patchwork-os 0.2.0-beta.5.canary.8 → 0.2.0-beta.5.canary.80

package/dist/server.js

@@ -1,14 +1,17 @@
 import { createHmac, timingSafeEqual } from "node:crypto";
 import { EventEmitter } from "node:events";
+import { unlinkSync } from "node:fs";
 import http from "node:http";
 import { WebSocket, WebSocketServer as WsServer } from "ws";
-import { getAnalyticsPrefsAll, getTelemetryPrefs, setTelemetryPrefs, } from "./analyticsPrefs.js";
+import { clearAnalyticsConfig, getAnalyticsConfig } from "./analyticsConfig.js";
+import { getAnalyticsPrefsAll, getAnalyticsPrefsPath, getAnalyticsSaltPath, getTelemetryPrefs, setTelemetryPrefs, } from "./analyticsPrefs.js";
 import { handleApprovalsStream, routeApprovalRequest } from "./approvalHttp.js";
 import { getApprovalQueue } from "./approvalQueue.js";
 import { saveBridgeConfigDriver } from "./config.js";
 import { tryHandleConnectorRoute, tryHandlePublicConnectorRoute, } from "./connectorRoutes.js";
 import { timingSafeStringEqual } from "./crypto.js";
 import { renderDashboardHtml } from "./dashboard.js";
+import { isLoopbackOrPrivateEndpoint } from "./drivers/local/index.js";
 import { EnvLockedFlagError, getEnvLockedValue, isEnvLockedFor, isWriteKillSwitchActive, KILL_SWITCH_WRITES, setFlag, } from "./featureFlags.js";
 import { respondIfUnknownBodyKeys } from "./httpBodyValidation.js";
 import { respond500 } from "./httpErrorResponse.js";
@@ -1158,6 +1161,21 @@ export class Server extends EventEmitter {
                 return;
             }
             if (parsedUrl.pathname === "/settings" && req.method === "POST") {
+                // Kill-switch gate: during an incident a settings mutation can
+                // defeat the panic posture (e.g. switching driver to one with a
+                // leaked API key, flipping approvalGate to "off"). The /settings
+                // card on the dashboard sits directly above the kill-switch
+                // toggle — users will reasonably read "writes blocked" as
+                // covering both. Refuse with 423 Locked; the /kill-switch
+                // endpoint itself is the only way out and is not gated.
+                if (isWriteKillSwitchActive()) {
+                    res.writeHead(423, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({
+                        error: "kill_switch_blocked",
+                        reason: "Settings writes are disabled while the write kill-switch is engaged. Release it via POST /kill-switch to mutate config.",
+                    }));
+                    return;
+                }
                 // 16 KB — settings POSTs are short-string fields (URLs, API keys,
                 // gate level). 16 KB is generous; an authenticated attacker can't
                 // stream gigabytes here.
@@ -1279,6 +1297,20 @@ export class Server extends EventEmitter {
                             respond400("pushServiceUrl must be HTTPS");
                             return;
                         }
+                        // pushServiceToken — bearer for the push relay. Charset cap to
+                        // printable ASCII (no newlines / control chars) so it can't
+                        // header-inject when later interpolated into an outgoing
+                        // `Authorization` header. 512 chars is an order of magnitude
+                        // above any realistic relay token.
+                        const pushTokenTrimmed = body.pushServiceToken !== undefined
+                            ? body.pushServiceToken.trim()
+                            : undefined;
+                        if (pushTokenTrimmed !== undefined &&
+                            pushTokenTrimmed !== "" &&
+                            !/^[\x21-\x7E]{1,512}$/.test(pushTokenTrimmed)) {
+                            respond400("pushServiceToken must be 1-512 printable ASCII characters");
+                            return;
+                        }
                         // pushServiceBaseUrl — bridge callback origin embedded in SW
                         // approveUrl/rejectUrl. http:// or attacker host = approval token
                         // exfiltration. Validate before persisting.
@@ -1309,6 +1341,41 @@ export class Server extends EventEmitter {
                             respond400("ntfyServer must be HTTPS");
                             return;
                         }
+                        // localEndpoint — used by LocalApiDriver as the inference base
+                        // URL. Must parse as http(s)://, be ≤2048 chars, and resolve to
+                        // a loopback or private address. Otherwise prompts + context
+                        // would stream to a public / metadata / file:// host. Same gate
+                        // the driver enforces at construction, raised to the HTTP
+                        // boundary so the bad value never reaches disk. Operator can
+                        // opt out via LOCAL_ENDPOINT_ALLOW_REMOTE=1 for audited
+                        // internal inference clusters.
+                        const localEndpointTrimmed = body.localEndpoint !== undefined
+                            ? body.localEndpoint.trim()
+                            : undefined;
+                        if (localEndpointTrimmed !== undefined &&
+                            localEndpointTrimmed !== "") {
+                            if (localEndpointTrimmed.length > 2048) {
+                                respond400("localEndpoint must be ≤2048 characters");
+                                return;
+                            }
+                            let parsed;
+                            try {
+                                parsed = new URL(localEndpointTrimmed);
+                            }
+                            catch {
+                                respond400("localEndpoint must be a valid http(s):// URL");
+                                return;
+                            }
+                            if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+                                respond400("localEndpoint must use http:// or https:// scheme");
+                                return;
+                            }
+                            if (process.env.LOCAL_ENDPOINT_ALLOW_REMOTE !== "1" &&
+                                !isLoopbackOrPrivateEndpoint(localEndpointTrimmed)) {
+                                respond400("localEndpoint must be loopback or private (set LOCAL_ENDPOINT_ALLOW_REMOTE=1 to override)");
+                                return;
+                            }
+                        }
                         // PHASE 2 — load config and apply all in-memory edits to `cfg`.
                         // Still no disk writes; if anything throws here the request
                         // returns 500 with no side effects.
@@ -1333,12 +1400,35 @@ export class Server extends EventEmitter {
                         }
                         if (body.model !== undefined) {
                             cfg.model = body.model;
-                            if (body.model === "local") {
-                                if (body.localEndpoint !== undefined)
-                                    cfg.localEndpoint = body.localEndpoint.trim() || undefined;
-                                if (body.localModel !== undefined)
-                                    cfg.localModel = body.localModel.trim() || undefined;
-                            }
+                        }
+                        // localEndpoint / localModel persist regardless of whether
+                        // `model` is sent. Previously they were silently dropped when
+                        // the dashboard updated only the endpoint of an already-local
+                        // install, which left the running driver pointed at the old
+                        // host until the user happened to re-pick "Local LLM" in the
+                        // UI.
+                        if (body.localEndpoint !== undefined) {
+                            cfg.localEndpoint = body.localEndpoint.trim() || undefined;
+                        }
+                        if (body.localModel !== undefined) {
+                            cfg.localModel = body.localModel.trim() || undefined;
+                        }
+                        // Push / ntfy fields used to be set only on `this.*` and were
+                        // lost on bridge restart. Persist alongside the rest.
+                        if (pushUrlTrimmed !== undefined) {
+                            cfg.pushServiceUrl = pushUrlTrimmed || undefined;
+                        }
+                        if (pushTokenTrimmed !== undefined) {
+                            cfg.pushServiceToken = pushTokenTrimmed || undefined;
+                        }
+                        if (pushBaseTrimmed !== undefined) {
+                            cfg.pushServiceBaseUrl = pushBaseTrimmed || undefined;
+                        }
+                        if (ntfyTopicTrimmed !== undefined) {
+                            cfg.ntfyTopic = ntfyTopicTrimmed || undefined;
+                        }
+                        if (ntfyServerTrimmed !== undefined) {
+                            cfg.ntfyServer = ntfyServerTrimmed || undefined;
                         }
                         // PHASE 3 — disk + secure-store writes. Order: secure store →
                         // bridge driver config → patchwork config. Each rolls back what
@@ -1348,7 +1438,19 @@ export class Server extends EventEmitter {
                                 saveApiKeyToSecureStore(body.apiKey.provider, body.apiKey.key);
                             }
                             catch (writeErr) {
-                                this.logger.error(`[/config/patchwork] saveApiKeyToSecureStore failed: ${writeErr instanceof Error ? writeErr.message : String(writeErr)}`);
+                                // Some Keychain / Secret-Service backends echo the
+                                // payload into the error message on certain failure
+                                // modes. Cap the logged message at 200 chars AND
+                                // strip anything that looks like the leading hex/
+                                // base64 of the just-attempted key so a misbehaving
+                                // backend can't leak it into bridge logs.
+                                const raw = writeErr instanceof Error
+                                    ? writeErr.message
+                                    : String(writeErr);
+                                const safe = raw
+                                    .replaceAll(body.apiKey.key, "[redacted]")
+                                    .slice(0, 200);
+                                this.logger.error(`[/config/patchwork] saveApiKeyToSecureStore failed: ${safe}`);
                                 res.writeHead(500, { "Content-Type": "application/json" });
                                 res.end(JSON.stringify({ error: "Failed to write provider API key" }));
                                 return;
@@ -1379,7 +1481,20 @@ export class Server extends EventEmitter {
                         // PHASE 4 — live state. Only after every persistence step
                         // succeeded; ensures live state never diverges from disk.
                         if (gateRaw !== undefined) {
+                            const prevGate = this.approvalGate;
                             this.approvalGate = gateRaw;
+                            // When the operator downgrades to "off", every pending
+                            // queue entry becomes moot — the originating tool dispatch
+                            // now bypasses, and a phone approver who hits "Approve"
+                            // five seconds later would get a 404. Cancel them
+                            // server-side so the dashboard /approvals list clears
+                            // and any pending phone notification reflects reality.
+                            if (gateRaw === "off" && prevGate !== "off") {
+                                const cancelled = getApprovalQueue().cancelAll();
+                                if (cancelled > 0) {
+                                    this.logger.info(`[/settings] approvalGate → off; cancelled ${cancelled} pending entr${cancelled === 1 ? "y" : "ies"}`);
+                                }
+                            }
                         }
                         if (body.enableTimeOfDayAnomaly !== undefined) {
                             this.enableTimeOfDayAnomaly = body.enableTimeOfDayAnomaly;
@@ -1390,8 +1505,8 @@ export class Server extends EventEmitter {
                         if (pushUrlTrimmed !== undefined) {
                             this.pushServiceUrl = pushUrlTrimmed || undefined;
                         }
-                        if (body.pushServiceToken !== undefined) {
-                            this.pushServiceToken = body.pushServiceToken.trim() || undefined;
+                        if (pushTokenTrimmed !== undefined) {
+                            this.pushServiceToken = pushTokenTrimmed || undefined;
                         }
                         if (pushBaseTrimmed !== undefined) {
                             this.pushServiceBaseUrl = pushBaseTrimmed || undefined;
@@ -1402,17 +1517,76 @@ export class Server extends EventEmitter {
                         if (ntfyServerTrimmed !== undefined) {
                             this.ntfyServer = ntfyServerTrimmed || undefined;
                         }
+                        // restartRequired covers fields the bridge only reads at boot:
+                        // driver/model/apiKey (env injection + driver factory), plus
+                        // localEndpoint/localModel which LocalApiDriver reads at
+                        // construction time. Push/ntfy fields are live-mutated on
+                        // `this.*` in PHASE 4 below, so they do not require restart.
                         const restartRequired = driverRaw !== undefined ||
                             body.apiKey !== undefined ||
-                            body.model !== undefined;
+                            body.model !== undefined ||
+                            body.localEndpoint !== undefined ||
+                            body.localModel !== undefined;
+                        // Audit-log emission — forensic record of every config mutation
+                        // so an operator can answer "who changed what, when?" after an
+                        // incident. Bearer-token auth doesn't carry an actor identity
+                        // (no user JWT) so we attribute to "http" with the request IP.
+                        // Secrets are redacted to the shape `"***"` — value presence
+                        // is recorded, value content is never logged.
+                        if (this.activityLog) {
+                            const changes = {};
+                            if (hasWebhookUpdate)
+                                changes.webhookUrl = webhookRaw || "";
+                            if (gateRaw !== undefined)
+                                changes.approvalGate = gateRaw;
+                            if (body.enableTimeOfDayAnomaly !== undefined)
+                                changes.enableTimeOfDayAnomaly = body.enableTimeOfDayAnomaly;
+                            if (driverRaw !== undefined)
+                                changes.driver = driverRaw;
+                            if (body.model !== undefined)
+                                changes.model = body.model;
+                            if (body.localEndpoint !== undefined)
+                                changes.localEndpoint = body.localEndpoint;
+                            if (body.localModel !== undefined)
+                                changes.localModel = body.localModel;
+                            if (body.apiKey)
+                                changes.apiKey = { provider: body.apiKey.provider, key: "***" };
+                            if (pushUrlTrimmed !== undefined)
+                                changes.pushServiceUrl = pushUrlTrimmed || "";
+                            if (pushTokenTrimmed !== undefined)
+                                changes.pushServiceToken = pushTokenTrimmed ? "***" : "";
+                            if (pushBaseTrimmed !== undefined)
+                                changes.pushServiceBaseUrl = pushBaseTrimmed || "";
+                            if (ntfyTopicTrimmed !== undefined)
+                                changes.ntfyTopic = ntfyTopicTrimmed ? "***" : "";
+                            if (ntfyServerTrimmed !== undefined)
+                                changes.ntfyServer = ntfyServerTrimmed || "";
+                            const remoteAddr = req.headers["x-forwarded-for"]
+                                ?.split(",")[0]
+                                ?.trim() ||
+                                req.socket.remoteAddress ||
+                                "unknown";
+                            this.activityLog.recordEvent("settings.change", {
+                                actor: "http",
+                                ip: remoteAddr,
+                                fields: Object.keys(changes),
+                                changes,
+                            });
+                        }
                         res.writeHead(200, { "Content-Type": "application/json" });
                         res.end(JSON.stringify({ ok: true, restartRequired }));
                     }
                 }
                 catch (err) {
-                    this.logger.error(`[/config/patchwork] error: ${err instanceof Error ? (err.stack ?? err.message) : String(err)}`);
-                    res.writeHead(400, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "Invalid request body" }));
+                    // Any error reaching this outer catch is unexpected — all caller
+                    // validation errors already returned their own 400 inline, and all
+                    // expected disk-write errors return their own 500. So this is a
+                    // server bug, not a client one. Returning 400 here misled clients
+                    // into believing they had sent a bad body when in fact something
+                    // crashed serverside.
+                    this.logger.error(`[/config/patchwork] unhandled error: ${err instanceof Error ? (err.stack ?? err.message) : String(err)}`);
+                    res.writeHead(500, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "Internal server error" }));
                 }
                 return;
             }
@@ -1541,8 +1715,10 @@ export class Server extends EventEmitter {
                 }
             }
             // /telemetry-prefs — read/write per-flag telemetry preferences.
-            // GET  → {crashReports, usageStats, localDiagnostics}
-            // POST {crashReports?, usageStats?, localDiagnostics?} → same shape (partial update)
+            // GET    → {crashReports, usageStats, localDiagnostics, endpoint, endpointSource}
+            // POST   {crashReports?, usageStats?, localDiagnostics?} → same shape (partial update)
+            // DELETE → clears prefs file + analytics-config + install salt
+            //          (right-to-erasure affordance).
             if (parsedUrl.pathname === "/telemetry-prefs") {
                 if (req.method === "GET") {
                     const prefs = getTelemetryPrefs();
@@ -1551,11 +1727,74 @@ export class Server extends EventEmitter {
                     if (all?.lastSentAt !== undefined) {
                         response.lastSentAt = all.lastSentAt;
                     }
+                    // Destination visibility — consent baseline. Caller can see
+                    // where their data would go and whether the destination came
+                    // from env (CI/headless) or the on-disk config file.
+                    const envEndpoint = process.env.PATCHWORK_ANALYTICS_ENDPOINT;
+                    const cfgEndpoint = getAnalyticsConfig().endpoint;
+                    const defaultEndpoint = "https://analytics.claude-ide-bridge.dev/v1/usage";
+                    if (envEndpoint) {
+                        response.endpoint = envEndpoint;
+                        response.endpointSource = "env";
+                    }
+                    else if (cfgEndpoint) {
+                        response.endpoint = cfgEndpoint;
+                        response.endpointSource = "config";
+                    }
+                    else {
+                        response.endpoint = defaultEndpoint;
+                        response.endpointSource = "default";
+                    }
                     res.writeHead(200, { "Content-Type": "application/json" });
                     res.end(JSON.stringify(response));
                     return;
                 }
+                if (req.method === "DELETE") {
+                    // Right-to-erasure: drop prefs, analytics-config (endpoint /
+                    // shared secret), and the install salt. Next outbound send
+                    // (if any) will mint a fresh salt and treat this as a new
+                    // install. Kill-switch is honored here too — incident-mode
+                    // operators may still want to scrub local state, so allow
+                    // it; flip if the threat model changes.
+                    try {
+                        unlinkSync(getAnalyticsPrefsPath());
+                    }
+                    catch {
+                        /* missing is fine */
+                    }
+                    try {
+                        unlinkSync(getAnalyticsSaltPath());
+                    }
+                    catch {
+                        /* missing is fine */
+                    }
+                    clearAnalyticsConfig();
+                    if (this.activityLog) {
+                        this.activityLog.recordEvent("telemetry.reset", {
+                            actor: "http",
+                            ip: req.headers["x-forwarded-for"]
+                                ?.split(",")[0]
+                                ?.trim() ||
+                                req.socket.remoteAddress ||
+                                "unknown",
+                        });
+                    }
+                    res.writeHead(200, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ ok: true }));
+                    return;
+                }
                 if (req.method === "POST") {
+                    // Kill-switch gate — telemetry prefs are config writes too.
+                    // GET stays open so operators can verify state during an
+                    // incident.
+                    if (isWriteKillSwitchActive()) {
+                        res.writeHead(423, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify({
+                            error: "kill_switch_blocked",
+                            reason: "Telemetry pref writes are disabled while the write kill-switch is engaged.",
+                        }));
+                        return;
+                    }
                     const TP_BODY_CAP = 1 * 1024;
                     const parsed = await readJsonBody(req, TP_BODY_CAP);
                     if (!parsed.ok) {
@@ -1576,6 +1815,25 @@ export class Server extends EventEmitter {
                         return;
                     }
                     const update = {};
+                    // Reject non-boolean values for known keys instead of silently
+                    // dropping them. Previously `{"crashReports": "true"}` (string)
+                    // got a 200 with no effect — caller never learned the toggle
+                    // did nothing. Misrepresented consent is the worst-case
+                    // outcome on the telemetry surface, so be strict here.
+                    for (const key of [
+                        "crashReports",
+                        "usageStats",
+                        "localDiagnostics",
+                    ]) {
+                        if (body[key] !== undefined && typeof body[key] !== "boolean") {
+                            res.writeHead(400, { "Content-Type": "application/json" });
+                            res.end(JSON.stringify({
+                                error: "invalid_request",
+                                reason: `${key} must be a boolean`,
+                            }));
+                            return;
+                        }
+                    }
                     if (typeof body.crashReports === "boolean") {
                         update.crashReports = body.crashReports;
                     }