fix: cap tunnel response size, recheck store epoch, and resolve review findings

The remote-control tunnel now destroys oversized local responses with a 502 instead of buffering without bound, and the early-frame bridge parameter is required. The search indexer bounds its pending wire record, counts skipped sessions in the pass outcome, and narrows the missing-file error properly. The minidb query store rechecks the store epoch after a successful operation so a concurrent rebuild cannot swallow the result. Panel copy drops the graduated experimental label, the slash-command table regains its fourth cell, and two CLI tests assert presence before shape.

Author: elkaix

apps/pythinker-code/src/cli/sub/web/remote-control.ts

@@ -58,7 +58,7 @@ export function formatRemoteControlOutput(options: RemoteControlOutputOptions):
   );
   return [
     '',
-    `  ${title('Pythinker Remote Control ready')}  ${muted(`${getVersion()} (experimental)`)}`,
+    `  ${title('Pythinker Remote Control ready')}  ${muted(getVersion())}`,
     `  ${muted('Use Pythinker Code on this machine from your phone or another computer.')}`,
     '',
     `  ${label('1.')} Scan the QR code, or open ${link(options.url)}`,
@@ -72,7 +72,7 @@ export function formatRemoteControlOutput(options: RemoteControlOutputOptions):
     `  ${label('QR code PNG: ')}${options.pngPath} ${muted('(open this if the QR above does not scan)')}`,
     `  ${label('Local UI: ')}${accent(localBase)}${dim(localFrag)} ${muted('(LAN: --host)')}`,
     '',
-    `  ${muted('Experimental —')} ${docs} ${muted('·')} ${feedback}`,
+    `  ${muted('Docs:')} ${docs} ${muted('·')} ${feedback}`,
     `  ${label('Logs: ')}${muted('off (--log-level info)')} ${muted('·')} ${label('Stop: ')}${muted('Ctrl+C')}`,
     '',
   ].join('\n');

apps/pythinker-code/test/cli/options.test.ts

@@ -5,7 +5,7 @@
  * Run: pnpm -C apps/pythinker-code exec vitest run test/cli/options.test.ts
  */
 
-import { describe, expect, it, vi } from 'vitest';
+import { describe, expect, it } from 'vitest';
 
 import { createProgram } from '#/cli/commands';
 import type { CLIOptions } from '#/cli/options';

apps/pythinker-code/test/cli/web/web.test.ts

@@ -546,6 +546,7 @@ describe('`pythinker web` opens the browser', () => {
     const remoteControlOption = makeProgram()
       .commands.find((command) => command.name() === 'web')!
       .options.find((option) => option.long === '--remote-control');
+    expect(remoteControlOption).toBeDefined();
     expect(remoteControlOption?.hidden).toBeFalsy();
   });
 });

docs/reference/slash-commands.md

@@ -16,7 +16,7 @@ Some commands are only available in the idle state. Executing these commands whi
 | `/logout` | — | Clear credentials for the currently selected account | No |
 | `/provider` | — | Open the interactive provider manager to view, add, and remove configured providers. See [Platforms & Models — `/provider` and provider management](../configuration/providers.md#provider-—-interactive-provider-management) | Yes |
 | `/model` | — | Switch the LLM model used in the current session | Yes |
-| `/secondary-model` | `/subagent-model` | Pick the default model for subagents (writes `[secondary_model] default_model`; see the [subagent model pool](../configuration/config-files.md#subagent-model-pool)). Yes |
+| `/secondary-model` | `/subagent-model` | Pick the default model for subagents (writes `[secondary_model] default_model`; see the [subagent model pool](../configuration/config-files.md#subagent-model-pool)) | Yes |
 | `/settings` | `/config` | Open the settings panel inside the TUI | Yes |
 | `/experiments` | `/experimental` | Open the experimental feature panel | Yes |
 | `/permission` | — | Select a permission mode | Yes |

packages/agent-core-v2/src/persistence/backends/minidb/miniDbQueryStore.ts

@@ -137,6 +137,9 @@ export class MiniDbQueryStore extends Disposable implements IQueryStore {
       const result = await op(db);
       if (kind === 'write') this.transientWriteFailures = 0;
       else this.transientReadFailures = 0;
+      if (expectedStoreEpoch !== undefined && expectedStoreEpoch !== this.storeEpochCounter) {
+        throw new QueryStoreRebuiltError();
+      }
       return result;
     } catch (error) {
       if (classifyStorageError(error) !== 'rebuild') {

packages/agent-gateway/src/search/indexCore.ts

@@ -60,6 +60,7 @@ function legacyFileMetaKey(filePath: string): string {
 
 const WIRE_READ_CHUNK_BYTES = 1 << 20;
 const WIRE_BATCH_OPS = 1_000;
+const MAX_WIRE_PENDING_BYTES = 4 * 1024 * 1024;
 const SYNC_ROUND_BYTE_BUDGET = 64 << 20;
 const SYNC_ROUND_TIME_BUDGET_MS = 30_000;
 const SYNC_FAILURE_ESCALATION_LIMIT = 5;
@@ -535,6 +536,7 @@ export class SearchIndexCore {
       if (result.failed) {
         const count = (this.sessionSyncFailures.get(summary.id) ?? 0) + 1;
         this.sessionSyncFailures.set(summary.id, count);
+        failures += 1;
         if (count >= SESSION_SYNC_FAILURE_SKIP_LIMIT) {
           this.sessionSyncFailures.delete(summary.id);
           this.sessionSyncSkips.set(summary.id, { at: Date.now(), updatedAt: summary.updatedAt });
@@ -543,7 +545,6 @@ export class SearchIndexCore {
             { sessionId: summary.id, error: result.error },
           );
         } else {
-          failures += 1;
           this.log.warn('global search: failed to index session', {
             sessionId: summary.id,
             error: result.error,
@@ -669,7 +670,7 @@ export class SearchIndexCore {
     try {
       handle = await open(file.path, 'r');
     } catch (error) {
-      if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+      if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
         return { truncated: false, failed: false };
       }
       return { truncated: false, failed: true, error: errorMessage(error) };
@@ -801,6 +802,7 @@ export class SearchIndexCore {
           pending.length > 0
             ? Buffer.concat([pending, slice.subarray(start)])
             : Buffer.from(slice.subarray(start));
+        if (pending.length > MAX_WIRE_PENDING_BYTES) break;
         if (finishing && completedRecord) break;
         if (ops.length >= WIRE_BATCH_OPS) {
           ops.push({ op: 'set', key: metaKey, value: fileMeta(byteCursor, turnState, stepState) });

packages/remote-control/src/remote-control.ts

@@ -53,6 +53,7 @@ export function resolveRelayKey(
 
 const MAX_HTTP_HEADER_BYTES = 64 * 1024;
 const MAX_HTTP_REQUEST_BYTES = 10 * 1024 * 1024;
+const MAX_HTTP_RESPONSE_BYTES = 64 * 1024 * 1024;
 const HTTP_REQUEST_TIMEOUT_MS = 30_000;
 const REGISTER_TIMEOUT_MS = 10_000;
 const MAX_RECONNECT_DELAY_MS = 30_000;
@@ -922,7 +923,17 @@ function requestLocalHttp(
       },
       (response) => {
         const chunks: Buffer[] = [];
-        response.on('data', (chunk: Buffer | string) => chunks.push(Buffer.from(chunk)));
+        let receivedBytes = 0;
+        response.on('data', (chunk: Buffer | string) => {
+          receivedBytes += chunk.length;
+          if (receivedBytes > MAX_HTTP_RESPONSE_BYTES) {
+            response.destroy(
+              new Error(`Remote Control response exceeds ${MAX_HTTP_RESPONSE_BYTES} bytes`),
+            );
+            return;
+          }
+          chunks.push(Buffer.from(chunk));
+        });
         response.once('error', reject);
         response.once('end', () => {
           void (async (): Promise<Buffer> => {
@@ -1018,7 +1029,7 @@ function bridgeSockets(
   left: WebSocket,
   right: WebSocket,
   onClose: () => void,
-  earlyLeftFrames?: [RawData, boolean][],
+  earlyLeftFrames: [RawData, boolean][],
 ): void {
   let closed = false;
   const closeBoth = (code = 1000, reason = Buffer.alloc(0)): void => {
@@ -1029,11 +1040,9 @@ function bridgeSockets(
     if (left.readyState === WebSocket.OPEN) left.close(safeCode, reason);
     if (right.readyState === WebSocket.OPEN) right.close(safeCode, reason);
   };
-  if (earlyLeftFrames !== undefined) {
-    left.removeAllListeners('message');
-    for (const [data, isBinary] of earlyLeftFrames) {
-      if (right.readyState === WebSocket.OPEN) right.send(data, { binary: isBinary });
-    }
+  left.removeAllListeners('message');
+  for (const [data, isBinary] of earlyLeftFrames) {
+    if (right.readyState === WebSocket.OPEN) right.send(data, { binary: isBinary });
   }
   left.on('message', (data, isBinary) => {
     if (right.readyState === WebSocket.OPEN) right.send(data, { binary: isBinary });