kiro-mobile-bridge 1.0.8 → 1.0.11

package/src/routes/api.js

@@ -4,8 +4,23 @@
 import { Router } from 'express';
 import fs from 'fs/promises';
 import path from 'path';
+import os from 'os';
 import { injectMessage } from '../services/message.js';
 import { clickElement } from '../services/click.js';
+import { 
+  validatePathWithinRoot, 
+  sanitizeClickInfo, 
+  validateMessage,
+  sanitizeFilePath 
+} from '../utils/security.js';
+import { 
+  CODE_EXTENSIONS, 
+  EXTENSION_TO_LANGUAGE, 
+  getLanguageFromExtension,
+  isCodeFile,
+  MAX_FILE_SEARCH_DEPTH,
+  MAX_WORKSPACE_DEPTH
+} from '../utils/constants.js';
 
 /**
  * Create API router
@@ -46,13 +61,17 @@ export function createApiRouter(cascades, mainWindowCDP) {
     if (!cascade) return res.status(404).json({ error: 'Cascade not found' });
     
     const { message } = req.body;
-    if (!message || typeof message !== 'string') {
-      return res.status(400).json({ error: 'Message is required' });
+    
+    // Validate message input
+    const validation = validateMessage(message);
+    if (!validation.valid) {
+      return res.status(400).json({ error: validation.error });
     }
     
     if (!cascade.cdp) return res.status(503).json({ error: 'CDP connection not available' });
     
-    console.log(`[Send] Message to ${req.params.id}: ${message.substring(0, 50)}...`);
+    // Log message length only, not content (security)
+    console.log(`[Send] Message to ${req.params.id}: ${message.length} chars`);
     const result = await injectMessage(cascade.cdp, message);
     
     if (result.success) {
@@ -68,81 +87,185 @@ export function createApiRouter(cascades, mainWindowCDP) {
     if (!cascade) return res.status(404).json({ error: 'Cascade not found' });
     if (!cascade.cdp?.rootContextId) return res.status(503).json({ error: 'CDP not available' });
     
-    const clickInfo = req.body;
-    console.log(`[Click] ${clickInfo.text?.substring(0, 30) || clickInfo.ariaLabel || clickInfo.tag}`);
+    // Validate and sanitize click info
+    const { valid, sanitized, error } = sanitizeClickInfo(req.body);
+    if (!valid) {
+      return res.status(400).json({ error: error || 'Invalid click info' });
+    }
+    
+    console.log(`[Click] ${sanitized.text?.substring(0, 30) || sanitized.ariaLabel || sanitized.tag || 'element'}`);
     
     try {
-      const result = await clickElement(cascade.cdp, clickInfo);
+      const result = await clickElement(cascade.cdp, sanitized);
       res.json(result);
     } catch (err) {
+      console.error('[Click] Error:', err.message);
       res.status(500).json({ success: false, error: err.message });
     }
   });
   
+  // GET /debug-model/:id - Debug model selector structure
+  router.get('/debug-model/:id', async (req, res) => {
+    const cascade = cascades.get(req.params.id);
+    if (!cascade) return res.status(404).json({ error: 'Cascade not found' });
+    if (!cascade.cdp?.rootContextId) return res.status(503).json({ error: 'CDP not available' });
+    
+    const script = `(function() {
+      let targetDoc = document;
+      const activeFrame = document.getElementById('active-frame');
+      if (activeFrame && activeFrame.contentDocument) targetDoc = activeFrame.contentDocument;
+      
+      const results = {
+        dropdownOpen: false,
+        dropdownItems: [],
+        dropdownContainer: null,
+        autopilotToggle: null
+      };
+      
+      // Check if dropdown is open
+      const openDropdown = targetDoc.querySelector('.kiro-dropdown-menu, [class*="dropdown-menu"], [class*="dropdown-content"], [role="listbox"], [role="menu"]');
+      if (openDropdown && openDropdown.offsetParent !== null) {
+        results.dropdownOpen = true;
+        results.dropdownContainer = {
+          tag: openDropdown.tagName,
+          className: (openDropdown.className || '').substring(0, 100),
+          role: openDropdown.getAttribute('role'),
+          innerHTML: openDropdown.innerHTML.substring(0, 1000)
+        };
+        
+        // Find all items in the dropdown
+        const items = openDropdown.querySelectorAll('.kiro-dropdown-item, [role="option"], [role="menuitem"], [class*="dropdown-item"], [class*="menu-item"], > div, > button');
+        items.forEach(item => {
+          results.dropdownItems.push({
+            tag: item.tagName,
+            className: (item.className || '').substring(0, 80),
+            text: (item.textContent || '').substring(0, 100),
+            role: item.getAttribute('role'),
+            dataValue: item.getAttribute('data-value'),
+            onclick: !!item.onclick,
+            cursor: window.getComputedStyle(item).cursor
+          });
+        });
+      }
+      
+      // Find Autopilot toggle
+      const autopilotElements = targetDoc.querySelectorAll('[class*="toggle"], input[type="checkbox"]');
+      for (const el of autopilotElements) {
+        const parent = el.closest('.kiro-toggle-switch, [class*="toggle"]');
+        if (parent) {
+          const label = parent.querySelector('label');
+          const labelText = label ? label.textContent.toLowerCase() : '';
+          if (labelText.includes('autopilot') || labelText.includes('auto')) {
+            results.autopilotToggle = {
+              toggleElement: {
+                tag: el.tagName,
+                type: el.type,
+                className: (el.className || '').substring(0, 80),
+                checked: el.checked,
+                id: el.id
+              },
+              parentElement: {
+                tag: parent.tagName,
+                className: (parent.className || '').substring(0, 80),
+                onclick: !!parent.onclick
+              },
+              labelText: labelText
+            };
+            break;
+          }
+        }
+      }
+      
+      return results;
+    })()`;
+    
+    try {
+      const result = await cascade.cdp.call('Runtime.evaluate', {
+        expression: script,
+        contextId: cascade.cdp.rootContextId,
+        returnByValue: true
+      });
+      
+      const data = result.result?.value;
+      console.log('[Debug] UI structure:', JSON.stringify(data, null, 2));
+      res.json(data);
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+  
   // POST /readFile/:id - Read file from filesystem
   router.post('/readFile/:id', async (req, res) => {
     const cascade = cascades.get(req.params.id);
     if (!cascade) return res.status(404).json({ error: 'Cascade not found' });
     
     const { filePath } = req.body;
-    if (!filePath) return res.status(400).json({ error: 'filePath is required' });
+    if (!filePath || typeof filePath !== 'string') {
+      return res.status(400).json({ error: 'filePath is required and must be a string' });
+    }
     
-    console.log(`[ReadFile] ${filePath}`);
+    // Sanitize the file path
+    const sanitizedPath = sanitizeFilePath(filePath);
+    if (!sanitizedPath) {
+      return res.status(400).json({ error: 'Invalid file path' });
+    }
+    
+    console.log(`[ReadFile] Request for: ${sanitizedPath}`);
     
     try {
-      const fileName = path.basename(filePath);
-      const possiblePaths = [
-        filePath,
-        path.join(process.cwd(), filePath),
-        path.join(process.cwd(), 'src', filePath),
-        path.join(process.cwd(), 'public', filePath)
-      ];
+      // Get workspace root
+      const workspaceRoot = await getWorkspaceRoot(mainWindowCDP) || process.cwd();
       
-      // Add workspace-relative paths
-      if (!path.isAbsolute(filePath)) {
-        const workspaceRoot = await getWorkspaceRoot(mainWindowCDP);
-        if (workspaceRoot) {
-          possiblePaths.unshift(path.join(workspaceRoot, filePath));
-        }
-      }
+      // SECURITY: Validate path is within workspace root
+      const pathValidation = validatePathWithinRoot(sanitizedPath, workspaceRoot);
       
       let content = null;
       let foundPath = null;
       
-      for (const tryPath of possiblePaths) {
+      if (pathValidation.valid) {
+        // Try the validated path first
         try {
-          content = await fs.readFile(tryPath, 'utf-8');
-          foundPath = tryPath;
-          break;
-        } catch (e) {}
+          content = await fs.readFile(pathValidation.resolvedPath, 'utf-8');
+          foundPath = pathValidation.resolvedPath;
+        } catch (e) {
+          // File doesn't exist at validated path, try searching
+        }
       }
       
-      // Recursive search fallback
+      // If not found, search within workspace only
       if (!content) {
-        foundPath = await findFileRecursive(process.cwd(), fileName);
-        if (foundPath) content = await fs.readFile(foundPath, 'utf-8');
+        const fileName = path.basename(sanitizedPath);
+        foundPath = await findFileRecursive(workspaceRoot, fileName, MAX_FILE_SEARCH_DEPTH);
+        
+        if (foundPath) {
+          // Validate the found path is still within workspace
+          const foundValidation = validatePathWithinRoot(foundPath, workspaceRoot);
+          if (foundValidation.valid) {
+            content = await fs.readFile(foundPath, 'utf-8');
+          } else {
+            console.warn(`[ReadFile] Found file outside workspace: ${foundPath}`);
+            foundPath = null;
+          }
+        }
       }
       
       if (!content) {
-        return res.status(404).json({ error: 'File not found' });
+        return res.status(404).json({ error: 'File not found within workspace' });
       }
       
-      const ext = path.extname(filePath).toLowerCase().slice(1);
-      const extMap = {
-        'ts': 'typescript', 'tsx': 'typescript', 'js': 'javascript', 'jsx': 'javascript',
-        'py': 'python', 'html': 'html', 'css': 'css', 'json': 'json', 'md': 'markdown'
-      };
+      const language = getLanguageFromExtension(sanitizedPath);
       
       res.json({
         content,
-        fileName: path.basename(filePath),
+        fileName: path.basename(sanitizedPath),
         fullPath: foundPath,
-        language: extMap[ext] || ext,
+        language,
         lineCount: content.split('\n').length,
         hasContent: true
       });
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      console.error('[ReadFile] Error:', err.message);
+      res.status(500).json({ error: 'Failed to read file' });
     }
   });
   
@@ -158,6 +281,7 @@ export function createApiRouter(cascades, mainWindowCDP) {
       console.log(`[Files] Found ${files.length} files in ${workspaceRoot}`);
       res.json({ files, workspaceRoot });
     } catch (err) {
+      console.error('[Files] Error:', err.message);
       res.status(500).json({ error: err.message });
     }
   });
@@ -186,13 +310,16 @@ export function createApiRouter(cascades, mainWindowCDP) {
         try {
           const content = await fs.readFile(tasksFilePath, 'utf-8');
           tasks.push({ name: dir.name, path: `.kiro/specs/${dir.name}/tasks.md`, content });
-        } catch (e) {}
+        } catch (e) {
+          // Task file doesn't exist, skip
+        }
       }
       
       tasks.sort((a, b) => a.name.localeCompare(b.name));
       console.log(`[Tasks] Found ${tasks.length} task files`);
       res.json({ tasks, workspaceRoot });
     } catch (err) {
+      console.error('[Tasks] Error:', err.message);
       res.status(500).json({ error: err.message });
     }
   });
@@ -203,12 +330,20 @@ export function createApiRouter(cascades, mainWindowCDP) {
     if (!cascade) return res.status(404).json({ error: 'Cascade not found' });
     
     const { specName } = req.body;
-    if (!specName) return res.status(400).json({ error: 'specName is required' });
+    if (!specName || typeof specName !== 'string') {
+      return res.status(400).json({ error: 'specName is required and must be a string' });
+    }
+    
+    // Sanitize spec name (alphanumeric, hyphens, underscores only)
+    const sanitizedSpecName = specName.replace(/[^a-zA-Z0-9_-]/g, '').substring(0, 100);
+    if (!sanitizedSpecName) {
+      return res.status(400).json({ error: 'Invalid spec name' });
+    }
     
     const cdp = cascade.cdp;
     if (!cdp?.rootContextId) return res.status(503).json({ error: 'CDP not connected' });
     
-    console.log(`[OpenSpec] Opening ${specName}`);
+    console.log(`[OpenSpec] Opening ${sanitizedSpecName}`);
     
     // Try to click on spec in sidebar
     const script = `(function() {
@@ -216,7 +351,7 @@ export function createApiRouter(cascades, mainWindowCDP) {
       const activeFrame = document.getElementById('active-frame');
       if (activeFrame && activeFrame.contentDocument) targetDoc = activeFrame.contentDocument;
       
-      const specName = '${specName.replace(/'/g, "\\'")}';
+      const specName = '${sanitizedSpecName}';
       const allElements = targetDoc.querySelectorAll('*');
       
       for (const el of allElements) {
@@ -246,7 +381,12 @@ export function createApiRouter(cascades, mainWindowCDP) {
   return router;
 }
 
-// Helper: Get workspace root from VS Code window title
+/**
+ * Get workspace root from VS Code window title
+ * Uses environment-based paths instead of hardcoded values
+ * @param {object} mainWindowCDP - Main window CDP connection
+ * @returns {Promise<string|null>}
+ */
 async function getWorkspaceRoot(mainWindowCDP) {
   if (!mainWindowCDP.connection?.rootContextId) return null;
   
@@ -261,79 +401,115 @@ async function getWorkspaceRoot(mainWindowCDP) {
     const parts = title.split(' - ');
     if (parts.length >= 2) {
       const folderName = parts[parts.length - 2].trim();
+      const homeDir = os.homedir();
+      
+      // Build possible roots from environment, not hardcoded paths
       const possibleRoots = [
         process.cwd(),
-        path.join(process.env.HOME || process.env.USERPROFILE || '', folderName),
-        path.join(process.env.HOME || process.env.USERPROFILE || '', 'projects', folderName),
-        path.join(process.env.HOME || process.env.USERPROFILE || '', 'dev', folderName),
-        path.join('C:', 'gab', folderName),
-        path.join('C:', 'dev', folderName)
+        path.join(homeDir, folderName),
+        path.join(homeDir, 'projects', folderName),
+        path.join(homeDir, 'dev', folderName),
+        path.join(homeDir, 'workspace', folderName),
+        path.join(homeDir, 'code', folderName)
       ];
       
+      // Add Windows-specific paths if on Windows
+      if (process.platform === 'win32') {
+        const drives = ['C:', 'D:', 'E:'];
+        for (const drive of drives) {
+          possibleRoots.push(
+            path.join(drive, 'dev', folderName),
+            path.join(drive, 'projects', folderName),
+            path.join(drive, 'workspace', folderName)
+          );
+        }
+      }
+      
       for (const root of possibleRoots) {
         try {
           const stat = await fs.stat(root);
           if (stat.isDirectory()) {
             const hasKiro = await fs.access(path.join(root, '.kiro')).then(() => true).catch(() => false);
             const hasPackage = await fs.access(path.join(root, 'package.json')).then(() => true).catch(() => false);
-            if (hasKiro || hasPackage) return root;
+            const hasGit = await fs.access(path.join(root, '.git')).then(() => true).catch(() => false);
+            if (hasKiro || hasPackage || hasGit) return root;
           }
-        } catch (e) {}
+        } catch (e) {
+          // Path doesn't exist, continue
+        }
       }
     }
-  } catch (e) {}
+  } catch (e) {
+    console.error('[getWorkspaceRoot] Error:', e.message);
+  }
   return null;
 }
 
-// Helper: Find file recursively
-async function findFileRecursive(dir, fileName, maxDepth = 4, depth = 0) {
-  if (depth > maxDepth) return null;
+/**
+ * Find file recursively within a directory
+ * @param {string} dir - Directory to search
+ * @param {string} fileName - File name to find
+ * @param {number} maxDepth - Maximum search depth
+ * @param {number} currentDepth - Current depth (internal)
+ * @returns {Promise<string|null>}
+ */
+async function findFileRecursive(dir, fileName, maxDepth = MAX_FILE_SEARCH_DEPTH, currentDepth = 0) {
+  if (currentDepth > maxDepth) return null;
   
   try {
     const entries = await fs.readdir(dir, { withFileTypes: true });
     
+    // Check files first
     for (const entry of entries) {
       if (entry.isFile() && entry.name === fileName) {
         return path.join(dir, entry.name);
       }
     }
     
+    // Then recurse into directories
     for (const entry of entries) {
       if (entry.isDirectory() && 
           (!entry.name.startsWith('.') || entry.name === '.kiro') &&
-          entry.name !== 'node_modules' && entry.name !== 'dist') {
-        const found = await findFileRecursive(path.join(dir, entry.name), fileName, maxDepth, depth + 1);
+          entry.name !== 'node_modules' && 
+          entry.name !== 'dist' &&
+          entry.name !== 'build' &&
+          entry.name !== '.git') {
+        const found = await findFileRecursive(
+          path.join(dir, entry.name), 
+          fileName, 
+          maxDepth, 
+          currentDepth + 1
+        );
         if (found) return found;
       }
     }
-  } catch (e) {}
+  } catch (e) {
+    // Directory not accessible, skip
+  }
   return null;
 }
 
-// Helper: Collect workspace files
+/**
+ * Collect workspace files for file tree
+ * @param {string} workspaceRoot - Workspace root directory
+ * @returns {Promise<Array<{name: string, path: string, language: string}>>}
+ */
 async function collectWorkspaceFiles(workspaceRoot) {
-  const codeExtensions = new Set([
-    '.ts', '.tsx', '.js', '.jsx', '.py', '.java', '.go', '.rs',
-    '.html', '.css', '.scss', '.json', '.yaml', '.yml', '.md',
-    '.sql', '.sh', '.c', '.cpp', '.h', '.cs', '.vue', '.svelte'
-  ]);
-  
-  const extToLang = {
-    '.ts': 'typescript', '.tsx': 'typescript', '.js': 'javascript', '.jsx': 'javascript',
-    '.py': 'python', '.html': 'html', '.css': 'css', '.json': 'json', '.md': 'markdown'
-  };
-  
   const files = [];
   
   async function collect(dir, relativePath = '', depth = 0) {
-    if (depth > 5) return;
+    if (depth > MAX_WORKSPACE_DEPTH) return;
     
     try {
       const entries = await fs.readdir(dir, { withFileTypes: true });
       
       for (const entry of entries) {
+        // Skip hidden files (except .kiro and .github), node_modules, and build directories
         if ((entry.name.startsWith('.') && entry.name !== '.kiro' && entry.name !== '.github') ||
-            entry.name === 'node_modules' || entry.name === 'dist' || entry.name === 'build') {
+            entry.name === 'node_modules' || 
+            entry.name === 'dist' || 
+            entry.name === 'build' ||
+            entry.name === '__pycache__') {
           continue;
         }
         
@@ -341,15 +517,20 @@ async function collectWorkspaceFiles(workspaceRoot) {
         const entryRelative = relativePath ? `${relativePath}/${entry.name}` : entry.name;
         
         if (entry.isFile()) {
-          const ext = path.extname(entry.name).toLowerCase();
-          if (codeExtensions.has(ext)) {
-            files.push({ name: entry.name, path: entryRelative, language: extToLang[ext] || ext.slice(1) });
+          if (isCodeFile(entry.name)) {
+            files.push({ 
+              name: entry.name, 
+              path: entryRelative, 
+              language: getLanguageFromExtension(entry.name) 
+            });
           }
         } else if (entry.isDirectory()) {
           await collect(entryPath, entryRelative, depth + 1);
         }
       }
-    } catch (e) {}
+    } catch (e) {
+      // Directory not accessible, skip
+    }
   }
   
   await collect(workspaceRoot);

package/src/server.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 /**
  * Kiro Mobile Bridge Server
+ * @version 1.0.10
  * 
  * A mobile web interface for monitoring Kiro IDE agent sessions from your phone over LAN.
  * Captures snapshots of the chat interface via CDP and lets you send messages remotely.
@@ -19,6 +20,14 @@ import { captureMetadata, captureCSS, captureSnapshot, captureEditor } from './s
 // Utils
 import { generateId, computeHash } from './utils/hash.js';
 import { getLocalIP } from './utils/network.js';
+import {
+  CDP_PORTS,
+  DISCOVERY_INTERVAL_ACTIVE,
+  DISCOVERY_INTERVAL_STABLE,
+  SNAPSHOT_INTERVAL_ACTIVE,
+  SNAPSHOT_INTERVAL_IDLE,
+  SNAPSHOT_IDLE_THRESHOLD
+} from './utils/constants.js';
 
 // Routes
 import { createApiRouter } from './routes/api.js';
@@ -31,7 +40,6 @@ const __dirname = dirname(__filename);
 // =============================================================================
 
 const PORT = process.env.PORT || 3000;
-const CDP_PORTS = [9000, 9001, 9002, 9003, 9222, 9229];
 
 // =============================================================================
 // State Management
@@ -44,12 +52,12 @@ const pollingState = {
   lastCascadeCount: 0,
   lastMainWindowConnected: false,
   discoveryInterval: null,
-  discoveryIntervalMs: 10000,
+  discoveryIntervalMs: DISCOVERY_INTERVAL_ACTIVE,
   stableCount: 0,
   snapshotInterval: null,
-  snapshotIntervalMs: 1000,
+  snapshotIntervalMs: SNAPSHOT_INTERVAL_ACTIVE,
   lastSnapshotChange: Date.now(),
-  idleThreshold: 10000
+  idleThreshold: SNAPSHOT_IDLE_THRESHOLD
 };
 
 // =============================================================================
@@ -113,7 +121,6 @@ async function discoverTargets() {
         foundCascadeIds.add(cascadeId);
         
         if (!cascades.has(cascadeId)) {
-          console.log(`[Discovery] Found new Kiro Agent: ${target.title} (${cascadeId})`);
           stateChanged = true;
           
           try {
@@ -145,7 +152,10 @@ async function discoverTargets() {
           cascades.get(cascadeId).metadata.windowTitle = target.title || cascades.get(cascadeId).metadata.windowTitle;
         }
       }
-    } catch (err) {}
+    } catch (err) {
+      // Log port scanning errors for debugging
+      console.debug(`[Discovery] Error scanning port ${port}: ${err.message}`);
+    }
   }
   
   // Clean up disconnected targets
@@ -153,7 +163,11 @@ async function discoverTargets() {
     if (!foundCascadeIds.has(cascadeId)) {
       console.log(`[Discovery] Target no longer available: ${cascadeId}`);
       stateChanged = true;
-      try { cascade.cdp.close(); } catch (e) {}
+      try { 
+        cascade.cdp.close(); 
+      } catch (e) {
+        console.debug(`[Discovery] Error closing cascade ${cascadeId}: ${e.message}`);
+      }
       cascades.delete(cascadeId);
       broadcastCascadeList();
     }
@@ -206,8 +220,10 @@ async function pollSnapshots() {
       }
       
       // Capture editor from main window
+      // Store rootContextId locally to avoid race conditions during async operations
       const mainCDP = mainWindowCDP.connection;
-      if (mainCDP?.rootContextId) {
+      const contextId = mainCDP?.rootContextId;
+      if (mainCDP && contextId) {
         const editor = await captureEditor(mainCDP);
         if (editor?.hasContent) {
           const editorHash = computeHash(editor.content + editor.fileName);
@@ -239,14 +255,14 @@ async function pollSnapshots() {
 function adjustDiscoveryInterval(hasChanges) {
   if (hasChanges) {
     pollingState.stableCount = 0;
-    if (pollingState.discoveryIntervalMs !== 10000) {
-      pollingState.discoveryIntervalMs = 10000;
+    if (pollingState.discoveryIntervalMs !== DISCOVERY_INTERVAL_ACTIVE) {
+      pollingState.discoveryIntervalMs = DISCOVERY_INTERVAL_ACTIVE;
       restartDiscoveryInterval();
     }
   } else {
     pollingState.stableCount++;
-    if (pollingState.stableCount >= 3 && pollingState.discoveryIntervalMs !== 30000) {
-      pollingState.discoveryIntervalMs = 30000;
+    if (pollingState.stableCount >= 3 && pollingState.discoveryIntervalMs !== DISCOVERY_INTERVAL_STABLE) {
+      pollingState.discoveryIntervalMs = DISCOVERY_INTERVAL_STABLE;
       restartDiscoveryInterval();
       console.log('[Discovery] Stable state, slowing to 30s interval');
     }
@@ -262,14 +278,14 @@ function adjustSnapshotInterval(hasChanges) {
   const now = Date.now();
   if (hasChanges) {
     pollingState.lastSnapshotChange = now;
-    if (pollingState.snapshotIntervalMs !== 1000) {
-      pollingState.snapshotIntervalMs = 1000;
+    if (pollingState.snapshotIntervalMs !== SNAPSHOT_INTERVAL_ACTIVE) {
+      pollingState.snapshotIntervalMs = SNAPSHOT_INTERVAL_ACTIVE;
       restartSnapshotInterval();
     }
   } else {
     const idleTime = now - pollingState.lastSnapshotChange;
-    if (idleTime > pollingState.idleThreshold && pollingState.snapshotIntervalMs !== 3000) {
-      pollingState.snapshotIntervalMs = 3000;
+    if (idleTime > pollingState.idleThreshold && pollingState.snapshotIntervalMs !== SNAPSHOT_INTERVAL_IDLE) {
+      pollingState.snapshotIntervalMs = SNAPSHOT_INTERVAL_IDLE;
       restartSnapshotInterval();
     }
   }
@@ -314,7 +330,7 @@ function broadcastCascadeList() {
 // =============================================================================
 
 const app = express();
-app.use(express.json());
+app.use(express.json({ limit: '1mb' })); // Limit request body size
 app.use(express.static(join(__dirname, 'public')));
 
 // Mount API routes