[sentry]

A sandbox OPTIONS request through the egress proxy can reach executeCredentialedEgressRequest with a body stream that is already used. requestBodyBytes then calls request.arrayBuffer(), which throws TypeError: Body is unusable: Body has already been read. The proxy logs the exception and returns a 500.

Changes

• requestBodyBytes in packages/junior/src/chat/egress/credentialed.ts skips the body for OPTIONS, like GET and HEAD. Sandbox egress already treats OPTIONS as a read method.
• Writes with a used body still get the Junior egress 500 from fix(egress): Return a Junior error when the request body is unreadable #2068. The proxy does not send a credentialed write upstream without its payload.
• An integration test in tests/integration/sandbox-egress-proxy.test.ts sends an OPTIONS request with a used body. It checks that the proxy forwards it without a body.

Fixes JUNIOR-DQ

_{@sentry <feedback>: Autofix iterates on these changes
@sentry stop iterating: Autofix stops iterating on this run}

_{This PR was automatically generated by Sentry. You can adjust this setting at any time.}

via Junior system actor junior.

--

View Junior Session [Sentry]

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
junior-docs	Ready	Preview	Oct 21, 2026 11:14am UTC

[cursor]

Stale Bugbot comment from a previous run.

[sentry-junior]

The OPTIONS part is right. JUNIOR-DQ is a sandbox OPTIONS request (curl) that failed in requestBodyBytes, and sandbox egress already treats OPTIONS as a read.

The request.bodyUsed guard was not safe, though. It made a used body look like no body for every method. A POST with a used body would then go upstream with credentials and no payload. #2068 added the 500 to stop exactly that, and its integration test (returns a Junior egress error instead of forwarding an unreadable body) fails with this guard (202 instead of 500).

I pushed f8be21f:

• Removed the bodyUsed guard and kept the OPTIONS skip.
• Moved the test from the component suite to tests/integration/sandbox-egress-proxy.test.ts, next to the unreadable-body case. It sends an OPTIONS request with a used body and checks that the proxy forwards it with no body. On main it gets a 500, and with this change it passes.

Local: both sandbox-egress-proxy suites pass (58/58), and tsc --noEmit, oxlint, and the test-architecture check pass. CI is running on the new head.

[sentry-junior]

Ready for a human merge at f8be21f.

• The change only skips the body read for OPTIONS. Writes with a used body still get the Junior egress 500 from #2068, so the Bugbot finding about the bodyUsed guard no longer applies.
• The new integration test (forwards an OPTIONS request without reading its used body) gets a 500 on main and passes here. returns a Junior egress error instead of forwarding an unreadable body still passes.
• CI is green on this head, including test / junior integration, test / junior component, check / types, lint / workspace, CodeQL, Warden, and ci / required.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 65a4c0d. Configure here.}

[sentry-junior]

Still ready for a human merge at 081f01e. The head moved after my earlier note. The source fix is the same: requestBodyBytes skips the body read only for OPTIONS. A write with a used body still gets the Junior egress 500 from #2068.

The OPTIONS test is now in the component suite again. It sends a preflight with an empty body and uses that body before the proxy runs. So the stream is not null, and the test fails if the OPTIONS guard is removed. That covers the later Bugbot note about the test.

Local run at 081f01e:

• Both sandbox-egress-proxy suites (integration and component) pass, 58/58. That includes returns a Junior egress error instead of forwarding an unreadable body.
• With the OPTIONS line removed, the new test fails.

CI is green at this head, including ci / required. Both review threads are resolved.