ai-agentmanager 1.5.0 → 1.6.0

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 1.6.0 (2026-10-31)
+
+- **Changes explained one by one:** `agentmgr doc <agent> walkthrough` explains each hunk of an agent's changes (what, why, risk, what to check) in the order a reviewer should read them, from the same diff the review screen shows. The review screen and a split view for it come next.
+- **Start at login:** a switch in ☰ → Settings installs (or removes) the login service, so the daemon and running agents come back by themselves after a restart, without a terminal command. Getting started lists it until it's on, and `agentmgr ui` mentions it when it's off. Same service as `agentmgr service install` (launchd on macOS, systemd on Linux).
+- **Attachments:** **📎 Attach files** in New agents and Ask Agent: pick, drop or paste screenshots, logs and documents. Each agent gets its own copy, listed in its request, in a folder Claude Code and Codex can read without a prompt (a team or race shares one copy). Backlog items keep theirs until they start. CLI: `--file-attach <path>` on `agentmgr add` and `agentmgr ask`.
+- **Ask Agent:** **Ask Claude** is now **Ask Agent**, with an Engine choice (Claude Code, Codex, Antigravity, Muse Code) and the engine's notice, if any. `agentmgr ask --engine <engine>`.
+
 ## 1.5.0 (2026-10-31)
 
 - **Muse Code engine:** Meta's Muse Code CLI (`muse`) as a fourth engine: `--engine muse` or **Muse Code** in the Engine picker. Session adoption, resume (messages typed once idle), conversation and usage, trust and approval questions in the inbox, a clean stop, and Explain. The picker warns when Muse is in contributor mode. Stuck detection from commands and edits isn't there yet for Muse.

package/README.md

@@ -42,7 +42,7 @@ Run one background [Claude Code](https://claude.com/claude-code) agent per inten
 - **Follows your conventions.** Before changing anything, agents review `CLAUDE.md` / `AGENTS.md`, skills, hooks and settings (repo and `~/.claude`), and follow them.
 - **Tokens and cost.** Input, output and cache tokens are tracked per session, subagents included, alongside the cost Claude Code reports.
 - **No trust prompt.** Folders agents run in are pre-trusted, so Claude's "trust this folder" prompt doesn't block them.
-- **Survives restarts and reboots.** Agents that were running when the daemon stopped (restart, crash or reboot) are resumed with the same session IDs when it starts again. `agentmgr service install` starts the daemon at login.
+- **Survives restarts and reboots.** Agents that were running when the daemon stopped (restart, crash or reboot) are resumed with the same session IDs when it starts again. For that after a reboot, turn on **Start at login** in ☰ → Settings (or run `agentmgr service install`); without it, the daemon starts only when you run `agentmgr`.
 - **Shells next to each agent.** **Open shell** gives a terminal in the agent's folder for running commands by hand. **+ Shell** opens as many more as you need, each in its own tab.
 - **Browser tabs.** **+ Browser** opens a page as this machine sees it, in a tab next to the agent's terminals. That can be the agent's dev server on `localhost:5173`, a site on its network or VPN, or any address. Local addresses the agent prints are offered as suggestions. It works from your phone or laptop too (see below).
 - **Live browser.** Browser tabs run a real Chrome on this machine and stream it into the tab: you see its screen and your clicks, scrolling, typing and paste go back to it, from the laptop or the phone. Because the page runs here, `localhost` is this machine, sites that refuse to be framed load normally, and popups (a sign-in window) open as tabs of their own and come back when they close. Chrome (or Chromium, Brave, Edge; `browserBin` in config.json picks one) runs headless with its own profile in `~/.agentmanager/browser-profile`, so sign-ins are remembered; it starts on the first view and stops after 15 minutes with nobody watching. Downloads go to `~/Downloads/agentmanager`. A site that still refuses it as a bot may accept `"browserHeadless": false`, which runs Chrome with a real window on this machine's screen. On Linux where Chrome's sandbox can't start (containers, Ubuntu 23.10+ user-namespace restrictions) the tab says so; `"browserNoSandbox": true` runs it without the sandbox, at your own risk. **Lite** on the bar switches a tab to the frame mode (the page loads in your own browser; quicker for a dev server).
@@ -51,7 +51,8 @@ Run one background [Claude Code](https://claude.com/claude-code) agent per inten
 - **Your layout.** Drag the edge of the agent list, or the line between the brief and the terminal, to resize them; double-click a line to reset it. **Expand** (Ctrl+Shift+E) fills the window with the terminal, shell or browser tab; **Full screen** fills the screen. Agents active in the last day sort to the top; idle ones are dimmed.
 - **As an app.** In Chrome or Edge, click the install icon in the address bar (or ⋮ → Cast, save and share → Install page as app). AI Agent Manager then opens in its own window with its own Dock or taskbar icon, and the daemon keeps running as before.
 - **About.** The version next to the title opens the About box: release date, author, license, links, and how this daemon runs (data folder, port, Node.js, which `claude`). **Check for updates** asks npm for the newest version. In a terminal: `agentmgr about` (`--check` for updates).
-- **General sessions.** **Ask Claude** starts a session with no repo, folder or intent, for questions. It is tracked and resumable like any other agent.
+- **General sessions.** **Ask Agent** starts a session with no repo, folder or intent, for questions, on Claude Code or any other engine you have (Codex, Antigravity, Muse Code). It is tracked and resumable like any other agent.
+- **Attachments.** **📎 Attach files** in New agents and Ask Agent (or drop files on the dialog, or paste a screenshot into the text box) adds a screenshot, a log or a document to the request. Each agent gets its own copy in `~/.agentmanager/uploads/<agent>/`, listed in its request, and Claude Code and Codex can read that folder without asking. From the CLI: `agentmgr add … --file-attach error.log` and `agentmgr ask … --file-attach shot.png`.
 
 New in 0.2, for running many agents at once:
 
@@ -83,13 +84,13 @@ Runs on macOS and Linux; on Windows, use WSL2. Requires Node 20+, `git`, and the
 
 ```sh
 npm install -g ai-agentmanager          # the latest release
-npm install -g ai-agentmanager@1.5.0    # or a specific one
+npm install -g ai-agentmanager@1.6.0    # or a specific one
 ```
 
 Or from the repository, at a release tag:
 
 ```sh
-git clone --branch v1.5.0 --depth 1 https://github.com/jdmunta/ai-agentmanager-core.git
+git clone --branch v1.6.0 --depth 1 https://github.com/jdmunta/ai-agentmanager-core.git
 cd ai-agentmanager-core
 npm install
 npm link            # optional: puts `agentmgr` on your PATH
@@ -109,7 +110,7 @@ npm link
 | Installed with | Update |
 | --- | --- |
 | npm | `npm install -g ai-agentmanager@latest` |
-| A clone at a release tag | `git fetch --tags && git checkout v1.5.0 && npm install` (the tag you want) |
+| A clone at a release tag | `git fetch --tags && git checkout v1.6.0 && npm install` (the tag you want) |
 | A clone of `main` | `git pull && npm install` |
 
 **Check your setup.** `agentmgr doctor` checks Node.js, Claude Code and its sign-in, git, `gh`, the data folder, the daemon's port and Chrome, and says how to fix anything missing.
@@ -920,7 +921,7 @@ Usage comes from the session transcripts and is refreshed every few seconds whil
   - **From another device** (remote access), AI Agent Manager gives each site its own HTTPS port. That port relays to the site as the machine sees it, so you can check from your phone what the agent built or what the machine can reach. Absolute links, redirects and hot-reload WebSockets on the same site keep working, and the site's "don't show me in a frame" headers are dropped. A link or redirect to a different site leaves the relay.
   - **Safety:** the relay serves only signed-in devices. It never relays to AI Agent Manager's own ports on any of the machine's addresses, and it removes AI Agent Manager's sign-in cookie before forwarding. Sites other than localhost must present a valid certificate. The relays close when remote access is turned off.
   - If a tab stays blank on a device, open it once with **↗** and accept the certificate there.
-- **Ask Claude** (or `agentmgr ask`) creates a `general` agent. All general sessions share `~/.agentmanager/general`, so Claude's folder-trust prompt only appears the first time.
+- **Ask Agent** (or `agentmgr ask`, with `--engine` for another engine) creates a `general` agent. All general sessions share `~/.agentmanager/general`, so Claude's folder-trust prompt only appears the first time.
 
 ## Configuration
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-agentmanager",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "Run background coding agents (Claude Code, Codex) per intent, and keep track of them from a web UI, your phone or the CLI",
   "keywords": [
     "claude",

package/public/app.js

@@ -4,6 +4,7 @@ import { marked } from '/vendor/marked/marked.esm.js';
 import DOMPurify from '/vendor/dompurify/purify.es.mjs';
 import { touchScroll } from '/touchscroll.js';
 import { openStream, post, REMOTE } from '/transport.js';
+import { attachBox } from '/attach.js';
 import { initReview } from '/review.js';
 import { initLand, prChips } from '/land.js';
 import { initTriggers } from '/triggers.js';
@@ -3147,6 +3148,7 @@ $('#recent-bar').addEventListener('click', (e) => {
 // ------------------------------------------------------------------ new agents dialog
 
 const dialog = $('#new-dialog');
+const newFiles = attachBox({ slot: $('#new-attach'), form: $('#new-form'), paste: $('#new-form').intents, esc, toast });
 function renderProjectOptions() {
   $('#project-options').innerHTML = projectsState
     .map((p) => `<option value="${esc(p.shortcut)}">${esc(p.name)}${p.repo ? ` · ${esc(p.repo)}` : p.dir ? ` · ${esc(p.dir)}` : ''}</option>`)
@@ -3224,6 +3226,12 @@ $('#new-form').addEventListener('submit', async (e) => {
   e.preventDefault();
   const f = new FormData(e.target);
   const intents = formIntents(e.target);
+  if (newFiles.pending()) {
+    $('#new-error').textContent = 'Still uploading the attached files; try again in a moment';
+    $('#new-error').hidden = false;
+    return;
+  }
+  const attachments = newFiles.paths().length ? newFiles.paths() : undefined;
   if (f.get('when') === 'team') {
     // "analyst=opus reviewer=opus"
     const models = Object.fromEntries(
@@ -3234,6 +3242,7 @@ $('#new-form').addEventListener('submit', async (e) => {
     );
     try {
       const team = await api('POST', '/teams', {
+        attachments,
         intent: intents.join('\n'),
         critics: Number(f.get('critics')),
         mode: f.get('teamMode') || undefined,
@@ -3253,6 +3262,7 @@ $('#new-form').addEventListener('submit', async (e) => {
       teams.set(team.id, team);
       dialog.close();
       e.target.reset();
+      newFiles.clear();
       syncWhen();
       openTeam(team.id);
       toast(team.mode === 'lead' ? 'Team started: one lead session with sub-agents' : `Team started: ${team.members.length} agents`);
@@ -3274,6 +3284,7 @@ $('#new-form').addEventListener('submit', async (e) => {
       });
     try {
       const race = await api('POST', '/races', {
+        attachments,
         intent: intents.join('\n'),
         variants,
         testCommand: f.get('testCommand') || undefined,
@@ -3288,6 +3299,7 @@ $('#new-form').addEventListener('submit', async (e) => {
       races.set(race.id, race);
       dialog.close();
       e.target.reset();
+      newFiles.clear();
       syncWhen();
       openRace(race.id);
       toast(`Race started: ${race.rows.length} attempts`);
@@ -3300,6 +3312,7 @@ $('#new-form').addEventListener('submit', async (e) => {
   if (f.get('when') === 'backlog') {
     try {
       const added = await api('POST', '/backlog', {
+        attachments,
         items: intents,
         repo: f.get('repo') || undefined,
         dir: f.get('dir') || undefined,
@@ -3315,6 +3328,7 @@ $('#new-form').addEventListener('submit', async (e) => {
       });
       dialog.close();
       e.target.reset();
+      newFiles.clear();
       showTab('backlog');
       toast(`Queued ${added.length} item${added.length > 1 ? 's' : ''}`);
     } catch (err) {
@@ -3325,6 +3339,7 @@ $('#new-form').addEventListener('submit', async (e) => {
   }
   try {
     const created = await api('POST', '/agents', {
+        attachments,
       priority: Number(f.get('priority')),
       intents,
       repo: f.get('repo') || undefined,
@@ -3342,6 +3357,7 @@ $('#new-form').addEventListener('submit', async (e) => {
     created.forEach((a) => agents.set(a.id, a));
     dialog.close();
     e.target.reset();
+      newFiles.clear();
     select(created[0].id);
     toast(`Created ${created.length} agent${created.length > 1 ? 's' : ''}`);
     if (created.length === 1 && created[0].runtime.planning) term.open(created[0].id);
@@ -3418,17 +3434,29 @@ $('#ask-btn').onclick = () => {
   askDialog.querySelector('textarea').focus();
 };
 $('#ask-cancel').onclick = () => askDialog.close();
+const askFiles = attachBox({ slot: $('#ask-attach'), form: $('#ask-form'), paste: $('#ask-form textarea'), esc, toast });
 $('#ask-form').addEventListener('submit', async (e) => {
   e.preventDefault();
   const f = new FormData(e.target);
+  if (askFiles.pending()) {
+    $('#ask-error').textContent = 'Still uploading the attached files; try again in a moment';
+    $('#ask-error').hidden = false;
+    return;
+  }
   try {
     const a = await api('POST', '/general', {
       question: String(f.get('question') || '').trim() || undefined,
       name: String(f.get('name') || '').trim() || undefined,
+      engine: f.get('engine') || undefined,
+      attachments: askFiles.paths().length ? askFiles.paths() : undefined,
     });
     agents.set(a.id, a);
     askDialog.close();
+    // Keep the engine for the next question; clear the rest.
+    const engine = e.target.engine.value;
     e.target.reset();
+    e.target.engine.value = engine;
+    askFiles.clear();
     select(a.id);
     // The shared general folder is ready almost immediately; open the terminal once it runs.
     const t0 = Date.now();
@@ -4011,18 +4039,19 @@ const ENGINE_LABEL = { claude: 'Claude', codex: 'Codex', antigravity: 'Antigravi
 async function loadEngines() {
   try {
     const list = (await api('GET', '/engines')).filter((e) => e.installed && e.id !== 'claude');
-    const sel = document.querySelector('#engine-field select');
-    for (const e of list) sel.append(Object.assign(document.createElement('option'), { value: e.id, textContent: e.label }));
-    $('#engine-field').hidden = !list.length;
     // Something to know before choosing an engine (Muse Code in contributor mode, say).
     const notices = Object.fromEntries(list.filter((e) => e.notice).map((e) => [e.id, e.notice]));
-    const show = () => {
-      const n = $('#engine-notice');
-      n.textContent = notices[sel.value] ?? '';
-      n.hidden = !notices[sel.value];
-    };
-    sel.addEventListener('change', show);
-    show();
+    for (const [field, notice] of [['#engine-field', '#engine-notice'], ['#ask-engine-field', '#ask-engine-notice']]) {
+      const sel = document.querySelector(`${field} select`);
+      for (const e of list) sel.append(Object.assign(document.createElement('option'), { value: e.id, textContent: e.label }));
+      $(field).hidden = !list.length;
+      const show = () => {
+        $(notice).textContent = notices[sel.value] ?? '';
+        $(notice).hidden = !notices[sel.value];
+      };
+      sel.addEventListener('change', show);
+      show();
+    }
   } catch {}
 }
 

package/public/attach.js

@@ -0,0 +1,100 @@
+// Attachments for a request that has no agent yet (New agents, Ask): pick, drop or paste files
+// (a screenshot, a log). Each uploads to the daemon right away and shows as a chip; the form sends
+// the uploaded paths, and the daemon copies them to each agent it creates.
+
+const fmtSize = (n) => (n < 1024 ? `${n} B` : n < 1048576 ? `${(n / 1024).toFixed(0)} KB` : `${(n / 1048576).toFixed(1)} MB`);
+
+/**
+ * `slot` is an element to fill with the button and chips; `form` takes drops; `paste` (a textarea)
+ * takes pasted files. Returns { paths(), pending(), clear() }.
+ */
+export function attachBox({ slot, form, paste, esc, toast }) {
+  const items = []; // { id, name, size, path?, error?, uploading }
+  let seq = 0;
+  slot.classList.add('attach-box');
+  slot.innerHTML = `<button type="button" class="small ghost attach-pick" title="Attach files: a screenshot, a log, a document. You can also drop them here or paste into the text box">📎 Attach files</button>
+    <input type="file" multiple hidden />
+    <span class="attach-chips"></span>`;
+  const input = slot.querySelector('input[type=file]');
+  const chips = slot.querySelector('.attach-chips');
+
+  function render() {
+    chips.innerHTML = items
+      .map(
+        (it) => `<span class="attach-chip ${it.error ? 'fail' : ''}" title="${esc(it.error ?? it.path ?? 'Uploading…')}">${esc(it.name)} <span class="hint">${it.uploading ? 'uploading…' : it.error ? 'failed' : fmtSize(it.size)}</span><button type="button" class="link" data-drop="${it.id}" title="Remove">×</button></span>`,
+      )
+      .join('');
+  }
+
+  async function add(files) {
+    for (const file of files) {
+      const name = file.name || `pasted-${Date.now()}.${(file.type.split('/')[1] || 'bin').replace(/\W/g, '')}`;
+      const it = { id: ++seq, name, size: file.size, uploading: true };
+      items.push(it);
+      render();
+      try {
+        const res = await fetch(`/api/uploads?name=${encodeURIComponent(name)}`, {
+          method: 'POST',
+          credentials: 'same-origin',
+          headers: { 'content-type': 'application/octet-stream', 'x-agentmgr': '1' },
+          body: file,
+        });
+        const data = await res.json().catch(() => ({}));
+        if (!res.ok) throw new Error(data.error || `HTTP ${res.status}`);
+        Object.assign(it, { path: data.path, size: data.size });
+      } catch (err) {
+        it.error = err.message;
+        toast(`Could not attach ${name}: ${err.message}`, 5000);
+      }
+      it.uploading = false;
+      render();
+    }
+  }
+
+  slot.querySelector('.attach-pick').onclick = () => input.click();
+  input.onchange = () => {
+    add([...input.files]);
+    input.value = '';
+  };
+  chips.addEventListener('click', (e) => {
+    const id = Number(e.target.closest('[data-drop]')?.dataset.drop);
+    if (!id) return;
+    items.splice(
+      items.findIndex((it) => it.id === id),
+      1,
+    );
+    render();
+  });
+  form.addEventListener('dragover', (e) => {
+    if ([...(e.dataTransfer?.types ?? [])].includes('Files')) {
+      e.preventDefault();
+      form.classList.add('dropping');
+    }
+  });
+  form.addEventListener('dragleave', (e) => {
+    if (!form.contains(e.relatedTarget)) form.classList.remove('dropping');
+  });
+  form.addEventListener('drop', (e) => {
+    form.classList.remove('dropping');
+    const files = [...(e.dataTransfer?.files ?? [])];
+    if (!files.length) return;
+    e.preventDefault();
+    add(files);
+  });
+  // A pasted screenshot (or copied files) attaches; pasted text stays text.
+  paste?.addEventListener('paste', (e) => {
+    const files = [...(e.clipboardData?.files ?? [])];
+    if (!files.length) return;
+    e.preventDefault();
+    add(files);
+  });
+
+  return {
+    paths: () => items.filter((it) => it.path).map((it) => it.path),
+    pending: () => items.some((it) => it.uploading),
+    clear() {
+      items.length = 0;
+      render();
+    },
+  };
+}

package/public/index.html

@@ -25,7 +25,7 @@
         <button id="assistant-btn" title="An always-on session that finds new work and starts agents for it">Assistant <span id="assistant-dot" class="assistant-dot" hidden></span></button>
         <button id="spend-btn" title="Results across agents (merge rate, time to PR, cost per merged PR), what they cost, and spending limits">Results <span id="spend-today" class="spend-today"></span></button>
         <button id="machine-btn" title="A terminal on this computer (your home folder), from any device you're signed in on">Terminal</button>
-        <button id="ask-btn" title="A general Claude session with no repo or folder">Ask Claude</button>
+        <button id="ask-btn" title="A general session with no repo or folder, on Claude Code or another engine you have (Codex, Muse Code, …)">Ask Agent</button>
         <button id="new-btn" class="primary">+ New agents</button>
         <div class="menu-wrap">
           <button id="menu-btn" class="menu-btn" type="button" aria-haspopup="menu" aria-expanded="false" title="Settings and preferences">
@@ -173,6 +173,7 @@
           <span class="sr-only">Intents</span>
           <textarea name="intents" rows="6" required placeholder="Add a dark mode toggle that remembers the user's choice&#10;Make search results show up as you type&#10;Find out why the dashboard takes 5 seconds to load and speed it up&#10;Add a one-click CSV export to the reports page"></textarea>
         </label>
+        <div id="new-attach"></div>
         <div class="row">
           <label>
             Git repository URL
@@ -307,16 +308,24 @@
 
     <dialog id="ask-dialog">
       <form id="ask-form" method="dialog">
-        <h2>Ask Claude</h2>
+        <h2>Ask an agent</h2>
         <p class="hint">A general session with no repo or folder. It is tracked and resumable like any other agent.</p>
         <label>
           Question <span class="hint">optional; you can also just type in the terminal</span>
           <textarea name="question" rows="4" placeholder="How do I tune GC for a JVM with a 32 GB heap?"></textarea>
         </label>
-        <label>
-          Name <span class="hint">optional</span>
-          <input name="name" placeholder="jvm-gc-questions" />
-        </label>
+        <div id="ask-attach"></div>
+        <div class="row">
+          <label>
+            Name <span class="hint">optional</span>
+            <input name="name" placeholder="jvm-gc-questions" />
+          </label>
+          <label id="ask-engine-field">
+            Engine
+            <select name="engine"><option value="">Claude Code</option></select>
+            <span class="hint warn" id="ask-engine-notice" hidden></span>
+          </label>
+        </div>
         <p id="ask-error" class="error" hidden></p>
         <div class="dialog-actions">
           <button type="button" id="ask-cancel" class="ghost">Cancel</button>
@@ -679,6 +688,11 @@
           <label class="check">Keep at most <input type="number" name="maxRunning" min="1" max="500" placeholder="no limit" class="num" /> agents open at once</label>
           <p class="hint">Above it, the agents idle longest are closed (they resume when you open them), so the machine stays responsive. Never closed: agents working, waiting for your answer, active in the last 5 minutes, marked Keep, or in a team that is still going. <span id="settings-running"></span></p>
         </fieldset>
+        <fieldset class="local-only" id="settings-service">
+          <legend>Start at login</legend>
+          <label class="check"><input type="checkbox" name="startAtLogin" /> Start AI Agent Manager when I log in</label>
+          <p class="hint">After a restart or a crash, the daemon comes back by itself and running agents resume; without it, it starts only when you run <code>agentmgr</code>. <span id="settings-service-state"></span></p>
+        </fieldset>
         <fieldset class="local-only">
           <legend>Updates</legend>
           <label class="check"><input type="checkbox" name="updateCheck" /> Check for a new release twice a day</label>

package/public/menu.js

@@ -52,15 +52,21 @@ export function initMenu({ api, esc, toast, $ }) {
   // ------------------------------------------------------------ Settings dialog
   const dialog = $('#settings-dialog');
   const form = $('#settings-form');
+  let service = null; // the login service as the dialog opened
   $('#settings-btn').onclick = async () => {
     $('#settings-error').hidden = true;
     try {
       const c = await api('GET', '/cleanup');
       form.maxRunning.value = c.maxRunning ?? '';
       $('#settings-running').textContent = `Open now: ${c.running}.`;
+      service = null;
       if (!remote()) {
         const u = await api('GET', '/update').catch(() => null);
         form.updateCheck.checked = u?.check !== false;
+        service = await api('GET', '/service').catch(() => null);
+        $('#settings-service').hidden = !service?.supported;
+        form.startAtLogin.checked = Boolean(service?.installed);
+        $('#settings-service-state').textContent = service?.installed ? (service.loaded ? 'On: the login service is loaded.' : 'On; loads at the next login.') : 'Off now.';
       }
       dialog.showModal();
     } catch (err) {
@@ -79,6 +85,11 @@ export function initMenu({ api, esc, toast, $ }) {
     try {
       const c = await api('PUT', '/cleanup', { maxRunning: form.maxRunning.value.trim() || null });
       if (!remote()) await api('PUT', '/update', { check: form.updateCheck.checked }).catch(() => {});
+      // Only when it changed: installing touches launchd / systemd.
+      if (!remote() && service?.supported && form.startAtLogin.checked !== Boolean(service.installed)) {
+        const s = await api('PUT', '/service', { enabled: form.startAtLogin.checked });
+        toast(s.installed ? `Starts at login from now on${s.note ? `. ${s.note}` : ''}` : 'No longer starts at login', 6000);
+      }
       dialog.close();
       toast(c.maxRunning ? `At most ${c.maxRunning} agents open; the ones idle longest close above that` : 'No limit on open agents');
     } catch (err) {

package/public/setup.js

@@ -3,6 +3,7 @@
 
 const STEPS = [
   ['agent', 'Start your first agent', 'Give it a request and a repo or folder; it works in its own branch.', '#new-btn', 'New agents'],
+  ['service', 'Start at login', 'So AI Agent Manager and your agents come back by themselves after a restart.', '#settings-btn', 'Settings'],
   ['alerts', 'Get Slack alerts', 'Hear when an agent needs you, is stuck or finished.', '#alerts-btn', 'Alerts'],
   ['assistant', 'Let work come to you', 'The assistant, or triggers (a GitHub label, a webhook), start agents for new work.', '#assistant-btn', 'Assistant'],
   ['remote', 'Use it from your phone', 'Answer agents from anywhere on your network.', '#remote-btn', 'Remote access'],

package/public/style.css

@@ -829,3 +829,11 @@ input.inline { display: inline-block; width: 80px; padding: 1px 4px; }
 .sr-only { position: absolute; width: 1px; height: 1px; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; }
 .hint.warn { display: block; margin-top: 4px; color: var(--yellow); }
 .hint.warn[hidden] { display: none; }
+
+/* Attachments in New agents and Ask: a button, then a chip per file. */
+.attach-box { display: flex; flex-wrap: wrap; align-items: center; gap: 6px; margin: -4px 0 10px; }
+.attach-chips { display: contents; }
+.attach-chip { display: inline-flex; align-items: center; gap: 6px; padding: 2px 4px 2px 8px; border: 1px solid var(--border); border-radius: 999px; background: var(--panel-2); font-size: 12px; max-width: 100%; }
+.attach-chip.fail { border-color: var(--red); }
+.attach-chip .link { padding: 0 4px; }
+form.dropping { outline: 2px dashed var(--accent, #6b8cff); outline-offset: 4px; }

package/src/backlog.js

@@ -89,7 +89,7 @@ export class Backlog extends EventEmitter {
   // ------------------------------------------------------------ editing
 
   /** Queue one item per title. Options are what an agent would take (repo, dir, base, project, ...). */
-  add(titles, { repo, dir, base, project, worktree, permissionMode, model, plan, planReview, engine, priority = 2 } = {}) {
+  add(titles, { repo, dir, base, project, worktree, permissionMode, model, plan, planReview, engine, attachments, priority = 2 } = {}) {
     const list = titles.map((t) => String(t ?? '').trim()).filter(Boolean);
     if (!list.length) throw err(400, 'At least one item is required');
     const pr = parsePriority(priority);
@@ -120,6 +120,8 @@ export class Backlog extends EventEmitter {
         permissionMode: permissionMode || null,
         model: model || null,
         engine: engine || null,
+        // Staged uploads; each item's agent gets its own copies when it starts.
+        attachments: Array.isArray(attachments) && attachments.length ? attachments.slice(0, 20).map(String) : undefined,
         plan: Boolean(plan),
         planReview: planReview ?? null,
         priority: pr,
@@ -219,6 +221,7 @@ export class Backlog extends EventEmitter {
       permissionMode: it.permissionMode,
       model: it.model,
       engine: it.engine ?? undefined,
+      attachments: it.attachments,
       plan: it.plan,
       planReview: it.planReview ?? undefined,
       priority: it.priority,

package/src/brief.js

@@ -411,6 +411,81 @@ export function diagramsOnly(markdown) {
     .trim();
 }
 
+// ------------------------------------------------------------------ Change walkthrough
+
+/**
+ * The agent's changes explained one by one, for review: each hunk of its diff gets a title, what
+ * changed, why, a risk and what to check, in the order a reviewer should read them.
+ * `hunks`: [{ id, file, head, text }].
+ */
+export function walkthroughPrompt({ intent, status, digest, briefMarkdown, hunks }) {
+  return [
+    "You help a person review an AI coding agent's changes, one change at a time.",
+    'Below are its changes as numbered hunks (H1, H2, ...), with the request and its conversation for the reasons behind them.',
+    '',
+    'Reply with one JSON object only, no prose around it:',
+    '{"summary": "<two sentences: what the changes do overall>", "changes": [{"id": "H3", "title": "<under 10 words>", "what": "<what this hunk changes, concretely>", "why": "<why, from the request or conversation; \"Not stated\" if unknown>", "risk": "low|medium|high", "check": "<what the reviewer should verify here>"}]}',
+    '',
+    'Rules:',
+    '- One entry per hunk, every hunk exactly once. Order them the way a reviewer should read them: the core change first, then what depends on it, then tests, docs and small edits.',
+    '- Be specific: name the functions, values and behavior. Base it only on the hunks and the context; do not invent intent.',
+    '- risk is high for security, data loss, concurrency, money or public API changes; medium for behavior changes; low for refactors, tests, docs and formatting.',
+    '- Keep what, why and check to one or two sentences each.',
+    '',
+    ...contextBlock({ intent, status, digest, repo: '', briefMarkdown }),
+    '<hunks>',
+    ...hunks.map((h) => `<hunk id="${h.id}" file="${h.file}">\n${h.head}\n${h.text}\n</hunk>`),
+    '</hunks>',
+  ].join('\n');
+}
+
+/** The hunks a walkthrough explains, from a parsed diff: ids, and the text sent (capped). */
+export function walkthroughHunks(files, { maxLines = 80, maxChars = 60_000 } = {}) {
+  const out = [];
+  let used = 0;
+  for (const f of files) {
+    if (f.binary) continue;
+    for (const h of f.hunks) {
+      const lines = h.lines.map((l) => `${l.t === 'add' ? '+' : l.t === 'del' ? '-' : ' '}${l.text}`);
+      const text = lines.length > maxLines ? [...lines.slice(0, maxLines), `… (${lines.length - maxLines} more lines)`].join('\n') : lines.join('\n');
+      if (used + text.length > maxChars) return { hunks: out, cut: true };
+      used += text.length;
+      out.push({ id: `H${out.length + 1}`, file: f.path, head: h.head, text });
+    }
+  }
+  return { hunks: out, cut: false };
+}
+
+/** The model's reply mapped back to hunks (file + header), in its reading order; unknown ids dropped. */
+export function walkthroughFrom(reply, hunks) {
+  const byId = new Map(hunks.map((h) => [h.id, h]));
+  const seen = new Set();
+  const risk = (r) => (['low', 'medium', 'high'].includes(r) ? r : 'medium');
+  const changes = [];
+  for (const c of Array.isArray(reply?.changes) ? reply.changes : []) {
+    const h = byId.get(String(c?.id ?? '').trim());
+    if (!h || seen.has(h.id)) continue;
+    seen.add(h.id);
+    changes.push({ file: h.file, head: h.head, title: String(c.title ?? '').slice(0, 120), what: String(c.what ?? '').slice(0, 800), why: String(c.why ?? '').slice(0, 800), risk: risk(c.risk), check: String(c.check ?? '').slice(0, 600) });
+  }
+  // Hunks the model skipped still get a place (unexplained), so stepping through covers everything.
+  for (const h of hunks) if (!seen.has(h.id)) changes.push({ file: h.file, head: h.head, title: '', what: '', why: '', risk: 'low', check: '', unexplained: true });
+  return { summary: String(reply?.summary ?? '').slice(0, 600), changes };
+}
+
+/** Markdown version, for Copy / Download and the CLI. */
+export function walkthroughMarkdown({ summary, changes }, title = '') {
+  const out = [`# Changes explained${title ? `: ${title}` : ''}`, '', summary, ''];
+  changes.forEach((c, i) => {
+    out.push(`## ${i + 1}. ${c.title || '(not explained)'}`, '', `\`${c.file}\` · \`${c.head.replace(/^(@@[^@]*@@).*/, '$1')}\` · risk: ${c.risk}`, '');
+    if (c.what) out.push(`- **What:** ${c.what}`);
+    if (c.why) out.push(`- **Why:** ${c.why}`);
+    if (c.check) out.push(`- **Check:** ${c.check}`);
+    out.push('');
+  });
+  return out.join('\n').trim() + '\n';
+}
+
 // ------------------------------------------------------------------ Human vs AI
 
 export const contextBlock = ({ intent, status, digest, repo, briefMarkdown }) => [

package/src/cli.js

@@ -1,5 +1,6 @@
 import { execFile } from 'node:child_process';
 import fs from 'node:fs';
+import path from 'node:path';
 import { Command, Option } from 'commander';
 import WebSocket from 'ws';
 import { HOST, PORT } from './config.js';
@@ -192,6 +193,20 @@ async function attach(ref, { resume = true, kind = 'claude' } = {}) {
   });
 }
 
+/** Upload local files for a request (a screenshot, a log); returns the staged paths the daemon gets. */
+async function uploadFiles(files = []) {
+  const out = [];
+  for (const f of files) {
+    const data = fs.readFileSync(f);
+    const res = await fetch(`${BASE}/api/uploads?name=${encodeURIComponent(path.basename(f))}`, { method: 'POST', headers: { 'content-type': 'application/octet-stream', 'x-agentmgr': '1' }, body: data });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error(`Could not attach ${f}: ${body.error || `HTTP ${res.status}`}`);
+    out.push(body.path);
+  }
+  return out.length ? out : undefined;
+}
+const collect = (v, list = []) => [...list, v];
+
 function readIntentsFile(file) {
   const text = file === '-' ? fs.readFileSync(0, 'utf8') : fs.readFileSync(file, 'utf8');
   return text
@@ -295,6 +310,11 @@ export async function main(argv) {
       const st = await api('GET', '/remote').catch(() => null);
       const phone = st?.running ? st.urls.find((u) => !u.vpn) : null;
       if (phone) console.log(dim(`phone: ${phone.url}  (sign-in QR: agentmgr remote status)`));
+      // Without the login service, nothing starts the daemon after a reboot.
+      if (['darwin', 'linux'].includes(process.platform)) {
+        const svc = await import('./service.js');
+        if (!(await svc.status().catch(() => ({ installed: true }))).installed) console.log(dim('tip: it won\'t start by itself after a restart; turn on Settings → Start at login, or run: agentmgr service install'));
+      }
       execFile(process.platform === 'darwin' ? 'open' : 'xdg-open', [BASE], () => {});
     });
 
@@ -321,7 +341,8 @@ export async function main(argv) {
       ]),
     )
     .option('-m, --model <model>', 'model (for the chosen engine)')
-    .option('-e, --engine <engine>', 'agent engine: claude (default) or codex')
+    .option('-e, --engine <engine>', 'agent engine: claude (default), codex, antigravity or muse')
+    .option('--file-attach <path>', 'attach a file to the request (a screenshot, a log); repeat for more', collect)
     .option('--plan', 'while a repo URL clones, plan the task with Claude (moves into the repo when ready)')
     .option('--no-start', 'create without launching')
     .option('-a, --attach', 'attach to the agent after launch (single intent only)')
@@ -332,8 +353,10 @@ export async function main(argv) {
       await daemon();
       // commander sets worktree=true for --no-worktree's default; only send it when the user chose.
       const worktreeSource = cmd.getOptionValueSource('worktree');
+      const attachments = await uploadFiles(opts.fileAttach);
       const created = await api('POST', '/agents', {
         intents,
+        attachments,
         repo: opts.repo,
         dir: opts.dir,
         name: opts.name,
@@ -362,14 +385,17 @@ export async function main(argv) {
 
   program
     .command('ask')
-    .description('Open a general Claude session (no repo or folder) and attach to it')
+    .description('Open a general session (no repo or folder) on any engine and attach to it')
     .argument('[question...]', 'optional first question')
     .option('-n, --name <name>', 'display name')
-    .option('-m, --model <model>', 'claude model')
+    .option('-m, --model <model>', 'model (for the chosen engine)')
+    .option('-e, --engine <engine>', 'agent engine: claude (default), codex, antigravity or muse')
+    .option('--file-attach <path>', 'attach a file to the question (a screenshot, a log); repeat for more', collect)
     .option('--no-attach', 'start it in the background only')
     .action(async (words, opts) => {
       await daemon();
-      let a = await api('POST', '/general', { question: words.join(' '), name: opts.name, model: opts.model });
+      const attachments = await uploadFiles(opts.fileAttach);
+      let a = await api('POST', '/general', { question: words.join(' '), name: opts.name, model: opts.model, engine: opts.engine, attachments });
       console.log(`${green('+')} ${bold(a.name)} ${dim(a.id)}  session ${cyan(a.sessionId)}`);
       for (let i = 0; i < 100 && a.status === 'preparing'; i++) {
         await new Promise((r) => setTimeout(r, 100));
@@ -404,9 +430,9 @@ export async function main(argv) {
 
   program
     .command('doc')
-    .description('Write a stakeholder document from the agent work: analysis, design, flow, proposal, humanai (Human vs AI) or diagrams (diagrams only)')
+    .description('Write a stakeholder document from the agent work: analysis, design, flow, proposal, humanai (Human vs AI), diagrams (diagrams only) or walkthrough (its changes explained one by one)')
     .argument('<agent>')
-    .argument('<kind>', 'analysis, design, flow, proposal, humanai, diagrams, or all (background; diagrams not included)')
+    .argument('<kind>', 'analysis, design, flow, proposal, humanai, diagrams, walkthrough, or all (background; diagrams and walkthrough not included)')
     .option('-o, --output <file>', 'also save the Markdown to this file')
     .option('--cached', 'print the last version instead of writing a new one')
     .option('-b, --background', 'start writing and return at once (kind "all" writes all five)')

package/src/manager.js

@@ -10,6 +10,10 @@ import {
   DOC_KINDS,
   diagramsOnly,
   diagramsPrompt,
+  walkthroughFrom,
+  walkthroughHunks,
+  walkthroughMarkdown,
+  walkthroughPrompt,
   briefDir,
   briefPath,
   briefPrompt,
@@ -36,12 +40,45 @@ const SUMMARIES = {
   ...Object.fromEntries(Object.keys(DOC_KINDS).map((k) => [k, { doc: k, prompt: (ctx) => docPrompt(k, ctx) }])),
   humanai: { doc: 'humanai', run: 'runHumanAi' },
   diagrams: { doc: 'diagrams', run: 'runDiagrams' },
+  walkthrough: { doc: 'walkthrough', run: 'runWalkthrough' },
 };
 /** Read / write where a summary of `kind` is kept on the agent record. */
 const getSummary = (agent, kind) => (SUMMARIES[kind].doc ? agent.docs?.[kind] : agent[SUMMARIES[kind].field]);
 const summaryPatch = (agent, kind, value) =>
   SUMMARIES[kind].doc ? { docs: { ...agent.docs, [kind]: value } } : { [SUMMARIES[kind].field]: value };
 
+const stagedDir = () => path.join(paths.uploads, 'staged');
+const safeName = (name) => path.basename(String(name || 'file')).replace(/[^\w.@+-]+/g, '_').slice(-120) || 'file';
+
+/** Staged uploads named in a request, checked to be files in the staging folder. */
+function stagedFiles(list) {
+  if (list == null) return [];
+  if (!Array.isArray(list)) throw Object.assign(new Error('attachments must be a list of uploaded files'), { status: 400 });
+  const root = path.resolve(stagedDir()) + path.sep;
+  return list.slice(0, 20).map((p) => {
+    const file = path.resolve(String(p ?? ''));
+    if (!file.startsWith(root) || !fs.existsSync(file) || !fs.statSync(file).isFile()) {
+      throw Object.assign(new Error(`Not an uploaded file: ${path.basename(file)} (attach it again)`), { status: 400 });
+    }
+    return file;
+  });
+}
+
+/** Copy staged files into an agent's uploads folder (a copy each: one upload can serve several agents). */
+function copyAttachments(files, agentId) {
+  const dir = path.join(paths.uploads, agentId);
+  fs.mkdirSync(dir, { recursive: true });
+  return files.map((f) => {
+    // Drop the staging prefix (time and a random tag) to get the name it was attached with.
+    const dest = path.join(dir, path.basename(f).replace(/^\d{4}-\d\d-\d\dT[\d-]+Z-[0-9a-f]{6}-/, ''));
+    fs.copyFileSync(f, dest);
+    return dest;
+  });
+}
+
+/** The part of the request that lists attached files. */
+export const attachmentNote = (files) => `Attached files (part of this request; read them):\n${files.map((f) => `- ${f}`).join('\n')}`;
+
 /** The folders of a repo with how many files each holds, two levels deep: a map for drawing it. */
 async function repoLayout(dir) {
   const files = (await git.run('git', ['ls-files'], { cwd: dir, timeout: 20_000 })).split('\n').filter(Boolean);
@@ -55,6 +92,7 @@ async function repoLayout(dir) {
 }
 import { spawn } from 'node:child_process';
 import * as git from './git.js';
+import { parseDiff } from '../public/review.js';
 import { conflictMessage, findConflicts, related, repoKey, summarize as summarizeConflicts } from './conflicts.js';
 import { answerMessage, loadQuestions, questionsPath, questionsPrompt } from './inbox.js';
 import { STUCK_DEFAULTS, detectStuck } from './stuck.js';
@@ -516,9 +554,9 @@ export class AgentManager extends EventEmitter {
     );
   }
 
-  /** A general Claude session with no repo or folder; the question (if any) is its first prompt. */
-  createGeneral({ question, name, permissionMode, model } = {}) {
-    return this.create({ kind: 'general', intent: question, name, permissionMode, model });
+  /** A general session with no repo or folder, on any engine; the question (if any) is its first prompt. */
+  createGeneral({ question, name, permissionMode, model, engine, attachments } = {}) {
+    return this.create({ kind: 'general', intent: question, name, permissionMode, model, engine, attachments });
   }
 
   create({
@@ -544,8 +582,10 @@ export class AgentManager extends EventEmitter {
     imported,
     startedBy,
     trigger,
+    attachments,
   }) {
     intent = (intent ?? '').trim();
+    const staged = stagedFiles(attachments);
     const engineDef = engineOf(engine || this.config.engine || DEFAULT_ENGINE);
     const engineId = engineDef.id;
     this.plugins.check('agent.create', {
@@ -569,7 +609,7 @@ export class AgentManager extends EventEmitter {
       base ??= entry.base ?? undefined;
       project = entry.key.startsWith('custom:') ? entry.name : null;
     }
-    if (!intent && !general) throw Object.assign(new Error('Intent is required'), { status: 400 });
+    if (!intent && !general && !staged.length) throw Object.assign(new Error('Intent is required'), { status: 400 });
     const id = crypto.randomBytes(3).toString('hex');
     // An imported session keeps its ID, so the first start resumes it.
     const sessionId = adopt || crypto.randomUUID();
@@ -577,6 +617,8 @@ export class AgentManager extends EventEmitter {
     const jiraKey = !name?.trim() && intent ? leadingJiraKey(intent) : null;
     const slug = name || intent ? slugify(name || jiraKey || intent) : `general-${id}`;
     const refs = extractRefs(intent, this.config.bugPatterns);
+    // Attached files (a screenshot, a log) go in the agent's own uploads folder, listed in its request.
+    if (staged.length) intent = [intent, attachmentNote(copyAttachments(staged, id))].filter(Boolean).join('\n\n');
 
     const agent = {
       id,
@@ -942,6 +984,12 @@ export class AgentManager extends EventEmitter {
       }
     }
     // Appended system prompts last only for the process they're passed to, so they go on every launch.
+    // Files attached for it (at creation or in its terminal): readable without a permission prompt.
+    const uploads = path.join(paths.uploads, agent.id);
+    if (fs.existsSync(uploads)) {
+      const dir = fs.realpathSync(uploads);
+      writableDir = writableDir ? [writableDir, dir].flat() : dir;
+    }
     return { extra: engine.extraArgs(this.config), permissionMode: agent.permissionMode, model: agent.model, writableDir, instructions: prompts.join('\n\n') || null, agents, allowedTools };
   }
 
@@ -1629,9 +1677,35 @@ export class AgentManager extends EventEmitter {
   }
 
   /** Save a file the user attached in the UI, so its path can be handed to Claude. */
+  /**
+   * A request with its attachments listed, for work that starts several agents from one request
+   * (a team, a race): the files are copied once to a shared folder they all read.
+   */
+  withSharedAttachments(intent, attachments) {
+    const staged = stagedFiles(attachments);
+    if (!staged.length) return intent;
+    const files = copyAttachments(staged, path.join('shared', crypto.randomBytes(4).toString('hex')));
+    return [String(intent ?? '').trim(), attachmentNote(files)].filter(Boolean).join('\n\n');
+  }
+
+  /** A file attached before its agent exists (New agents, Ask); create() copies it to the agent. */
+  stageUpload(name, data) {
+    fs.mkdirSync(stagedDir(), { recursive: true });
+    // Staged files nobody used are dropped after 30 days (a backlog item may wait that long).
+    const old = Date.now() - 30 * 86_400_000;
+    for (const f of fs.readdirSync(stagedDir())) {
+      try {
+        if (fs.statSync(path.join(stagedDir(), f)).mtimeMs < old) fs.rmSync(path.join(stagedDir(), f), { force: true });
+      } catch {}
+    }
+    const file = path.join(stagedDir(), `${new Date().toISOString().replace(/[:.]/g, '-')}-${crypto.randomBytes(3).toString('hex')}-${safeName(name)}`);
+    fs.writeFileSync(file, data);
+    return { path: file, name: safeName(name), size: data.length };
+  }
+
   saveUpload(ref, name, data) {
     const agent = this.mustGet(ref);
-    const safe = path.basename(String(name || 'file')).replace(/[^\w.@+-]+/g, '_').slice(-120) || 'file';
+    const safe = safeName(name);
     const dir = path.join(paths.uploads, agent.id);
     fs.mkdirSync(dir, { recursive: true });
     const file = path.join(dir, `${new Date().toISOString().replace(/[:.]/g, '-')}-${safe}`);
@@ -1963,6 +2037,37 @@ export class AgentManager extends EventEmitter {
     });
   }
 
+  /**
+   * The agent's changes explained one by one for review. `changesSource` (set by the server) gives
+   * the same diff the review screen shows; the result is keyed by file and hunk header.
+   */
+  async runWalkthrough(agent, ctx) {
+    if (!this.changesSource) throw new Error('Changes are not available here');
+    const data = await this.changesSource(agent.id);
+    const { hunks, cut } = walkthroughHunks(parseDiff(data.diff));
+    if (!hunks.length) throw Object.assign(new Error('No changes to explain yet'), { status: 400 });
+    const writer = this.writerFor(agent);
+    const result = walkthroughFrom(parseJsonReply(await this.oneShot(agent, walkthroughPrompt({ ...ctx, hunks }), writer)), hunks);
+    const cur = this.store.get(agent.id);
+    if (!cur) return null;
+    return this.view(
+      this.patch(
+        agent.id,
+        summaryPatch(cur, 'walkthrough', {
+          data: result,
+          cut,
+          diffHash: hash(data.diff),
+          markdown: walkthroughMarkdown(result, cur.name),
+          writer: `${writer.engine.label}${writer.model ? ` (${writer.model})` : ''}`,
+          at: now(),
+          briefUpdatedAt: cur.brief?.updatedAt ?? null,
+          pending: false,
+          error: null,
+        }),
+      ),
+    );
+  }
+
   /** Diagrams only: the problem and its solution drawn from the documents already written and the live context. */
   async runDiagrams(agent, ctx) {
     const cur0 = this.store.get(agent.id) ?? agent;

package/src/review.js

@@ -1,6 +1,7 @@
 // Review an agent's changes: the diff against where its branch started, line comments sent
 // back to the agent as one message, and commit / push / open a pull request from the UI.
 import * as git from './git.js';
+import { hash } from './judge.js';
 import { NO_REPO } from './manager.js';
 import { ghBin } from './tracker.js';
 
@@ -135,6 +136,8 @@ export class Review {
       prs: Object.values(agent.prs ?? {}),
       busy: Boolean(rt?.pty && rt.busy),
       diff,
+      // Matches a walkthrough's diffHash while the changes are the ones it explained.
+      diffHash: hash(diff),
       truncated: diff.endsWith('… (diff truncated)'),
     };
   }

package/src/server.js

@@ -32,6 +32,7 @@ import { Notifier, isWorkflowUrl, loadNotify, publicNotify, saveNotify, sendSlac
 import { Previews, parseUrl } from './preview.js';
 import { LiveBrowser } from './livebrowser.js';
 import * as remote from './remote.js';
+import * as service from './service.js';
 import { Store } from './store.js';
 import { about, latestRelease } from './about.js';
 
@@ -59,7 +60,7 @@ function isAllowedOrigin(origin, port) {
 }
 
 const PUBLIC_REMOTE_API = new Set(['POST /api/login', 'GET /api/session']);
-const LOCAL_ONLY_API = /^\/api\/(remote(\/|$)|notify(\/|$)|hub(\/|$)|triggers(\/|$)|update(\/|$)|editors$|agents\/[\w-]+\/open-in$|shutdown$)/;
+const LOCAL_ONLY_API = /^\/api\/(remote(\/|$)|notify(\/|$)|hub(\/|$)|triggers(\/|$)|update(\/|$)|service$|editors$|agents\/[\w-]+\/open-in$|shutdown$)/;
 const HOOK_PATH = '/api/hooks/agents';
 const NO_REPO_KINDS = new Set(['general', 'assistant']);
 
@@ -73,6 +74,8 @@ export async function startServer({ port = PORT, host = HOST } = {}) {
   const backlog = new Backlog({ manager, store, config });
   const races = new Races({ manager, store });
   const review = new Review({ manager });
+  // The walkthrough explains the same diff the review screen shows.
+  manager.changesSource = (id) => review.get(id);
   const studio = new Studio({ manager, review });
   const teams = new Teams({ manager, store, config });
   const cleanup = new Cleanup({ manager, store, config, teams });
@@ -259,6 +262,15 @@ export async function startServer({ port = PORT, host = HOST } = {}) {
   api.post('/agents/:id/shell/close', wrap((req) => manager.closeShell(req.params.id, req.body?.n ? Number(req.body.n) : undefined)));
   api.post('/agents/:id/shell/new', wrap((req) => ({ n: manager.nextShellNumber(manager.mustGet(req.params.id).id) })));
   api.post('/agents/:id/shell/drop', wrap((req) => manager.dropShell(req.params.id, Number(req.body?.n) || 1)));
+  // A file attached before its agent exists (New agents, Ask). Raw body, name in the query.
+  api.post(
+    '/uploads',
+    express.raw({ type: () => true, limit: '50mb' }),
+    wrap((req) => {
+      if (!Buffer.isBuffer(req.body) || !req.body.length) throw fail(400, 'Empty file');
+      return manager.stageUpload(req.query.name, req.body);
+    }),
+  );
   // Raw file body; the name comes in the query. Returns the saved path to paste into a terminal.
   api.post(
     '/agents/:id/upload',
@@ -466,7 +478,9 @@ export async function startServer({ port = PORT, host = HOST } = {}) {
   api.post('/agents/:id/fork', wrap((req) => manager.fork(req.params.id, req.body ?? {})));
 
   api.get('/races', wrap(() => races.list()));
-  api.post('/races', wrap((req) => races.create(req.body ?? {})));
+  // Attachments: copied once to a shared folder and listed in the request every attempt gets.
+  const withFiles = ({ attachments, ...body } = {}) => ({ ...body, intent: manager.withSharedAttachments(body.intent, attachments) });
+  api.post('/races', wrap((req) => races.create(withFiles(req.body ?? {}))));
   api.get('/races/:id', wrap((req) => races.view(req.params.id)));
   api.post('/races/:id/tests', wrap((req) => races.runTests(req.params.id, req.body ?? {})));
   api.get('/races/:id/diff/:agent', wrap((req) => races.diff(req.params.id, req.params.agent)));
@@ -494,6 +508,20 @@ export async function startServer({ port = PORT, host = HOST } = {}) {
   api.get('/agents/:id/memory', wrap((req) => memory.read(req.params.id)));
   api.put('/agents/:id/memory', wrap((req) => memory.write(req.params.id, req.body?.text)));
   api.post('/agents/:id/learn', wrap((req) => memory.learn(req.params.id, req.body?.text, { by: req.headers['x-agentmgr-agent'] ? undefined : 'you' })));
+  // Start at login: the login service (launchd or systemd) that brings the daemon back after a reboot.
+  const serviceSupported = ['darwin', 'linux'].includes(process.platform);
+  const serviceView = async () => ({ supported: serviceSupported, ...(serviceSupported ? await service.status().catch(() => ({ installed: false, loaded: false })) : { installed: false, loaded: false }) });
+  api.get('/service', wrap(serviceView));
+  api.put(
+    '/service',
+    wrap(async (req) => {
+      if (!serviceSupported) throw fail(400, `Start at login isn't supported on ${process.platform}`);
+      // Installing loads it; its own copy finds this daemon running and exits cleanly (no restart),
+      // so it takes over at the next login.
+      const res = req.body?.enabled === true ? await service.install() : await service.uninstall();
+      return { ...(await serviceView()), note: res.note ?? null };
+    }),
+  );
   // The first-run checklist: what is set up, and what this machine is missing.
   api.get('/setup', wrap(async () => {
     const checks = (await doctor().catch(() => [])).filter((c) => c.status === 'fail' || c.status === 'warn').filter((c) => c.name !== 'Daemon');
@@ -506,6 +534,8 @@ export async function startServer({ port = PORT, host = HOST } = {}) {
         assistant: agentsNow.some((a) => a.kind === 'assistant') || Boolean(config.triggers?.github?.enabled || config.triggers?.webhook?.enabled),
         remote: Boolean(remote.loadSettings().enabled),
         budget: Boolean(config.budgets?.perAgentUsd || config.budgets?.perDayUsd),
+        // Only where it can be set up (macOS, Linux); elsewhere there's nothing to do.
+        service: serviceSupported ? Boolean((await service.status().catch(() => ({}))).installed) : true,
       },
     };
   }));
@@ -544,7 +574,7 @@ export async function startServer({ port = PORT, host = HOST } = {}) {
     return cleanup.run({ close: b.close !== false, delete: b.delete !== false, ids: Array.isArray(b.ids) ? b.ids : null });
   }));
   api.get('/teams', wrap(() => teams.list()));
-  api.post('/teams', wrap((req) => teams.create(req.body ?? {})));
+  api.post('/teams', wrap((req) => teams.create(withFiles(req.body ?? {}))));
   api.get('/teams/:id', wrap((req) => teams.view(req.params.id)));
   api.get('/teams/:id/files/:name', wrap((req) => teams.file(req.params.id, req.params.name)));
   api.post('/teams/:id/resume', wrap((req) => teams.resume(req.params.id, req.body ?? {})));