fix: plug remaining injection and UX gaps

isSafeEnvValue:
- Reject '$' — dotenv / @next/env expand `${OTHER_VAR}` on re-parse,
  which would let a submitted value exfiltrate or overwrite sibling
  env contents.
- Reject whitespace — writeEnvFile doesn't quote, so an unquoted
  `KEY=a b` gets parsed as just `a` on the next read. Rejecting here
  is simpler than asymmetric quoting and no legitimate key/URL value
  needs spaces or tabs.

settings-panel:
- fetchKeys now returns "ok" | "rejected" | "error" so saveAdminToken
  can tell a 401 apart from a network blip. A network failure after a
  save no longer falsely claims the token was rejected.
- clearAdminToken and the open-effect mark fetchKeys/fetchSkills as
  void to silence @typescript-eslint/no-floating-promises.

Author: us

agent-templates/next/app/(agent)/_components/settings-panel.tsx

@@ -425,31 +425,39 @@ export default function SettingsPanel({ config, onChange }: { config: AgentConfi
     setTokenSet(getConfigToken() !== "");
   }, [open]);
 
-  // Returns true if the fetch authenticated (or no auth was needed) so
-  // callers like saveAdminToken can surface a "rejected" message.
-  const fetchKeys = useCallback(async (): Promise<boolean> => {
+  // Distinguishes the three outcomes so callers can show an accurate
+  // message — a network blip should not look like "token rejected".
+  type FetchKeysResult = "ok" | "rejected" | "error";
+  const fetchKeys = useCallback(async (): Promise<FetchKeysResult> => {
+    let res: Response;
     try {
       // On hosted deployments the GET is guarded too — attach token if we have one.
-      const res = await fetch("/api/config", { headers: configHeaders(false) });
-      if (res.status === 401 || res.status === 403) {
-        // The token (if any) is rejected. Drop it so the user doesn't
-        // stay locked out on the next render with stale creds in storage.
-        window.localStorage.removeItem(CONFIG_TOKEN_KEY);
-        setTokenSet(false);
-        setAuthRequired(true);
-        setHosted(true);
-        return false;
-      }
-      if (res.ok) {
+      res = await fetch("/api/config", { headers: configHeaders(false) });
+    } catch {
+      return "error";
+    }
+    if (res.status === 401 || res.status === 403) {
+      // The token (if any) is rejected. Drop it so the user doesn't
+      // stay locked out on the next render with stale creds in storage.
+      window.localStorage.removeItem(CONFIG_TOKEN_KEY);
+      setTokenSet(false);
+      setAuthRequired(true);
+      setHosted(true);
+      return "rejected";
+    }
+    if (res.ok) {
+      try {
         const data: ConfigResponse = await res.json();
         setKeyStatuses(data.keys);
         setValueStatuses(data.values ?? {});
         setHosted(data.hosted);
         setAuthRequired(false);
-        return true;
+        return "ok";
+      } catch {
+        return "error";
       }
-    } catch { /* noop */ }
-    return false;
+    }
+    return "error";
   }, []);
 
   const saveAdminToken = async () => {
@@ -458,8 +466,12 @@ export default function SettingsPanel({ config, onChange }: { config: AgentConfi
     window.localStorage.setItem(CONFIG_TOKEN_KEY, t);
     setTokenSet(true);
     setTokenDraft("");
-    const ok = await fetchKeys();
-    setSaveMsg(ok ? "Admin token saved" : "Token rejected by server");
+    const result = await fetchKeys();
+    const msg =
+      result === "ok" ? "Admin token saved"
+      : result === "rejected" ? "Token rejected by server"
+      : "Network error — token saved locally, retry when reachable";
+    setSaveMsg(msg);
     setTimeout(() => setSaveMsg(""), 3000);
   };
 
@@ -468,7 +480,7 @@ export default function SettingsPanel({ config, onChange }: { config: AgentConfi
     setTokenSet(false);
     setSaveMsg("Admin token cleared");
     setTimeout(() => setSaveMsg(""), 3000);
-    fetchKeys();
+    void fetchKeys();
   };
 
   const fetchSkills = useCallback(async () => {
@@ -484,7 +496,7 @@ export default function SettingsPanel({ config, onChange }: { config: AgentConfi
   }, []);
 
   useEffect(() => {
-    if (open) { fetchKeys(); fetchSkills(); }
+    if (open) { void fetchKeys(); void fetchSkills(); }
   }, [open, fetchKeys, fetchSkills]);
 
   const saveKey = async (id: string) => {

agent-templates/next/app/(agent)/_lib/config/keys.ts

@@ -118,12 +118,19 @@ export function requireConfigReadAuth(req: Request): Response | null {
  *               parser (e.g. `@next/env`, `dotenv`) re-reads the file
  *   \         — backslash escapes are parser-dependent; reject to keep
  *               round-trip predictable
- *   #         — leading/mid-line `#` is treated as a comment by most
- *               dotenv parsers and would truncate the value silently
- * API keys never legitimately contain any of these, so rejecting is safe.
+ *   #         — a mid-line `#` is treated as a comment by most dotenv
+ *               parsers and would truncate the value silently
+ *   $         — `${OTHER_VAR}` triggers variable expansion in dotenv /
+ *               @next/env and would let a submitted value exfiltrate
+ *               other env contents on re-parse
+ *   whitespace — unquoted space/tab in `KEY=a b` gets parsed as just
+ *               `a`; writeEnvFile doesn't quote, so reject here instead
+ *               of adding asymmetric quoting logic
+ * API keys, base URLs, OAuth/JWT tokens, and base64 strings never
+ * legitimately contain any of these, so rejecting is safe.
  */
 export function isSafeEnvValue(v: unknown): v is string {
-  return typeof v === "string" && !/[\r\n\0"'\\#]/.test(v);
+  return typeof v === "string" && !/[\r\n\0"'\\#$\s]/.test(v);
 }
 
 // Strip one layer of balanced surrounding quotes (" or ') from a .env value.