- Added internal protobuf wire codecs, message builders, and protocol definitions for Cursor and Devin providers.
- Deferred loading of OTel SDK and OTLP exporters and added bounded caches to optimize startup and lookup performance.
- Added SQLite-backed parse caching for legacy extension source analysis and streaming file chunk parsing for changelogs.
- Added support for rendering context usage overflow above 100% in the status line component.
The Devin Connect streaming reader in `streamDevin` buffered incoming
chunks with `Buffer.concat` and only dispatched a frame once
`pending.length >= 5 + len`, where `len` was an attacker-controlled
32-bit big-endian length prefix. A malicious or buggy peer that
advertised a length up to 2^32 - 1 could force the reader to buffer
gigabytes before `iterateWithIdleTimeout` fired.
Rejected the frame at the length-prefix decode site: added a
`MAX_CONNECT_FRAME_PAYLOAD` (16 MiB) constant next to the flag
constants and threw `AIError.ProviderResponseError({ kind: "envelope" })`
before the loop ever waited for more bytes. Any legitimate Cascade
response fits comfortably; corrupt lengths fail fast.
Added `packages/ai/test/devin-frame-cap.test.ts` covering both the
early-throw path and the finalized error surface.
Fixes#4228
can1357