fixes: no-store cache headers on agent-facing routes; stale command cleanup

server.js

@@ -51,6 +51,15 @@ function authMiddleware(req, res, next) {
   return res.status(401).json({ error: 'unauthorized' });
 }
 app.use(authMiddleware);
+
+// Agent-facing files must never be edge-cached (stale-agent incident 2026-10-01)
+app.use((req, res, next) => {
+  if (req.path.startsWith('/agent.py') || req.path.startsWith('/install') || req.path.startsWith('/bin/')) {
+    res.setHeader('Cache-Control', 'no-store, must-revalidate');
+    res.setHeader('CF-Cache-Status', 'BYPASS');
+  }
+  next();
+});
 app.get('/api/auth/check', (req, res) => {
   if (!AUTH_TOKEN) return res.json({ ok: true, authRequired: false });
   res.json({ ok: true, authRequired: true });