Knowledge Tree

🐛 Bugs

7 min read

2026-02-28: OpenRouter models[] Overflow in Routing Payload

🔴 Issue

OpenRouter requests failed with: "'models' array must have 3 items or fewer."

🔍 Root Cause

  • src/scripts/api.js built OpenRouter routing payload as [primaryModel, ...fallbackModels].
  • Primary + three fallbacks produced models[] length 4, exceeding OpenRouter limit (<=3).

✅ Fix

  • Added OpenRouter routing cap and dedupe in buildApiPayload(...).
  • Added normalization for model key dedupe (including :online variants).
  • Filtered stale fallback IDs against synced model catalog when available.
  • Added defensive server-side clamp in server.py for OpenRouter payloads.

📁 Files Changed

  • src/scripts/api.js
  • server.py
  • docs/bug-analysis.md

🧪 Verification

  • Syntax checks passed (node --check, py_compile).
  • Live proxy test with 4 routing models returned 200 and no max-items error.

2026-01-23: API Key Management Refactor (Server Proxy)

🔴 Issue

Tree generation broken after moving API keys from config.js to .env.

🔍 Root Cause

Browser JavaScript cannot read .env files. The api.js import of API_KEY from config.js yielded undefined, causing all LLM calls to fail with 401 Unauthorized.

✅ Fix

Implemented server-side LLM proxy:

  • server.py: Added /api/llm proxy endpoint that loads keys from .env
  • api.js: Refactored to POST to proxy instead of direct provider calls
  • Added /api/config endpoint for provider availability (no secrets)

📁 Files Changed

  • server.py - LLM proxy + config endpoints
  • src/scripts/api.js - Use proxy, remove config.js import
  • .env.example - New template
  • src/scripts/config.js - Deprecated

🔐 Security

API keys now secure on server, never sent to browser.

2026-01-23: Tree Generation Blocked by CSP

🔴 Issue

Tree generation not working - API calls to GROQ silently failing.

🔍 Root Cause

Content Security Policy (CSP) in index.html was missing https://api.groq.com in connect-src directive.

Browser blocked all fetch requests to GROQ API due to CSP violation:

connect-src https://openrouter.ai https://api.openai.com  ← Missing GROQ!

✅ Fix

Added https://api.groq.com and 'self' to CSP connect-src:

connect-src 'self' https://api.groq.com https://openrouter.ai https://api.openai.com https://cdnjs.cloudflare.com

📁 Files Changed

  • index.html - CSP meta tag updated

🧪 Verification

  1. Open app at http://localhost:50080 (historically 8080)
  2. Enter topic and press Enter
  3. Tree should generate successfully
  4. Check Network tab - GROQ requests return 200

2026-01-23: Debug Panel UX Improvement

🔄 Change

Converted debug panel from centered overlay modal to right-side slide-in drawer that pushes content.

📁 Files Changed

  • src/styles/components.css - Drawer positioning and push animation
  • src/scripts/ui.js - Body class management for push effect

✨ Benefits

  • Less intrusive - doesn’t block entire screen
  • Content remains partially visible
  • Smoother UX with push animation

2026-01-23: Security Configuration Leak (Gitignore Drift)

🔴 Issue

Active API keys and local read-only vault exposed to version tracking.

🔍 Root Cause

  • Gitignore Drift: File renames and structural changes caused paths in .gitignore to misalign.
  • The real .env file containing active provider API keys and the private vault folder _jamdata-important_READ-ONLY/ were not ignored.

✅ Fix

Overwrote .gitignore with strict ignore definitions including .env, the data vault, stale logs, macOS finder files, and python cache/build outputs.

📁 Files Changed

  • .gitignore

🧪 Verification

  • Checked git status output to confirm that local .env and vault folders are excluded from tracking.

2026-01-23: Codebase Clutter (Obsolete Artifacts & Cruft)

🔴 Issue

Redundant code files, stale system logs, and macOS filesystem metadata files cluttered the active workspace.

🔍 Root Cause

  • Code Residue: Deprecated config.js and .config.js.example left behind after the API key to .env migration for “backwards compatibility”.
  • OS Metadata: Finder .DS_Store files generated in root, src/, and tree/ directories.
  • Empty Folder Fossil: A blank tree/ directory left as a remnant of a former project layout.

✅ Fix

Created a dedicated quarantine directory structure (obsolete/{deprecated-code, stale-logs, macos-cruft, misc}) and migrated the obsolete files there. Removed empty folders.

📁 Files Changed

  • Moved src/scripts/config.js and src/scripts/config.js.example to obsolete/deprecated-code/
  • Moved .DS_Store files to obsolete/macos-cruft/
  • Removed empty folder tree/

2026-01-23: Log Accumulation (Stale JSONL Logs)

🔴 Issue

Daily debug logs accumulated continuously without rotation, inflating project size.

🔍 Root Cause

The server wrote detailed debug-*.jsonl files every day to logs/ but had no cleanup schedule or rotation policy.

✅ Fix

Quarantined old logs (debug-2026-01-23.jsonl and debug-2026-02-28.jsonl) to obsolete/stale-logs/ and updated .gitignore to exclude logs/*.jsonl from version control.

📁 Files Changed

  • .gitignore
  • Moved stale logs to obsolete/stale-logs/

2025-09-18: XSS Vulnerabilities via innerHTML Injections

🔴 Issue

Multiple critical P0 XSS vulnerabilities identified throughout UI rendering modules.

🔍 Root Cause

Unsanitized node titles and details injected directly into the DOM using innerHTML at:

  • ui.js lines 34, 142, 174, 260
  • index.html line 441

This permitted execution of arbitrary malicious scripts embedded in generated or loaded tree JSON structures.

✅ Fix

Removed all innerHTML injections. Replaced them with safe DOM node creation and textContent assignments, establishing a strict sanitization protocol.

📁 Files Changed

  • src/scripts/ui.js
  • index.html

2025-09-18: Inline Event Handlers

🔴 Issue

Scattershot inline event handlers exposed the application to DOM injection attacks.

🔍 Root Cause

Over 47+ inline handler attributes (e.g., onclick="window.something()") used in tree.js:222+, ui.js:41+, and index.html:297+.

✅ Fix

Removed inline attributes entirely and transitioned UI interaction hookups to modular event listener bindings in JS.

📁 Files Changed

  • src/scripts/tree.js
  • src/scripts/ui.js
  • index.html

2025-09-18: Content Security Policy (CSP) Security Theater

🔴 Issue

Content Security Policy was bypassable, negating actual security checks.

🔍 Root Cause

CSP metadata in index.html contained permissive directives (unsafe-inline and unsafe-eval) under script-src which allowed script injections.

✅ Fix

Tightened CSP policy inside the meta headers by removing the unsafe configuration overrides.

📁 Files Changed

  • index.html

2025-09-18: Event Listener Memory Leaks

🔴 Issue

System memory usage climbed continuously by approximately 2MB for every 10 minutes of active use.

🔍 Root Cause

D3 nodes and custom DOM elements added/bound new event listeners recursively during redraw loops without disposing of previous bindings.

✅ Fix

Implemented dynamic listener disposal lifecycle hooks inside D3 tree viz updates and UI panel removals.

📁 Files Changed

  • src/scripts/tree.js
  • src/scripts/ui.js

2025-09-18: DOM Thrashing & Unoptimized D3 Rendering

🔴 Issue

Regenerating the tree caused the browser window to lock up for 2 to 4 seconds.

🔍 Root Cause

The tree redraw routine carried out full DOM teardowns and reconstructions rather than leveraging D3’s incremental enter/update/exit selection patterns.

✅ Fix

Refactored tree renderer to utilize D3 key-based object bindings, enabling smooth transition animations and reusing DOM nodes.

📁 Files Changed

  • src/scripts/tree.js

Legacy: D3 NaN Path Rendering Errors

🔴 Issue

Console flooded with path coordinate parse errors: Error: <path> attribute d: Expected number, "MNaN,NaNCNaN,NaN,..."

🔍 Root Cause

D3 link generator evaluated coordinate values before they were initialized by the layout layout engine, feeding invalid NaN properties to SVG path string rendering.

✅ Fix

Wrapped link updating paths in validation checks ensuring numeric properties exist before generating SVG drawing instructions.

📁 Files Changed

  • src/scripts/tree.js

Legacy: CSP JS Map Block

🔴 Issue

JS Source maps blocked from loading (e.g. Refused to connect to 'https://cdnjs.cloudflare.com/ajax/libs/jspdf/2.5.1/jspdf.umd.min.js.map').

🔍 Root Cause

CSP connect-src limited fetch calls only to openrouter.ai and api.openai.com, rejecting CDN JS map queries.

✅ Fix

Expanded CSP meta tag config to permit CDN assets under connect-src.

📁 Files Changed

  • index.html

Legacy: Background Script Injection Queue Failures

🔴 Issue

Logs reported: 🔌 [UAC-CONTENT][INJECTION_FAILED] Background script failed to queue injection.

🔍 Root Cause

Extension load race condition where content scripts called injection methods before background scripts completed initialization.

✅ Fix

Implemented retry-and-queue logic inside content scripts to buffer queries until injection availability resolves.

📁 Files Changed

  • src/scripts/debugLog.js

Legacy: Export Click Failure

🔴 Issue

Export button click produced no action.

🔍 Root Cause

A registration oversight in UI setup left the trigger click callbacks unbound.

✅ Fix

Added explicit event listener bindings linking the settings panel export click triggers to export logic functions.

📁 Files Changed

  • src/scripts/ui.js

Graph View

Backlinks