Address Copilot review on #8

- Fix middleware ordering: securityHeaders before localhostOnly so 403s get headers
- Normalize Host header: case-insensitive, handle bracketed IPv6 [::1], trim trailing dots
- Return JSON from localhostOnly rejection (was plaintext)
- Migrate all remaining http.Error calls to jsonError for consistent JSON responses
- Rename maxToolResponseSize → maxToolFieldSize (now covers both fields)
- Add tool_input truncation assertion to TestAddObservationTruncation
- Remove stderr output from hardenPermissions (library code, silent chmod)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: lazypower

internal/server/middleware.go

@@ -3,20 +3,31 @@ package server
 import (
 	"net"
 	"net/http"
+	"strings"
 )
 
 const maxRequestBody = 1 << 20 // 1MB
 
+// normalizeHost extracts and normalizes the hostname from a Host header.
+// Handles ports, bracketed IPv6, case folding, and trailing dots.
+func normalizeHost(host string) string {
+	if h, _, err := net.SplitHostPort(host); err == nil {
+		host = h
+	} else if strings.HasPrefix(host, "[") && strings.HasSuffix(host, "]") {
+		host = host[1 : len(host)-1]
+	}
+	host = strings.ToLower(host)
+	host = strings.TrimSuffix(host, ".")
+	return host
+}
+
 // localhostOnly rejects requests where the Host header is not localhost.
 // Prevents DNS rebinding attacks against the local API server.
 func localhostOnly(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		host := r.Host
-		if h, _, err := net.SplitHostPort(host); err == nil {
-			host = h
-		}
+		host := normalizeHost(r.Host)
 		if host != "localhost" && host != "127.0.0.1" && host != "::1" {
-			http.Error(w, "Forbidden", http.StatusForbidden)
+			jsonError(w, "forbidden", http.StatusForbidden)
 			return
 		}
 		next.ServeHTTP(w, r)

internal/server/routes.go

@@ -13,8 +13,8 @@ import (
 	"github.com/lazypower/continuity/internal/engine"
 )
 
-// jsonError writes a JSON error response. All error responses should use this
-// to avoid JSON injection via string concatenation.
+// jsonError writes a JSON error response with proper Content-Type and encoding.
+// Prefer this over http.Error for consistent JSON responses.
 func jsonError(w http.ResponseWriter, msg string, code int) {
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(code)
@@ -27,11 +27,11 @@ func (s *Server) handleSessionInit(w http.ResponseWriter, r *http.Request) {
 		Project   string `json:"project"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		http.Error(w, `{"error":"invalid json"}`, http.StatusBadRequest)
+		jsonError(w, "invalid json", http.StatusBadRequest)
 		return
 	}
 	if req.SessionID == "" {
-		http.Error(w, `{"error":"session_id required"}`, http.StatusBadRequest)
+		jsonError(w, "session_id required", http.StatusBadRequest)
 		return
 	}
 
@@ -60,11 +60,11 @@ func (s *Server) handleAddObservation(w http.ResponseWriter, r *http.Request) {
 	}
 	body, err := io.ReadAll(r.Body)
 	if err != nil {
-		http.Error(w, `{"error":"read body failed"}`, http.StatusBadRequest)
+		jsonError(w, "read body failed", http.StatusBadRequest)
 		return
 	}
 	if err := json.Unmarshal(body, &req); err != nil {
-		http.Error(w, `{"error":"invalid json"}`, http.StatusBadRequest)
+		jsonError(w, "invalid json", http.StatusBadRequest)
 		return
 	}
 
@@ -119,7 +119,7 @@ func (s *Server) handleExtractSession(w http.ResponseWriter, r *http.Request) {
 		Force          bool   `json:"force"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		http.Error(w, `{"error":"invalid json"}`, http.StatusBadRequest)
+		jsonError(w, "invalid json", http.StatusBadRequest)
 		return
 	}
 
@@ -155,11 +155,11 @@ func (s *Server) handleSignal(w http.ResponseWriter, r *http.Request) {
 		Prompt string `json:"prompt"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		http.Error(w, `{"error":"invalid json"}`, http.StatusBadRequest)
+		jsonError(w, "invalid json", http.StatusBadRequest)
 		return
 	}
 	if req.Prompt == "" {
-		http.Error(w, `{"error":"prompt required"}`, http.StatusBadRequest)
+		jsonError(w, "prompt required", http.StatusBadRequest)
 		return
 	}
 
@@ -248,11 +248,11 @@ func (s *Server) handleRemember(w http.ResponseWriter, r *http.Request) {
 		SessionID string `json:"session_id"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		http.Error(w, `{"error":"invalid json"}`, http.StatusBadRequest)
+		jsonError(w, "invalid json", http.StatusBadRequest)
 		return
 	}
 	if req.Category == "" || req.Name == "" || req.Summary == "" || req.Body == "" {
-		http.Error(w, `{"error":"category, name, summary, and body are required"}`, http.StatusBadRequest)
+		jsonError(w, "category, name, summary, and body are required", http.StatusBadRequest)
 		return
 	}
 
@@ -295,7 +295,7 @@ func (s *Server) handleRemember(w http.ResponseWriter, r *http.Request) {
 func (s *Server) handleSearch(w http.ResponseWriter, r *http.Request) {
 	query := r.URL.Query().Get("q")
 	if query == "" {
-		http.Error(w, `{"error":"q parameter required"}`, http.StatusBadRequest)
+		jsonError(w, "q parameter required", http.StatusBadRequest)
 		return
 	}
 

internal/server/server.go

@@ -41,8 +41,8 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 func (s *Server) routes() {
 	r := chi.NewRouter()
 	r.Use(middleware.Recoverer)
-	r.Use(localhostOnly)
 	r.Use(securityHeaders)
+	r.Use(localhostOnly)
 	r.Use(limitRequestBody)
 
 	r.Route("/api", func(r chi.Router) {

internal/store/db.go

@@ -73,17 +73,14 @@ func OpenMemory() (*DB, error) {
 }
 
 // hardenPermissions tightens file/directory permissions for existing installs.
+// MkdirAll/OpenFile only set permissions on creation — this fixes pre-existing files.
 func hardenPermissions(dir, dbPath string) {
 	if info, err := os.Stat(dir); err == nil && info.Mode().Perm()&0077 != 0 {
-		if err := os.Chmod(dir, 0700); err == nil {
-			fmt.Fprintf(os.Stderr, "  security: tightened %s to 0700\n", dir)
-		}
+		_ = os.Chmod(dir, 0700)
 	}
 	for _, f := range []string{dbPath, dbPath + "-wal", dbPath + "-shm"} {
 		if info, err := os.Stat(f); err == nil && info.Mode().Perm()&0077 != 0 {
-			if err := os.Chmod(f, 0600); err == nil {
-				fmt.Fprintf(os.Stderr, "  security: tightened %s to 0600\n", f)
-			}
+			_ = os.Chmod(f, 0600)
 		}
 	}
 }

internal/store/observations.go

@@ -6,9 +6,9 @@ import (
 	"time"
 )
 
-// maxToolResponseSize is the maximum size of tool_response stored in the DB.
+// maxToolFieldSize is the maximum size of tool_input and tool_response stored in the DB.
 // Prevents bloat — Phase 2 extraction processes full transcript anyway.
-const maxToolResponseSize = 10 * 1024 // 10KB
+const maxToolFieldSize = 10 * 1024 // 10KB
 
 // Observation represents a single tool use recorded during a session.
 type Observation struct {
@@ -22,13 +22,13 @@ type Observation struct {
 
 // AddObservation stores a tool use observation. Truncates large fields to prevent DB bloat.
 func (db *DB) AddObservation(sessionID, toolName, toolInput, toolResponse string) error {
-	if len(toolInput) > maxToolResponseSize {
-		log.Printf("observation: tool_input truncated for session %s: %d → %d bytes", sessionID, len(toolInput), maxToolResponseSize)
-		toolInput = toolInput[:maxToolResponseSize]
+	if len(toolInput) > maxToolFieldSize {
+		log.Printf("observation: tool_input truncated for session %s: %d → %d bytes", sessionID, len(toolInput), maxToolFieldSize)
+		toolInput = toolInput[:maxToolFieldSize]
 	}
-	if len(toolResponse) > maxToolResponseSize {
-		log.Printf("observation: tool_response truncated for session %s: %d → %d bytes", sessionID, len(toolResponse), maxToolResponseSize)
-		toolResponse = toolResponse[:maxToolResponseSize]
+	if len(toolResponse) > maxToolFieldSize {
+		log.Printf("observation: tool_response truncated for session %s: %d → %d bytes", sessionID, len(toolResponse), maxToolFieldSize)
+		toolResponse = toolResponse[:maxToolFieldSize]
 	}
 
 	now := time.Now().UnixMilli()

internal/store/observations_test.go

@@ -42,15 +42,19 @@ func TestAddObservationTruncation(t *testing.T) {
 	}
 	defer db.Close()
 
-	bigResponse := strings.Repeat("x", 20*1024) // 20KB
-	err = db.AddObservation("sess-001", "Bash", "{}", bigResponse)
+	bigInput := strings.Repeat("i", 20*1024)    // 20KB
+	bigResponse := strings.Repeat("r", 20*1024)  // 20KB
+	err = db.AddObservation("sess-001", "Bash", bigInput, bigResponse)
 	if err != nil {
 		t.Fatalf("AddObservation: %v", err)
 	}
 
 	obs, _ := db.GetObservations("sess-001")
-	if len(obs[0].ToolResponse) != maxToolResponseSize {
-		t.Errorf("ToolResponse length = %d, want %d", len(obs[0].ToolResponse), maxToolResponseSize)
+	if len(obs[0].ToolInput) != maxToolFieldSize {
+		t.Errorf("ToolInput length = %d, want %d", len(obs[0].ToolInput), maxToolFieldSize)
+	}
+	if len(obs[0].ToolResponse) != maxToolFieldSize {
+		t.Errorf("ToolResponse length = %d, want %d", len(obs[0].ToolResponse), maxToolFieldSize)
 	}
 }