perf: optimize hot path iteration and destructuring

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: shenald-dev <245350826+shenald-dev@users.noreply.github.com>

Author: shenald-dev

.jules/bolt.md

@@ -176,7 +176,7 @@ Optimized validation helper logic in `src/index.js` to strictly rely on explicit
 Learning: Global `express.json()` middleware forces the application to buffer and parse request bodies even for unknown or non-existent routes, exposing a Denial of Service (DoS) vulnerability via large payloads to 404 endpoints.
 Action: Apply `express.json()` strictly as route-specific middleware to the exact endpoints that require body parsing, and ensure dependent JSON error handlers are positioned correctly after those specific route definitions in the middleware chain.
 
-## $(date +%Y-%m-%d) — Optimize Health Check Placement
+## 2026-04-29 — Optimize Health Check Placement
 
 Learning: In Express API gateways, declaring high-frequency, simple endpoints (like `/health`) below global middleware such as `helmet` and `cors` introduces significant and unnecessary CPU parsing overhead for every ping, even if the ping does not require CORS or security headers.
 Action: Moved the `/health` endpoint definition above `helmet()` and `cors()` in `src/index.js`, while manually explicitly setting the `Content-Type` header. This drastically reduces CPU overhead and latency for load balancer pings while maintaining correct response headers.
@@ -188,3 +188,11 @@ In highly trafficked functions like `heavyComputation` that rely on an LRU map c
 
 Action:
 Added an L1 cache using module-scoped variables (`lastIterations` and `lastResult`) to `heavyComputation` in `src/index.js`. This avoids redundant Map lookups and mutations for consecutive identical calls, transforming a hot path from an (1)$ Map operation to a much faster strict equality check.
+
+## 2026-04-29 — Optimize Hot Path Iteration and Destructuring
+
+Learning:
+In highly trafficked endpoints like `/v1/chat/completions`, destructuring properties directly from potentially undefined objects (e.g., `const { model, messages } = req.body || {}`) creates unnecessary object allocations for the fallback `{}` and is slower than explicitly checking for the object's existence and accessing properties directly. Additionally, using `for...of` loops incurs iterator allocation and traversal overhead compared to classic `for` loops with a cached array length, especially for large arrays like `messages`.
+
+Action:
+Replaced the object destructuring and `|| {}` fallback with direct property access after an explicit check of `req.body`. Replaced the `for...of` loop with a classic `for` loop caching the `messages.length` in a local variable `messagesLen` before the loop. This reduces garbage collection pressure and significantly improves execution speed on hot paths.

.jules/warden.md

@@ -1,3 +1,8 @@
+## 2026-04-29 — Assessment & Lifecycle
+Observation / Pruned:
+Assessed JULES/BOLT's optimization replacing object destructuring with explicit property access and fallback handling on \`req.body\`. Replaced \`for...of\` loops with classic \`for\` loops and length caching to avoid iterator allocation. Checked dependencies, no unused found. Pruned scratchpad files used for local benchmarks.
+Alignment / Deferred:
+Appended release notes to CHANGELOG.md specifying the performance improvement. Version bumped to 1.1.27.
 
 2024-06-21 — Assessment & Lifecycle
 Observation / Pruned:

CHANGELOG.md

@@ -1,3 +1,7 @@
+## [1.1.27] - 2026-04-29
+### Changed
+- Optimized `/v1/chat/completions` parsing and validation loops.
+
 ## [1.1.26] - 2026-04-28
 ### Changed
 * **[Reliability]:** Fixed an issue in `heavyComputation` where the L1 cache was incorrectly returning false cache hits when `undefined` was passed as a parameter. The cache is now properly initialized with a unique `Symbol`. Zero dead code pruned.

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "one-api",
-  "version": "1.1.26",
+  "version": "1.1.27",
   "description": "One API to rule them all. Unified gateway for 20+ LLM providers. OpenAI-compatible, single binary, zero config.",
   "main": "src/index.js",
   "scripts": {

package.json

@@ -96,7 +96,9 @@ const ERROR_MALFORMED_MESSAGE = Buffer.from(JSON.stringify({ error: 'Malformed m
 const jsonParser = express.json({ limit: '10mb' });
 
 app.post('/v1/chat/completions', jsonParser, (req, res) => {
-  const { model, messages } = req.body || {};
+  const body = req.body;
+  const model = body ? body.model : undefined;
+  const messages = body ? body.messages : undefined;
   if (!isValidModel(model)) {
     return res.status(400).send(ERROR_MISSING_MODEL);
   }
@@ -107,8 +109,9 @@ app.post('/v1/chat/completions', jsonParser, (req, res) => {
     return res.status(400).send(ERROR_TOO_MANY_MESSAGES);
   }
 
-  for (const msg of messages) {
-    if (!isValidMessage(msg)) {
+  const messagesLen = messages.length;
+  for (let i = 0; i < messagesLen; i++) {
+    if (!isValidMessage(messages[i])) {
       return res.status(400).send(ERROR_MALFORMED_MESSAGE);
     }
   }