nexus-prime 3.2.2 → 3.3.0

package/dist/dashboard/server.js

@@ -20,6 +20,7 @@ const REQUIRED_CAPABILITIES = {
 };
 export class DashboardServer {
     server;
+    cachedDashboardHtml = null;
     clients = new Set();
     unsubscribeBus = null;
     runtimeProvider;
@@ -108,220 +109,312 @@ export class DashboardServer {
         console.error(`[Dashboard] Topology console listening at ${this.dashboardUrl}`);
     }
     async requestHandler(req, res) {
-        const url = new URL(req.url || '/', this.dashboardUrl ?? this.buildUrl(this.activePort ?? DEFAULT_PORT));
-        if (req.method === 'OPTIONS') {
-            this.respondOptions(res);
-            return;
-        }
-        if (req.method === 'GET' && (url.pathname === '/' || url.pathname === '/index.html')) {
-            this.serveDashboard(res);
-            return;
-        }
-        if (req.method === 'GET' && url.pathname === '/stream') {
-            this.serveSSE(req, res);
-            return;
-        }
-        if (req.method === 'GET' && url.pathname === '/api/runs') {
-            const limit = parseInt(url.searchParams.get('limit') || '20', 10);
-            this.respondJson(res, this.getRuntime()?.listRuns(limit) ?? []);
-            return;
-        }
-        if (req.method === 'GET' && url.pathname.startsWith('/api/runs/')) {
-            const runId = decodeURIComponent(url.pathname.replace('/api/runs/', ''));
-            const run = this.getRuntime()?.getRun(runId);
-            this.respondJson(res, run ?? { error: 'run-not-found', runId }, run ? 200 : 404);
-            return;
-        }
-        if (req.method === 'GET' && url.pathname === '/api/skills') {
-            this.respondJson(res, this.getRuntime()?.listSkills() ?? []);
-            return;
-        }
-        if (req.method === 'GET' && url.pathname === '/api/workflows') {
-            this.respondJson(res, this.getRuntime()?.listWorkflows() ?? []);
-            return;
-        }
-        if (req.method === 'GET' && url.pathname === '/api/backends') {
-            this.respondJson(res, this.getRuntime()?.getBackendCatalog() ?? {});
-            return;
-        }
-        if (req.method === 'GET' && url.pathname === '/api/health') {
-            this.respondJson(res, this.collectHealth());
-            return;
-        }
-        if (req.method === 'GET' && url.pathname === '/api/memory') {
-            const limit = parseInt(url.searchParams.get('limit') || '40', 10);
-            const tier = url.searchParams.get('tier') ?? undefined;
-            const tag = url.searchParams.get('tag') ?? undefined;
-            const linkedType = url.searchParams.get('linkedType') ?? undefined;
-            const recencyMs = url.searchParams.get('recencyMs');
-            const memory = this.getMemory();
-            this.respondJson(res, memory?.listSnapshots(limit, {
-                tier: tier,
-                tag,
-                linkedType: linkedType,
-                recencyMs: recencyMs ? parseInt(recencyMs, 10) : undefined,
-            }) ?? []);
-            return;
-        }
-        if (req.method === 'GET' && url.pathname.startsWith('/api/memory/') && url.pathname.endsWith('/network')) {
-            const id = decodeURIComponent(url.pathname.replace('/api/memory/', '').replace('/network', '').replace(/\/$/, ''));
-            const depth = parseInt(url.searchParams.get('depth') || '2', 10);
-            const limit = parseInt(url.searchParams.get('limit') || '18', 10);
-            const memory = this.getMemory();
-            this.respondJson(res, memory?.getNetworkSnapshot(id, depth, limit) ?? { focusId: id, nodes: [], links: [] });
-            return;
-        }
-        if (req.method === 'GET' && url.pathname.startsWith('/api/memory/')) {
-            const id = decodeURIComponent(url.pathname.replace('/api/memory/', ''));
-            const memory = this.getMemory();
-            const detail = memory?.getDetail(id);
-            this.respondJson(res, detail ?? { error: 'memory-not-found', id }, detail ? 200 : 404);
-            return;
-        }
-        if (req.method === 'GET' && url.pathname === '/api/pod') {
-            const limit = parseInt(url.searchParams.get('limit') || '40', 10);
-            this.respondJson(res, podNetwork.getDashboardSnapshot(limit));
-            return;
-        }
-        if (req.method === 'GET' && url.pathname.startsWith('/api/pod/')) {
-            const workerId = decodeURIComponent(url.pathname.replace('/api/pod/', ''));
-            const limit = parseInt(url.searchParams.get('limit') || '20', 10);
-            this.respondJson(res, podNetwork.getWorker(workerId, limit));
-            return;
-        }
-        if (req.method === 'GET' && url.pathname === '/api/clients') {
-            this.respondJson(res, this.getClientRegistry()?.listClients(this.getAdapters()) ?? []);
-            return;
-        }
-        if (req.method === 'GET' && url.pathname === '/api/events') {
-            const category = url.searchParams.get('category');
-            const type = url.searchParams.get('type');
-            const limit = parseInt(url.searchParams.get('limit') || '80', 10);
-            const events = this.getEventCards()
-                .filter((event) => !category || event.category === category)
-                .filter((event) => !type || event.type === type)
-                .slice(0, Math.max(limit, 1));
-            this.respondJson(res, events);
-            return;
-        }
-        if (req.method === 'POST' && url.pathname === '/api/skills/deploy') {
-            const body = await this.readJsonBody(req);
-            const runtime = this.getRuntime();
-            const deployed = runtime?.deploySkill(String(body.skillId), body.scope);
-            if (deployed) {
-                nexusEventBus.emit('skill.deploy', {
-                    skillId: deployed.skillId,
-                    scope: deployed.scope,
-                    status: deployed.rolloutStatus,
-                });
+        try {
+            const url = new URL(req.url || '/', this.dashboardUrl ?? this.buildUrl(this.activePort ?? DEFAULT_PORT));
+            if (req.method === 'OPTIONS') {
+                this.respondOptions(res);
+                return;
             }
-            this.respondJson(res, deployed ?? { error: 'skill-not-found' }, deployed ? 200 : 404);
-            return;
-        }
-        if (req.method === 'POST' && url.pathname === '/api/skills/revoke') {
-            const body = await this.readJsonBody(req);
-            const runtime = this.getRuntime();
-            const revoked = runtime?.revokeSkill(String(body.skillId));
-            if (revoked) {
-                nexusEventBus.emit('skill.revoke', {
-                    skillId: revoked.skillId,
-                    status: revoked.rolloutStatus,
-                });
+            if (req.method === 'GET' && (url.pathname === '/' || url.pathname === '/index.html')) {
+                this.serveDashboard(res);
+                return;
             }
-            this.respondJson(res, revoked ?? { error: 'skill-not-found' }, revoked ? 200 : 404);
-            return;
-        }
-        if (req.method === 'POST' && url.pathname === '/api/workflows/deploy') {
-            const body = await this.readJsonBody(req);
-            const runtime = this.getRuntime();
-            const deployed = runtime?.deployWorkflow(String(body.workflowId), body.scope);
-            if (deployed) {
-                nexusEventBus.emit('workflow.deploy', {
-                    workflowId: deployed.workflowId,
-                    scope: deployed.scope,
-                    status: deployed.rolloutStatus,
-                });
+            if (req.method === 'GET' && url.pathname === '/stream') {
+                this.serveSSE(req, res);
+                return;
             }
-            this.respondJson(res, deployed ?? { error: 'workflow-not-found' }, deployed ? 200 : 404);
-            return;
-        }
-        if (req.method === 'POST' && url.pathname === '/api/workflows/run') {
-            const body = await this.readJsonBody(req);
-            const runtime = this.getRuntime();
-            if (!runtime) {
-                this.respondJson(res, { error: 'runtime-unavailable' }, 503);
+            if (req.method === 'GET' && url.pathname === '/api/runs') {
+                const limit = parseInt(url.searchParams.get('limit') || '20', 10);
+                this.respondJson(res, this.getRuntime()?.listRuns(limit) ?? []);
                 return;
             }
-            try {
-                const run = await runtime.runWorkflow(String(body.workflowId), body.goal ? String(body.goal) : undefined);
-                nexusEventBus.emit('workflow.run', {
-                    workflowId: String(body.workflowId),
-                    runId: run.runId,
-                    status: run.state,
-                });
-                this.respondJson(res, run);
+            if (req.method === 'GET' && url.pathname.startsWith('/api/runs/')) {
+                const runId = decodeURIComponent(url.pathname.replace('/api/runs/', ''));
+                const run = this.getRuntime()?.getRun(runId);
+                this.respondJson(res, run ?? { error: 'run-not-found', runId }, run ? 200 : 404);
+                return;
             }
-            catch (error) {
-                this.respondJson(res, { error: error instanceof Error ? error.message : 'workflow-run-failed' }, 400);
+            if (req.method === 'GET' && url.pathname === '/api/skills') {
+                this.respondJson(res, this.getRuntime()?.listSkills() ?? []);
+                return;
             }
-            return;
-        }
-        if (req.method === 'POST' && url.pathname === '/api/runtime/execute') {
-            const body = await this.readJsonBody(req);
-            const runtime = this.getRuntime();
-            if (!runtime) {
-                this.respondJson(res, { error: 'runtime-unavailable' }, 503);
+            if (req.method === 'GET' && url.pathname === '/api/workflows') {
+                this.respondJson(res, this.getRuntime()?.listWorkflows() ?? []);
                 return;
             }
-            if (!body.goal || typeof body.goal !== 'string') {
-                this.respondJson(res, { error: 'goal-required' }, 400);
+            if (req.method === 'GET' && url.pathname === '/api/backends') {
+                this.respondJson(res, this.getRuntime()?.getBackendCatalog() ?? {});
                 return;
             }
-            const run = await runtime.run(body);
-            nexusEventBus.emit('dashboard.action', {
-                action: 'runtime.execute',
-                status: run.state,
-                target: run.runId,
-            });
-            this.respondJson(res, run, 201);
-            return;
-        }
-        if (req.method === 'POST' && url.pathname.startsWith('/api/clients/') && url.pathname.endsWith('/reconnect')) {
-            const clientId = decodeURIComponent(url.pathname.replace('/api/clients/', '').replace('/reconnect', '').replace(/\/$/, ''));
-            const registry = this.getClientRegistry();
-            if (!registry) {
-                this.respondJson(res, { error: 'client-registry-unavailable' }, 503);
+            if (req.method === 'GET' && url.pathname === '/api/health') {
+                this.respondJson(res, this.collectHealth());
                 return;
             }
-            const client = registry.reconnect(clientId);
-            nexusEventBus.emit('dashboard.action', {
-                action: 'client.reconnect',
-                status: 'ok',
-                target: clientId,
-            });
-            this.respondJson(res, client);
-            return;
-        }
-        if (req.method === 'POST' && url.pathname.startsWith('/api/clients/') && url.pathname.endsWith('/clear')) {
-            const clientId = decodeURIComponent(url.pathname.replace('/api/clients/', '').replace('/clear', '').replace(/\/$/, ''));
-            const registry = this.getClientRegistry();
-            if (!registry) {
-                this.respondJson(res, { error: 'client-registry-unavailable' }, 503);
+            if (req.method === 'GET' && url.pathname === '/api/memory') {
+                const limit = parseInt(url.searchParams.get('limit') || '40', 10);
+                const tier = url.searchParams.get('tier') ?? undefined;
+                const tag = url.searchParams.get('tag') ?? undefined;
+                const linkedType = url.searchParams.get('linkedType') ?? undefined;
+                const recencyMs = url.searchParams.get('recencyMs');
+                const memory = this.getMemory();
+                this.respondJson(res, memory?.listSnapshots(limit, {
+                    tier: tier,
+                    tag,
+                    linkedType: linkedType,
+                    recencyMs: recencyMs ? parseInt(recencyMs, 10) : undefined,
+                }) ?? []);
                 return;
             }
-            registry.clear(clientId);
-            nexusEventBus.emit('dashboard.action', {
-                action: 'client.clear',
-                status: 'ok',
-                target: clientId,
-            });
-            this.respondJson(res, { ok: true, clientId });
-            return;
+            if (req.method === 'GET' && url.pathname.startsWith('/api/memory/') && url.pathname.endsWith('/network')) {
+                const id = decodeURIComponent(url.pathname.replace('/api/memory/', '').replace('/network', '').replace(/\/$/, ''));
+                const depth = parseInt(url.searchParams.get('depth') || '2', 10);
+                const limit = parseInt(url.searchParams.get('limit') || '18', 10);
+                const memory = this.getMemory();
+                this.respondJson(res, memory?.getNetworkSnapshot(id, depth, limit) ?? { focusId: id, nodes: [], links: [] });
+                return;
+            }
+            if (req.method === 'GET' && url.pathname.startsWith('/api/memory/')) {
+                const id = decodeURIComponent(url.pathname.replace('/api/memory/', ''));
+                const memory = this.getMemory();
+                const detail = memory?.getDetail(id);
+                this.respondJson(res, detail ?? { error: 'memory-not-found', id }, detail ? 200 : 404);
+                return;
+            }
+            if (req.method === 'GET' && url.pathname === '/api/pod') {
+                const limit = parseInt(url.searchParams.get('limit') || '40', 10);
+                this.respondJson(res, podNetwork.getDashboardSnapshot(limit));
+                return;
+            }
+            if (req.method === 'GET' && url.pathname.startsWith('/api/pod/')) {
+                const workerId = decodeURIComponent(url.pathname.replace('/api/pod/', ''));
+                const limit = parseInt(url.searchParams.get('limit') || '20', 10);
+                this.respondJson(res, podNetwork.getWorker(workerId, limit));
+                return;
+            }
+            if (req.method === 'GET' && url.pathname === '/api/clients') {
+                this.respondJson(res, this.getClientRegistry()?.listClients(this.getAdapters()) ?? []);
+                return;
+            }
+            if (req.method === 'GET' && url.pathname === '/api/events') {
+                const category = url.searchParams.get('category');
+                const type = url.searchParams.get('type');
+                const limit = parseInt(url.searchParams.get('limit') || '80', 10);
+                const events = this.getEventCards()
+                    .filter((event) => !category || event.category === category)
+                    .filter((event) => !type || event.type === type)
+                    .slice(0, Math.max(limit, 1));
+                this.respondJson(res, events);
+                return;
+            }
+            if (req.method === 'POST' && url.pathname === '/api/skills/deploy') {
+                const body = await this.readJsonBody(req);
+                const runtime = this.getRuntime();
+                const deployed = runtime?.deploySkill(String(body.skillId), body.scope);
+                if (deployed) {
+                    nexusEventBus.emit('skill.deploy', {
+                        skillId: deployed.skillId,
+                        scope: deployed.scope,
+                        status: deployed.rolloutStatus,
+                    });
+                }
+                this.respondJson(res, deployed ?? { error: 'skill-not-found' }, deployed ? 200 : 404);
+                return;
+            }
+            if (req.method === 'POST' && url.pathname === '/api/skills/revoke') {
+                const body = await this.readJsonBody(req);
+                const runtime = this.getRuntime();
+                const revoked = runtime?.revokeSkill(String(body.skillId));
+                if (revoked) {
+                    nexusEventBus.emit('skill.revoke', {
+                        skillId: revoked.skillId,
+                        status: revoked.rolloutStatus,
+                    });
+                }
+                this.respondJson(res, revoked ?? { error: 'skill-not-found' }, revoked ? 200 : 404);
+                return;
+            }
+            if (req.method === 'POST' && url.pathname === '/api/skills/register') {
+                const body = await this.readJsonBody(req);
+                const runtime = this.getRuntime();
+                if (!runtime) {
+                    this.respondJson(res, { error: 'runtime-unavailable' }, 503);
+                    return;
+                }
+                try {
+                    const riskClass = (['read', 'orchestrate', 'mutate'].includes(body.riskClass) ? body.riskClass : 'orchestrate');
+                    const scope = (['session', 'worker', 'global'].includes(body.scope) ? body.scope : 'session');
+                    const skill = runtime.generateSkill({
+                        name: String(body.name || 'unnamed-skill'),
+                        instructions: String(body.instructions || ''),
+                        riskClass,
+                        scope,
+                    });
+                    nexusEventBus.emit('skill.register', {
+                        name: skill.name,
+                        id: skill.skillId,
+                    });
+                    this.respondJson(res, skill);
+                }
+                catch (err) {
+                    this.respondJson(res, { error: err.message || 'register-failed' }, 400);
+                }
+                return;
+            }
+            if (req.method === 'POST' && url.pathname === '/api/skills/seed') {
+                const runtime = this.getRuntime();
+                if (!runtime) {
+                    this.respondJson(res, { error: 'runtime-unavailable' }, 503);
+                    return;
+                }
+                const defaultSkills = [
+                    { name: 'code-review-playbook', instructions: 'Guide structured code review: check for bugs, security issues, performance problems, readability concerns. Produce a checklist with severity ratings.', riskClass: 'read', scope: 'global' },
+                    { name: 'token-budget-guardian', instructions: 'Monitor token usage during sessions. Warn when context exceeds 70k tokens. Suggest pruning strategies and memory offloading when approaching limits.', riskClass: 'read', scope: 'global' },
+                    { name: 'session-handover', instructions: 'At session end, generate a comprehensive summary: files modified, decisions made, open questions, recommended next steps. Store as session-summary memory.', riskClass: 'orchestrate', scope: 'global' },
+                    { name: 'memory-hygiene', instructions: 'Review stored memories for staleness, duplicates, and contradictions. Suggest pruning candidates and consolidation opportunities. Never auto-delete.', riskClass: 'read', scope: 'global' },
+                    { name: 'test-first-guard', instructions: 'Before implementing features, ensure test files exist or are planned. Prompt for test strategy if missing. Verify tests pass after implementation.', riskClass: 'orchestrate', scope: 'session' },
+                    { name: 'commit-message-crafter', instructions: 'Generate concise, semantic commit messages following conventional commits format. Analyze staged changes to infer the correct type (feat/fix/chore/refactor).', riskClass: 'read', scope: 'global' },
+                ];
+                const results = [];
+                for (const skill of defaultSkills) {
+                    try {
+                        const existing = runtime.listSkills().find((s) => s.name === skill.name);
+                        if (!existing) {
+                            const registered = runtime.generateSkill(skill);
+                            results.push({ name: skill.name, status: 'created', skillId: registered.skillId });
+                        }
+                        else {
+                            results.push({ name: skill.name, status: 'exists', skillId: existing.skillId });
+                        }
+                    }
+                    catch {
+                        results.push({ name: skill.name, status: 'failed' });
+                    }
+                }
+                this.respondJson(res, { seeded: results });
+                return;
+            }
+            if (req.method === 'POST' && url.pathname === '/api/workflows/deploy') {
+                const body = await this.readJsonBody(req);
+                const runtime = this.getRuntime();
+                const deployed = runtime?.deployWorkflow(String(body.workflowId), body.scope);
+                if (deployed) {
+                    nexusEventBus.emit('workflow.deploy', {
+                        workflowId: deployed.workflowId,
+                        scope: deployed.scope,
+                        status: deployed.rolloutStatus,
+                    });
+                }
+                this.respondJson(res, deployed ?? { error: 'workflow-not-found' }, deployed ? 200 : 404);
+                return;
+            }
+            if (req.method === 'POST' && url.pathname === '/api/workflows/run') {
+                const body = await this.readJsonBody(req);
+                const runtime = this.getRuntime();
+                if (!runtime) {
+                    this.respondJson(res, { error: 'runtime-unavailable' }, 503);
+                    return;
+                }
+                try {
+                    const run = await runtime.runWorkflow(String(body.workflowId), body.goal ? String(body.goal) : undefined);
+                    nexusEventBus.emit('workflow.run', {
+                        workflowId: String(body.workflowId),
+                        runId: run.runId,
+                        status: run.state,
+                    });
+                    this.respondJson(res, run);
+                }
+                catch (error) {
+                    this.respondJson(res, { error: error instanceof Error ? error.message : 'workflow-run-failed' }, 400);
+                }
+                return;
+            }
+            if (req.method === 'POST' && url.pathname === '/api/runtime/execute') {
+                const body = await this.readJsonBody(req);
+                const runtime = this.getRuntime();
+                if (!runtime) {
+                    this.respondJson(res, { error: 'runtime-unavailable' }, 503);
+                    return;
+                }
+                if (!body.goal || typeof body.goal !== 'string') {
+                    this.respondJson(res, { error: 'goal-required' }, 400);
+                    return;
+                }
+                const run = await runtime.run(body);
+                nexusEventBus.emit('dashboard.action', {
+                    action: 'runtime.execute',
+                    status: run.state,
+                    target: run.runId,
+                });
+                this.respondJson(res, run, 201);
+                return;
+            }
+            if (req.method === 'POST' && url.pathname.startsWith('/api/clients/') && url.pathname.endsWith('/reconnect')) {
+                const clientId = decodeURIComponent(url.pathname.replace('/api/clients/', '').replace('/reconnect', '').replace(/\/$/, ''));
+                const registry = this.getClientRegistry();
+                if (!registry) {
+                    this.respondJson(res, { error: 'client-registry-unavailable' }, 503);
+                    return;
+                }
+                const client = registry.reconnect(clientId);
+                nexusEventBus.emit('dashboard.action', {
+                    action: 'client.reconnect',
+                    status: 'ok',
+                    target: clientId,
+                });
+                this.respondJson(res, client);
+                return;
+            }
+            if (req.method === 'POST' && url.pathname.startsWith('/api/clients/') && url.pathname.endsWith('/clear')) {
+                const clientId = decodeURIComponent(url.pathname.replace('/api/clients/', '').replace('/clear', '').replace(/\/$/, ''));
+                const registry = this.getClientRegistry();
+                if (!registry) {
+                    this.respondJson(res, { error: 'client-registry-unavailable' }, 503);
+                    return;
+                }
+                registry.clear(clientId);
+                nexusEventBus.emit('dashboard.action', {
+                    action: 'client.clear',
+                    status: 'ok',
+                    target: clientId,
+                });
+                this.respondJson(res, { ok: true, clientId });
+                return;
+            }
+            res.writeHead(404);
+            res.end('Not found');
+        }
+        catch (error) {
+            if (!res.headersSent) {
+                if (error instanceof Error && error.message === 'Request body too large') {
+                    res.writeHead(413, { 'Content-Type': 'text/plain' });
+                    res.end('Request body too large');
+                }
+                else {
+                    res.writeHead(500, { 'Content-Type': 'text/plain' });
+                    res.end('Internal server error');
+                }
+            }
         }
-        res.writeHead(404);
-        res.end('Not found');
     }
     serveDashboard(res) {
+        const securityHeaders = {
+            'Content-Type': 'text/html',
+            'Content-Security-Policy': [
+                "default-src 'self'",
+                "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
+                "font-src 'self' https://fonts.gstatic.com",
+                "script-src 'unsafe-inline'",
+                "connect-src 'self'",
+                "img-src 'self' data:",
+            ].join('; '),
+            'X-Content-Type-Options': 'nosniff',
+            'X-Frame-Options': 'DENY',
+        };
+        if (this.cachedDashboardHtml) {
+            res.writeHead(200, securityHeaders);
+            res.end(this.cachedDashboardHtml);
+            return;
+        }
         const htmlPath = path.join(__dirname, 'index.html');
         fs.readFile(htmlPath, 'utf8', (err, data) => {
             if (err) {
@@ -329,7 +422,8 @@ export class DashboardServer {
                 res.end('Error loading dashboard HTML');
                 return;
             }
-            res.writeHead(200, { 'Content-Type': 'text/html' });
+            this.cachedDashboardHtml = data;
+            res.writeHead(200, securityHeaders);
             res.end(data);
         });
     }
@@ -338,7 +432,7 @@ export class DashboardServer {
             'Content-Type': 'text/event-stream',
             'Cache-Control': 'no-cache',
             Connection: 'keep-alive',
-            'Access-Control-Allow-Origin': '*',
+            'Access-Control-Allow-Origin': this.getCorsOrigin(),
         });
         res.write('retry: 3000\n\n');
         res.write(`event: bootstrap\ndata: ${JSON.stringify({ connected: true, timestamp: Date.now() })}\n\n`);
@@ -363,9 +457,12 @@ export class DashboardServer {
             res.write(dataStr);
         }
     }
+    getCorsOrigin() {
+        return this.dashboardUrl || `http://${HOST}:${this.activePort || DEFAULT_PORT}`;
+    }
     respondOptions(res) {
         res.writeHead(204, {
-            'Access-Control-Allow-Origin': '*',
+            'Access-Control-Allow-Origin': this.getCorsOrigin(),
             'Access-Control-Allow-Methods': 'GET,POST,OPTIONS',
             'Access-Control-Allow-Headers': 'Content-Type',
         });
@@ -375,14 +472,21 @@ export class DashboardServer {
         res.writeHead(statusCode, {
             'Content-Type': 'application/json',
             'Cache-Control': 'no-cache',
-            'Access-Control-Allow-Origin': '*',
+            'Access-Control-Allow-Origin': this.getCorsOrigin(),
         });
         res.end(JSON.stringify(data, null, 2));
     }
     async readJsonBody(req) {
+        const MAX_BODY = 1024 * 1024; // 1MB
         const chunks = [];
+        let totalLength = 0;
         for await (const chunk of req) {
-            chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+            const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            totalLength += buf.length;
+            if (totalLength > MAX_BODY) {
+                throw new Error('Request body too large');
+            }
+            chunks.push(buf);
         }
         if (!chunks.length)
             return {};