patchwork-os 0.2.0-beta.9.canary.92 → 1.1.0-beta.1

package/dist/recipeRoutes.js

@@ -29,11 +29,32 @@
 import os from "node:os";
 import path from "node:path";
 import { computeSummary as computeActivationSummary, loadMetrics as loadActivationMetrics, } from "./activationMetrics.js";
+import { getApprovalQueue } from "./approvalQueue.js";
+import { buildCopilotReply, parseCopilotIntent, } from "./copilot/parseIntent.js";
 import { isWriteKillSwitchActive } from "./featureFlags.js";
 import { consumeToken, refillBucket, } from "./fp/tokenBucket.js";
 import { respondIfUnknownBodyKeys } from "./httpBodyValidation.js";
 import { respond500 } from "./httpErrorResponse.js";
+import { cancelRun } from "./recipes/runRegistry.js";
+import { invalidateRecipesCache } from "./recipesHttp.js";
 import { validateSafeUrl } from "./ssrfGuard.js";
+/**
+ * Sanitize error messages from storage operations before including them in
+ * HTTP responses. Node.js filesystem errors (ENOENT, EACCES, etc.) often
+ * contain absolute paths (e.g. "ENOENT: no such file or directory, open
+ * '/home/user/.patchwork/recipes/foo.yaml'"). These must not be returned
+ * verbatim to clients. Returns "Storage error" for any message that looks
+ * like a filesystem error (identified by Node.js errno code prefix);
+ * otherwise returns the message unchanged.
+ */
+function sanitizeStorageError(msg) {
+    // Node.js filesystem errors always start with an errno code such as
+    // "ENOENT:", "EACCES:", "EPERM:", "EBUSY:", "EISDIR:", etc.
+    if (/^E[A-Z]+:/.test(msg)) {
+        return "Storage error";
+    }
+    return msg;
+}
 // 5-minute cache of the public template registry from the patchworkos/recipes
 // GitHub repo. Process-wide; hoisted out of Server class state.
 // Sentinel `false` marks a negative-cache entry (fetch failed) — distinct from
@@ -41,20 +62,86 @@ import { validateSafeUrl } from "./ssrfGuard.js";
 let templatesCache = null;
 let templatesCacheTs = 0;
 /**
- * #605: shape-validate the upstream templates payload before caching.
+ * Canonical trust enums the dashboard understands. Anything outside these
+ * sets must NOT survive into the cached registry — an out-of-enum
+ * `risk_level` evaluates falsy downstream (silently reading as "safe") and
+ * `RISK_PILL_CLASS[risk_level]` resolves to `undefined`.
+ */
+const TEMPLATE_RISK_LEVELS = new Set(["low", "medium", "high"]);
+const TEMPLATE_APPROVAL_BEHAVIORS = new Set([
+    "always_ask",
+    "ask_on_novel",
+    "auto_approve",
+]);
+/**
+ * #605 / B3-A: shape-validate AND sanitize the upstream templates payload
+ * before caching.
+ *
  * The minimal contract used by the dashboard marketplace is `{recipes:
- * Array}` (other fields are optional). Anything else (an error page
- * JSON, a tampered file with a flipped key, a future GitHub schema
- * change) is rejected so we don't serve garbage for 5 minutes to every
- * dashboard client.
+ * Array}` (other fields are optional). A bare array is accepted too (legacy).
+ * Anything that fails that contract (an error page JSON, a tampered file with
+ * a flipped top-level key, a future GitHub schema change) is rejected so we
+ * don't serve garbage for 5 minutes to every dashboard client.
+ *
+ * B3-A SECURITY change: rather than reject the WHOLE payload when a single
+ * entry carries a malformed trust field, we SANITIZE each entry IN PLACE so
+ * one bad entry can't poison the registry for every client. For each entry:
+ *
+ *   - `risk_level` not in {low,medium,high}        → stripped (set undefined)
+ *   - `approval_behavior` not in the canonical set → stripped (set undefined)
+ *   - `downloads` not a finite number              → coerced if it parses to a
+ *                                                     finite number, else dropped
+ *
+ * Conservative by design: stripping an out-of-enum `risk_level` means the
+ * dashboard treats trust as UNKNOWN (which the default-deny gate renders as
+ * elevated), never silently as "low"/"safe".
  */
-function isWellFormedTemplatesPayload(raw) {
+export function isWellFormedTemplatesPayload(raw) {
     if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-        // Some legacy callers used a bare array; accept that too.
-        return Array.isArray(raw);
+        // Some legacy callers used a bare array; accept (and sanitize) that too.
+        if (Array.isArray(raw)) {
+            for (const entry of raw)
+                sanitizeTemplateEntry(entry);
+            return true;
+        }
+        return false;
     }
     const r = raw;
-    return Array.isArray(r.recipes);
+    if (!Array.isArray(r.recipes))
+        return false;
+    for (const entry of r.recipes)
+        sanitizeTemplateEntry(entry);
+    return true;
+}
+/**
+ * Strip/coerce untrusted trust fields on a single registry entry, mutating it
+ * in place. Non-object entries are left untouched (the dashboard tolerates
+ * them; they simply won't render trust pills). Kept conservative: we only
+ * touch the three fields with a downstream safety impact.
+ */
+function sanitizeTemplateEntry(entry) {
+    if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
+        return;
+    }
+    const e = entry;
+    // risk_level: must be one of the canonical levels, else undefined.
+    if ("risk_level" in e && !TEMPLATE_RISK_LEVELS.has(e.risk_level)) {
+        e.risk_level = undefined;
+    }
+    // approval_behavior: must be one of the canonical behaviors, else undefined.
+    if ("approval_behavior" in e &&
+        !TEMPLATE_APPROVAL_BEHAVIORS.has(e.approval_behavior)) {
+        e.approval_behavior = undefined;
+    }
+    // downloads: must be a finite number. Coerce a numeric string; otherwise
+    // drop. A non-numeric value (e.g. "abc") must never pass through as-is.
+    if ("downloads" in e && typeof e.downloads !== "number") {
+        const n = Number(e.downloads);
+        e.downloads = Number.isFinite(n) ? n : undefined;
+    }
+    else if (typeof e.downloads === "number" && !Number.isFinite(e.downloads)) {
+        e.downloads = undefined;
+    }
 }
 /**
  * Per-process token bucket guarding `/recipes/generate`. Every call to the
@@ -117,7 +204,7 @@ export function _resetRepairRateLimitForTests() {
 //                 per R3 amendment 4 / I-3, prevents JSON.stringify smuggling
 //                 a `..` segment into a coerced value at render time).
 const VARS_KEY_RE = /^[a-zA-Z_][a-zA-Z0-9_]{0,63}$/;
-const VARS_VALUE_RE = /^[\w\-. :+@,]+$/u;
+const VARS_VALUE_RE = /^(?!.*\.\.)([\w\-. :+@,]+)$/u;
 /** Validate the HTTP-supplied `vars` object. Returns null on success. */
 export function validateRecipeVars(vars) {
     if (vars == null)
@@ -188,6 +275,28 @@ export const RECIPE_ROUTE_BODY_CAPS = {
      * (256 KB matches the existing PUT/POST/lint caps).
      */
     repair: 256 * 1024,
+    /**
+     * PATCH /recipes/:name — only `{ "enabled": true/false }` (≈ 15 bytes).
+     * 1 KB is 66× that maximum; 256 KB was a trivial DoS vector.
+     */
+    toggle: 1 * 1024,
+    /**
+     * POST /outcomes — `{ issueUrl, disposition, recipeName?, workerClass? }`.
+     * A URL + short enum + two audit strings; 2 KB is generous.
+     */
+    outcomes: 2 * 1024,
+    /**
+     * POST /traces/decision — `{ ref, problem, solution, workspace?, tags?,
+     * sessionId?, source? }`. problem/solution are each capped at 500 chars
+     * by DecisionTraceLog.record(); 8 KB covers that plus tags/metadata with
+     * headroom, matching the shape of the ctxSaveTrace MCP tool's inputs.
+     */
+    decisionTrace: 8 * 1024,
+    /**
+     * POST /copilot/message — `{ text: string }`, a single chat-input line.
+     * 4 KB is generous for free text while blocking a pathological paste.
+     */
+    copilotMessage: 4 * 1024,
 };
 /**
  * Read an HTTP request body up to `max` bytes. Returns the raw string or
@@ -212,11 +321,14 @@ export function readBodyWithCap(req, max) {
             total += chunk.byteLength;
             if (total > max) {
                 aborted = true;
+                // Remove the data listener immediately so no further chunks accumulate
+                // in `chunks` after the promise resolves. The `aborted` guard already
+                // prevents adding to `chunks`, but leaving the listener attached causes
+                // unnecessary listener accumulation when the same socket is reused.
+                req.removeListener("data", onData);
                 // Resolve immediately so the route can write 413; do NOT destroy the
                 // socket here — destroying mid-upload races with the response write
                 // and the client sees EPIPE/ECONNRESET before reading the body.
-                // Subsequent chunks land in `onData` again but the `aborted` guard
-                // discards them, draining the upload until the client emits `end`.
                 resolve({ ok: false, code: "too_large" });
                 // Force the underlying stream to keep flowing so buffered upload
                 // data drains naturally. Without this Node may pause the stream
@@ -234,6 +346,7 @@ export function readBodyWithCap(req, max) {
         const onEnd = () => {
             if (aborted)
                 return;
+            req.removeListener("data", onData);
             const bytes = Buffer.concat(chunks);
             // `bytes` is the raw on-the-wire body; `body` is the utf-8 decode used
             // by JSON parsers. HMAC consumers must use `bytes` to avoid the
@@ -244,6 +357,7 @@ export function readBodyWithCap(req, max) {
             if (aborted)
                 return;
             aborted = true;
+            req.removeListener("data", onData);
             // Treat aborted/error mid-stream as a malformed read. Callers that
             // care about the distinction can check the `code` on the
             // readJsonBody result; here we collapse to "too_large" to keep
@@ -304,6 +418,73 @@ function respondInvalidJson(res) {
     res.writeHead(400, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ ok: false, error: "Invalid JSON body" }));
 }
+// END A-PR2 EDIT BLOCK
+// ---------------------------------------------------------------------
+// B3-A — post-redirect SSRF re-check for the non-github HTTPS install path.
+//
+// `validateSafeUrl` only validates the FIRST hop and explicitly does NOT pin
+// the resolved IP across redirects (see src/ssrfGuard.ts header comment). A
+// bare `fetch(url, { redirect: "follow" })` therefore lets a 302 → private
+// IP / IMDS slip past the upfront guard. This helper replays the manual
+// redirect-loop pattern from the CLI `httpsGet` in
+// src/commands/recipeInstall.ts: every hop's host is re-validated with the
+// canonical async guard (`validateSafeUrl`, which re-resolves DNS), the chain
+// is capped, and relative `Location` values are resolved against the current
+// URL before re-validation.
+// ---------------------------------------------------------------------
+const INSTALL_FETCH_MAX_REDIRECTS = 5;
+/**
+ * Fetch `startUrl` following HTTP redirects manually, re-validating every hop
+ * against the SSRF guard. Throws on a blocked host (private/loopback),
+ * unsupported protocol, malformed `Location`, or exceeding the hop cap.
+ * Returns the terminal (non-redirect) `Response`.
+ *
+ * `fetchImpl` is injectable for tests; defaults to the global `fetch`.
+ * `signal` is forwarded to every hop so the install timeout still applies.
+ */
+export async function fetchFollowingRedirectsSafely(startUrl, opts = {}) {
+    const doFetch = opts.fetchImpl ?? fetch;
+    let currentUrl = startUrl;
+    for (let hop = 0; hop <= INSTALL_FETCH_MAX_REDIRECTS; hop++) {
+        // Re-validate the host of THIS hop before issuing the request. The first
+        // hop was already validated by the route, but re-checking is cheap and
+        // keeps this helper self-contained / correct in isolation.
+        const ssrf = await validateSafeUrl(currentUrl);
+        if (!ssrf.ok) {
+            throw new Error(`SSRF guard blocked redirect target: ${ssrf.detail ?? ssrf.reason ?? "unknown"}`);
+        }
+        const res = await doFetch(currentUrl, {
+            ...(opts.signal ? { signal: opts.signal } : {}),
+            redirect: "manual",
+        });
+        const isRedirect = res.status >= 300 && res.status < 400;
+        // Defensive: a non-redirect response with no `Location` is terminal even
+        // if a stub omits the `headers` object entirely.
+        const location = typeof res.headers?.get === "function"
+            ? res.headers.get("location")
+            : null;
+        if (!isRedirect || !location) {
+            // Terminal response — host already validated above.
+            return res;
+        }
+        if (hop >= INSTALL_FETCH_MAX_REDIRECTS) {
+            throw new Error(`Too many redirects (>${INSTALL_FETCH_MAX_REDIRECTS}) installing recipe`);
+        }
+        // Resolve relative redirects against the current URL so a relative
+        // `Location: /foo` isn't treated as an empty hostname.
+        let nextUrl;
+        try {
+            nextUrl = new URL(location, currentUrl);
+        }
+        catch {
+            throw new Error(`Invalid redirect location: "${location}"`);
+        }
+        currentUrl = nextUrl.toString();
+        // Loop re-validates currentUrl at the top before fetching it.
+    }
+    // Unreachable: the loop either returns a terminal response or throws.
+    throw new Error("Too many redirects installing recipe");
+}
 /**
  * Best-effort fire of the recipe-changed notification. Wraps the
  * callback in try/catch + console.error so a misbehaving notifier
@@ -313,6 +494,7 @@ function respondInvalidJson(res) {
  * routes after their respective success paths.
  */
 function fireOnRecipesChanged(deps) {
+    invalidateRecipesCache();
     if (!deps.onRecipesChangedFn)
         return;
     try {
@@ -521,6 +703,270 @@ export function tryHandleRecipeRoute(req, res, parsedUrl, deps) {
         }
         return true;
     }
+    // GET /workers/shadow — read-only worker trust dial + ramp-vs-gate report.
+    // Replays the run log + gate decision log through the (worker × action-class)
+    // ramp; changes nothing. Backs the dashboard /workers page.
+    if (parsedUrl.pathname === "/workers/shadow" && req.method === "GET") {
+        void (async () => {
+            try {
+                const data = (await deps.workerShadowFn?.()) ?? {
+                    workers: [],
+                    runsScanned: 0,
+                    decisionsScanned: 0,
+                };
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ ...data, generatedAt: new Date().toISOString() }));
+            }
+            catch (err) {
+                respond500(res, err);
+            }
+        })();
+        return true;
+    }
+    // GET /gate/decisions — read-only query over the persisted Decision Record
+    // (worker_gate_decisions.jsonl). Backs `patchwork gate explain`. Requires
+    // BOTH workerId and classKey (there is no useful "explain everything"
+    // default; this is the one-decision/one-history lookup, not a dashboard
+    // feed like /workers/shadow).
+    if (parsedUrl.pathname === "/gate/decisions" && req.method === "GET") {
+        try {
+            const sp = parsedUrl.searchParams;
+            const workerId = sp.get("workerId") ?? undefined;
+            const classKey = sp.get("classKey") ?? undefined;
+            const limitRaw = sp.get("limit");
+            const limit = limitRaw ? Number.parseInt(limitRaw, 10) : undefined;
+            const decisions = deps.gateDecisionsFn?.({
+                ...(workerId && { workerId }),
+                ...(classKey && { classKey }),
+                ...(Number.isFinite(limit) && { limit }),
+            }) ?? [];
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ decisions }));
+        }
+        catch (err) {
+            respond500(res, err);
+        }
+        return true;
+    }
+    // POST /traces/decision — record a Decision Record trace over HTTP. The
+    // HTTP twin of the `ctxSaveTrace` MCP tool: same `DecisionTraceLog.record()`
+    // writer, same JSONL file, same validation (ref/problem/solution required,
+    // 500-char caps). Exists so future non-MCP callers (dashboard copilot, CI,
+    // scripts) can write decision traces without an MCP client. Bearer-gated —
+    // all recipe routes run after the auth gate in server.ts.
+    if (parsedUrl.pathname === "/traces/decision" && req.method === "POST") {
+        void (async () => {
+            const parsedBody = await readJsonBody(req, RECIPE_ROUTE_BODY_CAPS.decisionTrace);
+            if (!parsedBody.ok) {
+                if (parsedBody.code === "too_large") {
+                    respond413(res, RECIPE_ROUTE_BODY_CAPS.decisionTrace);
+                }
+                else {
+                    respondInvalidJson(res);
+                }
+                return;
+            }
+            const respond400 = (error) => {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ ok: false, error }));
+            };
+            try {
+                const parsed = parsedBody.value ?? {};
+                if (respondIfUnknownBodyKeys(res, parsed, [
+                    "ref",
+                    "problem",
+                    "solution",
+                    "workspace",
+                    "tags",
+                    "sessionId",
+                    "source",
+                ]))
+                    return;
+                const { ref, problem, solution, workspace, tags, sessionId, source } = parsed;
+                if (typeof ref !== "string" || !ref.trim()) {
+                    respond400("`ref` is required (issue ref, PR ref, commit SHA, or free text).");
+                    return;
+                }
+                if (typeof problem !== "string" || !problem.trim()) {
+                    respond400("`problem` is required.");
+                    return;
+                }
+                if (typeof solution !== "string" || !solution.trim()) {
+                    respond400("`solution` is required.");
+                    return;
+                }
+                if (workspace !== undefined && typeof workspace !== "string") {
+                    respond400("`workspace` must be a string when present.");
+                    return;
+                }
+                if (tags !== undefined &&
+                    (!Array.isArray(tags) || !tags.every((t) => typeof t === "string"))) {
+                    respond400("`tags` must be an array of strings when present.");
+                    return;
+                }
+                if (sessionId !== undefined && typeof sessionId !== "string") {
+                    respond400("`sessionId` must be a string when present.");
+                    return;
+                }
+                if (source !== undefined && typeof source !== "string") {
+                    respond400("`source` must be a string when present.");
+                    return;
+                }
+                if (!deps.saveDecisionTraceFn) {
+                    res.writeHead(503, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({
+                        ok: false,
+                        error: "Decision Record unavailable on this bridge.",
+                    }));
+                    return;
+                }
+                const trace = deps.saveDecisionTraceFn({
+                    ref,
+                    problem,
+                    solution,
+                    ...(workspace && { workspace }),
+                    ...(tags && { tags }),
+                    ...(sessionId && { sessionId }),
+                    ...(source && { source }),
+                });
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ ok: true, trace }));
+            }
+            catch (err) {
+                respond400(err instanceof Error ? err.message : "Invalid decision trace input.");
+            }
+        })();
+        return true;
+    }
+    // GET /outcomes — read-only list of operator outcome dispositions
+    // (~/.patchwork/outcome-log.jsonl, deduped last-writer-wins). Backs the
+    // dashboard "Filed outcomes" card + mirrors `patchwork outcomes list`.
+    // Bearer-gated (all recipe routes run after the auth gate in server.ts).
+    if (parsedUrl.pathname === "/outcomes" && req.method === "GET") {
+        try {
+            const outcomes = deps.outcomeStoreFn?.().readAll() ?? [];
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ outcomes }));
+        }
+        catch (err) {
+            respond500(res, err);
+        }
+        return true;
+    }
+    // GET /outcomes/pending — the confirm queue: worker filings awaiting an
+    // operator disposition. Read-only join over the run log + dispositions;
+    // backs the dashboard "awaiting confirmation" badge + mirrors
+    // `patchwork outcomes pending`. (Exact-path match, so it never shadows the
+    // bare /outcomes routes above.)
+    if (parsedUrl.pathname === "/outcomes/pending" && req.method === "GET") {
+        try {
+            const pending = deps.pendingConfirmationsFn?.() ?? [];
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ pending }));
+        }
+        catch (err) {
+            respond500(res, err);
+        }
+        return true;
+    }
+    // POST /outcomes — operator positive-act: record a `confirmed`|`junk`
+    // disposition for a worker-filed issue/PR URL. The HTTP twin of `patchwork
+    // outcomes confirm|reject` (src/workers/outcomesCli.ts) and the only write
+    // path the dashboard uses. `unknown` is ingester-only and rejected here.
+    // Same URL validation as the CLI. SELF-CONFIRM PROHIBITION: exposed over
+    // Bearer-gated HTTP + CLI only — never as a recipe step or MCP tool — so a
+    // worker cannot confirm its own filing. Append-only supersede makes a
+    // mis-click recoverable by a corrected write.
+    if (parsedUrl.pathname === "/outcomes" && req.method === "POST") {
+        void (async () => {
+            const parsedBody = await readJsonBody(req, RECIPE_ROUTE_BODY_CAPS.outcomes);
+            if (!parsedBody.ok) {
+                if (parsedBody.code === "too_large") {
+                    respond413(res, RECIPE_ROUTE_BODY_CAPS.outcomes);
+                }
+                else {
+                    respondInvalidJson(res);
+                }
+                return;
+            }
+            try {
+                const parsed = parsedBody.value ?? {};
+                if (respondIfUnknownBodyKeys(res, parsed, [
+                    "issueUrl",
+                    "disposition",
+                    "recipeName",
+                    "workerClass",
+                ]))
+                    return;
+                const respond400 = (error) => {
+                    res.writeHead(400, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ ok: false, error }));
+                };
+                const { issueUrl, disposition, recipeName, workerClass } = parsed;
+                if (typeof issueUrl !== "string" || !/^https?:\/\//.test(issueUrl)) {
+                    respond400("`issueUrl` must be an http(s) URL (the filed issue/PR URL).");
+                    return;
+                }
+                // `unknown` is ingester-only — an operator either confirms or rejects.
+                if (disposition !== "confirmed" && disposition !== "junk") {
+                    respond400('`disposition` must be "confirmed" or "junk" ("unknown" is ingester-only).');
+                    return;
+                }
+                if (recipeName !== undefined && typeof recipeName !== "string") {
+                    respond400("`recipeName` must be a string when present.");
+                    return;
+                }
+                if (workerClass !== undefined && typeof workerClass !== "string") {
+                    respond400("`workerClass` must be a string when present.");
+                    return;
+                }
+                const store = deps.outcomeStoreFn?.();
+                if (!store) {
+                    res.writeHead(503, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({
+                        ok: false,
+                        error: "Outcome store unavailable on this bridge.",
+                    }));
+                    return;
+                }
+                store.upsert({
+                    issueUrl,
+                    disposition,
+                    checkedAt: Date.now(),
+                    ...(recipeName ? { recipeName } : {}),
+                    ...(workerClass ? { workerClass } : {}),
+                });
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ ok: true, issueUrl, disposition }));
+            }
+            catch (err) {
+                respond500(res, err);
+            }
+        })();
+        return true;
+    }
+    // GET /approvals/kpi — considered-approval KPI (reject rate, latency-to-
+    // decision, abandoned, dashboard-vs-phone). Read-only over the persisted
+    // approval-decision log; the sibling of /workers/shadow that answers "was the
+    // trust climbing the dial EARNED or rubber-stamped". Backs the dashboard
+    // approval panel. Optional ?sinceMs=<epoch-ms> windows it. Fail-soft.
+    if (parsedUrl.pathname === "/approvals/kpi" && req.method === "GET") {
+        void (async () => {
+            try {
+                const sinceRaw = parsedUrl.searchParams.get("sinceMs");
+                const sinceMs = sinceRaw ? Number.parseInt(sinceRaw, 10) : Number.NaN;
+                const { readConsideredDecisions, computeConsideredApprovalKpi } = await import("./approvalKpi.js");
+                const decisions = readConsideredDecisions(Number.isFinite(sinceMs) ? { sinceMs } : {});
+                const kpi = computeConsideredApprovalKpi(decisions);
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ ...kpi, generatedAt: new Date().toISOString() }));
+            }
+            catch (err) {
+                respond500(res, err);
+            }
+        })();
+        return true;
+    }
     // GET /recipes/doctor?recipe=<name> — one-call recipe health diagnosis.
     // Server-side home for the `recipe doctor` CLI: composes the static
     // preflight check (lint + write-policy + plan) with the recipe-scoped
@@ -639,6 +1085,28 @@ export function tryHandleRecipeRoute(req, res, parsedUrl, deps) {
         })();
         return true;
     }
+    // POST /runs/:seq/cancel — cancel an in-flight recipe run. Aborts the run's
+    // registered AbortController so not-yet-started steps are skipped (and agent
+    // steps that honor the signal abort). 200 {cancelled:true} when a live run
+    // was found, 404 {cancelled:false} when the seq isn't currently running
+    // (already finished, unknown, or ran on a different process). (run-cancel)
+    const runCancelMatch = req.method === "POST"
+        ? /^\/runs\/(\d+)\/cancel$/.exec(parsedUrl.pathname)
+        : null;
+    if (runCancelMatch?.[1]) {
+        const seq = Number.parseInt(runCancelMatch[1], 10);
+        try {
+            const cancelled = cancelRun(seq);
+            res.writeHead(cancelled ? 200 : 404, {
+                "Content-Type": "application/json",
+            });
+            res.end(JSON.stringify({ cancelled, seq }));
+        }
+        catch (err) {
+            respond500(res, err, "runs/:seq/cancel");
+        }
+        return true;
+    }
     // GET /runs/:seq/plan — dry-run plan for the recipe that produced this run
     const runPlanMatch = req.method === "GET"
         ? /^\/runs\/(\d+)\/plan$/.exec(parsedUrl.pathname)
@@ -658,6 +1126,14 @@ export function tryHandleRecipeRoute(req, res, parsedUrl, deps) {
                     res.end(JSON.stringify({ error: "plan_unavailable" }));
                     return;
                 }
+                // Guard: recipeName may be absent on runs created before the field was
+                // added (audit LOW #36). An unsafe cast + immediate .replace() would
+                // throw TypeError — return 404 instead.
+                if (!run.recipeName) {
+                    res.writeHead(404, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "recipe_name_missing" }));
+                    return;
+                }
                 // triggerSource appends ":agent" suffix — strip before file lookup
                 const recipeName = run.recipeName.replace(/:agent$/, "");
                 const plan = await deps.runPlanFn(recipeName);
@@ -887,7 +1363,7 @@ export function tryHandleRecipeRoute(req, res, parsedUrl, deps) {
         })();
         return true;
     }
-    if (req.url === "/recipes" && req.method === "POST") {
+    if (parsedUrl.pathname === "/recipes" && req.method === "POST") {
         // A-PR2: bounded JSON read at RECIPE_ROUTE_BODY_CAPS.content (256 KB).
         void (async () => {
             const parsedBody = await readJsonBody(req, RECIPE_ROUTE_BODY_CAPS.content);
@@ -970,13 +1446,14 @@ export function tryHandleRecipeRoute(req, res, parsedUrl, deps) {
     }
     const recipePatchMatch = /^\/recipes\/([^/]+)$/.exec(parsedUrl.pathname);
     if (recipePatchMatch && req.method === "PATCH") {
-        // A-PR2: bounded JSON read at RECIPE_ROUTE_BODY_CAPS.content (256 KB).
+        // A-PR2: tight 1 KB cap — the only valid payload is `{"enabled":bool}`.
+        // Using the 256 KB content cap here was a trivial DoS vector (audit LOW #34).
         const name = decodeURIComponent(recipePatchMatch[1] ?? "");
         void (async () => {
-            const parsedBody = await readJsonBody(req, RECIPE_ROUTE_BODY_CAPS.content);
+            const parsedBody = await readJsonBody(req, RECIPE_ROUTE_BODY_CAPS.toggle);
             if (!parsedBody.ok) {
                 if (parsedBody.code === "too_large") {
-                    respond413(res, RECIPE_ROUTE_BODY_CAPS.content);
+                    respond413(res, RECIPE_ROUTE_BODY_CAPS.toggle);
                 }
                 else {
                     respondInvalidJson(res);
@@ -1089,6 +1566,41 @@ export function tryHandleRecipeRoute(req, res, parsedUrl, deps) {
         })();
         return true;
     }
+    // GET /recipes/:name/simulate — What-If Preview: static counterfactual
+    // simulation of a recipe by name (projected actions, side-effect taxonomy,
+    // blast-radius risk, tier-only approval projection honestly flagged as NOT
+    // gated on recipe steps today, low-confidence cost, undetermined branches).
+    // Executes nothing; superset of the dry-run plan. See runRecipeSimulate.
+    const recipeSimulateMatch = req.method === "GET"
+        ? /^\/recipes\/([^/]+)\/simulate$/.exec(parsedUrl.pathname)
+        : null;
+    if (recipeSimulateMatch?.[1]) {
+        const name = decodeURIComponent(recipeSimulateMatch[1]);
+        void (async () => {
+            try {
+                if (!deps.simulateFn) {
+                    res.writeHead(503, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "simulate_unavailable" }));
+                    return;
+                }
+                const report = await deps.simulateFn(name);
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ report }));
+            }
+            catch (err) {
+                // #605: classify by code, not substring (see /recipes/:name/plan).
+                const code = err?.code;
+                if (code === "ENOENT" || code === "RECIPE_NOT_FOUND") {
+                    res.writeHead(404, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "Recipe not found" }));
+                }
+                else {
+                    respond500(res, err, "recipes simulate");
+                }
+            }
+        })();
+        return true;
+    }
     const recipeContentMatch = /^\/recipes\/([^/]+)$/.exec(parsedUrl.pathname);
     if (recipeContentMatch && req.method === "GET") {
         const name = decodeURIComponent(recipeContentMatch[1] ?? "");
@@ -1148,7 +1660,10 @@ export function tryHandleRecipeRoute(req, res, parsedUrl, deps) {
                 res.writeHead(result.ok ? 200 : 400, {
                     "Content-Type": "application/json",
                 });
-                res.end(JSON.stringify(result));
+                const safeResult = result.error
+                    ? { ...result, error: sanitizeStorageError(result.error) }
+                    : result;
+                res.end(JSON.stringify(safeResult));
             }
             catch {
                 respondInvalidJson(res);
@@ -1177,7 +1692,10 @@ export function tryHandleRecipeRoute(req, res, parsedUrl, deps) {
                 ? 404
                 : 400;
         res.writeHead(status, { "Content-Type": "application/json" });
-        res.end(JSON.stringify(result));
+        const safeDeleteResult = result.error
+            ? { ...result, error: sanitizeStorageError(result.error) }
+            : result;
+        res.end(JSON.stringify(safeDeleteResult));
         return true;
     }
     // POST /recipes/:name/archive — move recipe (+ sidecar) into <recipesDir>/.archive/
@@ -1200,7 +1718,10 @@ export function tryHandleRecipeRoute(req, res, parsedUrl, deps) {
                 ? 404
                 : 400;
         res.writeHead(status, { "Content-Type": "application/json" });
-        res.end(JSON.stringify(result));
+        const safeArchiveResult = result.error
+            ? { ...result, error: sanitizeStorageError(result.error) }
+            : result;
+        res.end(JSON.stringify(safeArchiveResult));
         return true;
     }
     // POST /recipes/:name/duplicate — copy recipe as next available variant name
@@ -1223,7 +1744,10 @@ export function tryHandleRecipeRoute(req, res, parsedUrl, deps) {
                 ? 404
                 : 400;
         res.writeHead(status, { "Content-Type": "application/json" });
-        res.end(JSON.stringify(result));
+        const safeDuplicateResult = result.error
+            ? { ...result, error: sanitizeStorageError(result.error) }
+            : result;
+        res.end(JSON.stringify(safeDuplicateResult));
         return true;
     }
     // POST /recipes/:name/promote — promote variant to canonical name.
@@ -1288,7 +1812,7 @@ export function tryHandleRecipeRoute(req, res, parsedUrl, deps) {
         })();
         return true;
     }
-    if (req.url === "/recipes" && req.method === "GET") {
+    if (parsedUrl.pathname === "/recipes" && req.method === "GET") {
         try {
             const data = deps.recipesFn?.() ?? { recipesDir: null, recipes: [] };
             res.writeHead(200, { "Content-Type": "application/json" });
@@ -1299,12 +1823,83 @@ export function tryHandleRecipeRoute(req, res, parsedUrl, deps) {
         }
         return true;
     }
+    // POST /copilot/message — Tier 1 lever-action copilot (Overview deck's
+    // 7:copilot pane). Deterministic intent matching only, NEVER an LLM
+    // call and NEVER an executed action — this route only proposes
+    // {reply, action?}; the dashboard's action-card Confirm button is what
+    // actually calls the (separately gated) pause/enable/run endpoints.
+    // "Chat proposes, buttons dispose" — see parseIntent.ts's module doc.
+    if (parsedUrl.pathname === "/copilot/message" && req.method === "POST") {
+        void (async () => {
+            const parsedBody = await readJsonBody(req, RECIPE_ROUTE_BODY_CAPS.copilotMessage);
+            if (!parsedBody.ok) {
+                if (parsedBody.code === "too_large") {
+                    respond413(res, RECIPE_ROUTE_BODY_CAPS.copilotMessage);
+                }
+                else {
+                    respondInvalidJson(res);
+                }
+                return;
+            }
+            try {
+                const parsed = parsedBody.value ?? {};
+                if (respondIfUnknownBodyKeys(res, parsed, ["text"]))
+                    return;
+                const text = typeof parsed.text === "string" ? parsed.text : "";
+                const recipesData = deps.recipesFn?.() ?? { recipes: [] };
+                const recipeList = Array.isArray(recipesData.recipes)
+                    ? recipesData.recipes
+                    : [];
+                const intent = parseCopilotIntent(text, recipeList);
+                let haltReason = null;
+                if (intent.kind === "explain_halt") {
+                    const runs = deps.runsFn?.({
+                        recipe: intent.recipe?.name,
+                        limit: 20,
+                    }) ?? [];
+                    const lastHalt = runs.find((r) => typeof r.haltReason === "string");
+                    haltReason = lastHalt?.haltReason ?? null;
+                }
+                // Read-only status Q&A — same singletons the /approvals and
+                // /kill-switch routes already read from, so the copilot's answer
+                // can never drift from what those pages show.
+                const result = buildCopilotReply(intent, {
+                    haltReason,
+                    approvalsPending: intent.kind === "approvals_status"
+                        ? getApprovalQueue().list().length
+                        : undefined,
+                    killSwitchEngaged: intent.kind === "kill_switch_status"
+                        ? isWriteKillSwitchActive()
+                        : undefined,
+                });
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify(result));
+            }
+            catch (err) {
+                respond500(res, err);
+            }
+        })();
+        return true;
+    }
     if (parsedUrl.pathname === "/templates" && req.method === "GET") {
         void (async () => {
             try {
                 const now = Date.now();
                 if (templatesCache === null || now - templatesCacheTs > 5 * 60 * 1000) {
-                    const ghRes = await fetch("https://raw.githubusercontent.com/patchworkos/recipes/main/index.json");
+                    // Abort a stalled CDN connection — without this a hung socket
+                    // parks the handler forever (the negative-cache sentinel only
+                    // fires on rejection, which a hung connection never produces).
+                    // Matches the AbortController idiom used by the other fetch
+                    // sites in this file.
+                    const ctl = new AbortController();
+                    const timeout = setTimeout(() => ctl.abort(), 30_000);
+                    let ghRes;
+                    try {
+                        ghRes = await fetch("https://raw.githubusercontent.com/patchworkos/recipes/main/index.json", { signal: ctl.signal });
+                    }
+                    finally {
+                        clearTimeout(timeout);
+                    }
                     if (!ghRes.ok) {
                         throw new Error(`GitHub returned ${ghRes.status}`);
                     }
@@ -1563,8 +2158,10 @@ export function tryHandleRecipeRoute(req, res, parsedUrl, deps) {
                             // recipe inside one millisecond don't collide.
                             const { randomBytes: randomBytesFn } = await import("node:crypto");
                             const tmpFile = path.join(os.tmpdir(), `patchwork-bundle-install-${process.pid}-${Date.now()}-${randomBytesFn(6).toString("hex")}-${r}.yaml`);
-                            writeFileSync(tmpFile, yamlText, "utf-8");
+                            // Audit LOW #35: writeFileSync is inside the try so that the
+                            // finally block's unlinkSync runs even when the write throws.
                             try {
+                                writeFileSync(tmpFile, yamlText, "utf-8");
                                 const installResult = installRecipeFromFile(tmpFile, {
                                     recipesDir,
                                 });
@@ -1745,7 +2342,22 @@ export function tryHandleRecipeRoute(req, res, parsedUrl, deps) {
                     }
                     fetchUrl = source;
                     const urlParts = fetchUrl.split("/");
-                    recipeName = (urlParts[urlParts.length - 1] ?? "recipe").replace(/\.ya?ml$/i, "");
+                    const rawRecipeName = (urlParts[urlParts.length - 1] ?? "").replace(/\.ya?ml$/i, "");
+                    // Audit 2026-06-03 MEDIUM #17: the derived recipe name was written
+                    // into the recipes directory without any sanitisation, opening a
+                    // path-injection vector (e.g. `bad%20name`, `..evil`, etc.).
+                    // Validate against the same SEGMENT_RE used for github: sources.
+                    recipeName = rawRecipeName.toLowerCase();
+                    const { SEGMENT_RE: installSegRE } = await import("./recipes/githubInstallSource.js");
+                    if (!recipeName || !installSegRE.test(recipeName)) {
+                        res.writeHead(400, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify({
+                            ok: false,
+                            error: "Invalid recipe name in source URL",
+                            code: "invalid_recipe_name",
+                        }));
+                        return;
+                    }
                 }
                 else {
                     res.writeHead(400, { "Content-Type": "application/json" });
@@ -1806,13 +2418,34 @@ export function tryHandleRecipeRoute(req, res, parsedUrl, deps) {
                 }
                 else {
                     try {
-                        yamlRes = await fetch(fetchUrl, {
+                        // B3-A: manual redirect loop with per-hop SSRF re-validation —
+                        // the upfront validateSafeUrl above only pins the first hop, so a
+                        // 302 → private IP / IMDS would otherwise bypass it under
+                        // `redirect: "follow"`.
+                        yamlRes = await fetchFollowingRedirectsSafely(fetchUrl, {
                             signal: fetchCtl.signal,
-                            redirect: "follow",
                         });
                     }
                     catch (err) {
                         clearTimeout(fetchTimeout);
+                        // A redirect to a blocked host is an SSRF attempt, not a generic
+                        // network failure — surface it as 403 ssrf_blocked so it isn't
+                        // confused with an unreachable upstream.
+                        const msg = err instanceof Error ? err.message : String(err);
+                        if (/^SSRF guard blocked/.test(msg)) {
+                            // Log the full guard detail server-side, but return a STATIC
+                            // message — never echo the caught error text to the client (it is
+                            // error/stack-derived; CodeQL js/stack-trace-exposure). The
+                            // `code` carries the machine-readable signal.
+                            console.error(`[recipes/install] SSRF guard blocked redirect:`, msg);
+                            res.writeHead(403, { "Content-Type": "application/json" });
+                            res.end(JSON.stringify({
+                                ok: false,
+                                error: "Install blocked: the source redirected to a disallowed host (SSRF guard).",
+                                code: "ssrf_blocked",
+                            }));
+                            return;
+                        }
                         console.error(`[recipes/install] fetch failed:`, err);
                         // Network-level error → 502 (upstream unreachable), not 500.
                         res.writeHead(502, { "Content-Type": "application/json" });
@@ -1887,9 +2520,13 @@ export function tryHandleRecipeRoute(req, res, parsedUrl, deps) {
                 const { randomBytes } = await import("node:crypto");
                 const tmpFile = path.join(os.tmpdir(), `patchwork-install-${process.pid}-${Date.now()}-${randomBytes(6).toString("hex")}-${recipeName}.yaml`);
                 const { writeFileSync, mkdirSync, unlinkSync } = await import("node:fs");
-                writeFileSync(tmpFile, yamlText, "utf-8");
                 let result;
+                // Audit LOW #35: writeFileSync is now inside the try so that the
+                // finally block's unlinkSync runs even when the write itself throws
+                // (e.g. ENOSPC, EROFS). Previously writeFileSync was called before
+                // the try, orphaning the temp file on any write error.
                 try {
+                    writeFileSync(tmpFile, yamlText, "utf-8");
                     const recipesDir = path.join(os.homedir(), ".patchwork", "recipes");
                     mkdirSync(recipesDir, { recursive: true });
                     const { installRecipeFromFile } = await import("./recipes/installer.js");