Improve error handling and add response size cap with timeout

[robgruen]

This pull request introduces robust safeguards against denial-of-service (DoS) risks in both the Python and TypeScript language model clients by enforcing maximum response body sizes and request timeouts. It also improves error handling for unexpected or malformed responses and adds comprehensive tests to ensure these protections work as intended.

Python: DoS Hardening and Tests

• Response Size Limiting:
  • Adds a max_response_bytes property (default 100 MB) to HttpxLanguageModel, and enforces it by incrementally reading response bodies and aborting if the limit is exceeded. This prevents memory exhaustion from malicious or buggy endpoints. [1] [2]
  • Introduces _ResponseTooLargeError for clear error reporting when the limit is exceeded.
• Tests:
  • Adds tests for the new response size limit, including both fast-fail (via Content-Length) and incremental reading, as well as disabling the limit.

TypeScript: DoS Hardening and Error Handling

• Response Size and Timeout Enforcement:
  • Adds maxResponseBytes (default 100 MB) and timeoutMs (default 10 minutes) options to TypeChatLanguageModel, enforcing them in all REST API calls to prevent resource exhaustion and indefinite hangs. [1] [2] [3] [4] [5]
  • Implements fetchWithTimeout and readResponseJson utilities for incremental response reading and timeouts.
• Improved Error Handling:
  • Updates the model client to return structured errors (not exceptions) when responses are malformed or missing expected fields, preventing unhandled promise rejections and improving reliability. [1] [2]
• Regression Tests:
  • Adds tests to ensure that malformed or unexpected responses are handled gracefully and do not cause promise rejections or DoS vulnerabilities. [1] [2]

These changes significantly improve the resilience and reliability of the language model clients against large or malformed responses and network issues.