@hivemagnus/magnus-server 2.0.0 → 2.1.1

package/dist/routes/assistant.js

@@ -24,13 +24,25 @@ import { Hono } from 'hono';
 import { streamSSE } from 'hono/streaming';
 import { authMiddleware, requireRole } from '../middleware/auth.js';
 import { HttpError } from '../middleware/error-handler.js';
-import { chat, chatStream, listConversations, getConversationMessages, getUnreadAiMessageCount, markAiMessagesRead, markConversationRead, archiveConversation, deleteConversation, getHeartbeatPrompt, updateHeartbeatPrompt, resetHeartbeatPrompt, listOllamaModels, getModelContextLength, getAiSettings, updateAiSettings, getModelProfiles, updateModelProfiles, approveToolCall, rejectToolCall, createConversationShare, forkConversation, getSharedConversation, } from '../services/ai-assistant-service.js';
+import { clientErrorMessage } from '../utils/safe-errors.js';
+import { chat, chatStream, listConversations, getConversationMessages, getUnreadAiMessageCount, markAiMessagesRead, markConversationRead, archiveConversation, deleteConversation, getHeartbeatPrompt, updateHeartbeatPrompt, resetHeartbeatPrompt, listOllamaModels, getModelContextLength, getAiSettings, updateAiSettings, getModelProfiles, updateModelProfiles, approveToolCall, rejectToolCall, createConversationShare, forkConversation, getSharedConversation, conversationOwners, getConversationAccess, } from '../services/ai-assistant-service.js';
 import { executeAiTool } from '../services/ai-tools.js';
 import { generateInsights, listPinnedInsights, pinInsight, unpinInsight } from '../services/ai-insights-service.js';
 import { exportConversation } from '../services/ai-export-service.js';
 import { clearScratchpad, listScratchpadEntries } from '../services/ai-scratchpad-service.js';
 export const assistantRouter = new Hono();
 assistantRouter.use('*', authMiddleware);
+const ownersOf = (c) => conversationOwners(c.get('user'));
+/**
+ * A conversation belongs to whoever started it. ADMIN gets no exception, because no
+ * console feature reads other people's conversations. Someone else's answers 404,
+ * so a caller cannot tell it exists.
+ */
+async function requireConversation(c, id, level = 'own') {
+    const access = await getConversationAccess(id, ownersOf(c));
+    if (!access || (level === 'own' && access !== 'owner'))
+        throw new HttpError(404, 'NOT_FOUND', 'Conversation not found');
+}
 // ── Send a chat message ──
 assistantRouter.post('/chat', requireRole('ADMIN', 'OPERATOR'), async (c) => {
     const body = await c.req.json();
@@ -44,6 +56,8 @@ assistantRouter.post('/chat', requireRole('ADMIN', 'OPERATOR'), async (c) => {
         ctxParts.push(`You are the AI assistant for the "${body.controlNodeName}" Control Node (ID: ${body.controlNodeId ?? 'unknown'}). All fleet data you access is from this control node's database. When the user asks about "the fleet" or "nodes", they mean the nodes managed by this control node. Your tools (like getFleetStatus, getNodeHealth, etc.) query this control node's data directly — they do NOT require a fleet ID parameter.`);
         controllerContext = ctxParts.join('\n');
     }
+    if (body.conversationId)
+        await requireConversation(c, body.conversationId);
     const user = c.get('user');
     const result = await chat({
         message: body.message,
@@ -67,28 +81,23 @@ assistantRouter.get('/conversations', async (c) => {
         status: c.req.query('status') ?? 'active',
         page: parseInt(c.req.query('page') ?? '1', 10),
         pageSize: parseInt(c.req.query('pageSize') ?? '20', 10),
+        owners: ownersOf(c),
     });
     return c.json({ success: true, data: result });
 });
 // ── Get conversation messages ──
 assistantRouter.get('/conversations/:id', async (c) => {
     const id = c.req.param('id');
+    await requireConversation(c, id, 'read');
     const result = await getConversationMessages(id, {
         page: parseInt(c.req.query('page') ?? '1', 10),
         pageSize: parseInt(c.req.query('pageSize') ?? '50', 10),
     });
-    if (result.total === 0) {
-        // Check if conversation exists
-        const { getDb } = await import('../db/index.js');
-        const db = getDb();
-        const conv = await db.aiConversation.findUnique({ where: { id } });
-        if (!conv)
-            throw new HttpError(404, 'NOT_FOUND', 'Conversation not found');
-    }
     return c.json({ success: true, data: result });
 });
 assistantRouter.post('/conversations/:id/fork', requireRole('ADMIN', 'OPERATOR'), async (c) => {
     const id = c.req.param('id');
+    await requireConversation(c, id, 'read');
     const body = (await c.req.json().catch(() => ({})));
     const user = c.get('user');
     try {
@@ -107,6 +116,7 @@ assistantRouter.post('/conversations/:id/fork', requireRole('ADMIN', 'OPERATOR')
 });
 assistantRouter.post('/conversations/:id/share', requireRole('ADMIN', 'OPERATOR'), async (c) => {
     const id = c.req.param('id');
+    await requireConversation(c, id);
     const body = (await c.req.json().catch(() => ({})));
     const user = c.get('user');
     try {
@@ -123,6 +133,7 @@ assistantRouter.post('/conversations/:id/share', requireRole('ADMIN', 'OPERATOR'
     }
 });
 assistantRouter.get('/conversations/:id/scratchpad', async (c) => {
+    await requireConversation(c, c.req.param('id'), 'read');
     const entries = listScratchpadEntries(c.req.param('id')).map((entry) => ({
         name: entry.name,
         source: entry.source,
@@ -134,6 +145,7 @@ assistantRouter.get('/conversations/:id/scratchpad', async (c) => {
     return c.json({ success: true, data: { entries } });
 });
 assistantRouter.delete('/conversations/:id/scratchpad', requireRole('ADMIN', 'OPERATOR'), async (c) => {
+    await requireConversation(c, c.req.param('id'));
     clearScratchpad(c.req.param('id'));
     return c.json({ success: true });
 });
@@ -147,12 +159,14 @@ assistantRouter.get('/shares/:token', async (c) => {
 // ── Mark conversation as read ──
 assistantRouter.post('/conversations/:id/read', async (c) => {
     const id = c.req.param('id');
+    await requireConversation(c, id, 'read');
     const count = await markConversationRead(id);
     return c.json({ success: true, data: { marked: count } });
 });
 // ── Archive a conversation ──
 assistantRouter.post('/conversations/:id/archive', requireRole('ADMIN', 'OPERATOR'), async (c) => {
     const id = c.req.param('id');
+    await requireConversation(c, id);
     try {
         await archiveConversation(id);
         return c.json({ success: true });
@@ -163,7 +177,7 @@ assistantRouter.post('/conversations/:id/archive', requireRole('ADMIN', 'OPERATO
 });
 // ── Get unread message count ──
 assistantRouter.get('/unread', async (c) => {
-    const count = await getUnreadAiMessageCount();
+    const count = await getUnreadAiMessageCount(ownersOf(c));
     return c.json({ success: true, data: { unread: count } });
 });
 // ── Mark specific messages as read ──
@@ -172,12 +186,13 @@ assistantRouter.post('/messages/read', async (c) => {
     if (!body.messageIds?.length) {
         throw new HttpError(400, 'VALIDATION_ERROR', 'messageIds array is required');
     }
-    const count = await markAiMessagesRead(body.messageIds);
+    const count = await markAiMessagesRead(body.messageIds, ownersOf(c));
     return c.json({ success: true, data: { marked: count } });
 });
 // ── Delete a conversation permanently ──
 assistantRouter.delete('/conversations/:id', requireRole('ADMIN', 'OPERATOR'), async (c) => {
     const id = c.req.param('id');
+    await requireConversation(c, id);
     try {
         await deleteConversation(id);
         return c.json({ success: true });
@@ -236,6 +251,8 @@ assistantRouter.post('/chat/stream', requireRole('ADMIN', 'OPERATOR'), async (c)
         ctxParts.push(`You are the AI assistant for the "${body.controlNodeName}" Control Node (ID: ${body.controlNodeId ?? 'unknown'}).`);
         controllerContext = ctxParts.join('\n');
     }
+    if (body.conversationId)
+        await requireConversation(c, body.conversationId);
     const user = c.get('user');
     return streamSSE(c, async (stream) => {
         try {
@@ -261,7 +278,7 @@ assistantRouter.post('/chat/stream', requireRole('ADMIN', 'OPERATOR'), async (c)
         catch (err) {
             await stream.writeSSE({
                 event: 'error',
-                data: JSON.stringify({ type: 'error', error: err instanceof Error ? err.message : 'Stream failed' }),
+                data: JSON.stringify({ type: 'error', error: clientErrorMessage(err, 'Stream failed') }),
             });
         }
     });
@@ -352,6 +369,7 @@ assistantRouter.post('/messages/:id/confirm', requireRole('ADMIN', 'OPERATOR'),
 // ── Conversation export ──
 assistantRouter.get('/conversations/:id/export', async (c) => {
     const id = c.req.param('id');
+    await requireConversation(c, id, 'read');
     const format = (c.req.query('format') ?? 'markdown');
     if (!['markdown', 'json', 'csv'].includes(format)) {
         throw new HttpError(400, 'VALIDATION_ERROR', 'format must be markdown, json, or csv');

package/dist/routes/console.js

@@ -0,0 +1,33 @@
+import { Hono } from 'hono';
+import { authMiddleware, getUser } from '../middleware/auth.js';
+import { AGENT_VERSION, CONTROL_API_VERSION } from '../config/version.js';
+import { featureFlags } from '../config/features.js';
+import { securityConsoleUrl } from '../services/security-export.js';
+export const consoleRouter = new Hono();
+consoleRouter.use('*', authMiddleware);
+/**
+ * GET /console/session
+ * What a browser console may show this caller. A static page has no server of its
+ * own to read the environment, so this answers what the dashboard derives from
+ * server-side checks and build-time public values.
+ */
+consoleRouter.get('/session', (c) => {
+    const user = getUser(c);
+    c.header('Cache-Control', 'no-store');
+    return c.json({
+        success: true,
+        data: {
+            userId: user.userId,
+            role: user.role,
+            capabilities: {
+                hermes: featureFlags().hermes,
+                // Whether to offer the terminal. The gateway still verifies everything, including step-up.
+                terminal: featureFlags().fleetGateway && user.terminal === true,
+                agentVersion: AGENT_VERSION,
+                magnusVersion: CONTROL_API_VERSION,
+                securityConsoleUrl: securityConsoleUrl() ?? null,
+            },
+        },
+    });
+});
+//# sourceMappingURL=console.js.map

package/dist/routes/cron.js

@@ -2,6 +2,7 @@ import { managedCronRouter } from './managed-cron.js';
 import { canStageLegacyCronForEnrollment, cronMutationMode, finalizeManagedCronRevocation, installManagedCron, registerManagedCron, reconcileForeignSchedulerSource, revokeManagedCron, stageLegacyCronForEnrollment, updateAndRegisterManagedCron } from '../services/managed-cron.js';
 import { managedCronRegistrationSchema, schedulerSourceSettlementSchema } from '../schemas/managed-cron.js';
 import { Hono } from 'hono';
+import { cronJobForRole, mergeEnvironmentEdit, nodeForRole } from '../services/secret-views.js';
 import { getDb } from '../db/index.js';
 import { authMiddleware, getUser, requireRole } from '../middleware/auth.js';
 import { logAuditEvent, sanitizeDetails } from '../services/audit-service.js';
@@ -68,7 +69,8 @@ cronRouter.get('/', async (c) => {
         orderBy: { name: 'asc' },
         include: { node: { select: { name: true } } },
     });
-    return c.json({ success: true, data: jobs });
+    const viewer = getUser(c).role;
+    return c.json({ success: true, data: jobs.map((job) => cronJobForRole(job, viewer)) });
 });
 // ── Get single cron job ──
 cronRouter.get('/:cronId', async (c) => {
@@ -79,7 +81,7 @@ cronRouter.get('/:cronId', async (c) => {
     });
     if (!job)
         throw new HttpError(404, 'NOT_FOUND', 'Cron job not found');
-    return c.json({ success: true, data: job });
+    return c.json({ success: true, data: cronJobForRole(job, getUser(c).role) });
 });
 // ── Create cron job ──
 cronRouter.post('/', requireRole('ADMIN', 'OPERATOR'), async (c) => {
@@ -136,7 +138,7 @@ cronRouter.post('/', requireRole('ADMIN', 'OPERATOR'), async (c) => {
             timeoutSeconds: body.timeoutSeconds ?? 600,
         });
     }
-    return c.json({ success: true, data: job }, 201);
+    return c.json({ success: true, data: cronJobForRole(job, user.role) }, 201);
 });
 cronRouter.post('/scheduler-sources/reconcile', requireRole('ADMIN'), async (c) => {
     const assertion = await parseBody(c, schedulerSourceSettlementSchema);
@@ -209,7 +211,7 @@ cronRouter.patch('/:cronId', requireRole('ADMIN', 'OPERATOR'), async (c) => {
         ...(body.command && { command: body.command }),
         ...(body.args && { args: JSON.stringify(body.args) }),
         ...(body.workingDirectory !== undefined && { workingDirectory: body.workingDirectory }),
-        ...(body.environment !== undefined && { environment: JSON.stringify(sanitizeDetails(body.environment)) }),
+        ...(body.environment !== undefined && { environment: JSON.stringify(sanitizeDetails(user.role === 'ADMIN' ? body.environment : mergeEnvironmentEdit(initial.environment, body.environment))) }),
         ...(nextStatus && { status: nextStatus }),
         ...(body.timeoutSeconds && { timeoutSeconds: body.timeoutSeconds }),
     };
@@ -245,7 +247,8 @@ cronRouter.patch('/:cronId', requireRole('ADMIN', 'OPERATOR'), async (c) => {
                 timeoutSeconds: job.timeoutSeconds,
             });
         })();
-    return c.json({ success: true, data: job });
+    // The agent connection above needs the node; its token must never leave the server.
+    return c.json({ success: true, data: { ...cronJobForRole(job, user.role), node: nodeForRole(job.node, user.role) } });
 });
 // ── Delete cron job ──
 cronRouter.delete('/:cronId', requireRole('ADMIN', 'OPERATOR'), async (c) => {

package/dist/routes/events-stream.js

@@ -1,5 +1,6 @@
 import { Hono } from 'hono';
 import { authMiddleware } from '../middleware/auth.js';
+import { watchOathweaveStream } from '../middleware/oathweave.js';
 import { eventBus } from '../services/event-bus.js';
 export const eventsStreamRouter = new Hono();
 eventsStreamRouter.use('*', authMiddleware);
@@ -19,10 +20,12 @@ eventsStreamRouter.get('/', async (c) => {
     let keepAlive;
     let unsubscribe;
     let closed = false;
+    let stopWatching;
     // Idempotent cleanup for every exit path: client abort, stream cancel, or a
     // disconnect that happened while the subscription was still being set up.
     const cleanup = () => {
         closed = true;
+        stopWatching?.();
         if (keepAlive)
             clearInterval(keepAlive);
         keepAlive = undefined;
@@ -42,6 +45,13 @@ eventsStreamRouter.get('/', async (c) => {
                     // Stream closed
                 }
             };
+            stopWatching = watchOathweaveStream(c.req.header('Authorization'), () => {
+                cleanup();
+                try {
+                    controller.close();
+                }
+                catch { /* already closed */ }
+            });
             // Send initial connection event
             send('connected', { timestamp: new Date().toISOString() });
             // Keep-alive every 30s

package/dist/routes/files.js

@@ -1,3 +1,4 @@
+import { clientErrorMessage } from '../utils/safe-errors.js';
 import { Hono } from 'hono';
 import { getDb } from '../db/index.js';
 import { authMiddleware, getUser, requireRole } from '../middleware/auth.js';
@@ -133,7 +134,7 @@ filesRouter.post('/update', requireRole('ADMIN', 'OPERATOR'), async (c) => {
             return { ...task, status: 'completed' };
         }
         catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
+            const message = clientErrorMessage(err, 'File update failed');
             await db.filePatchTask.update({
                 where: { id: task.id },
                 data: { status: 'failed', error: message },

package/dist/routes/fleet-gateway.js

@@ -0,0 +1,69 @@
+import { createHash } from 'node:crypto';
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { getDb } from '../db/index.js';
+import { HttpError } from '../middleware/error-handler.js';
+import { parseBody } from '../utils/validate.js';
+import { safeEqual } from '../utils/safe-equal.js';
+import { logAuditEvent } from '../services/audit-service.js';
+/**
+ * Machine routes for the fleet gateway, the separate service that holds the restricted SSH key.
+ * The gateway asks what a node is and records what happened. Nothing here dials a node.
+ */
+export const fleetGatewayRouter = new Hono();
+async function requireGatewayCredential(c, next) {
+    const expected = process.env['FLEET_GATEWAY_TOKEN_SHA256'] ?? '';
+    const token = c.req.header('x-fleet-gateway-token') ?? '';
+    if (!expected || !token || !safeEqual(createHash('sha256').update(token).digest('hex'), expected))
+        throw new HttpError(401, 'UNAUTHORIZED', 'Fleet gateway credential required');
+    await next();
+}
+fleetGatewayRouter.use('*', requireGatewayCredential);
+const nodeId = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/);
+/** POST /fleet-gateway/target: inventory facts for one node. The gateway applies its own host-key approval. */
+fleetGatewayRouter.post('/target', async (c) => {
+    const body = await parseBody(c, z.object({ nodeId }).strict());
+    const node = await getDb().node.findUnique({
+        where: { id: body.nodeId },
+        select: { id: true, hostname: true, ipAddress: true, status: true },
+    });
+    if (!node)
+        throw new HttpError(404, 'NODE_NOT_FOUND', 'Node not found');
+    c.header('Cache-Control', 'no-store');
+    return c.json({ success: true, data: { nodeId: node.id, hostname: node.hostname, ipAddress: node.ipAddress, status: node.status } });
+});
+const auditSchema = z.object({
+    action: z.enum(['terminal.session.open', 'terminal.session.close', 'terminal.session.refuse', 'terminal.host-key.approve', 'terminal.host-key.remove']),
+    subject: z.string().min(1).max(256),
+    actorId: z.string().min(1).max(256),
+    nodeId: nodeId.nullable(),
+    sessionId: z.string().regex(/^ts_[A-Za-z0-9_-]{43}$/).nullable(),
+    outcome: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9:._/-]{0,199}$/),
+    at: z.iso.datetime(),
+    durationMs: z.number().int().nonnegative().nullable(),
+    ipAddress: z.union([z.ipv4(), z.ipv6()]).nullable(),
+    fingerprint: z.string().regex(/^SHA256:[A-Za-z0-9+/]{43}$/).nullable(),
+}).strict();
+/** POST /fleet-gateway/audit: terminal metadata. The schema has no field for terminal input or output. */
+fleetGatewayRouter.post('/audit', async (c) => {
+    const event = await parseBody(c, auditSchema);
+    await logAuditEvent({
+        action: event.action,
+        actorId: event.actorId,
+        actorType: 'user',
+        targetType: 'node',
+        targetId: event.nodeId ?? 'unspecified',
+        ipAddress: event.ipAddress,
+        details: {
+            subject: event.subject,
+            sessionHandle: event.sessionId,
+            outcome: event.outcome,
+            observedAt: event.at,
+            durationMs: event.durationMs,
+            hostKeyFingerprint: event.fingerprint,
+        },
+    });
+    c.header('Cache-Control', 'no-store');
+    return c.json({ success: true, data: { recorded: true } });
+});
+//# sourceMappingURL=fleet-gateway.js.map

package/dist/routes/hermes.js

@@ -1,5 +1,6 @@
 import { Hono } from 'hono';
-import { authMiddleware } from '../middleware/auth.js';
+import { authMiddleware, getUser } from '../middleware/auth.js';
+import { hermesProfileForRole } from '../services/secret-views.js';
 import { HttpError } from '../middleware/error-handler.js';
 import { hermesJobListQuerySchema } from '../schemas/hermes.js';
 import { getHermesApiServerStatus, getHermesInstallation, getHermesJob, listHermesInstallations, listHermesJobs, listHermesProfiles, } from '../services/hermes-service.js';
@@ -13,21 +14,40 @@ function requiredParam(c, name) {
 }
 // Read-only inventory/status endpoints remain available because they use the
 // Control database and never open SSH connections.
-hermesRouter.get('/installations', async (c) => c.json({ success: true, data: await listHermesInstallations() }));
+function installationForRole(installation, role) {
+    return installation.profiles
+        ? { ...installation, profiles: installation.profiles.map((profile) => hermesProfileForRole(profile, role)) }
+        : installation;
+}
+hermesRouter.get('/installations', async (c) => {
+    const role = getUser(c).role;
+    return c.json({ success: true, data: (await listHermesInstallations()).map((installation) => installationForRole(installation, role)) });
+});
 hermesRouter.get('/installations/:id', async (c) => {
     const data = await getHermesInstallation(requiredParam(c, 'id'));
     if (!data)
         throw new HttpError(404, 'NOT_FOUND', 'Hermes installation not found');
-    return c.json({ success: true, data });
+    return c.json({ success: true, data: installationForRole(data, getUser(c).role) });
 });
 hermesRouter.get('/installations/:id/profiles', async (c) => {
     const installation = await getHermesInstallation(requiredParam(c, 'id'));
     if (!installation)
         throw new HttpError(404, 'NOT_FOUND', 'Hermes installation not found');
-    return c.json({ success: true, data: await listHermesProfiles(installation.id) });
+    const role = getUser(c).role;
+    return c.json({ success: true, data: (await listHermesProfiles(installation.id)).map((profile) => hermesProfileForRole(profile, role)) });
+});
+hermesRouter.get('/profiles', async (c) => {
+    const role = getUser(c).role;
+    return c.json({ success: true, data: (await listHermesProfiles()).map((profile) => hermesProfileForRole(profile, role)) });
+});
+hermesRouter.get('/profiles/:id/api-server/status', async (c) => {
+    const { keyFingerprint, ...status } = await getHermesApiServerStatus(requiredParam(c, 'id'));
+    return c.json({ success: true, data: {
+            ...status,
+            ...(getUser(c).role === 'ADMIN' ? { keyFingerprint } : {}),
+            keyConfigured: Boolean(keyFingerprint),
+        } });
 });
-hermesRouter.get('/profiles', async (c) => c.json({ success: true, data: await listHermesProfiles() }));
-hermesRouter.get('/profiles/:id/api-server/status', async (c) => c.json({ success: true, data: await getHermesApiServerStatus(requiredParam(c, 'id')) }));
 hermesRouter.get('/jobs', async (c) => {
     const parsed = hermesJobListQuerySchema.safeParse({
         status: c.req.query('status'),

package/dist/routes/hiveskills.js

@@ -0,0 +1,116 @@
+import { createHash } from 'node:crypto';
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { HiveSkillsTargetPostureSchema, HiveSkillsPublicationSchema } from '@hivemagnus/magnus-contracts';
+import { getDb } from '../db/index.js';
+import { HttpError } from '../middleware/error-handler.js';
+import { safeEqual } from '../utils/safe-equal.js';
+import { getNodeManagerSecret } from '../utils/env.js';
+import { getNodeBaseUrl } from '../utils/node-url.js';
+import { NodeApiClient } from '../sdk/node-api-client.js';
+import { logAuditEvent } from '../services/audit-service.js';
+import { httpIdentity } from '../security/managed-http.js';
+const slug = z.string().regex(/^[a-z0-9][a-z0-9-]{1,62}$/);
+export const skillsExecutorConfig = z.record(slug, z.object({ tokenSha256: z.string().regex(/^[a-f0-9]{64}$/), targets: z.record(slug, z.object({ nodeId: z.string().min(1).max(128), agentTarget: slug }).strict()) }).strict());
+export const skillJobRequest = z.object({ target: slug, publicationSha256: z.string().regex(/^[a-f0-9]{64}$/), manifest: HiveSkillsPublicationSchema, approvedBy: z.string().min(1).max(200) }).strict();
+export const hiveskillsRouter = new Hono();
+function authorize(header) {
+    let raw;
+    try {
+        raw = JSON.parse(process.env['MAGNUS_HIVESKILLS_DEPLOYMENTS_JSON'] ?? '{}');
+    }
+    catch {
+        throw new HttpError(503, 'HIVESKILLS_UNCONFIGURED', 'Invalid Skills executor configuration');
+    }
+    const configured = skillsExecutorConfig.safeParse(raw);
+    if (!configured.success)
+        throw new HttpError(503, 'HIVESKILLS_UNCONFIGURED', 'Invalid Skills executor configuration');
+    if (!header?.startsWith('Bearer ') || header.length < 39 || /[\r\n]/.test(header))
+        throw new HttpError(401, 'UNAUTHORIZED', 'Endpoint-scoped Skills credential required');
+    const digest = createHash('sha256').update(header.slice(7)).digest('hex');
+    for (const [registryId, entry] of Object.entries(configured.data))
+        if (safeEqual(entry.tokenSha256, digest))
+            return { registryId, ...entry };
+    throw new HttpError(401, 'UNAUTHORIZED', 'Endpoint-scoped Skills credential required');
+}
+function commandId(registryId, id) { if (!z.uuid().safeParse(id).success)
+    throw new HttpError(400, 'VALIDATION_ERROR', 'Job UUID required'); return 'hiveskills-' + createHash('sha256').update(registryId + ':' + id).digest('hex'); }
+async function targetClient(registry, target) {
+    const binding = registry.targets[target];
+    if (!binding)
+        throw new HttpError(403, 'FORBIDDEN', 'Target is outside this registry executor grant');
+    const node = await getDb().node.findUnique({ where: { id: binding.nodeId } });
+    if (!node || node.status === 'DECOMMISSIONED')
+        throw new HttpError(409, 'TARGET_UNAVAILABLE', 'Configured target is unavailable');
+    return { binding, node, client: new NodeApiClient({ baseUrl: getNodeBaseUrl(node.ipAddress, node.port), resourceNodeId: node.id, resourceActorId: 'service:hiveskills:' + registry.registryId, nodeToken: getNodeManagerSecret() }) };
+}
+async function observed(registry, target, id) {
+    const { node, client } = await targetClient(registry, target), jobId = commandId(registry.registryId, id);
+    const row = await getDb().remoteCommand.findUnique({ where: { id: jobId } });
+    if (!row)
+        throw new HttpError(404, 'NOT_FOUND', 'Job has not been admitted');
+    if (row.nodeId !== node.id || row.createdBy !== 'service:hiveskills:' + registry.registryId)
+        throw new HttpError(409, 'JOB_BINDING_CONFLICT', 'Job belongs to another target');
+    const lease = await getDb().commandResourceLease.findUnique({ where: { commandId: jobId } });
+    if (!lease)
+        return { jobId, status: 'unknown', result: 'Missing durable ownership; review required' };
+    try {
+        const receipt = await client.getCommandReceipt(jobId, { nodeFqdn: node.hostname, requestSha256: lease.requestSha256 });
+        if (receipt.state === 'completed')
+            return { jobId, status: receipt.result.exitCode === 0 ? 'completed' : 'failed', result: receipt.result.exitCode === 0 ? 'Exact approved publication synchronized' : 'Node completed with a bounded failure' };
+        return { jobId, status: receipt.state === 'running' ? 'running' : 'unknown', result: 'Original operation retained; never replayed' };
+    }
+    catch {
+        return { jobId, status: 'unknown', result: 'Receipt unavailable; original operation retained' };
+    }
+}
+hiveskillsRouter.get('/targets/:target', async (c) => {
+    const registry = authorize(c.req.header('authorization')), target = slug.safeParse(c.req.param('target'));
+    if (!target.success)
+        throw new HttpError(400, 'VALIDATION_ERROR', 'Exact logical target required');
+    const { binding, node, client } = await targetClient(registry, target.data), enrollment = await getDb().resourceEnrollment.findUnique({ where: { nodeId: node.id } });
+    const base = { registryId: registry.registryId, target: target.data, nodeId: node.id, agentTarget: binding.agentTarget };
+    if (enrollment?.state !== 'enrolled' || enrollment.nodeFqdn !== node.hostname || node.status !== 'ONLINE' || !node.lastHeartbeatAt || Date.now() - node.lastHeartbeatAt.getTime() > 120000 || await getDb().commandResourceLease.count({ where: { nodeId: node.id, state: { in: ['reserved', 'running', 'unknown'] } } }))
+        return c.json({ ...base, ready: false, reason: 'Node enrollment, health or retained ownership requires operator review' });
+    try {
+        const reply = await client.hiveSkillsTargetPosture(binding.agentTarget, registry.registryId), posture = HiveSkillsTargetPostureSchema.parse(reply.data);
+        if (!reply.success || posture.registryId !== registry.registryId || posture.target !== binding.agentTarget)
+            throw new Error('Native target binding differs');
+        return c.json({ ...base, ready: posture.ready, reason: posture.reason, configurationSha256: posture.configurationSha256, clientSha256: posture.clientSha256 });
+    }
+    catch {
+        return c.json({ ...base, ready: false, reason: 'Native target posture unavailable' });
+    }
+});
+hiveskillsRouter.get('/jobs/:id', async (c) => { const registry = authorize(c.req.header('authorization')); const target = slug.safeParse(c.req.query('target')); if (!target.success)
+    throw new HttpError(400, 'VALIDATION_ERROR', 'Exact target required'); return c.json(await observed(registry, target.data, c.req.param('id'))); });
+hiveskillsRouter.post('/jobs/:id', async (c) => {
+    const registry = authorize(c.req.header('authorization')), parsed = skillJobRequest.safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success)
+        throw new HttpError(400, 'VALIDATION_ERROR', 'Exact approved Skills publication required');
+    const body = parsed.data, jobId = commandId(registry.registryId, c.req.param('id'));
+    if (createHash('sha256').update(JSON.stringify(body.manifest)).digest('hex') !== body.publicationSha256)
+        throw new HttpError(409, 'PUBLICATION_CONFLICT', 'Publication digest differs');
+    const { binding, node, client } = await targetClient(registry, body.target);
+    const request = { target: binding.agentTarget, registryId: registry.registryId, publicationSha256: body.publicationSha256, manifest: body.manifest };
+    const prior = await getDb().remoteCommand.findUnique({ where: { id: jobId } });
+    if (prior) {
+        const identity = httpIdentity(jobId, 'POST', '/hiveskills/sync', JSON.stringify(request), 120);
+        if (prior.nodeId !== node.id || prior.createdBy !== 'service:hiveskills:' + registry.registryId || prior.command !== identity.command || prior.args !== JSON.stringify(identity.args))
+            throw new HttpError(409, 'JOB_BINDING_CONFLICT', 'Existing job has another target or publication');
+        return c.json(await observed(registry, body.target, c.req.param('id')));
+    }
+    await logAuditEvent({ action: 'skill.push', actorId: 'service:hiveskills:' + registry.registryId, targetType: 'node', targetId: node.id, details: { jobId, target: body.target, publicationSha256: body.publicationSha256, approvedBy: body.approvedBy, outcome: 'requested' } });
+    try {
+        const result = await client.syncHiveSkills(request, jobId);
+        await logAuditEvent({ action: 'skill.push', actorId: 'service:hiveskills:' + registry.registryId, targetType: 'node', targetId: node.id, details: { jobId, target: body.target, publicationSha256: body.publicationSha256, approvedBy: body.approvedBy, commandSha256: result.evidence.commandSha256 } });
+        return c.json({ jobId, status: result.response.success ? 'completed' : 'failed', result: result.response.success ? 'Exact approved publication synchronized' : 'Node completed with a bounded failure' });
+    }
+    catch {
+        const row = await getDb().remoteCommand.findUnique({ where: { id: jobId } });
+        if (!row)
+            return c.json({ jobId, status: 'not_admitted', result: 'No operation was admitted; resolve target readiness and prepare a new preview' });
+        return c.json(await observed(registry, body.target, c.req.param('id')));
+    }
+});
+//# sourceMappingURL=hiveskills.js.map

package/dist/routes/library.js

@@ -1,3 +1,4 @@
+import { clientErrorMessage } from '../utils/safe-errors.js';
 import { Hono } from 'hono';
 import { getDb } from '../db/index.js';
 import { authMiddleware, getUser, requireRole } from '../middleware/auth.js';
@@ -373,7 +374,7 @@ libraryRouter.post('/deploy', requireRole('ADMIN', 'OPERATOR'), async (c) => {
                 nodeId: node.id,
                 nodeName: node.name,
                 status: 'failed',
-                error: err instanceof Error ? err.message : 'Unknown error',
+                error: clientErrorMessage(err, 'Unknown error'),
             };
         }
     }));
@@ -383,7 +384,7 @@ libraryRouter.post('/deploy', requireRole('ADMIN', 'OPERATOR'), async (c) => {
             nodeId: 'unknown',
             nodeName: 'unknown',
             status: 'failed',
-            error: r.reason instanceof Error ? r.reason.message : 'Unknown error',
+            error: clientErrorMessage(r.reason, 'Unknown error'),
         });
     await logAuditEvent({
         action: 'library.deploy',

package/dist/routes/logs.js

@@ -1,6 +1,7 @@
 import { Hono } from 'hono';
 import { createHmac, timingSafeEqual } from 'node:crypto';
 import { streamSSE } from 'hono/streaming';
+import { watchOathweaveStream } from '../middleware/oathweave.js';
 import { getDb } from '../db/index.js';
 import { authMiddleware } from '../middleware/auth.js';
 import { sanitizeDetails } from '../services/audit-service.js';
@@ -157,9 +158,13 @@ logsRouter.get('/stream', (c) => {
                 id: String(eventId++),
             });
         });
+        const stopWatching = watchOathweaveStream(c.req.header('Authorization'), () => {
+            void stream.close();
+        });
         // Wait until the client disconnects
         stream.onAbort(() => {
             clearInterval(heartbeatTimer);
+            stopWatching();
             unsubscribe();
         });
         // Keep the stream open — the onAbort callback will clean up

package/dist/routes/metrics.js

@@ -3,6 +3,7 @@ import { getDb } from '../db/index.js';
 import { getRedis } from '../queue/redis.js';
 import { getHeartbeatStreamStats } from '../services/heartbeat-stream.js';
 import { safeEqual } from '../utils/safe-equal.js';
+import { SENTINEL_NODE_IDS } from '../utils/sentinel-nodes.js';
 export const metricsRouter = new Hono();
 // ── In-process counters ──
 const counters = {
@@ -115,10 +116,10 @@ metricsRouter.get('/', async (c) => {
     try {
         const db = getDb();
         const [nodeCount, onlineNodes, pendingCommands, staleNodes, versions, oldestQueued] = await Promise.all([
-            db.node.count(),
-            db.node.count({ where: { status: 'ONLINE' } }),
+            db.node.count({ where: { id: { notIn: SENTINEL_NODE_IDS } } }),
+            db.node.count({ where: { id: { notIn: SENTINEL_NODE_IDS }, status: 'ONLINE' } }),
             db.remoteCommand.count({ where: { status: { in: ['PENDING', 'QUEUED'] } } }),
-            db.node.count({ where: { lastHeartbeatAt: { lt: new Date(Date.now() - 120_000) } } }),
+            db.node.count({ where: { id: { notIn: SENTINEL_NODE_IDS }, lastHeartbeatAt: { lt: new Date(Date.now() - 120_000) } } }),
             db.agent.groupBy({ by: ['version'], _count: true }),
             db.remoteCommand.findFirst({ where: { status: { in: ['PENDING', 'QUEUED'] } }, orderBy: { createdAt: 'asc' }, select: { createdAt: true } }),
         ]);