Skip to content

fix(cloud): harden API/plugin error boundaries and prevent MCP leaks - #183

Merged
RhysSullivan merged 7 commits into
mainfrom
refactor/cloud-api-effect-router
Apr 11, 2026
Merged

fix(cloud): harden API/plugin error boundaries and prevent MCP leaks#183
RhysSullivan merged 7 commits into
mainfrom
refactor/cloud-api-effect-router

Conversation

@RhysSullivan

@RhysSullivan RhysSullivan commented Apr 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

Follow-up cleanup after #182 (already in main). This PR now only contains incremental hardening changes:

  • harden plugin HTTP API error boundaries so unknown failures are sanitized
  • prevent raw internal exception messages from leaking in cloud/local MCP JSON-RPC responses
  • small cloud auth lint cleanup

What Changed

  • MCP + Google Discovery API groups now use explicit tagged API/internal error types instead of permissive structural { message: string } errors
  • MCP + Google Discovery handlers sanitize unknown failures/defects into safe internal errors
  • OAuth popup callback paths sanitize unknown errors to a generic user-facing message
  • cloud/local MCP request handlers now return generic internal JSON-RPC errors while logging full server-side details
  • removed unused imports in cloud auth handlers

Verification

  • bun run lint
  • bun run typecheck
  • bun x vitest run src/api/handlers.test.ts src/sdk/plugin.test.ts (packages/plugins/mcp)
  • bun x vitest run src/api/handlers.test.ts src/sdk/plugin.test.ts (packages/plugins/google-discovery)
  • bun x vitest run src/index.test.ts (packages/core/sdk)

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Apr 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Updated (UTC)
✅ Deployment successful!
View logs		 executor-cloud 1698cb4 Apr 11 2026, 05:06 AM

@RhysSullivan
RhysSullivan force-pushed the refactor/cloud-api-effect-router branch from e16dbbd to b604e3a Compare April 11, 2026 04:54
@RhysSullivan RhysSullivan changed the title refactor(cloud): effect-native API routing with hardened plugin error boundaries fix(cloud): harden API/plugin error boundaries and prevent MCP leaks Apr 11, 2026
@RhysSullivan
RhysSullivan merged commit 0d290d8 into main Apr 11, 2026
2 checks passed
@aryasaatvik aryasaatvik mentioned this pull request Apr 11, 2026
Closed
RhysSullivan added a commit that referenced this pull request May 31, 2026
@RhysSullivan
fix(cloud): harden API/plugin error boundaries and prevent MCP leaks (#…
6548b1d 
…183)

* fix(api): harden plugin error boundaries and sanitize unknown failures

* style: format

* fix(mcp): prevent internal error message leakage in json-rpc responses

* chore(cloud): remove unused auth error imports

* chore: exclude generated route trees from oxlint and oxfmt

* fix(cloud): add platform-node for api test typecheck

* style: format
@RhysSullivan
RhysSullivan deleted the refactor/cloud-api-effect-router branch June 11, 2026 08:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@RhysSullivan