ID-Robots · KrasimirKralev · Aug 11, 2026 · Aug 11, 2026 · Aug 11, 2026 · Aug 11, 2026
@@ -93,7 +93,7 @@ export function isAllowedPath(abs: string): boolean {
  * Used by the `bash` pre-flight, which sees a shell string rather than a path.
  */
 export const SECRET_NAME_RE =
-  /(^|[^\w.-])\.(ssh|hermes|openclaw|codex|gnupg|aws|kube|env|envrc|netrc|npmrc|pypirc|pgpass|git-credentials|session-secret|mcp-token|local-ai-token|hermes-dashboard-pw)(?![\w-])|(^|[^\w-])id_(rsa|ecdsa|ed25519)(?![\w-])/i;
+  /(^|[^\w.-])\.(ssh|hermes|openclaw|clawkeep|codex|gnupg|aws|kube|env|envrc|netrc|npmrc|pypirc|pgpass|git-credentials|session-secret|mcp-token|local-ai-token|hermes-dashboard-pw)(?![\w-])|(^|[^\w-])id_(rsa|ecdsa|ed25519)(?![\w-])/i;
 
 /**
  * Throw a BLOCKED_PATH the agent can act on. The message deliberately names no

@@ -4,7 +4,8 @@ import { NextResponse } from "next/server";
 import { spawn } from "child_process";
 import fs from "fs/promises";
 import path from "path";
-import { DATA_DIR, getAll, setMany } from "@/lib/config-store";
+import { getAll, setMany } from "@/lib/config-store";
+import { HANDOFF_TOKENS_PATH, HANDOFF_TTL_MS } from "@/lib/oauth-handoff";
 import {
   restartGateway,
   findOpenclawBin,
@@ -483,7 +484,6 @@ export async function POST(request: Request) {
     // 15-minute TTL rather than forcing a full re-auth.
     let pendingHandoffTokensPath: string | null = null;
     if (body.authMode === "subscription" && body.oauthHandoff) {
-      const tokensPath = path.join(DATA_DIR, "oauth-device-tokens.json");
       let handoff: {
         provider?: string;
         access_token?: string;
@@ -493,19 +493,22 @@ export async function POST(request: Request) {
         createdAt?: number;
       };
       try {
-        handoff = JSON.parse(await fs.readFile(tokensPath, "utf-8"));
+        handoff = JSON.parse(await fs.readFile(HANDOFF_TOKENS_PATH, "utf-8"));
       } catch {
         return NextResponse.json(
           { error: "No pending OAuth tokens. Restart the sign-in flow." },
           { status: 400 },
         );
       }
+      // A file with no `createdAt` has no age we can check, so it cannot be
+      // shown to be inside the TTL — treat it the same as one that is past it.
       if (
         !handoff.access_token ||
-        (handoff.createdAt && Date.now() - handoff.createdAt > 15 * 60 * 1000)
+        !handoff.createdAt ||
+        Date.now() - handoff.createdAt > HANDOFF_TTL_MS
       ) {
         // Stale/invalid credential material — consume it so it can't linger.
-        await fs.unlink(tokensPath).catch(() => {});
+        await fs.unlink(HANDOFF_TOKENS_PATH).catch(() => {});
         return NextResponse.json(
           { error: "OAuth tokens missing or expired. Restart the sign-in flow." },
           { status: 400 },
@@ -519,7 +522,7 @@ export async function POST(request: Request) {
       body.idToken = handoff.id_token;
       body.refreshToken = handoff.refresh_token;
       body.expiresIn = handoff.expires_in;
-      pendingHandoffTokensPath = tokensPath;
+      pendingHandoffTokensPath = HANDOFF_TOKENS_PATH;
     }
 
     const { provider, apiKey, authMode = "token", idToken, refreshToken, expiresIn, projectId, scope = "primary", model: bodyModel } = body;

@@ -3,6 +3,12 @@ import crypto from "crypto";
 import fs from "fs/promises";
 import path from "path";
 import { DATA_DIR } from "@/lib/config-store";
+import {
+  HANDOFF_TOKENS_PATH,
+  HANDOFF_TTL_MS,
+  clearHandoffTokens,
+  sweepStaleHandoffTokens,
+} from "@/lib/oauth-handoff";
 import {
   OPENAI_CLIENT_ID,
   OPENAI_DEVICE_TOKEN_URL,
@@ -13,7 +19,22 @@ import {
 export const dynamic = "force-dynamic";
 
 const STATE_PATH = path.join(DATA_DIR, "oauth-device-state.json");
-const TOKENS_PATH = path.join(DATA_DIR, "oauth-device-tokens.json");
+
+/**
+ * Drop both halves of a sign-in the provider ended without completing: the
+ * in-flight state, and any handoff tokens an earlier attempt left behind.
+ *
+ * Used on the provider-failure branches only. The expiry branch in POST drops
+ * the state alone, because a device-code state can be expired while the handoff
+ * file holds fresh tokens from the *other* (authorization-code) flow; those are
+ * left for the age sweep to judge on their own timestamp.
+ */
+async function discardFlow(): Promise<void> {
+  await Promise.all([
+    fs.unlink(STATE_PATH).catch(() => {}),
+    clearHandoffTokens(),
+  ]);
+}
 
 interface DeviceTokens {
   access_token?: string;
@@ -32,13 +53,13 @@ async function persistTokensAndAck(
   tokens: DeviceTokens,
 ): Promise<NextResponse> {
   await fs.mkdir(DATA_DIR, { recursive: true });
-  const tmpPath = `${TOKENS_PATH}.tmp.${crypto.randomBytes(8).toString("hex")}`;
+  const tmpPath = `${HANDOFF_TOKENS_PATH}.tmp.${crypto.randomBytes(8).toString("hex")}`;
   await fs.writeFile(
     tmpPath,
     JSON.stringify({ provider, ...tokens, createdAt: Date.now() }),
     { mode: 0o600 },
   );
-  await fs.rename(tmpPath, TOKENS_PATH);
+  await fs.rename(tmpPath, HANDOFF_TOKENS_PATH);
   return NextResponse.json({ status: "complete" });
 }
 
@@ -108,7 +129,7 @@ async function pollOpenAI(stored: StoredState): Promise<NextResponse> {
     const verifier = pollData.code_verifier;
     if (!verifier) {
       console.error("[device-poll/openai] No code_verifier in poll response:", pollData);
-      await fs.unlink(STATE_PATH).catch(() => {});
+      await discardFlow();
       return NextResponse.json(
         { error: "OpenAI did not return code_verifier" },
         { status: 502 }
@@ -141,7 +162,7 @@ async function pollOpenAI(stored: StoredState): Promise<NextResponse> {
         exchangeRes.status,
         errText
       );
-      await fs.unlink(STATE_PATH).catch(() => {});
+      await discardFlow();
       return NextResponse.json(
         { error: `Token exchange failed (${exchangeRes.status})` },
         { status: 502 }
@@ -173,6 +194,8 @@ async function pollOpenAI(stored: StoredState): Promise<NextResponse> {
 
 export async function POST() {
   try {
+    await sweepStaleHandoffTokens();
+
     let stored: StoredState;
     try {
       const raw = await fs.readFile(STATE_PATH, "utf-8");
@@ -189,7 +212,7 @@ export async function POST() {
     if (!stored.device_id && stored.device_auth_id) stored.device_id = stored.device_auth_id;
 
     // 15-minute expiry
-    if (Date.now() - stored.createdAt > 15 * 60 * 1000) {
+    if (Date.now() - stored.createdAt > HANDOFF_TTL_MS) {
       await fs.unlink(STATE_PATH).catch(() => {});
       return NextResponse.json(
         { error: "Device auth session expired. Please start again." },

@@ -3,19 +3,19 @@ import crypto from "crypto";
 import fs from "fs/promises";
 import path from "path";
 import { DATA_DIR } from "@/lib/config-store";
+import { clearHandoffTokens } from "@/lib/oauth-handoff";
 import { DEVICE_AUTH_PROVIDERS } from "@/lib/oauth-config";
 
 export const dynamic = "force-dynamic";
 
 const STATE_PATH = path.join(DATA_DIR, "oauth-device-state.json");
-const TOKENS_PATH = path.join(DATA_DIR, "oauth-device-tokens.json");
 
 export async function POST(request: Request) {
   try {
     // A new sign-in flow supersedes any prior one. Best-effort clear a stale
     // token-handoff file left behind by an abandoned earlier flow so it can
     // never be consumed by a later configure call.
-    await fs.unlink(TOKENS_PATH).catch(() => {});
+    await clearHandoffTokens();
 
     let body: { provider?: string } = {};
     try {

@@ -5,13 +5,14 @@ import crypto from "crypto";
 import fs from "fs/promises";
 import path from "path";
 import { DATA_DIR } from "@/lib/config-store";
+// Server-only handoff file the configure route reads on the `oauthHandoff`
+// path — the SAME file the device-code flow (device-poll) uses, so both take
+// its path from the one module that owns it.
+import { HANDOFF_TOKENS_PATH } from "@/lib/oauth-handoff";
 import { OAUTH_PROVIDERS, isGoogleConfigured } from "@/lib/oauth-config";
 import { discoverGoogleProject } from "@/lib/google-project";
 
 const STATE_PATH = path.join(DATA_DIR, "oauth-state.json");
-// Server-only handoff file the configure route reads on the `oauthHandoff`
-// path — the SAME file the device-code flow (device-poll) uses.
-const TOKENS_PATH = path.join(DATA_DIR, "oauth-device-tokens.json");
 
 // Persist the freshly-issued provider tokens to a 0600 server file and return
 // just a status, so the access/refresh/id tokens never travel back through the
@@ -24,13 +25,13 @@ async function persistTokensAndAck(
   extra?: { projectId?: string },
 ): Promise<NextResponse> {
   await fs.mkdir(DATA_DIR, { recursive: true });
-  const tmpPath = `${TOKENS_PATH}.tmp.${crypto.randomBytes(8).toString("hex")}`;
+  const tmpPath = `${HANDOFF_TOKENS_PATH}.tmp.${crypto.randomBytes(8).toString("hex")}`;
   await fs.writeFile(
     tmpPath,
     JSON.stringify({ provider, ...tokens, createdAt: Date.now() }),
     { mode: 0o600 },
   );
-  await fs.rename(tmpPath, TOKENS_PATH);
+  await fs.rename(tmpPath, HANDOFF_TOKENS_PATH);
   return NextResponse.json({ status: "complete", ...(extra?.projectId ? { projectId: extra.projectId } : {}) });
 }
 

@@ -5,6 +5,7 @@ import crypto from "crypto";
 import fs from "fs/promises";
 import path from "path";
 import { DATA_DIR } from "@/lib/config-store";
+import { clearHandoffTokens } from "@/lib/oauth-handoff";
 import { OAUTH_PROVIDERS, isGoogleConfigured } from "@/lib/oauth-config";
 
 const STATE_PATH = path.join(DATA_DIR, "oauth-state.json");
@@ -15,6 +16,11 @@ function base64url(buf: Buffer): string {
 
 export async function POST(request: Request) {
   try {
+    // A new sign-in supersedes any prior one — same rule the device-code entry
+    // point applies, so the handoff file always belongs to the flow in progress
+    // rather than to whichever one was abandoned last.
+    await clearHandoffTokens();
+
     let body: { provider?: string } = {};
     try {
       body = await request.json();

@@ -3,6 +3,7 @@ import * as config from "@/lib/config-store";
 import { getActiveHarness } from "@/lib/harness";
 import { sanitizePreferences, validatePreference } from "@/lib/preference-schema";
 import { personaFilesFor, writeLanguagePersona } from "@/lib/language-persona";
+import { logSafe } from "@/lib/log-safe";
 
 export const dynamic = "force-dynamic";
 
@@ -27,7 +28,11 @@ export async function GET(req: Request) {
   if (allParam) {
     // Return all preferences
     const allConfig = await config.getAll();
-    const result: Record<string, unknown> = {};
+    // Null-prototype accumulator: the names come from outside this function, so
+    // an assignment here should always define an own property and never reach
+    // an inherited one such as `__proto__`. Same below, and in
+    // sanitizePreferences, which is where these objects end up.
+    const result: Record<string, unknown> = Object.create(null);
     for (const [key, value] of Object.entries(allConfig)) {
       if (key.startsWith("pref:")) {
         result[key.slice(5)] = value;
@@ -41,7 +46,7 @@ export async function GET(req: Request) {
     return NextResponse.json({ error: "keys or all param required" }, { status: 400 });
   }
   const keys = keysParam.split(",").filter(isAllowed);
-  const result: Record<string, unknown> = {};
+  const result: Record<string, unknown> = Object.create(null);
   for (const key of keys) {
     result[key] = await config.get(`pref:${key}`);
   }
@@ -61,7 +66,10 @@ export async function POST(req: Request) {
       if (!isAllowed(key)) continue;
       const check = validatePreference(key, value);
       if (!check.ok) {
-        console.error(`[preferences] Rejected write: ${check.reason}`);
+        // The reason is built from the rejected key, which is caller-supplied
+        // and only prefix-checked — bound and sanitise it like any other
+        // request-derived log field.
+        console.error(`[preferences] Rejected write: ${logSafe(check.reason ?? "")}`);
         return NextResponse.json({ error: check.reason ?? "Invalid preference value" }, { status: 400 });
       }
       entries[`pref:${key}`] = value;

@@ -1,13 +1,18 @@
 import { NextResponse } from "next/server";
 import { execFile } from "child_process";
 import { promisify } from "util";
+import { logSafe } from "@/lib/log-safe";
 
 const execFileAsync = promisify(execFile);
 
 export const dynamic = "force-dynamic";
 
 const AP_PROFILE = "ClawBox-Setup";
 
+// 802.11 defines the SSID element as at most 32 octets, so a longer value
+// cannot name a network nmcli could act on.
+const SSID_MAX_OCTETS = 32;
+
 export async function POST(request: Request) {
   let body: { ssid?: string; password?: string; action?: "update" | "forget" };
   try { body = await request.json(); } catch { return NextResponse.json({ error: "Invalid JSON" }, { status: 400 }); }
@@ -18,6 +23,9 @@
   }
   const normalizedSsid = (body.ssid ?? "").trim();
   if (!normalizedSsid) return NextResponse.json({ error: "Network name is required" }, { status: 400 });
+  if (Buffer.byteLength(normalizedSsid, "utf8") > SSID_MAX_OCTETS) {
+    return NextResponse.json({ error: `Network name must be at most ${SSID_MAX_OCTETS} bytes` }, { status: 400 });
+  }
   if (normalizedSsid === AP_PROFILE) return NextResponse.json({ error: "Cannot modify the hotspot profile here" }, { status: 400 });
 
   try {
@@ -42,16 +50,19 @@
     } catch (err) {
       connected = false;
       reactivateError = err instanceof Error ? err.message : "Failed to reconnect";
-      console.warn(`[wifi/update] reactivate ${normalizedSsid} failed:`, err);
+      console.warn(`[wifi/update] reactivate ${logSafe(normalizedSsid)} failed: ${logSafe(reactivateError)}`);
     }
     return NextResponse.json({ success: true, action: "update", connected, reactivateError });
   } catch (err) {
     // The `connection modify` argv includes `wifi-sec.psk <password>`, which
     // execFile embeds into its error message — scrub the PSK before logging so
-    // it doesn't land in the journal in cleartext.
+    // it doesn't land in the journal in cleartext. The scrubbed text still
+    // carries the SSID nmcli echoed back, so it goes through logSafe too.
     const raw = err instanceof Error ? err.message : String(err);
-    const safe = body.password ? raw.split(String(body.password)).join("***") : raw;
-    console.warn(`[wifi/update] ${action} ${normalizedSsid} failed: ${safe}`);
+    // replaceAll rather than split/join: the message is bounded by execFile's
+    // 1 MB maxBuffer, and split would allocate an array of every fragment of it.
+    const safe = body.password ? raw.replaceAll(String(body.password), "***") : raw;
+    console.warn(`[wifi/update] ${action} ${logSafe(normalizedSsid)} failed: ${logSafe(safe)}`);
     return NextResponse.json({ error: "Failed to update WiFi network" }, { status: 500 });
   }
 }