修复全量审查问题;设置接口PATCH化;回传指纹加固

internal/oci/genai_responses.go

@@ -60,9 +60,9 @@ func (c *RealClient) GenAiCompatResponses(ctx context.Context, cred Credentials,
 		return nil, err
 	}
 	defer response.Body.Close()
-	payload, err := io.ReadAll(io.LimitReader(response.Body, compatResponsesLimit))
+	payload, err := readCompatBody(response.Body, compatResponsesLimit, "compat responses")
 	if err != nil {
-		return nil, fmt.Errorf("read compat responses body: %w", err)
+		return nil, err
 	}
 	return payload, nil
 }
@@ -121,3 +121,16 @@ func (c *RealClient) GenAiCompatResponsesStream(ctx context.Context, cred Creden
 	}
 	return callWithHeaderBudget(ctx, client, request, wait)
 }
+
+// readCompatBody 读取上游响应体并施加上限;读 limit+1 判超报错——
+// 静默截断的 JSON/音频配 200 会被下游当完整成功记账。
+func readCompatBody(body io.Reader, limit int64, tag string) ([]byte, error) {
+	payload, err := io.ReadAll(io.LimitReader(body, limit+1))
+	if err != nil {
+		return nil, fmt.Errorf("read %s body: %w", tag, err)
+	}
+	if int64(len(payload)) > limit {
+		return nil, fmt.Errorf("%s body exceeds %d bytes", tag, limit)
+	}
+	return payload, nil
+}