Issue Queue: issue-exec-20260106-160325 (#52)

* feat(security): Secure dashboard server by default

## Solution Summary
- Solution-ID: SOL-DSC-002-1
- Issue-ID: DSC-002

## Tasks Completed
- [T1] JWT token manager (24h expiry, persisted secret/token)
- [T2] API auth middleware + localhost token endpoint
- [T3] Default bind 127.0.0.1, add --host with warning
- [T4] Localhost-only CORS with credentials + Vary
- [T5] SECURITY.md documentation + README link

## Verification
- npm run build
- npm test -- ccw/tests/token-manager.test.ts ccw/tests/middleware.test.ts ccw/tests/server-auth.integration.test.ts ccw/tests/server.test.ts ccw/tests/cors.test.ts

* fix(security): Prevent command injection in Windows spawn()

## Solution Summary
- **Solution-ID**: SOL-DSC-001-1
- **Issue-ID**: DSC-001
- **Risk/Impact/Complexity**: high/high/medium

## Tasks Completed
- [T1] Create Windows shell escape utility
- [T2] Escape cli-executor spawn() args on Windows
- [T3] Add command injection regression tests

## Files Modified
- ccw/src/utils/shell-escape.ts
- ccw/src/tools/cli-executor.ts
- ccw/tests/shell-escape.test.ts
- ccw/tests/security/command-injection.test.ts

## Verification
- npm run build
- npm test -- ccw/tests/shell-escape.test.ts ccw/tests/security/command-injection.test.ts

* fix(security): Harden path validation (DSC-005)

## Solution Summary
- Solution-ID: SOL-DSC-005-1
- Issue-ID: DSC-005

## Tasks Completed
- T1: Refactor path validation to pre-resolution checking
- T2: Implement allowlist-based path validation
- T3: Add path validation to API routes
- T4: Add path security regression tests

## Files Modified
- ccw/src/utils/path-resolver.ts
- ccw/src/utils/path-validator.ts
- ccw/src/core/routes/graph-routes.ts
- ccw/src/core/routes/files-routes.ts
- ccw/src/core/routes/skills-routes.ts
- ccw/tests/path-resolver.test.ts
- ccw/tests/graph-routes.test.ts
- ccw/tests/files-routes.test.ts
- ccw/tests/skills-routes.test.ts
- ccw/tests/security/path-traversal.test.ts

## Verification
- npm run build
- npm test -- path-resolver.test.ts
- npm test -- path-validator.test.ts
- npm test -- graph-routes.test.ts
- npm test -- files-routes.test.ts
- npm test -- skills-routes.test.ts
- npm test -- ccw/tests/security/path-traversal.test.ts

* fix(security): Prevent credential leakage (DSC-004)

## Solution Summary
- Solution-ID: SOL-DSC-004-1
- Issue-ID: DSC-004

## Tasks Completed
- T1: Create credential handling security tests
- T2: Add log sanitization tests
- T3: Add env var leakage prevention tests
- T4: Add secure storage tests

## Files Modified
- ccw/src/config/litellm-api-config-manager.ts
- ccw/src/core/routes/litellm-api-routes.ts
- ccw/tests/security/credential-handling.test.ts

## Verification
- npm run build
- node --experimental-strip-types --test ccw/tests/security/credential-handling.test.ts

* test(ranking): expand normalize_weights edge case coverage (ISS-1766920108814-0)

## Solution Summary
- Solution-ID: SOL-20251228113607
- Issue-ID: ISS-1766920108814-0

## Tasks Completed
- T1: Fix NaN and invalid total handling in normalize_weights
- T2: Add unit tests for NaN edge cases in normalize_weights

## Files Modified
- codex-lens/tests/test_rrf_fusion.py

## Verification
- python -m pytest codex-lens/tests/test_rrf_fusion.py::TestNormalizeBM25Score -v
- python -m pytest codex-lens/tests/test_rrf_fusion.py -v -k normalize
- python -m pytest codex-lens/tests/test_rrf_fusion.py::TestReciprocalRankFusion::test_weight_normalization codex-lens/tests/test_cli_hybrid_search.py::TestCLIHybridSearch::test_weights_normalization -v

* feat(security): Add CSRF protection and tighten CORS (DSC-006)

## Solution Summary
- Solution-ID: SOL-DSC-006-1
- Issue-ID: DSC-006
- Risk/Impact/Complexity: high/high/medium

## Tasks Completed
- T1: Create CSRF token generation system
- T2: Add CSRF token endpoints
- T3: Implement CSRF validation middleware
- T4: Restrict CORS to trusted origins
- T5: Add CSRF security tests

## Files Modified
- ccw/src/core/auth/csrf-manager.ts
- ccw/src/core/auth/csrf-middleware.ts
- ccw/src/core/routes/auth-routes.ts
- ccw/src/core/server.ts
- ccw/tests/csrf-manager.test.ts
- ccw/tests/auth-routes.test.ts
- ccw/tests/csrf-middleware.test.ts
- ccw/tests/security/csrf.test.ts

## Verification
- npm run build
- node --experimental-strip-types --test ccw/tests/csrf-manager.test.ts
- node --experimental-strip-types --test ccw/tests/auth-routes.test.ts
- node --experimental-strip-types --test ccw/tests/csrf-middleware.test.ts
- node --experimental-strip-types --test ccw/tests/cors.test.ts
- node --experimental-strip-types --test ccw/tests/security/csrf.test.ts

* fix(cli-executor): prevent stale SIGKILL timeouts

## Solution Summary

- Solution-ID: SOL-DSC-007-1

- Issue-ID: DSC-007

- Risk/Impact/Complexity: low/low/low

## Tasks Completed

- [T1] Store timeout handle in killCurrentCliProcess

## Files Modified

- ccw/src/tools/cli-executor.ts

- ccw/tests/cli-executor-kill.test.ts

## Verification

- node --experimental-strip-types --test ccw/tests/cli-executor-kill.test.ts

* fix(cli-executor): enhance merge validation guards

## Solution Summary

- Solution-ID: SOL-DSC-008-1

- Issue-ID: DSC-008

- Risk/Impact/Complexity: low/low/low

## Tasks Completed

- [T1] Enhance sourceConversations array validation

## Files Modified

- ccw/src/tools/cli-executor.ts

- ccw/tests/cli-executor-merge-validation.test.ts

## Verification

- node --experimental-strip-types --test ccw/tests/cli-executor-merge-validation.test.ts

* refactor(core): remove @ts-nocheck from core routes

## Solution Summary
- Solution-ID: SOL-DSC-003-1
- Issue-ID: DSC-003
- Queue-ID: QUE-20260106-164500
- Item-ID: S-9

## Tasks Completed
- T1: Create shared RouteContext type definition
- T2: Remove @ts-nocheck from small route files
- T3: Remove @ts-nocheck from medium route files
- T4: Remove @ts-nocheck from large route files
- T5: Remove @ts-nocheck from remaining core files

## Files Modified
- ccw/src/core/dashboard-generator-patch.ts
- ccw/src/core/dashboard-generator.ts
- ccw/src/core/routes/ccw-routes.ts
- ccw/src/core/routes/claude-routes.ts
- ccw/src/core/routes/cli-routes.ts
- ccw/src/core/routes/codexlens-routes.ts
- ccw/src/core/routes/discovery-routes.ts
- ccw/src/core/routes/files-routes.ts
- ccw/src/core/routes/graph-routes.ts
- ccw/src/core/routes/help-routes.ts
- ccw/src/core/routes/hooks-routes.ts
- ccw/src/core/routes/issue-routes.ts
- ccw/src/core/routes/litellm-api-routes.ts
- ccw/src/core/routes/litellm-routes.ts
- ccw/src/core/routes/mcp-routes.ts
- ccw/src/core/routes/mcp-routes.ts.backup
- ccw/src/core/routes/mcp-templates-db.ts
- ccw/src/core/routes/nav-status-routes.ts
- ccw/src/core/routes/rules-routes.ts
- ccw/src/core/routes/session-routes.ts
- ccw/src/core/routes/skills-routes.ts
- ccw/src/core/routes/status-routes.ts
- ccw/src/core/routes/system-routes.ts
- ccw/src/core/routes/types.ts
- ccw/src/core/server.ts
- ccw/src/core/websocket.ts

## Verification
- npm run build
- npm test

* refactor: split cli-executor and codexlens routes into modules

## Solution Summary
- Solution-ID: SOL-DSC-012-1
- Issue-ID: DSC-012
- Risk/Impact/Complexity: medium/medium/high

## Tasks Completed
- [T1] Extract execution orchestration from cli-executor.ts (Refactor ccw/src/tools)
- [T2] Extract route handlers from codexlens-routes.ts (Refactor ccw/src/core/routes)
- [T3] Extract prompt concatenation logic from cli-executor (Refactor ccw/src/tools)
- [T4] Document refactored module architecture (Docs)

## Files Modified
- ccw/src/tools/cli-executor.ts
- ccw/src/tools/cli-executor-core.ts
- ccw/src/tools/cli-executor-utils.ts
- ccw/src/tools/cli-executor-state.ts
- ccw/src/tools/cli-prompt-builder.ts
- ccw/src/tools/README.md
- ccw/src/core/routes/codexlens-routes.ts
- ccw/src/core/routes/codexlens/config-handlers.ts
- ccw/src/core/routes/codexlens/index-handlers.ts
- ccw/src/core/routes/codexlens/semantic-handlers.ts
- ccw/src/core/routes/codexlens/watcher-handlers.ts
- ccw/src/core/routes/codexlens/utils.ts
- ccw/src/core/routes/codexlens/README.md

## Verification
- npm run build
- npm test

* test(issue): Add comprehensive issue command tests

## Solution Summary
- **Solution-ID**: SOL-DSC-009-1
- **Issue-ID**: DSC-009
- **Risk/Impact/Complexity**: low/high/medium

## Tasks Completed
- [T1] Create issue command test file structure: Create isolated test harness
- [T2] Add JSONL read/write operation tests: Verify JSONL correctness and errors
- [T3] Add issue lifecycle tests: Verify status transitions and timestamps
- [T4] Add solution binding tests: Verify binding flows and error cases
- [T5] Add queue formation tests: Verify queue creation, IDs, and DAG behavior
- [T6] Add queue execution tests: Verify next/done/retry and status sync

## Files Modified
- ccw/src/commands/issue.ts
- ccw/tests/issue-command.test.ts

## Verification
- node --experimental-strip-types --test ccw/tests/issue-command.test.ts

* test(routes): Add integration tests for route modules

## Solution Summary
- Solution-ID: SOL-DSC-010-1
- Issue-ID: DSC-010
- Queue-ID: QUE-20260106-164500

## Tasks Completed
- [T1] Add tests for ccw-routes.ts
- [T2] Add tests for files-routes.ts
- [T3] Add tests for claude-routes.ts (includes Windows path fix for create)
- [T4] Add tests for issue-routes.ts
- [T5] Add tests for help-routes.ts (avoid hanging watchers)
- [T6] Add tests for nav-status-routes.ts
- [T7] Add tests for hooks/graph/rules/skills/litellm-api routes

## Files Modified
- ccw/src/core/routes/claude-routes.ts
- ccw/src/core/routes/help-routes.ts
- ccw/tests/integration/ccw-routes.test.ts
- ccw/tests/integration/claude-routes.test.ts
- ccw/tests/integration/files-routes.test.ts
- ccw/tests/integration/issue-routes.test.ts
- ccw/tests/integration/help-routes.test.ts
- ccw/tests/integration/nav-status-routes.test.ts
- ccw/tests/integration/hooks-routes.test.ts
- ccw/tests/integration/graph-routes.test.ts
- ccw/tests/integration/rules-routes.test.ts
- ccw/tests/integration/skills-routes.test.ts
- ccw/tests/integration/litellm-api-routes.test.ts

## Verification
- node --experimental-strip-types --test ccw/tests/integration/ccw-routes.test.ts
- node --experimental-strip-types --test ccw/tests/integration/files-routes.test.ts
- node --experimental-strip-types --test ccw/tests/integration/claude-routes.test.ts
- node --experimental-strip-types --test ccw/tests/integration/issue-routes.test.ts
- node --experimental-strip-types --test ccw/tests/integration/help-routes.test.ts
- node --experimental-strip-types --test ccw/tests/integration/nav-status-routes.test.ts
- node --experimental-strip-types --test ccw/tests/integration/hooks-routes.test.ts
- node --experimental-strip-types --test ccw/tests/integration/graph-routes.test.ts
- node --experimental-strip-types --test ccw/tests/integration/rules-routes.test.ts
- node --experimental-strip-types --test ccw/tests/integration/skills-routes.test.ts
- node --experimental-strip-types --test ccw/tests/integration/litellm-api-routes.test.ts

* refactor(core): Switch cache and lite scanning to async fs

## Solution Summary
- Solution-ID: SOL-DSC-013-1
- Issue-ID: DSC-013
- Queue-ID: QUE-20260106-164500

## Tasks Completed
- [T1] Convert cache-manager.ts to async file operations
- [T2] Convert lite-scanner.ts to async file operations
- [T3] Update cache-manager call sites to await async API
- [T4] Update lite-scanner call sites to await async API

## Files Modified
- ccw/src/core/cache-manager.ts
- ccw/src/core/lite-scanner.ts
- ccw/src/core/data-aggregator.ts

## Verification
- npm run build
- npm test

* fix(exec): Add timeout protection for execSync

## Solution Summary
- Solution-ID: SOL-DSC-014-1
- Issue-ID: DSC-014
- Queue-ID: QUE-20260106-164500

## Tasks Completed
- [T1] Add timeout to execSync calls in python-utils.ts
- [T2] Add timeout to execSync calls in detect-changed-modules.ts
- [T3] Add timeout to execSync calls in claude-freshness.ts
- [T4] Add timeout to execSync calls in issue.ts
- [T5] Consolidate execSync timeout constants and audit coverage

## Files Modified
- ccw/src/utils/exec-constants.ts
- ccw/src/utils/python-utils.ts
- ccw/src/tools/detect-changed-modules.ts
- ccw/src/core/claude-freshness.ts
- ccw/src/commands/issue.ts
- ccw/src/tools/smart-search.ts
- ccw/src/tools/codex-lens.ts
- ccw/src/core/routes/codexlens/config-handlers.ts

## Verification
- npm run build
- npm test
- node --experimental-strip-types --test ccw/tests/issue-command.test.ts

* feat(cli): Add progress spinner with elapsed time for long-running operations

## Solution Summary
- Solution-ID: SOL-DSC-015-1
- Issue-ID: DSC-015
- Queue-Item: S-15
- Risk/Impact/Complexity: low/medium/low

## Tasks Completed
- [T1] Add progress spinner to CLI execution: Update ccw/src/commands/cli.ts

## Files Modified
- ccw/src/commands/cli.ts
- ccw/tests/cli-command.test.ts

## Verification
- node --experimental-strip-types --test ccw/tests/cli-command.test.ts
- node --experimental-strip-types --test ccw/tests/cli-executor-kill.test.ts
- node --experimental-strip-types --test ccw/tests/cli-executor-merge-validation.test.ts

* fix(cli): Move full output hint immediately after truncation notice

## Solution Summary
- Solution-ID: SOL-DSC-016-1
- Issue-ID: DSC-016
- Queue-Item: S-16
- Risk/Impact/Complexity: low/high/low

## Tasks Completed
- [T1] Relocate output hint after truncation: Update ccw/src/commands/cli.ts

## Files Modified
- ccw/src/commands/cli.ts
- ccw/tests/cli-command.test.ts

## Verification
- npm run build
- node --experimental-strip-types --test ccw/tests/cli-command.test.ts

* feat(cli): Add confirmation prompts for destructive operations

## Solution Summary
- Solution-ID: SOL-DSC-017-1
- Issue-ID: DSC-017
- Queue-Item: S-17
- Risk/Impact/Complexity: low/high/low

## Tasks Completed
- [T1] Add confirmation to storage clean operations: Update ccw/src/commands/cli.ts
- [T2] Add confirmation to issue queue delete: Update ccw/src/commands/issue.ts

## Files Modified
- ccw/src/commands/cli.ts
- ccw/src/commands/issue.ts
- ccw/tests/cli-command.test.ts
- ccw/tests/issue-command.test.ts

## Verification
- npm run build
- node --experimental-strip-types --test ccw/tests/cli-command.test.ts
- node --experimental-strip-types --test ccw/tests/issue-command.test.ts

* feat(cli): Improve multi-line prompt guidance

## Solution Summary
- Solution-ID: SOL-DSC-018-1
- Issue-ID: DSC-018
- Queue-Item: S-18
- Risk/Impact/Complexity: low/medium/low

## Tasks Completed
- [T1] Update CLI help to emphasize --file option: Update ccw/src/commands/cli.ts
- [T2] Add inline hint for multi-line detection: Update ccw/src/commands/cli.ts

## Files Modified
- ccw/src/commands/cli.ts
- ccw/tests/cli-command.test.ts

## Verification
- npm run build
- node --experimental-strip-types --test ccw/tests/cli-command.test.ts

---------

Co-authored-by: catlog22 <catlog22@github.com>

ccw/src/core/routes/mcp-routes.ts

@@ -1,13 +1,12 @@
-// @ts-nocheck
 /**
  * MCP Routes Module
  * Handles all MCP-related API endpoints
  */
-import type { IncomingMessage, ServerResponse } from 'http';
 import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, statSync } from 'fs';
 import { join, dirname } from 'path';
 import { homedir } from 'os';
 import * as McpTemplatesDb from './mcp-templates-db.js';
+import type { RouteContext } from './types.js';
 
 // Claude config file path
 const CLAUDE_CONFIG_PATH = join(homedir(), '.claude.json');
@@ -432,16 +431,6 @@ function toggleCodexMcpServer(serverName: string, enabled: boolean): { success?:
   }
 }
 
-export interface RouteContext {
-  pathname: string;
-  url: URL;
-  req: IncomingMessage;
-  res: ServerResponse;
-  initialPath: string;
-  handlePostRequest: (req: IncomingMessage, res: ServerResponse, handler: (body: unknown) => Promise<any>) => void;
-  broadcastToClients: (data: unknown) => void;
-}
-
 // ========================================
 // Helper Functions
 // ========================================
@@ -464,7 +453,7 @@ function getEnterpriseMcpPath(): string {
 /**
  * Safely read and parse JSON file
  */
-function safeReadJson(filePath) {
+function safeReadJson(filePath: string): any | null {
   try {
     if (!existsSync(filePath)) return null;
     const content = readFileSync(filePath, 'utf8');
@@ -479,8 +468,8 @@ function safeReadJson(filePath) {
  * @param {string} filePath
  * @returns {Object} mcpServers object or empty object
  */
-function getMcpServersFromFile(filePath) {
-  const config = safeReadJson(filePath);
+function getMcpServersFromFile(filePath: string): Record<string, unknown> {
+  const config = safeReadJson(filePath) as { mcpServers?: Record<string, unknown> } | null;
   if (!config) return {};
   return config.mcpServers || {};
 }
@@ -492,7 +481,7 @@ function getMcpServersFromFile(filePath) {
  * @param {Object} serverConfig - MCP server configuration
  * @returns {Object} Result with success/error
  */
-function addMcpServerToMcpJson(projectPath, serverName, serverConfig) {
+function addMcpServerToMcpJson(projectPath: string, serverName: string, serverConfig: unknown) {
   try {
     const normalizedPath = normalizePathForFileSystem(projectPath);
     const mcpJsonPath = join(normalizedPath, '.mcp.json');
@@ -530,7 +519,7 @@ function addMcpServerToMcpJson(projectPath, serverName, serverConfig) {
  * @param {string} serverName - MCP server name
  * @returns {Object} Result with success/error
  */
-function removeMcpServerFromMcpJson(projectPath, serverName) {
+function removeMcpServerFromMcpJson(projectPath: string, serverName: string) {
   try {
     const normalizedPath = normalizePathForFileSystem(projectPath);
     const mcpJsonPath = join(normalizedPath, '.mcp.json');
@@ -562,6 +551,26 @@ function removeMcpServerFromMcpJson(projectPath, serverName) {
   }
 }
 
+type McpServerConfig = Record<string, unknown>;
+type McpServers = Record<string, McpServerConfig>;
+type ProjectConfig = {
+  mcpServers?: McpServers;
+  mcpJsonPath?: string;
+  hasMcpJson?: boolean;
+  [key: string]: unknown;
+};
+type ProjectsConfig = Record<string, ProjectConfig>;
+type ConfigSource = { type: string; path: string; count: number };
+
+interface McpConfig {
+  projects: ProjectsConfig;
+  userServers: McpServers;
+  enterpriseServers: McpServers;
+  globalServers: McpServers;
+  configSources: ConfigSource[];
+  error?: string;
+}
+
 /**
  * Get MCP configuration from multiple sources (per official Claude Code docs):
  *
@@ -575,12 +584,13 @@ function removeMcpServerFromMcpJson(projectPath, serverName) {
  *
  * @returns {Object}
  */
-function getMcpConfig() {
+function getMcpConfig(): McpConfig {
   try {
-    const result = {
+    const result: McpConfig = {
       projects: {},
       userServers: {},        // User-level servers from ~/.claude.json mcpServers
       enterpriseServers: {},  // Enterprise managed servers (highest priority)
+      globalServers: {},      // Merged user + enterprise
       configSources: []       // Track where configs came from for debugging
     };
 
@@ -650,7 +660,14 @@ function getMcpConfig() {
     return result;
   } catch (error: unknown) {
     console.error('Error reading MCP config:', error);
-    return { projects: {}, globalServers: {}, userServers: {}, enterpriseServers: {}, configSources: [], error: (error as Error).message };
+    return {
+      projects: {},
+      globalServers: {},
+      userServers: {},
+      enterpriseServers: {},
+      configSources: [],
+      error: error instanceof Error ? error.message : String(error),
+    };
   }
 }
 
@@ -660,7 +677,7 @@ function getMcpConfig() {
  * @param {string} path
  * @returns {string}
  */
-function normalizePathForFileSystem(path) {
+function normalizePathForFileSystem(path: string): string {
   let normalized = path.replace(/\\/g, '/');
   
   // Handle /d/path format -> D:/path
@@ -678,7 +695,7 @@ function normalizePathForFileSystem(path) {
  * @param {Object} claudeConfig - Optional existing config to check format
  * @returns {string}
  */
-function normalizeProjectPathForConfig(path, claudeConfig = null) {
+function normalizeProjectPathForConfig(path: string, claudeConfig: unknown = null): string {
   // IMPORTANT: Always normalize to forward slashes to prevent duplicate entries
   // (e.g., prevents both "D:/Claude_dms3" and "D:\\Claude_dms3")
   let normalizedForward = path.replace(/\\/g, '/');
@@ -699,7 +716,7 @@ function normalizeProjectPathForConfig(path, claudeConfig = null) {
  * @param {boolean} enable
  * @returns {Object}
  */
-function toggleMcpServerEnabled(projectPath, serverName, enable) {
+function toggleMcpServerEnabled(projectPath: string, serverName: string, enable: boolean) {
   try {
     if (!existsSync(CLAUDE_CONFIG_PATH)) {
       return { error: '.claude.json not found' };
@@ -723,7 +740,7 @@ function toggleMcpServerEnabled(projectPath, serverName, enable) {
 
     if (enable) {
       // Remove from disabled list
-      projectConfig.disabledMcpServers = projectConfig.disabledMcpServers.filter(s => s !== serverName);
+      projectConfig.disabledMcpServers = projectConfig.disabledMcpServers.filter((s: string) => s !== serverName);
     } else {
       // Add to disabled list if not already there
       if (!projectConfig.disabledMcpServers.includes(serverName)) {
@@ -755,7 +772,7 @@ function toggleMcpServerEnabled(projectPath, serverName, enable) {
  * @param {boolean} useLegacyConfig - If true, use .claude.json instead of .mcp.json
  * @returns {Object}
  */
-function addMcpServerToProject(projectPath, serverName, serverConfig, useLegacyConfig = false) {
+function addMcpServerToProject(projectPath: string, serverName: string, serverConfig: unknown, useLegacyConfig: boolean = false) {
   try {
     // Default: Use .mcp.json for project-level MCP servers
     if (!useLegacyConfig) {
@@ -823,7 +840,7 @@ function addMcpServerToProject(projectPath, serverName, serverConfig, useLegacyC
  * @param {string} serverName
  * @returns {Object}
  */
-function removeMcpServerFromProject(projectPath, serverName) {
+function removeMcpServerFromProject(projectPath: string, serverName: string) {
   try {
     const normalizedPathForFile = normalizePathForFileSystem(projectPath);
     const mcpJsonPath = join(normalizedPathForFile, '.mcp.json');
@@ -859,7 +876,7 @@ function removeMcpServerFromProject(projectPath, serverName) {
 
           // Also remove from disabled list if present
           if (projectConfig.disabledMcpServers) {
-            projectConfig.disabledMcpServers = projectConfig.disabledMcpServers.filter(s => s !== serverName);
+            projectConfig.disabledMcpServers = projectConfig.disabledMcpServers.filter((s: string) => s !== serverName);
           }
 
           // Write back to file
@@ -894,7 +911,7 @@ function removeMcpServerFromProject(projectPath, serverName) {
  * @param {Object} serverConfig
  * @returns {Object}
  */
-function addGlobalMcpServer(serverName, serverConfig) {
+function addGlobalMcpServer(serverName: string, serverConfig: unknown) {
   try {
     if (!existsSync(CLAUDE_CONFIG_PATH)) {
       return { error: '.claude.json not found' };
@@ -931,7 +948,7 @@ function addGlobalMcpServer(serverName, serverConfig) {
  * @param {string} serverName
  * @returns {Object}
  */
-function removeGlobalMcpServer(serverName) {
+function removeGlobalMcpServer(serverName: string) {
   try {
     if (!existsSync(CLAUDE_CONFIG_PATH)) {
       return { error: '.claude.json not found' };
@@ -967,7 +984,7 @@ function removeGlobalMcpServer(serverName) {
  * @param {string} filePath
  * @returns {Object}
  */
-function readSettingsFile(filePath) {
+function readSettingsFile(filePath: string) {
   try {
     if (!existsSync(filePath)) {
       return {};
@@ -985,7 +1002,7 @@ function readSettingsFile(filePath) {
  * @param {string} filePath
  * @param {Object} settings
  */
-function writeSettingsFile(filePath, settings) {
+function writeSettingsFile(filePath: string, settings: any) {
   const dirPath = dirname(filePath);
   // Ensure directory exists
   if (!existsSync(dirPath)) {
@@ -999,7 +1016,7 @@ function writeSettingsFile(filePath, settings) {
  * @param {string} projectPath
  * @returns {string}
  */
-function getProjectSettingsPath(projectPath) {
+function getProjectSettingsPath(projectPath: string): string {
   // path.join automatically handles cross-platform path separators
   return join(projectPath, '.claude', 'settings.json');
 }
@@ -1008,6 +1025,10 @@ function getProjectSettingsPath(projectPath) {
 // Route Handlers
 // ========================================
 
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null;
+}
+
 /**
  * Handle MCP routes
  * @returns true if route was handled, false otherwise
@@ -1043,11 +1064,22 @@ export async function handleMcpRoutes(ctx: RouteContext): Promise<boolean> {
   // API: Add Codex MCP server
   if (pathname === '/api/codex-mcp-add' && req.method === 'POST') {
     handlePostRequest(req, res, async (body) => {
-      const { serverName, serverConfig } = body;
-      if (!serverName || !serverConfig) {
-        return { error: 'serverName and serverConfig are required', status: 400 };
+      if (!isRecord(body)) {
+        return { error: 'Invalid request body', status: 400 };
       }
-      return addCodexMcpServer(serverName, serverConfig);
+
+      const serverName = body.serverName;
+      const serverConfig = body.serverConfig;
+
+      if (typeof serverName !== 'string' || !serverName.trim()) {
+        return { error: 'serverName is required', status: 400 };
+      }
+
+      if (!isRecord(serverConfig)) {
+        return { error: 'serverConfig is required', status: 400 };
+      }
+
+      return addCodexMcpServer(serverName, serverConfig as Record<string, any>);
     });
     return true;
   }
@@ -1055,8 +1087,12 @@ export async function handleMcpRoutes(ctx: RouteContext): Promise<boolean> {
   // API: Remove Codex MCP server
   if (pathname === '/api/codex-mcp-remove' && req.method === 'POST') {
     handlePostRequest(req, res, async (body) => {
-      const { serverName } = body;
-      if (!serverName) {
+      if (!isRecord(body)) {
+        return { error: 'Invalid request body', status: 400 };
+      }
+
+      const serverName = body.serverName;
+      if (typeof serverName !== 'string' || !serverName.trim()) {
         return { error: 'serverName is required', status: 400 };
       }
       return removeCodexMcpServer(serverName);
@@ -1067,8 +1103,14 @@ export async function handleMcpRoutes(ctx: RouteContext): Promise<boolean> {
   // API: Toggle Codex MCP server enabled state
   if (pathname === '/api/codex-mcp-toggle' && req.method === 'POST') {
     handlePostRequest(req, res, async (body) => {
-      const { serverName, enabled } = body;
-      if (!serverName || enabled === undefined) {
+      if (!isRecord(body)) {
+        return { error: 'Invalid request body', status: 400 };
+      }
+
+      const serverName = body.serverName;
+      const enabled = body.enabled;
+
+      if (typeof serverName !== 'string' || !serverName.trim() || typeof enabled !== 'boolean') {
         return { error: 'serverName and enabled are required', status: 400 };
       }
       return toggleCodexMcpServer(serverName, enabled);
@@ -1079,9 +1121,16 @@ export async function handleMcpRoutes(ctx: RouteContext): Promise<boolean> {
   // API: Toggle MCP server enabled/disabled
   if (pathname === '/api/mcp-toggle' && req.method === 'POST') {
     handlePostRequest(req, res, async (body) => {
-      const { projectPath, serverName, enable } = body;
-      if (!projectPath || !serverName) {
-        return { error: 'projectPath and serverName are required', status: 400 };
+      if (!isRecord(body)) {
+        return { error: 'Invalid request body', status: 400 };
+      }
+
+      const projectPath = body.projectPath;
+      const serverName = body.serverName;
+      const enable = body.enable;
+
+      if (typeof projectPath !== 'string' || !projectPath.trim() || typeof serverName !== 'string' || !serverName.trim() || typeof enable !== 'boolean') {
+        return { error: 'projectPath, serverName, and enable are required', status: 400 };
       }
       return toggleMcpServerEnabled(projectPath, serverName, enable);
     });
@@ -1091,8 +1140,16 @@ export async function handleMcpRoutes(ctx: RouteContext): Promise<boolean> {
   // API: Copy MCP server to project
   if (pathname === '/api/mcp-copy-server' && req.method === 'POST') {
     handlePostRequest(req, res, async (body) => {
-      const { projectPath, serverName, serverConfig, configType } = body;
-      if (!projectPath || !serverName || !serverConfig) {
+      if (!isRecord(body)) {
+        return { error: 'Invalid request body', status: 400 };
+      }
+
+      const projectPath = body.projectPath;
+      const serverName = body.serverName;
+      const serverConfig = body.serverConfig;
+      const configType = body.configType;
+
+      if (typeof projectPath !== 'string' || !projectPath.trim() || typeof serverName !== 'string' || !serverName.trim() || serverConfig === undefined || serverConfig === null) {
         return { error: 'projectPath, serverName, and serverConfig are required', status: 400 };
       }
       // configType: 'mcp' = use .mcp.json (default), 'claude' = use .claude.json
@@ -1105,8 +1162,12 @@ export async function handleMcpRoutes(ctx: RouteContext): Promise<boolean> {
   // API: Install CCW MCP server to project
   if (pathname === '/api/mcp-install-ccw' && req.method === 'POST') {
     handlePostRequest(req, res, async (body) => {
-      const { projectPath } = body;
-      if (!projectPath) {
+      if (!isRecord(body)) {
+        return { error: 'Invalid request body', status: 400 };
+      }
+
+      const projectPath = body.projectPath;
+      if (typeof projectPath !== 'string' || !projectPath.trim()) {
         return { error: 'projectPath is required', status: 400 };
       }
 
@@ -1129,8 +1190,13 @@ export async function handleMcpRoutes(ctx: RouteContext): Promise<boolean> {
   // API: Remove MCP server from project
   if (pathname === '/api/mcp-remove-server' && req.method === 'POST') {
     handlePostRequest(req, res, async (body) => {
-      const { projectPath, serverName } = body;
-      if (!projectPath || !serverName) {
+      if (!isRecord(body)) {
+        return { error: 'Invalid request body', status: 400 };
+      }
+
+      const projectPath = body.projectPath;
+      const serverName = body.serverName;
+      if (typeof projectPath !== 'string' || !projectPath.trim() || typeof serverName !== 'string' || !serverName.trim()) {
         return { error: 'projectPath and serverName are required', status: 400 };
       }
       return removeMcpServerFromProject(projectPath, serverName);
@@ -1141,8 +1207,13 @@ export async function handleMcpRoutes(ctx: RouteContext): Promise<boolean> {
   // API: Add MCP server to global scope (top-level mcpServers in ~/.claude.json)
   if (pathname === '/api/mcp-add-global-server' && req.method === 'POST') {
     handlePostRequest(req, res, async (body) => {
-      const { serverName, serverConfig } = body;
-      if (!serverName || !serverConfig) {
+      if (!isRecord(body)) {
+        return { error: 'Invalid request body', status: 400 };
+      }
+
+      const serverName = body.serverName;
+      const serverConfig = body.serverConfig;
+      if (typeof serverName !== 'string' || !serverName.trim() || serverConfig === undefined || serverConfig === null) {
         return { error: 'serverName and serverConfig are required', status: 400 };
       }
       return addGlobalMcpServer(serverName, serverConfig);
@@ -1153,8 +1224,12 @@ export async function handleMcpRoutes(ctx: RouteContext): Promise<boolean> {
   // API: Remove MCP server from global scope
   if (pathname === '/api/mcp-remove-global-server' && req.method === 'POST') {
     handlePostRequest(req, res, async (body) => {
-      const { serverName } = body;
-      if (!serverName) {
+      if (!isRecord(body)) {
+        return { error: 'Invalid request body', status: 400 };
+      }
+
+      const serverName = body.serverName;
+      if (typeof serverName !== 'string' || !serverName.trim()) {
         return { error: 'serverName is required', status: 400 };
       }
       return removeGlobalMcpServer(serverName);
@@ -1177,14 +1252,29 @@ export async function handleMcpRoutes(ctx: RouteContext): Promise<boolean> {
   // API: Save MCP template
   if (pathname === '/api/mcp-templates' && req.method === 'POST') {
     handlePostRequest(req, res, async (body) => {
-      const { name, description, serverConfig, tags, category } = body;
-      if (!name || !serverConfig) {
-        return { error: 'name and serverConfig are required', status: 400 };
+      if (!isRecord(body)) {
+        return { error: 'Invalid request body', status: 400 };
       }
+
+      const name = body.name;
+      const serverConfig = body.serverConfig;
+
+      if (typeof name !== 'string' || !name.trim()) {
+        return { error: 'name is required', status: 400 };
+      }
+
+      if (!isRecord(serverConfig) || typeof serverConfig.command !== 'string') {
+        return { error: 'serverConfig with command is required', status: 400 };
+      }
+
+      const description = typeof body.description === 'string' ? body.description : undefined;
+      const tags = Array.isArray(body.tags) ? body.tags.filter((tag): tag is string => typeof tag === 'string') : undefined;
+      const category = typeof body.category === 'string' ? body.category : undefined;
+
       return McpTemplatesDb.saveTemplate({
         name,
         description,
-        serverConfig,
+        serverConfig: serverConfig as McpTemplatesDb.McpTemplate['serverConfig'],
         tags,
         category
       });
@@ -1244,8 +1334,15 @@ export async function handleMcpRoutes(ctx: RouteContext): Promise<boolean> {
   // API: Install template to project or global
   if (pathname === '/api/mcp-templates/install' && req.method === 'POST') {
     handlePostRequest(req, res, async (body) => {
-      const { templateName, projectPath, scope } = body;
-      if (!templateName) {
+      if (!isRecord(body)) {
+        return { error: 'Invalid request body', status: 400 };
+      }
+
+      const templateName = body.templateName;
+      const projectPath = body.projectPath;
+      const scope = body.scope;
+
+      if (typeof templateName !== 'string' || !templateName.trim()) {
         return { error: 'templateName is required', status: 400 };
       }
 
@@ -1258,7 +1355,7 @@ export async function handleMcpRoutes(ctx: RouteContext): Promise<boolean> {
       if (scope === 'global') {
         return addGlobalMcpServer(templateName, template.serverConfig);
       } else {
-        if (!projectPath) {
+        if (typeof projectPath !== 'string' || !projectPath.trim()) {
           return { error: 'projectPath is required for project scope', status: 400 };
         }
         return addMcpServerToProject(projectPath, templateName, template.serverConfig);