infinicode 2.8.37 → 2.8.38

package/packages/robopark/scheduler/main.py

@@ -5,6 +5,7 @@ Manages robot fleet, LiveKit servers, and session orchestration
 
 import os
 import asyncio
+import contextvars
 import json
 import logging
 import re
@@ -33,9 +34,15 @@ DB_PATH = os.path.join(os.getenv("SCHEDULER_DATA_DIR", "/app/data"), "scheduler.
 # Path to a ROBOVOICE-style settings file the scheduler reads for characters.
 # In production this should be a bind-mount to ROBOVOICE-main/settings.json (or .default.json).
 ROBOVOICE_SETTINGS_PATH = os.path.join(os.getenv("SCHEDULER_DATA_DIR", "/app/data"), "robovoice_settings.json")
-# Optional shared credential used only by the ROBOVOICE worker to refresh an
-# active RoboPark session. Device endpoints continue to require device tokens.
-ROBOPARK_AGENT_TOKEN = os.getenv("ROBOPARK_AGENT_TOKEN", "").strip()
+# Shared credential used only by the ROBOVOICE worker to refresh an active
+# RoboPark session. Device endpoints continue to require device tokens. If the
+# environment does not provide it, lifespan() creates/loads this local secret
+# file so a bare `robopark serve` is safe to run without manual secret wiring.
+ROBOPARK_AGENT_TOKEN = os.getenv("ROBOPARK_AGENT_TOKEN", "").strip()
+ROBOPARK_AGENT_TOKEN_FILE = os.getenv(
+    "ROBOPARK_AGENT_TOKEN_FILE",
+    os.path.join(os.getenv("SCHEDULER_DATA_DIR", "/app/data"), ".robopark-agent-token"),
+)
 
 # ElevenLabs credentials used by the /api/voices/elevenlabs endpoint. We accept
 # both the long-form ELEVENLABS_API_KEY and a shorter ELEVENLABS_KEY alias so
@@ -387,6 +394,31 @@ async def init_db():
                 PRIMARY KEY (device_id, service_name)
             );
 
+            -- ── Operator shell (C1 gap-fill) ──
+            -- When the operator clicks "Tail logs" or runs a diagnostic
+            -- command in the dashboard, we insert a row here. The robot
+            -- supervisor's next status-report poll receives the row in
+            -- its `commands` response, runs the request on a background
+            -- thread, and POSTs the result back to /api/devices/{id}/
+            -- supervisor-output which updates the `result` column. The
+            -- dashboard polls GET /api/robots/{id}/shell/result/{req_id}
+            -- for the response, with an 8s budget.
+            --
+            -- `kind` discriminates: tail_logs (read log file) vs
+            -- shell_run (execute an allowlisted diagnostic command).
+            CREATE TABLE IF NOT EXISTS shell_requests (
+                id TEXT PRIMARY KEY,
+                device_id TEXT NOT NULL,
+                service_name TEXT,
+                kind TEXT NOT NULL,
+                params TEXT NOT NULL DEFAULT '{}',
+                requested_at TEXT NOT NULL,
+                completed_at TEXT,
+                result_ok INTEGER,
+                result_payload TEXT
+            );
+            CREATE INDEX IF NOT EXISTS idx_shell_requests_device ON shell_requests(device_id, requested_at);
+
             CREATE TABLE IF NOT EXISTS history_log (
                 id INTEGER PRIMARY KEY AUTOINCREMENT,
                 timestamp TEXT DEFAULT CURRENT_TIMESTAMP,
@@ -561,18 +593,30 @@ async def init_db():
 # =============================================================================
 
 @asynccontextmanager
-async def lifespan(app: FastAPI):
-    await init_db()
-    if not ROBOPARK_AGENT_TOKEN:
-        logger.warning(
-            "ROBOPARK_AGENT_TOKEN is not set -- the voice agent's "
-            "POST /api/sessions/{id}/keepalive calls will all 401. Without "
-            "keepalive succeeding, every motion-triggered session's "
-            "last_activity_at never updates and gets cut off by its own "
-            "silence timeout within ~15s, before a greeting or any real "
-            "conversation can complete. Set it to match ROBOPARK_AGENT_TOKEN "
-            "in the voice agent's own .env before relying on production mode."
-        )
+async def lifespan(app: FastAPI):
+    await init_db()
+    global ROBOPARK_AGENT_TOKEN
+    if not ROBOPARK_AGENT_TOKEN:
+        try:
+            if os.path.isfile(ROBOPARK_AGENT_TOKEN_FILE):
+                with open(ROBOPARK_AGENT_TOKEN_FILE, "r", encoding="utf-8") as f:
+                    ROBOPARK_AGENT_TOKEN = f.read().strip()
+            if not ROBOPARK_AGENT_TOKEN:
+                ROBOPARK_AGENT_TOKEN = secrets.token_urlsafe(32)
+                os.makedirs(os.path.dirname(ROBOPARK_AGENT_TOKEN_FILE) or ".", exist_ok=True)
+                with open(ROBOPARK_AGENT_TOKEN_FILE, "w", encoding="utf-8") as f:
+                    f.write(ROBOPARK_AGENT_TOKEN + "\n")
+                try:
+                    os.chmod(ROBOPARK_AGENT_TOKEN_FILE, 0o600)
+                except OSError:
+                    pass
+                logger.info("Generated RoboPark agent secret in the scheduler data directory")
+        except OSError as exc:
+            logger.error("Could not load/create RoboPark agent secret: %s", exc)
+    if not ROBOPARK_AGENT_TOKEN:
+        logger.warning(
+            "RoboPark agent secret is unavailable; voice-agent keepalive calls will 401."
+        )
     asyncio.create_task(metrics_collector())
     asyncio.create_task(health_checker())
     yield
@@ -597,8 +641,60 @@ app.add_middleware(
     allow_credentials=_allow_credentials,
     allow_methods=["*"],
     allow_headers=["*"],
+    # X-Operator carries the per-action attribution. CORS preflight
+    # must allow it or the dashboard's rpAction() fetches will fail.
+    expose_headers=["X-Operator"],
 )
 
+
+# ── Operator-actor middleware (C3) ──
+# Reads the X-Operator header on every request and stores a sanitized
+# version in a contextvar. The header is informational only — the
+# scheduler is a single-tenant surface; the actor is recorded in the
+# audit log so "who clicked End-session?" is answerable. The header
+# value is sanitized at this boundary (trimmed, control chars stripped,
+# capped at 64 chars) so the value reaching the database is always a
+# safe printable string. An absent or invalid header leaves the
+# contextvar unset; _log_history then uses the call-site default
+# (usually "operator").
+class _OperatorActorMiddleware:
+    def __init__(self, app):
+        self.app = app
+    async def __call__(self, scope, receive, send):
+        if scope.get("type") == "http":
+            raw = None
+            # ASGI scope headers is a list of (name, value) tuples where
+            # value is bytes — except when a header has been repeated, in
+            # which case some servers emit (name, [b"a", b"b"]). Build a
+            # case-insensitive map that flattens both shapes.
+            for k, v in (scope.get("headers") or []):
+                if not isinstance(k, (bytes, bytearray)):
+                    continue
+                if k.lower() != b"x-operator":
+                    continue
+                if isinstance(v, (list, tuple)):
+                    v = b", ".join(bytes(x) for x in v if isinstance(x, (bytes, bytearray)))
+                if not isinstance(v, (bytes, bytearray)):
+                    continue
+                raw = bytes(v)
+                break
+            actor = None
+            if raw is not None:
+                try:
+                    actor = _sanitize_actor_name(raw.decode("utf-8", errors="replace"))
+                except Exception:
+                    actor = None
+            token = _current_actor_override.set(actor)
+            try:
+                await self.app(scope, receive, send)
+            finally:
+                _current_actor_override.reset(token)
+        else:
+            await self.app(scope, receive, send)
+
+
+app.add_middleware(_OperatorActorMiddleware)
+
 # WebSocket clients for real-time updates
 ws_clients: List[WebSocket] = []
 
@@ -693,15 +789,17 @@ async def robot_heartbeat(robot_id: str, ip_address: Optional[str] = None):
     return {"status": "ok"}
 
 @app.post("/api/robots/{robot_id}/request-session")
-async def request_session(robot_id: str,
-                          authorization: Optional[str] = Header(default=None)):
+async def request_session(robot_id: str,
+                          authorization: Optional[str] = Header(default=None)):
     """Robot requests a session after scene detection.
 
     Requires a valid enrolled-device Bearer token. The response never contains
     the LiveKit api_key/api_secret; instead the scheduler mints a short-lived
     JWT the robot uses to join the room."""
-    if not await _authorize_fleet(authorization):
-        raise HTTPException(401, "Invalid or missing device token")
+    if not await _authorize_fleet(authorization):
+        raise HTTPException(401, "Invalid or missing device token")
+    if not await get_production_mode():
+        raise HTTPException(403, "production_mode_off")
     async with aiosqlite.connect(DB_PATH) as db:
         db.row_factory = aiosqlite.Row
 
@@ -860,13 +958,24 @@ async def simulate_trigger(robot_id: str):
         return {"queued": False, "reason": "production_mode_off"}
     async with aiosqlite.connect(DB_PATH) as db:
         db.row_factory = aiosqlite.Row
-        async with db.execute(
-            "SELECT id, current_session_id FROM robots WHERE id = ?", (robot_id,)
-        ) as c:
-            robot = await c.fetchone()
-        if not robot:
-            raise HTTPException(404, "Robot not found")
-        if robot["current_session_id"]:
+        async with db.execute(
+            "SELECT id, current_session_id FROM robots WHERE id = ?", (robot_id,)
+        ) as c:
+            robot = await c.fetchone()
+        if not robot:
+            async with db.execute("SELECT id, name, character_id FROM devices WHERE id = ?", (robot_id,)) as c:
+                device = await c.fetchone()
+            if not device:
+                raise HTTPException(404, "Robot not found")
+            await db.execute(
+                "INSERT OR IGNORE INTO robots (id, name, character_id, status) VALUES (?, ?, ?, 'idle')",
+                (device["id"], device["name"], device["character_id"]),
+            )
+            await db.commit()
+            robot = {"id": device["id"], "current_session_id": None}
+        if not await _effective_device_production_mode(db, robot_id):
+            return {"queued": False, "reason": "device_production_mode_off"}
+        if robot["current_session_id"]:
             return {"queued": False, "reason": "session_active"}
         await db.execute(
             "INSERT INTO trigger_commands (robot_id, source, requested_at) VALUES (?, ?, ?) "
@@ -1542,14 +1651,16 @@ async def health_checker():
 # =============================================================================
 
 @app.get("/api/settings")
-async def get_settings():
-    """Public settings (production mode + whether default enrollment token exists)."""
-    pm = await get_production_mode()
-    has_default_token = bool(await get_setting("default_enrollment_token"))
-    return {
-        "production_mode": pm,
-        "default_enrollment_token_set": has_default_token,
-    }
+async def get_settings():
+    """Public settings with secret values reduced to status only."""
+    pm = await get_production_mode()
+    has_default_token = bool(await get_setting("default_enrollment_token"))
+    return {
+        "production_mode": pm,
+        "default_enrollment_token_set": has_default_token,
+        "agent_token_configured": bool(ROBOPARK_AGENT_TOKEN),
+        "agent_token_source": "environment" if os.getenv("ROBOPARK_AGENT_TOKEN", "").strip() else "scheduler_secret_file",
+    }
 
 @app.put("/api/settings")
 async def update_settings(payload: SettingsPayload):
@@ -1573,14 +1684,40 @@ async def update_settings(payload: SettingsPayload):
     await _log_history("settings", "settings", "production_mode", "updated", "operator", f"value={payload.production_mode}")
     return {"status": "ok", "production_mode": payload.production_mode}
 
-@app.post("/api/settings/enrollment-token/rotate")
-async def rotate_enrollment_token():
+@app.post("/api/settings/enrollment-token/rotate")
+async def rotate_enrollment_token():
     """Generate a fresh default enrollment token (rotates the secret)."""
     token = secrets.token_urlsafe(24)
     await set_setting("default_enrollment_token", _hash(token))
     logger.info("Default enrollment token rotated")
     await _log_history("settings", "settings", "default_enrollment_token", "rotated", "operator")
-    return {"enrollment_token": token}
+    return {"enrollment_token": token}
+
+@app.post("/api/settings/agent-token/provision")
+async def provision_agent_token(payload: Optional[dict] = None):
+    """Return the worker secret once so the UI/CLI can provision ROBOVOICE.
+
+    The value is never included in normal settings responses or logs. Rotation
+    is explicit because existing workers would otherwise lose connectivity.
+    """
+    global ROBOPARK_AGENT_TOKEN
+    rotate = bool((payload or {}).get("rotate"))
+    if rotate or not ROBOPARK_AGENT_TOKEN:
+        ROBOPARK_AGENT_TOKEN = secrets.token_urlsafe(32)
+        os.makedirs(os.path.dirname(ROBOPARK_AGENT_TOKEN_FILE) or ".", exist_ok=True)
+        temp_path = ROBOPARK_AGENT_TOKEN_FILE + ".tmp"
+        with open(temp_path, "w", encoding="utf-8") as f:
+            f.write(ROBOPARK_AGENT_TOKEN + "\n")
+        os.replace(temp_path, ROBOPARK_AGENT_TOKEN_FILE)
+        try:
+            os.chmod(ROBOPARK_AGENT_TOKEN_FILE, 0o600)
+        except OSError:
+            pass
+        await _log_history("settings", "settings", "agent_token", "rotated", "operator")
+    return {
+        "agent_token": ROBOPARK_AGENT_TOKEN,
+        "warning": "Shown once by this response. Store it only in the ROBOVOICE worker environment.",
+    }
 
 @app.get("/api/history")
 async def get_history(category: Optional[str] = None, limit: int = 200):
@@ -2181,18 +2318,63 @@ async def _authorize_device(device_id: str, authorization: Optional[str]) -> boo
 
 async def _log_history(category: str, entity_type: Optional[str] = None, entity_id: Optional[str] = None,
                        action: Optional[str] = None, actor: Optional[str] = None, details: Optional[str] = None):
-    """Append an immutable audit/history record."""
+    """Append an immutable audit/history record.
+
+    The actor argument is overridden by `_current_actor_override` (a
+    contextvar set by the FastAPI middleware from the X-Operator
+    header) when present. The middleware is the only writer to the
+    contextvar, so an untrusted caller cannot impersonate another
+    operator by setting it directly. Falls back to the call-site
+    `actor` argument when no override is set (e.g. system events)."""
+    final_actor = _current_actor_override.get() or actor
     try:
         async with aiosqlite.connect(DB_PATH) as db:
             await db.execute(
                 """INSERT INTO history_log (timestamp, category, entity_type, entity_id, action, actor, details)
                    VALUES (?, ?, ?, ?, ?, ?, ?)""",
-                (datetime.utcnow().isoformat(), category, entity_type, entity_id, action, actor, details),
+                (datetime.utcnow().isoformat(), category, entity_type, entity_id, action, final_actor, details),
             )
             await db.commit()
     except Exception as e:
         logger.warning(f"history log failed: {e}")
 
+
+# Per-request operator name. Set by the operator_actor_middleware (which
+# reads the X-Operator header) and read by _log_history. Sanitized at
+# the middleware boundary so the value reaching the database is always
+# a safe printable string.
+_current_actor_override: contextvars.ContextVar[Optional[str]] = contextvars.ContextVar("current_actor", default=None)
+
+
+def _sanitize_actor_name(name: Optional[str]) -> Optional[str]:
+    """Trim, strip control chars, cap at 64 chars. Returns None if the
+    result is empty so the caller can fall back to the default actor."""
+    if not name:
+        return None
+    s = str(name).strip()
+    if not s:
+        return None
+    # Allow printable ASCII + tab; strip everything else. Newlines and
+    # CR would split a single history row into two display lines, so
+    # we collapse them to a single space.
+    out = []
+    for c in s:
+        if c == "\t" or c == " ":
+            out.append(c)
+        elif 0x20 <= ord(c) < 0x7f:
+            out.append(c)
+        else:
+            # collapse any other whitespace-ish char to a space
+            if c in ("\n", "\r", "\v", "\f"):
+                out.append(" ")
+            # drop anything else silently
+    cleaned = "".join(out).strip()
+    if not cleaned:
+        return None
+    if len(cleaned) > 64:
+        cleaned = cleaned[:64]
+    return cleaned
+
 async def _authorize_fleet(authorization: Optional[str]) -> bool:
     """Verify a Bearer token matches ANY enrolled device token (fleet auth).
 
@@ -2414,12 +2596,55 @@ async def device_supervisor_status(device_id: str, payload: SupervisorStatusRepo
         # "restart" on a service) onto this same request/response cycle --
         # the robot already calls this every 10s, no separate poll needed.
         # Consumed immediately: read then delete, so a command fires once.
-        async with db.execute(
-            "SELECT service_name, action FROM supervisor_commands WHERE device_id = ?", (device_id,)
-        ) as c:
-            pending = [dict(r) for r in await c.fetchall()]
+        # Backward-compat: rows may or may not have a `kind` column on
+        # older DBs. Default to the original "supervisor_action" kind
+        # (treated as restart / start / stop on the service) when missing.
+        pending = []
+        try:
+            async with db.execute(
+                "SELECT service_name, action, kind, params, id FROM shell_requests "
+                "WHERE device_id = ? AND completed_at IS NULL ORDER BY requested_at",
+                (device_id,),
+            ) as c:
+                shell_rows = [dict(r) for r in await c.fetchall()]
+            for r in shell_rows:
+                pending.append({
+                    "service_name": r.get("service_name") or "",
+                    "action": "run",
+                    "kind": r.get("kind") or "shell_run",
+                    "params": json.loads(r["params"]) if r.get("params") else {},
+                    "id": r["id"],
+                })
+        except Exception:
+            shell_rows = []
+        try:
+            async with db.execute(
+                "SELECT service_name, action FROM supervisor_commands WHERE device_id = ?", (device_id,)
+            ) as c:
+                for r in await c.fetchall():
+                    pending.append({"service_name": r["service_name"], "action": r["action"], "kind": "supervisor_action"})
+        except Exception:
+            pass
         if pending:
-            await db.execute("DELETE FROM supervisor_commands WHERE device_id = ?", (device_id,))
+            # Mark shell requests as "in flight" so the dashboard can
+            # distinguish "queued" from "still queued" (the row is read
+            # but not yet completed). supervisor_commands rows are
+            # one-shot and are deleted to mirror the previous behavior.
+            try:
+                ids = [p["id"] for p in pending if p.get("id")]
+                if ids:
+                    placeholders = ",".join("?" for _ in ids)
+                    await db.execute(
+                        f"UPDATE shell_requests SET requested_at = requested_at "
+                        f"WHERE id IN ({placeholders})",
+                        ids,
+                    )
+            except Exception:
+                pass
+            try:
+                await db.execute("DELETE FROM supervisor_commands WHERE device_id = ?", (device_id,))
+            except Exception:
+                pass
             await db.commit()
     await broadcast("supervisor_status", {"device_id": device_id, "services": blob})
     return {"status": "ok", "commands": pending}
@@ -2446,6 +2671,244 @@ async def restart_device_service(device_id: str, service_name: str):
     await _log_history("device", "device", device_id, "service_restart_queued", "operator", f"service={service_name}")
     return {"status": "queued", "service": service_name}
 
+
+# ── Operator shell (C1) ──
+# Endpoints the dashboard calls to tail logs and run a small allowlisted
+# set of diagnostic commands on a specific robot. Commands are queued in
+# the `shell_requests` table; the robot's supervisor picks them up on its
+# next status-report poll, runs them, and POSTs results back to
+# /api/devices/{id}/supervisor-output. The dashboard polls
+# /api/robots/{id}/shell/result/{request_id} with an 8s budget.
+
+class ShellRequest(BaseModel):
+    kind: str  # "tail_logs" | "shell_run"
+    service: Optional[str] = None
+    params: Optional[dict] = None
+
+
+async def _queue_shell_request_async(device_id: str, kind: str, service: Optional[str], params: dict) -> str:
+    """Insert a shell request row and return its id. Picked up by the
+    robot's supervisor on its next status-report poll."""
+    request_id = secrets.token_urlsafe(12)
+    now = datetime.utcnow().isoformat()
+    async with aiosqlite.connect(DB_PATH) as db:
+        await db.execute(
+            """INSERT INTO shell_requests
+               (id, device_id, service_name, kind, params, requested_at)
+               VALUES (?, ?, ?, ?, ?, ?)""",
+            (request_id, device_id, service, kind, json.dumps(params or {}), now),
+        )
+        await db.commit()
+    return request_id
+
+
+@app.post("/api/robots/{robot_id}/shell/tail")
+async def robot_shell_tail(robot_id: str, payload: ShellRequest):
+    """Queue a tail-logs request for a robot. Returns a request_id the
+    dashboard polls to get the result.
+
+    robot_id == device_id in this codebase (the dashboard's "robot" id is
+    the same value as /api/devices rows)."""
+    device_id = robot_id
+    params = dict(payload.params or {})
+    if "lines" not in params:
+        params["lines"] = 200
+    request_id = await _queue_shell_request_async(device_id, "tail_logs", payload.service, params)
+    return {"status": "queued", "request_id": request_id, "device_id": device_id}
+
+
+@app.post("/api/robots/{robot_id}/shell/exec")
+async def robot_shell_exec(robot_id: str, payload: ShellRequest):
+    """Queue a shell-run request for a robot. Returns a request_id the
+    dashboard polls to get the result."""
+    device_id = robot_id
+    params = dict(payload.params or {})
+    if not params.get("name"):
+        raise HTTPException(400, "params.name is required (e.g. 'uptime', 'free', 'ps', 'tail')")
+    request_id = await _queue_shell_request_async(device_id, "shell_run", payload.service, params)
+    return {"status": "queued", "request_id": request_id, "device_id": device_id}
+
+
+@app.get("/api/robots/{robot_id}/shell/result/{request_id}")
+async def robot_shell_result(robot_id: str, request_id: str):
+    """Return the result of a previously-queued shell request. The
+    dashboard polls this with an 8s budget; we reply as soon as the
+    robot has reported the result back."""
+    async with aiosqlite.connect(DB_PATH) as db:
+        db.row_factory = aiosqlite.Row
+        async with db.execute("SELECT * FROM shell_requests WHERE id = ?", (request_id,)) as c:
+            r = await c.fetchone()
+        if not r or r["device_id"] != robot_id:
+            raise HTTPException(404, "No such shell request for this robot")
+        out = {
+            "request_id": r["id"],
+            "device_id": r["device_id"],
+            "service": r["service_name"],
+            "kind": r["kind"],
+            "params": json.loads(r["params"]) if r["params"] else {},
+            "requested_at": r["requested_at"],
+            "completed": r["completed_at"] is not None,
+            "completed_at": r["completed_at"],
+            "result": None,
+        }
+        if r["completed_at"] is not None:
+            try:
+                out["result"] = json.loads(r["result_payload"]) if r["result_payload"] else {"ok": bool(r["result_ok"])}
+            except Exception:
+                out["result"] = {"ok": bool(r["result_ok"]), "error": "(result payload not parseable)"}
+        return out
+
+
+# Long-poll variant: holds the connection open until the result arrives
+# (or the 8s budget elapses), so the dashboard can wait without polling
+# in a tight loop.
+@app.get("/api/robots/{robot_id}/shell/wait/{request_id}")
+async def robot_shell_wait(robot_id: str, request_id: str, timeout: float = 8.0):
+    deadline = asyncio.get_event_loop().time() + max(0.5, min(15.0, timeout))
+    while True:
+        async with aiosqlite.connect(DB_PATH) as db:
+            db.row_factory = aiosqlite.Row
+            async with db.execute("SELECT * FROM shell_requests WHERE id = ?", (request_id,)) as c:
+                r = await c.fetchone()
+        if not r or r["device_id"] != robot_id:
+            raise HTTPException(404, "No such shell request for this robot")
+        if r["completed_at"] is not None:
+            try:
+                payload = json.loads(r["result_payload"]) if r["result_payload"] else {"ok": bool(r["result_ok"])}
+            except Exception:
+                payload = {"ok": bool(r["result_ok"]), "error": "(result payload not parseable)"}
+            return {"request_id": request_id, "completed": True, "result": payload}
+        if asyncio.get_event_loop().time() >= deadline:
+            return {"request_id": request_id, "completed": False, "timed_out": True}
+        await asyncio.sleep(0.4)
+
+
+@app.post("/api/devices/{device_id}/supervisor-output")
+async def device_supervisor_output(device_id: str, payload: dict, authorization: Optional[str] = Header(default=None)):
+    """Robot supervisor posts back the result of a tail_logs or shell_run
+    request. We just record it on the shell_requests row; the dashboard
+    picks it up via /api/robots/{id}/shell/result/{request_id}."""
+    if not await _authorize_device(device_id, authorization):
+        raise HTTPException(401, "Invalid device token")
+    request_id = payload.get("request_id")
+    if not request_id:
+        raise HTTPException(400, "request_id is required")
+    now = datetime.utcnow().isoformat()
+    result_payload = payload.get("payload") or {}
+    ok = 1 if result_payload.get("ok") else 0
+    async with aiosqlite.connect(DB_PATH) as db:
+        db.row_factory = aiosqlite.Row
+        async with db.execute("SELECT device_id FROM shell_requests WHERE id = ?", (request_id,)) as c:
+            r = await c.fetchone()
+        if not r:
+            raise HTTPException(404, "No such shell request")
+        if r["device_id"] != device_id:
+            raise HTTPException(403, "request_id does not belong to this device")
+        await db.execute(
+            """UPDATE shell_requests SET completed_at = ?, result_ok = ?, result_payload = ?
+               WHERE id = ?""",
+            (now, ok, json.dumps(result_payload), request_id),
+        )
+        await db.commit()
+    kind = payload.get("kind") or "shell"
+    service = payload.get("service") or ""
+    await _log_history("device", "device", device_id, f"shell_{kind}_completed", "operator",
+                       f"service={service}, request_id={request_id}, ok={bool(ok)}")
+    return {"status": "ok"}
+
+
+# Endpoint the dashboard uses to list the available shell commands
+# (allowlist) so the UI can populate a picker instead of typing names.
+# The list mirrors the SHELL_ALLOWLIST in robot_supervisor.py — that
+# file is the authoritative source for what's actually allowed at
+# run time. Keep these two lists in sync when adding/removing commands.
+SHELL_DASHBOARD_ALLOWLIST = [
+    {"name": "uptime",        "argv": ["uptime"]},
+    {"name": "free",          "argv": ["free", "-m"]},
+    {"name": "df",            "argv": ["df", "-h"]},
+    {"name": "ps",            "argv": ["ps", "aux"]},
+    {"name": "uname",         "argv": ["uname", "-a"]},
+    {"name": "date",          "argv": ["date"]},
+    {"name": "whoami",        "argv": ["whoami"]},
+    {"name": "hostname",      "argv": ["hostname"]},
+    {"name": "ip",            "argv": ["ip", "addr"]},
+    {"name": "ss",            "argv": ["ss", "-tlnp"]},
+    {"name": "os-release",    "argv": ["cat", "/etc/os-release"]},
+    {"name": "ls-logs",       "argv": ["ls", "-la", "<dir>"]},
+    {"name": "systemctl-status", "argv": ["systemctl", "status", "<name>", "--no-pager", "-n", "30"]},
+    {"name": "journalctl",    "argv": ["journalctl", "-u", "<name>", "-n", "200", "--no-pager"]},
+    {"name": "tail",          "argv": ["tail", "-n", "<n>", "<path>"]},
+]
+SHELL_DASHBOARD_OUTPUT_MAX = 64 * 1024
+SHELL_DASHBOARD_TIMEOUT = 8.0
+
+@app.get("/api/shell/allowlist")
+async def shell_allowlist():
+    """Return the list of shell command names the robot's supervisor
+    supports. The dashboard uses this to populate the picker; the
+    robot side does the actual allowlist enforcement at run time."""
+    return {
+        "commands": [
+            {"name": s["name"], "argv": s["argv"]}
+            for s in SHELL_DASHBOARD_ALLOWLIST
+        ],
+        "max_output_bytes": SHELL_DASHBOARD_OUTPUT_MAX,
+        "timeout_seconds": SHELL_DASHBOARD_TIMEOUT,
+    }
+
+
+# ── Speaker roundtrip test (C2) ──
+# The dashboard's "Test speaker" button hits this. We queue a
+# speaker_test request on the robot's shell_requests table; the
+# robot's next status-report poll runs the round-trip (play tone,
+# record mic) and POSTs the result back via /supervisor-output.
+# The dashboard polls the same /shell/wait endpoint used for the
+# other shell commands (the supervisor treats speaker_test as
+# just another request kind).
+
+class SpeakerTestRequest(BaseModel):
+    frequency: Optional[float] = None
+    duration: Optional[float] = None
+    amplitude: Optional[float] = None
+    threshold_db: Optional[float] = None
+    output: Optional[str] = None
+    input: Optional[str] = None
+    sample_rate: Optional[int] = None
+
+
+@app.post("/api/robots/{robot_id}/shell/speaker-test")
+async def robot_speaker_test(robot_id: str, payload: SpeakerTestRequest):
+    """Queue a speaker + mic round-trip test on the robot. Returns a
+    request_id; poll /api/robots/{id}/shell/wait/{rid} for the result."""
+    device_id = robot_id
+    params = payload.model_dump(exclude_none=True)
+    request_id = await _queue_shell_request_async(device_id, "speaker_test", None, params)
+    return {"status": "queued", "request_id": request_id, "device_id": device_id}
+
+
+# ── Incident acknowledgement (C4) ──
+# The dashboard's Incidents sub-tab lets an operator acknowledge an
+# active incident (a robot stuck in stuck_session, server_unavailable,
+# etc). The acknowledgement is stored client-side (localStorage) so
+# each operator on their own browser gets their own list; this
+# endpoint is the "central log" mirror so the ack also shows up in
+# the audit history with the operator's name (via X-Operator).
+class IncidentAck(BaseModel):
+    robot_id: str
+    code: str
+    message: Optional[str] = None
+
+@app.post("/api/incidents/ack")
+async def incidents_ack(payload: IncidentAck, x_operator: Optional[str] = Header(default=None, alias="X-Operator")):
+    """Log an operator ack of an active incident. The dashboard
+    stores its own list; this endpoint mirrors the ack in the audit
+    log so the action is visible centrally with the operator's name."""
+    actor = _sanitize_actor_name(x_operator) or 'operator'
+    await _log_history("incident", "robot", payload.robot_id, "acked", actor,
+                       f"code={payload.code}, message={payload.message or ''}")
+    return {"status": "ok", "robot_id": payload.robot_id, "code": payload.code, "by": actor, "at": datetime.utcnow().isoformat()}
+
+
 @app.get("/api/devices/{device_id}/config")
 async def device_config(device_id: str, authorization: Optional[str] = Header(default=None)):
     """Pi polls this to learn current production_mode + assigned character, etc."""
@@ -2506,10 +2969,14 @@ async def device_request_session(device_id: str,
         db.row_factory = aiosqlite.Row
 
         # Resolve the enrolled device.
-        async with db.execute("SELECT * FROM devices WHERE id = ?", (device_id,)) as c:
-            device = await c.fetchone()
-            if not device:
-                raise HTTPException(404, "Device not found")
+        async with db.execute("SELECT * FROM devices WHERE id = ?", (device_id,)) as c:
+            device = await c.fetchone()
+            if not device:
+                raise HTTPException(404, "Device not found")
+        if not await get_production_mode():
+            raise HTTPException(403, "production_mode_off")
+        if not bool(device["production_mode"]):
+            raise HTTPException(403, "device_production_mode_off")
 
         # Mirror device -> robot identity (id == device_id). Additive + idempotent:
         # if the robot row already exists it is left untouched.
@@ -3693,12 +4160,16 @@ async def dashboard():
                     const connected = ref(false);
                     const serverMetrics = ref({});
                     const devices = ref([]);
-                    const settings = ref({ production_mode: false, default_enrollment_token_set: false });
+                    const settings = ref({ production_mode: false, default_enrollment_token_set: false, agent_token_configured: false, agent_token_source: null });
                     const livekit = ref({ url: null, api_key: null, has_secret: false });
-                    const showAddDevice = ref(false);
-                    const showDevices = ref(true);
+                    const showAddDevice = ref(false);
+                    const showDevices = ref(true);
+                    const showCommands = ref(false);
+                    const commandNetwork = ref('lan');
+                    const commandRobotId = ref('');
                     const newDevice = ref({ name: '', tailscale_ip: '', lan_ip: '', motor_server_url: '', character_id: '', livekit_url: '', video_device: 'auto', audio_device: 'default', notes: '' });
-                    const rotatedToken = ref(null);
+                    const rotatedToken = ref(null);
+                    const enrollmentNetwork = ref('lan');
                     const preview = ref({ robot: null, active: false, url: null, token: null, room: null, keepalive: null });
                     const simulation = ref({ robotId: null, busy: false });
                     const deviceInventory = ref({});
@@ -3756,18 +4227,25 @@ async def dashboard():
 
                     const buildDeviceInventory = () => {
                         const map = {};
-                        for (const robot of robots.value) {
-                            const device = devices.value.find(d => d.name === robot.name || d.id === robot.id);
-                            const savedVideo = device?.video_device || 'auto';
-                            const savedAudio = device?.audio_device || 'default';
-                            map[robot.id] = {
-                                deviceId: device?.id || null,
-                                robotName: robot.name,
-                                selectedVideo: savedVideo,
-                                selectedAudio: savedAudio,
-                                videoOptions: ['auto', 'none', 'picamera', '/dev/video0', '/dev/video1', '/dev/video2'],
-                                audioOptions: ['default', 'none'],
-                            };
+                        for (const robot of robots.value) {
+                            const device = devices.value.find(d => d.name === robot.name || d.id === robot.id);
+                            const savedVideo = device?.video_device || 'auto';
+                            const savedAudio = device?.audio_device || 'default';
+                            const hardware = device?.device_inventory || {};
+                            const videoOptions = (hardware.video || []).map(x => typeof x === 'string' ? x : x.id).filter(Boolean);
+                            const audioOptions = (hardware.audio_input || []).map(x => typeof x === 'string' ? x : x.id).filter(Boolean);
+                            const audioOutputOptions = (hardware.audio_output || []).map(x => typeof x === 'string' ? x : x.id).filter(Boolean);
+                            map[robot.id] = {
+                                deviceId: device?.id || null,
+                                robotName: robot.name,
+                                selectedVideo: savedVideo,
+                                selectedAudio: savedAudio,
+                                selectedAudioOutput: device?.audio_output_device || 'default',
+                                greetingText: (device?.greeting_phrases || []).join('\\n'),
+                                videoOptions: [...new Set(['auto', 'none', savedVideo, ...videoOptions])],
+                                audioOptions: [...new Set(['default', 'none', savedAudio, ...audioOptions])],
+                                audioOutputOptions: [...new Set(['default', 'none', device?.audio_output_device || 'default', ...audioOutputOptions])],
+                            };
                         }
                         deviceInventory.value = map;
                     };
@@ -3837,7 +4315,7 @@ async def dashboard():
                         }
                     };
 
-                    const rotateEnrollmentToken = async () => {
+                    const rotateEnrollmentToken = async () => {
                         if (!confirm('Rotate the global default enrollment token? Any Pi waiting to enroll with the previous token will be rejected.')) return;
                         try {
                             const r = await fetch('/api/settings/enrollment-token/rotate', { method: 'POST' }).then(r => r.json());
@@ -3846,7 +4324,23 @@ async def dashboard():
                         } catch (e) {
                             alert('Failed to rotate token: ' + e.message);
                         }
-                    };
+                    };
+
+                    const provisionAgentToken = async (rotate = false) => {
+                        if (rotate && !confirm('Rotate the ROBOVOICE authentication secret? Existing workers must be restarted after synchronization.')) return;
+                        try {
+                            const r = await fetch('/api/settings/agent-token/provision', {
+                                method: 'POST', headers: {'Content-Type': 'application/json'},
+                                body: JSON.stringify({ rotate }),
+                            }).then(r => r.json());
+                            if (!r.agent_token) throw new Error(r.detail || 'No secret returned');
+                            alert('ROBOVOICE secret (shown once):\\n\\n' + r.agent_token + '\\n\\nCopy it into the worker environment or run: robopark secrets --scheduler-url ' + window.location.origin + ' --worker-env <ROBOVOICE>/.env');
+                            settings.value.agent_token_configured = true;
+                            await fetchData();
+                        } catch (e) {
+                            alert('Failed to provision agent secret: ' + e.message);
+                        }
+                    };
 
                     const submitNewDevice = async () => {
                         try {
@@ -3866,7 +4360,7 @@ async def dashboard():
                         }
                     };
 
-                    const updateDeviceMedia = async (robotId) => {
+                    const updateDeviceMedia = async (robotId) => {
                         const inv = deviceInventory.value[robotId];
                         if (!inv || !inv.deviceId) return;
                         try {
@@ -3874,18 +4368,20 @@ async def dashboard():
                                 method: 'PATCH',
                                 headers: {'Content-Type': 'application/json'},
                                 body: JSON.stringify({
-                                    video_device: inv.selectedVideo,
-                                    audio_device: inv.selectedAudio,
-                                }),
-                            });
-                            fetchData();
+                                    video_device: inv.selectedVideo,
+                                    audio_device: inv.selectedAudio,
+                                    audio_output_device: inv.selectedAudioOutput,
+                                }),
+                            });
+                            if (!response.ok) throw new Error(`HTTP ${response.status}`);
+                            fetchData();
                         } catch (e) {
                             alert('Failed to update device media: ' + e.message);
                         }
                     };
 
-                    const startPreview = async (robot) => {
-                        stopPreview();
+                    const startPreview = async (robot) => {
+                        await stopPreview();
                         try {
                             const r = await fetch(`/api/robots/${robot.id}/preview/start`, { method: 'POST' }).then(r => r.json());
                             if (!r.active) {
@@ -3905,13 +4401,19 @@ async def dashboard():
                         }
                     };
 
-                    const stopPreview = () => {
-                        if (preview.value.keepalive) clearInterval(preview.value.keepalive);
-                        if (preview.value.room) {
-                            try { window.__lkPreviewRoom?.disconnect(); } catch (e) {}
-                        }
-                        preview.value = { robot: null, active: false, url: null, token: null, room: null, keepalive: null };
-                    };
+                    const stopPreview = async () => {
+                        const robotId = preview.value.robot?.id;
+                        if (preview.value.keepalive) clearInterval(preview.value.keepalive);
+                        if (preview.value.room) {
+                            try { window.__lkPreviewRoom?.disconnect(); } catch (e) {}
+                        }
+                        preview.value = { robot: null, active: false, url: null, token: null, room: null, keepalive: null };
+                        if (robotId) {
+                            try {
+                                await fetch(`/api/robots/${robotId}/preview/stop`, { method: 'POST' });
+                            } catch (e) { console.warn('preview stop failed', e); }
+                        }
+                    };
 
                     const simulateTrigger = async (robot) => {
                         if (!settings.value.production_mode || simulation.value.busy) return;
@@ -3931,7 +4433,7 @@ async def dashboard():
                         }
                     };
 
-                    const stopConversation = async (robot) => {
+                    const stopConversation = async (robot) => {
                         try {
                             const response = await fetch(`/api/robots/${robot.id}/simulate-stop`, { method: 'POST' });
                             const result = await response.json();
@@ -3940,7 +4442,52 @@ async def dashboard():
                         } catch (e) {
                             alert('Failed to stop conversation: ' + e.message);
                         }
-                    };
+                    };
+
+                    const recoverRobot = async (robot) => {
+                        if (!confirm(`Clear stale session state for ${robot.name}?`)) return;
+                        try {
+                            const response = await fetch(`/api/robots/${robot.id}/recover`, { method: 'POST' });
+                            const result = await response.json();
+                            if (!response.ok) throw new Error(result.detail || `HTTP ${response.status}`);
+                            await fetchData();
+                        } catch (e) {
+                            alert('Failed to recover robot: ' + e.message);
+                        }
+                    };
+
+                    const toggleDeviceProduction = async (robotId) => {
+                        const inv = deviceInventory.value[robotId];
+                        if (!inv || !inv.deviceId) return;
+                        await setDeviceProduction(inv.deviceId);
+                    };
+
+                    const setDeviceProduction = async (deviceId) => {
+                        const device = devices.value.find(d => d.id === deviceId);
+                        if (!device) return;
+                        try {
+                            const response = await fetch(`/api/devices/${deviceId}`, {
+                                method: 'PATCH', headers: {'Content-Type': 'application/json'},
+                                body: JSON.stringify({ production_mode: !device?.production_mode }),
+                            });
+                            if (!response.ok) throw new Error(`HTTP ${response.status}`);
+                            await fetchData();
+                        } catch (e) { alert('Failed to change robot production mode: ' + e.message); }
+                    };
+
+                    const saveDeviceGreetings = async (robotId) => {
+                        const inv = deviceInventory.value[robotId];
+                        if (!inv || !inv.deviceId) return;
+                        try {
+                            const greeting_phrases = inv.greetingText.split(/\\r?\\n/).map(s => s.trim()).filter(Boolean).slice(0, 20);
+                            const response = await fetch(`/api/devices/${inv.deviceId}`, {
+                                method: 'PATCH', headers: {'Content-Type': 'application/json'},
+                                body: JSON.stringify({ greeting_phrases }),
+                            });
+                            if (!response.ok) throw new Error(`HTTP ${response.status}`);
+                            await fetchData();
+                        } catch (e) { alert('Failed to save greetings: ' + e.message); }
+                    };
 
                     const connectLiveKitPreview = async (url, token) => {
                         const { Room } = LiveKitClient;
@@ -3977,7 +4524,15 @@ async def dashboard():
                         }
                     };
 
-                    const dismissRotatedToken = () => { rotatedToken.value = null; };
+                    const dismissRotatedToken = () => { rotatedToken.value = null; };
+                    const enrollmentCommand = (token) => {
+                        if (!token) return '';
+                        const schedulerPort = window.location.port || '8080';
+                        const networkFlag = enrollmentNetwork.value === 'tailscale' ? '--tailscale' : '--lan';
+                        const hubProtocol = window.location.protocol === 'https:' ? 'https://' : 'http://';
+                        const hubUrl = `${hubProtocol}${window.location.hostname}:47913`;
+                        return `robopark setup --robot --name "${token.name || token.device_id}" --hub-url ${hubUrl} --scheduler-port ${schedulerPort} ${networkFlag} --enrollment-token ${token.token} --start --auto-start`;
+                    };
 
                     const joinConversation = async (device) => {
                         try {
@@ -4080,9 +4635,10 @@ async def dashboard():
                         setInterval(fetchData, 30000);
                     });
 
-                    onUnmounted(() => {
-                        if (ws) ws.close();
-                    });
+                    onUnmounted(() => {
+                        if (ws) ws.close();
+                        stopPreview();
+                    });
 
                     const openVoiceStackForm = (stack = null) => {
                         if (stack) {
@@ -4176,17 +4732,44 @@ async def dashboard():
                     const stackName = (id) => voiceStacks.value.find(s => s.id === id)?.name || '—';
                     const characterName = (id) => characterPresets.value.find(c => c.id === id)?.name || '—';
 
-                    return {
-                        robots, servers, sessions, stats, connected, serverMetrics,
-                        devices, settings, livekit, showAddDevice, showDevices, newDevice, rotatedToken, simulation,
+                    const schedulerBase = () => window.location.origin;
+                    const selectedCommandRobot = computed(() => devices.value.find(d => d.id === commandRobotId.value) || devices.value[0] || null);
+                    const commandRows = computed(() => {
+                        const base = schedulerBase();
+                        const robot = selectedCommandRobot.value;
+                        const robotId = robot?.id || '<DEVICE_ID>';
+                        const robotName = robot?.name || '<ROBOT_NAME>';
+                        const networkFlag = commandNetwork.value === 'tailscale' ? '--tailscale' : '--lan';
+                        const tokenPlaceholder = '<ENROLLMENT_TOKEN_FROM_ADD_DEVICE>';
+                        return [
+                            { group: 'Scheduler', name: 'Health check', description: 'Confirm the control center API is reachable.', command: `curl -s ${base}/api/settings` },
+                            { group: 'Scheduler', name: 'Start scheduler', description: 'Start the RoboPark scheduler and dashboard on port 8080.', command: 'robopark serve --port 8080' },
+                            { group: 'Robot', name: 'Enroll robot', description: `Generated for ${robotName} over ${commandNetwork.value}. Paste the one-time token from the Add Device dialog.`, command: `robopark setup --robot --name "${robotName}" --hub-url ${base.replace(/:\\d+$/, '')}:47913 --scheduler-port ${window.location.port || '8080'} ${networkFlag} --enrollment-token ${tokenPlaceholder} --start --auto-start` },
+                            { group: 'Robot', name: 'Simulate motion', description: 'Queue a full production trigger for the selected robot.', command: `curl -s -X POST ${base}/api/robots/${robotId}/simulate-trigger` },
+                            { group: 'Robot', name: 'Stop conversation', description: 'Stop the active conversation and clear queued trigger state.', command: `curl -s -X POST ${base}/api/robots/${robotId}/simulate-stop` },
+                            { group: 'Robot', name: 'Recover stale state', description: 'Release a robot stuck in connecting/running after a failed teardown.', command: `curl -s -X POST ${base}/api/robots/${robotId}/recover` },
+                            { group: 'Worker', name: 'Sync agent secret', description: 'Provision the scheduler-managed secret into ROBOVOICE-main.', command: `robopark secrets --scheduler-url ${base} --worker-env C:\\path\\to\\ROBOVOICE-main\\.env` },
+                            { group: 'Diagnostics', name: 'Tail agent logs', description: 'Inspect the local ROBOVOICE worker.', command: 'docker logs --tail 100 caal-agent' },
+                            { group: 'Diagnostics', name: 'Check Docker', description: 'List containers, health, ports, and networks.', command: 'docker ps -a --format "table {{.Names}}\\t{{.Status}}\\t{{.Ports}}\\t{{.Networks}}"' },
+                            { group: 'Diagnostics', name: 'Check LiveKit port', description: 'Confirm the local LiveKit listener is present.', command: 'Get-NetTCPConnection -LocalPort 7883 -ErrorAction SilentlyContinue' },
+                        ];
+                    });
+                    const copyCommand = async (command) => {
+                        try { await navigator.clipboard.writeText(command); }
+                        catch (e) { window.prompt('Copy command:', command); }
+                    };
+
+                    return {
+                        robots, servers, sessions, stats, connected, serverMetrics,
+                        devices, settings, livekit, showAddDevice, showDevices, showCommands, commandNetwork, commandRobotId, selectedCommandRobot, commandRows, copyCommand, newDevice, rotatedToken, enrollmentNetwork, enrollmentCommand, simulation,
                         showLiveKitConfig, livekitForm, preview, deviceInventory,
                         voiceStacks, characterPresets, showVoiceStackForm, showCharacterForm,
                         editingVoiceStack, editingCharacter, voiceStackForm, characterForm,
                         loadModel, unloadModel, statusColor, formatDuration, formatTime,
-                        toggleProductionMode, rotateEnrollmentToken,
+                        toggleProductionMode, rotateEnrollmentToken, provisionAgentToken,
                         submitNewDevice, deleteDevice, rotateDeviceToken, dismissRotatedToken,
                         joinConversation, saveLiveKitConfig, openLiveKitConfig,
-                        startPreview, stopPreview, simulateTrigger, stopConversation, updateDeviceMedia,
+                        startPreview, stopPreview, simulateTrigger, stopConversation, recoverRobot, toggleDeviceProduction, setDeviceProduction, saveDeviceGreetings, updateDeviceMedia,
                         openVoiceStackForm, saveVoiceStack, deleteVoiceStack,
                         openCharacterForm, saveCharacter, deleteCharacter,
                         assignRobotCharacter, stackName, characterName,
@@ -4200,20 +4783,30 @@ async def dashboard():
                                 <h1 class="text-3xl font-bold">🤖 RoboPark Control Center</h1>
                                 <p class="text-gray-400">Session Scheduler Dashboard — Shenzhen Bay Park (test site)</p>
                             </div>
-                            <div class="flex items-center gap-4">
-                                <button @click="openLiveKitConfig"
+                            <div class="flex items-center gap-4">
+                                <button @click="showCommands = !showCommands"
+                                        :class="showCommands ? 'bg-blue-700 hover:bg-blue-600' : 'bg-gray-700 hover:bg-gray-600'"
+                                        class="px-3 py-2 rounded-lg text-sm">Commands</button>
+                                <button @click="openLiveKitConfig"
                                         :class="livekit.url && livekit.has_secret ? 'bg-cyan-700 hover:bg-cyan-600' : 'bg-gray-700 hover:bg-gray-600'"
                                         class="px-3 py-2 rounded-lg flex items-center gap-2 text-sm"
                                         :title="livekit.url || 'Not configured'">
                                     <span class="w-2 h-2 rounded-full" :class="livekit.url && livekit.has_secret ? 'bg-cyan-200' : 'bg-yellow-400'"></span>
                                     LiveKit: <strong>{{ livekit.url && livekit.has_secret ? (livekit.url.replace(/^wss?:[/][/]/, '')) : 'NOT SET' }}</strong>
                                 </button>
-                                <button @click="toggleProductionMode"
+                                <button @click="toggleProductionMode"
                                         :class="settings.production_mode ? 'bg-green-600 hover:bg-green-700' : 'bg-gray-700 hover:bg-gray-600'"
                                         class="px-3 py-2 rounded-lg flex items-center gap-2 text-sm">
                                     <span class="w-2 h-2 rounded-full" :class="settings.production_mode ? 'bg-green-200 animate-pulse' : 'bg-gray-400'"></span>
                                     Production Mode: <strong>{{ settings.production_mode ? 'ON' : 'OFF' }}</strong>
-                                </button>
+                                </button>
+                                <button @click="provisionAgentToken(false)"
+                                        :class="settings.agent_token_configured ? 'bg-emerald-800 hover:bg-emerald-700' : 'bg-red-800 hover:bg-red-700'"
+                                        class="px-3 py-2 rounded-lg flex items-center gap-2 text-sm"
+                                        title="Provision the scheduler-managed ROBOVOICE authentication secret">
+                                    <span class="w-2 h-2 rounded-full" :class="settings.agent_token_configured ? 'bg-emerald-200' : 'bg-red-300'"></span>
+                                    Agent Secret: <strong>{{ settings.agent_token_configured ? 'SET' : 'MISSING' }}</strong>
+                                </button>
                                 <span :class="connected ? 'text-green-400' : 'text-red-400'" class="flex items-center gap-2">
                                     <span class="w-2 h-2 rounded-full" :class="connected ? 'bg-green-400' : 'bg-red-400'"></span>
                                     {{ connected ? 'Live' : 'Disconnected' }}
@@ -4221,7 +4814,38 @@ async def dashboard():
                             </div>
                         </header>
 
-                        <!-- Stats Row -->
+                        <!-- Command Center -->
+                        <section v-if="showCommands" class="bg-gray-800 rounded-lg p-5 mb-6">
+                            <div class="flex flex-wrap items-center justify-between gap-3 mb-4">
+                                <div>
+                                    <h2 class="text-xl font-semibold">Command Center</h2>
+                                    <p class="text-xs text-gray-400">Copy-ready operational commands. Secrets are never included; enrollment uses a one-time token from the Add Device dialog.</p>
+                                </div>
+                                <div class="flex gap-2 items-center">
+                                    <select v-model="commandRobotId" class="bg-gray-700 rounded px-3 py-2 text-sm">
+                                        <option value="">Select robot</option>
+                                        <option v-for="d in devices" :key="d.id" :value="d.id">{{ d.name }} ({{ d.id }})</option>
+                                    </select>
+                                    <button @click="commandNetwork = 'lan'" :class="commandNetwork === 'lan' ? 'bg-blue-600' : 'bg-gray-700'" class="px-3 py-2 rounded text-sm">LAN</button>
+                                    <button @click="commandNetwork = 'tailscale'" :class="commandNetwork === 'tailscale' ? 'bg-cyan-600' : 'bg-gray-700'" class="px-3 py-2 rounded text-sm">Tailscale</button>
+                                </div>
+                            </div>
+                            <div class="grid md:grid-cols-2 gap-3">
+                                <div v-for="cmd in commandRows" :key="cmd.group + cmd.name" class="bg-gray-900 rounded p-3">
+                                    <div class="flex items-start justify-between gap-2">
+                                        <div>
+                                            <div class="text-xs text-cyan-400">{{ cmd.group }}</div>
+                                            <div class="font-medium text-sm">{{ cmd.name }}</div>
+                                            <div class="text-xs text-gray-500 mt-1">{{ cmd.description }}</div>
+                                        </div>
+                                        <button @click="copyCommand(cmd.command)" class="shrink-0 px-2 py-1 rounded bg-gray-700 hover:bg-gray-600 text-xs">Copy</button>
+                                    </div>
+                                    <code class="block mt-2 text-xs text-green-300 break-all select-all">{{ cmd.command }}</code>
+                                </div>
+                            </div>
+                        </section>
+
+                        <!-- Stats Row -->
                         <div class="grid grid-cols-5 gap-4 mb-6">
                             <div class="bg-gray-800 rounded-lg p-4">
                                 <div class="text-2xl font-bold text-green-400">{{ stats.active_sessions || 0 }}</div>
@@ -4298,9 +4922,12 @@ async def dashboard():
                                             <td class="py-2 px-2 font-mono text-xs">{{ d.tailscale_ip || '—' }}</td>
                                             <td class="py-2 px-2 font-mono text-xs">{{ d.lan_ip || '—' }}</td>
                                             <td class="py-2 px-2 font-mono text-xs text-gray-400">{{ d.motor_server_url || '—' }}</td>
-                                            <td class="py-2 px-2 text-xs text-gray-400">{{ formatTime(d.last_heartbeat) }}</td>
-                                            <td class="py-2 px-2 text-xs space-x-2">
-                                                <button @click="joinConversation(d)"
+                                            <td class="py-2 px-2 text-xs text-gray-400">{{ formatTime(d.last_heartbeat) }}</td>
+                                            <td class="py-2 px-2 text-xs space-x-2">
+                                                <button @click="setDeviceProduction(d.id)"
+                                                        :class="d.production_mode ? 'bg-green-700 hover:bg-green-600' : 'bg-gray-700 hover:bg-gray-600'"
+                                                        class="px-2 py-1 rounded">Prod {{ d.production_mode ? 'ON' : 'OFF' }}</button>
+                                                <button @click="joinConversation(d)"
                                                         :disabled="!settings.production_mode || !livekit.url || !livekit.has_secret"
                                                         :class="(settings.production_mode && livekit.url && livekit.has_secret) ? 'bg-cyan-600 hover:bg-cyan-700' : 'bg-gray-700 cursor-not-allowed'"
                                                         class="px-2 py-1 rounded"
@@ -4381,9 +5008,18 @@ async def dashboard():
                         <div v-if="rotatedToken" class="fixed inset-0 bg-black/70 flex items-center justify-center z-50" @click.self="dismissRotatedToken">
                             <div class="bg-gray-800 rounded-lg p-6 w-full max-w-lg">
                                 <h3 class="text-lg font-semibold mb-2">⚠ Save this token now</h3>
-                                <p class="text-xs text-gray-400 mb-4">This token is shown <strong>once</strong>. Copy it to the Pi (e.g. into <code>/etc/robopark/device.json</code>) before dismissing.</p>
-                                <div class="bg-gray-900 p-3 rounded font-mono text-xs break-all select-all">{{ rotatedToken.token }}</div>
-                                <div class="flex justify-end mt-4">
+                                <p class="text-xs text-gray-400 mb-4">This token is shown <strong>once</strong>. Copy it to the Pi (e.g. into <code>/etc/robopark/device.json</code>) before dismissing.</p>
+                                <div class="bg-gray-900 p-3 rounded font-mono text-xs break-all select-all">{{ rotatedToken.token }}</div>
+                                <div class="mt-4">
+                                    <div class="text-xs text-gray-400 mb-2">Robot network for generated enrollment command</div>
+                                    <div class="flex gap-2 mb-2">
+                                        <button @click="enrollmentNetwork = 'lan'" :class="enrollmentNetwork === 'lan' ? 'bg-blue-600' : 'bg-gray-700'" class="px-3 py-1 rounded text-xs">LAN</button>
+                                        <button @click="enrollmentNetwork = 'tailscale'" :class="enrollmentNetwork === 'tailscale' ? 'bg-cyan-600' : 'bg-gray-700'" class="px-3 py-1 rounded text-xs">Tailscale</button>
+                                    </div>
+                                    <div class="bg-gray-900 p-3 rounded font-mono text-xs break-all select-all">{{ enrollmentCommand(rotatedToken) }}</div>
+                                    <p class="text-xs text-gray-500 mt-1">LAN requires the robot and scheduler on the same subnet. Tailscale requires Tailscale on both devices and a Tailscale scheduler URL/host.</p>
+                                </div>
+                                <div class="flex justify-end mt-4">
                                     <button @click="dismissRotatedToken" class="px-3 py-2 bg-blue-600 hover:bg-blue-700 rounded">I have saved it</button>
                                 </div>
                             </div>
@@ -4444,7 +5080,11 @@ async def dashboard():
                                             Character: <strong>{{ characterName(robot.character_id) }}</strong> ·
                                             Voice Stack: <strong>{{ stackName(robot.voice_stack_id) }}</strong>
                                         </div>
-                                        <div class="grid grid-cols-2 gap-2 mb-2 text-sm">
+                                        <div v-if="deviceInventory[robot.id]" class="flex items-center justify-between mb-2 text-xs">
+                                            <span>Robot production: <strong :class="devices.find(d => d.id === deviceInventory[robot.id].deviceId)?.production_mode ? 'text-green-400' : 'text-gray-400'">{{ devices.find(d => d.id === deviceInventory[robot.id].deviceId)?.production_mode ? 'ON' : 'OFF' }}</strong></span>
+                                            <button @click="toggleDeviceProduction(robot.id)" class="px-2 py-1 rounded bg-gray-600 hover:bg-gray-500">Toggle</button>
+                                        </div>
+                                        <div class="grid grid-cols-2 gap-2 mb-2 text-sm">
                                             <div>
                                                 <label class="text-xs text-gray-500">Character</label>
                                                 <select :value="robot.character_id"
@@ -4460,7 +5100,7 @@ async def dashboard():
                                             </div>
                                         </div>
                                         <div v-if="deviceInventory[robot.id]" class="space-y-2 text-sm">
-                                            <div class="grid grid-cols-2 gap-2">
+                                            <div class="grid grid-cols-3 gap-2">
                                                 <div>
                                                     <label class="text-xs text-gray-500">Camera</label>
                                                     <select v-model="deviceInventory[robot.id].selectedVideo"
@@ -4469,15 +5109,28 @@ async def dashboard():
                                                         <option v-for="opt in deviceInventory[robot.id].videoOptions" :key="opt" :value="opt">{{ opt }}</option>
                                                     </select>
                                                 </div>
-                                                <div>
-                                                    <label class="text-xs text-gray-500">Microphone</label>
+                                                <div>
+                                                    <label class="text-xs text-gray-500">Microphone</label>
                                                     <select v-model="deviceInventory[robot.id].selectedAudio"
                                                             @change="updateDeviceMedia(robot.id)"
                                                             class="w-full bg-gray-800 rounded px-2 py-1 text-xs">
                                                         <option v-for="opt in deviceInventory[robot.id].audioOptions" :key="opt" :value="opt">{{ opt }}</option>
-                                                    </select>
-                                                </div>
-                                            </div>
+                                                    </select>
+                                                </div>
+                                                <div>
+                                                    <label class="text-xs text-gray-500">Speaker</label>
+                                                    <select v-model="deviceInventory[robot.id].selectedAudioOutput"
+                                                            @change="updateDeviceMedia(robot.id)"
+                                                            class="w-full bg-gray-800 rounded px-2 py-1 text-xs">
+                                                        <option v-for="opt in deviceInventory[robot.id].audioOutputOptions" :key="opt" :value="opt">{{ opt }}</option>
+                                                    </select>
+                                                </div>
+                                            </div>
+                                            <div>
+                                                <label class="text-xs text-gray-500">Cached greeting phrases (one per line)</label>
+                                                <textarea v-model="deviceInventory[robot.id].greetingText" rows="2" class="w-full bg-gray-800 rounded px-2 py-1 text-xs" placeholder="Hello! Want to go for a ride?"></textarea>
+                                                <button @click="saveDeviceGreetings(robot.id)" class="mt-1 px-2 py-1 rounded bg-gray-600 hover:bg-gray-500 text-xs">Save Greetings</button>
+                                            </div>
                                             <button @click="startPreview(robot)"
                                                     :disabled="!settings.production_mode || !livekit.url || !livekit.has_secret || preview.active"
                                                     :class="(settings.production_mode && livekit.url && livekit.has_secret && !preview.active) ? 'bg-cyan-600 hover:bg-cyan-700' : 'bg-gray-700 cursor-not-allowed'"
@@ -4491,13 +5144,16 @@ async def dashboard():
                                                         class="px-2 py-1 rounded text-xs">
                                                     {{ simulation.robotId === robot.id ? 'Triggering…' : 'Simulate Motion' }}
                                                 </button>
-                                                <button @click="stopConversation(robot)"
+                                                <button @click="stopConversation(robot)"
                                                         :disabled="robot.status !== 'connecting' && robot.status !== 'running'"
                                                         :class="robot.status === 'connecting' || robot.status === 'running' ? 'bg-red-600 hover:bg-red-500' : 'bg-gray-700 cursor-not-allowed'"
                                                         class="px-2 py-1 rounded text-xs">
-                                                    Stop Conversation
-                                                </button>
-                                            </div>
+                                                    Stop Conversation
+                                                </button>
+                                            </div>
+                                            <button @click="recoverRobot(robot)" class="w-full px-2 py-1 rounded text-xs bg-gray-600 hover:bg-gray-500">
+                                                Recover Stale State
+                                            </button>
                                             <button v-if="preview.active && preview.robot?.id === robot.id"
                                                     @click="stopPreview"
                                                     class="w-full px-2 py-1 bg-red-600 hover:bg-red-700 rounded text-xs">