http: no route slot takes a callback (#877)

[InauguralPhysicist]

The bug

http_route's third element is a response body, but the signature named it handler — which means "callback" in every mainstream HTTP framework. Passing a function stringified it into the route table, so a live endpoint answered 200 with a debug repr, silently and remote-visibly:

/fn       -> <fn hello>    [HTTP 200]

Wider than filed

The issue reports the 3-element body slot. Testing every slot found the 4-element code form has the same hole — a function as the source stringifies to <fn hello>, gets compiled as EigenScript, and serves null with a 200:

correct   -> pong          [200]
fn        -> <fn hello>    [200]   <- as filed
builtin   -> <builtin>     [200]   <- as filed (anticipated)
code-fn   -> null          [200]   <- NOT in the issue

So the guard covers every slot — method, path, kind, body/source — each with a message naming its own next step. VAL_FN/VAL_BUILTIN are the only value types with no sensible rendering; dicts, lists, numbers, buffers and text-builders all stringify to something a client can use, so that is the whole of the class.

One constraint the issue didn't mention

rt_error sets the error flag and returns rather than unwinding. Raising after the existing value_to_string calls would strand the strdup'd method/path in a route slot that route_count never reaches — a leak on the error path. The guard therefore runs before any allocation.

Registration time is also the right moment, per the issue: the error lands on the line the author wrote, before the socket is listening, instead of on a client's request.

Naming

Since the name is what invites the mistake: handler → body in the BUILTINS signature, in the four lib/http.eigs wrappers (which propagated it verbatim into the stdlib) and their STDLIB entries, and in http_route's arity error.

The test, and two things the planted fault caught in it

Suite HS35 pins all six rejections, that all four valid body forms still register, and that an uncaught callable aborts before http_serve. Both of the following were found by running the fault, not by reading the test:

1. The startup case is bounded by timeout, and that is load-bearing. With the guard regressed, http_serve IS reached and the server runs forever — unbounded, the case would hang the suite rather than fail it. It now reports rc=124 as an explicit failure.
2. A fourth assertion was written and then removed. "Nothing listens on the port" passed under the planted fault, because timeout had already killed the server before the check ran. A test that cannot fail when it matters is noise, so it is gone; the three remaining assertions carry the detection.

Planted fault: with route_slot_is_callable stubbed to return 0 and the binary rebuilt, all three HS35 assertions fail in ~5s.

Gates

gate	result
release suite	3786/3786, 0 failed
asan-http + UBSan, detect_leaks=1	3916/3916, 0 failed — LeakSanitizer tally at its 0 floor
HTTP integration suite	45/45, 0 failed

(ext_http.c is sanitized via make asan-http, not make asan — the latter compiles with EIGENSCRIPT_EXT_HTTP=0.)

Behavior change

A function in a route slot previously registered and served a 200; it now raises type_mismatch at registration. That is the point of the fix, and there are no external consumers to migrate.

Closes #877

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR fixes a class of silent, remote-visible HTTP routing bugs by rejecting callable values (functions/builtins) in any http_route slot at registration time, and aligns the public-facing naming/docs to clarify that the 3rd element is a literal response body (not a callback). It also adds an integration test to pin the new behavior and prevent regressions that could otherwise hang the test suite.

Changes:

• Add registration-time validation in http_route to reject callable values in method/path/kind/body/source slots.
• Rename the documented/stdlib-facing parameter from handler → body to reduce “callback” confusion.
• Add HS35 integration coverage for all callable-slot rejections and for abort-before-http_serve behavior.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/ext_http.c	Adds callable-slot guard and updates http_route arity message.
tests/test_http_server.sh	Adds HS35 integration assertions for callable-slot rejection and startup abort behavior.
lib/http.eigs	Renames stdlib wrapper parameters to body and updates wrapper comments.
docs/STDLIB.md	Updates stdlib docs to reflect body parameter and “not a callback” guidance.
docs/BUILTINS.md	Updates builtin signatures/docs to use body and document the new rejection behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.