diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
index f4af0c328..e27d4d479 100644
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -12,6 +12,14 @@ if [ ! -d "${HOME}/.picoclaw/workspace" ] && [ ! -f "${HOME}/.picoclaw/config.js
     exit 0
 fi
 
+# Ensure bsky CLI is on PATH (symlink from skill scripts)
+BSKY_SCRIPT="${HOME}/.picoclaw/workspace/skills/bluesky/scripts/bsky.py"
+if [ -f "$BSKY_SCRIPT" ] && [ ! -e /usr/local/bin/bsky ]; then
+    chmod +x "$BSKY_SCRIPT"
+    ln -sf "$BSKY_SCRIPT" /usr/local/bin/bsky
+    echo "bsky CLI symlinked to PATH"
+fi
+
 # Start virtual framebuffer for headed chromium (agent-browser)
 if [ -n "$DISPLAY" ] && command -v Xvfb >/dev/null 2>&1; then
     Xvfb "$DISPLAY" -screen 0 1280x1024x24 -ac &
@@ -35,6 +43,12 @@ fi
 
 # Start launcher (web UI) if available, otherwise fall back to gateway only.
 # The launcher auto-starts its own gateway subprocess.
+# Tail log files to stdout so they appear in `docker logs`.
+LOG_DIR="${HOME}/.picoclaw/logs"
+mkdir -p "$LOG_DIR"
+touch "$LOG_DIR/launcher.log" "$LOG_DIR/gateway.log"
+tail -F "$LOG_DIR/launcher.log" "$LOG_DIR/gateway.log" &
+
 if command -v picoclaw-launcher >/dev/null 2>&1; then
     exec picoclaw-launcher -public -no-browser "$@"
 else
diff --git a/pkg/providers/github_copilot_provider.go b/pkg/providers/github_copilot_provider.go
index 6d642b2b5..32ceb23e4 100644
--- a/pkg/providers/github_copilot_provider.go
+++ b/pkg/providers/github_copilot_provider.go
@@ -43,6 +43,7 @@ func NewGitHubCopilotProvider(uri string, connectMode string, model string) (*Gi
 		session, err := client.CreateSession(context.Background(), &copilot.SessionConfig{
 			Model: model,
 			Hooks: &copilot.SessionHooks{},
+			OnPermissionRequest: copilot.PermissionHandler.ApproveAll,
 		})
 		if err != nil {
 			client.Stop()
diff --git a/web/backend/api/config.go b/web/backend/api/config.go
index 7cdfde174..c937845d6 100644
--- a/web/backend/api/config.go
+++ b/web/backend/api/config.go
@@ -54,6 +54,15 @@ func (h *Handler) handleUpdateConfig(w http.ResponseWriter, r *http.Request) {
 		cfg.Tools.Exec.AllowRemote = config.DefaultConfig().Tools.Exec.AllowRemote
 	}
 
+	// Load existing config and copy security credentials before validation,
+	// so that security-managed fields (e.g. pico token) are available.
+	oldCfg, err := config.LoadConfig(h.configPath)
+	if err != nil {
+		http.Error(w, fmt.Sprintf("Failed to load config: %v", err), http.StatusInternalServerError)
+		return
+	}
+	cfg.SecurityCopyFrom(oldCfg)
+
 	if errs := validateConfig(&cfg); len(errs) > 0 {
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(http.StatusBadRequest)
@@ -65,12 +74,6 @@ func (h *Handler) handleUpdateConfig(w http.ResponseWriter, r *http.Request) {
 	}
 
 	logger.Infof("new config: %+v", cfg)
-	oldCfg, err := config.LoadConfig(h.configPath)
-	if err != nil {
-		http.Error(w, fmt.Sprintf("Failed to load config: %v", err), http.StatusInternalServerError)
-		return
-	}
-	cfg.SecurityCopyFrom(oldCfg)
 
 	if err := config.SaveConfig(h.configPath, &cfg); err != nil {
 		http.Error(w, fmt.Sprintf("Failed to save config: %v", err), http.StatusInternalServerError)
@@ -149,6 +152,10 @@ func (h *Handler) handlePatchConfig(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Copy security credentials before validation so security-managed
+	// fields (e.g. pico token) are available for validation checks.
+	newCfg.SecurityCopyFrom(cfg)
+
 	if errs := validateConfig(&newCfg); len(errs) > 0 {
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(http.StatusBadRequest)
@@ -159,8 +166,6 @@ func (h *Handler) handlePatchConfig(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	newCfg.SecurityCopyFrom(cfg)
-
 	if err := config.SaveConfig(h.configPath, &newCfg); err != nil {
 		http.Error(w, fmt.Sprintf("Failed to save config: %v", err), http.StatusInternalServerError)
 		return