@songsid/agend 2.2.0-beta.9 → 2.3.0-beta.1

package/dist/daemon.js

@@ -1,6 +1,9 @@
 import { AGENT_WHATS_NEW, agendVersion, planWhatsNew, readWhatsNewRecord, recordWhatsNew, whatsNewNotice } from "./agent-whats-new.js";
-import { join, dirname, basename, resolve } from "node:path";
+import { join, dirname, resolve } from "node:path";
+import { checkoutTarget, readCheckouts, releaseCandidate, reposRoot, verifyWorktree, writeCheckouts } from "./repo-worktree-guard.js";
 import { mkdirSync, writeFileSync, readFileSync, readdirSync, existsSync, unlinkSync, rmSync, appendFileSync, statSync, renameSync } from "node:fs";
+import { COMPACT_WATCH_TIMEOUT_MS, launchIdentity } from "./compact-watch.js";
+import { KIRO_COMPACT_PANE_LINES, KiroCompactPaneFollower } from "./kiro-compact-pane.js";
 import { fileURLToPath } from "node:url";
 import { ensureInstanceDir } from "./private-dir.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -17,6 +20,9 @@ import { TranscriptTurnLedger } from "./transcript-turns.js";
 import { credentialProfileStoreHome, resolveCredentialProfile } from "./backend/credential-profile.js";
 import { resolveToolSet } from "./tool-permissions.js";
 import { getAgendHome } from "./paths.js";
+import { readAgentEffect, sendEffectInParts } from "./web-effect-upload.js";
+import { readAgentFile } from "./agent-file-read.js";
+import { ASSET_UPLOAD_MAX_BYTES, MOD_FILE, MOD_MAX_PARTS, MOD_UPLOAD_MAX_BYTES, receiveFiles, receivePreview, sendAssetInParts, writeModFile, writePreview } from "./web-asset-parts.js";
 import { LOGIN_FLOWS } from "./login-flows.js";
 import { ProgressAccumulator, summarizeProgress } from "./tool-progress.js";
 import { assembleSystemPrompt, resolveWorkflowText } from "./prompt-file-ref.js";
@@ -53,6 +59,26 @@ import { unrecognisedPromptShape } from "./unrecognised-prompt.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 // Tool routing sets — module-level to avoid re-creation on every handleToolCall
+/** #1629: the caller's own web theme tools, each its own typed IPC message (one tool per type, for the permission check). */
+const WEB_THEME_IPC = Object.freeze({
+    get_web_theme: "fleet_get_web_theme", set_web_theme: "fleet_set_web_theme",
+    set_web_theme_asset: "fleet_set_web_theme_asset", reset_web_theme: "fleet_reset_web_theme",
+    // r4 §1: how it appears — read-only; a preview's files are written here, on the agent's side.
+    get_web_appearance: "fleet_get_web_appearance", preview_web_appearance: "fleet_preview_web_appearance",
+    // r4-4: its own declarative widgets.
+    set_web_widget: "fleet_set_web_widget", remove_web_widget: "fleet_remove_web_widget",
+    // r4-5b: mods — an export's file is written here, a proposal's file read here (on the agent's side).
+    export_web_mod: "fleet_export_web_mod", propose_web_mod: "fleet_propose_web_mod",
+    upload_web_effect: "fleet_upload_web_effect",
+    list_web_effects: "fleet_list_web_effects",
+    preview_web_effect: "fleet_preview_web_effect",
+    profile_web_effect: "fleet_profile_web_effect",
+    apply_web_effect: "fleet_apply_web_effect",
+    remove_web_effect: "fleet_remove_web_effect",
+    delete_web_effect: "fleet_delete_web_effect",
+});
+/** The largest picture any slot may take (a card slot's ceiling; the fleet checks the limit in force): read no more. */
+const WEB_THEME_ASSET_MAX_BYTES = ASSET_UPLOAD_MAX_BYTES;
 const CROSS_INSTANCE_TOOLS = new Set(["send_to_instance", "broadcast", "list_instances", "start_instance", "restart_instance", "create_instance", "delete_instance", "replace_instance", "request_information", "delegate_task", "report_result", "delivery_status", "describe_instance"]);
 const SCHEDULE_TOOLS = new Set(["create_schedule", "list_schedules", "update_schedule", "delete_schedule"]);
 const DECISION_TOOLS = new Set(["post_decision", "list_decisions", "update_decision"]);
@@ -102,7 +128,7 @@ export function buildInstructionReloadNotice(binaryName, instanceName, instanceD
         : binaryName === "kiro-cli"
             ? `.kiro/steering/agend-${instanceName}.md`
             : binaryName === "agy"
-                ? ".agents/agents.md"
+                ? ".agents/AGENTS.md"
                 : join(instanceDir, "fleet-instructions.md");
     return `[system] Your AgEnD instructions have been updated. Reload only ${source}; do not scan other instruction directories. Do not reply to this message.`;
 }
@@ -138,6 +164,8 @@ export const DEFAULT_STATE_IDLE_DEBOUNCE_MS = 2_000;
 export const DEFAULT_STATE_SAFETY_SWEEP_MS = 60_000;
 /** Coalesce one cosmetic-redraw burst before comparing the visible pane. */
 export const PERIODIC_REDRAW_PROBE_MS = 25;
+/** Board 907c7899: how often a kiro /compact's pane is read (TUI V2's "too short" shows for about ten seconds). */
+const KIRO_COMPACT_PANE_POLL_MS = 1_000;
 /** Do not turn a streaming Codex turn into one capture-pane per burst. */
 export const STRUCTURED_IDLE_PROBE_MS = 500;
 /**
@@ -645,6 +673,10 @@ export function channelStatus(meta) {
     // they are the dashboard's ticks (the fleet routes them by the message id, never to a platform).
     if (!messageId || (!chatId && meta.source !== "web"))
         return undefined;
+    // #1823: a notice from AgEnD itself (a poll's results) names its chat so the answer goes there, but its message id
+    // is AgEnD's own, not a platform message: there is nothing to react to.
+    if (meta.source === "agend-system")
+        return undefined;
     if (!chatId)
         return { chatId: "", messageId };
     const threadId = meta.thread_id || undefined;
@@ -1065,7 +1097,7 @@ export class BlockingProcessDetector {
 /** Response types the fleet sends back for tool calls the daemon forwarded. */
 const FLEET_RESPONSE_TYPES = new Set([
     "fleet_schedule_response", "fleet_outbound_response", "fleet_decision_response", "fleet_task_response",
-    "fleet_display_name_response", "fleet_description_response", "fleet_persona_emoji_response",
+    "fleet_display_name_response", "fleet_description_response", "fleet_persona_emoji_response", "fleet_web_theme_response",
 ]);
 export class Daemon extends EventEmitter {
     name;
@@ -3767,6 +3799,42 @@ export class Daemon extends EventEmitter {
             : Math.max(this.deliveryEpoch, fleetEpoch);
         this.logger.info({ deliveryEpoch: this.deliveryEpoch }, "Pending delivery queue cleared by user cancel");
     }
+    /** Board 907c7899: the layout a web /compact's end can be read from on this pane (kiro classic or TUI V2), or null. */
+    compactPaneUi() {
+        return this.backend?.compactPaneUi?.() ?? null;
+    }
+    /**
+     * Board 907c7899: follow a /compact written to this pane until the pane says how it ended, then say so once
+     * (`compact_pane_result`). Bound to the launch it was written under: another launch, or no pane, ends the look
+     * silently (the fleet's watch sees the launch change and calls it lost); the fleet's deadline is the same.
+     */
+    async followCompactPane(id, owner, follower) {
+        const tmux = this.tmux;
+        if (!tmux || owner === null)
+            return;
+        // Monotonic, and asked after every await: a result past the deadline is not said (the fleet's watch has timed out).
+        const deadline = performance.now() + COMPACT_WATCH_TIMEOUT_MS;
+        const standing = () => this.tmux === tmux && launchIdentity(this.interactionOwner()) === owner && performance.now() < deadline;
+        while (standing()) {
+            await new Promise(resolve => { setTimeout(resolve, KIRO_COMPACT_PANE_POLL_MS).unref?.(); });
+            if (!standing())
+                return;
+            let pane;
+            try {
+                pane = await tmux.capturePaneWithHistory(KIRO_COMPACT_PANE_LINES);
+            }
+            catch {
+                continue;
+            }
+            if (!standing())
+                return;
+            const outcome = follower.look(pane);
+            if (outcome) {
+                this.ipcServer?.broadcast({ type: "compact_pane_result", id, owner, outcome });
+                return;
+            }
+        }
+    }
     captureDeliveryEpoch(value) {
         const epoch = typeof value === "number" && Number.isSafeInteger(value) && value >= 0
             ? value
@@ -3778,21 +3846,55 @@ export class Daemon extends EventEmitter {
     isDeliveryEpochCurrent(epoch) {
         return epoch === this.deliveryEpoch;
     }
-    queueRawPaste(rawText, deliveryEpoch = this.deliveryEpoch, confirmClear = false, durableAttempt, ownSwitch) {
+    queueRawPaste(rawText, deliveryEpoch = this.deliveryEpoch, confirmClear = false, durableAttempt, ownSwitch, notifyWritten) {
         const reportSwitch = (result) => {
             if (!ownSwitch)
                 return;
             this.ipcServer?.broadcast({ type: "runtime_switch_result", id: ownSwitch.id, ...result });
         };
+        // Board 003648ac: the fleet follows a web /compact from just before its paste is written: the transcript's end then
+        // (taken here, under this launch, before the write) and the launch it was written under ride with the notice — once.
+        // The checkpoint and the launch are taken together, right before the paste (each attempt takes them again); the
+        // notice carries those — never the launch at notice time, which a respawn in between would relabel.
+        let told = false;
+        let checkpoint = null;
+        let owner = null;
+        // Board 907c7899: kiro says how a /compact ended only on its own pane; read from the pane just before this write.
+        let paneFollower = null;
+        const tellWritten = (written) => {
+            if (!notifyWritten || told)
+                return;
+            told = true;
+            this.ipcServer?.broadcast({ type: "raw_paste_written", id: notifyWritten, outcome: written ? "written" : "not_written",
+                ...(written ? { owner, checkpoint, ...(paneFollower ? { pane: true } : {}) } : {}) });
+            if (written && paneFollower)
+                void this.followCompactPane(notifyWritten, owner, paneFollower);
+        };
+        const takeCheckpoint = () => {
+            owner = launchIdentity(this.interactionOwner());
+            const path = this.logTranscriptPath();
+            checkpoint = null;
+            if (!path)
+                return;
+            try {
+                const st = statSync(path);
+                checkpoint = { path, ino: st.ino, size: st.size };
+            }
+            catch {
+                checkpoint = null;
+            }
+        };
         if (!this.tmux || !this.isDeliveryEpochCurrent(deliveryEpoch)) {
             if (durableAttempt)
                 this.retryDurableDeliveryBeforeBegin(durableAttempt, "raw_paste target unavailable before pane queue");
             reportSwitch({ outcome: "not_sent" });
+            tellWritten(false);
             return;
         }
         this.pasteLock = this.pasteLock.then(async () => {
             if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
                 reportSwitch({ outcome: "not_sent" });
+                tellWritten(false);
                 this.logger.info("Pending raw delivery dropped by user cancel");
                 if (durableAttempt)
                     this.retryDurableDeliveryBeforeBegin(durableAttempt, "raw_paste epoch changed while queued");
@@ -3805,8 +3907,16 @@ export class Daemon extends EventEmitter {
                     if (durableAttempt)
                         this.retryDurableDeliveryBeforeBegin(durableAttempt, "raw_paste epoch changed while waking");
                     reportSwitch({ outcome: "not_sent" }); // #1690: cancelled before anything was typed — said at once, nothing saved
+                    tellWritten(false);
                     return;
                 }
+                // Board 907c7899: the pane just before this attempt's paste — after its readiness wait, last capture and fence,
+                // under the paste lock (no other input lands in between). Each attempt looks again.
+                const lookBefore = async () => {
+                    const ui = this.backend?.compactPaneUi?.() ?? null;
+                    const before = ui ? await this.tmux?.capturePaneWithHistory(KIRO_COMPACT_PANE_LINES).catch(() => null) : null;
+                    paneFollower = ui && typeof before === "string" ? new KiroCompactPaneFollower(ui, before) : null;
+                };
                 const delivered = await this.deliverMessage(rawText, undefined, {
                     deliveryEpoch,
                     verdict,
@@ -3814,8 +3924,11 @@ export class Daemon extends EventEmitter {
                     preserveExactBytes: true,
                     // #1690: our own /model holds every other delivery from its write on — before the lock is released, so a steer
                     // or /btw waiting on it cannot type into the gap before claude paints "Switch model?" (default cursor: Yes).
-                    ...(ownSwitch ? { onPaneWritten: () => { this.ownSwitch = ownSwitch; } } : {}),
+                    ...(ownSwitch || notifyWritten ? { onPaneWritten: () => { if (ownSwitch)
+                            this.ownSwitch = ownSwitch; tellWritten(true); } } : {}),
+                    ...(notifyWritten ? { beforePaneWrite: takeCheckpoint, ...(this.backend?.compactPaneUi?.() ? { lookBeforePaneWrite: lookBefore } : {}) } : {}),
                 });
+                tellWritten(false); // never written (once told, this says nothing)
                 if (delivered)
                     this.finishDurableSubmission(durableAttempt ?? null, verdict);
                 else if (durableAttempt && verdict.paneWriteStarted) {
@@ -3852,6 +3965,7 @@ export class Daemon extends EventEmitter {
                         this.ownSwitch = null;
                     reportSwitch({ outcome: "not_confirmed" });
                 }
+                tellWritten(false);
                 return;
             }
             if (confirmClear)
@@ -3893,7 +4007,8 @@ export class Daemon extends EventEmitter {
         const sw = msg.runtime_switch;
         const ownSwitch = sw && typeof sw.id === "string" && sw.kind === "model" && typeof sw.requested === "string"
             ? { id: sw.id, kind: "model", requested: sw.requested } : undefined;
-        this.queueRawPaste(msg.content, this.captureDeliveryEpoch(msg.delivery_epoch), msg.confirm_clear === true, durableAttempt ? { ...durableAttempt, submissionMode: "raw_paste" } : undefined, ownSwitch);
+        const notifyWritten = typeof msg.notify_written === "string" && /^[0-9a-f]{16}$/.test(msg.notify_written) ? msg.notify_written : undefined;
+        this.queueRawPaste(msg.content, this.captureDeliveryEpoch(msg.delivery_epoch), msg.confirm_clear === true, durableAttempt ? { ...durableAttempt, submissionMode: "raw_paste", silentSchedule: msg.silent_schedule === true } : undefined, ownSwitch, notifyWritten);
     }
     /**
      * #1690 (the user's choice A): after AgEnD's own `/model <name>`, claude may ask "Switch model?" (a warm cache for
@@ -5332,8 +5447,9 @@ export class Daemon extends EventEmitter {
      * every delivery parked behind it. It recovers when the backend sees its own live, EMPTY composer with no busy, queued
      * or dialog marker (isStableUnknownLayoutIdlePane) AND the transcript shows no open turn — or, with no transcript to
      * ask, that same composer held unchanged for UNKNOWN_LAYOUT_STABLE_MS (#978's rule). An open turn never recovers.
+     * #1865: `hold` makes the closed-turn case wait out that window too (a `working` reading, recovered before the stuck deadline).
      */
-    recoverStuck(pane, snapshot, changeAt, turn) {
+    recoverStuck(pane, snapshot, changeAt, turn, hold = false) {
         const machine = this.instanceStateMachine;
         const idleComposer = this.backend?.isStableUnknownLayoutIdlePane?.(pane) === true;
         // The resume load (#1031: `Resuming session…` over the same composer) is input that is not open yet (#1641 R1).
@@ -5349,7 +5465,7 @@ export class Daemon extends EventEmitter {
             this.stuckRecoveryKey = key;
             this.stuckRecoverySince = mono;
         }
-        if (turn === "unknown" && mono - this.stuckRecoverySince < UNKNOWN_LAYOUT_STABLE_MS)
+        if ((turn === "unknown" || hold) && mono - this.stuckRecoverySince < UNKNOWN_LAYOUT_STABLE_MS)
             return snapshot;
         // A footer this build cannot read stays unreadable: the same still pane reads stuck again at every sweep and is
         // recovered again. Only the edge into idle is news.
@@ -5918,6 +6034,13 @@ export class Daemon extends EventEmitter {
             }
             if (snapshot.state === "stuck")
                 snapshot = this.recoverStuck(pane, snapshot, observedChangeAt, transcriptTurn);
+            // #1865: a resumed codex can paint its footer without the Context item (sol after the beta.13 restart), so its
+            // idle composer reads `working` for the whole stuck window. Its own rollout says no turn is open: the sweep needs
+            // no deadline for that — the same composer held still for UNKNOWN_LAYOUT_STABLE_MS is enough.
+            else if (snapshot.state === "working" && reason === "safety_sweep" && transcriptTurn === "closed"
+                && this.backend?.binaryName === "codex") {
+                snapshot = this.recoverStuck(pane, snapshot, observedChangeAt, transcriptTurn, true);
+            }
             this.applyInstanceStateSnapshot(snapshot, pane);
             // Backends without a transcript feed can still say what they are doing, if
             // their TUI names it. Free-riding on a capture that already happened: no
@@ -6957,7 +7080,7 @@ export class Daemon extends EventEmitter {
                     return stale();
                 if (residue !== "clear")
                     return this.failDelivery(verdict, status, "input-residue", residue);
-                const written = await this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status, opts?.submissionId, verdict, opts?.durableAttempt, opts?.steer === true, writeCurrent, opts?.humanVerificationId);
+                const written = await this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status, opts?.submissionId, verdict, opts?.durableAttempt, opts?.steer === true, writeCurrent, opts?.humanVerificationId, opts?.beforePaneWrite, opts?.lookBeforePaneWrite);
                 // #1690: still under the lock — whatever waits on it next must already see what this write started.
                 if (verdict.paneWriteStarted)
                     opts?.onPaneWritten?.();
@@ -8473,7 +8596,11 @@ export class Daemon extends EventEmitter {
     verdict = { reached: false }, durableAttempt, steer = false, 
     // #829: the caller's fence, asked once more after the last await before the
     // first side effect. Stale means unwritten: false, with no failure verdict.
-    stillCurrent, humanVerificationId) {
+    stillCurrent, humanVerificationId, 
+    // Board 003648ac: called synchronously right before each paste — after the last await and fence of that attempt.
+    beforePaste, 
+    // Board 907c7899: awaited each attempt after its last capture, begin and fence; the fence is asked again after it.
+    lookBeforePaste) {
         const signature = this.submissionSignature(formatted, humanVerificationId ?? submissionId, humanVerificationId !== undefined);
         const rawPaste = durableAttempt?.submissionMode === "raw_paste";
         const humanAttempt = verdict.humanReceipt;
@@ -8576,13 +8703,41 @@ export class Daemon extends EventEmitter {
                     }
                 }
             }
-            if (rawPaste)
+            if (lookBeforePaste) {
+                await lookBeforePaste();
+                // The look awaited: this attempt is still this write's — the same fence, tmux and launch — or nothing is written.
+                if (!steerCurrent()) {
+                    verdict.fenced = !verdict.durableBeginCommitted;
+                    return false;
+                }
+            }
+            if (rawPaste) {
                 verdict.paneWriteStarted = true;
+                // #1843: this write starts silent work even if its submission proof later stays uncertain.
+                // Retire the preceding human guard before the first write, not after proof: its idle callback must never
+                // turn a silent heartbeat into a channel reply or a reply-required recovery prompt. This may also retire a
+                // genuine missed human reply still awaiting confirmation/recovery; log that tradeoff instead of notifying.
+                if (durableAttempt?.silentSchedule) {
+                    this.clearReplyGuardConfirm();
+                    const previous = this.turnReplyGuard.snapshot();
+                    if (previous) {
+                        this.turnReplyGuard.complete(previous.generation);
+                        this.logger.info({
+                            correlationId: previous.target.correlationId ?? null,
+                            generation: previous.generation,
+                            phase: previous.phase,
+                            reason: "silent_schedule_delivery",
+                            deliveryId: durableAttempt.deliveryId,
+                        }, "Reply guard retired before silent schedule write");
+                    }
+                }
+            }
             // For raw commands the paste itself may alter the live composer. Treat a
             // failed/throwing write as uncertain rather than retrying bytes into the
             // same pane; the write-ahead Enter marker later separates safe pre-Enter
             // recovery from a possibly executed command.
             const pasteGeneration = this.spawnGeneration;
+            beforePaste?.();
             const pasted = await this.tmux.pasteBuffer(formatted);
             if (pasted)
                 this.rememberPaste(formatted, pasteGeneration);
@@ -9814,6 +9969,169 @@ export class Daemon extends EventEmitter {
             });
             return;
         }
+        // #1629: the caller's own web theme. set_web_theme_asset's file is read HERE, on the agent's side (in its working
+        // directory, no symlink, size-capped): the fleet receives bytes, never a workspace path.
+        if (Object.hasOwn(WEB_THEME_IPC, tool)) {
+            // Answered exactly once, whatever happens on the way (#1887 review: a throw here once left the call unanswered).
+            let answered = false;
+            const reply = (result, error) => { if (answered)
+                return; answered = true; respond(result, error); };
+            // One fleet request; resolves with its answer, or an error string (never rejects).
+            const ask = (payload) => new Promise((resolve) => {
+                const fleetReqId = `theme_${++this.fleetRequestSeq}_${requestId}`;
+                const timeout = setTimeout(() => {
+                    this.pendingIpcRequests.delete(fleetReqId);
+                    resolve({ result: null, error: `${tool} timed out` });
+                }, daemonBudgetMs(tool));
+                this.pendingIpcRequests.set(fleetReqId, (respMsg) => {
+                    clearTimeout(timeout);
+                    resolve({ result: respMsg.result, error: respMsg.error });
+                });
+                this.ipcServer?.broadcast({ type: WEB_THEME_IPC[tool], payload, meta: { instance_name: this.name }, fleetRequestId: fleetReqId });
+            });
+            void (async () => {
+                if (tool === "preview_web_appearance") {
+                    // The fleet builds the SVGs (whole, or in parts); they are written here, in the working directory.
+                    const first = await ask({ ...(args.modes !== undefined ? { modes: args.modes } : {}) });
+                    if (first.error) {
+                        reply(null, first.error);
+                        return;
+                    }
+                    let failed;
+                    const got = await receivePreview((first.result && typeof first.result === "object" ? first.result : {}), async (payload) => {
+                        const r = await ask(payload);
+                        if (r.error) {
+                            failed = r.error;
+                            return { error: r.error };
+                        }
+                        return (r.result && typeof r.result === "object" ? r.result : {});
+                    });
+                    if (failed) {
+                        reply(null, failed);
+                        return;
+                    }
+                    if ("error" in got) {
+                        reply(got, undefined);
+                        return;
+                    }
+                    const written = await writePreview(got.files, { workspace: this.config.working_directory, stateDir: getAgendHome() });
+                    if ("error" in written) {
+                        reply(null, `preview_web_appearance: ${written.error}`);
+                        return;
+                    }
+                    reply(written, undefined);
+                    return;
+                }
+                if (tool === "export_web_mod") {
+                    // The fleet builds the file (whole, or in parts); it is written here, in the working directory.
+                    const first = await ask(args);
+                    if (first.error) {
+                        reply(null, first.error);
+                        return;
+                    }
+                    let failed;
+                    const firstResult = (first.result && typeof first.result === "object" ? first.result : {});
+                    const got = await receiveFiles(firstResult, async (payload) => {
+                        const r = await ask(payload);
+                        if (r.error) {
+                            failed = r.error;
+                            return { error: r.error };
+                        }
+                        return (r.result && typeof r.result === "object" ? r.result : {});
+                    }, { name: MOD_FILE, idKey: "transfer", what: "export", maxParts: MOD_MAX_PARTS });
+                    if (failed) {
+                        reply(null, failed);
+                        return;
+                    }
+                    if ("error" in got) {
+                        reply(got, undefined);
+                        return;
+                    }
+                    const written = await writeModFile(got.files, { workspace: this.config.working_directory, stateDir: getAgendHome() });
+                    if ("error" in written) {
+                        reply(null, `export_web_mod: ${written.error}`);
+                        return;
+                    }
+                    reply({ ...written, ...(firstResult.effects_omitted ? { effects_omitted: firstResult.effects_omitted } : {}) }, undefined);
+                    return;
+                }
+                if (tool === "propose_web_mod") {
+                    const read = await readAgentFile(args.file, { workspace: this.config.working_directory, stateDir: getAgendHome(), maxBytes: MOD_UPLOAD_MAX_BYTES });
+                    const named = typeof args.file === "string" ? args.file.slice(0, 200) : "the file argument";
+                    if (!read.ok) {
+                        reply(null, `propose_web_mod: ${named} — ${read.reason}`);
+                        return;
+                    }
+                    let failed;
+                    const answer = await sendAssetInParts("mod", read.bytes, async (payload) => {
+                        const r = await ask(payload);
+                        if (r.error) {
+                            failed = r.error;
+                            return { error: r.error };
+                        }
+                        return (r.result && typeof r.result === "object" ? r.result : {});
+                    });
+                    reply(failed ? null : answer, failed);
+                    return;
+                }
+                if (tool === "upload_web_effect") {
+                    const owner = { fence: this.launchFenceEpoch, spawn: this.spawnGeneration, boot: this.bootId, ipc: this.ipcServer };
+                    const current = () => !!owner.ipc && owner.ipc === this.ipcServer && owner.fence === this.launchFenceEpoch && owner.spawn === this.spawnGeneration && owner.boot === this.bootId && !this.deliveryWritesStopping && !this.startupAborted;
+                    if (!current()) {
+                        reply(null, "upload_web_effect: launch no longer current");
+                        return;
+                    }
+                    const read = await readAgentEffect(args.dir, { workspace: this.config.working_directory, stateDir: getAgendHome() });
+                    if (!current()) {
+                        reply(null, "upload_web_effect: launch no longer current");
+                        return;
+                    }
+                    if (!read.ok) {
+                        reply(null, `upload_web_effect: ${read.reason}`);
+                        return;
+                    }
+                    let failed;
+                    const answer = await sendEffectInParts(read.files, async (payload) => {
+                        if (!current()) {
+                            failed = "upload_web_effect: launch no longer current";
+                            return { error: failed };
+                        }
+                        const r = await ask(payload);
+                        if (r.error) {
+                            failed = r.error;
+                            return { error: r.error };
+                        }
+                        return (r.result && typeof r.result === "object" ? r.result : {});
+                    });
+                    reply(failed ? null : answer, failed);
+                    return;
+                }
+                if (tool !== "set_web_theme_asset") {
+                    const r = await ask(args);
+                    reply(r.result, r.error);
+                    return;
+                }
+                const read = await readAgentFile(args.file, { workspace: this.config.working_directory, stateDir: getAgendHome(), maxBytes: WEB_THEME_ASSET_MAX_BYTES });
+                // The path as the agent gave it — only a string is shown (an object from raw JSON args is never coerced).
+                const named = typeof args.file === "string" ? args.file.slice(0, 200) : "the file argument";
+                if (!read.ok) {
+                    reply(null, `set_web_theme_asset: ${named} — ${read.reason}`);
+                    return;
+                }
+                // A picture larger than one IPC message goes up in parts (r4 §1: a card portrait may be megabytes).
+                let failed;
+                const answer = await sendAssetInParts(args.slot, read.bytes, async (payload) => {
+                    const r = await ask(payload);
+                    if (r.error) {
+                        failed = r.error;
+                        return { error: r.error };
+                    }
+                    return (r.result && typeof r.result === "object" ? r.result : {});
+                });
+                reply(failed ? null : answer, failed);
+            })().catch((err) => reply(null, `${tool} failed: ${err instanceof Error ? err.message : "error"}`));
+            return;
+        }
         if (tool === TASK_TOOL) {
             const fleetReqId = `task_${++this.fleetRequestSeq}_${requestId}`;
             const timeout = setTimeout(() => {
@@ -9994,6 +10312,11 @@ export class Daemon extends EventEmitter {
                 respond(null, `reply: ${buttons.error}`);
                 return;
             }
+            // #1823: a poll's results need the fleet's store and outbox; as text it would never close.
+            if (args.poll !== undefined && args.poll !== null) {
+                respond(null, "reply: a poll needs AgEnD's fleet; send the question without poll");
+                return;
+            }
             if (buttons) {
                 routed = { ...args, text: `${String(args.text)}\n\n${replyButtonsFallbackText(buttons.buttons)}` };
                 delete routed.buttons;
@@ -11208,6 +11531,11 @@ export class Daemon extends EventEmitter {
             this.logger.warn({ warning: launchWarning }, "Backend launch fell back");
             this.emit("backend_launch_warning", { name: this.name, message: launchWarning });
         }
+        // #1811: what the launch left out and why (an effort this CLI or model does not take) — the Log tab, not the chat.
+        for (const note of this.backend.consumeQuietLaunchNotes?.() ?? []) {
+            this.logger.info({ note }, "Launch note");
+            this.emit("backend_launch_warning", { name: this.name, message: note, quiet: true });
+        }
         // Ensure tmux session exists (may have been destroyed if all windows died)
         await TmuxManager.ensureSession(this.tmuxSessionName);
         if (this.stormWindow?.observeServerAlive(await TmuxManager.getServerPid(this.tmuxSessionName))) {
@@ -11914,16 +12242,29 @@ export class Daemon extends EventEmitter {
             respond(null, `Not a git repository: ${source}`);
             return;
         }
-        const repoDir = join(this.instanceDir, "repos");
-        mkdirSync(repoDir, { recursive: true });
-        const safeName = `${basename(source)}-${branch.replace(/\//g, "-")}`;
-        const worktreePath = join(repoDir, safeName);
+        mkdirSync(join(this.instanceDir, "repos"), { recursive: true });
+        // Only a fresh direct child of a real repos/ directory (never through a symlinked repos/, never an existing path).
+        const target = checkoutTarget(this.instanceDir, source, branch);
+        if (!target.ok) {
+            respond(null, `checkout_repo: ${target.reason}`);
+            return;
+        }
+        const worktreePath = target.path;
         try {
-            // Resolve branch/ref to verify it exists. Use `--` so git never treats
-            // branch as an option flag (defense in depth on top of the regex above).
-            await execFileAsync("git", ["rev-parse", "--verify", "--", branch], { cwd: source });
-            await execFileAsync("git", ["worktree", "add", "--detach", worktreePath, branch], { cwd: source });
+            // Resolve branch/ref to verify it exists. `--end-of-options` keeps git from ever reading branch as an option
+            // flag (defense in depth on top of the regex above). Not `--`: rev-parse then reads branch as a path, and
+            // `--verify` fails for every ref ("Needed a single revision"), which broke checkout_repo entirely.
+            await execFileAsync("git", ["rev-parse", "--verify", "--end-of-options", `${branch}^{commit}`], { cwd: source });
+            await execFileAsync("git", ["worktree", "add", "--detach", worktreePath, "--end-of-options", branch], { cwd: source });
             const { stdout: commitHash } = await execFileAsync("git", ["rev-parse", "--short", "HEAD"], { cwd: worktreePath });
+            // Recorded so release_repo can tell this instance's checkout of this repository from anything else.
+            try {
+                const { stdout: common } = await execFileAsync("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], { cwd: worktreePath });
+                const root = reposRoot(this.instanceDir);
+                if (root.ok)
+                    writeCheckouts(root.path, { ...readCheckouts(root.path), [worktreePath]: common.trim() });
+            }
+            catch { /* unrecorded: release still requires a listed linked worktree */ }
             respond({ path: worktreePath, branch, source, commit: commitHash.trim() });
         }
         catch (err) {
@@ -11931,26 +12272,50 @@ export class Daemon extends EventEmitter {
         }
     }
     async handleReleaseRepo(args, respond) {
-        const repoPath = args.path;
-        const reposDir = join(this.instanceDir, "repos");
-        // Safety: only allow releasing paths under our repos/ directory
-        if (!repoPath.startsWith(reposDir)) {
-            respond(null, `Cannot release path outside instance repos directory`);
+        // Containment first (real paths, strictly inside this instance's repos/), then proof it is a git worktree.
+        // Nothing that fails either check is ever removed.
+        const candidate = releaseCandidate(this.instanceDir, args.path);
+        if (!candidate.ok) {
+            respond(null, `Cannot release: ${candidate.reason}`);
             return;
         }
+        const root = reposRoot(this.instanceDir);
+        if (!root.ok) {
+            respond(null, `Cannot release: ${root.reason}`);
+            return;
+        }
+        const { execFile: execFileCb } = await import("node:child_process");
+        const { promisify } = await import("node:util");
+        const execFileAsync = promisify(execFileCb);
+        const git = async (gitArgs, cwd) => (await execFileAsync("git", gitArgs, { cwd })).stdout;
+        const worktree = await verifyWorktree(root.path, candidate.path, git);
+        if (!worktree.ok) {
+            respond(null, `Cannot release: ${worktree.reason}`);
+            return;
+        }
+        const repoPath = candidate.path;
         try {
-            const { execFile: execFileCb } = await import("node:child_process");
-            const { promisify } = await import("node:util");
-            const execFileAsync = promisify(execFileCb);
-            await execFileAsync("git", ["worktree", "remove", "--force", repoPath]);
+            await git(["--git-dir", worktree.commonDir, "worktree", "remove", "--force", repoPath], worktree.commonDir);
         }
         catch {
-            // Fallback: rm directly if git worktree remove fails
+            // Fallback for a verified worktree only: remove it, then let its repository forget it.
             try {
                 rmSync(repoPath, { recursive: true, force: true });
             }
             catch { /* best effort */ }
+            try {
+                await git(["--git-dir", worktree.commonDir, "worktree", "prune"], worktree.commonDir);
+            }
+            catch { /* best effort */ }
+        }
+        try {
+            const records = readCheckouts(root.path);
+            if (repoPath in records) {
+                delete records[repoPath];
+                writeCheckouts(root.path, records);
+            }
         }
+        catch { /* the worktree is gone; a stale record only refuses a later, different repo at this path */ }
         respond({ released: true, path: repoPath });
     }
     buildSnapshotPrompt() {