patchwork-os 0.2.0-beta.5.canary.13 → 0.2.0-beta.5.canary.131

package/dist/server.d.ts

@@ -35,9 +35,23 @@ export declare class Server extends EventEmitter<ServerEvents> {
     private oauthServer;
     private oauthIssuerUrl;
     private sseSubscriberCount;
+    /**
+     * Registered SSE subscribers on `/stream`, oldest-first by insertion
+     * order. Used as a defense-in-depth backstop: if a subscriber's peer is
+     * a dead-but-not-erroring socket (e.g. an orphaned proxy connection),
+     * the ping-write cleanup can fail to fire and the subscriber leaks. To
+     * guarantee a leak can never *permanently* brick `/stream`, a new
+     * request arriving at the cap evicts the oldest subscriber instead of
+     * returning 503 — mirroring the HTTP-session eviction in ADR-0005.
+     * The real cure for the known leak is the dashboard proxy aborting its
+     * upstream fetch on client disconnect; this is the backstop.
+     */
+    private sseSubscribers;
     /** Cache for CC permission rules (30s TTL) to avoid filesystem walks on each dashboard poll */
     private _explainRulesCache;
     private static readonly MAX_SSE_SUBSCRIBERS;
+    /** Number of currently-registered `/stream` SSE subscribers. Read-only. */
+    get sseSubscribers_count(): number;
     /** Set by bridge to provide health data */
     healthDataFn: (() => Record<string, unknown>) | null;
     /** Set by bridge to provide Prometheus metrics */

package/dist/server.js

@@ -1,8 +1,10 @@
 import { createHmac, timingSafeEqual } from "node:crypto";
 import { EventEmitter } from "node:events";
+import { unlinkSync } from "node:fs";
 import http from "node:http";
 import { WebSocket, WebSocketServer as WsServer } from "ws";
-import { getAnalyticsPrefsAll, getTelemetryPrefs, setTelemetryPrefs, } from "./analyticsPrefs.js";
+import { clearAnalyticsConfig, getAnalyticsConfig } from "./analyticsConfig.js";
+import { getAnalyticsPrefsAll, getAnalyticsPrefsPath, getAnalyticsSaltPath, getTelemetryPrefs, setTelemetryPrefs, } from "./analyticsPrefs.js";
 import { handleApprovalsStream, routeApprovalRequest } from "./approvalHttp.js";
 import { getApprovalQueue } from "./approvalQueue.js";
 import { saveBridgeConfigDriver } from "./config.js";
@@ -65,9 +67,25 @@ export class Server extends EventEmitter {
     oauthServer = null;
     oauthIssuerUrl = null;
     sseSubscriberCount = 0;
+    /**
+     * Registered SSE subscribers on `/stream`, oldest-first by insertion
+     * order. Used as a defense-in-depth backstop: if a subscriber's peer is
+     * a dead-but-not-erroring socket (e.g. an orphaned proxy connection),
+     * the ping-write cleanup can fail to fire and the subscriber leaks. To
+     * guarantee a leak can never *permanently* brick `/stream`, a new
+     * request arriving at the cap evicts the oldest subscriber instead of
+     * returning 503 — mirroring the HTTP-session eviction in ADR-0005.
+     * The real cure for the known leak is the dashboard proxy aborting its
+     * upstream fetch on client disconnect; this is the backstop.
+     */
+    sseSubscribers = new Set();
     /** Cache for CC permission rules (30s TTL) to avoid filesystem walks on each dashboard poll */
     _explainRulesCache = null;
     static MAX_SSE_SUBSCRIBERS = 20;
+    /** Number of currently-registered `/stream` SSE subscribers. Read-only. */
+    get sseSubscribers_count() {
+        return this.sseSubscriberCount;
+    }
     /** Set by bridge to provide health data */
     healthDataFn = null;
     /** Set by bridge to provide Prometheus metrics */
@@ -772,10 +790,18 @@ export class Server extends EventEmitter {
                 return;
             }
             if (req.url === "/stream" && req.method === "GET") {
+                // Backstop (ADR-0005 pattern): at the cap, evict the oldest
+                // subscriber rather than returning 503 forever. A leaked
+                // subscriber whose socket is dead-but-not-erroring can otherwise
+                // permanently brick /stream. The dashboard proxy abort-on-disconnect
+                // fix is the real cure; this guarantees recovery either way.
+                // sseSubscriberCount and sseSubscribers.size stay in lockstep
+                // (both mutated together below + in cleanup()), so when the
+                // counter is at the cap there is always an evictable subscriber —
+                // eviction always frees the slot.
                 if (this.sseSubscriberCount >= Server.MAX_SSE_SUBSCRIBERS) {
-                    res.writeHead(503, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "Too many SSE subscribers (max 20)" }));
-                    return;
+                    const oldest = this.sseSubscribers.values().next().value;
+                    oldest?.();
                 }
                 this.sseSubscriberCount++;
                 // Disable socket timeout — SSE connections are long-lived by design
@@ -798,15 +824,24 @@ export class Server extends EventEmitter {
                 let cleanedUp = false;
                 let pingHandle = null;
                 let unsub = () => { };
+                // Single teardown closure, also stored directly in the registry
+                // as this subscriber's eviction handler — it tears down state AND
+                // destroys the socket so the peer (and any orphaned proxy in
+                // between) observes the close. It removes this exact function
+                // from the Set, so no placeholder/no-op function is ever created.
                 const cleanup = () => {
                     if (cleanedUp)
                         return;
                     cleanedUp = true;
                     this.sseSubscriberCount--;
+                    this.sseSubscribers.delete(cleanup);
                     if (pingHandle)
                         clearInterval(pingHandle);
                     unsub();
+                    res.end();
+                    res.socket?.destroy();
                 };
+                this.sseSubscribers.add(cleanup);
                 unsub =
                     this.streamFn?.((kind, entry) => {
                         try {
@@ -1159,6 +1194,21 @@ export class Server extends EventEmitter {
                 return;
             }
             if (parsedUrl.pathname === "/settings" && req.method === "POST") {
+                // Kill-switch gate: during an incident a settings mutation can
+                // defeat the panic posture (e.g. switching driver to one with a
+                // leaked API key, flipping approvalGate to "off"). The /settings
+                // card on the dashboard sits directly above the kill-switch
+                // toggle — users will reasonably read "writes blocked" as
+                // covering both. Refuse with 423 Locked; the /kill-switch
+                // endpoint itself is the only way out and is not gated.
+                if (isWriteKillSwitchActive()) {
+                    res.writeHead(423, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({
+                        error: "kill_switch_blocked",
+                        reason: "Settings writes are disabled while the write kill-switch is engaged. Release it via POST /kill-switch to mutate config.",
+                    }));
+                    return;
+                }
                 // 16 KB — settings POSTs are short-string fields (URLs, API keys,
                 // gate level). 16 KB is generous; an authenticated attacker can't
                 // stream gigabytes here.
@@ -1280,6 +1330,20 @@ export class Server extends EventEmitter {
                             respond400("pushServiceUrl must be HTTPS");
                             return;
                         }
+                        // pushServiceToken — bearer for the push relay. Charset cap to
+                        // printable ASCII (no newlines / control chars) so it can't
+                        // header-inject when later interpolated into an outgoing
+                        // `Authorization` header. 512 chars is an order of magnitude
+                        // above any realistic relay token.
+                        const pushTokenTrimmed = body.pushServiceToken !== undefined
+                            ? body.pushServiceToken.trim()
+                            : undefined;
+                        if (pushTokenTrimmed !== undefined &&
+                            pushTokenTrimmed !== "" &&
+                            !/^[\x21-\x7E]{1,512}$/.test(pushTokenTrimmed)) {
+                            respond400("pushServiceToken must be 1-512 printable ASCII characters");
+                            return;
+                        }
                         // pushServiceBaseUrl — bridge callback origin embedded in SW
                         // approveUrl/rejectUrl. http:// or attacker host = approval token
                         // exfiltration. Validate before persisting.
@@ -1387,8 +1451,8 @@ export class Server extends EventEmitter {
                         if (pushUrlTrimmed !== undefined) {
                             cfg.pushServiceUrl = pushUrlTrimmed || undefined;
                         }
-                        if (body.pushServiceToken !== undefined) {
-                            cfg.pushServiceToken = body.pushServiceToken.trim() || undefined;
+                        if (pushTokenTrimmed !== undefined) {
+                            cfg.pushServiceToken = pushTokenTrimmed || undefined;
                         }
                         if (pushBaseTrimmed !== undefined) {
                             cfg.pushServiceBaseUrl = pushBaseTrimmed || undefined;
@@ -1407,7 +1471,19 @@ export class Server extends EventEmitter {
                                 saveApiKeyToSecureStore(body.apiKey.provider, body.apiKey.key);
                             }
                             catch (writeErr) {
-                                this.logger.error(`[/config/patchwork] saveApiKeyToSecureStore failed: ${writeErr instanceof Error ? writeErr.message : String(writeErr)}`);
+                                // Some Keychain / Secret-Service backends echo the
+                                // payload into the error message on certain failure
+                                // modes. Cap the logged message at 200 chars AND
+                                // strip anything that looks like the leading hex/
+                                // base64 of the just-attempted key so a misbehaving
+                                // backend can't leak it into bridge logs.
+                                const raw = writeErr instanceof Error
+                                    ? writeErr.message
+                                    : String(writeErr);
+                                const safe = raw
+                                    .replaceAll(body.apiKey.key, "[redacted]")
+                                    .slice(0, 200);
+                                this.logger.error(`[/config/patchwork] saveApiKeyToSecureStore failed: ${safe}`);
                                 res.writeHead(500, { "Content-Type": "application/json" });
                                 res.end(JSON.stringify({ error: "Failed to write provider API key" }));
                                 return;
@@ -1438,7 +1514,20 @@ export class Server extends EventEmitter {
                         // PHASE 4 — live state. Only after every persistence step
                         // succeeded; ensures live state never diverges from disk.
                         if (gateRaw !== undefined) {
+                            const prevGate = this.approvalGate;
                             this.approvalGate = gateRaw;
+                            // When the operator downgrades to "off", every pending
+                            // queue entry becomes moot — the originating tool dispatch
+                            // now bypasses, and a phone approver who hits "Approve"
+                            // five seconds later would get a 404. Cancel them
+                            // server-side so the dashboard /approvals list clears
+                            // and any pending phone notification reflects reality.
+                            if (gateRaw === "off" && prevGate !== "off") {
+                                const cancelled = getApprovalQueue().cancelAll();
+                                if (cancelled > 0) {
+                                    this.logger.info(`[/settings] approvalGate → off; cancelled ${cancelled} pending entr${cancelled === 1 ? "y" : "ies"}`);
+                                }
+                            }
                         }
                         if (body.enableTimeOfDayAnomaly !== undefined) {
                             this.enableTimeOfDayAnomaly = body.enableTimeOfDayAnomaly;
@@ -1449,8 +1538,8 @@ export class Server extends EventEmitter {
                         if (pushUrlTrimmed !== undefined) {
                             this.pushServiceUrl = pushUrlTrimmed || undefined;
                         }
-                        if (body.pushServiceToken !== undefined) {
-                            this.pushServiceToken = body.pushServiceToken.trim() || undefined;
+                        if (pushTokenTrimmed !== undefined) {
+                            this.pushServiceToken = pushTokenTrimmed || undefined;
                         }
                         if (pushBaseTrimmed !== undefined) {
                             this.pushServiceBaseUrl = pushBaseTrimmed || undefined;
@@ -1471,6 +1560,52 @@ export class Server extends EventEmitter {
                             body.model !== undefined ||
                             body.localEndpoint !== undefined ||
                             body.localModel !== undefined;
+                        // Audit-log emission — forensic record of every config mutation
+                        // so an operator can answer "who changed what, when?" after an
+                        // incident. Bearer-token auth doesn't carry an actor identity
+                        // (no user JWT) so we attribute to "http" with the request IP.
+                        // Secrets are redacted to the shape `"***"` — value presence
+                        // is recorded, value content is never logged.
+                        if (this.activityLog) {
+                            const changes = {};
+                            if (hasWebhookUpdate)
+                                changes.webhookUrl = webhookRaw || "";
+                            if (gateRaw !== undefined)
+                                changes.approvalGate = gateRaw;
+                            if (body.enableTimeOfDayAnomaly !== undefined)
+                                changes.enableTimeOfDayAnomaly = body.enableTimeOfDayAnomaly;
+                            if (driverRaw !== undefined)
+                                changes.driver = driverRaw;
+                            if (body.model !== undefined)
+                                changes.model = body.model;
+                            if (body.localEndpoint !== undefined)
+                                changes.localEndpoint = body.localEndpoint;
+                            if (body.localModel !== undefined)
+                                changes.localModel = body.localModel;
+                            if (body.apiKey)
+                                changes.apiKey = { provider: body.apiKey.provider, key: "***" };
+                            if (pushUrlTrimmed !== undefined)
+                                changes.pushServiceUrl = pushUrlTrimmed || "";
+                            if (pushTokenTrimmed !== undefined)
+                                changes.pushServiceToken = pushTokenTrimmed ? "***" : "";
+                            if (pushBaseTrimmed !== undefined)
+                                changes.pushServiceBaseUrl = pushBaseTrimmed || "";
+                            if (ntfyTopicTrimmed !== undefined)
+                                changes.ntfyTopic = ntfyTopicTrimmed ? "***" : "";
+                            if (ntfyServerTrimmed !== undefined)
+                                changes.ntfyServer = ntfyServerTrimmed || "";
+                            const remoteAddr = req.headers["x-forwarded-for"]
+                                ?.split(",")[0]
+                                ?.trim() ||
+                                req.socket.remoteAddress ||
+                                "unknown";
+                            this.activityLog.recordEvent("settings.change", {
+                                actor: "http",
+                                ip: remoteAddr,
+                                fields: Object.keys(changes),
+                                changes,
+                            });
+                        }
                         res.writeHead(200, { "Content-Type": "application/json" });
                         res.end(JSON.stringify({ ok: true, restartRequired }));
                     }
@@ -1613,8 +1748,10 @@ export class Server extends EventEmitter {
                 }
             }
             // /telemetry-prefs — read/write per-flag telemetry preferences.
-            // GET  → {crashReports, usageStats, localDiagnostics}
-            // POST {crashReports?, usageStats?, localDiagnostics?} → same shape (partial update)
+            // GET    → {crashReports, usageStats, localDiagnostics, endpoint, endpointSource}
+            // POST   {crashReports?, usageStats?, localDiagnostics?} → same shape (partial update)
+            // DELETE → clears prefs file + analytics-config + install salt
+            //          (right-to-erasure affordance).
             if (parsedUrl.pathname === "/telemetry-prefs") {
                 if (req.method === "GET") {
                     const prefs = getTelemetryPrefs();
@@ -1623,11 +1760,74 @@ export class Server extends EventEmitter {
                     if (all?.lastSentAt !== undefined) {
                         response.lastSentAt = all.lastSentAt;
                     }
+                    // Destination visibility — consent baseline. Caller can see
+                    // where their data would go and whether the destination came
+                    // from env (CI/headless) or the on-disk config file.
+                    const envEndpoint = process.env.PATCHWORK_ANALYTICS_ENDPOINT;
+                    const cfgEndpoint = getAnalyticsConfig().endpoint;
+                    const defaultEndpoint = "https://analytics.claude-ide-bridge.dev/v1/usage";
+                    if (envEndpoint) {
+                        response.endpoint = envEndpoint;
+                        response.endpointSource = "env";
+                    }
+                    else if (cfgEndpoint) {
+                        response.endpoint = cfgEndpoint;
+                        response.endpointSource = "config";
+                    }
+                    else {
+                        response.endpoint = defaultEndpoint;
+                        response.endpointSource = "default";
+                    }
                     res.writeHead(200, { "Content-Type": "application/json" });
                     res.end(JSON.stringify(response));
                     return;
                 }
+                if (req.method === "DELETE") {
+                    // Right-to-erasure: drop prefs, analytics-config (endpoint /
+                    // shared secret), and the install salt. Next outbound send
+                    // (if any) will mint a fresh salt and treat this as a new
+                    // install. Kill-switch is honored here too — incident-mode
+                    // operators may still want to scrub local state, so allow
+                    // it; flip if the threat model changes.
+                    try {
+                        unlinkSync(getAnalyticsPrefsPath());
+                    }
+                    catch {
+                        /* missing is fine */
+                    }
+                    try {
+                        unlinkSync(getAnalyticsSaltPath());
+                    }
+                    catch {
+                        /* missing is fine */
+                    }
+                    clearAnalyticsConfig();
+                    if (this.activityLog) {
+                        this.activityLog.recordEvent("telemetry.reset", {
+                            actor: "http",
+                            ip: req.headers["x-forwarded-for"]
+                                ?.split(",")[0]
+                                ?.trim() ||
+                                req.socket.remoteAddress ||
+                                "unknown",
+                        });
+                    }
+                    res.writeHead(200, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ ok: true }));
+                    return;
+                }
                 if (req.method === "POST") {
+                    // Kill-switch gate — telemetry prefs are config writes too.
+                    // GET stays open so operators can verify state during an
+                    // incident.
+                    if (isWriteKillSwitchActive()) {
+                        res.writeHead(423, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify({
+                            error: "kill_switch_blocked",
+                            reason: "Telemetry pref writes are disabled while the write kill-switch is engaged.",
+                        }));
+                        return;
+                    }
                     const TP_BODY_CAP = 1 * 1024;
                     const parsed = await readJsonBody(req, TP_BODY_CAP);
                     if (!parsed.ok) {