31 releases 31 tags

RSS feed

• v1.5.2 07842e911b

  Compare

  v1.5.2 Stable

  joeyr released this 2026-07-19 15:23:19 -05:00 | 11 commits to main since this release

  Code-review hardening — no new features, no behavior change for valid
  configurations.

  Fixed

  • Config validation now rejects malformed numeric env values. parseInt on
    e.g. CLAUDE_MAX_TOKENS=abc yields NaN, and every comparison against NaN
    is false, so the old <= 0 checks let it through and the mistake only
    surfaced as an API 400 at request time. Config.validate() now requires
    every numeric knob to be a finite number, and also covers
    MAX_CONTEXT_MESSAGES, MAX_CONTEXT_HOURS, and RATE_LIMIT_INTERVAL_MS,
    which previously weren't validated at all.
  • web_fetch no longer buffers unbounded response bodies. The tool read
    the entire body into memory before applying its character-level truncation,
    so a huge (or deliberately unbounded chunked) page could pull tens of MB into
    the process. Bodies are now streamed with a hard 1 MiB cap, and a
    Content-Length above the cap is rejected before reading at all.

  Changed

  • RATE_LIMIT_INTERVAL_MS now flows through the central config.
    RateLimiter read it straight from process.env, bypassing
    Config.validate() and getSummary(); it now comes from
    config.limits.rateLimitIntervalMs (tests inject the interval via the
    constructor instead of mutating the environment). The never-implemented
    RATE_LIMIT_PER_USER / RATE_LIMIT_WINDOW env vars are dropped from config
    and .env.config — enforcement has always been one command per
    RATE_LIMIT_INTERVAL_MS.
  • RateLimiter no longer starts its cleanup timer at module load. The
    expired-bypass cleanup interval was a side effect of importing the module; the
    bot host now starts it explicitly during startup (paired with the existing
    bot-quiesce stop), so importing the module has no timer side effect.
  • Docs: single-replica requirement made explicit. RATE_LIMITING.md and the
    DEPLOYMENT.md production checklist now state that in-memory rate limits are
    per-process, so the Swarm service must stay at replicas: 1.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads