[diegosouzapw]

Closes #4380

Problem

Large /v1/chat/completions JSON bodies (270–550 KB coding-agent payloads) were JSON-parsed twice: once in the route (request.clone().json() for the prompt-injection guard), then again in handleChat (request.json()). Under concurrent load this doubled the body's heap residency on the hot path and contributed to the heap-OOM crash-loop (exit 134) reported in #4380.

Fix

• New dependency-free helper src/sse/handlers/requestBody.ts::resolveChatRequestBody(request, preParsedBody) — returns the already-parsed body when present, otherwise parses the request. (Standalone module so it's unit-testable without importing the DB-bound chat pipeline.)
• handleChat gains an optional 3rd param preParsedBody = null (additive — the 12 existing callers are unchanged and parse as before).
• The chat/completions route threads the body it already parsed for the injection guard into handleChat, so the handler no longer re-parses it.

Validation (TDD)

New tests/unit/chat-request-body-parse-once-4380.test.ts (3/3): pre-parsed body is returned without calling request.json() (parse-once), null/undefined fall back to parsing, and a present-but-empty body is used as-is. Verified RED by temporarily reverting the guard (the parse-once assertions fail), then GREEN after restore.

typecheck:core clean (validates the new signature + the 12 handleChat callers + the new import). chat-pipeline integration: 28/29 — the one failure (Codex CLI fingerprint to OAuth responses requests) reproduces identically on the base branch without this change, i.e. a pre-existing flake unrelated to this PR. Lint clean.

This is the parse-once slice of the broader #4041 OOM work (injection-guard scan bound + heap-guard already shipped; system_prompt_leak heuristic in the #4041 PR).

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.