@hivemagnus/magnus-server 1.1.13 → 2.1.0

package/dist/routes/fleet-gateway.js

@@ -0,0 +1,69 @@
+import { createHash } from 'node:crypto';
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { getDb } from '../db/index.js';
+import { HttpError } from '../middleware/error-handler.js';
+import { parseBody } from '../utils/validate.js';
+import { safeEqual } from '../utils/safe-equal.js';
+import { logAuditEvent } from '../services/audit-service.js';
+/**
+ * Machine routes for the fleet gateway, the separate service that holds the restricted SSH key.
+ * The gateway asks what a node is and records what happened. Nothing here dials a node.
+ */
+export const fleetGatewayRouter = new Hono();
+async function requireGatewayCredential(c, next) {
+    const expected = process.env['FLEET_GATEWAY_TOKEN_SHA256'] ?? '';
+    const token = c.req.header('x-fleet-gateway-token') ?? '';
+    if (!expected || !token || !safeEqual(createHash('sha256').update(token).digest('hex'), expected))
+        throw new HttpError(401, 'UNAUTHORIZED', 'Fleet gateway credential required');
+    await next();
+}
+fleetGatewayRouter.use('*', requireGatewayCredential);
+const nodeId = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/);
+/** POST /fleet-gateway/target: inventory facts for one node. The gateway applies its own host-key approval. */
+fleetGatewayRouter.post('/target', async (c) => {
+    const body = await parseBody(c, z.object({ nodeId }).strict());
+    const node = await getDb().node.findUnique({
+        where: { id: body.nodeId },
+        select: { id: true, hostname: true, ipAddress: true, status: true },
+    });
+    if (!node)
+        throw new HttpError(404, 'NODE_NOT_FOUND', 'Node not found');
+    c.header('Cache-Control', 'no-store');
+    return c.json({ success: true, data: { nodeId: node.id, hostname: node.hostname, ipAddress: node.ipAddress, status: node.status } });
+});
+const auditSchema = z.object({
+    action: z.enum(['terminal.session.open', 'terminal.session.close', 'terminal.session.refuse', 'terminal.host-key.approve', 'terminal.host-key.remove']),
+    subject: z.string().min(1).max(256),
+    actorId: z.string().min(1).max(256),
+    nodeId: nodeId.nullable(),
+    sessionId: z.string().regex(/^ts_[A-Za-z0-9_-]{43}$/).nullable(),
+    outcome: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9:._/-]{0,199}$/),
+    at: z.iso.datetime(),
+    durationMs: z.number().int().nonnegative().nullable(),
+    ipAddress: z.union([z.ipv4(), z.ipv6()]).nullable(),
+    fingerprint: z.string().regex(/^SHA256:[A-Za-z0-9+/]{43}$/).nullable(),
+}).strict();
+/** POST /fleet-gateway/audit: terminal metadata. The schema has no field for terminal input or output. */
+fleetGatewayRouter.post('/audit', async (c) => {
+    const event = await parseBody(c, auditSchema);
+    await logAuditEvent({
+        action: event.action,
+        actorId: event.actorId,
+        actorType: 'user',
+        targetType: 'node',
+        targetId: event.nodeId ?? 'unspecified',
+        ipAddress: event.ipAddress,
+        details: {
+            subject: event.subject,
+            sessionHandle: event.sessionId,
+            outcome: event.outcome,
+            observedAt: event.at,
+            durationMs: event.durationMs,
+            hostKeyFingerprint: event.fingerprint,
+        },
+    });
+    c.header('Cache-Control', 'no-store');
+    return c.json({ success: true, data: { recorded: true } });
+});
+//# sourceMappingURL=fleet-gateway.js.map

package/dist/routes/heartbeat.js

@@ -1,4 +1,4 @@
-import { enqueueSecurityObservations, securityFusionLocal } from '../services/security-export.js';
+import { enqueueSecurityObservations } from '../services/security-export.js';
 import { warnOnAgentVersionMismatch } from '../services/agent-version-warnings.js';
 import { recordSelfUpgradeReport } from '../services/agent-upgrade-service.js';
 import { Hono } from 'hono';
@@ -22,7 +22,6 @@ import { heartbeatHealthSchema } from '../schemas/node-responses.js';
 import { normalizeIpAddress, isLoopbackOrUnroutableIp, isUsableNodeIp } from '../utils/ip.js';
 import { AGENT_VERSION } from '../config/version.js';
 import { getHeartbeatStreamStats } from '../services/heartbeat-stream.js';
-import { ingestMagnusServiceHealth } from '../services/security-fusion-service.js';
 import { deriveAgentCertificateHostname, selectAgentEndpointHostname, verifyAgentCertificateHostname, } from '../utils/node-url.js';
 import { heartbeatPeerAddress } from '../utils/heartbeat-peer.js';
 import { authMiddleware } from '../middleware/auth.js';
@@ -490,10 +489,6 @@ heartbeatRouter.post('/', async (c) => {
                 await enqueueSecurityObservations(tx, nodeId, existing?.name ?? fqdn ?? nodeId, (h.services ?? []), snapshot.id, snapshot.timestamp);
                 return snapshot;
             });
-            if (securityFusionLocal())
-                void ingestMagnusServiceHealth(nodeId, existing?.name ?? fqdn ?? nodeId, (h.services ?? [])).catch((err) => {
-                    console.error(`[security-fusion] heartbeat conversion failed for ${nodeId}:`, err instanceof Error ? err.message : err);
-                });
             // Evaluate health against alert rules (fire-and-forget)
             const alertNodeName = existing?.name ?? fqdn ?? nodeId;
             evaluateHealth(nodeId, alertNodeName, {

package/dist/routes/hermes.js

@@ -1,5 +1,6 @@
 import { Hono } from 'hono';
-import { authMiddleware } from '../middleware/auth.js';
+import { authMiddleware, getUser } from '../middleware/auth.js';
+import { hermesProfileForRole } from '../services/secret-views.js';
 import { HttpError } from '../middleware/error-handler.js';
 import { hermesJobListQuerySchema } from '../schemas/hermes.js';
 import { getHermesApiServerStatus, getHermesInstallation, getHermesJob, listHermesInstallations, listHermesJobs, listHermesProfiles, } from '../services/hermes-service.js';
@@ -13,21 +14,40 @@ function requiredParam(c, name) {
 }
 // Read-only inventory/status endpoints remain available because they use the
 // Control database and never open SSH connections.
-hermesRouter.get('/installations', async (c) => c.json({ success: true, data: await listHermesInstallations() }));
+function installationForRole(installation, role) {
+    return installation.profiles
+        ? { ...installation, profiles: installation.profiles.map((profile) => hermesProfileForRole(profile, role)) }
+        : installation;
+}
+hermesRouter.get('/installations', async (c) => {
+    const role = getUser(c).role;
+    return c.json({ success: true, data: (await listHermesInstallations()).map((installation) => installationForRole(installation, role)) });
+});
 hermesRouter.get('/installations/:id', async (c) => {
     const data = await getHermesInstallation(requiredParam(c, 'id'));
     if (!data)
         throw new HttpError(404, 'NOT_FOUND', 'Hermes installation not found');
-    return c.json({ success: true, data });
+    return c.json({ success: true, data: installationForRole(data, getUser(c).role) });
 });
 hermesRouter.get('/installations/:id/profiles', async (c) => {
     const installation = await getHermesInstallation(requiredParam(c, 'id'));
     if (!installation)
         throw new HttpError(404, 'NOT_FOUND', 'Hermes installation not found');
-    return c.json({ success: true, data: await listHermesProfiles(installation.id) });
+    const role = getUser(c).role;
+    return c.json({ success: true, data: (await listHermesProfiles(installation.id)).map((profile) => hermesProfileForRole(profile, role)) });
+});
+hermesRouter.get('/profiles', async (c) => {
+    const role = getUser(c).role;
+    return c.json({ success: true, data: (await listHermesProfiles()).map((profile) => hermesProfileForRole(profile, role)) });
+});
+hermesRouter.get('/profiles/:id/api-server/status', async (c) => {
+    const { keyFingerprint, ...status } = await getHermesApiServerStatus(requiredParam(c, 'id'));
+    return c.json({ success: true, data: {
+            ...status,
+            ...(getUser(c).role === 'ADMIN' ? { keyFingerprint } : {}),
+            keyConfigured: Boolean(keyFingerprint),
+        } });
 });
-hermesRouter.get('/profiles', async (c) => c.json({ success: true, data: await listHermesProfiles() }));
-hermesRouter.get('/profiles/:id/api-server/status', async (c) => c.json({ success: true, data: await getHermesApiServerStatus(requiredParam(c, 'id')) }));
 hermesRouter.get('/jobs', async (c) => {
     const parsed = hermesJobListQuerySchema.safeParse({
         status: c.req.query('status'),

package/dist/routes/hiveskills.js

@@ -0,0 +1,116 @@
+import { createHash } from 'node:crypto';
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { HiveSkillsTargetPostureSchema, HiveSkillsPublicationSchema } from '@hivemagnus/magnus-contracts';
+import { getDb } from '../db/index.js';
+import { HttpError } from '../middleware/error-handler.js';
+import { safeEqual } from '../utils/safe-equal.js';
+import { getNodeManagerSecret } from '../utils/env.js';
+import { getNodeBaseUrl } from '../utils/node-url.js';
+import { NodeApiClient } from '../sdk/node-api-client.js';
+import { logAuditEvent } from '../services/audit-service.js';
+import { httpIdentity } from '../security/managed-http.js';
+const slug = z.string().regex(/^[a-z0-9][a-z0-9-]{1,62}$/);
+export const skillsExecutorConfig = z.record(slug, z.object({ tokenSha256: z.string().regex(/^[a-f0-9]{64}$/), targets: z.record(slug, z.object({ nodeId: z.string().min(1).max(128), agentTarget: slug }).strict()) }).strict());
+export const skillJobRequest = z.object({ target: slug, publicationSha256: z.string().regex(/^[a-f0-9]{64}$/), manifest: HiveSkillsPublicationSchema, approvedBy: z.string().min(1).max(200) }).strict();
+export const hiveskillsRouter = new Hono();
+function authorize(header) {
+    let raw;
+    try {
+        raw = JSON.parse(process.env['MAGNUS_HIVESKILLS_DEPLOYMENTS_JSON'] ?? '{}');
+    }
+    catch {
+        throw new HttpError(503, 'HIVESKILLS_UNCONFIGURED', 'Invalid Skills executor configuration');
+    }
+    const configured = skillsExecutorConfig.safeParse(raw);
+    if (!configured.success)
+        throw new HttpError(503, 'HIVESKILLS_UNCONFIGURED', 'Invalid Skills executor configuration');
+    if (!header?.startsWith('Bearer ') || header.length < 39 || /[\r\n]/.test(header))
+        throw new HttpError(401, 'UNAUTHORIZED', 'Endpoint-scoped Skills credential required');
+    const digest = createHash('sha256').update(header.slice(7)).digest('hex');
+    for (const [registryId, entry] of Object.entries(configured.data))
+        if (safeEqual(entry.tokenSha256, digest))
+            return { registryId, ...entry };
+    throw new HttpError(401, 'UNAUTHORIZED', 'Endpoint-scoped Skills credential required');
+}
+function commandId(registryId, id) { if (!z.uuid().safeParse(id).success)
+    throw new HttpError(400, 'VALIDATION_ERROR', 'Job UUID required'); return 'hiveskills-' + createHash('sha256').update(registryId + ':' + id).digest('hex'); }
+async function targetClient(registry, target) {
+    const binding = registry.targets[target];
+    if (!binding)
+        throw new HttpError(403, 'FORBIDDEN', 'Target is outside this registry executor grant');
+    const node = await getDb().node.findUnique({ where: { id: binding.nodeId } });
+    if (!node || node.status === 'DECOMMISSIONED')
+        throw new HttpError(409, 'TARGET_UNAVAILABLE', 'Configured target is unavailable');
+    return { binding, node, client: new NodeApiClient({ baseUrl: getNodeBaseUrl(node.ipAddress, node.port), resourceNodeId: node.id, resourceActorId: 'service:hiveskills:' + registry.registryId, nodeToken: getNodeManagerSecret() }) };
+}
+async function observed(registry, target, id) {
+    const { node, client } = await targetClient(registry, target), jobId = commandId(registry.registryId, id);
+    const row = await getDb().remoteCommand.findUnique({ where: { id: jobId } });
+    if (!row)
+        throw new HttpError(404, 'NOT_FOUND', 'Job has not been admitted');
+    if (row.nodeId !== node.id || row.createdBy !== 'service:hiveskills:' + registry.registryId)
+        throw new HttpError(409, 'JOB_BINDING_CONFLICT', 'Job belongs to another target');
+    const lease = await getDb().commandResourceLease.findUnique({ where: { commandId: jobId } });
+    if (!lease)
+        return { jobId, status: 'unknown', result: 'Missing durable ownership; review required' };
+    try {
+        const receipt = await client.getCommandReceipt(jobId, { nodeFqdn: node.hostname, requestSha256: lease.requestSha256 });
+        if (receipt.state === 'completed')
+            return { jobId, status: receipt.result.exitCode === 0 ? 'completed' : 'failed', result: receipt.result.exitCode === 0 ? 'Exact approved publication synchronized' : 'Node completed with a bounded failure' };
+        return { jobId, status: receipt.state === 'running' ? 'running' : 'unknown', result: 'Original operation retained; never replayed' };
+    }
+    catch {
+        return { jobId, status: 'unknown', result: 'Receipt unavailable; original operation retained' };
+    }
+}
+hiveskillsRouter.get('/targets/:target', async (c) => {
+    const registry = authorize(c.req.header('authorization')), target = slug.safeParse(c.req.param('target'));
+    if (!target.success)
+        throw new HttpError(400, 'VALIDATION_ERROR', 'Exact logical target required');
+    const { binding, node, client } = await targetClient(registry, target.data), enrollment = await getDb().resourceEnrollment.findUnique({ where: { nodeId: node.id } });
+    const base = { registryId: registry.registryId, target: target.data, nodeId: node.id, agentTarget: binding.agentTarget };
+    if (enrollment?.state !== 'enrolled' || enrollment.nodeFqdn !== node.hostname || node.status !== 'ONLINE' || !node.lastHeartbeatAt || Date.now() - node.lastHeartbeatAt.getTime() > 120000 || await getDb().commandResourceLease.count({ where: { nodeId: node.id, state: { in: ['reserved', 'running', 'unknown'] } } }))
+        return c.json({ ...base, ready: false, reason: 'Node enrollment, health or retained ownership requires operator review' });
+    try {
+        const reply = await client.hiveSkillsTargetPosture(binding.agentTarget, registry.registryId), posture = HiveSkillsTargetPostureSchema.parse(reply.data);
+        if (!reply.success || posture.registryId !== registry.registryId || posture.target !== binding.agentTarget)
+            throw new Error('Native target binding differs');
+        return c.json({ ...base, ready: posture.ready, reason: posture.reason, configurationSha256: posture.configurationSha256, clientSha256: posture.clientSha256 });
+    }
+    catch {
+        return c.json({ ...base, ready: false, reason: 'Native target posture unavailable' });
+    }
+});
+hiveskillsRouter.get('/jobs/:id', async (c) => { const registry = authorize(c.req.header('authorization')); const target = slug.safeParse(c.req.query('target')); if (!target.success)
+    throw new HttpError(400, 'VALIDATION_ERROR', 'Exact target required'); return c.json(await observed(registry, target.data, c.req.param('id'))); });
+hiveskillsRouter.post('/jobs/:id', async (c) => {
+    const registry = authorize(c.req.header('authorization')), parsed = skillJobRequest.safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success)
+        throw new HttpError(400, 'VALIDATION_ERROR', 'Exact approved Skills publication required');
+    const body = parsed.data, jobId = commandId(registry.registryId, c.req.param('id'));
+    if (createHash('sha256').update(JSON.stringify(body.manifest)).digest('hex') !== body.publicationSha256)
+        throw new HttpError(409, 'PUBLICATION_CONFLICT', 'Publication digest differs');
+    const { binding, node, client } = await targetClient(registry, body.target);
+    const request = { target: binding.agentTarget, registryId: registry.registryId, publicationSha256: body.publicationSha256, manifest: body.manifest };
+    const prior = await getDb().remoteCommand.findUnique({ where: { id: jobId } });
+    if (prior) {
+        const identity = httpIdentity(jobId, 'POST', '/hiveskills/sync', JSON.stringify(request), 120);
+        if (prior.nodeId !== node.id || prior.createdBy !== 'service:hiveskills:' + registry.registryId || prior.command !== identity.command || prior.args !== JSON.stringify(identity.args))
+            throw new HttpError(409, 'JOB_BINDING_CONFLICT', 'Existing job has another target or publication');
+        return c.json(await observed(registry, body.target, c.req.param('id')));
+    }
+    await logAuditEvent({ action: 'skill.push', actorId: 'service:hiveskills:' + registry.registryId, targetType: 'node', targetId: node.id, details: { jobId, target: body.target, publicationSha256: body.publicationSha256, approvedBy: body.approvedBy, outcome: 'requested' } });
+    try {
+        const result = await client.syncHiveSkills(request, jobId);
+        await logAuditEvent({ action: 'skill.push', actorId: 'service:hiveskills:' + registry.registryId, targetType: 'node', targetId: node.id, details: { jobId, target: body.target, publicationSha256: body.publicationSha256, approvedBy: body.approvedBy, commandSha256: result.evidence.commandSha256 } });
+        return c.json({ jobId, status: result.response.success ? 'completed' : 'failed', result: result.response.success ? 'Exact approved publication synchronized' : 'Node completed with a bounded failure' });
+    }
+    catch {
+        const row = await getDb().remoteCommand.findUnique({ where: { id: jobId } });
+        if (!row)
+            return c.json({ jobId, status: 'not_admitted', result: 'No operation was admitted; resolve target readiness and prepare a new preview' });
+        return c.json(await observed(registry, body.target, c.req.param('id')));
+    }
+});
+//# sourceMappingURL=hiveskills.js.map

package/dist/routes/library.js

@@ -1,3 +1,4 @@
+import { clientErrorMessage } from '../utils/safe-errors.js';
 import { Hono } from 'hono';
 import { getDb } from '../db/index.js';
 import { authMiddleware, getUser, requireRole } from '../middleware/auth.js';
@@ -373,7 +374,7 @@ libraryRouter.post('/deploy', requireRole('ADMIN', 'OPERATOR'), async (c) => {
                 nodeId: node.id,
                 nodeName: node.name,
                 status: 'failed',
-                error: err instanceof Error ? err.message : 'Unknown error',
+                error: clientErrorMessage(err, 'Unknown error'),
             };
         }
     }));
@@ -383,7 +384,7 @@ libraryRouter.post('/deploy', requireRole('ADMIN', 'OPERATOR'), async (c) => {
             nodeId: 'unknown',
             nodeName: 'unknown',
             status: 'failed',
-            error: r.reason instanceof Error ? r.reason.message : 'Unknown error',
+            error: clientErrorMessage(r.reason, 'Unknown error'),
         });
     await logAuditEvent({
         action: 'library.deploy',

package/dist/routes/logs.js

@@ -1,6 +1,7 @@
 import { Hono } from 'hono';
 import { createHmac, timingSafeEqual } from 'node:crypto';
 import { streamSSE } from 'hono/streaming';
+import { watchOathweaveStream } from '../middleware/oathweave.js';
 import { getDb } from '../db/index.js';
 import { authMiddleware } from '../middleware/auth.js';
 import { sanitizeDetails } from '../services/audit-service.js';
@@ -157,9 +158,13 @@ logsRouter.get('/stream', (c) => {
                 id: String(eventId++),
             });
         });
+        const stopWatching = watchOathweaveStream(c.req.header('Authorization'), () => {
+            void stream.close();
+        });
         // Wait until the client disconnects
         stream.onAbort(() => {
             clearInterval(heartbeatTimer);
+            stopWatching();
             unsubscribe();
         });
         // Keep the stream open — the onAbort callback will clean up

package/dist/routes/metrics.js

@@ -3,6 +3,7 @@ import { getDb } from '../db/index.js';
 import { getRedis } from '../queue/redis.js';
 import { getHeartbeatStreamStats } from '../services/heartbeat-stream.js';
 import { safeEqual } from '../utils/safe-equal.js';
+import { SENTINEL_NODE_IDS } from '../utils/sentinel-nodes.js';
 export const metricsRouter = new Hono();
 // ── In-process counters ──
 const counters = {
@@ -115,10 +116,10 @@ metricsRouter.get('/', async (c) => {
     try {
         const db = getDb();
         const [nodeCount, onlineNodes, pendingCommands, staleNodes, versions, oldestQueued] = await Promise.all([
-            db.node.count(),
-            db.node.count({ where: { status: 'ONLINE' } }),
+            db.node.count({ where: { id: { notIn: SENTINEL_NODE_IDS } } }),
+            db.node.count({ where: { id: { notIn: SENTINEL_NODE_IDS }, status: 'ONLINE' } }),
             db.remoteCommand.count({ where: { status: { in: ['PENDING', 'QUEUED'] } } }),
-            db.node.count({ where: { lastHeartbeatAt: { lt: new Date(Date.now() - 120_000) } } }),
+            db.node.count({ where: { id: { notIn: SENTINEL_NODE_IDS }, lastHeartbeatAt: { lt: new Date(Date.now() - 120_000) } } }),
             db.agent.groupBy({ by: ['version'], _count: true }),
             db.remoteCommand.findFirst({ where: { status: { in: ['PENDING', 'QUEUED'] } }, orderBy: { createdAt: 'asc' }, select: { createdAt: true } }),
         ]);

package/dist/routes/nodes.js

@@ -1,7 +1,8 @@
 import { Hono } from 'hono';
+import { nodeForRole } from '../services/secret-views.js';
 import { nanoid } from 'nanoid';
 import { AGENT_VERSION } from '../config/index.js';
-import { getDb } from '../db/index.js';
+import { getDb, Prisma } from '../db/index.js';
 import { promises as dns } from 'node:dns';
 import { authMiddleware, getUser, requireRole } from '../middleware/auth.js';
 import { logAuditEvent } from '../services/audit-service.js';
@@ -79,6 +80,36 @@ async function tryResolveHostnameToIp(hostname) {
         return null;
     }
 }
+/**
+ * The latest snapshot of each node, in one statement, for what a list row shows. An
+ * indexed lookup per node avoids hydrating retained history, which a Prisma relation
+ * with `take: 1` would load. A node with no snapshot is simply absent.
+ */
+async function latestHealthSummaries(nodeIds) {
+    if (nodeIds.length === 0)
+        return new Map();
+    const rows = await getDb().$queryRaw `
+    SELECT snapshot."nodeId", snapshot."timestamp", snapshot."cpuUsagePercent", snapshot."cpuCores",
+      snapshot."memoryTotalBytes", snapshot."memoryUsedBytes", snapshot."memoryPercent",
+      snapshot."swapTotalBytes", snapshot."swapUsedBytes", snapshot."disks"
+    FROM "nodes" AS node
+    INNER JOIN "health_snapshots" AS snapshot ON snapshot."id" = (
+      SELECT candidate."id"
+      FROM "health_snapshots" AS candidate
+      WHERE candidate."nodeId" = node."id"
+      ORDER BY candidate."timestamp" DESC
+      LIMIT 1
+    )
+    WHERE node."id" IN (${Prisma.join(nodeIds)})
+  `;
+    return new Map(rows.map(({ nodeId, memoryTotalBytes, memoryUsedBytes, swapTotalBytes, swapUsedBytes, ...row }) => [nodeId, {
+            ...row,
+            memoryTotalBytes: Number(memoryTotalBytes),
+            memoryUsedBytes: Number(memoryUsedBytes),
+            swapTotalBytes: Number(swapTotalBytes),
+            swapUsedBytes: Number(swapUsedBytes),
+        }]));
+}
 export const nodesRouter = new Hono();
 // All routes require auth
 nodesRouter.use('*', authMiddleware);
@@ -116,11 +147,15 @@ nodesRouter.get('/', async (c) => {
         db.node.count({ where }),
     ]));
     // Strip token from API response — never expose node secrets to the frontend
-    const safeNodes = nodes.map(({ token: _token, ...rest }) => rest);
-    const readiness = await readinessOfNodes(safeNodes);
+    const viewer = getUser(c).role;
+    const safeNodes = nodes.map((node) => nodeForRole(node, viewer));
+    const [readiness, health] = await Promise.all([
+        readinessOfNodes(safeNodes),
+        withReadRetry('nodes list health', () => latestHealthSummaries(safeNodes.map((node) => node.id))),
+    ]);
     return c.json({
         success: true,
-        data: safeNodes.map(node => ({ ...node, upgradeReadiness: readiness.get(node.id) ?? null })),
+        data: safeNodes.map(node => ({ ...node, upgradeReadiness: readiness.get(node.id) ?? null, health: health.get(node.id) ?? null })),
         meta: { total, page, pageSize, hasMore: page * pageSize < total },
     });
 });
@@ -495,7 +530,7 @@ nodesRouter.get('/:nodeId', async (c) => {
     });
     if (!node)
         throw new HttpError(404, 'NOT_FOUND', 'Node not found');
-    const { token: _token, ...safeNode } = node;
+    const safeNode = nodeForRole(node, getUser(c).role);
     const readiness = await readinessOfNodes([safeNode]);
     return c.json({ success: true, data: { ...safeNode, upgradeReadiness: readiness.get(safeNode.id) ?? null } });
 });
@@ -535,6 +570,8 @@ nodesRouter.post('/register', requireRole('ADMIN', 'OPERATOR'), async (c) => {
         targetId: node.id,
         details: { name: body.name, hostname: body.hostname },
     });
+    // The only response that ever carries this token: no cache may keep it.
+    c.header('Cache-Control', 'no-store');
     return c.json({
         success: true,
         data: {
@@ -570,7 +607,7 @@ nodesRouter.patch('/:nodeId', requireRole('ADMIN', 'OPERATOR'), async (c) => {
             throw new HttpError(404, 'NOT_FOUND', 'Node not found');
         throw err;
     });
-    const { token: _token, ...safeNode } = node;
+    const safeNode = nodeForRole(node, getUser(c).role);
     await logAuditEvent({
         action: 'node.update',
         actorId: user.userId,
@@ -621,7 +658,7 @@ nodesRouter.post('/:nodeId/repair-address', requireRole('ADMIN', 'OPERATOR'), as
     const ipChanged = resolvedIp !== node.ipAddress;
     const hostnameChanged = targetHostname !== node.hostname;
     if (!ipChanged && !hostnameChanged) {
-        const { token: _token, ...safeNode } = node;
+        const safeNode = nodeForRole(node, getUser(c).role);
         return c.json({
             success: true,
             data: {
@@ -651,7 +688,7 @@ nodesRouter.post('/:nodeId/repair-address', requireRole('ADMIN', 'OPERATOR'), as
             source,
         },
     });
-    const { token: _token, ...safeNode } = updated;
+    const safeNode = nodeForRole(updated, getUser(c).role);
     return c.json({
         success: true,
         data: {

package/dist/routes/ops.js

@@ -2,6 +2,8 @@ import { applicationProbeContractDigest, getApplicationProbeCollectorStatus } fr
 import { lessonSchema, publishLesson, lessonSuggestions, supersedeLesson } from '../services/incident-lessons.js';
 import { exportIncidentEvidence } from '../services/incident-evidence.js';
 import { getNodeManagerSecret } from '../utils/env.js';
+import { getNodeBaseUrl } from '../utils/node-url.js';
+import { describeTransportFailure } from '../utils/safe-errors.js';
 import { Hono } from 'hono';
 import { authMiddleware, getUser, requireRole } from '../middleware/auth.js';
 import { HttpError } from '../middleware/error-handler.js';
@@ -20,7 +22,8 @@ import { loadRecoveryExerciseAssessmentEvidence } from '../services/recovery-exe
 export const opsRouter = new Hono();
 opsRouter.use('*', authMiddleware);
 opsRouter.get('/dependency-health', async (c) => c.json({ success: true, data: await getDependencyHealth() }));
-opsRouter.get('/readiness', async (c) => c.json({ success: true, data: await getFleetReadiness() }));
+opsRouter.get('/readiness', async (c) => c.json({ success: true,
+    data: await getFleetReadiness({ includeSecretFingerprints: getUser(c).role === 'ADMIN' }) }));
 opsRouter.get('/timeline', async (c) => {
     const limit = Math.min(Number(c.req.query('limit') ?? '80'), 200);
     return c.json({ success: true, data: await getFleetTimeline(limit) });
@@ -212,15 +215,30 @@ opsRouter.post('/maintenance/:id/cancel', requireRole('ADMIN', 'OPERATOR'), asyn
 });
 opsRouter.get('/incidents/:id/evidence', requireRole('ADMIN', 'OPERATOR'), async (c) => c.json({ success: true, data: await exportIncidentEvidence(c.req.param('id')) }));
 opsRouter.get('/storage-evidence/:nodeId', requireRole('ADMIN', 'OPERATOR'), async (c) => {
-    const node = await getDb().node.findUnique({ where: { id: c.req.param('nodeId') }, select: { ipAddress: true, port: true } });
+    const nodeId = c.req.param('nodeId');
+    const node = await getDb().node.findUnique({ where: { id: nodeId }, select: { name: true, ipAddress: true, port: true } });
     const mount = c.req.query('mount');
     if (!node || !mount || mount.length > 4096)
         return c.json({ success: false, error: { message: 'Valid node and mount required' } }, 400);
-    const host = node.ipAddress.includes(':') ? `[${node.ipAddress}]` : node.ipAddress;
-    const response = await fetch(`https://${host}:${node.port}/api/v1/storage-evidence?${new URLSearchParams({ mount })}`, { headers: { 'x-node-token': getNodeManagerSecret() }, signal: AbortSignal.timeout(15000), redirect: 'error' });
+    const audit = (success) => logAuditEvent({ action: 'storage.investigate', actorId: getUser(c).userId, targetType: 'node', targetId: nodeId, details: { operation: 'storage-evidence', readOnly: true, success } });
+    let response;
+    try {
+        response = await fetch(`${getNodeBaseUrl(node.ipAddress, node.port)}/api/v1/storage-evidence?${new URLSearchParams({ mount })}`, { headers: { 'x-node-token': getNodeManagerSecret() }, signal: AbortSignal.timeout(15000), redirect: 'error' });
+    }
+    catch (error) {
+        await audit(false);
+        throw new HttpError(502, 'NODE_UNREACHABLE', `Could not reach the agent on ${node.name}: ${describeTransportFailure(error)}. Check that the agent is running and that this server can reach its port.`);
+    }
     const { boundedJson } = await import('../services/application-probes.js');
-    const body = await boundedJson(response);
-    await logAuditEvent({ action: 'storage.investigate', actorId: getUser(c).userId, targetType: 'node', targetId: c.req.param('nodeId'), details: { operation: 'storage-evidence', readOnly: true, success: response.ok } });
+    let body;
+    try {
+        body = await boundedJson(response);
+    }
+    catch {
+        await audit(false);
+        throw new HttpError(502, 'NODE_BAD_RESPONSE', `The agent on ${node.name} answered HTTP ${response.status} with no readable storage report. Check that it is running a version that supports storage evidence.`);
+    }
+    await audit(response.ok);
     return c.json(body, response.ok ? 200 : 502);
 });
 opsRouter.get('/lessons', requireRole('ADMIN', 'OPERATOR'), async (c) => c.json({ success: true, data: await lessonSuggestions((c.req.query('query') ?? '').slice(0, 500)) }));

package/dist/routes/profiling.js

@@ -3,6 +3,7 @@ import { authMiddleware, requireRole } from '../middleware/auth.js';
 import { getDb } from '../db/index.js';
 import { HttpError } from '../middleware/error-handler.js';
 import { getNodeManagerSecret } from '../utils/env.js';
+import { SENTINEL_NODE_IDS } from '../utils/sentinel-nodes.js';
 export const profilingRouter = new Hono();
 profilingRouter.use('*', authMiddleware);
 /**
@@ -49,7 +50,7 @@ profilingRouter.get('/:nodeId', requireRole('ADMIN', 'OPERATOR'), async (c) => {
 profilingRouter.get('/', requireRole('ADMIN', 'OPERATOR'), async (c) => {
     const db = getDb();
     const nodes = await db.node.findMany({
-        where: { status: { notIn: ['DECOMMISSIONED', 'OFFLINE'] } },
+        where: { id: { notIn: SENTINEL_NODE_IDS }, status: { notIn: ['DECOMMISSIONED', 'OFFLINE'] } },
         select: { id: true, name: true, ipAddress: true, port: true },
     });
     const results = await Promise.allSettled(nodes.map(async (node) => {

package/dist/routes/roles.js

@@ -1,4 +1,5 @@
 import { Hono } from 'hono';
+import { mergeEnvironmentEdit } from '../services/secret-views.js';
 import { getDb } from '../db/index.js';
 import { authMiddleware, getUser, requireRole } from '../middleware/auth.js';
 import { logAuditEvent } from '../services/audit-service.js';
@@ -11,17 +12,23 @@ import { serializeStringArray, serializeRecord, parseStringArray, parseStringRec
 export const rolesRouter = new Hono();
 rolesRouter.use('*', authMiddleware);
 /** Transform a DB role record into a clean API response. */
-function formatRole(role) {
-    return {
-        ...role,
+function formatRole(role, viewer) {
+    // Values in envConfig are written to hosts and may be secrets: below ADMIN a
+    // role shows its key names only.
+    const { envConfig: rawEnvConfig, ...rest } = role;
+    const envConfig = parseStringRecord(rawEnvConfig);
+    const formatted = {
+        ...rest,
         libraryFileIds: parseStringArray(role.libraryFileIds),
         skillNames: parseStringArray(role.skillNames),
         aptPackages: parseStringArray(role.aptPackages),
         npmPackages: parseStringArray(role.npmPackages),
-        envConfig: parseStringRecord(role.envConfig),
+        ...(viewer === 'ADMIN' ? { envConfig } : {}),
+        envConfigKeys: Object.keys(envConfig).sort(),
         dockerVolumes: parseStringArray(role.dockerVolumes),
         firewallAllowRules: parseStringArray(role.firewallAllowRules),
     };
+    return formatted;
 }
 /** Transform a DB role application record. */
 function formatApplication(app) {
@@ -39,7 +46,8 @@ rolesRouter.get('/', async (c) => {
             _count: { select: { nodes: true } },
         },
     });
-    const data = roles.map((r) => formatRole(r));
+    const viewer = getUser(c).role;
+    const data = roles.map((r) => formatRole(r, viewer));
     return c.json({ success: true, data });
 });
 // ─── Get single role ───
@@ -55,7 +63,7 @@ rolesRouter.get('/:roleId', async (c) => {
     });
     if (!role)
         throw new HttpError(404, 'NOT_FOUND', 'Role not found');
-    return c.json({ success: true, data: formatRole(role) });
+    return c.json({ success: true, data: formatRole(role, getUser(c).role) });
 });
 // ─── Create role ───
 rolesRouter.post('/', requireRole('ADMIN', 'OPERATOR'), async (c) => {
@@ -105,7 +113,7 @@ rolesRouter.post('/', requireRole('ADMIN', 'OPERATOR'), async (c) => {
         targetId: role.id,
         details: { name: role.name, status: role.status },
     });
-    return c.json({ success: true, data: formatRole(role) }, 201);
+    return c.json({ success: true, data: formatRole(role, user.role) }, 201);
 });
 // ─── Update role ───
 rolesRouter.patch('/:roleId', requireRole('ADMIN', 'OPERATOR'), async (c) => {
@@ -131,7 +139,7 @@ rolesRouter.patch('/:roleId', requireRole('ADMIN', 'OPERATOR'), async (c) => {
             ...(body.skillNames !== undefined && { skillNames: serializeStringArray(body.skillNames) }),
             ...(body.aptPackages !== undefined && { aptPackages: serializeStringArray(body.aptPackages) }),
             ...(body.npmPackages !== undefined && { npmPackages: serializeStringArray(body.npmPackages) }),
-            ...(body.envConfig !== undefined && { envConfig: serializeRecord(body.envConfig) }),
+            ...(body.envConfig !== undefined && { envConfig: serializeRecord(user.role === 'ADMIN' ? body.envConfig : mergeEnvironmentEdit(existing.envConfig, body.envConfig)) }),
             ...(body.dockerEnabled !== undefined && { dockerEnabled: body.dockerEnabled }),
             ...(body.dockerNonRoot !== undefined && { dockerNonRoot: body.dockerNonRoot }),
             ...(body.dockerImage !== undefined && { dockerImage: body.dockerImage }),
@@ -149,7 +157,7 @@ rolesRouter.patch('/:roleId', requireRole('ADMIN', 'OPERATOR'), async (c) => {
         targetId: roleId,
         details: { name: body.name, status: body.status },
     });
-    return c.json({ success: true, data: formatRole(role) });
+    return c.json({ success: true, data: formatRole(role, user.role) });
 });
 // ─── Delete role ───
 rolesRouter.delete('/:roleId', requireRole('ADMIN'), async (c) => {