@matt82198/aesop 0.1.0-beta.5 → 0.1.0

package/ui/config.py

@@ -34,8 +34,28 @@ def reload():
     # PORT: env PORT > default 8770
     PORT = int(os.getenv("PORT", "8770"))
 
-    # Determine AESOP_ROOT: env AESOP_ROOT > default $HOME/aesop
-    AESOP_ROOT = Path(os.getenv("AESOP_ROOT", Path.home() / "aesop"))
+    # Determine AESOP_ROOT with fallback tiers (matching daemons/run-watchdog.sh pattern):
+    # (1) AESOP_ROOT env var if set
+    # (2) Derive from file location: Path(__file__).resolve().parents[1]
+    # (3) Load config from derived location; if it has aesop_root, use that
+    env_root = os.getenv("AESOP_ROOT")
+    if env_root:
+        AESOP_ROOT = Path(env_root)
+    else:
+        # Derive from file location (matches daemons/run-watchdog.sh pattern)
+        AESOP_ROOT = Path(__file__).resolve().parents[1]
+
+        # Check if derived location's config has aesop_root key
+        derived_config_file = AESOP_ROOT / "aesop.config.json"
+        if derived_config_file.exists():
+            try:
+                with open(derived_config_file) as f:
+                    derived_config = json.load(f)
+                    if "aesop_root" in derived_config:
+                        AESOP_ROOT = Path(derived_config["aesop_root"])
+            except Exception:
+                # Silently ignore config errors here; will attempt full load below
+                pass
 
     # Try to load config file for additional settings
     CONFIG_FILE = AESOP_ROOT / "aesop.config.json"

package/ui/cost.py

@@ -63,6 +63,75 @@ from pathlib import Path
 import config
 
 
+def _validate_ledger_format(lines):
+    """Validate that ledger has the expected column structure.
+
+    Checks the first non-empty, non-separator, non-header line to ensure it looks like a data row
+    (has ISO timestamp, agent type, model, numeric fields, verdict). Returns (is_valid, error_message).
+
+    Expected format:
+      | ISO timestamp | agent_type | model | duration | tokens_in | tokens_out | verdict |
+      |---|---|---|---|---|---|---|
+      | 2026-07-11T22:08:17 | Agent | claude-haiku-4-5-20251001 | 0 | 8 | 186 | OK |
+    """
+    for line in lines:
+        line = line.strip()
+
+        # Skip empty lines
+        if not line:
+            continue
+
+        # Skip separator lines (all dashes, pipes, and spaces)
+        if all(c in '|- ' for c in line):
+            continue
+
+        # This is the first real line; validate it
+        if not line.startswith('|') or not line.endswith('|'):
+            return False, "First data line does not start/end with pipe"
+
+        parts = [p.strip() for p in line.split('|')]
+
+        # Should have 9 parts: [empty, col1, col2, col3, col4, col5, col6, col7, empty]
+        if len(parts) != 9:
+            return False, f"Expected 7 columns, got {len(parts) - 2}"
+
+        # Extract columns and validate types
+        try:
+            timestamp = parts[1]
+            agent_type = parts[2]
+            model = parts[3]
+            duration_str = parts[4]
+            tokens_in_str = parts[5]
+            tokens_out_str = parts[6]
+            verdict = parts[7]
+
+            # Skip header line if timestamp column contains "timestamp" or "ISO"
+            if 'timestamp' in timestamp.lower() or 'iso' in timestamp.lower():
+                continue
+
+            # Check if timestamp looks like ISO format (contains 'T' and '-')
+            if 'T' not in timestamp or '-' not in timestamp:
+                return False, f"First data line does not have ISO timestamp in column 1: {timestamp}"
+
+            # Check if tokens are numeric
+            try:
+                int(tokens_in_str)
+                int(tokens_out_str)
+            except ValueError:
+                return False, f"Token columns must be numeric, got tokens_in={tokens_in_str}, tokens_out={tokens_out_str}"
+
+            # Check if verdict is valid
+            if verdict not in ("OK", "FAILED", "EMPTY", "HUNG"):
+                return False, f"First data line has invalid verdict: {verdict}"
+
+            return True, ""
+        except IndexError:
+            return False, "First data line has missing columns"
+
+    # No data lines found
+    return True, ""  # Empty ledger is ok
+
+
 def get_cost_summary():
     """Parse the outcomes ledger and return cost/token/verdict aggregations.
 
@@ -70,13 +139,18 @@ def get_cost_summary():
     Returns an empty summary with documented shape if ledger is missing or empty.
     Malformed lines are skipped and counted in skipped_lines.
 
+    Validates ledger format on first data line. If format is invalid, returns
+    a summary containing {"error": "ledger format invalid"} and logs to stderr.
+
     All config paths are read at call time (not import time) to ensure
     test-fixture isolation via config.reload().
 
     Returns:
         dict: CostSummary with models, daily_totals, overall_scorecard,
-              skipped_lines, has_pricing, estimates_by_model.
+              skipped_lines, has_pricing, estimates_by_model (or error field if invalid).
     """
+    import sys
+
     # Read ledger path at call time
     ledger_file = config.STATE_DIR / "ledger" / "OUTCOMES-LEDGER.md"
 
@@ -113,6 +187,13 @@ def get_cost_summary():
 
     lines = content.strip().split('\n')
 
+    # Validate ledger format
+    is_valid, error_msg = _validate_ledger_format(lines)
+    if not is_valid:
+        print(f"[cost] Ledger format invalid: {error_msg}", file=sys.stderr, flush=True)
+        result["error"] = "ledger format invalid"
+        return result
+
     # Parse each line
     for line in lines:
         line = line.strip()
@@ -121,15 +202,20 @@ def get_cost_summary():
         if not line:
             continue
 
-        # Skip header separator lines (all dashes and pipes) — silently, don't count as skipped
-        if all(c in '|-' for c in line):
+        # Skip header separator lines (all dashes, pipes, and spaces) — silently, don't count as skipped
+        if all(c in '|- ' for c in line):
             continue
 
         # Parse pipe-delimited row
         if not line.startswith('|') or not line.endswith('|'):
+            print(f"[cost] Skipping malformed line (no pipe delimiters): {line[:50]}", file=sys.stderr, flush=True)
             result["skipped_lines"] += 1
             continue
 
+        # Skip separator lines (all dashes, pipes, and spaces) — silently, don't count as skipped
+        if all(c in '|- ' for c in line):
+            continue
+
         # Split by pipe and strip whitespace
         parts = [p.strip() for p in line.split('|')]
 
@@ -137,6 +223,7 @@ def get_cost_summary():
         # Format: | col1 | col2 | col3 | col4 | col5 | col6 | col7 |
         # After split: ['', 'col1', 'col2', 'col3', 'col4', 'col5', 'col6', 'col7', '']
         if len(parts) < 9:  # Need at least 9 parts (empty + 7 columns + empty)
+            print(f"[cost] Skipping line with too few columns ({len(parts) - 2}): {line[:50]}", file=sys.stderr, flush=True)
             result["skipped_lines"] += 1
             continue
 
@@ -150,19 +237,26 @@ def get_cost_summary():
             tokens_out_str = parts[6]
             verdict = parts[7]
         except IndexError:
+            print(f"[cost] Skipping line with missing columns: {line[:50]}", file=sys.stderr, flush=True)
             result["skipped_lines"] += 1
             continue
 
+        # Skip header line if timestamp column contains "timestamp" or "ISO" — silently, don't count as skipped
+        if 'timestamp' in timestamp.lower() or 'iso' in timestamp.lower():
+            continue
+
         # Parse numeric fields
         try:
             tokens_in = int(tokens_in_str)
             tokens_out = int(tokens_out_str)
         except ValueError:
+            print(f"[cost] Skipping line with non-numeric tokens (in={tokens_in_str}, out={tokens_out_str}): {line[:50]}", file=sys.stderr, flush=True)
             result["skipped_lines"] += 1
             continue
 
         # Validate verdict
         if verdict not in ("OK", "FAILED", "EMPTY", "HUNG"):
+            print(f"[cost] Skipping line with invalid verdict ({verdict}): {line[:50]}", file=sys.stderr, flush=True)
             result["skipped_lines"] += 1
             continue
 
@@ -170,6 +264,7 @@ def get_cost_summary():
         try:
             date_str = timestamp.split('T')[0]
         except IndexError:
+            print(f"[cost] Skipping line with invalid timestamp format: {line[:50]}", file=sys.stderr, flush=True)
             result["skipped_lines"] += 1
             continue
 

package/ui/csrf.py

@@ -9,6 +9,7 @@ CRITICAL: This module reads config paths LIVE at call time via 'import config',
 never 'from config import <path>'. This ensures paths are recomputed when
 config.reload() is called (e.g., between test fixtures).
 """
+import hmac
 import os
 import secrets
 import sys
@@ -138,7 +139,7 @@ def validate_csrf_request(headers):
     if not token:
         return (False, "Missing X-Aesop-Token header")
 
-    if token != SESSION_TOKEN:
+    if not hmac.compare_digest(token, SESSION_TOKEN):
         return (False, "Invalid X-Aesop-Token")
 
     return (True, None)

package/ui/handler.py

@@ -13,6 +13,7 @@ import config
 import cost
 import csrf
 import sse
+import wave_prs
 import api
 import api.tracker
 import api.submit
@@ -25,7 +26,8 @@ from collectors import (_snapshot_data, _snapshot_tracker,
                        get_recent_events, get_repos_status,
                        parse_audit_backlog)
 from agents import (_AGENT_ID_FORBIDDEN, _transcripts_fingerprint,
-                   extract_agent_dispatch_prompt, get_fleet_agents)
+                   extract_agent_dispatch_prompt, get_agent_detail,
+                   get_fleet_agents)
 from sse import (_latest_lock, _latest_snapshots, _maybe_emit,
                 register_sse_client, unregister_sse_client)
 
@@ -34,6 +36,30 @@ from sse import (_latest_lock, _latest_snapshots, _maybe_emit,
 # frontend's first paint is one round trip (plan D3.1).
 _STATE_SECTIONS = ("data", "backlog", "agents", "tracker", "status", "cost")
 
+
+def _path_is_contained(child, root):
+    """Check if child path is contained within root path (no traversal).
+
+    Returns True if child is under root, False if it escapes (e.g., via ..).
+    Uses Path.is_relative_to (Python 3.9+) with a fallback for older runtimes.
+
+    Args:
+        child: Path object (typically resolved)
+        root: Path object (typically resolved)
+
+    Returns:
+        bool: True if child is contained within root, False otherwise
+    """
+    try:
+        return child.is_relative_to(root.resolve())
+    except AttributeError:
+        # Path.is_relative_to requires Python 3.9+; fall back for older runtimes.
+        try:
+            child.relative_to(root.resolve())
+            return True
+        except ValueError:
+            return False
+
 # MIME types for the built dist's content-hashed assets (wave-14, plan D3.4).
 _ASSET_MIME = {
     ".js": "text/javascript; charset=utf-8",
@@ -66,6 +92,79 @@ def _is_local_origin(origin):
     )
 
 
+def _is_valid_host_header(host_header, expected_port):
+    """True if Host header value is on the loopback allowlist.
+
+    DNS-rebinding mitigation (wave-19): validates that the Host header
+    matches one of the allowed loopback addresses with the correct port.
+
+    Allowed forms (where port matches expected_port):
+    - 127.0.0.1 (no port, implies http default)
+    - 127.0.0.1:<port>
+    - localhost (no port)
+    - localhost:<port>
+    - [::1] (IPv6 loopback, no port)
+    - [::1]:<port>
+
+    Args:
+        host_header: The value of the Host header (may be None/empty)
+        expected_port: the port the server is actually bound to (validate
+            against the live socket, not config.PORT — a test or a
+            dynamically-assigned ephemeral port can differ from config)
+
+    Returns:
+        bool: True if host is on the local allowlist, False otherwise
+    """
+    if not host_header:
+        return False
+
+    host_header = host_header.strip()
+
+    # Extract host and port from the header value
+    # Handle IPv6 format [::1]:port
+    if host_header.startswith("["):
+        # IPv6 format: [::1] or [::1]:port
+        if "]" not in host_header:
+            return False
+        bracket_end = host_header.index("]")
+        host_part = host_header[:bracket_end + 1]  # Include brackets
+        remainder = host_header[bracket_end + 1:]
+        if remainder:
+            # Port must follow immediately with a colon
+            if not remainder.startswith(":"):
+                return False
+            try:
+                port_part = int(remainder[1:])
+            except (ValueError, IndexError):
+                return False
+        else:
+            port_part = None
+    else:
+        # IPv4 or hostname format: 127.0.0.1, 127.0.0.1:port, localhost, localhost:port
+        if ":" in host_header:
+            host_part, port_str = host_header.rsplit(":", 1)
+            try:
+                port_part = int(port_str)
+            except ValueError:
+                return False
+        else:
+            host_part = host_header
+            port_part = None
+
+    # Check if host is on allowlist (127.0.0.1, localhost, or [::1])
+    # RFC 7230: hostnames are case-insensitive, so lowercase before comparing
+    allowed_hosts = ("127.0.0.1", "localhost", "[::1]")
+    if host_part.lower() not in allowed_hosts:
+        return False
+
+    # If a port was specified, it must match the server's actual bound port
+    if port_part is not None:
+        if port_part != expected_port:
+            return False
+
+    return True
+
+
 class DashboardHandler(http.server.BaseHTTPRequestHandler):
     """HTTP request handler for dashboard."""
 
@@ -75,6 +174,17 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
 
     def do_GET(self):
         """Handle GET requests."""
+        # DNS-rebinding mitigation: validate Host header against allowlist
+        host_header = self.headers.get("Host", "").strip()
+        if not _is_valid_host_header(host_header, self.server.server_address[1]):
+            self.send_response(403)
+            self.send_header("Content-Type", "application/json; charset=utf-8")
+            self.end_headers()
+            self.wfile.write(json.dumps(
+                {"error": "Forbidden: invalid Host header"}
+            ).encode('utf-8'))
+            return
+
         if self.path == "/":
             self.serve_html()
         elif self.path == "/data":
@@ -85,10 +195,14 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
             self.serve_api_session()
         elif self.path == "/api/cost":
             self.serve_api_cost()
+        elif self.path == "/api/wave/prs":
+            self.serve_api_wave_prs()
         elif self.path == "/api/backlog":
             self.serve_backlog()
         elif self.path == "/api/agents":
             self.serve_agents()
+        elif self.path.startswith("/api/agent?"):
+            self.serve_api_agent()
         elif self.path.startswith("/api/tracker"):
             self.serve_tracker()
         elif self.path.startswith("/assets/"):
@@ -107,6 +221,17 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
 
     def do_POST(self):
         """Handle POST requests."""
+        # DNS-rebinding mitigation: validate Host header against allowlist
+        host_header = self.headers.get("Host", "").strip()
+        if not _is_valid_host_header(host_header, self.server.server_address[1]):
+            self.send_response(403)
+            self.send_header("Content-Type", "application/json; charset=utf-8")
+            self.end_headers()
+            self.wfile.write(json.dumps(
+                {"error": "Forbidden: invalid Host header"}
+            ).encode('utf-8'))
+            return
+
         if self.path == "/submit":
             self.handle_submit()
         elif self.path == "/api/tracker":
@@ -172,17 +297,8 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
             candidate = (assets_root / rel).resolve()
 
             # Containment check: the resolved target must stay inside
-            # WEB_DIST/assets. Same belt-and-suspenders shape as agents.py.
-            try:
-                is_contained = candidate.is_relative_to(assets_root.resolve())
-            except AttributeError:
-                # Path.is_relative_to requires Python 3.9+; fall back for older runtimes.
-                try:
-                    candidate.relative_to(assets_root.resolve())
-                    is_contained = True
-                except ValueError:
-                    is_contained = False
-            if not is_contained:
+            # WEB_DIST/assets. Uses _path_is_contained helper for clarity.
+            if not _path_is_contained(candidate, assets_root):
                 self.send_error(403)
                 return
 
@@ -239,10 +355,11 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
             self.end_headers()
             self.wfile.write(json.dumps(state, default=str).encode('utf-8'))
         except Exception as e:
+            print(f"[serve_api_state] Uncaught exception: {e}", file=sys.stderr)
             self.send_response(500)
             self.send_header("Content-Type", "application/json; charset=utf-8")
             self.end_headers()
-            self.wfile.write(json.dumps({"error": str(e)}).encode('utf-8'))
+            self.wfile.write(json.dumps({"error": "Internal server error"}).encode('utf-8'))
 
     def serve_api_session(self):
         """GET /api/session — the CSRF token for same-origin JS (plan D3.3).
@@ -283,10 +400,32 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
             self.end_headers()
             self.wfile.write(json.dumps(summary, default=str).encode('utf-8'))
         except Exception as e:
+            print(f"[serve_api_cost] Uncaught exception: {e}", file=sys.stderr)
             self.send_response(500)
             self.send_header("Content-Type", "application/json; charset=utf-8")
             self.end_headers()
-            self.wfile.write(json.dumps({"error": str(e)}).encode('utf-8'))
+            self.wfile.write(json.dumps({"error": "Internal server error"}).encode('utf-8'))
+
+    def serve_api_wave_prs(self):
+        """GET /api/wave/prs — open PRs + PR-less feat/* branches for the PR board.
+
+        Read-only; runs `gh pr list` / `git for-each-ref` (short timeout, cached
+        a few seconds). Degrades to a well-formed {available:false, error:...}
+        payload when gh is missing or un-authenticated — never a 500 for those.
+        """
+        try:
+            payload = wave_prs.get_wave_prs()
+            self.send_response(200)
+            self.send_header("Content-Type", "application/json; charset=utf-8")
+            self.send_header("Cache-Control", "no-cache, no-store, must-revalidate")
+            self.end_headers()
+            self.wfile.write(json.dumps(payload, default=str).encode('utf-8'))
+        except Exception as e:
+            print(f"[serve_api_wave_prs] Uncaught exception: {e}", file=sys.stderr)
+            self.send_response(500)
+            self.send_header("Content-Type", "application/json; charset=utf-8")
+            self.end_headers()
+            self.wfile.write(json.dumps({"error": "Internal server error"}).encode('utf-8'))
 
     def serve_data(self):
         """Serve dashboard data as JSON."""
@@ -321,10 +460,11 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
             self.end_headers()
             self.wfile.write(json.dumps(body, default=str).encode('utf-8'))
         except Exception as e:
+            print(f"[serve_tracker] Uncaught exception: {e}", file=sys.stderr)
             self.send_response(500)
             self.send_header("Content-Type", "application/json")
             self.end_headers()
-            self.wfile.write(json.dumps({"error": str(e)}).encode('utf-8'))
+            self.wfile.write(json.dumps({"error": "Internal server error"}).encode('utf-8'))
 
     def handle_tracker_create(self):
         """Handle POST /api/tracker (create item)."""
@@ -346,10 +486,11 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
             self.end_headers()
             self.wfile.write(json.dumps(result, default=str).encode('utf-8'))
         except Exception as e:
+            print(f"[handle_tracker_create] Uncaught exception: {e}", file=sys.stderr)
             self.send_response(500)
             self.send_header("Content-Type", "application/json; charset=utf-8")
             self.end_headers()
-            self.wfile.write(json.dumps({"error": str(e)}).encode('utf-8'))
+            self.wfile.write(json.dumps({"error": "Internal server error"}).encode('utf-8'))
 
     def handle_tracker_mutate(self):
         """Handle POST /api/tracker/<id> (update or delete)."""
@@ -394,10 +535,11 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
                 self.end_headers()
                 self.wfile.write(json.dumps(result, default=str).encode('utf-8'))
         except Exception as e:
+            print(f"[handle_tracker_mutate] Uncaught exception: {e}", file=sys.stderr)
             self.send_response(500)
             self.send_header("Content-Type", "application/json; charset=utf-8")
             self.end_headers()
-            self.wfile.write(json.dumps({"error": str(e)}).encode('utf-8'))
+            self.wfile.write(json.dumps({"error": "Internal server error"}).encode('utf-8'))
 
 
     def serve_backlog(self):
@@ -410,10 +552,11 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
             self.end_headers()
             self.wfile.write(json.dumps(data, default=str).encode('utf-8'))
         except Exception as e:
+            print(f"[serve_backlog] Uncaught exception: {e}", file=sys.stderr)
             self.send_response(500)
             self.send_header("Content-Type", "application/json; charset=utf-8")
             self.end_headers()
-            self.wfile.write(json.dumps({"error": str(e)}).encode('utf-8'))
+            self.wfile.write(json.dumps({"error": "Internal server error"}).encode('utf-8'))
 
     def serve_agents(self):
         """Serve rich agent list with metadata via GET /api/agents."""
@@ -425,10 +568,11 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
             self.end_headers()
             self.wfile.write(json.dumps(agents, default=str).encode('utf-8'))
         except Exception as e:
+            print(f"[serve_agents] Uncaught exception: {e}", file=sys.stderr)
             self.send_response(500)
             self.send_header("Content-Type", "application/json; charset=utf-8")
             self.end_headers()
-            self.wfile.write(json.dumps({"error": str(e)}).encode('utf-8'))
+            self.wfile.write(json.dumps({"error": "Internal server error"}).encode('utf-8'))
 
     def serve_agent(self):
         """Serve agent dispatch prompt and metadata via GET /agent?id=<agent_id>"""
@@ -471,6 +615,49 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
             print(f"[serve_agent] Uncaught exception: {e}", file=sys.stderr)
             self.wfile.write(json.dumps({"error": "Internal server error"}).encode('utf-8'))
 
+    def serve_api_agent(self):
+        """GET /api/agent?id=<agent_id> — agent detail for the Inspector drawer.
+
+        Read-only. Returns the dispatch prompt/metadata PLUS a bounded, secret-
+        redacted transcript tail (last ~40 NDJSON lines, seek-read so a huge
+        transcript is never fully loaded). Same id-safety + status-code contract
+        as GET /agent: rejected input -> 400, well-formed id with no transcript
+        -> 404, unexpected failure -> 500. Never leaks a raw traceback.
+        """
+        try:
+            query = urllib.parse.urlparse(self.path).query
+            params = urllib.parse.parse_qs(query)
+            agent_id = params.get('id', [None])[0]
+
+            if not agent_id:
+                self.send_response(400)
+                self.send_header("Content-Type", "application/json; charset=utf-8")
+                self.end_headers()
+                self.wfile.write(json.dumps({"error": "missing id parameter"}).encode('utf-8'))
+                return
+
+            data = get_agent_detail(agent_id)
+
+            if "error" in data:
+                status = 400 if data.get("invalid") else 404
+                self.send_response(status)
+                self.send_header("Content-Type", "application/json; charset=utf-8")
+                self.end_headers()
+                self.wfile.write(json.dumps({"error": data["error"]}).encode('utf-8'))
+                return
+
+            self.send_response(200)
+            self.send_header("Content-Type", "application/json; charset=utf-8")
+            self.send_header("Cache-Control", "no-cache, no-store, must-revalidate")
+            self.end_headers()
+            self.wfile.write(json.dumps(data, default=str).encode('utf-8'))
+        except Exception as e:
+            self.send_response(500)
+            self.send_header("Content-Type", "application/json; charset=utf-8")
+            self.end_headers()
+            print(f"[serve_api_agent] Uncaught exception: {e}", file=sys.stderr)
+            self.wfile.write(json.dumps({"error": "Internal server error"}).encode('utf-8'))
+
     def _write_sse_event(self, event_name, payload):
         """Write one SSE frame with timeout. Caller handles disconnect exceptions."""
         msg = f"event: {event_name}\ndata: {payload}\n\n"
@@ -588,7 +775,7 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
                 return
 
             body_bytes = self.rfile.read(content_length)
-            data = json.loads(body_bytes.decode('utf-8', errors='ignore'))
+            data = json.loads(body_bytes.decode('utf-8', errors='replace'))
             text = data.get("text", "").strip()
 
             if not text:
@@ -612,10 +799,11 @@ class DashboardHandler(http.server.BaseHTTPRequestHandler):
             self.end_headers()
             self.wfile.write(json.dumps({"ok": True}).encode('utf-8'))
         except Exception as e:
+            print(f"[handle_submit] Uncaught exception: {e}", file=sys.stderr)
             self.send_response(500)
             self.send_header("Content-Type", "application/json; charset=utf-8")
             self.end_headers()
-            self.wfile.write(json.dumps({"error": str(e)}).encode('utf-8'))
+            self.wfile.write(json.dumps({"error": "Internal server error"}).encode('utf-8'))
 
 
 class QuietThreadingHTTPServer(http.server.ThreadingHTTPServer):