palaryn 0.1.0 → 0.3.2

package/src/anomaly/index.ts

@@ -0,0 +1 @@
+export { AnomalyDetector, AnomalyConfig, AnomalyAlert, AnomalyType, AnomalyState, RollingWindow } from './detector';

package/src/approval/manager.ts

@@ -0,0 +1,569 @@
+import * as crypto from 'crypto';
+import * as jwt from 'jsonwebtoken';
+import { randomUUID } from 'crypto';
+import { ToolCall } from '../types/tool-call';
+import { ApprovalConfig } from '../types/config';
+import { ApprovalWebhook } from './webhook';
+import { ApprovalStore } from '../storage/interfaces';
+import { InMemoryApprovalStore } from '../storage/memory';
+
+/** SHA-256 hash a string and return the hex digest */
+function hashToken(token: string): string {
+  return crypto.createHash('sha256').update(token).digest('hex');
+}
+
+/** Maximum number of used token hashes to track (prevents unbounded memory growth) */
+const MAX_USED_TOKENS = 100_000;
+
+export interface PendingApproval {
+  approval_id: string;
+  tool_call_id: string;
+  task_id: string;
+  workspace_id: string;
+  actor_id: string;
+  requesting_api_key_id?: string;  // Hash of the API key that created this approval (for self-approval prevention)
+  tool_name: string;
+  tool_capability: string;
+  args_summary: string;      // Sanitized summary of args (no secrets)
+  scope: string;             // Who can approve (e.g., 'team_lead', 'security_lead', 'admin')
+  reason: string;            // Why approval is needed
+  token_hash: string;        // SHA-256 hash of the JWT approval token (never store raw token)
+  status: 'pending' | 'approved' | 'denied' | 'expired';
+  created_at: string;
+  expires_at: string;
+  resolved_at?: string;
+  resolved_by?: string;
+  denial_reason?: string;
+}
+
+export interface CreateApprovalResult {
+  approval: PendingApproval;
+  token: string;             // Raw JWT token (returned to caller, never stored)
+}
+
+export interface ApprovalResult {
+  approved: boolean;
+  approval_id: string;
+  resolved_by?: string;
+  denial_reason?: string;
+}
+
+export class ApprovalManager {
+  private config: ApprovalConfig;
+  private store: ApprovalStore;
+  private webhook: ApprovalWebhook | null;
+  private requireDifferentIdentity: boolean;
+  /** Track approval IDs currently being processed to prevent concurrent resolution */
+  private inFlightApprovals = new Set<string>();
+  /**
+   * Track used approval tokens (token hash -> usage timestamp) to prevent replay attacks.
+   * This is defense-in-depth; the primary defense against replay is the approval status
+   * check in the store (which persists across restarts).
+   */
+  private usedTokens = new Map<string, number>();
+
+  constructor(config: ApprovalConfig, store?: ApprovalStore, options?: { require_different_identity?: boolean }) {
+    this.config = config;
+    this.store = store ?? new InMemoryApprovalStore();
+    this.webhook = config.webhook_url
+      ? new ApprovalWebhook(config.webhook_url, config.webhook_headers)
+      : null;
+    this.requireDifferentIdentity = options?.require_different_identity ?? true;
+  }
+
+  /**
+   * Create a pending approval for a tool call that received a REQUIRE_APPROVAL
+   * decision from the policy engine. Generates a signed JWT token that must be
+   * presented when approving or denying the request.
+   */
+  createApproval(toolCall: ToolCall, scope: string, reason: string, ttlSeconds?: number, requestingApiKeyId?: string): CreateApprovalResult {
+    const approvalId = randomUUID();
+    const ttl = ttlSeconds || this.config.default_ttl_seconds;
+    const now = new Date();
+    const expiresAt = new Date(now.getTime() + ttl * 1000);
+
+    // Create JWT token containing approval metadata
+    const token = jwt.sign(
+      {
+        approval_id: approvalId,
+        tool_call_id: toolCall.tool_call_id,
+        task_id: toolCall.task_id,
+        workspace_id: toolCall.workspace_id,
+        scope,
+      },
+      this.config.token_secret,
+      { expiresIn: ttl }
+    );
+
+    // Hash the token before storing (never persist the raw JWT)
+    const tokenHash = hashToken(token);
+
+    // Create sanitized args summary (strip sensitive fields)
+    const argsSummary = this.sanitizeArgs(toolCall);
+
+    // Hash the requesting API key ID to prevent storing raw keys
+    const requestingKeyHash = requestingApiKeyId
+      ? hashToken(requestingApiKeyId)
+      : undefined;
+
+    const approval: PendingApproval = {
+      approval_id: approvalId,
+      tool_call_id: toolCall.tool_call_id,
+      task_id: toolCall.task_id,
+      workspace_id: toolCall.workspace_id,
+      actor_id: toolCall.actor.id,
+      requesting_api_key_id: requestingKeyHash,
+      tool_name: toolCall.tool.name,
+      tool_capability: toolCall.tool.capability,
+      args_summary: argsSummary,
+      scope,
+      reason,
+      token_hash: tokenHash,
+      status: 'pending',
+      created_at: now.toISOString(),
+      expires_at: expiresAt.toISOString(),
+    };
+
+    this.store.save(approvalId, approval);
+    this.store.indexToken(tokenHash, approvalId);
+
+    if (this.webhook) {
+      this.webhook.notify('approval_requested', approval);
+    }
+
+    return { approval, token };
+  }
+
+  /**
+   * Approve a pending request by presenting the signed JWT token.
+   *
+   * Verifies the token signature and expiry, locates the corresponding
+   * approval record, confirms it is still in 'pending' status, and
+   * transitions it to 'approved'.
+   *
+   * Throws an Error for invalid tokens, expired approvals, or approvals
+   * that have already been resolved.
+   */
+  async approve(token: string, approverId: string, approverApiKeyId?: string): Promise<ApprovalResult> {
+    const tokenHash = hashToken(token);
+
+    // Token replay prevention: check if this token was already used
+    if (this.usedTokens.has(tokenHash)) {
+      throw new Error('Approval token has already been used');
+    }
+
+    const approval = this.resolveTokenToApproval(token);
+
+    // In-process lock: prevent concurrent resolution of the same approval
+    if (this.inFlightApprovals.has(approval.approval_id)) {
+      throw new Error(`Approval "${approval.approval_id}" is already being processed by another request`);
+    }
+    this.inFlightApprovals.add(approval.approval_id);
+
+    try {
+      // Prevent self-approval via API key comparison (cryptographic identity)
+      if (approval.requesting_api_key_id && approverApiKeyId) {
+        const approverKeyHash = hashToken(approverApiKeyId);
+        if (approverKeyHash === approval.requesting_api_key_id) {
+          console.warn(`[ApprovalManager] Self-approval attempt blocked: approver=${approverId}, approval=${approval.approval_id}, workspace=${approval.workspace_id}`);
+          throw new Error('Self-approval is not allowed. A different API key must approve this request.');
+        }
+      } else if (this.requireDifferentIdentity && (!approval.requesting_api_key_id || !approverApiKeyId)) {
+        // Without cryptographic identity on both sides, deny self-approval entirely
+        throw new Error('Self-approval not allowed without cryptographic identity (API key required)');
+      }
+
+      // Actor-level self-approval check: prevent same actor from approving their own request
+      if (approval.actor_id && approverId && approval.actor_id === approverId) {
+        console.warn(`[ApprovalManager] Self-approval attempt blocked (actor match): actor=${approverId}, approval=${approval.approval_id}, workspace=${approval.workspace_id}`);
+        throw new Error('Self-approval is not allowed. A different user must approve this request.');
+      }
+
+      // Build updated approval object (do NOT mutate the original before CAS)
+      const updated = {
+        ...approval,
+        status: 'approved' as const,
+        resolved_at: new Date().toISOString(),
+        resolved_by: approverId,
+      };
+
+      // Atomic CAS: use compareAndSetStatus if available to prevent race conditions
+      // where two concurrent approve() calls both resolve the same pending approval
+      if (this.store.compareAndSetStatus) {
+        const swapped = await this.store.compareAndSetStatus(approval.approval_id, 'pending', updated);
+        if (!swapped) {
+          throw new Error(`Approval "${approval.approval_id}" was already resolved by another request`);
+        }
+      } else {
+        this.store.save(approval.approval_id, updated);
+      }
+
+      // Mark token as used to prevent replay
+      this.usedTokens.set(tokenHash, Date.now());
+      if (this.usedTokens.size > MAX_USED_TOKENS) {
+        const evictCount = Math.floor(MAX_USED_TOKENS * 0.1);
+        let deleted = 0;
+        for (const key of this.usedTokens.keys()) {
+          if (deleted >= evictCount) break;
+          this.usedTokens.delete(key);
+          deleted++;
+        }
+      }
+
+      if (this.webhook) {
+        this.webhook.notify('approval_approved', updated);
+      }
+
+      return {
+        approved: true,
+        approval_id: approval.approval_id,
+        resolved_by: approverId,
+      };
+    } finally {
+      this.inFlightApprovals.delete(approval.approval_id);
+    }
+  }
+
+  /**
+   * Deny a pending request by presenting the signed JWT token along with a
+   * reason for denial.
+   *
+   * Verifies the token signature and expiry, locates the corresponding
+   * approval record, confirms it is still in 'pending' status, and
+   * transitions it to 'denied'.
+   *
+   * Throws an Error for invalid tokens, expired approvals, or approvals
+   * that have already been resolved.
+   */
+  async deny(token: string, approverId: string, reason: string, _approverApiKeyId?: string): Promise<ApprovalResult> {
+    const tokenHash = hashToken(token);
+
+    // Token replay prevention: check if this token was already used
+    if (this.usedTokens.has(tokenHash)) {
+      throw new Error('Approval token has already been used');
+    }
+
+    const approval = this.resolveTokenToApproval(token);
+
+    // In-process lock: prevent concurrent resolution of the same approval
+    if (this.inFlightApprovals.has(approval.approval_id)) {
+      throw new Error(`Approval "${approval.approval_id}" is already being processed by another request`);
+    }
+    this.inFlightApprovals.add(approval.approval_id);
+
+    try {
+      // Build updated approval object (do NOT mutate the original before CAS)
+      const updated = {
+        ...approval,
+        status: 'denied' as const,
+        resolved_at: new Date().toISOString(),
+        resolved_by: approverId,
+        denial_reason: reason,
+      };
+
+      // Atomic CAS: use compareAndSetStatus if available to prevent race conditions
+      if (this.store.compareAndSetStatus) {
+        const swapped = await this.store.compareAndSetStatus(approval.approval_id, 'pending', updated);
+        if (!swapped) {
+          throw new Error(`Approval "${approval.approval_id}" was already resolved by another request`);
+        }
+      } else {
+        this.store.save(approval.approval_id, updated);
+      }
+
+      // Mark token as used to prevent replay
+      this.usedTokens.set(tokenHash, Date.now());
+      if (this.usedTokens.size > MAX_USED_TOKENS) {
+        const evictCount = Math.floor(MAX_USED_TOKENS * 0.1);
+        let deleted = 0;
+        for (const key of this.usedTokens.keys()) {
+          if (deleted >= evictCount) break;
+          this.usedTokens.delete(key);
+          deleted++;
+        }
+      }
+
+      if (this.webhook) {
+        this.webhook.notify('approval_denied', updated);
+      }
+
+      return {
+        approved: false,
+        approval_id: approval.approval_id,
+        resolved_by: approverId,
+        denial_reason: reason,
+      };
+    } finally {
+      this.inFlightApprovals.delete(approval.approval_id);
+    }
+  }
+
+  /**
+   * Resolve an approval by its ID (for admin panel use where the raw token is
+   * not available). Validates the approval is still pending and not expired.
+   */
+  async resolveById(approvalId: string, approverId: string, approved: boolean, reason?: string, approverApiKeyId?: string): Promise<ApprovalResult> {
+    // In-process lock: prevent concurrent resolution of the same approval
+    if (this.inFlightApprovals.has(approvalId)) {
+      throw new Error(`Approval "${approvalId}" is already being processed by another request`);
+    }
+    this.inFlightApprovals.add(approvalId);
+
+    try {
+      const approval = this.store.getById(approvalId);
+      if (!approval) {
+        throw new Error('Approval not found');
+      }
+
+      if (approval.status === 'approved') {
+        throw new Error(`Approval "${approvalId}" has already been approved`);
+      }
+      if (approval.status === 'denied') {
+        throw new Error(`Approval "${approvalId}" has already been denied`);
+      }
+      if (approval.status === 'expired' || new Date() > new Date(approval.expires_at)) {
+        approval.status = 'expired';
+        throw new Error(`Approval "${approvalId}" has expired`);
+      }
+
+      // Prevent self-approval via API key comparison (cryptographic identity)
+      if (approved && approval.requesting_api_key_id && approverApiKeyId) {
+        const approverKeyHash = hashToken(approverApiKeyId);
+        if (approverKeyHash === approval.requesting_api_key_id) {
+          console.warn(`[ApprovalManager] Self-approval attempt blocked: approver=${approverId}, approval=${approvalId}, workspace=${approval.workspace_id}`);
+          throw new Error('Self-approval is not allowed. A different API key must approve this request.');
+        }
+      } else if (approved && !approval.requesting_api_key_id && !approverApiKeyId) {
+        // Fallback: compare actor IDs when no API key is available (admin panel use)
+        if (approval.actor_id === approverId) {
+          console.warn(`[ApprovalManager] Self-approval attempt blocked (actor match): actor=${approverId}, approval=${approvalId}, workspace=${approval.workspace_id}`);
+          throw new Error('Self-approval is not allowed. A different user must approve this request.');
+        }
+      }
+
+      // Actor-level self-approval check for API key path too
+      if (approved && approval.actor_id && approverId && approval.actor_id === approverId) {
+        console.warn(`[ApprovalManager] Self-approval attempt blocked (actor match): actor=${approverId}, approval=${approvalId}, workspace=${approval.workspace_id}`);
+        throw new Error('Self-approval is not allowed. A different user must approve this request.');
+      }
+
+      // Build updated approval object (do NOT mutate the original before CAS)
+      const updated = approved
+        ? { ...approval, status: 'approved' as const, resolved_at: new Date().toISOString(), resolved_by: approverId }
+        : { ...approval, status: 'denied' as const, resolved_at: new Date().toISOString(), resolved_by: approverId, denial_reason: reason || 'Denied' };
+
+      // Atomic CAS: use compareAndSetStatus if available
+      if (this.store.compareAndSetStatus) {
+        const swapped = await this.store.compareAndSetStatus(approvalId, 'pending', updated);
+        if (!swapped) {
+          throw new Error(`Approval "${approvalId}" was already resolved by another request`);
+        }
+      } else {
+        this.store.save(approvalId, updated);
+      }
+
+      if (this.webhook) {
+        this.webhook.notify(approved ? 'approval_approved' : 'approval_denied', updated);
+      }
+
+      return {
+        approved,
+        approval_id: approvalId,
+        resolved_by: approverId,
+        denial_reason: approved ? undefined : reason,
+      };
+    } finally {
+      this.inFlightApprovals.delete(approvalId);
+    }
+  }
+
+  /**
+   * Check if an approval exists and return its current status.
+   * Automatically marks the approval as 'expired' if it has passed its TTL.
+   */
+  getApproval(approvalId: string): PendingApproval | null {
+    const approval = this.store.getById(approvalId);
+    if (!approval) return null;
+
+    // Check if expired
+    if (approval.status === 'pending' && new Date() > new Date(approval.expires_at)) {
+      approval.status = 'expired';
+    }
+
+    return approval;
+  }
+
+  /**
+   * Look up an approval by the original tool_call_id. This is useful when an
+   * agent retries a tool call and needs to find the approval that was created
+   * for the original attempt.
+   *
+   * Automatically marks the approval as 'expired' if it has passed its TTL.
+   */
+  getApprovalByToolCallId(toolCallId: string): PendingApproval | null {
+    const approval = this.store.getByToolCallId(toolCallId);
+    if (!approval) return null;
+
+    // Check expiry
+    if (approval.status === 'pending' && new Date() > new Date(approval.expires_at)) {
+      approval.status = 'expired';
+    }
+    return approval;
+  }
+
+  /**
+   * Find an existing approved approval for the same task+actor+tool combination.
+   * Used to bypass re-approval when an agent retries after a previous approval.
+   */
+  findApprovedForTask(taskId: string, actorId: string, toolName: string, capability: string): PendingApproval | null {
+    if (this.store.findApproved) {
+      return this.store.findApproved(taskId, actorId, toolName, capability) || null;
+    }
+    return null;
+  }
+
+  /**
+   * Get all currently pending approvals, optionally filtered by workspace.
+   * Expires any approvals that are past their TTL before returning results.
+   */
+  getPendingApprovals(workspaceId?: string): PendingApproval[] {
+    const now = new Date();
+    const candidates = this.store.findPending(workspaceId);
+    const results: PendingApproval[] = [];
+
+    for (const approval of candidates) {
+      // Expire any that are past TTL
+      if (approval.status === 'pending' && now > new Date(approval.expires_at)) {
+        approval.status = 'expired';
+        continue;
+      }
+
+      results.push(approval);
+    }
+
+    return results;
+  }
+
+  /**
+   * Verify and decode a JWT approval token.
+   * Returns the decoded payload on success, or an error message on failure.
+   */
+  private verifyToken(token: string): { valid: boolean; payload?: any; error?: string } {
+    try {
+      const payload = jwt.verify(token, this.config.token_secret);
+      return { valid: true, payload };
+    } catch (err) {
+      const message = err instanceof Error ? err.message : 'Invalid token';
+      return { valid: false, error: message };
+    }
+  }
+
+  /**
+   * Common logic shared by approve() and deny(): verify the token, look up
+   * the approval record, and validate that it can still be resolved.
+   *
+   * Returns the mutable PendingApproval record so the caller can update its
+   * status fields directly.
+   *
+   * Throws an Error if:
+   *   - The token is invalid or has an expired signature
+   *   - No approval record is found for the token
+   *   - The approval has already been resolved (approved/denied)
+   *   - The approval has expired (past TTL)
+   */
+  private resolveTokenToApproval(token: string): PendingApproval {
+    // Step 1: Verify the JWT signature and expiry
+    const verification = this.verifyToken(token);
+    if (!verification.valid) {
+      throw new Error(`Invalid approval token: ${verification.error}`);
+    }
+
+    // Step 2: Look up the approval record by token hash
+    const tokenHash = hashToken(token);
+    const approval = this.store.getByToken(tokenHash);
+    if (!approval) {
+      throw new Error('Approval not found for the provided token');
+    }
+
+    const approvalId = approval.approval_id;
+
+    // Step 3: Check if the approval has already been resolved
+    if (approval.status === 'approved') {
+      throw new Error(`Approval "${approvalId}" has already been approved`);
+    }
+    if (approval.status === 'denied') {
+      throw new Error(`Approval "${approvalId}" has already been denied`);
+    }
+
+    // Step 4: Check if the approval has expired (belt-and-suspenders with JWT expiry)
+    if (approval.status === 'expired' || new Date() > new Date(approval.expires_at)) {
+      approval.status = 'expired';
+      throw new Error(`Approval "${approvalId}" has expired`);
+    }
+
+    return approval;
+  }
+
+  /**
+   * Create a sanitized summary of the tool call arguments that is safe to
+   * display to an approver. Strips query parameters (may contain tokens or
+   * secrets), omits headers entirely, and only indicates whether a body is
+   * present without revealing its contents.
+   */
+  private sanitizeArgs(toolCall: ToolCall): string {
+    const { method, url, body } = toolCall.args;
+    const parts: string[] = [];
+
+    if (method) parts.push(`method=${method}`);
+
+    if (url) {
+      // Only include domain and path, not full URL (might contain sensitive query params)
+      try {
+        const parsed = new URL(url as string);
+        parts.push(`domain=${parsed.hostname}`);
+        parts.push(`path=${parsed.pathname}`);
+      } catch {
+        parts.push(`url=[invalid]`);
+      }
+    }
+
+    if (body) parts.push(`body=[present]`);
+
+    return parts.join(', ') || 'no args';
+  }
+
+  /**
+   * Scan all pending approvals and mark any that have passed their TTL as
+   * 'expired'. Returns the number of approvals that were expired.
+   */
+  cleanup(): number {
+    let cleaned = 0;
+    const now = new Date();
+    const pending = this.store.findPending();
+
+    for (const approval of pending) {
+      if (now > new Date(approval.expires_at)) {
+        approval.status = 'expired';
+        cleaned++;
+      }
+    }
+
+    return cleaned;
+  }
+
+  /**
+   * Wait for all pending store writes to complete.
+   */
+  async flush(): Promise<void> {
+    if (this.store.flush) await this.store.flush();
+  }
+
+  /**
+   * Clear all approval state. Intended for use in tests only.
+   */
+  clear(): void {
+    this.store.clear();
+    this.inFlightApprovals.clear();
+    this.usedTokens.clear();
+  }
+}

package/src/approval/webhook.ts

@@ -0,0 +1,133 @@
+import * as http from 'http';
+import * as https from 'https';
+import { URL } from 'url';
+import { PendingApproval } from './manager';
+
+export interface ApprovalWebhookPayload {
+  event: 'approval_requested' | 'approval_approved' | 'approval_denied' | 'approval_expired';
+  approval: {
+    approval_id: string;
+    tool_call_id: string;
+    task_id: string;
+    workspace_id: string;
+    actor_id: string;
+    tool_name: string;
+    tool_capability: string;
+    args_summary: string;
+    scope: string;
+    reason: string;
+    status: string;
+    created_at: string;
+    expires_at: string;
+    resolved_by?: string;
+    denial_reason?: string;
+  };
+  timestamp: string;
+}
+
+/**
+ * Fires webhook notifications for approval lifecycle events.
+ * Non-blocking: errors are logged but never thrown to the caller.
+ */
+export class ApprovalWebhook {
+  private webhookUrl: string;
+  private headers: Record<string, string>;
+
+  constructor(webhookUrl: string, headers?: Record<string, string>) {
+    this.webhookUrl = webhookUrl;
+    this.headers = headers || {};
+  }
+
+  /** Send a webhook notification (fire-and-forget with retry, non-blocking) */
+  notify(event: ApprovalWebhookPayload['event'], approval: PendingApproval): void {
+    const payload: ApprovalWebhookPayload = {
+      event,
+      approval: {
+        approval_id: approval.approval_id,
+        tool_call_id: approval.tool_call_id,
+        task_id: approval.task_id,
+        workspace_id: approval.workspace_id,
+        actor_id: approval.actor_id,
+        tool_name: approval.tool_name,
+        tool_capability: approval.tool_capability,
+        args_summary: approval.args_summary,
+        scope: approval.scope,
+        reason: approval.reason,
+        status: approval.status,
+        created_at: approval.created_at,
+        expires_at: approval.expires_at,
+        resolved_by: approval.resolved_by,
+        denial_reason: approval.denial_reason,
+      },
+      timestamp: new Date().toISOString(),
+    };
+
+    // Fire and forget with retry - don't block the caller
+    this.sendWithRetry(payload, event).catch((err) => {
+      console.error(`[ApprovalWebhook] All retry attempts failed for ${event} notification (approval=${approval.approval_id}): ${err.message}`);
+    });
+  }
+
+  private async sendWithRetry(payload: ApprovalWebhookPayload, event: string, maxAttempts = 3): Promise<void> {
+    const backoffMs = [1000, 2000, 4000];
+    let lastError: Error | undefined;
+
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+      try {
+        await this.send(payload);
+        return; // success
+      } catch (err) {
+        lastError = err instanceof Error ? err : new Error(String(err));
+        if (attempt < maxAttempts - 1) {
+          console.warn(`[ApprovalWebhook] Retry ${attempt + 1}/${maxAttempts} for ${event} notification failed: ${lastError.message}. Retrying in ${backoffMs[attempt]}ms...`);
+          await new Promise(resolve => setTimeout(resolve, backoffMs[attempt]));
+        }
+      }
+    }
+
+    throw lastError;
+  }
+
+  private send(payload: ApprovalWebhookPayload): Promise<void> {
+    return new Promise((resolve, reject) => {
+      const url = new URL(this.webhookUrl);
+      const isHttps = url.protocol === 'https:';
+      const transport = isHttps ? https : http;
+      const bodyStr = JSON.stringify(payload);
+
+      const headers: Record<string, string> = {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(bodyStr).toString(),
+        'User-Agent': 'Palaryn-Approval-Webhook/0.1',
+        ...this.headers,
+      };
+
+      const options = {
+        hostname: url.hostname,
+        port: url.port || (isHttps ? 443 : 80),
+        path: url.pathname + url.search,
+        method: 'POST',
+        headers,
+        timeout: 5000,
+      };
+
+      const req = transport.request(options, (res) => {
+        res.resume(); // drain
+        if (res.statusCode && res.statusCode >= 200 && res.statusCode < 300) {
+          resolve();
+        } else {
+          reject(new Error(`Webhook returned HTTP ${res.statusCode}`));
+        }
+      });
+
+      req.on('error', reject);
+      req.on('timeout', () => {
+        req.destroy();
+        reject(new Error('Webhook request timeout'));
+      });
+
+      req.write(bodyStr);
+      req.end();
+    });
+  }
+}