mover-os 4.7.8 → 4.7.10

package/src/dashboard/server.js

@@ -15,6 +15,10 @@ const feedParser = require("./lib/feed-parser");
 // a persistent structured multi-turn session (onboarding-engine-SPEC.md §2 / D1).
 const { AgentSessionManager } = require("./lib/agent-session");
 const { RunRegistry } = require("./lib/run-registry");
+// Packet #2 rider (OWNER-DECISIONS.md) — server-held pending Engine-write
+// approvals for dashboard-launched runs. See lib/approval-registry.js header
+// for the full contract and the current wiring status.
+const { ApprovalRegistry } = require("./lib/approval-registry");
 // Onboarding-engine D3/D4/D7 — note ingestion (drag-drop digest), skill
 // recommendation (work → skills), and which agent CLIs are installed/authed.
 const ingestion = require("./lib/ingestion");
@@ -24,6 +28,40 @@ const { forgeBeats } = require("./lib/onboarding-forge");
 const agentDetect = require("./lib/agent-detect");
 // B5 (Rule S21 made mechanical) — atomic + drift-guarded writes to the user's Daily Notes.
 const { writeWithDriftGuard } = require("./lib/safe-write");
+// Library truthful search (sol product review 2026-07-11, Library 5.0): ONE
+// index whose coverage equals the shelves the Library route advertises.
+const { searchLibrary, rootDirFor } = require("./lib/library-search");
+
+// Server-side re-scrub for the /api/report technical attachment (sol Report gap,
+// 2026-07-11): the client already scrubs, but a spoofed/bypassed client could POST
+// raw error strings with filesystem paths. Defense-in-depth: re-apply the SAME
+// logic server-side before forwarding. Ported verbatim from
+// src/dashboard/ui/src/v6app/scrub.js (which ships as UI source, not guaranteed
+// at daemon runtime) — kept in lockstep by test/error-buffer-scrub.test.mjs +
+// test/report-scrub.test.mjs.
+function scrubToken(t) {
+  const low = t.toLowerCase();
+  if (low.includes("data:")) return "[data-url]";
+  if (/(?:https?|file|blob|wss?|ftp):\/\//i.test(t)) return "[url]";
+  if (/%2f|%5c|file%3a/i.test(t)) return "[path]";
+  if (/(?:[a-z]:\\|\\\\)/i.test(t)) return "[path]";
+  if (/\?[^\s]*=/.test(t)) return "[query]";
+  if (t.includes("/")) return "[path]";
+  return t;
+}
+function scrubReportLine(s) {
+  const raw = String(s);
+  if (/[\u0000-\u001f\u007f\u200b-\u200f\u2028\u2029\ufeff]/.test(raw)) {
+    return "[redacted: the error text contained control characters]";
+  }
+  return raw
+    .split(/\s+/)
+    .map(scrubToken)
+    .join(" ")
+    .replace(/(?:\[(?:path|url|data-url|query)\] ?){2,}/g, (m) => m.trim().split(" ")[0] + " ")
+    .trim()
+    .slice(0, 300);
+}
 
 // Per-server CSRF token — issued on /api/health, required on all POST endpoints.
 // Random per-process so dashboard ↔ server pairing is exclusive to this run.
@@ -104,6 +142,10 @@ function isTokenValid(req) {
 // like a new `###` sub-anchor), so the written answer silently vanishes on the
 // next read. `\#` is the canonical markdown escape (renders as a literal '#').
 function sanitizeJournalLine(v, max) {
+  // terra T-DW-10: an object/array answer would String()-coerce to "[object
+  // Object]" (or a comma-joined array) and be persisted as if it were the user's
+  // text. Drop non-primitive values so a malformed field is omitted, not stored.
+  if (v != null && typeof v === "object") return "";
   return String(v == null ? "" : v)
     .replace(/\r/g, "")
     .replace(/\n+/g, " ")
@@ -135,17 +177,19 @@ function mergeJournalSection(existing, ymd, mode, newBlock) {
   // a bare `### Alibi`/`### Prediction` (legacy/alt naming for the evening
   // alibi) is evening ONLY when it isn't a Morning header — so an evening write
   // can never delete a Morning block, and vice-versa.
-  const isThisMode = (headerLine) => {
-    const h = headerLine.toLowerCase();
-    // Codex W3 round 2: ONLY a header that explicitly starts with the mode name
-    // is replaced. A block that merely mentions "alibi"/"prediction" (or any
-    // other user heading) is left untouched — an evening write never deletes a
-    // block it didn't author. The endpoint always writes the alibi as
-    // "### Evening · alibi", so the anchored prefix already covers our own data;
-    // the old loose alibi/prediction fallback was pure data-loss risk.
-    if (mode === "evening") return /^###\s+evening\b/.test(h);
-    return /^###\s+morning\b/.test(h);
-  };
+  // terra T-DW-2: replace ONLY the sub-anchors THIS write actually carries, keyed
+  // by exact header, rather than every block of the mode. A partial same-mode save
+  // (e.g. just the score) now upserts that one field and PRESERVES the sibling
+  // evening fields (win, alibi, ...) instead of silently wiping the whole mode.
+  // Cross-mode preservation still falls out for free — a morning write's headers
+  // never match an evening block — so the Codex W3 mode-isolation guarantee holds.
+  // Preserve-on-omit is the safe default: journaling one field must not delete the
+  // others. (mode is retained in the signature for call-site compatibility.)
+  const newHeaders = new Set(
+    String(newBlock).split("\n").filter((l) => /^###\s+/.test(l)).map((l) => l.trim())
+  );
+  const isThisMode = (headerLine) => newHeaders.has(String(headerLine).trim());
+  void mode;
   const trimTail = (arr) => { const b = arr.slice(); while (b.length && b[b.length - 1].trim() === "") b.pop(); return b; };
   if (!existing) {
     return `# Daily - ${ymd}\n\n## Journal\n\n${newBlock}\n`;
@@ -253,6 +297,37 @@ function atomicWriteJson(filePath, obj) {
 // (UI_LEGACY_DIST_* points at ui/dist — the name is historical.)
 const UI_LEGACY_DIST_DIR = path.join(__dirname, "ui", "dist");
 const UI_LEGACY_DIST_INDEX = path.join(UI_LEGACY_DIST_DIR, "index.html");
+
+// terra T-EX-3/T-EX-4: the set of slash-commands the product actually ships,
+// derived once from src/workflows/*.md (server.js lives in src/dashboard/). Used
+// to reject an unknown /workflow before running an agent, opening a terminal, or
+// persisting a snooze — so a bogus token can't start a wasted agent run or leave
+// an inert record in snoozes.json. Lazy + cached; if the dir can't be read we fall
+// back to shape-only so an unusual layout never hard-fails a legitimate run.
+let _knownWorkflows = null;
+function knownWorkflowNames() {
+  if (_knownWorkflows) return _knownWorkflows;
+  const s = new Set();
+  try {
+    const dir = path.join(__dirname, "..", "workflows");
+    for (const f of fs.readdirSync(dir)) {
+      if (f.endsWith(".md")) s.add("/" + f.slice(0, -3).toLowerCase());
+    }
+  } catch (_) { /* bundle layout unusual — shape-only fallback below */ }
+  _knownWorkflows = s;
+  return s;
+}
+function isKnownWorkflow(w) {
+  // A workflow may carry trailing flags the product ships (e.g. "/ignite --feature",
+  // "/research --deep"). Validate the BASE slash-command against the registry and
+  // allow only flag-shaped suffixes after it — so a flagged command is accepted but
+  // a token with spaces/metachars/injected text is not.
+  const m = String(w).trim().match(/^(\/[a-z0-9][a-z0-9-]{0,40})((?:\s+--?[a-z0-9][a-z0-9-]*)*)\s*$/i);
+  if (!m) return false;
+  const s = knownWorkflowNames();
+  if (s.size === 0) return true; // registry unavailable → base shape already validated
+  return s.has(m[1].toLowerCase());
+}
 function uiDistAvailable() {
   try { return fs.existsSync(UI_LEGACY_DIST_INDEX); } catch (_) { return false; }
 }
@@ -267,7 +342,12 @@ const UI_DIST_DIR = activeUiDist().dir;
 const UI_DIST_INDEX = activeUiDist().index;
 
 const PRIMARY_PORT = 3737;
-const PORT_FALLBACKS = [3737, 3738, 3739, 3740];
+// MOVER_PORT pins the daemon to one port (hermetic tests, or a user running a
+// second vault without colliding with the default 3737-3740 range). Additive:
+// unset behaves exactly as before. A valid 1-65535 value becomes the sole
+// binding target (no fallback scan, so the caller controls isolation).
+const _envPort = parseInt(process.env.MOVER_PORT || "", 10);
+const PORT_FALLBACKS = (_envPort >= 1 && _envPort <= 65535) ? [_envPort] : [3737, 3738, 3739, 3740];
 
 const MIME = {
   ".html": "text/html; charset=utf-8",
@@ -316,8 +396,27 @@ function startServer({ buildFn, vault, version, openBrowser = true } = {}) {
     // from the request that started it; killed on shutdown. See lib/run-registry.js.
     const runRegistry = new RunRegistry();
 
+    // Packet #2 rider — pending Engine-write approvals for dashboard-launched
+    // runs. Killed on shutdown alongside agentSessions/runRegistry.
+    const approvalRegistry = new ApprovalRegistry();
+
     const server = http.createServer(async (req, res) => {
       try {
+        // DNS-rebinding gate (R5-A P0). The browser's origin model is computed
+        // from the URL string, so a hostile page served on our port whose DNS
+        // record flips to 127.0.0.1 becomes "same-origin" and can READ every
+        // un-tokened GET response — including /api/health (the token itself)
+        // and /api/file/read (the vault). Host reflects the literal request
+        // target and survives the trick: only loopback names pass, on EVERY
+        // method. Standard mitigation (webpack-dev-server, Vite, Jupyter).
+        const hostHeader = String(req.headers.host || "");
+        // Trailing dot = FQDN spelling of the same name ("localhost." is
+        // still loopback); strip it so pedantic-but-legit clients pass.
+        const hostName = hostHeader.replace(/:\d+$/, "").replace(/\.$/, "").toLowerCase();
+        if (hostName !== "127.0.0.1" && hostName !== "localhost" && hostName !== "[::1]") {
+          res.writeHead(400, { "Content-Type": "text/plain" });
+          return res.end("Bad Host header");
+        }
         const url = new URL(req.url, `http://${req.headers.host}`);
         const pathname = url.pathname;
 
@@ -345,7 +444,7 @@ function startServer({ buildFn, vault, version, openBrowser = true } = {}) {
           // /api/refresh was previously misclassified as "read-only POST" but
           // it triggers a full vault rebuild — DoS amplification vector if
           // hit cross-origin without token (code-bug-audit C2, 2026-05-24).
-          const tokenedRoutes = ["/api/agent/run", "/api/runs/stop", "/api/workflow/run", "/api/workflow/open-in-terminal", "/api/cli/run", "/api/cli/open-in-terminal", "/api/checkbox/toggle", "/api/snooze", "/api/override", "/api/config", "/api/file/open", "/api/refresh", "/api/event", "/api/view/generate", "/api/view/delete", "/api/capture", "/api/journal", "/api/session/start", "/api/session/send", "/api/session/approve", "/api/session/end", "/api/session/finalize", "/api/session/ingest", "/api/setup/recommend", "/api/setup/shortcut"];
+          const tokenedRoutes = ["/api/agent/run", "/api/runs/stop", "/api/workflow/run", "/api/workflow/open-in-terminal", "/api/cli/run", "/api/cli/open-in-terminal", "/api/checkbox/toggle", "/api/snooze", "/api/override", "/api/config", "/api/file/open", "/api/refresh", "/api/event", "/api/view/generate", "/api/view/delete", "/api/capture", "/api/journal", "/api/session/start", "/api/session/send", "/api/session/approve", "/api/session/end", "/api/session/finalize", "/api/session/ingest", "/api/setup/recommend", "/api/setup/shortcut", "/api/report", "/api/approval/request", "/api/approval/respond"];
           if (tokenedRoutes.includes(pathname) && !isTokenValid(req)) {
             return jsonResponse(res, 401, { ok: false, error: "Missing or invalid X-Mover-Token header" });
           }
@@ -407,6 +506,33 @@ function startServer({ buildFn, vault, version, openBrowser = true } = {}) {
           return jsonResponse(res, 200, { available: false });
         }
 
+        // Library truthful search (sol review 2026-07-11): one index whose
+        // coverage equals the advertised shelves. Content search across the
+        // vault shelves + skills + bundle workflows/hooks, with an honest
+        // coverage report (CLI commands are usage counts, not files). Bounded
+        // response (result/passage caps in lib/library-search.js); local-only
+        // read like /api/file/read — Host-gated, nothing leaves this machine.
+        if (pathname === "/api/library/search" && req.method === "GET") {
+          try {
+            const os = require("os");
+            const out = searchLibrary(
+              {
+                vault,
+                bundleRoot: path.resolve(__dirname, "..", ".."),
+                claudeDir: path.join(os.homedir(), ".claude"),
+              },
+              {
+                q: url.searchParams.get("q") || "",
+                shelf: url.searchParams.get("shelf") || "",
+                limit: url.searchParams.get("limit") || undefined,
+              }
+            );
+            return jsonResponse(res, 200, { ok: true, ...out });
+          } catch (_e) {
+            return jsonResponse(res, 500, { ok: false, error: "search failed" });
+          }
+        }
+
         // F37 — OG Image generator. Renders a server-side SVG receipt
         // suitable for og:image meta tags on shared moveros.dev pages.
         // Twitter/X, Discord, and Slack render SVG og:images directly.
@@ -469,10 +595,37 @@ function startServer({ buildFn, vault, version, openBrowser = true } = {}) {
           if (req.method === "POST") {
             try {
               const patch = await readJsonBody(req, 16 * 1024);
+              // terra T-DW-5: a non-object patch (null / array / scalar) must not
+              // reach the shallow merge. {...existing, ...null} is a harmless no-op,
+              // but {studio:null} would null out a whole nested prefs block. Require
+              // a plain-object patch, and reject a non-object value for the known
+              // nested objects so a settings write can never DELETE a prefs block.
+              const isPlainObject = (v) => v != null && typeof v === "object" && !Array.isArray(v);
+              if (!isPlainObject(patch)) {
+                return jsonResponse(res, 400, { ok: false, error: "config patch must be a JSON object" });
+              }
+              for (const k of ["studio", "providerPrefs"]) {
+                if (k in patch && !isPlainObject(patch[k])) {
+                  return jsonResponse(res, 400, { ok: false, error: `${k} must be an object` });
+                }
+              }
               // Serialize concurrent config writes (audit pass 2 #4).
               const merged = await withFileLock(configPath, () => {
                 let existing = {};
-                try { existing = JSON.parse(fs.readFileSync(configPath, "utf8")); } catch (_) {}
+                // terra T-DW-6: a parse failure of an EXISTING config.json must NOT
+                // be swallowed to {} — the next merge would then overwrite the
+                // malformed file and lose vaultPath + integration tokens. Only a
+                // truly-absent file is empty; a present-but-unparseable (or wrong-
+                // shape) file aborts the write so the user can repair it by hand.
+                try {
+                  existing = JSON.parse(fs.readFileSync(configPath, "utf8"));
+                } catch (e) {
+                  if (e.code === "ENOENT") existing = {};
+                  else throw Object.assign(new Error("config.json is unreadable or malformed; refusing to overwrite it"), { code: "ECONFIGCORRUPT" });
+                }
+                if (!isPlainObject(existing)) {
+                  throw Object.assign(new Error("config.json is not a JSON object; refusing to overwrite it"), { code: "ECONFIGCORRUPT" });
+                }
                 // Shallow merge — keys present in patch override, others kept.
                 // Allow nested `studio.<key>` merges via top-level studio object.
                 const out = { ...existing, ...patch };
@@ -500,6 +653,9 @@ function startServer({ buildFn, vault, version, openBrowser = true } = {}) {
               return jsonResponse(res, 500, { ok: false, error: e.message });
             }
           }
+          // Any other verb: refuse here — falling through served the SPA's
+          // index.html with a 200 for a PUT /api/config (R5-A P2).
+          return jsonResponse(res, 405, { ok: false, error: "Method not allowed" });
         }
 
         if (pathname === "/api/refresh") {
@@ -526,6 +682,63 @@ function startServer({ buildFn, vault, version, openBrowser = true } = {}) {
           return runAgentStream({ req, res, body, vault, runRegistry });
         }
 
+        // ── /api/report — the dashboard's report button ─────────────────────
+        // Same delivery channel as the /mover-report workflow: the developer's
+        // feedbackWebhook from ~/.mover/config.json. Server-side forward (the
+        // browser can't POST cross-origin), payload is the user's words plus
+        // machine facts (version/platform/agents) — never vault content.
+        if (pathname === "/api/report" && req.method === "POST") {
+          const body = await readJsonBody(req, 32 * 1024);
+          const desc = String((body && body.description) || "").trim().slice(0, 8000);
+          if (!desc) return jsonResponse(res, 400, { ok: false, error: "Say what happened first." });
+          const os = require("os");
+          let cfg = {};
+          try { cfg = JSON.parse(fs.readFileSync(path.join(os.homedir(), ".mover", "config.json"), "utf8")); } catch {}
+          const webhook = cfg.feedbackWebhook || "https://moveros.dev/api/feedback";
+          // Optional scrubbed client-error attachment (bug reports only, and
+          // only when the user left the attach box ticked). The client already
+          // redacts filesystem paths; cap hard here anyway. Strings only.
+          const errs = Array.isArray(body && body.errors)
+            ? body.errors.slice(0, 5).map((e) => scrubReportLine(String(e).slice(0, 400))).filter(Boolean)
+            : [];
+          // Guided precision (owner ask 2026-07-12): the card sends WHICH
+          // SCREEN the report points at, allowlist-validated here (never free
+          // text into the issue title) and folded into summary + description
+          // so the deployed feedback endpoint needs no schema change.
+          const REPORT_WHERE = { home: "Home", chat: "Chat", strategy: "Strategy", evidence: "Evidence", library: "Library", run: "Run", configure: "Settings", app: "" };
+          // A string, not a coercion (terra: ["home"] stringifies to "home"
+          // and would pass) — non-strings fall through to no label.
+          const whereLabel = body && typeof body.where === "string" && Object.prototype.hasOwnProperty.call(REPORT_WHERE, body.where) ? REPORT_WHERE[body.where] : "";
+          const REPORT_SEVERITIES = ["Blocking", "Annoying", "Cosmetic"];
+          const payload = {
+            type: ["bug", "feature", "comment"].includes(body && body.type) ? body.type : "comment",
+            severity: REPORT_SEVERITIES.includes(body && body.severity) ? body.severity : "Minor",
+            summary: ((whereLabel ? whereLabel + ": " : "") + desc.split("\n")[0]).slice(0, 140),
+            description: (whereLabel ? "Where: the " + whereLabel + " screen\n\n" : "")
+              + desc + (errs.length ? "\n\n-- attached technical details (scrubbed, no file contents) --\n" + errs.join("\n") : ""),
+            version: version || "unknown",
+            platform: process.platform,
+            agent: Array.isArray(cfg.agents) ? cfg.agents.join(", ") : "unknown",
+            date: new Date().toISOString().slice(0, 10),
+            source: "dashboard",
+          };
+          try {
+            const ctl = new AbortController();
+            const timer = setTimeout(() => ctl.abort(), 8000);
+            const r = await fetch(webhook, {
+              method: "POST",
+              headers: { "Content-Type": "application/json" },
+              body: JSON.stringify(payload),
+              signal: ctl.signal,
+            });
+            clearTimeout(timer);
+            if (r.ok) return jsonResponse(res, 200, { ok: true, delivered: true });
+            return jsonResponse(res, 200, { ok: true, delivered: false, error: "The developer's server answered " + r.status + "." });
+          } catch (e) {
+            return jsonResponse(res, 200, { ok: true, delivered: false, error: "Couldn't reach the developer's server." });
+          }
+        }
+
         // ── Run-tab persistence: the runs the registry is holding ────────────
         // GET  /api/runs            → list run summaries (rehydrate after refresh)
         // GET  /api/runs/get?id=    → one run incl. full output (expand a card)
@@ -553,9 +766,21 @@ function startServer({ buildFn, vault, version, openBrowser = true } = {}) {
             "Cache-Control": "no-cache",
             "X-Accel-Buffering": "no",
           });
-          const unsub = runRegistry.subscribe(id, (ev) => {
-            if (ev.type === "replay" || ev.type === "chunk") { try { res.write(ev.text); } catch (_) {} }
-            else if (ev.type === "end") { try { res.end(); } catch (_) {} }
+          let unsub = () => {};
+          unsub = runRegistry.subscribe(id, (ev) => {
+            if (ev.type === "replay" || ev.type === "chunk") {
+              try {
+                const ok = res.write(ev.text);
+                // Backpressure guard (terra run-path F3): a slow/stalled reader
+                // must not let the socket write buffer grow without bound. Once it
+                // exceeds the cap, drop THIS client — the run keeps going for
+                // everyone else.
+                if (!ok && res.writableLength > 8 * 1024 * 1024) {
+                  try { unsub(); } catch (_) {}
+                  try { res.destroy(); } catch (_) {}
+                }
+              } catch (_) {}
+            } else if (ev.type === "end") { try { res.end(); } catch (_) {} }
           });
           req.on("close", () => { try { unsub(); } catch (_) {} });
           return; // hold the stream open
@@ -566,6 +791,48 @@ function startServer({ buildFn, vault, version, openBrowser = true } = {}) {
           return jsonResponse(res, 200, { ok });
         }
 
+        // ── Packet #2 rider — dashboard-owned Engine-write approval ──────────
+        // (OWNER-DECISIONS.md Packet #2 rider; dev/plan.md T-PACKET2-RIDER-1.)
+        // request  [tokened, hook adapter]     -> create a pending approval
+        // wait     [tokened, hook adapter poll] -> current status by id
+        // pending  [GET, dashboard UI]          -> list of live pending ones
+        // respond  [tokened, dashboard UI]      -> approve/deny by id
+        if (pathname === "/api/approval/request" && req.method === "POST") {
+          const body = await readJsonBody(req, 8 * 1024);
+          try {
+            const rec = approvalRegistry.request({
+              agent: body.agent,
+              file: body.file,
+              tool: body.tool,
+              excerpt: body.excerpt,
+            });
+            return jsonResponse(res, 200, { ok: true, id: rec.id, expiresAt: rec.expiresAt });
+          } catch (e) {
+            return jsonResponse(res, 400, { ok: false, error: e.message });
+          }
+        }
+        // GET is not covered by the POST-only tokenedRoutes gate above, so this
+        // route checks the token inline (same isTokenValid used everywhere else).
+        if (pathname === "/api/approval/wait" && req.method === "GET") {
+          if (!isTokenValid(req)) {
+            return jsonResponse(res, 401, { ok: false, error: "Missing or invalid X-Mover-Token header" });
+          }
+          const rec = approvalRegistry.get(url.searchParams.get("id") || "");
+          if (!rec) return jsonResponse(res, 404, { ok: false, error: "no such approval" });
+          return jsonResponse(res, 200, { ok: true, status: rec.status, expiresAt: rec.expiresAt });
+        }
+        // Un-tokened read, same class as /api/runs: loopback + Host-header gate
+        // is the trust boundary, matching every other GET listing in this file.
+        if (pathname === "/api/approval/pending" && req.method === "GET") {
+          return jsonResponse(res, 200, { ok: true, pending: approvalRegistry.listPending() });
+        }
+        if (pathname === "/api/approval/respond" && req.method === "POST") {
+          const body = await readJsonBody(req, 4 * 1024);
+          const result = approvalRegistry.respond(body.id, body.approve === true);
+          if (!result.ok) return jsonResponse(res, result.code || 400, { ok: false, error: result.error });
+          return jsonResponse(res, 200, { ok: true, status: result.status });
+        }
+
         // System version + free/major update signal for the dashboard prompt.
         if (pathname === "/api/version" && req.method === "GET") {
           return jsonResponse(res, 200, { ok: true, ...versionInfo(version) });
@@ -704,8 +971,14 @@ function startServer({ buildFn, vault, version, openBrowser = true } = {}) {
             "X-Accel-Buffering": "no",
           });
           res.write(": connected\n\n");
-          const unsub = agentSessions.subscribe(sid, (ev) => {
-            try { res.write(`data: ${JSON.stringify(ev)}\n\n`); } catch (_) {}
+          // sol batch #1: honor socket backpressure here too (the runs stream
+          // already does) — a stalled SSE reader must not queue unboundedly.
+          let unsub = () => {};
+          unsub = agentSessions.subscribe(sid, (ev) => {
+            try {
+              const ok = res.write(`data: ${JSON.stringify(ev)}\n\n`);
+              if (!ok && res.writableLength > 8 * 1024 * 1024) { try { unsub(); } catch (_) {} try { res.destroy(); } catch (_) {} }
+            } catch (_) {}
           });
           const ping = setInterval(() => { try { res.write(": ping\n\n"); } catch (_) {} }, 25000);
           if (ping.unref) ping.unref();
@@ -807,8 +1080,10 @@ function startServer({ buildFn, vault, version, openBrowser = true } = {}) {
           const body = await readJsonBody(req, 16 * 1024);
           const workflow = String(body.workflow || "").trim();
           const agent = String(body.agent || "claude-code").trim();
-          if (!workflow.startsWith("/")) {
-            return jsonResponse(res, 400, { ok: false, error: "workflow must start with /" });
+          // terra T-EX-3: require an actual shipped workflow, not any slash token —
+          // an unknown /foo would start a real agent run with a junk prompt.
+          if (!isKnownWorkflow(workflow)) {
+            return jsonResponse(res, 400, { ok: false, error: "unknown workflow" });
           }
           // V5.0 activation event — fires for the streaming workflow runner
           // path too. Pairs with the open-in-terminal logger below so
@@ -834,6 +1109,10 @@ function startServer({ buildFn, vault, version, openBrowser = true } = {}) {
           if (!/^\/[a-z0-9][a-z0-9-]{0,40}$/i.test(workflow)) {
             return jsonResponse(res, 400, { ok: false, error: "workflow must match /[a-z0-9-]+" });
           }
+          // terra T-EX-3: shape is not enough — require an actual shipped workflow.
+          if (!isKnownWorkflow(workflow)) {
+            return jsonResponse(res, 400, { ok: false, error: "unknown workflow" });
+          }
           // Map agent id → interactive CLI command. Only registered agents
           // are allowed — no raw shell. Validates against the same registry
           // that runAgentStream uses (agentCommand).
@@ -875,6 +1154,27 @@ function startServer({ buildFn, vault, version, openBrowser = true } = {}) {
           if (!/^[a-zA-Z][a-zA-Z0-9_-]*$/.test(cmd)) {
             return jsonResponse(res, 400, { ok: false, error: "invalid cmd (alphanumeric + dash/underscore only)" });
           }
+          // terra T-EX-1: a shape-valid but UNKNOWN cmd is not rejected — parseArgs
+          // leaves opts.command unset and main() falls through to the bare-invocation
+          // default (open the dashboard on a configured machine, or ENTER THE INSTALL
+          // path on a fresh one), running something the caller never asked for.
+          // Require exact registry membership, exactly as /api/cli/open-in-terminal.
+          if (!getCliIndex().cli.some((c) => c.cmd === cmd)) {
+            return jsonResponse(res, 400, { ok: false, error: `Unknown cmd: ${cmd}` });
+          }
+          // terra T-EX-2: args must not be able to RE-SELECT the command. parseArgs
+          // maps --update/-u to the (destructive, comprehensive) update command
+          // regardless of the cmd already chosen, and --_self-updated is internal-
+          // only. Reject those, and constrain the rest to safe chars (mirrors the
+          // open-in-terminal ARG_RE — the child is argv-spawned so this is defense
+          // in depth, not the only guard).
+          const RUN_ARG_RE = /^[a-zA-Z0-9._=/-]{0,80}$/;
+          const RUN_BANNED_ARGS = new Set(["--update", "-u", "--_self-updated"]);
+          for (const a of args) {
+            if (RUN_BANNED_ARGS.has(a) || !RUN_ARG_RE.test(a)) {
+              return jsonResponse(res, 400, { ok: false, error: `Invalid arg: ${a}` });
+            }
+          }
           return runMoverosStream({ req, res, cmd, args, vault });
         }
 
@@ -925,6 +1225,10 @@ function startServer({ buildFn, vault, version, openBrowser = true } = {}) {
                 const full = path.join(dir, ent.name);
                 if (ent.isDirectory()) { if (depth < 2) walk(full, depth + 1); }
                 else if (ent.isFile() && ent.name.endsWith(".md")) {
+                  // Templates are scaffolding, not the user's record — listing
+                  // "Strategy_template" under "your Engine files" leaks internals
+                  // into the bell on day one. Same convention as the hook guard.
+                  if (/template\.md$/i.test(ent.name)) continue;
                   try { const st = fs.statSync(full); found.push({ p: path.relative(vault, full), n: ent.name, m: st.mtimeMs, s: st.size }); } catch (_) {}
                 }
               }
@@ -940,13 +1244,35 @@ function startServer({ buildFn, vault, version, openBrowser = true } = {}) {
 
         // Read a vault-scoped file's contents (for the in-app MD viewer drawer).
         // Query: ?path=<absolute path under vault>
+        //        &root=vault|skills|workflows|hooks (default vault) — the
+        //        Library's truthful search returns results from the skills dir
+        //        and the bundle's workflows/hooks; each root gets the SAME
+        //        realpath containment the vault does (resolveVaultScoped is
+        //        generic over its root argument). Relative paths resolve
+        //        against the chosen root, never the process cwd.
         // Returns { ok, content, mtime, size } — capped at 256KB.
         if (pathname === "/api/file/read" && req.method === "GET") {
-          const filePath = url.searchParams.get("path") || "";
+          let filePath = url.searchParams.get("path") || "";
+          const rootParam = url.searchParams.get("root") || "vault";
+          const os = require("os");
+          const rootDir = rootDirFor(
+            {
+              vault,
+              bundleRoot: path.resolve(__dirname, "..", ".."),
+              claudeDir: path.join(os.homedir(), ".claude"),
+            },
+            rootParam
+          );
+          if (!rootDir) {
+            return jsonResponse(res, 400, { ok: false, error: "unknown root" });
+          }
+          if (filePath && !path.isAbsolute(filePath)) {
+            filePath = path.join(rootDir, filePath);
+          }
           let scoped;
           try {
             // Realpath-resolved, refuses symlink escapes (audit pass 2 #3).
-            scoped = resolveVaultScoped(vault, filePath, { mustExist: true });
+            scoped = resolveVaultScoped(rootDir, filePath, { mustExist: true });
           } catch (e) {
             const code = e.code === "EESCAPE" ? 400 : e.code === "ENOENT" ? 404 : 400;
             // T242 bug hunt fix (B#2): success path returned only relPath
@@ -989,8 +1315,15 @@ function startServer({ buildFn, vault, version, openBrowser = true } = {}) {
             // Realpath-resolved, refuses symlink escapes (audit pass 2 #3).
             scoped = resolveVaultScoped(vault, filePath, { mustExist: true });
           } catch (e) {
+            // Generic messages: raw e.message from resolveVaultScoped's
+            // realpath ENOENT carries the resolved ABSOLUTE path, leaking the
+            // filesystem layout. /api/file/read was already hardened for this
+            // exact class; /api/file/open and the checkbox toggle had been
+            // missed.
             const code = e.code === "EESCAPE" ? 400 : e.code === "ENOENT" ? 404 : 400;
-            return jsonResponse(res, code, { ok: false, error: e.message });
+            const msg = e.code === "EESCAPE" ? "path escapes vault" :
+                        e.code === "ENOENT" ? "file not found" : "invalid path";
+            return jsonResponse(res, code, { ok: false, error: msg });
           }
           const targetAbs = scoped.absPath;
           try {
@@ -1034,8 +1367,12 @@ function startServer({ buildFn, vault, version, openBrowser = true } = {}) {
           try {
             scoped = resolveVaultScoped(vault, filePath, { mustExist: true });
           } catch (e) {
+            // Generic messages (same class as /api/file/open above): raw
+            // e.message leaks the resolved absolute path.
             const code = e.code === "EESCAPE" ? 400 : e.code === "ENOENT" ? 404 : 400;
-            return jsonResponse(res, code, { ok: false, error: e.message });
+            const msg = e.code === "EESCAPE" ? "path escapes vault" :
+                        e.code === "ENOENT" ? "file not found" : "invalid path";
+            return jsonResponse(res, code, { ok: false, error: msg });
           }
           const targetAbs = scoped.absPath;
           try {
@@ -1080,6 +1417,11 @@ function startServer({ buildFn, vault, version, openBrowser = true } = {}) {
         // but inline — no workflow shell-out, no terminal.
         if (pathname === "/api/capture" && req.method === "POST") {
           const body = await readJsonBody(req, 8 * 1024);
+          // terra T-DW-10: reject a non-string text so an object body can't be
+          // coerced to "[object Object]" and appended to the Daily Note.
+          if (body.text != null && typeof body.text !== "string") {
+            return jsonResponse(res, 400, { ok: false, error: "text must be a string" });
+          }
           const text = String(body.text || "").trim();
           // tag is optional — accept "work" or "#work", strip the hash.
           // Multi-tag input arrives as comma- or space-separated; normalise
@@ -1284,8 +1626,11 @@ function startServer({ buildFn, vault, version, openBrowser = true } = {}) {
           const workflow = String(body.workflow || "").trim();
           const hours = Number.isFinite(body.hours) ? Math.max(1, Math.min(168, body.hours)) : 24;
           const reason = String(body.reason || "").slice(0, 200);
-          if (!workflow.startsWith("/")) {
-            return jsonResponse(res, 400, { ok: false, error: "workflow must start with /" });
+          // terra T-EX-4: only snooze a real shipped workflow — an unknown token
+          // would persist an inert record in snoozes.json that can never match a
+          // suggestion.
+          if (!isKnownWorkflow(workflow)) {
+            return jsonResponse(res, 400, { ok: false, error: "unknown workflow" });
           }
           try {
             const os = require("os");
@@ -1391,7 +1736,20 @@ function startServer({ buildFn, vault, version, openBrowser = true } = {}) {
             // (e.g. user clicking twice while server slow) lose one entry.
             const entry = await withFileLock(manifestPath, () => {
               let manifest = {};
-              try { manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8")); } catch (_) {}
+              // terra T-DW-6: pattern-manifest.json holds the whole friction cache
+              // (single_test, sacrifice, recent_wins, override_history). Swallowing
+              // a parse failure to {} would let ONE override click overwrite the
+              // malformed file and wipe all of it. Only a missing file is empty; a
+              // present-but-unparseable/wrong-shape file aborts (preserved to repair).
+              try {
+                manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+              } catch (e) {
+                if (e.code === "ENOENT") manifest = {};
+                else throw Object.assign(new Error("pattern-manifest.json is unreadable or malformed; refusing to overwrite it"), { code: "EMANIFESTCORRUPT" });
+              }
+              if (manifest == null || typeof manifest !== "object" || Array.isArray(manifest)) {
+                throw Object.assign(new Error("pattern-manifest.json is not a JSON object; refusing to overwrite it"), { code: "EMANIFESTCORRUPT" });
+              }
               if (!Array.isArray(manifest.override_history)) manifest.override_history = [];
               const ent = {
                 id: `ov-${Date.now()}`,
@@ -1487,6 +1845,12 @@ function startServer({ buildFn, vault, version, openBrowser = true } = {}) {
         });
         fs.createReadStream(filePath).pipe(res);
       } catch (e) {
+        // A client sending unparseable JSON is a request problem, not a
+        // server fault — answer 400, keep the generic 500 for real faults.
+        if (e && e.message === "Invalid JSON body") {
+          res.writeHead(400, { "Content-Type": "application/json; charset=utf-8" });
+          return res.end(JSON.stringify({ ok: false, error: "Invalid JSON body" }));
+        }
         res.writeHead(500, { "Content-Type": "text/plain" });
         res.end(`Server error: ${e.message}`);
       }
@@ -1683,7 +2047,8 @@ function startServer({ buildFn, vault, version, openBrowser = true } = {}) {
           // below (Codex MF1: exit fired at 2s but SIGKILL escalation at 3s, so
           // a stubborn child could survive). shutdownAll resolves on child close.
           try { await agentSessions.shutdownAll(); } catch (_) { /* best-effort */ }
-          try { runRegistry.shutdownAll(); } catch (_) { /* best-effort */ }
+          try { await runRegistry.shutdownAll(); } catch (_) { /* best-effort */ }
+          try { approvalRegistry.stop(); } catch (_) { /* best-effort */ }
           clearRunningMarker();
           // Clear the token file so stale scripts don't try to POST against
           // a dead server.
@@ -1875,17 +2240,23 @@ function runAgentStream({ req, res, body, vault, runRegistry }) {
   const ap = command.applied || {};
   const tune = [ap.model ? `model=${ap.model}` : "", ap.effort ? `effort=${ap.effort}` : "", ap.approvalMode && ap.approvalMode !== "yolo" ? `approval=${ap.approvalMode}` : ""].filter(Boolean).join(" ");
   const preamble = `[mover-studio] agent=${agent}${tune ? " " + tune : ""}\n[mover-studio] cwd=<bundle-root>\n\n`;
-  const run = runRegistry.start({
-    agent,
-    label: (workflow || prompt || "task").slice(0, 200),
-    cmd: command.cmd,
-    args: command.args(finalPrompt),
-    stdin: command.stdin,
-    finalPrompt,
-    cwd: vault || repoRoot,
-    env: { ...process.env, MOVER_STUDIO_RUN: "1" },
-    preamble,
-  });
+  let run;
+  try {
+    run = runRegistry.start({
+      agent,
+      label: (workflow || prompt || "task").slice(0, 200),
+      cmd: command.cmd,
+      args: command.args(finalPrompt),
+      stdin: command.stdin,
+      finalPrompt,
+      cwd: vault || repoRoot,
+      env: { ...process.env, MOVER_STUDIO_RUN: "1" },
+      preamble,
+    });
+  } catch (e) {
+    if (e && e.code === "RUN_LIMIT") return jsonResponse(res, 429, { ok: false, error: e.message });
+    throw e;
+  }
 
   res.writeHead(200, {
     "Content-Type": "text/plain; charset=utf-8",
@@ -1897,9 +2268,16 @@ function runAgentStream({ req, res, body, vault, runRegistry }) {
   // Stream this run to the response by subscribing (replay buffer + live). On
   // client disconnect we ONLY unsubscribe — the run is not killed (an explicit
   // stop is POST /api/runs/stop). Same handler shape as /api/runs/stream.
-  const unsub = runRegistry.subscribe(run.id, (ev) => {
-    if (ev.type === "replay" || ev.type === "chunk") { try { res.write(ev.text); } catch (_) {} }
-    else if (ev.type === "end") { try { res.end(); } catch (_) {} }
+  // sol batch #1: same backpressure guard as /api/runs/stream — drop a stalled
+  // reader whose socket buffer exceeds the cap rather than queue without bound.
+  let unsub = () => {};
+  unsub = runRegistry.subscribe(run.id, (ev) => {
+    if (ev.type === "replay" || ev.type === "chunk") {
+      try {
+        const ok = res.write(ev.text);
+        if (!ok && res.writableLength > 8 * 1024 * 1024) { try { unsub(); } catch (_) {} try { res.destroy(); } catch (_) {} }
+      } catch (_) {}
+    } else if (ev.type === "end") { try { res.end(); } catch (_) {} }
   });
   req.on("close", () => { try { unsub(); } catch (_) {} });
 }
@@ -2021,4 +2399,4 @@ function renderOgSvg(state, opts = {}) {
 </svg>`;
 }
 
-module.exports = { startServer, mergeJournalSection, sanitizeJournalLine, writeNoteAtomic };
+module.exports = { startServer, mergeJournalSection, sanitizeJournalLine, writeNoteAtomic, isKnownWorkflow };