feat(rcon): refine server console

design/index.md

@@ -34,7 +34,7 @@ This OKF bundle is the product record for implemented and proposed behavior. Sto
 * [US-018 — Monitor community account activity](us-018-admin-dashboard.md) - Administrators review daily users, confirmed connections, locations, denials, and risky networks.
 * [US-019 — Manage groups efficiently](us-019-admin-group-management.md) - Administrators manage group identity, policies, membership, and creation through focused confirmed workflows.
 * [US-020 — Schedule group access in UTC](us-020-scheduled-group-access.md) - Enabled groups may be restricted to recurring weekly UTC windows with static denial-message templates.
-* [US-021 — Manage RCON server connections](us-021-rcon-connections.md) - Administrators manage encrypted internal Minecraft RCON endpoints.
+* [US-021 — Manage RCON server connections](us-021-rcon-connections.md) - Administrators manage encrypted Minecraft RCON server addresses.
 * [US-022 — Operate servers through an RCON console](us-022-rcon-console.md) - Administrators execute bounded commands through the server-side portal proxy.
 
 # Tracking

design/log.md

@@ -6,6 +6,7 @@
 * **Implement**: Added a bounded server-side RCON command console with safe output and error handling; internal-only deployment verification remains pending.
 * **Refine**: Removed deployment-managed RCON endpoint allowlisting so administrators may configure any valid DNS hostname and port, while retaining IP-literal rejection and documenting the outbound-connectivity trust boundary.
 * **Verify**: Confirmed the RCON console uses an authenticated internal ClusterIP deployment with secret-backed credentials and no public RCON exposure.
+* **Refine**: Renamed RCON host configuration to server addresses, documented internal and external targets, and redesigned the console as a portal-colored terminal with a target bar, command prompt, and latest-response viewport.
 
 ## 2026-08-07
 

design/us-021-rcon-connections.md

@@ -1,9 +1,9 @@
 ---
 type: User Story
 title: Manage RCON server connections
-description: Administrators manage encrypted connection settings for internal Minecraft RCON endpoints.
+description: Administrators manage encrypted connection settings for Minecraft RCON server addresses.
 tags: [admin, rcon, minecraft, security, operations]
-timestamp: 2026-08-08T11:44:59Z
+timestamp: 2026-08-08T12:05:37Z
 story_id: US-021
 status: verified
 ---
@@ -15,7 +15,7 @@ As an administrator, I want to manage one or more Minecraft RCON connections, so
 # Acceptance Criteria
 
 - [x] Existing account-manager administrators can list, add, edit, test, enable or disable, and delete RCON server connections.
-- [x] Each connection has a unique display name, internal hostname, port, enabled state, and write-only password.
+- [x] Each connection has a unique display name, server address, port, enabled state, and write-only password.
 - [x] RCON passwords are encrypted with an authenticated cipher using a deployment-managed master key and are never returned to the browser, audit events, or application logs.
 - [x] Updating a connection preserves its password unless an administrator explicitly supplies a replacement.
 - [x] Administrators can save any syntactically valid DNS hostname and port without deployment-managed endpoint configuration; IP literals remain rejected.
@@ -30,7 +30,7 @@ The administrator RCON page and server actions manage endpoints without deployme
 
 # Validation
 
-Verified with RCON validation, encryption, gateway, component, and server-action tests; full workspace tests and type checks; web lint; OKF validation; Semgrep; dependency audit; and a production Next.js build on 2026-08-08. Validation confirms arbitrary valid DNS hostname and port pairs no longer require deployment configuration while IP literals and malformed hostnames remain rejected. Action tests confirm independent authorization, password preservation, enabled-state rechecks, safe failures, and command audit redaction.
+Verified with RCON validation, encryption, gateway, component, and server-action tests; full workspace tests and type checks; web lint; OKF validation; Semgrep; dependency audit; and a production Next.js build on 2026-08-08. Validation confirms arbitrary valid internal or external DNS server addresses and ports no longer require deployment configuration while IP literals and malformed hostnames remain rejected. Action tests confirm independent authorization, password preservation, enabled-state rechecks, safe failures, and command audit redaction.
 
 # Related Stories
 

design/us-022-rcon-console.md

@@ -3,34 +3,34 @@ type: User Story
 title: Operate servers through an RCON console
 description: Administrators execute bounded RCON commands through the server-side portal proxy.
 tags: [admin, rcon, minecraft, console, security]
-timestamp: 2026-08-08T11:44:59Z
+timestamp: 2026-08-08T12:05:37Z
 story_id: US-022
 status: verified
 ---
 
 # User Story
 
-As an administrator, I want an RCON console in the portal, so that I can operate internal Minecraft servers without exposing RCON publicly.
+As an administrator, I want an RCON console in the portal, so that I can operate configured Minecraft servers without exposing credentials to the browser.
 
 # Acceptance Criteria
 
 - [x] Existing account-manager administrators can select an enabled connection and execute an RCON command from the admin UI.
-- [x] Browsers never connect to RCON directly; commands pass through the authenticated Next.js server runtime to an internal endpoint.
+- [x] Browsers never connect to RCON directly; commands pass through the authenticated Next.js server runtime to the configured endpoint.
 - [x] Every command independently rechecks administrator authorization and the selected connection's enabled state.
 - [x] Commands are length-limited, reject control characters, execute with bounded concurrency and a timeout, and return bounded output.
 - [x] Command responses are displayed safely and are not persisted in console history, audit data, or application logs.
 - [x] Audit events record the administrator, connection, command verb and digest, success, and duration without recording complete commands or responses.
 - [x] Authentication, timeout, and connection failures return safe operator-facing messages without credentials or stack traces.
-- [x] The console is keyboard accessible and clearly identifies the selected server.
-- [x] RCON remains internal to the cluster and is not exposed through public ingress or a load balancer.
+- [x] The console uses the portal color palette to present a terminal-style server header, single keyboard-accessible prompt, pending state, and scrollable latest-response viewport.
+- [x] Configured server addresses may be internal or external, and operators receive guidance that RCON network exposure and transport security remain their responsibility.
 
 # Implementation
 
-The client console invokes an authenticated server action that revalidates the enabled connection, decrypts its credential only in the server runtime, and executes one bounded command. The gateway limits each process to one operation per server and eight total operations, applies a five-second end-to-end deadline plus bounded cleanup, sanitizes and truncates output, and records keyed command lifecycle audits without command or response content.
+The portal-colored terminal interface identifies the selected server in its header, accepts one command through a keyboard-focused prompt, and displays only the latest bounded response in a scrollable viewport. The client invokes an authenticated server action that revalidates the enabled connection, decrypts its credential only in the server runtime, and executes one bounded command. The gateway limits each process to one operation per server and eight total operations, applies a five-second end-to-end deadline plus bounded cleanup, sanitizes and truncates output, and records keyed command lifecycle audits without command or response content.
 
 # Validation
 
-Application behavior is verified with gateway, validation, component, credential, and server-action tests; full workspace tests and type checks; web lint; OKF validation; Semgrep; dependency audit; and a production Next.js build on 2026-08-08. The SoMC GitOps deployment verifies Season 4 RCON through an authenticated internal ClusterIP Service backed by a Kubernetes Secret, with no public ingress or load balancer exposure.
+Application behavior is verified with gateway, validation, component, credential, and server-action tests; full workspace tests and type checks; web lint; OKF validation; Semgrep; dependency audit; and a production Next.js build on 2026-08-08. Component validation confirms labelled server and command controls, terminal semantics, an idle output viewport, and an accessible no-server state. The SoMC GitOps deployment verifies Season 4 RCON through an authenticated internal ClusterIP Service backed by a Kubernetes Secret while product guidance also covers external server addresses.
 
 # Related Stories