ghostbus 0.5.2 → 0.5.3

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.5.3 — 2026-10-11
+
+Security hardening, round 2 — the layer under the v0.5.2 defaults. v0.5.2 made enforcement the default; this round removes the sharp edges an attacker could still lean on: non-timing-safe secret compares, unthrottled key guessing at the hosted layer, unbounded request bodies, framable HTML pages, world-readable data files, and internal error text leaking to clients.
+
+- **Timing-safe secret comparisons everywhere** — the hosted router compared workspace keys with `sha256(given) === meta.keyHash` (plain `===` on a digest), and the core compared agent-token hashes the same way. Both now use `crypto.timingSafeEqual` over the digests (new exported `hashMatches` in `src/handler.mjs`, shared by the router, the core token check, and the serverless pack, whose `wsKeyOk` had the same plain compare). A full-codebase audit found no other secret comparisons.
+- **Failed-auth throttle at the hosted layer** (`src/hosted-server.mjs`) — the handler's 300 req/min limiter only throttles traffic already inside a workspace; nothing slowed down guessing admin or workspace keys. Now: 30 failed auth attempts per minute per IP → `429` on the admin surface and on workspace routes until the window rolls. Successful auth never counts; `/health` and `/probe` stay open so an operator can watch an attack happen.
+- **Request bodies capped at 1 MB** (`readJsonBody` in `src/handler.mjs`) — both body readers accumulated without a cap (past a 5 MB socket-destroy with no useful response). One shared reader now enforces a commented `MAX_BODY_BYTES = 1_000_000` on hosted admin routes, in-workspace routes, and the single relay; over the cap the client gets a clean `413` JSON error and the socket is dropped after the response. File contents travel as JSON in GhostBus, so legitimate traffic fits comfortably; a workspace *import* over 1 MB must be restored from a state file / the CLI instead of over HTTP (stated in `docs/hosted.md`).
+- **HTML pages carry frame/CSP protection** — the board (`src/handler.mjs`) and the hosted landing page are served with `X-Frame-Options: DENY` and a `Content-Security-Policy`: `default-src 'self'`, `frame-ancestors 'none'`, `object-src 'none'`. Both pages are single self-contained documents (inline script/style, same-origin fetches, zero external resources), so the CSP allows `'unsafe-inline'` for script/style specifically — no eval, no external origins.
+- **Data files are written 0600** — the registry and workspace state files hold every key/token hash; `FileStore.save` (core, so the single relay benefits too) and `saveRegistry` plus the hosted import write now create their temp files with mode 0600 (plus a chmod before the atomic rename), and the mode rides through the rename. Existing files tighten on their next save.
+- **Error hygiene** — the single relay and the hosted server returned raw `e.message` in 500s. Both now log the real error (with stack) to stderr and answer a generic `{ error: 'internal error' }`. The handler's 400s are unchanged on purpose: those are deliberate, client-facing validation/auth errors thrown by the core, not internal faults.
+- **Admin audit log** (`src/hosted-server.mjs`) — every admin action (workspace create, delete, rotate-key, export, import) emits one structured stderr line: timestamp, action, workspace id, source IP. Never a key, never a hash. On a paid host, that stderr stream is the operator's audit trail.
+- **SECURITY.md** — new at the repo root: latest-release-only support, private reporting to gdev6145@gmail.com, one-business-day acknowledgement (the studio's stated support posture), and scope notes.
+- **Tests** — three new checks (54 in the main suite, was 51): HTML headers + 0600 file modes + audit lines (create/rotate/delete, asserting no key material appears in stderr); the 1 MB cap returning 413 on hosted-admin, in-workspace, and single-relay routes; and the failed-auth throttle (30 bad keys → 401 each, then even the correct key → 429, admin too, health still 200). All three fail against the 0.5.2 servers (51 passed, 3 failed, each for its intended reason) and pass with the change; serverless stays 6/6 and both demos green. The timing-safe change is covered functionally by the existing right-key/wrong-key checks at every layer — a timing side channel is not observable from a functional test, so that one is verified by the audit above rather than a red/green run.
+- **Scope boundary, honestly** — what did NOT change: no API or behavior change for legitimate clients; storage format and locations; the local stdio/CLI trust model; the serverless pack's opt-in token posture (only its key compare was aligned); the deferred networked multi-writer store is still future work. One judgment call to know about: throttling is per-IP and in-memory — behind a shared NAT, one guesser can 429 a whole office's *unauthenticated* attempts for a minute; authenticated traffic with a valid key is only blocked while the throttle is tripped, and the window is short by design.
+
 ## 0.5.2 — 2026-10-11
 
 Security hardening — the pre-pilot pass. A cold source review scored GhostBus 7.4/10 with security maturity its lowest mark (5.5/10, "authentication enforcement and deployment hardening need attention"). That was the right call to answer before any hosted workspace carries a stranger's work — or their money:

package/README.md

@@ -23,7 +23,7 @@ Built and in use: 29 MCP tools across presence, messages, tasks, a shared worksp
 ```bash
 git clone https://github.com/littlestjames82-sys/ghostbus.git ghostbus && cd ghostbus
 node examples/two-agent-demo.mjs   # watch a planner and a builder cooperate
-node test.mjs                      # 51 checks: core, tokens, capsules, dependencies, sync, persistence, concurrency, MCP stdio, HTTP, SSE, CLI, hosted security
+node test.mjs                      # 54 checks: core, tokens, capsules, dependencies, sync, persistence, concurrency, MCP stdio, HTTP, SSE, CLI, hosted security
 node examples/three-agent-team.mjs # planner + builder + reviewer, no human relaying
 ```
 

package/docs/hosted.md

@@ -106,6 +106,38 @@ the operator, so its defaults are stricter than the local relay's (v0.5.2):
   Drill a restore (delete + import) before you need one; a restore lands in
   the workspace's provenance log as `workspace.restore`.
 
+Round 2 (v0.5.3) closed the next layer:
+
+- **Timing-safe secret comparisons everywhere.** Workspace keys (hosted
+  router + serverless pack) and per-agent tokens (core) are compared with
+  `crypto.timingSafeEqual` over SHA-256 digests — no `===` on secrets
+  anywhere in the codebase.
+- **Failed-auth throttling at the hosted layer.** The in-workspace limiter
+  (300 req/min/IP) never covered *guessing*: 30 failed auth attempts per
+  minute from one IP now gets 429s on the admin surface and on workspace
+  routes until the window rolls. Successful auth never counts toward it;
+  `/health` and `/probe` stay open so operators can see an attack.
+- **Request bodies are capped at 1 MB** on every JSON route (hosted admin,
+  in-workspace, single relay). Over the cap: a clean `413` JSON error.
+  File contents travel as JSON in GhostBus, so legitimate files fit
+  comfortably — but a workspace *import* larger than 1 MB must be restored
+  by placing the state file in the data dir (or via the CLI), not over HTTP.
+- **HTML pages can't be framed and carry a CSP.** The board and the hosted
+  landing page answer with `X-Frame-Options: DENY` and a
+  `Content-Security-Policy` (`default-src 'self'`, `frame-ancestors 'none'`;
+  inline script/style are allowed specifically because both pages are
+  single self-contained documents with zero external resources).
+- **Data files are written owner-only (0600).** The registry and every
+  workspace state file hold key/token hashes; they are created 0600 through
+  the same atomic temp+rename writes as before.
+- **Admin actions are audit-logged.** Every workspace create, delete,
+  rotate-key, export, and import writes one structured stderr line
+  (timestamp, action, workspace id, source IP) — never a key or a hash.
+  Point the hosted process's stderr at your log collector and that *is*
+  the operator audit trail.
+- **Reporting a vulnerability:** see `SECURITY.md` at the repo root
+  (private email reporting, one-business-day acknowledgement).
+
 ## Option B — serverless on Netlify (Blobs)
 
 `deploy/netlify/` contains a Netlify Function implementing the same multi-workspace semantics over Netlify Blobs (strong consistency):

package/package.json

@@ -44,5 +44,5 @@
     "hosted": "node src/hosted-server.mjs"
   },
   "type": "module",
-  "version": "0.5.2"
+  "version": "0.5.3"
 }

package/src/core.mjs

@@ -14,8 +14,14 @@ import path from 'node:path';
 import crypto from 'node:crypto';
 import { AsyncLocalStorage } from 'node:async_hooks';
 
-export const GHOSTBUS_VERSION = '0.5.2';
+export const GHOSTBUS_VERSION = '0.5.3';
 const sha256 = (s) => crypto.createHash('sha256').update(String(s)).digest('hex');
+// Timing-safe equality for hex digests (v0.5.3): secret comparisons must not
+// short-circuit on the first differing character the way === does.
+const hashEqHex = (aHex, bHex) => {
+  const a = Buffer.from(String(aHex)); const b = Buffer.from(String(bHex));
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+};
 export const TASK_STATUSES = ['queued', 'claimed', 'needs-approval', 'done', 'cancelled'];
 const CLAIM_LEASE_MS = 15 * 60 * 1000;
 
@@ -62,7 +68,11 @@ export class FileStore {
       await fs.promises.mkdir(path.dirname(this.file), { recursive: true });
       const tmp = this.file + '.tmp.' + process.pid + '.' + Math.random().toString(36).slice(2, 10);
       try {
-        await fs.promises.writeFile(tmp, JSON.stringify(state, null, 2));
+        // State files hold token hashes — owner-only (0600) from birth
+        // (v0.5.3). The mode rides through the atomic rename; the chmod
+        // covers filesystems/umasks that would otherwise widen it.
+        await fs.promises.writeFile(tmp, JSON.stringify(state, null, 2), { mode: 0o600 });
+        await fs.promises.chmod(tmp, 0o600).catch(() => {});
         await fs.promises.rename(tmp, this.file); // atomic replace
       } finally {
         await fs.promises.unlink(tmp).catch(() => {});
@@ -160,7 +170,7 @@ export class GhostBus {
     const a = this._agent(name);
     if (!a) throw Object.assign(new Error(`agent not registered: ${name}`), { code: 'UNKNOWN_AGENT' });
     if (this.requireTokens && a.tokenHash) {
-      if (!token || sha256(token) !== a.tokenHash) {
+      if (!token || !hashEqHex(sha256(token), a.tokenHash)) {
         throw Object.assign(new Error(`agent token required or wrong for: ${name}`), { code: 'AGENT_AUTH' });
       }
     }

package/src/handler.mjs

@@ -24,6 +24,56 @@ const hashEq = (given, expected) => {
   return a.length === b.length && crypto.timingSafeEqual(a, b);
 };
 export const keyMatches = (given, expected) => !!expected && !!given && hashEq(given, expected);
+// Timing-safe check of a presented secret against a STORED sha256 hex digest
+// (v0.5.3) — the hosted router and the core token check compare against
+// hashes at rest, never against raw keys.
+export const hashMatches = (given, storedHashHex) => {
+  if (!given || !storedHashHex) return false;
+  const a = Buffer.from(crypto.createHash('sha256').update(String(given)).digest('hex'));
+  const b = Buffer.from(String(storedHashHex));
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+};
+
+// JSON request-body cap (v0.5.3): file contents travel inside JSON bodies in
+// this codebase, so 1 MB is generous for messages/tasks/files while keeping
+// a single request from exhausting memory. Over the cap the reader rejects
+// with code BODY_TOO_LARGE and the route answers 413.
+export const MAX_BODY_BYTES = 1_000_000;
+export function readJsonBody(req, limit = MAX_BODY_BYTES) {
+  return new Promise((resolve, reject) => {
+    let size = 0; let done = false;
+    const chunks = [];
+    req.on('data', (c) => {
+      if (done) return;
+      size += c.length;
+      if (size > limit) {
+        done = true;
+        req.pause(); // stop reading; the route answers 413 and drops the socket
+        reject(Object.assign(new Error(`request body too large (limit ${limit} bytes)`), { code: 'BODY_TOO_LARGE' }));
+        return;
+      }
+      chunks.push(c);
+    });
+    req.on('end', () => {
+      if (done) return; done = true;
+      const data = Buffer.concat(chunks).toString('utf8');
+      try { resolve(data ? JSON.parse(data) : {}); } catch { resolve(null); }
+    });
+    req.on('error', () => { if (!done) { done = true; resolve(null); } });
+  });
+}
+
+// Headers for the HTML pages (board + hosted landing), v0.5.3. Both pages are
+// single self-contained documents: inline <script>/<style> and same-origin
+// fetches only, zero external resources — so the CSP allows 'unsafe-inline'
+// for script/style specifically (no eval, no external origins, no plugins)
+// and forbids framing outright.
+export const HTML_SECURITY_HEADERS = {
+  'x-frame-options': 'DENY',
+  'content-security-policy': "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; object-src 'none'",
+};
+
+const TOO_LARGE = Symbol('body-too-large');
 
 export function createBusHandler({ id = 'default', bus, key = '' }) {
   const buckets = new Map();
@@ -51,13 +101,19 @@ export function createBusHandler({ id = 'default', bus, key = '' }) {
     if (!rateOk(req) && url.pathname !== '/health' && url.pathname !== '/probe') {
       return send(429, { error: 'rate limit: 300 requests/min per IP per workspace' });
     }
-    const readBody = () => new Promise((resolve) => {
-      let data = ''; req.on('data', c => { data += c; if (data.length > 5_000_000) req.destroy(); });
-      req.on('end', () => { try { resolve(data ? JSON.parse(data) : {}); } catch { resolve(null); } });
-    });
+    const send413 = () => {
+      try {
+        res.writeHead(413, { 'content-type': 'application/json', connection: 'close' });
+        res.end(JSON.stringify({ error: `request body too large (limit ${MAX_BODY_BYTES} bytes)` }), () => { try { req.destroy(); } catch {} });
+      } catch {}
+    };
+    const readBody = async () => {
+      try { return await readJsonBody(req); }
+      catch (e) { if (e && e.code === 'BODY_TOO_LARGE') { send413(); return TOO_LARGE; } throw e; }
+    };
 
     try {
-      if (req.method === 'GET' && url.pathname === '/') { res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' }); return res.end(BOARD_HTML); }
+      if (req.method === 'GET' && url.pathname === '/') { res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', ...HTML_SECURITY_HEADERS }); return res.end(BOARD_HTML); }
       if (req.method === 'GET' && url.pathname === '/health') return send(200, { ok: true, server: 'ghostbus', workspace: id, version: GHOSTBUS_VERSION });
       if (req.method === 'GET' && url.pathname === '/probe') {
         const s = await bus.status();
@@ -103,6 +159,7 @@ export function createBusHandler({ id = 'default', bus, key = '' }) {
 
       if (req.method === 'POST' && url.pathname === '/mcp') {
         const msg = await readBody();
+        if (msg === TOO_LARGE) return; // 413 already sent
         if (!msg) return send(400, { error: 'invalid JSON body' });
         if (msg.method === 'tools/list') return send(200, { jsonrpc: '2.0', id: msg.id, result: { tools: TOOLS } });
         if (msg.method === 'tools/call') {
@@ -118,6 +175,7 @@ export function createBusHandler({ id = 'default', bus, key = '' }) {
       }
 
       const body = ['POST', 'PUT', 'DELETE'].includes(req.method) ? await readBody().catch(() => ({})) : {};
+      if (body === TOO_LARGE) return; // 413 already sent
       const safeBody = body && typeof body === 'object' ? body : {};
       const q = Object.fromEntries(url.searchParams);
 

package/src/hosted-server.mjs

@@ -23,13 +23,17 @@
  *   to act. GHOSTBUS_REQUIRE_TOKENS=0 is the only opt-out and starts with a
  *   loud warning. GHOSTBUS_ADMIN_KEY is required and must be at least 16
  *   characters — it is the operator root key (see docs/hosted.md).
+ * - v0.5.3: workspace-key checks are timing-safe, failed auth is throttled
+ *   per IP at this layer, JSON bodies are capped at 1 MB (413), registry +
+ *   workspace files are written 0600, HTML pages carry CSP/frame headers,
+ *   and every admin action is audit-logged to stderr (never keys/hashes).
  */
 import http from 'node:http';
 import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import { createBus, FileStore, GHOSTBUS_VERSION, validateSnapshot } from './core.mjs';
-import { createBusHandler, keyMatches } from './handler.mjs';
+import { createBusHandler, keyMatches, hashMatches, readJsonBody, MAX_BODY_BYTES, HTML_SECURITY_HEADERS } from './handler.mjs';
 
 const argv = process.argv.slice(2);
 const argVal = (flag) => { const i = argv.indexOf(flag); return i >= 0 ? argv[i + 1] : null; };
@@ -62,9 +66,11 @@ const loadRegistry = () => { try { return JSON.parse(fs.readFileSync(registryPat
 const saveRegistry = (reg) => {
   // Unique temp per save: two processes sharing this registry must never
   // collide on one fixed '.tmp' name (first rename wins, second throws ENOENT).
+  // The registry holds every workspace's key hash — owner-only (0600, v0.5.3).
   const tmp = registryPath + '.tmp.' + process.pid + '.' + Math.random().toString(36).slice(2, 10);
   try {
-    fs.writeFileSync(tmp, JSON.stringify(reg, null, 2));
+    fs.writeFileSync(tmp, JSON.stringify(reg, null, 2), { mode: 0o600 });
+    try { fs.chmodSync(tmp, 0o600); } catch { /* mode already applied on create */ }
     fs.renameSync(tmp, registryPath);
   } finally {
     try { fs.unlinkSync(tmp); } catch { /* already renamed away */ }
@@ -98,9 +104,38 @@ const wsKeyOk = (req, meta) => {
   const given = req.headers['x-bus-key'] || String(req.headers.authorization || '').replace(/^Bearer\s+/i, '');
   if (!given) return false;
   if (keyMatches(given, ADMIN_KEY)) return true; // master key
-  return sha256(given) === meta.keyHash;
+  return hashMatches(given, meta.keyHash); // timing-safe vs the stored hash (v0.5.3)
 };
 
+// Failed-auth throttle (v0.5.3): the in-workspace handler limiter (300/min)
+// throttles traffic that is already inside a workspace, but nothing slowed
+// down *guessing* at the hosted layer — admin keys and workspace keys were
+// unthrottled. Track FAILED auth per IP; past the limit, admin + workspace
+// routes answer 429 until the window rolls. Successful auth never counts.
+const AUTH_FAIL_LIMIT = 30;            // failed auth attempts per window per IP
+const AUTH_FAIL_WINDOW_MS = 60_000;    // one-minute window
+const authFails = new Map(); // ip -> {start, count}
+const clientIp = (req) => (req.socket && req.socket.remoteAddress) || 'unknown';
+const authThrottled = (ip) => {
+  const b = authFails.get(ip);
+  return !!b && Date.now() - b.start <= AUTH_FAIL_WINDOW_MS && b.count >= AUTH_FAIL_LIMIT;
+};
+const noteAuthFail = (ip) => {
+  const t = Date.now();
+  let b = authFails.get(ip);
+  if (!b || t - b.start > AUTH_FAIL_WINDOW_MS) { b = { start: t, count: 0 }; authFails.set(ip, b); }
+  b.count += 1;
+};
+
+// Operator audit trail (v0.5.3): one structured stderr line per admin
+// action, so a paid host has a record of who did what to which workspace.
+// NEVER log keys or hashes — ids, actions, timestamps, source IPs only.
+const audit = (action, id, req) => {
+  process.stderr.write(JSON.stringify({ ts: new Date().toISOString(), audit: 'admin', action, workspace: id, ip: clientIp(req) }) + '\n');
+};
+
+const TOO_LARGE = Symbol('body-too-large');
+
 const LANDING = `<!doctype html><html><head><meta charset="utf-8"><title>GhostBus Hosted</title>
 <style>body{font-family:system-ui;background:#0e0c14;color:#ece8f5;margin:0;padding:40px}h1{font-size:22px}code{background:#17131f;padding:2px 7px;border-radius:6px;color:#c9b8ff}p{color:#9b8fb5;max-width:640px;line-height:1.55}</style></head>
 <body><h1>👻 GhostBus Hosted</h1>
@@ -116,19 +151,34 @@ const server = http.createServer(async (req, res) => {
   };
   res.setHeader('x-content-type-options', 'nosniff');
   res.setHeader('referrer-policy', 'no-referrer');
-  const readBody = () => new Promise((resolve) => {
-    let data = ''; req.on('data', c => { data += c; if (data.length > 5_000_000) req.destroy(); });
-    req.on('end', () => { try { resolve(data ? JSON.parse(data) : {}); } catch { resolve(null); } });
-  });
+  const ip = clientIp(req);
+  const adminDenied = () => { noteAuthFail(ip); return send(401, { error: 'admin key required' }); };
+  const readBody = async () => {
+    try { return await readJsonBody(req); }
+    catch (e) {
+      if (e && e.code === 'BODY_TOO_LARGE') {
+        try {
+          res.writeHead(413, { 'content-type': 'application/json', connection: 'close' });
+          res.end(JSON.stringify({ error: `request body too large (limit ${MAX_BODY_BYTES} bytes)` }), () => { try { req.destroy(); } catch {} });
+        } catch {}
+        return TOO_LARGE;
+      }
+      throw e;
+    }
+  };
 
   try {
-    if (req.method === 'GET' && url.pathname === '/') { res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' }); return res.end(LANDING); }
+    if (req.method === 'GET' && url.pathname === '/') { res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', ...HTML_SECURITY_HEADERS }); return res.end(LANDING); }
     if (req.method === 'GET' && url.pathname === '/health') return send(200, { ok: true, server: 'ghostbus-hosted', version: GHOSTBUS_VERSION, workspaces: Object.keys(loadRegistry().workspaces).length });
 
     // ---- admin ----
+    // Failed-auth throttle (v0.5.3): sustained key guessing gets 429s on the
+    // whole admin surface before any key is even compared.
+    if (url.pathname.startsWith('/api/workspaces') && authThrottled(ip)) return send(429, { error: 'too many failed auth attempts — try again shortly' });
     if (url.pathname === '/api/workspaces' && req.method === 'POST') {
-      if (!isAdmin(req)) return send(401, { error: 'admin key required' });
+      if (!isAdmin(req)) return adminDenied();
       const body = await readBody();
+      if (body === TOO_LARGE) return; // 413 already sent
       if (!body) return send(400, { error: 'invalid JSON body' });
       const reg = loadRegistry();
       const id = body.id || `ws-${crypto.randomBytes(4).toString('hex')}`;
@@ -137,10 +187,11 @@ const server = http.createServer(async (req, res) => {
       const key = crypto.randomBytes(24).toString('hex');
       reg.workspaces[id] = { name: String(body.name || id).slice(0, 120), keyHash: sha256(key), createdAt: new Date().toISOString() };
       saveRegistry(reg);
+      audit('create', id, req);
       return send(201, { id, name: reg.workspaces[id].name, key, keyNote: 'Workspace key — shown ONCE, only its hash is stored. Agents use it as x-bus-key (or Bearer) under /w/' + id + '/.', board: `/w/${id}/` });
     }
     if (url.pathname === '/api/workspaces' && req.method === 'GET') {
-      if (!isAdmin(req)) return send(401, { error: 'admin key required' });
+      if (!isAdmin(req)) return adminDenied();
       const reg = loadRegistry();
       const out = [];
       for (const [id, meta] of Object.entries(reg.workspaces)) {
@@ -152,7 +203,7 @@ const server = http.createServer(async (req, res) => {
     }
     const rotateMatch = url.pathname.match(/^\/api\/workspaces\/([a-z0-9-]+)\/rotate-key$/);
     if (req.method === 'POST' && rotateMatch) {
-      if (!isAdmin(req)) return send(401, { error: 'admin key required' });
+      if (!isAdmin(req)) return adminDenied();
       const reg = loadRegistry();
       const id = rotateMatch[1];
       if (!reg.workspaces[id]) return send(404, { error: `no such workspace: ${id}` });
@@ -163,20 +214,23 @@ const server = http.createServer(async (req, res) => {
       // Refresh the cached meta so the old key dies immediately, not on restart.
       const cached = buses.get(id);
       if (cached) cached.meta = reg.workspaces[id];
+      audit('rotate-key', id, req);
       return send(200, { id, key, keyNote: 'New workspace key — shown ONCE. The previous key is invalid from this moment.', keyRotatedAt: reg.workspaces[id].keyRotatedAt });
     }
     const exportMatch = url.pathname.match(/^\/api\/workspaces\/([a-z0-9-]+)\/export$/);
     if (req.method === 'GET' && exportMatch) {
-      if (!isAdmin(req)) return send(401, { error: 'admin key required' });
+      if (!isAdmin(req)) return adminDenied();
       const id = exportMatch[1];
       const w = await getWorkspace(id);
       if (!w) return send(404, { error: `no such workspace: ${id}` });
       const state = await w.bus.snapshot();
+      audit('export', id, req);
       return send(200, { ghostbusExport: 1, version: GHOSTBUS_VERSION, exportedAt: new Date().toISOString(), workspace: { id, name: w.meta.name }, state });
     }
     if (url.pathname === '/api/workspaces/import' && req.method === 'POST') {
-      if (!isAdmin(req)) return send(401, { error: 'admin key required' });
+      if (!isAdmin(req)) return adminDenied();
       const body = await readBody();
+      if (body === TOO_LARGE) return; // 413 already sent
       if (!body) return send(400, { error: 'invalid JSON body' });
       // Accept either a full export envelope or a bare {state} / raw state.
       const env = body.ghostbusExport ? body : null;
@@ -195,15 +249,17 @@ const server = http.createServer(async (req, res) => {
       // the bus sees exactly what a restart would see.
       const file = path.join(dataDir, `${id}.json`);
       const tmp = file + '.tmp.' + process.pid + '.' + Math.random().toString(36).slice(2, 10);
-      fs.writeFileSync(tmp, JSON.stringify(state, null, 2));
+      fs.writeFileSync(tmp, JSON.stringify(state, null, 2), { mode: 0o600 }); // state file: owner-only (v0.5.3)
+      try { fs.chmodSync(tmp, 0o600); } catch { /* mode already applied on create */ }
       fs.renameSync(tmp, file);
+      audit('import', id, req);
       const w = await getWorkspace(id);
       const status = await w.bus.status();
       return send(201, { id, name, key, keyNote: 'Workspace key — shown ONCE, only its hash is stored. Imported workspaces always get a FRESH key; the source key is not carried over.', agents: status.agents, messages: status.messages, tasks: status.tasks.total, board: `/w/${id}/` });
     }
     const delMatch = url.pathname.match(/^\/api\/workspaces\/([a-z0-9-]+)$/);
     if (req.method === 'DELETE' && delMatch) {
-      if (!isAdmin(req)) return send(401, { error: 'admin key required' });
+      if (!isAdmin(req)) return adminDenied();
       const reg = loadRegistry();
       const id = delMatch[1];
       if (!reg.workspaces[id]) return send(404, { error: `no such workspace: ${id}` });
@@ -211,6 +267,7 @@ const server = http.createServer(async (req, res) => {
       saveRegistry(reg);
       buses.delete(id); handlers.delete(id);
       try { fs.unlinkSync(path.join(dataDir, `${id}.json`)); } catch {}
+      audit('delete', id, req);
       return send(200, { id, deleted: true });
     }
 
@@ -224,13 +281,15 @@ const server = http.createServer(async (req, res) => {
       sub.pathname = wMatch[2] || '/';
       // Open surfaces mirror the single relay: board page, health, probe.
       const open = sub.pathname === '/' || sub.pathname === '/health' || sub.pathname === '/probe';
-      if (!open && !wsKeyOk(req, w.meta)) return send(401, { error: 'missing or wrong workspace key' });
+      if (!open && authThrottled(ip)) return send(429, { error: 'too many failed auth attempts — try again shortly' });
+      if (!open && !wsKeyOk(req, w.meta)) { noteAuthFail(ip); return send(401, { error: 'missing or wrong workspace key' }); }
       return handlerFor(id, w.bus)(req, res, sub);
     }
 
     return send(404, { error: 'not found' });
   } catch (e) {
-    return send(500, { error: e.message });
+    process.stderr.write(`ghostbus hosted: internal error: ${(e && e.stack) || e}\n`);
+    return send(500, { error: 'internal error' });
   }
 });
 

package/src/http-server.mjs

@@ -30,7 +30,7 @@ const handle = createBusHandler({ id: 'default', bus, key: KEY });
 
 const server = http.createServer((req, res) => {
   const url = new URL(req.url, 'http://localhost');
-  handle(req, res, url).catch((e) => { try { res.writeHead(500, { 'content-type': 'application/json' }); res.end(JSON.stringify({ error: e.message })); } catch {} });
+  handle(req, res, url).catch((e) => { process.stderr.write(`ghostbus relay: internal error: ${(e && e.stack) || e}\n`); try { res.writeHead(500, { 'content-type': 'application/json' }); res.end(JSON.stringify({ error: 'internal error' })); } catch {} });
 });
 server.listen(port, () => {
   process.stderr.write(`ghostbus http relay v${GHOSTBUS_VERSION} · http://127.0.0.1:${port} · store=${storePath} · auth=${KEY ? 'workspace key required' : 'open (set GHOSTBUS_KEY)'}\n`);