blun-king-cli 9.1.581 → 9.1.583

package/CHANGELOG.md

@@ -1,3 +1,16 @@
+## 9.1.583 - 2026-09-08
+
+- FetchURL now passes caller cancellation through the tool and both fetch providers to the HTTP request.
+- An aborted managed fetch no longer starts a local fallback, and a late provider result cannot become source evidence after cancellation.
+- Normal fetch failures still allow the existing fallback. No new timeout is introduced; Telegram routing and model requests are unchanged.
+
+
+# 9.1.582 - 2026-09-08
+
+- Stop oversized local page responses while reading their body, including responses without a reliable Content-Length header. Cancel the stream when received bytes exceed the existing ten MiB limit.
+- Apply the limit to the delivered response stream after HTTP decompression and preserve UTF-8 characters split across chunks. Transport buffers and the crossing chunk may already exist; this is not an exact process-memory ceiling.
+- Keep the research fixes from 9.1.581. Telegram delivery, incoming addressing and model timing logic are unchanged.
+
 ## 9.1.581
 
 - Local HTML fetching now rejects extraction results that are empty after cleanup, instead of presenting a document title alone as page content.

package/blun.mjs

@@ -265663,9 +265663,11 @@ var init_fetch_url = __esmMin((() => {
 				execute: (ctx) => this.execution(args, ctx)
 			};
 		}
-		async execution(args, { toolCallId }) {
+		async execution(args, { toolCallId, signal }) {
 			try {
-				const { content, kind } = await this.fetcher.fetch(args.url, { toolCallId });
+				signal?.throwIfAborted();
+				const { content, kind } = await this.fetcher.fetch(args.url, { toolCallId, signal });
+				signal?.throwIfAborted();
 				return formatResearchPage({ ...args, content, kind });
 			} catch (error) {
 				const msg = error instanceof Error ? error.message : String(error);
@@ -315114,11 +315116,13 @@ var init_local_fetch_url = __esmMin((() => {
 			this.maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;
 			this.allowPrivateAddresses = options.allowPrivateAddresses ?? false;
 		}
-		async fetch(url, _options) {
+		async fetch(url, options) {
+			options?.signal?.throwIfAborted();
 			assertSafeFetchTarget(url, this.allowPrivateAddresses);
 			const response = await this.fetchImpl(url, {
 				method: "GET",
-				headers: { "User-Agent": this.userAgent }
+				headers: { "User-Agent": this.userAgent },
+				signal: options?.signal
 			});
 			if (response.status >= 400) {
 				await response.body?.cancel().catch(() => {});
@@ -315127,9 +315131,32 @@ var init_local_fetch_url = __esmMin((() => {
 			const contentLengthRaw = response.headers.get("content-length");
 			if (contentLengthRaw !== null) {
 				const cl = Number(contentLengthRaw);
-				if (Number.isFinite(cl) && cl > this.maxBytes) throw new Error(`Response body too large: ${String(cl)} bytes exceeds maxBytes (${String(this.maxBytes)}).`);
+				if (Number.isFinite(cl) && cl > this.maxBytes) {
+					await response.body?.cancel().catch(() => {});
+					throw new Error(`Response body too large: ${String(cl)} bytes exceeds maxBytes (${String(this.maxBytes)}).`);
+				}
+			}
+			let body = "";
+			if (response.body !== null) {
+				const reader = response.body.getReader();
+				const decoder = new TextDecoder();
+				let receivedBytes = 0;
+				try {
+					while (true) {
+						const { done, value } = await reader.read();
+						if (done) break;
+						receivedBytes += value.byteLength;
+						if (receivedBytes > this.maxBytes) {
+							await reader.cancel().catch(() => {});
+							throw new Error(`Response body too large: ${String(receivedBytes)} bytes exceeds maxBytes (${String(this.maxBytes)}).`);
+						}
+						body += decoder.decode(value, { stream: true });
+					}
+					body += decoder.decode();
+				} finally {
+					reader.releaseLock();
+				}
 			}
-			const body = await response.text();
 			const actualBytes = Buffer.byteLength(body, "utf8");
 			if (actualBytes > this.maxBytes) throw new Error(`Response body too large: ${String(actualBytes)} bytes exceeds maxBytes (${String(this.maxBytes)}).`);
 			const contentType = (response.headers.get("content-type") ?? "").toLowerCase();
@@ -315172,18 +315199,21 @@ var init_blun_fetch_url = __esmMin((() => {
 			this.fetchImpl = options.fetchImpl ?? globalThis.fetch.bind(globalThis);
 		}
 		async fetch(url, options) {
+			const signal = options?.signal;
+			signal?.throwIfAborted();
 			try {
 				return {
-					content: await this.fetchViaBlun(url, options?.toolCallId),
+					content: await this.fetchViaBlun(url, options?.toolCallId, signal),
 					kind: "extracted"
 				};
 			} catch {
+				signal?.throwIfAborted();
 				return this.localFallback.fetch(url, options ?? {});
 			}
 		}
-		async fetchViaBlun(url, toolCallId) {
+		async fetchViaBlun(url, toolCallId, signal) {
 			const bodyJson = JSON.stringify({ url });
-			const response = await this.post(bodyJson, toolCallId);
+			const response = await this.post(bodyJson, toolCallId, signal);
 			if (response.status !== 200) {
 				let detail = "";
 				try {
@@ -315193,8 +315223,9 @@ var init_blun_fetch_url = __esmMin((() => {
 			}
 			return response.text();
 		}
-		async post(bodyJson, toolCallId) {
+		async post(bodyJson, toolCallId, signal) {
 			const accessToken = await this.resolveApiKey();
+			signal?.throwIfAborted();
 			return this.fetchImpl(this.baseUrl, {
 				method: "POST",
 				headers: {
@@ -315205,7 +315236,8 @@ var init_blun_fetch_url = __esmMin((() => {
 					...toolCallId !== void 0 && toolCallId.length > 0 ? { "X-Msh-Tool-Call-Id": toolCallId } : {},
 					...this.customHeaders
 				},
-				body: bodyJson
+				body: bodyJson,
+				signal
 			});
 		}
 		async resolveApiKey() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blun-king-cli",
-  "version": "9.1.581",
+  "version": "9.1.583",
   "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",
   "license": "MIT",
   "bin": {