patchwork-os 0.2.0-beta.0 → 0.2.0-beta.2

package/dist/server.js

@@ -7,11 +7,12 @@ import { saveBridgeConfigDriver } from "./config.js";
 import { tryHandleConnectorRoute, tryHandlePublicConnectorRoute, } from "./connectorRoutes.js";
 import { timingSafeStringEqual } from "./crypto.js";
 import { renderDashboardHtml } from "./dashboard.js";
+import { respond500 } from "./httpErrorResponse.js";
 import { tryHandleInboxRoute } from "./inboxRoutes.js";
 import { tryHandleMcpRoute } from "./mcpRoutes.js";
 import { tryHandleOAuthRoute } from "./oauthRoutes.js";
-import { loadConfig as loadPatchworkConfig, defaultConfigPath as patchworkConfigPath, saveConfig as savePatchworkConfig, } from "./patchworkConfig.js";
-import { tryHandleRecipeRoute } from "./recipeRoutes.js";
+import { loadConfig as loadPatchworkConfig, defaultConfigPath as patchworkConfigPath, saveApiKeyToSecureStore, saveConfig as savePatchworkConfig, } from "./patchworkConfig.js";
+import { readBodyWithCap, readJsonBody, respond413, tryHandleRecipeRoute, } from "./recipeRoutes.js";
 import { PACKAGE_VERSION } from "./version.js";
 const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
 const SESSION_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -48,6 +49,7 @@ export class Server extends EventEmitter {
     logger;
     extraCorsOrigins;
     pingIntervalMs;
+    trustedProxies;
     httpServer;
     wss;
     pingInterval = null;
@@ -87,6 +89,8 @@ export class Server extends EventEmitter {
     saveRecipeContentFn = null;
     /** Patchwork: set by bridge to delete a recipe by name. */
     deleteRecipeContentFn = null;
+    /** Patchwork: set by bridge to archive a recipe (move to .archive/). */
+    archiveRecipeFn = null;
     /** Patchwork: set by bridge to promote a variant recipe to the canonical name. */
     promoteRecipeVariantFn = null;
     /** Patchwork: set by bridge to duplicate a recipe as a variant. */
@@ -120,6 +124,10 @@ export class Server extends EventEmitter {
     pushServiceToken = undefined;
     /** Patchwork: public base URL of this bridge, embedded in push payloads as callback base. */
     pushServiceBaseUrl = undefined;
+    /** Patchwork: ntfy.sh topic for direct phone-path approvals via action buttons. */
+    ntfyTopic = undefined;
+    /** Patchwork: ntfy server (default https://ntfy.sh; override for self-hosted). */
+    ntfyServer = undefined;
     /** Patchwork: approval decision audit callback wired to activityLog.recordEvent. */
     onApprovalDecision = undefined;
     /**
@@ -154,6 +162,36 @@ export class Server extends EventEmitter {
      */
     webhookPayloads = new Map();
     static MAX_WEBHOOK_PAYLOADS = 5;
+    /**
+     * Per-list FIFO bounds the per-recipe payload count, but the Map itself
+     * needs a key cap so a recipe-rename loop or a scanner hitting many
+     * distinct legitimate hookPaths can't grow `webhookPayloads.size`
+     * without bound. 1000 is generous for any realistic operator deployment
+     * (5 payloads × 1000 recipes = ~5000 entries × ~10 KB each = 50 MB).
+     * On overflow, evict the oldest *recipe* (Map iteration order is
+     * insertion order in JS), not the largest list.
+     */
+    static MAX_WEBHOOK_RECIPES = 1000;
+    /**
+     * Per-IP rate limit on the unauthenticated phone-path approval endpoints
+     * (`POST /approve/:callId` and `POST /reject/:callId` when
+     * `x-approval-token` is present). The auth gate intentionally bypasses
+     * bearer auth for those paths so a phone can dispatch without a bridge
+     * token; without rate limiting, an attacker who learns a callId (via
+     * webhook target leak, bearer-authed `/approvals` reader, etc.) can
+     * spray garbage tokens to DoS the legitimate approver. PR #380 bumped
+     * the per-callId failure cap to 1000 (memory bound, not security
+     * bound); this is the HTTP-layer spray defense flagged as the proper
+     * fix in that commit.
+     *
+     * 60 attempts per IP per minute is generous for legitimate retries
+     * (phone re-tap, network flake) and tight enough to bound brute-force
+     * attempts during the 5-minute approval TTL to 300 — well within the
+     * per-callId cap, so no legit retry budget is consumed by sprayers.
+     */
+    approvalIpCounts = new Map();
+    static APPROVAL_IP_MAX = 60;
+    static APPROVAL_IP_WINDOW_MS = 60_000;
     /** Set by bridge to handle MCP Streamable HTTP sessions (POST/GET/DELETE /mcp) */
     httpMcpHandler = null;
     /** Set by bridge to subscribe a caller to real-time activity events. Returns unsubscribe fn. */
@@ -193,12 +231,19 @@ export class Server extends EventEmitter {
     }
     /** Hosts accepted in the WebSocket upgrade Host header (DNS-rebinding guard). */
     allowedHosts;
-    constructor(authToken, logger, extraCorsOrigins = [], pingIntervalMs = 30_000) {
+    constructor(authToken, logger, extraCorsOrigins = [], pingIntervalMs = 30_000, 
+    // Reverse-proxy hops whose X-Forwarded-For values we trust. Empty by
+    // default — the per-IP rate limiter buckets on the direct socket peer.
+    // Behind nginx/Caddy/Cloudflare set this to the proxy's IP so distinct
+    // real clients get distinct buckets; otherwise every request looks
+    // like 127.0.0.1 and a single sprayer DoSes the legit approver.
+    trustedProxies = []) {
         super();
         this.authToken = authToken;
         this.logger = logger;
         this.extraCorsOrigins = extraCorsOrigins;
         this.pingIntervalMs = pingIntervalMs;
+        this.trustedProxies = trustedProxies;
         // Defense-in-depth: ensure token is non-empty so timingSafeTokenCompare
         // cannot accept a blank Authorization header against an empty token.
         if (authToken.length === 0) {
@@ -347,10 +392,7 @@ export class Server extends EventEmitter {
                     res.end(JSON.stringify(body, null, 2));
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
@@ -376,6 +418,51 @@ export class Server extends EventEmitter {
             const isPhoneApprovalPath = req.method === "POST" &&
                 /^\/(approve|reject)\/[A-Za-z0-9-]+$/.test(parsedUrl.pathname) &&
                 !!req.headers["x-approval-token"];
+            // Rate-limit the phone bypass surface. Only applies when this is
+            // actually a phone-path request that's relying on the bypass — a
+            // properly-authenticated bearer caller is unaffected. Counted +
+            // checked *before* dispatch so a sprayer can't burn the per-callId
+            // failure budget at line-rate.
+            if (isPhoneApprovalPath && !isStaticToken && !oauthResolved) {
+                const remoteIp = this.getClientIp(req);
+                if (!remoteIp) {
+                    // Fail closed — without an attributable IP we cannot bucket
+                    // safely, and the original "unknown" string was a single shared
+                    // counter every IP-less request rolled up into.
+                    res.writeHead(400, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({
+                        error: "bad_request",
+                        error_description: "could not determine client IP",
+                    }));
+                    return;
+                }
+                const now = Date.now();
+                const entry = this.approvalIpCounts.get(remoteIp);
+                if (entry && now - entry.windowStart < Server.APPROVAL_IP_WINDOW_MS) {
+                    entry.count++;
+                    if (entry.count > Server.APPROVAL_IP_MAX) {
+                        res.writeHead(429, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify({
+                            error: "too_many_requests",
+                            error_description: "per-IP approval endpoint rate limit reached",
+                        }));
+                        return;
+                    }
+                }
+                else {
+                    this.approvalIpCounts.set(remoteIp, { count: 1, windowStart: now });
+                }
+                // GC stale entries opportunistically — bounded growth alongside
+                // the same Map. 200 is well above any legitimate concurrent IP
+                // count; well below memory pressure.
+                if (this.approvalIpCounts.size > 200) {
+                    for (const [k, v] of this.approvalIpCounts) {
+                        if (now - v.windowStart > Server.APPROVAL_IP_WINDOW_MS) {
+                            this.approvalIpCounts.delete(k);
+                        }
+                    }
+                }
+            }
             // oauthResolved is the bridge token if the OAuth token is valid; null otherwise
             if (!isStaticToken && !oauthResolved && !isPhoneApprovalPath) {
                 // RFC 6750: only include error= when a token was actually presented but invalid
@@ -399,10 +486,7 @@ export class Server extends EventEmitter {
                     res.end(body);
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
@@ -418,10 +502,7 @@ export class Server extends EventEmitter {
                     res.end(JSON.stringify(data));
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
@@ -436,10 +517,7 @@ export class Server extends EventEmitter {
                     res.end(JSON.stringify({ events: data, count: data.length }));
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
@@ -475,10 +553,7 @@ export class Server extends EventEmitter {
                     res.end(JSON.stringify(data));
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
@@ -549,12 +624,7 @@ export class Server extends EventEmitter {
                         }
                     }
                     catch (err) {
-                        if (!res.headersSent) {
-                            res.writeHead(500, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({
-                                error: err instanceof Error ? err.message : String(err),
-                            }));
-                        }
+                        respond500(res, err);
                     }
                 })();
                 return;
@@ -577,10 +647,7 @@ export class Server extends EventEmitter {
                     res.end(JSON.stringify(data));
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
@@ -594,10 +661,7 @@ export class Server extends EventEmitter {
                     res.end(JSON.stringify(data));
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
@@ -625,10 +689,7 @@ export class Server extends EventEmitter {
                     }
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
@@ -681,10 +742,7 @@ export class Server extends EventEmitter {
                     res.end(JSON.stringify(data));
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
@@ -703,67 +761,77 @@ export class Server extends EventEmitter {
                     }
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
             if (parsedUrl.pathname?.startsWith("/hooks/") && req.method === "POST") {
                 const hookPath = parsedUrl.pathname.substring("/hooks".length);
-                const chunks = [];
-                req.on("data", (c) => chunks.push(c));
-                req.on("end", () => {
-                    void (async () => {
-                        let payload;
-                        if (chunks.length > 0) {
-                            const body = Buffer.concat(chunks).toString("utf-8");
-                            if (body.trim()) {
-                                try {
-                                    payload = JSON.parse(body);
-                                }
-                                catch {
-                                    payload = body;
-                                }
-                            }
-                        }
-                        if (!this.webhookFn) {
-                            res.writeHead(503, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({
-                                ok: false,
-                                error: "Webhooks unavailable — start bridge with --claude-driver subprocess",
-                            }));
-                            return;
-                        }
-                        const result = await this.webhookFn(hookPath, payload);
-                        const status = result.ok
-                            ? 200
-                            : result.error === "not_found"
-                                ? 404
-                                : 400;
-                        // Record in ring buffer so the dashboard can show "last
-                        // payload" per recipe. Skip not_found so unknown paths don't
-                        // pollute the buffer with garbage / scanner traffic.
-                        if (result.error !== "not_found") {
-                            const existing = this.webhookPayloads.get(hookPath) ?? [];
-                            existing.unshift({
-                                receivedAt: Date.now(),
-                                payload,
-                                ok: result.ok,
-                                error: result.error,
-                                taskId: result.taskId,
-                                recipeName: result.name,
-                            });
-                            if (existing.length > Server.MAX_WEBHOOK_PAYLOADS) {
-                                existing.length = Server.MAX_WEBHOOK_PAYLOADS;
-                            }
-                            this.webhookPayloads.set(hookPath, existing);
-                        }
-                        res.writeHead(status, { "Content-Type": "application/json" });
-                        res.end(JSON.stringify(result));
-                    })();
-                });
+                // 256 KB — webhook payloads from GitHub/Linear/etc. are typically
+                // 1–25 KB; 256 KB matches RECIPE_ROUTE_BODY_CAPS.content as a
+                // generous ceiling that still bounds an authenticated DoS vector.
+                const HOOKS_BODY_CAP = 256 * 1024;
+                const read = await readBodyWithCap(req, HOOKS_BODY_CAP);
+                if (!read.ok) {
+                    respond413(res, HOOKS_BODY_CAP);
+                    return;
+                }
+                let payload;
+                if (read.body.trim()) {
+                    try {
+                        payload = JSON.parse(read.body);
+                    }
+                    catch {
+                        payload = read.body;
+                    }
+                }
+                if (!this.webhookFn) {
+                    res.writeHead(503, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({
+                        ok: false,
+                        error: "Webhooks unavailable — start bridge with --claude-driver subprocess",
+                    }));
+                    return;
+                }
+                const result = await this.webhookFn(hookPath, payload);
+                const status = result.ok
+                    ? 200
+                    : result.error === "not_found"
+                        ? 404
+                        : 400;
+                // Record in ring buffer so the dashboard can show "last
+                // payload" per recipe. Skip not_found so unknown paths don't
+                // pollute the buffer with garbage / scanner traffic.
+                if (result.error !== "not_found") {
+                    const existing = this.webhookPayloads.get(hookPath) ?? [];
+                    existing.unshift({
+                        receivedAt: Date.now(),
+                        payload,
+                        ok: result.ok,
+                        error: result.error,
+                        taskId: result.taskId,
+                        recipeName: result.name,
+                    });
+                    if (existing.length > Server.MAX_WEBHOOK_PAYLOADS) {
+                        existing.length = Server.MAX_WEBHOOK_PAYLOADS;
+                    }
+                    // LRU eviction: Map.set() on an existing key keeps original
+                    // insertion-order position (per spec), so a hot recipe registered
+                    // at startup would otherwise be evicted in favor of a cold
+                    // scanner-spam recipe just because it was registered earlier.
+                    // Delete + re-set re-anchors the key to the END of insertion
+                    // order, making `.keys().next()` correctly point at the
+                    // least-recently-fired recipe.
+                    this.webhookPayloads.delete(hookPath);
+                    if (this.webhookPayloads.size >= Server.MAX_WEBHOOK_RECIPES) {
+                        const oldest = this.webhookPayloads.keys().next().value;
+                        if (oldest !== undefined)
+                            this.webhookPayloads.delete(oldest);
+                    }
+                    this.webhookPayloads.set(hookPath, existing);
+                }
+                res.writeHead(status, { "Content-Type": "application/json" });
+                res.end(JSON.stringify(result));
                 return;
             }
             if (parsedUrl.pathname?.startsWith("/webhook-payloads/") &&
@@ -916,6 +984,7 @@ export class Server extends EventEmitter {
                 loadRecipeContentFn: this.loadRecipeContentFn,
                 saveRecipeContentFn: this.saveRecipeContentFn,
                 deleteRecipeContentFn: this.deleteRecipeContentFn,
+                archiveRecipeFn: this.archiveRecipeFn,
                 duplicateRecipeFn: this.duplicateRecipeFn,
                 promoteRecipeVariantFn: this.promoteRecipeVariantFn,
                 lintRecipeContentFn: this.lintRecipeContentFn,
@@ -943,10 +1012,7 @@ export class Server extends EventEmitter {
                     res.end(JSON.stringify(data));
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
@@ -962,19 +1028,28 @@ export class Server extends EventEmitter {
                     res.end(JSON.stringify(data));
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
             if (parsedUrl.pathname === "/settings" && req.method === "POST") {
-                const chunks = [];
-                req.on("data", (c) => chunks.push(c));
-                req.on("end", () => {
-                    try {
-                        const body = JSON.parse(Buffer.concat(chunks).toString("utf-8"));
+                // 16 KB — settings POSTs are short-string fields (URLs, API keys,
+                // gate level). 16 KB is generous; an authenticated attacker can't
+                // stream gigabytes here.
+                const SETTINGS_BODY_CAP = 16 * 1024;
+                const parsed = await readJsonBody(req, SETTINGS_BODY_CAP);
+                if (!parsed.ok) {
+                    if (parsed.code === "too_large") {
+                        respond413(res, SETTINGS_BODY_CAP);
+                        return;
+                    }
+                    res.writeHead(400, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "Invalid request body" }));
+                    return;
+                }
+                try {
+                    {
+                        const body = parsed.value ?? {};
                         const hasWebhookUpdate = body.webhookUrl !== undefined;
                         const raw = hasWebhookUpdate
                             ? (body.webhookUrl?.trim() ?? "")
@@ -1032,6 +1107,8 @@ export class Server extends EventEmitter {
                                 "openai",
                                 "grok",
                                 "gemini",
+                                "gemini-api",
+                                "local",
                                 "none",
                             ];
                             if (!validDrivers.includes(driverRaw)) {
@@ -1043,7 +1120,17 @@ export class Server extends EventEmitter {
                             }
                             const driver = driverRaw;
                             cfg.driver = driver;
-                            saveBridgeConfigDriver(driver, this.bridgeConfigPath);
+                            try {
+                                saveBridgeConfigDriver(driver, this.bridgeConfigPath);
+                            }
+                            catch (writeErr) {
+                                this.logger.error(`[/config/patchwork] saveBridgeConfigDriver failed: ${writeErr instanceof Error ? (writeErr.stack ?? writeErr.message) : String(writeErr)}`);
+                                res.writeHead(500, { "Content-Type": "application/json" });
+                                res.end(JSON.stringify({
+                                    error: "Failed to write bridge driver config",
+                                }));
+                                return;
+                            }
                         }
                         if (body.model !== undefined) {
                             const validModels = [
@@ -1077,9 +1164,32 @@ export class Server extends EventEmitter {
                                 res.end(JSON.stringify({ error: "Invalid apiKey provider or key" }));
                                 return;
                             }
-                            cfg.apiKeys = { ...cfg.apiKeys, [provider]: key || undefined };
+                            // Provider keys go to the secure store (Keychain/DPAPI/Secret
+                            // Service / AES-256-GCM file fallback) — never persisted to
+                            // ~/.patchwork/config.json. Empty string clears.
+                            try {
+                                saveApiKeyToSecureStore(provider, key);
+                            }
+                            catch (writeErr) {
+                                this.logger.error(`[/config/patchwork] saveApiKeyToSecureStore failed: ${writeErr instanceof Error ? (writeErr.stack ?? writeErr.message) : String(writeErr)}`);
+                                res.writeHead(500, { "Content-Type": "application/json" });
+                                res.end(JSON.stringify({
+                                    error: "Failed to write provider API key",
+                                }));
+                                return;
+                            }
+                        }
+                        try {
+                            savePatchworkConfig(cfg, configPath);
+                        }
+                        catch (writeErr) {
+                            this.logger.error(`[/config/patchwork] savePatchworkConfig failed: ${writeErr instanceof Error ? (writeErr.stack ?? writeErr.message) : String(writeErr)}`);
+                            res.writeHead(500, { "Content-Type": "application/json" });
+                            res.end(JSON.stringify({
+                                error: "Failed to write patchwork config",
+                            }));
+                            return;
                         }
-                        savePatchworkConfig(cfg, configPath);
                         if (hasWebhookUpdate) {
                             this.approvalWebhookUrl = raw || undefined;
                         }
@@ -1096,8 +1206,46 @@ export class Server extends EventEmitter {
                             this.pushServiceToken = body.pushServiceToken.trim() || undefined;
                         }
                         if (body.pushServiceBaseUrl !== undefined) {
-                            this.pushServiceBaseUrl =
-                                body.pushServiceBaseUrl.trim() || undefined;
+                            const baseUrl = body.pushServiceBaseUrl.trim();
+                            // pushServiceBaseUrl is the bridge callback origin embedded in
+                            // the SW's approveUrl/rejectUrl. If it can be set to plain
+                            // http:// or to a host the operator didn't intend, the SW will
+                            // POST the one-shot approvalToken there — letting an attacker
+                            // who sets this redirect every approval to attacker.tld and
+                            // replay tokens to the real bridge for silent auto-approve.
+                            if (baseUrl && !baseUrl.startsWith("https://")) {
+                                res.writeHead(400, { "Content-Type": "application/json" });
+                                res.end(JSON.stringify({ error: "pushServiceBaseUrl must be HTTPS" }));
+                                return;
+                            }
+                            this.pushServiceBaseUrl = baseUrl || undefined;
+                        }
+                        if (body.ntfyTopic !== undefined) {
+                            const topic = body.ntfyTopic.trim();
+                            // Topic acts as a bearer token on the public ntfy.sh server —
+                            // anyone subscribed sees the approval payload + single-use
+                            // approvalToken. Reject empty / whitespace / control chars to
+                            // avoid silent misconfiguration.
+                            if (topic && !/^[A-Za-z0-9_-]{1,64}$/.test(topic)) {
+                                res.writeHead(400, { "Content-Type": "application/json" });
+                                res.end(JSON.stringify({
+                                    error: "ntfyTopic must match [A-Za-z0-9_-]{1,64}",
+                                }));
+                                return;
+                            }
+                            this.ntfyTopic = topic || undefined;
+                        }
+                        if (body.ntfyServer !== undefined) {
+                            const server = body.ntfyServer.trim();
+                            // Same reasoning as pushServiceBaseUrl — the bridge sends the
+                            // single-use token to this URL. http:// would expose it on the
+                            // wire; a malicious value would exfiltrate every approval.
+                            if (server && !server.startsWith("https://")) {
+                                res.writeHead(400, { "Content-Type": "application/json" });
+                                res.end(JSON.stringify({ error: "ntfyServer must be HTTPS" }));
+                                return;
+                            }
+                            this.ntfyServer = server || undefined;
                         }
                         const restartRequired = driverRaw !== undefined ||
                             body.apiKey !== undefined ||
@@ -1105,44 +1253,45 @@ export class Server extends EventEmitter {
                         res.writeHead(200, { "Content-Type": "application/json" });
                         res.end(JSON.stringify({ ok: true, restartRequired }));
                     }
-                    catch (err) {
-                        res.writeHead(400, { "Content-Type": "application/json" });
-                        res.end(JSON.stringify({
-                            error: err instanceof Error ? err.message : String(err),
-                        }));
-                    }
-                });
+                }
+                catch (err) {
+                    this.logger.error(`[/config/patchwork] error: ${err instanceof Error ? (err.stack ?? err.message) : String(err)}`);
+                    res.writeHead(400, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "Invalid request body" }));
+                }
                 return;
             }
             // CC hook notify endpoint — lightweight alternative to full MCP session for hook wiring.
             if (parsedUrl.pathname === "/notify" && req.method === "POST") {
-                const chunks = [];
-                req.on("data", (c) => chunks.push(c));
-                req.on("end", () => {
-                    try {
-                        const body = Buffer.concat(chunks).toString("utf-8");
-                        const parsed = JSON.parse(body);
-                        const event = parsed.event ?? "";
-                        const args = parsed.args ?? {};
-                        if (!this.notifyFn) {
-                            res.writeHead(503, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({
-                                ok: false,
-                                error: "Automation not enabled",
-                            }));
-                            return;
-                        }
-                        const result = this.notifyFn(event, args);
-                        res.writeHead(result.ok ? 200 : 400, {
-                            "Content-Type": "application/json",
-                        });
-                        res.end(JSON.stringify(result));
-                    }
-                    catch {
-                        res.writeHead(400, { "Content-Type": "application/json" });
-                        res.end(JSON.stringify({ ok: false, error: "Invalid JSON body" }));
+                // 8 KB — notify payloads carry an event name + small arg map
+                // (taskId, prompt, tool name). 8 KB fits everything we send today
+                // with headroom.
+                const NOTIFY_BODY_CAP = 8 * 1024;
+                const parsed = await readJsonBody(req, NOTIFY_BODY_CAP);
+                if (!parsed.ok) {
+                    if (parsed.code === "too_large") {
+                        respond413(res, NOTIFY_BODY_CAP);
+                        return;
                     }
+                    res.writeHead(400, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ ok: false, error: "Invalid JSON body" }));
+                    return;
+                }
+                const event = parsed.value?.event ?? "";
+                const args = parsed.value?.args ?? {};
+                if (!this.notifyFn) {
+                    res.writeHead(503, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({
+                        ok: false,
+                        error: "Automation not enabled",
+                    }));
+                    return;
+                }
+                const result = this.notifyFn(event, args);
+                res.writeHead(result.ok ? 200 : 400, {
+                    "Content-Type": "application/json",
                 });
+                res.end(JSON.stringify(result));
                 return;
             }
             // Single-approval detail lookup for the dashboard detail page.
@@ -1160,10 +1309,7 @@ export class Server extends EventEmitter {
                     res.end(JSON.stringify(data));
                 }
                 catch (err) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({
-                        error: err instanceof Error ? err.message : String(err),
-                    }));
+                    respond500(res, err);
                 }
                 return;
             }
@@ -1177,101 +1323,101 @@ export class Server extends EventEmitter {
             if (parsedUrl.pathname === "/approvals" ||
                 parsedUrl.pathname === "/cc-permissions" ||
                 /^\/(approve|reject)\/[A-Za-z0-9-]+$/.test(parsedUrl.pathname)) {
-                const chunks = [];
-                req.on("data", (c) => chunks.push(c));
-                req.on("end", async () => {
-                    let parsedBody;
-                    if (chunks.length > 0) {
-                        try {
-                            parsedBody = JSON.parse(Buffer.concat(chunks).toString("utf-8"));
-                        }
-                        catch {
-                            res.writeHead(400, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({ error: "invalid JSON body" }));
-                            return;
-                        }
-                    }
-                    try {
-                        const result = await routeApprovalRequest({
-                            method: req.method ?? "GET",
-                            path: parsedUrl.pathname,
-                            body: parsedBody,
-                            query: parsedUrl.searchParams,
-                            approvalToken: req.headers["x-approval-token"],
-                        }, {
-                            queue: getApprovalQueue(),
-                            workspace: process.cwd(),
-                            managedSettingsPath: this.managedSettingsPath,
-                            onDecision: this.onApprovalDecision,
-                            webhookUrl: this.approvalWebhookUrl,
-                            approvalGate: this.approvalGate,
-                            pushServiceUrl: this.pushServiceUrl,
-                            pushServiceToken: this.pushServiceToken,
-                            pushServiceBaseUrl: this.pushServiceBaseUrl,
-                            activityLog: this.activityLog,
-                            // RecipeRunLog satisfies RecipeRunQuerier structurally
-                            // — the cast bridges TS contravariance: RecipeRunQuerier's
-                            // narrow query interface (`status?: string`) is deliberately
-                            // loose so tests can mock it; RecipeRunLog's stricter
-                            // RunStatus union is a strict subset and fails the param
-                            // contravariance check despite being safe at runtime.
-                            recipeRunLog: this.recipeRunLog,
-                            enableTimeOfDayAnomaly: this.enableTimeOfDayAnomaly,
-                        });
-                        res.writeHead(result.status, {
-                            "Content-Type": "application/json",
-                        });
-                        res.end(JSON.stringify(result.body));
-                    }
-                    catch (err) {
-                        res.writeHead(500, { "Content-Type": "application/json" });
-                        res.end(JSON.stringify({
-                            error: err instanceof Error ? err.message : String(err),
-                        }));
+                // 32 KB — approvals carry decision + reason + optional permission
+                // rule patches; 32 KB matches RECIPE_ROUTE_BODY_CAPS.run. Critical
+                // here: /approve/:id and /reject/:id are reachable via the
+                // x-approval-token phone-path bypass at line 609-612 — without a
+                // cap an unbounded body read happens *before* token validation.
+                const APPROVALS_BODY_CAP = 32 * 1024;
+                const parsed = await readJsonBody(req, APPROVALS_BODY_CAP);
+                if (!parsed.ok) {
+                    if (parsed.code === "too_large") {
+                        respond413(res, APPROVALS_BODY_CAP);
+                        return;
                     }
-                });
+                    res.writeHead(400, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "invalid JSON body" }));
+                    return;
+                }
+                const parsedBody = parsed.value;
+                try {
+                    const result = await routeApprovalRequest({
+                        method: req.method ?? "GET",
+                        path: parsedUrl.pathname,
+                        body: parsedBody,
+                        query: parsedUrl.searchParams,
+                        approvalToken: req.headers["x-approval-token"],
+                    }, {
+                        queue: getApprovalQueue(),
+                        workspace: process.cwd(),
+                        managedSettingsPath: this.managedSettingsPath,
+                        onDecision: this.onApprovalDecision,
+                        webhookUrl: this.approvalWebhookUrl,
+                        approvalGate: this.approvalGate,
+                        pushServiceUrl: this.pushServiceUrl,
+                        pushServiceToken: this.pushServiceToken,
+                        pushServiceBaseUrl: this.pushServiceBaseUrl,
+                        ntfyTopic: this.ntfyTopic,
+                        ntfyServer: this.ntfyServer,
+                        activityLog: this.activityLog,
+                        // RecipeRunLog satisfies RecipeRunQuerier structurally
+                        // — the cast bridges TS contravariance: RecipeRunQuerier's
+                        // narrow query interface (`status?: string`) is deliberately
+                        // loose so tests can mock it; RecipeRunLog's stricter
+                        // RunStatus union is a strict subset and fails the param
+                        // contravariance check despite being safe at runtime.
+                        recipeRunLog: this.recipeRunLog,
+                        enableTimeOfDayAnomaly: this.enableTimeOfDayAnomaly,
+                    });
+                    res.writeHead(result.status, {
+                        "Content-Type": "application/json",
+                    });
+                    res.end(JSON.stringify(result.body));
+                }
+                catch (err) {
+                    respond500(res, err);
+                }
                 return;
             }
             // Quick-task launch endpoint — mirrors /notify pattern. Bearer auth already checked above.
             if (parsedUrl.pathname === "/launch-quick-task" &&
                 req.method === "POST") {
-                const chunks = [];
-                req.on("data", (c) => chunks.push(c));
-                req.on("end", () => {
-                    void (async () => {
-                        try {
-                            const body = Buffer.concat(chunks).toString("utf-8");
-                            const parsed = JSON.parse(body);
-                            const presetId = parsed.presetId;
-                            const source = parsed.source ?? "cli";
-                            if (typeof presetId !== "string" || !presetId) {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({
-                                    ok: false,
-                                    error: "presetId required",
-                                }));
-                                return;
-                            }
-                            if (!this.launchQuickTaskFn) {
-                                res.writeHead(503, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({
-                                    ok: false,
-                                    error: "Quick tasks unavailable — requires --claude-driver subprocess",
-                                }));
-                                return;
-                            }
-                            const result = await this.launchQuickTaskFn(presetId, source);
-                            res.writeHead(result.ok ? 200 : 429, {
-                                "Content-Type": "application/json",
-                            });
-                            res.end(JSON.stringify(result));
-                        }
-                        catch {
-                            res.writeHead(400, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({ ok: false, error: "Invalid JSON body" }));
-                        }
-                    })();
+                // 4 KB — body is `{ presetId?: string; source?: string }`, two
+                // short strings. 4 KB is plenty.
+                const QUICK_TASK_BODY_CAP = 4 * 1024;
+                const parsed = await readJsonBody(req, QUICK_TASK_BODY_CAP);
+                if (!parsed.ok) {
+                    if (parsed.code === "too_large") {
+                        respond413(res, QUICK_TASK_BODY_CAP);
+                        return;
+                    }
+                    res.writeHead(400, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ ok: false, error: "Invalid JSON body" }));
+                    return;
+                }
+                const presetId = parsed.value?.presetId;
+                const source = parsed.value?.source ?? "cli";
+                if (typeof presetId !== "string" || !presetId) {
+                    res.writeHead(400, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({
+                        ok: false,
+                        error: "presetId required",
+                    }));
+                    return;
+                }
+                if (!this.launchQuickTaskFn) {
+                    res.writeHead(503, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({
+                        ok: false,
+                        error: "Quick tasks unavailable — requires --claude-driver subprocess",
+                    }));
+                    return;
+                }
+                const result = await this.launchQuickTaskFn(presetId, source);
+                res.writeHead(result.ok ? 200 : 429, {
+                    "Content-Type": "application/json",
                 });
+                res.end(JSON.stringify(result));
                 return;
             }
             // MCP Streamable HTTP transport — POST/GET/DELETE /mcp.
@@ -1283,11 +1429,9 @@ export class Server extends EventEmitter {
                     req.method === "GET" ||
                     req.method === "DELETE") {
                     this.httpMcpHandler(req, res).catch((err) => {
-                        this.logger.error(`HTTP MCP handler error: ${err instanceof Error ? err.message : String(err)}`);
-                        if (!res.headersSent) {
-                            res.writeHead(500, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({ error: String(err) }));
-                        }
+                        // respond500 logs the underlying error detail server-side; no
+                        // need to also funnel it through this.logger.
+                        respond500(res, err, "/mcp HTTP handler");
                     });
                     return;
                 }
@@ -1420,6 +1564,41 @@ export class Server extends EventEmitter {
             this.emit("connection", ws);
         });
     }
+    /**
+     * Resolve the client IP for rate-limit bucketing on the phone-path
+     * approval bypass. Default: the direct socket peer. When trustedProxies
+     * is set AND the socket peer is one of them, the rightmost X-Forwarded-For
+     * entry not in the trusted list is the real client. XFF from an untrusted
+     * peer is ignored — that header is spoofable by anyone who can reach the
+     * server directly. Returns null when no IP can be determined; the caller
+     * should fail closed.
+     */
+    getClientIp(req) {
+        const socketIp = req.socket?.remoteAddress;
+        if (socketIp &&
+            this.trustedProxies.length > 0 &&
+            this.trustedProxies.includes(socketIp)) {
+            const xffRaw = req.headers["x-forwarded-for"];
+            const xffStr = Array.isArray(xffRaw) ? xffRaw[0] : xffRaw;
+            if (typeof xffStr === "string" && xffStr.length > 0) {
+                const hops = xffStr
+                    .split(",")
+                    .map((s) => s.trim())
+                    .filter((s) => s.length > 0);
+                // Walk right→left (proxies append to the right). The rightmost hop
+                // we DON'T trust is the client; everything to its right is our own
+                // hop chain.
+                for (let i = hops.length - 1; i >= 0; i--) {
+                    const hop = hops[i];
+                    if (hop !== undefined && !this.trustedProxies.includes(hop)) {
+                        return hop.slice(0, 64);
+                    }
+                }
+                // Edge case: every hop is in trustedProxies — unusual; fall through.
+            }
+        }
+        return socketIp ? socketIp.slice(0, 64) : null;
+    }
     async listen(port, bindAddress = "127.0.0.1") {
         const LOOPBACK = new Set(["127.0.0.1", "::1", "localhost"]);
         if (!LOOPBACK.has(bindAddress)) {