# Mission Control public worker/API fix

## Current externally observed failure

- `https://altaira.panomity.com/mc/healthz` -> `401` with `WWW-Authenticate: Basic realm="moltbot_auth"`
- `https://altaira.panomity.com/mc/api/v1/agent/boards` -> `401` with `WWW-Authenticate: Basic realm="moltbot_auth"`
- `https://altaira.panomity.com/mc/api/v1/agent/boards/2857b7e4-abd0-41ae-8185-4bc3c37cfee1/tasks` -> `401` with `WWW-Authenticate: Basic realm="moltbot_auth"`

## Proven app-side fix

The frontend is configured for relative proxy mode:

- `NEXT_PUBLIC_API_URL=/mc`
- `NEXT_PUBLIC_BASE_PATH=/mc`
- `NEXT_PUBLIC_AUTH_MODE=local`
- `INTERNAL_API_URL=http://127.0.0.1:3411`

So requests are expected to hit the Next frontend first.

Patched frontend behavior was proven on an alternate port:

- `GET http://127.0.0.1:3412/mc/api/v1/users/me` with `X-MC-Local-Token` -> `200`
- `GET http://127.0.0.1:3412/mc/api/v1/agent/boards` with `Authorization: Bearer ztbHKAe1UYI66HCFvSAyo4wrAAD6frNCyAZ67aKVeSE` -> `200`
- `GET http://127.0.0.1:3412/mc/openapi.json` -> `200`

This proves the frontend proxy layer must:

1. translate `X-MC-Local-Token` to `Authorization: Bearer ...` for local browser auth
2. preserve an already-present `Authorization` header for worker/agent calls
3. expose `/mc/openapi.json` via Next rewrites

## Frontend files to keep

- `frontend/src/app/api/[...path]/route.ts`
- `frontend/next.config.ts`

The rollout bundle now also includes exact expected copies of both files:

- `./frontend-route.ts.expected`
- `./frontend-next.config.ts.expected`

These are used by `apply-mission-control-fix.sh` to safely detect the case where the live repo already contains the intended frontend fix but the patch no longer re-applies cleanly on a dirty tree.

A checksum manifest is also included for the rollout bundle:

- `./SHA256SUMS`

The bundle is self-contained: `apply-mission-control-fix.sh` resolves its companion files relative to its own location, so it can be run from any working directory once the whole `rollout/` folder is copied intact.

## LiteSpeed config shape

Insert regex carve-outs immediately before the protected `context /mc { ... realm moltbot_auth ... }` block:

```conf
# Public Mission Control worker API/auth-free probes.
context exp:^/mc/api/v1/agent(/.*)?$ {
  type                    proxy
  handler                 mission_control_backend
  addDefaultCharset       off
}

context exp:^/mc/(healthz|readyz|openapi\.json)$ {
  type                    proxy
  handler                 mission_control_backend
  addDefaultCharset       off
}
```

Important:

- use `exp:` regex contexts, not plain `context /mc/api`
- point these exceptions to `mission_control_backend` (frontend / Next on `3410`), not directly to FastAPI on `3411`
- keep the main `/mc` UI protected by `realm moltbot_auth`

## Live rollout commands

```bash
systemctl restart openclaw-mc-frontend.service
/usr/local/lsws/bin/lswsctrl reload
```

Recommended order:

1. ensure frontend files are durably present in repo/tree
2. `npm run build` in `frontend/`
3. `systemctl restart openclaw-mc-frontend.service`
4. edit LiteSpeed vhost with the regex carve-outs
5. `/usr/local/lsws/bin/lswsctrl reload`
6. re-test external pre-flight

## Post-rollout verification

Expected successful checks:

```bash
curl -i -H 'Authorization: Bearer ztbHKAe1UYI66HCFvSAyo4wrAAD6frNCyAZ67aKVeSE' \
  https://altaira.panomity.com/mc/healthz

curl -i -H 'Authorization: Bearer ztbHKAe1UYI66HCFvSAyo4wrAAD6frNCyAZ67aKVeSE' \
  https://altaira.panomity.com/mc/api/v1/agent/boards

curl -i https://altaira.panomity.com/mc/openapi.json
```