@jxsuite/server 4.5.0 → 4.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jxsuite/server",
-  "version": "4.5.0",
+  "version": "4.5.1",
   "description": "Jx development server with live reload, server-side proxy, and studio integration",
   "license": "MIT",
   "repository": {
@@ -44,9 +44,9 @@
     "@jxsuite/ai": "^0.39.3",
     "@jxsuite/catalog": "^0.1.0",
     "@jxsuite/collab": "^0.11.1",
-    "@jxsuite/compiler": "^5.1.2",
+    "@jxsuite/compiler": "^5.1.3",
     "@jxsuite/create": "^1.3.14",
-    "@jxsuite/import": "^0.40.9",
+    "@jxsuite/import": "^0.40.10",
     "@jxsuite/protocol": "^2.6.1",
     "@jxsuite/runtime": "^4.1.0",
     "@jxsuite/schema": "^3.0.0",
@@ -54,8 +54,8 @@
     "@jxsuite/starters": "^2.0.1",
     "chokidar": "^5.0.0",
     "kysely": "^0.29.6",
-    "oxfmt": "^0.72.0",
-    "zod": "^4.6.5"
+    "oxfmt": "^0.73.0",
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@jxsuite/auth": "^0.6.2",

package/src/ai-api.ts

@@ -39,6 +39,7 @@ import {
   AI_SESSION_HEADER,
   affinityKey,
   createChatHandler,
+  DEFAULT_UPSTREAM_BASE_URL,
   extractUpstreamErrorMessage,
   isAiSessionId,
   modelsResponse,
@@ -46,12 +47,11 @@ import {
 } from "@jxsuite/ai/gateway";
 import type { GatewayRefusal, Upstream } from "@jxsuite/ai/gateway";
 import { problemDetails } from "@jxsuite/protocol";
+import { errorMessage } from "@jxsuite/schema/parse";
 import { problemTypeForStatus } from "./problem.ts";
 
 // ─── Configuration ───────────────────────────────────────────────────────────
 
-const DEFAULT_BASE_URL = "https://api.openai.com/v1";
-
 /** The model a chat request that names none is forwarded with. */
 const DEFAULT_MODEL = "gpt-4o";
 
@@ -120,7 +120,7 @@ function getConfig(req: Request): AiConfig {
   }
 
   const baseFromHeader = Boolean(baseUrlHeader);
-  const baseUrl = baseUrlHeader || process.env.OPENAI_BASE_URL || DEFAULT_BASE_URL;
+  const baseUrl = baseUrlHeader || process.env.OPENAI_BASE_URL || DEFAULT_UPSTREAM_BASE_URL;
 
   if (isBlockedHost(baseUrl)) {
     return {
@@ -261,6 +261,10 @@ export async function handleModels(req: Request): Promise<Response> {
       });
     }
 
+    /* SAFETY: an OpenAI-compatible `/models` answers either the `{ object: "list", data }`
+       envelope or a bare array of model entries. Both arrays are confirmed with Array.isArray
+       below before use, and a body outside the contract (e.g. `null`) throws into the catch below,
+       which answers with the default models. */
     const data = (await upstreamResp.json()) as { data?: ModelEntry[] } | ModelEntry[];
     // OpenAI /models returns { object: "list", data: [{ id, ... }] }
     // Map to our simpler format.
@@ -285,7 +289,7 @@ export async function handleModels(req: Request): Promise<Response> {
       configured: true,
       managed: false,
       upstreamError: "network",
-      upstreamMessage: (error as Error).message,
+      upstreamMessage: errorMessage(error),
     });
   }
 }

package/src/build.ts

@@ -1,5 +1,6 @@
 /** Build.js — Configurable Bun.build pipeline */
 
+import { isFunction } from "@jxsuite/schema/guards";
 import type { BuildConfig } from "bun";
 
 /**
@@ -66,12 +67,11 @@ export async function rebuild(builds: BuildEntry[], changedFile: string) {
     if (!entry.match) {
       continue;
     }
-    const matches =
-      typeof entry.match === "function"
-        ? entry.match(changedFile)
-        : entry.match instanceof RegExp
-          ? entry.match.test(changedFile)
-          : false;
+    const matches = isFunction(entry.match)
+      ? entry.match(changedFile)
+      : entry.match instanceof RegExp
+        ? entry.match.test(changedFile)
+        : false;
     if (!matches) {
       continue;
     }

package/src/code-api.ts

@@ -7,20 +7,29 @@
 
 import { tmpdir } from "node:os";
 import { errorMessage } from "@jxsuite/schema/parse";
+import type { JsonValue } from "@jxsuite/schema/types";
 import { dirname, join } from "node:path";
 import { existsSync } from "node:fs";
 import { unlink } from "node:fs/promises";
 import { format } from "oxfmt";
 import { problem } from "./problem.ts";
 
+/** A label's source span; oxlint's other span members pass through to the client unchanged. */
+interface OxcSpan {
+  offset: number;
+  line: number;
+  [key: string]: JsonValue;
+}
+
 interface OxcLabel {
-  span: { offset: number; line: number; [key: string]: unknown };
-  [key: string]: unknown;
+  span: OxcSpan;
+  [key: string]: JsonValue;
 }
 
+/** One entry of `oxlint --format=json` output; members other than `labels` pass through. */
 interface OxcDiagnostic {
   labels?: OxcLabel[];
-  [key: string]: unknown;
+  [key: string]: JsonValue | undefined;
 }
 
 interface CodeApiBody {
@@ -87,19 +96,19 @@ function unwrapFormatted(formatted: string) {
  * @param {number} headerLen
  */
 function adjustDiagnostics(diagnostics: OxcDiagnostic[], headerLen: number) {
-  return diagnostics
-    .filter((d) => {
-      const line = d.labels?.[0]?.span?.line;
-      return line == null || line > 1;
-    })
-    .map((d) => {
-      // Diagnostics are freshly parsed and serialized right after; mutate in place
-      for (const label of d.labels ?? []) {
-        label.span.line -= 1;
-        label.span.offset -= headerLen;
-      }
-      return d;
-    });
+  return diagnostics.flatMap((d) => {
+    const line = d.labels?.[0]?.span.line;
+    // A diagnostic on line 1 points at the synthetic wrapper header, not the user's code
+    if (line != null && line <= 1) {
+      return [];
+    }
+    // Diagnostics are freshly parsed and serialized right after; mutate in place
+    for (const label of d.labels ?? []) {
+      label.span.line -= 1;
+      label.span.offset -= headerLen;
+    }
+    return [d];
+  });
 }
 
 // ─── Reusable transpiler ─────────────────────────────────────────────────────
@@ -120,6 +129,8 @@ export async function handleCodeApi(req: Request, url: URL) {
 
   let body: CodeApiBody;
   try {
+    /* SAFETY: the Studio function editor is this route's only client, and it posts `{ code, args }`
+       with a string body and string parameter names; malformed JSON is refused just below. */
     body = (await req.json()) as CodeApiBody;
   } catch {
     return problem("invalidRequest", "Invalid JSON");
@@ -196,6 +207,8 @@ export async function handleCodeApi(req: Request, url: URL) {
       const output = await new Response(proc.stdout).text();
       await proc.exited;
 
+      /* SAFETY: `oxlint --format=json` prints `{ diagnostics: [...] }` whose labels each carry a
+         numeric `span.line`/`span.offset`; output that is not JSON throws into the catch below. */
       const parsed = JSON.parse(output) as { diagnostics?: OxcDiagnostic[] };
       const adjusted = adjustDiagnostics(parsed.diagnostics ?? [], headerLen);
       return Response.json({ diagnostics: adjusted });

package/src/collab.ts

@@ -17,6 +17,7 @@ import { resolve } from "node:path";
 import { readFile, writeFile } from "node:fs/promises";
 import { colorForKey } from "@jxsuite/collab/awareness-types";
 import { createCollabHost } from "@jxsuite/collab/room";
+import { isString } from "@jxsuite/schema/guards";
 import {
   COLLAB_SUBPROTOCOL,
   offeredSubprotocols,
@@ -215,10 +216,13 @@ export function createCollabRegistry(opts: {
         if (answer.reject !== null) {
           return problem("invalidRequest", answer.reject);
         }
-        const upgraded = server.upgrade(req, {
-          data: { connection: null },
-          ...(answer.echo === null ? {} : { headers: { "Sec-WebSocket-Protocol": answer.echo } }),
-        });
+        const upgraded =
+          answer.echo === null
+            ? server.upgrade(req, { data: { connection: null } })
+            : server.upgrade(req, {
+                data: { connection: null },
+                headers: { "Sec-WebSocket-Protocol": answer.echo },
+              });
         return upgraded ? undefined : problem("invalidRequest", "Upgrade failed");
       }
       /*
@@ -254,7 +258,7 @@ export function createCollabRegistry(opts: {
         ws.data.connection = null;
       },
       message(ws: ServerWebSocket<CollabSocketData>, message: string | Buffer) {
-        if (typeof message === "string") {
+        if (isString(message)) {
           return;
         }
         ws.data.connection?.handleMessage(new Uint8Array(message));