bosun 0.36.0 → 0.36.2

package/ui/index.html

@@ -148,7 +148,7 @@
         await loadApp(false);
       } catch (err) {
         if (!shimReady || !window.importShim) {
-          bootErr('⚠️ Failed to load app modules.<br><small style="color:#888">Try refreshing. If this persists, run <code>npm install</code> in the bosun directory.</small>');
+          bootErr(':alert: Failed to load app modules.<br><small style="color:#888">Try refreshing. If this persists, run <code>npm install</code> in the bosun directory.</small>');
           return;
         }
         console.warn("[ui] Primary CDN failed, switching to fallback.", err);
@@ -157,7 +157,7 @@
           await loadApp(true);
         } catch (fallbackErr) {
           console.error("[ui] Fallback CDN failed.", fallbackErr);
-          bootErr('⚠️ Failed to load app modules.<br><small style="color:#888">Local vendor and CDN fallback both failed. Run <code>npm install</code> in the bosun directory or check your connection.</small>');
+          bootErr(':alert: Failed to load app modules.<br><small style="color:#888">Local vendor and CDN fallback both failed. Run <code>npm install</code> in the bosun directory or check your connection.</small>');
         }
       }
     })();
@@ -170,7 +170,7 @@
       var el = document.getElementById('boot-loader');
       if (el) {
         var s = document.getElementById('boot-status');
-        if (s) s.innerHTML = '⚠️ Failed to load app modules.<br><small style="color:#888">Try refreshing. If this persists, run <code>npm install</code> in the bosun directory.</small>';
+        if (s) s.innerHTML = ':alert: Failed to load app modules.<br><small style="color:#888">Try refreshing. If this persists, run <code>npm install</code> in the bosun directory.</small>';
       }
     }, 12000);
   </script>

package/ui/modules/icon-utils.js

@@ -9,157 +9,201 @@ import htm from "htm";
 import { ICONS } from "./icons.js";
 
 const html = htm.bind(h);
+const TOKEN_ICON_REGEX = /^:([a-zA-Z][a-zA-Z0-9_-]*):$/;
+const INLINE_TOKEN_REGEX = /^:([a-zA-Z][a-zA-Z0-9_-]*):/;
 
 export const EMOJI_ICON_MAP = {
-  "✅": "check",
+  "\u{2705}": "check",
   "✓": "check",
   "✕": "close",
-  "✖": "close",
+  "\u{2716}": "close",
   "✗": "close",
   "✘": "close",
-  "❌": "close",
-  "❓": "help",
-  "➕": "plus",
+  "\u{274c}": "close",
+  "\u{2753}": "help",
+  "\u{2795}": "plus",
   "➤": "arrowRight",
-  "🌍": "globe",
-  "🌐": "globe",
-  "🌳": "git",
-  "🌿": "git",
-  "🎉": "star",
-  "🎛": "sliders",
-  "🎤": "mic",
-  "🎨": "palette",
-  "🎯": "target",
-  "🏁": "flag",
-  "🏠": "home",
-  "🏥": "heart",
-  "🏷": "tag",
-  "🐍": "file",
-  "🐙": "git",
-  "🐚": "terminal",
-  "🐛": "bug",
-  "👀": "eye",
-  "👁": "eye",
-  "👤": "user",
-  "👥": "users",
-  "💎": "diamond",
-  "💓": "heart",
-  "💚": "heart",
-  "💡": "lightbulb",
-  "💥": "zap",
-  "💬": "chat",
-  "💻": "monitor",
-  "💾": "save",
-  "📁": "folder",
-  "📂": "folder",
-  "📄": "file",
-  "📈": "chart",
-  "📊": "chart",
-  "📋": "clipboard",
-  "📌": "pin",
-  "📏": "ruler",
-  "📐": "ruler",
-  "📖": "file",
-  "📜": "file",
-  "📝": "edit",
-  "📡": "server",
-  "📤": "upload",
-  "📥": "download",
-  "📦": "box",
-  "📨": "mail",
-  "📬": "mail",
-  "📱": "phone",
-  "📸": "camera",
-  "🔀": "git",
-  "🔁": "repeat",
-  "🔄": "refresh",
-  "🔌": "plug",
-  "🔍": "search",
-  "🔎": "search",
-  "🔐": "lock",
-  "🔒": "lock",
-  "🔓": "unlock",
-  "🔔": "bell",
-  "🔗": "link",
-  "🔢": "hash",
-  "🔣": "terminal",
-  "🔥": "zap",
-  "🔧": "settings",
-  "🔨": "hammer",
-  "🔴": "dot",
-  "🔵": "dot",
-  "⚪": "dot",
-  "🔷": "diamond",
-  "🖥": "monitor",
-  "🗂": "folder",
-  "🗃": "archive",
-  "🗑": "trash",
-  "🗜": "filter",
-  "🗺": "grid",
-  "🙈": "eyeOff",
-  "🚀": "rocket",
-  "🚦": "alert",
-  "🚧": "alert",
-  "🚨": "alert",
-  "🚫": "ban",
-  "🛑": "close",
-  "🛡": "shield",
-  "🛰": "server",
-  "🟡": "dot",
-  "🟢": "dot",
-  "🤖": "bot",
-  "🦀": "file",
-  "🧠": "cpu",
-  "🧪": "beaker",
-  "🧭": "compass",
-  "🧰": "settings",
-  "🧵": "link",
-  "🧹": "trash",
-  "🪝": "link",
-  "♻": "repeat",
-  "♻️": "repeat",
-  "⬇": "download",
-  "⬇️": "download",
-  "⬆": "upload",
-  "⬆️": "upload",
-  "✨": "star",
-  "⭐": "star",
-  "⚙": "settings",
-  "⚙️": "settings",
-  "⚠": "alert",
-  "⚠️": "alert",
-  "⚡": "zap",
-  "⏱": "clock",
-  "⏱️": "clock",
-  "⏸": "pause",
-  "⏸️": "pause",
-  "⏹": "stop",
-  "⏹️": "stop",
-  "▶": "play",
-  "▶️": "play",
-  "⏳": "clock",
-  "⛔": "ban",
-  "☰": "menu",
+  "\u{1f30d}": "globe",
+  "\u{1f310}": "globe",
+  "\u{1f333}": "git",
+  "\u{1f33f}": "git",
+  "\u{1f389}": "star",
+  "\u{1f39b}": "sliders",
+  "\u{1f3a4}": "mic",
+  "\u{1f3a8}": "palette",
+  "\u{1f3af}": "target",
+  "\u{1f3c1}": "flag",
+  "\u{1f3e0}": "home",
+  "\u{1f3e5}": "heart",
+  "\u{1f3f7}": "tag",
+  "\u{1f40d}": "file",
+  "\u{1f419}": "git",
+  "\u{1f41a}": "terminal",
+  "\u{1f41b}": "bug",
+  "\u{1f440}": "eye",
+  "\u{1f441}": "eye",
+  "\u{1f464}": "user",
+  "\u{1f465}": "users",
+  "\u{1f48e}": "diamond",
+  "\u{1f493}": "heart",
+  "\u{1f49a}": "heart",
+  "\u{1f4a1}": "lightbulb",
+  "\u{1f4a5}": "zap",
+  "\u{1f4ac}": "chat",
+  "\u{1f4bb}": "monitor",
+  "\u{1f4be}": "save",
+  "\u{1f4c1}": "folder",
+  "\u{1f4c2}": "folder",
+  "\u{1f4c4}": "file",
+  "\u{1f4c8}": "chart",
+  "\u{1f4ca}": "chart",
+  "\u{1f4cb}": "clipboard",
+  "\u{1f4cc}": "pin",
+  "\u{1f4cf}": "ruler",
+  "\u{1f4d0}": "ruler",
+  "\u{1f4d6}": "file",
+  "\u{1f4dc}": "file",
+  "\u{1f4dd}": "edit",
+  "\u{1f4e1}": "server",
+  "\u{1f4e4}": "upload",
+  "\u{1f4e5}": "download",
+  "\u{1f4e6}": "box",
+  "\u{1f4e8}": "mail",
+  "\u{1f4ec}": "mail",
+  "\u{1f4f1}": "phone",
+  "\u{1f4f8}": "camera",
+  "\u{1f500}": "git",
+  "\u{1f501}": "repeat",
+  "\u{1f504}": "refresh",
+  "\u{1f50c}": "plug",
+  "\u{1f50d}": "search",
+  "\u{1f50e}": "search",
+  "\u{1f510}": "lock",
+  "\u{1f512}": "lock",
+  "\u{1f513}": "unlock",
+  "\u{1f514}": "bell",
+  "\u{1f517}": "link",
+  "\u{1f522}": "hash",
+  "\u{1f523}": "terminal",
+  "\u{1f525}": "zap",
+  "\u{1f527}": "settings",
+  "\u{1f528}": "hammer",
+  "\u{1f534}": "dot",
+  "\u{1f535}": "dot",
+  "\u{26aa}": "dot",
+  "\u{1f537}": "diamond",
+  "\u{1f5a5}": "monitor",
+  "\u{1f5c2}": "folder",
+  "\u{1f5c3}": "archive",
+  "\u{1f5d1}": "trash",
+  "\u{1f5dc}": "filter",
+  "\u{1f5fa}": "grid",
+  "\u{1f648}": "eyeOff",
+  "\u{1f680}": "rocket",
+  "\u{1f6a6}": "alert",
+  "\u{1f6a7}": "alert",
+  "\u{1f6a8}": "alert",
+  "\u{1f6ab}": "ban",
+  "\u{1f6d1}": "close",
+  "\u{1f6e1}": "shield",
+  "\u{1f6f0}": "server",
+  "\u{1f7e1}": "dot",
+  "\u{1f7e2}": "dot",
+  "\u{1f916}": "bot",
+  "\u{1f980}": "file",
+  "\u{1f9e0}": "cpu",
+  "\u{1f9ea}": "beaker",
+  "\u{1f9ed}": "compass",
+  "\u{1f9f0}": "settings",
+  "\u{1f9f5}": "link",
+  "\u{1f9f9}": "trash",
+  "\u{1fa9d}": "link",
+  "\u{267b}": "repeat",
+  "\u{267b}️": "repeat",
+  "\u{2b07}": "download",
+  "\u{2b07}️": "download",
+  "\u{2b06}": "upload",
+  "\u{2b06}️": "upload",
+  "\u{2728}": "star",
+  "\u{2b50}": "star",
+  "\u{2699}": "settings",
+  "\u{2699}️": "settings",
+  "\u{26a0}": "alert",
+  "\u{26a0}️": "alert",
+  "\u{26a1}": "zap",
+  "\u{23f1}": "clock",
+  "\u{23f1}️": "clock",
+  "\u{23f8}": "pause",
+  "\u{23f8}️": "pause",
+  "\u{23f9}": "stop",
+  "\u{23f9}️": "stop",
+  "\u{25b6}": "play",
+  "\u{25b6}️": "play",
+  "\u{23f3}": "clock",
+  "\u{26d4}": "ban",
+  "\u{2630}": "menu",
   "#️⃣": "hash",
-  "🎛️": "sliders",
-  "🗺️": "grid",
-  "🖥️": "monitor",
-  "🏷️": "tag",
-  "🛰️": "server",
-  "🛡️": "shield",
-  "👁️": "eye",
+  "\u{1f39b}️": "sliders",
+  "\u{1f5fa}️": "grid",
+  "\u{1f5a5}️": "monitor",
+  "\u{1f3f7}️": "tag",
+  "\u{1f6f0}️": "server",
+  "\u{1f6e1}️": "shield",
+  "\u{1f441}️": "eye",
 };
 
-export function resolveIcon(icon) {
+const ICON_ALIAS_MAP = Object.freeze({
+  ok: "check",
+  success: "check",
+  fail: "close",
+  error: "close",
+  warning: "alert",
+  warn: "alert",
+  info: "help",
+  question: "help",
+  sparkles: "star",
+  brain: "cpu",
+  tasks: "clipboard",
+  log: "file",
+  logs: "file",
+  stopSign: "stop",
+  playCircle: "play",
+  pauseCircle: "pause",
+});
+
+function normalizeIconInput(icon) {
+  return String(icon || "").replace(/[\uFE0E\uFE0F]/g, "");
+}
+
+function resolveIconName(icon) {
   if (!icon) return null;
-  if (ICONS[icon]) return ICONS[icon];
-  const normalized = String(icon).replace(/[\uFE0E\uFE0F]/g, "");
-  if (ICONS[normalized]) return ICONS[normalized];
-  const mapped = EMOJI_ICON_MAP[icon] || EMOJI_ICON_MAP[normalized];
-  if (mapped && ICONS[mapped]) return ICONS[mapped];
+  const normalizedRaw = normalizeIconInput(icon);
+  if (!normalizedRaw) return null;
+
+  const tokenMatch = normalizedRaw.match(TOKEN_ICON_REGEX);
+  const tokenName = tokenMatch ? tokenMatch[1] : normalizedRaw;
+  const normalized = normalizeIconInput(tokenName).trim();
+  if (!normalized) return null;
+
+  if (ICONS[normalized]) return normalized;
+  const lowered = normalized.toLowerCase();
+  if (ICONS[lowered]) return lowered;
+  const aliased = ICON_ALIAS_MAP[lowered];
+  if (aliased && ICONS[aliased]) return aliased;
+  const mapped = EMOJI_ICON_MAP[icon] || EMOJI_ICON_MAP[normalizedRaw] || EMOJI_ICON_MAP[normalized];
+  if (mapped && ICONS[mapped]) return mapped;
   return null;
 }
 
+function appendIconPart(parts, iconName) {
+  parts.push(html`<span class="icon-inline" aria-hidden="true">${ICONS[iconName]}</span>`);
+}
+
+export function resolveIcon(icon) {
+  const iconName = resolveIconName(icon);
+  return iconName ? ICONS[iconName] : null;
+}
+
 export function iconText(text, { className = "" } = {}) {
   if (text == null) return text;
   const str = String(text);
@@ -167,16 +211,36 @@ export function iconText(text, { className = "" } = {}) {
   const parts = [];
   let buffer = "";
 
-  for (const ch of str) {
+  for (let i = 0; i < str.length; ) {
+    const tokenMatch = str.slice(i).match(INLINE_TOKEN_REGEX);
+    if (tokenMatch) {
+      const fullMatch = tokenMatch[0];
+      const iconName = resolveIconName(tokenMatch[1]);
+      if (iconName) {
+        if (buffer) {
+          parts.push(buffer);
+          buffer = "";
+        }
+        appendIconPart(parts, iconName);
+        hasIcon = true;
+        i += fullMatch.length;
+        continue;
+      }
+    }
+
+    const codePoint = str.codePointAt(i);
+    if (typeof codePoint !== "number") break;
+    const ch = String.fromCodePoint(codePoint);
+    i += ch.length;
+
     if (ch === "\uFE0E" || ch === "\uFE0F") continue;
-    const mapped = EMOJI_ICON_MAP[ch];
-    const icon = mapped ? ICONS[mapped] : null;
-    if (icon) {
+    const iconName = resolveIconName(ch);
+    if (iconName) {
       if (buffer) {
         parts.push(buffer);
         buffer = "";
       }
-      parts.push(html`<span class="icon-inline" aria-hidden="true">${icon}</span>`);
+      appendIconPart(parts, iconName);
       hasIcon = true;
     } else {
       buffer += ch;

package/ui/modules/icons.js

@@ -13,7 +13,7 @@ const html = htm.bind(h);
  *   viewBox="0 0 24 24" fill="none" stroke="currentColor"
  *   stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
  *
- * Small inline icons additionally set width="16" height="16".
+ * Icon size is controlled exclusively by CSS (.icon-inline svg sets width/height).
  */
 export const ICONS = {
   /* ── Brand ── */
@@ -356,8 +356,6 @@ export const ICONS = {
     stroke-width="2"
     stroke-linecap="round"
     stroke-linejoin="round"
-    width="16"
-    height="16"
   >
     <polyline points="6 9 12 15 18 9" />
   </svg>`,
@@ -369,8 +367,6 @@ export const ICONS = {
     stroke-width="2"
     stroke-linecap="round"
     stroke-linejoin="round"
-    width="16"
-    height="16"
   >
     <line x1="22" y1="2" x2="11" y2="13" />
     <polygon points="22 2 15 22 11 13 2 9 22 2" />
@@ -383,8 +379,6 @@ export const ICONS = {
     stroke-width="2"
     stroke-linecap="round"
     stroke-linejoin="round"
-    width="16"
-    height="16"
   >
     <polyline points="23 4 23 10 17 10" />
     <path d="M20.49 15a9 9 0 1 1-2.12-9.36L23 10" />
@@ -397,8 +391,6 @@ export const ICONS = {
     stroke-width="2"
     stroke-linecap="round"
     stroke-linejoin="round"
-    width="16"
-    height="16"
   >
     <circle cx="11" cy="11" r="8" />
     <line x1="21" y1="21" x2="16.65" y2="16.65" />
@@ -411,8 +403,6 @@ export const ICONS = {
     stroke-width="2"
     stroke-linecap="round"
     stroke-linejoin="round"
-    width="16"
-    height="16"
   >
     <rect x="9" y="9" width="13" height="13" rx="2" ry="2" />
     <path d="M5 15H4a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h9a2 2 0 0 1 2 2v1" />
@@ -425,8 +415,6 @@ export const ICONS = {
     stroke-width="2"
     stroke-linecap="round"
     stroke-linejoin="round"
-    width="16"
-    height="16"
   >
     <polyline points="3 6 5 6 21 6" />
     <path
@@ -443,8 +431,6 @@ export const ICONS = {
     stroke-width="2"
     stroke-linecap="round"
     stroke-linejoin="round"
-    width="16"
-    height="16"
   >
     <path d="M11 4H4a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2v-7" />
     <path d="M18.5 2.5a2.121 2.121 0 0 1 3 3L12 15l-4 1 1-4 9.5-9.5z" />
@@ -457,8 +443,6 @@ export const ICONS = {
     stroke-width="2"
     stroke-linecap="round"
     stroke-linejoin="round"
-    width="16"
-    height="16"
   >
     <path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z" />
     <circle cx="12" cy="12" r="3" />
@@ -471,8 +455,6 @@ export const ICONS = {
     stroke-width="2"
     stroke-linecap="round"
     stroke-linejoin="round"
-    width="16"
-    height="16"
   >
     <path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71" />
     <path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71" />
@@ -485,8 +467,6 @@ export const ICONS = {
     stroke-width="2"
     stroke-linecap="round"
     stroke-linejoin="round"
-    width="16"
-    height="16"
   >
     <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4" />
     <polyline points="7 10 12 15 17 10" />
@@ -500,8 +480,6 @@ export const ICONS = {
     stroke-width="2"
     stroke-linecap="round"
     stroke-linejoin="round"
-    width="16"
-    height="16"
   >
     <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4" />
     <polyline points="17 8 12 3 7 8" />
@@ -515,8 +493,6 @@ export const ICONS = {
     stroke-width="2"
     stroke-linecap="round"
     stroke-linejoin="round"
-    width="16"
-    height="16"
   >
     <path d="M17 21v-2a4 4 0 0 0-4-4H5a4 4 0 0 0-4 4v2" />
     <circle cx="9" cy="7" r="4" />
@@ -531,8 +507,6 @@ export const ICONS = {
     stroke-width="2"
     stroke-linecap="round"
     stroke-linejoin="round"
-    width="16"
-    height="16"
   >
     <path
       d="M22 19a2 2 0 0 1-2 2H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h5l2 3h9a2 2 0 0 1 2 2z"
@@ -1074,3 +1048,4 @@ export const ICONS = {
     <polygon points="16 8 14 14 8 16 10 10 16 8" />
   </svg>`,
 };
+

package/ui/modules/settings-schema.js

@@ -66,21 +66,31 @@ export const SETTINGS_SCHEMA = [
   { key: "TELEGRAM_UI_ALLOW_UNSAFE",       label: "Allow Unsafe (No Auth)",      category: "miniapp", type: "boolean", defaultVal: false, description: "DANGER: Disables ALL authentication. Anyone with your URL can control agents, read secrets, and execute code on your machine. Combined with a tunnel, this exposes your machine to the ENTIRE INTERNET. Only enable for localhost-only debugging with tunnel DISABLED.", restart: true, danger: true },
   { key: "_UNSAFE_TUNNEL_WARNING",          label: "",                            category: "miniapp", type: "info",    description: "WARNING: If 'Allow Unsafe' is ON and 'Tunnel Mode' is not disabled, your UI is publicly accessible with ZERO authentication. This is a critical security risk." },
   { key: "TELEGRAM_UI_AUTH_MAX_AGE_SEC",   label: "Auth Token Max Age",         category: "miniapp", type: "number",  defaultVal: 86400, min: 300, max: 604800, unit: "sec", description: "Maximum age for Telegram initData tokens before they expire." },
-  { key: "TELEGRAM_UI_TUNNEL",             label: "Tunnel Mode",                category: "miniapp", type: "select",  defaultVal: "auto", options: ["auto", "cloudflared", "disabled"], description: "Cloudflare tunnel mode. 'auto' starts tunnel if cloudflared is available.", restart: true },
+  { key: "TELEGRAM_UI_TUNNEL",             label: "Tunnel Mode",                category: "miniapp", type: "select",  defaultVal: "named", options: ["named", "quick", "auto", "cloudflared", "disabled"], description: "Cloudflare tunnel mode. 'named' is default and uses persistent hostname + DNS sync. 'quick' is explicit fallback.", restart: true },
+  { key: "TELEGRAM_UI_ALLOW_QUICK_TUNNEL_FALLBACK", label: "Allow Quick Fallback", category: "miniapp", type: "boolean", defaultVal: false, description: "When named tunnel startup fails, allow fallback to random trycloudflare hostname.", restart: true, advanced: true },
+  { key: "TELEGRAM_UI_FALLBACK_AUTH_ENABLED", label: "Enable Fallback Auth", category: "miniapp", type: "boolean", defaultVal: true, description: "Enable admin fallback PIN/password auth for recovering access when Telegram/session token auth is unavailable.", restart: false },
+  { key: "TELEGRAM_UI_FALLBACK_AUTH_RATE_LIMIT_IP_PER_MIN", label: "Fallback Per-IP Limit", category: "miniapp", type: "number", defaultVal: 10, min: 1, max: 200, unit: "req/min", description: "Per-IP rate limit for fallback auth attempts.", advanced: true },
+  { key: "TELEGRAM_UI_FALLBACK_AUTH_RATE_LIMIT_GLOBAL_PER_MIN", label: "Fallback Global Limit", category: "miniapp", type: "number", defaultVal: 60, min: 1, max: 500, unit: "req/min", description: "Global rate limit for fallback auth attempts.", advanced: true },
+  { key: "TELEGRAM_UI_FALLBACK_AUTH_MAX_FAILURES", label: "Fallback Max Failures", category: "miniapp", type: "number", defaultVal: 5, min: 1, max: 50, description: "Failed fallback auth attempts before temporary lockout.", advanced: true },
+  { key: "TELEGRAM_UI_FALLBACK_AUTH_LOCKOUT_MS", label: "Fallback Lockout", category: "miniapp", type: "number", defaultVal: 600000, min: 10000, max: 86400000, unit: "ms", description: "Temporary lockout duration after too many failed fallback auth attempts.", advanced: true },
+  { key: "TELEGRAM_UI_FALLBACK_AUTH_ROTATE_DAYS", label: "Fallback Rotate Days", category: "miniapp", type: "number", defaultVal: 30, min: 1, max: 365, unit: "days", description: "Rotation target for fallback auth credential.", advanced: true },
+  { key: "TELEGRAM_UI_FALLBACK_AUTH_TRANSIENT_COOLDOWN_MS", label: "Fallback Cooldown", category: "miniapp", type: "number", defaultVal: 5000, min: 1000, max: 60000, unit: "ms", description: "Cooldown when fallback auth backend returns transient errors.", advanced: true },
 
   // ── Executor / AI ──────────────────────────────────────────
   { key: "EXECUTOR_MODE",                  label: "Executor Mode",              category: "executor", type: "select", defaultVal: "internal", options: ["vk", "internal", "hybrid"], description: "Task execution mode. 'internal' uses built-in agent pool, 'vk' delegates to Vibe-Kanban, 'hybrid' uses both.", restart: true },
   { key: "INTERNAL_EXECUTOR_PARALLEL",     label: "Max Parallel Agents",        category: "executor", type: "number", defaultVal: 3, min: 1, max: 20, description: "Maximum number of concurrent agent execution slots." },
-  { key: "INTERNAL_EXECUTOR_SDK",          label: "Default SDK",                category: "executor", type: "select", defaultVal: "auto", options: ["auto", "codex", "copilot", "claude"], description: "Default AI SDK for task execution. 'auto' selects based on availability and task complexity." },
+  { key: "INTERNAL_EXECUTOR_SDK",          label: "Default SDK",                category: "executor", type: "select", defaultVal: "auto", options: ["auto", "codex", "copilot", "claude", "gemini", "opencode"], description: "Default AI SDK for task execution. 'auto' selects based on availability and task complexity." },
   { key: "INTERNAL_EXECUTOR_TIMEOUT_MS",   label: "Task Timeout",               category: "executor", type: "number", defaultVal: 5400000, min: 60000, max: 14400000, unit: "ms", description: "Maximum time a single task execution can run (default: 90 min)." },
   { key: "INTERNAL_EXECUTOR_MAX_RETRIES",  label: "Max Retries",                category: "executor", type: "number", defaultVal: 2, min: 0, max: 10, description: "Number of automatic retries per task before marking as failed." },
   { key: "INTERNAL_EXECUTOR_POLL_MS",      label: "Poll Interval",              category: "executor", type: "number", defaultVal: 30000, min: 5000, max: 300000, unit: "ms", description: "How often the executor polls the kanban board for new tasks.", advanced: true },
   { key: "INTERNAL_EXECUTOR_REVIEW_AGENT_ENABLED", label: "PR Review Agent",    category: "executor", type: "boolean", defaultVal: true, description: "Enable automatic PR review handoff after task completion." },
   { key: "INTERNAL_EXECUTOR_REPLENISH_ENABLED", label: "Auto Replenish Backlog", category: "executor", type: "boolean", defaultVal: false, description: "Automatically generate new tasks when backlog is low." },
-  { key: "PRIMARY_AGENT",                  label: "Primary Agent SDK",          category: "executor", type: "select", defaultVal: "codex-sdk", options: ["codex-sdk", "copilot-sdk", "claude-sdk"], description: "Which AI SDK handles primary agent sessions and chat commands." },
+  { key: "PRIMARY_AGENT",                  label: "Primary Agent SDK",          category: "executor", type: "select", defaultVal: "codex-sdk", options: ["codex-sdk", "copilot-sdk", "claude-sdk", "gemini-sdk", "opencode-sdk"], description: "Which AI SDK handles primary agent sessions and chat commands." },
   { key: "CODEX_SDK_DISABLED",             label: "Disable Codex SDK",          category: "executor", type: "boolean", defaultVal: false, description: "When true, Codex SDK is unavailable for chat and will not appear in the executor picker.", restart: true },
   { key: "COPILOT_SDK_DISABLED",           label: "Disable Copilot SDK",        category: "executor", type: "boolean", defaultVal: false, description: "When true, Copilot SDK is unavailable for chat and will not appear in the executor picker.", restart: true },
   { key: "CLAUDE_SDK_DISABLED",            label: "Disable Claude SDK",         category: "executor", type: "boolean", defaultVal: false, description: "When true, Claude SDK is unavailable for chat and will not appear in the executor picker.", restart: true },
+  { key: "GEMINI_SDK_DISABLED",            label: "Disable Gemini SDK",         category: "executor", type: "boolean", defaultVal: false, description: "When true, Gemini SDK is unavailable for chat and will not appear in the executor picker.", restart: true },
+  { key: "OPENCODE_SDK_DISABLED",          label: "Disable OpenCode SDK",       category: "executor", type: "boolean", defaultVal: false, description: "When true, OpenCode SDK is unavailable for chat and will not appear in the executor picker.", restart: true },
   { key: "EXECUTORS",                      label: "Executor Distribution",      category: "executor", type: "string", defaultVal: "CODEX:DEFAULT:100", description: "Weighted executor configuration. Format: TYPE:VARIANT:WEIGHT[:MODEL|MODEL],... (e.g., CODEX:DEFAULT:70:gpt-5.2-codex|gpt-5.1-codex-mini,COPILOT:CLAUDE_OPUS_4_6:30:claude-opus-4.6)", validate: "^[A-Z_]+:[A-Z_]+:\\d+" },
   { key: "EXECUTOR_DISTRIBUTION",          label: "Distribution Strategy",      category: "executor", type: "select", defaultVal: "weighted", options: ["weighted", "round-robin", "primary-only"], description: "How tasks are distributed across configured executors.", advanced: true },
   { key: "FAILOVER_STRATEGY",              label: "Failover Strategy",          category: "executor", type: "select", defaultVal: "next-in-line", options: ["next-in-line", "weighted-random", "round-robin"], description: "Strategy for selecting next executor when the primary fails.", advanced: true },
@@ -104,20 +114,26 @@ export const SETTINGS_SCHEMA = [
   { key: "CODEX_SUBAGENT_MODEL",           label: "Subagent Model",             category: "executor", type: "string", defaultVal: "gpt-5.1-codex-mini", description: "Preferred lightweight model for delegated/subagent work." },
   { key: "ANTHROPIC_API_KEY",              label: "Anthropic API Key",          category: "executor", type: "secret", sensitive: true, description: "Anthropic API key for Claude SDK. Required if using Claude executor." },
   { key: "CLAUDE_MODEL",                   label: "Claude Model",               category: "executor", type: "string", defaultVal: "claude-opus-4-6", description: "Model for Claude SDK. E.g., claude-opus-4-6, claude-sonnet-4-5." },
+  { key: "GEMINI_API_KEY",                 label: "Gemini API Key",             category: "executor", type: "secret", sensitive: true, description: "Google AI Studio key for Gemini SDK (alternative: GOOGLE_API_KEY)." },
+  { key: "GOOGLE_API_KEY",                 label: "Google API Key",             category: "executor", type: "secret", sensitive: true, description: "Alternative key env used by Gemini SDK." },
+  { key: "GEMINI_MODEL",                   label: "Gemini Model",               category: "executor", type: "string", defaultVal: "gemini-2.5-pro", description: "Model for Gemini SDK sessions (for example gemini-2.5-pro)." },
+  { key: "GEMINI_TRANSPORT",               label: "Gemini Transport",           category: "executor", type: "select", defaultVal: "auto", options: ["auto", "sdk", "cli"], description: "Gemini adapter transport. 'auto' uses SDK then falls back to CLI." },
+  { key: "OPENCODE_MODEL",                 label: "OpenCode Model",             category: "executor", type: "string", defaultVal: "gpt-5.2-codex", description: "Model override passed to OpenCode sessions." },
   { key: "COPILOT_MODEL",                  label: "Copilot Model",              category: "executor", type: "string", defaultVal: "gpt-5", description: "Model for Copilot SDK sessions." },
   { key: "COPILOT_CLI_TOKEN",              label: "Copilot CLI Token",          category: "executor", type: "secret", sensitive: true, description: "Auth token for Copilot CLI remote mode." },
 
   // ── Voice Assistant ──────────────────────────────────────────
   { key: "VOICE_ENABLED",                  label: "Enable Voice Mode",          category: "voice", type: "boolean", defaultVal: true, description: "Enable the real-time voice assistant in the chat UI." },
-  { key: "VOICE_PROVIDER",                 label: "Voice Provider",             category: "voice", type: "select", defaultVal: "auto", options: ["auto", "openai", "azure", "fallback"], description: "Voice API provider. 'auto' selects based on available keys. 'fallback' uses browser speech APIs." },
+  { key: "VOICE_PROVIDER",                 label: "Voice Provider",             category: "voice", type: "select", defaultVal: "auto", options: ["auto", "openai", "azure", "claude", "gemini", "fallback"], description: "Voice API provider. 'auto' selects based on available keys. 'fallback' uses browser speech APIs." },
   { key: "VOICE_MODEL",                    label: "Voice Model",                category: "voice", type: "string", defaultVal: "gpt-4o-realtime-preview-2024-12-17", description: "OpenAI Realtime model to use for voice sessions." },
+  { key: "VOICE_VISION_MODEL",             label: "Vision Model",               category: "voice", type: "string", defaultVal: "gpt-4.1-mini", description: "Vision model used for live screen/camera understanding in voice mode." },
   { key: "OPENAI_REALTIME_API_KEY",        label: "OpenAI Realtime Key",        category: "voice", type: "secret", sensitive: true, description: "Dedicated API key for voice. Falls back to OPENAI_API_KEY if not set." },
   { key: "AZURE_OPENAI_REALTIME_ENDPOINT", label: "Azure Realtime Endpoint",    category: "voice", type: "string", description: "Azure OpenAI endpoint for Realtime API (e.g., https://myresource.openai.azure.com).", validate: "^$|^https?://" },
   { key: "AZURE_OPENAI_REALTIME_API_KEY",  label: "Azure Realtime Key",         category: "voice", type: "secret", sensitive: true, description: "Azure OpenAI API key for Realtime API. Falls back to AZURE_OPENAI_API_KEY if not set." },
   { key: "AZURE_OPENAI_REALTIME_DEPLOYMENT", label: "Azure Deployment",         category: "voice", type: "string", defaultVal: "gpt-4o-realtime-preview", description: "Azure deployment name for the Realtime model." },
   { key: "VOICE_ID",                       label: "Voice",                      category: "voice", type: "select", defaultVal: "alloy", options: ["alloy", "ash", "ballad", "coral", "echo", "fable", "onyx", "nova", "sage", "shimmer", "verse"], description: "Voice personality for text-to-speech output." },
   { key: "VOICE_TURN_DETECTION",           label: "Turn Detection",             category: "voice", type: "select", defaultVal: "server_vad", options: ["server_vad", "semantic_vad", "none"], description: "How the model detects when you stop speaking. 'semantic_vad' is more intelligent but higher latency." },
-  { key: "VOICE_DELEGATE_EXECUTOR",        label: "Delegate Executor",          category: "voice", type: "select", defaultVal: "codex-sdk", options: ["codex-sdk", "copilot-sdk", "claude-sdk", "opencode-sdk"], description: "Which agent executor voice tool calls delegate to for complex tasks." },
+  { key: "VOICE_DELEGATE_EXECUTOR",        label: "Delegate Executor",          category: "voice", type: "select", defaultVal: "codex-sdk", options: ["codex-sdk", "copilot-sdk", "claude-sdk", "gemini-sdk", "opencode-sdk"], description: "Which agent executor voice tool calls delegate to for complex tasks." },
   { key: "VOICE_FALLBACK_MODE",            label: "Fallback Mode",              category: "voice", type: "select", defaultVal: "browser", options: ["browser", "disabled"], description: "When Tier 1 (Realtime API) is unavailable, use browser speech APIs as fallback." },
 
   // ── Kanban / Tasks ─────────────────────────────────────────
@@ -172,6 +188,14 @@ export const SETTINGS_SCHEMA = [
   // ── Network / Tunnel ──────────────────────────────────────
   { key: "CLOUDFLARE_TUNNEL_NAME",         label: "Tunnel Name",                category: "network", type: "string", description: "Named Cloudflare tunnel for persistent URL. Leave empty for random quick tunnel." },
   { key: "CLOUDFLARE_TUNNEL_CREDENTIALS",  label: "Tunnel Credentials",         category: "network", type: "secret", sensitive: true, description: "Path to Cloudflare tunnel credentials JSON file." },
+  { key: "CLOUDFLARE_BASE_DOMAIN",         label: "Base Domain",                category: "network", type: "string", description: "Base domain for deterministic per-user hostnames (for example bosun.det.io)." },
+  { key: "CLOUDFLARE_TUNNEL_HOSTNAME",     label: "Explicit Hostname",          category: "network", type: "string", description: "Optional explicit hostname override (for example jon.bosun.det.io)." },
+  { key: "CLOUDFLARE_USERNAME_HOSTNAME_POLICY", label: "Hostname Policy",       category: "network", type: "select", defaultVal: "per-user-fixed", options: ["per-user-fixed", "fixed"], description: "per-user-fixed creates stable hostname per workstation user. fixed uses shared CLOUDFLARE_FIXED_HOST_LABEL.", advanced: true },
+  { key: "CLOUDFLARE_ZONE_ID",             label: "Zone ID",                    category: "network", type: "string", description: "Cloudflare zone ID used by DNS orchestration API client.", advanced: true },
+  { key: "CLOUDFLARE_API_TOKEN",           label: "API Token",                  category: "network", type: "secret", sensitive: true, description: "Cloudflare API token scoped to Zone DNS edit for the configured zone.", advanced: true },
+  { key: "CLOUDFLARE_DNS_SYNC_ENABLED",    label: "DNS Sync Enabled",           category: "network", type: "boolean", defaultVal: true, description: "Enable idempotent Cloudflare DNS create/verify/update for the named tunnel hostname.", advanced: true },
+  { key: "CLOUDFLARE_DNS_MAX_RETRIES",     label: "DNS Retry Count",            category: "network", type: "number", defaultVal: 3, min: 1, max: 8, description: "Retry attempts for Cloudflare DNS API operations.", advanced: true },
+  { key: "CLOUDFLARE_DNS_RETRY_BASE_MS",   label: "DNS Retry Base",             category: "network", type: "number", defaultVal: 750, min: 100, max: 5000, unit: "ms", description: "Base delay for Cloudflare DNS API retry backoff.", advanced: true },
   { key: "TELEGRAM_PRESENCE_INTERVAL_SEC", label: "Presence Interval",          category: "network", type: "number", defaultVal: 60, min: 10, max: 600, unit: "sec", description: "How often this instance announces its presence to the coordinator." },
   { key: "TELEGRAM_PRESENCE_DISABLED",     label: "Disable Presence",           category: "network", type: "boolean", defaultVal: false, description: "Disable multi-instance presence entirely." },
   { key: "VE_INSTANCE_LABEL",              label: "Instance Label",             category: "network", type: "string", description: "Human-friendly name for this instance in multi-instance setups." },