diff --git a/app/components/chat/Chat.client.tsx b/app/components/chat/Chat.client.tsx
index c9f97369..fad3cd41 100644
--- a/app/components/chat/Chat.client.tsx
+++ b/app/components/chat/Chat.client.tsx
@@ -102,6 +102,27 @@ const STEP_EVENT_FLUSH_MS = 250;
 const TELEMETRY_OUTPUT_MAX_CHARS = 1600;
 const TELEMETRY_MERGE_WINDOW_MS = 20000;
 const LOCAL_PROVIDER_SET = new Set<string>(LOCAL_PROVIDERS);
+const MODEL_PREFLIGHT_CACHE_TTL_MS = 45_000;
+let cachedModelCatalog: { expiresAt: number; models: ModelInfo[] } | null = null;
+
+async function fetchCachedModelCatalog(): Promise<ModelInfo[]> {
+  const now = Date.now();
+
+  if (cachedModelCatalog && cachedModelCatalog.expiresAt > now) {
+    return cachedModelCatalog.models;
+  }
+
+  const response = await fetch('/api/models');
+  const data = (await response.json()) as { modelList?: ModelInfo[] };
+  const models = data.modelList || [];
+
+  cachedModelCatalog = {
+    models,
+    expiresAt: now + MODEL_PREFLIGHT_CACHE_TTL_MS,
+  };
+
+  return models;
+}
 const ANSI_ESCAPE_RE = /\u001b\[[0-?]*[ -/]*[@-~]/g;
 const CARRIAGE_RETURN_RE = /\r+/g;
 const loadSessionManager = () => import('~/lib/services/sessionManager');
@@ -673,7 +694,10 @@ export const ChatImpl = memo(
         providerSettings: getProviderSettingsFromCookiesSafe(),
         selectedProvider: provider.name,
         selectedModel: model,
-        files,
+        files:
+          hostedRuntimeEnabled && typeof workbenchStore.hostedRuntimeSessionId === 'string'
+            ? undefined
+            : files,
         hostedRuntimeSessionId: hostedRuntimeEnabled ? workbenchStore.hostedRuntimeSessionId : undefined,
         projectContextId,
         promptId,
@@ -2290,9 +2314,7 @@ Requirements:
     const resolveModelSelection = useCallback(
       async (prompt: string, currentModel: string, currentProvider: ProviderInfo) => {
         try {
-          const response = await fetch('/api/models');
-          const data = (await response.json()) as { modelList: ModelInfo[] };
-          const availableModels = data.modelList || [];
+          const availableModels = await fetchCachedModelCatalog();
           const decision = selectModelForPrompt({
             prompt,
             currentModel,
@@ -3354,6 +3376,7 @@ CONTINUE IMMEDIATELY:
         setApiKeysCookie(updatedApiKeys, CHAT_SELECTION_COOKIE_EXPIRY_DAYS);
 
         const normalizedKey = apiKey.trim();
+        cachedModelCatalog = null;
 
         if (!normalizedKey) {
           return;
diff --git a/app/components/header/Shoutbox.client.tsx b/app/components/header/Shoutbox.client.tsx
index baf0af5c..d362a066 100644
--- a/app/components/header/Shoutbox.client.tsx
+++ b/app/components/header/Shoutbox.client.tsx
@@ -38,6 +38,7 @@ export function Shoutbox() {
   const [content, setContent] = useState('');
   const [loading, setLoading] = useState(false);
   const [enabled, setEnabled] = useState(isShoutboxEnabled);
+  const [canSend, setCanSend] = useState(false);
   const [lastReadAt, setLastReadAt] = useState<string | null>(() => localStorage.getItem(SHOUTBOX_LAST_READ_AT_KEY));
   const panelRef = useRef<HTMLDivElement | null>(null);
 
@@ -67,7 +68,7 @@ export function Shoutbox() {
     const loadMessages = async () => {
       try {
         const response = await fetch('/api/shout/messages');
-        const payload = (await response.json()) as { messages?: unknown; error?: string };
+        const payload = (await response.json()) as { messages?: unknown; error?: string; canSend?: boolean };
 
         if (!response.ok) {
           throw new Error(payload.error || 'Failed to load shout-out messages.');
@@ -75,6 +76,7 @@ export function Shoutbox() {
 
         if (active) {
           setMessages(normalizeShoutMessages(payload.messages));
+          setCanSend(Boolean(payload.canSend));
         }
       } catch (error) {
         console.error('Failed to load shout-out messages:', error);
@@ -225,21 +227,30 @@ export function Shoutbox() {
           </div>
 
           <div className="mt-3 space-y-2">
-            <textarea
-              value={content}
-              onChange={(event) => setContent(event.target.value)}
-              rows={3}
-              placeholder="Send a short update to other bolt.gives users on this deployment."
-              className="w-full rounded-xl border border-bolt-elements-borderColor bg-bolt-elements-background-depth-1 px-3 py-2 text-sm text-bolt-elements-textPrimary"
-            />
-            <button
-              type="button"
-              onClick={() => void sendMessage()}
-              disabled={loading || content.trim().length === 0}
-              className="rounded-lg bg-bolt-elements-button-primary-background px-3 py-2 text-xs font-medium text-bolt-elements-button-primary-text disabled:cursor-not-allowed disabled:opacity-50"
-            >
-              {loading ? 'Sending...' : 'Send shout-out'}
-            </button>
+            {canSend ? (
+              <>
+                <textarea
+                  value={content}
+                  onChange={(event) => setContent(event.target.value)}
+                  rows={3}
+                  placeholder="Send a short update to other bolt.gives users on this deployment."
+                  className="w-full rounded-xl border border-bolt-elements-borderColor bg-bolt-elements-background-depth-1 px-3 py-2 text-sm text-bolt-elements-textPrimary"
+                />
+                <button
+                  type="button"
+                  onClick={() => void sendMessage()}
+                  disabled={loading || content.trim().length === 0}
+                  className="rounded-lg bg-bolt-elements-button-primary-background px-3 py-2 text-xs font-medium text-bolt-elements-button-primary-text disabled:cursor-not-allowed disabled:opacity-50"
+                >
+                  {loading ? 'Sending...' : 'Send shout-out'}
+                </button>
+              </>
+            ) : (
+              <div className="rounded-xl border border-dashed border-bolt-elements-borderColor p-3 text-xs text-bolt-elements-textSecondary">
+                Shout-out broadcasts are operator-managed. You can read updates here, but only signed-in tenant admins can
+                post new messages.
+              </div>
+            )}
           </div>
         </div>
       ) : null}
diff --git a/app/lib/.server/admin-auth.ts b/app/lib/.server/admin-auth.ts
new file mode 100644
index 00000000..c44ea8dc
--- /dev/null
+++ b/app/lib/.server/admin-auth.ts
@@ -0,0 +1,64 @@
+import { createCookie } from '@remix-run/cloudflare';
+import { fetchRuntimeControlJson } from '~/lib/.server/runtime-control';
+
+export type TenantAdminSession = {
+  username: string;
+  issuedAt: string;
+};
+
+type TenantAdminStatusPayload = {
+  admin?: {
+    username?: string;
+  };
+};
+
+function getTenantAdminCookieSecret() {
+  if (typeof process !== 'undefined' && process.env?.BOLT_TENANT_ADMIN_COOKIE_SECRET?.trim()) {
+    return process.env.BOLT_TENANT_ADMIN_COOKIE_SECRET.trim();
+  }
+
+  return 'bolt-tenant-admin-dev-secret-change-me';
+}
+
+function createTenantAdminSessionCookie() {
+  return createCookie('bolt_tenant_admin', {
+    httpOnly: true,
+    path: '/',
+    sameSite: 'lax',
+    secure: typeof process !== 'undefined' ? process.env.NODE_ENV === 'production' : true,
+    maxAge: 60 * 60 * 12,
+    secrets: [getTenantAdminCookieSecret()],
+  });
+}
+
+export async function readTenantAdminSession(request: Request): Promise<TenantAdminSession | null> {
+  try {
+    const cookie = createTenantAdminSessionCookie();
+    const parsed = (await cookie.parse(request.headers.get('Cookie'))) as TenantAdminSession | undefined;
+
+    if (!parsed?.username) {
+      return null;
+    }
+
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+export async function isTenantAdminAuthorized(request: Request): Promise<boolean> {
+  const session = await readTenantAdminSession(request);
+
+  if (!session?.username) {
+    return false;
+  }
+
+  try {
+    const status = await fetchRuntimeControlJson<TenantAdminStatusPayload>('/tenant-admin/status');
+    const adminUsername = status.admin?.username;
+
+    return Boolean(adminUsername && adminUsername === session.username);
+  } catch {
+    return false;
+  }
+}
diff --git a/app/lib/api/cookies.spec.ts b/app/lib/api/cookies.spec.ts
new file mode 100644
index 00000000..c6bcd757
--- /dev/null
+++ b/app/lib/api/cookies.spec.ts
@@ -0,0 +1,22 @@
+import { describe, expect, it } from 'vitest';
+import { getApiKeysFromCookie, getProviderSettingsFromCookie, parseCookies } from './cookies';
+
+describe('cookie parsing helpers', () => {
+  it('skips malformed encoded cookie pairs without throwing', () => {
+    expect(() => parseCookies('ok=value; bad=%E0%A4%A; another=1')).not.toThrow();
+    expect(parseCookies('ok=value; bad=%E0%A4%A; another=1')).toEqual({
+      ok: 'value',
+      another: '1',
+    });
+  });
+
+  it('returns empty provider settings for invalid JSON cookie values', () => {
+    expect(getProviderSettingsFromCookie('providers=%7Binvalid-json')).toEqual({});
+  });
+
+  it('returns sanitized api key map from cookie payload', () => {
+    const cookie = `apiKeys=${encodeURIComponent(JSON.stringify({ OpenAI: ' sk-test ', Empty: ' ' }))}`;
+
+    expect(getApiKeysFromCookie(cookie)).toEqual({ OpenAI: 'sk-test' });
+  });
+});
diff --git a/app/lib/api/cookies.ts b/app/lib/api/cookies.ts
index 4f21ec77..d37a88c6 100644
--- a/app/lib/api/cookies.ts
+++ b/app/lib/api/cookies.ts
@@ -1,5 +1,13 @@
 import { normalizeCredential } from '~/lib/runtime/credentials';
 
+function safeDecodeURIComponent(value: string): string | null {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return null;
+  }
+}
+
 export function parseCookies(cookieHeader: string | null) {
   const cookies: Record<string, string> = {};
 
@@ -7,18 +15,23 @@ export function parseCookies(cookieHeader: string | null) {
     return cookies;
   }
 
-  // Split the cookie string by semicolons and spaces
   const items = cookieHeader.split(';').map((cookie) => cookie.trim());
 
   items.forEach((item) => {
     const [name, ...rest] = item.split('=');
 
-    if (name && rest.length > 0) {
-      // Decode the name and value, and join value parts in case it contains '='
-      const decodedName = decodeURIComponent(name.trim());
-      const decodedValue = decodeURIComponent(rest.join('=').trim());
-      cookies[decodedName] = decodedValue;
+    if (!name || rest.length === 0) {
+      return;
     }
+
+    const decodedName = safeDecodeURIComponent(name.trim());
+    const decodedValue = safeDecodeURIComponent(rest.join('=').trim());
+
+    if (!decodedName || decodedValue === null) {
+      return;
+    }
+
+    cookies[decodedName] = decodedValue;
   });
 
   return cookies;
@@ -53,5 +66,15 @@ export function getApiKeysFromCookie(cookieHeader: string | null): Record<string
 
 export function getProviderSettingsFromCookie(cookieHeader: string | null): Record<string, any> {
   const cookies = parseCookies(cookieHeader);
-  return cookies.providers ? JSON.parse(cookies.providers) : {};
+
+  if (!cookies.providers) {
+    return {};
+  }
+
+  try {
+    const parsed = JSON.parse(cookies.providers) as Record<string, any>;
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
 }
diff --git a/app/lib/runtime/action-runner.spec.ts b/app/lib/runtime/action-runner.spec.ts
index 34a4e308..c8345bb8 100644
--- a/app/lib/runtime/action-runner.spec.ts
+++ b/app/lib/runtime/action-runner.spec.ts
@@ -497,6 +497,45 @@ describe('ActionRunner start actions', () => {
     expect(runner.actions.get()['file-outside-workdir-traversal-1']?.status).toBe('failed');
   });
 
+  it('marks file actions as failed when workspace writes throw errors', async () => {
+    const writeFile = vi.fn().mockRejectedValue(new Error('disk full'));
+    const runner = new ActionRunner(
+      Promise.resolve({
+        workdir: '/home/project',
+        fs: {
+          readFile: vi.fn().mockResolvedValue('{}'),
+          readdir: vi.fn().mockResolvedValue([]),
+          mkdir: vi.fn().mockResolvedValue(undefined),
+          writeFile,
+        },
+      }) as any,
+      () =>
+        ({
+          ready: vi.fn().mockResolvedValue(undefined),
+          terminal: {},
+          process: {},
+          executeCommand: vi.fn().mockResolvedValue({ exitCode: 0, output: 'ok' }),
+        }) as any,
+    );
+
+    const actionData: ActionCallbackData = {
+      artifactId: 'artifact-1',
+      messageId: 'message-1',
+      actionId: 'file-write-error-1',
+      action: {
+        type: 'file',
+        filePath: '/home/project/src/App.jsx',
+        content: 'export default function App() { return null; }',
+      } as any,
+    };
+
+    runner.addAction(actionData);
+    await expect(runner.runAction(actionData)).rejects.toBeInstanceOf(Error);
+
+    expect(writeFile).toHaveBeenCalled();
+    expect(runner.actions.get()['file-write-error-1']?.status).toBe('failed');
+  });
+
   it('writes file actions using canonical workdir-relative paths', async () => {
     const executeCommand = vi.fn().mockResolvedValue({ exitCode: 0, output: 'ok' });
     const writeFile = vi.fn().mockResolvedValue(undefined);
diff --git a/app/lib/runtime/action-runner.ts b/app/lib/runtime/action-runner.ts
index 4fc1f85e..17d94495 100644
--- a/app/lib/runtime/action-runner.ts
+++ b/app/lib/runtime/action-runner.ts
@@ -44,6 +44,7 @@ const HEAVY_COMMAND_RE = /\b(?:pnpm|npm|yarn|bun)\s+(?:install|i|run\s+build|bui
 const LOW_PRIORITY_ASSET_FILE_RE =
   /\.(?:png|jpe?g|gif|webp|ico|svg|mp4|mp3|wav|ogg|pdf|zip|gz|tar|woff2?|ttf|otf|eot|wasm)$/i;
 const MAX_CAPTURED_OUTPUT_CHARS = 120_000;
+const STEP_EVENT_SOCKET_CLOSE_IDLE_MS = 4000;
 
 function capCapturedOutput(output: string): string {
   if (output.length <= MAX_CAPTURED_OUTPUT_CHARS) {
@@ -193,6 +194,10 @@ export class ActionRunner {
   #lastHostedRuntimePreview?: HostedRuntimePreviewInfo;
   #hostedRuntimePreviewRevision = 0;
   #stepEventSocket?: WebSocket;
+  #stepSocketConsumers = 0;
+  #stepSocketCloseTimer: ReturnType<typeof setTimeout> | null = null;
+  #disposeRequested = false;
+  #disposed = false;
   runnerId = atom<string>(`${Date.now()}`);
   actions: ActionsMap = map({});
   onAlert?: (alert: ActionAlert) => void;
@@ -225,6 +230,58 @@ export class ActionRunner {
     this.onStepRunnerEvent = onStepRunnerEvent;
   }
 
+  disposeWhenIdle() {
+    this.#disposeRequested = true;
+    this.#maybeDispose();
+  }
+
+  dispose() {
+    if (this.#disposed) {
+      return;
+    }
+
+    this.#disposed = true;
+    this.#disposeRequested = true;
+
+    if (this.#hostedRuntimeFlushTimer) {
+      clearTimeout(this.#hostedRuntimeFlushTimer);
+      this.#hostedRuntimeFlushTimer = null;
+    }
+
+    if (this.#stepSocketCloseTimer) {
+      clearTimeout(this.#stepSocketCloseTimer);
+      this.#stepSocketCloseTimer = null;
+    }
+
+    if (this.#stepEventSocket) {
+      try {
+        this.#stepEventSocket.close();
+      } catch {
+        // Ignore close errors for best-effort teardown.
+      }
+
+      this.#stepEventSocket = undefined;
+    }
+
+    this.#stepSocketConsumers = 0;
+  }
+
+  #maybeDispose() {
+    if (!this.#disposeRequested || this.#disposed) {
+      return;
+    }
+
+    const hasActiveActions = Object.values(this.actions.get()).some(
+      (action) => action.status === 'running' || action.status === 'pending',
+    );
+
+    if (hasActiveActions || this.#stepSocketConsumers > 0) {
+      return;
+    }
+
+    this.dispose();
+  }
+
   #getHostedRuntimeSessionId() {
     return this.#hostedRuntimeSessionId || this.runnerId.get();
   }
@@ -454,63 +511,68 @@ export class ActionRunner {
     let finalOutput = '';
     let finalExitCode = 0;
     let stepError: string | undefined;
-    const stepSocket = this.#getStepEventSocket();
-    const stepRunner = new InteractiveStepRunner(
-      {
-        executeStep: async (_step: InteractiveStep, context) => {
-          const resp = await runHostedRuntimeCommand({
-            sessionId: this.#getHostedRuntimeSessionId(),
-            command: action.content,
-            kind,
-            onEvent: (event) => {
-              if (event.type === 'stdout') {
-                const normalized = normalizeShellChunkForTimeline(event.chunk);
-
-                if (normalized.trim()) {
-                  context.onStdout(normalized);
-                }
-              } else if (event.type === 'stderr') {
-                const normalized = normalizeShellChunkForTimeline(event.chunk);
+    const stepSocketLease = this.#acquireStepEventSocket();
 
-                if (normalized.trim()) {
-                  context.onStderr(normalized);
+    try {
+      const stepRunner = new InteractiveStepRunner(
+        {
+          executeStep: async (_step: InteractiveStep, context) => {
+            const resp = await runHostedRuntimeCommand({
+              sessionId: this.#getHostedRuntimeSessionId(),
+              command: action.content,
+              kind,
+              onEvent: (event) => {
+                if (event.type === 'stdout') {
+                  const normalized = normalizeShellChunkForTimeline(event.chunk);
+
+                  if (normalized.trim()) {
+                    context.onStdout(normalized);
+                  }
+                } else if (event.type === 'stderr') {
+                  const normalized = normalizeShellChunkForTimeline(event.chunk);
+
+                  if (normalized.trim()) {
+                    context.onStderr(normalized);
+                  }
+                } else if (event.type === 'status') {
+                  context.onStdout(`${event.message}\n`);
+                } else if (event.type === 'ready') {
+                  this.#setHostedPreview(event.preview);
                 }
-              } else if (event.type === 'status') {
-                context.onStdout(`${event.message}\n`);
-              } else if (event.type === 'ready') {
-                this.#setHostedPreview(event.preview);
-              }
-            },
-          });
+              },
+            });
 
-          finalOutput = capCapturedOutput(resp.output);
-          finalExitCode = resp.exitCode;
+            finalOutput = capCapturedOutput(resp.output);
+            finalExitCode = resp.exitCode;
 
-          return {
-            exitCode: resp.exitCode,
-            stdout: capCapturedOutput(resp.output),
-            stderr: resp.exitCode === 0 ? '' : capCapturedOutput(resp.output),
-          };
+            return {
+              exitCode: resp.exitCode,
+              stdout: capCapturedOutput(resp.output),
+              stderr: resp.exitCode === 0 ? '' : capCapturedOutput(resp.output),
+            };
+          },
         },
-      },
-      stepSocket,
-    );
+        stepSocketLease.socket,
+      );
 
-    stepRunner.addEventListener('event', (event) => {
-      const detail = (event as CustomEvent<InteractiveStepRunnerEvent>).detail;
-      this.onStepRunnerEvent?.(detail);
+      stepRunner.addEventListener('event', (event) => {
+        const detail = (event as CustomEvent<InteractiveStepRunnerEvent>).detail;
+        this.onStepRunnerEvent?.(detail);
 
-      if (detail.type === 'error') {
-        stepError = detail.error || 'Step execution failed';
-      }
-    });
+        if (detail.type === 'error') {
+          stepError = detail.error || 'Step execution failed';
+        }
+      });
 
-    await stepRunner.run([
-      {
-        description,
-        command: [action.content],
-      },
-    ]);
+      await stepRunner.run([
+        {
+          description,
+          command: [action.content],
+        },
+      ]);
+    } finally {
+      stepSocketLease.release();
+    }
 
     if (stepError || finalExitCode !== 0) {
       const enhancedError = this.#createEnhancedShellError(action.content, finalExitCode, finalOutput);
@@ -746,74 +808,79 @@ export class ActionRunner {
     const streamState = { lastProgressEmitAt: 0 };
     const previewAlertMonitor = this.#createPreviewAlertMonitor(action.content, 'shell');
 
-    const stepSocket = this.#getStepEventSocket();
-    const stepRunner = new InteractiveStepRunner(
-      {
-        executeStep: async (_step: InteractiveStep, context) => {
-          const resp = await shell.executeCommand(
-            this.runnerId.get(),
-            action.content,
-            () => {
-              logger.debug(`[${action.type}]:Aborting Action\n\n`, action);
-              action.abort();
-            },
-            (chunk) => {
-              const normalized = normalizeShellChunkForTimeline(chunk);
-
-              if (!normalized.trim()) {
-                return;
-              }
-
-              previewAlertMonitor.observeChunk(normalized);
-
-              if (heavyCommand && NOISY_PACKAGE_PROGRESS_RE.test(normalized)) {
-                const now = Date.now();
+    const stepSocketLease = this.#acquireStepEventSocket();
 
-                if (now - streamState.lastProgressEmitAt < 2500) {
+    try {
+      const stepRunner = new InteractiveStepRunner(
+        {
+          executeStep: async (_step: InteractiveStep, context) => {
+            const resp = await shell.executeCommand(
+              this.runnerId.get(),
+              action.content,
+              () => {
+                logger.debug(`[${action.type}]:Aborting Action\n\n`, action);
+                action.abort();
+              },
+              (chunk) => {
+                const normalized = normalizeShellChunkForTimeline(chunk);
+
+                if (!normalized.trim()) {
                   return;
                 }
 
-                streamState.lastProgressEmitAt = now;
-                context.onStdout('[install progress]');
+                previewAlertMonitor.observeChunk(normalized);
 
-                return;
-              }
+                if (heavyCommand && NOISY_PACKAGE_PROGRESS_RE.test(normalized)) {
+                  const now = Date.now();
 
-              context.onStdout(normalized);
-            },
-          );
-          const output = capCapturedOutput(resp?.output || '');
-          const exitCode = resp?.exitCode ?? 1;
+                  if (now - streamState.lastProgressEmitAt < 2500) {
+                    return;
+                  }
 
-          finalOutput = output;
-          finalExitCode = exitCode;
-          previewAlertMonitor.observeFinalOutput(output);
+                  streamState.lastProgressEmitAt = now;
+                  context.onStdout('[install progress]');
 
-          return {
-            exitCode,
-            stdout: output,
-            stderr: exitCode === 0 ? '' : output,
-          };
+                  return;
+                }
+
+                context.onStdout(normalized);
+              },
+            );
+            const output = capCapturedOutput(resp?.output || '');
+            const exitCode = resp?.exitCode ?? 1;
+
+            finalOutput = output;
+            finalExitCode = exitCode;
+            previewAlertMonitor.observeFinalOutput(output);
+
+            return {
+              exitCode,
+              stdout: output,
+              stderr: exitCode === 0 ? '' : output,
+            };
+          },
         },
-      },
-      stepSocket,
-    );
+        stepSocketLease.socket,
+      );
 
-    stepRunner.addEventListener('event', (event) => {
-      const detail = (event as CustomEvent<InteractiveStepRunnerEvent>).detail;
-      this.onStepRunnerEvent?.(detail);
+      stepRunner.addEventListener('event', (event) => {
+        const detail = (event as CustomEvent<InteractiveStepRunnerEvent>).detail;
+        this.onStepRunnerEvent?.(detail);
 
-      if (detail.type === 'error') {
-        stepError = detail.error || 'Step execution failed';
-      }
-    });
+        if (detail.type === 'error') {
+          stepError = detail.error || 'Step execution failed';
+        }
+      });
 
-    await stepRunner.run([
-      {
-        description: `Run shell command: ${action.content}`,
-        command: [action.content],
-      },
-    ]);
+      await stepRunner.run([
+        {
+          description: `Run shell command: ${action.content}`,
+          command: [action.content],
+        },
+      ]);
+    } finally {
+      stepSocketLease.release();
+    }
 
     logger.debug(`${action.type} Shell Response: [exit code:${finalExitCode}]`);
 
@@ -885,60 +952,65 @@ export class ActionRunner {
     let finalExitCode = 0;
     let stepError: string | undefined;
     const previewAlertMonitor = this.#createPreviewAlertMonitor(action.content, 'start');
-    const stepSocket = this.#getStepEventSocket();
-    const stepRunner = new InteractiveStepRunner(
-      {
-        executeStep: async (_step: InteractiveStep, context) => {
-          const resp = await shell.executeCommand(
-            this.runnerId.get(),
-            action.content,
-            () => {
-              logger.debug(`[${action.type}]:Aborting Action\n\n`, action);
-              action.abort();
-            },
-            (chunk) => {
-              const normalized = normalizeShellChunkForTimeline(chunk);
-
-              if (!normalized.trim()) {
-                return;
-              }
+    const stepSocketLease = this.#acquireStepEventSocket();
 
-              previewAlertMonitor.observeChunk(normalized);
-              context.onStdout(normalized);
-            },
-          );
-          const output = capCapturedOutput(resp?.output || '');
-          const exitCode = resp?.exitCode ?? 1;
+    try {
+      const stepRunner = new InteractiveStepRunner(
+        {
+          executeStep: async (_step: InteractiveStep, context) => {
+            const resp = await shell.executeCommand(
+              this.runnerId.get(),
+              action.content,
+              () => {
+                logger.debug(`[${action.type}]:Aborting Action\n\n`, action);
+                action.abort();
+              },
+              (chunk) => {
+                const normalized = normalizeShellChunkForTimeline(chunk);
+
+                if (!normalized.trim()) {
+                  return;
+                }
 
-          finalOutput = output;
-          finalExitCode = exitCode;
-          previewAlertMonitor.observeFinalOutput(output);
+                previewAlertMonitor.observeChunk(normalized);
+                context.onStdout(normalized);
+              },
+            );
+            const output = capCapturedOutput(resp?.output || '');
+            const exitCode = resp?.exitCode ?? 1;
 
-          return {
-            exitCode,
-            stdout: output,
-            stderr: exitCode === 0 ? '' : output,
-          };
+            finalOutput = output;
+            finalExitCode = exitCode;
+            previewAlertMonitor.observeFinalOutput(output);
+
+            return {
+              exitCode,
+              stdout: output,
+              stderr: exitCode === 0 ? '' : output,
+            };
+          },
         },
-      },
-      stepSocket,
-    );
+        stepSocketLease.socket,
+      );
 
-    stepRunner.addEventListener('event', (event) => {
-      const detail = (event as CustomEvent<InteractiveStepRunnerEvent>).detail;
-      this.onStepRunnerEvent?.(detail);
+      stepRunner.addEventListener('event', (event) => {
+        const detail = (event as CustomEvent<InteractiveStepRunnerEvent>).detail;
+        this.onStepRunnerEvent?.(detail);
 
-      if (detail.type === 'error') {
-        stepError = detail.error || 'Step execution failed';
-      }
-    });
+        if (detail.type === 'error') {
+          stepError = detail.error || 'Step execution failed';
+        }
+      });
 
-    await stepRunner.run([
-      {
-        description: `Start application: ${action.content}`,
-        command: [action.content],
-      },
-    ]);
+      await stepRunner.run([
+        {
+          description: `Start application: ${action.content}`,
+          command: [action.content],
+        },
+      ]);
+    } finally {
+      stepSocketLease.release();
+    }
 
     logger.debug(`${action.type} Shell Response: [exit code:${finalExitCode}]`);
 
@@ -948,8 +1020,48 @@ export class ActionRunner {
     }
   }
 
+  #closeStepEventSocket() {
+    if (this.#stepSocketCloseTimer) {
+      clearTimeout(this.#stepSocketCloseTimer);
+      this.#stepSocketCloseTimer = null;
+    }
+
+    if (!this.#stepEventSocket) {
+      return;
+    }
+
+    try {
+      this.#stepEventSocket.close();
+    } catch {
+      // Ignore close errors for best-effort teardown.
+    }
+
+    this.#stepEventSocket = undefined;
+  }
+
+  #scheduleStepEventSocketClose() {
+    if (this.#disposed || this.#stepSocketConsumers > 0) {
+      return;
+    }
+
+    if (this.#stepSocketCloseTimer) {
+      clearTimeout(this.#stepSocketCloseTimer);
+    }
+
+    this.#stepSocketCloseTimer = setTimeout(() => {
+      this.#stepSocketCloseTimer = null;
+
+      if (this.#stepSocketConsumers > 0) {
+        return;
+      }
+
+      this.#closeStepEventSocket();
+      this.#maybeDispose();
+    }, STEP_EVENT_SOCKET_CLOSE_IDLE_MS);
+  }
+
   #getStepEventSocket() {
-    if (typeof window === 'undefined') {
+    if (this.#disposed || typeof window === 'undefined') {
       return undefined;
     }
 
@@ -985,6 +1097,25 @@ export class ActionRunner {
     }
   }
 
+  #acquireStepEventSocket() {
+    const socket = this.#getStepEventSocket();
+
+    if (this.#stepSocketCloseTimer) {
+      clearTimeout(this.#stepSocketCloseTimer);
+      this.#stepSocketCloseTimer = null;
+    }
+
+    this.#stepSocketConsumers += 1;
+
+    const release = () => {
+      this.#stepSocketConsumers = Math.max(0, this.#stepSocketConsumers - 1);
+      this.#scheduleStepEventSocketClose();
+      this.#maybeDispose();
+    };
+
+    return { socket, release };
+  }
+
   async #runZombieKiller(kind: 'shell' | 'start') {
     try {
       if (isHostedRuntimeEnabled()) {
@@ -1102,6 +1233,7 @@ export class ActionRunner {
       }
     } catch (error) {
       logger.error('Failed to write file\n\n', error);
+      throw error;
     }
   }
 
@@ -1109,6 +1241,7 @@ export class ActionRunner {
     const actions = this.actions.get();
 
     this.actions.setKey(id, { ...actions[id], ...newState });
+    this.#maybeDispose();
   }
 
   async getFileHistory(filePath: string): Promise<FileHistory | null> {
diff --git a/app/lib/security.ts b/app/lib/security.ts
index 18d7d12f..ec04f558 100644
--- a/app/lib/security.ts
+++ b/app/lib/security.ts
@@ -440,6 +440,14 @@ const HOSTED_FREE_RELAY_HEADER = 'x-bolt-hosted-free-relay';
 const HOSTED_FREE_RELAY_SECRET_HEADER = 'x-bolt-hosted-free-relay-secret';
 const HOSTED_FREE_RELAY_CSRF_EXEMPT_PATHS = new Set(['/api/chat', '/api/llmcall']);
 
+function safeDecodeURIComponent(value: string): string | null {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return null;
+  }
+}
+
 function parseCookies(header: string | null): Record<string, string> {
   if (!header) {
     return {};
@@ -462,7 +470,13 @@ function parseCookies(header: string | null): Record<string, string> {
 
     const name = trimmed.slice(0, eq).trim();
     const value = trimmed.slice(eq + 1).trim();
-    out[name] = decodeURIComponent(value);
+    const decodedValue = safeDecodeURIComponent(value);
+
+    if (decodedValue === null) {
+      continue;
+    }
+
+    out[name] = decodedValue;
   }
 
   return out;
diff --git a/app/lib/services/pluginManager.spec.ts b/app/lib/services/pluginManager.spec.ts
index c2454df2..7e93e868 100644
--- a/app/lib/services/pluginManager.spec.ts
+++ b/app/lib/services/pluginManager.spec.ts
@@ -1,9 +1,5 @@
-import { mkdtemp, rm, writeFile } from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { pathToFileURL } from 'node:url';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { PluginManager } from './pluginManager';
+import { PluginManager, normalizeTrustedPluginEntry } from './pluginManager';
 
 interface StorageLike {
   getItem: (key: string) => string | null;
@@ -33,7 +29,6 @@ function createLocalStorageMock(): StorageLike {
 
 describe('PluginManager', () => {
   const originalFetch = globalThis.fetch;
-  let tempDir: string | undefined;
 
   beforeEach(() => {
     Object.defineProperty(globalThis, 'window', {
@@ -41,27 +36,25 @@ describe('PluginManager', () => {
       writable: true,
       value: {
         localStorage: createLocalStorageMock(),
+        location: {
+          origin: 'https://alpha1.bolt.gives',
+        },
       },
     });
   });
 
-  afterEach(async () => {
+  afterEach(() => {
     vi.restoreAllMocks();
     delete (globalThis as any).window;
     globalThis.fetch = originalFetch;
-
-    if (tempDir) {
-      await rm(tempDir, { recursive: true, force: true });
-      tempDir = undefined;
-    }
   });
 
-  it('installs, lists, and uninstalls plugins', () => {
+  it('installs, lists, and uninstalls plugins from trusted HTTPS origins', () => {
     const installed = PluginManager.install({
       name: 'sample-plugin',
       version: '1.0.0',
       description: 'sample',
-      entry: 'https://example.com/plugin.mjs',
+      entry: 'https://raw.githubusercontent.com/embire2/bolt.gives-plugins/main/plugin.mjs',
     });
 
     expect(installed).toHaveLength(1);
@@ -71,37 +64,32 @@ describe('PluginManager', () => {
     expect(afterUninstall).toHaveLength(0);
   });
 
-  it('validates manifests and rejects invalid plugin payloads', () => {
+  it('rejects non-HTTPS plugin entries', () => {
     expect(() =>
       PluginManager.install({
-        name: 'invalid',
-        version: '',
+        name: 'insecure-plugin',
+        version: '1.0.0',
         description: 'bad',
-        entry: 'https://example.com/plugin.mjs',
+        entry: 'http://raw.githubusercontent.com/embire2/bolt.gives-plugins/main/plugin.mjs',
       }),
-    ).toThrow();
+    ).toThrow('Plugin entry must use HTTPS.');
   });
 
-  it('loads installed plugins at runtime', async () => {
-    tempDir = await mkdtemp(path.join(os.tmpdir(), 'bolt-plugin-'));
+  it('rejects HTTPS plugin entries from non-allowlisted origins', () => {
+    expect(() =>
+      PluginManager.install({
+        name: 'unknown-origin-plugin',
+        version: '1.0.0',
+        description: 'bad',
+        entry: 'https://example.com/plugin.mjs',
+      }),
+    ).toThrow('Plugin entry origin is not allowlisted');
+  });
 
-    const entryPath = path.join(tempDir, 'plugin.mjs');
-    await writeFile(
-      entryPath,
-      'globalThis.__boltPluginLoaded = (globalThis.__boltPluginLoaded || 0) + 1; export default {};',
-      'utf8',
+  it('normalizes trusted plugin entry URLs', () => {
+    expect(normalizeTrustedPluginEntry('https://RAW.GITHUBUSERCONTENT.COM/embire2/bolt.gives-plugins/main/plugin.mjs')).toBe(
+      'https://raw.githubusercontent.com/embire2/bolt.gives-plugins/main/plugin.mjs',
     );
-
-    PluginManager.install({
-      name: 'runtime-plugin',
-      version: '1.0.0',
-      description: 'runtime',
-      entry: pathToFileURL(entryPath).href,
-    });
-
-    await PluginManager.loadInstalledPlugins();
-
-    expect((globalThis as any).__boltPluginLoaded).toBe(1);
   });
 
   it('rejects malformed marketplace registries', async () => {
@@ -110,8 +98,14 @@ describe('PluginManager', () => {
       json: async () => ({ plugins: [{ name: 'missing-fields' }] }),
     }) as any;
 
-    await expect(PluginManager.fetchMarketplace('https://example.com/registry.json')).rejects.toThrow(
+    await expect(PluginManager.fetchMarketplace('https://raw.githubusercontent.com/embire2/bolt.gives-plugins/main/registry.json')).rejects.toThrow(
       'Plugin marketplace manifest is invalid.',
     );
   });
+
+  it('rejects marketplace indexes from non-allowlisted origins', async () => {
+    await expect(PluginManager.fetchMarketplace('https://example.com/registry.json')).rejects.toThrow(
+      'Plugin entry origin is not allowlisted',
+    );
+  });
 });
diff --git a/app/lib/services/pluginManager.ts b/app/lib/services/pluginManager.ts
index 2d9c6115..f4924ba6 100644
--- a/app/lib/services/pluginManager.ts
+++ b/app/lib/services/pluginManager.ts
@@ -9,6 +9,14 @@ export interface PluginManifest {
 
 const STORAGE_KEY = 'bolt_installed_plugins';
 const DEFAULT_MARKETPLACE_INDEX = 'https://raw.githubusercontent.com/embire2/bolt.gives-plugins/main/registry.json';
+const DEFAULT_ALLOWED_PLUGIN_ORIGINS = [
+  'https://raw.githubusercontent.com',
+  'https://cdn.jsdelivr.net',
+  'https://esm.sh',
+  'https://unpkg.com',
+];
+const ALLOWED_PLUGIN_ORIGINS_ENV_KEY = 'VITE_PLUGIN_ALLOWED_ORIGINS';
+
 const pluginManifestSchema = z.object({
   name: z.string().min(1),
   version: z.string().min(1),
@@ -23,8 +31,66 @@ const pluginRegistrySchema = z.union([
   }),
 ]);
 
+function normalizeOrigin(rawOrigin: string): string | null {
+  try {
+    const normalized = new URL(rawOrigin).origin;
+    return normalized.toLowerCase();
+  } catch {
+    return null;
+  }
+}
+
+function getAllowedPluginOrigins() {
+  const configuredOrigins = String((import.meta as ImportMeta & { env?: Record<string, string | undefined> }).env?.[
+    ALLOWED_PLUGIN_ORIGINS_ENV_KEY
+  ] || '')
+    .split(',')
+    .map((value) => normalizeOrigin(value.trim()))
+    .filter((value): value is string => Boolean(value));
+
+  const origins = new Set<string>([...DEFAULT_ALLOWED_PLUGIN_ORIGINS.map((origin) => origin.toLowerCase()), ...configuredOrigins]);
+
+  if (typeof window !== 'undefined') {
+    const windowOrigin = normalizeOrigin(window.location.origin);
+
+    if (windowOrigin) {
+      origins.add(windowOrigin);
+    }
+  }
+
+  return origins;
+}
+
+export function normalizeTrustedPluginEntry(entry: string): string {
+  let parsedUrl: URL;
+
+  try {
+    parsedUrl = new URL(entry);
+  } catch {
+    throw new Error(`Invalid plugin entry URL: ${entry}`);
+  }
+
+  if (parsedUrl.protocol !== 'https:') {
+    throw new Error('Plugin entry must use HTTPS.');
+  }
+
+  const allowedOrigins = getAllowedPluginOrigins();
+  const origin = parsedUrl.origin.toLowerCase();
+
+  if (!allowedOrigins.has(origin)) {
+    throw new Error(`Plugin entry origin is not allowlisted: ${origin}`);
+  }
+
+  return parsedUrl.toString();
+}
+
 function parsePluginManifest(input: unknown): PluginManifest {
-  return pluginManifestSchema.parse(input);
+  const parsed = pluginManifestSchema.parse(input);
+
+  return {
+    ...parsed,
+    entry: normalizeTrustedPluginEntry(parsed.entry),
+  };
 }
 
 function readInstalled(): PluginManifest[] {
@@ -42,7 +108,11 @@ function readInstalled(): PluginManifest[] {
     const parsed = JSON.parse(raw) as unknown;
     const result = pluginManifestListSchema.safeParse(parsed);
 
-    return result.success ? result.data : [];
+    if (!result.success) {
+      return [];
+    }
+
+    return result.data.map((plugin) => parsePluginManifest(plugin));
   } catch {
     return [];
   }
@@ -92,8 +162,10 @@ export class PluginManager {
 
     await Promise.allSettled(
       installed.map(async (plugin) => {
+        const trustedEntry = normalizeTrustedPluginEntry(plugin.entry);
+
         try {
-          await import(/* @vite-ignore */ plugin.entry);
+          await import(/* @vite-ignore */ trustedEntry);
         } catch {
           // Plugin loading is best-effort and isolated from app startup.
         }
@@ -102,7 +174,8 @@ export class PluginManager {
   }
 
   static async fetchMarketplace(indexUrl = DEFAULT_MARKETPLACE_INDEX) {
-    const response = await fetch(indexUrl);
+    const trustedIndex = normalizeTrustedPluginEntry(indexUrl);
+    const response = await fetch(trustedIndex);
 
     if (!response.ok) {
       throw new Error(`Failed to fetch plugin marketplace: ${response.status}`);
@@ -115,6 +188,7 @@ export class PluginManager {
       throw new Error('Plugin marketplace manifest is invalid.');
     }
 
-    return Array.isArray(parsed.data) ? parsed.data : parsed.data.plugins;
+    const plugins = Array.isArray(parsed.data) ? parsed.data : parsed.data.plugins;
+    return plugins.map((plugin) => parsePluginManifest(plugin));
   }
 }
diff --git a/app/lib/stores/workbench.ts b/app/lib/stores/workbench.ts
index da0ef77d..aa8bab54 100644
--- a/app/lib/stores/workbench.ts
+++ b/app/lib/stores/workbench.ts
@@ -1283,7 +1283,12 @@ export class WorkbenchStore {
       return;
     }
 
-    this.artifacts.setKey(artifactId, { ...artifact, ...state });
+    const nextArtifact = { ...artifact, ...state };
+    this.artifacts.setKey(artifactId, nextArtifact);
+
+    if (nextArtifact.closed) {
+      artifact.runner.disposeWhenIdle();
+    }
   }
 
   #primeRuntimeBootstrapFile(file: RuntimeBootstrapFile) {
diff --git a/app/routes/api.chat.ts b/app/routes/api.chat.ts
index 11c24235..962b1313 100644
--- a/app/routes/api.chat.ts
+++ b/app/routes/api.chat.ts
@@ -63,6 +63,7 @@ import {
 import { applyHostedRuntimeAssistantActions } from '~/lib/.server/hosted-runtime-handoff';
 import { extractLatestUserGoal, findLatestUserMessage } from '~/lib/runtime/user-goal';
 import { normalizeArtifactFilePath } from '~/lib/runtime/file-paths';
+import { parseCookies } from '~/lib/api/cookies';
 
 export async function action(args: ActionFunctionArgs) {
   return chatAction(args);
@@ -524,24 +525,6 @@ function extractPreviewPort(previewBaseUrl: string | null | undefined): number |
   }
 }
 
-function parseCookies(cookieHeader: string): Record<string, string> {
-  const cookies: Record<string, string> = {};
-
-  const items = cookieHeader.split(';').map((cookie) => cookie.trim());
-
-  items.forEach((item) => {
-    const [name, ...rest] = item.split('=');
-
-    if (name && rest) {
-      const decodedName = decodeURIComponent(name.trim());
-      const decodedValue = decodeURIComponent(rest.join('=').trim());
-      cookies[decodedName] = decodedValue;
-    }
-  });
-
-  return cookies;
-}
-
 function parseJsonObject<T extends Record<string, any>>(raw: string | undefined, fallback: T): T {
   if (!raw) {
     return fallback;
diff --git a/app/routes/api.managed-instances..refresh.ts b/app/routes/api.managed-instances..refresh.ts
new file mode 100644
index 00000000..ad94f4d5
--- /dev/null
+++ b/app/routes/api.managed-instances..refresh.ts
@@ -0,0 +1,31 @@
+import { json, type ActionFunctionArgs } from '@remix-run/cloudflare';
+import { fetchRuntimeControlJson } from '~/lib/.server/runtime-control';
+import type { ManagedInstanceRecord } from '~/lib/managed-instances';
+import { isTenantAdminAuthorized } from '~/lib/.server/admin-auth';
+
+export async function action({ request, params }: ActionFunctionArgs) {
+  if (!(await isTenantAdminAuthorized(request))) {
+    return json({ error: 'Forbidden' }, { status: 403 });
+  }
+
+  const slug = String(params.slug || '').trim();
+  const body = await request.json().catch(() => ({}));
+
+  try {
+    const payload = await fetchRuntimeControlJson<{ ok: boolean; instance: ManagedInstanceRecord }>(
+      `/managed-instances/${encodeURIComponent(slug)}/refresh`,
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+      },
+    );
+
+    return json(payload);
+  } catch (error) {
+    return json(
+      { error: error instanceof Error ? error.message : 'Managed instance refresh failed.' },
+      { status: 400 },
+    );
+  }
+}
diff --git a/app/routes/api.managed-instances..suspend.ts b/app/routes/api.managed-instances..suspend.ts
new file mode 100644
index 00000000..fecbc11a
--- /dev/null
+++ b/app/routes/api.managed-instances..suspend.ts
@@ -0,0 +1,31 @@
+import { json, type ActionFunctionArgs } from '@remix-run/cloudflare';
+import { fetchRuntimeControlJson } from '~/lib/.server/runtime-control';
+import type { ManagedInstanceRecord } from '~/lib/managed-instances';
+import { isTenantAdminAuthorized } from '~/lib/.server/admin-auth';
+
+export async function action({ request, params }: ActionFunctionArgs) {
+  if (!(await isTenantAdminAuthorized(request))) {
+    return json({ error: 'Forbidden' }, { status: 403 });
+  }
+
+  const slug = String(params.slug || '').trim();
+  const body = await request.json().catch(() => ({}));
+
+  try {
+    const payload = await fetchRuntimeControlJson<{ ok: boolean; instance: ManagedInstanceRecord }>(
+      `/managed-instances/${encodeURIComponent(slug)}/suspend`,
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+      },
+    );
+
+    return json(payload);
+  } catch (error) {
+    return json(
+      { error: error instanceof Error ? error.message : 'Managed instance suspend failed.' },
+      { status: 400 },
+    );
+  }
+}
diff --git a/app/routes/api.managed-instances.session.ts b/app/routes/api.managed-instances.session.ts
index 1fea4b33..5504e271 100644
--- a/app/routes/api.managed-instances.session.ts
+++ b/app/routes/api.managed-instances.session.ts
@@ -1,8 +1,13 @@
 import { json, type LoaderFunctionArgs } from '@remix-run/cloudflare';
 import { fetchRuntimeControlJson } from '~/lib/.server/runtime-control';
 import type { ManagedInstanceRecord } from '~/lib/managed-instances';
+import { isTenantAdminAuthorized } from '~/lib/.server/admin-auth';
 
 export async function loader({ request }: LoaderFunctionArgs) {
+  if (!(await isTenantAdminAuthorized(request))) {
+    return json({ error: 'Forbidden' }, { status: 403 });
+  }
+
   const sessionToken = new URL(request.url).searchParams.get('sessionToken')?.trim() || '';
 
   try {
diff --git a/app/routes/api.managed-instances.spawn.ts b/app/routes/api.managed-instances.spawn.ts
index 1fae89e2..1d37b4c3 100644
--- a/app/routes/api.managed-instances.spawn.ts
+++ b/app/routes/api.managed-instances.spawn.ts
@@ -1,8 +1,13 @@
 import { json, type ActionFunctionArgs } from '@remix-run/cloudflare';
 import { fetchRuntimeControlJson } from '~/lib/.server/runtime-control';
 import type { ManagedInstanceRecord } from '~/lib/managed-instances';
+import { isTenantAdminAuthorized } from '~/lib/.server/admin-auth';
 
 export async function action({ request }: ActionFunctionArgs) {
+  if (!(await isTenantAdminAuthorized(request))) {
+    return json({ error: 'Forbidden' }, { status: 403 });
+  }
+
   const body = await request.json().catch(() => ({}));
 
   try {
diff --git a/app/routes/api.shout.messages.ts b/app/routes/api.shout.messages.ts
index 44965608..2526306f 100644
--- a/app/routes/api.shout.messages.ts
+++ b/app/routes/api.shout.messages.ts
@@ -1,5 +1,6 @@
 import { json, type LoaderFunctionArgs } from '@remix-run/cloudflare';
 import { fetchRuntimeControlJson } from '~/lib/.server/runtime-control';
+import { isTenantAdminAuthorized } from '~/lib/.server/admin-auth';
 
 type ShoutMessage = {
   id: string;
@@ -8,10 +9,12 @@ type ShoutMessage = {
   createdAt: string;
 };
 
-export async function loader(_args: LoaderFunctionArgs) {
+export async function loader({ request }: LoaderFunctionArgs) {
+  const canSend = await isTenantAdminAuthorized(request);
+
   try {
     const payload = await fetchRuntimeControlJson<{ ok: boolean; messages: ShoutMessage[] }>('/shout/messages');
-    return json(payload);
+    return json({ ...payload, canSend });
   } catch (error) {
     return json(
       { error: error instanceof Error ? error.message : 'Failed to load shout-out messages.' },
diff --git a/app/routes/api.shout.send.ts b/app/routes/api.shout.send.ts
index b5832e6d..6a13e5a4 100644
--- a/app/routes/api.shout.send.ts
+++ b/app/routes/api.shout.send.ts
@@ -1,5 +1,6 @@
 import { json, type ActionFunctionArgs } from '@remix-run/cloudflare';
 import { fetchRuntimeControlJson } from '~/lib/.server/runtime-control';
+import { isTenantAdminAuthorized } from '~/lib/.server/admin-auth';
 
 type ShoutMessage = {
   id: string;
@@ -9,6 +10,10 @@ type ShoutMessage = {
 };
 
 export async function action({ request }: ActionFunctionArgs) {
+  if (!(await isTenantAdminAuthorized(request))) {
+    return json({ error: 'Forbidden' }, { status: 403 });
+  }
+
   const body = await request.json().catch(() => ({}));
 
   try {
diff --git a/app/routes/api.system.diagnostics.ts b/app/routes/api.system.diagnostics.ts
index 8c61966f..3c506e36 100644
--- a/app/routes/api.system.diagnostics.ts
+++ b/app/routes/api.system.diagnostics.ts
@@ -1,8 +1,6 @@
 import { json, type LoaderFunction, type LoaderFunctionArgs } from '@remix-run/cloudflare';
-
-/**
- * Diagnostic API for troubleshooting connection issues
- */
+import { parseCookies } from '~/lib/api/cookies';
+import { isTenantAdminAuthorized } from '~/lib/.server/admin-auth';
 
 interface AppContext {
   env?: {
@@ -11,50 +9,57 @@ interface AppContext {
   };
 }
 
+async function getExternalApiStatus(url: string, headers?: HeadersInit) {
+  try {
+    const response = await fetch(url, {
+      method: 'GET',
+      headers,
+    });
+
+    return {
+      isReachable: response.ok,
+      status: response.status,
+      statusText: response.statusText,
+    };
+  } catch (error) {
+    return {
+      isReachable: false,
+      error: error instanceof Error ? error.message : String(error),
+    };
+  }
+}
+
 export const loader: LoaderFunction = async ({ request, context }: LoaderFunctionArgs & { context: AppContext }) => {
-  // Get environment variables
+  const authenticated = await isTenantAdminAuthorized(request);
+  const timestamp = new Date().toISOString();
+
+  if (!authenticated) {
+    return json({
+      status: 'ok',
+      authenticated: false,
+      serverTimestamp: timestamp,
+      message: 'Diagnostics are restricted to tenant administrators on this deployment.',
+    });
+  }
+
+  const cookieValues = parseCookies(request.headers.get('Cookie'));
+  const hasGithubTokenCookie = Boolean(cookieValues.githubToken);
+  const hasGithubUsernameCookie = Boolean(cookieValues.githubUsername);
+  const hasNetlifyCookie = Boolean(cookieValues.netlifyToken);
+
   const envVars = {
     hasGithubToken: Boolean(process.env.GITHUB_ACCESS_TOKEN || context.env?.GITHUB_ACCESS_TOKEN),
     hasNetlifyToken: Boolean(process.env.NETLIFY_TOKEN || context.env?.NETLIFY_TOKEN),
     nodeEnv: process.env.NODE_ENV,
   };
 
-  // Check cookies
-  const cookieHeader = request.headers.get('Cookie') || '';
-  const cookies = cookieHeader.split(';').reduce(
-    (acc, cookie) => {
-      const [key, value] = cookie.trim().split('=');
-
-      if (key) {
-        acc[key] = value;
-      }
-
-      return acc;
-    },
-    {} as Record<string, string>,
-  );
-
-  const hasGithubTokenCookie = Boolean(cookies.githubToken);
-  const hasGithubUsernameCookie = Boolean(cookies.githubUsername);
-  const hasNetlifyCookie = Boolean(cookies.netlifyToken);
-
-  // Get local storage status (this can only be checked client-side)
-  const localStorageStatus = {
-    explanation: 'Local storage can only be checked on the client side. Use browser devtools to check.',
-    githubKeysToCheck: ['github_connection'],
-    netlifyKeysToCheck: ['netlify_connection'],
-  };
-
-  // Check if CORS might be an issue
   const corsStatus = {
     headers: {
-      'Access-Control-Allow-Origin': '*',
       'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
       'Access-Control-Allow-Headers': 'Content-Type, Authorization',
     },
   };
 
-  // Check if API endpoints are reachable
   const apiEndpoints = {
     githubUser: '/api/system/git-info?action=getUser',
     githubRepos: '/api/system/git-info?action=getRepos',
@@ -63,80 +68,40 @@ export const loader: LoaderFunction = async ({ request, context }: LoaderFunctio
     gitInfo: '/api/system/git-info',
   };
 
-  // Test GitHub API connectivity
-  let githubApiStatus;
-
-  try {
-    const githubResponse = await fetch('https://api.github.com/zen', {
-      method: 'GET',
-      headers: {
-        Accept: 'application/vnd.github.v3+json',
-      },
-    });
-
-    githubApiStatus = {
-      isReachable: githubResponse.ok,
-      status: githubResponse.status,
-      statusText: githubResponse.statusText,
-    };
-  } catch (error) {
-    githubApiStatus = {
-      isReachable: false,
-      error: error instanceof Error ? error.message : String(error),
-    };
-  }
-
-  // Test Netlify API connectivity
-  let netlifyApiStatus;
-
-  try {
-    const netlifyResponse = await fetch('https://api.netlify.com/api/v1/', {
-      method: 'GET',
-    });
-
-    netlifyApiStatus = {
-      isReachable: netlifyResponse.ok,
-      status: netlifyResponse.status,
-      statusText: netlifyResponse.statusText,
-    };
-  } catch (error) {
-    netlifyApiStatus = {
-      isReachable: false,
-      error: error instanceof Error ? error.message : String(error),
-    };
-  }
-
-  // Provide technical details about the environment
-  const technicalDetails = {
-    serverTimestamp: new Date().toISOString(),
-    userAgent: request.headers.get('User-Agent'),
-    referrer: request.headers.get('Referer'),
-    host: request.headers.get('Host'),
-    method: request.method,
-    url: request.url,
-  };
-
-  // Return diagnostics
-  return json(
-    {
-      status: 'success',
-      environment: envVars,
-      cookies: {
-        hasGithubTokenCookie,
-        hasGithubUsernameCookie,
-        hasNetlifyCookie,
-      },
-      localStorage: localStorageStatus,
-      apiEndpoints,
-      externalApis: {
-        github: githubApiStatus,
-        netlify: netlifyApiStatus,
-      },
-      corsStatus,
-      technicalDetails,
+  const [githubApiStatus, netlifyApiStatus] = await Promise.all([
+    getExternalApiStatus('https://api.github.com/zen', {
+      Accept: 'application/vnd.github.v3+json',
+    }),
+    getExternalApiStatus('https://api.netlify.com/api/v1/'),
+  ]);
+
+  return json({
+    status: 'success',
+    authenticated: true,
+    environment: envVars,
+    cookies: {
+      hasGithubTokenCookie,
+      hasGithubUsernameCookie,
+      hasNetlifyCookie,
+    },
+    localStorage: {
+      explanation: 'Local storage can only be checked on the client side. Use browser devtools to check.',
+      githubKeysToCheck: ['github_connection'],
+      netlifyKeysToCheck: ['netlify_connection'],
+    },
+    apiEndpoints,
+    externalApis: {
+      github: githubApiStatus,
+      netlify: netlifyApiStatus,
     },
-    {
-      headers: corsStatus.headers,
+    corsStatus,
+    technicalDetails: {
+      serverTimestamp: timestamp,
+      userAgent: request.headers.get('User-Agent'),
+      referrer: request.headers.get('Referer'),
+      host: request.headers.get('Host'),
+      method: request.method,
+      url: request.url,
     },
-  );
+  });
 };
diff --git a/app/routes/api.system.git-info.ts b/app/routes/api.system.git-info.ts
index f0fffd54..3ca22fad 100644
--- a/app/routes/api.system.git-info.ts
+++ b/app/routes/api.system.git-info.ts
@@ -1,4 +1,6 @@
 import { json, type LoaderFunction, type LoaderFunctionArgs } from '@remix-run/cloudflare';
+import { parseCookies } from '~/lib/api/cookies';
+import { isTenantAdminAuthorized } from '~/lib/.server/admin-auth';
 
 interface GitInfo {
   local: {
@@ -23,7 +25,6 @@ interface GitInfo {
   timestamp?: string;
 }
 
-// Define context type
 interface AppContext {
   env?: {
     GITHUB_ACCESS_TOKEN?: string;
@@ -48,285 +49,145 @@ interface GitHubGist {
 }
 
 // These values will be replaced at build time
+// eslint-disable-next-line @typescript-eslint/naming-convention
 declare const __COMMIT_HASH: string;
+// eslint-disable-next-line @typescript-eslint/naming-convention
 declare const __GIT_BRANCH: string;
+// eslint-disable-next-line @typescript-eslint/naming-convention
 declare const __GIT_COMMIT_TIME: string;
+// eslint-disable-next-line @typescript-eslint/naming-convention
 declare const __GIT_AUTHOR: string;
+// eslint-disable-next-line @typescript-eslint/naming-convention
 declare const __GIT_EMAIL: string;
+// eslint-disable-next-line @typescript-eslint/naming-convention
 declare const __GIT_REMOTE_URL: string;
+// eslint-disable-next-line @typescript-eslint/naming-convention
 declare const __GIT_REPO_NAME: string;
 
-/*
- * Remove unused variable to fix linter error
- * declare const __GIT_REPO_URL: string;
- */
+const PRIVILEGED_ACTIONS = new Set(['getUser', 'getRepos', 'getOrgs', 'getActivity']);
 
-export const loader: LoaderFunction = async ({ request, context }: LoaderFunctionArgs & { context: AppContext }) => {
-  console.log('Git info API called with URL:', request.url);
+function resolveBearerToken(request: Request) {
+  const authHeader = request.headers.get('Authorization');
+
+  if (!authHeader?.startsWith('Bearer ')) {
+    return null;
+  }
 
-  // Handle CORS preflight requests
+  const token = authHeader.substring(7).trim();
+
+  return token.length > 0 ? token : null;
+}
+
+function buildLocalGitInfo(): GitInfo {
+  return {
+    local: {
+      commitHash: typeof __COMMIT_HASH !== 'undefined' ? __COMMIT_HASH : 'development',
+      branch: typeof __GIT_BRANCH !== 'undefined' ? __GIT_BRANCH : 'main',
+      commitTime: typeof __GIT_COMMIT_TIME !== 'undefined' ? __GIT_COMMIT_TIME : new Date().toISOString(),
+      author: typeof __GIT_AUTHOR !== 'undefined' ? __GIT_AUTHOR : 'development',
+      email: typeof __GIT_EMAIL !== 'undefined' ? __GIT_EMAIL : 'development@local',
+      remoteUrl: typeof __GIT_REMOTE_URL !== 'undefined' ? __GIT_REMOTE_URL : 'local',
+      repoName: typeof __GIT_REPO_NAME !== 'undefined' ? __GIT_REPO_NAME : 'bolt.gives',
+    },
+    timestamp: new Date().toISOString(),
+  };
+}
+
+async function callGithub<T>(path: string, token: string): Promise<T> {
+  const response = await fetch(`https://api.github.com${path}`, {
+    headers: {
+      Accept: 'application/vnd.github.v3+json',
+      Authorization: `Bearer ${token}`,
+    },
+  });
+
+  if (!response.ok) {
+    throw new Error(`GitHub API error: ${response.status}`);
+  }
+
+  return (await response.json()) as T;
+}
+
+export const loader: LoaderFunction = async ({ request, context }: LoaderFunctionArgs & { context: AppContext }) => {
   if (request.method === 'OPTIONS') {
-    return new Response(null, {
-      headers: {
-        'Access-Control-Allow-Origin': '*',
-        'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
-        'Access-Control-Allow-Headers': 'Content-Type, Authorization',
-      },
-    });
+    return new Response(null, { status: 204 });
   }
 
   const { searchParams } = new URL(request.url);
-  const action = searchParams.get('action');
-
-  console.log('Git info action:', action);
-
-  if (action === 'getUser' || action === 'getRepos' || action === 'getOrgs' || action === 'getActivity') {
-    // Use server-side token instead of client-side token
-    const serverGithubToken = process.env.GITHUB_ACCESS_TOKEN || context.env?.GITHUB_ACCESS_TOKEN;
-    const cookieToken = request.headers
-      .get('Cookie')
-      ?.split(';')
-      .find((cookie) => cookie.trim().startsWith('githubToken='))
-      ?.split('=')[1];
-
-    // Also check for token in Authorization header
-    const authHeader = request.headers.get('Authorization');
-    const headerToken = authHeader?.startsWith('Bearer ') ? authHeader.substring(7) : null;
-
-    const token = serverGithubToken || headerToken || cookieToken;
-
-    console.log(
-      'Using GitHub token from:',
-      serverGithubToken ? 'server env' : headerToken ? 'auth header' : cookieToken ? 'cookie' : 'none',
-    );
-
-    if (!token) {
-      console.error('No GitHub token available');
-      return json(
-        { error: 'No GitHub token available' },
-        {
-          status: 401,
-          headers: {
-            'Access-Control-Allow-Origin': '*',
-            'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
-          },
-        },
-      );
-    }
+  const action = searchParams.get('action') || '';
 
-    try {
-      if (action === 'getUser') {
-        const response = await fetch('https://api.github.com/user', {
-          headers: {
-            Accept: 'application/vnd.github.v3+json',
-            Authorization: `Bearer ${token}`,
-          },
-        });
-
-        if (!response.ok) {
-          console.error('GitHub user API error:', response.status);
-          throw new Error(`GitHub API error: ${response.status}`);
-        }
+  if (!PRIVILEGED_ACTIONS.has(action)) {
+    return json(buildLocalGitInfo());
+  }
 
-        const userData = await response.json();
-
-        return json(
-          { user: userData },
-          {
-            headers: {
-              'Access-Control-Allow-Origin': '*',
-              'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
-            },
-          },
-        );
-      }
+  const isAdmin = await isTenantAdminAuthorized(request);
 
-      if (action === 'getRepos') {
-        const reposResponse = await fetch('https://api.github.com/user/repos?per_page=100&sort=updated', {
-          headers: {
-            Accept: 'application/vnd.github.v3+json',
-            Authorization: `Bearer ${token}`,
-          },
-        });
-
-        if (!reposResponse.ok) {
-          console.error('GitHub repos API error:', reposResponse.status);
-          throw new Error(`GitHub API error: ${reposResponse.status}`);
-        }
+  if (!isAdmin) {
+    return json({ error: 'Forbidden' }, { status: 403 });
+  }
 
-        const repos = (await reposResponse.json()) as GitHubRepo[];
-
-        // Get user's gists
-        const gistsResponse = await fetch('https://api.github.com/gists', {
-          headers: {
-            Accept: 'application/vnd.github.v3+json',
-            Authorization: `Bearer ${token}`,
-          },
-        });
-
-        const gists = gistsResponse.ok ? ((await gistsResponse.json()) as GitHubGist[]) : [];
-
-        // Calculate language statistics
-        const languageStats: Record<string, number> = {};
-        let totalStars = 0;
-        let totalForks = 0;
-
-        for (const repo of repos) {
-          totalStars += repo.stargazers_count || 0;
-          totalForks += repo.forks_count || 0;
-
-          if (repo.language && repo.language !== 'null') {
-            languageStats[repo.language] = (languageStats[repo.language] || 0) + 1;
-          }
-
-          /*
-           * Optionally fetch languages for each repo for more accurate stats
-           * This is commented out to avoid rate limiting
-           *
-           * if (repo.languages_url) {
-           *   try {
-           *     const langResponse = await fetch(repo.languages_url, {
-           *       headers: {
-           *         Accept: 'application/vnd.github.v3+json',
-           *         Authorization: `Bearer ${token}`,
-           *       },
-           *     });
-           *
-           *     if (langResponse.ok) {
-           *       const languages = await langResponse.json();
-           *       Object.keys(languages).forEach(lang => {
-           *         languageStats[lang] = (languageStats[lang] || 0) + languages[lang];
-           *       });
-           *     }
-           *   } catch (error) {
-           *     console.error(`Error fetching languages for ${repo.name}:`, error);
-           *   }
-           * }
-           */
-        }
+  const cookies = parseCookies(request.headers.get('Cookie'));
+  const headerToken = resolveBearerToken(request);
+  const cookieToken = cookies.githubToken;
+  const serverGithubToken = process.env.GITHUB_ACCESS_TOKEN || context.env?.GITHUB_ACCESS_TOKEN;
+  const token = headerToken || cookieToken || serverGithubToken;
 
-        return json(
-          {
-            repos,
-            stats: {
-              totalStars,
-              totalForks,
-              languages: languageStats,
-              totalGists: gists.length,
-            },
-          },
-          {
-            headers: {
-              'Access-Control-Allow-Origin': '*',
-              'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
-            },
-          },
-        );
-      }
+  if (!token) {
+    return json({ error: 'No GitHub token available' }, { status: 401 });
+  }
 
-      if (action === 'getOrgs') {
-        const response = await fetch('https://api.github.com/user/orgs', {
-          headers: {
-            Accept: 'application/vnd.github.v3+json',
-            Authorization: `Bearer ${token}`,
-          },
-        });
-
-        if (!response.ok) {
-          console.error('GitHub orgs API error:', response.status);
-          throw new Error(`GitHub API error: ${response.status}`);
-        }
+  try {
+    if (action === 'getUser') {
+      const user = await callGithub('/user', token);
+      return json({ user });
+    }
 
-        const orgs = await response.json();
-
-        return json(
-          { organizations: orgs },
-          {
-            headers: {
-              'Access-Control-Allow-Origin': '*',
-              'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
-            },
-          },
-        );
-      }
+    if (action === 'getRepos') {
+      const repos = await callGithub<GitHubRepo[]>('/user/repos?per_page=100&sort=updated', token);
+      const gists = await callGithub<GitHubGist[]>('/gists', token).catch(() => []);
 
-      if (action === 'getActivity') {
-        const username = request.headers
-          .get('Cookie')
-          ?.split(';')
-          .find((cookie) => cookie.trim().startsWith('githubUsername='))
-          ?.split('=')[1];
-
-        if (!username) {
-          console.error('GitHub username not found in cookies');
-          return json(
-            { error: 'GitHub username not found in cookies' },
-            {
-              status: 400,
-              headers: {
-                'Access-Control-Allow-Origin': '*',
-                'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
-              },
-            },
-          );
-        }
+      const languageStats: Record<string, number> = {};
+      let totalStars = 0;
+      let totalForks = 0;
 
-        const response = await fetch(`https://api.github.com/users/${username}/events?per_page=30`, {
-          headers: {
-            Accept: 'application/vnd.github.v3+json',
-            Authorization: `Bearer ${token}`,
-          },
-        });
+      for (const repo of repos) {
+        totalStars += repo.stargazers_count || 0;
+        totalForks += repo.forks_count || 0;
 
-        if (!response.ok) {
-          console.error('GitHub activity API error:', response.status);
-          throw new Error(`GitHub API error: ${response.status}`);
+        if (repo.language && repo.language !== 'null') {
+          languageStats[repo.language] = (languageStats[repo.language] || 0) + 1;
         }
-
-        const events = await response.json();
-
-        return json(
-          { recentActivity: events },
-          {
-            headers: {
-              'Access-Control-Allow-Origin': '*',
-              'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
-            },
-          },
-        );
       }
-    } catch (error) {
-      console.error('GitHub API error:', error);
-      return json(
-        { error: error instanceof Error ? error.message : 'Unknown error' },
-        {
-          status: 500,
-          headers: {
-            'Access-Control-Allow-Origin': '*',
-            'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
-          },
+
+      return json({
+        repos,
+        stats: {
+          totalStars,
+          totalForks,
+          languages: languageStats,
+          totalGists: gists.length,
         },
-      );
+      });
     }
-  }
 
-  const gitInfo: GitInfo = {
-    local: {
-      commitHash: typeof __COMMIT_HASH !== 'undefined' ? __COMMIT_HASH : 'development',
-      branch: typeof __GIT_BRANCH !== 'undefined' ? __GIT_BRANCH : 'main',
-      commitTime: typeof __GIT_COMMIT_TIME !== 'undefined' ? __GIT_COMMIT_TIME : new Date().toISOString(),
-      author: typeof __GIT_AUTHOR !== 'undefined' ? __GIT_AUTHOR : 'development',
-      email: typeof __GIT_EMAIL !== 'undefined' ? __GIT_EMAIL : 'development@local',
-      remoteUrl: typeof __GIT_REMOTE_URL !== 'undefined' ? __GIT_REMOTE_URL : 'local',
-      repoName: typeof __GIT_REPO_NAME !== 'undefined' ? __GIT_REPO_NAME : 'bolt.gives',
-    },
-    timestamp: new Date().toISOString(),
-  };
+    if (action === 'getOrgs') {
+      const organizations = await callGithub('/user/orgs', token);
+      return json({ organizations });
+    }
 
-  return json(gitInfo, {
-    headers: {
-      'Access-Control-Allow-Origin': '*',
-      'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
-    },
-  });
+    if (action === 'getActivity') {
+      const username = String(cookies.githubUsername || '').trim();
+
+      if (!username) {
+        return json({ error: 'GitHub username not found in cookies' }, { status: 400 });
+      }
+
+      const recentActivity = await callGithub(`/users/${encodeURIComponent(username)}/events?per_page=30`, token);
+      return json({ recentActivity });
+    }
+  } catch (error) {
+    return json({ error: error instanceof Error ? error.message : 'Unknown error' }, { status: 500 });
+  }
+
+  return json({ error: 'Unsupported action' }, { status: 400 });
 };
diff --git a/tests/routes/api.auth-guards.spec.ts b/tests/routes/api.auth-guards.spec.ts
new file mode 100644
index 00000000..7a8c11f5
--- /dev/null
+++ b/tests/routes/api.auth-guards.spec.ts
@@ -0,0 +1,101 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const adminAuthMocks = vi.hoisted(() => ({
+  isTenantAdminAuthorized: vi.fn(),
+}));
+const runtimeControlMocks = vi.hoisted(() => ({
+  fetchRuntimeControlJson: vi.fn(),
+}));
+
+vi.mock('~/lib/.server/admin-auth', () => ({
+  isTenantAdminAuthorized: adminAuthMocks.isTenantAdminAuthorized,
+}));
+vi.mock('~/lib/.server/runtime-control', () => ({
+  fetchRuntimeControlJson: runtimeControlMocks.fetchRuntimeControlJson,
+}));
+
+describe('route-local auth guards', () => {
+  beforeEach(() => {
+    adminAuthMocks.isTenantAdminAuthorized.mockReset();
+    runtimeControlMocks.fetchRuntimeControlJson.mockReset();
+  });
+
+  it('blocks managed instance spawn passthrough when caller is not admin-authenticated', async () => {
+    adminAuthMocks.isTenantAdminAuthorized.mockResolvedValue(false);
+    const route = await import('../../app/routes/api.managed-instances.spawn');
+
+    const response = await route.action({
+      request: new Request('https://alpha1.bolt.gives/api/managed-instances/spawn', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({}),
+      }),
+      context: {},
+      params: {},
+    } as any);
+
+    expect(response.status).toBe(403);
+    expect(runtimeControlMocks.fetchRuntimeControlJson).not.toHaveBeenCalled();
+  });
+
+  it('blocks shout send passthrough when caller is not admin-authenticated', async () => {
+    adminAuthMocks.isTenantAdminAuthorized.mockResolvedValue(false);
+    const route = await import('../../app/routes/api.shout.send');
+
+    const response = await route.action({
+      request: new Request('https://alpha1.bolt.gives/api/shout/send', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ author: 'x', content: 'y' }),
+      }),
+      context: {},
+      params: {},
+    } as any);
+
+    expect(response.status).toBe(403);
+    expect(runtimeControlMocks.fetchRuntimeControlJson).not.toHaveBeenCalled();
+  });
+
+  it('returns minimal diagnostics to unauthenticated callers', async () => {
+    adminAuthMocks.isTenantAdminAuthorized.mockResolvedValue(false);
+    const route = await import('../../app/routes/api.system.diagnostics');
+
+    const response = await route.loader({
+      request: new Request('https://alpha1.bolt.gives/api/system/diagnostics'),
+      context: {},
+      params: {},
+    } as any);
+    const payload = await response.json();
+
+    expect(payload.authenticated).toBe(false);
+    expect(payload.environment).toBeUndefined();
+  });
+
+  it('blocks privileged git-info actions when caller is not admin-authenticated', async () => {
+    adminAuthMocks.isTenantAdminAuthorized.mockResolvedValue(false);
+    const route = await import('../../app/routes/api.system.git-info');
+
+    const response = await route.loader({
+      request: new Request('https://alpha1.bolt.gives/api/system/git-info?action=getUser'),
+      context: {},
+      params: {},
+    } as any);
+
+    expect(response.status).toBe(403);
+  });
+
+  it('keeps non-privileged local git metadata endpoint available', async () => {
+    adminAuthMocks.isTenantAdminAuthorized.mockResolvedValue(false);
+    const route = await import('../../app/routes/api.system.git-info');
+
+    const response = await route.loader({
+      request: new Request('https://alpha1.bolt.gives/api/system/git-info'),
+      context: {},
+      params: {},
+    } as any);
+    const payload = await response.json();
+
+    expect(response.status).toBe(200);
+    expect(payload.local).toBeTruthy();
+  });
+});