linux-c2/PLAN.md

# NexusOps — Make-It-Perfect Plan
Target: `/root/agent-dashboard` on c2-builder-slay (10.30.20.44)
Rule: remove no features. Only add and fix.

---

## PHASE 1 — FIX (make everything that exists actually work)

### 1.1 Screenshot/Exfil/Harvest results viewer (the real gap — pipelines WORK, results invisible)
Verified: screenshot → `/api/agent/file-result` → `exfiltratedFiles` → `/api/files` ✅
Verified: harvest → `/api/agent/harvest-result` → `/api/credentials` ✅
**The frontend has the trigger buttons (Exfil & Harvest tab) but NEVER fetches `/api/files` or `/api/credentials`.** Data lands server-side and goes invisible.
- New **Loot** section in the dashboard: two tabs (Files / Credentials).
  - Files: table (node, filename, mime, size, time, download btn). Images (screenshots) get inline thumbnails + lightbox.
  - Credentials: grouped by node+type, masked by default, click-to-reveal, copy button, CSV export (endpoint exists).
- Live-update both via the existing WebSocket broadcast (add files/creds summary counts to `NODES_UPDATE` payload, or poll on event).
- "Loot received" toast when a new file/cred batch arrives.

### 1.3 Dashboard auth (currently wide open)
- Add session-token middleware to server.js: `NEXUS_AUTH_TOKEN` env var; on first load the UI asks for the token once, stores in localStorage, sends as `Authorization: Bearer`.
- Whitelist: agent endpoints (`/api/agent/*`, `/install*`, `/agent.py`) use a separate agent token embedded at install time. Dashboard/API/export endpoints require the operator token.
- WebSocket: token passed as query param on upgrade.

### 1.4 Server as a real service
- systemd unit `nexusops-dashboard.service`: node server.js, Restart=always, env file `/root/agent-dashboard/.env` (PORT, PUBLIC_URL, NEXUS_AUTH_TOKEN).
- systemd unit `nexusops-tunnel.service`: cloudflared tunnel for `agent.thetempleofdoom.com` (tunnel creds already on the box — find via `cloudflared tunnel list`).
- `systemctl enable --now` both. Verify reboot survival.

### 1.5 Persistence hardening
- Replace JSON-file saves with atomic writes (`write tmp → rename`) + a single-writer lock.
- Move to SQLite (`better-sqlite3`) for nodes/metrics/commands/files/creds — keeps all current data shapes, migration script imports existing `data/*.json` on first boot.
- Keeps JSON export endpoints untouched.

### 1.6 WebSocket resilience
- Frontend: reconnect with exponential backoff (1s→2s→5s→30s cap), visible "reconnecting" pill in nav, full state resync on reconnect.
- Server: heartbeat ping every 25s so proxies/CF don't kill idle sockets.

### 1.7 Agent robustness
- Verify `--silent` flag actually suppresses output (install scripts rely on it).
- Input capture: if `pynput` missing, agent logs one clear line to server (`input capture unavailable`) instead of silent degradation; dashboard shows the capability as "unavailable" on the node card instead of nothing.
- Agent auto-reconnect on server restart (already partially there — verify backoff doesn't spin at 100% CPU).
- Add agent version string; server tracks it per node; "update agent" skips already-current nodes.

### 1.8 Empty state + first-run UX
- Dashboard with zero nodes → hero panel with the universal one-liner + QR code (qrcode.js, local) pointing at the public install URL.
- First node connects → confetti-free but noticeable highlight animation.

---

## PHASE 2 — POLISH (the feel)

### 2.1 Design system pass
- Consolidate to CSS custom properties (colors, spacing, radius, glow) — file already has some; finish the job.
- Typography: JetBrains Mono for terminal/data, Inter for UI chrome.
- Online nodes: subtle emerald pulse ring. Offline: desaturated, grayscale icon.
- Consistent 8px spacing grid; kill stray one-off margins.

### 2.2 Node cards upgrade
- Inline SVG sparklines (last 30 heartbeats) for CPU + MEM on each card.
- Relative timestamps ("last seen 12s ago") ticking live.
- Click card → slide-in **detail drawer**: full metrics chart, files/creds/screenshots scoped to that node, command console pinned to it, tag editor, ping button with latency readout.
- Right-click (or ⋮ menu): ping, screenshot, update agent, reboot, kill agent, unregister — with confirm modals for destructive ones.

### 2.3 Command builder
- Structured action picker: dropdown of every agent action (raw_command, manage_service, screenshot, download_file, harvest_credentials, update_agent, …) with a per-action form (service name, file path, etc.) instead of making the operator type raw JSON.
- Terminal output viewer: ANSI color support, mono font, copy button, per-command expandable rows in audit log.
- Bulk commands: tag-based targeting ("all linux nodes", "tag=prod") with live preview of affected nodes before send.

### 2.4 Global polish
- Keyboard shortcuts: `/` focus search, `i` installer modal, `k` kill switch (with confirm), `Esc` close modals. `?` shows shortcut overlay.
- Toasts (top-right) for: node came online, node went offline, command completed/failed, file received, creds received.
- Loading skeletons for every section on first paint.
- Mobile responsive: cards stack, drawer becomes full-screen modal, terminal scrolls horizontally.
- Nav shows live clock + server latency (WS round-trip).

---

## PHASE 3 — ADD (new, no removals)

### 3.1 Scheduled commands
- `node-cron` in server: schedule raw/structured commands per node/tag on cron expressions. UI: simple scheduler panel (time picker + action + target). Persisted in SQLite.

### 3.2 Screenshot watch mode
- "Watch" mode: request screenshot every N seconds from one node, stream into the drawer (pseudo-live). Gallery itself ships with the Loot viewer in 1.1.

### 3.3 Webhook alerts
- Config panel: webhook URL (n8n on .236 / Discord / generic).
- Events: node online/offline, new node registered, creds harvested, command failed.
- Server POSTs JSON event; n8n routes to Telegram/iMessage.

### 3.4 Cross-platform binaries
- GitHub Actions (or local runners): build NexusAgent.exe (Windows) + NexusAgent-mac (macOS arm64/x64 universal2) on release.
- Binary tab becomes real: per-OS download buttons with version + build date.
- Fallback: keep "binary only exists for Linux x64" honest until then (grey out, tooltip).

### 3.5 Node grouping & tags
- Tag management UI: create/rename/delete tags, drag nodes between groups, group-level bulk actions.
- Saved filters ("show me prod-linux only").

### 3.6 Audit & export upgrades
- Audit log: filter by node/status/action, date range, export filtered CSV.
- Full-data export (one zip: nodes, commands, files, creds, inputs, logs).

### 3.7 Health watchdog for the stack itself
- Cron on the MacBook: every 5 min hit `https://agent.thetempleofdoom.com/api/status`; if down → restart services via SSH, alert via existing n8n/Telegram path.

---

## EXECUTION ORDER (suggested)

| # | Item | Phase | Effort |
|---|------|-------|--------|
| 1 | Server + tunnel systemd units | 1.4 | 15 min |
| 2 | Dashboard auth token | 1.3 | 45 min |
| 3 | Loot viewer (files + creds + screenshot gallery) | 1.1 | 2 h |
| 4 | WebSocket reconnect | 1.6 | 30 min |
| 5 | Empty state + QR install | 1.8 | 45 min |
| 6 | Atomic saves → SQLite | 1.5 | 2 h |
| 7 | Agent version + capability reporting | 1.7 | 1 h |
| 8 | Design system + node cards + drawer | 2.1–2.2 | 3 h |
| 9 | Command builder + bulk targeting | 2.3 | 2 h |
| 10 | Shortcuts, toasts, skeletons, mobile | 2.4 | 2 h |
| 11 | Scheduled commands | 3.1 | 1.5 h |
| 12 | Webhook alerts | 3.3 | 1 h |
| 13 | Screenshot watch mode (live refresh in drawer) | 3.2 | 1 h |
| 14 | Tags/groups UI | 3.5 | 1.5 h |
| 15 | Cross-platform binaries | 3.4 | 3 h |
| 16 | Audit/export upgrades | 3.6 | 1 h |
| 17 | Self-watchdog | 3.7 | 30 min |

**Ship gate after Phase 1:** every existing feature demonstrably works end-to-end (screenshot → visible in Loot, exfil → download, creds → UI, auth on, services survive reboot).
**Ship gate after Phase 2:** a stranger could run the dashboard without asking how anything works.