fix(shared): validate all parsed HTTP status prefixes

steipete · steipete · commit ae83f94090c5 · 2026-07-18T02:32:00.000-07:00
diff --git a/src/shared/assistant-error-format.test.ts b/src/shared/assistant-error-format.test.ts
@@ -2,6 +2,8 @@ import { describe, expect, it } from "vitest";
 import {
   extractLeadingHttpStatus,
   extractProviderWrappedHttpStatus,
+  formatRawAssistantErrorForUi,
+  parseApiErrorInfo,
 } from "./assistant-error-format.js";
 
 describe("extractLeadingHttpStatus", () => {
@@ -55,3 +57,31 @@ describe("extractProviderWrappedHttpStatus", () => {
     expect(extractProviderWrappedHttpStatus("API error (600): something")).toBeNull();
   });
 });
+
+describe("HTTP status consumers", () => {
+  it("formats only status lines inside the HTTP range", () => {
+    expect(formatRawAssistantErrorForUi("100 Continue")).toBe("HTTP 100: Continue");
+    expect(formatRawAssistantErrorForUi("599 Provider Error")).toBe("HTTP 599: Provider Error");
+    expect(formatRawAssistantErrorForUi("000 Invalid")).toBe("000 Invalid");
+    expect(formatRawAssistantErrorForUi("600 Invalid")).toBe("600 Invalid");
+    expect(formatRawAssistantErrorForUi("999 Invalid")).toBe("999 Invalid");
+  });
+
+  it("does not attach invalid status prefixes to API payloads", () => {
+    const payload = '{"type":"error","error":{"type":"server_error","message":"Provider failed."}}';
+
+    expect(parseApiErrorInfo(`599 ${payload}`)).toMatchObject({
+      httpCode: "599",
+      type: "server_error",
+      message: "Provider failed.",
+    });
+    expect(formatRawAssistantErrorForUi(`599 ${payload}`)).toBe(
+      "HTTP 599 server_error: Provider failed.",
+    );
+
+    for (const code of ["000", "600", "999"]) {
+      expect(parseApiErrorInfo(`${code} ${payload}`)).toBeNull();
+      expect(formatRawAssistantErrorForUi(`${code} ${payload}`)).toBe(`${code} ${payload}`);
+    }
+  });
+});
diff --git a/src/shared/assistant-error-format.ts b/src/shared/assistant-error-format.ts
@@ -1,4 +1,3 @@
-import { expectDefined } from "@openclaw/normalization-core";
 // Assistant error formatting helpers normalize assistant-visible error payloads.
 import { truncateUtf16Safe } from "@openclaw/normalization-core/utf16-slice";
 const ERROR_PAYLOAD_PREFIX_RE =
@@ -107,7 +106,7 @@ function extractHttpStatusMatch(
     return null;
   }
   const code = Number(match[1]);
-  if (!Number.isFinite(code) || code < 100 || code > 599) {
+  if (!Number.isInteger(code) || code < 100 || code > 599) {
     return null;
   }
   return { code, rest: (match[2] ?? "").trim() };
@@ -174,10 +173,10 @@ export function parseApiErrorInfo(raw?: string): ApiErrorInfo | null {
   let httpCode: string | undefined;
   let candidate = trimmed;
 
-  const httpPrefixMatch = candidate.match(/^(\d{3})\s+(.+)$/s);
-  if (httpPrefixMatch) {
-    httpCode = httpPrefixMatch[1];
-    candidate = expectDefined(httpPrefixMatch[2], "http prefix match capture group 2").trim();
+  const httpPrefix = extractHttpStatusMatch(candidate.match(/^(\d{3})\s+(.+)$/s));
+  if (httpPrefix) {
+    httpCode = String(httpPrefix.code);
+    candidate = httpPrefix.rest;
   }
 
   const payload = parseApiErrorPayload(candidate);
@@ -249,11 +248,10 @@ export function formatRawAssistantErrorForUi(raw?: string): string {
     );
   }
 
-  const httpMatch = trimmed.match(HTTP_STATUS_PREFIX_RE);
+  const httpMatch = extractHttpStatusMatch(trimmed.match(HTTP_STATUS_PREFIX_RE));
   if (httpMatch) {
-    const rest = expectDefined(httpMatch[2], "http match capture group 2").trim();
-    if (!rest.startsWith("{")) {
-      return `HTTP ${httpMatch[1]}: ${rest}`;
+    if (!httpMatch.rest.startsWith("{")) {
+      return `HTTP ${httpMatch.code}: ${httpMatch.rest}`;
     }
   }
 
