nodal-agents 0.7.0 → 0.7.5

package/cli.js

@@ -13,7 +13,8 @@ var __export = (target, all) => {
 var version_exports = {};
 __export(version_exports, {
   getInstalledVersion: () => getInstalledVersion,
-  getLatestVersion: () => getLatestVersion
+  getLatestVersion: () => getLatestVersion,
+  isNewerVersion: () => isNewerVersion
 });
 import { createRequire } from "module";
 import { fileURLToPath } from "url";
@@ -49,6 +50,20 @@ async function getLatestVersion() {
     return null;
   }
 }
+function parseVersionTriple(v) {
+  const match = /^(\d+)\.(\d+)\.(\d+)/.exec(v);
+  if (!match) return null;
+  return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+function isNewerVersion(candidate, current) {
+  const a = parseVersionTriple(candidate);
+  const b2 = parseVersionTriple(current);
+  if (!a || !b2) return false;
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b2[i]) return a[i] > b2[i];
+  }
+  return false;
+}
 var init_version = __esm({
   "src/lib/version.ts"() {
     "use strict";
@@ -59,8 +74,22 @@ var init_version = __esm({
 import { z } from "zod";
 import { homedir } from "os";
 import { join as join2 } from "path";
-import { readFileSync, writeFileSync, mkdirSync, existsSync as existsSync2 } from "fs";
+import { readFileSync, writeFileSync, mkdirSync, existsSync as existsSync2, chmodSync } from "fs";
+import { execFileSync } from "child_process";
 import { randomBytes } from "crypto";
+function restrictFileToOwner(path) {
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+  if (process.platform !== "win32") return;
+  const user = process.env["USERNAME"] || process.env["USER"];
+  if (!user) return;
+  try {
+    execFileSync("icacls", [path, "/inheritance:r", "/grant:r", `${user}:F`], { stdio: "ignore" });
+  } catch {
+  }
+}
 function ensureConfigDir() {
   for (const dir of [CONFIG_DIR, PID_DIR, LOG_DIR, PG_DATA_DIR]) {
     if (!existsSync2(dir)) {
@@ -81,11 +110,22 @@ function readConfig(configFile = CONFIG_FILE) {
     parsed = { ...parsed, serverActionsKey: randomBytes(32).toString("base64") };
     writeConfig(parsed, configFile);
   }
+  if (!parsed.authSecret) {
+    parsed = { ...parsed, authSecret: randomBytes(32).toString("base64") };
+    writeConfig(parsed, configFile);
+  }
+  if (configFile === CONFIG_FILE) {
+    try {
+      chmodSync(configFile, 384);
+    } catch {
+    }
+  }
   return parsed;
 }
 function writeConfig(config, configFile = CONFIG_FILE) {
   if (configFile === CONFIG_FILE) ensureConfigDir();
-  writeFileSync(configFile, JSON.stringify(config, null, 2), "utf-8");
+  writeFileSync(configFile, JSON.stringify(config, null, 2), { encoding: "utf-8", mode: 384 });
+  restrictFileToOwner(configFile);
 }
 var ConfigSchema, CONFIG_DIR, CONFIG_FILE, PID_DIR, LOG_DIR, PG_DATA_DIR;
 var init_config = __esm({
@@ -133,6 +173,18 @@ var init_config = __esm({
        * files; `readConfig` auto-mints + persists when absent.
        */
       serverActionsKey: z.string().length(44).optional(),
+      /**
+       * Base64-encoded 32-byte AES key used as better-auth's AUTH_SECRET (session
+       * cookie signing) for the web process. Deliberately SEPARATE from
+       * `workerSecret` (M-4): `workerSecret` is the runner's auth frontier — a
+       * leak of it must not also let an attacker forge a signed session cookie.
+       *
+       * Optional in the schema for back-compat with pre-existing config.json
+       * files; `readConfig` auto-mints + persists when absent. On an existing
+       * install this invalidates any active better-auth sessions ONCE (users
+       * re-login) — an acceptable one-time cost for closing the amplification.
+       */
+      authSecret: z.string().length(44).optional(),
       bind: z.enum(["loopback", "lan"]).default("loopback"),
       bearerToken: z.string().optional(),
       /**
@@ -6037,6 +6089,12 @@ var init_policies = __esm({
 });
 
 // ../../node_modules/.pnpm/drizzle-orm@0.45.2_@electri_96bd1661c4535b1384d37581a38c7c74/node_modules/drizzle-orm/pg-core/primary-keys.js
+function primaryKey(...config) {
+  if (config[0].columns) {
+    return new PrimaryKeyBuilder(config[0].columns, config[0].name);
+  }
+  return new PrimaryKeyBuilder(config);
+}
 var PrimaryKeyBuilder, PrimaryKey;
 var init_primary_keys = __esm({
   "../../node_modules/.pnpm/drizzle-orm@0.45.2_@electri_96bd1661c4535b1384d37581a38c7c74/node_modules/drizzle-orm/pg-core/primary-keys.js"() {
@@ -6400,19 +6458,19 @@ function extractTablesRelationalConfig(schema, configHelpers) {
       const relations2 = value.config(
         configHelpers(value.table)
       );
-      let primaryKey;
+      let primaryKey2;
       for (const [relationName, relation] of Object.entries(relations2)) {
         if (tableName) {
           const tableConfig = tablesConfig[tableName];
           tableConfig.relations[relationName] = relation;
-          if (primaryKey) {
-            tableConfig.primaryKey.push(...primaryKey);
+          if (primaryKey2) {
+            tableConfig.primaryKey.push(...primaryKey2);
           }
         } else {
           if (!(dbName in relationsBuffer)) {
             relationsBuffer[dbName] = {
               relations: {},
-              primaryKey
+              primaryKey: primaryKey2
             };
           }
           relationsBuffer[dbName].relations[relationName] = relation;
@@ -11231,6 +11289,10 @@ var init_job = __esm({
       task: z7.string().min(1),
       original_task: z7.string().nullable(),
       chat_id: z7.string().nullable(),
+      // Groups jobs from the same conversational thread (migration 0059) — see
+      // apps/runner/src/job/conversation-id.ts for the stamping rule. Null for
+      // non-conversational jobs (cron/schedule/webhook with no parent).
+      conversation_id: z7.string().guid().nullable(),
       system_prompt: z7.string().nullable(),
       messages: z7.array(z7.record(z7.string(), z7.unknown())),
       tools_used: z7.array(z7.string()),
@@ -11271,6 +11333,7 @@ var init_job = __esm({
       status: JobStatusSchema.default("pending"),
       original_task: z7.string().nullable().optional(),
       chat_id: z7.string().nullable().optional(),
+      conversation_id: z7.string().guid().nullable().optional(),
       system_prompt: z7.string().nullable().optional(),
       request_id: z7.string().nullable().optional(),
       parent_job_id: z7.string().guid().nullable().optional()
@@ -11278,6 +11341,38 @@ var init_job = __esm({
   }
 });
 
+// ../../packages/shared/src/entities/job-classification.ts
+var CHAT_DELIVERY_TOOLS, CHAT_CONTEXT_READ_TOOLS, CHAT_ALLOWED_TOOLS;
+var init_job_classification = __esm({
+  "../../packages/shared/src/entities/job-classification.ts"() {
+    "use strict";
+    CHAT_DELIVERY_TOOLS = [
+      "telegram_send_message",
+      "send_image",
+      "send_file",
+      "send_video",
+      "send_audio",
+      "send_voice",
+      "return_result",
+      "dashboard_publish"
+    ];
+    CHAT_CONTEXT_READ_TOOLS = [
+      "query_memory",
+      "search_history",
+      "skill_view",
+      "list_models",
+      "list_schedules",
+      "file_read",
+      "file_list",
+      "file_search"
+    ];
+    CHAT_ALLOWED_TOOLS = /* @__PURE__ */ new Set([
+      ...CHAT_DELIVERY_TOOLS,
+      ...CHAT_CONTEXT_READ_TOOLS
+    ]);
+  }
+});
+
 // ../../packages/shared/src/entities/task.ts
 import { z as z8 } from "zod";
 var TaskDescriptionSchema, TaskTitleSchema, AgentTaskSchema, AgentTaskInsertSchema;
@@ -11383,7 +11478,9 @@ var init_connector = __esm({
       name: z10.string().min(1).max(120),
       slug: z10.string().min(1).max(80).regex(/^[a-z0-9-]+$/),
       base_url: z10.string().nullable(),
-      // api_key stored encrypted in DB (pgp_sym_encrypt); raw value never returned
+      // audit#2026-07-07 SEC-5: this comment used to claim pgp_sym_encrypt (pgcrypto),
+      // which is not used anywhere. Real encryption is application-level AES-256-GCM
+      // via @nodal-agents/secrets before the value ever reaches the DB; raw value never returned.
       api_key: z10.string().nullable(),
       active: z10.boolean(),
       auth_type: ConnectorAuthTypeSchema,
@@ -11883,6 +11980,13 @@ var init_root_agent = __esm({
   }
 });
 
+// ../../packages/shared/src/system-prompt-cache.ts
+var init_system_prompt_cache = __esm({
+  "../../packages/shared/src/system-prompt-cache.ts"() {
+    "use strict";
+  }
+});
+
 // ../../packages/shared/src/connector-catalog.ts
 var init_connector_catalog = __esm({
   "../../packages/shared/src/connector-catalog.ts"() {
@@ -11914,7 +12018,10 @@ var init_model_catalog = __esm({
           // deepseek-chat is the production alias for DeepSeek V3. Standard tool
           // calling with forced tool_choice supported.
           capabilities: { tools: true, forcedToolChoice: true },
-          contextWindow: 128e3
+          contextWindow: 128e3,
+          // Standard (cache-miss) rate per DeepSeek's public pricing page —
+          // verify against api-docs.deepseek.com/quick_start/pricing if this drifts.
+          pricing: { inputPerMillionUsd: 0.27, outputPerMillionUsd: 1.1 }
         },
         {
           modelId: "deepseek-reasoner",
@@ -11924,7 +12031,8 @@ var init_model_catalog = __esm({
           // reasoning:true). Also requires reasoning_content to be echoed back on
           // assistant messages with tool_calls (the deepseek fetch shim handles this).
           capabilities: { tools: true, forcedToolChoice: true, reasoning: true },
-          contextWindow: 128e3
+          contextWindow: 128e3,
+          pricing: { inputPerMillionUsd: 0.55, outputPerMillionUsd: 2.19 }
         }
       ],
       // ─── Native MiniMax (api.minimax.io/anthropic) ───────────────────────────────
@@ -11937,6 +12045,11 @@ var init_model_catalog = __esm({
       // forced tool_choice with a 400/404 (observed on M3 via OpenRouter); the
       // runtime completion floor covers it. Context windows are docs-sourced where
       // available, else a conservative 200K until a live probe confirms.
+      // No `pricing` yet (unlike deepseek above) — no confidently-current MiniMax
+      // rate card verified at write time. Left as documented debt (Fix #21): the
+      // derived-cost fallback returns 0 for these until pricing is added, same as
+      // every other unpriced entry in this catalog; Guard 1a (token budget) is the
+      // backstop meanwhile.
       minimax: [
         {
           modelId: "MiniMax-M3",
@@ -12197,6 +12310,28 @@ var init_timezone = __esm({
   }
 });
 
+// ../../packages/shared/src/redact-secrets.ts
+var init_redact_secrets = __esm({
+  "../../packages/shared/src/redact-secrets.ts"() {
+    "use strict";
+  }
+});
+
+// ../../packages/shared/src/catastrophic-command.ts
+var init_catastrophic_command = __esm({
+  "../../packages/shared/src/catastrophic-command.ts"() {
+    "use strict";
+  }
+});
+
+// ../../packages/shared/src/approval-impact.ts
+var init_approval_impact = __esm({
+  "../../packages/shared/src/approval-impact.ts"() {
+    "use strict";
+    init_catastrophic_command();
+  }
+});
+
 // ../../packages/shared/src/index.ts
 var init_src2 = __esm({
   "../../packages/shared/src/index.ts"() {
@@ -12207,6 +12342,7 @@ var init_src2 = __esm({
     init_user();
     init_agent();
     init_job();
+    init_job_classification();
     init_task();
     init_credential();
     init_connector();
@@ -12220,11 +12356,15 @@ var init_src2 = __esm({
     init_operation();
     init_providers();
     init_root_agent();
+    init_system_prompt_cache();
     init_connector_catalog();
     init_community_skill_catalog();
     init_model_catalog();
     init_mcp_catalog();
     init_timezone();
+    init_redact_secrets();
+    init_approval_impact();
+    init_catastrophic_command();
   }
 });
 
@@ -12370,7 +12510,13 @@ var init_entities = __esm({
         check(
           "entity_members_role_check",
           sql`${table.role} IN ('owner', 'admin', 'member', 'viewer')`
-        )
+        ),
+        // R5 (audit #2 follow-up, found while sweeping helpers.ts for the SAME
+        // class of phantom constraint): the pglite test DDL already assumed a
+        // user can only be a member of an entity once — this table had no such
+        // constraint in the real schema/migrations. Both columns are NOT NULL, so
+        // a plain UNIQUE is correct (no NULLS NOT DISTINCT needed).
+        uniqueIndex("entity_members_entity_user_unique").on(table.entityId, table.userId)
       ]
     );
   }
@@ -12398,6 +12544,11 @@ var init_llm_keys = __esm({
         apiKeyLast4: text("api_key_last4").notNull().default(""),
         baseUrl: text("base_url"),
         nickname: text("nickname"),
+        // Real context window (tokens) for a custom/local model the catalog can't
+        // know (É-3). Auto-detected from the endpoint at save time or set by the
+        // user; NULL ⇒ fall back to the catalogued value or DEFAULT_CONTEXT_WINDOW.
+        // Used window-relative to trigger compaction before the model overflows.
+        contextWindow: integer("context_window"),
         isActive: boolean("is_active").notNull().default(true),
         createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
         updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
@@ -12422,7 +12573,7 @@ var init_agents = __esm({
         id: uuid("id").primaryKey().defaultRandom(),
         entityId: uuid("entity_id").references(() => entities.id, { onDelete: "cascade" }),
         name: text("name").notNull(),
-        slug: text("slug").notNull().unique(),
+        slug: text("slug").notNull(),
         personality: text("personality").notNull(),
         model: text("model").default("claude-sonnet-4-6-20260217"),
         llmKeyId: uuid("llm_key_id").references(() => entityLlmKeys.id, { onDelete: "set null" }),
@@ -12472,7 +12623,17 @@ var init_agents = __esm({
           "agents_orchestrator_mode_check",
           sql`${table.orchestratorMode} IN ('router', 'planner') OR ${table.orchestratorMode} IS NULL`
         ),
-        check("agents_max_tokens_per_job_check", sql`${table.maxTokensPerJob} >= 0`)
+        check("agents_max_tokens_per_job_check", sql`${table.maxTokensPerJob} >= 0`),
+        // F-6 (audit #2): slug was UNIQUE GLOBALLY, so a 2nd workspace/entity
+        // installing the same community skill's companion agent (or any agent
+        // sharing a slug with another entity's agent) would crash the insert —
+        // and, in multi-user mode, let one entity enumerate/squat another's
+        // slugs. Scoped to (entity_id, slug): every real insert always sets
+        // entityId (createAgentRepo takes it as a required param — no production
+        // path leaves it NULL), but the column itself is nullable, so
+        // NULLS NOT DISTINCT closes the same NULL-entity gap as DB-1/agent_plugins
+        // (multiple (NULL, 'x') rows would otherwise all satisfy a plain UNIQUE).
+        unique("agents_entity_slug_unique").on(table.entityId, table.slug).nullsNotDistinct()
       ]
     );
     agentAssignments = pgTable(
@@ -12485,7 +12646,18 @@ var init_agents = __esm({
         instructions: text("instructions"),
         createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
       },
-      () => []
+      (table) => [
+        // F-18 (audit #2): no index beyond the PK meant updateAgentAction's
+        // delete-then-insert (apps/web/src/lib/actions.ts) could race and leave the
+        // same sub-agent attached twice under one orchestrator (duplicated in the
+        // team-block). The unique index's leading column (orchestrator_id) also
+        // serves the hot read path (team-block.ts, assign-tools.ts, detach-agent.ts
+        // all look up by orchestratorId alone) — no separate index needed.
+        unique("agent_assignments_orchestrator_sub_agent_unique").on(
+          table.orchestratorId,
+          table.subAgentId
+        )
+      ]
     );
     agentBudgets = pgTable(
       "agent_budgets",
@@ -12532,6 +12704,18 @@ var init_jobs = __esm({
         task: text("task").notNull(),
         originalTask: text("original_task"),
         chatId: text("chat_id"),
+        /**
+         * Groups jobs from the same conversational thread for the Jobs page UI
+         * (migration 0059). Purely a reporting/grouping concern — the runtime
+         * execution path (delegation, cron, task-board) never reads this column.
+         * NULL for non-conversational jobs (cron/schedule/webhook with no parent).
+         * Stamped at creation by apps/runner/src/job/conversation-id.ts, reusing
+         * the exact idle-reset session boundary thread-history.ts already uses
+         * for chat continuity — see that file for the gap rule. Delegated/
+         * task-board children inherit their creator's value; nothing else
+         * mutates it after insert.
+         */
+        conversationId: uuid("conversation_id"),
         systemPrompt: text("system_prompt"),
         messages: jsonb("messages").default(sql`'[]'::jsonb`),
         /**
@@ -12614,8 +12798,22 @@ var init_jobs = __esm({
           sql`${table.createdAt} DESC`
         ),
         index("idx_agent_jobs_parent_job_id").on(table.parentJobId),
-        index("idx_jobs_parent").on(table.parentJobId),
+        // Migration 0059: the Jobs page groups conversational jobs by
+        // (entity_id, conversation_id) — this index serves that lookup directly.
+        index("idx_agent_jobs_entity_conversation").on(table.entityId, table.conversationId),
+        // idx_jobs_parent (F-20, audit #2) was an exact duplicate of
+        // idx_agent_jobs_parent_job_id above — same column, same order, both from
+        // migration 0000. Dropped in migration 0054; kept this one (matches the
+        // idx_agent_jobs_* naming convention used everywhere else on this table).
         index("idx_jobs_status").on(table.status, table.createdAt),
+        // DB-3 (audit #2): findUndeliveredRootJobIds (cron/deliver-results.ts)
+        // joins on this column filtered to IS NULL every tick; the cron recovery
+        // scans (findPendingJobsToRecover, resetOrphanedJobs, failStalePendingJobs
+        // in cron/reset-orphans.ts) also filter by status without an entity_id,
+        // which idx_jobs_status (kept above) still serves — completed rows vastly
+        // outnumber the still-open ones, so a partial index keyed on the open set
+        // stays small regardless of table growth.
+        index("idx_agent_jobs_completed_at_null").on(table.completedAt).where(sql`${table.completedAt} IS NULL`),
         check(
           "agent_jobs_status_check",
           sql`${table.status} IN ('pending','processing','completed','failed','awaiting_approval','awaiting_delegation','cancelled')`
@@ -12678,6 +12876,10 @@ var init_tasks = __esm({
         index("idx_agent_tasks_orchestrator_status").on(table.orchestratorId, table.status),
         index("idx_agent_tasks_status").on(table.status),
         index("idx_agent_tasks_assigned").on(table.assignedAgentId),
+        // DB-3 (audit #2): findUndeliveredRootJobIds (apps/runner/src/cron/
+        // deliver-results.ts) scans `WHERE root_job_id IS NOT NULL` on every cron
+        // tick and had no index to support it — full scan on the hottest task table.
+        index("idx_agent_tasks_root_job_id").on(table.rootJobId),
         check(
           "agent_tasks_status_check",
           sql`${table.status} IN ('todo','in_progress','done','cancelled','blocked')`
@@ -12742,7 +12944,10 @@ var init_connectors = __esm({
         name: text("name").notNull(),
         slug: text("slug").notNull(),
         baseUrl: text("base_url"),
-        // Encrypted with pgp_sym_encrypt in DB — raw value never returned in select
+        // audit#2026-07-07 SEC-5: this comment used to claim pgp_sym_encrypt (pgcrypto),
+        // which is not used anywhere. Real encryption is application-level AES-256-GCM
+        // via @nodal-agents/secrets before the value ever reaches this column — the DB
+        // column itself just holds ciphertext as opaque text. Raw value never returned in select.
         apiKey: text("api_key"),
         active: boolean("active").default(true),
         authType: text("auth_type").notNull().default("api_key"),
@@ -12862,7 +13067,16 @@ var init_approvals = __esm({
         check(
           "approval_rules_action_check",
           sql`${table.action} IN ('auto_approve','require_approval','block')`
-        )
+        ),
+        // DB-1 (audit #2): one canonical rule per (entity, agent-or-null, tool) —
+        // without this, two concurrent setAgentApprovalRuleAction calls (or any
+        // direct insert) can leave two rows for the same scope with DIVERGENT
+        // actions, and matchApprovalRule's `.find()` picks whichever the SELECT
+        // happens to return first — a non-deterministic approval gate. agentId IS
+        // NULL marks an entity-wide rule (e.g. the run_command LAN master-switch),
+        // so a plain UNIQUE would treat two NULL rows as distinct and let the
+        // duplicate back in; NULLS NOT DISTINCT (PG15+) closes that gap.
+        unique("approval_rules_entity_agent_tool_unique").on(table.entityId, table.agentId, table.toolName).nullsNotDistinct()
       ]
     );
   }
@@ -12994,8 +13208,8 @@ var init_skills = __esm({
       {
         id: uuid("id").primaryKey().defaultRandom(),
         entityId: uuid("entity_id").references(() => entities.id, { onDelete: "cascade" }),
-        name: text("name").notNull().unique(),
-        slug: text("slug").notNull().unique(),
+        name: text("name").notNull(),
+        slug: text("slug").notNull(),
         content: text("content").notNull(),
         active: boolean("active").default(true),
         description: text("description"),
@@ -13035,7 +13249,20 @@ var init_skills = __esm({
       (table) => [
         index("idx_agent_skills_entity_id").on(table.entityId),
         index("idx_skills_active").on(table.active, table.slug),
-        index("idx_agent_skills_is_community").on(table.isCommunity)
+        index("idx_agent_skills_is_community").on(table.isCommunity),
+        // F-6 (audit #2): slug AND name were UNIQUE GLOBALLY — a 2nd workspace/
+        // entity installing the same community skill (e.g. slug 'comfyui') or
+        // creating a skill with the same display name crashed the insert, and in
+        // multi-user mode let one entity squat/enumerate another's slugs or
+        // names. Scoped to (entity_id, slug) / (entity_id, name): every real
+        // insert always sets entityId (createSkillRepo takes it as a required
+        // param; the system-skill seeder and community-skill installer both pass
+        // it too — no production path leaves it NULL), but the column itself is
+        // nullable, so NULLS NOT DISTINCT closes the same NULL-entity gap as
+        // DB-1/agent_plugins (multiple (NULL, 'x') rows would otherwise all
+        // satisfy a plain UNIQUE).
+        unique("agent_skills_entity_slug_unique").on(table.entityId, table.slug).nullsNotDistinct(),
+        unique("agent_skills_entity_name_unique").on(table.entityId, table.name).nullsNotDistinct()
       ]
     );
     skillVersions = pgTable(
@@ -13092,7 +13319,14 @@ var init_skills = __esm({
         filesWritable: boolean("files_writable").notNull().default(false),
         createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
       },
-      () => []
+      (table) => [
+        // DB-2 (audit #2): the table had no index beyond the PK, so assignSkillRepo's
+        // check-then-insert (packages/db/src/repos/skills.ts) could race and leave
+        // the same skill assigned twice to one agent. The unique index's leading
+        // column (agent_id) also serves the hot read path (execute.ts loads all
+        // skills for an agent) — no separate index needed on top of it.
+        unique("agent_skill_assignments_agent_skill_unique").on(table.agentId, table.skillId)
+      ]
     );
   }
 });
@@ -13224,7 +13458,14 @@ var init_mcp = __esm({
         createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
         updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
       },
-      (table) => [index("idx_mcp_connections_entity").on(table.entityId)]
+      (table) => [
+        index("idx_mcp_connections_entity").on(table.entityId),
+        // R5 (audit #2 follow-up): the pglite test DDL (packages/db/src/tests/
+        // helpers.ts) already assumed a per-entity unique slug here — same class
+        // of phantom-constraint bug as DB-2/F-18. entityId is NOT NULL on this
+        // table, so a plain UNIQUE (no NULLS NOT DISTINCT needed) is correct.
+        uniqueIndex("mcp_connections_entity_slug_unique").on(table.entityId, table.slug)
+      ]
     );
   }
 });
@@ -13279,7 +13520,14 @@ var init_misc = __esm({
         check(
           "agent_plugins_hook_check",
           sql`${table.hook} IN ('pre_task','post_task','pre_tool','post_tool','on_memory_save')`
-        )
+        ),
+        // R5 (audit #2 follow-up): the pglite test DDL (packages/db/src/tests/
+        // helpers.ts) already assumed a per-entity unique slug here — same class
+        // of phantom-constraint bug as DB-2/F-18 (test mock ahead of the real
+        // schema/migration). entityId is nullable (no `.notNull()` above), so
+        // NULLS NOT DISTINCT closes the same NULL-entity gap as DB-1's
+        // approval_rules constraint.
+        unique("agent_plugins_entity_slug_unique").on(table.entityId, table.slug).nullsNotDistinct()
       ]
     );
     rateLimits = pgTable("rate_limits", {
@@ -13451,16 +13699,65 @@ var init_chat_messages = __esm({
 });
 
 // ../../packages/db/src/schema/app-settings.ts
-var appSettings;
+var appSettings, entitySettings;
 var init_app_settings = __esm({
   "../../packages/db/src/schema/app-settings.ts"() {
     "use strict";
     init_pg_core();
+    init_entities();
     appSettings = pgTable("app_settings", {
       key: text("key").primaryKey(),
       value: text("value").default("").notNull(),
       updatedAt: timestamp("updated_at", { withTimezone: true }).defaultNow().notNull()
     });
+    entitySettings = pgTable(
+      "entity_settings",
+      {
+        entityId: uuid("entity_id").notNull().references(() => entities.id, { onDelete: "cascade" }),
+        key: text("key").notNull(),
+        value: text("value").default("").notNull(),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).defaultNow().notNull()
+      },
+      (table) => [primaryKey({ columns: [table.entityId, table.key] })]
+    );
+  }
+});
+
+// ../../packages/db/src/schema/telegram-allowed-chats.ts
+var telegramAllowedChats;
+var init_telegram_allowed_chats = __esm({
+  "../../packages/db/src/schema/telegram-allowed-chats.ts"() {
+    "use strict";
+    init_pg_core();
+    init_drizzle_orm();
+    init_entities();
+    init_agents();
+    telegramAllowedChats = pgTable(
+      "telegram_allowed_chats",
+      {
+        id: uuid("id").primaryKey().defaultRandom(),
+        entityId: uuid("entity_id").references(() => entities.id, { onDelete: "cascade" }),
+        /** The bot the chat is talking to (the RECEIVING agent). */
+        agentId: uuid("agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
+        /** Telegram chat id (private chat, group, or supergroup) as a string. */
+        chatId: text("chat_id").notNull(),
+        /** 'owner' = the bot's controller; 'member' = an approved additional chat. */
+        role: text("role").notNull().default("member"),
+        /** 'active' = may create jobs; 'pending' = awaiting the owner's confirmation. */
+        status: text("status").notNull().default("pending"),
+        /** Display name of the requester, for the owner's confirmation card. */
+        requesterName: text("requester_name"),
+        createdAt: timestamp("created_at", { withTimezone: true }).defaultNow(),
+        updatedAt: timestamp("updated_at", { withTimezone: true }).defaultNow()
+      },
+      (table) => [
+        unique("telegram_allowed_chats_agent_chat_unique").on(table.agentId, table.chatId),
+        index("idx_telegram_allowed_chats_agent").on(table.agentId),
+        index("idx_telegram_allowed_chats_entity").on(table.entityId),
+        check("telegram_allowed_chats_role_check", sql`${table.role} IN ('owner','member')`),
+        check("telegram_allowed_chats_status_check", sql`${table.status} IN ('active','pending')`)
+      ]
+    );
   }
 });
 
@@ -13512,12 +13809,14 @@ __export(schema_exports, {
   entities: () => entities,
   entityLlmKeys: () => entityLlmKeys,
   entityMembers: () => entityMembers,
+  entitySettings: () => entitySettings,
   mcpConnections: () => mcpConnections,
   mcpServers: () => mcpServers,
   rateLimits: () => rateLimits,
   sessions: () => sessions,
   skillConnectors: () => skillConnectors,
   skillVersions: () => skillVersions,
+  telegramAllowedChats: () => telegramAllowedChats,
   toolCalls: () => toolCalls,
   userProfiles: () => userProfiles,
   users: () => users,
@@ -13549,6 +13848,7 @@ var init_schema2 = __esm({
     init_agent_workspaces();
     init_chat_messages();
     init_app_settings();
+    init_telegram_allowed_chats();
   }
 });
 
@@ -13557,7 +13857,29 @@ function createClient(connectionString, options = {}) {
   const pool = src_default(connectionString, {
     max: options.max ?? 10,
     // Fail fast on connection issues rather than hanging
-    connect_timeout: 10
+    connect_timeout: 10,
+    // R2 (audit2 concurrency review): bound the two ways a query on this pool
+    // can hang indefinitely with no client-side timeout at all. Sent as
+    // Postgres startup/session parameters (postgres.js `connection` option),
+    // so every connection in the pool gets them — no per-query opt-in needed.
+    //   - lock_timeout: the vector identified for the cron watchdog (R1) — a
+    //     query blocked waiting on a row lock previously waited forever.
+    //     30s is comfortably longer than any legitimate lock wait in this
+    //     app's write patterns (single-row updates/inserts, no long-held
+    //     locks by design).
+    //   - idle_in_transaction_session_timeout: a transaction left open with
+    //     no further statements (BEGIN without COMMIT/ROLLBACK) is always a
+    //     bug, never a legitimate long-running operation — 60s is generous.
+    // Deliberately NOT setting statement_timeout here: a global cap would
+    // also apply to legitimate long-running operations (a large backfill, a
+    // slow migration-adjacent query) and risk cutting them off mid-flight.
+    // migrate.ts uses its own separate `postgres()` connection (not this
+    // factory) for running migrations, so these timeouts don't touch
+    // migrations at all either way.
+    connection: {
+      lock_timeout: 3e4,
+      idle_in_transaction_session_timeout: 6e4
+    }
   });
   const db = drizzle(pool, { schema: schema_exports });
   return {
@@ -13584,12 +13906,24 @@ var init_transaction = __esm({
 
 // ../../packages/secrets/src/index.ts
 import { createCipheriv, createDecipheriv, randomBytes as randomBytes2 } from "crypto";
-import { chmodSync, existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { chmodSync as chmodSync2, existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { execFileSync as execFileSync2 } from "child_process";
 import { homedir as homedir2 } from "os";
 import { dirname as dirname3, join as join5 } from "path";
+function masterKeyPath() {
+  return join5(homedir2(), ".nodalai", "secrets.key");
+}
+function masterKeyFileMissing(path = masterKeyPath()) {
+  return !existsSync5(path);
+}
+function isEncrypted(value) {
+  return value.startsWith(`enc:${VERSION}:`);
+}
+var VERSION;
 var init_src3 = __esm({
   "../../packages/secrets/src/index.ts"() {
     "use strict";
+    VERSION = "v1";
   }
 });
 
@@ -13605,6 +13939,41 @@ var init_credentials2 = __esm({
   }
 });
 
+// ../../packages/db/src/queries/master-key-guard.ts
+async function assertMasterKeyRestorable(db, options = {}) {
+  if (!masterKeyFileMissing(options.keyPath)) return;
+  const [credRow] = await db.select({ id: credentials.id }).from(credentials).limit(1);
+  if (credRow) throw missingKeyError("a stored OAuth credential");
+  const llmKeyRows = await db.select({ apiKey: entityLlmKeys.apiKey }).from(entityLlmKeys);
+  const hasEncryptedLlmKey = llmKeyRows.some((r) => r.apiKey !== "" && isEncrypted(r.apiKey));
+  if (hasEncryptedLlmKey) throw missingKeyError("a stored LLM API key");
+  const connectorRows = await db.select({ apiKey: connectors.apiKey }).from(connectors);
+  const hasEncryptedConnector = connectorRows.some((r) => !!r.apiKey && isEncrypted(r.apiKey));
+  if (hasEncryptedConnector) throw missingKeyError("a stored connector API key");
+  const mcpRows = await db.select({ apiKey: mcpServers.apiKey, envVars: mcpServers.envVars }).from(mcpServers);
+  const hasEncryptedMcp = mcpRows.some((r) => {
+    if (r.apiKey && isEncrypted(r.apiKey)) return true;
+    const env = r.envVars ?? {};
+    return Object.values(env).some((v) => typeof v === "string" && isEncrypted(v));
+  });
+  if (hasEncryptedMcp) throw missingKeyError("a stored MCP server secret");
+}
+function missingKeyError(what) {
+  return new Error(
+    `~/.nodalai/secrets.key is missing, but the database already has ${what} encrypted with it. Generating a NEW key here would make every existing credential / LLM key permanently undecryptable, with no further warning. Restore the original secrets.key from a backup before running \`nodal-agents up\` again. If you intend to start fresh, delete the affected rows (or wipe the database) first, then retry.`
+  );
+}
+var init_master_key_guard = __esm({
+  "../../packages/db/src/queries/master-key-guard.ts"() {
+    "use strict";
+    init_credentials();
+    init_llm_keys();
+    init_connectors();
+    init_mcp();
+    init_src3();
+  }
+});
+
 // ../../packages/db/src/repos/agents.ts
 var init_agents2 = __esm({
   "../../packages/db/src/repos/agents.ts"() {
@@ -13648,6 +14017,7 @@ var init_src4 = __esm({
     init_transaction();
     init_schema2();
     init_credentials2();
+    init_master_key_guard();
     init_agents2();
     init_skills2();
     init_retention();
@@ -13707,11 +14077,20 @@ var init_local_auth = __esm({
   }
 });
 
+// ../../packages/auth/src/lib/constant-time.ts
+import { createHash, timingSafeEqual } from "crypto";
+var init_constant_time = __esm({
+  "../../packages/auth/src/lib/constant-time.ts"() {
+    "use strict";
+  }
+});
+
 // ../../packages/auth/src/providers/bearer-token.ts
 var init_bearer_token = __esm({
   "../../packages/auth/src/providers/bearer-token.ts"() {
     "use strict";
     init_local_trust();
+    init_constant_time();
   }
 });
 
@@ -13750,6 +14129,7 @@ var init_seed = __esm({
 });
 
 // src/lib/env.ts
+import { randomBytes as randomBytes3 } from "crypto";
 function buildEnvForRunner(config, databaseUrl) {
   const bind = config.bind === "loopback" ? "127.0.0.1" : "0.0.0.0";
   const env = {
@@ -13773,7 +14153,19 @@ function buildEnvForRunner(config, databaseUrl) {
   return env;
 }
 function resolveAuthMode(config) {
-  if (config.auth?.mode) return config.auth.mode;
+  if (config.bearerToken) {
+    throw new Error(
+      'Invalid config: "bearerToken" is set in config.json, which the docs describe as activating AUTH_MODE=bearer-token \u2014 but that mode is not fully wired end-to-end yet (the web dashboard\'s auth provider still falls back to no-auth for bearer-token mode; see apps/web/src/lib/server.ts getAuthProvider). Booting anyway would silently run in local-trust or local-auth instead \u2014 NOT the bearer-token protection you configured. Refused. Remove "bearerToken" from config.json until this is wired, or use `bind`/`auth.mode` for local-trust/local-auth.'
+    );
+  }
+  if (config.auth?.mode) {
+    if (config.auth.mode === "local-trust" && config.bind === "lan") {
+      throw new Error(
+        'Invalid config: auth.mode="local-trust" with bind="lan" would expose every runner route unauthenticated on the network (including run_command auto-approve). Refused. Use auth.mode="local-auth" for a LAN bind, or bind="loopback" for local-trust.'
+      );
+    }
+    return config.auth.mode;
+  }
   return config.bind === "lan" ? "local-auth" : "local-trust";
 }
 function buildEnvForWeb(config, databaseUrl) {
@@ -13797,8 +14189,16 @@ function buildEnvForWeb(config, databaseUrl) {
     // The web itself doesn't bind on this — Next.js listens on 0.0.0.0 anyway.
     BIND: bind,
     NODE_ENV: "production",
-    // AUTH_SECRET is required by better-auth in local-auth mode; harmless in local-trust.
-    AUTH_SECRET: config.workerSecret,
+    // AUTH_SECRET is required by better-auth in local-auth mode; harmless in
+    // local-trust. M-4: deliberately SEPARATE from workerSecret — the two
+    // used to share a value, so a leak of workerSecret (the runner's auth
+    // frontier) would also let an attacker forge a signed better-auth session
+    // cookie. readConfig() auto-mints authSecret, so this is set in every
+    // normal boot path; the random fallback below only guards a caller that
+    // somehow bypasses readConfig (ephemeral — would invalidate sessions on
+    // every restart, which is a symptom to fix at the config layer, not a
+    // reason to crash boot or fall back to workerSecret).
+    AUTH_SECRET: config.authSecret ?? randomBytes3(32).toString("base64"),
     // WORKER_SECRET — same value as the runner — so sendTaskAction can sign
     // the POST /api/worker call. Without this the runner returns 403 and the
     // job stays pending forever (cron only scans task-board, not API jobs).
@@ -14081,7 +14481,7 @@ __export(up_exports, {
 import chalk from "chalk";
 import ora from "ora";
 import open from "open";
-import { randomBytes as randomBytes3 } from "crypto";
+import { randomBytes as randomBytes4 } from "crypto";
 async function killSilent(child) {
   await killProcessTree(child);
 }
@@ -14106,8 +14506,12 @@ async function runUp(opts = {}) {
     const defaultConfig = {
       // No `llm` section: the browser onboarding sets it via createLlmKeyAction.
       ports: { web: 3e3, runner: 3001, postgres: 25432 },
-      workerSecret: randomBytes3(32).toString("hex"),
-      serverActionsKey: randomBytes3(32).toString("base64"),
+      workerSecret: randomBytes4(32).toString("hex"),
+      serverActionsKey: randomBytes4(32).toString("base64"),
+      // M-4: authSecret is minted here (distinct from workerSecret) rather
+      // than left for readConfig()'s auto-mint, because this in-memory
+      // `config` is used directly below without a re-read.
+      authSecret: randomBytes4(32).toString("base64"),
       // loopback derives auth: local-trust (no login/signup). Leave `auth`
       // unset so resolveAuthMode falls back to the loopback → local-trust map.
       bind: "loopback"
@@ -14115,6 +14519,7 @@ async function runUp(opts = {}) {
     writeConfig(defaultConfig);
     config = defaultConfig;
   }
+  resolveAuthMode(config);
   const orphans = [];
   for (const [name, port] of [
     ["web", config.ports.web],
@@ -14220,6 +14625,17 @@ async function runUp(opts = {}) {
     await pg.stop();
     throw err;
   }
+  {
+    const { db, close } = createClient(databaseUrl, { max: 1 });
+    try {
+      await assertMasterKeyRestorable(db);
+    } catch (err) {
+      await close();
+      await pg.stop();
+      throw err;
+    }
+    await close();
+  }
   const authMode = resolveAuthMode(config);
   if (authMode === "local-trust") {
     const seedSpinner = ora("Seeding default user and agent\u2026").start();
@@ -14269,13 +14685,13 @@ async function runUp(opts = {}) {
   }
   void (async () => {
     try {
-      const { getInstalledVersion: getInstalledVersion2, getLatestVersion: getLatestVersion2 } = await Promise.resolve().then(() => (init_version(), version_exports));
+      const { getInstalledVersion: getInstalledVersion2, getLatestVersion: getLatestVersion2, isNewerVersion: isNewerVersion2 } = await Promise.resolve().then(() => (init_version(), version_exports));
       const installed = getInstalledVersion2();
       const latest = await Promise.race([
         getLatestVersion2(),
         new Promise((resolve2) => setTimeout(() => resolve2(null), 3e3))
       ]);
-      if (latest !== null && latest !== installed) {
+      if (latest !== null && isNewerVersion2(latest, installed)) {
         console.log(chalk.cyan(`  \u2139 v${latest} available \u2014 run \`nodal-agents update\``));
       }
     } catch {
@@ -14431,9 +14847,9 @@ __export(init_exports, {
 import chalk2 from "chalk";
 import prompts from "prompts";
 import ora2 from "ora";
-import { randomBytes as randomBytes4 } from "crypto";
+import { randomBytes as randomBytes5 } from "crypto";
 function generateSecret(bytes = 32) {
-  return randomBytes4(bytes).toString("hex");
+  return randomBytes5(bytes).toString("hex");
 }
 async function runInit(options = {}) {
   const existing = readConfig();
@@ -14454,7 +14870,7 @@ async function runInit(options = {}) {
     const config2 = {
       ports: { web: 3e3, runner: 3001, postgres: 25432 },
       workerSecret: generateSecret(32),
-      serverActionsKey: randomBytes4(32).toString("base64"),
+      serverActionsKey: randomBytes5(32).toString("base64"),
       bind: "lan",
       auth: { mode: "local-auth" }
     };