8b3e43f30d
Use extract_event_actor_user instead of missing ORM field; map WinRM/SSH errors to HTTP 400. Co-authored-by: Cursor <cursoragent@cursor.com>