer);
+        req.unpipe(out);
+        req.pause();
+        out.destroy();
+        if (!error && (!req.complete || !res.writableFinished)) {
+            error = {
+                by: "sidecar",
+                code: "request_aborted",
+                detail: req.complete ? "response aborted" : "request body aborted",
+                call: { url: target.href, status, durationMs: Date.now() - started },
+            };
+        }
         record();
+        if (!req.complete)
+            req.destroy();
+        lease.release();
     });
     req.pipe(out);
 }