Repository navigation
clef-proxy: the upstream half of PR #691's fix has no regression test — and the hardcoded gateway URL makes it untestable #692
Description
Finding
PR #691 fixed both halves of #690 in bin/clef-proxy.mjs, but only the client-body half got a regression test. The upstream half — a non-JSON or null/scalar gateway response is reported as an upstream failure preserving the upstream status instead of throwing into a 500 — has no test that can fail if it regresses, and as written it cannot be tested at all: the gateway URL is hardcoded, so no stub upstream can be injected.
Evidence
- PR: fix(clef-proxy): malformed client JSON is a 400, not a 500 (#690) #691 (merged 2026-10-23T21:39:55Z, merge commit
8e05af24341b321779851bc824177b14cfd57b9f, commit02183adb78c00e20fab4bebb2e7100a6f4e58bcc, fixes clef-proxy: invalid client JSON returns 500 instead of 400 — body parse shares the upstream try/catch, non-JSON upstream is masked, and there are no tests #690, now CLOSED) - Upstream guard on current main
8e05af24(bin/clef-proxy.mjs:157-165, blobb61de077cross-checked viagh api):cfDatastartsnull,await cfRes.json()is in its owntry {} catch {}, and the success check iscfRes.ok && cfData?.success && cfData.result?.answers; the failure branch answerscfRes.status >= 400 ? cfRes.status : 502. - The new test file's own header says the upstream is out of scope (
bin/clef-proxy.test.mjs:4-6): "The proxy forwards valid requests to the Cloudflare AI gateway, which these tests never reach: they cover the paths that answer locally". Its four subtests are health 200, invalid JSON 400, non-object JSON 400, missing token 401 — none reaches the fetch. Verified this run (pr-diff-review):node --test bin/clef-proxy.test.mjspasses 5/5 on current main, and reverting only the upstream guard (unguardedcfRes.json()/cfData.success) would fail none of them. - The gateway base is not overridable (
bin/clef-proxy.mjs:141):const cfUrl = \https://gateway.ai.cloudflare.com/v1/${accountId}/${gatewayId}/workers-ai/run/${model}\``. Account, gateway and token all come from env/config (getCredentials, :56-73), but the host does not, so a test cannot point the proxy at a local stub gateway without a code change first. - clef-proxy: invalid client JSON returns 500 instead of 400 — body parse shares the upstream try/catch, non-JSON upstream is masked, and there are no tests #690's acceptance criteria required tests only for the local paths (health / invalid JSON 400 / missing token 401), so the issue closed with the upstream behaviour — two of its own acceptance bullets — unpinned. Same pattern as design-code-proxy: the streaming half of PR #685's Content-Length fix has no regression test — the stub never sets Content-Length on SSE responses #688 (the untested streaming half of PR fix(design-code-proxy): don't forward the backend's Content-Length for re-serialized bodies (#684) #685's design-code-proxy fix).
Why it matters
The upstream guard is the half that fires exactly when Cloudflare is misbehaving — an HTML 502/429 page or a malformed gateway body is when clients most need the real upstream status instead of a misleading JSON-parse 500. Today the code is correct; what is missing is the pin that keeps it correct, and the hardcoded gateway host means a future contributor cannot add that pin without first refactoring the URL construction.
Single-repo: clef-proxy and the gateway.ai.cloudflare.com URL exist only in this repo (git grep across the local clones of developing-today/opencode, developing-today/openchamber and dezren39/nix finds neither).
Acceptance criteria
- The gateway base URL is overridable for tests (e.g. an env var such as
CLEF_PROXY_GATEWAY_BASE_URL/CLOUDFLARE_GATEWAY_BASE_URLdefaulting tohttps://gateway.ai.cloudflare.com/v1), or an equivalent fetch/stub injection exists; production behaviour with the override unset is byte-identical. - New tests in
bin/clef-proxy.test.mjsrun the proxy against a stub gateway and cover at least: a non-JSON upstream body with an error status (client gets that status / 502 upstream failure, not a JSON-parse 500), and anull(or scalar) upstream JSON body (no throw oncfData.success, reported as an upstream failure). - Ablation: with the upstream guard reverted (unguarded
await cfRes.json()andcfData.success), the new tests fail; with the guard in place, the full clef-proxy suite passes (node --test bin/clef-proxy.test.mjs).
Activity
dezren39 commentedon Oct 26, 2026
Intake review
Still live (verified this run, fleet monitor):
bin/clef-proxy.mjson current main still hardcodes the gateway URL at line 160 (https://gateway.ai.cloudflare.com/v1/${accountId}/${gatewayId}/workers-ai/run/${model}) with no env override, and the upstream guard (cfRes.ok && cfData?.success && cfData.result?.answers, line ~184) is present but still has no test that can reach it — the test file's local-paths-only scope is unchanged.Related: PR #691 / closed #690 (the fix whose upstream half this pins), #688 (the same untested-streaming-half pattern in design-code-proxy).
Notes / risks: the prerequisite refactor (gateway base URL from env/config, defaulting to the current hardcoded value) is the only production change needed; keep the default byte-identical so deployment behaviour does not move.
Suggested approach: add a
CLEF_GATEWAY_BASE-style override ingetCredentials/config, point the test suite at a local stub gateway, and add subtests for non-JSON upstream body,null/scalar JSON, and upstream 4xx/5xx status preservation.Labels normalized by the fleet monitor: kind/test, priority/normal, effort/s.
dezren39 commentedon Oct 31, 2026
🤖 Agent note · picked up
dezren39 commentedon Oct 31, 2026
🤖 Agent note · triage findings (queue task 1068, lane D)
Verdict: CONFIRMED on current main
47214f1c— verified by direct read ofbin/clef-proxy.mjsthis run (line numbers moved since filing; the code is byte-equivalent)::246-255—cfDatastartsnull,await cfRes.json()sits in its owntry {} catch {}, success requirescfRes.ok && cfData?.success && cfData.result?.answers, and the failure branch answerscfRes.status >= 400 ? cfRes.status : 502. A non-JSON or null/scalar gateway body is reported as an upstream failure preserving the upstream status — the fix(clef-proxy): malformed client JSON is a 400, not a 500 (#690) #691 upstream half is present and correct.:227—cfUrlis built from a hardcodedhttps://gateway.ai.cloudflare.com/v1/${accountId}/${gatewayId}/workers-ai/run/${model}. Account/gateway/token all resolve env-first (getCredentials,:75/:79/:88), and even the listen host is env-overridable (CLEF_PROXY_HOST,:9) — but the gateway host/base is not, so no stub upstream can be injected.bin/clef-proxy.test.mjs's own header still states the tests "never reach" the upstream; its subtests cover only the local paths (health / 400 / 401), so reverting the guard would fail none of them.Seam proposal (pinned for the follow-up task — not implemented here): follow the file's own env-first convention:
const gatewayBase = process.env.CLEF_PROXY_GATEWAY_BASE || 'https://gateway.ai.cloudflare.com'and buildcfUrlas${gatewayBase}/v1/${accountId}/${gatewayId}/workers-ai/run/${model}. Default behaviour is byte-identical. The existing test harness already spawns the proxy as a subprocess with a controlled env/HOME, so with this seam the upstream tests need no export refactor: stand up a stub HTTP server on 127.0.0.1, pointCLEF_PROXY_GATEWAY_BASEat it, POST a valid body, and pin: (1) upstream 502 with an HTML/non-JSON body → proxy answers 502 (not 500); (2) upstream 200 with JSONnull→ 502; (3) upstream 200 with a scalar body → 502; (4) upstream 200 with{success:true,result:{answers}}→ 200 with the answers (happy path pinned too).A
small_fixfollow-up task (seam + the four upstream regression tests) is being enqueued from this triage.7 remaining items
dezren39 commentedon Oct 31, 2026
agent-note:v1 — task 4596 implemented by Lane A. PR opened @af1424238: CLEF_PROXY_GATEWAY_BASE seam (Cloudflare default, cfUrl shape unchanged) + stub-upstream regression tests (non-JSON 502 / null 200 / scalar 200 / happy path); node --test bin/clef-proxy.test.mjs 10/10 on the laptop. Parking on CI + Codex review.
Merge pull request #3172 from developing-today/queue/4596-692-clef-pr…
dezren39 commentedon Oct 31, 2026
🤖 Agent note · done