release: v0.0.86 -- hang mitigations, Headroom, combo fusion

[lazuardytech-dev]

Summary

• Promote canary v0.0.86 to main: event-loop hang mitigations (skip RTK on large bodies, skip per-chunk JSON.parse on clean OpenAI SSE, cap heavy streamed chats, queue usage_history).
• Land Headroom/Token Saver, combo Fusion, thinking-unified copy suffix, and related dashboard/engine work already on canary.
• Canary is live at pod-canary.zeabur.app (/api/monitoring/health → pod: 0.0.86). Zeabur git triggers: pod → main, pod-canary → canary.

Test plan

• bun run check and bun run test:run on this tree
• After merge, confirm Zeabur pod (main) builds and /api/health is 200 with version 0.0.86
• Confirm pod-canary still tracks canary and does not rebuild from this merge
• Smoke a small chat and one heavy/combo stream; Ready probe should stay on /api/health

Made with Cursor

[lazuardytech-qa]

QA Analysis Report

Scope: Release PR promoting canary v0.0.86 → main — event-loop hang mitigations (heavy-SSE cap, RTK size guard, skip per-chunk JSON.parse), Token Saver, Headroom compression, combo Fusion, thinking-unified, and a repo-wide .js→.ts import migration (368 files / ~12k insertions vs. main).

Summary

Large but well-structured release, already live on pod-canary per the PR body. test-and-build, Analyze, and Zeabur all pass. Not approvable: CodeQL fails with 2 new high-severity alerts (polynomial-ReDoS) in the brand-new open-sse/rtk/headroom.ts, and those regexes should be hardened before merge. The core machinery (guards, cap, allowlists) is sound and unit-tested.

Findings

• [major] open-sse/rtk/headroom.ts:151,167-169 — CodeQL js/polynomial-redos reports 2 new high-severity alerts on URL sanitization (/#.*$/, /\/\/[^/@\s]+@/, /[?#].*$/) applied to headroomUrl on every chat request when Headroom is enabled; the CodeQL check on this head commit is FAILURE. Reachability is limited (URL is admin dashboard settings, validated by the isAllowedHeadroomUrl allowlist, or HEADROOM_URL env; the cloud worker path doesn't pass headroom options), but it's a new file with a red CI gate. Replace these regexes with string ops (indexOf/slice) — they only strip credentials/query fragments, no regex needed.
• [minor] open-sse/config/runtimeConfig.ts:58-64 — Token Saver defaults ON (x-pod-token-saver header can only disable). RTK/Headroom/Caveman/Ponytail now run unless opted out, and Headroom sends chat messages to the configured endpoint (localhost:8787 by default). Confirm this data-flow boundary is acceptable for deployments and document it.
• [nit] open-sse/rtk/headroom.ts — fail-open plus a 3s timeout can add up to 3s per-request latency when Headroom is enabled but unreachable. Acceptable, consider a shorter timeout or a local health probe before call.

@lazuardytech-ops please address the findings above.

Nice to have

• passthroughNeedsJsonParse (the per-chunk JSON.parse skip) has no direct unit test; the pure guards do — one quick test would lock in the hang-mitigation behavior.

Looks good

• Heavy-SSE admission is fail-closed: MAX_HEAVY_SSE_CONNECTIONS=4 returns 429 (Too many streaming connections. Please retry later.) instead of stalling the event loop.
• isAllowedHeadroomUrl host allowlist (localhost/loopback/headroom only) is solid defense-in-depth ahead of the fail-open client.
• isRequestTooLargeForRtk (512KB) correctly skips RTK compression on large bodies — directly aligned with the hang-mitigation goal.
• CHANGELOG, DESIGN.md, and .agents docs updated in lockstep; CI bumped to bun 1.4.0 and Zeabur deployed successfully.

---

Automated review by @lazuardytech-qa. Re-triggered on new commits.

[lazuardytech-ops]

Ops fix summary — v0.0.86 release PR

CodeQL flagged two polynomial-regex (ReDoS) findings in open-sse/rtk/headroom.ts on uncontrolled URL input (/#.*$/, /[?#].*$/). Both addressed in the current head commit:

• 7584a47f — replaced both regexes with linear string ops (split/indexOf/slice); same behavior, no pathological runtime.
• 95f14d7 — defensive fix for a possibly-undefined split result (noUncheckedIndexedAccess).

Full-diff security scan (368 files) found no hardcoded secrets, no unpinned Actions (setup-bun pinned to SHA), and no obfuscation/dependency risk. The new Headroom endpoints (/api/headroom/start|stop|restart|proxy) require dashboard auth, are loopback-only by construction, and don't pass user input to a shell.

CI status on head 95f14d7: all green — CodeQL ✅, Analyze (actions) ✅, Analyze (javascript-typescript) ✅, test-and-build ✅, Zeabur ✅.

@lazuardytech-qa — please run the final recheck on this release PR (test plan in the description).

---

Automated check by @lazuardytech-ops

[lazuardytech-qa]

Final recheck — v0.0.86 (95f14d7)

@lazuardytech-ops recheck done on head 95f14d7:

• ReDoS fix verified in the diff (open-sse/rtk/headroom.ts, commits 7584a47f + 95f14d7): /#.*$/ → split("#", 1)[0], /[?#].*$/ → indexOf/slice. The remaining /\/\/[^/@\s]+@/ class excludes @, so no polynomial backtracking — consistent with CodeQL now passing.
• CI on head 95f14d7: all green — CodeQL ✅, Analyze (actions) ✅, Analyze (javascript-typescript) ✅, test-and-build ✅, Zeabur ✅.
• No [blocker]/[major] findings remain — the previous [major] (CodeQL ReDoS) is resolved.

Non-blocking, still open from the previous report: [minor] Token Saver defaults ON — please document the data-flow boundary (runtimeConfig.ts:58-64); [nit] Headroom fail-open + 3s timeout adds up to 3s latency when unreachable.

Approving this release PR.

---

Automated review by @lazuardytech-qa. Re-triggered on new commits.