@coffeerunhobby/mcp-ha-connect 1.2.0 → 1.3.0

package/tests/security/cryptoTransport.test.ts

@@ -0,0 +1,136 @@
+/**
+ * SEC-CRYPTO — Cryptographic / transport-security findings.
+ *
+ * OWASP API8:2023 Security Misconfiguration / A02:2021 Cryptographic Failures.
+ *
+ * H2  Per-client TLS scoping. The Omada and HA clients must NOT toggle the
+ *     process-global `NODE_TLS_REJECT_UNAUTHORIZED` env var to talk to a
+ *     self-signed controller — that disables certificate validation for EVERY
+ *     concurrent outbound request in the process (a TOCTOU race that silently
+ *     drops TLS verification for unrelated HA/AI traffic). The insecure mode
+ *     must be scoped to the single client via a per-instance undici dispatcher.
+ *
+ * L5  SSE client IDs must be generated with a CSPRNG (randomUUID), not
+ *     Math.random(), so they are not predictable/guessable.
+ */
+
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { RequestHandler } from '../../src/omadaClient/request.js';
+import { AuthManager } from '../../src/omadaClient/auth.js';
+import { generateClientId } from '../../src/server/eventSubscription.js';
+
+const ENV_KEY = 'NODE_TLS_REJECT_UNAUTHORIZED';
+
+function jsonResponse(body: unknown): Response {
+  return new Response(JSON.stringify(body), {
+    status: 200,
+    headers: { 'content-type': 'application/json' },
+  });
+}
+
+describe('SEC-CRYPTO H2: per-client TLS scoping (no global env mutation)', () => {
+  const realFetch = global.fetch;
+
+  afterEach(() => {
+    global.fetch = realFetch;
+    vi.restoreAllMocks();
+    delete process.env[ENV_KEY];
+  });
+
+  it('Omada request with strictSsl=false never mutates global NODE_TLS_REJECT_UNAUTHORIZED', async () => {
+    let envDuringFetch: string | undefined = 'SENTINEL';
+    let dispatcherDuringFetch: unknown;
+
+    global.fetch = vi.fn(async (_url: unknown, init: unknown) => {
+      envDuringFetch = process.env[ENV_KEY];
+      dispatcherDuringFetch = (init as { dispatcher?: unknown }).dispatcher;
+      return jsonResponse({ errorCode: 0, result: {} });
+    }) as unknown as typeof fetch;
+
+    const auth = {
+      getAccessToken: async () => 'access-token',
+      clearToken: () => {},
+    } as unknown as AuthManager;
+
+    const handler = new RequestHandler(
+      { baseUrl: 'https://omada.example:8043', strictSsl: false },
+      auth
+    );
+
+    await handler.get('/openapi/v1/anything');
+
+    // The env var must NOT be set at any point — it stays undefined throughout.
+    expect(envDuringFetch).toBeUndefined();
+    expect(process.env[ENV_KEY]).toBeUndefined();
+    // Insecure TLS must be carried by a per-call dispatcher instead.
+    expect(dispatcherDuringFetch).toBeDefined();
+  });
+
+  it('Omada request with strictSsl=true sends no insecure dispatcher', async () => {
+    let dispatcherDuringFetch: unknown = 'SENTINEL';
+
+    global.fetch = vi.fn(async (_url: unknown, init: unknown) => {
+      dispatcherDuringFetch = (init as { dispatcher?: unknown }).dispatcher;
+      return jsonResponse({ errorCode: 0, result: {} });
+    }) as unknown as typeof fetch;
+
+    const auth = {
+      getAccessToken: async () => 'access-token',
+      clearToken: () => {},
+    } as unknown as AuthManager;
+
+    const handler = new RequestHandler(
+      { baseUrl: 'https://omada.example:8043', strictSsl: true },
+      auth
+    );
+
+    await handler.get('/openapi/v1/anything');
+
+    expect(dispatcherDuringFetch).toBeUndefined();
+    expect(process.env[ENV_KEY]).toBeUndefined();
+  });
+
+  it('Omada auth with strictSsl=false never mutates global NODE_TLS_REJECT_UNAUTHORIZED', async () => {
+    let envDuringFetch: string | undefined = 'SENTINEL';
+    let dispatcherDuringFetch: unknown;
+
+    global.fetch = vi.fn(async (_url: unknown, init: unknown) => {
+      envDuringFetch = process.env[ENV_KEY];
+      dispatcherDuringFetch = (init as { dispatcher?: unknown }).dispatcher;
+      return jsonResponse({
+        errorCode: 0,
+        result: { accessToken: 'a', refreshToken: 'r', expiresIn: 3600 },
+      });
+    }) as unknown as typeof fetch;
+
+    const auth = new AuthManager({
+      baseUrl: 'https://omada.example:8043',
+      clientId: 'id',
+      clientSecret: 'secret',
+      omadacId: 'omadac',
+      strictSsl: false,
+    });
+
+    const token = await auth.getAccessToken();
+
+    expect(token).toBe('a');
+    expect(envDuringFetch).toBeUndefined();
+    expect(process.env[ENV_KEY]).toBeUndefined();
+    expect(dispatcherDuringFetch).toBeDefined();
+  });
+});
+
+describe('SEC-CRYPTO L5: SSE client IDs use a CSPRNG', () => {
+  it('generateClientId returns an unpredictable UUID, not a Math.random/timestamp string', () => {
+    const id = generateClientId();
+    // RFC 4122 v4 UUID shape.
+    expect(id).toMatch(
+      /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+    );
+  });
+
+  it('generateClientId returns distinct values across calls', () => {
+    const ids = new Set(Array.from({ length: 100 }, () => generateClientId()));
+    expect(ids.size).toBe(100);
+  });
+});

package/tests/security/dependencies.test.ts

@@ -0,0 +1,152 @@
+/**
+ * SEC-DEPS — Vulnerable & Outdated Components (OWASP A06:2021)
+ *
+ * Finding M9: production dependency tree shipped known-vulnerable transitive
+ * packages (hono / qs / path-to-regexp via the MCP SDK, plus a direct `ws`).
+ *
+ * These tests are the durable CI gate for that finding:
+ *   1. `npm audit --omit=dev` must report ZERO high/critical advisories in the
+ *      PRODUCTION dependency tree (dev-only tooling is out of scope). A small,
+ *      explicitly-documented allowlist exists for unavoidable transitive advisories
+ *      that have no upstream fix yet — each entry must be justified in a comment.
+ *   2. After bumping the SDK/ws, re-assert the per-request transport invariant so a
+ *      dependency upgrade can never silently change how transports are constructed.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { execFileSync } from 'node:child_process';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+
+/**
+ * Advisory IDs (GHSA / npm) we knowingly accept because there is no fixed
+ * upstream release reachable through our dependency tree. MUST stay empty unless
+ * a transitive advisory is genuinely unfixable — add the ID with a justification.
+ */
+const HIGH_CRITICAL_ALLOWLIST = new Set<string | number>([
+  // (intentionally empty — all known high/critical advisories are fixed)
+]);
+
+interface AuditAdvisory {
+  severity: string;
+  source?: number;
+  url?: string;
+  title?: string;
+  name?: string;
+}
+
+interface AuditReport {
+  vulnerabilities?: Record<
+    string,
+    {
+      severity: string;
+      via: Array<string | AuditAdvisory>;
+    }
+  >;
+  metadata?: {
+    vulnerabilities?: Record<string, number>;
+  };
+}
+
+/**
+ * Run `npm audit --omit=dev --json` and return the parsed report. npm audit exits
+ * NON-zero when advisories are present, so we capture stdout from the thrown error
+ * too. Returns null when the registry is unreachable (offline dev) so the gate
+ * skips rather than producing a false failure.
+ */
+function runProdAudit(): AuditReport | null {
+  let stdout: string;
+  try {
+    stdout = execFileSync('npm', ['audit', '--omit=dev', '--json'], {
+      encoding: 'utf8',
+      shell: process.platform === 'win32', // npm is npm.cmd on Windows
+      stdio: ['ignore', 'pipe', 'ignore'],
+      maxBuffer: 32 * 1024 * 1024,
+    });
+  } catch (err) {
+    const e = err as { stdout?: string; message?: string };
+    if (typeof e.stdout === 'string' && e.stdout.trim().startsWith('{')) {
+      stdout = e.stdout;
+    } else {
+      // Could not run audit (offline / registry down) — signal skip.
+      return null;
+    }
+  }
+
+  try {
+    return JSON.parse(stdout) as AuditReport;
+  } catch {
+    return null;
+  }
+}
+
+describe('SEC-DEPS — Vulnerable & Outdated Components (M9)', () => {
+  describe('production audit gate', () => {
+    it('reports zero high/critical advisories in the production tree', () => {
+      const report = runProdAudit();
+      if (report === null) {
+        // Registry unreachable — do not fail the suite offline.
+        console.warn('SEC-DEPS: npm audit unavailable (offline?), skipping gate assertion');
+        return;
+      }
+
+      const offenders: string[] = [];
+      for (const [pkg, vuln] of Object.entries(report.vulnerabilities ?? {})) {
+        const sev = vuln.severity?.toLowerCase();
+        if (sev !== 'high' && sev !== 'critical') {
+          continue;
+        }
+        // Allow only if EVERY advisory behind this package is allowlisted.
+        const advisoryIds = vuln.via
+          .filter((v): v is AuditAdvisory => typeof v === 'object')
+          .map((v) => v.source)
+          .filter((s): s is number => typeof s === 'number');
+        const allAllowlisted =
+          advisoryIds.length > 0 && advisoryIds.every((id) => HIGH_CRITICAL_ALLOWLIST.has(id));
+        if (!allAllowlisted) {
+          offenders.push(`${pkg} (${sev}; advisories: ${advisoryIds.join(', ') || 'n/a'})`);
+        }
+      }
+
+      expect(offenders, `Unfixed high/critical prod advisories:\n${offenders.join('\n')}`).toEqual(
+        []
+      );
+    });
+
+    it('reports zero high/critical via the audit metadata summary', () => {
+      const report = runProdAudit();
+      if (report === null) {
+        console.warn('SEC-DEPS: npm audit unavailable (offline?), skipping metadata assertion');
+        return;
+      }
+      const counts = report.metadata?.vulnerabilities ?? {};
+      const high = counts.high ?? 0;
+      const critical = counts.critical ?? 0;
+      // With an empty allowlist the metadata summary must also be clean.
+      if (HIGH_CRITICAL_ALLOWLIST.size === 0) {
+        expect(high + critical).toBe(0);
+      }
+    });
+  });
+
+  describe('per-request transport invariant (post-upgrade)', () => {
+    it('SDK still exposes a constructable StreamableHTTPServerTransport', () => {
+      expect(typeof StreamableHTTPServerTransport).toBe('function');
+    });
+
+    it('constructs an independent transport per call (stateless mode)', () => {
+      const make = (): StreamableHTTPServerTransport =>
+        new StreamableHTTPServerTransport({
+          sessionIdGenerator: undefined, // stateless: one transport per request
+          enableDnsRebindingProtection: true,
+          allowedHosts: ['localhost:3000'],
+          allowedOrigins: ['http://localhost:3000'],
+        });
+
+      const a = make();
+      const b = make();
+      expect(a).toBeInstanceOf(StreamableHTTPServerTransport);
+      expect(b).toBeInstanceOf(StreamableHTTPServerTransport);
+      expect(a).not.toBe(b); // distinct instances — no shared session state
+    });
+  });
+});

package/tests/security/injection.test.ts

@@ -0,0 +1,117 @@
+/**
+ * SEC-INJ — Injection (path / parameter)
+ * OWASP A03:2021 (Injection); overlaps SEC-SSRF (A10:2021).
+ *
+ * Finding covered:
+ *   H4 — Home Assistant API paths interpolate user input without encoding, so an
+ *        entity_id / domain / service containing "/", "..", "?" or "#" could escape
+ *        the intended /api/<resource> path or inject query parameters.
+ *
+ * Secure behavior asserted:
+ *   - Call sites percent-encode each user-controlled path segment.
+ *   - The request layer refuses any path that resolves outside /api/ (traversal guard).
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { RequestHandler } from '../../src/haClient/request.js';
+import { StateOperations } from '../../src/haClient/states.js';
+import { ServiceOperations } from '../../src/haClient/services.js';
+
+function makeHandler() {
+  return new RequestHandler({
+    baseUrl: 'http://ha.test:8123',
+    token: 'tok',
+    timeout: 30000,
+    strictSsl: true,
+  });
+}
+
+/** Capture the URL string passed to fetch and return an empty JSON response. */
+function stubFetch() {
+  const fetchMock = vi.fn(async () => ({
+    ok: true,
+    status: 200,
+    statusText: 'OK',
+    headers: { get: () => 'application/json' },
+    json: async () => ({}),
+    text: async () => '',
+  }));
+  vi.stubGlobal('fetch', fetchMock);
+  return fetchMock;
+}
+
+describe('SEC-INJ — Injection (H4: HA API path)', () => {
+  beforeEach(() => {
+    stubFetch();
+  });
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.restoreAllMocks();
+  });
+
+  describe('request-layer traversal guard', () => {
+    it('rejects a path that escapes /api via ".." before making any request', async () => {
+      const handler = makeHandler();
+      await expect(handler.get('/states/../../secret')).rejects.toThrow();
+      expect(fetch).not.toHaveBeenCalled();
+    });
+
+    it('allows a normal /api path', async () => {
+      const handler = makeHandler();
+      await handler.get('/states');
+      expect(fetch).toHaveBeenCalledOnce();
+      const calledUrl = (fetch as unknown as ReturnType<typeof vi.fn>).mock.calls[0][0] as string;
+      expect(new URL(calledUrl).pathname).toBe('/api/states');
+    });
+  });
+
+  describe('call-site encoding — StateOperations.getState', () => {
+    it('encodes a malicious entity_id so it cannot escape /api/states', async () => {
+      const states = new StateOperations(makeHandler());
+      await states.getState('x/../../admin');
+
+      const calledUrl = (fetch as unknown as ReturnType<typeof vi.fn>).mock.calls[0][0] as string;
+      const { pathname } = new URL(calledUrl);
+      // The whole id stays a single encoded segment under /api/states/.
+      expect(pathname.startsWith('/api/states/')).toBe(true);
+      expect(pathname).not.toContain('/admin');
+      expect(calledUrl).toContain('%2F'); // the slashes were encoded
+    });
+
+    it('encodes "?" so it cannot inject query parameters', async () => {
+      const states = new StateOperations(makeHandler());
+      await states.getState('light.x?evil=1');
+
+      const calledUrl = (fetch as unknown as ReturnType<typeof vi.fn>).mock.calls[0][0] as string;
+      expect(new URL(calledUrl).searchParams.get('evil')).toBeNull();
+    });
+
+    it('passes a normal entity_id through unchanged', async () => {
+      const states = new StateOperations(makeHandler());
+      await states.getState('light.kitchen');
+
+      const calledUrl = (fetch as unknown as ReturnType<typeof vi.fn>).mock.calls[0][0] as string;
+      expect(new URL(calledUrl).pathname).toBe('/api/states/light.kitchen');
+    });
+  });
+
+  describe('call-site encoding — ServiceOperations.callService', () => {
+    it('encodes domain and service segments', async () => {
+      const services = new ServiceOperations(makeHandler());
+      await services.callService({ domain: 'light', service: 'turn_on/../../admin' });
+
+      const calledUrl = (fetch as unknown as ReturnType<typeof vi.fn>).mock.calls[0][0] as string;
+      const { pathname } = new URL(calledUrl);
+      expect(pathname.startsWith('/api/services/light/')).toBe(true);
+      expect(pathname).not.toContain('/admin');
+    });
+
+    it('passes a normal service call through unchanged', async () => {
+      const services = new ServiceOperations(makeHandler());
+      await services.callService({ domain: 'light', service: 'turn_on' });
+
+      const calledUrl = (fetch as unknown as ReturnType<typeof vi.fn>).mock.calls[0][0] as string;
+      expect(new URL(calledUrl).pathname).toBe('/api/services/light/turn_on');
+    });
+  });
+});

package/tests/security/insecureDesign.test.ts

@@ -0,0 +1,122 @@
+/**
+ * SEC-DESIGN — Insecure Design / Fail-open
+ * OWASP A04:2021 (Insecure Design).
+ *
+ * Findings covered:
+ *   L3 — default-allow `?? 0xFF` fallbacks. A tool invocation that arrives with no
+ *        permission mask was granted FULL permissions. Secure behavior: fail closed
+ *        (deny) unless the transport is the trusted-local stdio path, which opts in
+ *        explicitly via setLocalFullTrust().
+ *   L1 — automation/script CREATION is effectively arbitrary HA template/shell exec.
+ *        Policy: it must remain behind a privileged bit (CONFIGURE), never a read or
+ *        plain-control bit. This guard locks that contract so it can't silently
+ *        regress to a lower tier.
+ */
+
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import type { ToolExtra } from '../../src/tools/common.js';
+import { wrapToolHandler, toToolResult, setLocalFullTrust } from '../../src/tools/common.js';
+import { Permission, Role, hasPermission } from '../../src/permissions/index.js';
+
+/** Build a ToolExtra; pass `undefined` to omit the permission mask entirely. */
+function extraWith(permissions?: number): ToolExtra {
+  return {
+    sessionId: 'test-session',
+    signal: new AbortController().signal,
+    requestId: 1,
+    authInfo:
+      permissions !== undefined
+        ? { token: 't', clientId: 'c', scopes: [], extra: { permissions } }
+        : undefined,
+  } as unknown as ToolExtra;
+}
+
+describe('SEC-DESIGN — Insecure Design / Fail-open', () => {
+  // The local-trust flag is process-global; never let a test leak it.
+  afterEach(() => setLocalFullTrust(false));
+
+  describe('L3: missing permission mask fails closed', () => {
+    it('denies a privileged tool when no authInfo is present (HTTP anomaly)', async () => {
+      const handler = vi.fn().mockResolvedValue(toToolResult('ok'));
+      const wrapped = wrapToolHandler('dangerTool', handler, Permission.ADMIN);
+
+      const result = await wrapped({}, extraWith(undefined));
+
+      expect(handler).not.toHaveBeenCalled();
+      expect(result.isError).toBe(true);
+      expect((result.content[0] as { text: string }).text).toContain('Permission denied');
+    });
+
+    it('denies even a QUERY-only tool when no mask is present', async () => {
+      const handler = vi.fn().mockResolvedValue(toToolResult('ok'));
+      const wrapped = wrapToolHandler('readTool', handler, Permission.QUERY);
+
+      const result = await wrapped({}, extraWith(undefined));
+
+      expect(handler).not.toHaveBeenCalled();
+      expect(result.isError).toBe(true);
+    });
+
+    it('still enforces an explicit insufficient mask (regression guard)', async () => {
+      const handler = vi.fn().mockResolvedValue(toToolResult('ok'));
+      const wrapped = wrapToolHandler('dangerTool', handler, Permission.ADMIN);
+
+      const result = await wrapped({}, extraWith(Permission.QUERY));
+
+      expect(handler).not.toHaveBeenCalled();
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  describe('L3: stdio local-trust opt-in', () => {
+    it('grants full permissions for no-auth calls ONLY when local trust is enabled', async () => {
+      const handler = vi.fn().mockResolvedValue(toToolResult('ok'));
+      const wrapped = wrapToolHandler('dangerTool', handler, Permission.ADMIN);
+
+      setLocalFullTrust(true);
+      const result = await wrapped({}, extraWith(undefined));
+
+      expect(handler).toHaveBeenCalledOnce();
+      expect(result.isError).toBe(false);
+    });
+
+    it('reverts to fail-closed once local trust is turned back off', async () => {
+      const handler = vi.fn().mockResolvedValue(toToolResult('ok'));
+      const wrapped = wrapToolHandler('dangerTool', handler, Permission.ADMIN);
+
+      setLocalFullTrust(true);
+      setLocalFullTrust(false);
+      const result = await wrapped({}, extraWith(undefined));
+
+      expect(handler).not.toHaveBeenCalled();
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  describe('L1: automation/script creation stays behind a privileged bit', () => {
+    it('CONFIGURE (the createAutomation gate) is NOT granted by read/operator roles', () => {
+      // createAutomation is registered with Permission.CONFIGURE. Document & lock that
+      // this bit represents code-exec-equivalent power: it must not leak into the
+      // low-privilege roles a typical read/control token would carry.
+      expect(hasPermission(Role.READONLY, Permission.CONFIGURE)).toBe(false);
+      expect(hasPermission(Role.OPERATOR, Permission.CONFIGURE)).toBe(false);
+
+      // Only the explicitly-privileged roles include it.
+      expect(hasPermission(Role.CONTRIBUTOR, Permission.CONFIGURE)).toBe(true);
+      expect(hasPermission(Role.ADMIN, Permission.CONFIGURE)).toBe(true);
+    });
+
+    it('a CONFIGURE gate denies an OPERATOR token but allows a CONTRIBUTOR token', async () => {
+      const handler = vi.fn().mockResolvedValue(toToolResult('created'));
+      const wrapped = wrapToolHandler('createAutomation', handler, Permission.CONFIGURE);
+
+      const denied = await wrapped({}, extraWith(Role.OPERATOR));
+      expect(handler).not.toHaveBeenCalled();
+      expect(denied.isError).toBe(true);
+
+      const allowed = await wrapped({}, extraWith(Role.CONTRIBUTOR));
+      expect(handler).toHaveBeenCalledOnce();
+      expect(allowed.isError).toBe(false);
+    });
+  });
+});

package/tests/security/logging.test.ts

@@ -0,0 +1,131 @@
+/**
+ * SEC-LOG — Logging & Information Disclosure
+ * OWASP A09:2021 (Security Logging and Monitoring Failures) / sensitive data exposure.
+ *
+ * Findings covered:
+ *   M6 — error responses leak the raw internal `error.message` to clients
+ *        (may contain internal hostnames, file paths, tokens, stack detail).
+ *   M7 — the unauthenticated `/health` endpoint discloses version, auth method,
+ *        and internal AI provider URLs.
+ *
+ * These tests assert the SECURE behavior: clients receive a generic error message
+ * (the detail is logged server-side only), and `/health` returns liveness only.
+ */
+
+import { describe, it, expect, vi } from 'vitest';
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { HaClient } from '../../src/haClient/index.js';
+import { sanitizeError } from '../../src/utils/sanitizeError.js';
+import { handleRestApi, handleHealthCheck } from '../../src/server/http.js';
+import type { AuthenticatedRequest } from '../../src/server/auth.js';
+
+/** An error whose message embeds infrastructure detail we must never echo. */
+const LEAKY = new Error('connect ECONNREFUSED 10.0.0.19:8123 (/volume1/docker/secret)');
+
+/** Build a mock request carrying a full permission mask. */
+function mockReq(method: string, url: string): AuthenticatedRequest {
+  const listeners: Record<string, ((arg?: unknown) => void)[]> = {};
+  const req = {
+    method,
+    url,
+    headers: { host: 'mcp.test:3000' },
+    auth: { token: 't', clientId: 'u', scopes: [], extra: { permissions: 0xff } },
+    on(event: string, cb: (arg?: unknown) => void) {
+      (listeners[event] ??= []).push(cb);
+      if (event === 'end') {
+        queueMicrotask(() => {
+          for (const e of listeners['end'] ?? []) e();
+        });
+      }
+      return req;
+    },
+  } as unknown as AuthenticatedRequest;
+  return req;
+}
+
+/** Capture status code and JSON body written to the response. */
+function mockRes(): ServerResponse & { _body?: unknown } {
+  const res = {
+    statusCode: 200,
+    headersSent: false,
+    setHeader: vi.fn(),
+    end: vi.fn(function (this: { _body?: unknown }, payload?: unknown) {
+      if (typeof payload === 'string') {
+        try {
+          this._body = JSON.parse(payload);
+        } catch {
+          this._body = payload;
+        }
+      }
+      return this;
+    }),
+  } as unknown as ServerResponse & { _body?: unknown };
+  return res;
+}
+
+describe('SEC-LOG — Logging & Information Disclosure', () => {
+  describe('M6: sanitizeError never echoes internal detail', () => {
+    it('returns a non-empty generic string', () => {
+      const out = sanitizeError(LEAKY);
+      expect(typeof out).toBe('string');
+      expect(out.length).toBeGreaterThan(0);
+    });
+
+    it('strips internal hostnames, ports and file paths from Error messages', () => {
+      const out = sanitizeError(LEAKY);
+      expect(out).not.toContain('10.0.0.19');
+      expect(out).not.toContain('8123');
+      expect(out).not.toContain('/volume1');
+      expect(out).not.toContain('ECONNREFUSED');
+    });
+
+    it('does not echo raw non-Error values', () => {
+      const out = sanitizeError('raw secret /volume1/docker/.env token=abc123');
+      expect(out).not.toContain('/volume1');
+      expect(out).not.toContain('abc123');
+    });
+
+    it('supports a caller-supplied generic fallback', () => {
+      expect(sanitizeError(LEAKY, 'Upstream request failed')).toBe('Upstream request failed');
+    });
+  });
+
+  describe('M6: handleRestApi 500 path returns a generic message', () => {
+    it('does not leak the upstream error detail to the client', async () => {
+      const client = { getStates: vi.fn().mockRejectedValue(LEAKY) } as unknown as HaClient;
+      const req = mockReq('GET', '/api/states');
+      const res = mockRes();
+
+      await handleRestApi(req, res, '/api/states', client);
+
+      expect(res.statusCode).toBe(500);
+      const body = JSON.stringify(res._body);
+      expect(body).not.toContain('10.0.0.19');
+      expect(body).not.toContain('/volume1');
+      expect(body).not.toContain('ECONNREFUSED');
+    });
+  });
+
+  describe('M7: /health discloses liveness only', () => {
+    it('returns status only — no version, auth method, or internal AI URLs', () => {
+      const res = mockRes();
+
+      handleHealthCheck(res);
+
+      const body = res._body as Record<string, unknown>;
+      expect(body).toEqual({ status: 'healthy' });
+
+      // Defense in depth: the serialized body carries none of the old internals.
+      const serialized = JSON.stringify(body);
+      expect(serialized).not.toContain('version');
+      expect(serialized).not.toContain('authMethod');
+      expect(serialized).not.toContain('aiUrl');
+      expect(serialized).not.toContain('aiProvider');
+      expect(body).not.toHaveProperty('rateLimitEnabled');
+      expect(body).not.toHaveProperty('eventsConnectedClients');
+    });
+  });
+});
+
+// Avoid unused-type lint on the IncomingMessage import in some configs.
+export type _LogTestReq = IncomingMessage;