@nordbyte/nordrelay 0.3.1 → 0.4.0

package/dist/relay-runtime.js

@@ -1,16 +1,23 @@
 import { randomUUID } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
-import { createArtifactZipBundle, getArtifactTurnReport, ensureOutDir, listRecentArtifactReports, removeArtifactTurn, totalArtifactSize, } from "./artifacts.js";
+import { createArtifactZipBundle, collectRecentWorkspaceArtifacts, getArtifactTurnReport, ensureOutDir, listRecentArtifactReports, persistWorkspaceArtifactReport, removeArtifactTurn, totalArtifactSize, } from "./artifacts.js";
 import { buildFileInstructions, outboxPath, stageFile, } from "./attachments.js";
-import { CODEX_AGENT_CAPABILITIES, CODEX_REASONING_EFFORTS, PI_THINKING_LEVELS, agentLabel, agentReasoningLabel, } from "./agent.js";
-import { enabledAgents } from "./agent-factory.js";
-import { checkAuthStatus } from "./codex-auth.js";
-import { getThreadRolloutSnapshot, } from "./codex-state.js";
+import { CODEX_AGENT_CAPABILITIES, agentLabel, agentReasoningLabel, agentReasoningOptions, } from "./agent.js";
+import { getAgentDiagnostics, getExternalSnapshotForSession, } from "./agent-activity.js";
+import { listAgentAdapterDescriptors } from "./agent-adapter.js";
+import { createAgentSessionService, enabledAgents } from "./agent-factory.js";
+import { AuditLogStore } from "./audit-log.js";
+import { checkAuthStatus, startLogin as startCodexLogin, startLogout as startCodexLogout } from "./codex-auth.js";
+import { checkClaudeCodeAuthStatus, startClaudeCodeLogin, startClaudeCodeLogout } from "./claude-code-auth.js";
 import { friendlyErrorText } from "./error-messages.js";
-import { getConnectorHealth, getVersionChecks, readFormattedLogTail, spawnConnectorRestart } from "./operations.js";
+import { checkHermesAuthStatus, startHermesLogin, startHermesLogout } from "./hermes-auth.js";
+import { checkOpenClawAuthStatus } from "./openclaw-auth.js";
+import { getConnectorHealth, getVersionChecks, readConnectorState, readFormattedLogTail, spawnConnectorRestart, spawnSelfUpdate } from "./operations.js";
+import { checkPiAuthStatus } from "./pi-auth.js";
 import { PromptStore, toPromptEnvelope } from "./prompt-store.js";
 import { renderSessionInfoPlain } from "./session-format.js";
+import { SessionLockStore } from "./session-locks.js";
 import { SessionRegistry } from "./session-registry.js";
 import { transcribeAudio } from "./voice.js";
 import { WebActivityStore, WebChatStore, } from "./web-state.js";
@@ -25,12 +32,15 @@ export class RelayRuntime {
     promptStore;
     chatStore;
     activityStore;
+    auditStore;
+    lockStore;
     subscribers = new Set();
     externalMonitor;
     draining = false;
     currentTurnId = null;
     accumulatedText = "";
     currentTurnStartedAt = 0;
+    currentProgress = null;
     externalMirror = null;
     constructor(config) {
         this.config = config;
@@ -41,6 +51,8 @@ export class RelayRuntime {
         this.promptStore = new PromptStore(config.workspace, config.stateBackend);
         this.chatStore = new WebChatStore(config.workspace, config.stateBackend, MAX_CHAT_HISTORY);
         this.activityStore = new WebActivityStore(config.workspace, config.stateBackend, config.auditMaxEvents);
+        this.auditStore = new AuditLogStore(config.workspace, config.stateBackend, config.auditMaxEvents);
+        this.lockStore = new SessionLockStore(config.workspace, config.stateBackend);
         if (config.codexExternalBusyCheckMs > 0) {
             this.externalMonitor = setInterval(() => {
                 void this.monitorExternalActivity().catch((error) => this.broadcastStatus(friendlyErrorText(error), "error"));
@@ -70,48 +82,311 @@ export class RelayRuntime {
     }
     async status() {
         return {
-            health: await getConnectorHealth(),
-            versionChecks: await getVersionChecks({ piCliPath: this.config.piCliPath }),
+            health: await getConnectorHealth({ piCliPath: this.config.piCliPath, hermesCliPath: this.config.hermesCliPath, openClawCliPath: this.config.openClawCliPath, claudeCodeCliPath: this.config.claudeCodeCliPath }),
+            versionChecks: await getVersionChecks({ piCliPath: this.config.piCliPath, hermesCliPath: this.config.hermesCliPath, openClawCliPath: this.config.openClawCliPath, claudeCodeCliPath: this.config.claudeCodeCliPath }),
             snapshot: await this.snapshot(),
         };
     }
+    async version() {
+        return {
+            health: await getConnectorHealth({ piCliPath: this.config.piCliPath, hermesCliPath: this.config.hermesCliPath, openClawCliPath: this.config.openClawCliPath, claudeCodeCliPath: this.config.claudeCodeCliPath }),
+            state: await readConnectorState(),
+            versionChecks: await getVersionChecks({ piCliPath: this.config.piCliPath, hermesCliPath: this.config.hermesCliPath, openClawCliPath: this.config.openClawCliPath, claudeCodeCliPath: this.config.claudeCodeCliPath }),
+        };
+    }
+    updateConnector() {
+        const update = spawnSelfUpdate();
+        this.broadcastStatus(`Update started with ${update.method}. Log: ${update.logPath}`, "warn");
+        this.appendActivity({
+            source: "web",
+            status: "info",
+            type: "update_started",
+            threadId: null,
+            workspace: this.config.workspace,
+            detail: `${update.method}: ${update.summary}`,
+        });
+        this.appendAudit({
+            action: "command",
+            status: "ok",
+            contextKey: WEB_CONTEXT_KEY,
+            description: "update",
+            detail: update.summary,
+        });
+        return update;
+    }
     async diagnostics() {
         return {
-            health: await getConnectorHealth(),
-            versionChecks: await getVersionChecks({ piCliPath: this.config.piCliPath }),
+            health: await getConnectorHealth({ piCliPath: this.config.piCliPath, hermesCliPath: this.config.hermesCliPath, openClawCliPath: this.config.openClawCliPath, claudeCodeCliPath: this.config.claudeCodeCliPath }),
+            versionChecks: await getVersionChecks({ piCliPath: this.config.piCliPath, hermesCliPath: this.config.hermesCliPath, openClawCliPath: this.config.openClawCliPath, claudeCodeCliPath: this.config.claudeCodeCliPath }),
             snapshot: await this.snapshot(),
             runtime: {
                 stateBackend: this.config.stateBackend,
                 sourceWorkspace: this.config.workspace,
                 queuePaused: this.promptStore.isPaused(WEB_CONTEXT_KEY),
                 externalMirror: this.externalMirror ? { ...this.externalMirror } : null,
+                agentDiagnostics: getAgentDiagnostics(await this.getSession(true), this.config),
             },
         };
     }
-    async controlOptions() {
-        const session = await this.getSession(true);
-        const info = this.publicInfo(session);
-        const capabilities = info.capabilities ?? CODEX_AGENT_CAPABILITIES;
-        return {
-            models: capabilities.modelSelection ? session.listModels() : [],
-            reasoningLabel: agentReasoningLabel(info.agentId),
-            reasoningOptions: info.agentId === "pi" ? PI_THINKING_LEVELS : CODEX_REASONING_EFFORTS,
-            launchProfiles: capabilities.launchProfiles
-                ? this.config.launchProfiles.map((profile) => ({
-                    id: profile.id,
-                    label: profile.label,
-                    behavior: `${profile.sandboxMode} / ${profile.approvalPolicy}`,
-                    unsafe: profile.unsafe,
+    async adapterHealth() {
+        const health = await getConnectorHealth({ piCliPath: this.config.piCliPath, hermesCliPath: this.config.hermesCliPath, openClawCliPath: this.config.openClawCliPath, claudeCodeCliPath: this.config.claudeCodeCliPath });
+        const versions = await getVersionChecks({ piCliPath: this.config.piCliPath, hermesCliPath: this.config.hermesCliPath, openClawCliPath: this.config.openClawCliPath, claudeCodeCliPath: this.config.claudeCodeCliPath });
+        return Promise.all(listAgentAdapterDescriptors().map(async (descriptor) => {
+            const enabled = enabledAgents(this.config).includes(descriptor.id);
+            const auth = descriptor.capabilities.auth && enabled
+                ? await this.authStatus(descriptor.id).catch((error) => ({
+                    agentId: descriptor.id,
+                    agentLabel: descriptor.label,
+                    supported: descriptor.capabilities.auth,
+                    authenticated: false,
+                    detail: friendlyErrorText(error),
+                    loginSupported: descriptor.capabilities.login,
+                    logoutSupported: descriptor.capabilities.logout,
                 }))
-                : [],
-            workspaces: filterAllowedWorkspaces(session.listWorkspaces(), this.config),
-            capabilities,
+                : null;
+            const cli = cliHealthForAgent(descriptor.id, health);
+            const version = versionCheckForAgent(descriptor.id, versions);
+            return {
+                id: descriptor.id,
+                label: descriptor.label,
+                enabled,
+                status: descriptor.status === "available" ? (enabled ? "enabled" : "disabled") : "planned",
+                auth: {
+                    supported: descriptor.capabilities.auth,
+                    authenticated: auth ? auth.authenticated : null,
+                    method: auth?.method,
+                    detail: auth?.detail,
+                },
+                cli,
+                version: {
+                    installed: version.installedLabel,
+                    latest: version.latestVersion,
+                    status: version.status,
+                    detail: version.detail,
+                },
+                capabilities: descriptor.capabilities,
+                notes: descriptor.notes,
+            };
+        }));
+    }
+    permissions() {
+        return {
+            telegramAllowAnyChat: this.config.telegramAllowAnyChat,
+            telegramAdminUserIds: this.config.telegramAdminUserIds,
+            telegramAllowedUserIds: this.config.telegramAllowedUserIds,
+            telegramReadOnlyUserIds: this.config.telegramReadOnlyUserIds,
+            telegramAllowedChatIds: this.config.telegramAllowedChatIds,
+            telegramRolePolicies: this.config.telegramRolePolicies,
         };
     }
+    tasks() {
+        return {
+            current: this.currentProgress ? { ...this.currentProgress, tools: [...this.currentProgress.tools] } : null,
+            external: this.externalTask(),
+            queue: this.queue(),
+            queuePaused: this.queuePaused(),
+            recent: this.activity({ limit: 20 }),
+        };
+    }
+    audit(limit = 50) {
+        return this.auditStore.list(limit);
+    }
+    locks() {
+        return this.lockStore.list();
+    }
+    lockWebSession(ownerName = "Web dashboard") {
+        const lock = this.lockStore.set(WEB_CONTEXT_KEY, 0, ownerName, this.config.sessionLockTtlMs);
+        this.appendAudit({
+            action: "lock_updated",
+            status: "ok",
+            contextKey: WEB_CONTEXT_KEY,
+            description: "lock",
+            detail: `locked by ${ownerName}`,
+        });
+        return lock;
+    }
+    unlockWebSession() {
+        const removed = this.lockStore.clear(WEB_CONTEXT_KEY);
+        this.appendAudit({
+            action: "lock_updated",
+            status: "ok",
+            contextKey: WEB_CONTEXT_KEY,
+            description: "unlock",
+            detail: removed ? "unlocked" : "no lock",
+        });
+        return { removed, locks: this.locks() };
+    }
+    async controlOptions(agentId) {
+        const { session, dispose } = await this.getControlSession(agentId);
+        try {
+            const info = this.publicInfo(session);
+            const capabilities = info.capabilities ?? CODEX_AGENT_CAPABILITIES;
+            if (capabilities.modelSelection) {
+                await session.refreshModels().catch((error) => {
+                    console.warn(`Failed to refresh ${agentLabel(info.agentId)} models: ${error instanceof Error ? error.message : String(error)}`);
+                });
+            }
+            return {
+                models: capabilities.modelSelection ? session.listModels() : [],
+                reasoningLabel: agentReasoningLabel(info.agentId),
+                reasoningOptions: agentReasoningOptions(info.agentId),
+                launchProfiles: capabilities.launchProfiles ? session.listLaunchProfiles() : [],
+                workspaces: filterAllowedWorkspaces(session.listWorkspaces(), this.config),
+                capabilities,
+            };
+        }
+        finally {
+            if (dispose) {
+                session.dispose();
+            }
+        }
+    }
+    async authStatus(agentId) {
+        const { session, dispose } = await this.getControlSession(agentId);
+        try {
+            const info = this.publicInfo(session);
+            const capabilities = info.capabilities ?? CODEX_AGENT_CAPABILITIES;
+            if (!capabilities.auth) {
+                return {
+                    agentId: info.agentId,
+                    agentLabel: info.agentLabel,
+                    supported: false,
+                    authenticated: null,
+                    detail: `${info.agentLabel} authentication is managed outside NordRelay.`,
+                    loginSupported: false,
+                    logoutSupported: false,
+                    hostLoginCommand: hostLoginCommand(info, this.config),
+                    hostLogoutCommand: hostLogoutCommand(info, this.config),
+                };
+            }
+            const status = await this.checkAgentAuth(info);
+            return {
+                agentId: info.agentId,
+                agentLabel: info.agentLabel,
+                supported: true,
+                authenticated: status.authenticated,
+                method: status.method,
+                detail: status.detail,
+                loginSupported: capabilities.login,
+                logoutSupported: capabilities.logout,
+                hostLoginCommand: hostLoginCommand(info, this.config),
+                hostLogoutCommand: hostLogoutCommand(info, this.config),
+            };
+        }
+        finally {
+            if (dispose) {
+                session.dispose();
+            }
+        }
+    }
+    async login(agentId) {
+        const { session, dispose } = await this.getControlSession(agentId);
+        try {
+            const info = this.publicInfo(session);
+            const capabilities = info.capabilities ?? CODEX_AGENT_CAPABILITIES;
+            if (!capabilities.login) {
+                return {
+                    ...(await this.authStatus(info.agentId)),
+                    result: {
+                        success: false,
+                        message: `${info.agentLabel} login is not managed by NordRelay. Run ${hostLoginCommand(info, this.config)} on the host.`,
+                    },
+                };
+            }
+            if (!this.config.enableTelegramLogin) {
+                return {
+                    ...(await this.authStatus(info.agentId)),
+                    result: {
+                        success: false,
+                        message: `Remote login is disabled. Run ${hostLoginCommand(info, this.config)} on the host.`,
+                    },
+                };
+            }
+            const result = await this.startAgentLogin(info);
+            this.appendAudit({
+                action: "command",
+                status: result.success ? "ok" : "failed",
+                contextKey: WEB_CONTEXT_KEY,
+                agentId: info.agentId,
+                threadId: info.threadId,
+                workspace: info.workspace,
+                description: "login",
+                detail: result.message,
+            });
+            return { ...(await this.authStatus(info.agentId)), result };
+        }
+        finally {
+            if (dispose) {
+                session.dispose();
+            }
+        }
+    }
+    async logout(agentId) {
+        const { session, dispose } = await this.getControlSession(agentId);
+        try {
+            const info = this.publicInfo(session);
+            const capabilities = info.capabilities ?? CODEX_AGENT_CAPABILITIES;
+            if (!capabilities.logout) {
+                return {
+                    ...(await this.authStatus(info.agentId)),
+                    result: {
+                        success: false,
+                        message: `${info.agentLabel} logout is not managed by NordRelay. Run ${hostLogoutCommand(info, this.config)} on the host.`,
+                    },
+                };
+            }
+            if (!this.config.enableTelegramLogin) {
+                return {
+                    ...(await this.authStatus(info.agentId)),
+                    result: {
+                        success: false,
+                        message: `Remote auth management is disabled. Run ${hostLogoutCommand(info, this.config)} on the host.`,
+                    },
+                };
+            }
+            const current = await this.checkAgentAuth(info);
+            if (current.method === "api-key") {
+                return {
+                    ...(await this.authStatus(info.agentId)),
+                    result: {
+                        success: false,
+                        message: "Cannot logout while API-key authentication is configured. Remove the API key from .env to use CLI auth.",
+                    },
+                };
+            }
+            const result = await this.startAgentLogout(info);
+            this.appendAudit({
+                action: "command",
+                status: result.success ? "ok" : "failed",
+                contextKey: WEB_CONTEXT_KEY,
+                agentId: info.agentId,
+                threadId: info.threadId,
+                workspace: info.workspace,
+                description: "logout",
+                detail: result.message,
+            });
+            return { ...(await this.authStatus(info.agentId)), result };
+        }
+        finally {
+            if (dispose) {
+                session.dispose();
+            }
+        }
+    }
     async chatHistory(limit = 200) {
         const session = await this.getSession(true);
         return this.chatStore.list(this.publicInfo(session).threadId, limit);
     }
+    async sessionDetail(threadId) {
+        const session = await this.getSession(true);
+        const record = session.getSessionRecord(threadId);
+        return {
+            record,
+            active: this.publicInfo(session),
+            messages: this.chatStore.list(threadId, 100),
+            activity: this.activity({ limit: 100 }).filter((event) => event.threadId === threadId),
+        };
+    }
     async clearChatHistory() {
         const session = await this.getSession(true);
         const removed = this.chatStore.clear(this.publicInfo(session).threadId);
@@ -122,6 +397,51 @@ export class RelayRuntime {
     activity(options = {}) {
         return this.activityStore.list(options);
     }
+    async retry() {
+        const cached = this.promptStore.getLastPrompt(WEB_CONTEXT_KEY);
+        if (!cached) {
+            throw new Error("Nothing to retry. Send a message first.");
+        }
+        this.appendAudit({
+            action: "command",
+            status: "ok",
+            contextKey: WEB_CONTEXT_KEY,
+            description: "retry",
+            detail: cached.description,
+        });
+        return this.sendEnvelope(cached);
+    }
+    async sync() {
+        const session = await this.getSession(true);
+        const info = this.publicInfo(session);
+        if (!(info.capabilities ?? CODEX_AGENT_CAPABILITIES).externalActivity) {
+            throw new Error(`${info.agentLabel} has no external state watcher to sync.`);
+        }
+        const result = session.syncFromAgentState({ reattach: true });
+        if (result.changed) {
+            this.updateSession(session);
+        }
+        this.appendActivity({
+            source: "web",
+            status: "info",
+            type: "session_sync",
+            threadId: result.info.threadId,
+            workspace: result.info.workspace,
+            agentId: result.info.agentId,
+            detail: result.changedFields.length > 0 ? result.changedFields.join(", ") : "already in sync",
+        });
+        this.appendAudit({
+            action: "command",
+            status: "ok",
+            contextKey: WEB_CONTEXT_KEY,
+            agentId: result.info.agentId,
+            threadId: result.info.threadId,
+            workspace: result.info.workspace,
+            description: "sync",
+            detail: result.changedFields.join(", ") || "none",
+        });
+        return result;
+    }
     async listSessions(limit = 80, query = "") {
         return this.filteredSessions(await this.getSession(true), query, Math.max(1, limit * 3)).slice(0, limit);
     }
@@ -161,7 +481,12 @@ export class RelayRuntime {
         });
     }
     async listModels() {
-        return (await this.getSession(true)).listModels();
+        const session = await this.getSession(true);
+        const info = this.publicInfo(session);
+        await session.refreshModels({ force: true }).catch((error) => {
+            console.warn(`Failed to refresh ${agentLabel(info.agentId)} models: ${error instanceof Error ? error.message : String(error)}`);
+        });
+        return session.listModels();
     }
     async setAgent(agentId) {
         if (!enabledAgents(this.config).includes(agentId)) {
@@ -175,7 +500,7 @@ export class RelayRuntime {
         const session = options.agentId ? await this.registry.switchAgent(WEB_CONTEXT_KEY, options.agentId) : await this.getSession(true);
         this.ensureIdle(session);
         if (options.reasoningEffort) {
-            const reasoningOptions = session.getInfo().agentId === "pi" ? PI_THINKING_LEVELS : CODEX_REASONING_EFFORTS;
+            const reasoningOptions = agentReasoningOptions(session.getInfo().agentId);
             if (!reasoningOptions.includes(options.reasoningEffort)) {
                 throw new Error(`Invalid ${agentReasoningLabel(session.getInfo().agentId)} value: ${options.reasoningEffort}`);
             }
@@ -230,7 +555,7 @@ export class RelayRuntime {
     async setReasoningEffort(effort) {
         const session = await this.getSession(true);
         this.ensureIdle(session);
-        const options = session.getInfo().agentId === "pi" ? PI_THINKING_LEVELS : CODEX_REASONING_EFFORTS;
+        const options = agentReasoningOptions(session.getInfo().agentId);
         if (!options.includes(effort)) {
             throw new Error(`Invalid ${agentReasoningLabel(session.getInfo().agentId)} value: ${effort}`);
         }
@@ -264,6 +589,16 @@ export class RelayRuntime {
     }
     async abort() {
         const session = await this.getSession(true);
+        const snapshot = getExternalSnapshotForSession(session, this.config, { maxEvents: 0 });
+        if (snapshot?.activity.active && !session.isProcessing()) {
+            this.broadcast({
+                type: "status",
+                level: "warn",
+                message: `Cannot abort the external ${snapshot.agentLabel} CLI task from NordRelay. Stop it in the terminal where it is running.`,
+                at: new Date().toISOString(),
+            });
+            return;
+        }
         await session.abort();
         this.broadcast({ type: "status", level: "warn", message: "Current operation aborted.", at: new Date().toISOString() });
     }
@@ -341,7 +676,8 @@ export class RelayRuntime {
     }
     async sendEnvelope(envelope) {
         const session = await this.getSession(false);
-        if (session.isProcessing()) {
+        const external = getExternalSnapshotForSession(session, this.config, { maxEvents: 0 });
+        if (session.isProcessing() || external?.activity.active) {
             const queued = this.promptStore.enqueue(WEB_CONTEXT_KEY, envelope);
             const info = this.publicInfo(session);
             this.appendActivity({
@@ -352,8 +688,23 @@ export class RelayRuntime {
                 workspace: info.workspace,
                 agentId: info.agentId,
                 prompt: envelope.description,
-                detail: `Queued at position ${this.promptStore.list(WEB_CONTEXT_KEY).length}.`,
+                detail: external?.activity.active
+                    ? `Queued because ${external.agentLabel} CLI is still processing another task.`
+                    : `Queued at position ${this.promptStore.list(WEB_CONTEXT_KEY).length}.`,
+            });
+            this.appendAudit({
+                action: "prompt_queued",
+                status: "ok",
+                contextKey: WEB_CONTEXT_KEY,
+                agentId: info.agentId,
+                threadId: info.threadId,
+                workspace: info.workspace,
+                promptId: queued.id,
+                description: envelope.description,
             });
+            if (external?.activity.active) {
+                this.broadcastStatus(`Waiting for ${external.agentLabel} CLI task... ${this.promptStore.list(WEB_CONTEXT_KEY).length} queued.`, "info");
+            }
             this.broadcastQueue();
             return { queued: true, queueId: queued.id };
         }
@@ -397,6 +748,12 @@ export class RelayRuntime {
             workspace: this.config.workspace,
             detail: id ? `${action}: ${id}` : action,
         });
+        this.appendAudit({
+            action: "queue_updated",
+            status: "ok",
+            contextKey: WEB_CONTEXT_KEY,
+            description: id ? `${action}: ${id}` : action,
+        });
         this.broadcastQueue();
         return this.queue();
     }
@@ -485,23 +842,21 @@ export class RelayRuntime {
     async monitorExternalActivity() {
         const session = await this.getSession(true);
         const info = this.publicInfo(session);
-        if (!info.capabilities.externalActivity || info.agentId !== "codex" || !info.threadId || session.isProcessing()) {
+        if (!info.capabilities.externalActivity || !info.threadId || session.isProcessing()) {
             return;
         }
-        const snapshot = getThreadRolloutSnapshot(info.threadId, {
+        const snapshot = getExternalSnapshotForSession(session, this.config, {
             afterLine: this.externalMirror?.threadId === info.threadId ? this.externalMirror.lastLine : Number.MAX_SAFE_INTEGER,
-            staleAfterMs: this.config.codexExternalBusyStaleMs,
-        }) ?? getThreadRolloutSnapshot(info.threadId, {
-            staleAfterMs: this.config.codexExternalBusyStaleMs,
+        }) ?? getExternalSnapshotForSession(session, this.config, {
             maxEvents: 0,
         });
         if (!snapshot) {
             return;
         }
-        if (!this.externalMirror || this.externalMirror.threadId !== snapshot.threadId || this.externalMirror.rolloutPath !== snapshot.rolloutPath) {
+        if (!this.externalMirror || this.externalMirror.threadId !== snapshot.threadId || this.externalMirror.rolloutPath !== snapshot.sourcePath) {
             this.externalMirror = {
                 threadId: snapshot.threadId,
-                rolloutPath: snapshot.rolloutPath,
+                rolloutPath: snapshot.sourcePath,
                 lastLine: snapshot.lineCount,
                 turnId: snapshot.activity.turnId,
                 startedAt: snapshot.activity.startedAt?.toISOString() ?? null,
@@ -555,16 +910,21 @@ export class RelayRuntime {
                 workspace: info.workspace,
                 agentId: info.agentId,
                 prompt: snapshot.latestUserMessage ?? undefined,
-                detail: `Codex CLI task ${terminalEvent.status ?? "finished"}.`,
+                detail: `${snapshot.agentLabel} CLI task ${terminalEvent.status ?? "finished"}.`,
                 durationMs: durationFromDates(externalStartedAt, terminalEvent.timestamp),
             });
-            this.broadcastStatus(`Codex CLI task ${terminalEvent.status ?? "finished"}.`, terminalEvent.status === "failed" ? "error" : terminalEvent.status === "aborted" ? "warn" : "info");
+            if (externalStartedAt && terminalEvent.turnId) {
+                await this.persistWorkspaceArtifactsForTurn(info.workspace, terminalEvent.turnId, externalStartedAt);
+            }
+            mirror.latestStatus = `${snapshot.agentLabel} CLI task ${terminalEvent.status ?? "finished"}.`;
+            this.broadcastStatus(`${snapshot.agentLabel} CLI task ${terminalEvent.status ?? "finished"}.`, terminalEvent.status === "failed" ? "error" : terminalEvent.status === "aborted" ? "warn" : "info");
             this.broadcast({ type: "chat_history", messages: await this.chatHistory() });
+            await this.drainQueue();
         }
         mirror.lastLine = Math.max(mirror.lastLine, snapshot.lineCount);
     }
     startExternalTurn(snapshot) {
-        const prompt = snapshot.latestUserMessage ?? "Codex CLI task";
+        const prompt = snapshot.latestUserMessage ?? `${snapshot.agentLabel} CLI task`;
         this.chatStore.append({
             threadId: snapshot.threadId,
             role: "user",
@@ -586,7 +946,7 @@ export class RelayRuntime {
             type: "cli_turn_started",
             threadId: snapshot.threadId,
             prompt,
-            detail: `Rollout: ${snapshot.rolloutPath}`,
+            detail: `${snapshot.sourceLabel}: ${snapshot.sourcePath}`,
         });
     }
     broadcastExternalEvents(snapshot, events) {
@@ -619,12 +979,79 @@ export class RelayRuntime {
     async getSession(deferThreadStart) {
         return this.registry.getOrCreate(WEB_CONTEXT_KEY, { deferThreadStart });
     }
+    async getControlSession(agentId) {
+        const active = await this.getSession(true);
+        const activeInfo = this.publicInfo(active);
+        if (!agentId || agentId === activeInfo.agentId) {
+            return { session: active, dispose: false };
+        }
+        if (!enabledAgents(this.config).includes(agentId)) {
+            throw new Error(`Agent is not enabled: ${agentId}`);
+        }
+        const session = await createAgentSessionService(this.config, agentId, {
+            deferThreadStart: true,
+            workspace: activeInfo.workspace,
+        });
+        return { session, dispose: true };
+    }
     async ensureActiveThread(session) {
         if (!session.hasActiveThread()) {
             await session.newThread();
             this.updateSession(session);
         }
     }
+    async checkAgentAuth(info) {
+        if (info.agentId === "pi") {
+            return checkPiAuthStatus(info.model);
+        }
+        if (info.agentId === "hermes") {
+            return checkHermesAuthStatus({
+                baseUrl: this.config.hermesApiBaseUrl,
+                apiKey: this.config.hermesApiKey,
+            });
+        }
+        if (info.agentId === "openclaw") {
+            return checkOpenClawAuthStatus({
+                gatewayUrl: this.config.openClawGatewayUrl,
+                token: this.config.openClawGatewayToken,
+                password: this.config.openClawGatewayPassword,
+            });
+        }
+        if (info.agentId === "claude-code") {
+            return checkClaudeCodeAuthStatus(this.config.claudeCodeCliPath);
+        }
+        return checkAuthStatus(this.config.codexApiKey);
+    }
+    async startAgentLogin(info) {
+        if (info.agentId === "hermes") {
+            return startHermesLogin(this.config.hermesCliPath);
+        }
+        if (info.agentId === "claude-code") {
+            return startClaudeCodeLogin(this.config.claudeCodeCliPath);
+        }
+        if (info.agentId === "codex") {
+            return startCodexLogin();
+        }
+        return {
+            success: false,
+            message: `${info.agentLabel} login is not managed by NordRelay. Run the agent login flow on the host.`,
+        };
+    }
+    async startAgentLogout(info) {
+        if (info.agentId === "hermes") {
+            return startHermesLogout(this.config.hermesCliPath);
+        }
+        if (info.agentId === "claude-code") {
+            return startClaudeCodeLogout(this.config.claudeCodeCliPath);
+        }
+        if (info.agentId === "codex") {
+            return startCodexLogout();
+        }
+        return {
+            success: false,
+            message: `${info.agentLabel} logout is not managed by NordRelay. Run the agent logout flow on the host.`,
+        };
+    }
     ensureIdle(session) {
         if (session.isProcessing()) {
             throw new Error("The active session is still processing a turn.");
@@ -634,9 +1061,9 @@ export class RelayRuntime {
         await this.ensureActiveThread(session);
         const info = session.getInfo();
         if ((info.capabilities ?? CODEX_AGENT_CAPABILITIES).auth) {
-            const auth = await checkAuthStatus(this.config.codexApiKey);
+            const auth = await this.checkAgentAuth(info);
             if (!auth.authenticated) {
-                throw new Error(`Codex is not authenticated: ${auth.detail}`);
+                throw new Error(`${agentLabel(info.agentId)} is not authenticated: ${auth.detail}`);
             }
         }
         const workspacePolicy = evaluateWorkspacePolicy(session.getInfo().workspace, this.config);
@@ -647,8 +1074,24 @@ export class RelayRuntime {
         this.currentTurnId = turnId;
         this.currentTurnStartedAt = Date.now();
         this.accumulatedText = "";
+        this.currentProgress = {
+            id: turnId,
+            source: "web",
+            status: "running",
+            prompt: envelope.description,
+            agentId: info.agentId,
+            agentLabel: info.agentLabel,
+            threadId: info.threadId,
+            workspace: info.workspace,
+            startedAt: new Date(this.currentTurnStartedAt).toISOString(),
+            updatedAt: new Date(this.currentTurnStartedAt).toISOString(),
+            durationMs: 0,
+            outputChars: 0,
+            tools: [],
+        };
         this.promptStore.setLastPrompt(WEB_CONTEXT_KEY, envelope);
-        const startedAt = new Date().toISOString();
+        const startedDate = new Date();
+        const startedAt = startedDate.toISOString();
         this.chatStore.append({
             threadId: info.threadId ?? "pending",
             role: "user",
@@ -666,22 +1109,45 @@ export class RelayRuntime {
             agentId: info.agentId,
             prompt: envelope.description,
         });
+        this.appendAudit({
+            action: "prompt_started",
+            status: "ok",
+            contextKey: WEB_CONTEXT_KEY,
+            agentId: info.agentId,
+            threadId: info.threadId,
+            workspace: info.workspace,
+            description: envelope.description,
+        });
         this.broadcast({ type: "turn_start", id: turnId, prompt: envelope.description, at: startedAt, source: "web" });
         const callbacks = {
             onTextDelta: (delta) => {
                 this.accumulatedText += delta;
+                this.updateCurrentProgress({ outputChars: this.accumulatedText.length });
                 this.broadcast({ type: "text_delta", id: turnId, delta });
             },
-            onToolStart: (toolName, toolCallId) => this.broadcast({ type: "tool_start", id: turnId, toolCallId, toolName }),
-            onToolUpdate: (toolCallId, partialResult) => this.broadcast({ type: "tool_update", id: turnId, toolCallId, partialResult }),
-            onToolEnd: (toolCallId, isError) => this.broadcast({ type: "tool_end", id: turnId, toolCallId, isError }),
-            onTodoUpdate: (items) => this.broadcast({ type: "todo_update", id: turnId, items }),
+            onToolStart: (toolName, toolCallId) => {
+                this.addCurrentTool(toolName);
+                this.broadcast({ type: "tool_start", id: turnId, toolCallId, toolName });
+            },
+            onToolUpdate: (toolCallId, partialResult) => {
+                this.updateCurrentProgress();
+                this.broadcast({ type: "tool_update", id: turnId, toolCallId, partialResult });
+            },
+            onToolEnd: (toolCallId, isError) => {
+                this.updateCurrentProgress({ currentTool: undefined });
+                this.broadcast({ type: "tool_end", id: turnId, toolCallId, isError });
+            },
+            onTodoUpdate: (items) => {
+                this.updateCurrentProgress({ detail: `Plan: ${items.filter((item) => item.completed).length}/${items.length} done` });
+                this.broadcast({ type: "todo_update", id: turnId, items });
+            },
             onTurnComplete: () => { },
             onAgentEnd: () => this.broadcast({ type: "turn_complete", id: turnId, at: new Date().toISOString() }),
         };
         try {
             await session.prompt(envelope.input, callbacks);
             this.updateSession(session);
+            await this.persistWorkspaceArtifactsForTurn(session.getInfo().workspace, turnId, startedDate);
             if (this.accumulatedText.trim()) {
                 this.chatStore.append({
                     threadId: info.threadId ?? "pending",
@@ -701,6 +1167,16 @@ export class RelayRuntime {
                 prompt: envelope.description,
                 durationMs: Date.now() - this.currentTurnStartedAt,
             });
+            this.appendAudit({
+                action: "prompt_completed",
+                status: "ok",
+                contextKey: WEB_CONTEXT_KEY,
+                agentId: info.agentId,
+                threadId: info.threadId,
+                workspace: info.workspace,
+                description: envelope.description,
+            });
+            this.updateCurrentProgress({ status: "completed" });
             this.broadcast({ type: "turn_complete", id: turnId, at: new Date().toISOString() });
             this.broadcast({ type: "chat_history", messages: await this.chatHistory() });
         }
@@ -724,12 +1200,27 @@ export class RelayRuntime {
                 detail: errorText,
                 durationMs: Date.now() - this.currentTurnStartedAt,
             });
+            this.appendAudit({
+                action: "prompt_failed",
+                status: "failed",
+                contextKey: WEB_CONTEXT_KEY,
+                agentId: info.agentId,
+                threadId: info.threadId,
+                workspace: info.workspace,
+                description: envelope.description,
+                detail: errorText,
+            });
+            this.updateCurrentProgress({ status: "failed", detail: errorText });
             this.broadcast({ type: "turn_error", id: turnId, error: errorText, at: new Date().toISOString() });
             this.broadcast({ type: "chat_history", messages: await this.chatHistory() });
             throw error;
         }
         finally {
             this.currentTurnId = null;
+            if (this.currentProgress) {
+                this.currentProgress.durationMs = Date.now() - this.currentTurnStartedAt;
+                this.currentProgress.updatedAt = new Date().toISOString();
+            }
             await this.drainQueue();
         }
     }
@@ -741,6 +1232,11 @@ export class RelayRuntime {
         try {
             const session = await this.getSession(false);
             while (!session.isProcessing()) {
+                const external = getExternalSnapshotForSession(session, this.config, { maxEvents: 0 });
+                if (external?.activity.active) {
+                    this.broadcastStatus(`Waiting for ${external.agentLabel} CLI task... ${this.queue().length} queued.`, "info");
+                    return;
+                }
                 const next = this.promptStore.dequeue(WEB_CONTEXT_KEY);
                 this.broadcastQueue();
                 if (!next) {
@@ -762,6 +1258,62 @@ export class RelayRuntime {
         this.broadcast({ type: "activity_update", events: this.activity({ limit: 50 }) });
         return event;
     }
+    appendAudit(input) {
+        return this.auditStore.append({ ...input, channelId: "web" });
+    }
+    updateCurrentProgress(patch = {}) {
+        if (!this.currentProgress) {
+            return;
+        }
+        if ("currentTool" in patch) {
+            this.currentProgress.currentTool = patch.currentTool;
+            const { currentTool: _currentTool, ...rest } = patch;
+            Object.assign(this.currentProgress, rest);
+        }
+        else {
+            Object.assign(this.currentProgress, patch);
+        }
+        this.currentProgress.durationMs = Date.now() - this.currentTurnStartedAt;
+        this.currentProgress.updatedAt = new Date().toISOString();
+    }
+    addCurrentTool(toolName) {
+        if (!this.currentProgress) {
+            return;
+        }
+        const existing = this.currentProgress.tools.find((tool) => tool.name === toolName);
+        if (existing) {
+            existing.count += 1;
+        }
+        else {
+            this.currentProgress.tools.push({ name: toolName, count: 1 });
+        }
+        this.updateCurrentProgress({ currentTool: toolName, lastTool: toolName });
+    }
+    externalTask() {
+        if (!this.externalMirror) {
+            return null;
+        }
+        const startedAt = this.externalMirror.startedAt ?? new Date().toISOString();
+        const startedMs = new Date(startedAt).getTime();
+        return {
+            id: this.externalMirror.turnId ?? "cli",
+            source: "cli",
+            status: this.externalMirror.latestStatus?.includes("failed")
+                ? "failed"
+                : this.externalMirror.latestStatus?.includes("aborted")
+                    ? "aborted"
+                    : this.externalMirror.latestStatus?.includes("finished") || this.externalMirror.latestStatus?.includes("completed")
+                        ? "completed"
+                        : "running",
+            threadId: this.externalMirror.threadId,
+            startedAt,
+            updatedAt: new Date().toISOString(),
+            durationMs: Number.isFinite(startedMs) ? Math.max(0, Date.now() - startedMs) : 0,
+            outputChars: 0,
+            tools: [],
+            detail: this.externalMirror.latestStatus ?? this.externalMirror.rolloutPath,
+        };
+    }
     broadcastQueue() {
         this.broadcast({ type: "queue_update", queue: this.queue(), paused: this.queuePaused() });
     }
@@ -788,6 +1340,20 @@ export class RelayRuntime {
             capabilities: info.capabilities ?? CODEX_AGENT_CAPABILITIES,
         };
     }
+    async persistWorkspaceArtifactsForTurn(workspace, turnId, startedAt) {
+        const report = await collectRecentWorkspaceArtifacts(workspace, {
+            since: startedAt,
+            until: new Date(),
+            maxFileSize: this.config.maxFileSize,
+            limit: 20,
+            ignoreDirs: this.config.artifactIgnoreDirs,
+            ignoreGlobs: this.config.artifactIgnoreGlobs,
+        });
+        if (report.artifacts.length === 0 && report.skippedCount === 0 && !report.omittedCount) {
+            return;
+        }
+        await persistWorkspaceArtifactReport(workspace, turnId, report);
+    }
 }
 function queueItemDto(item) {
     return {
@@ -820,7 +1386,63 @@ function externalStatusLine(snapshot, queueLength) {
         ? formatDuration((Date.now() - snapshot.activity.startedAt.getTime()) / 1000)
         : "-";
     const tool = snapshot.latestToolName ?? "-";
-    return `Codex CLI running · ${elapsed} · tool ${tool} · ${queueLength} queued`;
+    return `${snapshot.agentLabel} CLI running · ${elapsed} · tool ${tool} · ${queueLength} queued`;
+}
+function cliHealthForAgent(agentId, health) {
+    if (agentId === "pi") {
+        return { path: health.piCliPath, label: health.piCli, version: health.piCliVersion };
+    }
+    if (agentId === "hermes") {
+        return { path: health.hermesCliPath, label: health.hermesCli, version: health.hermesCliVersion };
+    }
+    if (agentId === "openclaw") {
+        return { path: health.openClawCliPath, label: health.openClawCli, version: health.openClawCliVersion };
+    }
+    if (agentId === "claude-code") {
+        return { path: health.claudeCodeCliPath, label: health.claudeCodeCli, version: health.claudeCodeCliVersion };
+    }
+    return { path: health.codexCliPath, label: health.codexCli, version: health.codexCliVersion };
+}
+function versionCheckForAgent(agentId, versions) {
+    if (agentId === "pi")
+        return versions.pi;
+    if (agentId === "hermes")
+        return versions.hermes;
+    if (agentId === "openclaw")
+        return versions.openclaw;
+    if (agentId === "claude-code")
+        return versions.claudeCode;
+    return versions.codex;
+}
+function hostLoginCommand(info, config) {
+    if (info.agentId === "hermes") {
+        return `${config.hermesCliPath ?? "hermes"} login --no-browser`;
+    }
+    if (info.agentId === "claude-code") {
+        return `${config.claudeCodeCliPath ?? "claude"} auth login`;
+    }
+    if (info.agentId === "pi") {
+        return `${config.piCliPath ?? "pi"} auth login`;
+    }
+    if (info.agentId === "openclaw") {
+        return `${config.openClawCliPath ?? "openclaw"} login`;
+    }
+    return "codex login --device-auth";
+}
+function hostLogoutCommand(info, config) {
+    if (info.agentId === "hermes") {
+        return `${config.hermesCliPath ?? "hermes"} logout`;
+    }
+    if (info.agentId === "claude-code") {
+        return `${config.claudeCodeCliPath ?? "claude"} auth logout`;
+    }
+    if (info.agentId === "pi") {
+        return `${config.piCliPath ?? "pi"} auth logout`;
+    }
+    if (info.agentId === "openclaw") {
+        return `${config.openClawCliPath ?? "openclaw"} logout`;
+    }
+    return "codex logout";
 }
 function durationFromDates(start, end) {
     if (!start || !end) {