feat: agent ZIP upload frontend with env vars + SUDO_PASSWORD auth

- GET / serves HTML upload form (password-protected via SUDO_PASSWORD env)
- POST /upload-agent accepts multipart: ZIP archive + env vars (KEY=VALUE)
- GET /agent-code returns stored ZIP (password in X-Password header)
- ZIP validated, env vars parsed and stored in-memory
- Constant-time password comparison for security

Author: Platform

src/config.rs

@@ -31,6 +31,7 @@ pub struct Config {
     pub consensus_threshold: f64,
     pub consensus_ttl_secs: u64,
     pub max_pending_consensus: usize,
+    pub sudo_password: Option<String>,
 }
 
 impl Config {
@@ -71,6 +72,9 @@ impl Config {
                 "MAX_PENDING_CONSENSUS",
                 DEFAULT_MAX_PENDING_CONSENSUS,
             ),
+            sudo_password: std::env::var("SUDO_PASSWORD")
+                .ok()
+                .filter(|s| !s.is_empty()),
         })
     }
 

src/executor.rs

@@ -365,17 +365,11 @@ async fn run_task_pipeline(
     .await?;
 
     // Capture git diff after agent runs (the patch the agent produced)
-    let agent_patch = match run_cmd(
-        &["git", "diff"],
-        &repo_dir,
-        Duration::from_secs(30),
-        None,
-    )
-    .await
-    {
-        Ok((stdout, _, _)) => stdout,
-        Err(_) => String::new(),
-    };
+    let agent_patch =
+        match run_cmd(&["git", "diff"], &repo_dir, Duration::from_secs(30), None).await {
+            Ok((stdout, _, _)) => stdout,
+            Err(_) => String::new(),
+        };
     debug!("[{}] Agent patch: {} bytes", task.id, agent_patch.len());
 
     // Store agent output and patch for later retrieval