@silicaclaw/cli 2026.3.19-9 → 2026.3.20-10

package/apps/local-console/src/server.ts

@@ -1,37 +1,46 @@
 import express, { NextFunction, Request, Response } from "express";
 import cors from "cors";
-import { execFile, spawnSync } from "child_process";
+import { execFile, spawn, spawnSync } from "child_process";
 import { resolve } from "path";
 import { accessSync, constants, copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, statSync } from "fs";
 import { createHash } from "crypto";
-import { hostname } from "os";
+import { homedir, hostname } from "os";
 import { promisify } from "util";
+import defaults from "../../../config/silicaclaw-defaults.json";
 import {
   AgentIdentity,
   DirectoryState,
   IndexRefRecord,
+  PrivateEncryptionKeyPair,
+  PrivateMessageReceiptRecord,
+  PrivateMessageRecord,
   PresenceRecord,
   ProfileInput,
   PublicProfile,
   PublicProfileSummary,
   SignedProfileRecord,
   buildPublicProfileSummary,
-  buildIndexRecords,
   cleanupExpiredPresence,
   createDefaultProfileInput,
   createEmptyDirectoryState,
   createIdentity,
+  createPrivateEncryptionKeyPair,
   dedupeIndex,
+  decryptPrivatePayload,
   ensureDefaultSocialMd,
+  encryptPrivatePayload,
   ingestIndexRecord,
   ingestPresenceRecord,
   ingestProfileRecord,
   isAgentOnline,
+  rebuildIndexForProfile,
   loadSocialConfig,
   getSocialConfigSearchPaths,
   resolveIdentityWithSocial,
   resolveProfileInputWithSocial,
   searchDirectory,
+  signPrivateMessage,
+  signPrivateMessageReceipt,
   signSocialMessage,
   signSocialMessageObservation,
   signPresence,
@@ -44,6 +53,8 @@ import {
   verifySocialMessage,
   verifySocialMessageObservation,
   verifyPresence,
+  verifyPrivateMessage,
+  verifyPrivateMessageReceipt,
   verifyProfile,
 } from "@silicaclaw/core";
 import {
@@ -60,6 +71,9 @@ import {
   CacheRepo,
   IdentityRepo,
   LogRepo,
+  PrivateEncryptionKeyRepo,
+  PrivateMessageReceiptRepo,
+  PrivateMessageRepo,
   ProfileRepo,
   SocialMessageGovernanceConfig,
   SocialMessageGovernanceRepo,
@@ -79,21 +93,36 @@ const NETWORK_MAX_PAST_DRIFT_MS = Number(process.env.NETWORK_MAX_PAST_DRIFT_MS |
 const NETWORK_HEARTBEAT_INTERVAL_MS = Number(process.env.NETWORK_HEARTBEAT_INTERVAL_MS || 12_000);
 const NETWORK_PEER_STALE_AFTER_MS = Number(process.env.NETWORK_PEER_STALE_AFTER_MS || 45_000);
 const OPENCLAW_GATEWAY_HOST = "127.0.0.1";
-const OPENCLAW_GATEWAY_PORT = 18_789;
+const DEFAULT_NETWORK_MODE = defaults.network.default_mode as "global-preview";
+const DEFAULT_NETWORK_NAMESPACE = defaults.network.default_namespace;
+const DEFAULT_NETWORK_PORT = defaults.ports.network_default;
+const DEFAULT_GLOBAL_SIGNALING_URL = defaults.network.global_preview.relay_url;
+const DEFAULT_GLOBAL_ROOM = defaults.network.global_preview.room;
+const DEFAULT_BRIDGE_API_BASE = defaults.bridge.api_base;
+const OPENCLAW_GATEWAY_PORT = defaults.ports.openclaw_gateway;
 const OPENCLAW_GATEWAY_URL = `http://${OPENCLAW_GATEWAY_HOST}:${OPENCLAW_GATEWAY_PORT}/`;
+const OPENCLAW_RUNTIME_CACHE_MS = 15_000;
+const OPENCLAW_BRIDGE_STATUS_CACHE_MS = 5_000;
 const NETWORK_PEER_REMOVE_AFTER_MS = Number(process.env.NETWORK_PEER_REMOVE_AFTER_MS || 180_000);
+const DIRECTORY_REMOTE_PROFILE_SOFT_LIMIT = Number(process.env.DIRECTORY_REMOTE_PROFILE_SOFT_LIMIT || 1000);
 const NETWORK_UDP_BIND_ADDRESS = process.env.NETWORK_UDP_BIND_ADDRESS || "0.0.0.0";
 const NETWORK_UDP_BROADCAST_ADDRESS = process.env.NETWORK_UDP_BROADCAST_ADDRESS || "255.255.255.255";
 const NETWORK_PEER_ID = process.env.NETWORK_PEER_ID;
 const NETWORK_MODE = process.env.NETWORK_MODE || "";
-const WEBRTC_SIGNALING_URL = process.env.WEBRTC_SIGNALING_URL || "https://relay.silicaclaw.com";
+const WEBRTC_SIGNALING_URL = process.env.WEBRTC_SIGNALING_URL || DEFAULT_GLOBAL_SIGNALING_URL;
 const WEBRTC_SIGNALING_URLS = process.env.WEBRTC_SIGNALING_URLS || "";
-const WEBRTC_ROOM = process.env.WEBRTC_ROOM || "silicaclaw-global-preview";
+const WEBRTC_ROOM = process.env.WEBRTC_ROOM || DEFAULT_GLOBAL_ROOM;
 const WEBRTC_SEED_PEERS = process.env.WEBRTC_SEED_PEERS || "";
 const WEBRTC_BOOTSTRAP_HINTS = process.env.WEBRTC_BOOTSTRAP_HINTS || "";
 const PROFILE_VERSION = "v0.9";
 const SOCIAL_MESSAGE_TOPIC = "social.message";
 const SOCIAL_MESSAGE_OBSERVATION_TOPIC = "social.message.observation";
+const PRIVATE_MESSAGE_TOPIC = "private.message";
+const PRIVATE_MESSAGE_RECEIPT_TOPIC = "private.message.receipt";
+const PRIVATE_MESSAGE_HISTORY_LIMIT = Number(process.env.PRIVATE_MESSAGE_HISTORY_LIMIT || 1000);
+const PRIVATE_MESSAGE_RECEIPT_HISTORY_LIMIT = Number(process.env.PRIVATE_MESSAGE_RECEIPT_HISTORY_LIMIT || 2000);
+const PRIVATE_MESSAGE_QUERY_LIMIT = Number(process.env.PRIVATE_MESSAGE_QUERY_LIMIT || 100);
+const PRIVATE_MESSAGE_PERSIST_DEBOUNCE_MS = Number(process.env.PRIVATE_MESSAGE_PERSIST_DEBOUNCE_MS || 750);
 const DEFAULT_SOCIAL_MESSAGE_CHANNEL = "global";
 const SOCIAL_MESSAGE_MAX_BODY_CHARS = Number(process.env.SOCIAL_MESSAGE_MAX_BODY_CHARS || 500);
 const SOCIAL_MESSAGE_HISTORY_LIMIT = Number(process.env.SOCIAL_MESSAGE_HISTORY_LIMIT || 100);
@@ -105,6 +134,14 @@ const SOCIAL_MESSAGE_DUPLICATE_WINDOW_MS = Number(process.env.SOCIAL_MESSAGE_DUP
 const SOCIAL_MESSAGE_MAX_FUTURE_MS = Number(process.env.SOCIAL_MESSAGE_MAX_FUTURE_MS || 30_000);
 const SOCIAL_MESSAGE_MAX_AGE_MS = Number(process.env.SOCIAL_MESSAGE_MAX_AGE_MS || 15 * 60_000);
 const SOCIAL_MESSAGE_OBSERVATION_HISTORY_LIMIT = Number(process.env.SOCIAL_MESSAGE_OBSERVATION_HISTORY_LIMIT || 500);
+const SOCIAL_MESSAGE_REPLAY_WINDOW_MS = Number(process.env.SOCIAL_MESSAGE_REPLAY_WINDOW_MS || 10 * 60_000);
+const SOCIAL_MESSAGE_REPLAY_MAX_PER_BROADCAST = Number(process.env.SOCIAL_MESSAGE_REPLAY_MAX_PER_BROADCAST || 3);
+const SOCIAL_MESSAGE_REPLAY_REFRESH_INTERVAL_MS = Number(
+  process.env.SOCIAL_MESSAGE_REPLAY_REFRESH_INTERVAL_MS || 120_000
+);
+const PROFILE_RELAY_REFRESH_INTERVAL_MS = Number(
+  process.env.PROFILE_RELAY_REFRESH_INTERVAL_MS || 120_000
+);
 const SOCIAL_MESSAGE_BLOCKED_AGENT_IDS = new Set(
   dedupeStrings(parseListEnv(process.env.SOCIAL_MESSAGE_BLOCKED_AGENT_IDS || ""))
 );
@@ -115,23 +152,79 @@ const execFileAsync = promisify(execFile);
 const OPENCLAW_SKILL_NAME = "silicaclaw-broadcast";
 
 function readWorkspaceVersion(workspaceRoot: string): string {
-  const pkgFile = resolve(workspaceRoot, "package.json");
-  if (existsSync(pkgFile)) {
-    try {
-      const pkg = JSON.parse(readFileSync(pkgFile, "utf8")) as { version?: string };
-      if (pkg.version) return String(pkg.version);
-    } catch {
-      // ignore
+  const candidates = [
+    workspaceRoot,
+    process.cwd(),
+    resolve(__dirname, "..", "..", ".."),
+    resolve(__dirname, "..", "..", "..", ".."),
+  ].filter((dir, index, list) => dir && list.indexOf(dir) === index);
+  for (const candidate of candidates) {
+    const pkgFile = resolve(candidate, "package.json");
+    if (existsSync(pkgFile)) {
+      try {
+        const pkg = JSON.parse(readFileSync(pkgFile, "utf8")) as { version?: string; name?: string };
+        if (pkg.version && (pkg.name === "@silicaclaw/cli" || existsSync(resolve(candidate, "apps", "local-console")))) {
+          return String(pkg.version);
+        }
+      } catch {
+        // ignore
+      }
+    }
+    const versionFile = resolve(candidate, "VERSION");
+    if (existsSync(versionFile)) {
+      const raw = readFileSync(versionFile, "utf8").trim();
+      if (raw) return raw;
     }
-  }
-  const versionFile = resolve(workspaceRoot, "VERSION");
-  if (existsSync(versionFile)) {
-    const raw = readFileSync(versionFile, "utf8").trim();
-    if (raw) return raw;
   }
   return "unknown";
 }
 
+function normalizeVersionText(value: unknown): string {
+  const text = String(value || "").trim();
+  return text.startsWith("v") ? text.slice(1) : text;
+}
+
+function formatBytesToMiB(value: number): number {
+  return Math.round((value / (1024 * 1024)) * 10) / 10;
+}
+
+function tokenizeVersion(value: unknown): Array<number | string> {
+  return normalizeVersionText(value)
+    .split(/[^0-9A-Za-z]+/)
+    .map((token) => token.trim())
+    .filter(Boolean)
+    .map((token) => (/^\d+$/.test(token) ? Number(token) : token.toLowerCase()));
+}
+
+function compareVersionTokens(left: unknown, right: unknown): number {
+  const leftTokens = tokenizeVersion(left);
+  const rightTokens = tokenizeVersion(right);
+  const maxLength = Math.max(leftTokens.length, rightTokens.length);
+  for (let index = 0; index < maxLength; index += 1) {
+    const leftToken = leftTokens[index];
+    const rightToken = rightTokens[index];
+    if (leftToken === undefined && rightToken === undefined) return 0;
+    if (leftToken === undefined) return -1;
+    if (rightToken === undefined) return 1;
+    if (typeof leftToken === "number" && typeof rightToken === "number") {
+      if (leftToken !== rightToken) return leftToken > rightToken ? 1 : -1;
+      continue;
+    }
+    const leftText = String(leftToken);
+    const rightText = String(rightToken);
+    if (leftText !== rightText) return leftText.localeCompare(rightText);
+  }
+  return 0;
+}
+
+function userNpmCacheDir(): string {
+  return resolve(homedir(), ".silicaclaw", "npm-cache");
+}
+
+function userShimPath(): string {
+  return resolve(homedir(), ".silicaclaw", "bin", "silicaclaw");
+}
+
 function resolveWorkspaceRoot(cwd = process.cwd()): string {
   if (existsSync(resolve(cwd, "apps", "local-console", "package.json"))) {
     return cwd;
@@ -143,7 +236,36 @@ function resolveWorkspaceRoot(cwd = process.cwd()): string {
   return cwd;
 }
 
+function resolveProjectRoot(appRoot: string, cwd = process.cwd()): string {
+  const envAppRoot = String(process.env.SILICACLAW_APP_DIR || "").trim();
+  if (
+    envAppRoot &&
+    existsSync(resolve(envAppRoot, "apps", "local-console", "package.json")) &&
+    existsSync(resolve(envAppRoot, "package.json"))
+  ) {
+    return resolve(envAppRoot);
+  }
+  const envRoot = String(process.env.SILICACLAW_WORKSPACE_DIR || "").trim();
+  if (envRoot) {
+    return resolve(envRoot);
+  }
+  if (
+    existsSync(resolve(appRoot, "apps", "local-console", "package.json")) &&
+    existsSync(resolve(appRoot, "package.json"))
+  ) {
+    return appRoot;
+  }
+  if (!existsSync(resolve(cwd, "apps", "local-console", "package.json"))) {
+    return resolve(cwd);
+  }
+  return appRoot;
+}
+
 function resolveStorageRoot(workspaceRoot: string, cwd = process.cwd()): string {
+  const home = process.env.HOME || homedir();
+  if (home) {
+    return resolve(home, ".silicaclaw", "local-console");
+  }
   const appRoot = resolve(workspaceRoot, "apps", "local-console");
   if (existsSync(resolve(appRoot, "package.json"))) {
     return appRoot;
@@ -151,6 +273,13 @@ function resolveStorageRoot(workspaceRoot: string, cwd = process.cwd()): string
   return cwd;
 }
 
+function defaultOpenClawSourceDir(rootDir: string): string {
+  if (existsSync(resolve(rootDir, "openclaw.mjs")) || existsSync(resolve(rootDir, "package.json"))) {
+    return rootDir;
+  }
+  return resolve(rootDir, "..", "openclaw");
+}
+
 function resolveExecutableInPath(binName: string): string | null {
   const pathValue = String(process.env.PATH || "").trim();
   if (!pathValue) return null;
@@ -213,6 +342,50 @@ function summarizeSkillReadme(filePath: string) {
   }
 }
 
+function readDialogueCheatsheetPreview(filePath: string, limit = 6) {
+  if (!filePath || !existsSync(filePath)) return [];
+  try {
+    return readFileSync(filePath, "utf8")
+      .split(/\r?\n/)
+      .map((line) => line.trim())
+      .filter((line) => line.startsWith("- "))
+      .map((line) => line.slice(2).trim())
+      .filter(Boolean)
+      .slice(0, limit);
+  } catch {
+    return [];
+  }
+}
+
+function readDialogueCheatsheetSections(filePath: string, maxSections = 3, maxItemsPerSection = 5) {
+  if (!filePath || !existsSync(filePath)) return [];
+  try {
+    const lines = readFileSync(filePath, "utf8").split(/\r?\n/);
+    const sections: Array<{ title: string; items: string[] }> = [];
+    let current: { title: string; items: string[] } | null = null;
+    for (const rawLine of lines) {
+      const line = rawLine.trim();
+      if (line.startsWith("## ")) {
+        if (current && current.items.length) sections.push(current);
+        current = { title: line.slice(3).trim(), items: [] };
+        continue;
+      }
+      if (line.startsWith("- ")) {
+        if (!current) {
+          current = { title: "Examples", items: [] };
+        }
+        if (current.items.length < maxItemsPerSection) {
+          current.items.push(line.slice(2).trim());
+        }
+      }
+    }
+    if (current && current.items.length) sections.push(current);
+    return sections.slice(0, maxSections);
+  } catch {
+    return [];
+  }
+}
+
 function detectOpenClawInstallation(workspaceRoot: string) {
   const workspaceDir = resolve(workspaceRoot, ".openclaw");
   const homeDir = resolve(process.env.HOME || "", ".openclaw");
@@ -265,7 +438,7 @@ function detectOpenClawInstallation(workspaceRoot: string) {
 
 function readOpenClawConfiguredGateway(workspaceRoot: string) {
   const configuredSourceDir = String(process.env.OPENCLAW_SOURCE_DIR || "").trim();
-  const defaultSourceDir = resolve(workspaceRoot, "..", "openclaw");
+  const defaultSourceDir = defaultOpenClawSourceDir(workspaceRoot);
   const sourceDir = configuredSourceDir || defaultSourceDir;
   const homeDir = resolve(process.env.HOME || "", ".openclaw");
   const explicitConfigPath = String(process.env.OPENCLAW_CONFIG_PATH || "").trim();
@@ -307,45 +480,66 @@ function readOpenClawConfiguredGateway(workspaceRoot: string) {
   } as const;
 }
 
-function detectOpenClawRuntime(workspaceRoot: string) {
-  const configuredGateway = readOpenClawConfiguredGateway(workspaceRoot);
-  const result = spawnSync("ps", ["-Ao", "pid=,ppid=,command="], {
-    encoding: "utf8",
-  });
-  const stdout = String(result.stdout || "");
-  const lines = stdout
-    .split("\n")
-    .map((line) => line.trim())
-    .filter(Boolean);
+function resolveOpenClawStatusCommand(workspaceRoot: string) {
+  const explicitBin = String(process.env.OPENCLAW_BIN || "").trim();
+  if (explicitBin) {
+    return { cmd: explicitBin, args: ["status"] } as const;
+  }
 
-  const processes = lines
-    .map((line) => {
-      const match = line.match(/^(\d+)\s+(\d+)\s+(.+)$/);
-      if (!match) return null;
-      const command = match[3] || "";
-      const lower = command.toLowerCase();
-      const isOpenClaw =
-        lower.includes(" openclaw ") ||
-        lower.endsWith(" openclaw") ||
-        lower.includes("/openclaw ") ||
-        lower.includes("openclaw.mjs") ||
-        lower.includes("openclaw gateway") ||
-        lower.includes("openclaw agent") ||
-        lower.includes("openclaw message");
-      if (!isOpenClaw) return null;
-      return {
-        pid: Number(match[1]),
-        ppid: Number(match[2]),
-        command,
-      };
-    })
-    .filter((item): item is { pid: number; ppid: number; command: string } => Boolean(item));
+  const configuredSourceDir = String(process.env.OPENCLAW_SOURCE_DIR || "").trim();
+  const defaultSourceDir = defaultOpenClawSourceDir(workspaceRoot);
+  const sourceDir = configuredSourceDir || defaultSourceDir;
+  const sourceEntry = existingPathOrNull(resolve(sourceDir, "openclaw.mjs"));
+  if (sourceEntry) {
+    return { cmd: process.execPath, args: [sourceEntry, "status"] } as const;
+  }
+
+  const commandPath = resolveExecutableInPath("openclaw");
+  if (commandPath) {
+    return { cmd: commandPath, args: ["status"] } as const;
+  }
+
+  return null;
+}
+
+function resolveOpenClawGatewayProbeCommand(workspaceRoot: string) {
+  const explicitBin = String(process.env.OPENCLAW_BIN || "").trim();
+  if (explicitBin) {
+    return { cmd: explicitBin, args: ["gateway", "probe"] } as const;
+  }
 
-  const openclawPids = new Set(processes.map((item) => item.pid));
-  const gatewayProbe = spawnSync("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN"], {
+  const configuredSourceDir = String(process.env.OPENCLAW_SOURCE_DIR || "").trim();
+  const defaultSourceDir = defaultOpenClawSourceDir(workspaceRoot);
+  const sourceDir = configuredSourceDir || defaultSourceDir;
+  const sourceEntry = existingPathOrNull(resolve(sourceDir, "openclaw.mjs"));
+  if (sourceEntry) {
+    return { cmd: process.execPath, args: [sourceEntry, "gateway", "probe"] } as const;
+  }
+
+  const commandPath = resolveExecutableInPath("openclaw");
+  if (commandPath) {
+    return { cmd: commandPath, args: ["gateway", "probe"] } as const;
+  }
+
+  return null;
+}
+
+function detectOpenClawRuntime(workspaceRoot: string) {
+  const configuredGateway = readOpenClawConfiguredGateway(workspaceRoot);
+  const statusCommand = resolveOpenClawStatusCommand(workspaceRoot);
+  const statusLooksConfigured = Boolean(
+    statusCommand ||
+    configuredGateway.config_path ||
+    detectOpenClawInstallation(workspaceRoot).detected
+  );
+  const gatewayProbeCommand = ["lsof", "-nP", `-iTCP:${configuredGateway.gateway_port}`, "-sTCP:LISTEN"];
+  const gatewayProbe = spawnSync(gatewayProbeCommand[0], gatewayProbeCommand.slice(1), {
     encoding: "utf8",
+    timeout: 1200,
   });
-  const gatewayLines = String(gatewayProbe.stdout || "")
+  const gatewayStatusStdout = String(gatewayProbe.stdout || "");
+  const gatewayStatusStderr = String(gatewayProbe.stderr || "");
+  const gatewayLines = gatewayStatusStdout
     .split("\n")
     .map((line) => line.trim())
     .filter(Boolean);
@@ -355,14 +549,9 @@ function detectOpenClawRuntime(workspaceRoot: string) {
       const parts = line.split(/\s+/);
       const pid = Number(parts[1] || 0);
       const command = parts[0] || "";
-      const lowerCommand = command.toLowerCase();
       const endpoint = parts[8] || parts[parts.length - 1] || "";
       const portMatch = endpoint.match(/:(\d+)(?:\s*\(|$)/);
       if (!pid || !command || !portMatch) return null;
-      const isOpenClawListener =
-        openclawPids.has(pid) ||
-        lowerCommand.includes("openclaw");
-      if (!isOpenClawListener) return null;
       const port = Number(portMatch[1]);
       if (!Number.isFinite(port) || port <= 0) return null;
       return {
@@ -373,46 +562,106 @@ function detectOpenClawRuntime(workspaceRoot: string) {
       };
     })
     .filter((item): item is { pid: number; ppid: number; port: number; command: string } => Boolean(item));
+  const gatewayProbeOk = gatewayListeners.length > 0;
+  let processes: Array<{ pid: number; ppid: number; command: string }> = gatewayListeners.map((item) => ({
+    pid: item.pid,
+    ppid: item.ppid,
+    command: item.command,
+  }));
+  let processResult: ReturnType<typeof spawnSync> | null = null;
+  if (!gatewayProbeOk) {
+    processResult = spawnSync("ps", ["-Ao", "pid=,ppid=,command="], {
+      encoding: "utf8",
+      timeout: 1200,
+    });
+    const stdout = String(processResult.stdout || "");
+    const lines = stdout
+      .split("\n")
+      .map((line) => line.trim())
+      .filter(Boolean);
+    processes = lines
+      .map((line) => {
+        const match = line.match(/^(\d+)\s+(\d+)\s+(.+)$/);
+        if (!match) return null;
+        const command = match[3] || "";
+        const lower = command.toLowerCase();
+        const isOpenClaw =
+          lower.includes(" openclaw ") ||
+          lower.endsWith(" openclaw") ||
+          lower.includes("/openclaw ") ||
+          lower.includes("openclaw.mjs") ||
+          lower.includes("openclaw gateway") ||
+          lower.includes("openclaw agent") ||
+          lower.includes("openclaw message");
+        if (!isOpenClaw) return null;
+        return {
+          pid: Number(match[1]),
+          ppid: Number(match[2]),
+          command,
+        };
+      })
+      .filter((item): item is { pid: number; ppid: number; command: string } => Boolean(item));
+  }
+
   const preferredListener =
     gatewayListeners.find((item) => item.port === configuredGateway.gateway_port) ||
     gatewayListeners[0] ||
     null;
-
-  const combinedProcesses = new Map<number, { pid: number; ppid: number; command: string }>();
-  for (const process of [...processes, ...gatewayListeners]) {
-    if (!combinedProcesses.has(process.pid)) {
-      combinedProcesses.set(process.pid, process);
-      continue;
-    }
-    const current = combinedProcesses.get(process.pid);
-    if (current && current.command.length < process.command.length) {
-      combinedProcesses.set(process.pid, process);
-    }
-  }
-  const allProcesses = Array.from(combinedProcesses.values());
-  const gatewayReachable = gatewayListeners.length > 0;
+  const allProcesses = processes.slice(0, 10);
+  const gatewayReachable = gatewayProbeOk;
   const detectionNotes = [];
-  if (result.status !== 0) detectionNotes.push(String(result.stderr || "ps failed").trim());
   if (gatewayProbe.status !== 0 && gatewayLines.length === 0) {
-    detectionNotes.push(String(gatewayProbe.stderr || "lsof failed").trim());
+    detectionNotes.push(String(gatewayStatusStderr || "openclaw gateway probe failed").trim());
+  }
+  if (processResult && processResult.status !== 0) {
+    detectionNotes.push(String(processResult.stderr || "ps failed").trim());
   }
   const gatewayPort = preferredListener?.port || configuredGateway.gateway_port;
   const gatewayUrl = `http://${OPENCLAW_GATEWAY_HOST}:${gatewayPort}/`;
 
   return {
-    running: allProcesses.length > 0 || gatewayReachable,
+    running: gatewayProbeOk || allProcesses.length > 0 || gatewayReachable,
     process_count: allProcesses.length,
     processes: allProcesses.slice(0, 10),
     detection_error: detectionNotes.filter(Boolean).join(" | ") || null,
     gateway_url: gatewayUrl,
     gateway_port: gatewayPort,
     gateway_reachable: gatewayReachable,
+    status_command: statusCommand ? [statusCommand.cmd, ...statusCommand.args].join(" ") : null,
+    status_ok: statusLooksConfigured,
+    status_summary: statusLooksConfigured
+      ? configuredGateway.config_path
+        ? `configured via ${configuredGateway.config_path}`
+        : statusCommand
+          ? `command available: ${[statusCommand.cmd, ...statusCommand.args].join(" ")}`
+          : "OpenClaw environment detected"
+      : null,
+    gateway_probe_command: gatewayProbeCommand.join(" "),
+    gateway_probe_ok: gatewayProbeOk,
+    gateway_probe_summary: gatewayProbeOk
+      ? gatewayStatusStdout
+          .split("\n")
+          .map((line) => line.trim())
+          .filter(Boolean)
+          .slice(0, 4)
+          .join(" | ")
+      : null,
     configured_gateway_url: configuredGateway.gateway_url,
     configured_gateway_port: configuredGateway.gateway_port,
     configured_gateway_bind: configuredGateway.gateway_bind,
     configured_gateway_config_path: configuredGateway.config_path,
     detection_mode:
-      processes.length > 0 && gatewayReachable
+      gatewayProbeOk
+        ? (
+          processes.length > 0 && gatewayReachable
+            ? "gateway-probe+process+gateway"
+            : gatewayReachable
+              ? "gateway-probe+gateway"
+              : processes.length > 0
+                ? "gateway-probe+process"
+                : "gateway-probe"
+        )
+        : processes.length > 0 && gatewayReachable
         ? "process+gateway"
         : gatewayReachable
           ? "gateway"
@@ -453,7 +702,7 @@ function detectOwnerDeliveryStatus(params: {
   const ownerAccount = String(process.env.OPENCLAW_OWNER_ACCOUNT || "").trim();
   const explicitOpenClawBin = String(process.env.OPENCLAW_BIN || "").trim();
   const configuredSourceDir = String(process.env.OPENCLAW_SOURCE_DIR || "").trim();
-  const defaultSourceDir = resolve(params.workspaceRoot, "..", "openclaw");
+  const defaultSourceDir = defaultOpenClawSourceDir(params.workspaceRoot);
   const openclawSourceDir = configuredSourceDir || defaultSourceDir;
   const openclawSourceEntry = existingPathOrNull(resolve(openclawSourceDir, "openclaw.mjs"));
   const openclawCommandResolvable = Boolean(explicitOpenClawBin || resolveExecutableInPath("openclaw") || openclawSourceEntry);
@@ -512,10 +761,18 @@ function hasMeaningfulJson(filePath: string): boolean {
   }
 }
 
-function migrateLegacyDataIfNeeded(workspaceRoot: string, storageRoot: string): void {
-  const legacyDataDir = resolve(workspaceRoot, "data");
+function migrateLegacyDataIfNeeded(appRoot: string, projectRoot: string, storageRoot: string): void {
+  const homeDir = process.env.HOME || homedir();
+  const legacyNpxAppRoots = collectLegacyNpxAppRoots(homeDir);
   const targetDataDir = resolve(storageRoot, "data");
-  if (legacyDataDir === targetDataDir) return;
+  const legacyDataDirs = [
+    resolve(appRoot, "data"),
+    resolve(appRoot, "apps", "local-console", "data"),
+    resolve(projectRoot, "data"),
+    resolve(projectRoot, "apps", "local-console", "data"),
+    resolve(process.cwd(), "data"),
+    ...legacyNpxAppRoots.map((root) => resolve(root, "apps", "local-console", "data")),
+  ].filter((dir, index, list) => list.indexOf(dir) === index && dir !== targetDataDir);
   const files = [
     "identity.json",
     "profile.json",
@@ -525,16 +782,65 @@ function migrateLegacyDataIfNeeded(workspaceRoot: string, storageRoot: string):
     "social-message-observations.json",
   ];
   for (const file of files) {
-    const src = resolve(legacyDataDir, file);
     const dst = resolve(targetDataDir, file);
-    if (!existsSync(src)) continue;
     if (hasMeaningfulJson(dst)) continue;
-    if (!hasMeaningfulJson(src)) continue;
-    mkdirSync(targetDataDir, { recursive: true });
-    copyFileSync(src, dst);
+    for (const legacyDataDir of legacyDataDirs) {
+      const src = resolve(legacyDataDir, file);
+      if (!existsSync(src)) continue;
+      if (!hasMeaningfulJson(src)) continue;
+      mkdirSync(targetDataDir, { recursive: true });
+      copyFileSync(src, dst);
+      break;
+    }
+  }
+
+  const targetDotDir = resolve(storageRoot, ".silicaclaw");
+  const legacyDotDirs = [
+    resolve(appRoot, ".silicaclaw"),
+    resolve(appRoot, "apps", "local-console", ".silicaclaw"),
+    resolve(projectRoot, ".silicaclaw"),
+    resolve(projectRoot, "apps", "local-console", ".silicaclaw"),
+    resolve(process.cwd(), ".silicaclaw"),
+    ...legacyNpxAppRoots.map((root) => resolve(root, "apps", "local-console", ".silicaclaw")),
+  ].filter((dir, index, list) => list.indexOf(dir) === index && dir !== targetDotDir);
+  const dotFiles = ["social.runtime.json", "social.message-governance.json"];
+  for (const file of dotFiles) {
+    const dst = resolve(targetDotDir, file);
+    if (hasMeaningfulJson(dst)) continue;
+    for (const legacyDotDir of legacyDotDirs) {
+      const src = resolve(legacyDotDir, file);
+      if (!existsSync(src)) continue;
+      if (!hasMeaningfulJson(src)) continue;
+      mkdirSync(targetDotDir, { recursive: true });
+      copyFileSync(src, dst);
+      break;
+    }
   }
 }
 
+function collectLegacyNpxAppRoots(homeDir: string): string[] {
+  const cacheRoots = [
+    resolve(homeDir, ".silicaclaw", "npm-cache", "_npx"),
+    resolve(homeDir, ".npm", "_npx"),
+  ];
+  const roots: string[] = [];
+  for (const cacheRoot of cacheRoots) {
+    if (!existsSync(cacheRoot)) continue;
+    let entries: string[] = [];
+    try {
+      entries = readdirSync(cacheRoot);
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const candidate = resolve(cacheRoot, entry, "node_modules", "@silicaclaw", "cli");
+      if (!existsSync(resolve(candidate, "apps", "local-console"))) continue;
+      roots.push(candidate);
+    }
+  }
+  return Array.from(new Set(roots));
+}
+
 function parseListEnv(raw: string): string[] {
   return raw
     .split(/[,\n]/g)
@@ -575,6 +881,7 @@ type IntegrationStatusSummary = {
 };
 
 type SocialMessageView = SocialMessageRecord & {
+  avatar_url?: string;
   is_self: boolean;
   online: boolean;
   last_seen_at: number | null;
@@ -584,6 +891,17 @@ type SocialMessageView = SocialMessageRecord & {
   delivery_status: "local-only" | "remote-observed";
 };
 
+type PrivateMessageView = {
+  message_id: string;
+  conversation_id: string;
+  from_agent_id: string;
+  to_agent_id: string;
+  body: string;
+  created_at: number;
+  is_self: boolean;
+  delivery_status: "sent" | "received" | "read";
+};
+
 type RuntimeMessageGovernance = SocialMessageGovernanceConfig;
 
 type OpenClawBridgeStatus = {
@@ -627,11 +945,17 @@ type OpenClawBridgeStatus = {
     gateway_url: string;
     gateway_port: number;
     gateway_reachable: boolean;
+    status_command: string | null;
+    status_ok: boolean;
+    status_summary: string | null;
+    gateway_probe_command: string | null;
+    gateway_probe_ok: boolean;
+    gateway_probe_summary: string | null;
     configured_gateway_url: string;
     configured_gateway_port: number;
     configured_gateway_bind: string | null;
     configured_gateway_config_path: string | null;
-    detection_mode: "process" | "gateway" | "process+gateway" | "not_running";
+    detection_mode: "gateway-probe" | "gateway-probe+process" | "gateway-probe+gateway" | "gateway-probe+process+gateway" | "process" | "gateway" | "process+gateway" | "not_running";
   };
   skill_learning: {
     available: boolean;
@@ -699,6 +1023,7 @@ type OpenClawBridgeConfigView = {
 
 export class LocalNodeService {
   private workspaceRoot: string;
+  private projectRoot: string;
   private storageRoot: string;
   private identityRepo: IdentityRepo;
   private profileRepo: ProfileRepo;
@@ -707,6 +1032,9 @@ export class LocalNodeService {
   private socialMessageGovernanceRepo: SocialMessageGovernanceRepo;
   private socialMessageRepo: SocialMessageRepo;
   private socialMessageObservationRepo: SocialMessageObservationRepo;
+  private privateMessageRepo: PrivateMessageRepo;
+  private privateMessageReceiptRepo: PrivateMessageReceiptRepo;
+  private privateEncryptionKeyRepo: PrivateEncryptionKeyRepo;
   private socialRuntimeRepo: SocialRuntimeRepo;
 
   private identity: AgentIdentity | null = null;
@@ -714,15 +1042,31 @@ export class LocalNodeService {
   private directory: DirectoryState = createEmptyDirectoryState();
   private socialMessages: SocialMessageRecord[] = [];
   private socialMessageObservations: SocialMessageObservationRecord[] = [];
+  private privateMessages: PrivateMessageRecord[] = [];
+  private privateMessageReceipts: PrivateMessageReceiptRecord[] = [];
+  private privateEncryptionKeyPair: PrivateEncryptionKeyPair | null = null;
+  private privatePeerRoutes: Record<string, string> = {};
+  private privateMessageBodyCache = new Map<string, string>();
   private messageGovernance: RuntimeMessageGovernance;
+  private privateMessagesPersistDirty = false;
+  private privateMessageReceiptsPersistDirty = false;
+  private privateMessagesPersistTimer: NodeJS.Timeout | null = null;
+  private privateMessageReceiptsPersistTimer: NodeJS.Timeout | null = null;
 
   private receivedCount = 0;
   private broadcastCount = 0;
   private lastMessageAt = 0;
   private lastBroadcastAt = 0;
+  private lastProfileBroadcastAt = 0;
+  private lastProfileBroadcastSignature = "";
+  private lastReplayBroadcastAt = 0;
+  private lastReplayBroadcastSignature = "";
   private lastBroadcastErrorAt = 0;
   private lastBroadcastError: string | null = null;
   private broadcastFailureCount = 0;
+  private consecutiveBroadcastFailures = 0;
+  private lastBroadcastRecoveryAttemptAt = 0;
+  private broadcastRecoveryInFlight = false;
   private broadcaster: NodeJS.Timeout | null = null;
   private subscriptionsBound = false;
   private broadcastEnabled = true;
@@ -741,7 +1085,7 @@ export class LocalNodeService {
 
   private network: NetworkAdapter;
   private adapterMode: "mock" | "local-event-bus" | "real-preview" | "webrtc-preview" | "relay-preview";
-  private networkMode: "local" | "lan" | "global-preview" = "global-preview";
+  private networkMode: "local" | "lan" | "global-preview" = DEFAULT_NETWORK_MODE;
   private networkNamespace: string;
   private networkPort: number | null;
   private socialConfig: SocialConfig;
@@ -755,17 +1099,24 @@ export class LocalNodeService {
     "silicaclaw-existing";
   private resolvedOpenClawIdentityPath: string | null = null;
   private webrtcSignalingUrls: string[] = [];
-  private webrtcRoom = "silicaclaw-global-preview";
+  private webrtcRoom = DEFAULT_GLOBAL_ROOM;
   private webrtcSeedPeers: string[] = [];
   private webrtcBootstrapHints: string[] = [];
   private webrtcBootstrapSources: string[] = [];
+  private networkStarted = false;
+  private networkStartupError: string | null = null;
+  private networkReconnectTimer: NodeJS.Timeout | null = null;
+  private networkReconnectDelayMs = 5_000;
   private appVersion = "unknown";
+  private openclawRuntimeCache: { value: ReturnType<typeof detectOpenClawRuntime>; expiresAt: number } | null = null;
+  private openclawBridgeStatusCache: { value: OpenClawBridgeStatus; expiresAt: number } | null = null;
 
-  constructor(options?: { workspaceRoot?: string; storageRoot?: string }) {
+  constructor(options?: { workspaceRoot?: string; projectRoot?: string; storageRoot?: string }) {
     this.workspaceRoot = options?.workspaceRoot || resolveWorkspaceRoot();
+    this.projectRoot = options?.projectRoot || resolveProjectRoot(this.workspaceRoot);
     this.storageRoot = options?.storageRoot || resolveStorageRoot(this.workspaceRoot);
     this.appVersion = readWorkspaceVersion(this.workspaceRoot);
-    migrateLegacyDataIfNeeded(this.workspaceRoot, this.storageRoot);
+    migrateLegacyDataIfNeeded(this.workspaceRoot, this.projectRoot, this.storageRoot);
 
     this.identityRepo = new IdentityRepo(this.storageRoot);
     this.profileRepo = new ProfileRepo(this.storageRoot);
@@ -774,19 +1125,22 @@ export class LocalNodeService {
     this.socialMessageGovernanceRepo = new SocialMessageGovernanceRepo(this.storageRoot);
     this.socialMessageRepo = new SocialMessageRepo(this.storageRoot);
     this.socialMessageObservationRepo = new SocialMessageObservationRepo(this.storageRoot);
+    this.privateMessageRepo = new PrivateMessageRepo(this.storageRoot);
+    this.privateMessageReceiptRepo = new PrivateMessageReceiptRepo(this.storageRoot);
+    this.privateEncryptionKeyRepo = new PrivateEncryptionKeyRepo(this.storageRoot);
     this.socialRuntimeRepo = new SocialRuntimeRepo(this.storageRoot);
     this.messageGovernance = this.defaultMessageGovernance();
 
-    let loadedSocial = loadSocialConfig(this.workspaceRoot);
+    let loadedSocial = loadSocialConfig(this.projectRoot);
     if (!loadedSocial.meta.found) {
-      ensureDefaultSocialMd(this.workspaceRoot, {
+      ensureDefaultSocialMd(this.projectRoot, {
         display_name: this.getDefaultDisplayName(),
         bio: "Local AI agent connected to SilicaClaw",
         tags: ["openclaw", "local-first"],
-        mode: "global-preview",
+        mode: DEFAULT_NETWORK_MODE,
         public_enabled: false,
       });
-      loadedSocial = loadSocialConfig(this.workspaceRoot);
+      loadedSocial = loadSocialConfig(this.projectRoot);
       this.initState.social_auto_created = true;
     }
     this.socialConfig = loadedSocial.config;
@@ -795,8 +1149,8 @@ export class LocalNodeService {
     this.socialParseError = loadedSocial.meta.parse_error;
     this.socialRawFrontmatter = loadedSocial.raw_frontmatter;
 
-    this.networkNamespace = this.socialConfig.network.namespace || process.env.NETWORK_NAMESPACE || "silicaclaw.preview";
-    this.networkPort = Number(this.socialConfig.network.port || process.env.NETWORK_PORT || 44123);
+    this.networkNamespace = this.socialConfig.network.namespace || process.env.NETWORK_NAMESPACE || DEFAULT_NETWORK_NAMESPACE;
+    this.networkPort = Number(this.socialConfig.network.port || process.env.NETWORK_PORT || DEFAULT_NETWORK_PORT);
     this.applyResolvedNetworkConfig();
     const resolved = this.buildNetworkAdapter();
     this.network = resolved.adapter;
@@ -804,36 +1158,42 @@ export class LocalNodeService {
     this.networkPort = resolved.port;
   }
 
+  private getCachedOpenClawRuntime() {
+    const now = Date.now();
+    if (this.openclawRuntimeCache && this.openclawRuntimeCache.expiresAt > now) {
+      return this.openclawRuntimeCache.value;
+    }
+    const value = detectOpenClawRuntime(this.projectRoot);
+    this.openclawRuntimeCache = {
+      value,
+      expiresAt: now + OPENCLAW_RUNTIME_CACHE_MS,
+    };
+    return value;
+  }
+
+  private invalidateOpenClawCaches() {
+    this.openclawRuntimeCache = null;
+    this.openclawBridgeStatusCache = null;
+  }
+
   async start(): Promise<void> {
     await this.hydrateFromDisk();
 
     this.bindNetworkSubscriptions();
-    await this.network.start();
-    await this.log(
-      "info",
-      `Local node started (${this.adapterMode}, mode=${this.networkMode}, signaling=${this.webrtcSignalingUrls[0] || "-"}, room=${this.webrtcRoom})`
-    );
-
-    if (this.profile?.public_enabled && this.broadcastEnabled) {
-      try {
-        await this.broadcastNow("adapter_start");
-      } catch (error) {
-        await this.log(
-          "warn",
-          `Initial broadcast failed: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
-
-    this.startBroadcastLoop();
+    await this.startNetworkAdapterWithRetry("adapter_start");
   }
 
   async stop(): Promise<void> {
+    this.clearNetworkReconnectTimer();
     if (this.broadcaster) {
       clearInterval(this.broadcaster);
       this.broadcaster = null;
     }
-    await this.network.stop();
+    await this.flushPrivatePersistence();
+    if (this.networkStarted) {
+      await this.network.stop();
+    }
+    this.networkStarted = false;
   }
 
   private ensureLocalDirectoryBaseline(): void {
@@ -848,12 +1208,11 @@ export class LocalNodeService {
   }
 
   getOverview() {
-    this.ensureLocalDirectoryBaseline();
-    this.compactCacheInMemory();
-    const profiles = Object.values(this.directory.profiles);
-    const onlineCount = profiles.filter((profile) =>
-      isAgentOnline(this.directory.presence[profile.agent_id], Date.now(), PRESENCE_TTL_MS)
-    ).length;
+    const discovered = this.search("");
+    const onlineCount = discovered.filter((profile) => profile.online).length;
+    const openclawInstallation = detectOpenClawInstallation(this.projectRoot);
+    const openclawRuntime = this.getCachedOpenClawRuntime();
+    const openclawSkillInstallation = detectOpenClawSkillInstallation();
 
     return {
       app_version: this.appVersion,
@@ -864,12 +1223,21 @@ export class LocalNodeService {
       last_broadcast_error_at: this.lastBroadcastErrorAt,
       last_broadcast_error: this.lastBroadcastError,
       broadcast_failure_count: this.broadcastFailureCount,
-      discovered_count: profiles.length,
+      discovered_count: discovered.length,
       online_count: onlineCount,
-      offline_count: Math.max(0, profiles.length - onlineCount),
+      offline_count: Math.max(0, discovered.length - onlineCount),
       init_state: this.initState,
       presence_ttl_ms: PRESENCE_TTL_MS,
       onboarding: this.getOnboardingSummary(),
+      openclaw: {
+        detected: openclawInstallation.detected,
+        running: openclawRuntime.running,
+        detection_mode: openclawRuntime.detection_mode,
+        gateway_url: openclawRuntime.gateway_url,
+        gateway_probe_ok: openclawRuntime.gateway_probe_ok,
+        status_ok: openclawRuntime.status_ok,
+        skill_installed: openclawSkillInstallation.installed,
+      },
       social: {
         found: this.socialFound,
         enabled: this.socialConfig.enabled,
@@ -888,7 +1256,9 @@ export class LocalNodeService {
   }
 
   getNetworkSummary() {
-    const diagnostics = this.getAdapterDiagnostics();
+    const network = this.getResolvedRealtimeNetworkSummary();
+    const diagnostics = network.diagnostics;
+    const relayCapable = this.adapterMode === "webrtc-preview" || this.adapterMode === "relay-preview";
     const peerCount = diagnostics?.peers.total ?? 0;
 
     return {
@@ -916,30 +1286,34 @@ export class LocalNodeService {
       real_preview_stats: diagnostics?.stats ?? null,
       real_preview_transport_stats: diagnostics?.transport_stats ?? null,
       real_preview_discovery_stats: diagnostics?.discovery_stats ?? null,
-      webrtc_preview: diagnostics && (diagnostics.adapter === "webrtc-preview" || diagnostics.adapter === "relay-preview")
+      webrtc_preview: relayCapable
         ? {
-            signaling_url: diagnostics.signaling_url ?? null,
-            signaling_endpoints: diagnostics.signaling_endpoints ?? [],
-            room: diagnostics.room ?? null,
-            bootstrap_sources: diagnostics.bootstrap_sources ?? [],
-            seed_peers_count: diagnostics.seed_peers_count ?? 0,
-            discovery_events_total: diagnostics.discovery_events_total ?? 0,
-            last_discovery_event_at: diagnostics.last_discovery_event_at ?? 0,
-            active_webrtc_peers: diagnostics.active_webrtc_peers ?? 0,
-            reconnect_attempts_total: diagnostics.reconnect_attempts_total ?? 0,
-            last_join_at: diagnostics.last_join_at ?? 0,
-            last_poll_at: diagnostics.last_poll_at ?? 0,
-            last_publish_at: diagnostics.last_publish_at ?? 0,
-            last_peer_refresh_at: diagnostics.last_peer_refresh_at ?? 0,
-            last_error_at: diagnostics.last_error_at ?? 0,
-            last_error: diagnostics.last_error ?? null,
+            started: this.networkStarted,
+            startup_error: this.networkStartupError,
+            signaling_url: network.signaling_url,
+            signaling_endpoints: network.signaling_endpoints,
+            room: network.room,
+            bootstrap_sources: network.bootstrap_sources,
+            seed_peers_count: network.seed_peers_count,
+            discovery_events_total: diagnostics?.discovery_events_total ?? 0,
+            last_discovery_event_at: diagnostics?.last_discovery_event_at ?? 0,
+            active_webrtc_peers: diagnostics?.active_webrtc_peers ?? 0,
+            reconnect_attempts_total: diagnostics?.reconnect_attempts_total ?? 0,
+            last_join_at: diagnostics?.last_join_at ?? 0,
+            last_poll_at: diagnostics?.last_poll_at ?? 0,
+            last_publish_at: diagnostics?.last_publish_at ?? 0,
+            last_peer_refresh_at: diagnostics?.last_peer_refresh_at ?? 0,
+            last_error_at: diagnostics?.last_error_at ?? 0,
+            last_error: diagnostics?.last_error ?? null,
           }
         : null,
     };
   }
 
   getNetworkConfig() {
-    const diagnostics = this.getAdapterDiagnostics();
+    const network = this.getResolvedRealtimeNetworkSummary();
+    const diagnostics = network.diagnostics;
+    const relayCapable = this.adapterMode === "webrtc-preview" || this.adapterMode === "relay-preview";
     return {
       adapter: this.adapterMode,
       mode: this.networkMode,
@@ -953,23 +1327,25 @@ export class LocalNodeService {
       },
       limits: diagnostics?.limits ?? null,
       adapter_config: diagnostics?.config ?? null,
-      adapter_extra: diagnostics && (diagnostics.adapter === "webrtc-preview" || diagnostics.adapter === "relay-preview")
+      adapter_extra: relayCapable
         ? {
-            signaling_url: diagnostics.signaling_url ?? null,
-            signaling_endpoints: diagnostics.signaling_endpoints ?? [],
-            room: diagnostics.room ?? null,
-            bootstrap_sources: diagnostics.bootstrap_sources ?? [],
-            seed_peers_count: diagnostics.seed_peers_count ?? 0,
-            discovery_events_total: diagnostics.discovery_events_total ?? 0,
-            last_discovery_event_at: diagnostics.last_discovery_event_at ?? 0,
-            connection_states_summary: diagnostics.connection_states_summary ?? null,
-            datachannel_states_summary: diagnostics.datachannel_states_summary ?? null,
-            last_join_at: diagnostics.last_join_at ?? 0,
-            last_poll_at: diagnostics.last_poll_at ?? 0,
-            last_publish_at: diagnostics.last_publish_at ?? 0,
-            last_peer_refresh_at: diagnostics.last_peer_refresh_at ?? 0,
-            last_error_at: diagnostics.last_error_at ?? 0,
-            last_error: diagnostics.last_error ?? null,
+            started: this.networkStarted,
+            startup_error: this.networkStartupError,
+            signaling_url: network.signaling_url,
+            signaling_endpoints: network.signaling_endpoints,
+            room: network.room,
+            bootstrap_sources: network.bootstrap_sources,
+            seed_peers_count: network.seed_peers_count,
+            discovery_events_total: diagnostics?.discovery_events_total ?? 0,
+            last_discovery_event_at: diagnostics?.last_discovery_event_at ?? 0,
+            connection_states_summary: diagnostics?.connection_states_summary ?? null,
+            datachannel_states_summary: diagnostics?.datachannel_states_summary ?? null,
+            last_join_at: diagnostics?.last_join_at ?? 0,
+            last_poll_at: diagnostics?.last_poll_at ?? 0,
+            last_publish_at: diagnostics?.last_publish_at ?? 0,
+            last_peer_refresh_at: diagnostics?.last_peer_refresh_at ?? 0,
+            last_error_at: diagnostics?.last_error_at ?? 0,
+            last_error: diagnostics?.last_error ?? null,
           }
         : null,
       env: {
@@ -997,16 +1373,19 @@ export class LocalNodeService {
         this.adapterMode === "real-preview"
           ? "lan-preview"
           : this.adapterMode === "webrtc-preview" || this.adapterMode === "relay-preview"
-            ? "internet-preview"
+            ? "global-preview"
             : "local-process",
       mode_explainer: this.getModeExplainer(),
     };
   }
 
   getNetworkStats() {
-    const diagnostics = this.getAdapterDiagnostics();
+    const network = this.getResolvedRealtimeNetworkSummary();
+    const diagnostics = network.diagnostics;
+    const relayCapable = this.adapterMode === "webrtc-preview" || this.adapterMode === "relay-preview";
     const peers: Array<{ status?: string }> = diagnostics?.peers?.items ?? [];
     const online = peers.filter((peer: { status?: string }) => peer.status === "online").length;
+    const memory = process.memoryUsage();
 
     return {
       adapter: this.adapterMode,
@@ -1031,34 +1410,54 @@ export class LocalNodeService {
       adapter_stats: diagnostics?.stats ?? null,
       adapter_transport_stats: diagnostics?.transport_stats ?? null,
       adapter_discovery_stats: diagnostics?.discovery_stats ?? null,
-      adapter_diagnostics_summary: diagnostics
+      runtime_diagnostics: {
+        memory_mib: {
+          rss: formatBytesToMiB(memory.rss),
+          heap_used: formatBytesToMiB(memory.heapUsed),
+          heap_total: formatBytesToMiB(memory.heapTotal),
+          external: formatBytesToMiB(memory.external),
+        },
+        directory: {
+          profile_count: Object.keys(this.directory.profiles).length,
+          presence_count: Object.keys(this.directory.presence).length,
+          index_key_count: Object.keys(this.directory.index).length,
+        },
+        social: {
+          message_count: this.socialMessages.length,
+          observation_count: this.socialMessageObservations.length,
+        },
+      },
+      adapter_diagnostics_summary: relayCapable || diagnostics
         ? {
-            signaling_url: diagnostics.signaling_url ?? null,
-            signaling_endpoints: diagnostics.signaling_endpoints ?? [],
-            room: diagnostics.room ?? null,
-            bootstrap_sources: diagnostics.bootstrap_sources ?? [],
-            seed_peers_count: diagnostics.seed_peers_count ?? 0,
-            discovery_events_total: diagnostics.discovery_events_total ?? 0,
-            last_discovery_event_at: diagnostics.last_discovery_event_at ?? 0,
-            connection_states_summary: diagnostics.connection_states_summary ?? null,
-            datachannel_states_summary: diagnostics.datachannel_states_summary ?? null,
-            signaling_messages_sent_total: diagnostics.signaling_messages_sent_total ?? null,
-            signaling_messages_received_total: diagnostics.signaling_messages_received_total ?? null,
-            reconnect_attempts_total: diagnostics.reconnect_attempts_total ?? null,
-            active_webrtc_peers: diagnostics.active_webrtc_peers ?? null,
-            last_join_at: diagnostics.last_join_at ?? 0,
-            last_poll_at: diagnostics.last_poll_at ?? 0,
-            last_publish_at: diagnostics.last_publish_at ?? 0,
-            last_peer_refresh_at: diagnostics.last_peer_refresh_at ?? 0,
-            last_error_at: diagnostics.last_error_at ?? 0,
-            last_error: diagnostics.last_error ?? null,
+            started: this.networkStarted,
+            startup_error: this.networkStartupError,
+            signaling_url: network.signaling_url,
+            signaling_endpoints: network.signaling_endpoints,
+            room: network.room,
+            bootstrap_sources: network.bootstrap_sources,
+            seed_peers_count: network.seed_peers_count,
+            discovery_events_total: diagnostics?.discovery_events_total ?? 0,
+            last_discovery_event_at: diagnostics?.last_discovery_event_at ?? 0,
+            connection_states_summary: diagnostics?.connection_states_summary ?? null,
+            datachannel_states_summary: diagnostics?.datachannel_states_summary ?? null,
+            signaling_messages_sent_total: diagnostics?.signaling_messages_sent_total ?? null,
+            signaling_messages_received_total: diagnostics?.signaling_messages_received_total ?? null,
+            reconnect_attempts_total: diagnostics?.reconnect_attempts_total ?? null,
+            active_webrtc_peers: diagnostics?.active_webrtc_peers ?? null,
+            last_join_at: diagnostics?.last_join_at ?? 0,
+            last_poll_at: diagnostics?.last_poll_at ?? 0,
+            last_publish_at: diagnostics?.last_publish_at ?? 0,
+            last_peer_refresh_at: diagnostics?.last_peer_refresh_at ?? 0,
+            last_error_at: diagnostics?.last_error_at ?? 0,
+            last_error: diagnostics?.last_error ?? null,
           }
         : null,
     };
   }
 
   getPeersSummary() {
-    const diagnostics = this.getAdapterDiagnostics();
+    const network = this.getResolvedRealtimeNetworkSummary();
+    const diagnostics = network.diagnostics;
     if (!diagnostics) {
       return {
         adapter: this.adapterMode,
@@ -1081,11 +1480,13 @@ export class LocalNodeService {
       components: diagnostics.components,
       limits: diagnostics.limits,
       diagnostics_summary: {
-        signaling_url: diagnostics.signaling_url ?? null,
-        signaling_endpoints: diagnostics.signaling_endpoints ?? [],
-        room: diagnostics.room ?? null,
-        bootstrap_sources: diagnostics.bootstrap_sources ?? [],
-        seed_peers_count: diagnostics.seed_peers_count ?? 0,
+        started: this.networkStarted,
+        startup_error: this.networkStartupError,
+        signaling_url: network.signaling_url,
+        signaling_endpoints: network.signaling_endpoints,
+        room: network.room,
+        bootstrap_sources: network.bootstrap_sources,
+        seed_peers_count: network.seed_peers_count,
         discovery_events_total: diagnostics.discovery_events_total ?? 0,
         last_discovery_event_at: diagnostics.last_discovery_event_at ?? 0,
         connection_states_summary: diagnostics.connection_states_summary ?? null,
@@ -1132,15 +1533,102 @@ export class LocalNodeService {
   getRuntimePaths() {
     return {
       workspace_root: this.workspaceRoot,
+      project_root: this.projectRoot,
       storage_root: this.storageRoot,
       data_dir: resolve(this.storageRoot, "data"),
       social_runtime_path: resolve(this.storageRoot, ".silicaclaw", "social.runtime.json"),
       local_console_public_dir: resolve(this.workspaceRoot, "apps", "local-console", "public"),
-      social_lookup_paths: getSocialConfigSearchPaths(this.workspaceRoot),
+      social_lookup_paths: getSocialConfigSearchPaths(this.projectRoot),
       social_source_path: this.socialSourcePath,
     };
   }
 
+  getAppUpdateStatus() {
+    const currentVersion = normalizeVersionText(this.appVersion) || "unknown";
+    const fallback = {
+      current_version: currentVersion,
+      latest_version: currentVersion,
+      update_available: false,
+      channel: "latest",
+      platform: process.platform,
+      checked_at: Date.now(),
+      can_update: true,
+      check_error: null as string | null,
+    };
+    try {
+      const result = spawnSync("npm", ["view", "@silicaclaw/cli", "dist-tags", "--json"], {
+        cwd: this.projectRoot,
+        encoding: "utf8",
+        env: {
+          ...process.env,
+          SILICACLAW_WORKSPACE_DIR: this.projectRoot,
+          SILICACLAW_APP_DIR: this.workspaceRoot,
+          npm_config_cache: process.env.npm_config_cache || userNpmCacheDir(),
+        },
+      });
+      if ((result.status ?? 1) !== 0) {
+        return {
+          ...fallback,
+          check_error: String(result.stderr || result.stdout || "npm view failed").trim() || "npm view failed",
+        };
+      }
+      const tags = JSON.parse(String(result.stdout || "{}").trim() || "{}") as { latest?: string };
+      const latestVersion = normalizeVersionText(tags.latest || currentVersion) || currentVersion;
+      return {
+        ...fallback,
+        latest_version: latestVersion,
+        update_available: compareVersionTokens(latestVersion, currentVersion) > 0,
+      };
+    } catch (error) {
+      return {
+        ...fallback,
+        check_error: error instanceof Error ? error.message : String(error),
+      };
+    }
+  }
+
+  startAppUpdate(): { started: boolean; target_version: string; platform: string; reason?: string } {
+    const status = this.getAppUpdateStatus();
+    if (!status.update_available || !status.latest_version) {
+      return {
+        started: false,
+        target_version: status.latest_version || status.current_version,
+        platform: process.platform,
+        reason: status.check_error || "already_current",
+      };
+    }
+    const shimPath = userShimPath();
+    const scriptPath = resolve(this.workspaceRoot, "scripts", "silicaclaw-cli.mjs");
+    const useShim = existsSync(shimPath);
+    if (!useShim && !existsSync(scriptPath)) {
+      return {
+        started: false,
+        target_version: status.latest_version,
+        platform: process.platform,
+        reason: "missing_cli_script",
+      };
+    }
+    const command = useShim ? shimPath : process.execPath;
+    const args = useShim ? ["update"] : [scriptPath, "update"];
+    const child = spawn(command, args, {
+      cwd: this.projectRoot,
+      detached: true,
+      stdio: "ignore",
+      env: {
+        ...process.env,
+        SILICACLAW_WORKSPACE_DIR: this.projectRoot,
+        SILICACLAW_APP_DIR: this.workspaceRoot,
+        npm_config_cache: process.env.npm_config_cache || userNpmCacheDir(),
+      },
+    });
+    child.unref();
+    return {
+      started: true,
+      target_version: status.latest_version,
+      platform: process.platform,
+    };
+  }
+
   getIntegrationSummary() {
     const status = this.getIntegrationStatus();
     const runtimeGenerated = Boolean(this.socialRuntime && this.socialRuntime.last_loaded_at > 0);
@@ -1175,9 +1663,10 @@ export class LocalNodeService {
 
   getIntegrationStatus(): IntegrationStatusSummary {
     const runtimeGenerated = Boolean(this.socialRuntime && this.socialRuntime.last_loaded_at > 0);
-    const connected = this.socialFound && runtimeGenerated && !this.socialParseError;
-    const configured = connected && this.socialConfig.enabled;
-    const running = configured && this.broadcastEnabled;
+    const runtimeReady = this.socialFound && runtimeGenerated && !this.socialParseError;
+    const connected = runtimeReady && this.networkStarted;
+    const configured = runtimeReady && this.socialConfig.enabled;
+    const running = configured && this.broadcastEnabled && this.networkStarted;
     const publicEnabled = Boolean(this.profile?.public_enabled);
     const discoveryEnabled =
       this.socialConfig.discovery.discoverable &&
@@ -1199,6 +1688,10 @@ export class LocalNodeService {
       ? "running"
       : !configured
         ? "not configured"
+        : this.networkReconnectTimer
+          ? "reconnecting to relay"
+        : this.networkStartupError
+          ? this.networkStartupError
         : !this.broadcastEnabled
           ? "broadcast paused"
           : "not running";
@@ -1244,20 +1737,36 @@ export class LocalNodeService {
   }
 
   async setNetworkModeRuntime(mode: "local" | "lan" | "global-preview") {
-    const currentMode = this.networkMode;
+    const before = {
+      mode: this.networkMode,
+      adapter: this.adapterMode,
+      namespace: this.networkNamespace,
+      port: this.networkPort,
+    };
     if (mode !== "local" && mode !== "lan" && mode !== "global-preview") {
       throw new Error("invalid_network_mode");
     }
     this.socialConfig.network.mode = mode;
     this.socialConfig.network.adapter = this.adapterForMode(mode);
     this.applyResolvedNetworkConfig();
-    this.socialNetworkRequiresRestart = currentMode !== mode || this.adapterMode !== this.socialConfig.network.adapter;
+
+    const needsRestart =
+      before.mode !== this.networkMode ||
+      before.adapter !== this.socialConfig.network.adapter ||
+      before.namespace !== this.networkNamespace ||
+      (before.port ?? null) !== (this.networkPort ?? null);
+
+    if (needsRestart) {
+      await this.restartNetworkAdapter("set_network_mode_runtime");
+    }
+
+    this.socialNetworkRequiresRestart = false;
     await this.writeSocialRuntime();
     return {
       mode: this.networkMode,
-      adapter: this.socialConfig.network.adapter,
-      network_requires_restart: this.socialNetworkRequiresRestart,
-      note: "Runtime mode updated. Existing social.md is unchanged.",
+      adapter: this.adapterMode,
+      network_requires_restart: false,
+      note: "Runtime mode updated and adapter restarted. Existing social.md is unchanged.",
     };
   }
 
@@ -1272,7 +1781,7 @@ export class LocalNodeService {
     this.socialConfig.network.adapter = "relay-preview";
     this.socialConfig.network.signaling_url = signalingUrl;
     this.socialConfig.network.signaling_urls = [signalingUrl];
-    this.socialConfig.network.room = room || "silicaclaw-global-preview";
+    this.socialConfig.network.room = room || DEFAULT_GLOBAL_ROOM;
     this.applyResolvedNetworkConfig();
     await this.restartNetworkAdapter("quick_connect_global_preview");
     this.socialNetworkRequiresRestart = false;
@@ -1297,7 +1806,7 @@ export class LocalNodeService {
       port: this.networkPort,
     };
 
-    const loaded = loadSocialConfig(this.workspaceRoot);
+    const loaded = loadSocialConfig(this.projectRoot);
     this.socialConfig = loaded.config;
     this.socialSourcePath = loaded.meta.source_path;
     this.socialFound = loaded.meta.found;
@@ -1319,13 +1828,18 @@ export class LocalNodeService {
       before.namespace !== after.namespace ||
       (before.port ?? null) !== (after.port ?? null);
 
+    if (this.socialNetworkRequiresRestart) {
+      await this.restartNetworkAdapter("reload_social_config");
+      this.socialNetworkRequiresRestart = false;
+    }
+
     await this.writeSocialRuntime();
 
     return this.getSocialConfigView();
   }
 
   async generateDefaultSocialMd() {
-    const result = ensureDefaultSocialMd(this.workspaceRoot, {
+    const result = ensureDefaultSocialMd(this.projectRoot, {
       display_name: this.getDefaultDisplayName(),
       bio: "Local AI agent connected to SilicaClaw",
       tags: ["openclaw", "local-first"],
@@ -1352,10 +1866,11 @@ export class LocalNodeService {
   search(keyword: string): PublicProfileSummary[] {
     this.ensureLocalDirectoryBaseline();
     this.compactCacheInMemory();
-    return searchDirectory(this.directory, keyword, { presenceTTLms: PRESENCE_TTL_MS }).map((profile) => {
+    const directMatches = searchDirectory(this.directory, keyword, { presenceTTLms: PRESENCE_TTL_MS }).map((profile) => {
       const lastSeenAt = this.directory.presence[profile.agent_id] ?? 0;
       return this.toPublicProfileSummary(profile, { last_seen_at: lastSeenAt });
     });
+    return this.mergeMessageOnlyAgentSummaries(directMatches, keyword);
   }
 
   getPublicProfilePreview(): PublicProfileSummary | null {
@@ -1412,6 +1927,7 @@ export class LocalNodeService {
         return {
           ...message,
           display_name: profile?.display_name || message.display_name || "Unnamed",
+          avatar_url: profile?.avatar_url || "",
           is_self: message.agent_id === this.identity?.agent_id,
           online: isAgentOnline(lastSeenAt, Date.now(), PRESENCE_TTL_MS),
           last_seen_at: lastSeenAt || null,
@@ -1431,18 +1947,149 @@ export class LocalNodeService {
     };
   }
 
+  getPrivateMessagingState() {
+    return {
+      enabled: Boolean(this.identity && this.privateEncryptionKeyPair),
+      agent_id: this.identity?.agent_id || "",
+      encryption_public_key: this.privateEncryptionKeyPair?.public_key || "",
+      conversation_count: this.getPrivateConversations().length,
+      message_count: this.privateMessages.length,
+    };
+  }
+
+  getPrivateConversations(): Array<{
+    conversation_id: string;
+    peer_agent_id: string;
+    peer_display_name: string;
+    peer_avatar_url: string;
+    peer_public_key: string;
+    last_message_at: number | null;
+    unread_count: number;
+  }> {
+    const conversations = new Map<string, {
+      conversation_id: string;
+      peer_agent_id: string;
+      peer_display_name: string;
+      peer_avatar_url: string;
+      peer_public_key: string;
+      last_message_at: number | null;
+      unread_count: number;
+    }>();
+    for (const message of this.privateMessages) {
+      if (message.from_agent_id === message.to_agent_id) {
+        continue;
+      }
+      const peerAgentId = message.from_agent_id === this.identity?.agent_id ? message.to_agent_id : message.from_agent_id;
+      if (!peerAgentId || peerAgentId === this.identity?.agent_id) {
+        continue;
+      }
+      const peerProfile = this.directory.profiles[peerAgentId];
+      const current = conversations.get(message.conversation_id);
+      const nextLast = Math.max(current?.last_message_at || 0, message.created_at || 0) || null;
+      conversations.set(message.conversation_id, {
+        conversation_id: message.conversation_id,
+        peer_agent_id: peerAgentId,
+        peer_display_name: peerProfile?.display_name || peerAgentId,
+        peer_avatar_url: peerProfile?.avatar_url || "",
+        peer_public_key: peerProfile?.private_encryption_public_key || "",
+        last_message_at: nextLast,
+        unread_count: current?.unread_count || 0,
+      });
+    }
+    return Array.from(conversations.values()).sort((a, b) => (b.last_message_at || 0) - (a.last_message_at || 0));
+  }
+
+  getPrivateMessages(conversationId: string, limit = PRIVATE_MESSAGE_QUERY_LIMIT): PrivateMessageView[] {
+    const normalizedConversationId = String(conversationId || "").trim();
+    const resolvedLimit = Math.max(1, Math.min(PRIVATE_MESSAGE_QUERY_LIMIT, Number(limit) || PRIVATE_MESSAGE_QUERY_LIMIT));
+    const receiptsByMessageId = new Map(
+      this.privateMessageReceipts.map((receipt) => [receipt.message_id, receipt.status] as const)
+    );
+    return this.privateMessages
+      .filter((message) => {
+        if (message.from_agent_id === message.to_agent_id) {
+          return false;
+        }
+        const peerAgentId = message.from_agent_id === this.identity?.agent_id ? message.to_agent_id : message.from_agent_id;
+        if (!peerAgentId || peerAgentId === this.identity?.agent_id) {
+          return false;
+        }
+        return !normalizedConversationId || message.conversation_id === normalizedConversationId;
+      })
+      .sort((a, b) => a.created_at - b.created_at)
+      .slice(-resolvedLimit)
+      .map((message) => ({
+        message_id: message.message_id,
+        conversation_id: message.conversation_id,
+        from_agent_id: message.from_agent_id,
+        to_agent_id: message.to_agent_id,
+        body: this.decryptPrivateMessageBody(message),
+        created_at: message.created_at,
+        is_self: message.from_agent_id === this.identity?.agent_id,
+        delivery_status: receiptsByMessageId.get(message.message_id) || "sent",
+      }));
+  }
+
+  async sendPrivateMessage(input: {
+    to_agent_id: string;
+    recipient_encryption_public_key: string;
+    body: string;
+  }): Promise<{ sent: boolean; reason: string; message?: PrivateMessageView }> {
+    if (!this.identity || !this.privateEncryptionKeyPair) {
+      return { sent: false, reason: "missing_identity_or_private_key" };
+    }
+    const toAgentId = String(input.to_agent_id || "").trim();
+    const recipientKey = String(input.recipient_encryption_public_key || "").trim();
+    const body = String(input.body || "").trim();
+    if (toAgentId === this.identity.agent_id) {
+      return { sent: false, reason: "self_private_message_not_allowed" };
+    }
+    const toPeerId = this.privatePeerRoutes[toAgentId] || "";
+    if (!toAgentId || !toPeerId || !recipientKey || !body) {
+      return { sent: false, reason: "invalid_private_message_input" };
+    }
+    if (typeof this.network.sendDirect !== "function") {
+      return { sent: false, reason: "direct_delivery_not_supported" };
+    }
+    const encrypted = encryptPrivatePayload({
+      plaintext: body,
+      recipient_public_key: recipientKey,
+      sender_keypair: this.privateEncryptionKeyPair,
+    });
+    const message = signPrivateMessage({
+      identity: this.identity,
+      message_id: createHash("sha256").update(`${this.identity.agent_id}:${toAgentId}:${Date.now()}:${body}:${Math.random()}`, "utf8").digest("hex"),
+      conversation_id: this.buildPrivateConversationId(this.identity.agent_id, toAgentId),
+      to_agent_id: toAgentId,
+      sender_encryption_public_key: encrypted.sender_encryption_public_key,
+      recipient_encryption_public_key: recipientKey,
+      ciphertext: encrypted.ciphertext,
+      nonce: encrypted.nonce,
+      created_at: Date.now(),
+    });
+    this.ingestPrivateMessage(message);
+    await this.persistPrivateMessages();
+    await this.network.sendDirect(toPeerId, PRIVATE_MESSAGE_TOPIC, message);
+    const view = this.getPrivateMessages(message.conversation_id).find((item) => item.message_id === message.message_id);
+    return { sent: true, reason: "sent", message: view };
+  }
+
   getOpenClawBridgeStatus(): OpenClawBridgeStatus {
+    const now = Date.now();
+    if (this.openclawBridgeStatusCache && this.openclawBridgeStatusCache.expiresAt > now) {
+      return this.openclawBridgeStatusCache.value;
+    }
     const integration = this.getIntegrationStatus();
-    const openclawInstallation = detectOpenClawInstallation(this.workspaceRoot);
-    const openclawRuntime = detectOpenClawRuntime(this.workspaceRoot);
+    const openclawInstallation = detectOpenClawInstallation(this.projectRoot);
+    const openclawRuntime = this.getCachedOpenClawRuntime();
     const skillInstallation = detectOpenClawSkillInstallation();
     const ownerDelivery = detectOwnerDeliveryStatus({
-      workspaceRoot: this.workspaceRoot,
+      workspaceRoot: this.projectRoot,
       connectedToSilicaclaw: integration.connected_to_silicaclaw,
       openclawRunning: openclawRuntime.running,
       skillInstalled: skillInstallation.installed,
     });
-    return {
+    const value: OpenClawBridgeStatus = {
       enabled: this.socialConfig.enabled,
       connected_to_silicaclaw: integration.connected_to_silicaclaw,
       public_enabled: integration.public_enabled,
@@ -1498,16 +2145,26 @@ export class LocalNodeService {
         install_skill: "/api/openclaw/bridge/skill-install",
       },
     };
+    this.openclawBridgeStatusCache = {
+      value,
+      expiresAt: now + OPENCLAW_BRIDGE_STATUS_CACHE_MS,
+    };
+    return value;
   }
 
-  async installOpenClawSkill() {
+  async installOpenClawSkill(skillName?: string) {
     const scriptPath = resolve(this.workspaceRoot, "scripts", "install-openclaw-skill.mjs");
-    const { stdout } = await execFileAsync(process.execPath, [scriptPath], {
+    const args = [scriptPath];
+    if (skillName) {
+      args.push(`--skill=${skillName}`);
+    }
+    const { stdout } = await execFileAsync(process.execPath, args, {
       cwd: this.workspaceRoot,
-      env: process.env,
+      env: { ...process.env, SILICACLAW_WORKSPACE_DIR: this.projectRoot },
       maxBuffer: 1024 * 1024,
     });
     const parsed = JSON.parse(String(stdout || "{}"));
+    this.invalidateOpenClawCaches();
     return {
       ...parsed,
       bridge: this.getOpenClawBridgeStatus(),
@@ -1528,12 +2185,12 @@ export class LocalNodeService {
     const homeDir = resolve(process.env.HOME || "", ".openclaw");
     const workspaceSkillDir = resolve(homeDir, "workspace", "skills");
     const legacySkillDir = resolve(homeDir, "skills");
-    const openclawSourceDir = resolve(this.workspaceRoot, "..", "openclaw");
-    const openclawRuntime = detectOpenClawRuntime(this.workspaceRoot);
+    const openclawSourceDir = defaultOpenClawSourceDir(this.projectRoot);
+    const openclawRuntime = this.getCachedOpenClawRuntime();
 
     return {
-      bridge_api_base: "http://localhost:4310",
-      openclaw_detected: detectOpenClawInstallation(this.workspaceRoot).detected,
+      bridge_api_base: DEFAULT_BRIDGE_API_BASE,
+      openclaw_detected: detectOpenClawInstallation(this.projectRoot).detected,
       openclaw_running: openclawRuntime.running,
       openclaw_gateway_host: OPENCLAW_GATEWAY_HOST,
       openclaw_gateway_port: openclawRuntime.configured_gateway_port,
@@ -1542,7 +2199,7 @@ export class LocalNodeService {
       openclaw_workspace_skill_dir: workspaceSkillDir,
       openclaw_legacy_skill_dir: legacySkillDir,
       silicaclaw_env_template_path: resolve(this.workspaceRoot, "openclaw-owner-forward.env.example"),
-      recommended_skill_name: "silicaclaw-broadcast",
+      recommended_skill_name: "silicaclaw-bridge-setup",
       recommended_install_command: "silicaclaw openclaw-skill-install",
       recommended_owner_forward_env: {
         OPENCLAW_SOURCE_DIR: openclawSourceDir,
@@ -1560,6 +2217,7 @@ export class LocalNodeService {
       ].join(" "),
       notes: [
         "Install and maintain the skill from SilicaClaw; do not edit OpenClaw core source for this integration.",
+        "Use silicaclaw-bridge-setup first when OpenClaw still needs local install, readiness checks, or troubleshooting guidance.",
         "OpenClaw learns broadcasts via the installed skill under ~/.openclaw/workspace/skills/.",
         "Runtime detection prefers the actual OpenClaw gateway listener port, then falls back to OpenClaw's own openclaw.json gateway.port.",
         "Owner delivery runs through OpenClaw's own message channel stack after the skill forwards a summary.",
@@ -1579,6 +2237,12 @@ export class LocalNodeService {
       const skillPath = resolve(dir.path, "SKILL.md");
       const versionPath = resolve(dir.path, "VERSION");
       const manifest = readJsonFileSafe(manifestPath);
+      const references = (manifest?.references && typeof manifest.references === "object")
+        ? manifest.references as Record<string, unknown>
+        : null;
+      const ownerDialogueCheatsheetPath = references?.owner_dialogue_cheatsheet_zh
+        ? resolve(dir.path, String(references.owner_dialogue_cheatsheet_zh))
+        : null;
       const name = String(manifest?.name || dir.name);
       const capabilities = Array.isArray(manifest?.capabilities)
         ? manifest.capabilities.map((item) => String(item))
@@ -1598,6 +2262,9 @@ export class LocalNodeService {
         skill_path: existsSync(skillPath) ? skillPath : null,
         capabilities,
         transport: manifest?.transport || null,
+        owner_dialogue_cheatsheet_path: ownerDialogueCheatsheetPath && existsSync(ownerDialogueCheatsheetPath) ? ownerDialogueCheatsheetPath : null,
+        owner_dialogue_examples_zh: ownerDialogueCheatsheetPath ? readDialogueCheatsheetPreview(ownerDialogueCheatsheetPath) : [],
+        owner_dialogue_sections_zh: ownerDialogueCheatsheetPath ? readDialogueCheatsheetSections(ownerDialogueCheatsheetPath) : [],
         installed_in_openclaw: installedInWorkspace || installedInLegacy,
         install_mode: installedInWorkspace ? "workspace" : installedInLegacy ? "legacy" : "not_installed",
         installed_path: installedInWorkspace ? installedWorkspacePath : installedInLegacy ? installedLegacyPath : null,
@@ -1612,6 +2279,12 @@ export class LocalNodeService {
       const skillPath = resolve(dir.path, "SKILL.md");
       const versionPath = resolve(dir.path, "VERSION");
       const manifest = readJsonFileSafe(manifestPath);
+      const references = (manifest?.references && typeof manifest.references === "object")
+        ? manifest.references as Record<string, unknown>
+        : null;
+      const ownerDialogueCheatsheetPath = references?.owner_dialogue_cheatsheet_zh
+        ? resolve(dir.path, String(references.owner_dialogue_cheatsheet_zh))
+        : null;
       return {
         key: `${dir.install_mode}:${dir.name}`,
         name: String(manifest?.name || dir.name),
@@ -1623,10 +2296,43 @@ export class LocalNodeService {
         manifest_path: existsSync(manifestPath) ? manifestPath : null,
         skill_path: existsSync(skillPath) ? skillPath : null,
         capabilities: Array.isArray(manifest?.capabilities) ? manifest.capabilities.map((item) => String(item)) : [],
+        owner_dialogue_cheatsheet_path: ownerDialogueCheatsheetPath && existsSync(ownerDialogueCheatsheetPath) ? ownerDialogueCheatsheetPath : null,
+        owner_dialogue_examples_zh: ownerDialogueCheatsheetPath ? readDialogueCheatsheetPreview(ownerDialogueCheatsheetPath) : [],
+        owner_dialogue_sections_zh: ownerDialogueCheatsheetPath ? readDialogueCheatsheetSections(ownerDialogueCheatsheetPath) : [],
         bundled_source_path: bundledSkills.find((item) => item.name === String(manifest?.name || dir.name))?.source_path || null,
       };
     });
 
+    const installedSkillVersions = new Map(installedSkills.map((item) => [item.name, item.version]));
+    const bundledSkillsWithUpdateState = bundledSkills.map((skill) => {
+      const installedVersion = installedSkillVersions.get(skill.name) || "";
+      const updateAvailable = Boolean(
+        skill.installed_in_openclaw &&
+        installedVersion &&
+        skill.version &&
+        compareVersionTokens(installedVersion, skill.version) < 0
+      );
+      return {
+        ...skill,
+        installed_version: installedVersion || null,
+        update_available: updateAvailable,
+      };
+    });
+    const bundledSkillVersions = new Map(bundledSkillsWithUpdateState.map((item) => [item.name, item.version]));
+    const installedSkillsWithUpdateState = installedSkills.map((skill) => {
+      const bundledVersion = bundledSkillVersions.get(skill.name) || "";
+      const updateAvailable = Boolean(
+        bundledVersion &&
+        skill.version &&
+        compareVersionTokens(skill.version, bundledVersion) < 0
+      );
+      return {
+        ...skill,
+        bundled_version: bundledVersion || null,
+        update_available: updateAvailable,
+      };
+    });
+
     return {
       openclaw: {
         detected: bridge.openclaw_installation.detected,
@@ -1637,13 +2343,14 @@ export class LocalNodeService {
         legacy_install_root: legacyInstallRoot,
       },
       summary: {
-        bundled_count: bundledSkills.length,
-        installed_count: installedSkills.length,
-        installed_bundled_count: bundledSkills.filter((item) => item.installed_in_openclaw).length,
+        bundled_count: bundledSkillsWithUpdateState.length,
+        installed_count: installedSkillsWithUpdateState.length,
+        installed_bundled_count: bundledSkillsWithUpdateState.filter((item) => item.installed_in_openclaw).length,
+        update_available_count: bundledSkillsWithUpdateState.filter((item) => item.update_available).length,
       },
       install_action: bridge.skill_learning.install_action,
-      bundled_skills: bundledSkills,
-      installed_skills: installedSkills,
+      bundled_skills: bundledSkillsWithUpdateState,
+      installed_skills: installedSkillsWithUpdateState,
     };
   }
 
@@ -1889,20 +2596,25 @@ export class LocalNodeService {
       profile: this.profile,
     };
     const presenceRecord = signPresence(this.identity, Date.now());
-    const indexRecords = buildIndexRecords(this.profile);
+    const shouldPublishProfile = this.shouldPublishProfileRecord(profileRecord, reason, presenceRecord.timestamp);
+    const replayMessages = this.getReplayableSelfSocialMessages(reason);
 
     try {
-      await this.publish("profile", profileRecord);
+      if (shouldPublishProfile) {
+        await this.publish("profile", profileRecord);
+      }
       await this.publish("presence", presenceRecord);
-      for (const record of indexRecords) {
-        await this.publish("index", record);
+      for (const message of replayMessages) {
+        await this.publish(SOCIAL_MESSAGE_TOPIC, message);
       }
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       this.lastBroadcastErrorAt = Date.now();
       this.lastBroadcastError = message;
       this.broadcastFailureCount += 1;
+      this.consecutiveBroadcastFailures += 1;
       await this.log("error", `Broadcast failed (reason=${reason}): ${message}`);
+      await this.maybeRecoverFromBroadcastFailure(reason, message);
       return { sent: false, reason: "publish_failed", error: message };
     }
 
@@ -1910,19 +2622,75 @@ export class LocalNodeService {
     this.broadcastCount += 1;
     this.lastBroadcastError = null;
     this.lastBroadcastErrorAt = 0;
+    this.consecutiveBroadcastFailures = 0;
 
     this.directory = ingestProfileRecord(this.directory, profileRecord);
     this.directory = ingestPresenceRecord(this.directory, presenceRecord);
-    for (const record of indexRecords) {
-      this.directory = ingestIndexRecord(this.directory, record);
-    }
     this.compactCacheInMemory();
     await this.persistCache();
 
-    await this.log("info", `Broadcast sent (${indexRecords.length} index refs, reason=${reason})`);
+    await this.log(
+      "info",
+      `Broadcast sent (${shouldPublishProfile ? "profile + " : ""}presence, replayed_messages=${replayMessages.length}, reason=${reason})`
+    );
     return { sent: true, reason };
   }
 
+  private shouldPublishProfileRecord(
+    profileRecord: SignedProfileRecord,
+    reason: string,
+    now = Date.now()
+  ): boolean {
+    if (reason !== "interval") {
+      this.lastProfileBroadcastSignature = profileRecord.profile.signature;
+      this.lastProfileBroadcastAt = now;
+      return true;
+    }
+    const signature = profileRecord.profile.signature;
+    const changedSinceLastPublish = signature !== this.lastProfileBroadcastSignature;
+    const refreshDue = now - this.lastProfileBroadcastAt >= PROFILE_RELAY_REFRESH_INTERVAL_MS;
+    if (!changedSinceLastPublish && !refreshDue) {
+      return false;
+    }
+    this.lastProfileBroadcastSignature = signature;
+    this.lastProfileBroadcastAt = now;
+    return true;
+  }
+
+  private async maybeRecoverFromBroadcastFailure(reason: string, errorMessage: string): Promise<void> {
+    const recoveryThreshold = 3;
+    const recoveryCooldownMs = 60_000;
+    if (this.broadcastRecoveryInFlight) {
+      return;
+    }
+    if (this.consecutiveBroadcastFailures < recoveryThreshold) {
+      return;
+    }
+    if (Date.now() - this.lastBroadcastRecoveryAttemptAt < recoveryCooldownMs) {
+      return;
+    }
+    if (this.adapterMode !== "relay-preview" && this.adapterMode !== "webrtc-preview" && this.adapterMode !== "real-preview") {
+      return;
+    }
+
+    this.broadcastRecoveryInFlight = true;
+    this.lastBroadcastRecoveryAttemptAt = Date.now();
+    try {
+      await this.log(
+        "warn",
+        `Broadcast recovery triggered after ${this.consecutiveBroadcastFailures} consecutive failures (${reason}): ${errorMessage}`
+      );
+      await this.restartNetworkAdapter("broadcast_failure_recovery");
+    } catch (recoveryError) {
+      await this.log(
+        "error",
+        `Broadcast recovery failed: ${recoveryError instanceof Error ? recoveryError.message : String(recoveryError)}`
+      );
+    } finally {
+      this.broadcastRecoveryInFlight = false;
+    }
+  }
+
   private async hydrateFromDisk(): Promise<void> {
     this.initState = {
       identity_auto_created: false,
@@ -1939,7 +2707,7 @@ export class LocalNodeService {
       socialConfig: this.socialConfig,
       existingIdentity,
       generatedIdentity: createIdentity(),
-      rootDir: this.workspaceRoot,
+      rootDir: this.projectRoot,
     });
     this.identity = resolvedIdentity.identity;
     this.resolvedIdentitySource = resolvedIdentity.source;
@@ -1952,28 +2720,35 @@ export class LocalNodeService {
       await this.log("info", `Bound existing OpenClaw identity: ${resolvedIdentity.openclaw_source_path}`);
     }
     await this.identityRepo.set(this.identity);
+    this.privateEncryptionKeyPair = (await this.privateEncryptionKeyRepo.get()) || createPrivateEncryptionKeyPair();
+    await this.privateEncryptionKeyRepo.set(this.privateEncryptionKeyPair);
 
     const existingProfile = await this.profileRepo.get();
     const profileInput = resolveProfileInputWithSocial({
       socialConfig: this.socialConfig,
       agentId: this.identity.agent_id,
       existingProfile: existingProfile && existingProfile.agent_id === this.identity.agent_id ? existingProfile : null,
-      rootDir: this.workspaceRoot,
+      rootDir: this.projectRoot,
     });
-    this.profile = signProfile(profileInput, this.identity);
+    this.profile = signProfile({
+      ...profileInput,
+      private_encryption_public_key: this.privateEncryptionKeyPair?.public_key || profileInput.private_encryption_public_key || "",
+    }, this.identity);
     if (!existingProfile || existingProfile.agent_id !== this.identity.agent_id) {
       this.initState.profile_auto_created = true;
       await this.log("info", "profile.json missing/invalid, initialized from social/default profile");
     }
     await this.profileRepo.set(this.profile);
 
-    this.directory = dedupeIndex(await this.cacheRepo.get());
+    this.directory = createEmptyDirectoryState();
     this.messageGovernance = {
       ...this.defaultMessageGovernance(),
       ...(await this.socialMessageGovernanceRepo.get()),
     };
     this.socialMessages = this.normalizeSocialMessages(await this.socialMessageRepo.get());
     this.socialMessageObservations = this.normalizeSocialMessageObservations(await this.socialMessageObservationRepo.get());
+    this.privateMessages = this.normalizePrivateMessages(await this.privateMessageRepo.get());
+    this.privateMessageReceipts = this.normalizePrivateMessageReceipts(await this.privateMessageReceiptRepo.get());
     this.directory = ingestProfileRecord(this.directory, { type: "profile", profile: this.profile });
     this.compactCacheInMemory();
     await this.persistCache();
@@ -1990,9 +2765,12 @@ export class LocalNodeService {
       socialConfig: this.socialConfig,
       agentId: this.identity.agent_id,
       existingProfile: this.profile,
-      rootDir: this.workspaceRoot,
+      rootDir: this.projectRoot,
     });
-    const nextProfile = signProfile(nextProfileInput, this.identity);
+    const nextProfile = signProfile({
+      ...nextProfileInput,
+      private_encryption_public_key: this.privateEncryptionKeyPair?.public_key || nextProfileInput.private_encryption_public_key || "",
+    }, this.identity);
     this.profile = nextProfile;
     await this.profileRepo.set(nextProfile);
 
@@ -2057,7 +2835,8 @@ export class LocalNodeService {
 
   private async onMessage(
     topic: "profile" | "presence" | "index" | "social.message" | "social.message.observation",
-    data: unknown
+    data: unknown,
+    meta?: { peerId?: string }
   ): Promise<void> {
     this.receivedCount += 1;
     this.receivedByTopic[topic] = (this.receivedByTopic[topic] ?? 0) + 1;
@@ -2075,6 +2854,9 @@ export class LocalNodeService {
           return;
         }
       }
+      if (meta?.peerId && record.profile.agent_id) {
+        this.privatePeerRoutes[record.profile.agent_id] = meta.peerId;
+      }
 
       this.directory = ingestProfileRecord(this.directory, record);
       this.compactCacheInMemory();
@@ -2094,6 +2876,9 @@ export class LocalNodeService {
           return;
         }
       }
+      if (meta?.peerId && record.agent_id) {
+        this.privatePeerRoutes[record.agent_id] = meta.peerId;
+      }
 
       this.directory = ingestPresenceRecord(this.directory, record);
       this.compactCacheInMemory();
@@ -2110,6 +2895,13 @@ export class LocalNodeService {
         await this.log("warn", `Rejected social message with invalid signature (${record.message_id.slice(0, 10)})`);
         return;
       }
+      if (meta?.peerId && record.agent_id) {
+        this.privatePeerRoutes[record.agent_id] = meta.peerId;
+      }
+      if (this.hasSocialMessage(record.message_id)) {
+        await this.publishObservationForMessage(record);
+        return;
+      }
       const governanceReason = this.getIncomingSocialMessageRejectionReason(record);
       if (governanceReason) {
         await this.log("warn", `Rejected social message (${record.message_id.slice(0, 10)}): ${governanceReason}`);
@@ -2144,12 +2936,42 @@ export class LocalNodeService {
     await this.persistCache();
   }
 
+  private async onDirectMessage(
+    topic: "private.message" | "private.message.receipt",
+    data: unknown,
+    meta?: { peerId?: string }
+  ): Promise<void> {
+    if (topic === PRIVATE_MESSAGE_TOPIC) {
+      const record = this.normalizeIncomingPrivateMessage(data);
+      if (!record || !verifyPrivateMessage(record)) {
+        return;
+      }
+      if (record.to_agent_id !== this.identity?.agent_id || this.hasPrivateMessage(record.message_id)) {
+        return;
+      }
+      this.ingestPrivateMessage(record);
+      await this.persistPrivateMessages();
+      await this.sendPrivateMessageReceipt(record, meta?.peerId);
+      return;
+    }
+
+    const receipt = this.normalizeIncomingPrivateMessageReceipt(data);
+    if (!receipt || !verifyPrivateMessageReceipt(receipt)) {
+      return;
+    }
+    if (receipt.to_agent_id !== this.identity?.agent_id) {
+      return;
+    }
+    this.ingestPrivateMessageReceipt(receipt);
+    await this.persistPrivateMessageReceipts();
+  }
+
   private startBroadcastLoop(): void {
     if (this.broadcaster) {
       clearInterval(this.broadcaster);
     }
 
-    if (!this.broadcastEnabled) {
+    if (!this.broadcastEnabled || !this.networkStarted) {
       return;
     }
 
@@ -2169,21 +2991,29 @@ export class LocalNodeService {
     if (this.subscriptionsBound) {
       return;
     }
-    this.network.subscribe("profile", (data: SignedProfileRecord) => {
-      this.onMessage("profile", data);
+    this.network.subscribe("profile", (data: SignedProfileRecord, meta?: { peerId?: string }) => {
+      this.onMessage("profile", data, meta);
     });
-    this.network.subscribe("presence", (data: PresenceRecord) => {
-      this.onMessage("presence", data);
+    this.network.subscribe("presence", (data: PresenceRecord, meta?: { peerId?: string }) => {
+      this.onMessage("presence", data, meta);
     });
-    this.network.subscribe("index", (data: IndexRefRecord) => {
-      this.onMessage("index", data);
+    this.network.subscribe("index", (data: IndexRefRecord, meta?: { peerId?: string }) => {
+      this.onMessage("index", data, meta);
     });
-    this.network.subscribe(SOCIAL_MESSAGE_TOPIC, (data: SocialMessageRecord) => {
-      this.onMessage(SOCIAL_MESSAGE_TOPIC, data);
+    this.network.subscribe(SOCIAL_MESSAGE_TOPIC, (data: SocialMessageRecord, meta?: { peerId?: string }) => {
+      this.onMessage(SOCIAL_MESSAGE_TOPIC, data, meta);
     });
-    this.network.subscribe(SOCIAL_MESSAGE_OBSERVATION_TOPIC, (data: SocialMessageObservationRecord) => {
-      this.onMessage(SOCIAL_MESSAGE_OBSERVATION_TOPIC, data);
+    this.network.subscribe(SOCIAL_MESSAGE_OBSERVATION_TOPIC, (data: SocialMessageObservationRecord, meta?: { peerId?: string }) => {
+      this.onMessage(SOCIAL_MESSAGE_OBSERVATION_TOPIC, data, meta);
     });
+    if (typeof this.network.subscribeDirect === "function") {
+      this.network.subscribeDirect(PRIVATE_MESSAGE_TOPIC, (data: PrivateMessageRecord, meta?: { peerId?: string }) => {
+        this.onDirectMessage(PRIVATE_MESSAGE_TOPIC, data, meta);
+      });
+      this.network.subscribeDirect(PRIVATE_MESSAGE_RECEIPT_TOPIC, (data: PrivateMessageReceiptRecord, meta?: { peerId?: string }) => {
+        this.onDirectMessage(PRIVATE_MESSAGE_RECEIPT_TOPIC, data, meta);
+      });
+    }
     this.subscriptionsBound = true;
   }
 
@@ -2271,6 +3101,7 @@ export class LocalNodeService {
   }
 
   private async restartNetworkAdapter(reason: string): Promise<void> {
+    this.clearNetworkReconnectTimer();
     const previous = this.network;
     try {
       await previous.stop();
@@ -2282,19 +3113,123 @@ export class LocalNodeService {
     this.network = next.adapter;
     this.adapterMode = next.mode;
     this.networkPort = next.port;
-
-    await this.network.start();
+    this.subscriptionsBound = false;
     this.bindNetworkSubscriptions();
-    this.startBroadcastLoop();
+    await this.startNetworkAdapterWithRetry(reason);
+  }
+
+  private clearNetworkReconnectTimer(): void {
+    if (this.networkReconnectTimer) {
+      clearTimeout(this.networkReconnectTimer);
+      this.networkReconnectTimer = null;
+    }
+  }
+
+  private async startNetworkAdapterWithRetry(reason: string): Promise<void> {
+    this.clearNetworkReconnectTimer();
+    try {
+      await this.network.start();
+      this.networkStarted = true;
+      this.networkStartupError = null;
+      this.networkReconnectDelayMs = 5_000;
+      await this.log(
+        "info",
+        `Local node started (${this.adapterMode}, mode=${this.networkMode}, signaling=${this.webrtcSignalingUrls[0] || "-"}, room=${this.webrtcRoom})`
+      );
+      this.startBroadcastLoop();
+      if (this.broadcastEnabled && this.profile?.public_enabled) {
+        try {
+          await this.broadcastNow(reason);
+        } catch (error) {
+          await this.log(
+            "warn",
+            `Initial broadcast failed: ${error instanceof Error ? error.message : String(error)}`
+          );
+        }
+      }
+    } catch (error) {
+      this.networkStarted = false;
+      this.networkStartupError = error instanceof Error ? error.message : String(error);
+      await this.log(
+        "warn",
+        `Network start failed (${this.adapterMode}, mode=${this.networkMode}): ${this.networkStartupError}`
+      );
+      this.scheduleNetworkReconnect();
+    }
+  }
 
-    if (this.broadcastEnabled && this.profile?.public_enabled) {
-      await this.broadcastNow("adapter_restart");
+  private scheduleNetworkReconnect(): void {
+    if (this.networkReconnectTimer) {
+      return;
+    }
+    const delayMs = this.networkReconnectDelayMs;
+    this.networkReconnectTimer = setTimeout(() => {
+      this.networkReconnectTimer = null;
+      void this.startNetworkAdapterWithRetry("adapter_reconnect");
+    }, delayMs);
+    this.networkReconnectDelayMs = Math.min(30_000, Math.max(5_000, Math.floor(delayMs * 1.5)));
+  }
+
+  private pruneRemoteProfilesInMemory(now = Date.now()): number {
+    if (!Number.isFinite(DIRECTORY_REMOTE_PROFILE_SOFT_LIMIT) || DIRECTORY_REMOTE_PROFILE_SOFT_LIMIT <= 0) {
+      return 0;
+    }
+    const selfAgentId = this.profile?.agent_id || this.identity?.agent_id || "";
+    const remoteProfiles = Object.values(this.directory.profiles).filter((profile) => profile.agent_id !== selfAgentId);
+    if (remoteProfiles.length <= DIRECTORY_REMOTE_PROFILE_SOFT_LIMIT) {
+      return 0;
+    }
+
+    const onlineRemoteProfiles = remoteProfiles.filter((profile) =>
+      isAgentOnline(this.directory.presence[profile.agent_id], now, PRESENCE_TTL_MS)
+    );
+    const offlineRemoteProfiles = remoteProfiles
+      .filter((profile) => !isAgentOnline(this.directory.presence[profile.agent_id], now, PRESENCE_TTL_MS))
+      .sort((a, b) => (b.updated_at || 0) - (a.updated_at || 0));
+
+    const keepOfflineCount = Math.max(0, DIRECTORY_REMOTE_PROFILE_SOFT_LIMIT - onlineRemoteProfiles.length);
+    const keptRemoteProfiles = [
+      ...onlineRemoteProfiles,
+      ...offlineRemoteProfiles.slice(0, keepOfflineCount),
+    ];
+    const keptRemoteIds = new Set(keptRemoteProfiles.map((profile) => profile.agent_id));
+    const removedIds = remoteProfiles
+      .map((profile) => profile.agent_id)
+      .filter((agentId) => !keptRemoteIds.has(agentId));
+    if (removedIds.length === 0) {
+      return 0;
+    }
+
+    const next = createEmptyDirectoryState();
+    const selfProfile = selfAgentId ? this.directory.profiles[selfAgentId] : null;
+    if (selfProfile) {
+      next.profiles[selfAgentId] = selfProfile;
+      const selfPresence = this.directory.presence[selfAgentId];
+      if (typeof selfPresence === "number" && Number.isFinite(selfPresence)) {
+        next.presence[selfAgentId] = selfPresence;
+      }
+      const rebuilt = rebuildIndexForProfile(next, selfProfile);
+      next.index = rebuilt.index;
+    }
+
+    for (const profile of keptRemoteProfiles) {
+      next.profiles[profile.agent_id] = profile;
+      const seenAt = this.directory.presence[profile.agent_id];
+      if (typeof seenAt === "number" && Number.isFinite(seenAt)) {
+        next.presence[profile.agent_id] = seenAt;
+      }
+      const rebuilt = rebuildIndexForProfile(next, profile);
+      next.index = rebuilt.index;
     }
+
+    this.directory = dedupeIndex(next);
+    return removedIds.length;
   }
 
   private compactCacheInMemory(): number {
     const cleaned = cleanupExpiredPresence(this.directory, Date.now(), PRESENCE_TTL_MS);
     this.directory = dedupeIndex(cleaned.state);
+    this.pruneRemoteProfilesInMemory();
     return cleaned.removed;
   }
 
@@ -2304,7 +3239,22 @@ export class LocalNodeService {
   }
 
   private async persistCache(): Promise<void> {
-    await this.cacheRepo.set(this.directory);
+    const persisted = createEmptyDirectoryState();
+    if (this.profile) {
+      const selfProfileRecord: SignedProfileRecord = {
+        type: "profile",
+        profile: this.profile,
+      };
+      this.directory = ingestProfileRecord(this.directory, selfProfileRecord);
+      persisted.profiles[this.profile.agent_id] = this.profile;
+      const selfLastSeenAt = this.directory.presence[this.profile.agent_id];
+      if (typeof selfLastSeenAt === "number" && Number.isFinite(selfLastSeenAt)) {
+        persisted.presence[this.profile.agent_id] = selfLastSeenAt;
+      }
+      const indexed = rebuildIndexForProfile(persisted, this.profile);
+      persisted.index = indexed.index;
+    }
+    await this.cacheRepo.set(persisted);
   }
 
   private async persistSocialMessages(): Promise<void> {
@@ -2315,6 +3265,57 @@ export class LocalNodeService {
     await this.socialMessageObservationRepo.set(this.socialMessageObservations);
   }
 
+  private async persistPrivateMessages(): Promise<void> {
+    this.privateMessagesPersistDirty = true;
+    if (this.privateMessagesPersistTimer) {
+      return;
+    }
+    this.privateMessagesPersistTimer = setTimeout(() => {
+      this.flushPrivateMessagesPersist().catch(() => {});
+    }, PRIVATE_MESSAGE_PERSIST_DEBOUNCE_MS);
+  }
+
+  private async persistPrivateMessageReceipts(): Promise<void> {
+    this.privateMessageReceiptsPersistDirty = true;
+    if (this.privateMessageReceiptsPersistTimer) {
+      return;
+    }
+    this.privateMessageReceiptsPersistTimer = setTimeout(() => {
+      this.flushPrivateMessageReceiptsPersist().catch(() => {});
+    }, PRIVATE_MESSAGE_PERSIST_DEBOUNCE_MS);
+  }
+
+  private async flushPrivatePersistence(): Promise<void> {
+    await Promise.all([
+      this.flushPrivateMessagesPersist(),
+      this.flushPrivateMessageReceiptsPersist(),
+    ]);
+  }
+
+  private async flushPrivateMessagesPersist(): Promise<void> {
+    if (this.privateMessagesPersistTimer) {
+      clearTimeout(this.privateMessagesPersistTimer);
+      this.privateMessagesPersistTimer = null;
+    }
+    if (!this.privateMessagesPersistDirty) {
+      return;
+    }
+    this.privateMessagesPersistDirty = false;
+    await this.privateMessageRepo.set(this.privateMessages);
+  }
+
+  private async flushPrivateMessageReceiptsPersist(): Promise<void> {
+    if (this.privateMessageReceiptsPersistTimer) {
+      clearTimeout(this.privateMessageReceiptsPersistTimer);
+      this.privateMessageReceiptsPersistTimer = null;
+    }
+    if (!this.privateMessageReceiptsPersistDirty) {
+      return;
+    }
+    this.privateMessageReceiptsPersistDirty = false;
+    await this.privateMessageReceiptRepo.set(this.privateMessageReceipts);
+  }
+
   private async log(level: "info" | "warn" | "error", message: string): Promise<void> {
     await this.logRepo.append({
       level,
@@ -2330,6 +3331,19 @@ export class LocalNodeService {
     return (this.network as any).getDiagnostics();
   }
 
+  private getResolvedRealtimeNetworkSummary() {
+    const diagnostics = this.getAdapterDiagnostics();
+    const relayCapable = this.adapterMode === "webrtc-preview" || this.adapterMode === "relay-preview";
+    return {
+      diagnostics,
+      signaling_url: diagnostics?.signaling_url ?? (relayCapable ? this.webrtcSignalingUrls[0] ?? null : null),
+      signaling_endpoints: diagnostics?.signaling_endpoints ?? (relayCapable ? this.webrtcSignalingUrls : []),
+      room: diagnostics?.room ?? (relayCapable ? this.webrtcRoom : null),
+      bootstrap_sources: diagnostics?.bootstrap_sources ?? (relayCapable ? this.webrtcBootstrapSources : []),
+      seed_peers_count: diagnostics?.seed_peers_count ?? this.webrtcSeedPeers.length,
+    };
+  }
+
   private toPublicProfileSummary(
     profile: PublicProfile,
     options?: { last_seen_at?: number }
@@ -2358,6 +3372,7 @@ export class LocalNodeService {
 
     return buildPublicProfileSummary({
       profile,
+      is_self: isSelf,
       online,
       last_seen_at: lastSeenAt || null,
       network_mode: isSelf ? this.networkMode : "unknown",
@@ -2373,6 +3388,73 @@ export class LocalNodeService {
     });
   }
 
+  private mergeMessageOnlyAgentSummaries(
+    summaries: PublicProfileSummary[],
+    keyword: string
+  ): PublicProfileSummary[] {
+    const normalizedKeyword = String(keyword || "").trim().toLowerCase();
+    const knownAgentIds = new Set(summaries.map((item) => item.agent_id));
+    const messageOnly: PublicProfileSummary[] = [];
+
+    for (const message of this.socialMessages) {
+      if (!message?.agent_id || knownAgentIds.has(message.agent_id)) {
+        continue;
+      }
+
+      const displayName = String(message.display_name || "Unnamed").trim() || "Unnamed";
+      if (normalizedKeyword) {
+        const haystacks = [
+          displayName.toLowerCase(),
+          message.agent_id.toLowerCase(),
+          String(message.topic || "").toLowerCase(),
+        ];
+        if (!haystacks.some((value) => value.includes(normalizedKeyword))) {
+          continue;
+        }
+      }
+
+      knownAgentIds.add(message.agent_id);
+      messageOnly.push(
+        buildPublicProfileSummary({
+          profile: {
+            agent_id: message.agent_id,
+            display_name: displayName,
+            bio: "Seen from signed public message. Profile/presence not synced yet.",
+            tags: ["message-only"],
+            avatar_url: "",
+            public_enabled: true,
+            updated_at: message.created_at,
+            signature: "",
+          },
+          is_self: message.agent_id === this.identity?.agent_id,
+          online: false,
+          last_seen_at: null,
+          network_mode: "unknown",
+          openclaw_bound: false,
+          profile_version: PROFILE_VERSION,
+          public_key_fingerprint: null,
+          verified_profile: false,
+          now: Date.now(),
+          presence_ttl_ms: PRESENCE_TTL_MS,
+        })
+      );
+    }
+
+    return [...summaries, ...messageOnly].sort((a, b) => {
+      if (a.online !== b.online) {
+        return a.online ? -1 : 1;
+      }
+      if (a.updated_at !== b.updated_at) {
+        return b.updated_at - a.updated_at;
+      }
+      const byName = a.display_name.localeCompare(b.display_name);
+      if (byName !== 0) {
+        return byName;
+      }
+      return a.agent_id.localeCompare(b.agent_id);
+    });
+  }
+
   private fingerprintPublicKey(publicKey: string): string {
     const digest = createHash("sha256").update(publicKey, "utf8").digest("hex");
     return `${digest.slice(0, 12)}:${digest.slice(-8)}`;
@@ -2381,6 +3463,22 @@ export class LocalNodeService {
   private getOnboardingSummary() {
     const summary = this.getIntegrationSummary();
     const publicEnabled = Boolean(this.profile?.public_enabled);
+    const nextSteps: string[] = [];
+    if (!String(this.profile?.display_name || "").trim()) {
+      nextSteps.push("Update display name in Profile page");
+    }
+    if (!publicEnabled) {
+      nextSteps.push("Enable Public Enabled in Profile");
+    }
+    if (!summary.running) {
+      nextSteps.push("Start broadcast in Network");
+    }
+    if (!summary.discoverable) {
+      nextSteps.push("Announce node once after the network is running");
+    }
+    if (nextSteps.length === 0) {
+      nextSteps.push("Node is public and discoverable");
+    }
     return {
       first_run: Boolean(
         this.initState.social_auto_created ||
@@ -2392,10 +3490,7 @@ export class LocalNodeService {
       mode: this.networkMode,
       public_enabled: publicEnabled,
       can_enable_public_discovery: !publicEnabled,
-      next_steps: [
-        "Update display name in Profile page",
-        "Export social.md from Social Config",
-      ],
+      next_steps: nextSteps,
     };
   }
 
@@ -2420,7 +3515,7 @@ export class LocalNodeService {
       };
     }
     return {
-      mode: "global-preview",
+      mode: DEFAULT_NETWORK_MODE,
       short_label: "Relay preview",
       summary: "Uses the public relay preview room so public nodes can find each other across the internet.",
     };
@@ -2450,14 +3545,14 @@ export class LocalNodeService {
       this.socialConfig.network.mode ||
       (modeEnv === "local" || modeEnv === "lan" || modeEnv === "global-preview"
         ? modeEnv
-        : "global-preview");
+        : DEFAULT_NETWORK_MODE);
 
     this.networkMode = resolvedMode;
-    this.networkNamespace = this.socialConfig.network.namespace || process.env.NETWORK_NAMESPACE || "silicaclaw.preview";
-    this.networkPort = Number(this.socialConfig.network.port || process.env.NETWORK_PORT || 44123);
+    this.networkNamespace = this.socialConfig.network.namespace || process.env.NETWORK_NAMESPACE || DEFAULT_NETWORK_NAMESPACE;
+    this.networkPort = Number(this.socialConfig.network.port || process.env.NETWORK_PORT || DEFAULT_NETWORK_PORT);
 
-    const builtInGlobalSignalingUrls = ["https://relay.silicaclaw.com"];
-    const builtInGlobalRoom = "silicaclaw-global-preview";
+    const builtInGlobalSignalingUrls = [DEFAULT_GLOBAL_SIGNALING_URL];
+    const builtInGlobalRoom = DEFAULT_GLOBAL_ROOM;
 
     const signalingUrlsSocial = dedupeStrings(this.socialConfig.network.signaling_urls || []);
     const signalingUrlSocial = String(this.socialConfig.network.signaling_url || "").trim();
@@ -2482,8 +3577,8 @@ export class LocalNodeService {
       signalingUrls = builtInGlobalSignalingUrls;
       signalingSource = "built-in-defaults:global-preview.signaling_urls";
     } else {
-      signalingUrls = ["https://relay.silicaclaw.com"];
-      signalingSource = "default:https://relay.silicaclaw.com";
+      signalingUrls = [DEFAULT_GLOBAL_SIGNALING_URL];
+      signalingSource = `default:${DEFAULT_GLOBAL_SIGNALING_URL}`;
     }
 
     const roomSocial = String(this.socialConfig.network.room || "").trim();
@@ -2492,14 +3587,14 @@ export class LocalNodeService {
       roomSocial ||
       roomEnv ||
       (this.networkMode === "global-preview" ? builtInGlobalRoom : "") ||
-      "silicaclaw-global-preview";
+      DEFAULT_GLOBAL_ROOM;
     const roomSource = roomSocial
       ? "social.md:network.room"
       : roomEnv
           ? "env:WEBRTC_ROOM"
           : this.networkMode === "global-preview"
         ? "built-in-defaults:global-preview.room"
-          : "default:silicaclaw-global-preview";
+          : `default:${DEFAULT_GLOBAL_ROOM}`;
 
     const seedPeersSocial = dedupeStrings(this.socialConfig.network.seed_peers || []);
     const seedPeersEnv = dedupeStrings(parseListEnv(WEBRTC_SEED_PEERS));
@@ -2537,6 +3632,34 @@ export class LocalNodeService {
       .trim();
   }
 
+  private buildPrivateConversationId(leftAgentId: string, rightAgentId: string): string {
+    return [String(leftAgentId || "").trim(), String(rightAgentId || "").trim()].sort().join(":");
+  }
+
+  private decryptPrivateMessageBody(message: PrivateMessageRecord): string {
+    const cached = this.privateMessageBodyCache.get(message.message_id);
+    if (typeof cached === "string") {
+      return cached;
+    }
+    if (!this.privateEncryptionKeyPair) {
+      return "[encrypted]";
+    }
+    const decrypted = decryptPrivatePayload({
+      ciphertext: message.ciphertext,
+      nonce: message.nonce,
+      sender_encryption_public_key: message.sender_encryption_public_key,
+      recipient_private_key: this.privateEncryptionKeyPair.private_key,
+    }) || "[encrypted]";
+    this.privateMessageBodyCache.set(message.message_id, decrypted);
+    if (this.privateMessageBodyCache.size > PRIVATE_MESSAGE_HISTORY_LIMIT * 2) {
+      const firstKey = this.privateMessageBodyCache.keys().next().value;
+      if (firstKey) {
+        this.privateMessageBodyCache.delete(firstKey);
+      }
+    }
+    return decrypted;
+  }
+
   private normalizeWindowTimestamps(timestamps: number[], windowMs: number, now = Date.now()): number[] {
     return timestamps.filter((timestamp) => now - timestamp <= windowMs);
   }
@@ -2558,6 +3681,38 @@ export class LocalNodeService {
     return this.messageGovernance.blocked_terms.some((term) => normalized.includes(term));
   }
 
+  private hasSocialMessage(messageId: string): boolean {
+    return this.socialMessages.some((item) => item.message_id === messageId);
+  }
+
+  private getReplayableSelfSocialMessages(reason = "manual", now = Date.now()): SocialMessageRecord[] {
+    const maxCount = Math.max(0, SOCIAL_MESSAGE_REPLAY_MAX_PER_BROADCAST);
+    if (!this.identity || maxCount === 0) {
+      return [];
+    }
+    const replayable = this.socialMessages
+      .filter((item) => (
+        item.agent_id === this.identity?.agent_id &&
+        now - item.created_at <= SOCIAL_MESSAGE_REPLAY_WINDOW_MS
+      ))
+      .sort((a, b) => a.created_at - b.created_at)
+      .slice(-maxCount);
+    if (!replayable.length) {
+      this.lastReplayBroadcastSignature = "";
+      return [];
+    }
+    const signature = replayable.map((item) => item.message_id).join(",");
+    const isIntervalReplay = reason === "interval";
+    const changedSinceLastReplay = signature !== this.lastReplayBroadcastSignature;
+    const refreshDue = now - this.lastReplayBroadcastAt >= SOCIAL_MESSAGE_REPLAY_REFRESH_INTERVAL_MS;
+    if (isIntervalReplay && !changedSinceLastReplay && !refreshDue) {
+      return [];
+    }
+    this.lastReplayBroadcastSignature = signature;
+    this.lastReplayBroadcastAt = now;
+    return replayable;
+  }
+
   private hasRecentDuplicateMessage(agentId: string, body: string, topic: string, now = Date.now()): boolean {
     return this.socialMessages.some((item) => (
       item.agent_id === agentId &&
@@ -2630,6 +3785,177 @@ export class LocalNodeService {
     await this.persistSocialMessageObservations();
   }
 
+  private async sendPrivateMessageReceipt(message: PrivateMessageRecord, replyPeerId?: string): Promise<void> {
+    if (!this.identity || typeof this.network.sendDirect !== "function" || !replyPeerId) {
+      return;
+    }
+    const receipt = signPrivateMessageReceipt({
+      identity: this.identity,
+      receipt_id: createHash("sha256").update(`${message.message_id}:${this.identity.agent_id}:${Date.now()}`, "utf8").digest("hex"),
+      message_id: message.message_id,
+      conversation_id: message.conversation_id,
+      to_agent_id: message.from_agent_id,
+      status: "received",
+      created_at: Date.now(),
+    });
+    this.ingestPrivateMessageReceipt(receipt);
+    await this.network.sendDirect(replyPeerId, PRIVATE_MESSAGE_RECEIPT_TOPIC, receipt);
+    await this.persistPrivateMessageReceipts();
+  }
+
+  private normalizeIncomingPrivateMessage(value: unknown): PrivateMessageRecord | null {
+    if (typeof value !== "object" || value === null) {
+      return null;
+    }
+    const record = value as Partial<PrivateMessageRecord>;
+    const createdAt = Number(record.created_at || 0);
+    const fromAgentId = String(record.from_agent_id || "").trim();
+    const toAgentId = String(record.to_agent_id || "").trim();
+    const conversationId = String(record.conversation_id || "").trim();
+    if (
+      record.type !== PRIVATE_MESSAGE_TOPIC ||
+      !String(record.message_id || "").trim() ||
+      !conversationId ||
+      !fromAgentId ||
+      !toAgentId ||
+      !String(record.sender_public_key || "").trim() ||
+      !String(record.sender_encryption_public_key || "").trim() ||
+      !String(record.recipient_encryption_public_key || "").trim() ||
+      !String(record.ciphertext || "").trim() ||
+      !String(record.nonce || "").trim() ||
+      String(record.cipher_scheme || "") !== "nacl-box-v1" ||
+      !String(record.signature || "").trim() ||
+      !Number.isFinite(createdAt)
+    ) {
+      return null;
+    }
+    if (fromAgentId === toAgentId) {
+      return null;
+    }
+    if (conversationId !== this.buildPrivateConversationId(fromAgentId, toAgentId)) {
+      return null;
+    }
+    return {
+      type: PRIVATE_MESSAGE_TOPIC,
+      message_id: String(record.message_id).trim(),
+      conversation_id: conversationId,
+      from_agent_id: fromAgentId,
+      to_agent_id: toAgentId,
+      sender_public_key: String(record.sender_public_key).trim(),
+      sender_encryption_public_key: String(record.sender_encryption_public_key).trim(),
+      recipient_encryption_public_key: String(record.recipient_encryption_public_key).trim(),
+      cipher_scheme: "nacl-box-v1",
+      ciphertext: String(record.ciphertext).trim(),
+      nonce: String(record.nonce).trim(),
+      created_at: createdAt,
+      signature: String(record.signature).trim(),
+    };
+  }
+
+  private normalizePrivateMessages(items: unknown): PrivateMessageRecord[] {
+    if (!Array.isArray(items)) {
+      return [];
+    }
+    const deduped = new Set<string>();
+    return items
+      .map((item) => this.normalizeIncomingPrivateMessage(item))
+      .filter((item): item is PrivateMessageRecord => Boolean(item))
+      .sort((a, b) => a.created_at - b.created_at)
+      .filter((item) => {
+        if (deduped.has(item.message_id)) {
+          return false;
+        }
+        deduped.add(item.message_id);
+        return true;
+      })
+      .slice(-PRIVATE_MESSAGE_HISTORY_LIMIT);
+  }
+
+  private normalizeIncomingPrivateMessageReceipt(value: unknown): PrivateMessageReceiptRecord | null {
+    if (typeof value !== "object" || value === null) {
+      return null;
+    }
+    const record = value as Partial<PrivateMessageReceiptRecord>;
+    const createdAt = Number(record.created_at || 0);
+    const status = String(record.status || "").trim();
+    if (
+      record.type !== PRIVATE_MESSAGE_RECEIPT_TOPIC ||
+      !String(record.receipt_id || "").trim() ||
+      !String(record.message_id || "").trim() ||
+      !String(record.conversation_id || "").trim() ||
+      !String(record.from_agent_id || "").trim() ||
+      !String(record.to_agent_id || "").trim() ||
+      !String(record.sender_public_key || "").trim() ||
+      (status !== "received" && status !== "read") ||
+      !String(record.signature || "").trim() ||
+      !Number.isFinite(createdAt)
+    ) {
+      return null;
+    }
+    return {
+      type: PRIVATE_MESSAGE_RECEIPT_TOPIC,
+      receipt_id: String(record.receipt_id).trim(),
+      message_id: String(record.message_id).trim(),
+      conversation_id: String(record.conversation_id).trim(),
+      from_agent_id: String(record.from_agent_id).trim(),
+      to_agent_id: String(record.to_agent_id).trim(),
+      sender_public_key: String(record.sender_public_key).trim(),
+      status: status as "received" | "read",
+      created_at: createdAt,
+      signature: String(record.signature).trim(),
+    };
+  }
+
+  private normalizePrivateMessageReceipts(items: unknown): PrivateMessageReceiptRecord[] {
+    if (!Array.isArray(items)) {
+      return [];
+    }
+    const deduped = new Set<string>();
+    return items
+      .map((item) => this.normalizeIncomingPrivateMessageReceipt(item))
+      .filter((item): item is PrivateMessageReceiptRecord => Boolean(item))
+      .sort((a, b) => a.created_at - b.created_at)
+      .filter((item) => {
+        if (deduped.has(item.receipt_id)) {
+          return false;
+        }
+        deduped.add(item.receipt_id);
+        return true;
+      })
+      .slice(-PRIVATE_MESSAGE_RECEIPT_HISTORY_LIMIT);
+  }
+
+  private hasPrivateMessage(messageId: string): boolean {
+    return this.privateMessages.some((item) => item.message_id === messageId);
+  }
+
+  private ingestPrivateMessage(message: PrivateMessageRecord): void {
+    const existing = this.privateMessages.findIndex((item) => item.message_id === message.message_id);
+    if (existing >= 0) {
+      this.privateMessages[existing] = message;
+    } else {
+      this.privateMessages.push(message);
+    }
+    this.privateMessages = this.normalizePrivateMessages(this.privateMessages);
+    const validIds = new Set(this.privateMessages.map((item) => item.message_id));
+    this.privateMessageBodyCache.delete(message.message_id);
+    for (const key of Array.from(this.privateMessageBodyCache.keys())) {
+      if (!validIds.has(key)) {
+        this.privateMessageBodyCache.delete(key);
+      }
+    }
+  }
+
+  private ingestPrivateMessageReceipt(receipt: PrivateMessageReceiptRecord): void {
+    const existing = this.privateMessageReceipts.findIndex((item) => item.receipt_id === receipt.receipt_id);
+    if (existing >= 0) {
+      this.privateMessageReceipts[existing] = receipt;
+    } else {
+      this.privateMessageReceipts.push(receipt);
+    }
+    this.privateMessageReceipts = this.normalizePrivateMessageReceipts(this.privateMessageReceipts);
+  }
+
   private normalizeIncomingSocialMessage(value: unknown): SocialMessageRecord | null {
     if (typeof value !== "object" || value === null) {
       return null;
@@ -2867,20 +4193,19 @@ function renderBootstrapScript(payload: unknown): string {
     if (data.pillBroadcastClassName) pillBroadcast.className = data.pillBroadcastClassName;
   }
   setHtml('overviewCards', data.overviewCardsHtml || '');
-  setText('agentsCountHint', data.agentsCountHintText || '0 agents');
-  setHtml('agentsWrap', data.agentsWrapHtml || '<div class="label">No discovered agents yet.</div>');
+  setText('agentsCountHint', data.agentsCountHintText || '0 nodes');
+  setHtml('agentsWrap', data.agentsWrapHtml || '<div class="label">No discovered nodes yet.</div>');
 })();
 </script>`;
 }
 
 export async function main() {
   const app = express();
-  const port = Number(process.env.PORT || 4310);
+  const port = Number(process.env.PORT || defaults.ports.local_console);
   const staticDir = resolveLocalConsoleStaticDir();
   const staticIndexFile = resolve(staticDir, "index.html");
 
   const node = new LocalNodeService();
-  await node.start();
 
   app.use(cors({ origin: true }));
   app.use(express.json());
@@ -2909,6 +4234,48 @@ export async function main() {
     sendOk(res, node.getRuntimePaths());
   });
 
+  app.get("/api/app/update-status", (_req, res) => {
+    sendOk(res, node.getAppUpdateStatus());
+  });
+
+  app.post(
+    "/api/app/update",
+    asyncRoute(async (_req, res) => {
+      const status = node.getAppUpdateStatus();
+      if (!status.update_available || !status.latest_version) {
+        sendOk(
+          res,
+          {
+            started: false,
+            current_version: status.current_version,
+            latest_version: status.latest_version,
+            platform: status.platform,
+            reason: status.check_error || "already_current",
+          },
+          { message: "Already on the latest version" }
+        );
+        return;
+      }
+      sendOk(
+        res,
+        {
+          started: true,
+          current_version: status.current_version,
+          target_version: status.latest_version,
+          platform: status.platform,
+        },
+        { message: `Updating to ${status.latest_version}` }
+      );
+      setTimeout(() => {
+        try {
+          node.startAppUpdate();
+        } catch {
+          // best effort after response has been sent
+        }
+      }, 150);
+    })
+  );
+
   app.put(
     "/api/profile",
     asyncRoute(async (req, res) => {
@@ -3051,6 +4418,34 @@ export async function main() {
     sendOk(res, node.getSocialMessages(limit, { agent_id: agentId || null }));
   });
 
+  app.get("/api/private/state", (_req, res) => {
+    sendOk(res, node.getPrivateMessagingState());
+  });
+
+  app.get("/api/private/conversations", (_req, res) => {
+    sendOk(res, node.getPrivateConversations());
+  });
+
+  app.get("/api/private/messages", (req, res) => {
+    const conversationId = String(req.query.conversation_id ?? "").trim();
+    const limit = Number(req.query.limit ?? PRIVATE_MESSAGE_QUERY_LIMIT);
+    sendOk(res, node.getPrivateMessages(conversationId, limit));
+  });
+
+  app.post(
+    "/api/private/messages/send",
+    asyncRoute(async (req, res) => {
+      const result = await node.sendPrivateMessage({
+        to_agent_id: String(req.body?.to_agent_id || ""),
+        recipient_encryption_public_key: String(req.body?.recipient_encryption_public_key || ""),
+        body: String(req.body?.body || ""),
+      });
+      sendOk(res, result, {
+        message: result.sent ? "Private message sent" : `Private message skipped: ${result.reason}`,
+      });
+    })
+  );
+
   app.get("/api/openclaw/bridge", (_req, res) => {
     sendOk(res, node.getOpenClawBridgeStatus());
   });
@@ -3083,9 +4478,10 @@ export async function main() {
 
   app.post(
     "/api/openclaw/bridge/skill-install",
-    asyncRoute(async (_req, res) => {
+    asyncRoute(async (req, res) => {
       try {
-        const result = await node.installOpenClawSkill();
+        const skillName = String(req.body?.skill_name || "").trim();
+        const result = await node.installOpenClawSkill(skillName || undefined);
         sendOk(res, result, {
           message: "OpenClaw skill installed",
         });
@@ -3133,7 +4529,7 @@ export async function main() {
     const agentId = req.params.agentId;
     const profile = state.profiles[agentId];
     if (!profile) {
-      sendError(res, 404, "AGENT_NOT_FOUND", "Agent not found", { agent_id: agentId });
+      sendError(res, 404, "AGENT_NOT_FOUND", "Node not found", { agent_id: agentId });
       return;
     }
 
@@ -3169,7 +4565,7 @@ export async function main() {
       .join("");
     const agentsWrapHtml =
       discovered.length === 0
-        ? `<div class="label">No discovered agents yet.</div>`
+        ? `<div class="label">No discovered nodes yet.</div>`
         : `
             <table class="table">
               <thead><tr><th>Name</th><th>Agent ID</th><th>Status</th><th>Updated</th></tr></thead>
@@ -3205,7 +4601,7 @@ export async function main() {
       pillBroadcastText: overview.broadcast_enabled ? "broadcast: running" : "broadcast: paused",
       pillBroadcastClassName: `pill ${overview.broadcast_enabled ? "ok" : "warn"}`,
       overviewCardsHtml,
-      agentsCountHintText: `${discovered.length} agents discovered`,
+      agentsCountHintText: `${discovered.length} nodes discovered`,
       agentsWrapHtml,
       integrationStatusText: `Connected to SilicaClaw: ${integration.connected_to_silicaclaw ? "yes" : "no"} · Network mode: ${integration.network_mode || "-"} · Public discovery: ${integration.public_enabled ? "enabled" : "disabled"}`,
       integrationStatusClassName: `integration-strip ${integration.connected_to_silicaclaw && integration.public_enabled ? "ok" : "warn"}`,
@@ -3230,6 +4626,8 @@ export async function main() {
     console.log(`SilicaClaw local-console running: http://localhost:${port}`);
   });
 
+  await node.start();
+
   process.on("SIGINT", async () => {
     await node.stop();
     process.exit(0);