#912 Adding osquery mode to console to run queries directly Pull request opened by javuto Summary Adds the SQL mode, command history, file carve support, node-scoped acceleration safeguards, and UI/handler fixes for more reliable quasi real-time behavior. Changes • Added console session metadata and command lifecycle handling: • Per-session working directory. • Per-node/per-user command history. • Active session heartbeat via

GET /console/{env}/sessions/{session_id}

. • Session freshness guard so stale active sessions stop accelerating nodes. • Added osquery SQL mode: •

sql

or

osquery

enters an

osquery>

prompt. • Queries issued in SQL mode are sent as raw read-only osquery SQL. •

.exit

,

exit

, or

quit

leaves SQL mode. •

.tables

lists loaded osquery tables supported by the node platform. • Linux distro platform values, such as Debian, are normalized to Linux table support. • Added console file carve support: •

get <path>

creates a targeted file carve. • Requires carve permission. • Carves are attributed as issued from console by the user and target the console node. • Tightened accelerated query behavior: • Default accelerated read interval is now 5 seconds. • Console distributed queries use

type = console

. • Console queries are hidden from normal query lists. • Query reads only return

accelerate

for the node with a pending console query or a fresh active console session. • Stale sessions no longer keep nodes accelerated. • Expired console commands expire their backing distributed query and node query rows. • Fixed console result handling: • Status-only osquery errors are processed even when no result payload is returned. • Query result decoding supports wrapped osquery query-write payloads. • Expired/deleted/completed distributed queries are filtered out of node query reads. • Improved console UI: • Shows a spinner while waiting for the node. • Keeps focus on the command input after commands run. • Pins the command input outside the scrollback pane. • Focuses the input when the console opens. • Shows node context in the header, including IP, osquery user, osquery version, and platform. • Adds session heartbeat while the console is open. Validation •

GOCACHE=/tmp/osctrl-gocache go test ./pkg/console ./pkg/queries ./cmd/api/handlers ./cmd/tls/handlers

•

npm test -- NodeConsolePage.test.tsx

•

npm run check

•

git diff --check

jmpsec/osctrl