Bound model catalog response reads

[ooiuuii]

Summary

• add a shared 16 MiB bounded reader for live model-catalog JSON responses in hermes_cli/models.py
• route OpenRouter/Nous recommendation and pricing fetches, Anthropic/Copilot/custom /models probes, and LM Studio model discovery through the bounded reader
• keep oversized or malformed catalog responses on the existing fallback/cache paths

Fixes #54838

Validation

• uv run --extra dev python -m pytest tests\hermes_cli\test_models.py tests\hermes_cli\test_model_validation.py tests\hermes_cli\test_api_key_providers.py -q --basetemp .pytest-tmp-models-response-cap (332 passed)
• git diff --check
• autoreview helper unavailable locally (autoreview, agent-autoreview, and codex-autoreview not found)

[tonydwb]

LGTM — Bounds model catalog response reads to 16MB. Adds two helper functions (_read_model_catalog_json, _read_model_catalog_text) that replace raw resp.read() calls across 10 call sites in models.py. Tests update mock read() to accept size parameter and verify bounded reads. The oversized-response fallback to static snapshot is well-tested.

[egilewski]

looks mergeable

Security evidence:

• trust boundary: remote/provider-controlled model catalog and pricing responses entering CLI model discovery and validation.
• source/sink/invariant: the live catalog and pricing response reads in hermes_cli/models.py now go through bounded helpers, with JSON reads requesting cap + 1 bytes and falling back when an oversized body is detected.
• current-main reproduction: a run-root probe imported the current-main hermes_cli/models.py and reproduced the existing OpenRouter catalog path calling the response with read(-1).
• PR-head or patch-replay validation: the same probe imported the run-owned patch replay, lowered the catalog cap to 8 bytes, and confirmed the live OpenRouter catalog path called read(9) and fell back to the curated list on oversized data.
• positive/negative cases: the new bounded-read and oversized-fallback tests cover the changed OpenRouter path, and the adjacent model catalog, validation, and API-key provider tests passed.
• residual bypass search: the replayed hermes_cli/models.py has no remaining direct response .read() calls outside the two bounded helpers, and the changed live catalog call sites route through those helpers.
• reviewer validation: CodeRabbit completed with no findings in the clean-pass flow.

I reviewed the meaningful PR patch replayed onto current GitHub main because the submitted branch has a stale/conflict setup advisory; that replay applied cleanly and validated, but the local replay by itself does not prove the submitted branch will keep merging cleanly if main moves again.

Signed: GPT-5.5-xhigh in Codex

[teknium1]

Thanks for the focused hardening work. The underlying issue remains on current main: hermes_cli/models.py:1410 still calls resp.read() before decoding the live OpenRouter catalog.

Problems

• The OpenRouter picker also calls get_curated_openrouter_models() first (hermes_cli/models.py:1397-1401), but its remote manifest fetch remains an unbounded resp.read() in hermes_cli/model_catalog.py:125-136. The shared bound should cover that catalog source too.
• Current main now uses _urlopen_model_catalog_request() (hermes_cli/models.py:33) after commit 6e75ba7fa. The PR diff patches raw urllib.request.urlopen calls and mocks that old seam, so the implementation and tests need to be ported to the current wrapper while preserving the redirect-security behavior.

Suggested changes

• Put the bounded JSON/text reader in a shared hermes_cli location and apply it to both models.py and model_catalog.py remote catalog reads.
• Retarget tests to _urlopen_model_catalog_request() and add an oversized-manifest fallback test for model_catalog.py.

Automated hermes-sweeper review.

[teknium1]

Please make this bounded reader available to hermes_cli/model_catalog.py too. fetch_openrouter_models() first fetches that remote curated manifest, and _fetch_manifest() still performs an unbounded resp.read() on current main.

[teknium1]

Current main reaches this response through _urlopen_model_catalog_request() (hermes_cli/models.py:33), not raw urllib.request.urlopen; port this mock to that wrapper seam when salvaging the test.