@songsid/agend 2.3.2-beta.3 → 2.3.2-beta.5

package/dist/dashboard-permissions.d.ts

@@ -6,17 +6,23 @@
  *
  * - `appearance`: its own look on the dashboard — theme, pictures, widgets, ambient, effects, mods it proposes;
  * - `task_board`: the task board (`task`, and `agend task …`);
- * - `web_settings`: Settings → Web appearance for the person (`get_web_settings`, `set_web_settings`).
+ * - `web_settings`: Settings → Web appearance for the person (`get_web_settings`, `set_web_settings`);
+ * - `office` (#2578), stored separately as `office_access`: its own character in Fleet → Org chart → Office — walking, a speech bubble, a pose
+ *   (`office_view`, `office_set`).
  *
  * Unset is allowed: a fleet that switches nothing off works as before, and the profile still decides what an agent
- * has. `false` takes the feature's tools away whatever the profile carries: refused at the fleet's checks
+ * has — except for a feature in OFF_UNLESS_ON (`office`), which is off until a person sets it true. `false` takes the feature's tools away whatever the profile carries: refused at the fleet's checks
  * (tool-permissions.ts's sinks, read at each call — no restart) and left out of the agent's tool menu from its next
  * start (AGEND_DASHBOARD_OFF, read by mcp-server). Like a profile, policy protection for the resolved identity, not
  * isolation between same-uid agents with a shell.
  */
-export declare const DASHBOARD_FEATURES: readonly ["appearance", "task_board", "web_settings"];
+export declare const DASHBOARD_FEATURES: readonly ["appearance", "task_board", "web_settings", "office"];
 export type DashboardFeature = typeof DASHBOARD_FEATURES[number];
-/** As written in fleet.yaml: each feature true (allowed), false (switched off) or absent (allowed). */
+/** The features a person switches on (#2578): absent (or null) is off for these, never allowed. */
+export declare const OFF_UNLESS_ON: ReadonlySet<DashboardFeature>;
+/** What a feature is when nothing (not the instance, not the defaults) says: allowed, or off for OFF_UNLESS_ON. */
+export declare const dashboardFeatureDefault: (feature: string) => boolean;
+/** As written in fleet.yaml: each feature true (allowed), false (switched off) or absent (allowed; off for OFF_UNLESS_ON). */
 export type DashboardAccess = Partial<Record<DashboardFeature, boolean>>;
 /**
  * What a NEW fleet.yaml says about the features (the user's decision, 2026-10-22): the task board is off until the
@@ -29,7 +35,7 @@ export declare const NEW_FLEET_DASHBOARD: Readonly<DashboardAccess>;
 export declare const DASHBOARD_FEATURE_TOOLS: Readonly<Record<DashboardFeature, readonly string[]>>;
 /** The feature a tool belongs to, or null for a tool no switch governs. */
 export declare function dashboardFeatureOf(tool: string): DashboardFeature | null;
-/** The features switched off (`false`) in an instance's `dashboard` as resolved; anything else allows. */
+/** The features switched off in an instance's `dashboard` as resolved: `false`, and an OFF_UNLESS_ON one not `true`. */
 export declare function dashboardFeaturesOff(access: unknown): DashboardFeature[];
 /** The refusal for `tool` when its feature is switched off in this resolved `dashboard` mapping, else null. */
 export declare function dashboardRefusal(access: unknown, tool: string): string | null;
@@ -52,9 +58,17 @@ export declare function dashboardAccessProblem(value: unknown): string | null;
  * the default — the same as absent (#2391 review: a literal `task_board: null` must not hide the default's `false`).
  */
 export declare function dashboardSwitches(value: unknown): DashboardAccess;
+/** Office lives beside dashboard so published rollback validators never see a new feature in that closed map. */
+export declare function officeAccessValue(config: any): unknown;
+export declare function dashboardAccessOf(config: any): DashboardAccess;
+/** Transitional dashboard.office input is accepted, but never written by a managed save. Canonical values win. */
+export declare function normalizeOfficeStorage(fleet: any): void;
+/** Accept an older Settings client, but project/save its Office edit using the canonical field. */
+export declare function officeInputPatch(value: Record<string, any>): Record<string, any>;
+export declare function hasLegacyOffice(fleet: any): boolean;
 /**
  * The features switched off in a fleet config for `name`: each feature's own switch where the instance has one, else
- * the default's, else allowed. `name` with no own `instances` entry (a ClassicBot identity) gets the defaults'.
+ * the default's, else allowed (off for OFF_UNLESS_ON). `name` with no own `instances` entry (a ClassicBot identity) gets the defaults'.
  */
 export declare function dashboardFeaturesOffIn(fleet: unknown, name: string): DashboardFeature[];
 /**

package/dist/dashboard-permissions.js

@@ -6,15 +6,21 @@
  *
  * - `appearance`: its own look on the dashboard — theme, pictures, widgets, ambient, effects, mods it proposes;
  * - `task_board`: the task board (`task`, and `agend task …`);
- * - `web_settings`: Settings → Web appearance for the person (`get_web_settings`, `set_web_settings`).
+ * - `web_settings`: Settings → Web appearance for the person (`get_web_settings`, `set_web_settings`);
+ * - `office` (#2578), stored separately as `office_access`: its own character in Fleet → Org chart → Office — walking, a speech bubble, a pose
+ *   (`office_view`, `office_set`).
  *
  * Unset is allowed: a fleet that switches nothing off works as before, and the profile still decides what an agent
- * has. `false` takes the feature's tools away whatever the profile carries: refused at the fleet's checks
+ * has — except for a feature in OFF_UNLESS_ON (`office`), which is off until a person sets it true. `false` takes the feature's tools away whatever the profile carries: refused at the fleet's checks
  * (tool-permissions.ts's sinks, read at each call — no restart) and left out of the agent's tool menu from its next
  * start (AGEND_DASHBOARD_OFF, read by mcp-server). Like a profile, policy protection for the resolved identity, not
  * isolation between same-uid agents with a shell.
  */
-export const DASHBOARD_FEATURES = ["appearance", "task_board", "web_settings"];
+export const DASHBOARD_FEATURES = ["appearance", "task_board", "web_settings", "office"];
+/** The features a person switches on (#2578): absent (or null) is off for these, never allowed. */
+export const OFF_UNLESS_ON = new Set(["office"]);
+/** What a feature is when nothing (not the instance, not the defaults) says: allowed, or off for OFF_UNLESS_ON. */
+export const dashboardFeatureDefault = (feature) => !OFF_UNLESS_ON.has(feature);
 /**
  * What a NEW fleet.yaml says about the features (the user's decision, 2026-10-22): the task board is off until the
  * person switches it on (Settings → defaults, or per agent). Written, visibly, by every path that creates the file —
@@ -34,6 +40,7 @@ export const DASHBOARD_FEATURE_TOOLS = {
     ],
     task_board: ["task"],
     web_settings: ["get_web_settings", "set_web_settings"],
+    office: ["office_view", "office_set"],
 };
 const FEATURE_OF = new Map(DASHBOARD_FEATURES.flatMap((f) => DASHBOARD_FEATURE_TOOLS[f].map((tool) => [tool, f])));
 /** The feature a tool belongs to, or null for a tool no switch governs. */
@@ -41,17 +48,20 @@ export function dashboardFeatureOf(tool) {
     return FEATURE_OF.get(tool) ?? null;
 }
 const isFeature = (k) => DASHBOARD_FEATURES.includes(k);
-/** The features switched off (`false`) in an instance's `dashboard` as resolved; anything else allows. */
+/** The features switched off in an instance's `dashboard` as resolved: `false`, and an OFF_UNLESS_ON one not `true`. */
 export function dashboardFeaturesOff(access) {
-    if (!access || typeof access !== "object" || Array.isArray(access))
-        return [];
-    return DASHBOARD_FEATURES.filter((f) => access[f] === false);
+    const a = access && typeof access === "object" && !Array.isArray(access) ? access : {};
+    return DASHBOARD_FEATURES.filter((f) => (OFF_UNLESS_ON.has(f) ? a[f] !== true : a[f] === false));
 }
 /** The refusal for `tool` when its feature is in `off`, else null. */
 function refusalFor(off, tool) {
     const feature = dashboardFeatureOf(tool);
     if (!feature || !off.includes(feature))
         return null;
+    if (OFF_UNLESS_ON.has(feature)) {
+        return `${tool} is not available to this instance: its dashboard feature "${feature}" is off until the person switches it on (${feature === "office" ? "office_access" : `dashboard.${feature}`}: true). `
+            + "Do not retry it; tell the person if you need it.";
+    }
     return `${tool} is not available to this instance: the person switched its dashboard feature "${feature}" off (dashboard.${feature}: false). `
         + "Do not retry it; tell the person if you need it.";
 }
@@ -106,15 +116,54 @@ export function dashboardSwitches(value) {
     }
     return out;
 }
+/** Office lives beside dashboard so published rollback validators never see a new feature in that closed map. */
+export function officeAccessValue(config) {
+    return config && Object.hasOwn(config, "office_access") ? config.office_access : config?.dashboard?.office;
+}
+export function dashboardAccessOf(config) {
+    const access = dashboardSwitches(config?.dashboard), office = officeAccessValue(config);
+    delete access.office;
+    if (typeof office === "boolean")
+        access.office = office;
+    return access;
+}
+/** Transitional dashboard.office input is accepted, but never written by a managed save. Canonical values win. */
+export function normalizeOfficeStorage(fleet) {
+    for (const config of [fleet?.defaults, ...Object.values(fleet?.instances ?? {})]) {
+        if (!config || typeof config !== "object" || Array.isArray(config))
+            continue;
+        const item = config;
+        if (!item.dashboard || typeof item.dashboard !== "object" || !Object.hasOwn(item.dashboard, "office"))
+            continue;
+        if (!Object.hasOwn(item, "office_access") && typeof item.dashboard.office === "boolean")
+            item.office_access = item.dashboard.office;
+        const { office: _office, ...dashboard } = item.dashboard;
+        item.dashboard = dashboard;
+    }
+}
+/** Accept an older Settings client, but project/save its Office edit using the canonical field. */
+export function officeInputPatch(value) {
+    const result = { ...value };
+    if (value.dashboard && typeof value.dashboard === "object" && !Array.isArray(value.dashboard) && Object.hasOwn(value.dashboard, "office")) {
+        const { office, ...dashboard } = value.dashboard;
+        result.dashboard = dashboard;
+        if (!Object.hasOwn(value, "office_access"))
+            result.office_access = office;
+    }
+    return result;
+}
+export function hasLegacyOffice(fleet) {
+    return [fleet?.defaults, ...Object.values(fleet?.instances ?? {})].some((item) => item?.dashboard && Object.hasOwn(item.dashboard, "office"));
+}
 /**
  * The features switched off in a fleet config for `name`: each feature's own switch where the instance has one, else
- * the default's, else allowed. `name` with no own `instances` entry (a ClassicBot identity) gets the defaults'.
+ * the default's, else allowed (off for OFF_UNLESS_ON). `name` with no own `instances` entry (a ClassicBot identity) gets the defaults'.
  */
 export function dashboardFeaturesOffIn(fleet, name) {
     const f = fleet && typeof fleet === "object" ? fleet : {};
     const instances = f.instances && typeof f.instances === "object" ? f.instances : {};
     const inst = Object.hasOwn(instances, name) ? instances[name] : undefined; // a name is a key of its own, never an inherited one
-    return dashboardFeaturesOff({ ...dashboardSwitches(f.defaults?.dashboard), ...dashboardSwitches(inst?.dashboard) });
+    return dashboardFeaturesOff({ ...dashboardAccessOf(f.defaults), ...dashboardAccessOf(inst) });
 }
 /**
  * (a) An agent without the task board is not told to use it: the built-in workflow's task board section ("## Progress

package/dist/dashboard-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard-permissions.js","sourceRoot":"","sources":["../src/dashboard-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,cAAc,CAAU,CAAC;AAKxF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AAEnG,yHAAyH;AACzH,MAAM,CAAC,MAAM,uBAAuB,GAA0D;IAC5F,UAAU,EAAE;QACV,eAAe,EAAE,eAAe,EAAE,qBAAqB,EAAE,iBAAiB;QAC1E,oBAAoB,EAAE,wBAAwB;QAC9C,gBAAgB,EAAE,mBAAmB;QACrC,iBAAiB,EAAE,mBAAmB;QACtC,gBAAgB,EAAE,iBAAiB;QACnC,mBAAmB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,mBAAmB;KAClJ;IACD,UAAU,EAAE,CAAC,MAAM,CAAC;IACpB,YAAY,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;CACvD,CAAC;AAEF,MAAM,UAAU,GAA0C,IAAI,GAAG,CAC/D,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAU,CAAC,CAAC,CAChG,CAAC;AAEF,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACtC,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAAS,EAAyB,EAAE,CAAE,kBAAwC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAE9G,0GAA0G;AAC1G,MAAM,UAAU,oBAAoB,CAAC,MAAe;IAClD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9E,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,MAAkC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;AAC5F,CAAC;AAED,sEAAsE;AACtE,SAAS,UAAU,CAAC,GAAgC,EAAE,IAAY;IAChE,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,GAAG,IAAI,kFAAkF,OAAO,oBAAoB,OAAO,YAAY;UAC1I,kDAAkD,CAAC;AACzD,CAAC;AACD,+GAA+G;AAC/G,MAAM,UAAU,gBAAgB,CAAC,MAAe,EAAE,IAAY;IAC5D,OAAO,UAAU,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AACD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,IAAY,EAAE,IAAY;IAC3E,OAAO,UAAU,CAAC,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,eAAe,CAA6B,KAAmB,EAAE,GAAgC;IAC/G,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,wBAAwB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACvI,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAAE,OAAO,oBAAoB,CAAC,aAAa,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7F,IAAI,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,wBAAwB,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3E,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;QAAC,MAAM,CAAC,GAAI,KAAiC,CAAC,CAAC,CAAC,CAAC;QAAC,IAAI,OAAO,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAChI,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc,EAAE,IAAY;IACjE,MAAM,CAAC,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAgH,CAAC,CAAC,CAAC,EAAE,CAAC;IACrK,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAY,qDAAqD;IAC3I,OAAO,oBAAoB,CAAC,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,GAAG,iBAAiB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;AACtH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,OAAO,QAAQ,CAAC,OAAO,CAAC,qDAAqD,EAAE,EAAE,CAAC,CAAC;AACrF,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED,mHAAmH;AACnH,MAAM,CAAC,MAAM,oBAAoB,GAAG,wGAAwG;MACxI,oIAAoI;MACpI,yLAAyL;MACzL,oFAAoF,CAAC;AAEzF,yGAAyG;AACzG,MAAM,UAAU,mBAAmB,CAAC,MAAe,EAAE,KAAc;IACjE,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACpH,CAAC"}
+{"version":3,"file":"dashboard-permissions.js","sourceRoot":"","sources":["../src/dashboard-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,CAAU,CAAC;AAElG,mGAAmG;AACnG,MAAM,CAAC,MAAM,aAAa,GAAkC,IAAI,GAAG,CAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClG,mHAAmH;AACnH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,OAA2B,CAAC,CAAC;AAIrH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA8B,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AAEnG,yHAAyH;AACzH,MAAM,CAAC,MAAM,uBAAuB,GAA0D;IAC5F,UAAU,EAAE;QACV,eAAe,EAAE,eAAe,EAAE,qBAAqB,EAAE,iBAAiB;QAC1E,oBAAoB,EAAE,wBAAwB;QAC9C,gBAAgB,EAAE,mBAAmB;QACrC,iBAAiB,EAAE,mBAAmB;QACtC,gBAAgB,EAAE,iBAAiB;QACnC,mBAAmB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,mBAAmB;KAClJ;IACD,UAAU,EAAE,CAAC,MAAM,CAAC;IACpB,YAAY,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IACtD,MAAM,EAAE,CAAC,aAAa,EAAE,YAAY,CAAC;CACtC,CAAC;AAEF,MAAM,UAAU,GAA0C,IAAI,GAAG,CAC/D,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAU,CAAC,CAAC,CAChG,CAAC;AAEF,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACtC,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAAS,EAAyB,EAAE,CAAE,kBAAwC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAE9G,wHAAwH;AACxH,MAAM,UAAU,oBAAoB,CAAC,MAAe;IAClD,MAAM,CAAC,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClH,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,sEAAsE;AACtE,SAAS,UAAU,CAAC,GAAgC,EAAE,IAAY;IAChE,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,GAAG,IAAI,8DAA8D,OAAO,6CAA6C,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,OAAO,EAAE,WAAW;cACtM,kDAAkD,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,IAAI,kFAAkF,OAAO,oBAAoB,OAAO,YAAY;UAC1I,kDAAkD,CAAC;AACzD,CAAC;AACD,+GAA+G;AAC/G,MAAM,UAAU,gBAAgB,CAAC,MAAe,EAAE,IAAY;IAC5D,OAAO,UAAU,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AACD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,IAAY,EAAE,IAAY;IAC3E,OAAO,UAAU,CAAC,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,eAAe,CAA6B,KAAmB,EAAE,GAAgC;IAC/G,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,wBAAwB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACvI,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAAE,OAAO,oBAAoB,CAAC,aAAa,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7F,IAAI,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,wBAAwB,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3E,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;QAAC,MAAM,CAAC,GAAI,KAAiC,CAAC,CAAC,CAAC,CAAC;QAAC,IAAI,OAAO,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAChI,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,iBAAiB,CAAC,MAAW;IAC3C,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC;AAC7G,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,MAAW;IAC3C,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxF,OAAO,MAAM,CAAC,MAAM,CAAC;IACrB,IAAI,OAAO,MAAM,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACxD,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,kHAAkH;AAClH,MAAM,UAAU,sBAAsB,CAAC,KAAU;IAC/C,KAAK,MAAM,MAAM,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACjF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,SAAS;QAC7E,MAAM,IAAI,GAAG,MAA6B,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC;YAAE,SAAS;QAChH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QACpI,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;QACzD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;AACH,CAAC;AACD,mGAAmG;AACnG,MAAM,UAAU,gBAAgB,CAAC,KAA0B;IACzD,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IAC5B,IAAI,KAAK,CAAC,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1I,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;QACjD,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC;YAAE,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC;IAC5E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,KAAU;IACxC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAS,EAAE,EAAE,CAAC,IAAI,EAAE,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AACrJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc,EAAE,IAAY;IACjE,MAAM,CAAC,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAgH,CAAC,CAAC,CAAC,EAAE,CAAC;IACrK,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAY,qDAAqD;IAC3I,OAAO,oBAAoB,CAAC,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,OAAO,QAAQ,CAAC,OAAO,CAAC,qDAAqD,EAAE,EAAE,CAAC,CAAC;AACrF,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED,mHAAmH;AACnH,MAAM,CAAC,MAAM,oBAAoB,GAAG,wGAAwG;MACxI,oIAAoI;MACpI,yLAAyL;MACzL,oFAAoF,CAAC;AAEzF,yGAAyG;AACzG,MAAM,UAAU,mBAAmB,CAAC,MAAe,EAAE,KAAc;IACjE,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACpH,CAAC"}

package/dist/fleet-manager.d.ts

@@ -65,6 +65,7 @@ import { OwnerCssStore } from "./web-owner-css-store.js";
 import { ThemeStore } from "./web-theme-store.js";
 import { OfficeStore, OfficeWriteLimiter } from "./web-office-store.js";
 import { OfficeSkinStore } from "./web-office-skins.js";
+import { OfficeActs } from "./web-office-acts.js";
 import { WebAppearance } from "./web-appearance.js";
 import { WebEffectLibrary } from "./web-effect-library.js";
 import { WebEffectTrials } from "./web-effect-trials.js";
@@ -84,6 +85,7 @@ import { type CrossInstanceRecord, type XmsgVisibility } from "./search/search-d
 import { WebSettingsTools } from "./web-settings-tools.js";
 import { type Delegation, type TrafficItem } from "./fleet-traffic.js";
 import { WebBackendLogins, type SignInTarget } from "./web-backend-login.js";
+import { BrowserBackendSignIns } from "./browser-backend-signins.js";
 import { type RawConfigPatch } from "./settings-api.js";
 import { type AgentEndpointContext } from "./agent-endpoint.js";
 import { ClassicChannelManager } from "./classic-channel-manager.js";
@@ -245,6 +247,7 @@ export declare const CLI_ENV_PROBE_DEADLINE_MS = 16000;
  * started ten CLIs together, saturated the CPU, and healthy starts then missed
  * their startup budget — which used to cost the user their conversation. Cores
  * bound how many can actually make progress; memory bounds how many fit.
+ * `cores` is what this process may use (cpuset and cgroup quota, #749), not the host's count.
  */
 export declare function deriveSpawnConcurrency(freeMemMB: number, cores: number): number;
 /** #2499 review: one line of Settings → Guests' Recent changes (guestOverview), from the event log. */
@@ -453,6 +456,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private pendingBackendSelects;
     /** nonce → pending button prompt (hang restart, interactive assist, clean-exit restart). */
     private pendingNonceButtons;
+    /** #2598 B2: the kiro moves waiting on a fleet admin's Confirm in General, by prompt nonce. */
+    private pendingKiroMigrations;
     /** #1386 "Needs you": the list, its live chat messages and Acknowledge. Started with the fleet (finishStartup). */
     private needsYou;
     /** When the fleet first saw an instance crashed, for its "Needs you" age; cleared when it is not. */
@@ -658,6 +663,14 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     readonly officeSkinWrites: OfficeWriteLimiter;
     /** How often a person may save the offices (PUT /ui/offices); memory only, as the appearance limiter. */
     readonly officeWrites: OfficeWriteLimiter;
+    private officeActsInstance?;
+    /** #2578: the agents' acts in the Office view (office_view / office_set), memory only; every change is `office_acts`. */
+    get officeActs(): OfficeActs;
+    /**
+     * #2578: each instance's state as the org chart shows it (fleet-org.js orgState, from the same fields the status
+     * frame and the Needs-you list carry) and its display name (resolveInstanceIdentity, as getUiStatus) — read once.
+     */
+    private officePeople;
     /** #1629: the theme tools, a person's reset and lock, and the one appearance rate limiter (shared with effects). */
     get webAppearance(): WebAppearance;
     private effectLibraryInstance?;
@@ -755,6 +768,21 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** Exact configured effect owners; this does not depend on prompt location. */
     private settingsChatAuthority;
     private promptSettingsChange;
+    private kiroMigrateDeps;
+    /**
+     * #2598 B2, migrate_kiro_instance: judge the move, then ask in General for a fleet admin's Confirm. Nothing changes
+     * here; the move runs on the Confirm (handleKiroMigrateCallback), judged again then.
+     */
+    requestKiroMigration(name: string, startFresh: boolean): Promise<{
+        ok: true;
+        text: string;
+        classic_conversation: string | null;
+    } | {
+        ok: false;
+        error: string;
+    }>;
+    /** A fleet admin's Confirm or Cancel on a kiro move. Any fleet admin (the default nonce authorization), in General. */
+    private handleKiroMigrateCallback;
     private handleSettingsChangeCallback;
     startSettingsConfirmationControl(): Promise<void>;
     private get webToken();
@@ -1633,6 +1661,10 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
         remainingSeconds?: number;
         noExpiry?: true;
     };
+    /** Notices use the first explicit admin of the owning connection; never a guest/paired account. */
+    private noticeAdmin;
+    /** Best-effort private delivery. The caller retains its existing topic fallback and authority fences. */
+    private tryNoticeDm;
     confirmPublicWebLogin(info: {
         label: string;
         handle: string;
@@ -2397,6 +2429,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * non-identity instance leaves are canonicalized to inheritance afterward.
      */
     saveFleetConfig(explicitPatches?: RawConfigPatch[]): void;
+    /** A permission tightening is effective when its save returns, independently of the later apply job or IPC. */
+    private refreshSavedDashboardPermissions;
     /** Why the config written to `candidate` must not replace fleet.yaml, or null: it does not load, or it adds errors. */
     private savedFleetConfigProblem;
     /**
@@ -2405,6 +2439,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     private logConfigWarningsAtStartup;
     /** One-time upgrade migration; invalid YAML is never rewritten. */
+    private migrateNoticeDeliveryStorage;
+    private migrateOfficeStorage;
     private slimFleetConfigAtStartup;
     private writeFleetConfigBackup;
     private patchFleetDocument;
@@ -2875,6 +2911,8 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * without one); codex "unrecorded" (its rollouts don't say which login wrote them).
      */
     private usageProfileOf;
+    /** #2122 §10: a Kiro instance with a credential profile writes its classic store in that profile's home. */
+    private kiroDbPathOf;
     /** #2122: the fleet's day boundary zone — defaults.scheduler.default_timezone, else this host's. */
     usageZone(): string;
     /**
@@ -2994,7 +3032,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     /** Persistently enable advanced tips through the admin-only slash command. */
     unlockAdvancedTips(userId: string): boolean;
     /** Post one fresh nonce-armed tip in a known General channel. */
-    promptTip(generalName: string, adapter: ChannelAdapter, chatId: string, threadId?: string): Promise<"posted" | "empty" | "unavailable">;
+    promptTip(generalName: string, adapter: ChannelAdapter, chatId: string, threadId?: string, directUserId?: string): Promise<"posted" | "empty" | "unavailable">;
     private promptAdvancedTipUnlock;
     private sendTipToGeneral;
     private handleTipDismiss;
@@ -3355,6 +3393,13 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     private readonly loginWindow;
     private get webLogin();
+    private browserBackendSignInsInstance;
+    private structuredLoginCleanupFailed;
+    private readonly pendingBackendSince;
+    private browserSignInOwnerCurrent;
+    /** #2599: default-account controls share the exact writer reservation with chat/profile/install. */
+    get browserBackendSignIns(): BrowserBackendSignIns;
+    private needsYouBackendSignIns;
     /** #2233: sign-ins started from the web dashboard (local admin sessions), on the same controller as chat's. */
     private webBackendLoginsInstance;
     get webBackendLogins(): WebBackendLogins;
@@ -3648,6 +3693,11 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private cliEnvPath;
     /** Read the cached CLI env for a backend (a credential profile's own, when given), or null if missing/stale/unparseable. */
     private readCliEnv;
+    /**
+     * #2122 §10: the version the CLI probe last recorded for a backend — its cache file read whatever its age (the usage
+     * reader's version gate needs the last known version, not a fresh one); null when none was recorded. Never a probe.
+     */
+    private lastRecordedCliVersion;
     /** Return cached CLI versions immediately. Refresh is started after /sysinfo is sent. */
     getBackendCliVersionSnapshot(): BackendCliVersionSnapshot;
     /** Called only after the user-visible sysinfo send/respond has settled. */