wontopos 2.2.15 → 2.2.17

package/dist/wontopos.d.ts

@@ -273,7 +273,7 @@ export declare class Client {
     withTimeout(timeoutMs: number): Client;
     /** A client with a different retry budget (everything else kept). 0 disables retries. */
     withRetries(maxRetries: number): Client;
-    /** Store one memory. `metadata` optional (e.g. { event_date: "2026-03-01" }).
+    /** Store one memory. `metadata` optional (e.g. { event_date: "2026-03-01T00:00:00Z" } — RFC3339).
      * `metadata.speaker`: "me" = the assistant's own words, or a person's name (up to 50 per store). */
     add(content: string, userId?: string, metadata?: Record<string, unknown>): Promise<StoreResult>;
     /** Alias of `add` — store one memory. Same surface as the Python SDK's `store`. */

package/dist/wontopos.js

@@ -37,7 +37,7 @@
  * runtime's (never disabled by this SDK; Node 18+ floors TLS at 1.2). Prefer
  * `Client.fromEnv()` over keys in source code.
  */
-const VERSION = "2.2.15";
+const VERSION = "2.2.17";
 /** Runtime info helps support debug a report ("node 18 on Windows...") —
  * platform only, never anything identifying. Browsers have no `process` (and
  * silently drop the UA header anyway). */
@@ -69,6 +69,10 @@ const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "0.0.0.0"]);
 const MAX_RESPONSE_BYTES = 64 * 1024 * 1024;
 /** Model names travel in a header — only header-safe characters. */
 const MODEL_RE = /^[A-Za-z0-9._-]+$/;
+/** Cap a server-controlled error message so a hostile body can't blow up a log. */
+const MAX_ERR_MSG = 4096;
+/** Paging backstop: bound the walk so a fresh-cursor-forever server can't loop us. */
+const MAX_PAGES = 1_000_000;
 /** Error codes that only occur while ESTABLISHING a connection — the request
  * never reached the server, so a retry can't double-process a write. Mid-stream
  * codes (ECONNRESET, EPIPE, UND_ERR_SOCKET, ETIMEDOUT) are ambiguous: the server
@@ -294,7 +298,7 @@ export class Client {
     // ----- write -----
     // `userId` is optional in every call below - omit it to use the client's default
     // store (set via `new Client({ apiKey, userId })` or `withUser`).
-    /** Store one memory. `metadata` optional (e.g. { event_date: "2026-03-01" }).
+    /** Store one memory. `metadata` optional (e.g. { event_date: "2026-03-01T00:00:00Z" } — RFC3339).
      * `metadata.speaker`: "me" = the assistant's own words, or a person's name (up to 50 per store). */
     add(content, userId, metadata = {}) {
         return this.post("/api/v1/memory/store", { user_id: this.uid(userId), content, metadata });
@@ -381,12 +385,13 @@ export class Client {
     async *iterMemories(userId, opts = {}) {
         let cursor;
         const seen = new Set();
-        for (;;) {
-            const page = await this.listMemories(userId, { limit: opts.pageSize ?? 100, cursor });
-            for (const m of page.memories ?? [])
+        // Backstop: the cursor-repeat guard catches a repeated cursor, but not a
+        // server that mints a FRESH cursor every page forever — bound the walk.
+        for (let page = 0; page < MAX_PAGES; page++) {
+            const p = await this.listMemories(userId, { limit: opts.pageSize ?? 100, cursor });
+            for (const m of p.memories ?? [])
                 yield m;
-            const next = page.next_cursor ?? undefined;
-            // Stop on last page OR a server that repeats a cursor (would loop forever).
+            const next = p.next_cursor ?? undefined;
             if (!next || seen.has(next))
                 break;
             seen.add(next);
@@ -564,6 +569,7 @@ export class Client {
             }
             if ((res.status >= 300 && res.status < 400) || res.type === "opaqueredirect") {
                 clearTimeout(timer);
+                void res.body?.cancel(); // release the stream — otherwise the connection leaks
                 throw new WosError(res.status, "unexpected redirect — refused (the API key never follows a redirect). Check baseUrl: exact host, https://.");
             }
             this._rateLimit = parseRateLimit(res.headers) ?? this._rateLimit;
@@ -612,18 +618,31 @@ export class Client {
                 catch {
                     /* keep raw text */
                 }
+                // Cap the FINAL message (a string `error` field can be as huge as the body),
+                // so a hostile server can't turn our exception/log into a giant string.
+                if (typeof msg === "string" && msg.length > MAX_ERR_MSG)
+                    msg = msg.slice(0, MAX_ERR_MSG) + "…(truncated)";
                 throw errorFor(res.status, msg, requestId);
             }
             if (!text)
-                return null;
+                return {};
+            let data;
             try {
-                return JSON.parse(text);
+                data = JSON.parse(text);
             }
             catch (e) {
                 // A 2xx with a corrupt body is a real failure — surface it, don't leak
                 // a raw SyntaxError (parity with the Rust SDK).
                 throw new WosError(res.status, `invalid JSON in response: ${e?.message ?? e}`);
             }
+            // Enforce a JSON OBJECT: every method reads the result with `.field`, so a
+            // body that parses to null / a number / a string / an array (a broken or
+            // hostile server) must be a clean WosError, not a `null.memories` TypeError.
+            if (data === null || typeof data !== "object" || Array.isArray(data)) {
+                const got = data === null ? "null" : Array.isArray(data) ? "array" : typeof data;
+                throw new WosError(res.status, `expected a JSON object in the response, got ${got}`);
+            }
+            return data;
         }
         throw new WosError(0, "retries exhausted"); // unreachable; keeps the compiler happy
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wontopos",
-  "version": "2.2.15",
+  "version": "2.2.17",
   "description": "Wontopos — long-term memory for AI agents. Pure semantic retrieval, identical recall in every language, ~100× lower LLM bill.",
   "keywords": [
     "memory",