fix(agent): validate assistant model requests

src/lib/llm/models.ts

@@ -41,9 +41,8 @@ export function normalizeLlmModelsPayload(payload: unknown): LlmModelOption[] {
     if (typeof row !== "object" || row === null || !("id" in row)) continue;
     const id = (row as { id?: unknown }).id;
     if (typeof id !== "string") continue;
-    const trimmed = id.trim();
+    if (!isValidLlmModelId(id)) continue;
-    if (!isValidLlmModelId(trimmed)) continue;
+    ids.add(id);
-    ids.add(trimmed);
   }
 
   return [...ids].sort((a, b) => a.localeCompare(b)).map((id) => ({ id, label: id }));
@@ -101,8 +100,8 @@ export function resolveAssistantModel(options: {
     ? options.fallbackModel
     : (options.models[0]?.id ?? options.fallbackModel);
 
-  if (options.requestedModel) {
+  if (options.requestedModel !== null && options.requestedModel !== undefined) {
-    if (!available.has(options.requestedModel)) {
+    if (!isValidLlmModelId(options.requestedModel) || !available.has(options.requestedModel)) {
       return { ok: false, model: fallback, error: "Invalid assistant model" };
     }
     return { ok: true, model: options.requestedModel };

tests/unit/llm-models.test.ts

@@ -29,7 +29,13 @@ describe("normalizeLlmModelsPayload", () => {
 
   it("ignores invalid or empty model rows", () => {
     const models = normalizeLlmModelsPayload({
-      data: [{ id: "" }, { id: "   " }, { id: "bad model" }, { object: "model" }],
+      data: [
+        { id: "" },
+        { id: "   " },
+        { id: "bad model" },
+        { id: " llama3.2 " },
+        { object: "model" },
+      ],
     });
 
     assert.deepEqual(models, []);
@@ -111,6 +117,39 @@ describe("resolveAssistantModel", () => {
   });
 
   it("rejects invalid requested models", () => {
+    const resolved = resolveAssistantModel({
+      requestedModel: "bad model",
+      savedModel: null,
+      fallbackModel: "llama3.2",
+      models: [
+        { id: "llama3.2", label: "llama3.2" },
+        { id: "bad model", label: "bad model" },
+      ],
+    });
+
+    assert.deepEqual(resolved, {
+      ok: false,
+      model: "llama3.2",
+      error: "Invalid assistant model",
+    });
+  });
+
+  it("rejects empty requested models", () => {
+    const resolved = resolveAssistantModel({
+      requestedModel: "",
+      savedModel: null,
+      fallbackModel: "llama3.2",
+      models: [{ id: "llama3.2", label: "llama3.2" }],
+    });
+
+    assert.deepEqual(resolved, {
+      ok: false,
+      model: "llama3.2",
+      error: "Invalid assistant model",
+    });
+  });
+
+  it("rejects unavailable requested models", () => {
     const resolved = resolveAssistantModel({
       requestedModel: "missing",
       savedModel: null,