fix: keep agent connections alive and auto-register connected agents

Two related bugs left agents permanently offline in the UI:

1. The hub set a 30s read deadline but refreshed it only on pong
   frames, while agents heartbeat with pings (client.go pingInterval).
   Gorilla auto-responds to pings but never refreshed the deadline, so
   every agent connection died at 30s and reconnected forever. Handle
   pings instead and relax the deadline to the agent's 90s pongWait.

2. The agent store is in-memory, so a server restart drops every
   registration, and the OnConnect hook only updated existing records
   without creating missing ones. A restart therefore made the real
   agent invisible in the UI (and unselectable in PITR), pushing users
   to create fake agents manually. OnConnect now auto-registers any
   agent presenting a CA-signed mTLS certificate under the first org.

Author: Developer

internal/server/org/store.go

@@ -35,6 +35,7 @@ type Invite struct {
 type OrgStore interface {
 	Create(org *Organization) error
 	Get(id string) (*Organization, error)
+	ListAll() ([]*Organization, error)
 	ListByUserID(userID string) ([]*Organization, error)
 	AddMember(orgID, userID, role string) error
 	RemoveMember(orgID, userID string) error
@@ -88,6 +89,21 @@ func (s *InMemoryOrgStore) Get(id string) (*Organization, error) {
 	return org, nil
 }
 
+// ListAll returns all organisations.
+func (s *InMemoryOrgStore) ListAll() ([]*Organization, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	var orgs []*Organization
+	for _, o := range s.orgs {
+		orgs = append(orgs, o)
+	}
+	if orgs == nil {
+		return []*Organization{}, nil
+	}
+	return orgs, nil
+}
+
 // ListByUserID returns all organisations the given user is a member of.
 func (s *InMemoryOrgStore) ListByUserID(userID string) ([]*Organization, error) {
 	s.mu.RLock()

internal/server/server.go

@@ -69,13 +69,36 @@ func New() (*Server, error) {
 	pitrHandler := pitr.NewHandler(pitrStore, agentStore, orgStore, auditStore, jwtSecret(), agentHub)
 	auditHandler := audit.NewHandler(auditStore, orgStore, jwtSecret())
 
-	// Keep the agents API's status field in sync with the hub.
+	// Keep the agents API's status field in sync with the hub. Unknown agents
+	// (e.g. after a server restart cleared the in-memory store) are registered
+	// automatically so they show up in the UI and are selectable in PITR.
 	agentHub.SetLifecycleHooks(hub.LifecycleHooks{
 		OnConnect: func(agentID string) {
 			if rec, err := agentStore.Get(agentID); err == nil {
 				rec.Status = "online"
 				rec.LastSeen = time.Now()
 				_ = agentStore.Update(rec)
+				return
+			}
+
+			// Presenting a CA-signed mTLS certificate proves registration, so
+			// trust it and auto-register the agent under the first org.
+			orgs, _ := orgStore.ListAll()
+			var orgID string
+			if len(orgs) > 0 {
+				orgID = orgs[0].ID
+			}
+			rec := &agent.AgentRecord{
+				ID:        agentID,
+				OrgID:     orgID,
+				Hostname:  agentID,
+				Status:    "online",
+				LastSeen:  time.Now(),
+				CreatedAt: time.Now(),
+				Approved:  true,
+			}
+			if err := agentStore.Create(rec); err == nil {
+				log.Printf("server: auto-registered connected agent %s", agentID)
 			}
 		},
 		OnDisconnect: func(agentID string) {

internal/ws/hub/hub.go

@@ -14,7 +14,10 @@ import (
 )
 
 const (
-	readDeadline = 30 * time.Second
+	// readDeadline matches the agent's pongWait (90s): the agent heartbeats
+	// with a ping every 30s (client.go pingInterval), so 90s gives three
+	// missed heartbeats before we declare the connection dead.
+	readDeadline = 90 * time.Second
 	writeTimeout = 10 * time.Second
 )
 
@@ -131,8 +134,14 @@ func (h *Hub) HandleConnection(conn *gorilla.Conn, r *http.Request) {
 
 	log.Printf("hub: agent %s connected", agentID)
 
-	conn.SetPongHandler(func(string) error {
-		return conn.SetReadDeadline(time.Now().Add(readDeadline))
+	// The agent heartbeats by sending a ping every 30s; it never sends pong
+	// frames itself. Refresh our read deadline on each ping and reply with a
+	// pong. The default gorilla PingHandler would reply automatically but
+	// would not refresh the deadline, which previously killed every
+	// connection at readDeadline.
+	conn.SetPingHandler(func(appData string) error {
+		_ = conn.SetReadDeadline(time.Now().Add(readDeadline))
+		return conn.WriteControl(gorilla.PongMessage, []byte(appData), time.Now().Add(writeTimeout))
 	})
 
 	if err := conn.SetReadDeadline(time.Now().Add(readDeadline)); err != nil {