2 commits

Author	SHA1	Message	Date
Carlos Arias	e57856173a	Phase 1: console runner service + nginx gate + systemd ... - agents/console/server.mjs: Node runner (as carlos-arias-agent, 127.0.0.1:3011). run/stream(SSE)/publish/discard/ping/auth. Agent edits files (no Bash); the runner builds isolated previews and git-commits on publish. Git ops scoped to content paths (app, brand, api/db, api/cli) — never infra or secrets. - adminauth check() — nginx auth_request target (204 admin / 401 not). - nginx: /devconsole + /_preview gated by auth_request, runner proxied, previews admin-only. Runner never exposed directly. - systemd unit (hardened: NoNewPrivileges, ProtectSystem, scoped ReadWritePaths). Verified end to end: admin login -> agent edits about.astro -> isolated preview (admin-gated) -> discard reverts. Unauthenticated access is 401 throughout. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DoFYZY9gkGPNDqZ7NuEa9a	2026-07-23 20:53:32 +00:00
Carlos Arias	59019d2f32	Phase 0: admin console foundation ... - cja_admin + cja_admin_log tables (dedicated single-admin tier + audit trail) - AdminAuth controller: /api/adminauth login/logout/me, session-based, rate-limited, every attempt logged - set-admin-password CLI (bcrypt, run manually so the password never enters an agent context) - requireAdmin() guard for future privileged console endpoints - agent env scaffold (git-ignored) Foundation only — no agent runner or features yet. Preview/publish, media, and the dashboard come in phases 1-3 per agents/console/PLAN.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DoFYZY9gkGPNDqZ7NuEa9a	2026-07-23 20:23:48 +00:00