patchwork-os 0.2.0-beta.9.canary.92 → 1.1.0-beta.1

package/dist/server.js

@@ -7,6 +7,7 @@ import { clearAnalyticsConfig, getAnalyticsConfig } from "./analyticsConfig.js";
 import { getAnalyticsPrefsAll, getAnalyticsPrefsPath, getAnalyticsSaltPath, getTelemetryPrefs, setTelemetryPrefs, } from "./analyticsPrefs.js";
 import { handleApprovalsStream, routeApprovalRequest } from "./approvalHttp.js";
 import { getApprovalQueue } from "./approvalQueue.js";
+import { handleClaudeAuthCancel, handleClaudeAuthComplete, handleClaudeAuthStart, } from "./claudeAuthHttp.js";
 import { saveBridgeConfigDriver } from "./config.js";
 import { tryHandleConnectorRoute, tryHandlePublicConnectorRoute, } from "./connectorRoutes.js";
 import { timingSafeStringEqual } from "./crypto.js";
@@ -37,6 +38,32 @@ export { corsOrigin };
 // Re-export canonical constant-time comparison for use in this module.
 // Implementation lives in src/crypto.ts — see there for security notes.
 const timingSafeTokenCompare = timingSafeStringEqual;
+/**
+ * H6 (audit 2026-06-19): the webhook auth gate must treat the
+ * `X-Hub-Signature-256` header identically at the bearer-bypass decision
+ * and at the HMAC verification step. A multi-valued header (duplicate
+ * lines collapsed to a `string[]` by an upstream proxy / HTTP-2 layer, or
+ * Node's comma-join) is NOT a usable single signature and must be rejected,
+ * never silently skipped. This returns the lone string only when exactly
+ * one usable value is present; otherwise `null`.
+ *
+ * - `undefined`        → null (absent)
+ * - single string      → that string
+ * - comma-joined string (Node merge of duplicates) → null (multi-valued)
+ * - `string[]`         → null (multi-valued)
+ */
+export function readSingleSignatureHeader(value) {
+    if (Array.isArray(value))
+        return null;
+    if (typeof value !== "string")
+        return null;
+    // Node merges duplicate non-special headers with ", ". A genuine GitHub
+    // signature is a single `sha256=<hex>` token and never contains a comma,
+    // so any comma marks a multi-valued (spoofed) header.
+    if (value.includes(","))
+        return null;
+    return value;
+}
 function setupPongHandler(ws) {
     ws.on("pong", (_data) => {
         ws.isAlive = true;
@@ -141,6 +168,30 @@ export class Server extends EventEmitter {
     judgeSummaryFn = null;
     /** Patchwork: set by bridge to generate a dry-run plan for a recipe by name. */
     runPlanFn = null;
+    /** Patchwork: set by bridge to generate a What-If Preview simulation for a
+     *  recipe by name (static counterfactual; superset of the dry-run plan). */
+    simulateFn = null;
+    /** Patchwork: read-only worker trust dial (shadow) — replays run + decision
+     *  logs through the (worker × action-class) ramp. Backs GET /workers/shadow. */
+    workerShadowFn = null;
+    /** Patchwork: read-only query over the persisted Decision Record
+     *  (worker_gate_decisions.jsonl). Backs GET /gate/decisions and the
+     *  `patchwork gate explain` CLI command — "why did the worker
+     *  allow/gate THIS action" without grepping the JSONL by hand. */
+    gateDecisionsFn = null;
+    /** Patchwork: record a Decision Record trace over HTTP. Backs
+     *  POST /traces/decision — the HTTP twin of the `ctxSaveTrace` MCP tool,
+     *  wired directly to `DecisionTraceLog.record()` so both paths persist
+     *  through the same JSONL writer. Throws on invalid input (caller maps
+     *  to 400); null when no bridge-side DecisionTraceLog is configured. */
+    saveDecisionTraceFn = null;
+    /** Patchwork: operator outcome dispositions (~/.patchwork/outcome-log.jsonl).
+     *  Backs GET/POST /outcomes and the dashboard confirm/reject panel; mirrors
+     *  the `patchwork outcomes` CLI. Never exposed as a recipe step / MCP tool. */
+    outcomeStoreFn = null;
+    /** Patchwork: the confirm queue — worker filings awaiting an operator
+     *  disposition. Backs GET /outcomes/pending + `patchwork outcomes pending`. */
+    pendingConfirmationsFn = null;
     /** Patchwork (VD-4): mocked replay of an existing run. Returns the new
      *  run's seq plus any unmocked steps the caller may want to surface. */
     runReplayFn = null;
@@ -286,6 +337,14 @@ export class Server extends EventEmitter {
     tracesFn = null;
     /** Set by bridge to handle CC hook notify events via POST /notify */
     notifyFn = null;
+    /**
+     * Patchwork: the configured workspace root (set by bridge from --workspace).
+     * Routes that resolve workspace-relative state — decision-replay and CC
+     * permission attribution, approval routing — must use this, NOT process.cwd():
+     * the bridge can be started with --workspace pointing elsewhere, and a
+     * launchd/systemd cwd is unrelated to the workspace (audit 2026-06-08 server-3).
+     */
+    workspace = process.cwd();
     /** Patchwork: set by bridge to list active agent sessions for the dashboard. */
     sessionsFn = null;
     /** Patchwork: set by bridge to answer GET /sessions/:id with per-session event stream + approvals. */
@@ -507,18 +566,26 @@ export class Server extends EventEmitter {
             const oauthResolved = !isStaticToken && this.oauthServer
                 ? this.oauthServer.resolveBearerToken(bearer)
                 : null;
-            // Phone-path: approve/reject with x-approval-token header or ?token= query param bypass bearer check.
-            // The token itself is validated inside routeApprovalRequest via queue.validateToken.
+            // Phone-path: approve/reject bypass the bearer check when they carry
+            // either the x-approval-token header (legacy ntfy/push) or the HMAC
+            // ?sig= query param (M23 signed callback). Both credentials are
+            // validated inside routeApprovalRequest. L43: the legacy ?token= query
+            // param is no longer accepted here — tokens in URLs leak into access
+            // logs, proxy logs, and Referer headers; use the header instead.
             const isPhoneApprovalPath = req.method === "POST" &&
                 /^\/(approve|reject)\/[A-Za-z0-9-]+$/.test(parsedUrl.pathname) &&
-                !!(req.headers["x-approval-token"] || parsedUrl.searchParams.get("token"));
+                !!(req.headers["x-approval-token"] || parsedUrl.searchParams.get("sig"));
             // GitHub-style webhook bypass: when --webhook-secret is configured,
             // POST /hooks/* requests carrying X-Hub-Signature-256 bypass the
             // bearer-token gate. Signature itself is verified inside the
             // /hooks/* handler after the body has been read.
+            // H6: only a single usable signature value counts as a webhook bypass
+            // candidate. A multi-valued header is rejected here (falls through to
+            // the bearer requirement — fail closed) and again at the HMAC step.
             const isHmacWebhookCandidate = req.method === "POST" &&
                 parsedUrl.pathname.startsWith("/hooks/") &&
-                !!req.headers["x-hub-signature-256"] &&
+                readSingleSignatureHeader(req.headers["x-hub-signature-256"]) !==
+                    null &&
                 this.webhookSecret !== null;
             // Rate-limit the phone bypass surface. Only applies when this is
             // actually a phone-path request that's relying on the bypass — a
@@ -541,8 +608,12 @@ export class Server extends EventEmitter {
                 const now = Date.now();
                 const entry = this.approvalIpCounts.get(remoteIp);
                 if (entry && now - entry.windowStart < Server.APPROVAL_IP_WINDOW_MS) {
-                    entry.count++;
-                    if (entry.count > Server.APPROVAL_IP_MAX) {
+                    // Check BEFORE incrementing so the counter is only advanced for
+                    // requests that are allowed through.  Increment-first then check
+                    // lets exactly one extra request slip past the limit (the rejected
+                    // request still bumps the counter, making the effective window
+                    // allow MAX+1 unique IDs in degenerate edge cases).
+                    if (entry.count >= Server.APPROVAL_IP_MAX) {
                         res.writeHead(429, { "Content-Type": "application/json" });
                         res.end(JSON.stringify({
                             error: "too_many_requests",
@@ -550,18 +621,21 @@ export class Server extends EventEmitter {
                         }));
                         return;
                     }
+                    entry.count++;
                 }
                 else {
                     this.approvalIpCounts.set(remoteIp, { count: 1, windowStart: now });
                 }
-                // GC stale entries opportunistically — bounded growth alongside
-                // the same Map. 200 is well above any legitimate concurrent IP
-                // count; well below memory pressure.
-                if (this.approvalIpCounts.size > 200) {
-                    for (const [k, v] of this.approvalIpCounts) {
-                        if (now - v.windowStart > Server.APPROVAL_IP_WINDOW_MS) {
-                            this.approvalIpCounts.delete(k);
-                        }
+                // http-server-2: prune stale entries on EVERY phone-path request,
+                // not only once the map crosses 200. The old `size > 200` guard meant
+                // any deployment with fewer than 200 distinct IPs never evicted
+                // expired entries — a one-shot IP's 40-byte record survived for the
+                // whole process lifetime. Each window is short (APPROVAL_IP_WINDOW_MS)
+                // and the map is tiny in practice, so a full pass per request is
+                // cheap and keeps the map genuinely bounded.
+                for (const [k, v] of this.approvalIpCounts) {
+                    if (now - v.windowStart > Server.APPROVAL_IP_WINDOW_MS) {
+                        this.approvalIpCounts.delete(k);
                     }
                 }
             }
@@ -631,6 +705,28 @@ export class Server extends EventEmitter {
                     const q = parsedUrl.searchParams;
                     const sinceStr = q.get("since");
                     const limitStr = q.get("limit");
+                    // Validate numeric ranges up front so an out-of-range value returns a
+                    // 400 with an actionable message instead of bubbling an exception
+                    // from ctxQueryTraces' optionalInt() into a generic 500 (audit sem-1).
+                    if (limitStr !== null && /^\d+$/.test(limitStr)) {
+                        const limitNum = Number(limitStr);
+                        if (limitNum < 1 || limitNum > 500) {
+                            res.writeHead(400, { "Content-Type": "application/json" });
+                            res.end(JSON.stringify({
+                                error: "limit must be an integer between 1 and 500",
+                            }));
+                            return;
+                        }
+                    }
+                    if (sinceStr !== null && /^\d+$/.test(sinceStr)) {
+                        if (!Number.isSafeInteger(Number(sinceStr))) {
+                            res.writeHead(400, { "Content-Type": "application/json" });
+                            res.end(JSON.stringify({
+                                error: "since must be a safe integer (epoch ms)",
+                            }));
+                            return;
+                        }
+                    }
                     const data = this.tracesFn
                         ? await this.tracesFn({
                             traceType: q.get("traceType") ?? undefined,
@@ -643,6 +739,11 @@ export class Server extends EventEmitter {
                             limit: limitStr !== null && /^\d+$/.test(limitStr)
                                 ? Number(limitStr)
                                 : undefined,
+                            // Opt-in meaning-based ranking (?semantic=true). The bridge's
+                            // tracesFn forwards it to ctxQueryTraces, which only ranks by
+                            // cosine when an embeddings endpoint is configured — otherwise
+                            // it falls back to the substring path. Safe default: false.
+                            semantic: q.get("semantic") === "true",
                         })
                         : {
                             traces: [],
@@ -920,7 +1021,16 @@ export class Server extends EventEmitter {
                 // computed over the raw on-the-wire bytes (read.bytes), not the
                 // utf-8-decoded string — non-UTF-8 or denormalized payloads must
                 // round-trip identically to validate.
-                const sigHeader = req.headers["x-hub-signature-256"];
+                // H6: reject multi-valued signature headers outright. The raw header
+                // is present-but-unusable → 401, never a silent skip of HMAC.
+                const rawSig = req.headers["x-hub-signature-256"];
+                if (rawSig !== undefined &&
+                    readSingleSignatureHeader(rawSig) === null) {
+                    res.writeHead(401, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "invalid_signature" }));
+                    return;
+                }
+                const sigHeader = readSingleSignatureHeader(rawSig);
                 if (typeof sigHeader === "string" && sigHeader.length > 0) {
                     if (!this.webhookSecret) {
                         res.writeHead(401, { "Content-Type": "application/json" });
@@ -1076,7 +1186,7 @@ export class Server extends EventEmitter {
                     : 0;
                 const { computeDecisionReplay } = await import("./decisionReplay.js");
                 const result = computeDecisionReplay(this.activityLog, {
-                    workspace: process.cwd(),
+                    workspace: this.workspace,
                     sinceMs,
                 });
                 res.writeHead(200, { "Content-Type": "application/json" });
@@ -1102,7 +1212,7 @@ export class Server extends EventEmitter {
                     now - this._explainRulesCache.at > 30_000) {
                     this._explainRulesCache = {
                         at: now,
-                        rules: loadCcPermissionsAttributed(process.cwd()),
+                        rules: loadCcPermissionsAttributed(this.workspace),
                     };
                 }
                 const explanation = explainRules(tool, specifier || undefined, this._explainRulesCache.rules);
@@ -1163,6 +1273,12 @@ export class Server extends EventEmitter {
                 haltSummaryFn: this.haltSummaryFn,
                 judgeSummaryFn: this.judgeSummaryFn,
                 runPlanFn: this.runPlanFn,
+                simulateFn: this.simulateFn,
+                workerShadowFn: this.workerShadowFn,
+                gateDecisionsFn: this.gateDecisionsFn,
+                saveDecisionTraceFn: this.saveDecisionTraceFn,
+                outcomeStoreFn: this.outcomeStoreFn,
+                pendingConfirmationsFn: this.pendingConfirmationsFn,
                 runReplayFn: this.runReplayFn,
                 runRecipeFn: this.runRecipeFn,
                 onRecipesChangedFn: this.onRecipesChangedFn,
@@ -1203,6 +1319,27 @@ export class Server extends EventEmitter {
                 }
                 return;
             }
+            // /auth/claude/* — Claude Code subscription OAuth 2.0 + PKCE flow.
+            // start → returns a claude.ai auth URL; complete → exchanges code for token;
+            // cancel → discards the pending session. The dashboard "Connect Claude"
+            // button drives this flow; after complete the dashboard saves the returned
+            // token via POST /api/auth/anthropic-key → control-plane re-provisions
+            // the container with CLAUDE_CODE_OAUTH_TOKEN so subprocess driver works.
+            if (parsedUrl.pathname === "/auth/claude/start" &&
+                req.method === "POST") {
+                await handleClaudeAuthStart(req, res);
+                return;
+            }
+            if (parsedUrl.pathname === "/auth/claude/complete" &&
+                req.method === "POST") {
+                await handleClaudeAuthComplete(req, res);
+                return;
+            }
+            if (parsedUrl.pathname === "/auth/claude/cancel" &&
+                req.method === "POST") {
+                await handleClaudeAuthCancel(req, res);
+                return;
+            }
             if (parsedUrl.pathname === "/settings" && req.method === "POST") {
                 // Kill-switch gate: during an incident a settings mutation can
                 // defeat the panic posture (e.g. switching driver to one with a
@@ -1604,11 +1741,10 @@ export class Server extends EventEmitter {
                                 changes.ntfyTopic = ntfyTopicTrimmed ? "***" : "";
                             if (ntfyServerTrimmed !== undefined)
                                 changes.ntfyServer = ntfyServerTrimmed || "";
-                            const remoteAddr = req.headers["x-forwarded-for"]
-                                ?.split(",")[0]
-                                ?.trim() ||
-                                req.socket.remoteAddress ||
-                                "unknown";
+                            // L44: honor X-Forwarded-For only from trusted proxies. Routed
+                            // through getClientIp so an untrusted client cannot spoof the
+                            // audited actor IP.
+                            const remoteAddr = this.getClientIp(req) ?? "unknown";
                             this.activityLog.recordEvent("settings.change", {
                                 actor: "http",
                                 ip: remoteAddr,
@@ -1902,11 +2038,8 @@ export class Server extends EventEmitter {
                     if (this.activityLog) {
                         this.activityLog.recordEvent("telemetry.reset", {
                             actor: "http",
-                            ip: req.headers["x-forwarded-for"]
-                                ?.split(",")[0]
-                                ?.trim() ||
-                                req.socket.remoteAddress ||
-                                "unknown",
+                            // L44: trusted-proxy-gated client IP (see getClientIp).
+                            ip: this.getClientIp(req) ?? "unknown",
                         });
                     }
                     res.writeHead(200, { "Content-Type": "application/json" });
@@ -2146,12 +2279,15 @@ export class Server extends EventEmitter {
                         path: parsedUrl.pathname,
                         body: parsedBody,
                         query: parsedUrl.searchParams,
+                        // L43: read the approval token from the header ONLY. A token in
+                        // ?token= leaks into HTTP access logs, proxy logs, and Referer
+                        // headers. (The separately-signed `sig` query param — see
+                        // approvalHttp.ts — is an HMAC over the path and is unaffected.)
                         approvalToken: req.headers["x-approval-token"] ??
-                            parsedUrl.searchParams.get("token") ??
                             undefined,
                     }, {
                         queue: getApprovalQueue(),
-                        workspace: process.cwd(),
+                        workspace: this.workspace,
                         managedSettingsPath: this.managedSettingsPath,
                         onDecision: this.onApprovalDecision,
                         webhookUrl: this.approvalWebhookUrl,
@@ -2458,7 +2594,7 @@ export class Server extends EventEmitter {
                     // Enforce a minimum interval so a misconfigured value cannot spin
                     // the event loop (setInterval(fn, 0) would fire on every tick).
                     // 10 ms floor is low enough for tests, high enough to be safe.
-                }, Math.max(10, this.pingIntervalMs));
+                }, Math.max(10, this.pingIntervalMs)).unref();
                 resolve(addr.port);
             })
                 .on("error", reject);
@@ -2471,7 +2607,27 @@ export class Server extends EventEmitter {
                 // Fall through to OS-assigned port below
             }
             else {
-                return this.listen(preferredPort, bindAddress);
+                // On Windows, SO_REUSEADDR does not release ports in TIME_WAIT (~4 min).
+                // A supervisor restart with --port N crash-loops until the port clears.
+                // Retry with exponential backoff (1s, 2s, 4s, 8s) before falling back
+                // to an OS-assigned port, so a single restart attempt survives the
+                // typical TIME_WAIT window without wedging the supervisor. (NET-001)
+                const backoffs = [1000, 2000, 4000, 8000];
+                for (let i = 0; i <= backoffs.length; i++) {
+                    try {
+                        return await this.listen(preferredPort, bindAddress);
+                    }
+                    catch (err) {
+                        if (err.code !== "EADDRINUSE")
+                            throw err;
+                        if (i === backoffs.length)
+                            break;
+                        this.logger.warn(`Port ${preferredPort} in use (attempt ${i + 1}/${backoffs.length}), ` +
+                            `retrying in ${backoffs[i]}ms…`);
+                        await new Promise((r) => setTimeout(r, backoffs[i]));
+                    }
+                }
+                this.logger.warn(`Port ${preferredPort} still in use after retries, falling back to OS-assigned port`);
             }
         }
         // Port 0 lets the OS kernel assign a free port atomically
@@ -2480,6 +2636,11 @@ export class Server extends EventEmitter {
     async close() {
         if (this.pingInterval)
             clearInterval(this.pingInterval);
+        // close() may run before listen() (failed startup, or tests that stub
+        // listen()); wss/httpServer are only created in listen(), so a pre-listen
+        // close is a safe no-op rather than a crash on undefined this.wss.
+        if (!this.wss)
+            return;
         for (const client of this.wss.clients) {
             client.close(1001, "Server shutting down");
         }