fix: the fetch function uses hyperquest in dist-indexer.js

[anupamme]

Summary

Fix high severity security issue in src/dist-indexer.js.

Vulnerability

Field	Value
ID	V-002
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-002
File	src/dist-indexer.js:125
Assessment	Likely exploitable

Description: The fetch function uses hyperquest.get() without timeout, size limits, or resource constraints. The bl library buffers entire responses in memory without size validation. Multiple fetch operations run in parallel without concurrency limits, making the application vulnerable to resource exhaustion attacks.

Evidence

Scanner confirmation: multi_agent_ai rule V-002 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• src/dist-indexer.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path, and the project's existing tests still pass, so intended behavior is unchanged.

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security