[eldad-caura-ai]

Summary

Two Low findings in the client SDKs, from the security audit's review of the client changes merged since its last recheck. Both are in the clients' response handling, so they share one PR.

L-237: stats() skips the response checks every other method has. It was added in #2035, after #2013 and #2014 made a non-JSON 2xx body a CauraAPIError.

• Python: stats() reads response.json() directly. A captive-portal or proxy page with a 200 status escapes as a bare JSONDecodeError, although the README says catching CauraError covers HTTP failures. A JSON body that isn't an object raises AttributeError.
• TypeScript: stats() returns zero counters with a non-object raw for a body that isn't an object.

search() and recall() in both clients reject such bodies with "... response must be a JSON object".

L-238: retry_after can hold a value nobody can wait on.

• Python: float() accepts nan, inf, -5, and digit strings past float range (which become inf). A caller that sleeps on it fails: time.sleep() raises for NaN and negatives and overflows on infinity, and asyncio.sleep(inf) never returns.
• TypeScript: Number() reads -5 as -5 and a blank header as 0.

The collaboration client's own parser (caura_bus_core.retry.retry_after_seconds) already rejects negatives.

Fix

• Both clients: stats() rejects a body that is not a JSON object with "stats response must be a JSON object", the same check search() and recall() make.
• Python: stats() reads its body through _json(), the helper from fix(client-python): raise CauraAPIError for non-JSON 2xx bodies #2013, so a 2xx page that is not JSON raises CauraAPIError like every other call.
• Retry-After: retry_after is kept only when it is finite and non-negative; otherwise it is None/null. TypeScript also treats a blank header as absent. Valid delays and HTTP-dates (past dates still give 0) are unchanged.

Test plan

• Tests alone failed in CI (commit 944953f), all on the new cases:
  • Client (Python) CI, run 39404592562: 8 failed, 233 passed. The failures are stats in the non-JSON 2xx test (JSONDecodeError), the three non-object stats bodies (AttributeError), and retry_after for -5, nan, inf and a 400-digit value (-5.0, nan, inf, inf).
  • Client (TypeScript) CI, run 39404592529: 5 of 78 failed. They are the three non-object stats bodies (resolved instead of rejecting), and -5 and a blank header (-5 and 0 instead of null).
• Both pass with the fix

🤖 Generated with Claude Code

[github-actions]

Claude Code Review — skipped: draft PR

[github-actions]

🤖 Review by Claude Code

Claude Code Review ✅ No issues found.

---

Reviewed by claude-sonnet-5-5 · cost $0.12635775

[eldad-caura-ai]

@erni-a pleas rparprove

[eldad-caura-ai]

@erni-a please review