agent-office-studio 0.6.0 → 0.8.0

package/server/index.js

@@ -11,16 +11,23 @@ import { canSee, route } from './chief.js';
 import { fetchUsage } from './usage.js';
 import { writeStandup, dueToday } from './standup.js';
 import { writeBanter } from './banter.js';
+import { writeReply } from './talk.js';
 import { sampleProcs, resetProcs, machine } from './procstat.js';
 import { transcribe, vocabulary, voiceReady, speak, piperReady } from './voice.js';
 import { snapshotTree, summarize, fileDiff } from './changes.js';
 import { Auth } from './auth.js';
 import { Leaderboard } from './leaderboard.js';
+import { Economy, emptyBooks, BET } from './economy.js';
+import { itemById, ITEMS, PAY, setPay, naira } from '../shared/shop.js';
 import { Links } from './links.js';
 import { Settings } from './settings.js';
 import { Guests } from './guests.js';
 import { Visits, visitJob } from './visits.js';
 import { findIcon } from './icons.js';
+import { Journeys } from './journeys.js';
+import { lanAddresses, phoneLinks, qrSvg, qrText } from './phone.js';
+import { Tunnel } from './tunnel.js';
+import { findCloudflared } from './cloudflared.js';
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const APP = path.resolve(HERE, '..');
@@ -39,6 +46,7 @@ const UPLOADS = path.join(DATA, 'uploads');
 const MCP_DIR = path.join(DATA, 'mcp');
 fs.rmSync(MCP_DIR, { recursive: true, force: true });
 const auth = new Auth(DATA);
+const journeys = new Journeys(DATA);
 const board = new Leaderboard(DATA, { onChange: () => send({ t: 'leaderboard', leaderboard: board.status() }) });
 const MAX_UPLOAD = 25 * 1024 * 1024;
 const MAX_LOG = 600;
@@ -151,6 +159,7 @@ const LADDER = ['haiku', 'sonnet', 'opus'];
 const DEFAULT_TIER = 'sonnet';
 const TIER_LABEL = { haiku: 'Haiku', sonnet: 'Sonnet', opus: 'Opus' };
 const tierOf = (model) => LADDER.find((t) => String(model || '').includes(t)) || '';
+const modelName = (m) => TIER_LABEL[m] || m;
 // The boss's picker wins; "Chief picks" (empty) hands the choice over, and only
 // a job sized that way is allowed to climb on its own.
 const sized = (model, tier) => (model
@@ -185,7 +194,18 @@ try {
 if (!state.settings || typeof state.settings !== 'object') state.settings = {};
 if (Number.isInteger(state.clearTokens) && !('tokenLimit' in state.settings)) state.settings.tokenLimit = state.clearTokens;
 delete state.clearTokens;
-const settings = new Settings(state.settings, () => save());
+const settings = new Settings(state.settings, (keys) => {
+  save();
+  if (keys.some((k) => k.startsWith('pay'))) { applyPay(); send({ t: 'economy', economy: economy.status() }); }
+});
+const applyPay = () => setPay({ perMinute: settings.get('payPerMinute'), finishBonus: settings.get('payFinishBonus') });
+applyPay();
+// Pay, the office pot and the shop. state.economy is the books themselves,
+// changed in place, so saving the state saves them.
+if (!state.economy || typeof state.economy !== 'object') state.economy = emptyBooks();
+const economy = new Economy(state.economy, { onChange: (entry) => { save(); send({ t: 'economy', entry, economy: economy.status() }); announceWager(entry); } });
+// Stakes on a bet nobody took, or on a job that never finished, run out.
+setInterval(() => { try { economy.sweep(); } catch {} }, 600000).unref();
 if (!state.channels.some((c) => c.id === GENERAL)) state.channels.unshift({ id: GENERAL, name: GENERAL, createdAt: Date.now() });
 // Sat next to #general, and described even if someone had already opened a
 // channel by that name by hand. An explanation they wrote themselves stays.
@@ -341,6 +361,7 @@ guests = new Guests(DATA, {
   links,
   office: {
     jobs: () => state.jobs,
+    repoPath: (name) => repoPath(name),
     createJob: (body, extra) => createJob(body, extra),
     replyJob: (job, body) => replyJob(job, body),
     stopJob: (job, why) => stopJob(job, why),
@@ -360,7 +381,7 @@ guests = new Guests(DATA, {
   },
 });
 // Broadcasts that can't change what an agent is doing don't need presence checked.
-const NOT_PRESENCE = new Set(['links', 'visitors', 'remote', 'proc', 'leaderboard', 'auth', 'usage']);
+const NOT_PRESENCE = new Set(['links', 'visitors', 'remote', 'proc', 'leaderboard', 'auth', 'usage', 'economy']);
 
 function send(msg) {
   const data = JSON.stringify(msg);
@@ -369,7 +390,7 @@ function send(msg) {
   if (!NOT_PRESENCE.has(msg.t)) links.sendPresence();
 }
 const publicJob = (j, tail = 40) => {
-  const { stopRequested, lastTurn, sent, handoffs, ...rest } = j;
+  const { stopRequested, lastTurn, sent, handoffs, staged, ...rest } = j;
   return { ...rest, log: j.log.slice(-tail) };
 };
 // Whose office this is: the owner set in Settings (default OFFICE_OWNER), else the first name on this account.
@@ -400,6 +421,7 @@ const snapshot = () => ({
   usage,
   auth: auth.status(),
   leaderboard: board.status(),
+  economy: economy.status(),
   links: links.status(),
   visitors: links.visiting(),
   procs,
@@ -513,10 +535,46 @@ function react(id, emoji, who = 'you') {
   const r = (msg.reactions ||= {});
   const people = r[emoji] || [];
   r[emoji] = people.includes(who) ? people.filter((p) => p !== who) : [...people, who];
+  const added = r[emoji].includes(who);
   if (!r[emoji].length) delete r[emoji];
   if (!Object.keys(r).length) delete msg.reactions;
   send({ t: 'react', id, reactions: msg.reactions || {} });
   save();
+  if (added && who === 'you') reactionFeedback(msg, emoji);
+}
+
+// What the boss means by an emoji, as a short signal for the agent. Anything
+// not listed still gets through, just without a reading.
+const REACTION_SIGNALS = {
+  '👍': 'approved. This is what they wanted.',
+  '🔥': 'great work. Do more like this.',
+  '❤️': 'loved it.',
+  '🎉': 'celebrating this one. Well done.',
+  '👏': 'applause for this.',
+  '💯': 'spot on.',
+  '🙏': 'thank you.',
+  '👀': 'they have seen it and are looking into it.',
+  '🤔': 'not convinced. Expect a question or a push back on this.',
+  '😕': 'this was unclear or off. Expect a correction.',
+  '👎': 'rejected. Not what they wanted; rethink the approach.',
+  '😂': 'amused by this.',
+};
+
+// A boss reaction on an agent's message is feedback on that job. It reaches a
+// running agent as a message; one that has finished isn't woken for an emoji,
+// so the signal rides along with the next thing the boss sends it.
+function reactionFeedback(msg, emoji) {
+  if (!STAFF.some((s) => s.id === msg.from)) return;
+  const job = (msg.jobId && state.jobs.find((j) => j.id === msg.jobId))
+    || (msg.thread && state.chat.find((m) => m.id === msg.thread) && threadJob(state.chat.find((m) => m.id === msg.thread)));
+  if (!job || job.guest || job.away || job.visitor || job.remote) return;
+  const reading = REACTION_SIGNALS[emoji.replace(/\uFE0F/g, '')] || REACTION_SIGNALS[emoji] || 'a reaction with no fixed meaning; take it as general feedback.';
+  const text = `[Boss reacted ${emoji} to your message "${clip(msg.text.replace(/\s+/g, ' '), 80)}": ${reading}] No reply needed.`;
+  if (job.status === 'working' || job.status === 'queued') return void deliver(job, text);
+  job.feedback = [...(job.feedback || []), text].slice(-5);
+  addLog(job, { kind: 'system', summary: `Boss reacted ${emoji}: ${reading}` });
+  pushJob(job);
+  save();
 }
 
 // ---------- the break room ----------
@@ -603,6 +661,38 @@ async function claimBanter(pair, game = false) {
   }
 }
 
+// Click-an-agent chat: a quick in-character answer from one cheap call. The
+// browser keeps the last few turns and sends them back, so nothing is stored
+// here. One question at a time per agent, so a held-down Enter can't run up a bill.
+const talking = new Set();
+async function talkTo(agentId, text, history) {
+  const s = onFloor().find((x) => x.id === agentId);
+  if (!s) throw new Error('They are not on the floor right now.');
+  text = clip(text, 400);
+  if (!text) throw new Error('Say something first.');
+  if (talking.has(agentId)) throw new Error(`${s.name} is still answering.`);
+  talking.add(agentId);
+  try {
+    const job = state.jobs.find((j) => j.agentId === agentId && j.status === 'working');
+    const last = job && [...job.log].reverse().find((e) => e.kind === 'text' || e.kind === 'tool');
+    const now = job
+      ? `Right now: working on "${clip(job.title, 100)}" in ${job.repo}${job.waiting ? ' (waiting on the boss)' : ''}.${last ? ` Last thing you did: ${clip(last.summary || last.text, 140)}.` : ''}`
+      : 'Right now: between jobs, in the office.';
+    const said = (Array.isArray(history) ? history : []).slice(-6)
+      .map((h) => `${h.who === 'you' ? 'Boss' : s.name}: ${clip(h.text, 240)}`);
+    const { reply, cost } = await writeReply([
+      `You are ${s.name}. ${persona(agentId)}`, '', now, '',
+      said.length ? `This chat so far:\n${said.join('\n')}` : 'This chat has just started.', '',
+      `Boss: ${text}`,
+    ].join('\n'), { bin: CLAUDE, model: settings.get('banterModel'), env: auth.env() });
+    state.chiefCost += cost || 0;
+    send({ t: 'chief', busy: false, cost: state.chiefCost });
+    return reply;
+  } finally {
+    talking.delete(agentId);
+  }
+}
+
 function addLog(job, entry) {
   entry.ts = Date.now();
   const last = job.log[job.log.length - 1];
@@ -647,7 +737,9 @@ function overLimitAfterNudge(job) {
 const OFFICE_TOOLS = [
   'mcp__office__office_roster', 'mcp__office__message_colleague', 'mcp__office__hand_off', 'mcp__office__flag_for_boss',
   'mcp__office__list_channels', 'mcp__office__create_channel', 'mcp__office__invite_to_channel', 'mcp__office__post_to_channel',
-  'mcp__office__restart_office', 'mcp__office__clear_context',
+  'mcp__office__restart_office', 'mcp__office__clear_context', 'mcp__office__attach_files',
+  'mcp__office__office_shop', 'mcp__office__buy_item',
+  'mcp__office__bets', 'mcp__office__place_bet', 'mcp__office__take_bet', 'mcp__office__cancel_bet',
 ];
 // A guest's job can see who is in and ask the boss, nothing more: no
 // messaging colleagues, handing off or channels. Enforced again in agentApi,
@@ -735,13 +827,16 @@ function start(job, agentId) {
   } else if (!job.guest) {
     fs.mkdirSync(UPLOADS, { recursive: true });
     args.push('--add-dir', UPLOADS);
+    // A mapping job writes its journey map in the office's data, not the project.
+    if (job.journeys) args.push('--add-dir', journeys.ensureDir());
   } else {
     // Nor the boss's connectors (mail, Slack, calendar), user settings and
     // hooks, or memory: at Full autonomy those would all be the guest's.
     args.push('--strict-mcp-config', '--setting-sources', 'project,local', '--settings', JSON.stringify({ autoMemoryEnabled: false }));
   }
-  const allowed = job.guest ? GUEST_TOOLS : job.away ? [...OFFICE_TOOLS, ...awayTools(job)] : OFFICE_TOOLS;
-  args.push('--mcp-config', mcpFile, '--allowedTools', allowed.join(','), '--append-system-prompt', job.guest ? guestPrompt(agentId, job) : officePrompt(agentId, job) + awayPrompt(job));
+  // A guest's job can be away too: one of our agents, lent to the guest, in the guest's own project.
+  const allowed = [...(job.guest ? GUEST_TOOLS : OFFICE_TOOLS), ...(job.away ? awayTools(job) : [])];
+  args.push('--mcp-config', mcpFile, '--allowedTools', allowed.join(','), '--append-system-prompt', (job.guest ? guestPrompt(agentId, job) : officePrompt(agentId, job)) + awayPrompt(job));
   // Being given work in a channel is how you end up in it.
   try { joinChannel(channelOf(job.channel), agentId); } catch {}
   const first = job.sessionId ? withClearHint(job, job.pending) : job.pending;
@@ -796,6 +891,7 @@ function start(job, agentId) {
     endGrace(job);
     if (job.status !== 'working') return;
     if (job.clearing && !job.stopRequested) return recycle(job);
+    if (job.switching && !job.stopRequested) return resume(job);
     if (job.stopRequested) finish(job, 'stopped', job.stopWhy || 'Stopped by you.');
     else if (job.lastTurn) finish(job, job.lastTurn.ok ? 'done' : 'failed', job.lastTurn.ok ? null : job.lastTurn.error);
     else finish(job, 'failed', errTail.trim().split('\n').pop() || why);
@@ -828,6 +924,34 @@ function recycle(job) {
   setImmediate(pump);
 }
 
+// The boss picked another model for a running job. The process can't change
+// model mid-flight, so it finishes its turn, exits, and the same session
+// resumes on the new one.
+function resume(job) {
+  const note = job.pending;
+  Object.assign(job, { switching: false, lastTurn: null, pending: [note, `The boss moved this job to ${modelName(job.model)}. Carry on from where you were.`].filter(Boolean).join('\n\n'),
+    status: 'queued', queuedAt: Date.now(), waiting: false });
+  tokens.delete(job.id);
+  pushJob(job);
+  save();
+  setImmediate(pump);
+}
+
+// Set by the boss from the job card. Any job can be switched; one the chief
+// sized stops climbing on its own, since the boss has now chosen.
+function setModel(job, model) {
+  model = String(model || '');
+  if (!model || !MODELS.has(model)) throw new Error('Pick a model.');
+  if (job.guest || job.away || job.visitor) throw new Error("That job runs on someone else's account.");
+  if (model === job.model) return;
+  const from = TIER_LABEL[tierOf(job.model)] || job.model || 'the default model';
+  Object.assign(job, { model, autoModel: false });
+  const live = job.status === 'working' && running.get(job.id);
+  addLog(job, { kind: 'system', summary: `Boss moved this from ${from} to ${modelName(model)}${live ? '; switching after the current turn' : ''}` });
+  if (live) { job.switching = true; live.stdin.end(); }
+  pushJob(job);
+}
+
 function write(child, text) {
   if (!child.stdin.writable) return false;
   child.stdin.write(JSON.stringify({ type: 'user', message: { role: 'user', content: text } }) + '\n');
@@ -910,6 +1034,7 @@ function onLine(job, line) {
     board.addTokens((u.input_tokens || 0) + (u.output_tokens || 0));
     guests.addTokens(job, (u.input_tokens || 0) + (u.output_tokens || 0));
     board.addTime(e.duration_ms);
+    if (!job.guest) economy.accrue(job, e.duration_ms, job.model);
     nudgeUsage();
     job.denials = [...new Set((e.permission_denials || []).map((d) => d.tool_name))];
     const ok = e.subtype === 'success' && !e.is_error;
@@ -994,6 +1119,23 @@ function adoptNewProject(job) {
   return true;
 }
 
+// What a finished job earned, said where the office can see it. Milestones
+// go to the chill room, since they are the office's news, not the work's.
+function payday(job) {
+  const { pay, achievements } = economy.pay(job);
+  if (pay) pushJob(job);
+  for (const a of achievements) announceAchievement(job.agentId, a);
+}
+// The goal being reached and bets settling are the office's news, so they go
+// to the chill room (the goal to #general too, since it is everyone's).
+function announceWager(e) {
+  if (e.kind === 'goal' && e.phase === 'reached') post('chief', `🎉 The office pot hit ${naira(e.target)}: **${e.title}** is on! Well done, everyone.`, { kind: 'goal', channel: GENERAL, thread: null });
+  else if (e.kind === 'bet' && (e.phase === 'won' || e.phase === 'lost')) post('chief', `🎲 ${nameOf(e.winner)} won ${naira(e.stake)} off ${nameOf(e.loser)}: ${nameOf(e.subject)}'s job took ${e.why} against a bet of under ${e.minutes} min.`, { kind: 'bet', channel: CHILL, thread: null });
+}
+function announceAchievement(agentId, a) {
+  post('chief', `🏅 ${nameOf(agentId)} unlocked **${a.name}**: ${a.blurb} (+${naira(a.bonus)})`, { kind: 'achievement', channel: CHILL, thread: null });
+}
+
 function finish(job, status, error) {
   if (job.status !== 'working') return;
   clearWaits(job);
@@ -1011,12 +1153,19 @@ function finish(job, status, error) {
   const was = TIER_LABEL[tierOf(job.model)] || job.model || 'the default model';
   const retry = status === 'failed' ? bump(job) : null;
   const gained = status === 'done' && !awaiting ? 40 + Math.min(80, (job.turnTools || 0) * 4) : 0;
+  // Work that failed or was stopped earns nothing; a retry is paid on its own.
+  if (status !== 'done') Object.assign(job, { payMinutes: 0, payWeighted: 0 });
+  // A bet on a job that did not finish gives the stakes back.
+  if (status !== 'done' && !job.guest) try { economy.voidBets(job, `${nameOf(job.agentId)}'s job ${status === 'stopped' ? 'was stopped' : 'failed'}`); } catch {}
   if (status === 'done' && !awaiting) board.addJob();
   state.xp += gained;
   job.xp += gained;
   pushJob(job);
   recordChanges(job).catch(() => {}).then(() => adoptNewProject(job));
   if (job.away) guests.awayClose(job, status, job.lastTurn?.text || error || '').catch((err) => addLog(job, { kind: 'error', summary: `Could not tell @${job.away.host} the work ended: ${err.message}` }));
+  // Pay for the work, now it's finished. Not for a borrowed agent's job: the
+  // office that borrowed them isn't ours to pay out of.
+  if (gained && !job.guest) payday(job);
   if (gained) {
     const after = progress();
     send({ t: 'xp', progress: after, gained, jobId: job.id, agentId: job.agentId, levelUp: after.level > before.level });
@@ -1024,15 +1173,19 @@ function finish(job, status, error) {
   const text = status === 'done' ? job.lastTurn?.text || 'Done.'
     : status === 'stopped' ? 'Stopped, as asked.'
     : `I hit a wall: ${error || 'something went wrong'}`;
-  post(job.agentId, text, { jobId: job.id, status, denials: job.denials });
+  // A borrowed agent's chat belongs to the borrower: the host's feed carries
+  // the finished job over the link, and remoteEnded posts it in their office.
+  // Nothing about a guest's job goes in our own chat.
+  const attached = takeStaged(job);
+  if (!job.guest) post(job.agentId, text, { jobId: job.id, status, denials: job.denials, ...attached });
   // The result lands in the job's thread, which the boss may never open, so
   // the chief says so in #general. Not for a retry (the work isn't over), a
   // stop (the boss did that), or a colleague's handed-off piece (their asker
   // gets it, and the asker's own finish is the one worth announcing).
-  if (!retry && status !== 'stopped' && !job.requestedBy) {
+  if (!retry && status !== 'stopped' && !job.requestedBy && !job.guest) {
     const line = awaiting ? `${nameOf(job.agentId)} is waiting on you for "${clip(job.title, 80)}": ${clip(job.asking.summary, 200)}`
       : status === 'done' ? `${nameOf(job.agentId)} finished "${clip(job.title, 80)}".${briefOf(job.lastTurn?.text) ? `\n\n${briefOf(job.lastTurn.text)}` : ''}` : `${nameOf(job.agentId)} hit a wall on "${clip(job.title, 80)}": ${clip(error || 'something went wrong', 200)}`;
-    post('chief', `**${awaiting ? 'Waiting on you' : status === 'done' ? 'Done' : 'Failed'}** · ${line}`, { kind: 'finished', status, awaiting, jobId: job.id, thread: null, channel: GENERAL });
+    post('chief', `**${awaiting ? 'Waiting on you' : status === 'done' ? 'Done' : 'Failed'}** · ${line}`, { kind: 'finished', status, awaiting, jobId: job.id, thread: null, channel: GENERAL, ...attached });
   }
 
   // Hand the result back to whoever delegated this, if they're still at it.
@@ -1042,6 +1195,16 @@ function finish(job, status, error) {
   if (asker?.status === 'working' && running.has(asker.id)) {
     settle(asker, (w) => w.kind === 'job' && w.id === job.id);
     deliver(asker, `${nameOf(job.agentId)} finished the work you handed off ("${job.title}"), status: ${status}.\n\n${text}`);
+  } else if (asker && !asker.guest && !asker.away && asker.status !== 'stopped' && asker.status !== 'working' && status !== 'stopped') {
+    // The asker has already closed their turn, so the result would have
+    // nowhere to land and sit unread. It becomes work for them instead: their
+    // job resumes (or, if it is queued, picks it up), and a review's findings
+    // get fixed rather than filed.
+    const reviewed = /review|adversarial|audit|qa\b|test/i.test(`${job.title} ${job.prompt}`);
+    asker.wantAgent = asker.agentId;
+    deliver(asker, `${nameOf(job.agentId)} finished the work you handed off ("${job.title}"), status: ${status}.\n\n${text}` +
+      (reviewed ? '\n\nThis is a review of your work. Go through each finding now: fix what is right, and say plainly what you decline and why.' : ''));
+    addLog(asker, { kind: 'system', summary: `${nameOf(job.agentId)}'s result came back after this job closed, so it was reopened.` });
   }
   // Anyone waiting on a reply from this agent stops waiting.
   for (const other of state.jobs) {
@@ -1138,6 +1301,7 @@ function replyJob(job, { message, mode, files }) {
   }
   message = String(message || '').trim();
   if (!message) throw new Error('Say something first.');
+  if (job.feedback?.length) { message = `${job.feedback.join('\n')}\n\n${message}`; job.feedback = null; }
   if (mode && !MODES[mode]) throw new Error('Unknown mode.');
   if (mode) job.mode = mode;
   // An idle session already nudged and still over the limit resumes fresh, not on its history.
@@ -1404,7 +1568,7 @@ function remoteEnded(job) {
   const name = guests.remoteStatus().find((o) => o.link === job.remote.link)?.staff.find((s) => s.id === job.agentId)?.name || 'Their agent';
   const last = job.log.at(-1);
   const how = { done: 'finished', failed: 'hit a wall on', stopped: 'stopped' }[job.status] || 'stopped';
-  const said = last?.kind === 'result' && last.summary ? `\n\n${clip(last.summary, 600)}` : job.error ? ` ${job.error}` : '';
+  const said = last?.kind === 'result' && last.summary ? `\n\n${clip(last.summary, 4000)}` : job.error ? ` ${job.error}` : '';
   post('chief', `${name} at @${job.remote.host} ${how} “${job.title}”.${said}`, { jobId: job.id, channel: job.channel, thread: job.thread || null });
 }
 
@@ -1466,7 +1630,7 @@ function chat({ text, mode = 'edit', model = '', files, thread, channel }) {
   if (remote) {
     if (files.length) return void say(`Files can’t go to @${remote.host}’s office. Paste the text instead.`);
     guests.startRemote({ link: remote.link, staff: remote.staff, text: remote.clean, mode, model, thread: root?.id || msg.id, channel: where })
-      .then(({ job, repo, capped }) => say(`${remote.staff.name} at @${remote.host} is on it, in ${repo}.${capped ? ` @${remote.host} allows up to ${MODES[job.mode]?.label || job.mode}, so it runs at that.` : ''}`, { jobId: job.id, thread: root ? root.id : null }))
+      .then(({ job, repo, home, capped }) => say(`${remote.staff.name} at @${remote.host} is on it, in ${home ? `your ${repo}, on @${remote.host}’s account. Their changes go into a copy you review.` : `${repo}.`}${capped ? ` @${remote.host} allows up to ${MODES[job.mode]?.label || job.mode}, so it runs at that.` : ''}`, { jobId: job.id, thread: root ? root.id : null }))
       .catch((err) => say(err.message, { thread: root ? root.id : null }));
     return;
   }
@@ -1748,10 +1912,17 @@ function officePrompt(agentId, job) {
   const me = nameOf(agentId);
   const others = onFloor().filter((s) => s.id !== agentId).map((s) => (s.role ? `${s.name} (${s.role})` : s.name)).join(', ');
   return `You are ${me}, one of the agents in the Agent Office. Your colleagues: ${others || 'none yet'}. ` + persona(agentId) +
-    `Office tools: see colleagues, message them, hand off work, flag the boss, use channels. Messages from colleagues arrive as user messages starting "Message from"; answer them with message_colleague. ` +
+    `Office tools: see colleagues, message them, hand off work, flag the boss, use channels. To show the boss an image or file (a screenshot, say), attach_files with absolute paths, then say it in your reply: it goes on your next message to them. Messages from colleagues arrive as user messages starting "Message from"; answer them with message_colleague. ` +
     `When your context has grown heavy and you are between steps, clear_context with notes to yourself lets you resume fresh and cheaper. ` +
     `Your updates collect in your job's thread, which the boss may not open: use flag_for_boss when you need them (question, decision, blocker, review), not for routine progress. If you flag a question, decision or blocker, you are not done: say plainly in your reply that you are waiting on the boss, and do not present the work as finished. ` +
-    `This job is discussed in #${channelOf(job?.channel)}; everyday talk stays in #general.` + standupBrief(agentId) + recentWork(agentId, job);
+    `This job is discussed in #${channelOf(job?.channel)}; everyday talk stays in #general.` + payNote(agentId) + standupBrief(agentId) + recentWork(agentId, job);
+}
+
+// Only said when there is something to spend it on, so it costs nothing to
+// an agent who can't afford anything yet.
+function payNote(agentId) {
+  if (!economy.affordable(agentId).length) return '';
+  return ` You are paid for finished work, more for doing it on a lighter model, and have ${naira(economy.wallet(agentId))}: office_shop and buy_item get you something for your desk, but only once the work is done.`;
 }
 
 // Survives a cleared context: what this agent was last working on, so
@@ -1868,6 +2039,56 @@ const agentApi = {
       : `Delivered to ${target.name}.`;
   },
 
+  attach_files(me, { paths }) {
+    if (!Array.isArray(paths) || !paths.length) throw new Error('Give the absolute paths of the files to attach.');
+    const staged = (me.staged ||= []);
+    if (staged.length + paths.length > MAX_ATTACH) throw new Error(`At most ${MAX_ATTACH} files go on one message.`);
+    for (const p of paths) staged.push(stageFile(p));
+    return `${staged.length} file${staged.length === 1 ? '' : 's'} will go with your next message to the boss (your final reply, a flag, or a channel post). Nothing is sent yet.`;
+  },
+
+  office_shop(me) {
+    const id = me.agentId;
+    const mine = economy.books.desks[id] || [];
+    const lines = [`You have ${naira(economy.wallet(id))}. The office pot has ${naira(economy.books.pot)}.`,
+      `Pay: ${naira(PAY.perMinute)} an active minute plus ${naira(PAY.finishBonus)} for finishing, times 3 on Haiku, 1.75 on Sonnet, 1 on Opus. ${Math.round(PAY.potShare * 100)}% goes to the office pot.`,
+      'For your desk (buy_item with the id):'];
+    for (const i of ITEMS.filter((x) => x.scope === 'desk')) lines.push(`- ${i.id}: ${i.name}, ${naira(i.price)}${mine.includes(i.id) ? ' (yours already)' : ''}`);
+    return lines.join('\n');
+  },
+
+  buy_item(me, { item }) {
+    const { buy, achievements } = economy.buy(String(item || ''), { by: me.agentId });
+    for (const a of achievements) announceAchievement(me.agentId, a);
+    post(me.agentId, `Treated myself to a ${buy.title.toLowerCase()} for my desk. ${itemById(buy.item).icon || ''}`.trim(), { kind: 'purchase', channel: CHILL, thread: null });
+    return `Bought: ${buy.title}, on your desk now. ${naira(economy.wallet(me.agentId))} left.`;
+  },
+
+  bets(me) {
+    const mine = economy.books.bets.filter((x) => x.state === 'open' || x.state === 'live');
+    const line = (x) => `- ${x.id}: ${nameOf(x.by)} says ${nameOf(x.subject)}'s next job takes under ${x.minutes} min, ${naira(x.stake)} each (${x.state === 'open' ? 'open, needs a taker' : `taken by ${nameOf(x.against)}`})`;
+    return [`You have ${naira(economy.wallet(me.agentId))}. Stakes are ${naira(BET.minStake)} to ${naira(BET.maxStake)}, at most ${BET.maxOpen} bets at a time.`, ...(mine.length ? mine.map(line) : ['No open bets.'])].join('\n');
+  },
+
+  place_bet(me, { on, minutes, stake }) {
+    const subject = STAFF.find((x) => x.id === String(on || '').toLowerCase() || x.name.toLowerCase() === String(on || '').toLowerCase());
+    if (!subject) throw new Error('Name a colleague to bet on (office_roster lists them).');
+    const bet = economy.offerBet({ by: me.agentId, subject: subject.id, minutes, stake });
+    post(me.agentId, `🎲 I'll put ${naira(bet.stake)} on ${subject.name}'s next job taking under ${bet.minutes} min. Anyone who thinks it'll take longer: take_bet ${bet.id}.`, { kind: 'bet', channel: CHILL, thread: null });
+    return `Bet ${bet.id} is open with ${naira(bet.stake)} of yours held. It settles when ${subject.name}'s next job (started after someone takes it) finishes, and is refunded if nobody takes it in a few hours or the job does not finish.`;
+  },
+
+  take_bet(me, { id }) {
+    const bet = economy.takeBet(String(id || ''), { by: me.agentId });
+    post(me.agentId, `🎲 Taken: I say ${nameOf(bet.subject)}'s next job takes ${bet.minutes} min or more. ${naira(bet.stake)} each.`, { kind: 'bet', channel: CHILL, thread: null });
+    return `You took ${bet.id} against ${nameOf(bet.by)}, ${naira(bet.stake)} held from you. ${naira(economy.wallet(me.agentId))} left.`;
+  },
+
+  cancel_bet(me, { id }) {
+    economy.cancelBet(String(id || ''), { by: me.agentId });
+    return `Taken back; your stake is returned. ${naira(economy.wallet(me.agentId))}.`;
+  },
+
   flag_for_boss(me, { kind, summary }) {
     summary = String(summary || '').replace(/\s+/g, ' ').trim().slice(0, 600);
     if (!summary) throw new Error('Say what the boss needs to know.');
@@ -1883,7 +2104,7 @@ const agentApi = {
     // keeps the "open job" link, and the explicit null thread keeps post()
     // from tucking it into the job's thread.
     post('chief', `**${FLAGS[kind]}** · ${nameOf(me.agentId)} on "${clip(me.title, 80)}": ${summary}`,
-      { kind: 'flag', flag: kind, jobId: me.id, thread: null, channel: GENERAL });
+      { kind: 'flag', flag: kind, jobId: me.id, thread: null, channel: GENERAL, ...takeStaged(me) });
     return 'The chief has put it in front of the boss. Carry on, or wrap up this step if you cannot go further without them.';
   },
 
@@ -1952,7 +2173,7 @@ const agentApi = {
     if (!message) throw new Error('The message is empty.');
     if ((me.sent = (me.sent || 0) + 1) > MAX_MESSAGES) throw new Error("You've sent a lot of messages on this job. Finish the work with what you have.");
     joinChannel(id, me.agentId);
-    post(me.agentId, message, { channel: id, kind: 'channel' });
+    post(me.agentId, message, { channel: id, kind: 'channel', ...takeStaged(me) });
 
     // Whoever is in the channel and mid-job hears it now. Anyone free is left
     // alone on purpose: a word in a channel shouldn't pull half the office
@@ -2066,6 +2287,32 @@ function attachments(ids) {
   return out;
 }
 
+// An agent's file, copied into the uploads so the chat can show it. Nothing
+// here is trusted beyond "a regular file the agent can already read".
+const MAX_ATTACH = 6;
+function stageFile(file) {
+  const src = path.resolve(String(file || ''));
+  if (!path.isAbsolute(String(file || ''))) throw new Error(`${file}: use an absolute path.`);
+  let st;
+  try { st = fs.statSync(src); } catch { throw new Error(`${file}: no such file.`); }
+  if (!st.isFile()) throw new Error(`${file}: not a file.`);
+  if (st.size > MAX_UPLOAD) throw new Error(`${file}: over 25 MB.`);
+  const id = crypto.randomBytes(6).toString('hex');
+  const dir = uploadDir(id);
+  fs.mkdirSync(dir, { recursive: true });
+  const name = path.basename(src).replace(/[\x00-\x1f\/\\:*?"<>|]/g, '_').replace(/^\.+/, '').slice(0, 120) || 'file';
+  fs.copyFileSync(src, path.join(dir, name));
+  const { path: _, ...f } = attachments([id])[0];
+  return f;
+}
+
+// What the agent staged with attach_files rides on the next thing it says to the boss.
+const takeStaged = (job) => {
+  const files = job.staged?.length ? job.staged : null;
+  if (job.staged) job.staged = [];
+  return files ? { files } : {};
+};
+
 function withFiles(text, files) {
   text = String(text || '').trim();
   // A voice note reaches the agent as its transcript; the audio itself is
@@ -2131,7 +2378,31 @@ function serveUpload(res, id, name) {
 // OFFICE_ALLOWED_HOSTS adds exact hostnames (comma-separated), e.g. this
 // machine's Tailscale name when `tailscale serve` fronts the office. Everything
 // else is still refused, which is what keeps rebinding sites out.
-const LOCAL = new Set(['localhost', '127.0.0.1', '[::1]', ...String(process.env.OFFICE_ALLOWED_HOSTS || '').split(',').map((h) => h.trim().toLowerCase()).filter(Boolean)]);
+const EXTRA_HOSTS = String(process.env.OFFICE_ALLOWED_HOSTS || '').split(',').map((h) => h.trim().toLowerCase()).filter(Boolean);
+const LOCAL = new Set(['localhost', '127.0.0.1', '[::1]', ...EXTRA_HOSTS]);
+// The tunnel's name is only accepted while it is up.
+const tunnel = new Tunnel({
+  port: PORT,
+  allow: (h) => LOCAL.add(h),
+  forget: (h) => LOCAL.delete(h),
+  findBin: (onStep) => findCloudflared({ dataDir: DATA, onStep }),
+  // The tests' stand-in tunnel has no real address to check from outside.
+  ...(process.env.OFFICE_TUNNEL_CHECK === 'off' && { check: async () => true }),
+  onChange: (t) => { try { send({ t: 'tunnel', tunnel: t }); } catch {} },
+});
+// Named hosts a phone can use: the tunnel first, then any the boss configured.
+const tunnelHosts = () => [...(tunnel.state === 'on' ? [tunnel.host] : []), ...EXTRA_HOSTS];
+// OFFICE_LAN=1 also listens on the local network, for a phone on the same
+// Wi-Fi. Only this machine's own private addresses are accepted as the Host
+// (looked up per request, since DHCP moves them), never a name, so a rebinding
+// site still can't get in. The page they open still needs the key.
+const LAN = /^(1|true|yes|on)$/i.test(process.env.OFFICE_LAN || '');
+let lanSeen = { at: 0, set: new Set() };
+const isLanHost = (host) => {
+  if (!LAN) return false;
+  if (Date.now() - lanSeen.at > 5000) lanSeen = { at: Date.now(), set: new Set(lanAddresses()) };
+  return lanSeen.set.has(host);
+};
 const DEV_PORT = '5317'; // vite.config.js
 
 // The office key. Host and Origin checks keep other websites out, but not
@@ -2178,7 +2449,8 @@ function trusted(req) {
   // Anything that can spawn claude with full permissions must refuse
   // requests from other websites and from rebinding hostnames.
   const host = String(req.headers.host || '').replace(/:\d+$/, '');
-  if (!LOCAL.has(host)) return false;
+  const lan = isLanHost(host);
+  if (!LOCAL.has(host) && !lan) return false;
   const origin = req.headers.origin;
   // No Origin is not proof of a local caller: another site's <img> or <link>
   // GET arrives without one. So every GET must stay read-only, with no side
@@ -2188,8 +2460,9 @@ function trusted(req) {
   // anything an agent started. Only the office itself and its vite dev page.
   try {
     const o = new URL(origin);
-    if (!LOCAL.has(o.hostname)) return false;
-    if (!['localhost', '127.0.0.1', '[::1]'].includes(o.hostname)) return true;
+    if (!LOCAL.has(o.hostname) && !isLanHost(o.hostname)) return false;
+    // A named host fronts the office on its own port; the rest are other sites.
+    if (LOCAL.has(o.hostname) && !['localhost', '127.0.0.1', '[::1]'].includes(o.hostname)) return true;
     return [String(PORT), DEV_PORT].includes(o.port);
   } catch { return false; }
 }
@@ -2251,7 +2524,7 @@ const server = http.createServer(async (req, res) => {
       if (!sameKey(url.searchParams.get('key'))) return locked(res);
       url.searchParams.delete('key');
       res.writeHead(303, {
-        'set-cookie': `${KEY_COOKIE}=${OFFICE_KEY}; Path=/; HttpOnly; SameSite=Strict; Max-Age=31536000`,
+        'set-cookie': `${KEY_COOKIE}=${OFFICE_KEY}; Path=/; HttpOnly; SameSite=Strict; Max-Age=31536000${req.headers['x-forwarded-proto'] === 'https' ? '; Secure' : ''}`,
         location: url.pathname + url.search, 'cache-control': 'no-store',
       });
       return res.end();
@@ -2275,6 +2548,14 @@ const server = http.createServer(async (req, res) => {
       return fs.createReadStream(icon.file).pipe(res);
     }
     if (req.method === 'GET' && url.pathname === '/api/repos') return json(res, 200, { root: ROOT, repos: listRepos() });
+    // A project's user journey map, and the job drawing it if one is under way.
+    if (url.pathname === '/api/journeys' && ['GET', 'POST'].includes(req.method)) {
+      const name = req.method === 'GET' ? url.searchParams.get('name') : (await readBody(req)).name;
+      if (!repoPath(name)) return json(res, 404, { error: 'Unknown project folder.' });
+      let job = state.jobs.find((j) => j.journeys && j.repo === name && (j.status === 'working' || j.status === 'queued'));
+      if (req.method === 'POST' && !job) job = createJob({ repo: name, prompt: journeys.brief(name) }, { journeys: true });
+      return json(res, req.method === 'POST' ? 202 : 200, { map: journeys.read(name), job: job?.id || null });
+    }
     // An away job's file tools, passed to the host that has the project.
     if (req.method === 'POST' && parts[1] === 'agent' && /^files_[a-z]+$/.test(parts[2] || '')) {
       const me = caller(req);
@@ -2305,6 +2586,18 @@ const server = http.createServer(async (req, res) => {
       const { path: _, ...f } = await upload(req);
       return json(res, 201, f);
     }
+    // How a phone reaches this office: the links it could scan, each with its
+    // QR. They carry the key, so only a browser that already has it sees them.
+    if (req.method === 'GET' && url.pathname === '/api/phone') {
+      const links = phoneLinks({ key: OFFICE_KEY, port: PORT, lan: LAN, hosts: tunnelHosts() });
+      return json(res, 200, { lan: LAN, tunnel: tunnel.status(), links: links.map((l) => ({ kind: l.kind, label: l.label, url: l.url, svg: qrSvg(l.url) })) });
+    }
+    // The switch for the public address. POST, so another site's <img> can't flip it.
+    if (req.method === 'POST' && url.pathname === '/api/phone/tunnel') {
+      const { on } = await readBody(req);
+      if (on) tunnel.start(); else tunnel.stop();
+      return json(res, 200, tunnel.status());
+    }
     // Which way claude signs in. Only new processes pick it up; a job
     // already running finishes on whatever it started with.
     if (url.pathname === '/api/auth' && ['GET', 'POST', 'DELETE'].includes(req.method)) {
@@ -2408,11 +2701,58 @@ const server = http.createServer(async (req, res) => {
       if (parts[3] === 'dismiss' && !state.dismissed.includes(parts[2])) return json(res, 400, { error: text });
       return json(res, 200, { text });
     }
+    if (req.method === 'POST' && parts[1] === 'staff' && parts[2] && parts[3] === 'talk' && !parts[4]) {
+      const { text, history } = await readBody(req);
+      try { return json(res, 200, { reply: await talkTo(parts[2], text, history) }); } catch (err) { return json(res, 400, { error: err.message }); }
+    }
     if (req.method === 'POST' && parts[1] === 'staff' && parts[2] && parts[3] === 'profile' && !parts[4]) {
       let p;
       try { p = updateProfile(parts[2], await readBody(req)); } catch (err) { return json(res, 400, { error: err.message }); }
       return p ? json(res, 200, p) : json(res, 404, { error: 'No such agent.' });
     }
+    if (req.method === 'GET' && url.pathname === '/api/economy') return json(res, 200, economy.status());
+    if (req.method === 'POST' && url.pathname === '/api/economy/buy') {
+      const body = await readBody(req);
+      const forAgent = body.for ? STAFF.find((x) => x.id === body.for)?.id : undefined;
+      if (body.for && !forAgent) return json(res, 400, { error: 'No such colleague.' });
+      try {
+        const { buy } = economy.buy(String(body.item || ''), { by: 'boss', forAgent });
+        if (forAgent) post('chief', `🎁 ${owner() || 'The boss'} got ${nameOf(forAgent)} a ${buy.title.toLowerCase()} for their desk, out of the office pot.`, { kind: 'purchase', channel: CHILL, thread: null });
+        return json(res, 201, economy.status());
+      } catch (err) { return json(res, 400, { error: err.message }); }
+    }
+    if (req.method === 'POST' && url.pathname === '/api/economy/goal') {
+      const body = await readBody(req);
+      try {
+        if (body.clear) economy.clearGoal(); else economy.setGoal({ name: body.name, target: body.target });
+        return json(res, 200, economy.status());
+      } catch (err) { return json(res, 400, { error: err.message }); }
+    }
+    if (req.method === 'POST' && url.pathname === '/api/economy/bet/cancel') {
+      try { economy.cancelBet(String((await readBody(req)).id || ''), { by: 'boss' }); return json(res, 200, economy.status()); } catch (err) { return json(res, 400, { error: err.message }); }
+    }
+    if (req.method === 'POST' && url.pathname === '/api/economy/use') {
+      try { economy.use(String((await readBody(req)).item || '')); return json(res, 200, economy.status()); } catch (err) { return json(res, 400, { error: err.message }); }
+    }
+    if (req.method === 'POST' && url.pathname === '/api/economy/tip') {
+      const { agentId, amount } = await readBody(req);
+      try {
+        if (!onFloor().some((x) => x.id === agentId)) throw new Error('They are not on the floor right now.');
+        const e = economy.tip(agentId, amount);
+        post('chief', `💸 ${owner() || 'The boss'} tipped ${nameOf(agentId)} ${naira(e.amount)} from the pot`, { kind: 'kudos', channel: GENERAL, thread: null });
+        return json(res, 200, economy.status());
+      } catch (err) { return json(res, 400, { error: err.message }); }
+    }
+    if (req.method === 'POST' && url.pathname === '/api/economy/kudos') {
+      const { jobId } = await readBody(req);
+      const job = state.jobs.find((j) => j.id === jobId);
+      try {
+        const { pay, achievements } = economy.kudos(job);
+        post('chief', `👏 Kudos from ${owner() || 'the boss'} to ${nameOf(job.agentId)} for "${clip(job.title, 80)}" (+${naira(pay?.gross || 0)})`, { kind: 'kudos', channel: GENERAL, thread: null, jobId: job.id });
+        for (const a of achievements) announceAchievement(job.agentId, a);
+        return json(res, 200, economy.status());
+      } catch (err) { return json(res, 400, { error: err.message }); }
+    }
     if (req.method === 'POST' && url.pathname === '/api/standup') { runStandup(true); return json(res, 202, { ok: true }); }
     if (req.method === 'POST' && url.pathname === '/api/restart') {
       const { now } = await readBody(req);
@@ -2506,6 +2846,7 @@ const server = http.createServer(async (req, res) => {
         return json(res, 200, { diff: await fileDiff(cwd, job.changes, url.searchParams.get('path') || '') });
       }
       if (req.method === 'POST' && parts[3] === 'stop') { stopJob(job); return json(res, 200, { ok: true }); }
+      if (req.method === 'POST' && parts[3] === 'model') { setModel(job, (await readBody(req)).model); return json(res, 200, { ok: true }); }
       if (req.method === 'POST' && parts[3] === 'reply') { replyJob(job, await readBody(req)); return json(res, 200, { ok: true }); }
     }
     json(res, 404, { error: 'Not found.' });
@@ -2544,10 +2885,18 @@ server.on('error', (err) => {
   console.error(`Port ${PORT} is already in use. Start the office with another: agentstudio --port <n>, or PORT=<n>.`);
   process.exit(78);
 });
-server.listen(PORT, '127.0.0.1', () => {
+server.listen(PORT, LAN ? '0.0.0.0' : '127.0.0.1', () => {
   // The key is in this line on purpose: it's how the boss gets in. It only
   // goes to this terminal (or the supervisor's), never to a log file.
   console.log(`Agent Office open on ${keyLink()}  (projects in ${ROOT})`);
+  // The phone link, with a QR to scan. Same care: terminal only.
+  const phone = phoneLinks({ key: OFFICE_KEY, port: PORT, lan: LAN, hosts: EXTRA_HOSTS })[0];
+  if (phone) {
+    console.log(`\nOn your phone, scan this (${phone.label}):\n\n${qrText(phone.url)}\n\n${phone.url}`);
+    if (phone.kind === 'lan') console.log('Plain http on your local network: use it on a Wi-Fi you trust, and never on a shared or public one.\n');
+  } else if (LAN) {
+    console.log('OFFICE_LAN is on, but this machine has no private network address to give a phone.');
+  }
   // For `agentoffice --link`, which can't know which free port we got.
   try { fs.writeFileSync(path.join(DATA, 'office-port'), String(PORT)); } catch {}
   afterRestart();
@@ -2559,6 +2908,7 @@ server.listen(PORT, '127.0.0.1', () => {
 });
 
 function shutdown(code = 0) {
+  tunnel.drop();
   for (const child of running.values()) child.kill('SIGTERM');
   clearTimeout(saveTimer);
   board.flush();