@hivemagnus/magnus-server 1.1.13 → 2.1.0

package/dist/queue/workers.js

@@ -1,11 +1,11 @@
 import { ResourceLeaseConflict } from '../services/command-resource-leases.js';
-import { securityFusionLocal } from '../services/security-export.js';
 import { recordMonitorPulse } from '../services/monitor-pulse.js';
 import { Queue, Worker } from 'bullmq';
+import { bullQueueIdentity } from './names.js';
+import { assertLiveExecution } from '../config/rehearsal.js';
 import { addDurableJob } from './requeue.js';
 import { validateRemediationCommandForDispatch } from '../services/remediation-service.js';
 import { reconcileCommands } from '../services/command-lifecycle.js';
-import { reconcileRestartVerification } from '../services/security-fusion-verification.js';
 import { getDb } from '../db/index.js';
 import { NodeApiClient } from '../sdk/index.js';
 import { getNodeBaseUrl } from '../utils/node-url.js';
@@ -14,11 +14,10 @@ import { RESULT_SIGNING_PREVIOUS_SECRET, RESULT_SIGNING_SECRET, getNodeManagerSe
 import { safeParse } from '../utils/validate.js';
 import { commandFenceSchema, commandResultSchema } from '../schemas/node-responses.js';
 import { incMetric } from '../routes/metrics.js';
-import { securityFusionActionSources } from '../services/security-fusion-actions.js';
 import { verifyCommandResultSignature } from '../security/command-result-signature.js';
 // ─── Command execution queue ───
 const REDIS_PREFIX = process.env['REDIS_PREFIX'] ?? 'magnus-';
-const COMMAND_QUEUE = `${REDIS_PREFIX}commands`;
+const COMMAND_QUEUE = bullQueueIdentity(REDIS_PREFIX, 'commands');
 const REDIS_URL = process.env['REDIS_URL'] ?? 'redis://127.0.0.1:6379';
 let _commandQueue = null;
 let _commandWorker = null;
@@ -28,8 +27,10 @@ const COMMAND_EXECUTION_LEASE_MS = 5 * 60 * 1_000;
 const NODE_HEARTBEAT_FRESHNESS_MS = Number(process.env['STALE_NODE_THRESHOLD_MS'] ?? 120_000);
 /** Get the singleton command queue instance. */
 export function getCommandQueue() {
+    assertLiveExecution();
     if (!_commandQueue) {
-        _commandQueue = new Queue(COMMAND_QUEUE, {
+        _commandQueue = new Queue(COMMAND_QUEUE.name, {
+            prefix: COMMAND_QUEUE.prefix,
             connection: { url: REDIS_URL },
             defaultJobOptions: {
                 attempts: 1,
@@ -69,64 +70,12 @@ export async function enqueueCommand(commandId) {
         removeOnFail: { age: 24 * 60 * 60, count: 1_000 },
     });
 }
-/**
- * Verify agent HMAC-SHA256 signature over command result fields.
- * Returns true if valid, false if tampered. Skips if secret is not configured.
- */
-async function recordSecurityFusionCommandResult(commandId, succeeded, detail) {
-    const db = getDb();
-    const outbox = await db.securityFusionCommandOutbox.findUnique({
-        where: { remoteCommandId: commandId },
-    });
-    const action = outbox
-        ? await db.securityFusionAction.findUnique({ where: { id: outbox.actionId } })
-        : null;
-    if (action && outbox) {
-        if (succeeded && action.kind === 'service_restart') {
-            const transitioned = await db.securityFusionAction.updateMany({
-                where: { id: action.id, status: { in: securityFusionActionSources('verifying') } },
-                data: { status: 'verifying', resultJson: JSON.stringify({ commandId, ...detail }) },
-            });
-            if (transitioned.count !== 1)
-                return;
-            await db.securityFusionCaseActivity.create({
-                data: {
-                    caseId: action.caseId,
-                    kind: 'containment.restart_verifying',
-                    actorId: 'system:command-worker',
-                    detailJson: JSON.stringify({ actionId: action.id, commandId }),
-                },
-            });
-            return;
-        }
-        const releasing = outbox.operation === 'release';
-        const status = succeeded ? (releasing ? 'released' : 'succeeded') : 'failed';
-        const transitioned = await db.securityFusionAction.updateMany({
-            where: {
-                id: action.id,
-                status: {
-                    in: securityFusionActionSources(status),
-                },
-            },
-            data: { status, resultJson: JSON.stringify({ commandId, ...detail }) },
-        });
-        if (transitioned.count !== 1)
-            return;
-        await db.securityFusionCaseActivity.create({
-            data: {
-                caseId: action.caseId,
-                kind: `containment.${status}`,
-                actorId: 'system:command-worker',
-                detailJson: JSON.stringify({ actionId: action.id, commandId, ...detail }),
-            },
-        });
-    }
-}
 /** Start the command execution worker. */
 export function startCommandWorker() {
+    assertLiveExecution();
     if (_commandWorker)
         return _commandWorker;
-    const worker = new Worker(COMMAND_QUEUE, async (job) => {
+    const worker = new Worker(COMMAND_QUEUE.name, async (job) => {
         const db = getDb();
         const { commandId } = job.data;
         const now = new Date();
@@ -241,11 +190,6 @@ export function startCommandWorker() {
             });
             if (!recorded)
                 return;
-            if (securityFusionLocal())
-                await recordSecurityFusionCommandResult(commandId, result.exitCode === 0, {
-                    exitCode: result.exitCode,
-                    durationMs: result.durationMs,
-                });
             // Emit notification on command failure
             if (result.exitCode !== 0) {
                 // Look up node name for the notification
@@ -287,8 +231,6 @@ export function startCommandWorker() {
             });
             if (!failed)
                 throw err;
-            if (securityFusionLocal())
-                await recordSecurityFusionCommandResult(commandId, false, { error: errMsg });
             // Emit notification on worker-level failure
             const node = nodeId ? await db.node.findUnique({
                 where: { id: nodeId },
@@ -308,6 +250,7 @@ export function startCommandWorker() {
     }, {
         connection: { url: REDIS_URL },
         concurrency: 10,
+        prefix: COMMAND_QUEUE.prefix,
     });
     worker.on('failed', (job, err) => {
         console.error(`[CommandWorker] Job ${job?.id} failed:`, err.message);
@@ -321,8 +264,6 @@ export function startCommandWorker() {
         reconciliationBusy = true;
         try {
             await reconcileCommands();
-            if (securityFusionLocal())
-                await reconcileRestartVerification();
             recordMonitorPulse('commands');
         }
         catch {

package/dist/routes/assistant.js

@@ -24,13 +24,25 @@ import { Hono } from 'hono';
 import { streamSSE } from 'hono/streaming';
 import { authMiddleware, requireRole } from '../middleware/auth.js';
 import { HttpError } from '../middleware/error-handler.js';
-import { chat, chatStream, listConversations, getConversationMessages, getUnreadAiMessageCount, markAiMessagesRead, markConversationRead, archiveConversation, deleteConversation, getHeartbeatPrompt, updateHeartbeatPrompt, resetHeartbeatPrompt, listOllamaModels, getModelContextLength, getAiSettings, updateAiSettings, getModelProfiles, updateModelProfiles, approveToolCall, rejectToolCall, createConversationShare, forkConversation, getSharedConversation, } from '../services/ai-assistant-service.js';
+import { clientErrorMessage } from '../utils/safe-errors.js';
+import { chat, chatStream, listConversations, getConversationMessages, getUnreadAiMessageCount, markAiMessagesRead, markConversationRead, archiveConversation, deleteConversation, getHeartbeatPrompt, updateHeartbeatPrompt, resetHeartbeatPrompt, listOllamaModels, getModelContextLength, getAiSettings, updateAiSettings, getModelProfiles, updateModelProfiles, approveToolCall, rejectToolCall, createConversationShare, forkConversation, getSharedConversation, conversationOwners, getConversationAccess, } from '../services/ai-assistant-service.js';
 import { executeAiTool } from '../services/ai-tools.js';
 import { generateInsights, listPinnedInsights, pinInsight, unpinInsight } from '../services/ai-insights-service.js';
 import { exportConversation } from '../services/ai-export-service.js';
 import { clearScratchpad, listScratchpadEntries } from '../services/ai-scratchpad-service.js';
 export const assistantRouter = new Hono();
 assistantRouter.use('*', authMiddleware);
+const ownersOf = (c) => conversationOwners(c.get('user'));
+/**
+ * A conversation belongs to whoever started it. ADMIN gets no exception, because no
+ * console feature reads other people's conversations. Someone else's answers 404,
+ * so a caller cannot tell it exists.
+ */
+async function requireConversation(c, id, level = 'own') {
+    const access = await getConversationAccess(id, ownersOf(c));
+    if (!access || (level === 'own' && access !== 'owner'))
+        throw new HttpError(404, 'NOT_FOUND', 'Conversation not found');
+}
 // ── Send a chat message ──
 assistantRouter.post('/chat', requireRole('ADMIN', 'OPERATOR'), async (c) => {
     const body = await c.req.json();
@@ -44,6 +56,8 @@ assistantRouter.post('/chat', requireRole('ADMIN', 'OPERATOR'), async (c) => {
         ctxParts.push(`You are the AI assistant for the "${body.controlNodeName}" Control Node (ID: ${body.controlNodeId ?? 'unknown'}). All fleet data you access is from this control node's database. When the user asks about "the fleet" or "nodes", they mean the nodes managed by this control node. Your tools (like getFleetStatus, getNodeHealth, etc.) query this control node's data directly — they do NOT require a fleet ID parameter.`);
         controllerContext = ctxParts.join('\n');
     }
+    if (body.conversationId)
+        await requireConversation(c, body.conversationId);
     const user = c.get('user');
     const result = await chat({
         message: body.message,
@@ -67,28 +81,23 @@ assistantRouter.get('/conversations', async (c) => {
         status: c.req.query('status') ?? 'active',
         page: parseInt(c.req.query('page') ?? '1', 10),
         pageSize: parseInt(c.req.query('pageSize') ?? '20', 10),
+        owners: ownersOf(c),
     });
     return c.json({ success: true, data: result });
 });
 // ── Get conversation messages ──
 assistantRouter.get('/conversations/:id', async (c) => {
     const id = c.req.param('id');
+    await requireConversation(c, id, 'read');
     const result = await getConversationMessages(id, {
         page: parseInt(c.req.query('page') ?? '1', 10),
         pageSize: parseInt(c.req.query('pageSize') ?? '50', 10),
     });
-    if (result.total === 0) {
-        // Check if conversation exists
-        const { getDb } = await import('../db/index.js');
-        const db = getDb();
-        const conv = await db.aiConversation.findUnique({ where: { id } });
-        if (!conv)
-            throw new HttpError(404, 'NOT_FOUND', 'Conversation not found');
-    }
     return c.json({ success: true, data: result });
 });
 assistantRouter.post('/conversations/:id/fork', requireRole('ADMIN', 'OPERATOR'), async (c) => {
     const id = c.req.param('id');
+    await requireConversation(c, id, 'read');
     const body = (await c.req.json().catch(() => ({})));
     const user = c.get('user');
     try {
@@ -107,6 +116,7 @@ assistantRouter.post('/conversations/:id/fork', requireRole('ADMIN', 'OPERATOR')
 });
 assistantRouter.post('/conversations/:id/share', requireRole('ADMIN', 'OPERATOR'), async (c) => {
     const id = c.req.param('id');
+    await requireConversation(c, id);
     const body = (await c.req.json().catch(() => ({})));
     const user = c.get('user');
     try {
@@ -123,6 +133,7 @@ assistantRouter.post('/conversations/:id/share', requireRole('ADMIN', 'OPERATOR'
     }
 });
 assistantRouter.get('/conversations/:id/scratchpad', async (c) => {
+    await requireConversation(c, c.req.param('id'), 'read');
     const entries = listScratchpadEntries(c.req.param('id')).map((entry) => ({
         name: entry.name,
         source: entry.source,
@@ -134,6 +145,7 @@ assistantRouter.get('/conversations/:id/scratchpad', async (c) => {
     return c.json({ success: true, data: { entries } });
 });
 assistantRouter.delete('/conversations/:id/scratchpad', requireRole('ADMIN', 'OPERATOR'), async (c) => {
+    await requireConversation(c, c.req.param('id'));
     clearScratchpad(c.req.param('id'));
     return c.json({ success: true });
 });
@@ -147,12 +159,14 @@ assistantRouter.get('/shares/:token', async (c) => {
 // ── Mark conversation as read ──
 assistantRouter.post('/conversations/:id/read', async (c) => {
     const id = c.req.param('id');
+    await requireConversation(c, id, 'read');
     const count = await markConversationRead(id);
     return c.json({ success: true, data: { marked: count } });
 });
 // ── Archive a conversation ──
 assistantRouter.post('/conversations/:id/archive', requireRole('ADMIN', 'OPERATOR'), async (c) => {
     const id = c.req.param('id');
+    await requireConversation(c, id);
     try {
         await archiveConversation(id);
         return c.json({ success: true });
@@ -163,7 +177,7 @@ assistantRouter.post('/conversations/:id/archive', requireRole('ADMIN', 'OPERATO
 });
 // ── Get unread message count ──
 assistantRouter.get('/unread', async (c) => {
-    const count = await getUnreadAiMessageCount();
+    const count = await getUnreadAiMessageCount(ownersOf(c));
     return c.json({ success: true, data: { unread: count } });
 });
 // ── Mark specific messages as read ──
@@ -172,12 +186,13 @@ assistantRouter.post('/messages/read', async (c) => {
     if (!body.messageIds?.length) {
         throw new HttpError(400, 'VALIDATION_ERROR', 'messageIds array is required');
     }
-    const count = await markAiMessagesRead(body.messageIds);
+    const count = await markAiMessagesRead(body.messageIds, ownersOf(c));
     return c.json({ success: true, data: { marked: count } });
 });
 // ── Delete a conversation permanently ──
 assistantRouter.delete('/conversations/:id', requireRole('ADMIN', 'OPERATOR'), async (c) => {
     const id = c.req.param('id');
+    await requireConversation(c, id);
     try {
         await deleteConversation(id);
         return c.json({ success: true });
@@ -236,6 +251,8 @@ assistantRouter.post('/chat/stream', requireRole('ADMIN', 'OPERATOR'), async (c)
         ctxParts.push(`You are the AI assistant for the "${body.controlNodeName}" Control Node (ID: ${body.controlNodeId ?? 'unknown'}).`);
         controllerContext = ctxParts.join('\n');
     }
+    if (body.conversationId)
+        await requireConversation(c, body.conversationId);
     const user = c.get('user');
     return streamSSE(c, async (stream) => {
         try {
@@ -261,7 +278,7 @@ assistantRouter.post('/chat/stream', requireRole('ADMIN', 'OPERATOR'), async (c)
         catch (err) {
             await stream.writeSSE({
                 event: 'error',
-                data: JSON.stringify({ type: 'error', error: err instanceof Error ? err.message : 'Stream failed' }),
+                data: JSON.stringify({ type: 'error', error: clientErrorMessage(err, 'Stream failed') }),
             });
         }
     });
@@ -352,6 +369,7 @@ assistantRouter.post('/messages/:id/confirm', requireRole('ADMIN', 'OPERATOR'),
 // ── Conversation export ──
 assistantRouter.get('/conversations/:id/export', async (c) => {
     const id = c.req.param('id');
+    await requireConversation(c, id, 'read');
     const format = (c.req.query('format') ?? 'markdown');
     if (!['markdown', 'json', 'csv'].includes(format)) {
         throw new HttpError(400, 'VALIDATION_ERROR', 'format must be markdown, json, or csv');

package/dist/routes/cindertrace-response.js

@@ -0,0 +1,183 @@
+import { bridgeSignature, equalSignature } from '../security/cindertrace-response.js';
+import { createHash } from 'node:crypto';
+import { Hono } from 'hono';
+import { responseRequestSchema } from '@hivemagnus/magnus-contracts';
+import { getDb } from '../db/index.js';
+import { NodeApiClient } from '../sdk/node-api-client.js';
+import { getNodeBaseUrl } from '../utils/node-url.js';
+import { getNodeManagerSecret } from '../utils/env.js';
+import { HttpError } from '../middleware/error-handler.js';
+import { logAuditEvent } from '../services/audit-service.js';
+export const cindertraceResponseRouter = new Hono();
+function secret() {
+    const value = process.env['CINDERTRACE_RESPONSE_SECRET'] ?? '';
+    if (value.length < 32 ||
+        value === process.env['API_SECRET'] ||
+        value === process.env['NODE_MANAGER_SECRET'])
+        throw new HttpError(503, 'RESPONSE_DISABLED', 'Dedicated Cindertrace response credential is required');
+    return value;
+}
+cindertraceResponseRouter.use('*', async (c, next) => {
+    const timestamp = c.req.header('x-cindertrace-time') ?? '', nonce = c.req.header('x-cindertrace-nonce') ?? '';
+    if (!/^\d{13}$/.test(timestamp) ||
+        Math.abs(Date.now() - Number(timestamp)) > 60000 ||
+        !/^[a-f0-9]{32}$/.test(nonce))
+        throw new HttpError(401, 'UNAUTHORIZED', 'Invalid response request');
+    const raw = c.req.method === 'GET' ? '' : await c.req.text();
+    if (Buffer.byteLength(raw) > 16384 ||
+        !equalSignature(c.req.header('x-cindertrace-signature') ?? '', bridgeSignature(secret(), c.req.method, c.req.path, timestamp, nonce, raw)))
+        throw new HttpError(401, 'UNAUTHORIZED', 'Invalid response request');
+    await next();
+    // Sign the exact response body and bind it to this request; no source output or credentials are returned.
+    const text = await c.res.clone().text();
+    c.header('x-cindertrace-signature', bridgeSignature(secret(), 'RESPONSE', c.req.path, timestamp, nonce, text));
+    c.header('Cache-Control', 'no-store');
+});
+async function client(nodeId) {
+    const node = await getDb().node.findUnique({ where: { id: nodeId } });
+    if (!node)
+        throw new HttpError(404, 'TARGET_NOT_FOUND', 'Target is unavailable');
+    return {
+        node,
+        api: new NodeApiClient({
+            baseUrl: getNodeBaseUrl(node.ipAddress, node.port),
+            nodeToken: getNodeManagerSecret(),
+            resourceNodeId: node.id,
+            resourceActorId: 'service:cindertrace',
+        }),
+    };
+}
+cindertraceResponseRouter.get('/targets/:id/health', async (c) => {
+    const { api } = await client(c.req.param('id'));
+    const health = await api.collectHealth();
+    return c.json({
+        data: {
+            services: health.data?.services ?? [],
+            wazuh: health.data?.wazuh,
+            responseCapable: await api.securityResponseCapable(),
+        },
+    });
+});
+export function validateResponsePolicy(p, node) {
+    if (p.operation === 'release')
+        return;
+    if (node.status !== 'ONLINE' ||
+        !node.lastHeartbeatAt ||
+        Date.now() - node.lastHeartbeatAt.getTime() > 120000)
+        throw new HttpError(409, 'TARGET_STALE', 'A fresh online target is required');
+    if (p.kind === 'service_restart') {
+        const allowed = (process.env['CINDERTRACE_RESTART_ALLOWLIST'] ?? '')
+            .split(',')
+            .map((x) => x.trim());
+        if (!p.serviceName || !allowed.includes(p.serviceName))
+            throw new HttpError(403, 'RESTART_BLOCKED', 'Service must be explicitly allowlisted');
+    }
+    else {
+        const tags = JSON.parse(node.tags), metadata = JSON.parse(node.metadata);
+        const protectedIds = (process.env['CINDERTRACE_PROTECTED_TARGET_IDS'] ?? '').split(',');
+        if (protectedIds.includes(node.id) ||
+            tags.some((x) => ['control-plane', 'network-infrastructure'].includes(x)) ||
+            metadata['securityIsolationPolicy'] !== 'allow' ||
+            metadata['securityIsolationCapable'] !== true ||
+            metadata['securityAegisChannelVerified'] !== true)
+            throw new HttpError(403, 'ISOLATION_BLOCKED', 'Explicit isolation policy, capability, and verified recovery channel are required');
+    }
+}
+cindertraceResponseRouter.post('/execute', async (c) => {
+    const parsed = responseRequestSchema.safeParse(await c.req.json());
+    if (!parsed.success)
+        throw new HttpError(400, 'INVALID_RESPONSE', 'Malformed response plan');
+    const p = parsed.data, raw = JSON.stringify(p), hash = createHash('sha256').update(raw).digest('hex');
+    const db = getDb();
+    const prior = await db.cindertraceResponse.findUnique({ where: { id: p.executionId } });
+    if (prior) {
+        if (prior.requestSha256 !== hash)
+            throw new HttpError(409, 'RESPONSE_CONFLICT', 'Execution identity is bound to another plan');
+        if (prior.status !== 'completed' || !prior.responseJson)
+            throw new HttpError(409, 'RESPONSE_UNKNOWN', 'Inspect the original execution; do not replay it');
+        return c.json(JSON.parse(prior.responseJson));
+    }
+    if (p.expiresAt <= Date.now() || p.expiresAt > Date.now() + 600000)
+        throw new HttpError(409, 'APPROVAL_EXPIRED', 'Approval is expired or outside its maximum lifetime');
+    const { node, api } = await client(p.nodeId);
+    validateResponsePolicy(p, node);
+    if (p.operation === 'release') {
+        const original = await db.cindertraceResponse.findUnique({
+            where: { actionOperation: `${p.actionId}:execute` },
+        });
+        if (!original ||
+            original.nodeId !== p.nodeId ||
+            JSON.parse(original.requestJson).kind !== 'host_isolation')
+            throw new HttpError(409, 'RELEASE_UNBOUND', 'Release requires an existing isolation execution on this target');
+    }
+    try {
+        await db.cindertraceResponse.create({
+            data: {
+                id: p.executionId,
+                actionOperation: `${p.actionId}:${p.operation}`,
+                nodeId: p.nodeId,
+                requestSha256: hash,
+                requestJson: raw,
+            },
+        });
+    }
+    catch (error) {
+        if (error.code === 'P2002')
+            throw new HttpError(409, 'RESPONSE_ALREADY_CLAIMED', 'Action operation already has an owner');
+        throw error;
+    }
+    await logAuditEvent({
+        action: 'cindertrace.response_claimed',
+        actorId: p.approvedBy,
+        targetType: 'node',
+        targetId: p.nodeId,
+        details: {
+            actionId: p.actionId,
+            executionId: p.executionId,
+            planSha256: p.planSha256,
+            operation: p.operation,
+        },
+    });
+    try {
+        const result = await api.securityResponse({
+            operation: p.operation,
+            kind: p.kind,
+            serviceName: p.serviceName,
+            isolationMinutes: p.isolationMinutes,
+        }, p.executionId);
+        if (!result.response.success || !Number.isInteger(result.response.data?.exitCode))
+            throw new Error('Response failed');
+        const reply = {
+            commandId: p.executionId,
+            actionId: p.actionId,
+            nodeId: p.nodeId,
+            operation: p.operation,
+            planSha256: p.planSha256,
+            exitCode: result.response.data.exitCode,
+            receiptSha256: result.evidence.receiptSha256,
+        };
+        await db.cindertraceResponse.update({
+            where: { id: p.executionId },
+            data: { status: 'completed', responseJson: JSON.stringify(reply) },
+        });
+        return c.json(reply);
+    }
+    catch {
+        await db.cindertraceResponse.update({
+            where: { id: p.executionId },
+            data: { status: 'unknown' },
+        });
+        throw new HttpError(409, 'RESPONSE_UNKNOWN', 'No verified completion; inspect the original execution');
+    }
+});
+cindertraceResponseRouter.get('/:id', async (c) => {
+    const row = await getDb().cindertraceResponse.findUnique({ where: { id: c.req.param('id') } });
+    if (!row)
+        throw new HttpError(404, 'NOT_FOUND', 'Execution is unavailable');
+    return c.json({
+        executionId: row.id,
+        status: row.status,
+        result: row.responseJson ? JSON.parse(row.responseJson) : null,
+    });
+});
+//# sourceMappingURL=cindertrace-response.js.map

package/dist/routes/console.js

@@ -0,0 +1,33 @@
+import { Hono } from 'hono';
+import { authMiddleware, getUser } from '../middleware/auth.js';
+import { AGENT_VERSION, CONTROL_API_VERSION } from '../config/version.js';
+import { featureFlags } from '../config/features.js';
+import { securityConsoleUrl } from '../services/security-export.js';
+export const consoleRouter = new Hono();
+consoleRouter.use('*', authMiddleware);
+/**
+ * GET /console/session
+ * What a browser console may show this caller. A static page has no server of its
+ * own to read the environment, so this answers what the dashboard derives from
+ * server-side checks and build-time public values.
+ */
+consoleRouter.get('/session', (c) => {
+    const user = getUser(c);
+    c.header('Cache-Control', 'no-store');
+    return c.json({
+        success: true,
+        data: {
+            userId: user.userId,
+            role: user.role,
+            capabilities: {
+                hermes: featureFlags().hermes,
+                // Whether to offer the terminal. The gateway still verifies everything, including step-up.
+                terminal: featureFlags().fleetGateway && user.terminal === true,
+                agentVersion: AGENT_VERSION,
+                magnusVersion: CONTROL_API_VERSION,
+                securityConsoleUrl: securityConsoleUrl() ?? null,
+            },
+        },
+    });
+});
+//# sourceMappingURL=console.js.map

package/dist/routes/cron.js

@@ -2,6 +2,7 @@ import { managedCronRouter } from './managed-cron.js';
 import { canStageLegacyCronForEnrollment, cronMutationMode, finalizeManagedCronRevocation, installManagedCron, registerManagedCron, reconcileForeignSchedulerSource, revokeManagedCron, stageLegacyCronForEnrollment, updateAndRegisterManagedCron } from '../services/managed-cron.js';
 import { managedCronRegistrationSchema, schedulerSourceSettlementSchema } from '../schemas/managed-cron.js';
 import { Hono } from 'hono';
+import { cronJobForRole, mergeEnvironmentEdit, nodeForRole } from '../services/secret-views.js';
 import { getDb } from '../db/index.js';
 import { authMiddleware, getUser, requireRole } from '../middleware/auth.js';
 import { logAuditEvent, sanitizeDetails } from '../services/audit-service.js';
@@ -68,7 +69,8 @@ cronRouter.get('/', async (c) => {
         orderBy: { name: 'asc' },
         include: { node: { select: { name: true } } },
     });
-    return c.json({ success: true, data: jobs });
+    const viewer = getUser(c).role;
+    return c.json({ success: true, data: jobs.map((job) => cronJobForRole(job, viewer)) });
 });
 // ── Get single cron job ──
 cronRouter.get('/:cronId', async (c) => {
@@ -79,7 +81,7 @@ cronRouter.get('/:cronId', async (c) => {
     });
     if (!job)
         throw new HttpError(404, 'NOT_FOUND', 'Cron job not found');
-    return c.json({ success: true, data: job });
+    return c.json({ success: true, data: cronJobForRole(job, getUser(c).role) });
 });
 // ── Create cron job ──
 cronRouter.post('/', requireRole('ADMIN', 'OPERATOR'), async (c) => {
@@ -136,7 +138,7 @@ cronRouter.post('/', requireRole('ADMIN', 'OPERATOR'), async (c) => {
             timeoutSeconds: body.timeoutSeconds ?? 600,
         });
     }
-    return c.json({ success: true, data: job }, 201);
+    return c.json({ success: true, data: cronJobForRole(job, user.role) }, 201);
 });
 cronRouter.post('/scheduler-sources/reconcile', requireRole('ADMIN'), async (c) => {
     const assertion = await parseBody(c, schedulerSourceSettlementSchema);
@@ -209,7 +211,7 @@ cronRouter.patch('/:cronId', requireRole('ADMIN', 'OPERATOR'), async (c) => {
         ...(body.command && { command: body.command }),
         ...(body.args && { args: JSON.stringify(body.args) }),
         ...(body.workingDirectory !== undefined && { workingDirectory: body.workingDirectory }),
-        ...(body.environment !== undefined && { environment: JSON.stringify(sanitizeDetails(body.environment)) }),
+        ...(body.environment !== undefined && { environment: JSON.stringify(sanitizeDetails(user.role === 'ADMIN' ? body.environment : mergeEnvironmentEdit(initial.environment, body.environment))) }),
         ...(nextStatus && { status: nextStatus }),
         ...(body.timeoutSeconds && { timeoutSeconds: body.timeoutSeconds }),
     };
@@ -245,7 +247,8 @@ cronRouter.patch('/:cronId', requireRole('ADMIN', 'OPERATOR'), async (c) => {
                 timeoutSeconds: job.timeoutSeconds,
             });
         })();
-    return c.json({ success: true, data: job });
+    // The agent connection above needs the node; its token must never leave the server.
+    return c.json({ success: true, data: { ...cronJobForRole(job, user.role), node: nodeForRole(job.node, user.role) } });
 });
 // ── Delete cron job ──
 cronRouter.delete('/:cronId', requireRole('ADMIN', 'OPERATOR'), async (c) => {

package/dist/routes/events-stream.js

@@ -1,5 +1,6 @@
 import { Hono } from 'hono';
 import { authMiddleware } from '../middleware/auth.js';
+import { watchOathweaveStream } from '../middleware/oathweave.js';
 import { eventBus } from '../services/event-bus.js';
 export const eventsStreamRouter = new Hono();
 eventsStreamRouter.use('*', authMiddleware);
@@ -19,10 +20,12 @@ eventsStreamRouter.get('/', async (c) => {
     let keepAlive;
     let unsubscribe;
     let closed = false;
+    let stopWatching;
     // Idempotent cleanup for every exit path: client abort, stream cancel, or a
     // disconnect that happened while the subscription was still being set up.
     const cleanup = () => {
         closed = true;
+        stopWatching?.();
         if (keepAlive)
             clearInterval(keepAlive);
         keepAlive = undefined;
@@ -42,6 +45,13 @@ eventsStreamRouter.get('/', async (c) => {
                     // Stream closed
                 }
             };
+            stopWatching = watchOathweaveStream(c.req.header('Authorization'), () => {
+                cleanup();
+                try {
+                    controller.close();
+                }
+                catch { /* already closed */ }
+            });
             // Send initial connection event
             send('connected', { timestamp: new Date().toISOString() });
             // Keep-alive every 30s

package/dist/routes/files.js

@@ -1,3 +1,4 @@
+import { clientErrorMessage } from '../utils/safe-errors.js';
 import { Hono } from 'hono';
 import { getDb } from '../db/index.js';
 import { authMiddleware, getUser, requireRole } from '../middleware/auth.js';
@@ -133,7 +134,7 @@ filesRouter.post('/update', requireRole('ADMIN', 'OPERATOR'), async (c) => {
             return { ...task, status: 'completed' };
         }
         catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
+            const message = clientErrorMessage(err, 'File update failed');
             await db.filePatchTask.update({
                 where: { id: task.id },
                 data: { status: 'failed', error: message },