fix: harden secrets, audit logging, agent-run recovery, CI, and token budgets

[rgxdev]

Summary

Five hardening work packages toward a reliable agentic OS, kept minimal and scoped to existing patterns already established in this codebase (see docs/SECURITY_AUDIT.md).

1. Secrets hardening

• mcpServer.env/mcpServer.oauthState were the last plaintext secret-shaped columns (per SECURITY_AUDIT.md SEC-01) — encrypted at rest using the same AES-256-GCM envelope already used for modelInstallation.apiKey/knowledgeBaseConfig.obsidianApiKey (packages/db/src/crypto.ts, new encryptJsonNullable/decryptJsonNullable helpers). Schema columns changed from jsonb/json-mode text to plain encrypted text (migration included for both dialects).
• Added toClientSafeMcpServer/toClientSafeKnowledgeBaseConfig mappers (mirroring the existing toClientSafeInstallation) and wired them into every router procedure that was returning raw secrets to the browser — this closed several leaks beyond the two named tables: models.installCustom/installOpenRouter/setModelEnabled/addModelToInstallation/removeModelFromInstallation/installCli/importSource were all returning the undecorated DB row (including apiKey), and knowledgeBase.overview/updateConfig were spreading the raw obsidianApiKey alongside the *Set boolean.
• NYXEL_ENCRYPTION_KEY production requirement (assertProductionSecret) was already in place from a prior session — untouched here.

2. Audit log redaction

• apps/server/src/audit.ts's logAudit now redacts secret-shaped keys (apiKey, token, accessToken, refreshToken, authorization, password, secret, cookie — case/separator-insensitive, arbitrarily nested) and caps serialized size (20k chars) before every audit_log write. inputHash is unaffected — it's computed from the raw value upstream in permissions.ts before this redaction runs.

3. Durable agent run recovery

• Added workerId/heartbeatAt/leaseUntil/cancelRequestedAt to agent_run (both dialects). executeManagedTask claims a lease at start and renews it on a 30s heartbeat; cancelAgentRun always sets DB state (it already did for status, now also cancelRequestedAt) regardless of whether the run's AbortController is reachable in this process.
• scheduler.ts's new checkStaleAgentRuns() recovers runs whose lease expired (or never had one — e.g. pre-dates this feature) into failed, and fails the linked task too so the Goal Orchestrator naturally re-drives it. Runs on every scheduler tick and once at startup.

4. CI/test gate cleanup

• Deleted 5 dead /tests files that imported nonexistent modules (leftover scaffolding from an earlier layout).
• Added a root "test": "bun test" script and a CI job that runs it after lint/typecheck.
• Added hermetic, fetch-mocked tests for local model detection (packages/model-providers/src/detect.ts previously had none and made real network calls to localhost ports).
• secret-scan.yml (gitleaks) already existed and is already non-blocking (continue-on-error: true) — verified, unchanged.

5. Token budget controls

• Knowledge-base prompt-injection char caps are now configurable via NYXEL_KB_PROMPT_CONTEXT_MAX_CHARS/NYXEL_KB_PROMPT_SECTION_MAX_CHARS (same defaults as before when unset).
• Added an aggregate output-byte cap (MAX_TOTAL_OUTPUT_BYTES) to the builtin search/codebase/usages tool, additive truncated field on the response.

Out of scope / left alone

• Plugin process isolation: ADR-0007 already documents the current in-process, permission-scoped design honestly (not claimed as solved) — no runtime change made here.
• 15 pre-existing, unrelated test failures (plugins.test.ts, skills-resolve.test.ts, seo-analyzer.test.ts — a shared test-fixture DB setup issue) and 2 pre-existing typecheck failures (apps/web's chat-top-bar.tsx, packages/create-nyxel's missing @types/node) — all predate this branch, verified against origin/main, not touched.
• A pre-existing duplicate-column bug across two early Postgres migrations (0007/0008 both add chat.archived_at) was discovered while verifying the new migrations against a fresh Postgres 16 instance — unrelated to this change, not fixed (out of scope), noted here for visibility.

Test plan

• bun run typecheck — clean on every touched package (only the two pre-existing, unrelated failures above remain)
• bun run lint (biome) — clean on every touched file; 3 pre-existing lint findings surfaced in workspace-settings-panel.tsx (2 accessibility, 1 hook-deps) because the file was touched, but verified present on origin/main before this change too
• bun run test — 192 pass / 15 pre-existing unrelated fail (verified against origin/main baseline)
• Both new Postgres migrations (0042, 0043) applied against a live local Postgres 16 instance; confirmed pre-existing legacy plaintext data survives the jsonb→encrypted-text conversion via the existing legacy-plaintext fallback in crypto.ts
• New tests added for every behavior changed (secrets-at-rest, client-safe mappers, audit redaction, stale-run recovery, cancel-without-controller, local model detection, token budgets)

🤖 Generated with Claude Code

---

Generated by Claude Code