@hivemagnus/magnus-server 2.0.0 → 2.1.0

package/dist/services/ardent-scope-enrollment.js

@@ -3,7 +3,7 @@ import { createHash, createHmac, timingSafeEqual } from 'node:crypto';
 import { z } from 'zod';
 import { getDb } from '../db/index.js';
 import { HttpError } from '../middleware/error-handler.js';
-import { apiDrainAttestationSchema, apiDrainAttestationSigningPayload, canonical, dashboardEnrollmentSecret, drainReceiptSchema, enrollmentSigningPayload } from './resource-enrollment.js';
+import { apiDrainAttestationSchema, apiDrainAttestationSigningPayload, canonical, assertDashboardStillAbsent, dashboardReceiptKey, drainReceiptSchema, enrollmentSigningPayload } from './resource-enrollment.js';
 import { lockResourceNode, resourceNodeIdentity } from './resource-node-lock.js';
 import { reconciliationSecret } from './resource-participant-work.js';
 import { RESULT_SIGNING_SECRET } from '../utils/env.js';
@@ -52,8 +52,10 @@ async function receiptHashes(tx, nodeId, nodeFqdn, epoch, barrierId) {
             fail();
         }
         const { signature, ...unsigned } = receipt;
+        if (participant === 'dashboard')
+            await assertDashboardStillAbsent(tx, nodeId);
         const key = participant === 'api' ? reconciliationSecret()
-            : participant === 'dashboard' ? dashboardEnrollmentSecret() : RESULT_SIGNING_SECRET;
+            : participant === 'dashboard' ? dashboardReceiptKey() : RESULT_SIGNING_SECRET;
         const payload = participant === 'api'
             ? apiDrainAttestationSigningPayload(unsigned)
             : enrollmentSigningPayload(unsigned);

package/dist/services/forecast-service.js

@@ -1,4 +1,5 @@
 import { getDb } from '../db/index.js';
+import { SENTINEL_NODE_IDS } from '../utils/sentinel-nodes.js';
 function linearRegression(points) {
     const n = points.length;
     if (n < 2)
@@ -10,13 +11,17 @@ function linearRegression(points) {
     const denom = n * sumX2 - sumX ** 2;
     if (denom === 0)
         return { slope: 0, intercept: sumY / n, r2: 0 };
-    const slope = (n * sumXY - sumX * sumY) / denom;
-    const intercept = (sumY - slope * sumX) / n;
     // R² for confidence
     const yMean = sumY / n;
     const ssTot = points.reduce((a, p) => a + (p.y - yMean) ** 2, 0);
+    // Identical samples have no trend. The formula below would still answer with a
+    // rounding residue, which reads as a tiny growth rate at full confidence.
     if (ssTot === 0)
-        return { slope, intercept, r2: 1 };
+        return { slope: 0, intercept: yMean, r2: 1 };
+    const slope = (n * sumXY - sumX * sumY) / denom;
+    const intercept = (sumY - slope * sumX) / n;
+    if (!Number.isFinite(slope))
+        return { slope: 0, intercept: yMean, r2: 0 };
     const ssRes = points.reduce((a, p) => a + (p.y - (slope * p.x + intercept)) ** 2, 0);
     const r2 = 1 - ssRes / ssTot;
     return { slope, intercept, r2 };
@@ -26,6 +31,10 @@ const MS_PER_DAY = 86_400_000;
 const MIN_DATA_POINTS = 3;
 const MIN_FORECAST_CONFIDENCE = 0.25;
 const DEFAULT_LOOKBACK_DAYS = 30;
+/** Samples closer together than this are a burst, not a growth trend. */
+const MIN_TREND_SPAN_MS = 60 * 60 * 1000;
+/** A fill date further out than this says nothing useful, and far enough out it is not a valid Date at all. */
+const MAX_FORECAST_DAYS = 36_500;
 const SYSTEM_MOUNT_PREFIXES = ['/boot', '/snap', '/var/lib/docker/', '/var/lib/containers/'];
 const READ_ONLY_FILESYSTEMS = new Set(['iso9660', 'squashfs']);
 function isForecastableVolume(disk) {
@@ -103,15 +112,20 @@ export async function forecastDisk(nodeId, lookbackDays = DEFAULT_LOOKBACK_DAYS)
             x: (s.timestamp - t0) / MS_PER_DAY,
             y: s.usedBytes,
         }));
-        const reg = linearRegression(points);
+        const reg = latest.timestamp - t0 >= MIN_TREND_SPAN_MS
+            ? linearRegression(points)
+            : { slope: 0, intercept: latest.usedBytes, r2: 0 };
         const growthRatePerDay = reg.slope; // bytes per day
         let estimatedFullDate = null;
         let daysUntilFull = null;
         if (growthRatePerDay > 0 && reg.r2 >= MIN_FORECAST_CONFIDENCE) {
-            const availableBytes = totalBytes - latest.usedBytes;
-            daysUntilFull = Math.ceil(availableBytes / growthRatePerDay);
-            const fullDate = new Date(Date.now() + daysUntilFull * MS_PER_DAY);
-            estimatedFullDate = fullDate.toISOString().split('T')[0] ?? null;
+            const availableBytes = Math.max(0, totalBytes - latest.usedBytes);
+            const days = Math.ceil(availableBytes / growthRatePerDay);
+            if (days <= MAX_FORECAST_DAYS) {
+                daysUntilFull = days;
+                const fullDate = new Date(Date.now() + days * MS_PER_DAY);
+                estimatedFullDate = fullDate.toISOString().split('T')[0] ?? null;
+            }
         }
         forecasts.push({
             mountPoint,
@@ -129,6 +143,7 @@ export async function forecastDisk(nodeId, lookbackDays = DEFAULT_LOOKBACK_DAYS)
 export async function forecastAtRisk(daysThreshold = 30) {
     const db = getDb();
     const nodes = await db.node.findMany({
+        where: { id: { notIn: SENTINEL_NODE_IDS } },
         select: { id: true, hostname: true },
     });
     const results = [];

package/dist/services/ops-service.js

@@ -9,6 +9,8 @@ import { getRateLimitHealth } from '../middleware/rate-limit.js';
 import { listHermesInstallations } from './hermes-service.js';
 import { getHealthRetentionCutoffs, getHealthRetentionPolicy, getRetentionPolicyReadiness } from './health-retention.js';
 import { getNotificationRetentionPolicy } from './notification-retention.js';
+import { SENTINEL_NODE_IDS } from '../utils/sentinel-nodes.js';
+import { databaseFailure, describeTransportFailure } from '../utils/safe-errors.js';
 const STALE_THRESHOLD_MS = Number(process.env['STALE_NODE_THRESHOLD_MS'] ?? 120_000);
 function fingerprint(value) {
     if (!value)
@@ -24,26 +26,10 @@ async function timed(fn) {
     catch (err) {
         return {
             latencyMs: Math.round((performance.now() - started) * 100) / 100,
-            error: err instanceof Error ? err.message : String(err),
+            error: databaseFailure(err)?.message ?? describeTransportFailure(err),
         };
     }
 }
-function describeDependencyError(error) {
-    if (!(error instanceof Error))
-        return String(error);
-    const cause = error.cause;
-    if (cause && typeof cause === 'object') {
-        const code = 'code' in cause && typeof cause.code === 'string' ? cause.code : undefined;
-        const message = 'message' in cause && typeof cause.message === 'string' ? cause.message : undefined;
-        if (code && message)
-            return `${error.message} (${code}: ${message})`;
-        if (code)
-            return `${error.message} (${code})`;
-        if (message)
-            return `${error.message} (${message})`;
-    }
-    return error.message;
-}
 export function resolveRouterHealthUrl(routerUrl, explicitHealthUrl) {
     if (explicitHealthUrl)
         return explicitHealthUrl;
@@ -70,7 +56,7 @@ export async function checkHttp(name, url, timeoutMs = 2500) {
         return {
             name,
             status: 'warn',
-            message: describeDependencyError(error),
+            message: describeTransportFailure(error),
             latencyMs: Math.round((performance.now() - started) * 100) / 100,
         };
     }
@@ -143,10 +129,17 @@ export async function getDependencyHealth() {
     const status = failCount > 0 ? 'unhealthy' : warnCount > 0 ? 'degraded' : 'healthy';
     return { status, checks, generatedAt: new Date().toISOString() };
 }
-export async function getFleetReadiness() {
+/**
+ * Fleet readiness. Secret fingerprints are opt-in, and only an ADMIN response
+ * asks for them: every other caller, including assistant tools and MCP, sees
+ * whether a node's credential is current without the value that identifies it.
+ */
+export async function getFleetReadiness(options = {}) {
+    const includeSecretFingerprints = options.includeSecretFingerprints === true;
     const db = getDb();
     const [nodes, latestHealthSnapshots] = await withReadRetry('fleet readiness', () => Promise.all([
         db.node.findMany({
+            where: { id: { notIn: SENTINEL_NODE_IDS } },
             orderBy: { name: 'asc' },
             include: {
                 agent: true,
@@ -171,10 +164,12 @@ export async function getFleetReadiness() {
     return {
         generatedAt: new Date().toISOString(),
         thresholds: { staleNodeMs: STALE_THRESHOLD_MS },
-        expectedFingerprints: {
-            nodeManagerSecret: fingerprint(getNodeManagerSecret()),
-            apiSecret: fingerprint(API_SECRET),
-        },
+        ...(includeSecretFingerprints ? {
+            expectedFingerprints: {
+                nodeManagerSecret: fingerprint(getNodeManagerSecret()),
+                apiSecret: fingerprint(API_SECRET),
+            },
+        } : {}),
         nodes: nodes.map((node) => {
             const heartbeatAgeMs = node.lastHeartbeatAt ? now - node.lastHeartbeatAt.getTime() : null;
             const stale = heartbeatAgeMs === null || heartbeatAgeMs > STALE_THRESHOLD_MS;
@@ -217,9 +212,9 @@ export async function getFleetReadiness() {
                     lastDetectedAt: hermes.lastDetectedAt?.toISOString() ?? null,
                 } : null,
                 secretFingerprint: {
-                    expectedNodeManagerSecret,
-                    observedNodeManagerSecret,
+                    ...(includeSecretFingerprints ? { expectedNodeManagerSecret, observedNodeManagerSecret } : {}),
                     match: observedNodeManagerSecret === null ? 'unknown' : observedNodeManagerSecret === expectedNodeManagerSecret ? 'match' : 'mismatch',
+                    state: typeof metadata['nodeManagerSecretState'] === 'string' ? metadata['nodeManagerSecretState'] : 'unknown',
                 },
             };
         }),

package/dist/services/prediction-service.js

@@ -8,6 +8,7 @@
  * Run after each heartbeat, alongside the existing z-score anomaly detection.
  */
 import { getDb } from '../db/index.js';
+import { SENTINEL_NODE_IDS } from '../utils/sentinel-nodes.js';
 import { createNotification } from './notification-service.js';
 import { eventBus, EventChannels } from './event-bus.js';
 // ── Configuration ──
@@ -249,7 +250,7 @@ export async function getNodePredictions(nodeId) {
 export async function getFleetPredictions() {
     const db = getDb();
     const nodes = await db.node.findMany({
-        where: { status: 'ONLINE' },
+        where: { id: { notIn: SENTINEL_NODE_IDS }, status: 'ONLINE' },
         select: { id: true, name: true, hostname: true },
     });
     const atRisk = [];

package/dist/services/resource-enrollment.js

@@ -45,6 +45,26 @@ export function dashboardEnrollmentSecret() {
         throw new HttpError(503, 'RESOURCE_PARTICIPANT_UNCONFIGURED', 'Dedicated dashboard participant credential is required');
     return key;
 }
+/** Who answers console drain challenges. Anything but an explicit `absent` needs a real gateway. */
+export function dashboardParticipantAbsent() {
+    return process.env['RESOURCE_ENROLLMENT_DASHBOARD_PARTICIPANT'] === 'absent';
+}
+/**
+ * The key that signs stored console evidence. In absent mode no participant exists to hold a shared
+ * key, so this server signs its own finding. Changing mode invalidates evidence from the other mode.
+ */
+export function dashboardReceiptKey() {
+    if (!dashboardParticipantAbsent())
+        return dashboardEnrollmentSecret();
+    if (RESULT_SIGNING_SECRET.length < 32)
+        throw new HttpError(503, 'RESOURCE_PARTICIPANT_UNCONFIGURED', 'Result signing credential is required');
+    return RESULT_SIGNING_SECRET;
+}
+/** Absent mode holds only while no console work was ever recorded on this node, in any state. */
+export async function assertDashboardStillAbsent(tx, nodeId) {
+    if (dashboardParticipantAbsent() && await tx.resourceParticipantWork.count({ where: { nodeId, participant: 'dashboard' } }))
+        fail('RESOURCE_DRAIN_INCOMPLETE', 'Console work exists on this node, so the console participant cannot be declared absent');
+}
 export function verifyDashboardCredential(token) {
     const expected = dashboardEnrollmentSecret();
     const received = Buffer.from(token);
@@ -243,6 +263,8 @@ export async function refreshEnrollmentParticipant(nodeId, participant) {
     if (participant === 'api')
         return { participant, status: 'pending', reason: 'signed-reviewed-evidence-required',
             descriptor: prepared.descriptor };
+    if (participant === 'dashboard' && dashboardParticipantAbsent())
+        return recordAbsentDashboard(nodeId, prepared.descriptor);
     let receipt;
     try {
         let url;
@@ -260,10 +282,16 @@ export async function refreshEnrollmentParticipant(nodeId, participant) {
         }
         else {
             key = dashboardEnrollmentSecret();
-            const origin = new URL(process.env['DASHBOARD_PUBLIC_ORIGIN'] ?? '');
+            let origin;
+            try {
+                origin = new URL(process.env['FLEET_GATEWAY_URL'] ?? '');
+            }
+            catch {
+                throw new ParticipantEvidenceError('gateway-origin-unavailable');
+            }
             if (origin.protocol !== 'https:' || origin.username || origin.password || origin.pathname !== '/' || origin.search || origin.hash)
-                throw new ParticipantEvidenceError('dashboard-origin-unavailable');
-            url = origin.origin + '/api/internal/resource-enrollment/drain';
+                throw new ParticipantEvidenceError('gateway-origin-unavailable');
+            url = origin.origin + '/internal/resource-enrollment/drain';
             headers = { 'x-resource-drain-key': key };
         }
         const response = await fetch(url, { method: 'POST', redirect: 'error', signal: AbortSignal.timeout(participant !== 'dashboard' ? 25_000 : 5_000),
@@ -316,6 +344,29 @@ export async function refreshEnrollmentParticipant(nodeId, participant) {
                     && !schedulerUnsettled && !central.activeCount && !central.unknownCount ? 'reviewed-boundary-required' : 'unsettled-work' };
     });
 }
+/** No participant exists to ask, so this server records what its own ledger shows, or refuses. */
+async function recordAbsentDashboard(nodeId, descriptor) {
+    const key = dashboardReceiptKey();
+    return getDb().$transaction(async (tx) => {
+        await lockResourceNode(tx, nodeId);
+        const { row } = await identity(tx, nodeId);
+        const ack = await tx.resourceDrainParticipant.findUnique({ where: { nodeId_participant: { nodeId, participant: 'dashboard' } } });
+        if (row?.state !== 'draining' || row.epoch !== descriptor.epoch || row.barrierId !== descriptor.barrierId || ack?.challengeId !== descriptor.challengeId)
+            fail('RESOURCE_DRAIN_STALE', 'Participant evidence no longer matches the current drain');
+        if (await tx.resourceParticipantWork.count({ where: { nodeId, participant: 'dashboard' } })) {
+            failures.set(`${nodeId}\ndashboard`, { participant: 'dashboard', cause: 'dashboard-work-exists', agentCode: null, agentReason: null, at: new Date().toISOString() });
+            return { participant: 'dashboard', status: 'pending', reason: 'dashboard-work-exists' };
+        }
+        failures.delete(`${nodeId}\ndashboard`);
+        const { evidenceSha256 } = await participantSnapshot(tx, nodeId, 'dashboard');
+        const unsigned = { ...descriptor, status: 'drained', activeCount: 0, unknownCount: 0, evidenceSha256 };
+        const receipt = { ...unsigned, signature: createHmac('sha256', key).update(enrollmentSigningPayload(unsigned)).digest('hex') };
+        await tx.resourceDrainParticipant.update({ where: { nodeId_participant: { nodeId, participant: 'dashboard' } }, data: {
+                status: 'verified', evidenceSha256, receiptJson: JSON.stringify(receipt), verifiedAt: new Date()
+            } });
+        return { participant: 'dashboard', status: 'verified', reason: 'declared-absent-no-work' };
+    });
+}
 export async function acceptSchedulerBoundaryAttestation(nodeId, raw) {
     const assertion = schedulerBoundaryAttestationSchema.parse(raw);
     const { signature, ...unsigned } = assertion;
@@ -449,7 +500,9 @@ export async function completeEnrollment(nodeId) {
                 fail('RESOURCE_DRAIN_INCOMPLETE', 'Stored participant receipt is unavailable');
             }
             const { signature, ...unsigned } = receipt;
-            const key = participant === 'dashboard' ? dashboardEnrollmentSecret()
+            if (participant === 'dashboard')
+                await assertDashboardStillAbsent(tx, nodeId);
+            const key = participant === 'dashboard' ? dashboardReceiptKey()
                 : participant === 'api' ? reconciliationSecret() : RESULT_SIGNING_SECRET;
             const payload = participant === 'api'
                 ? apiDrainAttestationSigningPayload(unsigned)

package/dist/services/secret-views.js

@@ -0,0 +1,72 @@
+/**
+ * What each role may see of values written to hosts and of secret fingerprints.
+ * Below ADMIN a response names environment keys but never carries their values,
+ * and reports a credential's state but never its fingerprint.
+ */
+function parseRecord(raw) {
+    try {
+        const value = JSON.parse(raw);
+        return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+    }
+    catch {
+        return {};
+    }
+}
+export function environmentKeys(raw) {
+    return Object.keys(parseRecord(raw)).sort();
+}
+/**
+ * Apply a non-admin's edit to stored environment values. Such a client only ever
+ * saw key names, so a key it left out or left blank means "unchanged", not
+ * "delete". Sending back a redacted response therefore cannot wipe a value, and
+ * removing a key takes an ADMIN, who can see what is being removed.
+ */
+export function mergeEnvironmentEdit(existing, incoming) {
+    const merged = {};
+    for (const [key, value] of Object.entries(parseRecord(existing))) {
+        if (typeof value === 'string')
+            merged[key] = value;
+    }
+    for (const [key, value] of Object.entries(incoming)) {
+        if (value === '' && key in merged)
+            continue;
+        merged[key] = value;
+    }
+    return merged;
+}
+const FINGERPRINT_METADATA_KEYS = ['nodeManagerSecretFingerprint'];
+/** Node metadata as a JSON string, with secret fingerprints removed below ADMIN. */
+export function nodeMetadataForRole(metadata, role) {
+    if (role === 'ADMIN')
+        return metadata;
+    if (!FINGERPRINT_METADATA_KEYS.some((key) => metadata.includes(key)))
+        return metadata;
+    const visible = parseRecord(metadata);
+    for (const key of FINGERPRINT_METADATA_KEYS)
+        delete visible[key];
+    return JSON.stringify(visible);
+}
+/** A node row for a response: never its token, and metadata fit for the role. */
+export function nodeForRole(node, role) {
+    const { token: _token, ...safe } = node;
+    return { ...safe, metadata: nodeMetadataForRole(node.metadata, role) };
+}
+/** A cron job for a response: environment values for ADMIN, key names for everyone. */
+export function cronJobForRole(job, role) {
+    const { environment, ...rest } = job;
+    return {
+        ...rest,
+        ...(role === 'ADMIN' ? { environment } : {}),
+        environmentKeys: environmentKeys(environment),
+    };
+}
+/** A Hermes profile for a response: whether a key is set, and its fingerprint only for ADMIN. */
+export function hermesProfileForRole(profile, role) {
+    const { apiServerKeyFingerprint, ...rest } = profile;
+    return {
+        ...rest,
+        ...(role === 'ADMIN' ? { apiServerKeyFingerprint: apiServerKeyFingerprint ?? null } : {}),
+        apiServerKeyConfigured: Boolean(apiServerKeyFingerprint),
+    };
+}
+//# sourceMappingURL=secret-views.js.map

package/dist/services/topology-service.js

@@ -8,6 +8,7 @@
  * - Gateway detection (subnet with most cross-subnet connections)
  */
 import { getDb } from '../db/index.js';
+import { SENTINEL_NODE_IDS } from '../utils/sentinel-nodes.js';
 import { connect } from 'node:net';
 // ── Helpers ──
 function getSubnet(ip) {
@@ -61,7 +62,7 @@ function probeNode(host, port, timeoutMs = 3000) {
 export async function scanTopology(probeTimeoutMs = 3000) {
     const db = getDb();
     const nodes = await db.node.findMany({
-        where: { status: { not: 'DECOMMISSIONED' } },
+        where: { id: { notIn: SENTINEL_NODE_IDS }, status: { not: 'DECOMMISSIONED' } },
         select: { id: true, name: true, hostname: true, ipAddress: true, port: true, status: true, lastHeartbeatAt: true },
     });
     // Probe all nodes concurrently

package/dist/services/webhook-security.js

@@ -107,6 +107,15 @@ function tailnetPins(origin) {
     const pins = entries[origin];
     return pins ? new Set(pins) : undefined;
 }
+/** The one refusal that is safe and useful to explain: it names a setting, and no address or allowlist entry. */
+export class WebhookOriginNotAllowedError extends Error {
+    constructor(allowlistIsEmpty) {
+        super(allowlistIsEmpty
+            ? 'Webhook target origin is not allowlisted: no webhook can be created until WEBHOOK_ALLOWED_ORIGINS is set on the control API. Set it to a comma-separated list of exact HTTPS origins, such as https://hooks.example.com, and restart the server.'
+            : 'Webhook target origin is not allowlisted. Add its exact HTTPS origin to WEBHOOK_ALLOWED_ORIGINS on the control API and restart the server.');
+        this.name = 'WebhookOriginNotAllowedError';
+    }
+}
 export function createPinnedWebhookLookup(target) {
     return (_hostname, options, callback) => {
         if (options.all) {
@@ -134,7 +143,7 @@ async function resolveWebhookTarget(rawUrl, options = {}) {
     url.hostname = hostname;
     const allowlist = allowedOrigins(options.allowedOriginsRaw);
     if (!allowlist.has(canonicalOrigin(url))) {
-        throw new Error('Webhook target origin is not allowlisted');
+        throw new WebhookOriginNotAllowedError(allowlist.size === 0);
     }
     const pins = tailnetPins(canonicalOrigin(url));
     let addresses;

package/dist/services/webhook-service.js

@@ -1,6 +1,10 @@
+import { consolePagePath } from '../config/console-path.js';
+import { bullQueueIdentity } from '../queue/names.js';
+import { assertLiveExecution } from '../config/rehearsal.js';
 import { recordMonitorPulse } from './monitor-pulse.js';
 import { WEBHOOK_FORMATS, webhookFormat } from './webhook-types.js';
 import { redactUnknown } from '../utils/redact.js';
+import { clientErrorMessage } from '../utils/safe-errors.js';
 import { createHmac, randomBytes, createCipheriv } from 'node:crypto';
 import { nanoid } from 'nanoid';
 import { Queue, Worker } from 'bullmq';
@@ -10,7 +14,7 @@ import { isEncryptedWebhookCredential, decryptWebhookCredential, encryptWebhookC
 // ─── Webhook Service — dispatch, deliver, retry ───
 const REDIS_URL = process.env['REDIS_URL'] ?? 'redis://127.0.0.1:6379';
 const REDIS_PREFIX = process.env['REDIS_PREFIX'] ?? 'magnus-';
-const WEBHOOK_QUEUE = `${REDIS_PREFIX}webhooks`;
+const WEBHOOK_QUEUE = bullQueueIdentity(REDIS_PREFIX, 'webhooks');
 const PROTECTED_HEADERS = new Set([
     'connection', 'content-length', 'host', 'transfer-encoding', 'user-agent',
     'x-magnus-delivery', 'x-magnus-encrypted', 'x-magnus-event', 'x-magnus-signature',
@@ -21,8 +25,9 @@ let _webhookQueue = null;
 let _webhookWorker = null;
 /** Get the singleton webhook queue instance. */
 export function getWebhookQueue() {
+    assertLiveExecution();
     if (!_webhookQueue) {
-        _webhookQueue = new Queue(WEBHOOK_QUEUE, { connection: { url: REDIS_URL } });
+        _webhookQueue = new Queue(WEBHOOK_QUEUE.name, { prefix: WEBHOOK_QUEUE.prefix, connection: { url: REDIS_URL } });
     }
     return _webhookQueue;
 }
@@ -177,8 +182,9 @@ export function formatPayload(type, event, payload) {
         if (origin) {
             try {
                 const parsed = new URL(origin);
-                if (parsed.protocol === 'https:' && !parsed.username && !parsed.password)
-                    link = `${parsed.origin}/incidents`;
+                const page = consolePagePath('/incidents');
+                if (page && parsed.protocol === 'https:' && !parsed.username && !parsed.password)
+                    link = `${parsed.origin}${page}`;
             }
             catch { /* no link */ }
         }
@@ -230,11 +236,12 @@ export async function claimMattermostAttempt(deliveryId) {
 }
 /** Start the webhook delivery worker. */
 export function startWebhookWorker() {
+    assertLiveExecution();
     if (_webhookWorker)
         return _webhookWorker;
     // Force the dedicated at-rest key to be present before accepting queued work.
     encryptWebhookCredential('', 'startup-check', 'secret');
-    const worker = new Worker(WEBHOOK_QUEUE, async (job) => {
+    const worker = new Worker(WEBHOOK_QUEUE.name, async (job) => {
         const db = getDb();
         const deliveryId = job.id;
         if (!deliveryId)
@@ -304,6 +311,7 @@ export function startWebhookWorker() {
     }, {
         connection: { url: REDIS_URL },
         concurrency: 5,
+        prefix: WEBHOOK_QUEUE.prefix,
     });
     worker.on('failed', (job, err) => {
         console.error(`[webhook-worker] Job ${job?.id} failed: ${err.message}`);
@@ -466,7 +474,7 @@ export async function testWebhookEndpoint(id) {
         return { success: res.ok, error: res.ok ? undefined : `HTTP ${res.status}` };
     }
     catch (err) {
-        return { success: false, error: err instanceof Error ? err.message : 'Unknown error' };
+        return { success: false, error: clientErrorMessage(err, 'Unknown error') };
     }
 }
 /**

package/dist/utils/node-url.js

@@ -9,7 +9,8 @@ import { isIP } from 'node:net';
 export function getNodeBaseUrl(ipAddress, port) {
     const useTls = process.env['TLS_CERT_PATH'] && process.env['TLS_KEY_PATH'];
     const protocol = useTls ? 'https' : 'http';
-    return `${protocol}://${ipAddress}:${port}`;
+    const host = ipAddress.includes(':') && !ipAddress.startsWith('[') ? `[${ipAddress}]` : ipAddress;
+    return `${protocol}://${host}:${port}`;
 }
 const DNS_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 /**

package/dist/utils/safe-errors.js

@@ -0,0 +1,130 @@
+/**
+ * Turns database and transport failures into text that is safe to send to a client.
+ *
+ * Prisma messages quote the failing call, its arguments, constraint names and the
+ * database address. Socket errors quote the peer's address, and `fetch` reports
+ * only "fetch failed". None of that belongs in a response, so the text here comes
+ * from fixed tables and never from the error's own message.
+ */
+const INVALID = { status: 400, code: 'VALIDATION_ERROR', message: 'The request contains an invalid value.' };
+const NOT_FOUND = { status: 404, code: 'NOT_FOUND', message: 'The requested record was not found.' };
+const IN_USE = { status: 409, code: 'CONFLICT', message: 'The change refers to a record that does not exist or is still in use.' };
+const UNAVAILABLE = { status: 503, code: 'DATABASE_UNAVAILABLE', message: 'The database is temporarily unavailable. Try again shortly.' };
+const UNEXPECTED = { status: 500, code: 'INTERNAL_ERROR', message: 'An unexpected error occurred' };
+const DATABASE_FAILURES = {
+    P2000: INVALID, P2005: INVALID, P2006: INVALID, P2007: INVALID, P2011: INVALID, P2012: INVALID, P2019: INVALID, P2020: INVALID, P2023: INVALID,
+    P2001: NOT_FOUND, P2015: NOT_FOUND, P2018: NOT_FOUND, P2025: NOT_FOUND,
+    P2003: IN_USE, P2014: IN_USE,
+    P2024: UNAVAILABLE, P2034: UNAVAILABLE, P2037: UNAVAILABLE,
+};
+const PRISMA_ERROR_NAME = /^PrismaClient(?:KnownRequest|UnknownRequest|Initialization|Validation|RustPanic)Error$|^DriverAdapterError$/u;
+/** Prisma text that reached a message through a wrapper, such as a route catching "not found". */
+const PRISMA_TEXT = /Invalid `[^`]+` invocation|PrismaClient|Unique constraint failed|Foreign key constraint|Can't reach database server|required but not found/iu;
+function errorProperty(error, key) {
+    return error && typeof error === 'object' && key in error ? error[key] : undefined;
+}
+function isPrismaError(error) {
+    const code = errorProperty(error, 'code');
+    return (typeof code === 'string' && /^P\d{4}$/u.test(code))
+        || (typeof errorProperty(error, 'name') === 'string' && PRISMA_ERROR_NAME.test(errorProperty(error, 'name')));
+}
+const words = (name) => name.replace(/(?<=[a-z])(?=[A-Z])/gu, ' ').toLowerCase();
+/** `HermesCredentialPool` becomes `hermes credential pool`. */
+function modelLabel(error) {
+    const name = errorProperty(errorProperty(error, 'meta'), 'modelName');
+    return typeof name === 'string' && /^[A-Za-z]+$/u.test(name)
+        ? words(name)
+        : null;
+}
+/**
+ * The columns of a violated unique constraint. The PostgreSQL adapter reports only the
+ * index, named `<table>_<columns>_key`. Other paths report the columns themselves.
+ */
+function constraintFields(error) {
+    const meta = errorProperty(error, 'meta');
+    const cause = errorProperty(errorProperty(meta, 'driverAdapterError'), 'cause');
+    const constraint = errorProperty(cause, 'constraint');
+    const listed = errorProperty(constraint, 'fields') ?? errorProperty(meta, 'target');
+    if (Array.isArray(listed))
+        return listed.filter((field) => typeof field === 'string' && /^[A-Za-z_]+$/u.test(field));
+    const index = errorProperty(constraint, 'index');
+    const table = errorProperty(cause, 'table');
+    if (typeof index !== 'string' || typeof table !== 'string' || !index.startsWith(`${table}_`) || !index.endsWith('_key'))
+        return [];
+    const columns = index.slice(table.length + 1, -'_key'.length);
+    return /^[A-Za-z]+(?:_[A-Za-z]+)*$/u.test(columns) ? columns.split('_') : [];
+}
+function duplicateMessage(error) {
+    const label = modelLabel(error);
+    const fields = constraintFields(error).map(words);
+    const subject = label ? `A ${label}` : 'A record';
+    return fields.length > 0 ? `${subject} with this ${fields.join(' and ')} already exists.` : `${subject} with the same unique value already exists.`;
+}
+/** The client's view of a database error, or null for any other error. */
+export function databaseFailure(error) {
+    if (!isPrismaError(error))
+        return null;
+    const name = errorProperty(error, 'name');
+    if (name === 'PrismaClientValidationError')
+        return INVALID;
+    if (name === 'PrismaClientInitializationError')
+        return UNAVAILABLE;
+    const code = errorProperty(error, 'code');
+    if (typeof code !== 'string')
+        return UNEXPECTED;
+    if (code === 'P2002')
+        return { status: 409, code: 'CONFLICT', message: duplicateMessage(error) };
+    if (code.startsWith('P1'))
+        return UNAVAILABLE;
+    return DATABASE_FAILURES[code] ?? UNEXPECTED;
+}
+export function containsDatabaseText(message) {
+    return PRISMA_TEXT.test(message);
+}
+/** An error's own message for a client, unless it is, or quotes, a database error. */
+export function clientErrorMessage(error, fallback) {
+    const failure = databaseFailure(error);
+    if (failure)
+        return failure.message;
+    const message = error instanceof Error ? error.message : '';
+    return message && !containsDatabaseText(message) ? message : fallback;
+}
+const TLS_VERIFICATION = 'its TLS certificate could not be verified';
+const TRANSPORT_FAILURES = {
+    ECONNREFUSED: 'the connection was refused',
+    ECONNRESET: 'the connection was closed unexpectedly',
+    EPIPE: 'the connection was closed unexpectedly',
+    UND_ERR_SOCKET: 'the connection was closed unexpectedly',
+    ETIMEDOUT: 'the connection timed out',
+    UND_ERR_CONNECT_TIMEOUT: 'the connection timed out',
+    UND_ERR_HEADERS_TIMEOUT: 'the response timed out',
+    ENOTFOUND: 'the address could not be resolved',
+    EAI_AGAIN: 'the address could not be resolved',
+    EHOSTUNREACH: 'there is no network route to it',
+    ENETUNREACH: 'there is no network route to it',
+    EPROTO: 'the TLS handshake failed',
+    ERR_SSL_WRONG_VERSION_NUMBER: 'the TLS handshake failed',
+    CERT_HAS_EXPIRED: 'its TLS certificate has expired',
+    DEPTH_ZERO_SELF_SIGNED_CERT: TLS_VERIFICATION,
+    SELF_SIGNED_CERT_IN_CHAIN: TLS_VERIFICATION,
+    UNABLE_TO_VERIFY_LEAF_SIGNATURE: TLS_VERIFICATION,
+    UNABLE_TO_GET_ISSUER_CERT_LOCALLY: TLS_VERIFICATION,
+    ERR_TLS_CERT_ALTNAME_INVALID: TLS_VERIFICATION,
+    EACCES: 'permission was denied',
+    ENOENT: 'the path does not exist',
+};
+/** Why a connection failed, in words that name no host, port, path or URL. */
+export function describeTransportFailure(error) {
+    let current = error;
+    for (let depth = 0; current && depth < 4; depth += 1) {
+        const name = errorProperty(current, 'name');
+        if (name === 'TimeoutError' || name === 'AbortError')
+            return 'the request timed out';
+        const code = errorProperty(current, 'code');
+        if (typeof code === 'string' && TRANSPORT_FAILURES[code])
+            return `${TRANSPORT_FAILURES[code]} (${code})`;
+        current = errorProperty(current, 'cause');
+    }
+    return 'the request failed';
+}
+//# sourceMappingURL=safe-errors.js.map