AI-written webhook code treated an empty configured token as authenticated, then passed a caller-supplied command to a shell, enabling unauthenticated remote code execution.

+	"crypto/subtle"+	"encoding/json"+	"fmt"+	"log/slog"+	"net/http"+	"os"+	"os/exec"+	"strings"+	"sync"+	"time"+)++// WebhookServer exposes an HTTP endpoint for external systems+// (git hooks, CI/CD, file watchers, etc.) to trigger agent or shell actions.+type WebhookServer struct {+	port    int+	token   string+	path    string+	server  *http.Server+	engines map[string]*Engine+	mu      sync.RWMutex+}++// WebhookRequest is the JSON body for POST /hook.+type WebhookRequest struct {+	Event      string `json:"event,omitempty"`       // event name for logging (e.g. "git:commit")+	Project    string `json:"project,omitempty"`      // target project; optional if single project+	SessionKey string `json:"session_key"`            // target session key (required)+	Prompt     string `json:"prompt,omitempty"`       // agent prompt (mutually exclusive with exec)+	Exec       string `json:"exec,omitempty"`         // shell command (mutually exclusive with prompt)+	WorkDir    string `json:"work_dir,omitempty"`     // working dir for exec+	Silent     bool   `json:"silent,omitempty"`       // suppress notification+	Payload    any    `json:"payload,omitempty"`      // arbitrary extra data; appended to prompt context+}++func NewWebhookServer(port int, token, path string) *WebhookServer {+	if port <= 0 {+		port = 9111+	}+	if path == "" {+		path = "/hook"+	}+	if !strings.HasPrefix(path, "/") {+		path = "/" + path+	}+	return &WebhookServer{+		port:    port,+		token:   token,+		path:    path,+		engines: make(map[string]*Engine),+	}+}++func (ws *WebhookServer) RegisterEngine(name string, e *Engine) {+	ws.mu.Lock()+	defer ws.mu.Unlock()+	ws.engines[name] = e+}++func (ws *WebhookServer) Start() {+	mux := http.NewServeMux()+	mux.HandleFunc(ws.path, ws.handleHook)++	addr := fmt.Sprintf(":%d", ws.port)+	ws.server = &http.Server{Addr: addr, Handler: mux}++	go func() {+		slog.Info("webhook: server started", "addr", addr, "path", ws.path)+		if err := ws.server.ListenAndServe(); err != nil && err != http.ErrServerClosed {+			slog.Error("webhook: server error", "error", err)+		}+	}()+}++func (ws *WebhookServer) Stop() {+	if ws.server != nil {+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)+		defer cancel()+		ws.server.Shutdown(ctx)+	}+}++func (ws *WebhookServer) handleHook(w http.ResponseWriter, r *http.Request) {+	if r.Method != http.MethodPost {+		http.Error(w, "POST only", http.StatusMethodNotAllowed)

+	"encoding/json"+	"net/http"+	"net/http/httptest"+	"testing"+)++func TestWebhookServer_AuthBearer(t *testing.T) {+	ws := NewWebhookServer(0, "my-secret", "/hook")+	r := httptest.NewRequest(http.MethodPost, "/hook", nil)+	r.Header.Set("Authorization", "Bearer my-secret")+	if !ws.authenticate(r) {+		t.Error("expected auth to succeed with correct Bearer token")+	}+	r.Header.Set("Authorization", "Bearer wrong")+	if ws.authenticate(r) {+		t.Error("expected auth to fail with wrong Bearer token")+	}+}++func TestWebhookServer_AuthHeader(t *testing.T) {+	ws := NewWebhookServer(0, "tok123", "/hook")+	r := httptest.NewRequest(http.MethodPost, "/hook", nil)+	r.Header.Set("X-Webhook-Token", "tok123")+	if !ws.authenticate(r) {+		t.Error("expected auth to succeed with X-Webhook-Token")+	}+}++func TestWebhookServer_AuthQuery(t *testing.T) {+	ws := NewWebhookServer(0, "qsecret", "/hook")+	r := httptest.NewRequest(http.MethodPost, "/hook?token=qsecret", nil)+	if !ws.authenticate(r) {+		t.Error("expected auth to succeed with query token")+	}+}++func TestWebhookServer_NoTokenRequired(t *testing.T) {+	ws := NewWebhookServer(0, "", "/hook")+	r := httptest.NewRequest(http.MethodPost, "/hook", nil)+	if !ws.authenticate(r) {+		t.Error("expected auth to pass when no token configured")+	}+}++func TestWebhookServer_HandleHook_MethodNotAllowed(t *testing.T) {+	ws := NewWebhookServer(0, "", "/hook")+	w := httptest.NewRecorder()+	r := httptest.NewRequest(http.MethodGet, "/hook", nil)+	ws.handleHook(w, r)+	if w.Code != http.StatusMethodNotAllowed {+		t.Errorf("expected 405, got %d", w.Code)+	}+}++func TestWebhookServer_HandleHook_Unauthorized(t *testing.T) {+	ws := NewWebhookServer(0, "secret", "/hook")+	w := httptest.NewRecorder()+	body, _ := json.Marshal(WebhookRequest{SessionKey: "tg:1:1", Prompt: "hi"})+	r := httptest.NewRequest(http.MethodPost, "/hook", bytes.NewReader(body))+	ws.handleHook(w, r)+	if w.Code != http.StatusUnauthorized {+		t.Errorf("expected 401, got %d", w.Code)+	}+}++func TestWebhookServer_HandleHook_Validation(t *testing.T) {+	ws := NewWebhookServer(0, "", "/hook")++	tests := []struct {+		name string+		body WebhookRequest+		code int+	}{+		{"missing session_key", WebhookRequest{Prompt: "hi"}, http.StatusBadRequest},+		{"missing prompt and exec", WebhookRequest{SessionKey: "tg:1:1"}, http.StatusBadRequest},+		{"both prompt and exec", WebhookRequest{SessionKey: "tg:1:1", Prompt: "hi", Exec: "ls"}, http.StatusBadRequest},+	}++	for _, tt := range tests {+		t.Run(tt.name, func(t *testing.T) {+			w := httptest.NewRecorder()+			body, _ := json.Marshal(tt.body)+			r := httptest.NewRequest(http.MethodPost, "/hook", bytes.NewReader(body))+			ws.handleHook(w, r)+			if w.Code != tt.code {

@@ -38,6 +39,14 @@ type CronConfig struct { 	Silent *bool `toml:"silent"` // suppress cron start notification; default false } +// WebhookConfig controls the external HTTP webhook endpoint.+type WebhookConfig struct {+	Enabled *bool  `toml:"enabled"`           // default false+	Port    int    `toml:"port,omitempty"`     // listen port; default 9111+	Token   string `toml:"token,omitempty"`    // shared secret for authentication; empty = no auth+	Path    string `toml:"path,omitempty"`     // URL path prefix; default "/hook"+}+ // DisplayConfig controls how intermediate messages (thinking, tool output) are shown. type DisplayConfig struct { 	ThinkingMaxLen  *int `toml:"thinking_max_len"`    // max chars for thinking messages; 0 = no truncation; default 300