@wirecat/cli-core 0.573.0 → 0.574.0

package/CHANGELOG.md

@@ -7,6 +7,16 @@ shape of this file.
 
 ## Unreleased
 
+## 0.574.0 — 05.11.2026
+
+### Fixed
+
+- **A finished request no longer keeps the command in memory until its time limit ends.** The limit was a timer that
+  ran to the end even after the answer came, and it held everything the command had loaded; tg-cli and max-cli
+  already fixed the same thing in their own requests, and tg ran out of memory on macOS before that. This covers the
+  OAuth token and revoke requests, the OpenAI model request, the bot-registry checks, calendar feeds and serve's
+  catch-up on start. `timeLimit` and `withTimeLimit` (`src/http/time-limit.ts`) are the stoppable limit now.
+
 ## 0.573.0 — 05.11.2026
 
 ### Added

package/dist/botcheck/registries.js

@@ -1,3 +1,4 @@
+import { withTimeLimit } from "../http/time-limit.js";
 /** Where each one is documented, for the help text and the MCP description. */
 export const REGISTRIES = {
     cas: { title: "Combot Anti-Spam (CAS)", docs: "https://cas.chat/api" },
@@ -12,17 +13,19 @@ const TIMEOUT_MS = 10_000;
 export const askRegistries = async (id, options = {}) => Promise.all([askCas(id, options), askLols(id, options)]);
 const getJson = async (url, headers, { fetch: fetchFn = fetch, timeoutMs = TIMEOUT_MS }) => {
     try {
-        const response = await fetchFn(url, {
-            headers: { accept: "application/json", ...headers },
-            signal: AbortSignal.timeout(timeoutMs),
-            redirect: "error",
+        const { status, text } = await withTimeLimit(timeoutMs, async (signal) => {
+            const response = await fetchFn(url, {
+                headers: { accept: "application/json", ...headers },
+                signal,
+                redirect: "error",
+            });
+            return { status: response.status, text: await response.text() };
         });
-        const text = await response.text();
         try {
-            return { status: response.status, body: JSON.parse(text) };
+            return { status, body: JSON.parse(text) };
         }
         catch {
-            return { failed: `answered ${response.status} with something that is not JSON` };
+            return { failed: `answered ${status} with something that is not JSON` };
         }
     }
     catch (error) {

package/dist/calendar/feeds.js

@@ -2,6 +2,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { CliError, isCliError } from "@wirecat/cli-base";
 import { zonedMoment } from "@wirecat/cli-base/query";
 import { runBudget } from "../background/budget.js";
+import { timeLimit } from "../http/time-limit.js";
 import { calendarText, joinUrlWithoutQuery } from "../meetings/index.js";
 import { expandSeries, unexpandable } from "./expand.js";
 import { readIcs } from "./ics.js";
@@ -72,8 +73,8 @@ export const fetchFeedIfChanged = async (address, options) => {
         ...(since?.lastModified ? { "if-modified-since": since.lastModified } : {}),
     };
     const run = options.fetch ?? fetch;
-    const timeout = AbortSignal.timeout(limits.timeoutMs);
-    const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
+    const timeout = timeLimit(limits.timeoutMs);
+    const signal = options.signal ? AbortSignal.any([options.signal, timeout.signal]) : timeout.signal;
     let url = feedAddress(address);
     try {
         for (let hop = 0;; hop++) {
@@ -122,7 +123,7 @@ export const fetchFeedIfChanged = async (address, options) => {
             throw error;
         if (options.signal?.aborted)
             throw new CliError("cancelled", `reading ${name} was cancelled`);
-        if (timeout.aborted)
+        if (timeout.signal.aborted)
             throw new CliError("timeout", `${name} did not answer within ${Math.round(limits.timeoutMs / 1000)} s`, {
                 reason: "feed.timeout",
                 retryable: true,
@@ -134,6 +135,9 @@ export const fetchFeedIfChanged = async (address, options) => {
             retryable: true,
         });
     }
+    finally {
+        timeout.clear();
+    }
 };
 const SPAN = { start: 0, end: 0 };
 const firstLink = (text) => text?.match(/https?:\/\/[^\s<>"')\]]+/iu)?.[0];

package/dist/cli/messenger/serve-catch-up.js

@@ -1,4 +1,5 @@
 import { failureKey } from "../../errors/failures.js";
+import { withTimeLimit } from "../../http/time-limit.js";
 /** The provider's own catch-up lands first; this pass then finds most chats already current. */
 export const START_SYNC_DELAY_MS = 30_000;
 export const START_SYNC_BUDGET_MS = 5 * 60_000;
@@ -19,8 +20,8 @@ export const startSync = ({ chats, newestHeld, fetch, note, warn, delayMs = STAR
     let pass = Promise.resolve();
     let started = false;
     let done;
-    const run = async () => {
-        const stop = AbortSignal.any([controller.signal, AbortSignal.timeout(budgetMs)]);
+    const run = () => withTimeLimit(budgetMs, (deadline) => catchUp(AbortSignal.any([controller.signal, deadline])));
+    const catchUp = async (stop) => {
         const floor = now() - windowMs;
         const moved = [];
         for (const chat of await chats(stop)) {

package/dist/http/time-limit.d.ts

@@ -0,0 +1,11 @@
+export interface TimeLimit {
+    signal: AbortSignal;
+    clear: () => void;
+}
+/**
+ * A time limit that can be stopped. `AbortSignal.timeout` cannot: its timer runs to the deadline even after the
+ * request is done, and keeps the run's whole async context (everything the command loaded) alive until then.
+ */
+export declare const timeLimit: (ms: number) => TimeLimit;
+/** Runs `run` under a time limit and stops the timer when it settles. Whatever `run` reads from the response belongs inside. */
+export declare const withTimeLimit: <T>(ms: number, run: (deadline: AbortSignal) => Promise<T>) => Promise<T>;

package/dist/http/time-limit.js

@@ -0,0 +1,20 @@
+/**
+ * A time limit that can be stopped. `AbortSignal.timeout` cannot: its timer runs to the deadline even after the
+ * request is done, and keeps the run's whole async context (everything the command loaded) alive until then.
+ */
+export const timeLimit = (ms) => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(new DOMException("The operation timed out.", "TimeoutError")), ms);
+    timer.unref();
+    return { signal: controller.signal, clear: () => clearTimeout(timer) };
+};
+/** Runs `run` under a time limit and stops the timer when it settles. Whatever `run` reads from the response belongs inside. */
+export const withTimeLimit = async (ms, run) => {
+    const limit = timeLimit(ms);
+    try {
+        return await run(limit.signal);
+    }
+    finally {
+        limit.clear();
+    }
+};

package/dist/models/openai.js

@@ -1,4 +1,5 @@
 import * as v from "valibot";
+import { withTimeLimit } from "../http/time-limit.js";
 import { checkedOptions, range } from "./options.js";
 import { messagesFor, systemFor } from "./types.js";
 const options = v.strictObject({
@@ -14,7 +15,7 @@ export const openai = {
     images: true,
     baseUrl: "https://api.openai.com/v1",
     validate: (given) => checkedOptions("openai", options, given),
-    complete: async (target, request, checked, apiKey, fetcher) => {
+    complete: (target, request, checked, apiKey, fetcher) => withTimeLimit(120_000, async (deadline) => {
         const response = await fetcher(`${target.baseUrl.replace(/\/+$/, "")}/chat/completions`, {
             method: "POST",
             headers: { "Content-Type": "application/json", ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}) },
@@ -40,7 +41,7 @@ export const openai = {
                     ? { max_completion_tokens: request.maxTokens }
                     : { max_tokens: request.maxTokens }),
             }),
-            signal: AbortSignal.timeout(120_000),
+            signal: deadline,
             redirect: "error",
         });
         if (!response.ok)
@@ -53,5 +54,5 @@ export const openai = {
             (body.usage?.total_tokens ?? 0) < 1)
             throw new Error("incomplete response");
         return { text: choice.message.content, tokens: body.usage?.total_tokens };
-    },
+    }),
 };

package/dist/oauth/requests.js

@@ -1,4 +1,5 @@
 import { CliError, isCliError } from "@wirecat/cli-base";
+import { withTimeLimit } from "../http/time-limit.js";
 const REQUEST_LIMIT_MS = 30_000;
 export const TOKEN_LOG_EVENT = "oauth.token";
 /** The keys the module's log records carry, for a run log's `allow`; names only, never a token. */
@@ -8,20 +9,20 @@ const object = (value) => {
         throw new Error("not an object");
     return value;
 };
-const requestSignal = (signal) => signal ? AbortSignal.any([signal, AbortSignal.timeout(REQUEST_LIMIT_MS)]) : AbortSignal.timeout(REQUEST_LIMIT_MS);
+const requestSignal = (deadline, signal) => signal ? AbortSignal.any([signal, deadline]) : deadline;
 const cancelledBy = (signal) => {
     if (!signal?.aborted)
         return;
     throw isCliError(signal.reason) ? signal.reason : new CliError("cancelled", "sign-in was cancelled");
 };
-const post = async (url, body, context) => {
+const post = async (url, body, context, deadline) => {
     cancelledBy(context.signal);
     try {
         return await context.fetch(url, {
             method: "POST",
             headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
             body,
-            signal: requestSignal(context.signal),
+            signal: requestSignal(deadline, context.signal),
             redirect: "error",
         });
     }
@@ -38,11 +39,12 @@ const clientFields = ({ client }) => ({
  * The token endpoint, form-encoded, for both grants. Nothing from the request or the response reaches a message or
  * a log record: both carry codes and tokens.
  */
-export const requestTokens = async (provider, params, context) => {
+export const requestTokens = (provider, params, context) => withTimeLimit(REQUEST_LIMIT_MS, (deadline) => exchangeTokens(provider, params, context, deadline));
+const exchangeTokens = async (provider, params, context, deadline) => {
     const operation = params.grant_type ?? "unknown";
     const record = (level, fields) => context.log?.[level]({ event: TOKEN_LOG_EVENT, provider: provider.id, operation, pid: process.pid, ...fields });
     const again = `run ${context.signInCommand} again`;
-    const response = await post(provider.tokenUrl, new URLSearchParams({ ...params, ...clientFields(context) }), context);
+    const response = await post(provider.tokenUrl, new URLSearchParams({ ...params, ...clientFields(context) }), context, deadline);
     if (!response) {
         record("warn", { outcome: "no_response" });
         throw new CliError("outcome_unknown", `${provider.name} token request did not finish; ${again} if it keeps failing`, {
@@ -112,7 +114,9 @@ export const revokeToken = async (provider, tokens, context) => {
         return provider.revoke(tokens, context);
     if (!provider.revokeUrl)
         throw new CliError("validation_error", `${provider.name} declares no way to revoke a sign-in`);
-    const response = await post(provider.revokeUrl, new URLSearchParams({ token: tokens.refreshToken, ...clientFields(context) }), context);
+    const { revokeUrl } = provider;
+    const form = new URLSearchParams({ token: tokens.refreshToken, ...clientFields(context) });
+    const response = await withTimeLimit(REQUEST_LIMIT_MS, (deadline) => post(revokeUrl, form, context, deadline));
     context.log?.[response?.ok ? "info" : "warn"]({
         event: TOKEN_LOG_EVENT,
         provider: provider.id,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.573.0",
+  "version": "0.574.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",