Adding osquery mode to console to run queries directly

[javuto]

Summary

Adds the SQL mode, command history, file carve support, node-scoped acceleration safeguards, and UI/handler fixes for more reliable quasi real-time behavior.

Changes

• Added console session metadata and command lifecycle handling:

  • Per-session working directory.
  • Per-node/per-user command history.
  • Active session heartbeat via GET /console/{env}/sessions/{session_id}.
  • Session freshness guard so stale active sessions stop accelerating nodes.

• Added osquery SQL mode:

  • sql or osquery enters an osquery> prompt.
  • Queries issued in SQL mode are sent as raw read-only osquery SQL.
  • .exit, exit, or quit leaves SQL mode.
  • .tables lists loaded osquery tables supported by the node platform.
  • Linux distro platform values, such as Debian, are normalized to Linux table support.

• Added console file carve support:

  • get <path> creates a targeted file carve.
  • Requires carve permission.
  • Carves are attributed as issued from console by the user and target the console node.

• Tightened accelerated query behavior:

  • Default accelerated read interval is now 5 seconds.
  • Console distributed queries use type = console.
  • Console queries are hidden from normal query lists.
  • Query reads only return accelerate for the node with a pending console query or a fresh active console session.
  • Stale sessions no longer keep nodes accelerated.
  • Expired console commands expire their backing distributed query and node query rows.

• Fixed console result handling:

  • Status-only osquery errors are processed even when no result payload is returned.
  • Query result decoding supports wrapped osquery query-write payloads.
  • Expired/deleted/completed distributed queries are filtered out of node query reads.

• Improved console UI:

  • Shows a spinner while waiting for the node.
  • Keeps focus on the command input after commands run.
  • Pins the command input outside the scrollback pane.
  • Focuses the input when the console opens.
  • Shows node context in the header, including IP, osquery user, osquery version, and platform.
  • Adds session heartbeat while the console is open.

Validation

• GOCACHE=/tmp/osctrl-gocache go test ./pkg/console ./pkg/queries ./cmd/api/handlers ./cmd/tls/handlers
• npm test -- NodeConsolePage.test.tsx
• npm run check
• git diff --check