@flame0510/project-aether 1.1.12 → 1.1.14

package/README.md

@@ -44,7 +44,10 @@ rev4a serve --port 8080
 ```
 
 > **Production install:** see `CONNECT.md` for systemd deployment on a VPS.
-> **Container deploy:** `docker run -d --name rev4a -v rev4a-data:/rev4a/data -v /var/run/docker.sock:/var/run/docker.sock -p 3740:3740 ghcr.io/flame0510/rev4a:latest`
+>
+> **Container deploy:** on hold. The root `Dockerfile` (Docker-in-Docker packaging of
+> the dashboard itself) is an experimental path, not currently built or published —
+> see the file for details. Use the git-clone install above.
 
 ---
 

package/app/agents/PageClient.tsx

@@ -42,11 +42,30 @@ interface Agent {
   ip: string | null;
   created: string | null;
   env: string[];
-  traefikUrl: string | null;
+  controlPort: string | null;
   authToken: string | null;
   imageOutdated?: boolean;
 }
 
+/**
+ * URL of the agent's OpenClaw Control UI.
+ *
+ * Composed here rather than on the server on purpose. The hostname the dashboard
+ * is currently being reached on is, by definition, one that resolves and routes
+ * for this user — `localhost` on a dev machine, a LAN address from a phone, the
+ * VPS IP, or a domain. The server can only guess, and it guessed badly: it shelled
+ * out to `curl icanhazip.com` on every call and, on macOS, ended up returning the
+ * machine's `.local` mDNS name.
+ *
+ * Returns null when the agent has no published port (nothing to link to) or when
+ * called during a server render, where `window` doesn't exist.
+ */
+function agentControlUrl(agent: Agent): string | null {
+  if (!agent.controlPort || typeof window === 'undefined') return null;
+  const base = `http://${window.location.hostname}:${agent.controlPort}`;
+  return agent.authToken ? `${base}#token=${encodeURIComponent(agent.authToken)}` : base;
+}
+
 type FilterState = 'all' | 'running' | 'exited';
 
 const STATUS_BULLET: Record<string, string> = {
@@ -180,11 +199,17 @@ function AgentListItem({
         )}
         <div style={{ marginLeft: 'auto', flexShrink: 0, display: 'flex', alignItems: 'center', gap: 8 }}>
           {loading && <span style={{ fontSize: 10, color: '#888' }}>...</span>}
-          {agent.state === 'running' && agent.traefikUrl && (
+          {agent.state === 'running' && agent.controlPort && (
             <Button
               variant="primary"
               size="sm"
-              onClick={(e) => { e.stopPropagation(); window.open(agent.traefikUrl!, '_blank'); }}
+              // Gate on the port, resolve the URL on click: the condition stays
+              // safe to evaluate during a server render, the URL never is.
+              onClick={(e) => {
+                e.stopPropagation();
+                const url = agentControlUrl(agent);
+                if (url) window.open(url, '_blank');
+              }}
               title="Open agent Control UI"
             >
               Open ↗
@@ -216,18 +241,23 @@ export default function AgentsPageClient() {
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState('');
   const [filter, setFilter] = useState<FilterState>('all');
-  const [selected, setSelected] = useState<Agent | null>(null);
+  const [selectedId, setSelectedId] = useState<string | null>(null);
   const [isMobile, setIsMobile] = useState(false);
   const [showList, setShowList] = useState(true);
   const [chSummary, setChSummary] = useState<Record<string, { telegram: boolean }>>({});
   const [imageReady, setImageReady] = useState(true);
-  const [providersConfigured, setProvidersConfigured] = useState(false);
+  // null = not checked yet. Keeping "unknown" distinct from "none configured" is
+  // the whole point: `false` as the initial value makes an unanswered check look
+  // exactly like a negative answer, so the warning banner renders on no evidence.
+  const [providersConfigured, setProvidersConfigured] = useState<boolean | null>(null);
   const [gatewayToken, setGatewayToken] = useState('');
   const [tokenLoading, setTokenLoading] = useState(true);
   const [tokenSaving, setTokenSaving] = useState(false);
   const [tokenStatus, setTokenStatus] = useState<{ type: 'success' | 'error'; message: string } | null>(null);
   const [lifecycleLoading, setLifecycleLoading] = useState<string | null>(null);
   const skipNextPoll = useRef(false);
+  /** Guards the un-awaited channel-summary fetch against out-of-order responses. */
+  const chSummarySeq = useRef(0);
   useEffect(() => {
     const check = () => setIsMobile(window.innerWidth < 768);
     check();
@@ -243,11 +273,23 @@ export default function AgentsPageClient() {
       if (!Array.isArray(data)) throw new Error('Invalid response');
       setAgents(data);
       setError('');
-      // Also load channel summary
-      try {
-        const chRes = await fetch('/api/agents/channels-summary');
-        if (chRes.ok) setChSummary(await chRes.json());
-      } catch { /* */ }
+
+      // Channel summary is deliberately not awaited: it only decorates rows with
+      // a TG badge, and awaiting it here held the whole page behind a second
+      // round trip — the agent list was ready in ~0.25s but stayed hidden for
+      // ~1.15s. It now lands on its own and the badges appear when it does.
+      //
+      // Sequence-guarded: load() also runs on a 15s poll, so several of these can
+      // be in flight at once. Without the check, a slow earlier response landing
+      // after a faster later one would overwrite fresh badges with stale ones.
+      const seq = ++chSummarySeq.current;
+      void (async () => {
+        try {
+          const chRes = await fetch('/api/agents/channels-summary');
+          if (!chRes.ok || seq !== chSummarySeq.current) return;
+          setChSummary(await chRes.json());
+        } catch { /* badges are optional */ }
+      })();
     } catch (e: any) {
       setError(e.message || 'Loading error');
     } finally {
@@ -274,7 +316,8 @@ export default function AgentsPageClient() {
 
   // Check if any provider is configured in the Gateway
   useEffect(() => {
-    fetch('/api/gateway/provider')
+    // summary=1: skips the live-pricing round trip we don't need here.
+    fetch('/api/gateway/provider?summary=1')
       .then((r) => r.json())
       .then((d: { providers?: Array<{ configured: boolean }> }) =>
         setProvidersConfigured((d.providers || []).some((p) => p.configured))
@@ -358,8 +401,36 @@ export default function AgentsPageClient() {
     return list;
   }, [agents, filter]);
 
+  // Derive the selected agent from the live list rather than holding a snapshot.
+  // A snapshot goes stale on every 15s poll (status, ports, imageOutdated) and
+  // survives deletion; deriving means a rename shows up on the next load() and a
+  // deleted agent can't leave a detail panel pointing at something that's gone.
+  const selected = useMemo(
+    () => (selectedId ? agents.find((a) => a.agentId === selectedId) ?? null : null),
+    [agents, selectedId],
+  );
+
+  // The selection can vanish under us — deleted here, or from another tab/CLI
+  // and picked up by the poll. Drop it so mobile falls back to the list instead
+  // of rendering a dead detail view.
+  useEffect(() => {
+    if (selectedId && !agents.some((a) => a.agentId === selectedId)) {
+      setSelectedId(null);
+      setShowList(true);
+    }
+  }, [agents, selectedId]);
+
+  /** An agent was deleted: drop it optimistically, then reconcile with the server. */
+  const handleAgentDeleted = useCallback((agentId: string) => {
+    // The DELETE already succeeded server-side, so removing it here is safe and
+    // spares the user the round trip — the API tears down container, volume and
+    // backups before it answers, which takes seconds.
+    setAgents((prev) => prev.filter((a) => a.agentId !== agentId));
+    void load();
+  }, [load]);
+
   function selectAgent(agent: Agent) {
-    setSelected(agent);
+    setSelectedId(agent.agentId);
     if (isMobile) setShowList(false);
   }
 
@@ -396,7 +467,11 @@ export default function AgentsPageClient() {
     </div>
   );
 
-  if (loading) {
+  // Hold the skeleton until the provider check has answered too. Both effects
+  // fire on mount, so this costs nothing when the check is warm (~3ms) and only
+  // shows up on a cold one (~230ms) — where it's exactly what we want, since
+  // that's the window the banner used to flash in.
+  if (loading || providersConfigured === null) {
     return (
       <div style={{ padding: 14, display: 'grid', gap: 14 }}>
         {Array.from({ length: 3 }).map((_, i) => (
@@ -433,10 +508,10 @@ export default function AgentsPageClient() {
             <span style={{ fontSize: 12, color: 'var(--violet)' }}>{selected.name}</span>
           </div>
           <ImageDownloadBanner onImageReady={handleImageReady} />
-        {!providersConfigured && <NoProviderBanner />}
+        {providersConfigured === false && <NoProviderBanner />}
           {/* Scrollable content */}
           <div style={{ flex: 1, overflowY: 'auto', WebkitOverflowScrolling: 'touch' }}>
-            <DetailPanel agent={selected} />
+            <DetailPanel key={selected.agentId} agent={selected} onDeleted={handleAgentDeleted} onChanged={load} />
           </div>
         </div>
       );
@@ -460,7 +535,7 @@ export default function AgentsPageClient() {
           ))} 
         </div>
         <ImageDownloadBanner onImageReady={handleImageReady} />
-        {!providersConfigured && <NoProviderBanner />}
+        {providersConfigured === false && <NoProviderBanner />}
         {tokenSection}
         <div style={{ flex: 1, overflowY: 'auto', WebkitOverflowScrolling: 'touch' }}>
           {filtered.length === 0 && <div style={{ padding: 14, color: '#888', fontSize: 12 }}>No agents found</div>}
@@ -499,13 +574,15 @@ export default function AgentsPageClient() {
         ))}
       </div>
       <ImageDownloadBanner onImageReady={handleImageReady} />
-      {!providersConfigured && <NoProviderBanner />}
+      {providersConfigured === false && <NoProviderBanner />}
       {tokenSection}
       <div style={{ flex: 1, display: 'flex', minHeight: 0 }}>
         <div style={{ width: '38%', minWidth: 300, borderRight: '1px solid var(--border)', overflow: 'auto' }}>
           {filtered.length === 0 && <div style={{ padding: 14, color: '#888', fontSize: 12 }}>No agents found</div>}
           {filtered.map((agent) => {
-            const isSelected = selected?.id === agent.id;
+            // Match on agentId, not the container id: recreate gives the agent a
+            // new container (new id) and would otherwise silently deselect it.
+            const isSelected = selectedId === agent.agentId;
 
             return (
               <AgentListItem
@@ -514,7 +591,7 @@ export default function AgentsPageClient() {
                 loading={lifecycleLoading === agent.agentId}
                 channelSummary={chSummary}
                 selected={isSelected}
-                onClick={() => setSelected(agent)}
+                onClick={() => setSelectedId(agent.agentId)}
                 onLifecycle={() => handleLifecycle(agent)}
               />
             );
@@ -524,7 +601,10 @@ export default function AgentsPageClient() {
           {!selected ? (
             <div style={{ color: '#666', fontSize: 12, padding: 20 }}>Select an agent for details</div>
           ) : (
-            <DetailPanel agent={selected} />
+            // key: without it React reuses one DetailPanel instance across
+            // selections, so in-flight state (deleting, recreating, restarting,
+            // toasts, open confirms) leaks onto the next agent you click.
+            <DetailPanel key={selected.agentId} agent={selected} onDeleted={handleAgentDeleted} onChanged={load} />
           )}
         </div>
       </div>
@@ -533,7 +613,12 @@ export default function AgentsPageClient() {
 }
 
 // ─── Edit Agent modal ───
-function EditAgentModal({ agent, onClose }: { agent: Agent; onClose: () => void }) {
+function EditAgentModal({ agent, onClose, onSaved }: {
+  agent: Agent;
+  onClose: () => void;
+  /** Rename succeeded — the parent refetches so the new name propagates. */
+  onSaved: () => void;
+}) {
   const [displayName, setDisplayName] = useState(agent.displayName || agent.name);
   const [saving, setSaving] = useState(false);
   const [error, setError] = useState('');
@@ -558,8 +643,9 @@ function EditAgentModal({ agent, onClose }: { agent: Agent; onClose: () => void
       });
       const data = await res.json();
       if (!res.ok) throw new Error(data.error || 'Failed to update');
-      // Reload to pick up the new display name
-      window.location.reload();
+      // Refetch the list so the new display name propagates — no full reload.
+      onSaved();
+      onClose();
     } catch (e: unknown) {
       setError((e as Error).message);
       setSaving(false);
@@ -682,25 +768,39 @@ function ConfigModal({ agent, onClose }: { agent: Agent; onClose: () => void })
 }
 
 // ─── Detail panel (shared between mobile & desktop) ───
-function DetailPanel({ agent }: { agent: Agent }) {
+function DetailPanel({ agent, onDeleted, onChanged }: {
+  agent: Agent;
+  /** The agent is gone — the parent drops it from the list. */
+  onDeleted: (agentId: string) => void;
+  /** The agent changed in place (renamed, recreated) — refetch the list. */
+  onChanged: () => void;
+}) {
   const [deleting, setDeleting] = useState(false);
   const [deleteError, setDeleteError] = useState('');
   const [showConfig, setShowConfig] = useState(false);
   const [showDeleteConfirm, setShowDeleteConfirm] = useState(false);
   const [showEdit, setShowEdit] = useState(false);
 
+  // Safe to resolve during render: this panel only mounts once the agent list has
+  // been fetched client-side, so it never runs in a server render. The helper
+  // guards for a missing `window` regardless.
+  const controlUrl = agentControlUrl(agent);
+
   const handleDelete = async () => {
     setDeleting(true);
     setDeleteError('');
     try {
-      const res = await fetch(`/api/agents/${agent.name}`, { method: 'DELETE' });
+      const res = await fetch(`/api/agents/${encodeURIComponent(agent.agentId)}`, { method: 'DELETE' });
       const data = await res.json();
       if (!res.ok || !data.success) {
         setDeleteError(data.error || 'Delete failed');
         setDeleting(false);
         return;
       }
-      window.location.reload();
+      setShowDeleteConfirm(false);
+      // No setDeleting(false): the parent drops the agent and this panel
+      // unmounts. Clearing state on an unmounted component would warn.
+      onDeleted(agent.agentId);
     } catch (e: unknown) {
       setDeleteError((e as Error).message || 'Network error');
       setDeleting(false);
@@ -778,15 +878,15 @@ function DetailPanel({ agent }: { agent: Agent }) {
       {/* Backup - persistent volume backup & restore */}
       <BackupSection agentName={agent.name} />
 
-      {/* Access - agent URL (token inline in link) */}
-      {agent.traefikUrl && (
+      {/* Access - agent Control UI URL (token inline in link) */}
+      {controlUrl && (
         <div style={{ border: '1px solid var(--border)', borderRadius: 0, background: 'var(--bg)', overflow: 'hidden' }}>
           <SectionHeader icon={<KeyIcon size={12} />} label="ACCESS" />
           <div style={{ padding: '7px 14px', fontSize: 12 }}>
             <div style={{ color: '#888', marginBottom: 2 }}>Control UI</div>
-            <a href={agent.traefikUrl} target="_blank" rel="noopener noreferrer"
+            <a href={controlUrl} target="_blank" rel="noopener noreferrer"
               style={{ color: '#60a5fa', textDecoration: 'underline', fontSize: 12, wordBreak: 'break-all' }}
-            >{agent.traefikUrl}</a>
+            >{controlUrl}</a>
 
           </div>
         </div>
@@ -796,7 +896,7 @@ function DetailPanel({ agent }: { agent: Agent }) {
       {showConfig && <ConfigModal agent={agent} onClose={() => setShowConfig(false)} />}
 
       {/* Edit agent modal */}
-      {showEdit && <EditAgentModal agent={agent} onClose={() => setShowEdit(false)} />}
+      {showEdit && <EditAgentModal agent={agent} onClose={() => setShowEdit(false)} onSaved={onChanged} />}
 
       {/* Delete confirmation */}
       <ConfirmModal
@@ -819,7 +919,7 @@ function DetailPanel({ agent }: { agent: Agent }) {
           </div>
         </div>
       )}
-      <RecreateSection agentName={agent.name} />
+      <RecreateSection agentName={agent.name} onRecreated={onChanged} />
 
       {/* Delete */}
       <div style={{ border: '1px solid rgba(239,68,68,0.3)', borderRadius: 0, background: 'rgba(239,68,68,0.04)', overflow: 'hidden' }}>
@@ -1137,7 +1237,11 @@ function RestartSection({ agentName }: { agentName: string }) {
 
 /* ─── Recreate section - rebuild container from same image while keeping volume ─── */
 
-function RecreateSection({ agentName }: { agentName: string }) {
+function RecreateSection({ agentName, onRecreated }: {
+  agentName: string;
+  /** The container was rebuilt — the parent refetches (new id, fresh image). */
+  onRecreated: () => void;
+}) {
   const [recreating, setRecreating] = useState(false);
   const [error, setError] = useState('');
   const [toast, setToast] = useState<string | null>(null);
@@ -1157,7 +1261,9 @@ function RecreateSection({ agentName }: { agentName: string }) {
       const data = await res.json();
       if (data.success) {
         showToast(data.backup ? `Recreated (backup: ${data.backup})` : 'Container recreated successfully');
-        setTimeout(() => window.location.reload(), 2000);
+        // Refetch instead of reloading: the toast stays readable and the panel
+        // keeps its scroll position while the new container id comes in.
+        onRecreated();
       } else {
         setError(data.error || 'Recreate failed');
       }

package/app/agents/create/PageClient.tsx

@@ -77,9 +77,16 @@ export default function CreatePageClient({ templates, models, usedNames, usedPor
   const [fallbacks] = useState<string[]>([]);
   const [submitting, setSubmitting] = useState(false);
   const [errorMsg, setErrorMsg] = useState('');
-  const [result, setResult] = useState<{ name: string; containerId: string; traefikUrl: string } | null>(null);
+  const [result, setResult] = useState<{ name: string; containerId: string; port: number; controlToken: string } | null>(null);
   const [toast, setToast] = useState<{ message: string; type: 'success' | 'error' } | null>(null);
 
+  // The agent's Control UI URL, composed here rather than server-side: whatever
+  // hostname reached this dashboard is one that resolves and routes for this
+  // user, which the server can only guess at. Null until the create succeeds.
+  const controlUrl = result && typeof window !== 'undefined'
+    ? `http://${window.location.hostname}:${result.port}#token=${encodeURIComponent(result.controlToken)}`
+    : null;
+
   const handleSelectTemplate = (id: string) => {
     setSelectedTemplate(id);
     setAgentName('');
@@ -389,10 +396,10 @@ export default function CreatePageClient({ templates, models, usedNames, usedPor
             <div style={{ fontSize: 13, color: '#888', marginBottom: 4 }}>
               Name: <span style={{ color: 'var(--text)' }}>{result.name}</span>
             </div>
-            {result.traefikUrl && (
+            {controlUrl && (
               <div style={{ fontSize: 13, color: '#888' }}>
-                Access: <a href={result.traefikUrl} target="_blank" rel="noopener noreferrer"
-                  style={{ color: '#60a5fa', textDecoration: 'underline' }}>{result.traefikUrl}</a>
+                Access: <a href={controlUrl} target="_blank" rel="noopener noreferrer"
+                  style={{ color: '#60a5fa', textDecoration: 'underline' }}>{controlUrl}</a>
               </div>
             )}
           </div>

package/app/api/agents/[id]/recreate/route.ts

@@ -181,9 +181,9 @@ export async function POST(request: Request,
         { timeout: 15000, stdio: 'pipe', input: providerJson },
       );
 
-      try {
-        execSync(`docker exec ${id} openclaw gateway restart`, { timeout: 15000 });
-      } catch { /* non-fatal */ }
+      // No gateway restart: `config patch` reports "Change will apply without
+      // restarting the gateway" for a models-only patch, and the Gateway watches
+      // openclaw.json with gateway.reload defaulting to hybrid.
     } catch {
       // config patch is best-effort on recreate
     }

package/app/api/agents/[id]/route.ts

@@ -265,7 +265,9 @@ export async function PATCH(
         `docker exec -i ${id} sh -c 'openclaw config patch --stdin'`,
         { timeout: 15000, stdio: 'pipe', input: providerJson },
       );
-      try { execSync(`docker exec ${id} openclaw gateway restart`, { timeout: 15000 }); } catch { /* non-fatal */ }
+      // No gateway restart: `config patch` reports "Change will apply without
+      // restarting the gateway" for a models-only patch, and the Gateway watches
+      // openclaw.json with gateway.reload defaulting to hybrid.
     } catch { /* non-fatal */ }
 
     return NextResponse.json({

package/app/api/agents/channels-summary/route.ts

@@ -1,36 +1,67 @@
 import { NextResponse, type NextRequest } from 'next/server';
-import { getChannels } from '@/lib/channelManager';
-import { execSync } from 'child_process';
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+import { parseTelegramChannel } from '@/lib/channelManager';
+import { dockerExecNoFail, mapWithConcurrency } from '@/lib/docker-exec';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
 
+const execFileAsync = promisify(execFile);
+
 export const dynamic = 'force-dynamic';
 export const maxDuration = 15; // 15-second timeout for channels summary
 
+/** Agents read at once — each is one `docker exec … cat`. */
+const AGENT_QUERY_CONCURRENCY = 8;
+
+const AGENT_CONFIG_PATH = '/root/.openclaw/openclaw.json';
+
 /**
  * GET /api/agents/channels-summary
  *
  * Returns a lightweight channel status map for all running agents.
  * { [agentId]: { telegram: boolean } }
+ *
+ * This used to call getChannels(agentId) in a loop, which re-ran
+ * `docker ps --filter label=AGENT_ID=<id>` for every agent just to recover the
+ * container name — a name this route's own `docker ps` had already returned and
+ * then discarded. So it was 1 + 2N synchronous process spawns to read N files.
+ * Now the discovery call carries the container name through, and the configs are
+ * read concurrently.
  */
-export async function GET(request: NextRequest,
-): Promise<NextResponse> {
+export async function GET(request: NextRequest): Promise<NextResponse> {
   const denied = await requireAuthJWT(request); if (denied) return denied as any;
   try {
-    // Discover agents with AGENT_ID label
-    const out = execSync(
-      `docker ps --filter "label=AGENT_ID" --format '{{.Label "AGENT_ID"}}' 2>/dev/null`,
-      { encoding: 'utf-8', timeout: 5000 },
-    ).trim();
+    // Keep the container name alongside the label — the follow-up lookups per
+    // agent existed only because this call used to throw the name away.
+    const { stdout } = await execFileAsync('docker', [
+      'ps', '--filter', 'label=AGENT_ID', '--format', '{{.Label "AGENT_ID"}}\t{{.Names}}',
+    ], { encoding: 'utf-8', timeout: 5000 });
 
-    const agentIds = out ? out.split('\n').filter(Boolean) : [];
-    const summary: Record<string, { telegram: boolean }> = {};
+    const agents = stdout.trim().split('\n')
+      .map((line) => {
+        const [agentId, containerName] = line.split('\t');
+        if (!agentId?.trim() || !containerName?.trim()) return null;
+        return { agentId: agentId.trim(), containerName: containerName.trim() };
+      })
+      .filter(Boolean) as { agentId: string; containerName: string }[];
+
+    const results = await mapWithConcurrency(agents, AGENT_QUERY_CONCURRENCY, async (agent) => {
+      const raw = await dockerExecNoFail(
+        agent.containerName,
+        ['cat', AGENT_CONFIG_PATH],
+        { timeoutMs: 8000 },
+      );
+      if (!raw) return { agentId: agent.agentId, telegram: false };
+      try {
+        const config = JSON.parse(raw) as Record<string, unknown>;
+        return { agentId: agent.agentId, telegram: parseTelegramChannel(config)?.connected === true };
+      } catch {
+        return { agentId: agent.agentId, telegram: false };
+      }
+    });
 
-    for (const agentId of agentIds) {
-      const channels = getChannels(agentId);
-      summary[agentId] = {
-        telegram: channels.telegram?.connected === true,
-      };
-    }
+    const summary: Record<string, { telegram: boolean }> = {};
+    for (const r of results) summary[r.agentId] = { telegram: r.telegram };
 
     return NextResponse.json(summary);
   } catch {

package/app/api/agents/create/route.ts

@@ -4,7 +4,6 @@ import * as crypto from 'crypto';
 import * as fs from 'fs';
 import * as path from 'path';
 import { buildRev4aProviderConfig } from '../../gateway/sync';
-import { detectPublicHost } from '@/lib/docker-utils';
 import { DB_FILE, AGENTS_TOKEN_FILE, PROVIDER_KEYS_FILE, templatesDir } from '@/lib/rev4a-paths';
 import { getMountFlags, applyRuntimeConfig } from '@/lib/agent-setup';
 import { loadModelsConfig } from '@/lib/model-catalogue';
@@ -44,11 +43,23 @@ const DEFAULT_BLOCK_SIZE = 10;
 
 function getUsedHostPorts(): Set<number> {
   try {
+    // Parse host ports in JS rather than piping through grep. The previous
+    // form used `grep -oP '\d+(?=->)'` inside a template literal, where \d
+    // loses its backslash — the shell received `d+(?=->)`, which never
+    // matches Docker's `0.0.0.0:3700->3000/tcp`, so this always returned an
+    // empty set and every agent was offered port 3700. `grep -P` is also
+    // GNU-only and absent on macOS. This mirrors the client-side parser in
+    // app/agents/create/page.tsx.
     const raw = execSync(
-      `docker ps --format '{{.Ports}}' | grep -oP '\d+(?=->)' | sort -n`,
+      `docker ps --format '{{.Ports}}'`,
       { encoding: 'utf-8', timeout: 3000 },
-    ).trim();
-    return new Set(raw ? raw.split('\n').map(Number) : []);
+    );
+    const used = new Set<number>();
+    for (const [, port] of raw.matchAll(/(\d+)->/g)) {
+      const n = Number(port);
+      if (Number.isInteger(n)) used.add(n);
+    }
+    return used;
   } catch {
     return new Set();
   }
@@ -237,17 +248,23 @@ export async function POST(request: NextRequest): Promise<NextResponse> {
       );
     }
 
-    // Every agent gets a host port range for direct access (http://<ip>:<port>).
-    const agentHostname = `${detectPublicHost()}:${portStart}`;
-    const traefikUrl = `http://${agentHostname}#token=${encodeURIComponent(agentsToken)}`;
-
+    // Every agent gets a host port range for direct access. The URL is composed
+    // by the browser from `port` + `controlToken` in the response — only the
+    // browser knows a hostname that actually reaches this machine.
+    //
+    // There used to be an AGENT_HOSTNAME env var here, holding `<detected-ip>:<port>`.
+    // Nothing ever read it: verified across this repo and across the whole
+    // filesystem of a running agent container, binaries included, with a control
+    // search proving the method finds AGENT_ID and OPENCLAW_GATEWAY_TOKEN in the
+    // same sweep. Worse, a container's env is immutable and recreate copies every
+    // AGENT_* var forward, so a wrong address was frozen in and propagated for the
+    // life of the agent, with no code path anywhere that could refresh it.
     const labels: string[] = [`AGENT_ID=${containerName}`];
     const envVars: string[] = [
       `AGENT_ID=${containerName}`,
       `AGENT_NAME=${displayName.trim()}`,
       `AGENT_TEMPLATE=${template}`,
       `OPENCLAW_GATEWAY_TOKEN=${agentsToken}`,
-      `AGENT_HOSTNAME=${agentHostname}`,
       `TZ=Europe/Rome`,
     ];
 
@@ -425,9 +442,11 @@ export async function POST(request: NextRequest): Promise<NextResponse> {
         { timeout: 15000, stdio: 'pipe', input: providerJson },
       );
 
-      try {
-        execSync(`docker exec ${containerName} openclaw gateway restart`, { timeout: 15000 });
-      } catch { /* restart is best-effort */ }
+      // No gateway restart: `config patch` reports "Change will apply without
+      // restarting the gateway" for a models-only patch, and the Gateway watches
+      // openclaw.json with gateway.reload defaulting to hybrid. The earlier
+      // restart in this route stays — that one follows a full-file rewrite that
+      // includes gateway.*, which is the one section that genuinely needs it.
     } catch (e: unknown) {
       // runtime config patch is best-effort; log but don't fail the create
       console.error('[agent:create] runtime config patch failed:', (e as Error).message || String(e));
@@ -440,7 +459,7 @@ export async function POST(request: NextRequest): Promise<NextResponse> {
       displayName: displayName.trim(),
       image,
       network,
-      traefikUrl,
+      controlToken: agentsToken,
       port: portStart,
       portEnd,
       isBlock,

package/app/api/agents/download-image/route.ts

@@ -16,6 +16,8 @@ import { requireAuthJWT } from '@/lib/rev4a-auth';
 export const dynamic = 'force-dynamic';
 
 export async function POST(request: NextRequest): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
   if (getIsDownloading()) {
     return NextResponse.json(
       { error: 'A download is already in progress' },