create-windy 0.8.2 → 0.9.1

package/template/apps/agent-server/main.ts

@@ -0,0 +1,179 @@
+import { timingSafeEqual } from "node:crypto";
+import {
+  createServer,
+  type IncomingMessage,
+  type ServerResponse,
+} from "node:http";
+import { once } from "node:events";
+import { Readable } from "node:stream";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createCanonicalHandler } from "./runtime/index.js";
+import { configFromEnvironment } from "./runtime/config.js";
+import { nativeModelSlots } from "./native/config.js";
+import { authorizeWorkbench, createBoundary } from "./native/boundary.js";
+import { WorkbenchManager } from "./native/manager.js";
+import { workbenchHandshake, workbenchHttp } from "./native/http.js";
+import { attachWorkbenchSockets } from "./native/socket.js";
+import { projectHost } from "./project/host.js";
+
+export function internalAuthentication(token: string) {
+  if (token !== token.trim() || token.length < 32 || /[\r\n]/.test(token))
+    throw new Error(
+      "AGENT_SERVER_INTERNAL_TOKEN must be a strong internal credential",
+    );
+  const expected = Buffer.from(`Bearer ${token}`);
+  return (headers: Headers) => {
+    const actual = Buffer.from(headers.get("authorization") ?? "");
+    return (
+      actual.length === expected.length && timingSafeEqual(actual, expected)
+    );
+  };
+}
+
+export async function startAgentServer(
+  port = Number(process.env.PORT || 8080),
+) {
+  process.umask(0o077);
+  const authenticated = internalAuthentication(
+    process.env.AGENT_SERVER_INTERNAL_TOKEN ?? "",
+  );
+  const config = configFromEnvironment();
+  const canonical = createCanonicalHandler({ config });
+  const manager = new WorkbenchManager({
+    gateOrigin: `http://127.0.0.1:${port}`,
+    authorize: authorizeWorkbench,
+  });
+  const boundary = createBoundary({
+    manager,
+    projectRoutes: projectHost.boundaryRoutes,
+    completion: canonical.handleNativeCompletion,
+  });
+  const handle = async (request: Request): Promise<Response> => {
+    const path = new URL(request.url).pathname;
+    if (path.startsWith("/internal/boundary/")) return boundary(request);
+    if (path.startsWith("/internal/workbench")) {
+      if (!authenticated(request.headers))
+        return Response.json({ error: "UNAUTHENTICATED" }, { status: 401 });
+      if (path === "/internal/workbench-ready") {
+        const code =
+          !config.baseUrl || !config.model
+            ? "MODEL_ROUTE_UNAVAILABLE"
+            : process.platform !== "linux" || process.getuid?.() !== 0
+              ? "WORKBENCH_ISOLATION_UNAVAILABLE"
+              : nativeModelSlots() < 1
+                ? "WORKBENCH_CAPACITY_RESERVED"
+                : undefined;
+        return Response.json(
+          code ? { ready: false, code } : { ready: true, engine: "dsh" },
+          { status: code ? 503 : 200 },
+        );
+      }
+      if (
+        path !== "/internal/workbench-handshake" &&
+        !path.startsWith("/internal/workbench/")
+      )
+        return new Response(null, { status: 404 });
+      try {
+        if (path === "/internal/workbench-handshake")
+          return await workbenchHandshake(request, manager);
+        return await workbenchHttp(request, manager);
+      } catch {
+        return Response.json(
+          { error: "WORKBENCH_UNAVAILABLE" },
+          { status: 503 },
+        );
+      }
+    }
+    return (await canonical(request)) ?? new Response(null, { status: 404 });
+  };
+  const server = createServer(
+    (incoming, outgoing) => void transport(incoming, outgoing, handle),
+  );
+  const detachSockets = attachWorkbenchSockets(server, manager, authenticated);
+  await new Promise<void>((accept, reject) => {
+    server.once("error", reject);
+    server.listen(port, "0.0.0.0", accept);
+  });
+  const close = async () => {
+    detachSockets();
+    await manager.close();
+    await canonical.close();
+    server.closeAllConnections();
+    await new Promise<void>((accept) => server.close(() => accept()));
+  };
+  return { server, close, manager };
+}
+
+async function transport(
+  incoming: IncomingMessage,
+  outgoing: ServerResponse,
+  handle: (request: Request) => Promise<Response>,
+) {
+  const controller = new AbortController();
+  incoming.once("aborted", () => controller.abort());
+  outgoing.once("close", () => {
+    if (!outgoing.writableEnded) controller.abort();
+  });
+  try {
+    const headers = new Headers();
+    for (const [key, value] of Object.entries(incoming.headers)) {
+      if (typeof value === "string") headers.set(key, value);
+      else if (Array.isArray(value))
+        for (const item of value) headers.append(key, item);
+    }
+    const init: RequestInit & { duplex?: string } = {
+      method: incoming.method,
+      headers,
+      signal: controller.signal,
+    };
+    if (!["GET", "HEAD"].includes(incoming.method ?? "GET")) {
+      init.body = Readable.toWeb(
+        incoming,
+      ) as unknown as ReadableStream<Uint8Array>;
+      init.duplex = "half";
+    }
+    const response = await handle(
+      new Request(`http://agent.internal${incoming.url ?? "/"}`, init),
+    );
+    const responseHeaders: Record<string, string> = {};
+    response.headers.forEach((value, key) => {
+      responseHeaders[key] = value;
+    });
+    outgoing.writeHead(response.status, responseHeaders);
+    if (response.body) {
+      const reader = response.body.getReader();
+      try {
+        while (!controller.signal.aborted) {
+          const { value, done } = await reader.read();
+          if (done) break;
+          if (!outgoing.write(value))
+            await once(outgoing, "drain", { signal: controller.signal });
+        }
+      } finally {
+        await reader.cancel().catch(() => {});
+      }
+    }
+    outgoing.end();
+  } catch {
+    if (!outgoing.headersSent)
+      outgoing.writeHead(502, { "content-type": "application/json" });
+    outgoing.end(JSON.stringify({ error: "AGENT_RUNTIME_FAILED" }));
+  }
+}
+
+if (
+  process.argv[1] &&
+  resolve(process.argv[1]) === fileURLToPath(import.meta.url)
+) {
+  startAgentServer()
+    .then(({ close }) => {
+      const shutdown = () => void close().finally(() => process.exit(0));
+      process.once("SIGTERM", shutdown);
+      process.once("SIGINT", shutdown);
+    })
+    .catch(() => {
+      console.error("Agent Server startup failed");
+      process.exitCode = 1;
+    });
+}

package/template/apps/agent-server/native/EXTENSIONS.md

@@ -0,0 +1,46 @@
+# 当前用户的 DSH 扩展
+
+固定上游为 DSH `0.2.1-rc.2`。本轮只开放原生能力，不新增服务、公开端口或第二个管理站点。
+
+## 插件入口与持久化
+
+- 原生侧栏「插件」→「添加插件」：安装声明 `dsh.bundle.patch` 的 npm 包、Git 地址、压缩包 URL 或可读取的本地目录。安装、取消、日志、卸载确认、依赖构建脚本批准沿用官方 UI。
+- 插件自己的配置页在「插件」内；「设置」→「内置插件」提供全局运行清单。应用托管的共享模型地址、身份等配置仍由最后一层 deployment patch 固定，更改这些字段会被上游拒绝，不应绕开覆盖。
+- 上游 `plugin-manager`、`config-editor`、`settings`、`hmr` 和 `client-hmr` 原样组合。安装和启停由 HMR 实时应用，真正需要重启的情况由上游显示原因。
+- 插件安装写入每个用户 `DSH_HOME/profiles/web` 的 `package.json`、`pnpm-lock.yaml`、`node_modules`、`cordis.patch.yml` 等文件。worker 使用官方 `initProfile()` 仅补缺失文件，重启不清空个人清单、锁或两层个人 patch。
+- 安装器是镜像内固定的官方 npm 包 `pnpm@11.28.6`（MIT），由 Node 调用，不使用 curl 安装器。上游依赖 pnpm 的 `view/add/remove`、脚本批准和文件恢复语义；项目 monorepo 仍以 Bun 管理。Docker 补齐 Git 与 CA，便于上游 Git spec 安装。
+- `tool-plugin-manager` 保持禁用；技能文本不能静默安装插件代码。安装代码由用户在原生管理界面执行。
+
+开发阶段 `AGENT_DSH_USER_EXTENSIONS=1` 默认开启。设置为 `0` 并重启现有 Agent Server 会关闭扩展安装、配置及清单管理入口，同时关闭个人 Skills 默认根发现。此开关不会删除已安装文件，也不会停止已经保存为启用的可信插件；要撤销已有插件代码，应先在原生 UI 卸载或停用，再重启当前用户 worker / Agent Server。它不是恶意代码安全开关。
+
+## Skills 的实际操作
+
+上游原生尚无完整 Skills 安装页；项目通过公开侧栏/main slots 提供「技能」面板：
+
+1. 选择当前用户的真实工作区，查看默认技能（只读）或新建、编辑个人技能。
+2. 导入 `SKILL.md` 时先在编辑器确认正文；离线 ZIP 导入保留 scripts、references、assets，
+   导入不执行脚本。压缩包 4 MiB、展开 16 MiB、128 项、单文件 4 MiB、正文 128 KiB。
+3. 同名导入拒绝覆盖；编辑使用原正文 SHA256 防止旧编辑器覆盖。个人文件保存在
+   `.dsh/skills/<name>/SKILL.md`，官方提供方热发现，输入 `/name` 调用。
+4. 删除个人技能需再次确认；默认技能只读。导出单个技能 ZIP 后由用户自行交给其他用户主动导入，
+   不共享其他用户目录、会话或整个工作区。分享前自行复核通用正文和附件，去除案件数据及凭据。
+5. 显式调用 `/windy-skill-capture` 可以把已验证的通用方法沉淀为个人技能，不能自动把案件事实
+   复制到跨会话记忆。默认业务方法清单见 [Skills](../plugins/skills/README.md)。
+
+文件权限、压缩展开与路径校验、社区开源评估及公开接口升级检查见
+[技能管理插件](../plugins/skill-library/README.md)。
+
+随附 `/windy-extension-guide` 提供中文步骤，只允许用户显式调用。封闭的默认 subprocess 没有网络，因此不要承诺 Agent 可以自行 `git clone` 任意互联网技能仓库；先下载可信文件再上传，或用用户明确安装的可信插件提供该能力。
+
+## 信任与边界
+
+第三方插件在当前用户独立 UID 的 DSH Host 中运行，是用户授权的可信代码。它能访问当前用户的 HOME、会话和工作区，也可能自行执行网络与代码操作；不能声称它仍被默认 subprocess adapter 或工作区 Landlock 约束。其他用户 UID、root 协调器文件权限、容量 Gate 与业务 MCP 当前身份检查仍保留；真正的 Provider / 产品内部凭据不进入 worker 环境。不要在个人插件中填入共享 Provider 真凭据。
+
+个人依赖、安装缓存与文件计入现有用户 HOME 软配额。超限会终止该用户 worker，安装的大型插件可能需要明确调整额度；本轮没有基于显卡型号提高容量或修改生产环境。
+
+## 验证及升级检查
+
+`bun test apps/agent-server/native/extensions.test.ts apps/agent-server/plugins/locale/locale.test.ts`：真实官方 pnpm 安装本地无依赖合成 bundle，验证清单选择、锁文件和个人 patch 在再次初始化后原样保留，再卸载；真实官方文件系统提供方先观察空目录，再检测新 Skills 的 watcher 失效事件，读取、编辑、删除并确认另一用户目录未被发现。该测试不等于任意第三方包验收。另已用最终 ARM 镜像与内置浏览器验证原生安装/启停/重启保留/卸载，
+及个人 Skill 热发现和实际 slash 指令正文传入合成 Provider；详见项目验收记录。
+
+升级 DSH 时重新核对官方 `plugin-manager`、`config-editor`、`settings`、`ui-plugin-manager`、`skill-filesystem` 的公开契约，尤其是 profile patch 优先级、HMR、脚本批准、版本兼容检查和重启行为；升级 pnpm 需同时更新 Bun lock 并验证安装/卸载语义。

package/template/apps/agent-server/native/admission.ts

@@ -0,0 +1,73 @@
+/** Bounded FIFO: queued native work owns no model slot and aborts without retries. */
+export class AdmissionQueue {
+  private active = 0;
+  private waiting: Array<{ grant(): void; signal: AbortSignal }> = [];
+  constructor(
+    readonly maximum: number,
+    private readonly pendingLimit = 16,
+    private readonly timeoutMs = 90000,
+    private readonly available = () => true,
+    private readonly reserve = (): (() => void) => () => {},
+  ) {}
+  acquire(signal: AbortSignal): Promise<() => void> {
+    signal.throwIfAborted();
+    if (this.maximum < 1)
+      return Promise.reject(new Error("NATIVE_CAPACITY_DISABLED"));
+    if (!this.waiting.length && this.active < this.maximum && this.available())
+      return Promise.resolve(this.take());
+    if (this.waiting.length >= this.pendingLimit)
+      return Promise.reject(new Error("NATIVE_QUEUE_FULL"));
+    return new Promise((accept, reject) => {
+      const remove = () => {
+        clearTimeout(timer);
+        signal.removeEventListener("abort", abort);
+        const position = this.waiting.indexOf(entry);
+        if (position >= 0) this.waiting.splice(position, 1);
+      };
+      const abort = () => {
+        remove();
+        reject(signal.reason);
+        this.drain();
+      };
+      const entry = {
+        signal,
+        grant: () => {
+          remove();
+          accept(this.take());
+        },
+      };
+      const timer = setTimeout(() => {
+        remove();
+        reject(new Error("NATIVE_QUEUE_TIMEOUT"));
+        this.drain();
+      }, this.timeoutMs);
+      timer.unref?.();
+      this.waiting.push(entry);
+      signal.addEventListener("abort", abort, { once: true });
+      if (signal.aborted) abort();
+    });
+  }
+  drain() {
+    while (
+      this.waiting.length &&
+      this.active < this.maximum &&
+      this.available()
+    )
+      this.waiting[0]!.grant();
+  }
+  private take() {
+    const releaseReservation = this.reserve();
+    this.active++;
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      this.active--;
+      releaseReservation();
+      this.drain();
+    };
+  }
+  snapshot() {
+    return { active: this.active, queued: this.waiting.length };
+  }
+}

package/template/apps/agent-server/native/authorization.test.ts

@@ -0,0 +1,176 @@
+import { describe, expect, test } from "bun:test";
+import {
+  authorizationUnavailableResponse,
+  authorizeWorkbench,
+  isWorkbenchAuthorizationUnavailable,
+  WorkbenchAuthorizationUnavailable,
+  type WorkbenchAuthorizationOptions,
+} from "./authorization.js";
+
+const authority = {
+  actorId: "synthetic-user",
+  session: "synthetic-session",
+  publicOrigin: "http://synthetic.invalid",
+};
+const signal = () => new AbortController().signal;
+const options = (
+  fetcher: NonNullable<WorkbenchAuthorizationOptions["fetcher"]>,
+): WorkbenchAuthorizationOptions => ({
+  fetcher,
+  productOrigin: "http://synthetic-product.invalid",
+});
+const actorResponse = (id = authority.actorId, type = "user") =>
+  Response.json({ actor: { id, type } });
+
+async function unavailable(
+  input: WorkbenchAuthorizationOptions,
+  expectedReason: WorkbenchAuthorizationUnavailable["reason"],
+) {
+  let failure: unknown;
+  try {
+    await authorizeWorkbench(authority, signal(), input);
+  } catch (error) {
+    failure = error;
+  }
+  expect(isWorkbenchAuthorizationUnavailable(failure)).toBe(true);
+  expect((failure as WorkbenchAuthorizationUnavailable).reason).toBe(
+    expectedReason,
+  );
+  expect(String(failure)).not.toContain(authority.session);
+}
+
+describe("workbench authorization distinguishes denial from unavailable", () => {
+  test("fresh matching admission allows; trusted actor mismatch denies", async () => {
+    expect(
+      await authorizeWorkbench(
+        authority,
+        signal(),
+        options(async () => actorResponse()),
+      ),
+    ).toBe(true);
+    for (const response of [
+      actorResponse("other-user"),
+      actorResponse(authority.actorId, "service"),
+    ])
+      expect(
+        await authorizeWorkbench(
+          authority,
+          signal(),
+          options(async () => response),
+        ),
+      ).toBe(false);
+  });
+
+  test("only 401 and 403 are confirmed HTTP denial", async () => {
+    for (const status of [401, 403])
+      expect(
+        await authorizeWorkbench(
+          authority,
+          signal(),
+          options(async () => new Response("synthetic", { status })),
+        ),
+      ).toBe(false);
+    for (const status of [201, 204, 302, 400, 404, 408, 429, 500, 503])
+      await unavailable(
+        options(async () => new Response(null, { status })),
+        "upstream_status",
+      );
+  });
+
+  test("malformed JSON and incomplete actor are unavailable", async () => {
+    await unavailable(
+      options(async () => new Response("not-json")),
+      "invalid_response",
+    );
+    for (const body of [
+      null,
+      {},
+      { actor: null },
+      { actor: {} },
+      { actor: { id: 1, type: "user" } },
+      { actor: { id: "synthetic-user" } },
+    ])
+      await unavailable(
+        options(async () => Response.json(body)),
+        "invalid_response",
+      );
+  });
+
+  test("network failures do not become denial and do not retain raw error", async () => {
+    await unavailable(
+      options(async () => {
+        throw new Error(`synthetic private ${authority.session}`);
+      }),
+      "network",
+    );
+  });
+
+  test("real fetch timeout is unavailable", async () => {
+    const server = Bun.serve({
+      port: 0,
+      async fetch() {
+        await Bun.sleep(100);
+        return actorResponse();
+      },
+    });
+    try {
+      await unavailable(
+        { productOrigin: server.url.origin, timeoutMs: 10 },
+        "timeout",
+      );
+    } finally {
+      await server.stop(true);
+    }
+  });
+
+  test("caller cancellation is unavailable and never grants permission", async () => {
+    const controller = new AbortController();
+    controller.abort();
+    await expect(
+      authorizeWorkbench(
+        authority,
+        controller.signal,
+        options(async (_url, init) => {
+          init.signal!.throwIfAborted();
+          return actorResponse();
+        }),
+      ),
+    ).rejects.toMatchObject({
+      code: "WORKBENCH_AUTHORIZATION_UNAVAILABLE",
+      reason: "aborted",
+    });
+  });
+
+  test("each admission is fetched and denial cannot reuse a previous success", async () => {
+    let calls = 0;
+    const input = options(async (url, init) => {
+      expect(url).toBe(
+        "http://synthetic-product.invalid/api/agent/workbench/admission",
+      );
+      expect(new Headers(init.headers).get("authorization")).toBe(
+        `Bearer ${authority.session}`,
+      );
+      expect(init.redirect).toBe("error");
+      calls++;
+      return calls === 1
+        ? actorResponse()
+        : new Response(null, { status: 401 });
+    });
+    expect(await authorizeWorkbench(authority, signal(), input)).toBe(true);
+    expect(await authorizeWorkbench(authority, signal(), input)).toBe(false);
+    expect(calls).toBe(2);
+  });
+
+  test("unavailable response is retryable 503 with no cached login result", async () => {
+    const response = authorizationUnavailableResponse();
+    expect(response.status).toBe(503);
+    expect(response.headers.get("retry-after")).toBe("2");
+    expect(response.headers.get("cache-control")).toBe("no-store");
+    expect(await response.json()).toEqual({
+      error: "WORKBENCH_AUTHORIZATION_UNAVAILABLE",
+    });
+    expect(isWorkbenchAuthorizationUnavailable(new Error("ordinary"))).toBe(
+      false,
+    );
+  });
+});

package/template/apps/agent-server/native/authorization.ts

@@ -0,0 +1,118 @@
+import type { WorkbenchAuthority } from "./config.js";
+
+export type AuthorizationUnavailableReason =
+  | "upstream_status"
+  | "invalid_response"
+  | "network"
+  | "timeout"
+  | "aborted";
+
+/** Contains only safe classification metadata; never retain response bodies or credentials. */
+export class WorkbenchAuthorizationUnavailable extends Error {
+  readonly code = "WORKBENCH_AUTHORIZATION_UNAVAILABLE";
+
+  constructor(
+    readonly reason: AuthorizationUnavailableReason,
+    readonly status?: number,
+  ) {
+    super("Workbench authorization is temporarily unavailable");
+    this.name = "WorkbenchAuthorizationUnavailable";
+  }
+}
+
+export function isWorkbenchAuthorizationUnavailable(
+  error: unknown,
+): error is WorkbenchAuthorizationUnavailable {
+  return error instanceof WorkbenchAuthorizationUnavailable;
+}
+
+export function authorizationUnavailableResponse(): Response {
+  return Response.json(
+    { error: "WORKBENCH_AUTHORIZATION_UNAVAILABLE" },
+    {
+      status: 503,
+      headers: { "retry-after": "2", "cache-control": "no-store" },
+    },
+  );
+}
+
+export function productOrigin(): string {
+  const url = new URL(
+    process.env.AI_TOOL_HOST_URL ??
+      process.env.AGENT_CONTEXT_HOST_URL ??
+      "http://server:9747",
+  );
+  if (
+    url.username ||
+    url.password ||
+    url.search ||
+    url.hash ||
+    url.pathname !== "/"
+  )
+    throw new Error("Invalid product host");
+  return url.origin;
+}
+
+export interface WorkbenchAuthorizationOptions {
+  fetcher?: (url: string, init: RequestInit) => Promise<Response>;
+  timeoutMs?: number;
+  productOrigin?: string;
+}
+
+/** false means confirmed denial; unknown authorization must never become permission or revocation. */
+export async function authorizeWorkbench(
+  authority: WorkbenchAuthority,
+  signal: AbortSignal,
+  options: WorkbenchAuthorizationOptions = {},
+): Promise<boolean> {
+  const timeout = AbortSignal.timeout(options.timeoutMs ?? 5000);
+  const combined = AbortSignal.any([signal, timeout]);
+  const unavailable = () =>
+    new WorkbenchAuthorizationUnavailable(
+      signal.aborted ? "aborted" : timeout.aborted ? "timeout" : "network",
+    );
+  let response: Response;
+  try {
+    response = await (options.fetcher ?? fetch)(
+      `${options.productOrigin ?? productOrigin()}/api/agent/workbench/admission`,
+      {
+        headers: { authorization: `Bearer ${authority.session}` },
+        signal: combined,
+        redirect: "error",
+      },
+    );
+  } catch {
+    throw unavailable();
+  }
+  if (response.status !== 200) {
+    // Classification comes from status, never from an untrusted error payload.
+    await response.body?.cancel().catch(() => {});
+    if (response.status === 401 || response.status === 403) return false;
+    throw new WorkbenchAuthorizationUnavailable(
+      "upstream_status",
+      response.status,
+    );
+  }
+  let body: unknown;
+  try {
+    body = await response.json();
+  } catch {
+    if (combined.aborted) throw unavailable();
+    throw new WorkbenchAuthorizationUnavailable("invalid_response");
+  }
+  if (combined.aborted) throw unavailable();
+  const actor =
+    body && typeof body === "object" && "actor" in body ? body.actor : null;
+  if (
+    !actor ||
+    typeof actor !== "object" ||
+    !("id" in actor) ||
+    typeof actor.id !== "string" ||
+    !actor.id ||
+    !("type" in actor) ||
+    typeof actor.type !== "string" ||
+    !actor.type
+  )
+    throw new WorkbenchAuthorizationUnavailable("invalid_response");
+  return actor.id === authority.actorId && actor.type === "user";
+}

package/template/apps/agent-server/native/boundary-io.ts

@@ -0,0 +1,93 @@
+export class ProjectBoundaryError extends Error {
+  constructor(
+    readonly status: number,
+    readonly code: string,
+  ) {
+    super(code);
+  }
+}
+
+export async function abortable<T>(
+  pending: Promise<T>,
+  signal: AbortSignal,
+): Promise<T> {
+  if (signal.aborted) {
+    void pending.catch(() => {});
+    signal.throwIfAborted();
+  }
+  let abort!: () => void;
+  try {
+    return await Promise.race([
+      pending,
+      new Promise<never>((_accept, reject) => {
+        abort = () => reject(signal.reason);
+        signal.addEventListener("abort", abort, { once: true });
+        if (signal.aborted) abort();
+      }),
+    ]);
+  } finally {
+    if (abort) signal.removeEventListener("abort", abort);
+  }
+}
+
+export async function boundedBytes(
+  stream: ReadableStream<Uint8Array> | null,
+  limit: number,
+  signal: AbortSignal,
+): Promise<Uint8Array<ArrayBuffer>> {
+  signal.throwIfAborted();
+  if (!stream) return new Uint8Array();
+  const reader = stream.getReader();
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  try {
+    for (;;) {
+      const part = await abortable(reader.read(), signal);
+      if (part.done) break;
+      size += part.value.byteLength;
+      if (size > limit)
+        throw new ProjectBoundaryError(413, "PROJECT_BODY_TOO_LARGE");
+      chunks.push(part.value);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return bytes;
+  } finally {
+    void reader.cancel().catch(() => {});
+  }
+}
+
+export async function boundedProjectResponse(
+  response: Response,
+  maximum: number,
+  signal: AbortSignal,
+): Promise<Response> {
+  const declared = Number(response.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > maximum) {
+    void response.body?.cancel().catch(() => {});
+    throw new ProjectBoundaryError(502, "PROJECT_RESPONSE_TOO_LARGE");
+  }
+  let bytes: Uint8Array<ArrayBuffer>;
+  try {
+    bytes = await boundedBytes(response.body, maximum, signal);
+  } catch (error) {
+    if (error instanceof ProjectBoundaryError)
+      throw new ProjectBoundaryError(502, "PROJECT_RESPONSE_TOO_LARGE");
+    throw error;
+  }
+  return new Response(
+    [204, 205, 304].includes(response.status) ? null : bytes,
+    {
+      status: response.status,
+      headers: {
+        "content-type":
+          response.headers.get("content-type") ?? "application/json",
+        "cache-control": "no-store",
+      },
+    },
+  );
+}