Phase 1: console runner service + nginx gate + systemd
- agents/console/server.mjs: Node runner (as carlos-arias-agent, 127.0.0.1:3011).
run/stream(SSE)/publish/discard/ping/auth. Agent edits files (no Bash); the
runner builds isolated previews and git-commits on publish. Git ops scoped to
content paths (app, brand, api/db, api/cli) — never infra or secrets.
- adminauth check() — nginx auth_request target (204 admin / 401 not).
- nginx: /devconsole + /_preview gated by auth_request, runner proxied,
previews admin-only. Runner never exposed directly.
- systemd unit (hardened: NoNewPrivileges, ProtectSystem, scoped ReadWritePaths).
Verified end to end: admin login -> agent edits about.astro -> isolated preview
(admin-gated) -> discard reverts. Unauthenticated access is 401 throughout.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DoFYZY9gkGPNDqZ7NuEa9a
Carlos Arias
e57856173a