Ingest correlates direct RDP logoff with open login events on the same host and user. Terminate-session treats missing qwinsta as already logged off.
Co-authored-by: Cursor <cursoragent@cursor.com>
Modal finish only after sawRunning or started_at after sessionOpenedAt, so a previous success no longer closes the window instantly while SAC updater is still running on the host.
Co-authored-by: Cursor <cursoragent@cursor.com>
Defer notify_lifecycle and notify_auth_login after commit; SAC_UVICORN_WORKERS via sac-api-start.sh; nginx /api/v1/events timeout; mass-update confirm in Hosts UI.
Pass UPDATE_VIA_SAC to the remote updater and run bootstrap with --deploy
so Linux hosts need only the SAC update button after initial config.
Co-authored-by: Cursor <cursoragent@cursor.com>
Close audit findings: anti-spoof client IP for login rate limit, JWT/CORS
enforce on startup, SSH host-key verification and sudo via stdin, optional
WinRM HTTPS, SSE httpOnly cookie auth, ingest body limit, ILIKE escaping,
and HMAC API key hashing with legacy SHA-256 fallback.
Move zip download and extract to user TEMP to avoid ProgramData access denied on DCs. Improve WinRM ERROR line parsing and add optional SAC_AGENT_BUNDLE_BASE_URL for LAN clients.
Co-authored-by: Cursor <cursoragent@cursor.com>
FCM/каналы для report.daily.* после commit ingest (BackgroundTasks);
SAC_DB_POOL_SIZE=15, SAC_DB_MAX_OVERFLOW=25 для штурма 09:00.
Co-authored-by: Cursor <cursoragent@cursor.com>
Treat acknowledged as active, dedupe by hostname, add PostgreSQL advisory lock and a unique index. Migration closes existing duplicate open problems.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add optional auto logoff of stuck sessions on RDG flap and direct RDP failure. Hide the RDS break button on old flap 302 when the user later reconnects or the workstation session is closed.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add host button probes Windows by hostname or Linux by IP, registers host in SAC and deploys agent in background.
Co-authored-by: Cursor <cursoragent@cursor.com>
Allow multiple remote update jobs at once; each upgrade gets its own
bottom-right log dock that auto-closes 30s after success.
Co-authored-by: Cursor <cursoragent@cursor.com>
Admin settings for web login whitelist, blocked IP list with unblock,
and optional fail2ban ignoreip sync for SSH jail.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add Omada-style git version arrow in the agent version column to trigger WinRM/SSH background updates, and soften host detail live refresh with debounced incremental event patches.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use event 302/303 instead of Win302 in RDG titles. Match event types by prefix in events list (e.g. rdg.connection).
Co-authored-by: Cursor <cursoragent@cursor.com>
Show RDS access via RDG-Comp or Haproxy-RDG-Comp, enable qwinsta/logoff on any RDG event with internal_ip.
Co-authored-by: Cursor <cursoragent@cursor.com>
PTah