@jrpool/kilotest 49.0.0 → 51.1.0

package/docs/SERVICE.md

@@ -64,7 +64,18 @@ pm2 start pm2.config.cjs
 pm2 save
 ```
 
-The management of the PM2 logs is [documented by PM2](https://pm2.keymetrics.io/docs/usage/log-management/).
+### PM2 log rotation
+
+PM2's own log management is [documented by PM2](https://pm2.keymetrics.io/docs/usage/log-management/), but PM2 does not rotate its logs by default. Since the general request log (see “Request logging” above) writes one line per request rather than only for rejections, log volume is meaningfully higher than before that addition, so explicit rotation is configured via the [`pm2-logrotate`](https://github.com/keymetrics/pm2-logrotate) module:
+
+```text
+pm2 install pm2-logrotate
+pm2 set pm2-logrotate:max_size 20M
+pm2 set pm2-logrotate:retain 14
+pm2 set pm2-logrotate:compress true
+```
+
+This rotates `~/.pm2/logs/kilotest-out-0.log` (and the error log) once it reaches 20MB, keeps 14 rotated files, and compresses rotated files with gzip.
 
 ### Process tuning
 
@@ -233,13 +244,30 @@ The Caddy configuration is maintained and tracked in `/etc/caddy/Caddyfile`. Lea
 # Docs: https://caddyserver.com/docs/caddyfile.
 
 kilotest.com {
+  # Log every request in structured JSON, rotated so it cannot grow unbounded. See
+  # "Request logging" below for why this exists alongside Kilotest's own request log.
+  log {
+    output file /var/log/caddy/kilotest-access.log {
+      roll_size 50mb
+      roll_keep 10
+      roll_keep_for 720h
+    }
+    format json
+  }
   # Enable Zstandard and Gzip compression of responses.
   encode zstd gzip
-  # Specify the only paths of forwardable requests. UptimeRobet uses HEAD.
+  # Specify the only paths of forwardable requests.
   @allowedGET {
-    method GET HEAD
+    method GET
     path /mcp / /index.html /robots.txt /openapi.yaml /openapi.json /swagger.yaml /swagger.json /api-docs /llms.txt /llms-full.txt /capability.md *.html* /fullReport.json/* /api/* /tutorialWeb/images/* /tutorialAI/images/* /qai /qai/comments /favicon.* /style.css /sitemap.xml
   }
+  # UptimeRobot's uptime check is the only known HEAD caller, and it targets only the site
+  # root (see "Health monitoring" below), so HEAD is forwarded only for that path, not the
+  # full GET allowlist above. index.ts's HEAD branch matches this same scope.
+  @allowedHEAD {
+    method HEAD
+    path / /index.html
+  }
   @allowedPOST {
     method POST
     path /mcp /requestRetest.html/* /requestTest.html /requestAction.html /reannotate.html /renewWCAG.html /ai0BalanceForm.html /expungeReportsForm.html /hideReportForm.html /metrics.html /pruneReportsForm.html /rewindReportsForm.html /showHiddenReportsForm.html /unhideReportForm.html /api/* /tutorialWebComment.html /tutorialAIComment.html /worker/job /worker/report
@@ -254,13 +282,19 @@ kilotest.com {
     }
     respond 204
   }
-  # Forward any other GET, POST, or OPTIONS request, if allowed, to port 3000.
+  # Forward any other GET, HEAD, or POST request, if allowed, to port 3000.
   handle @allowedGET {
     reverse_proxy localhost:3000 {
       # Improve SSE latency.
       flush_interval -1
     }
   }
+  handle @allowedHEAD {
+    reverse_proxy localhost:3000 {
+      # Improve SSE latency.
+      flush_interval -1
+    }
+  }
   handle @allowedPOST {
     reverse_proxy localhost:3000 {
       # Improve SSE latency.
@@ -278,6 +312,15 @@ This configuration can be futher tightened if experience warrants.
 
 The `flush_interval` setting prevents granular reporting by Testaro workers from being buffered, so the updates reach the browser without delay.
 
+### Request logging
+
+Two independent request logs exist, added as part of the abuse evaluation in [GitHub issue #3](https://github.com/jrpool/kilotest/issues/3), so that suspicious traffic can be recognized after the fact rather than only the narrower set of cases that already trigger a rejection:
+
+- **Application-level, general request log** (`index.ts`): every request Kilotest itself receives, whether it succeeds or is rejected, is logged as one single-line JSON record via `console.log` (captured by PM2 like all of Kilotest's other console output), with the fields `type: 'request'`, `time`, `ip`, `method`, `path` (no query string, so a parameter such as `authCode` is never written to a log file), `status`, and `userAgent`. This is separate from, and does not replace, `getAbuseError`'s existing multi-line dump, which remains a rarer, human-read-in-the-moment record logged only for rejected requests. Smoke-test-tagged requests (`x-kilotest-smoke`) are excluded from this log, exactly as they are already excluded from usage metrics; the maintainer's own manual testing is deliberately *not* excluded (unlike usage metrics), since abuse visibility should see all real traffic.
+- **Caddy access log**: enabled at the reverse-proxy layer for connection- and pre-dispatch-level visibility the application itself never sees (for example, requests to paths outside Kilotest's own allowlist, which Caddy rejects before ever forwarding them). See the `log` directive in the Caddyfile above.
+
+Both logs are rotated; see “PM2 log rotation” above for the application log and the `log` directive’s own `roll_size`/`roll_keep` options for the Caddy log.
+
 ## Version management
 
 When a new version of the `kilotest` package has been published, the service can be updated as follows:
@@ -310,7 +353,7 @@ The smoke-test check is defined in `.github/workflows/smoke-test.yml` and runs `
 When a pull request adds a new route to `index.js`, the Caddyfile at `/etc/caddy/Caddyfile` on the server must be updated to forward the new path before the pull request can merge. The workflow to follow is:
 
 1. Add the new route to the `routes` constant and the dispatch chain in `index.js`.
-1. Update the Caddyfile (`/etc/caddy/Caddyfile`) on the server to forward the new path.
+1. Update the Caddyfile (`/etc/caddy/Caddyfile`) on the server to forward the new path, then reload Caddy so the change takes effect: `sudo systemctl reload caddy` (a reload, not a restart, so in-flight connections are not dropped).
 1. Open or update the pull request.
 1. The smoke test workflow runs and verifies that all paths, including the new one, are forwarded by Caddy.
 1. If the Caddyfile was not updated, the smoke test reports a bare 404 for the new path, the required status check fails, and the pull request cannot merge.
@@ -332,7 +375,7 @@ The deployment is monitored for external health and availability using [UptimeRo
 
 UptimeRobot also sends a recovery message when the service recovers and a subsequent check succeeds after a prior failure.
 
-This monitoring service requires `Caddyfile` to permit `HEAD` requests, not only `GET` requests, to the root path.
+This monitoring service requires both `Caddyfile` and Kilotest itself to permit `HEAD` requests, not only `GET` requests, to the root path: `Caddyfile`’s `@allowedHEAD` matcher forwards such a request to port 3000, and `index.ts`’s own dedicated `HEAD` branch in `handleRequest` answers it. Before that branch existed, Kilotest treated `HEAD` as an invalid method for every path (its dispatch recognized only `GET` and `POST`), so UptimeRobot’s hourly check received a `400` response and reported the service as down even while it was actually up.
 
 ## Alerting
 
@@ -356,7 +399,7 @@ Alerts are sent to the maintainer in the following conditions:
 
 7. **Test request received via API**: When a test request is submitted via the API, an alert is sent with subject `"Kilotest: new test request in the API"` (via the `requestTest` API operation) or `"Kilotest: new retest request in the API"` (via the `requestRetest` API operation), including the target URL, description, and the user's stated reason. A request is treated as a duplicate, and no alert is sent for it, only if a request already pending in `db/jobs/testRequests.json`, i.e., submitted but not yet manually approved by the maintainer into an actual job, for the same URL has the identical description; this check ignores the stated reason and the test-versus-retest distinction, and is not limited to a recent time window, it compares against every request still pending approval for that URL. Once the maintainer approves a pending request (turning it into a job via `/enqueue.html`), all pending requests for that URL are cleared, so this check cannot detect a duplicate against a request that has already been approved, is currently running, or has already completed; an identical request submitted after approval alerts again. The check and its dedup key are identical for the UI and API paths, since both funnel through the same underlying request-queuing function.
 
-8. **MCP feature request received**: When a user submits a feature request via the MCP server's `requestFeature` tool, an alert is sent with subject `"MCP feature request received"`, including the text of the feature request.
+8. **MCP feature request received**: When a user submits a feature request via the MCP server's `requestFeature` tool, an alert is sent with subject `"MCP feature request received"`, including the text of the feature request, and the request is also appended to `db/featureRequests.json`, the same way tutorial comments are appended to their own files (see item 1), so that a manager can review or delete it later via `/deleteNotesForm.html`.
 
 9. **WAVE balance low**: When Kilotest detects that the account balance for the WAVE API service (used for accessibility testing) has fallen below a threshold, an alert is sent with subject `"Kilotest: WAVE balance low"`, indicating the number of credits remaining.
 

package/index.test.ts

@@ -15,9 +15,19 @@ process.env.DB_DIR = fixtureDBDir;
 process.env.AUTH_CODE = 'test-auth-code';
 process.env.TUTORIAL_WEB_COMMENTS_PATH = path.join(testCommentsDir, 'tutorialWeb.json');
 process.env.TUTORIAL_AI_COMMENTS_PATH = path.join(testCommentsDir, 'tutorialAI.json');
+process.env.FEATURE_REQUESTS_PATH = path.join(testCommentsDir, 'featureRequests.json');
 process.env.TESTARO_WORKERS = JSON.stringify({
   worker1: {secret: 'secret1', name: 'Worker One'}
 });
+// Blank the alert configuration unconditionally, so this file sends no real alert
+// emails (e.g. from the requestTest/requestRetest/tutorial-comment tests below) even
+// when run directly (e.g. `npx tsx --test index.test.ts`) rather than via `npm test`,
+// which normally guards against this by --require-ing test/setup.ts first. dotenv does
+// not override an already-set env var, so setting these here, before index.ts is ever
+// imported, prevents a real .env file's alert credentials from ever taking effect.
+for (const key of ['MANAGER_EMAIL', 'ALERT_API_HOST', 'ALERT_API_PATH', 'ALERT_API_KEY', 'ALERT_FROM']) {
+  process.env[key] = '';
+}
 
 // IMPORTS
 
@@ -58,6 +68,7 @@ beforeEach(async () => {
   await fs.mkdir(testCommentsDir, {recursive: true});
   await fs.writeFile(path.join(testCommentsDir, 'tutorialWeb.json'), '[]\n');
   await fs.writeFile(path.join(testCommentsDir, 'tutorialAI.json'), '[]\n');
+  await fs.writeFile(path.join(testCommentsDir, 'featureRequests.json'), '[]\n');
 });
 
 after(async () => {
@@ -215,6 +226,30 @@ test('GET /index.html serves the home page', async () => {
   assert.ok(res.headers['content-type'].includes('text/html'));
 });
 
+// TESTS: HEAD routes
+
+test('HEAD / returns the same status and headers as GET /, with no body', async () => {
+  const getRes = await request('GET', '/');
+  const headRes = await request('HEAD', '/');
+  assert.equal(headRes.statusCode, getRes.statusCode);
+  assert.equal(headRes.headers['content-type'], getRes.headers['content-type']);
+  assert.equal(headRes.body, '');
+});
+
+test('HEAD /index.html returns the same status and headers as GET /, with no body', async () => {
+  const getRes = await request('GET', '/');
+  const headRes = await request('HEAD', '/index.html');
+  assert.equal(headRes.statusCode, getRes.statusCode);
+  assert.equal(headRes.headers['content-type'], getRes.headers['content-type']);
+  assert.equal(headRes.body, '');
+});
+
+test('HEAD /robots.txt returns an invalid HEAD request error, since only the home page supports HEAD', async () => {
+  const res = await request('HEAD', '/robots.txt');
+  assert.equal(res.statusCode, 400);
+  assert.equal(res.body, '');
+});
+
 test('GET /robots.txt serves the robots file as text', async () => {
   const res = await request('GET', '/robots.txt');
   assert.equal(res.statusCode, 200);
@@ -826,6 +861,40 @@ test('GET /qai/comments redirects to /tutorialAI.html', async () => {
   assert.equal(res.headers['location'], '/tutorialAI.html');
 });
 
+test('GET /diagnoses.html/<segments> redirects to the equivalent /listDiagnoses.html/<segments>, preserving the query string', async () => {
+  const res = await request(
+    'GET', '/diagnoses.html/duplicateID/260426T1741/77w/718?pathID=/html/body', {}, {followRedirects: false}
+  );
+  assert.equal(res.statusCode, 301);
+  assert.equal(res.headers['location'], '/listDiagnoses.html/duplicateID/260426T1741/77w/718?pathID=/html/body');
+});
+
+test('GET /reportIssues.html/<timeStamp>/<jobID> redirects to the equivalent /listIssues.html/<timeStamp>/<jobID>', async () => {
+  const res = await request('GET', '/reportIssues.html/260101T0000/mix', {}, {followRedirects: false});
+  assert.equal(res.statusCode, 301);
+  assert.equal(res.headers['location'], '/listIssues.html/260101T0000/mix');
+});
+
+test('GET /reportIssue.html/<segments> redirects to the equivalent /listViolators.html/<segments>', async () => {
+  const res = await request(
+    'GET', '/reportIssue.html/duplicateID/260101T0000/mix', {}, {followRedirects: false}
+  );
+  assert.equal(res.statusCode, 301);
+  assert.equal(res.headers['location'], '/listViolators.html/duplicateID/260101T0000/mix');
+});
+
+test('GET /rules.html/<segment> redirects to the equivalent /listRules.html/<segment>', async () => {
+  const res = await request('GET', '/rules.html/allCaps', {}, {followRedirects: false});
+  assert.equal(res.statusCode, 301);
+  assert.equal(res.headers['location'], '/listRules.html/allCaps');
+});
+
+test('GET /targets.html redirects to /listReports.html', async () => {
+  const res = await request('GET', '/targets.html', {}, {followRedirects: false});
+  assert.equal(res.statusCode, 301);
+  assert.equal(res.headers['location'], '/listReports.html');
+});
+
 test('POST /requestTest.html with non-https URL returns an error', async () => {
   const res = await formRequest('POST', '/requestTest.html', {
     description: 'Test Page',
@@ -1213,6 +1282,7 @@ const htmlPagePaths = [
   '/pruneReportsForm.html',
   '/rewindReportsForm.html',
   '/ai0BalanceForm.html',
+  '/deleteNotesForm.html',
   '/metrics.html'
 ];
 
@@ -1390,6 +1460,32 @@ test('POST /rewindReportsForm.html with no selections shows the form and records
   assert.equal(await getManagerActivityCount('rewindReportsForm', 'ok'), countBefore + 1);
 });
 
+test('POST /deleteNotesForm.html deletes multiple selected notes across sources in one submission', async () => {
+  await fs.writeFile(process.env.TUTORIAL_WEB_COMMENTS_PATH!, JSON.stringify([
+    {timeStamp: '260101T0000', content: 'A web tutorial comment'}
+  ]));
+  await fs.writeFile(process.env.FEATURE_REQUESTS_PATH!, JSON.stringify([
+    {timeStamp: '260101T0001', content: 'A feature request'},
+    {timeStamp: '260101T0001', content: 'A different feature request'}
+  ]));
+  // Reconstructing the POST body's query string uses querystring.stringify, which (unlike
+  // the URLSearchParams object constructor) preserves multiple values for the same field
+  // name as repeated key=value pairs rather than collapsing them into one comma-joined
+  // value, so this exercises that multi-checkbox submission actually deletes every
+  // selected note, not just the one whose value happens to survive the collapse.
+  const res = await formRequest('POST', '/deleteNotesForm.html', [
+    ['authCode', 'test-auth-code'],
+    ['note', `tutorialWeb\t${encodeURIComponent('A web tutorial comment')}`],
+    ['note', `featureRequest\t${encodeURIComponent('A feature request')}`]
+  ]);
+  assert.equal(res.statusCode, 200);
+  const webComments = JSON.parse(await fs.readFile(process.env.TUTORIAL_WEB_COMMENTS_PATH!, 'utf8'));
+  assert.equal(webComments.length, 0);
+  const featureRequests = JSON.parse(await fs.readFile(process.env.FEATURE_REQUESTS_PATH!, 'utf8'));
+  assert.equal(featureRequests.length, 1);
+  assert.equal(featureRequests[0].content, 'A different feature request');
+});
+
 test('GET /pruneReportsForm.html records a managerActivity failure when a report file is corrupt', {timeout: 500}, async () => {
   const reportPath = path.join(fixtureDBDir, 'reports', '260101T0001-ct.json');
   const backup = await fs.readFile(reportPath, 'utf8');
@@ -1545,7 +1641,7 @@ test('POST /requestRetest.html with valid format but duplicate retest returns an
   assert.ok(res.body.includes('Test request duplicates an already submitted request'));
 });
 
-test('POST /requestAction.html with valid auth code and approval of a duplicate returns an error', {timeout: 500}, async () => {
+test('POST /requestAction.html with valid auth code approves the same target twice without error', {timeout: 500}, async () => {
   await fs.writeFile(testRequestsPath, '{}\n');
   // Create a request.
   await formRequest('POST', '/requestTest.html', {
@@ -1559,20 +1655,19 @@ test('POST /requestAction.html with valid auth code and approval of a duplicate
     authCode: 'test-auth-code',
     what: 'yes'
   });
-  // Approve it again (the requests may have been cleared, so this may succeed or fail).
-  // This test covers the requestAction answer error branch.
+  // Approve it again. enqueue.answer has no duplicate-detection logic of its own (that
+  // lives in processTestRequest, upstream of approval), so a second approval of the same
+  // target queues a second job rather than erroring.
   const res = await formRequest('POST', '/requestAction.html', {
     target: `https://example.com/action-dup-${uniqueStamp}\tAction Dup Page ${uniqueStamp}`,
     authCode: 'test-auth-code',
     what: 'yes'
   });
-  // Either it succeeds (200) or returns an error (400).
-  assert.ok(res.statusCode === 200 || res.statusCode === 400);
+  assert.equal(res.statusCode, 200);
 });
 
 test('POST /requestAction.html with valid auth code and approval of an invalid URL returns an error', async () => {
-  // A URL that starts with https:// but is not a valid URL causes
-  // enqueue.answer to return status error.
+  // A URL that starts with https:// but is not a valid URL fails index.ts's own isURL check.
   const res = await formRequest('POST', '/requestAction.html', {
     target: 'https://\tTest Page',
     authCode: 'test-auth-code',
@@ -1646,6 +1741,75 @@ test('getAbuseError uses unknown IP when no forwarding header or remote address'
   assert.equal(result.reason, 'test reason');
 });
 
+// TESTS FOR general per-request logging
+
+test('a request logs a single-line JSON record with the expected fields', async () => {
+  const logged: string[] = [];
+  const originalLog = console.log;
+  console.log = (line: string) => logged.push(line);
+  try {
+    await request('GET', '/listReports.html');
+  }
+  finally {
+    console.log = originalLog;
+  }
+  const requestLines = logged.filter(line => {
+    try {
+      return JSON.parse(line).type === 'request';
+    }
+    catch {
+      return false;
+    }
+  });
+  assert.equal(requestLines.length, 1);
+  const record = JSON.parse(requestLines[0]!);
+  assert.equal(record.method, 'GET');
+  assert.equal(record.path, '/listReports.html');
+  assert.equal(record.status, 200);
+  assert.ok(record.ip);
+  assert.ok(record.userAgent);
+  assert.ok(record.time);
+});
+
+test('a request logs its path without its query string', async () => {
+  const logged: string[] = [];
+  const originalLog = console.log;
+  console.log = (line: string) => logged.push(line);
+  try {
+    await request('GET', '/listIssues.html/260101T0000/mix?authCode=secret');
+  }
+  finally {
+    console.log = originalLog;
+  }
+  const record = logged
+  .map(line => { try {return JSON.parse(line);} catch {return null;} })
+  .find(parsed => parsed?.type === 'request');
+  assert.ok(record);
+  assert.equal(record.path, '/listIssues.html/260101T0000/mix');
+  assert.ok(!JSON.stringify(record).includes('secret'));
+});
+
+test('a smoke-test-flagged request is not logged as a general request', async () => {
+  const logged: string[] = [];
+  const originalLog = console.log;
+  console.log = (line: string) => logged.push(line);
+  try {
+    await request('GET', '/listReports.html', null, {'x-kilotest-smoke': '1'});
+  }
+  finally {
+    console.log = originalLog;
+  }
+  const requestLines = logged.filter(line => {
+    try {
+      return JSON.parse(line).type === 'request';
+    }
+    catch {
+      return false;
+    }
+  });
+  assert.equal(requestLines.length, 0);
+});
+
 // UNIT TESTS FOR startServer
 
 test('startServer starts an HTTP server when protocol is http', {timeout: 500}, async () => {

package/index.ts

@@ -23,7 +23,9 @@ import {
   isReportAvailable,
   isTimeStamp,
   isJobID,
+  isURL,
   isUsableReport,
+  isValidAuthCode,
   jobsPath,
   metricsExclusionCookieName,
   recordMetric,
@@ -40,7 +42,9 @@ import {answer as tutorialAI, handleComment as handleTutorialAIComment} from './
 import http, {type IncomingMessage, type ServerResponse} from 'node:http';
 import https from 'node:https';
 import path from 'node:path';
+import querystring from 'node:querystring';
 import {answer as ai0BalanceForm} from './web/ai0BalanceForm/index.ts';
+import {answer as deleteNotesForm} from './web/deleteNotesForm/index.ts';
 import {answer as enqueue} from './web/enqueue/index.ts';
 import {answer as enqueueForm} from './web/enqueueForm/index.ts';
 import {answer as expungeReportsForm} from './web/expungeReportsForm/index.ts';
@@ -95,6 +99,7 @@ type PageHandler = (...args: any[]) => Promise<AnswerData>;
 
 const answer: {
   ai0BalanceForm: PageHandler;
+  deleteNotesForm: PageHandler;
   enqueue: PageHandler;
   enqueueForm: PageHandler;
   expungeReportsForm: PageHandler;
@@ -124,6 +129,7 @@ const answer: {
   [key: string]: PageHandler | undefined;
 } = {
   ai0BalanceForm,
+  deleteNotesForm,
   enqueue,
   enqueueForm,
   expungeReportsForm,
@@ -205,6 +211,7 @@ export const routes = {
     '/api/*',
     '/mcp',
     '/ai0BalanceForm.html',
+    '/deleteNotesForm.html',
     '/expungeReportsForm.html',
     '/hideReportForm.html',
     '/metrics.html',
@@ -238,6 +245,7 @@ const managerPages = new Set([
   'unhideReportForm',
   'ai0BalanceForm',
   'renewWCAGForm',
+  'deleteNotesForm',
   'metrics'
 ]);
 // The set of manager pages (a subset of managerPages) whose single answer() function both
@@ -253,6 +261,7 @@ const selfSubmittingManagerPages = new Set([
   'showHiddenReportsForm',
   'unhideReportForm',
   'ai0BalanceForm',
+  'deleteNotesForm',
   'metrics'
 ]);
 // The subset of selfSubmittingManagerPages that must never be served on a direct GET
@@ -260,6 +269,17 @@ const selfSubmittingManagerPages = new Set([
 // unhideReportForm is served only by showHiddenReportsForm, once a valid authorization code
 // has been submitted), so that the names of hidden reports are never disclosed without one.
 const noDirectGetPages = new Set(['unhideReportForm']);
+// Old page names, from before a 2026-08-31 rename (see GitHub issue #3), that search
+// engines and other crawlers are still requesting. Redirecting them lets crawlers update
+// their own indexes, rather than leaving them to repeat the same dead request indefinitely.
+// TEMPORARY: retire this redirect after 2027-04-01 once crawlers have re-indexed.
+const renamedPagePrefixes: Record<string, string> = {
+  diagnoses: 'listDiagnoses',
+  reportIssue: 'listViolators',
+  reportIssues: 'listIssues',
+  rules: 'listRules',
+  targets: 'listReports'
+};
 const jobLock = createLock();
 
 // FUNCTIONS
@@ -309,16 +329,22 @@ export const serveError = async (error: Record<string, unknown>, response: Serve
     console.log('Cannot send error response because the response has ended.');
   }
 };
+// Returns the IP address a request should be attributed to: the value of its
+// x-forwarded-for header (Caddy runs in front of Kilotest, so a real client's address
+// arrives this way, not as the socket's own remote address), else the socket's remote
+// address, else 'unknown' if neither is available.
+export const getRequestIP = (request: IncomingMessage): string | string[] => {
+  const forwardedFor = request.headers['x-forwarded-for'];
+  const remoteAddress = request.socket.remoteAddress;
+  return forwardedFor || remoteAddress || 'unknown';
+};
 // Creates an error object about a suspicious request.
 export const getAbuseError = (request: IncomingMessage, reason: string | undefined) => {
   const {method, url, headers} = request;
-  const forwardedFor = headers['x-forwarded-for'];
-  const remoteAddress = request.socket.remoteAddress;
-  const ip = forwardedFor || remoteAddress || 'unknown';
   return {
     message: 'Invalid request',
     reason,
-    'IP address': ip,
+    'IP address': getRequestIP(request),
     method,
     URL: url,
     'user agent': headers['user-agent'] || 'none',
@@ -326,6 +352,39 @@ export const getAbuseError = (request: IncomingMessage, reason: string | undefin
     time: new Date().toISOString()
   };
 };
+// Logs one line for every request, successful or not, once it finishes. Unlike
+// getAbuseError (logged only for rejected requests, as a rare, human-read-in-the-moment
+// dump), this is a terse, single-line-per-request JSON record, intended to be high-volume
+// and machine-parseable, so that any kind of suspicious traffic pattern (not only the
+// specific rejection reasons getAbuseError already covers) can be recognized later. It
+// deliberately does not consult isMetricsExcluded: that exclusion exists to keep the
+// maintainer's own manual testing out of usage counts, but abuse visibility should see
+// all traffic, including the maintainer's own, or it recreates the same kind of blind
+// spot this logging exists to close.
+const logRequestOnFinish = (request: IncomingMessage, response: ServerResponse): void => {
+  const {method, headers} = request;
+  const ip = getRequestIP(request);
+  const userAgent = headers['user-agent'] || 'none';
+  const path = new URL(request.url as string, 'https://localhost:3000').pathname;
+  const originalEnd = response.end.bind(response);
+  // Reassign response.end so that every path through handleRequest logs exactly once,
+  // right before the response is actually sent, rather than requiring every dispatch
+  // branch to remember to log itself (the same class of gap that left successful
+  // requests unlogged in the first place). No query string is logged, so that a
+  // parameter such as authCode is never written to a log file.
+  response.end = ((...args: Parameters<typeof originalEnd>) => {
+    console.log(JSON.stringify({
+      type: 'request',
+      time: new Date().toISOString(),
+      ip,
+      method,
+      path,
+      status: response.statusCode,
+      userAgent
+    }));
+    return originalEnd(...args);
+  }) as typeof response.end;
+};
 // Returns whether a request carries the metrics-exclusion cookie with the value that
 // proves it. A request without a valid AUTH_CODE configured can never match, since
 // getExclusionCookieValue then hashes an empty string, which no cookie should equal.
@@ -487,6 +546,10 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
     response.end('{}');
     return;
   }
+  // Log this request once it finishes, for general abuse/usage visibility (see GitHub
+  // issue #3). Placed after the smoke-test short-circuit above, so CI's own smoke-test
+  // traffic is excluded from this log exactly as it is already excluded from metrics.
+  logRequestOnFinish(request, response);
   // Records a pageViews or apiOperations metric, unless this request's browser has proven,
   // via a valid authCode submitted earlier on metrics.html, that it belongs to the
   // maintainer testing Kilotest manually rather than to real usage.
@@ -636,13 +699,21 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
     // Otherwise, if it is for an HTML page other than the home page:
     else if (pageName.endsWith('.html')) {
       const topic = pageName.slice(0, -5);
-      // If the page can be generated and is not POST-only (a POST-only path also matches
+      // If it is for a page's old, pre-rename name:
+      if (renamedPagePrefixes[topic]) {
+        // Redirect the client permanently to the current page name, preserving any
+        // further path segments and the query string.
+        const newLocation = `/${renamedPagePrefixes[topic]}.html${pathTail ? `/${pathTail}` : ''}${search}`;
+        response.writeHead(301, {Location: newLocation});
+        response.end();
+      }
+      // Otherwise, if the page can be generated and is not POST-only (a POST-only path also matches
       // the '*.html*' GET pattern, but its handler expects POST's argument list and
       // performs no GET-appropriate rendering; a self-submitting manager page is POST-allowed
       // too, but its handler serves both methods the same way, so it is not excluded here,
       // except for a page in noDirectGetPages, which stays excluded from GET even though
       // it is self-submitting, since it must be reachable only via another page's POST):
-      if (
+      else if (
         answer[topic] &&
         !noDirectGetPages.has(topic) &&
         (!isPathAllowed('POST', pathname) || selfSubmittingManagerPages.has(topic))
@@ -793,6 +864,19 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
       );
     }
   }
+  // Otherwise, if the request is a HEAD request: only the home page supports HEAD, since
+  // UptimeRobot's uptime check is the only known HEAD caller and it targets only that path
+  // (see "Health monitoring" in docs/SERVICE.md). Its response must match what GET / would
+  // send, minus the body, so that a monitor reading headers alone sees the real page state.
+  else if (method === 'HEAD') {
+    if (['/', '/index.html'].includes(pathname)) {
+      setHeaders('text/html', '/index.html', 'medium');
+      response.end();
+    }
+    else {
+      await serveError({message: `ERROR: Invalid HEAD request (${pathname})`}, response, true);
+    }
+  }
   // Otherwise, if the request is a POST request:
   else if (method === 'POST') {
     // If the path is not authorized for POST requests:
@@ -815,7 +899,7 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
       else if (pageName === 'requestTest.html') {
         const {description, url, why} = postData as {description?: string; url: string; why?: string};
         // If the request is valid:
-        if (description && url.startsWith('https://') && why) {
+        if (description && isURL(url) && why) {
           // If a report on the page is already available:
           if (await isReportAvailable(description, url)) {
             // Report the error.
@@ -877,7 +961,7 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
         const {target, authCode} = postData as {target: string; authCode?: string};
         const [url, description] = target.split('\t') as [string, string];
         // If the request is valid:
-        if (url.startsWith('https://') && authCode === process.env.AUTH_CODE) {
+        if (isURL(url) && isValidAuthCode(authCode)) {
           // Set the non-location headers for a response.
           setHeaders('text/html', null, 'ultra');
           // If the request is an approval:
@@ -885,19 +969,10 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
             // Set a location header for a response.
             response.setHeader('content-location', pathname);
             // Process the approval and get the answer data about the remaining requests.
-            const answerData = await answer.enqueue(url, description, authCode);
-            // If the answer data are valid:
-            if (answerData.status === 'ok') {
-              await recordMetric('managerActivity', 'requestAction.html', 'ok');
-              // Serve the test-order page with the remaining recommendations.
-              response.end(answerData.answerPage);
-            }
-            // Otherwise, i.e. if they are invalid:
-            else {
-              await recordMetric('managerActivity', 'requestAction.html', 'error');
-              // Report the error.
-              await serveError({message: answerData.message}, response, true);
-            }
+            const answerData = await answer.enqueue(url, description);
+            await recordMetric('managerActivity', 'requestAction.html', 'ok');
+            // Serve the test-order page with the remaining recommendations.
+            response.end(answerData.answerPage);
           }
           // Otherwise, i.e. if it is a rejection:
           else {
@@ -968,7 +1043,12 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
         setHeaders('text/html', pathname, 'ultra');
         // Reconstruct a query string from the POST body, so the page's answer() function
         // can read its submitted parameters the same way it reads a GET query string.
-        const search = `?${new URLSearchParams(postData as Record<string, string>).toString()}`;
+        // querystring.stringify (rather than the URLSearchParams object constructor) is
+        // required here, because postData, from querystring.parse in getPOSTData, holds
+        // repeated form fields (e.g. multiple checked checkboxes sharing a name) as an
+        // array; the URLSearchParams constructor would join such an array into a single
+        // comma-separated value instead of preserving it as repeated key=value pairs.
+        const search = `?${querystring.stringify(postData as Record<string, string | string[]>)}`;
         // Get the answer data. The method is passed so the handler only processes a
         // submission for POST, never for GET, regardless of what its query string contains.
         const answerData = await answer[topic]!(pathTail, search, method);
@@ -1159,7 +1239,7 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
       }
     }
   }
-  // Otherwise, i.e. if it is neither a GET nor a POST request:
+  // Otherwise, i.e. if it is none of GET, HEAD, or POST:
   else {
     // Report its invalidity. (Caddy handles OPTIONS requests.)
     await serveError({message: 'ERROR: Invalid request method'}, response, true);

package/linkValidation.test.ts

@@ -60,6 +60,7 @@ const htmlRoutes = [
   '/expungeReportsForm.html',
   '/pruneReportsForm.html',
   '/rewindReportsForm.html',
+  '/deleteNotesForm.html',
   '/renewWCAG.html',
   '/renewWCAGForm.html',
   '/enqueue.html',

package/mcp.test.ts

@@ -157,7 +157,7 @@ test('requestFeature handler returns content and structuredContent', async () =>
   const server = createMCPServer();
   const countBefore = getToolCallCount('requestFeature');
   const result = await (server as any)._registeredTools.requestFeature.handler({
-    feature: 'A new feature idea'
+    feature: 'A new feature idea worth considering'
   });
   assert.ok(result.content);
   assert.equal(result.content[0].type, 'text');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jrpool/kilotest",
-  "version": "49.0.0",
+  "version": "51.1.0",
   "description": "Ensemble testing for front-end web quality",
   "type": "module",
   "main": "index.ts",