fix(proxy): strip stale content encoding after reserialization

[ROOOO]

Summary

• strip stale content-encoding after non-raw request bodies are reserialized
• preserve content-encoding and exact request bytes for raw passthrough endpoints
• keep content-length handling on the existing outbound transport blacklist

This is a narrow follow-up to #1238.

Why

#1238 strips content-encoding after successful decompression, but an encoding retained or reintroduced later can still reach the final forwarded headers. Non-raw paths serialize a new JSON or multipart body, so that encoding no longer describes the transmitted bytes and can make the upstream decode plaintext. Raw passthrough paths still need the original encoding header.

Tests

• non-raw reserialization strips stale content-encoding and content-length
• raw passthrough preserves content-encoding and exact request bytes
• targeted proxy tests (14 tests)
• bun run build
• bun run lint
• bun run lint:fix
• bun run typecheck
• bun run test (879 test files passed; 8795 tests passed)
• git diff --check

Greptile Summary

The PR removes stale content-encoding metadata from reserialized outbound request bodies while preserving the header and exact bytes for raw-passthrough endpoints.

• Adds conditional cleanup of content-encoding after non-raw body serialization.
• Adds regression coverage for both reserialized and raw-passthrough requests.

Confidence Score: 5/5

The PR appears safe to merge, with the changed header handling aligned to the distinction between reserialized and raw-passthrough request bodies.

Non-raw outbound bodies are newly serialized before the encoding header is removed, while raw-passthrough bodies retain both their original bytes and encoding metadata; no actionable failure remains.

Important Files Changed

Filename	Overview
src/app/v1/_lib/proxy/forwarder.ts	Removes content-encoding only when a defined request body has passed through the normal preprocessing and serialization path.
tests/unit/proxy/proxy-forwarder-raw-passthrough-regression.test.ts	Covers stale framing-header removal for reserialized requests and preservation of encoding metadata and exact bytes for raw passthrough.

_{Reviews (1): Last reviewed commit: "fix(proxy): strip stale content encoding..." | Re-trigger Greptile}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T12:47:36.011871Z	0e713f6	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: e3df2748-2042-4ada-80d2-50bd0af40632

📥 Commits

Reviewing files that changed from the base of the PR and between 426b4a7 and 0e713f6.

📒 Files selected for processing (2)

• src/app/v1/_lib/proxy/forwarder.ts
• tests/unit/proxy/proxy-forwarder-raw-passthrough-regression.test.ts

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

本次修改在非 raw 请求重新序列化后移除过期的 content-encoding，并新增回归测试验证非 raw 与 raw 透传请求的不同头部和请求体行为。

Changes

请求体编码头处理

Layer / File(s)	Summary
重新序列化请求的编码头清理 src/app/v1/_lib/proxy/forwarder.ts	当请求体已序列化、未启用 bypassForwarderPreprocessing 且存在 content-encoding 时，ProxyForwarder 删除该请求头并记录调试日志。
raw 透传回归验证 tests/unit/proxy/proxy-forwarder-raw-passthrough-regression.test.ts	新增请求过滤器 mock。测试验证非 raw 请求移除 content-encoding 和 content-length，并验证 raw 请求保留原始请求体字节及 content-encoding。

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 0e713

The proxy now keeps forwarded encoding metadata aligned with reserialized request bytes while preserving raw passthrough behavior. No actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: ding113, tesgth032, brisbanehuang

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	描述准确说明了非 raw 请求移除过期的 content-encoding、raw 透传保留原始头部和请求字节，以及相关测试与验证结果。描述与变更内容直接相关。
Title check	✅ Passed	标题明确概括了主要修复：请求重新序列化后移除过期的 content-encoding。标题简洁、具体，并与代码变更一致。
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2 files.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Code Review Summary

No significant issues identified in this PR. The guard is correctly placed after all header-building and body-serialization branches (standard, Gemini, multipart, raw passthrough) and before init construction, so every forwarded request path sees the stripped headers. The condition asymmetry with the raw-passthrough branch (which additionally requires session.request.buffer) is unreachable in practice: ProxySession is only constructed via fromContext, which always sets request.buffer for body-carrying methods.

PR Size: S

• Lines changed: 87
• Files changed: 2

Review Coverage

• Logic and correctness - Clean
• Security (OWASP Top 10) - Clean
• Error handling - Clean (strip action is logged at debug level with provider context)
• Type safety - Clean
• Documentation accuracy - Clean (log message matches behavior)
• Test coverage - Adequate (both new tests verified passing locally: 7/7 in the target file)
• Code clarity - Good

---

Automated review by Claude AI