arc402-cli 0.6.0 → 0.7.1

package/dist/daemon/index.js

@@ -52,6 +52,7 @@ const net = __importStar(require("net"));
 const http = __importStar(require("http"));
 const ethers_1 = require("ethers");
 const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
+const crypto = __importStar(require("crypto"));
 const config_1 = require("./config");
 const wallet_monitor_1 = require("./wallet-monitor");
 const notify_1 = require("./notify");
@@ -144,6 +145,40 @@ function openStateDB(dbPath) {
         },
     };
 }
+// ─── Auth token ───────────────────────────────────────────────────────────────
+const DAEMON_TOKEN_FILE = path.join(path.dirname(config_1.DAEMON_SOCK), "daemon.token");
+function generateApiToken() {
+    return crypto.randomBytes(32).toString("hex");
+}
+function saveApiToken(token) {
+    fs.mkdirSync(path.dirname(DAEMON_TOKEN_FILE), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(DAEMON_TOKEN_FILE, token, { mode: 0o600 });
+}
+function loadApiToken() {
+    try {
+        return fs.readFileSync(DAEMON_TOKEN_FILE, "utf-8").trim();
+    }
+    catch {
+        return null;
+    }
+}
+const rateLimitMap = new Map();
+const RATE_LIMIT = 30;
+const RATE_WINDOW_MS = 60000;
+function checkRateLimit(ip) {
+    const now = Date.now();
+    let bucket = rateLimitMap.get(ip);
+    if (!bucket || now >= bucket.resetTime) {
+        bucket = { count: 0, resetTime: now + RATE_WINDOW_MS };
+        rateLimitMap.set(ip, bucket);
+    }
+    bucket.count++;
+    return bucket.count <= RATE_LIMIT;
+}
+// Cleanup stale rate limit entries every 5 minutes to prevent unbounded growth
+let rateLimitCleanupInterval = null;
+// ─── Body size limit ──────────────────────────────────────────────────────────
+const MAX_BODY_SIZE = 1024 * 1024; // 1 MB
 // ─── Logger ───────────────────────────────────────────────────────────────────
 function openLogger(logPath, foreground) {
     let stream = null;
@@ -161,13 +196,14 @@ function openLogger(logPath, foreground) {
         }
     };
 }
-function startIpcServer(ctx, log) {
+function startIpcServer(ctx, log, apiToken) {
     // Remove stale socket
     if (fs.existsSync(config_1.DAEMON_SOCK)) {
         fs.unlinkSync(config_1.DAEMON_SOCK);
     }
     const server = net.createServer((socket) => {
         let buf = "";
+        let authenticated = false;
         socket.on("data", (data) => {
             buf += data.toString();
             const lines = buf.split("\n");
@@ -183,6 +219,19 @@ function startIpcServer(ctx, log) {
                     socket.write(JSON.stringify({ ok: false, error: "invalid_json" }) + "\n");
                     continue;
                 }
+                // First message must be auth
+                if (!authenticated) {
+                    if (cmd.auth === apiToken) {
+                        authenticated = true;
+                        socket.write(JSON.stringify({ ok: true, authenticated: true }) + "\n");
+                    }
+                    else {
+                        log({ event: "ipc_auth_failed" });
+                        socket.write(JSON.stringify({ ok: false, error: "unauthorized" }) + "\n");
+                        socket.destroy();
+                    }
+                    continue;
+                }
                 const response = handleIpcCommand(cmd, ctx, log);
                 socket.write(JSON.stringify(response) + "\n");
             }
@@ -464,6 +513,14 @@ async function runDaemon(foreground = false) {
             }
         }
     }, 30000);
+    // Rate limit map cleanup — every 5 minutes (prevents unbounded growth)
+    rateLimitCleanupInterval = setInterval(() => {
+        const now = Date.now();
+        for (const [ip, bucket] of rateLimitMap) {
+            if (bucket.resetTime < now)
+                rateLimitMap.delete(ip);
+        }
+    }, 5 * 60 * 1000);
     // Balance monitor — every 5 minutes
     const balanceInterval = setInterval(async () => {
         try {
@@ -481,15 +538,76 @@ async function runDaemon(foreground = false) {
         fs.writeFileSync(config_1.DAEMON_PID, String(process.pid), { mode: 0o600 });
         log({ event: "pid_written", pid: process.pid, path: config_1.DAEMON_PID });
     }
+    // ── Generate and save API token ──────────────────────────────────────────
+    const apiToken = generateApiToken();
+    saveApiToken(apiToken);
+    log({ event: "auth_token_saved", path: DAEMON_TOKEN_FILE });
     // ── Start IPC socket ─────────────────────────────────────────────────────
-    const ipcServer = startIpcServer(ipcCtx, log);
+    const ipcServer = startIpcServer(ipcCtx, log, apiToken);
     // ── Start HTTP relay server (public endpoint) ────────────────────────────
     const httpPort = config.relay.listen_port ?? 4402;
+    /**
+     * Optionally verifies X-ARC402-Signature against the request body.
+     * Logs the result but never rejects — unsigned requests are accepted for backwards compat.
+     */
+    function verifyRequestSignature(body, req) {
+        const sig = req.headers["x-arc402-signature"];
+        if (!sig)
+            return;
+        const claimedSigner = req.headers["x-arc402-signer"];
+        try {
+            const recovered = ethers_1.ethers.verifyMessage(body, sig);
+            if (claimedSigner && recovered.toLowerCase() !== claimedSigner.toLowerCase()) {
+                log({ event: "sig_mismatch", claimed: claimedSigner, recovered });
+            }
+            else {
+                log({ event: "sig_verified", signer: recovered });
+            }
+        }
+        catch {
+            log({ event: "sig_invalid" });
+        }
+    }
+    /**
+     * Read request body with a size cap. Destroys the request and sends 413
+     * if the body exceeds MAX_BODY_SIZE. Returns null in that case.
+     */
+    function readBody(req, res) {
+        return new Promise((resolve) => {
+            let body = "";
+            let size = 0;
+            req.on("data", (chunk) => {
+                size += chunk.length;
+                if (size > MAX_BODY_SIZE) {
+                    req.destroy();
+                    res.writeHead(413, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "payload_too_large" }));
+                    resolve(null);
+                    return;
+                }
+                body += chunk.toString();
+            });
+            req.on("end", () => { resolve(body); });
+            req.on("error", () => { resolve(null); });
+        });
+    }
+    const PUBLIC_GET_PATHS = new Set(["/", "/health", "/agent", "/capabilities", "/status"]);
+    // CORS whitelist — localhost for local tooling, arc402.xyz for the web app
+    const CORS_WHITELIST = new Set(["localhost", "127.0.0.1", "arc402.xyz", "app.arc402.xyz"]);
     const httpServer = http.createServer(async (req, res) => {
-        // CORS headers
-        res.setHeader("Access-Control-Allow-Origin", "*");
-        res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-        res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
+        // CORS — only reflect origin header if it's in the whitelist
+        const origin = (req.headers["origin"] ?? "");
+        if (origin) {
+            try {
+                const { hostname } = new URL(origin);
+                if (CORS_WHITELIST.has(hostname)) {
+                    res.setHeader("Access-Control-Allow-Origin", origin);
+                    res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+                    res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
+                }
+            }
+            catch { /* ignore invalid origin */ }
+        }
         if (req.method === "OPTIONS") {
             res.writeHead(204);
             res.end();
@@ -497,6 +615,25 @@ async function runDaemon(foreground = false) {
         }
         const url = new URL(req.url || "/", `http://localhost:${httpPort}`);
         const pathname = url.pathname;
+        // Rate limiting (all endpoints)
+        const clientIp = (req.socket.remoteAddress ?? "unknown").replace(/^::ffff:/, "");
+        if (!checkRateLimit(clientIp)) {
+            log({ event: "rate_limited", ip: clientIp, path: pathname });
+            res.writeHead(429, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "too_many_requests" }));
+            return;
+        }
+        // Auth required on all POST endpoints (GET public paths are open)
+        if (req.method === "POST" || (req.method === "GET" && !PUBLIC_GET_PATHS.has(pathname))) {
+            const authHeader = req.headers["authorization"] ?? "";
+            const token = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : "";
+            if (token !== apiToken) {
+                log({ event: "http_unauthorized", ip: clientIp, path: pathname });
+                res.writeHead(401, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "unauthorized" }));
+                return;
+            }
+        }
         // Health / info
         if (pathname === "/" || pathname === "/health") {
             const info = {
@@ -526,51 +663,36 @@ async function runDaemon(foreground = false) {
         }
         // Receive hire proposal
         if (pathname === "/hire" && req.method === "POST") {
-            let body = "";
-            req.on("data", (chunk) => { body += chunk.toString(); });
-            req.on("end", async () => {
-                try {
-                    const msg = JSON.parse(body);
-                    // Feed into the hire listener's message handler
-                    const proposal = {
-                        messageId: String(msg.messageId ?? msg.id ?? `http_${Date.now()}`),
-                        hirerAddress: String(msg.hirerAddress ?? msg.hirer_address ?? msg.from ?? ""),
-                        capability: String(msg.capability ?? ""),
-                        priceEth: String(msg.priceEth ?? msg.price_eth ?? "0"),
-                        deadlineUnix: Number(msg.deadlineUnix ?? msg.deadline ?? 0),
-                        specHash: String(msg.specHash ?? msg.spec_hash ?? ""),
-                        agreementId: msg.agreementId ? String(msg.agreementId) : undefined,
-                        signature: msg.signature ? String(msg.signature) : undefined,
-                    };
-                    // Dedup
-                    const existing = db.getHireRequest(proposal.messageId);
-                    if (existing) {
-                        res.writeHead(200, { "Content-Type": "application/json" });
-                        res.end(JSON.stringify({ status: existing.status, id: proposal.messageId }));
-                        return;
-                    }
-                    // Policy check
-                    const { evaluatePolicy } = await Promise.resolve().then(() => __importStar(require("./hire-listener")));
-                    const activeCount = db.countActiveHireRequests();
-                    const policyResult = evaluatePolicy(proposal, config, activeCount);
-                    if (!policyResult.allowed) {
-                        db.insertHireRequest({
-                            id: proposal.messageId,
-                            agreement_id: proposal.agreementId ?? null,
-                            hirer_address: proposal.hirerAddress,
-                            capability: proposal.capability,
-                            price_eth: proposal.priceEth,
-                            deadline_unix: proposal.deadlineUnix,
-                            spec_hash: proposal.specHash,
-                            status: "rejected",
-                            reject_reason: policyResult.reason ?? "policy_violation",
-                        });
-                        log({ event: "http_hire_rejected", id: proposal.messageId, reason: policyResult.reason });
-                        res.writeHead(200, { "Content-Type": "application/json" });
-                        res.end(JSON.stringify({ status: "rejected", reason: policyResult.reason, id: proposal.messageId }));
-                        return;
-                    }
-                    const status = config.policy.auto_accept ? "accepted" : "pending_approval";
+            const body = await readBody(req, res);
+            if (body === null)
+                return;
+            verifyRequestSignature(body, req);
+            try {
+                const msg = JSON.parse(body);
+                // Feed into the hire listener's message handler
+                const proposal = {
+                    messageId: String(msg.messageId ?? msg.id ?? `http_${Date.now()}`),
+                    hirerAddress: String(msg.hirerAddress ?? msg.hirer_address ?? msg.from ?? ""),
+                    capability: String(msg.capability ?? ""),
+                    priceEth: String(msg.priceEth ?? msg.price_eth ?? "0"),
+                    deadlineUnix: Number(msg.deadlineUnix ?? msg.deadline ?? 0),
+                    specHash: String(msg.specHash ?? msg.spec_hash ?? ""),
+                    agreementId: msg.agreementId ? String(msg.agreementId) : undefined,
+                    signature: msg.signature ? String(msg.signature) : undefined,
+                };
+                // Dedup
+                const existing = db.getHireRequest(proposal.messageId);
+                if (existing) {
+                    log({ event: "hire_duplicate", id: proposal.messageId, status: existing.status });
+                    res.writeHead(200, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ status: existing.status, id: proposal.messageId }));
+                    return;
+                }
+                // Policy check
+                const { evaluatePolicy } = await Promise.resolve().then(() => __importStar(require("./hire-listener")));
+                const activeCount = db.countActiveHireRequests();
+                const policyResult = evaluatePolicy(proposal, config, activeCount);
+                if (!policyResult.allowed) {
                     db.insertHireRequest({
                         id: proposal.messageId,
                         agreement_id: proposal.agreementId ?? null,
@@ -579,206 +701,217 @@ async function runDaemon(foreground = false) {
                         price_eth: proposal.priceEth,
                         deadline_unix: proposal.deadlineUnix,
                         spec_hash: proposal.specHash,
-                        status,
-                        reject_reason: null,
+                        status: "rejected",
+                        reject_reason: policyResult.reason ?? "policy_violation",
                     });
-                    log({ event: "http_hire_received", id: proposal.messageId, hirer: proposal.hirerAddress, status });
-                    if (config.notifications.notify_on_hire_request) {
-                        await notifier.notifyHireRequest(proposal.messageId, proposal.hirerAddress, proposal.priceEth, proposal.capability);
-                    }
+                    log({ event: "http_hire_rejected", id: proposal.messageId, reason: policyResult.reason });
                     res.writeHead(200, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ status, id: proposal.messageId }));
+                    res.end(JSON.stringify({ status: "rejected", reason: policyResult.reason, id: proposal.messageId }));
+                    return;
                 }
-                catch (err) {
-                    log({ event: "http_hire_error", error: String(err) });
-                    res.writeHead(400, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "invalid_request" }));
+                const status = config.policy.auto_accept ? "accepted" : "pending_approval";
+                db.insertHireRequest({
+                    id: proposal.messageId,
+                    agreement_id: proposal.agreementId ?? null,
+                    hirer_address: proposal.hirerAddress,
+                    capability: proposal.capability,
+                    price_eth: proposal.priceEth,
+                    deadline_unix: proposal.deadlineUnix,
+                    spec_hash: proposal.specHash,
+                    status,
+                    reject_reason: null,
+                });
+                log({ event: "http_hire_received", id: proposal.messageId, hirer: proposal.hirerAddress, status });
+                if (config.notifications.notify_on_hire_request) {
+                    await notifier.notifyHireRequest(proposal.messageId, proposal.hirerAddress, proposal.priceEth, proposal.capability);
                 }
-            });
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ status, id: proposal.messageId }));
+            }
+            catch (err) {
+                log({ event: "http_hire_error", error: String(err) });
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request" }));
+            }
             return;
         }
         // Handshake acknowledgment endpoint
         if (pathname === "/handshake" && req.method === "POST") {
-            let body = "";
-            req.on("data", (chunk) => { body += chunk.toString(); });
-            req.on("end", () => {
-                try {
-                    const msg = JSON.parse(body);
-                    log({ event: "handshake_received", from: msg.from, type: msg.type, note: msg.note });
-                    res.writeHead(200, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
-                }
-                catch {
-                    res.writeHead(400, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "invalid_request" }));
-                }
-            });
+            const body = await readBody(req, res);
+            if (body === null)
+                return;
+            verifyRequestSignature(body, req);
+            try {
+                const msg = JSON.parse(body);
+                log({ event: "handshake_received", from: msg.from, type: msg.type, note: msg.note });
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request" }));
+            }
             return;
         }
         // POST /hire/accepted — provider accepted, client notified
         if (pathname === "/hire/accepted" && req.method === "POST") {
-            let body = "";
-            req.on("data", (chunk) => { body += chunk.toString(); });
-            req.on("end", async () => {
-                try {
-                    const msg = JSON.parse(body);
-                    const agreementId = String(msg.agreementId ?? msg.agreement_id ?? "");
-                    const from = String(msg.from ?? "");
-                    log({ event: "hire_accepted_inbound", agreementId, from });
-                    if (config.notifications.notify_on_hire_accepted) {
-                        await notifier.notifyHireAccepted(agreementId, agreementId);
-                    }
-                    res.writeHead(200, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
+            const body = await readBody(req, res);
+            if (body === null)
+                return;
+            try {
+                const msg = JSON.parse(body);
+                const agreementId = String(msg.agreementId ?? msg.agreement_id ?? "");
+                const from = String(msg.from ?? "");
+                log({ event: "hire_accepted_inbound", agreementId, from });
+                if (config.notifications.notify_on_hire_accepted) {
+                    await notifier.notifyHireAccepted(agreementId, agreementId);
                 }
-                catch {
-                    res.writeHead(400, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "invalid_request" }));
-                }
-            });
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request" }));
+            }
             return;
         }
         // POST /message — off-chain negotiation message
         if (pathname === "/message" && req.method === "POST") {
-            let body = "";
-            req.on("data", (chunk) => { body += chunk.toString(); });
-            req.on("end", () => {
-                try {
-                    const msg = JSON.parse(body);
-                    const from = String(msg.from ?? "");
-                    const to = String(msg.to ?? "");
-                    const content = String(msg.content ?? "");
-                    const timestamp = Number(msg.timestamp ?? Date.now());
-                    log({ event: "message_received", from, to, timestamp, content_len: content.length });
-                    res.writeHead(200, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
-                }
-                catch {
-                    res.writeHead(400, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "invalid_request" }));
-                }
-            });
+            const body = await readBody(req, res);
+            if (body === null)
+                return;
+            verifyRequestSignature(body, req);
+            try {
+                const msg = JSON.parse(body);
+                const from = String(msg.from ?? "");
+                const to = String(msg.to ?? "");
+                const content = String(msg.content ?? "");
+                const timestamp = Number(msg.timestamp ?? Date.now());
+                log({ event: "message_received", from, to, timestamp, content_len: content.length });
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request" }));
+            }
             return;
         }
         // POST /delivery — provider committed a deliverable
         if (pathname === "/delivery" && req.method === "POST") {
-            let body = "";
-            req.on("data", (chunk) => { body += chunk.toString(); });
-            req.on("end", async () => {
-                try {
-                    const msg = JSON.parse(body);
-                    const agreementId = String(msg.agreementId ?? msg.agreement_id ?? "");
-                    const deliverableHash = String(msg.deliverableHash ?? msg.deliverable_hash ?? "");
-                    const from = String(msg.from ?? "");
-                    log({ event: "delivery_received", agreementId, deliverableHash, from });
-                    // Update DB: mark delivered
-                    const active = db.listActiveHireRequests();
-                    const found = active.find(r => r.agreement_id === agreementId);
-                    if (found)
-                        db.updateHireRequestStatus(found.id, "delivered");
-                    if (config.notifications.notify_on_delivery) {
-                        await notifier.notifyDelivery(agreementId, deliverableHash, "");
-                    }
-                    res.writeHead(200, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
-                }
-                catch {
-                    res.writeHead(400, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "invalid_request" }));
+            const body = await readBody(req, res);
+            if (body === null)
+                return;
+            verifyRequestSignature(body, req);
+            try {
+                const msg = JSON.parse(body);
+                const agreementId = String(msg.agreementId ?? msg.agreement_id ?? "");
+                const deliverableHash = String(msg.deliverableHash ?? msg.deliverable_hash ?? "");
+                const from = String(msg.from ?? "");
+                log({ event: "delivery_received", agreementId, deliverableHash, from });
+                // Update DB: mark delivered
+                const active = db.listActiveHireRequests();
+                const found = active.find(r => r.agreement_id === agreementId);
+                if (found)
+                    db.updateHireRequestStatus(found.id, "delivered");
+                if (config.notifications.notify_on_delivery) {
+                    await notifier.notifyDelivery(agreementId, deliverableHash, "");
                 }
-            });
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request" }));
+            }
             return;
         }
         // POST /delivery/accepted — client accepted delivery, payment releasing
         if (pathname === "/delivery/accepted" && req.method === "POST") {
-            let body = "";
-            req.on("data", (chunk) => { body += chunk.toString(); });
-            req.on("end", () => {
-                try {
-                    const msg = JSON.parse(body);
-                    const agreementId = String(msg.agreementId ?? msg.agreement_id ?? "");
-                    const from = String(msg.from ?? "");
-                    log({ event: "delivery_accepted_inbound", agreementId, from });
-                    // Update DB: mark complete
-                    const all = db.listActiveHireRequests();
-                    const found = all.find(r => r.agreement_id === agreementId);
-                    if (found)
-                        db.updateHireRequestStatus(found.id, "complete");
-                    res.writeHead(200, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
-                }
-                catch {
-                    res.writeHead(400, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "invalid_request" }));
-                }
-            });
+            const body = await readBody(req, res);
+            if (body === null)
+                return;
+            try {
+                const msg = JSON.parse(body);
+                const agreementId = String(msg.agreementId ?? msg.agreement_id ?? "");
+                const from = String(msg.from ?? "");
+                log({ event: "delivery_accepted_inbound", agreementId, from });
+                // Update DB: mark complete
+                const all = db.listActiveHireRequests();
+                const found = all.find(r => r.agreement_id === agreementId);
+                if (found)
+                    db.updateHireRequestStatus(found.id, "complete");
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request" }));
+            }
             return;
         }
         // POST /dispute — dispute raised against this agent
         if (pathname === "/dispute" && req.method === "POST") {
-            let body = "";
-            req.on("data", (chunk) => { body += chunk.toString(); });
-            req.on("end", async () => {
-                try {
-                    const msg = JSON.parse(body);
-                    const agreementId = String(msg.agreementId ?? msg.agreement_id ?? "");
-                    const reason = String(msg.reason ?? "");
-                    const from = String(msg.from ?? "");
-                    log({ event: "dispute_received", agreementId, reason, from });
-                    if (config.notifications.notify_on_dispute) {
-                        await notifier.notifyDispute(agreementId, from);
-                    }
-                    res.writeHead(200, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
-                }
-                catch {
-                    res.writeHead(400, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "invalid_request" }));
+            const body = await readBody(req, res);
+            if (body === null)
+                return;
+            try {
+                const msg = JSON.parse(body);
+                const agreementId = String(msg.agreementId ?? msg.agreement_id ?? "");
+                const reason = String(msg.reason ?? "");
+                const from = String(msg.from ?? "");
+                log({ event: "dispute_received", agreementId, reason, from });
+                if (config.notifications.notify_on_dispute) {
+                    await notifier.notifyDispute(agreementId, from);
                 }
-            });
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request" }));
+            }
             return;
         }
         // POST /dispute/resolved — dispute resolved by arbitrator
         if (pathname === "/dispute/resolved" && req.method === "POST") {
-            let body = "";
-            req.on("data", (chunk) => { body += chunk.toString(); });
-            req.on("end", () => {
-                try {
-                    const msg = JSON.parse(body);
-                    const agreementId = String(msg.agreementId ?? msg.agreement_id ?? "");
-                    const outcome = String(msg.outcome ?? "");
-                    const from = String(msg.from ?? "");
-                    log({ event: "dispute_resolved_inbound", agreementId, outcome, from });
-                    res.writeHead(200, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
-                }
-                catch {
-                    res.writeHead(400, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "invalid_request" }));
-                }
-            });
+            const body = await readBody(req, res);
+            if (body === null)
+                return;
+            try {
+                const msg = JSON.parse(body);
+                const agreementId = String(msg.agreementId ?? msg.agreement_id ?? "");
+                const outcome = String(msg.outcome ?? "");
+                const from = String(msg.from ?? "");
+                log({ event: "dispute_resolved_inbound", agreementId, outcome, from });
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request" }));
+            }
             return;
         }
         // POST /workroom/status — workroom lifecycle events
         if (pathname === "/workroom/status" && req.method === "POST") {
-            let body = "";
-            req.on("data", (chunk) => { body += chunk.toString(); });
-            req.on("end", () => {
-                try {
-                    const msg = JSON.parse(body);
-                    const event = String(msg.event ?? "");
-                    const agentAddress = String(msg.agentAddress ?? config.wallet.contract_address);
-                    const jobId = msg.jobId ? String(msg.jobId) : undefined;
-                    const timestamp = Number(msg.timestamp ?? Date.now());
-                    log({ event: "workroom_lifecycle", workroom_event: event, agentAddress, jobId, timestamp });
-                    res.writeHead(200, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
-                }
-                catch {
-                    res.writeHead(400, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "invalid_request" }));
-                }
-            });
+            const body = await readBody(req, res);
+            if (body === null)
+                return;
+            try {
+                const msg = JSON.parse(body);
+                const event = String(msg.event ?? "");
+                const agentAddress = String(msg.agentAddress ?? config.wallet.contract_address);
+                const jobId = msg.jobId ? String(msg.jobId) : undefined;
+                const timestamp = Number(msg.timestamp ?? Date.now());
+                log({ event: "workroom_lifecycle", workroom_event: event, agentAddress, jobId, timestamp });
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ received: true, agent: config.wallet.contract_address }));
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_request" }));
+            }
             return;
         }
         // GET /capabilities — agent capabilities from config
@@ -792,21 +925,25 @@ async function runDaemon(foreground = false) {
             }));
             return;
         }
-        // GET /status — health with active agreement count
+        // GET /status — health with active agreement count (sensitive counts only for authenticated)
         if (pathname === "/status" && req.method === "GET") {
-            const activeList = db.listActiveHireRequests();
-            const pendingList = db.listPendingHireRequests();
-            res.writeHead(200, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({
+            const statusAuth = (req.headers["authorization"] ?? "");
+            const statusToken = statusAuth.startsWith("Bearer ") ? statusAuth.slice(7) : "";
+            const statusAuthed = statusToken === apiToken;
+            const statusPayload = {
                 protocol: "arc-402",
                 version: "0.3.0",
                 agent: config.wallet.contract_address,
                 status: "online",
                 uptime: Math.floor((Date.now() - ipcCtx.startTime) / 1000),
-                active_agreements: activeList.length,
-                pending_approval: pendingList.length,
                 capabilities: config.policy.allowed_capabilities,
-            }));
+            };
+            if (statusAuthed) {
+                statusPayload.active_agreements = db.listActiveHireRequests().length;
+                statusPayload.pending_approval = db.listPendingHireRequests().length;
+            }
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(statusPayload));
             return;
         }
         // 404
@@ -838,6 +975,8 @@ async function runDaemon(foreground = false) {
             clearInterval(relayInterval);
         clearInterval(timeoutInterval);
         clearInterval(balanceInterval);
+        if (rateLimitCleanupInterval)
+            clearInterval(rateLimitCleanupInterval);
         // Close HTTP + IPC
         httpServer.close();
         ipcServer.close();