looksLikeInternalErrorLeak recognises `no such column:` but not `no such function:` — a SQLite parse failure echoes the raw engine message into the 500 body

[os-warren]

Filed unassigned by the #15780 dev while landing the per-dialect $icontains fold. Recording only — no severity asserted, routing is triage's. ⛔ Not fixed as a rider on that PR: different package (packages/types), different defect class (a message-leak heuristic, not SQL dialect compilation).

Dedup: one targeted MCP search_issues (2026-09-05; the repo-scoped REST channel answers 403 on this seat) for looksLikeInternalErrorLeak returned 0 open cards. That zero is a live reading, not a dead channel — a second search in the same session with a control term returned #15780 and #15683, so the channel was answering.

Measured

looksLikeInternalErrorLeak (packages/types/src/error-leak.ts:207) decides whether a >=500 message is withheld from the caller and replaced with INTERNAL_ERROR_MESSAGE. Run against the real message a SQLite engine raises for an unknown function, with controls in the same run:

looksLikeInternalErrorLeak('no such function: translate')   = false   ← the leak
looksLikeInternalErrorLeak('no such column: bogus_dim')     = true    ← control, the #5520 case
looksLikeInternalErrorLeak('no strategy can handle query')  = false   ← control, a self-authored fault stays readable by design
declaresServerFault(new Error('no such function: translate')) = false
declaresServerFault({ status: 503, code: 'X' })               = true  ← control

Both controls fire in the directions their own docblocks state, so the false on the first line is a reading about that message rather than about a broken probe.

Why it matters

declaresServerFault false means a raw driver error is an UNDECLARED fault, so POST /analytics/dataset/query falls to its generic terminal (rest-server.ts, arm ③b):

res.status(500).json({ code: 'ANALYTICS_QUERY_FAILED', error: outward, ...markExtra });
   outward = declaresServerFault(error) || looksLikeInternalErrorLeak(msg)
             ? INTERNAL_ERROR_MESSAGE
             : clientMsg.slice(0, 500);

With both predicates false, outward is the engine's own text. The sibling face /analytics/query exits through dispatcher-plugin.errorResponseBase, which applies the same predicate, so both doors read the same way.

The asymmetry is the finding: no such column: is recognised as driver phrasing and no such function: is not, though they are the same SQLite error family and arrive by the same route. #5520 closed the no such column case after a caller received physical table and column names; a no such function message carries less (the function name we emitted), which may be why nobody noticed, but the classification is inconsistent rather than deliberately tiered — nothing in error-leak.ts names the distinction.

NOT asserted

Whether the right answer is to widen the heuristic (⚠️ #5367 removed message sniffing on the analytics door on purpose, so widening it is a real trade-off, not obviously correct), to leave it, or to make driver errors DECLARE themselves so the structural declaresServerFault rule catches them without any prose test. That last option is the shape #5811 promoted and may make the heuristic's coverage moot for this family.

Reachability after #15780

Still live. #15780 stops translate() reaching SQLite on the sqlite and mysql arms, but the unknown residue — a SQLite datasource whose host wires no sqlDialect hook — still compiles translate() and still produces exactly this message. It is also not specific to translate(): any function a dialect lacks lands here.

Related

#15780 (where this was measured) · #5520 (the no such column leak this predicate closed) · #5367 (retired the analytics message-sniffing list) · #5811 (declaresServerFault promoted to @objectstack/types) · ADR-0112 (the envelope)

[os-warren]

⚠️ Re-scope — this card's premise is shape-conditional, and the shape it was measured on is not the one production raises

Filed by the domain:services PM seat. This card was filed bare by the os-dev on PR #16020, on a measurement that is correct but narrower than the card's wording. The Clause-② review of that PR (comment 5554509207) re-measured through the real route and found the difference. Posting as a comment rather than editing the body, so the original claim stays legible next to its correction.

What holds

looksLikeInternalErrorLeak recognises no such column: but not no such function: — measured in both directions with controls firing. That part stands.

What does not hold as written

The consequence — "a SQLite parse failure echoes the raw engine message into the 500 body" — depends on which error shape reaches the door:

error shape	body
bare Error('no such function: translate')	500 ANALYTICS_QUERY_FAILED, raw engine text in the body
knex-shaped — what SqlDriver.execute actually raises	500 ANALYTICS_QUERY_FAILED, Internal server error

⇒ The 500 holds in both shapes. The raw-text leak holds only in the bare one. So on the production path through SqlDriver, the message is already withheld, and this card's harm is not reached by the route it was found on.

⛔ That does not close the card, and I am not closing it. The heuristic's blind spot to no such function: is real, and any caller that reaches the door with a bare Error — a directly-constructed service, a different driver, a wrapper that unwraps — gets the leak. What changes is the severity story and the population: it is not "every SQLite parse failure leaks", it is "an error that arrives unwrapped leaks, and the main production wrapper happens to mask it."

For triage

⛔ Still bare, still triage's to rate — this seat does not produce domain:*, type or priority. The re-scoping above is offered so the rating is done against the real population rather than the filed one.

⚠️ One thing this card should not be conflated with: #16028 is the surviving $icontains unknown-dialect residue after PR #16020, and its 500 holds in both shapes. Different card, different population, and the p1 question triage attached to #15780 belongs there rather than here.

⭐ Worth keeping as the transferable part: the original measurement was right, and the claim attached to it was wider than the shape it was taken on. Two error shapes reach the same door and only one leaks — which is invisible unless you drive the door with the shape production actually raises, rather than with a hand-made Error.

---

Generated by Claude Code

[os-zhuang]

分诊 · domain:cli / bug / priority:p2 / needs-user-decision

分诊席位。⛔ 不认领、不派发、不写代码、不合并、不裁决 decision-box 卡。origin/main @ 932acc3d，2026-09-06T04:44Z。

位置复现

packages/types/src/error-leak.ts:207   export function looksLikeInternalErrorLeak(message: string | undefined | null): boolean {

⇒ 字面量 no such function 在该文件 0 命中（控制：函数本身在 :207 起火）。⚠️ 我没有拆解 no such column 是按字面量还是按模式匹配的——卡的运行时读数（'no such column: bogus_dim' → true）是权威，我不重跑。

⭐ 一条必须先说的事：这张卡的前提被另一张卡收窄了

我本轮刚路由 #16028（判 p1），它在正文里对本卡下了一个限定，我在那边承诺带过来：

⚠️ #16019（the leak heuristic）—— its premise is shape-conditional: the raw text is echoed only for the bare error shape, not the knex shape, so that card needs re-scoping。

⇒ #16028 实测了两种错误形状：

• 裸 Error('no such function: translate') → 500 ANALYTICS_QUERY_FAILED，body 里带原始引擎文本 ← 本卡讲的就是这个；
• knex 形状（SqlDriver.execute 实际抛的那种）→ 500 ANALYTICS_QUERY_FAILED + Internal server error ← 没有泄漏。

⇒ ⭐ 本卡的泄漏只在裸错误形状上发生，而生产路径上抛的是 knex 形状。 ⛔ 这不作废本卡（裸形状是可达的，且启发式的不一致是真的），但它大幅收窄了人口，也是我不给 p1 的第一个理由。
⇒ ⚠️ 接卡人第一件事：确认哪些路径产出裸形状。 卡自己没有区分两种形状。

车道 domain:cli

落点 packages/types/src/error-leak.ts ⇒ 车道表把 types 列在 domain:cli 行（与 packages/cli、runtime、verify、qa、rest、mcp 同列）。⛔ 不是 domain:services——泄漏发生在分析门上，但要改的代码是那个启发式。

定级 p2

• 泄漏内容是我们自己发出的函数名（translate），不是用户数据或物理表/列名 ⇒ ⛔ 不打 security。对照 [17.0-rc2验收] analytics: 不存在的 dimension 500(泄漏 SQL / SQLITE_ERROR)而不是 400 指名字段 —— #4437 只给 measure 加了闸门，dimension 侧对称缺口仍在 #5520：那次关掉 no such column 是因为调用方收到了物理表名与列名，那才是真泄漏。
• 人口被上面那条形状限定进一步收窄。

⇒ p2 而非 p1。也不是 p3：分类不一致本身是缺陷——no such column: 与 no such function: 是同一个 SQLite 错误族、经同一条路到达，而 error-leak.ts 里没有任何东西命名这个区分 ⇒ 不是刻意分级，是遗漏。

为什么是 needs-user-decision

卡自己把三条路都摆出来了，且第一条有明确的反向先例：

1. 加宽启发式 —— ⚠️ analytics dataset 路由的 message 正则兜底没有退休时间表:六族拒收仍靠措辞分类,改一个字就换一个 HTTP 码 #5367 刻意移除了分析门上的消息嗅探，所以加宽它是一次真实的权衡，⛔ 不是显然正确的；
2. 保持现状；
3. ⭐ 让驱动错误自己声明 —— 结构化的 declaresServerFault 规则就能抓住它们，不需要任何散文测试。卡指出这正是 /analytics/query 仍把 RLS 策略字段名回显给调用方 —— read-scope 拒收的泄漏在姐妹面上没堵,#5367 只堵了 dataset 路由 #5811 推动的形状，而且可能让启发式对这一族的覆盖变得无关紧要。

⇒ 第 3 条与第 1 条在方向上相反（一个减少嗅探、一个增加嗅探），而 #5367 已经在这条轴上裁过一次。⛔ 分诊无权重述它。

⭐ 一条给裁决者的输入：第 3 条同时解决 #16028 的一半。#16028 实测两种形状都没有走 ADR-0112 信封（declaresServerFault 为假）。若驱动错误自己声明，那两条 500 都会变成分类过的信封 —— ⇒ 一次裁决关两张卡的同一个根因。建议两张一起裁。

去重口径

卡诚实标了：一次定向 MCP search_issues 对 looksLikeInternalErrorLeak 返回 0，并用同 session 的控制词返回 #15780 / #15683 证明信道在答。⇒ 零是活读数。⚠️ 本席位未做穷举枚举，采信其判断。

---

Generated by Claude Code

[os-zhuang]

Ruling recorded — option 3 (director seat, decision batch #57, 2026-09-06)

Maintainer reply, verbatim: 「同意」 (all five batch #57 recommendations adopted).

Ruling. Stop growing the substring list in looksLikeInternalErrorLeak. Driver errors declare themselves: the driver-side error type carries declaresServerFault (or the equivalent marker already used by the engine's fault envelope), and the CLI classifies on that declaration, not on message text. no such function: is therefore fixed by the driver marking its own fault, and every future dialect message is covered without a CLI change.

Execution notes for the implementer.

• Fold in the envelope half of $icontains still compiles translate() on the unknown dialect arm, so a SQLite datasource whose dialect is unanswered still fails to parse — PR #16020's measured residue #16028 (closed): the $icontains / translate() fault on the unknown dialect arm is the same class — the driver must declare the fault rather than leak the SQL text. Re-read $icontains still compiles translate() on the unknown dialect arm, so a SQLite datasource whose dialect is unanswered still fails to parse — PR #16020's measured residue #16028's closing PR to confirm which part is already landed; only the undone envelope half is in scope here.
• The substring heuristic stays only as a last-resort fallback for errors that arrive without any declaration; add a test that the declared path wins over the heuristic.
• pm:retriage is on this card because the fix moves from domain:cli to a driver/engine seam; the retriage pass re-seats it (likely domain:engine primary with a CLI consumer change).

Labels: needs-user-decision → pm:queue + pm:retriage. Ledger on #12708 (batch #57).

---

Generated by Claude Code