Weekly tech debt audit: miso-chat - 2026-07-01

[itsmiso-ai]

Weekly tech debt audit: miso-chat - 2026-07-01

Issue URL: #654

Summary / Overall Risk Level

Overall risk level: P1 / medium, trending down. Since the 2026-06-24 audit (#622), 11 of 14 decomposed issues have been closed (issues #629–#640). Significant progress:

• CSP restored with sha256 hash pinning replacing unsafe-inline (Restore inline-script CSP without breaking startup #629)
• Pre-merge integration smoke catches boot/auth/send regressions before merge (Add pre-merge guard-rails for codex-style regressions #630, ci(smoke): add pre-merge integration smoke (#630) #648)
• addImage innerHTML sink replaced with createElement + isSafeImageUrl guard (Replace addImage innerHTML sink with createElement/textContent and add an isSafeImageUrl filter that rejects javascript #638, security: replace addImage innerHTML sink with createElement and add isSafeImageUrl guard #651)
• Authz/integration test matrix expanded to 986 lines (Expand the authz/integration test matrix #633, test: expand authz/integration test matrix for issue #633 #647)
• public/index.html modules extracted: secure-storage, session-key-hydration (Continue extracting public/index.html runtime modules #631, refactor: extract secure-storage and session-key-hydration modules #649)
• server.js boundary splitting: reactions route extraction (Continue splitting server.js by boundary #632)
• Link preview hardened with per-host concurrency, 5xx retry, structured timing metrics (Harden link-preview performance #637, feat(link-preview): harden performance with per-host concurrency, 5xx retry, and metrics #644)
• Post-deploy smoke wired into publish-release.yml and manual-release.yml (Wire post-deploy smoke into release/publish workflows #639, fix(release): wire post-deploy smoke into publish and manual release workflows #650)
• Docs repaired: README changelog backfilled through v0.4.19, Capgo Cloud refs removed (Repair README / docs drift #636, docs: backfill changelog v0.4.14–v0.4.19, remove stale Capgo Cloud refs #652)
• Dead typescript devDependency removed (Remove dead typescript devDependency and re-evaluate whether the server-side lib/update-manager.js should drop its @capa #635, Remove dead typescript devDependency and drop @capacitor/core in server update-manager #645)
• CSP directives tightened with form-action, base-uri, frame-ancestors, media-src, worker-src (Tighten CSP with media-src, worker-src; add header-presence tests #642)

Tests: 318 passing (up from 274), 0 failing. ESLint: 0 errors, 52 warnings. npm audit: 0 vulnerabilities. server.js: 1578 lines. public/index.html: 4011 lines.

Remaining open work from the prior audit (3 issues still open):

• Finish CSRF token frontend integration (#537 follow-up) #627 P1 — CSRF token frontend integration (status/in-progress) — no browser code fetches /api/csrf-token or sends X-CSRF-Token.
• Wire Android release signing #628 P1 — Wire Android release signing (status/in-review, PR fix(android-release): wire release signing with key.properties and required secrets #653 open) — signing config still missing.
• Add graceful shutdown #634 P2 — Add graceful shutdown (status/in-progress) — no SIGTERM handler.

New findings in this cycle are concentrated at P2 (maintainability, small hardening gaps).

Top Findings

P0

• None confirmed. No live secret exposure, no unauthenticated destructive route, no failing mainline CI.

P1

• Finish CSRF token frontend integration (#537 follow-up) #627 — CSRF token frontend integration still unfinished. security.js route-level CSRF middleware has never been wired into browser code. Zero matches for X-CSRF-Token in public/ files. The middleware early-returns when the session token is unset, making it dead code.

• Wire Android release signing #628 — Android release APKs remain unsigned. android/app/build.gradle still lacks a signingConfig for the release build type. PR fix(android-release): wire release signing with key.properties and required secrets #653 is open.

P2

• index.html still 4011 lines. Extraction of secure-storage and session-key-hydration helped, but message rendering, history polling, auth flows, SSE handling, theme, queue, emoji shortcodes, and mobile auth callback remain in one file. 9 remaining innerHTML assignments.

• Duplicate rate-limit key generation. The CF-IP / X-Forwarded-For / req.ip fallback chain is copy-pasted three times in server.js (lines 300, 334, 355). Should be extracted to a shared helper.

• public/mobile/update-manager.js still uses innerHTML (line 197) for the update notification template. No user interpolation, but same vector class.

• multer in package.json dependencies is listed but never imported or used anywhere in the codebase.

• cors package (v2.8.6) with Express 5 (v5.2.1). Express 5 has built-in CORS support; the cors npm package is an Express 3/4 middleware. Should be verified for compatibility or replaced.

• 5 unused variable warnings in tests (link-preview-cache, link-preview-performance, mobile-auth-regression).

• security.js has an unused reason parameter at line 72.

• console.warn duplication in security.js getScriptSrcDirective — same message in both branches.

P3

• RELEASE.md still recommends git push --tags workflow for releases, but the actual release process uses manual-release.yml auto-merge.
• scripts/release-version-check.js not run in any CI workflow.
• docker-compose.yml still mounts . to /app shadowing the container's /app/data directory.
• No knip or dead-code analysis tool in CI.

Evidence

Repository: misospace/miso-chat, main, HEAD 988dea0. Latest release: 0.4.19.

File sizes:

• server.js: 1578
• security.js: 298
• lib/auth-session.js: 545
• lib/gateway-ws.js: 459
• lib/db.js: 160
• lib/link-preview-cache.js: 259
• lib/ssrf-validation.js: 123
• lib/session-auth.js: 29
• lib/update-manager.js: 163
• public/index.html: 4011
• public/lib/api-client.js: 304
• public/lib/session-key-hydration.js: 122
• public/lib/secure-storage.js: 83
• public/lib/render-utils.js: 203
• tests/: 6581 (total across all test files)

Test results:

• 318 tests, 318 pass, 0 fail, duration ~30.1s

Lint:

• 0 errors, 52 warnings

Audit:

• 0 vulnerabilities

Unfinished business — CSRF:

• grep -rn "X-CSRF-Token|x-csrf-token|csrfToken|/api/csrf-token" public/ public/lib/ public/mobile/ -> zero matches in browser code.
• security.js csrfTokenCheck early-returns when session token is absent.
• tests/security.test.js destructures csrfTokenCheck but never exercises it.
• Issue Finish CSRF token frontend integration (#537 follow-up) #627 still status/in-progress.

Unfinished business — Android signing:

• android/app/build.gradle release type has no signingConfigs block.
• PR fix(android-release): wire release signing with key.properties and required secrets #653 is open as status/in-review.

Unfinished business — graceful shutdown:

• server.js: no process.on('SIGTERM') or process.on('SIGINT') handler.
• gatewayWsManager.disconnect() only called from request handlers.

Duplicate rate-limit key generation in server.js:

• Lines 300-329 (limiter)
• Lines 334-353 (sseLimiter)
• Lines 355-374 (authLimiter)
• All three identical except for max and skip predicates.

innerHTML usage remaining:

• 9 assignments in public/index.html (code highlighting, header parts, shortcode suggestions, session select, message container resets) — all hardcoded/trusted strings.
• 1 assignment in public/mobile/update-manager.js:197 (update notification template).

Recommended Issue Breakdown

1. P1 — Finish CSRF token frontend integration (Finish CSRF token frontend integration (#537 follow-up) #627 continuation): fetch /api/csrf-token on page load, attach X-CSRF-Token to POST/PUT/PATCH/DELETE from apiFetch, retry once on 403, add integration tests.

2. P1 — Wire Android release signing (Wire Android release signing #628 continuation): merge signing solution from PR fix(android-release): wire release signing with key.properties and required secrets #653.

3. P2 — Extract duplicate rate-limit key generation into shared helper: single rateLimitKeyGenerator(req) function replacing three copies.

4. P2 — Replace innerHTML in public/mobile/update-manager.js notification: use createElement/textContent/appendChild.

5. P2 — Add graceful shutdown (Add graceful shutdown #634 continuation): process.on('SIGTERM'/'SIGINT') handler closes HTTP server, drains SSE, calls gatewayWsManager.disconnect().

6. P2 — Verify cors package compatibility with Express 5. Either verify or migrate to Express 5 native CORS.

7. P2 — Remove unused multer dependency from package.json.

8. P3 — Update RELEASE.md to match current automation release flow.

9. P3 — Fix unused variable warnings in tests.

10. P3 — Clean up console.warn duplication in security.js getScriptSrcDirective.

Not Worth Doing Yet

• Do not rewrite the frontend framework. The module-extraction strategy is working.
• Do not replace SQLite. Only reactions are stored and volume is trivial.
• Do not build per-user RBAC before session-ownership contract settles (meta(0.5.0): plan miso-chat for OpenClaw-as-MCP and multi-provider message-plane #387).
• Do not add knip/CI dead-code analysis until remaining P1s are closed.
• Do not pursue Express 5 compatibility audit beyond the CORS point above.

• Finish CSRF token frontend integration (#537 follow-up) #627 — Finish CSRF token frontend integration (Add route-level CSRF tokens for browser session commands #537 follow-up)
• Wire Android release signing #628 — Wire Android release signing
• Add graceful shutdown #634 — Add graceful shutdown
• TBD — Extract duplicate rate-limit key generation into shared helper
• TBD — Replace innerHTML in public/mobile/update-manager.js notification
• TBD — Verify cors package compatibility with Express 5
• TBD — Remove unused multer dependency from package.json
• TBD — Update RELEASE.md to match current automation release flow
• TBD — Fix unused variable warnings in tests
• TBD — Clean up console.warn duplication in security.js