@nordbyte/nordrelay 0.5.2 → 0.7.0

package/dist/webui-assets/dashboard.js

@@ -7,6 +7,11 @@
     { path: "/api/snapshot", methods: ["GET"] },
     { path: "/api/tasks", methods: ["GET"] },
     { path: "/api/progress", methods: ["GET"] },
+    { path: "/api/metrics", methods: ["GET"] },
+    { path: "/api/jobs", methods: ["GET"] },
+    { re: /^\/api\/jobs\/[^\/]+\/log$/, methods: ["GET"] },
+    { re: /^\/api\/jobs\/[^\/]+\/action$/, methods: ["POST"] },
+    { path: "/api/active-sessions", methods: ["GET"] },
     { path: "/api/version", methods: ["GET"] },
     { path: "/api/update", methods: ["POST"] },
     { path: "/api/agent-updates", methods: ["GET"] },
@@ -15,6 +20,14 @@
     { re: /^\/api\/agent-update\/[^\/]+\/input$/, methods: ["POST"] },
     { re: /^\/api\/agent-update\/[^\/]+\/cancel$/, methods: ["POST"] },
     { path: "/api/adapters/health", methods: ["GET"] },
+    { path: "/api/peers", methods: ["GET", "POST"] },
+    { path: "/api/peers/invite", methods: ["POST"] },
+    { path: "/api/peers/pair", methods: ["POST"] },
+    { path: "/api/peers/global-sessions", methods: ["GET"] },
+    { re: /^\/api\/peers\/[^\/]+\/health$/, methods: ["GET"] },
+    { re: /^\/api\/peers\/[^\/]+$/, methods: ["PATCH", "DELETE"] },
+    { re: /^\/api\/peers\/[^\/]+\/proxy$/, methods: ["POST"] },
+    { re: /^\/api\/peers\/[^\/]+\/events$/, methods: ["GET"] },
     { path: "/api/permissions", methods: ["GET"] },
     { path: "/api/users", methods: ["GET", "POST"] },
     { re: /^\/api\/users\/[^\/]+$/, methods: ["PATCH"] },
@@ -23,10 +36,14 @@
     { re: /^\/api\/users\/[^\/]+\/sessions\/[^\/]+$/, methods: ["DELETE"] },
     { re: /^\/api\/users\/[^\/]+\/telegram$/, methods: ["POST"] },
     { re: /^\/api\/users\/[^\/]+\/telegram\/[^\/]+$/, methods: ["DELETE"] },
+    { re: /^\/api\/users\/[^\/]+\/discord$/, methods: ["POST"] },
+    { re: /^\/api\/users\/[^\/]+\/discord\/[^\/]+$/, methods: ["DELETE"] },
     { path: "/api/groups", methods: ["GET", "POST"] },
     { re: /^\/api\/groups\/[^\/]+$/, methods: ["PATCH"] },
     { path: "/api/telegram-chats", methods: ["GET", "POST"] },
     { re: /^\/api\/telegram-chats\/[^\/]+$/, methods: ["PATCH"] },
+    { path: "/api/discord-channels", methods: ["GET", "POST"] },
+    { re: /^\/api\/discord-channels\/[^\/]+$/, methods: ["PATCH"] },
     { path: "/api/audit", methods: ["GET"] },
     { path: "/api/locks", methods: ["GET", "POST", "DELETE"] },
     { path: "/api/auth/status", methods: ["GET"] },
@@ -75,6 +92,32 @@
     const method = normalizeMethod(options.method, options.body);
     const url = apiUrl(path, options.query);
     assertApiRoute(url.pathname, method);
+    if (!options.local && shouldProxyApi(url.pathname)) {
+      const peerId = selectedPeerTarget();
+      const proxyBody = JSON.stringify({
+        method,
+        path: url.pathname,
+        query: queryObject(url),
+        body: bodyObject(options.body),
+        contextKey: "web:dashboard"
+      });
+      const res2 = await fetch("/api/peers/" + encodeURIComponent(peerId) + "/proxy", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: proxyBody
+      });
+      if (res2.status === 401) {
+        location.reload();
+        return (
+          /** @type {never} */
+          void 0
+        );
+      }
+      const text2 = await res2.text();
+      const data2 = text2 ? JSON.parse(text2) : {};
+      if (!res2.ok) throw new Error(data2.error || res2.statusText);
+      return data2;
+    }
     const body = normalizeBody(options.body);
     const headers = {
       ...body !== void 0 && shouldSendJsonHeader(options.body) ? { "content-type": "application/json" } : {},
@@ -93,6 +136,46 @@
     if (!res.ok) throw new Error(data.error || res.statusText);
     return data;
   }
+  function shouldProxyApi(path) {
+    const peerId = selectedPeerTarget();
+    if (!peerId || peerId === "local") return false;
+    if (!path.startsWith("/api/")) return false;
+    return !(path === "/api/auth/me" || path === "/api/dashboard/logout" || path === "/api/peers" || path === "/api/peers/invite" || path === "/api/peers/pair" || /^\/api\/peers\/[^/]+(?:\/events|\/proxy)?$/.test(path) || isLocalAdminApi(path));
+  }
+  function isLocalAdminApi(path) {
+    return path === "/api/permissions" || path === "/api/settings" || path === "/api/audit" || path === "/api/locks" || path === "/api/users" || path === "/api/groups" || path === "/api/telegram-chats" || path === "/api/discord-channels" || /^\/api\/users\//.test(path) || /^\/api\/groups\//.test(path) || /^\/api\/telegram-chats\//.test(path) || /^\/api\/discord-channels\//.test(path);
+  }
+  function selectedPeerTarget() {
+    const runtimeState = (
+      /** @type {{ NORDRELAY_WEBUI_RUNTIME_STATE?: { selectedPeer?: string } }} */
+      globalThis.NORDRELAY_WEBUI_RUNTIME_STATE
+    );
+    return runtimeState?.selectedPeer || "local";
+  }
+  function queryObject(url) {
+    const result = {};
+    for (const [key, value] of url.searchParams.entries()) {
+      if (result[key] === void 0) result[key] = value;
+      else if (Array.isArray(result[key])) result[key].push(value);
+      else result[key] = [result[key], value];
+    }
+    return result;
+  }
+  function bodyObject(body) {
+    if (body === void 0 || body === null) return {};
+    if (typeof body === "string") {
+      try {
+        return body ? JSON.parse(body) : {};
+      } catch {
+        return { value: body };
+      }
+    }
+    if (isNativeBody(body)) return {};
+    return (
+      /** @type {Record<string, unknown>} */
+      body
+    );
+  }
   function apiUrl(path, query) {
     const url = new URL(path, location.origin);
     if (query) {
@@ -139,7 +222,8 @@
       throw new Error("Unsupported WebUI API method: " + method + " " + path);
     }
   }
-  const state = { snapshot: null, controls: null, newSessionControls: null, enabledAgents: [], auth: null, permissions: [], settings: [], currentPage: "overview", settingsGroup: null, logsPlain: "", logTimer: null, toastTimer: null, cliStatusActive: false, selectedArtifactTurns: /* @__PURE__ */ new Set(), mediaRecorder: null, recordedChunks: [], events: null, reconnectTimer: null, notifications: false, toolTooltipTimer: null, toolTooltipTarget: null, agentUpdateJobs: [], sessionsRequestId: 0 };
+  const state = { snapshot: null, controls: null, newSessionControls: null, enabledAgents: [], auth: null, permissions: [], settings: [], currentPage: "overview", settingsGroup: null, accessTab: "users", logsPlain: "", logTimer: null, toastTimer: null, cliStatusActive: false, selectedArtifactTurns: /* @__PURE__ */ new Set(), mediaRecorder: null, recordedChunks: [], events: null, reconnectTimer: null, notifications: false, toolTooltipTimer: null, toolTooltipTarget: null, agentUpdateJobs: [], sessionsRequestId: 0, activeSessions: null, peers: null, selectedPeer: localStorage.getItem("nordrelayPeerTarget") || "local" };
+  globalThis.NORDRELAY_WEBUI_RUNTIME_STATE = state;
   function toast(msg, options = {}) {
     const el = document.getElementById("toast");
     el.textContent = msg;
@@ -239,14 +323,15 @@
       ["#restartBtn", "system.restart"],
       ["#updateBtn", "updates.run"],
       ["#clearLogsBtn", "logs.clear"],
-      ["#createUserBtn,#createGroupBtn,#createChatBtn", "users.write"],
+      ["#createUserBtn,#createGroupBtn,#createChatBtn,#createDiscordChannelBtn", "users.write"],
+      ["#createPeerInviteBtn,#addPeerBtn,[data-peer-edit],[data-peer-toggle],[data-peer-revoke]", "peers.write"],
       ["#lockSessionBtn,#unlockSessionBtn", "sessions.write"],
       ["[data-switch]", "sessions.write"],
       ["[data-queue],[data-q]", "queue.write"],
       ["[data-del-art],#deleteSelectedArtifactsBtn", "files.write"],
       ["[data-auth-login],[data-auth-logout]", "auth.manage"],
       ["[data-update-agent],[data-update-send],[data-update-cancel],[data-update-delete-log]", "updates.run"],
-      ["[data-user-edit],[data-user-toggle],[data-user-code],[data-user-link],[data-user-password],[data-user-revoke],[data-telegram-unlink],[data-group-edit],[data-chat-edit],[data-chat-toggle]", "users.write"]
+      ["[data-user-edit],[data-user-toggle],[data-user-code],[data-user-link],[data-user-discord-code],[data-user-discord-link],[data-user-password],[data-user-revoke],[data-telegram-unlink],[data-discord-unlink],[data-group-edit],[data-chat-edit],[data-chat-toggle],[data-discord-channel-edit],[data-discord-channel-toggle]", "users.write"]
     ];
     disableMap.forEach(([selector, permission]) => document.querySelectorAll(selector).forEach((el) => {
       el.disabled = !can(permission);
@@ -288,6 +373,7 @@
   }
   async function reloadCurrentPage(options = {}) {
     const name = state.currentPage;
+    if (name === "overview") await loadActiveSessions();
     if (name === "chat") {
       await loadChatHistory();
       scrollChatToBottom();
@@ -299,7 +385,9 @@
     if (name === "artifacts") await loadArtifacts();
     if (name === "activity") await loadActivity();
     if (name === "tasks") await loadTasks();
+    if (name === "metrics") await loadMetrics();
     if (name === "adapters") await loadAdapterHealth();
+    if (name === "peers") await loadPeers();
     if (name === "access") await loadAccess();
     if (name === "version") await loadVersion();
   }
@@ -343,20 +431,23 @@
   }
   const sessionsPager = createPaginator("sessionsPager", () => loadSessions(false), 50);
   async function loadBootstrap() {
-    const data = await api("/api/bootstrap");
-    state.auth = data.auth || null;
-    state.permissions = data.auth?.permissions || [];
+    const local = await api("/api/bootstrap", { local: true });
+    state.auth = local.auth || null;
+    state.permissions = local.auth?.permissions || [];
+    await loadPeerSelector();
+    const data = state.selectedPeer && state.selectedPeer !== "local" ? await api("/api/bootstrap") : local;
     state.snapshot = data.status.snapshot;
     state.controls = data.controls;
     state.enabledAgents = data.enabledAgents || [];
     applyPermissions();
     renderSnapshot(state.snapshot);
+    safe(loadActiveSessions);
     renderSessionControls();
     populateNewSessionForm(data.enabledAgents);
     renderAdapters(data.channels, data.agentAdapters);
     document.getElementById("footerVersion").textContent = "NordRelay " + (data.status.health?.version || "");
     document.getElementById("footerHealth").textContent = "Health: " + (data.status.health?.state?.status || "unknown");
-    document.getElementById("footerUser").textContent = "User: " + (data.auth?.user?.email || "-");
+    document.getElementById("footerUser").textContent = "User: " + (local.auth?.user?.email || "-") + (state.selectedPeer && state.selectedPeer !== "local" ? " / target peer" : "");
     const agentSelect = document.getElementById("agentSelect");
     agentSelect.innerHTML = data.enabledAgents.map((a) => '<option value="' + a + '">' + a + "</option>").join("");
     agentSelect.value = state.snapshot.session.agentId;
@@ -373,9 +464,37 @@
     });
     applyPermissions();
   }
+  async function loadPeerSelector() {
+    const peerSelect = document.getElementById("peerSelect");
+    if (!peerSelect) return;
+    if (!can("peers.read")) {
+      peerSelect.innerHTML = '<option value="local">Local</option>';
+      peerSelect.value = "local";
+      state.selectedPeer = "local";
+      return;
+    }
+    try {
+      const peers = await api("/api/peers", { local: true });
+      state.peers = peers;
+      const available = (peers.peers || []).filter((p) => p.enabled && p.url);
+      peerSelect.innerHTML = '<option value="local">Local node</option>' + available.map((p) => '<option value="' + attr(p.id) + '">' + esc(p.name) + "</option>").join("");
+      if (state.selectedPeer !== "local" && !available.some((p) => p.id === state.selectedPeer)) state.selectedPeer = "local";
+      peerSelect.value = state.selectedPeer;
+      peerSelect.onchange = () => safe(async () => {
+        state.selectedPeer = peerSelect.value || "local";
+        localStorage.setItem("nordrelayPeerTarget", state.selectedPeer);
+        connectEvents();
+        toast(state.selectedPeer === "local" ? "Target: local" : "Target: " + peerSelect.options[peerSelect.selectedIndex].text);
+        await loadBootstrap();
+        await reloadCurrentPage();
+      });
+    } catch {
+      peerSelect.innerHTML = '<option value="local">Local node</option>';
+      peerSelect.value = "local";
+    }
+  }
   function renderSnapshot(s) {
     document.getElementById("sessionLine").textContent = (s.session.agentLabel || "Agent") + " / " + (s.session.model || "default") + " / " + (s.session.threadId || "not started");
-    document.getElementById("sessionText").textContent = s.sessionText || "";
     document.getElementById("metrics").innerHTML = [
       ["Status", s.processing ? "working" : "idle"],
       ["Agent", s.session.agentLabel],
@@ -387,6 +506,68 @@
     ].map(([k, v]) => '<div class="metric"><div class="label">' + esc(k) + '</div><div class="value">' + esc(v) + "</div></div>").join("");
     renderQueue(s.queue, s.queuePaused);
   }
+  async function loadActiveSessions() {
+    const box = document.getElementById("activeSessions");
+    if (!box) return;
+    if (!can("sessions.read")) {
+      box.innerHTML = '<div class="item">Permission required: sessions.read</div>';
+      return;
+    }
+    const data = await api("/api/active-sessions");
+    renderActiveSessions(data.sessions || []);
+  }
+  function renderActiveSessions(items) {
+    state.activeSessions = { sessions: items || [], updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    const box = document.getElementById("activeSessions");
+    if (!box) return;
+    box.innerHTML = (items || []).map(activeSessionCard).join("") || '<div class="item">No active sessions.</div>';
+    document.querySelectorAll("[data-active-copy]").forEach((b) => b.onclick = () => copyText(b.dataset.activeCopy || "", "Thread ID copied"));
+    document.querySelectorAll("[data-active-switch]").forEach((b) => b.onclick = () => safe(async () => {
+      if (!can("sessions.write")) {
+        toast("Permission required: sessions.write");
+        return;
+      }
+      const agentId = b.dataset.activeAgent;
+      const threadId = b.dataset.activeSwitch;
+      if (agentId && state.snapshot?.session?.agentId !== agentId) {
+        await api("/api/agent", { method: "POST", body: { agentId } });
+      }
+      if (threadId) {
+        await api("/api/sessions/switch", { method: "POST", body: { threadId } });
+      }
+      toast("Session switched");
+      await loadBootstrap();
+      page("chat");
+    }));
+    document.querySelectorAll("[data-active-detail]").forEach((b) => b.onclick = () => safe(async () => {
+      const agentId = b.dataset.activeAgent;
+      const threadId = b.dataset.activeDetail;
+      if (agentId && state.snapshot?.session?.agentId !== agentId) {
+        await api("/api/agent", { method: "POST", body: { agentId } });
+        await loadBootstrap();
+      }
+      if (threadId) await loadSessionDetail(threadId);
+    }));
+    applyPermissions();
+  }
+  function activeSessionCard(s) {
+    const thread = s.threadId || "not started";
+    const prompt = s.prompt ? "<small>" + esc(short(s.prompt, 250)) + "</small>" : "";
+    const tool2 = s.currentTool || s.lastTool || "-";
+    const queue = s.queueLength ? " \xB7 " + s.queueLength + " queued" + (s.queuePaused ? " paused" : "") : "";
+    const sourceLabel = activeSourceLabel(s.source);
+    const mirrors = (s.mirrorChannels || []).map((m) => activeSourceLabel(m.source) + " " + m.mode + (m.queueLength ? " \xB7 " + m.queueLength + " queued" + (m.queuePaused ? " paused" : "") : "")).join(", ");
+    const meta = ["Source " + sourceLabel, s.workspace, fmtDuration(s.durationMs), tool2 && tool2 !== "-" ? "tool " + tool2 : ""].filter(Boolean).join(" | ");
+    const mirrorLine = mirrors ? "<small>Mirroring: " + esc(mirrors) + "</small>" : s.source === "cli" ? "<small>Mirroring: none</small>" : "";
+    return '<div class="item active-session-item"><strong>' + esc(s.agentLabel || s.agentId || "Agent") + ' <span class="adapter-status enabled">' + esc(s.status) + '</span></strong><small><button type="button" class="copy-id" data-active-copy="' + attr(thread) + '" title="Copy thread ID">' + esc(short(thread, 64)) + "</button>" + esc(queue) + "</small><small>" + esc(meta) + "</small>" + mirrorLine + prompt + '<div class="row"><button data-active-switch="' + attr(thread) + '" data-active-agent="' + attr(s.agentId || "") + '" ' + (!s.threadId ? "disabled " : "") + disabledAttr("sessions.write") + '>Switch</button><button class="secondary" data-active-detail="' + attr(thread) + '" data-active-agent="' + attr(s.agentId || "") + '" ' + (!s.threadId ? "disabled " : "") + ">Details</button></div></div>";
+  }
+  function activeSourceLabel(source) {
+    if (source === "cli") return "CLI";
+    if (source === "telegram") return "Telegram";
+    if (source === "discord") return "Discord";
+    if (source === "web") return "WebUI";
+    return source || "-";
+  }
   function renderSessionControls() {
     const c = state.controls || {};
     const s = state.snapshot?.session || {};
@@ -428,7 +609,10 @@
     });
   }
   function renderAdapters(channels, agents) {
-    const channelCards = (channels || []).map((c) => adapterCard(c.label, c.status, "", c.capabilities.join(", ")));
+    const channelCards = (channels || []).map((c) => {
+      const status = c.status === "available" ? c.enabled === false ? "disabled" : "enabled" : c.status || "planned";
+      return adapterCard(c.label, status, "", c.capabilities.join(", ") + (c.notes ? " - " + c.notes : ""));
+    });
     const agentCards = (agents || []).map((a) => {
       const available = a.status === "available";
       const status = available ? state.enabledAgents.includes(a.id) ? "enabled" : "disabled" : a.status || "planned";
@@ -522,7 +706,8 @@
   let currentAgentMessage = null;
   function connectEvents() {
     if (state.events) state.events.close();
-    const events = new EventSource("/api/events");
+    const eventsUrl = state.selectedPeer && state.selectedPeer !== "local" ? "/api/peers/" + encodeURIComponent(state.selectedPeer) + "/events?contextKey=" + encodeURIComponent("web:dashboard") : "/api/events";
+    const events = new EventSource(eventsUrl);
     state.events = events;
     setConnection("Connecting", "warn");
     events.onopen = () => {
@@ -540,6 +725,11 @@
     });
     events.addEventListener("chat_history", (e) => renderChatMessages(JSON.parse(e.data).messages || []));
     events.addEventListener("activity_update", (e) => renderActivity(JSON.parse(e.data).events || []));
+    events.addEventListener("active_sessions_update", (e) => {
+      const d = JSON.parse(e.data);
+      state.activeSessions = d.active || null;
+      if (state.currentPage === "overview") renderActiveSessions(state.activeSessions?.sessions || []);
+    });
     events.addEventListener("session_update", (e) => {
       loadBootstrap();
       loadChatHistory();
@@ -1037,30 +1227,6 @@
     const r = await api("/api/queue", { method: "POST", body: JSON.stringify({ action: b.dataset.queue }) });
     renderQueue(r.queue, r.paused);
   }));
-  async function loadTasks() {
-    setLoading("tasksList", "Loading tasks...");
-    const d = await api("/api/tasks");
-    renderTasks(d);
-  }
-  function taskCard(t, title) {
-    if (!t) return '<div class="item"><strong>' + esc(title) + "</strong><small>Idle</small></div>";
-    const tools = (t.tools || []).map((x) => x.name + " x" + x.count).join(", ") || "-";
-    return '<div class="item"><strong>' + esc(title + " \xB7 " + t.status) + "</strong><small>" + esc((t.agentLabel || t.agentId || t.source) + " / " + (t.threadId || "-")) + "</small><small>" + esc("Elapsed " + fmtDuration(t.durationMs) + " / current " + (t.currentTool || "-") + " / last " + (t.lastTool || "-")) + "</small><small>" + esc("Tools: " + tools + " / output chars " + (t.outputChars || 0)) + "</small><small>" + esc(t.prompt || t.detail || "") + "</small></div>";
-  }
-  function renderTasks(d) {
-    document.getElementById("tasksList").innerHTML = '<div class="task-grid">' + taskCard(d.current, "Current web turn") + taskCard(d.external, "External CLI turn") + '</div><h2 class="task-section-title">Queue</h2><div class="list">' + ((d.queue || []).map((q) => '<div class="item"><strong>' + esc(q.id + " \xB7 " + q.description) + "</strong><small>" + esc(fmtDate(q.createdAt) + " / attempts " + q.attempts) + '</small><div class="row"><button data-q="run" data-id="' + attr(q.id) + '"' + disabledAttr("queue.write") + '>Run</button><button data-q="cancel" data-id="' + attr(q.id) + '" class="danger"' + disabledAttr("queue.write") + ">Cancel</button></div></div>").join("") || '<div class="item">Queue is empty.</div>') + '</div><h2 class="task-section-title">Recent turns</h2><div class="list">' + ((d.recent || []).map((e) => '<div class="item"><strong>' + esc(e.status + " / " + e.source + " / " + e.type) + "</strong><small>" + esc(fmtDate(e.timestamp) + " / " + (e.threadId || "-")) + "</small><small>" + esc(short(e.prompt || e.detail || "", 300)) + "</small></div>").join("") || '<div class="item">No recent tasks.</div>') + "</div>";
-    document.querySelectorAll("#tasksList [data-q]").forEach((b) => b.onclick = () => safe(async () => {
-      if (!can("queue.write")) {
-        toast("Permission required: queue.write");
-        return;
-      }
-      const r = await api("/api/queue", { method: "POST", body: JSON.stringify({ action: b.dataset.q, id: b.dataset.id }) });
-      renderQueue(r.queue, r.paused);
-      loadTasks();
-    }));
-    applyPermissions();
-  }
-  document.getElementById("reloadTasksBtn").onclick = () => loadTasks();
   async function loadArtifacts() {
     setLoading("artifactList", "Loading artifacts...");
     document.getElementById("artifactPreview").innerHTML = "";
@@ -1158,9 +1324,230 @@
       throw err;
     }
   }
+  function isRemotePeerTarget() {
+    return Boolean(state.selectedPeer && state.selectedPeer !== "local");
+  }
+  function artifactFileHref(turnId, path) {
+    return isRemotePeerTarget() ? "#" : "/api/artifacts/file?turnId=" + encodeURIComponent(turnId) + "&path=" + encodeURIComponent(path);
+  }
+  function artifactZipHref(turnId) {
+    return isRemotePeerTarget() ? "#" : "/api/artifacts/zip?turnId=" + encodeURIComponent(turnId);
+  }
+  async function downloadArtifactFile(turnId, path) {
+    const file = await api("/api/artifacts/file", { query: { turnId, path } });
+    downloadBase64(file.name || path, file.dataBase64 || "", file.mimeType || "application/octet-stream");
+  }
+  async function downloadArtifactZip(turnId) {
+    const file = await api("/api/artifacts/zip", { query: { turnId } });
+    downloadBase64(file.name || "nordrelay-artifacts-" + turnId + ".zip", file.dataBase64 || "", file.mimeType || "application/zip");
+  }
+  async function artifactDataUrl(turnId, path) {
+    const file = await api("/api/artifacts/file", { query: { turnId, path } });
+    return "data:" + (file.mimeType || "application/octet-stream") + ";base64," + (file.dataBase64 || "");
+  }
+  function renderArtifacts() {
+    const query = (document.getElementById("artifactSearch").value || "").toLowerCase();
+    const kind = document.getElementById("artifactKind").value;
+    const reports = state.artifactReports || [];
+    document.getElementById("artifactList").innerHTML = reports.map((r) => {
+      const files = (r.artifacts || []).filter((a) => artifactMatches(a, kind, query));
+      if (files.length === 0) return "";
+      const gallery = files.map((a) => {
+        const href = artifactFileHref(r.turnId, a.relativePath);
+        const isImage = /\.(png|jpe?g|gif|webp|svg)$/i.test(a.name);
+        const img = isImage && !isRemotePeerTarget() ? '<img src="' + href + '">' : "<pre>" + esc(a.name.split(".").pop() || "file") + "</pre>";
+        return '<div class="artifact-card"><label><input type="checkbox" data-artifact-select="' + attr(r.turnId) + '" ' + (state.selectedArtifactTurns.has(r.turnId) ? "checked" : "") + "> " + esc(short(a.name, 32)) + "</label>" + img + "<small>" + esc(fmtBytes(a.sizeBytes)) + '</small><div class="row"><a href="' + href + '" data-open-artifact="' + attr(r.turnId) + '" data-open-path="' + attr(a.relativePath) + '">Open</a><button class="secondary" data-preview-turn="' + attr(r.turnId) + '" data-preview-path="' + attr(a.relativePath) + '">Preview</button></div></div>';
+      }).join("");
+      return '<div class="item"><strong>' + esc(r.turnId) + " - " + files.length + "/" + r.fileCount + " files - " + fmtBytes(r.totalSizeBytes) + "</strong><small>" + fmtDate(r.updatedAt) + " / " + esc(r.source || "turn") + '</small><div class="row"><a href="' + artifactZipHref(r.turnId) + '" data-zip-artifact="' + attr(r.turnId) + '">Download ZIP</a><button data-del-art="' + esc(r.turnId) + '" class="danger"' + disabledAttr("files.write") + '>Delete</button></div><div class="gallery">' + gallery + "</div></div>";
+    }).join("") || '<div class="item">No artifacts.</div>';
+    document.querySelectorAll("[data-artifact-select]").forEach((c) => c.onchange = () => {
+      if (c.checked) state.selectedArtifactTurns.add(c.dataset.artifactSelect);
+      else state.selectedArtifactTurns.delete(c.dataset.artifactSelect);
+    });
+    document.querySelectorAll("[data-open-artifact]").forEach((a) => a.onclick = (e) => {
+      if (!isRemotePeerTarget()) return;
+      e.preventDefault();
+      safe(() => downloadArtifactFile(a.dataset.openArtifact, a.dataset.openPath));
+    });
+    document.querySelectorAll("[data-zip-artifact]").forEach((a) => a.onclick = (e) => {
+      if (!isRemotePeerTarget()) return;
+      e.preventDefault();
+      safe(() => downloadArtifactZip(a.dataset.zipArtifact));
+    });
+    document.querySelectorAll("[data-del-art]").forEach((b) => b.onclick = () => safe(async () => {
+      if (!can("files.write")) {
+        toast("Permission required: files.write");
+        return;
+      }
+      if (confirm("Delete artifact turn " + b.dataset.delArt + "?")) {
+        await api("/api/artifacts", { method: "DELETE", query: { turnId: b.dataset.delArt } });
+        state.selectedArtifactTurns.delete(b.dataset.delArt);
+        loadArtifacts();
+      }
+    }));
+    document.querySelectorAll("[data-preview-turn]").forEach((b) => b.onclick = () => safe(() => previewArtifact(b.dataset.previewTurn, b.dataset.previewPath)));
+    applyPermissions();
+  }
+  document.getElementById("zipSelectedArtifactsBtn").onclick = () => {
+    const turnIds = [...state.selectedArtifactTurns];
+    if (turnIds.length === 0) {
+      toast("No artifact turns selected");
+      return;
+    }
+    turnIds.forEach((turnId) => isRemotePeerTarget() ? safe(() => downloadArtifactZip(turnId)) : window.open("/api/artifacts/zip?turnId=" + encodeURIComponent(turnId), "_blank"));
+  };
+  async function previewArtifact(turnId, path) {
+    const target = document.getElementById("artifactPreview");
+    target.innerHTML = '<div class="panel">' + loadingHtml("Loading preview...") + "</div>";
+    target.scrollIntoView({ block: "start", behavior: "smooth" });
+    try {
+      const data = await api("/api/artifacts/preview", { query: { turnId, path } });
+      if (data.kind === "image") {
+        const src = isRemotePeerTarget() ? await artifactDataUrl(turnId, path) : "/api/artifacts/file?turnId=" + encodeURIComponent(turnId) + "&path=" + encodeURIComponent(path);
+        target.innerHTML = '<div class="panel"><h2>' + esc(data.name) + '</h2><img src="' + src + '"></div>';
+        return;
+      }
+      if (data.kind === "text") {
+        target.innerHTML = '<div class="panel"><h2>' + esc(data.name) + " " + fmtBytes(data.sizeBytes) + "</h2><pre>" + highlightCode(data.text || "") + "</pre>" + (data.truncated ? "<small>Preview truncated.</small>" : "") + "</div>";
+        return;
+      }
+      target.innerHTML = '<div class="panel"><h2>' + esc(data.name) + "</h2><p>" + esc(data.detail || "Preview unavailable") + "</p></div>";
+    } catch (err) {
+      target.innerHTML = '<div class="panel"><h2>Preview failed</h2><p>' + esc(err.message || String(err)) + "</p></div>";
+      throw err;
+    }
+  }
+  async function loadTasks() {
+    setLoading("tasksList", "Loading tasks...");
+    const [d, jobs] = await Promise.all([api("/api/tasks"), api("/api/jobs")]);
+    renderTasks(d, jobs);
+  }
+  function taskCard(t, title) {
+    if (!t) return '<div class="item"><strong>' + esc(title) + "</strong><small>Idle</small></div>";
+    const tools = (t.tools || []).map((x) => x.name + " x" + x.count).join(", ") || "-";
+    return '<div class="item"><strong>' + esc(title + " \xB7 " + t.status) + "</strong><small>" + esc((t.agentLabel || t.agentId || t.source) + " / " + (t.threadId || "-")) + "</small><small>" + esc("Elapsed " + fmtDuration(t.durationMs) + " / current " + (t.currentTool || "-") + " / last " + (t.lastTool || "-")) + "</small><small>" + esc("Tools: " + tools + " / output chars " + (t.outputChars || 0)) + "</small><small>" + esc(t.prompt || t.detail || "") + "</small></div>";
+  }
+  function renderTasks(d, jobs) {
+    document.getElementById("tasksList").innerHTML = '<div class="task-grid">' + taskCard(d.current, "Current web turn") + taskCard(d.external, "External CLI turn") + '</div><h2 class="task-section-title">Unified jobs</h2><div class="list">' + renderUnifiedJobs(jobs?.jobs || []) + '</div><h2 class="task-section-title">Queue</h2><div class="list">' + ((d.queue || []).map((q) => '<div class="item"><strong>' + esc(q.id + " \xB7 " + q.description) + "</strong><small>" + esc(fmtDate(q.createdAt) + " / attempts " + q.attempts) + '</small><div class="row"><button data-q="run" data-id="' + attr(q.id) + '"' + disabledAttr("queue.write") + '>Run</button><button data-q="cancel" data-id="' + attr(q.id) + '" class="danger"' + disabledAttr("queue.write") + ">Cancel</button></div></div>").join("") || '<div class="item">Queue is empty.</div>') + '</div><h2 class="task-section-title">Recent turns</h2><div class="list">' + ((d.recent || []).map((e) => '<div class="item"><strong>' + esc(e.status + " / " + e.source + " / " + e.type) + "</strong><small>" + esc(fmtDate(e.timestamp) + " / " + (e.threadId || "-")) + "</small><small>" + esc(short(e.prompt || e.detail || "", 300)) + "</small></div>").join("") || '<div class="item">No recent tasks.</div>') + "</div>";
+    document.querySelectorAll("#tasksList [data-q]").forEach((b) => b.onclick = () => safe(async () => {
+      if (!can("queue.write")) {
+        toast("Permission required: queue.write");
+        return;
+      }
+      const r = await api("/api/queue", { method: "POST", body: JSON.stringify({ action: b.dataset.q, id: b.dataset.id }) });
+      renderQueue(r.queue, r.paused);
+      loadTasks();
+    }));
+    bindUnifiedJobButtons();
+    applyPermissions();
+  }
+  function renderUnifiedJobs(jobs) {
+    return jobs.map((job) => {
+      const retryPermission = jobActionPermission(job, "retry");
+      const cancelPermission = jobActionPermission(job, "cancel");
+      return '<div class="item"><strong>' + esc(job.title) + ' <span class="adapter-status ' + esc(jobStatusClass(job.status)) + '">' + esc(job.status) + "</span></strong><small>" + esc([job.kind, job.source, job.agentLabel || job.agentId, fmtDate(job.startedAt)].filter(Boolean).join(" / ")) + "</small>" + (job.owner ? "<small>" + esc("Owner: " + (job.owner.label || job.owner.username || job.owner.id || "-")) + "</small>" : "") + (job.threadId ? "<small>" + esc("Thread: " + job.threadId) + "</small>" : "") + (job.summary ? "<small>" + esc(short(job.summary, 300)) + "</small>" : "") + (job.logTail ? '<pre class="update-log">' + esc(short(job.logTail, 1200)) + "</pre>" : "") + '<div class="row">' + (job.canReadLog ? '<button class="secondary" data-job-log="' + attr(job.id) + '">Log</button>' : "") + (job.canRetry ? '<button class="secondary" data-job-action="retry" data-job-permission="' + attr(retryPermission) + '" data-job-id="' + attr(job.id) + '"' + disabledAttr(retryPermission) + ">Retry</button>" : "") + (job.canCancel ? '<button class="danger" data-job-action="cancel" data-job-permission="' + attr(cancelPermission) + '" data-job-id="' + attr(job.id) + '"' + disabledAttr(cancelPermission) + ">Cancel</button>" : "") + "</div></div>";
+    }).join("") || '<div class="item">No jobs.</div>';
+  }
+  function jobActionPermission(job, action) {
+    if (job.id === "web:current" && action === "cancel") return "prompt.abort";
+    if (String(job.id || "").startsWith("queue:")) return "queue.write";
+    if (String(job.id || "").startsWith("support-bundle:")) return "diagnostics.read";
+    return "updates.run";
+  }
+  function bindUnifiedJobButtons() {
+    document.querySelectorAll("[data-job-log]").forEach((b) => b.onclick = () => safe(async () => {
+      const r = await api("/api/jobs/" + encodeURIComponent(b.dataset.jobLog) + "/log");
+      toast((r.plain || "No log").slice(0, 3500), { duration: 12e3 });
+    }));
+    document.querySelectorAll("[data-job-action]").forEach((b) => b.onclick = () => safe(async () => {
+      const permission = b.dataset.jobPermission || "updates.run";
+      if (!can(permission)) {
+        toast("Permission required: " + permission);
+        return;
+      }
+      const action = b.dataset.jobAction;
+      if (confirm((action === "cancel" ? "Cancel" : "Retry") + " job " + b.dataset.jobId + "?")) {
+        await api("/api/jobs/" + encodeURIComponent(b.dataset.jobId) + "/action", { method: "POST", body: JSON.stringify({ action }) });
+        toast("Job " + action + " requested");
+        loadTasks();
+      }
+    }));
+  }
+  document.getElementById("reloadTasksBtn").onclick = () => loadTasks();
+  async function loadMetrics() {
+    setLoading("metricsPanel", "Loading metrics...");
+    const d = await api("/api/metrics");
+    renderMetrics(d);
+  }
+  function metricStatusRows(d) {
+    return [
+      ["Generated", fmtDate(d.generatedAt)],
+      ["Queue", String(d.queue?.length ?? 0) + (d.queue?.paused ? " paused" : " running")],
+      ["Active turns", String(d.turns?.active ?? 0)],
+      ["Completed turns", String(d.turns?.completed ?? 0)],
+      ["Failed turns", String(d.turns?.failed ?? 0)],
+      ["Aborted turns", String(d.turns?.aborted ?? 0)],
+      ["Average turn duration", d.turns?.averageDurationMs === null ? "-" : fmtDuration(d.turns?.averageDurationMs)]
+    ];
+  }
+  function metricJobRows(d) {
+    const jobs = d.jobs || {};
+    return [
+      ["Total", jobs.total],
+      ["Queued", jobs.queued],
+      ["Running", jobs.running],
+      ["Completed", jobs.completed],
+      ["Failed", jobs.failed],
+      ["Aborted", jobs.aborted]
+    ];
+  }
+  function metricProcessRows(d) {
+    const p = d.process || {};
+    const memory = p.memory || {};
+    const cpu = p.cpu || {};
+    const loop = p.eventLoop || {};
+    return [
+      ["PID", p.pid],
+      ["Node", p.nodeVersion],
+      ["Platform", [p.platform, p.arch].filter(Boolean).join(" ")],
+      ["Uptime", fmtDuration(p.uptimeMs)],
+      ["Started", fmtDate(p.startedAt)],
+      ["RSS", fmtBytes(memory.rssBytes || 0)],
+      ["Heap used", fmtBytes(memory.heapUsedBytes || 0)],
+      ["Heap total", fmtBytes(memory.heapTotalBytes || 0)],
+      ["CPU total", fmtDuration(cpu.totalMs)],
+      ["CPU avg", cpu.percentSinceStart === null || cpu.percentSinceStart === void 0 ? "-" : cpu.percentSinceStart + "%"],
+      ["Event loop p95", formatMs(loop.delayP95Ms)],
+      ["Event loop max", formatMs(loop.delayMaxMs)]
+    ];
+  }
+  function formatMs(value) {
+    return value === null || value === void 0 ? "-" : value + "ms";
+  }
+  function rateRows(name, rate) {
+    return [
+      ["Queued", rate?.queued ?? 0],
+      ["Running", rate?.running ?? 0],
+      ["Completed", rate?.completed ?? 0],
+      ["Failed", rate?.failed ?? 0],
+      ["Retries", rate?.retries ?? 0],
+      ["Rate-limit hits", rate?.rateLimitHits ?? 0],
+      ["Last rate limit", fmtDate(rate?.lastRateLimitAt)],
+      ["Retry after", rate?.lastRetryAfterSeconds ? rate.lastRetryAfterSeconds + "s" : "-"],
+      ["Buckets", (rate?.buckets || []).length]
+    ].map(([k, v]) => [name + " " + k, v]);
+  }
+  function renderMetrics(d) {
+    const adapters = d.adapters || {};
+    document.getElementById("metricsPanel").innerHTML = '<div class="metrics-grid">' + card("Runtime", metricStatusRows(d)) + card("Process", metricProcessRows(d)) + card("Jobs", metricJobRows(d)) + card("Telegram rate limits", rateRows("", adapters.telegram).map(([k, v]) => [String(k).trim(), v])) + card("Discord rate limits", rateRows("", adapters.discord).map(([k, v]) => [String(k).trim(), v])) + "</div>";
+  }
+  document.getElementById("reloadMetricsBtn").onclick = () => safe(loadMetrics);
+  function activityQuery() {
+    return { source: val("activitySource"), category: val("activityCategory"), status: val("activityStatus"), limit: val("activityLimit") || "100", actor: val("activityActor") || void 0, agent: val("activityAgent") || "all", thread: val("activityThread") || void 0, workspace: val("activityWorkspace") || void 0, type: val("activityType") || void 0, since: val("activitySince") || void 0 };
+  }
   async function loadActivity() {
     setLoading("activityList", "Loading activity...");
-    const data = await api("/api/activity", { query: { source: val("activitySource"), status: val("activityStatus"), limit: val("activityLimit") || "100" } });
+    const data = await api("/api/activity", { query: activityQuery() });
     state.activityEvents = data.events || [];
     renderActivity(state.activityEvents);
   }
@@ -1168,28 +1555,32 @@
     const active = state.snapshot?.session;
     return e.workspace || (active?.threadId && e.threadId === active.threadId ? active.workspace : "");
   }
+  function activityActorText(e) {
+    const a = e.actor || {};
+    return a.label || a.username || a.id || ({ web: "Web user", telegram: "Telegram user", discord: "Discord user", cli: "CLI", system: "System" }[a.channel] || "System");
+  }
   function activityMetaHtml(e) {
     const workspace = activityWorkspace(e);
     const duration = typeof e.durationMs === "number" ? fmtDuration(e.durationMs) : "";
+    const actor = activityActorText(e);
     const parts = [];
+    if (actor) parts.push("User: " + esc(actor));
     if (e.threadId) parts.push('<button type="button" class="copy-id" data-copy-id="' + attr(e.threadId) + '">' + esc(e.threadId) + "</button>");
     if (workspace) parts.push(esc(workspace));
     if (duration) parts.push(esc(duration));
     return parts.join(" | ");
   }
   function renderActivity(events) {
-    const since = val("activitySince") ? new Date(val("activitySince")).getTime() : 0;
-    const filtered = (events || []).filter((e) => !since || new Date(e.timestamp).getTime() >= since);
-    document.getElementById("activityList").innerHTML = filtered.map((e) => {
+    document.getElementById("activityList").innerHTML = (events || []).map((e) => {
       const meta = activityMetaHtml(e);
-      return '<div class="item"><strong><span class="chip ' + (e.status === "failed" ? "error" : e.status === "queued" ? "warn" : "") + '">' + esc(e.status) + "</span>" + esc([fmtDate(e.timestamp), e.source, e.type].filter(Boolean).join(" | ")) + "</strong><small>" + esc(short(e.prompt || e.detail || "", 220)) + "</small>" + (meta ? "<small>" + meta + "</small>" : "") + "</div>";
+      return '<div class="item"><strong><span class="chip ' + (e.status === "failed" ? "error" : e.status === "queued" ? "warn" : "") + '">' + esc(e.status) + "</span>" + esc([fmtDate(e.timestamp), e.source, e.category, e.type].filter(Boolean).join(" | ")) + "</strong><small>" + esc(short(e.prompt || e.detail || "", 220)) + "</small>" + (meta ? "<small>" + meta + "</small>" : "") + "</div>";
     }).join("") || '<div class="item">No activity.</div>';
     document.querySelectorAll("#activityList [data-copy-id]").forEach((b) => b.onclick = () => copyText(b.dataset.copyId || "", "Thread ID copied"));
   }
   document.getElementById("loadActivityBtn").onclick = () => loadActivity();
-  document.getElementById("activitySince").onchange = () => renderActivity(state.activityEvents || []);
+  document.getElementById("activitySince").onchange = () => loadActivity();
   document.getElementById("exportActivityBtn").onclick = () => {
-    const rows = (state.activityEvents || []).map((e) => [e.timestamp, e.source, e.status, e.type, e.threadId || "", e.prompt || e.detail || ""].join("\\t")).join("\\n");
+    const rows = (state.activityEvents || []).map((e) => [e.timestamp, e.source, e.category || "", e.status, e.type, activityActorText(e), e.agentId || "", e.threadId || "", activityWorkspace(e), e.prompt || e.detail || ""].join("\\t")).join("\\n");
     const blob = new Blob([rows], { type: "text/tab-separated-values" });
     const a = document.createElement("a");
     a.href = URL.createObjectURL(blob);
@@ -1203,7 +1594,7 @@
     state.settings = data.settings;
     renderSettings();
   }
-  const settingsGroupOrder = ["Agents", "Codex", "Pi", "Hermes", "OpenClaw", "Claude Code", "Telegram", "Operations", "Artifacts", "Workspace", "Voice", "Dashboard"];
+  const settingsGroupOrder = ["Agents", "Codex", "Pi", "Hermes", "OpenClaw", "Claude Code", "Telegram", "Discord", "Operations", "Artifacts", "Workspace", "Peers", "Voice", "Dashboard"];
   const agentSettingGroups = ["Codex", "Pi", "Hermes", "OpenClaw", "Claude Code"];
   function orderedSettingsGroups(groups) {
     const known = settingsGroupOrder.filter((name) => groups[name]);
@@ -1213,6 +1604,12 @@
   function agentSettingsNav(current) {
     return '<div class="agent-settings-nav"><strong>Agent settings</strong>' + agentSettingGroups.map((name) => '<button type="button" data-setting-tab="' + attr(name) + '" class="' + (name === current ? "active" : "") + '">' + esc(name) + "</button>").join("") + "</div>";
   }
+  function settingHelp(s) {
+    return s.help ? '<span class="setting-info" tabindex="0" role="img" aria-label="' + attr(s.help) + '" title="' + attr(s.help) + '">i</span>' : "";
+  }
+  function settingLabel(s) {
+    return '<label class="setting-label"><span>' + esc(s.label) + "</span>" + settingHelp(s) + "</label>";
+  }
   function renderSettings() {
     const groups = {};
     state.settings.forEach((s) => (groups[s.group] ??= []).push(s));
@@ -1225,7 +1622,7 @@
     });
     const items = groups[state.settingsGroup] || [];
     const nav = state.settingsGroup === "Agents" || agentSettingGroups.includes(state.settingsGroup) ? agentSettingsNav(state.settingsGroup) : "";
-    document.getElementById("settingsForm").innerHTML = '<div class="settings-section"><h2>' + esc(state.settingsGroup || "Settings") + '</h2><div id="settingsRestartBanner"></div>' + nav + items.map((s) => '<div class="setting" data-setting-box="' + attr(s.key) + '" data-restart-required="' + (s.restartRequired ? "true" : "false") + '"><label>' + esc(s.label) + "</label>" + settingInput(s) + "<small>" + esc(s.key) + " - " + esc(s.description) + (s.effectiveValue ? " Active: " + esc(s.effectiveValue) + "." : "") + (s.restartRequired ? " Restart required." : "") + (s.configured ? " Saved in env file." : " Using default.") + '</small><div class="setting-actions"><button type="button" class="secondary" data-reset-setting="' + attr(s.key) + '">Use default</button>' + (s.kind === "secret" ? '<button type="button" class="secondary" data-reveal-setting="' + attr(s.key) + '">Reveal/replace</button>' : "") + '</div><div class="setting-error"></div></div>').join("") + "</div>";
+    document.getElementById("settingsForm").innerHTML = '<div class="settings-section"><h2>' + esc(state.settingsGroup || "Settings") + '</h2><div id="settingsRestartBanner"></div>' + nav + items.map((s) => '<div class="setting" data-setting-box="' + attr(s.key) + '" data-restart-required="' + (s.restartRequired ? "true" : "false") + '">' + settingLabel(s) + settingInput(s) + "<small>" + esc(s.key) + " - " + esc(s.description) + (s.effectiveValue ? " Active: " + esc(s.effectiveValue) + "." : "") + (s.restartRequired ? " Restart required." : "") + (s.configured ? " Saved in env file." : " Using default.") + '</small><div class="setting-actions"><button type="button" class="secondary" data-reset-setting="' + attr(s.key) + '">Use default</button>' + (s.kind === "secret" ? '<button type="button" class="secondary" data-reveal-setting="' + attr(s.key) + '">Reveal/replace</button>' : "") + '</div><div class="setting-error"></div></div>').join("") + "</div>";
     document.querySelectorAll("[data-setting-tab]").forEach((b) => b.onclick = () => {
       state.settingsGroup = b.dataset.settingTab;
       renderSettings();
@@ -1319,6 +1716,8 @@
     const d = await api("/api/users");
     state.userManagement = d;
     renderUserManagement(d);
+    bindAccessTabs();
+    switchAccessTab(state.accessTab || "users");
     if (can("sessions.read")) await loadLocks();
     else document.getElementById("locksList").innerHTML = '<div class="item">Permission required: sessions.read</div>';
     if (can("audit.read")) await loadAudit();
@@ -1334,7 +1733,7 @@
     return '<div class="permission-grid full-span">' + (state.userManagement?.permissions || []).map((p) => '<label class="checkbox"><input type="checkbox" data-permission-choice="' + attr(p) + '" ' + (selectedSet.has(p) ? "checked" : "") + "> " + esc(p) + "</label>").join("") + "</div>";
   }
   function selectedValues(selector) {
-    return Array.from(document.querySelectorAll(selector + ":checked")).map((x) => x.dataset.groupChoice || x.dataset.permissionChoice || x.value).filter(Boolean);
+    return Array.from(document.querySelectorAll(selector + ":checked")).map((x) => x.dataset.groupChoice || x.dataset.permissionChoice || x.dataset.discordChannelChoice || x.value).filter(Boolean);
   }
   function csv(values = []) {
     return (values || []).join(", ");
@@ -1355,14 +1754,66 @@
   function userGroups(u) {
     return (u.groups || []).map((g) => g.id);
   }
+  function accessCopyButton(value, label) {
+    return value ? '<button type="button" class="copy-id" data-access-copy="' + attr(value) + '" data-access-copy-label="' + attr(label) + '">' + esc(value) + "</button>" : "-";
+  }
+  function bindAccessCopyButtons() {
+    document.querySelectorAll("[data-access-copy]").forEach((b) => b.onclick = () => copyText(b.dataset.accessCopy || "", b.dataset.accessCopyLabel || "Copied"));
+  }
+  function bindAccessTabs() {
+    document.querySelectorAll("[data-access-tab]").forEach((b) => b.onclick = () => switchAccessTab(b.dataset.accessTab));
+    const search = document.getElementById("discordChannelSearch");
+    if (search && !search.dataset.bound) {
+      search.dataset.bound = "true";
+      search.oninput = () => renderDiscordChannels();
+    }
+  }
+  function switchAccessTab(tab) {
+    state.accessTab = tab || "users";
+    document.querySelectorAll("[data-access-tab]").forEach((b) => b.classList.toggle("active", b.dataset.accessTab === state.accessTab));
+    document.querySelectorAll("[data-access-tab-panel]").forEach((panel) => panel.classList.toggle("active", panel.dataset.accessTabPanel === state.accessTab));
+  }
+  function groupNames(ids = []) {
+    const groups = state.userManagement?.groups || [];
+    return (ids || []).map((id) => groups.find((g) => g.id === id)?.name || id).join(", ");
+  }
+  function discordChannelLabel(channel) {
+    return channel.title ? channel.title + " (" + channel.channelId + ")" : channel.channelId;
+  }
+  function discordScopeLabel(ids = []) {
+    const channels = state.userManagement?.discordChannels || [];
+    return (ids || []).map((id) => discordChannelLabel(channels.find((c) => c.channelId === id) || { channelId: id })).join(", ");
+  }
+  function discordChannelOptions(selected = []) {
+    const selectedSet = new Set(selected || []);
+    const channels = state.userManagement?.discordChannels || [];
+    return '<div class="permission-grid full-span">' + (channels.map((c) => '<label class="checkbox"><input type="checkbox" data-discord-channel-choice="' + attr(c.channelId) + '" ' + (selectedSet.has(c.channelId) ? "checked" : "") + "> " + esc(discordChannelLabel(c) + " / " + (c.guildId || "DM")) + "</label>").join("") || "<small>No Discord channels registered.</small>") + "</div>";
+  }
+  function discordIdentityHtml(user, identity) {
+    const id = String(identity.discordUserId || "");
+    return '<span class="access-id-row">' + accessCopyButton(id, "Discord user ID copied") + (identity.username ? " <span>@" + esc(identity.username) + "</span>" : "") + ' <button class="secondary mini-button" data-discord-user="' + attr(user.id) + '" data-discord-unlink="' + attr(identity.id) + '"' + disabledAttr("users.write") + ">Unlink</button></span>";
+  }
+  function renderDiscordChannels(channels = state.userManagement?.discordChannels || []) {
+    const target = document.getElementById("discordChannelsList");
+    if (!target) return;
+    const query = (document.getElementById("discordChannelSearch")?.value || "").toLowerCase();
+    const filtered = (channels || []).filter((c) => !query || [c.title, c.channelId, c.guildId, c.type, groupNames(c.allowedGroupIds)].filter(Boolean).join(" ").toLowerCase().includes(query));
+    target.innerHTML = filtered.map((c) => '<div class="item"><strong>' + esc(c.title || String(c.channelId)) + ' <span class="adapter-status ' + (c.enabled ? "enabled" : "disabled") + '">' + (c.enabled ? "enabled" : "disabled") + '</span></strong><small class="access-id-row">Channel ID: ' + accessCopyButton(c.channelId, "Discord channel ID copied") + '</small><small class="access-id-row">Guild ID: ' + accessCopyButton(c.guildId || "", "Discord guild ID copied") + "</small><small>" + esc("Type: " + (c.type || "-")) + "</small><small>Groups: " + esc(groupNames(c.allowedGroupIds) || "all groups") + '</small><div class="row"><button data-discord-channel-edit="' + attr(c.id) + '"' + disabledAttr("users.write") + '>Edit</button><button class="secondary" data-discord-channel-toggle="' + attr(c.id) + '"' + disabledAttr("users.write") + ">" + (c.enabled ? "Disable" : "Enable") + "</button></div></div>").join("") || '<div class="item">No Discord channels registered.</div>';
+    bindDiscordChannelButtons();
+    bindAccessCopyButtons();
+    applyPermissions();
+  }
   function renderUserManagement(d) {
     document.getElementById("accessPanel").innerHTML = (d.users || []).map((u) => {
       const telegram = (u.telegramIdentities || []).map((t) => t.telegramUserId + (t.username ? " @" + t.username : "") + ' <button class="secondary mini-button" data-telegram-user="' + attr(u.id) + '" data-telegram-unlink="' + attr(t.id) + '"' + disabledAttr("users.write") + ">Unlink</button>").join(" ");
-      return '<div class="item"><strong>' + esc(u.displayName) + ' <span class="adapter-status ' + (u.active ? "enabled" : "disabled") + '">' + (u.active ? "active" : "disabled") + "</span></strong><small>" + esc(u.email + " / " + u.id) + "</small><small>Groups: " + esc((u.groups || []).map((g) => g.name).join(", ") || "-") + "</small><small>Telegram: " + (telegram || "-") + "</small><small>Web sessions: " + esc(String((u.webSessions || []).length)) + '</small><div class="row"><button data-user-edit="' + attr(u.id) + '"' + disabledAttr("users.write") + '>Edit</button><button class="secondary" data-user-toggle="' + attr(u.id) + '"' + disabledAttr("users.write") + ">" + (u.active ? "Disable" : "Enable") + '</button><button class="secondary" data-user-code="' + attr(u.id) + '"' + disabledAttr("users.write") + '>Telegram code</button><button class="secondary" data-user-link="' + attr(u.id) + '"' + disabledAttr("users.write") + '>Link Telegram ID</button><button class="secondary" data-user-password="' + attr(u.id) + '"' + disabledAttr("users.write") + '>Set password</button><button class="danger" data-user-revoke="' + attr(u.id) + '"' + disabledAttr("users.write") + ">Revoke sessions</button></div></div>";
+      const discord = (u.discordIdentities || []).map((identity) => discordIdentityHtml(u, identity)).join(" ");
+      return '<div class="item"><strong>' + esc(u.displayName) + ' <span class="adapter-status ' + (u.active ? "enabled" : "disabled") + '">' + (u.active ? "active" : "disabled") + "</span></strong><small>" + esc(u.email + " / " + u.id) + "</small><small>Groups: " + esc((u.groups || []).map((g) => g.name).join(", ") || "-") + "</small><small>Telegram: " + (telegram || "-") + "</small><small>Discord: " + (discord || "-") + "</small><small>Web sessions: " + esc(String((u.webSessions || []).length)) + '</small><div class="row"><button data-user-edit="' + attr(u.id) + '"' + disabledAttr("users.write") + '>Edit</button><button class="secondary" data-user-toggle="' + attr(u.id) + '"' + disabledAttr("users.write") + ">" + (u.active ? "Disable" : "Enable") + '</button><button class="secondary" data-user-code="' + attr(u.id) + '"' + disabledAttr("users.write") + '>Telegram code</button><button class="secondary" data-user-link="' + attr(u.id) + '"' + disabledAttr("users.write") + '>Link Telegram ID</button><button class="secondary" data-user-discord-code="' + attr(u.id) + '"' + disabledAttr("users.write") + '>Discord code</button><button class="secondary" data-user-discord-link="' + attr(u.id) + '"' + disabledAttr("users.write") + '>Link Discord ID</button><button class="secondary" data-user-password="' + attr(u.id) + '"' + disabledAttr("users.write") + '>Set password</button><button class="danger" data-user-revoke="' + attr(u.id) + '"' + disabledAttr("users.write") + ">Revoke sessions</button></div></div>";
     }).join("") || '<div class="item">No users.</div>';
-    document.getElementById("groupsList").innerHTML = (d.groups || []).map((g) => '<div class="item"><strong>' + esc(g.name) + " " + (g.system ? '<span class="chip">system</span>' : "") + "</strong><small>" + esc(g.description || "") + "</small><small>Permissions: " + esc((g.permissions || []).join(", ") || "-") + "</small><small>Agent scope: " + esc(csv(g.agentIds) || "all") + "</small><small>Workspace scope: " + esc(csv(g.workspaceRoots) || "all") + "</small><small>Telegram chat scope: " + esc(csv(g.telegramChatIds) || "all") + '</small><div class="row"><button class="secondary" data-group-edit="' + attr(g.id) + '"' + disabledAttr("users.write") + ">Edit group</button></div></div>").join("") || '<div class="item">No groups.</div>';
-    document.getElementById("telegramChatsList").innerHTML = (d.telegramChats || []).map((c) => '<div class="item"><strong>' + esc(c.title || String(c.chatId)) + ' <span class="adapter-status ' + (c.enabled ? "enabled" : "disabled") + '">' + (c.enabled ? "enabled" : "disabled") + "</span></strong><small>" + esc("Chat ID: " + c.chatId + " / " + (c.type || "-")) + "</small><small>Groups: " + esc((c.allowedGroupIds || []).join(", ") || "all groups") + '</small><div class="row"><button data-chat-edit="' + attr(c.id) + '"' + disabledAttr("users.write") + '>Edit</button><button class="secondary" data-chat-toggle="' + attr(c.id) + '"' + disabledAttr("users.write") + ">" + (c.enabled ? "Disable" : "Enable") + "</button></div></div>").join("") || '<div class="item">No Telegram group chats registered.</div>';
+    document.getElementById("groupsList").innerHTML = (d.groups || []).map((g) => '<div class="item"><strong>' + esc(g.name) + " " + (g.system ? '<span class="chip">system</span>' : "") + "</strong><small>" + esc(g.description || "") + "</small><small>Permissions: " + esc((g.permissions || []).join(", ") || "-") + "</small><small>Agent scope: " + esc(csv(g.agentIds) || "all") + "</small><small>Workspace scope: " + esc(csv(g.workspaceRoots) || "all") + "</small><small>Telegram chat scope: " + esc(csv(g.telegramChatIds) || "all") + "</small><small>Discord channel scope: " + esc(discordScopeLabel(g.discordChannelIds) || "all") + '</small><div class="row"><button class="secondary" data-group-edit="' + attr(g.id) + '"' + disabledAttr("users.write") + ">Edit group</button></div></div>").join("") || '<div class="item">No groups.</div>';
+    document.getElementById("telegramChatsList").innerHTML = (d.telegramChats || []).map((c) => '<div class="item"><strong>' + esc(c.title || String(c.chatId)) + ' <span class="adapter-status ' + (c.enabled ? "enabled" : "disabled") + '">' + (c.enabled ? "enabled" : "disabled") + "</span></strong><small>" + esc("Chat ID: " + c.chatId + " / " + (c.type || "-")) + "</small><small>Groups: " + esc(groupNames(c.allowedGroupIds) || "all groups") + '</small><div class="row"><button data-chat-edit="' + attr(c.id) + '"' + disabledAttr("users.write") + '>Edit</button><button class="secondary" data-chat-toggle="' + attr(c.id) + '"' + disabledAttr("users.write") + ">" + (c.enabled ? "Disable" : "Enable") + "</button></div></div>").join("") || '<div class="item">No Telegram group chats registered.</div>';
+    renderDiscordChannels(d.discordChannels || []);
     bindUserButtons();
+    bindAccessCopyButtons();
     applyPermissions();
   }
   function bindUserButtons() {
@@ -1382,6 +1833,11 @@
       toast("Telegram link code: " + r.linkCode.code + " (expires " + fmtDate(r.linkCode.expiresAt) + ")", { duration: 15e3 });
     }));
     document.querySelectorAll("[data-user-link]").forEach((b) => b.onclick = () => openTelegramLinkDialog(b.dataset.userLink));
+    document.querySelectorAll("[data-user-discord-code]").forEach((b) => b.onclick = () => safe(async () => {
+      const r = await api("/api/users/" + encodeURIComponent(b.dataset.userDiscordCode) + "/discord", { method: "POST", body: JSON.stringify({ createCode: true }) });
+      toast("Discord link code: " + r.linkCode.code + " (expires " + fmtDate(r.linkCode.expiresAt) + ")", { duration: 15e3 });
+    }));
+    document.querySelectorAll("[data-user-discord-link]").forEach((b) => b.onclick = () => openDiscordLinkDialog(b.dataset.userDiscordLink));
     document.querySelectorAll("[data-user-password]").forEach((b) => b.onclick = () => openPasswordDialog(b.dataset.userPassword));
     document.querySelectorAll("[data-user-revoke]").forEach((b) => b.onclick = () => safe(async () => {
       if (confirm("Revoke all web sessions for this user?")) {
@@ -1397,6 +1853,13 @@
         loadAccess();
       }
     }));
+    document.querySelectorAll("[data-discord-unlink]").forEach((b) => b.onclick = () => safe(async () => {
+      if (confirm("Unlink this Discord identity?")) {
+        await api("/api/users/" + encodeURIComponent(b.dataset.discordUser) + "/discord/" + encodeURIComponent(b.dataset.discordUnlink), { method: "DELETE" });
+        toast("Discord unlinked");
+        loadAccess();
+      }
+    }));
     document.querySelectorAll("[data-group-edit]").forEach((b) => b.onclick = () => {
       const g = (state.userManagement?.groups || []).find((x) => x.id === b.dataset.groupEdit);
       if (g) openGroupDialog(g);
@@ -1412,6 +1875,30 @@
       toast("Chat updated");
       loadAccess();
     }));
+    document.querySelectorAll("[data-discord-channel-edit]").forEach((b) => b.onclick = () => {
+      const c = (state.userManagement?.discordChannels || []).find((x) => x.id === b.dataset.discordChannelEdit);
+      if (c) openDiscordChannelDialog(c);
+    });
+    document.querySelectorAll("[data-discord-channel-toggle]").forEach((b) => b.onclick = () => safe(async () => {
+      const c = (state.userManagement?.discordChannels || []).find((x) => x.id === b.dataset.discordChannelToggle);
+      if (!c) return;
+      await api("/api/discord-channels/" + encodeURIComponent(c.id), { method: "PATCH", body: JSON.stringify({ enabled: !c.enabled }) });
+      toast("Discord channel updated");
+      loadAccess();
+    }));
+  }
+  function bindDiscordChannelButtons() {
+    document.querySelectorAll("[data-discord-channel-edit]").forEach((b) => b.onclick = () => {
+      const c = (state.userManagement?.discordChannels || []).find((x) => x.id === b.dataset.discordChannelEdit);
+      if (c) openDiscordChannelDialog(c);
+    });
+    document.querySelectorAll("[data-discord-channel-toggle]").forEach((b) => b.onclick = () => safe(async () => {
+      const c = (state.userManagement?.discordChannels || []).find((x) => x.id === b.dataset.discordChannelToggle);
+      if (!c) return;
+      await api("/api/discord-channels/" + encodeURIComponent(c.id), { method: "PATCH", body: JSON.stringify({ enabled: !c.enabled }) });
+      toast("Discord channel updated");
+      loadAccess();
+    }));
   }
   function openUserDialog(u) {
     adminDialog(u ? "Edit user" : "Create user", '<label>Email<input id="dlgEmail" value="' + attr(u?.email || "") + '"></label><label>Display name<input id="dlgName" value="' + attr(u?.displayName || "") + '"></label>' + (!u ? '<label>Password<input id="dlgPassword" type="password" autocomplete="new-password"></label>' : "") + '<label class="checkbox"><input id="dlgActive" type="checkbox" ' + (!u || u.active ? "checked" : "") + '> Active</label><div class="full-span"><strong>Groups</strong><div class="row">' + groupOptions(u ? userGroups(u) : ["user"]) + "</div></div>", async () => {
@@ -1427,6 +1914,19 @@
       toast("Password updated");
     });
   }
+  function assertDiscordId(value, label, required = true) {
+    const text = String(value || "").trim();
+    if (!text && !required) return "";
+    if (!text) throw new Error(label + " is required");
+    if (!/^\d{5,32}$/.test(text)) throw new Error(label + " must be a numeric Discord ID");
+    return text;
+  }
+  function openDiscordLinkDialog(id) {
+    adminDialog("Link Discord ID", '<label>Discord user ID<input id="dlgDiscordId" inputmode="numeric" pattern="[0-9]*"></label><label>Username<input id="dlgDiscordUsername"></label>', async () => {
+      await api("/api/users/" + encodeURIComponent(id) + "/discord", { method: "POST", body: JSON.stringify({ discordUserId: assertDiscordId(val("dlgDiscordId"), "Discord user ID"), username: val("dlgDiscordUsername") || void 0 }) });
+      toast("Discord linked");
+    });
+  }
   function openTelegramLinkDialog(id) {
     adminDialog("Link Telegram ID", '<label>Telegram user ID<input id="dlgTelegramId" type="number"></label><label>Username<input id="dlgUsername"></label>', async () => {
       await api("/api/users/" + encodeURIComponent(id) + "/telegram", { method: "POST", body: JSON.stringify({ telegramUserId: Number(val("dlgTelegramId")), username: val("dlgUsername") || void 0 }) });
@@ -1434,12 +1934,20 @@
     });
   }
   function openGroupDialog(g) {
-    adminDialog(g ? "Edit group" : "Create group", '<label>Name<input id="dlgGroupName" value="' + attr(g?.name || "") + '" ' + (g?.system ? "disabled" : "") + '></label><label>Description<input id="dlgGroupDescription" value="' + attr(g?.description || "") + '"></label><label class="full-span">Agent scope, comma-separated<input id="dlgAgentIds" value="' + attr(csv(g?.agentIds)) + '" placeholder="empty means all"></label><label class="full-span">Workspace scope, comma-separated<input id="dlgWorkspaceRoots" value="' + attr(csv(g?.workspaceRoots)) + '" placeholder="empty means all"></label><label class="full-span">Telegram chat scope, comma-separated<input id="dlgTelegramChatIds" value="' + attr(csv(g?.telegramChatIds)) + '" placeholder="empty means all"></label><strong class="full-span">Permissions</strong>' + permissionOptions(g?.permissions || ["inspect", "sessions.read"]), async () => {
-      const payload = { name: val("dlgGroupName"), description: val("dlgGroupDescription"), permissions: selectedValues("[data-permission-choice]"), agentIds: csvToList(val("dlgAgentIds")), workspaceRoots: csvToList(val("dlgWorkspaceRoots")), telegramChatIds: csvToList(val("dlgTelegramChatIds")).map(Number).filter(Number.isInteger) };
+    adminDialog(g ? "Edit group" : "Create group", '<label>Name<input id="dlgGroupName" value="' + attr(g?.name || "") + '" ' + (g?.system ? "disabled" : "") + '></label><label>Description<input id="dlgGroupDescription" value="' + attr(g?.description || "") + '"></label><label class="full-span">Agent scope, comma-separated<input id="dlgAgentIds" value="' + attr(csv(g?.agentIds)) + '" placeholder="empty means all"></label><label class="full-span">Workspace scope, comma-separated<input id="dlgWorkspaceRoots" value="' + attr(csv(g?.workspaceRoots)) + '" placeholder="empty means all"></label><label class="full-span">Telegram chat scope, comma-separated<input id="dlgTelegramChatIds" value="' + attr(csv(g?.telegramChatIds)) + '" placeholder="empty means all"></label><div class="full-span"><strong>Discord channel scope</strong>' + discordChannelOptions(g?.discordChannelIds || []) + '<small>Leave empty to allow every registered Discord channel.</small></div><strong class="full-span">Permissions</strong>' + permissionOptions(g?.permissions || ["inspect", "sessions.read"]), async () => {
+      const payload = { name: val("dlgGroupName"), description: val("dlgGroupDescription"), permissions: selectedValues("[data-permission-choice]"), agentIds: csvToList(val("dlgAgentIds")), workspaceRoots: csvToList(val("dlgWorkspaceRoots")), telegramChatIds: csvToList(val("dlgTelegramChatIds")).map(Number).filter(Number.isInteger), discordChannelIds: selectedValues("[data-discord-channel-choice]") };
       await api(g ? "/api/groups/" + encodeURIComponent(g.id) : "/api/groups", { method: g ? "PATCH" : "POST", body: JSON.stringify(payload) });
       toast(g ? "Group updated" : "Group created");
     });
   }
+  function openDiscordChannelDialog(c) {
+    adminDialog(c ? "Edit Discord channel" : "Add Discord channel", '<label>Guild ID<input id="dlgDiscordGuildId" inputmode="numeric" pattern="[0-9]*" value="' + attr(c?.guildId || "") + '" ' + (c ? "disabled" : "") + '></label><label>Channel ID<input id="dlgDiscordChannelId" inputmode="numeric" pattern="[0-9]*" value="' + attr(c?.channelId || "") + '" ' + (c ? "disabled" : "") + '></label><label>Title<input id="dlgDiscordChannelTitle" value="' + attr(c?.title || "") + '"></label><label>Type<select id="dlgDiscordChannelType"><option value="guild" ' + ((c?.type || "guild") === "guild" ? "selected" : "") + '>guild</option><option value="thread" ' + (c?.type === "thread" ? "selected" : "") + '>thread</option><option value="dm" ' + (c?.type === "dm" ? "selected" : "") + '>dm</option></select></label><label class="checkbox"><input id="dlgDiscordChannelEnabled" type="checkbox" ' + (!c || c.enabled ? "checked" : "") + '> Enabled</label><div class="full-span"><strong>Allowed groups</strong><div class="row">' + groupOptions(c?.allowedGroupIds || []) + "</div><small>Leave empty to allow every group.</small></div>", async () => {
+      const type = val("dlgDiscordChannelType") || "guild";
+      const payload = { guildId: assertDiscordId(val("dlgDiscordGuildId"), "Guild ID", type === "dm" ? false : true) || void 0, channelId: assertDiscordId(val("dlgDiscordChannelId"), "Channel ID"), title: val("dlgDiscordChannelTitle") || void 0, type, enabled: document.getElementById("dlgDiscordChannelEnabled").checked, allowedGroupIds: selectedValues("[data-group-choice]") };
+      await api(c ? "/api/discord-channels/" + encodeURIComponent(c.id) : "/api/discord-channels", { method: c ? "PATCH" : "POST", body: JSON.stringify(payload) });
+      toast(c ? "Discord channel updated" : "Discord channel added");
+    });
+  }
   function openChatDialog(c) {
     adminDialog(c ? "Edit Telegram chat" : "Add Telegram chat", '<label>Chat ID<input id="dlgChatId" type="number" value="' + attr(c?.chatId || "") + '" ' + (c ? "disabled" : "") + '></label><label>Title<input id="dlgChatTitle" value="' + attr(c?.title || "") + '"></label><label>Type<input id="dlgChatType" value="' + attr(c?.type || "supergroup") + '"></label><label class="checkbox"><input id="dlgChatEnabled" type="checkbox" ' + (!c || c.enabled ? "checked" : "") + '> Enabled</label><div class="full-span"><strong>Allowed groups</strong><div class="row">' + groupOptions(c?.allowedGroupIds || []) + "</div><small>Leave empty to allow every group.</small></div>", async () => {
       const payload = { chatId: Number(val("dlgChatId")), title: val("dlgChatTitle") || void 0, type: val("dlgChatType") || void 0, enabled: document.getElementById("dlgChatEnabled").checked, allowedGroupIds: selectedValues("[data-group-choice]") };
@@ -1471,13 +1979,23 @@
     }
     openChatDialog(null);
   };
+  document.getElementById("createDiscordChannelBtn").onclick = () => {
+    if (!can("users.write")) {
+      toast("Permission required: users.write");
+      return;
+    }
+    openDiscordChannelDialog(null);
+  };
   async function loadLocks() {
     if (!can("sessions.read")) {
       document.getElementById("locksList").innerHTML = '<div class="item">Permission required: sessions.read</div>';
       return;
     }
     const d = await api("/api/locks");
-    document.getElementById("locksList").innerHTML = (d.locks || []).map((l) => '<div class="item"><strong>' + esc(l.contextKey) + "</strong><small>" + esc((l.ownerName || "owner") + " / " + l.ownerId + " / expires " + fmtDate(l.expiresAt)) + "</small></div>").join("") || '<div class="item">No active locks.</div>';
+    document.getElementById("locksList").innerHTML = (d.locks || []).map((l) => {
+      const owner = [l.ownerLabel || l.ownerUserId, l.ownerUserId, l.ownerChannel ? "via " + l.ownerChannel : "", l.ownerChannelUserId ? "channel user " + l.ownerChannelUserId : "", l.expiresAt ? "expires " + fmtDate(l.expiresAt) : ""].filter(Boolean).join(" | ");
+      return '<div class="item"><strong>' + esc(l.contextKey) + "</strong><small>" + esc(owner) + "</small></div>";
+    }).join("") || '<div class="item">No active locks.</div>';
   }
   document.getElementById("lockSessionBtn").onclick = () => safe(async () => {
     if (!can("sessions.write")) {
@@ -1497,15 +2015,36 @@
     toast("Web session unlocked");
     loadLocks();
   });
+  function auditQuery() {
+    return { limit: val("auditLimit") || "50", channel: val("auditChannel") || "all", category: val("auditCategory") || "all", status: val("auditStatus") || "all", actor: val("auditActor") || void 0, agent: val("auditAgent") || "all", thread: val("auditThread") || void 0, workspace: val("auditWorkspace") || void 0, since: val("auditSince") || void 0 };
+  }
   async function loadAudit() {
     if (!can("audit.read")) {
       document.getElementById("auditList").innerHTML = '<div class="item">Permission required: audit.read</div>';
       return;
     }
-    const d = await api("/api/audit", { query: { limit: val("auditLimit") || "50" } });
-    document.getElementById("auditList").innerHTML = (d.events || []).map((e) => '<div class="item"><strong>' + esc(fmtDate(e.timestamp) + " / " + (e.channelId || "-") + " / " + e.status + " / " + e.action) + "</strong><small>" + esc((e.contextKey || "-") + " / " + (e.agentId || "-") + " / " + (e.threadId || "-")) + "</small><small>" + esc(e.description || e.detail || "") + "</small></div>").join("") || '<div class="item">No audit events.</div>';
+    const d = await api("/api/audit", { query: auditQuery() });
+    state.auditEvents = d.events || [];
+    renderAudit(state.auditEvents);
+  }
+  function renderAudit(events) {
+    document.getElementById("auditList").innerHTML = (events || []).map((e) => {
+      const actor = e.actor ? [e.actor.label || e.actor.username || e.actor.id, e.actor.channel, e.actor.channelUserId].filter(Boolean).join(" | ") : e.actorId ? String(e.actorId) : "system";
+      const meta = [e.contextKey, e.agentId, e.threadId, e.workspace].filter(Boolean).join(" | ");
+      return '<div class="item"><strong>' + esc([fmtDate(e.timestamp), e.channelId, e.status, e.category, e.action].filter(Boolean).join(" | ")) + "</strong><small>" + esc("Actor: " + actor) + "</small>" + (meta ? "<small>" + esc(meta) + "</small>" : "") + "<small>" + esc(e.description || e.detail || "") + "</small></div>";
+    }).join("") || '<div class="item">No audit events.</div>';
   }
   document.getElementById("loadAuditBtn").onclick = () => loadAudit();
+  document.getElementById("exportAuditBtn").onclick = () => {
+    const events = state.auditEvents || [];
+    const text = events.map((e) => [fmtDate(e.timestamp), e.channelId, e.status, e.category, e.action, e.actor?.label || e.actor?.username || e.actor?.id || e.actorId || "system", e.contextKey, e.agentId || "", e.threadId || "", e.workspace || "", e.description || e.detail || ""].join("\\t")).join("\\n");
+    const blob = new Blob([text], { type: "text/tab-separated-values" });
+    const a = document.createElement("a");
+    a.href = URL.createObjectURL(blob);
+    a.download = "nordrelay-audit.tsv";
+    a.click();
+    URL.revokeObjectURL(a.href);
+  };
   async function loadLogs() {
     if (!document.getElementById("logAutoRefresh").checked) setLoading("logs", "Loading logs...");
     const target = document.getElementById("logTarget").value;
@@ -1562,6 +2101,97 @@
       toast("Cleared " + target + " log");
     }
   });
+  async function loadPeers() {
+    if (!can("peers.read")) {
+      document.getElementById("peersList").innerHTML = '<div class="item">Permission required: peers.read</div>';
+      return;
+    }
+    setLoading("peersList", "Loading peers...");
+    const d = await api("/api/peers", { local: true });
+    state.peers = d;
+    document.getElementById("peerStatus").innerHTML = card("Local peer identity", [["Peer server", d.enabled ? "enabled" : "disabled"], ["Listen URL", d.listenUrl], ["Require TLS", d.requireTls ? "yes" : "no"], ["Node ID", d.identity?.nodeId], ["Fingerprint", d.identity?.fingerprint]]);
+    document.getElementById("peersList").innerHTML = (d.peers || []).map(peerCard).join("") || '<div class="item">No peers configured.</div>';
+    document.getElementById("peerInvites").innerHTML = (d.invitations || []).map((i) => '<div class="item"><strong>' + esc(i.name) + ' <span class="chip">' + esc(new Date(i.expiresAt) > /* @__PURE__ */ new Date() && !i.usedAt ? "open" : "closed") + "</span></strong><small>" + esc("Expires: " + fmtDate(i.expiresAt)) + "</small><small>" + esc("Scopes: " + (i.scopes || []).join(", ")) + "</small><small>" + esc("Agents: " + ((i.allowedAgents || []).join(", ") || "all")) + "</small>" + (i.usedAt ? "<small>" + esc("Used: " + fmtDate(i.usedAt) + " by " + (i.usedByNodeId || "-")) + "</small>" : "") + "</div>").join("") || '<div class="item">No open invitations.</div>';
+    bindPeerButtons();
+    await loadPeerSelector();
+    applyPermissions();
+  }
+  function peerCard(p) {
+    const selected = state.selectedPeer === p.id ? ' <span class="chip">selected</span>' : "";
+    return '<div class="item"><strong>' + esc(p.name) + ' <span class="adapter-status ' + (p.enabled ? "enabled" : "disabled") + '">' + (p.enabled ? "enabled" : "disabled") + "</span>" + selected + "</strong><small>" + esc("URL: " + (p.url || "-")) + "</small><small>" + esc("Node: " + p.nodeId + " / " + p.fingerprint) + "</small>" + (p.tlsFingerprint ? "<small>" + esc("TLS: " + p.tlsFingerprint) + "</small>" : "") + "<small>" + esc("Direction: " + p.direction + " / scopes " + (p.scopes || []).join(", ")) + "</small><small>" + esc("Agents: " + ((p.allowedAgents || []).join(", ") || "all")) + "</small><small>" + esc("Workspaces: " + ((p.allowedWorkspaceRoots || []).join(", ") || "all")) + "</small>" + (p.lastSeenAt ? "<small>" + esc("Last seen: " + fmtDate(p.lastSeenAt)) + "</small>" : "") + (p.lastError ? '<small class="error">' + esc("Last error: " + p.lastError) + "</small>" : "") + '<div class="row"><button data-peer-select="' + attr(p.id) + '">Use target</button><button class="secondary" data-peer-test="' + attr(p.id) + '">Test</button><button class="secondary" data-peer-edit="' + attr(p.id) + '"' + disabledAttr("peers.write") + '>Edit</button><button class="secondary" data-peer-toggle="' + attr(p.id) + '"' + disabledAttr("peers.write") + ">" + (p.enabled ? "Disable" : "Enable") + '</button><button class="danger" data-peer-revoke="' + attr(p.id) + '"' + disabledAttr("peers.write") + ">Revoke</button></div></div>";
+  }
+  function bindPeerButtons() {
+    document.querySelectorAll("[data-peer-select]").forEach((b) => b.onclick = () => safe(async () => {
+      state.selectedPeer = b.dataset.peerSelect || "local";
+      localStorage.setItem("nordrelayPeerTarget", state.selectedPeer);
+      connectEvents();
+      await loadBootstrap();
+      toast("Peer target selected");
+    }));
+    document.querySelectorAll("[data-peer-test]").forEach((b) => b.onclick = () => safe(async () => {
+      const r = await api("/api/peers/" + encodeURIComponent(b.dataset.peerTest) + "/proxy", { method: "POST", body: JSON.stringify({ method: "GET", path: "/api/health", query: {}, body: {} }), local: true });
+      toast("Peer reachable: " + (r.health?.state?.status || r.state?.status || "ok"), { duration: 6e3 });
+      loadPeers();
+    }));
+    document.querySelectorAll("[data-peer-edit]").forEach((b) => b.onclick = () => {
+      const p = (state.peers?.peers || []).find((x) => x.id === b.dataset.peerEdit);
+      if (p) openPeerDialog(p);
+    });
+    document.querySelectorAll("[data-peer-toggle]").forEach((b) => b.onclick = () => safe(async () => {
+      const p = (state.peers?.peers || []).find((x) => x.id === b.dataset.peerToggle);
+      if (!p) return;
+      await api("/api/peers/" + encodeURIComponent(p.id), { method: "PATCH", body: JSON.stringify({ enabled: !p.enabled }), local: true });
+      toast("Peer updated");
+      loadPeers();
+    }));
+    document.querySelectorAll("[data-peer-revoke]").forEach((b) => b.onclick = () => safe(async () => {
+      if (confirm("Revoke this peer?")) {
+        await api("/api/peers/" + encodeURIComponent(b.dataset.peerRevoke), { method: "DELETE", local: true });
+        if (state.selectedPeer === b.dataset.peerRevoke) {
+          state.selectedPeer = "local";
+          localStorage.setItem("nordrelayPeerTarget", "local");
+        }
+        toast("Peer revoked");
+        loadPeers();
+      }
+    }));
+  }
+  function openPeerDialog(p) {
+    adminDialog("Edit peer", '<label>Name<input id="dlgPeerName" value="' + attr(p.name || "") + '"></label><label>URL<input id="dlgPeerUrl" value="' + attr(p.url || "") + '"></label><label class="checkbox"><input id="dlgPeerEnabled" type="checkbox" ' + (p.enabled ? "checked" : "") + '> Enabled</label><label class="full-span">Scopes<input id="dlgPeerScopes" value="' + attr((p.scopes || []).join(", ")) + '"></label><label class="full-span">Allowed agents<input id="dlgPeerAgents" value="' + attr((p.allowedAgents || []).join(", ")) + '"></label><label class="full-span">Allowed workspace roots<input id="dlgPeerWorkspaces" value="' + attr((p.allowedWorkspaceRoots || []).join(", ")) + '"></label>', async () => {
+      await api("/api/peers/" + encodeURIComponent(p.id), { method: "PATCH", body: JSON.stringify({ name: val("dlgPeerName"), url: val("dlgPeerUrl"), enabled: document.getElementById("dlgPeerEnabled").checked, scopes: csvToList(val("dlgPeerScopes")), allowedAgents: csvToList(val("dlgPeerAgents")), allowedWorkspaceRoots: csvToList(val("dlgPeerWorkspaces")) }), local: true });
+      toast("Peer updated");
+      await loadPeers();
+    });
+  }
+  function openPeerInviteDialog() {
+    adminDialog("Create peer invite", '<label>Name<input id="dlgPeerInviteName" value="NordRelay peer"></label><label>Expires minutes<input id="dlgPeerInviteExpires" type="number" value="10" min="1"></label><label class="full-span">Scopes<input id="dlgPeerInviteScopes" value="inspect, sessions.read, sessions.write, prompt.send, prompt.abort, queue.read, queue.write, files.read, files.write, diagnostics.read, logs.read"></label><label class="full-span">Allowed agents<input id="dlgPeerInviteAgents" value="codex, pi, hermes, openclaw, claude-code"></label><label class="full-span">Allowed workspace roots<input id="dlgPeerInviteWorkspaces" placeholder="empty means all"></label>', async () => {
+      const r = await api("/api/peers/invite", { method: "POST", body: JSON.stringify({ name: val("dlgPeerInviteName"), expiresMinutes: Number(val("dlgPeerInviteExpires") || 10), scopes: csvToList(val("dlgPeerInviteScopes")), allowedAgents: csvToList(val("dlgPeerInviteAgents")), allowedWorkspaceRoots: csvToList(val("dlgPeerInviteWorkspaces")) }), local: true });
+      toast("Pairing code: " + r.code + "\\n" + r.command, { duration: 2e4 });
+      await loadPeers();
+    });
+  }
+  function openPeerAddDialog() {
+    adminDialog("Add peer", '<label>Peer URL<input id="dlgPeerAddUrl" placeholder="https://host:31979"></label><label>Pairing code<input id="dlgPeerAddCode"></label><label>Name<input id="dlgPeerAddName" placeholder="optional local label"></label><label>Public URL for this node<input id="dlgPeerAddPublicUrl" placeholder="optional"></label>', async () => {
+      const r = await api("/api/peers/pair", { method: "POST", body: JSON.stringify({ url: val("dlgPeerAddUrl"), code: val("dlgPeerAddCode"), name: val("dlgPeerAddName") || void 0, publicUrl: val("dlgPeerAddPublicUrl") || void 0 }), local: true });
+      toast("Added peer " + (r.peer?.name || ""));
+      await loadPeers();
+    });
+  }
+  document.getElementById("loadPeersBtn").onclick = () => loadPeers();
+  document.getElementById("createPeerInviteBtn").onclick = () => {
+    if (!can("peers.write")) {
+      toast("Permission required: peers.write");
+      return;
+    }
+    openPeerInviteDialog();
+  };
+  document.getElementById("addPeerBtn").onclick = () => {
+    if (!can("peers.write")) {
+      toast("Permission required: peers.write");
+      return;
+    }
+    openPeerAddDialog();
+  };
   async function loadAdapterHealth() {
     setLoading("adapterHealth", "Loading adapters...");
     const d = await api("/api/adapters/health");
@@ -1724,13 +2354,28 @@
     document.getElementById("diagnostics").innerHTML = diagnosticsHtml(data);
   }
   const exportDiagnosticsBundleBtn = document.getElementById("exportDiagnosticsBundleBtn");
-  if (exportDiagnosticsBundleBtn) exportDiagnosticsBundleBtn.onclick = () => {
+  if (exportDiagnosticsBundleBtn) exportDiagnosticsBundleBtn.onclick = () => safe(async () => {
     if (!can("diagnostics.read")) {
       toast("Permission required: diagnostics.read");
       return;
     }
-    window.open("/api/diagnostics/bundle", "_blank");
-  };
+    if (!state.selectedPeer || state.selectedPeer === "local") {
+      window.open("/api/diagnostics/bundle", "_blank");
+      return;
+    }
+    const bundle = await api("/api/diagnostics/bundle");
+    downloadBase64(bundle.name || "nordrelay-support-bundle.zip", bundle.dataBase64 || "", bundle.mimeType || "application/zip");
+    toast("Remote diagnostics bundle downloaded");
+  });
+  function downloadBase64(name, dataBase64, mimeType) {
+    const bytes = Uint8Array.from(atob(dataBase64), (c) => c.charCodeAt(0));
+    const blob = new Blob([bytes], { type: mimeType });
+    const a = document.createElement("a");
+    a.href = URL.createObjectURL(blob);
+    a.download = name;
+    a.click();
+    URL.revokeObjectURL(a.href);
+  }
   function diagnosticsHtml(d) {
     const h = d.health || {};
     const s = d.snapshot?.session || {};
@@ -1747,4 +2392,83 @@
     Promise.resolve().then(fn).catch((err) => toast(err.message || String(err)));
   }
   loadBootstrap().then(() => connectEvents()).catch((err) => toast(err.message));
+  const loadPeersBase = loadPeers;
+  loadPeers = async function() {
+    await loadPeersBase();
+    ensureGlobalPeerSessionsPanel();
+  };
+  function ensureGlobalPeerSessionsPanel() {
+    if (document.getElementById("globalPeerSessionsPanel")) return;
+    const anchor = document.getElementById("peersList");
+    if (!anchor) return;
+    anchor.insertAdjacentHTML("afterend", '<h2>Global sessions</h2><div id="globalPeerSessionsPanel" class="list"><div class="item"><div class="row"><input id="globalPeerSessionSearch" placeholder="Search sessions across peers"><button id="loadGlobalPeerSessionsBtn">Load global sessions</button></div><div id="globalPeerSessionsList"></div></div></div>');
+    document.getElementById("loadGlobalPeerSessionsBtn").onclick = () => safe(loadGlobalPeerSessions);
+  }
+  async function loadGlobalPeerSessions() {
+    const target = document.getElementById("globalPeerSessionsList");
+    target.innerHTML = loadingHtml("Loading global sessions...");
+    const q = document.getElementById("globalPeerSessionSearch").value || "";
+    const d = await api("/api/peers/global-sessions", { local: true, query: { query: q, agent: state.snapshot?.session?.agentId || void 0, limit: 50 } });
+    target.innerHTML = (d.targets || []).map((t) => '<div class="item"><strong>' + esc(t.peerName + " (" + t.peerId + ")") + ' <span class="adapter-status ' + (t.ok ? "enabled" : "disabled") + '">' + (t.ok ? "ok" : "error") + "</span></strong>" + (t.ok ? (t.data?.sessions || []).slice(0, 8).map((s) => "<small>" + esc(short(s.id, 48) + " | " + short(s.cwd || "", 80) + " | " + fmtDate(s.updatedAt)) + "</small>").join("") || "<small>No sessions.</small>" : '<small class="error">' + esc(t.error || "failed") + "</small>") + "</div>").join("") || '<div class="item">No peer sessions found.</div>';
+  }
+  function peerCard(p) {
+    const selected = state.selectedPeer === p.id ? ' <span class="chip">selected</span>' : "";
+    const health = p.remoteStatus || p.lastSeenAt ? "Health: " + (p.remoteStatus || "seen") + (p.lastLatencyMs !== void 0 ? " / " + p.lastLatencyMs + "ms" : "") + (p.remoteVersion ? " / v" + p.remoteVersion : "") : "Health: unchecked";
+    const aliases = Object.entries(p.workspaceAliases || {}).map(([a, w]) => a + "=" + w).join(", ");
+    return '<div class="item"><strong>' + esc(p.name) + ' <span class="adapter-status ' + (p.enabled ? "enabled" : "disabled") + '">' + (p.enabled ? "enabled" : "disabled") + "</span>" + selected + "</strong><small>" + esc("URL: " + (p.url || "-")) + "</small><small>" + esc("Node: " + p.nodeId + " / " + p.fingerprint) + "</small>" + (p.tlsFingerprint ? "<small>" + esc("TLS: " + p.tlsFingerprint) + "</small>" : "") + "<small>" + esc("Direction: " + p.direction + " / scopes " + (p.scopes || []).join(", ")) + "</small><small>" + esc("Agents: " + ((p.allowedAgents || []).join(", ") || "all")) + "</small><small>" + esc("Workspaces: " + ((p.allowedWorkspaceRoots || []).join(", ") || "all")) + "</small>" + (aliases ? "<small>" + esc("Aliases: " + aliases) + "</small>" : "") + "<small>" + esc(health) + "</small>" + (p.lastCheckedAt ? "<small>" + esc("Checked: " + fmtDate(p.lastCheckedAt)) + "</small>" : "") + (p.lastSeenAt ? "<small>" + esc("Last seen: " + fmtDate(p.lastSeenAt)) + "</small>" : "") + (p.lastError ? '<small class="error">' + esc("Last error: " + p.lastError) + "</small>" : "") + '<div class="row"><button data-peer-select="' + attr(p.id) + '">Use target</button><button class="secondary" data-peer-test="' + attr(p.id) + '">Test</button><button class="secondary" data-peer-edit="' + attr(p.id) + '"' + disabledAttr("peers.write") + '>Edit</button><button class="secondary" data-peer-toggle="' + attr(p.id) + '"' + disabledAttr("peers.write") + ">" + (p.enabled ? "Disable" : "Enable") + '</button><button class="danger" data-peer-revoke="' + attr(p.id) + '"' + disabledAttr("peers.write") + ">Revoke</button></div></div>";
+  }
+  function openPeerDialog(p) {
+    const aliases = Object.entries(p.workspaceAliases || {}).map(([a, w]) => a + "=" + w).join(", ");
+    adminDialog("Edit peer", '<label>Name<input id="dlgPeerName" value="' + attr(p.name || "") + '"></label><label>URL<input id="dlgPeerUrl" value="' + attr(p.url || "") + '"></label><label class="checkbox"><input id="dlgPeerEnabled" type="checkbox" ' + (p.enabled ? "checked" : "") + '> Enabled</label><label class="full-span">Scopes<input id="dlgPeerScopes" value="' + attr((p.scopes || []).join(", ")) + '"></label><label class="full-span">Allowed agents<input id="dlgPeerAgents" value="' + attr((p.allowedAgents || []).join(", ")) + '"></label><label class="full-span">Allowed workspace roots<input id="dlgPeerWorkspaces" value="' + attr((p.allowedWorkspaceRoots || []).join(", ")) + '"></label><label class="full-span">Workspace aliases<input id="dlgPeerAliases" placeholder="project=/srv/project, demo=/home/me/demo" value="' + attr(aliases) + '"></label>', async () => {
+      await api("/api/peers/" + encodeURIComponent(p.id), { method: "PATCH", body: JSON.stringify({ name: val("dlgPeerName"), url: val("dlgPeerUrl"), enabled: document.getElementById("dlgPeerEnabled").checked, scopes: csvToList(val("dlgPeerScopes")), allowedAgents: csvToList(val("dlgPeerAgents")), allowedWorkspaceRoots: csvToList(val("dlgPeerWorkspaces")), workspaceAliases: aliasMap(val("dlgPeerAliases")) }), local: true });
+      toast("Peer updated");
+      await loadPeers();
+    });
+  }
+  function openPeerInviteDialog() {
+    adminDialog("Create peer invite", '<label>Name<input id="dlgPeerInviteName" value="NordRelay peer"></label><label>Expires minutes<input id="dlgPeerInviteExpires" type="number" value="10" min="1" max="1440"></label><label class="full-span">Scopes<input id="dlgPeerInviteScopes" value="inspect, sessions.read, sessions.write, prompt.send, prompt.abort, queue.read, queue.write, files.read, files.write, diagnostics.read, logs.read"></label><label class="full-span">Allowed agents<input id="dlgPeerInviteAgents" value="codex, pi, hermes, openclaw, claude-code"></label><label class="full-span">Allowed workspace roots<input id="dlgPeerInviteWorkspaces" placeholder="empty means all"></label><label class="full-span">Workspace aliases<input id="dlgPeerInviteAliases" placeholder="project=/srv/project, demo=/home/me/demo"></label>', async () => {
+      const r = await api("/api/peers/invite", { method: "POST", body: JSON.stringify({ name: val("dlgPeerInviteName"), expiresMinutes: Number(val("dlgPeerInviteExpires") || 10), scopes: csvToList(val("dlgPeerInviteScopes")), allowedAgents: csvToList(val("dlgPeerInviteAgents")), allowedWorkspaceRoots: csvToList(val("dlgPeerInviteWorkspaces")), workspaceAliases: aliasMap(val("dlgPeerInviteAliases")) }), local: true });
+      toast("Pairing code: " + r.code + "\\n" + r.command, { duration: 2e4 });
+      await loadPeers();
+    });
+  }
+  function aliasMap(text) {
+    return Object.fromEntries((text || "").split(",").map((item) => item.split("=", 2).map((part) => part.trim())).filter(([a, w]) => a && w));
+  }
+  function bindPeerButtons() {
+    document.querySelectorAll("[data-peer-select]").forEach((b) => b.onclick = () => safe(async () => {
+      state.selectedPeer = b.dataset.peerSelect || "local";
+      localStorage.setItem("nordrelayPeerTarget", state.selectedPeer);
+      connectEvents();
+      await loadBootstrap();
+      toast("Peer target selected");
+    }));
+    document.querySelectorAll("[data-peer-test]").forEach((b) => b.onclick = () => safe(async () => {
+      const r = await api("/api/peers/" + encodeURIComponent(b.dataset.peerTest) + "/health", { local: true });
+      toast("Peer reachable: " + (r.data?.version ? "v" + r.data.version : "ok"), { duration: 6e3 });
+      loadPeers();
+    }));
+    document.querySelectorAll("[data-peer-edit]").forEach((b) => b.onclick = () => {
+      const p = (state.peers?.peers || []).find((x) => x.id === b.dataset.peerEdit);
+      if (p) openPeerDialog(p);
+    });
+    document.querySelectorAll("[data-peer-toggle]").forEach((b) => b.onclick = () => safe(async () => {
+      const p = (state.peers?.peers || []).find((x) => x.id === b.dataset.peerToggle);
+      if (!p) return;
+      await api("/api/peers/" + encodeURIComponent(p.id), { method: "PATCH", body: JSON.stringify({ enabled: !p.enabled }), local: true });
+      toast("Peer updated");
+      loadPeers();
+    }));
+    document.querySelectorAll("[data-peer-revoke]").forEach((b) => b.onclick = () => safe(async () => {
+      if (confirm("Revoke this peer?")) {
+        await api("/api/peers/" + encodeURIComponent(b.dataset.peerRevoke), { method: "DELETE", local: true });
+        if (state.selectedPeer === b.dataset.peerRevoke) {
+          state.selectedPeer = "local";
+          localStorage.setItem("nordrelayPeerTarget", "local");
+        }
+        toast("Peer revoked");
+        loadPeers();
+      }
+    }));
+  }
 })();