fix: validate control panel runtime paths

central/app/control_api.py

@@ -8,7 +8,7 @@ from sqlalchemy import select
 from .audit import record_audit
 from .control_plane import dashboard_summary, installation_view, list_blockers, list_installations, list_jobs, list_panel_events
 from .human_auth import require_csrf, require_human
-from .models import Agent, AgentSnapshot, BlockedProduct, Installation, Tenant
+from .models import Agent, AgentSnapshot, BlockedProduct, Installation, Job, Tenant
 from .jobs import create_job
 
 
@@ -102,7 +102,8 @@ def router(session_factory):
             if kind not in {"REPROCESS_ALL", "REPROCESS_PRODUCTS"}: raise HTTPException(400, "unsupported action")
             job_payload = payload.get("payload") or {}
             if kind == "REPROCESS_PRODUCTS" and not job_payload.get("codigos"): raise HTTPException(400, "codigos required")
-            job = create_job(session, agent, kind, job_payload)
+            existing = next((candidate for candidate in session.scalars(select(Job).where(Job.agent_id == agent.id, Job.kind == kind, Job.status == "PENDING")).all() if candidate.payload == job_payload), None)
+            job = existing or create_job(session, agent, kind, job_payload)
             record_audit(session, admin_user_id=admin.id, tenant_id=installation.tenant_id, action=kind, target_type="installation", target_id=installation.installation_id, context={"job_id": job.id, "request_ip": request.client.host if request.client else None})
             session.commit()
             return {"job_id": job.id, "status": job.status}
@@ -116,7 +117,8 @@ def router(session_factory):
             if payload.get("confirm") is not True or not str(payload.get("context", "")).strip(): raise HTTPException(400, "confirmation and explicit context required")
             blocker = session.get(BlockedProduct, blocker_id)
             if not blocker: raise HTTPException(404, "blocker not found")
-            blocker.resolved_at = datetime.now(timezone.utc); blocker.resolution_source = "HUMAN_PANEL"
+            if blocker.resolved_at is None:
+                blocker.resolved_at = datetime.now(timezone.utc); blocker.resolution_source = "HUMAN_PANEL"
             record_audit(session, admin_user_id=admin.id, tenant_id=blocker.tenant_id, action="RESOLVE_BLOCKER", target_type="blocker", target_id=str(blocker_id), context={"context": payload["context"]})
             session.commit()
             return {"resolved": True, "blocker_id": blocker_id}