From dfd783081dbc6a18d344bb97297404b353f42e02 Mon Sep 17 00:00:00 2001
From: neutrino2211 <neutrino2211@gmail.com>
Date: Thu, 9 Apr 2026 20:26:24 +0100
Subject: [PATCH] fix(runner): read response body before creating new Response

Streams can only be read once - use arrayBuffer() to clone body.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 packages/at-run/runner/src/index.ts | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/packages/at-run/runner/src/index.ts b/packages/at-run/runner/src/index.ts
index 0446e68..dac5d7b 100644
--- a/packages/at-run/runner/src/index.ts
+++ b/packages/at-run/runner/src/index.ts
@@ -394,6 +394,8 @@ async function executeEndpoint(ctx: ExecuteContext): Promise<Response> {
 
     if (result instanceof Response) {
       // Ensure CORS headers are present on sandbox responses
+      // Must clone body since streams can only be read once
+      const body = await result.arrayBuffer()
       const headers = new Headers(result.headers)
       if (!headers.has("Access-Control-Allow-Origin")) {
         headers.set("Access-Control-Allow-Origin", "*")
@@ -404,7 +406,7 @@ async function executeEndpoint(ctx: ExecuteContext): Promise<Response> {
       if (!headers.has("Access-Control-Allow-Headers")) {
         headers.set("Access-Control-Allow-Headers", "Content-Type")
       }
-      return new Response(result.body, {
+      return new Response(body, {
         status: result.status,
         statusText: result.statusText,
         headers,
@@ -442,6 +444,8 @@ async function executeEndpoint(ctx: ExecuteContext): Promise<Response> {
     const result = await endpoint.handler(validatedArgs)
     if (result instanceof Response) {
       // Ensure CORS headers are present
+      // Must clone body since streams can only be read once
+      const body = await result.arrayBuffer()
       const headers = new Headers(result.headers)
       if (!headers.has("Access-Control-Allow-Origin")) {
         headers.set("Access-Control-Allow-Origin", "*")
@@ -452,7 +456,7 @@ async function executeEndpoint(ctx: ExecuteContext): Promise<Response> {
       if (!headers.has("Access-Control-Allow-Headers")) {
         headers.set("Access-Control-Allow-Headers", "Content-Type")
       }
-      return new Response(result.body, {
+      return new Response(body, {
         status: result.status,
         statusText: result.statusText,
         headers,
-- 
2.51.2