Parse WebSocket and job data at the boundary

[usehoplite]

Problem

The browser trusted data it had not checked. WebSocket frames were read with JSON.parse(text) as WSServerMessage, and the payload was then cast again in each branch. An unexpected frame could put a wrong shape into the jobs store. The API client also returned {} as T for any success response that was not JSON, so a proxy error page or the SPA fallback looked like a successful call. On the Go side, JobResponse copied every field of model.Job by hand and re-formatted the dates for no reason.

Change

• Add parseServerMessage, which turns a raw frame into a discriminated union (job_update | job_complete | error | pong) or null. The store switches on the union with an exhaustiveness check (satisfies never), and logs and ignores frames it does not recognise. No as remains in that path. Progress must be an integer from 0 to 100, and the log line for a rejected frame does not include the frame.
• Add frontend/src/lib/api/websocket.test.ts (runs with bun run test, using node:test so no new dependency) and a CI step for it.
• Move JobUpdate to api/jobs.ts with isJobState, so the job state values are listed once.
• The API client now throws ApiRequestError (INVALID_RESPONSE) when a success response is not JSON. Every handler already returns JSON, so no working call changes. Drive-name calls declared void for a JSON reply and now say unknown.
• Replace icon: any and its eslint-disable in SettingsSection with typeof ChevronDown.
• Go: delete JobResponse and toJobResponse and serialise model.Job directly. It already hides Owner and the resolved paths with json:"-". Job times now include fractional seconds (RFC 3339 with nanoseconds), the same format as modTime on files, which the browser already parses. An empty job list is still [].

Left alone: the 40 or so event.target as HTMLInputElement casts in components, and the null as string | null in settings.ts, which goes away when that store is migrated in unit 5. REST payload shapes are still trusted, not validated.

Verification

• New handler test: an empty list returns {"jobs":[]}. A job response contains no owner or resolved paths, omits a zero startedAt, and has a createdAt that parses as RFC 3339 with nanoseconds.
• New parser tests cover valid and invalid frames, including progress of -1, 101 and 12.5. They failed on the first version of the parser (range not checked) and pass now. bun run test passes.
• bun run check, lint and build pass. go vet and the handler tests pass.
• In a real browser against the stack-tip build, a copy job returned 202 and the page received newline-batched job_update frames (running, progress 0 to 100, then completed). The parser split them correctly and the copied file matched.
• Not tested: a job_complete or error frame from a real server, and a proxy that returns HTML with status 200 (the new INVALID_RESPONSE path).

Stack: 4 of 6. Targets the branch of the PR below it.

---

Written by anthropic/claude-sonnet-5-5 in the Hoplite agent harness.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
box-box	Ready	Preview	Oct 1, 2026 8:03am UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 4f4594f3-240b-4d8b-8ba1-c524252f436f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Invalid progress passes validation. Job progress is defined as 0–100, but this check accepts any number. If a malformed frame names an existing job, the jobs store writes values such as -1 or 5000 directly. Validate the range before accepting the update.

Suggested change

	if (typeof jobId !== 'string' || !isJobState(state) || typeof progress !== 'number') {
	return null;
	}
	if (
	typeof jobId !== 'string' ||
	!isJobState(state) ||
	typeof progress !== 'number' ||
	!Number.isInteger(progress) ||
	progress < 0 ||
	progress > 100
	) {
	return null;
	}

[greptile-apps]

Parser lacks persistent tests. This parser now decides which WebSocket frames can update job state, but its valid and invalid cases have no committed regression tests. The described 12-frame check was a throwaway script. Persistent tests would catch changes that accept malformed updates or discard valid server messages.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[greptile-apps]

Rejected frames logged verbatim. Every malformed or unrecognised frame is now printed in full. An unexpected job message could contain user paths or a large payload, making browser diagnostics noisy and retaining data the previous parse-error log did not print. Log a bounded description instead of the raw frame.

Suggested change

	console.warn('Ignoring unrecognised WebSocket message:', text);
	console.warn('Ignoring unrecognised WebSocket message');

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!