[pacocartones]

Summary

• A JSON body that is valid JSON but not an object (null, a string, a number or true) made handleChat throw (Cannot use 'in' operator to search for 'messages' in x, Cannot convert undefined or null to object) and the request ended as a 500. Two measurements, kept apart: calling the real route POST functions, /v1/chat/completions fails for a string, a number and true (3 values; null there was already a 400 Invalid JSON body), and /v1/messages and /v1/completions fail for all four values (8 combinations, 11 with the three from /v1/chat/completions); calling handleChat directly, as the test does, all 12 combinations (4 values on 3 paths) throw.
• Root cause: handleChat parses the body and goes on to "messages" in msgBody and Object.keys(body) without checking that it is an object. /v1/responses already answers the same input with a 400 Request body must be a JSON object; this adds the same guard, with the same message, right after the body is parsed in src/sse/handlers/chat.ts.
• Impact: a malformed request now gets an error response to that same request instead of a thrown TypeError; other clients and the process are unaffected either way. This is input validation, not a crash fix.

Related Issues

• Refs: none found. Searched open and closed pull requests for the changed function and file; the open pull requests that touch chat.ts (fix(sse): record unknown previous response rejections in the request journal #16193, feat(resilience): payload-aware anti-avalanche failover guard #15775, fix(auth): accept a valid x-api-key even when an unrelated Authorization bearer is present #16483, fix(routing): connection defaultModel only replaces a placeholder bare model #16550, feat(muse-code): consolidate open Muse Code PRs (#15234, #14138, #13634, #14267, #12687) #15521, [defer] feat(admission): cap concurrent SSE holds by estimated RSS #14430) do not validate the body.

Target Branch

• Base is the active release/v3.8.x branch (the highest open release/v*), not main

Proof Of Fix (required)

• TDD (preferred) — a test that fails before the fix and passes after it.
  • Test file(s): tests/unit/chat-non-object-body.test.ts
  • Failing output before the fix (through handleChat, 12 of 12 combinations): all fail with expected 400, got 500: Cannot use 'in' operator to search for 'messages' in null (the same error naming each value: in x, in 5, in true)

Tests Added Or Updated

• tests/unit/chat-non-object-body.test.ts: null, a string, a number and true, each posted to /v1/chat/completions, /v1/messages and /v1/completions through createChatPipelineHarness, assert a 400 with Request body must be a JSON object.

Coverage Notes

• Exercises handleChat (the shared handler of the three routes). The neighbouring chat-messages-entry-objects-12643 test keeps passing.

Scope

• Only the files the failing test proves need changing are touched (src/sse/handlers/chat.ts, the test and the changelog fragment)
• No test was weakened or deleted to make the suite pass

Validation

• Change type: other (chat request validation)
• Focused tests: the new test (12) and chat-messages-entry-objects-12643 pass; check:ai-attribution and check:changelog-integrity pass; eslint reports the same 8 existing problems in chat.ts as the base and none new.

Reviewer Notes

• An array body is not changed here: it already gets the existing messages: Expected array 400.