fix(web): add missing returns after http.Error in handlers

[ndf14685]

Summary

Five HTTP handlers in pkg/web/web.go write an error response with http.Error(...) but are missing the return afterwards, so the handler keeps executing on the error path:

Handler	Error path	What happened after the error
handleService	invalid JSON body (400)	still invoked service.CallService with a zero-value WebCallType
handleService	response marshal failure (500)	still wrote 200 headers + body on top of the error
handleWaveFile	invalid offset param (400)	kept serving the file with offset=0
handleWaveFile	fileinfo marshal failure (500)	still streamed the file data
handleStreamFile	ExpandHomeDir error (400)	still called http.ServeFile with the unexpanded path

The handleService case is the most relevant one: a malformed request body is rejected with 400 but the service call is executed anyway with empty data.

The fix is the same one-liner in each spot: return after http.Error. No behavior change on success paths.

Found while triaging CodeQL alerts on a fork; these were flagged around the go/stack-trace-exposure / go/path-injection sites but the underlying real bug is the missing early return.

Test plan

• go vet ./pkg/web/ and go build ./pkg/web/ pass.
• Error paths now terminate at the first http.Error (single response per request); success paths untouched.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NctL6NKspWCzRxHJDwBGMk

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 76ce2895-062e-4b55-b439-8183761e57ec

📥 Commits

Reviewing files that changed from the base of the PR and between a4447c1 and 5182dd7.

📒 Files selected for processing (1)

• pkg/web/web.go

---

Walkthrough

The web handlers now terminate immediately after error responses. handleService returns when response JSON marshaling fails; handleWaveFile returns for invalid offsets and metadata marshaling failures; and handleLocalStreamFile returns when home-directory expansion fails.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: adding missing returns after http.Error in web handlers.
Description check	✅ Passed	The description directly explains the same handler-return fixes and is clearly related to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}