@flame0510/project-aether 1.6.2 → 1.8.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Michele Tornello
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -13,11 +13,13 @@
 - **Agent creation wizard** — Pick a template (Atlas, Prometheus, Argus), choose an LLM model, deploy an agent in seconds
 - **Provider sync** — Add API keys once, push them to all agent containers with one click
 - **Model configuration** — Change the primary model and fallbacks per agent, from the detail panel on the Agents page. Providers: OpenAI, Anthropic, Google, DeepSeek, Groq, Kimi, GLM, Qwen, plus OpenRouter as an aggregator.
+- **Model details** — Every model row opens a modal with its description, price and provider, architecture and parameter count (mixture of experts, context, vision encoder, precision, weights on disk), reasoning modes, capabilities, benchmarks with sources and licence. Numbers come from the model card on Hugging Face plus curated entries that cite a source; nothing is estimated
 - **Shared gateway token** — One token to rule all agents. Manage from the dashboard, sync to all containers
 - **Live event stream** — Real-time session lineage, agent spawning, cost reporting
 - **Workspace browser** — Browse and edit agent files live from the dashboard
 - **Provider proxy** — OpenAI-compatible chat completions proxy that routes through a shared key vault
-- **System health** — CPU, RAM, disk, Docker daemon status, recommendations
+- **System health** — runtime sessions, daemon heartbeat and errors, cron jobs and usage cost, with recommendations
+- **System** — the host machine's CPU, memory, swap and storage, now and over 1h / 24h / 7d / 30d (sampled every 30 s, kept 30 days)
 - **Cost tracking** — Per-session, per-model, per-time-range usage and cost reporting
 - **PWA-ready** — Install on phone for mobile monitoring
 
@@ -81,6 +83,8 @@ already filled in — you normally never set these by hand. See
 | `REV4A_DATA_DIR` | `~/.config/rev4a` | No | Root of all persistent data |
 | `REV4A_DB` | `<data dir>/data/events.db` | No | SQLite database path |
 | `REV4A_WORKSPACE_ROOT` | — | No | Root exposed by the local file explorer |
+| `REV4A_DEV_ORIGINS` | — | No | Extra comma-separated hostnames or IPs allowed to reach `next dev` (e.g. a LAN address, without scheme or port); no effect on a production build |
+| `REV4A_SKIP_POSTINSTALL_BUILD` | — | No | `1` in CI so `npm ci` skips the post-install `next build`; the workflows build as a separate step. Any non-empty value skips it, `0` included |
 | `REV4A_AGENT_IMAGE_REGISTRY` | `ghcr.io/flame0510/rev4a/openclaw-agent-base` | No | Registry repository agent images are pulled from, as `<repository>:<OpenClaw version>`. A `localhost` registry is reached over plain HTTP |
 | `REV4A_DOCKER_WAIT_SECONDS` | `90` | No | How long `rev4a serve` waits for the Docker daemon at start-up before starting without it. Capped at 600; `0` checks once; a negative or non-numeric value means 90. Read from the process environment, not from the `.env` file |
 
@@ -161,4 +165,4 @@ at container creation time.
 
 ## License
 
-MIT
+MIT — see [LICENSE](./LICENSE).

package/agent-templates/atlas/HEARTBEAT.md

@@ -2,7 +2,7 @@
 
 ## Operational status
 - **Role:** Developer Lead
-- **Workspace:** /data/.openclaw/workspace-atlas
+- **Workspace:** /root/.openclaw/workspace/
 
 ## Periodic checks (heartbeat)
 - [ ] Any active tasks from Argus?

package/app/agents/ImageDownloadBanner.tsx

@@ -7,6 +7,19 @@
  * the registry publishes a newer supported version, and while a download runs.
  * Downloading touches no agent: each agent keeps its OpenClaw version until it is
  * updated on its own.
+ *
+ * The percent and the status line are real (docker pull's own per-layer lines, via
+ * GET /api/agents/image-status — see lib/buildAgentImage.ts); the bar is indeterminate
+ * only while no percent can be computed yet (resolving the version, listing the layers,
+ * the local-build fallback). Cancel (DELETE /api/agents/download-image) appears once the
+ * server reports the download running, and kills the docker process.
+ *
+ * Every outcome — ready, cancelled, failed — comes from the server's record of the last
+ * download (`lastResult`), whether this instance watched it happen or not: a download
+ * that ended while the Agents page was closed or reloading is still reported, if it
+ * ended less than LATE_RESULT_WINDOW_MS ago (aged with the server's clock). Each outcome
+ * is shown once per page load, even though the Agents page renders this component in
+ * more than one place (mobile list, mobile detail, desktop).
  */
 import { useState, useEffect, useCallback, useRef } from 'react';
 import { Button } from '../components/ui';
@@ -16,6 +29,21 @@ interface ImageStatus {
   needsUpdate: boolean;
   downloading: boolean;
   downloadingVersion: string | null;
+  /** Real percent from docker pull's per-layer lines; null while it cannot be computed yet. */
+  downloadPercent: number | null;
+  /** The latest line of docker's output, shown under the percent. */
+  downloadMessage: string | null;
+  /** Whether the last finished download ended as cancelled. */
+  canceled: boolean;
+  /** The server's clock when it answered, used to age `lastResult.at`. */
+  serverTime?: number;
+  /** The last download's outcome, even one this component instance never watched live. */
+  lastResult: {
+    version: string;
+    result: 'succeeded' | 'failed' | 'canceled';
+    message: string;
+    at: number;
+  } | null;
   localVersions: string[];
   newestLocal: string | null;
   /** Newest supported version on the registry that is not downloaded yet. */
@@ -23,16 +51,34 @@ interface ImageStatus {
 }
 
 const POLL_MS = 2000;
+/** How long a late-arriving result (this component instance missed the live transition)
+ * is still worth showing. Long enough to cover switching screens and coming right back;
+ * short enough that reopening the page an hour later shows nothing stale. */
+const LATE_RESULT_WINDOW_MS = 30_000;
+
+/**
+ * The newest `lastResult.at` already shown or dismissed. Module-level rather than per
+ * instance: the Agents page mounts this banner in several places and remounts it when the
+ * mobile view switches, and one outcome must not be announced once per mount. A page
+ * reload resets it, which is intended — that is one of the cases it exists to cover.
+ */
+let lastShownResultAt = 0;
 
 export default function ImageDownloadBanner({ onImageReady }: { onImageReady?: () => void }) {
   const [status, setStatus] = useState<ImageStatus>({
-    exists: true, needsUpdate: false, downloading: false, downloadingVersion: null, localVersions: [], newestLocal: null, available: null,
+    exists: true, needsUpdate: false, downloading: false, downloadingVersion: null,
+    downloadPercent: null, downloadMessage: null, canceled: false, lastResult: null,
+    localVersions: [], newestLocal: null, available: null,
   });
   const [error, setError] = useState<string | null>(null);
   const [justCompleted, setJustCompleted] = useState<string | null>(null);
+  const [justCanceled, setJustCanceled] = useState(false);
   const [actionLoading, setActionLoading] = useState(false);
+  const [canceling, setCanceling] = useState(false);
+  const [cancelError, setCancelError] = useState<string | null>(null);
   const wasDownloadingRef = useRef<string | null>(null);
   const completedTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+  const canceledTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
 
   useEffect(() => {
     let active = true;
@@ -45,21 +91,48 @@ export default function ImageDownloadBanner({ onImageReady }: { onImageReady?: (
         const data: ImageStatus = await res.json();
         setStatus(data);
 
+        const result = data.lastResult;
+        const unseen = !!result && result.at > lastShownResultAt;
+        const showOutcome = (r: NonNullable<ImageStatus['lastResult']>) => {
+          lastShownResultAt = r.at;
+          if (r.result === 'canceled') {
+            setJustCanceled(true);
+            if (canceledTimerRef.current) clearTimeout(canceledTimerRef.current);
+            canceledTimerRef.current = setTimeout(() => setJustCanceled(false), 3000);
+          } else if (r.result === 'succeeded') {
+            setJustCompleted(r.version);
+            onImageReady?.();
+            if (completedTimerRef.current) clearTimeout(completedTimerRef.current);
+            completedTimerRef.current = setTimeout(() => setJustCompleted(null), 3000);
+          } else {
+            setError(r.message || `The OpenClaw ${r.version} download did not complete.`);
+          }
+        };
+
         if (data.downloading) {
           setError(null);
           wasDownloadingRef.current = data.downloadingVersion ?? wasDownloadingRef.current ?? 'image';
+          // The record on file is from before this run: not news any more.
+          if (result) lastShownResultAt = Math.max(lastShownResultAt, result.at);
         } else if (wasDownloadingRef.current) {
+          // Live transition: this instance watched the download run and stop.
           const finished = wasDownloadingRef.current;
           wasDownloadingRef.current = null;
           setActionLoading(false);
-          if (data.localVersions?.includes(finished)) {
-            setJustCompleted(finished);
-            onImageReady?.();
-            if (completedTimerRef.current) clearTimeout(completedTimerRef.current);
-            completedTimerRef.current = setTimeout(() => setJustCompleted(null), 3000);
-          } else {
+          setCanceling(false);
+          setCancelError(null);
+          if (result && unseen) showOutcome(result);
+          else if (!result) {
             setError(`The OpenClaw ${finished} download did not complete. Check the Docker connection and try again.`);
           }
+          // result present but already seen: another instance (or a late pass) announced it.
+        } else if (result && unseen && (data.serverTime ?? Date.now()) - result.at < LATE_RESULT_WINDOW_MS) {
+          // Arrived late: it ended while this instance was not mounted or not yet
+          // watching (a reload, a return from another page, a very fast download).
+          showOutcome(result);
+        } else if (result) {
+          // Already shown, or too old to matter: just remember it so it cannot retrigger.
+          lastShownResultAt = Math.max(lastShownResultAt, result.at);
         }
       } catch { /* ignore */ }
 
@@ -73,6 +146,7 @@ export default function ImageDownloadBanner({ onImageReady }: { onImageReady?: (
   useEffect(() => {
     return () => {
       if (completedTimerRef.current) clearTimeout(completedTimerRef.current);
+      if (canceledTimerRef.current) clearTimeout(canceledTimerRef.current);
     };
   }, []);
 
@@ -99,39 +173,83 @@ export default function ImageDownloadBanner({ onImageReady }: { onImageReady?: (
     }
   }, []);
 
+  const handleCancel = useCallback(async () => {
+    setCanceling(true);
+    setCancelError(null);
+    try {
+      const res = await fetch('/api/agents/download-image', { method: 'DELETE' });
+      if (res.status === 404) {
+        // Nothing running any more: it ended on its own; its outcome arrives with the poll.
+        setCanceling(false);
+        return;
+      }
+      if (!res.ok) {
+        const data = await res.json().catch(() => ({ error: 'Failed to cancel' }));
+        setCancelError(data.error || 'Failed to cancel');
+        setCanceling(false);
+      }
+      // 202: the poll clears `canceling` once the download has actually stopped.
+    } catch (e: unknown) {
+      setCancelError((e as Error).message || 'Failed to cancel');
+      setCanceling(false);
+    }
+  }, []);
+
   const isDownloading = status.downloading || actionLoading;
-  const showBanner = status.needsUpdate || isDownloading || justCompleted || error;
+  const showBanner = status.needsUpdate || isDownloading || justCompleted || justCanceled || error;
 
   if (!showBanner && status.exists && !isDownloading) return null;
 
   // ─── Downloading ───
   if (isDownloading) {
     const version = status.downloadingVersion ?? status.available;
+    const percent = status.downloadPercent;
     return (
       <Banner downloading>
-        <div style={{ display: 'flex', alignItems: 'center', gap: 8, flex: 1 }}>
-          <span style={{
-            display: 'inline-block', width: 8, height: 8,
-            borderRadius: '50%',
-            background: 'var(--violet)',
-            animation: 'pulse 1.5s ease-in-out infinite',
-            flexShrink: 0,
-          }} />
-          <span style={{ color: 'var(--violet)', fontWeight: 500 }}>
-            {version ? `Downloading the OpenClaw ${version} agent image…` : 'Downloading the agent image…'}
-          </span>
+        <div style={{ display: 'flex', flexDirection: 'column', gap: 2, flex: 1, minWidth: 0 }}>
+          <div style={{ display: 'flex', alignItems: 'center', gap: 8 }}>
+            <span style={{
+              display: 'inline-block', width: 8, height: 8,
+              borderRadius: '50%',
+              background: 'var(--violet)',
+              animation: 'pulse 1.5s ease-in-out infinite',
+              flexShrink: 0,
+            }} />
+            <span style={{ color: 'var(--violet)', fontWeight: 500 }}>
+              {version ? `Downloading the OpenClaw ${version} agent image…` : 'Downloading the agent image…'}
+              {percent !== null ? ` ${percent}%` : ''}
+            </span>
+          </div>
+          {status.downloadMessage && (
+            <span style={{ color: 'var(--text-dim)', fontSize: 11, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>
+              {status.downloadMessage}
+            </span>
+          )}
+          {cancelError && <span style={{ color: 'var(--red)', fontSize: 11 }}>{cancelError}</span>}
         </div>
         <div style={{
           flex: 1, maxWidth: 120, height: 3,
-          background: 'var(--border)', borderRadius: 2, overflow: 'hidden',
+          background: 'var(--border)', borderRadius: 2, overflow: 'hidden', flexShrink: 0,
         }}>
-          <div style={{
-            height: 3, background: 'var(--violet)',
-            animation: 'progress-indeterminate 1.5s ease-in-out infinite',
-            width: '40%', borderRadius: 2,
-          }} />
+          {percent !== null ? (
+            <div style={{ height: 3, background: 'var(--violet)', width: `${percent}%`, borderRadius: 2 }} />
+          ) : (
+            <div style={{
+              height: 3, background: 'var(--violet)',
+              animation: 'progress-indeterminate 1.5s ease-in-out infinite',
+              width: '40%', borderRadius: 2,
+            }} />
+          )}
         </div>
-        <Button variant="secondary" size="sm" disabled>Downloading…</Button>
+        {/* Offered only once the server reports the download running: before that there
+            is nothing to cancel, and a DELETE would answer 404. */}
+        {status.downloading ? (
+          <Button variant="secondary" size="sm" onClick={() => { void handleCancel(); }} loading={canceling} disabled={canceling}>
+            {canceling ? 'Canceling…' : 'Cancel'}
+          </Button>
+        ) : (
+          <Button variant="secondary" size="sm" disabled>Starting…</Button>
+        )}
       </Banner>
     );
   }
@@ -141,25 +259,41 @@ export default function ImageDownloadBanner({ onImageReady }: { onImageReady?: (
     return (
       <Banner success>
         <div style={{ flex: 1 }}>
-          <span style={{ color: '#22c55e', fontWeight: 500 }}>✓ OpenClaw {justCompleted} agent image ready</span>
+          <span style={{ color: 'var(--green)', fontWeight: 500 }}>✓ OpenClaw {justCompleted} agent image ready</span>
+        </div>
+      </Banner>
+    );
+  }
+
+  // ─── Just canceled ───
+  if (justCanceled) {
+    return (
+      <Banner>
+        <div style={{ flex: 1 }}>
+          <span style={{ color: 'var(--text-dim)', fontWeight: 500 }}>Download canceled.</span>
         </div>
       </Banner>
     );
   }
 
-  // ─── Needs download ───
+  // ─── Needs download, or an error to report ───
+  // With an image present and nothing newer published, only an error brings us here:
+  // show just the error, not an "available" line with no version to name.
+  const headline = !status.exists
+    ? '⚠ Agent base image not found.'
+    : status.available ? `⚠ OpenClaw ${status.available} is available.` : null;
   return (
     <Banner warning>
       <div style={{ flex: 1 }}>
-        <strong style={{ color: '#fbbf24' }}>
-          {status.exists
-            ? `⚠ OpenClaw ${status.available} is available.`
-            : '⚠ Agent base image not found.'}
-        </strong>
-        {' '}{status.exists
-          ? 'Download it for new agents; existing agents keep their version until they are updated.'
-          : 'Download it to create agent containers.'}
-        {error && <div style={{ color: '#ef4444', fontSize: 11, marginTop: 4 }}>{error}</div>}
+        {headline && (
+          <>
+            <strong style={{ color: 'var(--yellow)' }}>{headline}</strong>
+            {' '}{status.exists
+              ? 'Download it for new agents; existing agents keep their version until they are updated.'
+              : 'Download it to create agent containers.'}
+          </>
+        )}
+        {error && <div style={{ color: 'var(--red)', fontSize: headline ? 11 : 12, marginTop: headline ? 4 : 0 }}>{headline ? '' : '⚠ '}{error}</div>}
       </div>
       {(status.exists ? status.available : true) && (
         <Button variant="primary" size="sm" onClick={() => { void handleDownload(status.available); }} loading={actionLoading}>

package/app/api/agents/download-image/route.ts

@@ -5,14 +5,21 @@ import { type NextRequest } from "next/server";
  * Downloads one OpenClaw version of the agent base image in the background.
  * Body (optional): `{ "version": "2026.9.3" }` — a supported version; without it, the
  * newest supported version the registry publishes. Returns 202 with the version;
- * poll GET /api/agents/image-status for completion.
+ * poll GET /api/agents/image-status for completion, percent and the latest status line.
  *
- * Requires auth. 400 for an unsupported version, 409 if a download is already running.
+ * Requires auth. 400 for an unsupported version, 409 if a download is already running,
+ * 503 when Docker is not available.
+ *
+ * DELETE /api/agents/download-image
+ *
+ * Cancels the running download, if any (kills the docker pull/build process).
+ * Requires auth. 404 when nothing is running.
  */
 import { NextResponse } from 'next/server';
-import { defaultDownloadVersion, downloadAgentImage, getIsDownloading } from '@/lib/buildAgentImage';
+import { cancelDownload, defaultDownloadVersion, downloadAgentImage, getIsDownloading } from '@/lib/buildAgentImage';
 import { isSupportedVersion } from '@/lib/agent-versions';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
+import { dockerAvailable } from '@/lib/docker-socket';
 
 export const dynamic = 'force-dynamic';
 
@@ -39,11 +46,28 @@ export async function POST(request: NextRequest): Promise<NextResponse> {
   if (getIsDownloading()) {
     return NextResponse.json({ error: 'A download is already in progress' }, { status: 409 });
   }
+  // Refused here rather than inside downloadAgentImage: that check throws before any
+  // outcome is recorded, so the banner would get a 202 and then nothing to explain it.
+  if (!dockerAvailable()) {
+    return NextResponse.json({ error: 'Docker is not available — start Docker and try again' }, { status: 503 });
+  }
 
-  // Start download in background — fire and forget
+  // Start download in background — fire and forget. A cancel (DELETE below) makes this
+  // reject with 'canceled', not a real failure: skip the log.
   downloadAgentImage({ version }).catch((e: unknown) => {
-    console.error(`[download-image] OpenClaw ${version}:`, (e as Error).message);
+    if ((e as Error).message !== 'canceled') {
+      console.error(`[download-image] OpenClaw ${version}:`, (e as Error).message);
+    }
   });
 
   return NextResponse.json({ started: true, version }, { status: 202 });
 }
+
+export async function DELETE(request: NextRequest): Promise<NextResponse> {
+  const denied = await requireAuthJWT(request);
+  if (denied) return denied;
+  if (!cancelDownload()) {
+    return NextResponse.json({ error: 'No download is running' }, { status: 404 });
+  }
+  return NextResponse.json({ canceling: true }, { status: 202 });
+}

package/app/api/agents/image-status/route.ts

@@ -9,7 +9,7 @@
  * (lib/agent-images.ts), so polling does not hit the network.
  */
 import { NextResponse, type NextRequest } from 'next/server';
-import { getDownloadingVersion, getIsDownloading } from '@/lib/buildAgentImage';
+import { getDownloadProgress, getDownloadingVersion, getIsDownloading, getLastDownloadResult, wasDownloadCanceled } from '@/lib/buildAgentImage';
 import { requireAuthJWT } from '@/lib/rev4a-auth';
 import { dockerAvailable } from '@/lib/docker-socket';
 import { listLocalAgentImages, localSupportedVersions, remoteSupportedVersions, type LocalAgentImage } from '@/lib/agent-images';
@@ -21,7 +21,22 @@ export async function GET(request: NextRequest): Promise<NextResponse> {
   const denied = await requireAuthJWT(request);
   if (denied) return denied;
 
-  const base = { downloading: getIsDownloading(), downloadingVersion: getDownloadingVersion() };
+  const progress = getDownloadProgress();
+  const base = {
+    downloading: getIsDownloading(),
+    downloadingVersion: getDownloadingVersion(),
+    downloadPercent: progress.percent,
+    downloadMessage: progress.message,
+    /** Whether the last finished download ended as cancelled (derived from `lastResult`). */
+    canceled: wasDownloadCanceled(),
+    /**
+     * The last download's outcome, whether or not anyone was watching it finish —
+     * covers a page reload or a late-opened tab. Overwritten by the next download.
+     */
+    lastResult: getLastDownloadResult(),
+    /** The server's clock, so the client can age `lastResult.at` without trusting its own. */
+    serverTime: Date.now(),
+  };
 
   if (!dockerAvailable()) {
     return NextResponse.json({

package/app/api/assistant/route.ts

@@ -18,13 +18,13 @@ interface PageContext {
 const PAGE_CONTEXT: Record<string, PageContext> = {
   '/': {
     title: 'Dashboard',
-    description: 'Main overview with live session list, cost summary by model, health cards for Rev4a\'s own runtime, cron and lineage, and a real-time event feed. It shows no CPU, RAM, disk or load average: those are collected by the daemon but no page displays them.',
+    description: 'Main overview with live session list, cost summary by model, health cards for Rev4a\'s own runtime, cron and lineage, and a real-time event feed. The Machine card shows the server\'s CPU, RAM and fullest disk right now, coloured past a threshold, with a link to the System page.',
     actions: ['Click any session row to open the Session Drawer for full details and tool call history', 'View cost breakdown by model and time period', 'See live events as they happen', 'Take a screenshot of the dashboard (mobile)'],
     hints: 'The Session Drawer shows you the complete tool call history for any session — just click a row.',
   },
   '/agents': {
     title: 'Agents',
-    description: 'List of all Docker containers that run OpenClaw agents. Shows status (running/exited/paused), image, ports, IP, and creation time. Includes a top banner for the agent base image status: yellow warning when outdated or missing, animated progress bar when downloading from registry.',
+    description: 'List of all Docker containers that run OpenClaw agents. Shows status (running/exited/paused), image, ports, IP, and creation time. Includes a top banner for the agent base image status: yellow warning when a newer version is published or none is downloaded; while downloading, the percent of layers finished, docker\'s latest output line and a Cancel button; afterwards the outcome (ready, canceled or the error).',
     actions: ['Filter by status: all, running, or exited', 'Click an agent to see its details (environment variables, backups, Telegram channels, and the Model section that sets its primary model and fallbacks)', 'Create a new agent using the "Create Agent" button', 'Download the agent base image when the banner shows it missing or outdated'],
     hints: 'The status bullet tells you at a glance if an agent is running (green), exited (red), or paused (yellow). The base image banner shows when a newer supported version is published on the registry — downloading makes it available to create and update agents on; it changes no agent by itself.',
   },
@@ -46,6 +46,12 @@ const PAGE_CONTEXT: Record<string, PageContext> = {
     actions: ['See all scheduled cron jobs at a glance', 'Check when each cron last ran and when it will run next', 'View job status (scheduled, running, completed, error)'],
     hints: 'Cron jobs use standard cron syntax. If a job shows "error" status, it means the last execution failed.',
   },
+  '/system': {
+    title: 'System',
+    description: 'The machine Rev4a runs on: CPU (percent, cores, load average 1/5/15 min), memory (used, available, swap) and storage (each disk with used and free space, and whether it is the system disk, Docker\'s data or Rev4a\'s data), now and over 1h, 24h, 7d or 30d. Sampled by the Rev4a daemon every 30 seconds, kept 30 days.',
+    actions: ['Read the current CPU, memory, swap and disk usage', 'Switch the charts between 1h, 24h, 7d and 30d', 'Hover a chart (or focus it and use the arrow keys) to read the average and peak at a point', 'Open a chart\'s Table view for the numbers'],
+    hints: 'Bars turn yellow then red past their thresholds: CPU and memory at 85% and 95%, disks at 80% and 90%. If the page says "Not collecting", the Rev4a daemon is not sampling: check that rev4a serve is running.',
+  },
   '/containers': {
     title: 'Containers',
     description: 'List of all Docker containers on the server, running or stopped (not just agents). Shows container ID, name, image, status, state, ports, and IP address.',
@@ -58,11 +64,17 @@ const PAGE_CONTEXT: Record<string, PageContext> = {
     actions: ['Run shell commands inside the container', 'Inspect files, processes, and logs live', 'Use any CLI tool available inside the container'],
     hints: 'This is a live terminal — changes you make inside the container are real. Be careful with destructive commands.',
   },
+  '/credentials': {
+    title: 'Credentials',
+    description: 'Store third-party service credentials (GitHub, Vercel, Supabase, Trello, Notion) once and install them into agent containers. Secrets are stored unencrypted in credentials.db; provider API keys are managed on the Gateway page, not here.',
+    actions: ['Configure a provider, or "+ Add another" credential for one already configured', 'Edit or delete a stored credential', 'Sync a credential to an agent container, or De-sync it to remove it', 'See which credentials are actually installed in each container (detected live)'],
+    hints: 'A credential reaches a container only when you sync it, and leaves only when you de-sync it. Any stored credential can be synced to any container.',
+  },
   '/config': {
     title: 'Config',
     description: 'Rev4a application configuration page. View and manage settings that control how Rev4a behaves.',
     actions: ['View current configuration values', 'Modify configuration settings', 'Save changes to update Rev4a behavior'],
-    hints: 'Configuration changes take effect immediately when saved.',
+    hints: 'Saved values are written to the .env file; restart Rev4a for them to take effect.',
   },
   '/lineage': {
     title: 'Lineage',
@@ -107,10 +119,11 @@ Navigation links inside Rev4a:
 - Dashboard → /
 - Agents → /agents
 - Create Agent → /agents/create
-- Providers → /providers
+- Credentials → /credentials
 - Gateway → /gateway
 - Cron Jobs → /crons
 - Containers → /containers
+- System (CPU, RAM, disk of the server) → /system
 - Config → /config
 - Lineage → /lineage?period=7d
 - Memory / Context → /memory
@@ -118,11 +131,14 @@ Navigation links inside Rev4a:
 - Tools → /tools
 - Plugins → /plugins
 - Skills → /skills
+- Wizard (first-run guide: providers, first agent) → /wizard
 `.trim();
 
 function buildSystemPrompt(page: string): string {
   const path = page.split('?')[0] || '/';
-  const ctx = PAGE_CONTEXT[path] ?? {
+  // Dynamic routes are keyed by their pattern; the terminal is the only one.
+  const key = path.startsWith('/containers/terminal/') ? '/containers/terminal/[id]' : path;
+  const ctx = PAGE_CONTEXT[key] ?? {
     title: path,
     description: 'Unknown page.',
     actions: [],

package/app/api/auth/login/route.ts

@@ -1,6 +1,6 @@
 import { NextResponse, type NextRequest } from 'next/server';
 import { SignJWT } from 'jose';
-import { getPassword, getJwtSecret } from '@/lib/rev4a-auth';
+import { getPassword, getJwtSecret, secretEquals } from '@/lib/rev4a-auth';
 
 export async function POST(request: NextRequest): Promise<NextResponse> {
   try {
@@ -27,7 +27,7 @@ export async function POST(request: NextRequest): Promise<NextResponse> {
       password?: string;
     };
 
-    if (!input || input !== password) {
+    if (!input || !secretEquals(input, password)) {
       return NextResponse.json({ error: 'Invalid password' }, { status: 401 });
     }