patchwork-os 0.2.0-beta.5 → 0.2.0-beta.5.canary.10

package/dist/server.js

@@ -10,6 +10,7 @@ import { tryHandleConnectorRoute, tryHandlePublicConnectorRoute, } from "./conne
 import { timingSafeStringEqual } from "./crypto.js";
 import { renderDashboardHtml } from "./dashboard.js";
 import { EnvLockedFlagError, getEnvLockedValue, isEnvLockedFor, isWriteKillSwitchActive, KILL_SWITCH_WRITES, setFlag, } from "./featureFlags.js";
+import { respondIfUnknownBodyKeys } from "./httpBodyValidation.js";
 import { respond500 } from "./httpErrorResponse.js";
 import { tryHandleInboxRoute } from "./inboxRoutes.js";
 import { tryHandleMcpRoute } from "./mcpRoutes.js";
@@ -1174,55 +1175,59 @@ export class Server extends EventEmitter {
                 try {
                     {
                         const body = parsed.value ?? {};
+                        if (respondIfUnknownBodyKeys(res, body, [
+                            "webhookUrl",
+                            "approvalGate",
+                            "enableTimeOfDayAnomaly",
+                            "driver",
+                            "model",
+                            "localEndpoint",
+                            "localModel",
+                            "apiKey",
+                            "pushServiceUrl",
+                            "pushServiceToken",
+                            "pushServiceBaseUrl",
+                            "ntfyTopic",
+                            "ntfyServer",
+                        ])) {
+                            return;
+                        }
+                        // PHASE 1 — validate ALL fields up front. No disk writes, no
+                        // secure-store writes, no live-state mutations until every input
+                        // has passed. Prevents the "valid driver + invalid ntfyTopic"
+                        // class of bug where a 400 still leaves a partial side-effect on
+                        // disk.
+                        const respond400 = (error) => {
+                            res.writeHead(400, { "Content-Type": "application/json" });
+                            res.end(JSON.stringify({ error }));
+                        };
+                        // webhookUrl
                         const hasWebhookUpdate = body.webhookUrl !== undefined;
-                        const raw = hasWebhookUpdate
+                        const webhookRaw = hasWebhookUpdate
                             ? (body.webhookUrl?.trim() ?? "")
                             : undefined;
-                        if (raw !== undefined && raw !== "" && !/^https:\/\/.+/.test(raw)) {
-                            res.writeHead(400, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({ error: "webhookUrl must be HTTPS" }));
+                        if (webhookRaw !== undefined &&
+                            webhookRaw !== "" &&
+                            !/^https:\/\/.+/.test(webhookRaw)) {
+                            respond400("webhookUrl must be HTTPS");
                             return;
                         }
+                        // approvalGate
                         const gateRaw = body.approvalGate;
                         if (gateRaw !== undefined &&
                             gateRaw !== "off" &&
                             gateRaw !== "high" &&
                             gateRaw !== "all") {
-                            res.writeHead(400, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({
-                                error: 'approvalGate must be "off", "high", or "all"',
-                            }));
+                            respond400('approvalGate must be "off", "high", or "all"');
                             return;
                         }
-                        const configPath = patchworkConfigPath();
-                        const cfg = loadPatchworkConfig(configPath);
-                        cfg.dashboard = {
-                            port: cfg.dashboard?.port ?? 3200,
-                            requireApproval: cfg.dashboard?.requireApproval ?? ["high"],
-                            pushNotifications: cfg.dashboard?.pushNotifications ?? false,
-                            webhookUrl: hasWebhookUpdate
-                                ? raw || undefined
-                                : cfg.dashboard?.webhookUrl,
-                        };
-                        if (gateRaw !== undefined) {
-                            cfg.approvalGate = gateRaw;
-                            this.approvalGate = gateRaw;
-                        }
-                        // h10 toggle: must be boolean if present. Persists to
-                        // ~/.patchwork/config.json AND live-mutates the Server
-                        // field so the next /approvals POST honors it without
-                        // needing a bridge restart.
-                        if (body.enableTimeOfDayAnomaly !== undefined) {
-                            if (typeof body.enableTimeOfDayAnomaly !== "boolean") {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({
-                                    error: "enableTimeOfDayAnomaly must be a boolean",
-                                }));
-                                return;
-                            }
-                            cfg.enableTimeOfDayAnomaly = body.enableTimeOfDayAnomaly;
-                            this.enableTimeOfDayAnomaly = body.enableTimeOfDayAnomaly;
+                        // enableTimeOfDayAnomaly
+                        if (body.enableTimeOfDayAnomaly !== undefined &&
+                            typeof body.enableTimeOfDayAnomaly !== "boolean") {
+                            respond400("enableTimeOfDayAnomaly must be a boolean");
+                            return;
                         }
+                        // driver
                         const driverRaw = body.driver;
                         if (driverRaw !== undefined) {
                             const validDrivers = [
@@ -1236,26 +1241,11 @@ export class Server extends EventEmitter {
                                 "none",
                             ];
                             if (!validDrivers.includes(driverRaw)) {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({
-                                    error: `driver must be one of: ${validDrivers.join(", ")}`,
-                                }));
-                                return;
-                            }
-                            const driver = driverRaw;
-                            cfg.driver = driver;
-                            try {
-                                saveBridgeConfigDriver(driver, this.bridgeConfigPath);
-                            }
-                            catch (writeErr) {
-                                this.logger.error(`[/config/patchwork] saveBridgeConfigDriver failed: ${writeErr instanceof Error ? (writeErr.stack ?? writeErr.message) : String(writeErr)}`);
-                                res.writeHead(500, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({
-                                    error: "Failed to write bridge driver config",
-                                }));
+                                respond400(`driver must be one of: ${validDrivers.join(", ")}`);
                                 return;
                             }
                         }
+                        // model
                         if (body.model !== undefined) {
                             const validModels = [
                                 "claude",
@@ -1265,40 +1255,137 @@ export class Server extends EventEmitter {
                                 "local",
                             ];
                             if (!validModels.includes(body.model)) {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({
-                                    error: `model must be one of: ${validModels.join(", ")}`,
-                                }));
+                                respond400(`model must be one of: ${validModels.join(", ")}`);
                                 return;
                             }
-                            cfg.model = body.model;
-                            if (body.model === "local") {
-                                if (body.localEndpoint !== undefined)
-                                    cfg.localEndpoint = body.localEndpoint.trim() || undefined;
-                                if (body.localModel !== undefined)
-                                    cfg.localModel = body.localModel.trim() || undefined;
-                            }
                         }
+                        // apiKey
                         if (body.apiKey) {
                             const { provider, key } = body.apiKey;
                             const validProviders = ["anthropic", "openai", "google", "xai"];
                             if (!validProviders.includes(provider) ||
                                 typeof key !== "string") {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({ error: "Invalid apiKey provider or key" }));
+                                respond400("Invalid apiKey provider or key");
+                                return;
+                            }
+                        }
+                        // pushServiceUrl
+                        const pushUrlTrimmed = body.pushServiceUrl !== undefined
+                            ? body.pushServiceUrl.trim()
+                            : undefined;
+                        if (pushUrlTrimmed !== undefined &&
+                            pushUrlTrimmed !== "" &&
+                            !pushUrlTrimmed.startsWith("https://")) {
+                            respond400("pushServiceUrl must be HTTPS");
+                            return;
+                        }
+                        // pushServiceBaseUrl — bridge callback origin embedded in SW
+                        // approveUrl/rejectUrl. http:// or attacker host = approval token
+                        // exfiltration. Validate before persisting.
+                        const pushBaseTrimmed = body.pushServiceBaseUrl !== undefined
+                            ? body.pushServiceBaseUrl.trim()
+                            : undefined;
+                        if (pushBaseTrimmed !== undefined &&
+                            pushBaseTrimmed !== "" &&
+                            !pushBaseTrimmed.startsWith("https://")) {
+                            respond400("pushServiceBaseUrl must be HTTPS");
+                            return;
+                        }
+                        // ntfyTopic — bearer-token on public ntfy.sh; charset-restricted.
+                        const ntfyTopicTrimmed = body.ntfyTopic !== undefined ? body.ntfyTopic.trim() : undefined;
+                        if (ntfyTopicTrimmed !== undefined &&
+                            ntfyTopicTrimmed !== "" &&
+                            !/^[A-Za-z0-9_-]{1,64}$/.test(ntfyTopicTrimmed)) {
+                            respond400("ntfyTopic must match [A-Za-z0-9_-]{1,64}");
+                            return;
+                        }
+                        // ntfyServer — same threat model as pushServiceBaseUrl.
+                        const ntfyServerTrimmed = body.ntfyServer !== undefined
+                            ? body.ntfyServer.trim()
+                            : undefined;
+                        if (ntfyServerTrimmed !== undefined &&
+                            ntfyServerTrimmed !== "" &&
+                            !ntfyServerTrimmed.startsWith("https://")) {
+                            respond400("ntfyServer must be HTTPS");
+                            return;
+                        }
+                        // PHASE 2 — load config and apply all in-memory edits to `cfg`.
+                        // Still no disk writes; if anything throws here the request
+                        // returns 500 with no side effects.
+                        const configPath = patchworkConfigPath();
+                        const cfg = loadPatchworkConfig(configPath);
+                        cfg.dashboard = {
+                            port: cfg.dashboard?.port ?? 3200,
+                            requireApproval: cfg.dashboard?.requireApproval ?? ["high"],
+                            pushNotifications: cfg.dashboard?.pushNotifications ?? false,
+                            webhookUrl: hasWebhookUpdate
+                                ? webhookRaw || undefined
+                                : cfg.dashboard?.webhookUrl,
+                        };
+                        if (gateRaw !== undefined) {
+                            cfg.approvalGate = gateRaw;
+                        }
+                        if (body.enableTimeOfDayAnomaly !== undefined) {
+                            cfg.enableTimeOfDayAnomaly = body.enableTimeOfDayAnomaly;
+                        }
+                        if (driverRaw !== undefined) {
+                            cfg.driver = driverRaw;
+                        }
+                        if (body.model !== undefined) {
+                            cfg.model = body.model;
+                        }
+                        // localEndpoint / localModel persist regardless of whether
+                        // `model` is sent. Previously they were silently dropped when
+                        // the dashboard updated only the endpoint of an already-local
+                        // install, which left the running driver pointed at the old
+                        // host until the user happened to re-pick "Local LLM" in the
+                        // UI.
+                        if (body.localEndpoint !== undefined) {
+                            cfg.localEndpoint = body.localEndpoint.trim() || undefined;
+                        }
+                        if (body.localModel !== undefined) {
+                            cfg.localModel = body.localModel.trim() || undefined;
+                        }
+                        // Push / ntfy fields used to be set only on `this.*` and were
+                        // lost on bridge restart. Persist alongside the rest.
+                        if (pushUrlTrimmed !== undefined) {
+                            cfg.pushServiceUrl = pushUrlTrimmed || undefined;
+                        }
+                        if (body.pushServiceToken !== undefined) {
+                            cfg.pushServiceToken = body.pushServiceToken.trim() || undefined;
+                        }
+                        if (pushBaseTrimmed !== undefined) {
+                            cfg.pushServiceBaseUrl = pushBaseTrimmed || undefined;
+                        }
+                        if (ntfyTopicTrimmed !== undefined) {
+                            cfg.ntfyTopic = ntfyTopicTrimmed || undefined;
+                        }
+                        if (ntfyServerTrimmed !== undefined) {
+                            cfg.ntfyServer = ntfyServerTrimmed || undefined;
+                        }
+                        // PHASE 3 — disk + secure-store writes. Order: secure store →
+                        // bridge driver config → patchwork config. Each rolls back what
+                        // it can on later failure (left to PR #02; for now log + 500).
+                        if (body.apiKey) {
+                            try {
+                                saveApiKeyToSecureStore(body.apiKey.provider, body.apiKey.key);
+                            }
+                            catch (writeErr) {
+                                this.logger.error(`[/config/patchwork] saveApiKeyToSecureStore failed: ${writeErr instanceof Error ? writeErr.message : String(writeErr)}`);
+                                res.writeHead(500, { "Content-Type": "application/json" });
+                                res.end(JSON.stringify({ error: "Failed to write provider API key" }));
                                 return;
                             }
-                            // Provider keys go to the secure store (Keychain/DPAPI/Secret
-                            // Service / AES-256-GCM file fallback) — never persisted to
-                            // ~/.patchwork/config.json. Empty string clears.
+                        }
+                        if (driverRaw !== undefined) {
                             try {
-                                saveApiKeyToSecureStore(provider, key);
+                                saveBridgeConfigDriver(driverRaw, this.bridgeConfigPath);
                             }
                             catch (writeErr) {
-                                this.logger.error(`[/config/patchwork] saveApiKeyToSecureStore failed: ${writeErr instanceof Error ? (writeErr.stack ?? writeErr.message) : String(writeErr)}`);
+                                this.logger.error(`[/config/patchwork] saveBridgeConfigDriver failed: ${writeErr instanceof Error ? writeErr.message : String(writeErr)}`);
                                 res.writeHead(500, { "Content-Type": "application/json" });
                                 res.end(JSON.stringify({
-                                    error: "Failed to write provider API key",
+                                    error: "Failed to write bridge driver config",
                                 }));
                                 return;
                             }
@@ -1307,73 +1394,47 @@ export class Server extends EventEmitter {
                             savePatchworkConfig(cfg, configPath);
                         }
                         catch (writeErr) {
-                            this.logger.error(`[/config/patchwork] savePatchworkConfig failed: ${writeErr instanceof Error ? (writeErr.stack ?? writeErr.message) : String(writeErr)}`);
+                            this.logger.error(`[/config/patchwork] savePatchworkConfig failed: ${writeErr instanceof Error ? writeErr.message : String(writeErr)}`);
                             res.writeHead(500, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({
-                                error: "Failed to write patchwork config",
-                            }));
+                            res.end(JSON.stringify({ error: "Failed to write patchwork config" }));
                             return;
                         }
+                        // PHASE 4 — live state. Only after every persistence step
+                        // succeeded; ensures live state never diverges from disk.
+                        if (gateRaw !== undefined) {
+                            this.approvalGate = gateRaw;
+                        }
+                        if (body.enableTimeOfDayAnomaly !== undefined) {
+                            this.enableTimeOfDayAnomaly = body.enableTimeOfDayAnomaly;
+                        }
                         if (hasWebhookUpdate) {
-                            this.approvalWebhookUrl = raw || undefined;
+                            this.approvalWebhookUrl = webhookRaw || undefined;
                         }
-                        if (body.pushServiceUrl !== undefined) {
-                            const pushUrl = body.pushServiceUrl.trim();
-                            if (pushUrl && !pushUrl.startsWith("https://")) {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({ error: "pushServiceUrl must be HTTPS" }));
-                                return;
-                            }
-                            this.pushServiceUrl = pushUrl || undefined;
+                        if (pushUrlTrimmed !== undefined) {
+                            this.pushServiceUrl = pushUrlTrimmed || undefined;
                         }
                         if (body.pushServiceToken !== undefined) {
                             this.pushServiceToken = body.pushServiceToken.trim() || undefined;
                         }
-                        if (body.pushServiceBaseUrl !== undefined) {
-                            const baseUrl = body.pushServiceBaseUrl.trim();
-                            // pushServiceBaseUrl is the bridge callback origin embedded in
-                            // the SW's approveUrl/rejectUrl. If it can be set to plain
-                            // http:// or to a host the operator didn't intend, the SW will
-                            // POST the one-shot approvalToken there — letting an attacker
-                            // who sets this redirect every approval to attacker.tld and
-                            // replay tokens to the real bridge for silent auto-approve.
-                            if (baseUrl && !baseUrl.startsWith("https://")) {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({ error: "pushServiceBaseUrl must be HTTPS" }));
-                                return;
-                            }
-                            this.pushServiceBaseUrl = baseUrl || undefined;
+                        if (pushBaseTrimmed !== undefined) {
+                            this.pushServiceBaseUrl = pushBaseTrimmed || undefined;
                         }
-                        if (body.ntfyTopic !== undefined) {
-                            const topic = body.ntfyTopic.trim();
-                            // Topic acts as a bearer token on the public ntfy.sh server —
-                            // anyone subscribed sees the approval payload + single-use
-                            // approvalToken. Reject empty / whitespace / control chars to
-                            // avoid silent misconfiguration.
-                            if (topic && !/^[A-Za-z0-9_-]{1,64}$/.test(topic)) {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({
-                                    error: "ntfyTopic must match [A-Za-z0-9_-]{1,64}",
-                                }));
-                                return;
-                            }
-                            this.ntfyTopic = topic || undefined;
+                        if (ntfyTopicTrimmed !== undefined) {
+                            this.ntfyTopic = ntfyTopicTrimmed || undefined;
                         }
-                        if (body.ntfyServer !== undefined) {
-                            const server = body.ntfyServer.trim();
-                            // Same reasoning as pushServiceBaseUrl — the bridge sends the
-                            // single-use token to this URL. http:// would expose it on the
-                            // wire; a malicious value would exfiltrate every approval.
-                            if (server && !server.startsWith("https://")) {
-                                res.writeHead(400, { "Content-Type": "application/json" });
-                                res.end(JSON.stringify({ error: "ntfyServer must be HTTPS" }));
-                                return;
-                            }
-                            this.ntfyServer = server || undefined;
+                        if (ntfyServerTrimmed !== undefined) {
+                            this.ntfyServer = ntfyServerTrimmed || undefined;
                         }
+                        // restartRequired covers fields the bridge only reads at boot:
+                        // driver/model/apiKey (env injection + driver factory), plus
+                        // localEndpoint/localModel which LocalApiDriver reads at
+                        // construction time. Push/ntfy fields are live-mutated on
+                        // `this.*` in PHASE 4 below, so they do not require restart.
                         const restartRequired = driverRaw !== undefined ||
                             body.apiKey !== undefined ||
-                            body.model !== undefined;
+                            body.model !== undefined ||
+                            body.localEndpoint !== undefined ||
+                            body.localModel !== undefined;
                         res.writeHead(200, { "Content-Type": "application/json" });
                         res.end(JSON.stringify({ ok: true, restartRequired }));
                     }
@@ -1432,6 +1493,9 @@ export class Server extends EventEmitter {
                         return;
                     }
                     const body = parsed.value ?? {};
+                    if (respondIfUnknownBodyKeys(res, body, ["engage", "reason"])) {
+                        return;
+                    }
                     if (typeof body.engage !== "boolean") {
                         res.writeHead(400, { "Content-Type": "application/json" });
                         res.end(JSON.stringify({
@@ -1534,6 +1598,13 @@ export class Server extends EventEmitter {
                         return;
                     }
                     const body = parsed.value ?? {};
+                    if (respondIfUnknownBodyKeys(res, body, [
+                        "crashReports",
+                        "usageStats",
+                        "localDiagnostics",
+                    ])) {
+                        return;
+                    }
                     const update = {};
                     if (typeof body.crashReports === "boolean") {
                         update.crashReports = body.crashReports;