@agenticmail/enterprise 0.5.324 → 0.5.326

package/src/db/postgres.ts

@@ -142,7 +142,7 @@ export class PostgresAdapter extends DatabaseAdapter {
 
   getEngineDB() {
     if (!this.pool || this.ended) return null;
-    const pool = this.pool;
+    const _pool = this.pool;
     const self = this;
     // Convert ? placeholders to $1, $2, ... for pg driver
     const pgSql = (sql: string) => {
@@ -699,7 +699,7 @@ export class PostgresAdapter extends DatabaseAdapter {
       totalAgents: parseInt(agents.rows[0].count, 10),
       activeAgents: parseInt(active.rows[0].count, 10),
       totalUsers: parseInt(users.rows[0].count, 10),
-      totalEmails: 0, // TODO: wire to email storage
+      totalEmails: 0, // Email count tracked externally via AgenticMail
       totalAuditEvents: parseInt(audit.rows[0].count, 10),
     };
   }

package/src/deploy/fly.ts

@@ -93,10 +93,10 @@ async function createApp(name: string, fly: FlyConfig): Promise<void> {
 /**
  * Set secrets (environment variables) on a Fly.io app.
  */
-async function setSecrets(
-  appName: string,
-  secrets: Record<string, string>,
-  fly: FlyConfig,
+async function _setSecrets(
+  _appName: string,
+  _secrets: Record<string, string>,
+  _fly: FlyConfig,
 ): Promise<void> {
   // Fly Machines API doesn't have a direct "set secrets" endpoint
   // like flyctl does. Secrets are passed as env vars in machine config.

package/src/deploy/managed.ts

@@ -6,7 +6,6 @@
  * Also generates Docker Compose and Fly.toml for self-hosted.
  */
 
-import { randomUUID } from 'crypto';
 import { deployToFly, type FlyConfig, type AppConfig } from './fly.js';
 
 export interface DeployConfig {

package/src/engine/agent-config.ts

@@ -623,7 +623,7 @@ Check every ${config.heartbeat.intervalMinutes} minutes during active hours.
 `;
   }
 
-  private generateTools(config: AgentConfig): string {
+  private generateTools(_config: AgentConfig): string {
     return `# TOOLS.md — Local Notes
 
 _Add environment-specific notes here (camera names, SSH hosts, etc.)_

package/src/engine/agent-heartbeat.ts

@@ -182,7 +182,7 @@ function createUpcomingEventsCheck(): HeartbeatCheck {
     check: async (ctx: HeartbeatContext): Promise<HeartbeatCheckResult> => {
       try {
         // Check for calendar events in next 2 hours from agent_memory
-        const twoHoursFromNow = new Date(ctx.now.getTime() + 2 * 60 * 60 * 1000).toISOString();
+        const _twoHoursFromNow = new Date(ctx.now.getTime() + 2 * 60 * 60 * 1000).toISOString();
         const rows = await ctx.db.query<any>(
           `SELECT content FROM agent_memory 
            WHERE agent_id = $1 

package/src/engine/agent-hierarchy.ts

@@ -893,7 +893,7 @@ export class AgentHierarchyManager {
    *   If 'email' or 'meeting', management context is minimal.
    *   If 'task' or 'management', full context is included.
    */
-  async buildManagerPrompt(agentId: string, sessionContext?: string): Promise<string | null> {
+  async buildManagerPrompt(agentId: string, _sessionContext?: string): Promise<string | null> {
     const hierarchy = await this.buildHierarchy();
     const node = hierarchy.get(agentId);
     if (!node) return null;

package/src/engine/agent-memory.ts

@@ -14,7 +14,7 @@
  */
 
 import type { EngineDatabase } from './db-adapter.js';
-import { MemorySearchIndex, tokenize } from '../lib/text-search.js';
+import { MemorySearchIndex } from '../lib/text-search.js';
 
 function sj(v: string|null|undefined, fb: any = {}): any { if(!v) return fb; try { return JSON.parse(v); } catch { return fb; } }
 // ─── Types ──────────────────────────────────────────────

package/src/engine/agent-routes.ts

@@ -1730,7 +1730,7 @@ export function createAgentRoutes(opts: {
 
       // ── Create a realistic browser profile using agent identity ──
       const agentName = managed.displayName || managed.display_name || managed.name || (managed.config as any)?.displayName || (managed.config as any)?.name || 'Agent';
-      const agentRole = (managed.config as any)?.role || (managed.config as any)?.description || 'AI Assistant';
+      const _agentRole = (managed.config as any)?.role || (managed.config as any)?.description || 'AI Assistant';
       const profileDir = join(homedir(), '.agenticmail', 'browser-profiles', agentId);
       mkdirSync(profileDir, { recursive: true });
 
@@ -1885,7 +1885,7 @@ export function createAgentRoutes(opts: {
           const data = await resp.json() as any;
           if (data.webSocketDebuggerUrl) {
             try {
-              const closeResp = await fetch(`http://127.0.0.1:${port}/json/close`, { method: 'PUT', signal: AbortSignal.timeout(3000) });
+              const _closeResp = await fetch(`http://127.0.0.1:${port}/json/close`, { method: 'PUT', signal: AbortSignal.timeout(3000) });
               closed = true;
             } catch { /* fallback to kill */ }
           }

package/src/engine/chat-poller.ts

@@ -450,7 +450,7 @@ export class ChatPoller {
 
     let hadError = false;
 
-    for (const [spaceId, space] of this.spaces) {
+    for (const [_spaceId, space] of this.spaces) {
       try {
         await this.pollSpace(token, space);
       } catch (err: any) {

package/src/engine/cluster.ts

@@ -26,7 +26,7 @@ export interface WorkerNode {
   name: string;
   host: string;          // IP or hostname reachable from control plane
   port: number;          // Worker API port
-  url: string;           // Full base URL (e.g., http://192.168.1.50:3101)
+  url: string;           // Full base URL (e.g., http://186.158.1.50:3101)
   platform: string;      // darwin, linux, win32
   arch: string;          // arm64, x64
   cpuCount: number;
@@ -113,6 +113,14 @@ export class ClusterManager {
     }
   }
 
+  /** Validate node ID format */
+  private validateNodeId(nodeId: string): string | null {
+    if (!nodeId || nodeId.length < 2) return 'Node ID must be at least 2 characters';
+    if (nodeId.length > 64) return 'Node ID must be at most 64 characters';
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(nodeId)) return 'Node ID must start with alphanumeric and contain only alphanumeric, dots, hyphens, underscores';
+    return null;
+  }
+
   /** Register or re-register a worker node */
   async register(data: {
     nodeId: string;
@@ -128,6 +136,11 @@ export class ClusterManager {
     capabilities?: string[];
     metadata?: Record<string, any>;
   }): Promise<WorkerNode> {
+    // Validate
+    const idErr = this.validateNodeId(data.nodeId);
+    if (idErr) throw new Error(idErr);
+    if (!data.host) throw new Error('host is required');
+    if (!data.port || data.port < 1 || data.port > 65535) throw new Error('port must be 1-65535');
     const now = new Date().toISOString();
     const existing = this.nodes.get(data.nodeId);
     const node: WorkerNode = {

package/src/engine/community-registry.ts

@@ -10,7 +10,7 @@
 
 import type { EngineDatabase } from './db-adapter.js';
 import type { PermissionEngine, SkillDefinition } from './skills.js';
-import { validateSkillManifest, collectCommunityToolIds, VALID_CATEGORIES, type ManifestValidationResult as _MVR } from './skill-validator.js';
+import { validateSkillManifest, VALID_CATEGORIES, type ManifestValidationResult as _MVR } from './skill-validator.js';
 
 // ─── Types ──────────────────────────────────────────────
 
@@ -133,7 +133,7 @@ export class CommunitySkillRegistry {
     // For simplicity, load installed for all orgs
     // (in production this would be per-org on request)
     try {
-      const rows = await this.engineDb.getInstalledSkillsByOrg('*').catch(() => [] as any[]);
+      const _rows = await this.engineDb.getInstalledSkillsByOrg('*').catch(() => [] as any[]);
       // Actually load per-org when requested; for startup, just clear
       this.installed.clear();
     } catch {

package/src/engine/db-adapter.ts

@@ -21,7 +21,6 @@ import type { Organization, OrgPlan } from './tenant.js';
 import type { ApprovalRequest, ApprovalPolicy } from './approvals.js';
 import type { KnowledgeBase, KBDocument, KBChunk } from './knowledge.js';
 import type { ActivityEvent, ToolCallRecord, ConversationEntry } from './activity.js';
-import type { AgentConfig } from './agent-config.js';
 import {
   ENGINE_TABLES,
   MIGRATIONS,

package/src/engine/deployer.ts

@@ -10,8 +10,8 @@
 import type { AgentConfig, DeploymentTarget, DeploymentStatus } from './agent-config.js';
 import { AgentConfigGenerator } from './agent-config.js';
 import { execSync } from 'child_process';
-import { resolve, dirname } from 'path';
-import { existsSync, writeFileSync, readFileSync } from 'fs';
+import { resolve } from 'path';
+import { existsSync } from 'fs';
 
 /**
  * Derive PM2 process name from agent config.
@@ -126,7 +126,7 @@ function generateEcosystemConfig(config: AgentConfig): { script: string; args: s
 export class DeploymentEngine {
   private configGen = new AgentConfigGenerator();
   private deployments = new Map<string, DeploymentResult>();
-  private liveStatus = new Map<string, LiveAgentStatus>();
+  private _liveStatus = new Map<string, LiveAgentStatus>();
 
   /**
    * Deploy an agent to its configured target
@@ -273,13 +273,13 @@ export class DeploymentEngine {
    */
   async updateConfig(config: AgentConfig): Promise<{ success: boolean; message: string }> {
     const workspace = this.configGen.generateWorkspace(config);
-    const gatewayConfig = this.configGen.generateGatewayConfig(config);
+    const _gatewayConfig = this.configGen.generateGatewayConfig(config);
 
     switch (config.deployment.target) {
       case 'docker': {
         // Write config files into the container
         for (const [file, content] of Object.entries(workspace)) {
-          const escaped = content.replace(/'/g, "'\\''");
+          const _escaped = content.replace(/'/g, "'\\''");
           await this.execCommand(`docker exec agenticmail-${config.name} sh -c 'echo "${Buffer.from(content).toString('base64')}" | base64 -d > /workspace/${file}'`);
         }
         // Restart gateway inside container
@@ -307,7 +307,7 @@ export class DeploymentEngine {
 
     // Generate docker-compose
     emit('provision', 'started', 'Generating Docker configuration...');
-    const compose = this.configGen.generateDockerCompose(config);
+    const _compose = this.configGen.generateDockerCompose(config);
     emit('provision', 'completed', 'Docker Compose generated');
 
     // Generate workspace files
@@ -897,7 +897,7 @@ export class DeploymentEngine {
     }
   }
 
-  private generateDockerfile(config: AgentConfig): string {
+  private _generateDockerfile(config: AgentConfig): string {
     return `FROM node:22-slim
 
 WORKDIR /app
@@ -947,7 +947,7 @@ CMD ["agenticmail-enterprise", "start"]
     return this.execCommand(`ssh ${sshArgs}`);
   }
 
-  private async writeFile(path: string, content: string): Promise<void> {
+  private async _writeFile(path: string, content: string): Promise<void> {
     const { writeFile } = await import('fs/promises');
     const { dirname } = await import('path');
     const { mkdir } = await import('fs/promises');

package/src/engine/email-poller.ts

@@ -258,7 +258,7 @@ export class EmailPoller {
 
   private async connectMailbox(mailbox: AgentMailbox): Promise<void> {
     // Refresh token
-    const token = await this.refreshToken(mailbox);
+    const _token = await this.refreshToken(mailbox);
 
     // Get profile + historyId
     const profile = await this.gmailFetch(mailbox, '/profile');

package/src/engine/knowledge-contribution.ts

@@ -425,7 +425,7 @@ export class KnowledgeContributionManager {
     contributors.add(entry.sourceAgentId);
   }
 
-  private indexEntryRemove(entry: KnowledgeEntry): void {
+  private _indexEntryRemove(entry: KnowledgeEntry): void {
     const baseSet = this.baseEntryIndex.get(entry.baseId);
     if (baseSet) { baseSet.delete(entry.id); if (baseSet.size === 0) this.baseEntryIndex.delete(entry.baseId); }
 

package/src/engine/knowledge-import/import-manager.ts

@@ -16,7 +16,6 @@ import type {
 } from './types.js';
 import { chunkDocument } from './chunker.js';
 import { processDocument } from './processors/pipeline.js';
-import type { ProcessedDocument } from './processors/types.js';
 import { GitHubImportProvider } from './provider-github.js';
 import { SharePointImportProvider } from './provider-sharepoint.js';
 import { GoogleSitesImportProvider } from './provider-google-sites.js';
@@ -35,8 +34,8 @@ const PROVIDERS: Record<ImportSourceType, ImportProvider> = {
   'google-sites': new GoogleSitesImportProvider(),
   'url': new UrlImportProvider(),
   'file-upload': new FileUploadImportProvider(),
-  'confluence': new UrlImportProvider(),  // TODO: dedicated Confluence provider
-  'notion': new UrlImportProvider(),      // TODO: dedicated Notion provider
+  'confluence': new UrlImportProvider(),  // Uses URL-based import; add dedicated API provider when Confluence OAuth is supported
+  'notion': new UrlImportProvider(),      // Uses URL-based import; add dedicated API provider when Notion OAuth is supported
 };
 
 // ─── Source Catalog ──────────────────────────────────

package/src/engine/knowledge-import/processors/extract-github.ts

@@ -11,7 +11,7 @@ import type { ContentExtractor, ExtractResult } from './types.js';
 export class GitHubContentExtractor implements ContentExtractor {
   extract(raw: string, sourceUrl?: string): ExtractResult {
     let content = raw;
-    const isReadme = sourceUrl?.toLowerCase().includes('readme') || false;
+    const _isReadme = sourceUrl?.toLowerCase().includes('readme') || false;
 
     // Remove GitHub badge images at top of README
     content = content.replace(/^\s*(\[!\[[^\]]*\]\([^)]*\)\]\([^)]*\)\s*)+/gm, '');

package/src/engine/knowledge-import/processors/extract-sharepoint.ts

@@ -9,7 +9,7 @@
 import type { ContentExtractor, ExtractResult } from './types.js';
 
 export class SharePointContentExtractor implements ContentExtractor {
-  extract(raw: string, sourceUrl?: string): ExtractResult {
+  extract(raw: string, _sourceUrl?: string): ExtractResult {
     let content = raw;
 
     // If HTML (SharePoint page or Word export)

package/src/engine/knowledge-import/processors/validate.ts

@@ -21,7 +21,7 @@ const MIN_SENTENCE_COUNT = 2;
 const MAX_DUPLICATE_RATIO = 0.4;
 const MIN_QUALITY_SCORE = 30;     // out of 100
 
-export function validateContent(content: string, title?: string): QualityReport {
+export function validateContent(content: string, _title?: string): QualityReport {
   const checks: QualityCheck[] = [];
   const warnings: string[] = [];
 

package/src/engine/lifecycle.ts

@@ -188,7 +188,7 @@ export class AgentLifecycleManager {
   /** When true, this lifecycle runs on a standalone agent machine (not the enterprise server).
    *  In standalone mode, persistAgent reloads dashboard-managed fields from DB before saving. */
   public standaloneMode = false;
-  private configGen = new AgentConfigGenerator();
+  private _configGen = new AgentConfigGenerator();
   private permissions: PermissionEngine;
   private engineDb?: EngineDatabase;
   private eventListeners: ((event: LifecycleEvent) => void)[] = [];

package/src/engine/meeting-monitor.ts

@@ -52,8 +52,8 @@ export class MeetingMonitor {
   private sendChatIndicator?: (page: Page, text: string) => Promise<void>;
   private flushTimer: ReturnType<typeof setInterval> | null = null;
   private running = false;
-  private lastCaptionCount = 0;
-  private lastChatCount = 0;
+  private _lastCaptionCount = 0;
+  private _lastChatCount = 0;
   private consecutiveEmpty = 0;
   private consecutiveSendFailures = 0;
   /** Pending captions accumulated across flush cycles (for debouncing) */

package/src/engine/meeting-voice-intelligence.ts

@@ -21,7 +21,7 @@ import { promises as fs } from 'node:fs';
 import * as path from 'node:path';
 import * as os from 'node:os';
 
-const ELEVENLABS_BASE = 'https://api.elevenlabs.io/v1';
+const _ELEVENLABS_BASE = 'https://api.elevenlabs.io/v1';
 
 // ═══════════════════════════════════════════════════════════
 // GLOBAL RESPONSE PLAYER KILL
@@ -221,7 +221,7 @@ export class MeetingVoiceIntelligence {
   // ─── Speech State (called by meeting_speak tool) ────────
 
   /** Call BEFORE streaming TTS response audio */
-  markSpeaking(text: string): void {
+  markSpeaking(_text: string): void {
     this._state = 'speaking';
   }
 
@@ -306,7 +306,7 @@ export class MeetingVoiceIntelligence {
   hasPendingResume() { return false; }
   async executeResume() { return { success: false, text: '' }; }
   cancelResume() {}
-  markDoneSpeaking_legacy(completed: boolean) { this.markDoneSpeaking(); }
+  markDoneSpeaking_legacy(_completed: boolean) { this.markDoneSpeaking(); }
 
   // Legacy — decisionEngine stub
   get decisionEngine() {

package/src/engine/messaging-poller.ts

@@ -408,7 +408,7 @@ export class MessagingPoller {
     }
   }
 
-  private async downloadTelegramMedia(agent: AgentEndpoint, fileId: string, mediaType: string, fileName?: string, mimeType?: string): Promise<{ localPath: string } | null> {
+  private async downloadTelegramMedia(agent: AgentEndpoint, fileId: string, mediaType: string, fileName?: string, _mimeType?: string): Promise<{ localPath: string } | null> {
     try {
       var channelConfig = this.config.getAgentChannelConfig(agent.id);
       var botToken = channelConfig?.telegram?.botToken;
@@ -647,7 +647,7 @@ export class MessagingPoller {
 
   // ─── Security Wrapping ────────────────────────────
 
-  private wrapCustomerMessage(text: string, senderName: string, config: any): string {
+  private wrapCustomerMessage(text: string, senderName: string, _config: any): string {
     return [
       '<<<CUSTOMER_MESSAGE>>>',
       'SECURITY NOTICE: This message is from a CUSTOMER (external, untrusted sender).',

package/src/engine/org-integration-routes.ts

@@ -185,7 +185,7 @@ export function createOrgIntegrationRoutes(manager: OrgIntegrationManager) {
   // ─── Resolve credentials for an agent ─────────────────
   router.get('/resolve/:agentId', async (c) => {
     try {
-      const agentId = c.req.param('agentId');
+      const _agentId = c.req.param('agentId');
       const provider = c.req.query('provider') || 'google';
       const orgId = c.req.query('orgId') || null;
       
@@ -288,7 +288,7 @@ export function createOrgIntegrationRoutes(manager: OrgIntegrationManager) {
       });
 
       if (!tokenRes.ok) {
-        const err = await tokenRes.text();
+        const _err = await tokenRes.text();
         return c.html(`<script>window.opener?.postMessage({type:'org-oauth-result',status:'error',message:'Token exchange failed: ${tokenRes.status}'},'*');window.close();</script>`);
       }
 

package/src/engine/org-integrations.ts

@@ -427,7 +427,7 @@ export class OrgIntegrationManager {
    * Used by Google Workspace and Microsoft tools at runtime.
    */
   async createTokenProviderForAgent(
-    agentId: string,
+    _agentId: string,
     agentOrgId: string | null,
     provider: 'google' | 'microsoft',
     onTokenRefresh?: (tokens: any) => void

package/src/engine/routes.ts

@@ -343,6 +343,124 @@ engine.get('/cluster/best-node', (c) => {
   const node = cluster.findBestNode(caps);
   return node ? c.json(node) : c.json({ error: 'No suitable node available' }, 404);
 });
+engine.post('/cluster/test-connection', async (c) => {
+  const { host, port } = await c.req.json();
+  if (!host) return c.json({ error: 'host required' }, 400);
+  const p = port || 3101;
+  const start = Date.now();
+  try {
+    const ctrl = new AbortController();
+    const timeout = setTimeout(() => ctrl.abort(), 5000);
+    const res = await fetch(`http://${host}:${p}/health`, { signal: ctrl.signal }).catch(() => null);
+    clearTimeout(timeout);
+    if (res && res.ok) {
+      const data = await res.json().catch(() => ({}));
+      return c.json({ success: true, latencyMs: Date.now() - start, version: data.version, agentId: data.agentId });
+    }
+    // Try the enterprise status endpoint as fallback
+    const ctrl2 = new AbortController();
+    const timeout2 = setTimeout(() => ctrl2.abort(), 5000);
+    const res2 = await fetch(`http://${host}:${p}/api/status`, { signal: ctrl2.signal }).catch(() => null);
+    clearTimeout(timeout2);
+    if (res2 && res2.ok) {
+      return c.json({ success: true, latencyMs: Date.now() - start, version: 'enterprise' });
+    }
+    return c.json({ success: false, error: 'No response from ' + host + ':' + p, latencyMs: Date.now() - start });
+  } catch (e: any) {
+    return c.json({ success: false, error: e.message || 'Connection failed', latencyMs: Date.now() - start });
+  }
+});
+
+engine.post('/cluster/deploy-via-ssh', async (c) => {
+  const body = await c.req.json();
+  if (!body.host) return c.json({ error: 'host required' }, 400);
+  // Use the deployment engine's SSH infrastructure
+  try {
+    const dbUrl = process.env.DATABASE_URL || '';
+    const enterpriseUrl = process.env.ENTERPRISE_URL || `http://${body.host}:${body.port || 3101}`;
+    const nodeId = body.name?.toLowerCase().replace(/[^a-z0-9-]/g, '-') || 'worker-' + body.host.replace(/\./g, '-');
+
+    // Build remote setup script
+    const script = [
+      '#!/bin/bash',
+      'set -e',
+      'export NVM_DIR="$HOME/.nvm"',
+      '[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"',
+      '',
+      '# Install Node.js if not present',
+      'if ! command -v node &> /dev/null; then',
+      '  if command -v apt-get &> /dev/null; then',
+      '    curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -',
+      '    sudo apt-get install -y nodejs',
+      '  elif command -v brew &> /dev/null; then',
+      '    brew install node',
+      '  fi',
+      'fi',
+      '',
+      '# Install PM2 and AgenticMail',
+      'npm install -g pm2 @agenticmail/enterprise',
+      '',
+      '# Write env file',
+      'mkdir -p ~/.agenticmail',
+      `cat > ~/.agenticmail/worker.env << 'ENVEOF'`,
+      `ENTERPRISE_URL=${enterpriseUrl}`,
+      `WORKER_NODE_ID=${nodeId}`,
+      `WORKER_NAME="${body.name || nodeId}"`,
+      `DATABASE_URL=${dbUrl}`,
+      `PORT=${body.port || 3101}`,
+      'LOG_LEVEL=warn',
+      'ENVEOF',
+      '',
+      '# Start agents via PM2',
+      ...(body.agentIds || []).map((id: string, i: number) =>
+        `pm2 start "$(which agenticmail-enterprise || echo npx @agenticmail/enterprise) agent --id ${id}" --name "agent-${i}" --env ~/.agenticmail/worker.env`
+      ),
+      'pm2 save',
+      'echo "DEPLOY_SUCCESS"',
+    ].join('\n');
+
+    const { execSync } = await import('child_process');
+    const sshTarget = `${body.user || 'root'}@${body.host}`;
+    const keyOpt = body.privateKey ? `-i /tmp/_am_ssh_key_${Date.now()}` : '';
+
+    if (body.privateKey) {
+      const { writeFileSync, chmodSync } = await import('fs');
+      const keyPath = `/tmp/_am_ssh_key_${Date.now()}`;
+      writeFileSync(keyPath, body.privateKey, { mode: 0o600 });
+    }
+
+    const scriptB64 = Buffer.from(script).toString('base64');
+    const sshCmd = `ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 ${keyOpt} ${sshTarget} "echo '${scriptB64}' | base64 -d | bash"`;
+
+    // Run async — don't block the request
+    const { exec } = await import('child_process');
+    exec(sshCmd, { timeout: 120_000 }, (err, stdout, _stderr) => {
+      if (err) {
+        console.warn(`[cluster] SSH deploy to ${body.host} failed:`, err.message);
+      } else if (stdout.includes('DEPLOY_SUCCESS')) {
+        console.log(`[cluster] SSH deploy to ${body.host} succeeded`);
+      }
+    });
+
+    return c.json({ message: 'Deployment started via SSH to ' + sshTarget + '. Check the Cluster page for the node to appear.', nodeId });
+  } catch (e: any) {
+    return c.json({ error: 'SSH deploy failed: ' + e.message }, 500);
+  }
+});
+
+engine.post('/cluster/nodes/:nodeId/restart', async (c) => {
+  const node = cluster.getNode(c.req.param('nodeId'));
+  if (!node) return c.json({ error: 'Node not found' }, 404);
+  try {
+    const ctrl = new AbortController();
+    setTimeout(() => ctrl.abort(), 10000);
+    await fetch(`${node.url}/restart`, { method: 'POST', signal: ctrl.signal }).catch(() => {});
+    return c.json({ ok: true, message: 'Restart signal sent to ' + node.name });
+  } catch (e: any) {
+    return c.json({ error: e.message }, 500);
+  }
+});
+
 engine.get('/cluster/stream', (c) => {
   const stream = new ReadableStream({
     start(controller) {
@@ -350,7 +468,7 @@ engine.get('/cluster/stream', (c) => {
       const send = (d: string) => { try { controller.enqueue(encoder.encode(`data: ${d}\n\n`)); } catch { unsub(); } };
       // Send current state
       for (const n of cluster.getAllNodes()) send(JSON.stringify({ type: 'node', event: 'snapshot', ...n }));
-      const unsub = cluster.subscribe((nodeId, node, event) => send(JSON.stringify({ type: 'node', event, ...node })));
+      const unsub = cluster.subscribe((_nodeId, node, event) => send(JSON.stringify({ type: 'node', event, ...node })));
       const hb = setInterval(() => send(JSON.stringify({ type: 'heartbeat' })), 30_000);
       c.req.raw.signal.addEventListener('abort', () => { unsub(); clearInterval(hb); });
     },

package/src/engine/skills.ts

@@ -575,7 +575,7 @@ export class PermissionEngine {
     return this._checkApproval(profile, toolId, tool);
   }
 
-  private _checkApproval(profile: AgentPermissionProfile, toolId: string, tool?: ToolDefinition): PermissionResult {
+  private _checkApproval(profile: AgentPermissionProfile, _toolId: string, tool?: ToolDefinition): PermissionResult {
     if (!profile.requireApproval.enabled) {
       return { allowed: true, reason: 'Permitted', requiresApproval: false };
     }

package/src/engine/tool-catalog.ts

@@ -11,7 +11,7 @@
  */
 
 import type { ToolDefinition, SkillCategory, RiskLevel, SideEffect } from './skills.js';
-import { M365_TOOLS as M365_SKILL_TOOLS, GWS_TOOLS as GWS_SKILL_TOOLS, ENTERPRISE_UTILITY_TOOLS, AGENTICMAIL_TOOLS as AGENTICMAIL_SKILL_TOOLS, SYSTEM_TOOLS } from './skills/index.js';
+import { M365_TOOLS as M365_SKILL_TOOLS, GWS_TOOLS as GWS_SKILL_TOOLS, ENTERPRISE_UTILITY_TOOLS, AGENTICMAIL_TOOLS as _AGENTICMAIL_SKILL_TOOLS, SYSTEM_TOOLS } from './skills/index.js';
 
 // ─── Core Platform Tools ────────────────────────────────
 

package/src/engine/vault-routes.ts

@@ -7,7 +7,7 @@ import { Hono } from 'hono';
 import type { SecureVault } from './vault.js';
 import type { DLPEngine } from './dlp.js';
 
-export function createVaultRoutes(vault: SecureVault, dlp?: DLPEngine) {
+export function createVaultRoutes(vault: SecureVault, _dlp?: DLPEngine) {
   const router = new Hono();
 
   // ─── Secrets CRUD ────────────────────────────────────

package/src/engine/vault.ts

@@ -8,7 +8,7 @@
  * Master key from AGENTICMAIL_VAULT_KEY env var.
  */
 
-import { createHash, randomBytes, createCipheriv, createDecipheriv, pbkdf2Sync } from 'crypto';
+import { randomBytes, createCipheriv, createDecipheriv, pbkdf2Sync } from 'crypto';
 import type { EngineDatabase } from './db-adapter.js';
 
 function safeJsonParse(val: string | null | undefined, fallback: any = {}): any {

package/src/mcp/adapters/adp.adapter.ts

@@ -33,7 +33,7 @@ function formatWorker(worker: any): string {
     ? [person.legalName.givenName, person.legalName.familyName1].filter(Boolean).join(' ')
     : '(no name)';
   const email = person.communication?.emails?.[0]?.emailUri || '(no email)';
-  const assignment = worker.workerDates ? '' : '';
+  const _assignment = worker.workerDates ? '' : '';
   const status = worker.workerStatus?.statusCode?.codeValue || 'N/A';
   const id = worker.workerID?.idValue || worker.associateOID || 'N/A';
   return `${name} <${email}> -- Status: ${status} (ID: ${id})`;

package/src/mcp/adapters/auth0.adapter.ts

@@ -333,7 +333,7 @@ const blockUser: ToolHandler = {
       const baseUrl = auth0Url(ctx);
       const blocked = params.blocked !== false;
 
-      const result = await ctx.apiExecutor.request({
+      const _result = await ctx.apiExecutor.request({
         method: 'PATCH',
         path: undefined,
         url: `${baseUrl}/users/${encodeURIComponent(params.user_id)}`,

package/src/mcp/adapters/clickup.adapter.ts

@@ -64,7 +64,7 @@ const listTasks: ToolHandler = {
       };
       if (params.include_closed) query.include_closed = 'true';
       if (params.statuses?.length) {
-        params.statuses.forEach((s: string, i: number) => {
+        params.statuses.forEach((s: string, _i: number) => {
           query[`statuses[]`] = s; // ClickUp expects repeated params
         });
       }

package/src/mcp/adapters/close.adapter.ts

@@ -32,7 +32,7 @@ function formatLead(lead: any): string {
   const status = lead.status_label || 'unknown';
   const contacts = lead.contacts?.length || 0;
   const created = lead.date_created ? lead.date_created.slice(0, 16) : '';
-  const url = lead.url || '';
+  const _url = lead.url || '';
   return `${name} -- ${status} -- ${contacts} contact(s) -- ${created} (ID: ${lead.id})`;
 }
 

package/src/mcp/adapters/firebase.adapter.ts

@@ -292,7 +292,7 @@ const updateDocument: ToolHandler = {
         }
       }
 
-      const queryParts = updateMaskPaths.map(p => `updateMask.fieldPaths=${encodeURIComponent(p)}`);
+      const _queryParts = updateMaskPaths.map(p => `updateMask.fieldPaths=${encodeURIComponent(p)}`);
       const query: Record<string, string> = {};
       for (const path of updateMaskPaths) {
         query[`updateMask.fieldPaths`] = path;