Rotate agent registration key; remove key literals from public scripts/UI

- install.sh, install-agent.sh: require JARVIS_REG_KEY env var or interactive prompt instead of baked-in key (matches install-mac.sh/install-windows.ps1 behavior)

- netscan.php: reuse AGENT_REGISTRATION_KEY constant instead of a duplicate literal

- agent.php + api.php: add session-authed "regkey" action so the admin install modal fetches the current key at runtime

- jarvis-agents.js: fetch reg key via /api/agent/regkey instead of hardcoding it; pass JARVIS_REG_KEY in the Linux install one-liner

- INFRASTRUCTURE-REFERENCE.md: scrub old key literal (rotated; real value lives only in api/config.php on VM211)

Key rotated on the box + rolled out to all 11 agents (verified all re-register online). New value is in the gitignored api/config.php only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

public_html/admin/downloads/INFRASTRUCTURE-REFERENCE.md

@@ -663,7 +663,7 @@ Webhook secret: `4c8805f0285214ff0a0602b5880270b935f36a896946c7f1`
 
 ### Agent System
 Agents installed on all servers — phone home every 10s (heartbeat) / 30s (metrics).  
-Registration key: `f846a9aaf7ce9a61742c63c87c4186052a71d2a580c65518`  
+Registration key: `[rotated 2026-07-07 — stored in api/config.php on VM211, not documented here]`  
 Install command: `curl -sk http://10.48.200.211/install-agent.sh | bash -s <hostname> <linux|proxmox>`
 
 ### Self-Healing Watchdog
@@ -918,7 +918,7 @@ sshpass -p 'Joker1974!!!' ssh root@10.48.200.90 \
 | Service | Key |
 |---------|-----|
 | GitHub PAT | `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` (rotated 2026-07-05, scopes `repo`+`workflow`) |
-| JARVIS Agent Registration | `f846a9aaf7ce9a61742c63c87c4186052a71d2a580c65518` |
+| JARVIS Agent Registration | `[rotated 2026-07-07 — stored in api/config.php on VM211, not documented here]` |
 | Proxmox API Token | `root@pam!jarvis=c45b5feb-f9a9-445d-a626-14fbb959f78b` |
 | HA Long-lived Token | `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiIzNmI0N2I1Njk5ZGQ0MTQ2ODMwZWFmYjZiYTQ1MjJkMSIsImlhdCI6MTc4MDIwMzU5NCwiZXhwIjoyMDk1NTYzNTk0fQ.sYRok-jRDlA4lFgWxLQELcEjkJNGQdprk6ZziLwLtXE` |
 | Sonarr API | `b43e04350a594846b4ee95261c29e9e0` |

public_html/agent/install.sh

@@ -21,7 +21,14 @@ JARVIS_HOST=""
 INSTALL_DIR="/opt/jarvis-agent"
 CONFIG_DIR="/etc/jarvis-agent"
 STATE_DIR="/var/lib/jarvis-agent"
-REG_KEY="f846a9aaf7ce9a61742c63c87c4186052a71d2a580c65518"
+REG_KEY="${JARVIS_REG_KEY:-}"
+if [ -z "$REG_KEY" ] && [ -r /dev/tty ]; then
+  read -rp "Enter JARVIS registration key: " REG_KEY </dev/tty
+fi
+if [ -z "$REG_KEY" ]; then
+  echo "ERROR: registration key required (set JARVIS_REG_KEY env var or enter at prompt)" >&2
+  exit 1
+fi
 SERVICE_FILE="/etc/systemd/system/jarvis-agent.service"
 
 echo "=== JARVIS Agent Installer v3.0 ==="

public_html/api.php

@@ -1,128 +1,128 @@
-<?php
-/**
- * JARVIS API Router — fault-isolated per endpoint
- * A ParseError or fatal in any endpoint file returns JSON 500 for that
- * endpoint only; all other endpoints continue to work normally.
- */
-require_once __DIR__ . '/../api/config.php';
-require_once __DIR__ . '/../api/lib/db.php';
-require_once __DIR__ . '/../api/lib/kb_engine.php';
-
-// Skip session for machine-agent calls and netscan/ping — each heartbeat would
-// otherwise create an empty session file, producing millions of files that slow
-// session GC for all requests.  Browser-facing agent sub-actions (list/status/myip)
-// still need a session to verify auth, so we only skip for machine-agent actions.
-$_earlyParts = explode('/', trim(parse_url($_SERVER['REQUEST_URI'] ?? '/', PHP_URL_PATH), '/'));
-if (($_earlyParts[0] ?? '') === 'api') array_shift($_earlyParts);
-$_e0 = $_earlyParts[0] ?? '';
-$_e1 = $_earlyParts[1] ?? '';
-$_skipSession = match(true) {
-    $_e0 === 'ping'    => true,
-    $_e0 === 'netscan' => true,
-    $_e0 === 'agent' && !in_array($_e1, ['list','status','myip'], true) => true,
-    default => false,
-};
-if (!$_skipSession) {
-    session_start();
-}
-
-header('Content-Type: application/json');
-$_allowedOrigins = ['https://jarvis.orbishosting.com', 'http://jarvis.orbishosting.com'];
-$_origin = $_SERVER['HTTP_ORIGIN'] ?? '';
-if (in_array($_origin, $_allowedOrigins, true)) {
-    header('Access-Control-Allow-Origin: ' . $_origin);
-    header('Access-Control-Allow-Credentials: true');
-}
-header('Access-Control-Allow-Methods: GET, POST, OPTIONS');
-header('Access-Control-Allow-Headers: Content-Type, X-Session-Token');
-
-if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') { http_response_code(204); exit; }
-
-$uri      = $_SERVER['REQUEST_URI'] ?? '/';
-$method   = $_SERVER['REQUEST_METHOD'];
-$path     = trim(parse_url($uri, PHP_URL_PATH), '/');
-$parts    = explode('/', $path);
-
-if (($parts[0] ?? '') === 'api') array_shift($parts);
-$endpoint = $parts[0] ?? '';
-$action   = $parts[1] ?? '';
-
-// ── Auth check (skip for auth / agent / netscan) ──────────────────────
-if (!\in_array($endpoint, ['auth', 'agent', 'netscan'], true)) {
-    $token   = $_SESSION['jarvis_token'] ?? ($_SERVER['HTTP_X_SESSION_TOKEN'] ?? '');
-    $isValid = !empty($token) && $token === ($_SESSION['jarvis_token'] ?? '');
-    if (!$isValid) {
-        $ip      = $_SERVER['REMOTE_ADDR'] ?? '';
-        $isLocal = \in_array($ip, ['127.0.0.1', '::1', JARVIS_IP], true);
-        if (!$isLocal && $endpoint !== 'ping') {
-            http_response_code(401);
-            echo json_encode(['error' => 'Unauthorized', 'code' => 401]);
-            exit;
-        }
-    }
-}
-
-if ($endpoint !== 'auth') session_write_close();
-
-$body = file_get_contents('php://input');
-$data = json_decode($body, true) ?? [];
-
-// ── Fast ping (no file dispatch needed) ──────────────────────────────
-if ($endpoint === 'ping') {
-    echo json_encode(['status' => 'online', 'time' => date('c'), 'codename' => JARVIS_CODENAME]);
-    exit;
-}
-
-// ── Endpoint → file map ───────────────────────────────────────────────
-$endpoints = [
-    'auth'       => 'auth.php',
-    'chat'       => 'chat.php',
-    'system'     => 'system.php',
-    'netscan'    => 'netscan.php',
-    'network'    => 'network.php',
-    'proxmox'    => 'proxmox.php',
-    'ha'         => 'ha.php',
-    'tts'        => 'tts.php',
-    'email'      => 'email.php',
-    'do'         => 'do_server.php',
-    'alerts'     => 'alerts.php',
-    'facts'      => 'facts_collector.php',
-    'weather'    => 'weather.php',
-    'news'       => 'news.php',
-    'sites'      => 'sites.php',
-    'agent'      => 'agent.php',
-    'planner'    => 'planner.php',
-    'jellyfin'   => 'jellyfin.php',
-    'history'    => 'history.php',
-    'metrics'    => 'metrics.php',
-    'suggestions' => 'suggestions.php',
-    'arc'        => 'arc.php',
-    'directives' => 'directives.php',
-    'memory'     => 'memory.php',
-    'calendar'   => 'calendar_sync.php',
-];
-
-if (!isset($endpoints[$endpoint])) {
-    http_response_code(404);
-    echo json_encode(['error' => 'Unknown endpoint: ' . $endpoint]);
-    exit;
-}
-
-$file = __DIR__ . '/../api/endpoints/' . $endpoints[$endpoint];
-
-// ── Fault-isolated dispatch ───────────────────────────────────────────
-// ob_start() buffers any partial output so a mid-execution fatal doesn't
-// send a broken response. catch(Throwable) catches ParseError, TypeError,
-// and all other Errors + Exceptions in PHP 7+.
-ob_start();
-try {
-    require $file;
-    ob_end_flush();
-} catch (\Throwable $e) {
-    ob_end_clean();
-    http_response_code(500);
-    echo json_encode(['error' => 'Endpoint unavailable', 'endpoint' => $endpoint, 'code' => 500]);
-    error_log(sprintf('JARVIS API [%s] %s: %s in %s:%d',
-        $endpoint, get_class($e), $e->getMessage(), $e->getFile(), $e->getLine()
-    ));
-}
+<?php
+/**
+ * JARVIS API Router — fault-isolated per endpoint
+ * A ParseError or fatal in any endpoint file returns JSON 500 for that
+ * endpoint only; all other endpoints continue to work normally.
+ */
+require_once __DIR__ . '/../api/config.php';
+require_once __DIR__ . '/../api/lib/db.php';
+require_once __DIR__ . '/../api/lib/kb_engine.php';
+
+// Skip session for machine-agent calls and netscan/ping — each heartbeat would
+// otherwise create an empty session file, producing millions of files that slow
+// session GC for all requests.  Browser-facing agent sub-actions (list/status/myip)
+// still need a session to verify auth, so we only skip for machine-agent actions.
+$_earlyParts = explode('/', trim(parse_url($_SERVER['REQUEST_URI'] ?? '/', PHP_URL_PATH), '/'));
+if (($_earlyParts[0] ?? '') === 'api') array_shift($_earlyParts);
+$_e0 = $_earlyParts[0] ?? '';
+$_e1 = $_earlyParts[1] ?? '';
+$_skipSession = match(true) {
+    $_e0 === 'ping'    => true,
+    $_e0 === 'netscan' => true,
+    $_e0 === 'agent' && !in_array($_e1, ['list','status','myip','regkey'], true) => true,
+    default => false,
+};
+if (!$_skipSession) {
+    session_start();
+}
+
+header('Content-Type: application/json');
+$_allowedOrigins = ['https://jarvis.orbishosting.com', 'http://jarvis.orbishosting.com'];
+$_origin = $_SERVER['HTTP_ORIGIN'] ?? '';
+if (in_array($_origin, $_allowedOrigins, true)) {
+    header('Access-Control-Allow-Origin: ' . $_origin);
+    header('Access-Control-Allow-Credentials: true');
+}
+header('Access-Control-Allow-Methods: GET, POST, OPTIONS');
+header('Access-Control-Allow-Headers: Content-Type, X-Session-Token');
+
+if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') { http_response_code(204); exit; }
+
+$uri      = $_SERVER['REQUEST_URI'] ?? '/';
+$method   = $_SERVER['REQUEST_METHOD'];
+$path     = trim(parse_url($uri, PHP_URL_PATH), '/');
+$parts    = explode('/', $path);
+
+if (($parts[0] ?? '') === 'api') array_shift($parts);
+$endpoint = $parts[0] ?? '';
+$action   = $parts[1] ?? '';
+
+// ── Auth check (skip for auth / agent / netscan) ──────────────────────
+if (!\in_array($endpoint, ['auth', 'agent', 'netscan'], true)) {
+    $token   = $_SESSION['jarvis_token'] ?? ($_SERVER['HTTP_X_SESSION_TOKEN'] ?? '');
+    $isValid = !empty($token) && $token === ($_SESSION['jarvis_token'] ?? '');
+    if (!$isValid) {
+        $ip      = $_SERVER['REMOTE_ADDR'] ?? '';
+        $isLocal = \in_array($ip, ['127.0.0.1', '::1', JARVIS_IP], true);
+        if (!$isLocal && $endpoint !== 'ping') {
+            http_response_code(401);
+            echo json_encode(['error' => 'Unauthorized', 'code' => 401]);
+            exit;
+        }
+    }
+}
+
+if ($endpoint !== 'auth') session_write_close();
+
+$body = file_get_contents('php://input');
+$data = json_decode($body, true) ?? [];
+
+// ── Fast ping (no file dispatch needed) ──────────────────────────────
+if ($endpoint === 'ping') {
+    echo json_encode(['status' => 'online', 'time' => date('c'), 'codename' => JARVIS_CODENAME]);
+    exit;
+}
+
+// ── Endpoint → file map ───────────────────────────────────────────────
+$endpoints = [
+    'auth'       => 'auth.php',
+    'chat'       => 'chat.php',
+    'system'     => 'system.php',
+    'netscan'    => 'netscan.php',
+    'network'    => 'network.php',
+    'proxmox'    => 'proxmox.php',
+    'ha'         => 'ha.php',
+    'tts'        => 'tts.php',
+    'email'      => 'email.php',
+    'do'         => 'do_server.php',
+    'alerts'     => 'alerts.php',
+    'facts'      => 'facts_collector.php',
+    'weather'    => 'weather.php',
+    'news'       => 'news.php',
+    'sites'      => 'sites.php',
+    'agent'      => 'agent.php',
+    'planner'    => 'planner.php',
+    'jellyfin'   => 'jellyfin.php',
+    'history'    => 'history.php',
+    'metrics'    => 'metrics.php',
+    'suggestions' => 'suggestions.php',
+    'arc'        => 'arc.php',
+    'directives' => 'directives.php',
+    'memory'     => 'memory.php',
+    'calendar'   => 'calendar_sync.php',
+];
+
+if (!isset($endpoints[$endpoint])) {
+    http_response_code(404);
+    echo json_encode(['error' => 'Unknown endpoint: ' . $endpoint]);
+    exit;
+}
+
+$file = __DIR__ . '/../api/endpoints/' . $endpoints[$endpoint];
+
+// ── Fault-isolated dispatch ───────────────────────────────────────────
+// ob_start() buffers any partial output so a mid-execution fatal doesn't
+// send a broken response. catch(Throwable) catches ParseError, TypeError,
+// and all other Errors + Exceptions in PHP 7+.
+ob_start();
+try {
+    require $file;
+    ob_end_flush();
+} catch (\Throwable $e) {
+    ob_end_clean();
+    http_response_code(500);
+    echo json_encode(['error' => 'Endpoint unavailable', 'endpoint' => $endpoint, 'code' => 500]);
+    error_log(sprintf('JARVIS API [%s] %s: %s in %s:%d',
+        $endpoint, get_class($e), $e->getMessage(), $e->getFile(), $e->getLine()
+    ));
+}

public_html/install-agent.sh

@@ -21,7 +21,14 @@ JARVIS_HOST=""
 INSTALL_DIR="/opt/jarvis-agent"
 CONFIG_DIR="/etc/jarvis-agent"
 STATE_DIR="/var/lib/jarvis-agent"
-REG_KEY="f846a9aaf7ce9a61742c63c87c4186052a71d2a580c65518"
+REG_KEY="${JARVIS_REG_KEY:-}"
+if [ -z "$REG_KEY" ] && [ -r /dev/tty ]; then
+  read -rp "Enter JARVIS registration key: " REG_KEY </dev/tty
+fi
+if [ -z "$REG_KEY" ]; then
+  echo "ERROR: registration key required (set JARVIS_REG_KEY env var or enter at prompt)" >&2
+  exit 1
+fi
 SERVICE_FILE="/etc/systemd/system/jarvis-agent.service"
 
 echo "=== JARVIS Agent Installer v3.0 ==="