Review fixes: log-only extraction, harden errorMessage(), redact code, quiet 42703

↗ view on GitHub · sloth-ninja · 2026-08-04 · 5047ffb7

- safeErrorMessage: revert the object-message widening - extraction is
  LOG-ONLY (all call sites are client-facing SSE/persisted text and libs
  rethrow raw Supabase plain objects); non-Error objects keep the fallback.
  safeErrorLog extracts independently, unchanged.
- routes/user.ts errorMessage(): Error instances keep their actionable
  message (redacted, string code appended); plain objects/strings degrade
  to GENERIC_ERROR_DETAIL - never join details/hint, never JSON.stringify.
  Fixes raw Postgrest text leaking through the MCP-connector 400/404
  sites. Exported for tests; follow-up: retire in favour of safeError.
- safeErrorLog: redact the code field before using it as name.
- middleware/auth.ts: 42703 (pre-migration, tolerated) stays at devLog;
  console.error only for real failures.
- Tests updated/added: safeErrorMessage fallback contract, code
  redaction, errorMessage both shapes (623 total).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Repository Sloth-ninja/JessicaOSS
Author sloth-ninja <ezanahaddis@gmail.com>
Authored
Parents 28f4eb0c
Stats 6 files changed , +139 , -66
Part of Error visibility hardening without raw-detail leaks

Capture this commit into my fork

Download a Markdown prompt that tells Claude how to port this exact commit into your working tree. Run it via claude -p < capture-commit-5047ffb7.md from inside the repo you want the change in.

⬇ Download capture-commit-5047ffb7.md