Claude/cpu guard script dn d8u

backend.js

@@ -38,22 +38,28 @@ const LOG_DIR  = path.join(__dirname, 'logs');
 const LOG_FILE = path.join(LOG_DIR, 'backend.log');
 const ERR_FILE = path.join(LOG_DIR, 'backend-error.log');
 
+let _logStream = null;
+let _errStream = null;
+
 try {
     if (!fs.existsSync(LOG_DIR)) fs.mkdirSync(LOG_DIR, { recursive: true });
+    _logStream = fs.createWriteStream(LOG_FILE, { flags: 'a' });
+    _errStream = fs.createWriteStream(ERR_FILE, { flags: 'a' });
+    _logStream.on('error', (e) => { _logStream = null; console.error(`[backend] log stream error: ${e.message}`); });
+    _errStream.on('error', (e) => { _errStream = null; console.error(`[backend] err stream error: ${e.message}`); });
 } catch (e) {
-    console.error(`[backend] Cannot create log directory ${LOG_DIR}: ${e.message}`);
+    console.error(`[backend] Cannot open log files in ${LOG_DIR}: ${e.message}`);
 }
 
-const _logStream = fs.createWriteStream(LOG_FILE, { flags: 'a' });
-const _errStream = fs.createWriteStream(ERR_FILE, { flags: 'a' });
-
 const logger = {
     _entry(level, eventType, msg, extra) {
         return { ts: new Date().toISOString(), level, eventType, msg, ...extra };
     },
     _write(streams, obj) {
         const line = JSON.stringify(obj) + '\n';
-        for (const s of streams) s.write(line);
+        for (const s of streams) {
+            if (s) s.write(line); else console.log(line.trimEnd());
+        }
     },
     info(eventType, msg, extra = {}) {
         this._write([_logStream], this._entry('info', eventType, msg, extra));
@@ -133,8 +139,15 @@ app.use((req, _res, next) => {
     next();
 });
 
-// Capture raw body for HMAC verification on /autofix routes before JSON parsing
-app.use('/autofix', express.raw({ type: '*/*', limit: '1mb' }));
+// Capture raw body for HMAC verification on /autofix routes.
+// Store it on req.rawBody before express.json() can overwrite req.body.
+app.use('/autofix', (req, res, next) => {
+    express.raw({ type: '*/*', limit: '1mb' })(req, res, (err) => {
+        if (err) return next(err);
+        if (Buffer.isBuffer(req.body)) req.rawBody = req.body;
+        next();
+    });
+});
 app.use(express.json({ limit: '1mb' }));
 
 // ─── GET /health ──────────────────────────────────────────────────────────────
@@ -191,7 +204,7 @@ app.post('/autofix/webhook', async (req, res) => {
     const requestId = req.id;
     try {
         const sig     = req.headers['x-autofix-signature'] ?? req.headers['x-hub-signature-256'] ?? '';
-        const rawBody = Buffer.isBuffer(req.body) ? req.body : Buffer.from(JSON.stringify(req.body ?? {}));
+        const rawBody = req.rawBody ?? Buffer.alloc(0);
 
         if (!AUTOFIX_SECRET || !verifySignature(rawBody, sig)) {
             const reason = !AUTOFIX_SECRET ? 'AUTOFIX_SECRET not configured' : 'Signature mismatch';