@flame0510/project-aether 1.11.0 → 1.11.1

package/README.md

@@ -39,6 +39,10 @@ rev4a serve
 
 Rev4a auto-builds on first run, generates `.env` with credentials,
 and starts all services. Open `http://localhost:3740` and follow the setup wizard.
+An npm install also builds the dashboard during installation; it fails if the
+production build cannot complete. Startup checks for `.next/BUILD_ID` and retries an
+incomplete build before starting the server. The published package includes a dependency
+lock and the TypeScript packages needed to build from a global installation.
 
 ```bash
 # Custom port:
@@ -84,7 +88,7 @@ already filled in — you normally never set these by hand. See
 | `REV4A_DB` | `<data dir>/data/events.db` | No | SQLite database path |
 | `REV4A_WORKSPACE_ROOT` | — | No | Root exposed by the local file explorer |
 | `REV4A_DEV_ORIGINS` | — | No | Extra comma-separated hostnames or IPs allowed to reach `next dev` (e.g. a LAN address, without scheme or port); no effect on a production build |
-| `REV4A_SKIP_POSTINSTALL_BUILD` | — | No | `1` in CI so `npm ci` skips the post-install `next build`; the workflows build as a separate step. Any non-empty value skips it, `0` included |
+| `REV4A_SKIP_POSTINSTALL_BUILD` | — | No | `1` in CI so `npm ci` skips the post-install `next build`; the workflows build as a separate step. Outside CI, a failed post-install build fails the installation. Any non-empty value skips it, `0` included |
 | `REV4A_AGENT_IMAGE_REGISTRY` | `ghcr.io/flame0510/rev4a/openclaw-agent-base` | No | Registry repository agent images are pulled from, as `<repository>:<OpenClaw version>`. A `localhost` registry is reached over plain HTTP |
 | `REV4A_DOCKER_WAIT_SECONDS` | `90` | No | How long `rev4a serve` waits for the Docker daemon at start-up before starting without it. Capped at 600; `0` checks once; a negative or non-numeric value means 90. Read from the process environment, not from the `.env` file |
 

package/app/agents/CostSection.tsx

@@ -13,6 +13,8 @@ import { PanelRow } from './PanelRow';
 interface AgentCosts {
   available: boolean;
   intervalS: number;
+  /** The vendor band billed right now (DeepSeek peak / off-peak), when one of its models is on offer. */
+  pricing?: { vendor: string; band: 'peak' | 'off-peak'; nextChange: number | null; source: string } | null;
   today?: number;
   week?: number;
   month?: number;
@@ -69,12 +71,18 @@ export default function CostSection({ container }: { container: string }) {
   }
 
   const stale = !data.collectedAt || Date.now() - data.collectedAt > data.intervalS * 3 * 1000;
-  const rows: [string, string][] = [
+  const utcTime = new Intl.DateTimeFormat('en-GB', { hour: '2-digit', minute: '2-digit', hour12: false, timeZone: 'UTC' });
+  // What the gateway charges right now: the band the agent's calls are billed at until the
+  // next change (the rows below are history, priced as each call happened).
+  const rows: [string, string][] = data.pricing ? [
+    ['Rates now', `${data.pricing.vendor} ${data.pricing.band}${data.pricing.nextChange ? ` · until ${utcTime.format(new Date(data.pricing.nextChange))} UTC` : ''}`],
+  ] : [];
+  rows.push(
     ['Today (UTC)', formatCost(data.today)],
     ['Last 7 days', formatCost(data.week)],
     ['Last 30 days', `${formatCost(data.month)} · ${Math.round((data.tokensMonth ?? 0) / 1000)}k tokens`],
     ['Top model (30 days)', data.topModel ? `${data.topModel.model} · ${formatCost(data.topModel.cost)}` : '-'],
-  ];
+  );
   if (data.unpricedMonth) rows.push(['Calls without a price (30 days)', String(data.unpricedMonth)]);
   rows.push(['Last read', data.collectedAt ? formatAge(Date.now() - data.collectedAt) : 'never']);
 

package/app/api/costs/agent/route.ts

@@ -1,11 +1,26 @@
 import { NextResponse, type NextRequest } from 'next/server';
 import { openCostsDb } from '@/lib/costs-db';
 import { COLLECT_INTERVAL_S, lastDays, readCostSummary } from '@/lib/agent-costs';
+import { loadOfferedModels } from '@/lib/model-catalogue';
+import { nextPriceChange, priceBandAt, priceScheduleFor } from '@/lib/model-pricing';
 import { CONTAINER_NAME_RE } from '@/lib/docker-stats';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
 
 export const dynamic = 'force-dynamic';
 
+/** The band DeepSeek bills at right now, when one of its models is on offer — the same object the Costs page header shows. Never throws: the panel's poll must not 500 over a broken key or catalogue file. */
+function currentPricing() {
+  try {
+    const scheduled = loadOfferedModels().map((m) => m.id).filter((id) => priceScheduleFor(id));
+    if (!scheduled.length) return null;
+    const pricingAt = new Date();
+    const next = nextPriceChange(scheduled, pricingAt);
+    return { vendor: 'DeepSeek', band: priceBandAt(scheduled[0], pricingAt), nextChange: next ? next.getTime() : null, source: priceScheduleFor(scheduled[0])!.source };
+  } catch {
+    return null;
+  }
+}
+
 /**
  * GET /api/costs/agent?container=<name> — one agent's spend for its panel: today, the
  * last 7 and 30 UTC days, its top model and unpriced calls over 30 days, and when it
@@ -18,13 +33,15 @@ export async function GET(request: NextRequest): Promise<NextResponse> {
   const container = request.nextUrl.searchParams.get('container') ?? '';
   if (!CONTAINER_NAME_RE.test(container)) return NextResponse.json({ error: 'Invalid container name' }, { status: 400 });
 
+  const pricing = currentPricing();
+
   let db;
   try {
     db = openCostsDb();
   } catch (e) {
     return NextResponse.json({ error: `costs.db could not be read: ${(e as Error).message}` }, { status: 500 });
   }
-  if (!db) return NextResponse.json({ available: false, intervalS: COLLECT_INTERVAL_S });
+  if (!db) return NextResponse.json({ available: false, intervalS: COLLECT_INTERVAL_S, pricing });
 
   try {
     const dates = lastDays(30);
@@ -38,6 +55,7 @@ export async function GET(request: NextRequest): Promise<NextResponse> {
     return NextResponse.json({
       available: true,
       intervalS: COLLECT_INTERVAL_S,
+      pricing,
       today: sum(1),
       week: sum(7),
       month: s.totals.cost,

package/app/api/gateway/provider/route.ts

@@ -10,7 +10,7 @@ import { execSync } from 'child_process';
 import { readProviderKeys, writeProviderKeys } from './keys';
 import { dockerUnreachableReason, syncAllAgents, type SyncOutcome } from '../sync';
 import { detectProviderGatewayUrl } from '@/lib/docker-utils';
-import { getPricing } from '@/lib/model-pricing';
+import { getPricing, nextPriceChange, priceAt, priceBandAt } from '@/lib/model-pricing';
 import { getModelParams } from '@/lib/model-details';
 import { PROVIDER_LABELS } from '@/lib/provider-labels';
 import { loadModelsConfig, toggleModelOverride, type ModelConfigEntry } from '@/lib/model-catalogue';
@@ -172,6 +172,7 @@ export async function GET(request: NextRequest) {
   // Sizes for the row's "next to the price" hint: open-weight models only (see
   // docs/dev/GATEWAY.md), absent for a model whose vendor does not publish one.
   const paramsByModel = getModelParams();
+  const pricingAt = new Date();
 
   const providers = Object.entries(PROVIDER_CONFIGS).map(([key, cfg]) => {
     const providerModels = allModels.filter((m) => m.provider === key);
@@ -190,12 +191,29 @@ export async function GET(request: NextRequest) {
         }
         if (m.modality) entry.modality = m.modality;
         if (paramsByModel[m.id]) entry.params = paramsByModel[m.id];
+        // The band billed right now for a time-of-day vendor (DeepSeek peak / off-peak):
+        // null for every model priced the same all day. The synced agent prices follow it
+        // (lib/price-schedule-sync.ts); the row shows the same thing — including the price,
+        // which is the rate in force now, not the peak list price.
+        const band = priceBandAt(m.id, pricingAt);
+        if (band) {
+          entry.band = band;
+          // The live OpenRouter overlay outranks the static band arithmetic (disjoint
+          // today — only `deepseek` is scheduled, only `openrouter/*` is live-priced —
+          // but keep it explicit so a future schedule never silent-replaces live prices).
+          if (!entry.pricingLive) {
+            const now = priceAt(m.id, pricingAt);
+            if (now) entry.pricing = now;
+          }
+        }
         return entry;
       }),
       ...(providerKeys[key] ? { apiKey: providerKeys[key] } : {}),
     };
   });
-  return NextResponse.json({ providers });
+  // When the band flips next, so an open page can refresh the chips right after it.
+  const nextChange = nextPriceChange(allModels.map((m) => m.id), pricingAt);
+  return NextResponse.json({ providers, nextPriceChangeMs: nextChange ? nextChange.getTime() : null });
 }
 
 /**

package/app/api/update-check/route.ts

@@ -1,8 +1,9 @@
 import { NextResponse } from 'next/server';
-import { execSync } from 'child_process';
-import { readFileSync } from 'fs';
+import { execSync, spawn } from 'child_process';
+import { appendFileSync, closeSync, mkdirSync, openSync, readFileSync } from 'fs';
 import { join } from 'path';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
+import { REV4A_DATA } from '@/lib/rev4a-paths';
 
 // Fallback used only when package.json cannot be read — the published npm
 // package name is the single source of truth, so never hardcode it elsewhere.
@@ -103,14 +104,15 @@ export async function POST(request: Request): Promise<NextResponse> {
   const denied = await requireAuthJWT(request);
   if (denied) return denied;
 
-  const { spawn } = require('child_process');
-  const { join } = require('path');
-  const { openSync, closeSync, appendFileSync } = require('fs');
-
-  const dataDir = process.env.REV4A_DATA_DIR ||
-    join(process.env.HOME || '/root', '.config', 'rev4a', 'data');
+  const dataDir = join(REV4A_DATA, 'data');
   const logPath = join(dataDir, 'update.log');
 
+  try {
+    mkdirSync(dataDir, { recursive: true });
+  } catch {
+    return NextResponse.json({ success: false, error: 'Could not prepare the update directory.' }, { status: 500 });
+  }
+
   let log: number | null = null;
   try {
     log = openSync(logPath, 'a');
@@ -126,9 +128,16 @@ export async function POST(request: Request): Promise<NextResponse> {
   });
   if (log !== null) closeSync(log);
 
-  child.on('error', (e: Error) => {
-    try { appendFileSync(logPath, `[dashboard] could not start the update: ${e.message}\n`); } catch {}
-  });
+  try {
+    await new Promise<void>((resolve, reject) => {
+      child.once('spawn', resolve);
+      child.once('error', reject);
+    });
+  } catch (e) {
+    const message = e instanceof Error ? e.message : String(e);
+    try { appendFileSync(logPath, `[dashboard] could not start the update: ${message}\n`); } catch {}
+    return NextResponse.json({ success: false, error: 'Could not start the update.' }, { status: 500 });
+  }
   child.unref();
 
   return NextResponse.json({

package/app/gateway/ModelDetailsModal.tsx

@@ -24,7 +24,7 @@ interface DetailsView {
   modality?: string;
   enabled: boolean;
   deprecated: boolean;
-  price: { input: number; output: number; source: 'openrouter' | 'vendor' } | null;
+  price: { input: number; output: number; source: 'openrouter' | 'vendor'; scheduled: boolean } | null;
   details: {
     description?: string;
     created?: string;
@@ -182,7 +182,9 @@ export default function ModelDetailsModal({ modelId, onClose }: { modelId: strin
           <div style={{ fontSize: 10, color: 'var(--violet)', textTransform: 'uppercase', letterSpacing: '0.08em', margin: '12px 0 4px' }}>Price</div>
           <PropertyList rows={[
             { label: 'Input / output', value: formatPrice(view.price) },
-            ...(view.price ? [{ label: 'Per 1M tokens, from', value: view.providerLabel, dim: true }] : []),
+            // The static file holds the list (peak) rate for a time-of-day vendor; the row
+            // behind this modal shows the rate in force. Name the difference, not the vendor twice.
+            ...(view.price ? [{ label: 'Per 1M tokens, from', value: view.price.scheduled ? `${view.providerLabel} · list price` : view.providerLabel, dim: true }] : []),
           ]} />
 
           {/* Architecture: the factory facts from the model card, open weights only */}

package/app/gateway/PageClient.tsx

@@ -23,6 +23,8 @@ interface ModelInfo {
   modality?: string;
   /** Total parameters, when the model's card publishes them (open weights only). */
   params?: number;
+  /** The vendor band billed right now (DeepSeek peak / off-peak); absent for fixed-rate models. */
+  band?: 'peak' | 'off-peak';
 }
 
 interface GatewayProvider {
@@ -37,6 +39,8 @@ interface GatewayProvider {
 
 interface ProviderApiResponse {
   providers: GatewayProvider[];
+  /** When the band flips next, so an open page refreshes the chips just after it. */
+  nextPriceChangeMs?: number | null;
 }
 
 /* ------------------------------------------------------------------ */
@@ -100,15 +104,25 @@ export default function GatewayPageClient() {
   // Accordion state — which provider cards are expanded
   const [expandedProviders, setExpandedProviders] = useState<Set<string>>(new Set());
   const expandedInitRef = useRef(false);
+  const loadAbortRef = useRef<AbortController | null>(null);
+  const [bandChangeAt, setBandChangeAt] = useState<number | null>(null);
+  const [retryAt, setRetryAt] = useState<number | null>(null);
 
   /* ---- Data loading ---- */
-  const loadAll = useCallback(async () => {
-    setLoading(true);
+  const loadAll = useCallback(async (silent = false) => {
+    loadAbortRef.current?.abort();
+    const controller = new AbortController();
+    loadAbortRef.current = controller;
+    if (!silent) setLoading(true);
     try {
-      const provRes = await fetch('/api/gateway/provider');
-      if (provRes.ok) {
+      const provRes = await fetch('/api/gateway/provider', { signal: controller.signal });
+      if (!provRes.ok) throw new Error(`Could not load providers (HTTP ${provRes.status})`);
+      setError(null);
+      setRetryAt(null);
+      {
         const provJson: ProviderApiResponse = await provRes.json();
         setProviders(provJson.providers);
+        setBandChangeAt(provJson.nextPriceChangeMs ?? null);
 
         // Auto-expand configured providers on first load
         if (!expandedInitRef.current) {
@@ -119,51 +133,79 @@ export default function GatewayPageClient() {
           });
           if (configured.size > 0) setExpandedProviders(configured);
         }
-        // Load keys from provider response (all configured providers now return apiKey)
-        const keyEntries: Record<string, string> = {};
-        const origEntries: Record<string, string> = {};
-        provJson.providers.forEach((p: any) => {
-          if (p.configured && p.apiKey) {
-            keyEntries[p.provider] = p.apiKey;
-            origEntries[p.provider] = p.apiKey;
-          }
-        });
-        setApiKeyInputs((prev) => ({ ...prev, ...keyEntries }));
-        setOriginalKeys((prev) => ({ ...prev, ...origEntries }));
-
-        // Auto-fetch balances for supported providers that have keys configured
-        const balanceProvs = provJson.providers
-          .filter((p: any) => p.configured && ['deepseek','openrouter','glm'].includes(p.provider))
-          .map((p: any) => p.provider);
-        for (const bp of balanceProvs) {
-          try {
-            const bRes = await fetch(`/api/gateway/provider/balance?provider=${bp}`);
-            const bJson = await bRes.json();
-            if (bRes.ok && bJson.balance) {
-              setBalances((prev) => ({ ...prev, [bp]: { balance: bJson.balance, label: bJson.label } }));
-            } else if (bJson.reason === 'no-balance-api') {
-              // Permanent: this provider has no balance API for the account — hide the badge.
-              setBalances((prev) => ({ ...prev, [bp]: { balance: '', unsupported: true } }));
-            } else {
-              setBalances((prev) => ({ ...prev, [bp]: { balance: '—', error: bJson.error || 'Failed' } }));
+        // A scheduled band refresh only updates model rows. It must not overwrite a key
+        // the operator is editing or re-run the slower balance requests.
+        if (!silent) {
+          // Load keys from provider response (all configured providers now return apiKey)
+          const keyEntries: Record<string, string> = {};
+          const origEntries: Record<string, string> = {};
+          provJson.providers.forEach((p: any) => {
+            if (p.configured && p.apiKey) {
+              keyEntries[p.provider] = p.apiKey;
+              origEntries[p.provider] = p.apiKey;
+            }
+          });
+          setApiKeyInputs((prev) => ({ ...prev, ...keyEntries }));
+          setOriginalKeys((prev) => ({ ...prev, ...origEntries }));
+
+          // Auto-fetch balances for supported providers that have keys configured
+          const balanceProvs = provJson.providers
+            .filter((p: any) => p.configured && ['deepseek','openrouter','glm'].includes(p.provider))
+            .map((p: any) => p.provider);
+          for (const bp of balanceProvs) {
+            try {
+              const bRes = await fetch(`/api/gateway/provider/balance?provider=${bp}`, { signal: controller.signal });
+              const bJson = await bRes.json();
+              if (bRes.ok && bJson.balance) {
+                setBalances((prev) => ({ ...prev, [bp]: { balance: bJson.balance, label: bJson.label } }));
+              } else if (bJson.reason === 'no-balance-api') {
+                // Permanent: this provider has no balance API for the account — hide the badge.
+                setBalances((prev) => ({ ...prev, [bp]: { balance: '', unsupported: true } }));
+              } else {
+                setBalances((prev) => ({ ...prev, [bp]: { balance: '—', error: bJson.error || 'Failed' } }));
+              }
+            } catch (e: unknown) {
+              if ((e as Error)?.name === 'AbortError') throw e;
+              setBalances((prev) => ({ ...prev, [bp]: { balance: '—', error: e instanceof Error ? e.message : String(e) } }));
             }
-          } catch (e: unknown) {
-            setBalances((prev) => ({ ...prev, [bp]: { balance: '—', error: e instanceof Error ? e.message : String(e) } }));
           }
         }
       }
     } catch (e: unknown) {
-      setError(e instanceof Error ? e.message : String(e));
+      if ((e as Error)?.name !== 'AbortError') {
+        setError(e instanceof Error ? e.message : String(e));
+        if (silent) setRetryAt(Date.now() + 60_000);
+      }
     } finally {
-      setLoading(false);
+      if (loadAbortRef.current === controller) {
+        loadAbortRef.current = null;
+        setLoading(false);
+      }
     }
   }, []);
 
-  useEffect(() => { void loadAll(); }, [loadAll]);
+  useEffect(() => {
+    void loadAll();
+    return () => { loadAbortRef.current?.abort(); };
+  }, [loadAll]);
+
+  // Band chips: when a rate change is due, reload just past it — silently, so an open page
+  // flips PEAK / OFF-PEAK with the prices the agents actually get, without flickering skeletons.
+  useEffect(() => {
+    const next = retryAt ?? bandChangeAt;
+    if (!next) return;
+    const t = setTimeout(() => { void loadAll(true); }, Math.max(5_000, next - Date.now() + (retryAt ? 0 : 2_000)));
+    return () => { clearTimeout(t); };
+  }, [bandChangeAt, retryAt, loadAll]);
 
   /** Format pricing for display — shared with the details modal (app/lib/model-format.ts). */
   const fmtPrice = formatPrice;
 
+  /** The band chips' tooltip: when the band in force now ends, in UTC. */
+  const bandUntilLabel = bandChangeAt
+    ? new Intl.DateTimeFormat('en-GB', { hour: '2-digit', minute: '2-digit', hour12: false, timeZone: 'UTC' }).format(new Date(bandChangeAt))
+    : null;
+
   /**
    * Local model filter. Matches against both the display name and the id,
    * because the upstream vendor often only appears in one of them — e.g.
@@ -658,6 +700,14 @@ export default function GatewayPageClient() {
                                   <span style={{ marginLeft: 8, color: 'var(--violet)', fontWeight: 500 }}>
                                     {fmtPrice(pricing)}
                                   </span>
+                                  {m.band && (
+                                    <span
+                                      title={`Time-of-day rates: ${m.band} until ${bandUntilLabel ? `${bandUntilLabel} UTC` : 'the next change'} — the agents' synced prices follow the band.`}
+                                      style={{ marginLeft: 6, display: 'inline-block', verticalAlign: 'middle' }}
+                                    >
+                                      <Pill tone={m.band === 'peak' ? 'warning' : 'success'}>{m.band === 'peak' ? 'PEAK' : 'OFF-PEAK'}</Pill>
+                                    </span>
+                                  )}
                                   {typeof m.params === 'number' && (
                                     <span
                                       style={{ marginLeft: 8, color: 'var(--text-dim)' }}

package/app/system/PageClient.tsx

@@ -54,6 +54,8 @@ interface MetricsPayload {
 }
 
 const ROLE_LABEL: Record<string, string> = { root: 'system', docker: 'Docker data', data: 'Rev4a data' };
+/** A filesystem's display name: the bare "/" is the root volume — clearer as a word. Its mount stays in the aria-label and, for other filesystems, is the name. */
+const diskLabel = (mount: string) => (mount === '/' ? 'Root' : mount);
 
 function formatUptime(s: number): string {
   const d = Math.floor(s / 86_400);
@@ -194,7 +196,7 @@ export default function SystemPageClient() {
           {latest?.disks.map((d) => (
             <div key={d.mount} style={{ marginTop: 14 }}>
               <div style={{ display: 'flex', alignItems: 'baseline', justifyContent: 'space-between', gap: 8, flexWrap: 'wrap' }}>
-                <span style={{ fontSize: 13 }}>{d.mount}</span>
+                <span style={{ fontSize: 13 }}>{diskLabel(d.mount)}</span>
                 <span style={{ display: 'flex', gap: 4, flexWrap: 'wrap' }}>
                   {d.roles.map((r) => <Pill key={r}>{ROLE_LABEL[r] ?? r}</Pill>)}
                 </span>
@@ -240,7 +242,7 @@ export default function SystemPageClient() {
         </Surface>
         {(data?.disk_history ?? []).map((d) => (
           <Surface as="section" key={d.mount}>
-            <div className="ui-kicker">Storage · {d.mount}</div>
+            <div className="ui-kicker">Storage · {diskLabel(d.mount)}</div>
             <TimeSeriesChart
               label={`Storage in use on ${d.mount}`}
               points={d.points.map((p) => ({ ts: p.ts, value: p.percent }))}

package/bin/postinstall.js

@@ -1,24 +1,27 @@
 #!/usr/bin/env node
 /**
- * Post-install hook: build Next.js app if .next doesn't exist.
+ * Post-install hook: build Next.js app if a complete production build is absent.
  *
  * Skipped when REV4A_SKIP_POSTINSTALL_BUILD is set: CI and the release workflow run
  * `npm run build` as an explicit step, and a second build here would run before every
- * other check and swallow its own failure.
+ * other check. A failed build must fail the install so an update cannot restart into
+ * an incomplete .next directory.
  */
 const { existsSync } = require('fs');
 const { join } = require('path');
 
 const ROOT = join(__dirname, '..');
-const NEXT_DIR = join(ROOT, '.next');
+const BUILD_ID = join(ROOT, '.next', 'BUILD_ID');
 
-if (!process.env.REV4A_SKIP_POSTINSTALL_BUILD && !existsSync(NEXT_DIR)) {
+if (!process.env.REV4A_SKIP_POSTINSTALL_BUILD && !existsSync(BUILD_ID)) {
   try {
     const { execSync } = require('child_process');
     console.log('[rev4a] Building dashboard… (one-time, may take a minute)');
     execSync('npx next build', { cwd: ROOT, stdio: 'inherit' });
+    if (!existsSync(BUILD_ID)) throw new Error('next build returned without a BUILD_ID');
     console.log('[rev4a] Build complete.');
   } catch (e) {
     console.error('[rev4a] Build failed. Run "rev4a build" to retry.');
+    process.exitCode = 1;
   }
 }

package/bin/rev4a.js

@@ -431,6 +431,7 @@ function build() {
     // Generous on purpose: a build is the slowest step of an install, and killing it
     // because it passed two minutes takes the server down over slowness alone.
     execSync('npx next build', { stdio: 'inherit', cwd: ROOT, timeout: 30 * 60_000 });
+    if (!existsSync(join(NEXT_DIR, 'BUILD_ID'))) throw new Error('next build returned without a BUILD_ID');
     log('BUILD', 'Build complete');
   } catch (err) {
     log('BUILD', `Build failed: ${err.message}`);
@@ -487,8 +488,8 @@ function preflight() {
   }
   ensureRev4aRules();
 
-  if (!existsSync(NEXT_DIR)) {
-    log('PREFLIGHT', 'No build found — running build first…');
+  if (!existsSync(join(NEXT_DIR, 'BUILD_ID'))) {
+    log('PREFLIGHT', 'No complete build found — running build first…');
     build();
   }
 }
@@ -769,11 +770,9 @@ if (cmd === 'update') {
         stdio: 'inherit',
         timeout: 20 * 60_000,
       });
-      // Wipe old build so rev4a serve rebuilds with the new version
-      const nextDir = join(ROOT, '.next');
-      if (existsSync(nextDir)) {
-        try { execSync(`rm -rf "${nextDir}"`, { stdio: 'inherit' }); } catch {}
-      }
+      // postinstall builds the freshly installed package and fails the install if it
+      // cannot; keep that build for the restart. The fallback covers a skipped build.
+      if (!existsSync(join(ROOT, '.next', 'BUILD_ID'))) build();
     }
     console.log('Update complete. Restarting…');
     try {

package/docs/FRONTEND-ARCHITECTURE.md

@@ -1,6 +1,6 @@
 # Rev4a Frontend Architecture
 
-> **Last updated:** 2026-10-01
+> **Last updated:** 2026-10-02
 
 ## Layering
 
@@ -48,9 +48,9 @@ All shared UI primitives live in `app/components/ui/` and are exported from `app
 | `BackupSection` | inline in `app/agents/PageClient.tsx` | BACKUP section of the agent detail panel, on the cold backup and the restore. **Backup Now** starts `POST /api/agents/[id]/cold-backup`; while the job runs a banner shows the file and its live percent with **Cancel** (`DELETE /cold-backup`). **Restore** (after a confirm) starts `POST /restore` and a banner shows `Restoring <file>…` (no percent: the extract is a single `tar xzf`, and there is no Cancel). Both sections poll their `GET` every 2 s while running, and on mount pick up a job that is already running — a backup lives in a Docker helper, a restore in `agent_restores`, so reloading the page or navigating away never loses them nor allows a second one (the server answers 409 anyway). Delete per row; all actions disabled while one runs; keyed busy state `{ kind, file }` so only the row in action shows the spinner. On the agent list, an activity Badge (fed by `/api/agents/activity-summary`, polled at 2 s only while something runs, otherwise riding the 15 s list poll) reads `BACKUP nn%`, `RESTORING`, `RECREATING`, `EDITING` or `UPDATING`. |
 | `RecreateSection` | inline in `app/agents/PageClient.tsx` | RECREATE section of the agent detail panel. **Recreate Container** starts `POST /api/agents/[id]/recreate` (202) after a confirm; a banner then shows the phase — *Backing up … nn%* while the cold backup runs, *Recreating container…* while the container is rebuilt and the gateway starts. The section polls `GET /recreate` every 2 s, and on mount picks up a recreate that is already running, so a reload or navigation never loses it; it refetches the agent once the job reports `done`. |
 | `Accordion` | `Accordion.tsx` | A row that opens: the header is a real `<button type="button">` (`aria-expanded`, `aria-controls` while open) carrying a `title`, `summary` figures and an optional muted `detail` line, so the answer to "what is this now" is on screen closed; the body holds what takes room and is **mounted only while open**, so a chart inside fetches nothing while closed. Controlled (`open` / `onToggle`: the parent can deep-link or fetch on it), optional `id` for a link to land on. Square, flat, tokens only. On mobile the summary wraps under the title. Used by the System page's agents. |
-| System page | `app/system/PageClient.tsx` | `/system`: CPU, memory and storage of the host, from `GET /api/metrics`. Three cards (CPU with cores and load; memory with available and swap; one `Meter` per filesystem with its roles) — thresholds 85/95 % for CPU and memory, 80/90 % for storage — then a range switch (`Tabs`: 1h · 24h · 7d · 30d) scoping the charts below it: CPU and memory average with peak, one chart per filesystem. Polls every 30 s with an `AbortController` ref (a range change aborts the previous fetch). Times in the configured Rev4a timezone (`useRev4aTimezone`). Before the first answer the cards and charts are skeletons shaped like them (`app/system/SystemSkeleton.tsx`, also the route's `loading.tsx`), so nothing jumps; the hostname line is cut with an ellipsis and never widens the page. Says *No samples yet* before the daemon's first sample and *Not collecting* when the latest sample is older than three intervals. Two columns of charts from lg (992px) up, one below; an odd last chart spans both columns instead of leaving a hole. Under them, **Agents and containers** (`app/system/AgentsSection.tsx`, heading in the accent eyebrow with a rule above — `system-section-heading`): *Docker storage* (images, volumes, writable layers, build cache, each with what no container uses — wording neutral on purpose: an unused image may be a rollback target, an unused volume the cold backups), then **one `Accordion` per container**, sorted by CPU now (`GET /api/metrics/containers`, polled every 30 s with an `AbortController` ref). Closed: name, an *agent* / *container* pill, *stopped* when it is — or *no data* when Docker still lists it but its stats call fails — and CPU (share of Docker's cores), memory, storage, PIDs, with average · peak over the range tabs, cores, network and memory share on a muted line. Open (`AgentCharts.tsx`): the same three charts as the machine — CPU (share), Memory, Storage — for that container, fetched when it opens (`?container=`), polled every 30 s, aborted on close or range change; each with `yMax="auto"` (an agent is 0.01–2 % of Docker's cores) and sizes in MB/GB, on `subtle` surfaces inside the accordion. A last row, *Everything else*, is the machine minus the containers. `/system?agent=<container>` opens one and scrolls to it. Then **Recent alerts** (`RecentAlerts.tsx`, `GET /api/metrics/alerts`): the machine's latest 10 anomalies with time (configured timezone), metric pill and message. The section has its own skeleton (`SystemAgentsSkeleton`, also in the route's `loading.tsx`). |
+| System page | `app/system/PageClient.tsx` | `/system`: CPU, memory and storage of the host, from `GET /api/metrics`. Three cards (CPU with cores and load; memory with available and swap; one `Meter` per filesystem (titled by its mount, the root volume as *Root*) with its roles) — thresholds 85/95 % for CPU and memory, 80/90 % for storage — then a range switch (`Tabs`: 1h · 24h · 7d · 30d) scoping the charts below it: CPU and memory average with peak, one chart per filesystem. Polls every 30 s with an `AbortController` ref (a range change aborts the previous fetch). Times in the configured Rev4a timezone (`useRev4aTimezone`). Before the first answer the cards and charts are skeletons shaped like them (`app/system/SystemSkeleton.tsx`, also the route's `loading.tsx`), so nothing jumps; the hostname line is cut with an ellipsis and never widens the page. Says *No samples yet* before the daemon's first sample and *Not collecting* when the latest sample is older than three intervals. Two columns of charts from lg (992px) up, one below; an odd last chart spans both columns instead of leaving a hole. Under them, **Agents and containers** (`app/system/AgentsSection.tsx`, heading in the accent eyebrow with a rule above — `system-section-heading`): *Docker storage* (images, volumes, writable layers, build cache, each with what no container uses — wording neutral on purpose: an unused image may be a rollback target, an unused volume the cold backups), then **one `Accordion` per container**, sorted by CPU now (`GET /api/metrics/containers`, polled every 30 s with an `AbortController` ref). Closed: name, an *agent* / *container* pill, *stopped* when it is — or *no data* when Docker still lists it but its stats call fails — and CPU (share of Docker's cores), memory, storage, PIDs, with average · peak over the range tabs, cores, network and memory share on a muted line. Open (`AgentCharts.tsx`): the same three charts as the machine — CPU (share), Memory, Storage — for that container, fetched when it opens (`?container=`), polled every 30 s, aborted on close or range change; each with `yMax="auto"` (an agent is 0.01–2 % of Docker's cores) and sizes in MB/GB, on `subtle` surfaces inside the accordion. A last row, *Everything else*, is the machine minus the containers. `/system?agent=<container>` opens one and scrolls to it. Then **Recent alerts** (`RecentAlerts.tsx`, `GET /api/metrics/alerts`): the machine's latest 10 anomalies with time (configured timezone), metric pill and message. The section has its own skeleton (`SystemAgentsSkeleton`, also in the route's `loading.tsx`). |
 | Costs page | `app/costs/PageClient.tsx` | `/costs`: what each agent spent, as its own OpenClaw priced it, from `GET /api/costs/usage`. A range switch (`Tabs`: Today · 7 days · 30 days, UTC days) scopes everything below it: three cards (spent with tokens and days; the cost split into input / output / cache read / cache write; the tokens with the share of input served from cache), the daily spend (`TimeSeriesChart` with dollars, not on Today), then *By agent* and *By model* side by side — each row a name and figure over a share `Meter`, the pattern of the System storage card — *Against the bill* (per vendor, what it billed, from balance or usage readings, next to what the agents priced over the same readings, top-ups apart), and the most expensive sessions. Warnings above: *No figures yet* before the daemon's first pass, *Not current* for agents still being read whose last read failed or is older than three intervals (a stopped or deleted agent keeps its figures unflagged), and *Calls without a price* by model (a model with no price is also marked in *By model*, so a $0.00 is never read as free). The header shows the DeepSeek band now (peak / off-peak, until when, UTC) when a DeepSeek model is on offer. Polls every 60 s with an `AbortController` ref. Skeletons shaped like the content (`app/costs/CostsSkeleton.tsx`, also the route's `loading.tsx`). Costs under a cent keep four decimals. |
-| Agent costs | `app/agents/CostSection.tsx` | The COSTS section of the agent panel, after MODEL: today (UTC), last 7 and 30 days with tokens, the top model, calls without a price, when the agent was last read (a note when not recently: a stopped agent keeps its last figures), and a link to `/costs`. From `GET /api/costs/agent`, every 60 s with an `AbortController` ref. |
+| Agent costs | `app/agents/CostSection.tsx` | The COSTS section of the agent panel, after MODEL: the rates in force now (`Rates now`: DeepSeek peak / off-peak with the UTC time of the next change, when a scheduled model is on offer — the same object as the Costs page header), today (UTC), last 7 and 30 days with tokens, the top model, calls without a price, when the agent was last read (a note when not recently: a stopped agent keeps its last figures), and a link to `/costs`. From `GET /api/costs/agent`, every 60 s with an `AbortController` ref. |
 | Agent resources | `app/agents/ResourceSection.tsx` | The RESOURCES section of the agent panel, after COSTS: CPU and memory now and over the last 24 h, processes, network, storage (volume and layer), from `GET /api/metrics/containers`, every 60 s with an `AbortController` ref, reset on agent switch; *Stopped* when the agent is not running, *Not collecting* when the newest sample is older than three intervals (the "now" figures then stand down), a refresh-failure line while the last answer stays, and a link to its charts on `/system?agent=<container>` — the history lives in one place. Rows are the shared `PanelRow` (`app/agents/PanelRow.tsx`, also used by COSTS). |
 | Containers page | `app/containers/ContainersClient.tsx` | `/containers`: one card per Docker container; a running one the daemon has sampled adds a line — CPU share, memory, PIDs — and *Charts →* to its accordion on `/system`. The figures are a bonus: a daemon that has not sampled yet, or a failed request, leaves the list as it was. |
 | Machine card | `app/components/SystemCockpit.tsx` | On the dashboard, next to Active sessions: CPU, RAM and the fullest disk now, each figure coloured only when past its threshold (same thresholds as the System page), the issues named in words, and a link to `/system`. It says *No samples yet* before the first sample, *Not collecting* when the newest is stale, and *Metrics unavailable* when a refresh fails (keeping the last figures). A `Surface`, not a `Metric`: a danger `Metric` paints its whole value red. |

package/docs/REV4A.md

@@ -1,6 +1,6 @@
 # Rev4a — VPS Dashboard
 
-> **Last updated:** 2026-10-01
+> **Last updated:** 2026-10-02
 
 A Next.js 16 dashboard for monitoring and managing the OpenClaw ecosystem.
 
@@ -56,7 +56,7 @@ Rev4a reads the following environment variables. Set them in `/config` (UI) or d
 | `REV4A_AGENT_IMAGE_REGISTRY` | No | Registry repository agent images are pulled from (default: `ghcr.io/flame0510/rev4a/openclaw-agent-base`); a `localhost` registry is reached over plain HTTP |
 | `REV4A_DOCKER_WAIT_SECONDS` | No | How long `rev4a serve` waits for the Docker daemon at start-up (default `90`, capped at 600) |
 | `REV4A_DEV_ORIGINS` | No | Extra comma-separated hostnames or IPs allowed to reach `next dev`; no effect on a production build |
-| `REV4A_SKIP_POSTINSTALL_BUILD` | No | `1` in CI: `npm ci` then skips the post-install `next build` (the workflows build as a separate step). Any non-empty value skips it, `0` included — leave it unset to build |
+| `REV4A_SKIP_POSTINSTALL_BUILD` | No | `1` in CI: `npm ci` then skips the post-install `next build` (the workflows build as a separate step). An installation build failure exits non-zero; startup checks `.next/BUILD_ID` before serving. Any non-empty value skips the post-install build, `0` included — leave it unset to build |
 
 See [Alerts](#alerts-telegram) below for the Telegram alert variables.
 
@@ -198,7 +198,7 @@ that too; run Sync All Agents once Docker is up.
 ### Memory (a host that runs several agents)
 
 `rev4a update` installs the new version and the server rebuilds Next before it comes
-back (`rev4a` wipes `.next`, so the build always runs). That build is the memory peak
+back (the install's postinstall build, or a startup build when none exists). That build is the memory peak
 of the whole installation: with several agent Gateways resident (roughly 0.5-0.8 GB
 each) a host with no swap can hit the kernel OOM killer during the update — it killed
 `next-server` on a 7.7 GB VPS, which then stayed unreachable until a reboot.
@@ -450,6 +450,9 @@ repo. The copy is skipped when the workspace is already populated (see
 One job: provider configuration. API keys, which catalogue models this deployment
 offers, and pushing that catalogue to every agent.
 
+For DeepSeek models, each model row shows the current peak/off-peak band and its
+current rate. An open page refreshes those figures after the next band change.
+
 - Reads the model catalogue from `models.config.json`, merged with user toggles in
   `<data dir>/model-overrides.json`
 - Scans providers with keys in `<data dir>/provider-keys.json`