Validate dashboard checkpoint ids

src/server/api/checkpoint-delete.ts

@@ -13,13 +13,15 @@ export async function handleCheckpointDelete(
   const rootDir = ctx.getCurrentCwd?.();
   if (!rootDir) return { status: 400, body: { error: "no active workspace" } };
 
-  let parsed: { id?: string };
+  let parsed: { id?: unknown };
   try {
     parsed = JSON.parse(body);
   } catch {
     return { status: 400, body: { error: "invalid JSON" } };
   }
-  if (!parsed.id) return { status: 400, body: { error: "missing id" } };
+  if (typeof parsed.id !== "string" || !parsed.id) {
+    return { status: 400, body: { error: "missing id" } };
+  }
 
   const ok = deleteCheckpoint(rootDir, parsed.id);
   return ok

src/server/api/checkpoint-restore.ts

@@ -13,13 +13,15 @@ export async function handleCheckpointRestore(
   const rootDir = ctx.getCurrentCwd?.();
   if (!rootDir) return { status: 400, body: { error: "no active workspace" } };
 
-  let parsed: { id?: string };
+  let parsed: { id?: unknown };
   try {
     parsed = JSON.parse(body);
   } catch {
     return { status: 400, body: { error: "invalid JSON" } };
   }
-  if (!parsed.id) return { status: 400, body: { error: "missing id" } };
+  if (typeof parsed.id !== "string" || !parsed.id) {
+    return { status: 400, body: { error: "missing id" } };
+  }
 
   const result: RestoreResult = restoreCheckpoint(rootDir, parsed.id);
   return { status: 200, body: result };

tests/dashboard-checkpoint-id.test.ts

@@ -0,0 +1,40 @@
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { handleCheckpointDelete } from "../src/server/api/checkpoint-delete.js";
+import { handleCheckpointRestore } from "../src/server/api/checkpoint-restore.js";
+import type { DashboardContext } from "../src/server/context.js";
+
+let root: string;
+
+function ctx(): DashboardContext {
+  return {
+    mode: "standalone",
+    configPath: join(root, ".carboncode", "config.json"),
+    usageLogPath: join(root, ".carboncode", "usage.jsonl"),
+    getCurrentCwd: () => root,
+  };
+}
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), "carboncode-checkpoint-id-"));
+});
+
+afterEach(() => {
+  rmSync(root, { recursive: true, force: true });
+});
+
+describe("dashboard checkpoint id validation", () => {
+  it("rejects non-string restore ids", async () => {
+    const result = await handleCheckpointRestore("POST", [], JSON.stringify({ id: 123 }), ctx());
+
+    expect(result).toEqual({ status: 400, body: { error: "missing id" } });
+  });
+
+  it("rejects non-string delete ids", async () => {
+    const result = await handleCheckpointDelete("POST", [], JSON.stringify({ id: ["cp"] }), ctx());
+
+    expect(result).toEqual({ status: 400, body: { error: "missing id" } });
+  });
+});