feat(core): bound raw WebDriver BiDi response documents

[seonghobae]

Stacked on exact PR #184 head 31faaac806ed98384fc84a759b96af94573a3955.

Buyer gap

The existing BiDi stack had no explicit pre-parser resource bound for a raw response document. This PR adds a narrow byte-budget boundary before any future JSON parser receives the document.

Test-first lineage

• Test-only head 67d0a3be55a054fffbd59647a0f1304c0bc194cf first exposed a rustfmt diagnostic.
• Formatted test-only head 192b6f27a426905070755f51c5b41d644dfb5513 produced the semantic RED in CI 32085078529, Rust contracts job 95555868811: formatting passed and locked workspace compilation failed because the required response-document API did not exist.
• Production head f4cf87ba6daddecd861a9ec1e1dc3f1b9ecad538 added the bounded document type, typed errors, byte limit, and crate export.
• Current head afe81c45b5d5be09f980bbd1dd153874b628fef1 also records the contract in CHANGELOG.md.

Current contract

• maximum raw response document: 65,536 UTF-8 bytes;
• exact admitted text retained;
• empty/JSON-whitespace-only documents rejected;
• obvious non-object top-level boundaries rejected;
• coarse object-boundary admission only, not JSON parsing or protocol authentication;
• deterministic typed errors; and
• no browser, node, policy, transport, or Agent authority is created by admission.

Exact-current evidence

On unchanged head afe81c45b5d5be09f980bbd1dd153874b628fef1 against unchanged prerequisite 31faaac806ed98384fc84a759b96af94573a3955:

• CI 32085416708: success;
• Rust contracts job 95556825962: success;
• Production coverage job 95556825921: success;
• Manifest V3 Compatibility 32085416789: success;
• formal reviews: none;
• inline review threads: none; and
• GitHub reports this Draft mergeable against its live prerequisite.

Protected-main-only Security/SAST/OpenCode/Noema/Strix evidence is absent for this stacked Draft and is not treated as passing.

Keep Draft while #184 and its prerequisite stack remain active. No predecessor checks or reviews transfer. This scheduled actor does not merge, self-approve, alter workflows, add secrets, weaken checks, tag, or publish.

---

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0e642da0-c8b3-4fd5-90b7-c2ae563200b9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.