@flame0510/project-aether 1.1.12 → 1.1.13

package/README.md

@@ -44,7 +44,10 @@ rev4a serve --port 8080
 ```
 
 > **Production install:** see `CONNECT.md` for systemd deployment on a VPS.
-> **Container deploy:** `docker run -d --name rev4a -v rev4a-data:/rev4a/data -v /var/run/docker.sock:/var/run/docker.sock -p 3740:3740 ghcr.io/flame0510/rev4a:latest`
+>
+> **Container deploy:** on hold. The root `Dockerfile` (Docker-in-Docker packaging of
+> the dashboard itself) is an experimental path, not currently built or published —
+> see the file for details. Use the git-clone install above.
 
 ---
 

package/app/agents/PageClient.tsx

@@ -216,12 +216,15 @@ export default function AgentsPageClient() {
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState('');
   const [filter, setFilter] = useState<FilterState>('all');
-  const [selected, setSelected] = useState<Agent | null>(null);
+  const [selectedId, setSelectedId] = useState<string | null>(null);
   const [isMobile, setIsMobile] = useState(false);
   const [showList, setShowList] = useState(true);
   const [chSummary, setChSummary] = useState<Record<string, { telegram: boolean }>>({});
   const [imageReady, setImageReady] = useState(true);
-  const [providersConfigured, setProvidersConfigured] = useState(false);
+  // null = not checked yet. Keeping "unknown" distinct from "none configured" is
+  // the whole point: `false` as the initial value makes an unanswered check look
+  // exactly like a negative answer, so the warning banner renders on no evidence.
+  const [providersConfigured, setProvidersConfigured] = useState<boolean | null>(null);
   const [gatewayToken, setGatewayToken] = useState('');
   const [tokenLoading, setTokenLoading] = useState(true);
   const [tokenSaving, setTokenSaving] = useState(false);
@@ -274,7 +277,8 @@ export default function AgentsPageClient() {
 
   // Check if any provider is configured in the Gateway
   useEffect(() => {
-    fetch('/api/gateway/provider')
+    // summary=1: skips the live-pricing round trip we don't need here.
+    fetch('/api/gateway/provider?summary=1')
       .then((r) => r.json())
       .then((d: { providers?: Array<{ configured: boolean }> }) =>
         setProvidersConfigured((d.providers || []).some((p) => p.configured))
@@ -358,8 +362,36 @@ export default function AgentsPageClient() {
     return list;
   }, [agents, filter]);
 
+  // Derive the selected agent from the live list rather than holding a snapshot.
+  // A snapshot goes stale on every 15s poll (status, ports, imageOutdated) and
+  // survives deletion; deriving means a rename shows up on the next load() and a
+  // deleted agent can't leave a detail panel pointing at something that's gone.
+  const selected = useMemo(
+    () => (selectedId ? agents.find((a) => a.agentId === selectedId) ?? null : null),
+    [agents, selectedId],
+  );
+
+  // The selection can vanish under us — deleted here, or from another tab/CLI
+  // and picked up by the poll. Drop it so mobile falls back to the list instead
+  // of rendering a dead detail view.
+  useEffect(() => {
+    if (selectedId && !agents.some((a) => a.agentId === selectedId)) {
+      setSelectedId(null);
+      setShowList(true);
+    }
+  }, [agents, selectedId]);
+
+  /** An agent was deleted: drop it optimistically, then reconcile with the server. */
+  const handleAgentDeleted = useCallback((agentId: string) => {
+    // The DELETE already succeeded server-side, so removing it here is safe and
+    // spares the user the round trip — the API tears down container, volume and
+    // backups before it answers, which takes seconds.
+    setAgents((prev) => prev.filter((a) => a.agentId !== agentId));
+    void load();
+  }, [load]);
+
   function selectAgent(agent: Agent) {
-    setSelected(agent);
+    setSelectedId(agent.agentId);
     if (isMobile) setShowList(false);
   }
 
@@ -396,7 +428,11 @@ export default function AgentsPageClient() {
     </div>
   );
 
-  if (loading) {
+  // Hold the skeleton until the provider check has answered too. Both effects
+  // fire on mount, so this costs nothing when the check is warm (~3ms) and only
+  // shows up on a cold one (~230ms) — where it's exactly what we want, since
+  // that's the window the banner used to flash in.
+  if (loading || providersConfigured === null) {
     return (
       <div style={{ padding: 14, display: 'grid', gap: 14 }}>
         {Array.from({ length: 3 }).map((_, i) => (
@@ -433,10 +469,10 @@ export default function AgentsPageClient() {
             <span style={{ fontSize: 12, color: 'var(--violet)' }}>{selected.name}</span>
           </div>
           <ImageDownloadBanner onImageReady={handleImageReady} />
-        {!providersConfigured && <NoProviderBanner />}
+        {providersConfigured === false && <NoProviderBanner />}
           {/* Scrollable content */}
           <div style={{ flex: 1, overflowY: 'auto', WebkitOverflowScrolling: 'touch' }}>
-            <DetailPanel agent={selected} />
+            <DetailPanel key={selected.agentId} agent={selected} onDeleted={handleAgentDeleted} onChanged={load} />
           </div>
         </div>
       );
@@ -460,7 +496,7 @@ export default function AgentsPageClient() {
           ))} 
         </div>
         <ImageDownloadBanner onImageReady={handleImageReady} />
-        {!providersConfigured && <NoProviderBanner />}
+        {providersConfigured === false && <NoProviderBanner />}
         {tokenSection}
         <div style={{ flex: 1, overflowY: 'auto', WebkitOverflowScrolling: 'touch' }}>
           {filtered.length === 0 && <div style={{ padding: 14, color: '#888', fontSize: 12 }}>No agents found</div>}
@@ -499,13 +535,15 @@ export default function AgentsPageClient() {
         ))}
       </div>
       <ImageDownloadBanner onImageReady={handleImageReady} />
-      {!providersConfigured && <NoProviderBanner />}
+      {providersConfigured === false && <NoProviderBanner />}
       {tokenSection}
       <div style={{ flex: 1, display: 'flex', minHeight: 0 }}>
         <div style={{ width: '38%', minWidth: 300, borderRight: '1px solid var(--border)', overflow: 'auto' }}>
           {filtered.length === 0 && <div style={{ padding: 14, color: '#888', fontSize: 12 }}>No agents found</div>}
           {filtered.map((agent) => {
-            const isSelected = selected?.id === agent.id;
+            // Match on agentId, not the container id: recreate gives the agent a
+            // new container (new id) and would otherwise silently deselect it.
+            const isSelected = selectedId === agent.agentId;
 
             return (
               <AgentListItem
@@ -514,7 +552,7 @@ export default function AgentsPageClient() {
                 loading={lifecycleLoading === agent.agentId}
                 channelSummary={chSummary}
                 selected={isSelected}
-                onClick={() => setSelected(agent)}
+                onClick={() => setSelectedId(agent.agentId)}
                 onLifecycle={() => handleLifecycle(agent)}
               />
             );
@@ -524,7 +562,10 @@ export default function AgentsPageClient() {
           {!selected ? (
             <div style={{ color: '#666', fontSize: 12, padding: 20 }}>Select an agent for details</div>
           ) : (
-            <DetailPanel agent={selected} />
+            // key: without it React reuses one DetailPanel instance across
+            // selections, so in-flight state (deleting, recreating, restarting,
+            // toasts, open confirms) leaks onto the next agent you click.
+            <DetailPanel key={selected.agentId} agent={selected} onDeleted={handleAgentDeleted} onChanged={load} />
           )}
         </div>
       </div>
@@ -533,7 +574,12 @@ export default function AgentsPageClient() {
 }
 
 // ─── Edit Agent modal ───
-function EditAgentModal({ agent, onClose }: { agent: Agent; onClose: () => void }) {
+function EditAgentModal({ agent, onClose, onSaved }: {
+  agent: Agent;
+  onClose: () => void;
+  /** Rename succeeded — the parent refetches so the new name propagates. */
+  onSaved: () => void;
+}) {
   const [displayName, setDisplayName] = useState(agent.displayName || agent.name);
   const [saving, setSaving] = useState(false);
   const [error, setError] = useState('');
@@ -558,8 +604,9 @@ function EditAgentModal({ agent, onClose }: { agent: Agent; onClose: () => void
       });
       const data = await res.json();
       if (!res.ok) throw new Error(data.error || 'Failed to update');
-      // Reload to pick up the new display name
-      window.location.reload();
+      // Refetch the list so the new display name propagates — no full reload.
+      onSaved();
+      onClose();
     } catch (e: unknown) {
       setError((e as Error).message);
       setSaving(false);
@@ -682,7 +729,13 @@ function ConfigModal({ agent, onClose }: { agent: Agent; onClose: () => void })
 }
 
 // ─── Detail panel (shared between mobile & desktop) ───
-function DetailPanel({ agent }: { agent: Agent }) {
+function DetailPanel({ agent, onDeleted, onChanged }: {
+  agent: Agent;
+  /** The agent is gone — the parent drops it from the list. */
+  onDeleted: (agentId: string) => void;
+  /** The agent changed in place (renamed, recreated) — refetch the list. */
+  onChanged: () => void;
+}) {
   const [deleting, setDeleting] = useState(false);
   const [deleteError, setDeleteError] = useState('');
   const [showConfig, setShowConfig] = useState(false);
@@ -693,14 +746,17 @@ function DetailPanel({ agent }: { agent: Agent }) {
     setDeleting(true);
     setDeleteError('');
     try {
-      const res = await fetch(`/api/agents/${agent.name}`, { method: 'DELETE' });
+      const res = await fetch(`/api/agents/${encodeURIComponent(agent.agentId)}`, { method: 'DELETE' });
       const data = await res.json();
       if (!res.ok || !data.success) {
         setDeleteError(data.error || 'Delete failed');
         setDeleting(false);
         return;
       }
-      window.location.reload();
+      setShowDeleteConfirm(false);
+      // No setDeleting(false): the parent drops the agent and this panel
+      // unmounts. Clearing state on an unmounted component would warn.
+      onDeleted(agent.agentId);
     } catch (e: unknown) {
       setDeleteError((e as Error).message || 'Network error');
       setDeleting(false);
@@ -796,7 +852,7 @@ function DetailPanel({ agent }: { agent: Agent }) {
       {showConfig && <ConfigModal agent={agent} onClose={() => setShowConfig(false)} />}
 
       {/* Edit agent modal */}
-      {showEdit && <EditAgentModal agent={agent} onClose={() => setShowEdit(false)} />}
+      {showEdit && <EditAgentModal agent={agent} onClose={() => setShowEdit(false)} onSaved={onChanged} />}
 
       {/* Delete confirmation */}
       <ConfirmModal
@@ -819,7 +875,7 @@ function DetailPanel({ agent }: { agent: Agent }) {
           </div>
         </div>
       )}
-      <RecreateSection agentName={agent.name} />
+      <RecreateSection agentName={agent.name} onRecreated={onChanged} />
 
       {/* Delete */}
       <div style={{ border: '1px solid rgba(239,68,68,0.3)', borderRadius: 0, background: 'rgba(239,68,68,0.04)', overflow: 'hidden' }}>
@@ -1137,7 +1193,11 @@ function RestartSection({ agentName }: { agentName: string }) {
 
 /* ─── Recreate section - rebuild container from same image while keeping volume ─── */
 
-function RecreateSection({ agentName }: { agentName: string }) {
+function RecreateSection({ agentName, onRecreated }: {
+  agentName: string;
+  /** The container was rebuilt — the parent refetches (new id, fresh image). */
+  onRecreated: () => void;
+}) {
   const [recreating, setRecreating] = useState(false);
   const [error, setError] = useState('');
   const [toast, setToast] = useState<string | null>(null);
@@ -1157,7 +1217,9 @@ function RecreateSection({ agentName }: { agentName: string }) {
       const data = await res.json();
       if (data.success) {
         showToast(data.backup ? `Recreated (backup: ${data.backup})` : 'Container recreated successfully');
-        setTimeout(() => window.location.reload(), 2000);
+        // Refetch instead of reloading: the toast stays readable and the panel
+        // keeps its scroll position while the new container id comes in.
+        onRecreated();
       } else {
         setError(data.error || 'Recreate failed');
       }

package/app/api/agents/create/route.ts

@@ -44,11 +44,23 @@ const DEFAULT_BLOCK_SIZE = 10;
 
 function getUsedHostPorts(): Set<number> {
   try {
+    // Parse host ports in JS rather than piping through grep. The previous
+    // form used `grep -oP '\d+(?=->)'` inside a template literal, where \d
+    // loses its backslash — the shell received `d+(?=->)`, which never
+    // matches Docker's `0.0.0.0:3700->3000/tcp`, so this always returned an
+    // empty set and every agent was offered port 3700. `grep -P` is also
+    // GNU-only and absent on macOS. This mirrors the client-side parser in
+    // app/agents/create/page.tsx.
     const raw = execSync(
-      `docker ps --format '{{.Ports}}' | grep -oP '\d+(?=->)' | sort -n`,
+      `docker ps --format '{{.Ports}}'`,
       { encoding: 'utf-8', timeout: 3000 },
-    ).trim();
-    return new Set(raw ? raw.split('\n').map(Number) : []);
+    );
+    const used = new Set<number>();
+    for (const [, port] of raw.matchAll(/(\d+)->/g)) {
+      const n = Number(port);
+      if (Number.isInteger(n)) used.add(n);
+    }
+    return used;
   } catch {
     return new Set();
   }

package/app/api/agents/download-image/route.ts

@@ -16,6 +16,8 @@ import { requireAuthJWT } from '@/lib/rev4a-auth';
 export const dynamic = 'force-dynamic';
 
 export async function POST(request: NextRequest): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   if (getIsDownloading()) {
     return NextResponse.json(
       { error: 'A download is already in progress' },

package/app/api/agents/image-status/route.ts

@@ -71,6 +71,8 @@ function getRemoteDigest(): string | null {
 }
 
 export async function GET(request: NextRequest): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   const exists = localImageExists();
   const localId = getLocalImageId();
   const downloading = getIsDownloading();

package/app/api/agents/route.ts

@@ -1,48 +1,13 @@
 import { NextResponse, type NextRequest } from 'next/server';
-import * as http from 'http';
 import * as fs from 'fs';
 import * as path from 'path';
 import { detectPublicHost } from '@/lib/docker-utils';
 import { AGENTS_TOKEN_FILE } from '@/lib/rev4a-paths';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
-
-const DOCKER_SOCKET = '/var/run/docker.sock';
-
-function dockerFetch(method: string, path: string): Promise<any> {
-  return new Promise((resolve, reject) => {
-    const options = {
-      socketPath: DOCKER_SOCKET,
-      path,
-      method,
-      headers: { 'Host': 'localhost' } as any,
-    };
-    const req = http.request(options, (res: any) => {
-      let data = '';
-      res.on('data', (chunk: string) => (data += chunk));
-      res.on('end', () => {
-        try {
-          resolve(JSON.parse(data));
-        } catch {
-          reject(new Error('Invalid JSON from Docker API'));
-        }
-      });
-    });
-    req.on('error', reject);
-    req.end();
-  });
-}
+import { dockerAvailable, dockerFetch } from '@/lib/docker-socket';
 
 export const dynamic = 'force-dynamic';
 
-function dockerAvailable(): boolean {
-  try {
-    fs.accessSync(DOCKER_SOCKET, fs.constants.R_OK | fs.constants.W_OK);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 export async function GET(request: NextRequest): Promise<NextResponse> {
   const denied = await requireAuthJWT(request); if (denied) return denied as any;
   // If Docker is not available (e.g. testing environment), return empty list

package/app/api/agents/token/route.ts

@@ -29,11 +29,14 @@ function shellQuote(value: string): string {
 }
 
 export async function GET(request: NextRequest): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   return NextResponse.json(readTokenFile());
 }
 
 export async function PUT(request: NextRequest): Promise<NextResponse> {
-  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   try {
     const body = await request.json();
     const token = typeof body?.token === 'string' ? body.token : null;

package/app/api/auth/check/route.ts

@@ -1,33 +1,12 @@
 import { NextResponse, type NextRequest } from 'next/server';
 import { jwtVerify } from 'jose';
-import * as fs from 'fs';
-import { ENV_FILE } from '@/lib/rev4a-paths';
-
-function getJwtSecret(): Uint8Array {
-  const fromEnv = process.env.REV4A_JWT_SECRET;
-  if (typeof fromEnv === 'string' && fromEnv.length > 0) {
-    return new TextEncoder().encode(fromEnv);
-  }
-  // Fallback: read from persistent .env
-  for (const file of [ENV_FILE]) {
-    try {
-      if (fs.existsSync(file)) {
-        const content = fs.readFileSync(file, 'utf-8');
-        const match = content.match(/^REV4A_JWT_SECRET=(.*)$/m);
-        if (match && match[1].trim()) {
-          return new TextEncoder().encode(match[1].trim());
-        }
-      }
-    } catch { /* ignore */ }
-  }
-  return new TextEncoder().encode('');
-}
+import { getJwtSecret } from '@/lib/rev4a-auth';
 
 export async function GET(request: NextRequest): Promise<NextResponse> {
   const cookieToken = request.cookies.get('rev4a_token')?.value;
   if (cookieToken) {
     try {
-      const secret = getJwtSecret();
+      const secret = new TextEncoder().encode(getJwtSecret());
       await jwtVerify(cookieToken, secret);
       return NextResponse.json({ authenticated: true });
     } catch {

package/app/api/auth/login/route.ts

@@ -1,43 +1,11 @@
 import { NextResponse, type NextRequest } from 'next/server';
 import { SignJWT } from 'jose';
-import * as fs from 'fs';
-import { ENV_FILE } from '@/lib/rev4a-paths';
-
-// ---------------------------------------------------------------------------
-// Resolve credentials at runtime from the persistent .env file.
-// ---------------------------------------------------------------------------
-function getEnvPassword(): string {
-  const fromEnv = process.env.REV4A_PASSWORD;
-  if (typeof fromEnv === 'string' && fromEnv.length > 0) return fromEnv;
-
-  try {
-    if (fs.existsSync(ENV_FILE)) {
-      const content = fs.readFileSync(ENV_FILE, 'utf-8');
-      const match = content.match(/^REV4A_PASSWORD=(.*)$/m);
-      if (match && match[1].trim()) return match[1].trim();
-    }
-  } catch { /* ignore */ }
-  return '';
-}
-
-function getEnvJwtSecret(): string {
-  const fromEnv = process.env.REV4A_JWT_SECRET;
-  if (typeof fromEnv === 'string' && fromEnv.length > 0) return fromEnv;
-
-  try {
-    if (fs.existsSync(ENV_FILE)) {
-      const content = fs.readFileSync(ENV_FILE, 'utf-8');
-      const match = content.match(/^REV4A_JWT_SECRET=(.*)$/m);
-      if (match && match[1].trim()) return match[1].trim();
-    }
-  } catch { /* ignore */ }
-  return '';
-}
+import { getPassword, getJwtSecret } from '@/lib/rev4a-auth';
 
 export async function POST(request: NextRequest): Promise<NextResponse> {
   try {
-    const password = getEnvPassword();
-    const jwtSecret = getEnvJwtSecret();
+    const password = getPassword();
+    const jwtSecret = getJwtSecret();
 
     if (!password) {
       console.error('[auth] No password configured — rejecting login');

package/app/api/auth/logout/route.ts

@@ -2,6 +2,6 @@ import { NextResponse } from 'next/server';
 
 export async function POST(): Promise<NextResponse> {
   const response = NextResponse.json({ ok: true });
-  response.cookies.delete('rev4a_token');
+  response.cookies.delete({ name: 'rev4a_token', path: '/' });
   return response;
 }

package/app/api/auth/status/route.ts

@@ -1,6 +1,5 @@
 import { NextResponse } from 'next/server';
-import * as fs from 'fs';
-import { ENV_FILE } from '@/lib/rev4a-paths';
+import { isConfigured } from '@/lib/rev4a-auth';
 
 /**
  * GET /api/auth/status
@@ -11,23 +10,5 @@ import { ENV_FILE } from '@/lib/rev4a-paths';
  * the setup wizard or the login form.
  */
 export function GET(): NextResponse {
-  let password = process.env.REV4A_PASSWORD;
-
-  // Fallback: read .env from config dir if env var is empty (Next.js inlines at build)
-  if (typeof password !== 'string' || password.length === 0) {
-    try {
-      if (fs.existsSync(ENV_FILE)) {
-        const content = fs.readFileSync(ENV_FILE, 'utf-8');
-        const match = content.match(/^REV4A_PASSWORD=(.*)$/m);
-        if (match && match[1].trim()) {
-          password = match[1].trim();
-        }
-      }
-    } catch {
-      // ignore
-    }
-  }
-
-  const configured = typeof password === 'string' && password.length > 0;
-  return NextResponse.json({ configured });
+  return NextResponse.json({ configured: isConfigured() });
 }

package/app/api/config/env/route.ts

@@ -5,7 +5,8 @@
  * PUT  /api/config/env  — upsert one or more env vars
  *
  * Only keys prefixed with REV4A_ or PROVIDER_ are exposed.
- * Auth: browser cookie (authenticated session via middleware).
+ * Auth: requireAuthJWT (browser cookie or bearer token) — API routes are
+ * never covered by proxy.ts, it explicitly exempts /api/*.
  */
 import { NextRequest, NextResponse } from 'next/server';
 import * as fs from 'fs';
@@ -54,6 +55,8 @@ function serializeEnvFile(vars: Record<string, string>): string {
 }
 
 export async function GET(request: NextRequest) {
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   try {
     let content = '';
     try {
@@ -78,7 +81,8 @@ export async function GET(request: NextRequest) {
 }
 
 export async function PUT(request: NextRequest) {
-  const denied = await requireAuthJWT(request); if (denied) return denied as any;
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   try {
     const body: { env?: Record<string, string> } = await request.json();
     if (!body.env || typeof body.env !== 'object') {
@@ -115,7 +119,7 @@ export async function PUT(request: NextRequest) {
 
     // Reload systemd so EnvironmentFile= picks up .env changes on next restart.
     // No need to write individual Environment= lines into unit files —
-    // rev4a-next.service already reads .env via EnvironmentFile=.
+    // rev4a.service already reads .env via EnvironmentFile=.
     try {
       execSync('sudo systemctl daemon-reload', { timeout: 5000 });
     } catch (syncErr) {

package/app/api/config/restart/route.ts

@@ -13,6 +13,8 @@ export const dynamic = 'force-dynamic';
 export const runtime = 'nodejs';
 
 export async function POST(request: NextRequest) {
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   try {
     execSync('sudo systemctl daemon-reload && sudo systemctl restart rev4a.service', {
       timeout: 15000,

package/app/api/containers/route.ts

@@ -1,44 +1,13 @@
 import { type NextRequest } from "next/server";
 import { NextResponse } from 'next/server';
-import * as http from 'http';
-import * as fs from 'fs';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
-
-const DOCKER_SOCKET = '/var/run/docker.sock';
-
-function dockerAvailable(): boolean {
-  try {
-    fs.accessSync(DOCKER_SOCKET, fs.constants.R_OK | fs.constants.W_OK);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function dockerFetch(method: string, path: string): Promise<any> {
-  return new Promise((resolve, reject) => {
-    const options = {
-      socketPath: DOCKER_SOCKET,
-      path,
-      method,
-      headers: { 'Host': 'localhost' } as any,
-    };
-    const req = http.request(options, (res: any) => {
-      let data = '';
-      res.on('data', (chunk: string) => data += chunk);
-      res.on('end', () => {
-        try { resolve(JSON.parse(data)); }
-        catch { reject(new Error('Invalid JSON from Docker')); }
-      });
-    });
-    req.on('error', reject);
-    req.end();
-  });
-}
+import { dockerAvailable, dockerFetch } from '@/lib/docker-socket';
 
 export const dynamic = 'force-dynamic';
 
 export async function GET(request: NextRequest) {
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   if (!dockerAvailable()) {
     return NextResponse.json([]);
   }

package/app/api/crons/route.ts

@@ -7,6 +7,8 @@ import { requireAuthJWT } from '@/lib/rev4a-auth';
 export const dynamic = 'force-dynamic';
 
 export async function GET(request: NextRequest): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   const result = await listOpenClawCronJobs();
   return NextResponse.json(result.jobs);
 }

package/app/api/debug/route.ts

@@ -3,6 +3,8 @@ import { NextResponse } from 'next/server';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
 
 export async function GET(request: NextRequest) {
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   return NextResponse.json({
     hasPassword: !!process.env.REV4A_PASSWORD,
     hasJwtSecret: !!process.env.REV4A_JWT_SECRET,

package/app/api/envcheck/route.ts

@@ -2,9 +2,11 @@ import { type NextRequest } from "next/server";
 import { NextResponse } from 'next/server';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
 
-const SENSITIVE = ['REV4A_PASSWORD', 'REV4A_TOKEN', 'REV4A_JWT_SECRET'];
+const SENSITIVE = ['REV4A_PASSWORD', 'REV4A_TOKEN', 'REV4A_JWT_SECRET', 'PROVIDER_DEEPSEEK_API_KEY'];
 
 export async function GET(request: NextRequest) {
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   const safe: Record<string, string> = {};
   for (const key of ['REV4A_PASSWORD', 'REV4A_TOKEN', 'REV4A_JWT_SECRET', 'REV4A_ALERTS_ENABLED', 'REV4A_DB', 'REV4A_WORKSPACE_ROOT', 'PROVIDER_DEEPSEEK_API_KEY', 'NODE_ENV']) {
     const val = process.env[key];