fix: security and correctness hardening across API, tools, MCP, persistence, and gateways

[Patel230]

Summary

Comprehensive security and correctness hardening across hawk, covering 6 commits and 19 files + eyrie submodule bumps.

Critical fixes

• api/server.go: Add ReadHeaderTimeout/Read/Write/Idle timeouts (slowloris DoS fix); add validateAuthConfig loopback auth gate; Stop uses 15s bounded timeout
• tool/file_write.go: Replace os.WriteFile with atomic temp-file → sync → rename (crash-safe writes); log backup failures via slog.Warn

High fixes

• tool/bash.go: Replace cmd.CombinedOutput with limitedWriter that caps memory at 500 KB
• tool/safety.go: validateURLPublic returns originalHost for Host header preservation; add 0.0.0.0/8, 100.64.0.0/10, 198.18.0.0/15 SSRF ranges; check IPv4-mapped IPv6 against IPv4 CIDR blocks
• tool/web_fetch.go + download.go: Set req.Host to preserve original hostname after IP pinning
• mcp/mcp.go: time.After → time.NewTimer+Stop; preserve JSON-RPC error code/message via pendErrors map; log scanner.Err() with slog.Warn
• tool/retry.go + resilience/retry/retry.go: time.After → time.NewTimer+Stop
• engine/stream.go: Same timer leak fix in stream retry backoff
• resilience/ratelimit/ratelimit.go: Same timer leak fix
• session/persist.go: Atomic write with sync before rename (was os.WriteFile without sync)
• session/sqlite_store.go: Add SetMaxOpenConns(1) + busy_timeout=5000 pragma
• sandbox/netproxy.go: Add HTTP server timeouts (slowloris fix)
• daemon/telegram.go: Replace fmt.Sprintf JSON injection with json.Marshal; bound response body to 1 MiB; rune-safe truncation
• daemon/discord.go + gateway.go: Bound response body reads

Medium fixes

• permissions/guardian.go: isBase64Injection uses byte iteration (rune/byte consistency)
• engine/stream.go: Snapshot goroutine bounded with 30s timeout
• api/server.go: Security headers middleware on all routes

Submodule bumps

• external/eyrie bumped to latest (picks up all eyrie fixes including centralized httputil package)

Verification

• ✅ go build ./...
• ✅ go test -race -count=1 ./... — all pass
• ✅ go vet ./...
• ✅ go fmt clean
• ✅ testaudit (go/ast invariants) passes
• ✅ govulncheck: no vulnerabilities

[Patel230]

Code Review — Findings & Fixes

Reviewed all 20 changed files. Found 4 issues (1 P1, 1 P2, 2 P3), all fixed in commit 0f00c09 + eyrie submodule bump 0593f34.

[P1] bash.go: Truncation marker silently lost (regression)

limitedWriter.maxBytes was set to maxOutputBytes (500,000), but TruncateOutput returns input unchanged at len(s) <= maxOutputBytes. Since the buffer caps at exactly 500,000, the [output truncated] indicator never fired for commands producing >=500KB. Fix: cap at maxOutputBytes + 1 so TruncateOutput's > branch fires.

[P2] engine/stream.go: Snapshot 30s timeout was dead code

snapCtx was created then immediately discarded (_ = snapCtx). SnapshotTracker.Track(message string) ignored context, so a hung git operation would leak the goroutine indefinitely. Fix: added TrackCtx(ctx, message) to the interface and Tracker impl, threading context into exec.CommandContext via new gitWorkCtx/gitWorkOutputCtx helpers.

[P3] tool/safety.go: Dead IPv4-mapped IPv6 branch

The checkIPs logic (ip.To4() != nil && !ip.Equal(v4)) was always false — net.IP.Equal canonicalizes mapped/4-byte forms, and net.IPNet.Contains already calls ip.To4() internally. Fix: removed the dead code, simplified to a direct block.Contains(ip) check.

[P3] mcp/mcp.go: pendErrors detail lost on quick server EOF

readLoop cleanup deleted ALL pendErrors entries, including ones for already-signaled requests whose caller hadn't read the error detail yet. Fix: only delete pendErrors entries for IDs still in s.pending (undelivered); leave already-delivered entries for the caller to reap.

Verified clean

Atomic file_write, SSRF IP pinning + Host preservation, timer.Stop() on all paths, sqlite_store MaxOpenConns + busy_timeout, daemon body bounding + rune-safe truncation, security headers middleware, bounded Shutdown timeout.