patchwork-os 0.2.0-beta.5.canary.2 → 0.2.0-beta.5.canary.21

package/dist/server.js

@@ -9,7 +9,9 @@ import { saveBridgeConfigDriver } from "./config.js";
 import { tryHandleConnectorRoute, tryHandlePublicConnectorRoute, } from "./connectorRoutes.js";
 import { timingSafeStringEqual } from "./crypto.js";
 import { renderDashboardHtml } from "./dashboard.js";
+import { isLoopbackOrPrivateEndpoint } from "./drivers/local/index.js";
 import { EnvLockedFlagError, getEnvLockedValue, isEnvLockedFor, isWriteKillSwitchActive, KILL_SWITCH_WRITES, setFlag, } from "./featureFlags.js";
+import { respondIfUnknownBodyKeys } from "./httpBodyValidation.js";
 import { respond500 } from "./httpErrorResponse.js";
 import { tryHandleInboxRoute } from "./inboxRoutes.js";
 import { tryHandleMcpRoute } from "./mcpRoutes.js";
@@ -1157,6 +1159,21 @@ export class Server extends EventEmitter {
                 return;
             }
             if (parsedUrl.pathname === "/settings" && req.method === "POST") {
+                // Kill-switch gate: during an incident a settings mutation can
+                // defeat the panic posture (e.g. switching driver to one with a
+                // leaked API key, flipping approvalGate to "off"). The /settings
+                // card on the dashboard sits directly above the kill-switch
+                // toggle — users will reasonably read "writes blocked" as
+                // covering both. Refuse with 423 Locked; the /kill-switch
+                // endpoint itself is the only way out and is not gated.
+                if (isWriteKillSwitchActive()) {
+                    res.writeHead(423, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({
+                        error: "kill_switch_blocked",
+                        reason: "Settings writes are disabled while the write kill-switch is engaged. Release it via POST /kill-switch to mutate config.",
+                    }));
+                    return;
+                }
                 // 16 KB — settings POSTs are short-string fields (URLs, API keys,
                 // gate level). 16 KB is generous; an authenticated attacker can't
                 // stream gigabytes here.
@@ -1174,55 +1191,59 @@ export class Server extends EventEmitter {
                 try {
                     {
                         const body = parsed.value ?? {};
+                        if (respondIfUnknownBodyKeys(res, body, [
+                            "webhookUrl",
+                            "approvalGate",
+                            "enableTimeOfDayAnomaly",
+                            "driver",
+                            "model",
+                            "localEndpoint",
+                            "localModel",
+                            "apiKey",
+                            "pushServiceUrl",
+                            "pushServiceToken",
+                            "pushServiceBaseUrl",
+                            "ntfyTopic",
+                            "ntfyServer",
+                        ])) {
+                            return;
+                        }
+                        // PHASE 1 — validate ALL fields up front. No disk writes, no
+                        // secure-store writes, no live-state mutations until every input
+                        // has passed. Prevents the "valid driver + invalid ntfyTopic"
+                        // class of bug where a 400 still leaves a partial side-effect on
+                        // disk.
+                        const respond400 = (error) => {
+                            res.writeHead(400, { "Content-Type": "application/json" });
+                            res.end(JSON.stringify({ error }));
+                        };
+                        // webhookUrl
                         const hasWebhookUpdate = body.webhookUrl !== undefined;
-                        const raw = hasWebhookUpdate
+                        const webhookRaw = hasWebhookUpdate
                             ? (body.webhookUrl?.trim() ?? "")
                             : undefined;
-                        if (raw !== undefined && raw !== "" && !/^https:\/\/.+/.test(raw)) {
-                            res.writeHead(400, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({ error: "webhookUrl must be HTTPS" }));
+                        if (webhookRaw !== undefined &&
+                            webhookRaw !== "" &&
+                            !/^https:\/\/.+/.test(webhookRaw)) {
+                            respond400("webhookUrl must be HTTPS");
                             return;
                         }
+                        // approvalGate
                         const gateRaw = body.approvalGate;
                         if (gateRaw !== undefined &&
                             gateRaw !== "off" &&
                             gateRaw !== "high" &&
                             gateRaw !== "all") {
-                            res.writeHead(400, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({
-                                error: 'approvalGate must be "off", "high", or "all"',
-                            }));
+                            respond400('approvalGate must be "off", "high", or "all"');
                             return;
                         }
-                        const configPath = patchworkConfigPath();
-                        const cfg = loadPatchworkConfig(configPath);
-                        cfg.dashboard = {
-                            port: cfg.dashboard?.port ?? 3200,
-                            requireApproval: cfg.dashboard?.requireApproval ?? ["high"],
-                            pushNotifications: cfg.dashboard?.pushNotifications ?? false,
-                            webhookUrl: hasWebhookUpdate
-                                ? raw || undefined
-                                : cfg.dashboard?.webhookUrl,
-                        };
-                        if (gateRaw !== undefined) {
-                            cfg.approvalGate = gateRaw;
-                            this.approvalGate = gateRaw;
-                        }
-                        // h10 toggle: must be boolean if present. Persists to
-                        // ~/.patchwork/config.json AND live-mutates the Server
-                        // field so the next /approvals POST honors it without
-                        // needing a bridge restart.
-                        if (body.enableTimeOfDayAnomaly !== undefined) {
-                            if (typeof body.enableTimeOfDayAnomaly !== "boolean") {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({
-                                    error: "enableTimeOfDayAnomaly must be a boolean",
-                                }));
-                                return;
-                            }
-                            cfg.enableTimeOfDayAnomaly = body.enableTimeOfDayAnomaly;
-                            this.enableTimeOfDayAnomaly = body.enableTimeOfDayAnomaly;
+                        // enableTimeOfDayAnomaly
+                        if (body.enableTimeOfDayAnomaly !== undefined &&
+                            typeof body.enableTimeOfDayAnomaly !== "boolean") {
+                            respond400("enableTimeOfDayAnomaly must be a boolean");
+                            return;
                         }
+                        // driver
                         const driverRaw = body.driver;
                         if (driverRaw !== undefined) {
                             const validDrivers = [
@@ -1236,26 +1257,11 @@ export class Server extends EventEmitter {
                                 "none",
                             ];
                             if (!validDrivers.includes(driverRaw)) {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({
-                                    error: `driver must be one of: ${validDrivers.join(", ")}`,
-                                }));
-                                return;
-                            }
-                            const driver = driverRaw;
-                            cfg.driver = driver;
-                            try {
-                                saveBridgeConfigDriver(driver, this.bridgeConfigPath);
-                            }
-                            catch (writeErr) {
-                                this.logger.error(`[/config/patchwork] saveBridgeConfigDriver failed: ${writeErr instanceof Error ? (writeErr.stack ?? writeErr.message) : String(writeErr)}`);
-                                res.writeHead(500, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({
-                                    error: "Failed to write bridge driver config",
-                                }));
+                                respond400(`driver must be one of: ${validDrivers.join(", ")}`);
                                 return;
                             }
                         }
+                        // model
                         if (body.model !== undefined) {
                             const validModels = [
                                 "claude",
@@ -1265,40 +1271,172 @@ export class Server extends EventEmitter {
                                 "local",
                             ];
                             if (!validModels.includes(body.model)) {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({
-                                    error: `model must be one of: ${validModels.join(", ")}`,
-                                }));
+                                respond400(`model must be one of: ${validModels.join(", ")}`);
                                 return;
                             }
-                            cfg.model = body.model;
-                            if (body.model === "local") {
-                                if (body.localEndpoint !== undefined)
-                                    cfg.localEndpoint = body.localEndpoint.trim() || undefined;
-                                if (body.localModel !== undefined)
-                                    cfg.localModel = body.localModel.trim() || undefined;
-                            }
                         }
+                        // apiKey
                         if (body.apiKey) {
                             const { provider, key } = body.apiKey;
                             const validProviders = ["anthropic", "openai", "google", "xai"];
                             if (!validProviders.includes(provider) ||
                                 typeof key !== "string") {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({ error: "Invalid apiKey provider or key" }));
+                                respond400("Invalid apiKey provider or key");
+                                return;
+                            }
+                        }
+                        // pushServiceUrl
+                        const pushUrlTrimmed = body.pushServiceUrl !== undefined
+                            ? body.pushServiceUrl.trim()
+                            : undefined;
+                        if (pushUrlTrimmed !== undefined &&
+                            pushUrlTrimmed !== "" &&
+                            !pushUrlTrimmed.startsWith("https://")) {
+                            respond400("pushServiceUrl must be HTTPS");
+                            return;
+                        }
+                        // pushServiceBaseUrl — bridge callback origin embedded in SW
+                        // approveUrl/rejectUrl. http:// or attacker host = approval token
+                        // exfiltration. Validate before persisting.
+                        const pushBaseTrimmed = body.pushServiceBaseUrl !== undefined
+                            ? body.pushServiceBaseUrl.trim()
+                            : undefined;
+                        if (pushBaseTrimmed !== undefined &&
+                            pushBaseTrimmed !== "" &&
+                            !pushBaseTrimmed.startsWith("https://")) {
+                            respond400("pushServiceBaseUrl must be HTTPS");
+                            return;
+                        }
+                        // ntfyTopic — bearer-token on public ntfy.sh; charset-restricted.
+                        const ntfyTopicTrimmed = body.ntfyTopic !== undefined ? body.ntfyTopic.trim() : undefined;
+                        if (ntfyTopicTrimmed !== undefined &&
+                            ntfyTopicTrimmed !== "" &&
+                            !/^[A-Za-z0-9_-]{1,64}$/.test(ntfyTopicTrimmed)) {
+                            respond400("ntfyTopic must match [A-Za-z0-9_-]{1,64}");
+                            return;
+                        }
+                        // ntfyServer — same threat model as pushServiceBaseUrl.
+                        const ntfyServerTrimmed = body.ntfyServer !== undefined
+                            ? body.ntfyServer.trim()
+                            : undefined;
+                        if (ntfyServerTrimmed !== undefined &&
+                            ntfyServerTrimmed !== "" &&
+                            !ntfyServerTrimmed.startsWith("https://")) {
+                            respond400("ntfyServer must be HTTPS");
+                            return;
+                        }
+                        // localEndpoint — used by LocalApiDriver as the inference base
+                        // URL. Must parse as http(s)://, be ≤2048 chars, and resolve to
+                        // a loopback or private address. Otherwise prompts + context
+                        // would stream to a public / metadata / file:// host. Same gate
+                        // the driver enforces at construction, raised to the HTTP
+                        // boundary so the bad value never reaches disk. Operator can
+                        // opt out via LOCAL_ENDPOINT_ALLOW_REMOTE=1 for audited
+                        // internal inference clusters.
+                        const localEndpointTrimmed = body.localEndpoint !== undefined
+                            ? body.localEndpoint.trim()
+                            : undefined;
+                        if (localEndpointTrimmed !== undefined &&
+                            localEndpointTrimmed !== "") {
+                            if (localEndpointTrimmed.length > 2048) {
+                                respond400("localEndpoint must be ≤2048 characters");
+                                return;
+                            }
+                            let parsed;
+                            try {
+                                parsed = new URL(localEndpointTrimmed);
+                            }
+                            catch {
+                                respond400("localEndpoint must be a valid http(s):// URL");
+                                return;
+                            }
+                            if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+                                respond400("localEndpoint must use http:// or https:// scheme");
+                                return;
+                            }
+                            if (process.env.LOCAL_ENDPOINT_ALLOW_REMOTE !== "1" &&
+                                !isLoopbackOrPrivateEndpoint(localEndpointTrimmed)) {
+                                respond400("localEndpoint must be loopback or private (set LOCAL_ENDPOINT_ALLOW_REMOTE=1 to override)");
+                                return;
+                            }
+                        }
+                        // PHASE 2 — load config and apply all in-memory edits to `cfg`.
+                        // Still no disk writes; if anything throws here the request
+                        // returns 500 with no side effects.
+                        const configPath = patchworkConfigPath();
+                        const cfg = loadPatchworkConfig(configPath);
+                        cfg.dashboard = {
+                            port: cfg.dashboard?.port ?? 3200,
+                            requireApproval: cfg.dashboard?.requireApproval ?? ["high"],
+                            pushNotifications: cfg.dashboard?.pushNotifications ?? false,
+                            webhookUrl: hasWebhookUpdate
+                                ? webhookRaw || undefined
+                                : cfg.dashboard?.webhookUrl,
+                        };
+                        if (gateRaw !== undefined) {
+                            cfg.approvalGate = gateRaw;
+                        }
+                        if (body.enableTimeOfDayAnomaly !== undefined) {
+                            cfg.enableTimeOfDayAnomaly = body.enableTimeOfDayAnomaly;
+                        }
+                        if (driverRaw !== undefined) {
+                            cfg.driver = driverRaw;
+                        }
+                        if (body.model !== undefined) {
+                            cfg.model = body.model;
+                        }
+                        // localEndpoint / localModel persist regardless of whether
+                        // `model` is sent. Previously they were silently dropped when
+                        // the dashboard updated only the endpoint of an already-local
+                        // install, which left the running driver pointed at the old
+                        // host until the user happened to re-pick "Local LLM" in the
+                        // UI.
+                        if (body.localEndpoint !== undefined) {
+                            cfg.localEndpoint = body.localEndpoint.trim() || undefined;
+                        }
+                        if (body.localModel !== undefined) {
+                            cfg.localModel = body.localModel.trim() || undefined;
+                        }
+                        // Push / ntfy fields used to be set only on `this.*` and were
+                        // lost on bridge restart. Persist alongside the rest.
+                        if (pushUrlTrimmed !== undefined) {
+                            cfg.pushServiceUrl = pushUrlTrimmed || undefined;
+                        }
+                        if (body.pushServiceToken !== undefined) {
+                            cfg.pushServiceToken = body.pushServiceToken.trim() || undefined;
+                        }
+                        if (pushBaseTrimmed !== undefined) {
+                            cfg.pushServiceBaseUrl = pushBaseTrimmed || undefined;
+                        }
+                        if (ntfyTopicTrimmed !== undefined) {
+                            cfg.ntfyTopic = ntfyTopicTrimmed || undefined;
+                        }
+                        if (ntfyServerTrimmed !== undefined) {
+                            cfg.ntfyServer = ntfyServerTrimmed || undefined;
+                        }
+                        // PHASE 3 — disk + secure-store writes. Order: secure store →
+                        // bridge driver config → patchwork config. Each rolls back what
+                        // it can on later failure (left to PR #02; for now log + 500).
+                        if (body.apiKey) {
+                            try {
+                                saveApiKeyToSecureStore(body.apiKey.provider, body.apiKey.key);
+                            }
+                            catch (writeErr) {
+                                this.logger.error(`[/config/patchwork] saveApiKeyToSecureStore failed: ${writeErr instanceof Error ? writeErr.message : String(writeErr)}`);
+                                res.writeHead(500, { "Content-Type": "application/json" });
+                                res.end(JSON.stringify({ error: "Failed to write provider API key" }));
                                 return;
                             }
-                            // Provider keys go to the secure store (Keychain/DPAPI/Secret
-                            // Service / AES-256-GCM file fallback) — never persisted to
-                            // ~/.patchwork/config.json. Empty string clears.
+                        }
+                        if (driverRaw !== undefined) {
                             try {
-                                saveApiKeyToSecureStore(provider, key);
+                                saveBridgeConfigDriver(driverRaw, this.bridgeConfigPath);
                             }
                             catch (writeErr) {
-                                this.logger.error(`[/config/patchwork] saveApiKeyToSecureStore failed: ${writeErr instanceof Error ? (writeErr.stack ?? writeErr.message) : String(writeErr)}`);
+                                this.logger.error(`[/config/patchwork] saveBridgeConfigDriver failed: ${writeErr instanceof Error ? writeErr.message : String(writeErr)}`);
                                 res.writeHead(500, { "Content-Type": "application/json" });
                                 res.end(JSON.stringify({
-                                    error: "Failed to write provider API key",
+                                    error: "Failed to write bridge driver config",
                                 }));
                                 return;
                             }
@@ -1307,81 +1445,107 @@ export class Server extends EventEmitter {
                             savePatchworkConfig(cfg, configPath);
                         }
                         catch (writeErr) {
-                            this.logger.error(`[/config/patchwork] savePatchworkConfig failed: ${writeErr instanceof Error ? (writeErr.stack ?? writeErr.message) : String(writeErr)}`);
+                            this.logger.error(`[/config/patchwork] savePatchworkConfig failed: ${writeErr instanceof Error ? writeErr.message : String(writeErr)}`);
                             res.writeHead(500, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({
-                                error: "Failed to write patchwork config",
-                            }));
+                            res.end(JSON.stringify({ error: "Failed to write patchwork config" }));
                             return;
                         }
+                        // PHASE 4 — live state. Only after every persistence step
+                        // succeeded; ensures live state never diverges from disk.
+                        if (gateRaw !== undefined) {
+                            this.approvalGate = gateRaw;
+                        }
+                        if (body.enableTimeOfDayAnomaly !== undefined) {
+                            this.enableTimeOfDayAnomaly = body.enableTimeOfDayAnomaly;
+                        }
                         if (hasWebhookUpdate) {
-                            this.approvalWebhookUrl = raw || undefined;
+                            this.approvalWebhookUrl = webhookRaw || undefined;
                         }
-                        if (body.pushServiceUrl !== undefined) {
-                            const pushUrl = body.pushServiceUrl.trim();
-                            if (pushUrl && !pushUrl.startsWith("https://")) {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({ error: "pushServiceUrl must be HTTPS" }));
-                                return;
-                            }
-                            this.pushServiceUrl = pushUrl || undefined;
+                        if (pushUrlTrimmed !== undefined) {
+                            this.pushServiceUrl = pushUrlTrimmed || undefined;
                         }
                         if (body.pushServiceToken !== undefined) {
                             this.pushServiceToken = body.pushServiceToken.trim() || undefined;
                         }
-                        if (body.pushServiceBaseUrl !== undefined) {
-                            const baseUrl = body.pushServiceBaseUrl.trim();
-                            // pushServiceBaseUrl is the bridge callback origin embedded in
-                            // the SW's approveUrl/rejectUrl. If it can be set to plain
-                            // http:// or to a host the operator didn't intend, the SW will
-                            // POST the one-shot approvalToken there — letting an attacker
-                            // who sets this redirect every approval to attacker.tld and
-                            // replay tokens to the real bridge for silent auto-approve.
-                            if (baseUrl && !baseUrl.startsWith("https://")) {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({ error: "pushServiceBaseUrl must be HTTPS" }));
-                                return;
-                            }
-                            this.pushServiceBaseUrl = baseUrl || undefined;
+                        if (pushBaseTrimmed !== undefined) {
+                            this.pushServiceBaseUrl = pushBaseTrimmed || undefined;
                         }
-                        if (body.ntfyTopic !== undefined) {
-                            const topic = body.ntfyTopic.trim();
-                            // Topic acts as a bearer token on the public ntfy.sh server —
-                            // anyone subscribed sees the approval payload + single-use
-                            // approvalToken. Reject empty / whitespace / control chars to
-                            // avoid silent misconfiguration.
-                            if (topic && !/^[A-Za-z0-9_-]{1,64}$/.test(topic)) {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({
-                                    error: "ntfyTopic must match [A-Za-z0-9_-]{1,64}",
-                                }));
-                                return;
-                            }
-                            this.ntfyTopic = topic || undefined;
+                        if (ntfyTopicTrimmed !== undefined) {
+                            this.ntfyTopic = ntfyTopicTrimmed || undefined;
                         }
-                        if (body.ntfyServer !== undefined) {
-                            const server = body.ntfyServer.trim();
-                            // Same reasoning as pushServiceBaseUrl — the bridge sends the
-                            // single-use token to this URL. http:// would expose it on the
-                            // wire; a malicious value would exfiltrate every approval.
-                            if (server && !server.startsWith("https://")) {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({ error: "ntfyServer must be HTTPS" }));
-                                return;
-                            }
-                            this.ntfyServer = server || undefined;
+                        if (ntfyServerTrimmed !== undefined) {
+                            this.ntfyServer = ntfyServerTrimmed || undefined;
                         }
+                        // restartRequired covers fields the bridge only reads at boot:
+                        // driver/model/apiKey (env injection + driver factory), plus
+                        // localEndpoint/localModel which LocalApiDriver reads at
+                        // construction time. Push/ntfy fields are live-mutated on
+                        // `this.*` in PHASE 4 below, so they do not require restart.
                         const restartRequired = driverRaw !== undefined ||
                             body.apiKey !== undefined ||
-                            body.model !== undefined;
+                            body.model !== undefined ||
+                            body.localEndpoint !== undefined ||
+                            body.localModel !== undefined;
+                        // Audit-log emission — forensic record of every config mutation
+                        // so an operator can answer "who changed what, when?" after an
+                        // incident. Bearer-token auth doesn't carry an actor identity
+                        // (no user JWT) so we attribute to "http" with the request IP.
+                        // Secrets are redacted to the shape `"***"` — value presence
+                        // is recorded, value content is never logged.
+                        if (this.activityLog) {
+                            const changes = {};
+                            if (hasWebhookUpdate)
+                                changes.webhookUrl = webhookRaw || "";
+                            if (gateRaw !== undefined)
+                                changes.approvalGate = gateRaw;
+                            if (body.enableTimeOfDayAnomaly !== undefined)
+                                changes.enableTimeOfDayAnomaly = body.enableTimeOfDayAnomaly;
+                            if (driverRaw !== undefined)
+                                changes.driver = driverRaw;
+                            if (body.model !== undefined)
+                                changes.model = body.model;
+                            if (body.localEndpoint !== undefined)
+                                changes.localEndpoint = body.localEndpoint;
+                            if (body.localModel !== undefined)
+                                changes.localModel = body.localModel;
+                            if (body.apiKey)
+                                changes.apiKey = { provider: body.apiKey.provider, key: "***" };
+                            if (pushUrlTrimmed !== undefined)
+                                changes.pushServiceUrl = pushUrlTrimmed || "";
+                            if (body.pushServiceToken !== undefined)
+                                changes.pushServiceToken = body.pushServiceToken ? "***" : "";
+                            if (pushBaseTrimmed !== undefined)
+                                changes.pushServiceBaseUrl = pushBaseTrimmed || "";
+                            if (ntfyTopicTrimmed !== undefined)
+                                changes.ntfyTopic = ntfyTopicTrimmed ? "***" : "";
+                            if (ntfyServerTrimmed !== undefined)
+                                changes.ntfyServer = ntfyServerTrimmed || "";
+                            const remoteAddr = req.headers["x-forwarded-for"]
+                                ?.split(",")[0]
+                                ?.trim() ||
+                                req.socket.remoteAddress ||
+                                "unknown";
+                            this.activityLog.recordEvent("settings.change", {
+                                actor: "http",
+                                ip: remoteAddr,
+                                fields: Object.keys(changes),
+                                changes,
+                            });
+                        }
                         res.writeHead(200, { "Content-Type": "application/json" });
                         res.end(JSON.stringify({ ok: true, restartRequired }));
                     }
                 }
                 catch (err) {
-                    this.logger.error(`[/config/patchwork] error: ${err instanceof Error ? (err.stack ?? err.message) : String(err)}`);
-                    res.writeHead(400, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "Invalid request body" }));
+                    // Any error reaching this outer catch is unexpected — all caller
+                    // validation errors already returned their own 400 inline, and all
+                    // expected disk-write errors return their own 500. So this is a
+                    // server bug, not a client one. Returning 400 here misled clients
+                    // into believing they had sent a bad body when in fact something
+                    // crashed serverside.
+                    this.logger.error(`[/config/patchwork] unhandled error: ${err instanceof Error ? (err.stack ?? err.message) : String(err)}`);
+                    res.writeHead(500, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "Internal server error" }));
                 }
                 return;
             }
@@ -1432,6 +1596,9 @@ export class Server extends EventEmitter {
                         return;
                     }
                     const body = parsed.value ?? {};
+                    if (respondIfUnknownBodyKeys(res, body, ["engage", "reason"])) {
+                        return;
+                    }
                     if (typeof body.engage !== "boolean") {
                         res.writeHead(400, { "Content-Type": "application/json" });
                         res.end(JSON.stringify({
@@ -1522,6 +1689,17 @@ export class Server extends EventEmitter {
                     return;
                 }
                 if (req.method === "POST") {
+                    // Kill-switch gate — telemetry prefs are config writes too.
+                    // GET stays open so operators can verify state during an
+                    // incident.
+                    if (isWriteKillSwitchActive()) {
+                        res.writeHead(423, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify({
+                            error: "kill_switch_blocked",
+                            reason: "Telemetry pref writes are disabled while the write kill-switch is engaged.",
+                        }));
+                        return;
+                    }
                     const TP_BODY_CAP = 1 * 1024;
                     const parsed = await readJsonBody(req, TP_BODY_CAP);
                     if (!parsed.ok) {
@@ -1534,7 +1712,33 @@ export class Server extends EventEmitter {
                         return;
                     }
                     const body = parsed.value ?? {};
+                    if (respondIfUnknownBodyKeys(res, body, [
+                        "crashReports",
+                        "usageStats",
+                        "localDiagnostics",
+                    ])) {
+                        return;
+                    }
                     const update = {};
+                    // Reject non-boolean values for known keys instead of silently
+                    // dropping them. Previously `{"crashReports": "true"}` (string)
+                    // got a 200 with no effect — caller never learned the toggle
+                    // did nothing. Misrepresented consent is the worst-case
+                    // outcome on the telemetry surface, so be strict here.
+                    for (const key of [
+                        "crashReports",
+                        "usageStats",
+                        "localDiagnostics",
+                    ]) {
+                        if (body[key] !== undefined && typeof body[key] !== "boolean") {
+                            res.writeHead(400, { "Content-Type": "application/json" });
+                            res.end(JSON.stringify({
+                                error: "invalid_request",
+                                reason: `${key} must be a boolean`,
+                            }));
+                            return;
+                        }
+                    }
                     if (typeof body.crashReports === "boolean") {
                         update.crashReports = body.crashReports;
                     }