fix(management): reject null Claude toggle bodies

[luvs01]

Summary

• reject top-level null and other non-object JSON bodies for PUT /api/native-integrations/claude;
• return the existing deterministic 400 envelope instead of dereferencing body.enabled and raising an unhandled TypeError;
• add a focused regression for the exact null input.

Why

The route parses JSON into a value typed as an object and immediately reads body.enabled. JSON null parses successfully, so it bypasses the malformed-JSON catch and crashes at the property access. Ordinary non-boolean object values already receive a 400 response; top-level non-objects should follow the same contract.

The guard now rejects null, arrays, and non-object values before reading enabled. No valid toggle payload or persistence behavior changes.

Verification

• Bun 1.3.14: tests/native-claude-code-toggle.test.ts 11/11 passed.
• Bun 1.4.0-canary.1 (b22e0e6d0): the same file 11/11 passed.
• bun x tsc --noEmit: passed.
• bun scripts/privacy-scan.ts: passed.
• git diff --check: passed.

Checklist

• The regression exercises the authenticated management route.
• Invalid input is rejected before any config write.
• Valid boolean toggle semantics remain covered by the existing suite.

Ready for review; upstream CI and automated review remain pending.

Summary by CodeRabbit

• Bug Fixes

  • Improved validation for Claude integration settings requests.
  • Invalid payloads, including null values, are now rejected with a clear HTTP 400 error instead of causing a server failure.

• Tests

  • Added regression coverage for invalid request bodies.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[coderabbitai]

📝 Walkthrough

Walkthrough

The Claude integration PUT route now validates that the request body is a non-null object with a boolean enabled field. A regression test verifies that a null body returns HTTP 400 with the expected error.

Changes

Claude toggle validation

Layer / File(s)	Summary
Body validation and regression coverage src/server/management/native-integration-routes.ts, tests/native-claude-code-toggle.test.ts	The route rejects null, array, and non-object JSON bodies before reading enabled at line 699. The regression test verifies that a null body returns HTTP 400 with { error: "enabled must be a boolean" }.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: lidge-jun

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: rejecting null request bodies for the Claude toggle endpoint.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Ingwannu]

Reviewed exact head c85d792d. The route now rejects null/non-object/array JSON before reading enabled, preserving the existing 400 contract instead of throwing. Focused coverage passed locally (11 tests), git diff --check passed, and typecheck passed. The substantive cross-platform shards, gates, privacy scan, keyring jobs, and platform tests are green; the macOS npm-global packaging job is still waiting for a runner, so do not merge until that final job completes successfully.

[Ingwannu]

Re-reviewed rebased exact head a1cf0d9c. The PR diff is byte-equivalent in scope to the previously approved patch and still contains only the null-body guard plus its regression. Exact-head focused tests passed 11/11 and typecheck passed. Do not merge until the newly triggered exact-head CI is green.

[github-actions]

⏳ DRAFT

• review readiness checklist open (0/4 boxes ticked).

What to do

• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ All CI tests are green on my local testing.
• ⬜ I pushed my PR to the latest dev commit.
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This PR stays in draft until every box above is ticked.

[luvs01]

Rebased exact head a9dc8222 onto current dev (517f4460) without changing the reviewed two-file patch.

Focused verification on the rebased state:

• Bun 1.3.14: tests/native-claude-code-toggle.test.ts 11/11 passed.
• Bun 1.4.0-canary.1: 11/11 passed.
• Typecheck, privacy scan, and git diff --check passed.

The branch is now exactly one commit ahead and zero behind dev. Fresh exact-head CI is required because the prior run's shard 4/4 was cancelled.