@nordbyte/nordrelay 0.4.0 → 0.5.0

package/dist/web-dashboard.js

@@ -6,26 +6,31 @@ import { URL } from "node:url";
 import { enabledAgents } from "./agent-factory.js";
 import { listAgentAdapterDescriptors } from "./agent-adapter.js";
 import { isAgentId } from "./agent.js";
+import { AuditLogStore } from "./audit-log.js";
 import { listChannelDescriptors } from "./channel-adapter.js";
+import { ALL_PERMISSIONS, permissionForWebRequest } from "./access-control.js";
 import { loadConfig } from "./config.js";
 import { friendlyErrorText } from "./error-messages.js";
 import { escapeHTML } from "./format.js";
 import { RelayRuntime } from "./relay-runtime.js";
 import { resolveDashboardEnvPath, SettingsService } from "./settings-service.js";
+import { UserStore, publicUser, publicUserSnapshot } from "./user-management.js";
+import { dashboardCss, dashboardJs } from "./web-dashboard-assets.js";
 import { renderDashboardNav } from "./web-dashboard-ui.js";
 const DEFAULT_HOME = path.join(os.homedir(), ".nordrelay");
 const JSON_HEADERS = { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" };
 const options = parseOptions(process.argv.slice(2));
-const auth = resolveDashboardAuth(options.host);
-if (auth.publicBind && !auth.token && !(auth.user && auth.password)) {
-    throw new Error("Dashboard bound to 0.0.0.0 requires NORDRELAY_DASHBOARD_TOKEN or NORDRELAY_DASHBOARD_USER/PASSWORD.");
-}
 const config = loadConfig();
 const runtime = new RelayRuntime(config);
 const settings = new SettingsService(resolveDashboardEnvPath(options.home));
+const users = new UserStore(options.home);
+const auditLog = new AuditLogStore(config.workspace, config.stateBackend, config.auditMaxEvents);
+const loginAttempts = new Map();
+class AccessDeniedError extends Error {
+}
 const server = createServer((req, res) => {
     void handleRequest(req, res).catch((error) => {
-        sendJson(res, 500, { error: friendlyErrorText(error) });
+        sendJson(res, error instanceof AccessDeniedError ? 403 : 500, { error: friendlyErrorText(error) });
     });
 });
 await new Promise((resolve) => server.listen(options.port, options.host, resolve));
@@ -34,64 +39,109 @@ process.once("SIGINT", () => shutdown());
 process.once("SIGTERM", () => shutdown());
 async function handleRequest(req, res) {
     const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
-    const queryToken = url.searchParams.get("token");
-    if (queryToken && isAuthorizedToken(queryToken) && !url.pathname.startsWith("/api/")) {
-        setAuthCookie(res, queryToken);
-        res.writeHead(302, { location: url.pathname || "/" });
-        res.end();
-        return;
-    }
     if (url.pathname === "/api/auth" && req.method === "POST") {
         await handleLogin(req, res);
         return;
     }
-    if (auth.required && !isAuthorizedRequest(req) && !isAuthorizedToken(queryToken ?? "")) {
-        if (url.pathname === "/" || url.pathname === "/index.html") {
-            sendText(res, 200, renderLoginPage(auth), "text/html; charset=utf-8");
+    if (url.pathname === "/api/dashboard/logout" && req.method === "POST") {
+        handleLogout(req, res);
+        return;
+    }
+    const authenticated = authenticateRequest(req);
+    if (url.pathname === "/api/auth/me" && req.method === "GET") {
+        if (!authenticated) {
+            sendJson(res, 401, { error: "Authentication required", adminConfigured: users.hasAdminUser() });
             return;
         }
-        if (url.pathname.startsWith("/api/") || url.pathname === "/healthz") {
-            sendJson(res, 401, { error: "Authentication required" });
+        sendJson(res, 200, currentUserDto(authenticated));
+        return;
+    }
+    if (!authenticated) {
+        if (url.pathname === "/" || url.pathname === "/index.html") {
+            sendText(res, 200, renderLoginPage({ adminConfigured: users.hasAdminUser() }), "text/html; charset=utf-8");
             return;
         }
-        sendText(res, 401, "Authentication required\n", "text/plain; charset=utf-8");
+        sendJson(res, 401, { error: "Authentication required", adminConfigured: users.hasAdminUser() });
         return;
     }
     if (url.pathname === "/healthz") {
+        if (!users.hasPermission(authenticated, "inspect")) {
+            sendText(res, 403, "access denied\n", "text/plain; charset=utf-8");
+            return;
+        }
         sendText(res, 200, "ok\n", "text/plain; charset=utf-8");
         return;
     }
     if (url.pathname === "/" || url.pathname === "/index.html") {
-        sendText(res, 200, renderDashboardApp({ authRequired: auth.required }), "text/html; charset=utf-8");
+        sendText(res, 200, renderDashboardApp(), "text/html; charset=utf-8");
+        return;
+    }
+    if (url.pathname === "/assets/dashboard.css") {
+        sendText(res, 200, dashboardCss(), "text/css; charset=utf-8");
+        return;
+    }
+    if (url.pathname === "/assets/dashboard.js") {
+        sendText(res, 200, dashboardJs(), "application/javascript; charset=utf-8");
         return;
     }
     if (url.pathname === "/api/events" && req.method === "GET") {
-        handleEvents(req, res);
+        await handleEvents(req, res);
         return;
     }
     if (!url.pathname.startsWith("/api/")) {
         sendText(res, 404, "not found\n", "text/plain; charset=utf-8");
         return;
     }
-    await handleApi(req, res, url);
+    await handleApi(req, res, url, authenticated);
 }
-async function handleApi(req, res, url) {
+async function handleApi(req, res, url, authUser) {
+    const permission = permissionForWebRequest(req.method, url.pathname);
+    if (!permission) {
+        audit({
+            action: "permission_denied",
+            status: "denied",
+            channelId: "web",
+            contextKey: "web",
+            actorId: authUser.user.id,
+            actorRole: authUser.groups.map((group) => group.name).join(", "),
+            description: `Denied unknown endpoint ${req.method ?? "GET"} ${url.pathname}`,
+        });
+        sendJson(res, 403, { error: "Access denied." });
+        return;
+    }
+    if (!users.hasPermission(authUser, permission)) {
+        audit({
+            action: "permission_denied",
+            status: "denied",
+            channelId: "web",
+            contextKey: "web",
+            actorId: authUser.user.id,
+            actorRole: authUser.groups.map((group) => group.name).join(", "),
+            description: `${permission} required for ${req.method ?? "GET"} ${url.pathname}`,
+        });
+        sendJson(res, 403, { error: `Access denied: ${permission} permission required.` });
+        return;
+    }
     if (req.method === "GET" && url.pathname === "/api/bootstrap") {
+        await assertCurrentSessionScope(authUser);
         sendJson(res, 200, {
-            auth: { required: auth.required, publicBind: auth.publicBind },
+            auth: currentUserDto(authUser),
             channels: listChannelDescriptors(),
-            agentAdapters: listAgentAdapterDescriptors(),
-            enabledAgents: enabledAgents(config),
-            controls: await runtime.controlOptions(),
-            status: await runtime.status(),
+            agentAdapters: listAgentAdapterDescriptors().filter((adapter) => users.canUseAgent(authUser, adapter.id)),
+            enabledAgents: enabledAgents(config).filter((agentId) => users.canUseAgent(authUser, agentId)),
+            controls: scopedControlOptions(authUser, await runtime.controlOptions()),
+            status: await runtime.bootstrapStatus(),
         });
         return;
     }
     if (req.method === "GET" && url.pathname === "/api/control-options") {
-        sendJson(res, 200, await runtime.controlOptions(parseAgentId(url.searchParams.get("agent") ?? undefined)));
+        const agentId = parseAgentId(url.searchParams.get("agent") ?? undefined);
+        assertScopedAgent(authUser, agentId);
+        sendJson(res, 200, scopedControlOptions(authUser, await runtime.controlOptions(agentId)));
         return;
     }
     if (req.method === "GET" && url.pathname === "/api/health") {
+        await assertCurrentSessionScope(authUser);
         sendJson(res, 200, await runtime.status());
         return;
     }
@@ -103,16 +153,203 @@ async function handleApi(req, res, url) {
         sendJson(res, 202, runtime.updateConnector());
         return;
     }
+    if (req.method === "GET" && url.pathname === "/api/agent-updates") {
+        sendJson(res, 200, { jobs: runtime.agentUpdateJobs().filter((job) => users.canUseAgent(authUser, job.agentId)) });
+        return;
+    }
+    if (req.method === "POST" && url.pathname === "/api/agent-update") {
+        const body = await readJsonBody(req);
+        const agentId = parseAgentIdRequired(stringField(body, "agentId"));
+        assertScopedAgent(authUser, agentId);
+        sendJson(res, 202, { job: runtime.startAgentUpdate(agentId) });
+        return;
+    }
+    const agentUpdateLogMatch = url.pathname.match(/^\/api\/agent-update\/([^/]+)\/log$/);
+    if (req.method === "GET" && agentUpdateLogMatch?.[1]) {
+        const id = decodeURIComponent(agentUpdateLogMatch[1]);
+        assertAgentUpdateJobScope(authUser, id);
+        sendJson(res, 200, runtime.agentUpdateLog(id));
+        return;
+    }
+    if (req.method === "DELETE" && agentUpdateLogMatch?.[1]) {
+        const id = decodeURIComponent(agentUpdateLogMatch[1]);
+        assertAgentUpdateJobScope(authUser, id);
+        sendJson(res, 200, { deletedId: id, job: runtime.deleteAgentUpdateLog(id) });
+        return;
+    }
+    const agentUpdateInputMatch = url.pathname.match(/^\/api\/agent-update\/([^/]+)\/input$/);
+    if (req.method === "POST" && agentUpdateInputMatch?.[1]) {
+        const body = await readJsonBody(req);
+        const id = decodeURIComponent(agentUpdateInputMatch[1]);
+        assertAgentUpdateJobScope(authUser, id);
+        sendJson(res, 200, { job: runtime.sendAgentUpdateInput(id, stringField(body, "input")) });
+        return;
+    }
+    const agentUpdateCancelMatch = url.pathname.match(/^\/api\/agent-update\/([^/]+)\/cancel$/);
+    if (req.method === "POST" && agentUpdateCancelMatch?.[1]) {
+        const id = decodeURIComponent(agentUpdateCancelMatch[1]);
+        assertAgentUpdateJobScope(authUser, id);
+        sendJson(res, 200, { job: runtime.cancelAgentUpdate(id) });
+        return;
+    }
     if (req.method === "GET" && (url.pathname === "/api/tasks" || url.pathname === "/api/progress")) {
-        sendJson(res, 200, runtime.tasks());
+        sendJson(res, 200, await scopedTasks(authUser, runtime.tasks()));
         return;
     }
     if (req.method === "GET" && url.pathname === "/api/adapters/health") {
-        sendJson(res, 200, { adapters: await runtime.adapterHealth() });
+        sendJson(res, 200, { adapters: (await runtime.adapterHealth()).filter((adapter) => users.canUseAgent(authUser, adapter.id)) });
         return;
     }
     if (req.method === "GET" && url.pathname === "/api/permissions") {
-        sendJson(res, 200, runtime.permissions());
+        sendJson(res, 200, { ...publicUserSnapshot(users.snapshot()), permissions: ALL_PERMISSIONS });
+        return;
+    }
+    if (req.method === "GET" && url.pathname === "/api/users") {
+        sendJson(res, 200, { ...publicUserSnapshot(users.snapshot()), permissions: ALL_PERMISSIONS });
+        return;
+    }
+    if (req.method === "POST" && url.pathname === "/api/users") {
+        const body = await readJsonBody(req);
+        const user = users.createUser({
+            email: stringField(body, "email"),
+            displayName: optionalStringField(body, "displayName") ?? stringField(body, "email"),
+            password: stringField(body, "password"),
+            groupIds: arrayStringField(body, "groupIds"),
+            active: optionalBooleanField(body, "active") ?? true,
+            telegramUserId: optionalNumberField(body, "telegramUserId"),
+        });
+        auditUserAction(authUser, "user_created", user.user.email);
+        sendJson(res, 201, { user: publicUser(user.user), groups: user.groups });
+        return;
+    }
+    const userMatch = url.pathname.match(/^\/api\/users\/([^/]+)$/);
+    if (userMatch?.[1] && req.method === "PATCH") {
+        const body = await readJsonBody(req);
+        const user = users.updateUser(decodeURIComponent(userMatch[1]), {
+            email: optionalStringField(body, "email"),
+            displayName: optionalStringField(body, "displayName"),
+            active: optionalBooleanField(body, "active"),
+            groupIds: body.groupIds === undefined ? undefined : arrayStringField(body, "groupIds"),
+        });
+        auditUserAction(authUser, "user_updated", user.user.email);
+        sendJson(res, 200, { user: publicUser(user.user), groups: user.groups });
+        return;
+    }
+    const passwordMatch = url.pathname.match(/^\/api\/users\/([^/]+)\/password$/);
+    if (passwordMatch?.[1] && req.method === "POST") {
+        const body = await readJsonBody(req);
+        const userId = decodeURIComponent(passwordMatch[1]);
+        users.setPassword(userId, stringField(body, "password"));
+        auditUserAction(authUser, "user_password_changed", userId);
+        sendJson(res, 200, { ok: true });
+        return;
+    }
+    const userSessionsMatch = url.pathname.match(/^\/api\/users\/([^/]+)\/sessions$/);
+    if (userSessionsMatch?.[1] && req.method === "GET") {
+        sendJson(res, 200, { sessions: users.listWebSessions(decodeURIComponent(userSessionsMatch[1])) });
+        return;
+    }
+    if (userSessionsMatch?.[1] && req.method === "DELETE") {
+        const userId = decodeURIComponent(userSessionsMatch[1]);
+        const revoked = users.revokeUserSessions(userId);
+        auditUserAction(authUser, "user_session_revoked", `${userId}: ${revoked} sessions`);
+        sendJson(res, 200, { revoked });
+        return;
+    }
+    const userSessionMatch = url.pathname.match(/^\/api\/users\/[^/]+\/sessions\/([^/]+)$/);
+    if (userSessionMatch?.[1] && req.method === "DELETE") {
+        const sessionId = decodeURIComponent(userSessionMatch[1]);
+        const revoked = users.revokeWebSession(sessionId);
+        auditUserAction(authUser, "user_session_revoked", sessionId);
+        sendJson(res, 200, { revoked });
+        return;
+    }
+    const telegramLinkMatch = url.pathname.match(/^\/api\/users\/([^/]+)\/telegram$/);
+    if (telegramLinkMatch?.[1] && req.method === "POST") {
+        const body = await readJsonBody(req);
+        if (body.createCode === true) {
+            const userId = decodeURIComponent(telegramLinkMatch[1]);
+            const linkCode = users.createTelegramLinkCode(userId);
+            auditUserAction(authUser, "telegram_link_created", userId);
+            sendJson(res, 201, { linkCode });
+            return;
+        }
+        const identity = users.linkTelegramUser(decodeURIComponent(telegramLinkMatch[1]), {
+            telegramUserId: numberField(body, "telegramUserId"),
+            username: optionalStringField(body, "username"),
+        });
+        auditUserAction(authUser, "telegram_linked", String(identity.telegramUserId));
+        sendJson(res, 201, { identity });
+        return;
+    }
+    const telegramUnlinkMatch = url.pathname.match(/^\/api\/users\/[^/]+\/telegram\/([^/]+)$/);
+    if (telegramUnlinkMatch?.[1] && req.method === "DELETE") {
+        const identityId = decodeURIComponent(telegramUnlinkMatch[1]);
+        const removed = users.unlinkTelegramIdentity(identityId);
+        auditUserAction(authUser, "telegram_unlinked", identityId);
+        sendJson(res, 200, { removed });
+        return;
+    }
+    if (req.method === "GET" && url.pathname === "/api/groups") {
+        sendJson(res, 200, { groups: users.listGroups() });
+        return;
+    }
+    if (req.method === "POST" && url.pathname === "/api/groups") {
+        const body = await readJsonBody(req);
+        const group = users.createGroup({
+            name: stringField(body, "name"),
+            description: optionalStringField(body, "description"),
+            permissions: arrayStringField(body, "permissions"),
+            agentIds: arrayStringField(body, "agentIds"),
+            workspaceRoots: arrayStringField(body, "workspaceRoots"),
+            telegramChatIds: arrayNumberField(body, "telegramChatIds"),
+        });
+        auditUserAction(authUser, "group_created", group.id);
+        sendJson(res, 201, { group });
+        return;
+    }
+    const groupMatch = url.pathname.match(/^\/api\/groups\/([^/]+)$/);
+    if (groupMatch?.[1] && req.method === "PATCH") {
+        const body = await readJsonBody(req);
+        const group = users.updateGroup(decodeURIComponent(groupMatch[1]), {
+            name: optionalStringField(body, "name"),
+            description: optionalStringField(body, "description"),
+            permissions: body.permissions === undefined ? undefined : arrayStringField(body, "permissions"),
+            agentIds: body.agentIds === undefined ? undefined : arrayStringField(body, "agentIds"),
+            workspaceRoots: body.workspaceRoots === undefined ? undefined : arrayStringField(body, "workspaceRoots"),
+            telegramChatIds: body.telegramChatIds === undefined ? undefined : arrayNumberField(body, "telegramChatIds"),
+        });
+        auditUserAction(authUser, "group_updated", group.id);
+        sendJson(res, 200, { group });
+        return;
+    }
+    if (req.method === "GET" && url.pathname === "/api/telegram-chats") {
+        sendJson(res, 200, { chats: users.snapshot().telegramChats });
+        return;
+    }
+    if (req.method === "POST" && url.pathname === "/api/telegram-chats") {
+        const body = await readJsonBody(req);
+        const chat = users.registerTelegramChat({
+            chatId: numberField(body, "chatId"),
+            title: optionalStringField(body, "title"),
+            type: optionalStringField(body, "type"),
+            enabled: optionalBooleanField(body, "enabled") ?? true,
+            allowedGroupIds: arrayStringField(body, "allowedGroupIds"),
+        });
+        auditUserAction(authUser, "telegram_chat_updated", String(chat.chatId));
+        sendJson(res, 201, { chat });
+        return;
+    }
+    const chatMatch = url.pathname.match(/^\/api\/telegram-chats\/([^/]+)$/);
+    if (chatMatch?.[1] && req.method === "PATCH") {
+        const body = await readJsonBody(req);
+        const chat = users.updateTelegramChat(decodeURIComponent(chatMatch[1]), {
+            enabled: optionalBooleanField(body, "enabled"),
+            title: optionalStringField(body, "title"),
+            allowedGroupIds: body.allowedGroupIds === undefined ? undefined : arrayStringField(body, "allowedGroupIds"),
+        });
+        auditUserAction(authUser, "telegram_chat_updated", String(chat.chatId));
+        sendJson(res, 200, { chat });
         return;
     }
     if (req.method === "GET" && url.pathname === "/api/audit") {
@@ -120,30 +357,39 @@ async function handleApi(req, res, url) {
         return;
     }
     if (req.method === "GET" && url.pathname === "/api/locks") {
+        await assertCurrentSessionScope(authUser);
         sendJson(res, 200, { locks: runtime.locks() });
         return;
     }
     if (req.method === "POST" && url.pathname === "/api/locks") {
         const body = await readJsonBody(req);
+        await assertCurrentSessionScope(authUser);
         sendJson(res, 200, { lock: runtime.lockWebSession(optionalStringField(body, "ownerName")), locks: runtime.locks() });
         return;
     }
     if (req.method === "DELETE" && url.pathname === "/api/locks") {
+        await assertCurrentSessionScope(authUser);
         sendJson(res, 200, runtime.unlockWebSession());
         return;
     }
     if (req.method === "GET" && url.pathname === "/api/auth/status") {
-        sendJson(res, 200, await runtime.authStatus(parseAgentId(url.searchParams.get("agent") ?? undefined)));
+        const agentId = parseAgentId(url.searchParams.get("agent") ?? undefined);
+        assertScopedAgent(authUser, agentId);
+        sendJson(res, 200, await runtime.authStatus(agentId));
         return;
     }
     if (req.method === "POST" && url.pathname === "/api/auth/login") {
         const body = await readJsonBody(req);
-        sendJson(res, 200, await runtime.login(parseAgentId(optionalStringField(body, "agentId"))));
+        const agentId = parseAgentId(optionalStringField(body, "agentId"));
+        assertScopedAgent(authUser, agentId);
+        sendJson(res, 200, await runtime.login(agentId));
         return;
     }
     if (req.method === "POST" && url.pathname === "/api/auth/logout") {
         const body = await readJsonBody(req);
-        sendJson(res, 200, await runtime.logout(parseAgentId(optionalStringField(body, "agentId"))));
+        const agentId = parseAgentId(optionalStringField(body, "agentId"));
+        assertScopedAgent(authUser, agentId);
+        sendJson(res, 200, await runtime.logout(agentId));
         return;
     }
     if (req.method === "GET" && url.pathname === "/api/settings") {
@@ -156,11 +402,20 @@ async function handleApi(req, res, url) {
         return;
     }
     if (req.method === "GET" && url.pathname === "/api/snapshot") {
+        await assertCurrentSessionScope(authUser);
         sendJson(res, 200, await runtime.snapshot());
         return;
     }
     if (req.method === "GET" && url.pathname === "/api/sessions") {
-        sendJson(res, 200, await runtime.listSessionsPage(numberParam(url, "page", 1), numberParam(url, "limit", 50), url.searchParams.get("query") ?? ""));
+        const agentId = parseAgentId(url.searchParams.get("agent") ?? undefined);
+        if (agentId) {
+            assertScopedAgent(authUser, agentId);
+        }
+        else {
+            await assertCurrentSessionScope(authUser);
+        }
+        const page = await runtime.listSessionsPage(numberParam(url, "page", 1), numberParam(url, "limit", 50), url.searchParams.get("query") ?? "", agentId);
+        sendJson(res, 200, scopedSessionPage(authUser, page));
         return;
     }
     if (req.method === "POST" && url.pathname === "/api/agent") {
@@ -169,15 +424,20 @@ async function handleApi(req, res, url) {
         if (!isAgentId(agentId)) {
             throw new Error(`Invalid agent: ${agentId}`);
         }
+        assertScopedAgent(authUser, agentId);
         sendJson(res, 200, { session: await runtime.setAgent(agentId) });
         return;
     }
     if (req.method === "POST" && url.pathname === "/api/sessions/new") {
         const body = await readJsonBody(req);
+        const agentId = parseAgentId(optionalStringField(body, "agentId"));
+        const workspace = optionalStringField(body, "workspace");
+        assertScopedAgent(authUser, agentId);
+        assertScopedWorkspace(authUser, workspace);
         sendJson(res, 200, {
             session: await runtime.newSession({
-                agentId: parseAgentId(optionalStringField(body, "agentId")),
-                workspace: optionalStringField(body, "workspace"),
+                agentId,
+                workspace,
                 model: optionalStringField(body, "model"),
                 reasoningEffort: optionalStringField(body, "reasoningEffort"),
                 launchProfileId: optionalStringField(body, "launchProfileId"),
@@ -188,49 +448,68 @@ async function handleApi(req, res, url) {
     }
     if (req.method === "POST" && url.pathname === "/api/sessions/switch") {
         const body = await readJsonBody(req);
-        sendJson(res, 200, { session: await runtime.switchSession(stringField(body, "threadId")) });
+        const threadId = stringField(body, "threadId");
+        const detail = await runtime.sessionDetail(threadId);
+        if (detail.record && typeof detail.record === "object") {
+            assertSessionScope(authUser, detail.record);
+        }
+        const session = await runtime.switchSession(threadId);
+        assertSessionScope(authUser, session);
+        sendJson(res, 200, { session });
         return;
     }
     if (req.method === "POST" && url.pathname === "/api/sessions/attach") {
         const body = await readJsonBody(req);
-        sendJson(res, 200, { session: await runtime.attachSession(stringField(body, "threadId")) });
+        const session = await runtime.attachSession(stringField(body, "threadId"));
+        assertSessionScope(authUser, session);
+        sendJson(res, 200, { session });
         return;
     }
     if (req.method === "GET" && url.pathname === "/api/sessions/detail") {
-        sendJson(res, 200, await runtime.sessionDetail(requiredSearch(url, "threadId")));
+        const threadId = requiredSearch(url, "threadId");
+        const detail = await runtime.sessionDetail(threadId);
+        assertSessionDetailScope(authUser, threadId, detail);
+        sendJson(res, 200, detail);
         return;
     }
     if (req.method === "GET" && url.pathname === "/api/models") {
+        await assertCurrentSessionScope(authUser);
         sendJson(res, 200, { models: await runtime.listModels() });
         return;
     }
     if (req.method === "POST" && url.pathname === "/api/session/model") {
         const body = await readJsonBody(req);
+        await assertCurrentSessionScope(authUser);
         sendJson(res, 200, { session: await runtime.setModel(stringField(body, "model")) });
         return;
     }
     if (req.method === "POST" && url.pathname === "/api/session/reasoning") {
         const body = await readJsonBody(req);
+        await assertCurrentSessionScope(authUser);
         sendJson(res, 200, { session: await runtime.setReasoningEffort(stringField(body, "reasoning")) });
         return;
     }
     if (req.method === "POST" && url.pathname === "/api/session/fast") {
         const body = await readJsonBody(req);
+        await assertCurrentSessionScope(authUser);
         sendJson(res, 200, { session: await runtime.setFastMode(Boolean(body?.enabled)) });
         return;
     }
     if (req.method === "POST" && url.pathname === "/api/session/launch") {
         const body = await readJsonBody(req);
+        await assertCurrentSessionScope(authUser);
         sendJson(res, 200, { session: await runtime.setLaunchProfile(stringField(body, "profileId")) });
         return;
     }
     if (req.method === "POST" && url.pathname === "/api/prompt") {
         const body = await readJsonBody(req);
+        await assertCurrentSessionScope(authUser);
         sendJson(res, 202, await runtime.sendPrompt(stringField(body, "text")));
         return;
     }
     if (req.method === "POST" && url.pathname === "/api/prompt/upload") {
         const body = await readJsonBody(req);
+        await assertCurrentSessionScope(authUser);
         sendJson(res, 202, await runtime.sendUploadPrompt({
             text: optionalStringField(body, "text"),
             files: parseUploadFiles(body.files),
@@ -238,59 +517,70 @@ async function handleApi(req, res, url) {
         return;
     }
     if (req.method === "POST" && (url.pathname === "/api/abort" || url.pathname === "/api/stop")) {
+        await assertCurrentSessionScope(authUser);
         await runtime.abort();
         sendJson(res, 200, { ok: true });
         return;
     }
     if (req.method === "POST" && url.pathname === "/api/handback") {
+        await assertCurrentSessionScope(authUser);
         sendJson(res, 200, await runtime.handback());
         return;
     }
     if (req.method === "POST" && url.pathname === "/api/retry") {
+        await assertCurrentSessionScope(authUser);
         sendJson(res, 202, await runtime.retry());
         return;
     }
     if (req.method === "POST" && url.pathname === "/api/sync") {
+        await assertCurrentSessionScope(authUser);
         sendJson(res, 200, await runtime.sync());
         return;
     }
     if (req.method === "GET" && url.pathname === "/api/queue") {
+        await assertCurrentSessionScope(authUser);
         sendJson(res, 200, { queue: runtime.queue(), paused: runtime.queuePaused() });
         return;
     }
     if (req.method === "POST" && url.pathname === "/api/queue") {
         const body = await readJsonBody(req);
+        await assertCurrentSessionScope(authUser);
         sendJson(res, 200, { queue: runtime.queueAction(stringField(body, "action"), optionalStringField(body, "id")), paused: runtime.queuePaused() });
         return;
     }
     if (req.method === "GET" && url.pathname === "/api/chat/history") {
+        await assertCurrentSessionScope(authUser);
         sendJson(res, 200, { messages: await runtime.chatHistory(numberParam(url, "limit", 200)) });
         return;
     }
     if (req.method === "DELETE" && url.pathname === "/api/chat/history") {
+        await assertCurrentSessionScope(authUser);
         sendJson(res, 200, await runtime.clearChatHistory());
         return;
     }
     if (req.method === "GET" && url.pathname === "/api/activity") {
         sendJson(res, 200, {
-            events: runtime.activity({
+            events: filterActivityByScope(authUser, runtime.activity({
                 limit: numberParam(url, "limit", 100),
                 source: (url.searchParams.get("source") || "all"),
                 status: (url.searchParams.get("status") || "all"),
-            }),
+            })),
         });
         return;
     }
     if (req.method === "GET" && url.pathname === "/api/artifacts") {
+        await assertCurrentSessionScope(authUser);
         sendJson(res, 200, { reports: await runtime.artifacts() });
         return;
     }
     if (req.method === "DELETE" && url.pathname === "/api/artifacts") {
+        await assertCurrentSessionScope(authUser);
         sendJson(res, 200, { removed: await runtime.deleteArtifact(requiredSearch(url, "turnId")) });
         return;
     }
     if (req.method === "POST" && url.pathname === "/api/artifacts/bulk") {
         const body = await readJsonBody(req);
+        await assertCurrentSessionScope(authUser);
         const action = stringField(body, "action");
         const turnIds = Array.isArray(body.turnIds) ? body.turnIds.filter((item) => typeof item === "string") : [];
         if (action !== "delete") {
@@ -306,6 +596,7 @@ async function handleApi(req, res, url) {
         return;
     }
     if (req.method === "GET" && url.pathname === "/api/artifacts/zip") {
+        await assertCurrentSessionScope(authUser);
         const bundle = await runtime.createArtifactZip(requiredSearch(url, "turnId"));
         if (!bundle) {
             sendJson(res, 404, { error: "Artifact turn not found or ZIP could not be created" });
@@ -315,6 +606,7 @@ async function handleApi(req, res, url) {
         return;
     }
     if (req.method === "GET" && url.pathname === "/api/artifacts/file") {
+        await assertCurrentSessionScope(authUser);
         const turnId = requiredSearch(url, "turnId");
         const relativePath = requiredSearch(url, "path");
         const report = await runtime.artifact(turnId);
@@ -327,6 +619,7 @@ async function handleApi(req, res, url) {
         return;
     }
     if (req.method === "GET" && url.pathname === "/api/artifacts/preview") {
+        await assertCurrentSessionScope(authUser);
         const preview = await runtime.artifactPreview(requiredSearch(url, "turnId"), requiredSearch(url, "path"));
         if (!preview) {
             sendJson(res, 404, { error: "Artifact not found" });
@@ -336,10 +629,16 @@ async function handleApi(req, res, url) {
         return;
     }
     if (req.method === "GET" && url.pathname === "/api/logs") {
-        sendJson(res, 200, await runtime.logs(url.searchParams.get("target") || "connector", numberParam(url, "lines", 120)));
+        sendJson(res, 200, await runtime.logs(parseLogTarget(url.searchParams.get("target") ?? undefined), numberParam(url, "lines", 120)));
+        return;
+    }
+    if (req.method === "POST" && url.pathname === "/api/logs/clear") {
+        const body = await readJsonBody(req);
+        sendJson(res, 200, runtime.clearLogs(parseLogTarget(optionalStringField(body, "target"))));
         return;
     }
     if (req.method === "GET" && url.pathname === "/api/diagnostics") {
+        await assertCurrentSessionScope(authUser);
         sendJson(res, 200, await runtime.diagnostics());
         return;
     }
@@ -349,21 +648,40 @@ async function handleApi(req, res, url) {
     }
     sendJson(res, 404, { error: "Unknown endpoint" });
 }
-function handleEvents(req, res) {
-    const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
-    const token = url.searchParams.get("token");
-    if (auth.required && !(isAuthorizedRequest(req) || (token && isAuthorizedToken(token)))) {
+async function handleEvents(req, res) {
+    const authUser = authenticateRequest(req);
+    if (!authUser) {
         sendJson(res, 401, { error: "Authentication required" });
         return;
     }
+    if (!users.hasPermission(authUser, "sessions.read")) {
+        sendJson(res, 403, { error: "Access denied: sessions.read permission required." });
+        return;
+    }
+    await assertCurrentSessionScope(authUser);
     res.writeHead(200, {
         "content-type": "text/event-stream; charset=utf-8",
         "cache-control": "no-cache, no-transform",
         connection: "keep-alive",
     });
     const send = (event) => {
-        res.write(`event: ${event.type}\n`);
-        res.write(`data: ${JSON.stringify(event)}\n\n`);
+        void scopeRelayEvent(authUser, event, canUseCurrentSession).then((scopedEvent) => {
+            if (!scopedEvent || res.destroyed || res.writableEnded) {
+                return;
+            }
+            res.write(`event: ${scopedEvent.type}\n`);
+            res.write(`data: ${JSON.stringify(scopedEvent)}\n\n`);
+        }).catch(() => { });
+    };
+    let currentScopeCache = null;
+    const canUseCurrentSession = async () => {
+        const now = Date.now();
+        if (currentScopeCache && currentScopeCache.expiresAt > now) {
+            return currentScopeCache.allowed;
+        }
+        const allowed = await canUseCurrentSessionScope(authUser);
+        currentScopeCache = { allowed, expiresAt: now + 1_000 };
+        return allowed;
     };
     const unsubscribe = runtime.subscribe(send);
     const heartbeat = setInterval(() => {
@@ -377,20 +695,60 @@ function handleEvents(req, res) {
 }
 async function handleLogin(req, res) {
     const body = await readJsonBody(req);
-    const token = optionalStringField(body, "token");
-    const user = optionalStringField(body, "user");
+    const email = optionalStringField(body, "email");
     const password = optionalStringField(body, "password");
-    if (token && isAuthorizedToken(token)) {
-        setAuthCookie(res, token);
-        sendJson(res, 200, { ok: true, mode: "token" });
+    const rateLimitKey = `${req.socket.remoteAddress ?? "unknown"}:${email ?? "-"}`;
+    const limited = consumeRateLimit(loginAttempts, rateLimitKey, 5, 15 * 60 * 1000, 15 * 60 * 1000);
+    if (limited.limited) {
+        audit({
+            action: "auth_login_failed",
+            status: "denied",
+            channelId: "web",
+            contextKey: "web",
+            description: `Rate limited login attempt for ${email ?? "unknown"}`,
+            detail: `${Math.ceil((limited.retryAfterMs ?? 0) / 1000)}s retry-after`,
+        });
+        sendJson(res, 429, { error: "Too many login attempts. Try again later.", retryAfterMs: limited.retryAfterMs });
+        return;
+    }
+    if (!users.hasAdminUser()) {
+        sendJson(res, 503, { error: "No admin user exists. Run nordrelay user create-admin first." });
         return;
     }
-    if (user && password && isAuthorizedBasic(user, password)) {
-        setBasicCookie(res, user, password);
-        sendJson(res, 200, { ok: true, mode: "basic" });
+    const authUser = email && password ? users.verifyPassword(email, password) : null;
+    if (!authUser) {
+        audit({
+            action: "auth_login_failed",
+            status: "failed",
+            channelId: "web",
+            contextKey: "web",
+            description: `Failed login for ${email ?? "unknown"}`,
+        });
+        sendJson(res, 401, { error: "Invalid credentials" });
         return;
     }
-    sendJson(res, 401, { error: "Invalid dashboard credentials" });
+    resetRateLimit(loginAttempts, rateLimitKey);
+    const session = users.createWebSession(authUser.user.id);
+    audit({
+        action: "auth_login",
+        status: "ok",
+        channelId: "web",
+        contextKey: "web",
+        actorId: authUser.user.id,
+        actorRole: authUser.groups.map((group) => group.name).join(", "),
+        description: `Login ${authUser.user.email}`,
+    });
+    setSessionCookie(res, session.token);
+    sendJson(res, 200, currentUserDto(authUser));
+}
+function handleLogout(req, res) {
+    const authUser = authenticateRequest(req);
+    users.destroyWebSession(parseCookies(req.headers.cookie ?? "").nr_session);
+    if (authUser) {
+        auditUserAction(authUser, "auth_logout", authUser.user.email);
+    }
+    clearSessionCookie(res);
+    sendJson(res, 200, { ok: true });
 }
 function parseOptions(argv) {
     let host = process.env.NORDRELAY_DASHBOARD_HOST || "127.0.0.1";
@@ -410,77 +768,177 @@ function parseOptions(argv) {
     }
     return { host, port, home };
 }
-function resolveDashboardAuth(host) {
-    const token = optionalEnv("NORDRELAY_DASHBOARD_TOKEN");
-    const user = optionalEnv("NORDRELAY_DASHBOARD_USER");
-    const password = optionalEnv("NORDRELAY_DASHBOARD_PASSWORD");
-    const publicBind = isPublicBindHost(host);
+function authenticateRequest(req) {
+    const cookies = parseCookies(req.headers.cookie ?? "");
+    return users.resolveWebSession(cookies.nr_session);
+}
+function setSessionCookie(res, token) {
+    res.setHeader("set-cookie", `nr_session=${encodeURIComponent(token)}; HttpOnly; SameSite=Strict; Path=/`);
+}
+function clearSessionCookie(res) {
+    res.setHeader("set-cookie", "nr_session=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0");
+}
+function currentUserDto(authUser) {
     return {
-        required: publicBind || Boolean(token || (user && password)),
-        publicBind,
-        token,
-        user,
-        password,
+        user: publicUser(authUser.user),
+        groups: authUser.groups,
+        permissions: authUser.permissions,
     };
 }
-function isPublicBindHost(host) {
-    return host === "0.0.0.0" || host === "::" || host === "";
-}
-function isAuthorizedRequest(req) {
-    if (!auth.required) {
-        return true;
+function audit(event) {
+    try {
+        auditLog.append(event);
     }
-    const header = req.headers.authorization;
-    if (header?.startsWith("Bearer ") && isAuthorizedToken(header.slice("Bearer ".length).trim())) {
-        return true;
+    catch (error) {
+        console.warn("Failed to write audit event:", error instanceof Error ? error.message : String(error));
     }
-    if (header?.startsWith("Basic ")) {
-        const decoded = Buffer.from(header.slice("Basic ".length), "base64").toString("utf8");
-        const [user, ...passwordParts] = decoded.split(":");
-        if (isAuthorizedBasic(user ?? "", passwordParts.join(":"))) {
-            return true;
-        }
+}
+function auditUserAction(authUser, action, description) {
+    audit({
+        action,
+        status: "ok",
+        channelId: "web",
+        contextKey: "web",
+        actorId: authUser.user.id,
+        actorRole: authUser.groups.map((group) => group.name).join(", "),
+        description,
+    });
+}
+function scopedControlOptions(authUser, options) {
+    return {
+        ...options,
+        workspaces: options.workspaces.filter((workspace) => users.canUseWorkspace(authUser, workspace)),
+    };
+}
+function scopedSessionPage(authUser, page) {
+    return {
+        ...page,
+        sessions: page.sessions.filter((session) => canUseSession(authUser, session)),
+    };
+}
+async function scopedTasks(authUser, tasks) {
+    const currentAllowed = await canUseCurrentSessionScope(authUser);
+    return {
+        ...tasks,
+        current: tasks.current && canUseSession(authUser, tasks.current) ? tasks.current : null,
+        external: tasks.external && canUseSession(authUser, tasks.external) ? tasks.external : null,
+        queue: currentAllowed ? tasks.queue : [],
+        recent: filterActivityByScope(authUser, tasks.recent),
+    };
+}
+async function scopeRelayEvent(authUser, event, canUseCurrentSession = () => canUseCurrentSessionScope(authUser)) {
+    switch (event.type) {
+        case "snapshot":
+            return canUseSession(authUser, event.data.session) ? event : null;
+        case "session_update":
+            return canUseSession(authUser, event.session) ? event : null;
+        case "activity_update":
+            return { ...event, events: filterActivityByScope(authUser, event.events) };
+        case "agent_update":
+            return users.canUseAgent(authUser, event.job.agentId) ? event : null;
+        case "status":
+            return event;
+        case "chat_history":
+        case "queue_update":
+        case "turn_start":
+        case "text_delta":
+        case "tool_start":
+        case "tool_update":
+        case "tool_end":
+        case "todo_update":
+        case "turn_complete":
+        case "turn_error":
+            return await canUseCurrentSession() ? event : null;
     }
-    const cookies = parseCookies(req.headers.cookie ?? "");
-    if (cookies.nrdash && isAuthorizedToken(cookies.nrdash)) {
+}
+function filterActivityByScope(authUser, events) {
+    return events.filter((event) => canUseSession(authUser, event));
+}
+async function canUseCurrentSessionScope(authUser) {
+    try {
+        await assertCurrentSessionScope(authUser);
         return true;
     }
-    if (cookies.nrdash_basic) {
-        const decoded = Buffer.from(cookies.nrdash_basic, "base64").toString("utf8");
-        const [user, ...passwordParts] = decoded.split(":");
-        if (isAuthorizedBasic(user ?? "", passwordParts.join(":"))) {
-            return true;
+    catch (error) {
+        if (error instanceof AccessDeniedError) {
+            return false;
         }
+        throw error;
     }
-    return false;
 }
-function isAuthorizedToken(token) {
-    return Boolean(auth.token && constantTimeEqual(token, auth.token));
+function canUseSession(authUser, session) {
+    const agentId = typeof session.agentId === "string" ? session.agentId : undefined;
+    const workspace = typeof session.workspace === "string"
+        ? session.workspace
+        : typeof session.cwd === "string"
+            ? session.cwd
+            : undefined;
+    return users.canUseAgent(authUser, agentId) && users.canUseWorkspace(authUser, workspace);
+}
+function assertAgentUpdateJobScope(authUser, id) {
+    const job = runtime.agentUpdateJobs().find((candidate) => candidate.id === id);
+    if (job) {
+        assertScopedAgent(authUser, job.agentId);
+    }
 }
-function isAuthorizedBasic(user, password) {
-    return Boolean(auth.user && auth.password && constantTimeEqual(user, auth.user) && constantTimeEqual(password, auth.password));
+function assertSessionDetailScope(authUser, threadId, detail) {
+    const record = objectValue(detail.record);
+    if (record) {
+        assertSessionScope(authUser, record);
+        return;
+    }
+    const active = objectValue(detail.active);
+    if (active && active.threadId === threadId) {
+        assertSessionScope(authUser, active);
+        return;
+    }
+    throw new AccessDeniedError("Access denied: session is outside your group scope.");
 }
-function constantTimeEqual(left, right) {
-    const leftBuffer = Buffer.from(left);
-    const rightBuffer = Buffer.from(right);
-    if (leftBuffer.length !== rightBuffer.length) {
-        return false;
+function assertScopedAgent(authUser, agentId) {
+    if (!users.canUseAgent(authUser, agentId)) {
+        throw new AccessDeniedError(`Access denied: agent ${agentId} is outside your group scope.`);
     }
-    return cryptoTimingSafeEqual(leftBuffer, rightBuffer);
 }
-function cryptoTimingSafeEqual(left, right) {
-    let diff = 0;
-    for (let index = 0; index < left.length; index += 1) {
-        diff |= left[index] ^ right[index];
+function assertScopedWorkspace(authUser, workspace) {
+    if (!users.canUseWorkspace(authUser, workspace)) {
+        throw new AccessDeniedError(`Access denied: workspace ${workspace} is outside your group scope.`);
     }
-    return diff === 0;
 }
-function setAuthCookie(res, token) {
-    res.setHeader("set-cookie", `nrdash=${encodeURIComponent(token)}; HttpOnly; SameSite=Strict; Path=/`);
+function assertSessionScope(authUser, session) {
+    const agentId = typeof session.agentId === "string" ? session.agentId : undefined;
+    const workspace = typeof session.workspace === "string"
+        ? session.workspace
+        : typeof session.cwd === "string"
+            ? session.cwd
+            : undefined;
+    assertScopedAgent(authUser, agentId);
+    assertScopedWorkspace(authUser, workspace);
+}
+async function assertCurrentSessionScope(authUser) {
+    const snapshot = await runtime.snapshot();
+    assertSessionScope(authUser, snapshot.session);
+}
+function objectValue(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
-function setBasicCookie(res, user, password) {
-    const value = Buffer.from(`${user}:${password}`).toString("base64");
-    res.setHeader("set-cookie", `nrdash_basic=${encodeURIComponent(value)}; HttpOnly; SameSite=Strict; Path=/`);
+function consumeRateLimit(buckets, key, limit, windowMs, blockMs) {
+    const now = Date.now();
+    const existing = buckets.get(key);
+    if (existing?.blockedUntil && existing.blockedUntil > now) {
+        return { limited: true, retryAfterMs: existing.blockedUntil - now };
+    }
+    const bucket = !existing || existing.resetAt <= now ? { count: 0, resetAt: now + windowMs } : existing;
+    bucket.count += 1;
+    if (bucket.count > limit) {
+        bucket.blockedUntil = now + blockMs;
+        buckets.set(key, bucket);
+        return { limited: true, retryAfterMs: blockMs };
+    }
+    buckets.set(key, bucket);
+    return { limited: false };
+}
+function resetRateLimit(buckets, key) {
+    buckets.delete(key);
 }
 function parseCookies(cookieHeader) {
     const cookies = {};
@@ -532,15 +990,61 @@ function optionalBooleanField(value, key) {
     const field = value[key];
     return typeof field === "boolean" ? field : undefined;
 }
+function numberField(value, key) {
+    const field = value[key];
+    const parsed = typeof field === "number" ? field : typeof field === "string" ? Number(field) : Number.NaN;
+    if (!Number.isInteger(parsed)) {
+        throw new Error(`${key} must be an integer`);
+    }
+    return parsed;
+}
+function optionalNumberField(value, key) {
+    if (value[key] === undefined || value[key] === "") {
+        return undefined;
+    }
+    return numberField(value, key);
+}
+function arrayStringField(value, key) {
+    const field = value[key];
+    if (field === undefined || field === null || field === "") {
+        return [];
+    }
+    if (Array.isArray(field)) {
+        return field.filter((item) => typeof item === "string");
+    }
+    if (typeof field === "string") {
+        return field.split(",").map((item) => item.trim()).filter(Boolean);
+    }
+    throw new Error(`${key} must be a string list`);
+}
+function arrayNumberField(value, key) {
+    const field = value[key];
+    if (field === undefined || field === null || field === "") {
+        return [];
+    }
+    if (Array.isArray(field)) {
+        return field.map((item) => typeof item === "number" ? item : Number(item)).filter((item) => Number.isInteger(item));
+    }
+    if (typeof field === "string") {
+        return field.split(",").map((item) => Number(item.trim())).filter((item) => Number.isInteger(item));
+    }
+    throw new Error(`${key} must be a number list`);
+}
 function parseAgentId(value) {
     if (!value) {
         return undefined;
     }
+    return parseAgentIdRequired(value);
+}
+function parseAgentIdRequired(value) {
     if (!isAgentId(value)) {
         throw new Error(`Invalid agent: ${value}`);
     }
     return value;
 }
+function parseLogTarget(value) {
+    return value === "update" || value === "agent-updates" ? value : "connector";
+}
 function objectRecord(value) {
     if (!value || typeof value !== "object" || Array.isArray(value)) {
         return {};
@@ -586,13 +1090,7 @@ function optionalEnv(key) {
 }
 function activeSettingsValues(current) {
     return {
-        TELEGRAM_ALLOW_ANY_CHAT: boolValue(current.telegramAllowAnyChat),
         TELEGRAM_BOT_TOKEN: current.telegramBotToken,
-        TELEGRAM_ADMIN_USER_IDS: current.telegramAdminUserIds.join(","),
-        TELEGRAM_ALLOWED_USER_IDS: current.telegramAllowedUserIds.join(","),
-        TELEGRAM_READONLY_USER_IDS: current.telegramReadOnlyUserIds.join(","),
-        TELEGRAM_ALLOWED_CHAT_IDS: current.telegramAllowedChatIds.join(","),
-        TELEGRAM_ROLE_POLICIES_JSON: optionalEnv("TELEGRAM_ROLE_POLICIES_JSON"),
         TELEGRAM_TRANSPORT: current.telegramTransport,
         TELEGRAM_WEBHOOK_URL: current.telegramWebhookUrl,
         TELEGRAM_WEBHOOK_HOST: current.telegramWebhookHost,
@@ -699,7 +1197,7 @@ function shutdown() {
     runtime.dispose();
     server.close(() => process.exit(0));
 }
-function renderLoginPage(currentAuth) {
+function renderLoginPage(options) {
     return `<!doctype html>
 <html lang="en">
 <head>
@@ -720,18 +1218,17 @@ function renderLoginPage(currentAuth) {
 <body>
   <form id="login">
     <h1>NordRelay Dashboard</h1>
-    <p>${currentAuth.publicBind ? "Remote dashboard access requires authentication." : "Authentication required."}</p>
-    ${currentAuth.token ? '<label>Token</label><input id="token" name="token" type="password" autocomplete="current-password">' : ""}
-    ${currentAuth.user ? '<label>User</label><input id="user" name="user" autocomplete="username"><label>Password</label><input id="password" name="password" type="password" autocomplete="current-password">' : ""}
-    <button>Sign in</button>
+    <p>${options.adminConfigured ? "Sign in with your NordRelay user account." : "No admin user exists. Run nordrelay user create-admin on this host first."}</p>
+    <label>Email</label><input id="email" name="email" type="email" autocomplete="username" ${options.adminConfigured ? "" : "disabled"}>
+    <label>Password</label><input id="password" name="password" type="password" autocomplete="current-password" ${options.adminConfigured ? "" : "disabled"}>
+    <button ${options.adminConfigured ? "" : "disabled"}>Sign in</button>
     <div class="error" id="error"></div>
   </form>
   <script>
     document.getElementById('login').addEventListener('submit', async (event) => {
       event.preventDefault();
       const payload = {
-        token: document.getElementById('token')?.value || undefined,
-        user: document.getElementById('user')?.value || undefined,
+        email: document.getElementById('email')?.value || undefined,
         password: document.getElementById('password')?.value || undefined,
       };
       const res = await fetch('/api/auth', { method:'POST', headers:{'content-type':'application/json'}, body: JSON.stringify(payload) });
@@ -739,14 +1236,13 @@ function renderLoginPage(currentAuth) {
         document.getElementById('error').textContent = 'Invalid credentials';
         return;
       }
-      if (payload.token) localStorage.setItem('nordrelayDashboardToken', payload.token);
       location.href = '/';
     });
   </script>
 </body>
 </html>`;
 }
-function renderDashboardApp(options) {
+function renderDashboardApp() {
     return `<!doctype html>
 <html lang="en">
 <head>
@@ -754,7 +1250,7 @@ function renderDashboardApp(options) {
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>NordRelay Dashboard</title>
   <script>document.documentElement.dataset.theme = localStorage.getItem('nordrelayTheme') || 'light';</script>
-  <style>${dashboardCss()}</style>
+  <link rel="stylesheet" href="/assets/dashboard.css">
 </head>
 <body>
   <div class="app">
@@ -776,6 +1272,7 @@ function renderDashboardApp(options) {
           <select id="agentSelect"></select>
           <button id="themeBtn" class="secondary" title="Toggle dark theme">Dark</button>
           <button id="refreshBtn">Refresh</button>
+          <button id="logoutBtn" class="secondary">Logout</button>
         </div>
       </header>
 
@@ -783,7 +1280,10 @@ function renderDashboardApp(options) {
         <div class="metrics" id="metrics"></div>
         <div class="stack">
           <div class="panel"><h2>Current Session</h2><pre id="sessionText"></pre></div>
-          <div class="panel"><h2>Adapters</h2><div id="adapters"></div></div>
+          <div class="overview-adapter-grid">
+            <div class="panel"><h2>Agent Adapters</h2><div id="agentAdapters"></div></div>
+            <div class="panel"><h2>Chat Adapters</h2><div id="chatAdapters"></div></div>
+          </div>
         </div>
       </section>
 
@@ -855,8 +1355,8 @@ function renderDashboardApp(options) {
       <section class="page" id="page-artifacts">
         <div class="panel">
           <div class="row"><button id="reloadArtifactsBtn">Reload artifacts</button><input id="artifactSearch" placeholder="Search artifacts"><select id="artifactKind"><option value="all">All files</option><option value="images">Images</option><option value="docs">Docs/code</option></select><button id="zipSelectedArtifactsBtn" class="secondary">ZIP selected</button><button id="deleteSelectedArtifactsBtn" class="danger">Delete selected</button></div>
-          <div id="artifactList" class="list"></div>
           <div id="artifactPreview" class="preview"></div>
+          <div id="artifactList" class="list"></div>
         </div>
       </section>
 
@@ -869,8 +1369,12 @@ function renderDashboardApp(options) {
 
       <section class="page" id="page-access">
         <div class="panel">
-          <div class="row"><button id="loadAccessBtn">Reload access</button><button id="saveAccessBtn">Save access settings</button><button id="lockSessionBtn" class="secondary">Lock web session</button><button id="unlockSessionBtn" class="secondary">Unlock web session</button></div>
+          <div class="row"><button id="loadAccessBtn">Reload users</button><button id="createUserBtn">Create user</button><button id="createGroupBtn" class="secondary">Create group</button><button id="createChatBtn" class="secondary">Add Telegram chat</button><button id="lockSessionBtn" class="secondary">Lock web session</button><button id="unlockSessionBtn" class="secondary">Unlock web session</button></div>
           <div id="accessPanel" class="settings-grid"></div>
+          <h2>Groups</h2>
+          <div id="groupsList" class="list"></div>
+          <h2>Telegram chats</h2>
+          <div id="telegramChatsList" class="list"></div>
           <h2>Locks</h2>
           <div id="locksList" class="list"></div>
           <h2>Audit</h2>
@@ -881,8 +1385,10 @@ function renderDashboardApp(options) {
 
       <section class="page" id="page-version">
         <div class="panel">
-          <div class="row"><button id="loadVersionBtn">Check versions</button><button id="updateBtn" class="secondary">Update NordRelay</button></div>
+          <div class="row version-actions"><button id="loadVersionBtn">Check versions</button><button id="updateBtn" class="secondary">Update NordRelay</button></div>
           <div id="versionPanel" class="list"></div>
+          <h2 class="version-update-title">Agent update jobs</h2>
+          <div id="agentUpdateJobs" class="list"></div>
         </div>
       </section>
 
@@ -896,8 +1402,8 @@ function renderDashboardApp(options) {
 
       <section class="page" id="page-logs">
         <div class="panel">
-          <div class="row"><select id="logTarget"><option value="connector">Connector</option><option value="update">Update</option></select><select id="logLevel"><option value="all">All levels</option><option value="ERROR">Error</option><option value="WARN">Warn</option><option value="INFO">Info</option></select><input id="logSearch" placeholder="Search logs"><input id="logSince" type="datetime-local" title="Show entries after this time"><input id="logLines" type="number" value="120" min="1" max="300"><label class="checkbox"><input id="logAutoRefresh" type="checkbox"> Auto</label><label class="checkbox"><input id="logFollow" type="checkbox"> Follow</label><button id="loadLogsBtn">Load logs</button><button id="downloadLogsBtn" class="secondary">Download</button></div>
-          <pre id="logs"></pre>
+          <div class="row"><select id="logTarget"><option value="connector">Connector</option><option value="update">NordRelay Update</option><option value="agent-updates">Agent Updates</option></select><select id="logLevel"><option value="all">All levels</option><option value="ERROR">Error</option><option value="WARN">Warn</option><option value="INFO">Info</option></select><input id="logSearch" placeholder="Search logs"><input id="logSince" type="datetime-local" title="Show entries after this time"><input id="logLines" type="number" value="120" min="1" max="300"><label class="checkbox"><input id="logAutoRefresh" type="checkbox"> Auto</label><label class="checkbox"><input id="logFollow" type="checkbox"> Follow</label><button id="loadLogsBtn">Load logs</button><button id="downloadLogsBtn" class="secondary">Download</button><button id="clearLogsBtn" class="danger">Clear</button></div>
+          <pre id="logs" class="log-view"></pre>
         </div>
       </section>
 
@@ -908,7 +1414,7 @@ function renderDashboardApp(options) {
       <footer>
         <span id="footerVersion">NordRelay</span>
         <span id="footerHealth">Health: loading</span>
-        <span>Dashboard bind: ${escapeHTML(options.authRequired ? "authenticated" : "local")}</span>
+        <span id="footerUser">User: loading</span>
       </footer>
     </main>
   </div>
@@ -931,242 +1437,16 @@ function renderDashboardApp(options) {
     <div id="sessionDetail"></div>
     <div class="row dialog-actions"><button id="closeSessionDetailBtn" class="secondary">Close</button></div>
   </dialog>
+  <dialog id="adminDialog">
+    <form method="dialog" id="adminDialogForm">
+      <h2 id="adminDialogTitle">Edit</h2>
+      <div id="adminDialogBody" class="form-grid"></div>
+      <div class="row dialog-actions"><button type="button" id="adminDialogCancel" class="secondary">Cancel</button><button id="adminDialogSubmit" value="default">Save</button></div>
+    </form>
+  </dialog>
+  <div id="toolTooltip" class="tool-tooltip"></div>
   <div id="toast"></div>
-  <script>${dashboardJs()}</script>
+  <script src="/assets/dashboard.js"></script>
 </body>
 </html>`;
 }
-function dashboardCss() {
-    return `
-:root{color-scheme:light;--bg:#f4f6f2;--surface:#ffffff;--surface-soft:#fbfcf8;--text:#18201b;--muted:#5d675f;--border:#dce3d9;--border-soft:#e7ede4;--sidebar:#17251d;--sidebar-text:#f4f8f2;--sidebar-muted:#aebcaf;--accent:#235c42;--accent-strong:#17452f;--accent-soft:#dff5e8;--warn:#fff7da;--danger:#9b1c1c;--pre:#111812;--pre-text:#f3f7ef;--shadow:0 8px 24px rgba(24,32,27,.04);--link:#1d6a4c}
-:root[data-theme="dark"]{color-scheme:dark;--bg:#101411;--surface:#171d19;--surface-soft:#1d251f;--text:#edf4ee;--muted:#a7b3aa;--border:#2d3830;--border-soft:#263128;--sidebar:#0c120f;--sidebar-text:#edf7ef;--sidebar-muted:#8da091;--accent:#4fa876;--accent-strong:#64bd89;--accent-soft:#173d2a;--warn:#3b3216;--danger:#cc4b4b;--pre:#070a08;--pre-text:#e8f1ea;--shadow:0 10px 28px rgba(0,0,0,.22);--link:#75c99a}
-.agent-settings-nav{display:flex;align-items:center;gap:8px;flex-wrap:wrap;margin:0 0 12px;padding:10px;border:1px solid var(--border-soft);border-radius:8px;background:var(--surface)}.agent-settings-nav strong{font-size:13px;color:var(--muted);margin-right:4px}.agent-settings-nav button{background:var(--surface);color:var(--text);border-color:var(--border);height:32px}.agent-settings-nav button.active{background:var(--accent);color:white;border-color:var(--accent)}@media(max-width:560px){.agent-settings-nav{align-items:stretch}.agent-settings-nav button{width:100%}}
-.drop-active{outline:2px dashed var(--accent);outline-offset:-8px}.chip{display:inline-flex;align-items:center;border-radius:999px;border:1px solid var(--border);padding:2px 8px;font-size:12px;color:var(--muted);margin-right:6px}.chip.error{color:var(--danger);border-color:var(--danger)}.chip.warn{color:#8a6a12;border-color:#d9c27a;background:var(--warn)}.gallery{display:grid;grid-template-columns:repeat(auto-fill,minmax(150px,1fr));gap:10px;margin-top:12px}.artifact-card{border:1px solid var(--border-soft);border-radius:8px;padding:8px;background:var(--surface-soft);min-width:0}.artifact-card img{width:100%;aspect-ratio:1.4;object-fit:cover;border:1px solid var(--border);border-radius:6px;background:var(--surface)}.artifact-card small{display:block;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.setting.dirty{border-color:var(--accent)}.setting-actions{display:flex;gap:8px;align-items:center;margin-top:8px}.setting-help{font-size:12px;color:var(--muted)}.restart-banner{border:1px solid #d9c27a;background:var(--warn);border-radius:8px;padding:10px;margin:0 0 12px}.task-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(240px,1fr));gap:10px}.log-line{display:block}.log-line.ERROR{color:var(--danger);font-weight:700}.log-line.WARN{color:#8a6a12;font-weight:700}.connection-ok{color:#1e754e;border-color:#8ed0aa}.connection-warn{color:#8a6a12;border-color:#d9c27a}.connection-error{color:var(--danger);border-color:var(--danger)}
-*{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--text);font-family:Inter,system-ui,-apple-system,Segoe UI,sans-serif}.app{min-height:100vh;display:grid;grid-template-columns:260px 1fr}.sidebar{background:var(--sidebar);color:var(--sidebar-text);padding:18px;display:flex;flex-direction:column;gap:22px}.brand{display:flex;align-items:center;gap:12px}.mark{display:grid;place-items:center;width:38px;height:38px;border-radius:8px;background:#d7ffe5;color:#173d29;font-weight:800}.brand small{display:block;color:var(--sidebar-muted)}nav{display:flex;flex-direction:column;gap:6px}nav button,.menu{border:0;border-radius:6px;padding:10px 12px;background:transparent;color:inherit;text-align:left;font:inherit;cursor:pointer}nav button.active,nav button:hover{background:color-mix(in srgb,var(--accent) 35%,transparent)}main{min-width:0;display:flex;flex-direction:column}header{position:sticky;top:0;z-index:5;display:flex;justify-content:space-between;gap:16px;align-items:center;padding:16px 22px;background:color-mix(in srgb,var(--surface) 92%,transparent);backdrop-filter:blur(12px);border-bottom:1px solid var(--border)}h1{font-size:24px;margin:0}h2{font-size:16px;margin:0 0 12px}p{margin:4px 0 0;color:var(--muted)}a{color:var(--link)}.header-actions,.row,.chat-toolbar,.attachment-row{display:flex;gap:8px;align-items:center;flex-wrap:wrap}.menu{display:none;background:var(--surface-soft);color:var(--text)}.page{display:none;padding:22px}.page.active{display:block}.stack{display:flex;flex-direction:column;gap:16px}.metrics{display:grid;grid-template-columns:repeat(auto-fit,minmax(170px,1fr));gap:12px;margin-bottom:16px}.metric,.panel{background:var(--surface);border:1px solid var(--border);border-radius:8px;padding:16px;box-shadow:var(--shadow)}.metric .label{font-size:12px;text-transform:uppercase;color:var(--muted)}.metric .value{font-size:22px;font-weight:750;margin-top:4px;overflow:hidden;text-overflow:ellipsis}button,select,input,textarea{border:1px solid var(--border);border-radius:6px;background:var(--surface);color:var(--text);font:inherit}button{height:36px;padding:0 12px;background:var(--accent);color:white;border-color:var(--accent);cursor:pointer}button:hover{background:var(--accent-strong)}button.secondary{background:var(--surface);color:var(--text)}input,select{height:36px;padding:0 10px}textarea{width:100%;padding:10px;resize:vertical}.chat-layout{display:grid;grid-template-columns:minmax(0,1fr) 330px;gap:16px;align-items:start}.chat-panel{height:calc(100vh - 170px);min-height:520px;display:flex;flex-direction:column}.control-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));gap:8px;margin:12px 0}.control-grid label,.form-grid label{display:grid;gap:5px;font-size:12px;color:var(--muted)}.messages{flex:1;min-height:0;overflow:auto;border:1px solid var(--border-soft);border-radius:8px;padding:12px;background:var(--surface-soft)}.message{margin:0 0 12px;padding:10px 12px;border-radius:8px;max-width:92%;white-space:pre-wrap;word-break:break-word}.message.user{margin-left:auto;background:var(--accent-soft)}.message.agent{background:color-mix(in srgb,var(--surface-soft) 80%,var(--border))}.message.system{background:var(--warn)}.composer{display:grid;grid-template-columns:1fr auto;gap:10px;margin-top:12px}.composer-fields{min-width:0}.composer button{height:auto;min-width:90px}.attachment-row{margin-top:8px;color:var(--muted);font-size:13px}.file-button{display:inline-flex;align-items:center;height:34px;padding:0 10px;border:1px solid var(--border);border-radius:6px;background:var(--surface);color:var(--text);cursor:pointer}input[type=file]{display:none}.sessions-toolbar{display:flex;justify-content:space-between;align-items:center;gap:12px;flex-wrap:wrap}.sessions-toolbar .search-row{flex:1 1 320px}.sessions-toolbar .attach-row{flex:1 1 360px;justify-content:flex-end;margin-left:auto}.sessions-toolbar input{min-width:220px}.copy-id{height:auto;padding:0;border:0;background:transparent;color:var(--link);font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:12px}.copy-id:hover{background:transparent;text-decoration:underline}.side-panel{max-height:calc(100vh - 126px);display:flex;flex-direction:column}.tool-stream{display:flex;flex-direction:column;gap:8px;overflow:auto;max-height:calc(100vh - 190px);padding-right:4px}.tool{border:1px solid var(--border-soft);border-radius:6px;padding:8px;background:var(--surface-soft);white-space:pre-wrap;word-break:break-word}.list{display:flex;flex-direction:column;gap:8px;margin-top:12px}.item{border:1px solid var(--border-soft);border-radius:8px;padding:12px;background:var(--surface-soft)}.item strong{display:block;overflow-wrap:anywhere}.item small{display:block;color:var(--muted);overflow-wrap:anywhere}.queue-item{cursor:grab}.queue-item.dragging{opacity:.55}.badge,.adapter-status{display:inline-flex;align-items:center;border:1px solid var(--border);border-radius:999px;padding:2px 8px;color:var(--muted);font-size:12px}.adapter-status{margin-left:6px;text-transform:capitalize}.adapter-status.enabled,.adapter-status.available{color:#1e754e;border-color:#8ed0aa;background:color-mix(in srgb,var(--accent-soft) 55%,transparent)}.adapter-status.disabled{color:var(--muted)}.adapter-status.planned{color:#8a6a12;border-color:#d9c27a;background:var(--warn)}.preview{margin-top:12px}.preview img{max-width:100%;border:1px solid var(--border);border-radius:8px;background:var(--surface)}.settings-grid{display:block}.setting{border:1px solid var(--border-soft);border-radius:8px;padding:12px;margin-bottom:10px;background:var(--surface-soft)}.setting label{display:block;font-size:13px;font-weight:700;margin-bottom:6px}.setting small{display:block;color:var(--muted);margin-top:6px}.setting input,.setting textarea,.setting select{width:100%}.setting-error{color:var(--danger);font-size:12px;margin-top:6px}.checkbox{display:inline-flex!important;grid-template-columns:auto 1fr!important;align-items:center;gap:8px}.checkbox input{height:auto;width:auto}.tabs{display:flex;gap:8px;flex-wrap:wrap;margin:14px 0}.tabs button{background:var(--surface);color:var(--text);border-color:var(--border);height:34px}.tabs button.active{background:var(--accent);color:white;border-color:var(--accent)}.pager{display:flex;justify-content:space-between;align-items:center;gap:10px;flex-wrap:wrap;margin-top:12px;color:var(--muted)}.pager-actions{display:flex;gap:8px}.pager button:disabled{opacity:.45;cursor:not-allowed}pre{white-space:pre-wrap;word-break:break-word;background:var(--pre);color:var(--pre-text);border-radius:8px;padding:14px;overflow:auto}footer{margin-top:auto;display:flex;gap:18px;flex-wrap:wrap;padding:14px 22px;border-top:1px solid var(--border);color:var(--muted);background:var(--surface)}dialog{border:1px solid var(--border);border-radius:8px;background:var(--surface);color:var(--text);width:min(720px,calc(100vw - 28px));padding:18px;box-shadow:0 18px 70px rgba(0,0,0,.22)}dialog::backdrop{background:rgba(0,0,0,.35)}.form-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:12px}.dialog-actions{justify-content:flex-end;margin-top:16px}#toast{position:fixed;right:18px;bottom:18px;display:none;background:var(--accent);color:white;border-radius:8px;padding:12px 14px;max-width:360px}.danger{background:var(--danger);border-color:var(--danger);color:white}@media(max-width:860px){.app{display:block}.sidebar{position:fixed;inset:0 auto 0 0;width:270px;transform:translateX(-100%);transition:.18s transform;z-index:20}.sidebar.open{transform:translateX(0)}.menu{display:inline-block}.header-actions{justify-content:flex-end}.page{padding:14px}.chat-layout{grid-template-columns:1fr}.chat-panel{height:auto;min-height:0}.messages{max-height:55vh;min-height:300px}.composer{grid-template-columns:1fr}.composer button{height:40px}.side-panel{order:-1;max-height:360px}.tool-stream{max-height:300px}header{align-items:flex-start}.metrics{grid-template-columns:1fr 1fr}}@media(max-width:560px){.metrics{grid-template-columns:1fr}.row{align-items:stretch}.row>*{width:100%}header{display:grid;grid-template-columns:auto 1fr}.header-actions{grid-column:1/3}.message{max-width:100%}.pager{align-items:stretch}.pager-actions,.pager button{width:100%}.attachment-row>*,.sessions-toolbar,.sessions-toolbar .row,.sessions-toolbar input,.sessions-toolbar button{width:100%}.sessions-toolbar .attach-row{margin-left:0;justify-content:stretch}}
-`;
-}
-function dashboardJs() {
-    return `
-const token = localStorage.getItem('nordrelayDashboardToken') || '';
-const state = { snapshot:null, controls:null, newSessionControls:null, enabledAgents:[], settings:[], currentPage:'overview', settingsGroup:null, logsPlain:'', logTimer:null, toastTimer:null, cliStatusActive:false, selectedArtifactTurns:new Set(), mediaRecorder:null, recordedChunks:[], events:null, reconnectTimer:null, notifications:false };
-const authHeaders = () => token ? { authorization: 'Bearer ' + token } : {};
-async function api(path, options={}) {
-  const headers = { ...(options.body ? {'content-type':'application/json'} : {}), ...authHeaders(), ...(options.headers||{}) };
-  const res = await fetch(path, { ...options, headers });
-  if (res.status === 401) { location.reload(); return; }
-  const text = await res.text();
-  const data = text ? JSON.parse(text) : {};
-  if (!res.ok) throw new Error(data.error || res.statusText);
-  return data;
-}
-function toast(msg,options={}){const el=document.getElementById('toast');el.textContent=msg;el.style.display='block';if(state.toastTimer)clearTimeout(state.toastTimer);state.toastTimer=null;if(!options.sticky){state.toastTimer=setTimeout(()=>{el.style.display='none';state.toastTimer=null},options.duration||3500)}}
-function esc(s){return String(s??'').replace(/[&<>]/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;'}[c]))}
-function attr(s){return esc(s).replace(/"/g,'&quot;')}
-function cssEscape(s){return window.CSS&&CSS.escape?CSS.escape(s):String(s).replace(/[^a-zA-Z0-9_-]/g,'\\\\$&')}
-function short(s,max=250){const text=String(s??'');return text.length>max?text.slice(0,max-1)+'...':text}
-async function copyText(text,label='Copied'){if(!text)return;try{await navigator.clipboard.writeText(text)}catch{const area=document.createElement('textarea');area.value=text;area.style.position='fixed';area.style.opacity='0';document.body.appendChild(area);area.select();document.execCommand('copy');area.remove()}toast(label)}
-function fmtDate(s){return s?new Date(s).toLocaleString(): '-'}
-function fmtDuration(ms){if(!ms&&ms!==0)return '-';const sec=Math.round(ms/1000);if(sec<60)return sec+'s';return Math.floor(sec/60)+'m '+(sec%60)+'s'}
-function fmtBytes(n){if(n<1024)return n+' B';if(n<1048576)return (n/1024).toFixed(1).replace(/\\.0$/,'')+' KB';return (n/1048576).toFixed(1).replace(/\\.0$/,'')+' MB'}
-function compactNum(n){if(!n)return'';if(n>=1000000000)return Math.round(n/100000000)/10+'B';if(n>=1000000)return Math.round(n/100000)/10+'M';if(n>=1000)return Math.round(n/100)/10+'K';return String(n)}
-function modelLabel(m){const meta=[m.contextWindow?compactNum(m.contextWindow):'',m.supportsImages===true?'img':m.supportsImages===false?'text':'',m.supportsThinking===true?'think':''].filter(Boolean).join(' ');return (m.displayName||m.slug)+(meta?' · '+meta:'')}
-function fmtAge(ms){const sec=Math.max(0,Math.floor(ms/1000));if(sec<60)return sec+'s ago';const min=Math.floor(sec/60);if(min<60)return min+'m ago';return Math.floor(min/60)+'h ago'}
-function isCliRunningStatus(msg){return / CLI running\\b/.test(String(msg||''))}
-function isCliDoneStatus(msg){return / CLI task\\b/.test(String(msg||''))}
-function applyTheme(theme){document.documentElement.dataset.theme=theme;localStorage.setItem('nordrelayTheme',theme);document.getElementById('themeBtn').textContent=theme==='dark'?'Light':'Dark'}
-function toggleTheme(){applyTheme(document.documentElement.dataset.theme==='dark'?'light':'dark')}
-function page(name){state.currentPage=name;document.querySelectorAll('nav button').forEach(b=>b.classList.toggle('active',b.dataset.page===name));document.querySelectorAll('.page').forEach(p=>p.classList.toggle('active',p.id==='page-'+name));document.getElementById('pageTitle').textContent=name[0].toUpperCase()+name.slice(1);document.getElementById('sidebar').classList.remove('open'); if(name==='sessions') loadSessions(); if(name==='settings') loadSettings(); if(name==='logs') loadLogs(); if(name==='diagnostics') loadDiagnostics(); if(name==='artifacts') loadArtifacts(); if(name==='activity') loadActivity(); if(name==='tasks') loadTasks(); if(name==='adapters') loadAdapterHealth(); if(name==='access') loadAccess(); if(name==='version') loadVersion();}
-document.querySelectorAll('nav button').forEach(b=>b.onclick=()=>page(b.dataset.page));
-document.getElementById('menuBtn').onclick=()=>document.getElementById('sidebar').classList.toggle('open');
-document.getElementById('refreshBtn').onclick=()=>loadBootstrap();
-document.getElementById('themeBtn').onclick=toggleTheme;
-applyTheme(localStorage.getItem('nordrelayTheme') || 'light');
-
-function createPaginator(containerId, onChange, pageSize=50){
-  const container=document.getElementById(containerId);
-  return {
-    page:1,
-    pageSize,
-    reset(){this.page=1},
-    render(meta={}){
-      const hasPrevious=Boolean(meta.hasPrevious);
-      const hasNext=Boolean(meta.hasNext);
-      container.innerHTML='<span>Page '+this.page+' / '+this.pageSize+' per page</span><div class="pager-actions"><button data-page-action="prev" '+(!hasPrevious?'disabled':'')+'>Previous</button><button data-page-action="next" '+(!hasNext?'disabled':'')+'>Next</button></div>';
-      const prev=container.querySelector('[data-page-action="prev"]');
-      const next=container.querySelector('[data-page-action="next"]');
-      prev.onclick=()=>{if(hasPrevious){this.page-=1;onChange()}};
-      next.onclick=()=>{if(hasNext){this.page+=1;onChange()}};
-    }
-  };
-}
-const sessionsPager=createPaginator('sessionsPager',()=>loadSessions(false),50);
-
-async function loadBootstrap(){
-  const data = await api('/api/bootstrap');
-  state.snapshot = data.status.snapshot;
-  state.controls = data.controls;
-  state.enabledAgents = data.enabledAgents || [];
-  renderSnapshot(state.snapshot);
-  renderSessionControls();
-  populateNewSessionForm(data.enabledAgents);
-  renderAdapters(data.channels, data.agentAdapters);
-  document.getElementById('footerVersion').textContent='NordRelay '+(data.status.health?.version || '');
-  document.getElementById('footerHealth').textContent='Health: '+(data.status.health?.state?.status || 'unknown');
-  const agentSelect=document.getElementById('agentSelect');
-  agentSelect.innerHTML=data.enabledAgents.map(a=>'<option value="'+a+'">'+a+'</option>').join('');
-  agentSelect.value=state.snapshot.session.agentId;
-  agentSelect.onchange=()=>safe(async()=>{await api('/api/agent',{method:'POST',body:JSON.stringify({agentId:agentSelect.value})});toast('Agent switched');await loadBootstrap();await loadChatHistory()});
-}
-function renderSnapshot(s){
-  document.getElementById('sessionLine').textContent=(s.session.agentLabel||'Agent')+' / '+(s.session.model||'default')+' / '+(s.session.threadId||'not started');
-  document.getElementById('sessionText').textContent=s.sessionText||'';
-  document.getElementById('metrics').innerHTML=[
-    ['Status',s.processing?'working':'idle'],['Agent',s.session.agentLabel],['Queue',s.queue.length],['Workspace',s.session.workspace],['Thread',s.session.threadId||'not started'],['Reasoning',s.session.reasoningEffort||'default'],['Fast',s.session.capabilities&&s.session.capabilities.fastMode?(s.session.fastMode?'on':'off'):'n/a']
-  ].map(([k,v])=>'<div class="metric"><div class="label">'+esc(k)+'</div><div class="value">'+esc(v)+'</div></div>').join('');
-  renderQueue(s.queue,s.queuePaused);
-}
-function renderSessionControls(){
-  const c=state.controls||{};const s=state.snapshot?.session||{};const caps=c.capabilities||{};
-  const modelOptions=['<option value="">Default</option>'].concat((c.models||[]).map(m=>'<option value="'+attr(m.slug)+'" '+(m.slug===s.model?'selected':'')+'>'+esc(modelLabel(m))+'</option>')).join('');
-  const reasoningOptions=(c.reasoningOptions||[]).map(v=>'<option value="'+attr(v)+'" '+(v===s.reasoningEffort?'selected':'')+'>'+esc(v)+'</option>').join('');
-  const launchOptions=(c.launchProfiles||[]).map(p=>'<option value="'+attr(p.id)+'" '+(p.id===(s.nextLaunchProfileId||s.launchProfileId)?'selected':'')+'>'+esc(p.label+' - '+p.behavior+(p.unsafe?' - unsafe':''))+'</option>').join('');
-  document.getElementById('sessionControls').innerHTML=[
-    caps.modelSelection?'<label>Model<select id="controlModel">'+modelOptions+'</select></label>':'',
-    caps.reasoningSelection?'<label>'+esc(c.reasoningLabel||'Reasoning')+'<select id="controlReasoning">'+reasoningOptions+'</select></label>':'',
-    caps.launchProfiles?'<label>Launch<select id="controlLaunch">'+launchOptions+'</select></label>':'',
-    caps.fastMode?'<label class="checkbox"><input id="controlFast" type="checkbox" '+(s.fastMode?'checked':'')+'> Fast mode</label>':''
-  ].join('');
-  const model=document.getElementById('controlModel'); if(model) model.onchange=()=>safe(async()=>{if(model.value){await api('/api/session/model',{method:'POST',body:JSON.stringify({model:model.value})});toast('Model updated');loadBootstrap()}});
-  const reasoning=document.getElementById('controlReasoning'); if(reasoning) reasoning.onchange=()=>safe(async()=>{await api('/api/session/reasoning',{method:'POST',body:JSON.stringify({reasoning:reasoning.value})});toast((c.reasoningLabel||'Reasoning')+' updated');loadBootstrap()});
-  const launch=document.getElementById('controlLaunch'); if(launch) launch.onchange=()=>safe(async()=>{await api('/api/session/launch',{method:'POST',body:JSON.stringify({profileId:launch.value})});toast('Launch profile updated');loadBootstrap()});
-  const fast=document.getElementById('controlFast'); if(fast) fast.onchange=()=>safe(async()=>{await api('/api/session/fast',{method:'POST',body:JSON.stringify({enabled:fast.checked})});toast('Fast mode updated');loadBootstrap()});
-}
-function renderAdapters(channels, agents){
-  const channelCards=(channels||[]).map(c=>adapterCard(c.label,c.status,c.capabilities.join(', ')));
-  const agentCards=(agents||[]).map(a=>{const available=a.status==='available';const status=available?(state.enabledAgents.includes(a.id)?'enabled':'disabled'):(a.status||'planned');const detail=[available?'integrated':(a.status||'planned'),a.envFlag,a.notes].filter(Boolean).join(' / ');return adapterCard(a.label,status,detail)});
-  document.getElementById('adapters').innerHTML='<div class="list">'+channelCards.concat(agentCards).join('')+'</div>';
-}
-function adapterCard(label,status,detail){return '<div class="item"><strong>'+esc(label)+' <span class="adapter-status '+esc(status)+'">'+esc(status)+'</span></strong><small>'+esc(detail||'')+'</small></div>'}
-function appendMessage(cls,text){const box=document.getElementById('messages');const div=document.createElement('div');div.className='message '+cls;div.textContent=text;box.appendChild(div);box.scrollTop=box.scrollHeight;return div}
-function appendQueuedMessage(id){const div=appendMessage('system','Queued prompt '+id);const btn=document.createElement('button');btn.textContent='Cancel queued message';btn.className='danger';btn.onclick=()=>safe(async()=>{const r=await api('/api/queue',{method:'POST',body:JSON.stringify({action:'cancel',id})});renderQueue(r.queue,r.paused);div.textContent='Cancelled queued prompt '+id});div.appendChild(document.createElement('br'));div.appendChild(btn)}
-function renderChatMessages(messages){state.chatMessages=messages||[];const box=document.getElementById('messages');box.innerHTML=(messages||[]).map(m=>'<div class="message '+esc(m.role)+'"><small>'+esc((m.source||'web')+' / '+fmtDate(m.timestamp))+'</small>\\n'+esc(m.text)+'</div>').join('');box.scrollTop=box.scrollHeight}
-async function loadChatHistory(){const data=await api('/api/chat/history');renderChatMessages(data.messages||[])}
-let currentAgentMessage=null;
-function connectEvents(){
-  if(state.events) state.events.close();
-  const qs = token ? '?token='+encodeURIComponent(token) : '';
-  const events = new EventSource('/api/events'+qs);
-  state.events=events;
-  setConnection('Connecting','warn');
-  events.onopen=()=>{if(state.reconnectTimer){clearTimeout(state.reconnectTimer);state.reconnectTimer=null}setConnection('Live','ok')};
-  events.addEventListener('snapshot', e=>{const d=JSON.parse(e.data).data;state.snapshot=d;renderSnapshot(d);renderSessionControls()});
-  events.addEventListener('chat_history', e=>renderChatMessages(JSON.parse(e.data).messages||[]));
-  events.addEventListener('activity_update', e=>renderActivity(JSON.parse(e.data).events||[]));
-  events.addEventListener('session_update', e=>{loadBootstrap();loadChatHistory()});
-  events.addEventListener('queue_update', e=>{const d=JSON.parse(e.data);renderQueue(d.queue,d.paused)});
-  events.addEventListener('turn_start', e=>{const d=JSON.parse(e.data);appendMessage('user',d.prompt);currentAgentMessage=appendMessage('agent','');if(state.currentPage==='tasks')loadTasks()});
-  events.addEventListener('text_delta', e=>{const d=JSON.parse(e.data);if(!currentAgentMessage)currentAgentMessage=appendMessage('agent','');currentAgentMessage.textContent+=d.delta;currentAgentMessage.scrollIntoView({block:'end'});if(state.currentPage==='tasks')loadTasks()});
-  events.addEventListener('tool_start', e=>{const d=JSON.parse(e.data);tool('tool','Started '+d.toolName);if(state.currentPage==='tasks')loadTasks()});
-  events.addEventListener('tool_update', e=>{const d=JSON.parse(e.data);if(d.partialResult)tool('tool',d.partialResult.slice(-600))});
-  events.addEventListener('tool_end', e=>{const d=JSON.parse(e.data);tool(d.isError?'danger':'tool','Finished '+d.toolCallId+(d.isError?' with error':''))});
-  events.addEventListener('todo_update', e=>{const d=JSON.parse(e.data);tool('tool','Plan:\\n'+d.items.map(i=>(i.completed?'[x] ':'[ ] ')+i.text).join('\\n'))});
-  events.addEventListener('turn_error', e=>{const d=JSON.parse(e.data);appendMessage('system','Error: '+d.error);currentAgentMessage=null});
-  events.addEventListener('turn_complete', ()=>{currentAgentMessage=null;notify('NordRelay turn finished','The active task completed.');loadBootstrap();if(state.currentPage==='tasks')loadTasks()});
-  events.addEventListener('status', e=>{const d=JSON.parse(e.data);const msg=d.message||'';if(isCliRunningStatus(msg)){state.cliStatusActive=true;toast(msg,{sticky:true});return}if(isCliDoneStatus(msg))state.cliStatusActive=false;toast(msg)});
-  events.onerror=()=>{setConnection('Reconnecting','error');if(!state.reconnectTimer)state.reconnectTimer=setTimeout(()=>{state.reconnectTimer=null;connectEvents()},5000)};
-}
-function setConnection(text,kind){const el=document.getElementById('connectionStatus');el.textContent=text;el.className='badge connection-'+kind}
-async function enableNotifications(){if(!('Notification' in window)){toast('Browser notifications are not supported');return}const permission=Notification.permission==='granted'?'granted':await Notification.requestPermission();state.notifications=permission==='granted';toast(state.notifications?'Browser notifications enabled':'Browser notifications denied')}
-function notify(title,body){if(state.notifications&&'Notification' in window&&Notification.permission==='granted')new Notification(title,{body})}
-function updateToolAgeTitles(){document.querySelectorAll('.tool[data-created-at]').forEach(el=>{const created=Number(el.dataset.createdAt||Date.now());el.title='Updated '+fmtAge(Date.now()-created)})}
-function tool(cls,text){const div=document.createElement('div');div.className='tool '+(cls==='danger'?'danger':'');div.dataset.createdAt=String(Date.now());div.textContent=text;document.getElementById('toolStream').prepend(div);updateToolAgeTitles()}
-setInterval(updateToolAgeTitles,30000);
-let selectedFiles=[];
-function renderSelectedFiles(){const summary=document.getElementById('fileSummary');if(selectedFiles.length===0){summary.textContent='No files selected';return}const names=selectedFiles.slice(0,3).map(f=>f.name || 'file').join(', ');const more=selectedFiles.length>3?' +'+(selectedFiles.length-3)+' more':'';const bytes=selectedFiles.reduce((sum,file)=>sum+file.size,0);summary.textContent=names+more+' ('+fmtBytes(bytes)+')'}
-function addFiles(files){selectedFiles=selectedFiles.concat(Array.from(files||[]));renderSelectedFiles()}
-async function filePayload(file){return {name:file.name || 'upload',mimeType:file.type || 'application/octet-stream',dataBase64:await fileToBase64(file)}}
-async function fileToBase64(file){const buffer=await file.arrayBuffer();const bytes=new Uint8Array(buffer);let binary='';const chunk=0x8000;for(let i=0;i<bytes.length;i+=chunk){binary+=String.fromCharCode(...bytes.subarray(i,i+chunk))}return btoa(binary)}
-document.getElementById('fileInput').onchange=e=>{addFiles(e.target.files)};
-document.getElementById('clearFilesBtn').onclick=()=>{selectedFiles=[];document.getElementById('fileInput').value='';renderSelectedFiles()};
-document.addEventListener('paste',e=>{const files=Array.from(e.clipboardData?.files||[]);if(files.length){addFiles(files);toast('Pasted '+files.length+' file(s)')}});
-document.addEventListener('dragover',e=>{e.preventDefault();document.body.classList.add('drop-active')});
-document.addEventListener('dragleave',()=>document.body.classList.remove('drop-active'));
-document.addEventListener('drop',e=>{e.preventDefault();document.body.classList.remove('drop-active');const files=Array.from(e.dataTransfer?.files||[]);if(files.length){addFiles(files);toast('Added '+files.length+' dropped file(s)')}});
-document.getElementById('promptForm').onsubmit=e=>safe(async()=>{e.preventDefault();const input=document.getElementById('promptInput');const text=input.value.trim();if(!text&&selectedFiles.length===0)return;const files=selectedFiles;input.value='';selectedFiles=[];document.getElementById('fileInput').value='';renderSelectedFiles();const payloadFiles=files.length?await Promise.all(files.map(filePayload)):[];const r=files.length?await api('/api/prompt/upload',{method:'POST',body:JSON.stringify({text,files:payloadFiles})}):await api('/api/prompt',{method:'POST',body:JSON.stringify({text})});if(r.transcribeOnly)appendMessage('system','Transcribed audio:\\n'+(r.transcript||'(empty)'));else if(r.queued)appendQueuedMessage(r.queueId)},e);
-document.getElementById('newSessionBtn').onclick=()=>openNewSessionDialog();
-document.getElementById('retryBtn').onclick=()=>safe(async()=>{const r=await api('/api/retry',{method:'POST'});toast(r.queued?'Retry queued '+r.queueId:'Retry started')});
-document.getElementById('editLastBtn').onclick=()=>{const last=[...(state.chatMessages||[])].reverse().find(m=>m.role==='user');if(last){document.getElementById('promptInput').value=last.text;document.getElementById('promptInput').focus()}else toast('No user prompt found')};
-document.getElementById('syncBtn').onclick=()=>safe(async()=>{const r=await api('/api/sync',{method:'POST'});toast(r.changed?'Synced: '+(r.changedFields||[]).join(', '):'Already in sync');loadBootstrap()});
-document.getElementById('notifyBtn').onclick=()=>enableNotifications();
-document.getElementById('clearChatBtn').onclick=()=>safe(async()=>{if(confirm('Clear chat history for the current thread?')){const r=await api('/api/chat/history',{method:'DELETE'});renderChatMessages(r.messages||[]);toast('Removed '+r.removed+' messages')}});
-document.getElementById('abortBtn').onclick=()=>safe(async()=>{await api('/api/abort',{method:'POST'});toast('Abort sent')});
-document.getElementById('handbackBtn').onclick=()=>safe(async()=>{const r=await api('/api/handback',{method:'POST'});appendMessage('system','Handback command:\\n'+(r.command||'No command available'))});
-document.getElementById('recordBtn').onclick=()=>safe(async()=>{const btn=document.getElementById('recordBtn');if(state.mediaRecorder&&state.mediaRecorder.state==='recording'){state.mediaRecorder.stop();btn.textContent='Record voice';return}const stream=await navigator.mediaDevices.getUserMedia({audio:true});state.recordedChunks=[];state.mediaRecorder=new MediaRecorder(stream);state.mediaRecorder.ondataavailable=e=>{if(e.data.size>0)state.recordedChunks.push(e.data)};state.mediaRecorder.onstop=()=>{stream.getTracks().forEach(t=>t.stop());const blob=new Blob(state.recordedChunks,{type:'audio/webm'});addFiles([new File([blob],'voice-note.webm',{type:'audio/webm'})]);toast('Voice note attached')};state.mediaRecorder.start();btn.textContent='Stop recording'});
-function renderNewSessionControls(c){const s=state.snapshot?.session||{};const caps=c.capabilities||{};document.getElementById('workspaceOptions').innerHTML=(c.workspaces||[]).map(w=>'<option value="'+attr(w)+'"></option>').join('');document.getElementById('newModel').innerHTML='<option value="">Default</option>'+((c.models||[]).map(m=>'<option value="'+attr(m.slug)+'">'+esc(modelLabel(m))+'</option>').join(''));document.getElementById('newModel').parentElement.style.display=caps.modelSelection?'grid':'none';const reasoningWrap=document.getElementById('newReasoningWrap');reasoningWrap.firstChild.nodeValue=(c.reasoningLabel||'Reasoning');reasoningWrap.style.display=caps.reasoningSelection?'grid':'none';document.getElementById('newReasoning').innerHTML='<option value="">Default</option>'+((c.reasoningOptions||[]).map(v=>'<option value="'+attr(v)+'">'+esc(v)+'</option>').join(''));document.getElementById('newLaunch').innerHTML='<option value="">Default</option>'+((c.launchProfiles||[]).map(p=>'<option value="'+attr(p.id)+'">'+esc(p.label+' - '+p.behavior)+'</option>').join(''));document.getElementById('newFast').checked=Boolean(s.fastMode&&caps.fastMode);document.getElementById('newLaunchWrap').style.display=caps.launchProfiles?'grid':'none';document.getElementById('newFastWrap').style.display=caps.fastMode?'inline-flex':'none'}
-function populateNewSessionForm(agents){const s=state.snapshot?.session||{};const agentSelect=document.getElementById('newAgent');agentSelect.innerHTML=(agents||[]).map(a=>'<option value="'+attr(a)+'" '+(a===s.agentId?'selected':'')+'>'+esc(a)+'</option>').join('');agentSelect.value=s.agentId||agentSelect.value;document.getElementById('newWorkspace').value=s.workspace||'';state.newSessionControls=state.controls||{};renderNewSessionControls(state.newSessionControls);agentSelect.onchange=()=>safe(async()=>{state.newSessionControls=await api('/api/control-options?agent='+encodeURIComponent(agentSelect.value));renderNewSessionControls(state.newSessionControls)})}
-function openNewSessionDialog(){populateNewSessionForm(state.enabledAgents);document.getElementById('newSessionDialog').showModal()}
-document.getElementById('newSessionForm').onsubmit=e=>safe(async()=>{e.preventDefault();const payload={agentId:val('newAgent'),workspace:val('newWorkspace')||undefined,model:val('newModel')||undefined,reasoningEffort:val('newReasoning')||undefined,launchProfileId:val('newLaunch')||undefined,fastMode:document.getElementById('newFast').checked};await api('/api/sessions/new',{method:'POST',body:JSON.stringify(payload)});document.getElementById('newSessionDialog').close();toast('New session started');await loadBootstrap();await loadChatHistory()},e);
-document.getElementById('cancelSessionBtn').onclick=()=>document.getElementById('newSessionDialog').close();
-function val(id){return document.getElementById(id).value.trim()}
-async function loadSessions(reset=true){if(reset)sessionsPager.reset();const q=document.getElementById('sessionSearch').value||'';const data=await api('/api/sessions?query='+encodeURIComponent(q)+'&page='+sessionsPager.page+'&limit='+sessionsPager.pageSize);document.getElementById('sessionsList').innerHTML=data.sessions.map(s=>'<div class="item"><strong title="'+attr(s.title||s.firstUserMessage||s.id)+'">'+esc(short(s.title||s.firstUserMessage||s.id))+'</strong><small><button type="button" class="copy-id" data-copy-id="'+attr(s.id)+'" title="Copy thread ID">'+esc(short(s.id,64))+'</button> / '+esc(short((s.cwd||'')+' / '+fmtDate(s.updatedAt)))+'</small><div class="row"><button data-switch="'+attr(s.id)+'">Switch</button><button class="secondary" data-session-detail="'+attr(s.id)+'">Details</button></div></div>').join('')||'<div class="item">No sessions found.</div>';sessionsPager.render(data.pagination||{});document.querySelectorAll('[data-copy-id]').forEach(b=>b.onclick=()=>copyText(b.dataset.copyId||'','Thread ID copied'));document.querySelectorAll('[data-switch]').forEach(b=>b.onclick=()=>safe(async()=>{await api('/api/sessions/switch',{method:'POST',body:JSON.stringify({threadId:b.dataset.switch})});toast('Session switched');loadBootstrap()}));document.querySelectorAll('[data-session-detail]').forEach(b=>b.onclick=()=>safe(()=>loadSessionDetail(b.dataset.sessionDetail)))}
-async function loadSessionDetail(threadId){const d=await api('/api/sessions/detail?threadId='+encodeURIComponent(threadId));const r=d.record||{};document.getElementById('sessionDetail').innerHTML='<h2>Session detail</h2>'+card('Metadata',[['Thread',threadId],['Agent',r.agentId],['Title',r.title],['Workspace',r.cwd],['Model',r.model],['Reasoning',r.reasoningEffort],['Updated',fmtDate(r.updatedAt)],['Path',r.sessionPath]])+'<h2>Recent messages</h2><div class="list">'+(d.messages||[]).slice(-20).map(m=>'<div class="item"><strong>'+esc(m.role+' / '+fmtDate(m.timestamp))+'</strong><small>'+esc(short(m.text,500))+'</small></div>').join('')+'</div><h2>Activity</h2><div class="list">'+(d.activity||[]).map(e=>'<div class="item"><strong>'+esc(e.status+' / '+e.type+' / '+fmtDate(e.timestamp))+'</strong><small>'+esc(short(e.prompt||e.detail||'',300))+'</small></div>').join('')+'</div>';document.getElementById('sessionDetailDialog').showModal()}
-document.getElementById('closeSessionDetailBtn').onclick=()=>document.getElementById('sessionDetailDialog').close();
-document.getElementById('sessionSearchBtn').onclick=()=>loadSessions(true);document.getElementById('sessionSearch').addEventListener('keydown',e=>{if(e.key==='Enter')loadSessions(true)});document.getElementById('attachBtn').onclick=async()=>{const threadId=document.getElementById('attachInput').value.trim();if(threadId){await api('/api/sessions/attach',{method:'POST',body:JSON.stringify({threadId})});toast('Session attached');loadBootstrap()}};
-function renderQueue(queue,paused){document.getElementById('queueStatus').textContent=paused?'Paused':'Running';document.getElementById('queueList').innerHTML=(queue||[]).map((q,i)=>'<div class="item queue-item" draggable="true" data-queue-id="'+attr(q.id)+'"><strong>'+esc((i+1)+'. '+q.id+' - '+q.description)+'</strong><small>Created '+fmtDate(q.createdAt)+' / attempts '+q.attempts+(q.lastError?' / '+esc(q.lastError):'')+'</small><div class="row"><button data-q="run" data-id="'+q.id+'">Run</button><button data-q="top" data-id="'+q.id+'">Top</button><button data-q="up" data-id="'+q.id+'">Up</button><button data-q="down" data-id="'+q.id+'">Down</button><button data-q="cancel" data-id="'+q.id+'" class="danger">Cancel</button></div></div>').join('')||'<div class="item">Queue is empty.</div>';document.querySelectorAll('[data-q]').forEach(b=>b.onclick=()=>safe(async()=>{const r=await api('/api/queue',{method:'POST',body:JSON.stringify({action:b.dataset.q,id:b.dataset.id})});renderQueue(r.queue,r.paused)}));let dragged=null;document.querySelectorAll('.queue-item').forEach(item=>{item.ondragstart=()=>{dragged=item.dataset.queueId;item.classList.add('dragging')};item.ondragend=()=>item.classList.remove('dragging');item.ondragover=e=>e.preventDefault();item.ondrop=()=>safe(async()=>{if(dragged&&dragged!==item.dataset.queueId){const ids=Array.from(document.querySelectorAll('.queue-item')).map(el=>el.dataset.queueId);const targetIndex=Math.max(0,ids.indexOf(item.dataset.queueId));await api('/api/queue',{method:'POST',body:JSON.stringify({action:'top',id:dragged})});for(let i=0;i<targetIndex;i++)await api('/api/queue',{method:'POST',body:JSON.stringify({action:'down',id:dragged})});const r=await api('/api/queue');renderQueue(r.queue,r.paused)}})})}
-document.querySelectorAll('[data-queue]').forEach(b=>b.onclick=()=>safe(async()=>{const r=await api('/api/queue',{method:'POST',body:JSON.stringify({action:b.dataset.queue})});renderQueue(r.queue,r.paused)}));
-async function loadTasks(){const d=await api('/api/tasks');renderTasks(d)}
-function taskCard(t,title){if(!t)return '<div class="item"><strong>'+esc(title)+'</strong><small>Idle</small></div>';const tools=(t.tools||[]).map(x=>x.name+' x'+x.count).join(', ')||'-';return '<div class="item"><strong>'+esc(title+' · '+t.status)+'</strong><small>'+esc((t.agentLabel||t.agentId||t.source)+' / '+(t.threadId||'-'))+'</small><small>'+esc('Elapsed '+fmtDuration(t.durationMs)+' / current '+(t.currentTool||'-')+' / last '+(t.lastTool||'-'))+'</small><small>'+esc('Tools: '+tools+' / output chars '+(t.outputChars||0))+'</small><small>'+esc(t.prompt||t.detail||'')+'</small></div>'}
-function renderTasks(d){document.getElementById('tasksList').innerHTML='<div class="task-grid">'+taskCard(d.current,'Current web turn')+taskCard(d.external,'External CLI turn')+'</div><h2>Queue</h2><div class="list">'+((d.queue||[]).map(q=>'<div class="item"><strong>'+esc(q.id+' · '+q.description)+'</strong><small>'+esc(fmtDate(q.createdAt)+' / attempts '+q.attempts)+'</small><div class="row"><button data-q="run" data-id="'+attr(q.id)+'">Run</button><button data-q="cancel" data-id="'+attr(q.id)+'" class="danger">Cancel</button></div></div>').join('')||'<div class="item">Queue is empty.</div>')+'</div><h2>Recent turns</h2><div class="list">'+((d.recent||[]).map(e=>'<div class="item"><strong>'+esc(e.status+' / '+e.source+' / '+e.type)+'</strong><small>'+esc(fmtDate(e.timestamp)+' / '+(e.threadId||'-'))+'</small><small>'+esc(short(e.prompt||e.detail||'',300))+'</small></div>').join('')||'<div class="item">No recent tasks.</div>')+'</div>';document.querySelectorAll('#tasksList [data-q]').forEach(b=>b.onclick=()=>safe(async()=>{const r=await api('/api/queue',{method:'POST',body:JSON.stringify({action:b.dataset.q,id:b.dataset.id})});renderQueue(r.queue,r.paused);loadTasks()}))}
-document.getElementById('reloadTasksBtn').onclick=()=>loadTasks();
-async function loadArtifacts(){const data=await api('/api/artifacts');state.artifactReports=data.reports||[];renderArtifacts()}
-function artifactMatches(a,kind,query){const name=(a.name||a.relativePath||'').toLowerCase();if(query&&!name.includes(query))return false;if(kind==='images')return /\\.(png|jpe?g|gif|webp|svg)$/i.test(name);if(kind==='docs')return !/\\.(png|jpe?g|gif|webp|svg)$/i.test(name);return true}
-function renderArtifacts(){const query=(document.getElementById('artifactSearch').value||'').toLowerCase();const kind=document.getElementById('artifactKind').value;const reports=state.artifactReports||[];document.getElementById('artifactList').innerHTML=reports.map(r=>{const files=(r.artifacts||[]).filter(a=>artifactMatches(a,kind,query));if(files.length===0)return'';const gallery=files.map(a=>{const href='/api/artifacts/file?turnId='+encodeURIComponent(r.turnId)+'&path='+encodeURIComponent(a.relativePath)+(token?'&token='+encodeURIComponent(token):'');const img=/\\.(png|jpe?g|gif|webp|svg)$/i.test(a.name)?'<img src="'+href+'">':'<pre>'+esc(a.name.split('.').pop()||'file')+'</pre>';return '<div class="artifact-card"><label><input type="checkbox" data-artifact-select="'+attr(r.turnId)+'" '+(state.selectedArtifactTurns.has(r.turnId)?'checked':'')+'> '+esc(short(a.name,32))+'</label>'+img+'<small>'+esc(fmtBytes(a.sizeBytes))+'</small><div class="row"><a href="'+href+'">Open</a><button class="secondary" data-preview-turn="'+attr(r.turnId)+'" data-preview-path="'+attr(a.relativePath)+'">Preview</button></div></div>'}).join('');return '<div class="item"><strong>'+esc(r.turnId)+' - '+files.length+'/'+r.fileCount+' files - '+fmtBytes(r.totalSizeBytes)+'</strong><small>'+fmtDate(r.updatedAt)+' / '+esc(r.source||'turn')+'</small><div class="row"><a href="/api/artifacts/zip?turnId='+encodeURIComponent(r.turnId)+(token?'&token='+encodeURIComponent(token):'')+'">Download ZIP</a><button data-del-art="'+esc(r.turnId)+'" class="danger">Delete</button></div><div class="gallery">'+gallery+'</div></div>'}).join('')||'<div class="item">No artifacts.</div>';document.querySelectorAll('[data-artifact-select]').forEach(c=>c.onchange=()=>{if(c.checked)state.selectedArtifactTurns.add(c.dataset.artifactSelect);else state.selectedArtifactTurns.delete(c.dataset.artifactSelect)});document.querySelectorAll('[data-del-art]').forEach(b=>b.onclick=()=>safe(async()=>{if(confirm('Delete artifact turn '+b.dataset.delArt+'?')){await api('/api/artifacts?turnId='+encodeURIComponent(b.dataset.delArt),{method:'DELETE'});state.selectedArtifactTurns.delete(b.dataset.delArt);loadArtifacts()}}));document.querySelectorAll('[data-preview-turn]').forEach(b=>b.onclick=()=>previewArtifact(b.dataset.previewTurn,b.dataset.previewPath))}
-document.getElementById('reloadArtifactsBtn').onclick=loadArtifacts;
-document.getElementById('artifactSearch').oninput=renderArtifacts;
-document.getElementById('artifactKind').onchange=renderArtifacts;
-document.getElementById('zipSelectedArtifactsBtn').onclick=()=>{const turnIds=[...state.selectedArtifactTurns];if(turnIds.length===0){toast('No artifact turns selected');return}turnIds.forEach(turnId=>window.open('/api/artifacts/zip?turnId='+encodeURIComponent(turnId)+(token?'&token='+encodeURIComponent(token):''),'_blank'))};
-document.getElementById('deleteSelectedArtifactsBtn').onclick=()=>safe(async()=>{const turnIds=[...state.selectedArtifactTurns];if(turnIds.length===0){toast('No artifact turns selected');return}if(confirm('Delete '+turnIds.length+' selected artifact turn(s)?')){const r=await api('/api/artifacts/bulk',{method:'POST',body:JSON.stringify({action:'delete',turnIds})});state.selectedArtifactTurns.clear();toast('Deleted '+(r.removed||[]).length+' artifact turn(s)');loadArtifacts()}});
-function highlightCode(text){return esc(text).replace(/\\b(import|export|const|let|function|return|if|else|for|while|class|interface|type|async|await)\\b/g,'<span class="chip">$1</span>')}
-async function previewArtifact(turnId,path){const data=await api('/api/artifacts/preview?turnId='+encodeURIComponent(turnId)+'&path='+encodeURIComponent(path));const target=document.getElementById('artifactPreview');if(data.kind==='image'){target.innerHTML='<div class="panel"><h2>'+esc(data.name)+'</h2><img src="/api/artifacts/file?turnId='+encodeURIComponent(turnId)+'&path='+encodeURIComponent(path)+(token?'&token='+encodeURIComponent(token):'')+'"></div>';return}if(data.kind==='text'){target.innerHTML='<div class="panel"><h2>'+esc(data.name)+' '+fmtBytes(data.sizeBytes)+'</h2><pre>'+highlightCode(data.text||'')+'</pre>'+(data.truncated?'<small>Preview truncated.</small>':'')+'</div>';return}target.innerHTML='<div class="panel"><h2>'+esc(data.name)+'</h2><p>'+esc(data.detail||'Preview unavailable')+'</p></div>'}
-async function loadActivity(){const q='?source='+encodeURIComponent(val('activitySource'))+'&status='+encodeURIComponent(val('activityStatus'))+'&limit='+encodeURIComponent(val('activityLimit')||'100');const data=await api('/api/activity'+q);state.activityEvents=data.events||[];renderActivity(state.activityEvents)}
-function renderActivity(events){const since=val('activitySince')?new Date(val('activitySince')).getTime():0;const filtered=(events||[]).filter(e=>!since||new Date(e.timestamp).getTime()>=since);document.getElementById('activityList').innerHTML=filtered.map(e=>'<div class="item"><strong><span class="chip '+(e.status==='failed'?'error':e.status==='queued'?'warn':'')+'">'+esc(e.status)+'</span>'+esc(fmtDate(e.timestamp)+' / '+e.source+' / '+e.type)+'</strong><small>'+esc(short(e.prompt||e.detail||'',220))+'</small><small><button type="button" class="copy-id" data-copy-id="'+attr(e.threadId||'')+'">'+esc(e.threadId||'-')+'</button> / '+esc((e.workspace||'-')+' / '+fmtDuration(e.durationMs))+'</small></div>').join('')||'<div class="item">No activity.</div>';document.querySelectorAll('#activityList [data-copy-id]').forEach(b=>b.onclick=()=>copyText(b.dataset.copyId||'','Thread ID copied'))}
-document.getElementById('loadActivityBtn').onclick=()=>loadActivity();
-document.getElementById('activitySince').onchange=()=>renderActivity(state.activityEvents||[]);
-document.getElementById('exportActivityBtn').onclick=()=>{const rows=(state.activityEvents||[]).map(e=>[e.timestamp,e.source,e.status,e.type,e.threadId||'',e.prompt||e.detail||''].join('\\t')).join('\\n');const blob=new Blob([rows],{type:'text/tab-separated-values'});const a=document.createElement('a');a.href=URL.createObjectURL(blob);a.download='nordrelay-activity.tsv';a.click();URL.revokeObjectURL(a.href)};
-async function loadSettings(){const data=await api('/api/settings');state.settings=data.settings;renderSettings()}
-const settingsGroupOrder=['Agents','Codex','Pi','Hermes','OpenClaw','Claude Code','Telegram','Operations','Artifacts','Workspace','Voice','Dashboard'];
-const agentSettingGroups=['Codex','Pi','Hermes','OpenClaw','Claude Code'];
-function orderedSettingsGroups(groups){const known=settingsGroupOrder.filter(name=>groups[name]);const extra=Object.keys(groups).filter(name=>!settingsGroupOrder.includes(name)).sort();return known.concat(extra)}
-function agentSettingsNav(current){return '<div class="agent-settings-nav"><strong>Agent settings</strong>'+agentSettingGroups.map(name=>'<button type="button" data-setting-tab="'+attr(name)+'" class="'+(name===current?'active':'')+'">'+esc(name)+'</button>').join('')+'</div>'}
-function renderSettings(){const groups={};state.settings.forEach(s=>(groups[s.group]??=[]).push(s));const names=orderedSettingsGroups(groups);if(!state.settingsGroup||!groups[state.settingsGroup])state.settingsGroup=groups.Agents?'Agents':names[0];document.getElementById('settingsTabs').innerHTML=names.map(name=>'<button data-setting-tab="'+attr(name)+'" class="'+(name===state.settingsGroup?'active':'')+'">'+esc(name)+' ('+groups[name].length+')</button>').join('');document.querySelectorAll('[data-setting-tab]').forEach(b=>b.onclick=()=>{state.settingsGroup=b.dataset.settingTab;renderSettings()});const items=groups[state.settingsGroup]||[];const nav=(state.settingsGroup==='Agents'||agentSettingGroups.includes(state.settingsGroup))?agentSettingsNav(state.settingsGroup):'';document.getElementById('settingsForm').innerHTML='<div class="settings-section"><h2>'+esc(state.settingsGroup||'Settings')+'</h2><div id="settingsRestartBanner"></div>'+nav+items.map(s=>'<div class="setting" data-setting-box="'+attr(s.key)+'" data-restart-required="'+(s.restartRequired?'true':'false')+'"><label>'+esc(s.label)+'</label>'+settingInput(s)+'<small>'+esc(s.key)+' - '+esc(s.description)+(s.effectiveValue?' Active: '+esc(s.effectiveValue)+'.':'')+(s.restartRequired?' Restart required.':'')+(s.configured?' Configured.':' Inherited/default.')+'</small><div class="setting-actions"><button type="button" class="secondary" data-reset-setting="'+attr(s.key)+'">Use default</button>'+(s.kind==='secret'?'<button type="button" class="secondary" data-reveal-setting="'+attr(s.key)+'">Reveal/replace</button>':'')+'</div><div class="setting-error"></div></div>').join('')+'</div>';document.querySelectorAll('[data-setting-tab]').forEach(b=>b.onclick=()=>{state.settingsGroup=b.dataset.settingTab;renderSettings()});bindSettingsUx()}
-function settingAttrs(s,original){return ' data-setting="'+attr(s.key)+'" data-original-value="'+attr(original)+'" data-configured="'+(s.configured?'true':'false')+'"'}
-function settingInput(s){const display=s.configured?(s.value||''):(s.effectiveValue||''); if(s.options){const blankLabel=s.effectiveValue?'Use active default ('+s.effectiveValue+')':'Use active default';return '<select'+settingAttrs(s,s.configured?s.value:'')+'><option value="" '+(!s.configured?'selected':'')+'>'+esc(blankLabel)+'</option>'+s.options.map(o=>'<option value="'+attr(o)+'" '+(s.configured&&s.value===o?'selected':'')+'>'+esc(o)+'</option>').join('')+'</select>'} if(s.kind==='boolean'){const blankLabel=s.effectiveValue?'Use active default ('+s.effectiveValue+')':'Use active default';return '<select'+settingAttrs(s,s.configured?s.value:'')+'><option value="" '+(!s.configured?'selected':'')+'>'+esc(blankLabel)+'</option><option value="true" '+(s.configured&&s.value==='true'?'selected':'')+'>true</option><option value="false" '+(s.configured&&s.value==='false'?'selected':'')+'>false</option></select>'} const value=esc(display); if(s.kind==='json')return '<textarea rows="4"'+settingAttrs(s,display)+'>'+value+'</textarea>'; return '<input'+settingAttrs(s,display)+' value="'+value+'" '+(s.kind==='secret'?'type="password"':'')+'>'}
-function bindSettingsUx(){document.querySelectorAll('[data-setting]').forEach(el=>{el.oninput=markSettingDirty;el.onchange=markSettingDirty});document.querySelectorAll('[data-reset-setting]').forEach(b=>b.onclick=()=>{const input=document.querySelector('[data-setting="'+cssEscape(b.dataset.resetSetting)+'"]');if(input){input.value='';markSettingDirty({target:input})}});document.querySelectorAll('[data-reveal-setting]').forEach(b=>b.onclick=()=>{const input=document.querySelector('[data-setting="'+cssEscape(b.dataset.revealSetting)+'"]');if(input){input.type=input.type==='password'?'text':'password';input.focus()}})}
-function markSettingDirty(e){const el=e.target;const box=el.closest('.setting');const dirty=el.value!==(el.dataset.originalValue??'');box.classList.toggle('dirty',dirty);const dirtyInputs=Array.from(document.querySelectorAll('[data-setting]')).filter(x=>x.value!==(x.dataset.originalValue??''));const restart=dirtyInputs.some(x=>x.closest('.setting')?.dataset.restartRequired==='true');document.getElementById('settingsStatus').textContent=dirtyInputs.length?dirtyInputs.length+' unsaved change(s)':'';const banner=document.getElementById('settingsRestartBanner');if(banner)banner.innerHTML=restart?'<div class="restart-banner">Some changed settings require a NordRelay restart.</div>':''}
-document.getElementById('saveSettingsBtn').onclick=()=>safe(async()=>{document.querySelectorAll('.setting-error').forEach(e=>e.textContent='');const patch={};document.querySelectorAll('[data-setting]').forEach(el=>{const original=el.dataset.originalValue??'';if(el.value!==original)patch[el.dataset.setting]=el.value});const r=await api('/api/settings',{method:'PATCH',body:JSON.stringify({settings:patch})});(r.errors||[]).forEach(err=>{const box=document.querySelector('[data-setting-box="'+cssEscape(err.key)+'"] .setting-error');if(box)box.textContent=err.message});document.getElementById('settingsStatus').textContent=(r.errors&&r.errors.length)?'Fix '+r.errors.length+' setting error(s)':(r.changedKeys.length?'Saved '+r.changedKeys.length+' setting(s)'+(r.restartRequired?' - restart required':''):'No changes');toast((r.errors&&r.errors.length)?'Settings need attention':'Settings saved');if(!(r.errors&&r.errors.length))await loadSettings()});
-document.getElementById('restartBtn').onclick=()=>safe(async()=>{if(confirm('Restart NordRelay now?')){await api('/api/runtime/restart',{method:'POST'});toast('Restart requested')}});
-async function loadAccess(){const d=await api('/api/permissions');document.getElementById('accessPanel').innerHTML=['TELEGRAM_ADMIN_USER_IDS','TELEGRAM_ALLOWED_USER_IDS','TELEGRAM_READONLY_USER_IDS','TELEGRAM_ALLOWED_CHAT_IDS','TELEGRAM_ALLOW_ANY_CHAT','TELEGRAM_ROLE_POLICIES_JSON'].map(key=>{const value=key==='TELEGRAM_ADMIN_USER_IDS'?d.telegramAdminUserIds.join(','):key==='TELEGRAM_ALLOWED_USER_IDS'?d.telegramAllowedUserIds.join(','):key==='TELEGRAM_READONLY_USER_IDS'?d.telegramReadOnlyUserIds.join(','):key==='TELEGRAM_ALLOWED_CHAT_IDS'?d.telegramAllowedChatIds.join(','):key==='TELEGRAM_ALLOW_ANY_CHAT'?String(d.telegramAllowAnyChat):JSON.stringify(d.telegramRolePolicies||{},null,2);return '<div class="setting"><label>'+esc(key)+'</label>'+(key.endsWith('_JSON')?'<textarea rows="5" data-access-setting="'+key+'">'+esc(value)+'</textarea>':'<input data-access-setting="'+key+'" value="'+esc(value)+'">')+'<small>Access control setting. Restart required after saving.</small></div>'}).join('');await loadLocks();await loadAudit()}
-document.getElementById('loadAccessBtn').onclick=()=>loadAccess();
-document.getElementById('saveAccessBtn').onclick=()=>safe(async()=>{const settings={};document.querySelectorAll('[data-access-setting]').forEach(el=>settings[el.dataset.accessSetting]=el.value);const r=await api('/api/settings',{method:'PATCH',body:JSON.stringify({settings})});toast((r.errors&&r.errors.length)?'Access settings need attention':'Access settings saved. Restart required.');if(r.errors&&r.errors.length)document.getElementById('accessPanel').insertAdjacentHTML('afterbegin','<div class="restart-banner">'+esc(r.errors.map(e=>e.key+': '+e.message).join(' / '))+'</div>')});
-async function loadLocks(){const d=await api('/api/locks');document.getElementById('locksList').innerHTML=(d.locks||[]).map(l=>'<div class="item"><strong>'+esc(l.contextKey)+'</strong><small>'+esc((l.ownerName||'owner')+' / '+l.ownerId+' / expires '+fmtDate(l.expiresAt))+'</small></div>').join('')||'<div class="item">No active locks.</div>'}
-document.getElementById('lockSessionBtn').onclick=()=>safe(async()=>{await api('/api/locks',{method:'POST',body:JSON.stringify({ownerName:'Web dashboard'})});toast('Web session locked');loadLocks()});
-document.getElementById('unlockSessionBtn').onclick=()=>safe(async()=>{await api('/api/locks',{method:'DELETE'});toast('Web session unlocked');loadLocks()});
-async function loadAudit(){const d=await api('/api/audit?limit='+encodeURIComponent(val('auditLimit')||'50'));document.getElementById('auditList').innerHTML=(d.events||[]).map(e=>'<div class="item"><strong>'+esc(fmtDate(e.timestamp)+' / '+(e.channelId||'-')+' / '+e.status+' / '+e.action)+'</strong><small>'+esc((e.contextKey||'-')+' / '+(e.agentId||'-')+' / '+(e.threadId||'-'))+'</small><small>'+esc(e.description||e.detail||'')+'</small></div>').join('')||'<div class="item">No audit events.</div>'}
-document.getElementById('loadAuditBtn').onclick=()=>loadAudit();
-async function loadLogs(){const target=document.getElementById('logTarget').value;const lines=document.getElementById('logLines').value;const data=await api('/api/logs?target='+target+'&lines='+lines);state.logsPlain=data.plain||'';renderLogs();if(document.getElementById('logFollow').checked)document.getElementById('logs').scrollTop=document.getElementById('logs').scrollHeight}document.getElementById('loadLogsBtn').onclick=loadLogs;
-function logLevelOf(line){if(line.includes(' ERROR '))return'ERROR';if(line.includes(' WARN '))return'WARN';if(line.includes(' INFO '))return'INFO';return''}
-function logTimeOf(line){const m=line.match(/^(\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2})/);return m?new Date(m[1].replace(' ','T')).getTime():0}
-function renderLogs(){const level=val('logLevel');const query=val('logSearch').toLowerCase();const since=val('logSince')?new Date(val('logSince')).getTime():0;const lines=state.logsPlain.split(/\\n/).filter(line=>(level==='all'||line.includes(level))&&(!query||line.toLowerCase().includes(query))&&(!since||!logTimeOf(line)||logTimeOf(line)>=since));document.getElementById('logs').innerHTML=lines.map(line=>'<span class="log-line '+logLevelOf(line)+'">'+esc(line)+'</span>').join('\\n')||'(empty)'}
-document.getElementById('logLevel').onchange=renderLogs;document.getElementById('logSearch').oninput=renderLogs;document.getElementById('logSince').onchange=renderLogs;document.getElementById('logAutoRefresh').onchange=e=>{clearInterval(state.logTimer);state.logTimer=null;if(e.target.checked)state.logTimer=setInterval(loadLogs,5000)};document.getElementById('downloadLogsBtn').onclick=()=>{const blob=new Blob([state.logsPlain||''],{type:'text/plain'});const a=document.createElement('a');a.href=URL.createObjectURL(blob);a.download='nordrelay-log.txt';a.click();URL.revokeObjectURL(a.href)};
-async function loadAdapterHealth(){const d=await api('/api/adapters/health');document.getElementById('adapterHealth').innerHTML=(d.adapters||[]).map(a=>'<div class="item"><strong>'+esc(a.label)+' <span class="adapter-status '+esc(a.status)+'">'+esc(a.status)+'</span></strong><small>'+esc('CLI: '+(a.cli.label||'-')+' / path '+(a.cli.path||'-')+' / version '+(a.cli.version||'-'))+'</small><small>'+esc('Auth: '+(a.auth.supported?(a.auth.authenticated?'authenticated':'not authenticated'):'not managed')+' '+(a.auth.detail||''))+'</small><small>'+esc('Version: '+a.version.installed+' / latest '+(a.version.latest||'-')+' / '+a.version.status)+'</small><div class="row"><button data-auth-status="'+attr(a.id)+'">Auth status</button><button data-auth-login="'+attr(a.id)+'" class="secondary" '+(!a.capabilities.login?'disabled':'')+'>Login</button><button data-auth-logout="'+attr(a.id)+'" class="secondary" '+(!a.capabilities.logout?'disabled':'')+'>Logout</button></div></div>').join('')||'<div class="item">No adapters.</div>';document.querySelectorAll('[data-auth-status]').forEach(b=>b.onclick=()=>safe(async()=>{const r=await api('/api/auth/status?agent='+encodeURIComponent(b.dataset.authStatus));toast(r.agentLabel+': '+r.detail,{duration:6000})}));document.querySelectorAll('[data-auth-login]').forEach(b=>b.onclick=()=>safe(async()=>{const r=await api('/api/auth/login',{method:'POST',body:JSON.stringify({agentId:b.dataset.authLogin})});toast((r.result?.message||r.detail),{duration:8000});loadAdapterHealth()}));document.querySelectorAll('[data-auth-logout]').forEach(b=>b.onclick=()=>safe(async()=>{const r=await api('/api/auth/logout',{method:'POST',body:JSON.stringify({agentId:b.dataset.authLogout})});toast((r.result?.message||r.detail),{duration:8000});loadAdapterHealth()}))}
-document.getElementById('reloadAdaptersBtn').onclick=()=>loadAdapterHealth();
-async function loadVersion(){const d=await api('/api/version');const checks=d.versionChecks||{};document.getElementById('versionPanel').innerHTML=Object.values(checks).map(v=>'<div class="item"><strong>'+esc((v.status==='current'?'OK ':v.status==='outdated'?'WARN ':'')+v.label)+'</strong><small>'+esc('Installed: '+(v.installedLabel||'-'))+'</small><small>'+esc('Latest: '+(v.latestVersion||'-')+' / '+v.status)+'</small><small>'+esc(v.detail||'')+'</small></div>').join('')+card('Runtime',[['Status',d.state?.status],['Version',d.health?.version],['Codex CLI',d.health?.codexCli],['Pi CLI',d.health?.piCli],['Hermes CLI',d.health?.hermesCli],['OpenClaw CLI',d.health?.openClawCli],['Claude Code CLI',d.health?.claudeCodeCli]])}
-document.getElementById('loadVersionBtn').onclick=()=>loadVersion();
-document.getElementById('updateBtn').onclick=()=>safe(async()=>{if(confirm('Start NordRelay self-update now?')){const r=await api('/api/update',{method:'POST'});toast('Update started via '+r.method+'. Log: '+r.logPath,{duration:8000});page('logs');document.getElementById('logTarget').value='update';loadLogs()}});
-async function loadDiagnostics(){const data=await api('/api/diagnostics');document.getElementById('diagnostics').innerHTML=diagnosticsHtml(data)}
-function diagnosticsHtml(d){const h=d.health||{};const s=d.snapshot?.session||{};const vc=d.versionChecks||{};const caps=s.capabilities||{};const agentDiag=d.runtime?.agentDiagnostics;return '<div class="list">'+card('Runtime',[['Status',h.state?.status],['PID',h.state?.pid],['App PID',h.state?.appPid],['State',h.stateFile],['Log',h.logFile],['State backend',d.runtime?.stateBackend],['Uptime',h.uptimeSeconds+'s']])+card('Agent',[['Agent',s.agentLabel],['Thread',s.threadId],['Workspace',s.workspace],['Model',s.model],['Reasoning',s.reasoningEffort],['Fast',caps.fastMode?(s.fastMode?'on':'off'):'n/a']])+card('Agent State',(agentDiag?.lines||[]).map(x=>[x.label,x.value]))+card('CLI Versions',Object.values(vc).map(v=>[v.label,(v.status==='current'?'OK ':'WARN ')+(v.installedLabel||'-')+' latest '+(v.latestVersion||'-')]))+card('External Mirror',d.runtime?.externalMirror?Object.entries(d.runtime.externalMirror):[['Status','idle']])+'</div>'}
-function card(title,rows){return '<div class="item"><strong>'+esc(title)+'</strong>'+rows.map(r=>'<small>'+esc(r[0])+': '+esc(r[1]??'-')+'</small>').join('')+'</div>'}
-function safe(fn,event){if(event&&event.preventDefault)event.preventDefault();Promise.resolve().then(fn).catch(err=>toast(err.message||String(err)))}
-loadBootstrap().then(()=>{connectEvents();loadChatHistory();loadSessions();loadArtifacts();loadSettings();loadLogs();loadDiagnostics();loadActivity()}).catch(err=>toast(err.message));
-`;
-}