infinicode 2.8.23 → 2.8.26

package/dist/robopark/setup-livekit.js

@@ -55,26 +55,52 @@ async function meshRpc(targetUrl, token, env) {
     }
     return (await res.json());
 }
-async function getHubNodeId(hubUrl, token) {
+async function getHubManifest(hubUrl, token) {
     try {
         const url = `${hubUrl.replace(/\/$/, '')}/fed/manifest?token=${encodeURIComponent(token)}`;
         const res = await fetch(url, { headers: { accept: 'application/json' } });
         if (!res.ok)
-            return null;
+            return { nodeId: null, platform: null };
         const manifest = (await res.json());
-        return manifest.nodeId || manifest.id || null;
+        return { nodeId: manifest.nodeId || manifest.id || null, platform: manifest.platform ?? null };
+    }
+    catch {
+        return { nodeId: null, platform: null };
+    }
+}
+/** Fallback: GET /fed/status returns the hub's own NodeManifest under `self`,
+ *  including `platform`. Used when /fed/manifest doesn't carry it. */
+async function getHubPlatformFromStatus(hubUrl, token) {
+    try {
+        const url = `${hubUrl.replace(/\/$/, '')}/fed/status?token=${encodeURIComponent(token)}`;
+        const res = await fetch(url, { headers: { accept: 'application/json' } });
+        if (!res.ok)
+            return null;
+        const status = (await res.json());
+        return status.self?.platform ?? null;
     }
     catch {
         return null;
     }
 }
-const LIVEKIT_SETUP_PROMPT = `You are the RoboPark infrastructure agent running on the fleet hub.
+const LIVEKIT_SETUP_PROMPT_HEADER = `You are the RoboPark infrastructure agent running on the fleet hub.
 
 GOAL: Install and start a LiveKit server in Docker on this machine so the RoboPark scheduler can mint tokens and the robot preview agent can publish camera/audio.
 
 DO NOT ask the user for confirmation. Execute the steps directly. If a step is already done, skip it and report it.
-
-Steps:
+`;
+const LIVEKIT_SETUP_PROMPT_FOOTER = `
+IMPORTANT: this is a headless fleet node. Do not open a browser. Only run shell commands and report the final LiveKit URL + credentials in a JSON code block like:
+\`\`\`json
+{
+  "url": "ws://127.0.0.1:7880",
+  "api_key": "...",
+  "api_secret": "...",
+  "running": true
+}
+\`\`\`
+`;
+const LIVEKIT_SETUP_STEPS_LINUX = `Steps:
 1. Check if Docker is installed and running. If not, install Docker (apt-get install docker.io on Debian/Ubuntu, or dnf install docker on Fedora, or use the official convenience script if needed) and start it with systemctl.
 2. Pull the official LiveKit server image: docker pull livekit/livekit-server:latest
 3. Create a directory /opt/livekit if it does not exist.
@@ -82,23 +108,58 @@ Steps:
    docker run --rm livekit/livekit-server:latest generate-keys
    Parse the output and write it as a YAML file with fields api_key and api_secret.
 5. Start the LiveKit server container with host networking on port 7880:
-   docker run -d --name livekit-server --restart unless-stopped --network host \
-     -v /opt/livekit/keys.yaml:/etc/livekit/keys.yaml:ro \
-     livekit/livekit-server:latest \
+   docker run -d --name livekit-server --restart unless-stopped --network host \\
+     -v /opt/livekit/keys.yaml:/etc/livekit/keys.yaml:ro \\
+     livekit/livekit-server:latest \\
      --config /etc/livekit/keys.yaml --bind 0.0.0.0 --port 7880
 6. Wait up to 30 seconds and verify it is healthy: curl -sf http://127.0.0.1:7880
 7. Report back the WebSocket URL (ws://THIS_MACHINE_TAILSCALE_IP:7880 or ws://127.0.0.1:7880), the api_key, the api_secret, and whether the container is running.
+`;
+// Windows hosts: Docker Desktop does not support --network host, so ports are
+// mapped explicitly. --dev mode ships with well-known devkey/secret, which
+// sidesteps the `generate-keys` dance (that container command is awkward to
+// run/parse consistently from PowerShell).
+const LIVEKIT_SETUP_STEPS_WINDOWS = `Steps (Windows host — use PowerShell, NOT bash):
+1. Check if Docker Desktop is installed and running: docker info
+   If it is not installed, stop and report that Docker Desktop must be installed manually (winget install Docker.DockerDesktop), since it requires a GUI/WSL2 backend and cannot be silently installed headlessly.
+2. Pull the official LiveKit server image: docker pull livekit/livekit-server:latest
+3. Start the LiveKit server container in --dev mode (uses the well-known devkey/secret credentials, no key generation needed). Docker Desktop on Windows does not support --network host, so map ports explicitly:
+   docker run -d --name livekit-server --restart unless-stopped \`
+     -p 7880:7880 -p 7881:7881 -p 7881:7881/udp -p 50000-50100:50000-50100/udp \`
+     livekit/livekit-server:latest --dev --bind 0.0.0.0
+   (If a container named livekit-server already exists, remove it first with: docker rm -f livekit-server)
+4. Wait up to 30 seconds and verify it is healthy: curl.exe -sf http://127.0.0.1:7880 (or Invoke-WebRequest)
+5. The credentials in --dev mode are fixed: api_key = devkey, api_secret = secret.
+6. Report back the WebSocket URL (ws://THIS_MACHINE_TAILSCALE_IP:7880 or ws://127.0.0.1:7880), api_key "devkey", api_secret "secret", and whether the container is running.
+`;
+// Used when the hub's platform could not be determined before dispatch: ask
+// the agent to detect its own OS first, then follow the matching branch.
+const LIVEKIT_SETUP_STEPS_AUTODETECT = `Steps:
+0. FIRST, detect your own OS before running anything else:
+   - On Windows, $env:OS will be "Windows_NT" (PowerShell) — or the presence of \`Get-Command\` with no \`uname\` binary.
+   - On Linux/macOS, \`uname\` will succeed and print Linux/Darwin.
+   Branch into ONE of the two command sets below based on that detection. Do not run both.
 
-IMPORTANT: this is a headless fleet node. Do not open a browser. Only run shell commands and report the final LiveKit URL + credentials in a JSON code block like:
-\`\`\`json
-{
-  "url": "ws://127.0.0.1:7880",
-  "api_key": "...",
-  "api_secret": "...",
-  "running": true
-}
-\`\`\`
+--- IF WINDOWS (use PowerShell): ---
+${LIVEKIT_SETUP_STEPS_WINDOWS}
+
+--- IF LINUX/macOS (use bash/sh): ---
+${LIVEKIT_SETUP_STEPS_LINUX}
 `;
+function buildLivekitSetupPrompt(platform) {
+    let steps;
+    if (platform === 'win32') {
+        steps = LIVEKIT_SETUP_STEPS_WINDOWS;
+    }
+    else if (platform === 'linux' || platform === 'darwin') {
+        steps = LIVEKIT_SETUP_STEPS_LINUX;
+    }
+    else {
+        // Platform unknown ahead of dispatch — let the agent detect itself.
+        steps = LIVEKIT_SETUP_STEPS_AUTODETECT;
+    }
+    return LIVEKIT_SETUP_PROMPT_HEADER + '\n' + steps + LIVEKIT_SETUP_PROMPT_FOOTER;
+}
 function extractJson(text) {
     const m = text.match(/\`\`\`json\s*([\s\S]*?)\s*\`\`\`/);
     if (!m)
@@ -152,14 +213,20 @@ export async function roboparkSetupLivekit(opts) {
     console.log(chalk.dim('  ' + '─'.repeat(52)));
     console.log(`  hub:       ${chalk.cyan(hubUrl)}`);
     console.log(`  scheduler: ${chalk.cyan(schedulerUrl ?? 'not provided')}`);
+    const from = hostname().split('.')[0];
+    const manifest = await getHubManifest(hubUrl, token);
+    let platform = manifest.platform;
+    if (!platform)
+        platform = await getHubPlatformFromStatus(hubUrl, token);
+    console.log(`  hub platform: ${chalk.cyan(platform ?? 'unknown (agent will self-detect)')}`);
     console.log();
+    const prompt = buildLivekitSetupPrompt(platform);
     if (opts.dryRun) {
         console.log(chalk.yellow('  dry run — prompt that would be sent:'));
-        console.log(chalk.dim(LIVEKIT_SETUP_PROMPT.split('\n').map(l => '  ' + l).join('\n')));
+        console.log(chalk.dim(prompt.split('\n').map(l => '  ' + l).join('\n')));
         return;
     }
-    const from = hostname().split('.')[0];
-    const nodeId = await getHubNodeId(hubUrl, token);
+    const nodeId = manifest.nodeId;
     if (!nodeId) {
         console.log(chalk.red('  ✗ hub manifest not reachable. Is infinicode serve running on the hub?'));
         process.exit(1);
@@ -168,7 +235,7 @@ export async function roboparkSetupLivekit(opts) {
     const dispatchEnv = envelope('task.dispatch', from, {
         description: 'Install LiveKit server on hub via Docker',
         capabilities: ['shell', 'docker', 'reasoning'],
-        prompt: LIVEKIT_SETUP_PROMPT,
+        prompt,
         agent: 'opencode',
         context: { role: 'hub', site: 'fleet-hub' },
     }, { to: nodeId, auth: token });

package/dist/robopark/setup.js

@@ -9,7 +9,7 @@
  *   robopark setup --control --start
  */
 import chalk from 'chalk';
-import { mkdirSync, writeFileSync } from 'node:fs';
+import { mkdirSync, writeFileSync, readFileSync, existsSync, rmSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { spawn } from 'node:child_process';
@@ -23,6 +23,43 @@ function saveToken(token) {
     mkdirSync(dir, { recursive: true });
     writeFileSync(join(dir, 'mesh.token'), token, 'utf8');
 }
+/**
+ * Clear a stale device identity before a fresh enrollment.
+ *
+ * preview_agent.py only re-enrolls (POSTs /api/devices/enroll) when it has
+ * NO device_token. If ~/.robopark/device_token and ~/.robopark/preview_agent.json
+ * survive from a previous enrollment (e.g. against a different scheduler),
+ * PreviewAgent.__init__ loads that old token/device_id and skips enrollment
+ * entirely — silently reusing a stale identity, which then 401s against the
+ * new target scheduler. An explicit --enrollment-token means the caller
+ * wants a fresh enrollment, not to reuse a stale identity from a previous
+ * target scheduler, so wipe the persisted device_token/device_id (and the
+ * token file) whenever one is passed.
+ */
+function resetStaleEnrollment() {
+    const dir = join(homedir(), '.robopark');
+    const configPath = join(dir, 'preview_agent.json');
+    const tokenPath = join(dir, 'device_token');
+    if (existsSync(tokenPath)) {
+        try {
+            rmSync(tokenPath);
+        }
+        catch (err) {
+            console.log(chalk.yellow(`  ⚠ could not clear stale device token: ${err.message}`));
+        }
+    }
+    if (existsSync(configPath)) {
+        try {
+            const cfg = JSON.parse(readFileSync(configPath, 'utf8'));
+            delete cfg.device_id;
+            delete cfg.device_token;
+            writeFileSync(configPath, JSON.stringify(cfg, null, 2), 'utf8');
+        }
+        catch (err) {
+            console.log(chalk.yellow(`  ⚠ could not clear stale enrollment config: ${err.message}`));
+        }
+    }
+}
 /** Run an external command and detach unless foreground is requested. */
 function runDetached(cmd, args, env) {
     const proc = spawn(cmd, args, {
@@ -193,14 +230,21 @@ async function setupRobot(config, opts, ctx, internal) {
         const robotArgv = await infinicodeArgv(args);
         console.log(chalk.dim('  starting robot satellite node…'));
         runDetached(robotArgv[0], robotArgv.slice(1));
+        // NOTE: there is deliberately no separate `robopark enroll` spawn here.
+        // preview_agent.py's own startup (PreviewAgent.start(), see
+        // packages/robopark/scheduler/preview_agent.py) already performs
+        // enrollment itself whenever it has an --enrollment-token and no
+        // device_token yet. Spawning `robopark enroll` as well used to launch a
+        // SECOND full preview_agent.py process (enroll.ts runs the whole script,
+        // not a one-shot enroll-and-exit) with a different arg set (no
+        // --video-device/--audio-device/vision flags), which raced the "real"
+        // preview-agent process below for the same camera/mic and the vision
+        // webhook port (5057). --enrollment-token is already forwarded via
+        // previewAgentArgs, so one process below covers both enrollment and the
+        // long-running agent.
         if (opts.enrollmentToken) {
-            console.log(chalk.dim('  enrolling robot with scheduler…'));
-            const enrollArgv = [process.execPath, process.argv[1], 'enroll',
-                '--scheduler-url', schedulerUrl,
-                '--robot-id', internal.name,
-                '--enrollment-token', opts.enrollmentToken,
-                '--save-config'];
-            runDetached(enrollArgv[0], enrollArgv.slice(1));
+            console.log(chalk.dim('  fresh --enrollment-token given — clearing any stale device identity…'));
+            resetStaleEnrollment();
         }
         console.log(chalk.dim('  starting preview agent…'));
         const previewArgv = [process.execPath, process.argv[1], ...previewAgentArgs];

package/dist/robopark/stop-all.js

@@ -101,11 +101,15 @@ function stopAllUnix() {
         }
     }
     if (process.platform === 'linux') {
-        const list = spawnSync('systemctl', ['list-units', '--all', '--plain', '--no-legend', 'robopark-*'], { encoding: 'utf8' });
+        // Broad match, not just "robopark-*" — known unit names in the wild
+        // include a bare "infinicode.service" (see pi-client install scripts),
+        // which a narrower glob would silently leave running (and respawning
+        // whatever we just killed, if it has Restart=always).
+        const list = spawnSync('systemctl', ['list-units', '--all', '--plain', '--no-legend'], { encoding: 'utf8' });
         const units = (list.stdout ?? '')
             .split('\n')
             .map(l => l.trim().split(/\s+/)[0])
-            .filter((u) => !!u && u.endsWith('.service'));
+            .filter((u) => !!u && u.endsWith('.service') && /infinicode|robopark/i.test(u));
         for (const unit of units) {
             spawnSync('systemctl', ['stop', unit], { encoding: 'utf8' });
             const disable = spawnSync('systemctl', ['disable', unit], { encoding: 'utf8' });

package/dist/robopark-cli.js

@@ -16,6 +16,10 @@ import { roboparkScan } from './robopark/scan.js';
 import { roboparkServe } from './robopark/serve.js';
 import { roboparkSetup } from './robopark/setup.js';
 import { stopAll } from './robopark/stop-all.js';
+import { roboparkDoctor } from './robopark/doctor.js';
+import { roboparkAddRobot } from './robopark/add-robot.js';
+import { saveHubProfile, clearHubProfile } from './robopark/profile.js';
+import { roboparkAgentUp, roboparkAgentDown, roboparkAgentLogs } from './robopark/agent-ctl.js';
 // Read the real version from package.json so `--version` never drifts from
 // what is actually installed (this was a hardcoded constant that went stale
 // across several releases — see the identical fix + comment in cli.ts).
@@ -160,6 +164,95 @@ program
         process.exitCode = 1;
     }
 });
+program
+    .command('doctor')
+    .description('Run a full fleet health check: hub, scheduler, LiveKit servers, device heartbeats, production mode')
+    .option('--hub-url <url>', 'hub federation URL, e.g. http://100.64.1.2:47913')
+    .option('--token <token>', 'mesh auth token')
+    .option('--scheduler-url <url>', 'scheduler base URL, e.g. http://100.64.1.2:8080')
+    .action(async (opts) => {
+    await roboparkDoctor(opts);
+});
+program
+    .command('server-add')
+    .description('Register a LiveKit server with the RoboPark scheduler')
+    .option('--hub-url <url>', 'hub federation URL, e.g. http://100.64.1.2:47913')
+    .option('--scheduler-url <url>', 'scheduler URL, e.g. http://100.64.1.2:8080 (derived from --hub-url if omitted)')
+    .option('--token <token>', 'mesh auth token (optional)')
+    .requiredOption('--id <id>', 'unique server id, e.g. livekit-hub-docker')
+    .option('--name <name>', 'display name (defaults to --id)')
+    .requiredOption('--url <url>', 'LiveKit ws:// URL, e.g. ws://100.64.1.2:7880')
+    .option('--webhook-url <url>', 'internal http URL for health/metrics (defaults to --url with ws->http)')
+    .option('--api-key <key>', "LiveKit API key (defaults to 'devkey')")
+    .option('--api-secret <secret>', "LiveKit API secret (defaults to 'secret')")
+    .option('--max-sessions <n>', 'max concurrent sessions', '8')
+    .action(async (opts) => {
+    const { roboparkServerAdd } = await import('./robopark/server-add.js');
+    await roboparkServerAdd(opts);
+});
+program
+    .command('llm-set')
+    .description('Upsert LLM_PROVIDER/OLLAMA_* keys into a ROBOVOICE .env file')
+    .requiredOption('--env-path <path>', 'path to the target .env file (e.g. a ROBOVOICE checkout)')
+    .requiredOption('--provider <name>', 'ollama | ollama-cloud | groq')
+    .option('--model <name>', 'model name (ollama providers only)')
+    .option('--host <url>', 'Ollama server URL (ollama providers only)')
+    .option('--api-key <key>', 'API key for cloud auth (ollama-cloud; currently unused by ROBOVOICE — see CLI warning)')
+    .action(async (opts) => {
+    const { roboparkLlmSet } = await import('./robopark/llm-set.js');
+    await roboparkLlmSet(opts);
+});
+program
+    .command('hub-use')
+    .description('Save hub/scheduler/token/site as defaults so other commands stop needing them repeated')
+    .option('--hub-url <url>', 'hub federation URL, e.g. http://100.64.1.2:47913')
+    .option('--token <token>', 'shared mesh token')
+    .option('--scheduler-url <url>', 'scheduler base URL, e.g. http://100.64.1.2:8080')
+    .option('--site <site>', 'physical location, e.g. "Tel Aviv"')
+    .option('--clear', 'wipe the saved hub profile')
+    .action(async (opts) => {
+    if (opts.clear) {
+        clearHubProfile();
+        console.log(chalk.green('  ✓ cleared saved hub profile'));
+        return;
+    }
+    saveHubProfile({ hubUrl: opts.hubUrl, token: opts.token, schedulerUrl: opts.schedulerUrl, site: opts.site });
+    console.log(chalk.green('  ✓ saved hub profile to ~/.robopark/hub-profile.json'));
+});
+program
+    .command('add-robot <name>')
+    .description('Mint a scheduler enrollment token and print (or run) the robot setup one-liner')
+    .option('--site <site>', 'physical location, e.g. "Tel Aviv"')
+    .option('--hub-url <url>', 'hub federation URL (defaults to saved hub profile / auto-discovery)')
+    .option('--token <token>', 'shared mesh token (defaults to saved hub profile / auto-discovery)')
+    .option('--scheduler-url <url>', 'scheduler base URL (defaults to saved hub profile / auto-discovery)')
+    .option('--start', 'start the robot node on this machine now, instead of printing the one-liner')
+    .action(async (name, opts) => {
+    await roboparkAddRobot(config, { name, ...opts });
+});
+program
+    .command('agent-up')
+    .description('Start the ROBOVOICE docker stack and register its LiveKit server with the scheduler')
+    .requiredOption('--path <dir>', 'path to the ROBOVOICE checkout (contains docker-compose.yaml)')
+    .option('--scheduler-url <url>', 'scheduler URL (defaults to resolved hub context)')
+    .option('--hub-url <url>', 'hub URL (defaults to resolved hub context)')
+    .option('--token <token>', 'mesh token')
+    .option('--server-id <id>', "server id to register (default: 'robovoice-<hostname>')")
+    .option('--server-name <name>', 'server display name')
+    .option('--no-register', 'bring up docker only; skip scheduler registration')
+    .action(roboparkAgentUp);
+program
+    .command('agent-down')
+    .description('Stop the ROBOVOICE docker stack')
+    .requiredOption('--path <dir>', 'path to the ROBOVOICE checkout')
+    .action(roboparkAgentDown);
+program
+    .command('agent-logs')
+    .description('Tail ROBOVOICE docker compose logs')
+    .requiredOption('--path <dir>', 'path to the ROBOVOICE checkout')
+    .option('-f, --follow', 'follow log output')
+    .option('--service <name>', 'scope logs to one compose service (e.g. agent, livekit)')
+    .action(roboparkAgentLogs);
 program
     .command('setup')
     .description('Set up this device in one pass')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infinicode",
-  "version": "2.8.23",
+  "version": "2.8.26",
   "description": "OpenKernel — provider-agnostic AI execution kernel. Native coding agent + mission-driven execution runtime.",
   "type": "module",
   "main": "./dist/kernel/index.js",
@@ -73,6 +73,7 @@
     "node": ">=20"
   },
   "dependencies": {
+    "@anthropic-ai/claude-code": "^2.1.207",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",

package/packages/robopark/scheduler/main.py

@@ -298,6 +298,13 @@ async def init_db():
             ("sessions", "joined_at", "TEXT"),
             ("devices", "video_device", "TEXT"),
             ("devices", "audio_device", "TEXT"),
+            # Silence-based session end (see POST /api/sessions/{id}/keepalive
+            # and GET /api/sessions/{id}/status): tracks the last time some
+            # caller signaled this session was still active. Defaults to
+            # started_at at INSERT time; existing rows on an upgraded DB will
+            # have NULL here until touched, so readers should fall back to
+            # started_at (see the /status endpoint below).
+            ("sessions", "last_activity_at", "TEXT"),
         ):
             try:
                 await db.execute(f"ALTER TABLE {_table} ADD COLUMN {_column} {_coldef}")
@@ -485,6 +492,12 @@ async def request_session(robot_id: str,
             async with db.execute("SELECT name FROM devices WHERE id = ?", (robot_id,)) as dc:
                 device_row = await dc.fetchone()
             if device_row:
+                # OR IGNORE means this name is only ever written on first
+                # creation of the robots row. PATCH /api/devices/{device_id}
+                # now keeps robots.name in sync on every rename going forward,
+                # so a stale robots.name here is only possible if a session
+                # request race wins before that PATCH sync runs — not an
+                # ongoing drift concern.
                 await db.execute(
                     "INSERT OR IGNORE INTO robots (id, name, status) VALUES (?, ?, 'idle')",
                     (robot_id, device_row["name"]),
@@ -517,11 +530,12 @@ async def request_session(robot_id: str,
         session_id = f"session_{robot_id}_{int(datetime.utcnow().timestamp())}"
         room_name = f"robopark-{robot_id}-{int(datetime.utcnow().timestamp())}"
         
+        _now_iso = datetime.utcnow().isoformat()
         await db.execute("""
-            INSERT INTO sessions (id, robot_id, server_id, room_name, started_at)
-            VALUES (?, ?, ?, ?, ?)
-        """, (session_id, robot_id, server["id"], room_name, datetime.utcnow().isoformat()))
-        
+            INSERT INTO sessions (id, robot_id, server_id, room_name, started_at, last_activity_at)
+            VALUES (?, ?, ?, ?, ?, ?)
+        """, (session_id, robot_id, server["id"], room_name, _now_iso, _now_iso))
+
         # Update robot status + count this as a camera trigger. request-session
         # is the natural trigger point ("robot requests a session after scene
         # detection"), so the trigger_count populates here with no client change.
@@ -808,10 +822,11 @@ async def create_web_client_session(req: Optional[WebClientSessionRequest] = Non
         session_id = f"web_{int(datetime.utcnow().timestamp())}"
         room_name = f"robopark_web_{int(datetime.utcnow().timestamp())}"
         
+        _now_iso = datetime.utcnow().isoformat()
         await db.execute("""
-            INSERT INTO sessions (id, robot_id, server_id, room_name, started_at)
-            VALUES (?, ?, ?, ?, ?)
-        """, (session_id, "web-client", server["id"], room_name, datetime.utcnow().isoformat()))
+            INSERT INTO sessions (id, robot_id, server_id, room_name, started_at, last_activity_at)
+            VALUES (?, ?, ?, ?, ?, ?)
+        """, (session_id, "web-client", server["id"], room_name, _now_iso, _now_iso))
         
         await db.commit()
     
@@ -899,6 +914,61 @@ async def session_joined(session_id: str,
     await _log_history("session", "session", session_id, "joined", "robot", f"latency_ms={latency_ms}")
     return {"status": "ok", "joined_at": now, "latency_ms": latency_ms}
 
+@app.post("/api/sessions/{session_id}/keepalive")
+async def session_keepalive(session_id: str,
+                            authorization: Optional[str] = Header(default=None)):
+    """Silence-based session extension signal.
+
+    INTEGRATION POINT (out of scope here — lives in a different repo): the
+    VOICE AGENT is the one process that actually knows, via VAD, whether the
+    user/agent are still talking. While a motion-triggered session's
+    conversation is active, the voice agent should call this endpoint
+    periodically (e.g. every few seconds) to bump last_activity_at. The robot
+    side (preview_agent.py) has no independent way to know if a conversation
+    is ongoing — it only knows this via what it reads back from here through
+    GET /api/sessions/{session_id}/status. If nothing ever calls this
+    endpoint, last_activity_at simply stays at started_at and the session
+    will be torn down by preview_agent.py's silence timeout shortly after it
+    starts — that's an intentionally conservative default, not a bug.
+
+    preview_agent.py additionally enforces vision_session_seconds as a hard
+    ceiling regardless of activity, so a misbehaving/stuck caller can never
+    hold the publisher forever even if it calls this endpoint continuously.
+    """
+    if not await _authorize_fleet(authorization):
+        raise HTTPException(401, "Invalid or missing device token")
+    now = datetime.utcnow().isoformat()
+    async with aiosqlite.connect(DB_PATH) as db:
+        cur = await db.execute(
+            "UPDATE sessions SET last_activity_at = ? WHERE id = ? AND ended_at IS NULL",
+            (now, session_id),
+        )
+        await db.commit()
+        if cur.rowcount == 0:
+            raise HTTPException(404, "Session not found or already ended")
+    return {"status": "ok", "last_activity_at": now}
+
+@app.get("/api/sessions/{session_id}/status")
+async def get_session_status(session_id: str):
+    """Lightweight session status for polling — used by preview_agent.py to
+    decide whether a motion-triggered session is still "active" (recent
+    last_activity_at) or has gone silent and should be torn down. See
+    POST /api/sessions/{session_id}/keepalive for who updates last_activity_at."""
+    async with aiosqlite.connect(DB_PATH) as db:
+        db.row_factory = aiosqlite.Row
+        async with db.execute("SELECT * FROM sessions WHERE id = ?", (session_id,)) as c:
+            session = await c.fetchone()
+        if not session:
+            raise HTTPException(404, "Session not found")
+    return {
+        "session_id": session["id"],
+        "started_at": session["started_at"],
+        "ended_at": session["ended_at"],
+        # Existing rows created before this column existed (or that predate
+        # any keepalive call) have NULL here — fall back to started_at.
+        "last_activity_at": session["last_activity_at"] or session["started_at"],
+    }
+
 # ── Back-compat: legacy web-client session token (ported from the deployed OLD
 #    scheduler so voice_client.html / the old frontend keep working after the
 #    fork reconcile). Raw-PyJWT HS256, publish-capable "Web User" token. ──
@@ -1089,7 +1159,15 @@ async def health_checker():
                             if resp.status_code == 200:
                                 new_status = "online"
                             else:
-                                new_status = "offline"
+                                # A bare LiveKit server (no sidecar webhook
+                                # service in front of it, e.g. `--dev` mode
+                                # with no separate health endpoint) has no
+                                # /health route and returns 404 here even
+                                # though it's genuinely up — LiveKit's own
+                                # root path returns "OK" instead. Fall back
+                                # to that before declaring it offline.
+                                resp2 = await client.get(server["webhook_url"])
+                                new_status = "online" if resp2.status_code == 200 else "offline"
                     except:
                         new_status = "offline"
                     
@@ -1591,6 +1669,20 @@ async def update_device(device_id: str, payload: DeviceUpdate):
         await db.commit()
         if cur.rowcount == 0:
             raise HTTPException(404, "Device not found")
+        # Keep the legacy `robots` table's own `name` column in sync when this
+        # PATCH actually changes the device name. Without this, robots.name
+        # only ever gets set once (at first-creation, via INSERT OR IGNORE)
+        # and silently goes stale on every subsequent rename — the dashboard
+        # reads from /api/robots, not /api/devices, so it would keep showing
+        # the old name forever. Only touch robots.name when a name was part
+        # of this update (don't unconditionally overwrite it on unrelated
+        # field updates), and only if a robots row for this id exists.
+        if "name" in fields:
+            await db.execute(
+                "UPDATE robots SET name = ? WHERE id = ?",
+                (fields["name"], device_id),
+            )
+            await db.commit()
     await broadcast("device_updated", {"device_id": device_id, "fields": list(fields.keys())})
     await _log_history("device", "device", device_id, "updated", "operator", f"fields={','.join(fields.keys())}")
     return await get_device(device_id)
@@ -1769,6 +1861,10 @@ async def enroll_device(payload: DeviceEnrollRequest):
                     payload.name, device_id,
                 ),
             )
+            # OR IGNORE: only fires the first time this robots row is created.
+            # PATCH /api/devices/{device_id} now propagates renames into
+            # robots.name afterwards, so this is purely a first-creation
+            # concern, not an ongoing sync path.
             await db.execute(
                 "INSERT OR IGNORE INTO robots (id, name, character_id, status) VALUES (?, ?, ?, 'idle')",
                 (device_id, existing["name"] or payload.name or device_id, existing["character_id"]),
@@ -1805,6 +1901,10 @@ async def enroll_device(payload: DeviceEnrollRequest):
                     new_hash, None, now, now,
                 ),
             )
+            # OR IGNORE: only fires the first time this robots row is created.
+            # PATCH /api/devices/{device_id} now propagates renames into
+            # robots.name afterwards, so this is purely a first-creation
+            # concern, not an ongoing sync path.
             await db.execute(
                 "INSERT OR IGNORE INTO robots (id, name, character_id, status) VALUES (?, ?, ?, 'idle')",
                 (device_id, (payload.name or f"Pi-{device_id[-4:]}").strip(), payload.character_id),
@@ -1910,6 +2010,10 @@ async def device_request_session(device_id: str,
 
         # Mirror device -> robot identity (id == device_id). Additive + idempotent:
         # if the robot row already exists it is left untouched.
+        # OR IGNORE: only fires the first time this robots row is created.
+        # PATCH /api/devices/{device_id} now propagates renames into
+        # robots.name afterwards, so this is purely a first-creation
+        # concern, not an ongoing sync path.
         await db.execute(
             "INSERT OR IGNORE INTO robots (id, name, character_id) VALUES (?, ?, ?)",
             (device_id, device["name"] or device_id, device["character_id"]),
@@ -1938,10 +2042,11 @@ async def device_request_session(device_id: str,
         # timeout instead of the 30s default).
         room_name = f"robopark-{device_id}-{ts}"
 
+        _now_iso = datetime.utcnow().isoformat()
         await db.execute("""
-            INSERT INTO sessions (id, robot_id, server_id, room_name, started_at)
-            VALUES (?, ?, ?, ?, ?)
-        """, (session_id, device_id, server["id"], room_name, datetime.utcnow().isoformat()))
+            INSERT INTO sessions (id, robot_id, server_id, room_name, started_at, last_activity_at)
+            VALUES (?, ?, ?, ?, ?, ?)
+        """, (session_id, device_id, server["id"], room_name, _now_iso, _now_iso))
 
         # Mark the mirrored robot connecting + count the camera trigger, exactly
         # as the robot path does (request-session is the natural trigger point).