Raise API response body cap from 1 MiB to 16 MiB

[Soph]

https://entire.io/gh/entireio/cli/trails/394

Summary

entire activity fails for any active user with:

Failed to load activity: fetch activity: decode commits: decode JSON response: unexpected end of JSON input

Root cause: /api/v1/me/commits?timeframe=last-month&limit=1000 returns ~1.5 MB of valid JSON for an active account, but api.DecodeJSON caps reads at maxResponseBytes = 1 << 20 (1 MiB) via io.LimitReader. The body is silently truncated mid-JSON, and json.Unmarshal then surfaces "unexpected end of JSON input" — which looks like a server bug but is self-inflicted.

Reproduction against production:

$ curl -sS -o /tmp/commits.json -w "bytes: %{size_download}\n" \
    -H "Authorization: Bearer $TOKEN" \
    "https://entire.io/api/v1/me/commits?timeframe=last-month&limit=1000"
bytes: 1463800

1.46 MB > 1 MiB cap → truncated → invalid JSON → error.

Fix

Raise the global cap from 1 MiB to 16 MiB (cmd/entire/cli/api/client.go:15). Still a defensive cap against unbounded reads, but gives the activity endpoint real headroom for active users.

Test

New regression test TestDecodeJSONResponse_LargeBodyOverOldCap (cmd/entire/cli/api/client_test.go):

• Builds a ~1.9 MiB JSON payload (4000 items × ~500 bytes)
• Serves it from an httptest.Server
• Asserts DecodeJSON decodes the full structure

Verified the test catches the regression: reverting maxResponseBytes to 1 << 20 makes the test fail with the exact user-facing error:

DecodeJSON(1884011-byte body) = decode JSON response: unexpected end of JSON input, want nil

Verification

• mise run check (fmt + lint + unit + integration + E2E canary) — all green

---

Note

Low Risk
Low risk: only increases a defensive read limit for API responses, with a regression test to catch truncation; main impact is higher potential memory use when decoding very large responses.

Overview
Fixes CLI failures when API endpoints return JSON bodies larger than 1 MiB by increasing the shared maxResponseBytes cap to 16 MiB for both DecodeJSON and CheckResponse reads.

Adds a regression test that serves and successfully decodes a ~2 MiB JSON payload to ensure large-but-valid responses no longer get truncated mid-JSON.

^{Reviewed by Cursor Bugbot for commit 0b9fa0a. Configure here.}

[Copilot]

Pull request overview

Raises the API response body size cap from 1 MiB to 16 MiB to fix entire activity failures caused by silent truncation of large JSON responses from /api/v1/me/commits.

Changes:

• Increase maxResponseBytes constant from 1 << 20 to 16 << 20.
• Add regression test TestDecodeJSONResponse_LargeBodyOverOldCap exercising a ~1.9 MiB JSON payload.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
cmd/entire/cli/api/client.go	Bumps response body read cap to 16 MiB.
cmd/entire/cli/api/client_test.go	Adds regression test verifying decoding of bodies above the old 1 MiB cap.