patchwork-os 0.2.0-beta.0 → 0.2.0-beta.1

package/dist/server.js

@@ -7,11 +7,12 @@ import { saveBridgeConfigDriver } from "./config.js";
 import { tryHandleConnectorRoute, tryHandlePublicConnectorRoute, } from "./connectorRoutes.js";
 import { timingSafeStringEqual } from "./crypto.js";
 import { renderDashboardHtml } from "./dashboard.js";
+import { respond500 } from "./httpErrorResponse.js";
 import { tryHandleInboxRoute } from "./inboxRoutes.js";
 import { tryHandleMcpRoute } from "./mcpRoutes.js";
 import { tryHandleOAuthRoute } from "./oauthRoutes.js";
-import { loadConfig as loadPatchworkConfig, defaultConfigPath as patchworkConfigPath, saveConfig as savePatchworkConfig, } from "./patchworkConfig.js";
-import { tryHandleRecipeRoute } from "./recipeRoutes.js";
+import { loadConfig as loadPatchworkConfig, defaultConfigPath as patchworkConfigPath, saveApiKeyToSecureStore, saveConfig as savePatchworkConfig, } from "./patchworkConfig.js";
+import { readBodyWithCap, readJsonBody, respond413, tryHandleRecipeRoute, } from "./recipeRoutes.js";
 import { PACKAGE_VERSION } from "./version.js";
 const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
 const SESSION_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -87,6 +88,8 @@ export class Server extends EventEmitter {
     saveRecipeContentFn = null;
     /** Patchwork: set by bridge to delete a recipe by name. */
     deleteRecipeContentFn = null;
+    /** Patchwork: set by bridge to archive a recipe (move to .archive/). */
+    archiveRecipeFn = null;
     /** Patchwork: set by bridge to promote a variant recipe to the canonical name. */
     promoteRecipeVariantFn = null;
     /** Patchwork: set by bridge to duplicate a recipe as a variant. */
@@ -347,10 +350,7 @@ export class Server extends EventEmitter {
                     res.end(JSON.stringify(body, null, 2));
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
@@ -399,10 +399,7 @@ export class Server extends EventEmitter {
                     res.end(body);
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
@@ -418,10 +415,7 @@ export class Server extends EventEmitter {
                     res.end(JSON.stringify(data));
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
@@ -436,10 +430,7 @@ export class Server extends EventEmitter {
                     res.end(JSON.stringify({ events: data, count: data.length }));
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
@@ -475,10 +466,7 @@ export class Server extends EventEmitter {
                     res.end(JSON.stringify(data));
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
@@ -549,12 +537,7 @@ export class Server extends EventEmitter {
                         }
                     }
                     catch (err) {
-                        if (!res.headersSent) {
-                            res.writeHead(500, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({
-                                error: err instanceof Error ? err.message : String(err),
-                            }));
-                        }
+                        respond500(res, err);
                     }
                 })();
                 return;
@@ -577,10 +560,7 @@ export class Server extends EventEmitter {
                     res.end(JSON.stringify(data));
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
@@ -594,10 +574,7 @@ export class Server extends EventEmitter {
                     res.end(JSON.stringify(data));
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
@@ -625,10 +602,7 @@ export class Server extends EventEmitter {
                     }
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
@@ -681,10 +655,7 @@ export class Server extends EventEmitter {
                     res.end(JSON.stringify(data));
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
@@ -703,67 +674,64 @@ export class Server extends EventEmitter {
                     }
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
             if (parsedUrl.pathname?.startsWith("/hooks/") && req.method === "POST") {
                 const hookPath = parsedUrl.pathname.substring("/hooks".length);
-                const chunks = [];
-                req.on("data", (c) => chunks.push(c));
-                req.on("end", () => {
-                    void (async () => {
-                        let payload;
-                        if (chunks.length > 0) {
-                            const body = Buffer.concat(chunks).toString("utf-8");
-                            if (body.trim()) {
-                                try {
-                                    payload = JSON.parse(body);
-                                }
-                                catch {
-                                    payload = body;
-                                }
-                            }
-                        }
-                        if (!this.webhookFn) {
-                            res.writeHead(503, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({
-                                ok: false,
-                                error: "Webhooks unavailable — start bridge with --claude-driver subprocess",
-                            }));
-                            return;
-                        }
-                        const result = await this.webhookFn(hookPath, payload);
-                        const status = result.ok
-                            ? 200
-                            : result.error === "not_found"
-                                ? 404
-                                : 400;
-                        // Record in ring buffer so the dashboard can show "last
-                        // payload" per recipe. Skip not_found so unknown paths don't
-                        // pollute the buffer with garbage / scanner traffic.
-                        if (result.error !== "not_found") {
-                            const existing = this.webhookPayloads.get(hookPath) ?? [];
-                            existing.unshift({
-                                receivedAt: Date.now(),
-                                payload,
-                                ok: result.ok,
-                                error: result.error,
-                                taskId: result.taskId,
-                                recipeName: result.name,
-                            });
-                            if (existing.length > Server.MAX_WEBHOOK_PAYLOADS) {
-                                existing.length = Server.MAX_WEBHOOK_PAYLOADS;
-                            }
-                            this.webhookPayloads.set(hookPath, existing);
-                        }
-                        res.writeHead(status, { "Content-Type": "application/json" });
-                        res.end(JSON.stringify(result));
-                    })();
-                });
+                // 256 KB — webhook payloads from GitHub/Linear/etc. are typically
+                // 1–25 KB; 256 KB matches RECIPE_ROUTE_BODY_CAPS.content as a
+                // generous ceiling that still bounds an authenticated DoS vector.
+                const HOOKS_BODY_CAP = 256 * 1024;
+                const read = await readBodyWithCap(req, HOOKS_BODY_CAP);
+                if (!read.ok) {
+                    respond413(res, HOOKS_BODY_CAP);
+                    return;
+                }
+                let payload;
+                if (read.body.trim()) {
+                    try {
+                        payload = JSON.parse(read.body);
+                    }
+                    catch {
+                        payload = read.body;
+                    }
+                }
+                if (!this.webhookFn) {
+                    res.writeHead(503, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({
+                        ok: false,
+                        error: "Webhooks unavailable — start bridge with --claude-driver subprocess",
+                    }));
+                    return;
+                }
+                const result = await this.webhookFn(hookPath, payload);
+                const status = result.ok
+                    ? 200
+                    : result.error === "not_found"
+                        ? 404
+                        : 400;
+                // Record in ring buffer so the dashboard can show "last
+                // payload" per recipe. Skip not_found so unknown paths don't
+                // pollute the buffer with garbage / scanner traffic.
+                if (result.error !== "not_found") {
+                    const existing = this.webhookPayloads.get(hookPath) ?? [];
+                    existing.unshift({
+                        receivedAt: Date.now(),
+                        payload,
+                        ok: result.ok,
+                        error: result.error,
+                        taskId: result.taskId,
+                        recipeName: result.name,
+                    });
+                    if (existing.length > Server.MAX_WEBHOOK_PAYLOADS) {
+                        existing.length = Server.MAX_WEBHOOK_PAYLOADS;
+                    }
+                    this.webhookPayloads.set(hookPath, existing);
+                }
+                res.writeHead(status, { "Content-Type": "application/json" });
+                res.end(JSON.stringify(result));
                 return;
             }
             if (parsedUrl.pathname?.startsWith("/webhook-payloads/") &&
@@ -916,6 +884,7 @@ export class Server extends EventEmitter {
                 loadRecipeContentFn: this.loadRecipeContentFn,
                 saveRecipeContentFn: this.saveRecipeContentFn,
                 deleteRecipeContentFn: this.deleteRecipeContentFn,
+                archiveRecipeFn: this.archiveRecipeFn,
                 duplicateRecipeFn: this.duplicateRecipeFn,
                 promoteRecipeVariantFn: this.promoteRecipeVariantFn,
                 lintRecipeContentFn: this.lintRecipeContentFn,
@@ -943,10 +912,7 @@ export class Server extends EventEmitter {
                     res.end(JSON.stringify(data));
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
@@ -962,19 +928,28 @@ export class Server extends EventEmitter {
                     res.end(JSON.stringify(data));
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
             if (parsedUrl.pathname === "/settings" && req.method === "POST") {
-                const chunks = [];
-                req.on("data", (c) => chunks.push(c));
-                req.on("end", () => {
-                    try {
-                        const body = JSON.parse(Buffer.concat(chunks).toString("utf-8"));
+                // 16 KB — settings POSTs are short-string fields (URLs, API keys,
+                // gate level). 16 KB is generous; an authenticated attacker can't
+                // stream gigabytes here.
+                const SETTINGS_BODY_CAP = 16 * 1024;
+                const parsed = await readJsonBody(req, SETTINGS_BODY_CAP);
+                if (!parsed.ok) {
+                    if (parsed.code === "too_large") {
+                        respond413(res, SETTINGS_BODY_CAP);
+                        return;
+                    }
+                    res.writeHead(400, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "Invalid request body" }));
+                    return;
+                }
+                try {
+                    {
+                        const body = parsed.value ?? {};
                         const hasWebhookUpdate = body.webhookUrl !== undefined;
                         const raw = hasWebhookUpdate
                             ? (body.webhookUrl?.trim() ?? "")
@@ -1032,6 +1007,8 @@ export class Server extends EventEmitter {
                                 "openai",
                                 "grok",
                                 "gemini",
+                                "gemini-api",
+                                "local",
                                 "none",
                             ];
                             if (!validDrivers.includes(driverRaw)) {
@@ -1043,7 +1020,17 @@ export class Server extends EventEmitter {
                             }
                             const driver = driverRaw;
                             cfg.driver = driver;
-                            saveBridgeConfigDriver(driver, this.bridgeConfigPath);
+                            try {
+                                saveBridgeConfigDriver(driver, this.bridgeConfigPath);
+                            }
+                            catch (writeErr) {
+                                this.logger.error(`[/config/patchwork] saveBridgeConfigDriver failed: ${writeErr instanceof Error ? (writeErr.stack ?? writeErr.message) : String(writeErr)}`);
+                                res.writeHead(500, { "Content-Type": "application/json" });
+                                res.end(JSON.stringify({
+                                    error: "Failed to write bridge driver config",
+                                }));
+                                return;
+                            }
                         }
                         if (body.model !== undefined) {
                             const validModels = [
@@ -1077,9 +1064,32 @@ export class Server extends EventEmitter {
                                 res.end(JSON.stringify({ error: "Invalid apiKey provider or key" }));
                                 return;
                             }
-                            cfg.apiKeys = { ...cfg.apiKeys, [provider]: key || undefined };
+                            // Provider keys go to the secure store (Keychain/DPAPI/Secret
+                            // Service / AES-256-GCM file fallback) — never persisted to
+                            // ~/.patchwork/config.json. Empty string clears.
+                            try {
+                                saveApiKeyToSecureStore(provider, key);
+                            }
+                            catch (writeErr) {
+                                this.logger.error(`[/config/patchwork] saveApiKeyToSecureStore failed: ${writeErr instanceof Error ? (writeErr.stack ?? writeErr.message) : String(writeErr)}`);
+                                res.writeHead(500, { "Content-Type": "application/json" });
+                                res.end(JSON.stringify({
+                                    error: "Failed to write provider API key",
+                                }));
+                                return;
+                            }
+                        }
+                        try {
+                            savePatchworkConfig(cfg, configPath);
+                        }
+                        catch (writeErr) {
+                            this.logger.error(`[/config/patchwork] savePatchworkConfig failed: ${writeErr instanceof Error ? (writeErr.stack ?? writeErr.message) : String(writeErr)}`);
+                            res.writeHead(500, { "Content-Type": "application/json" });
+                            res.end(JSON.stringify({
+                                error: "Failed to write patchwork config",
+                            }));
+                            return;
                         }
-                        savePatchworkConfig(cfg, configPath);
                         if (hasWebhookUpdate) {
                             this.approvalWebhookUrl = raw || undefined;
                         }
@@ -1105,44 +1115,45 @@ export class Server extends EventEmitter {
                         res.writeHead(200, { "Content-Type": "application/json" });
                         res.end(JSON.stringify({ ok: true, restartRequired }));
                     }
-                    catch (err) {
-                        res.writeHead(400, { "Content-Type": "application/json" });
-                        res.end(JSON.stringify({
-                            error: err instanceof Error ? err.message : String(err),
-                        }));
-                    }
-                });
+                }
+                catch (err) {
+                    this.logger.error(`[/config/patchwork] error: ${err instanceof Error ? (err.stack ?? err.message) : String(err)}`);
+                    res.writeHead(400, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "Invalid request body" }));
+                }
                 return;
             }
             // CC hook notify endpoint — lightweight alternative to full MCP session for hook wiring.
             if (parsedUrl.pathname === "/notify" && req.method === "POST") {
-                const chunks = [];
-                req.on("data", (c) => chunks.push(c));
-                req.on("end", () => {
-                    try {
-                        const body = Buffer.concat(chunks).toString("utf-8");
-                        const parsed = JSON.parse(body);
-                        const event = parsed.event ?? "";
-                        const args = parsed.args ?? {};
-                        if (!this.notifyFn) {
-                            res.writeHead(503, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({
-                                ok: false,
-                                error: "Automation not enabled",
-                            }));
-                            return;
-                        }
-                        const result = this.notifyFn(event, args);
-                        res.writeHead(result.ok ? 200 : 400, {
-                            "Content-Type": "application/json",
-                        });
-                        res.end(JSON.stringify(result));
-                    }
-                    catch {
-                        res.writeHead(400, { "Content-Type": "application/json" });
-                        res.end(JSON.stringify({ ok: false, error: "Invalid JSON body" }));
+                // 8 KB — notify payloads carry an event name + small arg map
+                // (taskId, prompt, tool name). 8 KB fits everything we send today
+                // with headroom.
+                const NOTIFY_BODY_CAP = 8 * 1024;
+                const parsed = await readJsonBody(req, NOTIFY_BODY_CAP);
+                if (!parsed.ok) {
+                    if (parsed.code === "too_large") {
+                        respond413(res, NOTIFY_BODY_CAP);
+                        return;
                     }
+                    res.writeHead(400, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ ok: false, error: "Invalid JSON body" }));
+                    return;
+                }
+                const event = parsed.value?.event ?? "";
+                const args = parsed.value?.args ?? {};
+                if (!this.notifyFn) {
+                    res.writeHead(503, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({
+                        ok: false,
+                        error: "Automation not enabled",
+                    }));
+                    return;
+                }
+                const result = this.notifyFn(event, args);
+                res.writeHead(result.ok ? 200 : 400, {
+                    "Content-Type": "application/json",
                 });
+                res.end(JSON.stringify(result));
                 return;
             }
             // Single-approval detail lookup for the dashboard detail page.
@@ -1160,10 +1171,7 @@ export class Server extends EventEmitter {
                     res.end(JSON.stringify(data));
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
@@ -1177,101 +1185,99 @@ export class Server extends EventEmitter {
             if (parsedUrl.pathname === "/approvals" ||
                 parsedUrl.pathname === "/cc-permissions" ||
                 /^\/(approve|reject)\/[A-Za-z0-9-]+$/.test(parsedUrl.pathname)) {
-                const chunks = [];
-                req.on("data", (c) => chunks.push(c));
-                req.on("end", async () => {
-                    let parsedBody;
-                    if (chunks.length > 0) {
-                        try {
-                            parsedBody = JSON.parse(Buffer.concat(chunks).toString("utf-8"));
-                        }
-                        catch {
-                            res.writeHead(400, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({ error: "invalid JSON body" }));
-                            return;
-                        }
-                    }
-                    try {
-                        const result = await routeApprovalRequest({
-                            method: req.method ?? "GET",
-                            path: parsedUrl.pathname,
-                            body: parsedBody,
-                            query: parsedUrl.searchParams,
-                            approvalToken: req.headers["x-approval-token"],
-                        }, {
-                            queue: getApprovalQueue(),
-                            workspace: process.cwd(),
-                            managedSettingsPath: this.managedSettingsPath,
-                            onDecision: this.onApprovalDecision,
-                            webhookUrl: this.approvalWebhookUrl,
-                            approvalGate: this.approvalGate,
-                            pushServiceUrl: this.pushServiceUrl,
-                            pushServiceToken: this.pushServiceToken,
-                            pushServiceBaseUrl: this.pushServiceBaseUrl,
-                            activityLog: this.activityLog,
-                            // RecipeRunLog satisfies RecipeRunQuerier structurally
-                            // — the cast bridges TS contravariance: RecipeRunQuerier's
-                            // narrow query interface (`status?: string`) is deliberately
-                            // loose so tests can mock it; RecipeRunLog's stricter
-                            // RunStatus union is a strict subset and fails the param
-                            // contravariance check despite being safe at runtime.
-                            recipeRunLog: this.recipeRunLog,
-                            enableTimeOfDayAnomaly: this.enableTimeOfDayAnomaly,
-                        });
-                        res.writeHead(result.status, {
-                            "Content-Type": "application/json",
-                        });
-                        res.end(JSON.stringify(result.body));
-                    }
-                    catch (err) {
-                        res.writeHead(500, { "Content-Type": "application/json" });
-                        res.end(JSON.stringify({
-                            error: err instanceof Error ? err.message : String(err),
-                        }));
+                // 32 KB — approvals carry decision + reason + optional permission
+                // rule patches; 32 KB matches RECIPE_ROUTE_BODY_CAPS.run. Critical
+                // here: /approve/:id and /reject/:id are reachable via the
+                // x-approval-token phone-path bypass at line 609-612 — without a
+                // cap an unbounded body read happens *before* token validation.
+                const APPROVALS_BODY_CAP = 32 * 1024;
+                const parsed = await readJsonBody(req, APPROVALS_BODY_CAP);
+                if (!parsed.ok) {
+                    if (parsed.code === "too_large") {
+                        respond413(res, APPROVALS_BODY_CAP);
+                        return;
                     }
-                });
+                    res.writeHead(400, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "invalid JSON body" }));
+                    return;
+                }
+                const parsedBody = parsed.value;
+                try {
+                    const result = await routeApprovalRequest({
+                        method: req.method ?? "GET",
+                        path: parsedUrl.pathname,
+                        body: parsedBody,
+                        query: parsedUrl.searchParams,
+                        approvalToken: req.headers["x-approval-token"],
+                    }, {
+                        queue: getApprovalQueue(),
+                        workspace: process.cwd(),
+                        managedSettingsPath: this.managedSettingsPath,
+                        onDecision: this.onApprovalDecision,
+                        webhookUrl: this.approvalWebhookUrl,
+                        approvalGate: this.approvalGate,
+                        pushServiceUrl: this.pushServiceUrl,
+                        pushServiceToken: this.pushServiceToken,
+                        pushServiceBaseUrl: this.pushServiceBaseUrl,
+                        activityLog: this.activityLog,
+                        // RecipeRunLog satisfies RecipeRunQuerier structurally
+                        // — the cast bridges TS contravariance: RecipeRunQuerier's
+                        // narrow query interface (`status?: string`) is deliberately
+                        // loose so tests can mock it; RecipeRunLog's stricter
+                        // RunStatus union is a strict subset and fails the param
+                        // contravariance check despite being safe at runtime.
+                        recipeRunLog: this.recipeRunLog,
+                        enableTimeOfDayAnomaly: this.enableTimeOfDayAnomaly,
+                    });
+                    res.writeHead(result.status, {
+                        "Content-Type": "application/json",
+                    });
+                    res.end(JSON.stringify(result.body));
+                }
+                catch (err) {
+                    respond500(res, err);
+                }
                 return;
             }
             // Quick-task launch endpoint — mirrors /notify pattern. Bearer auth already checked above.
             if (parsedUrl.pathname === "/launch-quick-task" &&
                 req.method === "POST") {
-                const chunks = [];
-                req.on("data", (c) => chunks.push(c));
-                req.on("end", () => {
-                    void (async () => {
-                        try {
-                            const body = Buffer.concat(chunks).toString("utf-8");
-                            const parsed = JSON.parse(body);
-                            const presetId = parsed.presetId;
-                            const source = parsed.source ?? "cli";
-                            if (typeof presetId !== "string" || !presetId) {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({
-                                    ok: false,
-                                    error: "presetId required",
-                                }));
-                                return;
-                            }
-                            if (!this.launchQuickTaskFn) {
-                                res.writeHead(503, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({
-                                    ok: false,
-                                    error: "Quick tasks unavailable — requires --claude-driver subprocess",
-                                }));
-                                return;
-                            }
-                            const result = await this.launchQuickTaskFn(presetId, source);
-                            res.writeHead(result.ok ? 200 : 429, {
-                                "Content-Type": "application/json",
-                            });
-                            res.end(JSON.stringify(result));
-                        }
-                        catch {
-                            res.writeHead(400, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({ ok: false, error: "Invalid JSON body" }));
-                        }
-                    })();
+                // 4 KB — body is `{ presetId?: string; source?: string }`, two
+                // short strings. 4 KB is plenty.
+                const QUICK_TASK_BODY_CAP = 4 * 1024;
+                const parsed = await readJsonBody(req, QUICK_TASK_BODY_CAP);
+                if (!parsed.ok) {
+                    if (parsed.code === "too_large") {
+                        respond413(res, QUICK_TASK_BODY_CAP);
+                        return;
+                    }
+                    res.writeHead(400, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ ok: false, error: "Invalid JSON body" }));
+                    return;
+                }
+                const presetId = parsed.value?.presetId;
+                const source = parsed.value?.source ?? "cli";
+                if (typeof presetId !== "string" || !presetId) {
+                    res.writeHead(400, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({
+                        ok: false,
+                        error: "presetId required",
+                    }));
+                    return;
+                }
+                if (!this.launchQuickTaskFn) {
+                    res.writeHead(503, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({
+                        ok: false,
+                        error: "Quick tasks unavailable — requires --claude-driver subprocess",
+                    }));
+                    return;
+                }
+                const result = await this.launchQuickTaskFn(presetId, source);
+                res.writeHead(result.ok ? 200 : 429, {
+                    "Content-Type": "application/json",
                 });
+                res.end(JSON.stringify(result));
                 return;
             }
             // MCP Streamable HTTP transport — POST/GET/DELETE /mcp.
@@ -1283,11 +1289,9 @@ export class Server extends EventEmitter {
                     req.method === "GET" ||
                     req.method === "DELETE") {
                     this.httpMcpHandler(req, res).catch((err) => {
-                        this.logger.error(`HTTP MCP handler error: ${err instanceof Error ? err.message : String(err)}`);
-                        if (!res.headersSent) {
-                            res.writeHead(500, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({ error: String(err) }));
-                        }
+                        // respond500 logs the underlying error detail server-side; no
+                        // need to also funnel it through this.logger.
+                        respond500(res, err, "/mcp HTTP handler");
                     });
                     return;
                 }