Summary
The backend accepts outputFormat as either an object map or an array of { key, type } rows. When the array form contains duplicate keys, normalizeOutputFormat collapses it into an object before validation, so the duplicate is silently overwritten.
Reproduction
validatePostScript({
name: 'duplicate-output',
content: 'Analyze {{summary}}.',
outputFormat: [
{ key: '_chip_risk', type: 'string' },
{ key: '_chip_risk', type: 'number' },
],
})This is accepted and normalized to the last value.
Workflow output formats have the same issue for non-terminal duplicate keys.
Expected behavior
Array-form output formats should reject duplicate keys before normalization.
Impact
API callers can submit ambiguous schemas that the frontend would reject, and the backend's duplicate-key validation does not catch them because the duplicate is already lost.
Suggested fix
Detect duplicate keys in array-form output formats before calling or immediately after parsing for normalization, then surface a 422 validation error for workflow and post-script validators.
Summary
The backend accepts
outputFormatas either an object map or an array of{ key, type }rows. When the array form contains duplicate keys,normalizeOutputFormatcollapses it into an object before validation, so the duplicate is silently overwritten.Reproduction
This is accepted and normalized to the last value.
Workflow output formats have the same issue for non-terminal duplicate keys.
Expected behavior
Array-form output formats should reject duplicate keys before normalization.
Impact
API callers can submit ambiguous schemas that the frontend would reject, and the backend's duplicate-key validation does not catch them because the duplicate is already lost.
Suggested fix
Detect duplicate keys in array-form output formats before calling or immediately after parsing for normalization, then surface a 422 validation error for workflow and post-script validators.