chore(guard): clean up guard

[MasterPtato]

No description provided.

[MasterPtato]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• fix: remove graceful requirement for metrics aggregator #4060
• fix(guard): cache custom serve routes #4059
• fix(gateway): configure cors for error responses #4058
• chore(guard): clean up guard #4057 👈 (View in Graphite)
• fix: fix active req caculation, add hws metrics #4053
• main

---

How to use the Graphite Merge Queue

Add the label merge-queue to this PR to add it to the merge queue.

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

This stack of pull requests is managed by Graphite. Learn more about stacking.

[claude]

PR Review: Guard Cleanup

This PR represents a significant refactoring of the guard proxy service with substantial code reduction. The changes improve code organization and separation of concerns.

Strengths

1. Better Code Organization - dedicated modules improve separation of concerns
2. Removed Analytics Module - deletes unused code
3. Improved Type Safety - ResponseBody enum properly handles streaming/buffered responses
4. Request Context Encapsulation - better encapsulation with dedicated struct

Critical Issues

1. Resource Leak in WebSocket Error Handling (proxy_service.rs:647-655)

The code spawns a task to release in-flight counters but does not track completion. If the task panics or system shuts down, counters will not be released, causing resource leaks and potential DoS.

Recommendation: Use TaskGroup to spawn this task, OR use a Drop guard for cleanup, OR at minimum log failures.

2. Always Treating Responses as Streaming (proxy_service.rs:737-741)

The streaming detection is hardcoded to true. All responses are treated as streaming even for small JSON responses, causing potential memory inefficiency.

Recommendation: Implement proper streaming detection OR document why hardcoded OR remove dead code.

3. Silent WebSocket Task Failures (proxy_service.rs:1479-1672)

WebSocket custom serve handler spawns tasks that return Result but errors are never logged or handled.

Recommendation: Add error logging at minimum. Consider metrics/alerts for task failures.

4. Inconsistent Logging Levels

Mixed use of trace/debug/error throughout the file makes debugging difficult.

Recommendation: Establish consistent conventions (trace=verbose, debug=lifecycle, warn=retryable, error=fatal).

5. URL Parsing Security (proxy_service.rs:958-992)

Manual IPv6 and query string handling could be fragile for edge cases.

Recommendation: Add test coverage for IPv6 with ports, special characters in query strings, paths with fragments, multiple delimiters.

6. Code Duplication

WebSocket close frame handling is duplicated throughout lines 1500-1660.

Recommendation: Extract to helper function.

Minor Issues

• Request Context field visibility inconsistencies
• Missing documentation for new public types
• Removed test file - verify coverage still exists

Performance & Security

• Cache sizes are reasonable (10k entries with TTL)
• HTTP client pooling is appropriate
• Backoff implementation is correct
• Rate limiting defaults are reasonable
• X-Forwarded-For handling is correct
• Header sanitization is proper

Recommendations

Must Fix:

1. Fix spawned task resource leak for in-flight counter release

Should Fix:
2. Implement streaming detection properly or document hardcoded value
3. Add error handling/logging for WebSocket task failures
4. Standardize logging levels

Nice to Have:
5. Test coverage for URL parsing edge cases
6. Extract WebSocket close frame helper
7. Add documentation for public types
8. Verify test coverage

Overall Assessment

Solid refactoring that improves code organization. Main concerns are resource cleanup guarantees and hardcoded streaming flag. Request changes for critical resource leak issue, then approve after fix.

[pkg-pr-new]

More templates

• actor-actions
• actor-actions-vercel
• example-ai-agent
• example-ai-agent-vercel
• example-ai-and-user-generated-actors-freestyle
• chat-room
• chat-room-vercel
• example-cloudflare-workers
• example-cloudflare-workers-hono
• cross-actor-actions
• cross-actor-actions-vercel
• example-cursors
• example-cursors-raw-websocket
• example-cursors-raw-websocket-vercel
• example-cursors-vercel
• custom-serverless
• custom-serverless-vercel
• example-sqlite
• example-elysia
• example-elysia-vercel
• example-experimental-durable-streams-ai-agent
• example-experimental-durable-streams-ai-agent-vercel
• hello-world
• hello-world-vercel
• example-hono
• hono-react
• hono-react-vercel
• example-hono-vercel
• example-kitchen-sink
• example-kitchen-sink-vercel
• multi-region
• multi-region-vercel
• native-websockets
• native-websockets-vercel
• next-js
• example-raw-fetch-handler
• example-raw-fetch-handler-vercel
• example-raw-websocket-handler
• example-raw-websocket-handler-proxy
• example-raw-websocket-handler-proxy-vercel
• example-raw-websocket-handler-vercel
• example-react
• example-react-vercel
• scheduling
• scheduling-vercel
• state
• state-vercel
• example-stream
• example-stream-vercel
• example-trpc
• example-trpc-vercel

@rivetkit/cloudflare-workers

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/cloudflare-workers@4057

@rivetkit/db

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/db@4057

@rivetkit/framework-base

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/framework-base@4057

@rivetkit/next-js

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/next-js@4057

@rivetkit/react

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/react@4057

rivetkit

pnpm add https://pkg.pr.new/rivet-dev/rivet/rivetkit@4057

@rivetkit/sql-loader

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/sql-loader@4057

@rivetkit/virtual-websocket

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/virtual-websocket@4057

@rivetkit/engine-runner

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/engine-runner@4057

@rivetkit/engine-runner-protocol

pnpm add https://pkg.pr.new/rivet-dev/rivet/@rivetkit/engine-runner-protocol@4057

commit: 30b52ba