agent-office-studio 0.2.0 → 0.4.0

package/server/index.js

@@ -2,6 +2,7 @@ import http from 'node:http';
 import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
+import os from 'node:os';
 import { spawn, spawnSync } from 'node:child_process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { WebSocketServer } from 'ws';
@@ -16,25 +17,31 @@ import { Terminals } from './terminal.js';
 import { snapshotTree, summarize, fileDiff } from './changes.js';
 import { Auth } from './auth.js';
 import { Leaderboard } from './leaderboard.js';
+import { Links } from './links.js';
+import { Settings } from './settings.js';
+import { Guests } from './guests.js';
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const APP = path.resolve(HERE, '..');
 const ROOT = path.resolve(process.env.OFFICE_ROOT || path.join(APP, '..'));
 const PORT = Number(process.env.PORT || 4317);
 const CLAUDE = process.env.CLAUDE_BIN || 'claude';
+// OFFICE_DATA is set by the agentoffice command; a clone keeps it beside the code.
 const DATA = path.resolve(process.env.OFFICE_DATA || path.join(APP, 'data'));
 const STATE_FILE = path.join(DATA, 'state.json');
 const DIST = path.join(APP, 'dist');
 const UPLOADS = path.join(DATA, 'uploads');
+// Each running job's office MCP config, token and all. On the command line it
+// would be readable by every process on the machine (`ps`); here it is a 0600
+// file in a 0700 folder, gone when the job's session closes. Leftovers from a
+// crash hold tokens that died with that server, so they are cleared at start.
+const MCP_DIR = path.join(DATA, 'mcp');
+fs.rmSync(MCP_DIR, { recursive: true, force: true });
 const auth = new Auth(DATA);
 const board = new Leaderboard(DATA, { onChange: () => send({ t: 'leaderboard', leaderboard: board.status() }) });
 const MAX_UPLOAD = 25 * 1024 * 1024;
 const MAX_LOG = 600;
 const MAX_CHAT = 300;
-const CHIEF_MODEL = process.env.CHIEF_MODEL || 'sonnet';
-// The daily standup, local time; "off" turns it off. Weekdays unless STANDUP_WEEKENDS=1.
-const STANDUP_AT = process.env.STANDUP_AT ?? '09:30';
-const STANDUP_WEEKENDS = process.env.STANDUP_WEEKENDS === '1';
 // After a turn ends, keep the session open briefly: a message that landed
 // at the last moment starts another turn instead of being lost.
 const GRACE_MS = 2500;
@@ -165,6 +172,12 @@ let state = { xp: 0, jobs: [], chat: [], channels: [], chiefCost: 0, dismissed:
 try {
   state = { ...state, ...JSON.parse(fs.readFileSync(STATE_FILE, 'utf8')) };
 } catch {}
+// What the boss sets on the Settings page, over the environment's defaults.
+// The context limit used to live at state.clearTokens.
+if (!state.settings || typeof state.settings !== 'object') state.settings = {};
+if (Number.isInteger(state.clearTokens) && !('tokenLimit' in state.settings)) state.settings.tokenLimit = state.clearTokens;
+delete state.clearTokens;
+const settings = new Settings(state.settings, () => save());
 if (!state.channels.some((c) => c.id === GENERAL)) state.channels.unshift({ id: GENERAL, name: GENERAL, createdAt: Date.now() });
 // Sat next to #general, and described even if someone had already opened a
 // channel by that name by hand. An explanation they wrote themselves stays.
@@ -234,7 +247,7 @@ for (const j of state.jobs) {
   if (j.status !== 'working') continue;
   if (j.sessionId) {
     Object.assign(j, {
-      status: 'queued', queuedAt: Date.now(), wantAgent: j.agentId, waiting: false,
+      status: 'queued', queuedAt: Date.now(), wantAgent: j.agentId, waiting: false, clearing: false,
       // An unread message stashed by deliver() comes along too, rather than
       // being written over by the notice about the restart.
       pending: [j.pending, 'The office restarted while you were working, which interrupted you. Pick up exactly where you left off.'].filter(Boolean).join('\n\n'),
@@ -272,16 +285,80 @@ function save() {
 // ---------- broadcasting ----------
 
 const clients = new Set();
+
+// Linked offices. Our agents as other offices see them: who, what they look
+// like, and what they're doing, down to the job title.
+// A job's title is the first line of its prompt, which can say more than the
+// boss means to share, so linked offices see only that an agent is busy.
+// OFFICE_SHARE_JOB_TITLES=1 sends the titles too.
+function presence() {
+  return hired().map((s) => {
+    const job = state.jobs.find((j) => j.agentId === s.id && j.status === 'working');
+    const doing =
+      state.dismissed.includes(s.id) ? 'away'
+      : standupNow?.who.includes(s.id) ? 'meeting'
+      : job ? 'working'
+      : chill?.who.includes(s.id) ? 'break'
+      : 'idle';
+    return { id: s.id, name: s.name, role: s.role, look: { shirt: s.shirt, hair: s.hair, skin: s.skin }, state: doing, job: job && settings.get('shareTitles') ? { title: job.title } : null };
+  });
+}
+// Set just below; anything broadcast before then has no guests to tell.
+let guests = null;
+const links = new Links(DATA, {
+  board,
+  presence,
+  onChange: () => {
+    guests?.linksChanged();
+    send({ t: 'links', ...links.status() });
+    send({ t: 'visitors', offices: links.visiting() });
+  },
+  onGuest: (link, msg) => guests?.onGuest(link, msg),
+});
+// Guest offices running jobs here, and our visits to offices that host us.
+guests = new Guests(DATA, {
+  links,
+  office: {
+    jobs: () => state.jobs,
+    createJob: (body, extra) => createJob(body, extra),
+    replyJob: (job, body) => replyJob(job, body),
+    stopJob: (job, why) => stopJob(job, why),
+    diff: async (job, p) => {
+      const cwd = repoPath(job.repo);
+      if (!cwd) throw Object.assign(new Error('That project folder is gone.'), { code: 404 });
+      return fileDiff(cwd, job.changes, p);
+    },
+    staff: () => STAFF,
+    modes: () => Object.fromEntries(Object.entries(MODES).map(([k, v]) => [k, v.label])),
+  },
+});
+// Broadcasts that can't change what an agent is doing don't need presence checked.
+const NOT_PRESENCE = new Set(['links', 'visitors', 'proc', 'leaderboard', 'auth', 'usage']);
+
 function send(msg) {
   const data = JSON.stringify(msg);
   for (const ws of clients) if (ws.readyState === 1) ws.send(data);
+  guests?.feed(msg);
+  if (!NOT_PRESENCE.has(msg.t)) links.sendPresence();
 }
 const publicJob = (j, tail = 40) => {
   const { stopRequested, lastTurn, sent, handoffs, ...rest } = j;
   return { ...rest, log: j.log.slice(-tail) };
 };
+// Whose office this is: the owner set in Settings (default OFFICE_OWNER), else the first name on this account.
+const ACCOUNT_NAME = (() => {
+  let full = '';
+  if (process.platform === 'darwin') full = spawnSync('/usr/bin/id', ['-F'], { encoding: 'utf8' }).stdout?.trim() || '';
+  return (full.split(/\s+/)[0] || os.userInfo().username || '').slice(0, 40);
+})();
+const owner = () => settings.get('owner') || ACCOUNT_NAME;
+function announceSettings() {
+  send({ t: 'settings', owner: owner(), settings: settings.status(), contextLimit: contextLimit() });
+}
 const snapshot = () => ({
   t: 'hello',
+  owner: owner(),
+  settings: settings.status(),
   staff: STAFF,
   modes: Object.fromEntries(Object.entries(MODES).map(([k, v]) => [k, v.label])),
   progress: progress(),
@@ -294,11 +371,14 @@ const snapshot = () => ({
   usage,
   auth: auth.status(),
   leaderboard: board.status(),
+  links: links.status(),
+  visitors: links.visiting(),
   procs,
   machine,
   dismissed: state.dismissed,
   voice: voiceReady(DATA),
   tts: { ...piperReady(DATA), replies: voiceOn() },
+  contextLimit: contextLimit(),
 });
 
 // ---------- what the agents are costing this machine ----------
@@ -461,9 +541,7 @@ const endChill = (id) => { if (chill?.id === id) chill = null; };
 // The model writes the small talk, but not for every chat: at most one per
 // BANTER_GAP, and BANTER=off turns it off. Anything else, or any failure,
 // comes back with no script and the browser uses a canned chat instead.
-const BANTER_ON = process.env.BANTER !== 'off';
-const BANTER_GAP = Number(process.env.BANTER_GAP_SECONDS ?? 120) * 1000;
-const BANTER_MODEL = process.env.BANTER_MODEL || 'haiku';
+const BANTER_GAP = () => settings.get('banterGap') * 1000;
 let banterAt = 0;
 
 function banterContext(pair) {
@@ -482,16 +560,16 @@ async function claimBanter(pair, game = false) {
   const c = claimChill(pair, game);
   if (!c) return { id: null };
   if (game) return { id: c.id };
-  if (!BANTER_ON || Date.now() - banterAt < BANTER_GAP) return { id: c.id };
+  if (!settings.get('banter') || Date.now() - banterAt < BANTER_GAP()) return { id: c.id };
   banterAt = Date.now();
   try {
-    const { lines, cost } = await writeBanter(banterContext(pair), { bin: CLAUDE, model: BANTER_MODEL, env: auth.env() });
+    const { lines, cost } = await writeBanter(banterContext(pair), { bin: CLAUDE, model: settings.get('banterModel'), env: auth.env() });
     state.chiefCost += cost || 0;
     send({ t: 'chief', busy: false, cost: state.chiefCost });
     c.at = Date.now();
     return { id: c.id, script: lines };
   } catch {
-    banterAt = Date.now() - BANTER_GAP + 30 * 1000;
+    banterAt = Date.now() - BANTER_GAP() + 30 * 1000;
     return { id: c.id };
   }
 }
@@ -518,12 +596,29 @@ const waits = new Map();
 const REPLY_WAIT_MS = 10 * 60 * 1000;
 // Long-lived jobs get resumed on every reply and pay for the whole history each
 // turn, so agents auto-compact earlier than the default. AGENT_COMPACT_PCT to tune.
-const AUTOCOMPACT_PCT = process.env.AGENT_COMPACT_PCT || '60';
+// Past this many tokens of context, the next message an agent gets carries a
+// nudge to clear_context. 0 turns the nudge off. AGENT_CLEAR_TOKENS to tune.
+// The limit set in the office wins over the environment's, which is the default.
+const clearTokens = () => settings.get('tokenLimit');
+const contextLimit = () => { const t = settings.status().find((x) => x.key === 'tokenLimit'); return { tokens: t.value, default: t.default, custom: t.custom }; };
+// The nudge goes with a message the session is about to pay its whole history
+// to read, once per session, and never to a guest (who has no such tool).
+function withClearHint(job, text) {
+  const limit = clearTokens();
+  if (!limit || job.guest || job.hinted || !(job.context >= limit)) return text;
+  job.hinted = true;
+  const k = Math.round(job.context / 1000);
+  return `${text}\n\n(Office note: your context is at ${k}k tokens, and every turn pays for all of it. If you are between steps, call clear_context with notes to yourself now, then end your turn.)`;
+}
 const OFFICE_TOOLS = [
   'mcp__office__office_roster', 'mcp__office__message_colleague', 'mcp__office__hand_off', 'mcp__office__flag_for_boss',
   'mcp__office__list_channels', 'mcp__office__create_channel', 'mcp__office__invite_to_channel', 'mcp__office__post_to_channel',
-  'mcp__office__restart_office',
+  'mcp__office__restart_office', 'mcp__office__clear_context',
 ];
+// A guest's job can see who is in and ask the boss, nothing more: no
+// messaging colleagues, handing off or channels. Enforced again in agentApi,
+// since full autonomy ignores --allowedTools.
+const GUEST_TOOLS = ['mcp__office__office_roster', 'mcp__office__flag_for_boss'];
 const endGrace = (job) => { clearTimeout(graces.get(job.id)); graces.delete(job.id); };
 
 function repoPath(name) {
@@ -540,7 +635,8 @@ function listRepos() {
     .sort((a, b) => a.localeCompare(b, undefined, { sensitivity: 'base' }));
 }
 
-function createJob({ repo, prompt, mode = 'edit', model = '', auto = false, agentId = '' }) {
+// `extra` tags a job, as a guest's (`from`, `guest`); it must be set before the job can start.
+function createJob({ repo, prompt, mode = 'edit', model = '', auto = false, agentId = '' }, extra = {}) {
   if (!repoPath(repo)) throw new Error('Unknown project folder.');
   prompt = String(prompt || '').trim();
   if (!prompt) throw new Error('Give the job a brief.');
@@ -555,6 +651,7 @@ function createJob({ repo, prompt, mode = 'edit', model = '', auto = false, agen
     sessionId: null, agentId: null, cost: 0, turns: 0, tools: 0, xp: 0,
     pending: prompt, denials: [], error: null, log: [],
     wantAgent: STAFF.some((st) => st.id === agentId) ? agentId : null,
+    ...extra,
   };
   state.jobs.push(job);
   if (job.wantAgent && state.dismissed.includes(job.wantAgent)) recall([job.wantAgent]);
@@ -588,13 +685,21 @@ function start(job, agentId) {
   tokens.set(job.id, token);
   const mcp = { mcpServers: { office: { command: process.execPath, args: [path.join(HERE, 'office-mcp.js')],
     env: { OFFICE_URL: `http://127.0.0.1:${PORT}`, OFFICE_JOB: job.id, OFFICE_TOKEN: token } } } };
+  const mcpFile = path.join(MCP_DIR, `${job.id}-${crypto.randomUUID().slice(0, 8)}.json`);
   // Attachments live outside the project, so agents need leave to read them.
-  fs.mkdirSync(UPLOADS, { recursive: true });
-  args.push('--add-dir', UPLOADS);
-  args.push('--mcp-config', JSON.stringify(mcp), '--allowedTools', OFFICE_TOOLS.join(','), '--append-system-prompt', officePrompt(agentId, job));
+  // A guest's job gets none of them: they are the boss's files.
+  if (!job.guest) {
+    fs.mkdirSync(UPLOADS, { recursive: true });
+    args.push('--add-dir', UPLOADS);
+  } else {
+    // Nor the boss's connectors (mail, Slack, calendar), user settings and
+    // hooks, or memory: at Full autonomy those would all be the guest's.
+    args.push('--strict-mcp-config', '--setting-sources', 'project,local', '--settings', JSON.stringify({ autoMemoryEnabled: false }));
+  }
+  args.push('--mcp-config', mcpFile, '--allowedTools', (job.guest ? GUEST_TOOLS : OFFICE_TOOLS).join(','), '--append-system-prompt', job.guest ? guestPrompt(agentId, job) : officePrompt(agentId, job));
   // Being given work in a channel is how you end up in it.
   try { joinChannel(channelOf(job.channel), agentId); } catch {}
-  const first = job.pending;
+  const first = job.sessionId ? withClearHint(job, job.pending) : job.pending;
 
   Object.assign(job, {
     status: 'working', agentId, pending: null, denials: [], error: null,
@@ -610,7 +715,14 @@ function start(job, agentId) {
 
   // stdin stays open for the whole job, so the chief can hand the agent
   // new messages while it works.
-  const child = spawn(CLAUDE, args, { cwd, env: { CLAUDE_AUTOCOMPACT_PCT_OVERRIDE: AUTOCOMPACT_PCT, ...auth.env() }, stdio: ['pipe', 'pipe', 'pipe'] });
+  try {
+    fs.mkdirSync(MCP_DIR, { recursive: true, mode: 0o700 });
+    fs.chmodSync(MCP_DIR, 0o700);
+    fs.writeFileSync(mcpFile, JSON.stringify(mcp), { mode: 0o600, flag: 'wx' });
+  } catch (err) {
+    return finish(job, 'failed', `Could not write the office tools' config: ${err.message}`);
+  }
+  const child = spawn(CLAUDE, args, { cwd, env: { CLAUDE_AUTOCOMPACT_PCT_OVERRIDE: String(settings.get('compactPct')), ...(job.guest ? { CLAUDE_CODE_DISABLE_AUTO_MEMORY: '1' } : {}), ...auth.env() }, stdio: ['pipe', 'pipe', 'pipe'] });
   running.set(job.id, child);
   startProcs();
   child.stdin.on('error', () => {});
@@ -633,10 +745,12 @@ function start(job, agentId) {
 
   const ended = (why) => {
     running.delete(job.id);
+    fs.rm(mcpFile, { force: true }, () => {});
     if (procs) { delete procs[job.id]; }
     endGrace(job);
     if (job.status !== 'working') return;
-    if (job.stopRequested) finish(job, 'stopped', 'Stopped by you.');
+    if (job.clearing && !job.stopRequested) return recycle(job);
+    if (job.stopRequested) finish(job, 'stopped', job.stopWhy || 'Stopped by you.');
     else if (job.lastTurn) finish(job, job.lastTurn.ok ? 'done' : 'failed', job.lastTurn.ok ? null : job.lastTurn.error);
     else finish(job, 'failed', errTail.trim().split('\n').pop() || why);
   };
@@ -644,6 +758,30 @@ function start(job, agentId) {
   child.on('close', (code) => ended(`claude exited with code ${code}`));
 }
 
+// Start a job over in a fresh session: the history is what costs tokens on
+// every turn, so the agent's own handoff note, the brief and anything that
+// arrived meanwhile are all the new session carries.
+function recycle(job) {
+  const note = job.clearNote;
+  const carried = job.context;
+  const wake = [
+    `Your original brief:\n${job.prompt}`,
+    `Your context has just been cleared (${(job.clears || 0) + 1} time${job.clears ? 's' : ''} on this job), ${job.clearedBy === 'boss' ? 'at the boss\'s request' : 'by you, to save tokens'}. Your notes:\n${note}`,
+    'The clear is DONE. If the brief or your notes only asked you to clear your context, that step is complete: do not call clear_context again, just confirm in one line that you are on a fresh context and finish. ' +
+      'The project still holds everything you changed. Check where the work stands, then carry on.',
+    job.pending,
+  ].filter(Boolean).join('\n\n');
+  Object.assign(job, { sessionId: null, clearNote: null, clearedBy: null, clearing: false, hinted: false, context: null, lastTurn: null, pending: wake,
+    status: 'queued', queuedAt: Date.now(), waiting: false });
+  job.clears = (job.clears || 0) + 1;
+  job.lastClear = { note, by: job.clearedBy || 'self', at: Date.now() };
+  tokens.delete(job.id);
+  addLog(job, { kind: 'system', summary: `Cleared context${carried ? ` (${Math.round(carried / 1000)}k tokens)` : ''} and carried on fresh` });
+  pushJob(job);
+  save();
+  setImmediate(pump);
+}
+
 function write(child, text) {
   if (!child.stdin.writable) return false;
   child.stdin.write(JSON.stringify({ type: 'user', message: { role: 'user', content: text } }) + '\n');
@@ -658,7 +796,7 @@ function deliver(job, text) {
     job.lastTurn = null;
     if (job.waiting) { job.waiting = false; pushJob(job); }
     addLog(job, { kind: 'user', summary: text });
-    if (child && write(child, text)) return 'live';
+    if (child && write(child, withClearHint(job, text))) return 'live';
     // The session ended between the check and the write, so there is nobody
     // to hand it to. Hold it for the next turn: passing it to replyJob would
     // only hand it straight back here, for as long as the stack allows.
@@ -688,6 +826,12 @@ function onLine(job, line) {
     job.sessionId = e.session_id;
     addLog(job, { kind: 'system', summary: `Clocked in · ${e.model}` });
   } else if (e.type === 'assistant') {
+    // Each assistant message carries the usage of one API call, whose input side
+    // is the real context size right now. (A subagent's calls are its own context.)
+    const au = e.message?.usage;
+    if (au && !e.parent_tool_use_id) {
+      job.context = (au.input_tokens || 0) + (au.cache_read_input_tokens || 0) + (au.cache_creation_input_tokens || 0);
+    }
     for (const c of e.message?.content || []) {
       if (c.type === 'text' && c.text.trim()) {
         addLog(job, { kind: 'text', summary: c.text.trim().slice(0, 6000) });
@@ -713,11 +857,12 @@ function onLine(job, line) {
   } else if (e.type === 'result') {
     job.cost += e.total_cost_usd || 0;
     job.turns++;
-    // The input side of the last turn is how much context this session is
-    // carrying. Worth seeing: a long-resumed job pays it on every turn.
+    // The result's usage is summed over every API call in the turn, so its cache
+    // reads count the whole history once per tool call: not the context size.
+    // job.context is kept from the last assistant message instead (see above).
     const u = e.usage || {};
-    job.context = (u.input_tokens || 0) + (u.cache_read_input_tokens || 0) + (u.cache_creation_input_tokens || 0);
     board.addTokens((u.input_tokens || 0) + (u.output_tokens || 0));
+    guests.addTokens(job, (u.input_tokens || 0) + (u.output_tokens || 0));
     board.addTime(e.duration_ms);
     nudgeUsage();
     job.denials = [...new Set((e.permission_denials || []).map((d) => d.tool_name))];
@@ -725,6 +870,13 @@ function onLine(job, line) {
     addLog(job, { kind: 'result', ok, summary: String(e.result || e.subtype || '').trim().slice(0, 8000), cost: e.total_cost_usd, ms: e.duration_ms });
     job.lastTurn = { ok, error: ok ? null : `Ended with ${e.subtype}`, text: String(e.result || '').trim() };
     endGrace(job);
+    // The agent asked for a clean slate: close this session now, and ended()
+    // starts the job again without its history.
+    if (ok && job.clearNote && running.has(job.id)) {
+      job.clearing = true;
+      running.get(job.id).stdin.end();
+      return;
+    }
     const pending = waits.get(job.id) || [];
     if (ok && pending.length && running.has(job.id)) {
       // Keep the session open; whatever they're waiting for will wake it.
@@ -803,7 +955,7 @@ function finish(job, status, error) {
   // gets it, and the asker's own finish is the one worth announcing).
   if (!retry && status !== 'stopped' && !job.requestedBy) {
     const line = awaiting ? `${nameOf(job.agentId)} is waiting on you for "${clip(job.title, 80)}": ${clip(job.asking.summary, 200)}`
-      : status === 'done' ? `${nameOf(job.agentId)} finished "${clip(job.title, 80)}".` : `${nameOf(job.agentId)} hit a wall on "${clip(job.title, 80)}": ${clip(error || 'something went wrong', 200)}`;
+      : status === 'done' ? `${nameOf(job.agentId)} finished "${clip(job.title, 80)}".${briefOf(job.lastTurn?.text) ? `\n\n${briefOf(job.lastTurn.text)}` : ''}` : `${nameOf(job.agentId)} hit a wall on "${clip(job.title, 80)}": ${clip(error || 'something went wrong', 200)}`;
     post('chief', `**${awaiting ? 'Waiting on you' : status === 'done' ? 'Done' : 'Failed'}** · ${line}`, { kind: 'finished', status, awaiting, jobId: job.id, thread: null, channel: GENERAL });
   }
 
@@ -882,20 +1034,21 @@ function addWait(job, w) {
   waits.set(job.id, [...(waits.get(job.id) || []), w]);
 }
 
-function stopJob(job) {
+function stopJob(job, why) {
   if (job.status === 'queued') {
     job.status = 'stopped';
-    job.error = 'Pulled from the queue.';
+    job.error = why || 'Pulled from the queue.';
     job.endedAt = Date.now();
     pushJob(job);
   } else if (job.status === 'working') {
     job.stopRequested = true;
+    job.stopWhy = why || null;
     const child = running.get(job.id);
     if (child) {
       child.kill('SIGTERM');
       setTimeout(() => running.get(job.id) === child && child.kill('SIGKILL'), 5000);
     } else {
-      finish(job, 'stopped', 'Stopped by you.');
+      finish(job, 'stopped', why || 'Stopped by you.');
     }
   }
 }
@@ -911,6 +1064,10 @@ function replyJob(job, { message, mode, files }) {
   if (!message) throw new Error('Say something first.');
   if (mode && !MODES[mode]) throw new Error('Unknown mode.');
   if (mode) job.mode = mode;
+  // A cleared session has no history, so what it was doing comes along with the reply.
+  if (!job.sessionId && job.lastClear) {
+    message = `Your context was cleared (${job.lastClear.by === 'boss' ? "at the boss's request" : 'by you'}). What you were on:\n${job.lastClear.note}\n\nOriginal brief:\n${job.prompt}\n\nNow: ${message}`;
+  }
   Object.assign(job, { status: 'queued', queuedAt: Date.now(), pending: message, error: null, endedAt: null, asking: null, awaitingBoss: false });
   addLog(job, { kind: 'user', summary: message });
   pushJob(job);
@@ -941,6 +1098,51 @@ function dismiss(ids) {
   ].filter(Boolean).join(' ');
 }
 
+// The boss's own "clear context", with no job to hand out. A live session is
+// closed once its turn ends and restarted fresh by ended(); a finished job
+// just forgets its session so the next reply starts clean.
+// What an agent was up to, kept when a context is wiped so neither they nor
+// the boss are left guessing: their last report, or failing that the brief.
+function whereItStood(job) {
+  const lastReply = [...(job.log || [])].reverse().find((e) => e.kind === 'result' && e.summary)?.summary;
+  const said = (job.lastTurn?.text || lastReply || '').trim().slice(0, 2000);
+  const state_ = job.status === 'working' ? 'in progress' : job.awaitingBoss ? 'waiting on the boss' : job.status;
+  return `Job "${job.title}" in ${job.repo} (${state_}). ` + (said ? `Last report:\n${said}` : `No report yet; the brief was:\n${String(job.prompt || '').slice(0, 1000)}`);
+}
+
+function clearContext(ids) {
+  const cleared = [], none = [];
+  for (const id of ids) {
+    const s = hired().find((x) => x.id === id);
+    if (!s) continue;
+    const job = workingJobOf(id);
+    if (job) {
+      if (job.clearNote || job.clearing) { cleared.push(s.name); continue; }
+      job.clearNote = whereItStood(job);
+      job.clearedBy = 'boss';
+      job.lastClear = { note: job.clearNote, by: 'boss', at: Date.now() };
+      // Idle with the session held open: nothing will end the turn, so close it now.
+      if (job.waiting && running.has(job.id)) { job.clearing = true; running.get(job.id).stdin.end(); }
+      cleared.push(s.name);
+      continue;
+    }
+    const last = state.jobs.filter((j) => j.agentId === id && j.sessionId).sort((a, b) => (b.queuedAt || 0) - (a.queuedAt || 0))[0];
+    if (last) {
+      const note = whereItStood(last);
+      // Held for the next reply, which starts a fresh session, so it carries on knowing.
+      Object.assign(last, { sessionId: null, context: null, hinted: false, lastClear: { note, by: 'boss', at: Date.now() } });
+      addLog(last, { kind: 'system', summary: `Context cleared by the boss. Kept: ${note.slice(0, 300)}` });
+      pushJob(last);
+      cleared.push(s.name);
+    } else none.push(s.name);
+  }
+  save();
+  return [
+    cleared.length ? `Cleared context for ${names(cleared)}.` : 'Nobody had a context to clear.',
+    none.length ? `${names(none)} had nothing to clear.` : '',
+  ].filter(Boolean).join(' ');
+}
+
 function recall(ids) {
   const back = ids.filter((id) => state.dismissed.includes(id));
   if (!back.length) return 'Everyone you named is already in.';
@@ -1054,7 +1256,7 @@ async function dispatch(text, mode, model, files, root, inThread, channel) {
     const said = files.length
       ? `${text}\n(Attached: ${files.map((f) => f.name).join(', ')}${shown.length ? `. ${shown.length === 1 ? 'The image is' : 'The images are'} attached for you to look at.` : ''})`
       : text;
-    d = await route(chiefContext(said, agent, repo, channel), { bin: CLAUDE, model: CHIEF_MODEL, images: shown, env: auth.env() });
+    d = await route(chiefContext(said, agent, repo, channel), { bin: CLAUDE, model: settings.get('chiefModel'), images: shown, env: auth.env() });
     state.chiefCost += d.cost || 0;
     nudgeUsage();
   } finally {
@@ -1094,6 +1296,10 @@ async function dispatch(text, mode, model, files, root, inThread, channel) {
     const ids = [...new Set([...(d.agentIds || []), ...(agent ? [agent.id] : [])])];
     return say(d.action === 'dismiss' ? dismiss(ids) : recall(ids));
   }
+  if (d.action === 'clear') {
+    const ids = [...new Set([...(d.agentIds || []), ...(agent ? [agent.id] : [])])];
+    return say(clearContext(ids.length ? ids : hired().map((x) => x.id)));
+  }
   if (d.action === 'standup') return void runStandup(true);
   // An answer that is merely about a job gets the same link a follow-up does.
   // Asking "how did that go?" from another channel shouldn't dead-end just
@@ -1235,6 +1441,21 @@ const clip = (s, n) => {
   s = String(s || '').replace(/\s+/g, ' ').trim();
   return s.length > n ? s.slice(0, n - 1) + '…' : s;
 };
+// A short plain-text brief of an agent's final reply: markdown stripped, the
+// opening sentences kept up to n characters, cut at a sentence end if possible.
+function briefOf(text, n = 280) {
+  const plain = String(text || '')
+    .replace(/```[\s\S]*?```/g, ' ')
+    .replace(/!?\[([^\]]*)\]\([^)]*\)/g, '$1')
+    .replace(/^\s*(#{1,6}|[-*>]|\d+\.)\s+/gm, '')
+    .replace(/[*_`]+/g, '')
+    .replace(/\s+/g, ' ')
+    .trim();
+  if (plain.length <= n) return plain;
+  const cut = plain.slice(0, n);
+  const end = Math.max(cut.lastIndexOf('. '), cut.lastIndexOf('! '), cut.lastIndexOf('? '));
+  return end > n * 0.4 ? cut.slice(0, end + 1) : clip(plain, n);
+}
 const ENDED = { done: 'Shipped', failed: 'Hit a wall on', stopped: 'Stopped' };
 
 // What each agent can honestly report since the last standup.
@@ -1305,7 +1526,7 @@ async function runStandup(byBoss) {
   try {
     // A quiet office has nothing worth a model call. Otherwise it writes
     // while everyone walks over.
-    const writing = quiet ? null : writeStandup(context, { bin: CLAUDE, model: CHIEF_MODEL, env: auth.env() }).catch(() => null);
+    const writing = quiet ? null : writeStandup(context, { bin: CLAUDE, model: settings.get('chiefModel'), env: auth.env() }).catch(() => null);
     await sleep(GATHER_MS);
     const written = writing && (await writing);
     if (written) {
@@ -1337,8 +1558,9 @@ async function runStandup(byBoss) {
 // Checked every minute. Missed standups still happen later that day, but
 // not after 6pm, and a day with nothing to talk about is skipped.
 function standupDue() {
-  if (STANDUP_AT === 'off' || standupNow) return;
-  const due = dueToday(STANDUP_AT, STANDUP_WEEKENDS);
+  const at = settings.get('standupAt');
+  if (!at || standupNow) return;
+  const due = dueToday(at, settings.get('standupWeekends'));
   const now = Date.now();
   if (!due || now < due || (state.lastStandup || 0) >= due || new Date().getHours() >= 18) return;
   const since = state.lastStandup || now - DAY_MS;
@@ -1386,17 +1608,39 @@ function officePrompt(agentId, job) {
   const others = onFloor().filter((s) => s.id !== agentId).map((s) => (s.role ? `${s.name} (${s.role})` : s.name)).join(', ');
   return `You are ${me}, one of the agents in the Agent Office. Your colleagues: ${others || 'none yet'}. ` + persona(agentId) +
     `Office tools: see colleagues, message them, hand off work, flag the boss, use channels. Messages from colleagues arrive as user messages starting "Message from"; answer them with message_colleague. ` +
+    `When your context has grown heavy and you are between steps, clear_context with notes to yourself lets you resume fresh and cheaper. ` +
     `Your updates collect in your job's thread, which the boss may not open: use flag_for_boss when you need them (question, decision, blocker, review), not for routine progress. If you flag a question, decision or blocker, you are not done: say plainly in your reply that you are waiting on the boss, and do not present the work as finished. ` +
-    `This job is discussed in #${channelOf(job?.channel)}; everyday talk stays in #general.` + standupBrief(agentId);
+    `This job is discussed in #${channelOf(job?.channel)}; everyday talk stays in #general.` + standupBrief(agentId) + recentWork(agentId, job);
 }
 
-const MAX_MESSAGES = 20, MAX_HANDOFFS = 5, MAX_DEPTH = 2, MAX_FLAGS = 5;
+// Survives a cleared context: what this agent was last working on, so
+// "what were you doing?" has an answer even in a brand new session.
+function recentWork(agentId, job) {
+  const mine = state.jobs.filter((j) => j.agentId === agentId && j.id !== job?.id && j.lastClear)
+    .sort((a, b) => b.lastClear.at - a.lastClear.at).slice(0, 2);
+  if (!mine.length) return '';
+  return ' Before your context was last cleared you were on: ' + mine.map((j) => `[${j.id}] ${clip(j.lastClear.note, 600)}`).join(' | ');
+}
+
+// A guest's job: the agent works for someone from another office, so it is
+// told nothing about this office's other work and can't reach colleagues.
+function guestPrompt(agentId, job) {
+  return `You are ${nameOf(agentId)}, an agent in the Agent Office, working on a job for ${job.from}, a guest from another office. ` + persona(agentId) +
+    `Work only in this project. Don't share anything about this office's other projects, jobs or people beyond what office_roster shows. ` +
+    `Your only office tools are office_roster and flag_for_boss; the boss here is the host, not ${job.from}. Talk to ${job.from} in your replies.`;
+}
+
+const MAX_MESSAGES = 20, MAX_HANDOFFS = 5, MAX_DEPTH = 2, MAX_FLAGS = 5, MAX_CLEARS = 5;
 const FLAGS = { question: 'Question for you', decision: 'Needs your decision', blocker: 'Blocked', review: 'Ready for your review' };
 
 function caller(req) {
   const id = req.headers['x-office-job'];
   const job = state.jobs.find((j) => j.id === id);
-  if (!job || job.status !== 'working' || !tokens.get(id) || tokens.get(id) !== req.headers['x-office-token']) return null;
+  if (!job || job.status !== 'working' || !tokens.get(id)) return null;
+  // Compared in constant time, so the token can't be guessed a byte at a time.
+  const want = Buffer.from(tokens.get(id));
+  const got = Buffer.from(String(req.headers['x-office-token'] || ''));
+  if (got.length !== want.length || !crypto.timingSafeEqual(got, want)) return null;
   return job;
 }
 
@@ -1412,6 +1656,15 @@ function recentJobOf(agentId) {
   return last?.status === 'done' && Date.now() - last.endedAt < RESUME_WINDOW_MS ? last : null;
 }
 
+// Who is in, without what anyone is working on or where: a guest's job
+// shouldn't learn this office's other work.
+function guestRoster(me) {
+  const lines = [`You are ${nameOf(me.agentId)}, on a job for ${me.from}.`, 'In the office today:'];
+  for (const s of onFloor()) if (s.id !== me.agentId) lines.push(`- ${s.role ? `${s.name} (${s.role})` : s.name}`);
+  lines.push('', `Project: ${me.repo}`);
+  return lines.join('\n');
+}
+
 const agentApi = {
   office_roster(me) {
     const lines = [`You are ${nameOf(me.agentId)}.`, 'Colleagues:'];
@@ -1437,6 +1690,8 @@ const agentApi = {
     if (!theirs || (theirs.status === 'working' && !running.has(theirs.id))) {
       throw new Error(`${target.name} isn't on a job right now. Use hand_off to give them work.`);
     }
+    // A guest reads that job's log, so nothing from this office goes into it.
+    if (theirs.guest) throw new Error(`${target.name} is on a job for a guest from another office and can't take messages.`);
 
     const myName = nameOf(me.agentId);
     deliver(theirs, `Message from ${myName} (working on "${me.title}" in ${me.repo}): ${message}` +
@@ -1477,6 +1732,14 @@ const agentApi = {
     return 'The chief has put it in front of the boss. Carry on, or wrap up this step if you cannot go further without them.';
   },
 
+  clear_context(me, { notes }) {
+    notes = String(notes || '').trim().slice(0, 4000);
+    if (!notes) throw new Error('Write the notes you will need: what is done, what is left, what you learned.');
+    if ((me.clears || 0) >= MAX_CLEARS) throw new Error("You've cleared your context several times on this job. Finish with what you have.");
+    me.clearNote = notes;
+    return 'Your context will clear when you end your turn. End it now: say nothing more of substance, your notes are what you resume with.';
+  },
+
   restart_office(me, { now = false } = {}) {
     requestRestart({ by: me.agentId, jobId: me.id, now: !!now });
     return 'The office will restart once everyone is between turns, and that includes you: end your turn now. ' +
@@ -1718,14 +1981,66 @@ const terminals = new Terminals({ root: ROOT, dataDir: DATA, folders: listRepos
 // machine's Tailscale name when `tailscale serve` fronts the office. Everything
 // else is still refused, which is what keeps rebinding sites out.
 const LOCAL = new Set(['localhost', '127.0.0.1', '[::1]', ...String(process.env.OFFICE_ALLOWED_HOSTS || '').split(',').map((h) => h.trim().toLowerCase()).filter(Boolean)]);
+const DEV_PORT = '5317'; // vite.config.js
+
+// The office key. Host and Origin checks keep other websites out, but not
+// other accounts on this machine (or the tailnet, with OFFICE_ALLOWED_HOSTS):
+// they can reach 127.0.0.1 too. So the page and its API need a secret only
+// this account can read. It is opened once with ?key=, which leaves it in an
+// HttpOnly cookie, and it stays the same across restarts. Delete the file to
+// sign every browser out. Agents use their job tokens instead.
+const KEY_FILE = path.join(DATA, 'office-key');
+const OFFICE_KEY = (() => {
+  try { const k = fs.readFileSync(KEY_FILE, 'utf8').trim(); if (/^[0-9a-f]{64}$/.test(k)) return k; } catch {}
+  const k = crypto.randomBytes(32).toString('hex');
+  fs.mkdirSync(DATA, { recursive: true });
+  fs.writeFileSync(KEY_FILE, k + '\n', { mode: 0o600 });
+  return k;
+})();
+try { fs.chmodSync(KEY_FILE, 0o600); } catch {}
+// Cookies ignore ports, so two offices on one machine each need their own name.
+const KEY_COOKIE = `office_key_${PORT}`;
+const sameKey = (k) => {
+  const a = Buffer.from(String(k || '')), b = Buffer.from(OFFICE_KEY);
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+};
+function hasKey(req) {
+  for (const c of String(req.headers.cookie || '').split(';')) {
+    const i = c.indexOf('=');
+    if (i > 0 && c.slice(0, i).trim() === KEY_COOKIE) return sameKey(c.slice(i + 1).trim());
+  }
+  return false;
+}
+const keyLink = (host = `localhost:${PORT}`) => `http://${host}/?key=${OFFICE_KEY}`;
+
+// What a browser without the key sees instead of the office.
+function locked(res) {
+  res.writeHead(401, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' });
+  res.end(`<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Agent Office</title>
+<style>body{font:16px/1.5 system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#11131a;color:#e8e9ee}main{max-width:30rem;padding:2rem}h1{font-size:1.25rem;margin:0 0 .75rem}p{margin:.5rem 0;color:#b4b7c3}code{font:.9em ui-monospace,monospace;background:#1d2030;padding:.1em .35em;border-radius:4px;color:#e8e9ee}</style>
+<main><h1>This office is locked</h1>
+<p>Open it with the link it printed when it started: the line that begins <code>Agent Office open on</code>.</p>
+<p>Lost it? Run <code>agentoffice --link</code> in a terminal on this machine.</p></main>`);
+}
+
 function trusted(req) {
   // Anything that can spawn claude with full permissions must refuse
   // requests from other websites and from rebinding hostnames.
   const host = String(req.headers.host || '').replace(/:\d+$/, '');
   if (!LOCAL.has(host)) return false;
   const origin = req.headers.origin;
+  // No Origin is not proof of a local caller: another site's <img> or <link>
+  // GET arrives without one. So every GET must stay read-only, with no side
+  // effects; anything that changes state or spawns goes behind another method.
   if (!origin) return true;
-  try { return LOCAL.has(new URL(origin).hostname); } catch { return false; }
+  // Another port on localhost is another site: a project's dev server, or
+  // anything an agent started. Only the office itself and its vite dev page.
+  try {
+    const o = new URL(origin);
+    if (!LOCAL.has(o.hostname)) return false;
+    if (!['localhost', '127.0.0.1', '[::1]'].includes(o.hostname)) return true;
+    return [String(PORT), DEV_PORT].includes(o.port);
+  } catch { return false; }
 }
 
 function readBody(req) {
@@ -1750,8 +2065,18 @@ const json = (res, code, body) => {
 };
 
 const TYPES = { '.html': 'text/html', '.js': 'text/javascript', '.css': 'text/css', '.woff2': 'font/woff2', '.woff': 'font/woff', '.svg': 'image/svg+xml', '.png': 'image/png', '.webmanifest': 'application/manifest+json', '.ico': 'image/x-icon' };
+// Build files are public code with nothing of the boss's in them; anything
+// else falls back to the page, which needs the key.
+function isAsset(pathname) {
+  let f;
+  try { f = path.join(DIST, path.normalize(decodeURIComponent(pathname)).replace(/^(\.\.[\/\\])+/, '')); } catch { return false; }
+  if (!f.startsWith(DIST + path.sep) || f === path.join(DIST, 'index.html')) return false;
+  try { return fs.statSync(f).isFile(); } catch { return false; }
+}
 function serveStatic(req, res) {
-  const url = decodeURIComponent(new URL(req.url, 'http://x').pathname);
+  let url;
+  // A bad escape (`/%E0`) throws; outside a try that would take the office down.
+  try { url = decodeURIComponent(new URL(req.url, 'http://x').pathname); } catch { return json(res, 400, { error: 'Bad path.' }); }
   let file = path.join(DIST, path.normalize(url).replace(/^(\.\.[\/\\])+/, ''));
   if (!file.startsWith(DIST)) return json(res, 403, { error: 'No.' });
   if (!fs.existsSync(file) || fs.statSync(file).isDirectory()) file = path.join(DIST, 'index.html');
@@ -1770,7 +2095,22 @@ const server = http.createServer(async (req, res) => {
   if (!trusted(req)) return json(res, 403, { error: 'Local only.' });
   const url = new URL(req.url, 'http://x');
   const parts = url.pathname.split('/').filter(Boolean);
-  if (parts[0] !== 'api') return serveStatic(req, res);
+  if (parts[0] !== 'api') {
+    if (url.searchParams.has('key')) {
+      if (!sameKey(url.searchParams.get('key'))) return locked(res);
+      url.searchParams.delete('key');
+      res.writeHead(303, {
+        'set-cookie': `${KEY_COOKIE}=${OFFICE_KEY}; Path=/; HttpOnly; SameSite=Strict; Max-Age=31536000`,
+        location: url.pathname + url.search, 'cache-control': 'no-store',
+      });
+      return res.end();
+    }
+    if (!hasKey(req) && !isAsset(url.pathname)) return locked(res);
+    return serveStatic(req, res);
+  }
+  // Agents prove who they are with their job token (caller); everyone else
+  // with the office key.
+  if (parts[1] !== 'agent' && !hasKey(req)) return json(res, 401, { error: 'Open the office with its link first.' });
 
   try {
     if (req.method === 'GET' && url.pathname === '/api/repos') return json(res, 200, { root: ROOT, repos: listRepos() });
@@ -1784,6 +2124,8 @@ const server = http.createServer(async (req, res) => {
     if (req.method === 'POST' && parts[1] === 'agent' && agentApi[parts[2]]) {
       const me = caller(req);
       if (!me) return json(res, 403, { error: 'Not on the clock.' });
+      if (me.guest && !GUEST_TOOLS.includes(`mcp__office__${parts[2]}`)) return json(res, 403, { error: 'Not on a guest’s job.' });
+      if (me.guest && parts[2] === 'office_roster') return json(res, 200, { text: guestRoster(me) });
       return json(res, 200, { text: agentApi[parts[2]](me, await readBody(req)) });
     }
     if (req.method === 'POST' && url.pathname === '/api/uploads') {
@@ -1799,15 +2141,62 @@ const server = http.createServer(async (req, res) => {
       if (req.method !== 'GET') { send({ t: 'auth', auth: status }); refreshUsage(); }
       return json(res, 200, status);
     }
+    // The context limit: past it, an agent is nudged to clear_context. 0 turns
+    // the nudge off; null goes back to the AGENT_CLEAR_TOKENS default.
+    if (url.pathname === '/api/context-limit' && ['GET', 'POST'].includes(req.method)) {
+      if (req.method === 'POST') {
+        const { tokens } = await readBody(req);
+        if (tokens !== null && !(Number.isInteger(tokens) && tokens >= 0 && tokens <= 10_000_000)) return json(res, 400, { error: 'Use a whole number of tokens, or 0 to turn it off.' });
+        settings.set({ tokenLimit: tokens });
+        announceSettings();
+      }
+      return json(res, 200, contextLimit());
+    }
+    // The Settings page: every value, its default, and whether it is overridden.
+    // A POST of { key: value | null } saves them all or none; null is the default.
+    if (url.pathname === '/api/settings' && ['GET', 'POST'].includes(req.method)) {
+      if (req.method === 'POST') {
+        try { settings.set(await readBody(req)); }
+        catch (err) { return json(res, err.code || 400, { error: err.message }); }
+        announceSettings();
+      }
+      return json(res, 200, { owner: owner(), settings: settings.status() });
+    }
     // The leaderboard. Joining claims a handle with the service and starts
-    // sharing day counters; leaving asks it to forget this office.
+    // sharing day counters. Leaving deletes the counters; the handle goes too
+    // unless linked offices still need it.
     if (url.pathname === '/api/leaderboard' && ['GET', 'POST', 'DELETE'].includes(req.method)) {
       let status;
-      try { status = req.method === 'GET' ? board.status() : req.method === 'DELETE' ? await board.leave() : await board.join((await readBody(req)).handle); }
-      catch (err) { return json(res, err.code >= 400 && err.code < 600 ? err.code : 400, { error: err.message }); }
+      try {
+        if (req.method === 'GET') status = board.status();
+        else if (req.method === 'POST') status = await board.join((await readBody(req)).handle);
+        else {
+          const keepHandle = links.links.length > 0;
+          status = await board.leave({ keepHandle });
+          if (!keepHandle) links.forget();
+        }
+      } catch (err) { return json(res, err.code >= 400 && err.code < 600 ? err.code : 400, { error: err.message }); }
       if (req.method !== 'GET') send({ t: 'leaderboard', leaderboard: status });
       return json(res, 200, status);
     }
+    // A handle without joining the board, for linking offices.
+    if (req.method === 'POST' && url.pathname === '/api/leaderboard/handle') {
+      let status;
+      try { status = await board.claim((await readBody(req)).handle); }
+      catch (err) { return json(res, err.code >= 400 && err.code < 600 ? err.code : 400, { error: err.message }); }
+      send({ t: 'leaderboard', leaderboard: status });
+      return json(res, 200, status);
+    }
+    // Linked offices: codes to make and use, and the links they made.
+    if (url.pathname === '/api/links' || parts[1] === 'links') {
+      const linkErr = (err) => json(res, err.code >= 400 && err.code < 600 ? err.code : 502, { error: err.message });
+      try {
+        if (req.method === 'GET' && url.pathname === '/api/links') return json(res, 200, await links.refresh().catch(() => links.status()));
+        if (req.method === 'POST' && url.pathname === '/api/links/invite') return json(res, 201, await links.invite(await readBody(req)));
+        if (req.method === 'POST' && url.pathname === '/api/links/redeem') return json(res, 200, await links.redeem(await readBody(req)));
+        if (req.method === 'DELETE' && parts[2] && !parts[3]) return json(res, 200, await links.unlink(parts[2]));
+      } catch (err) { return linkErr(err); }
+    }
     if (req.method === 'GET' && url.pathname === '/api/leaderboard/board') {
       try { return json(res, 200, await board.board(url.searchParams.get('period'))); }
       catch (err) { return json(res, err.code >= 400 && err.code < 600 ? err.code : 502, { error: err.message }); }
@@ -1886,6 +2275,20 @@ const server = http.createServer(async (req, res) => {
       send(snapshot());
       return json(res, 200, { ok: true });
     }
+    // Visiting an office that made us its guest: each call is a request to
+    // the host over the relay, which checks it against the guest's limits.
+    if (parts[1] === 'visit' && parts[2] && parts[3] === 'jobs') {
+      const link = parts[2], id = parts[4];
+      try {
+        if (req.method === 'POST' && !id) return json(res, 201, await guests.request(link, 'createJob', await readBody(req)));
+        if (req.method === 'GET' && id && !parts[5]) return json(res, 200, await guests.request(link, 'job', { job: id }));
+        if (req.method === 'GET' && id && parts[5] === 'diff') return json(res, 200, await guests.request(link, 'diff', { job: id, path: url.searchParams.get('path') || '' }));
+        if (req.method === 'POST' && id && parts[5] === 'reply') { const b = await readBody(req); return json(res, 200, await guests.request(link, 'reply', { job: id, text: b.text ?? b.message, mode: b.mode })); }
+        if (req.method === 'POST' && id && parts[5] === 'stop') return json(res, 200, await guests.request(link, 'stop', { job: id }));
+      } catch (err) {
+        return json(res, err.code >= 400 && err.code < 600 ? err.code : 400, { error: err.message });
+      }
+    }
     if (parts[1] === 'jobs' && parts[2]) {
       const job = state.jobs.find((j) => j.id === parts[2]);
       if (!job) return json(res, 404, { error: 'No such job.' });
@@ -1911,6 +2314,7 @@ const termWss = new WebSocketServer({ noServer: true, maxPayload: 64 * 1024 });
 server.on('upgrade', (req, socket, head) => {
   const url = new URL(req.url, 'http://x');
   if (!trusted(req)) return socket.destroy();
+  if (!hasKey(req)) { socket.end('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n'); return; }
   if (url.pathname === '/ws') {
     return wss.handleUpgrade(req, socket, head, (ws) => {
       clients.add(ws);
@@ -1918,6 +2322,14 @@ server.on('upgrade', (req, socket, head) => {
       ws.send(JSON.stringify(snapshot()));
     });
   }
+  const visit = /^\/ws\/visit\/([\w-]{1,64})$/.exec(url.pathname);
+  if (visit) {
+    // The host's office, as its guest. Our own fields fill what the host
+    // doesn't send, so the page has everything it expects.
+    return wss.handleUpgrade(req, socket, head, (ws) => guests.visit(ws, visit[1], () => ({
+      ...snapshot(), dismissed: [], standup: null, chiefBusy: false, procs: null, visitors: [],
+    })));
+  }
   // No terminal, no socket: with the door shut there is nothing to hold open
   // while someone guesses at tickets.
   if (url.pathname === '/ws/terminal' && terminals.on) {
@@ -1926,8 +2338,19 @@ server.on('upgrade', (req, socket, head) => {
   socket.destroy();
 });
 
+// A taken port won't free up by trying again, so say so and tell the
+// supervisor not to retry (78).
+server.on('error', (err) => {
+  if (err.code !== 'EADDRINUSE') throw err;
+  console.error(`Port ${PORT} is already in use. Start the office with another: agentstudio --port <n>, or PORT=<n>.`);
+  process.exit(78);
+});
 server.listen(PORT, '127.0.0.1', () => {
-  console.log(`Agent Office open on http://localhost:${PORT}  (projects in ${ROOT})`);
+  // The key is in this line on purpose: it's how the boss gets in. It only
+  // goes to this terminal (or the supervisor's), never to a log file.
+  console.log(`Agent Office open on ${keyLink()}  (projects in ${ROOT})`);
+  // For `agentoffice --link`, which can't know which free port we got.
+  try { fs.writeFileSync(path.join(DATA, 'office-port'), String(PORT)); } catch {}
   // Shell access being open is not something to find out by accident.
   terminals.status().then((t) => console.log(t.enabled
     ? `Terminal ON — anything in this browser gets a shell as ${process.env.USER || 'you'}. Up to ${t.max}, ${t.idleMinutes} min idle.`
@@ -1948,5 +2371,8 @@ function shutdown(code = 0) {
   fs.writeFileSync(STATE_FILE, JSON.stringify(state));
   process.exit(code);
 }
+// One bad request must not take the office down: a crash skips shutdown(),
+// so state isn't saved and running agents are orphaned.
+process.on('unhandledRejection', (err) => console.error('[office] unhandled', err));
 process.on('SIGINT', () => shutdown());
 process.on('SIGTERM', () => shutdown());