crewswarm 0.9.2 → 0.9.4

package/scripts/dashboard.mjs

@@ -30,9 +30,25 @@ import {
 } from "../lib/agents/tool-instructions.mjs";
 import {
   StartBuildSchema,
+  EnhancePromptSchema,
   StartPMLoopSchema,
   ServiceActionSchema,
   ImportSkillSchema,
+  AgentConfigCreateSchema,
+  AgentConfigDeleteSchema,
+  AgentResetSessionSchema,
+  ProviderAddSchema,
+  ProviderSaveSchema,
+  ProviderTestSchema,
+  ProviderBuiltinTestSchema,
+  ContinuousBuildSchema,
+  ReplayDLQSchema,
+  DeleteProjectSchema,
+  UpdateProjectSchema,
+  RoadmapWriteSchema,
+  RoadmapRetryFailedSchema,
+  ContactDeleteSchema,
+  ContactSendSchema,
   validate,
 } from "./dashboard-validation.mjs";
 import { execCrewLeadTools } from "../lib/crew-lead/tools.mjs";
@@ -108,6 +124,103 @@ if (!lockResult.ok) {
   process.exit(1);
 }
 
+// ── OAuth token cache with TTL refresh ──────────────────────────────────────
+const _oauthTokenCache = {};
+const _oauthTokenTimestamp = {};  // providerId → Date.now() when cached
+const OAUTH_TOKEN_TTL_MS = 25 * 60 * 1000; // 25 minutes (tokens typically expire in 30-60 min)
+
+// Capture execFileSync at module load for sync token refresh
+const { execFileSync: _oauthExecFileSync } = await import("node:child_process");
+
+function refreshAnthropicOAuthToken() {
+  try {
+    for (const acct of [os.userInfo().username, "jeffhobbs", "unknown"]) {
+      try {
+        const raw = _oauthExecFileSync("security", [
+          "find-generic-password", "-s", "Claude Code-credentials", "-a", acct, "-w"
+        ], { encoding: "utf8", timeout: 5000 }).trim();
+        const parsed = JSON.parse(raw);
+        if (parsed?.claudeAiOauth?.accessToken) {
+          _oauthTokenCache["anthropic-oauth"] = parsed.claudeAiOauth.accessToken;
+          _oauthTokenTimestamp["anthropic-oauth"] = Date.now();
+          return;
+        }
+      } catch { /* try next account */ }
+    }
+  } catch { /* keychain not accessible */ }
+}
+
+// Initial load at startup
+try {
+  for (const acct of [os.userInfo().username, "jeffhobbs", "unknown"]) {
+    try {
+      const raw = _oauthExecFileSync("security", [
+        "find-generic-password", "-s", "Claude Code-credentials", "-a", acct, "-w"
+      ], { encoding: "utf8", timeout: 5000 }).trim();
+      const parsed = JSON.parse(raw);
+      if (parsed?.claudeAiOauth?.accessToken) {
+        _oauthTokenCache["anthropic-oauth"] = parsed.claudeAiOauth.accessToken;
+        _oauthTokenTimestamp["anthropic-oauth"] = Date.now();
+        break;
+      }
+    } catch { /* try next account */ }
+  }
+} catch { /* keychain not accessible at startup (launchd) */ }
+
+// OpenAI/Codex OAuth — read from disk (no keychain needed)
+async function readOpenAIOAuthToken() {
+  const tokenPaths = [
+    path.join(os.homedir(), ".codex", "auth.json"),
+    path.join(os.homedir(), ".local", "share", "opencode", "auth.json"),
+    path.join(os.homedir(), ".codex-auth", "auth.json"),
+  ];
+  for (const p of tokenPaths) {
+    try {
+      const raw = await fs.promises.readFile(p, "utf8");
+      const data = JSON.parse(raw);
+      // Codex CLI chatgpt mode: { tokens: { access_token, refresh_token } }
+      if (data.tokens?.access_token) return data.tokens.access_token;
+      // openai-codex nested entry
+      const entry = data["openai-codex"] || data["codex"] || data["openai"];
+      if (entry?.access) return entry.access;
+      // flat
+      if (data.access_token) return data.access_token;
+      if (data.token) return data.token;
+    } catch { /* try next */ }
+  }
+  return null;
+}
+
+async function refreshOpenAIOAuthToken() {
+  try {
+    const t = await readOpenAIOAuthToken();
+    if (t) {
+      _oauthTokenCache["openai-oauth"] = t;
+      _oauthTokenTimestamp["openai-oauth"] = Date.now();
+    }
+  } catch { /* ignore */ }
+}
+
+// Pre-load OpenAI token at startup
+try {
+  const t = await readOpenAIOAuthToken();
+  if (t) {
+    _oauthTokenCache["openai-oauth"] = t;
+    _oauthTokenTimestamp["openai-oauth"] = Date.now();
+  }
+} catch { /* ignore */ }
+
+function getOAuthTokenCached(providerId) {
+  const cachedAt = _oauthTokenTimestamp[providerId] || 0;
+  const age = Date.now() - cachedAt;
+  // Refresh if token is stale (older than TTL)
+  if (age > OAUTH_TOKEN_TTL_MS) {
+    if (providerId === "anthropic-oauth") refreshAnthropicOAuthToken();
+    else if (providerId === "openai-oauth") refreshOpenAIOAuthToken(); // async, best-effort
+  }
+  return _oauthTokenCache[providerId] || null;
+}
+
 const opencodeBase = process.env.OPENCODE_URL || "http://127.0.0.1:4096";
 
 function resolveCommandPath(bin, extraPaths = []) {
@@ -134,6 +247,7 @@ function resolveCommandPath(bin, extraPaths = []) {
     const out = execSync(`command -v "${candidate.replace(/"/g, '\\"')}"`, {
       stdio: ["ignore", "pipe", "ignore"],
       shell: "/bin/zsh",
+      timeout: 1500,
       env: {
         ...process.env,
         PATH: [
@@ -960,10 +1074,236 @@ Keep the same intent; make it specific enough for a PM to break into small tasks
   return content;
 }
 
+function getRtAuthToken() {
+  try {
+    return readSwarmConfigSafe()?.rt?.authToken || "";
+  } catch {
+    return "";
+  }
+}
+
+function resolvePlannerEngine(preferredEngine = null, preferredModel = null) {
+  if (preferredEngine) {
+    return {
+      engine: preferredEngine,
+      model: preferredModel || null,
+      permissionMode: null,
+      sandbox: preferredEngine === "codex" ? "read-only" : null,
+      source: "request",
+    };
+  }
+
+  const cfg = readSwarmConfigSafe();
+  const agents = Array.isArray(cfg?.agents) ? cfg.agents : [];
+  const pm = agents.find((agent) => agent?.id === "crew-pm") || {};
+
+  if (pm.useClaudeCode) {
+    return {
+      engine: "claude",
+      model: pm.claudeCodeModel || null,
+      // Claude's plan mode can exit 0 with no streamed text for this planner path.
+      // Use the normal direct lane here; the build-planner prompt already forbids edits.
+      permissionMode: null,
+      sandbox: null,
+      source: "crew-pm",
+    };
+  }
+  if (pm.useCodex) {
+    return {
+      engine: "codex",
+      model: pm.codexModel || null,
+      permissionMode: null,
+      sandbox: "read-only",
+      source: "crew-pm",
+    };
+  }
+  if (pm.useCursorCli) {
+    return {
+      engine: "cursor",
+      model: pm.cursorCliModel || null,
+      permissionMode: null,
+      sandbox: null,
+      source: "crew-pm",
+    };
+  }
+  if (pm.useGeminiCli) {
+    return {
+      engine: "gemini",
+      model: pm.geminiCliModel || null,
+      permissionMode: null,
+      sandbox: null,
+      source: "crew-pm",
+    };
+  }
+  if (pm.useCrewCLI) {
+    return {
+      engine: "crew-cli",
+      model: pm.crewCliModel || null,
+      permissionMode: null,
+      sandbox: null,
+      source: "crew-pm",
+    };
+  }
+  if (pm.useOpenCode) {
+    return {
+      engine: "opencode",
+      model: pm.opencodeModel || null,
+      permissionMode: null,
+      sandbox: null,
+      source: "crew-pm",
+    };
+  }
+
+  const fallbacks = [
+    commandExists(process.env.CLAUDE_CODE_BIN || "claude") && { engine: "claude", model: process.env.CREWSWARM_CLAUDE_CODE_MODEL || null, permissionMode: null, sandbox: null, source: "fallback" },
+    commandExists(process.env.CODEX_CLI_BIN || "codex") && { engine: "codex", model: process.env.CREWSWARM_CODEX_MODEL || null, permissionMode: null, sandbox: "read-only", source: "fallback" },
+    commandExists(process.env.CURSOR_CLI_BIN || path.join(os.homedir(), ".local", "bin", "agent"), [path.join(os.homedir(), ".local", "bin", "agent")]) && { engine: "cursor", model: process.env.CREWSWARM_CURSOR_MODEL || process.env.CURSOR_DEFAULT_MODEL || null, permissionMode: null, sandbox: null, source: "fallback" },
+    commandExists(process.env.GEMINI_CLI_BIN || "gemini") && { engine: "gemini", model: process.env.CREWSWARM_GEMINI_CLI_MODEL || null, permissionMode: null, sandbox: null, source: "fallback" },
+    commandExists(process.env.CREWSWARM_OPENCODE_BIN || "opencode") && { engine: "opencode", model: process.env.CREWSWARM_OPENCODE_MODEL || null, permissionMode: null, sandbox: null, source: "fallback" },
+  ].filter(Boolean);
+
+  return fallbacks[0] || null;
+}
+
+function buildRequirementPlanningPrompt(userText, projectDir = null) {
+  return [
+    "You are the planning stage for CrewSwarm's Build tab.",
+    "Transform the user's rough build idea into a concrete build brief that crew-pm can execute.",
+    "If repository context is relevant, inspect the workspace before answering. Do not edit files.",
+    "",
+    "Output format:",
+    "## Build Brief",
+    "A 1-2 paragraph concrete requirement with explicit scope and deliverables.",
+    "",
+    "## Acceptance Criteria",
+    "- 3 to 7 flat bullets",
+    "",
+    "## Constraints / Assumptions",
+    "- Flat bullets only when needed",
+    "",
+    "Rules:",
+    "- Preserve the user's intent; do not invent a different product.",
+    "- Make it specific enough for PM decomposition and agent dispatch.",
+    "- Mention likely subsystems or files only if you have evidence from the repo.",
+    "- Keep it concise and actionable.",
+    "- Do not include implementation code, shell commands, or extra commentary.",
+    projectDir ? `- Current project directory: ${projectDir}` : "",
+    "",
+    "User idea:",
+    userText.trim(),
+  ].filter(Boolean).join("\n");
+}
+
+async function collectClaudePlannerTextDirect({ message, projectDir, model = null }) {
+  const claudeBin = resolveCommandPath(process.env.CLAUDE_CODE_BIN || "claude", [
+    path.join(os.homedir(), ".local", "bin", "claude"),
+    "/usr/local/bin/claude",
+    "/opt/homebrew/bin/claude",
+  ]) || (process.env.CLAUDE_CODE_BIN || "claude");
+  const { execFile } = await import("node:child_process");
+  const { promisify } = await import("node:util");
+  const execFileAsync = promisify(execFile);
+  const args = ["-p"];
+  if (projectDir) args.push("--add-dir", projectDir);
+  if (model) args.push("--model", model);
+  // Match the fixed engine-passthrough Claude invocation:
+  // skip user MCP startup and terminate option parsing before the prompt.
+  args.push(
+    "--strict-mcp-config",
+    "--mcp-config",
+    path.join(os.homedir(), ".crewswarm", "config", "empty-mcp.json"),
+    "--",
+    message,
+  );
+  const { stdout, stderr } = await execFileAsync(claudeBin, args, {
+    cwd: projectDir || process.cwd(),
+    env: process.env,
+    timeout: Number(process.env.CREWSWARM_PLANNER_TIMEOUT_MS || 300000),
+    maxBuffer: 2 * 1024 * 1024,
+  });
+  const trimmed = String(stdout || "").trim();
+  if (trimmed) return trimmed;
+  const stderrText = String(stderr || "").trim();
+  if (stderrText) throw new Error(stderrText);
+  throw new Error("planner produced no output");
+}
+
+async function collectPassthroughText({
+  engine,
+  message,
+  projectDir,
+  model = null,
+  permissionMode = null,
+  sandbox = null,
+  forceL2 = false,
+}) {
+  if (engine === "claude") {
+    return collectClaudePlannerTextDirect({ message, projectDir, model });
+  }
+  const token = getRtAuthToken();
+  const crewLeadPort = process.env.CREW_LEAD_PORT || "5010";
+  let upstream;
+  try {
+    upstream = await fetch(`http://127.0.0.1:${crewLeadPort}/api/engine-passthrough`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        ...(token ? { authorization: `Bearer ${token}` } : {}),
+        "x-passthrough-continue": "false",
+      },
+      body: JSON.stringify({
+        engine,
+        message,
+        projectDir: projectDir || process.cwd(),
+        sessionId: "build-planner",
+        ...(model ? { model } : {}),
+        ...(permissionMode ? { permissionMode } : {}),
+        ...(sandbox ? { sandbox } : {}),
+        ...(forceL2 ? { forceL2: true } : {}),
+      }),
+      signal: AbortSignal.timeout(300_000),
+    });
+  } catch (fetchErr) {
+    throw new Error(`planner fetch failed for ${engine}: ${fetchErr.message}`);
+  }
+
+  if (!upstream.ok) {
+    throw new Error(`planner upstream ${upstream.status}`);
+  }
+
+  let rawSSE;
+  try {
+    rawSSE = await upstream.text();
+  } catch (readErr) {
+    throw new Error(`planner SSE read failed for ${engine}: ${readErr.message}`);
+  }
+  let text = "";
+  let stderr = "";
+  let exitCode = 0;
+
+  for (const line of rawSSE.split("\n")) {
+    if (!line.startsWith("data: ")) continue;
+    try {
+      const ev = JSON.parse(line.slice(6));
+      if (ev.type === "chunk" && ev.text) text += ev.text;
+      else if (ev.type === "stderr" && ev.text) stderr += ev.text;
+      else if (ev.type === "done") exitCode = ev.exitCode ?? 0;
+    } catch {}
+  }
+
+  const trimmed = text.trim();
+  if (!trimmed && stderr.trim()) {
+    throw new Error(stderr.trim());
+  }
+  if (!trimmed) {
+    throw new Error(`planner produced no output${exitCode ? ` (exit ${exitCode})` : ""}`);
+  }
+  return trimmed;
+}
+
 async function getPhasedProgress(limit = 80) {
   const { readFile } = await import("node:fs/promises");
-  const { existsSync } = await import("node:fs");
-  if (!existsSync(phasedDispatchLog)) return [];
+  if (!(await fs.promises.access(phasedDispatchLog).then(() => true, () => false))) return [];
   try {
     const content = await readFile(phasedDispatchLog, "utf8");
     const lines = content.trim().split("\n").filter(Boolean).slice(-limit);
@@ -1116,8 +1456,41 @@ function serveStatic(req, res, filePath) {
   }
 }
 
+/**
+ * Make an HTTP request to crew-lead using http.request with agent:false.
+ * This bypasses Node 25's undici connection pool used by fetch(), which gets
+ * blocked when Chrome SSE EventSource connections saturate the pool.
+ */
+function crewLeadRequest(path, { method = "GET", body = null, timeout = 10000, port } = {}) {
+  const crewPort = port || process.env.CREW_LEAD_PORT || "5010";
+  return new Promise((resolve, reject) => {
+    const options = {
+      hostname: "127.0.0.1",
+      port: parseInt(crewPort, 10),
+      path,
+      method,
+      timeout,
+      agent: false,
+      headers: { "content-type": "application/json", connection: "close" },
+    };
+    const req = http.request(options, (res) => {
+      let d = "";
+      res.on("data", (chunk) => (d += chunk));
+      res.on("end", () => {
+        try { resolve({ ok: res.statusCode < 400, status: res.statusCode, data: JSON.parse(d) }); }
+        catch { resolve({ ok: res.statusCode < 400, status: res.statusCode, data: d }); }
+      });
+    });
+    req.on("error", (err) => reject(err));
+    req.on("timeout", () => { req.destroy(); reject(new Error("crew-lead request timeout")); });
+    if (body) req.write(typeof body === "string" ? body : JSON.stringify(body));
+    req.end();
+  });
+}
+
 const server = http.createServer(async (req, res) => {
   const url = new URL(req.url || "/", `http://localhost:${listenPort}`);
+  const exists = (p) => fs.promises.access(p).then(() => true, () => false);
 
   // CORS: echo local dev Origins so http://localhost:3333 (Vibe) works with http://127.0.0.1:4319
   // (browsers treat hostnames as distinct origins). Non-local callers still get *.
@@ -1173,7 +1546,7 @@ const server = http.createServer(async (req, res) => {
     if (url.pathname === "/crew-chat.html") {
       const chatFile = path.join(CREWSWARM_DIR, "crew-chat.html");
       try {
-        const chatHtml = fs.readFileSync(chatFile, "utf8");
+        const chatHtml = await fs.promises.readFile(chatFile, "utf8");
         res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
         res.end(chatHtml);
       } catch {
@@ -1185,7 +1558,7 @@ const server = http.createServer(async (req, res) => {
     if (url.pathname === "/signup" || url.pathname === "/signup.html") {
       const signupFile = path.join(FRONTEND_SRC, "public", "signup.html");
       try {
-        const signupHtml = fs.readFileSync(signupFile, "utf8");
+        const signupHtml = await fs.promises.readFile(signupFile, "utf8");
         res.writeHead(200, {
           "content-type": "text/html; charset=utf-8",
           "cache-control": "no-store, no-cache, must-revalidate",
@@ -1198,6 +1571,333 @@ const server = http.createServer(async (req, res) => {
       }
       return;
     }
+    // ── Test results API ─────────────────────────────────────────────────────
+    if (url.pathname === "/api/tests/summary" && req.method === "GET") {
+      const resultsDir = path.join(CREWSWARM_DIR, "test-results");
+      const runsDir = path.join(resultsDir, "runs");
+      try {
+        const allRuns = (await fs.promises.readdir(runsDir)).filter(d => /^\d{4}-/.test(d)).sort().reverse();
+        // Collect the last run per suite type (unit, integration, e2e, all)
+        // by inspecting run.json test_command
+        async function detectSuite(runDir) {
+          try {
+            const r = JSON.parse(await fs.promises.readFile(path.join(runDir, "run.json"), "utf8"));
+            const cmd = r.test_command || "";
+            if (cmd.includes("test/e2e/") || cmd.includes("test:e2e")) return "e2e";
+            if (cmd.includes("test/integration/")) return "integration";
+            if (cmd.includes("test/unit/")) {
+              // If it has ONLY unit tests, it's a unit run; if mixed, it's "all"
+              if (cmd.includes("test/integration/") || cmd.includes("test/e2e/")) return "all";
+              return "unit";
+            }
+            // Check file count heuristic: >100 files = probably "all"
+            const fileCount = (cmd.match(/\.test\.mjs/g) || []).length;
+            if (fileCount > 100) return "all";
+            if (fileCount > 15) return "unit";
+            return "unknown";
+          } catch { return "unknown"; }
+        }
+        async function readRunData(runId) {
+          const runDir = path.join(runsDir, runId);
+          const summaryFile = path.join(runDir, "summary.json");
+          let data;
+          if (await exists(summaryFile)) {
+            data = JSON.parse(await fs.promises.readFile(summaryFile, "utf8"));
+          } else {
+            // Fall back to .last-run.json if this is the matching run
+            const lastRunFile = path.join(resultsDir, ".last-run.json");
+            try {
+              const lr = JSON.parse(await fs.promises.readFile(lastRunFile, "utf8"));
+              if (lr.runId === runId) { data = lr; }
+            } catch {}
+          }
+          if (!data) {
+            // Fall back to counting test artifact dirs + failure.json presence
+            let timestamp = null;
+            try { const r = JSON.parse(await fs.promises.readFile(path.join(runDir, "run.json"), "utf8")); timestamp = r.timestamp; } catch {}
+            const ents = await fs.promises.readdir(runDir);
+            const testDirs = ents.filter(e => !e.endsWith(".json") && !e.startsWith("."));
+            let failed = 0;
+            for (const td of testDirs) { if (await exists(path.join(runDir, td, "failure.json"))) failed++; }
+            data = { runId, timestamp, passed: testDirs.length - failed, failed, skipped: 0, total: testDirs.length, duration_ms: 0 };
+          }
+          data.runId = runId;
+          data.suite = await detectSuite(runDir);
+          // Read failures and skips if available
+          const failFile = path.join(runDir, "failures.json");
+          const skipFile = path.join(runDir, "skips.json");
+          let failures = [];
+          let skips = [];
+          try { failures = JSON.parse(await fs.promises.readFile(failFile, "utf8")); } catch {}
+          try { skips = JSON.parse(await fs.promises.readFile(skipFile, "utf8")); } catch {}
+          data.failures = failures.map(f => ({
+            name: f.name || f.testId || "",
+            file: (f.file_fingerprint?.relative_file || f.file || "").replace(CREWSWARM_DIR + "/", ""),
+            error: typeof f.error === "string" ? f.error : (f.error?.message || f.error?.failureType || JSON.stringify(f.error || "").slice(0, 300)),
+            classification: f.classification || "unknown",
+            rerun_command: f.rerun_command || f.selector?.command || "",
+          }));
+          data.skips = skips.map(s => ({
+            name: s.name || s.testId || "",
+            file: (s.file_fingerprint?.relative_file || s.file || "").replace(CREWSWARM_DIR + "/", ""),
+          }));
+          return data;
+        }
+        // Find latest run for each suite type
+        const suiteRuns = {};
+        let latestOverall = null;
+        for (const runId of allRuns) {
+          if (Object.keys(suiteRuns).length >= 4 && latestOverall) break;
+          try {
+            const runDir = path.join(runsDir, runId);
+            const suite = await detectSuite(runDir);
+            if (!latestOverall) latestOverall = runId;
+            if (!suiteRuns[suite]) suiteRuns[suite] = runId;
+          } catch {}
+        }
+        // Build per-suite summaries
+        const suites = {};
+        for (const [suite, runId] of Object.entries(suiteRuns)) {
+          try { suites[suite] = await readRunData(runId); } catch { /* skip broken runs */ }
+        }
+        // Count test files on disk for reference
+        const testFileDir = path.join(CREWSWARM_DIR, "test");
+        const testsE2eDir = path.join(CREWSWARM_DIR, "tests", "e2e");
+        const crewCliTestDir = path.join(CREWSWARM_DIR, "crew-cli", "tests");
+        const crewCliTestDir2 = path.join(CREWSWARM_DIR, "crew-cli", "test");
+        let unitFiles = 0, intFiles = 0, e2eFiles = 0, playwrightFiles = 0, crewCliFiles = 0, rootFiles = 0;
+        try { unitFiles = (await fs.promises.readdir(path.join(testFileDir, "unit"))).filter(f => f.endsWith(".test.mjs")).length; } catch {}
+        try { intFiles = (await fs.promises.readdir(path.join(testFileDir, "integration"))).filter(f => f.endsWith(".test.mjs")).length; } catch {}
+        try { e2eFiles = (await fs.promises.readdir(path.join(testFileDir, "e2e"))).filter(f => f.endsWith(".test.mjs")).length; } catch {}
+        try { playwrightFiles = (await fs.promises.readdir(testsE2eDir)).filter(f => f.endsWith(".spec.js")).length; } catch {}
+        try { rootFiles = (await fs.promises.readdir(testFileDir)).filter(f => f.match(/\.test\./)).length; } catch {}
+        // crew-cli: tests/unit/*.test.js + tests/*.test.js + test/*.test.ts
+        try {
+          const unitDir = path.join(crewCliTestDir, "unit");
+          crewCliFiles += (await fs.promises.readdir(unitDir)).filter(f => f.match(/\.test\./)).length;
+        } catch {}
+        try { crewCliFiles += (await fs.promises.readdir(crewCliTestDir)).filter(f => f.match(/\.test\./)).length; } catch {}
+        try { crewCliFiles += (await fs.promises.readdir(crewCliTestDir2)).filter(f => f.match(/\.test\./)).length; } catch {}
+        // Remove "unknown" suite if it has no data
+        if (suites.unknown && (!suites.unknown.total || suites.unknown.total === 0)) delete suites.unknown;
+        let latest = null;
+        try { if (latestOverall) latest = await readRunData(latestOverall); } catch {}
+        // Count actual test()/it() calls in source files (ground truth)
+        async function countTestCalls(dir, pattern) {
+          let count = 0;
+          try {
+            const files = (await fs.promises.readdir(dir)).filter(f => f.match(pattern));
+            for (const f of files) {
+              const src = await fs.promises.readFile(path.join(dir, f), "utf8");
+              const matches = src.match(/^\s*(test|it)\s*\(/gm);
+              if (matches) count += matches.length;
+            }
+          } catch {}
+          return count;
+        }
+        async function countTestCallsRecursive(dir) {
+          let count = 0;
+          try {
+            for (const ent of await fs.promises.readdir(dir, { withFileTypes: true })) {
+              if (ent.isDirectory()) { count += countTestCallsRecursive(path.join(dir, ent.name)); continue; }
+              if (!ent.name.match(/\.test\./)) continue;
+              const src = await fs.promises.readFile(path.join(dir, ent.name), "utf8");
+              const matches = src.match(/^\s*(test|it)\s*\(/gm);
+              if (matches) count += matches.length;
+            }
+          } catch {}
+          return count;
+        }
+        const testCounts = {
+          unit: countTestCalls(path.join(testFileDir, "unit"), /\.test\.mjs$/),
+          integration: countTestCalls(path.join(testFileDir, "integration"), /\.test\.mjs$/),
+          e2e: countTestCalls(path.join(testFileDir, "e2e"), /\.test\.mjs$/),
+          playwright: countTestCalls(testsE2eDir, /\.spec\.js$/),
+          "crew-cli": countTestCallsRecursive(crewCliTestDir) + countTestCallsRecursive(crewCliTestDir2),
+          root: countTestCalls(testFileDir, /\.test\./),
+        };
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify({
+          latest,
+          suites,
+          fileCounts: { unit: unitFiles, integration: intFiles, e2e: e2eFiles, playwright: playwrightFiles, "crew-cli": crewCliFiles, root: rootFiles, total: unitFiles + intFiles + e2eFiles + playwrightFiles + crewCliFiles + rootFiles },
+          testCounts,
+        }));
+      } catch (e) {
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify({ latest: null, suites: {}, fileCounts: {}, error: e.message }));
+      }
+      return;
+    }
+    if (url.pathname === "/api/tests/history" && req.method === "GET") {
+      const resultsDir = path.join(CREWSWARM_DIR, "test-results");
+      const runsDir = path.join(resultsDir, "runs");
+      try {
+        const dirs = (await fs.promises.readdir(runsDir)).filter(d => /^\d{4}-/.test(d)).sort().reverse().slice(0, 40);
+        const history = [];
+        for (const d of dirs) {
+          const runDir = path.join(runsDir, d);
+          try {
+            let entry = null;
+            // Prefer summary.json (has all data)
+            const summaryFile = path.join(runDir, "summary.json");
+            if (await exists(summaryFile)) {
+              const s = JSON.parse(await fs.promises.readFile(summaryFile, "utf8"));
+              entry = { runId: d, timestamp: s.timestamp, status: s.status || (s.failed > 0 ? "failed" : "passed"), passed: s.passed || 0, failed: s.failed || 0, skipped: s.skipped || 0, total: s.total || 0, duration_ms: s.duration_ms || 0 };
+            } else {
+              const runMeta = JSON.parse(await fs.promises.readFile(path.join(runDir, "run.json"), "utf8"));
+              const ents = await fs.promises.readdir(runDir);
+              const testDirs = ents.filter(e => !e.endsWith(".json") && !e.startsWith("."));
+              let failed = 0;
+              for (const td of testDirs) { if (await exists(path.join(runDir, td, "failure.json"))) failed++; }
+              entry = { runId: d, timestamp: runMeta.timestamp, status: failed > 0 ? "failed" : "passed", passed: testDirs.length - failed, failed, skipped: 0, total: testDirs.length, duration_ms: 0 };
+            }
+            // Detect suite from test_command
+            try {
+              const r = JSON.parse(await fs.promises.readFile(path.join(runDir, "run.json"), "utf8"));
+              const cmd = r.test_command || "";
+              if (cmd.includes("test/e2e/")) entry.suite = "e2e";
+              else if (cmd.includes("test/integration/")) entry.suite = "integration";
+              else if (cmd.includes("test/unit/") && !cmd.includes("test/integration/")) entry.suite = "unit";
+              else { const fc = (cmd.match(/\.test\.mjs/g) || []).length; entry.suite = fc > 100 ? "all" : fc > 15 ? "unit" : "unknown"; }
+            } catch { entry.suite = "unknown"; }
+            history.push(entry);
+          } catch { /* skip */ }
+        }
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify({ history }));
+      } catch (e) {
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify({ history: [], error: e.message }));
+      }
+      return;
+    }
+    if (url.pathname === "/api/tests/run-detail" && req.method === "GET") {
+      const resultsDir = path.join(CREWSWARM_DIR, "test-results");
+      const runsDir = path.join(resultsDir, "runs");
+      const runId = url.searchParams.get("runId");
+      if (!runId) { res.writeHead(400, { "content-type": "application/json" }); res.end(JSON.stringify({ error: "Missing runId" })); return; }
+      try {
+        const runDir = path.join(runsDir, runId);
+        // Get timestamp from run.json
+        let timestamp = null;
+        try { const r = JSON.parse(await fs.promises.readFile(path.join(runDir, "run.json"), "utf8")); timestamp = r.timestamp; } catch {}
+        // Try summary.json for totals
+        let passed = 0, failed = 0, skipped = 0, total = 0, duration_ms = 0;
+        const summaryFile = path.join(runDir, "summary.json");
+        if (await exists(summaryFile)) {
+          const s = JSON.parse(await fs.promises.readFile(summaryFile, "utf8"));
+          passed = s.passed || 0; failed = s.failed || 0; skipped = s.skipped || 0; total = s.total || 0; duration_ms = s.duration_ms || 0;
+          if (!timestamp) timestamp = s.timestamp;
+        }
+        // If no summary, count from test artifact dirs
+        if (total === 0) {
+          const ents = await fs.promises.readdir(runDir);
+          const testDirs = ents.filter(e => !e.endsWith(".json") && !e.startsWith("."));
+          for (const td of testDirs) {
+            total++;
+            if (await exists(path.join(runDir, td, "failure.json"))) failed++;
+            else passed++;
+          }
+        }
+        // Read failures.json and skips.json
+        let failures = [], skips = [];
+        try { failures = JSON.parse(await fs.promises.readFile(path.join(runDir, "failures.json"), "utf8")); } catch {}
+        try { skips = JSON.parse(await fs.promises.readFile(path.join(runDir, "skips.json"), "utf8")); } catch {}
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify({
+          runId, timestamp, passed, failed, skipped, total, duration_ms,
+          failures: failures.map(f => {
+            let err = f.error;
+            if (typeof err === "object" && err !== null) err = err.message || err.failureType || JSON.stringify(err).slice(0, 300);
+            return {
+              name: f.name || f.testId || "", file: (f.file_fingerprint?.relative_file || f.file || "").replace(CREWSWARM_DIR + "/", ""),
+              error: String(err || ""),
+              rerun_command: f.rerun_command || f.selector?.command || "",
+            };
+          }),
+          skips: skips.map(s => ({
+            name: s.name || s.testId || "", file: (s.file_fingerprint?.relative_file || s.file || "").replace(CREWSWARM_DIR + "/", ""),
+          })),
+        }));
+      } catch (e) {
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify({ error: e.message }));
+      }
+      return;
+    }
+    if (url.pathname === "/api/tests/run" && req.method === "POST") {
+      let body = "";
+      req.on("data", (c) => (body += c));
+      req.on("end", async () => {
+        let suite = "test:unit";
+        try { const parsed = JSON.parse(body); suite = parsed.suite || suite; } catch { /* default */ }
+        const allowed = ["test:unit", "test:integration", "test:e2e", "test:all", "test", "test:e2e:vibe"];
+        if (!allowed.includes(suite)) {
+          res.writeHead(400, { "content-type": "application/json" });
+          res.end(JSON.stringify({ error: "Invalid suite: " + suite }));
+          return;
+        }
+        const { spawn } = await import("node:child_process");
+        const progressFile = path.join(CREWSWARM_DIR, "test-results", ".test-progress.json");
+        const outputFile = path.join(CREWSWARM_DIR, "test-results", ".test-output.log");
+        // Write initial progress
+        await fs.promises.writeFile(progressFile, JSON.stringify({ suite, running: true, pid: 0, started: Date.now(), passed: 0, failed: 0, skipped: 0, files_done: 0, current_file: "" }));
+        const outFd = fs.openSync(outputFile, "w");
+        const child = spawn("npm", ["run", suite], { cwd: CREWSWARM_DIR, stdio: ["ignore", outFd, outFd], detached: true });
+        child.unref();
+        fs.closeSync(outFd);
+        // Update progress by tailing the output file
+        const progressInterval = setInterval(() => {
+          try {
+            const out = fs.readFileSync(outputFile, "utf8");
+            const lines = out.split("\n");
+            let passed = 0, failed = 0, skipped = 0, files_done = 0, current_file = "";
+            for (const line of lines) {
+              if (line.startsWith("  ✓ ")) passed++;
+              else if (line.startsWith("  ✗ ")) failed++;
+              else if (line.includes("(skipped)")) skipped++;
+              else if (line.endsWith(".test.mjs") || line.endsWith(".test.ts") || line.endsWith(".test.js")) {
+                files_done++;
+                current_file = line.trim();
+              }
+            }
+            fs.writeFileSync(progressFile, JSON.stringify({ suite, running: true, pid: child.pid, started: JSON.parse(fs.readFileSync(progressFile, "utf8")).started, passed, failed, skipped, files_done, current_file }));
+          } catch { /* file may not exist yet */ }
+        }, 2000);
+        child.on("exit", (code) => {
+          clearInterval(progressInterval);
+          try {
+            const out = fs.readFileSync(outputFile, "utf8");
+            const lines = out.split("\n");
+            let passed = 0, failed = 0, skipped = 0, files_done = 0;
+            for (const line of lines) {
+              if (line.startsWith("  ✓ ")) passed++;
+              else if (line.startsWith("  ✗ ")) failed++;
+              else if (line.includes("(skipped)")) skipped++;
+              else if (line.endsWith(".test.mjs") || line.endsWith(".test.ts") || line.endsWith(".test.js")) files_done++;
+            }
+            fs.writeFileSync(progressFile, JSON.stringify({ suite, running: false, pid: child.pid, started: JSON.parse(fs.readFileSync(progressFile, "utf8")).started, finished: Date.now(), exitCode: code, passed, failed, skipped, files_done, current_file: "" }));
+          } catch {}
+        });
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify({ started: true, suite, pid: child.pid }));
+      });
+      return;
+    }
+    if (url.pathname === "/api/tests/progress" && req.method === "GET") {
+      const progressFile = path.join(CREWSWARM_DIR, "test-results", ".test-progress.json");
+      try {
+        const data = JSON.parse(await fs.promises.readFile(progressFile, "utf8"));
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify(data));
+      } catch {
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify({ running: false }));
+      }
+      return;
+    }
+
     // ── First-run detection ──────────────────────────────────────────────────
     if (url.pathname === "/api/first-run-status" && req.method === "GET") {
       const cfg = readSwarmConfigSafe();
@@ -1221,16 +1921,11 @@ const server = http.createServer(async (req, res) => {
 
       const hasApiKeys = configuredProviders.length > 0;
 
-      // Check crew-lead health
+      // Check crew-lead health (uses http.request, not fetch — avoids undici pool saturation from SSE)
       let crewLeadUp = false;
       try {
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), 2000);
-        const resp = await fetch("http://127.0.0.1:5010/health", {
-          signal: controller.signal,
-        });
-        clearTimeout(timer);
-        crewLeadUp = resp.ok;
+        const { ok } = await crewLeadRequest("/health", { timeout: 2000 });
+        crewLeadUp = ok;
       } catch {
         crewLeadUp = false;
       }
@@ -1280,11 +1975,11 @@ const server = http.createServer(async (req, res) => {
       const engine = String(url.searchParams.get("engine") || "opencode").trim();
       const limit = Math.min(Number(url.searchParams.get("limit") || "20"), 50);
       const projectId = String(url.searchParams.get("projectId") || "").trim();
-      const projectDir = (() => {
+      const projectDir = await (async () => {
         if (!projectId || projectId === "general") return "";
         try {
           const registryFile = path.join(CFG_DIR, "projects.json");
-          const projects = JSON.parse(fs.readFileSync(registryFile, "utf8"));
+          const projects = JSON.parse(await fs.promises.readFile(registryFile, "utf8"));
           return String(projects?.[projectId]?.outputDir || "").trim();
         } catch {
           return "";
@@ -1333,19 +2028,18 @@ const server = http.createServer(async (req, res) => {
       const limit = Math.min(Number(url.searchParams.get("limit") || "20"), 50);
       const sessionsBase = path.join(os.homedir(), ".codex", "sessions");
       const sessions = [];
-      if (fs.existsSync(sessionsBase)) {
-        const years = fs.readdirSync(sessionsBase).filter(d => /^\d{4}$/.test(d));
+      if (await exists(sessionsBase)) {
+        const years = (await fs.promises.readdir(sessionsBase)).filter(d => /^\d{4}$/.test(d));
         for (const year of years.sort().reverse()) {
           const yearDir = path.join(sessionsBase, year);
-          const months = fs.readdirSync(yearDir).filter(d => /^\d{2}$/.test(d));
+          const months = (await fs.promises.readdir(yearDir)).filter(d => /^\d{2}$/.test(d));
           for (const month of months.sort().reverse()) {
             const monthDir = path.join(yearDir, month);
-            const days = fs.readdirSync(monthDir).filter(d => /^\d{2}$/.test(d));
+            const days = (await fs.promises.readdir(monthDir)).filter(d => /^\d{2}$/.test(d));
             for (const day of days.sort().reverse()) {
               const dayDir = path.join(yearDir, month, day);
-              const files = fs.readdirSync(dayDir)
-                .filter(f => f.endsWith(".jsonl"))
-                .map(f => ({ f, mt: fs.statSync(path.join(dayDir, f)).mtimeMs }))
+              const rawFiles = (await fs.promises.readdir(dayDir)).filter(f => f.endsWith(".jsonl"));
+              const files = (await Promise.all(rawFiles.map(async f => ({ f, mt: (await fs.promises.stat(path.join(dayDir, f))).mtimeMs }))))
                 .sort((a, b) => b.mt - a.mt);
               for (const { f } of files) {
                 if (sessions.length >= limit) break;
@@ -1353,7 +2047,7 @@ const server = http.createServer(async (req, res) => {
                 const filePath = path.join(dayDir, f);
 
                 // Skip files larger than 10MB to avoid memory issues
-                const stats = fs.statSync(filePath);
+                const stats = await fs.promises.stat(filePath);
                 if (stats.size > 10 * 1024 * 1024) {
                   sessions.push({
                     id: sessionId,
@@ -1365,7 +2059,7 @@ const server = http.createServer(async (req, res) => {
                 }
 
                 const messages = [];
-                const allLines = fs.readFileSync(filePath, "utf8").trim().split("\n");
+                const allLines = (await fs.promises.readFile(filePath, "utf8")).trim().split("\n");
                 const lines = allLines.slice(-100); // Last 100 lines only
                 let firstUserMsg = "";
                 for (const line of lines) {
@@ -1405,22 +2099,21 @@ const server = http.createServer(async (req, res) => {
       const qDir = url.searchParams.get("dir") || process.cwd();
       const dirKey = qDir.replace(/\//g, "-");
       const projectsBase = path.join(os.homedir(), ".claude", "projects");
-      const candidates = fs.existsSync(projectsBase)
-        ? fs.readdirSync(projectsBase).filter(d => d === dirKey || d.endsWith(dirKey.split("-").slice(-2).join("-")))
+      const candidates = await exists(projectsBase)
+        ? (await fs.promises.readdir(projectsBase)).filter(d => d === dirKey || d.endsWith(dirKey.split("-").slice(-2).join("-")))
         : [];
       const sessions = [];
       for (const cand of candidates) {
         const sessDir = path.join(projectsBase, cand);
-        const files = fs.readdirSync(sessDir)
-          .filter(f => f.endsWith(".jsonl"))
-          .map(f => ({ f, mt: fs.statSync(path.join(sessDir, f)).mtimeMs }))
+        const rawSessFiles = (await fs.promises.readdir(sessDir)).filter(f => f.endsWith(".jsonl"));
+        const files = (await Promise.all(rawSessFiles.map(async f => ({ f, mt: (await fs.promises.stat(path.join(sessDir, f))).mtimeMs }))))
           .sort((a, b) => b.mt - a.mt)
           .slice(0, limit)
           .map(x => x.f);
         for (const file of files) {
           const sessionId = file.replace(".jsonl", "");
           const messages = [];
-          const lines = fs.readFileSync(path.join(sessDir, file), "utf8").trim().split("\n");
+          const lines = (await fs.promises.readFile(path.join(sessDir, file), "utf8")).trim().split("\n");
           for (const line of lines) {
             try {
               const d = JSON.parse(line);
@@ -1444,13 +2137,13 @@ const server = http.createServer(async (req, res) => {
       const limit = Math.min(Number(url.searchParams.get("limit") || "20"), 50);
       const historyBase = path.join(os.homedir(), ".gemini", "history");
       const sessions = [];
-      if (fs.existsSync(historyBase)) {
-        const projects = fs.readdirSync(historyBase);
+      if (await exists(historyBase)) {
+        const projects = await fs.promises.readdir(historyBase);
         for (const proj of projects) {
           const sessionFile = path.join(historyBase, proj, "session.jsonl");
-          if (fs.existsSync(sessionFile)) {
+          if (await exists(sessionFile)) {
             const messages = [];
-            const lines = fs.readFileSync(sessionFile, "utf8").trim().split("\n");
+            const lines = (await fs.promises.readFile(sessionFile, "utf8")).trim().split("\n");
             let firstUserMsg = "";
             for (const line of lines) {
               try {
@@ -1464,7 +2157,7 @@ const server = http.createServer(async (req, res) => {
               } catch { }
             }
             if (messages.length) {
-              const stat = fs.statSync(sessionFile);
+              const stat = await fs.promises.stat(sessionFile);
               sessions.push({
                 id: proj,
                 title: firstUserMsg || proj,
@@ -1486,33 +2179,32 @@ const server = http.createServer(async (req, res) => {
       const limit = Math.min(Number(url.searchParams.get("limit") || "20"), 50);
       const sessionsBase = path.join(process.cwd(), ".crew", "sessions");
       const sessions = [];
-      if (fs.existsSync(sessionsBase)) {
-        const engines = fs.readdirSync(sessionsBase);
+      if (await exists(sessionsBase)) {
+        const engines = await fs.promises.readdir(sessionsBase);
         for (const engine of engines) {
           const engineDir = path.join(sessionsBase, engine);
-          const projects = fs.readdirSync(engineDir);
+          const projects = await fs.promises.readdir(engineDir);
           for (const project of projects) {
             const projectSessionsDir = path.join(engineDir, project, "sessions");
-            if (!fs.existsSync(projectSessionsDir)) continue;
-            const years = fs.readdirSync(projectSessionsDir).filter(d => /^\d{4}$/.test(d));
+            if (!await exists(projectSessionsDir)) continue;
+            const years = (await fs.promises.readdir(projectSessionsDir)).filter(d => /^\d{4}$/.test(d));
             for (const year of years.sort().reverse()) {
               const yearDir = path.join(projectSessionsDir, year);
-              const months = fs.readdirSync(yearDir).filter(d => /^\d{2}$/.test(d));
+              const months = (await fs.promises.readdir(yearDir)).filter(d => /^\d{2}$/.test(d));
               for (const month of months.sort().reverse()) {
                 const monthDir = path.join(yearDir, month);
-                const days = fs.readdirSync(monthDir).filter(d => /^\d{2}$/.test(d));
+                const days = (await fs.promises.readdir(monthDir)).filter(d => /^\d{2}$/.test(d));
                 for (const day of days.sort().reverse()) {
                   const dayDir = path.join(yearDir, month, day);
-                  const files = fs.readdirSync(dayDir)
-                    .filter(f => f.endsWith(".jsonl"))
-                    .map(f => ({ f, mt: fs.statSync(path.join(dayDir, f)).mtimeMs }))
+                  const rawDayFiles = (await fs.promises.readdir(dayDir)).filter(f => f.endsWith(".jsonl"));
+                  const files = (await Promise.all(rawDayFiles.map(async f => ({ f, mt: (await fs.promises.stat(path.join(dayDir, f))).mtimeMs }))))
                     .sort((a, b) => b.mt - a.mt);
                   for (const { f } of files) {
                     if (sessions.length >= limit) break;
                     const sessionId = f.replace(".jsonl", "");
                     const messages = [];
                     // Limit to last 100 lines to avoid huge session files
-                    const allLines = fs.readFileSync(path.join(dayDir, f), "utf8").trim().split("\n");
+                    const allLines = (await fs.promises.readFile(path.join(dayDir, f), "utf8")).trim().split("\n");
                     const lines = allLines.slice(-100);
                     let firstUserMsg = "";
                     for (const line of lines) {
@@ -1588,8 +2280,8 @@ const server = http.createServer(async (req, res) => {
             "passthrough-sessions.json",
           );
           let sessions = {};
-          if (fs.existsSync(sessionFile)) {
-            sessions = JSON.parse(fs.readFileSync(sessionFile, "utf8"));
+          if (await exists(sessionFile)) {
+            sessions = JSON.parse(await fs.promises.readFile(sessionFile, "utf8"));
           }
           res.writeHead(200, { "content-type": "application/json" });
           res.end(JSON.stringify({ sessions }));
@@ -1613,11 +2305,11 @@ const server = http.createServer(async (req, res) => {
             "passthrough-sessions.json",
           );
           let sessions = {};
-          if (fs.existsSync(sessionFile)) {
-            sessions = JSON.parse(fs.readFileSync(sessionFile, "utf8"));
+          if (await exists(sessionFile)) {
+            sessions = JSON.parse(await fs.promises.readFile(sessionFile, "utf8"));
           }
           delete sessions[key];
-          fs.writeFileSync(
+          await fs.promises.writeFile(
             sessionFile,
             JSON.stringify(sessions, null, 2),
             "utf8",
@@ -1641,7 +2333,7 @@ const server = http.createServer(async (req, res) => {
       );
       let usage = { calls: 0, prompt: 0, completion: 0, byModel: {} };
       try {
-        usage = JSON.parse(fs.readFileSync(usageFile, "utf8"));
+        usage = JSON.parse(await fs.promises.readFile(usageFile, "utf8"));
       } catch { }
       res.writeHead(200, { "content-type": "application/json" });
       res.end(JSON.stringify(usage));
@@ -1738,13 +2430,12 @@ const server = http.createServer(async (req, res) => {
       const histDir = path.join(os.homedir(), ".crewswarm", "chat-history");
       const sessions = [];
       try {
-        const files = fs
-          .readdirSync(histDir)
+        const files = (await fs.promises.readdir(histDir))
           .filter((f) => f.startsWith("telegram-") && f.endsWith(".jsonl"));
         for (const file of files) {
           const chatId = file.replace(/^telegram-/, "").replace(/\.jsonl$/, "");
-          const lines = fs
-            .readFileSync(path.join(histDir, file), "utf8")
+          const lines = (await fs.promises
+            .readFile(path.join(histDir, file), "utf8"))
             .split("\n")
             .filter(Boolean);
           const msgs = lines
@@ -1770,7 +2461,7 @@ const server = http.createServer(async (req, res) => {
       return;
     }
 
-    if ((url.pathname === "/health" || url.pathname === "/api/health") && req.method === "GET") {
+    if (url.pathname === "/health" && req.method === "GET") {
       res.writeHead(200, { "content-type": "application/json" });
       res.end(JSON.stringify({ ok: true, uptime: Math.round(process.uptime()) }));
       return;
@@ -1849,7 +2540,7 @@ const server = http.createServer(async (req, res) => {
       // Credential keys are never exposed here
       let cfgEnv = {};
       try {
-        cfgEnv = JSON.parse(fs.readFileSync(CFG_FILE, "utf8")).env || {};
+        cfgEnv = JSON.parse(await fs.promises.readFile(CFG_FILE, "utf8")).env || {};
       } catch { }
       const result = {};
       for (const v of vars) {
@@ -1875,9 +2566,9 @@ const server = http.createServer(async (req, res) => {
       }
       const cfgPath = path.join(os.homedir(), ".crewswarm", "crewswarm.json");
       try {
-        const raw = (() => {
+        const raw = await (async () => {
           try {
-            return fs.readFileSync(cfgPath, "utf8");
+            return await fs.promises.readFile(cfgPath, "utf8");
           } catch {
             return "{}";
           }
@@ -1908,7 +2599,7 @@ const server = http.createServer(async (req, res) => {
       return;
     }
 
-    // ── Auth Token (for Studio) ───────────────────────────────────────────────────
+    // ── Auth Token (for Vibe) ─────────────────────────────────────────────────────
     if (url.pathname === "/api/auth/token") {
       res.writeHead(200, {
         "content-type": "application/json",
@@ -2070,7 +2761,7 @@ const server = http.createServer(async (req, res) => {
 
       try {
         // Load agent config
-        const csSwarm = JSON.parse(fs.readFileSync(CFG_FILE, "utf8"));
+        const csSwarm = JSON.parse(await fs.promises.readFile(CFG_FILE, "utf8"));
         const agentCfg = csSwarm.agents?.find((a) => a.id === agentId);
         if (!agentCfg?.model) {
           res.writeHead(404, { "content-type": "application/json" });
@@ -2103,7 +2794,7 @@ const server = http.createServer(async (req, res) => {
         let systemPrompt = `You are ${agentId}.`;
         try {
           const agentPrompts = JSON.parse(
-            fs.readFileSync(agentPromptsPath, "utf8"),
+            await fs.promises.readFile(agentPromptsPath, "utf8"),
           );
           const bareId = agentId.replace(/^crew-/, "");
           systemPrompt =
@@ -2295,14 +2986,14 @@ const server = http.createServer(async (req, res) => {
       );
 
       try {
-        if (!fs.existsSync(historyPath)) {
+        if (!await exists(historyPath)) {
           res.writeHead(200, { "content-type": "application/json" });
           res.end(JSON.stringify({ history: [] }));
           return;
         }
 
-        const lines = fs
-          .readFileSync(historyPath, "utf8")
+        const lines = (await fs.promises
+          .readFile(historyPath, "utf8"))
           .split("\n")
           .filter(Boolean);
         const history = lines.map((line) => JSON.parse(line));
@@ -2335,24 +3026,76 @@ const server = http.createServer(async (req, res) => {
     if (url.pathname === "/api/enhance-prompt" && req.method === "POST") {
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { text } = JSON.parse(body || "{}");
-      if (!text || typeof text !== "string") {
+      let parsed;
+      try { parsed = JSON.parse(body || "{}"); } catch {
         res.writeHead(400, { "content-type": "application/json" });
-        res.end(JSON.stringify({ error: "missing text" }));
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
         return;
       }
+      const vr = validate(EnhancePromptSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { text, projectId, engine: requestedEngine, model: requestedModel } = vr.data;
       try {
-        const enhanced = await enhancePromptWithGroq(text);
+        // Default to cwd for planner context — engines need repo access to produce aware briefs.
+        // Claude/Cursor/Codex use --add-dir for safe read access; crew-cli uses --project.
+        // Fall back to temp dir only if no project context is available.
+        let projectDir = process.cwd();
+        if (projectId) {
+          const regPath = path.join(CFG_DIR, "projects.json");
+          if (await exists(regPath)) {
+            const reg = JSON.parse(await fs.promises.readFile(regPath, "utf8") || "{}");
+            const proj = reg[projectId];
+            if (proj?.outputDir) projectDir = proj.outputDir;
+          }
+        }
+        await fs.promises.mkdir(projectDir, { recursive: true });
+
+        const planner = resolvePlannerEngine(requestedEngine, requestedModel);
+        if (!planner) throw new Error("No planning engine is configured or installed");
+
+        const planned = await collectPassthroughText({
+          engine: planner.engine,
+          message: buildRequirementPlanningPrompt(text, projectDir),
+          projectDir,
+          model: planner.model,
+          permissionMode: planner.permissionMode,
+          sandbox: planner.sandbox,
+          forceL2: planner.engine === "crew-cli",
+        });
+
         res.writeHead(200, { "content-type": "application/json" });
-        res.end(JSON.stringify({ enhanced }));
+        res.end(JSON.stringify({
+          enhanced: planned,
+          engine: planner.engine,
+          model: planner.model,
+          mode: planner.permissionMode || planner.sandbox || "prompt",
+          source: planner.source,
+        }));
       } catch (err) {
-        res.writeHead(200, { "content-type": "application/json" });
-        res.end(
-          JSON.stringify({
-            error: err?.message || String(err),
-            enhanced: null,
-          }),
-        );
+        try {
+          const enhanced = await enhancePromptWithGroq(text);
+          res.writeHead(200, { "content-type": "application/json" });
+          res.end(JSON.stringify({
+            enhanced,
+            engine: "groq",
+            model: "llama-3.3-70b-versatile",
+            mode: "fallback-rewrite",
+            source: "fallback",
+            warning: err?.message || String(err),
+          }));
+        } catch (fallbackErr) {
+          res.writeHead(200, { "content-type": "application/json" });
+          res.end(
+            JSON.stringify({
+              error: fallbackErr?.message || err?.message || String(fallbackErr || err),
+              enhanced: null,
+            }),
+          );
+        }
       }
       return;
     }
@@ -2375,13 +3118,12 @@ const server = http.createServer(async (req, res) => {
       // Resolve project output dir if projectId provided
       let projectEnv = {};
       if (projectId) {
-        const { existsSync: ex } = await import("node:fs");
         const { readFile: rf } = await import("node:fs/promises");
         const regPath = path.join(
           CFG_DIR,
           "projects.json",
         );
-        if (ex(regPath)) {
+        if (await exists(regPath)) {
           const reg = JSON.parse(await rf(regPath, "utf8").catch(() => "{}"));
           const proj = reg[projectId];
           if (proj) {
@@ -2397,8 +3139,7 @@ const server = http.createServer(async (req, res) => {
         }
       }
       const { spawn } = await import("node:child_process");
-      const { existsSync } = await import("node:fs");
-      if (!existsSync(phasedOrchestrator))
+      if (!(await exists(phasedOrchestrator)))
         throw new Error(
           "phased-orchestrator.mjs not found at " + phasedOrchestrator,
         );
@@ -2442,10 +3183,10 @@ const server = http.createServer(async (req, res) => {
         projectId ? "phased-" + projectId + ".pid" : "phased-orchestrator.pid",
       );
       try {
-        const pidStr = fs.readFileSync(pidFile, "utf8").trim();
+        const pidStr = (await fs.promises.readFile(pidFile, "utf8")).trim();
         const pid = parseInt(pidStr, 10);
         if (pid) process.kill(pid, "SIGTERM");
-        fs.unlinkSync(pidFile);
+        await fs.promises.unlink(pidFile);
         res.writeHead(200, { "content-type": "application/json" });
         res.end(JSON.stringify({ ok: true, pid }));
       } catch (e) {
@@ -2457,18 +3198,27 @@ const server = http.createServer(async (req, res) => {
     if (url.pathname === "/api/continuous-build" && req.method === "POST") {
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { requirement, projectId } = JSON.parse(body || "{}");
-      if (!requirement || typeof requirement !== "string")
-        throw new Error("missing requirement");
+      let parsed;
+      try { parsed = JSON.parse(body || "{}"); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(ContinuousBuildSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { requirement, projectId } = vr.data;
       let projectEnv = {};
       if (projectId) {
-        const { existsSync: ex } = await import("node:fs");
         const { readFile: rf } = await import("node:fs/promises");
         const regPath = path.join(
           CFG_DIR,
           "projects.json",
         );
-        if (ex(regPath)) {
+        if (await exists(regPath)) {
           const reg = JSON.parse(await rf(regPath, "utf8").catch(() => "{}"));
           const proj = reg[projectId];
           if (proj) {
@@ -2484,8 +3234,7 @@ const server = http.createServer(async (req, res) => {
         }
       }
       const { spawn } = await import("node:child_process");
-      const { existsSync } = await import("node:fs");
-      if (!existsSync(continuousBuild))
+      if (!(await exists(continuousBuild)))
         throw new Error("continuous-build.mjs not found at " + continuousBuild);
       const proc = spawn(PREFERRED_NODE_BIN, [continuousBuild, requirement], {
         cwd: CREWSWARM_DIR,
@@ -2533,10 +3282,10 @@ const server = http.createServer(async (req, res) => {
         projectId ? "continuous-" + projectId + ".pid" : "continuous-build.pid",
       );
       try {
-        const pidStr = fs.readFileSync(pidFile, "utf8").trim();
+        const pidStr = (await fs.promises.readFile(pidFile, "utf8")).trim();
         const pid = parseInt(pidStr, 10);
         if (pid) process.kill(pid, "SIGTERM");
-        fs.unlinkSync(pidFile);
+        await fs.promises.unlink(pidFile);
         res.writeHead(200, { "content-type": "application/json" });
         res.end(JSON.stringify({ ok: true, pid }));
       } catch (e) {
@@ -2546,7 +3295,6 @@ const server = http.createServer(async (req, res) => {
       return;
     }
     if (url.pathname === "/api/continuous-build/log" && req.method === "GET") {
-      const { existsSync } = await import("node:fs");
       const { readFile } = await import("node:fs/promises");
       const logPath = path.join(
         CREWSWARM_DIR,
@@ -2554,7 +3302,7 @@ const server = http.createServer(async (req, res) => {
         "continuous-build.jsonl",
       );
       let lines = [];
-      if (existsSync(logPath)) {
+      if (await exists(logPath)) {
         const raw = await readFile(logPath, "utf8").catch(() => "");
         lines = raw
           .trim()
@@ -2651,7 +3399,6 @@ const server = http.createServer(async (req, res) => {
 
     // ── Waves Configuration APIs ──────────────────────────────────────────
     if (url.pathname === "/api/waves/config" && req.method === "GET") {
-      const { existsSync, readFileSync } = await import("node:fs");
       const { readFile: rf } = await import("node:fs/promises");
       const wavesConfigPath = path.join(
         CREWSWARM_DIR,
@@ -2660,7 +3407,7 @@ const server = http.createServer(async (req, res) => {
         "waves-config.json",
       );
 
-      if (!existsSync(wavesConfigPath)) {
+      if (!(await exists(wavesConfigPath))) {
         res.writeHead(404, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ ok: false, error: "Waves config not found" }));
         return;
@@ -2675,7 +3422,7 @@ const server = http.createServer(async (req, res) => {
             raw = await rf(wavesConfigPath, "utf8");
           } catch {
             try {
-              raw = readFileSync(wavesConfigPath, "utf8");
+              raw = await fs.promises.readFile(wavesConfigPath, "utf8");
             } catch {
               raw = JSON.stringify(getEmbeddedWavesConfig());
             }
@@ -2729,8 +3476,7 @@ const server = http.createServer(async (req, res) => {
 
       try {
         // Check if we have a backup
-        const { existsSync } = await import("node:fs");
-        if (existsSync(wavesConfigBackup)) {
+        if (await exists(wavesConfigBackup)) {
           const defaultConfig = await rf(wavesConfigBackup, "utf8");
           await wf(wavesConfigPath, defaultConfig, "utf8");
         } else {
@@ -2881,7 +3627,7 @@ const server = http.createServer(async (req, res) => {
         if (!isValidWorkflowName(name))
           throw new Error("Invalid workflow name");
         const fp = getWorkflowFile(name);
-        if (fs.existsSync(fp)) fs.unlinkSync(fp);
+        if (await exists(fp)) await fs.promises.unlink(fp);
         workflowRuntime.runs.delete(name);
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ ok: true }));
@@ -2961,11 +3707,10 @@ const server = http.createServer(async (req, res) => {
 
     // ── Project management APIs ───────────────────────────────────────────
     if (url.pathname === "/api/projects" && req.method === "GET") {
-      const { existsSync } = await import("node:fs");
       const { readFile: rf } = await import("node:fs/promises");
       const registryFile = path.join(CFG_DIR, "projects.json");
       let projects = {};
-      if (existsSync(registryFile)) {
+      if (await exists(registryFile)) {
         projects = JSON.parse(await rf(registryFile, "utf8").catch(() => "{}"));
       }
       // Enrich each project with live roadmap stats and running status.
@@ -2979,7 +3724,7 @@ const server = http.createServer(async (req, res) => {
             failed = 0,
             pending = 0,
             total = 0;
-          if (existsSync(project.roadmapFile)) {
+          if (await exists(project.roadmapFile)) {
             const rm = await rf(project.roadmapFile, "utf8").catch(() => "");
             const lines = rm.split("\n").filter((l) => /^- \[/.test(l));
             total = lines.length;
@@ -2989,7 +3734,7 @@ const server = http.createServer(async (req, res) => {
           }
           let running = false;
           const pidPath = path.join(logsDir2, `pm-loop-${id}.pid`);
-          if (existsSync(pidPath)) {
+          if (await exists(pidPath)) {
             try {
               const pidStr = await rf(pidPath, "utf8").catch(() => "");
               const pid = parseInt(pidStr.trim(), 10);
@@ -3056,12 +3801,11 @@ const server = http.createServer(async (req, res) => {
         body || "{}",
       );
       if (!name || !outputDir) throw new Error("name and outputDir required");
-      const { existsSync, mkdirSync } = await import("node:fs");
       const { readFile: rf, writeFile: wf } = await import("node:fs/promises");
       // Create output dir and ROADMAP.md if they don't exist
-      if (!existsSync(outputDir)) mkdirSync(outputDir, { recursive: true });
+      if (!(await exists(outputDir))) await fs.promises.mkdir(outputDir, { recursive: true });
       const roadmapFile = path.join(outputDir, "ROADMAP.md");
-      if (!existsSync(roadmapFile)) {
+      if (!(await exists(roadmapFile))) {
         await wf(
           roadmapFile,
           `# ${name} — Living Roadmap\n\n> Managed by pm-loop.mjs. Add \`- [ ] items\` here at any time.\n\n---\n\n## Phase 0 — Getting Started\n\n- [ ] Create the initial project structure and entry point\n`,
@@ -3073,7 +3817,7 @@ const server = http.createServer(async (req, res) => {
         .replace(/^-|-$/g, "");
       const registryFile = path.join(CFG_DIR, "projects.json");
       let projects = {};
-      if (existsSync(registryFile))
+      if (await exists(registryFile))
         projects = JSON.parse(await rf(registryFile, "utf8").catch(() => "{}"));
       projects[id] = {
         id,
@@ -3097,13 +3841,23 @@ const server = http.createServer(async (req, res) => {
     if (url.pathname === "/api/projects/delete" && req.method === "POST") {
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { projectId } = JSON.parse(body || "{}");
-      if (!projectId) throw new Error("projectId required");
+      let parsed;
+      try { parsed = JSON.parse(body || "{}"); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(DeleteProjectSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { projectId } = vr.data;
       const registryFile = path.join(CFG_DIR, "projects.json");
-      const { existsSync, rmSync, writeFileSync, unlinkSync } = await import("node:fs");
       const { readFile: rf, writeFile: wf } = await import("node:fs/promises");
       let projects = {};
-      if (existsSync(registryFile))
+      if (await exists(registryFile))
         projects = JSON.parse(await rf(registryFile, "utf8").catch(() => "{}"));
       if (!projects[projectId])
         throw new Error("Project not found: " + projectId);
@@ -3112,7 +3866,7 @@ const server = http.createServer(async (req, res) => {
       const stopPath = path.join(logsDir, `pm-loop-${projectId}.stop`);
       const logPath = path.join(logsDir, `pm-loop-${projectId}.jsonl`);
       let stoppedPmLoop = false;
-      if (existsSync(pidPath)) {
+      if (await exists(pidPath)) {
         const pidStr = await rf(pidPath, "utf8").catch(() => "");
         const pid = parseInt(pidStr.trim(), 10);
         if (pid) {
@@ -3123,18 +3877,18 @@ const server = http.createServer(async (req, res) => {
         }
       }
       try {
-        writeFileSync(stopPath, new Date().toISOString());
+        await fs.promises.writeFile(stopPath, new Date().toISOString());
       } catch { }
       for (const cleanupPath of [pidPath, stopPath, logPath]) {
-        if (!existsSync(cleanupPath)) continue;
+        if (!(await exists(cleanupPath))) continue;
         try {
-          unlinkSync(cleanupPath);
+          await fs.promises.unlink(cleanupPath);
         } catch { }
       }
       const projectMessageDir = path.join(CFG_DIR, "project-messages", projectId);
-      if (existsSync(projectMessageDir)) {
+      if (await exists(projectMessageDir)) {
         try {
-          rmSync(projectMessageDir, { recursive: true, force: true });
+          await fs.promises.rm(projectMessageDir, { recursive: true, force: true });
         } catch { }
       }
       delete projects[projectId];
@@ -3146,14 +3900,23 @@ const server = http.createServer(async (req, res) => {
     if (url.pathname === "/api/projects/update" && req.method === "POST") {
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { projectId, autoAdvance, name, description, outputDir } =
-        JSON.parse(body || "{}");
-      if (!projectId) throw new Error("projectId required");
+      let parsed;
+      try { parsed = JSON.parse(body || "{}"); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(UpdateProjectSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { projectId, autoAdvance, name, description, outputDir } = vr.data;
       const registryFile = path.join(CFG_DIR, "projects.json");
-      const { existsSync } = await import("node:fs");
       const { readFile: rf, writeFile: wf } = await import("node:fs/promises");
       let projects = {};
-      if (existsSync(registryFile))
+      if (await exists(registryFile))
         projects = JSON.parse(await rf(registryFile, "utf8").catch(() => "{}"));
       if (!projects[projectId])
         throw new Error("Project not found: " + projectId);
@@ -3168,7 +3931,6 @@ const server = http.createServer(async (req, res) => {
       return;
     }
     if (url.pathname === "/api/pm-loop/status" && req.method === "GET") {
-      const { existsSync } = await import("node:fs");
       const { readFile: rf } = await import("node:fs/promises");
       const statusProjectId = url.searchParams.get("projectId") || "";
       const suffix = statusProjectId ? `-${statusProjectId}` : "";
@@ -3179,7 +3941,7 @@ const server = http.createServer(async (req, res) => {
       );
       let running = false,
         pid = null;
-      if (existsSync(pidPath)) {
+      if (await exists(pidPath)) {
         const pidStr = await rf(pidPath, "utf8").catch(() => "");
         pid = parseInt(pidStr.trim(), 10);
         if (pid) {
@@ -3213,9 +3975,8 @@ const server = http.createServer(async (req, res) => {
       }
       const { dryRun, projectId, pmOptions = {} } = vr.data;
       const { spawn } = await import("node:child_process");
-      const { existsSync, mkdirSync, unlinkSync } = await import("node:fs");
       const { readFile: rf } = await import("node:fs/promises");
-      if (!existsSync(pmLoop))
+      if (!(await exists(pmLoop)))
         throw new Error("pm-loop.mjs not found at " + pmLoop);
       // Resolve project config if projectId provided
       let projectDir = null,
@@ -3223,7 +3984,7 @@ const server = http.createServer(async (req, res) => {
         projectFeaturesDoc = null;
       if (projectId) {
         const registryFile = path.join(CFG_DIR, "projects.json");
-        if (existsSync(registryFile)) {
+        if (await exists(registryFile)) {
           const reg = JSON.parse(
             await rf(registryFile, "utf8").catch(() => "{}"),
           );
@@ -3247,7 +4008,7 @@ const server = http.createServer(async (req, res) => {
         "orchestrator-logs",
         `pm-loop${pidSuffix}.stop`,
       );
-      if (existsSync(pidFile)) {
+      if (await exists(pidFile)) {
         const pidStr = await rf(pidFile, "utf8").catch(() => "");
         const existingPid = parseInt(pidStr.trim(), 10);
         if (existingPid) {
@@ -3269,13 +4030,13 @@ const server = http.createServer(async (req, res) => {
         }
       }
       // Clear any stale stop file
-      if (existsSync(stopFilePath)) {
+      if (await exists(stopFilePath)) {
         try {
-          unlinkSync(stopFilePath);
+          await fs.promises.unlink(stopFilePath);
         } catch { }
       }
       const logsDir = path.join(CREWSWARM_DIR, "orchestrator-logs");
-      if (!existsSync(logsDir)) mkdirSync(logsDir, { recursive: true });
+      if (!(await exists(logsDir))) await fs.promises.mkdir(logsDir, { recursive: true });
       // Load RT token so pm-loop and its child gateway-bridge --send can authenticate with the RT daemon
       let rtToken = process.env.CREWSWARM_RT_AUTH_TOKEN || "";
       if (!rtToken) {
@@ -3367,13 +4128,12 @@ const server = http.createServer(async (req, res) => {
       let body = "";
       for await (const chunk of req) body += chunk;
       const { projectId } = JSON.parse(body || "{}");
-      const { writeFileSync, mkdirSync, existsSync } = await import("node:fs");
       const logsDir = path.join(CREWSWARM_DIR, "orchestrator-logs");
-      if (!existsSync(logsDir)) mkdirSync(logsDir, { recursive: true });
+      if (!(await exists(logsDir))) await fs.promises.mkdir(logsDir, { recursive: true });
       // Write project-specific stop file if projectId provided
       const suffix = projectId ? `-${projectId}` : "";
       const stopFilePath = path.join(logsDir, `pm-loop${suffix}.stop`);
-      writeFileSync(stopFilePath, new Date().toISOString());
+      await fs.promises.writeFile(stopFilePath, new Date().toISOString());
       res.writeHead(200, { "content-type": "application/json" });
       res.end(
         JSON.stringify({
@@ -3384,10 +4144,9 @@ const server = http.createServer(async (req, res) => {
       return;
     }
     if (url.pathname === "/api/pm-loop/log" && req.method === "GET") {
-      const { existsSync } = await import("node:fs");
       const { readFile } = await import("node:fs/promises");
       let lines = [];
-      if (existsSync(pmLogFile)) {
+      if (await exists(pmLogFile)) {
         const raw = await readFile(pmLogFile, "utf8").catch(() => "");
         lines = raw
           .trim()
@@ -3408,10 +4167,9 @@ const server = http.createServer(async (req, res) => {
       return;
     }
     if (url.pathname === "/api/pm-loop/roadmap" && req.method === "GET") {
-      const { existsSync } = await import("node:fs");
       const { readFile } = await import("node:fs/promises");
       let content = "(ROADMAP.md not found — create website/ROADMAP.md)";
-      if (existsSync(roadmapFile)) {
+      if (await exists(roadmapFile)) {
         content = await readFile(roadmapFile, "utf8").catch(
           () => "(unreadable)",
         );
@@ -3423,10 +4181,23 @@ const server = http.createServer(async (req, res) => {
     if (url.pathname === "/api/dlq/replay" && req.method === "POST") {
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { key } = JSON.parse(body);
-      if (!key) throw new Error("missing key");
-      const { execSync } = await import("node:child_process");
-      execSync(`"${ctlPath}" dlq-replay "${key}"`, {
+      let parsed;
+      try { parsed = JSON.parse(body); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(ReplayDLQSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { key } = vr.data;
+      const { execSync: _execSync } = await import("node:child_process");
+      const { promisify: _promisify } = await import("node:util");
+      const execAsync = _promisify(_execSync);
+      await execAsync(`"${ctlPath}" dlq-replay "${key}"`, {
         encoding: "utf8",
         timeout: 10000,
       });
@@ -3451,7 +4222,9 @@ const server = http.createServer(async (req, res) => {
     // ── Settings: Preset (from setup wizard) ────────────────────────────────
     // ── Engine detection for first-run wizard ─────────────────────────────
     if (url.pathname === "/api/first-run-engines" && req.method === "GET") {
-      const { execSync } = await import("node:child_process");
+      const { exec: _execFRE } = await import("node:child_process");
+      const { promisify: _promisifyFRE } = await import("node:util");
+      const _execAsyncFRE = _promisifyFRE(_execFRE);
       // Expand PATH to include common install locations (launchd has restricted PATH)
       const extraPaths = [
         `${os.homedir()}/.local/bin`,
@@ -3477,13 +4250,14 @@ const server = http.createServer(async (req, res) => {
       ];
       for (const { id, bin } of checks) {
         // Check common paths directly (launchd PATH is restricted)
-        if (searchDirs.some(d => fs.existsSync(path.join(d, bin)))) {
+        const foundInSearchDirs = await Promise.any(searchDirs.map(d => fs.promises.access(path.join(d, bin)).then(() => true))).catch(() => false);
+        if (foundInSearchDirs) {
           engines[id] = true;
           continue;
         }
         // Fallback: try login shell
         try {
-          execSync(`/bin/zsh -lc 'command -v ${bin}'`, { stdio: "pipe", timeout: 5000 });
+          await _execAsyncFRE(`/bin/zsh -lc 'command -v ${bin}'`, { timeout: 5000 });
           engines[id] = true;
         } catch {
           engines[id] = false;
@@ -3499,7 +4273,7 @@ const server = http.createServer(async (req, res) => {
       let token = "";
       try {
         token =
-          JSON.parse(fs.readFileSync(csConfigPath, "utf8"))?.rt?.authToken ||
+          JSON.parse(await fs.promises.readFile(csConfigPath, "utf8"))?.rt?.authToken ||
           "";
       } catch { }
       if (!token) token = process.env.CREWSWARM_RT_AUTH_TOKEN || "";
@@ -3513,13 +4287,13 @@ const server = http.createServer(async (req, res) => {
       const { token } = JSON.parse(body);
       const csDir = path.join(os.homedir(), ".crewswarm");
       const csConfigPath = path.join(csDir, "crewswarm.json");
-      fs.mkdirSync(csDir, { recursive: true });
+      await fs.promises.mkdir(csDir, { recursive: true });
       let cfg = {};
       try {
-        cfg = JSON.parse(fs.readFileSync(csConfigPath, "utf8"));
+        cfg = JSON.parse(await fs.promises.readFile(csConfigPath, "utf8"));
       } catch { }
       cfg.rt = { ...(cfg.rt || {}), authToken: token };
-      fs.writeFileSync(csConfigPath, JSON.stringify(cfg, null, 2));
+      await fs.promises.writeFile(csConfigPath, JSON.stringify(cfg, null, 2));
       res.writeHead(200, { "content-type": "application/json" });
       res.end(JSON.stringify({ ok: true }));
       return;
@@ -3529,15 +4303,20 @@ const server = http.createServer(async (req, res) => {
       const cfgPath = path.join(os.homedir(), ".crewswarm", "crewswarm.json");
       let locked = false;
       try {
-        const { execSync } = require("child_process");
+        const { exec: _lockExec } = await import("node:child_process");
+        const { promisify: _lockPromisify } = await import("node:util");
+        const _lockExecAsync = _lockPromisify(_lockExec);
         // Use stat command which is more reliable than ls
-        const output = execSync(`stat -f "%Sf" "${cfgPath}"`, { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
-        locked = output.trim().includes('uchg');
+        const { stdout: lockOut } = await _lockExecAsync(`stat -f "%Sf" "${cfgPath}"`, { encoding: 'utf8' });
+        locked = lockOut.trim().includes('uchg');
       } catch (e) {
         // If stat fails, try ls as fallback
         try {
-          const output2 = execSync(`ls -lO "${cfgPath}"`, { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
-          locked = output2.includes('uchg');
+          const { exec: _lockExec2 } = await import("node:child_process");
+          const { promisify: _lockPromisify2 } = await import("node:util");
+          const _lockExecAsync2 = _lockPromisify2(_lockExec2);
+          const { stdout: lockOut2 } = await _lockExecAsync2(`ls -lO "${cfgPath}"`, { encoding: 'utf8' });
+          locked = lockOut2.includes('uchg');
         } catch { }
       }
       res.writeHead(200, { "content-type": "application/json" });
@@ -3547,7 +4326,9 @@ const server = http.createServer(async (req, res) => {
     if (url.pathname === "/api/config/lock" && req.method === "POST") {
       const cfgPath = path.join(os.homedir(), ".crewswarm", "crewswarm.json");
       try {
-        execSync(`chflags uchg "${cfgPath}"`);
+        const { exec: _chflagsExec } = await import("node:child_process");
+        const { promisify: _chflagsPromisify } = await import("node:util");
+        await _chflagsPromisify(_chflagsExec)(`chflags uchg "${cfgPath}"`);
         res.writeHead(200, { "content-type": "application/json" });
         res.end(JSON.stringify({ ok: true, locked: true }));
       } catch (e) {
@@ -3559,7 +4340,9 @@ const server = http.createServer(async (req, res) => {
     if (url.pathname === "/api/config/unlock" && req.method === "POST") {
       const cfgPath = path.join(os.homedir(), ".crewswarm", "crewswarm.json");
       try {
-        execSync(`chflags nouchg "${cfgPath}"`);
+        const { exec: _chflagsExec2 } = await import("node:child_process");
+        const { promisify: _chflagsPromisify2 } = await import("node:util");
+        await _chflagsPromisify2(_chflagsExec2)(`chflags nouchg "${cfgPath}"`);
         res.writeHead(200, { "content-type": "application/json" });
         res.end(JSON.stringify({ ok: true, locked: false }));
       } catch (e) {
@@ -3583,7 +4366,7 @@ const server = http.createServer(async (req, res) => {
         "groq/moonshotai/kimi-k2-instruct-0905";
       let crewLeadModel = process.env.CREWSWARM_CREW_LEAD_MODEL || "";
       try {
-        const c = JSON.parse(fs.readFileSync(cfgPath, "utf8"));
+        const c = JSON.parse(await fs.promises.readFile(cfgPath, "utf8"));
         if (c.opencodeProject) dir = c.opencodeProject;
         if (c.opencodeFallbackModel) fallbackModel = c.opencodeFallbackModel;
         if (c.opencodeModel) opencodeModel = c.opencodeModel;
@@ -3614,10 +4397,10 @@ const server = http.createServer(async (req, res) => {
       }
       const cfgDir = path.join(os.homedir(), ".crewswarm");
       const cfgPath = path.join(cfgDir, "crewswarm.json");
-      fs.mkdirSync(cfgDir, { recursive: true });
+      await fs.promises.mkdir(cfgDir, { recursive: true });
       let cfg = {};
       try {
-        cfg = JSON.parse(fs.readFileSync(cfgPath, "utf8"));
+        cfg = JSON.parse(await fs.promises.readFile(cfgPath, "utf8"));
       } catch { }
       if (dir !== undefined) {
         if (dir) cfg.opencodeProject = dir;
@@ -3684,38 +4467,38 @@ const server = http.createServer(async (req, res) => {
     const csConfig = path.join(csDir, "crewswarm.json");
     const csSwarmConfig = path.join(csDir, "crewswarm.json");
     const ocConfig = path.join(os.homedir(), ".openclaw", "openclaw.json");
-    function readCSConfig() {
+    async function readCSConfig() {
       try {
-        return JSON.parse(fs.readFileSync(csConfig, "utf8"));
+        return JSON.parse(await fs.promises.readFile(csConfig, "utf8"));
       } catch {
         return {};
       }
     }
-    function readCSSwarmConfig() {
+    async function readCSSwarmConfig() {
       try {
-        return JSON.parse(fs.readFileSync(csSwarmConfig, "utf8"));
+        return JSON.parse(await fs.promises.readFile(csSwarmConfig, "utf8"));
       } catch {
         return {};
       }
     }
-    function writeCSSwarmConfig(c) {
-      fs.mkdirSync(csDir, { recursive: true });
-      fs.writeFileSync(csSwarmConfig, JSON.stringify(c, null, 2));
+    async function writeCSSwarmConfig(c) {
+      await fs.promises.mkdir(csDir, { recursive: true });
+      await fs.promises.writeFile(csSwarmConfig, JSON.stringify(c, null, 2));
     }
-    function readOCConfig() {
+    async function readOCConfig() {
       try {
-        return JSON.parse(fs.readFileSync(ocConfig, "utf8"));
+        return JSON.parse(await fs.promises.readFile(ocConfig, "utf8"));
       } catch {
         return null;
       }
     }
-    function writeOCConfig(c) {
-      fs.writeFileSync(ocConfig, JSON.stringify(c, null, 4));
+    async function writeOCConfig(c) {
+      await fs.promises.writeFile(ocConfig, JSON.stringify(c, null, 4));
     }
-    function getBuiltinKey(id) {
-      const sw = readCSSwarmConfig();
-      const cs = readCSConfig();
-      const oc = readOCConfig();
+    async function getBuiltinKey(id) {
+      const sw = await readCSSwarmConfig();
+      const cs = await readCSConfig();
+      const oc = await readOCConfig();
       return (
         sw?.providers?.[id]?.apiKey ||
         sw?.env?.[id.toUpperCase() + "_API_KEY"] ||
@@ -3726,10 +4509,257 @@ const server = http.createServer(async (req, res) => {
       );
     }
 
+    // ── OAuth / subscription provider status + model config ──────────────────
+    if (url.pathname === "/api/oauth/status" && req.method === "GET") {
+      const providers = {};
+      // Use startup cache first; fall back to live keychain only if cache missed
+      providers["anthropic-oauth"] = !!getOAuthTokenCached("anthropic-oauth");
+      if (!providers["anthropic-oauth"]) {
+        try {
+          const { execFileSync } = await import("node:child_process");
+          const { userInfo } = await import("node:os");
+          for (const acct of [userInfo().username, "jeffhobbs", "unknown"]) {
+            try {
+              const raw = execFileSync("security", [
+                "find-generic-password", "-s", "Claude Code-credentials", "-a", acct, "-w"
+              ], { encoding: "utf8", timeout: 5000 }).trim();
+              const parsed = JSON.parse(raw);
+              if (parsed?.claudeAiOauth?.accessToken) {
+                _oauthTokenCache["anthropic-oauth"] = parsed.claudeAiOauth.accessToken;
+                providers["anthropic-oauth"] = true;
+                break;
+              }
+            } catch { /* try next */ }
+          }
+        } catch { providers["anthropic-oauth"] = false; }
+      }
+      providers["openai-oauth"] = !!getOAuthTokenCached("openai-oauth");
+      if (!providers["openai-oauth"]) {
+        try {
+          const t = await readOpenAIOAuthToken();
+          if (t) { _oauthTokenCache["openai-oauth"] = t; providers["openai-oauth"] = true; }
+        } catch { providers["openai-oauth"] = false; }
+      }
+      res.writeHead(200, { "content-type": "application/json" });
+      res.end(JSON.stringify({ ok: true, providers }));
+      return;
+    }
+    if (url.pathname === "/api/oauth/test" && req.method === "POST") {
+      let body = "";
+      for await (const chunk of req) body += chunk;
+      const { providerId, model } = JSON.parse(body);
+      try {
+        let token = getOAuthTokenCached(providerId);
+        if (!token) {
+          if (providerId === "anthropic-oauth") {
+            const { execFileSync } = await import("node:child_process");
+            const { userInfo } = await import("node:os");
+            for (const acct of [userInfo().username, "jeffhobbs", "unknown"]) {
+              try {
+                const raw = execFileSync("security", [
+                  "find-generic-password", "-s", "Claude Code-credentials", "-a", acct, "-w"
+                ], { encoding: "utf8", timeout: 5000 }).trim();
+                const t = JSON.parse(raw)?.claudeAiOauth?.accessToken;
+                if (t) { token = t; _oauthTokenCache[providerId] = t; break; }
+              } catch { /* try next */ }
+            }
+          } else if (providerId === "openai-oauth") {
+            token = await readOpenAIOAuthToken();
+            if (token) _oauthTokenCache[providerId] = token;
+          }
+        }
+        if (!token) {
+          res.writeHead(200, { "content-type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "No OAuth token found — run login command first" }));
+          return;
+        }
+        // Quick test call
+        if (providerId === "anthropic-oauth") {
+          const { computeVersionSuffix, buildBillingBlock, signBody } = await import("../crew-cli/dist/engine.mjs").catch(() => ({}));
+          let responseText, testModel = model || "claude-sonnet-4-6";
+          {
+            const xxhash = (await import("xxhash-wasm")).default;
+            const wasm = await xxhash();
+            const CCH_SEED = BigInt("0x6E52736AC806831E");
+            const VERSION = "2.1.87", SALT = "59cf53e54c78";
+            const msg = "reply with exactly: OK";
+            const chars = [4,7,20].map(i => i < msg.length ? msg[i] : "0").join("");
+            const suffix = crypto.subtle
+              ? await crypto.subtle.digest("SHA-256", new TextEncoder().encode(`${SALT}${chars}${VERSION}`))
+                  .then(b => Array.from(new Uint8Array(b)).map(x=>x.toString(16).padStart(2,"0")).join("").slice(0,3))
+              : createHash("sha256").update(`${SALT}${chars}${VERSION}`).digest("hex").slice(0,3);
+            const billingText = `x-anthropic-billing-header: cc_version=${VERSION}.${suffix}; cc_entrypoint=cli; cch=00000;`;
+            const supportsThinking = !testModel.includes("haiku");
+            const bodyObj = {
+              model: testModel, max_tokens: 50,
+              ...(supportsThinking ? { thinking: { type: "adaptive" } } : {}),
+              metadata: { user_id: "user_crewswarm_test" },
+              system: [{ type: "text", text: billingText }],
+              messages: [{ role: "user", content: msg }],
+            };
+            const { system, messages, ...rest } = bodyObj;
+            const bodyStr = JSON.stringify({ ...rest, system, messages });
+            const cch = Number(wasm.h64(bodyStr, CCH_SEED) & BigInt(0xfffff)).toString(16).padStart(5,"0");
+            const signed = bodyStr.replace("cch=00000", `cch=${cch}`);
+            const BETAS = "claude-code-20250219,oauth-2025-04-20,adaptive-thinking-2026-01-28,research-preview-2026-02-01,interleaved-thinking-2025-05-14,redact-thinking-2026-02-12,context-management-2025-06-27";
+            const r = await fetch("https://api.anthropic.com/v1/messages?beta=true", {
+              method: "POST",
+              headers: {
+                Authorization: `Bearer ${token}`, "content-type": "application/json",
+                "anthropic-version": "2023-06-01", "anthropic-beta": BETAS,
+                "anthropic-dangerous-direct-browser-access": "true",
+                "x-app": "cli", "user-agent": "claude-cli/2.1.87 (external, cli)",
+                "x-claude-code-session-id": crypto.randomUUID(),
+              },
+              body: signed,
+              signal: AbortSignal.timeout(15000),
+            });
+            const data = await r.json();
+            if (!r.ok) throw new Error(data?.error?.message || r.statusText);
+            responseText = data?.content?.find(b => b.type === "text")?.text?.trim() || "OK";
+          }
+          res.writeHead(200, { "content-type": "application/json" });
+          res.end(JSON.stringify({ ok: true, response: responseText, model: testModel }));
+        } else if (providerId === "openai-oauth") {
+          const testModel = model || "gpt-5.4";
+          // Codex CLI backend requires streaming (SSE)
+          const r = await fetch("https://chatgpt.com/backend-api/codex/responses", {
+            method: "POST",
+            headers: {
+              Authorization: `Bearer ${token}`,
+              "Content-Type": "application/json",
+              "User-Agent": "openai-codex-cli/0.1.0",
+            },
+            body: JSON.stringify({
+              model: testModel,
+              instructions: "Reply with exactly: OK",
+              input: [{ role: "user", content: "ping" }],
+              stream: true,
+              store: false,
+            }),
+            signal: AbortSignal.timeout(20000),
+          });
+          if (!r.ok) {
+            const errData = await r.json().catch(() => ({}));
+            throw new Error(errData?.detail || errData?.error?.message || r.statusText);
+          }
+          // Consume SSE stream and collect output_text delta chunks
+          let responseText = "";
+          const decoder = new TextDecoder();
+          for await (const chunk of r.body) {
+            const text = decoder.decode(chunk, { stream: true });
+            for (const line of text.split("\n")) {
+              if (!line.startsWith("data: ")) continue;
+              const raw = line.slice(6).trim();
+              if (raw === "[DONE]") break;
+              try {
+                const evt = JSON.parse(raw);
+                // response.output_text.delta event
+                if (evt.type === "response.output_text.delta") responseText += evt.delta || "";
+                // completed event with full output
+                if (evt.type === "response.completed") {
+                  const items = evt.response?.output?.flatMap(o => o.content || []) || [];
+                  const full = items.find(c => c.type === "output_text")?.text;
+                  if (full) responseText = full;
+                }
+              } catch { /* skip malformed */ }
+            }
+          }
+          res.writeHead(200, { "content-type": "application/json" });
+          res.end(JSON.stringify({ ok: true, response: responseText.trim() || "OK", model: testModel }));
+        } else {
+          res.writeHead(200, { "content-type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "Unknown provider" }));
+        }
+      } catch(e) {
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: e.message }));
+      }
+      return;
+    }
+    if (url.pathname === "/api/oauth/models" && req.method === "GET") {
+      const { providerId } = Object.fromEntries(url.searchParams);
+      try {
+        let token = getOAuthTokenCached(providerId);
+        if (!token && providerId === "anthropic-oauth") {
+          const { execFileSync } = await import("node:child_process");
+          const { userInfo } = await import("node:os");
+          for (const acct of [userInfo().username, "jeffhobbs", "unknown"]) {
+            try {
+              const raw = execFileSync("security", [
+                "find-generic-password", "-s", "Claude Code-credentials", "-a", acct, "-w"
+              ], { encoding: "utf8", timeout: 5000 }).trim();
+              const t = JSON.parse(raw)?.claudeAiOauth?.accessToken;
+              if (t) { token = t; _oauthTokenCache[providerId] = t; break; }
+            } catch { /* try next */ }
+          }
+        }
+        if (providerId === "anthropic-oauth") {
+          if (!token) throw new Error("No Anthropic OAuth token");
+          const r = await fetch("https://api.anthropic.com/v1/models", {
+            headers: {
+              Authorization: `Bearer ${token}`,
+              "anthropic-version": "2023-06-01",
+              "anthropic-beta": "claude-code-20250219,oauth-2025-04-20",
+              "x-app": "cli",
+            },
+            signal: AbortSignal.timeout(10000),
+          });
+          const data = await r.json();
+          const models = (data?.data || []).map(m => ({ id: m.id, name: m.display_name || m.id }));
+          res.writeHead(200, { "content-type": "application/json" });
+          res.end(JSON.stringify({ ok: true, models }));
+        } else if (providerId === "openai-oauth") {
+          // Codex subscription doesn't expose a /models list endpoint —
+          // return the known codex-accessible models directly
+          const models = [
+            { id: "gpt-5.4",          name: "GPT-5.4 · Latest · Recommended" },
+            { id: "gpt-5.4-mini",     name: "GPT-5.4 Mini · Smaller frontier" },
+            { id: "gpt-5.3-codex",    name: "GPT-5.3 Codex · Codex-optimized" },
+            { id: "gpt-5.2-codex",    name: "GPT-5.2 Codex · Frontier agentic" },
+            { id: "gpt-5.2",          name: "GPT-5.2 · Professional / long-running agents" },
+            { id: "gpt-5.1-codex-max",  name: "GPT-5.1 Codex Max · Deep & fast reasoning" },
+            { id: "gpt-5.1-codex-mini", name: "GPT-5.1 Codex Mini · Fast & cheap" },
+            { id: "gpt-4o",           name: "GPT-4o · Fast & capable" },
+          ];
+          res.writeHead(200, { "content-type": "application/json" });
+          res.end(JSON.stringify({ ok: true, models }));
+        } else {
+          throw new Error("Unknown providerId");
+        }
+      } catch(e) {
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: e.message }));
+      }
+      return;
+    }
+    if (url.pathname === "/api/oauth/model" && req.method === "GET") {
+      const cfg = readSwarmConfigSafe() || {};
+      const models = {
+        claudeOauthModel: cfg.claudeOauthModel || "claude-sonnet-4-6",
+        openaiOauthModel: cfg.openaiOauthModel || "gpt-5.4",
+      };
+      res.writeHead(200, { "content-type": "application/json" });
+      res.end(JSON.stringify({ ok: true, models }));
+      return;
+    }
+    if (url.pathname === "/api/oauth/model" && req.method === "POST") {
+      let body = "";
+      for await (const chunk of req) body += chunk;
+      const data = JSON.parse(body);
+      const cfg = readSwarmConfigSafe() || {};
+      if (data.claudeOauthModel) cfg.claudeOauthModel = data.claudeOauthModel;
+      if (data.openaiOauthModel) cfg.openaiOauthModel = data.openaiOauthModel;
+      await safeWriteConfig(cfg);
+      res.writeHead(200, { "content-type": "application/json" });
+      res.end(JSON.stringify({ ok: true }));
+      return;
+    }
+
     if (url.pathname === "/api/providers/builtin" && req.method === "GET") {
       const keys = {};
       for (const id of Object.keys(BUILTIN_URLS)) {
-        keys[id] = getBuiltinKey(id) ? "SET" : "";
+        keys[id] = await getBuiltinKey(id) ? "SET" : "";
       }
       res.writeHead(200, { "content-type": "application/json" });
       res.end(JSON.stringify({ ok: true, keys }));
@@ -3746,16 +4776,16 @@ const server = http.createServer(async (req, res) => {
       if (providerId === "openai-local" && !(apiKey && apiKey.trim()))
         apiKey = "key";
       // Write to ~/.crewswarm/crewswarm.json
-      const cfg = readCSSwarmConfig();
+      const cfg = await readCSSwarmConfig();
       if (!cfg.providers) cfg.providers = {};
       cfg.providers[providerId] = {
         ...(cfg.providers[providerId] || {}),
         apiKey,
         baseUrl: BUILTIN_URLS[providerId],
       };
-      writeCSSwarmConfig(cfg);
+      await writeCSSwarmConfig(cfg);
       // Sync to ~/.openclaw/openclaw.json if it exists (legacy compat)
-      const oc = readOCConfig();
+      const oc = await readOCConfig();
       if (oc) {
         if (!oc.models) oc.models = {};
         if (!oc.models.providers) oc.models.providers = {};
@@ -3767,7 +4797,7 @@ const server = http.createServer(async (req, res) => {
           };
         }
         oc.models.providers[providerId].apiKey = apiKey;
-        writeOCConfig(oc);
+        await writeOCConfig(oc);
       }
       res.writeHead(200, { "content-type": "application/json" });
       res.end(JSON.stringify({ ok: true }));
@@ -3779,8 +4809,20 @@ const server = http.createServer(async (req, res) => {
     ) {
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { providerId } = JSON.parse(body);
-      const apiKey = getBuiltinKey(providerId);
+      let parsed;
+      try { parsed = JSON.parse(body); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(ProviderBuiltinTestSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { providerId } = vr.data;
+      const apiKey = await getBuiltinKey(providerId);
       const baseUrl = BUILTIN_URLS[providerId] || "";
       if (providerId === "ollama") {
         try {
@@ -3875,20 +4917,7 @@ const server = http.createServer(async (req, res) => {
               return b;
             })()
             : null;
-        const token = (() => {
-          try {
-            return (
-              JSON.parse(
-                fs.readFileSync(
-                  path.join(os.homedir(), ".crewswarm", "crewswarm.json"),
-                  "utf8",
-                ),
-              )?.rt?.authToken || ""
-            );
-          } catch {
-            return "";
-          }
-        })();
+        const token = resolveCrewLeadAuthToken();
         const r = await fetch(
           "http://127.0.0.1:5010/api/settings/bg-consciousness",
           {
@@ -3925,20 +4954,7 @@ const server = http.createServer(async (req, res) => {
               return b;
             })()
             : null;
-        const token = (() => {
-          try {
-            return (
-              JSON.parse(
-                fs.readFileSync(
-                  path.join(os.homedir(), ".crewswarm", "crewswarm.json"),
-                  "utf8",
-                ),
-              )?.rt?.authToken || ""
-            );
-          } catch {
-            return "";
-          }
-        })();
+        const token = resolveCrewLeadAuthToken();
         const r = await fetch(
           "http://127.0.0.1:5010/api/settings/cursor-waves",
           {
@@ -3975,20 +4991,7 @@ const server = http.createServer(async (req, res) => {
               return b;
             })()
             : null;
-        const token = (() => {
-          try {
-            return (
-              JSON.parse(
-                fs.readFileSync(
-                  path.join(os.homedir(), ".crewswarm", "crewswarm.json"),
-                  "utf8",
-                ),
-              )?.rt?.authToken || ""
-            );
-          } catch {
-            return "";
-          }
-        })();
+        const token = resolveCrewLeadAuthToken();
         const r = await fetch(
           "http://127.0.0.1:5010/api/settings/claude-code",
           {
@@ -4014,6 +5017,27 @@ const server = http.createServer(async (req, res) => {
       }
       return;
     }
+    // ── Proxy /api/settings/tmux-bridge → crew-lead:5010 ─────────────────────
+    if (url.pathname === "/api/settings/tmux-bridge") {
+      try {
+        const rawBody =
+          req.method === "POST"
+            ? await (async () => { let b = ""; for await (const c of req) b += c; return b; })()
+            : null;
+        const token = resolveCrewLeadAuthToken();
+        const { data } = await crewLeadRequest("/api/settings/tmux-bridge", {
+          method: req.method,
+          body: rawBody || null,
+          timeout: 8000,
+        });
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(typeof data === "string" ? data : JSON.stringify(data));
+      } catch (e) {
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "crew-lead unreachable: " + e.message }));
+      }
+      return;
+    }
     // ── Codex CLI executor toggle ──────────────────────────────────────────────
     if (url.pathname === "/api/settings/codex") {
       const { readFile, writeFile } = await import("node:fs/promises");
@@ -4099,7 +5123,7 @@ const server = http.createServer(async (req, res) => {
             process.env.CREWSWARM_CREW_CLI_ENABLED === "1";
           const installed =
             commandExists("crew") ||
-            fs.existsSync(path.join(CREWSWARM_DIR, "crew-cli", "dist", "index.js"));
+            await exists(path.join(CREWSWARM_DIR, "crew-cli", "dist", "index.js"));
           res.writeHead(200, { "content-type": "application/json" });
           res.end(JSON.stringify({ enabled, installed }));
         } catch {
@@ -4169,9 +5193,9 @@ const server = http.createServer(async (req, res) => {
           return;
         }
         try {
-          const raw = (() => {
+          const raw = await (async () => {
             try {
-              return fs.readFileSync(CFG_FILE, "utf8");
+              return await fs.promises.readFile(CFG_FILE, "utf8");
             } catch {
               return "{}";
             }
@@ -4223,7 +5247,7 @@ const server = http.createServer(async (req, res) => {
             process.env.CREWSWARM_OPENCODE_ENABLED === "1";
           const installed =
             commandExists(process.env.CREWSWARM_OPENCODE_BIN || "opencode") ||
-            fs.existsSync(path.join(os.homedir(), ".opencode", "bin", "opencode"));
+            await exists(path.join(os.homedir(), ".opencode", "bin", "opencode"));
           res.writeHead(200, { "content-type": "application/json" });
           res.end(JSON.stringify({ enabled, installed }));
         } catch {
@@ -4373,7 +5397,7 @@ const server = http.createServer(async (req, res) => {
       const cfgPath = CFG_FILE;
       if (req.method === "GET") {
         try {
-          const cfg = JSON.parse(fs.readFileSync(cfgPath, "utf8"));
+          const cfg = JSON.parse(await fs.promises.readFile(cfgPath, "utf8"));
           const roles = cfg.roleToolDefaults || {};
           res.writeHead(200, { "content-type": "application/json" });
           res.end(JSON.stringify({ roles }));
@@ -4388,7 +5412,7 @@ const server = http.createServer(async (req, res) => {
           let body = "";
           for await (const chunk of req) body += chunk;
           const { roles } = JSON.parse(body || "{}");
-          const cfg = JSON.parse(fs.readFileSync(cfgPath, "utf8"));
+          const cfg = JSON.parse(await fs.promises.readFile(cfgPath, "utf8"));
           cfg.roleToolDefaults = roles || {};
           const writeErr = await safeWriteConfig(cfg);
           if (writeErr) {
@@ -4410,7 +5434,7 @@ const server = http.createServer(async (req, res) => {
       const cfgPath = CFG_FILE;
       if (req.method === "GET") {
         try {
-          const cfg = JSON.parse(fs.readFileSync(cfgPath, "utf8"));
+          const cfg = JSON.parse(await fs.promises.readFile(cfgPath, "utf8"));
           const caps = cfg.globalSpendingCaps || {};
           res.writeHead(200, { "content-type": "application/json" });
           res.end(
@@ -4432,7 +5456,7 @@ const server = http.createServer(async (req, res) => {
           const { dailyTokenLimit, dailyCostLimitUSD } = JSON.parse(
             body || "{}",
           );
-          const cfg = JSON.parse(fs.readFileSync(cfgPath, "utf8"));
+          const cfg = JSON.parse(await fs.promises.readFile(cfgPath, "utf8"));
           cfg.globalSpendingCaps = {
             dailyTokenLimit: dailyTokenLimit ?? undefined,
             dailyCostLimitUSD: dailyCostLimitUSD ?? undefined,
@@ -4462,8 +5486,8 @@ const server = http.createServer(async (req, res) => {
       const rulesPath = path.join(CFG_DIR, "global-rules.md");
       if (req.method === "GET") {
         try {
-          const content = fs.existsSync(rulesPath)
-            ? fs.readFileSync(rulesPath, "utf8")
+          const content = await exists(rulesPath)
+            ? await fs.promises.readFile(rulesPath, "utf8")
             : "";
           res.writeHead(200, { "content-type": "application/json" });
           res.end(JSON.stringify({ content }));
@@ -4478,7 +5502,7 @@ const server = http.createServer(async (req, res) => {
           let body = "";
           for await (const chunk of req) body += chunk;
           const { content } = JSON.parse(body || "{}");
-          fs.writeFileSync(rulesPath, content || "", "utf8");
+          await fs.promises.writeFile(rulesPath, content || "", "utf8");
           res.writeHead(200, { "content-type": "application/json" });
           res.end(JSON.stringify({ ok: true }));
         } catch (e) {
@@ -4528,20 +5552,7 @@ const server = http.createServer(async (req, res) => {
           for await (const c of req) b += c;
           return b;
         })();
-        const token = (() => {
-          try {
-            return (
-              JSON.parse(
-                fs.readFileSync(
-                  path.join(os.homedir(), ".crewswarm", "crewswarm.json"),
-                  "utf8",
-                ),
-              )?.rt?.authToken || ""
-            );
-          } catch {
-            return "";
-          }
-        })();
+        const token = resolveCrewLeadAuthToken();
         const upstream = await fetch(
           "http://127.0.0.1:5010/api/engine-passthrough",
           {
@@ -4606,20 +5617,7 @@ const server = http.createServer(async (req, res) => {
               return b;
             })()
             : null;
-        const token = (() => {
-          try {
-            return (
-              JSON.parse(
-                fs.readFileSync(
-                  path.join(os.homedir(), ".crewswarm", "crewswarm.json"),
-                  "utf8",
-                ),
-              )?.rt?.authToken || ""
-            );
-          } catch {
-            return "";
-          }
-        })();
+        const token = resolveCrewLeadAuthToken();
         const r = await fetch(
           "http://127.0.0.1:5010/api/settings/global-fallback",
           {
@@ -4657,7 +5655,7 @@ const server = http.createServer(async (req, res) => {
       );
       const deviceJsonAlt = path.join(os.homedir(), ".openclaw", "device.json");
       const installed =
-        fs.existsSync(deviceJson) || fs.existsSync(deviceJsonAlt);
+        await exists(deviceJson) || await exists(deviceJsonAlt);
       res.writeHead(200, { "content-type": "application/json" });
       res.end(JSON.stringify({ ok: true, installed }));
       return;
@@ -4667,10 +5665,8 @@ const server = http.createServer(async (req, res) => {
       try {
         let online = false;
         try {
-          const health = await fetch("http://127.0.0.1:5010/health", {
-            signal: AbortSignal.timeout(1500),
-          });
-          online = health.ok;
+          const { ok } = await crewLeadRequest("/health", { timeout: 1500 });
+          online = ok;
         } catch { }
         if (!online) {
           const { execSync: es } = await import("node:child_process");
@@ -4690,11 +5686,11 @@ const server = http.createServer(async (req, res) => {
       return;
     }
 
-    // ── Models API (list available models for CrewChat dropdown) ─────────────
+    // ── Models API (list available models for crewchat dropdown) ─────────────
     if (url.pathname === "/api/models" && req.method === "GET") {
       try {
         const csSwarm = JSON.parse(
-          fs.readFileSync(
+          await fs.promises.readFile(
             path.join(os.homedir(), ".crewswarm", "crewswarm.json"),
             "utf8",
           ),
@@ -4780,7 +5776,7 @@ const server = http.createServer(async (req, res) => {
       return;
     }
 
-    // ── CLI Chat API (CrewChat CLI mode passthrough) ──────────────────────
+    // ── CLI Chat API (crewchat CLI mode passthrough) ──────────────────────
     if (url.pathname === "/api/cli/chat" && req.method === "POST") {
       let body = "";
       for await (const chunk of req) body += chunk;
@@ -4802,8 +5798,8 @@ const server = http.createServer(async (req, res) => {
         if (projectId) {
           try {
             const registryFile = path.join(CFG_DIR, "projects.json");
-            const projects = fs.existsSync(registryFile)
-              ? JSON.parse(fs.readFileSync(registryFile, "utf8"))
+            const projects = await exists(registryFile)
+              ? JSON.parse(await fs.promises.readFile(registryFile, "utf8"))
               : {};
             projectDir = projects?.[projectId]?.outputDir || null;
           } catch { }
@@ -4904,7 +5900,7 @@ const server = http.createServer(async (req, res) => {
 
         // Load agent config
         const csSwarm = JSON.parse(
-          fs.readFileSync(
+          await fs.promises.readFile(
             path.join(os.homedir(), ".crewswarm", "crewswarm.json"),
             "utf8",
           ),
@@ -4944,7 +5940,7 @@ const server = http.createServer(async (req, res) => {
         );
         let systemPrompt = `You are ${agentId}.`;
         try {
-          const prompts = JSON.parse(fs.readFileSync(promptPath, "utf8"));
+          const prompts = JSON.parse(await fs.promises.readFile(promptPath, "utf8"));
           const bareId = agentId.replace(/^crew-/, "");
           systemPrompt = prompts[agentId] || prompts[bareId] || systemPrompt;
         } catch { }
@@ -5020,7 +6016,7 @@ const server = http.createServer(async (req, res) => {
       return;
     }
 
-    // ── Chat Agent API (CrewChat direct agent chat) ──────────────────────────
+    // ── Chat Agent API (crewchat direct agent chat) ──────────────────────────
     if (url.pathname === "/api/chat-agent" && req.method === "POST") {
       let body = "";
       for await (const chunk of req) body += chunk;
@@ -5068,7 +6064,7 @@ const server = http.createServer(async (req, res) => {
       return;
     }
 
-    // ── Dispatch API (CrewChat agent direct mode) ─────────────────────────────
+    // ── Dispatch API (crewchat agent direct mode) ─────────────────────────────
     if (url.pathname === "/api/dispatch" && req.method === "POST") {
       let body = "";
       for await (const chunk of req) body += chunk;
@@ -5139,7 +6135,7 @@ const server = http.createServer(async (req, res) => {
     }
 
     if (url.pathname === "/api/transcribe-audio" && req.method === "POST") {
-      // Expects multipart/form-data with audio file (CrewChat: m4a, Dashboard: webm)
+      // Expects multipart/form-data with audio file (crewchat: m4a, Dashboard: webm)
       // Per Groq docs: https://console.groq.com/docs/speech-to-text — file, model required
       const sendJson = (status, body) => {
         if (res.headersSent) return;
@@ -5149,7 +6145,7 @@ const server = http.createServer(async (req, res) => {
       try {
         const busboy = await import("busboy");
         const chunks = [];
-        let mimeType = "audio/m4a"; // CrewChat default
+        let mimeType = "audio/m4a"; // crewchat default
         let resolved = false;
         const resolveOnce = () => {
           if (resolved) return;
@@ -5235,8 +6231,8 @@ const server = http.createServer(async (req, res) => {
       if (!resolvedProjectDir && projectId) {
         try {
           const registryFile = path.join(CFG_DIR, "projects.json");
-          const projects = fs.existsSync(registryFile)
-            ? JSON.parse(fs.readFileSync(registryFile, "utf8"))
+          const projects = await exists(registryFile)
+            ? JSON.parse(await fs.promises.readFile(registryFile, "utf8"))
             : {};
           resolvedProjectDir = projects?.[projectId]?.outputDir || null;
         } catch { }
@@ -5269,7 +6265,10 @@ const server = http.createServer(async (req, res) => {
             `http://127.0.0.1:${listenPort}/api/engine-passthrough`,
             {
               method: "POST",
-              headers: { "content-type": "application/json" },
+              headers: {
+                "content-type": "application/json",
+                ...(clAuthToken ? { authorization: `Bearer ${clAuthToken}` } : {}),
+              },
               body: JSON.stringify(payload),
               signal: AbortSignal.timeout(240000),
             },
@@ -5371,7 +6370,7 @@ const server = http.createServer(async (req, res) => {
           }
 
           if (wantAgentSSE && upstream.body) {
-            // SSE streaming path (Vibe, Studio)
+            // SSE streaming path (Dashboard or Vibe)
             res.writeHead(200, {
               "content-type": "text/event-stream",
               "cache-control": "no-cache",
@@ -5471,7 +6470,7 @@ const server = http.createServer(async (req, res) => {
         }
 
         if (wantSSE && upstream.body) {
-          // SSE streaming path (Vibe, Studio)
+          // SSE streaming path (Dashboard or Vibe)
           res.writeHead(200, {
             "content-type": "text/event-stream",
             "cache-control": "no-cache",
@@ -5820,9 +6819,19 @@ const server = http.createServer(async (req, res) => {
       const { readFile, writeFile } = await import("node:fs/promises");
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { providerId, apiKey } = JSON.parse(body);
-      if (!providerId || !apiKey)
-        throw new Error("providerId and apiKey required");
+      let parsed;
+      try { parsed = JSON.parse(body); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(ProviderSaveSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { providerId, apiKey } = vr.data;
       const cfgPath = CFG_FILE;
       const cfg = JSON.parse(await readFile(cfgPath, "utf8"));
       const fromModels = cfg?.models?.providers?.[providerId];
@@ -5870,8 +6879,19 @@ const server = http.createServer(async (req, res) => {
       const { readFile, writeFile } = await import("node:fs/promises");
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { id, baseUrl, apiKey, api } = JSON.parse(body);
-      if (!id || !baseUrl) throw new Error("id and baseUrl required");
+      let parsed;
+      try { parsed = JSON.parse(body); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(ProviderAddSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { id, baseUrl, apiKey, api } = vr.data;
       const cfgPath = CFG_FILE;
       const cfg = JSON.parse(await readFile(cfgPath, "utf8"));
       if (!cfg.models) cfg.models = {};
@@ -6191,7 +7211,19 @@ const server = http.createServer(async (req, res) => {
     if (url.pathname === "/api/providers/test" && req.method === "POST") {
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { providerId } = JSON.parse(body);
+      let parsed;
+      try { parsed = JSON.parse(body); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(ProviderTestSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { providerId } = vr.data;
       const { readFile } = await import("node:fs/promises");
       const cfgPath = CFG_FILE;
       const cfg = JSON.parse(await readFile(cfgPath, "utf8").catch(() => "{}"));
@@ -6618,7 +7650,7 @@ ORDER BY day DESC, cost DESC;`;
       try {
         const { execFile } = await import("node:child_process");
         const ocBin = path.join(os.homedir(), ".opencode", "bin", "opencode");
-        const bin = fs.existsSync(ocBin) ? ocBin : "opencode";
+        const bin = await exists(ocBin) ? ocBin : "opencode";
         models = await new Promise((resolve, reject) => {
           const child = execFile(
             bin,
@@ -6644,7 +7676,7 @@ ORDER BY day DESC, cost DESC;`;
             "opencode",
             "auth.json",
           );
-          const auth = JSON.parse(fs.readFileSync(authPath, "utf8"));
+          const auth = JSON.parse(await fs.promises.readFile(authPath, "utf8"));
           const providers = Object.keys(auth || {}).map((k) => k.toLowerCase());
           const knownModels = {
             openai: [
@@ -6908,6 +7940,16 @@ ORDER BY day DESC, cost DESC;`;
       for (const m of defaultModels) {
         if (!allModels.includes(m)) allModels.push(m);
       }
+      // Inject OAuth subscription models so they appear in agent primary/fallback dropdowns
+      const CLAUDE_OAUTH_MODELS = [
+        'claude-haiku-4-5-20251001',
+        'claude-sonnet-4-6',
+        'claude-opus-4-6',
+      ];
+      const OPENAI_OAUTH_MODELS = ['gpt-5.4', 'gpt-5.4-mini', 'gpt-5.3-codex', 'gpt-5.2-codex', 'gpt-5.2', 'gpt-5.1-codex-max', 'gpt-5.1-codex-mini', 'gpt-4o'];
+      for (const m of [...CLAUDE_OAUTH_MODELS, ...OPENAI_OAUTH_MODELS]) {
+        if (!allModels.includes(m)) allModels.push(m);
+      }
       const roleToolDefaults = cfg.roleToolDefaults || {};
       res.writeHead(200, { "content-type": "application/json" });
       res.end(
@@ -6985,7 +8027,7 @@ ORDER BY day DESC, cost DESC;`;
         await import("../lib/memory/shared-adapter.mjs");
       const brainPath = path.join(CREWSWARM_DIR, "memory", "brain.md");
 
-      if (!fs.existsSync(brainPath)) {
+      if (!await exists(brainPath)) {
         res.statusCode = 404;
         res.end(JSON.stringify({ ok: false, error: "brain.md not found" }));
         return;
@@ -7204,6 +8246,18 @@ ORDER BY day DESC, cost DESC;`;
       const { readFile, writeFile } = await import("node:fs/promises");
       let body = "";
       for await (const chunk of req) body += chunk;
+      let parsed;
+      try { parsed = JSON.parse(body); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(AgentConfigCreateSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
       const {
         id,
         model,
@@ -7212,7 +8266,7 @@ ORDER BY day DESC, cost DESC;`;
         theme,
         systemPrompt,
         alsoAllow: reqAlsoAllow,
-      } = JSON.parse(body);
+      } = vr.data;
       const rawId = String(id || "");
       const normalizedId =
         rawId && !rawId.startsWith("crew-")
@@ -7302,8 +8356,19 @@ ORDER BY day DESC, cost DESC;`;
       const { readFile, writeFile } = await import("node:fs/promises");
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { agentId } = JSON.parse(body);
-      if (!agentId) throw new Error("agentId required");
+      let parsed;
+      try { parsed = JSON.parse(body); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(AgentConfigDeleteSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { agentId } = vr.data;
       const cfgPath = CFG_FILE;
       const promptsPath = path.join(CFG_DIR, "agent-prompts.json");
       const cfg = JSON.parse(await readFile(cfgPath, "utf8"));
@@ -7351,12 +8416,19 @@ ORDER BY day DESC, cost DESC;`;
     ) {
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { agentId } = JSON.parse(body || "{}");
-      if (!agentId) {
-        res.writeHead(400);
-        res.end(JSON.stringify({ error: "agentId required" }));
+      let parsed;
+      try { parsed = JSON.parse(body || "{}"); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(AgentResetSessionSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
         return;
       }
+      const { agentId } = vr.data;
       const { execFile } = await import("node:child_process");
       const bridgePath = path.join(CREWSWARM_DIR, "gateway-bridge.mjs");
       // 1. Reset the agent session via gateway-bridge --reset-session
@@ -7389,9 +8461,8 @@ ORDER BY day DESC, cost DESC;`;
 
     if (url.pathname === "/api/crew/start" && req.method === "POST") {
       const { spawn: spawnProc } = await import("node:child_process");
-      const { existsSync: eS } = await import("node:fs");
       const crewScript = path.join(CREWSWARM_DIR, "scripts", "start-crew.mjs");
-      if (!eS(crewScript))
+      if (!(await exists(crewScript)))
         throw new Error(
           "start-crew.mjs not found — is the dashboard running from the crewswarm repo?",
         );
@@ -7434,9 +8505,19 @@ ORDER BY day DESC, cost DESC;`;
       const { writeFile } = await import("node:fs/promises");
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { roadmapFile, content } = JSON.parse(body);
-      if (!roadmapFile || content === undefined)
-        throw new Error("roadmapFile and content required");
+      let parsed;
+      try { parsed = JSON.parse(body); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(RoadmapWriteSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { roadmapFile, content } = vr.data;
       await writeFile(roadmapFile, content, "utf8");
       res.writeHead(200, { "content-type": "application/json" });
       res.end(JSON.stringify({ ok: true }));
@@ -7448,8 +8529,19 @@ ORDER BY day DESC, cost DESC;`;
       const { readFile, writeFile } = await import("node:fs/promises");
       let body = "";
       for await (const chunk of req) body += chunk;
-      const { roadmapFile } = JSON.parse(body);
-      if (!roadmapFile) throw new Error("roadmapFile required");
+      let parsed;
+      try { parsed = JSON.parse(body); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(RoadmapRetryFailedSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { roadmapFile } = vr.data;
       const content = await readFile(roadmapFile, "utf8");
       // Strip [!] markers back to [ ] and remove failure timestamps
       const reset = content
@@ -7492,13 +8584,13 @@ ORDER BY day DESC, cost DESC;`;
         "agent-prompts.json",
       );
       try {
-        const promptsRaw = JSON.parse(fs.readFileSync(promptsFile, "utf8"));
+        const promptsRaw = JSON.parse(await fs.promises.readFile(promptsFile, "utf8"));
         const { applySharedChatPromptOverlay } = await import(
           "../lib/chat/shared-chat-prompt-overlay.mjs"
         );
         let agents = [];
         try {
-          const cfg = JSON.parse(fs.readFileSync(CFG_FILE, "utf8"));
+          const cfg = JSON.parse(await fs.promises.readFile(CFG_FILE, "utf8"));
           const list = Array.isArray(cfg.agents)
             ? cfg.agents
             : Array.isArray(cfg.agents?.list)
@@ -7561,13 +8653,13 @@ ORDER BY day DESC, cost DESC;`;
       try {
         let prompts = {};
         try {
-          prompts = JSON.parse(fs.readFileSync(promptsFile, "utf8"));
+          prompts = JSON.parse(await fs.promises.readFile(promptsFile, "utf8"));
         } catch { }
 
         const keySet = new Set(Object.keys(prompts));
         let agentIds = [];
         try {
-          const cfg = JSON.parse(fs.readFileSync(CFG_FILE, "utf8"));
+          const cfg = JSON.parse(await fs.promises.readFile(CFG_FILE, "utf8"));
           const list = Array.isArray(cfg.agents)
             ? cfg.agents
             : Array.isArray(cfg.agents?.list)
@@ -7586,7 +8678,7 @@ ORDER BY day DESC, cost DESC;`;
           delete prompts[canonicalAgent.slice(5)];
         }
 
-        fs.writeFileSync(promptsFile, JSON.stringify(prompts, null, 2), "utf8");
+        await fs.promises.writeFile(promptsFile, JSON.stringify(prompts, null, 2), "utf8");
         console.log(
           `[dashboard] Prompt updated for ${canonicalAgent} (${prompt.length} chars)`,
         );
@@ -7624,11 +8716,11 @@ ORDER BY day DESC, cost DESC;`;
       ]);
       const MAX_FILES = 500;
       const results = [];
-      function walk(dir, depth) {
+      async function walk(dir, depth) {
         if (depth > 5) return;
         let entries;
         try {
-          entries = fs.readdirSync(dir, { withFileTypes: true });
+          entries = await fs.promises.readdir(dir, { withFileTypes: true });
         } catch {
           return;
         }
@@ -7636,12 +8728,12 @@ ORDER BY day DESC, cost DESC;`;
           if (e.name.startsWith(".") || e.name === "node_modules") continue;
           const full = path.join(dir, e.name);
           if (e.isDirectory()) {
-            walk(full, depth + 1);
+            await walk(full, depth + 1);
           } else if (e.isFile()) {
             const ext = path.extname(e.name).toLowerCase();
             if (!ALLOWED_EXT.has(ext)) continue;
             try {
-              const st = fs.statSync(full);
+              const st = await fs.promises.stat(full);
               results.push({ path: full, size: st.size, mtime: st.mtimeMs });
             } catch {
               /* skip */
@@ -7650,7 +8742,7 @@ ORDER BY day DESC, cost DESC;`;
           }
         }
       }
-      walk(scanDir, 0);
+      await walk(scanDir, 0);
       results.sort((a, b) => b.mtime - a.mtime);
       res.writeHead(200, {
         "content-type": "application/json",
@@ -7669,7 +8761,7 @@ ORDER BY day DESC, cost DESC;`;
         return;
       }
       try {
-        const raw = fs.readFileSync(filePath, "utf8");
+        const raw = await fs.promises.readFile(filePath, "utf8");
         const lines = raw.split("\n");
         const content =
           lines.length > 300
@@ -7710,17 +8802,17 @@ ORDER BY day DESC, cost DESC;`;
       "telegram-messages.jsonl",
     );
 
-    function loadTgConfig() {
+    async function loadTgConfig() {
       try {
-        return JSON.parse(fs.readFileSync(TG_CONFIG_PATH, "utf8"));
+        return JSON.parse(await fs.promises.readFile(TG_CONFIG_PATH, "utf8"));
       } catch {
         return {};
       }
     }
 
-    function isTgRunning() {
+    async function isTgRunning() {
       try {
-        const pid = parseInt(fs.readFileSync(TG_PID_PATH, "utf8").trim(), 10);
+        const pid = parseInt((await fs.promises.readFile(TG_PID_PATH, "utf8")).trim(), 10);
         if (!pid) return false;
         process.kill(pid, 0);
         return true;
@@ -7730,15 +8822,15 @@ ORDER BY day DESC, cost DESC;`;
     }
 
     if (url.pathname === "/api/telegram/status") {
-      const running = isTgRunning();
-      const cfg = loadTgConfig();
+      const running = await isTgRunning();
+      const cfg = await loadTgConfig();
       res.writeHead(200, { "content-type": "application/json" });
       res.end(JSON.stringify({ running, botName: cfg.botName || "" }));
       return;
     }
 
     if (url.pathname === "/api/telegram/config" && req.method === "GET") {
-      const cfg = loadTgConfig();
+      const cfg = await loadTgConfig();
       res.writeHead(200, { "content-type": "application/json" });
       res.end(
         JSON.stringify({
@@ -7757,9 +8849,9 @@ ORDER BY day DESC, cost DESC;`;
       let raw = "";
       for await (const chunk of req) raw += chunk;
       const body = JSON.parse(raw || "{}");
-      const existing = loadTgConfig();
+      const existing = await loadTgConfig();
       const updated = { ...existing, ...body };
-      fs.writeFileSync(TG_CONFIG_PATH, JSON.stringify(updated, null, 2));
+      await fs.promises.writeFile(TG_CONFIG_PATH, JSON.stringify(updated, null, 2));
       res.writeHead(200, { "content-type": "application/json" });
       res.end(JSON.stringify({ ok: true }));
       return;
@@ -7770,19 +8862,19 @@ ORDER BY day DESC, cost DESC;`;
       for await (const chunk of req) raw += chunk;
       const body = JSON.parse(raw || "{}");
       if (body.token) {
-        const existing = loadTgConfig();
-        fs.writeFileSync(
+        const existing = await loadTgConfig();
+        await fs.promises.writeFile(
           TG_CONFIG_PATH,
           JSON.stringify({ ...existing, ...body }, null, 2),
         );
       }
-      const cfg = loadTgConfig();
+      const cfg = await loadTgConfig();
       if (!cfg.token) {
         res.writeHead(400, { "content-type": "application/json" });
         res.end(JSON.stringify({ error: "No token configured" }));
         return;
       }
-      if (isTgRunning()) {
+      if (await isTgRunning()) {
         res.writeHead(200, { "content-type": "application/json" });
         res.end(JSON.stringify({ ok: true, message: "Already running" }));
         return;
@@ -7807,7 +8899,7 @@ ORDER BY day DESC, cost DESC;`;
 
     if (url.pathname === "/api/telegram/stop" && req.method === "POST") {
       try {
-        const pid = parseInt(fs.readFileSync(TG_PID_PATH, "utf8").trim(), 10);
+        const pid = parseInt((await fs.promises.readFile(TG_PID_PATH, "utf8")).trim(), 10);
         if (pid) process.kill(pid, "SIGTERM");
       } catch { }
       res.writeHead(200, { "content-type": "application/json" });
@@ -7817,7 +8909,7 @@ ORDER BY day DESC, cost DESC;`;
 
     if (url.pathname === "/api/telegram/messages") {
       try {
-        const raw = fs.readFileSync(TG_MSG_PATH, "utf8");
+        const raw = await fs.promises.readFile(TG_MSG_PATH, "utf8");
         const msgs = raw
           .trim()
           .split("\n")
@@ -7847,7 +8939,7 @@ ORDER BY day DESC, cost DESC;`;
           "logs",
           "telegram-bridge.jsonl",
         );
-        const raw = fs.readFileSync(TG_LOG_PATH, "utf8");
+        const raw = await fs.promises.readFile(TG_LOG_PATH, "utf8");
         const lines = raw.trim().split("\n").filter(Boolean);
         const topics = new Map(); // chatId:threadId -> {chatId, threadId, lastSeen, text}
 
@@ -7899,16 +8991,16 @@ ORDER BY day DESC, cost DESC;`;
     );
     const WA_AUTH_DIR = path.join(os.homedir(), ".crewswarm", "whatsapp-auth");
 
-    function loadWaCfg() {
+    async function loadWaCfg() {
       try {
-        return JSON.parse(fs.readFileSync(WA_CONFIG_PATH, "utf8"));
+        return JSON.parse(await fs.promises.readFile(WA_CONFIG_PATH, "utf8"));
       } catch {
         return {};
       }
     }
-    function isWaRunning() {
+    async function isWaRunning() {
       try {
-        const pid = parseInt(fs.readFileSync(WA_PID_PATH, "utf8").trim(), 10);
+        const pid = parseInt((await fs.promises.readFile(WA_PID_PATH, "utf8")).trim(), 10);
         if (!pid) return false;
         process.kill(pid, 0);
         return true;
@@ -7927,16 +9019,16 @@ ORDER BY day DESC, cost DESC;`;
     }
 
     if (url.pathname === "/api/whatsapp/status") {
-      const running = isWaRunning();
-      const authSaved = fs.existsSync(path.join(WA_AUTH_DIR, "creds.json"));
-      const cfg = loadWaCfg();
+      const running = await isWaRunning();
+      const authSaved = await exists(path.join(WA_AUTH_DIR, "creds.json"));
+      const cfg = await loadWaCfg();
       res.writeHead(200, { "content-type": "application/json" });
       res.end(JSON.stringify({ running, authSaved, number: cfg.number || "" }));
       return;
     }
 
     if (url.pathname === "/api/whatsapp/config" && req.method === "GET") {
-      const cfg = loadWaCfg();
+      const cfg = await loadWaCfg();
       res.writeHead(200, { "content-type": "application/json" });
       res.end(
         JSON.stringify({
@@ -7953,8 +9045,8 @@ ORDER BY day DESC, cost DESC;`;
       let raw = "";
       for await (const chunk of req) raw += chunk;
       const body = JSON.parse(raw || "{}");
-      const existing = loadWaCfg();
-      fs.writeFileSync(
+      const existing = await loadWaCfg();
+      await fs.promises.writeFile(
         WA_CONFIG_PATH,
         JSON.stringify({ ...existing, ...body }, null, 2),
       );
@@ -7965,13 +9057,13 @@ ORDER BY day DESC, cost DESC;`;
           ".crewswarm",
           "crewswarm.json",
         );
-        const swarm = JSON.parse(fs.readFileSync(swarmPath, "utf8"));
+        const swarm = JSON.parse(await fs.promises.readFile(swarmPath, "utf8"));
         swarm.env = swarm.env || {};
         if (body.allowedNumbers !== undefined) {
           swarm.env.WA_ALLOWED_NUMBERS = (body.allowedNumbers || []).join(",");
         }
         if (body.targetAgent) swarm.env.WA_TARGET_AGENT = body.targetAgent;
-        fs.writeFileSync(swarmPath, JSON.stringify(swarm, null, 2));
+        await fs.promises.writeFile(swarmPath, JSON.stringify(swarm, null, 2));
       } catch { }
       res.writeHead(200, { "content-type": "application/json" });
       res.end(JSON.stringify({ ok: true }));
@@ -7979,24 +9071,21 @@ ORDER BY day DESC, cost DESC;`;
     }
 
     if (url.pathname === "/api/whatsapp/start" && req.method === "POST") {
-      if (isWaRunning()) {
+      if (await isWaRunning()) {
         res.writeHead(200, { "content-type": "application/json" });
         res.end(JSON.stringify({ ok: true, message: "Already running" }));
         return;
       }
-      const cfg = loadWaCfg();
-      const swarm = (() => {
-        try {
-          return JSON.parse(
-            fs.readFileSync(
-              path.join(os.homedir(), ".crewswarm", "crewswarm.json"),
-              "utf8",
-            ),
-          );
-        } catch {
-          return {};
-        }
-      })();
+      const cfg = await loadWaCfg();
+      let swarm = {};
+      try {
+        swarm = JSON.parse(
+          await fs.promises.readFile(
+            path.join(os.homedir(), ".crewswarm", "crewswarm.json"),
+            "utf8",
+          ),
+        );
+      } catch { }
       const waEnv = swarm.env || {};
       const { spawn: spawnBridge } = await import("node:child_process");
       const bridgePath = path.join(CREWSWARM_DIR, "whatsapp-bridge.mjs");
@@ -8018,7 +9107,7 @@ ORDER BY day DESC, cost DESC;`;
       });
       proc.unref();
       await new Promise((r) => setTimeout(r, 1500));
-      const running = isWaRunning();
+      const running = await isWaRunning();
       res.writeHead(running ? 200 : 500, { "content-type": "application/json" });
       res.end(
         JSON.stringify({
@@ -8034,7 +9123,7 @@ ORDER BY day DESC, cost DESC;`;
 
     if (url.pathname === "/api/whatsapp/stop" && req.method === "POST") {
       try {
-        const pid = parseInt(fs.readFileSync(WA_PID_PATH, "utf8").trim(), 10);
+        const pid = parseInt((await fs.promises.readFile(WA_PID_PATH, "utf8")).trim(), 10);
         if (pid) process.kill(pid, "SIGTERM");
       } catch { }
       res.writeHead(200, { "content-type": "application/json" });
@@ -8044,7 +9133,7 @@ ORDER BY day DESC, cost DESC;`;
 
     if (url.pathname === "/api/whatsapp/messages") {
       try {
-        const raw = fs.readFileSync(WA_MSG_PATH, "utf8");
+        const raw = await fs.promises.readFile(WA_MSG_PATH, "utf8");
         const msgs = raw
           .trim()
           .split("\n")
@@ -8117,11 +9206,22 @@ ORDER BY day DESC, cost DESC;`;
     }
 
     if (url.pathname === "/api/contacts/delete" && req.method === "POST") {
+      let raw = "";
+      for await (const chunk of req) raw += chunk;
+      let parsed;
+      try { parsed = JSON.parse(raw || "{}"); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vr = validate(ContactDeleteSchema, parsed);
+      if (!vr.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vr.error }));
+        return;
+      }
+      const { contactId } = vr.data;
       try {
-        let raw = "";
-        for await (const chunk of req) raw += chunk;
-        const { contactId } = JSON.parse(raw || "{}");
-        if (!contactId) throw new Error("contactId required");
         const { deleteContact } = await import("../lib/contacts/index.mjs");
         deleteContact(contactId);
         res.writeHead(200, { "content-type": "application/json" });
@@ -8134,12 +9234,22 @@ ORDER BY day DESC, cost DESC;`;
     }
 
     if (url.pathname === "/api/contacts/send" && req.method === "POST") {
+      let raw = "";
+      for await (const chunk of req) raw += chunk;
+      let parsedSend;
+      try { parsedSend = JSON.parse(raw || "{}"); } catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: "Invalid JSON" }));
+        return;
+      }
+      const vrSend = validate(ContactSendSchema, parsedSend);
+      if (!vrSend.ok) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: vrSend.error }));
+        return;
+      }
+      const { contactId, platform, message } = vrSend.data;
       try {
-        let raw = "";
-        for await (const chunk of req) raw += chunk;
-        const { contactId, platform, message } = JSON.parse(raw || "{}");
-        if (!contactId || !message)
-          throw new Error("contactId and message required");
 
         const { getContact } = await import("../lib/contacts/index.mjs");
         const contact = getContact(contactId);
@@ -8155,12 +9265,19 @@ ORDER BY day DESC, cost DESC;`;
               : platformLinks.whatsapp;
           if (waJid) {
             // Call WhatsApp bridge's sendMessage function
-            const waUrl = `http://127.0.0.1:${process.env.WA_HTTP_PORT || 3000}/send`;
-            await fetch(waUrl, {
+            const waUrl = `http://127.0.0.1:${process.env.WA_HTTP_PORT || 5015}/send`;
+            const waRes = await fetch(waUrl, {
               method: "POST",
               headers: { "content-type": "application/json" },
-              body: JSON.stringify({ jid: waJid, message }),
+              body: JSON.stringify({ jid: waJid, text: message }),
             });
+            const waData = await waRes.json().catch(() => ({}));
+            if (!waRes.ok || !waData.ok) {
+              throw new Error(
+                waData.error ||
+                  `WhatsApp send failed (${waRes.status})`,
+              );
+            }
           }
         }
 
@@ -8176,10 +9293,10 @@ ORDER BY day DESC, cost DESC;`;
               ".crewswarm",
               "telegram-bridge.json",
             );
-            const tgCfg = JSON.parse(fs.readFileSync(TG_CONFIG_PATH, "utf8"));
+            const tgCfg = JSON.parse(await fs.promises.readFile(TG_CONFIG_PATH, "utf8"));
             const botToken = tgCfg.token;
             if (botToken) {
-              await fetch(
+              const tgRes = await fetch(
                 `https://api.telegram.org/bot${botToken}/sendMessage`,
                 {
                   method: "POST",
@@ -8187,6 +9304,14 @@ ORDER BY day DESC, cost DESC;`;
                   body: JSON.stringify({ chat_id: tgChatId, text: message }),
                 },
               );
+              const tgData = await tgRes.json().catch(() => ({}));
+              if (!tgRes.ok || !tgData.ok) {
+                throw new Error(
+                  tgData.description ||
+                    tgData.error ||
+                    `Telegram send failed (${tgRes.status})`,
+                );
+              }
             }
           }
         }
@@ -8204,9 +9329,49 @@ ORDER BY day DESC, cost DESC;`;
     if (url.pathname === "/api/services/status") {
       let services;
       try {
-        const { execSync } = await import("node:child_process");
+        const { exec: execCb } = await import("node:child_process");
         const net = await import("node:net");
 
+        // Single ps snapshot — avoids spawning dozens of pgrep child processes
+        const psSnapshot = await new Promise((resolve) => {
+          execCb("ps ax -o pid=,command=", { encoding: "utf8", timeout: 2000 }, (err, stdout) => {
+            resolve(err ? "" : stdout || "");
+          });
+        });
+
+        function findPid(pattern) {
+          const re = new RegExp(pattern);
+          for (const line of psSnapshot.split("\n")) {
+            const trimmed = line.trim();
+            if (!trimmed) continue;
+            const spaceIdx = trimmed.indexOf(" ");
+            if (spaceIdx < 0) continue;
+            const pid = parseInt(trimmed.slice(0, spaceIdx), 10);
+            const cmd = trimmed.slice(spaceIdx + 1);
+            if (re.test(cmd)) return pid;
+          }
+          return null;
+        }
+
+        function findAllPids(pattern) {
+          const re = new RegExp(pattern);
+          const pids = [];
+          for (const line of psSnapshot.split("\n")) {
+            const trimmed = line.trim();
+            if (!trimmed) continue;
+            const spaceIdx = trimmed.indexOf(" ");
+            if (spaceIdx < 0) continue;
+            const pid = parseInt(trimmed.slice(0, spaceIdx), 10);
+            const cmd = trimmed.slice(spaceIdx + 1);
+            if (re.test(cmd)) pids.push(pid);
+          }
+          return pids;
+        }
+
+        function countProcs(pattern) {
+          return findAllPids(pattern).length;
+        }
+
         function portListening(port, timeoutMs = 2000) {
           return new Promise((resolve) => {
             const sock = new net.default.Socket();
@@ -8240,9 +9405,9 @@ ORDER BY day DESC, cost DESC;`;
           }
         }
 
-        function pidRunning(pidFile) {
+        async function pidRunning(pidFile) {
           try {
-            const pid = parseInt(fs.readFileSync(pidFile, "utf8").trim(), 10);
+            const pid = parseInt((await fs.promises.readFile(pidFile, "utf8")).trim(), 10);
             if (!pid) return null;
             process.kill(pid, 0);
             return pid;
@@ -8251,85 +9416,41 @@ ORDER BY day DESC, cost DESC;`;
           }
         }
 
-        function countProcs(pattern) {
-          try {
-            const out = execSync(`pgrep -f "${pattern}" | wc -l`, {
-              encoding: "utf8",
-              timeout: 300,
-              stdio: ["pipe", "pipe", "pipe"],
-            }).trim();
-            return parseInt(out, 10) || 0;
-          } catch {
-            return 0;
-          }
-        }
-
-        function getPid(pattern) {
-          try {
-            const out = execSync(`pgrep -f "${pattern}"`, {
-              encoding: "utf8",
-              timeout: 300,
-              stdio: ["pipe", "pipe", "pipe"],
-            }).trim();
-            const pids = out
-              .split("\n")
-              .filter(Boolean)
-              .map((p) => parseInt(p, 10));
-            return pids.length > 0 ? pids[0] : null;
-          } catch {
-            return null;
-          }
-        }
-
-        function getAllPids(pattern) {
-          try {
-            const out = execSync(`pgrep -f "${pattern}"`, {
-              encoding: "utf8",
-              timeout: 300,
-              stdio: ["pipe", "pipe", "pipe"],
-            }).trim();
-            return out
-              .split("\n")
-              .filter(Boolean)
-              .map((p) => parseInt(p, 10));
-          } catch {
-            return [];
+        async function commandExistsFast(bin, extraPaths = []) {
+          const candidate = String(bin || "").trim();
+          if (!candidate) return false;
+          if (candidate.includes("/")) {
+            return await exists(candidate);
           }
-        }
-
-        function procStartTime(pid) {
-          try {
-            const out = execSync(`ps -p ${pid} -o lstart=`, {
-              encoding: "utf8",
-              timeout: 300,
-              stdio: ["pipe", "pipe", "pipe"],
-            }).trim();
-            return out ? new Date(out).getTime() : null;
-          } catch {
-            return null;
+          const checks = [
+            ...extraPaths,
+            path.join("/usr/local/bin", candidate),
+            path.join("/opt/homebrew/bin", candidate),
+            path.join(os.homedir(), ".local", "bin", candidate),
+            path.join(os.homedir(), "bin", candidate),
+          ];
+          for (const item of checks) {
+            if (item && await exists(item)) return true;
           }
+          return false;
         }
 
         const crewLeadPort = Number(process.env.CREW_LEAD_PORT || 5010);
-        const tgPid = pidRunning(
+        const tgPid = await pidRunning(
           path.join(os.homedir(), ".crewswarm", "logs", "telegram-bridge.pid"),
         );
         const waPid =
-          pidRunning(
+          (await pidRunning(
             path.join(os.homedir(), ".crewswarm", "logs", "whatsapp-bridge.pid"),
-          ) || getPid("whatsapp-bridge.mjs");
+          )) || findPid("whatsapp-bridge\\.mjs");
+
+        // Fire network checks in parallel — all process lookups are instant (ps snapshot)
         const rtStatusPromise = fetch("http://127.0.0.1:18889/status", {
-          signal: AbortSignal.timeout(2000),
+          signal: AbortSignal.timeout(5000),
         });
         const mcpHealthPromise = httpOk("http://127.0.0.1:5020/health", 3000);
         const [
-          rtUp,
-          crewLeadUp,
-          gwUp,
-          ocPortUp,
-          dashUp,
-          studioUp,
-          watchUp,
+          rtUp, crewLeadUp, gwUp, ocPortUp, dashUp, studioUp, watchUp,
         ] = await Promise.all([
           portListening(18889),
           portListening(crewLeadPort),
@@ -8339,37 +9460,38 @@ ORDER BY day DESC, cost DESC;`;
           portListening(3333),
           portListening(3334),
         ]);
-        const rtPid = getPid("opencrew-rt-daemon");
-        const crewLeadPid = getPid("crew-lead.mjs");
-        const gwPid = getPid("openclaw-gateway");
+
+        // All PID lookups are instant — pure JS regex against ps snapshot
+        const rtPid = findPid("opencrew-rt-daemon");
+        const crewLeadPid = findPid("crew-lead\\.mjs");
+        const gwPid = findPid("openclaw-gateway");
+        const ocPid = findPid("\\.opencode serve") || findPid("opencode serve") || findPid("bin/\\.opencode");
+        const mcpPid = findPid("mcp-server\\.mjs");
+        const studioPid = findPid("apps/vibe/server\\.mjs") || findPid("npm.*studio:start");
+        const watchPid = findPid("watch-server\\.mjs");
+
+        // commandExists — fs.existsSync only, no shell spawn
+        const codexInstalled = await commandExistsFast(process.env.CODEX_CLI_BIN || "codex");
+        const claudeInstalled = await commandExistsFast(process.env.CLAUDE_CODE_BIN || "claude");
+        const cursorInstalled = (await commandExistsFast(
+          process.env.CURSOR_CLI_BIN || path.join(os.homedir(), ".local", "bin", "agent"),
+          [path.join(os.homedir(), ".local", "bin", "agent")],
+        )) || (await commandExistsFast("agent", [path.join(os.homedir(), ".local", "bin", "agent")]));
+        const geminiInstalled = await commandExistsFast(process.env.GEMINI_CLI_BIN || "gemini");
+        const crewCliInstalled = (await commandExistsFast("crew", [
+          path.join(CREWSWARM_DIR, "crew-cli", "dist", "index.js"),
+        ])) || (await exists(path.join(CREWSWARM_DIR, "crew-cli", "dist", "index.js")));
         const oclawPaired =
-          fs.existsSync(
+          (await exists(
             path.join(os.homedir(), ".openclaw", "devices", "paired.json"),
-          ) ||
-          fs.existsSync(path.join(os.homedir(), ".openclaw", "device.json"));
-        const ocPid =
-          getPid("\\.opencode serve") ||
-          getPid("opencode serve") ||
-          getPid("bin/.opencode") ||
-          getPid("/.opencode");
+          )) ||
+          (await exists(path.join(os.homedir(), ".openclaw", "device.json")));
         const ocUp = ocPortUp || ocPid !== null;
-        const codexInstalled = commandExists(process.env.CODEX_CLI_BIN || "codex");
-        const claudeInstalled = commandExists(process.env.CLAUDE_CODE_BIN || "claude");
-        const cursorInstalled = commandExists(
-          process.env.CURSOR_CLI_BIN ||
-            path.join(os.homedir(), ".local", "bin", "agent"),
-          [path.join(os.homedir(), ".local", "bin", "agent")],
-        ) || commandExists("agent", [path.join(os.homedir(), ".local", "bin", "agent")]);
-        const geminiInstalled = commandExists(process.env.GEMINI_CLI_BIN || "gemini");
-        const crewCliInstalled =
-          commandExists("crew", [
-            path.join(CREWSWARM_DIR, "crew-cli", "dist", "index.js"),
-          ]) ||
-          fs.existsSync(path.join(CREWSWARM_DIR, "crew-cli", "dist", "index.js"));
+
         let swarmCfg = {};
         try {
           swarmCfg = JSON.parse(
-            fs.readFileSync(
+            await fs.promises.readFile(
               path.join(os.homedir(), ".crewswarm", "crewswarm.json"),
               "utf8",
             ),
@@ -8391,10 +9513,6 @@ ORDER BY day DESC, cost DESC;`;
           cfgEnv.CREWSWARM_OPENCODE_ENABLED === "1" ||
           process.env.CREWSWARM_OPENCODE_ENABLED === "on" ||
           process.env.CREWSWARM_OPENCODE_ENABLED === "1";
-        const mcpPid = getPid("mcp-server.mjs");
-        const studioPid =
-          getPid("apps/vibe/server.mjs") || getPid("npm.*studio:start");
-        const watchPid = getPid("watch-server.mjs");
 
         // Agent count: ask RT bus which agents are actually connected (most reliable source)
         let agentsOnline = 0;
@@ -8408,11 +9526,11 @@ ORDER BY day DESC, cost DESC;`;
             (a) => String(a).toLowerCase() !== "crew-lead",
           );
           agentsOnline = rtAgentList.length;
-          agentPids = getAllPids("gateway-bridge.mjs --rt-daemon");
+          agentPids = findAllPids("gateway-bridge\\.mjs --rt-daemon");
         } catch {
-          // RT not reachable — fall back to pgrep for count, config for names
-          agentsOnline = countProcs("gateway-bridge.mjs --rt-daemon");
-          agentPids = getAllPids("gateway-bridge.mjs --rt-daemon");
+          // RT not reachable — fall back to ps snapshot for count, config for names
+          agentsOnline = countProcs("gateway-bridge\\.mjs --rt-daemon");
+          agentPids = findAllPids("gateway-bridge\\.mjs --rt-daemon");
           try {
             rtAgentList = (swarmCfg.agents || [])
               .map((a) => a.id)
@@ -8428,7 +9546,7 @@ ORDER BY day DESC, cost DESC;`;
         } catch { }
         if (agentsTotal === 0) agentsTotal = 14;
         agentsTotal = Math.max(agentsTotal, agentsOnline);
-        const pmCount = countProcs("pm-loop.mjs");
+        const pmCount = countProcs("pm-loop\\.mjs");
 
         services = [
           {
@@ -8458,7 +9576,7 @@ ORDER BY day DESC, cost DESC;`;
           {
             id: "crew-lead",
             label: "crew-lead",
-            description: "Chat commander — dashboard chat, CrewChat, Telegram",
+            description: "Chat commander — dashboard chat, crewchat, Telegram",
             port: crewLeadPort,
             running: crewLeadUp,
             canRestart: true,
@@ -8590,7 +9708,7 @@ ORDER BY day DESC, cost DESC;`;
             label: "Vibe UI",
             description: studioUp
               ? "Monaco editor + agent chat — Cursor-like IDE for crewswarm"
-              : "Run: npm run studio:start (port 3333)",
+              : "Run: npm run vibe:start (port 3333)",
             port: 3333,
             running: studioUp,
             canRestart: true,
@@ -8602,7 +9720,7 @@ ORDER BY day DESC, cost DESC;`;
             label: "Vibe Watch Server",
             description: watchUp
               ? "CLI → Vibe live reload WebSocket relay (port 3334)"
-              : "Run: npm run studio:watch — enables live file reload in Vibe",
+              : "Run: npm run vibe:watch — enables live file reload in Vibe",
             port: 3334,
             running: watchUp,
             canRestart: true,
@@ -8637,12 +9755,8 @@ ORDER BY day DESC, cost DESC;`;
             canRestart: false,
             pid: (() => {
               try {
-                const pids = execSync("pgrep -f 'pm-loop.mjs'", {
-                  encoding: "utf8",
-                  timeout: 300,
-                  stdio: ["pipe", "pipe", "pipe"],
-                }).trim().split("\n").filter(Boolean).map(p => parseInt(p, 10));
-                return pids.length === 1 ? pids[0] : pids;
+                const pids = findAllPids("pm-loop\\.mjs");
+                return pids.length === 1 ? pids[0] : (pids.length > 0 ? pids : null);
               } catch {
                 return null;
               }
@@ -8854,17 +9968,15 @@ ORDER BY day DESC, cost DESC;`;
       } else if (id === "telegram") {
         try {
           const pid = parseInt(
-            fs
-              .readFileSync(
-                path.join(
-                  os.homedir(),
-                  ".crewswarm",
-                  "logs",
-                  "telegram-bridge.pid",
-                ),
-                "utf8",
-              )
-              .trim(),
+            (await fs.promises.readFile(
+              path.join(
+                os.homedir(),
+                ".crewswarm",
+                "logs",
+                "telegram-bridge.pid",
+              ),
+              "utf8",
+            )).trim(),
             10,
           );
           if (pid) process.kill(pid, "SIGTERM");
@@ -8872,17 +9984,15 @@ ORDER BY day DESC, cost DESC;`;
       } else if (id === "whatsapp") {
         try {
           const pid = parseInt(
-            fs
-              .readFileSync(
-                path.join(
-                  os.homedir(),
-                  ".crewswarm",
-                  "logs",
-                  "whatsapp-bridge.pid",
-                ),
-                "utf8",
-              )
-              .trim(),
+            (await fs.promises.readFile(
+              path.join(
+                os.homedir(),
+                ".crewswarm",
+                "logs",
+                "whatsapp-bridge.pid",
+              ),
+              "utf8",
+            )).trim(),
             10,
           );
           if (pid) process.kill(pid, "SIGTERM");
@@ -8898,8 +10008,8 @@ ORDER BY day DESC, cost DESC;`;
         let killed = false;
 
         try {
-          if (fs.existsSync(pidFile)) {
-            const pid = parseInt(fs.readFileSync(pidFile, "utf8").trim(), 10);
+          if (await exists(pidFile)) {
+            const pid = parseInt((await fs.promises.readFile(pidFile, "utf8")).trim(), 10);
             if (pid && !isNaN(pid)) {
               try {
                 process.kill(pid, 0); // Check if process exists
@@ -8911,7 +10021,7 @@ ORDER BY day DESC, cost DESC;`;
                 );
               } catch (e) {
                 // Process doesn't exist, clean up stale PID file
-                fs.writeFileSync(pidFile, "");
+                await fs.promises.writeFile(pidFile, "");
               }
             }
           }
@@ -9153,20 +10263,7 @@ ORDER BY day DESC, cost DESC;`;
         .filter(Boolean)
         .join("\n");
 
-      const token = (() => {
-        try {
-          return (
-            JSON.parse(
-              fs.readFileSync(
-                path.join(os.homedir(), ".crewswarm", "crewswarm.json"),
-                "utf8",
-              ),
-            )?.rt?.authToken || ""
-          );
-        } catch {
-          return "";
-        }
-      })();
+      const token = resolveCrewLeadAuthToken();
       try {
         const upstream = await fetch(
           "http://127.0.0.1:5010/api/engine-passthrough",
@@ -9282,13 +10379,11 @@ ORDER BY day DESC, cost DESC;`;
         const userDir = path.join(os.homedir(), ".crewswarm", "engines");
         const enginesMap = {};
         for (const dir of [bundledDir, userDir]) {
-          if (!fs.existsSync(dir)) continue;
-          for (const f of fs
-            .readdirSync(dir)
-            .filter((f) => f.endsWith(".json"))) {
+          if (!await exists(dir)) continue;
+          for (const f of (await fs.promises.readdir(dir)).filter((f) => f.endsWith(".json"))) {
             try {
               const eng = JSON.parse(
-                fs.readFileSync(path.join(dir, f), "utf8"),
+                await fs.promises.readFile(path.join(dir, f), "utf8"),
               );
               if (eng.id)
                 enginesMap[eng.id] = {
@@ -9302,11 +10397,11 @@ ORDER BY day DESC, cost DESC;`;
         const configPath = path.join(os.homedir(), ".crewswarm", "crewswarm.json");
         let envVars = {};
         try {
-          const cfg = JSON.parse(fs.readFileSync(configPath, "utf8"));
+          const cfg = JSON.parse(await fs.promises.readFile(configPath, "utf8"));
           envVars = cfg.env || {};
         } catch { }
 
-        const engines = Object.values(enginesMap).map((eng) => {
+        const engines = await Promise.all(Object.values(enginesMap).map(async (eng) => {
           let installed = false;
           try {
             const bin = eng.bin || eng.id;
@@ -9315,7 +10410,7 @@ ORDER BY day DESC, cost DESC;`;
           } catch {
             if (eng.binAlternate) {
               const alt = eng.binAlternate.replace(/^~/, os.homedir());
-              installed = fs.existsSync(alt);
+              installed = await exists(alt);
             }
           }
           const missingEnv = eng.requiresAuth
@@ -9336,7 +10431,7 @@ ORDER BY day DESC, cost DESC;`;
             ready: installed && missingEnv.length === 0,
             enabled,
           };
-        });
+        }));
         res.writeHead(200, { "content-type": "application/json" });
         res.end(JSON.stringify({ engines }));
       } catch (err) {
@@ -9363,10 +10458,10 @@ ORDER BY day DESC, cost DESC;`;
         if (!eng.id || !eng.label)
           throw new Error("Engine descriptor must have id and label");
         const engDir = path.join(os.homedir(), ".crewswarm", "engines");
-        if (!fs.existsSync(engDir)) fs.mkdirSync(engDir, { recursive: true });
+        if (!await exists(engDir)) await fs.promises.mkdir(engDir, { recursive: true });
         const outPath = path.join(engDir, `${eng.id}.json`);
         if (!outPath.startsWith(engDir)) throw new Error("Invalid engine id");
-        fs.writeFileSync(outPath, JSON.stringify(eng, null, 2), "utf8");
+        await fs.promises.writeFile(outPath, JSON.stringify(eng, null, 2), "utf8");
         res.writeHead(200, { "content-type": "application/json" });
         res.end(JSON.stringify({ ok: true, id: eng.id, label: eng.label }));
       } catch (err) {
@@ -9389,8 +10484,8 @@ ORDER BY day DESC, cost DESC;`;
         let engineDef = null;
         for (const dir of [bundledDir, userDir]) {
           const p = path.join(dir, `${engineId}.json`);
-          if (fs.existsSync(p)) {
-            engineDef = JSON.parse(fs.readFileSync(p, "utf8"));
+          if (await exists(p)) {
+            engineDef = JSON.parse(await fs.promises.readFile(p, "utf8"));
             break;
           }
         }
@@ -9401,12 +10496,12 @@ ORDER BY day DESC, cost DESC;`;
 
         const envVarName = engineDef.envToggle;
         const configPath = path.join(os.homedir(), ".crewswarm", "crewswarm.json");
-        const cfg = JSON.parse(fs.readFileSync(configPath, "utf8"));
+        const cfg = JSON.parse(await fs.promises.readFile(configPath, "utf8"));
 
         if (!cfg.env) cfg.env = {};
         cfg.env[envVarName] = enabled ? "1" : "off";
 
-        fs.writeFileSync(configPath, JSON.stringify(cfg, null, 2), "utf8");
+        await fs.promises.writeFile(configPath, JSON.stringify(cfg, null, 2), "utf8");
 
         res.writeHead(200, { "content-type": "application/json" });
         res.end(JSON.stringify({ ok: true, engineId, enabled, envVar: envVarName }));
@@ -9427,7 +10522,7 @@ ORDER BY day DESC, cost DESC;`;
         return;
       }
       try {
-        fs.unlinkSync(target);
+        await fs.promises.unlink(target);
       } catch { }
       res.writeHead(200, { "content-type": "application/json" });
       res.end(JSON.stringify({ ok: true }));
@@ -9583,13 +10678,13 @@ ORDER BY day DESC, cost DESC;`;
           ".crewswarm",
           "skills",
         );
-        if (!fs.existsSync(skillsDir))
-          fs.mkdirSync(skillsDir, { recursive: true });
+        if (!await exists(skillsDir))
+          await fs.promises.mkdir(skillsDir, { recursive: true });
         const outPath = path.join(skillsDir, `${skillName}.json`);
         // Final path traversal guard
         if (!outPath.startsWith(skillsDir))
           throw new Error("Invalid skill name");
-        fs.writeFileSync(outPath, JSON.stringify(skill, null, 2), "utf8");
+        await fs.promises.writeFile(outPath, JSON.stringify(skill, null, 2), "utf8");
 
         res.writeHead(200, { "content-type": "application/json" });
         res.end(
@@ -9683,14 +10778,35 @@ if (process.argv.includes("--print-html")) {
 }
 
 process.on("uncaughtException", (err) => {
+  const msg = String(err?.message || err || "");
   console.error(
     "[dashboard] uncaughtException:",
-    err?.stack || err?.message || err,
+    err?.stack || msg,
   );
 
-  // Always exit on uncaught exceptions — process is in undefined state
-  console.error("[dashboard] FATAL — exiting due to uncaught exception");
-  process.exit(1);
+  // Benign errors from engine passthrough / SSE streams — keep alive
+  if (
+    msg === "terminated" ||
+    msg === "aborted" ||
+    /client.*disconnect/i.test(msg) ||
+    /socket hang up/i.test(msg) ||
+    /ECONNRESET/i.test(msg) ||
+    /EPIPE/i.test(msg) ||
+    /fetch failed/i.test(msg) ||
+    /UND_ERR/i.test(msg)
+  ) {
+    console.error("[dashboard] Non-fatal uncaughtException — keeping alive");
+    return;
+  }
+
+  // Fatal errors: port conflicts, permissions, OOM — must exit
+  if (/EADDRINUSE|EACCES|out of memory|cannot allocate/i.test(msg)) {
+    console.error("[dashboard] FATAL — exiting due to uncaught exception");
+    process.exit(1);
+  }
+
+  // Default: log but keep alive — engine passthrough errors shouldn't kill the dashboard
+  console.error("[dashboard] Unexpected uncaughtException — keeping alive (not fatal)");
 });
 
 process.on("unhandledRejection", (reason) => {