Uh oh!
There was an error while loading. Please reload this page.
[RFC] Reject empty-string hook tokens in createHook() - #2490
Merged
Conversation
createHook() used `options.token ?? ctx.generateNanoid()`, so a nullish token fell back to a generated one but an empty string `""` was accepted verbatim — a meaningless, non-deterministic token that is almost always an accidental value (e.g. an unset variable). Throw a clear error when an explicit empty-string token is passed; `undefined`/`null` still auto-generate, and non-empty strings are unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
🦋 Changeset detectedLatest commit: d5a3328 The changes in this PR will be included in the next version bump. This PR includes changesets to release 16 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
Contributor
📊 Benchmark Results
workflow with no steps💻 Local Development
▲ Production (Vercel)
workflow with 1 step💻 Local Development
▲ Production (Vercel)
workflow with 10 sequential steps💻 Local Development
▲ Production (Vercel)
workflow with 25 sequential steps💻 Local Development
▲ Production (Vercel)
workflow with 50 sequential steps💻 Local Development
▲ Production (Vercel)
Promise.all with 10 concurrent steps💻 Local Development
▲ Production (Vercel)
Promise.all with 25 concurrent steps💻 Local Development
▲ Production (Vercel)
Promise.all with 50 concurrent steps💻 Local Development
▲ Production (Vercel)
Promise.race with 10 concurrent steps💻 Local Development
▲ Production (Vercel)
Promise.race with 25 concurrent steps💻 Local Development
▲ Production (Vercel)
Promise.race with 50 concurrent steps💻 Local Development
▲ Production (Vercel)
workflow with 10 sequential data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
workflow with 25 sequential data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
workflow with 50 sequential data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
workflow with 10 concurrent data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
workflow with 25 concurrent data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
workflow with 50 concurrent data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
Stream Benchmarks(includes TTFB metrics)workflow with stream💻 Local Development
▲ Production (Vercel)
stream pipeline with 5 transform steps (1MB)💻 Local Development
▲ Production (Vercel)
10 parallel streams (1MB each)💻 Local Development
▲ Production (Vercel)
fan-out fan-in 10 streams (1MB each)💻 Local Development
▲ Production (Vercel)
SummaryFastest Framework by WorldWinner determined by most benchmark wins
Fastest World by FrameworkWinner determined by most benchmark wins
Column Definitions
Worlds:
❌ Some benchmark jobs failed:
Check the workflow run for details. |
Contributor
🧪 E2E Test Results❌ Some tests failed Summary
❌ Failed Tests▲ Vercel Production (3 failed)express (1 failed):
nextjs-turbopack (1 failed):
nextjs-webpack (1 failed):
Details by Category❌ ▲ Vercel Production
✅ 💻 Local Development
✅ 📦 Local Production
✅ 🐘 Local Postgres
✅ 🪟 Windows
✅ 📋 Other
❌ Some E2E test jobs failed:
Check the workflow run for details. |
karthikscale3
approved these changes
Jun 18, 2026
karthikscale3
left a comment
Contributor
There was a problem hiding this comment.
the change itself looks good to me. but, it's a backwards incompatible API change - so maybe we should do a minor version upgrade instead of a patch for the changeset?
pranaygp
marked this pull request as draft
June 18, 2026 00:23
pranaygp
marked this pull request as ready for review
June 18, 2026 16:41
Uh oh!
There was an error while loading. Please reload this page.
github-actionsBot
added a commit
that referenced
this pull request
Jun 18, 2026
createHook() used `options.token ?? ctx.generateNanoid()`, so a nullish token fell back to a generated one but an empty string `""` was accepted verbatim — a meaningless, non-deterministic token that is almost always an accidental value (e.g. an unset variable). Throw a clear error when an explicit empty-string token is passed; `undefined`/`null` still auto-generate, and non-empty strings are unchanged. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Pranay Prakash <pranay.gp@gmail.com>
Contributor
Backport PR opened against |
This was referenced Jun 18, 2026
pranaygp added a commit
that referenced
this pull request
Jun 18, 2026
…testing * origin/main: perf(core): decouple workflow VM seed/clock from startedAt (#2525) [world-local] [core] Cache local dev server port per process (#2522) Show pending runs as gray animated stripes in trace viewer (#2520) [world-vercel] Route v4 event requests through global fetch (#2514) [core] Send workflowName with step events (#2511) Stamp run IDs on world spans (#2508) Reject empty-string hook tokens in createHook() (#2490) perf(core): cache compiled workflow-bundle vm.Script across replays (#2471) perf(core): drain consumable replay events synchronously (#2473) perf(core): lazy inline step start (save one world round-trip per step) (#2478)
This was referenced Jun 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
createHook()builds its token withoptions.token ?? ctx.generateNanoid(). Because??only falls back for nullish values, an explicit empty string (createHook({ token: '' })) was accepted verbatim and used as the hook's real token — a meaningless, non-deterministic value that defeats the purpose of caller-supplied tokens (deterministic identity, dedup, conflict detection). It's also an easy accidental value (e.g.token: someVarwheresomeVaris an unset/empty string).This change makes
createHook()fail at validation when given an empty-string token:token: ''→ throws a clear, actionableError.tokenomitted /undefined/null→ unchanged: a random token is generated.This mirrors the existing input-validation precedent right next door in
createWebhook(), which throws synchronously when handed a disallowedtokenoption.Changes
packages/core/src/workflow/hook.ts— throw whenoptions.token === ''increateHookImpl, before the token is generated/enqueued. The internal abort-controller hook writes to the invocations queue directly and does not go through this path, so internal callers are unaffected.packages/core/src/create-hook.ts— clarify theHookOptions.tokenJSDoc: must be a non-empty string if provided.packages/core/src/workflow/hook.test.ts— add tests that an empty-string token throws (and is not enqueued), and that omitting the token still auto-generates a non-empty one.Notes / scope
HookSchemazod (packages/world/src/hooks.ts) to.min(1). That schema validates persisted/replayed events; any run that already recorded an empty token from this bug would start failing to parse. Guarding atcreateHook()stops new bad tokens without that replay risk.Test plan
pnpm vitest run src/workflow/hook.test.tsinpackages/core— 37 passed (incl. 2 new).pnpm typecheckinpackages/core— clean (after building workspace deps).🤖 Generated with Claude Code