converse-mcp-server 4.1.1 → 4.1.2

package/docs/API.md

@@ -422,6 +422,8 @@ Only jobs in a `queued` or `running` state can be cancelled; already-completed,
 
 Each provider call retries timeouts, 408, 429 and 5xx with backoff, honoring `Retry-After`. Auth failures, exhausted retries and malformed responses fall back to the next provider. A 400/422 request fault stops immediately, because every host would reject it the same way.
 
+TypeSafe's API sits behind a Cloudflare firewall that rejects some request bodies containing SQL-injection or shell-command patterns (for example `-- ; DROP TABLE`, or a quoted `'...; DROP TABLE ...;'`) with a 403 before the model sees them. This applies through OpenRouter too, since it forwards to the same edge. `decide` reports it as `Blocked by typesafe.ai's Cloudflare firewall before reaching the model (Ray ID …)` and stops without retrying or falling back. Treat a block as an unanswered question, not as a decision, and report the Ray ID to TypeSafe.
+
 ### Example Usage
 
 ```json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "converse-mcp-server",
-  "version": "4.1.1",
+  "version": "4.1.2",
   "description": "Converse MCP Server - Converse with other LLMs with chat and consensus tools",
   "type": "module",
   "main": "src/index.js",

package/src/decisionProviders/systemOne.js

@@ -84,6 +84,43 @@ export function extractErrorMessage(body, rawText) {
   return rawText?.trim() || 'No error details returned';
 }
 
+const MAX_ERROR_MESSAGE_LENGTH = 500;
+
+/**
+ * Summarize an HTML error page, which arrives raw from TypeSafe's edge and
+ * embedded in OpenRouter's JSON error message when it forwards one.
+ * Cloudflare's block page means the firewall rejected the request content
+ * before any model saw it: typically SQL-injection or shell-command patterns
+ * inside state or questions.
+ * @returns {{ message: string, firewall: boolean, rayId: string|null }|null}
+ *   null when the text is not an HTML page
+ */
+export function describeHtmlError(text) {
+  if (!/<!doctype html|<html[\s>]/i.test(text || '')) return null;
+  const rayId = text.match(/Cloudflare Ray ID:\s*<strong[^>]*>([0-9a-f]+)</i)?.[1] ?? null;
+  if (/cloudflare/i.test(text) && /you have been blocked|Attention Required/i.test(text)) {
+    const host = text.match(/unable to access<\/span>\s*([^<\s]+)/i)?.[1] ?? 'the upstream';
+    return {
+      firewall: true,
+      rayId,
+      message:
+        `Blocked by ${host}'s Cloudflare firewall before reaching the model${rayId ? ` (Ray ID ${rayId})` : ''}: ` +
+        'the request content matched an attack signature, typically SQL-injection or shell-command patterns in state or questions. ' +
+        'Retrying the same content will not help; report the Ray ID to the provider.',
+    };
+  }
+  const title = text.match(/<title>([^<]*)<\/title>/i)?.[1]?.trim();
+  return {
+    firewall: false,
+    rayId,
+    message: `Upstream returned an HTML error page${title ? `: ${title}` : ''}${rayId ? ` (Ray ID ${rayId})` : ''}`,
+  };
+}
+
+function truncate(text) {
+  return text.length > MAX_ERROR_MESSAGE_LENGTH ? `${text.slice(0, MAX_ERROR_MESSAGE_LENGTH)}…` : text;
+}
+
 function parseRetryAfter(headers) {
   const ms = Number(headers.get('retry-after-ms'));
   if (Number.isFinite(ms) && ms > 0) return ms;
@@ -145,11 +182,20 @@ async function sendOnce({ url, headers, body, signal, timeoutMs }) {
 
   if (!response.ok) {
     const status = response.status;
-    throw new DecisionError(`HTTP ${status}: ${extractErrorMessage(parsed, rawText)}`, {
+    const detail = extractErrorMessage(parsed, rawText);
+    const html = describeHtmlError(detail);
+    // Every host forwards to TypeSafe's edge, so a firewall block repeats on
+    // retry and on failover alike.
+    const firewall = html?.firewall === true;
+    throw new DecisionError(`HTTP ${status}: ${html ? html.message : truncate(detail)}`, {
       status,
-      retryable: status === 408 || status === 429 || status >= 500 || status === 401 || status === 403,
-      terminal: status === 400 || status === 422,
-      requestId: response.headers.get('x-typesafe-request-id') || response.headers.get('x-generation-id'),
+      retryable: !firewall && (status === 408 || status === 429 || status >= 500 || status === 401 || status === 403),
+      terminal: firewall || status === 400 || status === 422,
+      requestId:
+        response.headers.get('x-typesafe-request-id') ||
+        response.headers.get('x-generation-id') ||
+        html?.rayId ||
+        response.headers.get('cf-ray'),
       retryAfterMs: parseRetryAfter(response.headers),
     });
   }