fix: harden PowerContext memory contract

Author: kic635

console/src/locales/en.json

@@ -2368,7 +2368,7 @@
     "llmAcquireTimeoutGtPauseJitter": "Slot acquire timeout must be greater than rate limit pause + jitter",
     "contextManagementTitle": "Context Management",
     "memoryManagerBackend": "Long-term Memory Management Backend",
-    "memoryManagerBackendTooltip": "Backend for the memory manager. Choose remelight (local files), adbpg (cloud database), or none (disable memory).",
+    "memoryManagerBackendTooltip": "Backend for the memory manager. Choose remelight (local files), adbpg (cloud database), PowerContext (remote memory service), or none (disable memory).",
     "memoryManagerBackendRestartWarning": "Switching the long-term memory management backend does not support hot reload. Save and restart QwenPaw for changes to take effect.",
     "maxIters": "Max Iterations",
     "maxItersTooltip": "Maximum number of reasoning-acting iterations for ReAct agent",

console/src/locales/id.json

@@ -2364,7 +2364,7 @@
     "llmAcquireTimeoutGtPauseJitter": "Timeout perolehan slot harus lebih besar dari jeda batas kecepatan + jitter",
     "contextManagementTitle": "Manajemen Konteks",
     "memoryManagerBackend": "Backend Manajemen Memori Jangka Panjang",
-    "memoryManagerBackendTooltip": "Backend untuk manajer memori. Pilih remelight (file lokal) atau adbpg (database cloud).",
+    "memoryManagerBackendTooltip": "Backend untuk manajer memori. Pilih remelight (file lokal), adbpg (database cloud), PowerContext (layanan memori jarak jauh), atau none (nonaktifkan memori).",
     "memoryManagerBackendRestartWarning": "Mengalihkan backend manajemen memori jangka panjang tidak mendukung hot reload. Simpan dan restart QwenPaw agar perubahan berlaku.",
     "maxIters": "Iterasi Maksimum",
     "maxItersTooltip": "Jumlah maksimum iterasi penalaran-tindakan untuk agen ReAct",

console/src/locales/ja.json

@@ -1912,7 +1912,7 @@
     "llmAcquireTimeoutGtPauseJitter": "スロット取得タイムアウトはレート制限一時停止とジッターの合計より大きい必要があります",
     "contextManagementTitle": "コンテキスト管理",
     "memoryManagerBackend": "長期記憶管理バックエンド",
-    "memoryManagerBackendTooltip": "メモリマネージャーのバックエンドタイプ。remelight（ローカルファイル）または adbpg（クラウドデータベース）から選択できます。",
+    "memoryManagerBackendTooltip": "メモリマネージャーのバックエンドタイプ。remelight（ローカルファイル）、adbpg（クラウドデータベース）、PowerContext（リモートメモリサービス）、または none（メモリを無効化）から選択できます。",
     "memoryManagerBackendRestartWarning": "長期記憶管理バックエンドの切り替えはホットリロードに対応していません。変更を反映するには保存後に QwenPaw を再起動してください。",
     "maxIters": "最大反復回数",
     "maxItersTooltip": "ReActエージェントの推論・行動サイクルの最大反復回数",

console/src/locales/pt-BR.json

@@ -2150,7 +2150,7 @@
     "llmAcquireTimeoutGtPauseJitter": "Slot acquire timeout must be greater than rate limit pause + jitter",
     "contextManagementTitle": "Context Management",
     "memoryManagerBackend": "Backend de gerenciamento de memória de longo prazo",
-    "memoryManagerBackendTooltip": "Backend para o gerenciador de memória. Escolha remelight (arquivos locais) ou adbpg (banco de dados na nuvem).",
+    "memoryManagerBackendTooltip": "Backend para o gerenciador de memória. Escolha remelight (arquivos locais), adbpg (banco de dados na nuvem), PowerContext (serviço remoto de memória) ou none (desativar memória).",
     "memoryManagerBackendRestartWarning": "A troca do backend de gerenciamento de memória de longo prazo não permite recarregamento a quente. Salve e reinicie o QwenPaw para aplicar as alterações.",
     "maxIters": "Max Iterations",
     "maxItersTooltip": "Maximum number of reasoning-acting iterations for ReAct agent",

console/src/locales/ru.json

@@ -1927,7 +1927,7 @@
     "llmAcquireTimeoutGtPauseJitter": "Таймаут получения слота должен быть больше суммы паузы и джиттера",
     "contextManagementTitle": "Управление контекстом",
     "memoryManagerBackend": "Бэкенд управления долговременной памятью",
-    "memoryManagerBackendTooltip": "Тип бэкенда менеджера памяти. Выберите remelight (локальные файлы) или adbpg (облачная база данных).",
+    "memoryManagerBackendTooltip": "Тип бэкенда менеджера памяти. Выберите remelight (локальные файлы), adbpg (облачная база данных), PowerContext (удалённый сервис памяти) или none (отключить память).",
     "memoryManagerBackendRestartWarning": "Смена бэкенда управления долговременной памятью не поддерживает горячую перезагрузку. Сохраните и перезапустите QwenPaw для применения изменений.",
     "maxIters": "Макс. итераций",
     "maxItersTooltip": "Максимальное число итераций рассуждение-действие для агента ReAct",

console/src/locales/vi.json

@@ -1238,7 +1238,7 @@
     "llmAcquireTimeoutGtPauseJitter": "Timeout phải lớn hơn tổng thời gian tạm dừng và jitter",
     "contextManagementTitle": "Quản lý ngữ cảnh",
     "memoryManagerBackend": "Backend quản lý bộ nhớ dài hạn",
-    "memoryManagerBackendTooltip": "Chọn remelight (file cục bộ) hoặc adbpg (cơ sở dữ liệu đám mây).",
+    "memoryManagerBackendTooltip": "Chọn remelight (tệp cục bộ), adbpg (cơ sở dữ liệu đám mây), PowerContext (dịch vụ bộ nhớ từ xa), hoặc none (tắt bộ nhớ).",
     "memoryManagerBackendRestartWarning": "Đổi backend quản lý bộ nhớ dài hạn yêu cầu khởi động lại QwenPaw.",
     "powercontextMemoryTitle": "Bộ nhớ PowerContext",
     "powercontextConfig": {

console/src/locales/zh.json

@@ -2226,7 +2226,7 @@
     "llmAcquireTimeoutGtPauseJitter": "槽位获取超时必须大于限流暂停时长与抖动范围之和",
     "contextManagementTitle": "上下文管理",
     "memoryManagerBackend": "长期记忆管理后端",
-    "memoryManagerBackendTooltip": "记忆管理器的后端类型，可选 remelight（本地文件）、adbpg（云端数据库）或 none（关闭记忆）",
+    "memoryManagerBackendTooltip": "记忆管理器的后端类型，可选 remelight（本地文件）、adbpg（云端数据库）、PowerContext（远程记忆服务）或 none（关闭记忆）",
     "memoryManagerBackendRestartWarning": "切换长期记忆管理后端不支持热更新，保存后需要重启 QwenPaw 才能生效",
     "maxIters": "最大迭代次数",
     "maxItersTooltip": "ReAct 智能体的最大推理-行动迭代次数",

console/src/pages/Agent/Config/components/PowerContextConfigCard.tsx

@@ -74,10 +74,18 @@ export function PowerContextConfigCard() {
                     "max_results",
                   ]}
                   initialValue={3}
-                  rules={[{ required: true }, { type: "number", min: 1 }]}
+                  rules={[
+                    { required: true },
+                    { type: "number", min: 1, max: 50 },
+                  ]}
                   tooltip={t("agentConfig.autoMaxResultsTooltip")}
                 >
-                  <InputNumber style={{ width: "100%" }} min={1} step={1} />
+                  <InputNumber
+                    style={{ width: "100%" }}
+                    min={1}
+                    max={50}
+                    step={1}
+                  />
                 </Form.Item>
               </>
             ),

src/qwenpaw/agents/memory/powercontext_client.py

@@ -1,3 +1,4 @@
+# -*- coding: utf-8 -*-
 """Small async client for PowerContext's public memory HTTP contract."""
 
 from __future__ import annotations
@@ -7,6 +8,31 @@
 
 import httpx
 
+MAX_MEMORY_TEXT_BYTES = 8000
+MIN_SEARCH_RESULTS = 1
+MAX_SEARCH_RESULTS = 50
+
+
+def truncate_utf8_text(
+    text: str,
+    *,
+    max_bytes: int = MAX_MEMORY_TEXT_BYTES,
+) -> str:
+    """Bound text without splitting a UTF-8 code point.
+
+    PowerContext accepts at most 8192 normalized UTF-8 bytes.  Keep a small
+    margin so the client remains valid when the server normalizes whitespace.
+    """
+    encoded = text.encode("utf-8")
+    if len(encoded) <= max_bytes:
+        return text
+    return encoded[:max_bytes].decode("utf-8", errors="ignore")
+
+
+def bound_search_limit(limit: int) -> int:
+    """Clamp a caller-provided result count to the PowerContext contract."""
+    return min(MAX_SEARCH_RESULTS, max(MIN_SEARCH_RESULTS, limit))
+
 
 @dataclass(frozen=True)
 class PowerContextConfig:
@@ -25,14 +51,29 @@ class PowerContextHTTPError(RuntimeError):
     """
 
     def __init__(
-        self, *, operation: str, response: httpx.Response, token: str = ""
+        self,
+        *,
+        operation: str,
+        response: httpx.Response,
+        token: str = "",
     ) -> None:
         self.operation = operation
         self.status_code = response.status_code
         self.summary = _safe_error_summary(response, token=token)
         super().__init__(
             f"PowerContext {operation} failed with HTTP {self.status_code}: "
-            f"{self.summary}"
+            f"{self.summary}",
+        )
+
+
+class PowerContextProtocolError(RuntimeError):
+    """Safe error for a successful response that violates the API contract."""
+
+    def __init__(self, *, operation: str, summary: str) -> None:
+        self.operation = operation
+        self.summary = summary
+        super().__init__(
+            f"PowerContext {operation} returned invalid response: {summary}",
         )
 
 
@@ -70,7 +111,11 @@ def _safe_error_summary(response: httpx.Response, *, token: str = "") -> str:
                 )
     if isinstance(payload, str) and payload.strip():
         summary = payload.strip()
-        return summary.replace(token, "<redacted>")[:300] if token else summary[:300]
+        return (
+            summary.replace(token, "<redacted>")[:300]
+            if token
+            else summary[:300]
+        )
     return response.reason_phrase or "request failed"
 
 
@@ -87,39 +132,64 @@ def __init__(self, config: PowerContextConfig) -> None:
         )
 
     async def remember(
-        self, *, kind: str, text: str, scope_id: str | None = None
+        self,
+        *,
+        kind: str,
+        text: str,
+        scope_id: str | None = None,
     ) -> dict[str, Any]:
         response = await self._http.post(
             "/v1/memory/remember",
             json={
                 "scope_id": scope_id or self.config.scope_id,
                 "kind": kind,
-                "text": text,
+                "text": truncate_utf8_text(text),
             },
         )
         self._raise_for_status("memory remember", response)
         return response.json()
 
     async def search(
-        self, *, query: str, limit: int = 5, scope_id: str | None = None
+        self,
+        *,
+        query: str,
+        limit: int = 5,
+        scope_id: str | None = None,
     ) -> list[dict[str, Any]]:
         response = await self._http.post(
             "/v1/memory/search",
             json={
                 "scope_id": scope_id or self.config.scope_id,
                 "query": query,
-                "limit": limit,
+                "limit": bound_search_limit(limit),
             },
         )
         self._raise_for_status("memory search", response)
         payload = response.json()
-        return payload.get("hits", []) if isinstance(payload, dict) else []
+        if not isinstance(payload, dict):
+            raise PowerContextProtocolError(
+                operation="memory search",
+                summary="response body must be an object",
+            )
+        hits = payload.get("hits")
+        if not isinstance(hits, list):
+            raise PowerContextProtocolError(
+                operation="memory search",
+                summary="response does not contain a hits list",
+            )
+        return hits
 
     async def close(self) -> None:
         await self._http.aclose()
 
-    def _raise_for_status(self, operation: str, response: httpx.Response) -> None:
+    def _raise_for_status(
+        self,
+        operation: str,
+        response: httpx.Response,
+    ) -> None:
         if response.is_error:
             raise PowerContextHTTPError(
-                operation=operation, response=response, token=self.config.token
+                operation=operation,
+                response=response,
+                token=self.config.token,
             )