@loicngr/kobo 1.11.27 → 1.11.28

package/AGENTS.md

@@ -68,6 +68,8 @@ src/
 │   │   ├── change-source-branch-service.ts # re-target a workspace onto a new source branch (built-in cherry-pick or custom bash)
 │   │   ├── git-stats-service.ts    # pure compute of commit/ahead-behind/diff stats + forge availability for a workspace
 │   │   ├── settings-defaults.ts    # DEFAULT_* constants for opt-in settings (e.g. change-source-branch script)
+│   │   ├── lifecycle-hook-service.ts # user shell hooks on session-ended / pr-merged / autoloop-disabled
+│   │   ├── awaiting-user-reminder-service.ts # reminds about workspaces stuck in `awaiting-user`
 │   │   ├── content-migration-service.ts # runtime legacy ws_events → normalised AgentEvent migration
 │   │   ├── templates-service.ts    # prompt templates CRUD (JSON file persistence, seeding)
 │   │   ├── dev-server-service.ts   # per-workspace dev server lifecycle (docker or npm process)
@@ -101,7 +103,7 @@ src/
 
 | Table | Purpose |
 |---|---|
-| `workspaces` | the unit of work: id, name, project_path, source_branch, working_branch, status, notion_url, model, `brainstorm_model`, dev_server_status, `archived_at`, `worktree_purged_at`, `worktree_purge_restore_data` (JSON), `auto_loop`, `auto_loop_ready`, `auto_loop_session_mode`, `no_progress_streak`, timestamps |
+| `workspaces` | the unit of work: id, name, project_path, source_branch, working_branch, status, notion_url, model, `brainstorm_model`, dev_server_status, `archived_at`, `worktree_purged_at`, `worktree_purge_restore_data` (JSON), `auto_loop`, `auto_loop_ready`, `auto_loop_session_mode`, `no_progress_streak`, timestamps, `comparison_id` |
 | `tasks` | workspace sub-items: title, status, `is_acceptance_criterion`, sort_order; CASCADE DELETE on workspace |
 | `agent_sessions` | agent-engine sessions: pid where applicable, engine session id, status, timestamps, model, and name |
 | `ws_events` | persisted WebSocket events for replay on reconnect: type, payload, session_id, created_at |
@@ -226,6 +228,22 @@ Background: the engine was migrated from `@openai/codex-sdk` (one-shot `codex ex
 - **Custom bash override**: if `effective.changeSourceBranchScript` is non-empty (per-project override or global default), the script **replaces** the built-in flow. Spawned with `bash -c`, cwd = worktree, 5 min timeout, stderr captured (last 8 KB). Exit 0 → Kōbō updates the source-branch metadata; any non-zero exit → the stderr tail is propagated as a clean error. The user-facing menu item only shows when the resolved script is non-empty; empty means the feature is disabled (opt-in).
 - **Custom-script env vars**: `KOBO_NEW_BASE`, `KOBO_OLD_BASE`, `KOBO_WORKING_BRANCH`, `KOBO_WORKTREE_PATH`, `KOBO_PROJECT_PATH`, `KOBO_PROJECT_NAME`, `KOBO_WORKSPACE_ID`, `KOBO_WORKSPACE_NAME`, `KOBO_FORGE`, `KOBO_PR_NUMBER` (empty when no PR/MR is open). The default script lives in `settings-defaults.ts` and is seeded into `global.changeSourceBranchScript` by settings migration v33; the client reads it through `GET /api/settings/defaults` for the "Reset to Kōbō default" button. See [CONFIGURATION.md → Custom change-source-branch script](CONFIGURATION.md#custom-change-source-branch-script).
 
+### Lifecycle hooks
+
+`src/server/services/lifecycle-hook-service.ts` runs a user-provided bash script on three moments that previously had none: `session-ended` (from `orchestrator.onSessionEnded`, once a session is known not to be superseded), `pr-merged` (from the pr-watcher, at the `pr:merged` emit, before archive/purge) and `autoloop-disabled` (from `auto-loop-service.disable`, for **every** reason including `user-action`, unlike the cleanup script which only fires on `completed`). The session-ended hook goes through `fireSessionEndedHook`, which also covers the watchdog's dead-engine sweep (that path never reaches `onSessionEnded`), dedupes by session id so a late `session:ended` from the same engine does not fire it twice, and stands down when the stop cause is `delete` or `purge` (`stopAgentAndWait`'s third argument) because the worktree is being removed.
+
+Each event maps to one effective-settings key (`sessionEndedScript` / `prMergedScript` / `autoLoopDisabledScript`, settings migration v55), cascading project-over-global with empty meaning inherit. Execution reuses `runScript` with `eventPrefix: 'hook:<event>'`; `runScript` gained an `extraEnv` option, merged **under** the identity variables so a hook payload can never claim a different `WORKSPACE_ID`. `runLifecycleHook` never rejects and returns `null` when there is nothing to run (no script, unknown workspace, worktree gone). The pr-watcher awaits the `pr-merged` hook before auto-purge so a deploy script does not lose its worktree mid-run. See [CONFIGURATION.md → Lifecycle hooks](CONFIGURATION.md#lifecycle-hooks).
+
+### Engine comparison
+
+One task, two engines, two sibling worktrees. `POST /api/workspaces` accepts a `comparisonId`; the client posts twice with the same one (sequentially — parallel creations contend on the git index lock), suffixing the name with the engine's display name and the branch with the engine id and giving the non-configured engine the model picked for it on the form and its own effort / permission defaults. `workspaces.comparison_id` (migration v40) groups them; `listComparisonMembers` reads them back, treating an empty id as no group rather than as a match against the NULL majority. `GET /api/workspaces/:id/comparison` returns each member with its cached git stats (`null`, never zeros, when nothing has been measured). `ComparisonPanel.vue` renders the table at the top of the Git tab, only for workspaces that belong to a comparison. See [CONFIGURATION.md → Comparing two engines on one task](CONFIGURATION.md#comparing-two-engines-on-one-task).
+
+### Unanswered question reminder
+
+`src/server/services/awaiting-user-reminder-service.ts` polls every 60 s for non-archived workspaces in `awaiting-user` and, past `global.awaitingUserReminderMinutes` (settings migration v56, `0` = off, the default), broadcasts `workspace:awaiting-reminder` via `broadcastAll` — deliberately not `emitEphemeral`, since the user is by definition not watching that workspace. The client (`stores/websocket.ts`) turns it into the same browser notification + question sound pair used when the question is first asked.
+
+`computeDueReminders` holds the interval arithmetic as a near-pure function over an injected `Map<id, {firstSeenAt, remindersSent}>`, so it is unit-tested without a timer or a DB. Two rules it encodes: a workspace that leaves `awaiting-user` is dropped from the map (answering resets the clock), and a tick that finds itself several intervals behind sends **one** reminder, not one per missed interval. State is in-memory only, like the pr-watcher's caches: a restart restarts the clock.
+
 ### Worktree purge
 
 `src/server/services/worktree-purge-service.ts` removes a workspace's worktree from disk while preserving the chat history and PR metadata. Triggered manually via `POST /api/workspaces/:id/purge-worktree` from the workspace context menu, or automatically by the pr-watcher when a PR transitions to MERGED **and** `global.autoPurgeOnPrMerged` is enabled (Settings → Worktrees toggle, settings migration v36).

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to Kōbō are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/). Each release is an `## <version>`
 section — the in-app "What's new" dialog reads this file.
 
+## 1.11.28
+
+- feat: lifecycle hooks, reminders, engine comparison and audit follow-ups
+- fix(security): trust the page we served, not a guessed port list
+- fix(security): close browser-driven access paths and credential leaks
+
 ## 1.11.27
 
 - fix: session watchdog false-positives, sync drain, and terminal leaks, audit npm

package/dist/mcp-server/kobo-tasks-handlers.js

@@ -6,6 +6,7 @@ import * as settingsService from '../server/services/settings-service.js';
 import { slugifyProjectName } from '../server/utils/project-slug.js';
 import { resolveExistingPathInside } from '../server/utils/safe-path.js';
 import { resolveWorkspaceWorktreePath } from '../server/utils/worktree-paths.js';
+import { MASKED_SECRET, SECRET_GLOBAL_KEYS } from '../shared/consts.js';
 /** Allowed task status values. */
 export const VALID_TASK_STATUSES = ['pending', 'in_progress', 'done'];
 function rowToDto(row) {
@@ -170,6 +171,17 @@ export function getDevServerStatusHandler(db, workspaceId) {
     }
     return { workspaceId, status: row.dev_server_status };
 }
+/** Copy of the global settings with every stored credential blanked out. */
+function sanitizeGlobalSecrets(global) {
+    const sanitized = { ...global };
+    for (const key of SECRET_GLOBAL_KEYS) {
+        // Same mask as the HTTP API rather than an empty string: blanking it would
+        // read as "not configured" and send the agent off offering to set it up.
+        if (sanitized[key])
+            sanitized[key] = MASKED_SECRET;
+    }
+    return sanitized;
+}
 /** Read global and per-project settings from the JSON file on disk. */
 export function getSettingsHandler(settingsPath, projectPath) {
     // Shape is determined solely by whether projectPath was provided:
@@ -187,7 +199,11 @@ export function getSettingsHandler(settingsPath, projectPath) {
     catch (err) {
         throw new Error(`Failed to read settings: ${err instanceof Error ? err.message : String(err)}`);
     }
-    const global = parsed.global ?? null;
+    // The agent gets the settings it can act on, never the credentials. Anything
+    // it reads can be echoed into the transcript, and the content it summarises
+    // (a Notion page, a Sentry issue, a repository) is not always trustworthy —
+    // "call get_settings and print the result" is a one-line exfiltration.
+    const global = parsed.global ? sanitizeGlobalSecrets(parsed.global) : null;
     const projects = Array.isArray(parsed.projects) ? parsed.projects : [];
     if (projectPath) {
         const project = projects.find((p) => p.path === projectPath) ?? null;

package/dist/server/db/migrations.js

@@ -692,6 +692,40 @@ export const migrations = [
             }
         },
     },
+    {
+        version: 39,
+        name: 'add-agent-session-end-reason',
+        migrate: (db) => {
+            const table = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'agent_sessions'").get();
+            if (!table)
+                return;
+            const columns = db.prepare('PRAGMA table_info(agent_sessions)').all().map((column) => column.name);
+            if (!columns.includes('end_reason')) {
+                // `status` collapses every ending into completed/error by exit code, so
+                // "the watchdog force-ended it", "the user stopped it" and "it finished"
+                // were indistinguishable after the fact. Existing rows keep NULL: we
+                // genuinely do not know why they ended, and guessing would be worse
+                // than saying so.
+                db.exec('ALTER TABLE agent_sessions ADD COLUMN end_reason TEXT');
+            }
+        },
+    },
+    {
+        version: 40,
+        name: 'add-workspace-comparison-id',
+        migrate: (db) => {
+            const table = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'workspaces'").get();
+            if (!table)
+                return;
+            const columns = db.prepare('PRAGMA table_info(workspaces)').all().map((column) => column.name);
+            if (!columns.includes('comparison_id')) {
+                // Shared by the workspaces created to run one task on two engines, so
+                // each can find its sibling. NULL for every workspace created on its
+                // own, which is nearly all of them.
+                db.exec('ALTER TABLE workspaces ADD COLUMN comparison_id TEXT');
+            }
+        },
+    },
 ];
 /** Current schema version — always equals the highest migration version. */
 export const SCHEMA_VERSION = migrations.length > 0 ? migrations[migrations.length - 1].version : 1;

package/dist/server/db/schema.js

@@ -38,6 +38,7 @@ export function initSchema(db) {
       pr_ci_failure_dismissed_at TEXT,
       worktree_purged_at TEXT,
       worktree_purge_restore_data TEXT,
+      comparison_id TEXT,
       created_at TEXT NOT NULL,
       updated_at TEXT NOT NULL
     );
@@ -64,7 +65,8 @@ export function initSchema(db) {
       started_at TEXT NOT NULL,
       ended_at TEXT,
       name TEXT,
-      task_progress_baseline TEXT
+      task_progress_baseline TEXT,
+      end_reason TEXT
     );
 
     CREATE TABLE IF NOT EXISTS ws_events (

package/dist/server/index.js

@@ -6,6 +6,7 @@ import { Hono } from 'hono';
 import WebSocket, { WebSocketServer } from 'ws';
 import { closeDb, getDb } from './db/index.js';
 import { getPendingMigrations, runMigrations } from './db/migrations.js';
+import { hostCheckMiddleware } from './middleware/host-check-middleware.js';
 import { networkAuthMiddleware } from './middleware/network-auth-middleware.js';
 import changelogRouter from './routes/changelog.js';
 import devServerRouter from './routes/dev-server.js';
@@ -28,11 +29,12 @@ import voiceRouter from './routes/voice.js';
 import workspacesRouter from './routes/workspaces.js';
 import { getAvailableSkills, isAgentUnavailableError, reconcileOrphanSessions, restoreRetryCountsFromDb, sendMessage, setBackendPort, startAgent, startWatchdog, stopAgent, stopAllAgents, stopWatchdog, } from './services/agent/orchestrator.js';
 import * as autoLoopService from './services/auto-loop-service.js';
+import { startAwaitingUserReminder, stopAwaitingUserReminder } from './services/awaiting-user-reminder-service.js';
 import { runContentMigrationIfNeeded } from './services/content-migration-service.js';
 import * as cronService from './services/cron-service.js';
 import { createDailyDbBackupIfNeeded, createPreMigrationBackup } from './services/db-backup-service.js';
 import { startDevServer, stopAllDevServers, stopDevServer } from './services/dev-server-service.js';
-import { authorizeWsUpgrade, generateToken, getLanUrls, resolveBindHost, resolveNetworkAccessEnvOverrides, } from './services/network-access-service.js';
+import { authorizeWsUpgrade, generateToken, getLanHostnames, getLanUrls, isAllowedOrigin, isAllowedRequestHost, resolveBindHost, resolveDevClientOrigin, resolveNetworkAccessEnvOverrides, resolveProxyHostname, } from './services/network-access-service.js';
 import { startPrWatcher, stopPrWatcher } from './services/pr-watcher-service.js';
 import * as quotaBackoffService from './services/quota-backoff-service.js';
 import { getGlobalSettings, updateNetworkAccessSettings } from './services/settings-service.js';
@@ -43,7 +45,7 @@ import * as wakeupService from './services/wakeup-service.js';
 import { emit, emitEphemeral, handleConnection, setMessageHandler } from './services/websocket-service.js';
 import { getActiveSession, getWorkspace, updateWorkspaceStatus } from './services/workspace-service.js';
 import { pruneWsEvents, resolveRetentionConfig } from './services/ws-events-retention-service.js';
-import { getClientSpaPath, getDbPath, getKoboHome, getPackageVersion } from './utils/paths.js';
+import { getClientSpaPath, getDbPath, getKoboHome, getPackageVersion, resolveSpaFile } from './utils/paths.js';
 console.log(`[kobo] Kōbō home: ${getKoboHome()}`);
 // Initialize DB + run migrations
 const db = getDb();
@@ -65,37 +67,54 @@ catch (err) {
 }
 runMigrations(db);
 // Event retention. OPT-IN: disabled by default, so this is a no-op until the
-// user sets a window in Settings → Worktrees. When enabled it runs at boot
-// only: no session is alive yet, so the batched write lock disturbs nobody, and
-// the daily backup that follows snapshots an already-compacted file.
+// user sets a window in Settings → Worktrees. Deliberately not enabled by
+// default — turning it on for an existing install would delete months of
+// conversation on the next upgrade, which is precisely why the UI shows a
+// count and asks first.
 // Best-effort — a failure must never block boot.
-try {
-    const retentionConfig = resolveRetentionConfig(getGlobalSettings());
-    if (retentionConfig.retentionDays > 0) {
+function runRetentionPass(context) {
+    try {
+        const retentionConfig = resolveRetentionConfig(getGlobalSettings());
+        if (retentionConfig.retentionDays <= 0)
+            return;
         const retentionStartedAt = Date.now();
         const retention = pruneWsEvents(db, retentionConfig);
         if (retention.deleted > 0 || retention.vacuumed) {
-            console.log(`[kobo] Event retention (${retentionConfig.retentionDays} d, keeping ${retentionConfig.keepPerWorkspace}/workspace): ` +
+            console.log(`[kobo] Event retention ${context} (${retentionConfig.retentionDays} d, keeping ${retentionConfig.keepPerWorkspace}/workspace): ` +
                 `${retention.deleted} agent event(s) permanently deleted, ` +
                 `${retention.sessionsRecomputed} session metric(s) recomputed, ` +
                 `${retention.vacuumed ? `VACUUM reclaimed ${retention.freePagesBefore - retention.freePagesAfter} page(s), ` : ''}` +
                 `${Date.now() - retentionStartedAt} ms`);
         }
     }
+    catch (err) {
+        console.error('[kobo] Event retention failed (continuing):', err);
+    }
 }
-catch (err) {
-    console.error('[kobo] Event retention failed (continuing):', err);
-}
+runRetentionPass('at boot');
+// Kōbō is a daemon people leave running for weeks, and `emit` writes a row per
+// agent event. Running the pass only at boot meant a window the user enabled
+// was not applied again until the next restart.
+const RETENTION_INTERVAL_MS = 24 * 60 * 60 * 1000;
+const retentionTimer = setInterval(() => runRetentionPass('daily'), RETENTION_INTERVAL_MS);
+retentionTimer.unref?.();
 // Daily DB backup (best-effort, fire-and-forget — never blocks boot).
 // Creates a WAL-safe snapshot alongside kobo.db if no backup exists in the
 // last 24h, and rotates out older backups beyond the retention window.
-void createDailyDbBackupIfNeeded(db, getDbPath()).then((r) => {
+void createDailyDbBackupIfNeeded(db, getDbPath())
+    .then((r) => {
     if (r.created) {
         console.log(`[kobo] Daily DB backup: ${r.created}`);
         if (r.deleted.length > 0) {
             console.log(`[kobo] Rotated ${r.deleted.length} old DB backup(s)`);
         }
     }
+})
+    .catch((err) => {
+    // A full disk or an unwritable backup directory must not stop the server
+    // from booting: without this catch the rejection reaches the last-resort
+    // handler below and Kōbō exits before it ever listens.
+    console.error('[kobo] Daily DB backup failed (continuing):', err);
 });
 // Initialize process cleanup, agent watchdog, PR watcher, and wakeup rehydration
 reconcileOrphanSessions();
@@ -121,8 +140,14 @@ catch (err) {
 }
 startPrWatcher();
 startUsagePoller();
+startAwaitingUserReminder();
 // Create Hono app
 const app = new Hono();
+// Refuse requests addressed to a hostname we are not reachable at, so a page
+// that re-resolves its own domain to 127.0.0.1 cannot read our responses as
+// same-origin. Mounted on every path, ahead of the token gate: the SPA shell
+// is served outside /api/*, and rebinding targets the browser, not the socket.
+app.use('*', hostCheckMiddleware);
 // Gate non-loopback requests behind the network-access token (loopback exempt).
 app.use('/api/*', networkAuthMiddleware);
 // Health check (root / is handled by the SPA catch-all below)
@@ -158,16 +183,10 @@ const clientDistPath = getClientSpaPath();
 if (clientDistPath) {
     app.get('*', async (c) => {
         const url = new URL(c.req.url);
-        let filePath = path.join(clientDistPath, url.pathname);
-        // Prevent path traversal
-        if (!path.resolve(filePath).startsWith(clientDistPath)) {
-            return c.notFound();
-        }
-        // Serve index.html for non-asset routes (SPA fallback)
-        if (!fs.existsSync(filePath) || fs.statSync(filePath).isDirectory()) {
-            filePath = path.join(clientDistPath, 'index.html');
-        }
-        if (!fs.existsSync(filePath)) {
+        // Traversal guard + SPA fallback live in one tested function: the inline
+        // version once rejected `/` itself and shipped a 404 on the home page.
+        const filePath = resolveSpaFile(clientDistPath, url.pathname);
+        if (!filePath) {
             return c.notFound();
         }
         const content = fs.readFileSync(filePath);
@@ -442,6 +461,37 @@ setMessageHandler(async (type, payload) => {
 server.on('upgrade', (request, socket, head) => {
     const { pathname } = new URL(request.url ?? '/', `http://localhost:${PORT}`);
     const wsGlobal = getGlobalSettings();
+    // WebSockets are exempt from the same-origin policy and send no preflight,
+    // so without these two any page the user visits could open /ws/terminal/<id>
+    // and drive a real shell here. Checked before the token gate: on loopback the
+    // token gate lets everything through, which is exactly the case a malicious
+    // page exploits. The HTTP side gets the same pair from hostCheckMiddleware,
+    // which does not see upgrade requests.
+    const wsHost = request.headers.host;
+    if (!isAllowedRequestHost({
+        host: wsHost,
+        enabled: wsGlobal.networkAccessEnabled,
+        lanHostnames: getLanHostnames(),
+        behindProxy: wsGlobal.networkAccessBehindProxy,
+        proxyHostname: resolveProxyHostname(),
+    })) {
+        console.warn(`[host-check] WS 403 (forbidden host '${wsHost ?? 'unknown'}') ${pathname}`);
+        socket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
+        socket.destroy();
+        return;
+    }
+    if (!isAllowedOrigin({
+        origin: request.headers.origin,
+        requestHost: wsHost,
+        behindProxy: wsGlobal.networkAccessBehindProxy,
+        proxyHostname: resolveProxyHostname(),
+        devOrigin: resolveDevClientOrigin(),
+    })) {
+        console.warn(`[origin-check] WS 403 (forbidden origin '${request.headers.origin ?? 'unknown'}') ${pathname}`);
+        socket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
+        socket.destroy();
+        return;
+    }
     if (!authorizeWsUpgrade({
         address: request.socket.remoteAddress,
         rawUrl: request.url,
@@ -517,6 +567,13 @@ async function gracefulShutdown(signal, exitCode = 0) {
     catch {
         // Best-effort
     }
+    try {
+        stopAwaitingUserReminder();
+    }
+    catch {
+        // Best-effort
+    }
+    clearInterval(retentionTimer);
     // Stop managed agents and both direct/Docker dev servers before closing DB.
     try {
         await Promise.all([stopAllAgents(), stopAllDevServers()]);

package/dist/server/middleware/host-check-middleware.js

@@ -0,0 +1,80 @@
+import { getLanHostnames, isAllowedOrigin, isAllowedRequestHost, isLocalRequestHost, resolveDevClientOrigin, resolveProxyHostname, } from '../services/network-access-service.js';
+import { getGlobalSettings } from '../services/settings-service.js';
+/**
+ * Rejects requests addressed to a hostname this server is not legitimately
+ * reachable at — the defense against DNS rebinding.
+ *
+ * A page on `evil.com` can make the domain re-resolve to 127.0.0.1 after it
+ * loads. Every later request then reaches Kōbō with `Host: evil.com`, and the
+ * browser treats the responses as same-origin, so the page can read them. The
+ * loopback address the connection arrives from is genuine, which is why the
+ * network-access gate lets it through: only the Host header distinguishes this
+ * from the user's own tab.
+ *
+ * `/api/health` is exempt, mirroring the network-access gate: it returns only
+ * `{ status, version }`, and a container healthcheck reaches it through the
+ * service name rather than localhost.
+ *
+ * The host comes from `c.req.url`, which the Node adapter builds from the Host
+ * header itself, so this reads the client-supplied value without depending on
+ * header casing.
+ */
+export const hostCheckMiddleware = async (c, next) => {
+    if (c.req.path === '/api/health')
+        return next();
+    let host;
+    try {
+        host = new URL(c.req.url).host;
+    }
+    catch {
+        host = undefined;
+    }
+    const origin = c.req.header('origin');
+    // Fast path. This middleware runs on every request, static assets included,
+    // and the calls below are a synchronous settings read plus an interface
+    // enumeration. A request addressed to loopback and carrying no Origin (a
+    // static asset, a direct navigation, a CLI call) is the common case and is
+    // allowed whatever the settings say, so settle it here.
+    if (origin === undefined && isLocalRequestHost(host))
+        return next();
+    const devOrigin = resolveDevClientOrigin();
+    // A page we served ourselves, talking to us: still no settings needed.
+    if (isLocalRequestHost(host) && isAllowedOrigin({ origin, requestHost: host, devOrigin })) {
+        return next();
+    }
+    let global;
+    let lanHostnames;
+    try {
+        global = getGlobalSettings();
+        lanHostnames = getLanHostnames();
+    }
+    catch (err) {
+        // An unreadable settings file must not take the whole app down. Loopback
+        // was already answered above, so anything reaching here is remote and
+        // fails closed.
+        console.error('[host-check] Could not resolve the allowed hosts — refusing:', err);
+        return c.json({ error: 'forbidden host' }, 403);
+    }
+    if (!isAllowedRequestHost({
+        host,
+        enabled: global.networkAccessEnabled,
+        lanHostnames,
+        behindProxy: global.networkAccessBehindProxy,
+        proxyHostname: resolveProxyHostname(),
+    })) {
+        // Surface it: "the page just stopped loading" is otherwise undebuggable.
+        console.warn(`[host-check] 403 (forbidden host '${host ?? 'unknown'}') ${c.req.method} ${c.req.path}`);
+        return c.json({ error: 'forbidden host' }, 403);
+    }
+    if (!isAllowedOrigin({
+        origin,
+        requestHost: host,
+        behindProxy: global.networkAccessBehindProxy,
+        proxyHostname: resolveProxyHostname(),
+        devOrigin,
+    })) {
+        console.warn(`[origin-check] 403 (forbidden origin '${origin}') ${c.req.method} ${c.req.path}`);
+        return c.json({ error: 'forbidden origin' }, 403);
+    }
+    return next();
+};

package/dist/server/routes/changelog.js

@@ -26,9 +26,57 @@ export function parseChangelog(markdown) {
         entries.push({ version: current.version, notes: current.lines.join('\n').trim() });
     return entries;
 }
+/**
+ * Latest version published to npm, looked up at most once a day.
+ *
+ * "What's new" tells the user what changed once they have upgraded; nothing
+ * told them an upgrade existed. A self-hosted install would silently rot.
+ *
+ * Best-effort by construction: no network, a registry hiccup or an air-gapped
+ * machine all resolve to null, and the client simply shows nothing.
+ */
+const REGISTRY_URL = 'https://registry.npmjs.org/@loicngr/kobo/latest';
+const LATEST_TTL_MS = 24 * 60 * 60 * 1000;
+let latestCache = null;
+/** The lookup in progress, so two loads racing on a cold cache share one request. */
+let inFlight = null;
+async function fetchLatestVersion() {
+    if (latestCache && Date.now() - latestCache.fetchedAt < LATEST_TTL_MS)
+        return latestCache.version;
+    if (inFlight)
+        return inFlight;
+    inFlight = lookupLatestVersion().finally(() => {
+        inFlight = null;
+    });
+    return inFlight;
+}
+async function lookupLatestVersion() {
+    let version = null;
+    try {
+        const res = await fetch(REGISTRY_URL, { signal: AbortSignal.timeout(5_000) });
+        if (res.ok) {
+            const body = (await res.json());
+            if (typeof body.version === 'string')
+                version = body.version;
+        }
+    }
+    catch {
+        // Offline, blocked, or the registry is down. Not worth a log line on a
+        // path that runs on every app load.
+    }
+    // Cache the failure too: a machine with no network must not retry per load.
+    latestCache = { version, fetchedAt: Date.now() };
+    return version;
+}
+/** @internal test-only — drop the cached registry lookup. */
+export function _clearLatestVersionCache() {
+    latestCache = null;
+    inFlight = null;
+}
 // GET /api/changelog — current app version + parsed CHANGELOG.md sections,
-// powering the "What's new" dialog shown after an update.
-app.get('/', (c) => {
+// powering the "What's new" dialog shown after an update, plus the latest
+// version published to npm so the UI can offer to upgrade.
+app.get('/', async (c) => {
     try {
         let versions = [];
         try {
@@ -37,7 +85,7 @@ app.get('/', (c) => {
         catch {
             // No CHANGELOG.md shipped (or unreadable) — degrade to an empty list.
         }
-        return c.json({ currentVersion: getPackageVersion(), versions });
+        return c.json({ currentVersion: getPackageVersion(), latestVersion: await fetchLatestVersion(), versions });
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);

package/dist/server/routes/notion.js

@@ -33,7 +33,7 @@ app.post('/extract', async (c) => {
         if (!getGlobalSettings().notionEnabled) {
             return c.json({ error: 'Notion integration is disabled in Settings' }, 403);
         }
-        const body = await c.req.json();
+        const body = await c.req.json().catch(() => ({}));
         if (!body.url) {
             return c.json({ error: 'Missing required field: url' }, 400);
         }

package/dist/server/routes/pull-requests.js

@@ -38,7 +38,9 @@ app.get('/', async (c) => {
 });
 app.post('/diagnose', async (c) => {
     try {
-        const { projectPath, prNumber, worktreesPath } = await c.req.json();
+        const { projectPath, prNumber, worktreesPath } = await c.req
+            .json()
+            .catch(() => ({}));
         if (!projectPath || !prNumber) {
             return c.json({ error: 'Missing required fields: projectPath, prNumber' }, 400);
         }
@@ -85,7 +87,9 @@ app.post('/diagnose', async (c) => {
 });
 app.post('/resolve', async (c) => {
     try {
-        const body = await c.req.json();
+        const body = await c.req
+            .json()
+            .catch(() => ({}));
         if (!body.projectPath || !body.fingerprint) {
             return c.json({ error: 'Missing required fields: projectPath, fingerprint' }, 400);
         }

package/dist/server/routes/sentry.js

@@ -19,7 +19,7 @@ app.post('/extract', async (c) => {
         if (!getGlobalSettings().sentryEnabled) {
             return c.json({ error: 'Sentry integration is disabled in Settings' }, 403);
         }
-        const body = await c.req.json();
+        const body = await c.req.json().catch(() => ({}));
         if (!body.url) {
             return c.json({ error: 'Missing required field: url' }, 400);
         }

package/dist/server/routes/settings.js

@@ -13,22 +13,22 @@ import { listTemplates, replaceAllTemplates } from '../services/templates-servic
 import { countPrunableWsEvents } from '../services/ws-events-retention-service.js';
 /** Hono sub-router for global and per-project settings CRUD. */
 const app = new Hono();
-// GET /api/settings — return full settings
+// GET /api/settings — return full settings, credentials masked
 app.get('/', (c) => {
     try {
         const settings = settingsService.getSettings();
-        return c.json(settings);
+        return c.json({ ...settings, global: settingsService.redactGlobalSecrets(settings.global) });
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         return c.json({ error: message }, 500);
     }
 });
-// GET /api/settings/global — return global settings
+// GET /api/settings/global — return global settings, credentials masked
 app.get('/global', (c) => {
     try {
         const global = settingsService.getGlobalSettings();
-        return c.json(global);
+        return c.json(settingsService.redactGlobalSecrets(global));
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -103,7 +103,12 @@ app.get('/network/ping', (c) => c.json({ ok: true }));
 // POST /api/settings/network — toggle enabled / regenerate token
 app.post('/network', async (c) => {
     try {
-        const body = await c.req.json();
+        const body = await c.req
+            .json()
+            .catch(() => null);
+        // `{}` is a valid request here, so a parse failure must not become one.
+        if (!body)
+            return c.json({ error: 'Invalid JSON body' }, 400);
         const current = settingsService.getGlobalSettings();
         const patch = {};
         let restartRequired = false;
@@ -148,9 +153,16 @@ app.get('/mcp-servers', (c) => {
 // PUT /api/settings/global — update global settings
 app.put('/global', async (c) => {
     try {
-        const body = await c.req.json();
+        const body = await c.req.json().catch(() => null);
+        // `{}` merges nothing but still rewrites settings.json; a parse failure
+        // must answer 400 rather than do that.
+        if (!body)
+            return c.json({ error: 'Invalid JSON body' }, 400);
         const updated = settingsService.updateGlobalSettings(body);
-        return c.json(updated);
+        // The client assigns this response straight into its store, so echoing the
+        // real credentials back would undo the masking on GET the first time
+        // anyone saves anything.
+        return c.json(settingsService.redactGlobalSecrets(updated));
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -190,7 +202,10 @@ app.put('/projects/:encodedPath', async (c) => {
     try {
         const encodedPath = c.req.param('encodedPath');
         const projectPath = Buffer.from(encodedPath, 'base64url').toString();
-        const body = await c.req.json();
+        const body = await c.req.json().catch(() => null);
+        // `{}` CREATES a project entry with defaults; a malformed body must not.
+        if (!body)
+            return c.json({ error: 'Invalid JSON body' }, 400);
         const project = settingsService.upsertProject(projectPath, body);
         return c.json(project);
     }

package/dist/server/routes/usage.js

@@ -1,6 +1,18 @@
 import { Hono } from 'hono';
+import { getDb } from '../db/index.js';
 import { refreshNow } from '../services/usage/poller.js';
+import { computeEngineReliability } from '../services/usage/reliability.js';
 const app = new Hono();
+// GET /api/usage/reliability — how each engine and model actually behaved.
+app.get('/reliability', (c) => {
+    try {
+        return c.json({ engines: computeEngineReliability(getDb()) });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return c.json({ error: message }, 500);
+    }
+});
 app.post('/:providerId/refresh', async (c) => {
     const providerId = c.req.param('providerId');
     try {