Sloth-ninja closes a key-management reliability and privacy gap

This fork makes API-key administration less brittle while reducing the risk that backend failures reveal too much.

securityinfrastructure

Sloth-ninja has fixed a crash when checking the status of user API keys, a small but consequential repair for any team relying on external services inside a legal-AI workflow.

The update also makes genuine key-saving failures visible to the person operating the system, while tightening what a server error sends back. Unhandled failures now stop the affected process instead of leaving it stuck in a broken state. A related test has been given more time to complete where secure password-style hashing can run unpredictably slowly.

So what Legal-product teams and legal ops leaders should care if they need dependable key administration without exposing unnecessary error detail.

View this fork on GitHub →

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

5 commits from Sloth-ninja/JessicaOSS, oldest first. Source extracted verbatim from the harvested git log.

SHA	Subject	Author	Date
`ddda0262`	Fix backend crash on api-keys status; surface real save errors	sloth-ninja	2026-07-19	↗ GitHub
commit body GET /user/api-keys lacked try/catch: Express 4 + Node 22 turned one transient DB error into a full process death during first live QA. Handler wrapped; process-level rejection guards added. Frontend now shows the server's detail (e.g. the 409 env-configured explanation) instead of a generic alert. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
`c979b098`	Review fixes: fixed 500 detail on save path; uncaughtException exits	sloth-ninja	2026-07-19	↗ GitHub
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
`56896cf4`	Merge pull request #22 from Sloth-ninja/fix-apikeys-stability	Ezana.H	2026-07-19	↗ GitHub
Pilot stability: api-keys crash fix + honest save errors
`b5f96649`	Fix userApiKeys test flake: 20s timeout on the scrypt-heavy test	sloth-ninja	2026-08-03	↗ GitHub
commit body The 'prefers the user's decrypted key over the env key for every provider' test performs multiple scrypt derivations and exceeded vitest's 5s default on cold full-suite runs (observed 6.7s), while passing in isolation. Known flake - bit the WS9 builder and the Stop hook. Per-test 20s timeout with an explanatory comment; no behaviour change. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
`53a2aee0`	Merge pull request #61 from Sloth-ninja/fix-userapikeys-flake	Ezana.H	2026-08-03	↗ GitHub
Fix userApiKeys test flake: per-test timeout on the scrypt-heavy test

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-854.md from inside the repo you want the changes in.

⬇ Download capture-thread-854.md