Build a config that always fails client creation (garbage PEM key).

Get the latest cached report for a server.

Get the remote address of a connected agent.

SSRF guard for server-pushed probe targets. Resolves `host` and rejects loopback / link-local (incl. the 169.254.169.254 cloud-metadata endpoint) / NA

Dispatch a Docker-related server message.

Helper: insert a network probe record with optional latency.

Insert a raw record at the given time with a fixed cpu value so the hourly average is deterministic.

Drain the first-connect pushes the server emits to a default agent. These (ping/network sync + firewall blocklist messages) are unrelated to the docke

Returns `true` if `addr` is safe for the **service-monitor checkers** to connect to. Unlike [`is_global_addr`], this intentionally ALLOWS RFC1918 pri

List all in-scope servers with their summary metrics + uptime band.

Log an audit event.

Build the `detail` string for login audit rows (failed / rate-limited). The username is attacker-controlled on the public login endpoints, so it is tr

Perform a mobile login as the seeded admin and return the parsed `{ "data": MobileTokenResponse }` body.

Helper: fetch a path with a fresh client that does NOT follow redirects, so we observe the handler's own status directly. The SPA handler always retur

Notify the scheduler that the agent's egress IP has changed. If the new IP differs from the last known value the scheduler will immediately trigger a

Bring a mock agent fully online: connect, drain the `welcome` frame, and complete the SystemInfo handshake with the supplied capability bitmask (`None

Public routes (no auth required).

Reconcile the `file` capability bit against the file subsystem config. File management is a two-layer feature: the `file` capability bit advertises t

Read browser frames until one with `type == expected` arrives (5s budget), ignoring other interleaved frames. Panics on timeout.

Wait until the agent receives a frame whose `type` is `expected`, ignoring the first-connect noise (ping/network-probe sync + blocklist reset/sync). R

Retry registration with category-aware backoff. Returns immediately on permanent auth failure so the caller can exit with [`EXIT_CODE_PERMANENT_AUTH_F

Register a pending request for HTTP→WS relay with a custom TTL. Returns a oneshot receiver that will receive the agent's response.

Rename/move a file or directory. Both paths must be validated.

Resize a terminal session.

Trigger an immediate check outside the regular schedule.

Seed a mobile session plus a session row + device token that reference it.

Insert a scheduled task row targeting `server_ids`.

Send a single agent frame as a JSON text message.

Start a tiny webhook sink that captures the first inbound HTTP request.

Get metadata for a single file or directory.

Write base64-encoded content to a file atomically (via .sb-tmp rename).

Write input data (base64 encoded) to a terminal session.

Overlay an externally-observed IP on top of interface-derived primaries. Replaces whichever stack the external IP belongs to.

Bring up a mock agent with the given capability bitmask and drain the first-connect noise. Returns `(server_id, sink, reader)`.

Build a valid collection zip from `(folder, id)` pairs plus an embedded collection.json listing every entry.

Build the granular dependencies the extracted tick needs without an `AppState`: a fresh agent manager, an empty alert-state manager and a default conf

Deletes all sessions whose `expires_at` is strictly before `now`. Returns the number of rows removed so callers can log it. Extracted from the `run`

On macOS, APFS exposes the same disk (e.g. "Macintosh HD") at both `/` and `/System/Volumes/Data`, causing double-counting. Deduplicate by name only o

Tier-2.5 runtime allow-list. Merges `[server] trusted_proxies` with each connected agent's most recently reported external IP, both of which we must n

Get all connected agent server IDs.