aidevops 3.29.8 → 3.29.11

package/README.md

@@ -58,7 +58,7 @@ The result: an AI operations platform that manages projects across every busines
 [![Copyright](https://img.shields.io/badge/Copyright-Marcus%20Quinn%202025--2026-blue.svg)](https://github.com/marcusquinn)
 
 <!-- Release & Version Info -->
-[![Version](https://img.shields.io/badge/Version-3.29.8-blue.svg)](https://github.com/marcusquinn/aidevops/releases)
+[![Version](https://img.shields.io/badge/Version-3.29.11-blue.svg)](https://github.com/marcusquinn/aidevops/releases)
 [![npm version](https://img.shields.io/npm/v/aidevops)](https://www.npmjs.com/package/aidevops)
 [![Homebrew](https://img.shields.io/badge/homebrew-marcusquinn%2Ftap-orange)](https://github.com/marcusquinn/homebrew-tap)
 [![GitHub repository](https://img.shields.io/badge/github-repository-181717.svg?logo=github)](https://github.com/marcusquinn/aidevops)

package/VERSION

@@ -1 +1 @@
-3.29.8
+3.29.11

package/aidevops.sh

@@ -5,7 +5,7 @@
 # AI DevOps Framework CLI
 # Usage: aidevops <command> [options]
 #
-# Version: 3.29.8
+# Version: 3.29.11
 
 set -euo pipefail
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aidevops",
-  "version": "3.29.8",
+  "version": "3.29.11",
   "description": "AI DevOps Framework - AI-assisted development workflows, code quality, and deployment automation",
   "type": "module",
   "workspaces": [

package/packages/gui-api/src/app.ts

@@ -10,6 +10,7 @@ const appActionCommands: Record<string, Partial<Record<GuiAppActionId, string[]>
   "gui-desktop": { install: ["aidevops", "setup", "--scope", "gui-desktop"], update: ["aidevops", "setup", "--scope", "gui-desktop"], reinstall: ["aidevops", "setup", "--scope", "gui-desktop"] },
   hooks: { install: ["aidevops", "setup", "--scope", "hooks"], update: ["aidevops", "setup", "--scope", "hooks"], reinstall: ["aidevops", "setup", "--scope", "hooks"] },
   opencode: { install: ["aidevops", "setup", "--scope", "opencode"], update: ["aidevops", "setup", "--scope", "opencode"], reinstall: ["aidevops", "setup", "--scope", "opencode"] },
+  "opencode-cli": { install: ["aidevops", "setup", "--scope", "opencode"], update: ["aidevops", "setup", "--scope", "opencode"], reinstall: ["aidevops", "setup", "--scope", "opencode"] },
   pulse: { install: ["aidevops", "setup", "--scope", "pulse"], update: ["aidevops", "setup", "--scope", "pulse"], reinstall: ["aidevops", "setup", "--scope", "pulse"] },
   tabby: { install: ["aidevops", "setup", "--scope", "tabby"], update: ["aidevops", "setup", "--scope", "tabby"], reinstall: ["aidevops", "setup", "--scope", "tabby"] },
   bun: { install: ["./setup.sh", "--non-interactive"], update: ["aidevops", "update-tools", "--update"] },

package/packages/gui-api/src/status-managed-apps.ts

@@ -83,12 +83,12 @@ const MANAGED_APP_DEFINITIONS: ManagedAppDefinition[] = [
   },
   {
     id: "opencode",
-    name: "OpenCode",
-    description: "AI terminal runtime configured by aidevops for local sessions.",
-    category: "ai runtime",
-    binary: "opencode",
-    version_args: ["--version"],
-    install_path_refs: ["~/Applications/OpenCode AIDevOps.app", "/Applications/OpenCode.app", "~/.config/opencode/opencode.json"],
+    name: "OpenCode Beta",
+    description: "Native OpenCode beta desktop app configured by aidevops.",
+    category: "desktop",
+    binary: null,
+    version_args: [],
+    install_path_refs: ["~/Applications/OpenCode AIDevOps.app", "~/Applications/OpenCode.app", "/Applications/OpenCode.app", "~/.config/opencode/opencode.json"],
     origin_website_url: "https://opencode.ai",
     origin_repo_url: "",
     aidevops_install: true,
@@ -96,6 +96,7 @@ const MANAGED_APP_DEFINITIONS: ManagedAppDefinition[] = [
     latest_version_source: "binary",
     action_commands: setupScopeActions("opencode"),
   },
+  binaryApp({ id: "opencode-cli", name: "OpenCode CLI", description: "Command-line runtime installed with OpenCode and configured by aidevops.", category: "cli", binary: "opencode", version_args: ["--version"], install_path_refs: ["/opt/homebrew/bin/opencode", "/usr/local/bin/opencode", "~/.bun/bin/opencode", "~/.config/opencode/opencode.json"], origin_website_url: "https://opencode.ai", origin_repo_url: "", aidevops_install: true, aidevops_update: true }),
   {
     id: "hooks",
     name: "Safety hooks",
@@ -139,7 +140,7 @@ const MANAGED_APP_DEFINITIONS: ManagedAppDefinition[] = [
   binaryApp({ id: "homebrew", name: "Homebrew", description: "macOS package manager used by setup/update when available.", category: "package manager", binary: "brew", version_args: ["--version"], install_path_refs: ["/opt/homebrew/bin/brew", "/usr/local/bin/brew"], origin_website_url: "https://brew.sh", origin_repo_url: "https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh" }),
   binaryApp({ id: "qlty", name: "Qlty CLI", description: "Optional code quality aggregator installed by setup when selected.", category: "quality", binary: "qlty", version_args: ["--version"], install_path_refs: ["/opt/homebrew/bin/qlty", "/usr/local/bin/qlty", "~/.qlty/bin/qlty"], origin_website_url: "https://qlty.sh", origin_repo_url: "" }),
   binaryApp({ id: "rtk", name: "rtk", description: "Token-optimized GitHub/API helper used by interactive discovery.", category: "developer tooling", binary: "rtk", version_args: ["--version"], install_path_refs: ["~/.local/bin/rtk", "/opt/homebrew/bin/rtk", "/usr/local/bin/rtk"], origin_website_url: "https://github.com/rtk-ai/rtk#installation", origin_repo_url: "https://github.com/rtk-ai/rtk" }),
-  binaryApp({ id: "cursor", name: "Cursor CLI", description: "Cursor command-line integration and config targets.", category: "ai runtime", binary: "cursor", version_args: ["--version"], install_path_refs: ["~/.cursor/bin/cursor", "/Applications/Cursor.app"], origin_website_url: "https://cursor.com/install", origin_repo_url: "" }),
+  binaryApp({ id: "cursor", name: "Cursor CLI", description: "Cursor command-line integration and config targets.", category: "cli", binary: "cursor", version_args: ["--version"], install_path_refs: ["~/.cursor/bin/cursor", "/Applications/Cursor.app"], origin_website_url: "https://cursor.com/install", origin_repo_url: "" }),
   binaryApp({ id: "zed", name: "Zed", description: "Optional editor installed by setup when selected.", category: "editor", binary: "zed", version_args: ["--version"], install_path_refs: ["/Applications/Zed.app", "/opt/homebrew/bin/zed", "/usr/local/bin/zed"], origin_website_url: "https://zed.dev/download", origin_repo_url: "", aidevops_install: false, aidevops_update: false }),
   binaryApp({ id: "orbstack", name: "OrbStack", description: "Optional local container/VM runtime for macOS development.", category: "runtime", binary: "orb", version_args: ["version"], install_path_refs: ["/Applications/OrbStack.app", "/opt/homebrew/bin/orb"], origin_website_url: "https://orbstack.dev/", origin_repo_url: "", aidevops_install: false, aidevops_update: false }),
   binaryApp({ id: "ollama", name: "Ollama", description: "Optional local model runtime for local AI workflows.", category: "ai runtime", binary: "ollama", version_args: ["--version"], install_path_refs: ["/Applications/Ollama.app", "/opt/homebrew/bin/ollama", "/usr/local/bin/ollama"], origin_website_url: "https://ollama.com", origin_repo_url: "" }),
@@ -221,8 +222,22 @@ function readManagedAppVersion(definition: ManagedAppDefinition, binaryPath: str
   }
 
   if (binaryPath === null) {
-    return "not installed";
+    const existingPathRef = firstExistingPathRef(definition.install_path_refs);
+
+    if (existingPathRef === null) {
+      return "not installed";
+    }
+
+    return readAppBundleVersion(existingPathRef) ?? "installed";
   }
 
   return readBinaryVersion(binaryPath, definition.version_args);
 }
+
+function readAppBundleVersion(pathRef: string): string | null {
+  if (!pathRef.endsWith(".app")) {
+    return null;
+  }
+
+  return readBinaryVersion("/usr/libexec/PlistBuddy", ["-c", "Print :CFBundleShortVersionString", `${expandHome(pathRef)}/Contents/Info.plist`]);
+}

package/packages/gui-web/src/InventorySurfaces.tsx

@@ -1,6 +1,10 @@
 import type { GuiAppActionId, GuiAppActionJobSummary, GuiManagedAppSummary, GuiResponseEnvelope, GuiStatusData } from "@aidevops/gui-shared";
-import { type Dispatch, type ReactElement, type SetStateAction, useEffect, useState } from "react";
-import { FiChevronDown, FiDownload, FiExternalLink, FiRefreshCw, FiRepeat, FiTrash2 } from "react-icons/fi";
+import { type Dispatch, type MouseEvent as ReactMouseEvent, type ReactElement, type SetStateAction, useEffect, useRef, useState } from "react";
+import type { IconType } from "react-icons";
+import { FaApple, FaLinux, FaWindows } from "react-icons/fa";
+import { FiChevronDown, FiCode, FiDownload, FiExternalLink, FiGlobe, FiMonitor, FiRefreshCw, FiRepeat, FiTerminal, FiTrash2 } from "react-icons/fi";
+import { IoLogoAndroid } from "react-icons/io";
+import { SiIos } from "react-icons/si";
 import type { InventoryColumn } from "./app-model";
 import { installationRows, text } from "./app-model";
 
@@ -12,17 +16,22 @@ interface DraftInventoryRow {
 let draftRowCounter = 0;
 
 export function AppsSurface({ status }: { status: GuiStatusData }): ReactElement {
+  const [appCollection, setAppCollection] = useState<AppCollectionId>("aidevops");
+  const [managedCategory, setManagedCategory] = useState<ManagedCategoryId>("core");
+  const [recommendedPlatform, setRecommendedPlatform] = useState<RecommendedPlatformFilterId>("all");
   const [selectedJobId, setSelectedJobId] = useState<string | null>(null);
-  const [expandedAppIds, setExpandedAppIds] = useState<Set<string>>(() => new Set(status.managed_apps.length > 0 ? [status.managed_apps[0].id] : []));
+  const [expandedAppId, setExpandedAppId] = useState<string | null>(() => sortedManagedApps(status.managed_apps).find((app) => managedCategoryForApp(app) === "core")?.id ?? null);
   const [jobs, setJobs] = useState<Record<string, GuiAppActionJobSummary>>({});
+  const [policyJobs, setPolicyJobs] = useState<Record<string, GuiAppActionJobSummary[]>>({});
+  const [policyToggles, setPolicyToggles] = useState<ManagedPolicyToggleState>(() => readManagedPolicyToggles());
   const selectedJob = selectedJobId === null ? null : jobs[selectedJobId] ?? null;
+  const managedApps = sortedManagedApps(status.managed_apps).map((app) => applyManagedPolicyToggles(app, policyToggles[app.id]));
+  const visibleManagedApps = managedApps.filter((app) => managedCategoryForApp(app) === managedCategory);
+  const visibleRecommendedApps = recommendedApps.filter((app) => recommendedPlatform === "all" || app.platforms.includes(recommendedPlatform));
 
   useEffect(() => {
-    if (status.managed_apps.length === 0) {
-      return;
-    }
-    setExpandedAppIds((current) => current.size === 0 ? new Set([status.managed_apps[0].id]) : current);
-  }, [status.managed_apps]);
+    setExpandedAppId(visibleManagedApps[0]?.id ?? null);
+  }, [managedCategory, status.managed_apps]);
 
   useEffect(() => {
     if (selectedJob === null || selectedJob.status !== "running") {
@@ -37,34 +46,52 @@ export function AppsSurface({ status }: { status: GuiStatusData }): ReactElement
   }, [selectedJob]);
 
   return (
-    <section className="panel" aria-label={text.apps}>
+    <section className="apps-surface" aria-label={text.apps}>
       <div className="section-heading">
         <p className="eyebrow">{text.infrastructure}</p>
         <h2>{text.apps}</h2>
         <p>{text.appsIntro}</p>
       </div>
-      <div className="managed-app-list">
-        {status.managed_apps.map((app) => (
-          <ManagedAppPanel
-            app={app}
-            expanded={expandedAppIds.has(app.id)}
-            job={jobForApp(app.id, jobs, selectedJob)}
-            key={app.id}
-            onJob={(job) => {
-              setJobs((current) => ({ ...current, [job.id]: job }));
-              setSelectedJobId(job.id);
-              setExpandedAppIds((current) => toggledAppIds(current, app.id, true));
-            }}
-            onToggle={() => setExpandedAppIds((current) => toggledAppIds(current, app.id))}
-          />
-        ))}
-      </div>
-      <p className="empty-state compact-notice">Install/update actions run as allowlisted background jobs and stream inside each app panel. xterm.js with a node-pty bridge is the right next step for full TUI apps such as OpenCode; this view starts with non-interactive command logs.</p>
+      <TabNav label="Apps collections" tabs={appCollectionTabs} value={appCollection} onChange={(value) => setAppCollection(value)} />
+      {appCollection === "aidevops" ? <>
+        <TabNav label="aidevops app groups" tabs={managedCategoryTabs} value={managedCategory} onChange={(value) => setManagedCategory(value)} />
+        <div className="managed-app-list">
+          {visibleManagedApps.map((app) => (
+            <ManagedAppPanel
+              app={app}
+              expanded={expandedAppId === app.id}
+              job={jobForApp(app.id, jobs, selectedJob)}
+              key={app.id}
+              policyJobs={policyJobs[app.id] ?? []}
+              onJob={(job) => {
+                setJobs((current) => ({ ...current, [job.id]: job }));
+                setSelectedJobId(job.id);
+                setExpandedAppId(app.id);
+              }}
+              onPolicyToggle={(policy, value) => {
+                setPolicyToggles((current) => {
+                  const next = { ...current, [app.id]: { ...current[app.id], [policy]: value } };
+                  writeManagedPolicyToggles(next);
+                  return next;
+                });
+                const policyJob = createPolicyJob(app.id, policy, value);
+                setPolicyJobs((current) => ({ ...current, [app.id]: [...(current[app.id] ?? []), policyJob] }));
+                setSelectedJobId(policyJob.id);
+                setExpandedAppId(app.id);
+              }}
+              onToggle={() => setExpandedAppId((current) => current === app.id ? null : app.id)}
+            />
+          ))}
+        </div>
+        <p className="empty-state compact-notice">Install/update actions run as allowlisted background jobs and stream inside each app panel. xterm.js with a node-pty bridge is the right next step for full TUI apps such as OpenCode; this view starts with non-interactive command logs.</p>
+      </> : <RecommendedAppsSurface apps={visibleRecommendedApps} platform={recommendedPlatform} setPlatform={setRecommendedPlatform} />}
     </section>
   );
 }
 
-function ManagedAppPanel({ app, expanded, job, onJob, onToggle }: { app: GuiManagedAppSummary; expanded: boolean; job: GuiAppActionJobSummary | null; onJob: (job: GuiAppActionJobSummary) => void; onToggle: () => void }): ReactElement {
+function ManagedAppPanel({ app, expanded, job, onJob, onPolicyToggle, onToggle, policyJobs }: { app: GuiManagedAppSummary; expanded: boolean; job: GuiAppActionJobSummary | null; onJob: (job: GuiAppActionJobSummary) => void; onPolicyToggle: (policy: ManagedPolicyId, value: boolean) => void; onToggle: () => void; policyJobs: GuiAppActionJobSummary[] }): ReactElement {
+  const lockedPolicy = isEssentialManagedApp(app);
+
   return (
     <article className={expanded ? "managed-app-card expanded" : "managed-app-card"}>
       <button aria-expanded={expanded} className="managed-app-summary" data-tooltip={`${expanded ? "Collapse" : "Expand"} ${app.name} controls`} onClick={onToggle} type="button">
@@ -74,7 +101,6 @@ function ManagedAppPanel({ app, expanded, job, onJob, onToggle }: { app: GuiMana
           <span>{app.description}</span>
         </span>
         <span className="managed-app-summary-meta">
-          <SummaryChip label="Status" value={app.status} />
           <SummaryChip label="Installed" value={app.installed_version} />
           <SummaryChip label="Latest" value={app.latest_version} />
           <FiChevronDown aria-hidden="true" className="managed-app-chevron" />
@@ -89,16 +115,18 @@ function ManagedAppPanel({ app, expanded, job, onJob, onToggle }: { app: GuiMana
           <div className="managed-app-actions">
             {app.actions.map((action) => <AppActionButton action={action.id} app={app} disabled={!action.enabled} key={action.id} onJob={onJob} commandPreview={action.command_preview} />)}
           </div>
-        </div>
+      </div>
       <div className="managed-app-details">
-        <ToggleSwitch checked={app.aidevops_install} label="setup installs" />
-        <ToggleSwitch checked={app.aidevops_update} label="update maintains" />
+        <ToggleSwitch checked={app.aidevops_install} disabled={lockedPolicy} label="setup installs" onChange={(value) => onPolicyToggle("setup", value)} />
+        <ToggleSwitch checked={app.aidevops_update} disabled={lockedPolicy} label="update maintains" onChange={(value) => onPolicyToggle("update", value)} />
         <AppMeta label="Installed" value={app.installed_version} />
         <AppMeta label="Latest" value={app.latest_version} />
         <AppMeta label={text.path} value={app.install_path_ref} />
-        <AppMeta label="Status" value={app.status} />
+        {job ? <AppLogLink job={job} /> : null}
       </div>
-      {job ? <AppActionTerminal job={job} /> : <p className="empty-state compact-notice">No recent command output for this app. Run an action to open this app's terminal log.</p>}
+      {job ? <AppActionTerminal job={job} /> : null}
+      {policyJobs.map((policyJob) => <AppActionTerminal job={policyJob} key={policyJob.id} />)}
+      {job === null && policyJobs.length === 0 ? <p className="empty-state compact-notice">No recent command output for this app. Run an action or change a policy toggle to open this app's terminal log.</p> : null}
       </div> : null}
     </article>
   );
@@ -113,41 +141,71 @@ function OriginLink({ href, label }: { href: string; label: string }): ReactElem
     return <span className="origin-missing">{label}: source pending</span>;
   }
 
-  return <a data-tooltip={`Open ${label.toLowerCase()} destination`} href={href} rel="noreferrer" target="_blank">{label} <FiExternalLink aria-hidden="true" /></a>;
+  return <a href={href} onClick={(event) => openExternalLink(event, href)} rel="noreferrer" target="_blank" title={href}>{label} <FiExternalLink aria-hidden="true" /></a>;
 }
 
-function ToggleSwitch({ checked, label }: { checked: boolean; label: string }): ReactElement {
-  return <span className="managed-toggle"><span aria-hidden="true" className={checked ? "switch-track checked" : "switch-track"}><span /></span>{label}</span>;
+function ToggleSwitch({ checked, disabled = false, label, onChange }: { checked: boolean; disabled?: boolean; label: string; onChange: (checked: boolean) => void }): ReactElement {
+  return <button aria-pressed={checked} className={checked ? "managed-toggle checked" : "managed-toggle"} data-tooltip={disabled ? "Essential aidevops component; policy is locked on" : undefined} disabled={disabled} onClick={() => onChange(!checked)} title={disabled ? "Essential aidevops component; policy is locked on" : undefined} type="button"><span aria-hidden="true" className={checked ? "switch-track checked" : "switch-track"}><span /></span>{label}</button>;
 }
 
 function AppMeta({ label, value }: { label: string; value: string }): ReactElement {
   return <span className="app-meta"><small>{label}</small><strong>{value}</strong></span>;
 }
 
+function AppLogLink({ job }: { job: GuiAppActionJobSummary }): ReactElement {
+  return <a className="app-meta app-log-link" href={`#app-job-${job.id}`}><small>Logs</small><strong>{job.action} · {job.status}</strong></a>;
+}
+
 function AppActionButton({ action, app, commandPreview, disabled, onJob }: { action: GuiAppActionId; app: GuiManagedAppSummary; commandPreview: string; disabled: boolean; onJob: (job: GuiAppActionJobSummary) => void }): ReactElement {
   const icon = action === "install" ? <FiDownload /> : action === "update" ? <FiRefreshCw /> : action === "reinstall" ? <FiRepeat /> : <FiTrash2 />;
+  const [confirmOpen, setConfirmOpen] = useState(false);
 
   async function runAction(): Promise<void> {
     if (disabled) {
       return;
     }
-    if ((action === "remove" || action === "reinstall") && !window.confirm(`${action} ${app.name}?`)) {
-      return;
-    }
 
     const response = await fetch(`/api/apps/${encodeURIComponent(app.id)}/actions/${action}`, { method: "POST" });
     const envelope = await response.json() as GuiResponseEnvelope<GuiAppActionJobSummary>;
     onJob(envelope.data);
   }
 
-  return <button aria-label={`${action} ${app.name}`} className={action === "remove" ? "app-action-button remove" : "app-action-button"} data-tooltip={commandPreview} disabled={disabled} onClick={() => void runAction()} type="button">{icon}<span>{action}</span></button>;
+  return <>
+    <button aria-label={`${action} ${app.name}`} className={action === "remove" ? "app-action-button remove" : "app-action-button"} data-tooltip={commandPreview} disabled={disabled} onClick={() => setConfirmOpen(true)} type="button">{icon}<span>{action}</span></button>
+    {confirmOpen ? <ConfirmActionModal action={action} app={app} commandPreview={commandPreview} close={() => setConfirmOpen(false)} confirm={() => { setConfirmOpen(false); void runAction(); }} /> : null}
+  </>;
+}
+
+function ConfirmActionModal({ action, app, close, commandPreview, confirm }: { action: GuiAppActionId; app: GuiManagedAppSummary; close: () => void; commandPreview: string; confirm: () => void }): ReactElement {
+  return (
+    <div className="modal-backdrop" role="presentation">
+      <section aria-modal="true" className="confirm-modal" role="dialog" aria-labelledby={`confirm-${app.id}-${action}`}>
+        <p className="eyebrow">Confirm action</p>
+        <h3 id={`confirm-${app.id}-${action}`}>{action} {app.name}?</h3>
+        <p>This will start the allowlisted background command for this app.</p>
+        <code>{commandPreview}</code>
+        <div className="confirm-modal-actions">
+          <button className="secondary-action" onClick={close} type="button">Cancel</button>
+          <button className={action === "remove" ? "app-action-button remove" : "app-action-button"} onClick={confirm} type="button">Confirm</button>
+        </div>
+      </section>
+    </div>
+  );
 }
 
 function AppActionTerminal({ job }: { job: GuiAppActionJobSummary }): ReactElement {
+  const outputRef = useRef<HTMLPreElement | null>(null);
+
+  useEffect(() => {
+    if (outputRef.current !== null) {
+      outputRef.current.scrollTop = outputRef.current.scrollHeight;
+    }
+  }, [job.output]);
+
   return (
-    <section className="app-terminal" aria-label="App action terminal output">
+    <section className="app-terminal" id={`app-job-${job.id}`} aria-label="App action terminal output">
       <header><strong>{job.app_id} {job.action}</strong><span>{job.status}{job.exit_code === null ? "" : ` (${job.exit_code})`}</span></header>
-      <pre>{job.output.join("\n")}</pre>
+      <pre ref={outputRef}>{job.output.join("\n")}</pre>
     </section>
   );
 }
@@ -169,15 +227,277 @@ function jobForApp(appId: string, jobs: Record<string, GuiAppActionJobSummary>,
   return Object.values(jobs).reverse().find((job) => job.app_id === appId) ?? null;
 }
 
-function toggledAppIds(current: Set<string>, appId: string, forceOpen = false): Set<string> {
-  const next = new Set(current);
-  if (forceOpen || !next.has(appId)) {
-    next.add(appId);
-  } else {
-    next.delete(appId);
+function sortedManagedApps(apps: GuiManagedAppSummary[]): GuiManagedAppSummary[] {
+  return [...apps].sort((left, right) => left.name.localeCompare(right.name, undefined, { sensitivity: "base" }));
+}
+
+function managedCategoryForApp(app: GuiManagedAppSummary): ManagedCategoryId {
+  if (["core", "safety", "automation"].includes(app.category)) {
+    return "core";
+  }
+  if (app.category.includes("cli")) {
+    return "cli";
+  }
+  if (app.category.includes("ai")) {
+    return "ai";
+  }
+  if (["desktop", "editor"].includes(app.category)) {
+    return "desktop";
+  }
+  if (["terminal"].includes(app.category) || app.name.toLowerCase().includes("terminal")) {
+    return "terminal";
+  }
+
+  return "cli";
+}
+
+function isEssentialManagedApp(app: GuiManagedAppSummary): boolean {
+  return ["core", "safety", "automation"].includes(app.category);
+}
+
+type AppCollectionId = "aidevops" | "recommended";
+type ManagedCategoryId = "core" | "ai" | "cli" | "desktop" | "terminal";
+type RecommendedOsId = "all" | "macos" | "linux" | "windows" | "ios" | "android";
+type RecommendedPlatformId = "webapp" | "saas" | "cli" | "api";
+type RecommendedPlatformFilterId = "all" | RecommendedPlatformId;
+type ManagedPolicyId = "setup" | "update";
+type ManagedPolicyToggleState = Record<string, Partial<Record<ManagedPolicyId, boolean>>>;
+
+interface TabOption<T extends string> {
+  id: T;
+  label: string;
+}
+
+interface RecommendedApp {
+  name: string;
+  description: string;
+  websiteUrl: string;
+  alternativeToUrl?: string;
+  repoUrl?: string;
+  iosUrl?: string;
+  androidUrl?: string;
+  fdroidUrl?: string;
+  obtainiumUrl?: string;
+  os: RecommendedOsId[];
+  platforms: RecommendedPlatformId[];
+}
+
+const appCollectionTabs: TabOption<AppCollectionId>[] = [
+  { id: "aidevops", label: "aidevops" },
+  { id: "recommended", label: "Recommended" },
+];
+
+const managedCategoryTabs: TabOption<ManagedCategoryId>[] = [
+  { id: "core", label: "Core" },
+  { id: "ai", label: "AI" },
+  { id: "cli", label: "CLI" },
+  { id: "desktop", label: "Desktop" },
+  { id: "terminal", label: "Terminal" },
+];
+
+const recommendedPlatformTabs: TabOption<RecommendedPlatformFilterId>[] = [
+  { id: "all", label: "All" },
+  { id: "webapp", label: "WebApp" },
+  { id: "saas", label: "SaaS" },
+  { id: "cli", label: "CLI" },
+  { id: "api", label: "API" },
+];
+
+const recommendedApps = ([
+  { name: "Affinity Studio", description: "Creative design suite.", websiteUrl: "https://www.affinity.studio/", alternativeToUrl: "https://alternativeto.net/software/affinity-1/", os: ["macos", "windows", "ios"], platforms: [] },
+  { name: "Bitwarden", description: "Open source password manager.", websiteUrl: "https://bitwarden.com", alternativeToUrl: "https://alternativeto.net/software/bitwarden--free-password-manager/", repoUrl: "https://github.com/bitwarden", os: ["macos", "linux", "windows", "ios", "android"], platforms: ["webapp", "saas", "cli", "api"] },
+  { name: "Brave Browser", description: "Privacy-focused web browser.", websiteUrl: "https://brave.com/", alternativeToUrl: "https://alternativeto.net/software/brave/", os: ["macos", "linux", "windows", "ios", "android"], platforms: [] },
+  { name: "Cloudron", description: "Self-hosted app platform.", websiteUrl: "https://www.cloudron.io/", alternativeToUrl: "https://alternativeto.net/software/cloudron/", os: ["linux"], platforms: ["webapp", "cli", "api"] },
+  { name: "Collabora Online", description: "Online office collaboration.", websiteUrl: "https://www.collaboraonline.com/collabora-online/", alternativeToUrl: "https://alternativeto.net/software/collabora-online/", os: ["linux"], platforms: ["webapp", "api"] },
+  { name: "Cometly", description: "Marketing attribution analytics.", websiteUrl: "https://www.cometly.com/", os: [], platforms: ["saas", "api"] },
+  { name: "DaVinci Resolve", description: "Professional video editing, color, VFX, and audio post-production.", websiteUrl: "https://www.blackmagicdesign.com/products/davinciresolve/", alternativeToUrl: "https://alternativeto.net/software/davinci-resolve/", os: ["macos", "linux", "windows"], platforms: [] },
+  { name: "DocuSeal", description: "Open source document signing.", websiteUrl: "https://www.docuseal.com/", alternativeToUrl: "https://alternativeto.net/software/docuseal/", os: ["linux"], platforms: ["webapp", "saas", "api"] },
+  { name: "Element", description: "Matrix messaging client.", websiteUrl: "https://element.io/", alternativeToUrl: "https://alternativeto.net/software/element-app/", os: ["macos", "linux", "windows", "ios", "android"], platforms: ["webapp"] },
+  { name: "Enpass", description: "Offline-first password manager.", websiteUrl: "https://www.enpass.io/", alternativeToUrl: "https://alternativeto.net/software/enpass/", os: ["macos", "linux", "windows", "ios", "android"], platforms: [] },
+  { name: "EspoCRM", description: "Open source CRM.", websiteUrl: "https://www.espocrm.com/", alternativeToUrl: "https://alternativeto.net/software/espocrm/", os: ["linux"], platforms: ["webapp", "saas", "api"] },
+  { name: "Fathom Analytics", description: "Privacy-first analytics.", websiteUrl: "https://usefathom.com/", alternativeToUrl: "https://alternativeto.net/software/fathom-analytics/", os: [], platforms: ["saas", "api"] },
+  { name: "FontBase", description: "Font management and reference tool.", websiteUrl: "https://fontba.se/", alternativeToUrl: "https://alternativeto.net/software/fontbase/", os: ["macos"], platforms: [] },
+  { name: "Forgejo", description: "Self-hosted Git forge.", websiteUrl: "https://forgejo.org/", alternativeToUrl: "https://alternativeto.net/software/forgejo/", os: ["linux"], platforms: ["webapp", "cli", "api"] },
+  { name: "Ghost", description: "Publishing platform.", websiteUrl: "https://ghost.org/", alternativeToUrl: "https://alternativeto.net/software/ghost/", os: ["linux"], platforms: ["webapp", "saas", "cli", "api"] },
+  { name: "Gitea", description: "Self-hosted Git service.", websiteUrl: "https://about.gitea.com/", alternativeToUrl: "https://alternativeto.net/software/gitea/", os: ["linux", "windows"], platforms: ["webapp", "cli", "api"] },
+  { name: "GitLab", description: "DevSecOps and Git hosting platform.", websiteUrl: "https://gitlab.com/", alternativeToUrl: "https://alternativeto.net/software/gitlab/", os: ["linux"], platforms: ["webapp", "saas", "cli", "api"] },
+  { name: "LibreOffice", description: "Open source office suite.", websiteUrl: "https://www.libreoffice.org/", alternativeToUrl: "https://alternativeto.net/software/libreoffice/", os: ["macos", "linux", "windows"], platforms: [] },
+  { name: "LocalWP", description: "Local WordPress development.", websiteUrl: "https://localwp.com/", alternativeToUrl: "https://alternativeto.net/software/local-by-flywheel/", os: ["macos", "linux", "windows"], platforms: [] },
+  { name: "Matomo", description: "Open analytics platform.", websiteUrl: "https://matomo.org/", alternativeToUrl: "https://alternativeto.net/software/piwik/", os: ["linux"], platforms: ["webapp", "saas", "api"] },
+  { name: "Nextcloud", description: "Open source content collaboration platform.", websiteUrl: "https://nextcloud.com/", alternativeToUrl: "https://alternativeto.net/software/nextcloud/", repoUrl: "https://github.com/nextcloud", os: ["macos", "linux", "windows", "ios", "android"], platforms: ["webapp", "saas", "api"] },
+  { name: "Nextcloud Talk", description: "Open source video calls, chat, and collaboration for Nextcloud.", websiteUrl: "https://nextcloud.com/talk/", repoUrl: "https://github.com/nextcloud/spreed", iosUrl: "https://apps.apple.com/us/app/nextcloud-talk/id1296825574", androidUrl: "https://play.google.com/store/apps/details?id=com.nextcloud.talk2&hl=en", os: ["ios", "android"], platforms: ["webapp"] },
+  { name: "OBS Studio", description: "Open source video recording and live streaming.", websiteUrl: "https://obsproject.com/", alternativeToUrl: "https://alternativeto.net/software/open-broadcaster-software/", repoUrl: "https://github.com/obsproject/obs-studio", os: ["macos", "linux", "windows"], platforms: [] },
+  { name: "ONLYOFFICE", description: "Office and document collaboration.", websiteUrl: "https://www.onlyoffice.com/", alternativeToUrl: "https://alternativeto.net/software/onlyoffice/", repoUrl: "https://github.com/ONLYOFFICE/", os: ["macos", "linux", "windows", "ios", "android"], platforms: ["webapp", "saas", "api"] },
+  { name: "OpenScreen", description: "Open screen-sharing project.", websiteUrl: "https://github.com/getopenscreen/openscreen/releases", alternativeToUrl: "https://alternativeto.net/software/openscreen/", repoUrl: "https://github.com/getopenscreen/openscreen", os: ["macos", "linux", "windows"], platforms: [] },
+  { name: "Osaurus", description: "AI app workspace.", websiteUrl: "https://osaurus.ai/", alternativeToUrl: "https://alternativeto.net/software/osaurus/", os: ["macos"], platforms: [] },
+  { name: "Parallels Desktop", description: "Run Windows, Linux, and virtual machines on macOS.", websiteUrl: "https://www.parallels.com/products/desktop/", alternativeToUrl: "https://alternativeto.net/software/parallels-desktop/about/", os: ["macos"], platforms: [] },
+  { name: "PDF Studio", description: "PDF editor.", websiteUrl: "https://www.qoppa.com/pdfstudio/", alternativeToUrl: "https://alternativeto.net/software/qoppa-pdf-studio/", os: ["macos", "linux", "windows"], platforms: [] },
+  { name: "Pixelmator Pro", description: "Professional image editor for macOS.", websiteUrl: "https://www.apple.com/pixelmator-pro/", os: ["macos"], platforms: [] },
+  { name: "PostHog", description: "Product analytics platform.", websiteUrl: "https://posthog.com/", alternativeToUrl: "https://alternativeto.net/software/posthog/", os: ["linux"], platforms: ["webapp", "saas", "cli", "api"] },
+  { name: "Postiz", description: "Social media scheduling.", websiteUrl: "https://postiz.com/", alternativeToUrl: "https://alternativeto.net/software/postiz/", os: ["linux"], platforms: ["webapp", "saas", "api"] },
+  { name: "PrivateBin", description: "Zero-knowledge pastebin.", websiteUrl: "https://privatebin.info/", alternativeToUrl: "https://alternativeto.net/software/privatebin/", repoUrl: "https://github.com/PrivateBin/PrivateBin", os: ["linux"], platforms: ["webapp", "api"] },
+  { name: "Proxmox", description: "Virtualization platform.", websiteUrl: "https://www.proxmox.com/", alternativeToUrl: "https://alternativeto.net/software/proxmox-virtual-environment/", os: ["linux"], platforms: ["webapp", "cli", "api"] },
+  { name: "QuickFile", description: "Accounting platform.", websiteUrl: "https://www.quickfile.co.uk/", os: [], platforms: ["saas", "api"] },
+  { name: "Reframed", description: "Creative framing utility.", websiteUrl: "https://www.reframed.dev/", alternativeToUrl: "https://alternativeto.net/software/reframed/", os: ["macos"], platforms: [] },
+  { name: "Rybbit", description: "Web analytics.", websiteUrl: "https://rybbit.com/", alternativeToUrl: "https://alternativeto.net/software/rybbit/", os: ["linux"], platforms: ["webapp", "saas", "api"] },
+  { name: "SchildiChat", description: "Matrix messaging client.", websiteUrl: "https://schildi.chat/", alternativeToUrl: "https://alternativeto.net/software/schildichat/", os: ["macos", "linux", "windows", "android"], platforms: ["webapp"] },
+  { name: "ScreenFlow", description: "Screen recording and editing.", websiteUrl: "https://www.telestream.net/screenflow/", alternativeToUrl: "https://alternativeto.net/software/screenflow/", os: ["macos", "ios"], platforms: [] },
+  { name: "SEO Utils", description: "Desktop SEO tools.", websiteUrl: "https://seoutils.app/", os: ["macos", "linux", "windows"], platforms: [] },
+  { name: "Shottr", description: "macOS screenshot utility.", websiteUrl: "https://shottr.cc/", alternativeToUrl: "https://alternativeto.net/software/shottr/", os: ["macos"], platforms: [] },
+  { name: "Signal", description: "Private messenger.", websiteUrl: "https://signal.org/", alternativeToUrl: "https://alternativeto.net/software/signal-private-messenger/", os: ["macos", "linux", "windows", "ios", "android"], platforms: [] },
+  { name: "SimpleX Chat", description: "Private messenger with no user IDs.", websiteUrl: "https://simplex.chat/", alternativeToUrl: "https://alternativeto.net/software/simplex-chat/about/", repoUrl: "https://github.com/simplex-chat", os: ["macos", "linux", "windows", "ios", "android"], platforms: ["cli"] },
+  { name: "Telegram", description: "Cloud-based mobile and desktop messaging app.", websiteUrl: "https://telegram.org/", iosUrl: "https://telegram.org/dl/ios", androidUrl: "https://telegram.org/android", os: ["macos", "linux", "windows", "ios", "android"], platforms: ["webapp", "api"] },
+  { name: "Thunderbird", description: "Email and calendar app.", websiteUrl: "https://www.thunderbird.net/", alternativeToUrl: "https://alternativeto.net/software/mozilla-thunderbird/about/", os: ["macos", "linux", "windows"], platforms: [] },
+  { name: "Ubicloud", description: "Open cloud platform.", websiteUrl: "https://www.ubicloud.com/", alternativeToUrl: "https://alternativeto.net/software/ubicloud/about/", repoUrl: "https://github.com/ubicloud/ubicloud", os: ["linux"], platforms: ["webapp", "saas", "cli", "api"] },
+  { name: "Vaultwarden", description: "Alternative Bitwarden server implementation.", websiteUrl: "https://github.com/dani-garcia/vaultwarden", alternativeToUrl: "https://alternativeto.net/software/vaultwarden/", repoUrl: "https://github.com/dani-garcia/vaultwarden", os: ["linux"], platforms: ["webapp", "api"] },
+  { name: "VideoProc", description: "Video processing toolkit.", websiteUrl: "https://www.videoproc.com/", alternativeToUrl: "https://alternativeto.net/software/videoproc/about/", os: ["macos", "windows"], platforms: [] },
+  { name: "VirtualBox", description: "Virtualization app.", websiteUrl: "https://www.virtualbox.org/", alternativeToUrl: "https://alternativeto.net/software/virtualbox/about/", os: ["macos", "linux", "windows"], platforms: ["cli"] },
+  { name: "WordPress", description: "Open source publishing platform.", websiteUrl: "https://wordpress.org/", alternativeToUrl: "https://alternativeto.net/software/wordpress/about/", os: ["linux"], platforms: ["webapp", "saas", "cli", "api"] },
+] satisfies RecommendedApp[]).sort((left, right) => left.name.localeCompare(right.name, undefined, { sensitivity: "base" }));
+
+function TabNav<T extends string>({ label, onChange, tabs, value }: { label: string; onChange: (value: T) => void; tabs: TabOption<T>[]; value: T }): ReactElement {
+  return <div aria-label={label} className="pill-tabs app-subnav" role="tablist">{tabs.map((tab) => <button aria-selected={value === tab.id} className={value === tab.id ? "active" : ""} key={tab.id} onClick={() => onChange(tab.id)} role="tab" type="button">{tab.label}</button>)}</div>;
+}
+
+function RecommendedAppsSurface({ apps, platform, setPlatform }: { apps: RecommendedApp[]; platform: RecommendedPlatformFilterId; setPlatform: (platform: RecommendedPlatformFilterId) => void }): ReactElement {
+  return <>
+    <TabNav label="Recommended app platform filters" tabs={recommendedPlatformTabs} value={platform} onChange={setPlatform} />
+    <div className="recommended-app-grid">
+      {apps.map((app) => <RecommendedAppCard app={app} key={app.name} setPlatform={setPlatform} />)}
+    </div>
+  </>;
+}
+
+function RecommendedAppCard({ app, setPlatform }: { app: RecommendedApp; setPlatform: (platform: RecommendedPlatformFilterId) => void }): ReactElement {
+  return <article className="recommended-app-card">
+    <div>
+      <strong>{app.name}</strong>
+      <p>{app.description}</p>
+    </div>
+    <div className="app-icon-groups">
+      <PlatformIconList platforms={app.platforms} setPlatform={setPlatform} />
+      <OsIconList os={app.os} />
+    </div>
+    <div className="managed-app-links plain-links">
+      <OriginLink href={app.websiteUrl} label={text.website} />
+      {app.alternativeToUrl ? <OriginLink href={app.alternativeToUrl} label="AlternativeTo" /> : null}
+      {app.repoUrl ? <OriginLink href={app.repoUrl} label="Repo" /> : null}
+      {app.iosUrl ? <OriginLink href={app.iosUrl} label="iOS" /> : null}
+      {app.androidUrl ? <OriginLink href={app.androidUrl} label="Android" /> : null}
+      {app.fdroidUrl ? <OriginLink href={app.fdroidUrl} label="F-Droid" /> : null}
+      {app.obtainiumUrl ? <OriginLink href={app.obtainiumUrl} label="Obtainium" /> : null}
+    </div>
+  </article>;
+}
+
+function PlatformIconList({ platforms, setPlatform }: { platforms: RecommendedPlatformId[]; setPlatform: (platform: RecommendedPlatformFilterId) => void }): ReactElement | null {
+  if (platforms.length === 0) {
+    return null;
+  }
+
+  return <span className="os-icon-list platform-icon-list">{platforms.map((platform) => <PlatformIcon id={platform} key={platform} setPlatform={setPlatform} />)}</span>;
+}
+
+function PlatformIcon({ id, setPlatform }: { id: RecommendedPlatformId; setPlatform: (platform: RecommendedPlatformFilterId) => void }): ReactElement {
+  const iconMap: Record<RecommendedPlatformId, { Icon: IconType; label: string }> = {
+    webapp: { Icon: FiMonitor, label: "WebApp" },
+    saas: { Icon: FiGlobe, label: "SaaS" },
+    cli: { Icon: FiTerminal, label: "CLI" },
+    api: { Icon: FiCode, label: "API" },
+  };
+  const { Icon, label } = iconMap[id];
+
+  return <button aria-label={`Filter by ${label}`} data-tooltip={`Filter by ${label}`} onClick={() => setPlatform(id)} title={`Filter by ${label}`} type="button"><Icon aria-hidden="true" focusable="false" /></button>;
+}
+
+function OsIconList({ os }: { os: RecommendedOsId[] }): ReactElement | null {
+  if (os.length === 0) {
+    return null;
+  }
+
+  return <span className="os-icon-list">{os.map((item) => <OsIcon id={item} key={item} />)}</span>;
+}
+
+function OsIcon({ id }: { id: RecommendedOsId }): ReactElement {
+  const iconMap: Record<RecommendedOsId, { Icon: IconType; label: string }> = {
+    all: { Icon: FiGlobe, label: "Web app" },
+    macos: { Icon: FaApple, label: "macOS" },
+    linux: { Icon: FaLinux, label: "Linux" },
+    windows: { Icon: FaWindows, label: "Windows" },
+    ios: { Icon: SiIos, label: "iOS" },
+    android: { Icon: IoLogoAndroid, label: "Android" },
+  };
+  const { Icon, label } = iconMap[id];
+
+  return <span aria-label={label} data-tooltip={label} role="img" title={label}><Icon aria-hidden="true" focusable="false" /></span>;
+}
+
+function applyManagedPolicyToggles(app: GuiManagedAppSummary, policy: Partial<Record<ManagedPolicyId, boolean>> | undefined): GuiManagedAppSummary {
+  if (policy === undefined) {
+    return app;
   }
 
-  return next;
+  return {
+    ...app,
+    aidevops_install: policy.setup ?? app.aidevops_install,
+    aidevops_update: policy.update ?? app.aidevops_update,
+  };
+}
+
+function createPolicyJob(appId: string, policy: ManagedPolicyId, value: boolean): GuiAppActionJobSummary {
+  const mode = value ? "on" : "off";
+  const command = `aidevops app policy set ${appId} --${policy === "setup" ? "setup-installs" : "update-maintains"} ${mode}`;
+  const now = new Date().toISOString();
+
+  return {
+    id: `policy-${appId}-${policy}-${Date.now()}`,
+    app_id: appId,
+    action: "update",
+    status: "completed",
+    command_preview: command,
+    started_at: now,
+    finished_at: now,
+    exit_code: 0,
+    output: [
+      `$ ${command}`,
+      `Saved local aidevops.app policy override for ${appId}: ${policy}=${mode}.`,
+      "Persistence: browser localStorage key aidevops-gui-managed-app-policy.",
+    ],
+  };
+}
+
+function readManagedPolicyToggles(): ManagedPolicyToggleState {
+  if (typeof window === "undefined") {
+    return {};
+  }
+
+  try {
+    const raw = window.localStorage.getItem("aidevops-gui-managed-app-policy");
+    return raw === null ? {} : JSON.parse(raw) as ManagedPolicyToggleState;
+  } catch {
+    return {};
+  }
+}
+
+function writeManagedPolicyToggles(policy: ManagedPolicyToggleState): void {
+  if (typeof window === "undefined") {
+    return;
+  }
+
+  window.localStorage.setItem("aidevops-gui-managed-app-policy", JSON.stringify(policy));
+}
+
+function openExternalLink(event: ReactMouseEvent<HTMLAnchorElement>, href: string): void {
+  event.stopPropagation();
+  if (event.defaultPrevented || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey) {
+    return;
+  }
+
+  const opened = window.open(href, "_blank", "noopener,noreferrer");
+  if (opened !== null) {
+    event.preventDefault();
+    opened.opener = null;
+  }
 }
 
 export function InstallationSurface(): ReactElement {

package/packages/gui-web/src/app-model.ts

@@ -335,6 +335,19 @@ function plannedCommsGroup(label: string, items: SurfaceNavItem[]): SurfaceNavGr
 }
 
 export const navGroups: SurfaceNavGroup[] = [
+  {
+    label: text.infrastructure,
+    mode: "devops",
+    items: [
+      { id: "devices", label: text.devices, description: "Installed aidevops machines", icon: "device", badge: text.planned },
+      { id: "apps", label: text.apps, description: "Installed tools and apps", icon: "package" },
+      { id: "vpnsProxies", label: text.vpnsProxies, description: "VPN and proxy inventory", icon: "shield", badge: text.planned },
+      { id: "installation", label: text.installation, description: "Optional setup toggles", icon: "download" },
+      { id: "registrars", label: text.registrars, description: "Domain registrars", icon: "chain" },
+      { id: "hosts", label: text.hosts, description: "Hosting providers", icon: "server" },
+      { id: "servers", label: text.servers, description: "Servers and orchestrators", icon: "hardDrive" },
+    ],
+  },
   {
     label: text.development,
     mode: "devops",
@@ -360,19 +373,6 @@ export const navGroups: SurfaceNavGroup[] = [
       { id: "routines", label: text.routines, description: "Scheduled workflows", icon: "clock", badge: text.planned },
     ],
   },
-  {
-    label: text.infrastructure,
-    mode: "devops",
-    items: [
-      { id: "devices", label: text.devices, description: "Installed aidevops machines", icon: "device", badge: text.planned },
-      { id: "vpnsProxies", label: text.vpnsProxies, description: "VPN and proxy inventory", icon: "shield", badge: text.planned },
-      { id: "apps", label: text.apps, description: "Installed tools and apps", icon: "package" },
-      { id: "installation", label: text.installation, description: "Optional setup toggles", icon: "download" },
-      { id: "registrars", label: text.registrars, description: "Domain registrars", icon: "chain" },
-      { id: "hosts", label: text.hosts, description: "Hosting providers", icon: "server" },
-      { id: "servers", label: text.servers, description: "Servers and orchestrators", icon: "hardDrive" },
-    ],
-  },
   {
     label: text.identities,
     mode: "comms",

package/packages/gui-web/src/styles.css

@@ -1,6 +1,7 @@
 :root {
   --accent-hue: 123;
   --accent: hsl(var(--accent-hue) 50% 36%);
+  --accent-aaa-bg: hsl(var(--accent-hue) 58% 24%);
   --accent-strong: hsl(var(--accent-hue) 56% 28%);
   --bg-primary: #ffffff;
   --bg-secondary: #f8f8f8;
@@ -33,6 +34,7 @@
 
 :root[data-theme="dark"] {
   --accent: hsl(var(--accent-hue) 74% 66%);
+  --accent-aaa-bg: hsl(var(--accent-hue) 64% 24%);
   --accent-strong: hsl(var(--accent-hue) 75% 72%);
   --bg-primary: #0a0a0a;
   --bg-secondary: #111111;
@@ -921,6 +923,15 @@ code {
   min-width: 0;
 }
 
+.header-actions > .header-icon-button,
+.header-actions > .header-action-menu {
+  align-items: center;
+  display: inline-flex;
+  flex: 0 0 38px;
+  justify-content: center;
+  width: 38px;
+}
+
 .workspace-search {
   background: var(--surface-muted);
   border: 1px solid var(--border);
@@ -1964,6 +1975,16 @@ code {
   margin-bottom: 12px;
 }
 
+.apps-surface {
+  display: grid;
+  align-content: start;
+  gap: 10px;
+}
+
+.apps-surface .section-heading {
+  margin-bottom: 8px;
+}
+
 .data-table,
 .editable-table,
 .installation-list,
@@ -1985,13 +2006,21 @@ code {
   border: 1px solid var(--border);
   border-radius: 18px;
   box-shadow: inset 0 1px 0 rgb(255 255 255 / 7%);
-  overflow: visible;
+  overflow: hidden;
+  transition: background 140ms ease, border-color 140ms ease;
 }
 
 .managed-app-card.expanded {
   border-color: color-mix(in srgb, var(--accent) 32%, var(--border));
 }
 
+.managed-app-card:hover,
+.managed-app-card:focus-within {
+  background:
+    linear-gradient(135deg, color-mix(in srgb, var(--accent) 11%, transparent), transparent 40%),
+    var(--surface-muted);
+}
+
 .managed-app-summary {
   align-items: center;
   background: transparent;
@@ -2001,6 +2030,7 @@ code {
   gap: 16px;
   grid-template-columns: minmax(0, 1fr) auto;
   padding: 16px;
+  position: relative;
   text-align: left;
   width: 100%;
 }
@@ -2039,13 +2069,16 @@ code {
 }
 
 .managed-summary-chip {
+  align-items: center;
   background: color-mix(in srgb, var(--surface-elevated) 92%, transparent);
   border: 1px solid var(--border);
   border-radius: 999px;
   display: inline-grid;
   gap: 1px;
+  justify-items: center;
   min-width: 118px;
   padding: 7px 11px;
+  text-align: center;
 }
 
 .managed-summary-chip small {
@@ -2081,6 +2114,7 @@ code {
   display: grid;
   gap: 14px;
   padding: 0 16px 16px;
+  position: relative;
 }
 
 .managed-app-toolbar {
@@ -2106,25 +2140,22 @@ code {
 .managed-app-links a,
 .origin-missing {
   align-items: center;
-  border: 1px solid var(--border);
-  border-radius: 999px;
   color: var(--text-secondary);
   display: inline-flex;
-  font-size: 0.78rem;
+  font-size: 0.95em;
   font-weight: 800;
   gap: 4px;
   max-width: 100%;
-  padding: 6px 9px;
+  padding: 4px 0;
   position: relative;
   text-decoration: none;
 }
 
 .managed-app-links a:hover,
 .managed-app-links a:focus-visible {
-  background: color-mix(in srgb, var(--accent) 12%, transparent);
-  border-color: color-mix(in srgb, var(--accent) 48%, var(--border));
   color: var(--accent);
   outline: none;
+  text-decoration: underline;
 }
 
 .origin-missing {
@@ -2157,9 +2188,25 @@ code {
   text-transform: uppercase;
 }
 
+button.managed-toggle {
+  cursor: pointer;
+  text-align: left;
+}
+
+button.managed-toggle:disabled {
+  cursor: not-allowed;
+  opacity: 0.82;
+}
+
+button.managed-toggle:hover,
+button.managed-toggle:focus-visible {
+  border-color: color-mix(in srgb, var(--accent) 42%, var(--border));
+  outline: none;
+}
+
 .switch-track {
-  background: var(--surface-muted);
-  border: 1px solid var(--border);
+  background: color-mix(in srgb, #ef4444 18%, var(--surface-muted));
+  border: 1px solid color-mix(in srgb, #ef4444 44%, var(--border));
   border-radius: 999px;
   display: inline-flex;
   padding: 2px;
@@ -2167,7 +2214,7 @@ code {
 }
 
 .switch-track span {
-  background: var(--text-muted);
+  background: #ef4444;
   border-radius: 50%;
   height: 14px;
   transform: translateX(0);
@@ -2176,10 +2223,15 @@ code {
 }
 
 .switch-track.checked span {
-  background: var(--accent);
+  background: #22c55e;
   transform: translateX(14px);
 }
 
+.switch-track.checked {
+  background: color-mix(in srgb, #22c55e 18%, var(--surface-muted));
+  border-color: color-mix(in srgb, #22c55e 48%, var(--border));
+}
+
 .app-meta small {
   color: var(--text-muted);
   font-size: 0.72rem;
@@ -2195,6 +2247,17 @@ code {
   word-break: break-word;
 }
 
+.app-log-link {
+  color: var(--text-primary);
+  text-decoration: none;
+}
+
+.app-log-link:hover,
+.app-log-link:focus-visible {
+  border-color: color-mix(in srgb, var(--accent) 42%, var(--border));
+  outline: none;
+}
+
 .app-action-button {
   align-items: center;
   background: color-mix(in srgb, var(--accent) 16%, var(--surface-elevated));
@@ -2278,6 +2341,45 @@ code {
   word-break: break-word;
 }
 
+.modal-backdrop {
+  align-items: center;
+  background: rgb(0 0 0 / 62%);
+  display: flex;
+  inset: 0;
+  justify-content: center;
+  padding: 18px;
+  position: fixed;
+  z-index: 100;
+}
+
+.confirm-modal {
+  background: var(--surface-elevated);
+  border: 1px solid var(--border-hover);
+  border-radius: 18px;
+  box-shadow: 0 24px 90px rgb(0 0 0 / 48%);
+  display: grid;
+  gap: 12px;
+  max-width: 520px;
+  padding: 22px;
+  width: min(100%, 520px);
+}
+
+.confirm-modal h3,
+.confirm-modal p {
+  margin: 0;
+}
+
+.confirm-modal code {
+  overflow-wrap: anywhere;
+}
+
+.confirm-modal-actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 10px;
+  justify-content: flex-end;
+}
+
 [data-tooltip] {
   position: relative;
 }
@@ -2292,7 +2394,7 @@ code {
   content: attr(data-tooltip);
   font-size: 0.72rem;
   font-weight: 700;
-  left: 50%;
+  left: clamp(10px, 50%, calc(100vw - 330px));
   line-height: 1.35;
   max-width: min(320px, 72vw);
   opacity: 0;
@@ -2303,7 +2405,7 @@ code {
   transform: translate(-50%, 4px);
   transition: opacity 140ms ease, transform 140ms ease;
   width: max-content;
-  z-index: 40;
+  z-index: 400;
 }
 
 [data-tooltip]:hover::after,
@@ -2382,10 +2484,82 @@ code {
   background: var(--surface-muted);
   border: 1px solid var(--border);
   border-radius: 999px;
-  display: flex;
+  align-items: center;
+  display: inline-flex;
   gap: 4px;
   padding: 5px;
-  width: min(100%, 520px);
+  width: max-content;
+  max-width: 100%;
+}
+
+.app-subnav {
+  justify-self: start;
+}
+
+.recommended-app-grid {
+  display: grid;
+  gap: 12px;
+  grid-template-columns: repeat(auto-fit, minmax(260px, 1fr));
+}
+
+.recommended-app-card {
+  background:
+    linear-gradient(135deg, color-mix(in srgb, var(--accent) 6%, transparent), transparent 40%),
+    var(--surface-muted);
+  border: 1px solid var(--border);
+  border-radius: 18px;
+  display: grid;
+  gap: 12px;
+  padding: 16px;
+}
+
+.recommended-app-card strong {
+  font-size: 1.05rem;
+}
+
+.recommended-app-card p {
+  color: var(--text-secondary);
+  margin: 4px 0 0;
+}
+
+.os-icon-list {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 6px;
+}
+
+.app-icon-groups {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 10px;
+}
+
+.os-icon-list span,
+.os-icon-list button {
+  align-items: center;
+  background: transparent;
+  border: 0;
+  border-radius: 0;
+  color: var(--text-secondary);
+  display: inline-flex;
+  font-size: 1.12rem;
+  font-weight: 900;
+  justify-content: center;
+  min-height: 24px;
+  min-width: 24px;
+  padding: 0;
+}
+
+.platform-icon-list button {
+  cursor: pointer;
+}
+
+.os-icon-list span:hover,
+.os-icon-list span:focus-visible,
+.os-icon-list button:hover,
+.os-icon-list button:focus-visible {
+  color: var(--accent);
+  outline: none;
 }
 
 .pill-tabs button {
@@ -2393,20 +2567,30 @@ code {
   border: 0;
   border-radius: 999px;
   color: var(--text-secondary);
-  flex: 1 1 0;
+  flex: 0 0 auto;
   font-weight: 800;
   min-height: 38px;
   padding: 9px 14px;
 }
 
-.pill-tabs button.active,
+.pill-tabs button.active {
+  background: var(--accent-aaa-bg);
+  color: #ffffff;
+}
+
 .pill-tabs button:hover,
 .pill-tabs button:focus-visible {
-  background: var(--surface-elevated);
-  color: var(--text-primary);
+  background: color-mix(in srgb, var(--accent) 16%, var(--surface-elevated));
+  color: var(--accent);
   outline: none;
 }
 
+.pill-tabs button.active:hover,
+.pill-tabs button.active:focus-visible {
+  background: var(--accent-aaa-bg);
+  color: #ffffff;
+}
+
 .count-pill,
 .repo-summary-strip span {
   background: color-mix(in srgb, var(--accent) 14%, transparent);

package/setup.sh

@@ -12,7 +12,7 @@ shopt -s inherit_errexit 2>/dev/null || true
 # AI Assistant Server Access Framework Setup Script
 # Helps developers set up the framework for their infrastructure
 #
-# Version: 3.29.8
+# Version: 3.29.11
 #
 # Quick Install:
 #   npm install -g aidevops && aidevops update          (recommended)