mulmoclaude 0.6.0 → 0.6.2

package/server/api/routes/config.ts

@@ -2,12 +2,15 @@ import { Router, type Request, type Response } from "express";
 import {
   fromMcpEntries,
   isAppSettings,
+  isAppSettingsPatch,
   loadMcpConfig,
   loadSettings,
+  normaliseAppSettingsPatch,
   saveMcpConfig,
   saveSettings,
   toMcpEntries,
   type AppSettings,
+  type AppSettingsPatch,
   type McpConfigFile,
   type McpServerEntry,
 } from "../../system/config.js";
@@ -16,6 +19,7 @@ import { errorMessage } from "../../utils/errors.js";
 import { isRecord } from "../../utils/types.js";
 import { API_ROUTES } from "../../../src/config/apiRoutes.js";
 import { log } from "../../system/logger/index.js";
+import { asyncHandler } from "../../utils/asyncHandler.js";
 import { loadCustomDirs, saveCustomDirs, ensureCustomDirs, validateCustomDirs, type CustomDirEntry } from "../../workspace/custom-dirs.js";
 import { loadReferenceDirs, saveReferenceDirs, validateReferenceDirs, type ReferenceDirEntry } from "../../workspace/reference-dirs.js";
 
@@ -66,16 +70,18 @@ function parseMcpPayloadOrFail(res: ConfigRes, servers: McpServerEntry[]): McpCo
   }
 }
 
-// Run a filesystem save. On failure, respond 500 with the error's
-// message and return false so the caller can early-return. Returns
-// true on success.
+// Run a filesystem save. On failure, log the raw error server-side
+// (full triage detail kept in logs), respond 500 with the safe
+// `fallback` message, and return false so the caller can early-return.
+// Returns true on success. The raw `err.message` deliberately doesn't
+// reach the client — same threat model as `asyncHandler`.
 function runSaveOrFail(res: ConfigRes, save: () => void, fallback: string): boolean {
   try {
     save();
     return true;
   } catch (err) {
     log.error("config", `save failed: ${fallback}`, { error: errorMessage(err) });
-    serverError(res, errorMessage(err, fallback));
+    serverError(res, fallback);
     return false;
   }
 }
@@ -133,15 +139,30 @@ router.put(API_ROUTES.config.base, (req: Request<unknown, unknown, PutConfigBody
   res.json(buildFullResponse());
 });
 
-router.put(API_ROUTES.config.settings, (req: Request<unknown, unknown, AppSettings>, res: ConfigRes) => {
+router.put(API_ROUTES.config.settings, (req: Request<unknown, unknown, AppSettingsPatch>, res: ConfigRes) => {
   const { body } = req;
   log.info("config", "PUT settings: start");
-  if (!isAppSettings(body)) {
+  if (!isAppSettingsPatch(body)) {
     log.warn("config", "PUT settings: invalid payload");
     badRequest(res, "Invalid AppSettings payload");
     return;
   }
-  if (!runSaveOrFail(res, () => saveSettings(body), "saveSettings failed")) {
+  // Merge the PUT body (a partial patch — fields the caller doesn't
+  // own can be omitted) onto the existing on-disk settings so a tab
+  // that knows about only some fields (e.g. Tools tab sends only
+  // `extraAllowedTools`, Map tab sends only `googleMapsApiKey`)
+  // doesn't wipe fields owned by other tabs.
+  //
+  // `null` in the patch is a sentinel for "clear this field":
+  // normaliseAppSettingsPatch drops the entry from the patch, AND we
+  // must also delete it from the merged result so the existing
+  // value doesn't leak through the spread.
+  const existing = loadSettings();
+  const merged: AppSettings = { ...existing, ...normaliseAppSettingsPatch(body) };
+  if (body.effortLevel === null) {
+    delete merged.effortLevel;
+  }
+  if (!runSaveOrFail(res, () => saveSettings(merged), "saveSettings failed")) {
     return;
   }
   log.info("config", "PUT settings: ok");
@@ -175,30 +196,29 @@ router.get(API_ROUTES.config.workspaceDirs, (_req: Request, res: Response<{ dirs
 
 router.put(
   API_ROUTES.config.workspaceDirs,
-  (req: Request<unknown, unknown, { dirs: unknown }>, res: Response<{ dirs: CustomDirEntry[] } | ConfigErrorResponse>) => {
-    const { body } = req;
-    log.info("config", "PUT workspace-dirs: start");
-    if (!isRecord(body) || !("dirs" in body)) {
-      log.warn("config", "PUT workspace-dirs: invalid envelope");
-      badRequest(res, "expected { dirs: [...] }");
-      return;
-    }
-    const result = validateCustomDirs(body.dirs);
-    if ("error" in result) {
-      log.warn("config", "PUT workspace-dirs: validation failed", { error: result.error });
-      badRequest(res, result.error);
-      return;
-    }
-    try {
+  asyncHandler<Request<unknown, unknown, { dirs: unknown }>, Response<{ dirs: CustomDirEntry[] } | ConfigErrorResponse>>(
+    "config",
+    "save failed",
+    async (req, res) => {
+      const { body } = req;
+      log.info("config", "PUT workspace-dirs: start");
+      if (!isRecord(body) || !("dirs" in body)) {
+        log.warn("config", "PUT workspace-dirs: invalid envelope");
+        badRequest(res, "expected { dirs: [...] }");
+        return;
+      }
+      const result = validateCustomDirs(body.dirs);
+      if ("error" in result) {
+        log.warn("config", "PUT workspace-dirs: validation failed", { error: result.error });
+        badRequest(res, result.error);
+        return;
+      }
       saveCustomDirs(result.entries);
       ensureCustomDirs(result.entries);
       log.info("config", "PUT workspace-dirs: ok", { dirs: result.entries.length });
       res.json({ dirs: result.entries });
-    } catch (err) {
-      log.error("config", "PUT workspace-dirs: threw", { error: errorMessage(err) });
-      serverError(res, errorMessage(err, "save failed"));
-    }
-  },
+    },
+  ),
 );
 
 // ── Reference directories (#455) ────────────────────────────────
@@ -209,29 +229,28 @@ router.get(API_ROUTES.config.referenceDirs, (_req: Request, res: Response<{ dirs
 
 router.put(
   API_ROUTES.config.referenceDirs,
-  (req: Request<unknown, unknown, { dirs: unknown }>, res: Response<{ dirs: ReferenceDirEntry[] } | ConfigErrorResponse>) => {
-    const { body } = req;
-    log.info("config", "PUT reference-dirs: start");
-    if (!isRecord(body) || !("dirs" in body)) {
-      log.warn("config", "PUT reference-dirs: invalid envelope");
-      badRequest(res, "expected { dirs: [...] }");
-      return;
-    }
-    const result = validateReferenceDirs(body.dirs);
-    if ("error" in result) {
-      log.warn("config", "PUT reference-dirs: validation failed", { error: result.error });
-      badRequest(res, result.error);
-      return;
-    }
-    try {
+  asyncHandler<Request<unknown, unknown, { dirs: unknown }>, Response<{ dirs: ReferenceDirEntry[] } | ConfigErrorResponse>>(
+    "config",
+    "save failed",
+    async (req, res) => {
+      const { body } = req;
+      log.info("config", "PUT reference-dirs: start");
+      if (!isRecord(body) || !("dirs" in body)) {
+        log.warn("config", "PUT reference-dirs: invalid envelope");
+        badRequest(res, "expected { dirs: [...] }");
+        return;
+      }
+      const result = validateReferenceDirs(body.dirs);
+      if ("error" in result) {
+        log.warn("config", "PUT reference-dirs: validation failed", { error: result.error });
+        badRequest(res, result.error);
+        return;
+      }
       saveReferenceDirs(result.entries);
       log.info("config", "PUT reference-dirs: ok", { dirs: result.entries.length });
       res.json({ dirs: result.entries });
-    } catch (err) {
-      log.error("config", "PUT reference-dirs: threw", { error: errorMessage(err) });
-      serverError(res, errorMessage(err, "save failed"));
-    }
-  },
+    },
+  ),
 );
 
 router.get(API_ROUTES.config.schedulerOverrides, (_req: Request, res: Response<{ overrides: ScheduleOverrides }>) => {
@@ -240,22 +259,24 @@ router.get(API_ROUTES.config.schedulerOverrides, (_req: Request, res: Response<{
 
 router.put(
   API_ROUTES.config.schedulerOverrides,
-  async (req: Request<unknown, unknown, { overrides: unknown }>, res: Response<{ overrides: ScheduleOverrides } | ConfigErrorResponse>) => {
-    const { body } = req;
-    log.info("config", "PUT scheduler-overrides: start");
-    if (!isRecord(body) || !("overrides" in body)) {
-      log.warn("config", "PUT scheduler-overrides: invalid envelope");
-      badRequest(res, "expected { overrides: { ... } }");
-      return;
-    }
-    const raw = body.overrides;
-    if (!isRecord(raw)) {
-      log.warn("config", "PUT scheduler-overrides: overrides not an object");
-      badRequest(res, "overrides must be an object");
-      return;
-    }
-    const overrides = raw as ScheduleOverrides;
-    try {
+  asyncHandler<Request<unknown, unknown, { overrides: unknown }>, Response<{ overrides: ScheduleOverrides } | ConfigErrorResponse>>(
+    "config",
+    "save failed",
+    async (req, res) => {
+      const { body } = req;
+      log.info("config", "PUT scheduler-overrides: start");
+      if (!isRecord(body) || !("overrides" in body)) {
+        log.warn("config", "PUT scheduler-overrides: invalid envelope");
+        badRequest(res, "expected { overrides: { ... } }");
+        return;
+      }
+      const raw = body.overrides;
+      if (!isRecord(raw)) {
+        log.warn("config", "PUT scheduler-overrides: overrides not an object");
+        badRequest(res, "overrides must be an object");
+        return;
+      }
+      const overrides = raw as ScheduleOverrides;
       saveSchedulerOverrides(overrides);
 
       // Apply to running task-manager immediately
@@ -275,11 +296,8 @@ router.put(
 
       log.info("config", "PUT scheduler-overrides: ok", { tasks: Object.keys(overrides).length });
       res.json({ overrides: loadSchedulerOverrides() });
-    } catch (err) {
-      log.error("config", "PUT scheduler-overrides: threw", { error: errorMessage(err) });
-      serverError(res, errorMessage(err, "save failed"));
-    }
-  },
+    },
+  ),
 );
 
 export default router;

package/server/api/routes/files.ts

@@ -305,9 +305,9 @@ export function parseRange(header: string, size: number): ByteRange | null {
   return { start, end };
 }
 
-// Security headers applied to every `/files/raw` response. Exported
-// so a regression test can pin the exact strings down — a silent
-// regression here reopens a real XSS surface (see plans/
+// Security headers applied to `/files/raw` responses. Exported so a
+// regression test can pin the exact strings down — a silent
+// regression here reopens a real XSS surface (see plans/done/
 // fix-files-raw-csp-sandbox.md for the full threat model).
 //
 // `sandbox` (no allow-flags) creates an opaque origin for the
@@ -315,8 +315,7 @@ export function parseRange(header: string, size: number): ByteRange | null {
 // gets loaded as a top-level document or inside an iframe, its
 // scripts can't access the localhost:3001 origin's cookies,
 // session storage, or hit the `/api/*` endpoints. Frames rendering
-// the response become sandboxed too — PDFs still work because
-// they don't rely on same-origin access to the parent.
+// the response become sandboxed too.
 //
 // `nosniff` stops Chrome / Firefox from re-guessing Content-Type
 // on files the server declared but the browser might want to
@@ -326,8 +325,27 @@ export const RAW_SECURITY_HEADERS: Readonly<Record<string, string>> = {
   "X-Content-Type-Options": "nosniff",
 };
 
-function applyRawSecurityHeaders(res: Response): void {
-  for (const [name, value] of Object.entries(RAW_SECURITY_HEADERS)) {
+// PDF responses skip `Content-Security-Policy: sandbox`. Issue
+// #1299: WebKit refuses to render `sandbox`-opaque PDFs and forces
+// a download, breaking the Files preview iframe on Safari. The
+// PDF viewer (PDFium on Chromium, the WebKit PDF renderer, pdf.js
+// on Firefox) runs embedded AcroJS inside its own sandbox; the
+// response-level CSP was never the layer enforcing PDF script
+// isolation. `nosniff` is kept so the response can't be
+// re-interpreted as HTML.
+export const RAW_SECURITY_HEADERS_PDF: Readonly<Record<string, string>> = {
+  "X-Content-Type-Options": "nosniff",
+};
+
+/** Pick the header set for a given MIME. PDF is the only special
+ *  case today — every other MIME (`image/*`, `text/*`,
+ *  `application/octet-stream`, …) keeps the sandbox CSP. */
+export function rawSecurityHeadersForMime(mime: string): Readonly<Record<string, string>> {
+  return mime === "application/pdf" ? RAW_SECURITY_HEADERS_PDF : RAW_SECURITY_HEADERS;
+}
+
+function applyRawSecurityHeaders(res: Response, mime: string): void {
+  for (const [name, value] of Object.entries(rawSecurityHeadersForMime(mime))) {
     res.setHeader(name, value);
   }
 }
@@ -341,7 +359,11 @@ function pipeWithErrorHandling(stream: ReadStream, res: Response<ErrorResponse>)
       res.destroy(err);
       return;
     }
-    serverError(res, `Failed to read file: ${err.message}`);
+    // The raw `err.message` carries filesystem paths / system error
+    // detail — keep it in the server log but ship a stable opaque
+    // string to the client. Same threat model as `asyncHandler`.
+    log.error("files", "raw stream error", { error: errorMessage(err) });
+    serverError(res, "Failed to read file");
   });
   stream.pipe(res);
 }
@@ -497,7 +519,7 @@ router.get(API_ROUTES.files.tree, async (_req: Request<object, unknown, unknown,
     res.json(tree);
   } catch (err) {
     log.error("files", "GET tree: threw", { error: errorMessage(err) });
-    serverError(res, `Failed to read workspace: ${errorMessage(err)}`);
+    serverError(res, "Failed to read workspace");
   }
 });
 
@@ -560,7 +582,7 @@ router.get(API_ROUTES.files.dir, async (req: Request<object, unknown, unknown, P
     res.json(listing);
   } catch (err) {
     log.error("files", "GET dir: threw", { pathPreview: previewSnippet(relPath), error: errorMessage(err) });
-    serverError(res, `Failed to read directory: ${errorMessage(err)}`);
+    serverError(res, "Failed to read directory");
   }
 });
 
@@ -700,7 +722,7 @@ router.get(API_ROUTES.files.content, (req: Request<object, unknown, unknown, Pat
     content = readFileSync(absPath, "utf-8");
   } catch (err) {
     log.error("files", "GET content: read threw", { pathPreview: previewSnippet(relPath), error: errorMessage(err) });
-    serverError(res, `Failed to read file: ${errorMessage(err)}`);
+    serverError(res, "Failed to read file");
     return;
   }
   log.info("files", "GET content: ok", { pathPreview: previewSnippet(relPath), bytes: stat.size });
@@ -818,7 +840,7 @@ router.put(API_ROUTES.files.content, async (req: Request<object, unknown, WriteC
     await writeFileContent(resolved.absPath, content);
   } catch (err) {
     log.error("files", "PUT content: write threw", { pathPreview: previewSnippet(relPath), error: errorMessage(err) });
-    serverError(res, `Failed to write file: ${errorMessage(err)}`);
+    serverError(res, "Failed to write file");
     return;
   }
   const fresh = await statSafeAsync(resolved.absPath);
@@ -859,11 +881,13 @@ router.get(API_ROUTES.files.raw, (req: Request<object, unknown, unknown, PathQue
   const mime = MIME_BY_EXT[ext] ?? "application/octet-stream";
   res.setHeader("Accept-Ranges", "bytes");
   res.setHeader("Content-Type", mime);
-  // Sandbox the response so an `.svg` / `.html` / `.pdf` with
-  // embedded JavaScript can't escape into the localhost:3001
-  // origin via direct navigation or <iframe>. See
-  // plans/done/fix-files-raw-csp-sandbox.md for the threat model.
-  applyRawSecurityHeaders(res);
+  // Sandbox the response so an `.svg` / `.html` with embedded
+  // JavaScript can't escape into the localhost:3001 origin via
+  // direct navigation or <iframe>. PDFs get a narrower header set
+  // (no sandbox CSP) because Safari/WebKit refuses to render
+  // sandbox-opaque PDFs (#1299). See plans/done/
+  // fix-files-raw-csp-sandbox.md for the full threat model.
+  applyRawSecurityHeaders(res, mime);
 
   // Range support is required for `<video>` playback (Safari refuses
   // to play media without 206 responses) and for seek-past-buffered

package/server/api/routes/hookLog.ts

@@ -0,0 +1,95 @@
+// POST /api/hooks/log — receives one structured log line from the
+// PostToolUse dispatcher and forwards it into the server's logger.
+//
+// Why: hook handlers run inside Claude CLI's process space and have
+// no path to the server's structured logger. Without this endpoint,
+// every hook side-effect (skill-bridge mirror copy, future ones)
+// silently succeeds — a user trying to verify a copy actually
+// happened has no signal to look at, and a partial failure is
+// indistinguishable from "the hook didn't fire". This endpoint is
+// the bridge from "the hook side did something" to the same log
+// stream the rest of the server writes to.
+//
+// Body shape:
+//
+//   { namespace: string; message: string;
+//     level?: "info" | "warn" | "error"; data?: object }
+//
+// Authentication: bearer auth (same as every other internal hook
+// endpoint). The dispatcher reads the workspace's `.session-token`
+// sidecar before POSTing.
+
+import { Router, type Request, type Response } from "express";
+import { API_ROUTES } from "../../../src/config/apiRoutes.js";
+import { badRequest } from "../../utils/httpError.js";
+import { log } from "../../system/logger/index.js";
+import { isRecord } from "../../utils/types.js";
+
+type Level = "info" | "warn" | "error";
+
+interface HookLogBody {
+  namespace?: unknown;
+  message?: unknown;
+  level?: unknown;
+  data?: unknown;
+}
+
+const router = Router();
+
+// Cap the inbound payload's text length. The dispatcher is trusted
+// (bearer-authed, same machine) but a runaway handler emitting an
+// unbounded `data` blob would crowd the server logs. 2 KB per field
+// is comfortable for "mirror src → dst" style messages and tight
+// enough to keep one event readable in the tail.
+const MAX_FIELD_CHARS = 2048;
+
+interface ValidatedHookLog {
+  namespace: string;
+  message: string;
+  level: Level;
+  // `Record<string, unknown>` matches the server logger's `data?`
+  // parameter exactly — `object` would force a cast at the log
+  // call site. The validator already narrows via `isRecord`, so the
+  // tighter type also documents the gate visually.
+  data?: Record<string, unknown>;
+}
+
+// Pull validation into a helper so the route body stays under the
+// 20-line cognitive-complexity guideline. The helper either returns
+// the typed shape ready for `log[level](...)` or writes a 400 and
+// returns null — caller short-circuits on null.
+function validateHookLogBody(body: HookLogBody | undefined, res: Response): ValidatedHookLog | null {
+  const { namespace, message, level, data } = body ?? {};
+  if (typeof namespace !== "string" || namespace.length === 0) {
+    badRequest(res, "namespace required");
+    return null;
+  }
+  if (typeof message !== "string" || message.length === 0) {
+    badRequest(res, "message required");
+    return null;
+  }
+  return {
+    // Tag the log entry's namespace so it's easy to grep against
+    // server-side noise — every hook-side log line starts with
+    // `hook:<handler>` rather than the bare handler name a server
+    // module would use.
+    namespace: `hook:${namespace.slice(0, MAX_FIELD_CHARS)}`,
+    message: message.slice(0, MAX_FIELD_CHARS),
+    level: resolveLevel(level),
+    data: isRecord(data) ? data : undefined,
+  };
+}
+
+router.post(API_ROUTES.hooks.log, (req: Request<object, unknown, HookLogBody>, res: Response) => {
+  const validated = validateHookLogBody(req.body, res);
+  if (validated === null) return;
+  log[validated.level](validated.namespace, validated.message, validated.data);
+  res.status(204).end();
+});
+
+function resolveLevel(raw: unknown): Level {
+  if (raw === "warn" || raw === "error") return raw;
+  return "info";
+}
+
+export default router;

package/server/api/routes/news.ts

@@ -17,10 +17,9 @@ import { aggregateRecentItems, loadItemBody, type NewsItem } from "../../workspa
 import { loadJsonFile, writeJsonAtomic } from "../../utils/files/json.js";
 import { WORKSPACE_FILES } from "../../../src/config/workspacePaths.js";
 import { API_ROUTES } from "../../../src/config/apiRoutes.js";
-import { badRequest, serverError } from "../../utils/httpError.js";
-import { errorMessage } from "../../utils/errors.js";
+import { badRequest } from "../../utils/httpError.js";
 import { isRecord } from "../../utils/types.js";
-import { log } from "../../system/logger/index.js";
+import { asyncHandler } from "../../utils/asyncHandler.js";
 
 // Window upper bound — keeps memory bounded if a caller passes
 // a comically large `days`. Daily JSON aggregation is O(days * items)
@@ -41,20 +40,18 @@ const router = Router();
 
 // ── /api/news/items ─────────────────────────────────────────────
 
-router.get(API_ROUTES.news.items, async (req: Request, res: Response<{ items: NewsItem[] } | { error: string }>) => {
-  const days = parseDays(req.query.days);
-  if (days === null) {
-    badRequest(res, "invalid `days` query parameter");
-    return;
-  }
-  try {
+router.get(
+  API_ROUTES.news.items,
+  asyncHandler<Request, Response<{ items: NewsItem[] } | { error: string }>>("news", "failed to load news items", async (req, res) => {
+    const days = parseDays(req.query.days);
+    if (days === null) {
+      badRequest(res, "invalid `days` query parameter");
+      return;
+    }
     const items = await aggregateRecentItems(workspacePath, days);
     res.json({ items });
-  } catch (err) {
-    log.error("news", "aggregate failed", { error: errorMessage(err) });
-    serverError(res, "failed to load news items");
-  }
-});
+  }),
+);
 
 function parseDays(raw: unknown): number | null {
   if (raw === undefined) return DEFAULT_DAYS;
@@ -72,13 +69,14 @@ function parseDays(raw: unknown): number | null {
 // params would let an attacker fabricate paths — so we resolve from
 // the trusted in-memory aggregate keyed by `id` here.
 
-router.get(API_ROUTES.news.itemBody, async (req: Request<{ id: string }>, res: Response<{ body: string | null } | { error: string }>) => {
-  const { id } = req.params;
-  if (!id) {
-    badRequest(res, "missing item id");
-    return;
-  }
-  try {
+router.get(
+  API_ROUTES.news.itemBody,
+  asyncHandler<Request<{ id: string }>, Response<{ body: string | null } | { error: string }>>("news", "failed to load item body", async (req, res) => {
+    const { id } = req.params;
+    if (!id) {
+      badRequest(res, "missing item id");
+      return;
+    }
     const items = await aggregateRecentItems(workspacePath, MAX_DAYS);
     const match = items.find((entry) => entry.id === id);
     if (!match) {
@@ -87,46 +85,35 @@ router.get(API_ROUTES.news.itemBody, async (req: Request<{ id: string }>, res: R
     }
     const body = await loadItemBody(workspacePath, match.sourceSlug, match.url, match.publishedAt);
     res.json({ body });
-  } catch (err) {
-    log.error("news", "body lookup failed", { error: errorMessage(err) });
-    serverError(res, "failed to load item body");
-  }
-});
+  }),
+);
 
 // ── /api/news/read-state ─────────────────────────────────────────
 
 const readStateAbsPath = (): string => path.join(workspacePath, WORKSPACE_FILES.newsReadState);
 
-router.get(API_ROUTES.news.readState, (_req: Request, res: Response<ReadState | { error: string }>) => {
-  try {
+router.get(
+  API_ROUTES.news.readState,
+  asyncHandler<Request, Response<ReadState | { error: string }>>("news", "failed to load news read-state", async (_req, res) => {
     const data = loadJsonFile<ReadState>(readStateAbsPath(), { readIds: [] });
     const sanitized = sanitizeReadState(data);
     res.json(sanitized);
-  } catch (err) {
-    log.error("news", "read-state load failed", {
-      error: errorMessage(err),
-    });
-    serverError(res, "failed to load news read-state");
-  }
-});
-
-router.put(API_ROUTES.news.readState, async (req: Request, res: Response<ReadState | { error: string }>) => {
-  const { body } = req;
-  if (!isRecord(body) || !Array.isArray(body.readIds)) {
-    badRequest(res, "expected { readIds: string[] }");
-    return;
-  }
-  const sanitized = sanitizeReadState({ readIds: body.readIds });
-  try {
+  }),
+);
+
+router.put(
+  API_ROUTES.news.readState,
+  asyncHandler<Request, Response<ReadState | { error: string }>>("news", "failed to save news read-state", async (req, res) => {
+    const { body } = req;
+    if (!isRecord(body) || !Array.isArray(body.readIds)) {
+      badRequest(res, "expected { readIds: string[] }");
+      return;
+    }
+    const sanitized = sanitizeReadState({ readIds: body.readIds });
     await writeJsonAtomic(readStateAbsPath(), sanitized);
     res.json(sanitized);
-  } catch (err) {
-    log.error("news", "read-state save failed", {
-      error: errorMessage(err),
-    });
-    serverError(res, "failed to save news read-state");
-  }
-});
+  }),
+);
 
 // Drop non-string entries, dedupe, cap at MAX_READ_IDS (keeping the
 // most recent — i.e. tail end — of the list). Pure for testability.

package/server/api/routes/notifier.ts

@@ -24,7 +24,7 @@ import { Router, type Request, type Response } from "express";
 import { API_ROUTES } from "../../../src/config/apiRoutes.js";
 import { cancel, clear, listAll, listHistory } from "../../notifier/engine.js";
 import type { NotifierEntry, NotifierHistoryEntry } from "../../notifier/types.js";
-import { log } from "../../system/logger/index.js";
+import { asyncHandler } from "../../utils/asyncHandler.js";
 
 interface DispatchBody {
   action?: unknown;
@@ -40,10 +40,17 @@ function isNonEmptyString(value: unknown): value is string {
 
 const notifierRouter: Router = Router();
 
-notifierRouter.post(API_ROUTES.notifier.dispatch, async (req: Request<object, DispatchResponse, DispatchBody>, res: Response<DispatchResponse>) => {
-  const body = req.body ?? {};
-  const { action } = body;
-  try {
+// Detailed error stays in the server log for triage (via asyncHandler's
+// `log.error`); the HTTP response gets the opaque "internal error"
+// message so a parser-thrown filesystem path / internal stack frame
+// can't leak to the client. Echoing `String(err)` would have given
+// e.g. `Error: ENOENT, open '/Users/<...>/active.json'` to anyone
+// holding the bearer token (CodeRabbit review on PR #1196).
+notifierRouter.post(
+  API_ROUTES.notifier.dispatch,
+  asyncHandler<Request<object, DispatchResponse, DispatchBody>, Response<DispatchResponse>>("notifier-route", "internal error", async (req, res) => {
+    const body = req.body ?? {};
+    const { action } = body;
     switch (action) {
       case "clear": {
         if (!isNonEmptyString(body.id)) {
@@ -80,19 +87,7 @@ notifierRouter.post(API_ROUTES.notifier.dispatch, async (req: Request<object, Di
       default:
         res.status(400).json({ error: `unknown action: ${typeof action === "string" ? action : "<missing>"}` });
     }
-  } catch (err) {
-    // Detailed error stays in the server log for triage; the HTTP
-    // response gets an opaque message so a parser-thrown filesystem
-    // path / internal stack frame can't leak to the client. Echoing
-    // `String(err)` would have given e.g. `Error: ENOENT, open
-    // '/Users/<...>/active.json'` to anyone holding the bearer token
-    // (CodeRabbit review on PR #1196).
-    log.error("notifier-route", "dispatch failed", {
-      action: typeof action === "string" ? action : "<unknown>",
-      error: String(err),
-    });
-    res.status(500).json({ error: "internal error" });
-  }
-});
+  }),
+);
 
 export default notifierRouter;

package/server/api/routes/pdf.ts

@@ -139,7 +139,7 @@ function loadImageAsDataUri(abs: string): string | null {
 // only thing the user actually sees in a PDF anyway. The `<video
 // src>` / `<source src>` (in a `<video>`) / `<audio src>` URL is
 // left as the original relative path; puppeteer's fetch will fail
-// quickly and `networkidle0` still resolves.
+// quickly and the page's `load` event still fires.
 //
 // Anchored at end-of-pathname (callers strip query / fragment first
 // via `urlPathname` below) so a query-string-only mention of the
@@ -232,7 +232,7 @@ async function renderPdf(fullHtml: string, format: "Letter" | "A4" = "Letter"):
   const browser = await puppeteer.launch({ headless: true });
   try {
     const page = await browser.newPage();
-    await page.setContent(fullHtml, { waitUntil: "networkidle0" });
+    await page.setContent(fullHtml, { waitUntil: "load" });
     const pdfBuffer = await page.pdf({
       format,
       margin: { top: "16mm", bottom: "16mm", left: "16mm", right: "16mm" },