Skip to content

Skip /config/dump pre-flight for md/llm endpoints in playground - #2224

Merged
ntohidi merged 1 commit into
developfrom
fix/playground-2222
Sep 14, 2026
Merged

ntohidi merged 1 commit into
developfrom
fix/playground-2222

Conversation

@SohamKukreti

Copy link
Copy Markdown
Collaborator

Summary

Fixes #2222

The playground validated the Advanced Config editor via /config/dump for every endpoint, including md and llm where the panel is hidden and its result is never used. That pre-flight sends the legacy { type, code } protocol, which the server removed in the 0.8.x security fixes and rejects loudly since 0.9.3 (code is a forbidden field on untrusted requests). The fallback only rescued crawl, so md/llm (and crawl_stream) aborted with field 'code' is not permitted on CrawlerRunConfig from an untrusted request before their request was ever sent.

The fix skips the /config/dump pre-flight unless the endpoint is crawl or crawl_stream. Behavior inside the guard is unchanged.

List of files changed and why

  • deploy/docker/static/playground/index.html - wrap the /config/dump pre-flight in runCrawl() with an endpoint guard so md/llm skip it; drop the now-redundant isCrawlEndpoint check inside the catch fallback.

How Has This Been Tested?

Manually verified and tested the playground
and
Drove the real playground UI with headless Chromium against a clean unclecode/crawl4ai:0.9.3 Docker container (the affected release):

  • md: fit / raw / bm25+query / llm-filter, both cache modes - all succeed; only POST /md fires, no /config/dump call
  • llm with a question - succeeds via GET /llm/{url}?q=...
  • crawl with the default snippet - behavior unchanged: /config/dump -> fallback -> /crawl, succeeds
  • crawl_stream with the default snippet - now works (streams from /crawl/stream; on stock 0.9.3 it aborted like md)
  • Error paths intact: an invalid URL surfaces the server error; editor content can no longer affect md/llm

Checklist:

  • My code follows the style guidelines of this project
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have added/updated unit tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes

…yground

md/llm runs died before their request was sent: the pre-flight sends the legacy 'code' field, which 0.9.3 rejects on untrusted requests (fixes #2222).
@SohamKukreti
SohamKukreti changed the base branch from main to develop September 1, 2026 08:03

@ntohidi ntohidi left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Diagnosis is right and I'd take this — md/llm were failing on a pre-flight whose result they never used, and dropping the isCrawlEndpoint check is what actually unblocks crawl_stream. Both good.

But this fixes half of #2222, and the other half is worth saying out loud before the issue gets closed.

/config/dump takes {type, params} now. The playground still sends {type, code}, and code is on the untrusted forbidden list, so that call always 400s — for crawl too, not just md/llm. What's left on crawl is the regex fallback, which means:

  • Default snippet (stream=True, cache_mode=CacheMode.BYPASS) → fallback fires, request goes out as {stream: true}. The cache_mode line is silently dropped. Looks like it worked.
  • Switch type to BrowserConfig → that template has no stream=True, so no fallback, hard ✖ config error and the run aborts. The panel is unusable.

So the Advanced Config editor is dead on the one endpoint that still shows it, and on the default path it quietly discards whatever the user typed beyond stream. That's arguably worse than the loud error md was giving.

Not asking you to fix it here — the real fix isn't a playground tweak. The server dropped code on purpose (it was a construction oracle), so a Python-snippet editor can't come back. It needs either a params/JSON editor or the panel removed, and that's a separate PR with a UI decision in it.

Two small things in this one, fine as follow-ups:

  • pyConfigToJson() is what writes #cfg-status. md/llm no longer call it, so a ✖ config error left over from a previous crawl run stays on screen.
  • The fallback comment says "so shouldUseStream + server load agree", which reads like the fallback is a normal mode. It's a workaround for a broken pre-flight. A line saying so would save the next person some digging.

Merging this as the one-line unblock. Will link a follow-up issue for the editor so it doesn't get closed with #2222.

@ntohidi
ntohidi merged commit 72cc980 into develop Sep 14, 2026
3 checks passed
@ntohidi

ntohidi commented Sep 14, 2026

Copy link
Copy Markdown
Collaborator

Follow-up filed as #2260 for the Advanced Config panel.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: Playground: /md and /llm endpoints always fail because Advanced Config code is sent to /config/dump

2 participants