bunnyquery 1.3.2 → 1.3.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bunnyquery",
-  "version": "1.3.2",
+  "version": "1.3.4",
   "description": "Embeddable BunnyQuery AI chat widget + its framework-agnostic chat engine",
   "main": "bunnyquery.js",
   "exports": {

package/src/engine/errors.ts

@@ -34,6 +34,55 @@ export function isErrorResponseBody(response: any): boolean {
 	return false;
 }
 
+// A request that failed because the REQUEST ITSELF is malformed — an unknown or
+// rejected parameter on a 400/422 — will deterministically re-fail if resent
+// unchanged; no session refresh or retry can fix it. Detecting it lets the retry
+// gates refuse to auto-resend (otherwise a 400 whose param name merely contains
+// "token", e.g. `max_output_tokens`, trips the `invalid_request + token` branch
+// of isAuthExpiredError below and loops refresh->resend forever, burning tokens).
+// This is the `_skapi_extract` 400 class. Distinct from auth-expiry, which IS
+// retryable after a token refresh — so 401 (auth) and 429/5xx (transient) are
+// intentionally NOT treated as non-retryable here.
+export function isNonRetryableRequestError(input: any): boolean {
+	if (!input || typeof input !== 'object') return false;
+
+	var status = typeof input.status_code === 'number' ? input.status_code
+		: typeof input.status === 'number' ? input.status : undefined;
+
+	// Collect the error envelope wherever it lives (response, response.body, or a
+	// thrown error), mirroring isErrorResponseBody / isAuthExpiredError.
+	var param: any = undefined;
+	var blobs: string[] = [];
+	var sources = [input.error, input.body && input.body.error, input.body, input];
+	for (var i = 0; i < sources.length; i++) {
+		var e = sources[i];
+		if (!e) continue;
+		if (typeof e === 'string') { blobs.push(e); continue; }
+		if (typeof e !== 'object') continue;
+		if (param === undefined && e.param != null) param = e.param;
+		if (typeof e.code === 'string') blobs.push(e.code);
+		if (typeof e.type === 'string') blobs.push(e.type);
+		if (typeof e.message === 'string') blobs.push(e.message);
+	}
+	var hay = blobs.join(' | ').toLowerCase();
+
+	// Explicit "unknown / unsupported parameter" is always a malformed request.
+	if (hay.indexOf('unknown_parameter') !== -1 || hay.indexOf('unknown parameter') !== -1 ||
+		hay.indexOf('unsupported_parameter') !== -1 || hay.indexOf('unsupported parameter') !== -1) {
+		return true;
+	}
+
+	// A 400/422 invalid_request that points at a specific rejected field: resending
+	// the identical body re-fails. (401 -> isAuthExpiredError; 429/5xx -> transient.)
+	var isClientReqStatus = status === 400 || status === 422;
+	if (isClientReqStatus && param != null && param !== '') return true;
+	if (isClientReqStatus && hay.indexOf('invalid_request') !== -1 &&
+		(hay.indexOf('parameter') !== -1 || hay.indexOf('param') !== -1)) {
+		return true;
+	}
+	return false;
+}
+
 export function isAuthExpiredError(input: any): boolean {
 	if (!input) return false;
 	var blobs: string[] = [];

package/src/engine/index.ts

@@ -30,7 +30,7 @@ export * from './prompts';
 
 // Pure helpers (Tier-1.5): error detection, token budgeting, link/path
 // normalization, and history mapping — shared so both consumers stay identical.
-export { getErrorMessage, isErrorResponseBody, isAuthExpiredError } from './errors';
+export { getErrorMessage, isErrorResponseBody, isAuthExpiredError, isNonRetryableRequestError } from './errors';
 export * from './budget';
 export * from './links';
 export {

package/src/engine/session.ts

@@ -30,7 +30,7 @@ import {
 	OPENAI_RESPONSES_API_URL,
 	type BgTaskEntry,
 } from './requests';
-import { isErrorResponseBody, isAuthExpiredError, getErrorMessage } from './errors';
+import { isErrorResponseBody, isAuthExpiredError, isNonRetryableRequestError, getErrorMessage } from './errors';
 import { buildBoundedChatMessages } from './budget';
 import { createInlineLinkRegex } from './links';
 import { mapHistoryListToMessages, extractLastUserTextFromRequest } from './history';
@@ -116,11 +116,15 @@ export class ChatSession {
 		};
 		var run = sendAndPoll()
 			.catch(function (err: any) {
-				if (isAuthExpiredError(err)) return self.host.refreshSession().then(sendAndPoll);
+				// Only auth-expiry is worth a refresh+resend; a malformed-request 400
+				// (e.g. the `_skapi_extract`/unknown-parameter class) re-fails identically,
+				// so never loop on it — guard against isAuthExpiredError's heuristic
+				// misfiring on a param name that merely contains "token".
+				if (isAuthExpiredError(err) && !isNonRetryableRequestError(err)) return self.host.refreshSession().then(sendAndPoll);
 				throw err;
 			})
 			.then(function (response: any) {
-				if (isErrorResponseBody(response) && isAuthExpiredError(response)) {
+				if (isErrorResponseBody(response) && isAuthExpiredError(response) && !isNonRetryableRequestError(response)) {
 					return self.host.refreshSession().then(sendAndPoll);
 				}
 				return response;
@@ -656,7 +660,7 @@ export class ChatSession {
 		var fetchHistory = function () { return getChatHistory({ service: serviceId, owner: owner, platform: platform }, options); };
 
 		return Promise.resolve().then(fetchHistory).catch(function (err: any) {
-			if (isAuthExpiredError(err)) return self.host.refreshSession().then(fetchHistory);
+			if (isAuthExpiredError(err) && !isNonRetryableRequestError(err)) return self.host.refreshSession().then(fetchHistory);
 			throw err;
 		}).then(function (history: any) {
 			if (token !== self.state.gateRefreshToken) return;