@kylecheng3146/agent-ops 0.7.0 → 0.7.1

package/README.md

@@ -81,9 +81,14 @@ header; the viewer badge reads “You” in English and “你” in Chinese. Th
 Supervisor movement and character animation run locally without model requests.
 Completed rooms move to Recently completed and remain for at most two hours.
 The page reads agent-ops state and `git diff` paths only, never transcripts or file
-contents. When enabled, managed ordinary sessions start the shared repository server
-automatically; a newly started Office opens the browser once, and subsequent
-sessions reuse it. The server exits after ten minutes without active runs or
+contents. One Office serves every repository you work in: each Office-enabled
+repository registers itself when its sessions report, rooms wear their
+repository's nameplate, and a header menu filters the building to one
+repository. Repositories that are removed, opt out, or stay quiet for two hours
+leave the building. When enabled, managed ordinary sessions start your one
+server automatically; a newly started Office opens the browser once, and
+subsequent sessions in any repository reuse it. A finished worktree's room
+moves to Recently completed as soon as `worktree finish` merges it. The server exits after ten minutes without active runs or
 ordinary sessions. Ordinary-session presence follows hook activity; a crashed
 or silent session expires after 30 minutes without an event. Office failures
 remain advisory and never block session work.

package/dist/packages/cli/src/commands/review.js

@@ -203,17 +203,23 @@ async function preflightReview(options, context, sourceFingerprint) {
         options.gitRunner === undefined) {
         return { ok: false, reason: "stale-verification" };
     }
-    if (context.criteria.some((criterion) => !options.config.verification.commands.some(({ id, required }) => required && (criterion.verifierIds ?? []).includes(id)))) {
+    const typed = (criterion) => {
+        const owner = context.criterionOwners?.get(criterion.id);
+        return context.records.find(r => r.task.id === (owner?.taskId ?? context.taskId))?.task.criteria
+            .find(c => c.id === (owner?.criterionId ?? criterion.id))?.acceptance !== undefined;
+    };
+    // A typed criterion (review-only included) is held to every required
+    // repository command below, so only a legacy one must name its own.
+    if (context.criteria.some((criterion) => !typed(criterion) && !options.config.verification.commands.some(({ id, required }) => required && (criterion.verifierIds ?? []).includes(id)))) {
         return { ok: false, reason: "missing-verification-evidence" };
     }
     const configHash = calculateConfigHash(options.config);
     const commands = [];
     for (const criterion of context.criteria) {
         const owner = context.criterionOwners?.get(criterion.id);
-        const typed = context.records.find(r => r.task.id === (owner?.taskId ?? context.taskId))?.task.criteria
-            .find(c => c.id === (owner?.criterionId ?? criterion.id))?.acceptance !== undefined;
+        const isTyped = typed(criterion);
         for (const commandId of new Set([...(criterion.verifierIds ?? []),
-            ...(typed ? options.config.verification.commands.filter(c => c.required).map(c => c.id) : [])])) {
+            ...(isTyped ? options.config.verification.commands.filter(c => c.required).map(c => c.id) : [])])) {
             const command = options.config.verification.commands.find((candidate) => candidate.id === commandId);
             if (command === undefined) {
                 return { ok: false, reason: "missing-verification-evidence" };

package/dist/packages/cli/src/context.js

@@ -36,7 +36,7 @@ export const DEFAULT_CONFIG = {
  */
 export function projectConfigRoot(root) {
     try {
-        const common = execFileSync("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+        const common = execFileSync("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], windowsHide: true }).trim();
         if (basename(common) !== ".git") {
             return root;
         }
@@ -184,7 +184,8 @@ export function repositoryRemoteUrl(root) {
     try {
         return execFileSync("git", ["config", "--get", "remote.origin.url"], {
             cwd: root,
-            encoding: "utf8"
+            encoding: "utf8",
+            windowsHide: true
         }).trim();
     }
     catch {
@@ -214,7 +215,7 @@ export async function repositoryTrust(root, config, cliVersion) {
 export async function runPolicyContext(root) {
     let common;
     try {
-        common = execFileSync("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+        common = execFileSync("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], windowsHide: true }).trim();
     }
     catch {
         return null;
@@ -234,8 +235,8 @@ export async function runPolicyContext(root) {
     let proof = false;
     if (proofProcess != null && String(proofProcess.processId) === process.env.AGENT_OPS_RUN_PROOF_PID) {
         try {
-            proof = execFileSync("ps", ["-o", "pgid=", "-p", String(process.pid)], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() === String(proofProcess.processId) &&
-                execFileSync("ps", ["-o", "lstart=", "-p", String(proofProcess.processId)], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() === proofProcess.processIdentity;
+            proof = execFileSync("ps", ["-o", "pgid=", "-p", String(process.pid)], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], windowsHide: true }).trim() === String(proofProcess.processId) &&
+                execFileSync("ps", ["-o", "lstart=", "-p", String(proofProcess.processId)], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], windowsHide: true }).trim() === proofProcess.processIdentity;
         }
         catch {
             proof = false;

package/dist/packages/cli/src/office-entry.js

@@ -1,14 +1,16 @@
 import { fileURLToPath } from "node:url";
 import { basename, join } from "node:path";
+import { homedir } from "node:os";
+import { rm } from "node:fs/promises";
 import { createHash } from "node:crypto";
 import { spawn } from "node:child_process";
-import { collectOfficeInput } from "../../../runtime/src/office/collect.js";
-import { claimOffice, createOfficeServer, ensureOffice, readLiveOffice, officeUrl, releaseOffice } from "../../../runtime/src/office/server.js";
-import { buildOfficeSnapshot } from "../../../runtime/src/office/snapshot.js";
+import { collectOfficeBuilding } from "../../../runtime/src/office/collect.js";
+import { claimOffice, createOfficeServer, ensureOffice, legacyOfficeHome, officeRecordPath, readLiveOffice, officeUrl, releaseOffice, userOfficeHome } from "../../../runtime/src/office/server.js";
+import { registerOfficeRepo } from "../../../runtime/src/office/repos.js";
 import { recordOfficeSession } from "../../../runtime/src/office/sessions.js";
 import { resolveCheckouts } from "../../../runtime/src/parallel/service.js";
 import { createLaunchdDescriptor, LaunchdController } from "../../../runtime/src/run/macOS.js";
-import { ensurePrivateDirectory } from "../../../runtime/src/security/permissions.js";
+import { ensurePrivateDirectory, readPrivateFile } from "../../../runtime/src/security/permissions.js";
 import { worktreeDependencies } from "./parallel-deps.js";
 import { normalizeShellHookEvent } from "../../../runtime/src/hooks/shell.js";
 import { AgentOpsError } from "../../../runtime/src/fs/paths.js";
@@ -110,23 +112,22 @@ export async function observeOfficeSession(options) {
         if (!(await officeEnabled(options.root)))
             return;
         const { mainRoot, commonDir } = await checkouts(options.root);
-        if (identity !== undefined) {
-            await recordOfficeSession({
-                sessionId: identity,
-                harness: options.harness,
-                projectRoot: mainRoot,
-                commonDir,
-                event: officeEvent(options.event),
-                ...(options.agentId === undefined ? {} : { agentId: options.agentId }),
-                ...(process.env.AGENT_OPS_RUN_ID === undefined ? {} : { runId: process.env.AGENT_OPS_RUN_ID }),
-                ...(process.env.AGENT_OPS_WORKER_ID === undefined ? {} : { workerId: process.env.AGENT_OPS_WORKER_ID }),
-                ...(process.env.AGENT_OPS_TASK_ID === undefined ? {} : { taskId: process.env.AGENT_OPS_TASK_ID }),
-                ...(options.phase === undefined ? {} : { phase: options.phase }),
-                host: options.harness
-            });
-        }
+        await recordOfficeSession({
+            sessionId: identity,
+            harness: options.harness,
+            projectRoot: mainRoot,
+            commonDir,
+            event: officeEvent(options.event),
+            ...(options.agentId === undefined ? {} : { agentId: options.agentId }),
+            ...(process.env.AGENT_OPS_RUN_ID === undefined ? {} : { runId: process.env.AGENT_OPS_RUN_ID }),
+            ...(process.env.AGENT_OPS_WORKER_ID === undefined ? {} : { workerId: process.env.AGENT_OPS_WORKER_ID }),
+            ...(process.env.AGENT_OPS_TASK_ID === undefined ? {} : { taskId: process.env.AGENT_OPS_TASK_ID }),
+            ...(options.phase === undefined ? {} : { phase: options.phase }),
+            host: options.harness
+        });
+        await registerOfficeRepo(officeHome(), { mainRoot, commonDir });
         // A resumed session may outlive the ten-minute idle shutdown. Reusing the
-        // same ensure path revives that repository server without creating a tab
+        // same ensure path revives the user's server without creating a tab
         // unless this call actually wins a new-server start claim.
         if (options.event !== "Stop")
             await ensureBackgroundOffice(options.root, undefined, openOfficeBrowser);
@@ -138,23 +139,49 @@ export async function observeOfficeSession(options) {
 async function checkouts(cwd) {
     return await resolveCheckouts(worktreeDependencies(), cwd);
 }
-/** Serve the office until no run has been active for the idle window. */
+/** The user's one Office; AGENT_OPS_HOME moves it with the rest of agent-ops' user state. */
+export function officeHome() {
+    return userOfficeHome(process.env.AGENT_OPS_HOME ?? homedir());
+}
+const officeLabel = (key) => "office-" + createHash("sha256").update(key).digest("hex").slice(0, 12);
+/**
+ * Stops and removes the server 0.7 ran for this one repository. Best effort
+ * and once: without its record there is nothing left to retire. Its pid is
+ * never signalled, since the record is only a file in the checkout; where
+ * launchd is absent the old server simply idles out.
+ */
+export async function retireLegacyOffice(mainRoot, commonDir, launchd = new LaunchdController()) {
+    const legacy = legacyOfficeHome(commonDir);
+    if (await readPrivateFile(officeRecordPath(legacy), commonDir).catch(() => null) === null)
+        return;
+    if (launchd.supported) {
+        await launchd.bootout(createLaunchdDescriptor({
+            runId: officeLabel(commonDir), workerId: "server", privateDirectory: join(legacy.dir, "office"),
+            command: process.execPath, args: [entry, mainRoot], cwd: mainRoot, pathEnvironment: process.env.PATH
+        })).catch(() => { });
+    }
+    await rm(officeRecordPath(legacy), { force: true });
+    await rm(join(legacy.dir, "office"), { recursive: true, force: true });
+}
+/** Serve the user's office until no run or session has been active for the idle window. */
 export async function serveOffice(cwd, onUrl = () => { }, openBrowser) {
     await requireOffice(cwd);
     const { mainRoot, commonDir } = await checkouts(cwd);
-    // ponytail: one shared 1s snapshot so several polling tabs cost one git scan
+    const home = officeHome();
+    await registerOfficeRepo(home, { mainRoot, commonDir });
+    // ponytail: one shared 1s building so several polling tabs cost one git scan per repository
     let cached = null;
-    const snapshot = () => {
+    const building = () => {
         if (cached === null || Date.now() - cached.at > 1000)
-            cached = { at: Date.now(), value: collectOfficeInput(mainRoot, commonDir).then(buildOfficeSnapshot) };
+            cached = { at: Date.now(), value: collectOfficeBuilding(home, officeEnabled) };
         return cached.value;
     };
     let finish = () => { };
     const idle = new Promise((resolve) => { finish = resolve; });
-    const office = createOfficeServer({ snapshot, onIdle: () => finish() });
-    const record = await claimOffice(commonDir, office);
+    const office = createOfficeServer({ snapshot: async () => (await building()).snapshot, onIdle: () => finish() });
+    const record = await claimOffice(home, office);
     if (record === null) {
-        const live = await readLiveOffice(commonDir);
+        const live = await readLiveOffice(home);
         if (live !== null)
             onUrl(officeUrl(live));
         return;
@@ -163,24 +190,28 @@ export async function serveOffice(cwd, onUrl = () => { }, openBrowser) {
     if (openBrowser !== undefined)
         void openBrowser(officeUrl(record)).catch(() => undefined);
     const timer = setInterval(() => {
-        void officeEnabled(cwd).then(enabled => enabled ? office.tick() : finish());
+        cached = null;
+        void building().then(current => current.repos > 0 ? office.tick() : finish(), () => office.tick());
     }, 15_000);
     await idle;
     clearInterval(timer);
-    await releaseOffice(commonDir, record);
+    await releaseOffice(home, record);
     await office.close();
 }
-/** Reuse the live server or start one under launchd; null where launchd is unavailable. */
+/** Reuse the user's live server or start one under launchd; null where launchd is unavailable. */
 export async function ensureBackgroundOffice(cwd, launchd = new LaunchdController(), openBrowser) {
     await requireOffice(cwd);
     const { mainRoot, commonDir } = await checkouts(cwd);
-    const live = await readLiveOffice(commonDir);
+    const home = officeHome();
+    await registerOfficeRepo(home, { mainRoot, commonDir });
+    await retireLegacyOffice(mainRoot, commonDir, launchd).catch(() => undefined);
+    const live = await readLiveOffice(home);
     if (live !== null)
         return officeUrl(live);
     let started = false;
     const args = [entry, mainRoot];
     if (!launchd.supported) {
-        const url = await ensureOffice(commonDir, async () => {
+        const url = await ensureOffice(home, async () => {
             started = true;
             await new Promise((resolve, reject) => {
                 const child = spawn(process.execPath, args, { cwd: mainRoot, detached: true, stdio: "ignore", windowsHide: true });
@@ -192,16 +223,16 @@ export async function ensureBackgroundOffice(cwd, launchd = new LaunchdControlle
             void openBrowser(url).catch(() => undefined);
         return url;
     }
-    const privateDirectory = join(commonDir, "agent-ops", "office");
+    const privateDirectory = join(home.dir, "launchd");
     const descriptor = createLaunchdDescriptor({
-        runId: "office-" + createHash("sha256").update(commonDir).digest("hex").slice(0, 12), workerId: "server",
+        runId: officeLabel(home.dir), workerId: "server",
         privateDirectory, command: process.execPath, args,
         cwd: mainRoot, pathEnvironment: process.env.PATH
     });
-    const url = await ensureOffice(commonDir, async () => {
+    const url = await ensureOffice(home, async () => {
         started = true;
         // The descriptor write anchors on this directory, so it must exist first.
-        await ensurePrivateDirectory(privateDirectory, commonDir);
+        await ensurePrivateDirectory(privateDirectory, home.anchor);
         await launchd.writeDescriptor(descriptor);
         // A server that exited idle stays loaded in launchd; reload it with the current descriptor.
         await launchd.bootout(descriptor).catch(() => { });

package/dist/packages/cli/src/parallel-deps.js

@@ -23,7 +23,8 @@ export function gitRunner(root) {
                     stdout: execFileSync("git", [...gitArgs], {
                         cwd: root,
                         encoding: "buffer",
-                        stdio: ["ignore", "pipe", "ignore"]
+                        stdio: ["ignore", "pipe", "ignore"],
+                        windowsHide: true
                     })
                 };
             }
@@ -51,7 +52,7 @@ export function worktreeDependencies() {
     });
     return {
         git: async (cwd, gitArgs) => await new Promise((resolve) => {
-            execFile("git", [...gitArgs], { cwd, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 }, (error, stdout, stderr) => resolve({
+            execFile("git", [...gitArgs], { cwd, encoding: "utf8", maxBuffer: 64 * 1024 * 1024, windowsHide: true }, (error, stdout, stderr) => resolve({
                 exitCode: error === null ? 0 : typeof error.code === "number" ? error.code : 1,
                 stdout,
                 stderr
@@ -90,6 +91,7 @@ export function worktreeDependencies() {
                 encoding: "utf8",
                 timeout: step.timeoutMs,
                 maxBuffer: 16 * 1024 * 1024,
+                windowsHide: true,
                 ...(process.platform === "win32" ? { shell: true } : {})
             }, (error, stdout, stderr) => resolve({
                 exitCode: error === null

package/dist/runtime/src/fs/transaction.js

@@ -58,7 +58,8 @@ async function runAnchoredMutation(targetPath, action, expectedHash, content, mo
         const child = spawn(process.execPath, [MUTATION_WORKER_PATH, encodedRequest], {
             cwd: parent,
             shell: false,
-            stdio: ["pipe", "ignore", "pipe"]
+            stdio: ["pipe", "ignore", "pipe"],
+            windowsHide: true
         });
         let standardError = "";
         let settled = false;

package/dist/runtime/src/hooks/completion-gate.js

@@ -5,9 +5,9 @@ import { AgentOpsError } from "../fs/paths.js";
 import { readPrivateFile, withPrivateFileLock, writePrivateFile } from "../security/permissions.js";
 import { checkTaskCompletionEvidence, findIncompleteSubtask } from "../task/completion.js";
 import { collectBaseChangePaths, collectChangeSurface } from "../verify/change-surface.js";
-import { calculateSourceFingerprint } from "../verify/source-fingerprint.js";
+import { calculateSourceFingerprint, worktreeFingerprint } from "../verify/source-fingerprint.js";
 import { resolveReviewScope } from "../review/scope.js";
-import { NOTES_REF, noteSessionLine, readWorktreeRecord } from "../parallel/service.js";
+import { NOTES_REF, noteSessionLine, readWorktreeRecord, sessionWorktreeName } from "../parallel/service.js";
 const FINGERPRINT = /^[a-f0-9]{64}$/u;
 const SESSION = /^[^\0\r\n]{1,256}$/u;
 function gateDirectory(root) {
@@ -352,6 +352,37 @@ export class CompletionGateService {
         const line = noteSessionLine(sessionId);
         return new TextDecoder().decode(log.stdout).split("\0").some((note) => note.split("\n").includes(line));
     }
+    /**
+     * Whether a clean checkout moved since the baseline only by fast-forward
+     * merges of other sessions' worktree branches. `worktree finish` rebases
+     * open sessions itself; a merge run by hand does not, and would otherwise
+     * read as this session's change. The branch reflog is walked back to the
+     * entry whose clean fingerprint is the baseline; any other move counts.
+     */
+    async #onlyOtherSessionsMerged(baseline, sessionId) {
+        const runner = this.#options.gitRunner;
+        if ((await collectChangeSurface(runner)).paths.length > 0)
+            return false;
+        const branch = await runner.run(["symbolic-ref", "-q", "HEAD"]);
+        if (branch.exitCode !== 0)
+            return false;
+        // ponytail: newest 200 branch moves only; an older baseline needs a one-time allow-stop
+        const log = await runner.run(["reflog", "--format=%H%x00%gs", "-n", "200",
+            new TextDecoder().decode(branch.stdout).trim(), "--"]);
+        if (log.exitCode !== 0)
+            return false;
+        const own = `agent-ops/${sessionWorktreeName(sessionId)}`;
+        const entries = new TextDecoder().decode(log.stdout).split("\n").filter((line) => line !== "");
+        for (const [index, entry] of entries.entries()) {
+            const [head = "", subject = ""] = entry.split("\0");
+            if (index > 0 && worktreeFingerprint(head) === baseline)
+                return true;
+            const merged = /^merge (agent-ops\/session-[a-z0-9-]+): Fast-forward$/u.exec(subject)?.[1];
+            if (merged === undefined || merged === own || merged.startsWith(`${own}-`))
+                return false;
+        }
+        return false;
+    }
     async #validateTask(sessionId) {
         let stored;
         try {
@@ -430,7 +461,11 @@ export class CompletionGateService {
                 ? "The session baseline is unavailable; continue once so PreInvocation can initialize it."
                 : "The session baseline is unavailable: its SessionStart never reached this checkout. The next tool call records one; if this repeats, run agent-ops doctor.");
         }
-        const changed = state.baselineFingerprint !== fingerprint && state.permitFingerprint !== fingerprint;
+        let changed = state.baselineFingerprint !== fingerprint && state.permitFingerprint !== fingerprint;
+        if (changed && await this.#onlyOtherSessionsMerged(state.baselineFingerprint, sessionId)) {
+            await this.#store.mutate(sessionId, (current) => ({ ...(current ?? state), baselineFingerprint: fingerprint }));
+            changed = false;
+        }
         const delegated = this.#delegatedRoots(state);
         if (delegated.length > 0) {
             // This checkout only has to stay untouched; the work, its task and its

package/dist/runtime/src/office/collect.js

@@ -1,4 +1,5 @@
 import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
 import { readdir, readFile, realpath, stat } from "node:fs/promises";
 import { basename, join, resolve } from "node:path";
 import { promisify } from "node:util";
@@ -10,10 +11,12 @@ import { findReviewAttestation } from "../review/attestation.js";
 import { FileEvidenceStore } from "../verify/evidence.js";
 import { readPrivateFile } from "../security/permissions.js";
 import { OFFICE_SESSION_RETENTION_MS, readOfficeSessions } from "./sessions.js";
+import { buildOfficeSnapshot, mergeOfficeSnapshots } from "./snapshot.js";
+import { forgetOfficeRepos, readOfficeRepos } from "./repos.js";
 const run = promisify(execFile);
 export const officeGit = async (cwd, args) => {
     try {
-        return { exitCode: 0, stdout: (await run("git", [...args], { cwd, maxBuffer: 8 * 1024 * 1024 })).stdout };
+        return { exitCode: 0, stdout: (await run("git", [...args], { cwd, maxBuffer: 8 * 1024 * 1024, windowsHide: true })).stdout };
     }
     catch {
         return { exitCode: 1, stdout: "" };
@@ -231,3 +234,35 @@ export async function collectOfficeInput(mainRoot, commonDir, git = officeGit, n
     }
     return { runs: await readRuns(commonDir), worktrees, sessions, reviews: await readReviewSlots(commonDir), now };
 }
+/**
+ * Every registered repository that still exists and still opts in, as one
+ * building. One that vanished or opted out is forgotten, and so is one that
+ * stayed quiet past the retention window with nothing left to show.
+ */
+export async function collectOfficeBuilding(home, enabled, git = officeGit, now = Date.now()) {
+    const parts = [];
+    const forget = [];
+    const names = new Set();
+    for (const repo of await readOfficeRepos(home)) {
+        if (!await stat(repo.commonDir).then(item => item.isDirectory(), () => false) || !await enabled(repo.mainRoot).catch(() => false)) {
+            forget.push(repo.commonDir);
+            continue;
+        }
+        // One unreadable repository must not hide the rest of the building.
+        const snapshot = await collectOfficeInput(repo.mainRoot, repo.commonDir, git, now).then(buildOfficeSnapshot, () => null);
+        if (snapshot === null)
+            continue;
+        if (snapshot.runs.length + snapshot.lobby.length + snapshot.reviews.length === 0 &&
+            now - Date.parse(repo.lastSeenAt) >= OFFICE_SESSION_RETENTION_MS) {
+            forget.push(repo.commonDir);
+            continue;
+        }
+        let name = basename(repo.mainRoot);
+        if (names.has(name))
+            name += "~" + createHash("sha256").update(repo.commonDir).digest("hex").slice(0, 4);
+        names.add(name);
+        parts.push({ repo: name, snapshot });
+    }
+    await forgetOfficeRepos(home, forget).catch(() => undefined);
+    return { snapshot: mergeOfficeSnapshots(parts, now), repos: parts.length };
+}

package/dist/runtime/src/office/page.js

@@ -259,7 +259,9 @@ button{font:inherit;color:inherit}
 #crumb{flex:1;overflow:hidden;text-overflow:ellipsis;color:#f2e5c9}
 #header button{border:2px solid #f2e5c9;background:#6d9275;color:#fff7e6;padding:5px 9px;cursor:pointer;box-shadow:2px 2px 0 #000}
 #header button:hover,#header button:focus-visible{background:#adc39a;color:#2b241f;outline:3px solid #f2c95c;outline-offset:2px}
-#header button[hidden]{display:none}
+#header button[hidden],#header select[hidden]{display:none}
+#header select{border:2px solid #f2e5c9;background:#355a4b;color:#fff7e6;padding:4px 6px;font:inherit;box-shadow:2px 2px 0 #000}
+#header select:focus-visible{outline:3px solid #f2c95c;outline-offset:2px}
 #live{color:#adc39a}
 #wrap{min-height:0;flex:1;display:flex;flex-direction:column;align-items:center;justify-content:space-between;gap:4px;padding:4px 8px;overflow:hidden;background:#ead8b8}
 #office{display:block;max-width:100%;max-height:none;width:auto;height:auto;image-rendering:pixelated;image-rendering:crisp-edges;border:4px solid #6b5d50;box-shadow:6px 6px 0 #8a5033;outline:none;cursor:pointer}
@@ -294,7 +296,7 @@ var canvas = document.getElementById("office"), ctx = canvas.getContext("2d"), a
 ctx.imageSmoothingEnabled = false;
 var dialogueBox = document.getElementById("dialogue"), statusBox = document.getElementById("status"), roomNav = document.getElementById("room-nav"), wrap = document.getElementById("wrap");
 var crumb = document.getElementById("crumb"), backButton = document.getElementById("back"), recentButton = document.getElementById("recent");
-var languageButton = document.getElementById("language"), live = document.getElementById("live");
+var languageButton = document.getElementById("language"), live = document.getElementById("live"), repoSelect = document.getElementById("repo-filter"), repoFilter = "", repoSignature = "";
 var snapshot = null, model = null, positions = {}, roomCanvases = {}, frame = 0, lineIndex = 0, typed = 0, offline = false;
 var mode = "overview", selectedKey = null, showRecent = false, detailPage = 0, dialogClose = null, detailPreviousFocus = null, detailTarget = null;
 var detailSignature = "";
@@ -303,8 +305,8 @@ var supervisor = {x:43, y:19, targetX:43, targetY:19}, supervisorReady = false,
 var roomSupervisor = {x:32, y:34, targetX:32, targetY:34};
 var reducedMotion = window.matchMedia && window.matchMedia("(prefers-reduced-motion: reduce)").matches;
 var STRINGS = {
-  en: {viewer:"You", overview:"Office overview", rooms:"rooms", people:"people", recent:"Recently completed", recentOn:"Hide completed", back:"Back to overview", connected:"● Connected", offline:"○ Reconnecting", quiet:"The office is quiet. No agent is at work.", waiting:"waiting for your answer", enter:"Enter room", close:"Close", previous:"Previous", next:"Next", page:"Page", details:"Details", progress:"Progress", verify:"Verify", review:"Review", pending:"Awaiting answer", task:"Task", status:"Status", phase:"Phase", host:"Host", now:"Now", owner:"Owner", currentWork:"Current work", question:"Pending question", questions:"Questions", workList:"Work list", clickWork:"Click for work", keyboardWork:"Press L for work list", keyboardPhase:"Press 1-5 for phase work", keyboardQuestions:"Press Q for questions", noPeople:"No known work is in this phase", noQuestions:"No pending questions", files:"Changed files", commands:"Commands", copy:"Copy", copied:"Copied", unknown:"unknown", unassigned:"unassigned", phases:{planning:"Planning", implementing:"Implementing", verifying:"Verifying", reviewing:"Reviewing", integrating:"Integrating", unknown:"Unassigned"}, statuses:{active:"active", idle:"idle", running:"running", reviewing:"reviewing", verifying:"verifying", blocked:"blocked", delivered:"delivered", complete:"complete", unknown:"unknown", unassigned:"unassigned", pending:"pending"}},
-  zh: {viewer:"你", overview:"辦公室總覽", rooms:"個房間", people:"位成員", recent:"最近完成", recentOn:"隱藏已完成", back:"返回總覽", connected:"● 已連線", offline:"○ 重新連線中", quiet:"辦公室很安靜，目前沒有成員工作。", waiting:"等待你的回覆", enter:"進入房間", close:"關閉", previous:"上一頁", next:"下一頁", page:"頁", details:"詳細資料", progress:"進度", verify:"驗證", review:"審查", pending:"待回覆", task:"任務", status:"狀態", phase:"階段", host:"主機", now:"目前", owner:"負責人", currentWork:"目前工作", question:"待回覆問題", questions:"問題", workList:"工作清單", clickWork:"點擊查看工作", keyboardWork:"按 L 開啟工作清單", keyboardPhase:"按 1-5 查看階段工作", keyboardQuestions:"按 Q 查看問題", noPeople:"此階段目前沒有已知工作", noQuestions:"目前沒有待回覆問題", files:"變更檔案", commands:"指令", copy:"複製", copied:"已複製", unknown:"未知", unassigned:"未分配", phases:{planning:"規劃", implementing:"開發", verifying:"驗證", reviewing:"審查", integrating:"整合", unknown:"未分配"}, statuses:{active:"進行中", idle:"閒置", running:"工作中", reviewing:"審查中", verifying:"驗證中", blocked:"受阻", delivered:"已交付", complete:"已完成", unknown:"未知", unassigned:"未分配", pending:"待回覆"}}
+  en: {viewer:"You", overview:"Office overview", rooms:"rooms", people:"people", recent:"Recently completed", recentOn:"Hide completed", repos:"Repository", allRepos:"All repositories", back:"Back to overview", connected:"● Connected", offline:"○ Reconnecting", quiet:"The office is quiet. No agent is at work.", waiting:"waiting for your answer", enter:"Enter room", close:"Close", previous:"Previous", next:"Next", page:"Page", details:"Details", progress:"Progress", verify:"Verify", review:"Review", pending:"Awaiting answer", task:"Task", status:"Status", phase:"Phase", host:"Host", now:"Now", owner:"Owner", currentWork:"Current work", question:"Pending question", questions:"Questions", workList:"Work list", clickWork:"Click for work", keyboardWork:"Press L for work list", keyboardPhase:"Press 1-5 for phase work", keyboardQuestions:"Press Q for questions", noPeople:"No known work is in this phase", noQuestions:"No pending questions", files:"Changed files", commands:"Commands", copy:"Copy", copied:"Copied", unknown:"unknown", unassigned:"unassigned", phases:{planning:"Planning", implementing:"Implementing", verifying:"Verifying", reviewing:"Reviewing", integrating:"Integrating", unknown:"Unassigned"}, statuses:{active:"active", idle:"idle", running:"running", reviewing:"reviewing", verifying:"verifying", blocked:"blocked", delivered:"delivered", complete:"complete", unknown:"unknown", unassigned:"unassigned", pending:"pending"}},
+  zh: {viewer:"你", overview:"辦公室總覽", rooms:"個房間", people:"位成員", recent:"最近完成", recentOn:"隱藏已完成", repos:"專案", allRepos:"所有專案", back:"返回總覽", connected:"● 已連線", offline:"○ 重新連線中", quiet:"辦公室很安靜，目前沒有成員工作。", waiting:"等待你的回覆", enter:"進入房間", close:"關閉", previous:"上一頁", next:"下一頁", page:"頁", details:"詳細資料", progress:"進度", verify:"驗證", review:"審查", pending:"待回覆", task:"任務", status:"狀態", phase:"階段", host:"主機", now:"目前", owner:"負責人", currentWork:"目前工作", question:"待回覆問題", questions:"問題", workList:"工作清單", clickWork:"點擊查看工作", keyboardWork:"按 L 開啟工作清單", keyboardPhase:"按 1-5 查看階段工作", keyboardQuestions:"按 Q 查看問題", noPeople:"此階段目前沒有已知工作", noQuestions:"目前沒有待回覆問題", files:"變更檔案", commands:"指令", copy:"複製", copied:"已複製", unknown:"未知", unassigned:"未分配", phases:{planning:"規劃", implementing:"開發", verifying:"驗證", reviewing:"審查", integrating:"整合", unknown:"未分配"}, statuses:{active:"進行中", idle:"閒置", running:"工作中", reviewing:"審查中", verifying:"驗證中", blocked:"受阻", delivered:"已交付", complete:"已完成", unknown:"未知", unassigned:"未分配", pending:"待回覆"}}
 };
 function getLanguage(){
   try { var cookie = document.cookie.split(";").map(function(part){ return part.trim().split("="); }).find(function(pair){ return pair[0] === "agent-office-language"; }); if (cookie && (cookie[1] === "en" || cookie[1] === "zh")) return cookie[1]; } catch (_) {}
@@ -377,7 +379,15 @@ function canvasPoint(event){var rect=canvas.getBoundingClientRect();return {x:(e
 function inside(point,rect){return point.x>=rect.x&&point.x<rect.x+rect.width&&point.y>=rect.y&&point.y<rect.y+rect.height;}
 function fillText(value, x, y, size, color){ ctx.fillStyle = color || PALETTE[0]; ctx.font = "bold " + Math.max(5, Math.round((size || 10) * U)) + "px monospace"; ctx.textBaseline = "top"; ctx.fillText(short(value, 36), x, y); }
 function roomByKey(key){ if (!model) return null; for (var i = 0; i < model.floors.length; i++) if (model.floors[i].key === key) return model.floors[i]; return null; }
-function visibleRooms(){ if (!model) return []; return model.floors.filter(function(f){ return showRecent || !f.completedAt; }); }
+function visibleRooms(){ if (!model) return []; return model.floors.filter(function(f){ return (showRecent || !f.completedAt) && (!repoFilter || f.repo === repoFilter); }); }
+function repoNames(){ var names = []; if (model) model.floors.forEach(function(f){ if (f.repo && names.indexOf(f.repo) < 0) names.push(f.repo); }); return names; }
+function repoColor(name){ var hash = 0; for (var i = 0; i < name.length; i++) hash = (hash * 31 + name.charCodeAt(i)) >>> 0; return PALETTE[[1, 4, 9, 13, 0, 8][hash % 6]] || PALETTE[1]; }
+function renderRepoFilter(){
+  var names = repoNames(); if (repoFilter && names.indexOf(repoFilter) < 0) repoFilter = "";
+  repoSelect.hidden = names.length < 2; repoSelect.setAttribute("aria-label", t("repos"));
+  var signature = lang + "|" + repoFilter + "|" + names.join("\n"); if (signature === repoSignature) return; repoSignature = signature;
+  repoSelect.textContent = ""; [""].concat(names).forEach(function(name){ var option = document.createElement("option"); option.value = name; option.textContent = name || t("allRepos"); option.selected = name === repoFilter; repoSelect.appendChild(option); });
+}
 function activeRoom(){ return selectedKey ? roomByKey(selectedKey) : null; }
 function hasRecent(){ return !!(model && model.floors.some(function(f){ return !!f.completedAt; })); }
 function setCanvasSize(width, height){
@@ -595,7 +605,9 @@ function drawOverviewRoom(floor){
   ctx.save();ctx.beginPath();ctx.rect(surface.x,surface.y,surface.width,surface.height);ctx.clip();
   var image=renderRoomImage(floor,surface.width,surface.height);if(image)ctx.drawImage(image,surface.x,surface.y);
   floor.actors.forEach(function(actor){drawActor(floor,actor,surface);});
-  if(floor.completedAt){ctx.fillStyle='rgba(53,90,75,.18)';ctx.fillRect(surface.x,surface.y,surface.width,surface.height);}ctx.restore();
+  if(floor.completedAt){ctx.fillStyle='rgba(53,90,75,.18)';ctx.fillRect(surface.x,surface.y,surface.width,surface.height);}
+  if(floor.repo){var plate=short(floor.repo,16),plateWidth=(plate.length*6+8)*U;ctx.fillStyle=repoColor(floor.repo);ctx.fillRect(surface.x+2*U,surface.y+2*U,plateWidth,13*U);ctx.strokeStyle=PALETTE[0];ctx.lineWidth=U;ctx.strokeRect(surface.x+2*U,surface.y+2*U,plateWidth,13*U);fillText(plate,surface.x+6*U,surface.y+4*U,8,PALETTE[15]);}
+  ctx.restore();
 }
 function render(){
   if(!model)return;chooseRenderScale();var floor=activeRoom();
@@ -620,6 +632,7 @@ function renderRoomNav(rooms){
 function updateHeader(){
   if(document.documentElement)document.documentElement.lang=lang==='zh'?'zh-Hant':'en';
   canvas.setAttribute('aria-label',(lang==='zh'?'方向鍵或 WASD 移動 Supervisor；Enter 進入房間或查看細節；Esc 返回。':'Arrow keys or WASD move Supervisor; Enter opens rooms or details; Escape returns.')+' '+t('keyboardWork')+'；'+t('keyboardPhase')+'；'+t('keyboardQuestions'));
+  renderRepoFilter();
   var rooms = visibleRooms(), people = rooms.reduce(function(n, f){ return n + f.actors.length; }, 0);
   crumb.textContent = mode === "room" && activeRoom() ? activeRoom().title : t("overview") + " · " + rooms.length + " " + t("rooms") + " · " + people + " " + t("people");
   backButton.hidden = mode !== "room"; backButton.textContent = "← " + t("back"); recentButton.textContent = (showRecent ? "✓ " + t("recentOn") : "▣ " + t("recent")) + (hasRecent() ? " (" + model.floors.filter(function(f){ return !!f.completedAt; }).length + ")" : "");
@@ -846,6 +859,7 @@ canvas.addEventListener("keydown", function(event){
   if (event.key === "Enter" && mode === "overview") { event.preventDefault(); enterRoom(); }
   if (event.key === "Enter" && mode === "room") { event.preventDefault(); openSelectedDetail(); }
 });
+repoSelect.addEventListener("change", function(){ repoFilter = repoSelect.value; navPage = 0; if (activeRoom() && repoFilter && activeRoom().repo !== repoFilter) mode = "overview"; if (!selectedKey || visibleRooms().every(function(f){ return f.key !== selectedKey; })) selectedKey = visibleRooms()[0] && visibleRooms()[0].key; updateHeader(); render(); });
 backButton.addEventListener("click", goOverview); recentButton.addEventListener("click", function(){ showRecent = !showRecent; if (!showRecent && activeRoom() && activeRoom().completedAt) mode = "overview"; updateHeader(); render(); });
 languageButton.addEventListener("click", changeLanguage); statusBox.addEventListener("keydown", function(event){
   if (event.key === "Escape") { event.preventDefault(); closeDialog(); return; }
@@ -867,7 +881,7 @@ export function officePage(nonce) {
     return `<!doctype html>
 <html lang="zh-Hant"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
 <meta name="referrer" content="no-referrer"><title>agent-ops Office · Preview</title><style nonce="${nonce}">${STYLE}</style></head>
-<body><div id="app"><header id="header"><div id="brand">agent-ops Office · Preview</div><div id="crumb">Office overview</div><button id="back" type="button" hidden>← Back to overview</button><button id="recent" type="button">▣ Recently completed</button><button id="language" type="button">繁中 / EN</button><span id="live" aria-live="polite">● Connected</span></header>
+<body><div id="app"><header id="header"><div id="brand">agent-ops Office · Preview</div><div id="crumb">Office overview</div><button id="back" type="button" hidden>← Back to overview</button><button id="recent" type="button">▣ Recently completed</button><select id="repo-filter" hidden></select><button id="language" type="button">繁中 / EN</button><span id="live" aria-live="polite">● Connected</span></header>
 <main id="wrap"><canvas id="office" tabindex="0" width="576" height="304" aria-label="Office rooms; use arrow keys and Enter to explore"></canvas><div id="dialogue" role="status" aria-live="polite"></div><nav id="room-nav" aria-label="Office rooms"></nav></main></div>
 <section id="status" role="dialog" aria-modal="true" aria-labelledby="status-title" tabindex="-1" hidden></section><script nonce="${nonce}">${script}</script></body></html>`;
 }

package/dist/runtime/src/office/repos.js

@@ -0,0 +1,43 @@
+import { join } from "node:path";
+import { readPrivateFile, withPrivateFileLock, writePrivateFile } from "../security/permissions.js";
+const MAX_REPOS = 64;
+const MAX_ROOT = 4_096;
+export const officeReposPath = (home) => join(home.dir, "repos.json");
+function parse(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return null;
+    const item = value;
+    const root = (text) => typeof text === "string" && text.length > 0 && text.length <= MAX_ROOT && !/[\0\r\n]/u.test(text);
+    if (!root(item.mainRoot) || !root(item.commonDir) || typeof item.lastSeenAt !== "string" || !Number.isFinite(Date.parse(item.lastSeenAt)))
+        return null;
+    return { mainRoot: item.mainRoot, commonDir: item.commonDir, lastSeenAt: item.lastSeenAt };
+}
+export async function readOfficeRepos(home) {
+    const source = await readPrivateFile(officeReposPath(home), home.anchor).catch(() => null);
+    if (source === null)
+        return [];
+    try {
+        const repos = JSON.parse(source).repos;
+        return Array.isArray(repos) ? repos.slice(0, MAX_REPOS).map(parse).filter((repo) => repo !== null) : [];
+    }
+    catch {
+        return [];
+    }
+}
+async function update(home, change) {
+    const path = officeReposPath(home);
+    await withPrivateFileLock(path, home.anchor, async () => {
+        const repos = change(await readOfficeRepos(home)).slice(-MAX_REPOS);
+        await writePrivateFile(path, JSON.stringify({ schemaVersion: 1, repos }) + "\n", home.anchor);
+    });
+}
+/** Adds or refreshes one repository; the newest stays last. */
+export async function registerOfficeRepo(home, repo, now = Date.now()) {
+    await update(home, repos => [...repos.filter(item => item.commonDir !== repo.commonDir),
+        { mainRoot: repo.mainRoot, commonDir: repo.commonDir, lastSeenAt: new Date(now).toISOString() }]);
+}
+export async function forgetOfficeRepos(home, commonDirs) {
+    if (commonDirs.length === 0)
+        return;
+    await update(home, repos => repos.filter(item => !commonDirs.includes(item.commonDir)));
+}

package/dist/runtime/src/office/scene.js

@@ -43,6 +43,13 @@ export function sceneModel(snapshot) {
     });
     const floors = [];
     const dialogue = [];
+    // Two repositories may hold rooms with the same name; the repo keeps their keys apart.
+    const repoOf = (value) => {
+        const repo = optional(value).repo;
+        return typeof repo === "string" && repo.length > 0 ? repo : null;
+    };
+    const scoped = (repo, key) => repo === null ? key : "repo:" + repo + "|" + key;
+    const titled = (repo, title) => short(repo === null ? title : repo + " · " + title, 34);
     const makeAreas = () => PHASES.map(phase => {
         const area = areas[phase];
         return { phase, x: area.x, y: area.y, width: area.width, height: area.height, prop: area.prop, label: labels[phase] };
@@ -67,9 +74,11 @@ export function sceneModel(snapshot) {
         const extra = optional(run);
         const completedAt = typeof extra.completedAt === "string" ? extra.completedAt : null;
         const questions = run.questions;
-        const props = makeProps(run.runId);
+        const repo = repoOf(run);
+        const key = scoped(repo, run.runId);
+        const props = makeProps(key);
         const actors = [];
-        const papers = { [run.runId + ":implementing"]: Math.min(8, run.agents.reduce((sum, agent) => sum + (agent.diff?.files ?? 0), 0)) };
+        const papers = { [key + ":implementing"]: Math.min(8, run.agents.reduce((sum, agent) => sum + (agent.diff?.files ?? 0), 0)) };
         let passed = 0, total = 0, verify = null, review = null;
         run.agents.forEach((agent, index) => {
             const phase = agent.phase;
@@ -78,7 +87,7 @@ export function sceneModel(snapshot) {
             const phaseCount = run.agents.filter(candidate => candidate.phase === phase).length;
             const point = position(phase, phaseIndex, phaseCount);
             if ((phase === "implementing" || phase === "unknown") && phaseIndex > 0) {
-                const deskKey = run.runId + ":desk:" + agent.id;
+                const deskKey = key + ":desk:" + agent.id;
                 props.push({ kind: "desk", x: point.x - 2, y: point.y - 5, key: deskKey, phase: "implementing", label: short(agent.id) });
                 papers[deskKey] = Math.min(8, agent.diff?.files ?? 0);
             }
@@ -92,7 +101,7 @@ export function sceneModel(snapshot) {
                 review = "FAIL";
             else if (p?.review === "PASS" && review === null)
                 review = "PASS";
-            actors.push({ key: run.runId + ":" + agent.id, id: agent.id, kind: agent.role, x: point.x, y: point.y, alert: agent.role === "coordinator" && questions.length > 0,
+            actors.push({ key: key + ":" + agent.id, id: agent.id, kind: agent.role, x: point.x, y: point.y, alert: agent.role === "coordinator" && questions.length > 0,
                 label: short(agent.id), status: agent.status, phase, taskId: agent.taskId || "unassigned", progress: p,
                 narration: agent.narration, questionCount: agent.role === "coordinator" ? questions.length : 0, host: "unknown" });
             dialogue.push(`${run.title}: ${agent.id} ${agent.narration}.`);
@@ -101,7 +110,7 @@ export function sceneModel(snapshot) {
             const reviewerIndex = actors.filter(actor => actor.phase === "reviewing").length;
             const reviewerCount = run.agents.filter(agent => agent.phase === "reviewing").length + run.reviewers.length;
             const point = position("reviewing", reviewerIndex, reviewerCount);
-            actors.push({ key: run.runId + ":review:" + reviewer.slot, id: "reviewer " + reviewer.slot, kind: "reviewer", x: point.x, y: point.y, alert: false,
+            actors.push({ key: key + ":review:" + reviewer.slot, id: "reviewer " + reviewer.slot, kind: "reviewer", x: point.x, y: point.y, alert: false,
                 label: "reviewer " + reviewer.slot, status: "reviewing", phase: "reviewing", taskId: reviewer.taskId ?? "unassigned",
                 progress: null, narration: "reviewing", questionCount: 0, host: "unknown" });
         });
@@ -109,10 +118,10 @@ export function sceneModel(snapshot) {
         const taskId = run.agents.find(agent => agent.role === "coordinator")?.taskId ?? "unassigned";
         if (questions.length > 0)
             dialogue.push(`${run.title}: waiting for your answer — ${questions[0].prompt}`);
-        return { key: run.runId, sourceIndex: null, kind: "run", title: short(run.title, 34), top: 0, props, actors, phaseAreas: makeAreas(), questions,
+        return { key, sourceIndex: null, kind: "run", title: titled(repo, run.title), top: 0, props, actors, phaseAreas: makeAreas(), questions,
             board: boardFor(rootProgress, run.status, taskId, questions.length), papers, books: { lit: passed, total },
             clock: run.budget.limitMs > 0 ? run.budget.remainingMs / run.budget.limitMs : 0, phase: run.phase, status: run.status,
-            completedAt, overview: { x: 0, y: 0, width: 0, height: 0 } };
+            completedAt, repo, overview: { x: 0, y: 0, width: 0, height: 0 } };
     };
     const makeDesk = (desk, index) => {
         const extra = optional(desk);
@@ -126,7 +135,8 @@ export function sceneModel(snapshot) {
             return { questionId: typeof item.questionId === "string" ? item.questionId : "unknown", prompt: typeof item.prompt === "string" ? item.prompt : "" };
         });
         const completedAt = typeof extra.completedAt === "string" ? extra.completedAt : null;
-        const key = "session:" + [desk.sessionId || "unknown", desk.branch || "unknown", desk.name || "session"].join(":");
+        const repo = repoOf(desk);
+        const key = scoped(repo, "session:" + [desk.sessionId || "unknown", desk.branch || "unknown", desk.name || "session"].join(":"));
         const props = makeProps(key);
         const point = position(phase, 0, 1);
         const host = typeof extra.host === "string" ? extra.host : "unknown";
@@ -135,24 +145,27 @@ export function sceneModel(snapshot) {
         if (questions.length > 0)
             dialogue.push(`${desk.name}: waiting for your answer.`);
         dialogue.push(`${desk.name}: ${desk.narration}.`);
-        return { key, sourceIndex: index, kind: "desk", title: short(desk.name, 34), top: 0, props, actors: [actor], phaseAreas: makeAreas(),
+        return { key, sourceIndex: index, kind: "desk", title: titled(repo, desk.name), top: 0, props, actors: [actor], phaseAreas: makeAreas(),
             board: boardFor(p, status, taskId, questions.length), questions, papers: { [key + ":implementing"]: Math.min(8, desk.diff.files) }, books: { lit: p?.passed ?? 0, total: p?.total ?? 0 },
-            clock: 1, phase, status, completedAt, overview: { x: 0, y: 0, width: 0, height: 0 } };
+            clock: 1, phase, status, completedAt, repo, overview: { x: 0, y: 0, width: 0, height: 0 } };
     };
     snapshot.runs.forEach(run => floors.push(makeRun(run)));
     snapshot.lobby.forEach((desk, index) => floors.push(makeDesk(desk, index)));
     snapshot.reviews.forEach((review, index) => {
-        const key = "review:" + review.slot + ":" + index;
+        const repo = repoOf(review);
+        const key = scoped(repo, "review:" + review.slot + ":" + index);
         const props = makeProps(key);
         const point = position("reviewing", 0);
         const actor = { key: key + ":actor", id: "reviewer " + review.slot, kind: "reviewer", x: point.x, y: point.y, alert: false, label: "reviewer " + review.slot,
             status: "reviewing", phase: "reviewing", taskId: review.taskId ?? "unassigned", progress: null,
             narration: "reviewing", questionCount: 0, host: "unknown" };
         dialogue.push(`Review slot ${review.slot}: ${review.taskId ?? "unassigned"}.`);
-        floors.push({ key, sourceIndex: index, kind: "review", title: "Review slot " + review.slot, top: 0, props, actors: [actor], phaseAreas: makeAreas(), questions: [],
+        floors.push({ key, sourceIndex: index, kind: "review", title: titled(repo, "Review slot " + review.slot), top: 0, props, actors: [actor], phaseAreas: makeAreas(), questions: [],
             board: boardFor(null, "reviewing", review.taskId ?? "unassigned", 0), papers: {}, books: { lit: 0, total: 0 }, clock: 1,
-            phase: "reviewing", status: "reviewing", completedAt: null, overview: { x: 0, y: 0, width: 0, height: 0 } });
+            phase: "reviewing", status: "reviewing", completedAt: null, repo, overview: { x: 0, y: 0, width: 0, height: 0 } });
     });
+    // Rooms of one repository sit together; the sort is stable inside each.
+    floors.sort((a, b) => (a.repo ?? "").localeCompare(b.repo ?? ""));
     if (dialogue.length === 0)
         dialogue.push("The office is quiet. No agent is at work.");
     const columns = floors.length === 0 ? 1 : Math.min(floors.length, Math.max(1, Math.ceil(Math.sqrt(floors.length * OVERVIEW_COLS / OVERVIEW_ROWS))));

package/dist/runtime/src/office/server.js

@@ -3,12 +3,16 @@ import { createServer } from "node:http";
 import { rm } from "node:fs/promises";
 import { join } from "node:path";
 import { AgentOpsError } from "../fs/paths.js";
-import { readPrivateFile, withPrivateFileLock, writePrivateFile } from "../security/permissions.js";
+import { localStatePaths, readPrivateFile, withPrivateFileLock, writePrivateFile } from "../security/permissions.js";
 import { officePage } from "./page.js";
 export const OFFICE_IDLE_MS = 10 * 60 * 1000;
 const ACTIVE = new Set(["active", "awaiting-input", "stopping"]);
-export const officeRecordPath = (commonDir) => join(commonDir, "agent-ops", "office.json");
-const officeStartLockPath = (commonDir) => join(commonDir, "agent-ops", "office-start.lock");
+/** The user's one Office, beside the other per-user agent-ops state. */
+export const userOfficeHome = (homeDirectory) => ({ anchor: homeDirectory, dir: join(localStatePaths(homeDirectory).root, "office") });
+/** Where 0.7 kept one Office per repository. */
+export const legacyOfficeHome = (commonDir) => ({ anchor: commonDir, dir: join(commonDir, "agent-ops") });
+export const officeRecordPath = (home) => join(home.dir, "office.json");
+const officeStartLockPath = (home) => join(home.dir, "office-start.lock");
 export const officeUrl = (record) => `http://127.0.0.1:${record.port}/?token=${record.token}`;
 function same(a, b) {
     const left = Buffer.from(a), right = Buffer.from(b);
@@ -83,8 +87,8 @@ function alive(pid) {
     }
 }
 /** A recorded server counts only if its process lives and it answers with its own token. */
-export async function readLiveOffice(commonDir) {
-    const source = await readPrivateFile(officeRecordPath(commonDir), commonDir).catch(() => null);
+export async function readLiveOffice(home) {
+    const source = await readPrivateFile(officeRecordPath(home), home.anchor).catch(() => null);
     if (source === null)
         return null;
     try {
@@ -100,29 +104,29 @@ export async function readLiveOffice(commonDir) {
     }
 }
 /**
- * Starts serving unless another live server already owns the repository.
+ * Starts serving unless another live server already owns this home.
  * Returns null when this process should exit because one is already running.
  */
-export async function claimOffice(commonDir, office, pid = process.pid) {
-    return await withPrivateFileLock(officeRecordPath(commonDir), commonDir, async () => {
-        if (await readLiveOffice(commonDir) !== null)
+export async function claimOffice(home, office, pid = process.pid) {
+    return await withPrivateFileLock(officeRecordPath(home), home.anchor, async () => {
+        if (await readLiveOffice(home) !== null)
             return null;
         const record = { pid, port: await office.listen(), token: office.token, startedAt: new Date().toISOString() };
-        await writePrivateFile(officeRecordPath(commonDir), JSON.stringify(record) + "\n", commonDir);
+        await writePrivateFile(officeRecordPath(home), JSON.stringify(record) + "\n", home.anchor);
         return record;
     });
 }
 /** Reuse the live server, or start one and wait for it to record itself. */
-export async function ensureOffice(commonDir, start, options = {}) {
-    return await withPrivateFileLock(officeStartLockPath(commonDir), commonDir, async () => {
-        const live = await readLiveOffice(commonDir);
+export async function ensureOffice(home, start, options = {}) {
+    return await withPrivateFileLock(officeStartLockPath(home), home.anchor, async () => {
+        const live = await readLiveOffice(home);
         if (live !== null)
             return officeUrl(live);
         await start();
         const deadline = Date.now() + (options.timeoutMs ?? 10_000);
         while (Date.now() < deadline) {
             await new Promise(resolve => setTimeout(resolve, options.pollMs ?? 200));
-            const started = await readLiveOffice(commonDir);
+            const started = await readLiveOffice(home);
             if (started !== null)
                 return officeUrl(started);
         }
@@ -130,10 +134,10 @@ export async function ensureOffice(commonDir, start, options = {}) {
     });
 }
 /** Drop the record on exit, unless another server has replaced it. */
-export async function releaseOffice(commonDir, record) {
-    await withPrivateFileLock(officeRecordPath(commonDir), commonDir, async () => {
-        const source = await readPrivateFile(officeRecordPath(commonDir), commonDir).catch(() => null);
+export async function releaseOffice(home, record) {
+    await withPrivateFileLock(officeRecordPath(home), home.anchor, async () => {
+        const source = await readPrivateFile(officeRecordPath(home), home.anchor).catch(() => null);
         if (source !== null && JSON.parse(source).token === record.token)
-            await rm(officeRecordPath(commonDir), { force: true });
+            await rm(officeRecordPath(home), { force: true });
     });
 }

package/dist/runtime/src/office/sessions.js

@@ -107,9 +107,24 @@ export async function recordOfficeSession(options) {
             ...(options.taskId ?? previous?.taskId ? { taskId: options.taskId ?? previous?.taskId } : {}),
             ...(options.phase ?? previous?.phase ? { phase: options.phase ?? previous?.phase } : {}),
             ...(options.host ?? previous?.host ? { host: options.host ?? previous?.host } : {}),
-            ...(options.event === "stop" && previous?.completedAt !== undefined ? { completedAt: previous.completedAt } : {})
+            // A finished session keeps its closed room through the tool calls that
+            // report the result; only a new start (or resume) reopens it.
+            ...(options.event !== "start" && previous?.completedAt !== undefined ? { completedAt: previous.completedAt } : {})
         };
         const without = records.filter(record => record.sessionId !== options.sessionId);
         await writePrivateFile(path, JSON.stringify({ schemaVersion: 1, sessions: [...without, next].slice(-MAX_SESSIONS) }) + "\n", options.commonDir);
     });
 }
+/** Closes a session's room once `worktree finish` merged its work. Unknown sessions stay unknown. */
+export async function markOfficeSessionCompleted(commonDir, sessionId, now = Date.now()) {
+    const path = officeSessionsPath(commonDir);
+    await withPrivateFileLock(path, commonDir, async () => {
+        const records = prune(await readRecords(commonDir), now);
+        if (!records.some(record => record.sessionId === sessionId))
+            return;
+        const at = new Date(now).toISOString();
+        const next = records.map(record => record.sessionId === sessionId
+            ? { ...record, status: "idle", phase: "integrating", lastSeenAt: at, completedAt: at } : record);
+        await writePrivateFile(path, JSON.stringify({ schemaVersion: OFFICE_SESSION_SCHEMA_VERSION, sessions: next }) + "\n", commonDir);
+    });
+}

package/dist/runtime/src/office/snapshot.js

@@ -62,7 +62,8 @@ export function buildOfficeSnapshot(input) {
         if (worktree.runId !== undefined)
             continue;
         const session = bySession.get(worktree.sessionId);
-        const completedAt = worktree.completedAt ?? session?.completedAt ?? null;
+        // An active task in a live worktree is new work, whatever closed the session before.
+        const completedAt = worktree.completedAt ?? (worktree.status === "active" ? null : session?.completedAt ?? null);
         if (completedAt !== null && input.now - Date.parse(completedAt) >= COMPLETED_RETENTION_MS)
             continue;
         lobby.push({
@@ -77,7 +78,7 @@ export function buildOfficeSnapshot(input) {
             ...(worktree.status === undefined && session?.taskStatus === undefined && session?.status === undefined ? {} : { status: worktree.status ?? session?.taskStatus ?? session?.status }),
             ...(worktree.taskId === undefined && session?.taskId === undefined ? {} : { taskId: worktree.taskId ?? session?.taskId ?? null }),
             ...(worktree.progress === undefined && session?.progress === undefined ? {} : { progress: worktree.progress ?? session?.progress ?? null }),
-            ...(completedAt === null && session?.completedAt === undefined ? {} : { completedAt: completedAt ?? session?.completedAt ?? null }),
+            ...(completedAt === null && session?.completedAt === undefined ? {} : { completedAt }),
             ...(worktree.host === undefined && session?.host === undefined ? {} : { host: worktree.host ?? session?.host }),
         });
         represented.add(worktree.sessionId);
@@ -105,3 +106,12 @@ export function buildOfficeSnapshot(input) {
     }
     return { generatedAt: new Date(input.now).toISOString(), runs, lobby, reviews: input.reviews.filter(r => !claimed.has(r)) };
 }
+/** One building from several repositories' snapshots; every room names its repository. */
+export function mergeOfficeSnapshots(parts, now) {
+    return {
+        generatedAt: new Date(now).toISOString(),
+        runs: parts.flatMap(({ repo, snapshot }) => snapshot.runs.map(run => ({ ...run, repo }))),
+        lobby: parts.flatMap(({ repo, snapshot }) => snapshot.lobby.map(desk => ({ ...desk, repo }))),
+        reviews: parts.flatMap(({ repo, snapshot }) => snapshot.reviews.map(review => ({ ...review, repo })))
+    };
+}

package/dist/runtime/src/parallel/finish.js

@@ -11,6 +11,7 @@ import { readRunIntegrationProof, readRunIntegrationReceiptBinding, markRunInteg
 import { canonicalJson } from "../config/hash.js";
 import { listWorktrees } from "./manage.js";
 import { withPrivateFileLock } from "../security/permissions.js";
+import { markOfficeSessionCompleted } from "../office/sessions.js";
 import { assertWorktreeName, NOTES_REF, noteSessionLine, parseWorktreeListPorcelain, readWorktreeRecord, removeCheckout, resolveCheckouts, worktreePath } from "./service.js";
 const LOCK_NAME = "agent-ops-finish.lock";
 const LOCK_POLL_MS = 2_000;
@@ -488,6 +489,8 @@ export async function finishWorktree(deps, options) {
                 }
             });
         }
+        // Office is display-only: its room closing never fails or partially fails a finish.
+        await markOfficeSessionCompleted(commonDir, record.sessionId).catch(() => undefined);
         await attempt("trust", async () => await deps.trust.revoke(record.path, worktreeConfig));
         if (options.finalProof !== undefined) {
             for (const child of sessionChildren) {

package/dist/runtime/src/run/hosts/codex.js

@@ -236,7 +236,7 @@ export class CodexGoalHost {
             clientInfo: {
                 name: "agent-ops",
                 title: "agent-ops native goal host",
-                version: "0.6.0"
+                version: "0.7.1"
             }
         });
         session.notify("initialized", {});

package/dist/runtime/src/security/permissions.js

@@ -37,6 +37,10 @@ const execFile = promisify(execFileCallback);
 const lockQueues = new Map();
 const heartbeatFailures = new Map();
 const heartbeatPaths = new Set();
+// A heartbeat lives as long as the process. Its handle is held here, not only
+// by the interval below, so a reset or mocked timer can never let garbage
+// collection close it (an uncaught error since Node 26).
+const heartbeatHandles = new Set();
 const processHeartbeats = new Map();
 const processIdentityCache = new Map();
 let heartbeatCleanupRegistered = false;
@@ -151,6 +155,7 @@ async function ensureProcessHeartbeat(parent, anchorDirectory) {
             throw error;
         }
         heartbeatPaths.add(heartbeatPath);
+        heartbeatHandles.add(handle);
         registerHeartbeatCleanup();
         const heartbeat = {
             device,
@@ -161,6 +166,7 @@ async function ensureProcessHeartbeat(parent, anchorDirectory) {
             void handle.utimes(new Date(), new Date()).catch((error) => {
                 heartbeatFailures.set(cacheKey, error);
                 clearInterval(timer);
+                heartbeatHandles.delete(handle);
                 void handle.close().catch(() => {
                     process.emitWarning("A failed private-state heartbeat handle could not be closed.");
                 });

package/dist/runtime/src/verify/source-fingerprint.js

@@ -39,6 +39,10 @@ export async function calculateSourceFingerprint(root, scope, runner) {
             hash: sha256(bytes)
         });
     }
+    return worktreeFingerprint(head, paths);
+}
+/** A worktree-mode fingerprint; with no paths, that of a clean checkout at `head`. */
+export function worktreeFingerprint(head, paths = []) {
     return sha256(JSON.stringify({
         domain: "agent-ops-source-v1",
         mode: "worktree",

package/docs/en/spec/harness-adapters.md

@@ -204,11 +204,20 @@ Claude or Codex transcripts or file contents.
   disabled choice on its next 15-second lifecycle check.
 - Trigger: When enabled, a managed ordinary session starts or reports activity, or a user runs
   `agent-ops office`, `agent-ops run start` or `agent-ops run status`.
-- Action: The command reuses the live server recorded in
-  `<git common dir>/agent-ops/office.json`, or starts one, and prints its URL.
-  Ordinary session hooks also start or reuse it, including before a task or
-  worktree exists. Only the successful new-server owner opens the browser;
-  other sessions share the same Office. Session metadata contains bounded
+- Action: The command reuses the user's one live server recorded in
+  `~/.agent-ops/state/office/office.json` (under `AGENT_OPS_HOME` when set), or
+  starts one, and prints its URL. Ordinary session hooks also start or reuse it,
+  including before a task or worktree exists. Only the successful new-server
+  owner opens the browser; sessions in every repository share the same Office.
+  An Office-enabled repository registers its main root and Git common directory
+  in `repos.json` beside that record. Each collection re-checks that the
+  directory exists and the repository still opts in, and forgets a repository
+  quiet for two hours with nothing left to show. Rooms carry their repository's
+  name, their keys are scoped by it, and the page filters by repository. The
+  first report from a repository that still has a 0.7 per-repository record
+  boots its launchd job out and removes that record; its pid is never signalled.
+  A successful `worktree finish` records the session's completion so its room
+  closes; only a new start or an active task reopens it. Session metadata contains bounded
   identifiers, known work state and activity times, never native transcripts,
   prompts or tool/file contents. Startup and observation failures are advisory.
   The server binds

package/docs/zh-TW/spec/harness-adapters.md

@@ -177,10 +177,17 @@ base 的 `git diff`；旁白只使用路徑（`docs/**` 為「writing docs」、
   server MUST 在下一次 15 秒生命週期檢查觀察到關閉選擇後結束。
 - Trigger: 啟用後，Managed 一般 session 啟動或回報活動，或使用者執行
   `agent-ops office`、`agent-ops run start` 或 `agent-ops run status`。
-- Action: Command 重用記錄於 `<git common dir>/agent-ops/office.json` 的 live
-  server，否則啟動一個，並印出 URL。一般 session hook 也會自動啟動或重用
-  Office，包含尚未建立 task 或 worktree 的 session。只有成功取得新 server
-  所有權的 process 開啟瀏覽器，後續 session 共用同一個 Office。Session metadata
+- Action: Command 重用記錄於 `~/.agent-ops/state/office/office.json`（設定
+  `AGENT_OPS_HOME` 時位於其下）的使用者唯一 live server，否則啟動一個，並印出
+  URL。一般 session hook 也會自動啟動或重用 Office，包含尚未建立 task 或
+  worktree 的 session。只有成功取得新 server 所有權的 process 開啟瀏覽器，所有
+  repository 的 session 共用同一個 Office。啟用 Office 的 repository 會把 main
+  root 與 Git common directory 登記在同目錄的 `repos.json`。每次收集都重新確認
+  目錄存在且仍啟用，並忘記安靜超過兩小時且沒有內容可顯示的 repository。房間
+  帶有 repository 名稱，key 以其區隔，頁面可依 repository 篩選。仍留有 0.7
+  per-repository 紀錄的 repository 第一次回報時，會 bootout 其 launchd job 並
+  刪除該紀錄，絕不對其 pid 發送訊號。`worktree finish` 成功後會記錄 session
+  完成，使房間關閉；只有新的啟動或 active task 會重新開啟。Session metadata
   只記錄有界限的識別資訊、已知工作狀態與活動時間，不包含 native transcript、
   prompt、tool 或檔案內容。啟動與活動觀察失敗均為 advisory。
   Server 綁定 127.0.0.1 的隨機 port，要求 URL 中不可猜測的 token，拒絕該位址與

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kylecheng3146/agent-ops",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Evidence-driven development loops for agy, Codex, Claude Code, and opencode",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",