@sulala/agent 0.1.39 → 0.1.41

package/dist/gateway/server.js

@@ -1,13 +1,15 @@
 import express from 'express';
 import { createServer } from 'http';
 import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync } from 'fs';
+import { homedir } from 'os';
 import { join, resolve, sep } from 'path';
 import { randomBytes } from 'crypto';
 import { WebSocketServer } from 'ws';
 import cors from 'cors';
-import { config, getSulalaEnvPath, getSulalaEnvKey, getPortalGatewayBase, getEffectivePortalApiKey } from '../config.js';
+import { config, ensureProtectedBindOrExit, getSulalaEnvPath, getSulalaEnvKey, getPortalGatewayBase, getEffectivePortalApiKey, isLocalRequest } from '../config.js';
+import { startTailscaleServe } from '../tailscale.js';
 import { readOnboardEnvKeys, writeOnboardEnvKeys } from '../onboard-env.js';
-import { initDb, getDb, log, insertTask, getFileStates, updateTaskStatus, setTaskPendingForRetry, getOrCreateAgentSession, getAgentSessionById, getAgentMessages, appendAgentMessage, updateAgentMessageToolResult, listAgentMemories, listAgentMemoryScopeKeys, listAgentSessions, listScheduledJobs, getScheduledJob, insertScheduledJob, updateScheduledJob, deleteScheduledJob, getTasksForJob, getChannelConfig, setChannelConfig, } from '../db/index.js';
+import { initDb, getDb, log, insertTask, getFileStates, updateTaskStatus, setTaskPendingForRetry, getOrCreateAgentSession, getAgentSessionById, getAgentMessages, appendAgentMessage, updateAgentMessageToolResult, listAgentMemories, listAgentMemoryScopeKeys, listAgentSessions, listScheduledJobs, getScheduledJob, insertScheduledJob, updateScheduledJob, deleteScheduledJob, getTasksForJob, getChannelConfig, setChannelConfig, getUsageSummary, listAgents, getAgentById, getAgentBySlug, getLatestAgentMetrics, listWorkflows, getWorkflow, insertWorkflow, updateWorkflow, deleteWorkflow, getScheduledJobIdForWorkflow, } from '../db/index.js';
 import { scheduleCronById, unscheduleJob } from '../scheduler/cron.js';
 import { getQueueLength } from '../scheduler/queue.js';
 import { getTelegramChannelState, setTelegramChannelConfig } from '../channels/telegram.js';
@@ -15,6 +17,10 @@ import { getDiscordChannelState, setDiscordChannelConfig } from '../channels/dis
 import { reloadProviders } from '../ai/orchestrator.js';
 import { runAgentTurn, runAgentTurnStream } from '../agent/loop.js';
 import { runAgentTurnWithPi, isPiAvailable } from '../agent/pi-runner.js';
+import { requestCancel, registerCancelController } from '../agent/run-cancel.js';
+import { isWorkflowAgent, SLUG_TO_TASK_TYPE } from '../agent/workflow-agents.js';
+import { ensureWorkflowFolder } from '../agent/workflow-folder.js';
+import { WORKFLOW_AGENT_CONFIG } from '../agent/workflow-agents-schedule.js';
 import { listTools, executeTool, refreshSpecTools } from '../agent/tools.js';
 import { listSkills, getAllRequiredBins } from '../agent/skills.js';
 import { getRegistrySkills, getAvailableUpdates, installSkill, uninstallSkill, updateSkillsAll, installAllSystemSkills, uploadSkill, getInstallSourceMap } from '../agent/skill-install.js';
@@ -93,6 +99,9 @@ function getStorePublishBaseUrl() {
 }
 export function createGateway(appMount = null) {
     const app = appMount || express();
+    if (process.env.SULALA_TAILSCALE_SERVE === '1') {
+        app.set('trust proxy', 1);
+    }
     app.use(cors());
     // Skip default JSON body parser for /api/upload so the route can use UPLOAD_EXPRESS_LIMIT for video uploads
     app.use((req, res, next) => {
@@ -116,8 +125,13 @@ export function createGateway(appMount = null) {
                 return next();
             if (req.path === '/onboard' || req.path.startsWith('/api/onboard') || req.path.startsWith('/api/ollama'))
                 return next();
+            if (req.path === '/api/settings/gateway-api-key')
+                return next();
             if (req.path.startsWith('/api/oauth/') && (req.path.endsWith('/authorize') || req.path.endsWith('/callback')))
                 return next();
+            const remote = (req.socket?.remoteAddress ?? req.ip ?? '').trim();
+            if (isLocalRequest(remote))
+                return next();
             const key = req.headers['x-api-key'] || req.query.api_key;
             if (key === config.gatewayApiKey)
                 return next();
@@ -384,6 +398,33 @@ export function createGateway(appMount = null) {
             sendGatewayError(res, e);
         }
     });
+    /** Aggregate token usage and cost over a time window. Defaults to last 7 days. */
+    app.get('/api/agent/usage', (req, res) => {
+        try {
+            const now = Date.now();
+            const daysRaw = typeof req.query.days === 'string' ? parseInt(req.query.days, 10) : NaN;
+            const days = Number.isFinite(daysRaw) && daysRaw > 0 ? daysRaw : 7;
+            const toMsRaw = typeof req.query.to === 'string' ? parseInt(req.query.to, 10) : NaN;
+            const toMs = Number.isFinite(toMsRaw) && toMsRaw > 0 ? toMsRaw : now;
+            const fromMsRaw = typeof req.query.from === 'string' ? parseInt(req.query.from, 10) : NaN;
+            const fromMs = Number.isFinite(fromMsRaw) && fromMsRaw > 0
+                ? fromMsRaw
+                : toMs - days * 24 * 60 * 60 * 1000;
+            const summary = getUsageSummary({ fromMs, toMs });
+            res.json({
+                from: summary.fromMs,
+                to: summary.toMs,
+                total_messages: summary.totalMessages,
+                prompt_tokens: summary.promptTokens,
+                completion_tokens: summary.completionTokens,
+                total_tokens: summary.totalTokens,
+                cost_usd: summary.costUsd,
+            });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
     app.post('/api/tasks', (req, res) => {
         try {
             const { type, payload, scheduled_at } = req.body || {};
@@ -489,6 +530,23 @@ export function createGateway(appMount = null) {
             sendGatewayError(res, e);
         }
     });
+    /** GET /api/settings/gateway-api-key — Return API key only when request is from loopback (for Settings display). Remote: returns hasKey only. */
+    app.get('/api/settings/gateway-api-key', (_req, res) => {
+        try {
+            const remote = (_req.socket?.remoteAddress ?? _req.ip ?? '').trim();
+            const fromLocal = isLocalRequest(remote);
+            const key = config.gatewayApiKey?.trim();
+            if (fromLocal && key) {
+                res.json({ apiKey: key, hasKey: true });
+            }
+            else {
+                res.json({ hasKey: !!key });
+            }
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
     /** POST /api/mcp/reload — Re-read mcp.json (or MCP_SERVERS env) and reload MCP tools. Use after editing ~/.sulala/mcp.json by hand so changes take effect without restarting the agent. */
     app.post('/api/mcp/reload', async (_req, res) => {
         try {
@@ -775,6 +833,579 @@ export function createGateway(appMount = null) {
             sendGatewayError(res, e);
         }
     });
+    const LEAD_AGENT_SETUP_KEY = 'lead_agent_setup';
+    app.get('/api/settings/lead-agent-setup', (_req, res) => {
+        try {
+            const raw = getChannelConfig(LEAD_AGENT_SETUP_KEY);
+            if (!raw?.trim()) {
+                res.json({
+                    targetIndustry: '',
+                    targetRole: '',
+                    companySize: 'any',
+                    leadSource: 'web_search',
+                    numLeads: 10,
+                    geographicFocus: '',
+                    enrichmentDepth: 'standard',
+                });
+                return;
+            }
+            const o = JSON.parse(raw);
+            res.json({
+                targetIndustry: typeof o.targetIndustry === 'string' ? o.targetIndustry : '',
+                targetRole: typeof o.targetRole === 'string' ? o.targetRole : '',
+                companySize: ['any', 'startup', 'smb', 'enterprise'].includes(String(o.companySize)) ? o.companySize : 'any',
+                leadSource: ['web_search', 'custom'].includes(String(o.leadSource)) ? o.leadSource : 'web_search',
+                numLeads: typeof o.numLeads === 'number' && o.numLeads >= 1 ? Math.min(100, Math.round(o.numLeads)) : 10,
+                geographicFocus: typeof o.geographicFocus === 'string' ? o.geographicFocus : '',
+                enrichmentDepth: ['basic', 'standard', 'deep'].includes(String(o.enrichmentDepth)) ? o.enrichmentDepth : 'standard',
+            });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    app.put('/api/settings/lead-agent-setup', (req, res) => {
+        try {
+            const body = (req.body || {});
+            const targetIndustry = typeof body.targetIndustry === 'string' ? body.targetIndustry.trim() : '';
+            const targetRole = typeof body.targetRole === 'string' ? body.targetRole.trim() : '';
+            const companySize = ['any', 'startup', 'smb', 'enterprise'].includes(String(body.companySize)) ? body.companySize : 'any';
+            const leadSource = ['web_search', 'custom'].includes(String(body.leadSource)) ? body.leadSource : 'web_search';
+            const numLeads = typeof body.numLeads === 'number' && body.numLeads >= 1 ? Math.min(100, Math.round(body.numLeads)) : 10;
+            const geographicFocus = typeof body.geographicFocus === 'string' ? body.geographicFocus.trim() : '';
+            const enrichmentDepth = ['basic', 'standard', 'deep'].includes(String(body.enrichmentDepth)) ? body.enrichmentDepth : 'standard';
+            setChannelConfig(LEAD_AGENT_SETUP_KEY, JSON.stringify({
+                targetIndustry,
+                targetRole,
+                companySize,
+                leadSource,
+                numLeads,
+                geographicFocus,
+                enrichmentDepth,
+            }));
+            res.json({ ok: true });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    app.delete('/api/settings/lead-agent-setup', (_req, res) => {
+        try {
+            setChannelConfig(LEAD_AGENT_SETUP_KEY, '');
+            res.json({ ok: true });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    const LEAD_AGENT_SCHEDULE_ID = 'lead-agent-daily';
+    const DEFAULT_LEAD_AGENT_CRON = '0 8 * * *';
+    app.get('/api/settings/lead-agent-schedule', (_req, res) => {
+        try {
+            const row = getScheduledJob(LEAD_AGENT_SCHEDULE_ID)
+                ?? listScheduledJobs(false).find((j) => j.task_type === 'lead_agent_run');
+            if (!row) {
+                res.status(404).json({ error: 'Lead Agent schedule not found' });
+                return;
+            }
+            res.json(row);
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    app.put('/api/settings/lead-agent-schedule', (req, res) => {
+        try {
+            const body = (req.body || {});
+            const cronExpression = typeof body.cron_expression === 'string' && body.cron_expression.trim()
+                ? body.cron_expression.trim()
+                : DEFAULT_LEAD_AGENT_CRON;
+            const enabled = body.enabled !== false ? 1 : 0;
+            const agent = getAgentBySlug('lead-agent');
+            if (!agent) {
+                res.status(400).json({ error: 'Lead Agent not found' });
+                return;
+            }
+            let row = getScheduledJob(LEAD_AGENT_SCHEDULE_ID)
+                ?? listScheduledJobs(false).find((j) => j.task_type === 'lead_agent_run');
+            if (!row) {
+                const payloadStr = JSON.stringify({
+                    agentId: agent.id,
+                    provider: agent.default_provider || 'openai',
+                    model: agent.default_model || 'gpt-4o-mini',
+                });
+                insertScheduledJob({
+                    id: LEAD_AGENT_SCHEDULE_ID,
+                    name: 'Lead Agent Daily Run',
+                    description: 'Autonomous lead generation and reporting',
+                    cron_expression: cronExpression,
+                    task_type: 'lead_agent_run',
+                    payload: payloadStr,
+                    enabled,
+                });
+                row = getScheduledJob(LEAD_AGENT_SCHEDULE_ID);
+            }
+            else {
+                updateScheduledJob(row.id, { cron_expression: cronExpression, enabled });
+                unscheduleJob(row.id);
+                row = getScheduledJob(row.id);
+            }
+            if (row.enabled) {
+                const payload = row.payload ? JSON.parse(row.payload) : { agentId: agent.id };
+                scheduleCronById(row.id, row.cron_expression, 'lead_agent_run', payload);
+            }
+            res.json(getScheduledJob(row.id));
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    // News & Social Agent setup and schedule
+    const NEWS_SOCIAL_AGENT_SETUP_KEY = 'news_social_agent_setup';
+    const NEWS_SOCIAL_AGENT_SCHEDULE_ID = 'news-social-agent-daily';
+    const DEFAULT_NEWS_SOCIAL_CRON = '0 9 * * *';
+    app.get('/api/settings/news-social-agent-setup', (_req, res) => {
+        try {
+            const raw = getChannelConfig(NEWS_SOCIAL_AGENT_SETUP_KEY);
+            if (!raw?.trim()) {
+                res.json({
+                    newsTopics: '', numStories: 5, confirmBeforePost: false, socialSkills: ['bluesky'], customPrompt: '',
+                    contentSourceType: 'web_search',
+                });
+                return;
+            }
+            const o = JSON.parse(raw);
+            const rawSkills = o.socialSkills;
+            const socialSkills = Array.isArray(rawSkills)
+                ? rawSkills.map((s) => String(s).toLowerCase().trim()).filter(Boolean)
+                : ['bluesky'];
+            if (socialSkills.length === 0)
+                socialSkills.push('bluesky');
+            const contentSourceType = ['web_search', 'google_doc', 'google_sheet', 'file'].includes(String(o.contentSourceType)) ? o.contentSourceType : 'web_search';
+            res.json({
+                newsTopics: typeof o.newsTopics === 'string' ? o.newsTopics : '',
+                numStories: typeof o.numStories === 'number' && o.numStories >= 1 ? Math.min(20, Math.round(o.numStories)) : 5,
+                confirmBeforePost: o.confirmBeforePost === true,
+                socialSkills,
+                customPrompt: typeof o.customPrompt === 'string' ? o.customPrompt.trim() : '',
+                contentSourceType,
+                contentSourceId: typeof o.contentSourceId === 'string' ? o.contentSourceId.trim() || undefined : undefined,
+                contentSourceSheetRange: typeof o.contentSourceSheetRange === 'string' ? o.contentSourceSheetRange.trim() || undefined : undefined,
+            });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    app.put('/api/settings/news-social-agent-setup', (req, res) => {
+        try {
+            const body = (req.body || {});
+            const newsTopics = typeof body.newsTopics === 'string' ? body.newsTopics.trim() : '';
+            const numStories = typeof body.numStories === 'number' && body.numStories >= 1 ? Math.min(20, Math.round(body.numStories)) : 5;
+            const confirmBeforePost = body.confirmBeforePost === true;
+            const rawSkills = body.socialSkills;
+            const socialSkills = Array.isArray(rawSkills)
+                ? rawSkills.map((s) => String(s).toLowerCase().trim()).filter(Boolean)
+                : ['bluesky'];
+            const finalSkills = socialSkills.length > 0 ? socialSkills : ['bluesky'];
+            const customPrompt = typeof body.customPrompt === 'string' ? body.customPrompt.trim() : '';
+            const contentSourceType = ['web_search', 'google_doc', 'google_sheet', 'file'].includes(String(body.contentSourceType)) ? body.contentSourceType : 'web_search';
+            const contentSourceId = typeof body.contentSourceId === 'string' ? body.contentSourceId.trim() || undefined : undefined;
+            const contentSourceSheetRange = typeof body.contentSourceSheetRange === 'string' ? body.contentSourceSheetRange.trim() || undefined : undefined;
+            setChannelConfig(NEWS_SOCIAL_AGENT_SETUP_KEY, JSON.stringify({
+                newsTopics, numStories, confirmBeforePost, socialSkills: finalSkills, customPrompt,
+                contentSourceType, contentSourceId, contentSourceSheetRange,
+            }));
+            res.json({ ok: true });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    app.delete('/api/settings/news-social-agent-setup', (_req, res) => {
+        try {
+            setChannelConfig(NEWS_SOCIAL_AGENT_SETUP_KEY, '');
+            res.json({ ok: true });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    app.get('/api/settings/news-social-agent-schedule', (_req, res) => {
+        try {
+            const row = getScheduledJob(NEWS_SOCIAL_AGENT_SCHEDULE_ID)
+                ?? listScheduledJobs(false).find((j) => j.task_type === 'news_social_agent_run');
+            if (!row) {
+                res.status(404).json({ error: 'News & Social Agent schedule not found' });
+                return;
+            }
+            res.json(row);
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    app.put('/api/settings/news-social-agent-schedule', (req, res) => {
+        try {
+            const body = (req.body || {});
+            const cronExpression = typeof body.cron_expression === 'string' && body.cron_expression.trim()
+                ? body.cron_expression.trim()
+                : DEFAULT_NEWS_SOCIAL_CRON;
+            const enabled = body.enabled !== false ? 1 : 0;
+            const agent = getAgentBySlug('news-social-agent');
+            if (!agent) {
+                res.status(400).json({ error: 'News & Social Agent not found' });
+                return;
+            }
+            let row = getScheduledJob(NEWS_SOCIAL_AGENT_SCHEDULE_ID)
+                ?? listScheduledJobs(false).find((j) => j.task_type === 'news_social_agent_run');
+            if (!row) {
+                const payloadStr = JSON.stringify({
+                    agentId: agent.id,
+                    provider: agent.default_provider || 'openai',
+                    model: agent.default_model || 'gpt-4o-mini',
+                });
+                insertScheduledJob({
+                    id: NEWS_SOCIAL_AGENT_SCHEDULE_ID,
+                    name: 'News & Social Agent Daily Run',
+                    description: 'Find hot news, post to social media, report to Telegram',
+                    cron_expression: cronExpression,
+                    task_type: 'news_social_agent_run',
+                    payload: payloadStr,
+                    enabled,
+                });
+                row = getScheduledJob(NEWS_SOCIAL_AGENT_SCHEDULE_ID);
+            }
+            else {
+                updateScheduledJob(row.id, { cron_expression: cronExpression, enabled });
+                unscheduleJob(row.id);
+                row = getScheduledJob(row.id);
+            }
+            if (row.enabled) {
+                const payload = row.payload ? JSON.parse(row.payload) : { agentId: agent.id };
+                scheduleCronById(row.id, row.cron_expression, 'news_social_agent_run', payload);
+            }
+            res.json(getScheduledJob(row.id));
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    // News Agent setup (personalized topics and story count)
+    const NEWS_AGENT_SETUP_KEY = 'news_agent_setup';
+    app.get('/api/settings/news-agent-setup', (_req, res) => {
+        try {
+            const raw = getChannelConfig(NEWS_AGENT_SETUP_KEY);
+            if (!raw?.trim()) {
+                res.json({ newsTopics: '', numStories: 10, customPrompt: '' });
+                return;
+            }
+            const o = JSON.parse(raw);
+            const numStories = typeof o.numStories === 'number' && o.numStories >= 1
+                ? Math.min(20, Math.round(o.numStories))
+                : 10;
+            res.json({
+                newsTopics: typeof o.newsTopics === 'string' ? o.newsTopics.trim() : '',
+                numStories,
+                customPrompt: typeof o.customPrompt === 'string' ? o.customPrompt.trim() : '',
+            });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    app.put('/api/settings/news-agent-setup', (req, res) => {
+        try {
+            const body = (req.body || {});
+            const newsTopics = typeof body.newsTopics === 'string' ? body.newsTopics.trim() : '';
+            const numStories = typeof body.numStories === 'number' && body.numStories >= 1
+                ? Math.min(20, Math.round(body.numStories))
+                : 10;
+            const customPrompt = typeof body.customPrompt === 'string' ? body.customPrompt.trim() : '';
+            setChannelConfig(NEWS_AGENT_SETUP_KEY, JSON.stringify({ newsTopics, numStories, customPrompt }));
+            res.json({ ok: true });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    app.delete('/api/settings/news-agent-setup', (_req, res) => {
+        try {
+            setChannelConfig(NEWS_AGENT_SETUP_KEY, '');
+            res.json({ ok: true });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    // Social Agent setup (reads from Doc/Sheet, posts to Bluesky/X)
+    const SOCIAL_AGENT_SETUP_KEY = 'social_agent_setup';
+    app.get('/api/settings/social-agent-setup', (_req, res) => {
+        try {
+            const raw = getChannelConfig(SOCIAL_AGENT_SETUP_KEY);
+            if (!raw?.trim()) {
+                res.json({
+                    contentSourceType: 'workflow_folder',
+                    contentSourceId: undefined,
+                    contentSourceDocName: undefined,
+                    contentSourceSheetRange: undefined,
+                    socialSkills: ['bluesky'],
+                    confirmBeforePost: false,
+                    customPrompt: '',
+                });
+                return;
+            }
+            const o = JSON.parse(raw);
+            const rawSkills = o.socialSkills;
+            const socialSkills = Array.isArray(rawSkills)
+                ? rawSkills.map((s) => String(s).toLowerCase().trim()).filter(Boolean)
+                : ['bluesky'];
+            if (socialSkills.length === 0)
+                socialSkills.push('bluesky');
+            res.json({
+                contentSourceType: ['workflow_folder', 'google_doc', 'google_sheet', 'file'].includes(String(o.contentSourceType)) ? o.contentSourceType : 'workflow_folder',
+                contentSourceId: typeof o.contentSourceId === 'string' ? o.contentSourceId.trim() || undefined : undefined,
+                contentSourceDocName: typeof o.contentSourceDocName === 'string' ? o.contentSourceDocName.trim() || undefined : undefined,
+                contentSourceSheetRange: typeof o.contentSourceSheetRange === 'string' ? o.contentSourceSheetRange.trim() || undefined : undefined,
+                socialSkills,
+                confirmBeforePost: o.confirmBeforePost === true,
+                customPrompt: typeof o.customPrompt === 'string' ? o.customPrompt.trim() : '',
+            });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    app.put('/api/settings/social-agent-setup', (req, res) => {
+        try {
+            const body = (req.body || {});
+            const contentSourceType = ['workflow_folder', 'google_doc', 'google_sheet', 'file'].includes(String(body.contentSourceType)) ? body.contentSourceType : 'workflow_folder';
+            const contentSourceId = typeof body.contentSourceId === 'string' ? body.contentSourceId.trim() || undefined : undefined;
+            const contentSourceDocName = typeof body.contentSourceDocName === 'string' ? body.contentSourceDocName.trim() || undefined : undefined;
+            const contentSourceSheetRange = typeof body.contentSourceSheetRange === 'string' ? body.contentSourceSheetRange.trim() || undefined : undefined;
+            const rawSkills = body.socialSkills;
+            const socialSkills = Array.isArray(rawSkills)
+                ? rawSkills.map((s) => String(s).toLowerCase().trim()).filter(Boolean)
+                : ['bluesky'];
+            const finalSkills = socialSkills.length > 0 ? socialSkills : ['bluesky'];
+            const customPrompt = typeof body.customPrompt === 'string' ? body.customPrompt.trim() : '';
+            setChannelConfig(SOCIAL_AGENT_SETUP_KEY, JSON.stringify({
+                contentSourceType,
+                contentSourceId,
+                contentSourceDocName,
+                contentSourceSheetRange,
+                socialSkills: finalSkills,
+                confirmBeforePost: body.confirmBeforePost === true,
+                customPrompt,
+            }));
+            res.json({ ok: true });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    app.delete('/api/settings/social-agent-setup', (_req, res) => {
+        try {
+            setChannelConfig(SOCIAL_AGENT_SETUP_KEY, '');
+            res.json({ ok: true });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    // Content Writer Agent setup (reads from source, writes to destination)
+    const CONTENT_WRITER_AGENT_SETUP_KEY = 'content_writer_agent_setup';
+    app.get('/api/settings/content-writer-agent-setup', (_req, res) => {
+        try {
+            const raw = getChannelConfig(CONTENT_WRITER_AGENT_SETUP_KEY);
+            if (!raw?.trim()) {
+                res.json({
+                    contentSourceType: 'workflow_folder',
+                    contentSourceId: undefined,
+                    contentSourceDocName: undefined,
+                    contentSourceSheetRange: undefined,
+                    outputDestinationType: 'workflow_folder',
+                    outputDestinationId: undefined,
+                    outputDestinationDocName: undefined,
+                    outputDestinationSheetRange: undefined,
+                    outputStyle: 'mixed',
+                    customPrompt: '',
+                });
+                return;
+            }
+            const o = JSON.parse(raw);
+            res.json({
+                contentSourceType: ['google_doc', 'google_sheet', 'file'].includes(String(o.contentSourceType)) ? o.contentSourceType : 'google_doc',
+                contentSourceId: typeof o.contentSourceId === 'string' ? o.contentSourceId.trim() || undefined : undefined,
+                contentSourceDocName: typeof o.contentSourceDocName === 'string' ? o.contentSourceDocName.trim() || undefined : undefined,
+                contentSourceSheetRange: typeof o.contentSourceSheetRange === 'string' ? o.contentSourceSheetRange.trim() || undefined : undefined,
+                outputDestinationType: ['workflow_folder', 'google_doc', 'google_sheet', 'notion_page', 'notion_database'].includes(String(o.outputDestinationType)) ? o.outputDestinationType : 'workflow_folder',
+                outputDestinationId: typeof o.outputDestinationId === 'string' ? o.outputDestinationId.trim() || undefined : undefined,
+                outputDestinationDocName: typeof o.outputDestinationDocName === 'string' ? o.outputDestinationDocName.trim() || undefined : undefined,
+                outputDestinationSheetRange: typeof o.outputDestinationSheetRange === 'string' ? o.outputDestinationSheetRange.trim() || undefined : undefined,
+                outputStyle: ['article', 'summary', 'social_posts', 'mixed'].includes(String(o.outputStyle)) ? o.outputStyle : 'mixed',
+                customPrompt: typeof o.customPrompt === 'string' ? o.customPrompt.trim() : '',
+            });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    app.put('/api/settings/content-writer-agent-setup', (req, res) => {
+        try {
+            const body = (req.body || {});
+            const contentSourceType = ['workflow_folder', 'google_doc', 'google_sheet', 'file'].includes(String(body.contentSourceType)) ? body.contentSourceType : 'workflow_folder';
+            const contentSourceId = typeof body.contentSourceId === 'string' ? body.contentSourceId.trim() || undefined : undefined;
+            const contentSourceDocName = typeof body.contentSourceDocName === 'string' ? body.contentSourceDocName.trim() || undefined : undefined;
+            const contentSourceSheetRange = typeof body.contentSourceSheetRange === 'string' ? body.contentSourceSheetRange.trim() || undefined : undefined;
+            const outputDestinationType = ['workflow_folder', 'google_doc', 'google_sheet', 'notion_page', 'notion_database'].includes(String(body.outputDestinationType)) ? body.outputDestinationType : 'workflow_folder';
+            const outputDestinationId = typeof body.outputDestinationId === 'string' ? body.outputDestinationId.trim() || undefined : undefined;
+            const outputDestinationDocName = typeof body.outputDestinationDocName === 'string' ? body.outputDestinationDocName.trim() || undefined : undefined;
+            const outputDestinationSheetRange = typeof body.outputDestinationSheetRange === 'string' ? body.outputDestinationSheetRange.trim() || undefined : undefined;
+            const outputStyle = ['article', 'summary', 'social_posts', 'mixed'].includes(String(body.outputStyle)) ? body.outputStyle : 'mixed';
+            const customPrompt = typeof body.customPrompt === 'string' ? body.customPrompt.trim() : '';
+            setChannelConfig(CONTENT_WRITER_AGENT_SETUP_KEY, JSON.stringify({
+                contentSourceType,
+                contentSourceId,
+                contentSourceDocName,
+                contentSourceSheetRange,
+                outputDestinationType,
+                outputDestinationId,
+                outputDestinationDocName,
+                outputDestinationSheetRange,
+                outputStyle,
+                customPrompt,
+            }));
+            res.json({ ok: true });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    app.delete('/api/settings/content-writer-agent-setup', (_req, res) => {
+        try {
+            setChannelConfig(CONTENT_WRITER_AGENT_SETUP_KEY, '');
+            res.json({ ok: true });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    // Workflow agent setup and schedule (Email Digest, Calendar Briefing, etc.)
+    app.get('/api/settings/workflow-agent/:slug/setup', (req, res) => {
+        try {
+            const slug = Array.isArray(req.params.slug) ? req.params.slug[0] : req.params.slug;
+            if (!slug || !isWorkflowAgent(slug)) {
+                res.status(400).json({ error: 'Invalid workflow agent slug' });
+                return;
+            }
+            const key = `${slug.replace(/-/g, '_')}_setup`;
+            const raw = getChannelConfig(key);
+            if (!raw?.trim()) {
+                res.json({ customPrompt: '' });
+                return;
+            }
+            const o = JSON.parse(raw);
+            res.json({ customPrompt: typeof o.customPrompt === 'string' ? o.customPrompt.trim() : '' });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    app.put('/api/settings/workflow-agent/:slug/setup', (req, res) => {
+        try {
+            const slug = Array.isArray(req.params.slug) ? req.params.slug[0] : req.params.slug;
+            if (!slug || !isWorkflowAgent(slug)) {
+                res.status(400).json({ error: 'Invalid workflow agent slug' });
+                return;
+            }
+            const body = (req.body || {});
+            const customPrompt = typeof body.customPrompt === 'string' ? body.customPrompt.trim() : '';
+            const key = `${slug.replace(/-/g, '_')}_setup`;
+            setChannelConfig(key, JSON.stringify({ customPrompt }));
+            res.json({ ok: true });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    app.get('/api/settings/workflow-agent/:slug/schedule', (req, res) => {
+        try {
+            const slug = Array.isArray(req.params.slug) ? req.params.slug[0] : req.params.slug;
+            if (!slug || !isWorkflowAgent(slug)) {
+                res.status(400).json({ error: 'Invalid workflow agent slug' });
+                return;
+            }
+            const cfg = WORKFLOW_AGENT_CONFIG.find((c) => c.slug === slug);
+            if (!cfg) {
+                res.status(404).json({ error: 'Schedule config not found' });
+                return;
+            }
+            const row = getScheduledJob(cfg.scheduleId) ?? listScheduledJobs(false).find((j) => j.task_type === cfg.taskType);
+            if (!row) {
+                res.status(404).json({ error: 'Schedule not found' });
+                return;
+            }
+            res.json(row);
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    app.put('/api/settings/workflow-agent/:slug/schedule', (req, res) => {
+        try {
+            const slug = Array.isArray(req.params.slug) ? req.params.slug[0] : req.params.slug;
+            if (!slug || !isWorkflowAgent(slug)) {
+                res.status(400).json({ error: 'Invalid workflow agent slug' });
+                return;
+            }
+            const cfg = WORKFLOW_AGENT_CONFIG.find((c) => c.slug === slug);
+            if (!cfg) {
+                res.status(404).json({ error: 'Schedule config not found' });
+                return;
+            }
+            const body = (req.body || {});
+            const cronExpression = typeof body.cron_expression === 'string' && body.cron_expression.trim()
+                ? body.cron_expression.trim()
+                : cfg.defaultCron;
+            const enabled = body.enabled !== false ? 1 : 0;
+            const agent = getAgentBySlug(slug);
+            if (!agent) {
+                res.status(400).json({ error: 'Agent not found' });
+                return;
+            }
+            let row = getScheduledJob(cfg.scheduleId) ?? listScheduledJobs(false).find((j) => j.task_type === cfg.taskType);
+            if (!row) {
+                insertScheduledJob({
+                    id: cfg.scheduleId,
+                    name: cfg.name,
+                    description: cfg.description,
+                    cron_expression: cronExpression,
+                    task_type: cfg.taskType,
+                    payload: JSON.stringify({
+                        agentId: agent.id,
+                        provider: agent.default_provider || 'openai',
+                        model: agent.default_model || 'gpt-4o-mini',
+                    }),
+                    enabled,
+                });
+                row = getScheduledJob(cfg.scheduleId);
+            }
+            else {
+                updateScheduledJob(row.id, { cron_expression: cronExpression, enabled });
+                unscheduleJob(row.id);
+                row = getScheduledJob(row.id);
+            }
+            if (row.enabled) {
+                const payload = row.payload ? JSON.parse(row.payload) : { agentId: agent.id };
+                scheduleCronById(row.id, row.cron_expression, cfg.taskType, payload);
+            }
+            res.json(getScheduledJob(row.id));
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
     app.get('/api/agent/skills/required-bins', (_req, res) => {
         try {
             const bins = getAllRequiredBins(config);
@@ -1361,6 +1992,23 @@ export function createGateway(appMount = null) {
             sendGatewayError(res, e);
         }
     });
+    /** GET /api/agent/social-skills — available social posting skills (tools ending in _post, from installed skills). */
+    app.get('/api/agent/social-skills', (_req, res) => {
+        try {
+            const tools = listTools();
+            const social = tools
+                .filter((t) => t.name.endsWith('_post'))
+                .map((t) => {
+                const slug = t.name.replace(/_post$/, '');
+                const name = slug.charAt(0).toUpperCase() + slug.slice(1);
+                return { slug, name, toolName: t.name };
+            });
+            res.json({ skills: social });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
     /** GET /api/agent/memory/scope-keys — distinct scope_key per scope (for Settings > Memory dropdowns). */
     app.get('/api/agent/memory/scope-keys', (_req, res) => {
         try {
@@ -1715,6 +2363,236 @@ export function createGateway(appMount = null) {
             sendGatewayError(res, e);
         }
     });
+    /** Cancel an in-flight agent run (e.g. lead_agent_run). Sends abort signal to the worker. */
+    app.post('/api/tasks/:id/cancel', (req, res) => {
+        try {
+            const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
+            if (!id) {
+                res.status(400).json({ error: 'Task id required' });
+                return;
+            }
+            const cancelled = requestCancel(id);
+            res.json({ id, cancelled });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    // Workflows (multi-agent pipelines)
+    app.get('/api/workflows', (_req, res) => {
+        try {
+            const workflows = listWorkflows();
+            res.json({ workflows });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    app.post('/api/workflows', (req, res) => {
+        try {
+            const { name, description, steps, cron_expression, enabled, approve_before_social_post } = req.body || {};
+            if (!cron_expression?.trim()) {
+                res.status(400).json({ error: 'cron_expression required' });
+                return;
+            }
+            const stepsArr = Array.isArray(steps) ? steps : [];
+            if (stepsArr.length === 0) {
+                res.status(400).json({ error: 'steps array required and must not be empty' });
+                return;
+            }
+            const validSteps = stepsArr
+                .filter((s) => s != null && typeof s === 'object' && typeof s.agentSlug === 'string')
+                .map((s, i) => ({
+                order: typeof s.order === 'number' ? s.order : i,
+                agentSlug: s.agentSlug.trim(),
+            }));
+            if (validSteps.length === 0) {
+                res.status(400).json({ error: 'steps must contain objects with agentSlug' });
+                return;
+            }
+            const agents = listAgents();
+            const validSlugs = new Set(agents.map((a) => a.slug));
+            const invalid = validSteps.find((s) => !validSlugs.has(s.agentSlug));
+            if (invalid) {
+                res.status(400).json({ error: `Unknown agent slug: ${invalid.agentSlug}` });
+                return;
+            }
+            const workflowId = `wf_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`;
+            const stepsJson = JSON.stringify(validSteps);
+            const enabledVal = enabled === false ? 0 : 1;
+            const approveBeforeSocialPost = approve_before_social_post === false ? 0 : 1;
+            insertWorkflow({
+                id: workflowId,
+                name: (name && typeof name === 'string' ? name.trim() : '') || `Workflow ${workflowId.slice(3, 15)}`,
+                description: (description && typeof description === 'string' ? description.trim() : '') || '',
+                steps: stepsJson,
+                cron_expression: cron_expression.trim(),
+                enabled: enabledVal,
+                approve_before_social_post: approveBeforeSocialPost,
+            });
+            const scheduleId = getScheduledJobIdForWorkflow(workflowId);
+            insertScheduledJob({
+                id: scheduleId,
+                name: (name && typeof name === 'string' ? name.trim() : '') || `Workflow ${workflowId.slice(3, 15)}`,
+                description: (description && typeof description === 'string' ? description.trim() : '') || '',
+                cron_expression: cron_expression.trim(),
+                task_type: 'workflow_run',
+                payload: JSON.stringify({ workflowId }),
+                enabled: enabledVal,
+            });
+            if (enabledVal) {
+                scheduleCronById(scheduleId, cron_expression.trim(), 'workflow_run', { workflowId });
+            }
+            const workflow = getWorkflow(workflowId);
+            ensureWorkflowFolder(workflowId, workflow.name);
+            log('gateway', 'info', 'Workflow created', { workflowId });
+            res.status(201).json(workflow);
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    app.get('/api/workflows/:id', (req, res) => {
+        try {
+            const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
+            if (!id) {
+                res.status(400).json({ error: 'Workflow id required' });
+                return;
+            }
+            const workflow = getWorkflow(id);
+            if (!workflow) {
+                res.status(404).json({ error: 'Workflow not found' });
+                return;
+            }
+            res.json(workflow);
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    app.patch('/api/workflows/:id', (req, res) => {
+        try {
+            const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
+            if (!id) {
+                res.status(400).json({ error: 'Workflow id required' });
+                return;
+            }
+            const workflow = getWorkflow(id);
+            if (!workflow) {
+                res.status(404).json({ error: 'Workflow not found' });
+                return;
+            }
+            const { name, description, steps, cron_expression, enabled, approve_before_social_post } = req.body || {};
+            const updates = {};
+            if (typeof name === 'string')
+                updates.name = name.trim();
+            if (typeof description === 'string')
+                updates.description = description.trim();
+            if (typeof cron_expression === 'string')
+                updates.cron_expression = cron_expression.trim();
+            if (enabled !== undefined)
+                updates.enabled = enabled ? 1 : 0;
+            if (approve_before_social_post !== undefined)
+                updates.approve_before_social_post = approve_before_social_post ? 1 : 0;
+            const stepsArr = steps !== undefined ? (Array.isArray(steps) ? steps : []) : null;
+            if (stepsArr !== null && stepsArr.length === 0) {
+                res.status(400).json({ error: 'steps array must not be empty' });
+                return;
+            }
+            if (stepsArr !== null && stepsArr.length > 0) {
+                const agents = listAgents();
+                const validSlugs = new Set(agents.map((a) => a.slug));
+                const validSteps = stepsArr
+                    .filter((s) => s != null && typeof s === 'object' && typeof s.agentSlug === 'string')
+                    .map((s, i) => ({
+                    order: typeof s.order === 'number' ? s.order : i,
+                    agentSlug: s.agentSlug.trim(),
+                }));
+                const invalid = validSteps.find((s) => !validSlugs.has(s.agentSlug));
+                if (invalid) {
+                    res.status(400).json({ error: `Unknown agent slug: ${invalid.agentSlug}` });
+                    return;
+                }
+                updates.steps = JSON.stringify(validSteps);
+            }
+            if (Object.keys(updates).length > 0) {
+                updateWorkflow(id, updates);
+            }
+            const updated = getWorkflow(id);
+            ensureWorkflowFolder(id, updated.name);
+            const scheduleId = getScheduledJobIdForWorkflow(id);
+            const job = getScheduledJob(scheduleId);
+            if (job) {
+                updateScheduledJob(scheduleId, {
+                    name: updated.name,
+                    description: updated.description,
+                    cron_expression: updated.cron_expression,
+                    payload: JSON.stringify({ workflowId: id }),
+                    enabled: updated.enabled,
+                });
+                unscheduleJob(scheduleId);
+                if (updated.enabled) {
+                    scheduleCronById(scheduleId, updated.cron_expression, 'workflow_run', { workflowId: id });
+                }
+            }
+            res.json(updated);
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    app.delete('/api/workflows/:id', (req, res) => {
+        try {
+            const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
+            if (!id) {
+                res.status(400).json({ error: 'Workflow id required' });
+                return;
+            }
+            const workflow = getWorkflow(id);
+            if (!workflow) {
+                res.status(404).json({ error: 'Workflow not found' });
+                return;
+            }
+            const scheduleId = getScheduledJobIdForWorkflow(id);
+            unscheduleJob(scheduleId);
+            deleteScheduledJob(scheduleId);
+            deleteWorkflow(id);
+            log('gateway', 'info', 'Workflow deleted', { id });
+            res.status(204).send();
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    app.post('/api/workflows/:id/run', (req, res) => {
+        try {
+            const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
+            if (!id) {
+                res.status(400).json({ error: 'Workflow id required' });
+                return;
+            }
+            const workflow = getWorkflow(id);
+            if (!workflow) {
+                res.status(404).json({ error: 'Workflow not found' });
+                return;
+            }
+            const taskId = `workflow_run_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`;
+            insertTask({
+                id: taskId,
+                type: 'workflow_run',
+                payload: { workflowId: id },
+                scheduled_at: Date.now(),
+            });
+            const enqueueTaskId = app.locals.enqueueTaskId;
+            if (typeof enqueueTaskId === 'function')
+                enqueueTaskId(taskId);
+            log('gateway', 'info', 'Workflow run enqueued', { workflowId: id, taskId });
+            res.status(201).json({ id: taskId, type: 'workflow_run', status: 'pending' });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
     // Scheduled jobs (cron → task type)
     app.get('/api/schedules', (_req, res) => {
         try {
@@ -1934,6 +2812,131 @@ export function createGateway(appMount = null) {
         }
     });
     /** Chat attachments: upload image/video, get a URL the agent can use (e.g. Facebook photo posts, YouTube video upload). */
+    // --- Agents (Agent OS v1) ---
+    app.get('/api/agents', (_req, res) => {
+        try {
+            const agents = listAgents(false); // all agents, even disabled
+            const result = agents.map((a) => ({
+                id: a.id,
+                slug: a.slug,
+                name: a.name,
+                description: a.description,
+                persona_prompt: a.persona_prompt,
+                default_provider: a.default_provider,
+                default_model: a.default_model,
+                workspace_root: a.workspace_root,
+                enabled: a.enabled === 1,
+                created_at: a.created_at,
+                updated_at: a.updated_at,
+            }));
+            res.json({ agents: result });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    app.get('/api/agents/:id', (req, res) => {
+        try {
+            const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
+            if (!id) {
+                res.status(400).json({ error: 'Agent id required' });
+                return;
+            }
+            const agent = getAgentById(id);
+            if (!agent) {
+                res.status(404).json({ error: 'Agent not found' });
+                return;
+            }
+            res.json({
+                id: agent.id,
+                slug: agent.slug,
+                name: agent.name,
+                description: agent.description,
+                persona_prompt: agent.persona_prompt,
+                default_provider: agent.default_provider,
+                default_model: agent.default_model,
+                default_tools: agent.default_tools ? JSON.parse(agent.default_tools) : null,
+                default_skills: agent.default_skills ? JSON.parse(agent.default_skills) : null,
+                workspace_root: agent.workspace_root,
+                enabled: agent.enabled === 1,
+                created_at: agent.created_at,
+                updated_at: agent.updated_at,
+            });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    app.get('/api/agents/:id/metrics', (req, res) => {
+        try {
+            const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
+            if (!id) {
+                res.status(400).json({ error: 'Agent id required' });
+                return;
+            }
+            const agent = getAgentById(id);
+            if (!agent) {
+                res.status(404).json({ error: 'Agent not found' });
+                return;
+            }
+            const metrics = getLatestAgentMetrics(id);
+            res.json({ metrics });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
+    /** Run an agent immediately (manual trigger). Body: { sessionId?, userMessage?, provider?, model? } */
+    app.post('/api/agents/:id/run-once', async (req, res) => {
+        try {
+            const id = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
+            if (!id) {
+                res.status(400).json({ error: 'Agent id required' });
+                return;
+            }
+            const agent = getAgentById(id);
+            if (!agent) {
+                res.status(404).json({ error: 'Agent not found' });
+                return;
+            }
+            const { sessionId: optionalSessionId, userMessage, provider: reqProvider, model: reqModel } = req.body || {};
+            const sessionId = optionalSessionId || `agent_run_${agent.id}_${Date.now()}`;
+            const session = getOrCreateAgentSession(sessionId, { agent_id: agent.id });
+            const provider = typeof reqProvider === 'string' ? reqProvider : agent.default_provider || undefined;
+            const model = typeof reqModel === 'string' ? reqModel : agent.default_model || undefined;
+            const userMsg = typeof userMessage === 'string' ? userMessage : `Run ${agent.name} workflow.`;
+            // Enqueue a task to run the agent
+            const taskId = `task_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`;
+            const taskType = agent.slug === 'lead-agent' ? 'lead_agent_run' :
+                agent.slug === 'news-social-agent' ? 'news_social_agent_run' :
+                    agent.slug === 'social-agent' ? 'social_agent_run' :
+                        agent.slug === 'content-writer-agent' ? 'content_writer_agent_run' :
+                            isWorkflowAgent(agent.slug) ? SLUG_TO_TASK_TYPE[agent.slug] :
+                                'agent_run';
+            if (taskType === 'lead_agent_run' || taskType === 'news_social_agent_run' || taskType === 'social_agent_run' || taskType === 'content_writer_agent_run') {
+                registerCancelController(taskId);
+            }
+            insertTask({
+                id: taskId,
+                type: taskType,
+                payload: {
+                    agentId: agent.id,
+                    sessionId: session.id,
+                    userMessage: userMsg,
+                    provider,
+                    model,
+                },
+            });
+            const enqueueTaskIdFn = app.locals.enqueueTaskId;
+            if (typeof enqueueTaskIdFn === 'function')
+                enqueueTaskIdFn(taskId);
+            log('gateway', 'info', `Agent run enqueued: ${agent.name}`, { agentId: agent.id, sessionId: session.id });
+            res.status(201).json({ taskId, sessionId: session.id, status: 'queued' });
+        }
+        catch (e) {
+            sendGatewayError(res, e);
+        }
+    });
     const uploadsDir = join(projectRoot, 'uploads');
     app.post('/api/upload', express.json({ limit: UPLOAD_EXPRESS_LIMIT }), (req, res) => {
         try {
@@ -2010,6 +3013,10 @@ export function createGateway(appMount = null) {
             if (p && !dirs.includes(p))
                 dirs.push(p);
         }
+        // Allow any path under user home (Downloads, Desktop, .sulala/workspace/uploads, etc.) so file_path uploads work when agent finds files via run_command
+        const home = homedir();
+        if (home && !dirs.includes(resolve(home)))
+            dirs.push(resolve(home));
         return dirs;
     };
     const isPathAllowed = (filePath) => {
@@ -2052,7 +3059,7 @@ export function createGateway(appMount = null) {
             return { buf: readFileSync(filePath), contentType };
         }
         if (filePath)
-            throw new Error('file_path must be under uploads, workspace, or a watch folder');
+            throw new Error('file_path must be under uploads, workspace, a watch folder, or the user home directory');
         if (!fileUrl)
             throw new Error('Body must include file_url or file_path');
         try {
@@ -2079,6 +3086,7 @@ export function createGateway(appMount = null) {
         try {
             const destination = typeof req.body?.destination === 'string' ? req.body.destination.trim().toLowerCase() : '';
             const connectionId = typeof req.body?.connection_id === 'string' ? req.body.connection_id.trim() : '';
+            const accessTokenFromBody = typeof req.body?.access_token === 'string' ? req.body.access_token.trim() : '';
             const fileUrl = (typeof req.body?.file_url === 'string' ? req.body.file_url.trim() : '') ||
                 (typeof req.body?.video_url === 'string' ? req.body.video_url.trim() : '');
             const filePath = (typeof req.body?.file_path === 'string' ? req.body.file_path.trim() : '') ||
@@ -2089,8 +3097,12 @@ export function createGateway(appMount = null) {
             const privacyStatus = ['public', 'private', 'unlisted'].includes(req.body?.privacyStatus || metadata.privacyStatus || '')
                 ? (req.body?.privacyStatus || metadata.privacyStatus || 'private')
                 : 'private';
-            if (!destination || !connectionId) {
-                res.status(400).json({ error: 'Body must include destination and connection_id' });
+            if (!destination) {
+                res.status(400).json({ error: 'Body must include destination' });
+                return;
+            }
+            if (!connectionId && !accessTokenFromBody) {
+                res.status(400).json({ error: 'Body must include connection_id (Portal) or access_token (e.g. from google-oauth)' });
                 return;
             }
             if (!filePath && !fileUrl) {
@@ -2102,12 +3114,18 @@ export function createGateway(appMount = null) {
                 res.status(400).json({ error: `File too large (max ${UPLOAD_MAX_BYTES / (1024 * 1024)} MB)` });
                 return;
             }
-            const tokenResult = await getConnectionToken(connectionId);
-            if (!tokenResult.ok) {
-                res.status(tokenResult.status).json({ error: tokenResult.error });
-                return;
+            let accessToken;
+            if (accessTokenFromBody) {
+                accessToken = accessTokenFromBody;
+            }
+            else {
+                const tokenResult = await getConnectionToken(connectionId);
+                if (!tokenResult.ok) {
+                    res.status(tokenResult.status).json({ error: tokenResult.error });
+                    return;
+                }
+                accessToken = tokenResult.accessToken;
             }
-            const accessToken = tokenResult.accessToken;
             const handler = getUploadHandler(destination);
             if (!handler) {
                 const available = listUploadDestinations();
@@ -2118,11 +3136,22 @@ export function createGateway(appMount = null) {
                 return;
             }
             const ctx = {
-                connectionId,
+                connectionId: connectionId || '',
                 accessToken,
                 buf,
                 contentType,
-                body: { title, description, privacyStatus, ...metadata },
+                body: {
+                    title,
+                    description,
+                    privacyStatus,
+                    ...metadata,
+                    file_url: fileUrl || undefined,
+                    file_path: typeof req.body?.file_path === 'string' ? req.body.file_path.trim() || undefined : undefined,
+                    target_path: typeof req.body?.target_path === 'string' ? req.body.target_path.trim() || undefined : undefined,
+                    mode: typeof req.body?.mode === 'string' ? req.body.mode.trim() : undefined,
+                    folder_id: typeof req.body?.folder_id === 'string' ? req.body.folder_id.trim() || undefined : undefined,
+                    name: typeof req.body?.name === 'string' ? req.body.name.trim() || undefined : undefined,
+                },
             };
             const result = await handler(ctx);
             if (result.ok) {
@@ -2183,7 +3212,20 @@ a{color:#2563eb;}</style></head>
     return app;
 }
 export function attachWebSocket(server, onConnection = () => { }) {
-    const wss = new WebSocketServer({ server, path: '/ws' });
+    const verifyClient = config.gatewayApiKey?.trim() ?
+        (info, callback) => {
+            const url = info.req?.url || '';
+            const params = new URLSearchParams(url.includes('?') ? url.split('?')[1] : '');
+            const key = params.get('api_key') || '';
+            if (key === config.gatewayApiKey) {
+                callback(true);
+            }
+            else {
+                callback(false, 401, 'Invalid or missing API key');
+            }
+        }
+        : undefined;
+    const wss = new WebSocketServer({ server, path: '/ws', verifyClient });
     const broadcast = (data) => {
         const msg = typeof data === 'string' ? data : JSON.stringify(data);
         wss.clients.forEach((c) => {
@@ -2215,11 +3257,13 @@ export function startGateway() {
     app.locals.wsBroadcast = broadcast;
     server.listen(config.port, config.host, () => {
         console.log(`Sulala gateway http://${config.host}:${config.port} (WS /ws)`);
+        startTailscaleServe(config.port);
     });
     return { app, server };
 }
 if (process.argv[1]?.includes('server')) {
     (async () => {
+        await ensureProtectedBindOrExit();
         await initDb(config.dbPath);
         startGateway();
     })().catch((err) => {