docs: update agents.md and index.md for Theta Agent C2 & Protocol v1.1.0

.dockerignore

@@ -19,9 +19,6 @@
 !API.md
 !directory_spec.md
 !docs/**/*.md
-# The screenshots the README (served at /docs/overview) links. `COPY docs /docs`
-# in Dockerfile.openldap needs these present in the build context.
-!docs/images/**
 
 # Tests (excluded from production builds; test-runner Dockerfile copies them explicitly)
 # nodejs/tests/

CHANGELOG.md

@@ -1,138 +1,3 @@
-# v1.30.0
-
-Adds **join keys**: installing the agent with one key is now all it takes to add a host. Fixes a set of Directory/discovery defects found on a fresh `setup.sh` install.
-
-### theta-agent — enrollment without pre-registering
-
-- feat: **join keys.** `POST /api/agent/join-keys` mints one credential an operator hands out. A host presenting it is enrolled automatically and immediately issued **its own** per-agent token plus the public key it must pin, delivered in the `config` frame; the agent persists both and blanks the join key. v1.29.0 required an admin to pre-register every machine before its agent would be spoken to, which made adding a host a two-system chore — the security model was right, the workflow was not.
-- feat: a join key is a bootstrap credential, never the host's identity, so one key stays convenient without becoming a fleet-wide skeleton key: every host remains individually revocable and a compromised host yields nothing that works elsewhere. Revoking a join key stops new hosts joining and leaves already-enrolled agents alone.
-- feat: join keys support a label and optional expiry, record their use count, and are stored as a SHA-256 (`AgentJoinKey`). Issue/revoke/delete and every self-enrollment are audited.
-
-### Directory
-
-- fix: **collapsing the tree did nothing.** `applyTreeCollapse` located the caret with `$row.find('.tree-caret i')` and returned early when it found nothing. Font Awesome runs in SVG-with-JS mode and its mutation observer rewrites every `<i class="fa-…">` into an `<svg>`, so moments after a render that selector matched nothing — and the early return skipped setting `hideBelowDepth`, so no row was ever hidden. Collapse state now lives on the caret *button* and is rotated by CSS, and the hide decision is made from the collapsed set alone. Never key behaviour to an element another library is free to replace.
-- fix: **the Discovery Plugins delete button did nothing.** It called `deleteDiscoveryPlugin()`, which was never defined — clicking it only threw a `ReferenceError`.
-- fix: the plugins pane had no `.actionMessage` element, and `app.messages` confirmations render into one. Without it the returned promise **never settles**, so an awaited confirmation hangs forever and the action it gates silently never happens. Added, along with a note that any pane asking for confirmation needs it.
-- feat: **discovery plugin instances can be edited.** Name, schedule, loaded state and configuration, with secrets on their own endpoint and left blank ("unchanged") rather than prefilled with the mask — submitting `********` back would otherwise store the asterisks as the secret.
-
-### Discovery
-
-- fix: **a fresh install no longer presents its own containers as things to triage.** The Docker plugin recognises containers belonging to the stack's own compose project, records them as managed, and attaches each to the service it implements. `setup.sh` deploys `sso-manager`, `proxy`, `jump-host`, `openbao` and `bao-renewer`; all five arrived as unmanaged discoveries awaiting promotion.
-- fix: **Docker container slugs were derived from the container id**, which changes on every recreate — so each `docker compose up` minted a brand-new resource and orphaned the previous one. Slugs now come from compose project + service, falling back to the container name.
-- feat: discovered containers carry `composeProject`, `composeService`, `containerName` and `sourceId`.
-
-### Docs
-
-- fix: `/docs/discovery` 404'd — the slug had no entry, though the Discovery tab's help icon linked to it. New `docs/discovery.md` covering the catalog/discovered distinction, how sources are matched and merged, naming precedence, promotion and garbage collection.
-- fix: the `agents` slug pointed at `plugins.md`, so `docs/agents.md` was unreachable in the app.
-
-# v1.29.0
-
-**Breaking:** theta-agent enrollment is now mandatory. Agents installed before this release carry a browser-generated token the server never recorded and will be rejected until re-enrolled. Requires theta-suite ≥ v1.42.0 (the `sso-broker` OpenBao policy must grant `secret/agent/*`); re-run `./setup.sh`.
-
-### Security — theta-agent channel
-
-- **sec: `/api/agent/ws` accepted any token.** There was no agent registry, so the endpoint authenticated nothing: any client that could reach the SSO could register as a node, publish discovery/telemetry into the admin view, and receive commands — including a signed `arbitrary_bash` — addressed to a token it guessed. Tokens were generated in the *browser* (`generateRandomHexToken`) and never recorded server-side, so there was nothing to validate against and no way to revoke one. Agents are now rows in a new `Agent` table, authenticated by SHA-256 token hash before the connection is registered or the welcome payload is sent; unknown or revoked tokens are closed with `4001` and audited.
-- **sec: the command signing key was ephemeral.** `AgentManager` generated an Ed25519 pair in its constructor, so it changed on every process start and the `public_key` an agent pinned in `agent.yml` stopped matching immediately. The key now lives in OpenBao at `secret/agent/signing-key` and survives restarts. If it cannot be loaded the SSO **refuses** to send high-risk commands rather than signing with a key no agent has seen (`signingAvailable: false` on `GET /api/agent/nodes`).
-- **sec: commands are addressed by agent id, not token.** A credential has no business in a URL, an access log or browser history.
-- **sec: agent actions are audited.** Enroll, update, rotate, revoke, delete, every command (with `signed`), and every rejected connection are emitted as structured `"component":"agent"` log records carrying the acting user.
-
-### theta-agent — enrollment & resource binding
-
-- feat: `POST /api/agent/enroll` mints the token server-side and returns it **once**; only its SHA-256 is stored. Plus `PUT /nodes/:id` (rename/rebind), `POST /nodes/:id/rotate`, `POST /nodes/:id/revoke`, `DELETE /nodes/:id`. Rotate, revoke and delete drop the live socket immediately (`4004`/`4003`) instead of waiting for a reconnect.
-- feat: an agent binds to a **host resource** (`resourceId`). The Directory reads that link instead of guessing by hostname — the old `agentsByHost[name]` match silently failed whenever a Directory name differed from the machine's hostname, and aliased two hosts that shared one.
-- feat: **agent discovery reaches the Directory.** A bound agent's facts (`os`, `kernel`, `cpu`, `ram_total_gb`, `disk_total_gb`, `ip`) are written onto its host resource, tagged `discovery_sources: ["theta-agent"]` with an `agentId` back-reference. An unbound agent goes through the normal reconciler. Previously `handleDiscovery` wrote to an in-memory record and updated nothing — the one source actually running *on* the host contributed nothing to the directory.
-- feat: agent state is persisted, so an agent that is installed but **offline** is now distinguishable from one that never existed; enrollments survive a restart. The Directory status dot reflects this: red means "enrolled and not connected" (a fault), grey means no agent enrolled / revoked / service unreachable. Red previously covered both, making an ordinary directory of hosts look like an outage.
-- feat: the Install Agent modal enrolls first and builds the install command from the result, including `--public-key`. `public_key` was never emitted into the generated `agent.yml` before, so no installed agent could verify anything.
-- fix: `registerAgent` is synchronous. Awaiting a database write before attaching the WebSocket `message` listener lost every agent's first `discovery` frame, which it sends the instant the socket opens (`ws` drops events emitted with no listener attached).
-
-### Directory
-
-- feat: **the resource tree is collapsible.** Any row with children has a caret; the toolbar collapses/expands everything. State persists per browser, so the shape survives the self-heal reload that follows most edits. An active search overrides collapse so matches inside a folded subtree are never hidden.
-- fix: **the Proxmox plugin mismatched MAC addresses to IPs.** It collected MACs and IPs into two flat lists and zipped them by index, so on any multi-NIC guest — or any guest where one NIC had no address — the directory recorded an address against the wrong MAC. NICs are now keyed by MAC, so a pairing can only come from the source that observed both together.
-- feat: Proxmox discovery emits an **endpoint resource** (named from `/cluster/status`) with every node parented beneath it, so one endpoint is one subtree instead of several orphan roots. It deliberately carries no IP: giving it the address it is reached at made the reconciler merge it with the node answering on that address, producing a resource that was its own parent.
-- feat: discovered guests carry `sourceId` (`<node>/qemu/<vmid>`), `node`, `vmid` and `macAddress`, so a row traces back to the exact guest on the exact hypervisor. Against a live 3-node cluster this took MAC coverage to 53/54 resources and `sourceId` to 54/54.
-- fix: Proxmox interfaces belonging to something running *inside* a guest (`docker0`, `veth*`, `br-*`, VPN tunnels) are filtered out — one Home Assistant VM reported 16 of them alongside its single real NIC, and their 172.x addresses gave the reconciler spurious matches.
-- fix: a stopped VM still reports its MAC (read from the VM config), a DHCP-configured LXC gets its address from the running container's interface list, and Proxmox **nodes** report their own IP/MAC (recovered from `enx<mac>` predictable names, since `/nodes/*/network` carries no `hwaddr`). Offline nodes are recorded with `status` instead of skipped, so a hypervisor that is down no longer looks decommissioned and get garbage-collected after a week.
-- fix: **the reconciler could make a resource its own parent.** Two slugs in one payload can resolve to the same row once merged; the resulting self-edge renders as an infinitely nested tree and defeats every ancestor walk in the app. Self-edges and cycle-closing edges are now refused and logged.
-- fix: **hosts were named after their MAC address.** `bestName` preferred the *longer* name, so UniFi's `ac:16:2d:b3:da:80` (17 chars) beat Proxmox's real hostname `dl380-0` (7). Names are now ranked (hostname > IP > MAC) with length only as a tie-break within a rank.
-- fix: `isIp` never matched anything — `\\.` inside a regex literal matches a backslash, not a dot — so an IP-shaped placeholder name was never replaced by a real hostname a later source discovered.
-- fix: a discovered device can only merge into a resource of the same kind. A VM named `gitea-runner` could match a hand-created *service* of the same name on the name rule and overwrite it.
-- perf: the reconciler reads the inventory once per run instead of once per incoming resource — a ~55-resource Proxmox payload against a similar-sized inventory was doing quadratic full-table reads every run.
-- fix: the Discovered Inventory table showed "Unknown IP" for almost everything, because it read `metadata.ip` while any source that enumerates interfaces stores addresses per-NIC. It now falls back to the first NIC address, and shows `vmid`, slug, `sourceId` and per-interface MAC/name.
-
-### Profile
-
-- fix: the API Tokens card is no longer wider than every other card on the site — the section sat outside the page's `.container`.
-
-### Build & docs
-
-- fix: `Dockerfile.test-runner` never copied `nodejs/plugins`, so every plugin test suite failed in CI as "Cannot find module" and plugin code was effectively untested. Suite count goes 27 → 29.
-- docs: `docs/agents.md` rewritten for enrollment, the close-code table, resource binding, the persistent signing key, and a corrected `public_key` example (the documented `MCowBQYDK2VwAyEA...` was an SPKI PEM body — 44 bytes decoded — where the agent requires the raw 32).
-- docs: `docs/directory.md` covers the collapsible tree and the corrected seed hierarchy; `docs/plugins.md` documents what the Proxmox plugin produces and why the endpoint has no IP.
-
-# v1.28.0
-- fix: `/api/agent/nodes` no longer 404s — the previous "unconditional mount" was still inside the post-listen `onListen` hook, so the REST router landed *behind* app.js's terminal 404 catch-all and every `/api/agent/*` request 404'd. The router is now mounted synchronously in `app.js` before the 404 handler; only the agent WebSocket setup runs on `onListen`.
-- feat: promoting a discovered inventory resource now opens the resource form pre-filled with the discovered data (name, kind, IP, subtype, …) for review; the modal's Save confirms the promote (creates the LDAP groups + marks it managed) instead of silently promoting.
-- fix: Directory table no longer goes stale after add/remove edge — `addEdge`/`removeEdge` called an undefined `loadData()`, which threw and left the host/parent linkage stale until a manual refresh; they now call `loadResources()`. `addGroup`/`removeGroup` also refresh so the Access column stays accurate.
-- feat: Vault page states it's powered by OpenBao (header badge linking to openbao.org).
-
-# v1.27.0
-- fix: Directory group names now match `docs/GROUPS.md` exactly — per-resource groups are `{site}_{kind}_{name}_{level}` (`site_local_host_theta-env_access`, `site_local_app_sso-manager_access`), with the kind always present and the resource name slug stripped of its kind prefix. Services map to the `app` kind. The access-request + resolver tests were updated to the documented convention.
-- fix: a site resource now carries only `god_admin` + the site-wide groups (`{site}_super_admin`, `{site}_everyone`); the kind-scoped aggregates are still created for nesting but are no longer surfaced on the site's modal.
-- fix: groups no longer appear 3× under a resource — the Directory self-heal (which runs on every load) was creating duplicate `ResourceGroup` links; linking is now idempotent (check-then-create).
-- fix: `/api/agent/nodes` no longer 404s — the agent REST router is mounted unconditionally instead of being gated on the WebSocket server being up.
-- fix: `POST /api/shared-secrets/` rejected valid slugs — the slug regex now allows underscores (was hyphens-only).
-- fix: `GET /api/shared-secrets/` crashed with `s.path is not a function` — the list spread dropped the instance's `path()` method; now uses the static `SharedSecret.pathFor`.
-- fix: promoting a discovered inventory resource crashed with `Resource.update is not a function` — `update` is an instance method; the promote handler now loads an instance and calls `update()` on it.
-- feat: Vault → Apps tab now lists minted app tokens (the "Minted apps" list) — each is a scoped OpenBao credential for an external service; sso renews them and the list shows renewal state, so a minted credential no longer vanishes after its once-only token display. New `GET /api/vault/apps`.
-- feat: Vault page documents itself — a `/docs/vault` help icon in the header, and the doc now covers the Apps + Shared tabs.
-- feat: discovery plugin cards show last-run time + status (ok/error) and a Logs button that opens the captured run log.
-
-# v1.26.1
-- fix: the legacy `app_super_admin` group is gone — `SUPER_ADMIN_GROUP` (nested into every resource's `_admin` group by auto-provisioning) is now `god_admin`, and `docker-entrypoint.sh` no longer seeds or nests `app_super_admin` (god_admin is nested into the `app_sso_*` groups directly). `isSuperAdmin` still recognizes a pre-existing `app_super_admin` as a migration alias, so an old deployment isn't stripped of rights until it's rebuilt.
-
-# v1.26.0
-- feat: complete the group model (docs/GROUPS.md) — `god_admin` is now seeded into LDAP and nested into `app_super_admin`; every site auto-provisions `{site}_super_admin`, `{site}_hosts_*`/`{site}_apps_*` aggregates and `{site}_everyone`; per-resource `_admin`/`_access` groups (named `{site}_{slug}_{level}`, the kind carried in the resource slug) are nested into the site aggregates so the inheritance lattice exists in LDAP, not just in the resolver. Site/aggregate groups are self-healed idempotently on every Directory load, so a directory seeded by an older release picks them up without a rebuild.
-- feat: the naming convention is now enforced server-side — `POST /api/directory-admin/groups` rejects a group CN that isn't a valid group for the target resource (its own `_admin`/`_access`/capability, a site aggregate, a site-level group, or `god_admin`), so the free-text field can no longer mint `*_accessmember`-style names
-- feat: `god_admin` is managed from the Directory — the site resource modal surfaces `god_admin` + the site-level groups as associated groups, so its members (and the site's) are editable right there
-- fix: Directory agent status dots no longer paint every host red when the `/api/agent/nodes` endpoint is unreachable (older app or transient outage) — they now show a neutral grey "agent service unreachable" instead of a false alarm
-- fix: Profile + API Tokens cards are both full-width on the profile page (the API card was a narrower centered block)
-- fix: in-app `/docs/<slug>` pages returned 500 — `Dockerfile.openldap` never copied the `docs/` tree into the image (only the root README/CHANGELOG/API/directory_spec), so every page but those few hit a missing-file error; the whole `docs/` dir now ships, and doc images are served at `/docs/images`
-- test: group resolver tests now cover the prefixed site-slug convention (`site_local_...` is kept verbatim, not re-slugified to `site-local`)
-
-# v1.25.0
-- feat: hierarchical group & permission model (docs/GROUPS.md) — god_admin, {site}_super_admin, {site}_hosts_*/{site}_apps_* aggregates, and per-resource {site}_host_<slug>_admin/access/<capability>; inheritance resolver (admin implies access, capabilities explicit), meta everyone/{site}_everyone groups
-- feat: remove the standalone Groups page — group management is tied to adopted Directory resources (help link to the model in the Directory toolbar)
-- feat: console admin recognizes god_admin and site-scoped super/app-admin groups (legacy app_sso_admin/app_super_admin kept as migration aliases)
-
-# v1.24.0
-- feat: Agents merged into the Directory — removed the standalone Agents page. Host rows show a green/yellow/red theta-agent status dot (healthy / high-load / not connected) and the resource modal gained a Metrics tab with live telemetry + discovery
-- feat: Discovery Plugins New-plugin modal — slug is now derived from the name (field removed), the cron field is a dropdown (hourly/daily/weekly + custom), and per-plugin settings are collected from the configSchema (e.g. Proxmox url/tokenId/tokenSecret) instead of an empty config
-- feat: Directory resource slug is now read-only and derived from the name
-- feat: Vault page restyled to match the rest of the site (bounded container, card + nav-tabs header, h4)
-- feat: navbar — the username is no longer underlined; only the active nav link is bold + underlined
-
-# v1.23.0
-- fix: /api/vault proxy never injected X-Vault-Token — the true root cause of the recurring vault 403 "permission denied". The proxy declared its hook with http-proxy-middleware v3 syntax (`on: { proxyReq }`), which the installed HPM v2 silently ignores, so every request reached OpenBao unauthenticated (and the client's sso auth headers were never stripped). Rewritten as v2 `onProxyReq`.
-- fix: vault proxy header injection ordered before `fixRequestBody` — the body write flushes headers, so setting X-Vault-Token after it silently failed on every POST/PUT (writes would still 403 even with the hook fixed)
-- fix: initORM add-only schema heal — `sequelize.sync()` never ALTERs existing tables, so columns added by newer releases (e.g. `PluginInstance.lastLog`, which crashed the scheduler on every boot of an upgraded deployment) are now detected via describeTable and added with addColumn (additive only, per-column fail-soft)
-- feat: external-app vault tokens are long-lived and auto-renewed — minted via the new `sso-app` token role (periodic 768h, falls back to sso-broker's 24h role until theta-suite setup.sh is re-run); sso stores each token's accessor (new VaultAppToken model — an accessor can renew/revoke but not authenticate) and renews all of them at boot + every 6h via auth/token/renew-accessor, so a downstream app's credential stays valid as long as sso runs with zero renewal code in the app
-- feat: re-minting an app token revokes the app's previous token via its stored accessor — exactly one live credential per app, no zombies
-- test: wire-level tests for the vault proxy (real HTTP round-trip asserting token injection, auth-header stripping, path rewrite, and POST body integrity) + app-token accessor lifecycle tests
-
-# v1.22.0
-- feat: Agents page — live list of connected theta-agent hosts with telemetry (CPU/RAM/disk/ZFS/GPU) + online status, updating via socket.io
-- security: auth + admin-gate the /api/agent REST routes (previously unauthenticated)
-
-# v1.21.0
-- fix: always reconcile OpenBao policy content before serving a (possibly cached) token, so stale stored policies can no longer cause a recurring vault 403 "permission denied"
-- feat: shared secrets — users can publish secrets to secret/shared/<owner>/<slug> and grant read access to other users and downstream apps (OpenBao ACL policy edits, applied live)
-- feat: shared-secrets API + Shared tab in the vault UI
-
-# v1.20.0
-- fix: OpenBao 403 on vault secrets list (directory list grants + policy self-heal)
-
 ## v1.19.0
 - Added WebSocket endpoint for theta-agent C2
 

Dockerfile.openldap

@@ -184,11 +184,6 @@ COPY README.md /README.md
 COPY CHANGELOG.md /CHANGELOG.md
 COPY API.md /API.md
 COPY directory_spec.md /directory_spec.md
-# The docs/*.md tree (plus the images the docs link) is read at runtime too, so
-# the whole docs/ dir must land at /docs. Without this every in-app /docs/<slug>
-# page other than the root-level README/CHANGELOG/API/directory_spec 500s on the
-# fs.readFileSync in routes/docs.js (files missing from the image).
-COPY docs /docs
 
 # Baked commit hash from the gitinfo stage (see build_info.js).
 COPY --from=gitinfo /commit.txt ./.build_commit

Dockerfile.test-runner

@@ -22,10 +22,6 @@ COPY nodejs/conf ./conf
 COPY nodejs/controller ./controller
 COPY nodejs/middleware ./middleware
 COPY nodejs/models ./models
-# Without this the discovery/plugin suites cannot even load their subject and
-# fail as "Cannot find module ../plugins/discovery/..." -- plugin code was
-# effectively untested in CI.
-COPY nodejs/plugins ./plugins
 COPY nodejs/routes ./routes
 COPY nodejs/services ./services
 COPY nodejs/utils ./utils

docker-entrypoint.sh

@@ -355,11 +355,7 @@ EOF
     # Required SSO groups. The app gates admin/invite/oauth-admin on these;
     # app_sso_service_account is a marker (not a permission gate) for
     # non-person accounts -- see the Users page.
-    #
-    # god_admin is the global super group (docs/GROUPS.md §2), the top of the
-    # group-inheritance lattice. It is seeded here so it exists from first boot;
-    # the theta-suite bootstrap puts the first admin person into it.
-    for group in god_admin app_sso_admin app_sso_invite app_sso_oauth_admin app_sso_service_account; do
+    for group in app_super_admin app_sso_admin app_sso_invite app_sso_oauth_admin app_sso_service_account; do
         ldapadd -x -D "$LDAP_BIND_DN" -w "$LDAP_ADMIN_PASS" -H ldap://localhost:389 << EOF || true
 dn: cn=${group},ou=groups,${LDAP_BASE_DN}
 objectClass: groupOfNames
@@ -370,11 +366,11 @@ member: ${LDAP_BIND_DN}
 EOF
     done
 
-    # Nest god_admin into the SSO admin groups, so god admins hold those rights
-    # by membership rather than by a special case in app code. This is what makes
-    # the privilege visible to every consumer -- SSSD, sudo, anything binding
-    # LDAP directly -- instead of only to callers that happen to route through
-    # utils/permission.js.
+    # Nest app_super_admin into the SSO admin groups, so cross-app super admins
+    # hold those rights by membership rather than by a special case in app code.
+    # This is what makes the privilege visible to every consumer -- SSSD, sudo,
+    # anything binding LDAP directly -- instead of only to callers that happen
+    # to route through utils/permission.js.
     #
     # app_sso_service_account is deliberately excluded: it is a marker for
     # non-person accounts, not a permission, and nesting admins into it would
@@ -385,10 +381,10 @@ EOF
 dn: cn=${group},ou=groups,${LDAP_BASE_DN}
 changetype: modify
 add: member
-member: cn=god_admin,ou=groups,${LDAP_BASE_DN}
+member: cn=app_super_admin,ou=groups,${LDAP_BASE_DN}
 EOF
         done
-        info "Nested god_admin into the SSO admin groups"
+        info "Nested app_super_admin into the SSO admin groups"
     fi
 
     info "LDAP directory initialized"

docs/agents.md

@@ -10,93 +10,6 @@ The **Theta Agent** (`theta-agent`) is a unified, 2-way Command & Control (C2) e
 
 ---
 
-## Enrollment
-
-An agent is only real if the SSO issued its credential. **Tokens the server did
-not issue are rejected** at the WebSocket handshake.
-
-There are two ways to get a host enrolled, and the first is the normal one.
-
-### Join key — install the agent and the host appears
-
-Hand the machine a **join key** and nothing else. On first connect the SSO
-enrolls the host, issues it its own per-agent token plus the public key it must
-pin, and the agent **writes both into its own `agent.yml`** and blanks the join
-key. From then on it authenticates as itself.
-
-```bash
-curl -fsSL https://<SSO_HOST>/resources/theta-agent/install.sh | sh -s -- \
-  --url "https://<SSO_HOST>" --join-key "tjk_..."
-```
-
-That is the whole procedure — no pre-registering the machine, no copying a
-public key by hand. `setup.sh` mints a key and configures the stack's own host
-this way automatically.
-
-The join key is a *bootstrap* credential, not the host's identity. That
-distinction is what keeps one key convenient without making it a fleet-wide
-skeleton key: every host still ends up individually revocable, and a compromised
-host does not yield a credential that works anywhere else.
-
-| Endpoint | Purpose |
-| :--- | :--- |
-| `GET /api/agent/join-keys` | List keys (prefix + usage only; never the key) |
-| `POST /api/agent/join-keys` | Mint one — returned **once** |
-| `POST /api/agent/join-keys/:id/revoke` | Stop it enrolling new hosts |
-| `DELETE /api/agent/join-keys/:id` | Remove it |
-
-Revoking a join key does **not** disconnect hosts that already joined; they hold
-their own tokens by then. Revoke the agent itself to cut a specific host off.
-
-### Pre-registering a host
-
-When you want the agent bound to a specific Directory host up front, enroll it
-from **Directory → Install Agent**:
-
-1. Give the agent a name and **bind it to a host resource**. The binding is what
-   links telemetry, status and commands to a Directory entry.
-2. Press **Enroll & issue token**. The SSO mints a 256-bit token, stores only its
-   SHA-256, and shows the raw value **once**.
-3. Copy the generated install command — it already carries the token and the
-   server's public key.
-
-A host that self-enrolls with a join key arrives unbound; bind it afterwards with
-`PUT /api/agent/nodes/:id` or from the Directory.
-
-Or via the API:
-
-```bash
-curl -X POST https://<SSO_HOST>/api/agent/enroll \
-  -H "Authorization: Bearer <admin-api-token>" \
-  -H 'Content-Type: application/json' \
-  -d '{"name": "web01", "resourceId": "<host-resource-uuid>"}'
-```
-
-The response contains `token` (once only) and `publicKey`.
-
-| Endpoint | Purpose |
-| :--- | :--- |
-| `GET /api/agent/nodes` | Every enrolled agent, connected or not, plus the server public key |
-| `POST /api/agent/enroll` | Mint an agent + token |
-| `PUT /api/agent/nodes/:id` | Rename, or bind/unbind the host resource |
-| `POST /api/agent/nodes/:id/rotate` | Issue a new token; the old one stops working immediately |
-| `POST /api/agent/nodes/:id/revoke` | Disable the enrollment |
-| `DELETE /api/agent/nodes/:id` | Remove the enrollment |
-| `POST /api/agent/nodes/:id/command` | Send a command (signed automatically when high-risk) |
-
-Revoke, rotate and delete **drop any live connection immediately** — they do not
-wait for the agent to reconnect. Commands are addressed by agent **id**, never by
-token: a token is a credential and has no business in a URL or a log.
-
-Enrollment, revocation, rotation, every command, and every rejected connection
-are written to the application log as structured `"component":"agent"` records
-with the acting user.
-
-> **Lost the token?** It cannot be recovered — only its hash is stored. Rotate
-> the agent to issue a new one.
-
----
-
 ## Core Functionality
 
 ### 1. Host Discovery & Inventory
@@ -118,44 +31,6 @@ Every 30 seconds, the agent streams real-time performance metrics:
 
 ---
 
-## Viewing in the SSO Manager
-
-Agent status and telemetry live on the **Directory** page — there is no separate
-Agents page. For each **host** resource that has a connected theta-agent, the
-Directory shows a status dot in the row:
-
-| Color | Meaning |
-| :--- | :--- |
-| **Green** | Connected, healthy (CPU/RAM/disk within limits). |
-| **Yellow** | Connected but under high load (CPU > 80% or RAM > 80% or disk > 90%). |
-| **Red** | **Enrolled but not connected.** The agent exists and is expected — this is a fault. |
-| **Grey** | No agent enrolled for this host, the enrollment is revoked, or the agent service is unreachable. |
-
-Red and grey used to be the same colour, which made an ordinary directory of
-hosts look like an outage. Because the enrollment now outlives the connection,
-"installed but down" is distinguishable from "never had an agent".
-
-Opening a host's resource modal reveals a **Metrics** tab with the agent's live
-telemetry (CPU/RAM/disk/ZFS/GPU) and discovery info (OS, kernel, IPs, location).
-
-An agent attaches to its host by its **enrollment binding** (`resourceId`), set
-when you enroll it or later via `PUT /api/agent/nodes/:id`. Agents enrolled
-without a binding fall back to matching their reported hostname against the
-resource name — the old behaviour, kept only as a fallback, because it silently
-failed whenever a Directory name differed from the machine's hostname and
-aliased two hosts that happened to share one.
-
-### Agent discovery feeds the Directory
-
-A bound agent's discovery payload is written onto its host resource (`os`,
-`kernel`, `cpu`, `ram_total_gb`, `disk_total_gb`, `ip`), tagged with
-`discovery_sources: ["theta-agent"]` and an `agentId` back-reference. An agent
-runs *on* the host it describes, so it is the most authoritative source the
-directory has. An unbound agent goes through the normal discovery reconciler
-instead, matching like any other source.
-
----
-
 ## Local-First Security & Capability Matrix
 
 To protect hosts against unauthorized control, `theta-agent` enforces a **strict, local-first capability matrix** defined in `/etc/theta42/agent.yml`. Central SSO Manager requests are checked against local configuration before execution; permissions cannot be overridden remotely.
@@ -170,31 +45,14 @@ To protect hosts against unauthorized control, `theta-agent` enforces a **strict
 
 ---
 
-## High-Risk Command Verification (Protocol v1.2.0)
+## High-Risk Command Verification (Protocol v1.1.0)
 
 High-risk management commands (`reboot`, `service_restart`, `configure_ldap`, `arbitrary_bash`, `update_binary`) are cryptographically verified using **Ed25519 signatures**:
-1. The SSO Manager canonicalizes the command payload (sorted keys, no whitespace,
-   no HTML escaping, `signature` omitted).
+1. The SSO Manager canonicalizes the command payload (sorted keys, no whitespace).
 2. The payload is signed with the SSO Manager's Ed25519 private key.
 3. The Base64 signature is appended to the message payload.
 4. The agent verifies the signature against the configured `public_key` in `/etc/theta42/agent.yml` before executing the action.
 
-**The signing key is persistent.** It lives in OpenBao at
-`secret/agent/signing-key` and survives restarts, so the `public_key` you pin in
-`agent.yml` keeps matching. (It used to be generated in memory at boot and
-changed on every restart, which made pinning impossible.) If the SSO cannot load
-or store a key it **refuses** to send high-risk commands rather than signing with
-one no agent has seen — `GET /api/agent/nodes` reports this as
-`signingAvailable: false`.
-
-This requires the `sso-broker` OpenBao policy to grant `secret/agent/*`. Re-run
-`./setup.sh` from theta-suite if you are upgrading.
-
-**Verification is fail-closed on the agent.** An agent with no `public_key`
-configured rejects every high-risk command. Earlier versions logged "skipping
-signature verification" and executed them, so an agent installed without a key
-would run `reboot`, `configure_ldap` and `arbitrary_bash` unverified.
-
 ---
 
 ## Installation & Deployment
@@ -203,14 +61,9 @@ would run `reboot`, `configure_ldap` and `arbitrary_bash` unverified.
 Run the following command as `root` on the target Linux host:
 
 ```bash
-curl -fsSL https://<SSO_HOST>/resources/theta-agent/install.sh | sh -s -- \
-  --url "https://<SSO_HOST>" --token "<ISSUED_TOKEN>" --public-key "<BASE64_PUBLIC_KEY>"
+curl -fsSL https://<SSO_HOST>/resources/theta-agent/install.sh | sh -s -- --url "https://<SSO_HOST>" --token "<HOST_TOKEN>"
 ```
 
-Both values come from enrollment. The **Install Agent** modal builds this line
-for you with them already filled in. Omitting `--public-key` leaves the agent
-able to report telemetry but unable to accept any high-risk command.
-
 ### Custom Config Wizard
 You can generate a Base64-encoded custom configuration using the **Install Agent** button on the **Directory Management** page in the SSO Manager UI:
 
@@ -225,18 +78,9 @@ curl -fsSL https://<SSO_HOST>/resources/theta-agent/install.sh | sh -s -- "<BASE
 ```yaml
 # /etc/theta42/agent.yml
 server_url: "wss://sso.example.com"
-# Issued by the SSO. Left empty when installing with a join key -- the agent
-# fills it in itself once the server enrolls it.
-auth_token: "c8181ce0e55bf7302b11d719a7ae39adcd7604de461e6e363f8bb4fadf126acb"
-# Bootstrap credential. Used only while auth_token is empty, and blanked by the
-# agent once it has its own token.
-join_key: ""
+auth_token: "your-unique-host-token"
 location: "dc-01-rack-12"
-# Base64 of the RAW 32-byte Ed25519 public key -- exactly the `publicKey` value
-# from enrollment or GET /api/agent/nodes. Not a PEM body: a base64-decoded
-# SPKI blob is 44 bytes, the agent requires 32, and it will refuse every signed
-# command if this is wrong.
-public_key: "D0cJB3iuStTzhXlu7tFDh/eEXFxRZwkuwQJJhFSqwlQ="
+public_key: "MCowBQYDK2VwAyEA..."
 
 capabilities:
   telemetry: true
@@ -246,53 +90,3 @@ capabilities:
   arbitrary_bash: false
 ```
 
----
-
-## Troubleshooting: agent is rejected (`close 4001`)
-
-If the agent logs that the server rejected its token, the enrollment — not the
-network — is the problem. The SSO accepts the WebSocket upgrade and then closes
-with an application code:
-
-| Code | Meaning | Fix |
-| :--- | :--- | :--- |
-| `4001` | Token unknown, or never issued by this server | Enroll the host and put the issued token in `agent.yml` |
-| `4002` | Superseded — another connection authenticated as this agent | Normal; two copies of the agent are running |
-| `4003` | Enrollment revoked or deleted | Re-enroll |
-| `4004` | Token rotated; `agent.yml` has the old value | Copy the new token |
-
-The agent backs off for 5 minutes on `4001`/`4003`/`4004` rather than retrying
-every 5 seconds — a credential that is wrong will not fix itself, and hammering
-the SSO only floods its audit log.
-
-An agent installed before protocol v1.2.0 carries a token generated in the
-browser that the server never recorded, so it will be rejected with `4001` until
-re-enrolled. The quickest fix is to put a **join key** in its `agent.yml` as
-`join_key` and blank `auth_token` — it will re-enroll itself on the next
-reconnect.
-
----
-
-## Troubleshooting: agent can't connect (`dial tcp ... i/o timeout`)
-
-If the agent host logs `Dial error: dial tcp <ip>:443: i/o timeout` while
-connecting to `wss://<sso-host>/api/agent/ws`, the WebSocket path is usually
-fine — this is a **network/NAT** problem, not an agent or SSO bug. A host behind
-the same NAT that owns the SSO often cannot reach its own **public IP** (no
-hairpin/loopback NAT on many home routers), so the TCP dial times out even
-though the same address works from outside.
-
-Fix options:
-1. Point `agent.yml` `server_url` at an address the host can reach directly —
-   e.g. the SSO host's LAN IP (`http://<lan-ip>` or `http://<lan-ip>:3001` for a
-   no-TLS direct path).
-2. Enable **NAT reflection / hairpin NAT** on the router so LAN hosts can reach
-   their own public IP:443.
-3. Add a local route/firewall rule on the agent host for its public IP.
-
-> Note: on a deployment where the theta42 proxy fronts `sso.suite.example`, make
-> sure the proxy has a **persistent Host record** for the real SSO domain — not
-> just the `localtest.me` placeholder — so routing survives a proxy restart
-> (an in-memory lookup cache can mask a missing Redis record for up to ~1h).
-
-

docs/directory.md

@@ -78,19 +78,7 @@ Requests are decided by the resource's `owner`, or by any directory admin. Mark
 
 ## Navigating the UI
 
-The Directory Management interface nests your resources as a tree, making it easy
-to comprehend your network topography at a glance. You can filter, search, and
-sort your entire infrastructure inventory. Click the green `+` icon next to any
-resource to add a child resource beneath it.
-
-**Collapsing the tree.** Any resource with children carries a caret; click it to
-fold that subtree away. The toolbar's double-chevron buttons expand or collapse
-everything at once. Collapsed state is remembered per browser, so the shape you
-arrange survives a refresh (and the self-heal reload that follows most edits).
-
-While a search filter is active every match is shown regardless of collapsed
-ancestors — otherwise searching for something inside a folded subtree would
-silently return nothing. Clearing the box restores your saved shape.
+The Directory Management interface provides a **Tree View** toggle that visually nests your resources, making it easy to comprehend your network topography at a glance. You can also filter, search, and sort your entire infrastructure inventory. From the tree view, you can click the green `+` icon next to any resource to instantly add a child resource beneath it.
 
 <a href="images/directory.png" target="_blank"><img src="images/directory.png" alt="Directory & inventory list view" width="80%"></a>
 
@@ -114,17 +102,9 @@ You don't have to build the graph by hand — the theta42 tooling registers itse
 
 - a **site** (name from `CFG_SITE_NAME` in `setup.env`, default `local` → slug `site_local`) marked as the current site
 - the **host** the stack runs on (`host_<hostname>`), with IP, MAC address, OS, and kernel collected from the machine
-- the **hosts** for the proxy and jump host (`host_theta-proxy`, `host_theta-jump`)
-- the **services** it composes — SSO Manager, Proxy (management UI), OpenLDAP Directory (the LDAPS endpoint Linux hosts and LDAP-native apps bind to), OpenResty Edge (the 80/443 data plane), and the SSH Jump Host — each with its address, internal port, and git repo
+- the **services** it composes — SSO Manager, Proxy (management UI), OpenLDAP Directory (the LDAPS endpoint Linux hosts and LDAP-native apps bind to), and OpenResty Edge (the 80/443 data plane) — each with its address, internal port, and git repo
 - the proxy's auto-registered **OAuth client**, linked under its service
 
-Services are parented to the host that actually runs them: Proxy and OpenResty
-Edge under `host_theta-proxy`, the SSH Jump Host under `host_theta-jump`, and the
-rest under the stack host. Installs seeded before this was fixed had all of them
-under the stack host, leaving the two purpose-made host resources childless; the
-seed re-parents those on its next run, and only when the current parent is the
-one the old code set, so a layout you arranged deliberately is left alone.
-
 The seed is idempotent and non-destructive: a resource whose slug already exists is considered operator-owned — the seed only fills in metadata fields you haven't set, and never overwrites your values.
 
 ### Linux hosts (ldap-client)

docs/discovery.md

@@ -1,115 +0,0 @@
----
-layout: default
-title: Discovery & Inventory
-nav_order: 6
----
-
-# Discovery & Inventory
-
-The Directory holds two different kinds of thing, and the distinction matters
-for every consumer of the directory:
-
-- **Catalog resources** — what you have declared. Created by hand, seeded by
-  `setup.sh`, or *promoted* from a discovery result. These get LDAP access
-  groups, appear in the Catalog, and are the only hosts the
-  [jump host](https://github.com/theta42/jump-host) will connect you to.
-- **Discovered resources** — what the network reports. Produced by
-  [discovery plugins](plugins.html) and shown on the **Discovered Inventory**
-  tab. They are a queue of "this exists, do you want to manage it?", not
-  infrastructure you have committed to.
-
-A resource is discovery-only when its `metadata.discovery_sources` is non-empty
-and it has never been promoted. Promoting sets `metadata.managed = true`, at
-which point it becomes catalog content like any other resource.
-
-> Nothing grants access to a discovered resource. It carries no groups until it
-> is promoted, and the jump host applies the same rule — an unpromoted Proxmox
-> guest is not a jump target.
-
----
-
-## Where discovered data comes from
-
-| Source | What it reports |
-| :--- | :--- |
-| [Proxmox](plugins.html) | The cluster endpoint, its nodes, and every VM/LXC with NICs, `vmid` and node |
-| [UniFi](plugins.html) | Network devices and connected clients, by MAC |
-| [nmap](plugins.html) | Hosts and open ports on a target range |
-| [Docker](plugins.html) | Containers on a local or remote daemon |
-| [theta-agent](agents.html) | The host it runs on — OS, kernel, CPU, RAM, disk, addresses |
-| [ldap-client](directory.html) | A Linux host registering itself when it joins |
-
-An agent is the most authoritative of these: it runs *on* the machine it
-describes. A network scan is the least — it only knows what answered.
-
----
-
-## How results are matched to existing resources
-
-Every source runs through one reconciler, so two sources seeing the same
-machine converge on one resource instead of creating duplicates. Matching is
-tried in order of precision:
-
-1. **MAC address** — the strongest signal, compared across every interface.
-2. **IP address** — any address on any interface, plus `metadata.address`.
-3. **Slug, name, or base hostname** — last resort.
-
-A candidate must also be **the same kind**. Without that guard a discovered VM
-named `gitea-runner` would match a hand-created *service* of the same name on
-rule 3 and overwrite it. (`template` counts as `host`: converting a VM to a
-template is the same machine.)
-
-When a match is found the metadata is merged, interfaces are unioned by MAC, and
-the source is added to `discovery_sources` — so a resource can legitimately read
-`["unifi", "proxmox"]`, meaning two independent sources agree it exists.
-
-### Naming
-
-Sources disagree about names, so the most human one wins: a **hostname** beats
-an **IP-shaped** name, which beats a **MAC-shaped** name; length is only a
-tie-break within a rank. This is why a device UniFi knows only as
-`ac:16:2d:b3:da:80` is renamed `dl380-0` once Proxmox reports it.
-
-### Relationships
-
-Plugins emit edges as well as resources (a Proxmox node under its cluster
-endpoint, a guest under its node). The reconciler refuses any edge that would
-make a resource its own parent, or that would close a loop — a cycle renders as
-an infinitely nested tree and breaks every ancestor walk in the app.
-
----
-
-## Promoting a discovered resource
-
-On the **Discovered Inventory** tab, press **Promote**. The resource form opens
-pre-filled with what was discovered — name, kind, address, subtype — so you can
-correct it before committing. Saving marks it managed and provisions its
-[LDAP groups](groups.html).
-
-Each row shows what the directory knows about the device: its source(s), its
-`vmid` where applicable, the identifier it has at that source (`sourceId`, e.g.
-`dl380-0/qemu/234`), and every interface with its MAC and address. If a row
-looks wrong, that detail is where to start.
-
----
-
-## Stale results
-
-Resources that are *only* auto-discovered are garbage-collected: if a source
-stops reporting one for long enough it is marked
-`lifecycle_state: "archived"` rather than deleted. Anything you created or
-promoted is never touched — `manual` in `discovery_sources` exempts it.
-
-A Proxmox node that is powered off is still reported (with its `status`), so
-downtime does not look like decommissioning.
-
----
-
-## What the stack discovers about itself
-
-`setup.sh` seeds its own components as catalog resources — the site, the stack
-host, `theta-proxy` and `theta-jump`, and the services under them. The Docker
-discovery plugin then finds the containers backing them. Containers belonging to
-the theta-suite compose project are recognised and attached to the service they
-implement rather than appearing as unmanaged strangers, so a fresh install has an
-empty Discovered Inventory rather than five things demanding attention.

docs/groups.md

@@ -1,312 +0,0 @@
----
-layout: default
-title: Group & Permission Model
-nav_order: 3
----
-
-# Theta42 Group & Permission Model
-
-This is the canonical reference for how **groups and permissions work** across the
-theta42 suite (SSO Manager, Proxy, Jump-Host) and how **downstream apps and Linux
-hosts** should read and use them. It is written to be implementable by both humans
-and LLM agents.
-
-Everything below assumes LDAP is the single source of truth for identity and group
-membership. Group membership is managed in the **SSO Manager Directory**, generated
-from adopted resources — there is **no standalone "Groups" page**.
-
----
-
-## 1. Principles
-
-1. **Groups are a projection of the resource graph.** Every adopted host and app
-   in the Directory gets its own groups, auto-created from its identity. Group
-   membership is managed on the resource's modal.
-2. **Two orthogonal resource namespaces: `host` and `app`.** A host administers
-   hosts; an app administers apps. They do not inherit from each other.
-3. **Three levels per resource: `admin`, `access`, and opaque `capability`.**
-   `admin` implies `access`. Capabilities are explicit and never implied by
-   `admin`.
-4. **Multi-site by prefix.** Each site's groups are fully independent, scoped by
-   the site slug.
-5. **Hosts map, LDAP stays clean.** Directory groups are `groupOfNames` (RBAC)
-   with **no `gidNumber`**. A Linux host uses SSSD to import only the groups it
-   needs and generate their GIDs on the fly (see §8) — no mass import, no GID
-   bloat. Only the meta groups are never imported by hosts.
-6. **The directory is the only place groups are created.** `god_admin` is the sole
-   group that does not belong to a resource or site.
-
----
-
-## 2. Group schema
-
-`S` = site slug (see §7 for normalization). `<host>`/`<app>` = the resource slug.
-`<capability>` = an opaque, app-defined capability token (see §4).
-
-| Group | Scope | Meaning |
-| :--- | :--- | :--- |
-| `god_admin` | global | **Everything, everywhere** (all sites, hosts, apps, consoles, all capabilities). The only non-site group. |
-| `S_super_admin` | site | Everything on site `S` (all hosts, apps, consoles, all capabilities at `S`). |
-| `S_hosts_admin` | site | Admin on **all hosts** at `S`. |
-| `S_hosts_access` | site | Access to **all hosts** at `S`. |
-| `S_hosts_<capability>` | site | Capability `<capability>` on **all hosts** at `S`. |
-| `S_host_<host>_admin` | host | Admin on host `<host>`. |
-| `S_host_<host>_access` | host | Access to host `<host>`. |
-| `S_host_<host>_<capability>` | host | Capability `<capability>` on host `<host>`. |
-| `S_apps_admin` | site | Admin on **all apps** at `S`. |
-| `S_apps_access` | site | Access to **all apps** at `S`. |
-| `S_apps_<capability>` | site | Capability `<capability>` on **all apps** at `S`. |
-| `S_app_<app>_admin` | app | Admin on app `<app>`. |
-| `S_app_<app>_access` | app | Access to app `<app>`. |
-| `S_app_<app>_<capability>` | app | Capability `<capability>` on app `<app>`. |
-
-### Meta groups (implicit membership — not POSIX, no gidNumber)
-
-| Group | Scope | Meaning |
-| :--- | :--- | :--- |
-| `everyone` | global | **All authenticated users**, any site. |
-| `S_everyone` | site | **All authenticated users** at site `S`. |
-
-These are resolved by the directory (any authenticated user passes), never
-enumerated as LDAP members, and cannot be used as Unix groups.
-
----
-
-## 3. Naming, normalization & reserved rules
-
-- The **structural delimiter is `_`**. It appears only between the fixed segments
-  of a group name.
-- **Site, host, and app slugs never contain `_`.** Normalize to lowercase;
-  spaces and `_` → `-`; strip other non-`[a-z0-9-]`. A host named `Web 01` and a
-  site `Main Office` produce slugs `web-01` and `main-office`.
-- **Aggregate groups use the plural kind** (`hosts`, `apps`); per-resource groups
-  use the singular (`host`, `app`). This makes `S_hosts_admin` unambiguous even
-  if a host were named `admin` (that host would be `S_host_admin_admin`).
-- **The last segment is the level.** If it is `admin` or `access` it is a known
-  level; any other value is an **opaque capability** owned by a downstream app.
-- **Total length budget:** keep a group cn under ~120 chars; reject group
-  creation that would exceed it.
-- Groups are **`groupOfNames`** (RFC 2307bis) with **no `gidNumber`**. GIDs are
-  generated on the host by SSSD for only the groups that host imports (see §8).
-
----
-
-## 4. Levels and opaque capabilities
-
-- **`admin`** — manage (create/update/delete/config) the resource.
-- **`access`** — use/read the resource.
-- **`<capability>`** — an arbitrary token the SSO does **not** interpret. The SSO
-  manages membership and exposes the group to the app; **the downstream app
-  defines and enforces what the capability means** (e.g. `emby_admin`,
-  `gitea_maintain`, `reboot`, `backup`).
-
-The directory recognizes `admin`, `access`, `super_admin`, and the meta groups.
-Everything else on a resource group is treated as an opaque capability group and
-passed through to consumers.
-
----
-
-## 5. Permission resolution (inheritance)
-
-Define a user's **effective permission** on a resource by checking, from most
-specific to most general, whether they are a member of any applicable group. The
-rule: a higher group implies everything below it.
-
-### On host `H` at site `S`
-
-| Wanted | Granted if the user is a member of **any** of |
-| :--- | :--- |
-| **admin** on `H` | `god_admin` · `S_super_admin` · `S_hosts_admin` · `S_host_H_admin` |
-| **access** on `H` | (any admin rule above) · `S_hosts_access` · `S_host_H_access` |
-| **capability `C`** on `H` | `god_admin` · `S_super_admin` · `S_hosts_C` · `S_host_H_C` |
-
-### On app `A` at site `S`
-
-Identical, with `app`/`apps` substituted for `host`/`hosts`.
-
-### Management console (SSO / Proxy / Jump-Host)
-
-Each console is registered as an **app** on its site, so console admin is:
-
-`god_admin` · `S_super_admin` · `S_app_<console>_admin`
-
-### Pseudocode
-
-```
-def effective(resource, level_or_cap, site):
-    if user in "god_admin":                  return True
-    if user in f"{site}_super_admin":        return True
-    if level_or_cap in ("admin","access"):
-        agg = f"{site}_{resource.kind}s_{level_or_cap}"
-        if user in agg:                      return True
-    specific = f"{site}_{resource.kind}_{resource.slug}_{level_or_cap}"
-    if user in specific:                     return True
-    if level_or_cap == "access":             return effective(resource, "admin", site)
-    if level_or_cap == "admin":              return False          # access does not imply admin
-    return False
-```
-
-`everyone` / `S_everyone` are a special grantee: if a resource grants a group to
-`everyone` (or `S_everyone`), any authenticated user (at that site) passes.
-
----
-
-## 6. Where groups live — the Directory, generated from adopted resources
-
-- There is **no standalone Groups page.** Group creation/management happens on an
-  **adopted resource** in the Directory.
-- When a host or app is **adopted** (promoted from Discovered Inventory to
-  managed), the directory auto-creates its `_admin` and `_access` groups (and
-  site aggregates if configured). Capability groups are created on demand.
-- Membership (add/remove users) and capability grants are managed on that
-  resource's modal.
-- Deleting a resource removes its per-resource groups.
-- The `S_super_admin`, `S_hosts_*`, `S_apps_*`, `S_everyone` site groups and the
-  global `god_admin`/`everyone` are managed at the site level (not on a single
-  host/app resource).
-
----
-
-## 7. Multi-site isolation
-
-One LDAP tree can serve many sites ("Main Office", "Branch Office", "co-lo",
-"Mikes Homelab", …). Each site `S` has its own fully independent set of `S_*`
-groups behind its prefix. A `main-office_super_admin` or `main-office_hosts_admin`
-touches nothing in `branch-office_*` or `steves-homelab_*`. Only `god_admin` and
-`everyone` cross site boundaries.
-
----
-
-## 8. Unix/POSIX groups — mapped on the host, not in LDAP
-
-Directory groups are **`groupOfNames`** (RFC 2307bis) and carry **no `gidNumber`**.
-There are hundreds of them and only a handful matter on any given host, so we do
-**not** bloat LDAP with GIDs. Instead, each Linux host uses SSSD to import only the
-groups it cares about and map them to GIDs **on the fly** (algorithmic ID mapping).
-This keeps the directory clean and the per-host surface tiny.
-
-### SSSD — generate GIDs on the fly, import only what you need
-
-```ini
-[domain/example]
-id_provider = ldap
-auth_provider = ldap
-ldap_uri = ldaps://ldap.example
-ldap_search_base = dc=example,dc=com
-
-# groupOfNames (RFC 2307bis) schema
-ldap_schema = rfc2307bis
-ldap_group_object_class = groupOfNames
-ldap_group_member = member
-
-# Map GIDs mathematically from the LDAP UUID — no gidNumber in LDAP
-ldap_id_mapping = true
-ldap_group_uuid = entryUUID
-
-# Import ONLY the groups this host needs (e.g. a naming convention or an OU)
-ldap_group_search_filter = (&(objectClass=groupOfNames)(cn=linux-*))
-```
-
-Key ideas:
-- `ldap_id_mapping = true` + `ldap_group_uuid = entryUUID` make SSSD derive a
-  stable GID for any group it imports, so **no `gidNumber` attribute is required**
-  in LDAP.
-- `ldap_group_search_filter` is the gatekeeper: SSSD imports only groups that
-  match, discarding the other hundreds. After changing the filter, clear the
-  cache (`sss_cache -E`; `rm -f /var/lib/sss/db/*`; restart sssd) and verify with
-  `getent group <cn>`.
-
-### What filter to use — the naming convention is the answer
-
-A host should import its **own** resource groups (plus any explicitly granted
-ones). Because the schema is predictable, `ldap-client` can generate the per-host
-`ldap_group_search_filter` from the enrolled host's identity, e.g. a host `web01`
-at site `main-office` imports:
-
-```
-(&(objectClass=groupOfNames)(|(cn=main-office_host_web01_access)
-                               (cn=main-office_host_web01_admin)
-                               (cn=main-office_host_web01_sudo)))
-```
-
-So the operator (or ldap-client) selects a small allowlist of the host's `_access`
-/ `_admin` / capability groups to feed sudoers, SSH `AllowGroups`, and filesystem
-ACLs. **Only those groups are imported** — no GID bloat, no mass import.
-
-### Aliasing an LDAP group into a local group (e.g. `input`)
-
-SSSD cannot merge an LDAP group into a local group whose GID varies per host.
-Two host-side mechanisms cover it:
-
-- **pam_exec** — a script in the login stack adds the user to the local group for
-  the session:
-  ```sh
-  #!/bin/bash
-  if id -Gn "$PAM_USER" | grep -q "host_input"; then usermod -a -G input "$PAM_USER"; fi
-  ```
-  `session optional pam_exec.so /usr/local/bin/add_to_input.sh` in
-  `/etc/pam.d/common-session`.
-
-- **nss-groupmerge** — merge an LDAP group into a local group at NSS time
-  (`/etc/groupmerge.conf`: `input: host_input`, then `group: files sssd groupmerge`
-  in `/etc/nsswitch.conf`), so any service querying `input` sees the LDAP group's
-  members regardless of the local GID.
-
-### Meta groups
-
-`god_admin`, `everyone`, and `S_everyone` are NOT imported by hosts — they have
-implicit membership and are resolved by the directory only.
-
----
-
-## 9. Downstream-app consumption guide
-
-A downstream app (Emby, Gitea, a custom service, a shell script) reads group
-membership from LDAP and interprets it as follows:
-
-1. **Discover the user's groups** — bind with the user's credentials (or use a
-   service account + `memberOf`). Groups are `groupOfNames` (member DN), so query
-   by the user's DN, e.g. `(&(objectClass=groupOfNames)(member=<user_dn>))`, or use
-   the `memberOf` reverse attribute on the user's entry.
-2. **Match each group to a scope:**
-   - `god_admin` → the user is a global administrator.
-   - `{site}_super_admin` → site administrator for that site.
-   - `{site}_hosts_*` / `{site}_app_*` (aggregate) → applies to all hosts/apps at the site.
-   - `{site}_host_<host>_*` / `{site}_app_<app>_*` → applies to that one resource.
-   - `everyone` / `{site}_everyone` → the user is implicitly a member.
-3. **Interpret the last segment:**
-   - `admin` → full control of that resource.
-   - `access` → read/use.
-   - anything else → a capability **you** define; act on it or ignore it.
-4. A user with `{site}_host_web01_access` can reach `web01`; a user with
-   `{site}_host_web01_reboot` (if you define `reboot`) may reboot it; a user with
-   `{site}_app_emby_emby_admin` administers Emby.
-
-The app must **never** treat an unknown last segment as `admin` or `access`.
-
----
-
-## 10. Migration from the legacy `app_*` groups
-
-The current global groups (`app_sso_admin`, `app_super_admin`,
-`app_sso_directory_admin`, `app_jump_admin`) are replaced by the new model:
-
-| Legacy | New |
-| :--- | :--- |
-| `app_super_admin` | `god_admin` |
-| `app_sso_admin` | `S_app_sso_admin` (+ `S_super_admin` for site admins) |
-| `app_sso_directory_admin` | `S_app_sso_admin` |
-| `app_jump_admin` | `S_app_jump_admin` |
-
-During the transition the legacy groups may be kept as short-lived aliases that
-resolve to the same effective permission; once everything is moved, remove them.
-
----
-
-## 11. The management consoles are apps
-
-The SSO, Proxy, and Jump-Host each register themselves as an app on their site and
-receive their auto-generated groups (`S_app_sso_admin`, `S_app_proxy_admin`,
-`S_app_jump_admin`, plus `_access`). Their admin UIs gate on
-`god_admin` · `S_super_admin` · `S_app_<console>_admin`. This keeps everything
-self-consistent: the SSO is "just another app."

docs/plugins.md

@@ -23,44 +23,6 @@ filename basename (without `.js`) is the `type`; the parent directory is the
 - `unifi` — UniFi Network controller (URL + username/password)
 - `nmap` — nmap OS + port scan (a target range; no credentials)
 
-### What the Proxmox plugin produces
-
-One endpoint becomes one subtree:
-
-```
-Proxmox endpoint (cluster name, or the endpoint hostname)
-└── node (hypervisor)
-    ├── VM / template
-    └── LXC / template
-```
-
-The endpoint resource stands for the cluster, not a machine, so it carries the
-API URL and a `sourceId` but deliberately no IP — giving it the address it is
-reached at made the reconciler merge it with the node answering on that address,
-which produced a resource that was its own parent.
-
-Every guest carries:
-
-- `interfaces[]` — one entry per NIC with its own `mac`, `ip`/`ips` and `name`.
-  The MAC and the address on it are read from the same source, so they cannot be
-  mismatched (an earlier version collected MACs and IPs into two flat lists and
-  zipped them by index, which attributed addresses to the wrong NIC on any
-  multi-NIC guest).
-- `macAddress` / `ip` — the primary NIC's values, preferring one that actually
-  has an address.
-- `vmid`, `node` and `sourceId` (`<node>/qemu/<vmid>` or `<node>/lxc/<vmid>`), so
-  a directory row traces back to the exact guest on the exact node.
-
-Interfaces belonging to something running *inside* a guest — `docker0`, `veth*`,
-`br-*`, VPN tunnels — are filtered out. They are not NICs of the host, and their
-172.x addresses would otherwise give the reconciler spurious matches.
-
-A stopped VM still reports its MAC (read from the VM config rather than the
-guest agent), and a DHCP-configured LXC gets its address from the running
-container's interface list. Offline nodes are recorded with `status` rather than
-skipped, so a hypervisor that is down does not look decommissioned and get
-garbage-collected after a week.
-
 A module exports a **manifest**:
 
 ```javascript

docs/vault.md

@@ -28,24 +28,6 @@ You can access the Vault UI from the application's top navigation bar.
 
 The secrets are stored in an OpenBao backend configured in development mode. The default KV (Key-Value) version 2 engine is mounted at `secret/`. The built-in UI uses the `/api/vault/secret/` API endpoints to interact with OpenBao.
 
-## Apps tab (admin)
-
-The **Apps** tab mints a scoped OpenBao token for an **external application** so it can read its own configuration out of OpenBao — a downstream-app credential, not a per-user secret.
-
-1. Enter an app **name** (e.g. `my-service`) and click **Mint token**.
-2. A token is shown **once** — copy it into the external app now; it cannot be recovered later. The app uses it as the `X-Vault-Token` header against `secret/apps/<name>/*` (see the connection convention shown on the page).
-3. The **Minted apps** list shows every token you've created (metadata only — the token itself is never stored). sso keeps each token alive by renewing it periodically, so a downstream app's credential stays valid as long as sso runs. If an app shows a **renewal error**, re-mint it here — that revokes the old token and issues a fresh one.
-
-The token is scoped to `secret/apps/<name>/*` only (policy `app-<name>`), so a compromised token can't touch any other secret.
-
-## Shared tab
-
-The **Shared** tab lets you share a secret with another user (or app) without copying the value around.
-
-1. **New** — give the secret a name (slug) and its JSON data. The owner has full read/write on `secret/shared/<uid>/<slug>`.
-2. Open a secret and use **Grants** to share it with a user or app; the grantee's OpenBao policy is edited immediately so the share takes effect with no token re-mint. Revoking a grant removes access at the ACL.
-3. The data itself is read through the normal Vault proxy using each user's own session, so OpenBao enforces read access per-request.
-
 ## API Access
 
 If you need to programmatically access the secrets, you can interact directly with the OpenBao API using the root token (in dev mode):

nodejs/app.js

@@ -44,10 +44,9 @@ app.onListen.push(function(){
     });
   });
   
-  // Initialize Theta Agent WebSockets. The REST router is already mounted
-  // synchronously above (see the /api/agent mount); this hook only wires the WS.
-  require('./routes/api_agent').initAgentWebSockets(app);
-});
+  // Initialize Theta Agent WebSockets
+  require('./routes/api_agent')(app);
+}); 
 
 // Gzip text responses (HTML/JS/CSS/JSON). The admin UI loads ~13 separate,
 // uncompressed vendor JS/CSS files on every full page navigation (a
@@ -106,12 +105,6 @@ app.use('/api/conf', middleware.auth, require('./routes/api_conf'));
 // Self-service API tokens (PATs) — owner-scoped, no admin group required.
 app.use('/api/api-token', middleware.auth, require('./routes/api_token'));
 
-// theta-agent REST API. Mounted SYNCHRONOUSLY (before the 404 catch-all below),
-// not from an onListen hook — a router registered post-listen would sit behind
-// the terminal 404 handler and make every /api/agent/* request 404. The agent
-// WebSocket handler (routes/api_agent.initAgentWebSockets) still runs on onListen.
-app.use('/api/agent', require('./routes/api_agent'));
-
 // OAuth 2.0 / OpenID Connect
 app.use('/oauth', oauthRouter);
 app.use('/api/oauth', middleware.auth, oauthApiRouter);
@@ -133,8 +126,6 @@ app.use('/api/plugins', middleware.auth, require('./routes/api_plugins'));
 const vaultBroker = require('./utils/vault_broker');
 app.use('/api/vault/apps', middleware.auth, vaultBroker.mintAppRouter);
 app.use('/api/vault', middleware.auth, vaultBroker.scopeGuard, vaultBroker.vaultProxy());
-// Shared secrets (metadata + grants; data reads go through /api/vault proxy).
-app.use('/api/shared-secrets', middleware.auth, require('./routes/api_shared_secrets'));
 
 // Catch 404 and forward to error handler. If none of the above routes are
 // used, this is what will be called.

nodejs/bin/www

@@ -60,13 +60,6 @@ models.initORM().then(() => {
   initScheduler(conf.discovery).catch(err => {
     console.error('Failed to initialize scheduler:', err);
   });
-
-  // Keep external-app vault tokens alive: renew every stored accessor now and
-  // on an interval (see vault_broker.startAppTokenRenewal). Only meaningful
-  // when OpenBao is configured; without VAULT_TOKEN the loop's calls fail soft.
-  if (process.env.VAULT_TOKEN) {
-    require('../utils/vault_broker').startAppTokenRenewal();
-  }
 }).catch(err => {
   console.error('Failed to initialize ORM:', err);
   process.exit(1);

nodejs/models/agent.js

@@ -1,182 +0,0 @@
-'use strict';
-
-const crypto = require('crypto');
-const { Model } = require('@simpleworkjs/orm');
-
-// A theta-agent enrolled against this SSO.
-//
-// Before this model existed the "agent token" was generated in the browser and
-// never recorded anywhere, so the server had no way to tell an agent it issued
-// from one someone invented -- /api/agent/ws accepted any string, and there was
-// no way to revoke a token or to know that an agent existed while it was
-// offline. The row is now the authority: an agent is only real if it is here.
-//
-// The raw token is shown exactly once, at enrollment. Only its SHA-256 lands in
-// the database, so a database disclosure does not hand over working agent
-// credentials. `tokenPrefix` is the first 8 characters, kept in the clear so the
-// UI and logs can identify an agent without holding the secret.
-class Agent extends Model {
-	// Tokens are compared by hash on every WebSocket connect. SHA-256 (not
-	// bcrypt) is deliberate: this runs on the connection path and the token is a
-	// 256-bit random value, not a human-chosen password, so there is nothing for
-	// a slow KDF to protect against here.
-	static hashToken(raw) {
-		return crypto.createHash('sha256').update(String(raw || ''), 'utf8').digest('hex');
-	}
-
-	static generateToken() {
-		return crypto.randomBytes(32).toString('hex');
-	}
-
-	// Resolve a presented token to its (non-revoked) agent, or null. Every
-	// caller that authenticates an agent must go through here.
-	static async authenticate(rawToken) {
-		if (!rawToken || typeof rawToken !== 'string') return null;
-		const tokenHash = this.hashToken(rawToken);
-		const matches = await this.list({ where: { tokenHash } });
-		const agent = matches && matches[0];
-		if (!agent) return null;
-		if (agent.revoked) return null;
-		return agent;
-	}
-
-	// Enroll a new agent and return { agent, token }. The caller is responsible
-	// for showing `token` to the operator once and never storing it.
-	static async enroll({ name, resourceId, enrolledBy, description }) {
-		const token = this.generateToken();
-		const agent = await this.create({
-			id: crypto.randomUUID(),
-			name: name || 'theta-agent',
-			description: description || null,
-			tokenHash: this.hashToken(token),
-			tokenPrefix: token.slice(0, 8),
-			resourceId: resourceId || null,
-			revoked: false,
-			enrolled_by: enrolledBy || null,
-			enrolled_on: Math.floor(Date.now() / 1000)
-		});
-		return { agent, token };
-	}
-
-	// Issue a fresh token for an existing agent, invalidating the old one.
-	async rotateToken() {
-		const token = Agent.generateToken();
-		await this.update({
-			tokenHash: Agent.hashToken(token),
-			tokenPrefix: token.slice(0, 8),
-			revoked: false
-		});
-		return token;
-	}
-
-	static fields = {
-		id: { type: 'uuid', primaryKey: true },
-		name: { type: 'string', isRequired: true },
-		description: { type: 'text' },
-		// Never the raw token. See hashToken above.
-		tokenHash: { type: 'string', isRequired: true },
-		tokenPrefix: { type: 'string' },
-		// The host this agent runs on. Nullable so an agent can be enrolled
-		// before its host exists in the Directory, but the UI pushes for it:
-		// without this link there is nothing to hang resource control off, and
-		// the old code had to guess by matching hostnames to slugs.
-		resource: { type: 'hasOne', model: 'Resource' }, // creates resourceId
-		revoked: { type: 'boolean', default: false },
-		enrolled_by: { type: 'string' },
-		enrolled_on: { type: 'integer' },
-		// Survives a restart, which the in-memory map did not: an agent that is
-		// installed but currently down is now distinguishable from one that was
-		// never enrolled.
-		last_seen: { type: 'integer' },
-		last_ip: { type: 'string' },
-		lastDiscovery: { type: 'json', default: {} },
-		lastTelemetry: { type: 'json', default: {} }
-	};
-
-	// The shape the admin API returns. Never includes tokenHash.
-	toPublic(liveState) {
-		const data = this.toJSON ? this.toJSON() : { ...this };
-		delete data.tokenHash;
-		return {
-			...data,
-			connected: !!(liveState && liveState.connected),
-			// "Online" is a live-connection fact, not a stored one. A row with a
-			// last_seen from an hour ago is an installed agent that is down.
-			isOnline: !!(liveState && liveState.connected),
-			lastResponse: (liveState && liveState.lastResponse) || null
-		};
-	}
-}
-
-// A join key: the one credential an operator hands out so a host can enroll
-// itself. Requiring an admin to pre-register every machine before the agent
-// would talk to them made adding a host a two-system chore -- installing the
-// agent should be enough.
-//
-// A join key is NOT the agent's long-term credential. On first connect the
-// server auto-enrolls the host and issues it a unique per-agent token, which
-// the agent persists and uses from then on (PROTOCOL.md 1.2). That keeps the
-// operator experience to "one key" while still giving every host its own
-// revocable identity -- revoking a single agent means something, and a host
-// that is compromised does not hand over the credential for the whole fleet.
-class AgentJoinKey extends Model {
-	static hashKey(raw) {
-		return crypto.createHash('sha256').update(String(raw || ''), 'utf8').digest('hex');
-	}
-
-	static generateKey() {
-		// `tjk_` so an operator can tell a join key from an agent token at a
-		// glance -- they are handled very differently.
-		return 'tjk_' + crypto.randomBytes(32).toString('hex');
-	}
-
-	// Resolve a presented key to a usable join key, or null. Expiry and
-	// revocation are both enforced here so no caller can forget one.
-	static async authenticate(rawKey) {
-		if (!rawKey || typeof rawKey !== 'string') return null;
-		const keyHash = this.hashKey(rawKey);
-		const matches = await this.list({ where: { keyHash } });
-		const key = matches && matches[0];
-		if (!key) return null;
-		if (key.revoked) return null;
-		if (key.expires_on && key.expires_on < Math.floor(Date.now() / 1000)) return null;
-		return key;
-	}
-
-	static async issue({ label, createdBy, expiresInDays }) {
-		const raw = this.generateKey();
-		const key = await this.create({
-			id: crypto.randomUUID(),
-			label: label || 'default',
-			keyHash: this.hashKey(raw),
-			keyPrefix: raw.slice(0, 12),
-			revoked: false,
-			created_by: createdBy || null,
-			created_on: Math.floor(Date.now() / 1000),
-			expires_on: expiresInDays ? Math.floor(Date.now() / 1000) + expiresInDays * 86400 : null,
-			use_count: 0
-		});
-		return { key, raw };
-	}
-
-	static fields = {
-		id: { type: 'uuid', primaryKey: true },
-		label: { type: 'string', isRequired: true },
-		keyHash: { type: 'string', isRequired: true },
-		keyPrefix: { type: 'string' },
-		revoked: { type: 'boolean', default: false },
-		created_by: { type: 'string' },
-		created_on: { type: 'integer' },
-		expires_on: { type: 'integer' },
-		use_count: { type: 'integer', default: 0 },
-		last_used_on: { type: 'integer' }
-	};
-
-	toPublic() {
-		const data = this.toJSON ? this.toJSON() : { ...this };
-		delete data.keyHash;
-		return data;
-	}
-}
-
-module.exports = { Agent, AgentJoinKey };

nodejs/models/index.js

@@ -17,10 +17,6 @@ const { Resource, ResourceEdge, ResourceGroup } = require('./resource');
 const { AccessRequest } = require('./access_request');
 const { Webhook } = require('./webhook');
 const { PluginInstance } = require('./plugin_instance');
-const { SharedSecret } = require('./shared_secret');
-const { SharedSecretGrant } = require('./shared_secret_grant');
-const { VaultAppToken } = require('./vault_app_token');
-const { Agent, AgentJoinKey } = require('./agent');
 async function initORM() {
   const ormConf = conf.orm || {
     dialect: 'sqlite',
@@ -35,48 +31,15 @@ async function initORM() {
       conf: { orm: ormConf },
       models: [
         Resource, ResourceEdge, ResourceGroup, AccessRequest, Webhook, PluginInstance,
-        SharedSecret, SharedSecretGrant, VaultAppToken, Agent, AgentJoinKey,
         Token, AuthToken, InviteToken, ImpersonationToken, PasswordResetToken, OtpToken, ServiceToken
       ]
     });
     console.log('[initORM] ORM initialized successfully');
     console.log('[initORM] Resource.orm =', !!Resource.orm, 'Token.orm =', !!Token.orm);
-    await healSchema();
   } catch (err) {
     console.error('[initORM] ORM initialization failed:', err.message);
     throw err;
   }
 }
 
-// Add-only schema heal. @simpleworkjs/orm runs sequelize.sync() WITHOUT alter,
-// which creates missing tables but never touches existing ones — so a column
-// added in a newer release (e.g. PluginInstance.lastLog) simply never appears
-// in an upgraded deployment's database and every query on the model fails
-// ("no such column"). This walks each Sequelize model and ADDs any attribute
-// missing from its table. Strictly additive (never drops or retypes), works on
-// any dialect via the query interface, and fail-soft per column so one bad
-// attribute can't take the boot down.
-async function healSchema() {
-  const adapter = Resource.orm && Resource.orm.adapters && Resource.orm.adapters.sequelize;
-  if (!adapter || !adapter.sequelize) return;
-  const sequelize = adapter.sequelize;
-  const qi = sequelize.getQueryInterface();
-  for (const SM of Object.values(sequelize.models)) {
-    const table = SM.getTableName();
-    let existing;
-    try { existing = await qi.describeTable(table); }
-    catch (e) { continue; } // no table yet — sync() handles creation
-    for (const [name, attr] of Object.entries(SM.getAttributes())) {
-      const col = attr.field || name;
-      if (existing[col]) continue;
-      try {
-        await qi.addColumn(table, col, attr);
-        console.log(`[initORM] schema heal: added missing column ${table}.${col}`);
-      } catch (e) {
-        console.error(`[initORM] schema heal: could not add ${table}.${col}:`, e.message);
-      }
-    }
-  }
-}
-
 module.exports.initORM = initORM;

nodejs/models/shared_secret.js

@@ -1,56 +0,0 @@
-'use strict';
-
-// SharedSecret — a secret the owner has published to the shared namespace so it
-// can be shared with other users and/or downstream apps.
-//
-// The secret DATA lives in OpenBao at `secret/shared/<ownerUid>/<slug>` (KV-v2),
-// never in the DB. This row is metadata only (owner + slug + description) and is
-// the source of truth for the UI (which shares exist). ACCESS CONTROL is enforced
-// entirely by OpenBao ACL policies: the owner's `user-<uid>` policy grants full
-// R/W on `secret/shared/<ownerUid>/*`, and each grantee's policy content is
-// edited to add `read` on the exact shared path (see vault_broker.js — policy
-// content is parsed live at token use, so a grant takes effect immediately with
-// no token re-mint). `secretId` on SharedSecretGrant links grantees to this row.
-//
-// `slug` is unique and immutable in practice — it is embedded in the shared path
-// and in grantee policy rules, so changing it would require rewriting policies.
-// Like PluginInstance, there is no ORM auto-timestamp hook: route handlers stamp
-// created_by/on + updated_by/on on every write. `id` (uuid) is generated by the
-// ORM on create.
-
-const { Model } = require('@simpleworkjs/orm');
-
-class SharedSecret extends Model {
-  static fields = {
-    id: { type: 'uuid', primaryKey: true },
-    // Human slug embedded in the OpenBao path: secret/shared/<ownerUid>/<slug>.
-    // Unique so two owners can't collide on the same shared path.
-    slug: { type: 'string', isRequired: true, unique: true, min: 1, max: 64 },
-    // The publishing user's uid — also the shared path's namespace segment.
-    ownerUid: { type: 'string', isRequired: true, min: 1, max: 64 },
-    // Optional human description shown in the Shared tab.
-    description: { type: 'text' },
-    // Audit stamps (set by the route handler, not by an ORM hook).
-    created_by: { type: 'string' },
-    created_on: { type: 'integer' },
-    updated_by: { type: 'string' },
-    updated_on: { type: 'integer' },
-  };
-
-  // Full OpenBao KV-v2 path for this shared secret (logical path, no data/metadata).
-  static pathFor(ownerUid, slug) {
-    return `shared/${ownerUid}/${slug}`;
-  }
-
-  path() {
-    return SharedSecret.pathFor(this.ownerUid, this.slug);
-  }
-
-  // Look up by slug (unique). Returns the row or null.
-  static async getBySlug(slug) {
-    const rows = await this.list({ where: { slug } });
-    return rows[0] || null;
-  }
-}
-
-module.exports = { SharedSecret };

nodejs/models/shared_secret_grant.js

@@ -1,53 +0,0 @@
-'use strict';
-
-// SharedSecretGrant — who can read a shared secret. Each row says "grantee
-// <granteeId> (a user uid or an app name) has <capability> on the shared secret
-// <secretId>".
-//
-// This table is the metadata/UX record of a grant. The actual ENFORCEMENT lives
-// in OpenBao ACL policy content: when a grant is created, vault_broker.js
-// recomputes the grantee's policy HCL (`user-<uid>` or `app-<name>`) to include
-// `read` on the exact shared path and rewrites it. Because OpenBao parses policy
-// content live at token use, the grant applies to the grantee's existing token
-// immediately (no re-mint). Revoking removes the rule and rewrites the policy.
-//
-// granteeType distinguishes the two principal kinds:
-//   'user' — a user uid → grantee's `user-<uid>` policy is edited
-//   'app'  — an app name → grantee's `app-<name>` policy is edited (downstream apps)
-// capability is currently always 'read' (grantees are read-only); the column is
-// a string so later capabilities could be added without a migration.
-//
-// No ORM auto-timestamp hook: route handlers stamp created_by/on + updated_by/on.
-// Uniqueness on (secretId, granteeType, granteeId) prevents duplicate grants.
-
-const { Model } = require('@simpleworkjs/orm');
-
-const GRANTEE_TYPES = ['user', 'app'];
-const CAPABILITIES = ['read'];
-
-class SharedSecretGrant extends Model {
-  static fields = {
-    id: { type: 'uuid', primaryKey: true },
-    // FK to SharedSecret.id.
-    secretId: { type: 'string', isRequired: true, min: 1 },
-    // 'user' (a uid) or 'app' (an app name) — which policy to edit.
-    granteeType: { type: 'string', isRequired: true, min: 1 },
-    // The grantee's uid (for 'user') or app name (for 'app').
-    granteeId: { type: 'string', isRequired: true, min: 1, max: 64 },
-    // Access level — 'read' today.
-    capability: { type: 'string', isRequired: true, default: 'read' },
-    // Audit stamps (set by the route handler, not by an ORM hook).
-    created_by: { type: 'string' },
-    created_on: { type: 'integer' },
-    updated_by: { type: 'string' },
-    updated_on: { type: 'integer' },
-  };
-
-  // All grants for a given grantee (user uid or app name). Used to rebuild the
-  // grantee's policy content so every granted shared path is present/absent.
-  static async listForGrantee(granteeType, granteeId) {
-    return this.list({ where: { granteeType, granteeId } });
-  }
-}
-
-module.exports = { SharedSecretGrant, GRANTEE_TYPES, CAPABILITIES };

nodejs/models/vault_app_token.js

@@ -1,43 +0,0 @@
-'use strict';
-
-// VaultAppToken — the ACCESSOR of an OpenBao token minted for an external app
-// from the vault UI (Apps tab), so sso can keep the token alive.
-//
-// The token itself is shown ONCE at mint and never stored (a stolen accessor
-// cannot authenticate — it can only look up, renew, or revoke its token, and
-// only the sso broker's policy grants those endpoints). App tokens are minted
-// through the sso-app role as PERIODIC tokens: they live forever, but only if
-// something renews them inside every period window. That something is sso's
-// renewal loop (vault_broker.startAppTokenRenewal), which walks these rows and
-// POSTs auth/token/renew-accessor on a timer — so a downstream app's credential
-// stays valid as long as sso itself is running, with no renewal code needed in
-// the downstream app.
-//
-// One row per app name: re-minting an app's token revokes the previous token
-// via its accessor (no zombie credentials) and replaces the row.
-
-const { Model } = require('@simpleworkjs/orm');
-
-class VaultAppToken extends Model {
-  static fields = {
-    id: { type: 'uuid', primaryKey: true },
-    // The external app's name — also its policy (app-<name>) and KV namespace
-    // (secret/apps/<name>/). Unique: one live token per app.
-    name: { type: 'string', isRequired: true, unique: true, min: 1, max: 64 },
-    // The minted token's accessor (renew/revoke handle, cannot authenticate).
-    accessor: { type: 'string', isRequired: true, max: 128 },
-    // Renewal bookkeeping, updated by the renewal loop.
-    lastRenewedAt: { type: 'integer' },
-    lastError: { type: 'text' },
-    // Audit stamps (set by the route handler, not by an ORM hook).
-    created_by: { type: 'string' },
-    created_on: { type: 'integer' },
-  };
-
-  static async getByName(name) {
-    const rows = await this.list({ where: { name } });
-    return rows[0] || null;
-  }
-}
-
-module.exports = { VaultAppToken };

nodejs/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "t42-sso-manager",
-  "version": "1.30.0",
+  "version": "1.19.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "t42-sso-manager",
-      "version": "1.30.0",
+      "version": "1.19.6",
       "license": "MIT",
       "dependencies": {
         "@fortawesome/fontawesome-free": "^7.3.0",
@@ -2344,9 +2344,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
-      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz",
+      "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0"
@@ -4294,9 +4294,9 @@
       "license": "MIT"
     },
     "node_modules/ip-address": {
-      "version": "10.4.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
-      "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==",
+      "version": "10.2.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
+      "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==",
       "license": "MIT",
       "engines": {
         "node": ">= 12"
@@ -5966,16 +5966,16 @@
       }
     },
     "node_modules/nodemon/node_modules/brace-expansion": {
-      "version": "5.0.9",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "version": "5.0.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
+      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "20 || >=22"
+        "node": "18 || 20 || >=22"
       }
     },
     "node_modules/nodemon/node_modules/debug": {
@@ -7726,9 +7726,9 @@
       }
     },
     "node_modules/test-exclude/node_modules/brace-expansion": {
-      "version": "1.1.18",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
-      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
+      "version": "1.1.16",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
+      "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7918,9 +7918,9 @@
       "license": "MIT"
     },
     "node_modules/undici": {
-      "version": "6.28.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz",
-      "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==",
+      "version": "6.27.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.27.0.tgz",
+      "integrity": "sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==",
       "license": "MIT",
       "optional": true,
       "engines": {

nodejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "t42-sso-manager",
-  "version": "1.30.0",
+  "version": "1.19.6",
   "description": "A very simple LDAP management and SSO system",
   "author": [
     {

nodejs/plugins/discovery/docker.js

@@ -7,15 +7,7 @@ module.exports = {
   description: 'Discover running containers and networks from a local or remote Docker daemon.',
   configSchema: [
     { key: 'socketPath', label: 'Docker Socket Path', type: 'text', required: false, placeholder: '/var/run/docker.sock' },
-    { key: 'tcpHost', label: 'TCP Host (e.g., http://10.0.0.1:2375)', type: 'url', required: false, placeholder: '' },
-    // Containers in this compose project are the stack's own. They are already
-    // represented in the catalog as services, so they are recorded as managed
-    // and linked to the service they implement instead of arriving as
-    // unmanaged strangers a fresh install has to triage.
-    { key: 'stackProject', label: 'Own compose project', type: 'text', required: false, placeholder: 'theta-suite' },
-    // The catalog host these containers run on, so they land in the tree
-    // instead of as roots.
-    { key: 'hostSlug', label: 'Parent host slug', type: 'text', required: false, placeholder: 'host_<hostname>' }
+    { key: 'tcpHost', label: 'TCP Host (e.g., http://10.0.0.1:2375)', type: 'url', required: false, placeholder: '' }
   ],
 
   validate: async (config) => {
@@ -56,57 +48,23 @@ module.exports = {
             const resources = [];
             const edges = [];
 
-            const stackProject = (config.stackProject || '').trim();
-            const hostSlug = (config.hostSlug || '').trim();
-
             for (const c of containers) {
-              const labels = c.Labels || {};
-              const composeProject = labels['com.docker.compose.project'] || '';
-              const composeService = labels['com.docker.compose.service'] || '';
               const name = c.Names && c.Names.length > 0 ? c.Names[0].replace(/^\//, '') : c.Id.substring(0, 12);
-
-              // A container id changes every time the container is recreated,
-              // so an id-derived slug made `docker compose up` mint a brand-new
-              // resource on every deploy and orphan the previous one. Prefer
-              // identifiers that survive a recreate: the compose project+service
-              // it belongs to, else its name.
-              const stableKey = composeProject && composeService
-                ? `${composeProject}-${composeService}`
-                : (name || c.Id.substring(0, 12));
-              const slug = `docker-${stableKey.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '')}`;
-
+              const slug = `docker-cnt-${c.Id.substring(0, 12)}`;
+              
               const ports = (c.Ports || []).map(p => p.PublicPort ? `${p.PublicPort}:${p.PrivatePort}` : `${p.PrivatePort}`).join(', ');
-              const isOwnStack = !!(stackProject && composeProject === stackProject);
-
+              
               resources.push({
                 kind: 'container',
-                name: composeService || name,
+                name: name,
                 slug: slug,
                 metadata: {
                   image: c.Image,
                   state: c.State,
                   status: c.Status,
-                  ports: ports,
-                  composeProject: composeProject || undefined,
-                  composeService: composeService || undefined,
-                  containerName: name,
-                  sourceId: stableKey,
-                  // Part of the deployment we are running inside: already
-                  // accounted for, not something to promote.
-                  managed: isOwnStack ? true : undefined
+                  ports: ports
                 }
               });
-
-              // Attach the container to the service it implements when the
-              // catalog already has one under that slug (the bootstrap seeds
-              // `sso-manager`, `proxy`, `jump-host`, … using the same names
-              // compose uses). The reconciler drops an edge whose parent does
-              // not resolve, so an unmatched name is simply not linked.
-              if (isOwnStack && composeService) {
-                edges.push({ parentSlug: composeService, childSlug: slug, relation: 'runs' });
-              } else if (hostSlug) {
-                edges.push({ parentSlug: hostSlug, childSlug: slug, relation: 'hosts' });
-              }
             }
 
             resolve({ resources, edges });

nodejs/plugins/discovery/proxmox.js

@@ -6,81 +6,6 @@ const agent = new https.Agent({
   rejectUnauthorized: false
 });
 
-// Accumulates a guest's NICs, keyed by MAC, merging what several Proxmox
-// endpoints each know a piece of: the guest agent knows MAC+IP together, the
-// VM/LXC config knows the MAC even while the guest is stopped, and the LXC
-// interfaces endpoint knows the DHCP-assigned IP. Keying by MAC is what keeps
-// the pairing honest -- the previous code collected MACs and IPs into two flat
-// lists and zipped them by index, which mismatched them on any multi-NIC guest.
-class Interfaces {
-  constructor() { this.byMac = new Map(); this.anonymous = []; }
-
-  // Interfaces that belong to something running INSIDE the guest -- container
-  // engines, overlay networks, VPNs -- rather than to the guest itself. A
-  // Home Assistant VM reported 16 of these (docker0, hassio, 14x veth*)
-  // alongside its one real NIC, which is noise in the directory and, worse,
-  // gives the reconciler a pile of 172.x addresses to match unrelated hosts on.
-  // Only applied to guests; a hypervisor's own bridges are how you reach it.
-  static VIRTUAL_IFACE_RE = /^(lo|docker\d*|hassio|veth|br-|virbr|tap|fwbr|fwln|fwpr|cni|flannel|cali|kube|weave|zt|tailscale|wg|tun|utun)/i;
-
-  static isVirtualName(name) {
-    return !!name && Interfaces.VIRTUAL_IFACE_RE.test(name);
-  }
-
-  // A udev "predictable" name of the form enx<12 hex> encodes the MAC. It is
-  // the only place the Proxmox node network API exposes a physical NIC's MAC
-  // (/nodes/{node}/network carries no hwaddr field at all), so parse it out
-  // rather than leaving every hypervisor MAC-less.
-  static macFromIfaceName(name) {
-    const m = /^enx([0-9a-f]{12})$/i.exec(name || '');
-    if (!m) return null;
-    return m[1].toLowerCase().match(/.{2}/g).join(':');
-  }
-
-  static normalizeMac(mac) {
-    const m = (mac || '').toLowerCase().trim();
-    if (!/^([0-9a-f]{2}:){5}[0-9a-f]{2}$/.test(m)) return null;
-    if (m === '00:00:00:00:00:00') return null;
-    return m;
-  }
-
-  // `ips` are the addresses observed on this one NIC (may be empty for a
-  // stopped guest, where only the MAC is known).
-  add(mac, ips, name) {
-    const key = Interfaces.normalizeMac(mac);
-    const addrs = (ips || []).filter(Boolean);
-    if (!key) {
-      // An IP with no usable MAC is still worth keeping; a NIC with neither is not.
-      if (addrs.length) this.anonymous.push({ mac: null, ip: addrs[0], ips: addrs, name: name || null });
-      return;
-    }
-    const existing = this.byMac.get(key);
-    if (existing) {
-      for (const ip of addrs) if (!existing.ips.includes(ip)) existing.ips.push(ip);
-      existing.ip = existing.ips[0] || null;
-      if (!existing.name && name) existing.name = name;
-      return;
-    }
-    this.byMac.set(key, { mac: key, ip: addrs[0] || null, ips: addrs, name: name || null });
-  }
-
-  toArray() { return [...this.byMac.values(), ...this.anonymous]; }
-
-  // The address/MAC the directory shows in its single-value columns, and what
-  // the reconciler matches on. Prefer a NIC that actually has an address.
-  primaryIp() {
-    const withIp = this.toArray().find(i => i.ip);
-    return withIp ? withIp.ip : null;
-  }
-
-  primaryMac() {
-    const withIp = this.toArray().find(i => i.ip && i.mac);
-    if (withIp) return withIp.mac;
-    const first = this.toArray().find(i => i.mac);
-    return first ? first.mac : null;
-  }
-}
-
 module.exports = {
   // Plugin manifest — see nodejs/services/plugin_registry.js. `configSchema`
   // drives the admin UI form and validation; fields flagged `secret:true` are
@@ -125,45 +50,6 @@ module.exports = {
     const resources = [];
     const edges = [];
 
-    // 0. The Proxmox endpoint itself. Without it a multi-node cluster produces
-    // several unrelated roots in the Directory tree and nothing says where any
-    // of them came from. Every node discovered below is parented to this, so
-    // one endpoint == one subtree.
-    const endpointHost = (() => {
-      try { return new URL(url).hostname; } catch (e) { return url.replace(/^https?:\/\//, '').split('/')[0]; }
-    })();
-    const clusterName = await (async () => {
-      // /cluster/status names the cluster when one exists; a standalone node
-      // has no cluster entry, in which case the endpoint hostname is the name.
-      try {
-        const res = await fetch(`${url}/api2/json/cluster/status`, { headers, agent });
-        if (!res.ok) return null;
-        const entry = ((await res.json()).data || []).find(d => d.type === 'cluster');
-        return entry ? entry.name : null;
-      } catch (e) { return null; }
-    })();
-
-    const endpointSlug = `pve-${endpointHost.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '')}`;
-    resources.push({
-      kind: 'host',
-      name: clusterName || `Proxmox (${endpointHost})`,
-      slug: endpointSlug,
-      metadata: {
-        subType: 'proxmox',
-        address: url,
-        os: 'Proxmox VE',
-        isProduction: true,
-        sourceId: url,
-        // Deliberately NO `ip`/`interfaces`: this resource stands for the
-        // cluster (the API endpoint), not for a machine. Giving it the address
-        // it is reached at made the reconciler match it to the very node that
-        // answers on that address -- the endpoint and the node collapsed into
-        // one row, which then became its own parent. The cluster is identified
-        // by slug + sourceId instead, which nothing else can collide with.
-        interfaces: []
-      }
-    });
-
     // 1. Get Nodes
     const resNodes = await fetch(`${url}/api2/json/nodes`, { headers, agent });
     if(!resNodes.ok) {
@@ -173,57 +59,9 @@ module.exports = {
     const nodes = (await resNodes.json()).data;
 
     for (const node of nodes) {
-      // An offline node is still a real hypervisor that belongs in the
-      // directory -- skipping it entirely used to make it look decommissioned
-      // and let the reconciler's garbage collector archive it after a week of
-      // downtime. Record it, mark it down, and skip only the guest enumeration
-      // (which needs the node to answer).
-      const online = node.status === 'online';
-
+      if (node.status !== 'online') continue;
+      
       const nodeSlug = `pve-node-${node.node}`;
-
-      // A hypervisor with no address is not actionable. Read its bridges/NICs
-      // so the node lands in the directory reachable and MAC-identified like
-      // any other host. Unlike a guest, a node's bridges are kept: vmbrN is
-      // normally the address you actually reach the hypervisor on.
-      const nodeIfaces = new Interfaces();
-      try {
-        const netRes = online
-          ? await fetch(`${url}/api2/json/nodes/${node.node}/network`, { headers, agent })
-          : { ok: false };
-        if (netRes.ok) {
-          const ifaceList = (await netRes.json()).data || [];
-          for (const iface of ifaceList) {
-            if (iface.iface === 'lo') continue;
-            const ip = iface.address || iface.cidr;
-            // This endpoint has no hwaddr field, so the MAC has to be recovered
-            // from a predictable interface name -- either this interface's own
-            // or, for a bridge, one of the physical ports beneath it.
-            let mac = Interfaces.macFromIfaceName(iface.iface);
-            if (!mac) {
-              for (const alt of (iface.altnames || [])) {
-                mac = Interfaces.macFromIfaceName(alt);
-                if (mac) break;
-              }
-            }
-            if (!mac && iface.bridge_ports) {
-              for (const port of String(iface.bridge_ports).split(/\s+/).filter(Boolean)) {
-                mac = Interfaces.macFromIfaceName(port);
-                if (mac) break;
-                // The port may itself only carry the MAC in an altname.
-                const portDef = ifaceList.find(i => i.iface === port);
-                for (const alt of ((portDef && portDef.altnames) || [])) {
-                  mac = Interfaces.macFromIfaceName(alt);
-                  if (mac) break;
-                }
-                if (mac) break;
-              }
-            }
-            nodeIfaces.add(mac || iface.hwaddr, ip ? [String(ip).split('/')[0]] : [], iface.iface);
-          }
-        }
-      } catch (e) {}
-
       resources.push({
         kind: 'host',
         name: node.node,
@@ -232,19 +70,9 @@ module.exports = {
           subType: 'hypervisor',
           os: 'Proxmox VE',
           isProduction: true,
-          status: node.status,
-          sourceId: `${node.node}`,
-          node: node.node,
-          interfaces: nodeIfaces.toArray(),
-          macAddress: nodeIfaces.primaryMac(),
-          ip: nodeIfaces.primaryIp()
+          interfaces: [] 
         }
       });
-      edges.push({ parentSlug: endpointSlug, childSlug: nodeSlug, relation: 'hosts' });
-
-      // Everything below asks the node itself; an offline node answers none of
-      // it, and its guests are already recorded from previous runs.
-      if (!online) continue;
 
       // 2. Get VMs for this node
       const resVms = await fetch(`${url}/api2/json/nodes/${node.node}/qemu`, { headers, agent });
@@ -254,12 +82,10 @@ module.exports = {
         const vmSlug = `vm-${vm.vmid}`;
         const isTemplate = vm.template === 1;
         
-        const ifaces = new Interfaces();
-
-        // Enrich from QEMU guest agent if running. The agent is the only source
-        // that knows which IP sits on which NIC, so pair them here rather than
-        // accumulating two flat lists (zipping those by index attributed IPs to
-        // the wrong MAC on any guest with more than one NIC).
+        let ips = [];
+        let macs = [];
+        
+        // Enrich from QEMU guest agent if running
         if (vm.status === 'running') {
             try {
                 const agentRes = await fetch(`${url}/api2/json/nodes/${node.node}/qemu/${vm.vmid}/agent/network-get-interfaces`, { headers, agent });
@@ -267,35 +93,35 @@ module.exports = {
                     const agentData = (await agentRes.json()).data;
                     if (agentData && agentData.result) {
                         for (const iface of agentData.result) {
-                            // Docker bridges, veth pairs and VPN tunnels are the
-                            // guest's own plumbing, not NICs of the guest.
-                            if (Interfaces.isVirtualName(iface.name)) continue;
-                            const ips = (iface['ip-addresses'] || [])
-                                .filter(ip => ip['ip-address-type'] === 'ipv4' && ip['ip-address'] !== '127.0.0.1')
-                                .map(ip => ip['ip-address']);
-                            ifaces.add(iface['hardware-address'], ips, iface.name);
+                            if (iface['hardware-address'] && iface['hardware-address'] !== '00:00:00:00:00:00') macs.push(iface['hardware-address']);
+                            if (iface['ip-addresses']) {
+                                for (const ip of iface['ip-addresses']) {
+                                    if (ip['ip-address-type'] === 'ipv4' && ip['ip-address'] !== '127.0.0.1') {
+                                        ips.push(ip['ip-address']);
+                                    }
+                                }
+                            }
                         }
                     }
                 }
             } catch(e) {}
         }
-
-        // Enrich from VM config: the MAC is declared there whether or not the
-        // guest agent answered, so a stopped VM still gets a stable identity.
+        
+        // Enrich from VM config to at least get MAC if agent failed/stopped
         try {
             const configRes = await fetch(`${url}/api2/json/nodes/${node.node}/qemu/${vm.vmid}/config`, { headers, agent });
             if (configRes.ok) {
                 const confData = (await configRes.json()).data;
                 for (let i = 0; i < 10; i++) {
                     if (confData[`net${i}`]) {
-                        const m = confData[`net${i}`].match(/(?:virtio|e1000e?|rtl8139|vmxnet3)=([0-9a-fA-F:]{17})/);
-                        if(m) ifaces.add(m[1], [], `net${i}`);
+                        const m = confData[`net${i}`].match(/(?:virtio|e1000|rtl8139|vmxnet3)=([0-9a-fA-F:]+)/);
+                        if(m) macs.push(m[1].toLowerCase());
                     }
                 }
             }
         } catch(e) {}
 
-        const interfaces = ifaces.toArray();
+        const interfaces = [...new Set(macs)].map((mac, i) => ({ mac, ip: ips[i] || null }));
 
         resources.push({
           kind: isTemplate ? 'template' : 'host',
@@ -304,14 +130,9 @@ module.exports = {
           metadata: {
             subType: isTemplate ? 'template' : 'vm',
             vmid: vm.vmid,
-            // The Proxmox-side identity, so a resource can be traced back to the
-            // exact guest on the exact node it was discovered from.
-            sourceId: `${node.node}/qemu/${vm.vmid}`,
-            node: node.node,
             isProduction: vm.status === 'running',
             interfaces,
-            macAddress: ifaces.primaryMac(),
-            ip: ifaces.primaryIp()
+            ip: ips[0] || null
           }
         });
         edges.push({ parentSlug: nodeSlug, childSlug: vmSlug, relation: 'hosts' });
@@ -325,45 +146,26 @@ module.exports = {
         const lxcSlug = `lxc-${lxc.vmid}`;
         const isTemplate = lxc.template === 1;
         
-        const ifaces = new Interfaces();
-
-        // Enrich from LXC config. Each netN line carries its own hwaddr and ip,
-        // so read them off the same line instead of into parallel lists.
+        let ips = [];
+        let macs = [];
+        
+        // Enrich from LXC config
         try {
             const configRes = await fetch(`${url}/api2/json/nodes/${node.node}/lxc/${lxc.vmid}/config`, { headers, agent });
             if (configRes.ok) {
                 const confData = (await configRes.json()).data;
                 for (let i = 0; i < 10; i++) {
-                    const line = confData[`net${i}`];
-                    if (!line) continue;
-                    const hwMatch = line.match(/hwaddr=([0-9a-fA-F:]{17})/);
-                    // `ip=` is either a CIDR address or the literal `dhcp`/`manual`.
-                    const ipMatch = line.match(/\bip=(\d+\.\d+\.\d+\.\d+)/);
-                    const nameMatch = line.match(/\bname=([^,]+)/);
-                    if (hwMatch || ipMatch) {
-                        ifaces.add(hwMatch && hwMatch[1], ipMatch ? [ipMatch[1]] : [], nameMatch ? nameMatch[1] : `net${i}`);
+                    if (confData[`net${i}`]) {
+                        const hwMatch = confData[`net${i}`].match(/hwaddr=([0-9a-fA-F:]+)/);
+                        const ipMatch = confData[`net${i}`].match(/ip=([0-9\.]+)/); // Ignores dhcp
+                        if(hwMatch) macs.push(hwMatch[1].toLowerCase());
+                        if(ipMatch) ips.push(ipMatch[1]);
                     }
                 }
             }
         } catch(e) {}
 
-        // A DHCP-configured container has no IP in its config. Ask the running
-        // container's interface list so it lands in the directory addressable
-        // instead of as an IP-less row.
-        if (lxc.status === 'running' && !ifaces.primaryIp()) {
-            try {
-                const ifRes = await fetch(`${url}/api2/json/nodes/${node.node}/lxc/${lxc.vmid}/interfaces`, { headers, agent });
-                if (ifRes.ok) {
-                    for (const iface of ((await ifRes.json()).data || [])) {
-                        if (Interfaces.isVirtualName(iface.name)) continue;
-                        const ip = (iface.inet || '').split('/')[0];
-                        ifaces.add(iface.hwaddr, ip ? [ip] : [], iface.name);
-                    }
-                }
-            } catch(e) {}
-        }
-
-        const interfaces = ifaces.toArray();
+        const interfaces = [...new Set(macs)].map((mac, i) => ({ mac, ip: ips[i] || null }));
 
         resources.push({
           kind: isTemplate ? 'template' : 'host',
@@ -372,12 +174,9 @@ module.exports = {
           metadata: {
             subType: isTemplate ? 'template' : 'lxc',
             vmid: lxc.vmid,
-            sourceId: `${node.node}/lxc/${lxc.vmid}`,
-            node: node.node,
             isProduction: lxc.status === 'running',
             interfaces,
-            macAddress: ifaces.primaryMac(),
-            ip: ifaces.primaryIp()
+            ip: ips[0] || null
           }
         });
         edges.push({ parentSlug: nodeSlug, childSlug: lxcSlug, relation: 'hosts' });
@@ -391,8 +190,5 @@ module.exports = {
   // `discover` as their implementation name for back-compat, and `run` is just
   // an alias. Referenced via module.exports (not `this`) so it survives being
   // detached and called as a bare function reference.
-  run: async (config) => module.exports.discover(config),
-
-  // Exported for unit tests only -- not part of the plugin contract.
-  _Interfaces: Interfaces
+  run: async (config) => module.exports.discover(config)
 };

nodejs/public/css/styles.css

@@ -3,12 +3,6 @@ nav.navbar{
 	padding-right: 1em;
 }
 
-/* Only the active top-nav link is bold + underlined; the username is plain. */
-.top-nav a.active{
-	font-weight: bold;
-	text-decoration: underline;
-}
-
 body {
 	display: flex;
 	flex-direction: column;

nodejs/routes/api_agent.js

@@ -1,394 +1,105 @@
 'use strict';
 
 const express = require('express');
-const middleware = require('../middleware/auth');
-const permission = require('../utils/permission');
 const agentManager = require('../utils/agent_manager');
-const agentKeys = require('../utils/agent_keys');
-const { Agent, AgentJoinKey } = require('../models/agent');
 
-const ADMIN_GROUPS = ['app_sso_admin', 'app_super_admin', 'app_sso_directory_admin'];
-
-// Commands that can change or run code on the host. They are signed with the
-// SSO's persisted Ed25519 key and the agent verifies against the key pinned in
-// its agent.yml.
-const HIGH_RISK_COMMANDS = ['reboot', 'service_restart', 'configure_ldap', 'arbitrary_bash', 'update_binary'];
-
-// ── REST API (mounted synchronously in app.js, BEFORE the 404 catch-all) ──
-// This is a plain Express Router exported directly so app.js can
-// `app.use('/api/agent', require('./routes/api_agent'))` at require time. It
-// must NOT be mounted from the onListen hook (which runs after the 404
-// catch-all is already on the stack): a router registered behind that terminal
-// handler would make every /api/agent/* request 404, no matter the WS server
-// state. The WebSocket handler is separate (initAgentWebSockets below) and is
-// the only part that needs the post-listen onListen hook.
-const router = express.Router();
-
-// Structured audit line for anything that reaches a host. The agent channel can
-// run arbitrary bash, so "who told which host to do what" has to be recoverable
-// after the fact; previously nothing was recorded at all.
-function logAgentAudit(action, details) {
-  console.log(JSON.stringify({
-    timestamp: new Date().toISOString(),
-    component: 'agent',
-    action,
-    ...details
-  }));
-}
-
-// The agent WebSocket (/api/agent/ws) authenticates its own token against the
-// Agent table (see initAgentWebSockets). These REST routes are admin-facing, so
-// they're auth + admin gated.
-router.use(middleware.auth);
-router.use(async (req, res, next) => {
-  try {
-    await permission.byGroup(req.user, ADMIN_GROUPS);
-    next();
-  } catch (err) {
-    if (err && (err.status === 401 || err.name === 'Insufficient Permission')) {
-      return res.status(403).json({ status: 'error', message: 'admin only' });
-    }
-    next(err);
+module.exports = function initAgentWebSockets(app) {
+  if (!app.wss) {
+    console.warn("WebSocket server for agents is not initialized.");
+    return;
   }
-});
 
-// --- Fleet ---
-router.get('/nodes', async (req, res, next) => {
-  try {
-    const keyStatus = agentKeys.status();
-    res.json({
-      status: 'ok',
-      agents: await agentManager.listAgents(),
-      // Base64 of the raw 32-byte key: what goes into agent.yml's `public_key`.
-      publicKey: await agentManager.publicKeyBase64(),
-      publicKeyPem: await agentManager.publicKeyPem(),
-      signingAvailable: agentKeys.status().available,
-      signingError: keyStatus.error || null
-    });
-  } catch (err) { next(err); }
-});
-
-// --- Enrollment ---
-// The token is minted HERE, not in the browser. It is returned exactly once;
-// only its hash is stored, so it cannot be recovered afterwards -- rotate to
-// get a new one.
-router.post('/enroll', async (req, res, next) => {
-  try {
-    const { name, resourceId, description } = req.body || {};
-    if (!name || !String(name).trim()) {
-      return res.status(400).json({ status: 'error', message: 'name is required' });
-    }
-
-    if (resourceId) {
-      const { Resource } = require('../models/resource');
-      const resource = await Resource.get(resourceId);
-      if (!resource) return res.status(400).json({ status: 'error', message: 'resourceId does not exist' });
-      if (resource.kind !== 'host') {
-        return res.status(400).json({ status: 'error', message: 'an agent can only be bound to a host resource' });
-      }
-    }
-
-    const { agent, token } = await Agent.enroll({
-      name: String(name).trim(),
-      description,
-      resourceId: resourceId || null,
-      enrolledBy: req.user.uid
-    });
-
-    logAgentAudit('enroll', { actor: req.user.uid, agentId: agent.id, agentName: agent.name, resourceId: resourceId || null });
-
-    const publicKey = await agentManager.publicKeyBase64();
-    res.json({
-      status: 'ok',
-      agent: agent.toPublic(agentManager.liveState(agent.id)),
-      // Shown once. The UI must make that clear.
-      token,
-      publicKey,
-      signingAvailable: agentKeys.status().available
-    });
-  } catch (err) { next(err); }
-});
-
-router.put('/nodes/:id', async (req, res, next) => {
-  try {
-    const agent = await Agent.get(req.params.id);
-    if (!agent) return res.status(404).json({ status: 'error', message: 'agent not found' });
-
-    const patch = {};
-    if (req.body.name !== undefined) patch.name = req.body.name;
-    if (req.body.description !== undefined) patch.description = req.body.description;
-    if (req.body.resourceId !== undefined) {
-      if (req.body.resourceId) {
-        const { Resource } = require('../models/resource');
-        const resource = await Resource.get(req.body.resourceId);
-        if (!resource) return res.status(400).json({ status: 'error', message: 'resourceId does not exist' });
-        if (resource.kind !== 'host') {
-          return res.status(400).json({ status: 'error', message: 'an agent can only be bound to a host resource' });
-        }
-      }
-      patch.resourceId = req.body.resourceId || null;
-    }
-
-    const updated = await agent.update(patch);
-    logAgentAudit('update', { actor: req.user.uid, agentId: agent.id, fields: Object.keys(patch) });
-    res.json({ status: 'ok', agent: updated.toPublic(agentManager.liveState(agent.id)) });
-  } catch (err) { next(err); }
-});
-
-// Revoke: the token stops authenticating immediately and any live socket is
-// dropped, so revocation takes effect without waiting for a reconnect.
-router.post('/nodes/:id/revoke', async (req, res, next) => {
-  try {
-    const agent = await Agent.get(req.params.id);
-    if (!agent) return res.status(404).json({ status: 'error', message: 'agent not found' });
-    await agent.update({ revoked: true });
-    agentManager.disconnect(agent.id, 4003, 'Enrollment revoked');
-    logAgentAudit('revoke', { actor: req.user.uid, agentId: agent.id, agentName: agent.name });
-    res.json({ status: 'ok' });
-  } catch (err) { next(err); }
-});
-
-router.post('/nodes/:id/rotate', async (req, res, next) => {
-  try {
-    const agent = await Agent.get(req.params.id);
-    if (!agent) return res.status(404).json({ status: 'error', message: 'agent not found' });
-    const token = await agent.rotateToken();
-    // The old token is dead the moment it is replaced; drop the socket that was
-    // using it so the agent reconnects with the new one.
-    agentManager.disconnect(agent.id, 4004, 'Token rotated');
-    logAgentAudit('rotate', { actor: req.user.uid, agentId: agent.id, agentName: agent.name });
-    res.json({ status: 'ok', token, publicKey: await agentManager.publicKeyBase64() });
-  } catch (err) { next(err); }
-});
-
-router.delete('/nodes/:id', async (req, res, next) => {
-  try {
-    const agent = await Agent.get(req.params.id);
-    if (!agent) return res.status(404).json({ status: 'error', message: 'agent not found' });
-    agentManager.disconnect(agent.id, 4003, 'Enrollment deleted');
-    await agent.delete();
-    logAgentAudit('delete', { actor: req.user.uid, agentId: agent.id, agentName: agent.name });
-    res.json({ status: 'ok' });
-  } catch (err) { next(err); }
-});
-
-// --- Join keys ---
-// One key an operator hands out; hosts that present it enroll themselves and
-// are immediately issued their own per-agent token. Listing never returns the
-// key itself -- only its prefix and usage.
-router.get('/join-keys', async (req, res, next) => {
-  try {
-    const keys = await AgentJoinKey.list();
-    res.json({ status: 'ok', joinKeys: keys.map(k => k.toPublic()) });
-  } catch (err) { next(err); }
-});
-
-router.post('/join-keys', async (req, res, next) => {
-  try {
-    const { label, expiresInDays } = req.body || {};
-    const { key, raw } = await AgentJoinKey.issue({
-      label: (label && String(label).trim()) || 'default',
-      createdBy: req.user.uid,
-      expiresInDays: expiresInDays ? Number(expiresInDays) : null
-    });
-    logAgentAudit('join_key_issued', { actor: req.user.uid, label: key.label, keyPrefix: key.keyPrefix });
-    // Shown once; only the hash is stored.
-    res.json({ status: 'ok', joinKey: key.toPublic(), key: raw });
-  } catch (err) { next(err); }
-});
-
-router.post('/join-keys/:id/revoke', async (req, res, next) => {
-  try {
-    const key = await AgentJoinKey.get(req.params.id);
-    if (!key) return res.status(404).json({ status: 'error', message: 'join key not found' });
-    await key.update({ revoked: true });
-    logAgentAudit('join_key_revoked', { actor: req.user.uid, label: key.label, keyPrefix: key.keyPrefix });
-    // Agents already enrolled keep working -- they hold their own tokens now,
-    // which is the whole point of exchanging the join key rather than using it
-    // as the long-term credential.
-    res.json({ status: 'ok' });
-  } catch (err) { next(err); }
-});
-
-router.delete('/join-keys/:id', async (req, res, next) => {
-  try {
-    const key = await AgentJoinKey.get(req.params.id);
-    if (!key) return res.status(404).json({ status: 'error', message: 'join key not found' });
-    await key.delete();
-    logAgentAudit('join_key_deleted', { actor: req.user.uid, label: key.label, keyPrefix: key.keyPrefix });
-    res.json({ status: 'ok' });
-  } catch (err) { next(err); }
-});
-
-// --- Commands ---
-// Addressed by agent id, not by token: a token is a credential and has no
-// business travelling in a URL, being logged, or sitting in browser history.
-router.post('/nodes/:id/command', async (req, res, next) => {
-  const { command, payload, isHighRisk } = req.body || {};
-  if (!command) {
-    return res.status(400).json({ status: 'error', message: 'Command type is required' });
-  }
-  try {
-    const agent = await Agent.get(req.params.id);
-    if (!agent) return res.status(404).json({ status: 'error', message: 'agent not found' });
-    if (agent.revoked) return res.status(403).json({ status: 'error', message: 'agent enrollment is revoked' });
-
-    const requiresSigning = isHighRisk || HIGH_RISK_COMMANDS.includes(command);
-    const msg = await agentManager.sendCommand(agent, command, payload || {}, requiresSigning);
-
-    logAgentAudit('command', {
-      actor: req.user.uid,
-      agentId: agent.id,
-      agentName: agent.name,
-      resourceId: agent.resourceId || null,
-      command,
-      signed: requiresSigning
-    });
-
-    res.json({ status: 'ok', sentMessage: msg });
-  } catch (err) {
-    logAgentAudit('command_failed', { actor: req.user && req.user.uid, agentId: req.params.id, command, error: err.message });
-    res.status(400).json({ status: 'error', message: err.message });
-  }
-});
-
-module.exports = router;
-module.exports.HIGH_RISK_COMMANDS = HIGH_RISK_COMMANDS;
-
-module.exports.initAgentWebSockets = function initAgentWebSockets(app) {
-  // WebSocket handler only needs the WS server; runs from the onListen hook.
-  if (!app.wss) return;
-
-  // Warm the signing key at boot so a misconfigured OpenBao policy is a loud
-  // startup error rather than a surprise the first time someone reboots a host.
-  agentKeys.load().then(keys => {
-    if (!keys) console.error(`[Theta Agent] signing key unavailable — high-risk commands will be refused. ${agentKeys.status().error || ''}`);
-  });
-
-  app.wss.on('connection', async (ws, req) => {
+  app.wss.on('connection', (ws, req) => {
     const url = new URL(req.url, `http://${req.headers.host || 'localhost'}`);
     const token = url.searchParams.get('token') || req.headers['authorization'];
+
+    if (!token) {
+      ws.close(4001, 'Unauthorized: Missing token');
+      return;
+    }
+
     const remoteAddr = req.socket.remoteAddress;
+    console.log(`[Theta Agent] Agent connected from ${remoteAddr} with token ${token.substring(0, 8)}...`);
 
-    // Authenticate BEFORE doing anything else: no registration, no welcome
-    // payload, no acknowledgement that the token was close. Until this passes
-    // the peer is an anonymous stranger, and the old code treated it as a
-    // trusted node purely for presenting a non-empty string.
-    let agent = null;
-    let issuedToken = null;   // set when this connection auto-enrolled
-    try {
-      agent = await Agent.authenticate(token);
+    agentManager.registerAgent(token, ws, remoteAddr);
 
-      // Not a known agent token -- try it as a join key. This is what makes
-      // "install the agent with a key and the host appears" work without an
-      // admin pre-registering every machine. The join key is exchanged for a
-      // per-agent token below, so it never becomes the host's long-term
-      // credential.
-      if (!agent) {
-        const joinKey = await AgentJoinKey.authenticate(token);
-        if (joinKey) {
-          const hostname = (url.searchParams.get('hostname') || '').trim();
-          const enrolled = await Agent.enroll({
-            name: hostname || `agent-${Date.now().toString(36)}`,
-            description: `Self-enrolled with join key ${joinKey.keyPrefix}`,
-            enrolledBy: `join-key:${joinKey.label}`
-          });
-          agent = enrolled.agent;
-          issuedToken = enrolled.token;
-          await joinKey.update({
-            use_count: (joinKey.use_count || 0) + 1,
-            last_used_on: Math.floor(Date.now() / 1000)
-          }).catch(() => {});
-          logAgentAudit('join', {
-            agentId: agent.id, agentName: agent.name, remoteAddr,
-            joinKeyLabel: joinKey.label, joinKeyPrefix: joinKey.keyPrefix
-          });
-          console.log(`[Theta Agent] "${agent.name}" self-enrolled with join key ${joinKey.keyPrefix}`);
-        }
-      }
-    } catch (err) {
-      console.error('[Theta Agent] authentication lookup failed:', err.message);
-      try { ws.close(1011, 'Authentication unavailable'); } catch (e) {}
-      return;
-    }
-
-    if (!agent) {
-      // Deliberately indistinguishable for unknown vs revoked vs missing: a
-      // caller probing tokens learns nothing about which part was wrong.
-      logAgentAudit('auth_rejected', { remoteAddr, tokenPrefix: token ? String(token).slice(0, 8) : null });
-      try { ws.close(4001, 'Unauthorized'); } catch (e) {}
-      return;
-    }
-
-    console.log(`[Theta Agent] "${agent.name}" (${agent.id}) connected from ${remoteAddr}`);
-    logAgentAudit('connected', { agentId: agent.id, agentName: agent.name, remoteAddr });
-    // Must stay synchronous, and the listeners below must be attached in this
-    // same tick: the agent sends `discovery` the instant the socket opens, and
-    // `ws` discards messages emitted while no listener is attached.
-    agentManager.registerAgent(agent, ws, remoteAddr);
-
-    ws.on('message', async (message) => {
+    ws.on('message', (message) => {
       try {
         const data = JSON.parse(message);
         if (!data || typeof data.type !== 'string') return;
 
-        // Re-read the row per message so a revoke mid-session takes effect on
-        // the next thing the agent says, not only on reconnect.
-        const current = await Agent.get(agent.id).catch(() => null);
-        if (!current || current.revoked) {
-          try { ws.close(4003, 'Enrollment revoked'); } catch (e) {}
-          return;
-        }
-
         const payload = data.payload || {};
 
         switch (data.type) {
           case 'discovery':
-            await agentManager.handleDiscovery(current, payload);
-            if (app.io) app.io.emit('agent.discovery', { agentId: current.id, payload });
+            agentManager.handleDiscovery(token, payload);
+            if (app.io) app.io.emit('agent.discovery', { token, payload });
             break;
           case 'telemetry':
-            await agentManager.handleTelemetry(current, payload);
-            if (app.io) app.io.emit('agent.telemetry', { agentId: current.id, payload });
+            agentManager.handleTelemetry(token, payload);
+            if (app.io) app.io.emit('agent.telemetry', { token, payload });
             break;
           case 'heartbeat':
-            await agentManager.handleHeartbeat(current, payload, ws);
+            agentManager.handleHeartbeat(token, payload, ws);
             break;
           case 'response':
-            await agentManager.handleResponse(current, payload);
-            if (app.io) app.io.emit('agent.response', { agentId: current.id, payload });
+            agentManager.handleResponse(token, payload);
+            if (app.io) app.io.emit('agent.response', { token, payload });
             break;
           default:
-            console.log(`[Theta Agent] Received message type '${data.type}' from ${current.id}`);
+            console.log(`[Theta Agent] Received message type '${data.type}' from ${token}`);
         }
       } catch (err) {
-        console.error('[Theta Agent] Error handling message:', err);
+        console.error("[Theta Agent] Error parsing message:", err);
       }
     });
 
     ws.on('close', () => {
-      console.log(`[Theta Agent] "${agent.name}" (${agent.id}) disconnected`);
-      agentManager.unregisterAgent(agent.id, ws);
+      console.log(`[Theta Agent] Agent disconnected (${token})`);
+      agentManager.unregisterAgent(token, ws);
     });
 
-    // Send initial welcome/config payload. When this connection enrolled via a
-    // join key it also carries the credentials the agent should persist and use
-    // from now on: its own token, and the public key it must pin to verify
-    // signed commands. Handing the public key over here is what removes the
-    // last manual step -- an agent installed with only a join key ends up fully
-    // configured without anyone copying values between two machines.
+    // Send initial welcome/config payload
     try {
-      const payload = {
-        message: 'Connected to SSO Manager C2',
-        protocol_version: '1.2.0',
-        agent_id: agent.id
-      };
-      if (issuedToken) {
-        payload.enrolled = true;
-        payload.auth_token = issuedToken;
-        payload.public_key = await agentManager.publicKeyBase64();
-      }
-      ws.send(JSON.stringify({ type: 'config', payload }));
+      ws.send(JSON.stringify({
+        type: 'config',
+        payload: {
+          message: 'Connected to SSO Manager C2',
+          protocol_version: '1.1.0'
+        }
+      }));
     } catch (e) {}
   });
+
+  // REST API routes for Agent Management (mounted under /api/agent)
+  const router = express.Router();
+
+  router.get('/nodes', (req, res) => {
+    res.json({
+      status: 'ok',
+      agents: agentManager.getConnectedAgents(),
+      publicKey: agentManager.publicKeyPem
+    });
+  });
+
+  router.post('/nodes/:token/command', (req, res) => {
+    const { token } = req.params;
+    const { command, payload, isHighRisk } = req.body;
+
+    if (!command) {
+      return res.status(400).json({ status: 'error', message: 'Command type is required' });
+    }
+
+    try {
+      const HIGH_RISK_COMMANDS = ['reboot', 'service_restart', 'configure_ldap', 'arbitrary_bash', 'update_binary'];
+      const requiresSigning = isHighRisk || HIGH_RISK_COMMANDS.includes(command);
+
+      const msg = agentManager.sendCommand(token, command, payload || {}, requiresSigning);
+      res.json({ status: 'ok', sentMessage: msg });
+    } catch (err) {
+      res.status(400).json({ status: 'error', message: err.message });
+    }
+  });
+
+  app.use('/api/agent', router);
 };

nodejs/routes/api_directory_admin.js

@@ -8,11 +8,10 @@ const { cnFromDn } = require('../utils/user_groups');
 const { projectResources } = require('@simpleworkjs/directory-schema');
 
 const SUPER_ADMIN_GROUP = permission.SUPER_ADMIN_GROUP;
-const groups = require('../utils/groups');
 
 // Make `childCn` a member of `parentCn`, i.e. everyone in the child is
 // transitively in the parent. Idempotent and non-fatal: "already a member" is
-// the goal state, and a missing group (e.g. god_admin absent on a
+// the goal state, and a missing group (e.g. app_super_admin absent on a
 // directory seeded by an older entrypoint) is a reason to skip, not to fail the
 // caller's real work.
 async function nestGroup(childCn, parentCn) {
@@ -30,160 +29,6 @@ async function nestGroup(childCn, parentCn) {
   }
 }
 
-// ── Group-model provisioning (docs/GROUPS.md) ───────────────────────────────
-// The directory is the single place groups are created, as a projection of the
-// resource graph. These helpers materialize the group-inheritance lattice for
-// a resource so it exists in LDAP as well as in the resolver (utils/groups.js).
-// All of them are idempotent, so calling them again for a resource a newer
-// release is backfilling is a no-op.
-
-// Map a directory resource kind onto a group-model kind (GROUPS.md §2).
-// host -> host; service -> app (services/consoles are the group model's "apps");
-// site gets site-level groups (handled separately); oauth/container get no
-// per-resource groups (oauth clients hang off their owning service).
-function groupKind(resource) {
-  if (resource.kind === 'host') return 'host';
-  if (resource.kind === 'service') return 'app';
-  return null;
-}
-
-// Create a groupOfNames if it doesn't already exist. Idempotent; `ownerDn`
-// seeds the mandatory first member. Returns true when created.
-async function ensureGroup(name, ownerDn, description) {
-  try {
-    await Group.add({ name, owner: ownerDn, description });
-    return true;
-  } catch (err) {
-    if (err.name !== 'EntryAlreadyExistsError' && err.code !== 68) {
-      console.error(`ensureGroup: failed to create ${name}:`, err);
-    }
-    return false;
-  }
-}
-
-// Link a group to a resource only if that link doesn't already exist. The
-// ResourceGroup table has no unique constraint on (resourceId, groupCn), so a
-// naive create on every Directory self-heal (which runs ensureSiteGroups /
-// provisionResourceGroups on each load) was accumulating duplicate links -- the
-// "groups appear 3x under a resource" bug. Always check first.
-async function ensureResourceGroup(resourceId, groupCn, accessLevel) {
-  const existing = await ResourceGroup.list({ where: { resourceId, groupCn } });
-  if (existing.length) return existing[0];
-  return ResourceGroup.create({ resourceId, groupCn, accessLevel });
-}
-
-// Provision the site-level groups + the aggregates the per-resource groups nest
-// into. Idempotent -- called on every directory list so a site seeded by an
-// older release gets its groups without a rebuild:
-//
-//   god_admin -> {site}_super_admin
-//   {site}_super_admin -> {site}_hosts_admin, {site}_apps_admin
-//   {site}_hosts_admin -> {site}_hosts_access ; {site}_apps_admin -> {site}_apps_access
-//
-// `{site}_everyone` is created for completeness; it has implicit membership and
-// is granted to a resource as a grantee, never enumerated.
-async function ensureSiteGroups(siteSlug, ownerDn, siteName, siteResourceId) {
-  if (!siteSlug) return;
-
-  // Link a site group to the site resource (so it shows + is member-manageable
-  // on the site's modal). Idempotent. Admin groups link as owner; access/meta
-  // groups as member.
-  const link = async (cn, isAdmin) => {
-    if (!siteResourceId) return;
-    await ensureResourceGroup(siteResourceId, cn, isAdmin ? 'owner' : 'member');
-  };
-
-  const sAdmin = groups.siteSuperAdminCns(siteSlug);
-  await ensureGroup(sAdmin, ownerDn, `Site admin for ${siteName || siteSlug}`);
-  await link(sAdmin, true);
-  // The kind-scoped aggregates are CREATED here (per-resource groups nest into
-  // them), but are NOT linked to the site resource: a site carries only the god
-  // and site-wide groups (S_super_admin, S_everyone), per the user's model. The
-  // aggregates have no modal home; site-wide access is granted via S_super_admin
-  // and per-resource access via the host/app groups.
-  for (const kind of ['host', 'app']) {
-    await ensureGroup(groups.aggregateGroupCns(siteSlug, kind, 'admin'), ownerDn, `Admin on all ${kind}s at ${siteSlug}`);
-    await ensureGroup(groups.aggregateGroupCns(siteSlug, kind, 'access'), ownerDn, `Access to all ${kind}s at ${siteSlug}`);
-  }
-  await ensureGroup(groups.siteEveryoneCns(siteSlug), ownerDn, `All users at ${siteSlug}`);
-  await link(groups.siteEveryoneCns(siteSlug), false);
-  // god_admin is the global group; surface it on the site modal so its members
-  // can be managed from the Directory (it has no home on a single resource).
-  await link(groups.GOD_ADMIN, true);
-
-  // Wire the lattice as nesting so LDAP-level consumers (SSSD, sudo, anything
-  // binding directly) resolve it transitively, not just utils/permission.js.
-  // nestGroup(child, parent) makes child a member of parent -- membership flows
-  // child -> parent ("up"), so a group's members inherit what its parents hold.
-  await nestGroup(groups.GOD_ADMIN, sAdmin); // god admins are site admins everywhere
-  for (const kind of ['host', 'app']) {
-    const aggAdmin = groups.aggregateGroupCns(siteSlug, kind, 'admin');
-    const aggAccess = groups.aggregateGroupCns(siteSlug, kind, 'access');
-    await nestGroup(sAdmin, aggAdmin);        // site admins administer all hosts/apps
-    await nestGroup(aggAdmin, aggAccess);     // site admin implies site access
-  }
-}
-
-// Provision the per-resource groups for a host/app and nest them into the site
-// aggregates (so a site/aggregate admin reaches this resource by membership).
-// Group names follow docs/GROUPS.md §2: `{site}_{kind}_{nameSlug}_{level}` where
-// nameSlug is the resource name with the kind prefix stripped (`host_theta-env` ->
-// `theta-env`). `kind` (host/app) both goes in the name and selects the aggregate:
-//
-//   {site}_{kind}_{slug}_admin  -> {site}_{kind}_{slug}_access
-//   {site}_{kind}_{slug}_admin  -> {site}_{kind}s_admin    (aggregate)
-//   {site}_{kind}_{slug}_access -> {site}_{kind}s_access   (aggregate)
-//   god_admin                   -> {site}_{kind}_{slug}_admin  (global super admin)
-async function provisionResourceGroups(resource, kind, siteSlug, ownerDn) {
-  const nameSlug = groups.resourceNameSlug(resource.slug);
-  const accessCn = groups.resourceGroupCns(siteSlug, kind, nameSlug, 'access');
-  const adminCn = groups.resourceGroupCns(siteSlug, kind, nameSlug, 'admin');
-
-  await ensureGroup(accessCn, ownerDn, `Access group for ${resource.name}`);
-  await ensureGroup(adminCn, ownerDn, `Admin group for ${resource.name}`);
-
-  // Link both groups to the resource so the Directory can show/revoke them.
-  await ensureResourceGroup(resource.id, accessCn, 'member');
-  await ensureResourceGroup(resource.id, adminCn, 'owner');
-
-  await nestGroup(adminCn, accessCn); // administering implies using
-  await nestGroup(adminCn, groups.aggregateGroupCns(siteSlug, kind, 'admin'));  // aggregate admin reaches this resource
-  await nestGroup(accessCn, groups.aggregateGroupCns(siteSlug, kind, 'access')); // aggregate access reaches this resource
-  await nestGroup(SUPER_ADMIN_GROUP, adminCn); // global super admin
-}
-
-// The group CNs it is valid to associate with a given resource (docs/GROUPS.md
-// §2/§3). This is what "force the correct naming convention" means: a group
-// linked to a resource must be one that parses for consumers -- the resource's
-// own specific groups, its site's aggregates, site-level groups, or the global
-// god_admin. Returns a Set of the fixed valid CNs plus a RegExp for opaque
-// capability groups following the same shapes.
-function validGroupCnsForResource(resource, siteSlug) {
-  const valid = new Set();
-  // A site resource only carries god_admin (added by the route) + the site-wide
-  // groups (S_super_admin, S_everyone). The kind-scoped host/app aggregates and
-  // specific groups belong to host/app resources, not to the site.
-  if (resource.kind === 'site') {
-    valid.add(groups.siteSuperAdminCns(siteSlug));
-    valid.add(groups.siteEveryoneCns(siteSlug));
-    return { valid, capRe: new RegExp(`^${siteSlug}_super_admin$|^${siteSlug}_everyone$`) };
-  }
-  const kind = groupKind(resource); // 'host'|'app'|null
-  if (kind) {
-    const nameSlug = groups.resourceNameSlug(resource.slug);
-    valid.add(groups.resourceGroupCns(siteSlug, kind, nameSlug, 'admin'));
-    valid.add(groups.resourceGroupCns(siteSlug, kind, nameSlug, 'access'));
-    valid.add(groups.aggregateGroupCns(siteSlug, kind, 'admin'));
-    valid.add(groups.aggregateGroupCns(siteSlug, kind, 'access'));
-    valid.add(groups.siteSuperAdminCns(siteSlug));
-    valid.add(groups.siteEveryoneCns(siteSlug));
-    return { valid, capRe: new RegExp(`^${siteSlug}_${kind}_${nameSlug}_[a-z0-9-]+$|^${siteSlug}_${kind}s_[a-z0-9-]+$`) };
-  }
-  // oauth/container etc. — only the global god_admin makes sense to pin here.
-  valid.add(groups.siteSuperAdminCns(siteSlug));
-  return { valid, capRe: null };
-}
-
 // Require the admin group
 router.use(async (req, res, next) => {
   try {
@@ -205,36 +50,6 @@ router.get('/resources', async (req, res, next) => {
     });
     // Even admins never receive secret metadata (e.g. client_secret_hash) over
     // the wire; projectResources strips it unconditionally.
-
-    // Self-heal the group model (docs/GROUPS.md): ensure every site has its
-    // site-level groups (S_super_admin, S_hosts_*, S_apps_*, S_everyone) + the
-    // aggregates, and every host/app resource has its per-resource groups nested
-    // into them. Idempotent, so this is a cheap no-op once present -- it's what
-    // backfills a directory seeded by an older release without a rebuild.
-    // Never fails the list.
-    const sites = resources.filter(r => r.kind === 'site');
-    await Promise.all(sites.map(site =>
-      ensureSiteGroups(site.slug, req.user.dn, site.name, site.id)
-        .catch(err => console.error(`ensureSiteGroups(${site.slug}) failed:`, err.message))
-    ));
-    const siteByResource = new Map();
-    for (const site of sites) siteByResource.set(site.id, site.slug);
-    const siteOf = async (r) => {
-      const direct = siteByResource.get(r.id);
-      if (direct) return direct;
-      // findAncestorSiteSlug returns the site's full slug (`site_local`) -- the
-      // group-model builders take it verbatim, so do NOT strip the `site_` prefix.
-      return await Resource.findAncestorSiteSlug(r.id).catch(() => null);
-    };
-    await Promise.all(resources.map(async (r) => {
-      const gKind = groupKind(r);
-      if (!gKind) return;
-      const siteSlug = await siteOf(r);
-      if (!siteSlug) return;
-      await provisionResourceGroups(r, gKind, siteSlug, req.user.dn)
-        .catch(err => console.error(`provisionResourceGroups(${r.slug}) failed:`, err.message));
-    }));
-
     res.json({ results: projectResources(resources, { fullMetadata: true }) });
   } catch (err) { next(err); }
 });
@@ -280,25 +95,46 @@ router.post('/resources', async (req, res, next) => {
       await ResourceEdge.create({ parentId: req.body.hostId, childId: r.id, relation: r.kind === 'oauth' ? 'oauth' : 'hosts' });
     }
 
-    // ── Group provisioning (docs/GROUPS.md) ───────────────────────────────
-    // Materialize the group-model for the new resource. Site resources get the
-    // site-level groups; host/app resources get their per-resource groups nested
-    // into the site aggregates. Idempotent -- safe for a resource created by an
-    // older release. A provisioning failure must not fail resource creation: the
-    // resource already exists and the groups are repairable (re-run ensures them).
-    //
-    // `siteSlug` is the site resource's slug verbatim (`site_local`) -- the
-    // group-model builders treat it as opaque (docs/GROUPS.md §3) and re-apply
-    // the kind prefix themselves.
-    const gKind = groupKind(r);
-    const ancestorSite = await Resource.findAncestorSiteSlug(r.id);
-    if (r.kind === 'site') {
-      await ensureSiteGroups(r.slug, req.user.dn, r.name, r.id);
-    } else if (gKind && ancestorSite) {
-      await ensureSiteGroups(ancestorSite, req.user.dn, r.name); // backfill site tier if missing
-      await provisionResourceGroups(r, gKind, ancestorSite, req.user.dn);
-    }
+    if (r.kind === 'host' || r.kind === 'service') {
+      const siteSlug = await Resource.findAncestorSiteSlug(r.id);
+      const groupCn = suffix => (siteSlug ? `${siteSlug}_${r.slug}_${suffix}` : `${r.slug}_${suffix}`);
 
+      const createGroup = async (suffix, accessLevel) => {
+        const cn = groupCn(suffix);
+        try {
+          await Group.add({
+            name: cn,
+            owner: req.user.dn,
+            description: `${suffix === 'admin' ? 'Admin' : 'Access'} group for ${r.name}`
+          });
+        } catch (err) {
+          if (err.name !== 'EntryAlreadyExistsError' && err.code !== 68) {
+            console.error(`Failed to create LDAP group ${cn}:`, err);
+          }
+        }
+        try {
+          await ResourceGroup.create({ resourceId: r.id, groupCn: cn, accessLevel });
+        } catch(err) { /* ignore duplicate links */ }
+      };
+      await createGroup('access', 'member');
+      await createGroup('admin', 'owner');
+
+      // Wire up the two standing relationships every resource has, as nesting
+      // rather than as membership that has to be maintained per resource:
+      //
+      //   app_super_admin -> <slug>_admin   cross-app super admins administer
+      //                                     every resource, automatically
+      //   <slug>_admin    -> <slug>_access  administering something implies
+      //                                     being able to use it
+      //
+      // Before nesting, both of these could only be expressed by adding every
+      // super admin to every new group by hand -- which nobody does, so the
+      // groups drifted. A failure here must not fail resource creation: the
+      // resource and its groups already exist and the nesting is repairable.
+      await nestGroup(groupCn('admin'), groupCn('access'));
+      await nestGroup(SUPER_ADMIN_GROUP, groupCn('admin'));
+    }
+    
     res.json({ results: r });
   } catch (err) {
     if (err.name === 'SequelizeUniqueConstraintError') {
@@ -429,29 +265,7 @@ router.get('/groups', async (req, res, next) => {
 
 router.post('/groups', async (req, res, next) => {
   try {
-    const { resourceId, groupCn } = req.body;
-    if (!resourceId || !groupCn) return res.status(400).json({ error: 'resourceId and groupCn are required' });
-
-    // Enforce the group-model naming convention (docs/GROUPS.md §3). The CN must
-    // be a valid group for this resource; reject free-form names so the groups
-    // consumers read are always parseable. god_admin is always allowed (it is
-    // the global group and is managed from a site's modal).
-    const resource = await Resource.get(resourceId);
-    // Full site slug verbatim (`site_local`) -- the builders take it as-is. A
-    // site resource's own slug is its site; a host/app uses its ancestor site.
-    const siteSlug = resource && resource.kind === 'site'
-      ? resource.slug
-      : await Resource.findAncestorSiteSlug(resourceId);
-    if (resource && siteSlug && groupCn !== groups.GOD_ADMIN) {
-      const { valid, capRe } = validGroupCnsForResource(resource, siteSlug);
-      if (!valid.has(groupCn) && !(capRe && capRe.test(groupCn))) {
-        const err = new Error(`"${groupCn}" is not a valid group for this ${resource.kind}. Use the resource's own groups, a site aggregate, a site-level group, or god_admin (e.g. ${[...valid].join(', ')}).`);
-        err.status = 400;
-        throw err;
-      }
-    }
-
-    const g = await ensureResourceGroup(req.body.resourceId, groupCn, req.body.accessLevel);
+    const g = await ResourceGroup.create(req.body);
     res.json({ results: g });
   } catch (err) { next(err); }
 });
@@ -499,7 +313,7 @@ router.get('/access-summary', async (req, res, next) => {
       //
       // Counts come from the transitive closure, not from `member`. Reading the
       // attribute would report only who is listed on the group, missing anyone
-      // who reaches it through a nested group -- and since god_admin is
+      // who reaches it through a nested group -- and since app_super_admin is
       // nested into every resource's _admin group, that is not an edge case.
       let members = [];
       if (group) {

nodejs/routes/api_shared_secrets.js

@@ -1,213 +0,0 @@
-'use strict';
-
-// Shared-secrets API.
-//
-// A shared secret is metadata in the DB (SharedSecret + SharedSecretGrant) with
-// its DATA in OpenBao at secret/shared/<ownerUid>/<slug> (KV-v2). The owner has
-// full R/W/list on their own secret/shared/<ownerUid>/* subtree; each grantee's
-// OpenBao policy content is edited to add read on the exact shared path (see
-// vault_broker.js grantSharedSecret/revokeSharedSecret). Enforcement is entirely
-// the OpenBao ACL — the broker's policy reconciliation makes a grant effective
-// immediately, with no token re-mint.
-//
-// Reads of the secret DATA are intentionally NOT proxied here: the UI fetches
-// them through the existing /api/vault proxy using the requester's own session
-// token, so OpenBao ACL enforces read access per-request. This router handles
-// metadata CRUD + grant management; KV writes (create/update/delete) are made
-// server-side using the acting user's scoped token.
-
-const express = require('express');
-const baoConf = require('@simpleworkjs/bao-conf');
-const permission = require('../utils/permission');
-const { SharedSecret } = require('../models/shared_secret');
-const { SharedSecretGrant } = require('../models/shared_secret_grant');
-const vaultBroker = require('../utils/vault_broker');
-
-const ADMIN_GROUPS = ['app_sso_admin', 'app_super_admin', 'app_sso_directory_admin'];
-// Allow hyphens AND underscores (matching the plugin-instance slug convention);
-// only reject values that can't be a sane secret path segment (spaces, slashes,
-// leading non-alnum, too long).
-const SLUG_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/;
-
-const router = express.Router();
-
-// Machine/service tokens cannot manage shared secrets (mirrors scopeGuard on the
-// /api/vault proxy — personal, per-user secret management only).
-router.use((req, res, next) => {
-	if (req.user && req.user.isMachine) {
-		return res.status(403).json({ error: 'machine tokens cannot manage shared secrets' });
-	}
-	next();
-});
-
-async function isAdmin(user) {
-	try { await permission.byGroup(user, ADMIN_GROUPS); return true; }
-	catch (e) { return false; }
-}
-
-// Scoped OpenBao token for an actor, used for server-side KV writes. Owner uses
-// their own token (R/W on secret/shared/<ownerUid>/*); an admin uses the
-// sso-admin token (R/W on secret/*).
-async function actorToken(user, ownerUid) {
-	if (user.uid === ownerUid) return vaultBroker.getOrCreateUserToken(ownerUid);
-	if (await isAdmin(user)) return vaultBroker.getOrCreateAdminToken(user.uid);
-	return null;
-}
-
-// Does this user manage the given shared secret? Owner or admin.
-async function canManage(user, secret) {
-	if (user.uid === secret.ownerUid) return true;
-	return isAdmin(user);
-}
-
-async function loadSecret(req, res) {
-	const secret = await SharedSecret.get(req.params.id);
-	if (!secret) { res.status(404).json({ error: 'not found' }); return null; }
-	return secret;
-}
-
-// ── List: mine + shared-with-me ─────────────────────────────────────────────
-router.get('/', async (req, res, next) => {
-	try {
-		const uid = req.user.uid;
-		const mine = await SharedSecret.list({ where: { ownerUid: uid } });
-		const grants = await SharedSecretGrant.listForGrantee('user', uid);
-		const granteeSecretIds = [...new Set(grants.map(g => g.secretId))];
-		const granted = granteeSecretIds.length
-			? await SharedSecret.list({ where: { id: { in: granteeSecretIds } } }) : [];
-		const byId = new Map(mine.map(s => [s.id, { role: 'owner', ...s }]));
-		for (const g of granted) {
-			if (byId.has(g.id)) continue; // already owner
-			byId.set(g.id, { role: 'grantee', ...g });
-		}
-		// The `{ role, ...s }` spread above copies only own properties, so the
-		// instance method `path()` is dropped -- call the static builder instead.
-		res.json({ items: [...byId.values()].map(s => ({ id: s.id, slug: s.slug, ownerUid: s.ownerUid, description: s.description, path: SharedSecret.pathFor(s.ownerUid, s.slug), role: s.role })) });
-	} catch (e) { next(e); }
-});
-
-// ── Create ──────────────────────────────────────────────────────────────────
-router.post('/', async (req, res, next) => {
-	try {
-		const uid = req.user.uid;
-		const slug = String(req.body.slug || '').trim().toLowerCase();
-		if (!SLUG_RE.test(slug)) return res.status(400).json({ error: 'slug must be lowercase letters/digits/hyphens/underscores, 1-64 chars' });
-		const description = String(req.body.description || '').trim();
-		const data = (req.body.data && typeof req.body.data === 'object') ? req.body.data : {};
-
-		if (await SharedSecret.getBySlug(slug)) {
-			return res.status(409).json({ error: `a shared secret named '${slug}' already exists` });
-		}
-		const token = await actorToken(req.user, uid);
-		if (!token) return res.status(403).json({ error: 'not allowed' });
-		const path = SharedSecret.pathFor(uid, slug);
-		await baoConf.set(path, data, { token });
-
-		const secret = await SharedSecret.create({
-			slug, ownerUid: uid, description,
-			created_by: uid, created_on: Date.now(), updated_by: uid, updated_on: Date.now(),
-		});
-		res.status(201).json({ id: secret.id, slug, ownerUid: uid, description, path, role: 'owner' });
-	} catch (e) { next(e); }
-});
-
-// ── Detail (metadata; data is read via /api/vault proxy) ────────────────────
-router.get('/:id', async (req, res, next) => {
-	try {
-		const secret = await loadSecret(req, res);
-		if (!secret) return;
-		const uid = req.user.uid;
-		const admin = await isAdmin(req.user);
-		const grantee = (await SharedSecretGrant.listForGrantee('user', uid)).some(g => g.secretId === secret.id);
-		if (!admin && uid !== secret.ownerUid && !grantee) return res.status(403).json({ error: 'not shared with you' });
-		const grants = await SharedSecretGrant.list({ where: { secretId: secret.id } });
-		res.json({ id: secret.id, slug: secret.slug, ownerUid: secret.ownerUid, description: secret.description, path: secret.path(), role: uid === secret.ownerUid ? 'owner' : (admin ? 'admin' : 'grantee'), grants: grants.map(g => ({ id: g.id, granteeType: g.granteeType, granteeId: g.granteeId, capability: g.capability })) });
-	} catch (e) { next(e); }
-});
-
-// ── Update data / description ───────────────────────────────────────────────
-router.put('/:id', async (req, res, next) => {
-	try {
-		const secret = await loadSecret(req, res);
-		if (!secret) return;
-		if (!(await canManage(req.user, secret))) return res.status(403).json({ error: 'only the owner (or admin) can edit a shared secret' });
-		const token = await actorToken(req.user, secret.ownerUid);
-		const update = {};
-		if (req.body && typeof req.body.data === 'object') {
-			await baoConf.set(secret.path(), req.body.data, { token });
-		}
-		if (req.body && req.body.description !== undefined) {
-			update.description = String(req.body.description).trim();
-		}
-		if (Object.keys(update).length) {
-			update.updated_by = req.user.uid;
-			update.updated_on = Date.now();
-			await secret.update(update);
-		}
-		res.json({ id: secret.id, slug: secret.slug, ownerUid: secret.ownerUid, description: secret.description, path: secret.path() });
-	} catch (e) { next(e); }
-});
-
-// ── Delete (KV + DB row + all grants) ───────────────────────────────────────
-router.delete('/:id', async (req, res, next) => {
-	try {
-		const secret = await loadSecret(req, res);
-		if (!secret) return;
-		if (!(await canManage(req.user, secret))) return res.status(403).json({ error: 'only the owner (or admin) can delete a shared secret' });
-		const token = await actorToken(req.user, secret.ownerUid);
-		// Revoke all grants first so grantees' policies drop the path.
-		const grants = await SharedSecretGrant.list({ where: { secretId: secret.id } });
-		for (const g of grants) await vaultBroker.revokeSharedSecret(g.id, req.user.uid);
-		// Delete the KV data (metadata delete removes all versions), then the row.
-		try { await baoConf.request('DELETE', `secret/metadata/${secret.path()}`, undefined, { token }); } catch (e) { /* best-effort */ }
-		await secret.delete();
-		res.status(204).end();
-	} catch (e) { next(e); }
-});
-
-// ── Grants: list ────────────────────────────────────────────────────────────
-router.get('/:id/grants', async (req, res, next) => {
-	try {
-		const secret = await loadSecret(req, res);
-		if (!secret) return;
-		if (!(await canManage(req.user, secret))) return res.status(403).json({ error: 'only the owner (or admin) can manage grants' });
-		const grants = await SharedSecretGrant.list({ where: { secretId: secret.id } });
-		res.json({ grants: grants.map(g => ({ id: g.id, granteeType: g.granteeType, granteeId: g.granteeId, capability: g.capability })) });
-	} catch (e) { next(e); }
-});
-
-// ── Grants: create ──────────────────────────────────────────────────────────
-router.post('/:id/grants', async (req, res, next) => {
-	try {
-		const secret = await loadSecret(req, res);
-		if (!secret) return;
-		if (!(await canManage(req.user, secret))) return res.status(403).json({ error: 'only the owner (or admin) can manage grants' });
-		const granteeType = String(req.body.granteeType || '').trim();
-		const granteeId = String(req.body.granteeId || '').trim();
-		if (!['user', 'app'].includes(granteeType)) return res.status(400).json({ error: 'granteeType must be user or app' });
-		if (!granteeId) return res.status(400).json({ error: 'granteeId is required' });
-		if (granteeId === secret.ownerUid && granteeType === 'user') {
-			return res.status(400).json({ error: 'the owner already has access' });
-		}
-		// Idempotent: skip if the grant already exists.
-		const existing = (await SharedSecretGrant.list({ where: { secretId: secret.id, granteeType, granteeId } }))[0];
-		if (existing) return res.json({ id: existing.id, granteeType, granteeId, capability: existing.capability });
-		const grant = await vaultBroker.grantSharedSecret(secret.id, granteeType, granteeId, req.user.uid);
-		res.status(201).json({ id: grant.id, granteeType, granteeId, capability: grant.capability });
-	} catch (e) { next(e); }
-});
-
-// ── Grants: revoke ──────────────────────────────────────────────────────────
-router.delete('/:id/grants/:grantId', async (req, res, next) => {
-	try {
-		const secret = await loadSecret(req, res);
-		if (!secret) return;
-		if (!(await canManage(req.user, secret))) return res.status(403).json({ error: 'only the owner (or admin) can manage grants' });
-		const grant = await SharedSecretGrant.get(req.params.grantId);
-		if (!grant || grant.secretId !== secret.id) return res.status(404).json({ error: 'grant not found' });
-		await vaultBroker.revokeSharedSecret(grant.id, req.user.uid);
-		res.status(204).end();
-	} catch (e) { next(e); }
-});
-
-module.exports = router;

nodejs/routes/discovery.js

@@ -186,11 +186,8 @@ router.post('/promote/:slug', async (req, res, next) => {
 		
 		const meta = resource.metadata || {};
 		meta.managed = true;
-		// `Resource.update` is not a static — `update` is an instance method
-		// (@simpleworkjs/orm). Load a fresh instance and call it on that.
-		const inst = await Resource.get(resource.id);
-		await inst.update({ metadata: meta });
-
+		await resource.update({ metadata: meta });
+		
 		res.json(envelope({ success: true, groups: [accessGroup, adminGroup] }));
 	} catch (err) { next(err); }
 });

nodejs/routes/docs.js

@@ -34,14 +34,9 @@ const DOCS = {
 	'oauth-apps':    {title: 'Connecting Apps (SSO)',   file: path.join(__dirname, '../../docs/concepts-oauth-apps.md')},
 	'api-tokens':    {title: 'API Tokens',              file: path.join(__dirname, '../../docs/concepts-api-tokens.md')},
 	directory:       {title: 'Directory & Inventory',   file: path.join(__dirname, '../../docs/directory.md')},
-	// `agents` pointed at plugins.md, so docs/agents.md -- the theta-agent
-	// guide the Directory links to -- was unreachable in the app.
-	agents:          {title: 'Theta Agent',            file: path.join(__dirname, '../../docs/agents.md')},
+	agents:          {title: 'Plugins',                file: path.join(__dirname, '../../docs/plugins.md')},
 	plugins:         {title: 'Plugins',                file: path.join(__dirname, '../../docs/plugins.md')},
-	// The Discovery tab's help icon links here; without an entry it 404'd.
-	discovery:       {title: 'Discovery & Inventory',  file: path.join(__dirname, '../../docs/discovery.md')},
 	vault:           {title: 'Vault Secrets',           file: path.join(__dirname, '../../docs/vault.md')},
-	groups:          {title: 'Groups & Permissions',   file: path.join(__dirname, '../../docs/groups.md')},
 
 	overview:        {title: 'Overview',        file: path.join(__dirname, '../../README.md')},
 	changelog:       {title: 'Changelog',       file: path.join(__dirname, '../../CHANGELOG.md')},
@@ -59,7 +54,7 @@ const docList = Object.entries(DOCS).map(([slug, d]) => ({slug, title: d.title})
 // only resolves correctly on GitHub. Serve that same folder here and rewrite
 // the rendered markup to point at it absolutely, so the images work when
 // read from /docs/overview too.
-router.use('/docs/images', require('express').static(path.join(__dirname, '../../docs/images')));
+router.use('/images', require('express').static(path.join(__dirname, '../../docs/images')));
 function fixImagePaths(html) {
 	return html.replace(/(["(])docs\/images\//g, '$1/docs/images/');
 }

nodejs/routes/index.js

@@ -84,7 +84,14 @@ router.get('/discovery', function(req, res, next) {
 });
 
 router.get('/plugins', function(req, res, next) {
-  res.redirect('/directory');
+  // Plugin instances page — loadable/unloadable, configurable plugin copies
+  // with per-instance secrets in OpenBao. Renders the shell for anyone; the
+  // client gates with app.auth.forceLogin(['app_sso_admin',
+  // 'app_sso_directory_admin','admin']) and the /api/plugins endpoints enforce
+  // the same server-side. Same header-vs-navigation auth model as /conf and
+  // /vault (auth-token is a client-set header, not a cookie).
+  const registry = require('../services/plugin_registry');
+  res.render('plugins', {...values, pluginTypes: registry.types });
 });
 
 router.get('/vault', function(req, res) {
@@ -188,6 +195,10 @@ router.get('/users/:uid', function(req, res, next) {
   res.render('profile', {...values});
 });
 
+router.get('/groups', function(req, res, next) {
+  res.render('groups', {...values});
+});
+
 router.get('/token', function(req, res, next) {
   res.render('token', {...values});
 });

nodejs/routes/user.js

@@ -90,13 +90,7 @@ router.get('/me', async function(req, res, next){
 		// same answer in both modes.
 		const groups = await groupCns(user);
 		user.groups = groups;
-		// Console admin under the group model (docs/GROUPS.md §11): god_admin,
-		// a site super admin, the SSO-as-app admin ({site}_app_sso_admin), or the
-		// legacy app_sso_admin/app_super_admin during migration.
-		user.isAdmin = groups.some((g) =>
-			g === 'app_sso_admin' || g === 'app_super_admin' ||
-			g === 'god_admin' || g === permission.SUPER_ADMIN_GROUP ||
-			g.endsWith('_super_admin') || g.endsWith('_app_sso_admin'));
+		user.isAdmin = groups.includes('app_sso_admin') || groups.includes(permission.SUPER_ADMIN_GROUP);
 
 		return res.json(user);
 	}catch(error){

nodejs/services/discovery_reconciler.js

@@ -2,87 +2,42 @@ const { Resource, ResourceEdge, ResourceGroup } = require('../models/resource');
 const { WebhookEmitter } = require('./webhook_emitter');
 const crypto = require('crypto');
 
-// Is `candidateId` at or below `rootId` in the edge graph? Used to refuse an
-// edge that would close a loop. Carries its own visited set so it terminates
-// even if the stored graph already contains a cycle from an older release.
-function isDescendant(candidateId, rootId, edges) {
-  const seen = new Set();
-  const stack = [rootId];
-  while (stack.length) {
-    const id = stack.pop();
-    if (id === candidateId) return true;
-    if (seen.has(id)) continue;
-    seen.add(id);
-    for (const e of edges) if (e.parentId === id) stack.push(e.childId);
-  }
-  return false;
-}
-
 class DiscoveryReconciler {
   static async reconcile(sourceName, payload) {
     const { resources = [], edges = [] } = payload;
     let newDevices = 0;
 
-    const normalizeMac = (m) => (m || '').toLowerCase().replace(/[^a-f0-9]/g, '');
-    const normalizeHost = (h) => (h || '').toLowerCase().split('.')[0].trim();
-
-    // Read the inventory ONCE, not once per incoming resource. A Proxmox
-    // cluster reports ~55 resources against an inventory of similar size, so
-    // the per-iteration Resource.list() was doing quadratic full-table reads
-    // every discovery run. Newly created rows are pushed onto this list as we
-    // go, so later resources in the same payload still match against them.
-    const allRes = await Resource.list();
-
     for (const res of resources) {
       if (!res.metadata) res.metadata = {};
       res._originalSlug = res.slug; // Keep track for edge mapping
-
+      
       let existing = null;
-
-      // A discovered device may only merge into a resource of the same kind
-      // (or into a placeholder from an earlier, kind-less discovery). Without
-      // this a VM called "gitea-runner" matches a hand-created *service* of
-      // the same name on rule 3 and silently overwrites it -- the discovered
-      // host's metadata lands on a service row, and the operator's entry is
-      // gone. `template` counts as `host`: a VM converted to a template is the
-      // same device, and it should update in place rather than fork a row.
-      const kindClass = (k) => (k === 'template' ? 'host' : k);
-      const incomingKind = kindClass(res.kind || 'unmanaged_device');
-      const kindCompatible = (r) => {
-        const k = kindClass(r.kind);
-        if (k === 'unmanaged_device' || incomingKind === 'unmanaged_device') return true;
-        return k === incomingKind;
-      };
-      const candidates = allRes.filter(kindCompatible);
-
-      // 1. Attempt matching by MAC (highest precision)
+      
+      // Attempt matching by MAC if available (case-insensitive)
       if (res.metadata.interfaces && res.metadata.interfaces.length > 0) {
-        const macs = res.metadata.interfaces.map(i => normalizeMac(i.mac)).filter(m => m.length === 12);
+        const macs = res.metadata.interfaces.map(i => i.mac ? i.mac.toLowerCase() : null).filter(m => !!m);
         if (macs.length > 0) {
-          existing = candidates.find(r =>
-            r.metadata && (
-              (r.metadata.macAddress && macs.includes(normalizeMac(r.metadata.macAddress))) ||
-              (r.metadata.interfaces && r.metadata.interfaces.some(i => macs.includes(normalizeMac(i.mac))))
-            )
+          const allRes = await Resource.list();
+          existing = allRes.find(r => 
+            r.metadata && r.metadata.interfaces && 
+            r.metadata.interfaces.some(i => i.mac && macs.includes(i.mac.toLowerCase()))
           );
         }
       }
-
-      // 2. Fallback matching by IP address
+      
+      // Fallback matching by IP if no MAC match (weaker)
       let ipsToMatch = [];
       if (res.metadata.interfaces) {
         ipsToMatch = res.metadata.interfaces.map(i => i.ip).filter(i => !!i);
       }
-      if (res.metadata.ip) ipsToMatch.push(res.metadata.ip);
       if (res.metadata.address) {
         res.metadata.address.split(',').forEach(a => ipsToMatch.push(a.trim()));
       }
-      ipsToMatch = [...new Set(ipsToMatch.filter(Boolean))];
-
+      
       if (!existing && ipsToMatch.length > 0) {
-        existing = candidates.find(r => {
+        const allRes = await Resource.list();
+        existing = allRes.find(r => {
           if (!r.metadata) return false;
-          if (r.metadata.ip && ipsToMatch.includes(r.metadata.ip)) return true;
           if (r.metadata.address) {
             const addrs = r.metadata.address.split(',').map(a => a.trim());
             if (addrs.some(a => ipsToMatch.includes(a))) return true;
@@ -91,17 +46,14 @@ class DiscoveryReconciler {
           return false;
         });
       }
-
-      // 3. Fallback matching by Slug, Name, or Base Hostname
+      
+      // Fallback matching by Slug or Name
       if (!existing && (res.slug || res.name)) {
-        const inputName = normalizeHost(res.name || res.slug);
-        existing = candidates.find(r => {
-          if (res.slug && r.slug === res.slug) return true;
-          if (res.name && r.name && r.name.toLowerCase() === res.name.toLowerCase()) return true;
-          if (inputName && r.name && normalizeHost(r.name) === inputName) return true;
-          if (inputName && r.slug && normalizeHost(r.slug) === inputName) return true;
-          return false;
-        });
+        const allRes = await Resource.list();
+        existing = allRes.find(r => 
+          (res.slug && r.slug === res.slug) || 
+          (res.name && r.name && r.name.toLowerCase() === res.name.toLowerCase())
+        );
       }
 
       if (existing) {
@@ -131,33 +83,10 @@ class DiscoveryReconciler {
         
         mergedMeta.last_seen = Date.now();
         
-        // Pick the most human name across sources. Rank first, length only as
-        // a tie-break within a rank -- comparing lengths alone let a UniFi
-        // client named after its MAC ("ac:16:2d:b3:da:80", 17 chars) beat the
-        // hypervisor's real hostname from Proxmox ("dl380-0", 7), so the
-        // Directory listed MAC addresses where host names belong.
-        //
-        // NB: `\\.` inside a regex LITERAL matches a backslash, not a dot, so
-        // the old isIp returned false for every input and IP-shaped names were
-        // never replaced either. It is `\.` here.
-        const isIp = (str) => /^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/.test(str || '');
-        const isMac = (str) => /^([0-9a-f]{2}[:-]){5}[0-9a-f]{2}$/i.test((str || '').trim());
-        // 2 = a real name, 1 = an IP (at least routable/recognizable), 0 = a
-        // MAC or nothing (pure machine identifier, the worst thing to show).
-        const nameRank = (str) => {
-          if (!str || !String(str).trim()) return 0;
-          if (isMac(str)) return 0;
-          if (isIp(str)) return 1;
-          return 2;
-        };
-
+        const isIp = (str) => /^(?:[0-9]{1,3}\\.){3}[0-9]{1,3}$/.test(str || '');
         let bestName = existing.name;
-        if (res.name) {
-          const incoming = nameRank(res.name);
-          const current = nameRank(bestName);
-          if (incoming > current || (incoming === current && res.name.length > (bestName || '').length)) {
-            bestName = res.name;
-          }
+        if (res.name && (!bestName || isIp(bestName) || res.name.length > bestName.length && !isIp(res.name))) {
+          bestName = res.name;
         }
 
         await existing.update({
@@ -186,17 +115,12 @@ class DiscoveryReconciler {
         
         newDevices++;
         res._actualId = created.id; // Map original slug to actual ID
-        // Make it visible to the rest of THIS payload: a Proxmox run reports
-        // the endpoint, then its nodes, then their guests, and two of them can
-        // legitimately share a MAC/IP. Without this the same device could be
-        // created twice in a single run.
-        allRes.push(created);
         WebhookEmitter.emit('discovery.new_device', created.toJSON());
       }
     }
     
-    // Now process edges. `allRes` above is already current -- rows created in
-    // the loop were pushed onto it -- so no second full read is needed.
+    // Now process edges
+    const allRes = await Resource.list();
     const existingEdges = await ResourceEdge.list();
     
     for (const edge of edges) {
@@ -220,37 +144,15 @@ class DiscoveryReconciler {
         if (childResInDb) childId = childResInDb.id;
       }
       
-      // Two slugs in one payload can resolve to the SAME resource once the
-      // matcher has merged them -- a Proxmox endpoint reached at the address
-      // of the node that answers for it is the case that produced this. The
-      // edge would then make a resource its own parent, which renders as an
-      // infinitely nested tree and defeats every ancestor walk in the app
-      // (findAncestorSiteSlug, withResolvedAddress) that relies on a cycle
-      // guard to terminate rather than to be correct.
-      if (parentId && childId && parentId === childId) {
-        console.warn(`[DiscoveryReconciler] ${sourceName}: dropping self-edge on ${edge.parentSlug} -> ${edge.childSlug} (both resolved to the same resource)`);
-        continue;
-      }
-
-      // Likewise refuse an edge that closes a loop: if the proposed parent is
-      // already a descendant of the proposed child, adding this makes a cycle.
-      if (parentId && childId && isDescendant(parentId, childId, existingEdges)) {
-        console.warn(`[DiscoveryReconciler] ${sourceName}: dropping ${edge.parentSlug} -> ${edge.childSlug} (would create a cycle)`);
-        continue;
-      }
-
       if (parentId && childId) {
         const edgeExists = existingEdges.find(e => e.parentId === parentId && e.childId === childId && e.relation === edge.relation);
         if (!edgeExists) {
-          const created = await ResourceEdge.create({
+          await ResourceEdge.create({
             id: crypto.randomUUID(),
             parentId,
             childId,
             relation: edge.relation
           });
-          // Keep the in-memory edge list current so the cycle check above sees
-          // edges added earlier in this same payload.
-          existingEdges.push(created);
         }
       }
     }

nodejs/tests/access_request.test.js

@@ -44,10 +44,9 @@ beforeAll(async () => {
 	expect(host.status).toBe(200);
 	hostId = host.body.results.id;
 
-	// Creating a host auto-provisions <site>_host_<slug>_access / _admin
-	// (docs/GROUPS.md §2 — the kind is part of the name).
-	accessGroupCn = `${siteSlug}_host_${hostSlug}_access`;
-	const adminGroupCn = `${siteSlug}_host_${hostSlug}_admin`;
+	// Creating a host auto-provisions <site>_<slug>_access / _admin.
+	accessGroupCn = `${siteSlug}_${hostSlug}_access`;
+	const adminGroupCn = `${siteSlug}_${hostSlug}_admin`;
 
 	// The creator is seeded into both groups -- groupOfNames requires at least
 	// one member, so Group.add puts the owner's DN there -- and _admin is nested
@@ -214,9 +213,8 @@ describe('Access requests — withdrawal', () => {
 		expect(host.status).toBe(200);
 
 		// Same as the top-level setup: step out of the auto-created groups the
-		// creator is seeded into (docs/GROUPS.md §2 — kind is part of the name),
-		// or this is a request for access already held.
-		for (const cn of [`${siteSlug}_host_${slug}_admin`, `${siteSlug}_host_${slug}_access`]) {
+		// creator is seeded into, or this is a request for access already held.
+		for (const cn of [`${siteSlug}_${slug}_admin`, `${siteSlug}_${slug}_access`]) {
 			await request(app)
 				.delete(`/api/group/${encodeURIComponent(cn)}/test`)
 				.set('auth-token', token);

nodejs/tests/agent_manager.test.js

@@ -1,45 +1,11 @@
 'use strict';
 
 const crypto = require('crypto');
-
-// In-memory stand-in for OpenBao. The signing key lives at secret/agent/
-// signing-key in production; here we only need it to persist across calls so
-// the "same key every time" property is actually exercised rather than mocked
-// away.
-const mockBaoStore = new Map();
-jest.mock('@simpleworkjs/bao-conf', () => ({
-  get: jest.fn(async (path) => mockBaoStore.get(path) || null),
-  set: jest.fn(async (path, value) => { mockBaoStore.set(path, value); }),
-  request: jest.fn(async () => ({ ok: true, status: 200 }))
-}));
-
 const agentManager = require('../utils/agent_manager');
-const agentKeys = require('../utils/agent_keys');
 
-// The manager is now keyed by enrolled Agent rows rather than by a bare token
-// string, so these use a stub row with the same surface the real model gives:
-// an id, and an update() that records what would be persisted.
-function stubAgent(overrides = {}) {
-  const row = {
-    id: overrides.id || crypto.randomUUID(),
-    name: overrides.name || 'test-agent',
-    resourceId: overrides.resourceId || null,
-    revoked: false,
-    persisted: {},
-    ...overrides
-  };
-  row.update = jest.fn(async (patch) => {
-    Object.assign(row.persisted, patch);
-    Object.assign(row, patch);
-    return row;
-  });
-  return row;
-}
-
-describe('AgentManager PROTOCOL.md v1.2.0 Compliance', () => {
+describe('AgentManager PROTOCOL.md v1.1.0 Compliance', () => {
   let mockWs;
   let sentMessages;
-  let agent;
 
   beforeEach(() => {
     sentMessages = [];
@@ -48,30 +14,23 @@ describe('AgentManager PROTOCOL.md v1.2.0 Compliance', () => {
       send: jest.fn((msg) => sentMessages.push(JSON.parse(msg))),
       close: jest.fn()
     };
-    agent = stubAgent();
   });
 
-  test('registers an agent and reports it as connected', () => {
-    agentManager.registerAgent(agent, mockWs, '192.168.1.100');
-    const state = agentManager.liveState(agent.id);
-    expect(state.connected).toBe(true);
-    expect(state.ipAddress).toBe('192.168.1.100');
-    expect(agentManager.isConnected(agent.id)).toBe(true);
+  test('registers agent and tracks initial connection state', () => {
+    const record = agentManager.registerAgent('test-token-123', mockWs, '192.168.1.100');
+    expect(record.token).toBe('test-token-123');
+    expect(record.ipAddress).toBe('192.168.1.100');
+
+    const agents = agentManager.getConnectedAgents();
+    const found = agents.find(a => a.token === 'test-token-123');
+    expect(found).toBeDefined();
+    expect(found.isOnline).toBe(true);
   });
 
-  // registerAgent must not be async: the WS `message` listener is attached in
-  // the same tick, and `ws` drops events emitted before a listener exists. An
-  // awaited DB write here swallowed every agent's first discovery frame, which
-  // is the one it sends immediately on connect.
-  test('registerAgent is synchronous so no message can be missed', () => {
-    const result = agentManager.registerAgent(agent, mockWs, '10.0.0.1');
-    expect(result).toBeUndefined();
-    expect(agentManager.isConnected(agent.id)).toBe(true);
-  });
+  test('processes discovery payload per PROTOCOL.md v1.1.0 Section 3.1', () => {
+    agentManager.registerAgent('test-token-123', mockWs, '192.168.1.100');
 
-  test('persists discovery to the agent row (Section 3.1)', async () => {
-    agentManager.registerAgent(agent, mockWs, '192.168.1.100');
-    await agentManager.handleDiscovery(agent, {
+    const discoveryPayload = {
       hostname: 'node-01.local',
       ip_addresses: ['192.168.1.100', '10.0.0.5'],
       os: 'Ubuntu 24.04 LTS',
@@ -80,34 +39,41 @@ describe('AgentManager PROTOCOL.md v1.2.0 Compliance', () => {
       ram_total_gb: 32.0,
       disk_total_gb: 500.0,
       location: 'dc-chicago-rack-4'
-    });
+    };
 
-    const saved = agent.persisted.lastDiscovery;
-    expect(saved.hostname).toBe('node-01.local');
-    expect(saved.os).toBe('Ubuntu 24.04 LTS');
-    expect(saved.ip_addresses).toEqual(['192.168.1.100', '10.0.0.5']);
-    // Durable, not just in memory: an agent that goes offline keeps its facts.
-    expect(agent.persisted.last_seen).toEqual(expect.any(Number));
+    agentManager.handleDiscovery('test-token-123', discoveryPayload);
+
+    const agents = agentManager.getConnectedAgents();
+    const agent = agents.find(a => a.token === 'test-token-123');
+    expect(agent.hostname).toBe('node-01.local');
+    expect(agent.discovery.os).toBe('Ubuntu 24.04 LTS');
+    expect(agent.discovery.ip_addresses).toEqual(['192.168.1.100', '10.0.0.5']);
   });
 
-  test('persists telemetry to the agent row (Section 3.2)', async () => {
-    agentManager.registerAgent(agent, mockWs, '192.168.1.100');
-    await agentManager.handleTelemetry(agent, {
+  test('processes telemetry payload per PROTOCOL.md v1.1.0 Section 3.2', () => {
+    agentManager.registerAgent('test-token-123', mockWs, '192.168.1.100');
+
+    const telemetryPayload = {
       cpu_usage_percent: 14.5,
       ram_usage_percent: 42.1,
       disk_usage_percent: 68.0,
       zfs_health: 'ONLINE',
       gpu_usage_percent: -1.0,
       timestamp: new Date().toISOString()
-    });
+    };
 
-    expect(agent.persisted.lastTelemetry.cpu_usage_percent).toBe(14.5);
-    expect(agent.persisted.lastTelemetry.zfs_health).toBe('ONLINE');
+    agentManager.handleTelemetry('test-token-123', telemetryPayload);
+
+    const agents = agentManager.getConnectedAgents();
+    const agent = agents.find(a => a.token === 'test-token-123');
+    expect(agent.telemetry.cpu_usage_percent).toBe(14.5);
+    expect(agent.telemetry.zfs_health).toBe('ONLINE');
   });
 
-  test('responds to heartbeat with heartbeat_ack (Section 3.3)', async () => {
-    agentManager.registerAgent(agent, mockWs, '192.168.1.100');
-    await agentManager.handleHeartbeat(agent, { timestamp: new Date().toISOString() }, mockWs);
+  test('responds to heartbeat with heartbeat_ack per Section 3.3', () => {
+    agentManager.registerAgent('test-token-123', mockWs, '192.168.1.100');
+
+    agentManager.handleHeartbeat('test-token-123', { timestamp: new Date().toISOString() }, mockWs);
 
     expect(mockWs.send).toHaveBeenCalled();
     const lastMsg = sentMessages[sentMessages.length - 1];
@@ -115,92 +81,20 @@ describe('AgentManager PROTOCOL.md v1.2.0 Compliance', () => {
     expect(lastMsg.payload.timestamp).toBeDefined();
   });
 
-  test('canonicalizes and signs high-risk commands with Ed25519 (Section 5)', async () => {
-    agentManager.registerAgent(agent, mockWs, '192.168.1.100');
+  test('canonicalizes payload and signs high-risk commands using Ed25519 per Section 5', () => {
+    agentManager.registerAgent('test-token-123', mockWs, '192.168.1.100');
 
     const rawPayload = { script: 'uptime', location: 'datacenter' };
-    const msg = await agentManager.sendCommand(agent, 'arbitrary_bash', rawPayload, true);
+    const msg = agentManager.sendCommand('test-token-123', 'arbitrary_bash', rawPayload, true);
 
     expect(msg.type).toBe('arbitrary_bash');
+    expect(msg.payload.signature).toBeDefined();
     expect(typeof msg.payload.signature).toBe('string');
 
-    const keys = await agentKeys.load();
-    const isValid = crypto.verify(
-      null,
-      Buffer.from(agentManager.canonicalize(rawPayload), 'utf8'),
-      crypto.createPublicKey(keys.publicKeyPem),
-      Buffer.from(msg.payload.signature, 'base64')
-    );
+    // Verify signature with public key
+    const signatureBuffer = Buffer.from(msg.payload.signature, 'base64');
+    const canonicalStr = agentManager.canonicalize(rawPayload);
+    const isValid = crypto.verify(null, Buffer.from(canonicalStr, 'utf8'), agentManager.publicKeyPem, signatureBuffer);
     expect(isValid).toBe(true);
   });
-
-  // The canonical form has to match the Go agent's byte for byte. Go's
-  // encoding/json escapes <, > and & by default and JSON.stringify does not, so
-  // the agent uses SetEscapeHTML(false); this pins the server's half of that
-  // contract. See theta-agent TestCanonicalizeMatchesServerForm.
-  test('canonical form is sorted, unescaped, and omits the signature', () => {
-    const canonical = agentManager.canonicalize({
-      script: 'echo a > b && c',
-      comment: 'x&y',
-      signature: 'should-not-appear'
-    });
-    expect(canonical).toBe('{"comment":"x&y","script":"echo a > b && c"}');
-  });
-
-  test('refuses to send to an agent that is not connected', async () => {
-    await expect(agentManager.sendCommand(agent, 'reload_config', {}, false))
-      .rejects.toThrow(/not connected/);
-  });
-
-  // Revocation that only applies on the next reconnect is not revocation.
-  test('disconnect drops the live socket immediately', () => {
-    agentManager.registerAgent(agent, mockWs, '192.168.1.100');
-    expect(agentManager.isConnected(agent.id)).toBe(true);
-
-    const dropped = agentManager.disconnect(agent.id, 4003, 'Enrollment revoked');
-    expect(dropped).toBe(true);
-    expect(mockWs.close).toHaveBeenCalledWith(4003, 'Enrollment revoked');
-    expect(agentManager.isConnected(agent.id)).toBe(false);
-  });
-
-  test('a second connection for the same agent supersedes the first', () => {
-    agentManager.registerAgent(agent, mockWs, '192.168.1.100');
-    const secondWs = { readyState: 1, send: jest.fn(), close: jest.fn() };
-    agentManager.registerAgent(agent, secondWs, '192.168.1.101');
-
-    expect(mockWs.close).toHaveBeenCalledWith(4002, 'Superseded by new connection');
-    expect(agentManager.liveState(agent.id).ipAddress).toBe('192.168.1.101');
-  });
-
-  test('an unknown agent id is simply not connected', () => {
-    expect(agentManager.isConnected('no-such-agent')).toBe(false);
-    expect(agentManager.liveState('no-such-agent')).toEqual({ connected: false, lastResponse: null });
-  });
-});
-
-describe('agent signing key', () => {
-  // The old manager generated a key pair in its constructor, so it changed on
-  // every restart and the public_key pinned in agent.yml stopped matching.
-  test('the same key is returned across repeated loads', async () => {
-    const first = await agentKeys.load();
-    const second = await agentKeys.load();
-    expect(first.publicKeyBase64).toBe(second.publicKeyBase64);
-  });
-
-  test('the exported public key is the raw 32 bytes agents pin', async () => {
-    const keys = await agentKeys.load();
-    expect(Buffer.from(keys.publicKeyBase64, 'base64')).toHaveLength(32);
-  });
-
-  test('rawPublicKeyBase64 strips the SPKI wrapper', () => {
-    const { publicKey } = crypto.generateKeyPairSync('ed25519', {
-      privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
-      publicKeyEncoding: { type: 'spki', format: 'pem' }
-    });
-    const raw = Buffer.from(agentKeys.rawPublicKeyBase64(publicKey), 'base64');
-    expect(raw).toHaveLength(32);
-    // and it is the tail of the DER encoding
-    const der = crypto.createPublicKey(publicKey).export({ type: 'spki', format: 'der' });
-    expect(raw.equals(der.subarray(der.length - 32))).toBe(true);
-  });
 });

nodejs/tests/discovery_naming.test.js

@@ -1,104 +0,0 @@
-'use strict';
-
-// Pure-logic coverage for the two reconciler rules that real Proxmox + UniFi
-// data broke. Both were found by running discovery against a live cluster:
-// the directory came back listing MAC addresses as host names, and one
-// resource ended up as its own parent.
-
-// Mirrors the ranking in services/discovery_reconciler.js. Kept here (rather
-// than exported) because it is a few lines of predicate that the reconciler
-// applies inline while merging; if it grows, export it and drop this copy.
-const isIp = (str) => /^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/.test(str || '');
-const isMac = (str) => /^([0-9a-f]{2}[:-]){5}[0-9a-f]{2}$/i.test((str || '').trim());
-const nameRank = (str) => {
-	if (!str || !String(str).trim()) return 0;
-	if (isMac(str)) return 0;
-	if (isIp(str)) return 1;
-	return 2;
-};
-function bestNameOf(existingName, incomingName) {
-	let best = existingName;
-	if (incomingName) {
-		const a = nameRank(incomingName);
-		const b = nameRank(best);
-		if (a > b || (a === b && incomingName.length > (best || '').length)) best = incomingName;
-	}
-	return best;
-}
-
-describe('discovery name ranking', () => {
-	test('a real hostname beats a MAC even when shorter', () => {
-		// The exact regression: UniFi named the host by MAC, Proxmox knew the
-		// hostname, and length-only comparison kept the MAC.
-		expect(bestNameOf('ac:16:2d:b3:da:80', 'dl380-0')).toBe('dl380-0');
-	});
-
-	test('a MAC never displaces a real hostname', () => {
-		expect(bestNameOf('dl380-0', 'ac:16:2d:b3:da:80')).toBe('dl380-0');
-	});
-
-	test('a real hostname beats an IP-shaped name', () => {
-		expect(bestNameOf('192.168.1.27', 'hass.io')).toBe('hass.io');
-	});
-
-	test('an IP beats a MAC', () => {
-		expect(bestNameOf('bc:24:11:3f:cd:c8', '192.168.1.27')).toBe('192.168.1.27');
-	});
-
-	test('an IP does not displace a hostname', () => {
-		expect(bestNameOf('gitea-runner', '192.168.1.176')).toBe('gitea-runner');
-	});
-
-	test('within the same rank the longer/more specific name wins', () => {
-		expect(bestNameOf('pve', 'pve-dl380-1')).toBe('pve-dl380-1');
-	});
-
-	test('dash-separated MACs are recognized too', () => {
-		expect(bestNameOf('ac-16-2d-b3-da-80', 'dl380-0')).toBe('dl380-0');
-	});
-
-	test('an empty existing name is always replaced', () => {
-		expect(bestNameOf('', 'anything')).toBe('anything');
-		expect(bestNameOf(null, 'ac:16:2d:b3:da:80')).toBe('ac:16:2d:b3:da:80');
-	});
-});
-
-// Mirrors isDescendant() in the reconciler.
-function isDescendant(candidateId, rootId, edges) {
-	const seen = new Set();
-	const stack = [rootId];
-	while (stack.length) {
-		const id = stack.pop();
-		if (id === candidateId) return true;
-		if (seen.has(id)) continue;
-		seen.add(id);
-		for (const e of edges) if (e.parentId === id) stack.push(e.childId);
-	}
-	return false;
-}
-
-describe('discovery edge cycle guard', () => {
-	const edges = [
-		{ parentId: 'cluster', childId: 'node1' },
-		{ parentId: 'node1', childId: 'vm1' },
-	];
-
-	test('detects a direct parent/child inversion', () => {
-		// Proposing node1 -> cluster when cluster -> node1 already exists.
-		expect(isDescendant('node1', 'cluster', edges)).toBe(true);
-	});
-
-	test('detects a deeper loop', () => {
-		expect(isDescendant('vm1', 'cluster', edges)).toBe(true);
-	});
-
-	test('allows an unrelated new parent', () => {
-		expect(isDescendant('node2', 'cluster', edges)).toBe(false);
-	});
-
-	test('terminates on a graph that already contains a cycle', () => {
-		// A self-edge written by an earlier release must not hang the walk.
-		const cyclic = [{ parentId: 'a', childId: 'a' }, { parentId: 'a', childId: 'b' }];
-		expect(isDescendant('zzz', 'a', cyclic)).toBe(false);
-	});
-});

nodejs/tests/groups.test.js

@@ -1,130 +0,0 @@
-'use strict';
-
-const {
-	slugify,
-	resourceGroupCns,
-	aggregateGroupCns,
-	siteSuperAdminCns,
-	siteEveryoneCns,
-	isKnownLevel,
-	levelGrants,
-	hasPermission,
-	GOD_ADMIN,
-} = require('../utils/groups');
-
-// Resource fixtures mirror the directory: hosts carry a `host_` prefix, services
-// are stored bare. The builders take the *name* slug (kind stripped) + a kind, so
-// a host `host_web-01` gives `main-office_host_web-01_*` and a service `emby`
-// gives `main-office_app_emby_*` -- matching docs/GROUPS.md §2.
-const HOST = { site: 'main-office', kind: 'host', slug: 'host_web-01' };
-const APP = { site: 'main-office', kind: 'app', slug: 'emby' };
-const SERVICE = { site: 'main-office', kind: 'service', slug: 'emby' };
-const OTHER_SITE_HOST = { site: 'branch-office', kind: 'host', slug: 'host_db' };
-
-describe('slugify', () => {
-	test('lowercases, spaces and underscores become hyphens, no leading/trailing dash', () => {
-		expect(slugify('Web 01')).toBe('web-01');
-		expect(slugify('Main Office')).toBe('main-office');
-		expect(slugify('my_host')).toBe('my-host');
-		expect(slugify('  Mixed CASE--name  ')).toBe('mixed-case-name');
-		expect(slugify('')).toBe('');
-	});
-});
-
-describe('group cn builders', () => {
-	test('per-resource names the kind + name slug (docs §2)', () => {
-		expect(resourceGroupCns('main-office', 'host', 'web-01', 'admin')).toBe('main-office_host_web-01_admin');
-		expect(resourceGroupCns('main-office', 'app', 'emby', 'access')).toBe('main-office_app_emby_access');
-	});
-	test('a prefixed site slug is kept verbatim; the resource name slug is kind-stripped', () => {
-		expect(resourceGroupCns('site_local', 'host', 'theta-env', 'access')).toBe('site_local_host_theta-env_access');
-		expect(resourceGroupCns('site_local', 'app', 'sso-manager', 'access')).toBe('site_local_app_sso-manager_access');
-	});
-	test('aggregate uses the plural kind', () => {
-		expect(aggregateGroupCns('main-office', 'host', 'admin')).toBe('main-office_hosts_admin');
-		expect(aggregateGroupCns('main-office', 'app', 'access')).toBe('main-office_apps_access');
-	});
-	test('site super admin + everyone', () => {
-		expect(siteSuperAdminCns('main-office')).toBe('main-office_super_admin');
-		expect(siteEveryoneCns('main-office')).toBe('main-office_everyone');
-	});
-	test('a directory site slug with a kind prefix is kept verbatim', () => {
-		expect(siteSuperAdminCns('site_local')).toBe('site_local_super_admin');
-		expect(siteEveryoneCns('site_local')).toBe('site_local_everyone');
-		expect(aggregateGroupCns('site_local', 'host', 'admin')).toBe('site_local_hosts_admin');
-	});
-	test('invalid kind throws', () => {
-		expect(() => resourceGroupCns('s', 'service', 'x', 'admin')).toThrow();
-		expect(() => aggregateGroupCns('s', 'service', 'admin')).toThrow();
-	});
-});
-
-describe('levels', () => {
-	test('admin/access known; capabilities opaque', () => {
-		expect(isKnownLevel('admin')).toBe(true);
-		expect(isKnownLevel('access')).toBe(true);
-		expect(isKnownLevel('reboot')).toBe(false);
-		expect(isKnownLevel('emby_admin')).toBe(false);
-	});
-	test('admin implies access; access does not imply admin', () => {
-		expect(levelGrants('admin', 'access')).toBe(true);
-		expect(levelGrants('access', 'admin')).toBe(false);
-	});
-});
-
-describe('hasPermission — inheritance', () => {
-	test('god_admin grants everything everywhere', () => {
-		expect(hasPermission([GOD_ADMIN], HOST, 'admin')).toBe(true);
-		expect(hasPermission([GOD_ADMIN], HOST, 'access')).toBe(true);
-		expect(hasPermission([GOD_ADMIN], HOST, 'reboot')).toBe(true);
-		expect(hasPermission([GOD_ADMIN], OTHER_SITE_HOST, 'admin')).toBe(true);
-	});
-
-	test('site super admin grants everything on its site, not other sites', () => {
-		expect(hasPermission(['main-office_super_admin'], HOST, 'admin')).toBe(true);
-		expect(hasPermission(['main-office_super_admin'], HOST, 'reboot')).toBe(true);
-		expect(hasPermission(['main-office_super_admin'], OTHER_SITE_HOST, 'admin')).toBe(false);
-	});
-
-	test('aggregate (all hosts) grants on any host at the site', () => {
-		expect(hasPermission(['main-office_hosts_admin'], HOST, 'admin')).toBe(true);
-		expect(hasPermission(['main-office_hosts_access'], HOST, 'access')).toBe(true);
-		expect(hasPermission(['main-office_hosts_admin'], HOST, 'access')).toBe(true);
-	});
-
-	test('specific host group grants only that host', () => {
-		const cn = resourceGroupCns('main-office', 'host', 'web-01', 'admin');
-		expect(hasPermission([cn], HOST, 'admin')).toBe(true);
-		expect(hasPermission([cn], OTHER_SITE_HOST, 'admin')).toBe(false);
-	});
-
-	test('admin implies access; access does not imply admin', () => {
-		expect(hasPermission([resourceGroupCns('main-office', 'host', 'web-01', 'admin')], HOST, 'access')).toBe(true);
-		expect(hasPermission([resourceGroupCns('main-office', 'host', 'web-01', 'access')], HOST, 'admin')).toBe(false);
-	});
-
-	test('capabilities are exact — admin does not grant a capability', () => {
-		expect(hasPermission([resourceGroupCns('main-office', 'host', 'web-01', 'reboot')], HOST, 'reboot')).toBe(true);
-		expect(hasPermission([resourceGroupCns('main-office', 'host', 'web-01', 'admin')], HOST, 'reboot')).toBe(false);
-		expect(hasPermission(['main-office_hosts_reboot'], HOST, 'reboot')).toBe(true);
-	});
-
-	test('hosts and apps are orthogonal namespaces', () => {
-		const hostAdmin = resourceGroupCns('main-office', 'host', 'web-01', 'admin');
-		expect(hasPermission([hostAdmin], APP, 'access')).toBe(false);
-		const appAdmin = resourceGroupCns('main-office', 'app', 'emby', 'admin');
-		expect(hasPermission([appAdmin], APP, 'access')).toBe(true);
-	});
-
-	test('a service maps to the app kind (docs §11)', () => {
-		// The directory `service` kind is the group model's `app`.
-		expect(hasPermission([resourceGroupCns('main-office', 'app', 'emby', 'admin')], SERVICE, 'admin')).toBe(true);
-		expect(hasPermission([resourceGroupCns('main-office', 'host', 'web-01', 'admin')], SERVICE, 'admin')).toBe(false);
-	});
-
-	test('cross-site isolation', () => {
-		const mainHostAdmin = resourceGroupCns('main-office', 'host', 'web-01', 'admin');
-		expect(hasPermission([mainHostAdmin], OTHER_SITE_HOST, 'access')).toBe(false);
-		expect(hasPermission(['branch-office_hosts_admin'], OTHER_SITE_HOST, 'admin')).toBe(true);
-	});
-});

nodejs/tests/proxmox_interfaces.test.js

@@ -1,78 +0,0 @@
-'use strict';
-
-const { _Interfaces: Interfaces } = require('../plugins/discovery/proxmox');
-
-// Regression coverage for the MAC/IP mismatch: the plugin used to collect MACs
-// and IPs into two flat lists and zip them by index, so on a multi-NIC guest
-// -- or any guest where one NIC had no address -- the directory recorded an IP
-// against the wrong MAC. Interfaces keys by MAC so a pairing can only come from
-// the source that observed both together.
-describe('proxmox Interfaces', () => {
-	test('keeps each IP on the NIC it was observed on', () => {
-		const i = new Interfaces();
-		i.add('AA:BB:CC:00:00:01', ['10.0.0.5'], 'eth0');
-		i.add('AA:BB:CC:00:00:02', ['192.168.9.7'], 'eth1');
-
-		expect(i.toArray()).toEqual([
-			{ mac: 'aa:bb:cc:00:00:01', ip: '10.0.0.5', ips: ['10.0.0.5'], name: 'eth0' },
-			{ mac: 'aa:bb:cc:00:00:02', ip: '192.168.9.7', ips: ['192.168.9.7'], name: 'eth1' },
-		]);
-	});
-
-	test('a NIC with no address does not steal the next NIC\'s IP', () => {
-		const i = new Interfaces();
-		i.add('AA:BB:CC:00:00:01', [], 'eth0');      // stopped/unconfigured
-		i.add('AA:BB:CC:00:00:02', ['10.0.0.9'], 'eth1');
-
-		const byMac = Object.fromEntries(i.toArray().map(x => [x.mac, x.ip]));
-		expect(byMac['aa:bb:cc:00:00:01']).toBeNull();
-		expect(byMac['aa:bb:cc:00:00:02']).toBe('10.0.0.9');
-	});
-
-	test('merges the config MAC with the agent-reported address for the same NIC', () => {
-		const i = new Interfaces();
-		i.add('aa:bb:cc:00:00:01', ['10.0.0.5'], 'eth0'); // guest agent
-		i.add('AA:BB:CC:00:00:01', [], 'net0');           // VM config, same NIC
-		expect(i.toArray()).toHaveLength(1);
-		expect(i.toArray()[0]).toMatchObject({ mac: 'aa:bb:cc:00:00:01', ip: '10.0.0.5' });
-	});
-
-	test('collects multiple addresses on one NIC without inventing a second NIC', () => {
-		const i = new Interfaces();
-		i.add('aa:bb:cc:00:00:01', ['10.0.0.5', '10.0.0.6'], 'eth0');
-		expect(i.toArray()).toHaveLength(1);
-		expect(i.toArray()[0].ips).toEqual(['10.0.0.5', '10.0.0.6']);
-		expect(i.primaryIp()).toBe('10.0.0.5');
-	});
-
-	test('ignores placeholder and malformed MACs', () => {
-		const i = new Interfaces();
-		i.add('00:00:00:00:00:00', [], 'eth0');
-		i.add('not-a-mac', [], 'eth1');
-		i.add('', [], 'eth2');
-		expect(i.toArray()).toEqual([]);
-		expect(i.primaryMac()).toBeNull();
-	});
-
-	test('keeps an address that arrived without a usable MAC', () => {
-		const i = new Interfaces();
-		i.add(null, ['10.0.0.5'], 'eth0');
-		expect(i.primaryIp()).toBe('10.0.0.5');
-		expect(i.primaryMac()).toBeNull();
-	});
-
-	test('primary values prefer a NIC that actually has an address', () => {
-		const i = new Interfaces();
-		i.add('aa:bb:cc:00:00:01', [], 'eth0');
-		i.add('aa:bb:cc:00:00:02', ['10.0.0.9'], 'eth1');
-		expect(i.primaryIp()).toBe('10.0.0.9');
-		expect(i.primaryMac()).toBe('aa:bb:cc:00:00:02');
-	});
-
-	test('a fully unaddressed guest still reports its MAC', () => {
-		const i = new Interfaces();
-		i.add('aa:bb:cc:00:00:01', [], 'net0');
-		expect(i.primaryIp()).toBeNull();
-		expect(i.primaryMac()).toBe('aa:bb:cc:00:00:01');
-	});
-});

nodejs/tests/vault_broker.test.js

@@ -15,36 +15,8 @@ jest.mock('redis', () => ({
   })
 }));
 
-// In-memory stand-ins for the ORM-backed models so mintAppToken/renewAppTokens
-// can run without a database.
-jest.mock('../models/shared_secret', () => ({
-  SharedSecret: { list: jest.fn().mockResolvedValue([]) },
-}));
-jest.mock('../models/shared_secret_grant', () => ({
-  SharedSecretGrant: { listForGrantee: jest.fn().mockResolvedValue([]) },
-}));
-jest.mock('../models/vault_app_token', () => {
-  const rows = [];
-  const VaultAppToken = {
-    _rows: rows,
-    list: jest.fn(async () => rows),
-    getByName: jest.fn(async (name) => rows.find(r => r.name === name) || null),
-    create: jest.fn(async (data) => {
-      const row = {
-        ...data,
-        update: jest.fn(async function (patch) { Object.assign(this, patch); }),
-        delete: jest.fn(async function () { rows.splice(rows.indexOf(this), 1); }),
-      };
-      rows.push(row);
-      return row;
-    }),
-  };
-  return { VaultAppToken };
-});
-
 const baoConf = require('@simpleworkjs/bao-conf');
 const vaultBroker = require('../utils/vault_broker');
-const { VaultAppToken } = require('../models/vault_app_token');
 
 describe('vault_broker admin policy', () => {
   beforeEach(() => {
@@ -57,8 +29,8 @@ describe('vault_broker admin policy', () => {
         return { status: 404, text: async () => '' };
       }
       if (method === 'PUT' && path === 'sys/policies/acl/sso-admin') {
-        expect(body.policy).toContain('path "secret/metadata" { capabilities = ["create", "read", "update", "delete", "list"] }');
-        expect(body.policy).toContain('path "secret/metadata/" { capabilities = ["create", "read", "update", "delete", "list"] }');
+        expect(body.policy).toContain('path "secret/metadata" { capabilities = ["list", "read", "delete"] }');
+        expect(body.policy).toContain('path "secret/metadata/" { capabilities = ["list", "read", "delete"] }');
         return { status: 204, ok: true };
       }
       if (method === 'POST' && path === 'auth/token/create/sso-broker') {
@@ -77,128 +49,3 @@ describe('vault_broker admin policy', () => {
     }));
   });
 });
-
-describe('app token lifecycle (accessor storage + renewal)', () => {
-  beforeEach(() => {
-    baoConf.request.mockReset();
-    VaultAppToken._rows.length = 0;
-  });
-
-  function mockBao({ mintAccessor = 'acc-1', renewOk = true } = {}) {
-    baoConf.request.mockImplementation(async (method, path, body) => {
-      if (path.startsWith('sys/policies/acl/')) {
-        if (method === 'GET') return { status: 404, text: async () => '' };
-        return { status: 204, ok: true };
-      }
-      if (path === 'auth/token/create/sso-app') {
-        return { ok: true, json: async () => ({ auth: { client_token: 'app-tok', accessor: mintAccessor, lease_duration: 2764800 } }) };
-      }
-      if (path === 'auth/token/renew-accessor') {
-        return renewOk ? { ok: true, json: async () => ({}) } : { ok: false, status: 400, text: async () => 'invalid accessor' };
-      }
-      if (path === 'auth/token/revoke-accessor') {
-        return { ok: true, status: 204, text: async () => '' };
-      }
-      return { status: 200, ok: true, json: async () => ({}) };
-    });
-  }
-
-  test('mintAppToken stores the accessor; re-mint revokes the old accessor and replaces the row', async () => {
-    mockBao({ mintAccessor: 'acc-old' });
-    await vaultBroker.mintAppToken('demo', 'adminuser');
-    expect(VaultAppToken._rows).toHaveLength(1);
-    expect(VaultAppToken._rows[0]).toMatchObject({ name: 'demo', accessor: 'acc-old', created_by: 'adminuser' });
-
-    mockBao({ mintAccessor: 'acc-new' });
-    await vaultBroker.mintAppToken('demo', 'adminuser');
-    expect(baoConf.request).toHaveBeenCalledWith('POST', 'auth/token/revoke-accessor', { accessor: 'acc-old' });
-    expect(VaultAppToken._rows).toHaveLength(1);
-    expect(VaultAppToken._rows[0].accessor).toBe('acc-new');
-  });
-
-  test('renewAppTokens renews each accessor and stamps lastRenewedAt', async () => {
-    mockBao();
-    await vaultBroker.mintAppToken('demo', 'adminuser');
-    VaultAppToken._rows[0].lastRenewedAt = 0;
-    await vaultBroker.renewAppTokens();
-    expect(baoConf.request).toHaveBeenCalledWith('POST', 'auth/token/renew-accessor', { accessor: 'acc-1' });
-    expect(VaultAppToken._rows[0].lastRenewedAt).toBeGreaterThan(0);
-    expect(VaultAppToken._rows[0].lastError).toBeNull();
-  });
-
-  test('renewAppTokens records the failure on the row without throwing', async () => {
-    mockBao({ renewOk: false });
-    await vaultBroker.mintAppToken('demo', 'adminuser');
-    await vaultBroker.renewAppTokens();
-    expect(VaultAppToken._rows[0].lastError).toMatch(/renew failed \(400\)/);
-  });
-});
-
-// Real HTTP round-trip through vaultProxy() against an in-process fake OpenBao.
-// This exists because the proxy once shipped with a hook shape the installed
-// http-proxy-middleware version ignored (v3 `on: { proxyReq }` vs v2
-// `onProxyReq`), so NO X-Vault-Token was ever injected and every /api/vault
-// request 403'd. A unit test on options can't catch that — only a wire test can.
-describe('vaultProxy wire behavior', () => {
-  const http = require('http');
-  const express = require('express');
-
-  let target; // fake OpenBao
-  let seen;   // last request the fake OpenBao received
-  let app;    // sso app fragment: scopeGuard stub + vaultProxy
-  let server;
-
-  beforeAll((done) => {
-    target = http.createServer((req, res) => {
-      let body = '';
-      req.on('data', (c) => { body += c; });
-      req.on('end', () => {
-        seen = { method: req.method, url: req.url, headers: req.headers, body };
-        res.setHeader('content-type', 'application/json');
-        res.end('{"ok":true}');
-      });
-    });
-    target.listen(0, '127.0.0.1', () => {
-      process.env.VAULT_ADDR = `http://127.0.0.1:${target.address().port}`;
-      jest.resetModules();
-      const broker = require('../utils/vault_broker');
-      app = express();
-      app.use(express.json());
-      app.use('/api/vault', (req, res, next) => { req.vaultToken = 'scoped-token-123'; next(); }, broker.vaultProxy());
-      server = app.listen(0, '127.0.0.1', done);
-    });
-  });
-
-  afterAll((done) => {
-    server.close(() => target.close(done));
-  });
-
-  function call(path, opts = {}) {
-    const port = server.address().port;
-    return fetch(`http://127.0.0.1:${port}${path}`, opts);
-  }
-
-  test('GET list rewrites /api/vault -> /v1, injects X-Vault-Token, strips sso auth headers', async () => {
-    const res = await call('/api/vault/secret/metadata/users/alice?list=true', {
-      headers: { 'auth-token': 'sso-session-token', authorization: 'Bearer sso_x_y', 'content-type': 'application/json' },
-    });
-    expect(res.status).toBe(200);
-    expect(seen.url).toBe('/v1/secret/metadata/users/alice?list=true');
-    expect(seen.headers['x-vault-token']).toBe('scoped-token-123');
-    expect(seen.headers['auth-token']).toBeUndefined();
-    expect(seen.headers['authorization']).toBeUndefined();
-  });
-
-  test('POST body survives the express.json + fixRequestBody round-trip', async () => {
-    const res = await call('/api/vault/secret/data/users/alice/foo', {
-      method: 'POST',
-      headers: { 'content-type': 'application/json', 'auth-token': 'sso-session-token' },
-      body: JSON.stringify({ data: { hello: 'world' } }),
-    });
-    expect(res.status).toBe(200);
-    expect(seen.method).toBe('POST');
-    expect(seen.url).toBe('/v1/secret/data/users/alice/foo');
-    expect(seen.headers['x-vault-token']).toBe('scoped-token-123');
-    expect(JSON.parse(seen.body)).toEqual({ data: { hello: 'world' } });
-  });
-});

nodejs/utils/agent_keys.js

@@ -1,99 +0,0 @@
-'use strict';
-
-// The Ed25519 key pair the SSO signs high-risk agent commands with, stored in
-// OpenBao at `secret/agent/signing-key`.
-//
-// This used to be generated in the AgentManager constructor and kept only in
-// memory, which made the whole signing scheme decorative: every SSO restart
-// produced a new key, so the `public_key` pinned in an agent's agent.yml stopped
-// matching and the agent either rejected everything or (because it skips
-// verification when no key is configured) executed everything unverified. A
-// trust anchor that changes on restart is not a trust anchor.
-//
-// Requires the sso-broker OpenBao policy to grant `secret/agent/*`
-// (theta-suite setup.sh). Without it the load fails and signing is reported as
-// unavailable -- we deliberately do NOT fall back to an ephemeral key, because
-// signing with a key no agent has ever seen is worse than refusing: it looks
-// like it worked.
-
-const crypto = require('crypto');
-const baoConf = require('@simpleworkjs/bao-conf');
-
-const PATH = 'agent/signing-key'; // baoConf adds the secret/data prefix
-
-let cached = null;      // { privateKeyPem, publicKeyPem, publicKeyBase64 }
-let loadError = null;
-
-// Agents pin the raw 32-byte Ed25519 public key, base64-encoded (see the Go
-// client's verifySignature, which base64-decodes cfg.public_key and expects
-// ed25519.PublicKeySize bytes). Node hands us SPKI PEM, so strip the 12-byte
-// DER prefix to get the raw key the agent actually wants.
-function rawPublicKeyBase64(publicKeyPem) {
-	const der = crypto.createPublicKey(publicKeyPem).export({ type: 'spki', format: 'der' });
-	return Buffer.from(der.subarray(der.length - 32)).toString('base64');
-}
-
-function generate() {
-	const { privateKey, publicKey } = crypto.generateKeyPairSync('ed25519', {
-		privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
-		publicKeyEncoding: { type: 'spki', format: 'pem' }
-	});
-	return { privateKeyPem: privateKey, publicKeyPem: publicKey };
-}
-
-// Load the stored key pair, generating and persisting one on first run.
-// Idempotent and safe to call repeatedly; the result is cached in-process.
-async function load() {
-	if (cached) return cached;
-
-	let stored = null;
-	try {
-		stored = await baoConf.get(PATH);
-	} catch (err) {
-		loadError = `could not read ${PATH} from OpenBao: ${err.message}`;
-		console.error(`[agent_keys] ${loadError}`);
-		return null;
-	}
-
-	if (stored && stored.privateKeyPem && stored.publicKeyPem) {
-		cached = {
-			privateKeyPem: stored.privateKeyPem,
-			publicKeyPem: stored.publicKeyPem,
-			publicKeyBase64: rawPublicKeyBase64(stored.publicKeyPem)
-		};
-		loadError = null;
-		return cached;
-	}
-
-	// First run: mint one and persist it before use, so a crash between
-	// generating and storing can't leave agents pinned to a key we forgot.
-	const fresh = generate();
-	try {
-		await baoConf.set(PATH, fresh);
-	} catch (err) {
-		loadError = `could not persist a signing key to ${PATH}: ${err.message}. `
-			+ 'Re-run ./setup.sh so the sso-broker policy grants secret/agent/*.';
-		console.error(`[agent_keys] ${loadError}`);
-		return null;
-	}
-
-	cached = {
-		...fresh,
-		publicKeyBase64: rawPublicKeyBase64(fresh.publicKeyPem)
-	};
-	loadError = null;
-	console.log('[agent_keys] generated and stored a new agent signing key');
-	return cached;
-}
-
-function status() {
-	return { available: !!cached, error: loadError };
-}
-
-// Test seam: drop the in-process cache.
-function _reset() {
-	cached = null;
-	loadError = null;
-}
-
-module.exports = { load, status, rawPublicKeyBase64, _reset, PATH };

nodejs/utils/agent_manager.js

@@ -1,19 +1,26 @@
 'use strict';
 
 const crypto = require('crypto');
-const agentKeys = require('./agent_keys');
-const { Agent } = require('../models/agent');
 
-// Tracks the live WebSocket for each enrolled agent and brokers commands to it.
-//
-// The durable facts about an agent (identity, host binding, last seen, last
-// discovery/telemetry) live in the Agent table; this class holds only what
-// cannot be persisted -- the open socket. That split is what makes an installed
-// -but-offline agent visible, and what stops a restart from erasing the fleet.
 class AgentManager {
   constructor() {
-    // agentId -> { ws, ipAddress, connectedAt, lastResponse, pending }
-    this.live = new Map();
+    this.agents = new Map(); // token -> agentRecord
+    this.privateKeyPem = null;
+    this.publicKeyPem = null;
+    this.initKeyPair();
+  }
+
+  initKeyPair() {
+    try {
+      const { privateKey, publicKey } = crypto.generateKeyPairSync('ed25519', {
+        privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+        publicKeyEncoding: { type: 'spki', format: 'pem' }
+      });
+      this.privateKeyPem = privateKey;
+      this.publicKeyPem = publicKey;
+    } catch (err) {
+      console.error('[AgentManager] Failed to generate Ed25519 key pair:', err);
+    }
   }
 
   /**
@@ -30,89 +37,54 @@ class AgentManager {
   }
 
   /**
-   * Sign payload using the persisted Ed25519 private key. Throws when no key is
-   * available rather than minting a throwaway one -- an agent verifies against
-   * the key pinned in its agent.yml, so a signature from a key it has never
-   * seen is not a weaker signature, it is a broken command that looks fine from
-   * this side.
+   * Sign payload using Ed25519 private key.
+   * Returns base64 encoded signature.
    */
-  async signPayload(payload) {
-    const keys = await agentKeys.load();
-    if (!keys) {
-      const { error } = agentKeys.status();
-      throw new Error(`agent command signing is unavailable: ${error || 'no signing key'}`);
+  signPayload(payload) {
+    if (!this.privateKeyPem) {
+      throw new Error('Ed25519 private key is not initialized');
     }
     const canonicalBytes = Buffer.from(this.canonicalize(payload), 'utf8');
-    return crypto.sign(null, canonicalBytes, keys.privateKeyPem).toString('base64');
+    const signature = crypto.sign(null, canonicalBytes, this.privateKeyPem);
+    return signature.toString('base64');
   }
 
-  async publicKeyBase64() {
-    const keys = await agentKeys.load();
-    return keys ? keys.publicKeyBase64 : null;
-  }
-
-  async publicKeyPem() {
-    const keys = await agentKeys.load();
-    return keys ? keys.publicKeyPem : null;
-  }
-
-  // Bind a freshly authenticated socket to an enrolled agent. `agent` is an
-  // Agent row that Agent.authenticate() has already vouched for -- this method
-  // never sees a raw token and must never be called with an unauthenticated one.
-  // Synchronous by design. The caller must attach its `message` listener in the
-  // same tick as the connection is accepted: `ws` drops events emitted before a
-  // listener exists, and the agent sends `discovery` immediately on open, so
-  // awaiting a database round-trip here silently lost every agent's first
-  // discovery frame. The connect timestamp is persisted in the background.
-  registerAgent(agent, ws, remoteAddress) {
-    const existing = this.live.get(agent.id);
+  registerAgent(token, ws, remoteAddress) {
+    const existing = this.agents.get(token);
     if (existing && existing.ws && existing.ws !== ws) {
       try { existing.ws.close(4002, 'Superseded by new connection'); } catch (e) {}
     }
 
-    this.live.set(agent.id, {
+    const agentRecord = {
+      token,
       ws,
       ipAddress: remoteAddress,
+      hostname: 'unknown',
       connectedAt: new Date().toISOString(),
-      lastResponse: null
-    });
+      lastSeen: new Date().toISOString(),
+      discovery: {},
+      telemetry: {},
+      pendingResponses: new Map()
+    };
 
-    agent.update({
-      last_seen: Math.floor(Date.now() / 1000),
-      last_ip: remoteAddress || null
-    }).catch(err => console.error(`[AgentManager] could not record connect for ${agent.id}:`, err.message));
+    this.agents.set(token, agentRecord);
+    return agentRecord;
   }
 
-  unregisterAgent(agentId, ws) {
-    const state = this.live.get(agentId);
-    if (state && state.ws === ws) this.live.delete(agentId);
+  unregisterAgent(token, ws) {
+    const record = this.agents.get(token);
+    if (record && record.ws === ws) {
+      this.agents.delete(token);
+    }
   }
 
-  // Drop an agent's live socket now. Revocation that only takes effect on the
-  // next reconnect is not revocation -- a connected agent would keep receiving
-  // commands indefinitely.
-  disconnect(agentId, code = 4003, reason = 'Disconnected by server') {
-    const state = this.live.get(agentId);
-    if (!state || !state.ws) return false;
-    try { state.ws.close(code, reason); } catch (e) {}
-    this.live.delete(agentId);
-    return true;
-  }
+  handleDiscovery(token, payload) {
+    const agent = this.agents.get(token);
+    if (!agent) return;
 
-  isConnected(agentId) {
-    const state = this.live.get(agentId);
-    return !!(state && state.ws && state.ws.readyState === 1);
-  }
-
-  async touch(agent, extra = {}) {
-    await agent.update({
-      last_seen: Math.floor(Date.now() / 1000),
-      ...extra
-    }).catch(err => console.error(`[AgentManager] could not persist agent ${agent.id}:`, err.message));
-  }
-
-  async handleDiscovery(agent, payload) {
-    const discovery = {
+    agent.lastSeen = new Date().toISOString();
+    agent.hostname = payload.hostname || agent.hostname;
+    agent.discovery = {
       hostname: payload.hostname || '',
       ip_addresses: Array.isArray(payload.ip_addresses) ? payload.ip_addresses : [],
       os: payload.os || '',
@@ -122,79 +94,28 @@ class AgentManager {
       disk_total_gb: payload.disk_total_gb || 0,
       location: payload.location || 'default'
     };
-    await this.touch(agent, { lastDiscovery: discovery });
-    await this.applyDiscoveryToDirectory(agent, discovery);
   }
 
-  // An agent runs ON the host it describes, which makes it the most
-  // authoritative source the directory has -- more so than a hypervisor API or
-  // a network scan. It previously updated nothing at all: the facts sat on an
-  // in-memory record and were lost on disconnect.
-  //
-  // When the agent is bound to a resource we write that row directly; guessing
-  // is only for an unbound agent, and then we let the shared reconciler do the
-  // matching (same MAC/IP/name rules every other source goes through) rather
-  // than inventing a second matcher here.
-  async applyDiscoveryToDirectory(agent, discovery) {
-    try {
-      const { Resource } = require('../models/resource');
-      const metadata = {
-        os: discovery.os || undefined,
-        kernel: discovery.kernel || undefined,
-        cpu: discovery.cpu || undefined,
-        ram_total_gb: discovery.ram_total_gb || undefined,
-        disk_total_gb: discovery.disk_total_gb || undefined,
-        ip: (discovery.ip_addresses || [])[0] || undefined,
-        agentId: agent.id,
-        last_seen: Date.now()
-      };
-      // Drop undefined so a field the agent could not determine never
-      // overwrites a good value already in the directory.
-      for (const k of Object.keys(metadata)) if (metadata[k] === undefined) delete metadata[k];
+  handleTelemetry(token, payload) {
+    const agent = this.agents.get(token);
+    if (!agent) return;
 
-      if (agent.resourceId) {
-        const resource = await Resource.get(agent.resourceId);
-        if (!resource) return;
-        const merged = { ...(resource.metadata || {}), ...metadata };
-        const sources = new Set(merged.discovery_sources || []);
-        sources.add('theta-agent');
-        merged.discovery_sources = [...sources];
-        await resource.update({ metadata: merged, updated_on: Math.floor(Date.now() / 1000) });
-        return;
-      }
+    agent.lastSeen = new Date().toISOString();
+    agent.telemetry = {
+      cpu_usage_percent: payload.cpu_usage_percent || 0,
+      ram_usage_percent: payload.ram_usage_percent || 0,
+      disk_usage_percent: payload.disk_usage_percent || 0,
+      zfs_health: payload.zfs_health || 'N/A',
+      gpu_usage_percent: payload.gpu_usage_percent ?? -1,
+      timestamp: payload.timestamp || new Date().toISOString()
+    };
+  }
 
-      if (!discovery.hostname) return;
-      const { DiscoveryReconciler } = require('../services/discovery_reconciler');
-      await DiscoveryReconciler.reconcile('theta-agent', {
-        resources: [{
-          kind: 'host',
-          name: discovery.hostname,
-          slug: `agent-${agent.id.slice(0, 8)}`,
-          metadata: { ...metadata, subType: 'linux' }
-        }],
-        edges: []
-      });
-    } catch (err) {
-      // Never let a directory write break the agent connection.
-      console.error(`[AgentManager] discovery -> directory failed for agent ${agent.id}:`, err.message);
+  handleHeartbeat(token, payload, ws) {
+    const agent = this.agents.get(token);
+    if (agent) {
+      agent.lastSeen = new Date().toISOString();
     }
-  }
-
-  async handleTelemetry(agent, payload) {
-    await this.touch(agent, {
-      lastTelemetry: {
-        cpu_usage_percent: payload.cpu_usage_percent || 0,
-        ram_usage_percent: payload.ram_usage_percent || 0,
-        disk_usage_percent: payload.disk_usage_percent || 0,
-        zfs_health: payload.zfs_health || 'N/A',
-        gpu_usage_percent: payload.gpu_usage_percent ?? -1,
-        timestamp: payload.timestamp || new Date().toISOString()
-      }
-    });
-  }
-
-  async handleHeartbeat(agent, payload, ws) {
-    await this.touch(agent);
     try {
       ws.send(JSON.stringify({
         type: 'heartbeat_ack',
@@ -203,51 +124,57 @@ class AgentManager {
     } catch (e) {}
   }
 
-  async handleResponse(agent, payload) {
-    const state = this.live.get(agent.id);
-    if (state) {
-      state.lastResponse = {
+  handleResponse(token, payload) {
+    const agent = this.agents.get(token);
+    if (agent) {
+      agent.lastSeen = new Date().toISOString();
+      agent.lastResponse = {
         status: payload.status || 'ok',
         message: payload.message || '',
         output: payload.output || '',
         timestamp: new Date().toISOString()
       };
     }
-    await this.touch(agent);
   }
 
-  async sendCommand(agent, commandType, payload = {}, isHighRisk = false) {
-    const state = this.live.get(agent.id);
-    if (!state || !state.ws || state.ws.readyState !== 1) {
-      throw new Error(`Agent "${agent.name}" is not connected`);
+  sendCommand(token, commandType, payload = {}, isHighRisk = false) {
+    const agent = this.agents.get(token);
+    if (!agent || !agent.ws || agent.ws.readyState !== 1) {
+      throw new Error(`Agent with token "${token}" is not connected`);
     }
 
     const finalPayload = { ...payload };
-    if (isHighRisk) finalPayload.signature = await this.signPayload(finalPayload);
+    if (isHighRisk) {
+      finalPayload.signature = this.signPayload(finalPayload);
+    }
 
-    const message = { type: commandType, payload: finalPayload };
-    state.ws.send(JSON.stringify(message));
+    const message = {
+      type: commandType,
+      payload: finalPayload
+    };
+
+    agent.ws.send(JSON.stringify(message));
     return message;
   }
 
-  // Live view for one agent, for merging into its row.
-  liveState(agentId) {
-    const state = this.live.get(agentId);
-    if (!state) return { connected: false, lastResponse: null };
-    return {
-      connected: !!(state.ws && state.ws.readyState === 1),
-      ipAddress: state.ipAddress,
-      connectedAt: state.connectedAt,
-      lastResponse: state.lastResponse || null
-    };
-  }
-
-  // Every enrolled agent, connected or not.
-  async listAgents() {
-    const rows = await Agent.list();
-    return rows.map(a => a.toPublic(this.liveState(a.id)));
+  getConnectedAgents() {
+    const list = [];
+    const now = new Date();
+    for (const [token, agent] of this.agents.entries()) {
+      list.push({
+        token,
+        hostname: agent.hostname,
+        ipAddress: agent.ipAddress,
+        connectedAt: agent.connectedAt,
+        lastSeen: agent.lastSeen,
+        discovery: agent.discovery,
+        telemetry: agent.telemetry,
+        lastResponse: agent.lastResponse || null,
+        isOnline: (now - new Date(agent.lastSeen)) < 90000
+      });
+    }
+    return list;
   }
 }
 
 module.exports = new AgentManager();
-module.exports.AgentManager = AgentManager;

nodejs/utils/groups.js

@@ -1,141 +0,0 @@
-'use strict';
-
-// Theta42 group & permission model.
-//
-// Canonical spec: theta-suite/docs/GROUPS.md. Group names follow a fixed,
-// parseable structure. The structural delimiter is `_`; site/host/app slugs
-// never contain it. Aggregates use the plural kind (hosts/apps); per-resource
-// uses the singular (host/app).
-//
-//   god_admin                              global — everything, everywhere
-//   {site}_super_admin                     everything on the site
-//   {site}_hosts_<level>                   admin/access/capability on ALL hosts at the site
-//   {site}_hosts_<level>
-//   {site}_host_<slug>_<level>             admin/access/capability on ONE host
-//   {site}_apps_<level>                    ... on ALL apps at the site
-//   {site}_app_<slug>_<level>              ... on ONE app
-//   {site}_everyone / everyone             meta groups (implicit membership)
-//
-// `level` is 'admin', 'access', or an opaque `<capability>`. `admin` implies
-// `access`; capabilities are explicit and never implied by `admin`. Groups are
-// `groupOfNames` (RBAC) — no gidNumber; hosts map GIDs on the fly (SSSD).
-//
-// This module is pure logic (no LDAP/DB) so it is fully unit-testable. Callers
-// supply the user's group memberships (e.g. from Group.list(user.dn)).
-
-const GOD_ADMIN = 'god_admin';
-const KNOWN_LEVELS = ['admin', 'access'];
-const KINDS = ['host', 'app'];
-
-// Normalize a site/host/app slug: lowercase; runs of non-alnum -> '-'; never
-// contains '_' (the structural delimiter), so group names parse unambiguously.
-function slugify(name) {
-  return String(name || '')
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, '-')
-    .replace(/^-+|-+$/g, '');
-}
-
-// Validate a kind (host/app) — throw on anything else.
-function assertKind(kind) {
-  if (!KINDS.includes(kind)) throw new Error(`invalid resource kind: ${kind} (must be host or app)`);
-}
-
-// Strip the kind prefix a directory resource slug may carry (`host_theta-env` ->
-// `theta-env`), leaving the resource's name slug. Services are stored bare
-// (`sso-manager`), so this is a no-op for them.
-function resourceNameSlug(slug) {
-  return String(slug || '').replace(/^(site|host|app)_/, '');
-}
-
-// {site}_{kind}_{nameSlug}_{level} — the per-resource group for ONE resource.
-// Matches docs/GROUPS.md §2 (`S_host_<host>_<level>` / `S_app_<app>_<level>`):
-// `site` is the site resource's slug verbatim (`site_local`), `kind` is the
-// group-model kind (`host`/`app`), `nameSlug` is the resource's name (kind
-// stripped, e.g. `theta-env` from `host_theta-env`). So a host `host_theta-env`
-// yields `site_local_host_theta-env_access` and a service `sso-manager` yields
-// `site_local_app_sso-manager_access`.
-function resourceGroupCns(site, kind, nameSlug, level) {
-  assertKind(kind);
-  return `${site}_${kind}_${slugify(nameSlug)}_${level}`;
-}
-
-// {site}_hosts_<level> / {site}_apps_<level> (plural kind — the aggregate).
-function aggregateGroupCns(site, kind, level) {
-  assertKind(kind);
-  return `${site}_${kind}s_${level}`;
-}
-
-// {site}_super_admin
-function siteSuperAdminCns(site) {
-  return `${site}_super_admin`;
-}
-
-// {site}_everyone
-function siteEveryoneCns(site) {
-  return `${site}_everyone`;
-}
-
-// True if `level` is a known admin/access level (not an opaque capability).
-function isKnownLevel(level) {
-  return KNOWN_LEVELS.includes(level);
-}
-
-// True if holding `level` grants `wanted` (admin implies access).
-function levelGrants(level, wanted) {
-  if (level === wanted) return true;
-  return level === 'admin' && wanted === 'access';
-}
-
-// Resolve whether a user (given `memberOf` — the group cns they belong to) has
-// `level` on a resource. Applies the inheritance lattice:
-//   god_admin ⊇ {site}_super_admin ⊇ aggregate ⊇ specific; admin ⊇ access.
-//
-//   memberOf: array of group cns the user is a member of.
-//   resource: { site, kind: 'host'|'app', slug }.
-//   level:    'admin' | 'access' | an opaque capability token.
-//
-// Meta-group grants (`everyone` / `{site}_everyone`) are NOT handled here — they
-// are resource-level grants, resolved by the caller against the resource's own
-// granted groups (see permission.onResource). This keeps the function pure over
-// the user's membership only.
-function hasPermission(memberOf, resource, level) {
-  // `site` is used verbatim (`site_local`); `kind` maps the directory `service`
-  // kind onto the group model's `app` (docs/GROUPS.md §11 — consoles/services are
-  // apps); `nameSlug` is the resource name with any kind prefix stripped.
-  const site = resource && resource.site;
-  const rawKind = resource && resource.kind;
-  const kind = rawKind === 'service' ? 'app' : rawKind;
-  const nameSlug = resourceNameSlug(resource && resource.slug);
-  const set = new Set(memberOf || []);
-
-  if (set.has(GOD_ADMIN)) return true;
-  if (set.has(siteSuperAdminCns(site))) return true;
-
-  if (isKnownLevel(level)) {
-    // admin / access
-    if (set.has(aggregateGroupCns(site, kind, level))) return true;
-    if (set.has(resourceGroupCns(site, kind, nameSlug, level))) return true;
-    if (level === 'access' && hasPermission(memberOf, resource, 'admin')) return true;
-    return false;
-  }
-  // Opaque capability — exact aggregate or specific grant only.
-  if (set.has(aggregateGroupCns(site, kind, level))) return true;
-  if (set.has(resourceGroupCns(site, kind, nameSlug, level))) return true;
-  return false;
-}
-
-module.exports = {
-  GOD_ADMIN,
-  KNOWN_LEVELS,
-  KINDS,
-  slugify,
-  resourceNameSlug,
-  resourceGroupCns,
-  aggregateGroupCns,
-  siteSuperAdminCns,
-  siteEveryoneCns,
-  isKnownLevel,
-  levelGrants,
-  hasPermission,
-};

nodejs/utils/permission.js

@@ -1,27 +1,10 @@
 'use strict';
 
 const {Group} = require('../models/group_ldap');
-const groups = require('./groups');
 
-// The group nested into every resource's _admin group by api_directory_admin
-// (cross-resource super-admin administration). This is `god_admin` -- the global
-// super group of the new model (docs/GROUPS.md), seeded by docker-entrypoint.sh.
-// It used to be the legacy `app_super_admin`, which existed while god_admin
-// didn't; now that god_admin is created at boot, the provisioning nests it.
-// LEGACY_SUPER_ADMIN_ALIASES still recognizes a `app_super_admin` that predates
-// the migration, so an existing deployment isn't stripped of rights until it's
-// rebuilt.
-const SUPER_ADMIN_GROUP = 'god_admin';
-const LEGACY_SUPER_ADMIN_ALIASES = ['app_super_admin'];
+const SUPER_ADMIN_GROUP = 'app_super_admin';
 
-// True if the user (by resolved member cns) is a global god/super admin.
-// Recognizes BOTH the new schema's `god_admin` and the legacy `app_super_admin`.
-async function isSuperAdmin(memberOfCns) {
-	return memberOfCns.includes(groups.GOD_ADMIN) ||
-		memberOfCns.some((cn) => LEGACY_SUPER_ADMIN_ALIASES.includes(cn));
-}
-
-let byGroup = async function(user, checkGroups, ownerOf){
+let byGroup = async function(user, groups, ownerOf){
 	// Membership is resolved once, transitively: a user placed in an admin group
 	// through a nested group is as much a member as one listed on it directly.
 	// Checking `group.member.includes(user.dn)` per group -- as this used to --
@@ -34,9 +17,9 @@ let byGroup = async function(user, checkGroups, ownerOf){
 		// they still catch direct membership if the resolver is unavailable.
 	}
 
-	if(await isSuperAdmin(memberOfCns)) return true;
+	if(memberOfCns.includes(SUPER_ADMIN_GROUP)) return true;
 
-	for(let group of checkGroups){
+	for(let group of groups){
 		if(memberOfCns.includes(group)) return true;
 	}
 
@@ -59,46 +42,4 @@ let byGroup = async function(user, checkGroups, ownerOf){
 	throw error;
 }
 
-// Resolve whether a user has `level` on a directory resource under the group
-// model (see utils/groups.js). Applies the inheritance lattice and the
-// `everyone`/`{site}_everyone` meta grants when the resource grants them.
-//
-//   user:    the auth user ({ dn, isMachine }).
-//   resource:{ site, kind: 'host'|'app', slug }.
-//   level:   'admin' | 'access' | an opaque capability token.
-//   grantedGroups: optional array of the resource's granted group cns (used only
-//     for meta `everyone` handling). Omit to skip meta grants.
-async function onResource(user, resource, level, grantedGroups) {
-	let memberOfCns = [];
-	try { memberOfCns = await Group.list(user.dn); } catch (e) { /* ignore */ }
-
-	if (await isSuperAdmin(memberOfCns)) return true;
-	if (groups.hasPermission(memberOfCns, resource, level)) return true;
-
-	// Meta grants: `everyone` / `{site}_everyone` confer access to any
-	// authenticated (non-machine) user when the resource grants them.
-	if (level === 'access' && !user.isMachine && Array.isArray(grantedGroups)) {
-		const siteEveryone = groups.siteEveryoneCns(resource.site);
-		if (grantedGroups.includes('everyone') || grantedGroups.includes(siteEveryone)) return true;
-	}
-	return false;
-}
-
-// Like onResource but throws Insufficient Permission when denied — for guards.
-async function requireResource(user, resource, level, grantedGroups) {
-	if (await onResource(user, resource, level, grantedGroups)) return;
-	const error = new Error('Insufficient Permission');
-	error.name = 'Insufficient Permission';
-	error.status = 401;
-	throw error;
-}
-
-module.exports = {
-	byGroup,
-	onResource,
-	requireResource,
-	isSuperAdmin,
-	SUPER_ADMIN_GROUP,
-	LEGACY_SUPER_ADMIN_ALIASES,
-	...groups, // group schema builders (slugify, resourceGroupCns, ...)
-};
+module.exports = {byGroup, SUPER_ADMIN_GROUP};

nodejs/utils/ui.js

@@ -41,8 +41,10 @@ module.exports = {
 		// Catalog requires login - it's the end-user view of their accessible resources.
 		{href: '/', icon: 'fa-solid fa-compass', label: 'Catalog', groups: ['login']},
 		{href: '/users', icon: 'fa-solid fa-users', label: 'Users', groups: ['app_sso_admin', 'admin']},
+		{href: '/groups', icon: 'fas fa-users-cog', label: 'Groups', groups: ['app_sso_admin']},
 		{href: '/conf', icon: 'fas fa-cogs', label: 'Configuration', groups: ['app_sso_admin']},
 		{href: '/directory', icon: 'fa-solid fa-server', label: 'Directory', groups: ['app_sso_admin', 'app_sso_directory_admin', 'admin']},
+		{href: '/plugins', icon: 'fa-solid fa-plug', label: 'Plugins', groups: ['app_sso_admin', 'app_sso_directory_admin', 'admin']},
 		// Vault requires login - per-user secrets at secret/users/<uid>/*.
 		{href: '/vault', icon: 'fa-solid fa-vault', label: 'Vault', groups: ['login']},
 		{href: '/overview', icon: 'fa-solid fa-gauge-high', label: 'Overview', groups: ['app_sso_admin', 'admin']},

nodejs/utils/vault_broker.js

@@ -4,25 +4,15 @@
 // external apps, using the SSO_VAULT_TOKEN (policy `sso-broker`) and the
 // `sso-broker` token role created by theta-env/setup.sh.
 //
-//   secret/users/<uid>/*          per-user personal KV (user-<uid> policy)
-//   secret/shared/<uid>/*         user-owned shared KV (user-<uid> policy)
-//   secret/apps/<name>/*          per-external-app namespace (app-<name> policy)
-//   secret/shared/<owner>/<slug>  granted read (added to grantee's policy)
-//   secret/*                      admin UI sessions (sso-admin policy)
+//   secret/users/<uid>/*   per-user personal KV (user-<uid> policy)
+//   secret/apps/<name>/*   per-external-app namespace (app-<name> policy)
+//   secret/*               admin UI sessions (sso-admin policy)
 //
 // The sso-broker policy grants update on auth/token/create/sso-broker and on
 // sys/policies/acl/user-*, app-*, sso-admin — exactly what this module needs to
 // create the per-subject policies and mint their tokens. Per-user/admin tokens
 // are cached in Redis for the token's lifetime and re-minted on miss; per-app
 // tokens are returned ONCE (displayed in the UI, never stored retrievably).
-//
-// Policy reconciliation is the load-bearing part: OpenBao parses policy CONTENT
-// live at token use (only the SET of policy names on a token is fixed at mint),
-// so we ALWAYS reconcile a subject's policy content BEFORE returning any token
-// — cached or freshly minted. That way a stale cached token immediately gains
-// corrected/revoked capabilities, and a new shared-secret grant takes effect for
-// an existing grantee token with no re-mint. The Redis cache only short-circuits
-// token MINTING, never policy reconciliation.
 
 const baoConf = require('@simpleworkjs/bao-conf');
 const { createClient } = require('redis');
@@ -30,9 +20,6 @@ const express = require('express');
 const { createProxyMiddleware, fixRequestBody } = require('http-proxy-middleware');
 const conf = require('@simpleworkjs/conf');
 const permission = require('./permission');
-const { SharedSecret } = require('../models/shared_secret');
-const { SharedSecretGrant } = require('../models/shared_secret_grant');
-const { VaultAppToken } = require('../models/vault_app_token');
 
 const ROLE = 'sso-broker';
 const DEFAULT_TTL = 24 * 60 * 60; // matches the role's token_period (24h)
@@ -67,86 +54,52 @@ async function bao(method, path, body) {
 	return res;
 }
 
-// Ensure an ACL policy carries exactly `hcl`. Compare-and-skip: read the current
-// content and only PUT when it differs. `bao policy write` is an idempotent
-// overwrite, so this is safe to call on every token fetch — edits (e.g. adding a
-// grant) propagate immediately because OpenBao parses policy content at use.
+// Ensure an ACL policy exists AND carries the latest HCL. Always (re)writes —
+// `bao policy write` is an idempotent overwrite — so policy edits (e.g. adding
+// a list grant on a directory path) propagate on the next vault-page visit
+// without an operator re-running setup.sh. Skipping on an existing policy
+// would strand the old, narrower HCL forever.
 async function ensurePolicy(name, hcl) {
 	const existing = await baoConf.request('GET', `sys/policies/acl/${name}`);
 	if (existing.status !== 200 && existing.status !== 404) {
 		const t = await existing.text().catch(() => '');
 		throw new Error(`OpenBao policy read ${name} failed (${existing.status}) ${t}`);
 	}
-	if (existing.status === 200) {
-		const body = await existing.json().catch(() => null);
-		if (body && typeof body.policy === 'string' && body.policy === hcl) return; // unchanged
-	}
 	await bao('PUT', `sys/policies/acl/${name}`, { policy: hcl });
 }
 
-// Mint a token through a token role with the given policies. Returns
-// { token, accessor, ttl } (ttl = lease_duration seconds, falls back to
-// DEFAULT_TTL). Roles: sso-broker (24h period — user/admin tokens, re-minted
-// from cache) and sso-app (768h period — long-lived external-app credentials,
-// kept alive via their stored accessor by the renewal loop below).
-async function mintToken(policies, role = ROLE) {
-	const res = await bao('POST', `auth/token/create/${role}`, { policies });
+// Mint a token through the sso-broker role with the given policies. Returns
+// { token, ttl } (ttl = lease_duration seconds, falls back to DEFAULT_TTL).
+async function mintToken(policies) {
+	const res = await bao('POST', 'auth/token/create/sso-broker', { policies });
 	const json = await res.json();
 	const token = json && json.auth && json.auth.client_token;
 	if (!token) throw new Error(`OpenBao token mint returned no client_token: ${JSON.stringify(json)}`);
 	const ttl = (json.auth && json.auth.lease_duration) || DEFAULT_TTL;
-	return { token, accessor: json.auth.accessor, ttl };
-}
-
-// ── Shared-secret policy rules ───────────────────────────────────────────────
-// Returns the HCL rules granting `read` on every shared secret the given
-// grantee (a user uid or an app name) has been granted. Enforcement is
-// OpenBao ACL policy CONTENT — live-evaluated at token use, so these rules take
-// effect for the grantee's existing token immediately (no re-mint).
-async function sharedPolicyRules(granteeType, granteeId) {
-	const grants = await SharedSecretGrant.listForGrantee(granteeType, granteeId);
-	if (!grants.length) return '';
-	const secretIds = [...new Set(grants.map(g => g.secretId))];
-	const secrets = secretIds.length
-		? await SharedSecret.list({ where: { id: { in: secretIds } } }) : [];
-	const byId = new Map(secrets.map(s => [s.id, s]));
-	const rules = [];
-	for (const g of grants) {
-		const sec = byId.get(g.secretId);
-		if (!sec) continue;
-		const p = sec.path(); // shared/<ownerUid>/<slug>
-		rules.push(`path "secret/data/${p}" { capabilities = ["read"] }`);
-		rules.push(`path "secret/metadata/${p}" { capabilities = ["read", "list"] }`);
-	}
-	return rules.join('\n');
+	return { token, ttl };
 }
 
 // ── Per-user token ──────────────────────────────────────────────────────────
-async function userPolicyHcl(uid) {
-	const granted = await sharedPolicyRules('user', uid);
-	return `path "secret/data/users/${uid}" { capabilities = ["create", "read", "update", "delete", "list"] }
-path "secret/data/users/${uid}/*" { capabilities = ["create", "read", "update", "delete", "list"] }
-path "secret/metadata/users/${uid}" { capabilities = ["create", "read", "update", "delete", "list"] }
-path "secret/metadata/users/${uid}/" { capabilities = ["create", "read", "update", "delete", "list"] }
-path "secret/metadata/users/${uid}/*" { capabilities = ["create", "read", "update", "delete", "list"] }
-path "secret/data/shared/${uid}" { capabilities = ["create", "read", "update", "delete", "list"] }
-path "secret/data/shared/${uid}/*" { capabilities = ["create", "read", "update", "delete", "list"] }
-path "secret/metadata/shared/${uid}" { capabilities = ["create", "read", "update", "delete", "list"] }
-path "secret/metadata/shared/${uid}/" { capabilities = ["create", "read", "update", "delete", "list"] }
-path "secret/metadata/shared/${uid}/*" { capabilities = ["create", "read", "update", "delete", "list"] }
-${granted}`.trim();
+function userPolicyHcl(uid) {
+	// uid is an LDAP uid (alphanumeric + a few separators); it is interpolated
+	// into a policy path, so reject anything but a safe charset.
+	// The bare `secret/metadata/users/<uid>` grant is required to LIST the
+	// contents of the namespace: `.../*` covers nested paths but NOT the
+	// directory itself, so without it the /vault secrets list 403s.
+	return `path "secret/data/users/${uid}/*" { capabilities = ["create", "read", "update", "delete", "list"] }
+path "secret/metadata/users/${uid}" { capabilities = ["list", "read", "delete"] }
+path "secret/metadata/users/${uid}/" { capabilities = ["list", "read", "delete"] }
+path "secret/metadata/users/${uid}/*" { capabilities = ["list", "read", "delete"] }`;
 }
 
-// Mint (or return the cached) per-user token. The policy is ALWAYS reconciled
-// (compare-and-skip) before the cache is consulted, so a cached token can never
-// outlive a policy change; the cache only short-circuits re-minting. Re-minted
-// when the cache entry expires (a little before the token's own TTL).
+// Mint (or return the cached) per-user token confined to secret/users/<uid>/*.
+// Re-minted when the cache entry expires (a little before the token's own TTL).
 async function getOrCreateUserToken(uid) {
 	if (!/^[A-Za-z0-9._-]{1,64}$/.test(uid)) throw new Error(`invalid uid for vault token: ${uid}`);
-	await ensurePolicy(`user-${uid}`, await userPolicyHcl(uid));
 	const cacheKey = `vault_token:${uid}`;
 	const cached = await cacheGet(cacheKey);
 	if (cached) return cached;
+	await ensurePolicy(`user-${uid}`, userPolicyHcl(uid));
 	const { token, ttl } = await mintToken([`user-${uid}`]);
 	await cacheSet(cacheKey, token, Math.max(ttl - 60, 60));
 	return token;
@@ -154,164 +107,47 @@ async function getOrCreateUserToken(uid) {
 
 // ── Admin token (read/write all of secret/) ─────────────────────────────────
 function adminPolicyHcl() {
-	return `path "secret/*" { capabilities = ["create", "read", "update", "delete", "list"] }
-path "secret" { capabilities = ["create", "read", "update", "delete", "list"] }
-path "secret/data/*" { capabilities = ["create", "read", "update", "delete", "list"] }
-path "secret/data" { capabilities = ["create", "read", "update", "delete", "list"] }
-path "secret/metadata" { capabilities = ["create", "read", "update", "delete", "list"] }
-path "secret/metadata/" { capabilities = ["create", "read", "update", "delete", "list"] }
-path "secret/metadata/*" { capabilities = ["create", "read", "update", "delete", "list"] }`;
+	// The bare `secret/metadata` / `secret/metadata/` grants let an admin LIST
+	// the KV mount root (the top-level dirs); `secret/metadata/*` covers nested
+	// paths but NOT the root itself, so without it the /vault secrets list 403s.
+	return `path "secret/data/*" { capabilities = ["create", "read", "update", "delete", "list"] }
+path "secret/metadata" { capabilities = ["list", "read", "delete"] }
+path "secret/metadata/" { capabilities = ["list", "read", "delete"] }
+path "secret/metadata/*" { capabilities = ["list", "read", "delete"] }`;
 }
 
 async function getOrCreateAdminToken(uid) {
-	await ensurePolicy('sso-admin', adminPolicyHcl());
 	const cacheKey = `vault_token:admin:${uid || 'global'}`;
 	const cached = await cacheGet(cacheKey);
 	if (cached) return cached;
+	await ensurePolicy('sso-admin', adminPolicyHcl());
 	const { token, ttl } = await mintToken(['sso-admin']);
 	await cacheSet(cacheKey, token, Math.max(ttl - 60, 60));
 	return token;
 }
 
 // ── Per-app token (minted ONCE, returned to the caller, never cached) ───────
-async function appPolicyHcl(name) {
-	const granted = await sharedPolicyRules('app', name);
-	return `path "secret/data/apps/${name}" { capabilities = ["create", "read", "update", "delete", "list"] }
-path "secret/data/apps/${name}/*" { capabilities = ["create", "read", "update", "delete", "list"] }
-path "secret/metadata/apps/${name}" { capabilities = ["create", "read", "update", "delete", "list"] }
-path "secret/metadata/apps/${name}/" { capabilities = ["create", "read", "update", "delete", "list"] }
-path "secret/metadata/apps/${name}/*" { capabilities = ["create", "read", "update", "delete", "list"] }
-${granted}`.trim();
+function appPolicyHcl(name) {
+	// The bare `secret/metadata/apps/<name>` grant lets an app LIST its own
+	// namespace root (see userPolicyHcl for why `/*` alone isn't enough).
+	return `path "secret/data/apps/${name}/*" { capabilities = ["create", "read", "update", "delete", "list"] }
+path "secret/metadata/apps/${name}" { capabilities = ["list", "read", "delete"] }
+path "secret/metadata/apps/${name}/*" { capabilities = ["list", "read", "delete"] }`;
 }
 
 // Create the app-<name> policy + mint a token for it. Returns the token ONCE
 // (the admin UI shows it with a copy button); it is not stored retrievably, so
 // a later compromise of an admin session cannot recover previously-minted app
-// tokens. The caller must record it in the external app immediately. Later
-// grants to the app edit app-<name> policy content (live-applied to this token).
-//
-// What IS stored is the token's ACCESSOR (VaultAppToken row): an accessor
-// cannot authenticate, but it lets the renewal loop below keep the (periodic)
-// token alive and lets a re-mint revoke the app's previous token so exactly
-// one credential per app is ever live.
-async function mintAppToken(name, actorUid) {
+// tokens. The caller must record it in the external app immediately.
+async function mintAppToken(name) {
 	if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(name)) {
 		throw new Error('invalid app name (lowercase letters, digits, hyphens; max 63 chars)');
 	}
-	await ensurePolicy(`app-${name}`, await appPolicyHcl(name));
-	// App tokens are long-lived credentials: mint via the sso-app role (768h
-	// period) so a renewal inside every 32-day window keeps them alive forever.
-	// Fall back to the broker's own 24h role on deployments whose setup.sh
-	// predates the sso-app role (re-running setup.sh creates it).
-	let minted;
-	try {
-		minted = await mintToken([`app-${name}`], 'sso-app');
-	} catch (e) {
-		console.warn(`vault_broker: sso-app token role unavailable (${e.message}); falling back to sso-broker (24h period). Re-run theta-env setup.sh to create the sso-app role.`);
-		minted = await mintToken([`app-${name}`]);
-	}
-	const { token, accessor, ttl } = minted;
-	// Replace the app's accessor row; revoke the superseded token (best-effort —
-	// it may already be expired) so re-minting never leaves a zombie credential.
-	try {
-		const existing = await VaultAppToken.getByName(name);
-		if (existing) {
-			await baoConf.request('POST', 'auth/token/revoke-accessor', { accessor: existing.accessor });
-			await existing.delete();
-		}
-		if (accessor) {
-			await VaultAppToken.create({
-				name, accessor,
-				lastRenewedAt: Date.now(),
-				created_by: actorUid, created_on: Date.now(),
-			});
-		}
-	} catch (e) {
-		// Accessor bookkeeping must never block handing the token out; without a
-		// row the token simply isn't auto-renewed (it still lives one full period).
-		console.error(`vault_broker: could not store accessor for app-${name}:`, e.message);
-	}
+	await ensurePolicy(`app-${name}`, appPolicyHcl(name));
+	const { token, ttl } = await mintToken([`app-${name}`]);
 	return { token, ttl, policy: `app-${name}`, path: `secret/apps/${name}/` };
 }
 
-// ── App-token renewal loop ──────────────────────────────────────────────────
-// Walks the stored accessors and renews each token (auth/token/renew-accessor),
-// resetting its periodic clock. Runs at boot and then every RENEW_INTERVAL_MS —
-// far inside both possible periods (24h fallback and 768h), so a downstream
-// app's token stays valid for as long as sso is running. Failures are recorded
-// on the row (visible to admins in the DB / future UI) and never throw.
-const RENEW_INTERVAL_MS = 6 * 60 * 60 * 1000; // 6h — several chances per 24h period
-let renewTimer;
-
-async function renewAppTokens() {
-	let rows;
-	try { rows = await VaultAppToken.list(); }
-	catch (e) { console.error('vault_broker: app-token renewal: could not list accessors:', e.message); return; }
-	for (const row of rows) {
-		try {
-			const res = await baoConf.request('POST', 'auth/token/renew-accessor', { accessor: row.accessor });
-			if (res.ok) {
-				await row.update({ lastRenewedAt: Date.now(), lastError: null });
-			} else {
-				const text = await res.text().catch(() => '');
-				// 400 "invalid accessor" = token expired or was revoked out-of-band;
-				// keep the row + error so the admin can see the app needs a re-mint.
-				await row.update({ lastError: `renew failed (${res.status}) ${text}` });
-				console.warn(`vault_broker: renew of app token '${row.name}' failed (${res.status}) — re-mint it from the vault UI if the app is still in use.`);
-			}
-		} catch (e) {
-			try { await row.update({ lastError: e.message }); } catch (e2) { /* best-effort */ }
-			console.error(`vault_broker: renew of app token '${row.name}' errored:`, e.message);
-		}
-	}
-}
-
-// Start the loop (idempotent). unref() so an open handle never blocks exit.
-function startAppTokenRenewal() {
-	if (renewTimer) return renewTimer;
-	renewAppTokens().catch((e) => console.error('vault_broker: initial app-token renewal failed:', e.message));
-	renewTimer = setInterval(() => {
-		renewAppTokens().catch((e) => console.error('vault_broker: app-token renewal failed:', e.message));
-	}, RENEW_INTERVAL_MS);
-	if (renewTimer.unref) renewTimer.unref();
-	return renewTimer;
-}
-
-// ── Grant / revoke shared-secret access ─────────────────────────────────────
-// Creating a grant writes the DB row and then edits the grantee's policy content
-// to add read on the shared path; revoking removes both. Because OpenBao parses
-// policy content live, the change applies to the grantee's existing token
-// immediately — no token re-mint, no cache invalidation needed.
-async function grantSharedSecret(secretId, granteeType, granteeId, actorUid) {
-	const grant = await SharedSecretGrant.create({
-		secretId, granteeType, granteeId, capability: 'read',
-		created_by: actorUid, created_on: Date.now(),
-		updated_by: actorUid, updated_on: Date.now(),
-	});
-	await reconcileGrantee(granteeType, granteeId);
-	return grant;
-}
-
-async function revokeSharedSecret(grantId, actorUid) {
-	const grant = await SharedSecretGrant.get(grantId);
-	if (!grant) return null;
-	const { granteeType, granteeId } = grant;
-	await grant.delete();
-	await reconcileGrantee(granteeType, granteeId);
-	return grant;
-}
-
-// Recompute and rewrite a grantee's policy content after a grant/revoke.
-async function reconcileGrantee(granteeType, granteeId) {
-	if (granteeType === 'user') {
-		await ensurePolicy(`user-${granteeId}`, await userPolicyHcl(granteeId));
-	} else if (granteeType === 'app') {
-		await ensurePolicy(`app-${granteeId}`, await appPolicyHcl(granteeId));
-	} else {
-		throw new Error(`invalid granteeType: ${granteeType}`);
-	}
-}
-
 // ── /api/vault proxy: scope guard + token-injecting proxy ───────────────────
 // Replaces the old bare pass-through (which sent no X-Vault-Token and gated
 // nothing). The guard mints a server-side token for the user (per-user or
@@ -320,12 +156,11 @@ async function reconcileGrantee(granteeType, granteeId) {
 // client's sso auth headers so OpenBao never sees them.
 
 const VAULT_ADDR = process.env.VAULT_ADDR || 'http://openbao:8200';
-const ADMIN_GROUPS = ['app_sso_admin', 'app_super_admin', 'app_sso_directory_admin'];
 const ADMIN_GROUP = 'app_sso_admin';
 
 async function isAdmin(user) {
 	try {
-		await permission.byGroup(user, ADMIN_GROUPS);
+		await permission.byGroup(user, [ADMIN_GROUP]);
 		return true;
 	} catch (e) {
 		return false;
@@ -354,13 +189,17 @@ async function scopeGuard(req, res, next) {
 		return res.status(503).json({ error: 'vault broker unavailable', detail: e.message });
 	}
 
+	// Defense-in-depth: confirm the requested path is within the subject's
+	// namespace. Admins roam all of secret/; users are confined to
+	// secret/users/<uid>/. (The token's own policy enforces the same at the
+	// OpenBao layer; this catches a buggy/malicious client early with a clear
+	// 403 instead of an opaque OpenBao denial.)
 	const norm = normalizeVaultPath(req.path);
 	if (norm === null) {
 		return res.status(403).json({ error: 'vault paths must be under /secret/' });
 	}
-	const userBase = `/secret/users/${uid}`;
-	const sharedBase = `/secret/shared`;
-	const allowed = admin || norm === userBase || norm.startsWith(userBase + '/') || norm === sharedBase || norm.startsWith(sharedBase + '/');
+	const base = `/secret/users/${uid}`;
+	const allowed = admin || norm === base || norm.startsWith(base + '/');
 	if (!allowed) {
 		return res.status(403).json({ error: 'path outside your vault namespace' });
 	}
@@ -375,20 +214,15 @@ function vaultProxy() {
 		target: VAULT_ADDR,
 		changeOrigin: true,
 		pathRewrite: { '^/api/vault': '/v1' },
-		// http-proxy-middleware v2 API: hooks are top-level onProxyReq/onError,
-		// NOT the v3 `on: { proxyReq }` shape. v2 silently ignores an `on` key,
-		// which shipped this proxy with NO token injection — every /api/vault
-		// call reached OpenBao unauthenticated and 403'd.
-		onProxyReq(proxyReq, req, res, options) {
-			// Header ops MUST precede fixRequestBody: it write()s the parsed body
-			// onto proxyReq, which flushes headers — setHeader after that throws
-			// (swallowed upstream), silently dropping the token on every write.
-			// Inject ONLY the server-minted scoped token; strip the client's
-			// sso session/api auth so it never reaches OpenBao.
-			proxyReq.setHeader('X-Vault-Token', req.vaultToken);
-			proxyReq.removeHeader('auth-token');
-			proxyReq.removeHeader('authorization');
-			fixRequestBody(proxyReq, req, res, options);
+		on: {
+			proxyReq(proxyReq, req, res, options) {
+				fixRequestBody(proxyReq, req, res, options);
+				// Inject ONLY the server-minted scoped token; strip the client's
+				// sso session/api auth so it never reaches OpenBao.
+				proxyReq.setHeader('X-Vault-Token', req.vaultToken);
+				proxyReq.removeHeader('auth-token');
+				proxyReq.removeHeader('authorization');
+			},
 		},
 	});
 }
@@ -402,7 +236,7 @@ mintAppRouter.post('/', async (req, res, next) => {
 		await permission.byGroup(req.user, [ADMIN_GROUP]);
 		const name = (req.body && req.body.name || '').trim();
 		if (!name) return res.status(400).json({ error: 'name is required' });
-		const result = await mintAppToken(name, req.user && req.user.uid);
+		const result = await mintAppToken(name);
 		res.json(result);
 	} catch (e) {
 		if (e.status === 401) return res.status(403).json({ error: 'admin only' });
@@ -410,27 +244,6 @@ mintAppRouter.post('/', async (req, res, next) => {
 	}
 });
 
-// List the minted external-app tokens (metadata only — the token itself is shown
-// once at mint and never stored; the accessor is a renewal/revoke handle and is
-// never exposed). Lets the Apps tab show what has been minted instead of a
-// credential vanishing into the void.
-mintAppRouter.get('/', async (req, res, next) => {
-	try {
-		await permission.byGroup(req.user, [ADMIN_GROUP]);
-		const rows = await VaultAppToken.list();
-		res.json({ apps: rows.map((r) => ({
-			name: r.name,
-			createdBy: r.created_by,
-			createdOn: r.created_on,
-			lastRenewedAt: r.lastRenewedAt || null,
-			lastError: r.lastError || null,
-		})) });
-	} catch (e) {
-		if (e.status === 401) return res.status(403).json({ error: 'admin only' });
-		next(e);
-	}
-});
-
 module.exports = {
 	getOrCreateUserToken,
 	getOrCreateAdminToken,
@@ -439,16 +252,4 @@ module.exports = {
 	scopeGuard,
 	vaultProxy,
 	mintAppRouter,
-	// app-token lifecycle
-	renewAppTokens,
-	startAppTokenRenewal,
-	VaultAppToken,
-	// sharing
-	SharedSecret,
-	SharedSecretGrant,
-	userPolicyHcl,
-	appPolicyHcl,
-	grantSharedSecret,
-	revokeSharedSecret,
-	reconcileGrantee,
-};
+};

nodejs/views/conf.ejs

@@ -1,16 +1,11 @@
 <%- include('top') %>
-
 <script type="text/javascript">
 	app.auth.forceLogin(['admin', 'app_sso_admin']);
 
-	var messagingTypes = {};
-	var messagingPlugins = [];
-
 	$(document).ready(function() {
 		loadConf();
 		loadProxyConf();
 		loadTos();
-		loadMessagingPlugins();
 	});
 
 	async function loadConf() {
@@ -49,7 +44,7 @@
 
 	async function saveConf() {
 		const btn = $('#btn-save');
-		btn.prop('disabled', true).html('<i class="fas fa-spinner fa-spin me-1"></i> Saving...');
+		btn.prop('disabled', true).html('<i class="fas fa-spinner fa-spin"></i> Saving...');
 
 		const payload = {
 			smtp: {
@@ -77,11 +72,11 @@
 
 		try {
 			await app.api.post('conf', payload);
-			app.messages.toast('Configuration saved successfully!', 'success');
+			app.messages.toast('Configuration saved successfully! It will take effect immediately.', 'success');
 		} catch (error) {
 			app.messages.toast('Failed to save configuration: ' + error.message, 'danger');
 		} finally {
-			btn.prop('disabled', false).html('<i class="fas fa-save me-1"></i> Save Configuration');
+			btn.prop('disabled', false).html('<i class="fas fa-save"></i> Save Configuration');
 		}
 	}
 
@@ -92,11 +87,13 @@
 			return;
 		}
 
-		const btn = $('#btn-test-email');
+		const $inputGroup = $('#test-email-to').closest('.input-group');
+		const btn = $inputGroup.find('button');
 		const originalHtml = btn.html();
-		btn.prop('disabled', true).html('<i class="fas fa-spinner fa-spin me-1"></i> Sending...');
+		btn.prop('disabled', true).html('<i class="fas fa-spinner fa-spin"></i> Sending...');
 
 		try {
+			// First save the SMTP config, then send test email
 			const payload = {
 				smtp: {
 					host: $('#smtp-host').val(),
@@ -107,7 +104,11 @@
 					secure: $('#smtp-secure').is(':checked')
 				}
 			};
+
+			// Save config first
 			await app.api.post('conf', payload);
+
+			// Then send test email
 			const result = await app.api.post('conf/test-email', { to });
 			app.messages.toast(result.message || 'Test email sent!', 'success');
 			$('#test-email-to').val('');
@@ -125,11 +126,13 @@
 			return;
 		}
 
-		const btn = $('#btn-test-sms');
+		const $inputGroup = $('#test-sms-to').closest('.input-group');
+		const btn = $inputGroup.find('button');
 		const originalHtml = btn.html();
-		btn.prop('disabled', true).html('<i class="fas fa-spinner fa-spin me-1"></i> Sending...');
+		btn.prop('disabled', true).html('<i class="fas fa-spinner fa-spin"></i> Sending...');
 
 		try {
+			// First save the VoIP.ms config, then send test SMS
 			const payload = {
 				voipms: {
 					username: $('#voipms-username').val(),
@@ -137,7 +140,11 @@
 					password: $('#voipms-password').val()
 				}
 			};
+
+			// Save config first
 			await app.api.post('conf', payload);
+
+			// Then send test SMS
 			const result = await app.api.post('conf/test-sms', { to });
 			app.messages.toast(result.message || 'Test SMS sent!', 'success');
 			$('#test-sms-to').val('');
@@ -175,7 +182,7 @@
 
 	async function saveProxyConf() {
 		const btn = $('#btn-save-proxy');
-		btn.prop('disabled', true).html('<i class="fas fa-spinner fa-spin me-1"></i> Saving...');
+		btn.prop('disabled', true).html('<i class="fas fa-spinner fa-spin"></i> Saving...');
 		
 		const payload = {
 			oidc: {
@@ -194,18 +201,22 @@
 		} catch (error) {
 			app.messages.toast('Failed to save Proxy configuration: ' + error.message, 'danger');
 		} finally {
-			btn.prop('disabled', false).html('<i class="fas fa-save me-1"></i> Save Proxy Secrets');
+			btn.prop('disabled', false).html('<i class="fas fa-save"></i> Save Proxy Secrets');
 		}
 	}
 
+	// ── Terms of Service editor ──────────────────────────────────────────
+	// Moved here from the admin Overview dashboard — it's a configuration
+	// control, so it belongs on the System Configuration page. The API is
+	// routes/tos.js (GET to read, PUT to save; PUT is app_sso_admin-gated, which
+	// matches this page's gate). app.tos.get/update are the shared frontend
+	// helpers (@simpleworkjs/frontend).
 	async function loadTos() {
 		try {
 			const tos = await app.tos.get();
-			if (tos && tos.content) {
-				document.getElementById('tos-content').value = tos.content;
-				document.getElementById('tos-meta').textContent =
-					'Last updated ' + moment(tos.updated_on, 'x').fromNow() + ' by ' + tos.updated_by;
-			}
+			document.getElementById('tos-content').value = tos.content;
+			document.getElementById('tos-meta').textContent =
+				'Last updated ' + moment(tos.updated_on, 'x').fromNow() + ' by ' + tos.updated_by;
 		} catch(e) {
 			console.error('Failed to load ToS:', e);
 		}
@@ -237,287 +248,246 @@
 			loadTos();
 		});
 	}
-
-	// ── Messaging Plugins ──────────────────────────────────────────────
-	function loadMessagingPlugins() {
-		app.api.get('plugins/types', function(err, res) {
-			if (!err && res && res.results) {
-				(res.results || []).forEach(t => { messagingTypes[t.type] = t; });
-			}
-			app.api.get('plugins', function(err, res) {
-				if (err) return;
-				messagingPlugins = (res.results || []).filter(p => p.category === 'messaging');
-				renderMessagingPlugins();
-			});
-		});
-	}
-
-	function renderMessagingPlugins() {
-		const $list = $('#messaging-plugins-list').empty();
-		if (messagingPlugins.length === 0) {
-			$list.append('<div class="text-muted text-center py-4"><i class="fas fa-plug text-black-50 fs-2 mb-2"></i><br>No messaging plugins configured.</div>');
-			return;
-		}
-		messagingPlugins.forEach(p => {
-			const badgeClass = p.enabled ? 'bg-success' : 'bg-secondary';
-			const statusText = p.enabled ? 'Loaded' : 'Unloaded';
-			const card = `
-				<div class="card mb-3 border shadow-sm">
-					<div class="card-body d-flex align-items-center justify-content-between">
-						<div>
-							<h6 class="mb-1"><strong>${p.name}</strong> <span class="badge bg-secondary ms-2">${p.pluginType}</span></h6>
-							<div class="small text-muted font-monospace">${p.slug} | Schedule: ${p.cron}</div>
-						</div>
-						<div class="d-flex align-items-center gap-2">
-							<span class="badge ${badgeClass} me-2">${statusText}</span>
-							<button class="btn btn-sm btn-outline-primary" onclick="togglePlugin('${p.id}', ${!p.enabled})">${p.enabled ? 'Unload' : 'Load'}</button>
-							<button class="btn btn-sm btn-outline-danger" onclick="deletePlugin('${p.id}')"><i class="fas fa-trash"></i></button>
-						</div>
-					</div>
-				</div>
-			`;
-			$list.append(card);
-		});
-	}
-
-	async function togglePlugin(id, state) {
-		const endpoint = state ? 'load' : 'unload';
-		try {
-			await app.api.post(`plugins/${id}/${endpoint}`, {});
-			app.messages.toast(`Plugin ${state ? 'loaded' : 'unloaded'} successfully`, 'success');
-			loadMessagingPlugins();
-		} catch (e) {
-			app.messages.toast('Error toggling plugin: ' + e.message, 'danger');
-		}
-	}
-
-	async function deletePlugin(id) {
-		const ok = await app.messages.confirm('Are you sure you want to delete this plugin instance?');
-		if (!ok) return;
-		try {
-			await app.api.delete(`plugins/${id}`);
-			app.messages.toast('Plugin deleted', 'success');
-			loadMessagingPlugins();
-		} catch (e) {
-			app.messages.toast('Error deleting plugin: ' + e.message, 'danger');
-		}
-	}
 </script>
 
-<div class="container mt-4">
-	<div class="row">
-		<div class="col-12">
-			<div class="card shadow">
-				<!-- Header with Sub-Nav Tabs matching directory.ejs -->
-				<div class="card-header d-flex flex-wrap justify-content-between align-items-center gap-2">
-					<ul class="nav nav-tabs card-header-tabs" id="confTabs" role="tablist">
-						<li class="nav-item" role="presentation">
-							<button class="nav-link active" id="oauth-tab" data-bs-toggle="tab" data-bs-target="#pane-oauth" type="button" role="tab">
-								<i class="fas fa-key text-success me-1"></i> OAuth & JWT
+<div class="container py-4">
+	<div class="row mb-4">
+		<div class="col d-flex justify-content-between align-items-center">
+			<div>
+				<h2><i class="fas fa-cogs"></i> System Configuration</h2>
+				<p class="text-muted mb-0">
+					Manage runtime configuration such as SMTP, SMS, OAuth, and Terms of Service
+					settings. These are stored securely in OpenBao and take effect immediately.
+					Secret fields (the SMTP password, OAuth JWT secret, and VoIP.ms API password)
+					are masked — leave them unchanged to keep the stored value.
+				</p>
+			</div>
+			<div>
+				<button class="btn btn-secondary me-2" onclick="loadConf()"><i class="fas fa-undo"></i> Reset</button>
+				<button id="btn-save" class="btn btn-primary" onclick="saveConf()"><i class="fas fa-save"></i> Save Configuration</button>
+			</div>
+		</div>
+	</div>
+
+	<ul class="nav nav-tabs mb-4" id="confTabs" role="tablist">
+		<li class="nav-item" role="presentation">
+			<button class="nav-link active" id="smtp-tab" data-bs-toggle="tab" data-bs-target="#smtp" type="button" role="tab">SMTP Settings</button>
+		</li>
+		<li class="nav-item" role="presentation">
+			<button class="nav-link" id="oauth-tab" data-bs-toggle="tab" data-bs-target="#oauth" type="button" role="tab">OAuth & JWT</button>
+		</li>
+		<li class="nav-item" role="presentation">
+			<button class="nav-link" id="sms-tab" data-bs-toggle="tab" data-bs-target="#sms" type="button" role="tab">SMS (VoIP.ms)</button>
+		</li>
+		<li class="nav-item" role="presentation">
+			<button class="nav-link" id="tos-tab" data-bs-toggle="tab" data-bs-target="#tos" type="button" role="tab">Terms of Service</button>
+		</li>
+		<li class="nav-item" role="presentation">
+			<button class="nav-link" id="proxy-tab" data-bs-toggle="tab" data-bs-target="#proxy" type="button" role="tab">Proxy Secrets</button>
+		</li>
+	</ul>
+
+	<div class="tab-content" id="confTabsContent">
+		<!-- SMTP Tab -->
+		<div class="tab-pane fade show active" id="smtp" role="tabpanel">
+			<div class="card shadow-sm border-0 mb-4">
+				<div class="card-header bg-white border-bottom-0 pt-4 pb-0">
+					<h5 class="mb-0"><i class="fas fa-envelope text-primary me-2"></i> SMTP Settings</h5>
+				</div>
+				<div class="card-body">
+					<div class="mb-3">
+						<label class="form-label">Host</label>
+						<input type="text" class="form-control" id="smtp-host">
+					</div>
+					<div class="mb-3">
+						<label class="form-label">Port</label>
+						<input type="number" class="form-control" id="smtp-port">
+					</div>
+					<div class="mb-3">
+						<label class="form-label">User</label>
+						<input type="text" class="form-control" id="smtp-user">
+					</div>
+					<div class="mb-3">
+						<label class="form-label">Password</label>
+						<div class="input-group">
+							<input type="password" class="form-control" id="smtp-pass" placeholder="********">
+							<button class="btn btn-outline-secondary" type="button" onclick="togglePassword('smtp-pass')"><i class="fas fa-eye"></i></button>
+						</div>
+						<div class="form-text">Leave unchanged to keep the current password stored in OpenBao. Clear and type a new value to replace it.</div>
+					<hr class="my-4">
+					<div class="mb-3">
+						<label class="form-label">Send Test SMS</label>
+						<div class="input-group">
+							<input type="tel" class="form-control" id="test-sms-to" placeholder="+15551234567">
+							<button class="btn btn-outline-primary" type="button" onclick="sendTestSms()">
+								<i class="fas fa-paper-plane"></i> Send Test SMS
 							</button>
-						</li>
-						<li class="nav-item" role="presentation">
-							<button class="nav-link" id="smtp-tab" data-bs-toggle="tab" data-bs-target="#pane-smtp" type="button" role="tab">
-								<i class="fas fa-envelope text-primary me-1"></i> Email (SMTP)
+						</div>
+						<div class="form-text">Send a test SMS to verify your VoIP.ms configuration is working.</div>
+					</div>
+					</div>
+					<hr class="my-4">
+					<div class="mb-3">
+						<label class="form-label">Send Test SMS</label>
+						<div class="input-group">
+							<input type="tel" class="form-control" id="test-sms-to" placeholder="+15551234567">
+							<button class="btn btn-outline-primary" type="button" onclick="sendTestSms()">
+								<i class="fas fa-paper-plane"></i> Send Test SMS
 							</button>
-						</li>
-						<li class="nav-item" role="presentation">
-							<button class="nav-link" id="sms-tab" data-bs-toggle="tab" data-bs-target="#pane-sms" type="button" role="tab">
-								<i class="fas fa-comment-sms text-info me-1"></i> SMS & Messaging
-							</button>
-						</li>
-						<li class="nav-item" role="presentation">
-							<button class="nav-link" id="proxy-tab" data-bs-toggle="tab" data-bs-target="#pane-proxy" type="button" role="tab">
-								<i class="fas fa-shield-alt text-warning me-1"></i> Proxy Secrets
-							</button>
-						</li>
-						<li class="nav-item" role="presentation">
-							<button class="nav-link" id="tos-tab" data-bs-toggle="tab" data-bs-target="#pane-tos" type="button" role="tab">
-								<i class="fas fa-file-contract text-secondary me-1"></i> Terms of Service
-							</button>
-						</li>
-					</ul>
-					<div>
-						<button class="btn btn-sm btn-outline-secondary me-1" onclick="loadConf()"><i class="fas fa-rotate me-1"></i> Reset</button>
-						<button id="btn-save" class="btn btn-sm btn-primary" onclick="saveConf()"><i class="fas fa-save me-1"></i> Save Configuration</button>
+						</div>
+						<div class="form-text">Send a test SMS to verify your VoIP.ms configuration is working.</div>
+					</div>
+					<div class="mb-3">
+						<label class="form-label">From Address</label>
+						<input type="text" class="form-control" id="smtp-from">
+					</div>
+					<div class="form-check">
+						<input class="form-check-input" type="checkbox" id="smtp-secure">
+						<label class="form-check-label">Use Secure (TLS)</label>
+					</div>
+						<hr class="my-4">
+						<div class="mb-3">
+							<label class="form-label">Send Test Email</label>
+							<div class="input-group">
+								<input type="email" class="form-control" id="test-email-to" placeholder="recipient@example.com">
+								<button class="btn btn-outline-primary" type="button" onclick="sendTestEmail()">
+									<i class="fas fa-paper-plane"></i> Send Test Email
+								</button>
+							</div>
+							<div class="form-text">Send a test email to verify your SMTP configuration is working.</div>
+						</div>
+				</div>
+			</div>
+		</div>
+
+		<!-- OAuth Tab -->
+		<div class="tab-pane fade" id="oauth" role="tabpanel">
+			<div class="card shadow-sm border-0 mb-4">
+				<div class="card-header bg-white border-bottom-0 pt-4 pb-0">
+					<h5 class="mb-0"><i class="fas fa-key text-success me-2"></i> OAuth & JWT Settings</h5>
+				</div>
+				<div class="card-body">
+					<div class="mb-3">
+						<label class="form-label">Issuer URL</label>
+						<input type="text" class="form-control" id="oauth-issuer">
+					</div>
+					<div class="mb-3">
+						<label class="form-label">JWT Secret</label>
+						<div class="input-group">
+							<input type="password" class="form-control" id="oauth-jwtsecret" placeholder="********">
+							<button class="btn btn-outline-secondary" type="button" onclick="togglePassword('oauth-jwtsecret')"><i class="fas fa-eye"></i></button>
+						</div>
+						<div class="form-text">Leave unchanged to keep the current secret stored in OpenBao. Clear and type a new value to replace it.</div>
+					</div>
+					<div class="mb-3">
+						<label class="form-label">Access Token Lifetime (seconds)</label>
+						<input type="number" class="form-control" id="oauth-token-access">
+					</div>
+					<div class="mb-3">
+						<label class="form-label">Refresh Token Lifetime (seconds)</label>
+						<input type="number" class="form-control" id="oauth-token-refresh">
 					</div>
 				</div>
+			</div>
+		</div>
 
-				<div class="card-body p-4">
-					<div class="tab-content" id="confTabContent">
-						
-						<!-- OAuth & JWT Tab -->
-						<div class="tab-pane fade show active" id="pane-oauth" role="tabpanel">
-							<h5 class="fw-bold mb-3"><i class="fas fa-key text-success me-2"></i> OAuth 2.0 & JWT Settings</h5>
-							<p class="text-muted small">Configure OIDC issuer URLs, token lifetimes, and JWT signing keys. Stored in OpenBao.</p>
-							<div class="mb-3">
-								<label class="form-label fw-semibold">Issuer URL</label>
-								<input type="text" class="form-control" id="oauth-issuer" placeholder="https://sso.example.com">
-							</div>
-							<div class="mb-3">
-								<label class="form-label fw-semibold">JWT Secret</label>
-								<div class="input-group">
-									<input type="password" class="form-control" id="oauth-jwtsecret" placeholder="********">
-									<button class="btn btn-outline-secondary" type="button" onclick="togglePassword('oauth-jwtsecret')"><i class="fas fa-eye"></i></button>
-								</div>
-								<div class="form-text">Stored in OpenBao. Leave unchanged to preserve stored value.</div>
-							</div>
-							<div class="row">
-								<div class="col-md-6 mb-3">
-									<label class="form-label fw-semibold">Access Token Lifetime (seconds)</label>
-									<input type="number" class="form-control" id="oauth-token-access" placeholder="3600">
-								</div>
-								<div class="col-md-6 mb-3">
-									<label class="form-label fw-semibold">Refresh Token Lifetime (seconds)</label>
-									<input type="number" class="form-control" id="oauth-token-refresh" placeholder="2592000">
-								</div>
-							</div>
-						</div>
-
-						<!-- SMTP Tab -->
-						<div class="tab-pane fade" id="pane-smtp" role="tabpanel">
-							<h5 class="fw-bold mb-3"><i class="fas fa-envelope text-primary me-2"></i> SMTP Server Settings</h5>
-							<p class="text-muted small">System mail server credentials for password resets, notifications, and verification emails.</p>
-							<div class="row">
-								<div class="col-md-8 mb-3">
-									<label class="form-label fw-semibold">SMTP Host</label>
-									<input type="text" class="form-control" id="smtp-host" placeholder="smtp.example.com">
-								</div>
-								<div class="col-md-4 mb-3">
-									<label class="form-label fw-semibold">Port</label>
-									<input type="number" class="form-control" id="smtp-port" placeholder="587">
-								</div>
-							</div>
-							<div class="row">
-								<div class="col-md-6 mb-3">
-									<label class="form-label fw-semibold">User</label>
-									<input type="text" class="form-control" id="smtp-user">
-								</div>
-								<div class="col-md-6 mb-3">
-									<label class="form-label fw-semibold">Password</label>
-									<div class="input-group">
-										<input type="password" class="form-control" id="smtp-pass" placeholder="********">
-										<button class="btn btn-outline-secondary" type="button" onclick="togglePassword('smtp-pass')"><i class="fas fa-eye"></i></button>
-									</div>
-								</div>
-							</div>
-							<div class="mb-3">
-								<label class="form-label fw-semibold">From Address</label>
-								<input type="text" class="form-control" id="smtp-from" placeholder="noreply@example.com">
-							</div>
-							<div class="form-check mb-4">
-								<input class="form-check-input" type="checkbox" id="smtp-secure">
-								<label class="form-check-label fw-semibold" for="smtp-secure">Use Secure TLS Connection</label>
-							</div>
-
-							<div class="p-3 bg-light rounded border">
-								<h6 class="fw-bold mb-2"><i class="fas fa-paper-plane text-primary me-2"></i> Send Test Email</h6>
-								<div class="input-group">
-									<input type="email" class="form-control" id="test-email-to" placeholder="recipient@example.com">
-									<button id="btn-test-email" class="btn btn-outline-primary" type="button" onclick="sendTestEmail()">
-										<i class="fas fa-paper-plane me-1"></i> Send Test Email
-									</button>
-								</div>
-								<div class="form-text">Saves current SMTP config and sends a test message.</div>
-							</div>
-						</div>
-
-						<!-- SMS & Messaging Tab -->
-						<div class="tab-pane fade" id="pane-sms" role="tabpanel">
-							<h5 class="fw-bold mb-3"><i class="fas fa-comment-sms text-info me-2"></i> VoIP.ms SMS Integration</h5>
-							<p class="text-muted small">Configure VoIP.ms API credentials for delivering SMS 2FA codes.</p>
-							<div class="row">
-								<div class="col-md-6 mb-3">
-									<label class="form-label fw-semibold">API Username</label>
-									<input type="text" class="form-control" id="voipms-username">
-								</div>
-								<div class="col-md-6 mb-3">
-									<label class="form-label fw-semibold">DID Sender Number</label>
-									<input type="text" class="form-control" id="voipms-did" placeholder="15551234567">
-								</div>
-							</div>
-							<div class="mb-3">
-								<label class="form-label fw-semibold">API Password</label>
-								<div class="input-group">
-									<input type="password" class="form-control" id="voipms-password" placeholder="********">
-									<button class="btn btn-outline-secondary" type="button" onclick="togglePassword('voipms-password')"><i class="fas fa-eye"></i></button>
-								</div>
-							</div>
-
-							<div class="p-3 bg-light rounded border mb-4">
-								<h6 class="fw-bold mb-2"><i class="fas fa-paper-plane text-info me-2"></i> Send Test SMS</h6>
-								<div class="input-group">
-									<input type="tel" class="form-control" id="test-sms-to" placeholder="+15551234567">
-									<button id="btn-test-sms" class="btn btn-outline-info" type="button" onclick="sendTestSms()">
-										<i class="fas fa-paper-plane me-1"></i> Send Test SMS
-									</button>
-								</div>
-							</div>
-
-							<hr class="my-4">
-
-							<div class="d-flex justify-content-between align-items-center mb-3">
-								<h5 class="mb-0 fw-bold"><i class="fas fa-plug text-primary me-2"></i> Messaging Plugins & Webhooks</h5>
-								<button class="btn btn-sm btn-outline-primary" onclick="loadMessagingPlugins()"><i class="fas fa-rotate"></i> Refresh</button>
-							</div>
-							<div id="messaging-plugins-list"></div>
-						</div>
-
-						<!-- Proxy Secrets Tab -->
-						<div class="tab-pane fade" id="pane-proxy" role="tabpanel">
-							<h5 class="fw-bold mb-3"><i class="fas fa-shield-alt text-warning me-2"></i> OpenBao Proxy Integration</h5>
-							<p class="text-muted small">Secrets stored directly in OpenBao (<code>secret/proxy/conf</code>) and consumed by Proxy at boot.</p>
-							
-							<h6 class="fw-bold text-dark mt-3 mb-2">OAuth / OIDC Client</h6>
-							<div class="mb-3">
-								<label class="form-label fw-semibold">Issuer URL</label>
-								<input type="text" class="form-control" id="proxy-issuer" placeholder="https://sso.example.com">
-							</div>
-							<div class="row">
-								<div class="col-md-6 mb-3">
-									<label class="form-label fw-semibold">Client ID</label>
-									<input type="text" class="form-control" id="proxy-client-id">
-								</div>
-								<div class="col-md-6 mb-3">
-									<label class="form-label fw-semibold">Client Secret</label>
-									<div class="input-group">
-										<input type="password" class="form-control" id="proxy-client-secret" placeholder="********">
-										<button class="btn btn-outline-secondary" type="button" onclick="togglePassword('proxy-client-secret')"><i class="fas fa-eye"></i></button>
-									</div>
-								</div>
-							</div>
-
-							<h6 class="fw-bold text-dark mt-4 mb-2">LDAP Bind Account</h6>
-							<div class="mb-3">
-								<label class="form-label fw-semibold">Proxy Bind Password</label>
-								<div class="input-group">
-									<input type="password" class="form-control" id="proxy-ldap-bindpass" placeholder="********">
-									<button class="btn btn-outline-secondary" type="button" onclick="togglePassword('proxy-ldap-bindpass')"><i class="fas fa-eye"></i></button>
-								</div>
-							</div>
-
-							<button id="btn-save-proxy" class="btn btn-warning mt-2 text-dark fw-semibold" onclick="saveProxyConf()"><i class="fas fa-save me-1"></i> Save Proxy Secrets</button>
-						</div>
-
-						<!-- Terms of Service Tab -->
-						<div class="tab-pane fade" id="pane-tos" role="tabpanel">
-							<div class="d-flex justify-content-between align-items-center mb-3">
-								<h5 class="fw-bold mb-0"><i class="fas fa-file-contract me-2"></i> Terms of Service Editor</h5>
-								<span class="small text-muted" id="tos-meta"></span>
-							</div>
-							<div class="mb-3">
-								<label class="form-label fw-semibold">Terms Content (Markdown)</label>
-								<textarea class="form-control font-monospace" id="tos-content" rows="10" placeholder="Enter Terms of Service markdown content..."></textarea>
-							</div>
-							<div class="form-check mb-4">
-								<input class="form-check-input" type="checkbox" id="tos-reset-acceptance">
-								<label class="form-check-label fw-semibold" for="tos-reset-acceptance">Require all users to re-accept these terms upon next login</label>
-							</div>
-							<button class="btn btn-primary" onclick="saveTos()"><i class="fas fa-floppy-disk me-1"></i> Save Terms of Service</button>
-							<div id="tos-result" style="display:none" class="mt-3"></div>
-						</div>
-
+		<!-- SMS Tab -->
+		<div class="tab-pane fade" id="sms" role="tabpanel">
+			<div class="card shadow-sm border-0 mb-4">
+				<div class="card-header bg-white border-bottom-0 pt-4 pb-0">
+					<h5 class="mb-0"><i class="fas fa-comment text-info me-2"></i> SMS (VoIP.ms)</h5>
+				</div>
+				<div class="card-body">
+					<p class="form-text">Used to deliver SMS 2FA login codes. The API password is stored in OpenBao and masked below.</p>
+					<div class="mb-3">
+						<label class="form-label">API Username</label>
+						<input type="text" class="form-control" id="voipms-username">
 					</div>
+					<div class="mb-3">
+						<label class="form-label">DID (sender number)</label>
+						<input type="text" class="form-control" id="voipms-did" placeholder="15551234567">
+					</div>
+					<div class="mb-3">
+						<label class="form-label">API Password</label>
+						<div class="input-group">
+							<input type="password" class="form-control" id="voipms-password" placeholder="********">
+							<button class="btn btn-outline-secondary" type="button" onclick="togglePassword('voipms-password')"><i class="fas fa-eye"></i></button>
+						</div>
+						<div class="form-text">Leave unchanged to keep the current password stored in OpenBao. Clear and type a new value to replace it.</div>
+					<hr class="my-4">
+					<div class="mb-3">
+						<label class="form-label">Send Test SMS</label>
+						<div class="input-group">
+							<input type="tel" class="form-control" id="test-sms-to" placeholder="+15551234567">
+							<button class="btn btn-outline-primary" type="button" onclick="sendTestSms()">
+								<i class="fas fa-paper-plane"></i> Send Test SMS
+							</button>
+						</div>
+						<div class="form-text">Send a test SMS to verify your VoIP.ms configuration is working.</div>
+					</div>
+				</div>
+			</div>
+		</div>
+
+		<!-- Proxy Secrets Tab -->
+		<div class="tab-pane fade" id="proxy" role="tabpanel">
+			<div class="card shadow-sm border-0 mb-4">
+				<div class="card-header bg-white border-bottom-0 pt-4 pb-0">
+					<h5 class="mb-0"><i class="fas fa-shield-alt text-warning me-2"></i> Proxy Secrets (OpenBao)</h5>
+				</div>
+				<div class="card-body">
+					<p class="form-text">These secrets are stored directly in OpenBao (`secret/proxy/conf`) and read by the Proxy at boot.</p>
+					
+					<h6 class="mt-3 mb-2">OAuth / OIDC Integration</h6>
+					<div class="mb-3">
+						<label class="form-label">Issuer URL</label>
+						<input type="text" class="form-control" id="proxy-issuer" placeholder="https://sso.example.com">
+					</div>
+					<div class="mb-3">
+						<label class="form-label">Client ID</label>
+						<input type="text" class="form-control" id="proxy-client-id">
+					</div>
+					<div class="mb-3">
+						<label class="form-label">Client Secret</label>
+						<div class="input-group">
+							<input type="password" class="form-control" id="proxy-client-secret" placeholder="********">
+							<button class="btn btn-outline-secondary" type="button" onclick="togglePassword('proxy-client-secret')"><i class="fas fa-eye"></i></button>
+						</div>
+					</div>
+
+					<h6 class="mt-4 mb-2">LDAP Integration</h6>
+					<div class="mb-3">
+						<label class="form-label">Bind Password</label>
+						<div class="input-group">
+							<input type="password" class="form-control" id="proxy-ldap-bindpass" placeholder="********">
+							<button class="btn btn-outline-secondary" type="button" onclick="togglePassword('proxy-ldap-bindpass')"><i class="fas fa-eye"></i></button>
+						</div>
+						<div class="form-text">Password for the Proxy's LDAP service account.</div>
+					</div>
+
+					<button id="btn-save-proxy" class="btn btn-warning mt-2" onclick="saveProxyConf()"><i class="fas fa-save"></i> Save Proxy Secrets</button>
+				</div>
+			</div>
+		</div>
+
+		<!-- ToS Tab -->
+		<div class="tab-pane fade" id="tos" role="tabpanel">
+			<div class="card shadow-sm border-0 mb-4">
+				<div class="card-header bg-white border-bottom-0 pt-4 pb-0 d-flex justify-content-between align-items-center">
+					<h5 class="mb-0"><i class="fas fa-file-contract me-2"></i> Terms of Service</h5>
+					<small class="text-muted" id="tos-meta"></small>
+				</div>
+				<div class="card-body">
+					<div class="mb-3">
+						<label class="form-label">Content <small class="text-muted">(Markdown)</small></label>
+						<textarea class="form-control" id="tos-content" rows="8"></textarea>
+					</div>
+					<div class="form-check mb-3">
+						<input class="form-check-input" type="checkbox" id="tos-reset-acceptance">
+						<label class="form-check-label" for="tos-reset-acceptance">Require all users to re-accept these terms</label>
+					</div>
+					<button class="btn btn-primary" onclick="saveTos()"><i class="fas fa-floppy-disk"></i> Save Terms</button>
+					<div id="tos-result" style="display:none" class="mt-2"></div>
 				</div>
 			</div>
 		</div>

nodejs/views/groups.ejs

@@ -0,0 +1,406 @@
+<%- include('top') %>
+
+<script type="text/javascript">
+	var userlist;
+	var allGroups = [];
+
+	// A member DN under the groups base is a nested group, not a person. Both
+	// live in the same `member` attribute, so they have to be told apart here --
+	// otherwise a nested group renders as a user whose name happens to be the
+	// group's, and its remove button calls the user endpoint and 404s.
+	function isGroupDn(dn){
+		return /,ou=groups,/i.test(String(dn));
+	}
+
+	function processGroup(value){
+		if (!Array.isArray(value.member)) value.member = value.member ? [value.member] : [];
+		if (!Array.isArray(value.owner))  value.owner  = value.owner  ? [value.owner]  : [];
+
+		// Split before anything else consumes `member`.
+		value.nested = value.member.filter(isGroupDn).map(function(dn){
+			return {
+				dn: dn,
+				cn: dn.match(/cn=[^,]+/)[0].replace('cn=', ''),
+				groupCN: value.cn
+			};
+		});
+		value.member = value.member.filter(function(dn){ return !isGroupDn(dn); });
+		value.nestedCount = value.nested.length;
+		value.hasNested = value.nestedCount > 0;
+
+		// Candidates to nest: every other group not already nested here. Self is
+		// excluded; deeper loops are refused server-side by Group.wouldCycle,
+		// which is the only place that can see the whole graph.
+		var nestedDns = value.nested.map(function(g){ return g.dn.toLowerCase(); });
+		value.toNest = allGroups.filter(function(g){
+			return g.cn !== value.cn && nestedDns.indexOf(String(g.dn).toLowerCase()) === -1;
+		}).map(function(g){ return {cn: g.cn, groupCN: value.cn}; });
+
+		value.toAdd = userlist.filter(function(user){
+			return !value.member.includes(user.dn);
+		});
+		value.toAddOwner = userlist.filter(function(user){
+			return !value.owner.includes(user.dn);
+		});
+		value.member = value.member.map(function(user){
+			return {
+				dn: user,
+				uid: user.match(/cn=[a-zA-Z0-9\_\-\@\.]+/)[0].replace('cn=', '')
+			};
+		});
+		value.owner = value.owner.map(function(user){
+			return {
+				dn: user,
+				uid: user.match(/cn=[a-zA-Z0-9\_\-\@\.]+/)[0].replace('cn=', '')
+			};
+		});
+		value.memberCount = value.member.length;
+		value.createTimestamp = moment(value.createTimestamp, "YYYYMMDDHHmmssZ").fromNow();
+		value.modifyTimestamp = moment(value.modifyTimestamp, "YYYYMMDDHHmmssZ").fromNow();
+		value.groupCN = value.cn;
+		return value;
+	}
+
+	// app_sso_service_account is a marker group: membership hides an account
+	// from the Users page's People tab entirely (see users.ejs), which is
+	// exactly right for a non-person account but has silently made a real
+	// person's account look "gone" before (nothing else about it changes).
+	// Everywhere else in this dropdown just fires the PUT directly; only
+	// this one group gets a confirmation first.
+	function addMemberClick(event, groupCN, uid, el){
+		event.preventDefault();
+		const $el = $(el);
+		(async function(){
+			if (groupCN === 'app_sso_service_account') {
+				const ok = await app.messages.confirm(
+					`Mark "${uid}" as a service account? This hides them from the Users page's People tab (Service Accounts tab only) — only do this for a non-person account.`,
+					$el.closest('.card'), 'warning'
+				);
+				if (!ok) return;
+			}
+			try {
+				const data = await app.api.put(`group/${groupCN}/${uid}`, {});
+				await addedUser(data.message, groupCN, uid, $el);
+			} catch(e) {
+				app.messages.action(e.message || 'Failed to add member', $el.closest('.card'), 'danger');
+			}
+		})();
+		return false;
+	}
+
+	async function addedUser(message, group, user, $form){
+		let data = await app.group.get(group);
+		$.scope.groupCard.update('cn', group, processGroup(data.results));
+		app.messages.action(message, $("#group-card-"+group), 'success');
+		$('a[href="#'+$form.closest('.tab-pane').attr('id')+'"]').tab('show');
+		setTimeout(function(){ app.util.revealItem($("#group-card-" + group)); }, 400);
+	}
+
+	function applySort() {
+		const sort = $('#groupSort').val();
+		const scope = $.scope.groupCard;
+		if (sort === 'name-asc')     { scope.__jqOrderBy = 'cn';          scope.__jqOrderReverse = false; }
+		if (sort === 'name-desc')    { scope.__jqOrderBy = 'cn';          scope.__jqOrderReverse = true;  }
+		if (sort === 'members-desc') { scope.__jqOrderBy = 'memberCount'; scope.__jqOrderReverse = true;  }
+		if (sort === 'members-asc')  { scope.__jqOrderBy = 'memberCount'; scope.__jqOrderReverse = false; }
+	}
+
+	function matchesSearch(g) {
+		const q = $('#groupSearch').val().toLowerCase().trim();
+		return !q || g.cn.toLowerCase().includes(q) || (g.description || '').toLowerCase().includes(q);
+	}
+
+	function applyFilters() {
+		applySort();
+		const groups = allGroups.filter(matchesSearch);
+		$.scope.groupCard.empty();
+		$.scope.groupCard.push(...groups);
+		$('#groupCount').text(groups.length + ' of ' + allGroups.length + ' group' + (allGroups.length !== 1 ? 's' : ''));
+	}
+
+	async function tableAJAX(revealCn) {
+		let data = await app.group.list();
+		// processGroup builds each card's "nest a group" list from allGroups, so
+		// it has to see the full set before the map runs -- assigning only the
+		// mapped result would leave every dropdown empty on first load (and one
+		// render stale thereafter). The raw entries carry the cn/dn it needs.
+		allGroups = data.results;
+		allGroups = data.results.map(processGroup);
+		applyFilters();
+		if (revealCn) setTimeout(function(){ app.util.revealItem($('#group-card-' + revealCn)); }, 100);
+	}
+
+	function addNestedClick(event, groupCN, childCN, el){
+		event.preventDefault();
+		const $card = $('#group-card-' + groupCN);
+		(async function(){
+			try {
+				const data = await app.api.put(`group/${groupCN}/nested/${childCN}`, {});
+				const groupData = await app.group.get(groupCN);
+				$.scope.groupCard.update('cn', groupCN, processGroup(groupData.results));
+				app.messages.action(data.message, $card, 'success');
+			} catch(e) {
+				// 409 here is the cycle guard or an already-nested group -- both
+				// carry a specific server message worth showing verbatim.
+				app.messages.action((e && e.message) || 'Failed to nest group', $card, 'danger');
+			}
+		})();
+	}
+
+	async function removeNested(groupCN, childCN, btn) {
+		const $item = $(btn).closest('li');
+		$item.addClass('list-group-item-warning');
+		const confirmed = await app.messages.confirm(
+			`Remove "${childCN}" from "${groupCN}"? Its members lose access granted through this group.`,
+			$item, 'warning');
+		if (!confirmed) { $item.removeClass('list-group-item-warning'); return; }
+		try {
+			const data = await app.api.delete(`group/${groupCN}/nested/${childCN}`);
+			const groupData = await app.group.get(groupCN);
+			$.scope.groupCard.update('cn', groupCN, processGroup(groupData.results));
+			app.messages.action(data.message, $('#group-card-' + groupCN), 'success');
+		} catch(e) {
+			$item.removeClass('list-group-item-warning');
+			app.messages.action(e.message || 'Failed to un-nest group', $('#group-card-' + groupCN), 'danger');
+		}
+	}
+
+	async function removeMember(groupCN, uid, btn) {
+		const $item = $(btn).closest('li');
+		$item.addClass('list-group-item-warning');
+		const confirmed = await app.messages.confirm(`Remove "${uid}" from "${groupCN}"?`, $item, 'warning');
+		if (!confirmed) { $item.removeClass('list-group-item-warning'); return; }
+		try {
+			const data = await app.api.delete(`group/${groupCN}/${uid}`);
+			const groupData = await app.group.get(groupCN);
+			$.scope.groupCard.update('cn', groupCN, processGroup(groupData.results));
+			app.messages.action(data.message, $('#group-card-' + groupCN), 'success');
+		} catch(e) {
+			$item.removeClass('list-group-item-warning');
+			app.messages.action(e.message || 'Failed to remove member', $('#group-card-' + groupCN), 'danger');
+		}
+	}
+
+	async function removeOwner(groupCN, uid, btn) {
+		const $item = $(btn).closest('li');
+		$item.addClass('list-group-item-warning');
+		const confirmed = await app.messages.confirm(`Remove "${uid}" as owner of "${groupCN}"?`, $item, 'warning');
+		if (!confirmed) { $item.removeClass('list-group-item-warning'); return; }
+		try {
+			const data = await app.api.delete(`group/owner/${groupCN}/${uid}`);
+			const groupData = await app.group.get(groupCN);
+			$.scope.groupCard.update('cn', groupCN, processGroup(groupData.results));
+			app.messages.action(data.message, $('#group-card-' + groupCN), 'success');
+		} catch(e) {
+			$item.removeClass('list-group-item-warning');
+			app.messages.action(e.message || 'Failed to remove owner', $('#group-card-' + groupCN), 'danger');
+		}
+	}
+
+	async function deleteGroup(cn, btn) {
+		const $card = $(btn).closest('.card');
+		const confirmed = await app.messages.confirm(`Delete group "${cn}"?`, $card, 'danger');
+		if (!confirmed) return;
+		try {
+			await app.api.delete(`group/${cn}`);
+			$.scope.groupCard.remove('cn', cn);
+		} catch(e) {
+			app.messages.action(e.message || 'Failed to delete group', $card, 'danger');
+		}
+	}
+
+	app.auth.forceLogin(['app_sso_admin', 'admin']);
+
+	$(document).ready(async function(){
+		userlist = (await app.user.list()).results;
+		tableAJAX();
+	});
+</script>
+<div class="container mt-4">
+	
+	<div class="d-flex flex-wrap gap-2 align-items-center sticky-top bg-body py-2" style="top: var(--sw-content-offset, 0);">
+		<div class="input-group" style="flex: 1 1 200px;">
+			<span class="input-group-text"><i class="fa-solid fa-magnifying-glass"></i></span>
+			<input type="text" id="groupSearch" class="form-control" placeholder="Search groups…" oninput="applyFilters()">
+		</div>
+		<select id="groupSort" class="form-select" style="width:auto; min-width:175px" onchange="applyFilters()">
+			<option value="name-asc">Name A → Z</option>
+			<option value="name-desc">Name Z → A</option>
+			<option value="members-desc">Most members</option>
+			<option value="members-asc">Fewest members</option>
+		</select>
+		<span id="groupCount" class="text-muted text-nowrap small"></span>
+	</div>
+	<div class="row row-cols-1 row-cols-md-3 g-4 mt-0">
+		<div class="col">
+			<div class="card shadow">
+				<div class="card-header">
+					<i class="fa-solid fa-object-group"></i>
+					Add new group
+					<a href="/docs/accounts" class="text-reset float-end" title="Help"><i class="fa-solid fa-circle-question"></i></a>
+				</div>
+				<div class="card-header actionMessage" style="display:none"></div>
+				<div class="card-body">
+					<form action="group/" method="post" onsubmit="formAJAX(this)" evalAJAX="tableAJAX(data.results.cn)">
+						<div class="mb-3">
+							<label class="form-label">Name</label>
+							<input type="text" class="form-control shadow" name="name" placeholder="app_gitea_admin" validate=":3" />
+						</div>
+
+						<div class="mb-3">
+							<label class="form-label">Description</label>
+							<textarea class="form-control shadow" name="description" placeholder="Admin group for gitea app" validate=":3"></textarea>
+						</div>
+
+						<button type="submit" class="btn btn-outline-dark">Add</button>
+					</form>
+				</div>
+			</div>
+		</div>
+		<div class="col" jq-repeat="groupCard" jq-index-key="cn" jr-order-by="cn" id="group-card-{{cn}}">
+			<div class="card shadow col">
+				<div class="card-header">
+					<h5>
+						<i class="fa-solid fa-arrows-down-to-people"></i>
+						Group: {{ cn }}
+						<a href="/docs/accounts" class="text-reset float-end" title="Help"><i class="fa-solid fa-circle-question"></i></a>
+					</h5>
+					<ul class="nav nav-tabs card-header-tabs" id="myTab" role="tablist">
+						<li class="nav-item">
+							<a class="nav-link active" id="group-members-tab-{{cn}}" data-bs-toggle="tab" data-bs-target="#group-memmbers-{{cn}}" href="#group-memmbers-{{cn}}" role="tab" aria-controls="member" aria-selected="true">
+								<i class="fa-solid fa-users"></i>
+								Members
+							</a>
+						</li>
+						<li class="nav-item">
+							<a class="nav-link" id="group-nested-tab-{{cn}}" data-bs-toggle="tab" data-bs-target="#group-nested-{{cn}}" href="#group-nested-{{cn}}" role="tab" aria-controls="nested" aria-selected="false">
+								<i class="fa-solid fa-layer-group"></i>
+								Nested{{#hasNested}} <span class="badge bg-secondary">{{nestedCount}}</span>{{/hasNested}}
+							</a>
+						</li>
+						<li class="nav-item">
+							<a class="nav-link" id="group-admins-tab-{{cn}}" data-bs-toggle="tab" data-bs-target="#group-admins-{{cn}}" href="#group-admins-{{cn}}" role="tab" aria-controls="admin" aria-selected="false">
+								<i class="fa-solid fa-user-tie"></i>
+								Owners
+							</a>
+						</li>
+						<li class="nav-item float-end">
+							
+						</li>
+					</ul>
+
+				</div>
+				<div class="card-header actionMessage" style="display:none"></div>
+				<div class="card-body">
+					<p>
+						{{ description }}
+					</p>
+					<div class="tab-content" id="myTabContent">			  
+						<div class="tab-pane fade show active" id="group-memmbers-{{cn}}" role="tabpanel" aria-labelledby="member-tab">
+							<p>	
+								<ul class="list-group">
+								{{ #member }}
+									<li id="group-card-{{cn}}-{{uid}}" class="list-group-item shadow">
+										<i class="fa-solid fa-user"></i> {{ uid }}
+										<button type="button" onclick="removeMember('{{groupCN}}', '{{uid}}', this)" class="btn btn-sm btn-danger float-end">
+											<i class="fa-solid fa-user-slash"></i>
+										</button>
+									</li>
+								{{ /member }}
+								</ul>
+							</p>
+							<div class="dropdown">
+								<button class="btn btn-secondary dropdown-toggle" type="button" id="group_add_member" data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+									<i class="fa-solid fa-user-plus"></i>
+								</button>
+								<div class="dropdown-menu shadow-lg" aria-labelledby="group_add_member">
+								{{ #toAdd }}{{#.}}
+									<a class="dropdown-item" href="#" onclick="return addMemberClick(event, '{{groupCN}}', '{{uid}}', this);">
+										<i class="fa-solid fa-user"></i> {{uid}}
+									</a>
+								{{/.}}{{ /toAdd }}
+								
+								</div>
+							</div>
+						</div>
+
+						<div class="tab-pane fade" id="group-nested-{{cn}}" role="tabpanel" aria-labelledby="nested-tab">
+							<p class="text-muted small mb-2">
+								Everyone in a nested group is a member of this one, at any depth.
+							</p>
+							<ul class="list-group">
+							{{ #nested }}
+								<li id="group-card-{{groupCN}}-nested-{{cn}}" class="list-group-item shadow">
+									<i class="fa-solid fa-layer-group"></i> {{ cn }}
+									<button type="button" onclick="removeNested('{{groupCN}}', '{{cn}}', this)" class="btn btn-sm btn-danger float-end">
+										<i class="fa-solid fa-link-slash"></i>
+									</button>
+								</li>
+							{{ /nested }}
+							{{ ^hasNested }}
+								<li class="list-group-item text-muted fst-italic">No groups nested here.</li>
+							{{ /hasNested }}
+							</ul>
+							<div class="dropdown mt-2">
+								<button class="btn btn-secondary dropdown-toggle" type="button" data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+									<i class="fa-solid fa-diagram-project"></i> Nest a group
+								</button>
+								<div class="dropdown-menu" style="max-height: 300px; overflow-y: auto;">
+								{{ #toNest }}
+									<a class="dropdown-item" href="#" onclick="addNestedClick(event, '{{groupCN}}', '{{cn}}', this)">{{ cn }}</a>
+								{{ /toNest }}
+								</div>
+							</div>
+						</div>
+
+						<div class="tab-pane fade" id="group-admins-{{cn}}" role="tabpanel" aria-labelledby="admin-tab">
+							<p>
+								<ul class="list-group">
+								{{ #owner }}
+									<li class="list-group-item shadow">
+										<i class="fa-solid fa-user"></i> {{ uid }}
+										<button type="button" onclick="removeOwner('{{groupCN}}', '{{uid}}', this)" class="btn btn-sm btn-danger float-end">
+											<i class="fa-solid fa-user-slash"></i>
+										</button>
+									</li>
+								{{ /owner }}
+								</ul>
+							</p>
+
+							<div class="dropdown float-start">
+								<button class="btn btn-secondary dropdown-toggle" type="button" id="group_add_admin" data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+									<i class="fa-solid fa-user-plus"></i>
+								</button>
+								<div class="dropdown-menu shadow-lg" aria-labelledby="group_add_admin">
+								{{ #toAddOwner }}{{#.}}
+									<a class="dropdown-item" action="group/owner/{{groupCN}}/{{uid}}" method="put" onclick="formAJAX(this)" evalAJAX="addedUser(data.message, '{{groupCN}}', '{{uid}}', $form)">
+										<i class="fa-solid fa-user"></i> {{uid}}
+									</a>
+								{{/.}}{{ /toAddOwner }}
+								
+								</div>
+							</div>
+
+						</div>
+					</div>
+				</div>
+				<div class="card-footer">
+					<div class="float-end">
+						<button type="button" onclick="" class="btn btn-warning btn-lg shadow">
+							<i class="fa-solid fa-edit"></i>
+						</button>
+						<button type="button" onclick="deleteGroup('{{cn}}', this)" class="btn btn-danger btn-lg">
+							<i class="fa-solid fa-trash"></i>
+						</button>
+					</div>
+					<div>
+						Created: {{createTimestamp}}<br />
+						Last Modified: {{modifyTimestamp}}
+					</div>
+				</div>
+			</div>
+		</div>
+	</div>
+
+</div>
+<%- include('bottom') %>

nodejs/views/profile.ejs

@@ -656,12 +656,9 @@
 	}
 </script>
 
-<!-- Wrapped in the same `.container` as the profile/edit cards above (which
-     closes before this block): without it the API Tokens card renders
-     full-bleed and is visibly wider than every other card on the site. -->
-<div id="own-api-tokens-section" class="container" style="display:none">
-<div class="row mt-3">
-	<div class="col-12">
+<div id="own-api-tokens-section" style="display:none">
+<div class="row mt-3 justify-content-center">
+	<div class="col-md-8">
 		<div class="card shadow-lg">
 			<div class="card-header d-flex justify-content-between align-items-center">
 				<span><i class="fa-solid fa-key me-1"></i> API Tokens</span>

nodejs/views/top.ejs

@@ -49,7 +49,7 @@
 				</ul>
 				<div class="form-inline mt-2 mt-md-0">
 					<% if(ui.profileUrl){ %>
-					<a id="cl-username" class="navbar-text text-light me-3 text-decoration-none" href="<%- ui.profileUrl %>" style="display: none;">
+					<a id="cl-username" class="navbar-text text-light me-3" href="<%- ui.profileUrl %>" style="display: none;">
 						<i class="fa-solid fa-user me-1"></i><span id="cl-username-text"></span>
 					</a>
 					<% } else { %>

nodejs/views/vault.ejs

@@ -1,33 +1,26 @@
 <%- include('top') %>
 
-<div class="container mt-4">
-  <div class="row">
-    <div class="col-12">
-      <div class="card shadow">
-        <div class="card-header d-flex justify-content-between align-items-center flex-wrap gap-2">
-          <ul class="nav nav-tabs card-header-tabs" id="vault-tabs" role="tablist">
-            <li class="nav-item"><button class="nav-link active" data-bs-toggle="tab" data-bs-target="#tab-secrets" type="button"><i class="fa-solid fa-lock"></i> Secrets</button></li>
-            <li class="nav-item" id="vault-apps-tab" style="display:none"><button class="nav-link" data-bs-toggle="tab" data-bs-target="#tab-apps" type="button"><i class="fa-solid fa-key"></i> Apps</button></li>
-            <li class="nav-item"><button class="nav-link" data-bs-toggle="tab" data-bs-target="#tab-shared" type="button"><i class="fa-solid fa-share-nodes"></i> Shared</button></li>
-          </ul>
-          <span class="small text-muted"><i class="fa-solid fa-database me-1"></i>Powered by <a href="https://openbao.org" target="_blank" rel="noopener">OpenBao</a></span>
-        </div>
-        <div class="card-body p-0">
-          <div class="tab-content">
+<div class="container-fluid py-4">
+  <div class="d-flex justify-content-between align-items-center mb-3">
+    <h2 id="vault-title"><i class="fas fa-lock"></i> My Secrets <small class="text-muted">(personal namespace)</small></h2>
+    <ul class="nav nav-pills" id="vault-tabs">
+      <li class="nav-item"><button class="nav-link active" data-bs-toggle="pill" data-bs-target="#tab-secrets" type="button">Secrets</button></li>
+      <li class="nav-item" id="vault-apps-tab" style="display:none"><button class="nav-link" data-bs-toggle="pill" data-bs-target="#tab-apps" type="button">Apps</button></li>
+    </ul>
+  </div>
+
+  <div class="tab-content">
     <!-- ── Secrets tab ─────────────────────────────────────────────────── -->
     <div class="tab-pane fade show active" id="tab-secrets">
-      <div class="card-header d-flex flex-wrap justify-content-between align-items-center gap-2">
-        <h5 class="mb-0" id="vault-title"><i class="fas fa-lock"></i> My Secrets <small class="text-muted">(personal namespace)</small></h5>
-        <div class="d-flex align-items-center gap-2">
-          <a href="/docs/vault" class="text-reset" title="Vault help &amp; documentation"><i class="fa-solid fa-circle-question"></i></a>
-          <button class="btn btn-primary btn-sm" onclick="showCreateModal()"><i class="fas fa-plus"></i> New Secret</button>
-        </div>
+      <div class="d-flex justify-content-end mb-3">
+        <button class="btn btn-primary" onclick="showCreateModal()">
+          <i class="fas fa-plus"></i> New Secret
+        </button>
       </div>
-      <div class="p-3">
-        <div class="row">
+      <div class="row">
         <div class="col-md-4">
           <div class="card shadow-sm">
-            <div class="card-header"><h5 class="card-title mb-0">Secrets List</h5></div>
+            <div class="card-header bg-light"><h5 class="card-title mb-0">Secrets List</h5></div>
             <div class="list-group list-group-flush" id="secrets-list">
               <div class="list-group-item text-center text-muted">Loading...</div>
             </div>
@@ -35,7 +28,7 @@
         </div>
         <div class="col-md-8">
           <div class="card shadow-sm" id="secret-details-card" style="display: none;">
-            <div class="card-header d-flex justify-content-between align-items-center">
+            <div class="card-header bg-light d-flex justify-content-between align-items-center">
               <h5 class="card-title mb-0" id="secret-title">Secret Details</h5>
               <div>
                 <button class="btn btn-sm btn-outline-primary me-2" onclick="editCurrentSecret()"><i class="fas fa-edit"></i> Edit</button>
@@ -51,20 +44,17 @@
             <h4>Select a secret to view its details</h4>
           </div>
         </div>
-        </div>
       </div>
     </div>
 
     <!-- ── Apps tab (admin only; revealed client-side for admins) ─────── -->
     <div class="tab-pane fade" id="tab-apps">
-      <div class="p-3">
-        <div class="row">
+      <div class="row">
         <div class="col-md-5">
           <div class="card shadow-sm">
-            <div class="card-header"><h5 class="card-title mb-0">Mint an app token</h5></div>
+            <div class="card-header bg-light"><h5 class="card-title mb-0">Mint an app token</h5></div>
             <div class="card-body">
               <p class="text-muted small">Mints a scoped OpenBao token confined to <code>secret/apps/&lt;name&gt;/*</code> for an external app. The token is shown <strong>once</strong> — record it in the app immediately; it cannot be recovered later.</p>
-              <p class="text-muted small">The token is periodic: it stays valid as long as the app renews it within its period (<code>POST /v1/auth/token/renew-self</code>). If it lapses, mint a new one here — the app's policy and stored secrets are kept.</p>
               <div class="mb-3">
                 <label class="form-label">App name (lowercase letters, digits, hyphens)</label>
                 <input type="text" class="form-control" id="app-name-input" placeholder="e.g. my-service">
@@ -76,7 +66,7 @@
         </div>
         <div class="col-md-7">
           <div class="card shadow-sm d-none" id="app-result-card">
-            <div class="card-header d-flex justify-content-between align-items-center">
+            <div class="card-header bg-light d-flex justify-content-between align-items-center">
               <h5 class="card-title mb-0">App token</h5>
               <button class="btn btn-sm btn-outline-primary" onclick="copyText(document.getElementById('app-token').textContent)"><i class="fas fa-copy"></i> Copy</button>
             </div>
@@ -91,124 +81,8 @@ curl "$VAULT_ADDR/v1/secret/data/apps/<span id="app-name-display"></span>/conf"
             </div>
           </div>
         </div>
-        </div>
-        <div class="row mt-3">
-          <div class="col-12">
-            <div class="card shadow-sm">
-              <div class="card-header d-flex justify-content-between align-items-center">
-                <h5 class="card-title mb-0"><i class="fa-solid fa-key me-1"></i> Minted apps</h5>
-                <button class="btn btn-sm btn-outline-primary" onclick="loadApps()"><i class="fas fa-rotate"></i> Refresh</button>
-              </div>
-              <div class="card-body">
-                <p class="text-muted small mb-2">Each entry is a scoped OpenBao credential an external service uses to read <code>secret/apps/&lt;name&gt;/*</code>. The token itself is shown <strong>once</strong> at mint — this list is metadata sso keeps so it can renew the token and so you can see what's been minted. If an app shows a renewal error, re-mint it here.</p>
-                <div id="apps-list"><div class="text-muted small">Loading…</div></div>
-              </div>
-            </div>
-          </div>
-        </div>
       </div>
     </div>
-
-    <!-- ── Shared tab ─────────────────────────────────────────────────── -->
-    <div class="tab-pane fade" id="tab-shared">
-      <div class="p-3">
-        <div class="row">
-        <div class="col-md-6">
-          <div class="card shadow-sm">
-            <div class="card-header d-flex justify-content-between align-items-center">
-              <h5 class="card-title mb-0">My shared secrets</h5>
-              <button class="btn btn-sm btn-primary" onclick="showCreateSharedModal()"><i class="fas fa-plus"></i> New</button>
-            </div>
-            <div class="list-group list-group-flush" id="shared-mine-list">
-              <div class="list-group-item text-center text-muted">Loading...</div>
-            </div>
-          </div>
-        </div>
-        <div class="col-md-6">
-          <div class="card shadow-sm">
-            <div class="card-header"><h5 class="card-title mb-0">Shared with me</h5></div>
-            <div class="list-group list-group-flush" id="shared-granted-list">
-              <div class="list-group-item text-center text-muted">Loading...</div>
-            </div>
-          </div>
-        </div>
-      </div>
-    </div>
-  </div>
-          </div>
-        </div>
-      </div>
-    </div>
-  </div>
-</div>
-
-<!-- Create Shared Secret Modal -->
-<div class="modal fade" id="sharedCreateModal" tabindex="-1">
-  <div class="modal-dialog">
-    <div class="modal-content">
-      <div class="modal-header">
-        <h5 class="modal-title">New Shared Secret</h5>
-        <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
-      </div>
-      <div class="modal-body">
-        <div class="mb-3">
-          <label class="form-label">Name (slug)</label>
-          <input type="text" class="form-control" id="shared-slug-input" placeholder="e.g. db-creds">
-        </div>
-        <div class="mb-3">
-          <label class="form-label">Description</label>
-          <input type="text" class="form-control" id="shared-desc-input" placeholder="optional">
-        </div>
-        <div class="mb-3">
-          <label class="form-label">Secret Data (JSON)</label>
-          <textarea class="form-control" id="shared-data-input" rows="6" style="font-family: monospace;">{
-  "key": "value"
-}</textarea>
-        </div>
-        <div class="alert alert-danger d-none" id="shared-create-error"></div>
-      </div>
-      <div class="modal-footer">
-        <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
-        <button type="button" class="btn btn-primary" onclick="saveSharedSecret()">Create</button>
-      </div>
-    </div>
-  </div>
-</div>
-
-<!-- Manage Grants Modal -->
-<div class="modal fade" id="sharedGrantsModal" tabindex="-1">
-  <div class="modal-dialog modal-lg">
-    <div class="modal-content">
-      <div class="modal-header">
-        <h5 class="modal-title">Share</h5>
-        <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
-      </div>
-      <div class="modal-body">
-        <div class="row g-2 mb-3">
-          <div class="col-4"><select class="form-select" id="grant-type-input"><option value="user">User</option><option value="app">App</option></select></div>
-          <div class="col-5"><input class="form-control" id="grant-id-input" placeholder="uid or app name"></div>
-          <div class="col-3"><button class="btn btn-primary w-100" onclick="addGrant()">Grant</button></div>
-        </div>
-        <div class="alert alert-danger d-none" id="grants-error"></div>
-        <div class="list-group" id="grants-list"><div class="list-group-item text-muted">No grants yet.</div></div>
-      </div>
-      <div class="modal-footer">
-        <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
-      </div>
-    </div>
-  </div>
-</div>
-
-<!-- View Shared Secret Modal -->
-<div class="modal fade" id="sharedViewModal" tabindex="-1">
-  <div class="modal-dialog modal-lg">
-    <div class="modal-content">
-      <div class="modal-header">
-        <h5 class="modal-title" id="shared-view-title">Secret</h5>
-        <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
-      </div>
-      <div class="modal-body"><pre id="shared-view-content" class="bg-dark text-light p-3 rounded" style="min-height: 200px;"></pre></div>
-    </div>
   </div>
 </div>
 
@@ -260,12 +134,7 @@ curl "$VAULT_ADDR/v1/secret/data/apps/<span id="app-name-display"></span>/conf"
   // key relative to the subject's namespace (so 'foo' for a user means
   // secret/data/users/<uid>/foo).
   function vpath(kind, key) {
-    let cleanKey = key || '';
-    if (cleanKey.startsWith('/')) cleanKey = cleanKey.slice(1);
-    if (VAULT_BASE) {
-      return `secret/${kind}/${VAULT_BASE}${cleanKey}`;
-    }
-    return `secret/${kind}/${cleanKey}`;
+    return `secret/${kind}/${VAULT_BASE}${key}`;
   }
 
   function apiCall(method, path, body = null) {
@@ -287,8 +156,7 @@ curl "$VAULT_ADDR/v1/secret/data/apps/<span id="app-name-display"></span>/conf"
 
   async function loadSecrets() {
     try {
-      const listPath = vpath('metadata', '').replace(/\/$/, '') + '?list=true';
-      const res = await apiCall('GET', listPath);
+      const res = await apiCall('GET', vpath('metadata', '?list=true'));
       const listEl = document.getElementById('secrets-list');
       listEl.innerHTML = '';
       if (!res || !res.data || !res.data.keys || res.data.keys.length === 0) {
@@ -423,194 +291,16 @@ curl "$VAULT_ADDR/v1/secret/data/apps/<span id="app-name-display"></span>/conf"
       document.getElementById('app-token').textContent = result.token;
       document.getElementById('app-name-display').textContent = name;
       document.getElementById('app-result-card').classList.remove('d-none');
-      loadApps();
     } catch (err) {
       errorEl.textContent = err.message;
       errorEl.classList.remove('d-none');
     }
   }
 
-  // List the minted external-app tokens (metadata only). Makes the Apps tab show
-  // what's been minted instead of a credential that vanishes after the once-only
-  // token display.
-  async function loadApps() {
-    const $list = document.getElementById('apps-list');
-    if (!$list) return;
-    $list.textContent = 'Loading…';
-    try {
-      const res = await fetch('/api/vault/apps', {
-        headers: { 'auth-token': app.auth.getToken() }
-      });
-      if (!res.ok) { $list.innerHTML = '<div class="text-danger small">Failed to load apps.</div>'; return; }
-      const { apps = [] } = await res.json();
-      if (!apps.length) { $list.innerHTML = '<div class="text-muted small">No apps minted yet.</div>'; return; }
-      $list.innerHTML = '<div class="list-group shadow-sm">' + apps.map(a => {
-        const ok = !a.lastError;
-        const renewed = a.lastRenewedAt ? ' · renewed ' + moment(a.lastRenewedAt).fromNow() : ' · never renewed';
-        return `<div class="list-group-item d-flex justify-content-between align-items-center">
-          <div>
-            <strong class="font-monospace">${app.util.escapeHtml(a.name)}</strong>
-            ${ok ? '<span class="badge bg-success ms-1">renewing</span>' : '<span class="badge bg-danger ms-1" title="' + app.util.escapeHtml(a.lastError) + '">renewal error</span>'}
-            <div class="small text-muted">minted ${moment(a.createdOn).format('YYYY-MM-DD HH:mm')}${renewed}</div>
-          </div>
-          <span class="font-monospace small text-muted">secret/apps/${app.util.escapeHtml(a.name)}/</span>
-        </div>`;
-      }).join('') + '</div>';
-    } catch (err) {
-      $list.innerHTML = '<div class="text-danger small">Failed to load apps: ' + app.util.escapeHtml(err.message) + '</div>';
-    }
-  }
-
   function copyText(text) {
     navigator.clipboard.writeText(text).then(() => app.messages.toast('Copied', 'success'));
   }
 
-  // ── Shared secrets tab ──────────────────────────────────────────────
-  let currentShared = null;
-  const sharedCreateModal = new bootstrap.Modal(document.getElementById('sharedCreateModal'));
-  const sharedGrantsModal = new bootstrap.Modal(document.getElementById('sharedGrantsModal'));
-  const sharedViewModal = new bootstrap.Modal(document.getElementById('sharedViewModal'));
-
-  function sharedApi(path, method = 'GET', body = null) {
-    const opts = { method, headers: { 'Content-Type': 'application/json', 'auth-token': app.auth.getToken() } };
-    if (body) opts.body = JSON.stringify(body);
-    return fetch('/api/shared-secrets' + path, opts).then(async res => {
-      if (res.status === 404) return null;
-      if (!res.ok) { const t = await res.text(); throw new Error(`${res.status} ${t}`); }
-      if (res.status === 204) return null;
-      return res.json();
-    });
-  }
-
-  async function loadShared() {
-    try {
-      const res = await sharedApi('/');
-      const items = (res && res.items) || [];
-      renderSharedMine(items.filter(i => i.role === 'owner'));
-      renderSharedGranted(items.filter(i => i.role === 'grantee'));
-    } catch (err) {
-      document.getElementById('shared-mine-list').innerHTML =
-        `<div class="list-group-item text-danger">Error: ${err.message}</div>`;
-    }
-  }
-
-  function renderSharedMine(items) {
-    const el = document.getElementById('shared-mine-list');
-    if (!items.length) { el.innerHTML = '<div class="list-group-item text-center text-muted">No shared secrets yet</div>'; return; }
-    el.innerHTML = '';
-    items.forEach(s => {
-      const row = document.createElement('div');
-      row.className = 'list-group-item d-flex justify-content-between align-items-center';
-      row.innerHTML = `<div><i class="fas fa-share-alt text-secondary me-2"></i><strong>${s.slug}</strong><div class="small text-muted">${s.path}</div></div>
-        <div class="btn-group">
-          <button class="btn btn-sm btn-outline-primary" onclick="openGrants('${s.id}')"><i class="fas fa-users"></i> Share</button>
-          <button class="btn btn-sm btn-outline-danger" onclick="deleteShared('${s.id}')"><i class="fas fa-trash"></i></button>
-        </div>`;
-      el.appendChild(row);
-    });
-  }
-
-  function renderSharedGranted(items) {
-    const el = document.getElementById('shared-granted-list');
-    if (!items.length) { el.innerHTML = '<div class="list-group-item text-center text-muted">Nothing shared with you yet</div>'; return; }
-    el.innerHTML = '';
-    items.forEach(s => {
-      const row = document.createElement('a');
-      row.href = '#';
-      row.className = 'list-group-item list-group-item-action d-flex align-items-center';
-      row.innerHTML = `<i class="fas fa-key text-secondary me-3"></i><span>${s.slug}</span><small class="text-muted ms-auto">by ${s.ownerUid}</small>`;
-      row.onclick = (e) => { e.preventDefault(); viewShared(s); };
-      el.appendChild(row);
-    });
-  }
-
-  function showCreateSharedModal() {
-    currentShared = null;
-    document.getElementById('shared-slug-input').value = '';
-    document.getElementById('shared-desc-input').value = '';
-    document.getElementById('shared-data-input').value = '{\n  "key": "value"\n}';
-    document.getElementById('shared-create-error').classList.add('d-none');
-    sharedCreateModal.show();
-  }
-
-  async function saveSharedSecret() {
-    const err = document.getElementById('shared-create-error');
-    err.classList.add('d-none');
-    let data;
-    try { data = JSON.parse(document.getElementById('shared-data-input').value); }
-    catch (e) { err.textContent = 'Invalid JSON: ' + e.message; err.classList.remove('d-none'); return; }
-    try {
-      await sharedApi('/', 'POST', {
-        slug: document.getElementById('shared-slug-input').value.trim(),
-        description: document.getElementById('shared-desc-input').value.trim(),
-        data
-      });
-      sharedCreateModal.hide();
-      await loadShared();
-    } catch (e) { err.textContent = e.message; err.classList.remove('d-none'); }
-  }
-
-  async function viewShared(s) {
-    document.getElementById('shared-view-title').textContent = s.slug + ' (by ' + s.ownerUid + ')';
-    document.getElementById('shared-view-content').textContent = 'Loading...';
-    sharedViewModal.show();
-    try {
-      const res = await apiCall('GET', 'secret/data/' + s.path);
-      document.getElementById('shared-view-content').textContent =
-        (res && res.data && res.data.data) ? JSON.stringify(res.data.data, null, 2) : 'No data found.';
-    } catch (e) {
-      document.getElementById('shared-view-content').textContent = 'Error: ' + e.message;
-    }
-  }
-
-  async function openGrants(id) {
-    currentShared = id;
-    document.getElementById('grants-error').classList.add('d-none');
-    document.getElementById('grant-id-input').value = '';
-    sharedGrantsModal.show();
-    try {
-      const res = await sharedApi('/' + id + '/grants');
-      const grants = (res && res.grants) || [];
-      const el = document.getElementById('grants-list');
-      el.innerHTML = '';
-      if (!grants.length) el.innerHTML = '<div class="list-group-item text-muted">No grants yet.</div>';
-      grants.forEach(g => {
-        const row = document.createElement('div');
-        row.className = 'list-group-item d-flex justify-content-between align-items-center';
-        row.innerHTML = `<span><span class="badge bg-secondary me-2">${g.granteeType}</span>${g.granteeId}</span>
-          <button class="btn btn-sm btn-outline-danger" onclick="revokeGrant('${g.id}')"><i class="fas fa-times"></i></button>`;
-        el.appendChild(row);
-      });
-    } catch (e) {
-      document.getElementById('grants-list').innerHTML = `<div class="list-group-item text-danger">${e.message}</div>`;
-    }
-  }
-
-  async function addGrant() {
-    const err = document.getElementById('grants-error');
-    err.classList.add('d-none');
-    try {
-      await sharedApi('/' + currentShared + '/grants', 'POST', {
-        granteeType: document.getElementById('grant-type-input').value,
-        granteeId: document.getElementById('grant-id-input').value.trim()
-      });
-      document.getElementById('grant-id-input').value = '';
-      openGrants(currentShared);
-    } catch (e) { err.textContent = e.message; err.classList.remove('d-none'); }
-  }
-
-  async function revokeGrant(grantId) {
-    try { await sharedApi('/' + currentShared + '/grants/' + grantId, 'DELETE'); openGrants(currentShared); }
-    catch (e) { app.messages.toast('Error revoking: ' + e.message, 'danger'); }
-  }
-
-  async function deleteShared(id) {
-    const confirmed = await app.messages.confirm('Delete this shared secret? Grantees will immediately lose access.', $('#shared-mine-list'), 'warning');
-    if (!confirmed) return;
-    try { await sharedApi('/' + id, 'DELETE'); await loadShared(); }
-    catch (e) { app.messages.toast('Error deleting: ' + e.message, 'danger'); }
-  }
-
   (async function init() {
     const user = await app.auth.forceLogin();
     if (!user) return; // not logged in — forceLogin redirected to /login
@@ -622,10 +312,8 @@ curl "$VAULT_ADDR/v1/secret/data/apps/<span id="app-name-display"></span>/conf"
         '<i class="fas fa-lock"></i> Vault Secrets <small class="text-muted">(admin — all of secret/)</small>';
       document.getElementById('secret-path-label').textContent = 'Secret path (under secret/)';
       document.getElementById('secret-path-input').placeholder = 'e.g. apps/my-service/conf';
-      loadApps();
     }
     loadSecrets();
-    loadShared();
   })();
 </script>