Spaces:

GaryLeckey
/

aureon-os

Running

aureon-os / server /nexus-command-server.ts

Deploy Aureon OS (deploy/selfhost stack: nginx edge + fusion API x2 + console + HNC organ + redis + postgres; paper mode) (part 19)

da0ce7b verified 2 days ago

Raw History Blame Contribute Delete

12.3 kB

#!/usr/bin/env tsx
import 'dotenv/config';
import http from 'http';
import cors from 'cors';
import express from 'express';
import { WebSocketServer, WebSocket } from 'ws';
import { createHash, timingSafeEqual } from 'crypto';

const DEFAULT_HOST = '127.0.0.1';
const MAX_JSON_BODY = '8kb';
const MAX_WS_PAYLOAD_BYTES = 16 * 1024;
const MIN_SECRET_BYTES = 32;

class SafeCommandError extends Error {
  constructor(readonly code: string, readonly status: number = 400) {
    super(code);
    this.name = 'SafeCommandError';
  }
}

function boundedInteger(
  value: unknown,
  fallback: number,
  minimum: number,
  maximum: number,
  code: string,
): number {
  const candidate = value === undefined || value === null || value === '' ? fallback : value;
  if (typeof candidate !== 'number' && typeof candidate !== 'string') {
    throw new SafeCommandError(code);
  }
  const parsed = typeof candidate === 'number' ? candidate : Number(candidate);
  if (!Number.isSafeInteger(parsed) || parsed < minimum || parsed > maximum) {
    throw new SafeCommandError(code);
  }
  return parsed;
}

function configuredHost(value: string | undefined): string {
  const host = String(value || DEFAULT_HOST).trim();
  if (!host || host.length > 253 || !/^[A-Za-z0-9.:[\]_-]+$/.test(host)) {
    throw new Error('nexus_command_host_invalid');
  }
  return host;
}

function isLoopbackHost(value: string): boolean {
  const host = value.trim().toLowerCase().replace(/^\[(.*)\]$/, '$1');
  return host === '127.0.0.1' || host === '::1' || host === 'localhost';
}

function configuredSocketPath(value: string | undefined): string {
  const socketPath = String(value || '/command-stream').trim();
  if (!/^\/[A-Za-z0-9/_-]{1,127}$/.test(socketPath)) {
    throw new Error('nexus_command_socket_path_invalid');
  }
  return socketPath;
}

function configuredOrigins(value: string | undefined): ReadonlySet<string> {
  const rawOrigins = String(value || '').split(',').map((item) => item.trim()).filter(Boolean);
  if (rawOrigins.length > 32) {
    throw new Error('nexus_command_cors_allowlist_too_large');
  }
  const origins = new Set<string>();
  for (const rawOrigin of rawOrigins) {
    if (rawOrigin.length > 2048) {
      throw new Error('nexus_command_cors_origin_invalid');
    }
    let parsed: URL;
    try {
      parsed = new URL(rawOrigin);
    } catch {
      throw new Error('nexus_command_cors_origin_invalid');
    }
    if (!['http:', 'https:'].includes(parsed.protocol) || parsed.origin !== rawOrigin) {
      throw new Error('nexus_command_cors_origin_invalid');
    }
    origins.add(parsed.origin);
  }
  return origins;
}

const HOST = configuredHost(process.env.NEXUS_COMMAND_HOST);
const PORT = boundedInteger(process.env.NEXUS_COMMAND_PORT, 8790, 1, 65535, 'nexus_command_port_invalid');
const SOCKET_PATH = configuredSocketPath(process.env.NEXUS_COMMAND_SOCKET_PATH);
const COMMAND_SECRET = String(process.env.NEXUS_COMMAND_SECRET || '');
const COMMAND_SECRET_BYTES = Buffer.byteLength(COMMAND_SECRET, 'utf8');
const COMMAND_SECRET_STRONG = COMMAND_SECRET_BYTES >= MIN_SECRET_BYTES && COMMAND_SECRET_BYTES <= 4096;
const COMMAND_SECRET_DIGEST = createHash('sha256').update(COMMAND_SECRET, 'utf8').digest();
const DUMMY_SECRET_DIGEST = createHash('sha256').update('aureon-nexus-no-command-secret', 'utf8').digest();
const LOOPBACK_BIND = isLoopbackHost(HOST);
const ALLOWED_ORIGINS = configuredOrigins(process.env.NEXUS_COMMAND_CORS_ORIGINS);

if (COMMAND_SECRET && !COMMAND_SECRET_STRONG) {
  throw new Error('nexus_command_secret_must_be_at_least_32_bytes');
}
if (!LOOPBACK_BIND && !COMMAND_SECRET_STRONG) {
  throw new Error('nexus_command_remote_bind_requires_strong_auth');
}

function bearerToken(header: unknown): string {
  if (typeof header !== 'string' || header.length > 8192 || !header.startsWith('Bearer ')) {
    return '';
  }
  return header.slice('Bearer '.length).trim();
}

function hasValidCommandSecret(header: unknown): boolean {
  const candidateDigest = createHash('sha256').update(bearerToken(header), 'utf8').digest();
  const expectedDigest = COMMAND_SECRET_STRONG ? COMMAND_SECRET_DIGEST : DUMMY_SECRET_DIGEST;
  return COMMAND_SECRET_STRONG && timingSafeEqual(candidateDigest, expectedDigest);
}

function fixedError(res: express.Response, status: number, code: string) {
  return res.status(status).json({ success: false, error: code });
}

function requireCommandAuthorization(
  req: express.Request,
  res: express.Response,
  next: express.NextFunction,
) {
  if (!COMMAND_SECRET_STRONG) {
    return fixedError(res, 503, 'command_auth_not_configured');
  }
  if (!hasValidCommandSecret(req.headers.authorization)) {
    return fixedError(res, 401, 'command_auth_required');
  }
  return next();
}

function requireReadAuthorizationOffLoopback(
  req: express.Request,
  res: express.Response,
  next: express.NextFunction,
) {
  if (LOOPBACK_BIND) {
    return next();
  }
  return requireCommandAuthorization(req, res, next);
}

function requireJsonCommandBody(
  req: express.Request,
  res: express.Response,
  next: express.NextFunction,
) {
  if (!req.is('application/json')) {
    return fixedError(res, 415, 'application_json_required');
  }
  return next();
}

const app = express();
app.disable('x-powered-by');
app.use((req, res, next) => {
  const origin = req.headers.origin;
  if (typeof origin === 'string' && !ALLOWED_ORIGINS.has(origin)) {
    return fixedError(res, 403, 'origin_not_allowed');
  }
  return next();
});
app.use(cors({
  origin(origin, callback) {
    if (!origin) {
      callback(null, true);
      return;
    }
    callback(null, ALLOWED_ORIGINS.has(origin));
  },
  methods: ['GET', 'POST'],
  allowedHeaders: ['Authorization', 'Content-Type'],
  credentials: false,
  maxAge: 600,
}));
app.use(express.json({ limit: MAX_JSON_BODY, strict: true, type: 'application/json' }));

const httpServer = http.createServer(app);
const wss = new WebSocketServer({ noServer: true, maxPayload: MAX_WS_PAYLOAD_BYTES });

const clients = new Map<WebSocket, boolean>();

function snapshot(_includeCommandDetails: boolean = false) {
  return {
    streaming: false,
    intervalMs: null,
    clients: clients.size,
    activeCommand: null,
    commandHistory: [],
    lastTick: null,
    commandEffectsEnabled: false,
    protectionStatus: 'HOLD_PLUMBER_HNC_MAGIC_STAR_BRIDGE_REQUIRED',
  };
}

function broadcastStatus() {
  for (const [client, authorized] of clients) {
    if (client.readyState === WebSocket.OPEN) {
      client.send(JSON.stringify({ type: 'system_status', payload: snapshot(authorized) }));
    }
  }
}

function isRecord(value: unknown): value is Record<string, unknown> {
  return typeof value === 'object' && value !== null && !Array.isArray(value);
}

function handleCommand(type: string, payload?: Record<string, unknown>) {
  const supported = new Set(['start_stream', 'stop_stream', 'run_nexus', 'stop_active_command']);
  if (!supported.has(type)) {
    throw new SafeCommandError('unsupported_command');
  }
  const body = payload === undefined ? {} : payload;
  if (!isRecord(body) || Object.keys(body).length > 8) {
    throw new SafeCommandError('command_payload_invalid');
  }
  return {
    success: false,
    status: 'HOLD',
    reasonCode: 'plumber_hnc_magic_star_bridge_required',
    command: type,
    inputAdmitted: false,
    effectAttempted: false,
  };
}

function respondCommandError(res: express.Response, error: unknown) {
  if (error instanceof SafeCommandError) {
    return fixedError(res, error.status, error.code);
  }
  console.error('Nexus command request failed.');
  return fixedError(res, 500, 'command_failed');
}

function respondCommandHold(
  res: express.Response,
  type: string,
  payload?: Record<string, unknown>,
) {
  try {
    return res.status(423).json(handleCommand(type, payload));
  } catch (error) {
    return respondCommandError(res, error);
  }
}

app.get('/health', requireReadAuthorizationOffLoopback, (_req, res) => {
  res.json({ ok: true, status: snapshot(false) });
});

app.get('/api/command-center/status', requireReadAuthorizationOffLoopback, (req, res) => {
  res.json(snapshot(hasValidCommandSecret(req.headers.authorization)));
});

app.post(
  '/api/command-center/stream/start',
  requireCommandAuthorization,
  requireJsonCommandBody,
  (req, res) => {
    return respondCommandHold(res, 'start_stream', req.body);
  },
);

app.post('/api/command-center/stream/stop', requireCommandAuthorization, (_req, res) => {
  return respondCommandHold(res, 'stop_stream', {});
});

app.post(
  '/api/command-center/nexus/run',
  requireCommandAuthorization,
  requireJsonCommandBody,
  (req, res) => {
    return respondCommandHold(res, 'run_nexus', req.body);
  },
);

app.post('/api/command-center/nexus/stop', requireCommandAuthorization, (_req, res) => {
  return respondCommandHold(res, 'stop_active_command', {});
});

app.use((_error: unknown, _req: express.Request, res: express.Response, _next: express.NextFunction) => {
  return fixedError(res, 400, 'invalid_json_body');
});

function rejectUpgrade(socket: import('net').Socket, status: number, reason: string) {
  socket.write(`HTTP/1.1 ${status} ${reason}\r\nConnection: close\r\n\r\n`);
  socket.destroy();
}

httpServer.on('upgrade', (request, socket, head) => {
  const origin = request.headers.origin;
  if (typeof origin === 'string' && !ALLOWED_ORIGINS.has(origin)) {
    rejectUpgrade(socket, 403, 'Forbidden');
    return;
  }

  let requestPath = '';
  try {
    requestPath = new URL(request.url || '/', 'http://127.0.0.1').pathname;
  } catch {
    rejectUpgrade(socket, 404, 'Not Found');
    return;
  }
  if (requestPath !== SOCKET_PATH) {
    rejectUpgrade(socket, 404, 'Not Found');
    return;
  }
  if (!LOOPBACK_BIND && !hasValidCommandSecret(request.headers.authorization)) {
    rejectUpgrade(socket, 401, 'Unauthorized');
    return;
  }

  wss.handleUpgrade(request, socket, head, (webSocket) => {
    wss.emit('connection', webSocket, request);
  });
});

wss.on('connection', (socket, request) => {
  const handshakeAuthorized = hasValidCommandSecret(request.headers.authorization);
  clients.set(socket, handshakeAuthorized);
  socket.send(JSON.stringify({ type: 'system_status', payload: snapshot(handshakeAuthorized) }));

  socket.on('message', (raw) => {
    try {
      const parsed = JSON.parse(raw.toString());
      if (parsed?.type === 'ping') {
        socket.send(JSON.stringify({ type: 'pong', ts: Date.now() }));
        return;
      }
      if (parsed?.type === 'status_request') {
        socket.send(JSON.stringify({
          type: 'system_status',
          payload: snapshot(clients.get(socket) === true),
        }));
        return;
      }
      if (parsed?.type === 'command') {
        const messageAuthorized = hasValidCommandSecret(parsed.authorization);
        if (clients.get(socket) !== true && !messageAuthorized) {
          socket.send(JSON.stringify({ type: 'command_response', error: 'command_auth_required' }));
          return;
        }
        clients.set(socket, true);
        if (typeof parsed.command !== 'string' || parsed.command.length > 64) {
          throw new SafeCommandError('unsupported_command');
        }
        const response = handleCommand(parsed.command, parsed.payload);
        socket.send(JSON.stringify({ type: 'command_response', payload: response }));
      }
    } catch (error) {
      const code = error instanceof SafeCommandError ? error.code : 'invalid_command_message';
      socket.send(JSON.stringify({ type: 'command_response', error: code }));
    }
  });

  socket.on('close', () => {
    clients.delete(socket);
    broadcastStatus();
  });
  socket.on('error', () => {
    clients.delete(socket);
  });
});

httpServer.listen(PORT, HOST, () => {
  console.log(`Nexus Command Server listening on http://${HOST}:${PORT}`);
  console.log(`WebSocket stream available at ws://${HOST}:${PORT}${SOCKET_PATH}`);
});

	#!/usr/bin/env tsx
	import 'dotenv/config';
	import http from 'http';
	import cors from 'cors';
	import express from 'express';
	import { WebSocketServer, WebSocket } from 'ws';
	import { createHash, timingSafeEqual } from 'crypto';

	const DEFAULT_HOST = '127.0.0.1';
	const MAX_JSON_BODY = '8kb';
	const MAX_WS_PAYLOAD_BYTES = 16 * 1024;
	const MIN_SECRET_BYTES = 32;

	class SafeCommandError extends Error {
	constructor(readonly code: string, readonly status: number = 400) {
	super(code);
	this.name = 'SafeCommandError';
	}
	}

	function boundedInteger(
	value: unknown,
	fallback: number,
	minimum: number,
	maximum: number,
	code: string,
	): number {
	const candidate = value === undefined \|\| value === null \|\| value === '' ? fallback : value;
	if (typeof candidate !== 'number' && typeof candidate !== 'string') {
	throw new SafeCommandError(code);
	}
	const parsed = typeof candidate === 'number' ? candidate : Number(candidate);
	if (!Number.isSafeInteger(parsed) \|\| parsed < minimum \|\| parsed > maximum) {
	throw new SafeCommandError(code);
	}
	return parsed;
	}

	function configuredHost(value: string \| undefined): string {
	const host = String(value \|\| DEFAULT_HOST).trim();
	if (!host \|\| host.length > 253 \|\| !/^[A-Za-z0-9.:[\]_-]+$/.test(host)) {
	throw new Error('nexus_command_host_invalid');
	}
	return host;
	}

	function isLoopbackHost(value: string): boolean {
	const host = value.trim().toLowerCase().replace(/^\[(.*)\]$/, '$1');
	return host === '127.0.0.1' \|\| host === '::1' \|\| host === 'localhost';
	}

	function configuredSocketPath(value: string \| undefined): string {
	const socketPath = String(value \|\| '/command-stream').trim();
	if (!/^\/[A-Za-z0-9/_-]{1,127}$/.test(socketPath)) {
	throw new Error('nexus_command_socket_path_invalid');
	}
	return socketPath;
	}

	function configuredOrigins(value: string \| undefined): ReadonlySet<string> {
	const rawOrigins = String(value \|\| '').split(',').map((item) => item.trim()).filter(Boolean);
	if (rawOrigins.length > 32) {
	throw new Error('nexus_command_cors_allowlist_too_large');
	}
	const origins = new Set<string>();
	for (const rawOrigin of rawOrigins) {
	if (rawOrigin.length > 2048) {
	throw new Error('nexus_command_cors_origin_invalid');
	}
	let parsed: URL;
	try {
	parsed = new URL(rawOrigin);
	} catch {
	throw new Error('nexus_command_cors_origin_invalid');
	}
	if (!['http:', 'https:'].includes(parsed.protocol) \|\| parsed.origin !== rawOrigin) {
	throw new Error('nexus_command_cors_origin_invalid');
	}
	origins.add(parsed.origin);
	}
	return origins;
	}

	const HOST = configuredHost(process.env.NEXUS_COMMAND_HOST);
	const PORT = boundedInteger(process.env.NEXUS_COMMAND_PORT, 8790, 1, 65535, 'nexus_command_port_invalid');
	const SOCKET_PATH = configuredSocketPath(process.env.NEXUS_COMMAND_SOCKET_PATH);
	const COMMAND_SECRET = String(process.env.NEXUS_COMMAND_SECRET \|\| '');
	const COMMAND_SECRET_BYTES = Buffer.byteLength(COMMAND_SECRET, 'utf8');
	const COMMAND_SECRET_STRONG = COMMAND_SECRET_BYTES >= MIN_SECRET_BYTES && COMMAND_SECRET_BYTES <= 4096;
	const COMMAND_SECRET_DIGEST = createHash('sha256').update(COMMAND_SECRET, 'utf8').digest();
	const DUMMY_SECRET_DIGEST = createHash('sha256').update('aureon-nexus-no-command-secret', 'utf8').digest();
	const LOOPBACK_BIND = isLoopbackHost(HOST);
	const ALLOWED_ORIGINS = configuredOrigins(process.env.NEXUS_COMMAND_CORS_ORIGINS);

	if (COMMAND_SECRET && !COMMAND_SECRET_STRONG) {
	throw new Error('nexus_command_secret_must_be_at_least_32_bytes');
	}
	if (!LOOPBACK_BIND && !COMMAND_SECRET_STRONG) {
	throw new Error('nexus_command_remote_bind_requires_strong_auth');
	}

	function bearerToken(header: unknown): string {
	if (typeof header !== 'string' \|\| header.length > 8192 \|\| !header.startsWith('Bearer ')) {
	return '';
	}
	return header.slice('Bearer '.length).trim();
	}

	function hasValidCommandSecret(header: unknown): boolean {
	const candidateDigest = createHash('sha256').update(bearerToken(header), 'utf8').digest();
	const expectedDigest = COMMAND_SECRET_STRONG ? COMMAND_SECRET_DIGEST : DUMMY_SECRET_DIGEST;
	return COMMAND_SECRET_STRONG && timingSafeEqual(candidateDigest, expectedDigest);
	}

	function fixedError(res: express.Response, status: number, code: string) {
	return res.status(status).json({ success: false, error: code });
	}

	function requireCommandAuthorization(
	req: express.Request,
	res: express.Response,
	next: express.NextFunction,
	) {
	if (!COMMAND_SECRET_STRONG) {
	return fixedError(res, 503, 'command_auth_not_configured');
	}
	if (!hasValidCommandSecret(req.headers.authorization)) {
	return fixedError(res, 401, 'command_auth_required');
	}
	return next();
	}

	function requireReadAuthorizationOffLoopback(
	req: express.Request,
	res: express.Response,
	next: express.NextFunction,
	) {
	if (LOOPBACK_BIND) {
	return next();
	}
	return requireCommandAuthorization(req, res, next);
	}

	function requireJsonCommandBody(
	req: express.Request,
	res: express.Response,
	next: express.NextFunction,
	) {
	if (!req.is('application/json')) {
	return fixedError(res, 415, 'application_json_required');
	}
	return next();
	}

	const app = express();
	app.disable('x-powered-by');
	app.use((req, res, next) => {
	const origin = req.headers.origin;
	if (typeof origin === 'string' && !ALLOWED_ORIGINS.has(origin)) {
	return fixedError(res, 403, 'origin_not_allowed');
	}
	return next();
	});
	app.use(cors({
	origin(origin, callback) {
	if (!origin) {
	callback(null, true);
	return;
	}
	callback(null, ALLOWED_ORIGINS.has(origin));
	},
	methods: ['GET', 'POST'],
	allowedHeaders: ['Authorization', 'Content-Type'],
	credentials: false,
	maxAge: 600,
	}));
	app.use(express.json({ limit: MAX_JSON_BODY, strict: true, type: 'application/json' }));

	const httpServer = http.createServer(app);
	const wss = new WebSocketServer({ noServer: true, maxPayload: MAX_WS_PAYLOAD_BYTES });

	const clients = new Map<WebSocket, boolean>();

	function snapshot(_includeCommandDetails: boolean = false) {
	return {
	streaming: false,
	intervalMs: null,
	clients: clients.size,
	activeCommand: null,
	commandHistory: [],
	lastTick: null,
	commandEffectsEnabled: false,
	protectionStatus: 'HOLD_PLUMBER_HNC_MAGIC_STAR_BRIDGE_REQUIRED',
	};
	}

	function broadcastStatus() {
	for (const [client, authorized] of clients) {
	if (client.readyState === WebSocket.OPEN) {
	client.send(JSON.stringify({ type: 'system_status', payload: snapshot(authorized) }));
	}
	}
	}

	function isRecord(value: unknown): value is Record<string, unknown> {
	return typeof value === 'object' && value !== null && !Array.isArray(value);
	}

	function handleCommand(type: string, payload?: Record<string, unknown>) {
	const supported = new Set(['start_stream', 'stop_stream', 'run_nexus', 'stop_active_command']);
	if (!supported.has(type)) {
	throw new SafeCommandError('unsupported_command');
	}
	const body = payload === undefined ? {} : payload;
	if (!isRecord(body) \|\| Object.keys(body).length > 8) {
	throw new SafeCommandError('command_payload_invalid');
	}
	return {
	success: false,
	status: 'HOLD',
	reasonCode: 'plumber_hnc_magic_star_bridge_required',
	command: type,
	inputAdmitted: false,
	effectAttempted: false,
	};
	}

	function respondCommandError(res: express.Response, error: unknown) {
	if (error instanceof SafeCommandError) {
	return fixedError(res, error.status, error.code);
	}
	console.error('Nexus command request failed.');
	return fixedError(res, 500, 'command_failed');
	}

	function respondCommandHold(
	res: express.Response,
	type: string,
	payload?: Record<string, unknown>,
	) {
	try {
	return res.status(423).json(handleCommand(type, payload));
	} catch (error) {
	return respondCommandError(res, error);
	}
	}

	app.get('/health', requireReadAuthorizationOffLoopback, (_req, res) => {
	res.json({ ok: true, status: snapshot(false) });
	});

	app.get('/api/command-center/status', requireReadAuthorizationOffLoopback, (req, res) => {
	res.json(snapshot(hasValidCommandSecret(req.headers.authorization)));
	});

	app.post(
	'/api/command-center/stream/start',
	requireCommandAuthorization,
	requireJsonCommandBody,
	(req, res) => {
	return respondCommandHold(res, 'start_stream', req.body);
	},
	);

	app.post('/api/command-center/stream/stop', requireCommandAuthorization, (_req, res) => {
	return respondCommandHold(res, 'stop_stream', {});
	});

	app.post(
	'/api/command-center/nexus/run',
	requireCommandAuthorization,
	requireJsonCommandBody,
	(req, res) => {
	return respondCommandHold(res, 'run_nexus', req.body);
	},
	);

	app.post('/api/command-center/nexus/stop', requireCommandAuthorization, (_req, res) => {
	return respondCommandHold(res, 'stop_active_command', {});
	});

	app.use((_error: unknown, _req: express.Request, res: express.Response, _next: express.NextFunction) => {
	return fixedError(res, 400, 'invalid_json_body');
	});

	function rejectUpgrade(socket: import('net').Socket, status: number, reason: string) {
	socket.write(`HTTP/1.1 ${status} ${reason}\r\nConnection: close\r\n\r\n`);
	socket.destroy();
	}

	httpServer.on('upgrade', (request, socket, head) => {
	const origin = request.headers.origin;
	if (typeof origin === 'string' && !ALLOWED_ORIGINS.has(origin)) {
	rejectUpgrade(socket, 403, 'Forbidden');
	return;
	}

	let requestPath = '';
	try {
	requestPath = new URL(request.url \|\| '/', 'http://127.0.0.1').pathname;
	} catch {
	rejectUpgrade(socket, 404, 'Not Found');
	return;
	}
	if (requestPath !== SOCKET_PATH) {
	rejectUpgrade(socket, 404, 'Not Found');
	return;
	}
	if (!LOOPBACK_BIND && !hasValidCommandSecret(request.headers.authorization)) {
	rejectUpgrade(socket, 401, 'Unauthorized');
	return;
	}

	wss.handleUpgrade(request, socket, head, (webSocket) => {
	wss.emit('connection', webSocket, request);
	});
	});

	wss.on('connection', (socket, request) => {
	const handshakeAuthorized = hasValidCommandSecret(request.headers.authorization);
	clients.set(socket, handshakeAuthorized);
	socket.send(JSON.stringify({ type: 'system_status', payload: snapshot(handshakeAuthorized) }));

	socket.on('message', (raw) => {
	try {
	const parsed = JSON.parse(raw.toString());
	if (parsed?.type === 'ping') {
	socket.send(JSON.stringify({ type: 'pong', ts: Date.now() }));
	return;
	}
	if (parsed?.type === 'status_request') {
	socket.send(JSON.stringify({
	type: 'system_status',
	payload: snapshot(clients.get(socket) === true),
	}));
	return;
	}
	if (parsed?.type === 'command') {
	const messageAuthorized = hasValidCommandSecret(parsed.authorization);
	if (clients.get(socket) !== true && !messageAuthorized) {
	socket.send(JSON.stringify({ type: 'command_response', error: 'command_auth_required' }));
	return;
	}
	clients.set(socket, true);
	if (typeof parsed.command !== 'string' \|\| parsed.command.length > 64) {
	throw new SafeCommandError('unsupported_command');
	}
	const response = handleCommand(parsed.command, parsed.payload);
	socket.send(JSON.stringify({ type: 'command_response', payload: response }));
	}
	} catch (error) {
	const code = error instanceof SafeCommandError ? error.code : 'invalid_command_message';
	socket.send(JSON.stringify({ type: 'command_response', error: code }));
	}
	});

	socket.on('close', () => {
	clients.delete(socket);
	broadcastStatus();
	});
	socket.on('error', () => {
	clients.delete(socket);
	});
	});

	httpServer.listen(PORT, HOST, () => {
	console.log(`Nexus Command Server listening on http://${HOST}:${PORT}`);
	console.log(`WebSocket stream available at ws://${HOST}:${PORT}${SOCKET_PATH}`);
	});