[pacocartones]

Summary

• POST /api/chaos/run and POST /api/skills/collect/chaos read the body with await request.json() inside the try whose catch answers 500, so a body that is not JSON came back as a 500. Both now answer 400 with { "error": { "message": "Invalid JSON body" } }, the error envelope these routes already use. A well-formed body behaves as before.
• This is the same guard fix(gamification): answer 400 for malformed JSON on the rotate, servers and federation score routes #16730 added to the gamification routes (fix(api): answer 400 for a non-integer limit, offset or page on the dashboard and management list routes #16661, fix(chat): answer 400 when the JSON body is not an object #16668 and fix(api): answer 400 for a JSON body that is not an object on the logs, settings and providers routes #16671 answer 400 for other malformed inputs).

Related Issues

• None found: no open or closed pull request or issue covers this (checked by touched path over the 296 open pull requests, with a positive control, and by keyword over merged and closed pull requests, 16 October).

Target Branch

• Base is the active release/v3.8.x branch (release/v3.8.52), not main
• Not a feature: a fix.

Validation

• Change type: other (chaos API routes)
• Focused test: the new file below fails on the base for the two non-JSON cases and passes with the change.
• The existing chaos tests pass with the change (chaos-api-routes, chaos-executor, chaos-config and the new file: 30 tests).
• prettier --check and eslint on the changed files are clean; check:ai-attribution and check:changelog-integrity pass.
• Full CI: runs on this PR.
• Production-code change includes a new automated test in this PR.

Tests Added Or Updated

• tests/unit/chaos-malformed-json-400.test.ts (new): a body that is not JSON sent to each route, with Chaos Mode enabled and, for the external route, an API key with chaosModeEnabled, must answer 400 with Invalid JSON body; a well-formed but invalid body must still answer 400 as before. On the base the two non-JSON cases fail with 500 !== 400; with the change they pass.

Coverage Notes

• The change is in src/; the new test calls the handlers directly, with the same setup as chaos-api-routes.test.ts. I did not run the routes under the Next.js server.
• On both routes the body is read after the auth check and after Chaos Mode is confirmed enabled (/api/chaos/run) or after the API key is verified (/api/skills/collect/chaos), so a caller that is not allowed still gets 401, 403 or the "not enabled" 400 first.

Reviewer Notes

• Changelog fragment: changelog.d/fixes/PENDING-chaos-json-400.md, one line, left for you to rename.