@hivemagnus/magnus-server 2.0.0 → 2.1.0

package/dist/routes/nodes.js

@@ -1,7 +1,8 @@
 import { Hono } from 'hono';
+import { nodeForRole } from '../services/secret-views.js';
 import { nanoid } from 'nanoid';
 import { AGENT_VERSION } from '../config/index.js';
-import { getDb } from '../db/index.js';
+import { getDb, Prisma } from '../db/index.js';
 import { promises as dns } from 'node:dns';
 import { authMiddleware, getUser, requireRole } from '../middleware/auth.js';
 import { logAuditEvent } from '../services/audit-service.js';
@@ -79,6 +80,36 @@ async function tryResolveHostnameToIp(hostname) {
         return null;
     }
 }
+/**
+ * The latest snapshot of each node, in one statement, for what a list row shows. An
+ * indexed lookup per node avoids hydrating retained history, which a Prisma relation
+ * with `take: 1` would load. A node with no snapshot is simply absent.
+ */
+async function latestHealthSummaries(nodeIds) {
+    if (nodeIds.length === 0)
+        return new Map();
+    const rows = await getDb().$queryRaw `
+    SELECT snapshot."nodeId", snapshot."timestamp", snapshot."cpuUsagePercent", snapshot."cpuCores",
+      snapshot."memoryTotalBytes", snapshot."memoryUsedBytes", snapshot."memoryPercent",
+      snapshot."swapTotalBytes", snapshot."swapUsedBytes", snapshot."disks"
+    FROM "nodes" AS node
+    INNER JOIN "health_snapshots" AS snapshot ON snapshot."id" = (
+      SELECT candidate."id"
+      FROM "health_snapshots" AS candidate
+      WHERE candidate."nodeId" = node."id"
+      ORDER BY candidate."timestamp" DESC
+      LIMIT 1
+    )
+    WHERE node."id" IN (${Prisma.join(nodeIds)})
+  `;
+    return new Map(rows.map(({ nodeId, memoryTotalBytes, memoryUsedBytes, swapTotalBytes, swapUsedBytes, ...row }) => [nodeId, {
+            ...row,
+            memoryTotalBytes: Number(memoryTotalBytes),
+            memoryUsedBytes: Number(memoryUsedBytes),
+            swapTotalBytes: Number(swapTotalBytes),
+            swapUsedBytes: Number(swapUsedBytes),
+        }]));
+}
 export const nodesRouter = new Hono();
 // All routes require auth
 nodesRouter.use('*', authMiddleware);
@@ -116,11 +147,15 @@ nodesRouter.get('/', async (c) => {
         db.node.count({ where }),
     ]));
     // Strip token from API response — never expose node secrets to the frontend
-    const safeNodes = nodes.map(({ token: _token, ...rest }) => rest);
-    const readiness = await readinessOfNodes(safeNodes);
+    const viewer = getUser(c).role;
+    const safeNodes = nodes.map((node) => nodeForRole(node, viewer));
+    const [readiness, health] = await Promise.all([
+        readinessOfNodes(safeNodes),
+        withReadRetry('nodes list health', () => latestHealthSummaries(safeNodes.map((node) => node.id))),
+    ]);
     return c.json({
         success: true,
-        data: safeNodes.map(node => ({ ...node, upgradeReadiness: readiness.get(node.id) ?? null })),
+        data: safeNodes.map(node => ({ ...node, upgradeReadiness: readiness.get(node.id) ?? null, health: health.get(node.id) ?? null })),
         meta: { total, page, pageSize, hasMore: page * pageSize < total },
     });
 });
@@ -495,7 +530,7 @@ nodesRouter.get('/:nodeId', async (c) => {
     });
     if (!node)
         throw new HttpError(404, 'NOT_FOUND', 'Node not found');
-    const { token: _token, ...safeNode } = node;
+    const safeNode = nodeForRole(node, getUser(c).role);
     const readiness = await readinessOfNodes([safeNode]);
     return c.json({ success: true, data: { ...safeNode, upgradeReadiness: readiness.get(safeNode.id) ?? null } });
 });
@@ -535,6 +570,8 @@ nodesRouter.post('/register', requireRole('ADMIN', 'OPERATOR'), async (c) => {
         targetId: node.id,
         details: { name: body.name, hostname: body.hostname },
     });
+    // The only response that ever carries this token: no cache may keep it.
+    c.header('Cache-Control', 'no-store');
     return c.json({
         success: true,
         data: {
@@ -570,7 +607,7 @@ nodesRouter.patch('/:nodeId', requireRole('ADMIN', 'OPERATOR'), async (c) => {
             throw new HttpError(404, 'NOT_FOUND', 'Node not found');
         throw err;
     });
-    const { token: _token, ...safeNode } = node;
+    const safeNode = nodeForRole(node, getUser(c).role);
     await logAuditEvent({
         action: 'node.update',
         actorId: user.userId,
@@ -621,7 +658,7 @@ nodesRouter.post('/:nodeId/repair-address', requireRole('ADMIN', 'OPERATOR'), as
     const ipChanged = resolvedIp !== node.ipAddress;
     const hostnameChanged = targetHostname !== node.hostname;
     if (!ipChanged && !hostnameChanged) {
-        const { token: _token, ...safeNode } = node;
+        const safeNode = nodeForRole(node, getUser(c).role);
         return c.json({
             success: true,
             data: {
@@ -651,7 +688,7 @@ nodesRouter.post('/:nodeId/repair-address', requireRole('ADMIN', 'OPERATOR'), as
             source,
         },
     });
-    const { token: _token, ...safeNode } = updated;
+    const safeNode = nodeForRole(updated, getUser(c).role);
     return c.json({
         success: true,
         data: {

package/dist/routes/ops.js

@@ -2,6 +2,8 @@ import { applicationProbeContractDigest, getApplicationProbeCollectorStatus } fr
 import { lessonSchema, publishLesson, lessonSuggestions, supersedeLesson } from '../services/incident-lessons.js';
 import { exportIncidentEvidence } from '../services/incident-evidence.js';
 import { getNodeManagerSecret } from '../utils/env.js';
+import { getNodeBaseUrl } from '../utils/node-url.js';
+import { describeTransportFailure } from '../utils/safe-errors.js';
 import { Hono } from 'hono';
 import { authMiddleware, getUser, requireRole } from '../middleware/auth.js';
 import { HttpError } from '../middleware/error-handler.js';
@@ -20,7 +22,8 @@ import { loadRecoveryExerciseAssessmentEvidence } from '../services/recovery-exe
 export const opsRouter = new Hono();
 opsRouter.use('*', authMiddleware);
 opsRouter.get('/dependency-health', async (c) => c.json({ success: true, data: await getDependencyHealth() }));
-opsRouter.get('/readiness', async (c) => c.json({ success: true, data: await getFleetReadiness() }));
+opsRouter.get('/readiness', async (c) => c.json({ success: true,
+    data: await getFleetReadiness({ includeSecretFingerprints: getUser(c).role === 'ADMIN' }) }));
 opsRouter.get('/timeline', async (c) => {
     const limit = Math.min(Number(c.req.query('limit') ?? '80'), 200);
     return c.json({ success: true, data: await getFleetTimeline(limit) });
@@ -212,15 +215,30 @@ opsRouter.post('/maintenance/:id/cancel', requireRole('ADMIN', 'OPERATOR'), asyn
 });
 opsRouter.get('/incidents/:id/evidence', requireRole('ADMIN', 'OPERATOR'), async (c) => c.json({ success: true, data: await exportIncidentEvidence(c.req.param('id')) }));
 opsRouter.get('/storage-evidence/:nodeId', requireRole('ADMIN', 'OPERATOR'), async (c) => {
-    const node = await getDb().node.findUnique({ where: { id: c.req.param('nodeId') }, select: { ipAddress: true, port: true } });
+    const nodeId = c.req.param('nodeId');
+    const node = await getDb().node.findUnique({ where: { id: nodeId }, select: { name: true, ipAddress: true, port: true } });
     const mount = c.req.query('mount');
     if (!node || !mount || mount.length > 4096)
         return c.json({ success: false, error: { message: 'Valid node and mount required' } }, 400);
-    const host = node.ipAddress.includes(':') ? `[${node.ipAddress}]` : node.ipAddress;
-    const response = await fetch(`https://${host}:${node.port}/api/v1/storage-evidence?${new URLSearchParams({ mount })}`, { headers: { 'x-node-token': getNodeManagerSecret() }, signal: AbortSignal.timeout(15000), redirect: 'error' });
+    const audit = (success) => logAuditEvent({ action: 'storage.investigate', actorId: getUser(c).userId, targetType: 'node', targetId: nodeId, details: { operation: 'storage-evidence', readOnly: true, success } });
+    let response;
+    try {
+        response = await fetch(`${getNodeBaseUrl(node.ipAddress, node.port)}/api/v1/storage-evidence?${new URLSearchParams({ mount })}`, { headers: { 'x-node-token': getNodeManagerSecret() }, signal: AbortSignal.timeout(15000), redirect: 'error' });
+    }
+    catch (error) {
+        await audit(false);
+        throw new HttpError(502, 'NODE_UNREACHABLE', `Could not reach the agent on ${node.name}: ${describeTransportFailure(error)}. Check that the agent is running and that this server can reach its port.`);
+    }
     const { boundedJson } = await import('../services/application-probes.js');
-    const body = await boundedJson(response);
-    await logAuditEvent({ action: 'storage.investigate', actorId: getUser(c).userId, targetType: 'node', targetId: c.req.param('nodeId'), details: { operation: 'storage-evidence', readOnly: true, success: response.ok } });
+    let body;
+    try {
+        body = await boundedJson(response);
+    }
+    catch {
+        await audit(false);
+        throw new HttpError(502, 'NODE_BAD_RESPONSE', `The agent on ${node.name} answered HTTP ${response.status} with no readable storage report. Check that it is running a version that supports storage evidence.`);
+    }
+    await audit(response.ok);
     return c.json(body, response.ok ? 200 : 502);
 });
 opsRouter.get('/lessons', requireRole('ADMIN', 'OPERATOR'), async (c) => c.json({ success: true, data: await lessonSuggestions((c.req.query('query') ?? '').slice(0, 500)) }));

package/dist/routes/profiling.js

@@ -3,6 +3,7 @@ import { authMiddleware, requireRole } from '../middleware/auth.js';
 import { getDb } from '../db/index.js';
 import { HttpError } from '../middleware/error-handler.js';
 import { getNodeManagerSecret } from '../utils/env.js';
+import { SENTINEL_NODE_IDS } from '../utils/sentinel-nodes.js';
 export const profilingRouter = new Hono();
 profilingRouter.use('*', authMiddleware);
 /**
@@ -49,7 +50,7 @@ profilingRouter.get('/:nodeId', requireRole('ADMIN', 'OPERATOR'), async (c) => {
 profilingRouter.get('/', requireRole('ADMIN', 'OPERATOR'), async (c) => {
     const db = getDb();
     const nodes = await db.node.findMany({
-        where: { status: { notIn: ['DECOMMISSIONED', 'OFFLINE'] } },
+        where: { id: { notIn: SENTINEL_NODE_IDS }, status: { notIn: ['DECOMMISSIONED', 'OFFLINE'] } },
         select: { id: true, name: true, ipAddress: true, port: true },
     });
     const results = await Promise.allSettled(nodes.map(async (node) => {

package/dist/routes/roles.js

@@ -1,4 +1,5 @@
 import { Hono } from 'hono';
+import { mergeEnvironmentEdit } from '../services/secret-views.js';
 import { getDb } from '../db/index.js';
 import { authMiddleware, getUser, requireRole } from '../middleware/auth.js';
 import { logAuditEvent } from '../services/audit-service.js';
@@ -11,17 +12,23 @@ import { serializeStringArray, serializeRecord, parseStringArray, parseStringRec
 export const rolesRouter = new Hono();
 rolesRouter.use('*', authMiddleware);
 /** Transform a DB role record into a clean API response. */
-function formatRole(role) {
-    return {
-        ...role,
+function formatRole(role, viewer) {
+    // Values in envConfig are written to hosts and may be secrets: below ADMIN a
+    // role shows its key names only.
+    const { envConfig: rawEnvConfig, ...rest } = role;
+    const envConfig = parseStringRecord(rawEnvConfig);
+    const formatted = {
+        ...rest,
         libraryFileIds: parseStringArray(role.libraryFileIds),
         skillNames: parseStringArray(role.skillNames),
         aptPackages: parseStringArray(role.aptPackages),
         npmPackages: parseStringArray(role.npmPackages),
-        envConfig: parseStringRecord(role.envConfig),
+        ...(viewer === 'ADMIN' ? { envConfig } : {}),
+        envConfigKeys: Object.keys(envConfig).sort(),
         dockerVolumes: parseStringArray(role.dockerVolumes),
         firewallAllowRules: parseStringArray(role.firewallAllowRules),
     };
+    return formatted;
 }
 /** Transform a DB role application record. */
 function formatApplication(app) {
@@ -39,7 +46,8 @@ rolesRouter.get('/', async (c) => {
             _count: { select: { nodes: true } },
         },
     });
-    const data = roles.map((r) => formatRole(r));
+    const viewer = getUser(c).role;
+    const data = roles.map((r) => formatRole(r, viewer));
     return c.json({ success: true, data });
 });
 // ─── Get single role ───
@@ -55,7 +63,7 @@ rolesRouter.get('/:roleId', async (c) => {
     });
     if (!role)
         throw new HttpError(404, 'NOT_FOUND', 'Role not found');
-    return c.json({ success: true, data: formatRole(role) });
+    return c.json({ success: true, data: formatRole(role, getUser(c).role) });
 });
 // ─── Create role ───
 rolesRouter.post('/', requireRole('ADMIN', 'OPERATOR'), async (c) => {
@@ -105,7 +113,7 @@ rolesRouter.post('/', requireRole('ADMIN', 'OPERATOR'), async (c) => {
         targetId: role.id,
         details: { name: role.name, status: role.status },
     });
-    return c.json({ success: true, data: formatRole(role) }, 201);
+    return c.json({ success: true, data: formatRole(role, user.role) }, 201);
 });
 // ─── Update role ───
 rolesRouter.patch('/:roleId', requireRole('ADMIN', 'OPERATOR'), async (c) => {
@@ -131,7 +139,7 @@ rolesRouter.patch('/:roleId', requireRole('ADMIN', 'OPERATOR'), async (c) => {
             ...(body.skillNames !== undefined && { skillNames: serializeStringArray(body.skillNames) }),
             ...(body.aptPackages !== undefined && { aptPackages: serializeStringArray(body.aptPackages) }),
             ...(body.npmPackages !== undefined && { npmPackages: serializeStringArray(body.npmPackages) }),
-            ...(body.envConfig !== undefined && { envConfig: serializeRecord(body.envConfig) }),
+            ...(body.envConfig !== undefined && { envConfig: serializeRecord(user.role === 'ADMIN' ? body.envConfig : mergeEnvironmentEdit(existing.envConfig, body.envConfig)) }),
             ...(body.dockerEnabled !== undefined && { dockerEnabled: body.dockerEnabled }),
             ...(body.dockerNonRoot !== undefined && { dockerNonRoot: body.dockerNonRoot }),
             ...(body.dockerImage !== undefined && { dockerImage: body.dockerImage }),
@@ -149,7 +157,7 @@ rolesRouter.patch('/:roleId', requireRole('ADMIN', 'OPERATOR'), async (c) => {
         targetId: roleId,
         details: { name: body.name, status: body.status },
     });
-    return c.json({ success: true, data: formatRole(role) });
+    return c.json({ success: true, data: formatRole(role, user.role) });
 });
 // ─── Delete role ───
 rolesRouter.delete('/:roleId', requireRole('ADMIN'), async (c) => {

package/dist/routes/stats.js

@@ -3,7 +3,10 @@ import { getDb } from '../db/index.js';
 import { authMiddleware } from '../middleware/auth.js';
 import { queryAuditEvents } from '../services/audit-service.js';
 import { getCodexFleetPosture } from '../services/codex-service.js';
+import { SENTINEL_NODE_IDS } from '../utils/sentinel-nodes.js';
 export const statsRouter = new Hono();
+// Sentinel records exist only to satisfy log foreign keys; they are not fleet members.
+const realNode = { id: { notIn: SENTINEL_NODE_IDS } };
 statsRouter.use('*', authMiddleware);
 /**
  * GET /stats/overview
@@ -12,11 +15,11 @@ statsRouter.use('*', authMiddleware);
 statsRouter.get('/overview', async (c) => {
     const db = getDb();
     const [totalNodes, onlineNodeRecords, offlineNodes, degradedNodes, provisioningNodes, totalCommands, runningCommands, pendingCommands, totalCronJobs, activeCronJobs, recentCommands, auditResult,] = await Promise.all([
-        db.node.count(),
-        db.node.findMany({ where: { status: 'ONLINE' }, select: { id: true } }),
-        db.node.count({ where: { status: 'OFFLINE' } }),
-        db.node.count({ where: { status: 'DEGRADED' } }),
-        db.node.count({ where: { status: 'PROVISIONING' } }),
+        db.node.count({ where: realNode }),
+        db.node.findMany({ where: { ...realNode, status: 'ONLINE' }, select: { id: true } }),
+        db.node.count({ where: { ...realNode, status: 'OFFLINE' } }),
+        db.node.count({ where: { ...realNode, status: 'DEGRADED' } }),
+        db.node.count({ where: { ...realNode, status: 'PROVISIONING' } }),
         db.remoteCommand.count(),
         db.remoteCommand.count({ where: { status: 'RUNNING' } }),
         db.remoteCommand.count({ where: { status: 'PENDING' } }),

package/dist/routes/terminal-ticket.js

@@ -3,13 +3,13 @@ import { authMiddleware, requireRole } from '../middleware/auth.js';
 export const terminalTicketRouter = new Hono();
 terminalTicketRouter.use('*', authMiddleware);
 terminalTicketRouter.use('*', requireRole('ADMIN', 'OPERATOR'));
-/** The password-backed Control API terminal is retired; use the dashboard's
- * dedicated restricted key and inventory-pinned terminal transport. */
+/** The password-backed Control API terminal is retired. The web terminal lives in the separate
+ * fleet gateway, so this process never holds the restricted SSH key. */
 terminalTicketRouter.post('/ticket', (c) => c.json({
     success: false,
     error: {
         code: 'TERMINAL_RETIRED',
-        message: 'Control API terminal tickets are retired; use the dashboard terminal.',
+        message: 'Control API terminal tickets are retired; the fleet gateway carries the web terminal.',
     },
 }, 410));
 //# sourceMappingURL=terminal-ticket.js.map

package/dist/routes/terminal.js

@@ -1,8 +1,8 @@
 import { WebSocketServer } from 'ws';
 /**
  * The former Control API terminal used retired reusable SSH passwords. Keep a
- * deterministic upgrade rejection so old clients fail closed while the
- * dashboard's separately scoped, host-key-pinned terminal remains available.
+ * deterministic upgrade rejection so old clients fail closed. The web terminal
+ * lives in the fleet gateway, so this process never holds the restricted SSH key.
  */
 export function setupTerminalWebSocket(server) {
     const wss = new WebSocketServer({ noServer: true });

package/dist/routes/webhooks.js

@@ -3,7 +3,7 @@ import { authMiddleware, getUser, requireRole } from '../middleware/auth.js';
 import { logAuditEvent } from '../services/audit-service.js';
 import { HttpError } from '../middleware/error-handler.js';
 import { listWebhookEndpoints, getWebhookEndpoint, createWebhookEndpoint, updateWebhookEndpoint, deleteWebhookEndpoint, listDeliveries, testWebhookEndpoint, dispatchWebhook, redeliverWebhookDelivery, } from '../services/webhook-service.js';
-import { validateWebhookTarget } from '../services/webhook-security.js';
+import { validateWebhookTarget, WebhookOriginNotAllowedError } from '../services/webhook-security.js';
 /** Audit only the target origin: webhook paths and queries often embed tokens. */
 function webhookOrigin(url) {
     try {
@@ -13,6 +13,17 @@ function webhookOrigin(url) {
         return 'invalid';
     }
 }
+/** Refused targets stay indistinguishable, so this cannot probe DNS or internal addresses. Only the allowlist is explained. */
+async function assertApprovedTarget(url) {
+    try {
+        await validateWebhookTarget(url);
+    }
+    catch (error) {
+        if (error instanceof WebhookOriginNotAllowedError)
+            throw new HttpError(400, 'VALIDATION_ERROR', error.message);
+        throw new HttpError(400, 'VALIDATION_ERROR', 'Webhook target is not an approved public HTTPS endpoint');
+    }
+}
 export const webhooksRouter = new Hono();
 // All webhook routes require ADMIN role
 webhooksRouter.use('*', authMiddleware);
@@ -35,12 +46,7 @@ webhooksRouter.post('/', async (c) => {
     if (!body.name || !body.url) {
         throw new HttpError(400, 'VALIDATION_ERROR', 'name and url are required');
     }
-    try {
-        await validateWebhookTarget(body.url);
-    }
-    catch {
-        throw new HttpError(400, 'VALIDATION_ERROR', 'Webhook target is not an approved public HTTPS endpoint');
-    }
+    await assertApprovedTarget(body.url);
     const user = c.get('user');
     const endpoint = await createWebhookEndpoint({
         ...body,
@@ -61,14 +67,8 @@ webhooksRouter.patch('/:id', async (c) => {
     if (!existing)
         throw new HttpError(404, 'NOT_FOUND', 'Webhook endpoint not found');
     const body = await c.req.json();
-    if (body.url !== undefined) {
-        try {
-            await validateWebhookTarget(body.url);
-        }
-        catch {
-            throw new HttpError(400, 'VALIDATION_ERROR', 'Webhook target is not an approved public HTTPS endpoint');
-        }
-    }
+    if (body.url !== undefined)
+        await assertApprovedTarget(body.url);
     const endpoint = await updateWebhookEndpoint(id, body);
     // Record which fields changed, never secret or header values.
     await logAuditEvent({

package/dist/sdk/node-api-client.js

@@ -1,4 +1,5 @@
 import { createHash, randomUUID } from 'node:crypto';
+import { assertLiveExecution } from '../config/rehearsal.js';
 import { MANAGED_CLAIM_HEADER, credentialMutationIdentity, httpIdentity, httpReceiptBody, managedHttpRequestSchema } from '../security/managed-http.js';
 import { nativeCompletionDescriptor, nativeCompletionResourceKey } from '../security/native-completion-registry.js';
 import { COMMAND_COMPLETION_REGISTRY, COMMAND_COMPLETION_REGISTRY_SHA256, commandCompletionDescriptor } from '../security/command-completion-registry.js';
@@ -201,7 +202,7 @@ export class NodeApiClient {
             headers: {
                 'x-node-token': options.nodeToken,
             },
-            hooks: { afterResponse: [rejectUnprivilegedAgent] },
+            hooks: { beforeRequest: [() => assertLiveExecution()], afterResponse: [rejectUnprivilegedAgent] },
         });
     }
     /** All finite native mutations use the same central owner and node execution slot. */
@@ -302,6 +303,15 @@ export class NodeApiClient {
         return { response: result.response, evidence: result.evidence };
     }
     // ── Health ──
+    async hiveSkillsTargetPosture(target, registryId) {
+        return this.api.get('hiveskills/targets/' + encodeURIComponent(target), { searchParams: { registryId }, retry: 0 }).json();
+    }
+    async syncHiveSkills(body, commandId) {
+        const result = await this.mutateWithEvidence('POST', 'hiveskills/sync', body, 120000, commandId, undefined, true);
+        if (!result.evidence)
+            throw new Error('Skills execution requires an enrolled node and signed receipt');
+        return { response: result.response, evidence: result.evidence };
+    }
     async securityResponseCapable() {
         const reply = await this.api.get('ping', { timeout: 5000, retry: 0 }).json();
         return reply.success === true && reply.data?.features?.securityResponse === 1;

package/dist/security/native-completion-registry.js

@@ -2,6 +2,8 @@ import { createHash } from 'node:crypto';
 export const NATIVE_COMPLETION_REGISTRY = {
     version: 1,
     descriptors: [
+        { id: 'hiveskills-sync', method: 'POST', pathMatcher: { kind: 'exact', path: '/hiveskills/sync' },
+            completionMode: 'buffered-synchronous-http', timeoutCeilingSeconds: 120, resourceClassifier: 'node-skill-catalog' },
         { id: 'security-response', method: 'POST', pathMatcher: { kind: 'exact', path: '/security-response' },
             completionMode: 'buffered-synchronous-http', timeoutCeilingSeconds: 120, resourceClassifier: 'node-filesystem' },
         { id: 'file-write', method: 'POST', pathMatcher: { kind: 'exact', path: '/files/write' },
@@ -52,7 +54,7 @@ export function knownNativeCompletionIdentity(version, sha256, descriptorId) {
     const descriptor = NATIVE_COMPLETION_REGISTRY.descriptors.find(item => item.id === descriptorId);
     if (!descriptor)
         return false;
-    return sha256 === NATIVE_COMPLETION_REGISTRY_SHA256 || (descriptorId !== 'security-response'
+    return sha256 === NATIVE_COMPLETION_REGISTRY_SHA256 || (descriptorId !== 'hiveskills-sync' && sha256 === 'e1303b169387f536c257e686eb95a29c1ff9b09e26fc38ac0d71d6c0daf9eb55') || (descriptorId !== 'security-response' && descriptorId !== 'hiveskills-sync'
         && sha256 === 'b0f05a1eac40dba262ec5ff0cc0de8d2b7c9f119a6a2d7ed3a00d94dcb6b1d3d');
 }
 //# sourceMappingURL=native-completion-registry.js.map

package/dist/server.js

@@ -17,6 +17,7 @@ import { nodesRouter } from './routes/nodes.js';
 import { commandsRouter } from './routes/commands.js';
 import { cronRouter } from './routes/cron.js';
 import { filesRouter } from './routes/files.js';
+import { hiveskillsRouter } from './routes/hiveskills.js';
 import { skillsRouter } from './routes/skills.js';
 import { logsRouter } from './routes/logs.js';
 import { healthRouter } from './routes/health.js';
@@ -34,6 +35,7 @@ import { systemUpdatesRouter } from './routes/system-updates.js';
 import { agentUpgradesRouter } from './routes/agent-upgrades.js';
 import { scanRouter } from './routes/scan.js';
 import { terminalTicketRouter } from './routes/terminal-ticket.js';
+import { fleetGatewayRouter } from './routes/fleet-gateway.js';
 import { usersRouter, authRouter } from './routes/users.js';
 import { docsRouter } from './routes/docs.js';
 import { webhooksRouter } from './routes/webhooks.js';
@@ -61,8 +63,11 @@ import { fleetChecksRouter } from './routes/fleet-checks.js';
 import { opsRouter } from './routes/ops.js';
 import { mcpRouter } from './routes/mcp.js';
 import { securityFusionRouter } from './routes/security-fusion.js';
+import { consoleRouter } from './routes/console.js';
 import { resolveCorsConfiguration } from './config/cors.js';
+import { rehearsalReadOnly } from './config/rehearsal.js';
 export const app = new Hono();
+app.use('*', rehearsalReadOnly);
 // ── Global middleware ──
 app.use('*', logger());
 app.use('*', correlationId);
@@ -118,6 +123,7 @@ v1.route('/shared-resource-leases', sharedResourceLeasesRouter);
 v1.route('/cron', cronRouter);
 v1.route('/files', filesRouter);
 v1.route('/skills', skillsRouter);
+v1.route('/hiveskills', hiveskillsRouter);
 v1.route('/logs', logsRouter);
 v1.route('/health', healthRouter);
 v1.route('/audit', auditRouter);
@@ -134,6 +140,7 @@ v1.route('/system/updates', systemUpdatesRouter);
 v1.route('/agents/upgrade', agentUpgradesRouter);
 v1.route('/scan', scanRouter);
 v1.route('/terminal', terminalTicketRouter);
+v1.route('/fleet-gateway', fleetGatewayRouter);
 v1.route('/users', usersRouter);
 v1.route('/auth', authRouter);
 v1.route('/webhooks', webhooksRouter);
@@ -158,6 +165,7 @@ v1.route('/ai-schedules', aiScheduleRouter);
 v1.route('/profiling', profilingRouter);
 v1.route('/assistant', assistantRouter);
 v1.route('/events/stream', eventsStreamRouter);
+v1.route('/console', consoleRouter);
 v1.route('/ops', opsRouter);
 v1.route('/mcp', mcpRouter);
 v1.route('/security-integration/response', cindertraceResponseRouter);

package/dist/services/ai-assistant-service.js

@@ -13,6 +13,7 @@ import { z } from 'zod';
 import { getDb } from '../db/index.js';
 import { executeAiTool, listAvailableTools } from './ai-tools.js';
 import { logAuditEvent } from './audit-service.js';
+import { clientErrorMessage } from '../utils/safe-errors.js';
 import { autoStoreToolResult, listScratchpadEntries } from './ai-scratchpad-service.js';
 import { getLlmProvider, getLlmProviderStatuses } from './llm-providers/index.js';
 import { getOllamaThinkingCapability } from './llm-providers/ollama.js';
@@ -1625,12 +1626,37 @@ export async function chat(request) {
     };
 }
 // ── Conversation list / message queries ──
+/** The values of `createdBy` that mean this caller: conversations store the email, or the user ID without one. */
+export function conversationOwners(user) {
+    return [...new Set([user?.email, user?.userId].filter((value) => Boolean(value)))];
+}
+/**
+ * The fleet heartbeat conversation is the server's own and describes the fleet, not
+ * anyone's work, and the anomaly page checks for it, so every role can read it.
+ */
+const SHARED_CONVERSATION = { createdBy: 'system', type: 'heartbeat' };
+/** What a caller may read: their own conversations and the shared heartbeat. */
+function readableConversations(owners) {
+    return { OR: [{ createdBy: { in: owners } }, SHARED_CONVERSATION] };
+}
+/** 'owner' may change a conversation, 'shared' may only read it, and null may not know it exists. */
+export async function getConversationAccess(conversationId, owners) {
+    const conversation = await getDb().aiConversation.findUnique({
+        where: { id: conversationId },
+        select: { createdBy: true, type: true },
+    });
+    if (!conversation)
+        return null;
+    if (owners.includes(conversation.createdBy))
+        return 'owner';
+    return conversation.createdBy === SHARED_CONVERSATION.createdBy && conversation.type === SHARED_CONVERSATION.type ? 'shared' : null;
+}
 export async function listConversations(params) {
     const db = getDb();
     const page = params.page ?? 1;
     const pageSize = Math.min(params.pageSize ?? 20, 50);
     const skip = (page - 1) * pageSize;
-    const where = {};
+    const where = readableConversations(params.owners);
     if (params.type)
         where['type'] = params.type;
     // 'all' is a sentinel meaning no status filter
@@ -1689,16 +1715,16 @@ export async function getConversationMessages(conversationId, params) {
         total,
     };
 }
-export async function getUnreadAiMessageCount() {
+export async function getUnreadAiMessageCount(owners) {
     const db = getDb();
     return db.aiMessage.count({
-        where: { role: 'assistant', isRead: false },
+        where: { role: 'assistant', isRead: false, conversation: readableConversations(owners) },
     });
 }
-export async function markAiMessagesRead(messageIds) {
+export async function markAiMessagesRead(messageIds, owners) {
     const db = getDb();
     const result = await db.aiMessage.updateMany({
-        where: { id: { in: messageIds }, isRead: false },
+        where: { id: { in: messageIds }, isRead: false, conversation: readableConversations(owners) },
         data: { isRead: true, readAt: new Date() },
     });
     return result.count;
@@ -2435,7 +2461,7 @@ export async function chatStream(request, onEvent) {
     catch (err) {
         onEvent({
             event: 'error',
-            data: { message: err instanceof Error ? err.message : 'Unknown streaming error' },
+            data: { message: clientErrorMessage(err, 'Unknown streaming error') },
         });
     }
 }

package/dist/services/ai-tools.js

@@ -15,11 +15,14 @@ import { logAuditEvent } from './audit-service.js';
 import { listSkills, getSkill, getSkillFile, createSkill } from './skill-service.js';
 import { NodeApiClient } from '../sdk/node-api-client.js';
 import { getNodeBaseUrl } from '../utils/node-url.js';
+import { SENTINEL_NODE_IDS } from '../utils/sentinel-nodes.js';
+import { clientErrorMessage } from '../utils/safe-errors.js';
 import { getNodeManagerSecret } from '../utils/env.js';
 import { correlateAnomalies, getAnomalyTimeline } from './ai-correlation-service.js';
 import { getHiveMemClient } from './hivemem-client.js';
 import { aliasScratchpadEntry, compareScratchpadSnapshots, listScratchpadEntries, setScratchpadEntry, transformScratchpadData, } from './ai-scratchpad-service.js';
 import { getDependencyHealth, getFleetReadiness, getFleetTimeline, getPredictiveMaintenance, getIncidentSummary, classifyRemediationPlan, getHermesEffectiveState, getPackageSecurityPosture, } from './ops-service.js';
+import { nodeMetadataForRole } from './secret-views.js';
 import { getCodexFleetPosture } from './codex-service.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const WORKSPACE_ROOT = resolve(__dirname, '../..');
@@ -63,6 +66,7 @@ function parseWazuhPosture(value) {
 registerTool('getFleetStatus', async () => {
     const db = getDb();
     const nodes = await db.node.findMany({
+        where: { id: { notIn: SENTINEL_NODE_IDS } },
         orderBy: { name: 'asc' },
         select: {
             id: true,
@@ -168,6 +172,7 @@ registerTool('getNodeHealth', async (args) => {
 registerTool('getWazuhFleetStatus', async () => {
     const db = getDb();
     const nodes = await db.node.findMany({
+        where: { id: { notIn: SENTINEL_NODE_IDS } },
         orderBy: { name: 'asc' },
         select: {
             id: true,
@@ -206,6 +211,7 @@ registerTool('getWazuhFleetStatus', async () => {
 registerTool('getSystemUpdateFleetStatus', async () => {
     const db = getDb();
     const nodes = await db.node.findMany({
+        where: { id: { notIn: SENTINEL_NODE_IDS } },
         orderBy: { name: 'asc' },
         select: {
             id: true, name: true, hostname: true, status: true, lastHeartbeatAt: true,
@@ -569,7 +575,7 @@ registerTool('searchNodes', async (args) => {
     const status = args['status'] ? String(args['status']).toUpperCase() : undefined;
     if (!query && !status)
         return { error: 'query or status is required' };
-    const where = {};
+    const where = { id: { notIn: SENTINEL_NODE_IDS } };
     if (status)
         where['status'] = status;
     if (query) {
@@ -648,10 +654,10 @@ registerTool('getSkills', async () => {
 registerTool('getDashboardStats', async () => {
     const db = getDb();
     const [totalNodes, onlineNodes, offlineNodes, degradedNodes, totalCommands, runningCommands, pendingCommands, totalCronJobs, activeCronJobs,] = await Promise.all([
-        db.node.count(),
-        db.node.count({ where: { status: 'ONLINE' } }),
-        db.node.count({ where: { status: 'OFFLINE' } }),
-        db.node.count({ where: { status: 'DEGRADED' } }),
+        db.node.count({ where: { id: { notIn: SENTINEL_NODE_IDS } } }),
+        db.node.count({ where: { id: { notIn: SENTINEL_NODE_IDS }, status: 'ONLINE' } }),
+        db.node.count({ where: { id: { notIn: SENTINEL_NODE_IDS }, status: 'OFFLINE' } }),
+        db.node.count({ where: { id: { notIn: SENTINEL_NODE_IDS }, status: 'DEGRADED' } }),
         db.remoteCommand.count(),
         db.remoteCommand.count({ where: { status: 'RUNNING' } }),
         db.remoteCommand.count({ where: { status: 'PENDING' } }),
@@ -729,7 +735,8 @@ registerTool('getNodeDetails', async (args) => {
         os: node.os,
         arch: node.arch,
         tags: node.tags ? JSON.parse(node.tags) : [],
-        metadata: node.metadata ? JSON.parse(node.metadata) : {},
+        // Tool results reach a model provider and stored conversations whatever the caller's role.
+        metadata: node.metadata ? JSON.parse(nodeMetadataForRole(node.metadata, 'VIEWER')) : {},
         lastHeartbeatAt: node.lastHeartbeatAt?.toISOString() ?? null,
         createdAt: node.createdAt.toISOString(),
         updatedAt: node.updatedAt.toISOString(),
@@ -1182,7 +1189,7 @@ registerTool('executeNaturalCommand', async (args) => {
     else {
         // If no node specified, try to extract from intent text
         const nodes = await db.node.findMany({
-            where: { status: 'ONLINE' },
+            where: { id: { notIn: SENTINEL_NODE_IDS }, status: 'ONLINE' },
             select: { id: true, name: true, hostname: true },
         });
         for (const n of nodes) {
@@ -1332,7 +1339,7 @@ export async function executeAiTool(call) {
             name: call.name,
             success: false,
             result: null,
-            error: err instanceof Error ? err.message : 'Tool execution failed',
+            error: clientErrorMessage(err, 'Tool execution failed'),
         };
     }
 }