@goodandready/dsh-remote-workspace 0.3.9 → 0.3.10

package/lib/index.js

@@ -305,6 +305,7 @@ export function apply(ctx, config = {}) {
 
   // Cleanup on unload
   ctx.on('dispose', () => {
+    clearInterval(idleTimer);
     alertService.stop();
     watcherService.stopAll();
     tunnelService.stopAll();

package/lib/routes/docker.js

@@ -1,4 +1,4 @@
-import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
 
 export function registerDockerRoutes(sctx, webServer, { dockerService, healthService, store }) {
   // 21. GET /dsh-remote-workspace/health
@@ -7,7 +7,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
     path: '/dsh-remote-workspace/health',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const url = new URL(req.url, 'http://localhost');
         const profileId = url.searchParams.get('profileId');
@@ -17,7 +17,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
         const health = await healthService.getHealth(profile);
         writeJson(res, 200, { ok: true, health });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /health');
@@ -28,7 +28,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
     path: '/dsh-remote-workspace/docker/list',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const url = new URL(req.url, 'http://localhost');
         const profileId = url.searchParams.get('profileId');
@@ -38,7 +38,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
         const result = await dockerService.listContainers(profile, true);
         writeJson(res, 200, { ok: true, ...result });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /docker/list');
@@ -49,7 +49,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
     path: '/dsh-remote-workspace/docker/action',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, containerId, action } = await readBody(req);
         const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
@@ -59,7 +59,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
         const result = await dockerService.containerAction(profile, containerId, action);
         writeJson(res, 200, { ok: result.success, ...result });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /docker/action');
@@ -70,7 +70,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
     path: '/dsh-remote-workspace/docker/logs',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, containerId, tail } = await readBody(req);
         const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
@@ -80,7 +80,7 @@ export function registerDockerRoutes(sctx, webServer, { dockerService, healthSer
         const result = await dockerService.containerLogs(profile, containerId, tail || 100);
         writeJson(res, 200, { ok: result.success, ...result });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /docker/logs');

package/lib/routes/env.js

@@ -1,4 +1,4 @@
-import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
 
 export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService, sshService, store }) {
   // 10. POST /dsh-remote-workspace/env/view
@@ -7,7 +7,7 @@ export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService
     path: '/dsh-remote-workspace/env/view',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, remotePath } = await readBody(req);
         const profile = store.getProfile(profileId);
@@ -15,7 +15,7 @@ export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService
         const result = await envService.readRemoteEnv(sshService, profile, remotePath);
         writeJson(res, 200, { ok: true, ...result });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /env/view');
@@ -26,7 +26,7 @@ export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService
     path: '/dsh-remote-workspace/env/save',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, remotePath, content } = await readBody(req);
         const profile = store.getProfile(profileId);
@@ -34,7 +34,7 @@ export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService
         const result = await envService.saveRemoteEnv(sshService, profile, remotePath, content);
         writeJson(res, 200, { ok: true, ...result });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /env/save');
@@ -45,7 +45,7 @@ export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService
     path: '/dsh-remote-workspace/diagnose',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, checks } = await readBody(req);
         const profile = store.getProfile(profileId);
@@ -53,7 +53,7 @@ export function registerEnvRoutes(sctx, webServer, { envService, diagnoseService
         const results = await diagnoseService.diagnose(sshService, profile, checks);
         writeJson(res, 200, { ok: true, results });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /diagnose');

package/lib/routes/files.js

@@ -1,4 +1,4 @@
-import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
 import { contentDisposition, pipeWithProgress, MAX_BYTES } from '../file-transfer.js';
 
 
@@ -27,7 +27,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
     path: '/dsh-remote-workspace/browse',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const body = await readBody(req);
         let profile = null;
@@ -48,7 +48,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
         const entries = await remoteFs.listDir(profile, targetPath);
         writeJson(res, 200, { ok: true, entries, items: entries, currentPath: targetPath });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /browse');
@@ -59,7 +59,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
     path: '/dsh-remote-workspace/file/view',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, filePath } = await readBody(req);
         const profile = store.getProfile(profileId);
@@ -71,7 +71,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
         const buf = await remoteFs.readFile(profile, filePath);
         writeJson(res, 200, { ok: true, content: buf.toString('utf8'), size: stat.size });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /file/view');
@@ -82,7 +82,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
     path: '/dsh-remote-workspace/file/save',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, filePath, content } = await readBody(req);
         const profile = store.getProfile(profileId);
@@ -90,7 +90,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
         await remoteFs.writeFile(profile, filePath, Buffer.from(content, 'utf8'));
         writeJson(res, 200, { ok: true });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /file/save');
@@ -100,7 +100,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
     path: '/dsh-remote-workspace/file/download',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profile, filePath } = transferTarget(req, store);
         const stat = await remoteFs.stat(profile, filePath);
@@ -128,7 +128,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
     path: '/dsh-remote-workspace/file/upload',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       let upload = null;
       try {
         const { profile, filePath } = transferTarget(req, store);
@@ -156,7 +156,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
     path: '/dsh-remote-workspace/transfer',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { sourceProfileId, sourcePath, destProfileId, destPath } = await readBody(req);
         const srcProfile = sourceProfileId ? store.getProfile(sourceProfileId) : store.getActiveProfile();
@@ -169,7 +169,7 @@ export function registerFileRoutes(sctx, webServer, { remoteFs, store, sshServic
         const result = await sshService.transferFileBetweenHosts(srcProfile, sourcePath, destProfile, destPath);
         writeJson(res, 200, { ok: result.success, ...result });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /transfer');

package/lib/routes/helpers.js

@@ -10,18 +10,54 @@ export function writeJson(res, statusCode, body) {
   res.end(JSON.stringify(body));
 }
 
-export function readBody(req) {
+export const MAX_BODY_BYTES = 5 * 1024 * 1024; // 5 MiB
+
+export function readBody(req, maxBytes = MAX_BODY_BYTES) {
   return new Promise((resolve, reject) => {
+    const rawCl = req?.headers?.['content-length'];
+    const contentLength = rawCl !== undefined ? parseInt(Array.isArray(rawCl) ? rawCl[0] : rawCl, 10) : NaN;
+    if (!isNaN(contentLength) && contentLength > maxBytes) {
+      if (typeof req.destroy === 'function') req.destroy();
+      const error = new Error('Payload too large');
+      error.statusCode = 413;
+      return reject(error);
+    }
+
     let body = '';
-    req.on('data', (chunk) => { body += chunk.toString(); });
+    let bytesReceived = 0;
+    let exceeded = false;
+
+    function onData(chunk) {
+      if (exceeded) return;
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+      bytesReceived += buffer.length;
+      if (bytesReceived > maxBytes) {
+        exceeded = true;
+        if (typeof req.removeListener === 'function') {
+          req.removeListener('data', onData);
+        } else if (typeof req.off === 'function') {
+          req.off('data', onData);
+        }
+        if (typeof req.destroy === 'function') req.destroy();
+        const error = new Error('Payload too large');
+        error.statusCode = 413;
+        return reject(error);
+      }
+      body += buffer.toString('utf8');
+    }
+
+    req.on('data', onData);
     req.on('end', () => {
+      if (exceeded) return;
       try {
         resolve(body ? JSON.parse(body) : {});
       } catch (err) {
         reject(err);
       }
     });
-    req.on('error', reject);
+    req.on('error', (err) => {
+      if (!exceeded) reject(err);
+    });
   });
 }
 
@@ -39,16 +75,24 @@ export function parseCookies(cookieHeader) {
   return cookies;
 }
 
+export function isLoopbackAddress(address) {
+  if (!address || typeof address !== 'string') return false;
+  return address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1' || address.startsWith('127.');
+}
+
 export function isTrustedSettingsRequest(req) {
-  const secFetch = req.headers['sec-fetch-site'];
+  const ip = req?.socket?.remoteAddress || '';
+  const isLoopback = isLoopbackAddress(ip);
+
+  const secFetch = req?.headers?.['sec-fetch-site'];
   // Fail-closed: unconditionally reject cross-site and cross-origin requests
   if (secFetch && secFetch !== 'same-origin') {
     return false;
   }
 
   // If origin is present, ensure it matches the request host
-  const origin = req.headers['origin'];
-  const host = req.headers['host'];
+  const origin = req?.headers?.['origin'];
+  const host = req?.headers?.['host'];
   if (origin && host) {
     try {
       const url = new URL(origin);
@@ -60,8 +104,8 @@ export function isTrustedSettingsRequest(req) {
     }
   }
 
-  const rawAuth = req.headers['authorization'];
-  const cookieHeader = req.headers['cookie'];
+  const rawAuth = req?.headers?.['authorization'];
+  const cookieHeader = req?.headers?.['cookie'];
   const expectedToken = process.env.DSH_AUTH_TOKEN || process.env.DSH_TOKEN;
 
   if (expectedToken) {
@@ -74,9 +118,53 @@ export function isTrustedSettingsRequest(req) {
       const token = cookies['token'] || cookies['dsh_token'];
       if (token && token === expectedToken) return true;
     }
+    return false;
   }
+
+  // Non-loopback requests without valid token must not pass simply on Sec-Fetch-Site: same-origin
+  if (!isLoopback) return false;
   if (secFetch === 'same-origin') return true;
-  const ip = req.socket?.remoteAddress || '';
-  if (ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1') return true;
-  return false;
+  return true;
+}
+
+export function getConnection(ctx) {
+  try {
+    return ctx?.reflect?.get ? ctx.reflect.get('connection') : (ctx?.get ? ctx.get('connection') : Reflect.get(ctx || {}, 'connection'));
+  } catch {
+    return undefined;
+  }
+}
+
+export function authorizeRequest(sctx, req, res) {
+  let connection;
+  try {
+    connection = getConnection(sctx);
+  } catch {
+    writeJson(res, 503, { ok: false, error: 'DSH browser authentication is unavailable' });
+    return false;
+  }
+
+  if (!connection || typeof connection.requestRejection !== 'function') {
+    writeJson(res, 503, { ok: false, error: 'DSH browser authentication is unavailable' });
+    return false;
+  }
+
+  let rejection;
+  try {
+    rejection = connection.requestRejection(req);
+  } catch {
+    writeJson(res, 503, { ok: false, error: 'DSH browser authentication is unavailable' });
+    return false;
+  }
+
+  if (rejection !== undefined) {
+    const status = rejection === 401 ? 401 : 403;
+    writeJson(res, status, {
+      ok: false,
+      error: status === 401 ? 'DSH browser authentication is required' : 'Forbidden'
+    });
+    return false;
+  }
+
+  return true;
 }

package/lib/routes/profiles.js

@@ -1,4 +1,4 @@
-import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
 import { SshConfigParser } from '../ssh-config-parser.js';
 import { testProfileGroup } from '../profile-groups.js';
 import { filterClusterProfiles, runCluster } from '../cluster-service.js';
@@ -19,7 +19,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/state',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const profiles = store.getProfiles();
         const activeId = store.getActiveId() || (profiles[0]?.id || '');
@@ -31,7 +31,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
         const terminalFontFamily = store.getTerminalFont ? store.getTerminalFont() : '';
         writeJson(res, 200, { ok: true, activeId, profiles: sanitized, tunnels, autoSync, alerts, authPrompts, terminalFontFamily });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /state');
@@ -42,7 +42,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/profiles/save',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const profile = await readBody(req);
         if (!profile.id || !profile.host) {
@@ -53,7 +53,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
         const sanitized = store.vault ? store.vault.sanitizeProfile(profile) : maskProfile(profile);
         writeJson(res, 200, { ok: true, profile: sanitized });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /profiles/save');
@@ -64,7 +64,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/profiles/delete',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { id } = await readBody(req);
         if (!id) return writeJson(res, 400, { ok: false, error: 'ID is required' });
@@ -72,7 +72,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
         await store.deleteProfile(id);
         writeJson(res, 200, { ok: true });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /profiles/delete');
@@ -83,14 +83,14 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/profiles/active',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { id } = await readBody(req);
         if (!id) return writeJson(res, 400, { ok: false, error: 'ID is required' });
         await store.setActiveId(id);
         writeJson(res, 200, { ok: true, activeId: id });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /profiles/active');
@@ -101,7 +101,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/profiles/import-ssh-config',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const body = await readBody(req);
         const content = typeof body.content === 'string' && body.content.trim()
@@ -119,7 +119,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
           skipped: report.skipped
         });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /profiles/import-ssh-config');
@@ -130,7 +130,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/auth/keyboard',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const body = await readBody(req);
         const answers = Array.isArray(body.answers) ? body.answers.slice(0, 20).map((item) => String(item ?? '').slice(0, 256)) : [];
@@ -138,7 +138,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
         if (!accepted) return writeJson(res, 404, { ok: false, error: 'No authentication prompt is waiting' });
         writeJson(res, 200, { ok: true });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /auth/keyboard');
@@ -149,7 +149,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/profiles/test-group',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const body = await readBody(req);
         const ids = Array.isArray(body.ids) ? body.ids.map((item) => String(item)) : [];
@@ -157,7 +157,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
         const results = await testProfileGroup(selected, (profile) => sshService.testConnection(profile));
         writeJson(res, 200, { ok: true, results });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /profiles/test-group');
@@ -168,7 +168,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/cluster',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const body = await readBody(req);
         if (!body.command || typeof body.command !== 'string') return writeJson(res, 400, { ok: false, error: 'Command is required' });
@@ -183,7 +183,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
         });
         writeJson(res, 200, { ok: true, results });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /cluster');
@@ -194,7 +194,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/test',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const profile = await readBody(req);
         if (!profile.host) return writeJson(res, 400, { ok: false, error: 'Host is required' });

package/lib/routes/sync.js

@@ -1,4 +1,4 @@
-import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
 
 export function registerSyncRoutes(sctx, webServer, { mirrorSync, tarSyncService, watcherService, store }) {
   // 17. POST /dsh-remote-workspace/sync
@@ -7,7 +7,7 @@ export function registerSyncRoutes(sctx, webServer, { mirrorSync, tarSyncService
     path: '/dsh-remote-workspace/sync',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, direction, force, mode } = await readBody(req);
         const profile = (profileId ? store.getProfile(profileId) : null) || store.getActiveProfile();
@@ -28,7 +28,7 @@ export function registerSyncRoutes(sctx, webServer, { mirrorSync, tarSyncService
           : await mirrorSync.pull(profile, profile.remoteWorkspace, profile.localMirrorPath);
         writeJson(res, 200, { ok: resSync.success, ...resSync });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /sync');
@@ -39,13 +39,13 @@ export function registerSyncRoutes(sctx, webServer, { mirrorSync, tarSyncService
     path: '/dsh-remote-workspace/watcher/toggle',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { enabled } = await readBody(req);
         await store.setAutoSyncEnabled(Boolean(enabled));
         writeJson(res, 200, { ok: true, autoSync: store.isAutoSyncEnabled() });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /watcher/toggle');

package/lib/routes/terminal.js

@@ -1,4 +1,4 @@
-import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
 import { normalizeTerminalFont } from '../terminal-font.js';
 
 export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
@@ -8,7 +8,7 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
     path: '/dsh-remote-workspace/terminal/font',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const body = await readBody(req);
         const fontFamily = await store.setTerminalFont(body.fontFamily);
@@ -26,7 +26,7 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
     path: '/dsh-remote-workspace/terminal/create',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, cols, rows } = await readBody(req);
         const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
@@ -34,7 +34,7 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
         const session = await sshService.createTerminalSession(profile, { cols: cols || 80, rows: rows || 24 });
         writeJson(res, 200, { ok: true, sessionId: session.id });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /terminal/create');
@@ -45,7 +45,7 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
     path: '/dsh-remote-workspace/terminal/input',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { sessionId, data, resize } = await readBody(req);
         const session = sshService.getTerminalSession(sessionId);
@@ -58,7 +58,7 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
         }
         writeJson(res, 200, { ok: true });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /terminal/input');
@@ -69,7 +69,7 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
     path: '/dsh-remote-workspace/terminal/stream',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const url = new URL(req.url, 'http://localhost');
         const sessionId = url.searchParams.get('sessionId');
@@ -99,7 +99,7 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
           session.subscribers.delete(sub);
         });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /terminal/stream');
@@ -110,13 +110,13 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
     path: '/dsh-remote-workspace/terminal/close',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { sessionId } = await readBody(req);
         sshService.closeTerminalSession(sessionId);
         writeJson(res, 200, { ok: true });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /terminal/close');

package/lib/routes/tunnels.js

@@ -1,4 +1,4 @@
-import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
 
 export function registerTunnelRoutes(sctx, webServer, { tunnelService, store }) {
   // 18. POST /dsh-remote-workspace/tunnels/start
@@ -7,7 +7,7 @@ export function registerTunnelRoutes(sctx, webServer, { tunnelService, store })
     path: '/dsh-remote-workspace/tunnels/start',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, localPort, targetHost, remotePort } = await readBody(req);
         const profile = (profileId ? store.getProfile(profileId) : null) || store.getActiveProfile();
@@ -20,7 +20,7 @@ export function registerTunnelRoutes(sctx, webServer, { tunnelService, store })
         const result = await tunnelService.startLocalTunnel(profile, lPort, targetHost || '127.0.0.1', rPort);
         writeJson(res, 200, { ok: result.success, ...result });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /tunnels/start');
@@ -31,14 +31,14 @@ export function registerTunnelRoutes(sctx, webServer, { tunnelService, store })
     path: '/dsh-remote-workspace/tunnels/stop',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { tunnelId } = await readBody(req);
         if (!tunnelId) return writeJson(res, 400, { ok: false, error: 'tunnelId required' });
         const stopped = tunnelService.stopTunnel(tunnelId);
         writeJson(res, 200, { ok: stopped });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /tunnels/stop');
@@ -49,11 +49,11 @@ export function registerTunnelRoutes(sctx, webServer, { tunnelService, store })
     path: '/dsh-remote-workspace/tunnels/telemetry',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         writeJson(res, 200, { ok: true, tunnels: tunnelService.listActiveTunnels() });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /tunnels/telemetry');

package/lib/routes.js

@@ -8,7 +8,7 @@ import { registerTunnelRoutes } from './routes/tunnels.js';
 import { registerDockerRoutes } from './routes/docker.js';
 import { registerSyncRoutes } from './routes/sync.js';
 
-export { isTrustedSettingsRequest } from './routes/helpers.js';
+export { isTrustedSettingsRequest, authorizeRequest, readBody, MAX_BODY_BYTES } from './routes/helpers.js';
 
 export function registerApiRoutes(
   ctx,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-remote-workspace",
-  "version": "0.3.9",
+  "version": "0.3.10",
   "description": "Enterprise Remote Workspace Plugin for DeepSeek Harness: SSH2 connection pool, SFTP operations, 3-way conflict-aware mirror sync, port forwarding, and native DSH UI.",
   "type": "module",
   "main": "lib/index.js",