@songsid/agend 2.3.2-beta.3 → 2.3.2-beta.4

package/dist/dashboard-permissions.d.ts

@@ -6,17 +6,23 @@
  *
  * - `appearance`: its own look on the dashboard — theme, pictures, widgets, ambient, effects, mods it proposes;
  * - `task_board`: the task board (`task`, and `agend task …`);
- * - `web_settings`: Settings → Web appearance for the person (`get_web_settings`, `set_web_settings`).
+ * - `web_settings`: Settings → Web appearance for the person (`get_web_settings`, `set_web_settings`);
+ * - `office` (#2578), stored separately as `office_access`: its own character in Fleet → Org chart → Office — walking, a speech bubble, a pose
+ *   (`office_view`, `office_set`).
  *
  * Unset is allowed: a fleet that switches nothing off works as before, and the profile still decides what an agent
- * has. `false` takes the feature's tools away whatever the profile carries: refused at the fleet's checks
+ * has — except for a feature in OFF_UNLESS_ON (`office`), which is off until a person sets it true. `false` takes the feature's tools away whatever the profile carries: refused at the fleet's checks
  * (tool-permissions.ts's sinks, read at each call — no restart) and left out of the agent's tool menu from its next
  * start (AGEND_DASHBOARD_OFF, read by mcp-server). Like a profile, policy protection for the resolved identity, not
  * isolation between same-uid agents with a shell.
  */
-export declare const DASHBOARD_FEATURES: readonly ["appearance", "task_board", "web_settings"];
+export declare const DASHBOARD_FEATURES: readonly ["appearance", "task_board", "web_settings", "office"];
 export type DashboardFeature = typeof DASHBOARD_FEATURES[number];
-/** As written in fleet.yaml: each feature true (allowed), false (switched off) or absent (allowed). */
+/** The features a person switches on (#2578): absent (or null) is off for these, never allowed. */
+export declare const OFF_UNLESS_ON: ReadonlySet<DashboardFeature>;
+/** What a feature is when nothing (not the instance, not the defaults) says: allowed, or off for OFF_UNLESS_ON. */
+export declare const dashboardFeatureDefault: (feature: string) => boolean;
+/** As written in fleet.yaml: each feature true (allowed), false (switched off) or absent (allowed; off for OFF_UNLESS_ON). */
 export type DashboardAccess = Partial<Record<DashboardFeature, boolean>>;
 /**
  * What a NEW fleet.yaml says about the features (the user's decision, 2026-10-22): the task board is off until the
@@ -29,7 +35,7 @@ export declare const NEW_FLEET_DASHBOARD: Readonly<DashboardAccess>;
 export declare const DASHBOARD_FEATURE_TOOLS: Readonly<Record<DashboardFeature, readonly string[]>>;
 /** The feature a tool belongs to, or null for a tool no switch governs. */
 export declare function dashboardFeatureOf(tool: string): DashboardFeature | null;
-/** The features switched off (`false`) in an instance's `dashboard` as resolved; anything else allows. */
+/** The features switched off in an instance's `dashboard` as resolved: `false`, and an OFF_UNLESS_ON one not `true`. */
 export declare function dashboardFeaturesOff(access: unknown): DashboardFeature[];
 /** The refusal for `tool` when its feature is switched off in this resolved `dashboard` mapping, else null. */
 export declare function dashboardRefusal(access: unknown, tool: string): string | null;
@@ -52,9 +58,17 @@ export declare function dashboardAccessProblem(value: unknown): string | null;
  * the default — the same as absent (#2391 review: a literal `task_board: null` must not hide the default's `false`).
  */
 export declare function dashboardSwitches(value: unknown): DashboardAccess;
+/** Office lives beside dashboard so published rollback validators never see a new feature in that closed map. */
+export declare function officeAccessValue(config: any): unknown;
+export declare function dashboardAccessOf(config: any): DashboardAccess;
+/** Transitional dashboard.office input is accepted, but never written by a managed save. Canonical values win. */
+export declare function normalizeOfficeStorage(fleet: any): void;
+/** Accept an older Settings client, but project/save its Office edit using the canonical field. */
+export declare function officeInputPatch(value: Record<string, any>): Record<string, any>;
+export declare function hasLegacyOffice(fleet: any): boolean;
 /**
  * The features switched off in a fleet config for `name`: each feature's own switch where the instance has one, else
- * the default's, else allowed. `name` with no own `instances` entry (a ClassicBot identity) gets the defaults'.
+ * the default's, else allowed (off for OFF_UNLESS_ON). `name` with no own `instances` entry (a ClassicBot identity) gets the defaults'.
  */
 export declare function dashboardFeaturesOffIn(fleet: unknown, name: string): DashboardFeature[];
 /**

package/dist/dashboard-permissions.js

@@ -6,15 +6,21 @@
  *
  * - `appearance`: its own look on the dashboard — theme, pictures, widgets, ambient, effects, mods it proposes;
  * - `task_board`: the task board (`task`, and `agend task …`);
- * - `web_settings`: Settings → Web appearance for the person (`get_web_settings`, `set_web_settings`).
+ * - `web_settings`: Settings → Web appearance for the person (`get_web_settings`, `set_web_settings`);
+ * - `office` (#2578), stored separately as `office_access`: its own character in Fleet → Org chart → Office — walking, a speech bubble, a pose
+ *   (`office_view`, `office_set`).
  *
  * Unset is allowed: a fleet that switches nothing off works as before, and the profile still decides what an agent
- * has. `false` takes the feature's tools away whatever the profile carries: refused at the fleet's checks
+ * has — except for a feature in OFF_UNLESS_ON (`office`), which is off until a person sets it true. `false` takes the feature's tools away whatever the profile carries: refused at the fleet's checks
  * (tool-permissions.ts's sinks, read at each call — no restart) and left out of the agent's tool menu from its next
  * start (AGEND_DASHBOARD_OFF, read by mcp-server). Like a profile, policy protection for the resolved identity, not
  * isolation between same-uid agents with a shell.
  */
-export const DASHBOARD_FEATURES = ["appearance", "task_board", "web_settings"];
+export const DASHBOARD_FEATURES = ["appearance", "task_board", "web_settings", "office"];
+/** The features a person switches on (#2578): absent (or null) is off for these, never allowed. */
+export const OFF_UNLESS_ON = new Set(["office"]);
+/** What a feature is when nothing (not the instance, not the defaults) says: allowed, or off for OFF_UNLESS_ON. */
+export const dashboardFeatureDefault = (feature) => !OFF_UNLESS_ON.has(feature);
 /**
  * What a NEW fleet.yaml says about the features (the user's decision, 2026-10-22): the task board is off until the
  * person switches it on (Settings → defaults, or per agent). Written, visibly, by every path that creates the file —
@@ -34,6 +40,7 @@ export const DASHBOARD_FEATURE_TOOLS = {
     ],
     task_board: ["task"],
     web_settings: ["get_web_settings", "set_web_settings"],
+    office: ["office_view", "office_set"],
 };
 const FEATURE_OF = new Map(DASHBOARD_FEATURES.flatMap((f) => DASHBOARD_FEATURE_TOOLS[f].map((tool) => [tool, f])));
 /** The feature a tool belongs to, or null for a tool no switch governs. */
@@ -41,17 +48,20 @@ export function dashboardFeatureOf(tool) {
     return FEATURE_OF.get(tool) ?? null;
 }
 const isFeature = (k) => DASHBOARD_FEATURES.includes(k);
-/** The features switched off (`false`) in an instance's `dashboard` as resolved; anything else allows. */
+/** The features switched off in an instance's `dashboard` as resolved: `false`, and an OFF_UNLESS_ON one not `true`. */
 export function dashboardFeaturesOff(access) {
-    if (!access || typeof access !== "object" || Array.isArray(access))
-        return [];
-    return DASHBOARD_FEATURES.filter((f) => access[f] === false);
+    const a = access && typeof access === "object" && !Array.isArray(access) ? access : {};
+    return DASHBOARD_FEATURES.filter((f) => (OFF_UNLESS_ON.has(f) ? a[f] !== true : a[f] === false));
 }
 /** The refusal for `tool` when its feature is in `off`, else null. */
 function refusalFor(off, tool) {
     const feature = dashboardFeatureOf(tool);
     if (!feature || !off.includes(feature))
         return null;
+    if (OFF_UNLESS_ON.has(feature)) {
+        return `${tool} is not available to this instance: its dashboard feature "${feature}" is off until the person switches it on (${feature === "office" ? "office_access" : `dashboard.${feature}`}: true). `
+            + "Do not retry it; tell the person if you need it.";
+    }
     return `${tool} is not available to this instance: the person switched its dashboard feature "${feature}" off (dashboard.${feature}: false). `
         + "Do not retry it; tell the person if you need it.";
 }
@@ -106,15 +116,54 @@ export function dashboardSwitches(value) {
     }
     return out;
 }
+/** Office lives beside dashboard so published rollback validators never see a new feature in that closed map. */
+export function officeAccessValue(config) {
+    return config && Object.hasOwn(config, "office_access") ? config.office_access : config?.dashboard?.office;
+}
+export function dashboardAccessOf(config) {
+    const access = dashboardSwitches(config?.dashboard), office = officeAccessValue(config);
+    delete access.office;
+    if (typeof office === "boolean")
+        access.office = office;
+    return access;
+}
+/** Transitional dashboard.office input is accepted, but never written by a managed save. Canonical values win. */
+export function normalizeOfficeStorage(fleet) {
+    for (const config of [fleet?.defaults, ...Object.values(fleet?.instances ?? {})]) {
+        if (!config || typeof config !== "object" || Array.isArray(config))
+            continue;
+        const item = config;
+        if (!item.dashboard || typeof item.dashboard !== "object" || !Object.hasOwn(item.dashboard, "office"))
+            continue;
+        if (!Object.hasOwn(item, "office_access") && typeof item.dashboard.office === "boolean")
+            item.office_access = item.dashboard.office;
+        const { office: _office, ...dashboard } = item.dashboard;
+        item.dashboard = dashboard;
+    }
+}
+/** Accept an older Settings client, but project/save its Office edit using the canonical field. */
+export function officeInputPatch(value) {
+    const result = { ...value };
+    if (value.dashboard && typeof value.dashboard === "object" && !Array.isArray(value.dashboard) && Object.hasOwn(value.dashboard, "office")) {
+        const { office, ...dashboard } = value.dashboard;
+        result.dashboard = dashboard;
+        if (!Object.hasOwn(value, "office_access"))
+            result.office_access = office;
+    }
+    return result;
+}
+export function hasLegacyOffice(fleet) {
+    return [fleet?.defaults, ...Object.values(fleet?.instances ?? {})].some((item) => item?.dashboard && Object.hasOwn(item.dashboard, "office"));
+}
 /**
  * The features switched off in a fleet config for `name`: each feature's own switch where the instance has one, else
- * the default's, else allowed. `name` with no own `instances` entry (a ClassicBot identity) gets the defaults'.
+ * the default's, else allowed (off for OFF_UNLESS_ON). `name` with no own `instances` entry (a ClassicBot identity) gets the defaults'.
  */
 export function dashboardFeaturesOffIn(fleet, name) {
     const f = fleet && typeof fleet === "object" ? fleet : {};
     const instances = f.instances && typeof f.instances === "object" ? f.instances : {};
     const inst = Object.hasOwn(instances, name) ? instances[name] : undefined; // a name is a key of its own, never an inherited one
-    return dashboardFeaturesOff({ ...dashboardSwitches(f.defaults?.dashboard), ...dashboardSwitches(inst?.dashboard) });
+    return dashboardFeaturesOff({ ...dashboardAccessOf(f.defaults), ...dashboardAccessOf(inst) });
 }
 /**
  * (a) An agent without the task board is not told to use it: the built-in workflow's task board section ("## Progress

package/dist/dashboard-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard-permissions.js","sourceRoot":"","sources":["../src/dashboard-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,cAAc,CAAU,CAAC;AAKxF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AAEnG,yHAAyH;AACzH,MAAM,CAAC,MAAM,uBAAuB,GAA0D;IAC5F,UAAU,EAAE;QACV,eAAe,EAAE,eAAe,EAAE,qBAAqB,EAAE,iBAAiB;QAC1E,oBAAoB,EAAE,wBAAwB;QAC9C,gBAAgB,EAAE,mBAAmB;QACrC,iBAAiB,EAAE,mBAAmB;QACtC,gBAAgB,EAAE,iBAAiB;QACnC,mBAAmB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,mBAAmB;KAClJ;IACD,UAAU,EAAE,CAAC,MAAM,CAAC;IACpB,YAAY,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;CACvD,CAAC;AAEF,MAAM,UAAU,GAA0C,IAAI,GAAG,CAC/D,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAU,CAAC,CAAC,CAChG,CAAC;AAEF,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACtC,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAAS,EAAyB,EAAE,CAAE,kBAAwC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAE9G,0GAA0G;AAC1G,MAAM,UAAU,oBAAoB,CAAC,MAAe;IAClD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9E,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,MAAkC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;AAC5F,CAAC;AAED,sEAAsE;AACtE,SAAS,UAAU,CAAC,GAAgC,EAAE,IAAY;IAChE,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,GAAG,IAAI,kFAAkF,OAAO,oBAAoB,OAAO,YAAY;UAC1I,kDAAkD,CAAC;AACzD,CAAC;AACD,+GAA+G;AAC/G,MAAM,UAAU,gBAAgB,CAAC,MAAe,EAAE,IAAY;IAC5D,OAAO,UAAU,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AACD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,IAAY,EAAE,IAAY;IAC3E,OAAO,UAAU,CAAC,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,eAAe,CAA6B,KAAmB,EAAE,GAAgC;IAC/G,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,wBAAwB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACvI,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAAE,OAAO,oBAAoB,CAAC,aAAa,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7F,IAAI,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,wBAAwB,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3E,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;QAAC,MAAM,CAAC,GAAI,KAAiC,CAAC,CAAC,CAAC,CAAC;QAAC,IAAI,OAAO,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAChI,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc,EAAE,IAAY;IACjE,MAAM,CAAC,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAgH,CAAC,CAAC,CAAC,EAAE,CAAC;IACrK,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAY,qDAAqD;IAC3I,OAAO,oBAAoB,CAAC,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,GAAG,iBAAiB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;AACtH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,OAAO,QAAQ,CAAC,OAAO,CAAC,qDAAqD,EAAE,EAAE,CAAC,CAAC;AACrF,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED,mHAAmH;AACnH,MAAM,CAAC,MAAM,oBAAoB,GAAG,wGAAwG;MACxI,oIAAoI;MACpI,yLAAyL;MACzL,oFAAoF,CAAC;AAEzF,yGAAyG;AACzG,MAAM,UAAU,mBAAmB,CAAC,MAAe,EAAE,KAAc;IACjE,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACpH,CAAC"}
+{"version":3,"file":"dashboard-permissions.js","sourceRoot":"","sources":["../src/dashboard-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,CAAU,CAAC;AAElG,mGAAmG;AACnG,MAAM,CAAC,MAAM,aAAa,GAAkC,IAAI,GAAG,CAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClG,mHAAmH;AACnH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,OAA2B,CAAC,CAAC;AAIrH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AAEnG,yHAAyH;AACzH,MAAM,CAAC,MAAM,uBAAuB,GAA0D;IAC5F,UAAU,EAAE;QACV,eAAe,EAAE,eAAe,EAAE,qBAAqB,EAAE,iBAAiB;QAC1E,oBAAoB,EAAE,wBAAwB;QAC9C,gBAAgB,EAAE,mBAAmB;QACrC,iBAAiB,EAAE,mBAAmB;QACtC,gBAAgB,EAAE,iBAAiB;QACnC,mBAAmB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,mBAAmB;KAClJ;IACD,UAAU,EAAE,CAAC,MAAM,CAAC;IACpB,YAAY,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IACtD,MAAM,EAAE,CAAC,aAAa,EAAE,YAAY,CAAC;CACtC,CAAC;AAEF,MAAM,UAAU,GAA0C,IAAI,GAAG,CAC/D,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAU,CAAC,CAAC,CAChG,CAAC;AAEF,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACtC,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAAS,EAAyB,EAAE,CAAE,kBAAwC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAE9G,wHAAwH;AACxH,MAAM,UAAU,oBAAoB,CAAC,MAAe;IAClD,MAAM,CAAC,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClH,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,sEAAsE;AACtE,SAAS,UAAU,CAAC,GAAgC,EAAE,IAAY;IAChE,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,GAAG,IAAI,8DAA8D,OAAO,6CAA6C,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,OAAO,EAAE,WAAW;cACtM,kDAAkD,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,IAAI,kFAAkF,OAAO,oBAAoB,OAAO,YAAY;UAC1I,kDAAkD,CAAC;AACzD,CAAC;AACD,+GAA+G;AAC/G,MAAM,UAAU,gBAAgB,CAAC,MAAe,EAAE,IAAY;IAC5D,OAAO,UAAU,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AACD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,IAAY,EAAE,IAAY;IAC3E,OAAO,UAAU,CAAC,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,eAAe,CAA6B,KAAmB,EAAE,GAAgC;IAC/G,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,wBAAwB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACvI,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAAE,OAAO,oBAAoB,CAAC,aAAa,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7F,IAAI,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,wBAAwB,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3E,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;QAAC,MAAM,CAAC,GAAI,KAAiC,CAAC,CAAC,CAAC,CAAC;QAAC,IAAI,OAAO,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAChI,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,iBAAiB,CAAC,MAAW;IAC3C,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC;AAC7G,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,MAAW;IAC3C,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxF,OAAO,MAAM,CAAC,MAAM,CAAC;IACrB,IAAI,OAAO,MAAM,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACxD,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,kHAAkH;AAClH,MAAM,UAAU,sBAAsB,CAAC,KAAU;IAC/C,KAAK,MAAM,MAAM,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACjF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,SAAS;QAC7E,MAAM,IAAI,GAAG,MAA6B,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC;YAAE,SAAS;QAChH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QACpI,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;QACzD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;AACH,CAAC;AACD,mGAAmG;AACnG,MAAM,UAAU,gBAAgB,CAAC,KAA0B;IACzD,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IAC5B,IAAI,KAAK,CAAC,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1I,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;QACjD,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC;YAAE,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC;IAC5E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,KAAU;IACxC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAS,EAAE,EAAE,CAAC,IAAI,EAAE,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AACrJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc,EAAE,IAAY;IACjE,MAAM,CAAC,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAgH,CAAC,CAAC,CAAC,EAAE,CAAC;IACrK,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAY,qDAAqD;IAC3I,OAAO,oBAAoB,CAAC,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,OAAO,QAAQ,CAAC,OAAO,CAAC,qDAAqD,EAAE,EAAE,CAAC,CAAC;AACrF,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED,mHAAmH;AACnH,MAAM,CAAC,MAAM,oBAAoB,GAAG,wGAAwG;MACxI,oIAAoI;MACpI,yLAAyL;MACzL,oFAAoF,CAAC;AAEzF,yGAAyG;AACzG,MAAM,UAAU,mBAAmB,CAAC,MAAe,EAAE,KAAc;IACjE,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACpH,CAAC"}

package/dist/fleet-manager.d.ts

@@ -65,6 +65,7 @@ import { OwnerCssStore } from "./web-owner-css-store.js";
 import { ThemeStore } from "./web-theme-store.js";
 import { OfficeStore, OfficeWriteLimiter } from "./web-office-store.js";
 import { OfficeSkinStore } from "./web-office-skins.js";
+import { OfficeActs } from "./web-office-acts.js";
 import { WebAppearance } from "./web-appearance.js";
 import { WebEffectLibrary } from "./web-effect-library.js";
 import { WebEffectTrials } from "./web-effect-trials.js";
@@ -658,6 +659,14 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     readonly officeSkinWrites: OfficeWriteLimiter;
     /** How often a person may save the offices (PUT /ui/offices); memory only, as the appearance limiter. */
     readonly officeWrites: OfficeWriteLimiter;
+    private officeActsInstance?;
+    /** #2578: the agents' acts in the Office view (office_view / office_set), memory only; every change is `office_acts`. */
+    get officeActs(): OfficeActs;
+    /**
+     * #2578: each instance's state as the org chart shows it (fleet-org.js orgState, from the same fields the status
+     * frame and the Needs-you list carry) and its display name (resolveInstanceIdentity, as getUiStatus) — read once.
+     */
+    private officePeople;
     /** #1629: the theme tools, a person's reset and lock, and the one appearance rate limiter (shared with effects). */
     get webAppearance(): WebAppearance;
     private effectLibraryInstance?;
@@ -1633,6 +1642,10 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
         remainingSeconds?: number;
         noExpiry?: true;
     };
+    /** Notices use the first explicit admin of the owning connection; never a guest/paired account. */
+    private noticeAdmin;
+    /** Best-effort private delivery. The caller retains its existing topic fallback and authority fences. */
+    private tryNoticeDm;
     confirmPublicWebLogin(info: {
         label: string;
         handle: string;
@@ -2405,6 +2418,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     private logConfigWarningsAtStartup;
     /** One-time upgrade migration; invalid YAML is never rewritten. */
+    private migrateNoticeDeliveryStorage;
+    private migrateOfficeStorage;
     private slimFleetConfigAtStartup;
     private writeFleetConfigBackup;
     private patchFleetDocument;
@@ -2994,7 +3009,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** Persistently enable advanced tips through the admin-only slash command. */
     unlockAdvancedTips(userId: string): boolean;
     /** Post one fresh nonce-armed tip in a known General channel. */
-    promptTip(generalName: string, adapter: ChannelAdapter, chatId: string, threadId?: string): Promise<"posted" | "empty" | "unavailable">;
+    promptTip(generalName: string, adapter: ChannelAdapter, chatId: string, threadId?: string, directUserId?: string): Promise<"posted" | "empty" | "unavailable">;
     private promptAdvancedTipUnlock;
     private sendTipToGeneral;
     private handleTipDismiss;

package/dist/fleet-manager.js

@@ -1,3 +1,6 @@
+import { hasLegacyOffice, normalizeOfficeStorage } from "./dashboard-permissions.js";
+import { loginNoticeMode, tipNoticeMode, normalizeNoticeDelivery, setNoticeMode } from "./notice-delivery.js";
+import { DEFAULT_REPLY_TRIGGERS } from "./reply-triggers.js";
 import { WorkingRecoveryCoordinator, WORKING_RECOVERY_KIND, buildWorkingRecoveryPrompt } from "./working-recovery.js";
 import { PUBLIC_TUNNEL_TOKEN_ENV, PUBLIC_TUNNEL_TOKEN_HINT, normalizePublicTunnelToken } from "./public-tunnel-config.js";
 import { humanOwnerObjectId, webHumanOrigin } from "./human-delivery-receipts.js";
@@ -160,6 +163,7 @@ import { OwnerCssStore } from "./web-owner-css-store.js";
 import { ThemeStore } from "./web-theme-store.js";
 import { OfficeStore, OfficeWriteLimiter } from "./web-office-store.js";
 import { OfficeSkinStore } from "./web-office-skins.js";
+import { OfficeActs } from "./web-office-acts.js";
 import { WebAppearance } from "./web-appearance.js";
 import { WebEffectLibrary } from "./web-effect-library.js";
 import { WebEffectTrials } from "./web-effect-trials.js";
@@ -1147,6 +1151,53 @@ export class FleetManager {
     officeSkinWrites = new OfficeWriteLimiter(undefined, { perWindow: 10, windowMs: 60_000 });
     /** How often a person may save the offices (PUT /ui/offices); memory only, as the appearance limiter. */
     officeWrites = new OfficeWriteLimiter();
+    officeActsInstance;
+    /** #2578: the agents' acts in the Office view (office_view / office_set), memory only; every change is `office_acts`. */
+    get officeActs() {
+        return (this.officeActsInstance ??= new OfficeActs({
+            offices: () => this.officeStore.list().offices,
+            pack: id => this.officeSkins.pack(id),
+            chart: () => { const c = this.orgChart(); return { names: Object.keys(c.instances), teams: c.teams }; },
+            people: () => this.officePeople(),
+            changed: acts => this.emitSseEvent("office_acts", { acts, now: Date.now() }),
+        }));
+    }
+    /**
+     * #2578: each instance's state as the org chart shows it (fleet-org.js orgState, from the same fields the status
+     * frame and the Needs-you list carry) and its display name (resolveInstanceIdentity, as getUiStatus) — read once.
+     */
+    officePeople() {
+        const needs = new Map();
+        for (const item of this.needsYouItems())
+            needs.set(item.instance, (needs.get(item.instance) ?? 0) + 1);
+        const classicRooms = new Map((this.classicChannels?.getAll() ?? []).map(ch => [ch.instanceName, ch]));
+        let profiles = null;
+        return {
+            stateOf: name => {
+                if (!this.isKnownInstance(name))
+                    return "missing";
+                const p = this.instancePresentation(name), status = this.getInstanceStatus(name);
+                if (p.state === "awaiting_input" || (needs.get(name) ?? 0) > 0)
+                    return "needs";
+                if (p.startup_phase === "queued" || p.startup_phase === "starting")
+                    return p.startup_phase;
+                if (status === "crashed" || status === "paused")
+                    return status;
+                if (status !== "running")
+                    return "stopped";
+                return p.execution_state === "stuck" || p.execution_state === "working" ? p.execution_state : "idle";
+            },
+            displayName: name => {
+                try {
+                    profiles ??= profileIdentities(this.dataDir);
+                    return resolveInstanceIdentity({ cfg: this.fleetConfig?.instances[name], classic: classicRooms.get(name), profile: profiles.get(name) }).display_name || undefined;
+                }
+                catch {
+                    return undefined;
+                }
+            },
+        };
+    }
     /** #1629: the theme tools, a person's reset and lock, and the one appearance rate limiter (shared with effects). */
     get webAppearance() {
         return (this.webAppearanceService ??= new WebAppearance(this.themeStore, () => this.fleetConfig?.web ?? null, () => { try {
@@ -3308,7 +3359,7 @@ export class FleetManager {
                 await data.respond(t("permission.denied"));
                 return;
             }
-            this.fleetConfig.defaults.tips = mode === "on";
+            setNoticeMode(this.fleetConfig, "tips", mode === "on");
             this.saveFleetConfig();
             await data.respond(t(mode === "on" ? "tips.enabled" : "tips.disabled"));
             return;
@@ -5098,6 +5149,7 @@ export class FleetManager {
     }
     classicBehaviorUpdate(instanceName) {
         return {
+            reply_triggers: this.classicChannels?.getReplyTriggersByInstance(instanceName, this.fleetConfig?.defaults?.reply_triggers) ?? DEFAULT_REPLY_TRIGGERS,
             tool_progress: this.classicChannels?.getToolProgressByInstance(instanceName, this.fleetConfig?.defaults?.tool_progress) ?? "off",
             reply_completion_guard: this.classicChannels?.getReplyCompletionGuardByInstance(instanceName, this.fleetConfig?.defaults?.reply_completion_guard) ?? true,
         };
@@ -6446,11 +6498,33 @@ export class FleetManager {
     getPublicWebStatus() {
         return this.publicWebLink?.status() ?? { state: "closed" };
     }
+    /** Notices use the first explicit admin of the owning connection; never a guest/paired account. */
+    noticeAdmin(adapterId) {
+        return this.adminListOf(adapterId)?.find(id => id.length > 0);
+    }
+    /** Best-effort private delivery. The caller retains its existing topic fallback and authority fences. */
+    async tryNoticeDm(adapter, userId, text) {
+        if (!userId || !adapter?.sendDirect)
+            return false;
+        try {
+            await withinBudget(adapter.sendDirect(userId, text, { disablePreview: true }), performance.now() + 2_000);
+            return true;
+        }
+        catch {
+            this.logger.info({ adapterId: adapter.id }, "Fleet notice DM failed; falling back to the topic");
+            return false;
+        }
+    }
     async confirmPublicWebLogin(info, current) {
         if (!current() || !this.publicOwnerCurrent(info.owner))
             throw new Error("public owner unavailable");
         const adapter = info.owner.binding;
-        await adapter.sendText(info.owner.chatId, t("web.public_login_notice", info.label, info.handle.slice(0, 8)), { threadId: info.owner.threadId, allowedMentions: { parse: [] } });
+        const text = t("web.public_login_notice", info.label, info.handle.slice(0, 8));
+        if (loginNoticeMode(this.fleetConfig?.web) !== "dm" || !await this.tryNoticeDm(adapter, info.owner.userId, text)) {
+            if (!current() || !this.publicOwnerCurrent(info.owner))
+                throw new Error("public owner changed");
+            await adapter.sendText(info.owner.chatId, text, { threadId: info.owner.threadId, allowedMentions: { parse: [] } });
+        }
         if (!current() || !this.publicOwnerCurrent(info.owner))
             throw new Error("public owner changed");
     }
@@ -6468,7 +6542,12 @@ export class FleetManager {
         if (!open)
             throw new Error("guest public sign-in unavailable");
         const adapter = open.owner.binding;
-        await adapter.sendText(open.owner.chatId, t("web.guest_public_login_notice", this.webPerson(info.account).name, info.label, this.guestScope(info.account).size, info.handle.slice(0, 8)), { threadId: open.owner.threadId, allowedMentions: { parse: [] } });
+        const text = t("web.guest_public_login_notice", this.webPerson(info.account).name, info.label, this.guestScope(info.account).size, info.handle.slice(0, 8));
+        if (loginNoticeMode(this.fleetConfig?.web) !== "dm" || !await this.tryNoticeDm(adapter, open.owner.userId, text)) {
+            if (!admitted())
+                throw new Error("guest public sign-in changed");
+            await adapter.sendText(open.owner.chatId, text, { threadId: open.owner.threadId, allowedMentions: { parse: [] } });
+        }
         if (!admitted())
             throw new Error("guest public sign-in changed");
     }
@@ -7306,17 +7385,26 @@ export class FleetManager {
     }
     /** Called by the sign-in endpoint: a login the operator did not make should be visible to them. */
     onWebLogin(info) {
-        // #1920 §2.3: a guest's sign-in is always said in General (web.notify_login is the operator's own sign-ins): who,
-        // and how many agents they now reach — admins stay aware of everyone who is not one of them.
-        if (info.tier === "guest" && info.owner) {
-            this.notifyFleetError(t("web.guest_login_notice", this.webPerson(info.owner).name, info.label, this.guestScope(info.owner).size, info.handle.slice(0, 8)));
+        // Keep the existing false policy: guest and public-link security notices remain mandatory.
+        const guest = info.tier === "guest" && info.owner;
+        if (!guest && this.fleetConfig?.web?.notify_login === false)
+            return;
+        const text = guest
+            ? t("web.guest_login_notice", this.webPerson(info.owner).name, info.label, this.guestScope(info.owner).size, info.handle.slice(0, 8))
+            : t("web.login_notice", info.label, info.surface, info.handle.slice(0, 8));
+        if (loginNoticeMode(this.fleetConfig?.web) === "dm") {
+            const adapterId = info.owner?.adapterId;
+            const adapter = adapterId ? this.adapters.get(adapterId) : undefined;
+            // A local guest's own account must never receive the admin's security notice.
+            const userId = guest ? (adapterId ? this.noticeAdmin(adapterId) : undefined)
+                : info.owner && this.isFleetAdmin(info.owner.userId, adapterId) ? info.owner.userId : undefined;
+            void this.tryNoticeDm(adapter, userId, text).then(sent => { if (!sent)
+                this.notifyFleetError(text); })
+                .catch(() => this.logger.warn("Web sign-in notice could not be delivered"));
             return;
         }
-        if (this.fleetConfig?.web?.notify_login === false)
-            return;
-        // The session handle makes each notice distinct: notifyFleetError throttles by text, and a second
-        // sign-in from the same kind of browser is exactly the one the operator most needs to hear about.
-        this.notifyFleetError(t("web.login_notice", info.label, info.surface, info.handle.slice(0, 8)));
+        // Exactly the old topic path, including the session-handle throttle key.
+        this.notifyFleetError(text);
     }
     getDashboardAccess() {
         return { ready: this.healthServerListening, token: this.webToken };
@@ -11122,7 +11210,7 @@ export class FleetManager {
         if (!ipc || !fleetRequestId)
             return;
         const type = String(msg.type);
-        const responseType = isCanvasWorkerTool(type.replace(/^fleet_/, "")) ? "fleet_web_theme_response"
+        const responseType = isCanvasWorkerTool(type.replace(/^fleet_/, "")) || type === "fleet_office_view" || type === "fleet_office_set" ? "fleet_web_theme_response"
             : type.startsWith("fleet_schedule_") ? "fleet_schedule_response"
                 : type.startsWith("fleet_decision_") ? "fleet_decision_response"
                     : type === "fleet_task" ? "fleet_task_response"
@@ -11176,7 +11264,8 @@ export class FleetManager {
             || type === "fleet_get_web_appearance" || type === "fleet_preview_web_appearance"
             || type === "fleet_set_web_widget" || type === "fleet_remove_web_widget"
             || type === "fleet_set_web_ambient" || type === "fleet_clear_web_ambient"
-            || type === "fleet_export_web_mod" || type === "fleet_propose_web_mod") {
+            || type === "fleet_export_web_mod" || type === "fleet_propose_web_mod"
+            || type === "fleet_office_view" || type === "fleet_office_set") {
             this.handleWebTheme(name, msg);
             return;
         }
@@ -11197,7 +11286,8 @@ export class FleetManager {
             const result = tool === "get_web_appearance" || tool === "preview_web_appearance"
                 ? this.appearanceTools.handle(instanceName, tool, args)
                 : tool === "export_web_mod" || tool === "propose_web_mod" ? this.agentMods.handle(instanceName, tool, args)
-                    : this.webAppearance.handleTool(instanceName, tool, args);
+                    : tool === "office_view" || tool === "office_set" ? this.officeActs.handle(instanceName, tool, args)
+                        : this.webAppearance.handleTool(instanceName, tool, args);
             ipc.send({ type: "fleet_web_theme_response", fleetRequestId, result });
         }
         catch (err) {
@@ -11633,6 +11723,8 @@ export class FleetManager {
             return this.appearanceTools.handle(instance, tool, args);
         if (tool === "export_web_mod" || tool === "propose_web_mod")
             return this.agentMods.handle(instance, tool, args);
+        if (tool === "office_view" || tool === "office_set")
+            return this.officeActs.handle(instance, tool, args); // #2578
         return this.webAppearance.handleTool(instance, tool, args);
     }
     async handlePreviewEmojisHttp(instance, args) {
@@ -12067,6 +12159,23 @@ export class FleetManager {
             return;
         if (!this.savedFleetConfigSnapshot)
             this.savedFleetConfigSnapshot = structuredClone(this.fleetConfig);
+        normalizeNoticeDelivery(this.fleetConfig);
+        normalizeOfficeStorage(this.fleetConfig);
+        explicitPatches = explicitPatches.flatMap(patch => {
+            const path = patch.path;
+            if (path.at(-2) === "dashboard" && path.at(-1) === "office" && !patch.remove) {
+                return [{ ...patch, path: [...path.slice(0, -2), "office_access"] }, { path, remove: true }];
+            }
+            if (path.at(-1) === "dashboard" && patch.value && typeof patch.value === "object" && Object.hasOwn(patch.value, "office")) {
+                const { office, ...dashboard } = patch.value;
+                return [{ ...patch, value: dashboard }, { path: [...path.slice(0, -1), "office_access"], value: office, remove: office === null }];
+            }
+            if (patch.path.join(".") === "web.notify_login" && patch.value === "dm")
+                return [{ ...patch, value: true }, { path: ["web", "notice_delivery", "login"], value: "dm" }];
+            if (patch.path.join(".") === "defaults.tips" && patch.value === "dm")
+                return [{ ...patch, value: true }, { path: ["web", "notice_delivery", "tips"], value: "dm" }];
+            return [patch];
+        });
         // Re-read immediately before patching so an unrelated concurrent/manual
         // edit is retained. Invalid concurrent YAML is never overwritten.
         const source = existsSync(this.configPath) ? readFileSync(this.configPath, "utf-8") : "{}\n";
@@ -12182,7 +12291,43 @@ export class FleetManager {
             this.logger.warn({ path: w.path }, `fleet.yaml: ${w.path ? `${w.path}: ` : ""}${w.message}`);
     }
     /** One-time upgrade migration; invalid YAML is never rewritten. */
+    migrateNoticeDeliveryStorage() {
+        if (this.fleetConfig && this.configPath && (this.fleetConfig.web?.notify_login === "dm" || this.fleetConfig.defaults.tips === "dm")
+            && validateFleetConfig(this.rawFleetConfig).valid) {
+            try {
+                this.writeFleetConfigBackup(readFileSync(this.configPath, "utf8"));
+                this.saveFleetConfig();
+                this.logger.info("Stored DM notice routing with downgrade-safe boolean fields");
+            }
+            catch (err) {
+                this.logger.warn({ err }, "Could not migrate DM notice routing; keeping the original file");
+            }
+        }
+    }
+    migrateOfficeStorage() {
+        if (!this.fleetConfig || !this.configPath || !hasLegacyOffice(this.rawFleetConfig) || !validateFleetConfig(this.rawFleetConfig).valid)
+            return;
+        try {
+            this.writeFleetConfigBackup(readFileSync(this.configPath, "utf8"));
+            const patches = [];
+            const raw = this.rawFleetConfig;
+            for (const [path, item] of [[["defaults"], raw.defaults], ...Object.entries(raw.instances ?? {}).map(([name, value]) => [["instances", name], value])]) {
+                if (!item?.dashboard || !Object.hasOwn(item.dashboard, "office"))
+                    continue;
+                patches.push({ path: [...path, "dashboard", "office"], remove: true });
+                if (!Object.hasOwn(item, "office_access") && typeof item.dashboard.office === "boolean")
+                    patches.push({ path: [...path, "office_access"], value: item.dashboard.office });
+            }
+            this.saveFleetConfig(patches);
+            this.logger.info("Stored Office access outside dashboard for downgrade compatibility");
+        }
+        catch (err) {
+            this.logger.warn({ err }, "Could not migrate Office access; keeping the original file");
+        }
+    }
     slimFleetConfigAtStartup() {
+        this.migrateOfficeStorage();
+        this.migrateNoticeDeliveryStorage();
         const redundantPaths = collectRedundantInstanceDefaultPaths(this.rawFleetConfig);
         if (redundantPaths.length === 0)
             return;
@@ -12405,6 +12550,7 @@ export class FleetManager {
             this.effectToolsService?.forget(name);
             this.mods.forgetInstance(name);
             this.agentMods.forget(name);
+            this.officeActsInstance?.forget(name);
         }
         catch (err) {
             this.logger.warn({ err: err.message, name }, "Dropping a removed instance's web theme failed");
@@ -14782,14 +14928,14 @@ export class FleetManager {
         }
     }
     /** Post one fresh nonce-armed tip in a known General channel. */
-    async promptTip(generalName, adapter, chatId, threadId) {
+    async promptTip(generalName, adapter, chatId, threadId, directUserId) {
         const state = this.readTipState();
         if (!state)
             return "unavailable";
         if (!state.advancedUnlocked
             && visibleTipLevels(true).has("advanced")
             && canUnlockAdvancedTips(state.dismissed)) {
-            return await this.promptAdvancedTipUnlock(generalName, adapter, chatId, threadId)
+            return await this.promptAdvancedTipUnlock(generalName, adapter, chatId, threadId, directUserId)
                 ? "posted"
                 : "unavailable";
         }
@@ -14805,6 +14951,7 @@ export class FleetManager {
             chatId,
             threadId,
             message: this.formatTip(tip),
+            ...(directUserId ? { deliver: (choices) => withinBudget(adapter.sendDirect(directUserId, this.formatTip(tip), { choices, disablePreview: true }), performance.now() + 5_000) } : {}),
             choices: [
                 { action: "dismiss", label: t("tips.dismiss") },
                 { action: "confused", label: t("tips.confused") },
@@ -14816,7 +14963,7 @@ export class FleetManager {
         });
         return nonce ? "posted" : "unavailable";
     }
-    async promptAdvancedTipUnlock(generalName, adapter, chatId, threadId) {
+    async promptAdvancedTipUnlock(generalName, adapter, chatId, threadId, directUserId) {
         const nonce = await this.postNonceButtonPrompt({
             prefix: TIP_UNLOCK_CALLBACK_PREFIX,
             alertType: "tip",
@@ -14826,6 +14973,7 @@ export class FleetManager {
             chatId,
             threadId,
             message: t("tips.advanced.unlock_prompt"),
+            ...(directUserId ? { deliver: (choices) => withinBudget(adapter.sendDirect(directUserId, t("tips.advanced.unlock_prompt"), { choices, disablePreview: true }), performance.now() + 5_000) } : {}),
             choices: [{ action: "unlock", label: t("tips.advanced.unlock") }],
             expiredText: t("tips.advanced.expired"),
             // No allowAnyUser: unlocking changes a persistent setting, which typed and slash `/tips advanced on` reserve for a
@@ -14845,6 +14993,15 @@ export class FleetManager {
         const topicId = this.fleetConfig?.instances[generalName]?.topic_id;
         if (!adapter || !chatId)
             return;
+        if (this.fleetConfig && tipNoticeMode(this.fleetConfig) === "dm" && adapter.sendDirect) {
+            const userId = this.noticeAdmin(adapter.id);
+            if (userId) {
+                const result = await this.promptTip(generalName, adapter, userId, undefined, userId);
+                if (result !== "unavailable")
+                    return;
+                // The failed prompt disarmed its nonce; a new topic prompt is safe.
+            }
+        }
         const result = await this.promptTip(generalName, adapter, chatId, topicId != null ? String(topicId) : undefined);
         if (result === "unavailable") {
             this.logger.warn({ generalName }, "Daily tip could not be posted");
@@ -17067,7 +17224,7 @@ export class FleetManager {
         // session only judges that verdict; it does not read the output for URLs or prompts.
         const flow = {
             backend,
-            command: info.install,
+            command: info.unattended ?? info.install,
             successPattern: /$^/,
             timeoutMs: 10 * 60 * 1000,
         };
@@ -18068,8 +18225,11 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             // its ping in the reference, not the text). One hop only: a reply to a message of ours that itself answered a bot
             // (or the sender) is a chain of bots answering each other — a mention still carries it on. A reply to our answer
             // to a person is the ordinary handoff, and is addressed.
-            const repliesToUs = !!adapterBotUserId && msg.replyToAuthorId === adapterBotUserId && msg.replyToChain !== true;
-            const isMentioned = (mentionTag && text.includes(mentionTag)) || repliesToUs;
+            const replyTriggers = this.classicChannels?.getReplyTriggers(channelId, msg.adapterId, this.fleetConfig?.defaults?.reply_triggers) ?? DEFAULT_REPLY_TRIGGERS;
+            const repliesToUs = replyTriggers && !!adapterBotUserId && msg.replyToAuthorId === adapterBotUserId && msg.replyToChain !== true;
+            // Snapshot/quoted content is context, never the forwarder's own mention.
+            const addressText = msg.source === "discord" ? (msg.humanOriginalBody ?? text) : text;
+            const isMentioned = (mentionTag && addressText.includes(mentionTag)) || repliesToUs;
             if (!isMentioned) {
                 // Bare attachment (no @mention) — already saved above; just acknowledge.
                 if (saved) {
@@ -20792,6 +20952,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             // mark every row done and tell the user "changes applied".
             return { rejected: why };
         }
+        this.migrateOfficeStorage();
+        this.migrateNoticeDeliveryStorage();
         if (canvasWorkerEnabled(oldConfig?.web) !== this.canvasWorkerEnabled()) {
             this.canvasWorkerSettingChanged();
         }