@songsid/agend 2.3.2-beta.3 → 2.3.2-beta.5

package/dist/fleet-manager.js

@@ -1,3 +1,6 @@
+import { hasLegacyOffice, normalizeOfficeStorage } from "./dashboard-permissions.js";
+import { loginNoticeMode, tipNoticeMode, normalizeNoticeDelivery, setNoticeMode } from "./notice-delivery.js";
+import { DEFAULT_REPLY_TRIGGERS } from "./reply-triggers.js";
 import { WorkingRecoveryCoordinator, WORKING_RECOVERY_KIND, buildWorkingRecoveryPrompt } from "./working-recovery.js";
 import { PUBLIC_TUNNEL_TOKEN_ENV, PUBLIC_TUNNEL_TOKEN_HINT, normalizePublicTunnelToken } from "./public-tunnel-config.js";
 import { humanOwnerObjectId, webHumanOrigin } from "./human-delivery-receipts.js";
@@ -28,13 +31,16 @@ import { ProfileControlServer } from "./profile-control.js";
 import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync, accessSync, realpathSync, lstatSync, constants as fsConstants, closeSync } from "node:fs";
 import { atomicWriteFileSync } from "./atomic-write.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { freemem, totalmem, cpus, homedir } from "node:os";
+import { freemem, totalmem, homedir } from "node:os";
+import { effectiveCpuCount } from "./cpu-quota.js";
 import { createServer } from "node:http";
 import { Worker } from "node:worker_threads";
 import { ProbeWorkerPool } from "./probe-worker-pool.js";
 import { join, dirname, basename, delimiter, isAbsolute, relative, resolve as resolvePath } from "node:path";
 import { fileURLToPath } from "node:url";
+import { isDeepStrictEqual } from "node:util";
 import { getAgendHome, ensureWorkspaceGit } from "./paths.js";
+import { applyKiroMigration, kiroMigrationPrompt, planKiroMigration } from "./kiro-migrate.js";
 import { fleetLabel } from "./fleet-label.js";
 import { beginFullRestartProgress as persistFullRestartProgress, beginUpdateProgress as persistUpdateProgress, clearUpdateMarker, isUpdateInProgress, readUpdateProgress, sameUpdateMarker, setUpdateProgressStage, updateMarkerIdentity, updateProgressOperation, updateReceiptOf, } from "./update-marker.js";
 import { formatUpdateProgress } from "./update-progress.js";
@@ -53,7 +59,7 @@ const __dirname = dirname(__filename);
 const DEFAULT_OPEN_ACCESS = { mode: "open", allowed_users: [], max_pending_codes: 0, code_expiry_minutes: 0 };
 import { STATUS_EMOJI_CONFIG_KEYS, STATUS_EMOJI_KEYS, STATUS_EMOJI_SUGGESTIONS, TELEGRAM_REACTION_EMOJIS, builtinStatusEmojis, customEmojiValue, emojiImageUrl, normalizeEmoji, previewStatusEmojis, reactionForm, reactionMatchKey, resolveStatusEmojis, statusAvoidList, statusEmojiProblem, statusMatchKey, statusMatchKeys, textForm, } from "./status-emojis.js";
 import { isProbeableRouteTarget } from "./fleet-context.js";
-import { getEffectiveInstanceDefaults, loadFleetConfig, loadRawFleetConfig, DEFAULT_COST_GUARD, DEFAULT_DAILY_SUMMARY, DEFAULT_INSTANCE_CONFIG } from "./config.js";
+import { getEffectiveInstanceDefaults, loadFleetConfig, loadRawFleetConfig, DEFAULT_COST_GUARD, DEFAULT_DAILY_SUMMARY, DEFAULT_INSTANCE_CONFIG, autoGeneralInstanceConfig } from "./config.js";
 import { EventLog } from "./event-log.js";
 import { binaryProbe } from "./binary-probe.js";
 import { AVAILABILITY_STALE_MS, BackendAvailabilityStore, hostAvailabilityProbes } from "./backend-availability.js";
@@ -160,6 +166,7 @@ import { OwnerCssStore } from "./web-owner-css-store.js";
 import { ThemeStore } from "./web-theme-store.js";
 import { OfficeStore, OfficeWriteLimiter } from "./web-office-store.js";
 import { OfficeSkinStore } from "./web-office-skins.js";
+import { OfficeActs } from "./web-office-acts.js";
 import { WebAppearance } from "./web-appearance.js";
 import { WebEffectLibrary } from "./web-effect-library.js";
 import { WebEffectTrials } from "./web-effect-trials.js";
@@ -189,7 +196,7 @@ import { discordGeneralChannelId } from "./discord-general.js";
 import { parseEnvText } from "./env-file.js";
 import { isDisallowedIntentsError, isRejectedTokenError } from "./discord-permissions.js";
 import { filterUsageProviders, formatDiscordUsageActivity, getUsageSnapshot, handleUsageRequest, isUsagePath, usageProviderIdForBackend } from "./usage/usage-api.js";
-import { LOGIN_FLOWS, LOGIN_BACKEND_ALIASES } from "./login-flows.js";
+import { LOGIN_FLOWS, checkAuthStatus, LOGIN_BACKEND_ALIASES } from "./login-flows.js";
 import { LoginSession } from "./login-manager.js";
 import { runOnLoginShell } from "./login-shell.js";
 import { tightenInstanceDirs } from "./private-dir.js";
@@ -209,6 +216,10 @@ import { admitProfileLogin, LoginController, LOGIN_TOKEN_RESEND_PREFIX, POST_LOG
 import { WebBackendLogins, dashboardSignInSupported } from "./web-backend-login.js";
 import { runBeforeDeadline } from "./deadline.js";
 import { LoginWindowLock } from "./login-window-lock.js";
+import { BrowserBackendSignIns } from "./browser-backend-signins.js";
+import { createStructuredSignInTransport } from "./structured-signin-transport.js";
+import { ONBOARDING_BACKENDS, readPendingBackendSignIns } from "./backend-signin-pending.js";
+import { structuredSignInSupported } from "./structured-signin.js";
 import { handleSettingsRequest } from "./settings-api.js";
 import { setLocale, detectLocale, getLocale, t } from "./locale.js";
 import { recentChatContext } from "./log-tail.js";
@@ -272,6 +283,7 @@ import { PROVIDER_SECRET_SPECS, PUBLIC_TUNNEL_SECRET_SPEC, providerSecretSpec, p
 /** A self-restart is a whole service restart; 120s is the apply budget, not this. */
 const SELF_RESTART_DEADLINE_MS = 300_000;
 import { APPLY_FLEET_TARGET, ApplyJobStore, viewOf, } from "./apply-job.js";
+import { kiroHome } from "./backend/kiro-kas-store.js";
 import { CHAT_PROFILE_LOGIN_BACKENDS, credentialHomeSpec, credentialProfileHome, credentialProfileLogin, credentialProfileLoginCommand, credentialProfileStoreHome, credentialSwitchCarriesConversation, credentialSwitchStartsFresh, instanceCredentialProfile } from "./backend/credential-profile.js";
 import { carryClaudeConversation } from "./backend/claude-carry.js";
 import { mergeBackendOptions, profileKey, profileName, profileOf } from "./classic-bindings.js";
@@ -469,6 +481,10 @@ const OOM_RETRY_CALLBACK_PREFIX = "oom-retry:";
 const NEEDS_PAUSE_TTL_MS = 10_000;
 const HANG_CALLBACK_PREFIX = "hang:";
 const CLEAR_CONFIRM_CALLBACK_PREFIX = "clear-confirm:";
+/** #2598 B2: a kiro classic → TUI move's Confirm in General. "kiro-migrate:" (13) + 32 hex + ":confirm" (8) = 53 bytes. */
+const KIRO_MIGRATE_CALLBACK_PREFIX = "kiro-migrate:";
+/** Long enough for an admin to read the prompt; the move is judged again on the click. */
+const KIRO_MIGRATE_TIMEOUT_MS = 10 * 60_000;
 /**
  * The prompts the web dashboard also offers: the ones about an instance's own health, which a dashboard
  * user — holding the full-fleet web credential — may answer exactly as a fleet admin on the platform may.
@@ -564,6 +580,7 @@ export const CLI_ENV_PROBE_DEADLINE_MS = 16_000;
  * started ten CLIs together, saturated the CPU, and healthy starts then missed
  * their startup budget — which used to cost the user their conversation. Cores
  * bound how many can actually make progress; memory bounds how many fit.
+ * `cores` is what this process may use (cpuset and cgroup quota, #749), not the host's count.
  */
 export function deriveSpawnConcurrency(freeMemMB, cores) {
     const byMemory = Math.floor(freeMemMB / 300);
@@ -881,6 +898,8 @@ export class FleetManager {
     pendingBackendSelects = new Map();
     /** nonce → pending button prompt (hang restart, interactive assist, clean-exit restart). */
     pendingNonceButtons = new Map();
+    /** #2598 B2: the kiro moves waiting on a fleet admin's Confirm in General, by prompt nonce. */
+    pendingKiroMigrations = new Map();
     /** #1386 "Needs you": the list, its live chat messages and Acknowledge. Started with the fleet (finishStartup). */
     needsYou = null;
     /** When the fleet first saw an instance crashed, for its "Needs you" age; cleared when it is not. */
@@ -1147,6 +1166,53 @@ export class FleetManager {
     officeSkinWrites = new OfficeWriteLimiter(undefined, { perWindow: 10, windowMs: 60_000 });
     /** How often a person may save the offices (PUT /ui/offices); memory only, as the appearance limiter. */
     officeWrites = new OfficeWriteLimiter();
+    officeActsInstance;
+    /** #2578: the agents' acts in the Office view (office_view / office_set), memory only; every change is `office_acts`. */
+    get officeActs() {
+        return (this.officeActsInstance ??= new OfficeActs({
+            offices: () => this.officeStore.list().offices,
+            pack: id => this.officeSkins.pack(id),
+            chart: () => { const c = this.orgChart(); return { names: Object.keys(c.instances), teams: c.teams }; },
+            people: () => this.officePeople(),
+            changed: acts => this.emitSseEvent("office_acts", { acts, now: Date.now() }),
+        }));
+    }
+    /**
+     * #2578: each instance's state as the org chart shows it (fleet-org.js orgState, from the same fields the status
+     * frame and the Needs-you list carry) and its display name (resolveInstanceIdentity, as getUiStatus) — read once.
+     */
+    officePeople() {
+        const needs = new Map();
+        for (const item of this.needsYouItems())
+            needs.set(item.instance, (needs.get(item.instance) ?? 0) + 1);
+        const classicRooms = new Map((this.classicChannels?.getAll() ?? []).map(ch => [ch.instanceName, ch]));
+        let profiles = null;
+        return {
+            stateOf: name => {
+                if (!this.isKnownInstance(name))
+                    return "missing";
+                const p = this.instancePresentation(name), status = this.getInstanceStatus(name);
+                if (p.state === "awaiting_input" || (needs.get(name) ?? 0) > 0)
+                    return "needs";
+                if (p.startup_phase === "queued" || p.startup_phase === "starting")
+                    return p.startup_phase;
+                if (status === "crashed" || status === "paused")
+                    return status;
+                if (status !== "running")
+                    return "stopped";
+                return p.execution_state === "stuck" || p.execution_state === "working" ? p.execution_state : "idle";
+            },
+            displayName: name => {
+                try {
+                    profiles ??= profileIdentities(this.dataDir);
+                    return resolveInstanceIdentity({ cfg: this.fleetConfig?.instances[name], classic: classicRooms.get(name), profile: profiles.get(name) }).display_name || undefined;
+                }
+                catch {
+                    return undefined;
+                }
+            },
+        };
+    }
     /** #1629: the theme tools, a person's reset and lock, and the one appearance rate limiter (shared with effects). */
     get webAppearance() {
         return (this.webAppearanceService ??= new WebAppearance(this.themeStore, () => this.fleetConfig?.web ?? null, () => { try {
@@ -1672,6 +1738,74 @@ export class FleetManager {
         // No platform confirmation was reachable. Host inspection is still required.
         this.logger.info({ id: view.id }, "Settings change requires local `agend settings confirm <id>`");
     }
+    kiroMigrateDeps() {
+        return {
+            agendHome: getAgendHome(),
+            fleetConfig: () => this.fleetConfig,
+            saveFleetConfig: () => this.saveFleetConfig(),
+            status: name => this.getInstanceStatus(name),
+            restart: name => this.restartSingleInstance(name, { explicit: true }),
+        };
+    }
+    /**
+     * #2598 B2, migrate_kiro_instance: judge the move, then ask in General for a fleet admin's Confirm. Nothing changes
+     * here; the move runs on the Confirm (handleKiroMigrateCallback), judged again then.
+     */
+    async requestKiroMigration(name, startFresh) {
+        const judged = planKiroMigration(this.kiroMigrateDeps(), name, startFresh);
+        if (!judged.ok)
+            return judged;
+        const general = this.findGeneralInstance();
+        const adapterId = general ? this.getInstanceAdapterId(general) : undefined;
+        const adapter = general ? this.getAdapterForInstance(general) : undefined;
+        const chatId = general ? this.getGroupIdForInstance(general) : undefined;
+        const topic = general ? String(this.fleetConfig?.instances[general]?.topic_id ?? "") : "";
+        if (!general || !adapterId || !adapter || !chatId)
+            return { ok: false, error: t("kiro_migrate.no_general") };
+        const { plan } = judged;
+        try {
+            const nonce = await this.postNonceButtonPromptOrThrow({
+                prefix: KIRO_MIGRATE_CALLBACK_PREFIX, alertType: "clear_confirm", instanceName: name, adapter, adapterId, chatId,
+                ...(topic ? { threadId: topic } : {}),
+                message: kiroMigrationPrompt(plan, this.getInstanceStatus(name) === "running"),
+                choices: [{ action: "confirm", label: t("kiro_migrate.confirm_button") }, { action: "cancel", label: t("kiro_migrate.cancel_button") }],
+                expiredText: t("kiro_migrate.expired", name),
+                timeoutMs: KIRO_MIGRATE_TIMEOUT_MS,
+            });
+            this.pendingKiroMigrations.set(nonce, plan);
+            const expiry = setTimeout(() => this.pendingKiroMigrations.delete(nonce), KIRO_MIGRATE_TIMEOUT_MS + 60_000);
+            expiry.unref?.();
+        }
+        catch (err) {
+            return { ok: false, error: `${t("kiro_migrate.no_general")} (${err.message})` };
+        }
+        return { ok: true, text: t("kiro_migrate.requested"), classic_conversation: plan.classicId };
+    }
+    /** A fleet admin's Confirm or Cancel on a kiro move. Any fleet admin (the default nonce authorization), in General. */
+    async handleKiroMigrateCallback(data, adapterId, adapter) {
+        const claimed = this.consumeNonceCallback(KIRO_MIGRATE_CALLBACK_PREFIX, /^kiro-migrate:([0-9a-f]{32}):(confirm|cancel)$/, data, adapterId, adapter);
+        if (claimed === null)
+            return false;
+        if (claimed === "consumed")
+            return true;
+        const { entry, action } = claimed;
+        const nonce = data.callbackData.slice(KIRO_MIGRATE_CALLBACK_PREFIX.length, KIRO_MIGRATE_CALLBACK_PREFIX.length + 32);
+        const plan = this.pendingKiroMigrations.get(nonce);
+        this.pendingKiroMigrations.delete(nonce);
+        const messageId = entry.messageId ?? data.messageId;
+        if (action === "cancel" || !plan) {
+            await this.retireNonceButtons(entry, messageId, t(plan ? "kiro_migrate.cancelled" : "kiro_migrate.expired", entry.instanceName));
+            return true;
+        }
+        this.eventLog?.insert(plan.name, "kiro_migrate", { classicId: plan.classicId, userId: data.userId });
+        await this.retireNonceButtons(entry, messageId, t("kiro_migrate.applying", plan.name));
+        const outcome = await applyKiroMigration(this.kiroMigrateDeps(), plan);
+        this.logger.info({ name: plan.name, ok: outcome.ok, classicId: plan.classicId }, "kiro classic → TUI move");
+        this.notifyFleetError(outcome.text);
+        if (outcome.ok)
+            this.notifyInstanceTopic(plan.name, outcome.text);
+        return true;
+    }
     async handleSettingsChangeCallback(data, adapterId, adapter) {
         const result = this.consumeNonceCallback("settings-confirm:", /^settings-confirm:([0-9a-f]{32}):(confirm|reject)$/, data, adapterId, adapter, undefined, (userId, entry) => entry.confirmationAdmin?.(userId) === true);
         if (!result)
@@ -2525,7 +2659,7 @@ export class FleetManager {
         const explicit = this.fleetConfig?.defaults?.startup?.concurrency;
         if (explicit != null)
             return Math.max(1, Math.min(20, explicit));
-        return deriveSpawnConcurrency(Math.round(freemem() / (1024 * 1024)), cpus().length);
+        return deriveSpawnConcurrency(Math.round(freemem() / (1024 * 1024)), effectiveCpuCount());
     }
     /** #1685: "elevated" or "critical" while host memory pressure slows or holds new agents; otherwise null (an
      *  unknown macOS reading — the advisory case — is unknown, so null too). */
@@ -3308,7 +3442,7 @@ export class FleetManager {
                 await data.respond(t("permission.denied"));
                 return;
             }
-            this.fleetConfig.defaults.tips = mode === "on";
+            setNoticeMode(this.fleetConfig, "tips", mode === "on");
             this.saveFleetConfig();
             await data.respond(t(mode === "on" ? "tips.enabled" : "tips.disabled"));
             return;
@@ -5098,6 +5232,7 @@ export class FleetManager {
     }
     classicBehaviorUpdate(instanceName) {
         return {
+            reply_triggers: this.classicChannels?.getReplyTriggersByInstance(instanceName, this.fleetConfig?.defaults?.reply_triggers) ?? DEFAULT_REPLY_TRIGGERS,
             tool_progress: this.classicChannels?.getToolProgressByInstance(instanceName, this.fleetConfig?.defaults?.tool_progress) ?? "off",
             reply_completion_guard: this.classicChannels?.getReplyCompletionGuardByInstance(instanceName, this.fleetConfig?.defaults?.reply_completion_guard) ?? true,
         };
@@ -6446,11 +6581,33 @@ export class FleetManager {
     getPublicWebStatus() {
         return this.publicWebLink?.status() ?? { state: "closed" };
     }
+    /** Notices use the first explicit admin of the owning connection; never a guest/paired account. */
+    noticeAdmin(adapterId) {
+        return this.adminListOf(adapterId)?.find(id => id.length > 0);
+    }
+    /** Best-effort private delivery. The caller retains its existing topic fallback and authority fences. */
+    async tryNoticeDm(adapter, userId, text) {
+        if (!userId || !adapter?.sendDirect)
+            return false;
+        try {
+            await withinBudget(adapter.sendDirect(userId, text, { disablePreview: true }), performance.now() + 2_000);
+            return true;
+        }
+        catch {
+            this.logger.info({ adapterId: adapter.id }, "Fleet notice DM failed; falling back to the topic");
+            return false;
+        }
+    }
     async confirmPublicWebLogin(info, current) {
         if (!current() || !this.publicOwnerCurrent(info.owner))
             throw new Error("public owner unavailable");
         const adapter = info.owner.binding;
-        await adapter.sendText(info.owner.chatId, t("web.public_login_notice", info.label, info.handle.slice(0, 8)), { threadId: info.owner.threadId, allowedMentions: { parse: [] } });
+        const text = t("web.public_login_notice", info.label, info.handle.slice(0, 8));
+        if (loginNoticeMode(this.fleetConfig?.web) !== "dm" || !await this.tryNoticeDm(adapter, info.owner.userId, text)) {
+            if (!current() || !this.publicOwnerCurrent(info.owner))
+                throw new Error("public owner changed");
+            await adapter.sendText(info.owner.chatId, text, { threadId: info.owner.threadId, allowedMentions: { parse: [] } });
+        }
         if (!current() || !this.publicOwnerCurrent(info.owner))
             throw new Error("public owner changed");
     }
@@ -6468,7 +6625,12 @@ export class FleetManager {
         if (!open)
             throw new Error("guest public sign-in unavailable");
         const adapter = open.owner.binding;
-        await adapter.sendText(open.owner.chatId, t("web.guest_public_login_notice", this.webPerson(info.account).name, info.label, this.guestScope(info.account).size, info.handle.slice(0, 8)), { threadId: open.owner.threadId, allowedMentions: { parse: [] } });
+        const text = t("web.guest_public_login_notice", this.webPerson(info.account).name, info.label, this.guestScope(info.account).size, info.handle.slice(0, 8));
+        if (loginNoticeMode(this.fleetConfig?.web) !== "dm" || !await this.tryNoticeDm(adapter, open.owner.userId, text)) {
+            if (!admitted())
+                throw new Error("guest public sign-in changed");
+            await adapter.sendText(open.owner.chatId, text, { threadId: open.owner.threadId, allowedMentions: { parse: [] } });
+        }
         if (!admitted())
             throw new Error("guest public sign-in changed");
     }
@@ -7306,17 +7468,26 @@ export class FleetManager {
     }
     /** Called by the sign-in endpoint: a login the operator did not make should be visible to them. */
     onWebLogin(info) {
-        // #1920 §2.3: a guest's sign-in is always said in General (web.notify_login is the operator's own sign-ins): who,
-        // and how many agents they now reach — admins stay aware of everyone who is not one of them.
-        if (info.tier === "guest" && info.owner) {
-            this.notifyFleetError(t("web.guest_login_notice", this.webPerson(info.owner).name, info.label, this.guestScope(info.owner).size, info.handle.slice(0, 8)));
+        // Keep the existing false policy: guest and public-link security notices remain mandatory.
+        const guest = info.tier === "guest" && info.owner;
+        if (!guest && this.fleetConfig?.web?.notify_login === false)
+            return;
+        const text = guest
+            ? t("web.guest_login_notice", this.webPerson(info.owner).name, info.label, this.guestScope(info.owner).size, info.handle.slice(0, 8))
+            : t("web.login_notice", info.label, info.surface, info.handle.slice(0, 8));
+        if (loginNoticeMode(this.fleetConfig?.web) === "dm") {
+            const adapterId = info.owner?.adapterId;
+            const adapter = adapterId ? this.adapters.get(adapterId) : undefined;
+            // A local guest's own account must never receive the admin's security notice.
+            const userId = guest ? (adapterId ? this.noticeAdmin(adapterId) : undefined)
+                : info.owner && this.isFleetAdmin(info.owner.userId, adapterId) ? info.owner.userId : undefined;
+            void this.tryNoticeDm(adapter, userId, text).then(sent => { if (!sent)
+                this.notifyFleetError(text); })
+                .catch(() => this.logger.warn("Web sign-in notice could not be delivered"));
             return;
         }
-        if (this.fleetConfig?.web?.notify_login === false)
-            return;
-        // The session handle makes each notice distinct: notifyFleetError throttles by text, and a second
-        // sign-in from the same kind of browser is exactly the one the operator most needs to hear about.
-        this.notifyFleetError(t("web.login_notice", info.label, info.surface, info.handle.slice(0, 8)));
+        // Exactly the old topic path, including the session-handle throttle key.
+        this.notifyFleetError(text);
     }
     getDashboardAccess() {
         return { ready: this.healthServerListening, token: this.webToken };
@@ -7686,7 +7857,8 @@ export class FleetManager {
         }
     }
     async startAllWithinDeadline(configPath, deadline) {
-        this.loginWindow.reopen(); // a stopAll → startAll restart must accept login windows again
+        if (!this.structuredLoginCleanupFailed)
+            this.loginWindow.reopen(); // a stopAll → startAll restart must accept login windows again
         this.loginController?.reopen();
         const startupStartedAt = Date.now();
         FleetManager.signalTarget = this;
@@ -7947,12 +8119,7 @@ export class FleetManager {
             mkdirSync(generalDir, { recursive: true, mode: 0o700 });
             const backendName = fleet.defaults.backend ?? "claude-code";
             this.ensureGeneralInstructions(generalDir, backendName, name);
-            fleet.instances[name] = {
-                ...DEFAULT_INSTANCE_CONFIG,
-                working_directory: generalDir,
-                general_topic: true,
-                channel_id: need.adapterId,
-            };
+            fleet.instances[name] = autoGeneralInstanceConfig(fleet.defaults, generalDir, need.adapterId); // #2598: its kiro_ui is the fleet's
             generalsCreated = true;
         }
         if (generalsCreated)
@@ -11122,7 +11289,7 @@ export class FleetManager {
         if (!ipc || !fleetRequestId)
             return;
         const type = String(msg.type);
-        const responseType = isCanvasWorkerTool(type.replace(/^fleet_/, "")) ? "fleet_web_theme_response"
+        const responseType = isCanvasWorkerTool(type.replace(/^fleet_/, "")) || type === "fleet_office_view" || type === "fleet_office_set" ? "fleet_web_theme_response"
             : type.startsWith("fleet_schedule_") ? "fleet_schedule_response"
                 : type.startsWith("fleet_decision_") ? "fleet_decision_response"
                     : type === "fleet_task" ? "fleet_task_response"
@@ -11176,7 +11343,8 @@ export class FleetManager {
             || type === "fleet_get_web_appearance" || type === "fleet_preview_web_appearance"
             || type === "fleet_set_web_widget" || type === "fleet_remove_web_widget"
             || type === "fleet_set_web_ambient" || type === "fleet_clear_web_ambient"
-            || type === "fleet_export_web_mod" || type === "fleet_propose_web_mod") {
+            || type === "fleet_export_web_mod" || type === "fleet_propose_web_mod"
+            || type === "fleet_office_view" || type === "fleet_office_set") {
             this.handleWebTheme(name, msg);
             return;
         }
@@ -11197,7 +11365,8 @@ export class FleetManager {
             const result = tool === "get_web_appearance" || tool === "preview_web_appearance"
                 ? this.appearanceTools.handle(instanceName, tool, args)
                 : tool === "export_web_mod" || tool === "propose_web_mod" ? this.agentMods.handle(instanceName, tool, args)
-                    : this.webAppearance.handleTool(instanceName, tool, args);
+                    : tool === "office_view" || tool === "office_set" ? this.officeActs.handle(instanceName, tool, args)
+                        : this.webAppearance.handleTool(instanceName, tool, args);
             ipc.send({ type: "fleet_web_theme_response", fleetRequestId, result });
         }
         catch (err) {
@@ -11633,6 +11802,8 @@ export class FleetManager {
             return this.appearanceTools.handle(instance, tool, args);
         if (tool === "export_web_mod" || tool === "propose_web_mod")
             return this.agentMods.handle(instance, tool, args);
+        if (tool === "office_view" || tool === "office_set")
+            return this.officeActs.handle(instance, tool, args); // #2578
         return this.webAppearance.handleTool(instance, tool, args);
     }
     async handlePreviewEmojisHttp(instance, args) {
@@ -12067,6 +12238,23 @@ export class FleetManager {
             return;
         if (!this.savedFleetConfigSnapshot)
             this.savedFleetConfigSnapshot = structuredClone(this.fleetConfig);
+        normalizeNoticeDelivery(this.fleetConfig);
+        normalizeOfficeStorage(this.fleetConfig);
+        explicitPatches = explicitPatches.flatMap(patch => {
+            const path = patch.path;
+            if (path.at(-2) === "dashboard" && path.at(-1) === "office" && !patch.remove) {
+                return [{ ...patch, path: [...path.slice(0, -2), "office_access"] }, { path, remove: true }];
+            }
+            if (path.at(-1) === "dashboard" && patch.value && typeof patch.value === "object" && Object.hasOwn(patch.value, "office")) {
+                const { office, ...dashboard } = patch.value;
+                return [{ ...patch, value: dashboard }, { path: [...path.slice(0, -1), "office_access"], value: office, remove: office === null }];
+            }
+            if (patch.path.join(".") === "web.notify_login" && patch.value === "dm")
+                return [{ ...patch, value: true }, { path: ["web", "notice_delivery", "login"], value: "dm" }];
+            if (patch.path.join(".") === "defaults.tips" && patch.value === "dm")
+                return [{ ...patch, value: true }, { path: ["web", "notice_delivery", "tips"], value: "dm" }];
+            return [patch];
+        });
         // Re-read immediately before patching so an unrelated concurrent/manual
         // edit is retained. Invalid concurrent YAML is never overwritten.
         const source = existsSync(this.configPath) ? readFileSync(this.configPath, "utf-8") : "{}\n";
@@ -12142,9 +12330,46 @@ export class FleetManager {
             },
         });
         this.rawFleetConfig = loadRawFleetConfig(this.configPath);
+        // The instance map is defaults-expanded. A defaults edit changes that view even when it writes no instance
+        // leaves. Re-resolve from the committed YAML so inherited values cannot become stale overrides on the next save.
+        // Keep the FleetConfig object itself: Settings and other request contexts hold it.
+        const resolvedInstances = loadFleetConfig(this.configPath).instances;
+        for (const [name, resolved] of Object.entries(resolvedInstances)) {
+            const current = this.fleetConfig.instances[name];
+            if (!current) {
+                this.fleetConfig.instances[name] = resolved;
+                continue;
+            }
+            // Lifecycle rollback fences hold these object identities across save. Refresh their values, not their owner.
+            for (const key of Object.keys(current))
+                if (!Object.hasOwn(resolved, key))
+                    delete current[key];
+            Object.assign(current, resolved);
+        }
         this.savedFleetConfigSnapshot = structuredClone(this.fleetConfig);
+        this.refreshSavedDashboardPermissions();
         this.logger.info({ path: this.configPath, strippedDefaults: redundantPaths.length }, "Saved fleet config (lossless patch)");
     }
+    /** A permission tightening is effective when its save returns, independently of the later apply job or IPC. */
+    refreshSavedDashboardPermissions() {
+        if (!this.fleetConfig)
+            return;
+        const classicNames = new Set(this.classicChannels?.getAll().map(ch => ch.instanceName) ?? []);
+        for (const [name, daemon] of this.daemons) {
+            const next = this.fleetConfig.instances[name] ?? (classicNames.has(name) ? getEffectiveInstanceDefaults(this.fleetConfig.defaults) : undefined);
+            const previous = daemon.getConfigSnapshot?.();
+            if (!next || !previous)
+                continue;
+            if (isDeepStrictEqual(previous.dashboard, next.dashboard) && previous.office_access === next.office_access)
+                continue;
+            // Only permissions are adopted here. Cold fields retain the live daemon's old snapshot, so reconcile still
+            // detects that they require a restart. MCP menus also watch the raw file; this updates the next spawn's env.
+            daemon.applyConfigUpdate({ dashboard: next.dashboard ?? null, office_access: next.office_access ?? null });
+            if (taskBoardSwitchedOn(previous.dashboard, next.dashboard)) {
+                this.admitTaskBoardNotice(name, TASK_BOARD_ON_NOTICE, `task-board-on:${name}:${Date.now()}`);
+            }
+        }
+    }
     /** Why the config written to `candidate` must not replace fleet.yaml, or null: it does not load, or it adds errors. */
     savedFleetConfigProblem(candidate) {
         let after;
@@ -12182,7 +12407,43 @@ export class FleetManager {
             this.logger.warn({ path: w.path }, `fleet.yaml: ${w.path ? `${w.path}: ` : ""}${w.message}`);
     }
     /** One-time upgrade migration; invalid YAML is never rewritten. */
+    migrateNoticeDeliveryStorage() {
+        if (this.fleetConfig && this.configPath && (this.fleetConfig.web?.notify_login === "dm" || this.fleetConfig.defaults.tips === "dm")
+            && validateFleetConfig(this.rawFleetConfig).valid) {
+            try {
+                this.writeFleetConfigBackup(readFileSync(this.configPath, "utf8"));
+                this.saveFleetConfig();
+                this.logger.info("Stored DM notice routing with downgrade-safe boolean fields");
+            }
+            catch (err) {
+                this.logger.warn({ err }, "Could not migrate DM notice routing; keeping the original file");
+            }
+        }
+    }
+    migrateOfficeStorage() {
+        if (!this.fleetConfig || !this.configPath || !hasLegacyOffice(this.rawFleetConfig) || !validateFleetConfig(this.rawFleetConfig).valid)
+            return;
+        try {
+            this.writeFleetConfigBackup(readFileSync(this.configPath, "utf8"));
+            const patches = [];
+            const raw = this.rawFleetConfig;
+            for (const [path, item] of [[["defaults"], raw.defaults], ...Object.entries(raw.instances ?? {}).map(([name, value]) => [["instances", name], value])]) {
+                if (!item?.dashboard || !Object.hasOwn(item.dashboard, "office"))
+                    continue;
+                patches.push({ path: [...path, "dashboard", "office"], remove: true });
+                if (!Object.hasOwn(item, "office_access") && typeof item.dashboard.office === "boolean")
+                    patches.push({ path: [...path, "office_access"], value: item.dashboard.office });
+            }
+            this.saveFleetConfig(patches);
+            this.logger.info("Stored Office access outside dashboard for downgrade compatibility");
+        }
+        catch (err) {
+            this.logger.warn({ err }, "Could not migrate Office access; keeping the original file");
+        }
+    }
     slimFleetConfigAtStartup() {
+        this.migrateOfficeStorage();
+        this.migrateNoticeDeliveryStorage();
         const redundantPaths = collectRedundantInstanceDefaultPaths(this.rawFleetConfig);
         if (redundantPaths.length === 0)
             return;
@@ -12405,6 +12666,7 @@ export class FleetManager {
             this.effectToolsService?.forget(name);
             this.mods.forgetInstance(name);
             this.agentMods.forget(name);
+            this.officeActsInstance?.forget(name);
         }
         catch (err) {
             this.logger.warn({ err: err.message, name }, "Dropping a removed instance's web theme failed");
@@ -14211,6 +14473,8 @@ export class FleetManager {
             return true;
         if (await this.handleSettingsChangeCallback(data, adapterId, adapter))
             return true;
+        if (await this.handleKiroMigrateCallback(data, adapterId, adapter))
+            return true;
         if (await this.handleDashboardCallback(data, adapterId, adapter))
             return true;
         if (await this.handleClassicApproval(data, adapterId, adapter))
@@ -14331,6 +14595,7 @@ export class FleetManager {
         const fleet = Object.entries(this.fleetConfig?.instances ?? {}).map(([name, cfg]) => ({
             name, backend: this.backendNameOf(name), workingDirectory: cfg.working_directory, ledgerPath: join(this.getInstanceDir(name), "cache-ledger.json"),
             claudeConfigDir: this.claudeConfigDirOf(name), profile: this.usageProfileOf(name, this.backendNameOf(name)),
+            kiroDbPath: this.kiroDbPathOf(name, this.backendNameOf(name)),
         }));
         const taken = new Set(fleet.map(i => i.name));
         const classic = (this.classicChannels?.getAll() ?? []).filter(ch => !taken.has(ch.instanceName)).map(ch => ({
@@ -14340,6 +14605,7 @@ export class FleetManager {
             ledgerPath: join(this.getInstanceDir(ch.instanceName), "cache-ledger.json"),
             claudeConfigDir: this.claudeConfigDirOf(ch.instanceName),
             profile: this.usageProfileOf(ch.instanceName, this.classicChannels?.getBackendByInstance(ch.instanceName, this.fleetConfig?.defaults?.backend) ?? this.fleetConfig?.defaults?.backend ?? "claude-code"),
+            kiroDbPath: this.kiroDbPathOf(ch.instanceName, this.classicChannels?.getBackendByInstance(ch.instanceName, this.fleetConfig?.defaults?.backend) ?? this.fleetConfig?.defaults?.backend ?? "claude-code"),
         }));
         return [...fleet, ...new Map(classic.map(c => [c.name, c])).values()];
     }
@@ -14360,8 +14626,19 @@ export class FleetManager {
             return this.credentialProfileOf(name, "claude-code") ?? "default";
         if (backend === "codex")
             return "unrecorded";
+        if (backend === "kiro-cli")
+            return this.credentialProfileOf(name, "kiro-cli") ?? "default";
+        if (backend === "grok" || backend === "muse" || backend === "opencode" || backend === "antigravity")
+            return "default";
         return undefined;
     }
+    /** #2122 §10: a Kiro instance with a credential profile writes its classic store in that profile's home. */
+    kiroDbPathOf(name, backend) {
+        if (backend !== "kiro-cli")
+            return undefined;
+        const profile = this.credentialProfileOf(name, "kiro-cli");
+        return profile ? join(credentialProfileStoreHome(getAgendHome(), "kiro-cli", profile), "data.sqlite3") : undefined;
+    }
     /** #2122: the fleet's day boundary zone — defaults.scheduler.default_timezone, else this host's. */
     usageZone() {
         return this.fleetConfig?.defaults?.scheduler?.default_timezone?.trim() || Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
@@ -14404,6 +14681,19 @@ export class FleetManager {
             rolloutsUnreadable: root => sharedRolloutIndex(root).unreadable,
             metaPath: join(this.dataDir, "cache-codex-rollouts.json"),
             zone: () => this.usageZone(),
+            // #2122 §10: Kiro's shared classic store (XDG_DATA_HOME, as kiro-cli resolves it) and its KIRO_HOME.
+            kiroDbPath: () => join(process.env.XDG_DATA_HOME?.trim() || join(homedir(), ".local", "share"), "kiro-cli", "data.sqlite3"),
+            kiroHome: () => kiroHome(),
+            // #2122 §10 step 3: grok keeps its sessions under ~/.grok (grok.ts reads them there too).
+            grokSessionsDir: () => join(homedir(), ".grok", "sessions"),
+            // #2122 §10 step 4: muse keeps sessions under $XDG_DATA_HOME/muse (else ~/.local/share/muse), as muse.ts reads them.
+            // #2122 §10 step 5: OpenCode's database, under XDG_DATA_HOME as opencode resolves it.
+            // #2122 §10 step 6: agy's conversations, under ~/.gemini as the antigravity backend reads its settings.
+            antigravityDir: () => join(homedir(), ".gemini", "antigravity-cli", "conversations"),
+            // The version AgEnD's CLI probe last recorded for agy: its cache file, whatever its age (never runs agy).
+            antigravityVersion: () => this.lastRecordedCliVersion("antigravity"),
+            opencodeDbPath: () => join(process.env.XDG_DATA_HOME?.trim() || join(homedir(), ".local", "share"), "opencode", "opencode.db"),
+            museSessionsDir: () => join(process.env.XDG_DATA_HOME?.trim() || join(homedir(), ".local", "share"), "muse", "sessions"),
             log: (level, msg, extra) => this.logger[level](extra ?? {}, msg),
         });
     }
@@ -14524,6 +14814,7 @@ export class FleetManager {
                 return this.deliveryOutbox.acknowledge(deliveryId, by);
             },
             tasks: () => this.needsYouTaskItems(),
+            backendSignIns: () => this.needsYouBackendSignIns(),
             taskAction: action => this.taskActionFromChat(action),
             settings: () => ({
                 liveMessage: this.fleetConfig?.needs_you?.live_message !== false,
@@ -14782,14 +15073,14 @@ export class FleetManager {
         }
     }
     /** Post one fresh nonce-armed tip in a known General channel. */
-    async promptTip(generalName, adapter, chatId, threadId) {
+    async promptTip(generalName, adapter, chatId, threadId, directUserId) {
         const state = this.readTipState();
         if (!state)
             return "unavailable";
         if (!state.advancedUnlocked
             && visibleTipLevels(true).has("advanced")
             && canUnlockAdvancedTips(state.dismissed)) {
-            return await this.promptAdvancedTipUnlock(generalName, adapter, chatId, threadId)
+            return await this.promptAdvancedTipUnlock(generalName, adapter, chatId, threadId, directUserId)
                 ? "posted"
                 : "unavailable";
         }
@@ -14805,6 +15096,7 @@ export class FleetManager {
             chatId,
             threadId,
             message: this.formatTip(tip),
+            ...(directUserId ? { deliver: (choices) => withinBudget(adapter.sendDirect(directUserId, this.formatTip(tip), { choices, disablePreview: true }), performance.now() + 5_000) } : {}),
             choices: [
                 { action: "dismiss", label: t("tips.dismiss") },
                 { action: "confused", label: t("tips.confused") },
@@ -14816,7 +15108,7 @@ export class FleetManager {
         });
         return nonce ? "posted" : "unavailable";
     }
-    async promptAdvancedTipUnlock(generalName, adapter, chatId, threadId) {
+    async promptAdvancedTipUnlock(generalName, adapter, chatId, threadId, directUserId) {
         const nonce = await this.postNonceButtonPrompt({
             prefix: TIP_UNLOCK_CALLBACK_PREFIX,
             alertType: "tip",
@@ -14826,6 +15118,7 @@ export class FleetManager {
             chatId,
             threadId,
             message: t("tips.advanced.unlock_prompt"),
+            ...(directUserId ? { deliver: (choices) => withinBudget(adapter.sendDirect(directUserId, t("tips.advanced.unlock_prompt"), { choices, disablePreview: true }), performance.now() + 5_000) } : {}),
             choices: [{ action: "unlock", label: t("tips.advanced.unlock") }],
             expiredText: t("tips.advanced.expired"),
             // No allowAnyUser: unlocking changes a persistent setting, which typed and slash `/tips advanced on` reserve for a
@@ -14845,6 +15138,15 @@ export class FleetManager {
         const topicId = this.fleetConfig?.instances[generalName]?.topic_id;
         if (!adapter || !chatId)
             return;
+        if (this.fleetConfig && tipNoticeMode(this.fleetConfig) === "dm" && adapter.sendDirect) {
+            const userId = this.noticeAdmin(adapter.id);
+            if (userId) {
+                const result = await this.promptTip(generalName, adapter, userId, undefined, userId);
+                if (result !== "unavailable")
+                    return;
+                // The failed prompt disarmed its nonce; a new topic prompt is safe.
+            }
+        }
         const result = await this.promptTip(generalName, adapter, chatId, topicId != null ? String(topicId) : undefined);
         if (result === "unavailable") {
             this.logger.warn({ generalName }, "Daily tip could not be posted");
@@ -16528,6 +16830,55 @@ export class FleetManager {
         }
         return this.loginController;
     }
+    browserBackendSignInsInstance = null;
+    structuredLoginCleanupFailed = false;
+    pendingBackendSince = new Map();
+    browserSignInOwnerCurrent(owner) {
+        const record = owner;
+        return !this.shuttingDown && typeof record.handle === "string" && this.webSessions?.findByHandle(record.handle) === owner
+            && this.isLocalAdminSession(record.handle);
+    }
+    /** #2599: default-account controls share the exact writer reservation with chat/profile/install. */
+    get browserBackendSignIns() {
+        return this.browserBackendSignInsInstance ??= new BrowserBackendSignIns({
+            dataDir: this.dataDir, lock: this.loginWindow,
+            current: owner => this.browserSignInOwnerCurrent(owner),
+            installed: async () => ONBOARDING_BACKENDS.filter(backend => this.isCliInstalled(backend)),
+            checkAuth: backend => checkAuthStatus(LOGIN_FLOWS[backend].authCheck),
+            checkConsoleAuth: () => checkAuthStatus(LOGIN_FLOWS.antigravity.authCheck),
+            transport: () => createStructuredSignInTransport(),
+            changed: (event, owner, launched) => {
+                try {
+                    this.eventLog?.insert("login", "browser_backend_signin", event);
+                }
+                catch { /* safe metadata only */ }
+                broadcastSseEvent(this.sseClients, "backend_login", {}, err => this.logger.debug({ err }, "backend_login event failed"));
+                this.needsYou?.poke();
+                if (!this.browserSignInOwnerCurrent(owner))
+                    return;
+                if (event.phase === "starting") {
+                    const record = owner;
+                    this.notifyFleetError(t("login.web_dashboard_notice", event.backend, record.label, record.handle.slice(0, 8)));
+                }
+                if (event.phase === "done") {
+                    void this.backendAvailability.refresh([event.backend], { force: true }).catch(() => { });
+                    if (launched)
+                        void this.recoverBackendInstances(event.backend, undefined, null).catch(() => this.logger.warn({ backend: event.backend }, "Post sign-in recovery failed"));
+                }
+            },
+        });
+    }
+    needsYouBackendSignIns() {
+        const pending = readPendingBackendSignIns(this.dataDir).pending;
+        for (const backend of this.pendingBackendSince?.keys() ?? [])
+            if (!pending.includes(backend))
+                this.pendingBackendSince.delete(backend);
+        return pending.map(backend => {
+            if (!this.pendingBackendSince.has(backend))
+                this.pendingBackendSince.set(backend, Date.now());
+            return { backend, since: this.pendingBackendSince.get(backend), browser: structuredSignInSupported(backend) };
+        });
+    }
     /** #2233: sign-ins started from the web dashboard (local admin sessions), on the same controller as chat's. */
     webBackendLoginsInstance = null;
     get webBackendLogins() {
@@ -16880,6 +17231,14 @@ export class FleetManager {
         // "cancelled" is the detail both legacy onDone handlers keep quiet about —
         // a stopping fleet must not announce "login failed — fleet shutdown".
         await Promise.all([
+            bounded(this.browserBackendSignInsInstance?.close().then(confirmed => {
+                if (confirmed)
+                    this.browserBackendSignInsInstance = null;
+                else {
+                    this.structuredLoginCleanupFailed = true;
+                    this.logger.error("Structured login cleanup failed; sign-in admission remains closed until the host is restarted.");
+                }
+            }), "browser-controls"),
             bounded(this.loginController?.shutdown(), "web-login"),
             bounded(this.activeInstall?.session.cancel("cancelled"), "install"),
         ]);
@@ -16896,6 +17255,13 @@ export class FleetManager {
             this.installHandoff = null;
             return t("login.cancelled", backend);
         }
+        const browserLogin = this.browserBackendSignInsInstance, browserBackend = browserLogin?.activeBackend;
+        if (browserLogin && browserBackend) {
+            const confirmed = await browserLogin.close();
+            if (confirmed)
+                this.browserBackendSignInsInstance = null;
+            return confirmed ? t("login.cancelled", browserBackend) : t("login.browser_cleanup_failed");
+        }
         if (this.loginController?.isActive())
             return this.loginController.cancel();
         return t("login.no_session");
@@ -17067,7 +17433,7 @@ export class FleetManager {
         // session only judges that verdict; it does not read the output for URLs or prompts.
         const flow = {
             backend,
-            command: info.install,
+            command: info.unattended ?? info.install,
             successPattern: /$^/,
             timeoutMs: 10 * 60 * 1000,
         };
@@ -18068,8 +18434,11 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             // its ping in the reference, not the text). One hop only: a reply to a message of ours that itself answered a bot
             // (or the sender) is a chain of bots answering each other — a mention still carries it on. A reply to our answer
             // to a person is the ordinary handoff, and is addressed.
-            const repliesToUs = !!adapterBotUserId && msg.replyToAuthorId === adapterBotUserId && msg.replyToChain !== true;
-            const isMentioned = (mentionTag && text.includes(mentionTag)) || repliesToUs;
+            const replyTriggers = this.classicChannels?.getReplyTriggers(channelId, msg.adapterId, this.fleetConfig?.defaults?.reply_triggers) ?? DEFAULT_REPLY_TRIGGERS;
+            const repliesToUs = replyTriggers && !!adapterBotUserId && msg.replyToAuthorId === adapterBotUserId && msg.replyToChain !== true;
+            // Snapshot/quoted content is context, never the forwarder's own mention.
+            const addressText = msg.source === "discord" ? (msg.humanOriginalBody ?? text) : text;
+            const isMentioned = (mentionTag && addressText.includes(mentionTag)) || repliesToUs;
             if (!isMentioned) {
                 // Bare attachment (no @mention) — already saved above; just acknowledge.
                 if (saved) {
@@ -18404,6 +18773,19 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         catch { /* missing / stale / corrupt */ }
         return null;
     }
+    /**
+     * #2122 §10: the version the CLI probe last recorded for a backend — its cache file read whatever its age (the usage
+     * reader's version gate needs the last known version, not a fresh one); null when none was recorded. Never a probe.
+     */
+    lastRecordedCliVersion(backend) {
+        try {
+            const v = JSON.parse(readFileSync(this.cliEnvPath(backend), "utf-8")).version;
+            return typeof v === "string" && v.trim() ? v.trim() : null;
+        }
+        catch {
+            return null;
+        }
+    }
     /** Return cached CLI versions immediately. Refresh is started after /sysinfo is sent. */
     getBackendCliVersionSnapshot() {
         const snapshot = {};
@@ -20792,6 +21174,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             // mark every row done and tell the user "changes applied".
             return { rejected: why };
         }
+        this.migrateOfficeStorage();
+        this.migrateNoticeDeliveryStorage();
         if (canvasWorkerEnabled(oldConfig?.web) !== this.canvasWorkerEnabled()) {
             this.canvasWorkerSettingChanged();
         }