@lifeaitools/clauth 1.30.26 → 2.0.0

package/cli/commands/serve.js

@@ -47,6 +47,7 @@ import {
   runSurfaceAction,
   setPluginEnabled,
   supervisorHealth,
+  operation,
 } from "../supervisor-registry.js";
 import {
   AgentPool,
@@ -772,15 +773,13 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
   .btn-ccandme{background:linear-gradient(135deg,#1a1a2e,#16213e);color:#a78bfa;border:1px solid #4c1d95;padding:7px 16px;font-size:.85rem;border-radius:7px;cursor:pointer;font-weight:600;transition:all .15s;white-space:nowrap}
   .btn-ccandme:hover{background:linear-gradient(135deg,#2d1b69,#1e1b4b);border-color:#7c3aed;color:#c4b5fd;transform:translateY(-1px)}
   .btn-ccandme:disabled{opacity:.5;cursor:not-allowed;transform:none}
-  .btn-tintin{background:linear-gradient(135deg,#103c2f,#0f2f3f);color:#86efac;border:1px solid #166534;padding:7px 16px;font-size:.85rem;border-radius:7px;cursor:pointer;font-weight:700;transition:all .15s;white-space:nowrap}
-  .btn-tintin:hover{background:linear-gradient(135deg,#14532d,#155e75);border-color:#22c55e;color:#bbf7d0;transform:translateY(-1px)}
-  .btn-tintin:disabled{opacity:.5;cursor:not-allowed;transform:none}
   .btn-claude{background:linear-gradient(135deg,#d97706,#f59e0b);color:#0a0f1a;padding:8px 18px;font-size:.85rem;border-radius:7px;border:none;cursor:pointer;font-weight:700;letter-spacing:.3px;transition:all .15s;white-space:nowrap}
   .btn-claude:hover{filter:brightness(1.1);transform:translateY(-1px)}
   .btn-claude:disabled{opacity:.4;cursor:not-allowed;transform:none;filter:none}
   .btn-tunnel-stop{background:#1e293b;color:#f87171;border:1px solid #334155;padding:6px 12px;font-size:.8rem;border-radius:6px;cursor:pointer;font-weight:500}
   .btn-tunnel-stop:hover{background:#2d1f1f;border-color:#f87171}
   .tunnel-err{font-size:.78rem;color:#f87171;width:100%;margin-top:4px}
+  .dash-panel{margin-bottom:1.25rem}
   .build-panel{background:#0f1a2d;border:1px solid #1e3a5f;border-radius:8px;padding:1rem 1.25rem;margin-bottom:1.25rem;display:flex;align-items:center;gap:12px;flex-wrap:wrap}
   .build-dot{width:10px;height:10px;border-radius:50%;flex-shrink:0}
   .build-dot.idle{background:#64748b}
@@ -791,25 +790,6 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
   .build-label{font-size:.85rem;color:#94a3b8;flex:1}
   .build-label strong{color:#e2e8f0}
   .build-meta{font-family:'Courier New',monospace;font-size:.75rem;color:#64748b}
-  .tintin-tab{position:fixed;top:50%;right:0;transform:translateY(-50%);z-index:81;writing-mode:vertical-rl;text-orientation:mixed;background:linear-gradient(180deg,#103c2f,#0f2f3f);color:#86efac;border:1px solid #166534;border-right:none;border-radius:8px 0 0 8px;padding:14px 6px;font-size:.78rem;font-weight:700;cursor:pointer;letter-spacing:.5px;transition:all .2s}
-  .tintin-tab:hover{background:linear-gradient(180deg,#14532d,#155e75);color:#bbf7d0;padding-right:10px}
-  .tintin-tab.active{background:#081c1a;border-color:#22c55e;color:#bbf7d0}
-  .tintin-panel{position:fixed;top:0;right:-440px;bottom:0;z-index:80;width:min(420px,calc(100vw - 24px));background:#081c1a;border-left:1px solid #14532d;padding:0;box-shadow:-22px 0 60px rgba(0,0,0,.42);display:flex;flex-direction:column;transition:right .25s ease}
-  .tintin-panel.open{right:0}
-  .tintin-head{display:flex;align-items:center;justify-content:space-between;gap:10px;margin-bottom:.8rem}
-  .tintin-title{font-size:.95rem;font-weight:700;color:#dcfce7}
-  .tintin-sub{font-size:.78rem;color:#6ee7b7;margin-top:2px}
-  .tintin-grid{display:grid;grid-template-columns:1fr 1fr;gap:10px;margin-bottom:10px}
-  .tintin-field{display:flex;flex-direction:column;gap:4px}
-  .tintin-field label{font-size:.72rem;color:#94a3b8;text-transform:uppercase;letter-spacing:.04em;font-weight:700}
-  .tintin-input,.tintin-textarea{background:#031312;border:1px solid #14532d;border-radius:6px;color:#e2e8f0;font-family:'Courier New',monospace;font-size:.85rem;padding:8px 10px;outline:none;transition:border-color .15s}
-  .tintin-input:focus,.tintin-textarea:focus{border-color:#22c55e}
-  .tintin-textarea{width:100%;min-height:92px;resize:vertical;line-height:1.45;margin-bottom:10px}
-  .tintin-actions{display:flex;align-items:center;gap:8px;flex-wrap:wrap}
-  .tintin-status{font-family:'Courier New',monospace;font-size:.78rem;color:#94a3b8}
-  .tintin-result{display:none;margin-top:12px;background:#020b0a;border:1px solid #134e4a;border-radius:8px;padding:10px;white-space:pre-wrap;word-break:break-word;font-family:'Courier New',monospace;font-size:.82rem;color:#bbf7d0;max-height:240px;overflow:auto}
-  .tintin-result.open{display:block}
-  @media (max-width:720px){.tintin-panel{width:100vw}.tintin-grid{grid-template-columns:1fr}}
   .mcp-row{display:flex;align-items:center;gap:8px;margin-bottom:8px}
   .mcp-label{font-size:.72rem;color:#64748b;min-width:80px;text-transform:uppercase;letter-spacing:.5px;font-weight:600}
   .mcp-val{flex:1;font-family:'Courier New',monospace;font-size:.82rem;color:#60a5fa;background:#0a0f1a;border:1px solid #1e3a5f;border-radius:4px;padding:6px 10px;word-break:break-all;user-select:all}
@@ -936,10 +916,16 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
   .supervisor-pill.warn{border-color:rgba(250,204,21,.35);color:#fde68a;background:rgba(250,204,21,.08)}
   .supervisor-pill.bad{border-color:rgba(248,113,113,.35);color:#fecaca;background:rgba(248,113,113,.08)}
   .supervisor-list{display:flex;flex-direction:column;gap:8px;max-height:320px;overflow:auto}
-  .supervisor-row{border:1px solid #1e293b;border-radius:8px;padding:8px;background:rgba(15,23,42,.45)}
+  .supervisor-row{border:1px solid #1e293b;border-radius:8px;padding:6px 8px;background:rgba(15,23,42,.45);cursor:pointer}
+  .supervisor-row:hover{border-color:#334155}
+  .supervisor-row.selected{border-color:#38bdf8;background:rgba(56,189,248,.08)}
+  .supervisor-row.readonly{cursor:default}
   .supervisor-row-top{display:flex;justify-content:space-between;gap:8px;align-items:center}
   .supervisor-name{font-size:.82rem;color:#e2e8f0;font-weight:600;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
   .supervisor-row-actions{display:flex;gap:5px;flex-wrap:wrap;margin-top:7px}
+  .supervisor-cmdbar{display:flex;gap:6px;flex-wrap:wrap;align-items:center;margin-bottom:8px;padding:8px;border:1px solid #1e293b;border-radius:8px;background:rgba(2,6,23,.4);min-height:36px}
+  .supervisor-cmdbar-empty{font-size:.74rem;color:#64748b}
+  .supervisor-cmdbar-name{font-size:.78rem;color:#e2e8f0;font-weight:600;margin-right:4px}
   .supervisor-log{font-family:'Courier New',monospace;font-size:.7rem;color:#94a3b8;white-space:pre-wrap;word-break:break-word;max-height:280px;overflow:auto}
   .supervisor-feedback{margin-top:8px;padding:7px 9px;border-radius:6px;font-family:'Courier New',monospace;font-size:.72rem;color:#86efac;background:rgba(34,197,94,.08);border:1px solid rgba(74,222,128,.22);display:none}
   .supervisor-feedback.bad{color:#fecaca;background:rgba(248,113,113,.08);border-color:rgba(248,113,113,.25)}
@@ -982,13 +968,7 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
 
 <!-- ── Main view (shown after unlock) ──────── -->
 <div id="main-view">
-  <div id="upgrade-banner" style="display:none" class="upgrade-banner">
-    <div class="upgrade-content">
-      <strong>⬆ clauth upgraded to v<span id="upgrade-to-version"></span></strong>
-      <span id="upgrade-details"></span>
-      <button onclick="dismissUpgrade()">Dismiss ✕</button>
-    </div>
-  </div>
+  <section class="dash-panel" data-panel="title-status">
   <div class="header">
     <div class="dot" id="dot"></div>
     <h1>🔐 clauth vault <span style="font-size:0.55em;opacity:0.45;font-weight:400">v${VERSION}</span>${isStaged ? `<span style="font-size:0.5em;background:#b45309;color:#fef3c7;border-radius:4px;padding:2px 10px;margin-left:12px;font-weight:600;letter-spacing:.5px">STAGED</span>` : ""}</h1>
@@ -1007,6 +987,16 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
     <div>Services: <span id="s-services">${whitelist ? whitelist.join(", ") : "all"}</span></div>
     <div>Failures: <span id="s-fails">—</span></div>
   </div>
+  </section>
+
+  <section class="dash-panel" data-panel="status-area">
+  <div id="upgrade-banner" style="display:none" class="upgrade-banner">
+    <div class="upgrade-content">
+      <strong>⬆ clauth upgraded to v<span id="upgrade-to-version"></span></strong>
+      <span id="upgrade-details"></span>
+      <button onclick="dismissUpgrade()">Dismiss ✕</button>
+    </div>
+  </div>
   <div class="build-panel" id="build-panel">
     <div class="build-dot idle" id="build-dot"></div>
     <div class="build-label" id="build-label">
@@ -1015,8 +1005,9 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
     <span id="build-sha" style="font-family:'Courier New',monospace;font-size:.72rem;color:#60a5fa;background:#0a0f1a;border:1px solid #1e3a5f;border-radius:4px;padding:2px 8px;letter-spacing:.3px"></span>
     <div class="build-meta" id="build-meta" style="width:100%;margin-top:4px"></div>
   </div>
+  </section>
 
-  <div class="toolbar">
+  <div class="toolbar" data-panel="menu-bar">
     <button class="btn-refresh" onclick="loadServices()">↻ Refresh</button>
     <button class="btn-add" onclick="toggleAddService()">+ Add Service</button>
     <button class="btn-check" id="check-btn" onclick="checkAll()">⬤ Check All</button>
@@ -1108,7 +1099,7 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
     </form>
   </div>
 
-  <div class="tunnel-panel" id="tunnel-panel">
+  <div class="tunnel-panel" id="tunnel-panel" data-panel="tunnel-bar">
     <!-- not_configured -->
     <div class="tunnel-state not-configured" style="display:none;align-items:center;gap:10px;width:100%;flex-wrap:wrap">
       <div class="tunnel-dot off"></div>
@@ -1149,39 +1140,7 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
     </div>
   </div>
 
-  <div class="tintin-tab" id="tintin-tab" onclick="toggleTinTinPanel()">TinTin</div>
-  <div class="tintin-panel" id="tintin-panel">
-    <div class="tintin-head" style="padding:12px 16px;border-bottom:1px solid #14532d;flex-shrink:0">
-      <div style="display:flex;align-items:center;justify-content:space-between">
-        <div class="tintin-title">TinTin</div>
-        <button class="btn-cancel" onclick="toggleTinTinPanel()" style="font-size:16px;padding:2px 6px">x</button>
-      </div>
-      <div class="tintin-sub">claude-sonnet-4-6 · clauth CLI dispatch</div>
-      <div style="margin-top:6px"><a href="/tintin/settings/ui" target="_blank" rel="noopener" style="font-size:.72rem;color:#86efac;text-decoration:none;border:1px solid #14532d;padding:2px 6px;border-radius:4px">Agent settings</a></div>
-    </div>
-    <div id="tintin-messages" style="flex:1;min-height:0;overflow-y:auto;padding:12px 16px;display:flex;flex-direction:column;gap:10px">
-      <div style="font-size:.78rem;color:#6ee7b7;font-style:italic">Ask anything. Runs a Claude CLI agent with full clauth + repo context.</div>
-    </div>
-    <div style="padding:10px 16px;border-top:1px solid #14532d;flex-shrink:0">
-      <div class="tintin-grid" style="margin-bottom:8px">
-        <div class="tintin-field">
-          <label>CWD</label>
-          <input class="tintin-input" id="tintin-cwd" value="C:\\Dev\\regen-root" spellcheck="false" autocomplete="off">
-        </div>
-        <div class="tintin-field">
-          <label>App</label>
-          <input class="tintin-input" id="tintin-app" value="clauth" spellcheck="false" autocomplete="off">
-        </div>
-      </div>
-      <textarea class="tintin-textarea" id="tintin-prompt" spellcheck="false" placeholder="Ask TinTin..." style="min-height:64px;margin-bottom:8px"></textarea>
-      <div style="display:flex;gap:8px;align-items:center">
-        <button class="btn-tintin" id="tintin-send" onclick="sendTinTinMessage()" style="flex:1">Send</button>
-        <span class="tintin-status" id="tintin-status">idle</span>
-      </div>
-    </div>
-  </div>
-
-  <section class="supervisor-panel" id="supervisor-panel">
+  <section class="supervisor-panel" id="supervisor-panel" data-panel="surfaces-log">
     <div class="supervisor-head">
       <div>
         <div class="supervisor-title">Local Software Factory Supervisor</div>
@@ -1199,6 +1158,7 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
         <h4>Surfaces</h4>
         <div class="supervisor-kpi" id="supervisor-surface-count">—</div>
         <div class="supervisor-meta" id="supervisor-surface-meta">destination + owner matrix</div>
+        <div class="supervisor-cmdbar" id="supervisor-cmdbar"><span class="supervisor-cmdbar-empty">Select a surface below to act on it.</span></div>
         <div class="supervisor-list" id="supervisor-surfaces" style="margin-top:8px"></div>
       </div>
       <div class="supervisor-card">
@@ -1211,7 +1171,7 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
   </section>
 
 
-  <div class="tunnel-panel" id="webdav-panel" style="flex-direction:column;align-items:stretch;gap:8px">
+  <div class="tunnel-panel" id="webdav-panel" data-panel="webdav-mounts" style="flex-direction:column;align-items:stretch;gap:8px">
     <div style="display:flex;align-items:center;gap:10px;width:100%">
       <div class="tunnel-dot off" id="webdav-dot"></div>
       <strong style="color:#e2e8f0;font-size:.88rem">WebDAV Mounts</strong>
@@ -1247,6 +1207,7 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
     <div class="wizard-foot" id="wizard-foot"></div>
   </div>
 
+  <section class="dash-panel" data-panel="search-credentials">
   <div id="project-tabs" class="project-tabs" style="display:none"></div>
   <div id="service-search" class="service-search">
     <span class="service-search-label">Search</span>
@@ -1254,7 +1215,8 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
     <span id="service-search-count" class="service-search-count"></span>
   </div>
   <div id="grid" class="grid"><p class="loading">Loading services…</p></div>
-  <div class="footer" id="originFooter">checking origin… · 10-strike lockout</div>
+  </section>
+  <div class="footer" id="originFooter" data-panel="footer">checking origin… · 10-strike lockout</div>
 </div>
 
 <script>
@@ -1496,9 +1458,17 @@ function showMain(ping) {
   loadWebdavMounts();
   updateBuildStatus();
   loadSupervisorCockpit();
+  startSupervisorLogTail();
   refreshWriteLockUi();
 }
 
+let supervisorLogTailStarted = false;
+function startSupervisorLogTail() {
+  if (supervisorLogTailStarted) return; // showMain() can run more than once per page load
+  supervisorLogTailStarted = true;
+  setInterval(loadSupervisorCockpit, 3000);
+}
+
 function supervisorBadge(text, kind) {
   return '<span class="supervisor-pill ' + (kind || '') + '">' + htmlEscape(text) + '</span>';
 }
@@ -1518,6 +1488,22 @@ function supervisorFeedback(text, bad) {
   el.style.display = text ? "block" : "none";
 }
 
+const SUPERVISOR_SURFACE_ACTIONS = ["start", "stop", "restart", "reconcile", "test", "promote", "rollback"];
+let selectedSupervisorSurface = null; // { id, name } | null
+let lastSupervisorSurfaceRows = [];
+
+const CLAUTH_SELF_PSEUDO_SURFACE = {
+  __pseudo: true,
+  id: "clauth:mcp-sse",
+  plugin_id: "clauth",
+  name: "clauth (self)",
+  lifecycle_owner: "external",
+  destination: "self",
+  state: "self_managed",
+  port: null,
+  health: null,
+};
+
 async function loadSupervisorCockpit() {
   const status = document.getElementById("supervisor-status");
   if (status) status.textContent = "Loading supervisor state…";
@@ -1527,16 +1513,27 @@ async function loadSupervisorCockpit() {
       supervisorJson("/v1/surfaces"),
       supervisorJson("/v1/logs?limit=40"),
     ]);
-    const surfaceRows = surfaces.surfaces || [];
-    document.getElementById("supervisor-surface-count").textContent = String(surfaceRows.length);
+    const surfaceRows = [CLAUTH_SELF_PSEUDO_SURFACE, ...(surfaces.surfaces || [])];
+    lastSupervisorSurfaceRows = surfaceRows;
+    if (selectedSupervisorSurface && !surfaceRows.some(s => (s.plugin_id + ":" + s.id) === selectedSupervisorSurface.id)) {
+      selectedSupervisorSurface = null;
+    }
+    document.getElementById("supervisor-surface-count").textContent = String(surfaceRows.length - 1);
     document.getElementById("supervisor-operation-count").textContent = String((logs.operations || []).length);
     document.getElementById("supervisor-surface-meta").textContent = "pm2 home: " + (health.pm2_home || "—");
     document.getElementById("supervisor-log-path").textContent = logs.log_path || "events.jsonl";
-    document.getElementById("supervisor-surfaces").innerHTML = surfaceRows.length ? surfaceRows.map(renderSupervisorSurface).join("") : '<div class="supervisor-sub">No surfaces declared.</div>';
-    document.getElementById("supervisor-events").textContent = (logs.events || []).slice(-20).reverse().map(e => {
+    document.getElementById("supervisor-surfaces").innerHTML = surfaceRows.map(renderSupervisorSurface).join("");
+    renderSupervisorCmdbar();
+    const logEl = document.getElementById("supervisor-events");
+    // Newest-at-bottom, like a real tail -- and only auto-scroll if the
+    // reader was already at the bottom, so scrolling up to read history
+    // during a poll tick doesn't get yanked back down.
+    const wasAtBottom = logEl.scrollHeight - logEl.scrollTop - logEl.clientHeight < 12;
+    logEl.textContent = (logs.events || []).slice(-40).map(e => {
       const label = e.kind === "operation" ? (e.action + " " + JSON.stringify(e.target || {})) : (e.kind + " " + (e.plugin_id || ""));
       return (e.ts || e.created_at || "") + "  " + label;
     }).join("\\n") || "No events yet.";
+    if (wasAtBottom) logEl.scrollTop = logEl.scrollHeight;
     if (status) status.innerHTML = supervisorBadge("supervisor " + (health.status === "ok" ? "healthy" : (health.status || "unknown")), health.status === "ok" ? "ok" : "warn") + supervisorBadge("vault " + (health.vault_locked ? "locked" : "unlocked"), health.vault_locked ? "warn" : "ok") + supervisorBadge("v" + (health.clauth_version || "${VERSION}"), "");
   } catch (err) {
     if (status) status.innerHTML = supervisorBadge("supervisor unreachable", "bad") + " " + htmlEscape(err.message || err);
@@ -1544,13 +1541,55 @@ async function loadSupervisorCockpit() {
   }
 }
 
+// Derives an "Open UI" target for a surface without storing one on disk —
+// a real localhost port wins, else the first externally-routable URL.
+function openUiUrlForSurface(surface) {
+  if (surface.port && surface.port !== "auto") return "http://127.0.0.1:" + surface.port + "/";
+  const external = (surface.routes || []).find(r => r.kind === "external" && r.url);
+  return external ? external.url : null;
+}
+
+function selectSupervisorSurface(compositeId, name) {
+  selectedSupervisorSurface = selectedSupervisorSurface && selectedSupervisorSurface.id === compositeId
+    ? null // clicking the already-selected card deselects it
+    : { id: compositeId, name };
+  document.querySelectorAll(".supervisor-row[data-surface-id]").forEach(row => {
+    row.classList.toggle("selected", row.dataset.surfaceId === (selectedSupervisorSurface && selectedSupervisorSurface.id));
+  });
+  renderSupervisorCmdbar();
+}
+
+function renderSupervisorCmdbar() {
+  const bar = document.getElementById("supervisor-cmdbar");
+  if (!bar) return;
+  if (!selectedSupervisorSurface) {
+    bar.innerHTML = '<span class="supervisor-cmdbar-empty">Select a surface below to act on it.</span>';
+    return;
+  }
+  const { id, name } = selectedSupervisorSurface;
+  bar.innerHTML = '<span class="supervisor-cmdbar-name">' + htmlEscape(name) + '</span>' +
+    SUPERVISOR_SURFACE_ACTIONS.map(a => '<button class="supervisor-action" data-supervisor-action="' + a + '" onclick="runSupervisorSurface(' + jsArg(id) + ',' + jsArg(a) + ')">' + a + '</button>').join("");
+}
+
 function renderSupervisorSurface(surface) {
+  const compositeId = surface.plugin_id + ":" + surface.id;
   const ownerKind = surface.lifecycle_owner === "clauth" ? "ok" : (surface.lifecycle_owner === "plugin" ? "warn" : "");
   const stateKind = surface.state === "current" || surface.status === "healthy" ? "ok" : (surface.state === "unavailable" ? "bad" : "warn");
-  return '<div class="supervisor-row"><div class="supervisor-row-top"><span class="supervisor-name">' + htmlEscape(surface.plugin_id + ":" + surface.id) + '</span>' + supervisorBadge(surface.lifecycle_owner || "unknown", ownerKind) + supervisorBadge(surface.state || surface.status || "unknown", stateKind) + '</div>' +
+  const openUrl = surface.__pseudo ? null : openUiUrlForSurface(surface);
+  const isSelected = selectedSupervisorSurface && selectedSupervisorSurface.id === compositeId;
+  const rowClass = "supervisor-row" + (surface.__pseudo ? " readonly" : "") + (isSelected ? " selected" : "");
+  const onclick = surface.__pseudo ? "" : ' onclick="selectSupervisorSurface(' + jsArg(compositeId) + ',' + jsArg(surface.name || compositeId) + ')"';
+  const openBtn = surface.__pseudo
+    ? '<button class="supervisor-action" onclick="event.stopPropagation();openClauthSelfMcp()" title="Open clauth\\'s own MCP endpoint">Open</button>'
+    : (openUrl ? '<button class="supervisor-action" onclick="event.stopPropagation();window.open(' + jsArg(openUrl) + ',\\'_blank\\')" title="Open this surface\\'s UI">Open UI</button>' : "");
+  return '<div class="' + rowClass + '" data-surface-id="' + htmlEscape(compositeId) + '"' + onclick + '>' +
+    '<div class="supervisor-row-top"><span class="supervisor-name">' + htmlEscape(surface.name || compositeId) + '</span>' +
+    supervisorBadge(surface.lifecycle_owner || "unknown", ownerKind) + supervisorBadge(surface.state || surface.status || "unknown", stateKind) +
+    openBtn +
+    '</div>' +
     '<div class="supervisor-meta">' + htmlEscape(surface.destination || "—") + ' · port ' + htmlEscape(surface.port || "—") + '</div>' +
     '<div class="supervisor-meta">' + htmlEscape(surface.health || surface.health_url || "no health") + '</div>' +
-    '<div class="supervisor-row-actions">' + ["start","stop","restart","reconcile","test","promote","rollback"].map(a => '<button class="supervisor-action" data-supervisor-action="' + a + '" onclick="runSupervisorSurface(' + jsArg(surface.id) + ',' + jsArg(a) + ')">' + a + '</button>').join("") + '</div></div>';
+    '</div>';
 }
 
 async function rescanSupervisorPlugins() {
@@ -1570,6 +1609,21 @@ async function runSupervisorSurface(id, action) {
   } catch (err) { supervisorFeedback("Surface " + action + " failed: " + (err.message || err), true); }
 }
 
+// clauth doesn't manage itself as a plugin, so its own MCP endpoint has no
+// entry in the real surfaces registry — this reads the vault value directly
+// (never hardcoded) rather than storing a synthetic surfaces row.
+async function openClauthSelfMcp() {
+  try {
+    const res = await fetch(BASE + "/v/mcp-clauth-endpoint");
+    const text = (await res.text()).trim();
+    if (!res.ok) {
+      supervisorFeedback("Could not read clauth's own MCP endpoint: " + text, true);
+      return;
+    }
+    window.open(text, "_blank");
+  } catch (err) { supervisorFeedback("Could not read clauth's own MCP endpoint: " + (err.message || err), true); }
+}
+
 // ── Unlock ──────────────────────────────────
 async function unlock() {
   const input = document.getElementById("lock-input");
@@ -1743,124 +1797,6 @@ async function launchCCandMe() {
   }
 }
 
-// ── TinTin local CLI dispatch sidebar ──
-let tintinPollTimer = null;
-
-function toggleTinTinPanel() {
-  const panel = document.getElementById("tintin-panel");
-  const tab = document.getElementById("tintin-tab");
-  if (!panel) return;
-  panel.classList.toggle("open");
-  if (tab) tab.classList.toggle("active");
-}
-
-function fillTinTinSmoke() {
-  const prompt = document.getElementById("tintin-prompt");
-  const app = document.getElementById("tintin-app");
-  if (app) app.value = "clauth-dashboard";
-  if (prompt) prompt.value = "Reply exactly: tintin-dashboard-ok";
-}
-
-function setTinTinStatus(text) {
-  const el = document.getElementById("tintin-status");
-  if (el) el.textContent = text || "";
-}
-
-function appendTinTinMessage(role, text) {
-  const container = document.getElementById("tintin-messages");
-  if (!container || !text) return;
-  const bubble = document.createElement("div");
-  bubble.style.cssText = role === "user"
-    ? "background:#14532d;border:1px solid #166534;border-radius:8px;padding:8px 10px;font-size:.82rem;color:#bbf7d0;white-space:pre-wrap;word-break:break-word;align-self:flex-end;max-width:90%"
-    : "background:#0a1f1a;border:1px solid #134e4a;border-radius:8px;padding:8px 10px;font-size:.82rem;color:#86efac;font-family:'Courier New',monospace;white-space:pre-wrap;word-break:break-word;max-width:95%;max-height:300px;overflow:auto";
-  bubble.textContent = text;
-  container.appendChild(bubble);
-  container.scrollTop = container.scrollHeight;
-}
-
-function setTinTinResult(text, open) {
-  if (open && text) appendTinTinMessage("assistant", text);
-}
-
-async function sendTinTinMessage() {
-  const sendBtn = document.getElementById("tintin-send");
-  const promptEl = document.getElementById("tintin-prompt");
-  const appEl = document.getElementById("tintin-app");
-  const cwdEl = document.getElementById("tintin-cwd");
-  const prompt = (promptEl && promptEl.value || "").trim();
-  const appSlug = (appEl && appEl.value || "clauth-dashboard").trim() || "clauth-dashboard";
-  const cwd = (cwdEl && cwdEl.value || "").trim();
-  if (!prompt) {
-    setTinTinStatus("prompt required");
-    return;
-  }
-  if (tintinPollTimer) {
-    clearTimeout(tintinPollTimer);
-    tintinPollTimer = null;
-  }
-  const jobId = "tintin-" + Date.now();
-  const body = {
-    prompt,
-    job_id: jobId,
-    cwd,
-    agent_context: {
-      app: { slug: appSlug, route: "/clauth-dashboard", origin: window.location.origin },
-      repo: { root: cwd, cwd },
-      runtime: { agent: "clauth-cli", requested_by: "clauth-dashboard", model: "claude-sonnet-4-6" },
-      task: { intent: "general_chat", thread_id: jobId }
-    }
-  };
-
-  appendTinTinMessage("user", prompt);
-  if (promptEl) promptEl.value = "";
-  if (sendBtn) { sendBtn.disabled = true; sendBtn.textContent = "Dispatching..."; }
-  setTinTinStatus("dispatching");
-  try {
-    const response = await fetch(BASE + "/tintin/dispatch", {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body)
-    });
-    const result = await response.json();
-    if (!response.ok || result.error) {
-      setTinTinStatus("dispatch failed");
-      setTinTinResult(JSON.stringify(result, null, 2), true);
-      return;
-    }
-    setTinTinStatus("spawned pid " + result.pid + " - polling");
-    pollTinTinJob(jobId, 0);
-  } catch (err) {
-    setTinTinStatus("dispatch error");
-    setTinTinResult(err && err.message ? err.message : String(err), true);
-  } finally {
-    if (sendBtn) { sendBtn.disabled = false; sendBtn.textContent = "Dispatch"; }
-  }
-}
-
-async function pollTinTinJob(jobId, attempt) {
-  try {
-    const response = await fetch(BASE + "/tintin/dispatch/" + encodeURIComponent(jobId), { cache: "no-store" });
-    const job = await response.json();
-    if (!response.ok || job.error) {
-      setTinTinStatus("job lookup failed");
-      setTinTinResult(JSON.stringify(job, null, 2), true);
-      return;
-    }
-    if (job.status === "running" && attempt < 60) {
-      setTinTinStatus("running pid " + (job.pid || "?") + " - " + (attempt + 1));
-      tintinPollTimer = setTimeout(function() { pollTinTinJob(jobId, attempt + 1); }, 1500);
-      return;
-    }
-    setTinTinStatus(job.status === "completed" ? "done" : job.status);
-    const out = (job.stdout || "").trim();
-    if (out) appendTinTinMessage("assistant", out);
-    if (job.stderr && job.stderr.trim()) appendTinTinMessage("assistant", "stderr: " + job.stderr.trim());
-  } catch (err) {
-    setTinTinStatus("poll error");
-    setTinTinResult(err && err.message ? err.message : String(err), true);
-  }
-}
-
 // ── Restart daemon (keeps boot.key — vault stays unlocked) ──
 async function restartDaemon() {
   if (!confirm("Restart the daemon?\\n\\nThe vault will stay unlocked (boot.key kept).")) return;
@@ -1932,8 +1868,16 @@ function switchProjectTab(key) {
   renderServiceGrid(allServices);
 }
 
+const MCP_SURFACE_DUPLICATE_SERVICES = new Set([
+  "mcp-clauth-endpoint",
+  "mcp-fs-endpoint",
+  "mcp-regen-media-endpoint",
+  "mcp-web-research-endpoint",
+]);
+
 function renderServiceGrid(services) {
   const grid = document.getElementById("grid");
+  services = services.filter(s => !MCP_SURFACE_DUPLICATE_SERVICES.has(s.name));
   let filtered = services;
   if (activeProjectTab === "unassigned") {
     filtered = services.filter(s => !s.project);
@@ -3326,11 +3270,6 @@ setInterval(async () => {
 }, 5000);
 
 boot();
-
-const tintinSidebarScript = document.createElement("script");
-tintinSidebarScript.src = "/tintin/sidebar.user.js";
-tintinSidebarScript.defer = true;
-document.body.appendChild(tintinSidebarScript);
 </script>
 </body>
 </html>`;
@@ -3353,561 +3292,6 @@ function clauthConfigDir() {
   return path.join(os.homedir(), ".config", "clauth");
 }
 
-function tintinConfigPath() {
-  return process.env.CLAUTH_MONKEY_CONFIG || path.join(clauthConfigDir(), "monkey.config.json");
-}
-
-function defaultTinTinConfig() {
-  return {
-    schema_version: 3,
-    trust_mode: process.env.CLAUTH_MONKEY_TRUST_MODE || "open-local",
-    agent_settings: {
-      default_repo_root: process.env.CLAUTH_TINTIN_REPO_ROOT || "C:\\Dev\\regen-root",
-      worktree_root: process.env.CLAUTH_TINTIN_WORKTREE_ROOT || "C:\\Dev\\regen-root.wt",
-      base_branch: process.env.CLAUTH_TINTIN_BASE_BRANCH || "develop",
-      isolation: process.env.CLAUTH_TINTIN_ISOLATION || "worktree",
-      launch_mode: "setup_only",
-      agents: {
-        claude: {
-          runtime: "claude",
-          model: process.env.CLAUTH_TINTIN_CLAUDE_MODEL || "claude-sonnet-4-6",
-          command: process.env.CLAUDE_BIN || "claude",
-          enabled: true,
-        },
-        codex: {
-          runtime: "codex",
-          model: process.env.CLAUTH_TINTIN_CODEX_MODEL || "gpt-5-codex",
-          command: process.env.CODEX_BIN || "codex",
-          enabled: true,
-        },
-      },
-    },
-    sidebar_settings: {
-      enabled: true,
-      default_app_slug: "tintin-console",
-      session_ttl_hours: 24,
-      event_history_limit: 200,
-    },
-    dispatch_settings: {
-      enabled: true,
-      default_agent: "claude",
-      default_model: process.env.CLAUTH_TINTIN_CLAUDE_MODEL || "claude-sonnet-4-6",
-      max_concurrent_workers: 2,
-    },
-    codevelop_settings: {
-      enabled: true,
-      default_repo: process.env.CLAUTH_TINTIN_REPO_ROOT || "C:\\Dev\\regen-root",
-      message_retention_limit: 500,
-      require_peer_join: true,
-    },
-    agent_sessions: [],
-    apps: [
-      {
-        slug: "rdc-marketing-engine",
-        origins: [
-          "http://localhost:3000",
-          "http://127.0.0.1:3000",
-          "https://app.regendevcorp.com",
-          "https://rdc-marketing-engine.dev.regendevcorp.com",
-        ],
-        manifest_url: "https://app.regendevcorp.com/.well-known/monkey.json",
-        cwd: "C:\\Dev\\regen-root",
-        capabilities: ["general_chat", "skill_request", "handoff"],
-      },
-    ],
-  };
-}
-
-function mergeTinTinAgentSettings(input = {}) {
-  const defaults = defaultTinTinConfig().agent_settings;
-  const incoming = input && typeof input === "object" ? input : {};
-  return {
-    ...defaults,
-    ...incoming,
-    agents: {
-      ...defaults.agents,
-      ...(incoming.agents && typeof incoming.agents === "object" ? incoming.agents : {}),
-    },
-  };
-}
-
-function mergeTinTinSectionSettings(sectionName, input = {}) {
-  const defaults = defaultTinTinConfig()[sectionName] || {};
-  const incoming = input && typeof input === "object" ? input : {};
-  return { ...defaults, ...incoming };
-}
-
-function normalizeTinTinConfig(input = {}) {
-  const defaults = defaultTinTinConfig();
-  return {
-    schema_version: Math.max(Number(input.schema_version || 0), defaults.schema_version),
-    trust_mode: typeof input.trust_mode === "string" ? input.trust_mode : defaults.trust_mode,
-    agent_settings: mergeTinTinAgentSettings(input.agent_settings),
-    sidebar_settings: mergeTinTinSectionSettings("sidebar_settings", input.sidebar_settings),
-    dispatch_settings: mergeTinTinSectionSettings("dispatch_settings", input.dispatch_settings),
-    codevelop_settings: mergeTinTinSectionSettings("codevelop_settings", input.codevelop_settings),
-    agent_sessions: Array.isArray(input.agent_sessions) ? input.agent_sessions : defaults.agent_sessions,
-    apps: Array.isArray(input.apps) ? input.apps : defaults.apps,
-  };
-}
-
-function loadTinTinConfig() {
-  const configPath = tintinConfigPath();
-  try {
-    if (!fs.existsSync(configPath)) return { ...normalizeTinTinConfig(), path: configPath, exists: false };
-    const parsed = JSON.parse(fs.readFileSync(configPath, "utf8"));
-    return {
-      ...normalizeTinTinConfig(parsed),
-      path: configPath,
-      exists: true,
-    };
-  } catch (err) {
-    return {
-      ...normalizeTinTinConfig(),
-      path: configPath,
-      exists: false,
-      error: err.message,
-    };
-  }
-}
-
-function saveTinTinConfig(input = {}) {
-  const configPath = tintinConfigPath();
-  const next = normalizeTinTinConfig(input);
-  fs.mkdirSync(path.dirname(configPath), { recursive: true });
-  fs.writeFileSync(configPath, `${JSON.stringify(next, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
-  return { ...next, path: configPath, exists: true };
-}
-
-function slugPart(value, fallback = "session") {
-  return String(value || fallback).toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64) || fallback;
-}
-
-function assertInside(parent, child) {
-  const rel = path.relative(path.resolve(parent), path.resolve(child));
-  return rel && !rel.startsWith("..") && !path.isAbsolute(rel);
-}
-
-function gitTopLevel(repoRoot) {
-  try {
-    return execSyncTop("git rev-parse --show-toplevel", {
-      cwd: repoRoot,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe"],
-      windowsHide: true,
-    }).trim();
-  } catch {
-    return null;
-  }
-}
-
-function createTinTinAgentSession(input = {}) {
-  const config = loadTinTinConfig();
-  const settings = mergeTinTinAgentSettings(config.agent_settings);
-  const agentKey = slugPart(input.agent || input.runtime || "claude", "claude");
-  const agent = settings.agents?.[agentKey] || { runtime: agentKey, model: input.model || "", command: agentKey, enabled: true };
-  if (agent.enabled === false) return { ok: false, error: "agent_disabled", agent: agentKey };
-
-  const sessionId = slugPart(input.session_id || makeTinTinId("agent"), "agent");
-  const repoRoot = path.resolve(String(input.repo_root || settings.default_repo_root || settings.cwd || process.cwd()));
-  const top = gitTopLevel(repoRoot);
-  if (!top) return { ok: false, error: "not_git_repo", repo_root: repoRoot };
-
-  const isolation = String(input.isolation || settings.isolation || "worktree");
-  const baseBranch = slugPart(input.base_branch || settings.base_branch || "develop", "develop");
-  let cwd = top;
-  let branch = null;
-  let worktreePath = null;
-  let worktreeCreated = false;
-  const commands = [];
-
-  if (isolation === "worktree") {
-    const worktreeRoot = path.resolve(String(input.worktree_root || settings.worktree_root || path.join(path.dirname(top), `${path.basename(top)}.wt`)));
-    fs.mkdirSync(worktreeRoot, { recursive: true });
-    worktreePath = path.join(worktreeRoot, `tintin-${agentKey}-${sessionId}`);
-    if (!assertInside(worktreeRoot, worktreePath)) return { ok: false, error: "worktree_path_escape", worktree_root: worktreeRoot, worktree_path: worktreePath };
-    branch = `wt/tintin/${agentKey}/${sessionId}`;
-    if (!fs.existsSync(worktreePath)) {
-      execSyncTop(`git worktree add -b ${JSON.stringify(branch)} ${JSON.stringify(worktreePath)} ${JSON.stringify(baseBranch)}`, {
-        cwd: top,
-        stdio: ["ignore", "pipe", "pipe"],
-        timeout: 60_000,
-        windowsHide: true,
-      });
-      worktreeCreated = true;
-      commands.push(`git worktree add -b ${branch} ${worktreePath} ${baseBranch}`);
-    }
-    cwd = worktreePath;
-  } else if (isolation !== "cwd") {
-    return { ok: false, error: "unsupported_isolation", isolation };
-  }
-
-  const runtime = agent.runtime || agentKey;
-  const command = agent.command || runtime;
-  const model = input.model || agent.model || "";
-  const launchCommand = runtime === "codex"
-    ? `${command} exec --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check -C ${JSON.stringify(cwd)} -`
-    : `${command} -p <prompt> --dangerously-skip-permissions`;
-
-  const result = {
-    ok: true,
-    agent_session_id: sessionId,
-    agent: agentKey,
-    runtime,
-    model,
-    isolation,
-    repo_root: top,
-    cwd,
-    worktree_root: isolation === "worktree" ? path.dirname(worktreePath) : null,
-    worktree_path: worktreePath,
-    worktree_created: worktreeCreated,
-    branch,
-    base_branch: baseBranch,
-    launch_mode: settings.launch_mode || "setup_only",
-    launch_command: launchCommand,
-    commands,
-  };
-  const sessionRecord = {
-    agent_session_id: result.agent_session_id,
-    agent: result.agent,
-    runtime: result.runtime,
-    model: result.model,
-    isolation: result.isolation,
-    repo_root: result.repo_root,
-    cwd: result.cwd,
-    worktree_path: result.worktree_path,
-    branch: result.branch,
-    base_branch: result.base_branch,
-    launch_mode: result.launch_mode,
-    created_at: new Date().toISOString(),
-  };
-  const sessions = [sessionRecord, ...(Array.isArray(config.agent_sessions) ? config.agent_sessions : [])
-    .filter((item) => item && item.agent_session_id !== sessionId)]
-    .slice(0, 100);
-  saveTinTinConfig({ ...config, agent_sessions: sessions });
-  return result;
-}
-
-function isLoopbackOrigin(origin) {
-  if (!origin) return false;
-  try {
-    const parsed = new URL(origin);
-    return ["localhost", "127.0.0.1", "::1"].includes(parsed.hostname);
-  } catch {
-    return false;
-  }
-}
-
-function tintinAppForOrigin(config, origin) {
-  if (!origin) return null;
-  return (config.apps || []).find((app) => (
-    Array.isArray(app.origins) && app.origins.some((allowed) => allowed === origin || allowed === "*")
-  )) || null;
-}
-
-function checkTinTinBrowserAccess(req) {
-  const config = loadTinTinConfig();
-  const origin = req.headers.origin || "";
-  const trustMode = config.trust_mode || "open-local";
-  const matchedApp = tintinAppForOrigin(config, origin);
-
-  if (trustMode === "disabled") {
-    return { allowed: false, config, reason: "monkey_disabled" };
-  }
-  if (!origin) {
-    return { allowed: true, config, app: null, reason: "non_browser_local" };
-  }
-  if (matchedApp) {
-    return { allowed: true, config, app: matchedApp, reason: "configured_origin" };
-  }
-  if (trustMode === "open-local" && isLoopbackOrigin(origin)) {
-    return { allowed: true, config, app: null, reason: "open_local_loopback" };
-  }
-  return { allowed: false, config, reason: "origin_not_allowed", origin };
-}
-
-function publicTinTinConfig(config) {
-  return {
-    schema_version: config.schema_version || 1,
-    trust_mode: config.trust_mode || "open-local",
-    config_path: config.path,
-    config_exists: !!config.exists,
-    config_error: config.error || null,
-    agent_settings: mergeTinTinAgentSettings(config.agent_settings),
-    sidebar_settings: mergeTinTinSectionSettings("sidebar_settings", config.sidebar_settings),
-    dispatch_settings: mergeTinTinSectionSettings("dispatch_settings", config.dispatch_settings),
-    codevelop_settings: mergeTinTinSectionSettings("codevelop_settings", config.codevelop_settings),
-    agent_sessions: Array.isArray(config.agent_sessions) ? config.agent_sessions : [],
-    apps: (config.apps || []).map((app) => ({
-      slug: app.slug,
-      origins: app.origins || [],
-      manifest_url: app.manifest_url || null,
-      cwd: app.cwd || null,
-      capabilities: app.capabilities || [],
-    })),
-  };
-}
-
-function tintinSettingsHtml() {
-  return `<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width,initial-scale=1">
-<title>clauth TinTin Settings</title>
-<style>
-body{margin:0;background:#07100e;color:#d9fbe8;font-family:system-ui,-apple-system,Segoe UI,sans-serif}
-header{display:flex;align-items:center;justify-content:space-between;gap:12px;padding:16px 20px;border-bottom:1px solid #14352f;background:#091814}
-h1{font-size:20px;margin:0}.sub{font-size:12px;color:#8dd8c2;margin-top:3px}.pill{display:inline-flex;align-items:center;border:1px solid #14532d;color:#86efac;padding:2px 7px;font-size:11px;margin-top:7px}
-main{display:grid;grid-template-columns:minmax(300px,430px) 1fr;gap:14px;padding:14px}
-.stack{display:grid;gap:14px}.wide{display:grid;gap:14px}
-section{border:1px solid #14352f;background:#091814;padding:14px}
-h2{font-size:15px;margin:0 0 10px;color:#dcfce7}
-label{display:block;font-size:11px;text-transform:uppercase;letter-spacing:.05em;color:#8dd8c2;font-weight:700;margin:10px 0 4px}
-input,select,textarea{box-sizing:border-box;width:100%;border:1px solid #1d4d43;background:#031312;color:#d9fbe8;padding:8px 9px;font:13px ui-monospace,SFMono-Regular,Consolas,monospace;outline:none}
-textarea{min-height:170px;resize:vertical}.short{min-height:92px}.tiny{min-height:58px}
-.row{display:grid;grid-template-columns:1fr 1fr;gap:8px}.actions{display:flex;gap:8px;flex-wrap:wrap;margin-top:12px}
-button,a.btn{border:1px solid #2d6a5e;background:#08231f;color:#b8ffe1;padding:7px 10px;font-size:12px;font-weight:700;text-decoration:none;cursor:pointer}
-button:hover,a.btn:hover{background:#0f2a24}.danger{border-color:#5f3b3b;color:#fecaca;background:#241010}
-pre{white-space:pre-wrap;word-break:break-word;border:1px solid #0d2a25;background:#020b09;color:#c8f9df;padding:10px;max-height:460px;overflow:auto;font-size:12px}
-.status{font:12px ui-monospace,SFMono-Regular,Consolas,monospace;color:#86efac}.hint{font-size:12px;color:#7dd3c0;line-height:1.4}.check{display:flex;align-items:center;gap:8px;margin-top:10px;color:#d9fbe8;font-size:13px}.check input{width:auto}
-@media(max-width:900px){main{grid-template-columns:1fr}.row{grid-template-columns:1fr}}
-</style>
-</head>
-<body>
-<header>
-  <div><h1>TinTin Settings</h1><div class="sub">Persistent clauth control plane for agent setup, app sidebars, blackboard dispatch, and co-develop relay.</div><div class="pill">GET/PUT /tintin/settings</div></div>
-  <a class="btn" href="/">Vault Dashboard</a>
-</header>
-<main>
-  <div class="stack">
-    <section>
-      <h2>Agent Setup</h2>
-      <div class="hint">Creates a proper isolated cwd for Claude or Codex. Worktree setup is explicit and returned before any supervisor launches a process.</div>
-      <div class="row">
-        <div><label>agent</label><select id="agent"><option value="claude">claude</option><option value="codex">codex</option></select></div>
-        <div><label>isolation</label><select id="isolation"><option value="worktree">worktree</option><option value="cwd">cwd</option></select></div>
-      </div>
-      <label>repo root</label><input id="repoRoot">
-      <label>worktree root</label><input id="worktreeRoot">
-      <div class="row">
-        <div><label>base branch</label><input id="baseBranch"></div>
-        <div><label>session id</label><input id="sessionId" placeholder="auto if blank"></div>
-      </div>
-      <div class="actions">
-        <button onclick="loadSettings()" title="GET /tintin/settings">Load</button>
-        <button onclick="saveSettings()" title="PUT /tintin/settings">Save</button>
-        <button onclick="setupAgent()" title="POST /tintin/agent-sessions">Setup Agent</button>
-      </div>
-      <p class="status" id="status">idle</p>
-    </section>
-    <section>
-      <h2>Stored Agent Sessions</h2>
-      <pre id="agentSessions">No sessions loaded.</pre>
-    </section>
-    <section>
-      <h2>Return</h2>
-      <pre id="result">No return yet.</pre>
-    </section>
-  </div>
-  <div class="wide">
-    <section>
-      <h2>Agent Defaults</h2>
-      <div class="row">
-        <div><label>Claude model</label><input id="claudeModel"></div>
-        <div><label>Codex model</label><input id="codexModel"></div>
-      </div>
-      <div class="row">
-        <div><label>Claude command</label><input id="claudeCommand"></div>
-        <div><label>Codex command</label><input id="codexCommand"></div>
-      </div>
-      <div class="row">
-        <label class="check"><input type="checkbox" id="claudeEnabled"> Claude enabled</label>
-        <label class="check"><input type="checkbox" id="codexEnabled"> Codex enabled</label>
-      </div>
-    </section>
-    <section>
-      <h2>Sidebar Apps</h2>
-      <div class="row">
-        <div><label>trust mode</label><select id="trustMode"><option value="open-local">open-local</option><option value="configured-origins">configured-origins</option><option value="disabled">disabled</option></select></div>
-        <div><label>default app slug</label><input id="defaultAppSlug"></div>
-      </div>
-      <div class="row">
-        <div><label>session ttl hours</label><input id="sessionTtlHours" type="number" min="1" step="1"></div>
-        <div><label>event history limit</label><input id="eventHistoryLimit" type="number" min="1" step="1"></div>
-      </div>
-      <label class="check"><input type="checkbox" id="sidebarEnabled"> Sidebar sessions enabled</label>
-      <label>apps JSON</label><textarea class="short" id="appsJson" spellcheck="false"></textarea>
-    </section>
-    <section>
-      <h2>Blackboard Dispatch</h2>
-      <div class="row">
-        <div><label>default agent</label><select id="dispatchDefaultAgent"><option value="claude">claude</option><option value="codex">codex</option></select></div>
-        <div><label>default model</label><input id="dispatchDefaultModel"></div>
-      </div>
-      <div class="row">
-        <div><label>max workers</label><input id="dispatchMaxWorkers" type="number" min="1" step="1"></div>
-        <label class="check"><input type="checkbox" id="dispatchEnabled"> Dispatch enabled</label>
-      </div>
-    </section>
-    <section>
-      <h2>Co-develop Relay</h2>
-      <div class="row">
-        <div><label>default repo</label><input id="codevelopDefaultRepo"></div>
-        <div><label>message retention</label><input id="codevelopRetention" type="number" min="1" step="1"></div>
-      </div>
-      <div class="row">
-        <label class="check"><input type="checkbox" id="codevelopEnabled"> Co-develop enabled</label>
-        <label class="check"><input type="checkbox" id="codevelopRequirePeer"> Require peer join</label>
-      </div>
-    </section>
-    <section>
-      <h2>Settings JSON</h2>
-      <textarea id="settingsJson" spellcheck="false"></textarea>
-    </section>
-  </div>
-</main>
-<script>
-const BASE = location.origin;
-let currentSettings = {};
-function setStatus(text){ document.getElementById("status").textContent = text; }
-function show(value){ document.getElementById("result").textContent = typeof value === "string" ? value : JSON.stringify(value,null,2); }
-function num(id, fallback){ const n = Number(document.getElementById(id).value); return Number.isFinite(n) ? n : fallback; }
-function applySettings(data){
-  const cfg = data.agent_settings ? data : data.config || data;
-  currentSettings = cfg;
-  const s = cfg.agent_settings || {};
-  const side = cfg.sidebar_settings || {};
-  const dispatch = cfg.dispatch_settings || {};
-  const codevelop = cfg.codevelop_settings || {};
-  const agents = s.agents || {};
-  const claude = agents.claude || {};
-  const codex = agents.codex || {};
-  document.getElementById("trustMode").value = cfg.trust_mode || "open-local";
-  document.getElementById("repoRoot").value = s.default_repo_root || "";
-  document.getElementById("worktreeRoot").value = s.worktree_root || "";
-  document.getElementById("baseBranch").value = s.base_branch || "develop";
-  document.getElementById("isolation").value = s.isolation || "worktree";
-  document.getElementById("claudeModel").value = claude.model || "";
-  document.getElementById("codexModel").value = codex.model || "";
-  document.getElementById("claudeCommand").value = claude.command || "claude";
-  document.getElementById("codexCommand").value = codex.command || "codex";
-  document.getElementById("claudeEnabled").checked = claude.enabled !== false;
-  document.getElementById("codexEnabled").checked = codex.enabled !== false;
-  document.getElementById("sidebarEnabled").checked = side.enabled !== false;
-  document.getElementById("defaultAppSlug").value = side.default_app_slug || "";
-  document.getElementById("sessionTtlHours").value = side.session_ttl_hours || 24;
-  document.getElementById("eventHistoryLimit").value = side.event_history_limit || 200;
-  document.getElementById("appsJson").value = JSON.stringify(cfg.apps || [],null,2);
-  document.getElementById("dispatchEnabled").checked = dispatch.enabled !== false;
-  document.getElementById("dispatchDefaultAgent").value = dispatch.default_agent || "claude";
-  document.getElementById("dispatchDefaultModel").value = dispatch.default_model || "";
-  document.getElementById("dispatchMaxWorkers").value = dispatch.max_concurrent_workers || 2;
-  document.getElementById("codevelopEnabled").checked = codevelop.enabled !== false;
-  document.getElementById("codevelopDefaultRepo").value = codevelop.default_repo || "";
-  document.getElementById("codevelopRetention").value = codevelop.message_retention_limit || 500;
-  document.getElementById("codevelopRequirePeer").checked = codevelop.require_peer_join !== false;
-  document.getElementById("agentSessions").textContent = JSON.stringify(cfg.agent_sessions || [],null,2);
-  document.getElementById("settingsJson").value = JSON.stringify(cfg,null,2);
-}
-function collectSettings(){
-  let apps;
-  try { apps = JSON.parse(document.getElementById("appsJson").value || "[]"); }
-  catch(e){ throw new Error("apps JSON: " + e.message); }
-  const parsed = JSON.parse(document.getElementById("settingsJson").value || "{}");
-  return {
-    ...parsed,
-    trust_mode: document.getElementById("trustMode").value,
-    agent_settings: {
-      ...(parsed.agent_settings || {}),
-      default_repo_root: document.getElementById("repoRoot").value,
-      worktree_root: document.getElementById("worktreeRoot").value,
-      base_branch: document.getElementById("baseBranch").value,
-      isolation: document.getElementById("isolation").value,
-      agents: {
-        ...((parsed.agent_settings || {}).agents || {}),
-        claude: {
-          ...(((parsed.agent_settings || {}).agents || {}).claude || {}),
-          runtime: "claude",
-          model: document.getElementById("claudeModel").value,
-          command: document.getElementById("claudeCommand").value,
-          enabled: document.getElementById("claudeEnabled").checked
-        },
-        codex: {
-          ...(((parsed.agent_settings || {}).agents || {}).codex || {}),
-          runtime: "codex",
-          model: document.getElementById("codexModel").value,
-          command: document.getElementById("codexCommand").value,
-          enabled: document.getElementById("codexEnabled").checked
-        }
-      }
-    },
-    sidebar_settings: {
-      ...(parsed.sidebar_settings || {}),
-      enabled: document.getElementById("sidebarEnabled").checked,
-      default_app_slug: document.getElementById("defaultAppSlug").value,
-      session_ttl_hours: num("sessionTtlHours", 24),
-      event_history_limit: num("eventHistoryLimit", 200)
-    },
-    dispatch_settings: {
-      ...(parsed.dispatch_settings || {}),
-      enabled: document.getElementById("dispatchEnabled").checked,
-      default_agent: document.getElementById("dispatchDefaultAgent").value,
-      default_model: document.getElementById("dispatchDefaultModel").value,
-      max_concurrent_workers: num("dispatchMaxWorkers", 2)
-    },
-    codevelop_settings: {
-      ...(parsed.codevelop_settings || {}),
-      enabled: document.getElementById("codevelopEnabled").checked,
-      default_repo: document.getElementById("codevelopDefaultRepo").value,
-      message_retention_limit: num("codevelopRetention", 500),
-      require_peer_join: document.getElementById("codevelopRequirePeer").checked
-    },
-    agent_sessions: Array.isArray(parsed.agent_sessions) ? parsed.agent_sessions : (currentSettings.agent_sessions || []),
-    apps
-  };
-}
-async function loadSettings(){
-  setStatus("GET /tintin/settings");
-  const r = await fetch(BASE + "/tintin/settings", { cache:"no-store" });
-  const data = await r.json();
-  applySettings(data);
-  show(data);
-  setStatus(r.ok ? "loaded" : "load failed");
-}
-async function saveSettings(){
-  setStatus("PUT /tintin/settings");
-  let body;
-  try { body = collectSettings(); }
-  catch(e){ setStatus("invalid JSON"); show(e.message); return; }
-  const r = await fetch(BASE + "/tintin/settings", { method:"PUT", headers:{ "Content-Type":"application/json" }, body: JSON.stringify(body) });
-  const data = await r.json();
-  applySettings(data);
-  show(data);
-  setStatus(r.ok ? "saved" : "save failed");
-}
-async function setupAgent(){
-  const body = {
-    agent: document.getElementById("agent").value,
-    isolation: document.getElementById("isolation").value,
-    repo_root: document.getElementById("repoRoot").value,
-    worktree_root: document.getElementById("worktreeRoot").value,
-    base_branch: document.getElementById("baseBranch").value,
-    session_id: document.getElementById("sessionId").value || undefined
-  };
-  setStatus("POST /tintin/agent-sessions");
-  const r = await fetch(BASE + "/tintin/agent-sessions", { method:"POST", headers:{ "Content-Type":"application/json" }, body: JSON.stringify(body) });
-  const data = await r.json();
-  show(data);
-  setStatus(r.ok && data.ok ? "agent setup ready" : "agent setup failed");
-  if (r.ok && data.ok) loadSettings().catch(function(){});
-}
-loadSettings().catch(err => { setStatus("load failed"); show(err.message || String(err)); });
-</script>
-</body>
-</html>`;
-}
-
 // ── call_agent noauth-host guard (Gate B, bearer-gated tunnel) ───────────────
 // Pure decision function so the policy is testable without a daemon. Decides
 // whether a /call-agent request may proceed.
@@ -5091,6 +4475,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       saveClients(oauthClients);
       const logMsg = `[${new Date().toISOString()}] OAuth: registered public client ${clientId} (${client.client_name})\n`;
       try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
+      operation("oauth.client_register", { client_id: clientId, client_name: client.client_name }, null, { ok: true });
       res.writeHead(201, { "Content-Type": "application/json", "Cache-Control": "no-store", ...CORS });
       return res.end(JSON.stringify(client));
     }
@@ -5214,6 +4599,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
       const logMsg = `[${new Date().toISOString()}] OAuth: token issued for ${stored.client_id} (token=${accessToken.slice(0,8)}…)\n`;
       try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
+      operation("oauth.token_issue", { client_id: stored.client_id }, null, { ok: true });
       res.writeHead(200, { "Content-Type": "application/json", "Cache-Control": "no-store", ...CORS });
       return res.end(JSON.stringify({ access_token: accessToken, token_type: "Bearer", scope: "mcp:tools", expires_in: 86400 }));
     }
@@ -5224,7 +4610,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     function toolsForPath(p) {
       const tools = filterMcpToolsForWriteMode(MCP_TOOLS);
       if (p === "/gws")      return tools.filter(t => t.name.startsWith("gws_"));
-      if (p === "/clauth")   return tools.filter(t => t.name.startsWith("clauth_") || t.name === "tintin_dispatch" || t.name === "call_agent" || t.name.startsWith("terminal_") || t.name.startsWith("channel_") || t.name.startsWith("handoff_"));
+      if (p === "/clauth")   return tools.filter(t => t.name.startsWith("clauth_") || t.name === "call_agent" || t.name.startsWith("terminal_") || t.name.startsWith("channel_") || t.name.startsWith("handoff_"));
       if (p === "/fs")       return tools.filter(t => t.name.startsWith("fs_"));
       if (p === "/chitchat") return tools.filter(t => t.name.startsWith("chitchat_"));
       if (p === "/codevelop") return tools.filter(t => t.name.startsWith("codevelop_"));
@@ -5530,8 +4916,12 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         return res.end(JSON.stringify({ error: "name and path are required" }));
       }
       const result = webdavService.addMount(name.trim(), mountPath.trim());
-      if (result.error) { res.writeHead(409, { "Content-Type": "application/json", ...CORS }); return res.end(JSON.stringify(result)); }
+      if (result.error) {
+        operation("webdav.mount_add", { name: name.trim() }, null, { ok: false, error: result.error });
+        res.writeHead(409, { "Content-Type": "application/json", ...CORS }); return res.end(JSON.stringify(result));
+      }
       webdavService.shutdown();
+      operation("webdav.mount_add", { name: name.trim(), path: mountPath.trim() }, null, { ok: true });
       return ok(res, result);
     }
 
@@ -5539,8 +4929,12 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       if (writeGuard(req, res)) return;
       const mountName = decodeURIComponent(reqPath.slice("/webdav/mounts/".length));
       const result = webdavService.removeMount(mountName);
-      if (result.error) { res.writeHead(404, { "Content-Type": "application/json", ...CORS }); return res.end(JSON.stringify(result)); }
+      if (result.error) {
+        operation("webdav.mount_remove", { name: mountName }, null, { ok: false, error: result.error });
+        res.writeHead(404, { "Content-Type": "application/json", ...CORS }); return res.end(JSON.stringify(result));
+      }
       webdavService.shutdown();
+      operation("webdav.mount_remove", { name: mountName }, null, { ok: true });
       return ok(res, result);
     }
 
@@ -5554,6 +4948,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         return res.end(JSON.stringify({ error: "Invalid JSON" }));
       }
       const result = startCodevelopSession(body || {});
+      operation("codevelop.start", { session_id: result?.session_id }, null, { ok: !result?.error, error: result?.error });
       return ok(res, result);
     }
 
@@ -5565,12 +4960,19 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       }
       const result = joinCodevelopSession(body || {});
       if (result.error) {
+        operation("codevelop.join", { session_id: body?.session_id }, null, { ok: false, error: result.error });
         res.writeHead(result.error === "not_found" ? 404 : 400, { "Content-Type": "application/json", ...CORS });
         return res.end(JSON.stringify(result));
       }
+      operation("codevelop.join", { session_id: body?.session_id }, null, { ok: true });
       return ok(res, result);
     }
 
+    // codevelop/send is a genuine mutation (adds a message) but excluded from
+    // per-route logging by design — a live peer-to-peer relay can send at a
+    // frequency that would bloat events.jsonl (same risk noted in the audit-
+    // logging retrofit plan for codevelop/poll). Session lifecycle
+    // (start/join/stop) is logged; message throughput is not.
     if (method === "POST" && reqPath === "/codevelop/send") {
       let body;
       try { body = await readBody(req); } catch {
@@ -5654,9 +5056,11 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       }
       const result = stopCodevelopSession(body?.session_id);
       if (result.error) {
+        operation("codevelop.stop", { session_id: body?.session_id }, null, { ok: false, error: result.error });
         res.writeHead(404, { "Content-Type": "application/json", ...CORS });
         return res.end(JSON.stringify(result));
       }
+      operation("codevelop.stop", { session_id: body?.session_id }, null, { ok: true });
       return ok(res, result);
     }
 
@@ -5844,6 +5248,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       saveTokens(oauthTokens);
       const logMsg = `[${new Date().toISOString()}] OAuth: rolled credentials — all clients and tokens invalidated\n`;
       try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
+      operation("oauth.roll_creds", {}, null, { ok: true });
       return ok(res, { clients_cleared: true, tokens_invalidated: true });
     }
 
@@ -5857,10 +5262,12 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       }
       if (body.action === "stop") {
         stopTunnel();
+        operation("tunnel.stop", {}, null, { ok: true });
         return ok(res, { status: tunnelStatus, running: false });
       }
       // start
       await startTunnel();
+      operation("tunnel.start", {}, null, { ok: !!tunnelProc, url: tunnelUrl, error: tunnelError });
       return ok(res, { status: tunnelStatus, running: !!tunnelProc, url: tunnelUrl, error: tunnelError });
     }
 
@@ -5870,6 +5277,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       if (tunnelProc) return ok(res, { status: tunnelStatus, message: "already running" });
       tunnelStatus = "starting";
       startTunnel().catch(() => {});
+      operation("tunnel.start", {}, null, { ok: true, status: "starting" });
       return ok(res, { status: "starting" });
     }
 
@@ -5877,6 +5285,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     if (method === "POST" && reqPath === "/tunnel/stop") {
       if (lockedGuard(res)) return;
       stopTunnel();
+      operation("tunnel.stop", {}, null, { ok: true });
       return ok(res, { status: tunnelStatus });
     }
 
@@ -5919,8 +5328,10 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           stdio: "ignore",
         });
         child.unref();
+        operation("ccandme.launch", {}, null, { ok: true });
         return ok(res, { ok: true, message: "CCandMe launched" });
       } catch (err) {
+        operation("ccandme.launch", {}, null, { ok: false, error: err.message });
         res.writeHead(500, { "Content-Type": "application/json", ...CORS });
         return res.end(JSON.stringify({ error: err.message }));
       }
@@ -5928,6 +5339,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
     // POST /restart — spawn fresh process then exit (keeps boot.key, vault stays unlocked)
     if (method === "POST" && reqPath === "/restart") {
+      operation("daemon.restart_requested", { port }, null, { ok: true });
       ok(res, { ok: true, message: "restarting" });
       const { spawn } = await import("child_process");
       const cliEntry = path.resolve(__dirname, "../index.js");
@@ -5949,454 +5361,6 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       return;
     }
 
-    // GET /tintin/manifest — app manifest for the TinTin sidebar loader.
-    // GET /monkey/manifest — backward-compat alias.
-    if (method === "GET" && (reqPath === "/tintin/manifest" || reqPath === "/monkey/manifest")) {
-      return ok(res, {
-        schema_version: 1,
-        app: {
-          slug: "clauth-dashboard",
-          name: "clauth Dashboard",
-        },
-        load: {
-          mode: "external-sidebar",
-          requires_compile_in: false,
-          recommended_loader: "chrome-extension-or-tampermonkey",
-          userscript_url: "/tintin/sidebar.user.js",
-        },
-        local_clauth: {
-          base_url: `http://127.0.0.1:${port}`,
-          capabilities_endpoint: "/tintin/capabilities",
-          session_endpoint: "/tintin/sessions",
-          transport: "tintin",
-        },
-        repo: {
-          root_hint: "C:\\Dev\\regen-root",
-          cwd_hint: "C:\\Dev\\regen-root",
-        },
-        capabilities: ["general_chat", "skill_request", "handoff", "dashboard_test"],
-        agent_context: {
-          app: { slug: "clauth-dashboard" },
-          runtime: { requested_by: "clauth-dashboard-monkey" },
-        },
-      });
-    }
-
-    // GET /tintin/sidebar.user.js — shared app-side TinTin sidebar loader.
-    // GET /monkey/sidebar.user.js — backward-compat alias.
-    if (method === "GET" && (reqPath === "/tintin/sidebar.user.js" || reqPath === "/monkey/sidebar.user.js")) {
-      const candidates = [
-        process.env.CLAUTH_MONKEY_SIDEBAR_SCRIPT,
-        "C:\\Dev\\regen-root\\scripts\\monkey-sidebar.user.js",
-        path.resolve(process.cwd(), "..", "regen-root", "scripts", "monkey-sidebar.user.js"),
-      ].filter(Boolean);
-      const scriptPath = candidates.find((candidate) => {
-        try { return fs.existsSync(candidate); } catch { return false; }
-      });
-      if (!scriptPath) {
-        res.writeHead(404, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "monkey_sidebar_script_not_found" }));
-      }
-      res.writeHead(200, { "Content-Type": "text/javascript; charset=utf-8", "Cache-Control": "no-cache, no-store, must-revalidate", ...CORS });
-      return res.end(fs.readFileSync(scriptPath, "utf8"));
-    }
-
-    // GET /tintin/capabilities — browser-safe local TinTin sidebar capability probe.
-    // GET /monkey/capabilities — backward-compat alias.
-    if (method === "GET" && (reqPath === "/tintin/capabilities" || reqPath === "/monkey/capabilities")) {
-      const access = checkTinTinBrowserAccess(req);
-      if (!access.allowed) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: access.reason, origin: access.origin || null }));
-      }
-      return ok(res, {
-        ok: true,
-        status: password ? "available" : "locked",
-        locked: !password,
-        trust_mode: access.config.trust_mode || "open-local",
-        app: access.app?.slug || null,
-        config: publicTinTinConfig(access.config),
-        transports: ["dispatch", "sse", "polling", "result"],
-        endpoints: {
-          sessions: "/tintin/sessions",
-          events: "/tintin/sessions/:session_id/events",
-          messages: "/tintin/sessions/:session_id/messages",
-          result: "/tintin/messages/:message_id/result",
-        },
-      });
-    }
-
-    // GET /tintin/config — local operator view of the app allowlist/config.
-    // GET /monkey/config — backward-compat alias.
-    if (method === "GET" && (reqPath === "/tintin/config" || reqPath === "/monkey/config")) {
-      const access = checkTinTinBrowserAccess(req);
-      if (!access.allowed) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: access.reason, origin: access.origin || null }));
-      }
-      return ok(res, { ok: true, ...publicTinTinConfig(access.config) });
-    }
-
-    if (method === "GET" && reqPath === "/tintin/settings/ui") {
-      res.writeHead(200, { "Content-Type": "text/html", ...CORS });
-      return res.end(tintinSettingsHtml());
-    }
-
-    if (method === "GET" && (reqPath === "/tintin/settings" || reqPath === "/monkey/settings")) {
-      const config = loadTinTinConfig();
-      return ok(res, { ok: true, ...publicTinTinConfig(config) });
-    }
-
-    if ((method === "PUT" || method === "POST") && (reqPath === "/tintin/settings" || reqPath === "/monkey/settings")) {
-      let body;
-      try { body = await readBody(req); } catch {
-        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: "Invalid JSON body" }));
-      }
-      try {
-        const saved = saveTinTinConfig(body || {});
-        return ok(res, { ok: true, ...publicTinTinConfig(saved) });
-      } catch (err) {
-        res.writeHead(500, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: "settings_save_failed", message: err.message }));
-      }
-    }
-
-    if (method === "POST" && (reqPath === "/tintin/agent-sessions" || reqPath === "/monkey/agent-sessions")) {
-      let body;
-      try { body = await readBody(req); } catch {
-        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: "Invalid JSON body" }));
-      }
-      try {
-        const result = createTinTinAgentSession(body || {});
-        if (!result.ok) {
-          res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-          return res.end(JSON.stringify(result));
-        }
-        return ok(res, result);
-      } catch (err) {
-        res.writeHead(500, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: "agent_session_setup_failed", message: err.message }));
-      }
-    }
-
-    // POST /tintin/sessions — create or attach to a local CLI-backed TinTin session.
-    // POST /monkey/sessions — backward-compat alias.
-    if (method === "POST" && (reqPath === "/tintin/sessions" || reqPath === "/monkey/sessions")) {
-      const access = checkTinTinBrowserAccess(req);
-      if (!access.allowed) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: access.reason, origin: access.origin || null }));
-      }
-      let body;
-      try { body = await readBody(req); } catch {
-        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "Invalid JSON body" }));
-      }
-      const session = createTinTinSession(body || {});
-      pushTinTinEvent(session.id, {
-        source: "clauth",
-        type: "status",
-        content: "session ready",
-        payload: { status: "ready" },
-      });
-      return ok(res, {
-        ok: true,
-        session_id: session.id,
-        status: session.status,
-        agent_context: session.agent_context,
-        last_seq: session.seq,
-      });
-    }
-
-    // GET /tintin/sessions — list in-memory local TinTin sessions.
-    // GET /monkey/sessions — backward-compat alias.
-    if (method === "GET" && (reqPath === "/tintin/sessions" || reqPath === "/monkey/sessions")) {
-      const access = checkTinTinBrowserAccess(req);
-      if (!access.allowed) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: access.reason, origin: access.origin || null }));
-      }
-      return ok(res, {
-        ok: true,
-        sessions: [...tintinSessions.values()].map((session) => ({
-          session_id: session.id,
-          status: session.status,
-          created_at: session.created_at,
-          updated_at: session.updated_at,
-          last_seq: session.seq,
-          agent_context: session.agent_context,
-        })),
-      });
-    }
-
-    const tintinSessionMatch = reqPath.match(/^\/(?:tintin|monkey)\/sessions\/([^/]+)$/);
-    if (method === "GET" && tintinSessionMatch) {
-      const access = checkTinTinBrowserAccess(req);
-      if (!access.allowed) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: access.reason, origin: access.origin || null }));
-      }
-      const sessionId = decodeURIComponent(tintinSessionMatch[1]);
-      const session = getTinTinSession(sessionId);
-      if (!session) {
-        res.writeHead(404, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "not_found", session_id: sessionId }));
-      }
-      return ok(res, {
-        ok: true,
-        session_id: session.id,
-        status: session.status,
-        created_at: session.created_at,
-        updated_at: session.updated_at,
-        last_seq: session.seq,
-        agent_context: session.agent_context,
-      });
-    }
-
-    const tintinMessagesMatch = reqPath.match(/^\/(?:tintin|monkey)\/sessions\/([^/]+)\/messages$/);
-    if (method === "GET" && tintinMessagesMatch) {
-      const access = checkTinTinBrowserAccess(req);
-      if (!access.allowed) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: access.reason, origin: access.origin || null }));
-      }
-      const sessionId = decodeURIComponent(tintinMessagesMatch[1]);
-      const afterSeq = Number(url.searchParams.get("after_seq") || url.searchParams.get("after") || 0);
-      const events = listTinTinEvents(sessionId, Number.isFinite(afterSeq) ? afterSeq : 0);
-      if (!events) {
-        res.writeHead(404, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "not_found", session_id: sessionId }));
-      }
-      return ok(res, { ok: true, session_id: sessionId, events });
-    }
-
-    if (method === "POST" && tintinMessagesMatch) {
-      const access = checkTinTinBrowserAccess(req);
-      if (!access.allowed) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: access.reason, origin: access.origin || null }));
-      }
-      if (!password) {
-        res.writeHead(401, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "Vault is locked", locked: true }));
-      }
-      const sessionId = decodeURIComponent(tintinMessagesMatch[1]);
-      let session = getTinTinSession(sessionId);
-      let body;
-      try { body = await readBody(req); } catch {
-        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "Invalid JSON body" }));
-      }
-      if (!session) session = createTinTinSession({ ...(body || {}), session_id: sessionId });
-      const content = String(body?.content || body?.prompt || "").trim();
-      if (!content) {
-        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "content required" }));
-      }
-
-      const messageId = body.message_id || makeTinTinId("msg");
-      const jobId = body.job_id || messageId;
-      const agentContext = normalizeAgentContext(body.agent_context || {
-        ...session.agent_context,
-        task: {
-          ...(session.agent_context?.task || {}),
-          intent: body.skill ? "skill_request" : "general_chat",
-          thread_id: sessionId,
-        },
-      });
-      pushTinTinEvent(sessionId, {
-        source: "sidebar",
-        type: "message",
-        role: "user",
-        message_id: messageId,
-        job_id: jobId,
-        content,
-        payload: { skill: body.skill || null },
-      });
-
-      const prompt = buildTinTinPrompt({
-        prompt: body.skill ? `Skill: ${body.skill}\n\n${content}` : content,
-        job_id: jobId,
-        agent_context: agentContext,
-      });
-      const dispatchCwd = resolveDispatchCwd(body.cwd || session.cwd, agentContext);
-      const result = spawnClaudeTask(prompt, jobId, dispatchCwd, agentContext);
-      if (result.error) {
-        pushTinTinEvent(sessionId, {
-          source: "clauth",
-          type: "error",
-          role: "assistant",
-          message_id: messageId,
-          job_id: jobId,
-          content: result.message || result.error,
-          payload: { code: result.error, retryable: result.error === "concurrency_limit" },
-        });
-        res.writeHead(503, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify(result));
-      }
-
-      tintinMessageIndex.set(messageId, { session_id: sessionId, job_id: jobId });
-      pushTinTinEvent(sessionId, {
-        source: "clauth",
-        type: "status",
-        role: "assistant",
-        message_id: messageId,
-        job_id: jobId,
-        content: "spawned",
-        payload: result,
-      });
-      startTinTinMessageMonitor(sessionId, messageId, jobId);
-      return ok(res, {
-        ok: true,
-        session_id: sessionId,
-        message_id: messageId,
-        job_id: jobId,
-        status: "spawned",
-        dispatch: result,
-      });
-    }
-
-    const tintinEventsMatch = reqPath.match(/^\/(?:tintin|monkey)\/sessions\/([^/]+)\/events$/);
-    if (method === "GET" && tintinEventsMatch) {
-      const access = checkTinTinBrowserAccess(req);
-      if (!access.allowed) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: access.reason, origin: access.origin || null }));
-      }
-      const sessionId = decodeURIComponent(tintinEventsMatch[1]);
-      const afterSeq = Number(url.searchParams.get("after_seq") || url.searchParams.get("after") || 0);
-      const session = getTinTinSession(sessionId);
-      if (!session) {
-        res.writeHead(404, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "not_found", session_id: sessionId }));
-      }
-
-      res.writeHead(200, { "Content-Type": "text/event-stream", "Cache-Control": "no-store", "Connection": "keep-alive", ...CORS });
-      const send = (event) => {
-        const eventType = event.type || "message";
-        res.write(`event: ${eventType}\ndata: ${JSON.stringify(event)}\n\n`);
-      };
-      res.write(`event: ready\ndata: ${JSON.stringify({ ok: true, session_id: sessionId, last_seq: session.seq })}\n\n`);
-      for (const event of listTinTinEvents(sessionId, Number.isFinite(afterSeq) ? afterSeq : 0) || []) send(event);
-      const unsubscribe = subscribeTinTinEvents(sessionId, send);
-      const heartbeat = setInterval(() => {
-        try { res.write(`event: heartbeat\ndata: ${JSON.stringify({ session_id: sessionId, at: new Date().toISOString() })}\n\n`); }
-        catch { clearInterval(heartbeat); unsubscribe(); }
-      }, 15000);
-      req.on("close", () => {
-        clearInterval(heartbeat);
-        unsubscribe();
-      });
-      return;
-    }
-
-    const tintinResultMatch = reqPath.match(/^\/(?:tintin|monkey)\/messages\/([^/]+)\/result$/);
-    if (method === "GET" && tintinResultMatch) {
-      const access = checkTinTinBrowserAccess(req);
-      if (!access.allowed) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: access.reason, origin: access.origin || null }));
-      }
-      const messageId = decodeURIComponent(tintinResultMatch[1]);
-      const ref = tintinMessageIndex.get(messageId);
-      if (!ref) {
-        res.writeHead(404, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "not_found", message_id: messageId }));
-      }
-      const job = tintinJobs.get(ref.job_id);
-      const session = getTinTinSession(ref.session_id);
-      return ok(res, {
-        ok: true,
-        message_id: messageId,
-        session_id: ref.session_id,
-        job_id: ref.job_id,
-        status: job?.status || "unknown",
-        stdout: job?.stdout || "",
-        stderr: job?.stderr || "",
-        events: session?.events.filter((event) => event.message_id === messageId) || [],
-      });
-    }
-
-    // POST /tintin/dispatch — browser-safe, config-checked CLI worker spawn.
-    // POST /monkey/dispatch, /dispatch, and /monkey-dispatch remain legacy backward-compat aliases.
-    if (method === "POST" && (reqPath === "/tintin/dispatch" || reqPath === "/dispatch" || reqPath === "/monkey-dispatch" || reqPath === "/monkey/dispatch")) {
-      if (reqPath === "/tintin/dispatch" || reqPath === "/monkey/dispatch") {
-        const access = checkTinTinBrowserAccess(req);
-        if (!access.allowed) {
-          res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-          return res.end(JSON.stringify({ ok: false, error: access.reason, origin: access.origin || null }));
-        }
-      } else if (req.headers.origin) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: "legacy_dispatch_rejects_browser_origin", use: "/tintin/dispatch" }));
-      }
-      let body = "";
-      req.on("data", d => body += d);
-      req.on("end", () => {
-        try {
-          const { prompt, job_id, cwd, agent_context } = JSON.parse(body || "{}");
-          if (!prompt && !job_id) {
-            res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-            return res.end(JSON.stringify({ error: "prompt required" }));
-          }
-          const normalizedContext = normalizeAgentContext(agent_context);
-          const wrappedPrompt = buildTinTinPrompt({ prompt, job_id, agent_context: normalizedContext });
-          const dispatchCwd = resolveDispatchCwd(cwd, normalizedContext);
-          const result = spawnClaudeTask(wrappedPrompt, job_id || "untracked", dispatchCwd, normalizedContext);
-          const status = result.error ? 503 : 200;
-          res.writeHead(status, { "Content-Type": "application/json", ...CORS });
-          res.end(JSON.stringify({ ...result, context: normalizedContext }));
-        } catch {
-          res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-          res.end(JSON.stringify({ error: "invalid JSON" }));
-        }
-      });
-      return;
-    }
-
-    // POST /tintin/dispatch/:jobId/kill — kill a running dispatch job.
-    // POST /monkey/dispatch/:jobId/kill — backward-compat alias.
-    const dispatchKillMatch = reqPath.match(/^\/(?:tintin|monkey)\/dispatch\/([^/]+)\/kill$/);
-    if (method === "POST" && dispatchKillMatch) {
-      const jobId = decodeURIComponent(dispatchKillMatch[1]);
-      const job = tintinJobs.get(jobId);
-      if (!job) {
-        res.writeHead(404, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: "not_found" }));
-      }
-      if (job.pid && job.status === "running") {
-        try { process.kill(job.pid); } catch {}
-        job.status = "killed";
-        job.completed_at = new Date().toISOString();
-      }
-      res.writeHead(200, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify({ ok: true, status: job.status, jobId }));
-    }
-
-    const dispatchStatusMatch = reqPath.match(/^\/(?:tintin|monkey)\/dispatch\/([^/]+)$/) || reqPath.match(/^\/dispatch\/([^/]+)$/);
-    if (method === "GET" && dispatchStatusMatch) {
-      if (reqPath.startsWith("/tintin/dispatch/") || reqPath.startsWith("/monkey/dispatch/")) {
-        const access = checkTinTinBrowserAccess(req);
-        if (!access.allowed) {
-          res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-          return res.end(JSON.stringify({ ok: false, error: access.reason, origin: access.origin || null }));
-        }
-      } else if (req.headers.origin) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: "legacy_dispatch_rejects_browser_origin", use: "/tintin/dispatch/:job_id" }));
-      }
-      const jobId = decodeURIComponent(dispatchStatusMatch[1]);
-      const job = tintinJobs.get(jobId);
-      if (!job) {
-        res.writeHead(404, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "not_found", job_id: jobId }));
-      }
-      res.writeHead(200, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify(job));
-    }
-
     // ── call_agent (Gate B) ───────────────────────────────────────────────────
     // POST /call-agent — lean one-shot Haiku dispatch through the warm pool.
     // sync (default): blocks, returns { ok, package, jobId, model, ms }.
@@ -6535,6 +5499,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         try {
           const { name } = JSON.parse(body || "{}");
           const result = await startChitchatSession(name || "collab");
+          operation("chitchat.start", { name: name || "collab" }, null, { ok: !result?.error, session_id: result?.session_id, error: result?.error });
           res.writeHead(200, { "Content-Type": "application/json", ...CORS });
           res.end(JSON.stringify(result));
         } catch (e) {
@@ -6545,14 +5510,15 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       return;
     }
 
-    // POST /handoff, /tintin/handoff, and /monkey/handoff — visible local handoff from claude.ai or a sidebar.
-    if (method === "POST" && (reqPath === "/handoff" || reqPath === "/tintin/handoff" || reqPath === "/monkey/handoff")) {
+    // POST /handoff — visible local handoff from claude.ai or a sidebar.
+    if (method === "POST" && reqPath === "/handoff") {
       let body;
       try { body = await readBody(req); } catch {
         res.writeHead(400, { "Content-Type": "application/json", ...CORS });
         return res.end(JSON.stringify({ error: "invalid JSON" }));
       }
       const result = await startHandoffSession(body || {});
+      operation("handoff.start", {}, null, { ok: !result.error, error: result.error });
       const status = result.error ? 503 : 200;
       res.writeHead(status, { "Content-Type": "application/json", ...CORS });
       return res.end(JSON.stringify(result));
@@ -6570,6 +5536,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
             return res.end(JSON.stringify({ error: "session_id and message required" }));
           }
           const result = sendChitchatMessage(session_id, message);
+          operation("chitchat.send", { session_id }, null, { ok: !result.error, error: result.error });
           const status = result.error === 'not_found' ? 404 : result.error ? 400 : 200;
           res.writeHead(status, { "Content-Type": "application/json", ...CORS });
           res.end(JSON.stringify(result));
@@ -6594,6 +5561,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           }
           const tier = knowledge_tier || 'db_only';
           const result = startTerminalSession(name, tier, context_md || null);
+          operation("terminal.start", { name, tier }, null, { ok: !result.error, error: result.error });
           const status = result.error ? 503 : 200;
           res.writeHead(status, { "Content-Type": "application/json", ...CORS });
           res.end(JSON.stringify(result));
@@ -6617,6 +5585,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
             return res.end(JSON.stringify({ error: "session_id and message required" }));
           }
           const result = sendTerminalMessage(session_id, message);
+          operation("terminal.send", { session_id }, null, { ok: !result.error, error: result.error });
           const status = result.error === 'session_busy' ? 409 : result.error ? 404 : 200;
           res.writeHead(status, { "Content-Type": "application/json", ...CORS });
           res.end(JSON.stringify(result));
@@ -6670,6 +5639,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
             return res.end(JSON.stringify({ error: "session_id required" }));
           }
           const result = stopTerminalSession(session_id);
+          operation("terminal.stop", { session_id }, null, { ok: !result.error, error: result.error });
           const status = result.error ? 404 : 200;
           res.writeHead(status, { "Content-Type": "application/json", ...CORS });
           res.end(JSON.stringify(result));
@@ -6729,6 +5699,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           channelEvents.push(entry);
           if (channelEvents.length > MAX_CHANNEL_EVENTS) channelEvents.shift();
           console.log(`[channel] queued event ${eventId} type=${event}`);
+          operation("channel.event", { event, resource, repository }, null, { ok: true, event_id: eventId });
           return ok(res, { received: true, event_id: eventId });
         } catch {
           res.writeHead(400, { "Content-Type": "application/json", ...CORS });
@@ -6741,6 +5712,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     // GET|POST /shutdown (for daemon stop — programmatic, keeps boot.key)
     // Accept POST as well — older scripts and curl default to POST
     if ((method === "GET" || method === "POST") && reqPath === "/shutdown") {
+      operation("daemon.shutdown", { port }, null, { ok: true });
       stopTunnel();
       ok(res, { ok: true, message: "shutting down" });
       removePid();
@@ -6750,6 +5722,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
     // POST /shutdown-ui (user-initiated stop — clears boot.key so password is required on restart)
     if (method === "POST" && reqPath === "/shutdown-ui") {
+      operation("daemon.shutdown_ui", { port }, null, { ok: true });
       stopTunnel();
       // Clear boot.key so watchdog can't auto-unlock on restart
       const bootKeyPath = getBootKeyPath();
@@ -6831,10 +5804,12 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       if (promoted) {
         const okLog = `[${new Date().toISOString()}] Make-live: promoted to live on port ${LIVE_PORT}\n`;
         try { fs.appendFileSync(LOG_FILE, okLog); } catch {}
+        operation("daemon.make_live", { from_port: port, live_port: LIVE_PORT }, null, { ok: true });
         ok(res, { ok: true, message: "promoted to live", live_port: LIVE_PORT });
       } else {
         const failLog = `[${new Date().toISOString()}] Make-live: new daemon failed to start on port ${LIVE_PORT}\n`;
         try { fs.appendFileSync(LOG_FILE, failLog); } catch {}
+        operation("daemon.make_live", { from_port: port, live_port: LIVE_PORT }, null, { ok: false, error: "new daemon failed to start" });
         ok(res, { ok: false, error: "New daemon failed to start on live port — check log" });
       }
 
@@ -7173,6 +6148,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           tunnelStatus = "starting";
           startTunnel().catch(() => {});
         }
+        operation("vault.unlock", {}, null, { ok: true });
         return ok(res, { ok: true, locked: false, write_token: writeSession.token, write_expires_at: new Date(writeSession.expiresAt).toISOString() });
       } catch (authErr) {
         const msg = authErr.message || "";
@@ -7198,6 +6174,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           // No strike, no hard-lock — the verdict was never rendered.
           const failLog = `[${new Date().toISOString()}] [BACKEND ${backendKind}] vault backend unreachable, no auth strike — ${detail}\n`;
           try { fs.appendFileSync(LOG_FILE, failLog); } catch {}
+          operation("vault.unlock", {}, null, { ok: false, backend_error: true, kind: backendKind });
           res.writeHead(503, { "Content-Type": "application/json", ...CORS });
           return res.end(JSON.stringify({
             error: friendly,
@@ -7222,6 +6199,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           authHardLocked = true;
           const lockLog = `[${new Date().toISOString()}] Server rejected with terminal verdict${reasonSuffix} — hard-locking locally to stop strike accrual; recover via the runbook (unlock machine + re-seal boot.key)\n`;
           try { fs.appendFileSync(LOG_FILE, lockLog); } catch {}
+          operation("vault.unlock", {}, null, { ok: false, terminal: true, reason: serverReason });
           res.writeHead(401, { "Content-Type": "application/json", ...CORS });
           return res.end(JSON.stringify({ error: "Vault rejected credentials — recovery required", reason: serverReason, hard_locked: true, terminal: true }));
         }
@@ -7229,9 +6207,11 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           authHardLocked = true;
           const lockLog = `[${new Date().toISOString()}] Auth failure limit reached — vault hard-locked\n`;
           try { fs.appendFileSync(LOG_FILE, lockLog); } catch {}
+          operation("vault.unlock", {}, null, { ok: false, hard_locked: true, reason: serverReason });
           res.writeHead(401, { "Content-Type": "application/json", ...CORS });
           return res.end(JSON.stringify({ error: "Too many failed attempts — restart daemon to try again", reason: serverReason, hard_locked: true }));
         }
+        operation("vault.unlock", {}, null, { ok: false, reason: serverReason, failures_remaining: authRemaining });
         res.writeHead(401, { "Content-Type": "application/json", ...CORS });
         return res.end(JSON.stringify({ error: "Invalid password", reason: serverReason, failures_remaining: authRemaining }));
       }
@@ -7245,6 +6225,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       stopTunnel();
       const logLine = `[${new Date().toISOString()}] Vault locked\n`;
       try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
+      operation("vault.lock", {}, null, { ok: true });
       return ok(res, { ok: true, locked: true, hard_locked: authHardLocked });
     }
 
@@ -7266,10 +6247,15 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       try {
         const { token, timestamp } = deriveToken(password, machineHash);
         const result = await api.updateService(password, machineHash, token, timestamp, service, { name: newName, label: newName });
-        if (result.error) return strike(res, 502, result.error);
+        if (result.error) {
+          operation("service.rename", { service, new_name: newName }, null, { ok: false, error: result.error });
+          return strike(res, 502, result.error);
+        }
         invalidateServiceStatusCache(machineHash);
+        operation("service.rename", { service, new_name: newName }, null, { ok: true });
         return ok(res, { ok: true, old_name: service, new_name: newName });
       } catch (err) {
+        operation("service.rename", { service, new_name: newName }, null, { ok: false, error: err.message });
         return strike(res, 502, err.message);
       }
     }
@@ -7282,10 +6268,15 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       try {
         const { token, timestamp } = deriveToken(password, machineHash);
         const result = await api.removeService(password, machineHash, token, timestamp, service, `CONFIRM REMOVE ${service.toUpperCase()}`);
-        if (result.error) return strike(res, 502, result.error);
+        if (result.error) {
+          operation("service.delete", { service }, null, { ok: false, error: result.error });
+          return strike(res, 502, result.error);
+        }
         invalidateServiceStatusCache(machineHash);
+        operation("service.delete", { service }, null, { ok: true });
         return ok(res, { ok: true, deleted: service });
       } catch (err) {
+        operation("service.delete", { service }, null, { ok: false, error: err.message });
         return strike(res, 502, err.message);
       }
     }
@@ -7311,10 +6302,15 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       try {
         const { token, timestamp } = deriveToken(password, machineHash);
         const result = await api.enable(password, machineHash, token, timestamp, service, enabled);
-        if (result.error) return strike(res, 502, result.error);
+        if (result.error) {
+          operation("service.toggle", { service, enabled }, null, { ok: false, error: result.error });
+          return strike(res, 502, result.error);
+        }
         invalidateServiceStatusCache(machineHash);
+        operation("service.toggle", { service, enabled }, null, { ok: true });
         return ok(res, { ok: true, service, enabled });
       } catch (err) {
+        operation("service.toggle", { service, enabled }, null, { ok: false, error: err.message });
         return strike(res, 502, err.message);
       }
     }
@@ -7401,6 +6397,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         return res.end(JSON.stringify({ error: "Service name required" }));
       }
       const result = await rotationEngine.rotateService(service);
+      operation("service.rotate", { service }, null, { ok: !result?.error, error: result?.error });
       return ok(res, result);
     }
 
@@ -7414,6 +6411,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         return res.end(JSON.stringify({ error: "Invalid JSON body" }));
       }
       rotationEngine.setExpiry(service, body.expires_at, body.rotation_days);
+      operation("service.set_expiry", { service }, null, { ok: true, expires_at: body.expires_at, rotation_days: body.rotation_days });
       return ok(res, { ok: true, service, expires_at: body.expires_at });
     }
 
@@ -7597,8 +6595,10 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           });
         }
 
+        operation("tunnel.setup.cf_token", {}, null, { ok: true, accountId, accountName });
         return ok(res, { ok: true, accountId, accountName });
       } catch (err) {
+        operation("tunnel.setup.cf_token", {}, null, { ok: false, error: err.message });
         return strike(res, 502, err.message);
       }
     }
@@ -7669,8 +6669,10 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         tunnelHostname = hostname;
         tunnelUrl = `https://${hostname}`;
 
+        operation("tunnel.setup.cf_save", { hostname, tunnelId }, null, { ok: true });
         return ok(res, { ok: true, hostname });
       } catch (err) {
+        operation("tunnel.setup.cf_save", { hostname }, null, { ok: false, error: err.message });
         return strike(res, 502, err.message);
       }
     }
@@ -7750,8 +6752,10 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         tunnelHostname = hostname;
         tunnelUrl = `https://${hostname}`;
 
+        operation("tunnel.setup.cf_create_api", { hostname, tunnelId }, null, { ok: true });
         return ok(res, { ok: true, tunnelId, hostname });
       } catch (err) {
+        operation("tunnel.setup.cf_create_api", { hostname }, null, { ok: false, error: err.message });
         return strike(res, 502, err.message);
       }
     }
@@ -7792,9 +6796,13 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         const proc = spawn("cloudflared", ["tunnel", "login"], { stdio: ["ignore","pipe","pipe"], windowsHide: true });
         proc.stdout.on("data", d => d.toString().split("\n").forEach(l => l.trim() && sendEvt({ line: l })));
         proc.stderr.on("data", d => d.toString().split("\n").forEach(l => l.trim() && sendEvt({ line: l })));
-        proc.on("close", code => { sendEvt({ done: true, code }); res.end(); });
+        proc.on("close", code => {
+          operation("tunnel.setup.cf_login", {}, null, { ok: code === 0, exit_code: code });
+          sendEvt({ done: true, code }); res.end();
+        });
         req.on("close", () => { try { proc.kill(); } catch {} });
       } catch (err) {
+        operation("tunnel.setup.cf_login", {}, null, { ok: false, error: err.message });
         sendEvt({ done: true, code: 1, error: err.message });
         res.end();
       }
@@ -7866,9 +6874,11 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         tunnelHostname = hostname;
         tunnelUrl = `https://${hostname}`;
 
+        operation("tunnel.setup.cf_create", { name, hostname, tunnelId }, null, { ok: true });
         sendEvt({ done: true, tunnelId, hostname });
         res.end();
       } catch (err) {
+        operation("tunnel.setup.cf_create", { name, hostname }, null, { ok: false, error: err.message });
         sendEvt({ error: err.message, done: true });
         res.end();
       }
@@ -7900,8 +6910,10 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         writeSession = makeWriteToken();
         const logLine = `[${new Date().toISOString()}] Password changed\n`;
         try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
+        operation("vault.change_password", {}, null, { ok: true });
         return ok(res, { ok: true, write_token: writeSession.token, write_expires_at: new Date(writeSession.expiresAt).toISOString() });
       } catch (err) {
+        operation("vault.change_password", {}, null, { ok: false, error: err.message });
         res.writeHead(502, { "Content-Type": "application/json", ...CORS });
         return res.end(JSON.stringify({ error: err.message }));
       }
@@ -7929,11 +6941,17 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       }
 
       try {
+        // NEVER log `value` — it is the secret being written.
         const { result, snapshot, normalized } = await writeCredentialWithRecovery({ password, machineHash, service, value, logFile: LOG_FILE });
-        if (result.error) return strike(res, 502, result.error);
+        if (result.error) {
+          operation("service.set", { service }, null, { ok: false, error: result.error });
+          return strike(res, 502, result.error);
+        }
         invalidateServiceStatusCache(machineHash);
+        operation("service.set", { service }, null, { ok: true, normalized });
         return ok(res, { ok: true, service, recovery_snapshot: snapshot?.ok ? true : false, normalized });
       } catch (err) {
+        operation("service.set", { service }, null, { ok: false, error: err.message });
         return strike(res, 502, err.message);
       }
     }
@@ -7962,11 +6980,17 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       try {
         const randomHex = crypto.randomBytes(32).toString("hex");
         const token = `${prefix}${randomHex}`;
+        // NEVER log `token` — it is the secret being generated/stored.
         const { result, snapshot } = await writeCredentialWithRecovery({ password, machineHash, service, value: token, logFile: LOG_FILE, normalize: false });
-        if (result.error) return strike(res, 502, result.error);
+        if (result.error) {
+          operation("service.generate_token", { service }, null, { ok: false, error: result.error });
+          return strike(res, 502, result.error);
+        }
         invalidateServiceStatusCache(machineHash);
+        operation("service.generate_token", { service }, null, { ok: true });
         return ok(res, { token, service, stored: true, recovery_snapshot: snapshot?.ok ? true : false });
       } catch (err) {
+        operation("service.generate_token", { service }, null, { ok: false, error: err.message });
         return strike(res, 502, err.message);
       }
     }
@@ -7996,10 +7020,15 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       try {
         const { token, timestamp } = deriveToken(password, machineHash);
         const result = await api.addService(password, machineHash, token, timestamp, name.trim().toLowerCase(), label || name.trim(), type, description || "", project || undefined);
-        if (result.error) return strike(res, 502, result.error);
+        if (result.error) {
+          operation("service.add", { name: name.trim().toLowerCase() }, null, { ok: false, error: result.error });
+          return strike(res, 502, result.error);
+        }
         invalidateServiceStatusCache(machineHash);
+        operation("service.add", { name: name.trim().toLowerCase() }, null, { ok: true, key_type: type });
         return ok(res, { ok: true, service: name.trim().toLowerCase() });
       } catch (err) {
+        operation("service.add", { name: name.trim().toLowerCase() }, null, { ok: false, error: err.message });
         return strike(res, 502, err.message);
       }
     }
@@ -8033,10 +7062,15 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       try {
         const { token, timestamp } = deriveToken(password, machineHash);
         const result = await api.updateService(password, machineHash, token, timestamp, service.toLowerCase(), updates);
-        if (result.error) return strike(res, 502, result.error);
+        if (result.error) {
+          operation("service.update", { name: service.toLowerCase() }, null, { ok: false, error: result.error });
+          return strike(res, 502, result.error);
+        }
         invalidateServiceStatusCache(machineHash);
+        operation("service.update", { name: service.toLowerCase() }, null, { ok: true, fields: Object.keys(updates) });
         return ok(res, { ok: true, service: service.toLowerCase(), ...updates });
       } catch (err) {
+        operation("service.update", { name: service.toLowerCase() }, null, { ok: false, error: err.message });
         return strike(res, 502, err.message);
       }
     }
@@ -8087,11 +7121,16 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       try {
         const { token, timestamp } = deriveToken(password, machineHash);
         const result = await api.createEnrollment(password, machineHash, token, timestamp, label, ttlMinutes);
-        if (result.error) return strike(res, 502, result.error);
+        if (result.error) {
+          operation("machine.enroll", { label, target }, null, { ok: false, error: result.error });
+          return strike(res, 502, result.error);
+        }
         const localConfig = new Conf(getConfOptions());
         const supabaseUrl = localConfig.get("supabase_url") || process.env.CLAUTH_SUPABASE_URL || "";
         const anonKey = localConfig.get("supabase_anon_key") || process.env.CLAUTH_SUPABASE_ANON_KEY || "";
+        // NEVER log `enrollment_code` — it is a one-time credential.
         const scriptPath = writeEnrollmentScript({ supabaseUrl, anonKey, enrollmentCode: result.enrollment_code, label, target });
+        operation("machine.enroll", { label, target }, null, { ok: true, expires_at: result.expires_at });
         return ok(res, {
           ok: true,
           enrollment_code: result.enrollment_code,
@@ -8099,6 +7138,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           script_path: scriptPath,
         });
       } catch (err) {
+        operation("machine.enroll", { label, target }, null, { ok: false, error: err.message });
         return strike(res, 502, err.message);
       }
     }
@@ -8561,9 +7601,35 @@ async function actionForeground(opts) {
   console.log(chalk.gray(`  Services: ${whitelist ? whitelist.join(", ") : "all"}`));
   console.log(chalk.gray(`  Lockout:  3 failures → exit\n`));
 
+  // Plugin discovery previously only ran under `serve supervisor` or an
+  // on-demand rescan — normal `serve start`/`foreground` boot never ran it,
+  // so a stale/never-discovered plugin list could sit unnoticed until
+  // someone happened to hit rescan. Discovery touching disk must never be
+  // allowed to crash daemon boot, hence the try/catch.
+  let discoveryResult = null;
+  let discoveryError = null;
+  try {
+    discoveryResult = discoverPlugins();
+  } catch (err) {
+    discoveryError = err;
+    console.log(chalk.yellow(`  ⚠ plugin discovery failed at boot: ${err.message}`));
+  }
+
   const server = createServer(password, whitelist, port, tunnelHostname);
   server.listen(port, bindHost, () => {
     if (!isolated) writePid(process.pid, port);
+    try {
+      operation("daemon.started", { port, isolated }, null, { ok: true, version: VERSION }, "system");
+      operation(
+        "daemon.plugin_discovery",
+        { port },
+        null,
+        discoveryError
+          ? { ok: false, error: discoveryError.message }
+          : { ok: true, plugin_count: (discoveryResult?.plugins || discoveryResult || []).length },
+        "system",
+      );
+    } catch { /* startup logging must never block the daemon from serving */ }
     console.log(chalk.green(`  clauth serve → http://${bindHost}:${port}`));
     if (tunnelHostname) {
       console.log(chalk.cyan(`  Tunnel:   https://${tunnelHostname}/sse`));
@@ -8604,7 +7670,7 @@ async function actionForeground(opts) {
 import { createInterface } from "readline";
 import { execSync, spawn as spawnProc, spawnSync } from "child_process";
 
-// ── TinTin dispatch (formerly Monkey) — headless Claude CLI worker ───
+// ── Shared headless Claude CLI worker helpers (used by call-agent, terminal, codevelop) ───
 function findClaudeBinary() {
   const candidates = [
     process.env.CLAUDE_BIN,
@@ -9095,7 +8161,7 @@ async function runCallAgent(args = {}) {
   const persistMeta = { prompt, skill_slug: args.skill_slug, model, agent_context: args.agent_context };
 
   if (mode === "async") {
-    const jobId = makeTinTinId("call");
+    const jobId = `call-${crypto.randomUUID()}`;
     // Persist the queued row FIRST so the { jobId } we return is recoverable
     // even if the daemon restarts before the worker settles.
     await persistCallAgentDispatch({ jobId, ...persistMeta });
@@ -9119,307 +8185,6 @@ async function runCallAgent(args = {}) {
   return { ok: true, package: rec.package, jobId: rec.jobId, model: rec.model, ms: rec.ms };
 }
 
-const tintinJobs = new Map();
-const MAX_TINTIN_JOBS = 100;
-const tintinSessions = new Map();
-const tintinMessageIndex = new Map();
-const tintinEventStreams = new Map();
-const tintinMessageMonitors = new Map();
-const MAX_TINTIN_SESSION_EVENTS = 500;
-
-function normalizeAgentContext(input = {}) {
-  const context = input && typeof input === "object" ? input : {};
-  const app = context.app && typeof context.app === "object" ? context.app : {};
-  const repo = context.repo && typeof context.repo === "object" ? context.repo : {};
-  const runtime = context.runtime && typeof context.runtime === "object" ? context.runtime : {};
-  const task = context.task && typeof context.task === "object" ? context.task : {};
-
-  return {
-    app: {
-      slug: String(app.slug || context.app_slug || "unknown-app"),
-      route: String(app.route || context.route || "/"),
-      origin: String(app.origin || context.origin || "unknown-origin"),
-    },
-    repo: {
-      root: String(repo.root || context.repo_root || ""),
-      cwd: String(repo.cwd || context.cwd || ""),
-    },
-    runtime: {
-      agent: String(runtime.agent || context.agent || "clauth-cli"),
-      requested_by: String(runtime.requested_by || context.requested_by || "tintin"),
-    },
-    task: {
-      intent: String(task.intent || context.intent || "tintin-dispatch"),
-      thread_id: task.thread_id || context.thread_id || null,
-    },
-  };
-}
-
-function makeTinTinId(prefix) {
-  return `${prefix}-${Date.now()}-${crypto.randomBytes(4).toString("hex")}`;
-}
-
-function createTinTinSession(input = {}) {
-  const sessionId = input.session_id || input.thread_id || makeTinTinId("ms");
-  const agentContext = normalizeAgentContext(input.agent_context || {
-    app: {
-      slug: input.app_id || input.app_slug || "unknown-app",
-      route: input.route || "/",
-      origin: input.origin || "unknown-origin",
-    },
-    repo: {
-      root: input.repo_root || "",
-      cwd: input.cwd || "",
-    },
-    runtime: {
-      agent: "clauth-cli",
-      requested_by: "tintin-sidebar",
-    },
-    task: {
-      intent: input.intent || "general_chat",
-      thread_id: sessionId,
-    },
-  });
-  const existing = tintinSessions.get(sessionId);
-  if (existing) {
-    existing.agent_context = agentContext;
-    existing.updated_at = new Date().toISOString();
-    tintinSessions.set(sessionId, existing);
-    return existing;
-  }
-  const session = {
-    id: sessionId,
-    status: "ready",
-    created_at: new Date().toISOString(),
-    updated_at: new Date().toISOString(),
-    seq: 0,
-    agent_context: agentContext,
-    cwd: input.cwd || agentContext.repo.cwd || agentContext.repo.root || "",
-    events: [],
-  };
-  tintinSessions.set(sessionId, session);
-  return session;
-}
-
-function getTinTinSession(sessionId) {
-  return tintinSessions.get(sessionId);
-}
-
-function pushTinTinEvent(sessionId, event) {
-  const session = getTinTinSession(sessionId);
-  if (!session) return null;
-  session.seq += 1;
-  session.updated_at = new Date().toISOString();
-  const fullEvent = {
-    id: event.id || makeTinTinId("mev"),
-    session_id: sessionId,
-    seq: session.seq,
-    source: event.source || "clauth",
-    type: event.type || "status",
-    role: event.role,
-    message_id: event.message_id,
-    job_id: event.job_id,
-    content: event.content,
-    payload: event.payload || {},
-    created_at: new Date().toISOString(),
-  };
-  session.events.push(fullEvent);
-  session.events = session.events.slice(-MAX_TINTIN_SESSION_EVENTS);
-  tintinSessions.set(sessionId, session);
-  const streams = tintinEventStreams.get(sessionId);
-  if (streams) {
-    for (const send of [...streams]) {
-      try {
-        send(fullEvent);
-      } catch {
-        streams.delete(send);
-      }
-    }
-  }
-  return fullEvent;
-}
-
-function listTinTinEvents(sessionId, afterSeq = 0) {
-  const session = getTinTinSession(sessionId);
-  if (!session) return null;
-  return session.events.filter((event) => event.seq > afterSeq);
-}
-
-function subscribeTinTinEvents(sessionId, send) {
-  const streams = tintinEventStreams.get(sessionId) || new Set();
-  streams.add(send);
-  tintinEventStreams.set(sessionId, streams);
-  return () => {
-    const current = tintinEventStreams.get(sessionId);
-    if (!current) return;
-    current.delete(send);
-    if (current.size === 0) tintinEventStreams.delete(sessionId);
-  };
-}
-
-function startTinTinMessageMonitor(sessionId, messageId, jobId) {
-  const key = `${sessionId}:${messageId}`;
-  if (tintinMessageMonitors.has(key)) return;
-  let lastStdoutLength = 0;
-  const timer = setInterval(() => {
-    const job = tintinJobs.get(jobId);
-    if (!job) return;
-    const stdout = job.stdout || "";
-    if (stdout.length > lastStdoutLength) {
-      const chunk = stdout.slice(lastStdoutLength);
-      lastStdoutLength = stdout.length;
-      pushTinTinEvent(sessionId, {
-        source: "claude",
-        type: "delta",
-        role: "assistant",
-        message_id: messageId,
-        job_id: jobId,
-        content: chunk,
-      });
-    }
-    if (job.status !== "running") {
-      clearInterval(timer);
-      tintinMessageMonitors.delete(key);
-      pushTinTinEvent(sessionId, {
-        source: "clauth",
-        type: job.status === "completed" ? "done" : "error",
-        role: "assistant",
-        message_id: messageId,
-        job_id: jobId,
-        content: job.status === "completed" ? "" : (job.stderr || job.stdout || "TinTin worker failed"),
-        payload: {
-          status: job.status,
-          exit_code: job.exit_code,
-          completed_at: job.completed_at,
-        },
-      });
-    }
-  }, 500);
-  tintinMessageMonitors.set(key, timer);
-}
-
-function resolveDispatchCwd(requestedCwd, agentContext = {}) {
-  const raw = requestedCwd || agentContext?.repo?.cwd || agentContext?.repo?.root || CHITCHAT_FALLBACK_CWD;
-  if (!raw || typeof raw !== "string") return CHITCHAT_FALLBACK_CWD;
-  const resolved = path.resolve(raw);
-  try {
-    const st = fs.statSync(resolved);
-    if (!st.isDirectory()) return CHITCHAT_FALLBACK_CWD;
-    return resolved;
-  } catch {
-    return CHITCHAT_FALLBACK_CWD;
-  }
-}
-
-function buildTinTinPrompt({ prompt, job_id, agent_context }) {
-  const normalized = normalizeAgentContext(agent_context);
-  const jobInstruction = job_id
-    ? [
-        `TinTin job id: ${job_id}`,
-        "If the prompt does not contain all job details, use clauth at http://127.0.0.1:52437 to fetch exact credentials and query the app database/API directly.",
-        "Do not assume agent MCP/plugin tools are available to this spawned CLI process.",
-      ].join("\n")
-    : "";
-
-  const body = prompt || [
-    "Process this TinTin job using the provided agent context.",
-    jobInstruction,
-    "Find the job payload from the consuming app's declared data path before making changes.",
-  ].filter(Boolean).join("\n\n");
-
-  return [
-    "You are a clauth-spawned TinTin CLI agent (model: claude-sonnet-4-6).",
-    "Agent context setup follows. Treat it as the runtime contract for this task.",
-    "```json",
-    JSON.stringify(normalized, null, 2),
-    "```",
-    "",
-    "Execution rules:",
-    "- You are a local CLI process, not the parent agent runtime.",
-    "- You do not inherit Codex/Claude MCP or plugin tools.",
-    "- Use clauth HTTP, direct HTTP APIs, repo files, or app endpoints for access.",
-    "- Keep results tied to the supplied app, route, cwd, thread, and job id.",
-    "",
-    jobInstruction,
-    "",
-    body,
-  ].filter(Boolean).join("\n");
-}
-
-function spawnClaudeTask(prompt, jobId, cwd, agentContext) {
-  if (activeCliWorkers >= MAX_CLI_WORKERS) {
-    return { error: 'concurrency_limit', message: `Max ${MAX_CLI_WORKERS} CLI workers active` };
-  }
-  const binary = findClaudeBinary();
-  if (!binary) {
-    return { error: 'binary_not_found', message: 'claude CLI not found in PATH or AppData/npm' };
-  }
-
-  const resolvedCwd = resolveDispatchCwd(cwd, agentContext);
-  activeCliWorkers++;
-  const startedAtIso = new Date().toISOString();
-  tintinJobs.set(jobId, {
-    jobId,
-    status: "running",
-    cwd: resolvedCwd,
-    pid: null,
-    started_at: startedAtIso,
-    completed_at: null,
-    exit_code: null,
-    stdout: "",
-    stderr: "",
-    context: normalizeAgentContext(agentContext),
-  });
-  while (tintinJobs.size > MAX_TINTIN_JOBS) {
-    const firstKey = tintinJobs.keys().next().value;
-    tintinJobs.delete(firstKey);
-  }
-  const isCmdShim = process.platform === "win32" && /\.cmd$/i.test(binary);
-  const command = isCmdShim ? "cmd" : binary;
-  const args = isCmdShim
-    ? ["/d", "/s", "/c", `"${binary}"`, "-p", prompt, "--dangerously-skip-permissions"]
-    : ["-p", prompt, "--dangerously-skip-permissions"];
-  const proc = spawnProc(command, args, {
-    cwd: resolvedCwd,
-    env: process.env,
-    stdio: ['ignore', 'pipe', 'pipe'],
-    shell: false,
-    windowsHide: true,
-  });
-
-  const tracked = tintinJobs.get(jobId);
-  if (tracked) {
-    tracked.pid = proc.pid;
-    tintinJobs.set(jobId, tracked);
-  }
-
-  const startedAt = Date.now();
-  proc.stdout?.on("data", (chunk) => {
-    const trackedJob = tintinJobs.get(jobId);
-    if (!trackedJob) return;
-    trackedJob.stdout = `${trackedJob.stdout}${chunk.toString()}`.slice(-20000);
-    tintinJobs.set(jobId, trackedJob);
-  });
-  proc.stderr?.on("data", (chunk) => {
-    const trackedJob = tintinJobs.get(jobId);
-    if (!trackedJob) return;
-    trackedJob.stderr = `${trackedJob.stderr}${chunk.toString()}`.slice(-20000);
-    tintinJobs.set(jobId, trackedJob);
-  });
-  proc.on('close', (code) => {
-    activeCliWorkers--;
-    const trackedJob = tintinJobs.get(jobId);
-    if (trackedJob) {
-      trackedJob.status = code === 0 ? "completed" : "failed";
-      trackedJob.exit_code = code;
-      trackedJob.completed_at = new Date().toISOString();
-      tintinJobs.set(jobId, trackedJob);
-    }
-    console.log(`[tintin] job ${jobId} exited code=${code} in ${Date.now() - startedAt}ms`);
-  });
-
-  return { status: 'spawned', pid: proc.pid, jobId, cwd: resolvedCwd, activeWorkers: activeCliWorkers };
-}
 
 // ── Terminal session manager ─────────────────────────────────────
 // Rolling-context approach: each session stores a context string.
@@ -9437,7 +8202,7 @@ function generateSessionId() {
 }
 
 function defaultTerminalCwd() {
-  const dir = process.env.CLAUTH_TERMINAL_CWD || path.join(os.tmpdir(), "clauth-tintin-terminal");
+  const dir = process.env.CLAUTH_TERMINAL_CWD || path.join(os.tmpdir(), "clauth-terminal");
   try {
     fs.mkdirSync(dir, { recursive: true });
   } catch {
@@ -9471,7 +8236,7 @@ function startTerminalSession(name, knowledge_tier, context_md, cwd, use_warm =
   };
 
   // Try to acquire a warm worker only when explicitly requested. The warm pool
-  // is optimized for call_agent one-shots; TinTin browser chat needs reliable
+  // is optimized for call_agent one-shots; a terminal session needs reliable
   // repeated turns more than experimental low-latency pinning.
   if (use_warm) {
     try {
@@ -9679,12 +8444,12 @@ function showTerminalSession(session_id) {
 
   if (process.platform === "win32") {
     try {
-      const title = `TinTin ${session.name || session_id}`;
+      const title = `clauth terminal ${session.name || session_id}`;
       const lines = [
         `$Host.UI.RawUI.WindowTitle = ${JSON.stringify(title)}`,
         `Set-Location -LiteralPath ${JSON.stringify(session.cwd || os.homedir())}`,
         "Clear-Host",
-        `Write-Host ${JSON.stringify(`TinTin session ${session_id}`)} -ForegroundColor Cyan`,
+        `Write-Host ${JSON.stringify(`clauth terminal session ${session_id}`)} -ForegroundColor Cyan`,
         `Write-Host ${JSON.stringify(`Name: ${session.name || ""}`)}`,
         `Write-Host ${JSON.stringify(`Status: ${session.status}`)}`,
         `Write-Host ${JSON.stringify(`CWD: ${session.cwd || ""}`)}`,
@@ -10653,7 +9418,7 @@ function isAllowedGitImportPath(p, allowedPrefixes = FS_GIT_IMPORT_ALLOWED_PREFI
   return allowedPrefixes.some((prefix) => p === prefix.replace(/\/$/, "") || p.startsWith(prefix));
 }
 
-const MCP_TOOLS = [
+export const MCP_TOOLS = [
   {
     name: "clauth_ping",
     description: "Check if the vault is locked or unlocked, show failure count",
@@ -10803,7 +9568,7 @@ const MCP_TOOLS = [
   },
   {
     name: "call_agent",
-    description: "Call a headless Haiku agent for a single prompt or skill and get the answer back. Lean one-shot through a warm pool (model default claude-haiku-4-5, ~4-5s warm). sync mode (default) blocks and returns { ok, package, jobId, model, ms }; async returns { ok, jobId } for polling. Use this for call-and-return — not tintin_dispatch (which is fire-and-poll).",
+    description: "Call a headless Haiku agent for a single prompt or skill and get the answer back. Lean one-shot through a warm pool (model default claude-haiku-4-5, ~4-5s warm). sync mode (default) blocks and returns { ok, package, jobId, model, ms }; async returns { ok, jobId } for polling.",
     inputSchema: {
       type: "object",
       properties: {
@@ -10844,24 +9609,6 @@ const MCP_TOOLS = [
       additionalProperties: false,
     },
   },
-  {
-    name: "tintin_dispatch", // formerly monkey_dispatch
-    description: "Dispatch a TinTin job to a headless Claude Code CLI worker with an app/repo/runtime/task agent_context envelope. Max 2 concurrent workers.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        prompt: { type: "string", description: "Full prompt for the CLI worker to execute. Optional when job_id is supplied." },
-        job_id: { type: "string", description: "tintin job UUID or app job id for tracking" },
-        cwd: { type: "string", description: "Existing local directory where the CLI worker should run" },
-        agent_context: {
-          type: "object",
-          description: "App-neutral context envelope with app, repo, runtime, and task fields",
-          additionalProperties: true,
-        },
-      },
-      additionalProperties: false,
-    },
-  },
   {
     name: "handoff_start",
     description: "Start a visible local Claude Code handoff session from a /handoff command and return immediately with session metadata.",
@@ -10913,7 +9660,7 @@ const MCP_TOOLS = [
   },
   {
     name: "terminal_show",
-    description: "Reveal/focus a TinTin terminal session on this Windows machine. If no live Claude process window exists, opens a visible session inspector at the session cwd.",
+    description: "Reveal/focus a clauth terminal session on this Windows machine. If no live Claude process window exists, opens a visible session inspector at the session cwd.",
     inputSchema: {
       type: "object",
       properties: {
@@ -12819,19 +11566,6 @@ async function handleMcpTool(vault, name, args) {
       return mcpResult(JSON.stringify(result));
     }
 
-    case "tintin_dispatch": // formerly monkey_dispatch
-    case "monkey_dispatch": {
-      const { prompt, job_id, cwd: requestedCwd, agent_context } = args;
-      if (!prompt && !job_id) return mcpError("prompt required");
-      const fallbackCwd = await resolveChitchatRoot(vault);
-      const normalizedContext = normalizeAgentContext(agent_context);
-      const dispatchCwd = resolveDispatchCwd(requestedCwd || fallbackCwd, normalizedContext);
-      const wrappedPrompt = buildTinTinPrompt({ prompt, job_id, agent_context: normalizedContext });
-      const result = spawnClaudeTask(wrappedPrompt, job_id || "untracked", dispatchCwd, normalizedContext);
-      if (result.error) return mcpError(`${result.error}: ${result.message}`);
-      return mcpResult(JSON.stringify({ ...result, context: normalizedContext }));
-    }
-
     case "handoff_start": {
       const result = await startHandoffSession(args || {}, vault);
       if (result.error) return mcpError(`${result.error}: ${result.message}`);
@@ -13957,7 +12691,8 @@ async function actionUpgrade(opts) {
 async function actionSupervisor(opts) {
   opts.isolated = true;
   opts.port = String(opts.port || getSupervisorPort());
-  discoverPlugins();
+  // discoverPlugins() now runs unconditionally inside actionForeground at
+  // every boot — calling it here too would double-run discovery.
   return actionForeground(opts);
 }