Alix-007 bf5c9d1748 fix(feishu): bound Feishu API JSON response reads to prevent OOM (#97782) ...

* fix(feishu): bound Feishu API JSON response reads to prevent OOM

Replace the bare `response.json()` in `fetchFeishuJson`
(`extensions/feishu/src/app-registration.ts`) with a `readResponseWithLimit`
call capped at 16 MiB. A misconfigured or adversarial Feishu endpoint that
streams an unbounded body previously had no defence; the bounded reader now
cancels the stream at the cap and throws a labelled `feishu.api` error.

Tests: over-cap (32 MiB stream, no Content-Length — stream cancelled, error
matches feishu.api), under-cap (chunked valid JSON — parsed and returned),
and malformed-JSON (labelled feishu.api error). All five tests pass.

* fix(feishu): delegate JSON reads to provider helper

* test(feishu): add real node:http server proof for readProviderJsonResponse bound

* test(feishu): fix lint errors in real HTTP server proof (curly + no-promise-executor-return)

* test(feishu): prove bound reads through SSRF guard

* fix(feishu): satisfy overloaded LookupFn type in hermetic test lookup stub

2026-07-06 01:06:08 -07:00

..

acpx

chore: update dependencies (#100027)

2026-07-04 14:56:50 -04:00

active-memory

fix(core): keep backend truncation UTF-16 safe (#100244)

2026-07-05 05:48:35 -07:00

admin-http-rpc

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

alibaba

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

amazon-bedrock

chore: update dependencies (#100027)

2026-07-04 14:56:50 -04:00

amazon-bedrock-mantle

fix(bedrock): bound Mantle model discovery fetches (#99961)

2026-07-06 02:21:00 +01:00

anthropic

feat: show auto-detected provider plans and billing (#100520)

2026-07-06 04:53:09 +01:00

anthropic-vertex

chore: update dependencies (#100027)

2026-07-04 14:56:50 -04:00

arcee

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

azure-speech

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

bonjour

refactor(shared): consolidate provider and utility lazy loaders (#98749)

2026-07-02 21:16:26 -07:00

brave

refactor(shared): consolidate provider and utility lazy loaders (#98749)

2026-07-02 21:16:26 -07:00

browser

fix(browser): diagnose empty WSL2 Chrome replies (#100590)

2026-07-06 07:42:02 +01:00

byteplus

refactor(providers): table-drive paired catalogs (#99777)

2026-07-04 11:35:55 -07:00

canvas

chore: update dependencies (#100027)

2026-07-04 14:56:50 -04:00

cerebras

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

chutes

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

clawrouter

feat: show auto-detected provider plans and billing (#100520)

2026-07-06 04:53:09 +01:00

clickclack

fix(clickclack): reply to a top-level message in-channel, not as a new thread (#100582)

2026-07-05 22:27:27 -07:00

cloudflare-ai-gateway

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

codex

fix(codex): return JSON-RPC codes for handler errors (#100713)

2026-07-06 08:59:20 +01:00

codex-supervisor

chore: update dependencies (#100027)

2026-07-04 14:56:50 -04:00

cohere

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

comfy

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

copilot

fix(ios): restore in-flight runs after reconnect (#100277)

2026-07-06 03:23:38 +01:00

copilot-proxy

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

deepgram

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

deepinfra

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

deepseek

feat: show auto-detected provider plans and billing (#100520)

2026-07-06 04:53:09 +01:00

device-pair

fix(pairing): advertise reachable Tailnet routes (#100317)

2026-07-05 07:43:43 -07:00

diagnostics-otel

chore: update dependencies (#100027)

2026-07-04 14:56:50 -04:00

diagnostics-prometheus

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

diffs

fix(diffs): share SSR preloads and repair language-pack hydration (#100487)

2026-07-06 00:34:17 +01:00

diffs-language-pack

fix(diffs): share SSR preloads and repair language-pack hydration (#100487)

2026-07-06 00:34:17 +01:00

discord

fix(providers): bound successful OAuth and webhook responses (#98098)

2026-07-06 08:58:58 +01:00

document-extract

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

duckduckgo

refactor(shared): consolidate provider and utility lazy loaders (#98749)

2026-07-02 21:16:26 -07:00

elevenlabs

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

exa

refactor(shared): consolidate provider and utility lazy loaders (#98749)

2026-07-02 21:16:26 -07:00

fal

fix(fal): route grok-imagine and nano-banana-2-lite edits to correct endpoints (#98688)

2026-07-01 20:42:25 -07:00

feishu

fix(feishu): bound Feishu API JSON response reads to prevent OOM (#97782)

2026-07-06 01:06:08 -07:00

file-transfer

chore: update dependencies (#100027)

2026-07-04 14:56:50 -04:00

firecrawl

improve(web-fetch): speed up provider fallback loading (#98559)

2026-07-04 12:47:10 -07:00

fireworks

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

github-copilot

feat: show auto-detected provider plans and billing (#100520)

2026-07-06 04:53:09 +01:00

gmi

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

google

feat: show auto-detected provider plans and billing (#100520)

2026-07-06 04:53:09 +01:00

google-meet

fix(google-meet): bound JSON response body reads to prevent OOM (#98850)

2026-07-05 02:34:08 -04:00

googlechat

chore: update dependencies (#100027)

2026-07-04 14:56:50 -04:00

gradium

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

groq

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

huggingface

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

image-generation-core

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

imessage

feat: add channel pairing request hook (#97733)

2026-07-05 19:11:58 -07:00

inworld

fix(inworld): guard voices JSON.parse against malformed API response bodies (#98660)

2026-07-01 08:55:41 -07:00

irc

fix(irc): long non-ASCII messages are silently truncated at the 512-byte line limit (#99138)

2026-07-05 22:10:59 +01:00

kilocode

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

kimi-coding

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

line

feat: add channel pairing request hook (#97733)

2026-07-05 19:11:58 -07:00

litellm

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

llama-cpp

chore: update dependencies (#100027)

2026-07-04 14:56:50 -04:00

llm-task

chore: update dependencies (#100027)

2026-07-04 14:56:50 -04:00

lmstudio

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

lobster

refactor(plugin-sdk): consolidate tool result helpers (#99740)

2026-07-04 16:50:44 -07:00

logbook

feat(logbook): automatic work journal plugin with Control UI timeline tab (#99930)

2026-07-05 11:50:44 -07:00

matrix

test: stabilize load-sensitive test families that break gates under parallel load (#100420)

2026-07-05 12:53:06 -07:00

mattermost

fix(skills): apply command description limits per channel (#99593)

2026-07-05 18:12:51 -07:00

media-understanding-core

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

memory-core

fix(memory-core): guard qmd mcporter JSON.parse against non-JSON stdout (#98381)

2026-07-06 06:57:41 +00:00

memory-lancedb

chore: update dependencies (#100027)

2026-07-04 14:56:50 -04:00

memory-wiki

fix: land nine small correctness fixes (#100204)

2026-07-05 01:44:56 -07:00

microsoft

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

microsoft-foundry

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

migrate-claude

refactor: consolidate core stream cleanup, watchdog locality, and approval text duplication (#99901)

2026-07-04 02:08:35 -07:00

migrate-hermes

refactor: consolidate core stream cleanup, watchdog locality, and approval text duplication (#99901)

2026-07-04 02:08:35 -07:00

minimax

feat: show auto-detected provider plans and billing (#100520)

2026-07-06 04:53:09 +01:00

mistral

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

moonshot

refactor(shared): consolidate provider and utility lazy loaders (#98749)

2026-07-02 21:16:26 -07:00

msteams

fix(channels): expose inbound media download failures [AI-assisted] (#100119)

2026-07-04 20:28:52 -04:00

nextcloud-talk

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

nostr

refactor: consolidate exact keyed async queues (#99691)

2026-07-04 16:45:07 -07:00

novita

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

nvidia

refactor(plugins): consolidate record guards (#99361)

2026-07-02 22:12:53 -07:00

oc-path

chore: update dependencies (#100027)

2026-07-04 14:56:50 -04:00

ollama

fix(ollama): fall back when native streams end early (#100482)

2026-07-06 03:12:49 +01:00

open-prose

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

openai

fix(openai): keep missing-auth hint on default model (#100579)

2026-07-06 08:56:20 +01:00

opencode

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

opencode-go

fix(agents): time out local streams without first event (#98525)

2026-07-01 23:01:46 +08:00

openrouter

fix(providers): bound successful OAuth and webhook responses (#98098)

2026-07-06 08:58:58 +01:00

openshell

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

parallel

refactor(plugins): consolidate record guards (#99361)

2026-07-02 22:12:53 -07:00

perplexity

refactor(shared): consolidate provider and utility lazy loaders (#98749)

2026-07-02 21:16:26 -07:00

phone-control

refactor: consolidate duplicated plugin state and doctor migration plumbing onto SDK seams (#99850)

2026-07-04 01:51:03 -07:00

pixverse

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

policy

policy: repair automatic narrowing findings (#99690)

2026-07-05 08:11:38 -07:00

qa-channel

fix(build): restore package artifact declarations (#100249)

2026-07-05 02:22:11 -07:00

qa-lab

fix(qa-lab): bound Telegram live transport JSON response reads (#99151)

2026-07-06 00:59:59 -07:00

qa-matrix

test(qa): record Matrix route state inventory (#100039)

2026-07-04 11:48:18 -07:00

qianfan

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

qqbot

test: speed up and stabilize full suite

2026-07-05 08:00:23 -04:00

qwen

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

raft

fix(release): use workspace host deps in release lockfile

2026-06-30 15:54:12 -07:00

runway

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

searxng

refactor(shared): consolidate provider and utility lazy loaders (#98749)

2026-07-02 21:16:26 -07:00

senseaudio

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

sglang

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

signal

fix(signal): bound receive websocket payloads (#99992)

2026-07-06 05:10:57 +01:00

slack

feat: add channel pairing request hook (#97733)

2026-07-05 19:11:58 -07:00

sms

feat: add channel pairing request hook (#97733)

2026-07-05 19:11:58 -07:00

stepfun

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

synology-chat

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

synthetic

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

talk-voice

fix(voice): require admin for voice set (#97874)

2026-06-29 15:41:26 -07:00

tavily

chore: update dependencies (#100027)

2026-07-04 14:56:50 -04:00

telegram

fix(telegram): add missing "edit" retry context for editMessageTelegram (#100543)

2026-07-06 00:46:37 -07:00

tencent

feat(tencent): add Tencent Hy3 provider (TokenHub and TokenPlan) (#99076)

2026-07-06 04:29:48 +00:00

test-support

Bound successful provider response reads

2026-06-24 19:08:22 -05:00

thread-ownership

…

tlon

fix(tlon): bound external image upload reads (#100374)

2026-07-06 04:44:33 +01:00

together

refactor: consolidate image data URL formatting (#99715)

2026-07-03 17:09:30 -07:00

tokenjuice

refactor(plugins): consolidate record guards (#99361)

2026-07-02 22:12:53 -07:00

tts-local-cli

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

twitch

chore: update dependencies (#100027)

2026-07-04 14:56:50 -04:00

venice

feat: show auto-detected provider plans and billing (#100520)

2026-07-06 04:53:09 +01:00

vercel-ai-gateway

test(vercel-ai-gateway): complete guarded fetch fixtures

2026-07-01 19:49:38 -07:00

video-generation-core

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

vllm

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

voice-call

fix(voice-call): deliver early TTS via onEarlyText before compaction wait (#94015)

2026-07-06 02:34:22 +01:00

volcengine

refactor(providers): table-drive paired catalogs (#99777)

2026-07-04 11:35:55 -07:00

voyage

fix(voyage): close response body stream when batch output JSONL parsing throws (#98840)

2026-07-06 06:32:50 +00:00

vydra

chore(release): close out 2026.6.11 on main

2026-06-30 11:31:08 -07:00

web-readability

improve(web-fetch): speed up provider fallback loading (#98559)

2026-07-04 12:47:10 -07:00

webhooks

refactor(security): consolidate secret primitives (#99746)

2026-07-04 16:38:13 -07:00

whatsapp

feat: add channel pairing request hook (#97733)

2026-07-05 19:11:58 -07:00

workboard

feat(agents): add managed git worktree lifecycle (create/provision/snapshot/restore/GC) (#100535)

2026-07-06 05:24:58 +01:00

xai

refactor: extract reusable AI runtime package (#99059)

2026-07-05 01:56:40 -04:00

xiaomi

feat: show auto-detected provider plans and billing (#100520)

2026-07-06 04:53:09 +01:00

zai

feat: show auto-detected provider plans and billing (#100520)

2026-07-06 04:53:09 +01:00

zalo

improve: keep isolated tests under one second (#100019)

2026-07-05 10:57:19 -07:00

zalouser

refactor(plugin-sdk): consolidate tool result helpers (#99740)

2026-07-04 16:50:44 -07:00

.npmignore

…

AGENTS.md

…

CLAUDE.md

…

music-generation-providers.live.test.ts

…

tsconfig.package-boundary.base.json

…

tsconfig.package-boundary.paths.json

refactor: extract reusable AI runtime package (#99059)

2026-07-05 01:56:40 -04:00

video-generation-providers.live.test.ts

…