@0xmaxma/claude-gateway 2.0.5 → 2.0.7

package/dist/api/gateway-router.js

@@ -38,11 +38,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GatewayRouter = void 0;
 exports.resolveBindHost = resolveBindHost;
+const dashboard_processes_1 = require("./dashboard-processes");
+const dashboard_sessions_1 = require("./dashboard-sessions");
+const memory_activity_1 = require("./memory-activity");
 const dashboard_range_1 = require("../ui/dashboard-range");
 const dashboard_reader_1 = require("../orchestration/dashboard-reader");
 const express_1 = __importDefault(require("express"));
 const http = __importStar(require("node:http"));
-const child_process_1 = require("child_process");
 const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
@@ -231,6 +233,7 @@ class RateLimiter {
 }
 class GatewayRouter {
     constructor(agents, configs, schedulers, gatewayConfig, cronManager, configPath, appsRegistry, appInstaller, appRegistryClient) {
+        var _a, _b;
         this.dashboardReader = new dashboard_reader_1.DashboardReader();
         this.dashboardStreams = new Set();
         // ─── App proxy ──────────────────────────────────────────────────────────
@@ -244,10 +247,6 @@ class GatewayRouter {
         /** Short-lived WS auth tickets: ticket → { agentId, sessionId, expiresAt }. One-time use. */
         this.ptyStreamTickets = new Map();
         this.ticketPruner = null;
-        /** Dashboard session tokens (DASH_SESSION_TTL_MS). Issued at POST /dashboard/login
-         *  and carried by the HttpOnly `dash_session` cookie — never embedded in the HTML,
-         *  so no token is exposed to view-source/XSS. token → expiresAt. */
-        this.dashboardTokens = new Map();
         /** Failed-login throttle for /dashboard/login, keyed by client IP.
          *  ip → { count, resetAt }. Blocks brute-forcing configured API keys. */
         this.loginAttempts = new Map();
@@ -265,8 +264,13 @@ class GatewayRouter {
         this.agents = agents;
         this.configs = configs;
         this.gatewayConfig = gatewayConfig;
+        if (gatewayConfig) {
+            (_a = gatewayConfig.gateway).api ?? (_a.api = { keys: [] });
+            (_b = gatewayConfig.gateway.api).keys ?? (_b.keys = []);
+        }
         this.cronManager = cronManager;
         this.configPath = configPath;
+        this.dashboardSessions = new dashboard_sessions_1.DashboardSessions(configPath ? path.join(path.dirname(configPath), 'dashboard-sessions.db') : undefined);
         this.appsRegistry = appsRegistry;
         this.appInstaller = appInstaller;
         this.appRegistryClient = appRegistryClient;
@@ -318,8 +322,12 @@ class GatewayRouter {
         const token = parseCookies(req.headers['cookie'])[DASH_SESSION_COOKIE];
         if (!token)
             return false;
-        const exp = this.dashboardTokens.get(token) ?? 0;
-        return exp > Date.now();
+        try {
+            return this.dashboardSessions.valid(token, this.apiKeys);
+        }
+        catch {
+            return false;
+        } // Unreadable/corrupt auth storage must never grant access.
     }
     /**
      * Gate a dashboard-adjacent endpoint: accept an admin API key OR a live
@@ -620,8 +628,8 @@ class GatewayRouter {
                 path.join(os.homedir(), '.claude-gateway', 'shares.db');
             const store = new share_store_1.ShareStore(dbPath);
             this.app.use((0, share_router_1.createSharesPublicRouter)(store, this.agentsRoot()));
-            if (this.gatewayConfig?.gateway?.api?.keys?.length) {
-                const publicUrl = (0, url_1.normalizePublicUrl)(this.gatewayConfig?.gateway?.publicUrl) ?? undefined;
+            if (this.gatewayConfig?.gateway?.api?.keys) {
+                const publicUrl = () => (0, url_1.normalizePublicUrl)(this.gatewayConfig?.gateway?.publicUrl) ?? undefined;
                 this.app.use('/api', (0, share_router_1.createSharesPrivateRouter)(store, this.gatewayConfig.gateway.api.keys, this.agentsRoot(), publicUrl));
             }
         }
@@ -661,29 +669,29 @@ class GatewayRouter {
             res.json({ ticket, expiresAt: new Date(expiresAt).toISOString() });
         });
         // Mount API router after body parser so req.body is populated
-        if (this.gatewayConfig?.gateway?.api?.keys?.length) {
-            const apiRouter = (0, router_1.createApiRouter)(this.agents, this.configs, this.gatewayConfig.gateway.api.keys, this.configPath, this.gatewayConfig.gateway.models);
+        if (this.gatewayConfig?.gateway?.api?.keys) {
+            const apiRouter = (0, router_1.createApiRouter)(this.agents, this.configs, this.gatewayConfig.gateway.api.keys, this.configPath, () => this.gatewayConfig?.gateway.models);
             this.app.use('/api', apiRouter);
             this.voiceApi = new voice_router_1.VoiceApi(this.agents, this.configs, this.gatewayConfig.gateway.api.keys);
             this.app.use('/api', this.voiceApi.router);
         }
         // Mount workspace file routes
-        if (this.gatewayConfig?.gateway?.api?.keys?.length) {
+        if (this.gatewayConfig?.gateway?.api?.keys) {
             const workspaceRouter = (0, workspace_router_1.createWorkspaceRouter)(this.configs, this.gatewayConfig.gateway.api.keys);
             this.app.use('/api', workspaceRouter);
         }
         // Mount skills routes
-        if (this.gatewayConfig?.gateway?.api?.keys?.length) {
+        if (this.gatewayConfig?.gateway?.api?.keys) {
             const skillsRouter = (0, skills_router_1.createSkillsRouter)(this.configs, this.gatewayConfig.gateway.api.keys, this.agents, this.gatewayConfig);
             this.app.use('/api', skillsRouter);
         }
         // Mount package update routes (admin-only)
-        if (this.gatewayConfig?.gateway?.api?.keys?.length) {
+        if (this.gatewayConfig?.gateway?.api?.keys) {
             const packagesRouter = (0, packages_1.createPackagesRouter)(this.gatewayConfig.gateway.api.keys);
             this.app.use('/api', packagesRouter);
         }
         // Mount connector management routes (connector definitions + secret store + config wiring)
-        if (this.gatewayConfig?.gateway?.api?.keys?.length) {
+        if (this.gatewayConfig?.gateway?.api?.keys) {
             const connectorsRouter = (0, connectors_router_1.createConnectorsRouter)(this.gatewayConfig.gateway.api.keys, this.configPath, this.agents, this.customConnectorsStore);
             this.app.use('/api', connectorsRouter);
             // Admin-gated "start an OAuth sign-in" endpoint for gateway-owned
@@ -695,17 +703,15 @@ class GatewayRouter {
         // Public (no auth) — this is what the OAuth provider redirects the end
         // user's own browser to after they sign in. Mounted at the app root, not
         // under /api, mirroring the /app/:name/:portName proxy below.
-        this.app.use((0, oauth_connectors_router_1.createOauthCallbackRouter)(this.customConnectorsStore, undefined, typeof this.gatewayConfig?.gateway?.oauthReturnUrl === 'string'
-            ? this.gatewayConfig.gateway.oauthReturnUrl
-            : undefined, this.agents));
+        this.app.use((0, oauth_connectors_router_1.createOauthCallbackRouter)(this.customConnectorsStore, undefined, () => this.gatewayConfig?.gateway.oauthReturnUrl, this.agents));
         // Mount cron manager routes with same API key auth as agent router
         if (this.cronManager) {
-            const cronRouter = (0, cron_router_1.createCronRouter)(this.cronManager, this.gatewayConfig?.gateway?.api?.keys, new Set(this.configs.keys()));
+            const cronRouter = (0, cron_router_1.createCronRouter)(this.cronManager, this.gatewayConfig?.gateway?.api?.keys, () => new Set(this.configs.keys()));
             this.app.use('/api', cronRouter);
         }
         // Mount the route manifest endpoint (GET /api/v1/_meta/routes) — serves the
         // registry populated by the converted routers above, for CLI cross-checking.
-        if (this.gatewayConfig?.gateway?.api?.keys?.length) {
+        if (this.gatewayConfig?.gateway?.api?.keys) {
             const metaRouter = (0, meta_router_1.createMetaRouter)(this.gatewayConfig.gateway.api.keys);
             this.app.use('/api', metaRouter);
         }
@@ -713,7 +719,7 @@ class GatewayRouter {
         if (this.appsRegistry &&
             this.appInstaller &&
             this.appRegistryClient &&
-            this.gatewayConfig?.gateway?.api?.keys?.length) {
+            this.gatewayConfig?.gateway?.api?.keys) {
             const appsRouter = (0, apps_router_1.createAppsRouter)(this.appsRegistry, this.appInstaller, this.appRegistryClient, this.gatewayConfig.gateway.api.keys);
             this.app.use('/api', appsRouter);
         }
@@ -815,10 +821,10 @@ class GatewayRouter {
                 delete require.cache[webUiPath];
                 // eslint-disable-next-line @typescript-eslint/no-require-imports
                 const { generateDashboardHtml: fresh } = require('../ui/web-ui');
-                res.send(fresh());
+                res.send(fresh(this.gatewayConfig?.gateway?.timezone));
             }
             else {
-                res.send((0, web_ui_1.generateDashboardHtml)());
+                res.send((0, web_ui_1.generateDashboardHtml)(this.gatewayConfig?.gateway?.timezone));
             }
         });
         // Reports expose cross-agent usage/tool inventories: the same admin gate as status.
@@ -857,7 +863,7 @@ class GatewayRouter {
                 }
                 try {
                     const source = runner.getDashboardSource?.();
-                    let report = source ? await this.dashboardReader.read('report', source.filename, { workspace: source.workspace, sessionId, offset, since: (0, dashboard_range_1.dashboardSince)(req.query.scope ?? (reportPath === '/token-report' ? 'all' : '24h')), historyFilename: source.historyFilename }) : await runner.getTokenReport(sessionId);
+                    let report = source ? await this.dashboardReader.read('report', source.filename, { workspace: source.workspace, sessionId, offset, since: (0, dashboard_range_1.dashboardSince)(req.query.scope ?? (reportPath === '/token-report' ? 'all' : '24h'), Date.now(), this.gatewayConfig?.gateway?.timezone), historyFilename: source.historyFilename }) : await runner.getTokenReport(sessionId);
                     if (!report) {
                         res.status(404).json({ error: 'No recorded session token report' });
                         return;
@@ -869,7 +875,7 @@ class GatewayRouter {
                     if (reportPath === '/token-report')
                         res.json(report);
                     else
-                        res.type('html').send((0, token_report_1.generateTokenReportHtml)(agentId, { ...report, scope: (0, dashboard_range_1.dashboardRange)(req.query.scope), sessionStatus: runner.agentSessionLiveStatus?.(sessionId) ?? 'stopped' }));
+                        res.type('html').send((0, token_report_1.generateTokenReportHtml)(agentId, { ...report, timezone: this.gatewayConfig?.gateway?.timezone, scope: (0, dashboard_range_1.dashboardRange)(req.query.scope), sessionStatus: runner.agentSessionLiveStatus?.(sessionId) ?? 'stopped' }));
                 }
                 catch {
                     res.status(500).json({ error: 'Unable to load session token report' });
@@ -892,7 +898,7 @@ class GatewayRouter {
                 return;
             }
             try {
-                const detail = await this.dashboardReader.read('session', source.filename, { sessionId, offset, since: (0, dashboard_range_1.dashboardSince)(req.query.scope), historyFilename: source.historyFilename });
+                const detail = await this.dashboardReader.read('session', source.filename, { sessionId, offset, since: (0, dashboard_range_1.dashboardSince)(req.query.scope, Date.now(), this.gatewayConfig?.gateway?.timezone), historyFilename: source.historyFilename });
                 if (!detail) {
                     res.status(404).json({ error: 'Session not found' });
                     return;
@@ -923,7 +929,7 @@ class GatewayRouter {
                 return;
             }
             try {
-                const task = await this.dashboardReader.read('task', source.filename, { sessionId, taskId, offset, since: (0, dashboard_range_1.dashboardSince)(req.query.scope) });
+                const task = await this.dashboardReader.read('task', source.filename, { sessionId, taskId, offset, since: (0, dashboard_range_1.dashboardSince)(req.query.scope, Date.now(), this.gatewayConfig?.gateway?.timezone) });
                 if (!task) {
                     res.status(404).json({ error: 'Task not found in this session' });
                     return;
@@ -959,49 +965,57 @@ class GatewayRouter {
             }
             // Success: clear this IP's failure window.
             this.loginAttempts.delete(this.clientIp(req));
-            const token = crypto.randomBytes(32).toString('hex');
-            this.dashboardTokens.set(token, Date.now() + DASH_SESSION_TTL_MS);
+            let token;
+            try {
+                token = this.dashboardSessions.issue(key, DASH_SESSION_TTL_MS);
+            }
+            catch {
+                res.status(503).json({ error: 'Dashboard session storage is unavailable.' });
+                return;
+            }
             res.setHeader('Set-Cookie', this.buildSessionCookie(req, token, DASH_SESSION_TTL_MS));
             res.json({ ok: true });
         });
         // Dashboard logout — revoke the session token and clear the cookie.
         this.app.post('/dashboard/logout', (req, res) => {
             const token = parseCookies(req.headers['cookie'])[DASH_SESSION_COOKIE];
-            if (token)
-                this.dashboardTokens.delete(token);
+            try {
+                if (token)
+                    this.dashboardSessions.revoke(token);
+            }
+            catch {
+                res.status(503).json({ error: 'Could not revoke the dashboard session. Please try again.' });
+                return;
+            }
             res.setHeader('Set-Cookie', this.buildSessionCookie(req, '', 0));
             res.json({ ok: true });
         });
-        // Process tree endpoint — returns raw ps data for dashboard.
-        // Async exec + 3s cache: avoids blocking the event loop on every dashboard poll.
-        this.app.get('/processes', (req, res) => {
+        // Authenticated, cached, single-flight process inventory. No raw command lines.
+        this.app.get('/processes', async (req, res) => {
             if (!this.requireDashOrApiKey(req, res))
                 return;
-            const now = Date.now();
-            if (this.processesCache && now - this.processesCache.ts < GatewayRouter.PROCESSES_CACHE_TTL_MS) {
-                res.json({ processes: this.processesCache.data, numCpus: GatewayRouter.NUM_CPUS });
-                return;
+            try {
+                if (!this.processesCache || Date.now() - this.processesCache.ts >= GatewayRouter.PROCESSES_CACHE_TTL_MS) {
+                    if (!this.processesPending) {
+                        const owners = [{ pid: process.pid, group: 'gateway' }];
+                        for (const runner of this.agents.values())
+                            owners.push(...(runner.getProcessOwners?.() ?? []));
+                        const apps = new Map();
+                        for (const [id, config] of this.configs)
+                            if (config.type === 'app-agent' && config.container) {
+                                apps.set(config.container, [...(apps.get(config.container) ?? []), id]);
+                            }
+                        this.processesPending = (0, dashboard_processes_1.collectDashboardProcesses)(owners, [...apps].map(([name, agentIds]) => ({ name, agentIds })))
+                            .then(data => { this.processesCache = { data, ts: Date.now() }; return data; })
+                            .finally(() => { this.processesPending = undefined; });
+                    }
+                    await this.processesPending;
+                }
+                res.json({ ...this.processesCache.data, numCpus: GatewayRouter.NUM_CPUS });
+            }
+            catch {
+                res.status(503).json({ error: 'Process inspection unavailable' });
             }
-            (0, child_process_1.exec)("ps -eo pid,ppid,stat,%cpu,%mem,rss,args --no-headers 2>/dev/null | grep -E 'claude|bun.*gateway|bun.*mcp|bun.*receiver|node.*dist/' | grep -v grep | grep -v vscode", { encoding: 'utf8', timeout: 5000 }, (err, stdout) => {
-                if (err)
-                    process.stderr.write(`[processes] ps error: ${err.message}\n`);
-                const processes = (stdout ?? '').trim().split('\n').filter(Boolean).map((line) => {
-                    const m = line.trim().match(/^(\d+)\s+(\d+)\s+(\S+)\s+([\d.]+)\s+([\d.]+)\s+(\d+)\s+(.+)$/);
-                    if (!m)
-                        return null;
-                    return {
-                        pid: parseInt(m[1]),
-                        ppid: parseInt(m[2]),
-                        stat: m[3],
-                        cpu: parseFloat(m[4]),
-                        mem: parseFloat(m[5]),
-                        rssKb: parseInt(m[6]),
-                        args: m[7].trim(),
-                    };
-                }).filter(Boolean);
-                this.processesCache = { data: processes, ts: Date.now() };
-                res.json({ processes, numCpus: GatewayRouter.NUM_CPUS });
-            });
         });
         // Knowledge Base graph — a memory-wiki as a {nodes, edges} model for the
         // dashboard's "Knowledge base" tab. Computed ON DEMAND from *.md notes (does
@@ -1161,6 +1175,66 @@ class GatewayRouter {
                 res.status(500).json({ error: 'Failed to list knowledge sources' });
             }
         });
+        let memorySnapshot;
+        let memorySnapshotUntil = 0;
+        this.app.get('/dashboard/memory-activity', async (req, res) => {
+            if (!this.requireDashOrApiKey(req, res))
+                return;
+            res.setHeader('Cache-Control', 'no-store');
+            const { agentId, kind, status, id, scope, completedOnly } = req.query, page = Number(req.query.page ?? 0);
+            if (!Number.isSafeInteger(page) || page < 0 || page > 1000000 ||
+                [agentId, kind, status, id, scope].some(v => v !== undefined && (typeof v !== 'string' || v.length > 256)) ||
+                (completedOnly !== undefined && completedOnly !== 'true' && completedOnly !== 'false') ||
+                (kind !== undefined && !['all', 'memory_dream', 'session_compaction'].includes(String(kind))) ||
+                (status !== undefined && !String(status).split(',').every(s => ['all', 'none', 'pending', 'running', 'completed', 'failed', 'partial_failure', 'interrupted', 'skipped'].includes(s))) ||
+                (scope !== undefined && !['24h', '7d', '30d', '90d', 'all'].includes(String(scope)))) {
+                res.status(400).json({ error: 'Invalid activity filters' });
+                return;
+            }
+            if (agentId && !this.agents.has(String(agentId))) {
+                res.status(404).json({ error: 'Unknown agent' });
+                return;
+            }
+            try {
+                if (!memorySnapshot || Date.now() >= memorySnapshotUntil) {
+                    memorySnapshotUntil = Infinity;
+                    const snapshot = (0, memory_activity_1.readMemoryActivity)(this.agents, this.agentsRoot(), (filename, agentId) => this.dashboardReader.read('compaction', filename, { agentId })).then(data => { if (memorySnapshot === snapshot)
+                        memorySnapshotUntil = Date.now() + 5000; return data; }, error => { if (memorySnapshot === snapshot)
+                        memorySnapshot = undefined; throw error; });
+                    memorySnapshot = snapshot;
+                }
+                const data = await memorySnapshot;
+                if (id) {
+                    let run = data.runs.find(r => r.id === id && r.agent === agentId);
+                    if (!run) {
+                        res.status(404).json({ error: 'Activity not found' });
+                        return;
+                    }
+                    const source = this.agents.get(String(agentId))?.getDashboardSource?.();
+                    if (run.kind === 'session_compaction' && source)
+                        run = await this.dashboardReader.read('compaction', source.filename, { agentId, runId: id });
+                    if (!run) {
+                        res.status(404).json({ error: 'Activity not found' });
+                        return;
+                    }
+                    if (completedOnly === 'true' && run.kind === 'session_compaction') {
+                        run = { ...run, items: (run.items ?? []).filter((item) => item.status === 'completed'), itemCount: run.completedSessions };
+                    }
+                    res.json({ run });
+                    return;
+                }
+                const timezone = this.gatewayConfig?.gateway?.timezone || 'UTC';
+                const since = (0, dashboard_range_1.dashboardSince)(scope, Date.now(), timezone);
+                const runs = data.runs.filter(r => (completedOnly !== 'true' || r.kind !== 'session_compaction' || r.completedSessions > 0 || (r.items ?? []).some((i) => i.status === 'completed')) && (!agentId || r.agent === agentId) && (!kind || kind === 'all' || r.kind === kind) && (!status || status === 'all' || String(status).split(',').includes(r.status)) && r.startedAt >= since);
+                res.json({ timezone, since, runs: runs.slice(page * 25, page * 25 + 25).map(memory_activity_1.activitySummary), total: runs.length, page, pageSize: 25,
+                    agents: data.agents, schedules: data.schedules.filter(s => !agentId || s.agent === agentId), unavailable: data.unavailable,
+                    counts: { compactedSessions: runs.reduce((n, r) => n + (r.completedSessions ?? r.items?.filter((i) => i.status === 'completed').length ?? 0), 0), measuredReduction: runs.reduce((n, r) => n + ((0, memory_activity_1.activitySummary)(r).measuredReduction ?? 0), 0), measuredSessions: runs.reduce((n, r) => n + ((0, memory_activity_1.activitySummary)(r).measuredSessions ?? 0), 0), runs: runs.length, pendingProposals: runs.reduce((n, r) => n + (r.pendingProposals ?? 0), 0), failed: runs.filter(r => ['failed', 'partial_failure', 'interrupted'].includes(r.status)).length },
+                    historyLimit: 100 });
+            }
+            catch {
+                res.status(503).json({ error: 'Memory activity temporarily unavailable' });
+            }
+        });
         // Nightly dreaming report — parses every agent's `.dreaming/` audit trail
         // (DREAMS.md + promotions.jsonl) into newest-first runs for the dashboard's
         // "Nightly dreaming" tab. Auth: dashboard session cookie OR API key. Payload is
@@ -1175,7 +1249,7 @@ class GatewayRouter {
                 const runs = [];
                 const agents = [];
                 for (const id of this.agents.keys()) {
-                    const dir = path.join(root, id, 'workspace', audit_1.DREAMING_DIR);
+                    const dir = path.join(this.agents.get(id)?.workspacePath ?? path.join(root, id, 'workspace'), audit_1.DREAMING_DIR);
                     let dreams;
                     try {
                         dreams = fs.readFileSync(path.join(dir, 'DREAMS.md'), 'utf8');
@@ -1231,6 +1305,7 @@ class GatewayRouter {
         this.app.post('/knowledge/dreams/apply', (req, res) => {
             if (!this.requireDashOrApiKey(req, res))
                 return;
+            memorySnapshot = undefined;
             try {
                 const body = (req.body ?? {});
                 const agentId = typeof body.agentId === 'string' ? body.agentId : '';
@@ -1254,7 +1329,7 @@ class GatewayRouter {
                     }
                     indexes = body.indexes;
                 }
-                const workspaceDir = path.join(this.agentsRoot(), agentId, 'workspace');
+                const workspaceDir = this.agents.get(agentId)?.workspacePath ?? path.join(this.agentsRoot(), agentId, 'workspace');
                 const budget = (0, workspace_loader_1.resolveMemoryBudget)({
                     ...this.gatewayConfig?.gateway?.memory,
                     ...this.configs.get(agentId)?.memory,
@@ -1337,7 +1412,7 @@ class GatewayRouter {
                 const source = runner.getDashboardSource?.();
                 const legacySessions = runner.getSessionsSummary();
                 const liveSessionIds = new Set(runner.liveSessionIds?.() ?? []);
-                const orchestration = source ? (source.enabled ? await this.dashboardReader.read('summary', source.filename, { ...source, offset, since: (0, dashboard_range_1.dashboardSince)(scope), legacyIds: legacySessions.map(s => s.sessionId) }) : undefined) : runner.getOrchestrationSummary?.();
+                const orchestration = source ? (source.enabled ? await this.dashboardReader.read('summary', source.filename, { ...source, timezone: this.gatewayConfig?.gateway?.timezone, offset, since: (0, dashboard_range_1.dashboardSince)(scope, Date.now(), this.gatewayConfig?.gateway?.timezone), legacyIds: legacySessions.map(s => s.sessionId) }) : undefined) : runner.getOrchestrationSummary?.();
                 const managedSessions = (orchestration?.sessions ?? []).map((s) => ({
                     ...s,
                     // Live liveness from the runner's in-memory map: the DB-derived status
@@ -1347,7 +1422,7 @@ class GatewayRouter {
                     ...(runner.isSessionCompacting?.(s.sessionId) ? { status: 'compacting', isRunning: true } : {}),
                 }));
                 const managedIds = new Set([...managedSessions.map((s) => s.sessionId), ...(orchestration?.managedLegacyIds ?? [])]);
-                const sessions = [...legacySessions.filter(s => !managedIds.has(s.sessionId) && (!(0, dashboard_range_1.dashboardSince)(scope) || Number(s.updatedAt || s.spawnedAt || 0) >= (0, dashboard_range_1.dashboardSince)(scope))), ...managedSessions].map((s) => ({
+                const sessions = [...legacySessions.filter(s => !managedIds.has(s.sessionId) && (!(0, dashboard_range_1.dashboardSince)(scope, Date.now(), this.gatewayConfig?.gateway?.timezone) || Number(s.updatedAt || s.spawnedAt || 0) >= (0, dashboard_range_1.dashboardSince)(scope, Date.now(), this.gatewayConfig?.gateway?.timezone))), ...managedSessions].map((s) => ({
                     ...s,
                     hasPtyStream: pty_stream_registry_1.ptyStreamRegistry.hasSockets(s.sessionId),
                 }));
@@ -1383,6 +1458,34 @@ class GatewayRouter {
                 watchers: (0, factory_1.getWatcherHealth)(),
             };
         };
+        this.app.get('/dashboard/charts', async (req, res) => {
+            if (!this.requireDashOrApiKey(req, res))
+                return;
+            res.setHeader('Cache-Control', 'no-store');
+            const scope = req.query.scope ?? '24h';
+            if (typeof scope !== 'string' || !['24h', '7d', '30d', '90d'].includes(scope)) {
+                res.status(400).json({ error: 'Invalid chart range' });
+                return;
+            }
+            const timezone = this.gatewayConfig?.gateway?.timezone || 'UTC';
+            // Stable snapshot timestamp coalesces all four cards and concurrent browsers.
+            const now = Math.floor(Date.now() / 10000) * 10000;
+            try {
+                const agents = [];
+                for (const [id, runner] of this.agents) {
+                    const source = runner.getDashboardSource?.();
+                    if (!source?.enabled)
+                        continue;
+                    const usage = await this.dashboardReader.read('charts', source.filename, { scope, timezone, now });
+                    if (usage)
+                        agents.push({ id, ...usage });
+                }
+                res.json({ scope, timezone, asOf: now, since: (0, dashboard_range_1.dashboardSince)(scope, now, timezone), agents });
+            }
+            catch {
+                res.status(503).json({ error: 'Chart data temporarily unavailable' });
+            }
+        });
         this.app.get('/status', async (req, res) => {
             if (!this.requireDashOrApiKey(req, res))
                 return;
@@ -1510,10 +1613,10 @@ class GatewayRouter {
                     if (v.expiresAt < now)
                         this.ptyStreamTickets.delete(k);
                 }
-                for (const [k, exp] of this.dashboardTokens) {
-                    if (exp < now)
-                        this.dashboardTokens.delete(k);
+                try {
+                    this.dashboardSessions.prune();
                 }
+                catch { /* Login reports unavailable storage; auth fails closed. */ }
                 for (const [ip, rec] of this.loginAttempts) {
                     if (rec.resetAt < now)
                         this.loginAttempts.delete(ip);
@@ -1655,6 +1758,7 @@ class GatewayRouter {
         await this.voiceApi?.close();
         if (this.ticketPruner)
             clearInterval(this.ticketPruner);
+        this.dashboardSessions.close();
         // Terminate live WebSocket clients first. The dashboard PTY viewer holds these
         // open indefinitely; without an explicit terminate, server.close() below would
         // wait forever for them to drain (the "Ctrl+C twice" hang).
@@ -1712,7 +1816,14 @@ class GatewayRouter {
         if (!this.gatewayConfig?.gateway?.api?.keys)
             return;
         const keys = this.gatewayConfig.gateway.api.keys;
-        keys.splice(0, keys.length, ...newKeys);
+        const next = structuredClone(newKeys);
+        if (JSON.stringify(keys) === JSON.stringify(next))
+            return;
+        keys.splice(0, keys.length, ...next);
+        this.ptyStreamTickets.clear();
+        for (const client of this.wss?.clients ?? [])
+            client.close(1008, 'Authorization changed');
+        this.voiceApi?.invalidateAuthorization();
     }
     /**
      * Return per-agent stats.