[Duplicate Code] JSON body parse-and-validate guard copy-pasted into five api-proxy functions

[github-actions]

Duplicate Code Opportunity

Summary

• Pattern: The JSON body parse-and-validate guard is repeated inline in five production functions across three files with no shared helper
• Locations: containers/api-proxy/body-transform.js (×3), containers/api-proxy/providers/copilot.js, containers/api-proxy/model-resolver.js
• Impact: ~40 lines of duplicated input validation; any correction (e.g. adding a max-size guard, changing the rejection type, or fixing a subtle type-check) must be applied to all five sites independently

Evidence

The following pattern appears verbatim (or near-verbatim) in five places:

let parsed;
try {
  parsed = JSON.parse(body.toString('utf8'));
} catch {
  return null;
}
if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return null;

Occurrences:

1. containers/api-proxy/body-transform.js:13–20 — sanitizeNullToolCallTypes()
2. containers/api-proxy/body-transform.js:87–91 — injectSteeringMessage()
3. containers/api-proxy/body-transform.js:151–158 — injectStreamOptions()
4. containers/api-proxy/providers/copilot.js:154–162 — injectByokExtraBodyFields()
5. containers/api-proxy/model-resolver.js:421–427 — request body parsing

Suggested Refactoring

Extract a shared parseBodyAsObject helper (e.g. in containers/api-proxy/body-utils.js):

/**
 * Parse a Buffer as a plain JSON object.
 * Returns null on parse error, non-object, or array input.
 * `@param` {Buffer|string} body
 * `@returns` {object|null}
 */
function parseBodyAsObject(body) {
  let parsed;
  try {
    parsed = JSON.parse(body.toString('utf8'));
  } catch {
    return null;
  }
  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return null;
  return parsed;
}
module.exports = { parseBodyAsObject };

Each call site becomes two lines:

const parsed = parseBodyAsObject(body);
if (!parsed) return null;

This also makes future hardening (e.g. a size limit) a single-file change.

Affected Files

• containers/api-proxy/body-transform.js — lines 13–20, 87–91, 151–158
• containers/api-proxy/providers/copilot.js — lines 154–162
• containers/api-proxy/model-resolver.js — line 421+

Effort Estimate

Low

---

Detected by Duplicate Code Detector workflow. Run date: 2026-06-04

Generated by Duplicate Code Detector · sonnet46 2.2M · ◷

• expires on Jul 4, 2026, 10:15 PM UTC