fix: complete debug-log request bounds

server/providers/common/request.js

@@ -17,21 +17,29 @@ async function readRequestBodyCapped(req, maxBytes) {
 function readRequestBody(req, maxBytes = 1024 * 1024) {
   return new Promise((resolve, reject) => {
     let total = 0;
+    let bodyTooLarge = false;
     const chunks = [];
     req.on('data', (chunk) => {
+      // Keep draining after the cap without retaining more bytes. Destroying
+      // the request also destroys its socket, so the handler cannot deliver
+      // the fixed error response it constructs for BODY_TOO_LARGE.
+      if (bodyTooLarge) return;
       total += chunk.length;
       if (total > maxBytes) {
         // Same marker readRequestBodyCapped sets, so a caller can tell an
         // oversized body from a genuine failure without matching on text.
+        bodyTooLarge = true;
+        chunks.length = 0;
         const error = new Error(`Request body exceeds ${maxBytes} bytes`);
         error.code = 'BODY_TOO_LARGE';
         reject(error);
-        req.destroy();
         return;
       }
       chunks.push(chunk);
     });
-    req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+    req.on('end', () => {
+      if (!bodyTooLarge) resolve(Buffer.concat(chunks).toString('utf8'));
+    });
     req.on('error', reject);
   });
 }

server/providers/openai/debug-log.js

@@ -46,6 +46,10 @@ function createDebugLogHandler({ sourceRoot = defaultSourceRoot } = {}) {
         () => 0,
       );
       if (size + Buffer.byteLength(line) > REALTIME_DEBUG_LOG_MAX_FILE_BYTES) {
+        // Node does not replace an existing destination on Windows. Remove the
+        // retained generation explicitly so every rotation behaves the same on
+        // supported platforms rather than failing after the first 64 MB.
+        await fsp.rm(`${logFile}.1`, { force: true });
         await fsp.rename(logFile, `${logFile}.1`);
       }
       await fsp.appendFile(logFile, line);
@@ -67,7 +71,7 @@ function createDebugLogHandler({ sourceRoot = defaultSourceRoot } = {}) {
     if (!allow(clientKey(req))) {
       res.writeHead(429, {
         'Content-Type': 'application/json',
-        'Retry-After': '5',
+        'Retry-After': '60',
       });
       res.end(JSON.stringify({ error: 'Rate limit exceeded' }));
       return;