feat: run Fleet Node discovery without Nmap

[ankitgoswami]

Reviewable diff: +870/-699 across 24 files (excludes generated, test, and story files).

Summary

Fleet Nodes discover miners without installing or executing Nmap. Network scans feed open TCP endpoints into the existing miner plugins. Explicit IP lists and ranges probe plugins directly, preserving virtual miners that have no TCP listeners, and both paths retain identified devices when discovery stops early.

Stack: #1034 (this PR) → #1035 → #1036 → #1037

This diff targets main and includes the shared parser, DNS policy and bounded TCP scanner alongside Fleet Node adoption. PR #1030 is already on main and supplies dispatch and report routing. This layer still uses the existing wire mode name and 1,024-target limit.

Server runtime and dependency removal are in #1035; operator warnings in #1036; coordinated API rename and larger limits in #1037.

How it works

A node validates private targets and resolves names locally using the shared target and port rules. Network-mode validation reuses its parsed target for private-scope checks and address enumeration. Network scans filter open TCP ports; explicit IP lists and ranges feed the validated endpoints directly into the same bounded pool of up to 32 plugin probes. The ten-minute command budget and ten-second probe deadlines remain. At completion, the node uploads retained reports in 1,024-device batches under one 30-second upload budget, then acknowledges the command. Upload failure takes precedence over scan failure; deadline or supervisor truncation produces PARTIAL.

Diagrams

flowchart LR
  C["Discovery command"] --> V["Shared target, DNS and port validation"]
  V --> N["Network scan"]
  N --> S["Shared TCP scanner"]
  S --> P["Bounded plugin probes"]
  V --> E["Explicit IP list or range"]
  E --> P
  P --> R["Retained device reports"]
  R --> U["Final batched upload"]
  U --> A["ACK with completion outcome"]

Loading

sequenceDiagram
  participant Server
  participant Node
  participant Plugins
  Server->>Node: Discovery command
  Node->>Plugins: Probe explicit endpoints or open network ports
  Plugins-->>Node: Identified devices
  Node-->>Server: Final report batches
  Node-->>Server: ACK after upload completes

Loading

Areas of the code involved

Area / package / file	What changed	Why it matters for review
server/internal/domain/netscan	Shared target parsing, DNS policy and bounded TCP scanner	Shared foundation for node and server adoption
server/cmd/fleetnode	Use shared TCP scanning for network mode and direct bounded probes for explicit targets	Review cancellation, retained reports and ACK precedence
server/internal/domain/fleetnode/discovery	Reuse inclusive range and report-scope semantics	Explicit .0/.1 endpoints remain reportable
Fleet Node installer, Dockerfile, artifact workflow and justfile	Remove Nmap prerequisites, packages and symlinks	Node packaging no longer requires an external scanner
server/cmd/fleetnode/firmware_space_* and server/go.mod	Split the existing free-space check by platform using the existing x/sys dependency	Allows Windows compilation while preserving the safety check

Key technical decisions & trade-offs

• Explicit discovery lets plugins decide whether a target exists; network discovery first checks TCP reachability. No driver-specific bypass or new plugin contract.
• Keep uploads at command completion rather than adding a new progressive reporting protocol.
• Keep existing private-address checks, local-subnet detection, command protocol and supervisor behavior.
• Drop NET_RAW from the node test container while retaining unrelated simulator capabilities.
• Use the existing Windows system API for free-space checks; no dependency version upgrade.

Testing & validation

• Regression tests exercise in-memory virtual devices with no TCP listener in both explicit modes, cancellation, and network-only TCP filtering.
• Fleet Node and shared scanner race suites pass, including failure/deadline report retention, upload batching and timeout behavior.
• Installer tests pass; Windows amd64 and Linux ARM64 node builds pass.
• Windows execution, installed-package discovery and real miner/network qualification were not run.

Post-deploy monitoring & validation

Release the complete stack with server, nodes and client updated together. On a controlled network, compare expected miners against both server and node discovery, exercise an incomplete scan, and confirm that retained results and its warning reach the client. Pause rollout if expected devices disappear, scans cannot stop within their budgets, or completed reports are lost. No deployment was performed for these draft PRs.

---

Restack validation: affected unit/race suites, server lint, protobuf lint, client type check and 33 focused client tests pass. Database integration tests remain for CI.

[github-actions]

🔐 Codex Security Review

Note: This is an automated security-focused code review generated by Codex.
It should be used as a supplementary check alongside human review.
False positives are possible - use your judgment.

Scope summary

• Reviewed pull request diff only (96d9669f98079494b99bc540b9cebc8a48ba38af...f43acb51175a2ecf6eff1ba59dc636415f5670b5, exact PR three-dot diff)
• Model: gpt-5.6-sol

💡 Click "edited" above to see previous reviews for this PR.

---

Review Summary

Overall Risk: HIGH

Findings

[HIGH] Automated review incomplete

• Category: Other
• Description: The automated review produced no usable result for 96d9669f98079494b99bc540b9cebc8a48ba38af...f43acb51175a2ecf6eff1ba59dc636415f5670b5 (workflow run 34645825999; reason: codex-job-timeout, elapsed: unknown, budget: 9 minutes).
• Impact: The pull request has not received complete automated security, correctness, and reliability analysis.
• Recommendation: Require human review before merging. Do not treat this result as approval-free or low risk.

Notes

Human review is required because the bounded automated review was incomplete.

---

_{Generated by Codex Security Review |
Triggered by: @ankitgoswami |
Review workflow run}

[Copilot]

🟢 Approval recommended

The implementation is consistent and well tested; only a minor obsolete README security reference remains.

Pull request overview

Replaces Fleet Node Nmap execution with shared in-process TCP scanning while preserving direct plugin probing for explicit targets.

Changes:

• Adds bounded TCP scanning, probing, cancellation, and partial-result handling.
• Removes Fleet Node Nmap packaging and installation requirements.
• Adds platform-specific firmware disk-space checks.

File summaries

File	Description
server/internal/domain/fleetnode/discovery/service.go	Uses shared range validation.
server/internal/domain/fleetnode/discovery/reportscope.go	Uses shared target matching.
server/internal/domain/fleetnode/discovery/iprange_test.go	Tests inclusive range behavior.
server/go.mod	Makes x/sys direct.
server/Dockerfile.fleetnode.dev	Removes Nmap package.
server/docker-compose.fleetnode-ui-test.yaml	Drops NET_RAW.
server/cmd/fleetnode/scan.go	Implements scanning and probing.
server/cmd/fleetnode/scan_test.go	Tests new discovery paths.
server/cmd/fleetnode/run.go	Configures the shared scanner.
server/cmd/fleetnode/README.md	Documents TCP discovery.
server/cmd/fleetnode/nmap.go	Removes Nmap integration.
server/cmd/fleetnode/nmap_windows.go	Removes Windows Nmap handling.
server/cmd/fleetnode/nmap_unix.go	Removes Unix Nmap handling.
server/cmd/fleetnode/nmap_test.go	Removes obsolete Nmap tests.
server/cmd/fleetnode/minercommand.go	Moves disk-space logic.
server/cmd/fleetnode/firmware_space_windows.go	Adds Windows disk-space support.
server/cmd/fleetnode/firmware_space_unix.go	Preserves Unix disk-space checks.
server/cmd/fleetnode/control.go	Integrates scanning and retained uploads.
server/cmd/fleetnode/control_test.go	Updates discovery tests.
justfile	Stops staging Nmap.
deployment-files/fleetnode/tests/test-install-fleetnode.sh	Removes Nmap installer assertions.
deployment-files/fleetnode/install-fleet-node.sh	Removes Nmap prerequisite.
.github/workflows/proto-fleet-artifact-build.yml	Stops installing Nmap in CI.

Review details

• Files reviewed: 23/23 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 33073a6fa4

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".