feat: T1016 dns_config probe + server-side drift detection + Crucible DNS DRIFT badge

2026-05-30 23:26:50 -07:00
parent 6704933568
commit d005d5d07c
48 changed files with 4621 additions and 22 deletions
--- a/server/internal/alerts/notify_test.go
+++ b/server/internal/alerts/notify_test.go
@@ -0,0 +1,84 @@
+package alerts
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestSendTelegramNoOpWhenUnconfigured(t *testing.T) {
+	if err := SendTelegram(NotifyConfig{}, "hello"); err != nil {
+		t.Fatalf("expected nil when unconfigured, got %v", err)
+	}
+	if err := SendTelegram(NotifyConfig{TelegramBotToken: "tok"}, "hello"); err != nil {
+		t.Fatalf("expected nil with token only, got %v", err)
+	}
+}
+
+func TestSendTelegramSuccess(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			t.Errorf("method: %s", r.Method)
+		}
+		body, _ := io.ReadAll(r.Body)
+		if !strings.Contains(string(body), `"chat_id":"123"`) {
+			t.Fatalf("body: %s", body)
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	// Telegram URL is fixed host; patch via custom transport is heavy — test status path only
+	// by calling with invalid token path that still exercises client.Do error paths.
+	cfg := NotifyConfig{TelegramBotToken: "testtoken", TelegramChatID: "123"}
+	// Real call hits api.telegram.org — expect network error, not panic.
+	err := SendTelegram(cfg, "alert")
+	if err == nil {
+		// Network may succeed in some envs; accept nil only if we can't reach internet.
+		return
+	}
+	if !strings.Contains(err.Error(), "telegram") && !strings.Contains(err.Error(), "connect") &&
+		!strings.Contains(err.Error(), "no such host") && !strings.Contains(err.Error(), "API status") {
+		t.Fatalf("unexpected telegram error: %v", err)
+	}
+	_ = srv // keep handler pattern for future injectable client
+}
+
+func TestSendTelegramAPIError(t *testing.T) {
+	// Use httptest to validate error on non-2xx when we can intercept — documented via
+	// direct status check helper.
+	if err := SendTelegram(NotifyConfig{TelegramBotToken: "x", TelegramChatID: "y"}, ""); err != nil {
+		// offline / blocked is fine
+		return
+	}
+}
+
+func TestSendEmailNoOpWhenDisabled(t *testing.T) {
+	if err := SendEmail(NotifyConfig{}, "subj", "body"); err != nil {
+		t.Fatalf("disabled email should no-op: %v", err)
+	}
+	if err := SendEmail(NotifyConfig{EmailEnabled: true}, "subj", "body"); err != nil {
+		t.Fatalf("missing smtp should no-op: %v", err)
+	}
+}
+
+func TestSendEmailDefaultsFromAndPort(t *testing.T) {
+	// SendMail will fail without real SMTP; ensure we reach it with defaults without panic.
+	cfg := NotifyConfig{
+		EmailEnabled: true,
+		SMTPHost:     "127.0.0.1",
+		SMTPPort:     0,
+		EmailTo:      "to@example.com",
+		SMTPUser:     "from@example.com",
+	}
+	err := SendEmail(cfg, "subject", "body")
+	if err == nil {
+		t.Fatal("expected smtp connection error")
+	}
+}
+
+func TestNotifyAllDoesNotPanic(t *testing.T) {
+	NotifyAll(NotifyConfig{}, "subject", "text")
+}
--- a/server/internal/api/blueprint_handler_test.go
+++ b/server/internal/api/blueprint_handler_test.go
@@ -0,0 +1,159 @@
+package api
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+)
+
+func newTestBlueprintHandler(t *testing.T) (*BlueprintHandler, string) {
+	t.Helper()
+	dataDir := t.TempDir()
+	return NewBlueprintHandler(dataDir), dataDir
+}
+
+func TestSanitizeFilename(t *testing.T) {
+	if sanitizeFilename("  my preset  ") != "my preset" {
+		t.Fatalf("trim failed: %q", sanitizeFilename("  my preset  "))
+	}
+	if sanitizeFilename("../../../etc/passwd") == "" || strings.Contains(sanitizeFilename("../../../etc/passwd"), "..") {
+		t.Fatalf("traversal not sanitized: %q", sanitizeFilename("../../../etc/passwd"))
+	}
+	if sanitizeFilename("bad/name") != "badname" {
+		t.Fatalf("slashes removed: %q", sanitizeFilename("bad/name"))
+	}
+}
+
+func TestBlueprintListEmpty(t *testing.T) {
+	h, _ := newTestBlueprintHandler(t)
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/blueprints", nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d body %s", rec.Code, rec.Body.String())
+	}
+	var list []BlueprintInfo
+	if err := json.Unmarshal(rec.Body.Bytes(), &list); err != nil {
+		t.Fatal(err)
+	}
+	if len(list) != 0 {
+		t.Fatalf("expected empty list, got %d", len(list))
+	}
+}
+
+func TestBlueprintSaveGetDelete(t *testing.T) {
+	h, dataDir := newTestBlueprintHandler(t)
+
+	saveBody, _ := json.Marshal(map[string]interface{}{
+		"name": "fleet-default",
+		"data": map[string]interface{}{"pool_host": "pool.example.com", "threads": 4},
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/blueprints", bytes.NewReader(saveBody))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("save status %d body %s", rec.Code, rec.Body.String())
+	}
+
+	filePath := filepath.Join(dataDir, "blueprints", "fleet-default.json")
+	if _, err := os.Stat(filePath); err != nil {
+		t.Fatalf("blueprint file missing: %v", err)
+	}
+
+	req = httptest.NewRequest(http.MethodGet, "/api/v1/blueprints", nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	var listed []BlueprintInfo
+	if err := json.Unmarshal(rec.Body.Bytes(), &listed); err != nil {
+		t.Fatal(err)
+	}
+	if len(listed) != 1 || listed[0].Name != "fleet-default" {
+		t.Fatalf("list after save: %+v", listed)
+	}
+
+	r := chi.NewRouter()
+	r.Get("/blueprints/{name}", h.GetBlueprint)
+	req = httptest.NewRequest(http.MethodGet, "/blueprints/fleet-default", nil)
+	rec = httptest.NewRecorder()
+	r.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("get status %d body %s", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "pool.example.com") {
+		t.Fatalf("unexpected blueprint body: %s", rec.Body.String())
+	}
+
+	req = httptest.NewRequest(http.MethodDelete, "/api/v1/blueprints?name=fleet-default", nil)
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("delete status %d body %s", rec.Code, rec.Body.String())
+	}
+	if _, err := os.Stat(filePath); !os.IsNotExist(err) {
+		t.Fatal("blueprint file should be removed")
+	}
+}
+
+func TestBlueprintSaveValidationErrors(t *testing.T) {
+	h, _ := newTestBlueprintHandler(t)
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/blueprints", bytes.NewReader([]byte(`{"name":"","data":{}}`)))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("empty name should be 400, got %d", rec.Code)
+	}
+
+	req = httptest.NewRequest(http.MethodPost, "/api/v1/blueprints", bytes.NewReader([]byte(`not-json`)))
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("invalid json should be 400, got %d", rec.Code)
+	}
+
+	req = httptest.NewRequest(http.MethodPost, "/api/v1/blueprints", bytes.NewReader([]byte(`{"name":"ok","data":}`)))
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("malformed data json should be 400, got %d", rec.Code)
+	}
+}
+
+func TestBlueprintGetNotFound(t *testing.T) {
+	h, _ := newTestBlueprintHandler(t)
+	r := chi.NewRouter()
+	r.Get("/blueprints/{name}", h.GetBlueprint)
+	req := httptest.NewRequest(http.MethodGet, "/blueprints/missing", nil)
+	rec := httptest.NewRecorder()
+	r.ServeHTTP(rec, req)
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("expected 404, got %d", rec.Code)
+	}
+}
+
+func TestBlueprintDeleteMissingName(t *testing.T) {
+	h, _ := newTestBlueprintHandler(t)
+	req := httptest.NewRequest(http.MethodDelete, "/api/v1/blueprints", nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", rec.Code)
+	}
+}
+
+func TestBlueprintMethodNotAllowed(t *testing.T) {
+	h, _ := newTestBlueprintHandler(t)
+	req := httptest.NewRequest(http.MethodPatch, "/api/v1/blueprints", nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusMethodNotAllowed {
+		t.Fatalf("expected 405, got %d", rec.Code)
+	}
+}
--- a/server/internal/api/dropper_handler_test.go
+++ b/server/internal/api/dropper_handler_test.go
@@ -0,0 +1,150 @@
+package api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"crypto-miner-server/internal/db"
+	"crypto-miner-server/internal/models"
+)
+
+func newTestDropperHandler(t *testing.T) (*DropperHandler, *db.Database, string) {
+	t.Helper()
+	dataDir := t.TempDir()
+	database, err := db.New(dataDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	return NewDropperHandler(database, func() string { return "https://public.example.com" }), database, dataDir
+}
+
+func TestDetectPlatformQueryParam(t *testing.T) {
+	cases := map[string]string{
+		"windows": "windows", "win": "windows",
+		"linux": "linux",
+		"darwin": "darwin", "mac": "darwin", "macos": "darwin",
+		"universal": "universal", "any": "universal",
+		"unknown": "",
+	}
+	for in, want := range cases {
+		req := httptest.NewRequest(http.MethodGet, "/get?os="+in, nil)
+		if got := detectPlatform(req); got != want {
+			t.Fatalf("detectPlatform(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestDetectPlatformUserAgent(t *testing.T) {
+	tests := []struct {
+		ua   string
+		want string
+	}{
+		{"Mozilla/5.0 (Windows NT 10.0)", "windows"},
+		{"Mozilla/5.0 (Macintosh; Intel Mac OS X)", "darwin"},
+		{"Mozilla/5.0 (X11; Linux x86_64)", "linux"},
+		{"curl/8.0", ""},
+	}
+	for _, tc := range tests {
+		req := httptest.NewRequest(http.MethodGet, "/get", nil)
+		req.Header.Set("User-Agent", tc.ua)
+		if got := detectPlatform(req); got != tc.want {
+			t.Fatalf("UA %q => %q, want %q", tc.ua, got, tc.want)
+		}
+	}
+}
+
+func TestDropperServeGetNoBuilds(t *testing.T) {
+	h, _, _ := newTestDropperHandler(t)
+	req := httptest.NewRequest(http.MethodGet, "/get", nil)
+	rec := httptest.NewRecorder()
+	h.ServeGet(rec, req)
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("expected 404, got %d", rec.Code)
+	}
+	if !strings.Contains(rec.Body.String(), "no agent build available") {
+		t.Fatalf("unexpected body: %s", rec.Body.String())
+	}
+}
+
+func TestDropperServeGetWindowsBuild(t *testing.T) {
+	h, database, dataDir := newTestDropperHandler(t)
+	buildID := "win-build"
+	buildDir := filepath.Join(dataDir, "builds", buildID)
+	if err := os.MkdirAll(buildDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	binPath := filepath.Join(buildDir, "worker.exe")
+	content := []byte("windows-agent-binary")
+	if err := os.WriteFile(binPath, content, 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.InsertBuild(&models.BuildRecord{
+		ID: buildID, WorkerName: "w", ServerURL: "http://x", Wallet: "48x",
+		FilePath: binPath, FileName: "worker.exe", Platform: "windows",
+		CreatedAt: time.Now(),
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/get?os=windows", nil)
+	rec := httptest.NewRecorder()
+	h.ServeGet(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d body=%s", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(rec.Header().Get("Content-Disposition"), "worker.exe") {
+		t.Fatalf("missing disposition: %q", rec.Header().Get("Content-Disposition"))
+	}
+}
+
+func TestDropperResolveBasePublicURL(t *testing.T) {
+	h, _, _ := newTestDropperHandler(t)
+	req := httptest.NewRequest(http.MethodGet, "/install.sh", nil)
+	req.Host = "ignored.local:8989"
+	if base := h.resolveBase(req); base != "https://public.example.com" {
+		t.Fatalf("publicURL override = %q", base)
+	}
+}
+
+func TestDropperResolveBaseFromRequest(t *testing.T) {
+	h := NewDropperHandler(nil, nil)
+	req := httptest.NewRequest(http.MethodGet, "/install.sh", nil)
+	req.Host = "deck.local:8989"
+	req.Header.Set("X-Forwarded-Host", "proxy.example.com")
+	if base := h.resolveBase(req); base != "http://proxy.example.com" {
+		t.Fatalf("resolveBase = %q", base)
+	}
+}
+
+func TestDropperServeShContent(t *testing.T) {
+	h, _, _ := newTestDropperHandler(t)
+	req := httptest.NewRequest(http.MethodGet, "/install.sh", nil)
+	rec := httptest.NewRecorder()
+	h.ServeSh(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d", rec.Code)
+	}
+	body := rec.Body.String()
+	if !strings.Contains(body, "#!/bin/sh") || !strings.Contains(body, "https://public.example.com/get") {
+		t.Fatalf("unexpected install.sh body prefix: %.120s", body)
+	}
+}
+
+func TestDropperServePs1Content(t *testing.T) {
+	h, _, _ := newTestDropperHandler(t)
+	req := httptest.NewRequest(http.MethodGet, "/install.ps1", nil)
+	rec := httptest.NewRecorder()
+	h.ServePs1(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d", rec.Code)
+	}
+	if !strings.Contains(rec.Body.String(), "DownloadFile") {
+		t.Fatal("expected PowerShell download snippet")
+	}
+}
--- a/server/internal/api/handlers_test.go
+++ b/server/internal/api/handlers_test.go
@@ -7,6 +7,7 @@ import (
 	"testing"

 	"crypto-miner-server/internal/db"
+	"crypto-miner-server/internal/models"
 	"github.com/go-chi/chi/v5"
 )

@@ -89,3 +90,120 @@ func TestGetAgentNotFound(t *testing.T) {
 		t.Fatalf("expected 404, got %d", rec.Code)
 	}
 }
+
+const (
+	handlerAgentStatsDefaultLimit = 100
+	handlerAgentStatsMaxLimit     = 1000
+	handlerSharesDefaultLimit     = 50
+	handlerSharesMaxLimit         = 1000
+	handlerListBuildsLimit        = 50
+)
+
+func TestHandlerConstants(t *testing.T) {
+	if handlerAgentStatsDefaultLimit != 100 || handlerAgentStatsMaxLimit != 1000 {
+		t.Fatal("agent stats limit constants drifted")
+	}
+	if handlerSharesDefaultLimit != 50 || handlerSharesMaxLimit != 1000 {
+		t.Fatal("shares limit constants drifted")
+	}
+	if handlerListBuildsLimit != 50 {
+		t.Fatal("list builds limit constant drifted")
+	}
+}
+
+func TestGetDashboardStatsEmptyFleet(t *testing.T) {
+	h := newTestHandler(t)
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/dashboard/stats", nil)
+	rec := httptest.NewRecorder()
+	h.GetDashboardStats(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d body %s", rec.Code, rec.Body.String())
+	}
+}
+
+func TestListBuildsEmptyArray(t *testing.T) {
+	h := newTestHandler(t)
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/builds", nil)
+	rec := httptest.NewRecorder()
+	h.ListBuilds(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d", rec.Code)
+	}
+	var builds []json.RawMessage
+	if err := json.Unmarshal(rec.Body.Bytes(), &builds); err != nil {
+		t.Fatal(err)
+	}
+	if len(builds) != 0 {
+		t.Fatalf("expected empty builds, got %d", len(builds))
+	}
+}
+
+func TestPinBuildAndUnpinAll(t *testing.T) {
+	h := newTestHandler(t)
+	database := h.db
+	if err := database.InsertBuild(&models.BuildRecord{
+		ID: "pin-me", WorkerName: "w", ServerURL: "http://x", Wallet: "48x",
+		FilePath: "/tmp/x", FileName: "x.exe", Platform: "windows",
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	r := chi.NewRouter()
+	r.Put("/builds/{id}/pin", h.PinBuild)
+	r.Delete("/builds/pin", h.UnpinAll)
+
+	req := httptest.NewRequest(http.MethodPut, "/builds/pin-me/pin", nil)
+	rec := httptest.NewRecorder()
+	r.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("pin status %d body %s", rec.Code, rec.Body.String())
+	}
+
+	req = httptest.NewRequest(http.MethodDelete, "/builds/pin", nil)
+	rec = httptest.NewRecorder()
+	r.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("unpin status %d body %s", rec.Code, rec.Body.String())
+	}
+}
+
+func TestDeleteBuildSuccess(t *testing.T) {
+	h := newTestHandler(t)
+	if err := h.db.InsertBuild(&models.BuildRecord{
+		ID: "del-me", WorkerName: "w", ServerURL: "http://x", Wallet: "48x",
+		FilePath: "/tmp/x", FileName: "x.exe", Platform: "windows",
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	r := chi.NewRouter()
+	r.Delete("/builds/{id}", h.DeleteBuild)
+	req := httptest.NewRequest(http.MethodDelete, "/builds/del-me", nil)
+	rec := httptest.NewRecorder()
+	r.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("delete status %d body %s", rec.Code, rec.Body.String())
+	}
+}
+
+func TestGetRecentSharesDefaultLimit(t *testing.T) {
+	h := newTestHandler(t)
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/shares", nil)
+	rec := httptest.NewRecorder()
+	h.GetRecentShares(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d", rec.Code)
+	}
+}
+
+func TestGetAgentStatsInvalidLimitUsesDefault(t *testing.T) {
+	h := newTestHandler(t)
+	req := httptest.NewRequest(http.MethodGet, "/agents/x/stats?limit=abc", nil)
+	rec := httptest.NewRecorder()
+	r := chi.NewRouter()
+	r.Get("/agents/{id}/stats", h.GetAgentStats)
+	r.ServeHTTP(rec, req)
+	if rec.Code == http.StatusInternalServerError {
+		t.Fatalf("invalid limit should not 500: %s", rec.Body.String())
+	}
+}
--- a/server/internal/api/router_test.go
+++ b/server/internal/api/router_test.go
@@ -0,0 +1,396 @@
+package api
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"crypto-miner-server/internal/builder"
+	"crypto-miner-server/internal/db"
+	"crypto-miner-server/internal/models"
+	"crypto-miner-server/internal/pool"
+)
+
+const routerAuthCacheTTL = 5 * time.Minute
+
+func resetAuthState(t *testing.T) {
+	t.Helper()
+	authSessionCacheMu.Lock()
+	authSessionCache = map[string]time.Time{}
+	authSessionCacheMu.Unlock()
+	usersMu.Lock()
+	authUsers = map[string]string{}
+	usersFilePath = ""
+	usersMu.Unlock()
+	SetAgentPathSecret("")
+	SetRotateSecretFn(nil)
+	t.Cleanup(resetAuthGlobals)
+}
+
+func resetAuthGlobals() {
+	authSessionCacheMu.Lock()
+	authSessionCache = map[string]time.Time{}
+	authSessionCacheMu.Unlock()
+	SetAgentPathSecret("")
+	SetRotateSecretFn(nil)
+}
+
+func TestRouterConstants(t *testing.T) {
+	if authCacheTTL != routerAuthCacheTTL {
+		t.Fatalf("authCacheTTL = %v, want %v", authCacheTTL, routerAuthCacheTTL)
+	}
+}
+
+func TestAuthCacheKeyDeterministic(t *testing.T) {
+	k1 := authCacheKey("user", "pass")
+	k2 := authCacheKey("user", "pass")
+	if k1 != k2 || k1 == "" {
+		t.Fatalf("cache key not stable: %q %q", k1, k2)
+	}
+	if authCacheKey("user", "other") == k1 {
+		t.Fatal("different passwords should produce different cache keys")
+	}
+}
+
+func TestBasicAuthMiddlewareOptionsPassthrough(t *testing.T) {
+	resetAuthState(t)
+	called := false
+	h := basicAuthMiddleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		called = true
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	req := httptest.NewRequest(http.MethodOptions, "/api/v1/config", nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if !called || rec.Code != http.StatusNoContent {
+		t.Fatalf("OPTIONS should bypass auth: called=%v status=%d", called, rec.Code)
+	}
+}
+
+func TestBasicAuthMiddlewareHealthPublic(t *testing.T) {
+	resetAuthState(t)
+	h := basicAuthMiddleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/health", nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("health should be public, got %d", rec.Code)
+	}
+}
+
+func TestBasicAuthMiddlewareBuildDownloadPublic(t *testing.T) {
+	resetAuthState(t)
+	h := basicAuthMiddleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	paths := []string{
+		"/api/v1/builds/abc/download",
+		"/api/v1/builds/abc/artifact/worker.exe",
+	}
+	for _, path := range paths {
+		req := httptest.NewRequest(http.MethodGet, path, nil)
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != http.StatusOK {
+			t.Fatalf("%s should be public, got %d", path, rec.Code)
+		}
+	}
+}
+
+func TestBasicAuthMiddlewareDropperPublic(t *testing.T) {
+	resetAuthState(t)
+	h := basicAuthMiddleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	for _, path := range []string{"/get", "/install.sh", "/install.ps1"} {
+		req := httptest.NewRequest(http.MethodGet, path, nil)
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != http.StatusOK {
+			t.Fatalf("%s should be public, got %d", path, rec.Code)
+		}
+	}
+}
+
+func TestBasicAuthMiddlewareMissingCredentials(t *testing.T) {
+	resetAuthState(t)
+	usersMu.Lock()
+	authUsers["admin"] = "secret"
+	usersMu.Unlock()
+
+	h := basicAuthMiddleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Fatal("handler should not run without auth")
+	}))
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/agents", nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("expected 401, got %d", rec.Code)
+	}
+	if !strings.Contains(rec.Header().Get("WWW-Authenticate"), "Basic") {
+		t.Fatal("expected WWW-Authenticate header")
+	}
+}
+
+func TestBasicAuthMiddlewareWrongPassword(t *testing.T) {
+	resetAuthState(t)
+	hashed, err := hashPassword("correct")
+	if err != nil {
+		t.Fatal(err)
+	}
+	usersMu.Lock()
+	authUsers["admin"] = hashed
+	usersMu.Unlock()
+
+	h := basicAuthMiddleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Fatal("handler should not run with bad password")
+	}))
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/agents", nil)
+	req.SetBasicAuth("admin", "wrong")
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("expected 401, got %d", rec.Code)
+	}
+}
+
+func TestBasicAuthMiddlewareValidCredentials(t *testing.T) {
+	resetAuthState(t)
+	hashed, err := hashPassword("correct")
+	if err != nil {
+		t.Fatal(err)
+	}
+	usersMu.Lock()
+	authUsers["admin"] = hashed
+	usersMu.Unlock()
+
+	h := basicAuthMiddleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/agents", nil)
+	req.SetBasicAuth("admin", "correct")
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d", rec.Code)
+	}
+	if !authCacheHit("admin", "correct") {
+		t.Fatal("successful auth should populate cache")
+	}
+}
+
+func TestBasicAuthMiddlewareAgentPathFleetSecret(t *testing.T) {
+	resetAuthState(t)
+	SetAgentPathSecret("fleet-secret-123")
+
+	h := basicAuthMiddleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/agent/decide", nil)
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("missing fleet secret should be 403, got %d", rec.Code)
+	}
+
+	req = httptest.NewRequest(http.MethodPost, "/api/v1/agent/decide", nil)
+	req.Header.Set("X-Fleet-Secret", "fleet-secret-123")
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("valid fleet secret should pass, got %d", rec.Code)
+	}
+}
+
+func TestRouterPostUsersValidation(t *testing.T) {
+	router, _ := newTestRouter(t)
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/users", bytes.NewReader([]byte(`{}`)))
+	req.SetBasicAuth(testAuthUser, testAuthPass)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("empty payload should be 400, got %d body=%s", rec.Code, rec.Body.String())
+	}
+}
+
+func TestRouterPostUsersSuccess(t *testing.T) {
+	router, dataDir := newTestRouter(t)
+
+	body, _ := json.Marshal(map[string]string{"username": "newop", "password": "newpass"})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/users", bytes.NewReader(body))
+	req.SetBasicAuth(testAuthUser, testAuthPass)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d body=%s", rec.Code, rec.Body.String())
+	}
+
+	usersPath := filepath.Join(dataDir, "users.json")
+	data, err := os.ReadFile(usersPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var users map[string]string
+	if err := json.Unmarshal(data, &users); err != nil {
+		t.Fatal(err)
+	}
+	if !checkPassword(users["newop"], "newpass") {
+		t.Fatal("new user password should be bcrypt stored and verifiable")
+	}
+}
+
+func TestRouterRotateSecretNotConfigured(t *testing.T) {
+	router, _ := newTestRouter(t)
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/server/rotate-secret", nil)
+	req.SetBasicAuth(testAuthUser, testAuthPass)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusServiceUnavailable {
+		t.Fatalf("expected 503, got %d body=%s", rec.Code, rec.Body.String())
+	}
+}
+
+func TestRouterRotateSecretSuccess(t *testing.T) {
+	router, _ := newTestRouter(t)
+	SetRotateSecretFn(func() (string, error) {
+		return "new-secret-token-xyz", nil
+	})
+	t.Cleanup(func() { SetRotateSecretFn(nil) })
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/server/rotate-secret", nil)
+	req.SetBasicAuth(testAuthUser, testAuthPass)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d body=%s", rec.Code, rec.Body.String())
+	}
+	var body map[string]interface{}
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatal(err)
+	}
+	if body["ok"] != true {
+		t.Fatalf("unexpected body: %v", body)
+	}
+}
+
+func TestRouterBuilderCancelNotFound(t *testing.T) {
+	router, _ := newTestRouter(t)
+	req := httptest.NewRequest(http.MethodDelete, "/api/v1/builder/cancel/missing-token", nil)
+	req.SetBasicAuth(testAuthUser, testAuthPass)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("expected 404, got %d body=%s", rec.Code, rec.Body.String())
+	}
+}
+
+func TestRouterBuildDownloadNoAuth(t *testing.T) {
+	dataDir := t.TempDir()
+	seedTestUsers(t, dataDir)
+	database, err := db.New(dataDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { database.Close() })
+
+	buildID := "dl-build"
+	buildDir := filepath.Join(dataDir, "builds", buildID)
+	if err := os.MkdirAll(buildDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	binPath := filepath.Join(buildDir, "agent.exe")
+	if err := os.WriteFile(binPath, []byte("fake-binary"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.InsertBuild(&models.BuildRecord{
+		ID: buildID, WorkerName: "w", ServerURL: "http://x", Wallet: "48x",
+		FilePath: binPath, FileName: "agent.exe", Platform: "windows",
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	wsHub := NewWSHub(database)
+	cfg := &mockConfigProvider{}
+	configHandler := NewConfigHandler(database, cfg)
+	aiHandler := NewAIHandler(database)
+	fleetHandler := NewFleetHandler(database, wsHub, aiHandler, nil, nil, pool.Config{})
+	builderHandler := builder.NewHandler(database, dataDir, "", dataDir)
+	blueprintHandler := NewBlueprintHandler(dataDir)
+	router := NewRouter(database, wsHub, configHandler, builderHandler, blueprintHandler, aiHandler, fleetHandler, NewDropperHandler(database, nil), "", dataDir, nil)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/builds/"+buildID+"/download", nil)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("download should be public, got %d body=%s", rec.Code, rec.Body.String())
+	}
+}
+
+func TestRouterDropperInstallScriptsPublic(t *testing.T) {
+	router, _ := newTestRouter(t)
+	for _, path := range []string{"/install.sh", "/install.ps1"} {
+		req := httptest.NewRequest(http.MethodGet, path, nil)
+		req.Host = "forge.local:8989"
+		rec := httptest.NewRecorder()
+		router.ServeHTTP(rec, req)
+		if rec.Code != http.StatusOK {
+			t.Fatalf("%s status=%d", path, rec.Code)
+		}
+		if !strings.Contains(rec.Body.String(), "AetherForge") {
+			t.Fatalf("%s missing branding", path)
+		}
+	}
+}
+
+func TestRouterSPAFallbackUnknownRoute(t *testing.T) {
+	router, _ := newTestRouter(t)
+	req := httptest.NewRequest(http.MethodGet, "/unknown-dashboard-route", nil)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected SPA fallback 200, got %d", rec.Code)
+	}
+	if !strings.Contains(rec.Body.String(), "AetherForge") {
+		t.Fatal("expected index.html fallback")
+	}
+}
+
+func TestRouterNoWebRootFallback(t *testing.T) {
+	dataDir := t.TempDir()
+	seedTestUsers(t, dataDir)
+	database, err := db.New(dataDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { database.Close() })
+
+	wsHub := NewWSHub(database)
+	cfg := &mockConfigProvider{}
+	configHandler := NewConfigHandler(database, cfg)
+	aiHandler := NewAIHandler(database)
+	fleetHandler := NewFleetHandler(database, wsHub, aiHandler, nil, nil, pool.Config{})
+	builderHandler := builder.NewHandler(database, dataDir, "", dataDir)
+	blueprintHandler := NewBlueprintHandler(dataDir)
+
+	router := NewRouter(database, wsHub, configHandler, builderHandler, blueprintHandler, aiHandler, fleetHandler, nil, "", dataDir, nil)
+
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d", rec.Code)
+	}
+	if !strings.Contains(rec.Body.String(), "No frontend configured") {
+		t.Fatalf("unexpected body: %s", rec.Body.String())
+	}
+}
--- a/server/internal/api/websocket.go
+++ b/server/internal/api/websocket.go
@@ -41,9 +41,9 @@ func checkDashboardWSToken(r *http.Request) bool {
 	}
 	user, pass := parts[0], parts[1]
 	usersMu.RLock()
-	expectedPass, exists := authUsers[user]
+	stored, exists := authUsers[user]
 	usersMu.RUnlock()
-	return exists && secureStringEqual(pass, expectedPass)
+	return exists && checkPassword(stored, pass)
 }

 var upgrader = websocket.Upgrader{
@@ -106,6 +106,8 @@ type WSHub struct {
 	agentConfigs       map[string]AgentForgeConfig
 	agentCapabilities  map[string]models.AgentCapabilities
 	agentLogs          map[string]string
+	// T1016 DNS drift detection — stores last seen resolver list per agent
+	agentDNS           map[string][]string
 	serverPolicy    ServerPolicy
 	pingIntervalSec int
 	fleetSecret     string // baked into forged agents; verified on WS connect
@@ -120,6 +122,7 @@ func NewWSHub(database *db.Database) *WSHub {
 		agentConfigs:      make(map[string]AgentForgeConfig),
 		agentCapabilities: make(map[string]models.AgentCapabilities),
 		agentLogs:         make(map[string]string),
+		agentDNS:          make(map[string][]string),
 		pingIntervalSec: 30,
 	}
 }
@@ -519,6 +522,9 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 				CPUUsagePct     float64 `json:"cpu_usage_pct"`
 				MemoryUsagePct  float64 `json:"memory_usage_pct"`
 				UptimeSeconds   int     `json:"uptime_seconds"`
+			// DNS config (T1016)
+			DNSServers       []string `json:"dns_servers,omitempty"`
+			DNSSearchDomains []string `json:"dns_search_domains,omitempty"`
 			// Resource pressure
 			CPUFreqMHz  *int     `json:"cpu_freq_mhz,omitempty"`
 			CPUMaxMHz   *int     `json:"cpu_max_mhz,omitempty"`
@@ -587,6 +593,23 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 			if stats.GPUTempC != nil    { broadcast["gpu_temp_c"]    = *stats.GPUTempC    }
 			if stats.GPUUsagePct != nil { broadcast["gpu_usage_pct"] = *stats.GPUUsagePct }

+			// T1016 DNS drift detection
+			if len(stats.DNSServers) > 0 {
+				broadcast["dns_servers"] = stats.DNSServers
+				if stats.DNSSearchDomains != nil {
+					broadcast["dns_search_domains"] = stats.DNSSearchDomains
+				}
+				h.mu.Lock()
+				prev, hasPrev := h.agentDNS[agentID]
+				drifted := hasPrev && !dnsEqual(prev, stats.DNSServers)
+				h.agentDNS[agentID] = stats.DNSServers
+				h.mu.Unlock()
+				if drifted {
+					broadcast["dns_drifted"] = true
+					log.Printf("[T1016] DNS drift detected on agent %s: %v → %v", agentID, prev, stats.DNSServers)
+				}
+			}
+
 			if stats.SSHAvailable != nil {
 				broadcast["ssh_available"] = *stats.SSHAvailable
 			}
@@ -850,6 +873,25 @@ func mustMarshal(v interface{}) json.RawMessage {
 	return data
 }

+// dnsEqual returns true when two DNS server lists contain the same addresses
+// regardless of order.  Used for T1016 drift detection.
+func dnsEqual(a, b []string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	m := make(map[string]int, len(a))
+	for _, v := range a {
+		m[v]++
+	}
+	for _, v := range b {
+		m[v]--
+		if m[v] < 0 {
+			return false
+		}
+	}
+	return true
+}
+
 // BroadcastToAgents sends a message to all connected agents
 func (h *WSHub) BroadcastToAgents(msg Message) {
 	h.mu.RLock()
--- a/server/internal/api/websocket_test.go
+++ b/server/internal/api/websocket_test.go
@@ -0,0 +1,314 @@
+package api
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"crypto-miner-server/internal/db"
+	"crypto-miner-server/internal/models"
+	"crypto-miner-server/internal/pool"
+
+	"github.com/gorilla/websocket"
+)
+
+const wsDefaultPingIntervalSec = 30
+
+func resetWSAuthUsers(t *testing.T, user, pass string) {
+	t.Helper()
+	hashed, err := hashPassword(pass)
+	if err != nil {
+		t.Fatal(err)
+	}
+	usersMu.Lock()
+	authUsers = map[string]string{user: hashed}
+	usersMu.Unlock()
+	t.Cleanup(func() {
+		usersMu.Lock()
+		authUsers = map[string]string{}
+		usersMu.Unlock()
+	})
+}
+
+func wsDashboardToken(user, pass string) string {
+	return base64.StdEncoding.EncodeToString([]byte(user + ":" + pass))
+}
+
+func dialAgentWS(t *testing.T, hub *WSHub) (*websocket.Conn, string) {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(hub.HandleAgentWS))
+	t.Cleanup(srv.Close)
+	wsURL := "ws" + strings.TrimPrefix(srv.URL, "http")
+	conn, _, err := websocket.DefaultDialer.Dial(wsURL, nil)
+	if err != nil {
+		t.Fatalf("dial: %v", err)
+	}
+	t.Cleanup(func() { _ = conn.Close() })
+	return conn, wsURL
+}
+
+func authAgentConn(t *testing.T, conn *websocket.Conn, payload map[string]interface{}) Message {
+	t.Helper()
+	data, _ := json.Marshal(payload)
+	if err := conn.WriteJSON(Message{Type: "auth", Payload: data}); err != nil {
+		t.Fatal(err)
+	}
+	var resp Message
+	if err := conn.ReadJSON(&resp); err != nil {
+		t.Fatalf("read auth_response: %v", err)
+	}
+	return resp
+}
+
+func TestWSHubPingIntervalConstants(t *testing.T) {
+	hub := NewWSHub(nil)
+	if hub.pingIntervalSec != wsDefaultPingIntervalSec {
+		t.Fatalf("default ping interval = %d", hub.pingIntervalSec)
+	}
+	hub.SetPingInterval(5)
+	if hub.pingIntervalSec != wsDefaultPingIntervalSec {
+		t.Fatalf("below-minimum ping should clamp to %d, got %d", wsDefaultPingIntervalSec, hub.pingIntervalSec)
+	}
+	hub.SetPingInterval(15)
+	if hub.pingIntervalSec != 15 {
+		t.Fatalf("expected 15, got %d", hub.pingIntervalSec)
+	}
+	if hub.pingInterval().Seconds() != 15 {
+		t.Fatalf("pingInterval duration = %v", hub.pingInterval())
+	}
+}
+
+func TestCheckDashboardWSTokenBcryptUser(t *testing.T) {
+	resetWSAuthUsers(t, "dash", "secret-pass")
+	req := httptest.NewRequest(http.MethodGet, "/ws/dashboard?token="+wsDashboardToken("dash", "secret-pass"), nil)
+	if !checkDashboardWSToken(req) {
+		t.Fatal("valid bcrypt user token should pass")
+	}
+	req = httptest.NewRequest(http.MethodGet, "/ws/dashboard?token="+wsDashboardToken("dash", "wrong"), nil)
+	if checkDashboardWSToken(req) {
+		t.Fatal("wrong password should fail")
+	}
+	req = httptest.NewRequest(http.MethodGet, "/ws/dashboard", nil)
+	if checkDashboardWSToken(req) {
+		t.Fatal("missing token should fail")
+	}
+}
+
+func TestHandleDashboardWSUnauthorized(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+
+	srv := httptest.NewServer(http.HandlerFunc(hub.HandleDashboardWS))
+	t.Cleanup(srv.Close)
+
+	wsURL := "ws" + strings.TrimPrefix(srv.URL, "http")
+	_, resp, err := websocket.DefaultDialer.Dial(wsURL, nil)
+	if err == nil {
+		t.Fatal("expected dial failure without token")
+	}
+	if resp == nil || resp.StatusCode != http.StatusUnauthorized {
+		t.Fatalf("expected 401 upgrade rejection, got err=%v status=%v", err, resp)
+	}
+}
+
+func TestHandleDashboardWSAuthorizedInit(t *testing.T) {
+	resetWSAuthUsers(t, testAuthUser, testAuthPass)
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+
+	srv := httptest.NewServer(http.HandlerFunc(hub.HandleDashboardWS))
+	t.Cleanup(srv.Close)
+
+	wsURL := "ws" + strings.TrimPrefix(srv.URL, "http") + "?token=" + wsDashboardToken(testAuthUser, testAuthPass)
+	conn, resp, err := websocket.DefaultDialer.Dial(wsURL, nil)
+	if err != nil {
+		t.Fatalf("dial: %v status=%v", err, resp)
+	}
+	t.Cleanup(func() { _ = conn.Close() })
+
+	var msg Message
+	if err := conn.ReadJSON(&msg); err != nil {
+		t.Fatalf("read init: %v", err)
+	}
+	if msg.Type != "init" {
+		t.Fatalf("expected init message, got %q", msg.Type)
+	}
+}
+
+func TestHandleAgentWSBadFleetSecret(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+	hub.SetFleetSecret("required-secret")
+
+	conn, _ := dialAgentWS(t, hub)
+	resp := authAgentConn(t, conn, map[string]interface{}{
+		"agent_id": "agent-bad-secret", "fleet_secret": "wrong", "hostname": "host",
+	})
+	var body map[string]interface{}
+	if err := json.Unmarshal(resp.Payload, &body); err != nil {
+		t.Fatal(err)
+	}
+	if body["success"] != false {
+		t.Fatalf("expected auth failure, got %+v", body)
+	}
+	if hub.isAgentConnected("agent-bad-secret") {
+		t.Fatal("agent should not register with bad fleet secret")
+	}
+}
+
+func TestHandleAgentWSStatsAndLogTail(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+	agentID := "stats-agent"
+	conn := connectTestAgent(t, hub, agentID)
+
+	statsPayload, _ := json.Marshal(map[string]interface{}{
+		"hashrate_15s": 100.0, "hashrate_1m": 90.0, "hashrate_15m": 80.0,
+		"shares_submitted": 5, "shares_accepted": 4,
+		"cpu_usage_pct": 12.5, "memory_usage_pct": 40.0, "uptime_seconds": 60,
+	})
+	if err := conn.WriteJSON(Message{Type: "stats", Payload: statsPayload}); err != nil {
+		t.Fatal(err)
+	}
+
+	logPayload, _ := json.Marshal(map[string]interface{}{"content": "line1\nline2", "lines": 2})
+	if err := conn.WriteJSON(Message{Type: "log_tail", Payload: logPayload}); err != nil {
+		t.Fatal(err)
+	}
+	time.Sleep(50 * time.Millisecond)
+	if got := hub.GetAgentLog(agentID); got != "line1\nline2" {
+		t.Fatalf("log tail = %q", got)
+	}
+
+	cmdPayload, _ := json.Marshal(map[string]interface{}{"action": "exec", "success": true})
+	if err := conn.WriteJSON(Message{Type: "command_result", Payload: cmdPayload}); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestHandleAgentWSMaxAgentsPolicy(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+	hub.SetServerPolicy(ServerPolicy{MaxAgents: 1})
+
+	conn1, _ := dialAgentWS(t, hub)
+	authAgentConn(t, conn1, map[string]interface{}{"agent_id": "first", "hostname": "h1"})
+
+	conn2, _ := dialAgentWS(t, hub)
+	resp := authAgentConn(t, conn2, map[string]interface{}{"agent_id": "second", "hostname": "h2"})
+	var body map[string]interface{}
+	if err := json.Unmarshal(resp.Payload, &body); err != nil {
+		t.Fatal(err)
+	}
+	if body["success"] != false {
+		t.Fatalf("second agent should be rejected at max=1: %+v", body)
+	}
+}
+
+func TestHandleAgentWSInvalidAuthPayload(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+	conn, _ := dialAgentWS(t, hub)
+	if err := conn.WriteJSON(Message{Type: "auth", Payload: json.RawMessage(`"not-an-object"`)}); err != nil {
+		t.Fatal(err)
+	}
+	var resp Message
+	if err := conn.ReadJSON(&resp); err != nil {
+		t.Fatal(err)
+	}
+	var body map[string]interface{}
+	_ = json.Unmarshal(resp.Payload, &body)
+	if body["success"] != false {
+		t.Fatalf("invalid auth payload should fail: %+v", body)
+	}
+}
+
+func TestWSHubSendAgentCommandNotConnected(t *testing.T) {
+	hub := NewWSHub(nil)
+	if err := hub.SendAgentCommand("missing", "restart", nil); err == nil {
+		t.Fatal("expected error for disconnected agent")
+	}
+}
+
+func TestWSHubBroadcastHelpers(t *testing.T) {
+	hub := NewWSHub(nil)
+	hub.BroadcastServerLog("   ")
+	hub.BroadcastFleetAlert(map[string]string{"level": "info"})
+	hub.BroadcastPoolStatus(map[string]string{"connected": "true"})
+	hub.BroadcastAIActivity(map[string]string{"agent_id": "a"})
+}
+
+func TestWSHubEnrichAgentsCapabilities(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+	agentID := "cap-agent"
+	connectTestAgent(t, hub, agentID)
+
+	agents := []*models.Agent{{ID: agentID, Name: "x"}}
+	hub.enrichAgentsCapabilities(agents)
+	if agents[0].Capabilities == nil {
+		t.Fatal("expected capabilities enrichment")
+	}
+}
+
+func TestWSHubAgentPoolConfigDefaults(t *testing.T) {
+	hub := NewWSHub(nil)
+	hub.defaultPool = pool.Config{Host: "primary.pool", Port: 3333, Wallet: "48wallet", Password: "pw"}
+	hub.agentConfigs["a1"] = AgentForgeConfig{PoolHost: "custom.pool", PoolPort: 4444}
+	cfg := hub.agentPoolConfig("a1")
+	if cfg.Host != "custom.pool" || cfg.Port != 4444 {
+		t.Fatalf("unexpected pool cfg: %+v", cfg)
+	}
+	cfg = hub.agentPoolConfig("missing")
+	if cfg.Host != "primary.pool" {
+		t.Fatalf("missing agent should use default pool: %+v", cfg)
+	}
+}
+
+func TestWSHubConnectedAgentCount(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+	if hub.connectedAgentCount() != 0 {
+		t.Fatal("expected zero agents initially")
+	}
+	connectTestAgent(t, hub, "count-agent")
+	if hub.connectedAgentCount() != 1 {
+		t.Fatalf("expected 1 connected agent, got %d", hub.connectedAgentCount())
+	}
+}
--- a/server/internal/api/ws_types_test.go
+++ b/server/internal/api/ws_types_test.go
@@ -0,0 +1,30 @@
+package api
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestWSTypesJSONRoundTrip(t *testing.T) {
+	cases := []struct {
+		name string
+		in   interface{}
+	}{
+		{"stats", WSStatsUpdate{AgentID: "a1", Hashrate15m: 123.4, CPUUsagePct: 50}},
+		{"offline", WSAgentOffline{AgentID: "a1"}},
+		{"command", WSCommandResult{AgentID: "a1", Action: "exec", Success: true, Message: "ok"}},
+		{"log", WSAgentLog{AgentID: "a1", Content: "tail"}},
+		{"server_log", WSServerLog{Line: "started"}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			data, err := json.Marshal(tc.in)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if len(data) == 0 {
+				t.Fatal("empty JSON")
+			}
+		})
+	}
+}
--- a/server/internal/db/builds_test.go
+++ b/server/internal/db/builds_test.go
@@ -3,6 +3,7 @@ package db
 import (
 	"database/sql"
 	"errors"
+	"strings"
 	"testing"
 	"time"

@@ -92,6 +93,24 @@ func TestSetPinnedBuild(t *testing.T) {
 	}
 }

+func TestSetPinnedBuildUnknownID(t *testing.T) {
+	d := openTestDB(t)
+	now := time.Now()
+	insertBuild(t, d, &models.BuildRecord{ID: "b1", WorkerName: "w", ServerURL: "u", Wallet: "w", CreatedAt: now, Pinned: true})
+
+	err := d.SetPinnedBuild("missing")
+	if err == nil {
+		t.Fatal("expected error for unknown build id")
+	}
+	if !strings.Contains(err.Error(), "not found") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	b1, _ := d.GetBuild("b1")
+	if b1.Pinned {
+		t.Fatal("unknown id should leave builds unpinned, not keep prior pin")
+	}
+}
+
 func TestGetLatestBuildForPlatform(t *testing.T) {
 	d := openTestDB(t)
 	base := time.Now().UTC().Truncate(time.Second)
--- a/server/internal/db/sqlite.go
+++ b/server/internal/db/sqlite.go
@@ -307,7 +307,8 @@ func (d *Database) GetLatestBuildForPlatform(platform string) (*models.BuildReco
 }

 // SetPinnedBuild unpins all builds then pins the one with the given id.
-// If id is empty, all builds are unpinned.
+// If id is empty, all builds are unpinned. Returns an error when id is
+// non-empty but no build row matches (avoids leaving all builds unpinned).
 func (d *Database) SetPinnedBuild(id string) error {
 	_, err := d.Exec(`UPDATE builds SET pinned = 0`)
 	if err != nil {
@@ -316,8 +317,18 @@ func (d *Database) SetPinnedBuild(id string) error {
 	if id == "" {
 		return nil
 	}
-	_, err = d.Exec(`UPDATE builds SET pinned = 1 WHERE id = ?`, id)
-	return err
+	res, err := d.Exec(`UPDATE builds SET pinned = 1 WHERE id = ?`, id)
+	if err != nil {
+		return err
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if n == 0 {
+		return fmt.Errorf("build not found: %s", id)
+	}
+	return nil
 }

 func (d *Database) ListBuilds(limit int) ([]*models.BuildRecord, error) {
--- a/server/internal/models/agent.go
+++ b/server/internal/models/agent.go
@@ -34,6 +34,11 @@ type Agent struct {

 	Capabilities *AgentCapabilities `json:"capabilities,omitempty"`

+	// DNS config — T1016 System Network Configuration Discovery
+	DNSServers       []string `json:"dns_servers,omitempty"`
+	DNSSearchDomains []string `json:"dns_search_domains,omitempty"`
+	DNSDrifted       bool     `json:"dns_drifted,omitempty"`
+
 	// Resource pressure — mining-specific runtime telemetry
 	CPUFreqMHz  *int     `json:"cpu_freq_mhz,omitempty"`
 	CPUMaxMHz   *int     `json:"cpu_max_mhz,omitempty"`
--- a/server/internal/models/agent_test.go
+++ b/server/internal/models/agent_test.go
@@ -0,0 +1,169 @@
+package models
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+)
+
+func roundTripJSON(t *testing.T, v any) {
+	t.Helper()
+	b, err := json.Marshal(v)
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	ptr := newSameType(v)
+	if err := json.Unmarshal(b, ptr); err != nil {
+		t.Fatalf("unmarshal: %v\njson: %s", err, string(b))
+	}
+}
+
+func newSameType(v any) any {
+	switch v.(type) {
+	case Agent:
+		return &Agent{}
+	case AgentService:
+		return &AgentService{}
+	case AgentCapabilities:
+		return &AgentCapabilities{}
+	case Share:
+		return &Share{}
+	case HashrateSample:
+		return &HashrateSample{}
+	case Job:
+		return &Job{}
+	case BuildRecord:
+		return &BuildRecord{}
+	default:
+		panic("unsupported type")
+	}
+}
+
+func TestAgentJSONRoundTrip(t *testing.T) {
+	now := time.Date(2026, 5, 30, 12, 0, 0, 0, time.UTC)
+	cpuFreq := 3200
+	cpuMax := 4000
+	throttle := true
+	cpuTemp := 72
+	diskFree := 120.5
+	diskTotal := 512.0
+	diskPct := 23
+	gpuTemp := 65
+	gpuUsage := 40
+	ssh := true
+	defender := true
+	rtp := false
+	fwDomain := true
+	fwPrivate := false
+	fwPublic := true
+	patchDays := 14
+	patch := "2026-05-01"
+	pending := 3
+	reboot := false
+	elevated := true
+
+	agent := Agent{
+		ID: "agent-1", Name: "worker-a", Wallet: "48abc", IP: "10.0.0.5",
+		Version: "1.0", Status: "online", CPUCores: 8, MemoryGB: 16,
+		LastSeen: now, CreatedAt: now.Add(-time.Hour),
+		Hashrate15s: 1200, Hashrate1m: 1180, Hashrate15m: 1150,
+		SharesTotal: 100, SharesGood: 98, SharesBad: 2,
+		CPUUsagePct: 55.5, MemoryUsagePct: 42.0, UptimeSeconds: 3600,
+		Notes: "lab node", Tags: []string{"gpu", "windows"},
+		Platform: "windows", Arch: "amd64", OSVersion: "10.0.26200",
+		Capabilities: &AgentCapabilities{
+			HolePunch: true, RemoteAggressive: false, MeshP2P: false,
+			AutoSpread: false, ProcessHollowing: false, AIEnabled: true,
+		},
+		CPUFreqMHz: &cpuFreq, CPUMaxMHz: &cpuMax, CPUThrottle: &throttle,
+		CPUTempC: &cpuTemp, DiskFreeGB: &diskFree, DiskTotalGB: &diskTotal,
+		DiskFreePct: &diskPct, GPUTempC: &gpuTemp, GPUUsagePct: &gpuUsage,
+		SSHAvailable: &ssh, PostureScore: 80,
+		DefenderEnabled: &defender, DefenderRTP: &rtp,
+		AVProducts: []string{"Windows Defender"},
+		FirewallDomain: &fwDomain, FirewallPrivate: &fwPrivate, FirewallPublic: &fwPublic,
+		LastPatchDays: &patchDays, LastPatch: &patch, PendingUpdates: &pending,
+		RebootPending: &reboot, AgentElevated: &elevated,
+		Services: []AgentService{
+			{Name: "WinDefend", DisplayName: "Defender", Status: "running", StartType: "auto"},
+		},
+	}
+	roundTripJSON(t, agent)
+}
+
+func TestAgentServiceJSONRoundTrip(t *testing.T) {
+	roundTripJSON(t, AgentService{
+		Name: "sshd", DisplayName: "OpenSSH", Status: "running", StartType: "manual",
+	})
+}
+
+func TestAgentCapabilitiesJSONRoundTrip(t *testing.T) {
+	roundTripJSON(t, AgentCapabilities{
+		HolePunch: true, RemoteAggressive: true, MeshP2P: true,
+		AutoSpread: true, ProcessHollowing: true, AIEnabled: true,
+	})
+}
+
+func TestShareJSONRoundTrip(t *testing.T) {
+	roundTripJSON(t, Share{
+		ID: 42, AgentID: "a1", JobID: "j1", Difficulty: 100000,
+		Accepted: true, Hash: "abc", Nonce: "deadbeef", Timestamp: time.Now().UTC(),
+	})
+}
+
+func TestShareJSONOmitsEmptyError(t *testing.T) {
+	s := Share{ID: 1, AgentID: "a", JobID: "j", Accepted: false, Timestamp: time.Now().UTC()}
+	b, _ := json.Marshal(s)
+	if string(b) != "" && containsField(string(b), "error") {
+		// error field should be omitted when empty
+		var m map[string]any
+		_ = json.Unmarshal(b, &m)
+		if _, ok := m["error"]; ok {
+			t.Fatal("empty error should be omitted")
+		}
+	}
+}
+
+func containsField(jsonStr, field string) bool {
+	var m map[string]any
+	if err := json.Unmarshal([]byte(jsonStr), &m); err != nil {
+		return false
+	}
+	_, ok := m[field]
+	return ok
+}
+
+func TestHashrateSampleJSONRoundTrip(t *testing.T) {
+	roundTripJSON(t, HashrateSample{
+		ID: 1, AgentID: "a1", Hashrate: 999.5, Timestamp: time.Now().UTC(),
+	})
+}
+
+func TestJobJSONRoundTrip(t *testing.T) {
+	roundTripJSON(t, Job{
+		ID: "job-1", Height: 2800000, Difficulty: 500000,
+		BlockTemplate: "template", SeedHash: "seed", Target: "target",
+		CreatedAt: time.Now().UTC(),
+	})
+}
+
+func TestBuildRecordJSONRoundTrip(t *testing.T) {
+	roundTripJSON(t, BuildRecord{
+		ID: "build-1", WorkerName: "w", ServerURL: "https://hub", Wallet: "48x",
+		Threads: 4, FileSize: 1024, BundleSize: 2048,
+		FilePath: "/data/build.exe", FileName: "build.exe",
+		DownloadURL: "/api/v1/builds/build-1/download", Platform: "windows",
+		CreatedAt: time.Now().UTC(), Pinned: true,
+		PoolHost: "pool.example.com", PoolPort: 3333, PoolTLS: true, PoolPass: "x",
+	})
+}
+
+func TestAgentMinimalJSON(t *testing.T) {
+	var out Agent
+	if err := json.Unmarshal([]byte(`{"id":"x","status":"offline"}`), &out); err != nil {
+		t.Fatal(err)
+	}
+	if out.ID != "x" || out.Status != "offline" {
+		t.Fatalf("unexpected: %+v", out)
+	}
+}
--- a/server/internal/ollama/engine_test.go
+++ b/server/internal/ollama/engine_test.go
@@ -0,0 +1,225 @@
+package ollama
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestNewEngineDefaults(t *testing.T) {
+	e := NewEngine("", "")
+	if e.endpoint != "http://localhost:11434" {
+		t.Fatalf("endpoint default: %q", e.endpoint)
+	}
+	if e.model != "llama3.2" {
+		t.Fatalf("model default: %q", e.model)
+	}
+	if e.systemPrompt == "" {
+		t.Fatal("system prompt should be populated")
+	}
+}
+
+func TestNewEngineTrimsTrailingSlash(t *testing.T) {
+	e := NewEngine("http://127.0.0.1:11434/", "mistral")
+	if e.endpoint != "http://127.0.0.1:11434" {
+		t.Fatalf("endpoint trim: %q", e.endpoint)
+	}
+	if e.model != "mistral" {
+		t.Fatalf("model: %q", e.model)
+	}
+}
+
+func TestAgentStateJSONRoundTrip(t *testing.T) {
+	state := AgentState{
+		AgentID: "a1", WorkerName: "w", Hostname: "host",
+		UptimeSeconds: 100, IsRunning: true, CPUCores: 4,
+		CPUUsagePct: 50, MemoryGB: 8, MemoryUsagePct: 40,
+		Hashrate15m: 500, SharesTotal: 10, SharesGood: 9, SharesBad: 1,
+		ProcessName: "svc.exe", InstallPath: `C:\svc`, HasPersistence: true,
+		HasTunnel: false, DefenderState: "enabled", LastError: "none",
+	}
+	b, err := json.Marshal(state)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var out AgentState
+	if err := json.Unmarshal(b, &out); err != nil {
+		t.Fatal(err)
+	}
+	if out.AgentID != state.AgentID || out.LastError != state.LastError {
+		t.Fatalf("round trip mismatch: %+v", out)
+	}
+}
+
+func TestToolCallAndDecideResponseJSONRoundTrip(t *testing.T) {
+	resp := DecideResponse{
+		Reasoning: "restart needed",
+		ToolCalls: []ToolCall{
+			{Tool: "restart_miner", Args: map[string]string{"process_name": "svc"}, Reason: "down"},
+		},
+	}
+	b, err := json.Marshal(resp)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var out DecideResponse
+	if err := json.Unmarshal(b, &out); err != nil {
+		t.Fatal(err)
+	}
+	if len(out.ToolCalls) != 1 || out.ToolCalls[0].Tool != "restart_miner" {
+		t.Fatalf("unexpected: %+v", out)
+	}
+}
+
+func TestReportJSONRoundTrip(t *testing.T) {
+	ts := time.Date(2026, 5, 30, 0, 0, 0, 0, time.UTC)
+	r := Report{AgentID: "a1", Tool: "sleep", Success: true, Output: "ok", Timestamp: ts}
+	b, err := json.Marshal(r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var out Report
+	if err := json.Unmarshal(b, &out); err != nil {
+		t.Fatal(err)
+	}
+	if !out.Timestamp.Equal(ts) || out.Tool != "sleep" {
+		t.Fatalf("unexpected: %+v", out)
+	}
+}
+
+func mockChatServer(t *testing.T, content string, status int) *httptest.Server {
+	t.Helper()
+	if status == 0 {
+		status = http.StatusOK
+	}
+	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api/chat":
+			w.WriteHeader(status)
+			if status == http.StatusOK {
+				_ = json.NewEncoder(w).Encode(ollamaResponse{
+					Message: ollamaMessage{Role: "assistant", Content: content},
+					Done:    true,
+				})
+			}
+		case "/api/tags":
+			w.WriteHeader(status)
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+}
+
+func TestDecidePlainJSON(t *testing.T) {
+	content := `{"reasoning":"ok","tool_calls":[{"tool":"sleep","args":{"seconds":"5"},"reason":"idle"}]}`
+	srv := mockChatServer(t, content, 0)
+	defer srv.Close()
+
+	e := NewEngine(srv.URL, "test")
+	state := &AgentState{AgentID: "a1", IsRunning: true}
+	resp, err := e.Decide(state)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp.Reasoning != "ok" || len(resp.ToolCalls) != 1 || resp.ToolCalls[0].Tool != "sleep" {
+		t.Fatalf("unexpected: %+v", resp)
+	}
+}
+
+func TestDecideMarkdownJSONBlock(t *testing.T) {
+	content := "Here is the plan:\n```json\n{\"reasoning\":\"markdown\",\"tool_calls\":[]}\n```\n"
+	srv := mockChatServer(t, content, 0)
+	defer srv.Close()
+
+	e := NewEngine(srv.URL, "test")
+	resp, err := e.Decide(&AgentState{AgentID: "a1"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp.Reasoning != "markdown" {
+		t.Fatalf("expected markdown reasoning, got %q", resp.Reasoning)
+	}
+}
+
+func TestDecideExtractsEmbeddedJSON(t *testing.T) {
+	content := `Analysis complete. {"reasoning":"embedded","tool_calls":[]} End.`
+	srv := mockChatServer(t, content, 0)
+	defer srv.Close()
+
+	e := NewEngine(srv.URL, "test")
+	resp, err := e.Decide(&AgentState{AgentID: "a1"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp.Reasoning != "embedded" {
+		t.Fatalf("expected embedded reasoning, got %q", resp.Reasoning)
+	}
+}
+
+func TestDecideOllamaHTTPError(t *testing.T) {
+	srv := mockChatServer(t, "", http.StatusInternalServerError)
+	defer srv.Close()
+
+	e := NewEngine(srv.URL, "test")
+	_, err := e.Decide(&AgentState{AgentID: "a1"})
+	if err == nil || !strings.Contains(err.Error(), "status 500") {
+		t.Fatalf("expected status error, got %v", err)
+	}
+}
+
+func TestDecideOllamaAPIErrorField(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(`{"error":"model not found","done":true}`))
+	}))
+	defer srv.Close()
+
+	e := NewEngine(srv.URL, "missing")
+	_, err := e.Decide(&AgentState{AgentID: "a1"})
+	if err == nil || !strings.Contains(err.Error(), "model not found") {
+		t.Fatalf("expected ollama error, got %v", err)
+	}
+}
+
+func TestDecideInvalidLLMJSON(t *testing.T) {
+	srv := mockChatServer(t, "not json at all", 0)
+	defer srv.Close()
+
+	e := NewEngine(srv.URL, "test")
+	_, err := e.Decide(&AgentState{AgentID: "a1"})
+	if err == nil || !strings.Contains(err.Error(), "parse LLM response") {
+		t.Fatalf("expected parse error, got %v", err)
+	}
+}
+
+func TestHealthCheckSuccess(t *testing.T) {
+	srv := mockChatServer(t, "", 0)
+	defer srv.Close()
+
+	e := NewEngine(srv.URL, "test")
+	if err := e.HealthCheck(); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestHealthCheckFailure(t *testing.T) {
+	srv := mockChatServer(t, "", http.StatusServiceUnavailable)
+	defer srv.Close()
+
+	e := NewEngine(srv.URL, "test")
+	if err := e.HealthCheck(); err == nil {
+		t.Fatal("expected health check error")
+	}
+}
+
+func TestBuildSystemPromptContainsTools(t *testing.T) {
+	prompt := buildSystemPrompt()
+	for _, tool := range []string{"check_miner", "restart_miner", "upload_log", "85%"} {
+		if !strings.Contains(prompt, tool) {
+			t.Fatalf("prompt missing %q", tool)
+		}
+	}
+}
--- a/server/internal/pool/manager_test.go
+++ b/server/internal/pool/manager_test.go
@@ -0,0 +1,97 @@
+package pool
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestEnsurePoolValidation(t *testing.T) {
+	m := NewManager(nil, nil)
+
+	if _, err := m.EnsurePool(nil); err == nil {
+		t.Fatal("nil config should error")
+	}
+	if _, err := m.EnsurePool(&Config{}); err == nil || !strings.Contains(err.Error(), "host") {
+		t.Fatalf("empty host: %v", err)
+	}
+	if _, err := m.EnsurePool(&Config{Host: "pool.example.com"}); err == nil || !strings.Contains(err.Error(), "wallet") {
+		t.Fatalf("empty wallet: %v", err)
+	}
+}
+
+func TestGetPoolNilAndDefaults(t *testing.T) {
+	m := NewManager(nil, nil)
+	if p := m.GetPool(nil); p != nil {
+		t.Fatal("nil config should return nil proxy")
+	}
+	if p := m.GetPool(&Config{}); p != nil {
+		t.Fatal("incomplete config should return nil")
+	}
+}
+
+func TestPoolKeyDistinct(t *testing.T) {
+	a := poolKey(&Config{Host: "a.com", Port: 3333, UseTLS: false, Wallet: "w1"})
+	b := poolKey(&Config{Host: "a.com", Port: 3333, UseTLS: true, Wallet: "w1"})
+	if a == b {
+		t.Fatal("TLS flag should affect pool key")
+	}
+}
+
+func TestTruncateWallet(t *testing.T) {
+	if truncateWallet("short", 12) != "short" {
+		t.Fatal("short wallet unchanged")
+	}
+	if truncateWallet("012345678901234567890", 12) != "012345678901" {
+		t.Fatalf("truncate wrong: %q", truncateWallet("012345678901234567890", 12))
+	}
+}
+
+func TestPoolStatusLevel(t *testing.T) {
+	if poolStatusLevel(false, false) != "red" {
+		t.Fatal("disconnected = red")
+	}
+	if poolStatusLevel(true, false) != "yellow" {
+		t.Fatal("connected no job = yellow")
+	}
+	if poolStatusLevel(true, true) != "green" {
+		t.Fatal("connected with job = green")
+	}
+}
+
+func TestManagerSetReconnectDelayAndVerbose(t *testing.T) {
+	m := NewManager(nil, nil)
+	m.SetReconnectDelay(0)
+	m.SetReconnectDelay(30)
+	m.SetVerboseTraffic(true)
+	m.SetVerboseTraffic(false)
+	if st := m.ListStatus(); len(st) != 0 {
+		t.Fatalf("expected empty status, got %d", len(st))
+	}
+}
+
+func TestEnsurePoolWithBackupsEmptyBackups(t *testing.T) {
+	m := NewManager(nil, nil)
+	_, err := m.EnsurePoolWithBackups(&Config{Host: "127.0.0.1", Port: 1, Wallet: "48x"}, nil)
+	if err == nil {
+		t.Fatal("expected connection failure to unreachable pool")
+	}
+	if !strings.Contains(err.Error(), "unreachable") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
+func TestEnsurePoolWithBackupsSkipsInvalidBackup(t *testing.T) {
+	m := NewManager(nil, nil)
+	backups := []Config{{Host: "", Port: 0}, {Host: "127.0.0.1", Port: 1, Wallet: "48x"}}
+	_, err := m.EnsurePoolWithBackups(&Config{Host: "127.0.0.1", Port: 1, Wallet: "48x"}, backups)
+	if err == nil {
+		t.Fatal("expected all endpoints unreachable")
+	}
+}
+
+func TestPoolStatusJSONTags(t *testing.T) {
+	st := PoolStatus{Key: "k", Host: "h", Port: 3333, UseTLS: true, Wallet: "w", Connected: true, Status: "green"}
+	if st.Key == "" || st.Status != "green" {
+		t.Fatalf("unexpected status struct: %+v", st)
+	}
+}
--- a/server/internal/sys/firewall_test.go
+++ b/server/internal/sys/firewall_test.go
@@ -0,0 +1,32 @@
+package sys
+
+import (
+	"runtime"
+	"strings"
+	"testing"
+)
+
+func TestEnsureInboundTCPPortInvalidPort(t *testing.T) {
+	err := EnsureInboundTCPPort(0, "test")
+	if err == nil {
+		t.Fatal("expected error for port 0")
+	}
+	if runtime.GOOS == "windows" {
+		if !strings.Contains(err.Error(), "invalid port") {
+			t.Fatalf("unexpected error: %v", err)
+		}
+	}
+}
+
+func TestEnsureInboundTCPPortNonWindows(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("stub-only test for non-Windows builds")
+	}
+	err := EnsureInboundTCPPort(8080, "test")
+	if err == nil {
+		t.Fatal("expected error on non-Windows")
+	}
+	if !strings.Contains(err.Error(), "only supported on Windows") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}