patchwork-os 0.2.0-beta.5.canary.7 → 0.2.0-beta.5.canary.71

package/dist/server.js

@@ -1,14 +1,17 @@
 import { createHmac, timingSafeEqual } from "node:crypto";
 import { EventEmitter } from "node:events";
+import { unlinkSync } from "node:fs";
 import http from "node:http";
 import { WebSocket, WebSocketServer as WsServer } from "ws";
-import { getAnalyticsPrefsAll, getTelemetryPrefs, setTelemetryPrefs, } from "./analyticsPrefs.js";
+import { clearAnalyticsConfig, getAnalyticsConfig } from "./analyticsConfig.js";
+import { getAnalyticsPrefsAll, getAnalyticsPrefsPath, getAnalyticsSaltPath, getTelemetryPrefs, setTelemetryPrefs, } from "./analyticsPrefs.js";
 import { handleApprovalsStream, routeApprovalRequest } from "./approvalHttp.js";
 import { getApprovalQueue } from "./approvalQueue.js";
 import { saveBridgeConfigDriver } from "./config.js";
 import { tryHandleConnectorRoute, tryHandlePublicConnectorRoute, } from "./connectorRoutes.js";
 import { timingSafeStringEqual } from "./crypto.js";
 import { renderDashboardHtml } from "./dashboard.js";
+import { isLoopbackOrPrivateEndpoint } from "./drivers/local/index.js";
 import { EnvLockedFlagError, getEnvLockedValue, isEnvLockedFor, isWriteKillSwitchActive, KILL_SWITCH_WRITES, setFlag, } from "./featureFlags.js";
 import { respondIfUnknownBodyKeys } from "./httpBodyValidation.js";
 import { respond500 } from "./httpErrorResponse.js";
@@ -1158,6 +1161,21 @@ export class Server extends EventEmitter {
                 return;
             }
             if (parsedUrl.pathname === "/settings" && req.method === "POST") {
+                // Kill-switch gate: during an incident a settings mutation can
+                // defeat the panic posture (e.g. switching driver to one with a
+                // leaked API key, flipping approvalGate to "off"). The /settings
+                // card on the dashboard sits directly above the kill-switch
+                // toggle — users will reasonably read "writes blocked" as
+                // covering both. Refuse with 423 Locked; the /kill-switch
+                // endpoint itself is the only way out and is not gated.
+                if (isWriteKillSwitchActive()) {
+                    res.writeHead(423, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({
+                        error: "kill_switch_blocked",
+                        reason: "Settings writes are disabled while the write kill-switch is engaged. Release it via POST /kill-switch to mutate config.",
+                    }));
+                    return;
+                }
                 // 16 KB — settings POSTs are short-string fields (URLs, API keys,
                 // gate level). 16 KB is generous; an authenticated attacker can't
                 // stream gigabytes here.
@@ -1192,55 +1210,42 @@ export class Server extends EventEmitter {
                         ])) {
                             return;
                         }
+                        // PHASE 1 — validate ALL fields up front. No disk writes, no
+                        // secure-store writes, no live-state mutations until every input
+                        // has passed. Prevents the "valid driver + invalid ntfyTopic"
+                        // class of bug where a 400 still leaves a partial side-effect on
+                        // disk.
+                        const respond400 = (error) => {
+                            res.writeHead(400, { "Content-Type": "application/json" });
+                            res.end(JSON.stringify({ error }));
+                        };
+                        // webhookUrl
                         const hasWebhookUpdate = body.webhookUrl !== undefined;
-                        const raw = hasWebhookUpdate
+                        const webhookRaw = hasWebhookUpdate
                             ? (body.webhookUrl?.trim() ?? "")
                             : undefined;
-                        if (raw !== undefined && raw !== "" && !/^https:\/\/.+/.test(raw)) {
-                            res.writeHead(400, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({ error: "webhookUrl must be HTTPS" }));
+                        if (webhookRaw !== undefined &&
+                            webhookRaw !== "" &&
+                            !/^https:\/\/.+/.test(webhookRaw)) {
+                            respond400("webhookUrl must be HTTPS");
                             return;
                         }
+                        // approvalGate
                         const gateRaw = body.approvalGate;
                         if (gateRaw !== undefined &&
                             gateRaw !== "off" &&
                             gateRaw !== "high" &&
                             gateRaw !== "all") {
-                            res.writeHead(400, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({
-                                error: 'approvalGate must be "off", "high", or "all"',
-                            }));
+                            respond400('approvalGate must be "off", "high", or "all"');
                             return;
                         }
-                        const configPath = patchworkConfigPath();
-                        const cfg = loadPatchworkConfig(configPath);
-                        cfg.dashboard = {
-                            port: cfg.dashboard?.port ?? 3200,
-                            requireApproval: cfg.dashboard?.requireApproval ?? ["high"],
-                            pushNotifications: cfg.dashboard?.pushNotifications ?? false,
-                            webhookUrl: hasWebhookUpdate
-                                ? raw || undefined
-                                : cfg.dashboard?.webhookUrl,
-                        };
-                        if (gateRaw !== undefined) {
-                            cfg.approvalGate = gateRaw;
-                            this.approvalGate = gateRaw;
-                        }
-                        // h10 toggle: must be boolean if present. Persists to
-                        // ~/.patchwork/config.json AND live-mutates the Server
-                        // field so the next /approvals POST honors it without
-                        // needing a bridge restart.
-                        if (body.enableTimeOfDayAnomaly !== undefined) {
-                            if (typeof body.enableTimeOfDayAnomaly !== "boolean") {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({
-                                    error: "enableTimeOfDayAnomaly must be a boolean",
-                                }));
-                                return;
-                            }
-                            cfg.enableTimeOfDayAnomaly = body.enableTimeOfDayAnomaly;
-                            this.enableTimeOfDayAnomaly = body.enableTimeOfDayAnomaly;
+                        // enableTimeOfDayAnomaly
+                        if (body.enableTimeOfDayAnomaly !== undefined &&
+                            typeof body.enableTimeOfDayAnomaly !== "boolean") {
+                            respond400("enableTimeOfDayAnomaly must be a boolean");
+                            return;
                         }
+                        // driver
                         const driverRaw = body.driver;
                         if (driverRaw !== undefined) {
                             const validDrivers = [
@@ -1254,26 +1259,11 @@ export class Server extends EventEmitter {
                                 "none",
                             ];
                             if (!validDrivers.includes(driverRaw)) {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({
-                                    error: `driver must be one of: ${validDrivers.join(", ")}`,
-                                }));
-                                return;
-                            }
-                            const driver = driverRaw;
-                            cfg.driver = driver;
-                            try {
-                                saveBridgeConfigDriver(driver, this.bridgeConfigPath);
-                            }
-                            catch (writeErr) {
-                                this.logger.error(`[/config/patchwork] saveBridgeConfigDriver failed: ${writeErr instanceof Error ? (writeErr.stack ?? writeErr.message) : String(writeErr)}`);
-                                res.writeHead(500, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({
-                                    error: "Failed to write bridge driver config",
-                                }));
+                                respond400(`driver must be one of: ${validDrivers.join(", ")}`);
                                 return;
                             }
                         }
+                        // model
                         if (body.model !== undefined) {
                             const validModels = [
                                 "claude",
@@ -1283,40 +1273,198 @@ export class Server extends EventEmitter {
                                 "local",
                             ];
                             if (!validModels.includes(body.model)) {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({
-                                    error: `model must be one of: ${validModels.join(", ")}`,
-                                }));
+                                respond400(`model must be one of: ${validModels.join(", ")}`);
                                 return;
                             }
-                            cfg.model = body.model;
-                            if (body.model === "local") {
-                                if (body.localEndpoint !== undefined)
-                                    cfg.localEndpoint = body.localEndpoint.trim() || undefined;
-                                if (body.localModel !== undefined)
-                                    cfg.localModel = body.localModel.trim() || undefined;
-                            }
                         }
+                        // apiKey
                         if (body.apiKey) {
                             const { provider, key } = body.apiKey;
                             const validProviders = ["anthropic", "openai", "google", "xai"];
                             if (!validProviders.includes(provider) ||
                                 typeof key !== "string") {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({ error: "Invalid apiKey provider or key" }));
+                                respond400("Invalid apiKey provider or key");
                                 return;
                             }
-                            // Provider keys go to the secure store (Keychain/DPAPI/Secret
-                            // Service / AES-256-GCM file fallback) — never persisted to
-                            // ~/.patchwork/config.json. Empty string clears.
+                        }
+                        // pushServiceUrl
+                        const pushUrlTrimmed = body.pushServiceUrl !== undefined
+                            ? body.pushServiceUrl.trim()
+                            : undefined;
+                        if (pushUrlTrimmed !== undefined &&
+                            pushUrlTrimmed !== "" &&
+                            !pushUrlTrimmed.startsWith("https://")) {
+                            respond400("pushServiceUrl must be HTTPS");
+                            return;
+                        }
+                        // pushServiceToken — bearer for the push relay. Charset cap to
+                        // printable ASCII (no newlines / control chars) so it can't
+                        // header-inject when later interpolated into an outgoing
+                        // `Authorization` header. 512 chars is an order of magnitude
+                        // above any realistic relay token.
+                        const pushTokenTrimmed = body.pushServiceToken !== undefined
+                            ? body.pushServiceToken.trim()
+                            : undefined;
+                        if (pushTokenTrimmed !== undefined &&
+                            pushTokenTrimmed !== "" &&
+                            !/^[\x21-\x7E]{1,512}$/.test(pushTokenTrimmed)) {
+                            respond400("pushServiceToken must be 1-512 printable ASCII characters");
+                            return;
+                        }
+                        // pushServiceBaseUrl — bridge callback origin embedded in SW
+                        // approveUrl/rejectUrl. http:// or attacker host = approval token
+                        // exfiltration. Validate before persisting.
+                        const pushBaseTrimmed = body.pushServiceBaseUrl !== undefined
+                            ? body.pushServiceBaseUrl.trim()
+                            : undefined;
+                        if (pushBaseTrimmed !== undefined &&
+                            pushBaseTrimmed !== "" &&
+                            !pushBaseTrimmed.startsWith("https://")) {
+                            respond400("pushServiceBaseUrl must be HTTPS");
+                            return;
+                        }
+                        // ntfyTopic — bearer-token on public ntfy.sh; charset-restricted.
+                        const ntfyTopicTrimmed = body.ntfyTopic !== undefined ? body.ntfyTopic.trim() : undefined;
+                        if (ntfyTopicTrimmed !== undefined &&
+                            ntfyTopicTrimmed !== "" &&
+                            !/^[A-Za-z0-9_-]{1,64}$/.test(ntfyTopicTrimmed)) {
+                            respond400("ntfyTopic must match [A-Za-z0-9_-]{1,64}");
+                            return;
+                        }
+                        // ntfyServer — same threat model as pushServiceBaseUrl.
+                        const ntfyServerTrimmed = body.ntfyServer !== undefined
+                            ? body.ntfyServer.trim()
+                            : undefined;
+                        if (ntfyServerTrimmed !== undefined &&
+                            ntfyServerTrimmed !== "" &&
+                            !ntfyServerTrimmed.startsWith("https://")) {
+                            respond400("ntfyServer must be HTTPS");
+                            return;
+                        }
+                        // localEndpoint — used by LocalApiDriver as the inference base
+                        // URL. Must parse as http(s)://, be ≤2048 chars, and resolve to
+                        // a loopback or private address. Otherwise prompts + context
+                        // would stream to a public / metadata / file:// host. Same gate
+                        // the driver enforces at construction, raised to the HTTP
+                        // boundary so the bad value never reaches disk. Operator can
+                        // opt out via LOCAL_ENDPOINT_ALLOW_REMOTE=1 for audited
+                        // internal inference clusters.
+                        const localEndpointTrimmed = body.localEndpoint !== undefined
+                            ? body.localEndpoint.trim()
+                            : undefined;
+                        if (localEndpointTrimmed !== undefined &&
+                            localEndpointTrimmed !== "") {
+                            if (localEndpointTrimmed.length > 2048) {
+                                respond400("localEndpoint must be ≤2048 characters");
+                                return;
+                            }
+                            let parsed;
                             try {
-                                saveApiKeyToSecureStore(provider, key);
+                                parsed = new URL(localEndpointTrimmed);
+                            }
+                            catch {
+                                respond400("localEndpoint must be a valid http(s):// URL");
+                                return;
+                            }
+                            if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+                                respond400("localEndpoint must use http:// or https:// scheme");
+                                return;
+                            }
+                            if (process.env.LOCAL_ENDPOINT_ALLOW_REMOTE !== "1" &&
+                                !isLoopbackOrPrivateEndpoint(localEndpointTrimmed)) {
+                                respond400("localEndpoint must be loopback or private (set LOCAL_ENDPOINT_ALLOW_REMOTE=1 to override)");
+                                return;
+                            }
+                        }
+                        // PHASE 2 — load config and apply all in-memory edits to `cfg`.
+                        // Still no disk writes; if anything throws here the request
+                        // returns 500 with no side effects.
+                        const configPath = patchworkConfigPath();
+                        const cfg = loadPatchworkConfig(configPath);
+                        cfg.dashboard = {
+                            port: cfg.dashboard?.port ?? 3200,
+                            requireApproval: cfg.dashboard?.requireApproval ?? ["high"],
+                            pushNotifications: cfg.dashboard?.pushNotifications ?? false,
+                            webhookUrl: hasWebhookUpdate
+                                ? webhookRaw || undefined
+                                : cfg.dashboard?.webhookUrl,
+                        };
+                        if (gateRaw !== undefined) {
+                            cfg.approvalGate = gateRaw;
+                        }
+                        if (body.enableTimeOfDayAnomaly !== undefined) {
+                            cfg.enableTimeOfDayAnomaly = body.enableTimeOfDayAnomaly;
+                        }
+                        if (driverRaw !== undefined) {
+                            cfg.driver = driverRaw;
+                        }
+                        if (body.model !== undefined) {
+                            cfg.model = body.model;
+                        }
+                        // localEndpoint / localModel persist regardless of whether
+                        // `model` is sent. Previously they were silently dropped when
+                        // the dashboard updated only the endpoint of an already-local
+                        // install, which left the running driver pointed at the old
+                        // host until the user happened to re-pick "Local LLM" in the
+                        // UI.
+                        if (body.localEndpoint !== undefined) {
+                            cfg.localEndpoint = body.localEndpoint.trim() || undefined;
+                        }
+                        if (body.localModel !== undefined) {
+                            cfg.localModel = body.localModel.trim() || undefined;
+                        }
+                        // Push / ntfy fields used to be set only on `this.*` and were
+                        // lost on bridge restart. Persist alongside the rest.
+                        if (pushUrlTrimmed !== undefined) {
+                            cfg.pushServiceUrl = pushUrlTrimmed || undefined;
+                        }
+                        if (pushTokenTrimmed !== undefined) {
+                            cfg.pushServiceToken = pushTokenTrimmed || undefined;
+                        }
+                        if (pushBaseTrimmed !== undefined) {
+                            cfg.pushServiceBaseUrl = pushBaseTrimmed || undefined;
+                        }
+                        if (ntfyTopicTrimmed !== undefined) {
+                            cfg.ntfyTopic = ntfyTopicTrimmed || undefined;
+                        }
+                        if (ntfyServerTrimmed !== undefined) {
+                            cfg.ntfyServer = ntfyServerTrimmed || undefined;
+                        }
+                        // PHASE 3 — disk + secure-store writes. Order: secure store →
+                        // bridge driver config → patchwork config. Each rolls back what
+                        // it can on later failure (left to PR #02; for now log + 500).
+                        if (body.apiKey) {
+                            try {
+                                saveApiKeyToSecureStore(body.apiKey.provider, body.apiKey.key);
                             }
                             catch (writeErr) {
-                                this.logger.error(`[/config/patchwork] saveApiKeyToSecureStore failed: ${writeErr instanceof Error ? (writeErr.stack ?? writeErr.message) : String(writeErr)}`);
+                                // Some Keychain / Secret-Service backends echo the
+                                // payload into the error message on certain failure
+                                // modes. Cap the logged message at 200 chars AND
+                                // strip anything that looks like the leading hex/
+                                // base64 of the just-attempted key so a misbehaving
+                                // backend can't leak it into bridge logs.
+                                const raw = writeErr instanceof Error
+                                    ? writeErr.message
+                                    : String(writeErr);
+                                const safe = raw
+                                    .replaceAll(body.apiKey.key, "[redacted]")
+                                    .slice(0, 200);
+                                this.logger.error(`[/config/patchwork] saveApiKeyToSecureStore failed: ${safe}`);
+                                res.writeHead(500, { "Content-Type": "application/json" });
+                                res.end(JSON.stringify({ error: "Failed to write provider API key" }));
+                                return;
+                            }
+                        }
+                        if (driverRaw !== undefined) {
+                            try {
+                                saveBridgeConfigDriver(driverRaw, this.bridgeConfigPath);
+                            }
+                            catch (writeErr) {
+                                this.logger.error(`[/config/patchwork] saveBridgeConfigDriver failed: ${writeErr instanceof Error ? writeErr.message : String(writeErr)}`);
                                 res.writeHead(500, { "Content-Type": "application/json" });
                                 res.end(JSON.stringify({
-                                    error: "Failed to write provider API key",
+                                    error: "Failed to write bridge driver config",
                                 }));
                                 return;
                             }
@@ -1325,81 +1473,120 @@ export class Server extends EventEmitter {
                             savePatchworkConfig(cfg, configPath);
                         }
                         catch (writeErr) {
-                            this.logger.error(`[/config/patchwork] savePatchworkConfig failed: ${writeErr instanceof Error ? (writeErr.stack ?? writeErr.message) : String(writeErr)}`);
+                            this.logger.error(`[/config/patchwork] savePatchworkConfig failed: ${writeErr instanceof Error ? writeErr.message : String(writeErr)}`);
                             res.writeHead(500, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({
-                                error: "Failed to write patchwork config",
-                            }));
+                            res.end(JSON.stringify({ error: "Failed to write patchwork config" }));
                             return;
                         }
+                        // PHASE 4 — live state. Only after every persistence step
+                        // succeeded; ensures live state never diverges from disk.
+                        if (gateRaw !== undefined) {
+                            const prevGate = this.approvalGate;
+                            this.approvalGate = gateRaw;
+                            // When the operator downgrades to "off", every pending
+                            // queue entry becomes moot — the originating tool dispatch
+                            // now bypasses, and a phone approver who hits "Approve"
+                            // five seconds later would get a 404. Cancel them
+                            // server-side so the dashboard /approvals list clears
+                            // and any pending phone notification reflects reality.
+                            if (gateRaw === "off" && prevGate !== "off") {
+                                const cancelled = getApprovalQueue().cancelAll();
+                                if (cancelled > 0) {
+                                    this.logger.info(`[/settings] approvalGate → off; cancelled ${cancelled} pending entr${cancelled === 1 ? "y" : "ies"}`);
+                                }
+                            }
+                        }
+                        if (body.enableTimeOfDayAnomaly !== undefined) {
+                            this.enableTimeOfDayAnomaly = body.enableTimeOfDayAnomaly;
+                        }
                         if (hasWebhookUpdate) {
-                            this.approvalWebhookUrl = raw || undefined;
+                            this.approvalWebhookUrl = webhookRaw || undefined;
                         }
-                        if (body.pushServiceUrl !== undefined) {
-                            const pushUrl = body.pushServiceUrl.trim();
-                            if (pushUrl && !pushUrl.startsWith("https://")) {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({ error: "pushServiceUrl must be HTTPS" }));
-                                return;
-                            }
-                            this.pushServiceUrl = pushUrl || undefined;
+                        if (pushUrlTrimmed !== undefined) {
+                            this.pushServiceUrl = pushUrlTrimmed || undefined;
                         }
-                        if (body.pushServiceToken !== undefined) {
-                            this.pushServiceToken = body.pushServiceToken.trim() || undefined;
+                        if (pushTokenTrimmed !== undefined) {
+                            this.pushServiceToken = pushTokenTrimmed || undefined;
                         }
-                        if (body.pushServiceBaseUrl !== undefined) {
-                            const baseUrl = body.pushServiceBaseUrl.trim();
-                            // pushServiceBaseUrl is the bridge callback origin embedded in
-                            // the SW's approveUrl/rejectUrl. If it can be set to plain
-                            // http:// or to a host the operator didn't intend, the SW will
-                            // POST the one-shot approvalToken there — letting an attacker
-                            // who sets this redirect every approval to attacker.tld and
-                            // replay tokens to the real bridge for silent auto-approve.
-                            if (baseUrl && !baseUrl.startsWith("https://")) {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({ error: "pushServiceBaseUrl must be HTTPS" }));
-                                return;
-                            }
-                            this.pushServiceBaseUrl = baseUrl || undefined;
+                        if (pushBaseTrimmed !== undefined) {
+                            this.pushServiceBaseUrl = pushBaseTrimmed || undefined;
                         }
-                        if (body.ntfyTopic !== undefined) {
-                            const topic = body.ntfyTopic.trim();
-                            // Topic acts as a bearer token on the public ntfy.sh server —
-                            // anyone subscribed sees the approval payload + single-use
-                            // approvalToken. Reject empty / whitespace / control chars to
-                            // avoid silent misconfiguration.
-                            if (topic && !/^[A-Za-z0-9_-]{1,64}$/.test(topic)) {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({
-                                    error: "ntfyTopic must match [A-Za-z0-9_-]{1,64}",
-                                }));
-                                return;
-                            }
-                            this.ntfyTopic = topic || undefined;
+                        if (ntfyTopicTrimmed !== undefined) {
+                            this.ntfyTopic = ntfyTopicTrimmed || undefined;
                         }
-                        if (body.ntfyServer !== undefined) {
-                            const server = body.ntfyServer.trim();
-                            // Same reasoning as pushServiceBaseUrl — the bridge sends the
-                            // single-use token to this URL. http:// would expose it on the
-                            // wire; a malicious value would exfiltrate every approval.
-                            if (server && !server.startsWith("https://")) {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({ error: "ntfyServer must be HTTPS" }));
-                                return;
-                            }
-                            this.ntfyServer = server || undefined;
+                        if (ntfyServerTrimmed !== undefined) {
+                            this.ntfyServer = ntfyServerTrimmed || undefined;
                         }
+                        // restartRequired covers fields the bridge only reads at boot:
+                        // driver/model/apiKey (env injection + driver factory), plus
+                        // localEndpoint/localModel which LocalApiDriver reads at
+                        // construction time. Push/ntfy fields are live-mutated on
+                        // `this.*` in PHASE 4 below, so they do not require restart.
                         const restartRequired = driverRaw !== undefined ||
                             body.apiKey !== undefined ||
-                            body.model !== undefined;
+                            body.model !== undefined ||
+                            body.localEndpoint !== undefined ||
+                            body.localModel !== undefined;
+                        // Audit-log emission — forensic record of every config mutation
+                        // so an operator can answer "who changed what, when?" after an
+                        // incident. Bearer-token auth doesn't carry an actor identity
+                        // (no user JWT) so we attribute to "http" with the request IP.
+                        // Secrets are redacted to the shape `"***"` — value presence
+                        // is recorded, value content is never logged.
+                        if (this.activityLog) {
+                            const changes = {};
+                            if (hasWebhookUpdate)
+                                changes.webhookUrl = webhookRaw || "";
+                            if (gateRaw !== undefined)
+                                changes.approvalGate = gateRaw;
+                            if (body.enableTimeOfDayAnomaly !== undefined)
+                                changes.enableTimeOfDayAnomaly = body.enableTimeOfDayAnomaly;
+                            if (driverRaw !== undefined)
+                                changes.driver = driverRaw;
+                            if (body.model !== undefined)
+                                changes.model = body.model;
+                            if (body.localEndpoint !== undefined)
+                                changes.localEndpoint = body.localEndpoint;
+                            if (body.localModel !== undefined)
+                                changes.localModel = body.localModel;
+                            if (body.apiKey)
+                                changes.apiKey = { provider: body.apiKey.provider, key: "***" };
+                            if (pushUrlTrimmed !== undefined)
+                                changes.pushServiceUrl = pushUrlTrimmed || "";
+                            if (pushTokenTrimmed !== undefined)
+                                changes.pushServiceToken = pushTokenTrimmed ? "***" : "";
+                            if (pushBaseTrimmed !== undefined)
+                                changes.pushServiceBaseUrl = pushBaseTrimmed || "";
+                            if (ntfyTopicTrimmed !== undefined)
+                                changes.ntfyTopic = ntfyTopicTrimmed ? "***" : "";
+                            if (ntfyServerTrimmed !== undefined)
+                                changes.ntfyServer = ntfyServerTrimmed || "";
+                            const remoteAddr = req.headers["x-forwarded-for"]
+                                ?.split(",")[0]
+                                ?.trim() ||
+                                req.socket.remoteAddress ||
+                                "unknown";
+                            this.activityLog.recordEvent("settings.change", {
+                                actor: "http",
+                                ip: remoteAddr,
+                                fields: Object.keys(changes),
+                                changes,
+                            });
+                        }
                         res.writeHead(200, { "Content-Type": "application/json" });
                         res.end(JSON.stringify({ ok: true, restartRequired }));
                     }
                 }
                 catch (err) {
-                    this.logger.error(`[/config/patchwork] error: ${err instanceof Error ? (err.stack ?? err.message) : String(err)}`);
-                    res.writeHead(400, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "Invalid request body" }));
+                    // Any error reaching this outer catch is unexpected — all caller
+                    // validation errors already returned their own 400 inline, and all
+                    // expected disk-write errors return their own 500. So this is a
+                    // server bug, not a client one. Returning 400 here misled clients
+                    // into believing they had sent a bad body when in fact something
+                    // crashed serverside.
+                    this.logger.error(`[/config/patchwork] unhandled error: ${err instanceof Error ? (err.stack ?? err.message) : String(err)}`);
+                    res.writeHead(500, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "Internal server error" }));
                 }
                 return;
             }
@@ -1528,8 +1715,10 @@ export class Server extends EventEmitter {
                 }
             }
             // /telemetry-prefs — read/write per-flag telemetry preferences.
-            // GET  → {crashReports, usageStats, localDiagnostics}
-            // POST {crashReports?, usageStats?, localDiagnostics?} → same shape (partial update)
+            // GET    → {crashReports, usageStats, localDiagnostics, endpoint, endpointSource}
+            // POST   {crashReports?, usageStats?, localDiagnostics?} → same shape (partial update)
+            // DELETE → clears prefs file + analytics-config + install salt
+            //          (right-to-erasure affordance).
             if (parsedUrl.pathname === "/telemetry-prefs") {
                 if (req.method === "GET") {
                     const prefs = getTelemetryPrefs();
@@ -1538,11 +1727,74 @@ export class Server extends EventEmitter {
                     if (all?.lastSentAt !== undefined) {
                         response.lastSentAt = all.lastSentAt;
                     }
+                    // Destination visibility — consent baseline. Caller can see
+                    // where their data would go and whether the destination came
+                    // from env (CI/headless) or the on-disk config file.
+                    const envEndpoint = process.env.PATCHWORK_ANALYTICS_ENDPOINT;
+                    const cfgEndpoint = getAnalyticsConfig().endpoint;
+                    const defaultEndpoint = "https://analytics.claude-ide-bridge.dev/v1/usage";
+                    if (envEndpoint) {
+                        response.endpoint = envEndpoint;
+                        response.endpointSource = "env";
+                    }
+                    else if (cfgEndpoint) {
+                        response.endpoint = cfgEndpoint;
+                        response.endpointSource = "config";
+                    }
+                    else {
+                        response.endpoint = defaultEndpoint;
+                        response.endpointSource = "default";
+                    }
                     res.writeHead(200, { "Content-Type": "application/json" });
                     res.end(JSON.stringify(response));
                     return;
                 }
+                if (req.method === "DELETE") {
+                    // Right-to-erasure: drop prefs, analytics-config (endpoint /
+                    // shared secret), and the install salt. Next outbound send
+                    // (if any) will mint a fresh salt and treat this as a new
+                    // install. Kill-switch is honored here too — incident-mode
+                    // operators may still want to scrub local state, so allow
+                    // it; flip if the threat model changes.
+                    try {
+                        unlinkSync(getAnalyticsPrefsPath());
+                    }
+                    catch {
+                        /* missing is fine */
+                    }
+                    try {
+                        unlinkSync(getAnalyticsSaltPath());
+                    }
+                    catch {
+                        /* missing is fine */
+                    }
+                    clearAnalyticsConfig();
+                    if (this.activityLog) {
+                        this.activityLog.recordEvent("telemetry.reset", {
+                            actor: "http",
+                            ip: req.headers["x-forwarded-for"]
+                                ?.split(",")[0]
+                                ?.trim() ||
+                                req.socket.remoteAddress ||
+                                "unknown",
+                        });
+                    }
+                    res.writeHead(200, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ ok: true }));
+                    return;
+                }
                 if (req.method === "POST") {
+                    // Kill-switch gate — telemetry prefs are config writes too.
+                    // GET stays open so operators can verify state during an
+                    // incident.
+                    if (isWriteKillSwitchActive()) {
+                        res.writeHead(423, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify({
+                            error: "kill_switch_blocked",
+                            reason: "Telemetry pref writes are disabled while the write kill-switch is engaged.",
+                        }));
+                        return;
+                    }
                     const TP_BODY_CAP = 1 * 1024;
                     const parsed = await readJsonBody(req, TP_BODY_CAP);
                     if (!parsed.ok) {
@@ -1563,6 +1815,25 @@ export class Server extends EventEmitter {
                         return;
                     }
                     const update = {};
+                    // Reject non-boolean values for known keys instead of silently
+                    // dropping them. Previously `{"crashReports": "true"}` (string)
+                    // got a 200 with no effect — caller never learned the toggle
+                    // did nothing. Misrepresented consent is the worst-case
+                    // outcome on the telemetry surface, so be strict here.
+                    for (const key of [
+                        "crashReports",
+                        "usageStats",
+                        "localDiagnostics",
+                    ]) {
+                        if (body[key] !== undefined && typeof body[key] !== "boolean") {
+                            res.writeHead(400, { "Content-Type": "application/json" });
+                            res.end(JSON.stringify({
+                                error: "invalid_request",
+                                reason: `${key} must be a boolean`,
+                            }));
+                            return;
+                        }
+                    }
                     if (typeof body.crashReports === "boolean") {
                         update.crashReports = body.crashReports;
                     }