fluxy-bot 0.8.9 → 0.9.0

package/worker/index.ts

@@ -5,131 +5,66 @@ import path from 'path';
 import { loadConfig, saveConfig } from '../shared/config.js';
 import { paths, WORKSPACE_DIR } from '../shared/paths.js';
 import { log } from '../shared/logger.js';
-import {
-    initDb,
-    closeDb,
-    listConversations,
-    createConversation,
-    deleteConversation,
-    getMessages,
-    addMessage,
-    getSetting,
-    getAllSettings,
-    setSetting,
-    createSession,
-    getSession,
-    deleteExpiredSessions,
-    getRecentMessages,
-    getMessagesBefore,
-    addPushSubscription,
-    removePushSubscription,
-    getAllPushSubscriptions,
-    getPushSubscriptionByEndpoint,
-    createTrustedDevice,
-    getTrustedDevice,
-    updateDeviceLastSeen,
-    listTrustedDevices,
-    deleteTrustedDevice,
-    deleteExpiredDevices,
-    deleteAllTrustedDevices
-} from './db.js';
+import { initDb, closeDb, listConversations, createConversation, deleteConversation, getMessages, addMessage, getSetting, getAllSettings, setSetting, createSession, getSession, deleteExpiredSessions, getRecentMessages, getMessagesBefore, addPushSubscription, removePushSubscription, getAllPushSubscriptions, getPushSubscriptionByEndpoint, createTrustedDevice, getTrustedDevice, updateDeviceLastSeen, listTrustedDevices, deleteTrustedDevice, deleteExpiredDevices, deleteAllTrustedDevices } from './db.js';
 import webpush from 'web-push';
 import { TOTP } from 'otpauth';
 import QRCode from 'qrcode';
-import {
-    startCodexOAuth,
-    cancelCodexOAuth,
-    getCodexAuthStatus,
-    readCodexAccessToken
-} from './codex-auth.js';
-import {
-    startClaudeOAuth,
-    exchangeClaudeCode,
-    getClaudeAuthStatus,
-    readClaudeAccessToken
-} from './claude-auth.js';
-import {
-    checkAvailability,
-    registerHandle,
-    claimReservedHandle,
-    releaseHandle,
-    updateTunnelUrl,
-    startHeartbeat,
-    stopHeartbeat
-} from '../shared/relay.js';
+import { startCodexOAuth, cancelCodexOAuth, getCodexAuthStatus, readCodexAccessToken } from './codex-auth.js';
+import { startClaudeOAuth, exchangeClaudeCode, getClaudeAuthStatus, readClaudeAccessToken } from './claude-auth.js';
+import { checkAvailability, registerHandle, claimReservedHandle, releaseHandle, updateTunnelUrl, startHeartbeat, stopHeartbeat } from '../shared/relay.js';
 import { ensureFileDirs } from '../supervisor/file-saver.js';
 
 // ── Password hashing (scrypt) ──
 
 function hashPassword(password: string): string {
-    const salt = crypto.randomBytes(16).toString('hex');
-    const hash = crypto.scryptSync(password, salt, 64).toString('hex');
-    return `${salt}:${hash}`;
+  const salt = crypto.randomBytes(16).toString('hex');
+  const hash = crypto.scryptSync(password, salt, 64).toString('hex');
+  return `${salt}:${hash}`;
 }
 
 function verifyPassword(password: string, stored: string): boolean {
-    const [salt, hash] = stored.split(':');
-    const test = crypto.scryptSync(password, salt, 64).toString('hex');
-    return hash === test;
+  const [salt, hash] = stored.split(':');
+  const test = crypto.scryptSync(password, salt, 64).toString('hex');
+  return hash === test;
 }
 
 // ── TOTP helpers ──
 
 function generateTOTPSecret(): string {
-    return crypto
-        .randomBytes(20)
-        .toString('base64url')
-        .replace(/[^A-Z2-7]/gi, '')
-        .slice(0, 32)
-        .toUpperCase();
+  return crypto.randomBytes(20).toString('base64url').replace(/[^A-Z2-7]/gi, '').slice(0, 32).toUpperCase();
 }
 
 function verifyTOTPCode(code: string, secret: string): boolean {
-    const totp = new TOTP({
-        issuer: 'Fluxy',
-        algorithm: 'SHA1',
-        digits: 6,
-        period: 30,
-        secret
-    });
-    const delta = totp.validate({ token: code, window: 1 });
-    return delta !== null;
+  const totp = new TOTP({ issuer: 'Fluxy', algorithm: 'SHA1', digits: 6, period: 30, secret });
+  const delta = totp.validate({ token: code, window: 1 });
+  return delta !== null;
 }
 
 function generateRecoveryCodes(): string[] {
-    const codes: string[] = [];
-    for (let i = 0; i < 8; i++) {
-        codes.push(crypto.randomBytes(4).toString('hex'));
-    }
-    return codes;
+  const codes: string[] = [];
+  for (let i = 0; i < 8; i++) {
+    codes.push(crypto.randomBytes(4).toString('hex'));
+  }
+  return codes;
 }
 
 function hashRecoveryCode(code: string): string {
-    return crypto.createHash('sha256').update(code.toLowerCase()).digest('hex');
+  return crypto.createHash('sha256').update(code.toLowerCase()).digest('hex');
 }
 
-function verifyRecoveryCode(
-    code: string,
-    hashes: string[]
-): { valid: boolean; remaining: string[] } {
-    const h = hashRecoveryCode(code);
-    const idx = hashes.indexOf(h);
-    if (idx === -1) return { valid: false, remaining: hashes };
-    const remaining = [...hashes];
-    remaining.splice(idx, 1);
-    return { valid: true, remaining };
+function verifyRecoveryCode(code: string, hashes: string[]): { valid: boolean; remaining: string[] } {
+  const h = hashRecoveryCode(code);
+  const idx = hashes.indexOf(h);
+  if (idx === -1) return { valid: false, remaining: hashes };
+  const remaining = [...hashes];
+  remaining.splice(idx, 1);
+  return { valid: true, remaining };
 }
 
-function parseCookie(
-    cookieHeader: string | undefined,
-    name: string
-): string | undefined {
-    if (!cookieHeader) return undefined;
-    const match = cookieHeader
-        .split(';')
-        .map(c => c.trim())
-        .find(c => c.startsWith(`${name}=`));
-    return match ? match.slice(name.length + 1) : undefined;
+function parseCookie(cookieHeader: string | undefined, name: string): string | undefined {
+  if (!cookieHeader) return undefined;
+  const match = cookieHeader.split(';').map(c => c.trim()).find(c => c.startsWith(`${name}=`));
+  return match ? match.slice(name.length + 1) : undefined;
 }
 
 const port = parseInt(process.env.WORKER_PORT || '3001', 10);
@@ -144,23 +79,23 @@ ensureFileDirs();
 // ── VAPID key management (Web Push) ──
 
 function getOrCreateVapidKeys() {
-    let publicKey = getSetting('vapid_public_key');
-    let privateKey = getSetting('vapid_private_key');
-    if (!publicKey || !privateKey) {
-        const keys = webpush.generateVAPIDKeys();
-        publicKey = keys.publicKey;
-        privateKey = keys.privateKey;
-        setSetting('vapid_public_key', publicKey);
-        setSetting('vapid_private_key', privateKey);
-        log.ok('Generated new VAPID keys');
-    }
-    return { publicKey, privateKey };
+  let publicKey = getSetting('vapid_public_key');
+  let privateKey = getSetting('vapid_private_key');
+  if (!publicKey || !privateKey) {
+    const keys = webpush.generateVAPIDKeys();
+    publicKey = keys.publicKey;
+    privateKey = keys.privateKey;
+    setSetting('vapid_public_key', publicKey);
+    setSetting('vapid_private_key', privateKey);
+    log.ok('Generated new VAPID keys');
+  }
+  return { publicKey, privateKey };
 }
 
 function initWebPush() {
-    const { publicKey, privateKey } = getOrCreateVapidKeys();
-    webpush.setVapidDetails('mailto:push@fluxy.bot', publicKey, privateKey);
-    log.ok('Web Push initialized');
+  const { publicKey, privateKey } = getOrCreateVapidKeys();
+  webpush.setVapidDetails('mailto:push@fluxy.bot', publicKey, privateKey);
+  log.ok('Web Push initialized');
 }
 
 initWebPush();
@@ -171,914 +106,742 @@ app.use(express.json({ limit: '10mb' }));
 
 // Prevent browsers/CDN/relay from caching API responses (avoids stale 502s)
 app.use('/api', (_, res, next) => {
-    res.set(
-        'Cache-Control',
-        'no-store, no-cache, must-revalidate, proxy-revalidate'
-    );
-    res.set('Pragma', 'no-cache');
-    res.set('Expires', '0');
-    res.set('Surrogate-Control', 'no-store');
-    next();
+  res.set('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
+  res.set('Pragma', 'no-cache');
+  res.set('Expires', '0');
+  res.set('Surrogate-Control', 'no-store');
+  next();
 });
 
 app.get('/api/health', (_, res) => res.json({ status: 'ok' }));
 app.get('/api/conversations', (_, res) => res.json(listConversations()));
 app.get('/api/conversations/:id', (req, res) => {
-    const msgs = getMessages(req.params.id);
-    res.json({ id: req.params.id, messages: msgs });
+  const msgs = getMessages(req.params.id);
+  res.json({ id: req.params.id, messages: msgs });
 });
 app.post('/api/conversations', (req, res) => {
-    const { title, model } = req.body || {};
-    const conv = createConversation(title, model);
-    res.json(conv);
+  const { title, model } = req.body || {};
+  const conv = createConversation(title, model);
+  res.json(conv);
 });
 app.post('/api/conversations/:id/messages', (req, res) => {
-    const { role, content, meta } = req.body || {};
-    if (!role || !content) {
-        res.status(400).json({ error: 'Missing role or content' });
-        return;
-    }
-    const msg = addMessage(req.params.id, role, content, meta);
-    res.json(msg);
+  const { role, content, meta } = req.body || {};
+  if (!role || !content) { res.status(400).json({ error: 'Missing role or content' }); return; }
+  const msg = addMessage(req.params.id, role, content, meta);
+  res.json(msg);
 });
 app.get('/api/conversations/:id/messages/recent', (req, res) => {
-    const limit = parseInt(req.query.limit as string) || 20;
-    const msgs = getRecentMessages(req.params.id, Math.min(limit, 100));
-    res.json(msgs);
+  const limit = parseInt(req.query.limit as string) || 20;
+  const msgs = getRecentMessages(req.params.id, Math.min(limit, 100));
+  res.json(msgs);
 });
 app.get('/api/conversations/:id/messages', (req, res) => {
-    const before = req.query.before as string;
-    const limit = Math.min(parseInt(req.query.limit as string) || 20, 100);
-    if (before) {
-        res.json(getMessagesBefore(req.params.id, before, limit));
-    } else {
-        res.json(getRecentMessages(req.params.id, limit));
-    }
-});
-app.delete('/api/conversations/:id', (req, res) => {
-    deleteConversation(req.params.id);
-    res.json({ ok: true });
-});
+  const before = req.query.before as string;
+  const limit = Math.min(parseInt(req.query.limit as string) || 20, 100);
+  if (before) {
+    res.json(getMessagesBefore(req.params.id, before, limit));
+  } else {
+    res.json(getRecentMessages(req.params.id, limit));
+  }
+});
+app.delete('/api/conversations/:id', (req, res) => { deleteConversation(req.params.id); res.json({ ok: true }); });
 app.get('/api/settings', (_, res) => res.json(getAllSettings()));
 app.put('/api/settings/:key', (req, res) => {
-    setSetting(req.params.key, req.body.value);
-    res.json({ ok: true });
+  setSetting(req.params.key, req.body.value);
+  res.json({ ok: true });
 });
 
 // ── Current conversation (shared across devices) ──
 
 app.get('/api/context/current', (_, res) => {
-    const convId = getSetting('current_conversation');
-    res.json({ conversationId: convId || null });
+  const convId = getSetting('current_conversation');
+  res.json({ conversationId: convId || null });
 });
 
 app.post('/api/context/set', (req, res) => {
-    const { conversationId } = req.body;
-    if (conversationId) {
-        setSetting('current_conversation', conversationId);
-    }
-    res.json({ ok: true });
+  const { conversationId } = req.body;
+  if (conversationId) {
+    setSetting('current_conversation', conversationId);
+  }
+  res.json({ ok: true });
 });
 
 app.post('/api/context/clear', (_, res) => {
-    setSetting('current_conversation', '');
-    res.json({ ok: true });
+  setSetting('current_conversation', '');
+  res.json({ ok: true });
 });
 
 // ── Codex OAuth routes ──
 
 app.post('/api/auth/codex/start', async (_req, res) => {
-    const result = await startCodexOAuth();
-    res.json(result);
+  const result = await startCodexOAuth();
+  res.json(result);
 });
 
 app.post('/api/auth/codex/cancel', (_req, res) => {
-    cancelCodexOAuth();
-    res.json({ ok: true });
+  cancelCodexOAuth();
+  res.json({ ok: true });
 });
 
 app.get('/api/auth/codex/status', (_req, res) => {
-    res.json(getCodexAuthStatus());
+  res.json(getCodexAuthStatus());
 });
 
 // ── Claude OAuth routes ──
 
 app.post('/api/auth/claude/start', (_req, res) => {
-    res.json(startClaudeOAuth());
+  res.json(startClaudeOAuth());
 });
 
 app.post('/api/auth/claude/exchange', async (req, res) => {
-    const { code } = req.body;
-    if (!code) {
-        res.json({ success: false, error: 'No code provided' });
-        return;
-    }
-    const result = await exchangeClaudeCode(code);
-    res.json(result);
+  const { code } = req.body;
+  if (!code) { res.json({ success: false, error: 'No code provided' }); return; }
+  const result = await exchangeClaudeCode(code);
+  res.json(result);
 });
 
 app.get('/api/auth/claude/status', async (_req, res) => {
-    res.json(await getClaudeAuthStatus());
+  res.json(await getClaudeAuthStatus());
 });
 
 // ── Handle registration ──
 
 app.get('/api/handle/check/:username', async (req, res) => {
-    try {
-        const result = await checkAvailability(req.params.username);
-        res.json(result);
-    } catch {
-        res.json({
-            available: false,
-            valid: false,
-            error: 'Could not reach relay server'
-        });
-    }
+  try {
+    const result = await checkAvailability(req.params.username);
+    res.json(result);
+  } catch {
+    res.json({ available: false, valid: false, error: 'Could not reach relay server' });
+  }
 });
 
 app.get('/api/handle/status', (_req, res) => {
-    const cfg = loadConfig();
-    res.json({
-        registered: !!cfg.relay?.token,
-        username: cfg.username || '',
-        tier: cfg.relay?.tier || '',
-        url: cfg.relay?.url || ''
-    });
+  const cfg = loadConfig();
+  res.json({
+    registered: !!cfg.relay?.token,
+    username: cfg.username || '',
+    tier: cfg.relay?.tier || '',
+    url: cfg.relay?.url || '',
+  });
 });
 
 app.post('/api/handle/register', async (req, res) => {
-    const { username, tier } = req.body;
-    log.ok(`Handle register request: username=${username}, tier=${tier}`);
-    if (!username || !tier) {
-        res.status(400).json({ error: 'Missing username or tier' });
-        return;
-    }
-
-    try {
-        const result = await registerHandle(username, tier);
-        log.ok(
-            `Handle registered with relay: url=${result.relayUrl}, token=${result.token ? 'received' : 'MISSING'}`
-        );
+  const { username, tier } = req.body;
+  log.ok(`Handle register request: username=${username}, tier=${tier}`);
+  if (!username || !tier) {
+    res.status(400).json({ error: 'Missing username or tier' });
+    return;
+  }
+
+  try {
+    const result = await registerHandle(username, tier);
+    log.ok(`Handle registered with relay: url=${result.relayUrl}, token=${result.token ? 'received' : 'MISSING'}`);
+
+    // Save to config
+    const cfg = loadConfig();
+    cfg.username = username;
+    cfg.relay = { token: result.token, tier, url: result.relayUrl };
+    saveConfig(cfg);
 
-        // Save to config
-        const cfg = loadConfig();
-        cfg.username = username;
-        cfg.relay = { token: result.token, tier, url: result.relayUrl };
-        saveConfig(cfg);
-
-        log.ok(`Handle registered: ${result.relayUrl}`);
-
-        // If the tunnel is already running, push the URL to the relay immediately
-        if (cfg.tunnelUrl) {
-            try {
-                await updateTunnelUrl(result.token, cfg.tunnelUrl);
-                startHeartbeat(result.token, cfg.tunnelUrl);
-            } catch (err: any) {
-                log.warn(`Relay update: ${err.message}`);
-            }
-        }
+    log.ok(`Handle registered: ${result.relayUrl}`);
 
-        res.json({ ok: true, url: result.relayUrl });
-    } catch (err: any) {
-        res.status(400).json({ error: err.message || 'Registration failed' });
+    // If the tunnel is already running, push the URL to the relay immediately
+    if (cfg.tunnelUrl) {
+      try {
+        await updateTunnelUrl(result.token, cfg.tunnelUrl);
+        startHeartbeat(result.token, cfg.tunnelUrl);
+      } catch (err: any) {
+        log.warn(`Relay update: ${err.message}`);
+      }
     }
+
+    res.json({ ok: true, url: result.relayUrl });
+  } catch (err: any) {
+    res.status(400).json({ error: err.message || 'Registration failed' });
+  }
 });
 
 app.post('/api/handle/change', async (req, res) => {
-    const { username, tier } = req.body;
-    log.ok(`Handle change request: new=${username}, tier=${tier}`);
-    if (!username || !tier) {
-        res.status(400).json({ error: 'Missing username or tier' });
-        return;
+  const { username, tier } = req.body;
+  log.ok(`Handle change request: new=${username}, tier=${tier}`);
+  if (!username || !tier) {
+    res.status(400).json({ error: 'Missing username or tier' });
+    return;
+  }
+
+  try {
+    const cfg = loadConfig();
+    log.ok(`Handle change: old username=${cfg.username || '(none)'}, old token=${cfg.relay?.token ? 'yes' : 'NO — cannot release!'}`);
+
+    // Release old handle if one exists
+    if (cfg.relay?.token) {
+      stopHeartbeat();
+      try {
+        await releaseHandle(cfg.relay.token);
+        log.ok(`Released old handle: ${cfg.username}`);
+      } catch (err: any) {
+        log.warn(`Release old handle: ${err.message}`);
+      }
+    } else {
+      log.warn('Handle change: no existing token found — old handle will NOT be released (orphaned in MongoDB)');
     }
 
-    try {
-        const cfg = loadConfig();
-        log.ok(
-            `Handle change: old username=${cfg.username || '(none)'}, old token=${cfg.relay?.token ? 'yes' : 'NO — cannot release!'}`
-        );
-
-        // Release old handle if one exists
-        if (cfg.relay?.token) {
-            stopHeartbeat();
-            try {
-                await releaseHandle(cfg.relay.token);
-                log.ok(`Released old handle: ${cfg.username}`);
-            } catch (err: any) {
-                log.warn(`Release old handle: ${err.message}`);
-            }
-        } else {
-            log.warn(
-                'Handle change: no existing token found — old handle will NOT be released (orphaned in MongoDB)'
-            );
-        }
-
-        // Register new handle
-        const result = await registerHandle(username, tier);
+    // Register new handle
+    const result = await registerHandle(username, tier);
 
-        cfg.username = username;
-        cfg.relay = { token: result.token, tier, url: result.relayUrl };
-        saveConfig(cfg);
+    cfg.username = username;
+    cfg.relay = { token: result.token, tier, url: result.relayUrl };
+    saveConfig(cfg);
 
-        log.ok(`Handle changed to: ${result.relayUrl}`);
+    log.ok(`Handle changed to: ${result.relayUrl}`);
 
-        // Push tunnel URL to new handle
-        if (cfg.tunnelUrl) {
-            try {
-                await updateTunnelUrl(result.token, cfg.tunnelUrl);
-                startHeartbeat(result.token, cfg.tunnelUrl);
-            } catch (err: any) {
-                log.warn(`Relay update: ${err.message}`);
-            }
-        }
-
-        res.json({ ok: true, url: result.relayUrl });
-    } catch (err: any) {
-        res.status(400).json({ error: err.message || 'Handle change failed' });
+    // Push tunnel URL to new handle
+    if (cfg.tunnelUrl) {
+      try {
+        await updateTunnelUrl(result.token, cfg.tunnelUrl);
+        startHeartbeat(result.token, cfg.tunnelUrl);
+      } catch (err: any) {
+        log.warn(`Relay update: ${err.message}`);
+      }
     }
+
+    res.json({ ok: true, url: result.relayUrl });
+  } catch (err: any) {
+    res.status(400).json({ error: err.message || 'Handle change failed' });
+  }
 });
 
 app.post('/api/handle/claim-reserved', async (req, res) => {
-    const { handle, hash } = req.body;
-    if (!handle || !hash) {
-        res.status(400).json({ error: 'Missing handle or activation code' });
-        return;
-    }
+  const { handle, hash } = req.body;
+  if (!handle || !hash) {
+    res.status(400).json({ error: 'Missing handle or activation code' });
+    return;
+  }
 
-    try {
-        const result = await claimReservedHandle(handle, hash);
+  try {
+    const result = await claimReservedHandle(handle, hash);
 
-        // Save to config (same as normal registration)
-        const cfg = loadConfig();
+    // Save to config (same as normal registration)
+    const cfg = loadConfig();
 
-        // Release old handle if one exists
-        if (cfg.relay?.token) {
-            stopHeartbeat();
-            try {
-                await releaseHandle(cfg.relay.token);
-            } catch (err: any) {
-                log.warn(`Release old handle: ${err.message}`);
-            }
-        }
+    // Release old handle if one exists
+    if (cfg.relay?.token) {
+      stopHeartbeat();
+      try {
+        await releaseHandle(cfg.relay.token);
+      } catch (err: any) {
+        log.warn(`Release old handle: ${err.message}`);
+      }
+    }
 
-        cfg.username = handle;
-        cfg.relay = {
-            token: result.token,
-            tier: 'premium',
-            url: result.relayUrl
-        };
-        saveConfig(cfg);
-
-        log.ok(`Reserved handle claimed: ${result.relayUrl}`);
-
-        // Push tunnel URL if running
-        if (cfg.tunnelUrl) {
-            try {
-                await updateTunnelUrl(result.token, cfg.tunnelUrl);
-                startHeartbeat(result.token, cfg.tunnelUrl);
-            } catch (err: any) {
-                log.warn(`Relay update: ${err.message}`);
-            }
-        }
+    cfg.username = handle;
+    cfg.relay = { token: result.token, tier: 'premium', url: result.relayUrl };
+    saveConfig(cfg);
 
-        res.json({ ok: true, url: result.relayUrl });
-    } catch (err: any) {
-        res.status(400).json({ error: err.message || 'Claim failed' });
+    log.ok(`Reserved handle claimed: ${result.relayUrl}`);
+
+    // Push tunnel URL if running
+    if (cfg.tunnelUrl) {
+      try {
+        await updateTunnelUrl(result.token, cfg.tunnelUrl);
+        startHeartbeat(result.token, cfg.tunnelUrl);
+      } catch (err: any) {
+        log.warn(`Relay update: ${err.message}`);
+      }
     }
+
+    res.json({ ok: true, url: result.relayUrl });
+  } catch (err: any) {
+    res.status(400).json({ error: err.message || 'Claim failed' });
+  }
 });
 
 // ── Onboarding ──
 
 app.get('/api/onboard/status', (_, res) => {
-    const settings = getAllSettings();
-    const cfg = loadConfig();
-    const hasToken = !!cfg.relay?.token;
-    res.json({
-        userName: settings.user_name || '',
-        agentName: settings.agent_name || '',
-        portalUser: settings.portal_user || '',
-        portalConfigured: !!settings.portal_pass,
-        whisperEnabled: settings.whisper_enabled === 'true',
-        whisperKey: settings.whisper_key || '',
-        provider: cfg.ai?.provider || '',
-        model: cfg.ai?.model || '',
-        handle: hasToken
-            ? {
-                  username: cfg.username,
-                  tier: cfg.relay.tier,
-                  url: cfg.relay.url
-              }
-            : null,
-        tunnelMode: cfg.tunnel?.mode || 'quick',
-        tunnelDomain: cfg.tunnel?.domain || '',
-        tunnelUrl: cfg.tunnelUrl || '',
-        totpEnabled: settings.totp_enabled === 'true'
-    });
+  const settings = getAllSettings();
+  const cfg = loadConfig();
+  const hasToken = !!cfg.relay?.token;
+  res.json({
+    userName: settings.user_name || '',
+    agentName: settings.agent_name || '',
+    portalUser: settings.portal_user || '',
+    portalConfigured: !!settings.portal_pass,
+    whisperEnabled: settings.whisper_enabled === 'true',
+    whisperKey: settings.whisper_key || '',
+    provider: cfg.ai?.provider || '',
+    model: cfg.ai?.model || '',
+    handle: hasToken ? {
+      username: cfg.username,
+      tier: cfg.relay.tier,
+      url: cfg.relay.url,
+    } : null,
+    tunnelMode: cfg.tunnel?.mode || 'quick',
+    tunnelDomain: cfg.tunnel?.domain || '',
+    tunnelUrl: cfg.tunnelUrl || '',
+    totpEnabled: settings.totp_enabled === 'true',
+  });
 });
 
 app.post('/api/portal/verify-password', (req, res) => {
-    const { password } = req.body;
-    const stored = getSetting('portal_pass');
-    if (!stored) {
-        res.json({ valid: false, error: 'No password set' });
-        return;
-    }
-    res.json({ valid: verifyPassword(password, stored) });
+  const { password } = req.body;
+  const stored = getSetting('portal_pass');
+  if (!stored) { res.json({ valid: false, error: 'No password set' }); return; }
+  res.json({ valid: verifyPassword(password, stored) });
 });
 
 // Shared login logic (used by both POST and GET handlers)
-function handleLogin(
-    username: string | undefined,
-    password: string | undefined,
-    req: any,
-    res: any
-) {
-    if (!password) {
-        res.status(400).json({ error: 'Password required' });
-        return;
-    }
-    const storedPass = getSetting('portal_pass');
-    if (!storedPass) {
-        res.status(400).json({ error: 'No password set' });
-        return;
-    }
-    if (!verifyPassword(password, storedPass)) {
-        res.status(401).json({ error: 'Invalid password' });
-        return;
-    }
-
-    // Check if TOTP is enabled
-    const totpEnabled = getSetting('totp_enabled') === 'true';
-    if (totpEnabled) {
-        // Check for trusted device cookie
-        const deviceToken = parseCookie(req.headers.cookie, 'fluxy_device');
-        if (deviceToken) {
-            const device = getTrustedDevice(deviceToken);
-            if (device) {
-                updateDeviceLastSeen(deviceToken);
-                // Trusted device — skip TOTP
-                deleteExpiredSessions();
-                const token = crypto.randomBytes(64).toString('hex');
-                const expiresAt = new Date(
-                    Date.now() + 7 * 24 * 60 * 60 * 1000
-                ).toISOString();
-                createSession(token, expiresAt);
-                res.json({ token, expiresAt });
-                return;
-            }
-        }
-        // No valid trusted device — require TOTP
-        const pendingToken = crypto.randomBytes(32).toString('hex');
-        const pendingExpiry = new Date(
-            Date.now() + 5 * 60 * 1000
-        ).toISOString();
-        setSetting(`totp_pending_login:${pendingToken}`, pendingExpiry);
-        res.json({ requiresTOTP: true, pendingToken });
+function handleLogin(username: string | undefined, password: string | undefined, req: any, res: any) {
+  if (!password) { res.status(400).json({ error: 'Password required' }); return; }
+  const storedPass = getSetting('portal_pass');
+  if (!storedPass) { res.status(400).json({ error: 'No password set' }); return; }
+  if (!verifyPassword(password, storedPass)) { res.status(401).json({ error: 'Invalid password' }); return; }
+
+  // Check if TOTP is enabled
+  const totpEnabled = getSetting('totp_enabled') === 'true';
+  if (totpEnabled) {
+    // Check for trusted device cookie
+    const deviceToken = parseCookie(req.headers.cookie, 'fluxy_device');
+    if (deviceToken) {
+      const device = getTrustedDevice(deviceToken);
+      if (device) {
+        updateDeviceLastSeen(deviceToken);
+        // Trusted device — skip TOTP
+        deleteExpiredSessions();
+        const token = crypto.randomBytes(64).toString('hex');
+        const expiresAt = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString();
+        createSession(token, expiresAt);
+        res.json({ token, expiresAt });
         return;
-    }
-
-    deleteExpiredSessions();
-    const token = crypto.randomBytes(64).toString('hex');
-    const expiresAt = new Date(
-        Date.now() + 7 * 24 * 60 * 60 * 1000
-    ).toISOString();
-    createSession(token, expiresAt);
-    res.json({ token, expiresAt });
+      }
+    }
+    // No valid trusted device — require TOTP
+    const pendingToken = crypto.randomBytes(32).toString('hex');
+    const pendingExpiry = new Date(Date.now() + 5 * 60 * 1000).toISOString();
+    setSetting(`totp_pending_login:${pendingToken}`, pendingExpiry);
+    res.json({ requiresTOTP: true, pendingToken });
+    return;
+  }
+
+  deleteExpiredSessions();
+  const token = crypto.randomBytes(64).toString('hex');
+  const expiresAt = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString();
+  createSession(token, expiresAt);
+  res.json({ token, expiresAt });
 }
 
 // POST: credentials in JSON body
 app.post('/api/portal/login', (req, res) => {
-    const { username, password } = req.body;
-    handleLogin(username, password, req, res);
+  const { username, password } = req.body;
+  handleLogin(username, password, req, res);
 });
 
 // GET: credentials via Authorization Basic header (relay proxies don't forward POST bodies)
 app.get('/api/portal/login', (req, res) => {
-    const authHeader = req.headers['authorization'];
-    if (!authHeader?.startsWith('Basic ')) {
-        res.status(400).json({ error: 'Authorization header required' });
-        return;
-    }
-    const decoded = Buffer.from(authHeader.slice(6), 'base64').toString();
-    const sep = decoded.indexOf(':');
-    if (sep < 0) {
-        res.status(400).json({ error: 'Invalid credentials format' });
-        return;
-    }
-    handleLogin(decoded.slice(0, sep), decoded.slice(sep + 1), req, res);
+  const authHeader = req.headers['authorization'];
+  if (!authHeader?.startsWith('Basic ')) { res.status(400).json({ error: 'Authorization header required' }); return; }
+  const decoded = Buffer.from(authHeader.slice(6), 'base64').toString();
+  const sep = decoded.indexOf(':');
+  if (sep < 0) { res.status(400).json({ error: 'Invalid credentials format' }); return; }
+  handleLogin(decoded.slice(0, sep), decoded.slice(sep + 1), req, res);
 });
 
 // POST + GET for validate-token (same relay issue)
 function handleValidateToken(token: string | undefined, res: any) {
-    if (!token) {
-        res.json({ valid: false });
-        return;
-    }
-    const session = getSession(token);
-    res.json({ valid: !!session });
+  if (!token) { res.json({ valid: false }); return; }
+  const session = getSession(token);
+  res.json({ valid: !!session });
 }
 
 app.post('/api/portal/validate-token', (req, res) => {
-    handleValidateToken(req.body.token, res);
+  handleValidateToken(req.body.token, res);
 });
 
 app.get('/api/portal/validate-token', (req, res) => {
-    handleValidateToken(req.query.token as string, res);
+  handleValidateToken(req.query.token as string, res);
 });
 
 // ── TOTP 2FA endpoints ──
 
 app.get('/api/portal/totp/status', (_req, res) => {
-    res.json({ enabled: getSetting('totp_enabled') === 'true' });
+  res.json({ enabled: getSetting('totp_enabled') === 'true' });
 });
 
 app.post('/api/portal/totp/setup', async (req, res) => {
-    // Verify caller has auth: session token, correct password, or initial onboard (no password set yet)
-    const authHeader = req.headers['authorization'];
-    let authorized = false;
-    if (authHeader?.startsWith('Bearer ')) {
-        const session = getSession(authHeader.slice(7));
-        if (session) authorized = true;
-    }
-    if (!authorized && req.body?.password) {
-        const storedPass = getSetting('portal_pass');
-        if (storedPass && verifyPassword(req.body.password, storedPass))
-            authorized = true;
-    }
-    // During initial onboard, no password is stored yet — allow setup
-    if (!authorized && !getSetting('portal_pass')) authorized = true;
-    if (!authorized) {
-        res.status(401).json({ error: 'Unauthorized' });
-        return;
-    }
+  // Verify caller has auth: session token, correct password, or initial onboard (no password set yet)
+  const authHeader = req.headers['authorization'];
+  let authorized = false;
+  if (authHeader?.startsWith('Bearer ')) {
+    const session = getSession(authHeader.slice(7));
+    if (session) authorized = true;
+  }
+  if (!authorized && req.body?.password) {
+    const storedPass = getSetting('portal_pass');
+    if (storedPass && verifyPassword(req.body.password, storedPass)) authorized = true;
+  }
+  // During initial onboard, no password is stored yet — allow setup
+  if (!authorized && !getSetting('portal_pass')) authorized = true;
+  if (!authorized) { res.status(401).json({ error: 'Unauthorized' }); return; }
 
-    const secret = generateTOTPSecret();
-    setSetting('totp_pending_secret', secret);
-
-    const botName = getSetting('agent_name') || 'Fluxy';
-    const totp = new TOTP({
-        issuer: 'Fluxy',
-        label: botName,
-        algorithm: 'SHA1',
-        digits: 6,
-        period: 30,
-        secret
-    });
-    const otpauthUri = totp.toString();
-
-    try {
-        const qrDataUri = await QRCode.toDataURL(otpauthUri, {
-            width: 256,
-            margin: 2
-        });
-        res.json({ secret, qrDataUri, otpauthUri });
-    } catch (err: any) {
-        res.status(500).json({ error: 'Failed to generate QR code' });
-    }
+  const secret = generateTOTPSecret();
+  setSetting('totp_pending_secret', secret);
+
+  const botName = getSetting('agent_name') || 'Fluxy';
+  const totp = new TOTP({ issuer: 'Fluxy', label: botName, algorithm: 'SHA1', digits: 6, period: 30, secret });
+  const otpauthUri = totp.toString();
+
+  try {
+    const qrDataUri = await QRCode.toDataURL(otpauthUri, { width: 256, margin: 2 });
+    res.json({ secret, qrDataUri, otpauthUri });
+  } catch (err: any) {
+    res.status(500).json({ error: 'Failed to generate QR code' });
+  }
 });
 
 app.post('/api/portal/totp/verify-setup', (req, res) => {
-    const authHeader = req.headers['authorization'];
-    let authorized = false;
-    if (authHeader?.startsWith('Bearer ')) {
-        const session = getSession(authHeader.slice(7));
-        if (session) authorized = true;
-    }
-    if (!authorized && req.body?.password) {
-        const storedPass = getSetting('portal_pass');
-        if (storedPass && verifyPassword(req.body.password, storedPass))
-            authorized = true;
-    }
-    // During initial onboard, no password is stored yet — allow verify
-    if (!authorized && !getSetting('portal_pass')) authorized = true;
-    if (!authorized) {
-        res.status(401).json({ error: 'Unauthorized' });
-        return;
-    }
+  const authHeader = req.headers['authorization'];
+  let authorized = false;
+  if (authHeader?.startsWith('Bearer ')) {
+    const session = getSession(authHeader.slice(7));
+    if (session) authorized = true;
+  }
+  if (!authorized && req.body?.password) {
+    const storedPass = getSetting('portal_pass');
+    if (storedPass && verifyPassword(req.body.password, storedPass)) authorized = true;
+  }
+  // During initial onboard, no password is stored yet — allow verify
+  if (!authorized && !getSetting('portal_pass')) authorized = true;
+  if (!authorized) { res.status(401).json({ error: 'Unauthorized' }); return; }
 
-    const { code } = req.body;
-    if (!code) {
-        res.status(400).json({ error: 'Code required' });
-        return;
-    }
+  const { code } = req.body;
+  if (!code) { res.status(400).json({ error: 'Code required' }); return; }
 
-    const pendingSecret = getSetting('totp_pending_secret');
-    if (!pendingSecret) {
-        res.status(400).json({ error: 'No TOTP setup in progress' });
-        return;
-    }
+  const pendingSecret = getSetting('totp_pending_secret');
+  if (!pendingSecret) { res.status(400).json({ error: 'No TOTP setup in progress' }); return; }
 
-    if (!verifyTOTPCode(code, pendingSecret)) {
-        res.status(400).json({
-            error: 'Invalid code. Check your authenticator app and try again.'
-        });
-        return;
-    }
+  if (!verifyTOTPCode(code, pendingSecret)) {
+    res.status(400).json({ error: 'Invalid code. Check your authenticator app and try again.' });
+    return;
+  }
 
-    // Success: persist TOTP config
-    setSetting('totp_secret', pendingSecret);
-    setSetting('totp_enabled', 'true');
+  // Success: persist TOTP config
+  setSetting('totp_secret', pendingSecret);
+  setSetting('totp_enabled', 'true');
 
-    // Generate recovery codes
-    const codes = generateRecoveryCodes();
-    const hashes = codes.map(hashRecoveryCode);
-    setSetting('totp_recovery_codes', JSON.stringify(hashes));
+  // Generate recovery codes
+  const codes = generateRecoveryCodes();
+  const hashes = codes.map(hashRecoveryCode);
+  setSetting('totp_recovery_codes', JSON.stringify(hashes));
 
-    // Clean up pending secret
-    setSetting('totp_pending_secret', '');
+  // Clean up pending secret
+  setSetting('totp_pending_secret', '');
 
-    res.json({ success: true, recoveryCodes: codes });
+  res.json({ success: true, recoveryCodes: codes });
 });
 
 app.post('/api/portal/totp/disable', (req, res) => {
-    const { password, code } = req.body;
-    if (!password || !code) {
-        res.status(400).json({ error: 'Password and TOTP code required' });
-        return;
-    }
+  const { password, code } = req.body;
+  if (!password || !code) { res.status(400).json({ error: 'Password and TOTP code required' }); return; }
 
-    const storedPass = getSetting('portal_pass');
-    if (!storedPass || !verifyPassword(password, storedPass)) {
-        res.status(401).json({ error: 'Invalid password' });
-        return;
-    }
+  const storedPass = getSetting('portal_pass');
+  if (!storedPass || !verifyPassword(password, storedPass)) {
+    res.status(401).json({ error: 'Invalid password' });
+    return;
+  }
 
-    const secret = getSetting('totp_secret');
-    if (!secret) {
-        res.status(400).json({ error: '2FA is not enabled' });
-        return;
-    }
+  const secret = getSetting('totp_secret');
+  if (!secret) { res.status(400).json({ error: '2FA is not enabled' }); return; }
 
-    if (!verifyTOTPCode(code, secret)) {
-        res.status(400).json({ error: 'Invalid TOTP code' });
-        return;
-    }
+  if (!verifyTOTPCode(code, secret)) {
+    res.status(400).json({ error: 'Invalid TOTP code' });
+    return;
+  }
 
-    // Clear all TOTP settings
-    setSetting('totp_enabled', 'false');
-    setSetting('totp_secret', '');
-    setSetting('totp_recovery_codes', '');
-    setSetting('totp_pending_secret', '');
-    deleteAllTrustedDevices();
+  // Clear all TOTP settings
+  setSetting('totp_enabled', 'false');
+  setSetting('totp_secret', '');
+  setSetting('totp_recovery_codes', '');
+  setSetting('totp_pending_secret', '');
+  deleteAllTrustedDevices();
 
-    res.json({ success: true });
+  res.json({ success: true });
 });
 
 app.get('/api/portal/login/totp', (req, res) => {
-    const pending = req.query.pending as string;
-    const code = req.query.code as string;
-    const trust = req.query.trust as string;
-
-    if (!pending || !code) {
-        res.status(400).json({ error: 'Missing pending token or code' });
-        return;
-    }
-
-    // Validate pending token
-    const expiry = getSetting(`totp_pending_login:${pending}`);
-    if (!expiry || new Date(expiry) < new Date()) {
-        res.status(401).json({
-            error: 'Login session expired. Please start over.'
-        });
-        return;
-    }
-
-    // Clean up pending token
-    setSetting(`totp_pending_login:${pending}`, '');
-
-    const secret = getSetting('totp_secret');
-    if (!secret) {
-        res.status(400).json({ error: '2FA is not configured' });
-        return;
-    }
-
-    // Try TOTP code first
-    let valid = verifyTOTPCode(code, secret);
-
-    // If not valid as TOTP, try as recovery code
-    if (!valid) {
-        const hashesJson = getSetting('totp_recovery_codes');
-        if (hashesJson) {
-            try {
-                const hashes = JSON.parse(hashesJson) as string[];
-                const result = verifyRecoveryCode(code, hashes);
-                if (result.valid) {
-                    valid = true;
-                    setSetting(
-                        'totp_recovery_codes',
-                        JSON.stringify(result.remaining)
-                    );
-                }
-            } catch {}
+  const pending = req.query.pending as string;
+  const code = req.query.code as string;
+  const trust = req.query.trust as string;
+
+  if (!pending || !code) { res.status(400).json({ error: 'Missing pending token or code' }); return; }
+
+  // Validate pending token
+  const expiry = getSetting(`totp_pending_login:${pending}`);
+  if (!expiry || new Date(expiry) < new Date()) {
+    res.status(401).json({ error: 'Login session expired. Please start over.' });
+    return;
+  }
+
+  // Clean up pending token
+  setSetting(`totp_pending_login:${pending}`, '');
+
+  const secret = getSetting('totp_secret');
+  if (!secret) { res.status(400).json({ error: '2FA is not configured' }); return; }
+
+  // Try TOTP code first
+  let valid = verifyTOTPCode(code, secret);
+
+  // If not valid as TOTP, try as recovery code
+  if (!valid) {
+    const hashesJson = getSetting('totp_recovery_codes');
+    if (hashesJson) {
+      try {
+        const hashes = JSON.parse(hashesJson) as string[];
+        const result = verifyRecoveryCode(code, hashes);
+        if (result.valid) {
+          valid = true;
+          setSetting('totp_recovery_codes', JSON.stringify(result.remaining));
         }
+      } catch {}
     }
+  }
 
-    if (!valid) {
-        res.status(401).json({ error: 'Invalid code' });
-        return;
-    }
+  if (!valid) {
+    res.status(401).json({ error: 'Invalid code' });
+    return;
+  }
 
-    // Create session
-    deleteExpiredSessions();
-    const token = crypto.randomBytes(64).toString('hex');
-    const expiresAt = new Date(
-        Date.now() + 7 * 24 * 60 * 60 * 1000
-    ).toISOString();
-    createSession(token, expiresAt);
-
-    // Trust device if requested
-    if (trust === '1') {
-        deleteExpiredDevices();
-        const deviceToken = crypto.randomBytes(32).toString('hex');
-        const deviceExpiry = new Date(
-            Date.now() + 90 * 24 * 60 * 60 * 1000
-        ).toISOString();
-        createTrustedDevice(deviceToken, 'Browser', deviceExpiry);
-        res.setHeader(
-            'Set-Cookie',
-            `fluxy_device=${deviceToken}; HttpOnly; Secure; SameSite=Strict; Max-Age=7776000; Path=/`
-        );
-    }
+  // Create session
+  deleteExpiredSessions();
+  const token = crypto.randomBytes(64).toString('hex');
+  const expiresAt = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString();
+  createSession(token, expiresAt);
+
+  // Trust device if requested
+  if (trust === '1') {
+    deleteExpiredDevices();
+    const deviceToken = crypto.randomBytes(32).toString('hex');
+    const deviceExpiry = new Date(Date.now() + 90 * 24 * 60 * 60 * 1000).toISOString();
+    createTrustedDevice(deviceToken, 'Browser', deviceExpiry);
+    res.setHeader('Set-Cookie', `fluxy_device=${deviceToken}; HttpOnly; Secure; SameSite=Strict; Max-Age=7776000; Path=/`);
+  }
 
-    res.json({ token, expiresAt });
+  res.json({ token, expiresAt });
 });
 
 app.get('/api/portal/devices', (_req, res) => {
-    res.json(listTrustedDevices());
+  res.json(listTrustedDevices());
 });
 
 app.delete('/api/portal/devices/:id', (req, res) => {
-    deleteTrustedDevice(req.params.id);
-    res.json({ ok: true });
+  deleteTrustedDevice(req.params.id);
+  res.json({ ok: true });
 });
 
 app.post('/api/portal/devices/revoke', (req, res) => {
-    const { id } = req.body;
-    if (!id) {
-        res.status(400).json({ error: 'Device ID required' });
-        return;
-    }
-    deleteTrustedDevice(id);
-    res.json({ ok: true });
+  const { id } = req.body;
+  if (!id) { res.status(400).json({ error: 'Device ID required' }); return; }
+  deleteTrustedDevice(id);
+  res.json({ ok: true });
 });
 
 app.post('/api/onboard', (req, res) => {
-    const {
-        userName,
-        agentName,
-        provider,
-        model,
-        apiKey,
-        baseUrl,
-        portalUser,
-        portalPass,
-        whisperEnabled,
-        whisperKey
-    } = req.body;
-
-    // Read old names before overwriting (needed for FLUXY.md re-onboard)
-    const oldBotName = getSetting('agent_name') || '$BOT';
-    const oldHumanName = getSetting('user_name') || '$HUMAN';
-
-    setSetting('user_name', userName || '');
-    setSetting('agent_name', agentName || 'Fluxy');
-    setSetting('onboard_complete', 'true');
-
-    // Save portal credentials
-    if (portalUser) {
-        setSetting('portal_user', portalUser.trim().toLowerCase());
-    }
-    if (portalPass) {
-        setSetting('portal_pass', hashPassword(portalPass));
-    }
-
-    // Save whisper config
-    setSetting('whisper_enabled', whisperEnabled ? 'true' : 'false');
-    if (whisperKey) {
-        setSetting('whisper_key', whisperKey);
-    }
-
-    // Update bot and human names in FLUXY.md
-    // On first onboard: replaces $BOT / $HUMAN placeholders
-    // On re-onboard: replaces the previous names with the new ones
-    const newBotName = agentName || 'Fluxy';
-    const newHumanName = userName || 'Human';
-    const fluxyMdPath = path.join(WORKSPACE_DIR, 'FLUXY.md');
-    if (fs.existsSync(fluxyMdPath)) {
-        let fluxyContent = fs.readFileSync(fluxyMdPath, 'utf-8');
-        if (oldBotName !== newBotName) {
-            fluxyContent = fluxyContent.replace(
-                new RegExp(
-                    oldBotName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'),
-                    'g'
-                ),
-                newBotName
-            );
-        }
-        if (oldHumanName !== newHumanName) {
-            fluxyContent = fluxyContent.replace(
-                new RegExp(
-                    oldHumanName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'),
-                    'g'
-                ),
-                newHumanName
-            );
-        }
-        fs.writeFileSync(fluxyMdPath, fluxyContent, 'utf-8');
-        log.ok(
-            `FLUXY.md: updated names — bot="${newBotName}", human="${newHumanName}"`
-        );
-    }
-
-    // Re-read config from disk to preserve relay/handle data written by registration
-    const currentCfg = loadConfig();
-    log.ok(
-        `Onboard: preserving relay data — token=${currentCfg.relay?.token ? 'yes' : 'no'}, username=${currentCfg.username || '(none)'}`
-    );
-
-    currentCfg.ai.provider = provider || '';
-    currentCfg.ai.model = model || '';
-    currentCfg.ai.baseUrl = baseUrl || undefined;
-
-    // Read OAuth token if no API key provided
-    if (!apiKey && provider === 'openai') {
-        currentCfg.ai.apiKey = readCodexAccessToken() || '';
-    } else if (!apiKey && provider === 'anthropic') {
-        currentCfg.ai.apiKey = readClaudeAccessToken() || '';
-    } else {
-        currentCfg.ai.apiKey = apiKey || '';
-    }
-
-    saveConfig(currentCfg);
-
-    res.json({ ok: true });
+  const { userName, agentName, provider, model, apiKey, baseUrl, portalUser, portalPass, whisperEnabled, whisperKey } = req.body;
+
+  // Read old names before overwriting (needed for FLUXY.md re-onboard)
+  const oldBotName = getSetting('agent_name') || '$BOT';
+  const oldHumanName = getSetting('user_name') || '$HUMAN';
+
+  setSetting('user_name', userName || '');
+  setSetting('agent_name', agentName || 'Fluxy');
+  setSetting('onboard_complete', 'true');
+
+  // Save portal credentials
+  if (portalUser) {
+    setSetting('portal_user', portalUser.trim().toLowerCase());
+  }
+  if (portalPass) {
+    setSetting('portal_pass', hashPassword(portalPass));
+  }
+
+  // Save whisper config
+  setSetting('whisper_enabled', whisperEnabled ? 'true' : 'false');
+  if (whisperKey) {
+    setSetting('whisper_key', whisperKey);
+  }
+
+  // Update bot and human names in FLUXY.md
+  // On first onboard: replaces $BOT / $HUMAN placeholders
+  // On re-onboard: replaces the previous names with the new ones
+  const newBotName = agentName || 'Fluxy';
+  const newHumanName = userName || 'Human';
+  const fluxyMdPath = path.join(WORKSPACE_DIR, 'FLUXY.md');
+  if (fs.existsSync(fluxyMdPath)) {
+    let fluxyContent = fs.readFileSync(fluxyMdPath, 'utf-8');
+    if (oldBotName !== newBotName) {
+      fluxyContent = fluxyContent.replace(new RegExp(oldBotName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'g'), newBotName);
+    }
+    if (oldHumanName !== newHumanName) {
+      fluxyContent = fluxyContent.replace(new RegExp(oldHumanName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'g'), newHumanName);
+    }
+    fs.writeFileSync(fluxyMdPath, fluxyContent, 'utf-8');
+    log.ok(`FLUXY.md: updated names — bot="${newBotName}", human="${newHumanName}"`);
+  }
+
+  // Re-read config from disk to preserve relay/handle data written by registration
+  const currentCfg = loadConfig();
+  log.ok(`Onboard: preserving relay data — token=${currentCfg.relay?.token ? 'yes' : 'no'}, username=${currentCfg.username || '(none)'}`);
+
+  currentCfg.ai.provider = provider || '';
+  currentCfg.ai.model = model || '';
+  currentCfg.ai.baseUrl = baseUrl || undefined;
+
+  // Read OAuth token if no API key provided
+  if (!apiKey && provider === 'openai') {
+    currentCfg.ai.apiKey = readCodexAccessToken() || '';
+  } else if (!apiKey && provider === 'anthropic') {
+    currentCfg.ai.apiKey = readClaudeAccessToken() || '';
+  } else {
+    currentCfg.ai.apiKey = apiKey || '';
+  }
+
+  saveConfig(currentCfg);
+
+  res.json({ ok: true });
 });
 
 // ── Push notifications ──
 
 app.get('/api/push/vapid-public-key', (_, res) => {
-    const key = getSetting('vapid_public_key');
-    if (!key) {
-        res.status(500).json({ error: 'VAPID keys not initialized' });
-        return;
-    }
-    res.json({ publicKey: key });
+  const key = getSetting('vapid_public_key');
+  if (!key) { res.status(500).json({ error: 'VAPID keys not initialized' }); return; }
+  res.json({ publicKey: key });
 });
 
 app.post('/api/push/subscribe', (req, res) => {
-    const { endpoint, keys } = req.body || {};
-    if (!endpoint || !keys?.p256dh || !keys?.auth) {
-        res.status(400).json({ error: 'Invalid subscription' });
-        return;
-    }
-    addPushSubscription(endpoint, keys.p256dh, keys.auth);
-    res.json({ ok: true });
+  const { endpoint, keys } = req.body || {};
+  if (!endpoint || !keys?.p256dh || !keys?.auth) {
+    res.status(400).json({ error: 'Invalid subscription' });
+    return;
+  }
+  addPushSubscription(endpoint, keys.p256dh, keys.auth);
+  res.json({ ok: true });
 });
 
 app.delete('/api/push/unsubscribe', (req, res) => {
-    const { endpoint } = req.body || {};
-    if (!endpoint) {
-        res.status(400).json({ error: 'Missing endpoint' });
-        return;
-    }
-    removePushSubscription(endpoint);
-    res.json({ ok: true });
+  const { endpoint } = req.body || {};
+  if (!endpoint) { res.status(400).json({ error: 'Missing endpoint' }); return; }
+  removePushSubscription(endpoint);
+  res.json({ ok: true });
 });
 
 app.post('/api/push/send', async (req, res) => {
-    const { title, body, tag, url } = req.body || {};
-    const subs = getAllPushSubscriptions();
-    log.info(`[push] Sending to ${subs.length} subscription(s): "${title}"`);
-    const payload = JSON.stringify({
-        title: title || 'Fluxy',
-        body: body || '',
-        tag: tag || 'fluxy',
-        url: url || '/'
-    });
+  const { title, body, tag, url } = req.body || {};
+  const subs = getAllPushSubscriptions();
+  log.info(`[push] Sending to ${subs.length} subscription(s): "${title}"`);
+  const payload = JSON.stringify({ title: title || 'Fluxy', body: body || '', tag: tag || 'fluxy', url: url || '/' });
+
+  const results = await Promise.allSettled(
+    subs.map(async (sub) => {
+      try {
+        await webpush.sendNotification(
+          { endpoint: sub.endpoint, keys: { p256dh: sub.keys_p256dh, auth: sub.keys_auth } },
+          payload,
+        );
+      } catch (err: any) {
+        if (err.statusCode === 410 || err.statusCode === 404) {
+          removePushSubscription(sub.endpoint);
+          log.info(`[push] Removed expired subscription: ${sub.endpoint.slice(0, 60)}...`);
+        } else {
+          log.warn(`[push] Send failed: ${err.message}`);
+        }
+        throw err;
+      }
+    }),
+  );
 
-    const results = await Promise.allSettled(
-        subs.map(async sub => {
-            try {
-                await webpush.sendNotification(
-                    {
-                        endpoint: sub.endpoint,
-                        keys: { p256dh: sub.keys_p256dh, auth: sub.keys_auth }
-                    },
-                    payload
-                );
-            } catch (err: any) {
-                if (err.statusCode === 410 || err.statusCode === 404) {
-                    removePushSubscription(sub.endpoint);
-                    log.info(
-                        `[push] Removed expired subscription: ${sub.endpoint.slice(0, 60)}...`
-                    );
-                } else {
-                    log.warn(`[push] Send failed: ${err.message}`);
-                }
-                throw err;
-            }
-        })
-    );
-
-    const sent = results.filter(r => r.status === 'fulfilled').length;
-    res.json({ sent, total: subs.length });
+  const sent = results.filter((r) => r.status === 'fulfilled').length;
+  res.json({ sent, total: subs.length });
 });
 
 app.get('/api/push/status', (req, res) => {
-    const endpoint = req.query.endpoint as string;
-    if (!endpoint) {
-        res.json({ subscribed: false });
-        return;
-    }
-    const sub = getPushSubscriptionByEndpoint(endpoint);
-    res.json({ subscribed: !!sub });
+  const endpoint = req.query.endpoint as string;
+  if (!endpoint) { res.json({ subscribed: false }); return; }
+  const sub = getPushSubscriptionByEndpoint(endpoint);
+  res.json({ subscribed: !!sub });
 });
 
 // ── Whisper transcription ──
 
-app.post(
-    '/api/whisper/transcribe',
-    express.json({ limit: '10mb' }),
-    async (req, res) => {
-        const whisperEnabled = getSetting('whisper_enabled');
-        const whisperKey = getSetting('whisper_key');
-
-        if (whisperEnabled !== 'true' || !whisperKey) {
-            res.status(400).json({
-                error: 'Whisper not enabled or API key missing'
-            });
-            return;
-        }
-
-        const { audio } = req.body; // base64 string (no data URL prefix expected, but handle both)
-        if (!audio) {
-            res.status(400).json({ error: 'No audio data provided' });
-            return;
-        }
+app.post('/api/whisper/transcribe', express.json({ limit: '10mb' }), async (req, res) => {
+  const whisperEnabled = getSetting('whisper_enabled');
+  const whisperKey = getSetting('whisper_key');
+
+  if (whisperEnabled !== 'true' || !whisperKey) {
+    res.status(400).json({ error: 'Whisper not enabled or API key missing' });
+    return;
+  }
+
+  const { audio } = req.body; // base64 string (no data URL prefix expected, but handle both)
+  if (!audio) {
+    res.status(400).json({ error: 'No audio data provided' });
+    return;
+  }
+
+  try {
+    // Strip data URL prefix if present
+    const raw = audio.includes(',') ? audio.split(',')[1] : audio;
+    const audioBuffer = Buffer.from(raw, 'base64');
+
+    // Build multipart/form-data manually
+    const boundary = '----WhisperBoundary' + Date.now();
+    const CRLF = '\r\n';
+
+    const parts: Buffer[] = [];
+
+    // file part
+    parts.push(Buffer.from(
+      `--${boundary}${CRLF}` +
+      `Content-Disposition: form-data; name="file"; filename="audio.webm"${CRLF}` +
+      `Content-Type: audio/webm${CRLF}${CRLF}`
+    ));
+    parts.push(audioBuffer);
+    parts.push(Buffer.from(CRLF));
+
+    // model part
+    parts.push(Buffer.from(
+      `--${boundary}${CRLF}` +
+      `Content-Disposition: form-data; name="model"${CRLF}${CRLF}` +
+      `whisper-1${CRLF}`
+    ));
+
+    // closing boundary
+    parts.push(Buffer.from(`--${boundary}--${CRLF}`));
+
+    const body = Buffer.concat(parts);
+
+    const response = await fetch('https://api.openai.com/v1/audio/transcriptions', {
+      method: 'POST',
+      headers: {
+        'Authorization': `Bearer ${whisperKey}`,
+        'Content-Type': `multipart/form-data; boundary=${boundary}`,
+      },
+      body,
+    });
 
-        try {
-            // Strip data URL prefix if present
-            const raw = audio.includes(',') ? audio.split(',')[1] : audio;
-            const audioBuffer = Buffer.from(raw, 'base64');
-
-            // Build multipart/form-data manually
-            const boundary = '----WhisperBoundary' + Date.now();
-            const CRLF = '\r\n';
-
-            const parts: Buffer[] = [];
-
-            // file part
-            parts.push(
-                Buffer.from(
-                    `--${boundary}${CRLF}` +
-                        `Content-Disposition: form-data; name="file"; filename="audio.webm"${CRLF}` +
-                        `Content-Type: audio/webm${CRLF}${CRLF}`
-                )
-            );
-            parts.push(audioBuffer);
-            parts.push(Buffer.from(CRLF));
-
-            // model part
-            parts.push(
-                Buffer.from(
-                    `--${boundary}${CRLF}` +
-                        `Content-Disposition: form-data; name="model"${CRLF}${CRLF}` +
-                        `whisper-1${CRLF}`
-                )
-            );
-
-            // closing boundary
-            parts.push(Buffer.from(`--${boundary}--${CRLF}`));
-
-            const body = Buffer.concat(parts);
-
-            const response = await fetch(
-                'https://api.openai.com/v1/audio/transcriptions',
-                {
-                    method: 'POST',
-                    headers: {
-                        Authorization: `Bearer ${whisperKey}`,
-                        'Content-Type': `multipart/form-data; boundary=${boundary}`
-                    },
-                    body
-                }
-            );
-
-            if (!response.ok) {
-                const errText = await response.text();
-                log.warn(`Whisper API error: ${response.status} ${errText}`);
-                res.status(502).json({ error: 'Whisper API error' });
-                return;
-            }
-
-            const result = (await response.json()) as { text: string };
-            res.json({ transcript: result.text });
-        } catch (err: any) {
-            log.warn(`Whisper transcription failed: ${err.message}`);
-            res.status(500).json({ error: 'Transcription failed' });
-        }
+    if (!response.ok) {
+      const errText = await response.text();
+      log.warn(`Whisper API error: ${response.status} ${errText}`);
+      res.status(502).json({ error: 'Whisper API error' });
+      return;
     }
-);
+
+    const result = await response.json() as { text: string };
+    res.json({ transcript: result.text });
+  } catch (err: any) {
+    log.warn(`Whisper transcription failed: ${err.message}`);
+    res.status(500).json({ error: 'Transcription failed' });
+  }
+});
 
 // Serve stored files (audio, images, documents)
 app.use('/api/files', express.static(paths.files));
@@ -1089,8 +852,4 @@ console.log('[worker] API-only mode — dashboard served by Vite dev server');
 // HTTP server (no WebSocket — chat lives in supervisor)
 const server = app.listen(port, () => log.ok(`Worker on port ${port}`));
 
-process.on('SIGTERM', () => {
-    closeDb();
-    server.close();
-    process.exit(0);
-});
+process.on('SIGTERM', () => { closeDb(); server.close(); process.exit(0); });