@songsid/agend 2.3.0-beta.16 → 2.3.0-beta.17

package/dist/diagnostic-redaction.d.ts

@@ -0,0 +1,10 @@
+/** Public diagnostic export boundary. Never use a privacy opt-in to disable credentials. */
+export declare const REDACTED = "[REDACTED]";
+export interface RedactionOptions {
+    keepIdentifiers?: boolean;
+}
+export declare function redactDiagnostics(input: string, options?: RedactionOptions): string;
+/** Log prose may itself be chat. Export only recognized diagnostics and stack locations. */
+export declare function diagnosticLine(line: string, options?: RedactionOptions): string | null;
+/** Unknown and arbitrary string fields are deliberately omitted, even inside nested objects. */
+export declare function diagnosticRecord(record: Record<string, unknown>, options?: RedactionOptions): string;

package/dist/diagnostic-redaction.js

@@ -0,0 +1,167 @@
+import { isIP } from "node:net";
+import { stripVTControlCharacters } from "node:util";
+import { constants as osConstants } from "node:os";
+/** Public diagnostic export boundary. Never use a privacy opt-in to disable credentials. */
+export const REDACTED = '[REDACTED]';
+const credentialKey = /(?:token|secret|password|passwd|credential|authorization|cookie|api[_-]?key|private[_-]?key|session|^code$|^state$)/i;
+const contentKey = /(?:^msg$|^host$|^ip$|message|content|prompt|text|body|conversation|transcript|topic|chat|user|sender|recipient|instance|channel|guild|email|hostname|address|url|path|argv|args)/i;
+const personalKey = /^(?:emails?|ip(?:v[46])?(?:address)?|host(?:name)?|user[_-]?name|path)$/i;
+const safeCodes = /\b(?:E[A-Z_]{3,30}|SIG[A-Z]{2,10}|ERR_[A-Z_]+)\b/g;
+const knownCodes = new Set([...Object.keys(osConstants.errno), ...Object.keys(osConstants.signals),
+    'EAI_AGAIN', 'EAI_NONAME', 'ERR_STREAM_DESTROYED', 'ERR_STREAM_PREMATURE_CLOSE', 'ERR_UNHANDLED_ERROR',
+    'ERR_HTTP_HEADERS_SENT', 'ERR_SOCKET_CLOSED', 'ERR_TLS_CERT_ALTNAME_INVALID', 'ERR_WORKER_OUT_OF_MEMORY',
+    'ERR_MODULE_NOT_FOUND', 'ERR_REQUIRE_ESM', 'ERR_DLOPEN_FAILED', 'ERR_INVALID_STATE']);
+const safePhrases = /Opening handshake has timed out|Connect Timeout Error|uncaught exception|unhandled rejection|gateway watchdog|MCP server died|web_terminal_created|adapter retry exhausted|out of memory|heap limit|allocation failed/gi;
+/** Decode common wrappers before matching; don't preserve encoded copies of credentials. */
+function decode(text) {
+    for (let pass = 0; pass < 4; pass++) {
+        const previous = text;
+        text = text.replace(/\\u([0-9a-f]{4})/gi, (_, n) => String.fromCharCode(parseInt(n, 16)))
+            .replace(/\\x([0-9a-f]{2})/gi, (_, n) => String.fromCharCode(parseInt(n, 16)))
+            .replace(/(?:%[0-9a-f]{2})+/gi, s => { try {
+            return decodeURIComponent(s);
+        }
+        catch {
+            return REDACTED;
+        } });
+        if (text === previous)
+            break;
+    }
+    // Ambiguous deeply encoded data is withheld, not partially decoded and exported.
+    return stripVTControlCharacters(text).replace(/(?:%[0-9a-f]{2})+/gi, REDACTED).replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f\u200b-\u200f\u202a-\u202e\u2060-\u206f\ufeff]/g, '');
+}
+/** A credential field can contain a whole object/list or YAML block, not just a string. */
+function redactContainers(text) {
+    const fields = /["']?[\w.-]{0,128}(?:token|secret|password|passwd|credential|authorization|cookie|session|api[_-]?key|private[_-]?key)[\w.-]{0,128}["']?\s*[:=]\s*/gi;
+    let cursor = 0, out = '', match;
+    while ((match = fields.exec(text))) {
+        const start = fields.lastIndex, opener = text[start];
+        if ((opener !== '{' && opener !== '[') || text.startsWith(REDACTED, start))
+            continue;
+        const stack = [], pairs = { '{': '}', '[': ']' };
+        let quote = '', escaped = false, end = text.length;
+        for (let i = start; i < text.length; i++) {
+            const c = text[i];
+            if (quote) {
+                if (escaped)
+                    escaped = false;
+                else if (c === '\\')
+                    escaped = true;
+                else if (c === quote)
+                    quote = '';
+                continue;
+            }
+            if (c === '"' || c === "'") {
+                quote = c;
+                continue;
+            }
+            if (pairs[c])
+                stack.push(pairs[c]);
+            else if (c === '}' || c === ']') {
+                if (stack.pop() !== c)
+                    break; // malformed container: withhold the rest
+                if (!stack.length) {
+                    end = i + 1;
+                    break;
+                }
+            }
+        }
+        out += text.slice(cursor, start) + REDACTED;
+        cursor = end;
+        fields.lastIndex = end;
+    }
+    text = out + text.slice(cursor);
+    return text.replace(/^([ \t]*["']?[\w.-]{0,128}(?:token|secret|password|passwd|credential|cookie|api[_-]?key)[\w.-]{0,128}["']?\s*:\s*)[>|][-+]?[^\r\n]*(?:\r?\n[ \t]+[^\r\n]*)*/gmi, '$1' + REDACTED);
+}
+export function redactDiagnostics(input, options = {}) {
+    // Whole structured values (including nested cookie/token objects) cannot be redacted safely token by token.
+    try {
+        const parsed = JSON.parse(input);
+        if (parsed && typeof parsed === 'object') {
+            const scrub = (value, depth) => {
+                if (depth > 16)
+                    return REDACTED;
+                if (typeof value === 'string')
+                    return redactDiagnostics(value, options);
+                if (Array.isArray(value))
+                    return value.map(v => scrub(v, depth + 1));
+                if (value && typeof value === 'object')
+                    return Object.fromEntries(Object.entries(value).map(([key, v]) => [redactDiagnostics(key, options), credentialKey.test(key) || (contentKey.test(key) && !(options.keepIdentifiers && personalKey.test(key))) ? REDACTED : scrub(v, depth + 1)]));
+                return value;
+            };
+            return JSON.stringify(scrub(parsed, 0));
+        }
+    }
+    catch { /* Free-form diagnostic/description, handled below. */ }
+    let text = redactContainers(decode(input));
+    text = text.replace(/-----BEGIN [^-\r\n]*(?:PRIVATE KEY|CERTIFICATE)-----[\s\S]*?(?:-----END [^-\r\n]+-----|$)/gi, REDACTED);
+    // Entire header values, including folded continuation lines; not just Bearer tokens.
+    text = text.replace(/\b(?:authorization|proxy-authorization|cookie|set-cookie)\s*:[^\r\n]*(?:\r?\n[ \t]+[^\r\n]*)*/gi, REDACTED);
+    // Quoted JSON/YAML/env/query credential values, including whitespace and multiline strings.
+    text = text.replace(/(["']?[\w.-]{0,128}(?:tokens?|secrets?|passwords?|passwd|credentials?[\w.-]{0,128}|authorization|cookies?|api[_-]?key|private[_-]?key|session(?:[_-]?(?:key|id))?)[\w.-]{0,128}["']?\s*[:=]\s*)(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\[REDACTED\]|[^\s,;&}\]\r\n]+)/gi, '$1' + REDACTED);
+    text = text.replace(/\b(?:Bearer|Basic)\s+[^\s,;"'<>]+/gi, REDACTED)
+        .replace(/\b(?:mfa\.[\w-]+|[\w-]{20,}\.[\w-]{6,}\.[\w-]{20,})\b/g, REDACTED)
+        .replace(/\b\d{5,}:[A-Za-z0-9_-]{15,}\b/g, REDACTED)
+        .replace(/\b(?:ya29\.[\w.-]+|1\/\/[\w.-]+|sk-[\w-]+|gh[pousr]_[\w]+|github_pat_[\w]+|xox[baprs]-[\w-]+|AKIA[A-Z0-9]{12,}|ASIA[A-Z0-9]{12,}|AIza[\w-]{20,}|npm_[\w]+|glpat-[\w-]+)\b/g, REDACTED)
+        .replace(/\beyJ[\w-]*\.[\w-]+\.[\w-]+\b/g, REDACTED)
+        .replace(/\b[a-z][a-z\d+.-]{0,127}:\/\/[^\s<>"']+/gi, REDACTED);
+    // Protect only recognized diagnostic locations/fields AFTER explicit credential rules.
+    // Do not treat scoped npm paths as emails, long module names as opaque tokens, or
+    // trusted line numbers/durations as chat IDs during the general privacy pass.
+    const kept = new Map();
+    const keep = (value) => { const marker = 'AGENDKEEP' + kept.size.toString(36) + 'Q'; kept.set(marker, value); return marker; };
+    const safePath = (value) => value.split(/[\\/]/).map(part => part.replace(/[A-Za-z0-9_+=]{24,}|\b\d{5,}\b/g, REDACTED)).join('/');
+    text = text.replace(/(?:…+)?(?:[a-z]:[\\/]|\/)[^\r\n<>"()]{0,512}?@songsid[\\/]agend[\\/]((?:[@\w.-]+[\\/]){0,12}[\w.-]+\.(?:[cm]?js|ts)):(\d{1,7}):(\d{1,7})/gi, (_all, relative, line, column) => keep('…/@songsid/agend/' + safePath(relative) + ':' + line + ':' + column))
+        .replace(/\bnode:([a-z_]+(?:\/[\w.-]+){0,12}):(\d{1,7}):(\d{1,7})/g, (_all, relative, line, column) => keep('node:' + safePath(relative) + ':' + line + ':' + column))
+        .replace(/"(?:duration|durationMs|attempt|exitCode|statusCode)"\s*:\s*-?\d{1,24}(?:\.\d{1,12})?(?:e[+-]?\d{1,3})?/gi, keep);
+    text = text
+        // Opaque unknown keys and unlabelled IDs. Over-redaction is intentional.
+        .replace(/[A-Za-z0-9_+/=-]{24,}/g, REDACTED)
+        .replace(/\b\d{5,}\b/g, REDACTED)
+        .replace(/[\"']?\b[\w.-]{0,128}(?:topic|chat|user|sender|recipient|instance|channel|guild)[_-]?id[\"']?\s*[=:]\s*(?:\[REDACTED\]|[^\s,;]+)/gi, REDACTED)
+        .replace(/\b(?:message|content|prompt|chat[_-]?text)\s*[=:]\s*[^\r\n]*/gi, REDACTED);
+    if (!options.keepIdentifiers) {
+        text = text.replace(/[^\s@<>"'(),;\[\]\\/:]{1,320}@[^\s@<>"'(),;\[\]\\/:]{1,320}/gu, REDACTED)
+            .replace(/(?:\b\d{1,3}\.){3}\d{1,3}\b/g, REDACTED)
+            .replace(/\[?[a-f\d:.]{0,64}:[a-f\d:.]{1,64}(?:%[\w.-]{1,64})?\]?/gi, value => isIP(value.replace(/^\[|\]$/g, '').split('%')[0]) === 6 ? REDACTED : value)
+            .replace(/(?<![\p{L}\p{N}_-])[\p{L}\p{N}-][\p{L}\p{N}.-]{0,252}\.[\p{L}][\p{L}\p{N}-]{0,62}(?![\p{L}\p{N}_-])/gu, value => /\.(?:ya?ml|json|log|[cm]?js|tsx?|md|txt|sh|ps1)$/i.test(value) || /^(?:e\.g|i\.e)$/i.test(value) ? value : REDACTED)
+            .replace(/(\/(?:home|Users|mnt\/[a-z]\/Users)\/)[^\/\s]+/gi, '$1' + REDACTED)
+            .replace(/([a-z]:\\Users\\)[^\\\s]+/gi, '$1' + REDACTED)
+            .replace(/[\"']?\b(?:host(?:name)?|user(?:name)?)[\"']?\s*[=:]\s*(?:\[REDACTED\]|[^\s,;]+)/gi, REDACTED);
+    }
+    return text.replace(/AGENDKEEP[0-9a-z]+Q/g, value => kept.get(value) ?? value);
+}
+/** Log prose may itself be chat. Export only recognized diagnostics and stack locations. */
+export function diagnosticLine(line, options = {}) {
+    const codes = [...new Set((line.match(safeCodes) ?? []).filter(code => knownCodes.has(code)))];
+    const phrases = [...new Set(line.match(safePhrases) ?? [])];
+    const stack = line.match(/^\s*at\s+(?:[\w.$<>]+\s+)?\(?((?:\/|[a-z]:\\|node:)[^\r\n]*?:\d+:\d+)\)?\s*$/i);
+    if (stack)
+        return redactDiagnostics('at ' + stack[1], options);
+    const diagnostic = [...phrases, ...codes].join('; ');
+    return diagnostic ? redactDiagnostics(diagnostic, options) : null;
+}
+/** Unknown and arbitrary string fields are deliberately omitted, even inside nested objects. */
+export function diagnosticRecord(record, options = {}) {
+    const out = {};
+    for (const [key, value] of Object.entries(record)) {
+        if (credentialKey.test(key) || contentKey.test(key))
+            continue;
+        if (/^(?:level|duration|durationMs|attempt|exitCode|statusCode)$/.test(key) && typeof value === 'number')
+            out[key] = value;
+        if (/^(?:backend|runtime)$/.test(key) && typeof value === 'string' && /^(?:claude-code|codex|kiro-cli|opencode|grok|muse|antigravity|node)$/.test(value))
+            out[key] = value;
+        if (/^(?:version|cliVersion|backendVersion)$/.test(key) && typeof value === 'string' && /^\d{1,3}\.\d{1,3}\.\d{1,3}(?:-[a-z]+\.\d{1,3})?$/.test(value))
+            out[key] = value;
+        if (key === 'err' || key === 'error') {
+            const error = value && typeof value === 'object' ? value : { message: value };
+            const lines = Object.values(error).filter((s) => typeof s === 'string').flatMap(s => s.split('\n'));
+            out.error = lines.map(l => diagnosticLine(l, options)).filter(Boolean).join('\n') || '[Free-form error details withheld]';
+        }
+    }
+    // msg is inspected for canonical diagnostics, never exported as raw prose.
+    if (typeof record.msg === 'string')
+        out.diagnostic = diagnosticLine(record.msg, options) ?? '[Free-form log text withheld]';
+    return JSON.stringify(out);
+}
+//# sourceMappingURL=diagnostic-redaction.js.map

package/dist/diagnostic-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostic-redaction.js","sourceRoot":"","sources":["../src/diagnostic-redaction.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AACnD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAGrC,MAAM,aAAa,GAAG,sHAAsH,CAAC;AAC7I,MAAM,UAAU,GAAG,mLAAmL,CAAC;AACvM,MAAM,WAAW,GAAG,0EAA0E,CAAC;AAC/F,MAAM,SAAS,GAAG,mDAAmD,CAAC;AACtE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;IAChG,WAAW,EAAE,YAAY,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,qBAAqB;IACtG,uBAAuB,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,0BAA0B;IACxG,sBAAsB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AACxF,MAAM,WAAW,GAAG,yNAAyN,CAAC;AAE9O,4FAA4F;AAC5F,SAAS,MAAM,CAAC,IAAY;IAC1B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC;QACtB,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;aAC9F,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;aACrF,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC;YAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,QAAQ,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7G,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM;IAC/B,CAAC;IACD,iFAAiF;IACjF,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,8FAA8F,EAAE,EAAE,CAAC,CAAC;AAC7L,CAAC;AAED,2FAA2F;AAC3F,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,sJAAsJ,CAAC;IACtK,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,GAAG,EAAE,EAAE,KAA6B,CAAC;IACxD,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC;YAAE,SAAS;QACrF,MAAM,KAAK,GAAa,EAAE,EAAE,KAAK,GAA2B,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QACnF,IAAI,KAAK,GAAG,EAAE,EAAE,OAAO,GAAG,KAAK,EAAE,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;QACnD,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,IAAI,KAAK,EAAE,CAAC;gBAAC,IAAI,OAAO;oBAAE,OAAO,GAAG,KAAK,CAAC;qBAAM,IAAI,CAAC,KAAK,IAAI;oBAAE,OAAO,GAAG,IAAI,CAAC;qBAAM,IAAI,CAAC,KAAK,KAAK;oBAAE,KAAK,GAAG,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC7H,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,KAAK,GAAG,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACpD,IAAI,KAAK,CAAC,CAAC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;iBAC9B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBAChC,IAAI,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC;oBAAE,MAAM,CAAC,yCAAyC;gBACvE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;oBAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;oBAAC,MAAM;gBAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC;QAC5C,MAAM,GAAG,GAAG,CAAC;QAAC,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC;IACvC,CAAC;IACD,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,gKAAgK,EAAE,IAAI,GAAG,QAAQ,CAAC,CAAC;AACzM,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,UAA4B,EAAE;IAC7E,4GAA4G;IAC5G,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,KAAa,EAAW,EAAE;gBACvD,IAAI,KAAK,GAAG,EAAE;oBAAE,OAAO,QAAQ,CAAC;gBAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,OAAO,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACxE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;oBAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;gBACrE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,eAAe,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzR,OAAO,KAAK,CAAC;YACf,CAAC,CAAC;YACF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,sDAAsD,CAAC,CAAC;IAClE,IAAI,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,6FAA6F,EAAE,QAAQ,CAAC,CAAC;IAC7H,qFAAqF;IACrF,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,iGAAiG,EAAE,QAAQ,CAAC,CAAC;IACjI,4FAA4F;IAC5F,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,wQAAwQ,EAAE,IAAI,GAAG,QAAQ,CAAC,CAAC;IAC/S,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,qCAAqC,EAAE,QAAQ,CAAC;SACjE,OAAO,CAAC,wDAAwD,EAAE,QAAQ,CAAC;SAC3E,OAAO,CAAC,gCAAgC,EAAE,QAAQ,CAAC;SACnD,OAAO,CAAC,4KAA4K,EAAE,QAAQ,CAAC;SAC/L,OAAO,CAAC,gCAAgC,EAAE,QAAQ,CAAC;SACnD,OAAO,CAAC,2CAA2C,EAAE,QAAQ,CAAC,CAAC;IAClE,uFAAuF;IACvF,kFAAkF;IAClF,8EAA8E;IAC9E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAU,EAAE,GAAG,MAAM,MAAM,GAAG,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/I,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,iCAAiC,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClJ,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,4IAA4I,EAC9J,CAAC,IAAI,EAAE,QAAgB,EAAE,IAAY,EAAE,MAAc,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,MAAM,CAAC,CAAC;SACpI,OAAO,CAAC,0DAA0D,EACjE,CAAC,IAAI,EAAE,QAAgB,EAAE,IAAY,EAAE,MAAc,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,MAAM,CAAC,CAAC;SAC1H,OAAO,CAAC,2GAA2G,EAAE,IAAI,CAAC,CAAC;IAC9H,IAAI,GAAG,IAAI;QACT,yEAAyE;SACxE,OAAO,CAAC,wBAAwB,EAAE,QAAQ,CAAC;SAC3C,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC;SAChC,OAAO,CAAC,oIAAoI,EAAE,QAAQ,CAAC;SACvJ,OAAO,CAAC,gEAAgE,EAAE,QAAQ,CAAC,CAAC;IACvF,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QAC7B,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,+DAA+D,EAAE,QAAQ,CAAC;aAC3F,OAAO,CAAC,8BAA8B,EAAE,QAAQ,CAAC;aACjD,OAAO,CAAC,2DAA2D,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;aACzJ,OAAO,CAAC,uGAAuG,EAAE,KAAK,CAAC,EAAE,CAAC,mDAAmD,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;aAC/O,OAAO,CAAC,kDAAkD,EAAE,IAAI,GAAG,QAAQ,CAAC;aAC5E,OAAO,CAAC,6BAA6B,EAAE,IAAI,GAAG,QAAQ,CAAC;aACvD,OAAO,CAAC,oFAAoF,EAAE,QAAQ,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC;AACjF,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,UAA4B,EAAE;IACzE,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,+EAA+E,CAAC,CAAC;IAC1G,IAAI,KAAK;QAAE,OAAO,iBAAiB,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAAC,MAA+B,EAAE,UAA4B,EAAE;IAC9F,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAC9D,IAAI,6DAA6D,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC3H,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,sEAAsE,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC3K,IAAI,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,kDAAkD,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACzK,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACzG,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACjH,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,oCAAoC,CAAC;QAC5H,CAAC;IACH,CAAC;IACD,2EAA2E;IAC3E,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAAE,GAAG,CAAC,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,+BAA+B,CAAC;IAC5H,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC"}

package/dist/fleet-manager.d.ts

@@ -76,6 +76,7 @@ import { AgentMods } from "./web-mod-agent.js";
 import { type CachedImage } from "./web-images.js";
 import { WebSettingsTools } from "./web-settings-tools.js";
 import { type Delegation, type TrafficItem } from "./fleet-traffic.js";
+import { WebBackendLogins, type SignInTarget } from "./web-backend-login.js";
 import { type RawConfigPatch } from "./settings-api.js";
 import { type AgentEndpointContext } from "./agent-endpoint.js";
 import { ClassicChannelManager } from "./classic-channel-manager.js";
@@ -3057,6 +3058,23 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     private readonly loginWindow;
     private get webLogin();
+    /** #2233: sign-ins started from the web dashboard (local admin sessions), on the same controller as chat's. */
+    private webBackendLoginsInstance;
+    get webBackendLogins(): WebBackendLogins;
+    /** #2233: the login a paused-for-sign-in instance needs, when the dashboard can sign it in. */
+    private signInFor;
+    /**
+     * #2233: Settings → Agents' sign-in list — every backend's default login as the availability snapshot has it, then
+     * each credential profile an agent uses (its own login state, read offline).
+     */
+    backendSignInTargets(): SignInTarget[];
+    /** #2233: the session with this handle is live, admin, local and of the current dashboard token. */
+    private isLocalAdminSession;
+    /**
+     * #2233: `/login` for a dashboard requester. The same controller and checks; a CLI that is not installed is refused
+     * with its install command (chat's install-first runs a terminal of its own, which the dashboard does not offer).
+     */
+    private startWebDashboardLogin;
     /**
      * Post the backend chooser for a bare `/login`. Caller enforces admin.
      * Returns why the chooser could not be posted, for the caller to tell the

package/dist/fleet-manager.js

@@ -190,6 +190,7 @@ import { installedChannel, updateNoticeKey } from "./update-check.js";
 import { resolveInstalledAgend } from "./update-dispatch.js";
 import { resolveUpdateLaunch, openUpdateLog, updateLogPath, watchUpdateLaunch } from "./update-launch.js";
 import { admitProfileLogin, LoginController, LOGIN_TOKEN_RESEND_PREFIX, POST_LOGIN_RECOVERY_DEADLINE_MS } from "./login-controller.js";
+import { WebBackendLogins, dashboardSignInSupported } from "./web-backend-login.js";
 import { runBeforeDeadline } from "./deadline.js";
 import { LoginWindowLock } from "./login-window-lock.js";
 import { handleSettingsRequest } from "./settings-api.js";
@@ -248,7 +249,7 @@ import { PROVIDER_SECRET_SPECS, providerSecretSpec, providerRegistryEnvKeys, isR
 /** A self-restart is a whole service restart; 120s is the apply budget, not this. */
 const SELF_RESTART_DEADLINE_MS = 300_000;
 import { APPLY_FLEET_TARGET, ApplyJobStore, viewOf, } from "./apply-job.js";
-import { CHAT_PROFILE_LOGIN_BACKENDS, credentialHomeSpec, credentialProfileHome, credentialProfileLogin, credentialProfileStoreHome, credentialSwitchCarriesConversation, credentialSwitchStartsFresh, instanceCredentialProfile } from "./backend/credential-profile.js";
+import { CHAT_PROFILE_LOGIN_BACKENDS, credentialHomeSpec, credentialProfileHome, credentialProfileLogin, credentialProfileLoginCommand, credentialProfileStoreHome, credentialSwitchCarriesConversation, credentialSwitchStartsFresh, instanceCredentialProfile } from "./backend/credential-profile.js";
 import { carryClaudeConversation } from "./backend/claude-carry.js";
 import { mergeBackendOptions, profileKey, profileName, profileOf } from "./classic-bindings.js";
 import { classifyInstanceChange, CLASSIC_HOT_CONFIG_KEYS, HOT_INSTANCE_CONFIG_KEYS, hotConfigUpdate, } from "./instance-config-impact.js";
@@ -261,6 +262,14 @@ import { SpawnGate } from "./spawn-gate.js";
 import { BackendOutageTracker } from "./backend-outage.js";
 import { canUnlockAdvancedTips, DailyTipScheduler, selectTip, visibleTipLevels, } from "./tips.js";
 import { getTmuxSession } from "./config.js";
+// Closed migration cohort: these 11 names existed immediately before the first
+// managed-skill publisher (a1ac499f; parent e267e684). Never grow this set when
+// adding a bundled skill: its new name is not proof of old AgEnD ownership.
+const PRE_MANIFEST_KIRO_SKILLS = new Set([
+    "backend-providers", "cross-instance-messaging", "fleet-config", "fleet-health",
+    "fleet-restart", "instance-lifecycle", "model-discovery", "multi-channel",
+    "scheduling", "session-management", "tui-effort",
+]);
 export function resolveReplyThreadId(argsThreadId, instanceConfig) {
     if (typeof argsThreadId === "string" && argsThreadId.length > 0) {
         return argsThreadId;
@@ -7384,6 +7393,10 @@ export class FleetManager {
             // operation so an older stop never reports. No pending operation means
             // a plain boot — nothing was stopped by an operation, report nothing.
             const backgroundWorkEndedNames = this.collectBackgroundWorkEndedNames(configuredNames, pendingUpdateProgress?.startedAt ?? null);
+            // #2264: an update whose fleet comes back on another version did not land — say so in its final message (the
+            // version it aimed for, the one running, and the one repair), never just "updated".
+            const aimedAt = pendingProgressOperation === "update" ? pendingUpdateProgress?.progress.version : undefined;
+            const notLanded = aimedAt && agendVersion !== "unknown" && aimedAt !== agendVersion ? t("update.not_landed", aimedAt, agendVersion) : null;
             const completionSummary = {
                 running: started,
                 total,
@@ -7393,7 +7406,7 @@ export class FleetManager {
                 backgroundWorkEndedNames,
                 ...(cleanupOutcome && "render" in cleanupOutcome
                     ? { warningText: cleanupOutcome.render.warning, warningCommand: cleanupOutcome.render.cleanupCommand }
-                    : {}),
+                    : notLanded ? { warningText: notLanded } : {}),
             };
             const progressCompleted = await startupProgress.finish(completionSummary);
             // Armed only after the completion posted: an append racing ahead of it would be overwritten by it.
@@ -13469,6 +13482,7 @@ export class FleetManager {
                 interactionSummary: p.interaction_summary ?? null,
                 pauseReason, pausedAt,
                 crashedAt: crashed ? (this.needsCrashedAt.get(name) ?? null) : null,
+                signIn: pauseReason === "auth" ? this.signInFor(name) : null,
             });
         }
         return out;
@@ -14179,7 +14193,7 @@ export class FleetManager {
                 const current = this.resolveInstanceEffort(instance).effort;
                 return { current, options: levels.map(l => ({ id: l, label: this.effortChoiceLabel(l, current) })) };
             },
-            backendStep: async (instance, args) => {
+            backendStep: async (instance, args, stepOpts) => {
                 const refusal = this.backendCommandRefusal(instance);
                 if (refusal)
                     return { error: refusal };
@@ -14189,7 +14203,13 @@ export class FleetManager {
                     return step.noop ? { text: step.text } : { error: step.text };
                 if (step.kind === "choose") {
                     const id = (token) => joinBackendArgs([...step.args, token]);
-                    return { choices: { prompt: step.text, current: step.current === null ? null : id(step.current), options: step.choices.map(c => ({ id: id(c.token), label: c.label, ...(c.disabled ? { disabled: c.disabled } : {}) })) } };
+                    return { choices: { prompt: step.text, current: step.current === null ? null : id(step.current), options: step.choices.map(c => {
+                                // #2233: the web offers Sign in beside it, so its reason is no longer "use /login".
+                                // Not over the public link: Sign in is refused there, so the choice keeps its "(use /login)" (#2262 review).
+                                const signIn = c.signIn && !stepOpts?.publicLink && dashboardSignInSupported(c.signIn) ? c.signIn : null;
+                                const disabled = signIn ? t("backend.reason_not_signed_in_web") : c.disabled;
+                                return { id: id(c.token), label: signIn ? `${c.token} — ${disabled}` : c.label, ...(disabled ? { disabled } : {}), ...(signIn ? { signIn } : {}) };
+                            }) } };
                 }
                 const now = performance.now();
                 for (const [k, v] of this.webBackendTokens)
@@ -15353,6 +15373,86 @@ export class FleetManager {
         }
         return this.loginController;
     }
+    /** #2233: sign-ins started from the web dashboard (local admin sessions), on the same controller as chat's. */
+    webBackendLoginsInstance = null;
+    get webBackendLogins() {
+        this.webBackendLoginsInstance ??= new WebBackendLogins({
+            isLocalAdmin: handle => this.isLocalAdminSession(handle),
+            start: (backend, chat, opts) => this.startWebDashboardLogin(backend, chat, opts),
+            accessToken: sink => this.loginController?.webAccessToken(sink) ?? null,
+            isActiveFor: sink => this.loginController?.isActiveFor(sink) ?? false,
+            cancelFor: sink => this.loginController?.cancelFor(sink) ?? Promise.resolve(false),
+            cancel: () => this.cancelLoginSession(),
+            notice: ({ shown, label, handle }) => this.notifyFleetError(t("login.web_dashboard_notice", shown, label, handle.slice(0, 8))),
+            // No details in the event: each page reads its own view (GET /ui/backend-login), as its session may see it.
+            changed: () => broadcastSseEvent(this.sseClients, "backend_login", {}, err => this.logger.debug({ err }, "backend_login event failed")),
+        });
+        return this.webBackendLoginsInstance;
+    }
+    /** #2233: the login a paused-for-sign-in instance needs, when the dashboard can sign it in. */
+    signInFor(name) {
+        const backend = this.backendNameForInstance(name);
+        const profile = this.credentialProfileOf(name, backend);
+        return dashboardSignInSupported(backend, profile) ? { backend, ...(profile ? { profile } : {}) } : null;
+    }
+    /**
+     * #2233: Settings → Agents' sign-in list — every backend's default login as the availability snapshot has it, then
+     * each credential profile an agent uses (its own login state, read offline).
+     */
+    backendSignInTargets() {
+        const out = [];
+        for (const row of this.backendAvailabilityRows()) {
+            const flow = LOGIN_FLOWS[row.backend];
+            const install = BACKEND_INSTALLATION_INFO[row.backend]?.install;
+            out.push({
+                // Not installed or too old: signing in would not help — the row says how to install (or update) it instead.
+                backend: row.backend, state: row.state, signIn: row.state !== "not_installed" && row.state !== "too_old" && dashboardSignInSupported(row.backend),
+                ...(flow?.remoteLogin === "unsupported" ? { hostCommand: flow.command } : {}),
+                ...(row.state === "not_installed" && install ? { install } : {}),
+                ...(row.state === "too_old" && install ? { update: install } : {}),
+            });
+        }
+        const seen = new Set();
+        for (const name of Object.keys(this.fleetConfig?.instances ?? {}).sort()) {
+            const backend = this.backendNameForInstance(name);
+            const profile = this.credentialProfileOf(name, backend);
+            if (!profile || seen.has(`${backend}\0${profile}`))
+                continue;
+            seen.add(`${backend}\0${profile}`);
+            let login = "unknown";
+            try {
+                login = credentialProfileLogin(this.dataDir, backend, profile).state;
+            }
+            catch { /* unknown */ }
+            const signIn = dashboardSignInSupported(backend, profile);
+            const hostCommand = signIn ? null : credentialProfileLoginCommand(this.dataDir, backend, profile);
+            out.push({ backend, profile, state: login === "logged-in" ? "usable" : login === "signed-out" ? "not_signed_in" : "unknown", signIn,
+                ...(hostCommand ? { hostCommand } : {}) });
+        }
+        return out;
+    }
+    /** #2233: the session with this handle is live, admin, local and of the current dashboard token. */
+    isLocalAdminSession(handle) {
+        const sessions = this.webSessions, token = this.webToken;
+        const record = sessions?.findByHandle(handle);
+        return !!record && !!token && record.tier === "admin" && record.surface === "local" && sessions.isCurrent(record, tokenEpoch(token));
+    }
+    /**
+     * #2233: `/login` for a dashboard requester. The same controller and checks; a CLI that is not installed is refused
+     * with its install command (chat's install-first runs a terminal of its own, which the dashboard does not offer).
+     */
+    startWebDashboardLogin(backendArg, chat, opts) {
+        const wanted = LOGIN_BACKEND_ALIASES[backendArg.toLowerCase()] ?? backendArg.toLowerCase();
+        if (isRemovedBackend(wanted))
+            return Promise.resolve(removedBackendMessage(wanted));
+        const info = BACKEND_INSTALLATION_INFO[wanted];
+        if (info && LOGIN_FLOWS[wanted]?.remoteLogin !== "unsupported" && !this.isCliInstalled(wanted)) {
+            return Promise.resolve(t("login.web_dashboard_not_installed", wanted, info.install));
+        }
+        if (!opts.skipAuthCheck)
+            this.recordLoginFlow(wanted, "login", chat.userId);
+        return this.webLogin.start(backendArg, chat, opts);
+    }
     /**
      * Post the backend chooser for a bare `/login`. Caller enforces admin.
      * Returns why the chooser could not be posted, for the caller to tell the
@@ -16089,6 +16189,7 @@ export class FleetManager {
                 links: m.links,
                 channel: m.channel,
                 from: m.from,
+                replyTo: m.replyTo,
             });
             broadcastSseEvent(this.sseClients, event, recorded, onError, this.webChatHistory.cursorOf(recorded));
             // #1629: live-only receipt after the recorded agent reply. Never persist/replay it or give it an SSE cursor.
@@ -16435,16 +16536,16 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             .filter(name => existsSync(join(srcSkills, name, "SKILL.md")))
             .sort();
         // Pre-manifest Kiro General copied bundled skills directly into
-        // .kiro/skills. If every existing skill is still a bundled name, this is
-        // the unambiguous legacy layout: adopt it once, update it below, and write
-        // the ownership manifest. Any extra skill name keeps the directory fully
+        // .kiro/skills. If every existing skill is still bundled AND belongs to
+        // the closed pre-manifest cohort, adopt it once, update it below, and
+        // write the ownership manifest. Any extra skill name keeps the directory fully
         // on the user-owned/collision path.
         if (!hadManifest && adoptLegacyUnmanaged) {
             const existing = readdirSync(destSkills, { withFileTypes: true })
                 .filter(entry => entry.isDirectory() && existsSync(join(destSkills, entry.name, "SKILL.md")))
                 .map(entry => entry.name)
                 .sort();
-            if (existing.length > 0 && existing.every(name => bundled.includes(name))) {
+            if (existing.length > 0 && existing.every(name => bundled.includes(name) && PRE_MANIFEST_KIRO_SKILLS.has(name))) {
                 previouslyManaged = existing;
                 this.logger.info({ skills: existing, destSkills }, "Adopted legacy AgEnD skills into managed ownership");
             }