diff --git a/create-a-container/bin/test-docker-registry.js b/create-a-container/bin/test-docker-registry.js
new file mode 100755
index 00000000..8263944d
--- /dev/null
+++ b/create-a-container/bin/test-docker-registry.js
@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+/**
+ * Test script for docker-registry utilities
+ * Usage: node test-docker-registry.js <image-ref>
+ * Example: node test-docker-registry.js nginx:alpine
+ */
+
+const { parseDockerRef, getImageConfig, extractImageMetadata } = require('../utils/docker-registry');
+
+// Normalize function copied from routers/containers.js
+function normalizeDockerRef(ref) {
+  if (ref.startsWith('http://') || ref.startsWith('https://') || ref.startsWith('git@')) {
+    return ref;
+  }
+
+  let tag = 'latest';
+  let imagePart = ref;
+  
+  const lastColon = ref.lastIndexOf(':');
+  if (lastColon !== -1) {
+    const potentialTag = ref.substring(lastColon + 1);
+    if (!potentialTag.includes('/')) {
+      tag = potentialTag;
+      imagePart = ref.substring(0, lastColon);
+    }
+  }
+  
+  const parts = imagePart.split('/');
+  
+  let host = 'docker.io';
+  let org = 'library';
+  let image;
+  
+  if (parts.length === 1) {
+    image = parts[0];
+  } else if (parts.length === 2) {
+    if (parts[0].includes('.') || parts[0].includes(':')) {
+      host = parts[0];
+      image = parts[1];
+    } else {
+      org = parts[0];
+      image = parts[1];
+    }
+  } else {
+    host = parts[0];
+    image = parts[parts.length - 1];
+    org = parts.slice(1, -1).join('/');
+  }
+  
+  return `${host}/${org}/${image}:${tag}`;
+}
+
+async function test(imageRef) {
+  try {
+    console.log('Testing image:', imageRef);
+    console.log('---');
+    
+    const normalized = normalizeDockerRef(imageRef);
+    console.log('Normalized:', normalized);
+    
+    const parsed = parseDockerRef(normalized);
+    console.log('Parsed:', parsed);
+    
+    const repo = `${parsed.namespace}/${parsed.image}`;
+    console.log('Fetching config from registry...');
+    
+    const config = await getImageConfig(parsed.registry, repo, parsed.tag);
+    console.log('✓ Config fetched successfully');
+    
+    const metadata = extractImageMetadata(config);
+    console.log('---');
+    console.log('Metadata:');
+    console.log(JSON.stringify(metadata, null, 2));
+    
+  } catch (err) {
+    console.error('✗ Error:', err.message);
+    process.exit(1);
+  }
+}
+
+const imageRef = process.argv[2] || 'nginx:alpine';
+test(imageRef);
diff --git a/create-a-container/config/ozwell-agent.yaml b/create-a-container/config/ozwell-agent.yaml
new file mode 100644
index 00000000..291c8a9f
--- /dev/null
+++ b/create-a-container/config/ozwell-agent.yaml
@@ -0,0 +1,36 @@
+name: MIE Container Manager Assistant
+model: llama3.1:latest
+temperature: 0.1
+instructions: >
+  You are MIE Assistant. You help users manage their containers, nodes, domains, and settings.
+
+  CRITICAL RULES:
+  1. NEVER write JSON in your text responses. Use tool calls instead.
+  2. NEVER describe or narrate tool calls. Just call them silently.
+  3. NEVER claim you did something without actually calling a tool.
+  4. ALWAYS call get_page_contents FIRST before any other tool. This tells you what fields, tables, buttons, and links are on the page.
+  5. If get_page_contents shows available actions (buttons/links), use click_element to click them.
+  6. Only use set_page_contents when the page has form fields to fill.
+  7. Keep text responses short - one or two sentences max.
+
+  NAVIGATION: When the user asks to create/add something and the page shows a
+  "New..." button in the actions list, use click_element to click that button.
+  Do NOT try to set_page_contents on a list/table page — navigate first.
+
+  FORM WORKFLOW (only on pages with form fields):
+  Step 1: Call get_page_contents to see available fields.
+  Step 2: Call set_page_contents with fields and submit:true.
+  Step 3: Report success or failure in plain English.
+
+  FIELD MAPPING: Use the name attribute from get_page_contents results.
+  For custom Docker images, set customTemplate to the image name. The
+  template field will auto-select.
+
+# Ozwell uses simple string tool names for Ollama compatibility.
+# Full tool definitions (descriptions, parameters) are provided by the
+# widget's OzwellChatConfig on the client side and sent in each API request.
+tools:
+  - get_page_contents
+  - set_page_contents
+  - submit_form
+  - click_element
diff --git a/create-a-container/public/js/chatbot-tools.js b/create-a-container/public/js/chatbot-tools.js
new file mode 100644
index 00000000..59e9b513
--- /dev/null
+++ b/create-a-container/public/js/chatbot-tools.js
@@ -0,0 +1,493 @@
+/**
+ * Generic tool handlers for the Ozwell chatbot widget.
+ * Handles get_page_contents and set_page_contents tool calls
+ * via the ozwell-tool-call DOM event.
+ */
+(function () {
+  'use strict';
+
+  /**
+   * Find the label text for a form element.
+   */
+  function getFieldLabel(el) {
+    // Explicit <label for="...">
+    if (el.id) {
+      const label = document.querySelector(`label[for="${CSS.escape(el.id)}"]`);
+      if (label) return label.textContent.trim();
+    }
+    // Wrapping <label>
+    const parent = el.closest('label');
+    if (parent) {
+      const clone = parent.cloneNode(true);
+      // Remove the input itself to get only label text
+      const inputs = clone.querySelectorAll('input, select, textarea');
+      inputs.forEach(function (i) { i.remove(); });
+      const text = clone.textContent.trim();
+      if (text) return text;
+    }
+    // ARIA
+    if (el.getAttribute('aria-label')) return el.getAttribute('aria-label');
+    // Placeholder as last resort
+    if (el.placeholder) return el.placeholder;
+    return el.name || el.id || '';
+  }
+
+  /**
+   * Get select element options as an array.
+   */
+  function getSelectOptions(el) {
+    return Array.from(el.options).map(function (opt) {
+      return { value: opt.value, text: opt.textContent.trim(), selected: opt.selected };
+    });
+  }
+
+  var MAX_TEXT_LENGTH = 8000;
+
+  /**
+   * Get the main content element.
+   */
+  function getMainEl() {
+    return document.querySelector('main')
+      || document.querySelector('[role="main"]')
+      || document.querySelector('.container');
+  }
+
+  /**
+   * Extract the visible text from <main>, with light filtering.
+   * Strips SQL queries and collapses excessive whitespace.
+   */
+  function getVisibleText() {
+    var mainEl = getMainEl();
+    if (!mainEl) return '';
+    var text = mainEl.innerText || '';
+    // Filter out verbose Sequelize SQL queries
+    text = text.replace(/Executing \(default\):.*$/gm, '');
+    // Collapse runs of 3+ blank lines into 2
+    text = text.replace(/\n{3,}/g, '\n\n');
+    // Trim and cap length
+    text = text.trim();
+    if (text.length > MAX_TEXT_LENGTH) {
+      text = text.substring(0, MAX_TEXT_LENGTH) + '\n...(truncated)';
+    }
+    return text;
+  }
+
+  /**
+   * Scrape page content: structured form fields + raw visible text.
+   * Form fields are structured (name, type, value, options) because the
+   * LLM needs machine-readable identifiers to call set_page_contents.
+   * Everything else (tables, headings, logs, metadata) is sent as raw
+   * text — the LLM parses it directly.
+   */
+  function getPageContents() {
+    var pageTitle = document.title || '';
+    var mainEl = getMainEl();
+
+    // Structured form fields — LLM needs name/id/type to call set_page_contents
+    var fields = [];
+    var seen = new Set();
+    var elements = mainEl
+      ? mainEl.querySelectorAll('input, select, textarea')
+      : document.querySelectorAll('input, select, textarea');
+
+    elements.forEach(function (el) {
+      if (el.type === 'hidden' || el.type === 'submit' || el.type === 'button') return;
+      var key = el.name || el.id;
+      if (!key || seen.has(key)) return;
+      seen.add(key);
+
+      var field = {
+        name: el.name || '',
+        id: el.id || '',
+        type: el.tagName === 'SELECT' ? 'select' : (el.type || 'text'),
+        label: getFieldLabel(el),
+        value: el.type === 'checkbox' ? el.checked : el.value,
+        required: el.required || false,
+        disabled: el.disabled || false
+      };
+
+      if (el.tagName === 'SELECT') {
+        field.options = getSelectOptions(el);
+      }
+
+      fields.push(field);
+    });
+
+    var result = {
+      title: pageTitle,
+      url: window.location.pathname,
+      fields: fields,
+      pageText: getVisibleText()
+    };
+
+    return result;
+  }
+
+  /**
+   * Find a form element by name, id, label text, or fuzzy word matching.
+   * Tolerates LLM-guessed names like "container_name" for a field named "hostname"
+   * with label "Container Hostname" by scoring word overlap.
+   */
+  function findField(identifier) {
+    // 1. Exact name match
+    var el = document.querySelector('[name="' + CSS.escape(identifier) + '"]');
+    if (el) return el;
+    // 2. Exact id match
+    el = document.getElementById(identifier);
+    if (el) return el;
+
+    var lower = identifier.toLowerCase();
+
+    // 3. Label text contains the full identifier
+    var labels = document.querySelectorAll('label');
+    for (var i = 0; i < labels.length; i++) {
+      if (labels[i].textContent.trim().toLowerCase().includes(lower)) {
+        var forId = labels[i].getAttribute('for');
+        if (forId) return document.getElementById(forId);
+        var input = labels[i].querySelector('input, select, textarea');
+        if (input) return input;
+      }
+    }
+
+    // 4. Word-level fuzzy match — split identifier into words and score each field
+    var words = lower.replace(/[_\-\s]+/g, ' ').split(' ').filter(Boolean);
+    if (words.length > 0) {
+      var allFields = document.querySelectorAll('input:not([type="hidden"]):not([type="submit"]), select, textarea');
+      var bestMatch = null;
+      var bestScore = 0;
+
+      allFields.forEach(function (field) {
+        var fieldText = [
+          field.name || '',
+          field.id || '',
+          getFieldLabel(field),
+          field.placeholder || ''
+        ].join(' ').toLowerCase();
+
+        var score = 0;
+        words.forEach(function (w) { if (fieldText.includes(w)) score++; });
+
+        if (score > bestScore) {
+          bestScore = score;
+          bestMatch = field;
+        }
+      });
+
+      if (bestMatch && bestScore >= 1) return bestMatch;
+    }
+
+    return null;
+  }
+
+  /**
+   * Set a form field's value and fire change events.
+   * For selects, also tries case-insensitive partial matching.
+   * Returns { ok: true } or { ok: false, options: [...] } for selects.
+   */
+  function setFieldValue(el, value) {
+    if (el.type === 'checkbox') {
+      el.checked = value === true || value === 'true';
+    } else if (el.tagName === 'SELECT') {
+      var strVal = String(value);
+      var lower = strVal.toLowerCase();
+      // Try exact value match, exact text match, then partial text match
+      for (var i = 0; i < el.options.length; i++) {
+        if (el.options[i].value === strVal) {
+          el.value = el.options[i].value;
+          el.dispatchEvent(new Event('input', { bubbles: true }));
+          el.dispatchEvent(new Event('change', { bubbles: true }));
+          return { ok: true };
+        }
+      }
+      for (var j = 0; j < el.options.length; j++) {
+        var optText = el.options[j].textContent.trim().toLowerCase();
+        if (optText === lower || optText.includes(lower)) {
+          el.value = el.options[j].value;
+          el.dispatchEvent(new Event('input', { bubbles: true }));
+          el.dispatchEvent(new Event('change', { bubbles: true }));
+          return { ok: true };
+        }
+      }
+      // Return available options so the LLM can self-correct
+      var opts = Array.from(el.options)
+        .filter(function (o) { return o.value; })
+        .map(function (o) { return o.textContent.trim(); });
+      return { ok: false, options: opts };
+    } else {
+      el.value = String(value);
+    }
+    el.dispatchEvent(new Event('input', { bubbles: true }));
+    el.dispatchEvent(new Event('change', { bubbles: true }));
+    return { ok: true };
+  }
+
+  /**
+   * Build a concise text summary of available fields for LLM context.
+   */
+  function fieldSummary() {
+    var pageData = getPageContents();
+    return pageData.fields.map(function (f) {
+      var desc = f.name + ' (' + f.type;
+      if (f.required) desc += ', required';
+      if (f.options) {
+        var optNames = f.options
+          .filter(function (o) { return o.value; })
+          .map(function (o) { return '"' + o.text + '"'; });
+        desc += ', options: ' + optNames.join(' | ');
+      }
+      if (f.value) desc += ', current: "' + f.value + '"';
+      desc += ')';
+      return desc;
+    }).join('; ');
+  }
+
+  /**
+   * Update multiple form fields.
+   * If args.submit is true, submits the form after setting fields (atomic fill+submit).
+   * Returns a concise summary of available fields so the LLM
+   * can self-correct without needing a separate get_page_contents call.
+   */
+  function setPageContents(args) {
+    var shouldSubmit = args.submit === true || args.submit === 'true';
+
+    // Resilient: accept either {fields: {...}} or flat {name: value, ...}
+    var fieldsMap = args.fields || {};
+    if (Object.keys(fieldsMap).length === 0) {
+      fieldsMap = {};
+      Object.keys(args).forEach(function (k) {
+        if (k !== 'fields' && k !== 'submit') fieldsMap[k] = args[k];
+      });
+    }
+    var updated = [];
+    var notFound = [];
+
+    Object.keys(fieldsMap).forEach(function (key) {
+      var el = findField(key);
+      if (!el) {
+        notFound.push(key + ' (no such field)');
+        return;
+      }
+      if (el.disabled) {
+        notFound.push(key + ' (disabled)');
+        return;
+      }
+
+      // Auto-select "Custom Docker Image..." when customTemplate is being set
+      if (el.name === 'customTemplate' && fieldsMap[key]) {
+        var templateSel = document.querySelector('[name="template"]');
+        if (templateSel && templateSel.value !== 'custom') {
+          setFieldValue(templateSel, 'custom');
+        }
+      }
+
+      var result = setFieldValue(el, fieldsMap[key]);
+      if (result.ok) {
+        updated.push(key);
+      } else if (result.options) {
+        notFound.push(key + ' (value "' + fieldsMap[key] + '" not valid, options: ' + result.options.join(', ') + ')');
+      } else {
+        notFound.push(key + ' (could not set)');
+      }
+    });
+
+    var response = {
+      success: updated.length > 0 && notFound.length === 0,
+      updated: updated,
+      notFound: notFound,
+      availableFields: fieldSummary()
+    };
+
+    if (updated.length === 0 && Object.keys(fieldsMap).length > 0) {
+      response.error = 'No fields were updated. Use get_page_contents first to see available fields and actions.';
+    }
+
+    if (shouldSubmit) {
+      // Validate: check for unfilled required fields or unselected dropdowns
+      var emptyRequired = [];
+      var form = document.querySelector('main form')
+        || document.querySelector('[role="main"] form')
+        || document.querySelector('.container form');
+      if (form) {
+        form.querySelectorAll('input, select, textarea').forEach(function (el) {
+          if (el.type === 'hidden' || el.type === 'submit' || el.type === 'button' || el.disabled) return;
+          var key = el.name || el.id;
+          if (!key) return;
+          if (el.required && !el.value) {
+            emptyRequired.push(key + ' (' + getFieldLabel(el) + ')');
+          }
+          if (el.tagName === 'SELECT' && el.selectedIndex === 0 && el.options[0] && !el.options[0].value) {
+            emptyRequired.push(key + ' (' + getFieldLabel(el) + ', no option selected)');
+          }
+        });
+      }
+
+      if (notFound.length > 0) {
+        response.submitted = false;
+        response.submitError = 'Cannot submit: some fields failed to set';
+      } else if (emptyRequired.length > 0) {
+        response.submitted = false;
+        response.submitError = 'Cannot submit, these required fields are still empty: ' + emptyRequired.join(', ');
+      } else {
+        var submitResult = submitForm();
+        response.submitted = submitResult.success;
+        if (!submitResult.success) response.submitError = submitResult.error;
+      }
+    }
+
+    return response;
+  }
+
+  /**
+   * Submit the form on the current page.
+   * Validates that required fields are filled before submitting.
+   */
+  function submitForm() {
+    var form = document.querySelector('main form')
+      || document.querySelector('[role="main"] form')
+      || document.querySelector('.container form');
+    if (!form) {
+      return { success: false, error: 'No form found in the main content area' };
+    }
+
+    // Validate required fields before submitting
+    var emptyRequired = [];
+    form.querySelectorAll('input, select, textarea').forEach(function (el) {
+      if (el.type === 'hidden' || el.type === 'submit' || el.type === 'button' || el.disabled) return;
+      var key = el.name || el.id;
+      if (!key) return;
+      if (el.required && !el.value) {
+        emptyRequired.push(key + ' (' + getFieldLabel(el) + ')');
+      } else if (el.tagName === 'SELECT' && el.selectedIndex === 0 && el.options[0] && !el.options[0].value) {
+        emptyRequired.push(key + ' (' + getFieldLabel(el) + ', no option selected)');
+      }
+    });
+    if (emptyRequired.length > 0) {
+      return {
+        success: false,
+        error: 'Cannot submit, these required fields are still empty: ' + emptyRequired.join(', '),
+        availableFields: fieldSummary()
+      };
+    }
+
+    var submitBtn = form.querySelector('button[type="submit"], input[type="submit"], button:not([type])');
+    if (submitBtn) {
+      submitBtn.click();
+    } else {
+      form.requestSubmit();
+    }
+
+    return { success: true, message: 'Form submitted' };
+  }
+
+  /**
+   * Click a button or link on the page by its visible text.
+   * Tries: exact text, partial text, aria-label, href, then word-level fuzzy.
+   */
+  function clickElement(args) {
+    // Resilient: accept text, name, label, button, or first string value
+    var text = (args.text || args.name || args.label || args.button || '').trim();
+    if (!text) {
+      var keys = Object.keys(args);
+      for (var k = 0; k < keys.length; k++) {
+        if (typeof args[keys[k]] === 'string' && args[keys[k]].trim()) {
+          text = args[keys[k]].trim();
+          break;
+        }
+      }
+    }
+    if (!text) return { success: false, error: 'No text provided' };
+
+    var lower = text.toLowerCase();
+    var mainEl = getMainEl();
+    var candidates = (mainEl || document).querySelectorAll('a, button, [role="button"]');
+
+    // Pass 1: Exact or partial text match (bidirectional)
+    for (var i = 0; i < candidates.length; i++) {
+      var el = candidates[i];
+      var elText = el.textContent.trim().toLowerCase();
+      if (elText === lower || elText.includes(lower) || lower.includes(elText)) {
+        el.click();
+        return { success: true, message: 'Clicked: ' + el.textContent.trim() };
+      }
+    }
+
+    // Pass 2: aria-label match
+    for (var j = 0; j < candidates.length; j++) {
+      var ariaLabel = (candidates[j].getAttribute('aria-label') || '').toLowerCase();
+      if (ariaLabel && (ariaLabel.includes(lower) || lower.includes(ariaLabel))) {
+        candidates[j].click();
+        return { success: true, message: 'Clicked: ' + candidates[j].textContent.trim() };
+      }
+    }
+
+    // Pass 3: If input looks like a URL path, find a link with that href
+    if (text.startsWith('/')) {
+      for (var u = 0; u < candidates.length; u++) {
+        var href = candidates[u].getAttribute('href') || '';
+        if (href === text || href.endsWith(text)) {
+          candidates[u].click();
+          return { success: true, message: 'Clicked: ' + candidates[u].textContent.trim() };
+        }
+      }
+    }
+
+    // Pass 4: Word-level fuzzy match (e.g. "New..." matches "New Site")
+    var words = lower.replace(/[_\-\.…]+/g, ' ').split(/\s+/).filter(Boolean);
+    if (words.length > 0) {
+      var bestMatch = null;
+      var bestScore = 0;
+      for (var f = 0; f < candidates.length; f++) {
+        if (candidates[f].disabled) continue;
+        var fieldText = (candidates[f].textContent.trim() + ' ' +
+          (candidates[f].getAttribute('aria-label') || '')).toLowerCase();
+        var score = 0;
+        words.forEach(function (w) { if (fieldText.includes(w)) score++; });
+        if (score > bestScore) {
+          bestScore = score;
+          bestMatch = candidates[f];
+        }
+      }
+      if (bestMatch && bestScore >= 1) {
+        bestMatch.click();
+        return { success: true, message: 'Clicked: ' + bestMatch.textContent.trim() };
+      }
+    }
+
+    // Collect available actions for error feedback
+    var available = [];
+    for (var a = 0; a < candidates.length; a++) {
+      var t = candidates[a].textContent.trim();
+      if (t && t.length < 80 && !candidates[a].disabled) available.push(t);
+    }
+    return {
+      success: false,
+      error: 'No clickable element found with text: ' + text,
+      availableActions: available
+    };
+  }
+
+  // --- Event listener for Ozwell tool calls ---
+  document.addEventListener('ozwell-tool-call', function (e) {
+    var detail = e.detail;
+    var name = detail.name;
+    var args = detail.arguments || {};
+    var respond = detail.respond;
+    var error = detail.error;
+
+    try {
+      if (name === 'get_page_contents') {
+        respond(getPageContents());
+      } else if (name === 'set_page_contents') {
+        respond(setPageContents(args));
+      } else if (name === 'submit_form') {
+        respond(submitForm());
+      } else if (name === 'click_element') {
+        respond(clickElement(args));
+      } else {
+        error('Unknown tool: ' + name);
+      }
+    } catch (err) {
+      error('Tool execution failed: ' + err.message);
+    }
+  });
+})();
diff --git a/create-a-container/public/style.css b/create-a-container/public/style.css
index c89a70a8..3d5a389d 100644
--- a/create-a-container/public/style.css
+++ b/create-a-container/public/style.css
@@ -277,6 +277,7 @@ select:focus {
 main {
   padding-top: 1rem;
   min-height: calc(100vh - 56px);
+  min-width: 0; /* Allow flex shrinking so sidebar+main don't wrap */
 }
 
 /* Site selector dropdown in sidebar */
diff --git a/create-a-container/routers/chatbot.js b/create-a-container/routers/chatbot.js
new file mode 100644
index 00000000..dda2be9d
--- /dev/null
+++ b/create-a-container/routers/chatbot.js
@@ -0,0 +1,283 @@
+const express = require('express');
+const crypto = require('crypto');
+const axios = require('axios');
+const { Transform } = require('stream');
+const { requireAuth } = require('../middlewares');
+const { Setting, SessionSecret } = require('../models');
+
+const router = express.Router();
+
+const TOKEN_TTL_MS = 60 * 60 * 1000; // 1 hour
+const REFRESH_MARGIN_MS = 10 * 60 * 1000; // refresh 10 min before expiry
+
+// --- HMAC token helpers ---
+
+async function getHmacKey() {
+  const secret = await SessionSecret.findOne({ order: [['createdAt', 'DESC']] });
+  if (!secret) throw new Error('No session secret available for HMAC signing');
+  return secret.secret;
+}
+
+function generateToken(userId, hmacKey) {
+  const payload = `${userId}:${Date.now()}`;
+  const hmac = crypto.createHmac('sha256', hmacKey).update(payload).digest('hex');
+  return Buffer.from(`${payload}:${hmac}`).toString('base64url');
+}
+
+function validateToken(token, hmacKey) {
+  try {
+    const decoded = Buffer.from(token, 'base64url').toString();
+    const lastColon = decoded.lastIndexOf(':');
+    const secondLastColon = decoded.lastIndexOf(':', lastColon - 1);
+    const userId = decoded.substring(0, secondLastColon);
+    const timestamp = parseInt(decoded.substring(secondLastColon + 1, lastColon), 10);
+    if (isNaN(timestamp)) return null;
+    const hmac = decoded.substring(lastColon + 1);
+
+    const expected = crypto.createHmac('sha256', hmacKey).update(`${userId}:${timestamp}`).digest('hex');
+    if (!crypto.timingSafeEqual(Buffer.from(hmac), Buffer.from(expected))) return null;
+    if (Date.now() - timestamp > TOKEN_TTL_MS) return null;
+
+    return { userId, timestamp };
+  } catch {
+    return null;
+  }
+}
+
+// --- SSE content filter ---
+// Strips hallucinated JSON tool-call text from LLM content responses.
+// Small models sometimes write tool calls as plain text instead of using
+// the function-calling mechanism, e.g. {"name":"set_page_contents",...}.
+// This transform buffers content when it looks like JSON is starting,
+// then discards the buffer if it matches a tool-call pattern.
+
+function createContentFilter() {
+  let jsonBuffer = '';
+  let braceDepth = 0;
+  let buffering = false;
+  // Accumulates text across SSE chunks to detect function-call-style hallucinations
+  let textAccumulator = '';
+
+  // Tool names the LLM might hallucinate as text
+  const toolNames = ['get_page_contents', 'set_page_contents', 'click_element', 'submit_form'];
+  const funcCallPattern = new RegExp(
+    '(' + toolNames.join('|') + ')\\s*\\(', 'i'
+  );
+
+  return new Transform({
+    transform(chunk, encoding, callback) {
+      const lines = chunk.toString().split('\n');
+      const output = [];
+
+      for (const line of lines) {
+        if (!line.startsWith('data: ') || line === 'data: [DONE]') {
+          output.push(line);
+          continue;
+        }
+
+        try {
+          const data = JSON.parse(line.substring(6));
+          const delta = data.choices?.[0]?.delta;
+          const content = delta?.content;
+
+          // Only filter text content (not tool_calls)
+          if (typeof content !== 'string' || delta.tool_calls) {
+            output.push(line);
+            continue;
+          }
+
+          // Track text across chunks to detect function-call syntax
+          textAccumulator += content;
+
+          // Check for function-call-style hallucinations (e.g. click_element("text"))
+          if (funcCallPattern.test(textAccumulator)) {
+            // Strip the hallucinated function call from content
+            data.choices[0].delta.content = '';
+            output.push('data: ' + JSON.stringify(data));
+            continue;
+          }
+          // Keep accumulator trimmed to last 60 chars
+          if (textAccumulator.length > 60) {
+            textAccumulator = textAccumulator.slice(-60);
+          }
+
+          // Process each character for JSON detection
+          let filtered = '';
+          for (let i = 0; i < content.length; i++) {
+            const ch = content[i];
+            if (!buffering && ch === '{') {
+              buffering = true;
+              braceDepth = 1;
+              jsonBuffer = ch;
+            } else if (buffering) {
+              jsonBuffer += ch;
+              if (ch === '{') braceDepth++;
+              else if (ch === '}') braceDepth--;
+
+              if (braceDepth === 0) {
+                // JSON block closed — check if it looks like a tool call
+                if (!/["']name["']/.test(jsonBuffer) || jsonBuffer.length < 10) {
+                  filtered += jsonBuffer; // Not a tool call, keep it
+                }
+                jsonBuffer = '';
+                buffering = false;
+              }
+            } else {
+              filtered += ch;
+            }
+          }
+
+          // Rewrite the SSE line with filtered content
+          if (filtered !== content) {
+            data.choices[0].delta.content = filtered;
+            output.push('data: ' + JSON.stringify(data));
+          } else {
+            output.push(line);
+          }
+        } catch {
+          output.push(line); // Unparseable, forward as-is
+        }
+      }
+
+      callback(null, output.join('\n'));
+    },
+
+    flush(callback) {
+      buffering = false;
+      jsonBuffer = '';
+      braceDepth = 0;
+      textAccumulator = '';
+      callback();
+    }
+  });
+}
+
+// --- Ozwell settings loader ---
+
+async function getOzwellSettings() {
+  const settings = await Setting.getMultiple(['ozwell_api_url', 'ozwell_agent_key']);
+  const apiUrl = (settings.ozwell_api_url || '').trim();
+  const agentKey = (settings.ozwell_agent_key || '').trim();
+  if (!apiUrl || !agentKey) return null;
+  return { apiUrl, agentKey };
+}
+
+// --- Token endpoint ---
+
+router.get('/token', requireAuth, async (req, res) => {
+  try {
+    const ozwell = await getOzwellSettings();
+    if (!ozwell) return res.status(404).json({ error: 'Chatbot not configured' });
+
+    const hmacKey = await getHmacKey();
+    const token = generateToken(req.session.user, hmacKey);
+
+    res.json({
+      token,
+      ozwellUrl: ozwell.apiUrl,
+      tokenTtlMs: TOKEN_TTL_MS,
+      refreshMs: TOKEN_TTL_MS - REFRESH_MARGIN_MS
+    });
+  } catch (err) {
+    console.error('Chatbot token generation failed:', err.message);
+    res.status(500).json({ error: 'Failed to generate chatbot token' });
+  }
+});
+
+// --- CORS middleware for proxy routes (Ozwell iframe needs cross-origin access) ---
+
+router.use('/v1', async (req, res, next) => {
+  try {
+    const ozwell = await getOzwellSettings();
+    if (!ozwell) return res.status(404).json({ error: 'Chatbot not configured' });
+
+    const origin = new URL(ozwell.apiUrl).origin;
+    res.setHeader('Access-Control-Allow-Origin', origin);
+    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+    res.setHeader('Access-Control-Max-Age', '3600');
+
+    // Store settings for downstream handlers
+    req.ozwellSettings = ozwell;
+    next();
+  } catch (err) {
+    console.error('Chatbot CORS middleware error:', err.message);
+    res.status(500).json({ error: 'Internal server error' });
+  }
+});
+
+// Handle CORS preflight
+router.options('/v1/{*path}', (req, res) => res.sendStatus(204));
+
+// --- Proxy middleware: validate token + forward to Ozwell ---
+
+router.all('/v1/{*path}', async (req, res) => {
+  try {
+    const authHeader = req.get('Authorization');
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+      return res.status(401).json({ error: 'Missing authorization token' });
+    }
+
+    const hmacKey = await getHmacKey();
+    const tokenData = validateToken(authHeader.substring(7), hmacKey);
+    if (!tokenData) {
+      return res.status(401).json({ error: 'Invalid or expired chatbot token' });
+    }
+
+    const { apiUrl, agentKey } = req.ozwellSettings;
+    // path-to-regexp 8.x returns wildcard as an array of segments
+    const pathSegments = req.params.path || [];
+    const subPath = Array.isArray(pathSegments) ? pathSegments.join('/') : pathSegments;
+    const targetUrl = `${apiUrl}/v1/${subPath}`;
+
+    const axiosConfig = {
+      method: req.method,
+      url: targetUrl,
+      params: req.query,
+      headers: {
+        'Authorization': `Bearer ${agentKey}`,
+        'Content-Type': req.get('Content-Type') || 'application/json',
+      },
+      // Stream the response for SSE support
+      responseType: 'stream',
+      // Don't throw on non-2xx so we can forward error responses
+      validateStatus: () => true,
+    };
+
+    // Forward request body for POST/PUT/PATCH
+    if (['POST', 'PUT', 'PATCH'].includes(req.method)) {
+      axiosConfig.data = req.body;
+      // Re-serialize body since express.json() already parsed it
+      if (req.is('application/json')) {
+        axiosConfig.data = JSON.stringify(req.body);
+        axiosConfig.headers['Content-Type'] = 'application/json';
+      }
+    }
+
+    const response = await axios(axiosConfig);
+
+    // Forward status and relevant headers
+    res.status(response.status);
+    const forwardHeaders = ['content-type', 'cache-control', 'x-request-id'];
+    for (const header of forwardHeaders) {
+      if (response.headers[header]) {
+        res.setHeader(header, response.headers[header]);
+      }
+    }
+
+    // Pipe the response stream through content filter for SSE, or directly for other responses
+    const isSSE = (response.headers['content-type'] || '').includes('text/event-stream');
+    if (isSSE) {
+      response.data.pipe(createContentFilter()).pipe(res);
+    } else {
+      response.data.pipe(res);
+    }
+  } catch (err) {
+    console.error('Chatbot proxy error:', err.message);
+    if (!res.headersSent) {
+      res.status(502).json({ error: 'Failed to reach chatbot service' });
+    }
+  }
+});
+
+module.exports = router;
diff --git a/create-a-container/routers/settings.js b/create-a-container/routers/settings.js
index 37d308a6..e949bdb8 100644
--- a/create-a-container/routers/settings.js
+++ b/create-a-container/routers/settings.js
@@ -11,7 +11,9 @@ router.get('/', async (req, res) => {
     'push_notification_url', 
     'push_notification_enabled',
     'smtp_url',
-    'smtp_noreply_address'
+    'smtp_noreply_address',
+    'ozwell_api_url',
+    'ozwell_agent_key'
   ]);
   
   res.render('settings/index', {
@@ -19,6 +21,8 @@ router.get('/', async (req, res) => {
     pushNotificationEnabled: settings.push_notification_enabled === 'true',
     smtpUrl: settings.smtp_url || '',
     smtpNoreplyAddress: settings.smtp_noreply_address || '',
+    ozwellApiUrl: settings.ozwell_api_url || '',
+    ozwellAgentKey: settings.ozwell_agent_key || '',
     req
   });
 });
@@ -28,7 +32,9 @@ router.post('/', async (req, res) => {
     push_notification_url, 
     push_notification_enabled,
     smtp_url,
-    smtp_noreply_address
+    smtp_noreply_address,
+    ozwell_api_url,
+    ozwell_agent_key
   } = req.body;
   
   const enabled = push_notification_enabled === 'on';
@@ -42,6 +48,8 @@ router.post('/', async (req, res) => {
   await Setting.set('push_notification_enabled', enabled ? 'true' : 'false');
   await Setting.set('smtp_url', smtp_url || '');
   await Setting.set('smtp_noreply_address', smtp_noreply_address || '');
+  await Setting.set('ozwell_api_url', ozwell_api_url || '');
+  await Setting.set('ozwell_agent_key', ozwell_agent_key || '');
   
   await req.flash('success', 'Settings saved successfully');
   return res.redirect('/settings');
diff --git a/create-a-container/server.js b/create-a-container/server.js
index 9053f29c..c6b75f9e 100644
--- a/create-a-container/server.js
+++ b/create-a-container/server.js
@@ -134,7 +134,9 @@ async function main() {
   const settingsRouter = require('./routers/settings');
   const apikeysRouter = require('./routers/apikeys');
   const resetPasswordRouter = require('./routers/reset-password');
+  const chatbotRouter = require('./routers/chatbot');
   
+  app.use('/api/chatbot', chatbotRouter);
   app.use('/jobs', jobsRouter);
   app.use('/login', loginRouter);
   app.use('/register', registerRouter);
diff --git a/create-a-container/views/containers/form.ejs b/create-a-container/views/containers/form.ejs
index 4a4f81c4..694fe93d 100644
--- a/create-a-container/views/containers/form.ejs
+++ b/create-a-container/views/containers/form.ejs
@@ -176,13 +176,11 @@ const breadcrumbLabel = isEdit ? 'Edit' : 'New';
       if (this.value === 'custom') {
         customTemplateContainer.style.display = 'block';
         customTemplateInput.required = true;
-        this.removeAttribute('name'); // Don't submit the select value
       } else if (this.value) {
         // Standard image selected (not empty and not custom)
         customTemplateContainer.style.display = 'none';
         customTemplateInput.required = false;
         customTemplateInput.value = '';
-        this.setAttribute('name', 'template'); // Submit select value
         
         // Fetch metadata for standard image
         await fetchAndPopulateMetadata(this.value, this);
@@ -191,7 +189,6 @@ const breadcrumbLabel = isEdit ? 'Edit' : 'New';
         customTemplateContainer.style.display = 'none';
         customTemplateInput.required = false;
         customTemplateInput.value = '';
-        this.setAttribute('name', 'template'); // Submit select value
       }
     });
   }
diff --git a/create-a-container/views/external-domains/index.ejs b/create-a-container/views/external-domains/index.ejs
index de250ce2..18ed632d 100644
--- a/create-a-container/views/external-domains/index.ejs
+++ b/create-a-container/views/external-domains/index.ejs
@@ -14,15 +14,15 @@
     </div>
 
     <div class="table-responsive">
-      <table class="table table-hover table-bordered align-middle mb-0">
+      <table class="table table-hover table-bordered align-middle mb-0 table-sm">
         <thead class="table-light">
           <tr>
             <th>Domain Name</th>
             <th>Default Site</th>
             <th>ACME Email</th>
             <th>ACME Directory</th>
-            <th>Cloudflare API Email</th>
-            <th>Actions</th>
+            <th>Cloudflare Email</th>
+            <th class="text-nowrap">Actions</th>
           </tr>
         </thead>
         <tbody>
@@ -31,10 +31,10 @@
               <tr>
                 <td><strong><%= domain.name %></strong></td>
                 <td><%= domain.defaultSite || '-' %></td>
-                <td><%= domain.acmeEmail || '-' %></td>
-                <td><small class="text-muted"><%= domain.acmeDirectoryUrl || '-' %></small></td>
-                <td><%= domain.cloudflareApiEmail || '-' %></td>
-                <td>
+                <td class="text-break"><%= domain.acmeEmail || '-' %></td>
+                <td><small class="text-muted text-break"><%= domain.acmeDirectoryUrl || '-' %></small></td>
+                <td class="text-break"><%= domain.cloudflareApiEmail || '-' %></td>
+                <td class="text-nowrap">
                   <a href="/external-domains/<%= domain.id %>/edit" class="btn btn-sm btn-outline-primary" aria-label="Edit domain <%= domain.name %>">Edit</a>
                   <form method="POST" action="/external-domains/<%= domain.id %>" style="display: inline;" onsubmit="return confirm('Are you sure you want to delete <%= domain.name %>? This action cannot be undone.');">
                     <input type="hidden" name="_method" value="DELETE">
diff --git a/create-a-container/views/layouts/footer.ejs b/create-a-container/views/layouts/footer.ejs
index c713a198..ae89a240 100644
--- a/create-a-container/views/layouts/footer.ejs
+++ b/create-a-container/views/layouts/footer.ejs
@@ -27,5 +27,149 @@
     const popoverTriggerList = document.querySelectorAll('[data-bs-toggle="popover"]');
     const popoverList = [...popoverTriggerList].map(popoverTriggerEl => new bootstrap.Popover(popoverTriggerEl));
   </script>
+
+  <% if (req.session && req.session.user) { %>
+  <style>
+    /* Replace Ozwell's default /favicon.ico icon with a chat bubble SVG */
+    #ozwell-chat-button .ozwell-chat-icon {
+      content: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='white'%3E%3Cpath d='M20 2H4c-1.1 0-2 .9-2 2v18l4-4h14c1.1 0 2-.9 2-2V4c0-1.1-.9-2-2-2zm0 14H5.2L4 17.2V4h16v12z'/%3E%3C/svg%3E");
+    }
+  </style>
+  <script>
+    (function () {
+      var TOOL_DEFS = [
+        {
+          type: 'function',
+          function: {
+            name: 'get_page_contents',
+            description: 'Reads the current page. Returns the page title, URL, structured form fields (name, type, value, options), and the full visible text content of the page (tables, headings, buttons, logs, metadata — everything the user can see). Always call this first to understand what is on the page before taking action.',
+            parameters: { type: 'object', properties: {} }
+          }
+        },
+        {
+          type: 'function',
+          function: {
+            name: 'set_page_contents',
+            description: 'Updates form field values on the current page. Field names are matched fuzzily — you can use the exact name attribute or descriptive words from the label. Set submit to true to submit the form after filling. Returns which fields were updated, which failed, and lists all available fields.',
+            parameters: {
+              type: 'object',
+              properties: {
+                fields: {
+                  type: 'object',
+                  description: 'Key-value pairs mapping field names to new values. For checkboxes use true/false. For selects use the option text (partial match supported).',
+                  additionalProperties: { type: 'string' }
+                },
+                submit: {
+                  type: 'boolean',
+                  description: 'If true, submit the form after setting all fields. Only submits if all fields were set successfully.'
+                }
+              },
+              required: ['fields']
+            }
+          }
+        },
+        {
+          type: 'function',
+          function: {
+            name: 'submit_form',
+            description: 'Submits the form on the current page. Use after setting field values. The page will navigate on success.',
+            parameters: { type: 'object', properties: {} }
+          }
+        },
+        {
+          type: 'function',
+          function: {
+            name: 'click_element',
+            description: 'Clicks a button or link on the page by its visible text. Use for navigation or triggering actions.',
+            parameters: {
+              type: 'object',
+              properties: {
+                text: { type: 'string', description: 'The visible text of the button or link to click.' }
+              },
+              required: ['text']
+            }
+          }
+        }
+      ];
+
+      function loadScript(src) {
+        return new Promise(function (resolve, reject) {
+          var s = document.createElement('script');
+          s.src = src;
+          s.onload = resolve;
+          s.onerror = reject;
+          document.body.appendChild(s);
+        });
+      }
+
+      function initChatbot(token, ozwellUrl, refreshMs) {
+        window.OzwellChatConfig = {
+          apiKey: token,
+          endpoint: window.location.origin + '/api/chatbot/v1/chat/completions',
+          title: 'MIE Assistant',
+          tools: TOOL_DEFS
+        };
+
+        // Load tool handlers and widget loader in parallel
+        Promise.all([
+          loadScript('/js/chatbot-tools.js'),
+          loadScript(ozwellUrl + '/embed/ozwell-loader.js')
+        ]).catch(function (err) {
+          console.warn('Chatbot widget failed to load:', err);
+        });
+
+        // Schedule token refresh
+        if (refreshMs > 0) {
+          setTimeout(function () { refreshToken(ozwellUrl); }, refreshMs);
+        }
+      }
+
+      function refreshToken(ozwellUrl) {
+        fetch('/api/chatbot/token', { credentials: 'same-origin' })
+          .then(function (r) {
+            if (r.status === 401) return null; // session expired
+            if (!r.ok) throw new Error('Token refresh failed');
+            return r.json();
+          })
+          .then(function (data) {
+            if (!data) return; // session expired, stop refreshing
+            if (typeof OzwellChat !== 'undefined' && OzwellChat.configure) {
+              OzwellChat.configure({ apiKey: data.token });
+            }
+            if (data.refreshMs > 0) {
+              setTimeout(function () { refreshToken(ozwellUrl); }, data.refreshMs);
+            }
+          })
+          .catch(function (err) {
+            console.warn('Chatbot token refresh failed:', err);
+            // Retry once after 30 seconds
+            setTimeout(function () {
+              fetch('/api/chatbot/token', { credentials: 'same-origin' })
+                .then(function (r) { return r.ok ? r.json() : null; })
+                .then(function (data) {
+                  if (data && typeof OzwellChat !== 'undefined' && OzwellChat.configure) {
+                    OzwellChat.configure({ apiKey: data.token });
+                    if (data.refreshMs > 0) {
+                      setTimeout(function () { refreshToken(ozwellUrl); }, data.refreshMs);
+                    }
+                  }
+                })
+                .catch(function () {}); // give up silently
+            }, 30000);
+          });
+      }
+
+      // Fetch initial token and bootstrap the widget
+      fetch('/api/chatbot/token', { credentials: 'same-origin' })
+        .then(function (r) { return r.ok ? r.json() : null; })
+        .then(function (data) {
+          if (data && data.token && data.ozwellUrl) {
+            initChatbot(data.token, data.ozwellUrl, data.refreshMs || 0);
+          }
+        })
+        .catch(function () {}); // chatbot not available, fail silently
+    })();
+  </script>
+  <% } %>
 </body>
 </html>
diff --git a/create-a-container/views/settings/index.ejs b/create-a-container/views/settings/index.ejs
index 104fe800..e6d3ddda 100644
--- a/create-a-container/views/settings/index.ejs
+++ b/create-a-container/views/settings/index.ejs
@@ -92,6 +92,46 @@
         </div>
       </div>
 
+      <div class="mb-4">
+        <h5 class="mb-3">Ozwell Chatbot</h5>
+        
+        <div class="mb-3">
+          <label for="ozwell_api_url" class="form-label">
+            Ozwell API URL
+          </label>
+          <input 
+            type="url" 
+            class="form-control font-monospace" 
+            id="ozwell_api_url" 
+            name="ozwell_api_url" 
+            value="<%= ozwellApiUrl %>"
+            placeholder="https://ozwell-dev-refserver.opensource.mieweb.org"
+            aria-describedby="ozwell_api_url_help"
+          >
+          <div id="ozwell_api_url_help" class="form-text">
+            Base URL for the Ozwell API server. Leave blank to disable the chatbot.
+          </div>
+        </div>
+
+        <div class="mb-3">
+          <label for="ozwell_agent_key" class="form-label">
+            Ozwell Agent Key
+          </label>
+          <input 
+            type="password" 
+            class="form-control font-monospace" 
+            id="ozwell_agent_key" 
+            name="ozwell_agent_key" 
+            value="<%= ozwellAgentKey %>"
+            placeholder="agnt_key-..."
+            aria-describedby="ozwell_agent_key_help"
+          >
+          <div id="ozwell_agent_key_help" class="form-text">
+            Agent key from Ozwell. Create an agent via the Ozwell API and paste the returned key here.
+          </div>
+        </div>
+      </div>
+
       <div class="d-flex gap-2">
         <button type="submit" class="btn btn-primary" aria-label="Save settings">
           Save Settings