wontopos 2.2.15 → 2.2.16

package/dist/wontopos.js

@@ -37,7 +37,7 @@
  * runtime's (never disabled by this SDK; Node 18+ floors TLS at 1.2). Prefer
  * `Client.fromEnv()` over keys in source code.
  */
-const VERSION = "2.2.15";
+const VERSION = "2.2.16";
 /** Runtime info helps support debug a report ("node 18 on Windows...") —
  * platform only, never anything identifying. Browsers have no `process` (and
  * silently drop the UA header anyway). */
@@ -69,6 +69,10 @@ const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "0.0.0.0"]);
 const MAX_RESPONSE_BYTES = 64 * 1024 * 1024;
 /** Model names travel in a header — only header-safe characters. */
 const MODEL_RE = /^[A-Za-z0-9._-]+$/;
+/** Cap a server-controlled error message so a hostile body can't blow up a log. */
+const MAX_ERR_MSG = 4096;
+/** Paging backstop: bound the walk so a fresh-cursor-forever server can't loop us. */
+const MAX_PAGES = 1_000_000;
 /** Error codes that only occur while ESTABLISHING a connection — the request
  * never reached the server, so a retry can't double-process a write. Mid-stream
  * codes (ECONNRESET, EPIPE, UND_ERR_SOCKET, ETIMEDOUT) are ambiguous: the server
@@ -381,12 +385,13 @@ export class Client {
     async *iterMemories(userId, opts = {}) {
         let cursor;
         const seen = new Set();
-        for (;;) {
-            const page = await this.listMemories(userId, { limit: opts.pageSize ?? 100, cursor });
-            for (const m of page.memories ?? [])
+        // Backstop: the cursor-repeat guard catches a repeated cursor, but not a
+        // server that mints a FRESH cursor every page forever — bound the walk.
+        for (let page = 0; page < MAX_PAGES; page++) {
+            const p = await this.listMemories(userId, { limit: opts.pageSize ?? 100, cursor });
+            for (const m of p.memories ?? [])
                 yield m;
-            const next = page.next_cursor ?? undefined;
-            // Stop on last page OR a server that repeats a cursor (would loop forever).
+            const next = p.next_cursor ?? undefined;
             if (!next || seen.has(next))
                 break;
             seen.add(next);
@@ -564,6 +569,7 @@ export class Client {
             }
             if ((res.status >= 300 && res.status < 400) || res.type === "opaqueredirect") {
                 clearTimeout(timer);
+                void res.body?.cancel(); // release the stream — otherwise the connection leaks
                 throw new WosError(res.status, "unexpected redirect — refused (the API key never follows a redirect). Check baseUrl: exact host, https://.");
             }
             this._rateLimit = parseRateLimit(res.headers) ?? this._rateLimit;
@@ -612,6 +618,10 @@ export class Client {
                 catch {
                     /* keep raw text */
                 }
+                // Cap the FINAL message (a string `error` field can be as huge as the body),
+                // so a hostile server can't turn our exception/log into a giant string.
+                if (typeof msg === "string" && msg.length > MAX_ERR_MSG)
+                    msg = msg.slice(0, MAX_ERR_MSG) + "…(truncated)";
                 throw errorFor(res.status, msg, requestId);
             }
             if (!text)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wontopos",
-  "version": "2.2.15",
+  "version": "2.2.16",
   "description": "Wontopos — long-term memory for AI agents. Pure semantic retrieval, identical recall in every language, ~100× lower LLM bill.",
   "keywords": [
     "memory",