npm - @remodex/rmx - Versions diffs - 1.0.4 → 1.0.6 - Mend

@remodex/rmx 1.0.4 → 1.0.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (13) hide show

package/gui/dist/assets/{index-D3MaPif3.js → index-BOZwc-1w.js} +13 -13
package/gui/dist/assets/{index-1SDbgh2-.css → index-s2Il3gAr.css} +1 -1
package/gui/dist/index.html +2 -2
package/package.json +1 -1
package/src/android-remote/codex-app-server.ts +43 -7
package/src/android-remote/gateway.ts +73 -4
package/src/cli/index.ts +0 -2
package/src/cli/onboard.ts +47 -4
package/src/server/management/config-routes.ts +9 -1
package/src/service.ts +0 -6
package/src/update/auto-scheduler.ts +21 -1
package/src/update/notify.ts +2 -5
package/src/update/release-notes.ts +111 -0

package/gui/dist/index.html CHANGED Viewed

@@ -16,8 +16,8 @@
         } catch (e) {}
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-D3MaPif3.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-1SDbgh2-.css">
+    <script type="module" crossorigin src="/assets/index-BOZwc-1w.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-s2Il3gAr.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@remodex/rmx",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "description": "Remodex universal provider proxy for OpenAI Codex & Claude Code — use any LLM with Codex CLI/App/SDK and Claude Code",
   "displayName": "Remodex",
   "type": "module",

package/src/android-remote/codex-app-server.ts CHANGED Viewed

@@ -6,6 +6,8 @@ import { resolveCodexRuntime } from "../codex/runtime";
 const DEFAULT_CODEX_APP_SERVER_PORT = 10106;
 const START_TIMEOUT_MS = 12_000;
 const REQUEST_TIMEOUT_MS = 30_000;
+const OWNED_PROCESS_TERM_GRACE_MS = 1_000;
+const OWNED_PROCESS_KILL_GRACE_MS = 1_000;
 const APP_SERVER_PROFILE_KEYS = new Set([
   "model_provider",
@@ -353,6 +355,45 @@ async function waitUntilReady(port: number, child: Bun.Subprocess): Promise<void
   throw new Error("Codex task server did not become ready");
 }
+type KillableSubprocess = Pick<Bun.Subprocess, "kill" | "exited">;
+function waitForSubprocessExit(child: KillableSubprocess, timeoutMs: number): Promise<boolean> {
+  return new Promise(resolve => {
+    let settled = false;
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const finish = (exited: boolean): void => {
+      if (settled) return;
+      settled = true;
+      if (timer !== undefined) clearTimeout(timer);
+      resolve(exited);
+    };
+    timer = setTimeout(() => finish(false), Math.max(0, timeoutMs));
+    // A failed exit promise still means the child is no longer running. The
+    // rejection is consumed here so shutdown never creates an unhandled error.
+    void child.exited.then(() => finish(true), () => finish(true));
+  });
+}
+/**
+ * Stop a process that the current Remodex runtime explicitly spawned.
+ *
+ * Codex normally honors SIGTERM, but an app-server can be wedged while its
+ * listener is being torn down. Keep the wait bounded and escalate only for
+ * this caller-owned handle; callers must never pass a process they did not
+ * create and positively mark as owned.
+ */
+export async function terminateOwnedCodexProcess(
+  child: KillableSubprocess,
+  termGraceMs = OWNED_PROCESS_TERM_GRACE_MS,
+  killGraceMs = OWNED_PROCESS_KILL_GRACE_MS,
+): Promise<void> {
+  try { child.kill("SIGTERM"); } catch { /* already exited */ }
+  if (await waitForSubprocessExit(child, termGraceMs)) return;
+  try { child.kill("SIGKILL"); } catch { /* already exited */ }
+  await waitForSubprocessExit(child, killGraceMs);
+}
 export type AndroidCodexRuntimeStatus = {
   connected: boolean;
   port: number;
@@ -553,13 +594,8 @@ export class AndroidCodexRuntime {
   private async stopOwnedProcess(): Promise<void> {
     const child = this.child;
     this.child = null;
-    if (child && this.ownedProcess) {
-      try { child.kill(); } catch { /* already exited */ }
-      await Promise.race([
-        child.exited.catch(() => -1),
-        new Promise(resolve => setTimeout(resolve, 1_000)),
-      ]);
-    }
+    const owned = child !== null && this.ownedProcess;
     this.ownedProcess = false;
+    if (owned) await terminateOwnedCodexProcess(child);
   }
 }

package/src/android-remote/gateway.ts CHANGED Viewed

@@ -5,6 +5,7 @@ import { homedir, networkInterfaces, hostname as readHostname } from "node:os";
 import { basename, dirname, isAbsolute, join, parse, resolve } from "node:path";
 import type { Server, ServerWebSocket } from "bun";
 import { getConfigDir } from "../config";
+import { redactSecretString } from "../lib/redact";
 import { commandInvocation } from "../lib/win-exec";
 import type { ManagementModelRow } from "../server/management/model-rows";
 import { modelSourceDisplayName } from "../model-sources";
@@ -351,6 +352,58 @@ function stringValue(value: unknown, maximum = 4096): string {
   return typeof value === "string" ? value.trim().slice(0, maximum) : "";
 }
+/**
+ * Keep the lifecycle error actionable without echoing credentials or an
+ * unbounded exception string through the management API.  Startup failures
+ * are otherwise indistinguishable from a transient tunnel failure, which
+ * makes `rmx onboard --verbose` misleading.
+ */
+function startupErrorText(error: unknown): string {
+  const parts: string[] = [];
+  const seen = new Set<object>();
+  let current: unknown = error;
+  for (let depth = 0; depth < 4 && current !== undefined && current !== null; depth += 1) {
+    if ((typeof current === "object" || typeof current === "function") && current !== null) {
+      if (seen.has(current)) break;
+      seen.add(current);
+    }
+    if (current instanceof Error) {
+      if (current.message.trim()) parts.push(current.message.trim());
+      current = current.cause;
+      continue;
+    }
+    const object = record(current);
+    if (object) {
+      if (typeof object.message === "string" && object.message.trim()) {
+        parts.push(object.message.trim());
+      }
+      current = object.cause;
+      continue;
+    }
+    const text = String(current).trim();
+    if (text) parts.push(text);
+    break;
+  }
+  return parts.filter((part, index) => index === 0 || part !== parts[index - 1]).join(": ");
+}
+function gatewayStartupError(error: unknown): string {
+  const raw = startupErrorText(error);
+  const safe = redactSecretString(raw)
+    .replace(/[\u0000-\u001f\u007f]/gu, " ")
+    .replace(/\s+/gu, " ")
+    .trim()
+    .slice(0, 240);
+  const prefix = "Could not start the Android Remote gateway";
+  // Runtime adapters may already use the public prefix. Strip any repeated
+  // wrapper before adding one canonical, actionable message.
+  let detail = safe;
+  while (new RegExp(`^${prefix}(?::|\\s|$)`, "iu").test(detail)) {
+    detail = detail.slice(prefix.length).replace(/^:\s*/u, "").trim();
+  }
+  return detail ? `${prefix}: ${detail}` : prefix;
+}
 function desktopConversationIsActive(value: unknown): boolean | null {
   const state = record(value);
   if (!state) return null;
@@ -1978,6 +2031,8 @@ export class AndroidRemoteGatewayController {
   private server: Server<GatewayWsData> | null = null;
   private codex: AndroidCodexClient | null = null;
   private unsubscribeCodex: (() => void) | null = null;
+  /** All callers must await one physical gateway startup. */
+  private startFlight: Promise<void> | null = null;
   private transition: Promise<void> = Promise.resolve();
   private readonly sockets = new Set<ServerWebSocket<GatewayWsData>>();
   private readonly socketsByClient = new Map<string, Set<ServerWebSocket<GatewayWsData>>>();
@@ -2371,7 +2426,19 @@ export class AndroidRemoteGatewayController {
   }
   async start(): Promise<void> {
-    if (this.gatewayStatus === "ready" || this.gatewayStatus === "starting") return;
+    if (this.gatewayStatus === "ready") return;
+    if (this.startFlight) return this.startFlight;
+    const flight = this.startInternal();
+    this.startFlight = flight;
+    try {
+      await flight;
+    } finally {
+      if (this.startFlight === flight) this.startFlight = null;
+    }
+  }
+  private async startInternal(): Promise<void> {
     this.gatewayStatus = "starting";
     this.statusError = undefined;
     try {
@@ -2396,15 +2463,17 @@ export class AndroidRemoteGatewayController {
       for (const remoteThreadId of this.queuedTurns.keys()) {
         void this.startNextQueuedTurn(remoteThreadId).catch(() => undefined);
       }
-    } catch {
+    } catch (error) {
       this.gatewayStatus = "error";
-      this.statusError = "Could not start the Android Remote gateway";
+      this.statusError = gatewayStartupError(error);
       await this.stopResources();
-      throw new Error(this.statusError);
+      throw new Error(this.statusError, { cause: error });
     }
   }
   async stop(): Promise<void> {
+    const starting = this.startFlight;
+    if (starting) await starting.catch(() => undefined);
     await this.stopResources();
     this.gatewayStatus = "stopped";
     this.statusError = undefined;

package/src/cli/index.ts CHANGED Viewed

@@ -53,7 +53,6 @@ import { installShellHook, uninstallShellHook } from "../server/system-env";
 import { startTokenGuardian } from "../oauth/token-guardian";
 import { startHistoryMigrationGuardian } from "../codex/history-migration-guardian";
 import { maybeAutoRestoreCodexShim } from "./codex-shim-autorestore";
-import { maybeShowStarPrompt } from "./star-prompt";
 import { scheduleCatalogPrewarm } from "./catalog-prewarm";
 import { maybeShowUpdatePrompt } from "../update/notify";
 import { syncModelsToCodex } from "../codex/sync";
@@ -399,7 +398,6 @@ async function handleStart(options: { block?: boolean } = {}) {
   // Auto-install .zshrc hook (idempotent — skips if already present).
   installShellHook();
-  await maybeShowStarPrompt(); // once-only Yes/No GitHub-star prompt on first interactive start
   // Post-startup sync drives the readiness gate AND the #1046 stale app-server
   // warning. `syncCodexOnStartIfEnabled` respects the Codex integration toggle
   // (OFF → no sync) and reports whether anything was written; the readiness gate

package/src/cli/onboard.ts CHANGED Viewed

@@ -12,6 +12,7 @@ import {
 } from "../codex/desired-state";
 import { syncModelsToCodex, type CodexSyncResult } from "../codex/sync";
 import { openUrl } from "../lib/open-url";
+import { redactSecretString } from "../lib/redact";
 import {
   assertServiceEnvironmentMatchesInstall,
   diagnoseService,
@@ -33,6 +34,8 @@ const ONBOARD_STEPS = 6;
 const DEFAULT_PROXY_WAIT_MS = 45_000;
 const DEFAULT_TUNNEL_WAIT_MS = 180_000;
 const CAPTURE_LIMIT = 96 * 1024;
+const GATEWAY_RETRY_LIMIT = 2;
+const GATEWAY_RETRY_DELAY_MS = 750;
 export type OnboardOptions = {
   verbose: boolean;
@@ -186,7 +189,20 @@ function platformLabel(platform: NodeJS.Platform): string {
 }
 function safeTerminalValue(value: string): string {
-  return value.replace(/[\u0000-\u001f\u007f]/gu, " ").trim().slice(0, 96);
+  return redactSecretString(value)
+    .replace(/[\u0000-\u001f\u007f]/gu, " ")
+    .replace(/\s+/gu, " ")
+    .trim()
+    .slice(0, 96);
+}
+function gatewayErrorDetail(value: string | undefined): string {
+  let detail = value?.trim() ?? "";
+  const prefix = "Could not start the Android Remote gateway";
+  while (new RegExp(`^${prefix}(?::|\\s|$)`, "iu").test(detail)) {
+    detail = detail.slice(prefix.length).replace(/^:\s*/u, "").trim();
+  }
+  return detail;
 }
 function defaultConfigureAndroidRemote(): { mode: "quick" | "named"; hostname?: string } {
@@ -275,8 +291,9 @@ async function waitForLiveProxy(
 function tunnelWaitMessage(status: OnboardRemoteStatus): string {
   const runtime = status.tunnel.runtime;
   if (status.gateway.status === "error") {
-    return status.gateway.error
-      ? `The Android gateway could not start: ${safeTerminalValue(status.gateway.error)}`
+    const detail = gatewayErrorDetail(status.gateway.error);
+    return detail
+      ? `The Android gateway could not start: ${safeTerminalValue(detail)}`
       : "The Android gateway could not start.";
   }
   if (runtime.error === "named_tunnel_incomplete") {
@@ -302,11 +319,13 @@ async function waitForVerifiedTunnel(
   now: () => number,
   timeoutMs: number,
   onTransition: (status: OnboardRemoteStatus["tunnel"]["runtime"]["status"]) => void,
+  retryGateway?: () => Promise<void>,
 ): Promise<OnboardRemoteStatus> {
   const deadline = now() + timeoutMs;
   let lastStatus: OnboardRemoteStatus | null = null;
   let lastReadError: unknown;
   let observed: OnboardRemoteStatus["tunnel"]["runtime"]["status"] | null = null;
+  let gatewayRetries = 0;
   do {
     try {
       const status = await read(baseUrl);
@@ -317,7 +336,27 @@ async function waitForVerifiedTunnel(
         observed = runtime.status;
         onTransition(runtime.status);
       }
-      if (status.gateway.status === "error" || runtime.error === "named_tunnel_incomplete") {
+      if (status.gateway.status === "error") {
+        // The service can expose the main proxy before its Android listener has
+        // finished starting. A failed first attempt is also recoverable when a
+        // stale private app-server/socket is released a moment later. Re-run the
+        // idempotent enable operation a couple of times before surfacing a hard
+        // failure to the user.
+        if (retryGateway && gatewayRetries < GATEWAY_RETRY_LIMIT) {
+          gatewayRetries += 1;
+          try {
+            await retryGateway();
+          } catch (error) {
+            lastReadError = error;
+          }
+          const remainingAfterRetry = deadline - now();
+          if (remainingAfterRetry <= 0) break;
+          await sleep(Math.min(GATEWAY_RETRY_DELAY_MS, remainingAfterRetry));
+          continue;
+        }
+        throw new OnboardStepError(tunnelWaitMessage(status));
+      }
+      if (runtime.error === "named_tunnel_incomplete") {
         throw new OnboardStepError(tunnelWaitMessage(status));
       }
       if (runtime.mode === expectedMode
@@ -522,6 +561,10 @@ export async function runOnboard(
         else if (state === "checking") output.log("      Public address found · verifying…");
         else if (state === "error") output.log("      Waiting for Cloudflare to recover…");
       },
+      async () => {
+        if (!options.json) output.log("      Android gateway did not start; retrying…");
+        await applyAndroidRemote(baseUrl);
+      },
     );
     const publicUrl = verified.tunnel.runtime.publicUrl!;
     complete(6, "Public connection verified");

package/src/server/management/config-routes.ts CHANGED Viewed

@@ -343,11 +343,19 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
   if (url.pathname === "/api/update/check" && req.method === "GET") {
     const { checkForUpdate, normalizeUpdateChannel } = await import("../../update/job");
+    const { fetchReleaseNotesForVersion } = await import("../../update/release-notes");
     const rawTag = url.searchParams.get("tag");
     if (rawTag && rawTag !== "latest" && rawTag !== "preview") {
       return jsonResponse({ error: "tag must be latest or preview" }, 400);
     }
-    return jsonResponse(checkForUpdate(normalizeUpdateChannel(rawTag)));
+    const check = checkForUpdate(normalizeUpdateChannel(rawTag));
+    const releaseNotesVersion = check.latestVersion ?? check.currentVersion;
+    const releaseNotes = await fetchReleaseNotesForVersion(releaseNotesVersion);
+    return jsonResponse({
+      ...check,
+      releaseNotesVersion,
+      ...(releaseNotes ? { releaseNotes } : {}),
+    });
   }
   if (url.pathname === "/api/update/run" && req.method === "POST") {

package/src/service.ts CHANGED Viewed

@@ -53,7 +53,6 @@ import { defaultWinswEntry, installWinswService, startWinswService, stopWinswSer
 import { hardenSecretDir, hardenSecretPath } from "./lib/windows-secret-acl";
 import { windowsEnvIndirectBatchPathList, windowsEnvIndirectBatchValue } from "./lib/win-paths";
 import { rebaseConfigOwnershipRoot, recordOwnedConfigPath } from "./lib/config-ownership";
-import { maybeShowStarPrompt } from "./cli/star-prompt";
 import {
   type DefaultRemodexHomeResolution,
   LEGACY_REMODEX_HOME_DIRNAME,
@@ -2916,11 +2915,6 @@ export async function serviceCommand(...args: (string | undefined)[]): Promise<v
       // installed artifact instead.
       await reportServiceServing("installed", { port: resolveServiceListenPort() });
       if (process.platform === "linux") console.log("   For auto-start on boot: loginctl enable-linger $USER");
-      // Service users never reach the `rmx start` prompt: the proxy they run is the
-      // supervised child, which always carries OCX_SERVICE=1. This command, though, is
-      // hand-typed in a real terminal, so it is the one interactive moment they get.
-      // Same one-time marker and same guards (TTY, gh auth, agent deferral) apply.
-      await maybeShowStarPrompt();
       break;
     case "start":
       prepareServiceProviderEnvironment();

package/src/update/auto-scheduler.ts CHANGED Viewed

@@ -736,6 +736,26 @@ function systemdQuote(value: string): string {
     .replace(/%/g, "%%")}"`;
 }
+/**
+ * `WorkingDirectory=` accepts a path value, not the quoted argument form used
+ * by `ExecStart=` and `Environment=`. Encode whitespace and unit-significant
+ * characters as systemd escapes so paths with spaces remain valid without
+ * leaving literal quotes in the directory name.
+ */
+function systemdPath(value: string): string {
+  let escaped = "";
+  for (const character of value) {
+    if (character === "\\") escaped += "\\\\";
+    else if (character === "%") escaped += "%%";
+    else if (character === " ") escaped += "\\x20";
+    else if (character === "\t") escaped += "\\x09";
+    else if (character === "\n") escaped += "\\x0a";
+    else if (character === '"') escaped += "\\x22";
+    else escaped += character;
+  }
+  return escaped;
+}
 function systemdEnvironment(name: string, value: string): string {
   return `Environment=${systemdQuote(`${name}=${value}`)}`;
 }
@@ -760,7 +780,7 @@ Wants=network-online.target
 [Service]
 Type=oneshot
 ExecStart=${systemdQuote(input.nodePath)} ${systemdQuote(input.launcherPath)} __auto-update
-WorkingDirectory=${systemdQuote(input.configDir)}
+WorkingDirectory=${systemdPath(input.configDir)}
 ${env.join("\n")}
 TimeoutStartSec=15min

package/src/update/notify.ts CHANGED Viewed

@@ -3,7 +3,6 @@ import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { atomicWriteFile, getConfigDir } from "../config";
-import { hasStarPromptRun } from "../cli/star-prompt";
 import {
   type Channel,
   currentVersion,
@@ -120,7 +119,7 @@ export function isSourceBuildVersion(v: string): boolean {
   return v.trim() === "0.0.0";
 }
-/** The interactive/TTY + install-method gate shared with the star prompt. */
+/** The interactive/TTY + install-method gate for update notifications. */
 function interactiveGuardOk(): boolean {
   return !(process.env.OCX_SERVICE || !process.stdin.isTTY || !process.stdout.isTTY);
 }
@@ -128,15 +127,13 @@ function interactiveGuardOk(): boolean {
 /**
  * Decide whether this run should even consider showing the prompt. Returns the
  * channel + current version when eligible, else null. Eligibility requires a
- * real global install, a non-source version, the interactive guard, and that
- * the one-time star prompt has already run (first-run yield, O1).
+ * real global install, a non-source version, and the interactive guard.
  */
 export function shouldConsider(): { channel: Channel; current: string } | null {
   if (detectInstall() === "source") return null;
   const current = currentVersion();
   if (current === "?" || isSourceBuildVersion(current)) return null;
   if (!interactiveGuardOk()) return null;
-  if (!hasStarPromptRun()) return null; // yield on the very first run
   return { channel: updateTag(current), current };
 }

package/src/update/release-notes.ts ADDED Viewed

@@ -0,0 +1,111 @@
+import { readBoundedResponseBody } from "../lib/bounded-body";
+/** Public repository that carries the release notes for the npm package. */
+export const RELEASE_NOTES_REPOSITORY = "ESCANOR-001/remodex-android";
+const RELEASE_NOTES_API_URL = `https://api.github.com/repos/${RELEASE_NOTES_REPOSITORY}/releases/tags`;
+export const RELEASE_NOTES_MAX_BYTES = 32 * 1024;
+const RELEASE_RESPONSE_MAX_BYTES = 64 * 1024;
+const FETCH_TIMEOUT_MS = 6_000;
+const BODY_TIMEOUT_MS = 5_000;
+const CACHE_TTL_MS = 10 * 60_000;
+const VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+interface CacheEntry {
+  body: string;
+  expiresAt: number;
+}
+const notesCache = new Map<string, CacheEntry>();
+function isReleaseVersion(value: string): boolean {
+  return value.length <= 64 && VERSION_PATTERN.test(value);
+}
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeReleaseNotes(value: string): string {
+  const normalized = value
+    .replace(/\r\n?/g, "\n")
+    // Keep markdown and whitespace, but never let terminal/control bytes reach the GUI.
+    .replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/g, "")
+    .trim();
+  if (Buffer.byteLength(normalized, "utf8") <= RELEASE_NOTES_MAX_BYTES) return normalized;
+  // The response reader already enforces a byte ceiling. This second guard accounts for the
+  // JSON envelope and makes the field safe even when this function is called directly in tests.
+  const clipped = Buffer.from(normalized, "utf8")
+    .subarray(0, RELEASE_NOTES_MAX_BYTES)
+    .toString("utf8")
+    .replace(/\uFFFD$/u, "")
+    .trimEnd();
+  return `${clipped}\n…`;
+}
+/** Clear the in-memory release-note cache. Intended for focused tests and development reloads. */
+export function clearReleaseNotesCacheForTests(): void {
+  notesCache.clear();
+}
+/**
+ * Fetch the exact GitHub Release body for a version.
+ *
+ * Release notes are display-only metadata. A registry/API failure therefore returns `null` and
+ * leaves the npm version check usable. The response is bounded, rendered as text by React, and
+ * accepted only when GitHub confirms the requested tag.
+ */
+export async function fetchReleaseNotesForVersion(
+  version: string,
+  fetchFn: typeof fetch = fetch,
+): Promise<string | null> {
+  if (!isReleaseVersion(version)) return null;
+  const now = Date.now();
+  const cached = notesCache.get(version);
+  if (cached && cached.expiresAt > now) return cached.body;
+  if (cached) notesCache.delete(version);
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const response = await fetchFn(`${RELEASE_NOTES_API_URL}/v${encodeURIComponent(version)}`, {
+      headers: {
+        Accept: "application/vnd.github+json",
+        "User-Agent": "Remodex-update-check",
+        "X-GitHub-Api-Version": "2022-11-28",
+      },
+      redirect: "error",
+      signal: controller.signal,
+    });
+    if (!response.ok) return null;
+    const bounded = await readBoundedResponseBody(response, {
+      // The JSON envelope and escaping can be larger than the final note body.
+      maxBytes: RELEASE_RESPONSE_MAX_BYTES,
+      totalTimeoutMs: BODY_TIMEOUT_MS,
+      inactivityTimeoutMs: BODY_TIMEOUT_MS,
+    });
+    if (!bounded.displaySafe || bounded.oversized || bounded.timedOut) return null;
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(bounded.text);
+    } catch {
+      return null;
+    }
+    if (!isRecord(parsed) || parsed.tag_name !== `v${version}` || typeof parsed.body !== "string") {
+      return null;
+    }
+    const body = normalizeReleaseNotes(parsed.body);
+    if (!body) return null;
+    notesCache.set(version, { body, expiresAt: Date.now() + CACHE_TTL_MS });
+    return body;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timeout);
+  }
+}