v2.1.1 - Security & Rate Limit Fixes

Summary

Fixes a security leak, removes dead code, and resolves Cloudflare Workers stalled HTTP response issues that caused rate limit exhaustion.

What Changed

Security & code quality (code-review-fixes)

• Fixed security leak: Removed generateAuthInstructions parameter that accepted baseUrl from env, replaced with config constant to prevent URL injection
• Removed dead code: Cleaned up unused variables and functions flagged by linter
• Lint fixes: Prefixed unused params with _, used const for non-reassigned variables

Rate limiting & stalled responses (fix/rate-limiting-stalled-responses)

• Fixed stalled HTTP responses: ResponseError now consumes the response body (await response.text()) before throwing, preventing Cloudflare Workers from holding unconsumed response bodies that cause deadlocks when the concurrent in-flight response limit is reached
• Always use in-memory filtering: Single-query searches now use the cached complete collection + in-memory filtering (same as mood-expanded queries), instead of paginating the entire collection via API. This eliminates unnecessary API calls for the most common search path.

Commits

• eff4182 Fix lint errors: prefix unused param, use const for non-reassigned variable
• ebba3bd New skills
• 6735bd4 Fix security leak, remove dead code, and move hardcoded URL to config
• 2867029 Fix stalled HTTP responses and always use in-memory filtering for searches