Skip to content

fix: refuse unreadable custom models and unknown login URLs - #170

Merged
TheGreatAxios merged 2 commits into
cl-12110-check-untrusted-json-and-casts-in-the-interfacefrom
cl-12110-refuse-unknown-plugins-and-unreadable-models-plainly
Nov 4, 2026
Merged

fix: refuse unreadable custom models and unknown login URLs#170
TheGreatAxios merged 2 commits into
cl-12110-check-untrusted-json-and-casts-in-the-interfacefrom
cl-12110-refuse-unknown-plugins-and-unreadable-models-plainly

Conversation

@TheGreatAxios

@TheGreatAxios TheGreatAxios commented Nov 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Part of CL-12110: the two non-null assertions from the Findings document that can fail. Stacked on #169.

Changes

  • packages/client: subscription-login base URLs live in a Record<ModelLoginPlugin, string>, so startModelLogin and finishModelLogin read a base URL the type guarantees instead of DEFAULT_BASE_URLS[plugin]! and a possibly-undefined lookup. The general map spreads it, so other lookups are unchanged.
  • Custom providers: saving reads the models once, before any connection test, and, when the stored models don't parse, throws a readable error (wording in config.ts) that the form shows, instead of sending null to the hub.

Verification

  • bun run lint, format:check, typecheck, test, pins:verify and vendor:verify pass.
  • No new test: the login change is enforced by the type, and the save path is a hook with no existing render harness.

@linear-code

linear-code Bot commented Nov 4, 2026

Copy link
Copy Markdown

CL-12110

@TheGreatAxios TheGreatAxios changed the title fix(web): refuse unreadable custom models instead of sending null fix: refuse unreadable custom models and unknown login URLs Nov 4, 2026
@TheGreatAxios
TheGreatAxios force-pushed the cl-12110-refuse-unknown-plugins-and-unreadable-models-plainly branch from 4295582 to b44207c Compare November 4, 2026 21:38
@TheGreatAxios
TheGreatAxios marked this pull request as ready for review November 4, 2026 21:39
@corbits-triage

corbits-triage Bot commented Nov 4, 2026 •
edited
Loading

Copy link
Copy Markdown

Triage: Pass

No changes needed from you. A maintainer will review this pull request.

Stacked on #169: only this pull request's own changes were checked.

Notes:

  • Not confirmed: makes one focused change

corbits-triage[bot]
corbits-triage Bot reviewed Nov 4, 2026
View reviewed changes

@corbits-triage corbits-triage Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No defects reported.

@TheGreatAxios
TheGreatAxios force-pushed the cl-12110-check-untrusted-json-and-casts-in-the-interface branch from b5dede4 to 80edb8b Compare November 4, 2026 21:50
@TheGreatAxios
TheGreatAxios force-pushed the cl-12110-refuse-unknown-plugins-and-unreadable-models-plainly branch from b44207c to 79938b7 Compare November 4, 2026 21:51
corbits-triage[bot]
corbits-triage Bot reviewed Nov 4, 2026
View reviewed changes

@corbits-triage corbits-triage Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No defects reported.

@TheGreatAxios
TheGreatAxios merged commit 40483d7 into cl-12110-check-untrusted-json-and-casts-in-the-interface Nov 4, 2026
9 checks passed
TheGreatAxios added a commit that referenced this pull request Nov 4, 2026
@TheGreatAxios
fix: refuse unreadable custom models and unknown login URLs (#170)
0168c8e 
* fix(client): read login base URLs from a map keyed by login plugin

* fix(web): refuse unreadable custom models instead of sending null
TheGreatAxios added a commit that referenced this pull request Nov 4, 2026
@TheGreatAxios
fix(web): check untrusted JSON and hub values against their schemas (#…
69a62c5 
…169)

* fix(web): check untrusted JSON and hub values against their schemas

* fix(web): treat an unreadable session as an error, not a sign-out

* fix(web): read a frame's missing text without inventing one

* fix: refuse unreadable custom models and unknown login URLs (#170)

* fix(client): read login base URLs from a map keyed by login plugin

* fix(web): refuse unreadable custom models instead of sending null
TheGreatAxios added a commit that referenced this pull request Nov 4, 2026
@TheGreatAxios
fix(web): check untrusted JSON and hub values against their schemas
10cf13f 
* fix(web): check untrusted JSON and hub values against their schemas

* fix(web): treat an unreadable session as an error, not a sign-out

* fix(web): read a frame's missing text without inventing one

* fix: refuse unreadable custom models and unknown login URLs (#170)

* fix(client): read login base URLs from a map keyed by login plugin

* fix(web): refuse unreadable custom models instead of sending null
TheGreatAxios added a commit that referenced this pull request Nov 4, 2026
@TheGreatAxios
fix(web): check untrusted JSON and hub values against their schemas
c1de195 
* fix(web): check untrusted JSON and hub values against their schemas

* fix(web): treat an unreadable session as an error, not a sign-out

* fix(web): read a frame's missing text without inventing one

* fix: refuse unreadable custom models and unknown login URLs (#170)

* fix(client): read login base URLs from a map keyed by login plugin

* fix(web): refuse unreadable custom models instead of sending null
TheGreatAxios added a commit that referenced this pull request Nov 4, 2026
@TheGreatAxios
fix(web): surface swallowed errors and close the microphone on failure (
9ba3e91 
#167)

* fix(web): surface swallowed errors and close the microphone on failure

* fix(web): keep courtesy reads and damaged imports from failing loudly

* refactor(web): name the invitation load instead of an IIFE

* fix(web): toast every failed copy of a project's failure detail

* fix(web): read approval-package decks with the slidedeck schema (#168)

* fix(web): read approval-package decks with the slidedeck schema

* fix(web): load approval slides lazily and keep packages readable

* fix(web): show a line when the slides fail to load, not a crash

* fix(web): handle missing room data instead of inventing it (#171)

* fix(web): handle missing room data instead of inventing it

* fix(web): start room reads early and keep unread decisions unknown

* fix(web): name an approval without concepts instead of defaulting

* fix(web): ask about a blank-named document by its tool

* refactor(web): replace promise chains and IIFEs with named functions

* fix(web): rethrow failures other than unreadable JSON or cache

* refactor(web): replace promise chains and an IIFE with named functions

* refactor(web): poll a subscription login with a query observer

* fix(web): treat an unreadable refusal body as one without a code

* fix(web): never hold the first paint on a failed cache restore

* fix(web): keep a login poll running offline and out of the cache

* refactor(web): share one version read between view and compare

* fix(web): check untrusted JSON and hub values against their schemas

* fix(web): check untrusted JSON and hub values against their schemas

* fix(web): treat an unreadable session as an error, not a sign-out

* fix(web): read a frame's missing text without inventing one

* fix: refuse unreadable custom models and unknown login URLs (#170)

* fix(client): read login base URLs from a map keyed by login plugin

* fix(web): refuse unreadable custom models instead of sending null
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@corbits-triage corbits-triage[bot] corbits-triage[bot] approved these changes

Assignees

No one assigned

Labels

focused: check

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@TheGreatAxios