title: "#2219 — [BUG] decentralized-api: admin API cannot disable, enable or delete a node whose id contains "/"" source: https://github.com/gonka-ai/gonka/issues/2219 issue_number: 2219 synced_at: 2026-11-05T11:10:06Z template: issues-main.html
[BUG] decentralized-api: admin API cannot disable, enable or delete a node whose id contains "/" #2219
Summary
POST /admin/v1/nodes accepts a node id that contains /, for example Qwen/Qwen3-4B-Instruct-2507:host--secondary. After that, the node cannot be disabled, enabled or deleted through the admin API. Echo does not unescape path parameters, so the handlers look up Qwen%2FQwen3-… and do not find the node. DELETE still returns 200.
Motivation
Node ids built from model names contain /. Such a node stays in the broker until the API is restarted with a changed configuration.
Impact
- Who is affected: hosts whose node ids contain
/. - Limited to that node.
- Likelihood: edge case; the create endpoint accepts these ids.
- Affected components:
decentralized-apiadmin API.
Detailed description
The routes take :id from the raw path (server.go#L70-L72). deleteNode, enableNode and disableNode pass c.Param("id") to the broker as is (node_handlers.go#L25-L43, #L246-L247, #L273-L274). The MLNode callback already unescapes model_id (post_generated_artifacts_v2_handler.go#L19-L28).
Reproduced with a test on setupTestServer (real broker, Echo v4.15.1), at 8af3f3f and release/v0.2.16-post1. The id is passed through url.PathEscape.
| Step | Id with / |
Id without / |
|---|---|---|
POST /admin/v1/nodes |
200 | 200 |
POST …/nodes/<id>/disable |
404 node not found: Qwen%2FQwen3-… |
200, enabled=false |
POST …/nodes/<id>/enable |
404, same body | 200, enabled=true |
DELETE …/nodes/<id> |
200, body false |
200, body true |
GET /admin/v1/nodes |
node still listed, enabled=true |
[] |
The same 404 body came from a DevNet host on v0.2.16-post1.
🔄 Auto-synced from Issue #2219 every hour.