Merge feature/lan-mode: LAN sharing with multi-key auth, dashboard, CLI

Add LAN mode to share one Claude Pro/Max subscription across a household: - 3-tier auth: none / shared / multi (per-user API keys) - SQLite-backed key management and per-request usage tracking - Embedded web dashboard with real-time monitoring - CLI commands: keys, lan, usage --by-key - Zero external dependencies (uses node:sqlite) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
docs: update README with complete LAN mode reference
2026-07-21 21:15:09 +00:00 · 2026-04-10 21:45:17 +10:00 · 2026-04-10 21:45:07 +10:00 · 2026-04-10 21:36:16 +10:00 · 2026-04-10 21:21:36 +10:00 · 2026-04-10 21:20:24 +10:00
12 changed files with 2261 additions and 122 deletions
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Tao Deng
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
@@ -1,6 +1,6 @@
 # OCP — Open Claude Proxy

-> **Status: Stable (v3.0.0)** — Feature-complete. Bug fixes only.
+> **Status: Stable (v3.4.0)** — Feature-complete. Bug fixes only.

 > **Already paying for Claude Pro/Max? Use your subscription as an OpenAI-compatible API — $0 extra cost.**

@@ -55,6 +55,112 @@ curl http://127.0.0.1:3456/v1/models
 # Returns: claude-opus-4-6, claude-sonnet-4-6, claude-haiku-4
 ```

+## LAN Mode — Share with Family
+
+OCP can serve your entire household from a single machine. One Claude Pro/Max subscription, shared across all devices on your network.
+
+```
+Wife's laptop   ──┐
+Son's iPad      ───┼──→ OCP :3456 (your Mac) ──→ Claude subscription
+Your Pi server  ───┤
+Your desktop    ──┘
+```
+
+### Step 1: Enable LAN Access
+
+**Quick start (temporary, until restart):**
+```bash
+export CLAUDE_BIND=0.0.0.0
+export CLAUDE_AUTH_MODE=multi    # per-user keys
+export OCP_ADMIN_KEY=your-secret-admin-key
+ocp restart
+```
+
+**Permanent (survives reboot):**
+```bash
+node setup.mjs --bind 0.0.0.0 --auth-mode multi
+```
+
+Then set your admin key in the launchd/systemd environment, or save it to a file:
+```bash
+echo "your-secret-admin-key" > ~/.ocp/admin-key
+chmod 600 ~/.ocp/admin-key
+```
+
+### Step 2: Create Keys for Family Members
+
+```bash
+# Set admin key for CLI (or save to ~/.ocp/admin-key)
+export OCP_ADMIN_KEY=your-secret-admin-key
+
+# Create a key for each person/device
+ocp keys add wife-laptop
+#  ✓ Key created for "wife-laptop"
+#    API Key: ocp_xDYzOB9ZKYzn...
+#    Copy this key now — you won't see it again.
+
+ocp keys add son-ipad
+ocp keys add pi-server
+```
+
+### Step 3: Share Connection Info
+
+Run `ocp lan` to see your IP and ready-to-share instructions:
+
+```
+$ ocp lan
+OCP LAN Setup
+─────────────────────────────────────
+  Your IP: 192.168.1.100
+  Port:    3456
+
+  For IDE users, set:
+    OPENAI_BASE_URL=http://192.168.1.100:3456/v1
+    OPENAI_API_KEY=<their-key>
+
+  Dashboard: http://192.168.1.100:3456/dashboard
+
+  Status: ✓ LAN-accessible
+```
+
+Give each family member their key and these two settings:
+```bash
+export OPENAI_BASE_URL=http://192.168.1.100:3456/v1
+export OPENAI_API_KEY=ocp_<their-key>
+```
+
+### Step 4: Monitor Usage
+
+```bash
+# Per-key usage stats
+ocp usage --by-key
+#  Key                  Reqs   OK  Err  Avg Time
+#  wife-laptop             5    5    0      8.0s
+#  son-ipad                3    3    0      6.2s
+
+# Manage keys
+ocp keys              # List all keys
+ocp keys revoke son-ipad   # Revoke a key
+```
+
+**Web Dashboard:** Open `http://<your-ip>:3456/dashboard` in any browser for real-time monitoring — per-key usage, request history, plan utilization, and system health. No login needed.
+
+### Auth Modes
+
+| Mode | Env | Use Case |
+|------|-----|----------|
+| `none` | `CLAUDE_AUTH_MODE=none` | Trusted home network, no auth needed |
+| `shared` | `CLAUDE_AUTH_MODE=shared` + `PROXY_API_KEY=xxx` | Everyone shares one key |
+| `multi` | `CLAUDE_AUTH_MODE=multi` + `OCP_ADMIN_KEY=xxx` | Per-person keys with usage tracking (recommended) |
+
+### Important Notes
+
+- All users share your Claude Pro/Max **rate limits** (5h session + 7d weekly)
+- `ocp usage` shows how much quota remains
+- Keys are stored in `~/.ocp/ocp.db` (SQLite, zero external dependencies)
+- Admin key is required for key management API endpoints
+- The dashboard (`/dashboard`) and health check (`/health`) are always public
+
 ## Built-in Usage Monitoring

 Check your subscription usage from the terminal:
@@ -85,8 +191,13 @@ Proxy: up 6h 32m | 23 reqs | 0 err | 0 timeout

 ```
 ocp usage              Plan usage limits & model stats
+ocp usage --by-key     Per-key usage breakdown (LAN mode)
 ocp status             Quick overview
 ocp health             Proxy diagnostics
+ocp keys               List all API keys (multi mode)
+ocp keys add <name>    Create a new API key
+ocp keys revoke <name> Revoke an API key
+ocp lan                Show LAN connection info & IP
 ocp settings           View tunable settings
 ocp settings <k> <v>   Update a setting at runtime
 ocp logs [N] [level]   Recent logs (default: 20, error)
@@ -95,7 +206,8 @@ ocp sessions           Active sessions
 ocp clear              Clear all sessions
 ocp restart            Restart proxy
 ocp restart gateway    Restart gateway
-ocp version            Show version
+ocp update             Update to latest version
+ocp update --check     Check for updates without applying
 ocp --help             Command reference
 ```

@@ -111,6 +223,16 @@ ocp --help

 > **Cloud/Linux servers:** If `ocp: command not found`, the binary isn't in PATH. Full path: `~/.openclaw/projects/ocp/ocp`

+### Self-Update
+
+```bash
+# Check if a new version is available
+ocp update --check
+
+# Pull latest, sync plugin, restart proxy — one command
+ocp update
+```
+
 ### Runtime Settings (No Restart Needed)

 ```
@@ -149,6 +271,10 @@ OCP translates OpenAI-compatible `/v1/chat/completions` requests into `claude -p
 | `/settings` | GET/PATCH | View or update settings at runtime |
 | `/logs` | GET | Recent log entries (`?n=20&level=error`) |
 | `/sessions` | GET/DELETE | List or clear active sessions |
+| `/dashboard` | GET | Web dashboard (always public) |
+| `/api/keys` | GET/POST | List or create API keys (admin only) |
+| `/api/keys/:id` | DELETE | Revoke an API key (admin only) |
+| `/api/usage` | GET | Per-key usage stats (`?since=&until=&hours=&limit=`) |

 ## OpenClaw Integration

@@ -157,6 +283,7 @@ OCP was originally built for [OpenClaw](https://github.com/openclaw/openclaw) an
 - **`setup.mjs`** auto-configures the `claude-local` provider in `openclaw.json`
 - **Gateway plugin** registers `/ocp` as a native slash command in Telegram/Discord
 - **Multi-agent** — 8 concurrent requests sharing one subscription
+- **No conflicts** — uses neutral service names (`dev.ocp.proxy` / `ocp-proxy`) that don't trigger OpenClaw's gateway-like service detection

 ### Install the Gateway Plugin

@@ -176,42 +303,82 @@ Add to `~/.openclaw/openclaw.json`:

 Restart: `openclaw gateway restart`

+## Troubleshooting
+
+### Requests fail with exit 143 / SIGTERM after ~60 seconds
+
+**Symptom:** Claude returns errors or stops responding after about 60 seconds, especially during tool use (Bash, Read, etc.).
+
+**Cause:** OpenClaw's gateway has a default `idleTimeoutSeconds` of 60 seconds. When Claude calls tools, the token stream pauses while the tool executes — if that takes longer than 60s, the gateway kills the connection.
+
+**Fix:** `setup.mjs` (v3.2.1+) sets this automatically. If you installed an older version, add this to `~/.openclaw/openclaw.json`:
+
+```json
+{
+  "agents": {
+    "defaults": {
+      "llm": {
+        "idleTimeoutSeconds": 0
+      }
+    }
+  }
+}
+```
+
+Then restart: `openclaw gateway restart`
+
+### Agents stuck in "typing" but never respond
+
+Usually caused by stuck sessions from previous timeout errors. Fix:
+
+```bash
+# Clear all sessions
+ocp clear
+
+# Restart both services
+ocp restart
+openclaw gateway restart
+```
+
+If that doesn't help, manually clear the session store:
+```bash
+# Find and reset stuck Telegram sessions
+cat ~/.openclaw/agents/main/sessions/sessions.json
+# Remove entries with "telegram" channel, then restart gateway
+```
+
+## Upgrading from v3.0.x
+
+If you installed OCP before v3.1.0, the auto-start service used names that OpenClaw's gateway detected as conflicting (`ai.openclaw.proxy` on macOS, `openclaw-proxy` on Linux). Running `node setup.mjs` or `ocp update` will automatically migrate to the new neutral names.
+
 ## Environment Variables

 | Variable | Default | Description |
 |----------|---------|-------------|
 | `CLAUDE_PROXY_PORT` | `3456` | Listen port |
+| `CLAUDE_BIND` | `127.0.0.1` | Bind address (`0.0.0.0` for LAN access) |
+| `CLAUDE_AUTH_MODE` | `none` | Auth mode: `none`, `shared`, or `multi` |
+| `OCP_ADMIN_KEY` | *(unset)* | Admin key for key management (multi mode) |
 | `CLAUDE_BIN` | *(auto-detect)* | Path to claude binary |
-| `CLAUDE_TIMEOUT` | `300000` | Overall request timeout (ms) |
-| `CLAUDE_FIRST_BYTE_TIMEOUT` | `90000` | Base first-byte timeout (ms) |
+| `CLAUDE_TIMEOUT` | `600000` | Request timeout (ms, default: 10 min) |
 | `CLAUDE_MAX_CONCURRENT` | `8` | Max concurrent claude processes |
 | `CLAUDE_MAX_PROMPT_CHARS` | `150000` | Prompt truncation limit (chars) |
 | `CLAUDE_SESSION_TTL` | `3600000` | Session expiry (ms, default: 1 hour) |
 | `CLAUDE_ALLOWED_TOOLS` | `Bash,Read,...,Agent` | Comma-separated tools to pre-approve |
 | `CLAUDE_SKIP_PERMISSIONS` | `false` | Bypass all permission checks |
-| `PROXY_API_KEY` | *(unset)* | Bearer token for API authentication |
+| `PROXY_API_KEY` | *(unset)* | Bearer token for shared-mode authentication |

 ## Security

- **Localhost only** — binds to `127.0.0.1`, not exposed to the network
- **Bearer token auth (optional)** — set `PROXY_API_KEY` to require auth
+- **Localhost by default** — binds to `127.0.0.1`; set `CLAUDE_BIND=0.0.0.0` to enable LAN access
+- **3-tier auth** — `none` (trusted network), `shared` (single key), `multi` (per-user keys with usage tracking)
+- **Timing-safe key comparison** — prevents timing attacks on API keys and admin keys
+- **Admin-only key management** — creating, listing, and revoking keys requires the admin key
+- **Public endpoints** — `/health` and `/dashboard` are always accessible without auth
 - **No API keys needed** — authentication goes through Claude CLI's OAuth session
+- **Keys stored locally** — `~/.ocp/ocp.db` (SQLite), never sent to external services
 - **Auto-start** — launchd (macOS) / systemd (Linux)

-## Known Issues
-
-### `/ocp` command returns "Unknown skill: ocp" (OpenClaw only)
-
-The `/ocp` plugin command may intermittently stop working in Telegram/Discord. This is caused by an OpenClaw gateway bug ([openclaw/openclaw#26895](https://github.com/openclaw/openclaw/issues/26895)).
-
-**Workaround:**
-```
-/new
-/ocp restart
-```
-
-**Important:** Do not add `ocp` to agent `skills` lists or place a `SKILL.md` in workspace skills — this creates a routing conflict.
-
 ## License

 MIT
@@ -0,0 +1,245 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>OCP Dashboard</title>
+<style>
+  * { box-sizing: border-box; margin: 0; padding: 0; }
+  body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; background: #0f172a; color: #e2e8f0; padding: 1.5rem; }
+  h1 { font-size: 1.5rem; margin-bottom: 1rem; color: #38bdf8; }
+  h2 { font-size: 1.1rem; margin: 1.5rem 0 0.5rem; color: #94a3b8; }
+  .grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); gap: 1rem; margin-bottom: 1.5rem; }
+  .card { background: #1e293b; border-radius: 8px; padding: 1rem; }
+  .card .label { font-size: 0.75rem; color: #64748b; text-transform: uppercase; }
+  .card .value { font-size: 1.5rem; font-weight: 700; margin-top: 0.25rem; }
+  .card .sub { font-size: 0.8rem; color: #94a3b8; margin-top: 0.25rem; }
+  table { width: 100%; border-collapse: collapse; margin-top: 0.5rem; }
+  th, td { text-align: left; padding: 0.5rem 0.75rem; border-bottom: 1px solid #334155; font-size: 0.85rem; }
+  th { color: #64748b; font-weight: 600; }
+  .tag { display: inline-block; padding: 2px 8px; border-radius: 4px; font-size: 0.75rem; }
+  .tag-ok { background: #065f46; color: #6ee7b7; }
+  .tag-err { background: #7f1d1d; color: #fca5a5; }
+  .btn { background: #2563eb; color: white; border: none; padding: 0.5rem 1rem; border-radius: 6px; cursor: pointer; font-size: 0.85rem; }
+  .btn:hover { background: #1d4ed8; }
+  .btn-sm { padding: 0.25rem 0.5rem; font-size: 0.75rem; }
+  .btn-danger { background: #dc2626; }
+  .btn-danger:hover { background: #b91c1c; }
+  input { background: #1e293b; border: 1px solid #334155; color: #e2e8f0; padding: 0.4rem 0.75rem; border-radius: 6px; font-size: 0.85rem; }
+  .flex { display: flex; gap: 0.5rem; align-items: center; }
+  .mono { font-family: "SF Mono", "Fira Code", monospace; font-size: 0.8rem; }
+  .bar-bg { background: #334155; border-radius: 4px; height: 8px; overflow: hidden; margin-top: 0.5rem; }
+  .bar-fill { height: 100%; border-radius: 4px; transition: width 0.5s; }
+  .bar-blue { background: #3b82f6; }
+  .bar-amber { background: #f59e0b; }
+  .bar-red { background: #ef4444; }
+  #refresh-indicator { font-size: 0.75rem; color: #475569; }
+  .section { margin-bottom: 2rem; }
+</style>
+</head>
+<body>
+
+<div class="flex" style="justify-content: space-between; margin-bottom: 1.5rem;">
+  <h1>OCP Dashboard</h1>
+  <div class="flex">
+    <span id="refresh-indicator"></span>
+    <button class="btn btn-sm" onclick="refreshAll()">Refresh</button>
+  </div>
+</div>
+
+<div class="grid" id="status-cards"></div>
+
+<div class="section">
+  <h2>Plan Usage</h2>
+  <div class="grid" id="plan-cards"></div>
+</div>
+
+<div class="section">
+  <h2>Usage by Key</h2>
+  <table id="key-usage-table">
+    <thead><tr><th>Key</th><th>Requests</th><th>OK</th><th>Err</th><th>Avg Time</th><th>Last Request</th></tr></thead>
+    <tbody></tbody>
+  </table>
+</div>
+
+<div class="section" id="key-mgmt-section" style="display:none">
+  <h2>API Keys</h2>
+  <div class="flex" style="margin-bottom: 0.75rem;">
+    <input type="text" id="new-key-name" placeholder="Key name (e.g. wife-laptop)">
+    <button class="btn btn-sm" onclick="addKey()">Create Key</button>
+  </div>
+  <table id="keys-table">
+    <thead><tr><th>Name</th><th>Key</th><th>Created</th><th>Status</th><th></th></tr></thead>
+    <tbody></tbody>
+  </table>
+</div>
+
+<div class="section">
+  <h2>Recent Requests</h2>
+  <table id="recent-table">
+    <thead><tr><th>Time</th><th>Key</th><th>Model</th><th>Prompt</th><th>Response</th><th>Time</th><th>Status</th></tr></thead>
+    <tbody></tbody>
+  </table>
+</div>
+
+<script>
+const BASE = window.location.origin;
+const headers = {};
+const storedToken = localStorage.getItem("ocp_token");
+if (storedToken) headers["Authorization"] = `Bearer ${storedToken}`;
+
+async function api(path) {
+  const resp = await fetch(BASE + path, { headers });
+  if (resp.status === 401 || resp.status === 403) {
+    const token = prompt("Enter your OCP admin key:");
+    if (token) {
+      localStorage.setItem("ocp_token", token);
+      headers["Authorization"] = `Bearer ${token}`;
+      return api(path);
+    }
+  }
+  return resp.json();
+}
+
+async function apiPost(path, body) {
+  const resp = await fetch(BASE + path, {
+    method: "POST", headers: { ...headers, "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  return resp.json();
+}
+
+async function apiDelete(path) {
+  const resp = await fetch(BASE + path, { method: "DELETE", headers });
+  return resp.json();
+}
+
+function fmtTime(ms) {
+  if (!ms) return "-";
+  return ms > 1000 ? (ms/1000).toFixed(1) + "s" : Math.round(ms) + "ms";
+}
+
+function fmtChars(n) {
+  if (!n) return "-";
+  return n > 1000 ? (n/1000).toFixed(0) + "K" : String(n);
+}
+
+function barColor(pct) {
+  if (pct >= 80) return "bar-red";
+  if (pct >= 50) return "bar-amber";
+  return "bar-blue";
+}
+
+async function refreshStatus() {
+  const data = await api("/status");
+  const p = data.proxy || {};
+  const r = data.requests || {};
+
+  document.getElementById("status-cards").innerHTML = `
+    <div class="card"><div class="label">Status</div><div class="value"><span class="tag ${p.status === 'ok' ? 'tag-ok' : 'tag-err'}">${p.status || '?'}</span></div><div class="sub">v${p.version || '?'}</div></div>
+    <div class="card"><div class="label">Uptime</div><div class="value">${p.uptime || '?'}</div></div>
+    <div class="card"><div class="label">Requests</div><div class="value">${r.total || 0}</div><div class="sub">${r.active || 0} active</div></div>
+    <div class="card"><div class="label">Errors</div><div class="value">${r.errors || 0}</div><div class="sub">${r.timeouts || 0} timeouts</div></div>
+    <div class="card"><div class="label">Sessions</div><div class="value">${p.activeSessions || 0}</div></div>
+  `;
+
+  const plan = data.plan;
+  if (plan && typeof plan === 'object' && !plan.error) {
+    const s = plan.currentSession || {};
+    const w = plan.weeklyLimits?.allModels || {};
+    const sPct = Math.round((s.utilization || 0) * 100);
+    const wPct = Math.round((w.utilization || 0) * 100);
+    document.getElementById("plan-cards").innerHTML = `
+      <div class="card">
+        <div class="label">Session (5h)</div>
+        <div class="value">${s.percent || '?'}</div>
+        <div class="bar-bg"><div class="bar-fill ${barColor(sPct)}" style="width:${sPct}%"></div></div>
+        <div class="sub">Resets in ${s.resetsIn || '?'}</div>
+      </div>
+      <div class="card">
+        <div class="label">Weekly (7d)</div>
+        <div class="value">${w.percent || '?'}</div>
+        <div class="bar-bg"><div class="bar-fill ${barColor(wPct)}" style="width:${wPct}%"></div></div>
+        <div class="sub">Resets in ${w.resetsIn || '?'}</div>
+      </div>
+    `;
+  }
+}
+
+async function refreshUsage() {
+  try {
+    const data = await api("/api/usage");
+    const tbody = document.querySelector("#key-usage-table tbody");
+    tbody.innerHTML = (data.byKey || []).map(k => `
+      <tr>
+        <td>${k.key_name}</td>
+        <td>${k.requests}</td>
+        <td>${k.successes}</td>
+        <td>${k.errors}</td>
+        <td>${fmtTime(k.avg_elapsed_ms)}</td>
+        <td class="mono">${k.last_request || '-'}</td>
+      </tr>
+    `).join("") || '<tr><td colspan="6" style="color:#475569">No usage data yet</td></tr>';
+
+    const rtbody = document.querySelector("#recent-table tbody");
+    rtbody.innerHTML = (data.recent || []).slice(0, 20).map(r => `
+      <tr>
+        <td class="mono">${r.created_at?.slice(11, 19) || '?'}</td>
+        <td>${r.key_name}</td>
+        <td>${r.model}</td>
+        <td>${fmtChars(r.prompt_chars)}</td>
+        <td>${fmtChars(r.response_chars)}</td>
+        <td>${fmtTime(r.elapsed_ms)}</td>
+        <td><span class="tag ${r.success ? 'tag-ok' : 'tag-err'}">${r.success ? 'ok' : 'err'}</span></td>
+      </tr>
+    `).join("") || '<tr><td colspan="7" style="color:#475569">No requests yet</td></tr>';
+  } catch(e) {
+    console.warn("Usage API not available:", e);
+  }
+}
+
+async function refreshKeys() {
+  try {
+    const data = await api("/api/keys");
+    document.getElementById("key-mgmt-section").style.display = "";
+    const tbody = document.querySelector("#keys-table tbody");
+    tbody.innerHTML = (data.keys || []).map(k => `
+      <tr>
+        <td>${k.name}</td>
+        <td class="mono">${k.keyPreview}</td>
+        <td class="mono">${k.created_at}</td>
+        <td><span class="tag ${k.revoked ? 'tag-err' : 'tag-ok'}">${k.revoked ? 'revoked' : 'active'}</span></td>
+        <td>${k.revoked ? '' : `<button class="btn btn-sm btn-danger" onclick="revokeKeyUI('${k.name}')">Revoke</button>`}</td>
+      </tr>
+    `).join("");
+  } catch(e) { /* not admin */ }
+}
+
+async function addKey() {
+  const name = document.getElementById("new-key-name").value.trim();
+  if (!name) return alert("Enter a key name");
+  const result = await apiPost("/api/keys", { name });
+  if (result.key) {
+    alert("New API Key (copy it now — you won't see it again):\n\n" + result.key);
+    document.getElementById("new-key-name").value = "";
+    refreshKeys();
+  }
+}
+
+async function revokeKeyUI(name) {
+  if (!confirm(`Revoke key "${name}"?`)) return;
+  await apiDelete(`/api/keys/${encodeURIComponent(name)}`);
+  refreshKeys();
+}
+
+async function refreshAll() {
+  document.getElementById("refresh-indicator").textContent = "Refreshing...";
+  await Promise.all([refreshStatus(), refreshUsage(), refreshKeys()]);
+  document.getElementById("refresh-indicator").textContent = `Updated ${new Date().toLocaleTimeString()}`;
+}
+
+refreshAll();
+setInterval(refreshAll, 30000);
+</script>
+</body>
+</html>
@@ -0,0 +1,160 @@
+// keys.mjs — API key management and usage tracking for OCP LAN mode
+// Uses Node.js built-in SQLite (node:sqlite) — zero external dependencies.
+import { DatabaseSync } from "node:sqlite";
+import { randomBytes } from "node:crypto";
+import { join } from "node:path";
+import { mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+
+const OCP_DIR = join(homedir(), ".ocp");
+mkdirSync(OCP_DIR, { recursive: true });
+const DB_PATH = join(OCP_DIR, "ocp.db");
+
+let db;
+
+export function getDb() {
+  if (!db) {
+    db = new DatabaseSync(DB_PATH);
+    db.exec("PRAGMA journal_mode = WAL");
+    db.exec("PRAGMA foreign_keys = ON");
+    initSchema();
+  }
+  return db;
+}
+
+function initSchema() {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS api_keys (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      key TEXT UNIQUE NOT NULL,
+      name TEXT NOT NULL,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      revoked INTEGER NOT NULL DEFAULT 0
+    );
+
+    CREATE TABLE IF NOT EXISTS usage_log (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      key_id INTEGER,
+      key_name TEXT NOT NULL DEFAULT 'anonymous',
+      model TEXT NOT NULL,
+      prompt_chars INTEGER NOT NULL DEFAULT 0,
+      response_chars INTEGER NOT NULL DEFAULT 0,
+      elapsed_ms INTEGER NOT NULL DEFAULT 0,
+      success INTEGER NOT NULL DEFAULT 1,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      FOREIGN KEY (key_id) REFERENCES api_keys(id)
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_usage_created ON usage_log(created_at);
+    CREATE INDEX IF NOT EXISTS idx_usage_key ON usage_log(key_id);
+  `);
+}
+
+// ── Key CRUD ──
+
+export function createKey(name) {
+  const key = "ocp_" + randomBytes(24).toString("base64url");
+  const d = getDb();
+  const stmt = d.prepare("INSERT INTO api_keys (key, name) VALUES (?, ?)");
+  const result = stmt.run(key, name);
+  return { id: result.lastInsertRowid, key, name };
+}
+
+export function listKeys() {
+  const d = getDb();
+  return d.prepare(
+    "SELECT id, key, name, created_at, revoked FROM api_keys ORDER BY created_at DESC"
+  ).all().map(({ key, ...rest }) => ({
+    ...rest,
+    keyPreview: key.slice(0, 8) + "..." + key.slice(-4),
+  }));
+}
+
+export function revokeKey(idOrName) {
+  const d = getDb();
+  const stmt = d.prepare(
+    "UPDATE api_keys SET revoked = 1 WHERE (id = ? OR name = ?) AND revoked = 0"
+  );
+  return stmt.run(idOrName, idOrName).changes > 0;
+}
+
+export function validateKey(key) {
+  const d = getDb();
+  const row = d.prepare(
+    "SELECT id, name FROM api_keys WHERE key = ? AND revoked = 0"
+  ).get(key);
+  return row || null;
+}
+
+// ── Usage recording ──
+
+export function recordUsage({ keyId, keyName, model, promptChars, responseChars, elapsedMs, success }) {
+  const d = getDb();
+  d.prepare(`
+    INSERT INTO usage_log (key_id, key_name, model, prompt_chars, response_chars, elapsed_ms, success)
+    VALUES (?, ?, ?, ?, ?, ?, ?)
+  `).run(keyId ?? null, keyName || "anonymous", model, promptChars, responseChars, elapsedMs, success ? 1 : 0);
+}
+
+// ── Usage queries ──
+
+export function getUsageByKey({ since, until } = {}) {
+  const d = getDb();
+  let where = "WHERE 1=1";
+  const params = [];
+  if (since) { where += " AND created_at >= ?"; params.push(since); }
+  if (until) { where += " AND created_at <= ?"; params.push(until); }
+
+  return d.prepare(`
+    SELECT
+      key_name,
+      COUNT(*) as requests,
+      SUM(CASE WHEN success = 1 THEN 1 ELSE 0 END) as successes,
+      SUM(CASE WHEN success = 0 THEN 1 ELSE 0 END) as errors,
+      SUM(prompt_chars) as total_prompt_chars,
+      SUM(response_chars) as total_response_chars,
+      SUM(elapsed_ms) as total_elapsed_ms,
+      AVG(elapsed_ms) as avg_elapsed_ms,
+      MIN(created_at) as first_request,
+      MAX(created_at) as last_request
+    FROM usage_log
+    ${where}
+    GROUP BY key_name
+    ORDER BY requests DESC
+  `).all(...params);
+}
+
+export function getUsageTimeline({ keyName, hours = 24 } = {}) {
+  const d = getDb();
+  const since = new Date(Date.now() - hours * 3600000).toISOString();
+  let where = "WHERE created_at >= ?";
+  const params = [since];
+  if (keyName) { where += " AND key_name = ?"; params.push(keyName); }
+
+  return d.prepare(`
+    SELECT
+      strftime('%Y-%m-%dT%H:00:00', created_at) as hour,
+      COUNT(*) as requests,
+      SUM(prompt_chars) as prompt_chars,
+      SUM(response_chars) as response_chars,
+      AVG(elapsed_ms) as avg_elapsed_ms
+    FROM usage_log
+    ${where}
+    GROUP BY hour
+    ORDER BY hour
+  `).all(...params);
+}
+
+export function getRecentUsage(limit = 50) {
+  const d = getDb();
+  return d.prepare(`
+    SELECT key_name, model, prompt_chars, response_chars, elapsed_ms, success, created_at
+    FROM usage_log
+    ORDER BY created_at DESC
+    LIMIT ?
+  `).all(limit);
+}
+
+export function closeDb() {
+  if (db) { db.close(); db = null; }
+}
@@ -8,6 +8,23 @@ set -euo pipefail

 PROXY="http://127.0.0.1:3456"

+# Auth header for multi-key mode: reads from OCP_ADMIN_KEY env or ~/.ocp/admin-key file
+_AUTH_HEADER=""
+if [[ -n "${OCP_ADMIN_KEY:-}" ]]; then
+  _AUTH_HEADER="-H \"Authorization: Bearer $OCP_ADMIN_KEY\""
+elif [[ -f "$HOME/.ocp/admin-key" ]]; then
+  _AUTH_HEADER="-H \"Authorization: Bearer $(cat "$HOME/.ocp/admin-key")\""
+fi
+
+# Wrapper: curl with optional auth
+_curl() {
+  if [[ -n "$_AUTH_HEADER" ]]; then
+    eval curl "$_AUTH_HEADER" "$@"
+  else
+    curl "$@"
+  fi
+}
+
 _json() { python3 -m json.tool 2>/dev/null || cat; }

 _bar() {
@@ -29,11 +46,36 @@ Displays current session utilization, weekly limits, extra usage status,
 and proxy request statistics. Data is fetched from the Anthropic API
 via a minimal probe call (cached for 5 minutes).

-Usage: ocp usage
+Usage: ocp usage [--by-key]
+
+Options:
+  --by-key    Show per-key usage statistics
 EOF
 }

 cmd_usage() {
+  if [[ "${1:-}" == "--by-key" ]]; then
+    local data
+    data=$(_curl -sf --max-time 15 "$PROXY/api/usage" 2>&1) || { echo "Error: proxy unreachable or usage API not available"; exit 1; }
+    echo "$data" | python3 -c "
+import sys, json
+d = json.loads(sys.stdin.read())
+by_key = d.get('byKey', [])
+if not by_key:
+    print('No usage data yet.')
+else:
+    print('Usage by Key')
+    print('─────────────────────────────────────────────────────────────────')
+    hdr = f'  {\"Key\":<20} {\"Reqs\":>5} {\"OK\":>4} {\"Err\":>4} {\"Avg Time\":>9} {\"Last Request\":<20}'
+    print(hdr)
+    print('  ' + '─' * (len(hdr) - 2))
+    for k in by_key:
+        avg_t = f'{k[\"avg_elapsed_ms\"]/1000:.1f}s' if k['avg_elapsed_ms'] else '-'
+        print(f'  {k[\"key_name\"]:<20} {k[\"requests\"]:>5} {k[\"successes\"]:>4} {k[\"errors\"]:>4} {avg_t:>9} {k[\"last_request\"]:<20}')
+"
+    return
+  fi
+
  local data
  data=$(curl -sf --max-time 15 "$PROXY/usage" 2>&1) || { echo "Error: proxy unreachable"; exit 1; }

@@ -213,6 +255,121 @@ cmd_clear() {
  echo "Cleared $count sessions."
 }

+# ── keys ────────────────────────────────────────────────────────────────
+cmd_keys_help() {
+  cat <<'EOF'
+ocp keys — Manage API keys (multi-key auth mode)
+
+Usage:
+  ocp keys                     List all keys
+  ocp keys add <name>          Create a new key
+  ocp keys revoke <name|id>    Revoke a key
+
+Examples:
+  ocp keys add wife-laptop
+  ocp keys add son-ipad
+  ocp keys revoke wife-laptop
+EOF
+}
+
+cmd_keys() {
+  case "${1:-}" in
+    add)
+      if [[ -z "${2:-}" ]]; then echo "Usage: ocp keys add <name>"; return 1; fi
+      local result
+      result=$(_curl -sf --max-time 5 -X POST "$PROXY/api/keys" \
+        -H "Content-Type: application/json" \
+        -d "{\"name\": \"$2\"}" 2>&1) || { echo "Error: proxy unreachable or unauthorized"; exit 1; }
+      echo "$result" | python3 -c "
+import sys, json
+d = json.loads(sys.stdin.read())
+if 'key' in d:
+    print(f'✓ Key created for \"{d[\"name\"]}\"')
+    print(f'')
+    print(f'  API Key: {d[\"key\"]}')
+    print(f'')
+    print(f'  Copy this key now — you won\\'t see it again.')
+    print(f'  Configure in IDE: OPENAI_API_KEY={d[\"key\"]}')
+else:
+    print(f'✗ {d.get(\"error\", \"Unknown error\")}')
+"
+      ;;
+    revoke)
+      if [[ -z "${2:-}" ]]; then echo "Usage: ocp keys revoke <name|id>"; return 1; fi
+      _curl -sf --max-time 5 -X DELETE "$PROXY/api/keys/$2" | python3 -c "
+import sys, json
+d = json.loads(sys.stdin.read())
+if d.get('revoked'):
+    print(f'✓ Key \"{d[\"idOrName\"]}\" revoked.')
+else:
+    print(f'✗ Key not found or already revoked.')
+"
+      ;;
+    --help|-h)
+      cmd_keys_help
+      ;;
+    "")
+      _curl -sf --max-time 5 "$PROXY/api/keys" | python3 -c "
+import sys, json
+d = json.loads(sys.stdin.read())
+keys = d.get('keys', [])
+if not keys:
+    print('No API keys configured.')
+    print('Create one: ocp keys add <name>')
+else:
+    print('API Keys')
+    print('─────────────────────────────────────────────────')
+    for k in keys:
+        status = '✗ revoked' if k['revoked'] else '✓ active'
+        print(f'  {k[\"name\"]:<20} {k[\"keyPreview\"]:<20} {status}  {k[\"created_at\"]}')
+" 2>/dev/null || { echo "Error: proxy unreachable or key management not available"; exit 1; }
+      ;;
+    *)
+      echo "Unknown subcommand: $1"; cmd_keys_help; return 1 ;;
+  esac
+}
+
+# ── lan ─────────────────────────────────────────────────────────────────
+cmd_lan_help() {
+  cat <<'EOF'
+ocp lan — Quick LAN mode setup guide
+
+Shows current network configuration and connection instructions
+for other devices on the same network.
+
+Usage: ocp lan
+EOF
+}
+
+cmd_lan() {
+  local ip
+  ip=$(ipconfig getifaddr en0 2>/dev/null || ipconfig getifaddr en1 2>/dev/null || hostname -I 2>/dev/null | awk '{print $1}' || echo "unknown")
+  local port=3456
+
+  echo "OCP LAN Setup"
+  echo "─────────────────────────────────────"
+  echo ""
+  echo "  Your IP: $ip"
+  echo "  Port:    $port"
+  echo ""
+  echo "  For IDE users, set:"
+  echo "    OPENAI_BASE_URL=http://$ip:$port/v1"
+  echo "    OPENAI_API_KEY=<your-key>    (if auth enabled)"
+  echo ""
+  echo "  Dashboard: http://$ip:$port/dashboard"
+  echo ""
+
+  if curl -sf --max-time 2 "http://$ip:$port/health" > /dev/null 2>&1; then
+    echo "  Status: ✓ LAN-accessible"
+  else
+    echo "  Status: ✗ Not LAN-accessible (bound to localhost only)"
+    echo ""
+    echo "  To enable LAN mode, set env var and restart:"
+    echo "    CLAUDE_BIND=0.0.0.0"
+    echo "    ocp restart"
+  fi
+}
+
 # ── restart ──────────────────────────────────────────────────────────────
 cmd_restart_help() {
  cat <<'EOF'
@@ -231,12 +388,27 @@ cmd_restart() {
    openclaw gateway restart 2>&1
  else
    echo "Restarting proxy..."
-    launchctl kickstart -k gui/501/ai.openclaw.proxy 2>/dev/null || {
-      echo "launchctl failed, trying kill + restart..."
-      pkill -f "claude-proxy/server.mjs" 2>/dev/null || true
+    # Try current service name, then legacy, then manual restart
+    local uid
+    uid=$(id -u)
+    if launchctl kickstart -k "gui/$uid/dev.ocp.proxy" 2>/dev/null; then
+      true
+    elif launchctl kickstart -k "gui/$uid/ai.openclaw.proxy" 2>/dev/null; then
+      true
+    elif systemctl --user restart ocp-proxy 2>/dev/null; then
+      true
+    elif systemctl --user restart openclaw-proxy 2>/dev/null; then
+      true
+    else
+      echo "Service restart failed, trying kill + restart..."
+      pkill -f "server.mjs.*CLAUDE_PROXY" 2>/dev/null || pkill -f "claude-proxy/server.mjs" 2>/dev/null || true
      sleep 1
-      cd "$HOME/.openclaw/projects/claude-proxy" && nohup node server.mjs >> "$HOME/.openclaw/logs/proxy.log" 2>&1 &
-    }
+      local self_r script_dir
+      self_r="${BASH_SOURCE[0]}"
+      while [[ -L "$self_r" ]]; do self_r="$(readlink "$self_r")"; done
+      script_dir="$(cd "$(dirname "$self_r")" && pwd)"
+      nohup node "$script_dir/server.mjs" >> "$HOME/.ocp/logs/proxy.log" 2>&1 &
+    fi
    sleep 3
    if curl -sf --max-time 5 "$PROXY/health" > /dev/null 2>&1; then
      echo "✓ Proxy restarted successfully."
@@ -323,6 +495,102 @@ for e in d.get('errors', []):
  fi
 }

+# ── update ──────────────────────────────────────────────────────────────
+cmd_update_help() {
+  cat <<'EOF'
+ocp update — Update OCP to the latest version
+
+Pulls the latest code from GitHub, restarts the proxy service,
+and optionally syncs the plugin to the OpenClaw extensions directory.
+
+Usage:
+  ocp update             Pull latest and restart
+  ocp update --check     Check for updates without applying
+EOF
+}
+
+cmd_update() {
+  local script_dir self
+  self="${BASH_SOURCE[0]}"
+  # Resolve symlinks (e.g. ~/.local/bin/ocp → real location)
+  while [[ -L "$self" ]]; do self="$(readlink "$self")"; done
+  script_dir="$(cd "$(dirname "$self")" && pwd)"
+
+  # Check-only mode
+  if [[ "${1:-}" == "--check" ]]; then
+    cd "$script_dir"
+    git fetch origin main --quiet 2>/dev/null || true
+    local local_ver remote_ver
+    local_ver=$(python3 -c "import json; print(json.load(open('package.json'))['version'])" 2>/dev/null || echo "?")
+    remote_ver=$(git show origin/main:package.json 2>/dev/null | python3 -c "import sys,json; print(json.load(sys.stdin)['version'])" 2>/dev/null || echo "?")
+    local behind
+    behind=$(git rev-list HEAD..origin/main --count 2>/dev/null || echo "?")
+    echo "OCP Update Check"
+    echo "─────────────────────────────────────"
+    echo "  Current:  v$local_ver"
+    echo "  Latest:   v$remote_ver"
+    if [[ "$behind" == "0" ]]; then
+      echo "  Status:   ✓ Up to date"
+    else
+      echo "  Status:   $behind commit(s) behind"
+      echo ""
+      echo "  Run 'ocp update' to apply."
+    fi
+    return 0
+  fi
+
+  echo "Updating OCP..."
+  echo ""
+
+  # 1. Pull latest
+  cd "$script_dir"
+  local old_ver
+  old_ver=$(python3 -c "import json; print(json.load(open('package.json'))['version'])" 2>/dev/null || echo "?")
+
+  echo "  Pulling latest from GitHub..."
+  if ! git pull origin main --ff-only 2>&1 | sed 's/^/    /'; then
+    echo "  ✗ Git pull failed. Resolve conflicts manually in: $script_dir"
+    return 1
+  fi
+
+  local new_ver
+  new_ver=$(python3 -c "import json; print(json.load(open('package.json'))['version'])" 2>/dev/null || echo "?")
+
+  if [[ "$old_ver" == "$new_ver" ]]; then
+    echo "  ✓ Already at latest (v$new_ver)"
+  else
+    echo "  ✓ Updated v$old_ver → v$new_ver"
+  fi
+
+  # 2. Sync plugin to extensions dir
+  local ext_dir="$HOME/.openclaw/extensions/ocp"
+  if [[ -d "$ext_dir" && -d "$script_dir/ocp-plugin" ]]; then
+    echo ""
+    echo "  Syncing OCP plugin..."
+    cp "$script_dir/ocp-plugin/index.js" "$ext_dir/index.js" 2>/dev/null
+    cp "$script_dir/ocp-plugin/package.json" "$ext_dir/package.json" 2>/dev/null
+    cp "$script_dir/ocp-plugin/openclaw.plugin.json" "$ext_dir/openclaw.plugin.json" 2>/dev/null
+    echo "  ✓ Plugin synced to $ext_dir"
+  fi
+
+  # 3. Restart proxy
+  echo ""
+  echo "  Restarting proxy..."
+  cmd_restart > /dev/null 2>&1
+  sleep 2
+
+  if curl -sf --max-time 5 "$PROXY/health" > /dev/null 2>&1; then
+    local running_ver
+    running_ver=$(curl -sf --max-time 5 "$PROXY/health" | python3 -c "import sys,json; print(json.loads(sys.stdin.read())['version'])" 2>/dev/null || echo "?")
+    echo "  ✓ Proxy running (v$running_ver)"
+  else
+    echo "  ⚠ Proxy not responding — check: ocp health"
+  fi
+
+  echo ""
+  echo "Done."
+}
+
 # ── help ─────────────────────────────────────────────────────────────────
 cmd_help() {
  cat <<'EOF'
@@ -331,7 +599,7 @@ ocp — OpenClaw Proxy CLI
 Usage: ocp <command> [args]

 Commands:
-  usage              Plan usage limits
+  usage              Plan usage limits (--by-key for per-key stats)
  status             Quick overview (usage + health)
  health             Proxy diagnostics
  settings           View or update tunable settings
@@ -339,8 +607,12 @@ Commands:
  models             Available models
  sessions           Active sessions
  clear              Clear all sessions
+  keys               Manage API keys (add/list/revoke)
+  lan                LAN mode setup guide
  restart            Restart proxy
  restart gateway    Restart gateway
+  update             Update OCP to latest version
+  update --check     Check for updates

 Run 'ocp <command> --help' for details on a specific command.
 EOF
@@ -371,7 +643,7 @@ for arg in "$@"; do
 done

 case "$subcmd" in
-  usage)    cmd_usage ;;
+  usage)    cmd_usage "${1:-}" ;;
  status)   cmd_status ;;
  health)   cmd_health ;;
  settings) cmd_settings "${1:-}" "${2:-}" ;;
@@ -379,6 +651,9 @@ case "$subcmd" in
  models)   cmd_models ;;
  sessions) cmd_sessions ;;
  clear)    cmd_clear ;;
+  keys)     cmd_keys "${1:-}" "${2:-}" ;;
+  lan)      cmd_lan ;;
  restart)  cmd_restart "${1:-}" ;;
+  update)   cmd_update "${1:-}" ;;
  *)        echo "Unknown command: $subcmd"; echo ""; cmd_help; exit 1 ;;
 esac
@@ -2,7 +2,7 @@
  "id": "ocp",
  "name": "OCP Commands",
  "description": "Slash commands for the OpenClaw Proxy — /ocp usage, /ocp settings, /ocp health, etc.",
-  "version": "3.1.0",
+  "version": "3.3.1",
  "configSchema": {
    "type": "object",
    "additionalProperties": false,
@@ -1,6 +1,6 @@
 {
  "name": "ocp",
-  "version": "3.1.0",
+  "version": "3.3.1",
  "description": "Slash commands for the OpenClaw Proxy",
  "main": "index.js",
  "type": "module",
@@ -0,0 +1,20 @@
+{
+  "name": "openclaw-claude-proxy",
+  "version": "3.4.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "openclaw-claude-proxy",
+      "version": "3.4.0",
+      "license": "MIT",
+      "bin": {
+        "ocp": "ocp",
+        "openclaw-claude-proxy": "server.mjs"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    }
+  }
+}
@@ -1,6 +1,6 @@
 {
  "name": "openclaw-claude-proxy",
-  "version": "3.1.0",
+  "version": "3.4.0",
  "description": "OCP (Open Claude Proxy) — use your Claude Pro/Max subscription as an OpenAI-compatible API for any IDE. Works with Cline, OpenCode, Aider, Continue.dev, OpenClaw, and more.",
  "type": "module",
  "bin": {
@@ -1,30 +1,19 @@
 #!/usr/bin/env node
 /**
- * openclaw-claude-proxy v2.5.0 — OpenAI-compatible proxy for Claude CLI
+ * openclaw-claude-proxy — OpenAI-compatible proxy for Claude CLI
 *
 * Translates OpenAI chat/completions requests into `claude -p` CLI calls,
 * letting you use your Claude Pro/Max subscription as an OpenClaw model provider.
 *
- * v2.5.0:
- *   - Sliding-window circuit breaker: uses time-windowed failure rate instead of
- *     consecutive-count, preventing multi-agent burst scenarios from tripping the
- *     breaker too aggressively. Half-open state allows configurable probe requests.
- *   - Graduated backoff: cooldown doubles on each re-open (capped at 5min),
- *     resets fully on success.
- *   - Health endpoint now exposes per-model breaker state and sliding window stats.
- *   - Increased default timeout tiers for Opus/Sonnet to handle large agent prompts.
- *
- * v2.4.0:
- *   - Per-model circuit breaker: consecutive timeouts temporarily mark a model as degraded
- *   - Adaptive first-byte timeout: scales by model tier + prompt size
- *   - Structured JSON logging for key events (easier to parse/alert on)
- *   - On-demand spawning (no pool), session management, full tool access
+ * Timeout design: single CLAUDE_TIMEOUT (default 600s / 10 min).
+ * No separate first-byte or idle timeout — Claude tool-use causes long pauses
+ * in the token stream (30s-5min) that make fine-grained timeouts unreliable.
+ * This matches LiteLLM, OpenAI SDK, and other major LLM proxies.
 *
 * Env vars:
 *   CLAUDE_PROXY_PORT            — listen port (default: 3456)
 *   CLAUDE_BIN                   — path to claude binary (default: auto-detect)
- *   CLAUDE_TIMEOUT               — per-request timeout in ms (default: 300000)
- *   CLAUDE_FIRST_BYTE_TIMEOUT    — base first-byte timeout in ms (default: 90000)
+ *   CLAUDE_TIMEOUT               — per-request timeout in ms (default: 600000)
 *   CLAUDE_ALLOWED_TOOLS         — comma-separated tools to allow (default: expanded set)
 *   CLAUDE_SKIP_PERMISSIONS      — "true" to bypass all permission checks (default: false)
 *   CLAUDE_SYSTEM_PROMPT         — system prompt appended to all requests
@@ -44,6 +33,7 @@ import { readFileSync, accessSync, constants } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
+import { validateKey, recordUsage, getUsageByKey, getUsageTimeline, getRecentUsage, createKey, listKeys, revokeKey, closeDb } from "./keys.mjs";

 const __dirname = dirname(fileURLToPath(import.meta.url));
 const _pkg = JSON.parse(readFileSync(join(__dirname, "package.json"), "utf8"));
@@ -89,8 +79,7 @@ function resolveClaude() {
 // Settings marked with `let` can be changed at runtime via PATCH /settings.
 const PORT = parseInt(process.env.CLAUDE_PROXY_PORT || "3456", 10);
 const CLAUDE = resolveClaude();
-let TIMEOUT = parseInt(process.env.CLAUDE_TIMEOUT || "300000", 10);
-let BASE_FIRST_BYTE_TIMEOUT = parseInt(process.env.CLAUDE_FIRST_BYTE_TIMEOUT || "90000", 10);
+let TIMEOUT = parseInt(process.env.CLAUDE_TIMEOUT || "600000", 10);
 const PROXY_API_KEY = process.env.PROXY_API_KEY || "";
 const SKIP_PERMISSIONS = process.env.CLAUDE_SKIP_PERMISSIONS === "true";
 const ALLOWED_TOOLS = (process.env.CLAUDE_ALLOWED_TOOLS ||
@@ -104,6 +93,13 @@ const BREAKER_THRESHOLD = parseInt(process.env.CLAUDE_BREAKER_THRESHOLD || "6",
 const BREAKER_COOLDOWN = parseInt(process.env.CLAUDE_BREAKER_COOLDOWN || "120000", 10);
 const BREAKER_WINDOW = parseInt(process.env.CLAUDE_BREAKER_WINDOW || "300000", 10);
 const BREAKER_HALF_OPEN_MAX = parseInt(process.env.CLAUDE_BREAKER_HALF_OPEN_MAX || "2", 10);
+const BIND_ADDRESS = process.env.CLAUDE_BIND || "127.0.0.1";
+const AUTH_MODE = process.env.CLAUDE_AUTH_MODE || (PROXY_API_KEY ? "shared" : "none");
+const ADMIN_KEY = process.env.OCP_ADMIN_KEY || "";
+
+if (AUTH_MODE === "shared" && !PROXY_API_KEY) {
+  console.warn("WARNING: AUTH_MODE=shared but PROXY_API_KEY is not set — all requests will pass unauthenticated");
+}

 const VERSION = _pkg.version;
 const START_TIME = Date.now();
@@ -358,26 +354,13 @@ function messagesToPrompt(messages) {
  return result;
 }

-// Model tier multipliers for first-byte timeout.
-// Opus is much slower to produce first token, especially with large contexts.
-let MODEL_TIMEOUT_TIERS = {
-  "opus": { base: 150000, perPromptChar: 0.00050 },   // 150s base + ~50s per 100k chars
-  "sonnet": { base: 120000, perPromptChar: 0.00050 }, // 120s base + ~50s per 100k chars
-  "haiku": { base: 45000, perPromptChar: 0.00010 },   // 45s base + ~10s per 100k chars
-};
-
+// Model tier — used for logging only (no timeout logic).
 function getModelTier(cliModel) {
  if (cliModel.includes("opus")) return "opus";
  if (cliModel.includes("haiku")) return "haiku";
  return "sonnet";
 }

-function computeFirstByteTimeout(cliModel, promptLength) {
-  const tier = MODEL_TIMEOUT_TIERS[getModelTier(cliModel)];
-  const timeout = tier.base + Math.floor(promptLength * tier.perPromptChar);
-  return Math.min(timeout, Math.max(TIMEOUT - 5000, 10000));
-}
-
 // ── Spawn claude CLI (shared setup) ─────────────────────────────────────
 // Resolves session logic, builds CLI args, spawns the process, and sets up
 // timeouts. Returns context object or throws synchronously.
@@ -437,7 +420,6 @@ function spawnClaudeProcess(model, messages, conversationId) {
  activeProcesses.add(proc);

  const t0 = Date.now();
-  const firstByteTimeoutMs = computeFirstByteTimeout(cliModel, prompt.length);
  let gotFirstByte = false;
  let cleaned = false;

@@ -445,7 +427,6 @@ function spawnClaudeProcess(model, messages, conversationId) {
    if (cleaned) return;
    cleaned = true;
    clearTimeout(overallTimer);
-    clearTimeout(firstByteTimer);
    stats.activeRequests--;
  }

@@ -459,7 +440,6 @@ function spawnClaudeProcess(model, messages, conversationId) {
  function markFirstByte() {
    if (!gotFirstByte) {
      gotFirstByte = true;
-      clearTimeout(firstByteTimer);
      console.log(`[claude] first-byte model=${cliModel} elapsed=${Date.now() - t0}ms`);
    }
  }
@@ -469,27 +449,17 @@ function spawnClaudeProcess(model, messages, conversationId) {
  proc.stdin.end();

  recordModelRequest(cliModel, prompt.length);
-  logEvent("info", "claude_spawned", { model: cliModel, promptChars: prompt.length, firstByteTimeout: firstByteTimeoutMs, tier: getModelTier(cliModel), session: conversationId ? conversationId.slice(0, 12) + "..." : "none" });
+  logEvent("info", "claude_spawned", { model: cliModel, promptChars: prompt.length, timeout: TIMEOUT, tier: getModelTier(cliModel), session: conversationId ? conversationId.slice(0, 12) + "..." : "none" });

-  // First-byte timeout
-  const firstByteTimer = setTimeout(() => {
-    if (!gotFirstByte && !cleaned) {
-      stats.timeouts++;
-      recordModelError(cliModel, true);
-      breakerRecordTimeout(cliModel);
-      logEvent("error", "first_byte_timeout", { model: cliModel, timeoutMs: firstByteTimeoutMs, promptChars: prompt.length });
-      try { proc.kill("SIGTERM"); } catch {}
-      setTimeout(() => { try { proc.kill("SIGKILL"); } catch {} }, 5000);
-    }
-  }, firstByteTimeoutMs);
-
-  // Overall request timeout
+  // Single request timeout — no separate first-byte timer.
+  // Claude tool-use causes long pauses in the token stream (30s-5min),
+  // making first-byte/idle timeouts unreliable. One generous timeout is simpler and correct.
  const overallTimer = setTimeout(() => {
    if (!cleaned) {
      stats.timeouts++;
      recordModelError(cliModel, true);
      breakerRecordTimeout(cliModel);
-      logEvent("error", "request_timeout", { model: cliModel, timeoutMs: TIMEOUT });
+      logEvent("error", "request_timeout", { model: cliModel, timeoutMs: TIMEOUT, elapsed: Date.now() - t0 });
      try { proc.kill("SIGTERM"); } catch {}
      setTimeout(() => { try { proc.kill("SIGKILL"); } catch {} }, 5000);
    }
@@ -552,7 +522,7 @@ function callClaude(model, messages, conversationId) {
 // ── Call claude CLI (real streaming) ─────────────────────────────────────
 // Pipes stdout from the claude process directly to SSE chunks as they arrive.
 // Each data chunk becomes a proper SSE event with delta content in real time.
-function callClaudeStreaming(model, messages, conversationId, res) {
+function callClaudeStreaming(model, messages, conversationId, res, authInfo = {}) {
  const id = `chatcmpl-${randomUUID()}`;
  const created = Math.floor(Date.now() / 1000);

@@ -607,6 +577,7 @@ function callClaudeStreaming(model, messages, conversationId, res) {

    if (code !== 0) {
      recordModelError(cliModel, false);
+      try { recordUsage({ keyId: authInfo.keyId, keyName: authInfo.keyName, model, promptChars: messages.reduce((a, m) => a + (typeof m.content === "string" ? m.content.length : JSON.stringify(m.content).length), 0), responseChars: 0, elapsedMs: elapsed, success: false }); } catch (e) { logEvent("error", "usage_record_failed", { error: e.message }); }
      logEvent("error", "claude_exit", { model: cliModel, code, signal: signal || "none", elapsed, stderr: stderr.slice(0, 300) });
      trackError(stderr.slice(0, 300) || `claude exit ${code}`);
      handleSessionFailure();
@@ -624,6 +595,7 @@ function callClaudeStreaming(model, messages, conversationId, res) {
    } else {
      recordModelSuccess(cliModel, elapsed);
      breakerRecordSuccess(cliModel);
+      try { recordUsage({ keyId: authInfo.keyId, keyName: authInfo.keyName, model, promptChars: messages.reduce((a, m) => a + (typeof m.content === "string" ? m.content.length : JSON.stringify(m.content).length), 0), responseChars: totalChars, elapsedMs: elapsed, success: true }); } catch (e) { logEvent("error", "usage_record_failed", { error: e.message }); }
      logEvent("info", "claude_ok", { model: cliModel, chars: totalChars, elapsed, session: convId ? convId.slice(0, 12) + "..." : "none" });

      if (!headersSent) ensureHeaders();
@@ -929,31 +901,18 @@ async function handleStatus(_req, res) {
 //
 // Tunable keys and their types/ranges:
 const SETTINGS_SCHEMA = {
-  timeout:          { type: "number", min: 30000, max: 600000, unit: "ms", desc: "Overall request timeout" },
-  firstByteTimeout: { type: "number", min: 15000, max: 300000, unit: "ms", desc: "Base first-byte timeout" },
+  timeout:          { type: "number", min: 30000, max: 1800000, unit: "ms", desc: "Request timeout (default: 600s)" },
  maxConcurrent:    { type: "number", min: 1, max: 32, unit: "", desc: "Max concurrent claude processes" },
  sessionTTL:       { type: "number", min: 60000, max: 86400000, unit: "ms", desc: "Session idle expiry" },
  maxPromptChars:   { type: "number", min: 10000, max: 1000000, unit: "chars", desc: "Prompt truncation limit" },
-  "tiers.opus.base":        { type: "number", min: 30000, max: 600000, unit: "ms", desc: "Opus base first-byte timeout" },
-  "tiers.opus.perChar":     { type: "number", min: 0, max: 0.01, unit: "ms/char", desc: "Opus per-char timeout addition" },
-  "tiers.sonnet.base":      { type: "number", min: 30000, max: 600000, unit: "ms", desc: "Sonnet base first-byte timeout" },
-  "tiers.sonnet.perChar":   { type: "number", min: 0, max: 0.01, unit: "ms/char", desc: "Sonnet per-char timeout addition" },
-  "tiers.haiku.base":       { type: "number", min: 15000, max: 300000, unit: "ms", desc: "Haiku base first-byte timeout" },
-  "tiers.haiku.perChar":    { type: "number", min: 0, max: 0.01, unit: "ms/char", desc: "Haiku per-char timeout addition" },
 };

 function getSettings() {
  return {
    timeout:          { value: TIMEOUT, ...SETTINGS_SCHEMA.timeout },
-    firstByteTimeout: { value: BASE_FIRST_BYTE_TIMEOUT, ...SETTINGS_SCHEMA.firstByteTimeout },
    maxConcurrent:    { value: MAX_CONCURRENT, ...SETTINGS_SCHEMA.maxConcurrent },
    sessionTTL:       { value: SESSION_TTL, ...SETTINGS_SCHEMA.sessionTTL },
    maxPromptChars:   { value: MAX_PROMPT_CHARS, ...SETTINGS_SCHEMA.maxPromptChars },
-    tiers: {
-      opus:   { base: MODEL_TIMEOUT_TIERS.opus.base, perPromptChar: MODEL_TIMEOUT_TIERS.opus.perPromptChar },
-      sonnet: { base: MODEL_TIMEOUT_TIERS.sonnet.base, perPromptChar: MODEL_TIMEOUT_TIERS.sonnet.perPromptChar },
-      haiku:  { base: MODEL_TIMEOUT_TIERS.haiku.base, perPromptChar: MODEL_TIMEOUT_TIERS.haiku.perPromptChar },
-    },
  };
 }

@@ -965,16 +924,9 @@ function applySettingUpdate(key, value) {

  switch (key) {
    case "timeout":          TIMEOUT = value; break;
-    case "firstByteTimeout": BASE_FIRST_BYTE_TIMEOUT = value; break;
    case "maxConcurrent":    MAX_CONCURRENT = value; break;
    case "sessionTTL":       SESSION_TTL = value; break;
    case "maxPromptChars":   MAX_PROMPT_CHARS = value; break;
-    case "tiers.opus.base":        MODEL_TIMEOUT_TIERS.opus.base = value; break;
-    case "tiers.opus.perChar":     MODEL_TIMEOUT_TIERS.opus.perPromptChar = value; break;
-    case "tiers.sonnet.base":      MODEL_TIMEOUT_TIERS.sonnet.base = value; break;
-    case "tiers.sonnet.perChar":   MODEL_TIMEOUT_TIERS.sonnet.perPromptChar = value; break;
-    case "tiers.haiku.base":       MODEL_TIMEOUT_TIERS.haiku.base = value; break;
-    case "tiers.haiku.perChar":    MODEL_TIMEOUT_TIERS.haiku.perPromptChar = value; break;
    default: return `${key}: not implemented`;
  }
  logEvent("info", "setting_changed", { key, value });
@@ -1053,14 +1005,18 @@ async function handleChatCompletions(req, res) {

  if (stream) {
    // Real streaming: pipe stdout from claude process directly as SSE chunks
-    return callClaudeStreaming(model, messages, conversationId, res);
+    return callClaudeStreaming(model, messages, conversationId, res, { keyId: req._authKeyId, keyName: req._authKeyName });
  }

+  const t0Usage = Date.now();
+  const promptChars = messages.reduce((a, m) => a + (typeof m.content === "string" ? m.content.length : JSON.stringify(m.content).length), 0);
  try {
    const content = await callClaude(model, messages, conversationId);
    const id = `chatcmpl-${randomUUID()}`;
    completionResponse(res, id, model, content);
+    try { recordUsage({ keyId: req._authKeyId, keyName: req._authKeyName, model, promptChars, responseChars: content.length, elapsedMs: Date.now() - t0Usage, success: true }); } catch (e) { logEvent("error", "usage_record_failed", { error: e.message }); }
  } catch (err) {
+    try { recordUsage({ keyId: req._authKeyId, keyName: req._authKeyName, model, promptChars, responseChars: 0, elapsedMs: Date.now() - t0Usage, success: false }); } catch (e) { logEvent("error", "usage_record_failed", { error: e.message }); }
    console.error(`[proxy] error: ${err.message}`);
    if (res.headersSent || res.writableEnded || res.destroyed) {
      try { res.end(); } catch {}
@@ -1074,25 +1030,59 @@ async function handleChatCompletions(req, res) {

 // ── HTTP server ─────────────────────────────────────────────────────────
 const server = createServer(async (req, res) => {
-  // Dynamic CORS: only allow localhost origins
+  // Dynamic CORS: allow localhost and LAN origins
  const origin = req.headers["origin"] || "";
-  const isLocalhost = /^https?:\/\/(127\.0\.0\.1|localhost)(:\d+)?$/.test(origin);
-  res.setHeader("Access-Control-Allow-Origin", isLocalhost ? origin : `http://127.0.0.1:${PORT}`);
-  res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+  const isAllowedOrigin = /^https?:\/\/(127\.0\.0\.1|localhost|192\.168\.\d+\.\d+|172\.(1[6-9]|2\d|3[01])\.\d+\.\d+|10\.\d+\.\d+\.\d+)(:\d+)?$/.test(origin);
+  res.setHeader("Access-Control-Allow-Origin", isAllowedOrigin ? origin : `http://127.0.0.1:${PORT}`);
+  res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS, PATCH");
  res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Session-Id, X-Conversation-Id");
  if (req.method === "OPTIONS") { res.writeHead(204); res.end(); return; }

-  // Bearer token auth (skip for /health and when PROXY_API_KEY is not set)
-  if (PROXY_API_KEY && req.url !== "/health") {
+  // 3-mode auth: none | shared | multi
+  const isPublicEndpoint = req.url === "/health" || req.url === "/dashboard";
+  let authKeyName = "local";
+  let authKeyId = null;
+
+  if (!isPublicEndpoint) {
    const auth = req.headers["authorization"] || "";
    const token = auth.startsWith("Bearer ") ? auth.slice(7) : "";
-    const tokenBuf = Buffer.from(token);
-    const keyBuf = Buffer.from(PROXY_API_KEY);
-    if (tokenBuf.length !== keyBuf.length || !timingSafeEqual(tokenBuf, keyBuf)) {
-      return jsonResponse(res, 401, { error: { message: "Unauthorized: invalid or missing Bearer token", type: "auth_error" } });
+
+    if (AUTH_MODE === "shared") {
+      if (PROXY_API_KEY) {
+        const tokenBuf = Buffer.from(token);
+        const keyBuf = Buffer.from(PROXY_API_KEY);
+        if (tokenBuf.length !== keyBuf.length || !timingSafeEqual(tokenBuf, keyBuf)) {
+          return jsonResponse(res, 401, { error: { message: "Unauthorized: invalid or missing Bearer token", type: "auth_error" } });
+        }
+        authKeyName = "shared";
+      }
+    } else if (AUTH_MODE === "multi") {
+      if (!token) {
+        return jsonResponse(res, 401, { error: { message: "Unauthorized: Bearer token required", type: "auth_error" } });
+      }
+      let isAdminToken = false;
+      if (ADMIN_KEY) {
+        const adminBuf = Buffer.from(ADMIN_KEY);
+        const tokenBuf2 = Buffer.from(token);
+        if (adminBuf.length === tokenBuf2.length && timingSafeEqual(adminBuf, tokenBuf2)) {
+          authKeyName = "admin";
+          isAdminToken = true;
+        }
+      }
+      if (!isAdminToken) {
+        const keyInfo = validateKey(token);
+        if (!keyInfo) {
+          return jsonResponse(res, 401, { error: { message: "Unauthorized: invalid or revoked API key", type: "auth_error" } });
+        }
+        authKeyName = keyInfo.name;
+        authKeyId = keyInfo.id;
+      }
    }
  }

+  req._authKeyName = authKeyName;
+  req._authKeyId = authKeyId;
+
  // GET /v1/models
  if (req.url === "/v1/models" && req.method === "GET") {
    return jsonResponse(res, 200, {
@@ -1136,7 +1126,6 @@ const server = createServer(async (req, res) => {
      auth: authStatus,
      config: {
        timeout: TIMEOUT,
-        firstByteTimeout: BASE_FIRST_BYTE_TIMEOUT,
        maxConcurrent: MAX_CONCURRENT,
        sessionTTL: SESSION_TTL,
        circuitBreaker: "disabled",
@@ -1188,7 +1177,57 @@ const server = createServer(async (req, res) => {
    return handleSettings(req, res);
  }

-  jsonResponse(res, 404, { error: "Not found. Endpoints: GET /v1/models, POST /v1/chat/completions, GET /health, GET /usage, GET /status, GET /logs, GET|PATCH /settings, GET|DELETE /sessions" });
+  // ── Key management API ──
+  const isAdmin = AUTH_MODE !== "multi" || authKeyName === "admin";
+
+  if (req.url === "/api/keys" && req.method === "POST") {
+    if (!isAdmin) return jsonResponse(res, 403, { error: "Admin access required" });
+    let body = "";
+    for await (const chunk of req) body += chunk;
+    let parsed;
+    try { parsed = JSON.parse(body); } catch { return jsonResponse(res, 400, { error: "Invalid JSON" }); }
+    const name = parsed.name || `key-${Date.now()}`;
+    const newKey = createKey(name);
+    return jsonResponse(res, 201, newKey);
+  }
+
+  if (req.url === "/api/keys" && req.method === "GET") {
+    if (!isAdmin) return jsonResponse(res, 403, { error: "Admin access required" });
+    return jsonResponse(res, 200, { keys: listKeys() });
+  }
+
+  if (req.url?.startsWith("/api/keys/") && req.method === "DELETE") {
+    if (!isAdmin) return jsonResponse(res, 403, { error: "Admin access required" });
+    const idOrName = decodeURIComponent(req.url.split("/api/keys/")[1]);
+    const revoked = revokeKey(idOrName);
+    return jsonResponse(res, 200, { revoked, idOrName });
+  }
+
+  if (req.url?.startsWith("/api/usage") && req.method === "GET") {
+    if (!isAdmin) return jsonResponse(res, 403, { error: "Admin access required" });
+    const url = new URL(req.url, `http://${BIND_ADDRESS}:${PORT}`);
+    const since = url.searchParams.get("since");
+    const until = url.searchParams.get("until");
+    return jsonResponse(res, 200, {
+      byKey: getUsageByKey({ since, until }),
+      timeline: getUsageTimeline({ hours: Math.min(parseInt(url.searchParams.get("hours") || "24", 10), 720) }),
+      recent: getRecentUsage(Math.min(parseInt(url.searchParams.get("limit") || "50", 10), 500)),
+    });
+  }
+
+  // GET /dashboard — web dashboard
+  if (req.url === "/dashboard" && req.method === "GET") {
+    try {
+      const html = readFileSync(join(__dirname, "dashboard.html"), "utf8");
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(html);
+    } catch (err) {
+      return jsonResponse(res, 500, { error: "Dashboard file not found" });
+    }
+    return;
+  }
+
+  jsonResponse(res, 404, { error: "Not found. Endpoints: GET /v1/models, POST /v1/chat/completions, GET /health, GET /usage, GET /status, GET /logs, GET|PATCH /settings, GET|DELETE /sessions, GET /dashboard, GET|POST|DELETE /api/keys, GET /api/usage" });
 });


@@ -1208,6 +1247,7 @@ function gracefulShutdown(signal) {
  // 2. Clear intervals/timers
  clearInterval(sessionCleanupInterval);
  clearInterval(authCheckInterval);
+  closeDb();

  // 3. Kill all active child processes
  for (const proc of activeProcesses) {
@@ -1245,18 +1285,21 @@ process.on("SIGTERM", () => gracefulShutdown("SIGTERM"));
 process.on("SIGINT", () => gracefulShutdown("SIGINT"));

 // ── Start ───────────────────────────────────────────────────────────────
-server.listen(PORT, "127.0.0.1", () => {
-  console.log(`openclaw-claude-proxy v${VERSION} listening on http://127.0.0.1:${PORT}`);
+server.listen(PORT, BIND_ADDRESS, () => {
+  const bindMsg = BIND_ADDRESS === "0.0.0.0" ? `http://0.0.0.0:${PORT} (LAN mode)` : `http://127.0.0.1:${PORT}`;
+  console.log(`openclaw-claude-proxy v${VERSION} listening on ${bindMsg}`);
  console.log(`Architecture: on-demand spawning (no pool)`);
  console.log(`Models: ${MODELS.map((m) => m.id).join(", ")}`);
  console.log(`Claude binary: ${CLAUDE}`);
-  console.log(`Timeout: ${TIMEOUT}ms (base first-byte: ${BASE_FIRST_BYTE_TIMEOUT}ms, adaptive by model/prompt) | Max concurrent: ${MAX_CONCURRENT}`);
+  console.log(`Timeout: ${TIMEOUT / 1000}s | Max concurrent: ${MAX_CONCURRENT}`);
  console.log(`Circuit breaker: disabled`);
  console.log(`Tools: ${SKIP_PERMISSIONS ? "all (skip-permissions)" : ALLOWED_TOOLS.join(", ")}`);
  console.log(`Sessions: TTL=${SESSION_TTL / 1000}s`);
  if (SYSTEM_PROMPT) console.log(`System prompt: "${SYSTEM_PROMPT.slice(0, 80)}..."`);
  if (MCP_CONFIG) console.log(`MCP config: ${MCP_CONFIG}`);
  console.log(`Auth: ${PROXY_API_KEY ? "enabled (PROXY_API_KEY set)" : "disabled (no PROXY_API_KEY)"}`);
+  console.log(`Auth mode: ${AUTH_MODE}${AUTH_MODE === "shared" ? " (PROXY_API_KEY)" : AUTH_MODE === "multi" ? " (per-user keys)" : " (open)"}`);
+  console.log(`Bind: ${BIND_ADDRESS}${BIND_ADDRESS === "0.0.0.0" ? " ⚠ LAN-accessible" : ""}`);
  console.log(`---`);
  console.log(`Coexistence: This proxy does NOT conflict with Claude Code interactive mode.`);
  console.log(`  OCP uses: localhost:${PORT} (HTTP) → claude -p (per-request process)`);
@@ -36,6 +36,8 @@ const DEFAULT_MODEL = opt("default-model", "opus"); // opus | sonnet | haiku
 const DRY_RUN = flag("dry-run");
 const SKIP_START = flag("no-start");
 const PROVIDER_NAME = opt("provider-name", "claude-local");
+const BIND_ADDRESS = opt("bind", "127.0.0.1");
+const AUTH_MODE_CONFIG = opt("auth-mode", "none");

 const MODEL_ID_MAP = {
  opus: "claude-opus-4-6",
@@ -169,6 +171,19 @@ for (const [key, val] of Object.entries(MODEL_ALIASES)) {
 }
 log(`Model aliases added to agents.defaults.models`);

+// Set idleTimeoutSeconds to 0 — critical for Claude tool-use.
+// When Claude calls tools (Bash, Read, etc.), the token stream pauses for 30-120s.
+// OpenClaw's default idleTimeoutSeconds (60s) kills the connection mid-tool-call,
+// causing exit 143 (SIGTERM) and stuck sessions. Setting to 0 disables the idle timer.
+if (!config.agents.defaults.llm) config.agents.defaults.llm = {};
+if (config.agents.defaults.llm.idleTimeoutSeconds === undefined ||
+    config.agents.defaults.llm.idleTimeoutSeconds > 0) {
+  config.agents.defaults.llm.idleTimeoutSeconds = 0;
+  log(`Set agents.defaults.llm.idleTimeoutSeconds = 0 (prevents tool-call timeouts)`);
+} else {
+  log(`idleTimeoutSeconds already configured: ${config.agents.defaults.llm.idleTimeoutSeconds}`);
+}
+
 writeJSON(CONFIG_PATH, config);
 log(`Config saved`);

@@ -285,7 +300,16 @@ if (!DRY_RUN) {
  console.log("\n🔄 Installing auto-start on login...\n");

  const platform = process.platform;
-  const nodeBin = process.execPath;
+  // Use stable symlink path instead of versioned Cellar path (e.g. /opt/homebrew/opt/node/bin/node
+  // instead of /opt/homebrew/Cellar/node/25.8.0/bin/node) so the plist survives node upgrades.
+  let nodeBin = process.execPath;
+  if (platform === "darwin" && nodeBin.includes("/Cellar/")) {
+    const stable = nodeBin.replace(/\/Cellar\/[^/]+\/[^/]+\//, "/opt/");
+    if (existsSync(stable)) {
+      nodeBin = stable;
+      log(`Using stable node path: ${nodeBin}`);
+    }
+  }

  // Ensure logs dir exists
  const logsDir = join(OPENCLAW_DIR, "logs");
@@ -341,6 +365,10 @@ if (!DRY_RUN) {
  <dict>
    <key>CLAUDE_PROXY_PORT</key>
    <string>${PORT}</string>
+    <key>CLAUDE_BIND</key>
+    <string>${BIND_ADDRESS}</string>
+    <key>CLAUDE_AUTH_MODE</key>
+    <string>${AUTH_MODE_CONFIG}</string>
  </dict>
  <key>RunAtLoad</key>
  <true/>
@@ -377,6 +405,8 @@ After=network.target
 [Service]
 ExecStart=${nodeBin} ${serverPath}
 Environment=CLAUDE_PROXY_PORT=${PORT}
+Environment=CLAUDE_BIND=${BIND_ADDRESS}
+Environment=CLAUDE_AUTH_MODE=${AUTH_MODE_CONFIG}
 Restart=always
 RestartSec=5
 StandardOutput=append:${logPath}
Author	SHA1	Message	Date
taodengandClaude Opus 4.6	18cb759359	Merge feature/lan-mode: LAN sharing with multi-key auth, dashboard, CLI Add LAN mode to share one Claude Pro/Max subscription across a household: - 3-tier auth: none / shared / multi (per-user API keys) - SQLite-backed key management and per-request usage tracking - Embedded web dashboard with real-time monitoring - CLI commands: keys, lan, usage --by-key - Zero external dependencies (uses node:sqlite) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-10 21:45:17 +10:00
taodengandClaude Opus 4.6	cc745aa5d9	docs: update README with complete LAN mode reference Add LAN CLI commands (keys, lan, usage --by-key), new API endpoints (dashboard, keys, usage), LAN env vars (CLAUDE_BIND, CLAUDE_AUTH_MODE, OCP_ADMIN_KEY), and expanded security section. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-10 21:45:07 +10:00
taodengandClaude Opus 4.6	1983f9372d	fix: CLI auth support for multi-key mode + fix LAN IP detection - Add _curl wrapper that reads OCP_ADMIN_KEY env or ~/.ocp/admin-key file - All admin API calls (keys, usage) use _curl for auth - Fix ocp lan IP detection to try en0 and en1 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-10 21:36:16 +10:00
taodengandClaude Opus 4.6	471bda2c40	fix: make /dashboard a public endpoint (no auth required) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-10 21:21:36 +10:00
taodengandClaude Opus 4.6	566a01a6bd	refactor: switch from better-sqlite3 to node:sqlite (zero dependencies) better-sqlite3 native addon fails on Node v25. Node.js built-in SQLite (node:sqlite) has an identical synchronous API and requires no compilation. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-10 21:20:24 +10:00
taodeng	43daf8162c	docs: add LAN mode documentation and family sharing guide	2026-04-10 21:17:25 +10:00
taodeng	aa0adab784	feat: add LAN mode config options to setup.mjs	2026-04-10 21:17:19 +10:00
taodengandClaude Sonnet 4.6	4f4e1edf16	feat: add ocp keys, ocp lan, and ocp usage --by-key CLI commands Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-10 21:16:25 +10:00
taodeng	ea57db6ceb	feat: add embedded web dashboard with real-time usage display	2026-04-10 21:15:44 +10:00
taodengandClaude Sonnet 4.6	5fbeaed568	security: fix key exposure, timing-safe admin auth, remove admin bypass, cap params, harden usage recording - Fix 1 (keys.mjs): listKeys() no longer leaks full API key field in response - Fix 2 (server.mjs): Remove BIND_ADDRESS admin bypass from isAdmin check - Fix 3 (server.mjs): Admin key comparison now uses timingSafeEqual - Fix 4 (server.mjs): Cap limit (max 500) and hours (max 720) in GET /api/usage - Fix 5 (server.mjs): Streaming error path now computes promptChars from messages - Fix 6 (server.mjs): Warn at startup if AUTH_MODE=shared but PROXY_API_KEY is empty - Fix 7 (server.mjs): All recordUsage calls wrapped in try/catch to prevent DB errors crashing server - Fix 8 (server.mjs): CORS fallback changed from "*" to specific origin (http://127.0.0.1:<PORT>) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-10 21:13:17 +10:00
taodengandClaude Sonnet 4.6	2b18884d2a	feat: add LAN bind, 3-mode auth, usage recording, key/usage API endpoints Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-10 21:07:22 +10:00
taodeng	4f72f4844e	feat: add keys.mjs — API key management and SQLite usage store	2026-04-10 21:04:00 +10:00
taodeng	bc17b27f2b	chore: add better-sqlite3 dependency, bump to v3.4.0	2026-04-10 21:02:40 +10:00
taodengandClaude Opus 4.6	3e8ff7a509	docs: add LAN mode implementation plan Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-10 21:00:22 +10:00
taodengandClaude Opus 4.6	b6b33d2623	chore: add MIT LICENSE file Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-10 20:37:11 +10:00
taodengandClaude Opus 4.6	8796a5fc19	docs: update README version to v3.3.1 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-05 07:49:54 +10:00
taodengandClaude Opus 4.6	609ceb28b0	fix: use stable node symlink path in macOS plist, avoid Cellar breakage setup.mjs now resolves /opt/homebrew/Cellar/node/X.Y.Z/ to /opt/homebrew/opt/node/ so the LaunchAgent plist survives node upgrades. Bump to v3.3.1. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-04 10:01:54 +10:00
taodengandClaude Opus 4.6	3843ec8fe6	refactor: simplify timeout to single CLAUDE_TIMEOUT (default 600s) Remove firstByteTimeout, adaptive tier algorithm, and MODEL_TIMEOUT_TIERS. Claude tool-use causes 30s-5min pauses in token streams, making fine-grained timeouts unreliable — they repeatedly killed valid requests. A single generous timeout (10 min, matching LiteLLM/OpenAI SDK defaults) is simpler and correct. Breaking: CLAUDE_FIRST_BYTE_TIMEOUT env var removed, default timeout changed from 300s to 600s. Bump to v3.3.0. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-04 09:46:12 +10:00
taodengandClaude Opus 4.6	afe0c6e1be	fix: computeFirstByteTimeout now respects CLAUDE_FIRST_BYTE_TIMEOUT env var The adaptive timeout calculation ignored BASE_FIRST_BYTE_TIMEOUT (set via CLAUDE_FIRST_BYTE_TIMEOUT env), always using the tier base (120s for Sonnet). Now uses whichever is larger: adaptive or env override. Bump to v3.2.2. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-04 09:26:01 +10:00
taodengandClaude Opus 4.6	a6007393a3	fix: auto-configure idleTimeoutSeconds=0 to prevent tool-call timeouts setup.mjs now sets agents.defaults.llm.idleTimeoutSeconds=0 in openclaw.json during installation. Without this, OpenClaw's default 60s idle timeout kills Claude connections during tool use (Bash, Read, etc.), causing exit 143 errors and stuck sessions. Also adds troubleshooting section to README. Bump to v3.2.1. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-03 08:50:19 +10:00
taodengandClaude Opus 4.6	8592150f7a	docs: update README for v3.2.0 — add update command, upgrade notes - Document ocp update / ocp update --check - Add Self-Update section - Add Upgrading from v3.0.x migration notes - Remove Known Issues (resolved upstream) - Note neutral service names in OpenClaw Integration Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-03 08:22:55 +10:00
taodengandClaude Opus 4.6	eb76971ffc	fix: resolve symlinks in ocp update/restart for linked installs BASH_SOURCE returns the symlink path, not the target. This broke ocp update on systems where ocp is installed as a symlink (e.g. ~/.local/bin/ocp → repo/ocp). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-03 08:20:26 +10:00
taodengandClaude Opus 4.6	d54e73ef89	fix: prevent git fetch failure from aborting ocp update --check Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-03 08:19:41 +10:00
taodengandClaude Opus 4.6	3f10b459f5	feat: add `ocp update` command + fix restart for new service names - `ocp update`: pulls latest from GitHub, syncs plugin, restarts proxy - `ocp update --check`: shows current vs latest version without applying - `ocp restart`: now handles both dev.ocp.proxy and legacy ai.openclaw.proxy service names on macOS/Linux - Bumps to v3.2.0 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-03 08:18:41 +10:00