From b85503b3b20be08123c46c2ba7429a98705cfd59 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Wed, 24 Dec 2025 17:49:52 +0100
Subject: [PATCH] fix: guard hook payload strings

---
 src/gateway/server.ts | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/src/gateway/server.ts b/src/gateway/server.ts
index ceea9874d..470c5984d 100644
--- a/src/gateway/server.ts
+++ b/src/gateway/server.ts
@@ -1363,10 +1363,8 @@ export async function startGatewayServer(
       typeof body.value === "object" && body.value !== null ? body.value : {};
 
     if (subPath === "wake") {
-      const text =
-        typeof (payload as { text?: unknown }).text === "string"
-          ? (payload as { text?: string }).text.trim()
-          : "";
+      const textRaw = (payload as { text?: unknown }).text;
+      const text = typeof textRaw === "string" ? textRaw.trim() : "";
       if (!text) {
         sendJson(res, 400, { ok: false, error: "text required" });
         return true;
@@ -1382,10 +1380,8 @@ export async function startGatewayServer(
     }
 
     if (subPath === "agent") {
-      const message =
-        typeof (payload as { message?: unknown }).message === "string"
-          ? (payload as { message?: string }).message.trim()
-          : "";
+      const messageRaw = (payload as { message?: unknown }).message;
+      const message = typeof messageRaw === "string" ? messageRaw.trim() : "";
       if (!message) {
         sendJson(res, 400, { ok: false, error: "message required" });
         return true;
@@ -1486,7 +1482,7 @@ export async function startGatewayServer(
             requestReplyHeartbeatNow({ reason: `hook:${jobId}` });
           }
         } catch (err) {
-          logHooks.warn({ err: String(err) }, "hook agent failed");
+          logHooks.warn("hook agent failed", { err: String(err) });
           enqueueSystemEvent(`Hook ${name} (error): ${String(err)}`);
           if (wakeMode === "now") {
             requestReplyHeartbeatNow({ reason: `hook:${jobId}:error` });