@flame0510/project-aether 1.1.13 → 1.1.15

package/app/agents/PageClient.tsx

@@ -42,11 +42,30 @@ interface Agent {
   ip: string | null;
   created: string | null;
   env: string[];
-  traefikUrl: string | null;
+  controlPort: string | null;
   authToken: string | null;
   imageOutdated?: boolean;
 }
 
+/**
+ * URL of the agent's OpenClaw Control UI.
+ *
+ * Composed here rather than on the server on purpose. The hostname the dashboard
+ * is currently being reached on is, by definition, one that resolves and routes
+ * for this user — `localhost` on a dev machine, a LAN address from a phone, the
+ * VPS IP, or a domain. The server can only guess, and it guessed badly: it shelled
+ * out to `curl icanhazip.com` on every call and, on macOS, ended up returning the
+ * machine's `.local` mDNS name.
+ *
+ * Returns null when the agent has no published port (nothing to link to) or when
+ * called during a server render, where `window` doesn't exist.
+ */
+function agentControlUrl(agent: Agent): string | null {
+  if (!agent.controlPort || typeof window === 'undefined') return null;
+  const base = `http://${window.location.hostname}:${agent.controlPort}`;
+  return agent.authToken ? `${base}#token=${encodeURIComponent(agent.authToken)}` : base;
+}
+
 type FilterState = 'all' | 'running' | 'exited';
 
 const STATUS_BULLET: Record<string, string> = {
@@ -180,11 +199,17 @@ function AgentListItem({
         )}
         <div style={{ marginLeft: 'auto', flexShrink: 0, display: 'flex', alignItems: 'center', gap: 8 }}>
           {loading && <span style={{ fontSize: 10, color: '#888' }}>...</span>}
-          {agent.state === 'running' && agent.traefikUrl && (
+          {agent.state === 'running' && agent.controlPort && (
             <Button
               variant="primary"
               size="sm"
-              onClick={(e) => { e.stopPropagation(); window.open(agent.traefikUrl!, '_blank'); }}
+              // Gate on the port, resolve the URL on click: the condition stays
+              // safe to evaluate during a server render, the URL never is.
+              onClick={(e) => {
+                e.stopPropagation();
+                const url = agentControlUrl(agent);
+                if (url) window.open(url, '_blank');
+              }}
               title="Open agent Control UI"
             >
               Open ↗
@@ -231,6 +256,8 @@ export default function AgentsPageClient() {
   const [tokenStatus, setTokenStatus] = useState<{ type: 'success' | 'error'; message: string } | null>(null);
   const [lifecycleLoading, setLifecycleLoading] = useState<string | null>(null);
   const skipNextPoll = useRef(false);
+  /** Guards the un-awaited channel-summary fetch against out-of-order responses. */
+  const chSummarySeq = useRef(0);
   useEffect(() => {
     const check = () => setIsMobile(window.innerWidth < 768);
     check();
@@ -246,11 +273,23 @@ export default function AgentsPageClient() {
       if (!Array.isArray(data)) throw new Error('Invalid response');
       setAgents(data);
       setError('');
-      // Also load channel summary
-      try {
-        const chRes = await fetch('/api/agents/channels-summary');
-        if (chRes.ok) setChSummary(await chRes.json());
-      } catch { /* */ }
+
+      // Channel summary is deliberately not awaited: it only decorates rows with
+      // a TG badge, and awaiting it here held the whole page behind a second
+      // round trip — the agent list was ready in ~0.25s but stayed hidden for
+      // ~1.15s. It now lands on its own and the badges appear when it does.
+      //
+      // Sequence-guarded: load() also runs on a 15s poll, so several of these can
+      // be in flight at once. Without the check, a slow earlier response landing
+      // after a faster later one would overwrite fresh badges with stale ones.
+      const seq = ++chSummarySeq.current;
+      void (async () => {
+        try {
+          const chRes = await fetch('/api/agents/channels-summary');
+          if (!chRes.ok || seq !== chSummarySeq.current) return;
+          setChSummary(await chRes.json());
+        } catch { /* badges are optional */ }
+      })();
     } catch (e: any) {
       setError(e.message || 'Loading error');
     } finally {
@@ -742,6 +781,11 @@ function DetailPanel({ agent, onDeleted, onChanged }: {
   const [showDeleteConfirm, setShowDeleteConfirm] = useState(false);
   const [showEdit, setShowEdit] = useState(false);
 
+  // Safe to resolve during render: this panel only mounts once the agent list has
+  // been fetched client-side, so it never runs in a server render. The helper
+  // guards for a missing `window` regardless.
+  const controlUrl = agentControlUrl(agent);
+
   const handleDelete = async () => {
     setDeleting(true);
     setDeleteError('');
@@ -834,15 +878,15 @@ function DetailPanel({ agent, onDeleted, onChanged }: {
       {/* Backup - persistent volume backup & restore */}
       <BackupSection agentName={agent.name} />
 
-      {/* Access - agent URL (token inline in link) */}
-      {agent.traefikUrl && (
+      {/* Access - agent Control UI URL (token inline in link) */}
+      {controlUrl && (
         <div style={{ border: '1px solid var(--border)', borderRadius: 0, background: 'var(--bg)', overflow: 'hidden' }}>
           <SectionHeader icon={<KeyIcon size={12} />} label="ACCESS" />
           <div style={{ padding: '7px 14px', fontSize: 12 }}>
             <div style={{ color: '#888', marginBottom: 2 }}>Control UI</div>
-            <a href={agent.traefikUrl} target="_blank" rel="noopener noreferrer"
+            <a href={controlUrl} target="_blank" rel="noopener noreferrer"
               style={{ color: '#60a5fa', textDecoration: 'underline', fontSize: 12, wordBreak: 'break-all' }}
-            >{agent.traefikUrl}</a>
+            >{controlUrl}</a>
 
           </div>
         </div>

package/app/agents/create/PageClient.tsx

@@ -77,9 +77,16 @@ export default function CreatePageClient({ templates, models, usedNames, usedPor
   const [fallbacks] = useState<string[]>([]);
   const [submitting, setSubmitting] = useState(false);
   const [errorMsg, setErrorMsg] = useState('');
-  const [result, setResult] = useState<{ name: string; containerId: string; traefikUrl: string } | null>(null);
+  const [result, setResult] = useState<{ name: string; containerId: string; port: number; controlToken: string } | null>(null);
   const [toast, setToast] = useState<{ message: string; type: 'success' | 'error' } | null>(null);
 
+  // The agent's Control UI URL, composed here rather than server-side: whatever
+  // hostname reached this dashboard is one that resolves and routes for this
+  // user, which the server can only guess at. Null until the create succeeds.
+  const controlUrl = result && typeof window !== 'undefined'
+    ? `http://${window.location.hostname}:${result.port}#token=${encodeURIComponent(result.controlToken)}`
+    : null;
+
   const handleSelectTemplate = (id: string) => {
     setSelectedTemplate(id);
     setAgentName('');
@@ -389,10 +396,10 @@ export default function CreatePageClient({ templates, models, usedNames, usedPor
             <div style={{ fontSize: 13, color: '#888', marginBottom: 4 }}>
               Name: <span style={{ color: 'var(--text)' }}>{result.name}</span>
             </div>
-            {result.traefikUrl && (
+            {controlUrl && (
               <div style={{ fontSize: 13, color: '#888' }}>
-                Access: <a href={result.traefikUrl} target="_blank" rel="noopener noreferrer"
-                  style={{ color: '#60a5fa', textDecoration: 'underline' }}>{result.traefikUrl}</a>
+                Access: <a href={controlUrl} target="_blank" rel="noopener noreferrer"
+                  style={{ color: '#60a5fa', textDecoration: 'underline' }}>{controlUrl}</a>
               </div>
             )}
           </div>

package/app/api/agents/[id]/recreate/route.ts

@@ -181,9 +181,9 @@ export async function POST(request: Request,
         { timeout: 15000, stdio: 'pipe', input: providerJson },
       );
 
-      try {
-        execSync(`docker exec ${id} openclaw gateway restart`, { timeout: 15000 });
-      } catch { /* non-fatal */ }
+      // No gateway restart: `config patch` reports "Change will apply without
+      // restarting the gateway" for a models-only patch, and the Gateway watches
+      // openclaw.json with gateway.reload defaulting to hybrid.
     } catch {
       // config patch is best-effort on recreate
     }

package/app/api/agents/[id]/route.ts

@@ -265,7 +265,9 @@ export async function PATCH(
         `docker exec -i ${id} sh -c 'openclaw config patch --stdin'`,
         { timeout: 15000, stdio: 'pipe', input: providerJson },
       );
-      try { execSync(`docker exec ${id} openclaw gateway restart`, { timeout: 15000 }); } catch { /* non-fatal */ }
+      // No gateway restart: `config patch` reports "Change will apply without
+      // restarting the gateway" for a models-only patch, and the Gateway watches
+      // openclaw.json with gateway.reload defaulting to hybrid.
     } catch { /* non-fatal */ }
 
     return NextResponse.json({

package/app/api/agents/channels-summary/route.ts

@@ -1,36 +1,67 @@
 import { NextResponse, type NextRequest } from 'next/server';
-import { getChannels } from '@/lib/channelManager';
-import { execSync } from 'child_process';
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+import { parseTelegramChannel } from '@/lib/channelManager';
+import { dockerExecNoFail, mapWithConcurrency } from '@/lib/docker-exec';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
 
+const execFileAsync = promisify(execFile);
+
 export const dynamic = 'force-dynamic';
 export const maxDuration = 15; // 15-second timeout for channels summary
 
+/** Agents read at once — each is one `docker exec … cat`. */
+const AGENT_QUERY_CONCURRENCY = 8;
+
+const AGENT_CONFIG_PATH = '/root/.openclaw/openclaw.json';
+
 /**
  * GET /api/agents/channels-summary
  *
  * Returns a lightweight channel status map for all running agents.
  * { [agentId]: { telegram: boolean } }
+ *
+ * This used to call getChannels(agentId) in a loop, which re-ran
+ * `docker ps --filter label=AGENT_ID=<id>` for every agent just to recover the
+ * container name — a name this route's own `docker ps` had already returned and
+ * then discarded. So it was 1 + 2N synchronous process spawns to read N files.
+ * Now the discovery call carries the container name through, and the configs are
+ * read concurrently.
  */
-export async function GET(request: NextRequest,
-): Promise<NextResponse> {
+export async function GET(request: NextRequest): Promise<NextResponse> {
   const denied = await requireAuthJWT(request); if (denied) return denied as any;
   try {
-    // Discover agents with AGENT_ID label
-    const out = execSync(
-      `docker ps --filter "label=AGENT_ID" --format '{{.Label "AGENT_ID"}}' 2>/dev/null`,
-      { encoding: 'utf-8', timeout: 5000 },
-    ).trim();
+    // Keep the container name alongside the label — the follow-up lookups per
+    // agent existed only because this call used to throw the name away.
+    const { stdout } = await execFileAsync('docker', [
+      'ps', '--filter', 'label=AGENT_ID', '--format', '{{.Label "AGENT_ID"}}\t{{.Names}}',
+    ], { encoding: 'utf-8', timeout: 5000 });
 
-    const agentIds = out ? out.split('\n').filter(Boolean) : [];
-    const summary: Record<string, { telegram: boolean }> = {};
+    const agents = stdout.trim().split('\n')
+      .map((line) => {
+        const [agentId, containerName] = line.split('\t');
+        if (!agentId?.trim() || !containerName?.trim()) return null;
+        return { agentId: agentId.trim(), containerName: containerName.trim() };
+      })
+      .filter(Boolean) as { agentId: string; containerName: string }[];
+
+    const results = await mapWithConcurrency(agents, AGENT_QUERY_CONCURRENCY, async (agent) => {
+      const raw = await dockerExecNoFail(
+        agent.containerName,
+        ['cat', AGENT_CONFIG_PATH],
+        { timeoutMs: 8000 },
+      );
+      if (!raw) return { agentId: agent.agentId, telegram: false };
+      try {
+        const config = JSON.parse(raw) as Record<string, unknown>;
+        return { agentId: agent.agentId, telegram: parseTelegramChannel(config)?.connected === true };
+      } catch {
+        return { agentId: agent.agentId, telegram: false };
+      }
+    });
 
-    for (const agentId of agentIds) {
-      const channels = getChannels(agentId);
-      summary[agentId] = {
-        telegram: channels.telegram?.connected === true,
-      };
-    }
+    const summary: Record<string, { telegram: boolean }> = {};
+    for (const r of results) summary[r.agentId] = { telegram: r.telegram };
 
     return NextResponse.json(summary);
   } catch {

package/app/api/agents/create/route.ts

@@ -4,7 +4,6 @@ import * as crypto from 'crypto';
 import * as fs from 'fs';
 import * as path from 'path';
 import { buildRev4aProviderConfig } from '../../gateway/sync';
-import { detectPublicHost } from '@/lib/docker-utils';
 import { DB_FILE, AGENTS_TOKEN_FILE, PROVIDER_KEYS_FILE, templatesDir } from '@/lib/rev4a-paths';
 import { getMountFlags, applyRuntimeConfig } from '@/lib/agent-setup';
 import { loadModelsConfig } from '@/lib/model-catalogue';
@@ -249,17 +248,23 @@ export async function POST(request: NextRequest): Promise<NextResponse> {
       );
     }
 
-    // Every agent gets a host port range for direct access (http://<ip>:<port>).
-    const agentHostname = `${detectPublicHost()}:${portStart}`;
-    const traefikUrl = `http://${agentHostname}#token=${encodeURIComponent(agentsToken)}`;
-
+    // Every agent gets a host port range for direct access. The URL is composed
+    // by the browser from `port` + `controlToken` in the response — only the
+    // browser knows a hostname that actually reaches this machine.
+    //
+    // There used to be an AGENT_HOSTNAME env var here, holding `<detected-ip>:<port>`.
+    // Nothing ever read it: verified across this repo and across the whole
+    // filesystem of a running agent container, binaries included, with a control
+    // search proving the method finds AGENT_ID and OPENCLAW_GATEWAY_TOKEN in the
+    // same sweep. Worse, a container's env is immutable and recreate copies every
+    // AGENT_* var forward, so a wrong address was frozen in and propagated for the
+    // life of the agent, with no code path anywhere that could refresh it.
     const labels: string[] = [`AGENT_ID=${containerName}`];
     const envVars: string[] = [
       `AGENT_ID=${containerName}`,
       `AGENT_NAME=${displayName.trim()}`,
       `AGENT_TEMPLATE=${template}`,
       `OPENCLAW_GATEWAY_TOKEN=${agentsToken}`,
-      `AGENT_HOSTNAME=${agentHostname}`,
       `TZ=Europe/Rome`,
     ];
 
@@ -437,9 +442,11 @@ export async function POST(request: NextRequest): Promise<NextResponse> {
         { timeout: 15000, stdio: 'pipe', input: providerJson },
       );
 
-      try {
-        execSync(`docker exec ${containerName} openclaw gateway restart`, { timeout: 15000 });
-      } catch { /* restart is best-effort */ }
+      // No gateway restart: `config patch` reports "Change will apply without
+      // restarting the gateway" for a models-only patch, and the Gateway watches
+      // openclaw.json with gateway.reload defaulting to hybrid. The earlier
+      // restart in this route stays — that one follows a full-file rewrite that
+      // includes gateway.*, which is the one section that genuinely needs it.
     } catch (e: unknown) {
       // runtime config patch is best-effort; log but don't fail the create
       console.error('[agent:create] runtime config patch failed:', (e as Error).message || String(e));
@@ -452,7 +459,7 @@ export async function POST(request: NextRequest): Promise<NextResponse> {
       displayName: displayName.trim(),
       image,
       network,
-      traefikUrl,
+      controlToken: agentsToken,
       port: portStart,
       portEnd,
       isBlock,

package/app/api/agents/image-status/route.ts

@@ -2,127 +2,134 @@ import { type NextRequest } from "next/server";
 /**
  * GET /api/agents/image-status
  *
- * Checks whether the openclaw-agent-base image is present and up to date.
- * Compares the local image digest with the remote registry digest
- * (public image on ghcr.io, no auth needed).
+ * Reports whether the openclaw-agent-base image is present, whether a download
+ * is in flight, and whether a newer image exists in the registry.
+ *
+ * The four fields cost wildly different amounts, which is what makes this route
+ * worth structuring carefully. ImageDownloadBanner polls it every 2s to animate
+ * download progress, so anything slow in here is paid over and over:
+ *
+ *   downloading   in-memory flag                          free
+ *   error         local                                   free
+ *   exists        one `docker image inspect`              ~0.5s
+ *   needsUpdate   `docker manifest inspect` over the net  ~3.4s
+ *
+ * The route used to compute all of them, synchronously, on every poll — a 2s
+ * interval driving a ~5s blocking call, so the whole server sat frozen for as
+ * long as the agents page stayed open. It also ran `docker version` three times
+ * per request (once inside each helper) just to ask whether Docker was up, at
+ * ~2s a call, and inspected the same image three times over.
+ *
+ * Now: Docker liveness comes from the socket check in lib/docker-socket (a
+ * cached filesystem stat), the image is inspected once, everything is async, and
+ * the registry lookup — the only genuinely expensive part — is cached. The base
+ * image changes when a release is published, not every two seconds.
  */
 import { NextResponse } from 'next/server';
-import { execSync } from 'child_process';
+import { execFile } from 'child_process';
+import { promisify } from 'util';
 import { getIsDownloading } from '@/lib/buildAgentImage';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
+import { dockerAvailable } from '@/lib/docker-socket';
+
+const execFileAsync = promisify(execFile);
 
 export const dynamic = 'force-dynamic';
 
 const REGISTRY_IMAGE = 'ghcr.io/flame0510/rev4a/openclaw-agent-base:latest';
 const LOCAL_IMAGE = 'openclaw-agent-base:latest';
+const REGISTRY_PREFIX = 'ghcr.io/flame0510/rev4a/openclaw-agent-base@';
 
-function dockerOk(): boolean {
-  try {
-    execSync('docker version --format "{{.Client.Version}}" 2>/dev/null', {
-      encoding: 'utf-8',
-      timeout: 2000,
-    });
-    return true;
-  } catch {
-    return false;
-  }
-}
+/**
+ * How long a registry lookup is reused. Long enough that a 2s poll doesn't hit
+ * the network, short enough that a freshly published base image surfaces on its
+ * own. The cost of being stale here is a banner appearing a few minutes late.
+ */
+const REMOTE_TTL_MS = 10 * 60 * 1000;
 
-function localImageExists(): boolean {
-  if (!dockerOk()) return false;
-  try {
-    execSync(
-      `docker image inspect ${LOCAL_IMAGE} --format "{{.ID}}" 2>/dev/null`,
-      { timeout: 3000 },
-    );
-    return true;
-  } catch {
-    return false;
-  }
-}
+let remoteCache: { digest: string | null; at: number } | null = null;
+/** Shared across concurrent requests so a burst of polls triggers one lookup. */
+let remoteInFlight: Promise<string | null> | null = null;
 
-function getLocalImageId(): string | null {
-  if (!dockerOk()) return null;
+/** The local image's ID and its registry digest, from a single inspect. */
+async function inspectLocalImage(): Promise<{ id: string; registryDigest: string | null } | null> {
   try {
-    return execSync(
-      `docker image inspect ${LOCAL_IMAGE} --format "{{.ID}}" 2>/dev/null`,
-      { encoding: 'utf-8', timeout: 3000 },
-    ).trim() || null;
+    const { stdout } = await execFileAsync(
+      'docker',
+      ['image', 'inspect', LOCAL_IMAGE, '--format', '{{json .}}'],
+      { encoding: 'utf-8', timeout: 5000 },
+    );
+    const info = JSON.parse(stdout) as { Id?: string; RepoDigests?: string[] };
+    const fromRegistry = (info.RepoDigests ?? []).find((d) => d.startsWith(REGISTRY_PREFIX));
+    return {
+      id: info.Id ?? '',
+      registryDigest: fromRegistry ? fromRegistry.split('@')[1] ?? null : null,
+    };
   } catch {
     return null;
   }
 }
 
-/** Fetch the remote manifest digest from ghcr.io (public, no auth). */
-function getRemoteDigest(): string | null {
-  if (!dockerOk()) return null;
+/** Manifest digest of the published image, cached for REMOTE_TTL_MS. */
+async function getRemoteDigest(): Promise<string | null> {
+  if (remoteCache && Date.now() - remoteCache.at < REMOTE_TTL_MS) return remoteCache.digest;
+  if (remoteInFlight) return remoteInFlight;
+
+  remoteInFlight = (async () => {
+    try {
+      const { stdout } = await execFileAsync(
+        'docker',
+        ['manifest', 'inspect', REGISTRY_IMAGE, '--verbose'],
+        { encoding: 'utf-8', timeout: 15000 },
+      );
+      const manifest = JSON.parse(stdout) as { Descriptor?: { digest?: string } };
+      // The descriptor digest is what RepoDigests can be compared against;
+      // config.digest is a different hash entirely.
+      return manifest?.Descriptor?.digest ?? null;
+    } catch {
+      return null;
+    }
+  })();
+
   try {
-    const out = execSync(
-      `docker manifest inspect ${REGISTRY_IMAGE} --verbose 2>/dev/null`,
-      { encoding: 'utf-8', timeout: 15000 },
-    );
-    const manifest = JSON.parse(out);
-    // Use the manifest descriptor digest (comparable with RepoDigests),
-    // not config.digest (which is a different hash).
-    return manifest?.Descriptor?.digest || null;
-  } catch {
-    return null;
+    const digest = await remoteInFlight;
+    remoteCache = { digest, at: Date.now() };
+    return digest;
+  } finally {
+    remoteInFlight = null;
   }
 }
 
 export async function GET(request: NextRequest): Promise<NextResponse> {
   const denied = await requireAuthJWT(request);
   if (denied) return denied;
-  const exists = localImageExists();
-  const localId = getLocalImageId();
+
   const downloading = getIsDownloading();
 
-  if (!exists) {
-    return NextResponse.json({
-      exists: false,
-      needsUpdate: true,
-      downloading,
-      localId: null,
-    });
+  if (!dockerAvailable()) {
+    return NextResponse.json({ exists: false, needsUpdate: true, downloading, localId: null });
   }
 
-  // Compare local image digest with remote registry digest.
-  // If they differ, a newer image is available.
-  let needsUpdate = false;
-  const remoteDigest = getRemoteDigest();
+  const local = await inspectLocalImage();
+  if (!local) {
+    return NextResponse.json({ exists: false, needsUpdate: true, downloading, localId: null });
+  }
 
-  if (remoteDigest && localId) {
-    // localId is the image ID (e.g. sha256:abc123...).
-    // Extract it from any RepoDigest that references the registry.
-    try {
-      const inspect = JSON.parse(
-        execSync(
-          `docker image inspect ${LOCAL_IMAGE} --format '{{json .}}' 2>/dev/null`,
-          { encoding: 'utf-8', timeout: 3000 },
-        ),
-      );
-      const localRepoDigests: string[] = inspect?.RepoDigests || [];
-      const registryDigest = localRepoDigests.find((d: string) =>
-        d.startsWith('ghcr.io/flame0510/rev4a/openclaw-agent-base@'),
-      );
+  // A cached registry digest answers immediately; a cold one costs a network
+  // round trip, but only once per TTL rather than once per poll.
+  const remoteDigest = await getRemoteDigest();
 
-      if (registryDigest) {
-        // Extract sha256:... from "ghcr.io/...@sha256:xxx"
-        const localDigest = registryDigest.split('@')[1] || '';
-        needsUpdate = localDigest !== remoteDigest;
-      } else {
-        // Image was built locally, never pulled — needs update
-        needsUpdate = true;
-      }
-    } catch {
-      // Can't determine — assume up to date
-    }
+  let needsUpdate = false;
+  if (remoteDigest) {
+    // No registry digest locally means the image was built here and never
+    // pulled, so it can't be compared — treat it as updatable.
+    needsUpdate = local.registryDigest ? local.registryDigest !== remoteDigest : true;
   }
 
   return NextResponse.json({
     exists: true,
     needsUpdate,
     downloading,
-    localId,
+    localId: local.id || null,
   });
 }

package/app/api/agents/route.ts

@@ -1,7 +1,6 @@
 import { NextResponse, type NextRequest } from 'next/server';
 import * as fs from 'fs';
 import * as path from 'path';
-import { detectPublicHost } from '@/lib/docker-utils';
 import { AGENTS_TOKEN_FILE } from '@/lib/rev4a-paths';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
 import { dockerAvailable, dockerFetch } from '@/lib/docker-socket';
@@ -38,7 +37,7 @@ export async function GET(request: NextRequest): Promise<NextResponse> {
         let created: string | null = null;
         let env: string[] = [];
         let authToken: string | null = null;
-        let traefikUrl: string | null = null;
+        let controlPort: string | null = null;
         let portBindings: Record<string, Array<{ HostIp: string; HostPort: string }>> | null = null;
 
         try {
@@ -61,7 +60,6 @@ export async function GET(request: NextRequest): Promise<NextResponse> {
           portBindings = inspect.HostConfig?.PortBindings || null;
 
           // Read auth token — always prefer the shared agents-token.json (user-managed)
-          const cName = (c.Names?.[0] || '').replace(/^\//, '');
           try {
             const tokenRaw = fs.readFileSync(
               AGENTS_TOKEN_FILE,
@@ -75,36 +73,34 @@ export async function GET(request: NextRequest): Promise<NextResponse> {
             // agents-token.json unavailable
           }
 
-          // Fallback only if shared token is missing: try the container's own gateway token
+          // Fallback when the shared file is missing: the container's own token,
+          // taken from the inspect data already fetched above.
+          //
+          // This used to `docker exec … grep OPENCLAW_GATEWAY_TOKEN /root/….env`
+          // — a path containing a literal U+2026 ellipsis, so not a path at all.
+          // Correcting the character wouldn't have helped: agent containers have
+          // no .env file, and no file under /root/ holds that variable (verified
+          // across the production fleet). The token exists only in the container
+          // environment, which is right here in Config.Env. So the fallback spawned
+          // a blocking process per agent to read a file that cannot exist, failed
+          // silently, and left every "Open" button without its token — while the
+          // value sat in memory, already fetched.
           if (!authToken) {
-            try {
-              const { execSync } = require('child_process');
-              let token = execSync(
-                `docker exec ${cName} sh -c 'grep ^OPENCLAW_GATEWAY_TOKEN= /root/….env 2>/dev/null | cut -d= -f2- | tr -d "\"\""' 2>/dev/null || echo ''`,
-                { timeout: 5000, encoding: 'utf-8' }
-              ).toString().trim();
-              if (token && token !== 'undefined') authToken = token;
-            } catch {
-              // token unavailable for this container
-            }
+            const fromEnv = ((inspect.Config?.Env || []) as string[])
+              .find((e) => e.startsWith('OPENCLAW_GATEWAY_TOKEN='));
+            const token = fromEnv?.slice('OPENCLAW_GATEWAY_TOKEN='.length).trim();
+            if (token && token !== 'undefined') authToken = token;
           }
 
-          // Build the agent URL from the host's public IP + mapped port.
-          // Every agent has -p <port>:3000, so we look for the public port
-          // that maps to the internal port 3000.
-          // Use portBindings from inspect (works stopped) with fallback to c.Ports (running only).
+          // The host port mapped to the agent's Control UI (container port 3000).
+          // Only the port is returned: the browser composes the full URL, because
+          // only the browser knows which hostname actually reaches this machine.
+          // Read from portBindings (works on a stopped container) with a fallback
+          // to c.Ports, which is only populated while running.
           const port3000Binding = portBindings?.['3000/tcp'];
-          const publicPort = port3000Binding?.[0]?.HostPort
-            || (c.Ports || []).find((p: any) => p.PublicPort && p.PrivatePort === 3000)?.PublicPort
+          controlPort = port3000Binding?.[0]?.HostPort
+            || (c.Ports || []).find((p: any) => p.PublicPort && p.PrivatePort === 3000)?.PublicPort?.toString()
             || null;
-          if (publicPort) {
-            const host = detectPublicHost();
-            let baseUrl = `http://${host}:${publicPort}`;
-            if (authToken) {
-              baseUrl += `#token=${encodeURIComponent(authToken)}`;
-            }
-            traefikUrl = baseUrl;
-          }
         } catch {
           // inspect non-critical, continue with partial data
         }
@@ -150,7 +146,7 @@ export async function GET(request: NextRequest): Promise<NextResponse> {
           ip,
           created,
           env,
-          traefikUrl,
+          controlPort,
           authToken,
           // Flag as outdated when the container's image differs from the current base image.
           // We compare raw ImageID digests — no fragile name-based filtering.