fix: three defensive bug fixes — GHCR manifest validation, shared issue response guard, hex-id adapter array checks

[cursor]

Summary

Three independent bug fixes for unguarded external data handling that can cause runtime crashes.

---

1. ghcr.ts — Validate OCI manifest response before accessing layers

Root cause: fetchManifest() cast response.json() as OciManifest without validating the response shape. If the GHCR registry returns malformed JSON or a response without a layers array, findLayerByFilename() crashes with TypeError: Cannot read properties of undefined (reading 'find').

Reproduction: GHCR returns a non-standard manifest (e.g., during an outage or when the tag points to an index manifest rather than an image manifest).

Fix: Wrap response.json() in try/catch with debug logging, and validate that layers is an array before returning.

---

2. api/issues.ts — Validate getSharedIssue response shape before returning groupID

Root cause: getSharedIssue() cast response.json() as { groupID: string } without validation. If the API returns a different shape (missing groupID, null, or non-string value), the caller passes undefined to subsequent API calls, producing confusing 404 errors on /issues/undefined/.

Reproduction: The shared issue endpoint returns a response without groupID (e.g., API version change, rate limiting with non-standard body).

Fix: Wrap response.json() in try/catch with debug logging, and validate groupID is a non-empty string before returning.

---

3. hex-id-recovery.ts — Guard adapter data casts with Array.isArray

Root cause: The event, trace, and span fuzzy-lookup adapters cast the data field from API responses as typed arrays and call .map() without checking Array.isArray(). If the API returns non-array data (null, undefined, or an error object), .map() crashes with TypeError.

Reproduction: API returns an error response body or malformed JSON where data is not an array.

Fix: Add Array.isArray guards with debug logging, returning empty arrays on malformed responses.

---

All existing tests pass (148 tests across 5 test files).

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cli	Ready	Preview	Aug 10, 2026 12:09pm