7b:I[154500,[["$2",["$3","$4"],[14451,1389]],["$5",["$6","$7","$8","$9","$a","$b"],[40076,28925,10525,30632,7744,72054]]],"IconMark"] 78:T96a,Fixes #119. ## What & why An empty string supplied for a `{pathParam}` placeholder passed schema validation — the base `RunInput` path-param shape is `z.string()` with no length rule, and connector schemas don't consistently add `minLength` — and was substituted into the url, producing an empty path segment: an endpoint compiled from `/v1/items/{id}/sub` with `pathParams.id = ""` issued `https://api.example.test/v1/items//sub`. An empty segment can address a **different vendor route** (e.g. a list route), and that request goes out with the endpoint's credentials. ## The change `substituteUrl` (`engine/request.ts`) now treats an empty placeholder value like a missing one: `INVALID_INPUT` before any request is built. The guard sits at the engine boundary, shared by the declarative pipeline (`buildRequest`) and the lifecycle ctx's `data.request`, so every caller gets the same rule regardless of each connector's own schema strictness. ## Tests (`engine/engine.test.ts`) New "path substitution" section, mirroring the query section's shape: - a **non-empty** id substitutes into the url (positive control); - an **empty** id is `INVALID_INPUT`, asserting the transport is never called — no request leaves the engine (`seen.url` stays `undefined`); - a **missing** id stays `INVALID_INPUT` (covers the pre-existing guard). The new empty-value test fails on `main` and passes with this change. ## Verification - `deno test --allow-read --allow-env --allow-write engine/` — 103 passed (100 before + 3 new) - `deno test` on `connectors/clay/endpoints/search/query-mode-run/endpoint.test.ts` and `connectors/orbit/endpoints/profile-read/endpoint.test.ts` — the only two tests in the repo that pass an empty path param, both negative controls asserting `INVALID_INPUT`; both still pass - `deno check engine/mod.ts engine/request.ts engine/engine.test.ts`, `deno lint engine/`, `deno fmt` — clean - repo-wide grep: no other caller passes an empty path param ## Summary by CodeRabbit * **Bug Fixes** * URL path parameters with empty values are now rejected, matching the existing handling of missing values. * Requests with an empty path parameter are not sent and return an invalid-input error. 79:T3219,

No actionable comments were generated in the recent review.

Recent review info

Run configuration

- **Source mode**: Auto - **Repository**: [monid\-ai/monid](https://github.com/monid-ai/monid) - **Branch**: [main](https://github.com/monid-ai/monid/tree/main) - **File**: [.coderabbit.yaml](https://github.com/monid-ai/monid/blob/09d54479142e36eff876383beacfbd37b33b5908/.coderabbit.yaml) - **Commit**: [09d5447](https://github.com/monid-ai/monid/commit/09d54479142e36eff876383beacfbd37b33b5908) - **Layers**: Repository YAML - **Review profile**: CHILL - **Plan**: Advanced - **Run ID**: `a817f299-3595-4d7e-a635-ac9055137de3`

Commits

Reviewing files that changed from the base of the PR and between 09d54479142e36eff876383beacfbd37b33b5908 and 7fb1d141991e8bedf88900ef0b32b890693c0597.

Files selected for processing: 2

* `engine/engine.test.ts` * `engine/request.ts`

**Included review availability:** This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

`substituteUrl` now rejects empty path parameter values with `INVALID_INPUT`, in addition to rejecting missing values. Tests cover non\-empty substitution, empty\-value rejection without sending a request, and missing\-value rejection.

Priority: Normal **Severity of issue fixed:** Medium

Merge Risk: Minimal · up to 7fb1d

The requested validation is implemented and covered by tests, with no remaining merge\-blocking risk identified.

Pre-merge checks: 4

| Check name | Status | Explanation | |:-------------------------- |:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------:|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Description Check | ![Passed](https://cdn.trylle.com/media/images/9b9f7fc0af96c9889ff30dd8dc8752bd?key=Aec7YlhhL%2FWojK8gn54mkt9KD7Uvp%2B14YdVeU%2F7AOnbnO8x76NKhQn886i%2FCQT5dcj7%2FiiBjzzzUypazN2QvWoTYfhbCW723SX%2B0ZlbFieBXi1YY7J7gIBXHpKWTAj2Q4%2BCa4dgdBnn8d3HEdUGlUW2Xi%2BXlSDbHrrQTK5zYO2kQgyBp3%2BIaYZB2v57Hd07YU35qEgQV377f%2FXo0E72gVN4H6btm4nsvMaw%3D) | Check skipped \- CodeRabbit’s high\-level summary is enabled. | | Title check | ![Passed](https://cdn.trylle.com/media/images/9b9f7fc0af96c9889ff30dd8dc8752bd?key=Aec7YlhhL%2FWojK8gn54mkt9KD7Uvp%2B14YdVeU%2F7AOnbnO8x76NKhQn886i%2FCQT5dcj7%2FiiBjzzzUypazN2QvWoTYfhbCW723SX%2B0ZlbFieBXi1YY7J7gIBXHpKWTAj2Q4%2BCa4dgdBnn8d3HEdUGlUW2Xi%2BXlSDbHrrQTK5zYO2kQgyBp3%2BIaYZB2v57Hd07YU35qEgQV377f%2FXo0E72gVN4H6btm4nsvMaw%3D) | The title clearly and concisely describes the main change: rejecting empty path parameters before URL substitution. | | Linked Issues check | ![Passed](https://cdn.trylle.com/media/images/9b9f7fc0af96c9889ff30dd8dc8752bd?key=Aec7YlhhL%2FWojK8gn54mkt9KD7Uvp%2B14YdVeU%2F7AOnbnO8x76NKhQn886i%2FCQT5dcj7%2FiiBjzzzUypazN2QvWoTYfhbCW723SX%2B0ZlbFieBXi1YY7J7gIBXHpKWTAj2Q4%2BCa4dgdBnn8d3HEdUGlUW2Xi%2BXlSDbHrrQTK5zYO2kQgyBp3%2BIaYZB2v57Hd07YU35qEgQV377f%2FXo0E72gVN4H6btm4nsvMaw%3D) | Issue `#119` requires empty path\-placeholder values to fail with INVALID\_INPUT before URL substitution. `engine/request.ts` now rejects `value === ""` together with missing values in `substituteUrl`. Th… | | Out of Scope Changes check | ![Passed](https://cdn.trylle.com/media/images/9b9f7fc0af96c9889ff30dd8dc8752bd?key=Aec7YlhhL%2FWojK8gn54mkt9KD7Uvp%2B14YdVeU%2F7AOnbnO8x76NKhQn886i%2FCQT5dcj7%2FiiBjzzzUypazN2QvWoTYfhbCW723SX%2B0ZlbFieBXi1YY7J7gIBXHpKWTAj2Q4%2BCa4dgdBnn8d3HEdUGlUW2Xi%2BXlSDbHrrQTK5zYO2kQgyBp3%2BIaYZB2v57Hd07YU35qEgQV377f%2FXo0E72gVN4H6btm4nsvMaw%3D) | The changes stay within issue `#119`. The `substituteUrl` guard implements the requested behavior. The three engine tests provide the required regression coverage and positive control. |

Full details: Linked Issues check

**Explanation** Issue `#119` requires empty path\-placeholder values to fail with INVALID\_INPUT before URL substitution. `engine/request.ts` now rejects `value === ""` together with missing values in `substituteUrl`. The new tests cover non\-empty substitution, empty\-value rejection, no transport call, and missing\-value rejection.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts _{Comment `@coderabbitai help` to get the list of available commands.} 62:["$","$L75",null,{"entries":[{"key":["platform",{"userId":"anon"},"pulls","page",{"owner":"monid-ai","repo":"monid","pullNumber":200}],"data":{"repositoryId":"4088","detail":{"author":{"avatarUrl":"https://cdn.trylle.com/media/images/f43f80860ed4683406981cbe240c0fd9?key=ASBgJR3IpfPKE386ClZhSQBu%2FPrtt41BP8s3E3UyqdKWoLlTR1PXxHV5hYIb7ysHVsBxGQv%2BimNOG5JLH67FIi06hWYP%2B6GFemhtwk2Ugnn%2BYRewxcr7K%2FYc7jnRtEDGi4PCh8EyIWUHE3FsaKzXZ2HDFUJ%2FLBgvczUoTRqTPZwO7K4a2JglmVNrJzA%3D","externalProvider":"github","login":"suzhiguo7","type":"User","url":"https://github.com/suzhiguo7"},"authorId":"192097495","baseRefName":"main","closedAt":null,"comments":2,"createdAt":"2026-10-25T15:06:59Z","headRefName":"suzhiguo7/fix/engine-empty-path-params","id":"4957556","isDraft":false,"labels":[],"number":200,"repository":{"name":"monid","owner":"monid-ai","provider":"forgejo"},"state":"open","title":"fix(engine): reject empty path params before url substitution","updatedAt":"2026-10-25T15:09:44Z","url":"https://trylle.com/monid-ai/monid/pulls/200","body":"$78","additions":70,"deletions":2,"changedFiles":2,"commits":1,"reviewComments":1,"headSha":"7fb1d141991e8bedf88900ef0b32b890693c0597","baseSha":"09d54479142e36eff876383beacfbd37b33b5908","headRepoOwner":"monid-ai","headRepoName":"monid","isMerged":false,"mergeCommitSha":null,"mergedBy":null,"mergeable":true,"mergeableState":"clean","conflictingFiles":null,"requestedTeams":[],"requestedReviewers":[],"graphqlId":"issue:200"},"comments":[{"id":27021348,"graphqlId":"27021348","body":"$79","createdAt":"2026-10-25T15:07:16Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/d39e0f17743c08d7bf625ba6f80c545a?key=Ac3dCIMfeEeTRToXUBeRdRfe7IGnH7FaknGcutnXETLNIDauVDMEeYfL%2BNJ1UW6PltLPYQ8AAbXVYTqKXZ2sbxmdR%2FJeAINpLPz%2Fgbhi3if42haJXKHU1rlVIjj4bCQzj6%2FWYhkNT360oU7wzsBjYZsV7FyaaYuuIlrb3O4TqxAm%2FsfmH46nFvfFacg%3D","externalProvider":"github","login":"coderabbitai[bot]","type":"Bot","url":"https://github.com/apps/coderabbitai"}}],"commits":[{"sha":"7fb1d141991e8bedf88900ef0b32b890693c0597","message":"fix(engine): reject empty path params before url substitution\n\nAn empty string supplied for a {pathParam} placeholder passed schema\nvalidation (the base RunInput path-param shape is z.string(), and\nconnector schemas don't consistently add minLength) and was substituted\ninto the url, producing an empty path segment like /v1/items//sub — a\nurl that can address a different vendor route, sent with the endpoint's\ncredentials.\n\nTreat an empty placeholder value like a missing one in substituteUrl:\nINVALID_INPUT before any request is built. Regression tests cover\nrejection of the empty value (asserting no request leaves the engine),\na non-empty positive control, and the pre-existing missing-value guard.\n\nFixes #119\n","createdAt":"2026-10-25T23:04:35+08:00","author":{"avatarUrl":"","login":"","name":"suzhiguo7","type":"User","url":""},"verification":{"verified":false,"reason":"gpg.error.not_signed_commit"}}],"events":[],"reviews":[{"id":3636309,"state":"REQUEST_REVIEW","author":{"avatarUrl":"https://cdn.trylle.com/media/images/1ec5c00f9995b5dc5ca35af1a0870887?key=AaIaiXNENNoLHWYsNT9HhOMffcuSHcUM0aNJr7rpnJJaybk8kOBUO0z9tl87uDS%2BldW83peTE%2B%2BpbIdbg6scl4vuXQQlVZvucTGYTNh7Bh99jjJ%2FK6zS2g9Vwtc%2B02qF4HsZBMLgEqny6b%2B7nWvpfnkQrM5bdVZ3uRDt4yIY2KCKwuHYv5ypOCsoz6I%3D","externalProvider":"github","login":"ooctoo777","type":"User","url":"https://github.com/ooctoo777"},"submittedAt":"2026-10-25T15:06:59Z","official":false}],"stackEvents":[],"commentPagination":{"totalCount":2,"perPage":30,"loadedPages":[1]},"eventPagination":{"loadedPages":[1],"hasMore":false},"headRefDeleted":false},"fetchedAt":1793524400236}],"children":"$L7a"}] 64:null 6b:[["$","title","0",{"children":"Commits · fix(engine): reject empty path params before url substitution · monid-ai/monid | Trylle"}],["$","meta","1",{"name":"description","content":"Commits on fix(engine): reject empty path params before url substitution (#200) in monid-ai/monid."}],["$","meta","2",{"name":"application-name","content":"Trylle"}],["$","link","3",{"rel":"manifest","href":"/manifest.json","crossOrigin":"$undefined"}],["$","meta","4",{"name":"keywords","content":"Commits · fix(engine): reject empty path params before url substitution · monid-ai/monid, monid-ai/monid, monid-ai/monid repository, monid, TypeScript repository, source code, trylle, agent-native git platform, git platform for agents and humans, git platform for ai agents, coding agent pull requests, ai code review, repository automation, stacked pull requests, two-way github sync, github-compatible actions, try cli"}],["$","meta","5",{"name":"robots","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","6",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","7",{"name":"googlebot","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","8",{"name":"twitter:domain","content":"trylle.com"}],["$","meta","9",{"name":"twitter:url","content":"https://trylle.com/monid-ai/monid/pulls/200/commits"}],["$","link","10",{"rel":"canonical","href":"https://trylle.com/monid-ai/monid/pulls/200/commits"}],["$","meta","11",{"name":"format-detection","content":"telephone=no"}],["$","meta","12",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","13",{"name":"apple-mobile-web-app-title","content":"Trylle"}],["$","meta","14",{"name":"apple-mobile-web-app-status-bar-style","content":"black-translucent"}],["$","meta","15",{"property":"og:title","content":"Commits · fix(engine): reject empty path params before url substitution · monid-ai/monid | Trylle"}],["$","meta","16",{"property":"og:description","content":"Commits on fix(engine): reject empty path params before url substitution (#200) in monid-ai/monid."}],["$","meta","17",{"property":"og:url","content":"https://trylle.com/monid-ai/monid/pulls/200/commits"}],["$","meta","18",{"property":"og:site_name","content":"Trylle"}],["$","meta","19",{"property":"og:locale","content":"en_US"}],["$","meta","20",{"property":"og:image","content":"https://trylle.com/api/og.png?kind=repo&owner=monid-ai&repo=monid"}],["$","meta","21",{"property":"og:image:secure_url","content":"https://trylle.com/api/og.png?kind=repo&owner=monid-ai&repo=monid"}],["$","meta","22",{"property":"og:image:type","content":"image/png"}],["$","meta","23",{"property":"og:image:width","content":"1200"}],["$","meta","24",{"property":"og:image:height","content":"630"}],["$","meta","25",{"property":"og:image:alt","content":"monid-ai/monid repository preview on Trylle"}],["$","meta","26",{"property":"og:type","content":"website"}],["$","meta","27",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","28",{"name":"twitter:site","content":"@trylle"}],["$","meta","29",{"name":"twitter:title","content":"Commits · fix(engine): reject empty path params before url substitution · monid-ai/monid | Trylle"}],["$","meta","30",{"name":"twitter:description","content":"Commits on fix(engine): reject empty path params before url substitution (#200) in monid-ai/monid."}],["$","meta","31",{"name":"twitter:image","content":"https://trylle.com/api/og.png?kind=repo&owner=monid-ai&repo=monid"}],["$","meta","32",{"name":"twitter:image:alt","content":"monid-ai/monid repository preview on Trylle"}],["$","link","33",{"rel":"icon","href":"/favicon.png","type":"image/png"}],["$","link","34",{"rel":"icon","href":"/favicon-white.png","type":"image/png","media":"(prefers-color-scheme: dark)"}],["$","link","35",{"rel":"apple-touch-icon","href":"/logo192.png"}],["$","$L7b","36",{}]]

Commits on Sun, Oct 25, 2026