fix(providers): bound quota response parsing

[luvs01]

Summary

• Route every provider-quota JSON response through one 512 KiB bounded reader with total and inactivity deadlines.
• Preserve transient fallback and last-good semantics when a quota endpoint stalls, returns malformed JSON, or exceeds the budget.
• Cover the earlier Cursor period and summary probes as well as the final auth-usage fallback, and prevent new direct Response.json() quota probes.

Verification

• Bun 1.3.14: bun test tests/provider-quota.test.ts — 97 passed on current dev.
• bun run typecheck — passed.
• bun run privacy:scan — passed.
• git diff --check origin/dev...HEAD — passed.
• Full bun run test was attempted once. The long Windows run hit existing effective-account/catalog isolation failures and ultimately a Bun 1.3.14 panic after 1,221 seconds; no changed-path failure was observed. It was not retried.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed; none are required for this internal quota-reader hardening.
• Security-sensitive changes were reviewed for untrusted response bounds, cancellation, timeouts, and credential-safe fallback behavior.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[coderabbitai]

📝 Walkthrough

Walkthrough

Quota responses now use a 512 KiB bounded reader with timeouts, cancellation, safety checks, and unified parse-failure handling. All provider quota probes and Cursor fallback endpoints use the reader. Tests cover oversized, stalled, malformed, and fallback responses.

Changes

Quota response safety

Layer / File(s)	Summary
Bounded quota JSON reader src/providers/quota.ts	Lines 37–38 define the 512 KiB limit. Lines 266–302 add bounded reading with total and inactivity timeouts, cancellation, size checks, JSON validation, and a test-only wrapper.
Provider quota integration src/providers/quota.ts	Lines 397–1807 replace unrestricted parsing across provider probes. Cursor endpoints retain fallback behavior when responses are malformed or exceed the limit.
Quota boundary and fallback tests tests/provider-quota.test.ts	Lines 102–1940 test direct-parser removal, stalled and oversized response cancellation, A6API transient handling, Cursor fallback selection, and last-good report preservation.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant QuotaProbe
  participant readQuotaJson
  participant ResponseBody
  QuotaProbe->>readQuotaJson: Read provider quota response
  readQuotaJson->>ResponseBody: Consume bounded response body
  ResponseBody-->>readQuotaJson: JSON bytes or read failure
  readQuotaJson-->>QuotaProbe: Parsed quota data or transient failure

Loading

Possibly related PRs

• lidge-jun/opencodex#866: Adds bounded, failure-safe HTTP response-body parsing for quota-related handling in another module.
• lidge-jun/opencodex#878: Also modifies src/providers/quota.ts for Codex quota aggregation and fallback behavior.

Suggested reviewers: lidge-jun, wibias, byongshintv

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: bounding provider quota response parsing.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

✅ READY

• all PR quality gates passed; the review readiness checklist is complete.

Review readiness checklist

• ✅ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ✅ My PR is ready for review.

✅ 4/4 boxes ticked.

This pull request is already Ready for Review.
The review-ready label marks this PR as ready; review automation runs independently. If no CodeRabbit review appears, comment @coderabbitai review to request one.
Maintainers: @lidge-jun @Ingwannu @Wibias

[coderabbitai]

@github-actions[bot] I will review pull request #1387. I am replying to the latest comment only. The earlier comment chain is unavailable.

⚠️ Action not completed

Already reviewed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@github-actions[bot] Acknowledged. Pull request #1387 is marked ready for review.

_{You are interacting with an AI system.}

[Wibias]

All your descriptions are messed up. Please fix it @luvs01

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@github-actions[bot] Acknowledged. Pull request #1387 is ready for review.

_{You are interacting with an AI system.}

[Wibias]

Reviewed current head 27d1b5f. The shared quota JSON reader bounds retained bytes at 512 KiB, adds total and inactivity deadlines, cancels oversized/stalled bodies, and converts malformed/oversized reads into the same transient null/fallback semantics used by the quota probes. Cursor fallback coverage and A6API last-good coverage exercise the important multi-probe paths, and the source guard prevents new direct Response.json quota probes. Cross-platform CI is green. No actionable correctness, security, or availability findings.

[Wibias]

Thanks @luvs01! 🙏 Nice hardening pass on provider quota parsing, especially the bounded body handling and preserved fallback semantics. Merged into dev.