Repository navigation
fix(sse): guard non-string error.code in proxyFetch + harden model parsing (#2463) - #2923
Conversation
…rsing (#2463) NVIDIA NIM (and any provider) failed with `s.startsWith is not a function` (`errCode.startsWith is not a function` un-minified). Root cause: open-sse/utils/proxyFetch.ts guarded `error.code` only against `undefined` before calling `.startsWith("UND_ERR")`, but undici/system errors can carry a numeric code. The crash fired inside the catch block that should fall back to native fetch, so the dispatcher failure became fatal instead of recoverable. Fix the confirmed crash and harden the same class of bug elsewhere: - proxyFetch.ts: `typeof errCode === "string"` before `.startsWith` (the bug). - model.ts parseModel: widen the falsy guard to reject truthy non-strings so `cleanStr.endsWith("[1m]")` cannot crash (same class as #2359). - chatCore.ts: only string-strip the upstream model when it is a string (defense-in-depth; the API already guards `model` via Zod). - combo.ts: coerce-by-guard the upstream JSON `error.code`/`type` instead of an `as string` cast, so the resilience/fallback path can't crash on a numeric code. Tests (red->green): - proxyfetch-undici-retry: numeric error code must fall back, not crash. - parse-model-defensive: parseModel returns null result for object/number/array. Reproduced against the live NVIDIA endpoint with a real nvapi- key: validation returned the literal `errCode.startsWith is not a function` before the fix and a clean sanitized result after.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
There was a problem hiding this comment.
Code Review
This pull request introduces defensive type-checking guards across several files (chatCore.ts, combo.ts, model.ts, and proxyFetch.ts) to prevent runtime crashes when handling unexpected non-string inputs, such as numeric error codes or object-type model strings. It also adds corresponding unit tests to verify these fixes. The reviewer suggests converting numeric or non-string error codes and types to strings using String() instead of discarding them as undefined in combo.ts, ensuring that valuable debugging information is preserved.
| code: | ||
| typeof (rawError as Record<string, unknown>).code === "string" | ||
| ? ((rawError as Record<string, unknown>).code as string) | ||
| : undefined, | ||
| type: | ||
| typeof (rawError as Record<string, unknown>).type === "string" | ||
| ? ((rawError as Record<string, unknown>).type as string) | ||
| : undefined, |
There was a problem hiding this comment.
Ao receber um erro do upstream com um code ou type numérico (por exemplo, { "code": 40001 }), a verificação estrita de tipo typeof ... === "string" descarta o valor definindo-o como undefined. Isso resulta na perda de informações úteis que poderiam ser usadas para classificação de erros ou depuração. Em vez de descartar valores não-string, é mais resiliente e informativo convertê-los para string usando String() caso existam e não sejam nulos.
| code: | |
| typeof (rawError as Record<string, unknown>).code === "string" | |
| ? ((rawError as Record<string, unknown>).code as string) | |
| : undefined, | |
| type: | |
| typeof (rawError as Record<string, unknown>).type === "string" | |
| ? ((rawError as Record<string, unknown>).type as string) | |
| : undefined, | |
| code: | |
| (rawError as Record<string, unknown>).code !== undefined && (rawError as Record<string, unknown>).code !== null | |
| ? String((rawError as Record<string, unknown>).code) | |
| : undefined, | |
| type: | |
| (rawError as Record<string, unknown>).type !== undefined && (rawError as Record<string, unknown>).type !== null | |
| ? String((rawError as Record<string, unknown>).type) | |
| : undefined, |
| code: | ||
| typeof (rawError as Record<string, unknown>).code === "string" | ||
| ? ((rawError as Record<string, unknown>).code as string) | ||
| : undefined, | ||
| type: | ||
| typeof (rawError as Record<string, unknown>).type === "string" | ||
| ? ((rawError as Record<string, unknown>).type as string) | ||
| : undefined, |
There was a problem hiding this comment.
Ao receber um erro do upstream com um code ou type numérico (por exemplo, { "code": 40001 }), a verificação estrita de tipo typeof ... === "string" descarta o valor definindo-o como undefined. Isso resulta na perda de informações úteis que poderiam ser usadas para classificação de erros ou depuração. Em vez de descartar valores não-string, é mais resiliente e informativo convertê-los para string usando String() caso existam e não sejam nulos.
| code: | |
| typeof (rawError as Record<string, unknown>).code === "string" | |
| ? ((rawError as Record<string, unknown>).code as string) | |
| : undefined, | |
| type: | |
| typeof (rawError as Record<string, unknown>).type === "string" | |
| ? ((rawError as Record<string, unknown>).type as string) | |
| : undefined, | |
| code: | |
| (rawError as Record<string, unknown>).code !== undefined && (rawError as Record<string, unknown>).code !== null | |
| ? String((rawError as Record<string, unknown>).code) | |
| : undefined, | |
| type: | |
| (rawError as Record<string, unknown>).type !== undefined && (rawError as Record<string, unknown>).type !== null | |
| ? String((rawError as Record<string, unknown>).type) | |
| : undefined, |
Ad-hoc diagnostic used to root-cause the proxyFetch errCode crash. Reads the key from NVIDIA_API_KEY (never hardcoded). Runs: validateProviderApiKey, a direct upstream sanity POST, and type-crash probes against the TS source.
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Files Reviewed (6 files)
Reviewed by nemotron-3-super-120b-a12b-20230311:free · 398,954 tokens |
* feat(plugins): WordPress-style plugin system backend
* fix(plugins): address code review feedback
- Path traversal guard: validate entryPoint stays within plugin dir
- install() now handles direct plugin directories (not just parent dirs)
- Non-null assertion replaced with explicit null check
- require efficiency: allowedModules map moved outside function
- Source wrapper: add newlines to prevent trailing comment issues
- Config validation: validate values against configSchema on save
- Dynamic import comment: clarify Node.js caching behavior
Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
* fix(plugins): replace vm with child_process, add auth to all routes
Addresses all remaining code review feedback:
1. **Loader rewrite**: Replaced Node.js vm module with child_process.fork()
for proper process-level isolation. Complies with Rule 3 (no eval).
Each plugin runs in a separate Node.js process with IPC communication.
2. **Auth on all routes**: Added requireManagementAuth to all 6 plugin
API route files (list, install, scan, details, activate, deactivate, config).
3. **Env filtering**: Only safe env vars passed to plugin processes unless
"env" permission is granted.
Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
* fix(plugins): security + ESM fixes for loader and manager
loader.ts:
- Fix IPC: use process.send()/process.on("message") instead of worker_threads.parentPort
- Fix ESM: write host script as .mjs (not .js) to force ESM execution
- Add timeout: 10s default on callHook() with Promise.race
- Add SIGKILL escalation: SIGTERM first, then SIGKILL after 3s grace
- Fix env filtering: use allowlist (safeKeys) instead of passing all env vars
- Clear timeout on successful IPC response (no timer leak)
manager.ts:
- Fix path traversal: use fs.realpath() instead of startsWith()
- Fix imports: use registerHook/unregisterHooks from hooks.ts
- Register hooks individually via registerHook(event, name, handler)
hooks.ts:
- Copied from feat/plugin-custom-hooks (canonical registry)
* feat(discovery): add discovery tool stub service
Phase 1 scaffold for automated provider discovery:
- DiscoveryConfig, DiscoveryResult types
- probeEndpoint() for URL availability checking
- scanProvider() stub (Phase 2 will implement real scanning)
- getDiscoveryResults() stub
- Default config: disabled (opt-in)
* chore(plugins): slop cleanup — pino logger, remove redundant sorts
- index.ts: replace console.log/error with pino structured logging
- hooks.ts: remove redundant .sort() in emitHookBlocking/runOnResponse (already sorted on registration)
- manager.ts: add readFile import
* test(plugins): add scanner, loader, manager unit tests
- scanner: 9 tests (discovery, hidden dirs, validation, entry point, multiple)
- loader: 5 tests (type contracts, Plugin/PluginContext/PluginResult interfaces)
- manager: 6 tests (singleton, lifecycle methods, error on unknown)
- Total: 20 tests, all passing
* fix(settings): add missing home page pin keys to updateSettingsSchema
* feat(plugins): add i18n keys to all 42 locales
* fix(settings): add missing security keys to updateSettingsSchema and add tests
* fix(usage): analytics route reads combo_name/requested_model from call_logs only
The 3.8.6 variant of #2904 added SELECTs of combo_name/requested_model
against usage_history, but those columns only exist in call_logs (no
migration adds them to usage_history). This returned HTTP 500 on
/api/usage/analytics. Restore the working query shape from the 3.8.7
variant. Fixes 18 failing usage-analytics-route tests.
* fix(types,test): resolve noImplicitAny in progressiveAging + align semaphore test to #2903 gate pruning
- progressiveAging: type compression results so messages[0].content is
indexable (was TS7053 against {}); restores typecheck:noimplicit:core gate.
- services-branch-hardening: #2903 (perf-ram) prunes idle rate-limit gates
on zero; assert no-running/empty-queue without assuming the entry persists.
* fix(analytics): address merged review regressions
* fix(executor): normalize max effort for openai shape providers
* Make zero-latency combo optimizations opt-in
* Address zero-latency combo review feedback
* chore(release): sync v3.8.7 touchpoints + credit contributors
- llm.txt → 3.8.7 (Current version + Key Features header)
- CHANGELOG: add Dmitry Kuznetsov & Nikolay Alafuzov to 3.8.6 Hall of Contributors
- version already 3.8.7 across package.json/open-sse/electron/openapi (from #2909)
* fix(cleanup): restore usage history cutoff boundary
* docs(changelog): rank 3.8.6 contributors in a commits table with their PRs
* fix(dashboard): theme ReactFlow Controls +/- buttons for dark mode
* fix(settings): add missing home page pin keys to updateSettingsSchema
* fix(settings): add missing security keys to updateSettingsSchema and add tests
* fix(executor): normalize max effort for openai shape providers
* Make zero-latency combo optimizations opt-in
* Address zero-latency combo review feedback
* fix(analytics): address merged review regressions
* fix(cleanup): restore usage history cutoff boundary
* feat(plugins): WordPress-style plugin system backend
* fix(plugins): address code review feedback
- Path traversal guard: validate entryPoint stays within plugin dir
- install() now handles direct plugin directories (not just parent dirs)
- Non-null assertion replaced with explicit null check
- require efficiency: allowedModules map moved outside function
- Source wrapper: add newlines to prevent trailing comment issues
- Config validation: validate values against configSchema on save
- Dynamic import comment: clarify Node.js caching behavior
Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
* fix(plugins): replace vm with child_process, add auth to all routes
Addresses all remaining code review feedback:
1. **Loader rewrite**: Replaced Node.js vm module with child_process.fork()
for proper process-level isolation. Complies with Rule 3 (no eval).
Each plugin runs in a separate Node.js process with IPC communication.
2. **Auth on all routes**: Added requireManagementAuth to all 6 plugin
API route files (list, install, scan, details, activate, deactivate, config).
3. **Env filtering**: Only safe env vars passed to plugin processes unless
"env" permission is granted.
Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
* fix(plugins): security + ESM fixes for loader and manager
loader.ts:
- Fix IPC: use process.send()/process.on("message") instead of worker_threads.parentPort
- Fix ESM: write host script as .mjs (not .js) to force ESM execution
- Add timeout: 10s default on callHook() with Promise.race
- Add SIGKILL escalation: SIGTERM first, then SIGKILL after 3s grace
- Fix env filtering: use allowlist (safeKeys) instead of passing all env vars
- Clear timeout on successful IPC response (no timer leak)
manager.ts:
- Fix path traversal: use fs.realpath() instead of startsWith()
- Fix imports: use registerHook/unregisterHooks from hooks.ts
- Register hooks individually via registerHook(event, name, handler)
hooks.ts:
- Copied from feat/plugin-custom-hooks (canonical registry)
* feat(discovery): add discovery tool stub service
Phase 1 scaffold for automated provider discovery:
- DiscoveryConfig, DiscoveryResult types
- probeEndpoint() for URL availability checking
- scanProvider() stub (Phase 2 will implement real scanning)
- getDiscoveryResults() stub
- Default config: disabled (opt-in)
* chore(plugins): slop cleanup — pino logger, remove redundant sorts
- index.ts: replace console.log/error with pino structured logging
- hooks.ts: remove redundant .sort() in emitHookBlocking/runOnResponse (already sorted on registration)
- manager.ts: add readFile import
* test(plugins): add scanner, loader, manager unit tests
- scanner: 9 tests (discovery, hidden dirs, validation, entry point, multiple)
- loader: 5 tests (type contracts, Plugin/PluginContext/PluginResult interfaces)
- manager: 6 tests (singleton, lifecycle methods, error on unknown)
- Total: 20 tests, all passing
* feat(plugins): add i18n keys to all 42 locales
* chore(plugins): remove duplicate migration 059_create_plugins.sql
* chore(plugins): remove duplicate migration 059_create_plugins.sql (post-merge)
* fix(sse): guard non-string error.code in proxyFetch + harden model parsing (#2463) (#2923)
Integrated into release/v3.8.7
* fix(docker): add runner-web stage with Playwright Chromium (#2832) (#2846)
Integrated into release/v3.8.7
* docs(changelog): document NVIDIA NIM and error code type-crash fix (#2463)
* test: ignore NVIDIA_BASE_URL and NVIDIA_MODEL in env contract check
---------
Co-authored-by: oyi77 <oyi77@users.noreply.github.com>
Co-authored-by: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
Co-authored-by: Apostol Apostolov <theapoapostolov@gmail.com>
Co-authored-by: Halil Tezcan KARABULUT <info@hlltzcnkb.com>
Co-authored-by: R.D. <rogerproself@gmail.com>
* feat(plugins): WordPress-style plugin system backend
* fix(plugins): address code review feedback
- Path traversal guard: validate entryPoint stays within plugin dir
- install() now handles direct plugin directories (not just parent dirs)
- Non-null assertion replaced with explicit null check
- require efficiency: allowedModules map moved outside function
- Source wrapper: add newlines to prevent trailing comment issues
- Config validation: validate values against configSchema on save
- Dynamic import comment: clarify Node.js caching behavior
Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
* fix(plugins): replace vm with child_process, add auth to all routes
Addresses all remaining code review feedback:
1. **Loader rewrite**: Replaced Node.js vm module with child_process.fork()
for proper process-level isolation. Complies with Rule 3 (no eval).
Each plugin runs in a separate Node.js process with IPC communication.
2. **Auth on all routes**: Added requireManagementAuth to all 6 plugin
API route files (list, install, scan, details, activate, deactivate, config).
3. **Env filtering**: Only safe env vars passed to plugin processes unless
"env" permission is granted.
Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
* fix(plugins): security + ESM fixes for loader and manager
loader.ts:
- Fix IPC: use process.send()/process.on("message") instead of worker_threads.parentPort
- Fix ESM: write host script as .mjs (not .js) to force ESM execution
- Add timeout: 10s default on callHook() with Promise.race
- Add SIGKILL escalation: SIGTERM first, then SIGKILL after 3s grace
- Fix env filtering: use allowlist (safeKeys) instead of passing all env vars
- Clear timeout on successful IPC response (no timer leak)
manager.ts:
- Fix path traversal: use fs.realpath() instead of startsWith()
- Fix imports: use registerHook/unregisterHooks from hooks.ts
- Register hooks individually via registerHook(event, name, handler)
hooks.ts:
- Copied from feat/plugin-custom-hooks (canonical registry)
* feat(discovery): add discovery tool stub service
Phase 1 scaffold for automated provider discovery:
- DiscoveryConfig, DiscoveryResult types
- probeEndpoint() for URL availability checking
- scanProvider() stub (Phase 2 will implement real scanning)
- getDiscoveryResults() stub
- Default config: disabled (opt-in)
* chore(plugins): slop cleanup — pino logger, remove redundant sorts
- index.ts: replace console.log/error with pino structured logging
- hooks.ts: remove redundant .sort() in emitHookBlocking/runOnResponse (already sorted on registration)
- manager.ts: add readFile import
* test(plugins): add scanner, loader, manager unit tests
- scanner: 9 tests (discovery, hidden dirs, validation, entry point, multiple)
- loader: 5 tests (type contracts, Plugin/PluginContext/PluginResult interfaces)
- manager: 6 tests (singleton, lifecycle methods, error on unknown)
- Total: 20 tests, all passing
* fix(settings): add missing home page pin keys to updateSettingsSchema
* feat(plugins): add i18n keys to all 42 locales
* fix(settings): add missing security keys to updateSettingsSchema and add tests
* fix(usage): analytics route reads combo_name/requested_model from call_logs only
The 3.8.6 variant of cheaper-inference#2904 added SELECTs of combo_name/requested_model
against usage_history, but those columns only exist in call_logs (no
migration adds them to usage_history). This returned HTTP 500 on
/api/usage/analytics. Restore the working query shape from the 3.8.7
variant. Fixes 18 failing usage-analytics-route tests.
* fix(types,test): resolve noImplicitAny in progressiveAging + align semaphore test to cheaper-inference#2903 gate pruning
- progressiveAging: type compression results so messages[0].content is
indexable (was TS7053 against {}); restores typecheck:noimplicit:core gate.
- services-branch-hardening: cheaper-inference#2903 (perf-ram) prunes idle rate-limit gates
on zero; assert no-running/empty-queue without assuming the entry persists.
* fix(analytics): address merged review regressions
* fix(executor): normalize max effort for openai shape providers
* Make zero-latency combo optimizations opt-in
* Address zero-latency combo review feedback
* chore(release): sync v3.8.7 touchpoints + credit contributors
- llm.txt → 3.8.7 (Current version + Key Features header)
- CHANGELOG: add Dmitry Kuznetsov & Nikolay Alafuzov to 3.8.6 Hall of Contributors
- version already 3.8.7 across package.json/open-sse/electron/openapi (from cheaper-inference#2909)
* fix(cleanup): restore usage history cutoff boundary
* docs(changelog): rank 3.8.6 contributors in a commits table with their PRs
* fix(dashboard): theme ReactFlow Controls +/- buttons for dark mode
* fix(settings): add missing home page pin keys to updateSettingsSchema
* fix(settings): add missing security keys to updateSettingsSchema and add tests
* fix(executor): normalize max effort for openai shape providers
* Make zero-latency combo optimizations opt-in
* Address zero-latency combo review feedback
* fix(analytics): address merged review regressions
* fix(cleanup): restore usage history cutoff boundary
* feat(plugins): WordPress-style plugin system backend
* fix(plugins): address code review feedback
- Path traversal guard: validate entryPoint stays within plugin dir
- install() now handles direct plugin directories (not just parent dirs)
- Non-null assertion replaced with explicit null check
- require efficiency: allowedModules map moved outside function
- Source wrapper: add newlines to prevent trailing comment issues
- Config validation: validate values against configSchema on save
- Dynamic import comment: clarify Node.js caching behavior
Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
* fix(plugins): replace vm with child_process, add auth to all routes
Addresses all remaining code review feedback:
1. **Loader rewrite**: Replaced Node.js vm module with child_process.fork()
for proper process-level isolation. Complies with Rule 3 (no eval).
Each plugin runs in a separate Node.js process with IPC communication.
2. **Auth on all routes**: Added requireManagementAuth to all 6 plugin
API route files (list, install, scan, details, activate, deactivate, config).
3. **Env filtering**: Only safe env vars passed to plugin processes unless
"env" permission is granted.
Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
* fix(plugins): security + ESM fixes for loader and manager
loader.ts:
- Fix IPC: use process.send()/process.on("message") instead of worker_threads.parentPort
- Fix ESM: write host script as .mjs (not .js) to force ESM execution
- Add timeout: 10s default on callHook() with Promise.race
- Add SIGKILL escalation: SIGTERM first, then SIGKILL after 3s grace
- Fix env filtering: use allowlist (safeKeys) instead of passing all env vars
- Clear timeout on successful IPC response (no timer leak)
manager.ts:
- Fix path traversal: use fs.realpath() instead of startsWith()
- Fix imports: use registerHook/unregisterHooks from hooks.ts
- Register hooks individually via registerHook(event, name, handler)
hooks.ts:
- Copied from feat/plugin-custom-hooks (canonical registry)
* feat(discovery): add discovery tool stub service
Phase 1 scaffold for automated provider discovery:
- DiscoveryConfig, DiscoveryResult types
- probeEndpoint() for URL availability checking
- scanProvider() stub (Phase 2 will implement real scanning)
- getDiscoveryResults() stub
- Default config: disabled (opt-in)
* chore(plugins): slop cleanup — pino logger, remove redundant sorts
- index.ts: replace console.log/error with pino structured logging
- hooks.ts: remove redundant .sort() in emitHookBlocking/runOnResponse (already sorted on registration)
- manager.ts: add readFile import
* test(plugins): add scanner, loader, manager unit tests
- scanner: 9 tests (discovery, hidden dirs, validation, entry point, multiple)
- loader: 5 tests (type contracts, Plugin/PluginContext/PluginResult interfaces)
- manager: 6 tests (singleton, lifecycle methods, error on unknown)
- Total: 20 tests, all passing
* feat(plugins): add i18n keys to all 42 locales
* chore(plugins): remove duplicate migration 059_create_plugins.sql
* chore(plugins): remove duplicate migration 059_create_plugins.sql (post-merge)
* fix(sse): guard non-string error.code in proxyFetch + harden model parsing (cheaper-inference#2463) (cheaper-inference#2923)
Integrated into release/v3.8.7
* fix(docker): add runner-web stage with Playwright Chromium (cheaper-inference#2832) (cheaper-inference#2846)
Integrated into release/v3.8.7
* docs(changelog): document NVIDIA NIM and error code type-crash fix (cheaper-inference#2463)
* test: ignore NVIDIA_BASE_URL and NVIDIA_MODEL in env contract check
---------
Co-authored-by: oyi77 <oyi77@users.noreply.github.com>
Co-authored-by: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
Co-authored-by: Apostol Apostolov <theapoapostolov@gmail.com>
Co-authored-by: Halil Tezcan KARABULUT <info@hlltzcnkb.com>
Co-authored-by: R.D. <rogerproself@gmail.com>
* feat(plugins): WordPress-style plugin system backend
* fix(plugins): address code review feedback
- Path traversal guard: validate entryPoint stays within plugin dir
- install() now handles direct plugin directories (not just parent dirs)
- Non-null assertion replaced with explicit null check
- require efficiency: allowedModules map moved outside function
- Source wrapper: add newlines to prevent trailing comment issues
- Config validation: validate values against configSchema on save
- Dynamic import comment: clarify Node.js caching behavior
Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
* fix(plugins): replace vm with child_process, add auth to all routes
Addresses all remaining code review feedback:
1. **Loader rewrite**: Replaced Node.js vm module with child_process.fork()
for proper process-level isolation. Complies with Rule 3 (no eval).
Each plugin runs in a separate Node.js process with IPC communication.
2. **Auth on all routes**: Added requireManagementAuth to all 6 plugin
API route files (list, install, scan, details, activate, deactivate, config).
3. **Env filtering**: Only safe env vars passed to plugin processes unless
"env" permission is granted.
Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
* fix(plugins): security + ESM fixes for loader and manager
loader.ts:
- Fix IPC: use process.send()/process.on("message") instead of worker_threads.parentPort
- Fix ESM: write host script as .mjs (not .js) to force ESM execution
- Add timeout: 10s default on callHook() with Promise.race
- Add SIGKILL escalation: SIGTERM first, then SIGKILL after 3s grace
- Fix env filtering: use allowlist (safeKeys) instead of passing all env vars
- Clear timeout on successful IPC response (no timer leak)
manager.ts:
- Fix path traversal: use fs.realpath() instead of startsWith()
- Fix imports: use registerHook/unregisterHooks from hooks.ts
- Register hooks individually via registerHook(event, name, handler)
hooks.ts:
- Copied from feat/plugin-custom-hooks (canonical registry)
* feat(discovery): add discovery tool stub service
Phase 1 scaffold for automated provider discovery:
- DiscoveryConfig, DiscoveryResult types
- probeEndpoint() for URL availability checking
- scanProvider() stub (Phase 2 will implement real scanning)
- getDiscoveryResults() stub
- Default config: disabled (opt-in)
* chore(plugins): slop cleanup — pino logger, remove redundant sorts
- index.ts: replace console.log/error with pino structured logging
- hooks.ts: remove redundant .sort() in emitHookBlocking/runOnResponse (already sorted on registration)
- manager.ts: add readFile import
* test(plugins): add scanner, loader, manager unit tests
- scanner: 9 tests (discovery, hidden dirs, validation, entry point, multiple)
- loader: 5 tests (type contracts, Plugin/PluginContext/PluginResult interfaces)
- manager: 6 tests (singleton, lifecycle methods, error on unknown)
- Total: 20 tests, all passing
* fix(settings): add missing home page pin keys to updateSettingsSchema
* feat(plugins): add i18n keys to all 42 locales
* fix(settings): add missing security keys to updateSettingsSchema and add tests
* fix(usage): analytics route reads combo_name/requested_model from call_logs only
The 3.8.6 variant of cheaper-inference#2904 added SELECTs of combo_name/requested_model
against usage_history, but those columns only exist in call_logs (no
migration adds them to usage_history). This returned HTTP 500 on
/api/usage/analytics. Restore the working query shape from the 3.8.7
variant. Fixes 18 failing usage-analytics-route tests.
* fix(types,test): resolve noImplicitAny in progressiveAging + align semaphore test to cheaper-inference#2903 gate pruning
- progressiveAging: type compression results so messages[0].content is
indexable (was TS7053 against {}); restores typecheck:noimplicit:core gate.
- services-branch-hardening: cheaper-inference#2903 (perf-ram) prunes idle rate-limit gates
on zero; assert no-running/empty-queue without assuming the entry persists.
* fix(analytics): address merged review regressions
* fix(executor): normalize max effort for openai shape providers
* Make zero-latency combo optimizations opt-in
* Address zero-latency combo review feedback
* chore(release): sync v3.8.7 touchpoints + credit contributors
- llm.txt → 3.8.7 (Current version + Key Features header)
- CHANGELOG: add Dmitry Kuznetsov & Nikolay Alafuzov to 3.8.6 Hall of Contributors
- version already 3.8.7 across package.json/open-sse/electron/openapi (from cheaper-inference#2909)
* fix(cleanup): restore usage history cutoff boundary
* docs(changelog): rank 3.8.6 contributors in a commits table with their PRs
* fix(dashboard): theme ReactFlow Controls +/- buttons for dark mode
* fix(settings): add missing home page pin keys to updateSettingsSchema
* fix(settings): add missing security keys to updateSettingsSchema and add tests
* fix(executor): normalize max effort for openai shape providers
* Make zero-latency combo optimizations opt-in
* Address zero-latency combo review feedback
* fix(analytics): address merged review regressions
* fix(cleanup): restore usage history cutoff boundary
* feat(plugins): WordPress-style plugin system backend
* fix(plugins): address code review feedback
- Path traversal guard: validate entryPoint stays within plugin dir
- install() now handles direct plugin directories (not just parent dirs)
- Non-null assertion replaced with explicit null check
- require efficiency: allowedModules map moved outside function
- Source wrapper: add newlines to prevent trailing comment issues
- Config validation: validate values against configSchema on save
- Dynamic import comment: clarify Node.js caching behavior
Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
* fix(plugins): replace vm with child_process, add auth to all routes
Addresses all remaining code review feedback:
1. **Loader rewrite**: Replaced Node.js vm module with child_process.fork()
for proper process-level isolation. Complies with Rule 3 (no eval).
Each plugin runs in a separate Node.js process with IPC communication.
2. **Auth on all routes**: Added requireManagementAuth to all 6 plugin
API route files (list, install, scan, details, activate, deactivate, config).
3. **Env filtering**: Only safe env vars passed to plugin processes unless
"env" permission is granted.
Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
* fix(plugins): security + ESM fixes for loader and manager
loader.ts:
- Fix IPC: use process.send()/process.on("message") instead of worker_threads.parentPort
- Fix ESM: write host script as .mjs (not .js) to force ESM execution
- Add timeout: 10s default on callHook() with Promise.race
- Add SIGKILL escalation: SIGTERM first, then SIGKILL after 3s grace
- Fix env filtering: use allowlist (safeKeys) instead of passing all env vars
- Clear timeout on successful IPC response (no timer leak)
manager.ts:
- Fix path traversal: use fs.realpath() instead of startsWith()
- Fix imports: use registerHook/unregisterHooks from hooks.ts
- Register hooks individually via registerHook(event, name, handler)
hooks.ts:
- Copied from feat/plugin-custom-hooks (canonical registry)
* feat(discovery): add discovery tool stub service
Phase 1 scaffold for automated provider discovery:
- DiscoveryConfig, DiscoveryResult types
- probeEndpoint() for URL availability checking
- scanProvider() stub (Phase 2 will implement real scanning)
- getDiscoveryResults() stub
- Default config: disabled (opt-in)
* chore(plugins): slop cleanup — pino logger, remove redundant sorts
- index.ts: replace console.log/error with pino structured logging
- hooks.ts: remove redundant .sort() in emitHookBlocking/runOnResponse (already sorted on registration)
- manager.ts: add readFile import
* test(plugins): add scanner, loader, manager unit tests
- scanner: 9 tests (discovery, hidden dirs, validation, entry point, multiple)
- loader: 5 tests (type contracts, Plugin/PluginContext/PluginResult interfaces)
- manager: 6 tests (singleton, lifecycle methods, error on unknown)
- Total: 20 tests, all passing
* feat(plugins): add i18n keys to all 42 locales
* chore(plugins): remove duplicate migration 059_create_plugins.sql
* chore(plugins): remove duplicate migration 059_create_plugins.sql (post-merge)
* fix(sse): guard non-string error.code in proxyFetch + harden model parsing (cheaper-inference#2463) (cheaper-inference#2923)
Integrated into release/v3.8.7
* fix(docker): add runner-web stage with Playwright Chromium (cheaper-inference#2832) (cheaper-inference#2846)
Integrated into release/v3.8.7
* docs(changelog): document NVIDIA NIM and error code type-crash fix (cheaper-inference#2463)
* test: ignore NVIDIA_BASE_URL and NVIDIA_MODEL in env contract check
---------
Co-authored-by: oyi77 <oyi77@users.noreply.github.com>
Co-authored-by: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
Co-authored-by: Apostol Apostolov <theapoapostolov@gmail.com>
Co-authored-by: Halil Tezcan KARABULUT <info@hlltzcnkb.com>
Co-authored-by: R.D. <rogerproself@gmail.com>
…rsing (cheaper-inference#2463) (cheaper-inference#2923) Integrated into release/v3.8.7
* feat(plugins): WordPress-style plugin system backend
* fix(plugins): address code review feedback
- Path traversal guard: validate entryPoint stays within plugin dir
- install() now handles direct plugin directories (not just parent dirs)
- Non-null assertion replaced with explicit null check
- require efficiency: allowedModules map moved outside function
- Source wrapper: add newlines to prevent trailing comment issues
- Config validation: validate values against configSchema on save
- Dynamic import comment: clarify Node.js caching behavior
Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
* fix(plugins): replace vm with child_process, add auth to all routes
Addresses all remaining code review feedback:
1. **Loader rewrite**: Replaced Node.js vm module with child_process.fork()
for proper process-level isolation. Complies with Rule 3 (no eval).
Each plugin runs in a separate Node.js process with IPC communication.
2. **Auth on all routes**: Added requireManagementAuth to all 6 plugin
API route files (list, install, scan, details, activate, deactivate, config).
3. **Env filtering**: Only safe env vars passed to plugin processes unless
"env" permission is granted.
Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
* fix(plugins): security + ESM fixes for loader and manager
loader.ts:
- Fix IPC: use process.send()/process.on("message") instead of worker_threads.parentPort
- Fix ESM: write host script as .mjs (not .js) to force ESM execution
- Add timeout: 10s default on callHook() with Promise.race
- Add SIGKILL escalation: SIGTERM first, then SIGKILL after 3s grace
- Fix env filtering: use allowlist (safeKeys) instead of passing all env vars
- Clear timeout on successful IPC response (no timer leak)
manager.ts:
- Fix path traversal: use fs.realpath() instead of startsWith()
- Fix imports: use registerHook/unregisterHooks from hooks.ts
- Register hooks individually via registerHook(event, name, handler)
hooks.ts:
- Copied from feat/plugin-custom-hooks (canonical registry)
* feat(discovery): add discovery tool stub service
Phase 1 scaffold for automated provider discovery:
- DiscoveryConfig, DiscoveryResult types
- probeEndpoint() for URL availability checking
- scanProvider() stub (Phase 2 will implement real scanning)
- getDiscoveryResults() stub
- Default config: disabled (opt-in)
* chore(plugins): slop cleanup — pino logger, remove redundant sorts
- index.ts: replace console.log/error with pino structured logging
- hooks.ts: remove redundant .sort() in emitHookBlocking/runOnResponse (already sorted on registration)
- manager.ts: add readFile import
* test(plugins): add scanner, loader, manager unit tests
- scanner: 9 tests (discovery, hidden dirs, validation, entry point, multiple)
- loader: 5 tests (type contracts, Plugin/PluginContext/PluginResult interfaces)
- manager: 6 tests (singleton, lifecycle methods, error on unknown)
- Total: 20 tests, all passing
* fix(settings): add missing home page pin keys to updateSettingsSchema
* feat(plugins): add i18n keys to all 42 locales
* fix(settings): add missing security keys to updateSettingsSchema and add tests
* fix(usage): analytics route reads combo_name/requested_model from call_logs only
The 3.8.6 variant of cheaper-inference#2904 added SELECTs of combo_name/requested_model
against usage_history, but those columns only exist in call_logs (no
migration adds them to usage_history). This returned HTTP 500 on
/api/usage/analytics. Restore the working query shape from the 3.8.7
variant. Fixes 18 failing usage-analytics-route tests.
* fix(types,test): resolve noImplicitAny in progressiveAging + align semaphore test to cheaper-inference#2903 gate pruning
- progressiveAging: type compression results so messages[0].content is
indexable (was TS7053 against {}); restores typecheck:noimplicit:core gate.
- services-branch-hardening: cheaper-inference#2903 (perf-ram) prunes idle rate-limit gates
on zero; assert no-running/empty-queue without assuming the entry persists.
* fix(analytics): address merged review regressions
* fix(executor): normalize max effort for openai shape providers
* Make zero-latency combo optimizations opt-in
* Address zero-latency combo review feedback
* chore(release): sync v3.8.7 touchpoints + credit contributors
- llm.txt → 3.8.7 (Current version + Key Features header)
- CHANGELOG: add Dmitry Kuznetsov & Nikolay Alafuzov to 3.8.6 Hall of Contributors
- version already 3.8.7 across package.json/open-sse/electron/openapi (from cheaper-inference#2909)
* fix(cleanup): restore usage history cutoff boundary
* docs(changelog): rank 3.8.6 contributors in a commits table with their PRs
* fix(dashboard): theme ReactFlow Controls +/- buttons for dark mode
* fix(settings): add missing home page pin keys to updateSettingsSchema
* fix(settings): add missing security keys to updateSettingsSchema and add tests
* fix(executor): normalize max effort for openai shape providers
* Make zero-latency combo optimizations opt-in
* Address zero-latency combo review feedback
* fix(analytics): address merged review regressions
* fix(cleanup): restore usage history cutoff boundary
* feat(plugins): WordPress-style plugin system backend
* fix(plugins): address code review feedback
- Path traversal guard: validate entryPoint stays within plugin dir
- install() now handles direct plugin directories (not just parent dirs)
- Non-null assertion replaced with explicit null check
- require efficiency: allowedModules map moved outside function
- Source wrapper: add newlines to prevent trailing comment issues
- Config validation: validate values against configSchema on save
- Dynamic import comment: clarify Node.js caching behavior
Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
* fix(plugins): replace vm with child_process, add auth to all routes
Addresses all remaining code review feedback:
1. **Loader rewrite**: Replaced Node.js vm module with child_process.fork()
for proper process-level isolation. Complies with Rule 3 (no eval).
Each plugin runs in a separate Node.js process with IPC communication.
2. **Auth on all routes**: Added requireManagementAuth to all 6 plugin
API route files (list, install, scan, details, activate, deactivate, config).
3. **Env filtering**: Only safe env vars passed to plugin processes unless
"env" permission is granted.
Co-Authored-By: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
* fix(plugins): security + ESM fixes for loader and manager
loader.ts:
- Fix IPC: use process.send()/process.on("message") instead of worker_threads.parentPort
- Fix ESM: write host script as .mjs (not .js) to force ESM execution
- Add timeout: 10s default on callHook() with Promise.race
- Add SIGKILL escalation: SIGTERM first, then SIGKILL after 3s grace
- Fix env filtering: use allowlist (safeKeys) instead of passing all env vars
- Clear timeout on successful IPC response (no timer leak)
manager.ts:
- Fix path traversal: use fs.realpath() instead of startsWith()
- Fix imports: use registerHook/unregisterHooks from hooks.ts
- Register hooks individually via registerHook(event, name, handler)
hooks.ts:
- Copied from feat/plugin-custom-hooks (canonical registry)
* feat(discovery): add discovery tool stub service
Phase 1 scaffold for automated provider discovery:
- DiscoveryConfig, DiscoveryResult types
- probeEndpoint() for URL availability checking
- scanProvider() stub (Phase 2 will implement real scanning)
- getDiscoveryResults() stub
- Default config: disabled (opt-in)
* chore(plugins): slop cleanup — pino logger, remove redundant sorts
- index.ts: replace console.log/error with pino structured logging
- hooks.ts: remove redundant .sort() in emitHookBlocking/runOnResponse (already sorted on registration)
- manager.ts: add readFile import
* test(plugins): add scanner, loader, manager unit tests
- scanner: 9 tests (discovery, hidden dirs, validation, entry point, multiple)
- loader: 5 tests (type contracts, Plugin/PluginContext/PluginResult interfaces)
- manager: 6 tests (singleton, lifecycle methods, error on unknown)
- Total: 20 tests, all passing
* feat(plugins): add i18n keys to all 42 locales
* chore(plugins): remove duplicate migration 059_create_plugins.sql
* chore(plugins): remove duplicate migration 059_create_plugins.sql (post-merge)
* fix(sse): guard non-string error.code in proxyFetch + harden model parsing (cheaper-inference#2463) (cheaper-inference#2923)
Integrated into release/v3.8.7
* fix(docker): add runner-web stage with Playwright Chromium (cheaper-inference#2832) (cheaper-inference#2846)
Integrated into release/v3.8.7
* docs(changelog): document NVIDIA NIM and error code type-crash fix (cheaper-inference#2463)
* test: ignore NVIDIA_BASE_URL and NVIDIA_MODEL in env contract check
---------
Co-authored-by: oyi77 <oyi77@users.noreply.github.com>
Co-authored-by: OpenClaude (mimo-v2.5-pro) <openclaude@gitlawb.com>
Co-authored-by: Apostol Apostolov <theapoapostolov@gmail.com>
Co-authored-by: Halil Tezcan KARABULUT <info@hlltzcnkb.com>
Co-authored-by: R.D. <rogerproself@gmail.com>
Problema (#2463)
NVIDIA NIM — e qualquer provedor — falhava com
s.startsWith is not a function("all the time" desde a 3.8.x). Rodando contra a fonte (stack não-minificado) com uma chavenvapi-real, o erro apareceu literalmente comoerrCode.startsWith is not a function.Root cause
open-sse/utils/proxyFetch.tsprotegiaerror.codeapenas contraundefinedantes de.startsWith("UND_ERR"):Mas erros do dispatcher undici / sistema podem ter
codenumérico (errno). Aí.startsWithlançaTypeError. Pior: o crash acontecia dentro docatchque deveria cair no fallback parafetchnativo — então uma falha recuperável do dispatcher virava fatal, e o NVIDIA quebrava sempre (ofetchnativo direto funciona, como comprovado isoladamente).Mudanças
open-sse/utils/proxyFetch.tstypeof errCode === "string"antes do.startsWith.open-sse/services/model.tsparseModelrejeita não-string truthy (objeto/número) — evitacleanStr.endsWithcrashar (mesma classe do #2359).open-sse/handlers/chatCore.tsmodelvia Zod).open-sse/services/combo.tserror.code/typedo JSON upstream em vez deas string— a lógica de resiliência não pode crashar com code numérico.Testes (red → green)
tests/unit/proxyfetch-undici-retry.test.ts— erro comcodenumérico deve cair no fallback nativo, não crashar (RED reproduziuproxyFetch.ts:320 — errCode.startsWith is not a function).tests/unit/parse-model-defensive.test.ts—parseModelretorna resultado nulo (sem throw) para objeto/número/array.Verificação
nvapi-válida: antes do fix a validação retornavaerrCode.startsWith is not a function; depois, resultado limpo e sanitizado.npm run typecheck:core✅ ·eslintnos arquivos tocados ✅ · 34/34 testes relacionados ✅ · pre-pushtest:unit✅Auditoria da classe de bug
Auditei
src/eopen-sse/por chamadas de método de string sobre valores guardados só contraundefined/falsy. O único crash ativo era oproxyFetch:320(camada de fetch compartilhada → afetava todos os provedores). As demais ocorrências eram latentes/não-alcançáveis pela API e foram endurecidas mesmo assim.