fix(ai-sdk): clamp search limit to 1-50 and add client timeout - #1583
Open
Sravanjangam wants to merge 1 commit into
Open
fix(ai-sdk): clamp search limit to 1-50 and add client timeout#1583Sravanjangam wants to merge 1 commit into
Sravanjangam wants to merge 1 commit into
Conversation
- search_memories limit is now an integer constrained to 1-50 in the JSON schema AND clamped at execute time (clampSearchLimit): negative, fractional, or huge model-supplied values previously flowed straight into the metered Search API with full documents included, flooding agent context and inflating cost. - Supermemory client now sets timeout: 30s / maxRetries: 2 so a hung connection can't stall an agent's tool loop indefinitely.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi supermemory team 👋 Thanks for building such a great product! While running a security & quality audit of the repo we hit this issue and put together a small, tested fix — details below.
Problem
In
packages/ai-sdk,search_memoriesexposed alimitparameter that was an unconstrained LLM-controlled number flowing into the metered Search API with full documents included — a runaway agent loop could issue arbitrarily large queries. The underlying client also had no timeout or retry bound, so hung requests stalled agent turns indefinitely.Part of #1578 (finding M8).
Solution
Constrain at both ends: the zod schema rejects out-of-range values up front, a runtime clamp defends against non-schema callers, and the HTTP client gets bounded timeouts/retries.
Changes
packages/ai-sdk/src/tools.ts→ schemalimit:integer().min(1).max(50);clampSearchLimit()applied at the call site; client constructed with 30s timeout /maxRetries: 2packages/ai-sdk/src/limit.test.ts(new) → 4 tests (schema bounds + clamp behavior)Verification
Fresh from the committed branch:
bunx vitest run src/limit.test.ts→ 4/4 pass;bunx tsc --noEmit→ exit 0 (package fully clean); Biome clean.Happy to iterate on any of this — feedback and reworks very welcome! 🙏
Environment
fix/ai-sdk-tool-bounds— all gates re-run fresh at commit287e8c24054e