@foldrun/core 2.10.1 → 2.11.0

package/src/store.ts

@@ -48,6 +48,7 @@ export function readFrontmatter(file: string): Record<string, unknown> {
 }
 import { ownToolNames, legacyUseNames, retiredToolNames } from "./tool-names.ts";
 import { refNames } from "./refs.ts";
+import { checkFilter } from "./trigger-filter.ts";
 import { parseBudget, budgetProblem } from "./budget.ts";
 import { timezoneProblem } from "./clock.ts";
 import { parseStepLimits, readLimits } from "./limits.ts";
@@ -1410,6 +1411,13 @@ export interface FlowInfo {
   /** `trigger: storage` — a path prefix under storage/; a file landing
    *  there starts the flow with the path as its task. */
   path: string | null;
+  /** `filter:` — the fields a delivery must have before it becomes a run
+   *  (trigger-filter.ts): matched against a webhook's JSON body, an email,
+   *  a chained run or a storage event. Null: no `filter:` line, every
+   *  delivery. Kept exactly as written — a list, `false`, a word — so one
+   *  that cannot be read matches nothing (fails closed) rather than reading
+   *  as no filter at all. Test it with `!= null`, never for truthiness. */
+  filter: unknown;
 
   // ---- how often a trigger is allowed to become a run ----
   //
@@ -2055,6 +2063,7 @@ export function parseFlow(file: string, raw: string): FlowInfo {
   badEnum("catchup", data.catchup, ["none", "last"]);
   badEnum("on", data.on, ["completed", "failed", "blocked", "any"]);
   badEnum("signature", data.signature, ["github", "stripe", "slack", "hmac"]);
+  for (const p of checkFilter(data.filter)) frontProblems.push(p);
 
   steps.sort((a, b) => a.group - b.group);
   return {
@@ -2086,6 +2095,7 @@ export function parseFlow(file: string, raw: string): FlowInfo {
         ? data.signing_secret.trim().replace(/^\$\{|\}$/g, "")
         : null,
     path: typeof data.path === "string" ? data.path.trim().replace(/^\/+/, "") : null,
+    filter: data.filter === undefined || data.filter === null ? null : data.filter,
     // A header name is case-insensitive on the wire; a JSON field is not.
     // `body:eventId` lower-cased to `body:eventid` matched nothing, and a
     // dedupe that matches nothing admits everything.
@@ -2607,7 +2617,7 @@ export function isEditablePath(rel: string): boolean {
   }
 }
 
-function assertEditablePath(rel: string) {
+export function assertEditablePath(rel: string) {
   const norm = path.normalize(rel);
   if (norm.startsWith("..") || path.isAbsolute(norm)) throw new Error(`illegal path: ${rel}`);
   assertCanonicalCase(norm);

package/src/tool-test.ts

@@ -28,6 +28,7 @@ import { commandFor, resolveRunPath } from "./script-tools.ts";
 import { parseRuntime, prepareRuntime } from "./runtime.ts";
 import { hostSafeEnv } from "./host-env.ts";
 import { linkWorkspace, workspaceLinkEnv } from "./confine.ts";
+import { fetchUntrusted, ResponseTooLarge, MAX_BYTES } from "./untrusted-fetch.ts";
 
 export interface ToolTestResult {
   ok: boolean;
@@ -174,12 +175,23 @@ export async function testTool(
       const headers: Record<string, string> = {};
       for (const [k, v] of Object.entries(api.headers)) headers[k] = substitute(v, env);
 
-      const res = await fetch(url, {
-        method,
-        headers,
-        signal: AbortSignal.timeout(TIMEOUT_MS),
-      });
-      const body = await res.text();
+      // A URL the tenant chose, fetched from the web tier: through the
+      // platform's guard (no private or cluster address, each redirect hop
+      // checked), and the secrets in the headers go only to the origin
+      // they were written for.
+      const res = await fetchUntrusted(
+        url.href,
+        { method, headers, signal: AbortSignal.timeout(TIMEOUT_MS) },
+        { sameOrigin: true },
+      );
+      // The status is the test; a body past the limit is said, not shown.
+      let body: string;
+      try {
+        body = await res.text();
+      } catch (err) {
+        if (!(err instanceof ResponseTooLarge)) throw err;
+        body = `(the answer was larger than ${MAX_BYTES / (1024 * 1024)} MiB — not shown)`;
+      }
 
       // An unset secret means the tool cannot authenticate, so it is not
       // working — whatever a permissive endpoint chose to return. Reporting
@@ -366,7 +378,9 @@ export async function testTool(
     // A remote server: the honest check we can make without a full client is
     // that the endpoint answers.
     try {
-      const res = await fetch(spec.url, { signal: AbortSignal.timeout(TIMEOUT_MS) });
+      // Through the platform's guard, as the http probe is; only the status is read.
+      const res = await fetchUntrusted(spec.url, { signal: AbortSignal.timeout(TIMEOUT_MS) }, { sameOrigin: true });
+      await res.body?.cancel().catch(() => {});
       return done({
         ok: res.ok,
         transport: "mcp",

package/src/translator.ts

@@ -32,6 +32,7 @@ import http from "node:http";
 import crypto from "node:crypto";
 import { PROTECTED_PARAMS } from "./providers.ts";
 import { viaEgress } from "./egress.ts";
+import { fetchUntrusted } from "./untrusted-fetch.ts";
 import { trimSlashes } from "./paths.ts";
 import { captureRefusalHeaders, isRefusalStatus, refusalLine } from "./refusal.ts";
 
@@ -907,6 +908,11 @@ function upstreamMessage(text: string, status: number): string {
 
 // ---------------------------------------------------------------- server
 
+/** The most one upstream answer may be, read, on the host: a long streamed
+ *  reply is many small events, well past fetchUntrusted's 1 MiB default,
+ *  and still far under this. */
+export const UPSTREAM_MAX_BYTES = 64 * 1024 * 1024;
+
 /**
  * Start the translator for one step. Binds an ephemeral port on loopback,
  * mints the key the SDK will present, and returns the env that points the
@@ -963,7 +969,8 @@ export async function startTranslator(spec: TranslatorSpec): Promise<RunningTran
 
       let upstream: Response;
       try {
-        upstream = await fetch(viaEgress(spec.egress, `${base}${responses ? "/responses" : "/chat/completions"}`), {
+        const target = `${base}${responses ? "/responses" : "/chat/completions"}`;
+        const request: RequestInit = {
           method: "POST",
           headers: {
             "content-type": "application/json",
@@ -971,7 +978,16 @@ export async function startTranslator(spec: TranslatorSpec): Promise<RunningTran
             ...(spec.headers ?? {}),
           },
           body: JSON.stringify(outbound),
-        });
+        };
+        // In a step the lease's proxy is the way out: it guards the address
+        // and fills the key itself. Without one this runs on the host — an
+        // eval's judge, a dashboard draft — at a base URL the tenant wrote,
+        // so through the platform's guard: no private or cluster address,
+        // the key never follows a redirect off the provider's origin, and
+        // the answer read to UPSTREAM_MAX_BYTES.
+        upstream = spec.egress
+          ? await fetch(viaEgress(spec.egress, target), request)
+          : await fetchUntrusted(target, request, { sameOrigin: true, maxBytes: UPSTREAM_MAX_BYTES });
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         log.push(`POST ${label} → unreachable: ${message}`);
@@ -1050,7 +1066,12 @@ export async function startTranslator(spec: TranslatorSpec): Promise<RunningTran
       const message = err instanceof Error ? err.message : String(err);
       log.push(`translator error: ${message}`);
       if (!res.headersSent) send(500, errorBody(500, `translator: ${message}`));
-      else res.end();
+      else {
+        // Mid-stream: say so as an Anthropic error event, so the SDK reads a
+        // failed reply, not a short one that merely stopped.
+        res.write(`event: error\ndata: ${errorBody(500, `translator: ${message}`)}\n\n`);
+        res.end();
+      }
     }
   });
 

package/src/trigger-filter.ts

@@ -0,0 +1,264 @@
+// `filter:` — which deliveries of an event trigger become runs.
+//
+// A webhook flow used to start for every POST that carried the right token:
+// a GitHub hook for "pull requests" started a run for drafts, bot pushes and
+// label changes alike, and the first step's only job was to say "not this
+// one" — a sandbox, a model call and a run on the record, per non-event.
+// A filter says it in the flow's own file, and nothing starts:
+//
+//   filter:
+//     action: [opened, reopened]          # any of these values
+//     pull_request:
+//       draft: false                      # exactly this value
+//       base:
+//         ref: { starts_with: release/ }  # text, never a regular expression
+//     sender:
+//       type: { not_in: [Bot] }           # none of these
+//
+// What the pattern is matched against depends on the trigger: a webhook's
+// JSON body; an email's { from, to, subject, text }; a chained flow's
+// { run, flow, status, verdict, summary }; a storage event's { by, paths }.
+//
+// The rules, all of them:
+//
+//   · every key must match (AND); a nested object matches the nested field;
+//   · a list is the values allowed (any of them); a scalar is the one value;
+//   · an operator object — only the keys in, not_in, exists, starts_with,
+//     ends_with, contains — says it explicitly; the last three compare text
+//     (case-sensitive) and never run a regular expression, so a body a
+//     sender crafts cannot make one backtrack for minutes;
+//   · strings compare exactly and case-sensitively, numbers numerically
+//     (1 equals 1.0), booleans and null as themselves;
+//   · a field that is missing fails `in`, a value and the text operators, and passes
+//     `not_in`; `exists: false` passes only when it is missing;
+//   · a list in the payload: a nested pattern matches when any element
+//     does; `in` matches when any element is allowed, `not_in` when none is;
+//   · it fails closed — a body that is not JSON, or a pattern that cannot be
+//     evaluated, never matches.
+//
+// Pure and browser-safe: the gate, the check, the editor and the dashboard's
+// Test box all call these two functions.
+
+export const FILTER_LIMITS = { depth: 10, leaves: 64, values: 32, textChars: 500 } as const;
+
+const TEXT_OPERATORS = ["starts_with", "ends_with", "contains"] as const;
+const TEXT_VERB = { starts_with: "start with", ends_with: "end with", contains: "contain" } as const;
+const OPERATORS = new Set<string>(["in", "not_in", "exists", ...TEXT_OPERATORS]);
+
+type Scalar = string | number | boolean | null;
+
+const isScalar = (v: unknown): v is Scalar =>
+  v === null || typeof v === "string" || typeof v === "number" || typeof v === "boolean";
+
+const isPlainObject = (v: unknown): v is Record<string, unknown> =>
+  !!v && typeof v === "object" && !Array.isArray(v) && !(v instanceof Date);
+
+/** An object whose every key is an operator — `{ not_in: [Bot] }`. A pattern
+ *  object mixing operators with field names is refused by the check, since
+ *  it cannot be read one way. */
+function isOperatorObject(v: unknown): v is Record<string, unknown> {
+  if (!isPlainObject(v)) return false;
+  const keys = Object.keys(v);
+  return keys.length > 0 && keys.every((k) => OPERATORS.has(k));
+}
+
+/** YAML reads `2026-10-01` as a Date; a filter means the text. */
+const asScalar = (v: unknown): Scalar | undefined =>
+  v instanceof Date ? v.toISOString().slice(0, 10) : isScalar(v) ? v : undefined;
+
+/** Strings exactly, numbers numerically, the rest by identity. */
+function sameValue(a: Scalar, b: unknown): boolean {
+  if (typeof a === "number" && typeof b === "number") return a === b;
+  return a === b;
+}
+
+const show = (v: unknown) => (typeof v === "string" ? JSON.stringify(v) : JSON.stringify(v ?? null));
+
+/**
+ * What is wrong with a `filter:` as written, one sentence each — empty when
+ * it can be read. `foldrun check`, the deploy and the editor report these as
+ * `config/invalid-value`.
+ */
+export function checkFilter(filter: unknown): string[] {
+  const problems: string[] = [];
+  if (filter === undefined || filter === null) return problems;
+  if (!isPlainObject(filter) || Object.keys(filter).length === 0) {
+    return ["filter: is a map of field names to the values they must have — e.g. `action: [opened]`"];
+  }
+  let leaves = 0;
+  const walk = (node: Record<string, unknown>, where: string, depth: number) => {
+    if (depth > FILTER_LIMITS.depth) {
+      problems.push(`filter: nests deeper than ${FILTER_LIMITS.depth} levels at ${where}`);
+      return;
+    }
+    for (const [key, value] of Object.entries(node)) {
+      const at = where ? `${where}.${key}` : key;
+      if (OPERATORS.has(key)) {
+        problems.push(`filter: ${at} — ${key} is an operator; write it under a field name, e.g. \`sender: { ${key}: … }\``);
+        continue;
+      }
+      if (isPlainObject(value) && Object.keys(value).some((k) => OPERATORS.has(k))) {
+        if (!isOperatorObject(value)) {
+          problems.push(`filter: ${at} mixes operators (${[...OPERATORS].join(", ")}) with field names — split them`);
+          continue;
+        }
+        leaves++;
+        problems.push(...checkOperators(value, at));
+        continue;
+      }
+      if (isPlainObject(value)) {
+        if (Object.keys(value).length === 0) problems.push(`filter: ${at} is an empty map, which says nothing`);
+        else walk(value, at, depth + 1);
+        continue;
+      }
+      leaves++;
+      if (Array.isArray(value)) problems.push(...checkValues(value, at, "the list"));
+      else if (asScalar(value) === undefined) problems.push(`filter: ${at} — a value, a list of values, a map, or { in, not_in, exists, starts_with, ends_with, contains }`);
+    }
+  };
+  walk(filter, "", 1);
+  if (leaves > FILTER_LIMITS.leaves) problems.push(`filter: has ${leaves} conditions — at most ${FILTER_LIMITS.leaves}`);
+  return problems;
+}
+
+function checkValues(list: unknown[], at: string, what: string): string[] {
+  const out: string[] = [];
+  if (list.length === 0) out.push(`filter: ${at} — ${what} is empty, so nothing could ever match`);
+  if (list.length > FILTER_LIMITS.values) out.push(`filter: ${at} — ${what} has ${list.length} values, at most ${FILTER_LIMITS.values}`);
+  if (list.some((v) => asScalar(v) === undefined)) out.push(`filter: ${at} — ${what} holds only plain values (text, numbers, true/false, null)`);
+  return out;
+}
+
+function checkOperators(op: Record<string, unknown>, at: string): string[] {
+  const out: string[] = [];
+  const list = (k: "in" | "not_in") => {
+    const v = op[k];
+    if (v === undefined) return null;
+    const arr = Array.isArray(v) ? v : [v];
+    out.push(...checkValues(arr, at, k));
+    return arr.map(asScalar).filter((x): x is Scalar => x !== undefined);
+  };
+  const inList = list("in");
+  const notIn = list("not_in");
+  if (inList && notIn) {
+    const both = inList.filter((v) => notIn.some((w) => sameValue(v, w)));
+    if (both.length) out.push(`filter: ${at} lists ${both.map(show).join(", ")} in both in and not_in`);
+  }
+  if (op.exists !== undefined && typeof op.exists !== "boolean") out.push(`filter: ${at} — exists: is true or false`);
+  const texts = TEXT_OPERATORS.filter((k) => op[k] !== undefined);
+  if (op.exists === false && (inList?.length || texts.length)) {
+    out.push(`filter: ${at} — exists: false cannot also require a value`);
+  }
+  for (const k of texts) {
+    const v = op[k];
+    if (typeof v !== "string" || !v) out.push(`filter: ${at} — ${k}: is text, e.g. \`${k}: "refs/heads/"\``);
+    else if (v.length > FILTER_LIMITS.textChars) out.push(`filter: ${at} — ${k}: is longer than ${FILTER_LIMITS.textChars} characters`);
+  }
+  return out;
+}
+
+export interface FilterVerdict {
+  match: boolean;
+  /** Why, in one sentence: the first condition that failed, or "matched". */
+  reason: string;
+}
+
+const MISSING = Symbol("missing");
+
+/** One field's value against one leaf of the pattern. */
+function leafMatches(value: unknown, cond: unknown, at: string): FilterVerdict {
+  // An operator object.
+  if (isOperatorObject(cond)) {
+    if (cond.exists !== undefined) {
+      const present = value !== MISSING;
+      if (cond.exists === true && !present) return { match: false, reason: `${at} is missing (exists: true)` };
+      if (cond.exists === false && present) return { match: false, reason: `${at} is present (exists: false)` };
+    }
+    const values = Array.isArray(value) ? value : value === MISSING ? [] : [value];
+    if (cond.in !== undefined) {
+      const allowed = (Array.isArray(cond.in) ? cond.in : [cond.in]).map(asScalar).filter((x): x is Scalar => x !== undefined);
+      if (value === MISSING) return { match: false, reason: `${at} is missing` };
+      if (!values.some((v) => allowed.some((a) => sameValue(a, v)))) return { match: false, reason: `${at} is ${show(value)}, not one of ${allowed.map(show).join(", ")}` };
+    }
+    if (cond.not_in !== undefined) {
+      const refused = (Array.isArray(cond.not_in) ? cond.not_in : [cond.not_in]).map(asScalar).filter((x): x is Scalar => x !== undefined);
+      const hit = values.find((v) => refused.some((a) => sameValue(a, v)));
+      if (hit !== undefined) return { match: false, reason: `${at} is ${show(hit)}, which not_in refuses` };
+    }
+    for (const k of TEXT_OPERATORS) {
+      const want = cond[k];
+      if (want === undefined) continue;
+      if (value === MISSING) return { match: false, reason: `${at} is missing` };
+      const w = String(want);
+      const texts = values.filter((v) => typeof v === "string" || typeof v === "number").map(String);
+      const hit = texts.some((t) => (k === "starts_with" ? t.startsWith(w) : k === "ends_with" ? t.endsWith(w) : t.includes(w)));
+      if (!hit) return { match: false, reason: `${at} is ${show(value)}, which does not ${TEXT_VERB[k]} ${show(w)}` };
+    }
+    return { match: true, reason: "matched" };
+  }
+
+  // A list of allowed values, or one value.
+  const allowed = (Array.isArray(cond) ? cond : [cond]).map(asScalar);
+  if (allowed.some((a) => a === undefined)) return { match: false, reason: `${at}: the filter's value cannot be compared` };
+  if (value === MISSING) return { match: false, reason: `${at} is missing` };
+  const values = Array.isArray(value) ? value : [value];
+  if (values.some((v) => allowed.some((a) => sameValue(a as Scalar, v)))) return { match: true, reason: "matched" };
+  return {
+    match: false,
+    reason: allowed.length === 1 ? `${at} is ${show(value)}, not ${show(allowed[0])}` : `${at} is ${show(value)}, not one of ${allowed.map(show).join(", ")}`,
+  };
+}
+
+function nodeMatches(payload: unknown, pattern: Record<string, unknown>, where: string, depth: number): FilterVerdict {
+  if (depth > FILTER_LIMITS.depth) return { match: false, reason: `the filter nests deeper than ${FILTER_LIMITS.depth} levels` };
+  for (const [key, cond] of Object.entries(pattern)) {
+    const at = where ? `${where}.${key}` : key;
+    const value = isPlainObject(payload) && Object.prototype.hasOwnProperty.call(payload, key) ? payload[key] : MISSING;
+    if (isPlainObject(cond) && !isOperatorObject(cond)) {
+      // A nested pattern: the field must be an object that matches it, or a
+      // list holding one that does.
+      if (value === MISSING) return { match: false, reason: `${at} is missing` };
+      // A nested pattern needs an object (or a list of them) to look inside:
+      // a scalar or null there is not "every field missing", which would let
+      // not_in and exists: false pass on a malformed delivery.
+      if (!Array.isArray(value) && !isPlainObject(value)) return { match: false, reason: `${at} is ${show(value)}, not an object` };
+      if (Array.isArray(value)) {
+        const objects = value.filter(isPlainObject);
+        if (objects.some((o) => nodeMatches(o, cond, at, depth + 1).match)) continue;
+        return { match: false, reason: `no item of ${at} matches` };
+      }
+      const inner = nodeMatches(value, cond, at, depth + 1);
+      if (!inner.match) return inner;
+      continue;
+    }
+    const leaf = leafMatches(value, cond, at);
+    if (!leaf.match) return leaf;
+  }
+  return { match: true, reason: "matched" };
+}
+
+/**
+ * Does this payload pass this filter? No filter passes everything. A filter
+ * the check would refuse never matches — it fails closed, so a typo holds
+ * deliveries back instead of letting all of them through.
+ */
+export function matchFilter(filter: unknown, payload: unknown): FilterVerdict {
+  if (filter === undefined || filter === null) return { match: true, reason: "no filter" };
+  const problems = checkFilter(filter);
+  if (problems.length) return { match: false, reason: `the filter cannot be read: ${problems[0].replace(/^filter: /, "")}` };
+  if (!isPlainObject(payload)) return { match: false, reason: "the delivery is not a JSON object, so no field can match" };
+  return nodeMatches(payload, filter as Record<string, unknown>, "", 1);
+}
+
+/** A webhook body as the filter reads it: its JSON, or null when it is not
+ *  JSON (which no filter matches). */
+export function webhookFilterPayload(raw: string): unknown {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
+/** The triggers a filter means something for. */
+export const FILTERABLE_TRIGGERS = ["webhook", "email", "flow", "storage"] as const;

package/src/trigger-log.ts

@@ -42,6 +42,7 @@ export type TriggerOutcome =
   | "halted"
   | "overlap-skipped"
   | "missed"
+  | "filtered"
   | "failed";
 
 export interface TriggerEvent {

package/src/triggers.ts

@@ -59,6 +59,18 @@ export function chainedFlows(tenant: string, workspace: string, finished: RunRec
   );
 }
 
+/** What a chained flow's `filter:` reads: the run that just settled. */
+export function chainFields(finished: RunRecord): Record<string, unknown> {
+  return {
+    run: finished.id,
+    flow: finished.flow,
+    status: finished.status,
+    ending: endingOf(finished),
+    verdict: runVerdict(finished) ?? null,
+    summary: finished.summary ?? null,
+  };
+}
+
 /**
  * Start every flow chained on a run that just settled. The finished run's
  * one-line summary and its final result are the task; the run id rides
@@ -78,7 +90,7 @@ export async function fireChainedFlows(tenant: string, workspace: string, finish
     (result ? `\n${result}` : "");
   for (const flow of flows) {
     try {
-      const gate = await platform.admitTrigger(tenant, workspace, flow, { body, tag: "previous_run" });
+      const gate = await platform.admitTrigger(tenant, workspace, flow, { body, tag: "previous_run", fields: chainFields(finished) });
       if (!gate.admit) {
         console.log(`[foldrun] trigger: flow — ${tenant}/${workspace}/${flow.name} not started: ${gate.detail}`);
         continue;
@@ -143,7 +155,7 @@ export async function fireStorageTriggers(
       const body = `by: ${by}\n${hits.map((h) => `- storage/${h}`).join("\n")}`;
       // A deploy that writes forty files under one prefix is one event, not
       // forty runs — which is exactly what `debounce:` is for.
-      const gate = await platform.admitTrigger(tenant, workspace, flow, { body, tag: "storage_event" });
+      const gate = await platform.admitTrigger(tenant, workspace, flow, { body, tag: "storage_event", fields: { by, paths: hits } });
       if (!gate.admit) {
         console.log(`[foldrun] trigger: storage — ${tenant}/${workspace}/${flow.name} not started: ${gate.detail}`);
         continue;

package/src/untrusted-fetch.ts

@@ -14,6 +14,12 @@
 // the first one was. A hop to another origin keeps only the headers that
 // cannot carry a credential, and a caller whose request IS a credential
 // (a token exchange, a provider key in a header) follows none at all.
+//
+// And every answer is read to a limit (maxBytes, 1 MiB unless the caller
+// says otherwise): a tenant's URL can answer forever, and the worker or web
+// tier holding it all in memory is the platform's problem, not the tenant's.
+// Past the limit the body errors — a caller never gets the first megabyte
+// passed off as the whole answer.
 
 import { platform } from "./platform.ts";
 
@@ -28,6 +34,60 @@ const REDIRECT = new Set([301, 302, 303, 307, 308]);
  *  webhook's signature — stays with the origin it was meant for. */
 const CROSS_ORIGIN_SAFE = new Set(["accept", "accept-language", "content-type", "user-agent"]);
 
+/** What one answer may be, read, unless the caller says otherwise. */
+export const MAX_BYTES = 1024 * 1024;
+
+export class ResponseTooLarge extends Error {
+  constructor(url: string, maxBytes: number) {
+    super(`${url} answered more than ${sizeLabel(maxBytes)} — not read`);
+    this.name = "ResponseTooLarge";
+  }
+}
+
+const sizeLabel = (n: number) => (n % (1024 * 1024) === 0 ? `${n / (1024 * 1024)} MiB` : `${n} bytes`);
+
+/** Statuses whose Response may carry no body (the constructor throws on one). */
+const NULL_BODY = new Set([101, 204, 205, 304]);
+
+/**
+ * `res`, its body read to at most `maxBytes`. The status and headers stand;
+ * the body errors with ResponseTooLarge at the limit — `text()`, `json()`
+ * and a reader all reject, never resolve short. A declared length past the
+ * limit errors at the first read, before a byte is fetched; an undeclared
+ * one is counted as it streams (after decompression, so a small gzip that
+ * unpacks huge is caught too). Infinity: no limit.
+ */
+export function capBody(res: Response, maxBytes: number, url: string): Response {
+  if (!Number.isFinite(maxBytes) || !res.body || NULL_BODY.has(res.status)) return res;
+  const declared = Number(res.headers.get("content-length") ?? NaN);
+  const tooLong = Number.isFinite(declared) && declared > maxBytes;
+  const reader = res.body.getReader();
+  let seen = 0;
+  const body = new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      if (tooLong) {
+        reader.cancel().catch(() => {});
+        return controller.error(new ResponseTooLarge(url, maxBytes));
+      }
+      const { done, value } = await reader.read();
+      if (done) return controller.close();
+      seen += value.byteLength;
+      if (seen > maxBytes) {
+        reader.cancel().catch(() => {});
+        return controller.error(new ResponseTooLarge(url, maxBytes));
+      }
+      controller.enqueue(value);
+    },
+    cancel(reason) {
+      return reader.cancel(reason);
+    },
+  });
+  const out = new Response(body, { status: res.status, statusText: res.statusText, headers: res.headers });
+  // Where the answer came from, as the original said.
+  Object.defineProperty(out, "url", { value: res.url });
+  return out;
+}
+
 export class RedirectRefused extends Error {
   constructor(message: string) {
     super(message);
@@ -42,14 +102,17 @@ export async function fetchUntrusted(
     /** The request carries a credential (in its body or its headers):
      *  follow a redirect only within the origin it was sent to. */
     sameOrigin?: boolean;
+    /** The most the answer may be, read; MAX_BYTES unless said. */
+    maxBytes?: number;
   } = {},
 ): Promise<Response> {
+  const maxBytes = opts.maxBytes ?? MAX_BYTES;
   let current = url;
   let req: RequestInit = { ...init };
   for (let hop = 0; ; hop++) {
-    const res = await platform.fetchUntrusted(current, { ...req, redirect: "manual" });
+    const res = await platform.fetchUntrusted(current, { ...req, redirect: "manual" }, { maxBytes });
     const location = REDIRECT.has(res.status) ? res.headers.get("location") : null;
-    if (!location) return res;
+    if (!location) return capBody(res, maxBytes, current);
     // The body of a redirect is never read; free the socket.
     await res.body?.cancel().catch(() => {});
     if (hop >= MAX_REDIRECTS) throw new RedirectRefused(`${url}: more than ${MAX_REDIRECTS} redirects — not followed`);