fix(shadcn): isolate Nexus CSS vars with --nx- prefix + admin password reset endpoint

backend/Controllers/AuthController.cs

@@ -91,6 +91,23 @@ public class AuthController(
             : Results.Ok(new UserInfo { Id = user.Id, Email = user.Email, DisplayName = user.DisplayName, Role = user.Role });
     }
 
+    [HttpPost("admin-reset-password")]
+    [EnableRateLimiting("agents")]
+    public async Task<IResult> AdminResetPassword([FromBody] AdminResetPasswordRequest request, CancellationToken ct)
+    {
+        if (string.IsNullOrWhiteSpace(request.Email) || string.IsNullOrWhiteSpace(request.NewPassword) || string.IsNullOrWhiteSpace(request.AdminToken))
+            return Results.ValidationProblem(new Dictionary<string, string[]> { ["request"] = ["Email, new password, and admin token are required."] });
+
+        if (request.NewPassword.Length < 10)
+            return Results.ValidationProblem(new Dictionary<string, string[]> { ["newPassword"] = ["New password must be at least 10 characters."] });
+
+        var success = await authService.AdminResetPasswordAsync(request.Email, request.NewPassword, request.AdminToken, ct);
+        if (!success)
+            return Results.Problem("Password reset failed. Check the admin token, email, and that the user exists.", statusCode: 400);
+
+        return Results.Ok(new { message = "Password reset successfully." });
+    }
+
     [HttpPost("change-password")]
     public async Task<IResult> ChangePassword([FromBody] ChangePasswordRequest request, CancellationToken ct)
     {

backend/Controllers/DashboardController.cs

@@ -122,7 +122,6 @@ public class DashboardController(OpenClawGatewayClient gateway, ILogger<Dashboar
             var key = string.IsNullOrWhiteSpace(sessionKey) ? "agent:iris:main" : sessionKey.Trim();
             var messages = await gateway.GetSessionHistoryAsync(key, Math.Clamp(limit, 1, 200), Math.Max(0, offset));
 
-            // Filter: only user and assistant messages (exclude tool/system)
             return messages
                 .Where(m => string.Equals(m.Role, "user", StringComparison.OrdinalIgnoreCase)
                          || string.Equals(m.Role, "assistant", StringComparison.OrdinalIgnoreCase))
@@ -152,6 +151,66 @@ public class DashboardController(OpenClawGatewayClient gateway, ILogger<Dashboar
         }
     }
 
+    /// <summary>
+    /// Returns the current model and provider for a specific agent session.
+    /// Calls session_status with the agent's session key.
+    /// </summary>
+    [HttpGet("agents/{id}/model")]
+    public async Task<ActionResult<AgentModelInfo>> GetAgentModel(string id)
+    {
+        try
+        {
+            var info = await gateway.GetAgentModelAsync(id);
+            if (info is null)
+                return NotFound(new { error = $"Agent '{id}' not found or gateway unreachable" });
+            return Ok(info);
+        }
+        catch (Exception ex)
+        {
+            logger.LogWarning(ex, "GetAgentModel failed for {AgentId}", id);
+            return StatusCode(500, new { error = "Internal error" });
+        }
+    }
+
+    /// <summary>
+    /// Sets the model for a specific agent session.
+    /// Calls session_status with model parameter.
+    /// </summary>
+    [HttpPut("agents/{id}/model")]
+    public async Task<ActionResult> SetAgentModel(string id, [FromBody] SetModelRequest request)
+    {
+        if (string.IsNullOrWhiteSpace(request.Model))
+            return BadRequest(new { error = "Model is required" });
+
+        try
+        {
+            var ok = await gateway.SetAgentModelAsync(id, request.Model);
+            if (!ok)
+                return StatusCode(502, new { error = "Gateway did not accept the change" });
+            return Ok(new { status = "ok", model = request.Model });
+        }
+        catch (Exception ex)
+        {
+            logger.LogWarning(ex, "SetAgentModel failed for {AgentId}", id);
+            return StatusCode(500, new { error = "Internal error" });
+        }
+    }
+
+    /// <summary>
+    /// Returns the list of available models that can be assigned to agents.
+    /// </summary>
+    [HttpGet("models")]
+    public ActionResult<List<ModelOption>> GetAvailableModels()
+    {
+        var models = new List<ModelOption>
+        {
+            new ModelOption("openai/gpt-5.4", "GPT-5.4", "openai"),
+            new ModelOption("deepseek/deepseek-v4-flash", "DeepSeek V4 Flash", "deepseek"),
+            new ModelOption("deepseek/deepseek-v4-pro", "DeepSeek V4 Pro", "deepseek")
+        };
+        return Ok(models);
+    }
+
     // ========== Helpers ==========
 
     private static DateTimeOffset ParseTimestamp(string timestamp)