From 609ccd32c43a2ea84987d43d736d784f4c234bb4 Mon Sep 17 00:00:00 2001
From: Hermes <hermes@nousagent.com>
Date: Sat, 8 Aug 2026 03:35:55 -0700
Subject: [PATCH] =?UTF-8?q?[grade=3DA]=20P0-5:=20apps-revert=20catch=20?=
 =?UTF-8?q?=E2=80=94=20log=20err=20server-side,=20return=20generic=20'Reve?=
 =?UTF-8?q?rt=20failed'=20to=20client?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 dashcaddy-api/routes/apps/restore.js | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/dashcaddy-api/routes/apps/restore.js b/dashcaddy-api/routes/apps/restore.js
index 81e1434..ec0f423 100644
--- a/dashcaddy-api/routes/apps/restore.js
+++ b/dashcaddy-api/routes/apps/restore.js
@@ -293,7 +293,11 @@ module.exports = function({ docker, caddy, servicesStateManager, asyncHandler, e
         throw err;
       }
     } catch (err) {
-      errorResponse(res, 500, err.message);
+      // P0-5 fix: was `errorResponse(res, 500, err.message)` which leaks internal
+      // error details (paths, stack traces, library error codes) to the client.
+      // Log the actual error server-side and return a generic message.
+      log.error('apps-revert', 'Revert failed', { error: err.message, stack: err.stack });
+      errorResponse(res, 500, 'Revert failed');
     }
   }, 'apps-revert'));