@songsid/agend 2.3.1 → 2.3.2-beta.2

package/dist/general-knowledge/skills/web-dashboard/SKILL.md

@@ -34,7 +34,7 @@ For how *you* look on the dashboard (theme, identity card, colour, widgets, ambi
 | subscription meters, plan badges, profiles, keep-warm, prompt cache | [Usage and the cache report](#usage-and-the-cache-report) |
 | what an agent did step by step | [The Log tab](#the-log-tab) |
 | any Settings control | [Settings](#settings) |
-| themes, cards, widgets, ambient effects (petals, click stars), effects, mods | [Web appearance](#web-appearance) |
+| themes, cards, widgets, ambient effects (petals, click stars), effects, mods | [Look](#look) |
 | blank page, preview refused, link fails, signed out, "live" missing | [Troubleshooting](#troubleshooting) |
 
 Addresses: the dashboard is served on the host at `http://localhost:<health_port>` (default 19280), on 127.0.0.1
@@ -66,7 +66,7 @@ hostname (named tunnel, `web.public_link.hostname`) the minutes go up to 10080,
 `web.public_link.auto_open` reopens the link after AgEnD starts for the admin who last opened it (nothing posted; sign-in
 still needs a code).
 Close it with **Close public link** → **Close link (signs public browsers out)**, `/web revoke`, or let it expire.
-A public link is limited on purpose: no live stream (the page polls), no custom CSS, and Settings → Web, appearance,
+A public link is limited on purpose: no live stream (the page polls), no custom CSS, and Settings → Access & security, Look,
 mods, effect-library/personal-selection management, schedule edits and preference writes are refused. Current in-scope
 Chat effect metadata/code reads are allowed, with session/epoch/exposure checks; the public viewer’s show switch is browser-local. HTML previews work over it through a second tunnel
 of their own (`web.preview_on_public_link`, default on).
@@ -86,14 +86,24 @@ the local address sees every instance's live terminal and the roster (status, co
 tags, name, description, avatars, cards) and the usage meters — read only; editing says "Sign in to edit". Over a
 public link `/view` always needs sign-in.
 
-**Guests (#1920).** Off by default: `web.guests.enabled` (or Settings → Web → Guests). Then someone who is
-not a fleet admin sends `/web` and gets a code privately, signing in as their own Discord or Telegram account. A guest
-sees only the agents they can already use in chat: their connection's fleet topics and General (an `open` connection:
-only `web.guests.open_instances`), their own Telegram private ClassicBot room, and ClassicBot group rooms while their
-membership is verified, minus any `web.guests.narrow`. They can chat there unless `web.guests.chat` is false, never send
-a command (text starting with `/` is refused), and the agent sees them as `via web (guest)`. A guest's app has no Fleet,
-View, Settings or Needs you. To invite someone: turn it on, then tell them to send `/web`. The Guests card is not in
-Settings over the public link.
+**Guests (#1920, #2348).** Off by default: `web.guests.enabled` (or Settings → Access & security → Guests). Then someone
+who is not a fleet admin gets a code privately, by sending `/web` or from an admin's **Send sign-in code**, and signs in
+as their own Discord or Telegram account. What a guest sees:
+- **With explicit grants** (`web.guests.grants`, set in Settings → Access & security → Guests): exactly the agents an
+  admin granted that person, nothing else (default deny once the key exists). The admin picks the person from people
+  AgEnD has seen writing to an agent, ticks their agents, saves (giving access or more agents waits for a fleet admin in
+  General; taking away applies at once and ends their sessions), then presses **Send sign-in code**, a DM, never a post.
+  Each code sent and each change to someone's access is in the event log (`guest_code_sent`, `guest_grant_changed`),
+  shown to admins under **Recent changes** in that section (no agent's Log tab shows them).
+- **Without grants** (before an admin saves the first one): the agents they can already use in chat: their connection's
+  fleet topics and General (an `open` connection: only `web.guests.open_instances`), their own Telegram private
+  ClassicBot room, and ClassicBot group rooms while their membership is verified, minus any `web.guests.narrow`.
+  **Start from today's guests** turns that into grants.
+
+They can chat there unless `web.guests.chat` is false, never send a command (text starting with `/` is refused), and the
+agent sees them as `via web (guest)`. A guest's app has no Fleet, View, Settings or Needs you. To invite someone: turn it
+on, grant them their agents in Settings → Access & security → Guests, and press **Send sign-in code** (or tell them to
+send `/web`). The Guests section is not in Settings over the public link.
 
 **Web authority (#1939).** A signed-in fleet admin's browser can speak as their own Discord or Telegram
 account. The one row under the composer (bottom left, before the Enter hint) says **Not verified · Authorize**; the
@@ -104,14 +114,14 @@ again. Confirm within 5 minutes and the session menu says **Verified · speaks a
 just **✓ Verified**, with the until-when in its tooltip, its accessible name and a tap. That
 browser's messages then carry the account's authority in their delivery receipt for `max_session_hours` (default 48).
 Not me signs that browser out, also after Confirm, from the same card. At most one card waits per browser, and 3 an hour
-per account. Never for a guest or on a quick-tunnel public link. Over the admin's own named link (#2453) only with
-**Also over my named link** (`named_link`, off by default). That authority ends with the link, and the card says "over
-your named link". When a browser can't be authorized, the line says why (with a link to Settings when the switch, "Only
-this computer" or the named-link option is the reason). Settings → Web → **Web authority** (`web.verified_authority`, on
+per account. Never for a guest. Over the admin's own named link (#2453) only with **Also over my named link**
+(`named_link`, off by default); over the temporary public link `/web` opens only with **Also over the temporary public
+link** (`quick_link`, off by default, §0.3). That authority ends with the link, and the card says "over your named link"
+or "over the temporary public link". When a browser can't be authorized, the line says why (with a link to Settings when the switch, "Only
+this computer" or the named-link option is the reason). Settings → Access & security → **Web authority** (`web.verified_authority`, on
 by default) has the switch, **Only this computer can authorize** (`loopback_only`), **Also over my named link** (shown
-with a fixed hostname), the hours, the authorized sessions, and **Revoke web authority** (or `/web revoke`). Every change
-there applies at once, except turning the named-link option on: a General or the host confirms that, never the browser
-asking.
+with a fixed hostname), **Also over the temporary public link**, the hours, the authorized sessions, and **Revoke web authority** (or `/web revoke`). Every change
+there applies at once, except turning a link's option on: a General or the host confirms that, never the browser asking.
 Agents then see that browser's messages as `via web (verified)` and check their receipt like a Discord or Telegram message.
 
 ## Chat
@@ -171,8 +181,8 @@ restored; files that can't be served again show as unavailable.
 
 **Copies in Discord/Telegram (web echo).** For a fleet topic instance, each web message is also posted to its topic as
 `🌐 web · <name>: …` (the first 500 characters plus attachment names; longer text says "(full text in web chat)").
-Turn it off with Settings → Web → **Web echo** (`web.echo_to_channel`). ClassicBot rooms: per room,
-`classicBot.yaml` `channels.<key>.web_echo` (Settings → ClassicBot → the room → **Web echo**). Since 2.2.5
+Turn it off with Settings → Chat & connections → **Web echo** (`web.echo_to_channel`). ClassicBot rooms: per room,
+`classicBot.yaml` `channels.<key>.web_echo` (Settings → Chat & connections → ClassicBot → the room → **Web echo**). Since 2.2.5
 (#2054) a room echoes by default: an unset room follows `web.echo_to_channel`, `web_echo: false` keeps it off and
 `web_echo: true` keeps it on. Before 2.2.5, a room echoed only with `web_echo: true`.
 
@@ -219,7 +229,8 @@ values reloaded after Save. Password fields keep the browser's behaviour.
 
 ## Fleet
 
-`/ui/fleet/<tab>`: **Tasks**, **Schedules**, **Teams**, **Org chart**, **Cache**, **Config**, plus a **Docs** link.
+`/ui/fleet/<tab>`: **Tasks**, **Schedules**, **Teams**, **Org chart**, **Cache**, plus a **Docs** link
+(`/ui/fleet/config` leads to Settings → Agent defaults: each of its settings lives in Settings, #2347).
 The sidebar's **Fleet** (zh "Fleet 概覽", at the top) and the phone's Fleet tab open the Fleet tab this device used last
 (`agend_last_fleet_tab`; the Org chart the first time). The sidebar has no separate Fleet (Details) or View row.
 - **Tasks** — the task board: Home lists **projects** (with % done) and what waits for the person (**Confirm** /
@@ -241,8 +252,6 @@ The sidebar's **Fleet** (zh "Fleet 概覽", at the top) and the phone's Fleet ta
 - **Teams** — **New team**, **Edit** (members, description; no rename), **Delete**. Read only on a public link.
 - **Org chart** — see below.
 - **Cache** — see [the cache report](#usage-and-the-cache-report).
-- **Config** — the main channel, access (Locked/Open, allowed users), default backend and project roots; **Save
-  changes** rewrites fleet.yaml (its comments are lost).
 
 **Org chart (#1918).** **Canvas** or **List** (remembered per device). The canvas: General at the top, then teams in
 fleet.yaml order, then "Not in a team". Drag to pan, wheel or pinch to zoom (0.2–2.5), **Zoom in / Zoom out / Fit to
@@ -258,11 +267,49 @@ blinking light (needs you, crashed, looks stuck). With **Live** on, each message
 desk to desk along the corridors in the Key's colours; a delegation in progress is a purple folder on the worker's
 desk. Hover (or tap once) a desk for its name, state and backend; click (or tap again) opens the chat. **Find** dims
 the rest. **Show** picks a team or the Lobby and **People** pins chosen instances (both kept per browser); the
-**Office** switcher lists offices kept on the host (`web-offices.json`, `GET`/`PUT /ui/offices`; changing them takes
-an admin session, never the public link — v1 has no editor). **Style** (per browser): **Desks** (the default) or
-**Studio** — one scene (Work, Lounge, Help desk, Nap corner) where each instance walks to the area for its state.
-Now and then someone says a short line for their state in a bubble (never message content). Reduced motion: still
-poses, nothing in the air, bubbles shown whole.
+**Office** switcher lists offices kept on the host (`web-offices.json`, `GET`/`PUT /ui/offices`). An admin session
+(never a read-only one, a guest or the public link) gets **Edit offices**: add, rename and delete offices, pick who is
+in each (whole teams or single instances; none = everyone) and its style, and upload or delete **skin packs** (an
+artist's pictures: `manifest.json` plus PNGs, format v1, kept in `web-office-skins/` in the AgEnD home; the host
+checks every rule — PNG only, each strip exactly frames·w × h, a 16:9 background, size caps — and never changes a
+pack; a strip may give its displayed size, `dw`/`dh`, apart from its pictures' size, and a character may walk four
+ways with `walkDown`, `walkUp` and `walkSide`, the side one mirrored for left). **Style** (per browser for the whole fleet, per office for a stored one): **Desks** (the default),
+**Studio** — one scene (Work, Lounge, Help desk, Nap corner) where each instance walks to the area for its state —
+or an uploaded pack; one the page cannot load is drawn as Desks with a note. On a stored office in Studio or a pack,
+**Edit layout** (admin only) shows a 1280×720 coordinate grid and lets you drag seats, furniture, the door and
+waypoints (or Tab to one and use the arrow keys, Shift for 10), add or remove waypoints and join or unjoin
+corridors; **Save layout** keeps the moves as that office's overrides (the pack stays as uploaded), **Reset** goes
+back to the pack's own. While it is open the office picker and Edit offices wait (**Cancel** closes it); if someone
+saved the offices meanwhile, Save says so and keeps your layout — Save again puts it on the current list. A crowded area packs extra people into a tighter grid, then shows "+N" in its corner; there
+only calls and work get bubbles (a few at most) and name tags show on hover or focus. **Hide paused and stopped**
+(per browser, off by default) leaves the sleepers out. Now and then someone says a short line for their state in a
+bubble (never message content). Reduced motion: still poses, nothing in the air, bubbles shown whole.
+**All offices** (in the switcher once two or more offices are stored, kept per device) shows every stored office as
+a tile on one canvas, each exactly as its own view (its style, members, seats, bubbles, walking), labelled with its
+name and head count, each as large as its office's content, packed to fill the panel; **Lobby tile** (on by
+default; disabled when everyone is in an office) adds the instances in no office. Below 75% name tags show on hover
+only. Hover and click work across
+tiles; a tile's label, or a double-click on it, opens that office; traffic between offices flies straight across.
+Edit offices and Edit layout wait for a single office.
+The Office fills the Fleet panel and moves like the Canvas (#2540): drag to pan, the wheel or a pinch to zoom,
+**+** / **−** / **Fit** / **Fill** at the top right (the zoom shown as a percentage above them) or the `+ - 0` keys
+(with the office focused), an overview at the bottom right to jump (not on a phone). It takes the whole panel: the
+Fleet area's full width, down to the window's foot. **Fit** shows the whole scene as large as the panel allows
+(any scale, so it fills the panel's width or height); **Fill** (a toggle, kept per office) fills the panel instead,
+cropping what overflows — drag to see it. **+** / **−** step in pixel levels (each logical unit a whole number of
+screen pixels); drawing is always unsmoothed. A resize fits a fitted view again; the scene can never be dragged off
+the panel. The zoom, centre and Fit/Fill are kept per device for each office and style. Around the 16:9 scene the
+whole panel is a matte: a pack's own `matte` (`#rrggbb`), else its background's edge colour, else the skin's own
+(Studio's hall floor; Desks: the dashboard's background). Hover, click, name tags and Edit layout all work at any zoom: a drag on a handle moves it,
+anywhere else pans; zoom and pan are never animated.
+**Fullscreen** (the button under **Fit**, or `f`; Esc leaves) shows the office alone: the dashboard's header, tabs
+and bars go, and the zoom buttons, the overview (not on a phone), a small office switcher and Exit float over it. It
+uses the browser's fullscreen; where a page cannot have it (an iPhone) or the browser refuses, the office covers the
+window instead. Opening a chat leaves it, and it is never remembered.
+A pack may add a `foreground` (a 16:9 PNG over the whole scene, zones packs only): drawn above the people, furniture
+and items in the air, below name tags, bubbles and "+N" — door frames, pillars, table fronts that hide whoever walks
+behind them. A furniture item's `depth` may be `"y"`: drawn among the people by base y (whoever stands lower is in
+front). Numeric depths keep their meaning (under 1000 under the people, 1000 and up over them).
 
 **Live traffic** (**Live** switch, on by default; **Key** in the toolbar explains it, as a strip above the canvas): a line for each message between instances.
 Colour by kind — task (delegate_task) purple, send/query/update teal, report pink, broadcast orange; between teams
@@ -355,7 +402,7 @@ they are never a $0 row, and what such an instance measured before still shows.
 by backend they go under its backend now. Coverage only says "read" for a catch-up that listed and read every source
 (an unreadable directory or transcript is not covered, never a 0). Scope as
 `get_cache_report`. The dashboard reaches it over the public link only with `web.usage_report_on_public_link: true`
-(Settings → Web → **Usage report over the public link**, applies at once; otherwise the page says "Not offered over
+(Settings → Web dashboard → **Usage report over the public link**, applies at once; otherwise the page says "Not offered over
 the public link" and links to that switch on the dashboard reached directly); guests never. The page adds a daily trend (top 5 and
 others), a heatmap that tells a day read with nothing used from a day not collected, and **Download CSV** (the shown
 answer's daily rows, with the basis). Claude subagent (sidechain) turns aren't counted yet. A long range whose daily rows
@@ -372,38 +419,45 @@ still being designed). If the report says **Switch to 1-hour cache**, the remedy
 What an agent was asked, its replies (never its thinking), each tool call (Read, Edit, Search, Run, Web, MCP,
 Sub-agent…, with **Show output**), errors, turn ends, compactions and fleet events, on one timeline. Filters **All /
 Tools / Errors**; **Live** while it updates. Opens with the newest 200 steps; **Load older steps** adds 100 at a time
-(the page keeps 1000). Off by default: `web.log_tab` (Settings → Web → **Log tab: each agent's steps**; turning it on
+(the page keeps 1000). Off by default: `web.log_tab` (Settings → Web dashboard → **Log tab: each agent's steps**; turning it on
 from the tab itself needs a fleet admin's confirmation). Full for Claude Code (also after it stopped) and Codex while
 running; kiro shows fleet events only; other backends say they have no readable transcript. Secrets are masked.
 
 ## Settings
 
-**Connections → Retry now** retries a disconnected connection without a fleet restart; a running login is reused. Startup retries continue with a five-minute cap. Local admin only, unavailable over public links. It changes no token or binding; refresh to read the later result.
+**Chat & connections → Retry now** retries a disconnected connection without a fleet restart; a running login is reused. Startup retries continue with a five-minute cap. Local admin only, unavailable over public links. It changes no token or binding; refresh to read the later result.
 
-Tabs (`/settings/<tab>`): **Preferences**, **Web appearance**, **Agents**, **Connections**, **ClassicBot**,
-**General**, **Web**, **Developer**. Header: version, **Setup wizard**, **Help**.
+Sections (`/settings/<section>`, #2347), in two groups. **You**: **Preferences**, **Look**. **Fleet**: **Agents**,
+**Agent defaults**, **Chat & connections**, **Web dashboard**, **Access & security**, **Advanced**. Old addresses (`device`,
+`appearance`, `general`, `bots`, `classic`, `web`) lead to the new sections. **Search settings** (top of the sections, **/**;
+also Ctrl K → Settings) finds a setting by name, `fleet.yaml` key or synonym in either language and goes to the field.
+Header: version, **Setup wizard**, **Help**.
 
-**How changes apply.** Agents, Connections, ClassicBot, General, Web and Developer edits are *staged*: a dialog's
-**Stage change** (General/Web: **Review changes**) adds it to the bar **Changes not applied yet**, which shows the
-cost — **Immediately**, **Restart this Agent** or **Restart AgEnD** — then **Apply changes** or **Discard**.
+**How changes apply (#2347).** Every Fleet section's edits are unsaved until
+**Save**: a field edit (Agent defaults, Chat & connections, Web dashboard, Access & security) is unsaved at once (a straight bar on its left); a dialog's **Done**
+adds its changes. The bar **N unsaved change(s)** shows the cost — **Immediately**, **Restart this Agent** or **Restart
+AgEnD** — then **Save** or **Discard**; an invalid field keeps Save waiting (**Fix 1 field(s) to save**). Over a public
+link an admin can change the fleet's settings too (not the dashboard's own web settings, Guests or Web authority).
 Confirmations (e.g. opening access) are asked at Apply. A change that loosens access waits for a fleet admin to confirm
 in the General chat ("Waiting for confirmation", **Withdraw**) — unless the browser is web-verified (#2170): an
 account that is a fleet admin of every connection the change affects, on their platform, confirms it by its own Apply
 ("Confirmed by your account"; General gets a notice; every check runs again at execution). Not for a guest, the public
 link, an unverified browser or a change that needs the host CLI. After a failure, unapplied changes are staged again
-(secrets must be re-entered). **Restart AgEnD** restarts every agent. Preferences and Web appearance save directly.
+(secrets must be re-entered). **Restart AgEnD** restarts every agent
+(never automatic); until then every page shows **N saved change(s) take effect after AgEnD restarts** · **Restart now** ·
+**Later**. Preferences and Look save with the same bar (**Your preferences**; device-only switches count on their own; Restore defaults saves at once).
 
 **Preferences** — follows you across devices unless marked:
 | Control | What it does | Stored |
 |---|---|---|
 | Your name (**Save**, **Use web-user** / **Use <account>**) | the name agents see on your web messages | your profile |
 | Theme: System / Light / Dark | page theme | host prefs `theme` |
-| Language: English / 中文 | page language (not the bots' replies — that is General → Language) | host prefs `lang` |
+| Language: English / 中文 | page language (not the bots' replies — that is Agent defaults → Language) | host prefs `lang` |
 | Names: Nickname first / Real name first | sidebar names | host prefs `names.primary` |
 | Allow HTML previews | the preview opt-in | host prefs `preview.optIn` |
 | Chat tour (this device) | replays the chat tour | browser |
 
-**Web appearance** — see [Web appearance](#web-appearance) for the cards and what they mean.
+**Look** — see [Look](#look) for the cards and what they mean.
 
 **Signing a backend in (#2233)** — local admin sessions only (never a guest or the public link): Settings → Agents →
 **Sign-ins** (each backend's login and each credential profile an agent uses: state, **Sign in** / **Sign in again**,
@@ -417,7 +471,8 @@ opencode: no dashboard sign-in. Config: `web_terminal.*` (as `/login`).
 
 **Agents** — **New agent**; per agent **Settings**, **Pause / Wake**, **Start / Stop** (direct), ⋯ **Delete agent**
 (staged; on Apply it waits for a fleet admin's confirmation in General, then the agent is stopped and removed, as
-`delete_instance` does — no restart). The agent dialog writes `instances.<name>.*` (an "Inherit" box removes the key):
+`delete_instance` does — no restart). The agent dialog writes `instances.<name>.*` (an "Inherit" box removes the key, and the field then says what it inherits:
+"Inherited: 30 min · change in Agent defaults"; a value nobody set anywhere is marked "default"):
 | Label | Key | Applies |
 |---|---|---|
 | Display name, Description | `display_name`, `description` | now |
@@ -434,7 +489,7 @@ opencode: no dashboard sign-in. Config: `web_terminal.*` (as `/login`).
 | General topic (fleet dispatcher) | `general_topic` | AgEnD |
 | Status emojis (Received, Queued, Processing, Delivered, Failed, …) | `status_emojis` | agent |
 
-**Connections** (the bots) — **New connection**: type, bot token (**Verify**), Discord server or Telegram group,
+**Chat & connections** — connections (the bots): **New connection**: type, bot token (**Verify**), Discord server or Telegram group,
 your user ID. It starts without a restart when AgEnD already runs another connection and nothing else at fleet level
 changed; a fleet's first connection (or a change to an existing one) offers **Restart AgEnD**. Per bot: **Access mode** (locked / open / pairing) and **Allowed users** —
 `channels[i].access.*`, staged, restarts AgEnD, asks before opening access; **Guild/Group id** and General channel /
@@ -442,17 +497,18 @@ forum topic with **Verify the new binding** (applies directly after a confirmati
 **Replace** the token (saved to `~/.agend/.env`); **Delete this bot** (the token stays in `.env`). **Provider API keys**:
 **Verify & apply**, used by new processes.
 
-**ClassicBot** — per room **Settings**, **Pause / Wake**. The room dialog writes `classicBot.yaml`
+ClassicBot (in **Chat & connections**, `/settings/chat#classicbot`) — per room **Settings**, **Pause / Wake**. The room dialog writes `classicBot.yaml`
 `channels.<key>.*`: Backend, Model, Auto-pause after, **Collaboration mode** (`collab`), **Web echo** (`web_echo`),
 Advanced **Context lines** (these restart the room's agent); Tool progress and Require a delivered reply (now).
 
-**General** — fleet defaults (`defaults.*`): **Language (bot replies)** (`locale`: Auto / en / zh-TW; read at startup: restart AgEnD), default
+**Agent defaults** — **Project folders** (`project_roots`: where New agent may put an agent; empty = anywhere;
+changing it waits for a fleet admin's OK) and the fleet defaults (`defaults.*`): **Language (bot replies)** (`locale`: Auto / en / zh-TW; read at startup: restart AgEnD), default
 backend and model, auto-pause, tool progress, bot-to-bot visibility, reply guard; Advanced: tool set, agent mode, log
 level, **Hang detector enabled** / **Stuck timeout** (`hang_detector.*`), **Startup concurrency** (1–20) and
-**Stagger delay** (`startup.*`, used from the next agent start, no restart). ClassicBot card (`classicBot.yaml defaults.*`): default backend, tool
+**Stagger delay** (`startup.*`, used from the next agent start, no restart). ClassicBot defaults (in Chat & connections; `classicBot.yaml defaults.*`): default backend, tool
 progress, reply guard, **ClassicBot admins**, **Allowed guilds**.
 
-**Web** — all apply at once; loosening waits for an admin; disabled over a public link.
+**Access & security** (sessions, browser terminal, public link and fixed address, guests, web authority; web echo is in Chat & connections, the Log tab and usage over the link in **Web dashboard**) — all apply at once; loosening waits for an admin; disabled over a public link.
 | Label | Key |
 |---|---|
 | Session length, hours (1–720) | `web.session.local.absolute_hours` |
@@ -470,20 +526,19 @@ Shown read-only ("Set in fleet.yaml"): `web.allowed_hosts`, `view_access`, `noti
 300,000-row cap), `provider_secrets`, `upload_max_file_mb`,
 `upload_max_total_mb`, `web_terminal.bind`, `web_terminal.tunnel`.
 
-**Developer** — fleet.yaml as **YAML / JSON**, **Edit / View**, **Copy**, **Download fleet.yaml**; **Apply & save**
-(edit mode) applies at once, without the bar.
+**Advanced** — fleet.yaml as **YAML / JSON**, **Edit / View**, **Copy**, **Download fleet.yaml**; **Apply**
+(edit mode) adds the edit to the bar, and Save writes it. While it waits, Agents, Agent defaults and the
+connections are off (and the setup wizard); while those have unsaved changes, the editor only reads.
 
 **Setup wizard** — agent (backend, directory, name) → platform → token and server/group, your user ID → preview →
 **Create and start**.
 
-## Web appearance
+## Look
 
 For an agent changing its *own* look, the `web-appearance` skill has the tools and limits. What a person sees in
-Settings → **Web appearance**, card by card:
+Settings → **Look**, card by card (the app icon, card upload limits and Canvas Worker effects are in **Web dashboard**; following reduced motion and custom CSS off here are in **Preferences**):
 - **Agents' themes** — **Show agents' themes, effects and widgets**; off, every chat looks the same and pictures and
-  ring colours fall back to the bots' own (all devices). **Effects: follow the system's reduced-motion setting** (this
-  device only, off by default): on, both ambient and Canvas Worker effects stay still while the system asks for reduced
-  motion. Otherwise both play, with one shared one-time chat note and a local action to follow the system.
+  ring colours fall back to the bots' own (all devices).
 - **Ambient effects** — an agent's falling petals, snow, rising lanterns, twinkles or stars on a click, drawn behind
   its chat by the dashboard (data only, no consent needed). They show by default, the public link too; the chat's ⋯
   menu says why one is not showing (choosing the line fixes it there) and offers **Clear the ambient effect** /
@@ -499,7 +554,7 @@ Settings → **Web appearance**, card by card:
   can't load from the internet (put pictures and fonts under Assets: PNG, WebP, JPEG, GIF, WOFF2, 1 MiB in total).
   **Save and try**, then **Keep** within 15 s or it reverts; **Turn off (all devices)**; earlier versions **Use
   this**. If something is hidden or broken, open the page with `?safe=1`, or tick **Turn off custom CSS on this
-  device**.
+  device** (in Preferences).
 - **Mods** — one `.agendmod.json` file carrying a look; importing shows everything first and applies only what you
   tick (custom CSS is never pre-ticked); agents can propose mods (**Review** / **Dismiss**); **Export a mod** writes one.
   Uninstalling removes the mod, not what it applied.
@@ -512,14 +567,17 @@ Settings → **Web appearance**, card by card:
   click, with no extra consent. The show switch, safe mode, hidden tab, browser support and live performance guard remain.
   No startup FPS calibration; data saver does not block. Reduced motion blocks only if this device chose to follow it.
   A blocked placement keeps an exact named notice. On ordinary dashboard sessions, Show/custom-CSS actions open
-  **Web appearance**. Public/guest Show-off has **Turn effects on here**; a guest CSS refusal offers Reload.
+  **Look**. Public/guest Show-off has **Turn effects on here**; a guest CSS refusal offers Reload.
   An unavailable
   isolated transport offers Reload, never an HTML-preview setup step. A motion refusal offers **Play effects anyway**;
   safe mode offers **Leave safe mode**. The dialog names loading, safety and raw unknown codes. Codes stay local; agents get only closed recent blocked reasons without viewer identifiers or counts.
-- **Identity card upload limits** — portrait and banner size limits and per-agent picture quota
-  (`web.appearance.*`); lowering applies at once, raising waits for an admin.
 - **Restore defaults** — resets this host's appearance settings (it lists what it resets first).
 
+Moved out of Look in 2.3.2 (#2347). **Preferences** (this device only): **Effects: follow the system's reduced-motion
+setting** (off by default): on, both ambient and Canvas Worker effects stay still while the system asks for reduced motion. Otherwise both play, with one shared one-time chat note and a local action to follow the system. And **Turn off custom CSS on this device**. **Web dashboard**: the **App icon**;
+**Identity card upload limits** — portrait and banner size limits and per-agent picture quota (`web.appearance.*`);
+lowering applies at once, raising waits for an admin; and **Experimental: Canvas Worker effects**.
+
 **What an agent can change for the user.** A worker changes only its own look (the `web-appearance` tools); before
 #2064 everything on this page was the person's. Since #2064 (2.2.5) General, coordinators and
 full-profile instances get `get_web_settings` / `set_web_settings`, which go through the same checks as the page;
@@ -578,7 +636,7 @@ no instance uses that provider.
 
 **Settings won't change something.** Over a public link, Web settings and appearance are read only; a loosening
 change waits for an admin's confirmation in General chat; a value in the "Set in fleet.yaml" list must be edited in
-fleet.yaml (Developer tab, or the file) and `agend reload`.
+fleet.yaml (Advanced, or the file) and `agend reload`.
 
 ### Canvas Worker playback diagnostics
 

package/dist/guest-seen-people.d.ts

@@ -0,0 +1,38 @@
+/**
+ * #2348: the people AgEnD has seen in chat — the Settings → Guests picker's source. One row per platform account
+ * (`adapter_id`, `user_id`), written where a platform message is admitted as human input (a human receipt: never a bot,
+ * never the web), so only real senders appear. Kept 400 days since last seen (the receipts themselves are pruned at
+ * `retention_days`, 30 by default — too short for "pick someone who wrote last month"). Backfilled once from the
+ * receipts still kept. Ids leave this table only through the admin's Settings read.
+ */
+import type Database from "better-sqlite3";
+export declare const SEEN_PEOPLE_KEEP_DAYS = 400;
+/** The picker reads at most this many, most recently seen first. */
+export declare const SEEN_PEOPLE_LIST_MAX = 500;
+export interface SeenPerson {
+    adapterId: string;
+    userId: string;
+    username: string | null;
+    firstSeen: string;
+    lastSeen: string;
+    /** The instances they wrote to, most recent first, with when. */
+    instances: Array<{
+        name: string;
+        at: string;
+    }>;
+}
+export declare function initializeSeenPeople(db: Database.Database): void;
+/** A platform sender seen writing to `instance` at `at` (ISO). */
+export declare function noteSeenPerson(db: Database.Database, p: {
+    adapterId: string;
+    userId: string;
+    username: string | null;
+    instance: string;
+    at: string;
+}): void;
+/** The picker's list: most recently seen first, at most SEEN_PEOPLE_LIST_MAX. */
+export declare function listSeenPeople(db: Database.Database, limit?: number): SeenPerson[];
+/** Whether an account was ever seen (and is still kept): a grant may only name one (or one already granted). */
+export declare function isSeenPerson(db: Database.Database, adapterId: string, userId: string): boolean;
+/** Forget whoever was last seen before `cutoffIso`. */
+export declare function pruneSeenPeople(db: Database.Database, cutoffIso: string): number;

package/dist/guest-seen-people.js

@@ -0,0 +1,78 @@
+export const SEEN_PEOPLE_KEEP_DAYS = 400;
+/** The picker reads at most this many, most recently seen first. */
+export const SEEN_PEOPLE_LIST_MAX = 500;
+/** Instances remembered per person (the most recent). */
+const INSTANCES_MAX = 20;
+export function initializeSeenPeople(db) {
+    const existed = !!db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'seen_people'").get();
+    db.exec(`CREATE TABLE IF NOT EXISTS seen_people (
+    adapter_id TEXT NOT NULL, user_id TEXT NOT NULL, username TEXT, first_seen TEXT NOT NULL, last_seen TEXT NOT NULL,
+    instances_json TEXT NOT NULL DEFAULT '[]', PRIMARY KEY (adapter_id, user_id));
+    CREATE INDEX IF NOT EXISTS idx_seen_people_last ON seen_people(last_seen);`);
+    if (existed)
+        return;
+    // Once, when the table is new: everyone the receipts still name (platform messages only).
+    const rows = db.prepare("SELECT target_instance, origin_json, created_at FROM human_delivery_receipts ORDER BY created_at").all();
+    const tx = db.transaction(() => {
+        for (const r of rows) {
+            let o;
+            try {
+                o = JSON.parse(r.origin_json);
+            }
+            catch {
+                continue;
+            }
+            if ((o.platform !== "discord" && o.platform !== "telegram") || typeof o.adapter_id !== "string" || typeof o.user_id !== "string")
+                continue;
+            noteSeenPerson(db, { adapterId: o.adapter_id, userId: o.user_id, username: typeof o.username === "string" ? o.username : null, instance: r.target_instance, at: r.created_at });
+        }
+    });
+    tx();
+}
+/** A platform sender seen writing to `instance` at `at` (ISO). */
+export function noteSeenPerson(db, p) {
+    if (!p.adapterId || !p.userId)
+        return;
+    const row = db.prepare("SELECT first_seen, last_seen, instances_json, username FROM seen_people WHERE adapter_id = ? AND user_id = ?").get(p.adapterId, p.userId);
+    let instances = [];
+    if (row) {
+        try {
+            instances = JSON.parse(row.instances_json);
+        }
+        catch {
+            instances = [];
+        }
+    }
+    instances = [{ name: p.instance, at: p.at }, ...instances.filter((i) => i.name !== p.instance)]
+        .sort((a, b) => b.at.localeCompare(a.at)).slice(0, INSTANCES_MAX);
+    const last = row && row.last_seen > p.at ? row.last_seen : p.at;
+    const first = row && row.first_seen < p.at ? row.first_seen : p.at;
+    // The handle as last seen (a rename shows up); an older message never overwrites a newer one's.
+    const username = row && row.last_seen > p.at ? row.username : (p.username ?? row?.username ?? null);
+    db.prepare(`INSERT INTO seen_people (adapter_id, user_id, username, first_seen, last_seen, instances_json) VALUES (?, ?, ?, ?, ?, ?)
+    ON CONFLICT(adapter_id, user_id) DO UPDATE SET username = excluded.username, first_seen = excluded.first_seen, last_seen = excluded.last_seen, instances_json = excluded.instances_json`)
+        .run(p.adapterId, p.userId, username, first, last, JSON.stringify(instances));
+}
+/** The picker's list: most recently seen first, at most SEEN_PEOPLE_LIST_MAX. */
+export function listSeenPeople(db, limit = SEEN_PEOPLE_LIST_MAX) {
+    const rows = db.prepare("SELECT * FROM seen_people ORDER BY last_seen DESC LIMIT ?").all(Math.max(1, Math.min(limit, SEEN_PEOPLE_LIST_MAX)));
+    return rows.map((r) => {
+        let instances = [];
+        try {
+            instances = JSON.parse(r.instances_json);
+        }
+        catch {
+            instances = [];
+        }
+        return { adapterId: r.adapter_id, userId: r.user_id, username: r.username, firstSeen: r.first_seen, lastSeen: r.last_seen, instances };
+    });
+}
+/** Whether an account was ever seen (and is still kept): a grant may only name one (or one already granted). */
+export function isSeenPerson(db, adapterId, userId) {
+    return !!db.prepare("SELECT 1 FROM seen_people WHERE adapter_id = ? AND user_id = ?").get(adapterId, userId);
+}
+/** Forget whoever was last seen before `cutoffIso`. */
+export function pruneSeenPeople(db, cutoffIso) {
+    return db.prepare("DELETE FROM seen_people WHERE last_seen < ?").run(cutoffIso).changes;
+}
+//# sourceMappingURL=guest-seen-people.js.map

package/dist/guest-seen-people.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guest-seen-people.js","sourceRoot":"","sources":["../src/guest-seen-people.ts"],"names":[],"mappings":"AASA,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AACzC,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACxC,yDAAyD;AACzD,MAAM,aAAa,GAAG,EAAE,CAAC;AAYzB,MAAM,UAAU,oBAAoB,CAAC,EAAqB;IACxD,MAAM,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,8EAA8E,CAAC,CAAC,GAAG,EAAE,CAAC;IACnH,EAAE,CAAC,IAAI,CAAC;;;+EAGqE,CAAC,CAAC;IAC/E,IAAI,OAAO;QAAE,OAAO;IACpB,0FAA0F;IAC1F,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,kGAAkG,CAAC,CAAC,GAAG,EAClD,CAAC;IAC9E,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;QAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAsF,CAAC;YAC3F,IAAI,CAAC;gBAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAa,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;YACtE,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;gBAAE,SAAS;YAC3I,cAAc,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QAClL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,EAAE,EAAE,CAAC;AACP,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,cAAc,CAAC,EAAqB,EAAE,CAA+F;IACnJ,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO;IACtC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,8GAA8G,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CACxD,CAAC;IACzG,IAAI,SAAS,GAAwC,EAAE,CAAC;IACxD,IAAI,GAAG,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAqB,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS,GAAG,EAAE,CAAC;QAAC,CAAC;IAAC,CAAC;IAC9G,SAAS,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC;SAC5F,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,KAAK,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,gGAAgG;IAChG,MAAM,QAAQ,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC;IACpG,EAAE,CAAC,OAAO,CAAC;4LAC+K,CAAC;SACxL,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,EAAqB,EAAE,KAAK,GAAG,oBAAoB;IAChF,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,2DAA2D,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC,CACH,CAAC;IACzI,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACpB,IAAI,SAAS,GAA4B,EAAE,CAAC;QAC5C,IAAI,CAAC;YAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAA4B,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS,GAAG,EAAE,CAAC;QAAC,CAAC;QACtG,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC;IACzI,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,YAAY,CAAC,EAAqB,EAAE,SAAiB,EAAE,MAAc;IACnF,OAAO,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,gEAAgE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAC/G,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,eAAe,CAAC,EAAqB,EAAE,SAAiB;IACtE,OAAO,EAAE,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC;AAC1F,CAAC"}

package/dist/instance-config-impact.js

@@ -26,6 +26,7 @@ export const HOT_INSTANCE_CONFIG_KEYS = new Set([
     "tool_progress",
     "reply_completion_guard",
     "mcp_proxy_reply",
+    "resume_interrupted_work",
     "auto_pause_after",
     "warm_cap",
     "display_name",
@@ -62,7 +63,7 @@ const FLEET_SCOPED_INSTANCE_KEYS = new Set([
 /** Instance-scoped fields the settings page renders. */
 const INSTANCE_FIELDS = [
     "display_name", "description", "backend", "model", "working_directory",
-    "auto_pause_after", "warm_cap", "topic_id", "channel_id", "general_topic",
+    "resume_interrupted_work", "auto_pause_after", "warm_cap", "topic_id", "channel_id", "general_topic",
     "tool_progress", "reply_completion_guard", "mcp_proxy_reply", "log_level",
     "systemPrompt", "tags", "hang_detector", "agent_mode", "tool_set",
     "lightweight", "model_failover", "effort", "pre_task_command",
@@ -121,6 +122,8 @@ const FLEET_FIELD_IMPACTS = {
     // #2346: read at each spawn by the SpawnGate (fleet-level-config.ts RUNTIME_READ_FLEET_KEYS): the next start uses it.
     "fleet.spawn_concurrency": "now",
     "fleet.spawn_stagger_ms": "now",
+    // #2347 §10: checked at each create (instance-lifecycle's project_roots boundary), so the next New agent uses it.
+    "fleet.project_roots": "now",
     "classic.admin_users": "fleet",
     "classic.allowed_guilds": "fleet",
     // #2168: a confirmed delete stops and removes the agent at once (removeInstance) — no AgEnD restart.

package/dist/instance-config-impact.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance-config-impact.js","sourceRoot":"","sources":["../src/instance-config-impact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAM9C,0EAA0E;AAC1E,MAAM,CAAC,MAAM,YAAY,GAA4B,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AAElF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsC,IAAI,GAAG,CAAuB;IACvG,eAAe;IACf,wBAAwB;IACxB,iBAAiB;IACjB,kBAAkB;IAClB,UAAU;IACV,cAAc;IACd,aAAa;IACb,MAAM;IACN,WAAW;IACX,sFAAsF;IACtF,2BAA2B;IAC3B,wFAAwF;IACxF,qBAAqB;IACrB,oGAAoG;IACpG,WAAW;CACZ,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAChE,CAAC,eAAe,EAAE,wBAAwB,CAAW;KACnD,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CACpD,CAAC;AAEF;;;GAGG;AACH,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAC;IAC9D,UAAU;IACV,YAAY;IACZ,eAAe;CAChB,CAAC,CAAC;AAEH,wDAAwD;AACxD,MAAM,eAAe,GAAG;IACtB,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB;IACtE,kBAAkB,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe;IACzE,eAAe,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,WAAW;IACzE,cAAc,EAAE,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,UAAU;IACjE,aAAa,EAAE,gBAAgB,EAAE,QAAQ,EAAE,kBAAkB;IAC7D,0EAA0E;IAC1E,kEAAkE;IAClE,eAAe;IACf,2BAA2B;IAC3B,qDAAqD;IACrD,qBAAqB;IACrB,kEAAkE;IAClE,WAAW;CACH,CAAC;AAEX,2DAA2D;AAC3D,MAAM,cAAc,GAAG;IACrB,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,eAAe;IACvD,wBAAwB,EAAE,QAAQ,EAAE,eAAe,EAAE,kBAAkB;IACvE,UAAU;CACF,CAAC;AAEX;;;GAGG;AACH,MAAM,mBAAmB,GAA2C;IAClE,gCAAgC,EAAE,KAAK;IACvC,qBAAqB,EAAE,KAAK;IAC5B,aAAa,EAAE,KAAK;IACpB,iCAAiC,EAAE,KAAK;IACxC,8BAA8B,EAAE,KAAK;IACrC,6BAA6B,EAAE,KAAK;IACpC,0BAA0B,EAAE,KAAK;IACjC,0BAA0B,EAAE,KAAK;IACjC,kCAAkC,EAAE,KAAK;IACzC,6BAA6B,EAAE,KAAK;IACpC,sDAAsD;IACtD,2BAA2B,EAAE,OAAO;IACpC,+EAA+E;IAC/E,kCAAkC,EAAE,KAAK;IACzC,8BAA8B,EAAE,KAAK;IACrC,oGAAoG;IACpG,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,oBAAoB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,gBAAgB;QAC/I,sBAAsB,EAAE,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,KAAc,CAAC,CAAC,CAAC;IACpG,sBAAsB,EAAE,KAAK;IAC7B,0BAA0B,EAAE,KAAK;IACjC,mHAAmH;IACnH,qDAAqD;IACrD,YAAY,EAAE,KAAK;IACnB,wBAAwB,EAAE,KAAK;IAC/B,+GAA+G;IAC/G,iBAAiB,EAAE,OAAO;IAC1B,gBAAgB,EAAE,OAAO;IACzB,2BAA2B,EAAE,OAAO;IACpC,oCAAoC,EAAE,OAAO;IAC7C,gHAAgH;IAChH,2GAA2G;IAC3G,qCAAqC,EAAE,KAAK;IAC5C,sHAAsH;IACtH,yBAAyB,EAAE,KAAK;IAChC,wBAAwB,EAAE,KAAK;IAC/B,qBAAqB,EAAE,OAAO;IAC9B,wBAAwB,EAAE,OAAO;IACjC,qGAAqG;IACrG,iBAAiB,EAAE,KAAK;CACzB,CAAC;AAEF,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,MAAsB;IAIvD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAwE,EAAE,CAAC;QACzH,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,KAAc,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AACvB,CAAC;AAED;mEACmE;AACnE,MAAM,UAAU,eAAe,CAAC,MAAsB;IACpD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,wBAAwB;QAAE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IAC9E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAuB,EACvB,IAAoB;IAEpB,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACvC,gEAAgE;IAChE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,IAAI,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACxD,OAAO,wBAAwB,CAAC,GAAG,CAAC,GAA2B,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAuB,EAAE,QAAuC;IAC1F,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrF,OAAO,YAAY,CAAC,KAAK,CAAE,CAAC;AAC9B,CAAC;AASD,qDAAqD;AACrD,MAAM,UAAU,yBAAyB;IACvC,MAAM,OAAO,GAAiC,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACzE,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,OAAO,CAAC,YAAY,GAAG,EAAE,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtD,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,YAAY,GAAG,EAAE,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAClG,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,OAAO,CAAC,WAAW,GAAG,EAAE,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACpD,OAAO,CAAC,oBAAoB,GAAG,EAAE,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"instance-config-impact.js","sourceRoot":"","sources":["../src/instance-config-impact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAM9C,0EAA0E;AAC1E,MAAM,CAAC,MAAM,YAAY,GAA4B,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AAElF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsC,IAAI,GAAG,CAAuB;IACvG,eAAe;IACf,wBAAwB;IACxB,iBAAiB;IACjB,yBAAyB;IACzB,kBAAkB;IAClB,UAAU;IACV,cAAc;IACd,aAAa;IACb,MAAM;IACN,WAAW;IACX,sFAAsF;IACtF,2BAA2B;IAC3B,wFAAwF;IACxF,qBAAqB;IACrB,oGAAoG;IACpG,WAAW;CACZ,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAChE,CAAC,eAAe,EAAE,wBAAwB,CAAW;KACnD,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CACpD,CAAC;AAEF;;;GAGG;AACH,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAC;IAC9D,UAAU;IACV,YAAY;IACZ,eAAe;CAChB,CAAC,CAAC;AAEH,wDAAwD;AACxD,MAAM,eAAe,GAAG;IACtB,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB;IACtE,yBAAyB,EAAE,kBAAkB,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe;IACpG,eAAe,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,WAAW;IACzE,cAAc,EAAE,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,UAAU;IACjE,aAAa,EAAE,gBAAgB,EAAE,QAAQ,EAAE,kBAAkB;IAC7D,0EAA0E;IAC1E,kEAAkE;IAClE,eAAe;IACf,2BAA2B;IAC3B,qDAAqD;IACrD,qBAAqB;IACrB,kEAAkE;IAClE,WAAW;CACH,CAAC;AAEX,2DAA2D;AAC3D,MAAM,cAAc,GAAG;IACrB,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,eAAe;IACvD,wBAAwB,EAAE,QAAQ,EAAE,eAAe,EAAE,kBAAkB;IACvE,UAAU;CACF,CAAC;AAEX;;;GAGG;AACH,MAAM,mBAAmB,GAA2C;IAClE,gCAAgC,EAAE,KAAK;IACvC,qBAAqB,EAAE,KAAK;IAC5B,aAAa,EAAE,KAAK;IACpB,iCAAiC,EAAE,KAAK;IACxC,8BAA8B,EAAE,KAAK;IACrC,6BAA6B,EAAE,KAAK;IACpC,0BAA0B,EAAE,KAAK;IACjC,0BAA0B,EAAE,KAAK;IACjC,kCAAkC,EAAE,KAAK;IACzC,6BAA6B,EAAE,KAAK;IACpC,sDAAsD;IACtD,2BAA2B,EAAE,OAAO;IACpC,+EAA+E;IAC/E,kCAAkC,EAAE,KAAK;IACzC,8BAA8B,EAAE,KAAK;IACrC,oGAAoG;IACpG,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,oBAAoB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,gBAAgB;QAC/I,sBAAsB,EAAE,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,KAAc,CAAC,CAAC,CAAC;IACpG,sBAAsB,EAAE,KAAK;IAC7B,0BAA0B,EAAE,KAAK;IACjC,mHAAmH;IACnH,qDAAqD;IACrD,YAAY,EAAE,KAAK;IACnB,wBAAwB,EAAE,KAAK;IAC/B,+GAA+G;IAC/G,iBAAiB,EAAE,OAAO;IAC1B,gBAAgB,EAAE,OAAO;IACzB,2BAA2B,EAAE,OAAO;IACpC,oCAAoC,EAAE,OAAO;IAC7C,gHAAgH;IAChH,2GAA2G;IAC3G,qCAAqC,EAAE,KAAK;IAC5C,sHAAsH;IACtH,yBAAyB,EAAE,KAAK;IAChC,wBAAwB,EAAE,KAAK;IAC/B,kHAAkH;IAClH,qBAAqB,EAAE,KAAK;IAC5B,qBAAqB,EAAE,OAAO;IAC9B,wBAAwB,EAAE,OAAO;IACjC,qGAAqG;IACrG,iBAAiB,EAAE,KAAK;CACzB,CAAC;AAEF,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,MAAsB;IAIvD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAwE,EAAE,CAAC;QACzH,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,KAAc,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AACvB,CAAC;AAED;mEACmE;AACnE,MAAM,UAAU,eAAe,CAAC,MAAsB;IACpD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,wBAAwB;QAAE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IAC9E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAuB,EACvB,IAAoB;IAEpB,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACvC,gEAAgE;IAChE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,IAAI,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACxD,OAAO,wBAAwB,CAAC,GAAG,CAAC,GAA2B,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAuB,EAAE,QAAuC;IAC1F,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrF,OAAO,YAAY,CAAC,KAAK,CAAE,CAAC;AAC9B,CAAC;AASD,qDAAqD;AACrD,MAAM,UAAU,yBAAyB;IACvC,MAAM,OAAO,GAAiC,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACzE,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,OAAO,CAAC,YAAY,GAAG,EAAE,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtD,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,YAAY,GAAG,EAAE,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAClG,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,OAAO,CAAC,WAAW,GAAG,EAAE,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACpD,OAAO,CAAC,oBAAoB,GAAG,EAAE,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AAC1C,CAAC"}

package/dist/instance-lifecycle.d.ts

@@ -200,6 +200,7 @@ export interface IncidentEventSource {
     /** `nudge_continue`: arm / drop the daemon's "tell the agent to keep going" for the error just reported. */
     armCapacityNudge?(pattern: RegExp, delayMs: number): boolean;
     cancelCapacityNudge?(reason: string): void;
+    markCapacityNudgePromised?(target: string): void;
     prepareCapacityNudgePause?(): Promise<CapacityNudgePauseGuard | null>;
     /** Real daemons buffer `pty_error` raised by the startup scan until the lifecycle can handle it. */
     holdStartupIncidents?(): void;

package/dist/instance-lifecycle.js

@@ -583,6 +583,19 @@ export class InstanceLifecycle {
         }, this.ctx.logger, `daemon.message_failed[${name}]`));
     }
     attachIncidentHandlers(name, daemon) {
+        daemon.on("capacity_nudge_cancelled", safeHandler((data) => {
+            const reason = data.reason === "the user cancelled" ? t("inst.codex_retry_cancel_reason_user")
+                : data.reason === "the instance was stopped, paused or respawned" || data.reason === "the instance is not running" ? t("inst.codex_retry_cancel_reason_stopped")
+                    : data.reason === "the instance has work of its own" ? t("inst.codex_retry_cancel_reason_work")
+                        : data.reason === "the failed turn is no longer idle with an empty input" ? t("inst.codex_retry_cancel_reason_pane")
+                            : t("inst.codex_retry_cancel_reason_unsent");
+            this.ctx.eventLog?.insert(name, "capacity_nudge_cancelled", { reason: data.reason });
+            // Settle an already-dispatched promise in its original channel, including
+            // during a planned stop. This is not a new restart/storm incident alarm.
+            if (this.ctx.notifyInstanceTopic(data.target, t("inst.codex_retry_cancelled", name, reason)) === false) {
+                this.ctx.logger.warn({ name }, "Could not dispatch retry cancellation notice");
+            }
+        }, this.ctx.logger, `daemon.capacity_nudge_cancelled[${name}]`));
         const hangDetector = daemon.getHangDetector?.();
         if (hangDetector) {
             hangDetector.on("hang", safeHandler(async (data) => {
@@ -1194,7 +1207,9 @@ export class InstanceLifecycle {
         budget.set(name, { count: attempts + 1, lastAt: now });
         this.ctx.logger.info({ name, attempt: attempts + 1 }, "Model at capacity — will tell it to keep going");
         if (notificationTarget) {
-            this.notifyIncident(notificationTarget, "pty_error", t(rateLimit ? "inst.codex_rate_retry_scheduled" : "inst.codex_capacity_nudge_scheduled", name, String(attempts + 1), String(InstanceLifecycle.CAPACITY_BACKOFF_MAX), String(Math.round(delayMs / 1000))));
+            const promised = this.notifyIncident(notificationTarget, "pty_error", t(rateLimit ? "inst.codex_rate_retry_scheduled" : "inst.codex_capacity_nudge_scheduled", name, String(attempts + 1), String(InstanceLifecycle.CAPACITY_BACKOFF_MAX), String(Math.round(delayMs / 1000))));
+            if (promised)
+                daemon.markCapacityNudgePromised?.(notificationTarget);
         }
     }
     /** An exhausted error must not pause a draft, new delivery or replacement launch. */