[WRONG BRANCH] management: reject non‑object JSON bodies for /api/custom-models POST/PUT

[luvs01]

Motivation

• The custom-model POST and PUT handlers accepted parsed JSON without ensuring it was a plain object, so valid non-object JSON like null, arrays, or strings could be parsed and then dereferenced, causing an unhandled TypeError.
• The goal is to harden request validation so malformed-but-parseable JSON is rejected with a controlled 400 before any property access, preserving existing functionality and management-plane admission controls.

Description

• Changed the POST and PUT handlers in src/server/management/model-routes.ts to read the body as unknown and return 400 { error: "invalid JSON body" } when isPlainRecord(body) is false.
• This prevents dereferencing null/array/string bodies and restores a predictable validation path for non-object JSON.
• Added a regression test in tests/catalog-input-modality-enum.test.ts that asserts POST and PUT return 400 for null, arrays, and strings and that no config persistence occurs.
• No public API behavior changed for valid object bodies; existing field validation and duplicate checks remain intact.

Testing

• Ran the TypeScript check with bun run typecheck (bun x tsc --noEmit) and it passed.
• Executed tests/catalog-input-modality-enum.test.ts and all tests in that file passed (11 pass, 0 fail).
• Ran bun run privacy:scan and it passed.
• Attempted the full bun run test suite but the GUI integration step failed to build due to external npm registry 403 errors (network/package fetch issue), so the entire full-suite run could not complete in this environment.

---

Codex Task

[coderabbitai]

Warning

Review limit reached

@luvs01, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 56 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 84fd07f7-6b07-4f48-800a-44dfccad3708

📥 Commits

Reviewing files that changed from the base of the PR and between 121f1ad and 95ac2f1.

📒 Files selected for processing (2)

• src/server/management/model-routes.ts
• tests/catalog-input-modality-enum.test.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev. UI screenshot required.

What to do

• Retarget this PR to dev — all contributions go to dev.
• Add a screenshot of the UI change to the PR description.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.