Skip to content

fix(chat): reject non-object entries in messages with a clear 400 - #12644

Closed
soroush5 wants to merge 1 commit into
cheaper-inference:release/v3.8.51from
soroush5:fix/messages-entry-guard
Closed

soroush5 wants to merge 1 commit into
cheaper-inference:release/v3.8.51from
soroush5:fix/messages-entry-guard

Conversation

@soroush5

@soroush5 soroush5 commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

Summary

A messages array containing null (or any non-object entry) passed every entry guard and crashed translators with a raw TypeError, surfacing as HTTP 500. The fix extends the entry-guard family (#5110/#6402/#6407/#6412) with a 400 for non-object entries.

Related Issues

Fixes #12643

Validation

  • Focused tests: node --import tsx/esm --test tests/unit/chat-messages-entry-objects-12643.test.ts — 3 passed (2 fail without the fix, healthy passes both ways)
  • Neighbors: chat-messages-validation-6402 + chat-non-string-model-6407 — 22 passed
  • Lint clean on touched files (repo has one pre-existing dashboard error, untouched)
  • Base matches the active release (release/v3.8.51)

Tests Added Or Updated

  • tests/unit/chat-messages-entry-objects-12643.test.ts: null entry, string/number entries → 400 + no upstream call; well-formed → passes the guard
  • changelog.d/fixes/12643-messages-entry-guard.md: changelog fragment

Coverage Notes

Guard-only change: every new branch (null, non-object, array item) is hit by the new tests.

Reviewer Notes

Follows the exact pattern of the sibling guards in the same function. The route schema (z.array(z.unknown())) is intentionally left wide — rejection happens here with a clear message, same as #6402.

fenix007 pushed a commit to fenix007/OmniRoute that referenced this pull request Sep 4, 2026
Strip unsupported sampling parameters from native Codex Responses passthrough and reject malformed chat message entries before provider translation.

Ports upstream PRs cheaper-inference#12585 and cheaper-inference#12644 onto the frozen v3.8.48 base.

Co-Authored-By: OpenAI GPT-5 <noreply@openai.com>
@soroush5 soroush5 closed this Sep 12, 2026
diegosouzapw added a commit that referenced this pull request Sep 17, 2026
)

* fix(chat): reject null/non-object entries in messages[] (#12643)

A messages array containing null (or any non-object entry, e.g. [null] or
[42]) passed every existing entry guard in chat.ts (#5110/#6402/#6407/#6412)
and reached downstream translators/session helpers that read `.role` /
`.content` directly off each entry (openai-to-claude.ts, sessionManager.ts,
contextManager.ts's fixToolPairs), crashing with a raw TypeError and
surfacing as an HTTP 500 instead of a clean 400. The route's Zod schema is
intentionally wide (z.array(z.unknown())), so this shape check belongs in
the handler's guard chain. Adds one more entry-shape guard clause to the
same chokepoint, rejecting the request with a clear 400 before any routing
or upstream call.

Regression test: tests/unit/chat-messages-entry-objects-12643.test.ts

PR #12644 (@soroush5) proposed this exact fix but was closed without
merging on 2026-09-12; this re-implements it fresh against the current tip
using the same guard shape and error message.

Originally-proposed-by: @soroush5 in #12644
Co-authored-by: soroush5 <mrsoroushahmadi@gmail.com>

* chore(quality): refix the chat.ts ceiling for the merged tree

This branch rebaselined src/sse/handlers/chat.ts against an older tip. After
merging the current release tip the combined file is 2520 lines, so the 2500
ceiling no longer covers it.

The tip alone is already at 2509 — above the 2500 this PR had frozen — so most
of the gap is inherited, not introduced here. This PR's own contribution is the
+10 of the messages-entry guard itself. Ceiling refixed at the value the gate
reports for the merged tree.

---------

Co-authored-by: soroush5 <mrsoroushahmadi@gmail.com>
muhamadgalihsaputra pushed a commit to niyatna/NiyatnaRoute that referenced this pull request Sep 27, 2026
…rence#12643) (cheaper-inference#13755)

* fix(chat): reject null/non-object entries in messages[] (cheaper-inference#12643)

A messages array containing null (or any non-object entry, e.g. [null] or
[42]) passed every existing entry guard in chat.ts (cheaper-inference#5110/cheaper-inference#6402/cheaper-inference#6407/cheaper-inference#6412)
and reached downstream translators/session helpers that read `.role` /
`.content` directly off each entry (openai-to-claude.ts, sessionManager.ts,
contextManager.ts's fixToolPairs), crashing with a raw TypeError and
surfacing as an HTTP 500 instead of a clean 400. The route's Zod schema is
intentionally wide (z.array(z.unknown())), so this shape check belongs in
the handler's guard chain. Adds one more entry-shape guard clause to the
same chokepoint, rejecting the request with a clear 400 before any routing
or upstream call.

Regression test: tests/unit/chat-messages-entry-objects-12643.test.ts

PR cheaper-inference#12644 (@soroush5) proposed this exact fix but was closed without
merging on 2026-09-12; this re-implements it fresh against the current tip
using the same guard shape and error message.

Originally-proposed-by: @soroush5 in cheaper-inference#12644
Co-authored-by: soroush5 <mrsoroushahmadi@gmail.com>

* chore(quality): refix the chat.ts ceiling for the merged tree

This branch rebaselined src/sse/handlers/chat.ts against an older tip. After
merging the current release tip the combined file is 2520 lines, so the 2500
ceiling no longer covers it.

The tip alone is already at 2509 — above the 2500 this PR had frozen — so most
of the gap is inherited, not introduced here. This PR's own contribution is the
+10 of the messages-entry guard itself. Ceiling refixed at the value the gate
reports for the merged tree.

---------

Co-authored-by: soroush5 <mrsoroushahmadi@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(api): Null/non-object entries in messages[] pass guards and crash translators with HTTP 500

1 participant