feat(search): bound SearXNG response bodies

[ihor-sokoliuk]

Summary

• bound streamed SearXNG response consumption for search JSON, HTML fallback, error previews, instance capability discovery, and autocomplete
• keep request deadlines active through response-body reads and prevent failed or oversized bodies from populating caches or health success
• document SEARXNG_MAX_RESPONSE_BYTES, its strict grammar, limits, and per-response scope

Verification

• npm run lint
• npm run audit:deps and npm audit --omit=dev (0 vulnerabilities)
• npm run test:coverage (736/736; 94.90% lines, 92.02% branches)
• npm run build && npm run test:e2e (28/28; optional protected-PDF live endpoint skipped)
• npm run verify:packed-consumer (adapters=2.1.1, audit=0, tools=4)

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 90 complexity · 4 duplication

Metric	Results
Complexity	90
Duplication	4

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[Copilot]

Pull request overview

This PR introduces a centralized, byte-bounded response-body reader for SearXNG HTTP responses and updates search, instance capability discovery, and autocomplete flows to consume streamed bodies safely under explicit size/time limits.

Changes:

• Added src/searxng-response.ts to enforce per-response byte ceilings (full reads and bounded previews), plus auxiliary body cancellation helpers.
• Refactored search, HTML fallback, /config, and /autocompleter to use bounded body reads and to avoid caching/health-success on failed/oversized/partial bodies.
• Documented the new SEARXNG_MAX_RESPONSE_BYTES env var and expanded unit/integration/e2e tests to cover bounded streaming and timeout-through-body-consumption.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/suggestions.ts	Applies bounded body reads to autocomplete and keeps the request abort signal active during body consumption.
src/searxng-response.ts	New bounded response-body reader with preview mode, strict env parsing, and best-effort cancellation utilities.
src/search.ts	Refactors fetch handling to route responses through bounded readers for JSON, HTML fallback, and error previews; improves diagnostic URL redaction.
src/instance-info.ts	Bounds /config reads, cancels non-success bodies, and avoids logging sensitive URL components.
SECURITY.md	Documents response-body limit behavior and its security implications.
CONFIGURATION.md	Adds SEARXNG_MAX_RESPONSE_BYTES and clarifies deadline semantics through body streaming/decoding/parsing.
tests/unit/suggestions.test.ts	Adds unit coverage for suggestion byte limits, cancellation, malformed/partial bodies, and non-disclosure logging.
tests/unit/searxng-response.test.ts	New unit suite for bounded reader behavior, abort semantics, cancellation, and config parsing rules.
tests/unit/search.test.ts	Updates mocks to real Response bodies and adds coverage for bounded search/HTML fallback and non-caching on oversize/partial responses.
tests/unit/instance-info.test.ts	Adds coverage for bounded /config, negative caching on oversize/malformed, and timeout-through-body-consumption behavior.
tests/run-all.ts	Registers the new SearXNG response module test suite.
tests/integration/mcp-handlers.test.ts	Updates integration mocks to return real Response instances with readable bodies.
tests/helpers/mock-fetch.ts	Switches helper responses to real Response objects to better model single-use streamed bodies.
tests/e2e/timeout.e2e.ts	Adds e2e coverage ensuring SEARXNG_TIMEOUT_MS applies even when bodies stall after headers (JSON and HTML fallback).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[ihor-sokoliuk]

Review round 1 handling:

• Addressed both valid Codacy maintainability findings in 6699cd9 by extracting the bounded reader into focused helpers; the exported reader is now a 21-line orchestrator, while all streaming, cancellation, and lock-release tests remain green.
• Also made the fixed overflow error deterministic when stream cancellation triggers a same-turn abort, with a real ReadableStream regression.
• Left the search diagnostic helper unchanged because the reported 452-line method is a parser boundary miscount: the function begins at line 123 and ends before the next helper, while the annotation attributes hundreds of following lines to it. Exact false-positive adjudication will be handled against the new analysis.
• The initial review generated no inline findings.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated no new comments.