Skip to content

web: unwrap Infernet's { data } balance envelope (adult gate refused everyone) - #319

Merged
ralyodio merged 1 commit into
masterfrom
fix/balance-envelope
Nov 11, 2026
Merged

ralyodio merged 1 commit into
masterfrom
fix/balance-envelope

Conversation

@ralyodio

Copy link
Copy Markdown
Collaborator

Infernet's /api/v1/billing/balance answers { data: {...} }; balanceFor returned the envelope, so total_spendable_usd and admin read as undefined everywhere. Adult mode answered 402 needs a paid compute balance to every account (an admin with $12.62 spendable hit it at 10:37 after #314/#316 were live), and /api/v1/me showed $0 to web, desktop, TUI and CLI. New unwrapData + tests; bun test 8 pass.

🤖 Generated with Claude Code

balanceFor returned { data: {...} } as is, so every caller read
total_spendable_usd/admin as undefined: the adult gate refused every
account (paid or admin) with 'needs a paid compute balance', and /me
showed a 0 balance in web, desktop, TUI and CLI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@ralyodio
ralyodio merged commit f7370cc into master Nov 11, 2026
9 of 10 checks passed
@ralyodio
ralyodio deleted the fix/balance-envelope branch November 11, 2026 10:40
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

14 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 9 | LOW: 4

Severity Rule Location
HIGH js-ssrf-outbound-request apps/web/public/sw.js:24
MEDIUM js-unescaped-html-sink apps/web/src/app/blog/[slug]/page.tsx:53
MEDIUM js-unescaped-html-sink apps/web/src/app/layout.tsx:109
MEDIUM sql-template-interpolation apps/web/src/lib/chat/push.ts:476
MEDIUM sh-remote-script-execution scripts/dev-setup.sh:25
MEDIUM sh-eval-expansion scripts/dev-setup.sh:35
MEDIUM sh-remote-script-execution scripts/install.sh:185
MEDIUM sh-remote-script-execution scripts/install.sh:210
MEDIUM sh-remote-script-execution scripts/install.sh:408
MEDIUM sh-remote-script-execution scripts/install.sh:450
LOW py-ssrf-outbound-request examples/business-strategist-agent/chat.py:37
LOW py-ssrf-outbound-request examples/business-strategist-agent/train.py:54
LOW secret-generic-credential node/crates/c0mpute-core/src/webhook.rs:1171
LOW py-path-traversal node/crates/c0mpute-core/tests/fixtures/fake-infernet-text:29

Snippets are redacted; ThreatCrush never prints matched credential material.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant