Potential fix for code scanning alert no. 4: Information exposure through a stack trace

[0xcucumbersalad]

Potential fix for https://github.com/decocms/studio/security/code-scanning/4

To fix this without changing functional behavior, keep HTTP status codes and route behavior the same, but replace client-visible error details derived from caught exceptions with a generic message. If debugging detail is still needed, log the caught error on the server (stderr) instead of returning it in the response payload.

Best single approach in this file:

• In packages/sandbox/daemon-e2e/stub-daemon.mjs, update both catch (e) blocks in:
  • POST /_sandbox/write
  • POST /_sandbox/read
• Replace return send(res, 400, { error: String(e?.message ?? e) }); with:
  • a server-side log line including the error object (or stack if present), and
  • a generic client message such as { error: "invalid request" }.

No imports or external dependencies are needed.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

---

Summary by cubic

Stops exposing exception details from the sandbox daemon stub by returning a generic error to clients and logging the stack to stderr. Preserves all route behavior and HTTP status codes to address the information exposure alert.

• Changes limited to POST /_sandbox/write and POST /_sandbox/read: still return 400 on failure, but payload is { error: "invalid request" }; full error/stack is written to stderr.
• No new imports or dependencies; only two catch blocks modified.
• If any tests or clients assert on previous error strings, update them to expect the generic message.

^{Written for commit fc07d5a. Summary will update on new commits.}