@flame0510/project-aether 1.6.1 → 1.7.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Michele Tornello
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -13,11 +13,12 @@
 - **Agent creation wizard** — Pick a template (Atlas, Prometheus, Argus), choose an LLM model, deploy an agent in seconds
 - **Provider sync** — Add API keys once, push them to all agent containers with one click
 - **Model configuration** — Change the primary model and fallbacks per agent, from the detail panel on the Agents page. Providers: OpenAI, Anthropic, Google, DeepSeek, Groq, Kimi, GLM, Qwen, plus OpenRouter as an aggregator.
+- **Model details** — Every model row opens a modal with its description, price and provider, architecture and parameter count (mixture of experts, context, vision encoder, precision, weights on disk), reasoning modes, capabilities, benchmarks with sources and licence. Numbers come from the model card on Hugging Face plus curated entries that cite a source; nothing is estimated
 - **Shared gateway token** — One token to rule all agents. Manage from the dashboard, sync to all containers
 - **Live event stream** — Real-time session lineage, agent spawning, cost reporting
 - **Workspace browser** — Browse and edit agent files live from the dashboard
 - **Provider proxy** — OpenAI-compatible chat completions proxy that routes through a shared key vault
-- **System health** — CPU, RAM, disk, Docker daemon status, recommendations
+- **System health** — runtime sessions, event ingestion and errors, cron jobs and usage cost, with recommendations
 - **Cost tracking** — Per-session, per-model, per-time-range usage and cost reporting
 - **PWA-ready** — Install on phone for mobile monitoring
 
@@ -81,6 +82,8 @@ already filled in — you normally never set these by hand. See
 | `REV4A_DATA_DIR` | `~/.config/rev4a` | No | Root of all persistent data |
 | `REV4A_DB` | `<data dir>/data/events.db` | No | SQLite database path |
 | `REV4A_WORKSPACE_ROOT` | — | No | Root exposed by the local file explorer |
+| `REV4A_DEV_ORIGINS` | — | No | Extra comma-separated hostnames or IPs allowed to reach `next dev` (e.g. a LAN address, without scheme or port); no effect on a production build |
+| `REV4A_SKIP_POSTINSTALL_BUILD` | — | No | `1` in CI so `npm ci` skips the post-install `next build`; the workflows build as a separate step. Any non-empty value skips it, `0` included |
 | `REV4A_AGENT_IMAGE_REGISTRY` | `ghcr.io/flame0510/rev4a/openclaw-agent-base` | No | Registry repository agent images are pulled from, as `<repository>:<OpenClaw version>`. A `localhost` registry is reached over plain HTTP |
 | `REV4A_DOCKER_WAIT_SECONDS` | `90` | No | How long `rev4a serve` waits for the Docker daemon at start-up before starting without it. Capped at 600; `0` checks once; a negative or non-numeric value means 90. Read from the process environment, not from the `.env` file |
 
@@ -161,4 +164,4 @@ at container creation time.
 
 ## License
 
-MIT
+MIT — see [LICENSE](./LICENSE).

package/agent-templates/atlas/HEARTBEAT.md

@@ -2,7 +2,7 @@
 
 ## Operational status
 - **Role:** Developer Lead
-- **Workspace:** /data/.openclaw/workspace-atlas
+- **Workspace:** /root/.openclaw/workspace/
 
 ## Periodic checks (heartbeat)
 - [ ] Any active tasks from Argus?

package/app/agents/ImageDownloadBanner.tsx

@@ -7,6 +7,19 @@
  * the registry publishes a newer supported version, and while a download runs.
  * Downloading touches no agent: each agent keeps its OpenClaw version until it is
  * updated on its own.
+ *
+ * The percent and the status line are real (docker pull's own per-layer lines, via
+ * GET /api/agents/image-status — see lib/buildAgentImage.ts); the bar is indeterminate
+ * only while no percent can be computed yet (resolving the version, listing the layers,
+ * the local-build fallback). Cancel (DELETE /api/agents/download-image) appears once the
+ * server reports the download running, and kills the docker process.
+ *
+ * Every outcome — ready, cancelled, failed — comes from the server's record of the last
+ * download (`lastResult`), whether this instance watched it happen or not: a download
+ * that ended while the Agents page was closed or reloading is still reported, if it
+ * ended less than LATE_RESULT_WINDOW_MS ago (aged with the server's clock). Each outcome
+ * is shown once per page load, even though the Agents page renders this component in
+ * more than one place (mobile list, mobile detail, desktop).
  */
 import { useState, useEffect, useCallback, useRef } from 'react';
 import { Button } from '../components/ui';
@@ -16,6 +29,21 @@ interface ImageStatus {
   needsUpdate: boolean;
   downloading: boolean;
   downloadingVersion: string | null;
+  /** Real percent from docker pull's per-layer lines; null while it cannot be computed yet. */
+  downloadPercent: number | null;
+  /** The latest line of docker's output, shown under the percent. */
+  downloadMessage: string | null;
+  /** Whether the last finished download ended as cancelled. */
+  canceled: boolean;
+  /** The server's clock when it answered, used to age `lastResult.at`. */
+  serverTime?: number;
+  /** The last download's outcome, even one this component instance never watched live. */
+  lastResult: {
+    version: string;
+    result: 'succeeded' | 'failed' | 'canceled';
+    message: string;
+    at: number;
+  } | null;
   localVersions: string[];
   newestLocal: string | null;
   /** Newest supported version on the registry that is not downloaded yet. */
@@ -23,16 +51,34 @@ interface ImageStatus {
 }
 
 const POLL_MS = 2000;
+/** How long a late-arriving result (this component instance missed the live transition)
+ * is still worth showing. Long enough to cover switching screens and coming right back;
+ * short enough that reopening the page an hour later shows nothing stale. */
+const LATE_RESULT_WINDOW_MS = 30_000;
+
+/**
+ * The newest `lastResult.at` already shown or dismissed. Module-level rather than per
+ * instance: the Agents page mounts this banner in several places and remounts it when the
+ * mobile view switches, and one outcome must not be announced once per mount. A page
+ * reload resets it, which is intended — that is one of the cases it exists to cover.
+ */
+let lastShownResultAt = 0;
 
 export default function ImageDownloadBanner({ onImageReady }: { onImageReady?: () => void }) {
   const [status, setStatus] = useState<ImageStatus>({
-    exists: true, needsUpdate: false, downloading: false, downloadingVersion: null, localVersions: [], newestLocal: null, available: null,
+    exists: true, needsUpdate: false, downloading: false, downloadingVersion: null,
+    downloadPercent: null, downloadMessage: null, canceled: false, lastResult: null,
+    localVersions: [], newestLocal: null, available: null,
   });
   const [error, setError] = useState<string | null>(null);
   const [justCompleted, setJustCompleted] = useState<string | null>(null);
+  const [justCanceled, setJustCanceled] = useState(false);
   const [actionLoading, setActionLoading] = useState(false);
+  const [canceling, setCanceling] = useState(false);
+  const [cancelError, setCancelError] = useState<string | null>(null);
   const wasDownloadingRef = useRef<string | null>(null);
   const completedTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+  const canceledTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
 
   useEffect(() => {
     let active = true;
@@ -45,21 +91,48 @@ export default function ImageDownloadBanner({ onImageReady }: { onImageReady?: (
         const data: ImageStatus = await res.json();
         setStatus(data);
 
+        const result = data.lastResult;
+        const unseen = !!result && result.at > lastShownResultAt;
+        const showOutcome = (r: NonNullable<ImageStatus['lastResult']>) => {
+          lastShownResultAt = r.at;
+          if (r.result === 'canceled') {
+            setJustCanceled(true);
+            if (canceledTimerRef.current) clearTimeout(canceledTimerRef.current);
+            canceledTimerRef.current = setTimeout(() => setJustCanceled(false), 3000);
+          } else if (r.result === 'succeeded') {
+            setJustCompleted(r.version);
+            onImageReady?.();
+            if (completedTimerRef.current) clearTimeout(completedTimerRef.current);
+            completedTimerRef.current = setTimeout(() => setJustCompleted(null), 3000);
+          } else {
+            setError(r.message || `The OpenClaw ${r.version} download did not complete.`);
+          }
+        };
+
         if (data.downloading) {
           setError(null);
           wasDownloadingRef.current = data.downloadingVersion ?? wasDownloadingRef.current ?? 'image';
+          // The record on file is from before this run: not news any more.
+          if (result) lastShownResultAt = Math.max(lastShownResultAt, result.at);
         } else if (wasDownloadingRef.current) {
+          // Live transition: this instance watched the download run and stop.
           const finished = wasDownloadingRef.current;
           wasDownloadingRef.current = null;
           setActionLoading(false);
-          if (data.localVersions?.includes(finished)) {
-            setJustCompleted(finished);
-            onImageReady?.();
-            if (completedTimerRef.current) clearTimeout(completedTimerRef.current);
-            completedTimerRef.current = setTimeout(() => setJustCompleted(null), 3000);
-          } else {
+          setCanceling(false);
+          setCancelError(null);
+          if (result && unseen) showOutcome(result);
+          else if (!result) {
             setError(`The OpenClaw ${finished} download did not complete. Check the Docker connection and try again.`);
           }
+          // result present but already seen: another instance (or a late pass) announced it.
+        } else if (result && unseen && (data.serverTime ?? Date.now()) - result.at < LATE_RESULT_WINDOW_MS) {
+          // Arrived late: it ended while this instance was not mounted or not yet
+          // watching (a reload, a return from another page, a very fast download).
+          showOutcome(result);
+        } else if (result) {
+          // Already shown, or too old to matter: just remember it so it cannot retrigger.
+          lastShownResultAt = Math.max(lastShownResultAt, result.at);
         }
       } catch { /* ignore */ }
 
@@ -73,6 +146,7 @@ export default function ImageDownloadBanner({ onImageReady }: { onImageReady?: (
   useEffect(() => {
     return () => {
       if (completedTimerRef.current) clearTimeout(completedTimerRef.current);
+      if (canceledTimerRef.current) clearTimeout(canceledTimerRef.current);
     };
   }, []);
 
@@ -99,39 +173,83 @@ export default function ImageDownloadBanner({ onImageReady }: { onImageReady?: (
     }
   }, []);
 
+  const handleCancel = useCallback(async () => {
+    setCanceling(true);
+    setCancelError(null);
+    try {
+      const res = await fetch('/api/agents/download-image', { method: 'DELETE' });
+      if (res.status === 404) {
+        // Nothing running any more: it ended on its own; its outcome arrives with the poll.
+        setCanceling(false);
+        return;
+      }
+      if (!res.ok) {
+        const data = await res.json().catch(() => ({ error: 'Failed to cancel' }));
+        setCancelError(data.error || 'Failed to cancel');
+        setCanceling(false);
+      }
+      // 202: the poll clears `canceling` once the download has actually stopped.
+    } catch (e: unknown) {
+      setCancelError((e as Error).message || 'Failed to cancel');
+      setCanceling(false);
+    }
+  }, []);
+
   const isDownloading = status.downloading || actionLoading;
-  const showBanner = status.needsUpdate || isDownloading || justCompleted || error;
+  const showBanner = status.needsUpdate || isDownloading || justCompleted || justCanceled || error;
 
   if (!showBanner && status.exists && !isDownloading) return null;
 
   // ─── Downloading ───
   if (isDownloading) {
     const version = status.downloadingVersion ?? status.available;
+    const percent = status.downloadPercent;
     return (
       <Banner downloading>
-        <div style={{ display: 'flex', alignItems: 'center', gap: 8, flex: 1 }}>
-          <span style={{
-            display: 'inline-block', width: 8, height: 8,
-            borderRadius: '50%',
-            background: 'var(--violet)',
-            animation: 'pulse 1.5s ease-in-out infinite',
-            flexShrink: 0,
-          }} />
-          <span style={{ color: 'var(--violet)', fontWeight: 500 }}>
-            {version ? `Downloading the OpenClaw ${version} agent image…` : 'Downloading the agent image…'}
-          </span>
+        <div style={{ display: 'flex', flexDirection: 'column', gap: 2, flex: 1, minWidth: 0 }}>
+          <div style={{ display: 'flex', alignItems: 'center', gap: 8 }}>
+            <span style={{
+              display: 'inline-block', width: 8, height: 8,
+              borderRadius: '50%',
+              background: 'var(--violet)',
+              animation: 'pulse 1.5s ease-in-out infinite',
+              flexShrink: 0,
+            }} />
+            <span style={{ color: 'var(--violet)', fontWeight: 500 }}>
+              {version ? `Downloading the OpenClaw ${version} agent image…` : 'Downloading the agent image…'}
+              {percent !== null ? ` ${percent}%` : ''}
+            </span>
+          </div>
+          {status.downloadMessage && (
+            <span style={{ color: 'var(--text-dim)', fontSize: 11, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>
+              {status.downloadMessage}
+            </span>
+          )}
+          {cancelError && <span style={{ color: 'var(--red)', fontSize: 11 }}>{cancelError}</span>}
         </div>
         <div style={{
           flex: 1, maxWidth: 120, height: 3,
-          background: 'var(--border)', borderRadius: 2, overflow: 'hidden',
+          background: 'var(--border)', borderRadius: 2, overflow: 'hidden', flexShrink: 0,
         }}>
-          <div style={{
-            height: 3, background: 'var(--violet)',
-            animation: 'progress-indeterminate 1.5s ease-in-out infinite',
-            width: '40%', borderRadius: 2,
-          }} />
+          {percent !== null ? (
+            <div style={{ height: 3, background: 'var(--violet)', width: `${percent}%`, borderRadius: 2 }} />
+          ) : (
+            <div style={{
+              height: 3, background: 'var(--violet)',
+              animation: 'progress-indeterminate 1.5s ease-in-out infinite',
+              width: '40%', borderRadius: 2,
+            }} />
+          )}
         </div>
-        <Button variant="secondary" size="sm" disabled>Downloading…</Button>
+        {/* Offered only once the server reports the download running: before that there
+            is nothing to cancel, and a DELETE would answer 404. */}
+        {status.downloading ? (
+          <Button variant="secondary" size="sm" onClick={() => { void handleCancel(); }} loading={canceling} disabled={canceling}>
+            {canceling ? 'Canceling…' : 'Cancel'}
+          </Button>
+        ) : (
+          <Button variant="secondary" size="sm" disabled>Starting…</Button>
+        )}
       </Banner>
     );
   }
@@ -141,25 +259,41 @@ export default function ImageDownloadBanner({ onImageReady }: { onImageReady?: (
     return (
       <Banner success>
         <div style={{ flex: 1 }}>
-          <span style={{ color: '#22c55e', fontWeight: 500 }}>✓ OpenClaw {justCompleted} agent image ready</span>
+          <span style={{ color: 'var(--green)', fontWeight: 500 }}>✓ OpenClaw {justCompleted} agent image ready</span>
+        </div>
+      </Banner>
+    );
+  }
+
+  // ─── Just canceled ───
+  if (justCanceled) {
+    return (
+      <Banner>
+        <div style={{ flex: 1 }}>
+          <span style={{ color: 'var(--text-dim)', fontWeight: 500 }}>Download canceled.</span>
         </div>
       </Banner>
     );
   }
 
-  // ─── Needs download ───
+  // ─── Needs download, or an error to report ───
+  // With an image present and nothing newer published, only an error brings us here:
+  // show just the error, not an "available" line with no version to name.
+  const headline = !status.exists
+    ? '⚠ Agent base image not found.'
+    : status.available ? `⚠ OpenClaw ${status.available} is available.` : null;
   return (
     <Banner warning>
       <div style={{ flex: 1 }}>
-        <strong style={{ color: '#fbbf24' }}>
-          {status.exists
-            ? `⚠ OpenClaw ${status.available} is available.`
-            : '⚠ Agent base image not found.'}
-        </strong>
-        {' '}{status.exists
-          ? 'Download it for new agents; existing agents keep their version until they are updated.'
-          : 'Download it to create agent containers.'}
-        {error && <div style={{ color: '#ef4444', fontSize: 11, marginTop: 4 }}>{error}</div>}
+        {headline && (
+          <>
+            <strong style={{ color: 'var(--yellow)' }}>{headline}</strong>
+            {' '}{status.exists
+              ? 'Download it for new agents; existing agents keep their version until they are updated.'
+              : 'Download it to create agent containers.'}
+          </>
+        )}
+        {error && <div style={{ color: 'var(--red)', fontSize: headline ? 11 : 12, marginTop: headline ? 4 : 0 }}>{headline ? '' : '⚠ '}{error}</div>}
       </div>
       {(status.exists ? status.available : true) && (
         <Button variant="primary" size="sm" onClick={() => { void handleDownload(status.available); }} loading={actionLoading}>

package/app/api/agents/download-image/route.ts

@@ -5,14 +5,21 @@ import { type NextRequest } from "next/server";
  * Downloads one OpenClaw version of the agent base image in the background.
  * Body (optional): `{ "version": "2026.9.3" }` — a supported version; without it, the
  * newest supported version the registry publishes. Returns 202 with the version;
- * poll GET /api/agents/image-status for completion.
+ * poll GET /api/agents/image-status for completion, percent and the latest status line.
  *
- * Requires auth. 400 for an unsupported version, 409 if a download is already running.
+ * Requires auth. 400 for an unsupported version, 409 if a download is already running,
+ * 503 when Docker is not available.
+ *
+ * DELETE /api/agents/download-image
+ *
+ * Cancels the running download, if any (kills the docker pull/build process).
+ * Requires auth. 404 when nothing is running.
  */
 import { NextResponse } from 'next/server';
-import { defaultDownloadVersion, downloadAgentImage, getIsDownloading } from '@/lib/buildAgentImage';
+import { cancelDownload, defaultDownloadVersion, downloadAgentImage, getIsDownloading } from '@/lib/buildAgentImage';
 import { isSupportedVersion } from '@/lib/agent-versions';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
+import { dockerAvailable } from '@/lib/docker-socket';
 
 export const dynamic = 'force-dynamic';
 
@@ -39,11 +46,28 @@ export async function POST(request: NextRequest): Promise<NextResponse> {
   if (getIsDownloading()) {
     return NextResponse.json({ error: 'A download is already in progress' }, { status: 409 });
   }
+  // Refused here rather than inside downloadAgentImage: that check throws before any
+  // outcome is recorded, so the banner would get a 202 and then nothing to explain it.
+  if (!dockerAvailable()) {
+    return NextResponse.json({ error: 'Docker is not available — start Docker and try again' }, { status: 503 });
+  }
 
-  // Start download in background — fire and forget
+  // Start download in background — fire and forget. A cancel (DELETE below) makes this
+  // reject with 'canceled', not a real failure: skip the log.
   downloadAgentImage({ version }).catch((e: unknown) => {
-    console.error(`[download-image] OpenClaw ${version}:`, (e as Error).message);
+    if ((e as Error).message !== 'canceled') {
+      console.error(`[download-image] OpenClaw ${version}:`, (e as Error).message);
+    }
   });
 
   return NextResponse.json({ started: true, version }, { status: 202 });
 }
+
+export async function DELETE(request: NextRequest): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
+  if (!cancelDownload()) {
+    return NextResponse.json({ error: 'No download is running' }, { status: 404 });
+  }
+  return NextResponse.json({ canceling: true }, { status: 202 });
+}

package/app/api/agents/image-status/route.ts

@@ -9,7 +9,7 @@
  * (lib/agent-images.ts), so polling does not hit the network.
  */
 import { NextResponse, type NextRequest } from 'next/server';
-import { getDownloadingVersion, getIsDownloading } from '@/lib/buildAgentImage';
+import { getDownloadProgress, getDownloadingVersion, getIsDownloading, getLastDownloadResult, wasDownloadCanceled } from '@/lib/buildAgentImage';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
 import { dockerAvailable } from '@/lib/docker-socket';
 import { listLocalAgentImages, localSupportedVersions, remoteSupportedVersions, type LocalAgentImage } from '@/lib/agent-images';
@@ -21,7 +21,22 @@ export async function GET(request: NextRequest): Promise<NextResponse> {
   const denied = await requireAuthJWT(request);
   if (denied) return denied;
 
-  const base = { downloading: getIsDownloading(), downloadingVersion: getDownloadingVersion() };
+  const progress = getDownloadProgress();
+  const base = {
+    downloading: getIsDownloading(),
+    downloadingVersion: getDownloadingVersion(),
+    downloadPercent: progress.percent,
+    downloadMessage: progress.message,
+    /** Whether the last finished download ended as cancelled (derived from `lastResult`). */
+    canceled: wasDownloadCanceled(),
+    /**
+     * The last download's outcome, whether or not anyone was watching it finish —
+     * covers a page reload or a late-opened tab. Overwritten by the next download.
+     */
+    lastResult: getLastDownloadResult(),
+    /** The server's clock, so the client can age `lastResult.at` without trusting its own. */
+    serverTime: Date.now(),
+  };
 
   if (!dockerAvailable()) {
     return NextResponse.json({

package/app/api/assistant/route.ts

@@ -24,7 +24,7 @@ const PAGE_CONTEXT: Record<string, PageContext> = {
   },
   '/agents': {
     title: 'Agents',
-    description: 'List of all Docker containers that run OpenClaw agents. Shows status (running/exited/paused), image, ports, IP, and creation time. Includes a top banner for the agent base image status: yellow warning when outdated or missing, animated progress bar when downloading from registry.',
+    description: 'List of all Docker containers that run OpenClaw agents. Shows status (running/exited/paused), image, ports, IP, and creation time. Includes a top banner for the agent base image status: yellow warning when a newer version is published or none is downloaded; while downloading, the percent of layers finished, docker\'s latest output line and a Cancel button; afterwards the outcome (ready, canceled or the error).',
     actions: ['Filter by status: all, running, or exited', 'Click an agent to see its details (environment variables, backups, Telegram channels, and the Model section that sets its primary model and fallbacks)', 'Create a new agent using the "Create Agent" button', 'Download the agent base image when the banner shows it missing or outdated'],
     hints: 'The status bullet tells you at a glance if an agent is running (green), exited (red), or paused (yellow). The base image banner shows when a newer supported version is published on the registry — downloading makes it available to create and update agents on; it changes no agent by itself.',
   },
@@ -58,11 +58,17 @@ const PAGE_CONTEXT: Record<string, PageContext> = {
     actions: ['Run shell commands inside the container', 'Inspect files, processes, and logs live', 'Use any CLI tool available inside the container'],
     hints: 'This is a live terminal — changes you make inside the container are real. Be careful with destructive commands.',
   },
+  '/credentials': {
+    title: 'Credentials',
+    description: 'Store third-party service credentials (GitHub, Vercel, Supabase, Trello, Notion) once and install them into agent containers. Secrets are stored unencrypted in credentials.db; provider API keys are managed on the Gateway page, not here.',
+    actions: ['Configure a provider, or "+ Add another" credential for one already configured', 'Edit or delete a stored credential', 'Sync a credential to an agent container, or De-sync it to remove it', 'See which credentials are actually installed in each container (detected live)'],
+    hints: 'A credential reaches a container only when you sync it, and leaves only when you de-sync it. Any stored credential can be synced to any container.',
+  },
   '/config': {
     title: 'Config',
     description: 'Rev4a application configuration page. View and manage settings that control how Rev4a behaves.',
     actions: ['View current configuration values', 'Modify configuration settings', 'Save changes to update Rev4a behavior'],
-    hints: 'Configuration changes take effect immediately when saved.',
+    hints: 'Saved values are written to the .env file; restart Rev4a for them to take effect.',
   },
   '/lineage': {
     title: 'Lineage',
@@ -107,7 +113,7 @@ Navigation links inside Rev4a:
 - Dashboard → /
 - Agents → /agents
 - Create Agent → /agents/create
-- Providers → /providers
+- Credentials → /credentials
 - Gateway → /gateway
 - Cron Jobs → /crons
 - Containers → /containers
@@ -118,11 +124,14 @@ Navigation links inside Rev4a:
 - Tools → /tools
 - Plugins → /plugins
 - Skills → /skills
+- Wizard (first-run guide: providers, first agent) → /wizard
 `.trim();
 
 function buildSystemPrompt(page: string): string {
   const path = page.split('?')[0] || '/';
-  const ctx = PAGE_CONTEXT[path] ?? {
+  // Dynamic routes are keyed by their pattern; the terminal is the only one.
+  const key = path.startsWith('/containers/terminal/') ? '/containers/terminal/[id]' : path;
+  const ctx = PAGE_CONTEXT[key] ?? {
     title: path,
     description: 'Unknown page.',
     actions: [],

package/app/api/auth/login/route.ts

@@ -1,6 +1,6 @@
 import { NextResponse, type NextRequest } from 'next/server';
 import { SignJWT } from 'jose';
-import { getPassword, getJwtSecret } from '@/lib/rev4a-auth';
+import { getPassword, getJwtSecret, secretEquals } from '@/lib/rev4a-auth';
 
 export async function POST(request: NextRequest): Promise<NextResponse> {
   try {
@@ -27,7 +27,7 @@ export async function POST(request: NextRequest): Promise<NextResponse> {
       password?: string;
     };
 
-    if (!input || input !== password) {
+    if (!input || !secretEquals(input, password)) {
       return NextResponse.json({ error: 'Invalid password' }, { status: 401 });
     }
 

package/app/api/setup/agent-image/route.ts

@@ -45,6 +45,8 @@ export async function POST(request: NextRequest): Promise<Response> {
   }
 
   const encoder = new TextEncoder();
+  // Aborted when the client goes away (the stream's cancel()), which stops docker.
+  const abort = new AbortController();
 
   const stream = new ReadableStream({
     async start(controller) {
@@ -54,10 +56,8 @@ export async function POST(request: NextRequest): Promise<Response> {
         } catch { /* stream closed */ }
       };
 
-      const ctrl = controller as ReadableStreamDefaultController & { signal?: AbortSignal };
-
       try {
-        await downloadAgentImage({ onEvent: send, signal: ctrl.signal });
+        await downloadAgentImage({ onEvent: send, signal: abort.signal });
       } catch (e: unknown) {
         send(JSON.stringify({
           type: 'error',
@@ -66,7 +66,9 @@ export async function POST(request: NextRequest): Promise<Response> {
       }
       controller.close();
     },
-    cancel() { /* downloadAgentImage stops the docker process through the signal */ },
+    // A ReadableStreamDefaultController has no signal of its own; this is the hook the
+    // runtime calls when the client disconnects.
+    cancel() { abort.abort(); },
   });
 
   return new Response(stream, {

package/app/api/system-health/route.ts

@@ -118,7 +118,7 @@ export async function GET(request: NextRequest): Promise<NextResponse> {
         title: 'Check Rev4a runtime heartbeat',
         details: latestMetricAgeSeconds === null
           ? 'No heartbeat metrics available from runtime.'
-          : `Heartbeat metrics stuck for ${latestMetricAgeSeconds}s (soglia ${staleThresholdSeconds}s).`,
+          : `Heartbeat metrics stuck for ${latestMetricAgeSeconds}s (threshold ${staleThresholdSeconds}s).`,
         actionHref: '/lineage',
         dismissible: false,
         createdAt,
@@ -133,7 +133,7 @@ export async function GET(request: NextRequest): Promise<NextResponse> {
         ? 'system_metrics table unavailable: freshness runtime not verifiable.'
         : latestMetricAgeSeconds === null
           ? 'No heartbeat metrics detected.'
-          : `Last heartbeat metrics ${latestMetricAgeSeconds}s fa (soglia ${staleThresholdSeconds}s).`,
+          : `Last heartbeat metrics ${latestMetricAgeSeconds}s ago (threshold ${staleThresholdSeconds}s).`,
       resolvedMessage: 'DB Rev4a fresh again.',
       stale: hasSystemMetrics ? (latestMetricAgeSeconds === null ? true : latestMetricAgeSeconds > staleThresholdSeconds) : false,
     });
@@ -190,7 +190,7 @@ export async function GET(request: NextRequest): Promise<NextResponse> {
         severity: 'warning',
         source: 'cost',
         title: 'High usage-based cost',
-        details: `Provider usage-based today: $${billing.usageBasedCost.toFixed(2)}. Include OpenRouter e altri provider pay-per-use, non i piani fissi.`,
+        details: `Provider usage-based today: $${billing.usageBasedCost.toFixed(2)}. Counts OpenRouter and the other pay-per-use providers, not the fixed plans.`,
         actionHref: '/gateway',
         dismissible: true,
         createdAt,

package/app/components/DashboardToolbar.tsx

@@ -12,7 +12,7 @@ interface DashboardToolbarProps {
 export default function DashboardToolbar({ filter, onChange, agents = ['all'] }: DashboardToolbarProps) {
   return (
     <section className="toolbar">
-      <span className="toolbar-label">AGENTI</span>
+      <span className="toolbar-label">AGENTS</span>
 
       {agents.map((name) => (
         <button
@@ -44,7 +44,7 @@ export default function DashboardToolbar({ filter, onChange, agents = ['all'] }:
       </button>
 
       <span className="toolbar-sep">|</span>
-      <span className="toolbar-label">PERIODO</span>
+      <span className="toolbar-label">PERIOD</span>
 
       {PERIODS.map((p) => (
         <button

package/app/components/LineageGraphPage.tsx

@@ -48,9 +48,9 @@ export default function LineageGraphPage({ initialCosts }: LineageGraphPageProps
       {isMobile && (
         <div style={{ display: 'flex', gap: 8, padding: '8px 12px', borderBottom: '1px solid var(--border)', background: 'var(--bg2)' }}>
           {[
-            { key: 'graph', label: 'GRAFO' },
+            { key: 'graph', label: 'GRAPH' },
             { key: 'feed', label: 'FEED' },
-            { key: 'costs', label: 'COSTI' },
+            { key: 'costs', label: 'COSTS' },
           ].map((t) => (
             <button
               key={t.key}
@@ -101,11 +101,11 @@ export default function LineageGraphPage({ initialCosts }: LineageGraphPageProps
               <button
                 type="button"
                 className="agent-btn"
-                aria-label="Reimposta vista grafo"
+                aria-label="Reset graph view"
                 onClick={() => topologyRef.current?.resetView()}
                 style={resetButtonStyle}
               >
-                ⊙ Reimposta vista
+                ⊙ Reset view
               </button>
             </div>
             {hasSessionsLoaded ? (