fix: viewer security hardening and evolve write ordering

[rohitg00]

Summary

• Viewer auth uses timing-safe HMAC comparison (fixes Viewer server does not validate Content-Type on POST requests #38, Error responses inconsistently leak raw error messages #39 partially)
• CSP header on viewer HTML responses (fixes Viewer HTML served without Content-Security-Policy headers #44 for viewer server)
• Content-Type validation on POST/DELETE endpoints — returns 415 on mismatch (fixes Viewer server does not validate Content-Type on POST requests #38)
• Evolve function: supersede old memory before saving new to prevent dual-latest

Closes

• Closes Viewer server does not validate Content-Type on POST requests #38
• Closes Error responses inconsistently leak raw error messages #39

Test plan

• npm run build passes
• All 216 tests pass
• No regressions

Summary by CodeRabbit

Release Notes

• Security Improvements
  • Strengthened authentication verification mechanisms
  • Added Content Security Policy headers for enhanced viewer security
  • Enforced content-type validation for API and governance requests to prevent malformed submissions
  • Improved request validation for better protection against invalid data

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 2f1d34f2-632c-4508-a580-a4f8522b0259

📥 Commits

Reviewing files that changed from the base of the PR and between 70999c3 and 169939f.

📒 Files selected for processing (2)

• src/functions/relations.ts
• src/viewer/server.ts

---

📝 Walkthrough

Walkthrough

The pull request reorders memory evolution write operations in the relations flow, then hardens the viewer server with security improvements: timing-safe authentication comparison, Content-Security-Policy headers, and Content-Type validation on POST and DELETE requests.

Changes

Cohort / File(s)	Summary
Memory Evolution Reordering src/functions/relations.ts	Reorders KV write operations during memory evolution: removes initial write of evolved memory, defers it until after marking existing memory as non-latest, preserving end state consistency.
Viewer Server Security Hardening src/viewer/server.ts	Adds timing-safe authentication comparison for Bearer token validation, sets Content-Security-Policy header on HTML responses, and enforces Content-Type validation (application/json) on POST and DELETE requests with 415 error responses.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~22 minutes

Possibly related PRs

• feat: viewer UI redesign with real-time streaming #10: Directly modifies the same viewer server implementation with related security and validation enhancements across authentication and request handling.

Poem

🐰 Whiskers twitching with delight!
Auth now time-safe, policies tight,
Content-Type guards the gate,
Memory writes reordered straight,
Security hops feel just right! 🔐✨

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/remaining-audit-issues

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}