fix(devin): bound held signature-type payloads

[luvs01]

Summary

• Count signatureType alongside reasoning and signatures in Devin's held UTF-16 payload budget, so these events obey the existing 1 MiB fallback limit.
• Admit Cloud-Direct signature-type wire fields only up to 4 KiB before UTF-8 decoding. Preserve the accompanying signature when an oversized type is ignored.
• Carry my original change, source commit 3a257a6b72169ced57d4ef44faa11bbfdb9997cf, with exact-byte/multibyte boundaries and below-budget unsigned-retry preservation tests. No authentication flow or credential destination changes.

Verification

• Base: cda8ff4e4eb5c48d7af1f5b108e6551fbdc1e5d3; validated head: 46a3ceac9568e14e8103c9fc5de12c81514e806d. Latest inspected dev was 3008bae77043701fe0f6200c9117ab7e1f9da2ee, 4 commits ahead, without changes to the affected runtime/test files.
• Bun 1.4.0: bun test tests/providers/devin-reasoning-continuation.test.ts tests/providers/devin-anthropic-signature-fallback.test.ts: 27 pass, 0 fail. The initial 26-test set against the base runtime produced 23 pass, 3 expected failures before the fix; the final set additionally includes the connected envelope/replay regression.
• bun run typecheck, bun run structure:check, bun run privacy:scan, bun run scripts/file-size-ratchet.ts, and git diff --check: passed.
• Focused local validation uses the documented resource exception: preparing this Windows checkout required costly file I/O, and the transfer series reuses one worktree and its verified dependency cache. Both changed runtime paths are exercised by the focused files, including refusal/retry behavior and the buffer threshold. The full local suite and test:changed have not been run on this head; broader import-connected/platform coverage remains for exact-head CI. No timeout or baseline was relaxed.
• Added a named wire-byte cap and a decoder-to-stored-envelope-to-replay regression: the original signature remains on wire field Add configurable context window caps #12 and an oversized type is absent from Streaming text duplicates and code-edit turns can stall before fileChange events under opencodex #18. This reuses the existing untyped legacy path; offline fixtures do not establish provider acceptance.
• Exact-head CI (46a3ceac9568e14e8103c9fc5de12c81514e806d) passed, including the CI aggregate, all four Linux test shards, gates, structure and hygiene. Optional platform/docs/privacy jobs marked skipped are not counted as passes. CodeRabbit completed a full review covering this exact head with no actionable findings; its docstring-coverage warning is advisory, not a repository gate.
• The readiness checklist is attested against this exact head and the documented focused-validation exception. CodeRabbit review is complete; no Codex review result has been received, and there are no current-head Codex/CodeRabbit inline findings to resolve. Maintainer approval/sponsorship before merge, where applicable, is a separate requirement.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

The privacy scan passed and synthetic fixtures contain no real credentials. The current-head CodeRabbit security-architecture review reports no architecture-level concerns. This automated review is not maintainer approval or sponsorship for merge.

Review readiness

• Required local validation passed with its scope documented.
• Branch is on the latest dev commit (within the documented maximum 10-commit window; inspected base is 4 commits behind).
• All correct Codex and CodeRabbit findings are fixed.
• Ready for review.

Summary by CodeRabbit

• Bug Fixes

  • Improved handling of large reasoning-signature metadata: oversized type information is omitted while the signature remains available.
  • Retry handling now accounts for signature-type data when enforcing payload limits, helping prevent oversized retries from proceeding.

• Documentation

  • Clarified the size limits applied to signature-type data and held retries.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 502173ad-c119-47e3-9cdc-5c1d19b20be2

📥 Commits

Reviewing files that changed from the base of the PR and between 04731c1 and 46a3cea.

📒 Files selected for processing (5)

• src/adapters/devin.ts
• src/adapters/devin/cloud-direct/chat.ts
• structure/providers-and-adapters.md
• tests/providers/devin-anthropic-signature-fallback.test.ts
• tests/providers/devin-reasoning-continuation.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The Devin chat-frame decoder omits signature types larger than 4 KiB. Held-retry size accounting now includes signature-type length. Tests cover decoding, replay, and retry behavior.

Changes

Devin signature limits

Layer / File(s)	Summary
Limit decoded signature types src/adapters/devin/cloud-direct/chat.ts, tests/providers/devin-reasoning-continuation.test.ts	The decoder omits signature types larger than 4 KiB while preserving the signature. Tests cover the byte limit and replay behavior.
Count signature types in held-retry payloads src/adapters/devin.ts, tests/providers/devin-anthropic-signature-fallback.test.ts, structure/providers-and-adapters.md	Held-retry size accounting includes signature-type length. Tests cover retry behavior at different queue sizes. The documentation describes the queue cap and the per-signature-type limit.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Bug fix

Suggested reviewers: lidge-jun

Merge Risk: ⚪ Minimal · up to 46a3c

The change bounds signature types while preserving signatures and accounting for retained types in the retry budget. No merge-blocking defect is established; normal checks and Draft readiness remain prerequisites to merging.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 46a3c

The change strengthens payload limits without expanding access, credential destinations, or tool authority. Remaining uncertainty is limited to live-provider compatibility and execution paths not demonstrated by focused validation.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The affected attack surface remains provider-controlled response bytes entering the existing chat decoder and request-local held-response state. Malicious or faulty upstream signature types can influence allocation and fallback timing, but this change restricts those inputs rather than adding callers, privileges, destinations, or tool-execution paths.

Trust Boundaries and Controls

• observed — The new byte check operates before signature-type string allocation. Existing stream processing still limits both encoded frame length and gzip output to 16 MiB. Credential-bearing requests retain endpoint resolution and redirect rejection; the inspected diff does not alter those controls.

Resilience and Maintainability Implications

• observed — The added regressions distinguish safe below-budget recovery from above-budget flushing: below-budget signature types allow an unsigned retry without exposing refused signatures, while above-budget types expose the signed attempt and its error without issuing that retry. This preserves the existing protection against mixing signatures from one attempt with reasoning from another.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 4 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: adding bounds to Devin held signature-type payloads. It matches the code, documentation, and regression-test changes.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 4 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

리뷰 · 우선순위 34 / 80

이 PR은 Devin이 서명된 답을 잠시 들고 있을 때, signatureType(서명 종류 문자열)까지 같이 크기 계산에 넣도록 고칩니다. 예전에는 reasoning 글자와 signature만 세서, 종류 문자열이 커져도 1 MiB 한도를 피할 수 있었습니다. 또 Cloud-Direct 쪽에서 와이어로 오는 종류 필드(#21)는 UTF-8로 읽기 전에 4 KiB를 넘으면 버리고, 같은 프레임의 signature 자체는 남깁니다. 문서도 그 규칙에 맞게 고쳤고, 한도 바로 아래·바로 위·멀티바이트(é) 경계 테스트가 붙어 있습니다. base는 dev이고, 인증/자격 증명 경로는 건드리지 않습니다. 초점은 “안 믿어도 되는 페이로드가 메모리를 키우지 않게”입니다.

라인 - src/adapters/devin/cloud-direct/chat.ts의 4_096이 이름 없는 숫자로만 있습니다. 테스트·구조 문서에도 같은 숫자가 흩어져 있어서, 나중에 한도만 바꿀 때 한곳을 빠뜨리기 쉽습니다. 상수 이름 하나(예: 와이어 종류 상한)로 묶을지 정하면 좋습니다.
라인 - 종류 문자열이 4 KiB를 넘으면 조용히 빼고 signature만 남깁니다. 의도는 테스트로 보이지만, 종류 없는 signature가 이후 재전송·저장 경로에서 “종류 있음”과 다르게 동작하는지 한번만 확인이 필요합니다.
라인 - PR이 Draft이고 본문 checklist도 아직 ready가 아닙니다. 코드 방향은 좁고 테스트도 경계가 분명하지만, exact-head CI·upstream 리뷰 전에 머지 후보로 보지 않는 편이 맞습니다.

메인테이너의 판단이 필요한 지점
종류 필드를 버릴 때 signature를 살리는 현재 동작이 제품 규칙과 맞는지, 아니면 종류가 없으면 signature도 같이 버려야 하는지. 또 4 KiB 상한을 코드·테스트·문서가 공유하는 named constant로 둘지.

너의 추천
방향은 맞고, 들고 있는 예산에 signatureType을 넣는 수정과 와이어 4 KiB 컷은 유지하는 쪽을 추천합니다. Draft를 Ready로 올리기 전에 상수 정리 여부만 짧게 정하고, 종류 드롭 시 signature 보존이 의도한 제품 동작인지 한 줄로 확인한 뒤 머지하면 됩니다. types.ts/config.ts 분리나 중복 PR 이슈는 이 변경과 무관합니다.

이 댓글은 grok-bot이 작성했습니다

[luvs01]

Addressed the boundary-review questions in 46a3ceac9568e14e8103c9fc5de12c81514e806d: the 4 KiB wire limit now has a named constant. A connected offline regression decodes an oversized field #21, stores the unchanged signature via the existing untyped legacy envelope, parses/maps it, and verifies identical wire #12 with #18 absent. This does not create a new signature or alter model-based Anthropic fallback, and does not claim live provider acceptance.

The focused files pass 27 tests; typecheck, structure, privacy, file-size ratchet and whitespace checks pass. Initial-head CI passed; updated-head CI and independent upstream review remain pending. The PR stays Draft.

@coderabbitai full review
@codex review

[coderabbitai]

✅ Action performed

Full review finished.

[lidge-jun]

Maintainer integration into dev (MAINTAINERS.md, dev-only exception) by @lidge-jun.

• Head 46a3ceac95: Cross-platform CI 36706299465 (pull_request, attempt 1) passed, including all four Linux test shards.
• Independent review: signature-type strings now count toward the held UTF-16 budget (src/adapters/devin.ts) and the 4 KiB wire limit applies before decoding (src/adapters/devin/cloud-direct/chat.ts). No auth, credential, config-write or logging change.
• Local integration: merged together with fix(devin): bound held signature-type payloads #6315, fix(devin): score family axes sparsely with own-key targets #6324 and fix(codex): preserve TOML values and routing marker ownership #6308 onto dev b933aa2; bun run typecheck passes and the PRs' own test files pass (197 pass / 0 fail).
• scripts/ci/assert-mergeable-review.sh --maintainer-integration OK at this head. Cross-platform CI for the final dev tip runs once after this landing batch.

Thanks @luvs01!