fix(request): stream-stall failover, private-header prefix block, pinned-index message - #546

Summary

Fixes three latent issues in the modules #532 extracted — all pre-existing behavior moved verbatim by the carve (same code on main inside runtime-rotation-proxy.ts), fixed here so #532 stays zero-behavior-change. The first was found by writing #532's unit suites; the other two are CodeRabbit review findings on #532.

Stacked on #532 (claude/audit-15-rotation-proxy-carve). Merge #532 first; this PR then shows only the two fix commits.

Fix 1 — stream stall forwarded as clean success (withTimeout ordering)

withTimeout invoked onTimeout before rejecting. forwardStreamingResponse's onTimeout cancels the stream reader, and cancelling a reader settles the pending read() with {done: true} ahead of the rejection in the microtask queue — so Promise.race resolved. A stalled upstream stream was forwarded to the client as a clean end-of-stream: truncated body with a normal end(), no status.lastError, and the onStreamError failover hook never fired; the stall branch of the catch block was unreachable. Fix: reject first, then run onTimeout. readErrorBody (the only other caller) passes a no-op onTimeout and is unaffected.

Fix 2 — private account headers blocked by prefix (CodeRabbit, security guideline)

responseHeadersForClient filtered account metadata with an exact-name allowlist (x-codex-multi-auth-account-{index,label,email,id}); a future header under the same prefix would have leaked to clients by default. The filter now blocks the entire x-codex-multi-auth-account- prefix.

Fix 3 — null pinned index rendered as "Pinned account 1" (CodeRabbit)

On the pin-desync path buildPinnedUnavailableErrorBody reported pinnedAccountIndex: null but the human-readable message claimed "Pinned account 1", contradicting the payload. The message now says "The pinned account is currently unavailable…" when the index is unknown; the machine-readable fields are unchanged.

Changes

• lib/request/stream-failover-runtime.ts: timer-callback ordering swap (with the ordering constraint documented); prefix-based private-header filter replacing the exact-name set.
• lib/request/rate-limit-decision.ts: null-index message branch.
• test/stream-failover-runtime.test.ts: stall test flipped from pinned-bug to intended behavior; new prefix-coverage case (x-codex-multi-auth-account-plan / mixed-case future field blocked).
• test/rate-limit-decision.test.ts + test/issue-474-pin-honored.test.ts: null-index expectations updated to the corrected message (the issue-474 test previously pinned the contradictory message).

Validation

• npm run typecheck; eslint on all touched files --max-warnings=0
• npx vitest run rate-limit-decision + stream-failover-runtime + issue-474-pin-honored + runtime-rotation-proxy: 147 passed, 2 failed — the 2 are the known IPv6 ::1 bind environment failures from the documented baseline

Risk / Rollback

Three small, isolated fixes; the only client-visible deltas are that stalled streams now take the (previously dead) error path, unknown future account headers are stripped, and the desync message no longer fabricates an index. Revert the two commits to roll back.

https://claude.ai/code/session_01XNtnkLbBiXZxfQQYLMpucB

note: greptile review for oc-chatgpt-multi-auth. cite files like lib/foo.ts:123. confirm regression tests + windows concurrency/token redaction coverage.

Greptile Summary

fixes a latent race condition in withTimeout where onTimeout was called before reject, allowing reader.cancel() to settle the pending read() with {done: true} ahead of the rejection — causing Promise.race to resolve a stalled stream as a clean end-of-stream. also fixes a null-index desync message bug and upgrades the private header filter from an exact-name set to a prefix check.

• withTimeout ordering fix: reject() now fires before onTimeout(), ensuring the race rejection is enqueued first; stalled streams now correctly destroy the response, set lastError, and fire onStreamError
• prefix-based header filter: PRIVATE_CLIENT_RESPONSE_HEADERS set replaced with startsWith(\"x-codex-multi-auth-account-\") — any future account-identifying header is blocked by default instead of leaking until added to an allowlist
• null-index message fix: buildPinnedUnavailableErrorBody no longer fabricates "Pinned account 1" when pinnedIndex is null, keeping the human-readable message consistent with pinnedAccountIndex: null

Confidence Score: 5/5

safe to merge — the change is a two-line swap in a single timer callback, isolated to withTimeout, and the stall error path it restores was already fully implemented; the only behavioral delta is that stalled streams now take the intended error path

the ordering fix is mechanically correct: reject() enqueues the rejection synchronously before any reader.cancel() microtask can settle the read() promise, so Promise.race cannot resolve ahead of it. the forwardStreamingResponse stall test proves the end-to-end behavior and is a reliable regression pin. the two companion fixes (null-index message, prefix header filter) are small and independently verified by their own test updates.

test/stream-failover-runtime.test.ts — the withTimeout ordering guarantee is only covered end-to-end via the forwardStreamingResponse stall test; a direct withTimeout unit test that lets onTimeout settle the inner promise would make the regression harder to miss in a future refactor

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant Timer as setTimeout callback
    participant Race as Promise.race
    participant Read as reader.read()
    participant Cancel as reader.cancel()

    note over Timer,Cancel: BEFORE fix (buggy)
    Timer->>Cancel: onTimeout() → reader.cancel()
    Cancel-->>Read: "settles {done:true} (microtask)"
    Timer->>Race: reject(Error)
    Read-->>Race: "resolves {done:true} wins race ❌"
    note over Race: resolves — stall silently ends stream

    note over Timer,Cancel: AFTER fix (correct)
    Timer->>Race: reject(Error)
    note over Race: rejection enqueued in microtask queue
    Timer->>Cancel: onTimeout() → reader.cancel()
    Cancel-->>Read: "settles {done:true} (later microtask)"
    Race-->>Race: rejection wins — caught by forwardStreamingResponse ✅
    note over Race: rejects — lastError set, res.destroy(), onStreamError fires

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
test/stream-failover-runtime.test.ts:135-152
**missing ordering-specific unit test for `withTimeout`**

the existing `withTimeout` stall test covers the rejection path but passes a promise that can never settle on its own (`new Promise<never>(() => undefined)`), so it doesn't exercise the exact failure mode this PR fixes — where `onTimeout`'s side effects *do* settle `promise` before the rejection wins the race. the regression is proven end-to-end via the `forwardStreamingResponse` stall test, but a targeted `withTimeout` unit test (one where `onTimeout` triggers settlement of the inner promise, e.g. by cancelling a real stream reader) would pin the ordering guarantee closer to the function itself and survive a refactor of `forwardStreamingResponse`.

_{Reviews (2): Last reviewed commit: "fix(request): block private account head..." | Re-trigger Greptile}