arc402-cli 0.5.0 → 0.7.0

package/dist/daemon/index.js

@@ -52,6 +52,7 @@ const net = __importStar(require("net"));
 const http = __importStar(require("http"));
 const ethers_1 = require("ethers");
 const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
+const crypto = __importStar(require("crypto"));
 const config_1 = require("./config");
 const wallet_monitor_1 = require("./wallet-monitor");
 const notify_1 = require("./notify");
@@ -144,6 +145,38 @@ function openStateDB(dbPath) {
         },
     };
 }
+// ─── Auth token ───────────────────────────────────────────────────────────────
+const DAEMON_TOKEN_FILE = path.join(path.dirname(config_1.DAEMON_SOCK), "daemon.token");
+function generateApiToken() {
+    return crypto.randomBytes(32).toString("hex");
+}
+function saveApiToken(token) {
+    fs.mkdirSync(path.dirname(DAEMON_TOKEN_FILE), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(DAEMON_TOKEN_FILE, token, { mode: 0o600 });
+}
+function loadApiToken() {
+    try {
+        return fs.readFileSync(DAEMON_TOKEN_FILE, "utf-8").trim();
+    }
+    catch {
+        return null;
+    }
+}
+const rateLimitMap = new Map();
+const RATE_LIMIT = 30;
+const RATE_WINDOW_MS = 60000;
+function checkRateLimit(ip) {
+    const now = Date.now();
+    let bucket = rateLimitMap.get(ip);
+    if (!bucket || now >= bucket.resetTime) {
+        bucket = { count: 0, resetTime: now + RATE_WINDOW_MS };
+        rateLimitMap.set(ip, bucket);
+    }
+    bucket.count++;
+    return bucket.count <= RATE_LIMIT;
+}
+// ─── Body size limit ──────────────────────────────────────────────────────────
+const MAX_BODY_SIZE = 1024 * 1024; // 1 MB
 // ─── Logger ───────────────────────────────────────────────────────────────────
 function openLogger(logPath, foreground) {
     let stream = null;
@@ -161,13 +194,14 @@ function openLogger(logPath, foreground) {
         }
     };
 }
-function startIpcServer(ctx, log) {
+function startIpcServer(ctx, log, apiToken) {
     // Remove stale socket
     if (fs.existsSync(config_1.DAEMON_SOCK)) {
         fs.unlinkSync(config_1.DAEMON_SOCK);
     }
     const server = net.createServer((socket) => {
         let buf = "";
+        let authenticated = false;
         socket.on("data", (data) => {
             buf += data.toString();
             const lines = buf.split("\n");
@@ -183,6 +217,19 @@ function startIpcServer(ctx, log) {
                     socket.write(JSON.stringify({ ok: false, error: "invalid_json" }) + "\n");
                     continue;
                 }
+                // First message must be auth
+                if (!authenticated) {
+                    if (cmd.auth === apiToken) {
+                        authenticated = true;
+                        socket.write(JSON.stringify({ ok: true, authenticated: true }) + "\n");
+                    }
+                    else {
+                        log({ event: "ipc_auth_failed" });
+                        socket.write(JSON.stringify({ ok: false, error: "unauthorized" }) + "\n");
+                        socket.destroy();
+                    }
+                    continue;
+                }
                 const response = handleIpcCommand(cmd, ctx, log);
                 socket.write(JSON.stringify(response) + "\n");
             }
@@ -481,10 +528,38 @@ async function runDaemon(foreground = false) {
         fs.writeFileSync(config_1.DAEMON_PID, String(process.pid), { mode: 0o600 });
         log({ event: "pid_written", pid: process.pid, path: config_1.DAEMON_PID });
     }
+    // ── Generate and save API token ──────────────────────────────────────────
+    const apiToken = generateApiToken();
+    saveApiToken(apiToken);
+    log({ event: "auth_token_saved", path: DAEMON_TOKEN_FILE });
     // ── Start IPC socket ─────────────────────────────────────────────────────
-    const ipcServer = startIpcServer(ipcCtx, log);
+    const ipcServer = startIpcServer(ipcCtx, log, apiToken);
     // ── Start HTTP relay server (public endpoint) ────────────────────────────
     const httpPort = config.relay.listen_port ?? 4402;
+    /**
+     * Read request body with a size cap. Destroys the request and sends 413
+     * if the body exceeds MAX_BODY_SIZE. Returns null in that case.
+     */
+    function readBody(req, res) {
+        return new Promise((resolve) => {
+            let body = "";
+            let size = 0;
+            req.on("data", (chunk) => {
+                size += chunk.length;
+                if (size > MAX_BODY_SIZE) {
+                    req.destroy();
+                    res.writeHead(413, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "payload_too_large" }));
+                    resolve(null);
+                    return;
+                }
+                body += chunk.toString();
+            });
+            req.on("end", () => { resolve(body); });
+            req.on("error", () => { resolve(null); });
+        });
+    }
+    const PUBLIC_GET_PATHS = new Set(["/", "/health", "/agent", "/capabilities", "/status"]);
     const httpServer = http.createServer(async (req, res) => {
         // CORS headers
         res.setHeader("Access-Control-Allow-Origin", "*");
@@ -497,6 +572,25 @@ async function runDaemon(foreground = false) {
         }
         const url = new URL(req.url || "/", `http://localhost:${httpPort}`);
         const pathname = url.pathname;
+        // Rate limiting (all endpoints)
+        const clientIp = (req.socket.remoteAddress ?? "unknown").replace(/^::ffff:/, "");
+        if (!checkRateLimit(clientIp)) {
+            log({ event: "rate_limited", ip: clientIp, path: pathname });
+            res.writeHead(429, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "too_many_requests" }));
+            return;
+        }
+        // Auth required on all POST endpoints (GET public paths are open)
+        if (req.method === "POST" || (req.method === "GET" && !PUBLIC_GET_PATHS.has(pathname))) {
+            const authHeader = req.headers["authorization"] ?? "";
+            const token = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : "";
+            if (token !== apiToken) {
+                log({ event: "http_unauthorized", ip: clientIp, path: pathname });
+                res.writeHead(401, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "unauthorized" }));
+                return;
+            }
+        }
         // Health / info
         if (pathname === "/" || pathname === "/health") {
             const info = {
@@ -526,51 +620,35 @@ async function runDaemon(foreground = false) {
         }
         // Receive hire proposal
         if (pathname === "/hire" && req.method === "POST") {
-            let body = "";
-            req.on("data", (chunk) => { body += chunk.toString(); });
-            req.on("end", async () => {
-                try {
-                    const msg = JSON.parse(body);
-                    // Feed into the hire listener's message handler
-                    const proposal = {
-                        messageId: String(msg.messageId ?? msg.id ?? `http_${Date.now()}`),
-                        hirerAddress: String(msg.hirerAddress ?? msg.hirer_address ?? msg.from ?? ""),
-                        capability: String(msg.capability ?? ""),
-                        priceEth: String(msg.priceEth ?? msg.price_eth ?? "0"),
-                        deadlineUnix: Number(msg.deadlineUnix ?? msg.deadline ?? 0),
-                        specHash: String(msg.specHash ?? msg.spec_hash ?? ""),
-                        agreementId: msg.agreementId ? String(msg.agreementId) : undefined,
-                        signature: msg.signature ? String(msg.signature) : undefined,
-                    };
-                    // Dedup
-                    const existing = db.getHireRequest(proposal.messageId);
-                    if (existing) {
-                        res.writeHead(200, { "Content-Type": "application/json" });
-                        res.end(JSON.stringify({ status: existing.status, id: proposal.messageId }));
-                        return;
-                    }
-                    // Policy check
-                    const { evaluatePolicy } = await Promise.resolve().then(() => __importStar(require("./hire-listener")));
-                    const activeCount = db.countActiveHireRequests();
-                    const policyResult = evaluatePolicy(proposal, config, activeCount);
-                    if (!policyResult.allowed) {
-                        db.insertHireRequest({
-                            id: proposal.messageId,
-                            agreement_id: proposal.agreementId ?? null,
-                            hirer_address: proposal.hirerAddress,
-                            capability: proposal.capability,
-                            price_eth: proposal.priceEth,
-                            deadline_unix: proposal.deadlineUnix,
-                            spec_hash: proposal.specHash,
-                            status: "rejected",
-                            reject_reason: policyResult.reason ?? "policy_violation",
-                        });
-                        log({ event: "http_hire_rejected", id: proposal.messageId, reason: policyResult.reason });
-                        res.writeHead(200, { "Content-Type": "application/json" });
-                        res.end(JSON.stringify({ status: "rejected", reason: policyResult.reason, id: proposal.messageId }));
-                        return;
-                    }
-                    const status = config.policy.auto_accept ? "accepted" : "pending_approval";
+            const body = await readBody(req, res);
+            if (body === null)
+                return;
+            try {
+                const msg = JSON.parse(body);
+                // Feed into the hire listener's message handler
+                const proposal = {
+                    messageId: String(msg.messageId ?? msg.id ?? `http_${Date.now()}`),
+                    hirerAddress: String(msg.hirerAddress ?? msg.hirer_address ?? msg.from ?? ""),
+                    capability: String(msg.capability ?? ""),
+                    priceEth: String(msg.priceEth ?? msg.price_eth ?? "0"),
+                    deadlineUnix: Number(msg.deadlineUnix ?? msg.deadline ?? 0),
+                    specHash: String(msg.specHash ?? msg.spec_hash ?? ""),
+                    agreementId: msg.agreementId ? String(msg.agreementId) : undefined,
+                    signature: msg.signature ? String(msg.signature) : undefined,
+                };
+                // Dedup
+                const existing = db.getHireRequest(proposal.messageId);
+                if (existing) {
+                    log({ event: "hire_duplicate", id: proposal.messageId, status: existing.status });
+                    res.writeHead(200, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ status: existing.status, id: proposal.messageId }));
+                    return;
+                }
+                // Policy check
+                const { evaluatePolicy } = await Promise.resolve().then(() => __importStar(require("./hire-listener")));
+                const activeCount = db.countActiveHireRequests();
+                const policyResult = evaluatePolicy(proposal, config, activeCount);
+                if (!policyResult.allowed) {
                     db.insertHireRequest({
                         id: proposal.messageId,
                         agreement_id: proposal.agreementId ?? null,
@@ -579,206 +657,214 @@ async function runDaemon(foreground = false) {
                         price_eth: proposal.priceEth,
                         deadline_unix: proposal.deadlineUnix,
                         spec_hash: proposal.specHash,
-                        status,
-                        reject_reason: null,
+                        status: "rejected",
+                        reject_reason: policyResult.reason ?? "policy_violation",
                     });
-                    log({ event: "http_hire_received", id: proposal.messageId, hirer: proposal.hirerAddress, status });
-                    if (config.notifications.notify_on_hire_request) {
-                        await notifier.notifyHireRequest(proposal.messageId, proposal.hirerAddress, proposal.priceEth, proposal.capability);
-                    }
+                    log({ event: "http_hire_rejected", id: proposal.messageId, reason: policyResult.reason });
                     res.writeHead(200, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ status, id: proposal.messageId }));
+                    res.end(JSON.stringify({ status: "rejected", reason: policyResult.reason, id: proposal.messageId }));
+                    return;
                 }
-                catch (err) {
-                    log({ event: "http_hire_error", error: String(err) });
-                    res.writeHead(400, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "invalid_request" }));
+                const status = config.policy.auto_accept ? "accepted" : "pending_approval";
+                db.insertHireRequest({
+                    id: proposal.messageId,
+                    agreement_id: proposal.agreementId ?? null,
+                    hirer_address: proposal.hirerAddress,
+                    capability: proposal.capability,
+                    price_eth: proposal.priceEth,
+                    deadline_unix: proposal.deadlineUnix,
+                    spec_hash: proposal.specHash,
+                    status,
+                    reject_reason: null,
+                });
+                log({ event: "http_hire_received", id: proposal.messageId, hirer: proposal.hirerAddress, status });
+                if (config.notifications.notify_on_hire_request) {
+                    await notifier.notifyHireRequest(proposal.messageId, proposal.hirerAddress, proposal.priceEth, proposal.capability);
                 }
-            });
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ status, id: proposal.messageId }));
+            }
+            catch (err) {
+                log({ event: "http_hire_error", error: String(err) });
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request" }));
+            }
             return;
         }
         // Handshake acknowledgment endpoint
         if (pathname === "/handshake" && req.method === "POST") {
-            let body = "";
-            req.on("data", (chunk) => { body += chunk.toString(); });
-            req.on("end", () => {
-                try {
-                    const msg = JSON.parse(body);
-                    log({ event: "handshake_received", from: msg.from, type: msg.type, note: msg.note });
-                    res.writeHead(200, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
-                }
-                catch {
-                    res.writeHead(400, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "invalid_request" }));
-                }
-            });
+            const body = await readBody(req, res);
+            if (body === null)
+                return;
+            try {
+                const msg = JSON.parse(body);
+                log({ event: "handshake_received", from: msg.from, type: msg.type, note: msg.note });
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request" }));
+            }
             return;
         }
         // POST /hire/accepted — provider accepted, client notified
         if (pathname === "/hire/accepted" && req.method === "POST") {
-            let body = "";
-            req.on("data", (chunk) => { body += chunk.toString(); });
-            req.on("end", async () => {
-                try {
-                    const msg = JSON.parse(body);
-                    const agreementId = String(msg.agreementId ?? msg.agreement_id ?? "");
-                    const from = String(msg.from ?? "");
-                    log({ event: "hire_accepted_inbound", agreementId, from });
-                    if (config.notifications.notify_on_hire_accepted) {
-                        await notifier.notifyHireAccepted(agreementId, agreementId);
-                    }
-                    res.writeHead(200, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
+            const body = await readBody(req, res);
+            if (body === null)
+                return;
+            try {
+                const msg = JSON.parse(body);
+                const agreementId = String(msg.agreementId ?? msg.agreement_id ?? "");
+                const from = String(msg.from ?? "");
+                log({ event: "hire_accepted_inbound", agreementId, from });
+                if (config.notifications.notify_on_hire_accepted) {
+                    await notifier.notifyHireAccepted(agreementId, agreementId);
                 }
-                catch {
-                    res.writeHead(400, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "invalid_request" }));
-                }
-            });
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request" }));
+            }
             return;
         }
         // POST /message — off-chain negotiation message
         if (pathname === "/message" && req.method === "POST") {
-            let body = "";
-            req.on("data", (chunk) => { body += chunk.toString(); });
-            req.on("end", () => {
-                try {
-                    const msg = JSON.parse(body);
-                    const from = String(msg.from ?? "");
-                    const to = String(msg.to ?? "");
-                    const content = String(msg.content ?? "");
-                    const timestamp = Number(msg.timestamp ?? Date.now());
-                    log({ event: "message_received", from, to, timestamp, content_len: content.length });
-                    res.writeHead(200, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
-                }
-                catch {
-                    res.writeHead(400, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "invalid_request" }));
-                }
-            });
+            const body = await readBody(req, res);
+            if (body === null)
+                return;
+            try {
+                const msg = JSON.parse(body);
+                const from = String(msg.from ?? "");
+                const to = String(msg.to ?? "");
+                const content = String(msg.content ?? "");
+                const timestamp = Number(msg.timestamp ?? Date.now());
+                log({ event: "message_received", from, to, timestamp, content_len: content.length });
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request" }));
+            }
             return;
         }
         // POST /delivery — provider committed a deliverable
         if (pathname === "/delivery" && req.method === "POST") {
-            let body = "";
-            req.on("data", (chunk) => { body += chunk.toString(); });
-            req.on("end", async () => {
-                try {
-                    const msg = JSON.parse(body);
-                    const agreementId = String(msg.agreementId ?? msg.agreement_id ?? "");
-                    const deliverableHash = String(msg.deliverableHash ?? msg.deliverable_hash ?? "");
-                    const from = String(msg.from ?? "");
-                    log({ event: "delivery_received", agreementId, deliverableHash, from });
-                    // Update DB: mark delivered
-                    const active = db.listActiveHireRequests();
-                    const found = active.find(r => r.agreement_id === agreementId);
-                    if (found)
-                        db.updateHireRequestStatus(found.id, "delivered");
-                    if (config.notifications.notify_on_delivery) {
-                        await notifier.notifyDelivery(agreementId, deliverableHash, "");
-                    }
-                    res.writeHead(200, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
-                }
-                catch {
-                    res.writeHead(400, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "invalid_request" }));
+            const body = await readBody(req, res);
+            if (body === null)
+                return;
+            try {
+                const msg = JSON.parse(body);
+                const agreementId = String(msg.agreementId ?? msg.agreement_id ?? "");
+                const deliverableHash = String(msg.deliverableHash ?? msg.deliverable_hash ?? "");
+                const from = String(msg.from ?? "");
+                log({ event: "delivery_received", agreementId, deliverableHash, from });
+                // Update DB: mark delivered
+                const active = db.listActiveHireRequests();
+                const found = active.find(r => r.agreement_id === agreementId);
+                if (found)
+                    db.updateHireRequestStatus(found.id, "delivered");
+                if (config.notifications.notify_on_delivery) {
+                    await notifier.notifyDelivery(agreementId, deliverableHash, "");
                 }
-            });
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request" }));
+            }
             return;
         }
         // POST /delivery/accepted — client accepted delivery, payment releasing
         if (pathname === "/delivery/accepted" && req.method === "POST") {
-            let body = "";
-            req.on("data", (chunk) => { body += chunk.toString(); });
-            req.on("end", () => {
-                try {
-                    const msg = JSON.parse(body);
-                    const agreementId = String(msg.agreementId ?? msg.agreement_id ?? "");
-                    const from = String(msg.from ?? "");
-                    log({ event: "delivery_accepted_inbound", agreementId, from });
-                    // Update DB: mark complete
-                    const all = db.listActiveHireRequests();
-                    const found = all.find(r => r.agreement_id === agreementId);
-                    if (found)
-                        db.updateHireRequestStatus(found.id, "complete");
-                    res.writeHead(200, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
-                }
-                catch {
-                    res.writeHead(400, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "invalid_request" }));
-                }
-            });
+            const body = await readBody(req, res);
+            if (body === null)
+                return;
+            try {
+                const msg = JSON.parse(body);
+                const agreementId = String(msg.agreementId ?? msg.agreement_id ?? "");
+                const from = String(msg.from ?? "");
+                log({ event: "delivery_accepted_inbound", agreementId, from });
+                // Update DB: mark complete
+                const all = db.listActiveHireRequests();
+                const found = all.find(r => r.agreement_id === agreementId);
+                if (found)
+                    db.updateHireRequestStatus(found.id, "complete");
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request" }));
+            }
             return;
         }
         // POST /dispute — dispute raised against this agent
         if (pathname === "/dispute" && req.method === "POST") {
-            let body = "";
-            req.on("data", (chunk) => { body += chunk.toString(); });
-            req.on("end", async () => {
-                try {
-                    const msg = JSON.parse(body);
-                    const agreementId = String(msg.agreementId ?? msg.agreement_id ?? "");
-                    const reason = String(msg.reason ?? "");
-                    const from = String(msg.from ?? "");
-                    log({ event: "dispute_received", agreementId, reason, from });
-                    if (config.notifications.notify_on_dispute) {
-                        await notifier.notifyDispute(agreementId, from);
-                    }
-                    res.writeHead(200, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
+            const body = await readBody(req, res);
+            if (body === null)
+                return;
+            try {
+                const msg = JSON.parse(body);
+                const agreementId = String(msg.agreementId ?? msg.agreement_id ?? "");
+                const reason = String(msg.reason ?? "");
+                const from = String(msg.from ?? "");
+                log({ event: "dispute_received", agreementId, reason, from });
+                if (config.notifications.notify_on_dispute) {
+                    await notifier.notifyDispute(agreementId, from);
                 }
-                catch {
-                    res.writeHead(400, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "invalid_request" }));
-                }
-            });
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request" }));
+            }
             return;
         }
         // POST /dispute/resolved — dispute resolved by arbitrator
         if (pathname === "/dispute/resolved" && req.method === "POST") {
-            let body = "";
-            req.on("data", (chunk) => { body += chunk.toString(); });
-            req.on("end", () => {
-                try {
-                    const msg = JSON.parse(body);
-                    const agreementId = String(msg.agreementId ?? msg.agreement_id ?? "");
-                    const outcome = String(msg.outcome ?? "");
-                    const from = String(msg.from ?? "");
-                    log({ event: "dispute_resolved_inbound", agreementId, outcome, from });
-                    res.writeHead(200, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
-                }
-                catch {
-                    res.writeHead(400, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "invalid_request" }));
-                }
-            });
+            const body = await readBody(req, res);
+            if (body === null)
+                return;
+            try {
+                const msg = JSON.parse(body);
+                const agreementId = String(msg.agreementId ?? msg.agreement_id ?? "");
+                const outcome = String(msg.outcome ?? "");
+                const from = String(msg.from ?? "");
+                log({ event: "dispute_resolved_inbound", agreementId, outcome, from });
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request" }));
+            }
             return;
         }
         // POST /workroom/status — workroom lifecycle events
         if (pathname === "/workroom/status" && req.method === "POST") {
-            let body = "";
-            req.on("data", (chunk) => { body += chunk.toString(); });
-            req.on("end", () => {
-                try {
-                    const msg = JSON.parse(body);
-                    const event = String(msg.event ?? "");
-                    const agentAddress = String(msg.agentAddress ?? config.wallet.contract_address);
-                    const jobId = msg.jobId ? String(msg.jobId) : undefined;
-                    const timestamp = Number(msg.timestamp ?? Date.now());
-                    log({ event: "workroom_lifecycle", workroom_event: event, agentAddress, jobId, timestamp });
-                    res.writeHead(200, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
-                }
-                catch {
-                    res.writeHead(400, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "invalid_request" }));
-                }
-            });
+            const body = await readBody(req, res);
+            if (body === null)
+                return;
+            try {
+                const msg = JSON.parse(body);
+                const event = String(msg.event ?? "");
+                const agentAddress = String(msg.agentAddress ?? config.wallet.contract_address);
+                const jobId = msg.jobId ? String(msg.jobId) : undefined;
+                const timestamp = Number(msg.timestamp ?? Date.now());
+                log({ event: "workroom_lifecycle", workroom_event: event, agentAddress, jobId, timestamp });
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request" }));
+            }
             return;
         }
         // GET /capabilities — agent capabilities from config