blun-king-cli 9.1.581 → 9.1.582

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+# 9.1.582 - 2026-09-08
+
+- Stop oversized local page responses while reading their body, including responses without a reliable Content-Length header. Cancel the stream when received bytes exceed the existing ten MiB limit.
+- Apply the limit to the delivered response stream after HTTP decompression and preserve UTF-8 characters split across chunks. Transport buffers and the crossing chunk may already exist; this is not an exact process-memory ceiling.
+- Keep the research fixes from 9.1.581. Telegram delivery, incoming addressing and model timing logic are unchanged.
+
 ## 9.1.581
 
 - Local HTML fetching now rejects extraction results that are empty after cleanup, instead of presenting a document title alone as page content.

package/blun.mjs

@@ -315127,9 +315127,32 @@ var init_local_fetch_url = __esmMin((() => {
 			const contentLengthRaw = response.headers.get("content-length");
 			if (contentLengthRaw !== null) {
 				const cl = Number(contentLengthRaw);
-				if (Number.isFinite(cl) && cl > this.maxBytes) throw new Error(`Response body too large: ${String(cl)} bytes exceeds maxBytes (${String(this.maxBytes)}).`);
+				if (Number.isFinite(cl) && cl > this.maxBytes) {
+					await response.body?.cancel().catch(() => {});
+					throw new Error(`Response body too large: ${String(cl)} bytes exceeds maxBytes (${String(this.maxBytes)}).`);
+				}
+			}
+			let body = "";
+			if (response.body !== null) {
+				const reader = response.body.getReader();
+				const decoder = new TextDecoder();
+				let receivedBytes = 0;
+				try {
+					while (true) {
+						const { done, value } = await reader.read();
+						if (done) break;
+						receivedBytes += value.byteLength;
+						if (receivedBytes > this.maxBytes) {
+							await reader.cancel().catch(() => {});
+							throw new Error(`Response body too large: ${String(receivedBytes)} bytes exceeds maxBytes (${String(this.maxBytes)}).`);
+						}
+						body += decoder.decode(value, { stream: true });
+					}
+					body += decoder.decode();
+				} finally {
+					reader.releaseLock();
+				}
 			}
-			const body = await response.text();
 			const actualBytes = Buffer.byteLength(body, "utf8");
 			if (actualBytes > this.maxBytes) throw new Error(`Response body too large: ${String(actualBytes)} bytes exceeds maxBytes (${String(this.maxBytes)}).`);
 			const contentType = (response.headers.get("content-type") ?? "").toLowerCase();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blun-king-cli",
-  "version": "9.1.581",
+  "version": "9.1.582",
   "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",
   "license": "MIT",
   "bin": {