doing · High priority

Game Panel Go Host Agent

A first read-only CT-side Go agent is now installed and running on the Games CT via a prebuilt Linux binary, with bearer-token auth, health/system/log-tail/root/process endpoints, allowed-root path checks, scoped process snapshots with redacted command previews, secret-file refusal, systemd install notes, tests, secret-aware package/upload helpers, upload dry-run planning, CT remote preflight checks, install-mode Go/systemd hard stops, SSH-port vs agent-port docs, custom archive validation, root-only CT install permissions, env-preserving reinstalls with trapped temporary env cleanup, hardened systemd settings, a StartService guard that refuses to start until the remote env already has a real token, and a web-server-to-Games-CT upload helper for the private LAN path. Server Settings can test the private agent URL, verify root coverage, show scoped process counts in compact process cards, keeps the bearer token out of forms, strips any old token-note setting on save, selected console refreshes try the host agent first before falling back to SSH, and the agent now only accepts URL query tokens from loopback smoke tests while LAN/web-panel calls use Authorization headers.