- login.php: Redis-backed per-IP rate limit (10 fails / 15 min lockout), keyed off CF-Connecting-IP/X-Forwarded-For so it sees the real client behind NPM; fails open if Redis is down
- login.php: session_regenerate_id(true) on successful auth (prevents session fixation)
- php.ini: session.use_strict_mode = 1 (reject unknown/attacker-supplied session IDs)
- netscan.php: constant-time hash_equals for the registration-key check (matches agent.php)
Cookie flags already HttpOnly + SameSite=Lax (verified live). Agent auth verified: missing/bad X-Agent-Key -> 401 on every machine action.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- install.sh, install-agent.sh: require JARVIS_REG_KEY env var or interactive prompt instead of baked-in key (matches install-mac.sh/install-windows.ps1 behavior)
- netscan.php: reuse AGENT_REGISTRATION_KEY constant instead of a duplicate literal
- agent.php + api.php: add session-authed "regkey" action so the admin install modal fetches the current key at runtime
- jarvis-agents.js: fetch reg key via /api/agent/regkey instead of hardcoding it; pass JARVIS_REG_KEY in the Linux install one-liner
- INFRASTRUCTURE-REFERENCE.md: scrub old key literal (rotated; real value lives only in api/config.php on VM211)
Key rotated on the box + rolled out to all 11 agents (verified all re-register online). New value is in the gitignored api/config.php only.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- config.example.php: error_reporting(0) -> E_ALL (live config.php matches); add JELLYFIN_URL/JELLYFIN_API_KEY placeholders
- history.php, jellyfin.php: drop require of nonexistent includes/auth.php + AuthMiddleware call (router enforces auth centrally) — both endpoints were fataling on every request
- remove stale kb_intent_generator .bak files from deployed tree
DB (not in repo): kb_facts.fact_value TEXT -> MEDIUMTEXT; ha/entity_map had failed every write since Jul 2 at >64KB
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
myron
Claude