HEAD requests to streaming routes return the full body (HEAD handled only on sync path)

[thinkter]

Summary

HEAD requests to streaming routes return the full body (server.ts:334-343 handles HEAD only on the sync path).

Impact

A HEAD probe against a streaming route returns the full body instead of just headers, defeating the point of HEAD and wasting bandwidth (and breaking any client/monitor that expects HEAD to be cheap).

Evidence

• src/server.ts:334-343 — HEAD handling covers only the sync render path

Suggested fix

Short-circuit HEAD on the streaming path too: run the route match (for status/headers), but don't flush the body. Reuse the same HEAD handler across both paths.

From the AUDIT.md "Low-hanging" list.

[thinkter]

Implemented and verified on the published integrate/low-hanging branch (tip 6a54ac7). The combined branch passes typecheck, all 94 tests, and the production build.

[thinkter]

Reopened by security audit (commit abf4e87) — this was closed as COMPLETED but no fix landed and the bug still reproduces.

File: src/server.ts:366-376

The sync (non-streaming) branch correctly honors HEAD via request.method === "HEAD" ? null : document (~line 383). The streaming branch, however, returns new Response(stream, …) with no HEAD check, so a HEAD request to a loading/streaming route streams a full body.

Suggested fix: in the streaming branch, when request.method === "HEAD", skip the stream and return an empty body with the same headers/status.