fix(server): strip hop-by-hop proxy response headers (#813)

* fix(server): strip hop-by-hop proxy response headers

* chore(ui): remove unused markdown runtime destructures

packages/web/server/lib/opencode/proxy.js

@@ -1,6 +1,8 @@
 import express from 'express';
 import { createProxyMiddleware } from 'http-proxy-middleware';
 
+import { shouldForwardProxyResponseHeader } from '../../proxy-headers.js';
+
 export const registerOpenCodeProxy = (app, deps) => {
   const {
     fs,
@@ -160,6 +162,13 @@ export const registerOpenCodeProxy = (app, deps) => {
         // This avoids compressed-body/header mismatches in multi-proxy setups.
         proxyReq.setHeader('accept-encoding', 'identity');
       },
+      proxyRes: (proxyRes) => {
+        for (const key of Object.keys(proxyRes.headers || {})) {
+          if (!shouldForwardProxyResponseHeader(key)) {
+            delete proxyRes.headers[key];
+          }
+        }
+      },
       error: (err, _req, res) => {
         console.error('[proxy] OpenCode proxy error:', err.message);
         if (res && !res.headersSent && typeof res.status === 'function') {

packages/web/server/proxy-headers.test.js

@@ -23,6 +23,11 @@ describe('OpenCode proxy header handling', () => {
     expect(shouldForwardProxyResponseHeader('Content-Encoding')).toBe(false);
   });
 
+  it('drops transfer-encoding from forwarded response headers', () => {
+    expect(shouldForwardProxyResponseHeader('transfer-encoding')).toBe(false);
+    expect(shouldForwardProxyResponseHeader('Transfer-Encoding')).toBe(false);
+  });
+
   it('still keeps ordinary response headers', () => {
     expect(shouldForwardProxyResponseHeader('content-type')).toBe(true);
     expect(shouldForwardProxyResponseHeader('etag')).toBe(true);