@flame0510/project-aether 1.1.9

package/docs/dev/WORKSPACE.md

@@ -0,0 +1,199 @@
+# Workspace — Multi-Workspace File Explorer
+
+> **Status:** Active — `main` branch
+> **Last updated:** 2026-06-30
+
+---
+
+## 1. Overview
+
+The Workspace feature provides a unified file explorer for OpenClaw agent workspaces across
+the VPS host and any Docker containers. Users can browse directories, read files, write
+content, and navigate a recursive tree — all from the Rev4a dashboard.
+
+**Purpose:** Give operators direct access to agent workspace files (MEMORY.md, logs,
+configurations, project files) without needing to SSH into the host or exec into containers.
+
+---
+
+## 2. Workspace Selector (UI)
+
+The dashboard includes a **workspace selector** — a dropdown that lists all available
+workspaces. Selecting one loads its file tree into the editor panel.
+
+Available workspaces are grouped by type:
+
+- **Host:** always one entry — the VPS host workspace (`vps`)
+- **Containers:** one entry per running Docker container that has an `AGENT_ID` label
+
+---
+
+## 3. Available Workspaces
+
+### VPS Host
+
+| Property | Value |
+|---|---|
+| ID | `vps` |
+| Label | `VPS Host (Nexus)` |
+| Type | `host` |
+| Root path | `/path/to/workspace/` |
+| Access | `fs.readdirSync` / `fs.readFileSync` / `fs.writeFileSync` (direct filesystem) |
+
+### Container Agents
+
+Container workspaces are **auto-discovered** at runtime by querying Docker:
+
+```
+docker ps --filter label=AGENT_ID --format '{{.Names}}|{{.Label "AGENT_ID"}}'
+```
+
+| Property | Value |
+|---|---|
+| ID convention | `container-<containerName>` (e.g. `container-openclaw-atlas`) |
+| Label | `<agentId> (<containerName>)` (e.g. `atlas (openclaw-atlas)`) |
+| Type | `container` |
+| Root path | `/root/.openclaw/workspace/` |
+| Access | `docker exec` (shell commands over Docker socket) |
+
+Only containers with the `AGENT_ID` Docker label appear — this prevents showing
+infrastructure containers (Traefik, databases, etc.) that are not agent workspaces.
+
+---
+
+## 4. API Endpoints
+
+### `GET /api/workspace?action=list`
+
+List all available workspaces.
+
+**Auth:** Bearer token, query param, `x-agent-token` header, or browser cookie
+
+**Response:**
+```json
+{
+  "workspaces": [
+    { "id": "vps", "label": "VPS Host (Nexus)", "type": "host" },
+    { "id": "container-agent_8ba21f83", "label": "Giuanmuzzziins", "type": "container" }
+  ]
+}
+```
+
+### `GET /api/workspace?workspace=<id>[&path=<path>][&tree=1]`
+
+List files in a workspace, read a file, or return a recursive tree.
+
+**Auth:** any auth method
+
+**Query params:**
+| Param | Default | Description |
+|---|---|---|
+| `workspace` | `vps` | Workspace ID |
+| `path` | workspace root | Directory or file path to read |
+| `tree=1` | — | When set, returns a recursive flat list of all entries |
+
+**Response (directory listing):**
+```json
+{
+  "workspace": "vps",
+  "label": "VPS Host (Nexus)",
+  "path": "/path/to/workspace",
+  "type": "host",
+  "files": [
+    { "name": "config", "isDirectory": true, "isFile": false, "path": "..." },
+    { "name": "SOUL.md", "isDirectory": false, "isFile": true, "path": "..." }
+  ]
+}
+```
+
+**Response (`tree=1` — recursive tree):**
+```json
+{
+  "workspace": "vps",
+  "label": "VPS Host (Nexus)",
+  "path": "/path/to/workspace",
+  "root": "/path/to/workspace",
+  "type": "host",
+  "entries": [
+    { "name": "rev4a", "path": "/path/to/workspace/rev4a",
+      "relPath": "rev4a", "type": "directory", "size": 0,
+      "mtimeMs": 1750000000000, "isDirectory": true, "isFile": false },
+    ...
+  ],
+  "tree": [ "...same items as entries..." ],
+  "files": [ "...same items as entries..." ]
+}
+```
+
+**Response (file read):** Same structure with a `content` field (string) instead of `files`.
+
+### `PUT /api/workspace`
+
+Write content to a workspace file.
+
+**Auth:** any auth method
+
+**Body:**
+```json
+{
+  "workspace": "vps",
+  "path": "/path/to/workspace/test.md",
+  "content": "hello"
+}
+```
+
+**Response:** `{ "ok": true }`
+
+If `workspace` is omitted, defaults to `vps`.
+
+---
+
+## 5. Entry Sorting (Consistency Rule)
+
+All directory listings and trees are sorted server-side by `compareWorkspaceEntries()`:
+
+1. **Directories before files** — at every level of a nested path
+2. **Alphabetical within each group** — directories sorted by name, then files sorted by name
+3. **Recursive depth-first** — the same rule applies at every nesting level
+
+This ordering is **always applied server-side** so the UI receives a consistent
+sequence regardless of filesystem order (`readdir` order differs across platforms and
+filesystems). Both host and container listings use the same comparator.
+
+---
+
+## 6. Host Workspace Implementation
+
+- Uses `fs.readdirSync` / `fs.readFileSync` / `fs.writeFileSync` — real-time, no caching
+- Paths are validated against `VPS_ROOT` (`/path/to/workspace/`) to prevent directory traversal
+- Binary files (images, PDFs) are detected by extension (`BINARY_EXTENSIONS` set) and served inline
+- Hidden files (starting with `.`) and `node_modules` are skipped in directory listings
+
+---
+
+## 7. Container Workspace Implementation
+
+- Uses `docker exec` to run shell commands inside the container for listing, reading, and writing
+- **Discovery** uses `execFileSync('docker', ['ps', ...])` with explicit arguments — this avoids
+  shell quoting fragility compared to `execSync('docker ps ...')`
+- **List directory:** `docker exec <name> ls -1Ap <dir>` (detects directories via trailing `/`)
+- **File existence check:** `docker exec <name> test -d <path> && echo YES || echo NO`
+- **File read:** `docker exec <name> cat <path>`
+- **File write:** `docker exec -i <name> sh -c 'mkdir -p $(dirname <path>) && cat > <path>'` with content piped via heredoc
+- Container root is scoped to `/root/.openclaw/workspace/` rather than the full
+  container filesystem — this is intentional: it limits the editor to agent workspace
+  files and prevents accidental editing of system files inside the container
+
+---
+
+## 8. Design Decisions
+
+| Decision | Rationale |
+|---|---|
+| Server-side sorting | Filesystem `readdir` order is platform-dependent (e.g. ext4 vs overlayfs). Sorting server-side guarantees consistent ordering for the UI. |
+| Container discovery via `AGENT_ID` | Avoids listing all containers (including Traefik, DBs, etc.) — only agent containers are relevant workspace targets. |
+| `execFileSync` for `docker ps` | `execFileSync` passes arguments as an array, avoiding shell injection vulnerabilities and fragile quoting compared to `execSync('docker ps ...')` with string concatenation. |
+| Container root at `/root/.openclaw/workspace/` | Prevents operators from accidentally reading/writing system files (e.g. `/etc/passwd`, `/bin/sh`) inside the container. The workspace root is the only exposed sandbox. |
+| Real-time file reads (no caching) | Workspace files change frequently (agents write MEMORY.md, logs). Caching would require invalidation logic with little benefit — file reads are fast. |
+| UI tree auto-refresh (5s polling) | The file tree re-fetches every 5s (recursive `setTimeout`, not `setInterval`, to avoid overlapping requests) so external changes — a credential sync writing `TOOLS.md`, a restore, a manual edit inside the container — appear without a manual page reload. Only the tree is refreshed; the currently open file is left untouched to avoid clobbering an in-progress edit. Cleaned up on unmount via a `mounted` flag + `clearTimeout`. |
+| Flat tree with aliases (`entries`, `tree`, `files`) | Backward compatibility: older UI components expect `files` or `tree` keys; `entries` is the canonical name in the current codebase. |

package/docs/rag/DATA-FRESHNESS.md

@@ -0,0 +1,109 @@
+# Data Freshness in Rev4a
+
+> **Last updated:** 2026-07-18
+
+Understanding how current the data in Rev4a is — and what is truly real-time vs. periodically updated.
+
+---
+
+## Session data
+
+**Update frequency:** every 15–30 seconds
+
+The daemon polls `openclaw sessions --json --all-agents` on this schedule:
+- 15 seconds when at least one session has status `working`
+- 30 seconds when no sessions are actively working
+
+This means session statuses, token counts, and costs are at most 30 seconds behind reality during quiet periods, and 15 seconds behind during active work.
+
+**What this means for PULSE:** if you ask "is Argus working right now?", the answer reflects data that is up to 30 seconds old.
+
+---
+
+## Event feed
+
+**Update frequency:** ~3 seconds (via SSE stream)
+
+The `/api/stream` endpoint pushes updates to the dashboard every ~3 seconds. This includes:
+- New events (spawn, complete, error, tool_call)
+- Updated session list
+- Today's cost total
+- Lineage data
+
+The event feed is as close to real-time as Rev4a gets. However, events are generated by the daemon's poll cycle, so an event that just happened may take up to 30 seconds to appear.
+
+---
+
+## System metrics (CPU, RAM, disk)
+
+**Update frequency:** every daemon poll cycle (15–30 seconds)
+
+**Retention:** last 24 hours only (older rows are pruned automatically)
+
+---
+
+## Cost totals
+
+**Update frequency:** every 15–30 seconds (recalculated from sessions on each API call)
+
+The cost figures shown in the dashboard are always computed fresh from the database on each page load or SSE push. They are not cached.
+
+**Cost override:** if a manual override is set for the current month, it is shown immediately after being saved — no delay.
+
+---
+
+## Cron jobs
+
+**Update frequency:** on demand (fetched live from OpenClaw gateway on page load)
+
+Cron status (last run, next run) is fetched directly from the OpenClaw gateway each time the Crons page is loaded. It is not stored in the database.
+
+**Note:** if the OpenClaw gateway returns a scope-blocked error when listing crons, Rev4a may show no crons even if crons exist. This is an authorization scope issue, not a real absence of crons.
+
+---
+
+## Agent configuration
+
+**Update frequency:** on demand (read from `openclaw.json` on each request)
+
+The agents list, Telegram accounts, and bindings are read directly from `openclaw.json` each time the Agents Config page is accessed. Changes saved via the UI take effect immediately.
+
+## Agent base image
+
+**Update frequency:** polled every 2 seconds during a build; on page load otherwise
+
+The `GET /api/agents/image-status` endpoint compares the local image digest
+with the remote registry digest (ghcr.io). Download progress is shown inline
+via polling `GET /api/agents/image-status` and reading logs from
+`/tmp/rev4a-download-<timestamp>.log`.
+
+---
+
+## Memory / context files
+
+**Update frequency:** on demand (files read from disk on each request)
+
+Memory files (MEMORY.md, etc.) are read from disk each time they are requested. There is no caching.
+
+---
+
+## What is NOT real-time
+
+| Data | Why it may be stale |
+|---|---|
+| Sessions ended more than 7 days ago | `agents-active` endpoint only looks back 7 days |
+| Sessions never polled by daemon | If the daemon was down, sessions from that window are missing |
+| Tool calls for a session | Only captured if the OpenClaw session export includes them |
+| Costs before Rev4a was installed | Historical data before the first daemon run is not available |
+
+---
+
+## How to check if data is fresh
+
+The System Health page shows a check like "last event X seconds ago". If this number is larger than ~60 seconds, the daemon may have stopped.
+
+You can also run this command on the server to check directly:
+```bash
+sqlite3 data/events.db \
+  "SELECT datetime(MAX(ts)/1000, 'unixepoch', 'localtime') FROM events"
+```

package/docs/rag/GLOSSARY.md

@@ -0,0 +1,125 @@
+# Rev4a Glossary
+
+> **Last updated:** 2026-07-15
+
+Terms you'll encounter while using the Rev4a dashboard.
+
+---
+
+## Agent
+An AI assistant configured with a specific role, AI model, and workspace. Each agent has a name (e.g. "Argus") and can run multiple sessions over time. Agents are deployed as Docker containers with persistent data volumes.
+
+## Agent Template
+A pre-built configuration used when creating a new agent. Templates include default files (AGENTS.md, SOUL.md, MEMORY.md, IDENTITY.md, TOOLS.md, HEARTBEAT.md, BOOTSTRAP.md) and settings. Located in `agent-templates/`. Available templates: **Atlas** (general dev), **Argus** (security/audit), **Prometheus** (client-facing), and **Custom** (blank slate — bootstraps identity interactively on first run).
+
+## Badge
+A small inline label component used for status indicators and channel chips. Supports success, danger, warning, and neutral tones. Used for TG/WA chips on the agent list and pairing status in the Channel Manager.
+
+## Backup (Agent)
+A compressed archive (`.tar.gz`) of an agent's persistent volume (`/root/`). Backups exclude the npm cache to keep sizes small (~1.5 MB). Stored in the `rev4a-backups` Docker volume. Used for restore operations and auto-created before each recreate.
+
+## Container
+A Docker container running on the server. Each agent runs in its own container. The Containers page shows all containers, including infrastructure ones (databases, reverse proxies, etc.), with CPU/memory metrics, logs, and a web terminal.
+
+## Channel
+A communication channel (Telegram) configured on an agent. Channels allow users to send DMs to the agent via messaging apps. The Channel Manager modal lets you connect/disconnect Telegram and manage pairings (approve/reject senders).
+
+## Channel Manager
+Modal in the agent detail panel for configuring Telegram channels. Connect with bot token, restart agent, manage pairings (approve pending codes, revoke approved senders). Pairings are polled every 5 seconds with automatic cancellation of stale requests via AbortController.
+
+## Cost
+The estimated cost of an agent session in USD, calculated from tokens used and per-model pricing. Rev4a shows cost by today, 7 days, 30 days, all-time, and by model.
+
+## Cost Override
+A manual correction for a month's total cost. If the automatic calculation doesn't match the actual invoice, you can set an override value for that month with an optional note.
+
+## Credential
+A third-party service token (GitHub PAT, Trello API key, Vercel token, Supabase access key, Notion API token) stored in the Rev4a vault. Credentials can be scoped to specific agent containers and synced via CLI auth or config files. Every reveal is logged in the audit trail.
+
+## Cron / Cron Job
+A scheduled task that runs an agent automatically at a fixed time (e.g. every night at 3:15 AM). Configured with standard cron syntax. Jobs can be enabled/disabled per entry.
+
+## Dashboard
+The main page of Rev4a (`/`). Shows live sessions, cost summary, system health metrics (CPU, RAM, disk, load average), and a real-time event feed. A setup banner appears if the onboarding wizard is incomplete.
+
+## Event
+A lifecycle occurrence for a session: spawned, completed, errored, or a tool call made. Events appear in the live feed on the Dashboard and are pushed via SSE every ~3 seconds.
+
+## Gateway
+The routing layer that connects agents to AI providers. The Gateway page has two panels: Provider Sync (push the model catalogue to all agents) and Agent Model Config (set each agent's primary model and fallbacks).
+
+## Lineage
+The parent-child relationship tree between sessions. When an agent spawns another agent to do work, that relationship is shown as an interactive graph on the Lineage page. Configurable time periods: 1d, 7d, 30d.
+
+## Memory
+Files that store an agent's persistent knowledge and personality: MEMORY.md, SOUL.md, IDENTITY.md, USER.md, AGENTS.md, TOOLS.md, HEARTBEAT.md. Editing them changes how an agent behaves. The Memory page shows all files with size and budget tracking.
+
+## Model
+The AI model used by an agent or session. Examples: GPT-5.4, Claude Sonnet 4, DeepSeek V4 Flash. Models are linked to specific providers. The Gateway page manages which models are enabled and which agent uses which model.
+
+## Onboarding
+First-time setup wizard at `/onboarding`. Four steps: Welcome → Providers → First Agent → Ready. Progress is tracked per-step in `data/onboarding-progress.json`. A badge in the sidebar shows remaining steps (e.g. "2/3"). Always accessible from the sidebar or mobile navbar.
+
+## Plugin
+An extension that adds new tools and capabilities to agents. Plugins are installed in the workspace and appear in the Plugins page with enable/disable toggles.
+
+## Provider
+An AI service provider (OpenAI, Anthropic, Groq, OpenRouter, DeepSeek, etc.) that hosts models. Provider API keys are configured in the Gateway page or via the onboarding wizard.
+
+## Provider Gateway
+Rev4a's built-in proxy that gives all agents unified access to configured LLM providers. Agents point to `http://host.docker.internal:3740/api/provider/v1` and Rev4a routes requests to the correct upstream using the stored API keys.
+
+## Pulse
+The AI concierge embedded in Rev4a. Click the floating chat button (bottom-right) on any page to ask questions about the dashboard features and navigation.
+
+## Recreate (Agent)
+Rebuild an agent container from the latest `openclaw-agent-base:latest` image while preserving the persistent volume. Auto-backups the volume first — if the backup fails, the recreate is aborted. This is how agents pick up OpenClaw image updates.
+
+## Restore (Agent)
+Replace an agent's persistent volume with a previously created backup. The container is stopped, the volume content is fully replaced, then the container is restarted.
+
+## Session
+One instance of an agent doing work. Tracks: start/end time, tokens used, cost, model, status, and task description. A session starts when an agent receives a task and ends when it completes or fails.
+
+## Pairing
+A security mechanism for Telegram channels. When a user sends `/start` to the bot, a 4-digit pairing code is generated. An admin must approve this code in the Channel Manager to add the user to the allowlist. Approved senders can be revoked at any time.
+
+## Telegram
+A messaging channel type. Agents can be connected to Telegram via a bot token from @BotFather. Once connected, users send `/start` to get a pairing code, which an admin approves in the Channel Manager.
+
+## Session ID
+A unique identifier for a session. Format: `agent:<name>:<role>` (e.g. `agent:ops:main`) or `agent:<name>:subagent:<uuid>` for temporary child agents.
+
+## Skill
+A reusable prompt/tool bundle that agents can invoke. Skills appear in the Skills page and can be used by agents via commands or direct invocation.
+
+## Status (Session)
+Current state of a session:
+- **idle** — agent is running but not actively processing
+- **working** — agent is actively processing a task (consuming tokens)
+- **completed** — task finished successfully
+- **error** — task failed
+
+## BOOTSTRAP.md
+A first-run ritual file for agents. When an agent starts for the first time in a new workspace, it reads BOOTSTRAP.md, introduces itself, learns who the user is, and together they define the agent's name, personality, tone, and boundaries. The agent then creates/updates SOUL.md, IDENTITY.md, and USER.md, then deletes BOOTSTRAP.md so the ritual never repeats. Used by the Custom agent template.
+
+## Token
+The unit of text processed by an AI model. Input tokens (your prompt) and output tokens (the AI's response) are counted separately and used to calculate cost.
+
+## Tool
+A capability available to agents: running shell commands, reading files, searching the web, etc. Tools can be built-in, from plugins, or from MCP servers.
+
+## Tool Call
+A record of an agent using a tool during a session. Useful for auditing what an agent actually did. Shown in the Session Drawer.
+
+## Traefik
+Optional reverse proxy for routing web traffic to agent containers. If configured, an agent gets a public URL. Rev4a itself runs on port 3740 and does not require Traefik.
+
+## Vault
+Rev4a's credential storage system. Stores provider API keys and third-party service tokens with per-agent permission scoping. Supports reveal (with audit trail), sync to containers, and live detection of installed credentials.
+
+## Workspace
+The directory where an agent's operational files live (config, memory files, skills, plugins, scripts). The Workspace page lets you browse, view, and edit files across the VPS host and all agent containers.
+
+## System Health
+Hardware metrics shown on the Dashboard: CPU usage (%), RAM used/total (MB), disk used/total (GB), system load average (1m). The System Health API (`/api/system-health`) also generates recommendations (e.g. "Consider archiving old sessions to reduce disk usage"). Status can be `ok`, `warn`, or `error`.

package/docs/rag/REV4A-OVERVIEW.md

@@ -0,0 +1,135 @@
+# What is Rev4a?
+
+> **Last updated:** 2026-07-18
+
+Rev4a is the control panel for your AI agent infrastructure. It shows you everything your agents are doing, how much they cost, and whether the system is healthy — all in one dashboard.
+
+## What can you do in Rev4a?
+
+### Dashboard (`/`)
+The main page. See live sessions (who's working right now), cost summary by model and time period (today, 7 days, 30 days), system health (CPU, RAM, disk, load average), and a real-time event feed. Click any session row to open the Session Drawer and see every tool call the agent made. If the onboarding wizard is incomplete, a banner appears at the top with a link to continue.
+
+### Onboarding (`/onboarding`)
+First-run setup wizard that guides new users through configuration. Four steps:
+1. **Welcome** — what Rev4a is and what it can do
+2. **Providers** — add API keys for DeepSeek, OpenAI, OpenRouter, or Groq (saved via the Provider Gateway)
+3. **First Agent** — understand how agents work and what you need to create one
+4. **Ready** — site map of key sections with quick links
+
+The wizard is always accessible from the sidebar. A progress badge (e.g. "1/3") shows how many steps are complete. Once finished, the badge disappears and the dashboard banner goes away.
+
+### Agents (`/agents`)
+Manage Docker containers running OpenClaw agents. See which agents are running, stopped, or errored. Filter by status, view agent details (environment variables, ports, auth tokens, backups, Telegram channels), and create new agents. Each agent card shows its template, status, TG channel chip, and a direct link to its Control UI.
+
+**Agent Creation Wizard** (`/agents/create`) — two-step flow:
+1. Pick a template: **Atlas** (general dev), **Argus** (security/audit), **Prometheus** (client-facing), or **Custom** (blank slate)
+2. Configure: name, optional port, optional model → Deploy
+
+**Custom template:** starts with no preset identity. On first run, the agent runs a bootstrap ritual (BOOTSTRAP.md): introduces itself, asks who the user is, and together they define name, personality, tone, and boundaries. No AI generation needed — it's a native OpenClaw feature.
+
+**Channel Manager:** Each agent detail panel has a "CHANNELS" section with TG status badge and a "Manage Channels" button. The modal lets you:
+- **Telegram:** connect a bot (paste bot token → save → restart agent), disconnect, and manage pairings (approve pending codes, revoke approved senders). Pairings are polled every 5 seconds.
+
+The agent list also shows a compact TG chip next to each agent name (green = connected, hidden if not configured).
+
+The Agents page includes a banner for the **agent base image** (`openclaw-agent-base:latest`):
+- Green: image is up-to-date (no banner shown)
+- Yellow: image is outdated or missing — click "Rebuild Image" to start a build
+- Copper: a build is running in the background — click "View Progress" to open
+  the build modal
+
+The build modal shows live Docker build logs (polled every 2s). You can:
+- **Run in Background** — close the modal, build continues on the server
+- **Abort** — kill the build process; the existing image stays intact
+- **Refresh / re-enter** — opening the modal again resumes log streaming
+  from the last seen line
+
+The build writes logs to `/tmp/rev4a-build-<timestamp>.log` so they survive
+page refreshes and modal closes.
+
+### Create Agent (`/agents/create`)
+Wizard to spin up a new agent. Steps: choose a template (Prometheus, Argus, Atlas, etc.), name your agent, pick a model, set an optional port range (default: auto-assigned 10-port block, e.g. 3700-3709). The agent is created as a Docker container with a persistent volume — all config, workspace files, and credentials survive container restarts.
+
+### Lineage (`/lineage?period=7d`)
+Interactive graph showing session family trees — which agent spawned which child agent, across configurable time periods (1d, 7d, 30d). Click any node to inspect. Includes a live feed side panel.
+
+### Gateway (`/gateway`)
+Central hub connecting agents to AI providers. Two panels:
+- **Provider Sync** — reads the model catalogue from `models.config.json`, discovers which providers have API keys, and syncs the full model list to every agent container
+- **Agent Model Config** — set each agent's primary model and fallback models via `PUT /api/gateway/agent`
+
+### Containers (`/containers`)
+Full list of all Docker containers on the server. See name, image, status, ports, IP, CPU%, and memory usage. Click "Terminal" on any container to open an interactive shell. Use Start/Stop/Restart buttons to manage lifecycle.
+
+### Container Terminal (`/containers/terminal/[id]`)
+Live web terminal into a Docker container. Run commands, inspect files, debug issues — like SSH but in the browser.
+
+### Workspace (`/workspace`)
+File explorer for the OpenClaw workspace. Browse, view, and edit files across workspaces: the VPS host workspace and every agent container workspace. Switch between workspaces via a dropdown. Supports binary file preview (images) and text editing with syntax awareness.
+
+### Credentials (`/credentials`)
+Manage third-party service credentials: GitHub, Trello, Vercel, Supabase, Notion. Each credential can be scoped to specific agent containers. Sync pushes credentials into containers via CLI auth (gh, vercel, supabase) or config files (trello, notion). Live detection shows which credentials are actually installed in each container. Audit trail for every reveal action.
+
+### Crons (`/crons`)
+Scheduled tasks auto-discovered from the host OpenClaw gateway (via `openclaw cron list --json`) and every running Docker container with the `AGENT_ID` label (via `docker exec openclaw cron list --json`). Filter jobs by agent using the toolbar tabs. Each job shows name, description, cron expression, next run, last run, and last status. Toggle on/off per job. The run history panel shows recent cron run executions for the selected job, loaded on demand from the container's gateway.
+
+### Memory / Context (`/memory`)
+Browse agent memory files — MEMORY.md, SOUL.md, IDENTITY.md, USER.md, AGENTS.md, TOOLS.md, HEARTBEAT.md. These files define how agents behave, what they know, and their personality. Also shows total memory budget vs usage.
+
+### Config (`/config`)
+Rev4a application settings. View and modify environment variables (password, tokens, secrets), restart the server. Changes are persisted to `.env`, synced to systemd, and a daemon-reload is triggered.
+
+### Tools (`/tools`)
+Catalog of every tool available to agents — built-in commands, MCP server tools, plugin tools, and audio/TTS configuration. Includes timezone settings.
+
+### Plugins (`/plugins`)
+Browse installed OpenClaw plugins. Enable/disable toggle per plugin. Plugins extend agent capabilities with new tools and integrations.
+
+### Skills (`/skills`)
+Skill registry showing all skills across three sources:
+- **Shared** — global skills from `/docker/shared-skills`, available to all agents
+- **Per-agent** — skills in each agent's workspace (`<workspace>/skills`), shown with agent label
+- **Bundled** — skills shipped with OpenClaw (read-only)
+
+Filter by source, view and edit SKILL.md content, and **promote** agent-local skills to shared with one click.
+
+### Plugins & Skills (`/plugins-skills`)
+Combined view showing both plugins and skills side by side.
+
+### Login (`/login`)
+Password-protected access to the dashboard. Enter the Rev4a password to authenticate. Session persists via a JWT cookie (7-day expiry).
+
+### Vault (`/vault`)
+Credential storage with per-agent permissions. Store API keys and service tokens, scope them to specific agents, and manage permissions via the UI.
+
+## What about Pulse?
+
+Pulse is the AI assistant embedded in Rev4a. She appears as a floating chat button in the bottom-right corner of every page. She can:
+
+- Explain what any page does
+- Guide you through features ("how do I create an agent?")
+- Answer questions about agents, providers, costs, sessions, containers, crons, credentials, and onboarding
+- Give practical tips based on the page you're on
+
+Pulse does NOT have access to live data — she knows the page layout and features, but you need to look at the dashboard for real-time information.
+
+## What is an "agent"?
+
+An agent is an AI assistant that runs tasks autonomously. Each agent has:
+- A name and role (e.g. "Argus" the ops lead)
+- A configured AI model (e.g. GPT-5.4, Claude Sonnet)
+- A workspace with its memory files and configuration
+- Sessions — each time an agent does work, it creates a session
+- A Docker container with a persistent data volume
+- Backups that can be created, restored, and managed from the Agents page
+
+## What is a "session"?
+
+A session is one unit of agent work. It starts when an agent receives a task and ends when the task completes or fails. Sessions track:
+- Tokens used (input and output)
+- Cost in USD
+- Model used
+- Status (idle, working, completed, error)
+- Tool calls made during the session
+
+Sessions can have parent-child relationships (lineage): one agent spawns another to delegate work.