@naisys/hub 3.0.0-beta.38 → 3.0.0-beta.40

package/dist/handlers/hubHeartbeatService.js

@@ -1,11 +1,11 @@
+import { hashToken } from "@naisys/common-node";
 import { HeartbeatSchema, HUB_HEARTBEAT_INTERVAL_MS, HubEvents, } from "@naisys/hub-protocol";
 /** Tracks NAISYS instance heartbeats and pushes aggregate active user status to all instances */
-export function createHubHeartbeatService(naisysServer, { hubDb }, logService) {
-    // Track active agent user IDs per host from heartbeat data
+export function createHubHeartbeatService(naisysServer, { hubDb }, logService, redactionService, runtimeKeyService) {
+    // Active agent user ids per host. Subagents ride under the parent's userId.
     const hostActiveAgents = new Map();
-    // Track each active agent's current run session and its last heartbeat time.
-    // Keyed by hostId so we can drop sessions when a host disconnects.
     const hostActiveSessions = new Map();
+    const sessionKey = (userId, subagentId) => `${userId}:${subagentId ?? 0}`;
     // Track per-agent notification IDs (latestLogId, latestMailId)
     const agentNotifications = new Map();
     /** Update a single notification field for an agent */
@@ -20,7 +20,10 @@ export function createHubHeartbeatService(naisysServer, { hubDb }, logService) {
     // Handle heartbeat from NAISYS instances
     naisysServer.registerEvent(HubEvents.HEARTBEAT, async (hostId, data) => {
         const parsed = HeartbeatSchema.parse(data);
-        const activeUserIds = parsed.activeSessions.map((s) => s.userId);
+        // Dedup: a parent and its subagents share a userId.
+        const activeUserIds = [
+            ...new Set(parsed.activeSessions.map((s) => s.userId)),
+        ];
         // Update in-memory per-host active agent IDs
         hostActiveAgents.set(hostId, activeUserIds);
         try {
@@ -42,15 +45,10 @@ export function createHubHeartbeatService(naisysServer, { hubDb }, logService) {
             // aggregate SESSION_HEARTBEAT broadcast runs on its own interval below.
             const sessionMap = new Map();
             for (const session of parsed.activeSessions) {
-                await hubDb.run_session.updateMany({
-                    where: {
-                        user_id: session.userId,
-                        run_id: session.runId,
-                        session_id: session.sessionId,
-                    },
-                    data: { last_active: now },
-                });
-                sessionMap.set(session.userId, {
+                const subagentId = session.subagentId ?? 0;
+                sessionMap.set(sessionKey(session.userId, subagentId), {
+                    userId: session.userId,
+                    subagentId: subagentId === 0 ? null : subagentId,
                     runId: session.runId,
                     sessionId: session.sessionId,
                     lastActive: now,
@@ -58,15 +56,62 @@ export function createHubHeartbeatService(naisysServer, { hubDb }, logService) {
                     state: session.state,
                 });
             }
+            if (parsed.activeSessions.length > 0) {
+                await hubDb.run_session.updateMany({
+                    where: {
+                        OR: parsed.activeSessions.map((session) => ({
+                            user_id: session.userId,
+                            run_id: session.runId,
+                            subagent_id: session.subagentId ?? 0,
+                            session_id: session.sessionId,
+                        })),
+                    },
+                    data: { last_active: now },
+                });
+            }
             hostActiveSessions.set(hostId, sessionMap);
+            // Self-heal: register each plaintext with the redactor (idempotent),
+            // then mint + push a fresh key if the hash is missing or mismatched.
+            // Old plaintexts accumulate per user so leaks during the rotate
+            // transition window still get scrubbed; AGENT_STOP clears the set.
+            if (parsed.runtimeApiKeys?.length) {
+                const userIds = parsed.runtimeApiKeys.map((k) => k.userId);
+                const users = await hubDb.users.findMany({
+                    where: { id: { in: userIds } },
+                    select: { id: true, api_key_hash: true, enabled: true, archived: true },
+                });
+                const userMap = new Map(users.map((u) => [u.id, u]));
+                for (const claim of parsed.runtimeApiKeys) {
+                    if (claim.runtimeApiKey) {
+                        redactionService.registerRuntimeApiKey(claim.userId, claim.runtimeApiKey);
+                    }
+                    const user = userMap.get(claim.userId);
+                    if (!user || !user.enabled || user.archived)
+                        continue;
+                    if (claim.runtimeApiKey &&
+                        user.api_key_hash &&
+                        hashToken(claim.runtimeApiKey) === user.api_key_hash) {
+                        continue; // hub already knows this key — nothing to do
+                    }
+                    try {
+                        const runtimeApiKey = await runtimeKeyService.issueRuntimeApiKey(claim.userId);
+                        naisysServer.sendMessage(hostId, HubEvents.RUNTIME_KEY_REISSUE, {
+                            userId: claim.userId,
+                            runtimeApiKey,
+                        });
+                    }
+                    catch (err) {
+                        logService.error(`[Hub:Heartbeat] Failed to reissue runtime key for user ${claim.userId}: ${err}`);
+                    }
+                }
+            }
         }
         catch (error) {
             logService.error(`[Hub:Heartbeat] Error updating heartbeat for host ${hostId}: ${error}`);
         }
     });
-    // Clean up tracking when a host disconnects. Runtime API keys are not
-    // touched here — they're rotated on the next AGENT_START and revoked
-    // explicitly on user disable/archive/delete.
+    // Runtime keys aren't touched on disconnect — the DB hash stays valid;
+    // if the agent reconnects, heartbeat re-registers the plaintext.
     naisysServer.registerEvent(HubEvents.CLIENT_DISCONNECTED, (hostId) => {
         hostActiveAgents.delete(hostId);
         hostActiveSessions.delete(hostId);
@@ -99,10 +144,11 @@ export function createHubHeartbeatService(naisysServer, { hubDb }, logService) {
     function pushSessionHeartbeat() {
         const updates = [];
         for (const sessions of hostActiveSessions.values()) {
-            for (const [userId, info] of sessions) {
+            for (const info of sessions.values()) {
                 updates.push({
-                    userId,
+                    userId: info.userId,
                     runId: info.runId,
+                    subagentId: info.subagentId ?? undefined,
                     sessionId: info.sessionId,
                     lastActive: info.lastActive,
                     paused: info.paused,

package/dist/handlers/hubHostService.js

@@ -37,6 +37,9 @@ export function createHubHostService(naisysServer, hostRegistrar, logService) {
     naisysServer.registerEvent(HubEvents.CLIENT_CONNECTED, (_hostId, connection) => {
         broadcastHostList(connection);
     });
+    naisysServer.registerEvent(HubEvents.CLIENT_DISCONNECTED, () => {
+        broadcastHostList();
+    });
     naisysServer.registerEvent(HubEvents.HOSTS_CHANGED, async () => {
         logService.log("[Hub:Hosts] Received HOSTS_CHANGED, refreshing cache...");
         await hostRegistrar.refreshHosts();

package/dist/handlers/hubLogService.js

@@ -1,6 +1,6 @@
 import { HubEvents, LogWriteRequestSchema, } from "@naisys/hub-protocol";
 /** Handles log_write events from NAISYS instances (fire-and-forget) */
-export function createHubLogService(naisysServer, { hubDb }, logService, heartbeatService) {
+export function createHubLogService(naisysServer, { hubDb }, logService, heartbeatService, redactionService) {
     // Track last pushed log ID per session for gap detection
     const lastPushedLogId = new Map();
     naisysServer.registerEvent(HubEvents.LOG_WRITE, async (hostId, data) => {
@@ -11,17 +11,22 @@ export function createHubLogService(naisysServer, { hubDb }, logService, heartbe
             const sessionUpdates = new Map();
             for (const entry of parsed.entries) {
                 const now = new Date().toISOString();
-                const lineCount = entry.message.split("\n").length;
+                const message = redactionService.redact(entry.message);
+                const lineCount = message.split("\n").length;
+                const subagentId = entry.subagentId ?? 0;
+                // Wire format: undefined for parent (subagent_id 0 in DB), number otherwise
+                const wireSubagentId = subagentId === 0 ? undefined : subagentId;
                 const log = await hubDb.context_log.create({
                     data: {
                         user_id: entry.userId,
                         run_id: entry.runId,
+                        subagent_id: subagentId,
                         session_id: entry.sessionId,
                         host_id: hostId,
                         role: entry.role,
                         source: entry.source ?? null,
                         type: entry.type ?? null,
-                        message: entry.message,
+                        message,
                         created_at: entry.createdAt,
                         attachment_id: entry.attachmentId ?? null,
                     },
@@ -31,6 +36,7 @@ export function createHubLogService(naisysServer, { hubDb }, logService, heartbe
                     where: {
                         user_id: entry.userId,
                         run_id: entry.runId,
+                        subagent_id: subagentId,
                         session_id: entry.sessionId,
                     },
                     data: {
@@ -69,18 +75,19 @@ export function createHubLogService(naisysServer, { hubDb }, logService, heartbe
                     }
                 }
                 // Collect push entry with DB-assigned ID
-                const sessionKey = `${entry.userId}-${entry.runId}-${entry.sessionId}`;
+                const sessionKey = `${entry.userId}-${entry.runId}-${subagentId}-${entry.sessionId}`;
                 const previousId = lastPushedLogId.get(sessionKey) ?? null;
                 pushEntries.push({
                     id: log.id,
                     previousId,
                     userId: entry.userId,
                     runId: entry.runId,
+                    subagentId: wireSubagentId,
                     sessionId: entry.sessionId,
                     role: entry.role,
                     source: entry.source,
                     type: entry.type,
-                    message: entry.message,
+                    message,
                     createdAt: entry.createdAt,
                     attachmentId: attachmentPublicId,
                     attachmentFilename,
@@ -98,6 +105,7 @@ export function createHubLogService(naisysServer, { hubDb }, logService, heartbe
                     sessionUpdates.set(sessionKey, {
                         userId: entry.userId,
                         runId: entry.runId,
+                        subagentId: wireSubagentId,
                         sessionId: entry.sessionId,
                         lastActive: now,
                         latestLogId: log.id,

package/dist/handlers/hubRedactionService.js

@@ -0,0 +1,93 @@
+import { HubEvents } from "@naisys/hub-protocol";
+const MIN_SECRET_LENGTH = 6;
+const PATTERN_REPLACEMENTS = [
+    {
+        pattern: /Authorization:\s*(Bearer|Basic)\s+\S+/gi,
+        replacement: "Authorization: $1 [REDACTED]",
+    },
+    {
+        pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]+?-----END [A-Z ]*PRIVATE KEY-----/g,
+        replacement: "[REDACTED:PRIVATE_KEY]",
+    },
+    {
+        pattern: /eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g,
+        replacement: "[REDACTED:JWT]",
+    },
+    {
+        pattern: /AKIA[0-9A-Z]{16}/g,
+        replacement: "[REDACTED:AWS_KEY]",
+    },
+];
+/**
+ * Strips sensitive values before they hit the DB or get rebroadcast. Two
+ * sources:
+ *  - DB variables flagged sensitive
+ *  - Runtime NAISYS_API_KEY plaintexts, registered by issueRuntimeApiKey
+ *    and accumulated per-user as a Set. Heartbeat-driven re-registration
+ *    self-heals across hub restarts; AGENT_STOP clears the Set.
+ */
+export async function createHubRedactionService(naisysServer, { hubDb }, logService) {
+    // Sorted longest-first so a secret that is a prefix of another doesn't
+    // get partially replaced before the longer match runs.
+    let dbSecrets = [];
+    const runtimeApiKeys = new Map();
+    async function rebuildDbSecrets() {
+        const rows = await hubDb.variables.findMany({ where: { sensitive: true } });
+        dbSecrets = rows
+            .filter((r) => r.value && r.value.length >= MIN_SECRET_LENGTH)
+            .map((r) => ({ value: r.value, key: r.key }))
+            .sort((a, b) => b.value.length - a.value.length);
+    }
+    function redact(text) {
+        if (!text)
+            return text ?? "";
+        let out = text;
+        for (const { value, key } of dbSecrets) {
+            if (out.includes(value)) {
+                out = out.split(value).join(`[REDACTED:${key}]`);
+            }
+        }
+        for (const [userId, plaintexts] of runtimeApiKeys) {
+            for (const plaintext of plaintexts) {
+                if (out.includes(plaintext)) {
+                    out = out
+                        .split(plaintext)
+                        .join(`[REDACTED:NAISYS_API_KEY:${userId}]`);
+                }
+            }
+        }
+        for (const { pattern, replacement } of PATTERN_REPLACEMENTS) {
+            out = out.replace(pattern, replacement);
+        }
+        return out;
+    }
+    function registerRuntimeApiKey(userId, plaintext) {
+        if (!plaintext || plaintext.length < MIN_SECRET_LENGTH)
+            return;
+        let set = runtimeApiKeys.get(userId);
+        if (!set) {
+            set = new Set();
+            runtimeApiKeys.set(userId, set);
+        }
+        set.add(plaintext);
+    }
+    function revokeRuntimeApiKey(userId) {
+        runtimeApiKeys.delete(userId);
+    }
+    naisysServer.registerEvent(HubEvents.VARIABLES_CHANGED, async () => {
+        try {
+            await rebuildDbSecrets();
+        }
+        catch (error) {
+            logService.error(`[Hub:Redaction] Failed to rebuild secrets after VARIABLES_CHANGED: ${error}`);
+        }
+    });
+    await rebuildDbSecrets();
+    return {
+        redact,
+        registerRuntimeApiKey,
+        revokeRuntimeApiKey,
+        rebuildDbSecrets,
+    };
+}
+//# sourceMappingURL=hubRedactionService.js.map

package/dist/handlers/hubRedactionService.test.js

@@ -0,0 +1,116 @@
+import { HubEvents } from "@naisys/hub-protocol";
+import { beforeEach, describe, expect, test, vi } from "vitest";
+import { createHubRedactionService } from "./hubRedactionService.js";
+function createServerHarness() {
+    const handlers = new Map();
+    const server = {
+        registerEvent: vi.fn((event, handler) => {
+            handlers.set(event, handler);
+        }),
+    };
+    async function emit(event, ...args) {
+        const handler = handlers.get(event);
+        if (!handler)
+            throw new Error(`No handler for ${event}`);
+        await handler(...args);
+    }
+    return { server, emit };
+}
+function createHubDb(initialRows) {
+    let rows = [...initialRows];
+    const hubDb = {
+        variables: {
+            findMany: vi.fn(({ where }) => Promise.resolve(rows.filter((r) => r.sensitive === where.sensitive))),
+        },
+    };
+    return {
+        hubDb,
+        setRows: (next) => {
+            rows = [...next];
+        },
+    };
+}
+function createLogger() {
+    return {
+        log: vi.fn(),
+        error: vi.fn(),
+        disableConsole: vi.fn(),
+    };
+}
+describe("hubRedactionService", () => {
+    let server;
+    let emit;
+    beforeEach(() => {
+        const harness = createServerHarness();
+        server = harness.server;
+        emit = harness.emit;
+    });
+    test("redacts sensitive variable values", async () => {
+        const { hubDb } = createHubDb([
+            { key: "OPENAI_API_KEY", value: "sk-abc123def456", sensitive: true },
+            { key: "PUBLIC_VAR", value: "not-a-secret", sensitive: false },
+        ]);
+        const svc = await createHubRedactionService(server, { hubDb }, createLogger());
+        expect(svc.redact("call with sk-abc123def456 here")).toBe("call with [REDACTED:OPENAI_API_KEY] here");
+        expect(svc.redact("not-a-secret stays")).toBe("not-a-secret stays");
+    });
+    test("skips sensitive values shorter than 6 chars", async () => {
+        const { hubDb } = createHubDb([
+            { key: "SHORT", value: "abc", sensitive: true },
+            { key: "LONG_ENOUGH", value: "123456", sensitive: true },
+        ]);
+        const svc = await createHubRedactionService(server, { hubDb }, createLogger());
+        expect(svc.redact("abc and 123456")).toBe("abc and [REDACTED:LONG_ENOUGH]");
+    });
+    test("longest-first ordering avoids partial replacement", async () => {
+        const { hubDb } = createHubDb([
+            { key: "SHORT_KEY", value: "abc123", sensitive: true },
+            { key: "LONG_KEY", value: "abc1234567", sensitive: true },
+        ]);
+        const svc = await createHubRedactionService(server, { hubDb }, createLogger());
+        expect(svc.redact("token=abc1234567")).toBe("token=[REDACTED:LONG_KEY]");
+    });
+    test("registers and revokes runtime API keys per user", async () => {
+        const { hubDb } = createHubDb([]);
+        const svc = await createHubRedactionService(server, { hubDb }, createLogger());
+        svc.registerRuntimeApiKey(7, "deadbeefcafebabe");
+        expect(svc.redact("auth=deadbeefcafebabe")).toBe("auth=[REDACTED:NAISYS_API_KEY:7]");
+        svc.revokeRuntimeApiKey(7);
+        expect(svc.redact("auth=deadbeefcafebabe")).toBe("auth=deadbeefcafebabe");
+    });
+    test("accumulates plaintexts per user so old keys stay redactable mid-rotation", async () => {
+        const { hubDb } = createHubDb([]);
+        const svc = await createHubRedactionService(server, { hubDb }, createLogger());
+        svc.registerRuntimeApiKey(7, "oldkey1234567");
+        svc.registerRuntimeApiKey(7, "newkey7654321");
+        expect(svc.redact("oldkey1234567 and newkey7654321")).toBe("[REDACTED:NAISYS_API_KEY:7] and [REDACTED:NAISYS_API_KEY:7]");
+        svc.revokeRuntimeApiKey(7);
+        expect(svc.redact("oldkey1234567 and newkey7654321")).toBe("oldkey1234567 and newkey7654321");
+    });
+    test("pattern fallbacks catch shapes not in the secret list", async () => {
+        const { hubDb } = createHubDb([]);
+        const svc = await createHubRedactionService(server, { hubDb }, createLogger());
+        expect(svc.redact("Authorization: Bearer xyz.token.here")).toBe("Authorization: Bearer [REDACTED]");
+        expect(svc.redact("AKIAIOSFODNN7EXAMPLE")).toBe("[REDACTED:AWS_KEY]");
+        expect(svc.redact("header eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c trail")).toBe("header [REDACTED:JWT] trail");
+    });
+    test("redact returns empty string for null/undefined", async () => {
+        const { hubDb } = createHubDb([]);
+        const svc = await createHubRedactionService(server, { hubDb }, createLogger());
+        expect(svc.redact(null)).toBe("");
+        expect(svc.redact(undefined)).toBe("");
+        expect(svc.redact("")).toBe("");
+    });
+    test("rebuilds dbSecrets on VARIABLES_CHANGED", async () => {
+        const { hubDb, setRows } = createHubDb([
+            { key: "OLD_KEY", value: "old-secret-value", sensitive: true },
+        ]);
+        const svc = await createHubRedactionService(server, { hubDb }, createLogger());
+        expect(svc.redact("old-secret-value")).toBe("[REDACTED:OLD_KEY]");
+        setRows([{ key: "NEW_KEY", value: "new-secret-value", sensitive: true }]);
+        await emit(HubEvents.VARIABLES_CHANGED, 1);
+        expect(svc.redact("old-secret-value")).toBe("old-secret-value");
+        expect(svc.redact("new-secret-value")).toBe("[REDACTED:NEW_KEY]");
+    });
+});
+//# sourceMappingURL=hubRedactionService.test.js.map

package/dist/handlers/hubRunService.js

@@ -14,18 +14,42 @@ export function createHubRunService(naisysServer, { hubDb }, logService) {
     naisysServer.registerEvent(HubEvents.SESSION_CREATE, async (hostId, data, ack) => {
         try {
             const parsed = SessionCreateRequestSchema.parse(data);
-            // Get the last run_id across all sessions
-            const lastRun = await hubDb.run_session.findFirst({
-                select: { run_id: true },
-                orderBy: { run_id: "desc" },
-            });
-            const newRunId = lastRun ? lastRun.run_id + 1 : 1;
+            // Subagent path: inherit the parent's runId rather than allocating a new one.
+            let runId;
+            if (parsed.subagentId !== undefined) {
+                if (parsed.parentRunId === undefined) {
+                    throw new Error("parentRunId is required when subagentId is set");
+                }
+                // Confirm the parent's run row exists before materializing a child
+                // under it — otherwise we'd silently create an orphan subagent row.
+                const parent = await hubDb.run_session.findFirst({
+                    where: {
+                        user_id: parsed.userId,
+                        run_id: parsed.parentRunId,
+                        subagent_id: 0,
+                    },
+                    select: { run_id: true },
+                });
+                if (!parent) {
+                    throw new Error(`parent run ${parsed.parentRunId} not found for user ${parsed.userId}`);
+                }
+                runId = parsed.parentRunId;
+            }
+            else {
+                const lastRun = await hubDb.run_session.findFirst({
+                    select: { run_id: true },
+                    orderBy: { run_id: "desc" },
+                });
+                runId = lastRun ? lastRun.run_id + 1 : 1;
+            }
+            const subagentId = parsed.subagentId ?? 0;
             const newSessionId = 1;
             const now = new Date().toISOString();
             await hubDb.run_session.create({
                 data: {
                     user_id: parsed.userId,
-                    run_id: newRunId,
+                    run_id: runId,
+                    subagent_id: subagentId,
                     session_id: newSessionId,
                     host_id: hostId,
                     model_name: parsed.modelName,
@@ -35,12 +59,13 @@ export function createHubRunService(naisysServer, { hubDb }, logService) {
             });
             ack({
                 success: true,
-                runId: newRunId,
+                runId,
                 sessionId: newSessionId,
             });
             pushSessionToSupervisors({
                 userId: parsed.userId,
-                runId: newRunId,
+                runId,
+                subagentId: parsed.subagentId,
                 sessionId: newSessionId,
                 modelName: parsed.modelName,
                 createdAt: now,
@@ -55,12 +80,14 @@ export function createHubRunService(naisysServer, { hubDb }, logService) {
     naisysServer.registerEvent(HubEvents.SESSION_INCREMENT, async (hostId, data, ack) => {
         try {
             const parsed = SessionIncrementRequestSchema.parse(data);
-            // Get the max session_id for this user + run
+            const subagentId = parsed.subagentId ?? 0;
+            // Get the max session_id for this user + run + subagent
             const lastSession = await hubDb.run_session.findFirst({
                 select: { session_id: true },
                 where: {
                     user_id: parsed.userId,
                     run_id: parsed.runId,
+                    subagent_id: subagentId,
                 },
                 orderBy: { session_id: "desc" },
             });
@@ -70,6 +97,7 @@ export function createHubRunService(naisysServer, { hubDb }, logService) {
                 data: {
                     user_id: parsed.userId,
                     run_id: parsed.runId,
+                    subagent_id: subagentId,
                     session_id: newSessionId,
                     host_id: hostId,
                     model_name: parsed.modelName,
@@ -81,6 +109,7 @@ export function createHubRunService(naisysServer, { hubDb }, logService) {
             pushSessionToSupervisors({
                 userId: parsed.userId,
                 runId: parsed.runId,
+                subagentId: parsed.subagentId,
                 sessionId: newSessionId,
                 modelName: parsed.modelName,
                 createdAt: now,

package/dist/handlers/hubRuntimeKeyService.js

@@ -0,0 +1,27 @@
+import { hashToken } from "@naisys/common-node";
+import { randomBytes } from "crypto";
+/**
+ * Mints and revokes per-user runtime API keys. 32 random bytes; only the
+ * hash is persisted. Plaintext is registered with the redactor on issue so
+ * leaks get scrubbed; the user's Set is cleared on revoke.
+ */
+export function createHubRuntimeKeyService({ hubDb }, redactionService) {
+    async function issueRuntimeApiKey(userId) {
+        const token = randomBytes(32).toString("hex");
+        await hubDb.users.update({
+            where: { id: userId },
+            data: { api_key_hash: hashToken(token) },
+        });
+        redactionService.registerRuntimeApiKey(userId, token);
+        return token;
+    }
+    async function revokeRuntimeApiKey(userId) {
+        await hubDb.users.update({
+            where: { id: userId },
+            data: { api_key_hash: null },
+        });
+        redactionService.revokeRuntimeApiKey(userId);
+    }
+    return { issueRuntimeApiKey, revokeRuntimeApiKey };
+}
+//# sourceMappingURL=hubRuntimeKeyService.js.map

package/dist/handlers/hubSendMailService.js

@@ -1,9 +1,13 @@
 import { HubEvents, } from "@naisys/hub-protocol";
 /** Pure send-mail service with no auto-start logic, breaking the circular dependency */
-export function createHubSendMailService(naisysServer, { hubDb }, heartbeatService) {
+export function createHubSendMailService(naisysServer, { hubDb }, heartbeatService, redactionService) {
     /** Send a mail message directly by user IDs */
     async function sendMail(params) {
         const now = new Date();
+        // Redact once at entry — DB row, supervisor push, and any future fan-out
+        // all read from these locals.
+        const subject = redactionService.redact(params.subject);
+        const body = redactionService.redact(params.body);
         // Build participants string from usernames (sorted alphabetically)
         const allUserIds = [
             ...new Set([params.fromUserId, ...params.recipientUserIds]),
@@ -24,8 +28,8 @@ export function createHubSendMailService(naisysServer, { hubDb }, heartbeatServi
                     host_id: params.hostId,
                     kind: params.kind,
                     participants,
-                    subject: params.subject,
-                    body: params.body,
+                    subject,
+                    body,
                     created_at: now,
                 },
             });
@@ -114,8 +118,8 @@ export function createHubSendMailService(naisysServer, { hubDb }, heartbeatServi
             fromUserId: params.fromUserId,
             kind: params.kind,
             messageId: message.id,
-            subject: params.subject,
-            body: params.body,
+            subject,
+            body,
             createdAt: now.toISOString(),
             participants,
             attachments,

package/dist/handlers/hubVariablePatchService.js

@@ -0,0 +1,54 @@
+import { OPENAI_CODEX_ACCESS_TOKEN_VAR, OPENAI_CODEX_EXPIRES_AT_VAR, OPENAI_CODEX_REFRESH_TOKEN_VAR, } from "@naisys/common";
+import { HubEvents, VariablePatchRequestSchema, } from "@naisys/hub-protocol";
+// Allowlist + per-key storage policy. Without this, a compromised host could
+// rotate any API key and have the hub broadcast it to every other host.
+const clientPatchableVariables = new Map([
+    [OPENAI_CODEX_ACCESS_TOKEN_VAR, { sensitive: true, exportToShell: false }],
+    [OPENAI_CODEX_REFRESH_TOKEN_VAR, { sensitive: true, exportToShell: false }],
+    [OPENAI_CODEX_EXPIRES_AT_VAR, { sensitive: false, exportToShell: false }],
+]);
+export function createHubVariablePatchService(naisysServer, { hubDb }, configService, redactionService, logService) {
+    async function patchVariables(hostId, request) {
+        const denied = request.updates.find(({ key }) => !clientPatchableVariables.has(key));
+        if (denied) {
+            logService.error(`[Hub:Variables] Rejected patch from host ${hostId}: variable '${denied.key}' is not patchable by NAISYS clients.`);
+            return;
+        }
+        await hubDb.$transaction(async (tx) => {
+            for (const update of request.updates) {
+                const policy = clientPatchableVariables.get(update.key);
+                await tx.variables.upsert({
+                    where: { key: update.key },
+                    update: {
+                        value: update.value,
+                        export_to_shell: policy.exportToShell,
+                        sensitive: policy.sensitive,
+                        updated_by: `host:${hostId}`,
+                    },
+                    create: {
+                        key: update.key,
+                        value: update.value,
+                        export_to_shell: policy.exportToShell,
+                        sensitive: policy.sensitive,
+                        created_by: `host:${hostId}`,
+                        updated_by: `host:${hostId}`,
+                    },
+                });
+            }
+        });
+        // Inline rather than firing VARIABLES_CHANGED so the redaction set is
+        // rebuilt before any subsequent log lines ingest.
+        await redactionService.rebuildDbSecrets();
+        await configService.broadcastConfig();
+    }
+    naisysServer.registerEvent(HubEvents.VARIABLE_PATCH, async (hostId, request) => {
+        try {
+            await patchVariables(hostId, request);
+        }
+        catch (error) {
+            logService.error(`[Hub:Variables] Failed to apply variable patch from host ${hostId}: ${error}`);
+        }
+    }, VariablePatchRequestSchema);
+    return { patchVariables };
+}
+//# sourceMappingURL=hubVariablePatchService.js.map