F3h-01 script_service._build_kill_command: shlex.quote(log_path) wraps the
path in single-quotes; embedding that inside "..." produced a filename
with literal single-quote chars that cat/kill could not find.
Fix: use the shlex-quoted string directly without extra double-quotes.
F3h-02 script_service._substitute_db_vars: non-atomic string replacement
allowed nested substitution when a credential value contained another
$DB_* pattern. Fix: replace with null-byte sentinels first, then
substitute actual values in a second pass.
server_service.push_to_servers: add comment documenting that audit_repo and
retry_repo are None (internal compat shim — not used by routes).
Co-authored-by: Cursor <cursoragent@cursor.com>
- login.php: Fix JWT response format (success/access_token vs status=ok),
store JWT tokens in session, support TOTP 202 flow
- api_client.php: Dual auth (JWT Bearer + X-API-Key fallback), add
auto-refresh on 401, fix API endpoints (checkServerHealth → array,
getServerLogs, getAuditLogs, getDashboardStats field mapping)
- api_proxy.php: Fix check_all to use /api/servers/check (not per-server),
fix get_logs to support global endpoint, restart_multisync → restart_nexus
- install.php: Add 4 missing tables (platforms, nodes, ssh_sessions,
command_logs), fix table creation order for FK dependencies, add JWT
columns to admins, add new indexes, add platform_id/node_id/protocols/
extra_attrs/connectivity to servers
- logout.php: Call /api/auth/logout to invalidate JWT refresh token
- index.php: Use JWT Bearer auth for API calls
- server_service.py: Implement real check_all_servers with concurrent
httpx Agent health checks (was stub)
- servers.py: Add GET /api/servers/logs global sync logs endpoint
- Branding: MultiSync → Nexus across all PHP files (sidebar, titles,
TOTP issuer, version strings)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
r