Skip to content

Reject NDJSON values without a JSON representation - #6982

Merged
tim-smart merged 2 commits into
mainfrom
audit/repro-unstable-encoding-ndjson-undefined
Aug 4, 2026
Merged

Reject NDJSON values without a JSON representation#6982
tim-smart merged 2 commits into
mainfrom
audit/repro-unstable-encoding-ndjson-undefined

Conversation

@fubhy

@fubhy fubhy commented Aug 4, 2026

Copy link
Copy Markdown
Member

Summary

encodeString reports success for undefined and emits a blank line that the module's own decoder rejects.

Important

This PR starts with focused failing reproduction tests. Add the implementation fix to this same branch; CI is expected to fail until that fix is included.

Undefined encodes as an invalid blank NDJSON record

Module: encoding/Ndjson
Audit ID: unstable-ai-cli-ndjson-undefined-blank-record
Severity / confidence: medium / high

What happens

encodeString reports success for undefined and emits a blank line that the module's own decoder rejects.

Why it happens

JSON.stringify(undefined) returns undefined, which Array.join coerces to an empty field before the newline is appended.

Expected behavior

Every accepted input becomes a complete JSON value on one line, or encoding fails with NdjsonError when no JSON representation exists.

Relevant implementation

These links and excerpts are pinned to audit base c9b56ab507f224426ee8388dc450da447ec4715f.

View problematic code at packages/effect/src/unstable/encoding/Ndjson.ts:65-81
export const encodeString = <IE = never, Done = unknown>(): Channel.Channel<
  Arr.NonEmptyReadonlyArray<string>,
  IE | NdjsonError,
  Done,
  Arr.NonEmptyReadonlyArray<unknown>,
  IE,
  Done
> =>
  Channel.fromTransform((upstream, _scope) =>
    Effect.succeed(Effect.flatMap(upstream, (input) => {
      try {
        return Effect.succeed(Arr.of(input.map((item) => JSON.stringify(item)).join("\n") + "\n"))
      } catch (cause) {
        return Effect.fail(new NdjsonError({ kind: "Pack", cause }))
      }
    }))
  )

View exact lines on GitHub

Reproduction

pnpm test --run packages/effect/test/unstable/encoding/Ndjson.test.ts

Observed failure: FAIL: the encoder succeeded and emitted a blank line.

Implementation handoff

The initial reproduction tests on this branch are the regression specification for the implementation fix that should follow in this PR.

  1. Start with the pinned implementation excerpts and the Why it happens analysis above.
  2. Change the implementation so it satisfies the stated Expected behavior; do not weaken or remove the reproduction assertions.
  3. Run the focused reproduction command(s) and confirm the observed failures become passing tests:
pnpm test --run packages/effect/test/unstable/encoding/Ndjson.test.ts
  1. Run the affected package's existing tests, then the repository lint and type checks before requesting review.

Audit provenance

  • Audit base: c9b56ab507f224426ee8388dc450da447ec4715f
  • Reproduction base: c9b56ab507f224426ee8388dc450da447ec4715f
  • Findings: unstable-ai-cli-ndjson-undefined-blank-record
  • Initial patch: focused reproduction tests; implementation fix pending

Closes EFF-420

@fubhy fubhy added the audit Findings originating from the Effect runtime correctness audit label Aug 4, 2026
@changeset-bot

changeset-bot Bot commented Aug 4, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: cc4c124

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 30 packages
Name Type
effect Patch
@effect/opentelemetry Patch
@effect/platform-browser Patch
@effect/platform-bun Patch
@effect/platform-deno Patch
@effect/platform-node-shared Patch
@effect/platform-node Patch
@effect/vitest Patch
@effect/ai-anthropic Patch
@effect/ai-openai-compat Patch
@effect/ai-openai Patch
@effect/ai-openrouter Patch
@effect/atom-react Patch
@effect/atom-solid Patch
@effect/atom-vue Patch
@effect/sql-clickhouse Patch
@effect/sql-d1 Patch
@effect/sql-libsql Patch
@effect/sql-mssql Patch
@effect/sql-mysql2 Patch
@effect/sql-pg Patch
@effect/sql-pglite Patch
@effect/sql-sqlite-bun Patch
@effect/sql-sqlite-do Patch
@effect/sql-sqlite-node Patch
@effect/sql-sqlite-react-native Patch
@effect/sql-sqlite-wasm Patch
@effect/docgen Patch
@effect/doctest Patch
@effect/openapi-generator Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@effect-slopcop effect-slopcop Bot added 4.0 bug Something isn't working labels Aug 4, 2026

@pullfrog pullfrog Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR currently adds only the failing regression test for the bug described in the body — implementation fix is intentionally pending. The test correctly fails against the current encodeString and the assertion is precise enough to enforce the intended behavior. Two suggestions below for when the implementation fix lands.

Reviewed changes

  • Adds fails instead of emitting invalid NDJSON for undefined regression test in packages/effect/test/unstable/encoding/Ndjson.test.ts.
  • Confirms the existing encodeString implementation at packages/effect/src/unstable/encoding/Ndjson.ts:73-81 produces a blank line for undefined.

Pullfrog  | ⚠️ this action is pinned to a commit SHA, which freezes the cleanup step — switch to @v0 or keep the SHA fresh with Dependabot | Fix all ➔Fix 👍s ➔View workflow run | Using Kimi K2 (free via Pullfrog for OSS) | 𝕏

Comment thread packages/effect/test/unstable/encoding/Ndjson.test.ts Outdated
Comment thread packages/effect/test/unstable/encoding/Ndjson.test.ts Outdated
@tim-smart
tim-smart enabled auto-merge (squash) August 4, 2026 22:43

@pullfrog pullfrog Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ No new issues found.

The implementation fix correctly rejects top-level values whose JSON.stringify result is undefined, and the regression test now covers the full class of values without a JSON representation.

Reviewed changes

  • Updated encodeString in packages/effect/src/unstable/encoding/Ndjson.ts to throw a TypeError when JSON.stringify(item) returns undefined, which is then surfaced as an NdjsonError with kind: "Pack".
  • Expanded the regression test in packages/effect/test/unstable/encoding/Ndjson.test.ts to assert that undefined, functions, and symbols all fail with an NdjsonError whose kind is "Pack".
  • Added a patch changeset (.changeset/tough-rooms-camp.md) describing the behavioral fix.

Pullfrog  | ⚠️ this action is pinned to a commit SHA, which freezes the cleanup step — switch to @v0 or keep the SHA fresh with Dependabot | View workflow run | Using Kimi K2 (free via Pullfrog for OSS) | 𝕏

@tim-smart
tim-smart merged commit d517692 into main Aug 4, 2026
32 of 33 checks passed
@tim-smart
tim-smart deleted the audit/repro-unstable-encoding-ndjson-undefined branch August 4, 2026 23:55
@github-actions

github-actions Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Bundle Size Analysis

Generated from PR build output; treat the content below as untrusted.

File Name Current Size Previous Size Difference
basic.ts 7.06 KB 7.06 KB 0.00 KB (0.00%)
batching.ts 9.86 KB 9.86 KB 0.00 KB (0.00%)
brand.ts 6.34 KB 6.34 KB 0.00 KB (0.00%)
cache.ts 10.62 KB 10.71 KB -0.09 KB (-0.83%)
config.ts 20.60 KB 20.60 KB 0.00 KB (0.00%)
differ.ts 20.20 KB 20.20 KB 0.00 KB (0.00%)
http-client.ts 21.49 KB 21.58 KB -0.09 KB (-0.41%)
logger.ts 10.76 KB 10.84 KB -0.08 KB (-0.76%)
metric.ts 8.98 KB 8.98 KB 0.00 KB (0.00%)
optic.ts 7.18 KB 7.18 KB 0.00 KB (0.00%)
pubsub.ts 14.90 KB 14.99 KB -0.09 KB (-0.57%)
queue.ts 11.58 KB 11.66 KB -0.08 KB (-0.68%)
schedule.ts 10.74 KB 10.83 KB -0.09 KB (-0.80%)
schema-class.ts 19.14 KB 19.14 KB 0.00 KB (0.00%)
schema-fromJsonSchemaDocument.ts 28.96 KB 28.96 KB 0.00 KB (0.00%)
schema-representation-roundtrip.ts 25.29 KB 25.29 KB 0.00 KB (0.00%)
schema-string-transformation.ts 13.30 KB 13.38 KB -0.09 KB (-0.64%)
schema-string.ts 10.94 KB 10.94 KB 0.00 KB (0.00%)
schema-template-literal.ts 15.17 KB 15.17 KB 0.00 KB (0.00%)
schema-toArbitraryLazy.ts 21.94 KB 21.94 KB 0.00 KB (0.00%)
schema-toCodeDocument.ts 24.34 KB 24.34 KB 0.00 KB (0.00%)
schema-toCodecJson.ts 19.18 KB 19.18 KB 0.00 KB (0.00%)
schema-toEquivalence.ts 19.01 KB 19.01 KB 0.00 KB (0.00%)
schema-toFormatter.ts 18.87 KB 18.87 KB 0.00 KB (0.00%)
schema-toJsonSchemaDocument.ts 22.60 KB 22.60 KB 0.00 KB (0.00%)
schema-toRepresentation.ts 19.52 KB 19.52 KB 0.00 KB (0.00%)
schema.ts 18.41 KB 18.41 KB 0.00 KB (0.00%)
stm.ts 12.54 KB 12.63 KB -0.09 KB (-0.74%)
stream.ts 9.80 KB 9.80 KB 0.00 KB (0.00%)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

4.0 audit Findings originating from the Effect runtime correctness audit bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants