diff --git a/Cargo.toml b/Cargo.toml
index e7470fc..49391f4 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -34,6 +34,7 @@ futures = "0.3"
 # For tool implementations
 walkdir = "2"
 urlencoding = "2"
+url = "2"
 anyhow = "1"
 async-stream = "0.3"
 regex = "1"
diff --git a/dashboard/src/app/control/control-client.tsx b/dashboard/src/app/control/control-client.tsx
index eea8601..e81e91c 100644
--- a/dashboard/src/app/control/control-client.tsx
+++ b/dashboard/src/app/control/control-client.tsx
@@ -27,6 +27,7 @@ import {
   getModelDisplayName,
   filterAndSortModels,
   getModelCategory,
+  getHealth,
   type ControlRunState,
   type Mission,
   type MissionStatus,
@@ -423,6 +424,9 @@ export default function ControlClient() {
   // Model selection state
   const [availableModels, setAvailableModels] = useState<string[]>([]);
 
+  // Server configuration (fetched from health endpoint)
+  const [maxIterations, setMaxIterations] = useState<number>(50); // Default fallback
+
   // Check if the mission we're viewing is actually running (not just any mission)
   const viewingMissionIsRunning = useMemo(() => {
     if (!viewingMissionId) return runState !== "idle";
@@ -706,6 +710,19 @@ export default function ControlClient() {
       });
   }, []);
 
+  // Fetch server configuration (max_iterations) from health endpoint
+  useEffect(() => {
+    getHealth()
+      .then((data) => {
+        if (data.max_iterations) {
+          setMaxIterations(data.max_iterations);
+        }
+      })
+      .catch((err) => {
+        console.error("Failed to fetch health:", err);
+      });
+  }, []);
+
   // Handle cancelling a parallel mission
   const handleCancelMission = async (missionId: string) => {
     try {
@@ -1520,7 +1537,7 @@ export default function ControlClient() {
                       {currentMission.status === "interrupted" ? (
                         <>This mission was interrupted (server shutdown or cancellation). Click the <strong className="text-amber-400">Resume</strong> button in the mission menu to continue where you left off.</>
                       ) : currentMission.status === "blocked" ? (
-                        <>The agent reached its iteration limit (50). You can continue the mission to give it more iterations.</>
+                        <>The agent reached its iteration limit ({maxIterations}). You can continue the mission to give it more iterations.</>
                       ) : (
                         <>This mission was {currentMission.status} without any messages.
                         {currentMission.status === "completed" && " You can reactivate it to continue."}</>
@@ -1831,7 +1848,7 @@ export default function ControlClient() {
                     <Clock className="h-5 w-5 text-amber-400" />
                     <div className="text-sm">
                       <span className="text-amber-400 font-medium">Iteration limit reached</span>
-                      <span className="text-white/50 ml-1">— Agent used all 50 iterations</span>
+                      <span className="text-white/50 ml-1">— Agent used all {maxIterations} iterations</span>
                     </div>
                     <button
                       onClick={handleResumeMission}
diff --git a/dashboard/src/lib/api.ts b/dashboard/src/lib/api.ts
index fd3e9c8..d284f3f 100644
--- a/dashboard/src/lib/api.ts
+++ b/dashboard/src/lib/api.ts
@@ -38,6 +38,7 @@ export interface HealthResponse {
   version: string;
   dev_mode: boolean;
   auth_required: boolean;
+  max_iterations: number;
 }
 
 export interface LoginResponse {
@@ -775,10 +776,10 @@ export function uploadFile(
     
     xhr.open("POST", url);
     
-    // Add auth header
-    const token = typeof window !== "undefined" ? sessionStorage.getItem("token") : null;
-    if (token) {
-      xhr.setRequestHeader("Authorization", `Bearer ${token}`);
+    // Add auth header using the same method as other API calls
+    const headers = authHeader();
+    if (headers.Authorization) {
+      xhr.setRequestHeader("Authorization", headers.Authorization);
     }
     
     const formData = new FormData();
@@ -925,13 +926,22 @@ export async function downloadFromUrl(
   return res.json();
 }
 
-// Format bytes for display
+// Format bytes for display (handles up to petabyte scale)
 export function formatBytes(bytes: number): string {
+  if (!Number.isFinite(bytes) || bytes < 0) return "-";
   if (bytes === 0) return "0 B";
-  const k = 1024;
-  const sizes = ["B", "KB", "MB", "GB"];
-  const i = Math.floor(Math.log(bytes) / Math.log(k));
-  return `${(bytes / Math.pow(k, i)).toFixed(1)} ${sizes[i]}`;
+  if (bytes < 1024) return `${bytes} B`;
+  
+  const units = ["KB", "MB", "GB", "TB", "PB"] as const;
+  let value = bytes / 1024;
+  let unitIndex = 0;
+  
+  while (value >= 1024 && unitIndex < units.length - 1) {
+    value /= 1024;
+    unitIndex++;
+  }
+  
+  return `${value.toFixed(value >= 10 ? 0 : 1)} ${units[unitIndex]}`;
 }
 
 // ==================== Models ====================
diff --git a/src/agents/mod.rs b/src/agents/mod.rs
index 66004c4..eb5a9a0 100644
--- a/src/agents/mod.rs
+++ b/src/agents/mod.rs
@@ -17,30 +17,30 @@
 //! - Blocker detection via system prompt rules
 //! - Mission completion via complete_mission tool
 
-mod types;
 mod context;
+pub mod leaf;
+pub mod orchestrator; // TODO: Remove after migration
+mod simple;
 mod tree;
 pub mod tuning;
-pub mod orchestrator;  // TODO: Remove after migration
-pub mod leaf;
-mod simple;
+mod types;
 
 pub use simple::SimpleAgent;
 
-pub use types::{AgentId, AgentType, AgentResult, AgentError, Complexity, TerminalReason};
 pub use context::AgentContext;
-pub use tree::{AgentTree, AgentRef};
+pub use tree::{AgentRef, AgentTree};
 pub use tuning::TuningParams;
+pub use types::{AgentError, AgentId, AgentResult, AgentType, Complexity};
 
-use async_trait::async_trait;
 use crate::task::Task;
+use async_trait::async_trait;
 
 /// Base trait for all agents.
-/// 
+///
 /// # Invariants
 /// - `execute()` returns `Ok` only if the task was actually completed or delegated
 /// - `execute()` never panics; all errors are returned as `Err`
-/// 
+///
 /// # Design for Provability
 /// - Preconditions and postconditions are documented
 /// - Pure functions are preferred where possible
@@ -53,15 +53,15 @@ pub trait Agent: Send + Sync {
     fn agent_type(&self) -> AgentType;
 
     /// Execute a task.
-    /// 
+    ///
     /// # Preconditions
     /// - `task.budget().remaining_cents() > 0` (has budget)
     /// - `task.status() == Pending || task.status() == Running`
-    /// 
+    ///
     /// # Postconditions
     /// - On success: task is completed or delegated appropriately
     /// - `result.cost_cents <= task.budget().total_cents()`
-    /// 
+    ///
     /// # Errors
     /// Returns `Err` if:
     /// - Task cannot be executed (insufficient budget, invalid state)
@@ -75,7 +75,7 @@ pub trait Agent: Send + Sync {
 }
 
 /// Trait for orchestrator agents (Root and Node) that can have children.
-/// 
+///
 /// # Child Management
 /// Orchestrators can delegate work to child agents.
 #[async_trait]
@@ -87,26 +87,22 @@ pub trait OrchestratorAgent: Agent {
     fn find_child(&self, agent_type: AgentType) -> Option<AgentRef>;
 
     /// Delegate a task to a specific child.
-    /// 
+    ///
     /// # Preconditions
     /// - Child exists and is capable of handling the task
     /// - Task has sufficient budget
-    /// 
+    ///
     /// # Postconditions
     /// - Child's execute() is called
     /// - Results are aggregated and returned
     async fn delegate(&self, task: &mut Task, child: AgentRef, ctx: &AgentContext) -> AgentResult;
 
     /// Delegate multiple tasks to appropriate children.
-    /// 
+    ///
     /// # Preconditions
     /// - Sum of task budgets <= available budget
     /// - All tasks can be matched to capable children
-    async fn delegate_all(
-        &self,
-        tasks: &mut [Task],
-        ctx: &AgentContext,
-    ) -> Vec<AgentResult>;
+    async fn delegate_all(&self, tasks: &mut [Task], ctx: &AgentContext) -> Vec<AgentResult>;
 }
 
 /// Trait for leaf agents with specialized capabilities.
@@ -120,13 +116,13 @@ pub trait LeafAgent: Agent {
 pub enum LeafCapability {
     /// Can estimate task complexity
     ComplexityEstimation,
-    
+
     /// Can select optimal model for a task
     ModelSelection,
-    
+
     /// Can execute tasks using tools
     TaskExecution,
-    
+
     /// Can verify task completion
     Verification,
 }
@@ -142,4 +138,3 @@ impl LeafCapability {
         }
     }
 }
-
diff --git a/src/agents/simple.rs b/src/agents/simple.rs
index 6c55508..0c9dff9 100644
--- a/src/agents/simple.rs
+++ b/src/agents/simple.rs
@@ -171,7 +171,6 @@ impl Agent for SimpleAgent {
                 "agent": "SimpleAgent",
                 "execution": result.data,
             })),
-            terminal_reason: result.terminal_reason,
         }
     }
 }
diff --git a/src/agents/types.rs b/src/agents/types.rs
index 48a50bb..be964c5 100644
--- a/src/agents/types.rs
+++ b/src/agents/types.rs
@@ -60,27 +60,8 @@ impl AgentType {
     }
 }
 
-/// Reason why agent execution terminated (for non-successful completions).
-/// 
-/// Used to determine whether auto-complete should trigger, avoiding substring matching.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-pub enum TerminalReason {
-    /// Agent hit the maximum iteration limit
-    MaxIterations,
-    /// Agent was cancelled by user
-    Cancelled,
-    /// Budget was exhausted
-    BudgetExhausted,
-    /// Agent stalled (no progress, timeouts)
-    Stalled,
-    /// Agent got stuck in an infinite loop
-    InfiniteLoop,
-    /// LLM API error
-    LlmError,
-}
-
 /// Result of an agent executing a task.
-/// 
+///
 /// # Invariants
 /// - If `success == true`, the task was completed
 /// - `cost_cents` reflects actual cost incurred
@@ -88,23 +69,18 @@ pub enum TerminalReason {
 pub struct AgentResult {
     /// Whether the task was successful
     pub success: bool,
-    
+
     /// Output or response from the agent
     pub output: String,
-    
+
     /// Cost incurred in cents
     pub cost_cents: u64,
-    
+
     /// Model used (if any)
     pub model_used: Option<String>,
-    
+
     /// Detailed result data (type-specific)
     pub data: Option<serde_json::Value>,
-    
-    /// If execution ended due to a terminal condition (not normal completion),
-    /// this indicates why. Used by auto-complete logic to avoid substring matching.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub terminal_reason: Option<TerminalReason>,
 }
 
 impl AgentResult {
@@ -116,7 +92,6 @@ impl AgentResult {
             cost_cents,
             model_used: None,
             data: None,
-            terminal_reason: None,
         }
     }
 
@@ -128,7 +103,6 @@ impl AgentResult {
             cost_cents,
             model_used: None,
             data: None,
-            terminal_reason: None,
         }
     }
 
@@ -143,16 +117,10 @@ impl AgentResult {
         self.data = Some(data);
         self
     }
-    
-    /// Set the terminal reason (why execution ended abnormally).
-    pub fn with_terminal_reason(mut self, reason: TerminalReason) -> Self {
-        self.terminal_reason = Some(reason);
-        self
-    }
 }
 
 /// Complexity estimation for a task.
-/// 
+///
 /// # Invariants
 /// - `score` is in range [0.0, 1.0]
 /// - `should_split` is derived from score threshold
@@ -160,23 +128,23 @@ impl AgentResult {
 pub struct Complexity {
     /// Complexity score: 0.0 = trivial, 1.0 = extremely complex
     score: f64,
-    
+
     /// Human-readable explanation
     reasoning: String,
-    
+
     /// Whether the task should be split into subtasks
     should_split: bool,
-    
+
     /// Estimated token count for this task
     estimated_tokens: u64,
 }
 
 impl Complexity {
     /// Create a new complexity estimate.
-    /// 
+    ///
     /// # Preconditions
     /// - `score` is in [0.0, 1.0] (will be clamped if not)
-    /// 
+    ///
     /// # Postconditions
     /// - `self.score` is in [0.0, 1.0]
     /// - `self.should_split` is true if score > threshold (0.6)
@@ -240,25 +208,25 @@ impl Complexity {
 pub enum AgentError {
     #[error("Task error: {0}")]
     TaskError(String),
-    
+
     #[error("Budget exhausted: needed {needed} cents, had {available} cents")]
     BudgetExhausted { needed: u64, available: u64 },
-    
+
     #[error("No capable agent found for task")]
     NoCapableAgent,
-    
+
     #[error("LLM error: {0}")]
     LlmError(String),
-    
+
     #[error("Tool error: {0}")]
     ToolError(String),
-    
+
     #[error("Verification failed: {0}")]
     VerificationFailed(String),
-    
+
     #[error("Max iterations reached: {0}")]
     MaxIterations(usize),
-    
+
     #[error("Internal error: {0}")]
     Internal(String),
 }
@@ -277,4 +245,3 @@ impl From<crate::budget::BudgetError> for AgentError {
         }
     }
 }
-
diff --git a/src/api/fs.rs b/src/api/fs.rs
index 8db30f4..ca9c34e 100644
--- a/src/api/fs.rs
+++ b/src/api/fs.rs
@@ -3,6 +3,7 @@
 //! Note: uploads/downloads use `sftp` for transfer performance; directory listing uses `ssh` to run a small
 //! Python snippet that returns JSON (easier/safer than parsing `sftp ls` output).
 
+use std::net::IpAddr;
 use std::sync::Arc;
 
 use axum::{
@@ -24,6 +25,112 @@ fn is_localhost(host: &str) -> bool {
     matches!(host, "localhost" | "127.0.0.1" | "::1")
 }
 
+/// Sanitize a path component to prevent path traversal attacks.
+/// Removes directory separators and path traversal sequences.
+fn sanitize_path_component(s: &str) -> String {
+    // Take only the filename portion (after any path separator)
+    let filename = s.rsplit(|c| c == '/' || c == '\\').next().unwrap_or(s);
+
+    // Remove any remaining path traversal patterns and null bytes
+    filename
+        .replace("..", "")
+        .replace('\0', "")
+        .trim()
+        .to_string()
+}
+
+/// Validate a URL to prevent SSRF attacks.
+/// Blocks requests to:
+/// - localhost and loopback addresses (127.0.0.0/8, ::1)
+/// - Private network ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
+/// - Link-local addresses (169.254.0.0/16, fe80::/10)
+/// - Cloud metadata endpoints (169.254.169.254)
+fn validate_url_for_ssrf(url: &str) -> Result<(), String> {
+    let parsed = url::Url::parse(url).map_err(|e| format!("Invalid URL: {}", e))?;
+
+    // Only allow http and https schemes
+    match parsed.scheme() {
+        "http" | "https" => {}
+        other => return Err(format!("Disallowed URL scheme: {}", other)),
+    }
+
+    // Get the host
+    let host = parsed
+        .host_str()
+        .ok_or_else(|| "URL has no host".to_string())?;
+
+    // Check for localhost variants
+    let host_lower = host.to_lowercase();
+    if host_lower == "localhost" || host_lower.ends_with(".localhost") || host_lower == "0.0.0.0" {
+        return Err("Requests to localhost are not allowed".to_string());
+    }
+
+    // Try to parse as IP address
+    if let Ok(ip) = host.parse::<IpAddr>() {
+        if is_internal_ip(&ip) {
+            return Err(format!(
+                "Requests to internal IP addresses are not allowed: {}",
+                ip
+            ));
+        }
+    }
+
+    // Try DNS resolution to catch DNS rebinding attacks
+    // (hostname that resolves to internal IP)
+    if let Ok(addrs) = std::net::ToSocketAddrs::to_socket_addrs(&(host, 80u16)) {
+        for addr in addrs {
+            if is_internal_ip(&addr.ip()) {
+                return Err(format!(
+                    "URL resolves to internal IP address: {}",
+                    addr.ip()
+                ));
+            }
+        }
+    }
+
+    Ok(())
+}
+
+/// Check if an IP address is internal/private
+fn is_internal_ip(ip: &IpAddr) -> bool {
+    match ip {
+        IpAddr::V4(ipv4) => {
+            // Loopback (127.0.0.0/8)
+            ipv4.is_loopback()
+            // Private networks
+            || ipv4.is_private()
+            // Link-local (169.254.0.0/16)
+            || ipv4.is_link_local()
+            // Broadcast
+            || ipv4.is_broadcast()
+            // Documentation ranges (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24)
+            || ipv4.is_documentation()
+            // Cloud metadata endpoint (169.254.169.254)
+            || ipv4.octets() == [169, 254, 169, 254]
+            // Unspecified (0.0.0.0)
+            || ipv4.is_unspecified()
+        }
+        IpAddr::V6(ipv6) => {
+            // Loopback (::1)
+            ipv6.is_loopback()
+            // Unspecified (::)
+            || ipv6.is_unspecified()
+            // IPv4-mapped addresses - check the embedded IPv4
+            || {
+                if let Some(ipv4) = ipv6.to_ipv4_mapped() {
+                    is_internal_ip(&IpAddr::V4(ipv4))
+                } else {
+                    false
+                }
+            }
+            // Unique local addresses (fc00::/7) - private in IPv6
+            || (ipv6.segments()[0] & 0xfe00) == 0xfc00
+            // Link-local (fe80::/10)
+            || (ipv6.segments()[0] & 0xffc0) == 0xfe80
+        }
+    }
+}
+
 #[derive(Debug, Deserialize)]
 pub struct PathQuery {
     pub path: String,
@@ -83,12 +190,22 @@ except FileNotFoundError:
 print(json.dumps(out))
 "#;
 
-async fn get_key_and_cfg(state: &Arc<AppState>) -> Result<(crate::config::ConsoleSshConfig, super::ssh_util::TempKeyFile), (StatusCode, String)> {
+async fn get_key_and_cfg(
+    state: &Arc<AppState>,
+) -> Result<
+    (
+        crate::config::ConsoleSshConfig,
+        super::ssh_util::TempKeyFile,
+    ),
+    (StatusCode, String),
+> {
     let cfg = state.config.console_ssh.clone();
-    let key = cfg
-        .private_key
-        .as_deref()
-        .ok_or_else(|| (StatusCode::SERVICE_UNAVAILABLE, "Console SSH not configured".to_string()))?;
+    let key = cfg.private_key.as_deref().ok_or_else(|| {
+        (
+            StatusCode::SERVICE_UNAVAILABLE,
+            "Console SSH not configured".to_string(),
+        )
+    })?;
     let key_file = materialize_private_key(key)
         .await
         .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
@@ -117,27 +234,31 @@ pub async fn list(
         &vec!["-".into(), q.path.clone()],
         LIST_SCRIPT,
     )
-        .await
-        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+    .await
+    .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
 
-    let parsed = serde_json::from_str::<Vec<FsEntry>>(&out)
-        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("parse error: {}", e)))?;
+    let parsed = serde_json::from_str::<Vec<FsEntry>>(&out).map_err(|e| {
+        (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            format!("parse error: {}", e),
+        )
+    })?;
     Ok(Json(parsed))
 }
 
 /// List directory contents locally (for localhost optimization)
 async fn list_directory_local(path: &str) -> anyhow::Result<Vec<FsEntry>> {
     use std::os::unix::fs::MetadataExt;
-    
+
     let mut entries = Vec::new();
     let mut dir = tokio::fs::read_dir(path).await?;
-    
+
     while let Some(entry) = dir.next_entry().await? {
         let metadata = match entry.metadata().await {
             Ok(m) => m,
             Err(_) => continue,
         };
-        
+
         let kind = if metadata.is_dir() {
             "dir"
         } else if metadata.is_symlink() {
@@ -147,9 +268,9 @@ async fn list_directory_local(path: &str) -> anyhow::Result<Vec<FsEntry>> {
         } else {
             "other"
         };
-        
+
         let mtime = metadata.mtime();
-        
+
         entries.push(FsEntry {
             name: entry.file_name().to_string_lossy().to_string(),
             path: entry.path().to_string_lossy().to_string(),
@@ -158,7 +279,7 @@ async fn list_directory_local(path: &str) -> anyhow::Result<Vec<FsEntry>> {
             mtime,
         });
     }
-    
+
     Ok(entries)
 }
 
@@ -167,7 +288,7 @@ pub async fn mkdir(
     Json(req): Json<MkdirRequest>,
 ) -> Result<Json<serde_json::Value>, (StatusCode, String)> {
     let (cfg, key_file) = get_key_and_cfg(&state).await?;
-    
+
     // Optimization: if SSH target is localhost, create directory directly
     if is_localhost(&cfg.host) {
         tokio::fs::create_dir_all(&req.path)
@@ -175,7 +296,7 @@ pub async fn mkdir(
             .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
         return Ok(Json(serde_json::json!({ "ok": true })));
     }
-    
+
     ssh_exec(&cfg, key_file.path(), "mkdir", &vec!["-p".into(), req.path])
         .await
         .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
@@ -188,7 +309,7 @@ pub async fn rm(
 ) -> Result<Json<serde_json::Value>, (StatusCode, String)> {
     let (cfg, key_file) = get_key_and_cfg(&state).await?;
     let recursive = req.recursive.unwrap_or(false);
-    
+
     // Optimization: if SSH target is localhost, delete directly
     if is_localhost(&cfg.host) {
         if recursive {
@@ -202,7 +323,7 @@ pub async fn rm(
         }
         return Ok(Json(serde_json::json!({ "ok": true })));
     }
-    
+
     let mut args = vec![];
     if recursive {
         args.push("-rf".to_string());
@@ -230,7 +351,10 @@ pub async fn download(
             .parse()
             .unwrap(),
     );
-    headers.insert(header::CONTENT_TYPE, "application/octet-stream".parse().unwrap());
+    headers.insert(
+        header::CONTENT_TYPE,
+        "application/octet-stream".parse().unwrap(),
+    );
 
     // Optimization: if SSH target is localhost, read file directly
     if is_localhost(&cfg.host) {
@@ -278,7 +402,10 @@ pub async fn upload(
         .await
         .map_err(|e| (StatusCode::BAD_REQUEST, e.to_string()))?
     {
-        let file_name = field.file_name().map(|s| s.to_string()).unwrap_or_else(|| "upload.bin".to_string());
+        let file_name = field
+            .file_name()
+            .map(|s| s.to_string())
+            .unwrap_or_else(|| "upload.bin".to_string());
         // Stream to temp file first (avoid buffering large uploads in memory).
         let tmp = std::env::temp_dir().join(format!("open_agent_ul_{}", uuid::Uuid::new_v4()));
         let mut f = tokio::fs::File::create(&tmp)
@@ -315,22 +442,33 @@ pub async fn upload(
         // Optimization: if SSH target is localhost, skip SFTP and use direct file operations
         if is_localhost(&cfg.host) {
             // Direct local file operations (much faster than SFTP to self)
-            tokio::fs::create_dir_all(&target_dir)
-                .await
-                .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Failed to create directory: {}", e)))?;
-            
+            tokio::fs::create_dir_all(&target_dir).await.map_err(|e| {
+                (
+                    StatusCode::INTERNAL_SERVER_ERROR,
+                    format!("Failed to create directory: {}", e),
+                )
+            })?;
+
             // Try rename first (fast), fall back to copy+delete if across filesystems
             if tokio::fs::rename(&tmp, &remote_path).await.is_err() {
-                tokio::fs::copy(&tmp, &remote_path)
-                    .await
-                    .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Failed to copy file: {}", e)))?;
+                tokio::fs::copy(&tmp, &remote_path).await.map_err(|e| {
+                    (
+                        StatusCode::INTERNAL_SERVER_ERROR,
+                        format!("Failed to copy file: {}", e),
+                    )
+                })?;
                 let _ = tokio::fs::remove_file(&tmp).await;
             }
         } else {
             // Remote upload via SFTP
             ssh_exec(&cfg, key_file.path(), "mkdir", &["-p".into(), target_dir])
                 .await
-                .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Failed to create directory: {}", e)))?;
+                .map_err(|e| {
+                    (
+                        StatusCode::INTERNAL_SERVER_ERROR,
+                        format!("Failed to create directory: {}", e),
+                    )
+                })?;
 
             let batch = format!("put -p \"{}\" \"{}\"\n", tmp.to_string_lossy(), remote_path);
             sftp_batch(&cfg, key_file.path(), &batch)
@@ -339,7 +477,9 @@ pub async fn upload(
             let _ = tokio::fs::remove_file(tmp).await;
         }
 
-        return Ok(Json(serde_json::json!({ "ok": true, "path": q.path, "name": file_name })));
+        return Ok(Json(
+            serde_json::json!({ "ok": true, "path": q.path, "name": file_name }),
+        ));
     }
 
     Err((StatusCode::BAD_REQUEST, "missing file".to_string()))
@@ -356,16 +496,25 @@ pub struct ChunkUploadQuery {
 
 // Handle chunked file upload
 pub async fn upload_chunk(
-    State(state): State<Arc<AppState>>,
+    State(_state): State<Arc<AppState>>,
     Query(q): Query<ChunkUploadQuery>,
     mut multipart: Multipart,
 ) -> Result<Json<serde_json::Value>, (StatusCode, String)> {
+    // Sanitize upload_id to prevent path traversal attacks
+    let safe_upload_id = sanitize_path_component(&q.upload_id);
+    if safe_upload_id.is_empty() {
+        return Err((StatusCode::BAD_REQUEST, "Invalid upload_id".to_string()));
+    }
+
     // Store chunks in temp directory organized by upload_id
-    let chunk_dir = std::env::temp_dir().join(format!("open_agent_chunks_{}", q.upload_id));
-    tokio::fs::create_dir_all(&chunk_dir)
-        .await
-        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Failed to create chunk dir: {}", e)))?;
-    
+    let chunk_dir = std::env::temp_dir().join(format!("open_agent_chunks_{}", safe_upload_id));
+    tokio::fs::create_dir_all(&chunk_dir).await.map_err(|e| {
+        (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            format!("Failed to create chunk dir: {}", e),
+        )
+    })?;
+
     while let Some(field) = multipart
         .next_field()
         .await
@@ -375,7 +524,7 @@ pub async fn upload_chunk(
         let mut f = tokio::fs::File::create(&chunk_path)
             .await
             .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
-        
+
         let mut field = field;
         while let Some(chunk) = field
             .chunk()
@@ -386,15 +535,17 @@ pub async fn upload_chunk(
                 .await
                 .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
         }
-        f.flush().await.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
-        
+        f.flush()
+            .await
+            .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+
         return Ok(Json(serde_json::json!({
             "ok": true,
             "chunk_index": q.chunk_index,
             "total_chunks": q.total_chunks,
         })));
     }
-    
+
     Err((StatusCode::BAD_REQUEST, "missing chunk data".to_string()))
 }
 
@@ -412,67 +563,114 @@ pub async fn upload_finalize(
     Json(req): Json<FinalizeUploadRequest>,
 ) -> Result<Json<serde_json::Value>, (StatusCode, String)> {
     let (cfg, key_file) = get_key_and_cfg(&state).await?;
-    
-    let chunk_dir = std::env::temp_dir().join(format!("open_agent_chunks_{}", req.upload_id));
-    let assembled_path = std::env::temp_dir().join(format!("open_agent_assembled_{}", req.upload_id));
-    
+
+    // Sanitize upload_id and file_name to prevent path traversal attacks
+    let safe_upload_id = sanitize_path_component(&req.upload_id);
+    if safe_upload_id.is_empty() {
+        return Err((StatusCode::BAD_REQUEST, "Invalid upload_id".to_string()));
+    }
+    let safe_file_name = sanitize_path_component(&req.file_name);
+    if safe_file_name.is_empty() {
+        return Err((StatusCode::BAD_REQUEST, "Invalid file_name".to_string()));
+    }
+
+    let chunk_dir = std::env::temp_dir().join(format!("open_agent_chunks_{}", safe_upload_id));
+    let assembled_path =
+        std::env::temp_dir().join(format!("open_agent_assembled_{}", safe_upload_id));
+
     // Assemble chunks into single file
     let mut assembled = tokio::fs::File::create(&assembled_path)
         .await
-        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Failed to create assembled file: {}", e)))?;
-    
+        .map_err(|e| {
+            (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                format!("Failed to create assembled file: {}", e),
+            )
+        })?;
+
     for i in 0..req.total_chunks {
         let chunk_path = chunk_dir.join(format!("chunk_{:06}", i));
-        let chunk_data = tokio::fs::read(&chunk_path)
-            .await
-            .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Failed to read chunk {}: {}", i, e)))?;
-        assembled.write_all(&chunk_data)
-            .await
-            .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Failed to write chunk {}: {}", i, e)))?;
+        let chunk_data = tokio::fs::read(&chunk_path).await.map_err(|e| {
+            (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                format!("Failed to read chunk {}: {}", i, e),
+            )
+        })?;
+        assembled.write_all(&chunk_data).await.map_err(|e| {
+            (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                format!("Failed to write chunk {}: {}", i, e),
+            )
+        })?;
     }
-    assembled.flush().await.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+    assembled
+        .flush()
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
     drop(assembled);
-    
-    // Move assembled file to destination
+
+    // Move assembled file to destination (using sanitized file_name)
     let remote_path = if req.path.ends_with('/') {
-        format!("{}{}", req.path, req.file_name)
+        format!("{}{}", req.path, safe_file_name)
     } else {
-        format!("{}/{}", req.path, req.file_name)
+        format!("{}/{}", req.path, safe_file_name)
     };
-    
+
     let target_dir = if req.path.ends_with('/') {
         req.path.trim_end_matches('/').to_string()
     } else {
         req.path.clone()
     };
-    
+
     if is_localhost(&cfg.host) {
-        tokio::fs::create_dir_all(&target_dir)
+        tokio::fs::create_dir_all(&target_dir).await.map_err(|e| {
+            (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                format!("Failed to create directory: {}", e),
+            )
+        })?;
+
+        if tokio::fs::rename(&assembled_path, &remote_path)
             .await
-            .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Failed to create directory: {}", e)))?;
-        
-        if tokio::fs::rename(&assembled_path, &remote_path).await.is_err() {
+            .is_err()
+        {
             tokio::fs::copy(&assembled_path, &remote_path)
                 .await
-                .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Failed to copy file: {}", e)))?;
+                .map_err(|e| {
+                    (
+                        StatusCode::INTERNAL_SERVER_ERROR,
+                        format!("Failed to copy file: {}", e),
+                    )
+                })?;
             let _ = tokio::fs::remove_file(&assembled_path).await;
         }
     } else {
         ssh_exec(&cfg, key_file.path(), "mkdir", &["-p".into(), target_dir])
             .await
-            .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Failed to create directory: {}", e)))?;
-        
-        let batch = format!("put -p \"{}\" \"{}\"\n", assembled_path.to_string_lossy(), remote_path);
+            .map_err(|e| {
+                (
+                    StatusCode::INTERNAL_SERVER_ERROR,
+                    format!("Failed to create directory: {}", e),
+                )
+            })?;
+
+        let batch = format!(
+            "put -p \"{}\" \"{}\"\n",
+            assembled_path.to_string_lossy(),
+            remote_path
+        );
         sftp_batch(&cfg, key_file.path(), &batch)
             .await
             .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
         let _ = tokio::fs::remove_file(&assembled_path).await;
     }
-    
+
     // Cleanup chunk directory
     let _ = tokio::fs::remove_dir_all(&chunk_dir).await;
-    
-    Ok(Json(serde_json::json!({ "ok": true, "path": req.path, "name": req.file_name })))
+
+    Ok(Json(
+        serde_json::json!({ "ok": true, "path": req.path, "name": safe_file_name }),
+    ))
 }
 
 #[derive(Debug, Deserialize)]
@@ -488,89 +686,143 @@ pub async fn download_from_url(
     Json(req): Json<DownloadUrlRequest>,
 ) -> Result<Json<serde_json::Value>, (StatusCode, String)> {
     let (cfg, key_file) = get_key_and_cfg(&state).await?;
-    
+
+    // Validate URL to prevent SSRF attacks
+    validate_url_for_ssrf(&req.url).map_err(|e| (StatusCode::BAD_REQUEST, e))?;
+
     // Download to temp file
     let client = reqwest::Client::builder()
         .timeout(std::time::Duration::from_secs(300)) // 5 min timeout
+        // Don't follow redirects automatically to prevent redirect-based SSRF
+        .redirect(reqwest::redirect::Policy::limited(5))
         .build()
-        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Failed to create HTTP client: {}", e)))?;
-    
-    let response = client.get(&req.url)
-        .send()
-        .await
-        .map_err(|e| (StatusCode::BAD_REQUEST, format!("Failed to fetch URL: {}", e)))?;
-    
+        .map_err(|e| {
+            (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                format!("Failed to create HTTP client: {}", e),
+            )
+        })?;
+
+    let response = client.get(&req.url).send().await.map_err(|e| {
+        (
+            StatusCode::BAD_REQUEST,
+            format!("Failed to fetch URL: {}", e),
+        )
+    })?;
+
+    // Validate the final URL after redirects to prevent redirect-based SSRF
+    let final_url = response.url().to_string();
+    validate_url_for_ssrf(&final_url).map_err(|e| {
+        (
+            StatusCode::BAD_REQUEST,
+            format!("Redirect target blocked: {}", e),
+        )
+    })?;
+
     if !response.status().is_success() {
-        return Err((StatusCode::BAD_REQUEST, format!("URL returned error: {}", response.status())));
+        return Err((
+            StatusCode::BAD_REQUEST,
+            format!("URL returned error: {}", response.status()),
+        ));
     }
-    
+
     // Try to get filename from Content-Disposition header or URL
-    let file_name = req.file_name.unwrap_or_else(|| {
-        response.headers()
+    let raw_file_name = req.file_name.clone().unwrap_or_else(|| {
+        response
+            .headers()
             .get("content-disposition")
             .and_then(|h| h.to_str().ok())
             .and_then(|s| {
-                s.split("filename=").nth(1)
+                s.split("filename=")
+                    .nth(1)
                     .map(|f| f.trim_matches('"').trim_matches('\'').to_string())
             })
             .unwrap_or_else(|| {
-                req.url.split('/').last()
+                req.url
+                    .split('/')
+                    .last()
                     .and_then(|s| s.split('?').next())
                     .map(|s| s.to_string())
                     .unwrap_or_else(|| format!("download_{}", uuid::Uuid::new_v4()))
             })
     });
-    
+
+    // Sanitize filename to prevent path traversal attacks
+    let file_name = sanitize_path_component(&raw_file_name);
+    let file_name = if file_name.is_empty() {
+        format!("download_{}", uuid::Uuid::new_v4())
+    } else {
+        file_name
+    };
+
     let tmp = std::env::temp_dir().join(format!("open_agent_url_{}", uuid::Uuid::new_v4()));
     let mut f = tokio::fs::File::create(&tmp)
         .await
         .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
-    
-    let bytes = response.bytes()
-        .await
-        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Failed to read response: {}", e)))?;
-    
+
+    let bytes = response.bytes().await.map_err(|e| {
+        (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            format!("Failed to read response: {}", e),
+        )
+    })?;
+
     f.write_all(&bytes)
         .await
         .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
-    f.flush().await.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
+    f.flush()
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
     drop(f);
-    
+
     // Move to destination
     let remote_path = if req.path.ends_with('/') {
         format!("{}{}", req.path, file_name)
     } else {
         format!("{}/{}", req.path, file_name)
     };
-    
+
     let target_dir = if req.path.ends_with('/') {
         req.path.trim_end_matches('/').to_string()
     } else {
         req.path.clone()
     };
-    
+
     if is_localhost(&cfg.host) {
-        tokio::fs::create_dir_all(&target_dir)
-            .await
-            .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Failed to create directory: {}", e)))?;
-        
+        tokio::fs::create_dir_all(&target_dir).await.map_err(|e| {
+            (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                format!("Failed to create directory: {}", e),
+            )
+        })?;
+
         if tokio::fs::rename(&tmp, &remote_path).await.is_err() {
-            tokio::fs::copy(&tmp, &remote_path)
-                .await
-                .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Failed to copy file: {}", e)))?;
+            tokio::fs::copy(&tmp, &remote_path).await.map_err(|e| {
+                (
+                    StatusCode::INTERNAL_SERVER_ERROR,
+                    format!("Failed to copy file: {}", e),
+                )
+            })?;
             let _ = tokio::fs::remove_file(&tmp).await;
         }
     } else {
         ssh_exec(&cfg, key_file.path(), "mkdir", &["-p".into(), target_dir])
             .await
-            .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Failed to create directory: {}", e)))?;
-        
+            .map_err(|e| {
+                (
+                    StatusCode::INTERNAL_SERVER_ERROR,
+                    format!("Failed to create directory: {}", e),
+                )
+            })?;
+
         let batch = format!("put -p \"{}\" \"{}\"\n", tmp.to_string_lossy(), remote_path);
         sftp_batch(&cfg, key_file.path(), &batch)
             .await
             .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;
         let _ = tokio::fs::remove_file(&tmp).await;
     }
-    
-    Ok(Json(serde_json::json!({ "ok": true, "path": req.path, "name": file_name })))
+
+    Ok(Json(
+        serde_json::json!({ "ok": true, "path": req.path, "name": file_name }),
+    ))
 }
diff --git a/src/api/routes.rs b/src/api/routes.rs
index 87e4ebc..f53fdf8 100644
--- a/src/api/routes.rs
+++ b/src/api/routes.rs
@@ -250,6 +250,7 @@ async fn health(State(state): State<Arc<AppState>>) -> Json<HealthResponse> {
         version: env!("CARGO_PKG_VERSION").to_string(),
         dev_mode: state.config.dev_mode,
         auth_required: state.config.auth.auth_required(state.config.dev_mode),
+        max_iterations: state.config.max_iterations,
     })
 }
 
diff --git a/src/api/types.rs b/src/api/types.rs
index 65d0c20..824ef32 100644
--- a/src/api/types.rs
+++ b/src/api/types.rs
@@ -145,6 +145,9 @@ pub struct HealthResponse {
 
     /// Whether auth is required for API requests (dev_mode=false)
     pub auth_required: bool,
+
+    /// Maximum iterations per agent (from MAX_ITERATIONS env var)
+    pub max_iterations: usize,
 }
 
 /// Login request for dashboard auth.