Correctness: Wire format conversion can silently drop OpenRouter fields #122

New issue

Open

opened 2026-05-11 23:08:59 +00:00 by thabeta · 0 comments

thabeta commented

2026-05-11 23:08:59 +00:00

Owner

Severity: Medium

Location

crates/hero_aibroker_lib/src/service/wire.rs

Finding

The wire format types are manually defined structs. When converting between OpenAI and OpenRouter shapes, fields not in the target struct are silently dropped.

Impact

OpenRouter-specific features (reasoning, transforms) silently lost
Client sends parameters that are ignored
No warning about unsupported features
Data loss in protocol conversion

Recommendation

Use serde's deny_unknown_fields during conversion to detect dropped fields
Log warnings when fields are dropped
Preserve unknown fields in a passthrough bag
Add integration tests that verify field round-tripping

## Severity: Medium ## Location `crates/hero_aibroker_lib/src/service/wire.rs` ## Finding The wire format types are manually defined structs. When converting between OpenAI and OpenRouter shapes, fields not in the target struct are silently dropped. ## Impact - OpenRouter-specific features (reasoning, transforms) silently lost - Client sends parameters that are ignored - No warning about unsupported features - Data loss in protocol conversion ## Recommendation - Use serde's deny_unknown_fields during conversion to detect dropped fields - Log warnings when fields are dropped - Preserve unknown fields in a passthrough bag - Add integration tests that verify field round-tripping