Add Xquik OpenAPI example and harden JSON decoding

[kriptoburak]

Summary

• add a compact Xquik OpenAPI fixture for the existing importer examples
• document the matching PowerShell import command
• model supported bearer auth, required q, write-account fields, and Idempotency-Key headers
• align compact account, tweet search, and write-response schemas with the current public contract
• reject trailing JSON values and unknown-length bodies above 1 MiB
• add regression tests for the gateway decoder and imported Xquik tool contract

Independent Repository Fix

The gateway limited reads to 1 MiB without verifying whether more bytes remained. A valid JSON value followed by data beyond that boundary could therefore bypass the trailing-value check. The decoder now reads at most 1 MiB plus one byte and rejects oversized bodies from known-length and streaming requests.

Validation

• make check
• make example
• go test -race ./...
• go run golang.org/x/vuln/cmd/govulncheck@latest ./... - no vulnerabilities
• Xquik fixture import produces exactly 4 tools
• write tools require forwarded Idempotency-Key headers and account fields
• tweet search requires q and exposes current pagination fields
• git diff --check
• clean merge-tree verification

The repository's Windows CI workflow awaits maintainer approval for this external contribution.

Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fc5a421514

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kriptoburak]

Verified the 3 Codex review findings against the current PR head. testdata/fixtures/openapi.xquik.yaml now uses bearer auth that the importer supports, exposes the required tweet search parameter as q, and includes required account fields in both X write request schemas.

Validation: YAML parse, git diff --check, and go test ./....

[kriptoburak]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[kriptoburak]

Repair verification is complete at signed head 9b3703f.

I preserved the validated source tree exactly while adding verified SSH signatures to all 4 commits. All 3 earlier Codex findings remain fixed and their threads are resolved. The later review-quota bot message is informational and requests no code change. The full Go suite passes, Go formatting and the diff are clean, the Xquik OpenAPI fixture parses and imports into 4 tools, and trailing JSON values are covered by regression tests. No Xquik action remains. This is ready to merge.

[kriptoburak]

Published the current-contract repair at signed and GitHub-verified head f17789baeda4c9872308bba19d41587b52e87e0e.

The Xquik fixture now requires the forwarded Idempotency-Key header for both write tools, preserves the required q and account inputs, and models current account, search pagination, tweet author, and write-action response fields. The independent gateway fix now rejects unknown-length request bodies beyond 1 MiB instead of allowing bytes past the decoder limit to escape the trailing-value check.

Validation passed with make check, make example, the full race suite, a 4-tool fixture import contract check, clean merge-tree verification, and govulncheck with no vulnerabilities. All 5 commits are verified, all 3 earlier review threads remain resolved, and the PR is conflict-free.

GitHub Actions shows action_required with 0 jobs. A maintainer must approve the external-contributor workflow before the Windows and Ubuntu jobs can start; there is no code-side check failure.