fix: Codex review — batch item size check, version-pinned npm install, truncated tag scan

- Validate each batch item text against MAX_INGEST_TEXT_BYTES (Codex P1)
- Pin npm binary download to package.json version tag, not /releases/latest (Codex P2)
- Add scanned/truncated fields to tag_list_taxonomy response (Codex P2)

Author: alvinttang

cortex-mcp-server/src/tools.rs

@@ -1017,6 +1017,14 @@ fn tool_memory_ingest_batch(cortex: &Arc<Cortex>, args: &Value) -> Result<String
         return Err(format!("batch too large: {} items (max {})", items_arr.len(), MAX_BATCH_SIZE));
     }
 
+    // Validate each item's text size (same guard as memory_ingest)
+    for (i, item) in items_arr.iter().enumerate() {
+        let text_len = item.get("text").and_then(|v| v.as_str()).map(|s| s.len()).unwrap_or(0);
+        if text_len > MAX_INGEST_TEXT_BYTES {
+            return Err(format!("item[{}] text too large: {} bytes (max {})", i, text_len, MAX_INGEST_TEXT_BYTES));
+        }
+    }
+
     let items: Vec<cortex_core::types::BatchIngestItem> = items_arr.iter().map(|item| {
         cortex_core::types::BatchIngestItem {
             text: item.get("text").and_then(|v| v.as_str()).unwrap_or("").to_string(),
@@ -1049,8 +1057,14 @@ fn tool_tag_list_taxonomy(cortex: &Arc<Cortex>) -> Result<String, String> {
         cortex_core::types::MemoryTier::Procedural,
     ];
 
+    let mut scanned_total: usize = 0;
+    let mut truncated = false;
     for tier in &tiers {
         if let Ok(mems) = cortex.storage().list_by_tier(*tier, MAX_TAG_SCAN_PER_TIER) {
+            if mems.len() >= MAX_TAG_SCAN_PER_TIER {
+                truncated = true;
+            }
+            scanned_total += mems.len();
             for mem in mems {
                 for tag in &mem.tags {
                     *tag_counts.entry(tag.clone()).or_insert(0) += 1;
@@ -1069,6 +1083,8 @@ fn tool_tag_list_taxonomy(cortex: &Arc<Cortex>) -> Result<String, String> {
     Ok(json!({
         "tags": items,
         "total_unique": items.len(),
+        "scanned": scanned_total,
+        "truncated": truncated,
     }).to_string())
 }
 

npm/bin/install.js

@@ -11,6 +11,7 @@ const REPO = "gambletan/cortex";
 const BINARY_NAME = "cortex-mcp-server";
 const BIN_DIR = path.join(__dirname);
 const BINARY_PATH = path.join(BIN_DIR, BINARY_NAME);
+const PKG_VERSION = require("../package.json").version;
 
 function getPlatformSuffix() {
   const platform = os.platform();
@@ -79,16 +80,19 @@ function httpsGet(url, redirectCount = 0) {
   });
 }
 
-async function fetchLatestRelease() {
-  const url = `https://api.github.com/repos/${REPO}/releases/latest`;
+async function fetchRelease() {
+  // Pin to the version in package.json for reproducible installs
+  const tag = `v${PKG_VERSION}`;
+  const url = `https://api.github.com/repos/${REPO}/releases/tags/${tag}`;
   const data = await httpsGet(url);
   try {
     return JSON.parse(data.toString());
   } catch {
     throw new Error(
-      `Failed to parse GitHub API response. ` +
-      `This may be due to rate limiting. Try again in a few minutes, or ` +
-      `download manually from: https://github.com/${REPO}/releases/latest`
+      `Failed to parse GitHub API response for v${PKG_VERSION}. ` +
+      `This may be due to rate limiting or a missing release tag. ` +
+      `Try again in a few minutes, or download manually from: ` +
+      `https://github.com/${REPO}/releases/tag/v${PKG_VERSION}`
     );
   }
 }
@@ -100,7 +104,7 @@ async function install() {
   console.log(`[cortex-memory] Detected platform: ${suffix}`);
   console.log(`[cortex-memory] Fetching latest release from ${REPO}...`);
 
-  const release = await fetchLatestRelease();
+  const release = await fetchRelease();
   const asset = release.assets.find((a) => a.name === assetName);
 
   if (!asset) {