@useorgx/openclaw-plugin 0.3.0 → 0.3.1

package/dist/http-handler.js

@@ -8,6 +8,7 @@
  *   /orgx/api/agents     → agent states
  *   /orgx/api/activity   → activity feed
  *   /orgx/api/initiatives → initiative data
+ *   /orgx/api/health     → plugin diagnostics + outbox/sync status
  *   /orgx/api/onboarding → onboarding / config state
  *   /orgx/api/delegation/preflight → delegation preflight
  *   /orgx/api/runs/:id/checkpoints → list/create checkpoints
@@ -15,13 +16,17 @@
  *   /orgx/api/runs/:id/actions/:action → run control action
  */
 import { readFileSync, existsSync } from "node:fs";
-import { join, extname } from "node:path";
-import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
-import { createHash } from "node:crypto";
+import { join, extname, normalize, resolve, relative, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawn } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
 import { formatStatus, formatAgents, formatActivity, formatInitiatives, getOnboardingState, } from "./dashboard-api.js";
 import { loadLocalOpenClawSnapshot, loadLocalTurnDetail, toLocalLiveActivity, toLocalLiveAgents, toLocalLiveInitiatives, toLocalSessionTree, } from "./local-openclaw.js";
-import { readAllOutboxItems } from "./outbox.js";
+import { defaultOutboxAdapter } from "./adapters/outbox.js";
+import { readAgentContexts, upsertAgentContext } from "./agent-context-store.js";
+import { getAgentRun, markAgentRunStopped, readAgentRuns, upsertAgentRun, } from "./agent-run-store.js";
+import { readByokKeys, writeByokKeys } from "./byok-store.js";
 // =============================================================================
 // Helpers
 // =============================================================================
@@ -32,6 +37,445 @@ function safeErrorMessage(err) {
         return err;
     return "Unexpected error";
 }
+function isUserScopedApiKey(apiKey) {
+    return apiKey.trim().toLowerCase().startsWith("oxk_");
+}
+function parseJsonSafe(value) {
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return null;
+    }
+}
+function maskSecret(value) {
+    if (!value)
+        return null;
+    const trimmed = value.trim();
+    if (!trimmed)
+        return null;
+    if (trimmed.length <= 8)
+        return `${trimmed[0]}…${trimmed.slice(-1)}`;
+    return `${trimmed.slice(0, 4)}…${trimmed.slice(-4)}`;
+}
+function modelImpliesByok(model) {
+    const lower = (model ?? "").trim().toLowerCase();
+    if (!lower)
+        return false;
+    return (lower.includes("openrouter") ||
+        lower.includes("anthropic") ||
+        lower.includes("openai"));
+}
+async function fetchBillingStatusSafe(client) {
+    try {
+        return await client.getBillingStatus();
+    }
+    catch {
+        return null;
+    }
+}
+function resolveByokEnvOverrides() {
+    const stored = readByokKeys();
+    const env = {};
+    const openai = stored?.openaiApiKey?.trim() ?? "";
+    const anthropic = stored?.anthropicApiKey?.trim() ?? "";
+    const openrouter = stored?.openrouterApiKey?.trim() ?? "";
+    if (openai)
+        env.OPENAI_API_KEY = openai;
+    if (anthropic)
+        env.ANTHROPIC_API_KEY = anthropic;
+    if (openrouter)
+        env.OPENROUTER_API_KEY = openrouter;
+    return env;
+}
+async function runCommandCollect(input) {
+    const timeoutMs = input.timeoutMs ?? 10_000;
+    return await new Promise((resolve, reject) => {
+        const child = spawn(input.command, input.args, {
+            env: input.env ? { ...process.env, ...input.env } : process.env,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        const timer = timeoutMs
+            ? setTimeout(() => {
+                try {
+                    child.kill("SIGKILL");
+                }
+                catch {
+                    // best effort
+                }
+                reject(new Error(`Command timed out after ${timeoutMs}ms`));
+            }, timeoutMs)
+            : null;
+        child.stdout?.on("data", (chunk) => {
+            stdout += chunk.toString("utf8");
+        });
+        child.stderr?.on("data", (chunk) => {
+            stderr += chunk.toString("utf8");
+        });
+        child.on("error", (err) => {
+            if (timer)
+                clearTimeout(timer);
+            reject(err);
+        });
+        child.on("close", (code) => {
+            if (timer)
+                clearTimeout(timer);
+            resolve({ stdout, stderr, exitCode: typeof code === "number" ? code : null });
+        });
+    });
+}
+async function listOpenClawAgents() {
+    const result = await runCommandCollect({
+        command: "openclaw",
+        args: ["agents", "list", "--json"],
+        timeoutMs: 5_000,
+        env: resolveByokEnvOverrides(),
+    });
+    if (result.exitCode !== 0) {
+        throw new Error(result.stderr.trim() || "openclaw agents list failed");
+    }
+    const parsed = parseJsonSafe(result.stdout);
+    if (!Array.isArray(parsed)) {
+        throw new Error("openclaw agents list returned invalid JSON");
+    }
+    return parsed.filter((entry) => Boolean(entry && typeof entry === "object"));
+}
+function spawnOpenClawAgentTurn(input) {
+    const args = [
+        "agent",
+        "--agent",
+        input.agentId,
+        "--session-id",
+        input.sessionId,
+        "--message",
+        input.message,
+    ];
+    if (input.thinking) {
+        args.push("--thinking", input.thinking);
+    }
+    const child = spawn("openclaw", args, {
+        env: { ...process.env, ...resolveByokEnvOverrides() },
+        stdio: "ignore",
+        detached: true,
+    });
+    child.unref();
+    return { pid: child.pid ?? null };
+}
+function normalizeOpenClawProvider(value) {
+    const raw = (value ?? "").trim().toLowerCase();
+    if (!raw)
+        return null;
+    if (raw === "auto")
+        return null;
+    if (raw === "claude")
+        return "anthropic";
+    if (raw === "anthropic")
+        return "anthropic";
+    if (raw === "openrouter" || raw === "open-router")
+        return "openrouter";
+    if (raw === "openai")
+        return "openai";
+    return null;
+}
+async function setOpenClawAgentModel(input) {
+    const agentId = input.agentId.trim();
+    const model = input.model.trim();
+    if (!agentId || !model) {
+        throw new Error("agentId and model are required");
+    }
+    const result = await runCommandCollect({
+        command: "openclaw",
+        args: ["models", "--agent", agentId, "set", model],
+        timeoutMs: 10_000,
+        env: resolveByokEnvOverrides(),
+    });
+    if (result.exitCode !== 0) {
+        throw new Error(result.stderr.trim() || `openclaw models set failed for ${agentId}`);
+    }
+}
+async function listOpenClawProviderModels(input) {
+    const result = await runCommandCollect({
+        command: "openclaw",
+        args: [
+            "models",
+            "--agent",
+            input.agentId,
+            "list",
+            "--provider",
+            input.provider,
+            "--json",
+        ],
+        timeoutMs: 10_000,
+        env: resolveByokEnvOverrides(),
+    });
+    if (result.exitCode !== 0) {
+        throw new Error(result.stderr.trim() || "openclaw models list failed");
+    }
+    const parsed = parseJsonSafe(result.stdout);
+    if (!parsed || typeof parsed !== "object") {
+        const trimmed = result.stdout.trim();
+        if (!trimmed || /no models found/i.test(trimmed)) {
+            return [];
+        }
+        throw new Error("openclaw models list returned invalid JSON");
+    }
+    const modelsRaw = "models" in parsed && Array.isArray(parsed.models)
+        ? parsed.models
+        : [];
+    return modelsRaw
+        .map((entry) => {
+        if (!entry || typeof entry !== "object")
+            return null;
+        const row = entry;
+        const key = typeof row.key === "string" ? row.key.trim() : "";
+        const tags = Array.isArray(row.tags)
+            ? row.tags.filter((t) => typeof t === "string")
+            : [];
+        if (!key)
+            return null;
+        return { key, tags };
+    })
+        .filter((entry) => Boolean(entry));
+}
+function pickPreferredModel(models) {
+    if (models.length === 0)
+        return null;
+    const preferred = models.find((m) => m.tags.some((t) => t === "default"));
+    return preferred?.key ?? models[0]?.key ?? null;
+}
+async function configureOpenClawProviderRouting(input) {
+    const requestedModel = (input.requestedModel ?? "").trim() || null;
+    // Fast path: use known aliases where possible.
+    const aliasByProvider = {
+        anthropic: "opus",
+        openrouter: "sonnet",
+        openai: null,
+    };
+    const candidate = requestedModel ?? aliasByProvider[input.provider];
+    if (candidate) {
+        try {
+            await setOpenClawAgentModel({ agentId: input.agentId, model: candidate });
+            return { provider: input.provider, model: candidate };
+        }
+        catch {
+            // Fall through to discovery-based selection.
+        }
+    }
+    const models = await listOpenClawProviderModels({
+        agentId: input.agentId,
+        provider: input.provider,
+    });
+    const selected = pickPreferredModel(models);
+    if (!selected) {
+        throw new Error(`No ${input.provider} models configured for agent ${input.agentId}. Add a model in OpenClaw and retry.`);
+    }
+    await setOpenClawAgentModel({ agentId: input.agentId, model: selected });
+    return { provider: input.provider, model: selected };
+}
+function isPidAlive(pid) {
+    if (!Number.isFinite(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function stopDetachedProcess(pid) {
+    const alive = isPidAlive(pid);
+    if (!alive) {
+        return { stopped: true, wasRunning: false };
+    }
+    const tryKill = (signal) => {
+        try {
+            // Detached child becomes its own process group (pgid = pid) on Unix.
+            process.kill(-pid, signal);
+            return;
+        }
+        catch {
+            // Fall back to direct pid kill.
+        }
+        try {
+            process.kill(pid, signal);
+        }
+        catch {
+            // ignore
+        }
+    };
+    tryKill("SIGTERM");
+    await new Promise((resolve) => setTimeout(resolve, 450));
+    if (isPidAlive(pid)) {
+        tryKill("SIGKILL");
+    }
+    return { stopped: !isPidAlive(pid), wasRunning: true };
+}
+function getScopedAgentIds(contexts) {
+    const scoped = new Set();
+    for (const [key, ctx] of Object.entries(contexts)) {
+        if (!ctx || typeof ctx !== "object")
+            continue;
+        const agentId = (ctx.agentId ?? key).trim();
+        if (!agentId)
+            continue;
+        const initiativeId = ctx.initiativeId?.trim() ?? "";
+        if (initiativeId) {
+            scoped.add(agentId);
+        }
+    }
+    return scoped;
+}
+function applyAgentContextsToSessionTree(input, contexts) {
+    if (!input || !Array.isArray(input.nodes))
+        return input;
+    const groupsById = new Map();
+    for (const group of input.groups ?? []) {
+        if (!group)
+            continue;
+        groupsById.set(group.id, {
+            id: group.id,
+            label: group.label,
+            status: group.status ?? null,
+        });
+    }
+    const nodes = input.nodes.map((node) => {
+        const agentId = node.agentId?.trim() ?? "";
+        if (!agentId)
+            return node;
+        const ctx = contexts[agentId];
+        const initiativeId = ctx?.initiativeId?.trim() ?? "";
+        if (!initiativeId)
+            return node;
+        const groupId = initiativeId;
+        const ctxTitle = ctx.initiativeTitle?.trim() ?? "";
+        const groupLabel = ctxTitle || node.groupLabel || initiativeId;
+        const existing = groupsById.get(groupId);
+        if (!existing) {
+            groupsById.set(groupId, {
+                id: groupId,
+                label: groupLabel,
+                status: node.status ?? null,
+            });
+        }
+        else if (ctxTitle && (existing.label === groupId || existing.label.startsWith("Agent "))) {
+            groupsById.set(groupId, { ...existing, label: groupLabel });
+        }
+        return {
+            ...node,
+            initiativeId,
+            workstreamId: ctx.workstreamId ?? node.workstreamId ?? null,
+            groupId,
+            groupLabel,
+        };
+    });
+    // Ensure every node's group exists.
+    for (const node of nodes) {
+        if (!groupsById.has(node.groupId)) {
+            groupsById.set(node.groupId, {
+                id: node.groupId,
+                label: node.groupLabel || node.groupId,
+                status: node.status ?? null,
+            });
+        }
+    }
+    return {
+        ...input,
+        nodes,
+        groups: Array.from(groupsById.values()),
+    };
+}
+function applyAgentContextsToActivity(input, contexts) {
+    if (!Array.isArray(input))
+        return [];
+    return input.map((item) => {
+        const agentId = item.agentId?.trim() ?? "";
+        if (!agentId)
+            return item;
+        const ctx = contexts[agentId];
+        const initiativeId = ctx?.initiativeId?.trim() ?? "";
+        if (!initiativeId)
+            return item;
+        const metadata = item.metadata && typeof item.metadata === "object"
+            ? { ...item.metadata }
+            : {};
+        metadata.orgx_context = {
+            initiativeId,
+            workstreamId: ctx.workstreamId ?? null,
+            taskId: ctx.taskId ?? null,
+            updatedAt: ctx.updatedAt,
+        };
+        return {
+            ...item,
+            initiativeId,
+            metadata,
+        };
+    });
+}
+function mergeSessionTrees(base, extra) {
+    const seenNodes = new Set();
+    const nodes = [];
+    for (const node of base.nodes ?? []) {
+        seenNodes.add(node.id);
+        nodes.push(node);
+    }
+    for (const node of extra.nodes ?? []) {
+        if (seenNodes.has(node.id))
+            continue;
+        seenNodes.add(node.id);
+        nodes.push(node);
+    }
+    const seenEdges = new Set();
+    const edges = [];
+    for (const edge of base.edges ?? []) {
+        const key = `${edge.parentId}→${edge.childId}`;
+        seenEdges.add(key);
+        edges.push(edge);
+    }
+    for (const edge of extra.edges ?? []) {
+        const key = `${edge.parentId}→${edge.childId}`;
+        if (seenEdges.has(key))
+            continue;
+        seenEdges.add(key);
+        edges.push(edge);
+    }
+    const groupsById = new Map();
+    for (const group of base.groups ?? []) {
+        groupsById.set(group.id, group);
+    }
+    for (const group of extra.groups ?? []) {
+        const existing = groupsById.get(group.id);
+        if (!existing) {
+            groupsById.set(group.id, group);
+            continue;
+        }
+        const nextLabel = existing.label === existing.id && group.label && group.label !== group.id
+            ? group.label
+            : existing.label;
+        groupsById.set(group.id, { ...existing, label: nextLabel });
+    }
+    return {
+        nodes,
+        edges,
+        groups: Array.from(groupsById.values()),
+    };
+}
+function mergeActivities(base, extra, limit) {
+    const merged = [...(base ?? []), ...(extra ?? [])].sort((a, b) => Date.parse(b.timestamp) - Date.parse(a.timestamp));
+    const deduped = [];
+    const seen = new Set();
+    for (const item of merged) {
+        if (seen.has(item.id))
+            continue;
+        seen.add(item.id);
+        deduped.push(item);
+        if (deduped.length >= limit)
+            break;
+    }
+    return deduped;
+}
 const ACTIVITY_HEADLINE_TIMEOUT_MS = 4_000;
 const ACTIVITY_HEADLINE_CACHE_TTL_MS = 12 * 60 * 60_000;
 const ACTIVITY_HEADLINE_CACHE_MAX = 1_000;
@@ -78,53 +522,6 @@ function heuristicActivityHeadline(text, title) {
         return cleanedTitle;
     return "Activity update";
 }
-function readDotEnvValue(pattern) {
-    try {
-        const envPath = join(homedir(), "Code", "orgx", "orgx", ".env.local");
-        const envContent = readFileSync(envPath, "utf-8");
-        const match = envContent.match(pattern);
-        return match?.[1]?.trim() ?? "";
-    }
-    catch {
-        return "";
-    }
-}
-function findOpenRouterApiKeyInConfig(input, trail = []) {
-    if (!input || typeof input !== "object")
-        return null;
-    if (Array.isArray(input)) {
-        for (const value of input) {
-            const nested = findOpenRouterApiKeyInConfig(value, trail);
-            if (nested)
-                return nested;
-        }
-        return null;
-    }
-    const record = input;
-    for (const [key, value] of Object.entries(record)) {
-        const nextTrail = [...trail, key.toLowerCase()];
-        if (typeof value === "string" &&
-            key.toLowerCase() === "apikey" &&
-            nextTrail.join(".").includes("openrouter") &&
-            value.trim().length > 0) {
-            return value.trim();
-        }
-        const nested = findOpenRouterApiKeyInConfig(value, nextTrail);
-        if (nested)
-            return nested;
-    }
-    return null;
-}
-function readOpenRouterApiKeyFromConfig() {
-    try {
-        const raw = readFileSync(join(homedir(), ".openclaw", "openclaw.json"), "utf8");
-        const parsed = JSON.parse(raw);
-        return findOpenRouterApiKeyInConfig(parsed) ?? "";
-    }
-    catch {
-        return "";
-    }
-}
 function resolveActivitySummaryApiKey() {
     if (resolvedActivitySummaryApiKey !== undefined) {
         return resolvedActivitySummaryApiKey;
@@ -132,9 +529,6 @@ function resolveActivitySummaryApiKey() {
     const candidates = [
         process.env.ORGX_ACTIVITY_SUMMARY_API_KEY ?? "",
         process.env.OPENROUTER_API_KEY ?? "",
-        readDotEnvValue(/^ORGX_ACTIVITY_SUMMARY_API_KEY=["']?([^"'\n]+)["']?$/m),
-        readDotEnvValue(/^OPENROUTER_API_KEY=["']?([^"'\n]+)["']?$/m),
-        readOpenRouterApiKeyFromConfig(),
     ];
     const key = candidates.find((candidate) => candidate.trim().length > 0)?.trim() ?? "";
     resolvedActivitySummaryApiKey = key || null;
@@ -296,13 +690,63 @@ function contentType(filePath) {
     return MIME_TYPES[extname(filePath).toLowerCase()] ?? "application/octet-stream";
 }
 // =============================================================================
-// CORS headers (for local dev)
+// CORS + response hardening
 // =============================================================================
 const CORS_HEADERS = {
-    "Access-Control-Allow-Origin": "*",
     "Access-Control-Allow-Methods": "GET, POST, PATCH, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type, Authorization",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization, X-OrgX-Api-Key, X-API-Key, X-OrgX-User-Id",
+    Vary: "Origin",
+};
+const SECURITY_HEADERS = {
+    "X-Content-Type-Options": "nosniff",
+    "X-Frame-Options": "DENY",
+    "Referrer-Policy": "same-origin",
+    "Cross-Origin-Resource-Policy": "same-origin",
 };
+function normalizeHost(value) {
+    return value.trim().toLowerCase().replace(/^\[|\]$/g, "");
+}
+function isLoopbackHost(hostname) {
+    const host = normalizeHost(hostname);
+    return host === "localhost" || host === "127.0.0.1" || host === "::1";
+}
+function isTrustedOrigin(origin) {
+    try {
+        const parsed = new URL(origin);
+        if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+            return false;
+        }
+        return isLoopbackHost(parsed.hostname);
+    }
+    catch {
+        return false;
+    }
+}
+function isTrustedRequestSource(headers) {
+    const fetchSite = pickHeaderString(headers, ["sec-fetch-site"]);
+    if (fetchSite) {
+        const normalizedFetchSite = fetchSite.trim().toLowerCase();
+        if (normalizedFetchSite !== "same-origin" &&
+            normalizedFetchSite !== "same-site" &&
+            normalizedFetchSite !== "none") {
+            return false;
+        }
+    }
+    const origin = pickHeaderString(headers, ["origin"]);
+    if (origin) {
+        return isTrustedOrigin(origin);
+    }
+    const referer = pickHeaderString(headers, ["referer"]);
+    if (referer) {
+        try {
+            return isTrustedOrigin(new URL(referer).origin);
+        }
+        catch {
+            return false;
+        }
+    }
+    return true;
+}
 const STREAM_IDLE_TIMEOUT_MS = 60_000;
 // =============================================================================
 // Resolve the dashboard/dist/ directory relative to this file
@@ -310,6 +754,21 @@ const STREAM_IDLE_TIMEOUT_MS = 60_000;
 const __filename = fileURLToPath(import.meta.url);
 // src/http-handler.ts → up to plugin root → dashboard/dist
 const DIST_DIR = join(__filename, "..", "..", "dashboard", "dist");
+const RESOLVED_DIST_DIR = resolve(DIST_DIR);
+const RESOLVED_DIST_ASSETS_DIR = resolve(DIST_DIR, "assets");
+function resolveSafeDistPath(subPath) {
+    if (!subPath || subPath.includes("\0"))
+        return null;
+    const normalized = normalize(subPath).replace(/^([/\\])+/, "");
+    if (!normalized || normalized === ".")
+        return null;
+    const candidate = resolve(DIST_DIR, normalized);
+    const rel = relative(RESOLVED_DIST_DIR, candidate);
+    if (!rel || rel === "." || rel.startsWith("..") || rel.includes(`..${sep}`)) {
+        return null;
+    }
+    return candidate;
+}
 // =============================================================================
 // Helpers
 // =============================================================================
@@ -317,6 +776,7 @@ function sendJson(res, status, data) {
     const body = JSON.stringify(data);
     res.writeHead(status, {
         "Content-Type": "application/json; charset=utf-8",
+        ...SECURITY_HEADERS,
         ...CORS_HEADERS,
     });
     res.end(body);
@@ -327,6 +787,7 @@ function sendFile(res, filePath, cacheControl) {
         res.writeHead(200, {
             "Content-Type": contentType(filePath),
             "Cache-Control": cacheControl,
+            ...SECURITY_HEADERS,
             ...CORS_HEADERS,
         });
         res.end(content);
@@ -338,6 +799,7 @@ function sendFile(res, filePath, cacheControl) {
 function send404(res) {
     res.writeHead(404, {
         "Content-Type": "text/plain; charset=utf-8",
+        ...SECURITY_HEADERS,
         ...CORS_HEADERS,
     });
     res.end("Not Found");
@@ -350,6 +812,7 @@ function sendIndexHtml(res) {
     else {
         res.writeHead(503, {
             "Content-Type": "text/html; charset=utf-8",
+            ...SECURITY_HEADERS,
             ...CORS_HEADERS,
         });
         res.end("<html><body><h1>Dashboard not built</h1>" +
@@ -382,11 +845,120 @@ function parseJsonBody(body) {
             return {};
         }
     }
+    if (body instanceof Uint8Array) {
+        try {
+            const parsed = JSON.parse(Buffer.from(body).toString("utf8"));
+            return typeof parsed === "object" && parsed !== null
+                ? parsed
+                : {};
+        }
+        catch {
+            return {};
+        }
+    }
+    if (body instanceof ArrayBuffer) {
+        try {
+            const parsed = JSON.parse(Buffer.from(body).toString("utf8"));
+            return typeof parsed === "object" && parsed !== null
+                ? parsed
+                : {};
+        }
+        catch {
+            return {};
+        }
+    }
     if (typeof body === "object") {
         return body;
     }
     return {};
 }
+const MAX_JSON_BODY_BYTES = 1_000_000;
+const JSON_BODY_TIMEOUT_MS = 2_000;
+function chunkToBuffer(chunk) {
+    if (!chunk)
+        return Buffer.alloc(0);
+    if (Buffer.isBuffer(chunk))
+        return chunk;
+    if (typeof chunk === "string")
+        return Buffer.from(chunk, "utf8");
+    if (chunk instanceof Uint8Array)
+        return Buffer.from(chunk);
+    try {
+        return Buffer.from(JSON.stringify(chunk), "utf8");
+    }
+    catch {
+        return Buffer.from(String(chunk), "utf8");
+    }
+}
+async function readRequestBodyBuffer(req) {
+    const on = req.on ? req.on.bind(req) : null;
+    if (!on)
+        return null;
+    return await new Promise((resolve) => {
+        const chunks = [];
+        let totalBytes = 0;
+        let finished = false;
+        const finish = (buffer) => {
+            if (finished)
+                return;
+            finished = true;
+            clearTimeout(timer);
+            resolve(buffer);
+        };
+        const timer = setTimeout(() => finish(null), JSON_BODY_TIMEOUT_MS);
+        on("data", (chunk) => {
+            const buf = chunkToBuffer(chunk);
+            if (buf.length === 0)
+                return;
+            totalBytes += buf.length;
+            if (totalBytes > MAX_JSON_BODY_BYTES) {
+                finish(null);
+                return;
+            }
+            chunks.push(buf);
+        });
+        const onDone = () => {
+            if (chunks.length === 0) {
+                finish(Buffer.alloc(0));
+            }
+            else {
+                finish(Buffer.concat(chunks, totalBytes));
+            }
+        };
+        const once = (req.once ?? req.on)?.bind(req) ?? null;
+        if (once) {
+            once("end", onDone);
+            once("error", () => finish(null));
+        }
+        else {
+            on("end", onDone);
+            on("error", () => finish(null));
+        }
+    });
+}
+async function parseJsonRequest(req) {
+    const body = req.body;
+    if (typeof body === "string" && body.length > 0) {
+        return parseJsonBody(body);
+    }
+    if (Buffer.isBuffer(body) && body.length > 0) {
+        return parseJsonBody(body);
+    }
+    if (body instanceof Uint8Array && body.byteLength > 0) {
+        return parseJsonBody(body);
+    }
+    if (body instanceof ArrayBuffer && body.byteLength > 0) {
+        return parseJsonBody(body);
+    }
+    if (body && typeof body === "object" && !Buffer.isBuffer(body)) {
+        return parseJsonBody(body);
+    }
+    const streamed = await readRequestBodyBuffer(req);
+    if (!streamed || streamed.length === 0) {
+        return {};
+    }
+    return parseJsonBody(streamed);
+}
 function pickString(record, keys) {
     for (const key of keys) {
         const value = record[key];
@@ -487,17 +1059,101 @@ function parsePositiveInt(raw, fallback) {
         return fallback;
     return Math.max(1, Math.floor(parsed));
 }
+function parseBooleanQuery(raw) {
+    if (!raw)
+        return false;
+    const normalized = raw.trim().toLowerCase();
+    return (normalized === "1" ||
+        normalized === "true" ||
+        normalized === "yes" ||
+        normalized === "on");
+}
 const DEFAULT_DURATION_HOURS = {
     initiative: 40,
     workstream: 16,
     milestone: 6,
     task: 2,
 };
+function readBudgetEnvNumber(name, fallback, bounds = {}) {
+    const raw = process.env[name];
+    if (typeof raw !== "string" || raw.trim().length === 0)
+        return fallback;
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed))
+        return fallback;
+    if (typeof bounds.min === "number" && parsed < bounds.min)
+        return fallback;
+    if (typeof bounds.max === "number" && parsed > bounds.max)
+        return fallback;
+    return parsed;
+}
+const DEFAULT_TOKEN_MODEL_PRICING_USD_PER_1M = {
+    // GPT-5.3 Codex API pricing is not published yet; use GPT-5.2 Codex pricing as proxy.
+    gpt53CodexProxy: {
+        input: readBudgetEnvNumber("ORGX_BUDGET_GPT53_CODEX_INPUT_PER_1M", 1.75, { min: 0 }),
+        cachedInput: readBudgetEnvNumber("ORGX_BUDGET_GPT53_CODEX_CACHED_INPUT_PER_1M", 0.175, {
+            min: 0,
+        }),
+        output: readBudgetEnvNumber("ORGX_BUDGET_GPT53_CODEX_OUTPUT_PER_1M", 14, { min: 0 }),
+    },
+    opus46: {
+        input: readBudgetEnvNumber("ORGX_BUDGET_OPUS46_INPUT_PER_1M", 5, { min: 0 }),
+        // Anthropic does not publish a fixed cached-input rate on the model page.
+        cachedInput: readBudgetEnvNumber("ORGX_BUDGET_OPUS46_CACHED_INPUT_PER_1M", 5, { min: 0 }),
+        output: readBudgetEnvNumber("ORGX_BUDGET_OPUS46_OUTPUT_PER_1M", 25, { min: 0 }),
+    },
+};
+const DEFAULT_TOKEN_BUDGET_ASSUMPTIONS = {
+    tokensPerHour: readBudgetEnvNumber("ORGX_BUDGET_TOKENS_PER_HOUR", 1_200_000, { min: 1 }),
+    inputShare: readBudgetEnvNumber("ORGX_BUDGET_INPUT_TOKEN_SHARE", 0.86, { min: 0, max: 1 }),
+    cachedInputShare: readBudgetEnvNumber("ORGX_BUDGET_CACHED_INPUT_SHARE", 0.15, {
+        min: 0,
+        max: 1,
+    }),
+    contingencyMultiplier: readBudgetEnvNumber("ORGX_BUDGET_CONTINGENCY_MULTIPLIER", 1.3, {
+        min: 0.1,
+    }),
+    roundingStepUsd: readBudgetEnvNumber("ORGX_BUDGET_ROUNDING_STEP_USD", 5, { min: 0.01 }),
+};
+const DEFAULT_TOKEN_MODEL_MIX = {
+    gpt53CodexProxy: 0.7,
+    opus46: 0.3,
+};
+function modelCostPerMillionTokensUsd(pricing) {
+    const inputShare = DEFAULT_TOKEN_BUDGET_ASSUMPTIONS.inputShare;
+    const outputShare = Math.max(0, 1 - inputShare);
+    const cachedShare = DEFAULT_TOKEN_BUDGET_ASSUMPTIONS.cachedInputShare;
+    const uncachedShare = Math.max(0, 1 - cachedShare);
+    const effectiveInputRate = pricing.input * uncachedShare + pricing.cachedInput * cachedShare;
+    return inputShare * effectiveInputRate + outputShare * pricing.output;
+}
+function estimateBudgetUsdFromDurationHours(durationHours) {
+    if (!Number.isFinite(durationHours) || durationHours <= 0)
+        return 0;
+    const blendedPerMillionUsd = DEFAULT_TOKEN_MODEL_MIX.gpt53CodexProxy *
+        modelCostPerMillionTokensUsd(DEFAULT_TOKEN_MODEL_PRICING_USD_PER_1M.gpt53CodexProxy) +
+        DEFAULT_TOKEN_MODEL_MIX.opus46 *
+            modelCostPerMillionTokensUsd(DEFAULT_TOKEN_MODEL_PRICING_USD_PER_1M.opus46);
+    const tokenMillions = (durationHours * DEFAULT_TOKEN_BUDGET_ASSUMPTIONS.tokensPerHour) / 1_000_000;
+    const rawBudgetUsd = tokenMillions *
+        blendedPerMillionUsd *
+        DEFAULT_TOKEN_BUDGET_ASSUMPTIONS.contingencyMultiplier;
+    const roundedBudgetUsd = Math.round(rawBudgetUsd / DEFAULT_TOKEN_BUDGET_ASSUMPTIONS.roundingStepUsd) *
+        DEFAULT_TOKEN_BUDGET_ASSUMPTIONS.roundingStepUsd;
+    return Math.max(0, roundedBudgetUsd);
+}
+function isLegacyHourlyBudget(budgetUsd, durationHours) {
+    if (!Number.isFinite(budgetUsd) || !Number.isFinite(durationHours) || durationHours <= 0) {
+        return false;
+    }
+    const legacyHourlyBudget = durationHours * 40;
+    return Math.abs(budgetUsd - legacyHourlyBudget) <= 0.5;
+}
 const DEFAULT_BUDGET_USD = {
-    initiative: 1500,
-    workstream: 300,
-    milestone: 120,
-    task: 40,
+    initiative: estimateBudgetUsdFromDurationHours(DEFAULT_DURATION_HOURS.initiative),
+    workstream: estimateBudgetUsdFromDurationHours(DEFAULT_DURATION_HOURS.workstream),
+    milestone: estimateBudgetUsdFromDurationHours(DEFAULT_DURATION_HOURS.milestone),
+    task: estimateBudgetUsdFromDurationHours(DEFAULT_DURATION_HOURS.task),
 };
 const PRIORITY_LABEL_TO_NUM = {
     urgent: 10,
@@ -726,7 +1382,7 @@ function toMissionControlNode(type, entity, fallbackInitiativeId) {
         ]) ??
         extractDurationHoursFromText(pickString(record, ["description", "summary", "context"]), pickString(metadata, ["description", "summary", "context"])) ??
         DEFAULT_DURATION_HOURS[type];
-    const expectedBudget = pickNumber(record, [
+    const explicitBudget = pickNumber(record, [
         "expected_budget_usd",
         "expectedBudgetUsd",
         "budget_usd",
@@ -737,9 +1393,15 @@ function toMissionControlNode(type, entity, fallbackInitiativeId) {
             "expectedBudgetUsd",
             "budget_usd",
             "budgetUsd",
-        ]) ??
-        extractBudgetUsdFromText(pickString(record, ["description", "summary", "context"]), pickString(metadata, ["description", "summary", "context"])) ??
-        DEFAULT_BUDGET_USD[type];
+        ]);
+    const extractedBudget = extractBudgetUsdFromText(pickString(record, ["description", "summary", "context"]), pickString(metadata, ["description", "summary", "context"])) ?? null;
+    const tokenModeledBudget = estimateBudgetUsdFromDurationHours(expectedDuration > 0 ? expectedDuration : DEFAULT_DURATION_HOURS[type]) || DEFAULT_BUDGET_USD[type];
+    const expectedBudget = explicitBudget ??
+        (typeof extractedBudget === "number"
+            ? isLegacyHourlyBudget(extractedBudget, expectedDuration)
+                ? tokenModeledBudget
+                : extractedBudget
+            : DEFAULT_BUDGET_USD[type]);
     const priority = normalizePriorityForEntity(record);
     return {
         id: String(record.id ?? ""),
@@ -1199,27 +1861,501 @@ async function resolveAutoAssignments(input) {
 // =============================================================================
 // Factory
 // =============================================================================
-export function createHttpHandler(config, client, getSnapshot, onboarding) {
+export function createHttpHandler(config, client, getSnapshot, onboarding, diagnostics, adapters) {
     const dashboardEnabled = config.dashboardEnabled ??
         true;
-    return async function handler(req, res) {
-        const method = (req.method ?? "GET").toUpperCase();
-        const rawUrl = req.url ?? "/";
-        const [path, queryString] = rawUrl.split("?", 2);
-        const url = path;
-        const searchParams = new URLSearchParams(queryString ?? "");
-        // Only handle /orgx paths — return false for everything else
-        if (!url.startsWith("/orgx")) {
-            return false;
+    const outboxAdapter = adapters?.outbox ?? defaultOutboxAdapter;
+    const autoContinueRuns = new Map();
+    let autoContinueTickInFlight = false;
+    const AUTO_CONTINUE_TICK_MS = 2_500;
+    function normalizeTokenBudget(value, fallback) {
+        if (typeof value === "number" && Number.isFinite(value)) {
+            return Math.max(1_000, Math.round(value));
+        }
+        if (typeof value === "string" && value.trim().length > 0) {
+            const parsed = Number(value);
+            if (Number.isFinite(parsed)) {
+                return Math.max(1_000, Math.round(parsed));
+            }
+        }
+        return Math.max(1_000, Math.round(fallback));
+    }
+    function defaultAutoContinueTokenBudget() {
+        const hours = readBudgetEnvNumber("ORGX_AUTO_CONTINUE_BUDGET_HOURS", 4, {
+            min: 0.05,
+            max: 24,
+        });
+        const fallback = DEFAULT_TOKEN_BUDGET_ASSUMPTIONS.tokensPerHour *
+            hours *
+            DEFAULT_TOKEN_BUDGET_ASSUMPTIONS.contingencyMultiplier;
+        return normalizeTokenBudget(process.env.ORGX_AUTO_CONTINUE_TOKEN_BUDGET, fallback);
+    }
+    function estimateTokensForDurationHours(durationHours) {
+        if (!Number.isFinite(durationHours) || durationHours <= 0)
+            return 0;
+        const raw = durationHours *
+            DEFAULT_TOKEN_BUDGET_ASSUMPTIONS.tokensPerHour *
+            DEFAULT_TOKEN_BUDGET_ASSUMPTIONS.contingencyMultiplier;
+        return Math.max(0, Math.round(raw));
+    }
+    function isSafePathSegment(value) {
+        const normalized = value.trim();
+        if (!normalized || normalized === "." || normalized === "..")
+            return false;
+        if (normalized.includes("/") || normalized.includes("\\") || normalized.includes("\0")) {
+            return false;
+        }
+        if (normalized.includes(".."))
+            return false;
+        return true;
+    }
+    function toFiniteNumber(value) {
+        if (typeof value === "number" && Number.isFinite(value))
+            return value;
+        if (typeof value === "string" && value.trim().length > 0) {
+            const parsed = Number(value);
+            if (Number.isFinite(parsed))
+                return parsed;
+        }
+        return null;
+    }
+    function readOpenClawSessionSummary(input) {
+        const agentId = input.agentId.trim();
+        const sessionId = input.sessionId.trim();
+        if (!agentId || !sessionId) {
+            return { tokens: 0, costUsd: 0, hadError: false, errorMessage: null };
+        }
+        if (!isSafePathSegment(agentId) || !isSafePathSegment(sessionId)) {
+            return { tokens: 0, costUsd: 0, hadError: false, errorMessage: null };
+        }
+        const jsonlPath = join(homedir(), ".openclaw", "agents", agentId, "sessions", `${sessionId}.jsonl`);
+        try {
+            if (!existsSync(jsonlPath)) {
+                return { tokens: 0, costUsd: 0, hadError: false, errorMessage: null };
+            }
+            const raw = readFileSync(jsonlPath, "utf8");
+            const lines = raw.split("\n");
+            let tokens = 0;
+            let costUsd = 0;
+            let hadError = false;
+            let errorMessage = null;
+            for (const line of lines) {
+                const trimmed = line.trim();
+                if (!trimmed)
+                    continue;
+                try {
+                    const evt = JSON.parse(trimmed);
+                    if (evt.type !== "message")
+                        continue;
+                    const msg = evt.message;
+                    if (!msg || typeof msg !== "object")
+                        continue;
+                    const usage = msg.usage;
+                    if (usage && typeof usage === "object") {
+                        const totalTokens = toFiniteNumber(usage.totalTokens) ??
+                            toFiniteNumber(usage.total_tokens) ??
+                            null;
+                        const inputTokens = toFiniteNumber(usage.input) ?? 0;
+                        const outputTokens = toFiniteNumber(usage.output) ?? 0;
+                        const cacheReadTokens = toFiniteNumber(usage.cacheRead) ?? 0;
+                        const cacheWriteTokens = toFiniteNumber(usage.cacheWrite) ?? 0;
+                        tokens += Math.max(0, Math.round(totalTokens ??
+                            inputTokens + outputTokens + cacheReadTokens + cacheWriteTokens));
+                        const cost = usage.cost;
+                        const costTotal = cost ? toFiniteNumber(cost.total) : null;
+                        if (costTotal !== null) {
+                            costUsd += Math.max(0, costTotal);
+                        }
+                    }
+                    const stopReason = typeof msg.stopReason === "string" ? msg.stopReason : "";
+                    const msgError = typeof msg.errorMessage === "string" && msg.errorMessage.trim().length > 0
+                        ? msg.errorMessage.trim()
+                        : null;
+                    if (stopReason === "error" || msgError) {
+                        hadError = true;
+                        errorMessage = msgError ?? errorMessage;
+                    }
+                }
+                catch {
+                    // Ignore malformed lines.
+                }
+            }
+            return {
+                tokens,
+                costUsd: Math.round(costUsd * 10_000) / 10_000,
+                hadError,
+                errorMessage,
+            };
+        }
+        catch {
+            return { tokens: 0, costUsd: 0, hadError: false, errorMessage: null };
+        }
+    }
+    async function fetchInitiativeEntity(initiativeId) {
+        try {
+            const list = await client.listEntities("initiative", { limit: 200 });
+            const match = list.data.find((candidate) => String(candidate?.id ?? "") === initiativeId);
+            return match ?? null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async function updateInitiativeMetadata(initiativeId, patch) {
+        const existing = await fetchInitiativeEntity(initiativeId);
+        const existingMeta = existing && typeof existing === "object"
+            ? getRecordMetadata(existing)
+            : {};
+        const nextMeta = { ...existingMeta, ...patch };
+        await client.updateEntity("initiative", initiativeId, { metadata: nextMeta });
+    }
+    async function updateInitiativeAutoContinueState(input) {
+        const now = new Date().toISOString();
+        const patch = {
+            auto_continue_enabled: true,
+            auto_continue_status: input.run.status,
+            auto_continue_stop_reason: input.run.stopReason,
+            auto_continue_started_at: input.run.startedAt,
+            auto_continue_stopped_at: input.run.stoppedAt,
+            auto_continue_updated_at: now,
+            auto_continue_token_budget: input.run.tokenBudget,
+            auto_continue_tokens_used: input.run.tokensUsed,
+            auto_continue_active_task_id: input.run.activeTaskId,
+            auto_continue_active_run_id: input.run.activeRunId,
+            auto_continue_active_task_token_estimate: input.run.activeTaskTokenEstimate,
+            auto_continue_last_task_id: input.run.lastTaskId,
+            auto_continue_last_run_id: input.run.lastRunId,
+            auto_continue_include_verification: input.run.includeVerification,
+            auto_continue_workstream_filter: input.run.allowedWorkstreamIds,
+            ...(input.run.lastError ? { auto_continue_last_error: input.run.lastError } : {}),
+        };
+        await updateInitiativeMetadata(input.initiativeId, patch);
+    }
+    async function stopAutoContinueRun(input) {
+        const now = new Date().toISOString();
+        input.run.status = "stopped";
+        input.run.stopReason = input.reason;
+        input.run.stoppedAt = now;
+        input.run.updatedAt = now;
+        input.run.stopRequested = false;
+        input.run.activeRunId = null;
+        input.run.activeTaskId = null;
+        if (input.error)
+            input.run.lastError = input.error;
+        try {
+            if (input.reason === "completed") {
+                await client.updateEntity("initiative", input.run.initiativeId, {
+                    status: "completed",
+                });
+            }
+            else {
+                await client.updateEntity("initiative", input.run.initiativeId, {
+                    status: "paused",
+                });
+            }
+        }
+        catch {
+            // best effort; UI still derives paused state locally
+        }
+        try {
+            await updateInitiativeAutoContinueState({
+                initiativeId: input.run.initiativeId,
+                run: input.run,
+            });
+        }
+        catch {
+            // best effort
+        }
+    }
+    async function tickAutoContinueRun(run) {
+        if (run.status !== "running" && run.status !== "stopping")
+            return;
+        const now = new Date().toISOString();
+        // 1) If we have an active run, wait for it to finish.
+        if (run.activeRunId) {
+            const record = getAgentRun(run.activeRunId);
+            const pid = record?.pid ?? null;
+            if (pid && isPidAlive(pid)) {
+                return;
+            }
+            // Run finished (or pid missing). Mark stopped and auto-complete the task.
+            if (record) {
+                try {
+                    markAgentRunStopped(record.runId);
+                }
+                catch {
+                    // ignore
+                }
+                const summary = readOpenClawSessionSummary({
+                    agentId: record.agentId,
+                    sessionId: record.runId,
+                });
+                const modeledTokens = run.activeTaskTokenEstimate ?? 0;
+                const consumedTokens = summary.tokens > 0 ? summary.tokens : modeledTokens;
+                run.tokensUsed += Math.max(0, consumedTokens);
+                run.activeTaskTokenEstimate = null;
+                if (record.taskId) {
+                    try {
+                        await client.updateEntity("task", record.taskId, {
+                            status: summary.hadError ? "blocked" : "done",
+                        });
+                    }
+                    catch (err) {
+                        run.lastError = safeErrorMessage(err);
+                    }
+                }
+                run.lastRunId = record.runId;
+                run.lastTaskId = record.taskId ?? run.lastTaskId;
+                run.activeRunId = null;
+                run.activeTaskId = null;
+                run.updatedAt = now;
+                if (summary.hadError && summary.errorMessage) {
+                    run.lastError = summary.errorMessage;
+                }
+                try {
+                    await updateInitiativeAutoContinueState({
+                        initiativeId: run.initiativeId,
+                        run,
+                    });
+                }
+                catch {
+                    // best effort
+                }
+            }
+            else {
+                // No record; clear active pointers so we can continue.
+                run.activeRunId = null;
+                run.activeTaskId = null;
+            }
+            // If a stop was requested, finalize after the active run completes.
+            if (run.stopRequested) {
+                await stopAutoContinueRun({ run, reason: "stopped" });
+                return;
+            }
+        }
+        if (run.stopRequested) {
+            run.status = "stopping";
+            run.updatedAt = now;
+            await stopAutoContinueRun({ run, reason: "stopped" });
+            return;
+        }
+        // 2) Enforce token guardrail before starting a new task.
+        if (run.tokensUsed >= run.tokenBudget) {
+            await stopAutoContinueRun({ run, reason: "budget_exhausted" });
+            return;
+        }
+        // 3) Pick next-up task and dispatch.
+        let graph;
+        try {
+            graph = await buildMissionControlGraph(client, run.initiativeId);
+        }
+        catch (err) {
+            await stopAutoContinueRun({
+                run,
+                reason: "error",
+                error: safeErrorMessage(err),
+            });
+            return;
+        }
+        const nodes = graph.nodes;
+        const nodeById = new Map(nodes.map((node) => [node.id, node]));
+        const taskNodes = nodes.filter((node) => node.type === "task");
+        const todoTasks = taskNodes.filter((node) => isTodoStatus(node.status));
+        if (todoTasks.length === 0) {
+            await stopAutoContinueRun({ run, reason: "completed" });
+            return;
+        }
+        const taskIsReady = (task) => task.dependencyIds.every((depId) => {
+            const dependency = nodeById.get(depId);
+            return dependency ? isDoneStatus(dependency.status) : true;
+        });
+        const taskHasBlockedParent = (task) => {
+            const milestone = task.milestoneId ? nodeById.get(task.milestoneId) ?? null : null;
+            const workstream = task.workstreamId ? nodeById.get(task.workstreamId) ?? null : null;
+            return (milestone?.status?.toLowerCase() === "blocked" ||
+                workstream?.status?.toLowerCase() === "blocked");
+        };
+        let nextTaskNode = null;
+        for (const taskId of graph.recentTodos) {
+            const node = nodeById.get(taskId);
+            if (!node || node.type !== "task")
+                continue;
+            if (!isTodoStatus(node.status))
+                continue;
+            if (!run.includeVerification &&
+                typeof node.title === "string" &&
+                /^verification\s+scenario/i.test(node.title)) {
+                continue;
+            }
+            if (run.allowedWorkstreamIds &&
+                node.workstreamId &&
+                !run.allowedWorkstreamIds.includes(node.workstreamId)) {
+                continue;
+            }
+            if (node.workstreamId) {
+                const ws = nodeById.get(node.workstreamId);
+                if (ws && !isInProgressStatus(ws.status)) {
+                    continue;
+                }
+            }
+            if (!taskIsReady(node))
+                continue;
+            if (taskHasBlockedParent(node))
+                continue;
+            nextTaskNode = node;
+            break;
+        }
+        if (!nextTaskNode) {
+            await stopAutoContinueRun({ run, reason: "blocked" });
+            return;
+        }
+        const nextTaskTokenEstimate = estimateTokensForDurationHours(typeof nextTaskNode.expectedDurationHours === "number"
+            ? nextTaskNode.expectedDurationHours
+            : 0);
+        if (nextTaskTokenEstimate > 0 &&
+            run.tokensUsed + nextTaskTokenEstimate > run.tokenBudget) {
+            await stopAutoContinueRun({ run, reason: "budget_exhausted" });
+            return;
+        }
+        const agentId = run.agentId || "main";
+        const sessionId = randomUUID();
+        const initiativeNode = nodes.find((node) => node.type === "initiative") ?? null;
+        const workstreamTitle = nextTaskNode.workstreamId
+            ? nodeById.get(nextTaskNode.workstreamId)?.title ?? null
+            : null;
+        const milestoneTitle = nextTaskNode.milestoneId
+            ? nodeById.get(nextTaskNode.milestoneId)?.title ?? null
+            : null;
+        const message = [
+            initiativeNode ? `Initiative: ${initiativeNode.title}` : null,
+            workstreamTitle ? `Workstream: ${workstreamTitle}` : null,
+            milestoneTitle ? `Milestone: ${milestoneTitle}` : null,
+            "",
+            `Task: ${nextTaskNode.title}`,
+            "",
+            "Execute this task. When finished, provide a concise completion summary and any relevant commands/notes.",
+        ]
+            .filter((line) => typeof line === "string")
+            .join("\n");
+        try {
+            await client.updateEntity("task", nextTaskNode.id, {
+                status: "in_progress",
+            });
+        }
+        catch (err) {
+            await stopAutoContinueRun({
+                run,
+                reason: "error",
+                error: safeErrorMessage(err),
+            });
+            return;
+        }
+        upsertAgentContext({
+            agentId,
+            initiativeId: run.initiativeId,
+            initiativeTitle: initiativeNode?.title ?? null,
+            workstreamId: nextTaskNode.workstreamId,
+            taskId: nextTaskNode.id,
+        });
+        const spawned = spawnOpenClawAgentTurn({
+            agentId,
+            sessionId,
+            message,
+        });
+        upsertAgentRun({
+            runId: sessionId,
+            agentId,
+            pid: spawned.pid,
+            message,
+            provider: null,
+            model: null,
+            initiativeId: run.initiativeId,
+            initiativeTitle: initiativeNode?.title ?? null,
+            workstreamId: nextTaskNode.workstreamId,
+            taskId: nextTaskNode.id,
+            startedAt: now,
+            status: "running",
+        });
+        run.lastTaskId = nextTaskNode.id;
+        run.lastRunId = sessionId;
+        run.activeTaskId = nextTaskNode.id;
+        run.activeRunId = sessionId;
+        run.activeTaskTokenEstimate = nextTaskTokenEstimate > 0 ? nextTaskTokenEstimate : null;
+        run.updatedAt = now;
+        try {
+            await client.updateEntity("initiative", run.initiativeId, { status: "active" });
+        }
+        catch {
+            // best effort
+        }
+        try {
+            await updateInitiativeAutoContinueState({
+                initiativeId: run.initiativeId,
+                run,
+            });
+        }
+        catch {
+            // best effort
+        }
+    }
+    async function tickAllAutoContinue() {
+        if (autoContinueTickInFlight)
+            return;
+        autoContinueTickInFlight = true;
+        try {
+            for (const run of autoContinueRuns.values()) {
+                try {
+                    await tickAutoContinueRun(run);
+                }
+                catch (err) {
+                    // Never let one loop crash the whole handler.
+                    run.lastError = safeErrorMessage(err);
+                    run.updatedAt = new Date().toISOString();
+                    await stopAutoContinueRun({ run, reason: "error", error: run.lastError });
+                }
+            }
+        }
+        finally {
+            autoContinueTickInFlight = false;
+        }
+    }
+    const autoContinueTimer = setInterval(() => {
+        void tickAllAutoContinue();
+    }, AUTO_CONTINUE_TICK_MS);
+    autoContinueTimer.unref?.();
+    return async function handler(req, res) {
+        const method = (req.method ?? "GET").toUpperCase();
+        const rawUrl = req.url ?? "/";
+        const [path, queryString] = rawUrl.split("?", 2);
+        const url = path;
+        const searchParams = new URLSearchParams(queryString ?? "");
+        // Only handle /orgx paths — return false for everything else
+        if (!url.startsWith("/orgx")) {
+            return false;
         }
         // Handle CORS preflight
         if (method === "OPTIONS") {
-            res.writeHead(204, CORS_HEADERS);
+            if (url.startsWith("/orgx/api/") && !isTrustedRequestSource(req.headers)) {
+                sendJson(res, 403, {
+                    error: "Cross-origin browser requests are blocked for /orgx/api endpoints.",
+                });
+                return true;
+            }
+            res.writeHead(204, {
+                ...SECURITY_HEADERS,
+                ...CORS_HEADERS,
+            });
             res.end();
             return true;
         }
         // ── API endpoints ──────────────────────────────────────────────────────
         if (url.startsWith("/orgx/api/")) {
+            if (!isTrustedRequestSource(req.headers)) {
+                sendJson(res, 403, {
+                    error: "Cross-origin browser requests are blocked for /orgx/api endpoints.",
+                });
+                return true;
+            }
             const route = url.replace("/orgx/api/", "").replace(/\/+$/, "");
             const decisionApproveMatch = route.match(/^live\/decisions\/([^/]+)\/approve$/);
             const runActionMatch = route.match(/^runs\/([^/]+)\/actions\/([^/]+)$/);
@@ -1227,6 +2363,8 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
             const runCheckpointRestoreMatch = route.match(/^runs\/([^/]+)\/checkpoints\/([^/]+)\/restore$/);
             const isDelegationPreflight = route === "delegation/preflight";
             const isMissionControlAutoAssignmentRoute = route === "mission-control/assignments/auto";
+            const isMissionControlAutoContinueStartRoute = route === "mission-control/auto-continue/start";
+            const isMissionControlAutoContinueStopRoute = route === "mission-control/auto-continue/stop";
             const isEntitiesRoute = route === "entities";
             const entityActionMatch = route.match(/^entities\/([^/]+)\/([^/]+)\/([^/]+)$/);
             const isOnboardingStartRoute = route === "onboarding/start";
@@ -1234,9 +2372,13 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
             const isOnboardingManualKeyRoute = route === "onboarding/manual-key";
             const isOnboardingDisconnectRoute = route === "onboarding/disconnect";
             const isLiveActivityHeadlineRoute = route === "live/activity/headline";
+            const isAgentLaunchRoute = route === "agents/launch";
+            const isAgentStopRoute = route === "agents/stop";
+            const isAgentRestartRoute = route === "agents/restart";
+            const isByokSettingsRoute = route === "settings/byok";
             if (method === "POST" && isOnboardingStartRoute) {
                 try {
-                    const payload = parseJsonBody(req.body);
+                    const payload = await parseJsonRequest(req);
                     const started = await onboarding.startPairing({
                         openclawVersion: pickString(payload, ["openclawVersion", "openclaw_version"]) ??
                             undefined,
@@ -1280,7 +2422,7 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
             }
             if (method === "POST" && isOnboardingManualKeyRoute) {
                 try {
-                    const payload = parseJsonBody(req.body);
+                    const payload = await parseJsonRequest(req);
                     const authHeader = pickHeaderString(req.headers, ["authorization"]);
                     const bearerApiKey = authHeader && authHeader.toLowerCase().startsWith("bearer ")
                         ? authHeader.slice("bearer ".length).trim()
@@ -1299,9 +2441,10 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                         });
                         return true;
                     }
-                    const userId = pickString(payload, ["userId", "user_id"]) ??
+                    const requestedUserId = pickString(payload, ["userId", "user_id"]) ??
                         pickHeaderString(req.headers, ["x-orgx-user-id", "x-user-id"]) ??
                         undefined;
+                    const userId = isUserScopedApiKey(apiKey) ? undefined : requestedUserId;
                     const state = await onboarding.submitManualKey({
                         apiKey,
                         userId,
@@ -1335,10 +2478,560 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                 }
                 return true;
             }
+            if (method === "POST" && isAgentLaunchRoute) {
+                try {
+                    const payload = await parseJsonRequest(req);
+                    const agentId = (pickString(payload, ["agentId", "agent_id", "id"]) ??
+                        searchParams.get("agentId") ??
+                        searchParams.get("agent_id") ??
+                        searchParams.get("id") ??
+                        "")
+                        .trim();
+                    if (!agentId) {
+                        sendJson(res, 400, { ok: false, error: "agentId is required" });
+                        return true;
+                    }
+                    if (!/^[a-zA-Z0-9_-]+$/.test(agentId)) {
+                        sendJson(res, 400, {
+                            ok: false,
+                            error: "agentId must be a simple identifier (letters, numbers, _ or -).",
+                        });
+                        return true;
+                    }
+                    const sessionId = (pickString(payload, ["sessionId", "session_id"]) ??
+                        searchParams.get("sessionId") ??
+                        searchParams.get("session_id") ??
+                        "")
+                        .trim() ||
+                        randomUUID();
+                    const initiativeId = pickString(payload, ["initiativeId", "initiative_id"]) ??
+                        searchParams.get("initiativeId") ??
+                        searchParams.get("initiative_id") ??
+                        null;
+                    const initiativeTitle = pickString(payload, [
+                        "initiativeTitle",
+                        "initiative_title",
+                        "initiativeName",
+                        "initiative_name",
+                    ]) ??
+                        searchParams.get("initiativeTitle") ??
+                        searchParams.get("initiative_title") ??
+                        searchParams.get("initiativeName") ??
+                        searchParams.get("initiative_name") ??
+                        null;
+                    const workstreamId = pickString(payload, ["workstreamId", "workstream_id"]) ??
+                        searchParams.get("workstreamId") ??
+                        searchParams.get("workstream_id") ??
+                        null;
+                    const taskId = pickString(payload, ["taskId", "task_id"]) ??
+                        searchParams.get("taskId") ??
+                        searchParams.get("task_id") ??
+                        null;
+                    const thinking = (pickString(payload, ["thinking"]) ??
+                        searchParams.get("thinking") ??
+                        "")
+                        .trim() || null;
+                    const provider = normalizeOpenClawProvider(pickString(payload, ["provider", "modelProvider", "model_provider"]) ??
+                        searchParams.get("provider") ??
+                        searchParams.get("modelProvider") ??
+                        searchParams.get("model_provider") ??
+                        null);
+                    const requestedModel = (pickString(payload, ["model", "modelId", "model_id"]) ??
+                        searchParams.get("model") ??
+                        searchParams.get("modelId") ??
+                        searchParams.get("model_id") ??
+                        "")
+                        .trim() || null;
+                    const dryRunRaw = payload.dryRun ??
+                        payload.dry_run ??
+                        searchParams.get("dryRun") ??
+                        searchParams.get("dry_run") ??
+                        null;
+                    const dryRun = typeof dryRunRaw === "boolean"
+                        ? dryRunRaw
+                        : parseBooleanQuery(typeof dryRunRaw === "string" ? dryRunRaw : null);
+                    let requiresPremiumLaunch = Boolean(provider) || modelImpliesByok(requestedModel);
+                    if (!requiresPremiumLaunch) {
+                        try {
+                            const agents = await listOpenClawAgents();
+                            const agentEntry = agents.find((entry) => String(entry.id ?? "").trim() === agentId) ??
+                                null;
+                            const agentModel = agentEntry && typeof agentEntry.model === "string"
+                                ? agentEntry.model
+                                : null;
+                            requiresPremiumLaunch = modelImpliesByok(agentModel);
+                        }
+                        catch {
+                            // ignore
+                        }
+                    }
+                    if (requiresPremiumLaunch) {
+                        const billingStatus = await fetchBillingStatusSafe(client);
+                        if (billingStatus && billingStatus.plan === "free") {
+                            const pricingUrl = `${client.getBaseUrl().replace(/\/+$/, "")}/pricing`;
+                            sendJson(res, 402, {
+                                ok: false,
+                                code: "upgrade_required",
+                                error: "BYOK agent launch requires a paid OrgX plan. Upgrade, then retry.",
+                                currentPlan: billingStatus.plan,
+                                requiredPlan: "starter",
+                                actions: {
+                                    checkout: "/orgx/api/billing/checkout",
+                                    portal: "/orgx/api/billing/portal",
+                                    pricing: pricingUrl,
+                                },
+                            });
+                            return true;
+                        }
+                    }
+                    const messageInput = (pickString(payload, ["message", "prompt", "text"]) ??
+                        searchParams.get("message") ??
+                        searchParams.get("prompt") ??
+                        searchParams.get("text") ??
+                        "")
+                        .trim();
+                    const message = messageInput ||
+                        (initiativeTitle
+                            ? `Kick off: ${initiativeTitle}`
+                            : initiativeId
+                                ? `Kick off initiative ${initiativeId}`
+                                : `Kick off agent ${agentId}`);
+                    if (dryRun) {
+                        sendJson(res, 200, {
+                            ok: true,
+                            dryRun: true,
+                            agentId,
+                            initiativeId,
+                            workstreamId,
+                            taskId,
+                            requiresPremiumLaunch,
+                            startedAt: new Date().toISOString(),
+                            message,
+                        });
+                        return true;
+                    }
+                    let routedProvider = null;
+                    let routedModel = null;
+                    if (provider) {
+                        const routed = await configureOpenClawProviderRouting({
+                            agentId,
+                            provider,
+                            requestedModel,
+                        });
+                        routedProvider = routed.provider;
+                        routedModel = routed.model;
+                    }
+                    upsertAgentContext({
+                        agentId,
+                        initiativeId,
+                        initiativeTitle,
+                        workstreamId,
+                        taskId,
+                    });
+                    const spawned = spawnOpenClawAgentTurn({
+                        agentId,
+                        sessionId,
+                        message,
+                        thinking,
+                    });
+                    upsertAgentRun({
+                        runId: sessionId,
+                        agentId,
+                        pid: spawned.pid,
+                        message,
+                        provider: routedProvider,
+                        model: routedModel,
+                        initiativeId,
+                        initiativeTitle,
+                        workstreamId,
+                        taskId,
+                        startedAt: new Date().toISOString(),
+                        status: "running",
+                    });
+                    sendJson(res, 202, {
+                        ok: true,
+                        agentId,
+                        sessionId,
+                        pid: spawned.pid,
+                        provider: routedProvider,
+                        model: routedModel,
+                        initiativeId,
+                        workstreamId,
+                        taskId,
+                        startedAt: new Date().toISOString(),
+                    });
+                }
+                catch (err) {
+                    sendJson(res, 500, {
+                        ok: false,
+                        error: safeErrorMessage(err),
+                    });
+                }
+                return true;
+            }
+            if (method === "POST" && isAgentStopRoute) {
+                try {
+                    const payload = await parseJsonRequest(req);
+                    const runId = (pickString(payload, ["runId", "run_id", "sessionId", "session_id"]) ??
+                        searchParams.get("runId") ??
+                        searchParams.get("run_id") ??
+                        searchParams.get("sessionId") ??
+                        searchParams.get("session_id") ??
+                        "")
+                        .trim();
+                    if (!runId) {
+                        sendJson(res, 400, { ok: false, error: "runId is required" });
+                        return true;
+                    }
+                    const record = getAgentRun(runId);
+                    if (!record) {
+                        sendJson(res, 404, { ok: false, error: "Run not found" });
+                        return true;
+                    }
+                    if (!record.pid) {
+                        sendJson(res, 409, { ok: false, error: "Run has no tracked pid" });
+                        return true;
+                    }
+                    const result = await stopDetachedProcess(record.pid);
+                    const updated = markAgentRunStopped(runId);
+                    sendJson(res, 200, {
+                        ok: true,
+                        runId,
+                        agentId: record.agentId,
+                        pid: record.pid,
+                        stopped: result.stopped,
+                        wasRunning: result.wasRunning,
+                        record: updated,
+                    });
+                }
+                catch (err) {
+                    sendJson(res, 500, { ok: false, error: safeErrorMessage(err) });
+                }
+                return true;
+            }
+            if (method === "POST" && isAgentRestartRoute) {
+                try {
+                    const payload = await parseJsonRequest(req);
+                    const previousRunId = (pickString(payload, ["runId", "run_id", "sessionId", "session_id"]) ??
+                        searchParams.get("runId") ??
+                        searchParams.get("run_id") ??
+                        searchParams.get("sessionId") ??
+                        searchParams.get("session_id") ??
+                        "")
+                        .trim();
+                    if (!previousRunId) {
+                        sendJson(res, 400, { ok: false, error: "runId is required" });
+                        return true;
+                    }
+                    const record = getAgentRun(previousRunId);
+                    if (!record) {
+                        sendJson(res, 404, { ok: false, error: "Run not found" });
+                        return true;
+                    }
+                    const messageOverride = (pickString(payload, ["message", "prompt", "text"]) ??
+                        searchParams.get("message") ??
+                        searchParams.get("prompt") ??
+                        searchParams.get("text") ??
+                        "")
+                        .trim() || null;
+                    const providerOverride = normalizeOpenClawProvider(pickString(payload, ["provider", "modelProvider", "model_provider"]) ??
+                        searchParams.get("provider") ??
+                        searchParams.get("modelProvider") ??
+                        searchParams.get("model_provider") ??
+                        record.provider ??
+                        null);
+                    const requestedModel = (pickString(payload, ["model", "modelId", "model_id"]) ??
+                        searchParams.get("model") ??
+                        searchParams.get("modelId") ??
+                        searchParams.get("model_id") ??
+                        record.model ??
+                        "")
+                        .trim() || null;
+                    let requiresPremiumRestart = Boolean(providerOverride) ||
+                        modelImpliesByok(requestedModel) ||
+                        modelImpliesByok(record.model ?? null);
+                    if (!requiresPremiumRestart) {
+                        try {
+                            const agents = await listOpenClawAgents();
+                            const agentEntry = agents.find((entry) => String(entry.id ?? "").trim() === record.agentId) ?? null;
+                            const agentModel = agentEntry && typeof agentEntry.model === "string"
+                                ? agentEntry.model
+                                : null;
+                            requiresPremiumRestart = modelImpliesByok(agentModel);
+                        }
+                        catch {
+                            // ignore
+                        }
+                    }
+                    if (requiresPremiumRestart) {
+                        const billingStatus = await fetchBillingStatusSafe(client);
+                        if (billingStatus && billingStatus.plan === "free") {
+                            const pricingUrl = `${client.getBaseUrl().replace(/\/+$/, "")}/pricing`;
+                            sendJson(res, 402, {
+                                ok: false,
+                                code: "upgrade_required",
+                                error: "BYOK agent launch requires a paid OrgX plan. Upgrade, then retry.",
+                                currentPlan: billingStatus.plan,
+                                requiredPlan: "starter",
+                                actions: {
+                                    checkout: "/orgx/api/billing/checkout",
+                                    portal: "/orgx/api/billing/portal",
+                                    pricing: pricingUrl,
+                                },
+                            });
+                            return true;
+                        }
+                    }
+                    const sessionId = randomUUID();
+                    const message = messageOverride ?? record.message ?? `Restart agent ${record.agentId}`;
+                    let routedProvider = providerOverride ?? null;
+                    let routedModel = requestedModel ?? null;
+                    if (providerOverride) {
+                        const routed = await configureOpenClawProviderRouting({
+                            agentId: record.agentId,
+                            provider: providerOverride,
+                            requestedModel,
+                        });
+                        routedProvider = routed.provider;
+                        routedModel = routed.model;
+                    }
+                    upsertAgentContext({
+                        agentId: record.agentId,
+                        initiativeId: record.initiativeId,
+                        initiativeTitle: record.initiativeTitle,
+                        workstreamId: record.workstreamId,
+                        taskId: record.taskId,
+                    });
+                    const spawned = spawnOpenClawAgentTurn({
+                        agentId: record.agentId,
+                        sessionId,
+                        message,
+                    });
+                    upsertAgentRun({
+                        runId: sessionId,
+                        agentId: record.agentId,
+                        pid: spawned.pid,
+                        message,
+                        provider: routedProvider,
+                        model: routedModel,
+                        initiativeId: record.initiativeId,
+                        initiativeTitle: record.initiativeTitle,
+                        workstreamId: record.workstreamId,
+                        taskId: record.taskId,
+                        startedAt: new Date().toISOString(),
+                        status: "running",
+                    });
+                    sendJson(res, 202, {
+                        ok: true,
+                        previousRunId,
+                        sessionId,
+                        agentId: record.agentId,
+                        pid: spawned.pid,
+                        provider: routedProvider,
+                        model: routedModel,
+                    });
+                }
+                catch (err) {
+                    sendJson(res, 500, { ok: false, error: safeErrorMessage(err) });
+                }
+                return true;
+            }
+            if (method === "POST" && isMissionControlAutoContinueStartRoute) {
+                try {
+                    const payload = await parseJsonRequest(req);
+                    const initiativeId = (pickString(payload, ["initiativeId", "initiative_id"]) ??
+                        searchParams.get("initiativeId") ??
+                        searchParams.get("initiative_id") ??
+                        "")
+                        .trim();
+                    if (!initiativeId) {
+                        sendJson(res, 400, { ok: false, error: "initiativeId is required" });
+                        return true;
+                    }
+                    const agentIdRaw = (pickString(payload, ["agentId", "agent_id"]) ??
+                        searchParams.get("agentId") ??
+                        searchParams.get("agent_id") ??
+                        "main")
+                        .trim();
+                    const agentId = agentIdRaw || "main";
+                    if (!/^[a-zA-Z0-9_-]+$/.test(agentId)) {
+                        sendJson(res, 400, {
+                            ok: false,
+                            error: "agentId must be a simple identifier (letters, numbers, _ or -).",
+                        });
+                        return true;
+                    }
+                    let requiresPremiumAutoContinue = false;
+                    try {
+                        const agents = await listOpenClawAgents();
+                        const agentEntry = agents.find((entry) => String(entry.id ?? "").trim() === agentId) ??
+                            null;
+                        const agentModel = agentEntry && typeof agentEntry.model === "string"
+                            ? agentEntry.model
+                            : null;
+                        requiresPremiumAutoContinue = modelImpliesByok(agentModel);
+                    }
+                    catch {
+                        // ignore
+                    }
+                    if (requiresPremiumAutoContinue) {
+                        const billingStatus = await fetchBillingStatusSafe(client);
+                        if (billingStatus && billingStatus.plan === "free") {
+                            const pricingUrl = `${client.getBaseUrl().replace(/\/+$/, "")}/pricing`;
+                            sendJson(res, 402, {
+                                ok: false,
+                                code: "upgrade_required",
+                                error: "Auto-continue for BYOK agents requires a paid OrgX plan. Upgrade, then retry.",
+                                currentPlan: billingStatus.plan,
+                                requiredPlan: "starter",
+                                actions: {
+                                    checkout: "/orgx/api/billing/checkout",
+                                    portal: "/orgx/api/billing/portal",
+                                    pricing: pricingUrl,
+                                },
+                            });
+                            return true;
+                        }
+                    }
+                    const tokenBudget = pickNumber(payload, [
+                        "tokenBudget",
+                        "token_budget",
+                        "tokenBudgetTokens",
+                        "token_budget_tokens",
+                        "maxTokens",
+                        "max_tokens",
+                    ]) ??
+                        searchParams.get("tokenBudget") ??
+                        searchParams.get("token_budget") ??
+                        searchParams.get("tokenBudgetTokens") ??
+                        searchParams.get("token_budget_tokens") ??
+                        searchParams.get("maxTokens") ??
+                        searchParams.get("max_tokens") ??
+                        null;
+                    const includeVerificationRaw = payload.includeVerification ??
+                        payload.include_verification ??
+                        searchParams.get("includeVerification") ??
+                        searchParams.get("include_verification") ??
+                        null;
+                    const includeVerification = typeof includeVerificationRaw === "boolean"
+                        ? includeVerificationRaw
+                        : parseBooleanQuery(typeof includeVerificationRaw === "string"
+                            ? includeVerificationRaw
+                            : null);
+                    const workstreamFilter = dedupeStrings([
+                        ...pickStringArray(payload, [
+                            "workstreamIds",
+                            "workstream_ids",
+                            "workstreamId",
+                            "workstream_id",
+                        ]),
+                        ...(searchParams.get("workstreamIds") ??
+                            searchParams.get("workstream_ids") ??
+                            searchParams.get("workstreamId") ??
+                            searchParams.get("workstream_id") ??
+                            "")
+                            .split(",")
+                            .map((entry) => entry.trim())
+                            .filter(Boolean),
+                    ]);
+                    const allowedWorkstreamIds = workstreamFilter.length > 0 ? workstreamFilter : null;
+                    const now = new Date().toISOString();
+                    const existing = autoContinueRuns.get(initiativeId) ?? null;
+                    const run = existing ??
+                        {
+                            initiativeId,
+                            agentId,
+                            includeVerification: false,
+                            allowedWorkstreamIds: null,
+                            tokenBudget: defaultAutoContinueTokenBudget(),
+                            tokensUsed: 0,
+                            status: "running",
+                            stopReason: null,
+                            stopRequested: false,
+                            startedAt: now,
+                            stoppedAt: null,
+                            updatedAt: now,
+                            lastError: null,
+                            lastTaskId: null,
+                            lastRunId: null,
+                            activeTaskId: null,
+                            activeRunId: null,
+                            activeTaskTokenEstimate: null,
+                        };
+                    run.agentId = agentId;
+                    run.includeVerification = includeVerification;
+                    run.allowedWorkstreamIds = allowedWorkstreamIds;
+                    run.tokenBudget = normalizeTokenBudget(tokenBudget, run.tokenBudget || defaultAutoContinueTokenBudget());
+                    run.status = "running";
+                    run.stopReason = null;
+                    run.stopRequested = false;
+                    run.startedAt = now;
+                    run.stoppedAt = null;
+                    run.updatedAt = now;
+                    run.lastError = null;
+                    autoContinueRuns.set(initiativeId, run);
+                    try {
+                        await client.updateEntity("initiative", initiativeId, { status: "active" });
+                    }
+                    catch {
+                        // best effort
+                    }
+                    try {
+                        await updateInitiativeAutoContinueState({ initiativeId, run });
+                    }
+                    catch {
+                        // best effort
+                    }
+                    sendJson(res, 200, { ok: true, run });
+                }
+                catch (err) {
+                    sendJson(res, 500, { ok: false, error: safeErrorMessage(err) });
+                }
+                return true;
+            }
+            if (method === "POST" && isMissionControlAutoContinueStopRoute) {
+                try {
+                    const payload = await parseJsonRequest(req);
+                    const initiativeId = (pickString(payload, ["initiativeId", "initiative_id"]) ??
+                        searchParams.get("initiativeId") ??
+                        searchParams.get("initiative_id") ??
+                        "")
+                        .trim();
+                    if (!initiativeId) {
+                        sendJson(res, 400, { ok: false, error: "initiativeId is required" });
+                        return true;
+                    }
+                    const run = autoContinueRuns.get(initiativeId) ?? null;
+                    if (!run) {
+                        sendJson(res, 404, { ok: false, error: "No auto-continue run found" });
+                        return true;
+                    }
+                    const now = new Date().toISOString();
+                    run.stopRequested = true;
+                    run.status = run.activeRunId ? "stopping" : "stopped";
+                    run.updatedAt = now;
+                    if (!run.activeRunId) {
+                        await stopAutoContinueRun({ run, reason: "stopped" });
+                    }
+                    else {
+                        try {
+                            await updateInitiativeAutoContinueState({ initiativeId, run });
+                        }
+                        catch {
+                            // best effort
+                        }
+                    }
+                    sendJson(res, 200, { ok: true, run });
+                }
+                catch (err) {
+                    sendJson(res, 500, { ok: false, error: safeErrorMessage(err) });
+                }
+                return true;
+            }
             if (method === "POST" &&
                 (route === "live/decisions/approve" || decisionApproveMatch)) {
                 try {
-                    const payload = parseJsonBody(req.body);
+                    const payload = await parseJsonRequest(req);
                     const action = payload.action === "reject" ? "reject" : "approve";
                     const note = typeof payload.note === "string" && payload.note.trim().length > 0
                         ? payload.note.trim()
@@ -1381,7 +3074,7 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
             }
             if (method === "POST" && isDelegationPreflight) {
                 try {
-                    const payload = parseJsonBody(req.body);
+                    const payload = await parseJsonRequest(req);
                     const intent = pickString(payload, ["intent"]);
                     if (!intent) {
                         sendJson(res, 400, { error: "intent is required" });
@@ -1407,7 +3100,7 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
             }
             if (method === "POST" && isMissionControlAutoAssignmentRoute) {
                 try {
-                    const payload = parseJsonBody(req.body);
+                    const payload = await parseJsonRequest(req);
                     const entityId = pickString(payload, ["entity_id", "entityId"]);
                     const entityType = pickString(payload, ["entity_type", "entityType"]);
                     const initiativeId = pickString(payload, ["initiative_id", "initiativeId"]) ?? null;
@@ -1441,7 +3134,7 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
             if (runCheckpointsMatch && method === "POST") {
                 try {
                     const runId = decodeURIComponent(runCheckpointsMatch[1]);
-                    const payload = parseJsonBody(req.body);
+                    const payload = await parseJsonRequest(req);
                     const reason = pickString(payload, ["reason"]) ?? undefined;
                     const rawPayload = payload.payload;
                     const checkpointPayload = rawPayload && typeof rawPayload === "object" && !Array.isArray(rawPayload)
@@ -1464,7 +3157,7 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                 try {
                     const runId = decodeURIComponent(runCheckpointRestoreMatch[1]);
                     const checkpointId = decodeURIComponent(runCheckpointRestoreMatch[2]);
-                    const payload = parseJsonBody(req.body);
+                    const payload = await parseJsonRequest(req);
                     const reason = pickString(payload, ["reason"]) ?? undefined;
                     const data = await client.restoreRunCheckpoint(runId, {
                         checkpointId,
@@ -1483,7 +3176,7 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                 try {
                     const runId = decodeURIComponent(runActionMatch[1]);
                     const action = decodeURIComponent(runActionMatch[2]);
-                    const payload = parseJsonBody(req.body);
+                    const payload = await parseJsonRequest(req);
                     const checkpointId = pickString(payload, ["checkpointId", "checkpoint_id"]);
                     const reason = pickString(payload, ["reason"]);
                     const data = await client.runAction(runId, action, {
@@ -1505,7 +3198,7 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                     const entityType = decodeURIComponent(entityActionMatch[1]);
                     const entityId = decodeURIComponent(entityActionMatch[2]);
                     const entityAction = decodeURIComponent(entityActionMatch[3]);
-                    const payload = parseJsonBody(req.body);
+                    const payload = await parseJsonRequest(req);
                     if (entityAction === "delete") {
                         // Delete via status update
                         const entity = await client.updateEntity(entityType, entityId, {
@@ -1545,6 +3238,7 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                 return true;
             }
             if (method !== "GET" &&
+                method !== "HEAD" &&
                 !(runCheckpointsMatch && method === "POST") &&
                 !(runCheckpointRestoreMatch && method === "POST") &&
                 !(runActionMatch && method === "POST") &&
@@ -1556,9 +3250,11 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                 !(isOnboardingStartRoute && method === "POST") &&
                 !(isOnboardingManualKeyRoute && method === "POST") &&
                 !(isOnboardingDisconnectRoute && method === "POST") &&
+                !(isByokSettingsRoute && method === "POST") &&
                 !(isLiveActivityHeadlineRoute && method === "POST")) {
                 res.writeHead(405, {
                     "Content-Type": "text/plain",
+                    ...SECURITY_HEADERS,
                     ...CORS_HEADERS,
                 });
                 res.end("Method Not Allowed");
@@ -1576,12 +3272,150 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                             // use null snapshot
                         }
                     }
+                    if (method === "HEAD") {
+                        // The dashboard uses a HEAD probe to determine connection state.
+                        // Mirror the GET semantics (connected vs not) via status code,
+                        // but omit a response body.
+                        res.writeHead(snapshot ? 200 : 503, {
+                            ...SECURITY_HEADERS,
+                            ...CORS_HEADERS,
+                        });
+                        res.end();
+                        return true;
+                    }
                     sendJson(res, 200, formatStatus(snapshot));
                     return true;
                 }
+                case "health": {
+                    const probeRemote = parseBooleanQuery(searchParams.get("probe") ?? searchParams.get("probe_remote"));
+                    try {
+                        if (diagnostics?.getHealth) {
+                            const health = await diagnostics.getHealth({ probeRemote });
+                            sendJson(res, 200, health);
+                            return true;
+                        }
+                        const outbox = await outboxAdapter.readSummary();
+                        sendJson(res, 200, {
+                            ok: true,
+                            status: "ok",
+                            generatedAt: new Date().toISOString(),
+                            checks: [],
+                            plugin: {
+                                baseUrl: config.baseUrl,
+                            },
+                            auth: {
+                                hasApiKey: Boolean(config.apiKey),
+                            },
+                            outbox: {
+                                pendingTotal: outbox.pendingTotal,
+                                pendingByQueue: outbox.pendingByQueue,
+                                oldestEventAt: outbox.oldestEventAt,
+                                newestEventAt: outbox.newestEventAt,
+                                replayStatus: "idle",
+                                lastReplayAttemptAt: null,
+                                lastReplaySuccessAt: null,
+                                lastReplayFailureAt: null,
+                                lastReplayError: null,
+                            },
+                            remote: {
+                                enabled: false,
+                                reachable: null,
+                                latencyMs: null,
+                                error: null,
+                            },
+                        });
+                    }
+                    catch (err) {
+                        sendJson(res, 500, {
+                            error: safeErrorMessage(err),
+                        });
+                    }
+                    return true;
+                }
                 case "agents":
                     sendJson(res, 200, formatAgents(getSnapshot()));
                     return true;
+                case "agents/catalog": {
+                    try {
+                        const [openclawAgents, localSnapshot] = await Promise.all([
+                            listOpenClawAgents(),
+                            loadLocalOpenClawSnapshot(240).catch(() => null),
+                        ]);
+                        const localById = new Map();
+                        if (localSnapshot) {
+                            for (const agent of localSnapshot.agents) {
+                                localById.set(agent.id, {
+                                    status: agent.status,
+                                    currentTask: agent.currentTask,
+                                    runId: agent.runId,
+                                    startedAt: agent.startedAt,
+                                    blockers: agent.blockers,
+                                });
+                            }
+                        }
+                        const contexts = readAgentContexts().agents;
+                        const runs = readAgentRuns().runs;
+                        const latestRunByAgent = new Map();
+                        for (const run of Object.values(runs)) {
+                            if (!run || typeof run !== "object")
+                                continue;
+                            const agentId = typeof run.agentId === "string" ? run.agentId.trim() : "";
+                            if (!agentId)
+                                continue;
+                            const existing = latestRunByAgent.get(agentId);
+                            const nextTs = Date.parse(run.startedAt ?? "");
+                            const existingTs = existing ? Date.parse(existing.startedAt ?? "") : 0;
+                            // Prefer latest running record; fall back to latest overall if none running.
+                            if (!existing) {
+                                latestRunByAgent.set(agentId, run);
+                                continue;
+                            }
+                            const existingRunning = existing.status === "running";
+                            const nextRunning = run.status === "running";
+                            if (nextRunning && !existingRunning) {
+                                latestRunByAgent.set(agentId, run);
+                                continue;
+                            }
+                            if (nextRunning === existingRunning && nextTs > existingTs) {
+                                latestRunByAgent.set(agentId, run);
+                            }
+                        }
+                        const agents = openclawAgents.map((entry) => {
+                            const id = typeof entry.id === "string" ? entry.id.trim() : "";
+                            const name = typeof entry.name === "string" && entry.name.trim().length > 0
+                                ? entry.name.trim()
+                                : id || "unknown";
+                            const local = id ? localById.get(id) ?? null : null;
+                            const context = id ? contexts[id] ?? null : null;
+                            const runFromSession = id && local?.runId ? runs[local.runId] ?? null : null;
+                            const run = runFromSession ?? (id ? latestRunByAgent.get(id) ?? null : null);
+                            return {
+                                id,
+                                name,
+                                workspace: typeof entry.workspace === "string" ? entry.workspace : null,
+                                model: typeof entry.model === "string" ? entry.model : null,
+                                isDefault: Boolean(entry.isDefault),
+                                status: local?.status ?? null,
+                                currentTask: local?.currentTask ?? null,
+                                runId: local?.runId ?? null,
+                                startedAt: local?.startedAt ?? null,
+                                blockers: local?.blockers ?? [],
+                                context,
+                                run,
+                            };
+                        });
+                        sendJson(res, 200, {
+                            generatedAt: new Date().toISOString(),
+                            agents,
+                        });
+                    }
+                    catch (err) {
+                        sendJson(res, 500, {
+                            error: safeErrorMessage(err),
+                        });
+                    }
+                    return true;
+                }
                 case "activity":
                     sendJson(res, 200, formatActivity(getSnapshot()));
                     return true;
@@ -1591,6 +3425,229 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                 case "onboarding":
                     sendJson(res, 200, getOnboardingState(await onboarding.getStatus()));
                     return true;
+                case "mission-control/auto-continue/status": {
+                    const initiativeId = searchParams.get("initiative_id") ??
+                        searchParams.get("initiativeId") ??
+                        "";
+                    const id = initiativeId.trim();
+                    if (!id) {
+                        sendJson(res, 400, {
+                            ok: false,
+                            error: "Query parameter 'initiative_id' is required.",
+                        });
+                        return true;
+                    }
+                    const run = autoContinueRuns.get(id) ?? null;
+                    sendJson(res, 200, {
+                        ok: true,
+                        initiativeId: id,
+                        run,
+                        defaults: {
+                            tokenBudget: defaultAutoContinueTokenBudget(),
+                            tickMs: AUTO_CONTINUE_TICK_MS,
+                        },
+                    });
+                    return true;
+                }
+                case "billing/status": {
+                    if (method !== "GET") {
+                        sendJson(res, 405, { ok: false, error: "Method not allowed" });
+                        return true;
+                    }
+                    try {
+                        const status = await client.getBillingStatus();
+                        sendJson(res, 200, { ok: true, data: status });
+                    }
+                    catch (err) {
+                        sendJson(res, 200, { ok: false, error: safeErrorMessage(err) });
+                    }
+                    return true;
+                }
+                case "billing/checkout": {
+                    if (method !== "POST") {
+                        sendJson(res, 405, { ok: false, error: "Method not allowed" });
+                        return true;
+                    }
+                    const basePricingUrl = `${client.getBaseUrl().replace(/\/+$/, "")}/pricing`;
+                    try {
+                        const payload = await parseJsonRequest(req);
+                        const planIdRaw = (pickString(payload, ["planId", "plan_id", "plan"]) ?? "starter").trim().toLowerCase();
+                        const billingCycleRaw = (pickString(payload, ["billingCycle", "billing_cycle"]) ?? "monthly").trim().toLowerCase();
+                        const planId = planIdRaw === "team" || planIdRaw === "enterprise" ? planIdRaw : "starter";
+                        const billingCycle = billingCycleRaw === "annual" ? "annual" : "monthly";
+                        const result = await client.createBillingCheckout({
+                            planId,
+                            billingCycle,
+                        });
+                        const url = result?.url ?? result?.checkout_url ?? null;
+                        sendJson(res, 200, { ok: true, data: { url: url ?? basePricingUrl } });
+                    }
+                    catch (err) {
+                        // If the remote billing endpoints are not deployed yet, degrade gracefully.
+                        sendJson(res, 200, { ok: true, data: { url: basePricingUrl } });
+                    }
+                    return true;
+                }
+                case "billing/portal": {
+                    if (method !== "POST") {
+                        sendJson(res, 405, { ok: false, error: "Method not allowed" });
+                        return true;
+                    }
+                    const basePricingUrl = `${client.getBaseUrl().replace(/\/+$/, "")}/pricing`;
+                    try {
+                        const result = await client.createBillingPortal();
+                        const url = result?.url ?? null;
+                        sendJson(res, 200, { ok: true, data: { url: url ?? basePricingUrl } });
+                    }
+                    catch (err) {
+                        sendJson(res, 200, { ok: true, data: { url: basePricingUrl } });
+                    }
+                    return true;
+                }
+                case "settings/byok": {
+                    const stored = readByokKeys();
+                    const effectiveOpenai = stored?.openaiApiKey ?? process.env.OPENAI_API_KEY ?? null;
+                    const effectiveAnthropic = stored?.anthropicApiKey ?? process.env.ANTHROPIC_API_KEY ?? null;
+                    const effectiveOpenrouter = stored?.openrouterApiKey ?? process.env.OPENROUTER_API_KEY ?? null;
+                    const toProvider = (input) => {
+                        const hasStored = typeof input.storedValue === "string" && input.storedValue.trim().length > 0;
+                        const hasEnv = typeof input.envValue === "string" && input.envValue.trim().length > 0;
+                        const source = hasStored ? "stored" : hasEnv ? "env" : "none";
+                        return {
+                            configured: Boolean(input.effective && input.effective.trim().length > 0),
+                            source,
+                            masked: maskSecret(input.effective),
+                        };
+                    };
+                    if (method === "POST") {
+                        try {
+                            const payload = await parseJsonRequest(req);
+                            const updates = {};
+                            const setIfPresent = (key, aliases) => {
+                                for (const alias of aliases) {
+                                    if (!Object.prototype.hasOwnProperty.call(payload, alias))
+                                        continue;
+                                    const raw = payload[alias];
+                                    if (raw === null) {
+                                        updates[key] = null;
+                                        return;
+                                    }
+                                    if (typeof raw === "string") {
+                                        updates[key] = raw;
+                                        return;
+                                    }
+                                }
+                            };
+                            setIfPresent("openaiApiKey", ["openaiApiKey", "openai_api_key", "openaiKey", "openai_key"]);
+                            setIfPresent("anthropicApiKey", [
+                                "anthropicApiKey",
+                                "anthropic_api_key",
+                                "anthropicKey",
+                                "anthropic_key",
+                            ]);
+                            setIfPresent("openrouterApiKey", [
+                                "openrouterApiKey",
+                                "openrouter_api_key",
+                                "openrouterKey",
+                                "openrouter_key",
+                            ]);
+                            const saved = writeByokKeys(updates);
+                            const nextEffectiveOpenai = saved.openaiApiKey ?? process.env.OPENAI_API_KEY ?? null;
+                            const nextEffectiveAnthropic = saved.anthropicApiKey ?? process.env.ANTHROPIC_API_KEY ?? null;
+                            const nextEffectiveOpenrouter = saved.openrouterApiKey ?? process.env.OPENROUTER_API_KEY ?? null;
+                            sendJson(res, 200, {
+                                ok: true,
+                                updatedAt: saved.updatedAt,
+                                providers: {
+                                    openai: toProvider({
+                                        storedValue: saved.openaiApiKey,
+                                        envValue: process.env.OPENAI_API_KEY,
+                                        effective: nextEffectiveOpenai,
+                                    }),
+                                    anthropic: toProvider({
+                                        storedValue: saved.anthropicApiKey,
+                                        envValue: process.env.ANTHROPIC_API_KEY,
+                                        effective: nextEffectiveAnthropic,
+                                    }),
+                                    openrouter: toProvider({
+                                        storedValue: saved.openrouterApiKey,
+                                        envValue: process.env.OPENROUTER_API_KEY,
+                                        effective: nextEffectiveOpenrouter,
+                                    }),
+                                },
+                            });
+                        }
+                        catch (err) {
+                            sendJson(res, 500, { ok: false, error: safeErrorMessage(err) });
+                        }
+                        return true;
+                    }
+                    sendJson(res, 200, {
+                        ok: true,
+                        updatedAt: stored?.updatedAt ?? null,
+                        providers: {
+                            openai: toProvider({
+                                storedValue: stored?.openaiApiKey,
+                                envValue: process.env.OPENAI_API_KEY,
+                                effective: effectiveOpenai,
+                            }),
+                            anthropic: toProvider({
+                                storedValue: stored?.anthropicApiKey,
+                                envValue: process.env.ANTHROPIC_API_KEY,
+                                effective: effectiveAnthropic,
+                            }),
+                            openrouter: toProvider({
+                                storedValue: stored?.openrouterApiKey,
+                                envValue: process.env.OPENROUTER_API_KEY,
+                                effective: effectiveOpenrouter,
+                            }),
+                        },
+                    });
+                    return true;
+                }
+                case "settings/byok/health": {
+                    let agentId = searchParams.get("agentId") ??
+                        searchParams.get("agent_id") ??
+                        "";
+                    agentId = agentId.trim();
+                    if (!agentId) {
+                        try {
+                            const agents = await listOpenClawAgents();
+                            const defaultAgent = agents.find((entry) => Boolean(entry.isDefault)) ?? agents[0] ?? null;
+                            const candidate = defaultAgent && typeof defaultAgent.id === "string" ? defaultAgent.id.trim() : "";
+                            if (candidate)
+                                agentId = candidate;
+                        }
+                        catch {
+                            // ignore
+                        }
+                    }
+                    if (!agentId)
+                        agentId = "main";
+                    const providers = {};
+                    for (const provider of ["openai", "anthropic", "openrouter"]) {
+                        try {
+                            const models = await listOpenClawProviderModels({ agentId, provider });
+                            providers[provider] = {
+                                ok: true,
+                                modelCount: models.length,
+                                sample: models.slice(0, 4).map((model) => model.key),
+                            };
+                        }
+                        catch (err) {
+                            providers[provider] = {
+                                ok: false,
+                                error: safeErrorMessage(err),
+                            };
+                        }
+                    }
+                    sendJson(res, 200, {
+                        ok: true,
+                        agentId,
+                        providers,
+                    });
+                    return true;
+                }
                 case "mission-control/graph": {
                     const initiativeId = searchParams.get("initiative_id") ??
                         searchParams.get("initiativeId");
@@ -1614,7 +3671,7 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                 case "entities": {
                     if (method === "POST") {
                         try {
-                            const payload = parseJsonBody(req.body);
+                            const payload = await parseJsonRequest(req);
                             const type = pickString(payload, ["type"]);
                             const title = pickString(payload, ["title", "name"]);
                             if (!type || !title) {
@@ -1660,7 +3717,7 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                     }
                     if (method === "PATCH") {
                         try {
-                            const payload = parseJsonBody(req.body);
+                            const payload = await parseJsonRequest(req);
                             const type = pickString(payload, ["type"]);
                             const id = pickString(payload, ["id"]);
                             if (!type || !id) {
@@ -1709,6 +3766,7 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                     }
                     return true;
                 }
+                case "dashboard-bundle":
                 case "live/snapshot": {
                     const sessionsLimit = parsePositiveInt(searchParams.get("sessionsLimit") ?? searchParams.get("sessions_limit"), 320);
                     const activityLimit = parsePositiveInt(searchParams.get("activityLimit") ?? searchParams.get("activity_limit"), 600);
@@ -1719,6 +3777,49 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                     const decisionStatus = searchParams.get("status") ?? "pending";
                     const includeIdleRaw = searchParams.get("include_idle");
                     const includeIdle = includeIdleRaw === null ? undefined : includeIdleRaw !== "false";
+                    const degraded = [];
+                    const agentContexts = readAgentContexts().agents;
+                    const scopedAgentIds = getScopedAgentIds(agentContexts);
+                    let outboxStatus = null;
+                    try {
+                        if (diagnostics?.getHealth) {
+                            const health = await diagnostics.getHealth({ probeRemote: false });
+                            if (health && typeof health === "object") {
+                                const maybeOutbox = health.outbox;
+                                if (maybeOutbox && typeof maybeOutbox === "object") {
+                                    outboxStatus = maybeOutbox;
+                                }
+                            }
+                        }
+                        if (!outboxStatus) {
+                            const outbox = await outboxAdapter.readSummary();
+                            outboxStatus = {
+                                pendingTotal: outbox.pendingTotal,
+                                pendingByQueue: outbox.pendingByQueue,
+                                oldestEventAt: outbox.oldestEventAt,
+                                newestEventAt: outbox.newestEventAt,
+                                replayStatus: "idle",
+                                lastReplayAttemptAt: null,
+                                lastReplaySuccessAt: null,
+                                lastReplayFailureAt: null,
+                                lastReplayError: null,
+                            };
+                        }
+                    }
+                    catch (err) {
+                        degraded.push(`outbox status unavailable (${safeErrorMessage(err)})`);
+                        outboxStatus = {
+                            pendingTotal: 0,
+                            pendingByQueue: {},
+                            oldestEventAt: null,
+                            newestEventAt: null,
+                            replayStatus: "idle",
+                            lastReplayAttemptAt: null,
+                            lastReplaySuccessAt: null,
+                            lastReplayFailureAt: null,
+                            lastReplayError: null,
+                        };
+                    }
                     let localSnapshot = null;
                     const ensureLocalSnapshot = async (minimumLimit) => {
                         if (!localSnapshot || localSnapshot.sessions.length < minimumLimit) {
@@ -1746,7 +3847,6 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                             includeIdle,
                         }),
                     ]);
-                    const degraded = [];
                     // sessions
                     let sessions = {
                         nodes: [],
@@ -1761,6 +3861,7 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                         degraded.push(`sessions unavailable (${safeErrorMessage(sessionsResult.reason)})`);
                         try {
                             let local = toLocalSessionTree(await ensureLocalSnapshot(Math.max(sessionsLimit, 200)), sessionsLimit);
+                            local = applyAgentContextsToSessionTree(local, agentContexts);
                             if (initiative && initiative.trim().length > 0) {
                                 const filteredNodes = local.nodes.filter((node) => node.initiativeId === initiative || node.groupId === initiative);
                                 const filteredIds = new Set(filteredNodes.map((node) => node.id));
@@ -1799,6 +3900,7 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                                     filtered = filtered.filter((item) => Date.parse(item.timestamp) >= sinceEpoch);
                                 }
                             }
+                            filtered = applyAgentContextsToActivity(filtered, agentContexts);
                             activity = filtered.slice(0, activityLimit);
                         }
                         catch (localErr) {
@@ -1852,9 +3954,51 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                             degraded.push(`agents local fallback failed (${safeErrorMessage(localErr)})`);
                         }
                     }
+                    // Merge locally-launched OpenClaw agent sessions/activity into the snapshot so
+                    // the UI reflects one-click launches even when the cloud reporting plane is reachable.
+                    if (scopedAgentIds.size > 0) {
+                        try {
+                            const minimum = Math.max(Math.max(sessionsLimit, activityLimit), 240);
+                            const snapshot = await ensureLocalSnapshot(minimum);
+                            const scopedSnapshot = {
+                                ...snapshot,
+                                sessions: snapshot.sessions.filter((session) => Boolean(session.agentId && scopedAgentIds.has(session.agentId))),
+                                agents: snapshot.agents.filter((agent) => scopedAgentIds.has(agent.id)),
+                            };
+                            // Sessions
+                            let localSessions = applyAgentContextsToSessionTree(toLocalSessionTree(scopedSnapshot, sessionsLimit), agentContexts);
+                            if (initiative && initiative.trim().length > 0) {
+                                const filteredNodes = localSessions.nodes.filter((node) => node.initiativeId === initiative || node.groupId === initiative);
+                                const filteredIds = new Set(filteredNodes.map((node) => node.id));
+                                const filteredGroupIds = new Set(filteredNodes.map((node) => node.groupId));
+                                localSessions = {
+                                    nodes: filteredNodes,
+                                    edges: localSessions.edges.filter((edge) => filteredIds.has(edge.parentId) && filteredIds.has(edge.childId)),
+                                    groups: localSessions.groups.filter((group) => filteredGroupIds.has(group.id)),
+                                };
+                            }
+                            sessions = mergeSessionTrees(sessions, localSessions);
+                            // Activity
+                            const localActivity = await toLocalLiveActivity(scopedSnapshot, Math.max(activityLimit, 240));
+                            let localItems = applyAgentContextsToActivity(localActivity.activities, agentContexts);
+                            if (run && run.trim().length > 0) {
+                                localItems = localItems.filter((item) => item.runId === run);
+                            }
+                            if (since && since.trim().length > 0) {
+                                const sinceEpoch = Date.parse(since);
+                                if (Number.isFinite(sinceEpoch)) {
+                                    localItems = localItems.filter((item) => Date.parse(item.timestamp) >= sinceEpoch);
+                                }
+                            }
+                            activity = mergeActivities(activity, localItems, activityLimit);
+                        }
+                        catch (err) {
+                            degraded.push(`local agent merge failed (${safeErrorMessage(err)})`);
+                        }
+                    }
                     // include locally buffered events so offline-generated actions are visible
                     try {
-                        const buffered = await readAllOutboxItems();
+                        const buffered = await outboxAdapter.readAllItems();
                         if (buffered.length > 0) {
                             const merged = [...activity, ...buffered]
                                 .sort((a, b) => Date.parse(b.timestamp) - Date.parse(a.timestamp))
@@ -1879,6 +4023,7 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                         handoffs,
                         decisions,
                         agents,
+                        outbox: outboxStatus,
                         generatedAt: new Date().toISOString(),
                         degraded: degraded.length > 0 ? degraded : undefined,
                     });
@@ -1905,6 +4050,7 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                                 : undefined;
                             const limit = Number.isFinite(limitRaw) ? Math.max(1, Number(limitRaw)) : 100;
                             let local = toLocalSessionTree(await loadLocalOpenClawSnapshot(Math.max(limit, 200)), limit);
+                            local = applyAgentContextsToSessionTree(local, readAgentContexts().agents);
                             if (initiative && initiative.trim().length > 0) {
                                 const filteredNodes = local.nodes.filter((node) => node.initiativeId === initiative || node.groupId === initiative);
                                 const filteredIds = new Set(filteredNodes.map((node) => node.id));
@@ -1966,8 +4112,9 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                                     };
                                 }
                             }
+                            const activitiesWithContexts = applyAgentContextsToActivity(local.activities, readAgentContexts().agents);
                             sendJson(res, 200, {
-                                activities: local.activities.slice(0, limit),
+                                activities: activitiesWithContexts.slice(0, limit),
                                 total: local.total,
                             });
                         }
@@ -2014,7 +4161,7 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                         return true;
                     }
                     try {
-                        const payload = parseJsonBody(req.body);
+                        const payload = await parseJsonRequest(req);
                         const text = pickString(payload, ["text", "summary", "detail", "content"]);
                         if (!text) {
                             sendJson(res, 400, { error: "text is required" });
@@ -2192,12 +4339,14 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                         }, STREAM_IDLE_TIMEOUT_MS);
                     };
                     try {
+                        const includeUserHeader = Boolean(config.userId && config.userId.trim().length > 0) &&
+                            !isUserScopedApiKey(config.apiKey);
                         const upstream = await fetch(target, {
                             method: "GET",
                             headers: {
                                 Authorization: `Bearer ${config.apiKey}`,
                                 Accept: "text/event-stream",
-                                ...(config.userId
+                                ...(includeUserHeader
                                     ? { "X-Orgx-User-Id": config.userId }
                                     : {}),
                             },
@@ -2220,6 +4369,7 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                             "Content-Type": "text/event-stream; charset=utf-8",
                             "Cache-Control": "no-cache, no-transform",
                             Connection: "keep-alive",
+                            ...SECURITY_HEADERS,
                             ...CORS_HEADERS,
                         });
                         streamOpened = true;
@@ -2306,6 +4456,7 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
         if (!dashboardEnabled) {
             res.writeHead(404, {
                 "Content-Type": "text/plain",
+                ...SECURITY_HEADERS,
                 ...CORS_HEADERS,
             });
             res.end("Dashboard is disabled");
@@ -2317,8 +4468,14 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
             // Static assets: /orgx/live/assets/* → dashboard/dist/assets/*
             // Hashed filenames get long-lived cache
             if (subPath.startsWith("assets/")) {
-                const assetPath = join(DIST_DIR, subPath);
-                if (existsSync(assetPath)) {
+                const assetPath = resolveSafeDistPath(subPath);
+                let isWithinAssetsDir = false;
+                if (assetPath) {
+                    isWithinAssetsDir =
+                        assetPath === RESOLVED_DIST_ASSETS_DIR ||
+                            assetPath.startsWith(`${RESOLVED_DIST_ASSETS_DIR}${sep}`);
+                }
+                if (assetPath && isWithinAssetsDir && existsSync(assetPath)) {
                     sendFile(res, assetPath, "public, max-age=31536000, immutable");
                 }
                 else {
@@ -2327,9 +4484,9 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
                 return true;
             }
             // Check for an exact file match (e.g. favicon, manifest)
-            if (subPath && !subPath.includes("..")) {
-                const filePath = join(DIST_DIR, subPath);
-                if (existsSync(filePath)) {
+            if (subPath) {
+                const filePath = resolveSafeDistPath(subPath);
+                if (filePath && existsSync(filePath)) {
                     sendFile(res, filePath, "no-cache");
                     return true;
                 }
@@ -2343,6 +4500,7 @@ export function createHttpHandler(config, client, getSnapshot, onboarding) {
             // Redirect to dashboard
             res.writeHead(302, {
                 Location: "/orgx/live",
+                ...SECURITY_HEADERS,
                 ...CORS_HEADERS,
             });
             res.end();