@lamalibre/create-lamaste 4.3.1 → 4.4.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (75) hide show
  1. package/package.json +2 -2
  2. package/src/lib/service-config.js +6 -0
  3. package/vendor/docs/00-introduction/how-it-works.md +2 -2
  4. package/vendor/docs/00-introduction/quickstart.md +5 -5
  5. package/vendor/docs/00-introduction/what-is-lamaste.md +5 -5
  6. package/vendor/docs/01-concepts/certificates.md +3 -3
  7. package/vendor/docs/01-concepts/mtls.md +2 -2
  8. package/vendor/docs/01-concepts/security-model.md +38 -1
  9. package/vendor/docs/01-concepts/tickets.md +2 -2
  10. package/vendor/docs/01-concepts/tunneling.md +4 -4
  11. package/vendor/docs/02-guides/agent-setup.md +6 -6
  12. package/vendor/docs/02-guides/certificate-management.md +2 -2
  13. package/vendor/docs/02-guides/cloud-provisioning.md +3 -3
  14. package/vendor/docs/02-guides/desktop-app-setup.md +11 -11
  15. package/vendor/docs/02-guides/installation.md +3 -3
  16. package/vendor/docs/02-guides/onboarding.md +2 -2
  17. package/vendor/docs/02-guides/standalone-plugin-with-tickets.md +2 -2
  18. package/vendor/docs/03-architecture/installer-flow.md +2 -2
  19. package/vendor/docs/03-architecture/installer.md +4 -4
  20. package/vendor/docs/03-architecture/management-flow.md +1 -1
  21. package/vendor/docs/03-architecture/overview.md +5 -5
  22. package/vendor/docs/03-architecture/panel-client.md +7 -7
  23. package/vendor/docs/03-architecture/panel-server.md +2 -2
  24. package/vendor/docs/03-architecture/state-management.md +2 -2
  25. package/vendor/docs/03-architecture/system-overview.md +1 -1
  26. package/vendor/docs/04-api-reference/agent-hosted-plugins.md +394 -34
  27. package/vendor/docs/04-api-reference/app-host.md +87 -38
  28. package/vendor/docs/04-api-reference/audit-and-notifications.md +10 -10
  29. package/vendor/docs/04-api-reference/certificates.md +22 -19
  30. package/vendor/docs/04-api-reference/lifecycle-hooks.md +34 -12
  31. package/vendor/docs/04-api-reference/onboarding.md +1 -1
  32. package/vendor/docs/04-api-reference/overview.md +137 -135
  33. package/vendor/docs/04-api-reference/registry-and-oidc.md +3 -1
  34. package/vendor/docs/04-api-reference/tunnels.md +14 -10
  35. package/vendor/docs/05-operations/backup-and-restore.md +2 -1
  36. package/vendor/docs/05-operations/uninstalling.md +1 -1
  37. package/vendor/docs/05-operations/upgrades.md +6 -6
  38. package/vendor/docs/06-reference/config-files.md +90 -85
  39. package/vendor/docs/06-reference/glossary.md +3 -3
  40. package/vendor/docs/06-reference/installer-flags.md +13 -13
  41. package/vendor/docs/06-reference/ports-and-services.md +1 -1
  42. package/vendor/docs/06-reference/troubleshooting.md +8 -8
  43. package/vendor/docs/gatekeeper-design.md +8 -8
  44. package/vendor/docs/identity-directory-design.md +2 -2
  45. package/vendor/docs/package.json +1 -1
  46. package/vendor/docs/todo/lib-cli-desktop-refactor.md +27 -27
  47. package/vendor/gatekeeper/package.json +2 -2
  48. package/vendor/server/bin/lamaste-server.js +4 -1
  49. package/vendor/server/package.json +4 -3
  50. package/vendor/server/src/commands/plugin-settings.js +541 -0
  51. package/vendor/server/src/commands/plugins.js +94 -27
  52. package/vendor/server/src/panel-api.js +36 -4
  53. package/vendor/server/src/plugin-approval.js +78 -0
  54. package/vendor/server/src/plugin-settings.js +699 -0
  55. package/vendor/server-ui/dist/assets/index-25wo_8av.css +1 -0
  56. package/vendor/server-ui/dist/assets/index-roDHz3dM.js +84 -0
  57. package/vendor/server-ui/dist/index.html +2 -2
  58. package/vendor/serverd/package.json +2 -2
  59. package/vendor/serverd/src/index.js +9 -0
  60. package/vendor/serverd/src/lib/agent-presence.js +106 -0
  61. package/vendor/serverd/src/lib/hook-pipelines.js +20 -4
  62. package/vendor/serverd/src/lib/migrations/state/0012_plugin_settings_and_presence.sql +62 -0
  63. package/vendor/serverd/src/lib/mtls.js +44 -4
  64. package/vendor/serverd/src/lib/plugin-hooks.js +120 -20
  65. package/vendor/serverd/src/lib/plugin-hosting.js +35 -14
  66. package/vendor/serverd/src/lib/plugin-lifecycle.js +267 -83
  67. package/vendor/serverd/src/lib/plugin-packages.js +30 -22
  68. package/vendor/serverd/src/lib/plugin-settings.js +1101 -0
  69. package/vendor/serverd/src/lib/plugins.js +108 -33
  70. package/vendor/serverd/src/lib/registry-credential.js +37 -0
  71. package/vendor/serverd/src/lib/tunnel-hooks.js +11 -0
  72. package/vendor/serverd/src/routes/management/plugins.js +166 -19
  73. package/vendor/serverd/src/routes/management/tunnels.js +21 -1
  74. package/vendor/server-ui/dist/assets/index-BTlBt_cD.js +0 -84
  75. package/vendor/server-ui/dist/assets/index-Bc5NCMSv.css +0 -1
package/vendor/docs/04-api-reference/overview.md CHANGED
@@ -274,141 +274,143 @@ There are two exceptions:
274
274
 
275
275
  ### Endpoint Summary
276
276
 
277
- | Method | Path | Group | Description |
278
- | ------ | --------------------------------------------------------- | ---------- | ------------------------------------------ |
279
- | GET | `/api/health` | Always | Health check |
280
- | GET | `/api/onboarding/status` | Always | Onboarding state |
281
- | POST | `/api/onboarding/domain` | Onboarding | Set domain and email |
282
- | POST | `/api/onboarding/verify-dns` | Onboarding | Verify DNS records |
283
- | POST | `/api/onboarding/provision` | Onboarding | Start provisioning |
284
- | WS | `/api/onboarding/provision/stream` | Onboarding | Provisioning progress |
285
- | GET | `/api/invite/:token` | Public | Get invitation details |
286
- | POST | `/api/invite/:token/accept` | Public | Accept invitation |
287
- | POST | `/api/enroll` | Public | Enroll agent with token (hardware-bound) |
288
- | GET | `/api/system/stats` | Management | System statistics |
289
- | POST | `/api/system/update` | Management | Trigger background server update |
290
- | POST | `/api/agents/plugins/report` | Management | Report agent plugin capabilities |
291
- | GET | `/api/agents/me/chisel-credential` | Management | The calling agent's Chisel credential |
292
- | POST | `/api/agents/me/chisel-credential/rotate` | Management | Rotate own Chisel credential (agent) |
293
- | GET | `/api/agents/me/registry-credential` | Management | One-hour registry token for the agent |
294
- | GET | `/api/agents/me/relay-keys` | Management | Relay assertion keys, caller's relay label |
295
- | GET | `/api/agents/me/plugin-config/:route` | Management | Hosting agent: its plugin's port, secret |
296
- | POST | `/api/agents/me/plugin-config/:route/ack` | Management | Hosting agent holds the secret issued |
297
- | POST | `/api/agents/me/jobs/:id/result` | Management | Report an agent job's result (agent) |
298
- | PUT | `/api/agents/me/host-facts` | Management | Report the agent's host facts (agent) |
299
- | GET | `/api/agent-panel/authz/:label` | Management | Agent-panel vhost `auth_request` (nginx) |
300
- | POST | `/api/agents/:label/chisel-credential/rotate` | Management | Rotate an agent's Chisel credential |
301
- | GET | `/api/tunnels/agent-config` | Management | One agent's tunnel configuration |
302
- | GET | `/api/tunnels` | Management | List tunnels |
303
- | POST | `/api/tunnels` | Management | Create tunnel |
304
- | PATCH | `/api/tunnels/:id` | Management | Move, access mode, body limit, enable |
305
- | DELETE | `/api/tunnels/:id` | Management | Delete tunnel |
306
- | GET | `/api/sites` | Management | List static sites |
307
- | POST | `/api/sites` | Management | Create static site |
308
- | DELETE | `/api/sites/:id` | Management | Delete static site |
309
- | PATCH | `/api/sites/:id` | Management | Update site settings |
310
- | POST | `/api/sites/:id/verify-dns` | Management | Verify site DNS |
311
- | GET | `/api/sites/:id/files` | Management | List site files |
312
- | POST | `/api/sites/:id/files` | Management | Upload site files |
313
- | DELETE | `/api/sites/:id/files` | Management | Delete site file |
314
- | GET | `/api/invitations` | Management | List invitations |
315
- | POST | `/api/invitations` | Management | Create invitation |
316
- | DELETE | `/api/invitations/:id` | Management | Revoke invitation |
317
- | GET | `/api/users` | Management | List users |
318
- | POST | `/api/users` | Management | Create user |
319
- | PUT | `/api/users/:username` | Management | Update user |
320
- | DELETE | `/api/users/:username` | Management | Delete user |
321
- | POST | `/api/users/:username/reset-totp` | Management | Reset TOTP secret |
322
- | GET | `/api/certs` | Management | List certificates |
323
- | GET | `/api/certs/auto-renew-status` | Management | Auto-renew timer status |
324
- | POST | `/api/certs/:domain/renew` | Management | Force-renew certificate |
325
- | POST | `/api/certs/mtls/rotate` | Management | Rotate mTLS cert |
326
- | GET | `/api/certs/mtls/download` | Management | Download client.p12 |
327
- | POST | `/api/certs/agent` | Management | Generate agent certificate |
328
- | GET | `/api/certs/agent` | Management | List agent certificates |
329
- | GET | `/api/certs/agent/:label/download` | Management | Download agent .p12 |
330
- | PATCH | `/api/certs/agent/:label/capabilities` | Management | Update agent capabilities |
331
- | PATCH | `/api/certs/agent/:label/allowed-sites` | Management | Update agent site access |
332
- | DELETE | `/api/certs/agent/:label` | Management | Revoke agent certificate |
333
- | POST | `/api/certs/agent/enroll` | Management | Generate enrollment token |
334
- | DELETE | `/api/certs/agent/enroll/:label` | Management | Revoke unused enrollment token |
335
- | POST | `/api/certs/agent/upgrade-cert` | Management | Upgrade agent cert to hardware-bound |
336
- | POST | `/api/certs/admin/upgrade-to-hardware-bound` | Management | Upgrade admin to hardware-bound |
337
- | GET | `/api/certs/admin/auth-mode` | Management | Get admin auth mode |
338
- | GET | `/api/settings/2fa` | Management | Get 2FA status |
339
- | POST | `/api/settings/2fa/setup` | Management | Generate TOTP secret |
340
- | POST | `/api/settings/2fa/confirm` | Management | Confirm initial code, enable 2FA |
341
- | POST | `/api/settings/2fa/verify` | Management | Verify code, issue session cookie |
342
- | POST | `/api/settings/2fa/disable` | Management | Disable 2FA |
343
- | GET | `/api/services` | Management | List service statuses |
344
- | POST | `/api/services/:name/:action` | Management | Control a service (start/stop/restart) |
345
- | WS | `/api/services/:name/logs` | Management | Stream service logs |
346
- | GET | `/api/plugins` | Management | List installed plugins |
347
- | GET | `/api/plugins/:name` | Management | Get plugin details |
348
- | POST | `/api/plugins/install` | Management | Install a plugin |
349
- | POST | `/api/plugins/:name/enable` | Management | Enable a plugin |
350
- | POST | `/api/plugins/:name/disable` | Management | Disable a plugin |
351
- | DELETE | `/api/plugins/:name` | Management | Uninstall a plugin |
352
- | GET | `/api/plugins/:name/oidc-clients` | Management | A plugin's OIDC clients (no secrets) |
353
- | POST | `/api/plugins/:name/oidc-clients/:clientId/rotate-secret` | Management | New secret for a confidential client |
354
- | GET | `/api/plugins/:name/hosting` | Management | Which agent hosts the plugin, its health |
355
- | POST | `/api/plugins/:name/hosting` | Management | Host the plugin on an agent (operation) |
356
- | DELETE | `/api/plugins/:name/hosting` | Management | Remove the hosting (operation) |
357
- | POST | `/api/plugins/:name/hosting/rotate-secret` | Management | New installation secret |
358
- | GET | `/api/plugins/:name/hosting/eligibility` | Management | Which agents can host the plugin, and why |
359
- | GET | `/api/plugins/:name/retained-data` | Management | Data agents keep of its agent half |
360
- | DELETE | `/api/plugins/:name/retained-data` | Management | Purge it on an agent, or forget the record |
361
- | GET | `/api/plugins/:name/hooks` | Management | Lifecycle hooks, what needs approval |
362
- | POST | `/api/plugins/:name/hooks/approve` | Management | Approve with the approval digest |
363
- | PUT | `/api/plugins/:name/hooks/auto-approve` | Management | Auto-approve what later versions bring |
364
- | POST | `/api/plugins/:name/update` | Management | Update an agent-hosted plugin in place |
365
- | DELETE | `/api/plugins/:name/update` | Management | Discard an update waiting for approval |
366
- | GET | `/api/plugins/:name/operations` | Management | The plugin's recent operations |
367
- | GET | `/api/plugins/:name/operations/:id` | Management | One operation and its steps |
368
- | ANY | `/api/<route>`, `/api/<route>/*` | Management | Forwarded to the agent half's `/admin/*` |
369
- | GET | `/api/audit` | Management | Audit log |
370
- | GET | `/api/notifications` | Management | Panel notifications |
371
- | POST | `/api/notifications/read` | Management | Mark notifications read |
372
- | GET | `/api/registry-credential` | Management | Registry credential summary |
373
- | PUT | `/api/registry-credential` | Management | Set the registry credential (verified) |
374
- | DELETE | `/api/registry-credential` | Management | Remove the registry credential |
375
- | GET | `/api/plugins/push-install/config` | Management | Get push install configuration |
376
- | PATCH | `/api/plugins/push-install/config` | Management | Update push install configuration |
377
- | GET | `/api/plugins/push-install/policies` | Management | List push install policies |
378
- | POST | `/api/plugins/push-install/policies` | Management | Create push install policy |
379
- | PATCH | `/api/plugins/push-install/policies/:id` | Management | Update push install policy |
380
- | DELETE | `/api/plugins/push-install/policies/:id` | Management | Delete push install policy |
381
- | POST | `/api/plugins/push-install/enable/:label` | Management | Enable push install for agent |
382
- | DELETE | `/api/plugins/push-install/enable/:label` | Management | Disable push install for agent |
383
- | GET | `/api/plugins/push-install/agent-status` | Management | Agent checks own push install status |
384
- | POST | `/api/plugins/push-install/:label` | Management | Record a push-install command (legacy) |
385
- | GET | `/api/plugins/push-install/sessions` | Management | List push install audit log |
386
- | POST | `/api/tickets/scopes` | Management | Register ticket scope |
387
- | GET | `/api/tickets/scopes` | Management | List scopes, instances, assignments |
388
- | DELETE | `/api/tickets/scopes/:name` | Management | Delete ticket scope |
389
- | POST | `/api/tickets/instances` | Management | Register instance |
390
- | DELETE | `/api/tickets/instances/:instanceId` | Management | Deregister instance |
391
- | POST | `/api/tickets/instances/:instanceId/heartbeat` | Management | Instance heartbeat |
392
- | POST | `/api/tickets/assignments` | Management | Assign agent to instance |
393
- | DELETE | `/api/tickets/assignments/:agentLabel/:instanceScope` | Management | Remove assignment |
394
- | GET | `/api/tickets/assignments` | Management | List assignments |
395
- | POST | `/api/tickets` | Management | Request ticket |
396
- | GET | `/api/tickets/inbox` | Management | Check ticket inbox |
397
- | POST | `/api/tickets/validate` | Management | Validate and consume ticket |
398
- | GET | `/api/tickets` | Management | List all tickets (admin) |
399
- | DELETE | `/api/tickets/:ticketId` | Management | Revoke ticket |
400
- | POST | `/api/tickets/sessions` | Management | Create session from ticket |
401
- | POST | `/api/tickets/sessions/:sessionId/heartbeat` | Management | Session heartbeat |
402
- | PATCH | `/api/tickets/sessions/:sessionId` | Management | Update session status |
403
- | DELETE | `/api/tickets/sessions/:sessionId` | Management | Kill session |
404
- | GET | `/api/tickets/sessions` | Management | List sessions |
405
- | POST | `/api/storage/servers` | Management | Register a storage server |
406
- | GET | `/api/storage/servers` | Management | List registered storage servers |
407
- | DELETE | `/api/storage/servers/:id` | Management | Remove a storage server |
408
- | POST | `/api/storage/bindings` | Management | Bind storage to plugin |
409
- | GET | `/api/storage/bindings` | Management | List all bindings |
410
- | GET | `/api/storage/bindings/:pluginName` | Management | Get binding for plugin |
411
- | DELETE | `/api/storage/bindings/:pluginName` | Management | Unbind storage from plugin |
277
+ | Method | Path | Group | Description |
278
+ | ------ | --------------------------------------------------------- | ---------- | ------------------------------------------- |
279
+ | GET | `/api/health` | Always | Health check |
280
+ | GET | `/api/onboarding/status` | Always | Onboarding state |
281
+ | POST | `/api/onboarding/domain` | Onboarding | Set domain and email |
282
+ | POST | `/api/onboarding/verify-dns` | Onboarding | Verify DNS records |
283
+ | POST | `/api/onboarding/provision` | Onboarding | Start provisioning |
284
+ | WS | `/api/onboarding/provision/stream` | Onboarding | Provisioning progress |
285
+ | GET | `/api/invite/:token` | Public | Get invitation details |
286
+ | POST | `/api/invite/:token/accept` | Public | Accept invitation |
287
+ | POST | `/api/enroll` | Public | Enroll agent with token (hardware-bound) |
288
+ | GET | `/api/system/stats` | Management | System statistics |
289
+ | POST | `/api/system/update` | Management | Trigger background server update |
290
+ | POST | `/api/agents/plugins/report` | Management | Report agent plugin capabilities |
291
+ | GET | `/api/agents/me/chisel-credential` | Management | The calling agent's Chisel credential |
292
+ | POST | `/api/agents/me/chisel-credential/rotate` | Management | Rotate own Chisel credential (agent) |
293
+ | GET | `/api/agents/me/registry-credential` | Management | One-hour registry token for the agent |
294
+ | GET | `/api/agents/me/relay-keys` | Management | Relay assertion keys, caller's relay label |
295
+ | GET | `/api/agents/me/plugin-config/:route` | Management | Hosting agent: its plugin's port, secret |
296
+ | POST | `/api/agents/me/plugin-config/:route/ack` | Management | Hosting agent holds the secret issued |
297
+ | POST | `/api/agents/me/jobs/:id/result` | Management | Report an agent job's result (agent) |
298
+ | PUT | `/api/agents/me/host-facts` | Management | Report the agent's host facts (agent) |
299
+ | GET | `/api/agent-panel/authz/:label` | Management | Agent-panel vhost `auth_request` (nginx) |
300
+ | POST | `/api/agents/:label/chisel-credential/rotate` | Management | Rotate an agent's Chisel credential |
301
+ | GET | `/api/tunnels/agent-config` | Management | One agent's tunnel configuration |
302
+ | GET | `/api/tunnels` | Management | List tunnels |
303
+ | POST | `/api/tunnels` | Management | Create tunnel |
304
+ | PATCH | `/api/tunnels/:id` | Management | Move, access mode, body limit, enable |
305
+ | DELETE | `/api/tunnels/:id` | Management | Delete tunnel |
306
+ | GET | `/api/sites` | Management | List static sites |
307
+ | POST | `/api/sites` | Management | Create static site |
308
+ | DELETE | `/api/sites/:id` | Management | Delete static site |
309
+ | PATCH | `/api/sites/:id` | Management | Update site settings |
310
+ | POST | `/api/sites/:id/verify-dns` | Management | Verify site DNS |
311
+ | GET | `/api/sites/:id/files` | Management | List site files |
312
+ | POST | `/api/sites/:id/files` | Management | Upload site files |
313
+ | DELETE | `/api/sites/:id/files` | Management | Delete site file |
314
+ | GET | `/api/invitations` | Management | List invitations |
315
+ | POST | `/api/invitations` | Management | Create invitation |
316
+ | DELETE | `/api/invitations/:id` | Management | Revoke invitation |
317
+ | GET | `/api/users` | Management | List users |
318
+ | POST | `/api/users` | Management | Create user |
319
+ | PUT | `/api/users/:username` | Management | Update user |
320
+ | DELETE | `/api/users/:username` | Management | Delete user |
321
+ | POST | `/api/users/:username/reset-totp` | Management | Reset TOTP secret |
322
+ | GET | `/api/certs` | Management | List certificates |
323
+ | GET | `/api/certs/auto-renew-status` | Management | Auto-renew timer status |
324
+ | POST | `/api/certs/:domain/renew` | Management | Force-renew certificate |
325
+ | POST | `/api/certs/mtls/rotate` | Management | Rotate mTLS cert |
326
+ | GET | `/api/certs/mtls/download` | Management | Download client.p12 |
327
+ | POST | `/api/certs/agent` | Management | Generate agent certificate |
328
+ | GET | `/api/certs/agent` | Management | List agent certificates |
329
+ | GET | `/api/certs/agent/:label/download` | Management | Download agent .p12 |
330
+ | PATCH | `/api/certs/agent/:label/capabilities` | Management | Update agent capabilities |
331
+ | PATCH | `/api/certs/agent/:label/allowed-sites` | Management | Update agent site access |
332
+ | DELETE | `/api/certs/agent/:label` | Management | Revoke agent certificate |
333
+ | POST | `/api/certs/agent/enroll` | Management | Generate enrollment token |
334
+ | DELETE | `/api/certs/agent/enroll/:label` | Management | Revoke unused enrollment token |
335
+ | POST | `/api/certs/agent/upgrade-cert` | Management | Upgrade agent cert to hardware-bound |
336
+ | POST | `/api/certs/admin/upgrade-to-hardware-bound` | Management | Upgrade admin to hardware-bound |
337
+ | GET | `/api/certs/admin/auth-mode` | Management | Get admin auth mode |
338
+ | GET | `/api/settings/2fa` | Management | Get 2FA status |
339
+ | POST | `/api/settings/2fa/setup` | Management | Generate TOTP secret |
340
+ | POST | `/api/settings/2fa/confirm` | Management | Confirm initial code, enable 2FA |
341
+ | POST | `/api/settings/2fa/verify` | Management | Verify code, issue session cookie |
342
+ | POST | `/api/settings/2fa/disable` | Management | Disable 2FA |
343
+ | GET | `/api/services` | Management | List service statuses |
344
+ | POST | `/api/services/:name/:action` | Management | Control a service (start/stop/restart) |
345
+ | WS | `/api/services/:name/logs` | Management | Stream service logs |
346
+ | GET | `/api/plugins` | Management | List installed plugins |
347
+ | GET | `/api/plugins/:name` | Management | Get plugin details |
348
+ | POST | `/api/plugins/install` | Management | Install a plugin |
349
+ | POST | `/api/plugins/:name/enable` | Management | Enable a plugin |
350
+ | POST | `/api/plugins/:name/disable` | Management | Disable a plugin |
351
+ | DELETE | `/api/plugins/:name` | Management | Uninstall a plugin |
352
+ | GET | `/api/plugins/:name/oidc-clients` | Management | A plugin's OIDC clients (no secrets) |
353
+ | POST | `/api/plugins/:name/oidc-clients/:clientId/rotate-secret` | Management | New secret for a confidential client |
354
+ | GET | `/api/plugins/:name/hosting` | Management | Which agent hosts the plugin, its health |
355
+ | POST | `/api/plugins/:name/hosting` | Management | Host the plugin on an agent (operation) |
356
+ | DELETE | `/api/plugins/:name/hosting` | Management | Remove the hosting (operation) |
357
+ | POST | `/api/plugins/:name/hosting/rotate-secret` | Management | New installation secret |
358
+ | GET | `/api/plugins/:name/hosting/eligibility` | Management | Which agents can host the plugin, and why |
359
+ | GET | `/api/plugins/:name/retained-data` | Management | Data agents keep of its agent half |
360
+ | DELETE | `/api/plugins/:name/retained-data` | Management | Purge it on an agent, or forget the record |
361
+ | GET | `/api/plugins/:name/settings` | Management | Its settings (secrets only as set), hosting |
362
+ | PUT | `/api/plugins/:name/settings` | Management | Change them, through to the agent half |
363
+ | GET | `/api/plugins/:name/hooks` | Management | Lifecycle hooks, what needs approval |
364
+ | POST | `/api/plugins/:name/hooks/approve` | Management | Approve with the approval digest |
365
+ | PUT | `/api/plugins/:name/hooks/auto-approve` | Management | Auto-approve what later versions bring |
366
+ | POST | `/api/plugins/:name/update` | Management | Update an agent-hosted plugin in place |
367
+ | DELETE | `/api/plugins/:name/update` | Management | Discard an update waiting for approval |
368
+ | GET | `/api/plugins/:name/operations` | Management | The plugin's recent operations |
369
+ | GET | `/api/plugins/:name/operations/:id` | Management | One operation and its steps |
370
+ | ANY | `/api/<route>`, `/api/<route>/*` | Management | Forwarded to the agent half's `/admin/*` |
371
+ | GET | `/api/audit` | Management | Audit log |
372
+ | GET | `/api/notifications` | Management | Panel notifications |
373
+ | POST | `/api/notifications/read` | Management | Mark notifications read |
374
+ | GET | `/api/registry-credential` | Management | Registry credential summary |
375
+ | PUT | `/api/registry-credential` | Management | Set the registry credential (verified) |
376
+ | DELETE | `/api/registry-credential` | Management | Remove the registry credential |
377
+ | GET | `/api/plugins/push-install/config` | Management | Get push install configuration |
378
+ | PATCH | `/api/plugins/push-install/config` | Management | Update push install configuration |
379
+ | GET | `/api/plugins/push-install/policies` | Management | List push install policies |
380
+ | POST | `/api/plugins/push-install/policies` | Management | Create push install policy |
381
+ | PATCH | `/api/plugins/push-install/policies/:id` | Management | Update push install policy |
382
+ | DELETE | `/api/plugins/push-install/policies/:id` | Management | Delete push install policy |
383
+ | POST | `/api/plugins/push-install/enable/:label` | Management | Enable push install for agent |
384
+ | DELETE | `/api/plugins/push-install/enable/:label` | Management | Disable push install for agent |
385
+ | GET | `/api/plugins/push-install/agent-status` | Management | Agent checks own push install status |
386
+ | POST | `/api/plugins/push-install/:label` | Management | Record a push-install command (legacy) |
387
+ | GET | `/api/plugins/push-install/sessions` | Management | List push install audit log |
388
+ | POST | `/api/tickets/scopes` | Management | Register ticket scope |
389
+ | GET | `/api/tickets/scopes` | Management | List scopes, instances, assignments |
390
+ | DELETE | `/api/tickets/scopes/:name` | Management | Delete ticket scope |
391
+ | POST | `/api/tickets/instances` | Management | Register instance |
392
+ | DELETE | `/api/tickets/instances/:instanceId` | Management | Deregister instance |
393
+ | POST | `/api/tickets/instances/:instanceId/heartbeat` | Management | Instance heartbeat |
394
+ | POST | `/api/tickets/assignments` | Management | Assign agent to instance |
395
+ | DELETE | `/api/tickets/assignments/:agentLabel/:instanceScope` | Management | Remove assignment |
396
+ | GET | `/api/tickets/assignments` | Management | List assignments |
397
+ | POST | `/api/tickets` | Management | Request ticket |
398
+ | GET | `/api/tickets/inbox` | Management | Check ticket inbox |
399
+ | POST | `/api/tickets/validate` | Management | Validate and consume ticket |
400
+ | GET | `/api/tickets` | Management | List all tickets (admin) |
401
+ | DELETE | `/api/tickets/:ticketId` | Management | Revoke ticket |
402
+ | POST | `/api/tickets/sessions` | Management | Create session from ticket |
403
+ | POST | `/api/tickets/sessions/:sessionId/heartbeat` | Management | Session heartbeat |
404
+ | PATCH | `/api/tickets/sessions/:sessionId` | Management | Update session status |
405
+ | DELETE | `/api/tickets/sessions/:sessionId` | Management | Kill session |
406
+ | GET | `/api/tickets/sessions` | Management | List sessions |
407
+ | POST | `/api/storage/servers` | Management | Register a storage server |
408
+ | GET | `/api/storage/servers` | Management | List registered storage servers |
409
+ | DELETE | `/api/storage/servers/:id` | Management | Remove a storage server |
410
+ | POST | `/api/storage/bindings` | Management | Bind storage to plugin |
411
+ | GET | `/api/storage/bindings` | Management | List all bindings |
412
+ | GET | `/api/storage/bindings/:pluginName` | Management | Get binding for plugin |
413
+ | DELETE | `/api/storage/bindings/:pluginName` | Management | Unbind storage from plugin |
412
414
 
413
415
  `POST /api/plugins/push-install/:label` checks the push-install gates and records the command in the push-install log; nothing delivers it to the agent. What Lamaste does push to an agent — installing, updating and removing an agent half — runs as plugin operations under the same gates ([Agent-Hosted Plugins](agent-hosted-plugins.md#push-install-gates)). The agent-hosted plugin endpoints are described in [Agent-Hosted Plugins](agent-hosted-plugins.md), [Lifecycle Hooks](lifecycle-hooks.md) and [Audit Log and Notifications](audit-and-notifications.md).
414
416
 
package/vendor/docs/04-api-reference/registry-and-oidc.md CHANGED
@@ -6,6 +6,8 @@ Two generic mechanisms a plugin can build on, first used by Feria (the Lamalibre
6
6
 
7
7
  Agents install plugins with `npm install` from the Lamalibre registry. A networked registry accepts nothing anonymously, and an agent must never hold a long-lived registry credential. So the panel holds one credential for the registry and, each time an agent is about to install a plugin, asks the registry for a one-hour read-only token owned by that agent. The agent writes it to a throw-away npm configuration file for that one install and deletes it afterwards.
8
8
 
9
+ The panel's own npm calls use the same credential: installing a plugin, fetching a version to stage an update, and reading an agent package's integrity to pin it all run with npm routed to the credential's registry for its scope and authenticated with the panel's service token — through a throw-away userconfig of the same kind (0600 in a private temporary directory, named to npm as `npm_config_userconfig`, removed once npm has run), never the service account's `~/.npmrc`. A registry that answers `401` has the token obtained again once; a token still refused, or `403`, fails the operation naming the registry and the status. Without a credential the panel's npm runs as the machine configures it (the public registry by default).
10
+
9
11
  The panel itself can authenticate to the registry in two ways: with a long-lived token an administrator pasted in, or — the recommended way — as its own **service principal**: an OpenID Connect client on the relay's Authelia named `lamaste-server`. In that mode nothing long-lived is pasted anywhere; the panel proves its identity to Authelia with a secret it generated itself, Authelia issues a short-lived JWT, and the registry exchanges that JWT for a registry token.
10
12
 
11
13
  Plugins use the same Authelia to let people and programs log in. A plugin's manifest declares its OIDC clients — a CLI that logs in with the device-code flow, a service that authenticates with client credentials — and the panel writes them into Authelia's configuration when the plugin is enabled.
@@ -156,7 +158,7 @@ Admin only. What is configured — never a token.
156
158
 
157
159
  ### `PUT /api/registry-credential`
158
160
 
159
- Admin only, 10 per minute. Verifies the whole chain against the registry, then stores the credential at `/etc/lamalibre/lamaste/registry-credential.json` (0600).
161
+ Admin only, 10 per minute. Verifies the whole chain against the registry, then stores the credential at `/etc/lamalibre/lamaste/registry-credential.json` (0600). From then on the panel's own installs, update staging and agent-half pinning authenticate to `registryUrl` for `scope` with the service token (see In Plain English); a package published only there installs from the panel.
160
162
 
161
163
  ```json
162
164
  { "registryUrl": "https://feria.example.com", "auth": { "kind": "oidc" } }
package/vendor/docs/04-api-reference/tunnels.md CHANGED
@@ -275,7 +275,7 @@ curl -s --cert client.p12:password \
275
275
 
276
276
  ### `GET /api/tunnels/agent-config`
277
277
 
278
- Returns the Chisel client configuration for one agent: the enabled tunnels it carries that the Chisel authfile actually grants it, and nothing else. A tunnel on a reserved port or sharing its port with another tunnel (possible only in state written before those checks) is withheld — Chisel would refuse the agent's whole session for it. Used by `lamaste-agent setup`, `update`, and the agent's 30-second sync timer (`lamaste-agent sync`), on both macOS and Linux.
278
+ Returns the Chisel client configuration for one agent: the enabled tunnels it carries that the Chisel authfile actually grants it, and nothing else. A tunnel on a reserved port or sharing its port with another tunnel (possible only in state written before those checks) is withheld — Chisel would refuse the agent's whole session for it. Used by `lamaste-agent setup`, `update`, and the agent's 30-second sync timer (`lamaste-agent sync`), on both macOS and Linux. A call with an agent certificate is also that agent's contact with the relay: the panel records when each agent last called (`lastSeenAt` on [`GET /api/certs/agent`](certificates.md), `agentLastSeenAt` on the hostings of [agent-hosted plugins](agent-hosted-plugins.md#when-the-hosting-agent-is-offline)); an administrator's `?agent=` call is not.
279
279
 
280
280
  **Required capability:** `tunnels:read`
281
281
 
@@ -299,20 +299,24 @@ curl -s --cert client.p12:password \
299
299
  "agentLabel": "laptop",
300
300
  "chiselArgs": ["client", "https://tunnel.example.com:443", "R:127.0.0.1:3000:127.0.0.1:3000"],
301
301
  "chiselCredentialIssuedAt": "2026-09-20T10:12:00.000Z",
302
- "tunnels": [{ "port": 3000, "subdomain": "app" }]
302
+ "tunnels": [{ "port": 3000, "subdomain": "app" }],
303
+ "hostFactsHash": "…64 hex…"
303
304
  }
304
305
  ```
305
306
 
307
+ `hostFactsHash` is in an agent certificate's answer only, never in an administrator's `?agent=` answer. The answer also lists the agent-hosted plugins on the agent and the jobs for its sync (`appPlugins`, `agentJobs` — see [Agent-Hosted Plugins](agent-hosted-plugins.md#what-the-agent-does-with-it)).
308
+
306
309
  **Response (200) — admin without `?agent=`:** `{ "domain": "...", "chiselServerUrl": "..." }` only. A Chisel configuration is meaningless without an agent to carry it.
307
310
 
308
- | Field | Type | Description |
309
- | -------------------------- | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
310
- | `domain` | `string` | Base domain |
311
- | `chiselServerUrl` | `string` | Full URL to the Chisel server endpoint |
312
- | `agentLabel` | `string` | The agent this configuration is for |
313
- | `chiselArgs` | `string[]` | Chisel client arguments: `client`, the server URL, and one `R:127.0.0.1:<port>:127.0.0.1:<port>` remote per tunnel. No `--tls-skip-verify` (the agent verifies the relay's certificate) and no credential — the agent supplies its own through the service environment, never argv |
314
- | `chiselCredentialIssuedAt` | `string \| null` | When the agent's current Chisel credential was issued — a timestamp, never the credential. An agent holding a credential with a different issue time (an administrator rotated it) fetches the current one from `GET /api/agents/me/chisel-credential` |
315
- | `tunnels` | `array` | The agent's enabled tunnels with port and subdomain |
311
+ | Field | Type | Description |
312
+ | -------------------------- | ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
313
+ | `domain` | `string` | Base domain |
314
+ | `chiselServerUrl` | `string` | Full URL to the Chisel server endpoint |
315
+ | `agentLabel` | `string` | The agent this configuration is for |
316
+ | `chiselArgs` | `string[]` | Chisel client arguments: `client`, the server URL, and one `R:127.0.0.1:<port>:127.0.0.1:<port>` remote per tunnel. No `--tls-skip-verify` (the agent verifies the relay's certificate) and no credential — the agent supplies its own through the service environment, never argv |
317
+ | `chiselCredentialIssuedAt` | `string \| null` | When the agent's current Chisel credential was issued — a timestamp, never the credential. An agent holding a credential with a different issue time (an administrator rotated it) fetches the current one from `GET /api/agents/me/chisel-credential` |
318
+ | `tunnels` | `array` | The agent's enabled tunnels with port and subdomain |
319
+ | `hostFactsHash` | `string \| null` | Agent certificates only: the SHA-256 of the [host facts](agent-hosted-plugins.md#host-facts) the relay stores for the agent, computed as the agent computes it over its own (`hostFactsHash` in `@lamalibre/lamaste@4.4.1`); `null` when it stores none. The agent's sync reports its facts again when this is not the hash of its own, so a record replaced since its last report — the agent enrolled again on its label, the relay restored from a backup — has them again after one sync, not a day. An agent behind a relay without the field reports as before |
316
320
 
317
321
  **Errors:**
318
322
 
package/vendor/docs/05-operations/backup-and-restore.md CHANGED
@@ -197,7 +197,7 @@ sudo chown lamaste-authelia:lamaste-authelia /etc/authelia/db.sqlite3* /etc/auth
197
197
  sudo chmod 600 /etc/authelia/db.sqlite3* /etc/authelia/notifications.txt
198
198
  ```
199
199
 
200
- A backup taken on a version before the privilege boundary holds root-owned Authelia files and older unit files. After restoring one, re-run `npx @lamalibre/create-lamaste@4.3.1 --yes`: the redeploy rewrites the `chisel` and `authelia` units and converts the ownership of `/etc/authelia`, the Chisel key and the PKI directory (see [Upgrades](upgrades.md)).
200
+ A backup taken on a version before the privilege boundary holds root-owned Authelia files and older unit files. After restoring one, re-run `npx @lamalibre/create-lamaste@4.4.1 --yes`: the redeploy rewrites the `chisel` and `authelia` units and converts the ownership of `/etc/authelia`, the Chisel key and the PKI directory (see [Upgrades](upgrades.md)).
201
201
 
202
202
  The panel re-applies the authfile's group and mode itself on every start, so a Chisel that fails to read it before the panel is up is started again by the panel's reconciliation.
203
203
 
@@ -320,6 +320,7 @@ The atomic write pattern (write to temporary file, sync, rename) ensures that a
320
320
  - **`/etc/authelia/.secrets.json`** contains the JWT secret. If this changes, all active Authelia sessions are invalidated and users must re-authenticate.
321
321
  - **`/etc/authelia/db.sqlite3`** contains Authelia session data and TOTP registration states. It can be regenerated (users re-enroll TOTP), but this is disruptive.
322
322
  - **Let's Encrypt account credentials** in `/etc/letsencrypt/accounts/` are tied to the email address used during registration. If lost, certbot creates a new account on next run.
323
+ - **Settings of agent-hosted plugins** are kept by each plugin's agent half on its hosting agent — `settings.json` and `secrets.json` in its data directory (`/var/lib/lamalibre/apps/<route>/` for an agent half Lamaste installs) — not on the relay. The relay's `state.db` holds a cache of the non-secret values only, which it reads again from the agent half whenever the settings are read while the hosting is up. A relay backup therefore restores no plugin secret: back them up with the agent half's data. An agent half reads its restored files when it starts ([Agent-Hosted Plugins](../04-api-reference/agent-hosted-plugins.md#settings)); since restored files carry another revision than the one Lamaste last wrote, the relay's next read records the restore as a change made outside Lamaste (`plugin.settings.changed-outside-lamaste`, with the names of the settings that differ) and warns the administrators — expected after a restore you made.
323
324
 
324
325
  ## Quick Reference
325
326
 
package/vendor/docs/05-operations/uninstalling.md CHANGED
@@ -29,7 +29,7 @@ It stops and disables the panel, gatekeeper, Chisel and Authelia; removes their
29
29
  The manual guide is also available from the CLI:
30
30
 
31
31
  ```bash
32
- npx @lamalibre/create-lamaste@4.3.1 --uninstall
32
+ npx @lamalibre/create-lamaste@4.4.1 --uninstall
33
33
  ```
34
34
 
35
35
  This prints the same steps listed below.
package/vendor/docs/05-operations/upgrades.md CHANGED
@@ -27,13 +27,13 @@ Coming from 3.x, upgrade the **agents first**, as 4.0 required: agents from befo
27
27
  On each agent machine, after the server:
28
28
 
29
29
  ```bash
30
- sudo npm install -g @lamalibre/lamaste-agent@4.3.1
30
+ sudo npm install -g @lamalibre/lamaste-agent@4.4.1
31
31
  lamaste-agent update
32
32
  ```
33
33
 
34
34
  `update` applies the panel's configuration, restarts the tunnel client, and installs the sync timer (which applies later tunnel changes within 30 seconds). An agent originally set up with `npx` must be installed globally first — the sync timer runs the installed program. On Linux it also rewrites the agent panel's user unit so the panel starts at boot. An agent from before 4.0 rotates its Chisel credential once on its first sync, because older versions exposed it in process arguments and 0644 unit files. The Desktop App updates the agents it manages.
35
35
 
36
- A machine that hosts app plugins' agent halves needs the root-owned install shown above and its app host helper enabled once with `sudo lamaste-agent apphost enable` (see [App host](../04-api-reference/app-host.md)); after replacing the server's relay signing key, run `sudo lamaste-agent apphost pin` there.
36
+ A machine that hosts app plugins' agent halves needs the root-owned install shown above and its app host helper enabled once with `sudo lamaste-agent apphost enable` (see [App host](../04-api-reference/app-host.md)); after replacing the server's relay signing key, run `sudo lamaste-agent apphost pin` there. An upgrade of `lamaste-agent` does not replace that helper: when a release raises the app host protocol (4.4 speaks 2), run `sudo lamaste-agent apphost enable` again there — until then the agent refuses to install agent halves and the server does not offer it for hosting (`lamaste-agent apphost status` shows the helper as out of date).
37
37
 
38
38
  ### Updating Lamaste (Panel Server and Client)
39
39
 
@@ -84,7 +84,7 @@ exit
84
84
 
85
85
  ### Updating Chisel
86
86
 
87
- Chisel is the tunnel server binary at `/usr/local/bin/chisel`. Lamaste pins it: server and agents run Chisel 1.12.0 (`CHISEL_RELEASE` in `@lamalibre/lamaste@4.3.1`), downloaded from the fixed release URL and verified against a pinned SHA-256 before it is unpacked. **Do not replace the binary by hand.** On the server, `create-lamaste` installs it (as root) and replaces a binary that reports any other version; the panel cannot install binaries, and only logs an error at startup when the installed Chisel is not the pinned release (it then restarts Chisel on every authfile change). Each agent's sync replaces its own copy.
87
+ Chisel is the tunnel server binary at `/usr/local/bin/chisel`. Lamaste pins it: server and agents run Chisel 1.12.0 (`CHISEL_RELEASE` in `@lamalibre/lamaste@4.4.1`), downloaded from the fixed release URL and verified against a pinned SHA-256 before it is unpacked. **Do not replace the binary by hand.** On the server, `create-lamaste` installs it (as root) and replaces a binary that reports any other version; the panel cannot install binaries, and only logs an error at startup when the installed Chisel is not the pinned release (it then restarts Chisel on every authfile change). Each agent's sync replaces its own copy.
88
88
 
89
89
  A new Chisel version therefore arrives with a Lamaste release that changes the pin: re-run the installer, which installs it and restarts Chisel. To check what is running:
90
90
 
@@ -98,7 +98,7 @@ Tunnel clients reconnect on their own after the brief interruption (they retry a
98
98
 
99
99
  ### Updating Authelia
100
100
 
101
- Authelia is the authentication server binary at `/usr/local/bin/authelia`. Lamaste pins it too: Authelia 4.39.28 (`AUTHELIA_RELEASE` in `@lamalibre/lamaste@4.3.1`), downloaded by `create-lamaste` from its fixed release URL and verified against a pinned SHA-256 per architecture. A new Authelia version arrives with a Lamaste release that changes the pin — re-run the installer. It stops Authelia while it replaces the binary and starts it again.
101
+ Authelia is the authentication server binary at `/usr/local/bin/authelia`. Lamaste pins it too: Authelia 4.39.28 (`AUTHELIA_RELEASE` in `@lamalibre/lamaste@4.4.1`), downloaded by `create-lamaste` from its fixed release URL and verified against a pinned SHA-256 per architecture. A new Authelia version arrives with a Lamaste release that changes the pin — re-run the installer. It stops Authelia while it replaces the binary and starts it again.
102
102
 
103
103
  An installed Authelia **newer** than the pin is kept, never downgraded: its database may already use a schema the pinned release cannot read, and Authelia refuses to start on a database newer than itself. If you install a newer release by hand, stop the service, replace the binary as root with a `root:root 0755` file, and start it again; check the [Authelia changelog](https://github.com/authelia/authelia/blob/master/CHANGELOG.md) first, since the configuration format may change between versions.
104
104
 
@@ -237,7 +237,7 @@ The panel server, CLI, client, docs and gatekeeper are always redeployed (files
237
237
 
238
238
  ### Version Pinning
239
239
 
240
- Chisel and Authelia are pinned by version and SHA-256 in `packages/core/lib/src/constants.ts` (`CHISEL_RELEASE`, `AUTHELIA_RELEASE`); changing a pin means updating the version and every digest there. The downloads are verified by `downloadVerifiedChisel` / `downloadVerifiedAuthelia` (exported from `@lamalibre/lamaste@4.3.1`) before anything is unpacked; the server installer uses them in `packages/provisioners/server/src/lib/binaries.js`. The configuration the panel writes needs Authelia 4.38 or later.
240
+ Chisel and Authelia are pinned by version and SHA-256 in `packages/core/lib/src/constants.ts` (`CHISEL_RELEASE`, `AUTHELIA_RELEASE`); changing a pin means updating the version and every digest there. The downloads are verified by `downloadVerifiedChisel` / `downloadVerifiedAuthelia` (exported from `@lamalibre/lamaste@4.4.1`) before anything is unpacked; the server installer uses them in `packages/provisioners/server/src/lib/binaries.js`. The configuration the panel writes needs Authelia 4.38 or later.
241
241
 
242
242
  ### Automated Updates
243
243
 
@@ -259,7 +259,7 @@ sudo dpkg-reconfigure -plow unattended-upgrades
259
259
  | Panel server | `/opt/lamalibre/lamaste/lamaste-serverd/` | Re-run `npx @lamalibre/create-lamaste@latest` |
260
260
  | Panel client | `/opt/lamalibre/lamaste/lamaste-server-ui/` | Re-run `npx @lamalibre/create-lamaste@latest` |
261
261
  | Chisel | `/usr/local/bin/chisel` | Pinned; installed by `create-lamaste` |
262
- | Agents | `sudo npm install -g @lamalibre/lamaste-agent@4.3.1` | Upgrade after the server, then `lamaste-agent update` |
262
+ | Agents | `sudo npm install -g @lamalibre/lamaste-agent@4.4.1` | Upgrade after the server, then `lamaste-agent update` |
263
263
  | Authelia | `/usr/local/bin/authelia` | Pinned; installed by `create-lamaste` (newer is kept) |
264
264
  | nginx | System package | `sudo apt-get update && sudo apt-get upgrade` |
265
265
  | certbot | System package | `sudo apt-get update && sudo apt-get upgrade` |