Skip to content

fix: Create the action attempts client only when waiting - #1016

Open
razor-x wants to merge 2 commits into
mainfrom
claude/js-sdk-audit-6x115l-l8b-lazy-action-attempts
Open

fix: Create the action attempts client only when waiting#1016
razor-x wants to merge 2 commits into
mainfrom
claude/js-sdk-audit-6x115l-l8b-lazy-action-attempts

Conversation

@razor-x

@razor-x razor-x commented Aug 24, 2026

Copy link
Copy Markdown
Member

Problem

SDK audit finding L8b (low): every generated action-attempt route method eagerly constructed a fresh SeamHttpActionAttempts client — fromClient → constructor → full parseOptions — inside the request config. Since SeamHttpRequest is lazy, this work ran even when the request was never awaited, and even when waitForActionAttempt was disabled. The client is only consumed when a wait actually happens.

Fix

Codegen emits a thunk (actionAttempts: () => SeamHttpActionAttempts.fromClient(...)) and execute() resolves it only on the waiting path. The config still accepts a plain client for compatibility. Regenerated route files.

Tests

New test hand-builds a request with a counting thunk: building the request and awaiting it with waitForActionAttempt: false never constructs the client; awaiting with waiting enabled constructs it exactly once and resolves the attempt. Existing wait-for-action-attempt suite covers the generated thunk path end to end. Full suite (126 tests), lint, typecheck green.

Part of applying the rev-3 SDK audit (one PR per finding). Related: #1002#1015.

🤖 Generated with Claude Code

https://claude.ai/code/session_01B8xeJm2Hd923k8uo6eoFd2


Generated by Claude Code

Every action attempt route call eagerly constructed a full
SeamHttpActionAttempts client, including complete option parsing, even
when the request was never awaited or waiting was disabled.

Generate a thunk instead and resolve it inside execute only when the
request actually waits for the action attempt. A plain client is still
accepted for compatibility.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B8xeJm2Hd923k8uo6eoFd2
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants