fix(rsc-mf): guard no-body statuses in proxy responses

Author: cursoragent

tests/integration/rsc-mf/shared/proxyResponse.ts

@@ -11,6 +11,7 @@ const PROXY_UNSAFE_RESPONSE_HEADERS = [
   'transfer-encoding',
   'upgrade',
 ];
+const STATUS_CODES_WITHOUT_BODY = new Set([204, 205, 304]);
 
 export const createSafeProxyResponse = (upstream: Response) => {
   const headers = new Headers(upstream.headers);
@@ -31,7 +32,10 @@ export const createSafeProxyResponse = (upstream: Response) => {
   for (const token of connectionHeaderTokens) {
     headers.delete(token);
   }
-  return new Response(upstream.body, {
+  const responseBody = STATUS_CODES_WITHOUT_BODY.has(upstream.status)
+    ? null
+    : upstream.body;
+  return new Response(responseBody, {
     status: upstream.status,
     statusText: upstream.statusText,
     headers,

tests/integration/rsc-mf/tests/proxyResponse.test.ts

@@ -81,4 +81,28 @@ describe('rsc-mf proxy response helper', () => {
     expect(proxied.headers.get('keep-alive')).toBeNull();
     expect(proxied.headers.get('x-safe-header')).toBe('preserve-me');
   });
+
+  it('forces empty body for no-content status responses', async () => {
+    const upstream = {
+      status: 204,
+      statusText: 'No Content',
+      headers: new Headers({
+        'content-type': 'application/javascript',
+      }),
+      body: new ReadableStream({
+        start(controller) {
+          controller.enqueue(
+            new TextEncoder().encode('should-not-be-forwarded'),
+          );
+          controller.close();
+        },
+      }),
+    } as unknown as Response;
+
+    const proxied = createSafeProxyResponse(upstream);
+
+    expect(proxied.status).toBe(204);
+    expect(proxied.statusText).toBe('No Content');
+    await expect(proxied.text()).resolves.toBe('');
+  });
 });