aidevops 3.29.9 → 3.29.12

package/README.md

@@ -58,7 +58,7 @@ The result: an AI operations platform that manages projects across every busines
 [![Copyright](https://img.shields.io/badge/Copyright-Marcus%20Quinn%202025--2026-blue.svg)](https://github.com/marcusquinn)
 
 <!-- Release & Version Info -->
-[![Version](https://img.shields.io/badge/Version-3.29.9-blue.svg)](https://github.com/marcusquinn/aidevops/releases)
+[![Version](https://img.shields.io/badge/Version-3.29.12-blue.svg)](https://github.com/marcusquinn/aidevops/releases)
 [![npm version](https://img.shields.io/npm/v/aidevops)](https://www.npmjs.com/package/aidevops)
 [![Homebrew](https://img.shields.io/badge/homebrew-marcusquinn%2Ftap-orange)](https://github.com/marcusquinn/homebrew-tap)
 [![GitHub repository](https://img.shields.io/badge/github-repository-181717.svg?logo=github)](https://github.com/marcusquinn/aidevops)

package/VERSION

@@ -1 +1 @@
-3.29.9
+3.29.12

package/aidevops.sh

@@ -5,7 +5,7 @@
 # AI DevOps Framework CLI
 # Usage: aidevops <command> [options]
 #
-# Version: 3.29.9
+# Version: 3.29.12
 
 set -euo pipefail
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aidevops",
-  "version": "3.29.9",
+  "version": "3.29.12",
   "description": "AI DevOps Framework - AI-assisted development workflows, code quality, and deployment automation",
   "type": "module",
   "workspaces": [

package/packages/gui-api/src/app.ts

@@ -1,4 +1,5 @@
 import { spawn } from "node:child_process";
+import * as readline from "node:readline";
 import { Hono } from "hono";
 import { APP_ACTION_ROUTE_MANIFEST, APP_ACTION_STATUS_ROUTE_MANIFEST, BANNED_ROUTE_PATTERNS, createEnvelope, FILE_EXPLORER_ROUTE_MANIFEST, type GuiAppActionId, type GuiAppActionJobSummary, STATUS_ROUTE_MANIFEST, VAULT_STATUS_ROUTE_MANIFEST } from "../../gui-shared/src";
 import { readFileExplorer } from "./file-adapter";
@@ -10,6 +11,7 @@ const appActionCommands: Record<string, Partial<Record<GuiAppActionId, string[]>
   "gui-desktop": { install: ["aidevops", "setup", "--scope", "gui-desktop"], update: ["aidevops", "setup", "--scope", "gui-desktop"], reinstall: ["aidevops", "setup", "--scope", "gui-desktop"] },
   hooks: { install: ["aidevops", "setup", "--scope", "hooks"], update: ["aidevops", "setup", "--scope", "hooks"], reinstall: ["aidevops", "setup", "--scope", "hooks"] },
   opencode: { install: ["aidevops", "setup", "--scope", "opencode"], update: ["aidevops", "setup", "--scope", "opencode"], reinstall: ["aidevops", "setup", "--scope", "opencode"] },
+  "opencode-cli": { install: ["aidevops", "setup", "--scope", "opencode"], update: ["aidevops", "setup", "--scope", "opencode"], reinstall: ["aidevops", "setup", "--scope", "opencode"] },
   pulse: { install: ["aidevops", "setup", "--scope", "pulse"], update: ["aidevops", "setup", "--scope", "pulse"], reinstall: ["aidevops", "setup", "--scope", "pulse"] },
   tabby: { install: ["aidevops", "setup", "--scope", "tabby"], update: ["aidevops", "setup", "--scope", "tabby"], reinstall: ["aidevops", "setup", "--scope", "tabby"] },
   bun: { install: ["./setup.sh", "--non-interactive"], update: ["aidevops", "update-tools", "--update"] },
@@ -149,10 +151,16 @@ function startAppActionJob(appId: string, action: GuiAppActionId, command: strin
     env: { ...process.env, AIDEVOPS_NON_INTERACTIVE: "true" },
     stdio: ["ignore", "pipe", "pipe"],
   });
-  child.stdout.on("data", (chunk) => appendJobOutput(job, chunk.toString()));
-  child.stderr.on("data", (chunk) => appendJobOutput(job, chunk.toString()));
+  if (child.stdout !== null) {
+    const stdoutLines = readline.createInterface({ input: child.stdout, terminal: false });
+    stdoutLines.on("line", (line) => appendJobLine(job, line));
+  }
+  if (child.stderr !== null) {
+    const stderrLines = readline.createInterface({ input: child.stderr, terminal: false });
+    stderrLines.on("line", (line) => appendJobLine(job, line));
+  }
   child.on("error", (error) => {
-    appendJobOutput(job, error.message);
+    appendJobLine(job, error.message);
     job.status = "failed";
     job.finished_at = new Date().toISOString();
     job.exit_code = 127;
@@ -166,8 +174,11 @@ function startAppActionJob(appId: string, action: GuiAppActionId, command: strin
   return job;
 }
 
-function appendJobOutput(job: GuiAppActionJobSummary, output: string): void {
-  job.output.push(...output.split(/\r?\n/).filter((line) => line.length > 0).map(redactOutputLine));
+function appendJobLine(job: GuiAppActionJobSummary, line: string): void {
+  if (line.length === 0) {
+    return;
+  }
+  job.output.push(redactOutputLine(line));
   if (job.output.length > 400) {
     job.output.splice(1, job.output.length - 400);
   }

package/packages/gui-api/src/status-managed-apps.ts

@@ -83,12 +83,12 @@ const MANAGED_APP_DEFINITIONS: ManagedAppDefinition[] = [
   },
   {
     id: "opencode",
-    name: "OpenCode",
-    description: "AI terminal runtime configured by aidevops for local sessions.",
-    category: "ai runtime",
-    binary: "opencode",
-    version_args: ["--version"],
-    install_path_refs: ["~/Applications/OpenCode AIDevOps.app", "/Applications/OpenCode.app", "~/.config/opencode/opencode.json"],
+    name: "OpenCode Beta",
+    description: "Native OpenCode beta desktop app configured by aidevops.",
+    category: "desktop",
+    binary: null,
+    version_args: [],
+    install_path_refs: ["~/Applications/OpenCode AIDevOps.app", "~/Applications/OpenCode.app", "/Applications/OpenCode.app", "~/.config/opencode/opencode.json"],
     origin_website_url: "https://opencode.ai",
     origin_repo_url: "",
     aidevops_install: true,
@@ -96,6 +96,7 @@ const MANAGED_APP_DEFINITIONS: ManagedAppDefinition[] = [
     latest_version_source: "binary",
     action_commands: setupScopeActions("opencode"),
   },
+  binaryApp({ id: "opencode-cli", name: "OpenCode CLI", description: "Command-line runtime installed with OpenCode and configured by aidevops.", category: "cli", binary: "opencode", version_args: ["--version"], install_path_refs: ["/opt/homebrew/bin/opencode", "/usr/local/bin/opencode", "~/.bun/bin/opencode", "~/.config/opencode/opencode.json"], origin_website_url: "https://opencode.ai", origin_repo_url: "", aidevops_install: true, aidevops_update: true }),
   {
     id: "hooks",
     name: "Safety hooks",
@@ -139,7 +140,7 @@ const MANAGED_APP_DEFINITIONS: ManagedAppDefinition[] = [
   binaryApp({ id: "homebrew", name: "Homebrew", description: "macOS package manager used by setup/update when available.", category: "package manager", binary: "brew", version_args: ["--version"], install_path_refs: ["/opt/homebrew/bin/brew", "/usr/local/bin/brew"], origin_website_url: "https://brew.sh", origin_repo_url: "https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh" }),
   binaryApp({ id: "qlty", name: "Qlty CLI", description: "Optional code quality aggregator installed by setup when selected.", category: "quality", binary: "qlty", version_args: ["--version"], install_path_refs: ["/opt/homebrew/bin/qlty", "/usr/local/bin/qlty", "~/.qlty/bin/qlty"], origin_website_url: "https://qlty.sh", origin_repo_url: "" }),
   binaryApp({ id: "rtk", name: "rtk", description: "Token-optimized GitHub/API helper used by interactive discovery.", category: "developer tooling", binary: "rtk", version_args: ["--version"], install_path_refs: ["~/.local/bin/rtk", "/opt/homebrew/bin/rtk", "/usr/local/bin/rtk"], origin_website_url: "https://github.com/rtk-ai/rtk#installation", origin_repo_url: "https://github.com/rtk-ai/rtk" }),
-  binaryApp({ id: "cursor", name: "Cursor CLI", description: "Cursor command-line integration and config targets.", category: "ai runtime", binary: "cursor", version_args: ["--version"], install_path_refs: ["~/.cursor/bin/cursor", "/Applications/Cursor.app"], origin_website_url: "https://cursor.com/install", origin_repo_url: "" }),
+  binaryApp({ id: "cursor", name: "Cursor CLI", description: "Cursor command-line integration and config targets.", category: "cli", binary: "cursor", version_args: ["--version"], install_path_refs: ["~/.cursor/bin/cursor", "/Applications/Cursor.app"], origin_website_url: "https://cursor.com/install", origin_repo_url: "" }),
   binaryApp({ id: "zed", name: "Zed", description: "Optional editor installed by setup when selected.", category: "editor", binary: "zed", version_args: ["--version"], install_path_refs: ["/Applications/Zed.app", "/opt/homebrew/bin/zed", "/usr/local/bin/zed"], origin_website_url: "https://zed.dev/download", origin_repo_url: "", aidevops_install: false, aidevops_update: false }),
   binaryApp({ id: "orbstack", name: "OrbStack", description: "Optional local container/VM runtime for macOS development.", category: "runtime", binary: "orb", version_args: ["version"], install_path_refs: ["/Applications/OrbStack.app", "/opt/homebrew/bin/orb"], origin_website_url: "https://orbstack.dev/", origin_repo_url: "", aidevops_install: false, aidevops_update: false }),
   binaryApp({ id: "ollama", name: "Ollama", description: "Optional local model runtime for local AI workflows.", category: "ai runtime", binary: "ollama", version_args: ["--version"], install_path_refs: ["/Applications/Ollama.app", "/opt/homebrew/bin/ollama", "/usr/local/bin/ollama"], origin_website_url: "https://ollama.com", origin_repo_url: "" }),
@@ -221,8 +222,22 @@ function readManagedAppVersion(definition: ManagedAppDefinition, binaryPath: str
   }
 
   if (binaryPath === null) {
-    return "not installed";
+    const existingPathRef = firstExistingPathRef(definition.install_path_refs);
+
+    if (existingPathRef === null) {
+      return "not installed";
+    }
+
+    return readAppBundleVersion(existingPathRef) ?? "installed";
   }
 
   return readBinaryVersion(binaryPath, definition.version_args);
 }
+
+function readAppBundleVersion(pathRef: string): string | null {
+  if (!pathRef.endsWith(".app")) {
+    return null;
+  }
+
+  return readBinaryVersion("/usr/libexec/PlistBuddy", ["-c", "Print :CFBundleShortVersionString", `${expandHome(pathRef)}/Contents/Info.plist`]);
+}

package/packages/gui-shared/src/notifications.ts

@@ -17,7 +17,7 @@ const toastSeverityRank: Record<GuiNotificationSeverity, number> = {
 
 const warningLineMatchers: Array<(line: string) => boolean> = [
   (line) => line.startsWith("Pulse stalled"),
-  (line) => /contribution\(s\) need/i.test(line),
+  (line) => /contribution(\(s\)|s)?\s+needs?/i.test(line),
   (line) => line.startsWith("[OPENCODE MAINTENANCE]"),
   (line) => line.startsWith("[WARNING]"),
   (line) => line.startsWith("[WARN]"),
@@ -28,7 +28,7 @@ const toastTitleRules: Array<{ matches: (line: string) => boolean; title: string
   { matches: (line) => line.startsWith("[ERROR]"), title: "Startup error" },
   { matches: (line) => line.startsWith("[OPENCODE MAINTENANCE]"), title: "OpenCode maintenance" },
   { matches: (line) => line.startsWith("Pulse stalled"), title: "Pulse stalled" },
-  { matches: (line) => /contribution\(s\) need/i.test(line), title: "External contribution review" },
+  { matches: (line) => /contribution(\(s\)|s)?\s+needs?/i.test(line), title: "External contribution review" },
   { matches: (line) => line.startsWith("[WARNING]") || line.startsWith("[WARN]"), title: "Startup warning" },
   { matches: (line) => line.startsWith("Security: all protections active"), title: "Security protections active" },
 ];
@@ -93,10 +93,10 @@ function buildToastNotifications(greetingOutput: string): GuiNotificationSummary
 }
 
 function buildGuiStateNotifications(input: BuildNotificationInput): GuiNotificationSummary[] {
-  const setupNeedsUpdate = input.setupTargets.filter((target) => target.needs_update);
-  const appNeedsUpdate = input.aiApps.filter((app) => app.needs_update);
-  const authErrors = input.oauthPool.providers.filter((provider) => provider.auth_errors > 0);
-  const rateLimited = input.oauthPool.providers.filter((provider) => provider.rate_limited > 0);
+  const setupNeedsUpdate = (input.setupTargets ?? []).filter((target) => target.needs_update);
+  const appNeedsUpdate = (input.aiApps ?? []).filter((app) => app.needs_update);
+  const authErrors = (input.oauthPool?.providers ?? []).filter((provider) => provider.auth_errors > 0);
+  const rateLimited = (input.oauthPool?.providers ?? []).filter((provider) => provider.rate_limited > 0);
   const notifications: GuiNotificationSummary[] = [];
 
   if (input.restartRequired) {

package/packages/gui-web/src/AppNavigation.tsx

@@ -222,6 +222,11 @@ function ConversationSidebar({ conversationMode, selectedLocalRepoIndex, selecte
     ? []
     : status.opencode_sessions.sessions.filter((session) => session.repo_path_ref === selectedRepo.path_ref);
   const activeSessionId = sessions.some((session) => session.id_ref === selectedSessionId) ? selectedSessionId : sessions[0]?.id_ref;
+  useEffect(() => {
+    if (activeSessionId !== selectedSessionId) {
+      setSelectedSessionId(activeSessionId);
+    }
+  }, [activeSessionId, selectedSessionId, setSelectedSessionId]);
   const canSelectPreviousRepo = selectedLocalRepoIndex > 0;
   const canSelectNextRepo = selectedLocalRepoIndex < repos.length - 1;
 

package/packages/gui-web/src/AppWorkspace.tsx

@@ -189,21 +189,30 @@ function NotificationsMenu({ notifications, openSurface }: { notifications: GuiN
         <span>{active.length} active</span>
       </div>
       {preview.length === 0 ? <p>No current aidevops notifications.</p> : null}
-      {preview.map((notification) => <NotificationPreview key={notification.id} notification={notification} />)}
+      {preview.map((notification) => (
+        <NotificationPreview
+          key={notification.id}
+          notification={notification}
+          onClick={() => {
+            const action = notification.actions.find((candidate) => candidate.enabled && candidate.kind === "surface" && isSurfaceId(candidate.surface_id));
+            openSurface(action?.kind === "surface" && isSurfaceId(action.surface_id) ? action.surface_id : "notifications");
+          }}
+        />
+      ))}
       <button onClick={() => openSurface("notifications")} role="menuitem" type="button">Open notifications</button>
     </div>
   );
 }
 
-function NotificationPreview({ notification }: { notification: GuiNotificationSummary }): ReactElement {
+function NotificationPreview({ notification, onClick }: { notification: GuiNotificationSummary; onClick: () => void }): ReactElement {
   return (
-    <article className={`notification-preview ${notification.severity}`}>
+    <button className={`notification-preview ${notification.severity}`} onClick={onClick} role="menuitem" type="button">
       <span aria-hidden="true"><NotificationIcon notification={notification} /></span>
       <div>
         <strong>{notification.title}</strong>
         <small>{notification.category} · {notification.status}</small>
       </div>
-    </article>
+    </button>
   );
 }
 
@@ -528,7 +537,7 @@ function NotificationCard({ notification, openSurface }: { notification: GuiNoti
               return <button className="secondary-action" disabled={!action.enabled} key={action.id} onClick={() => openSurface(surfaceId)} type="button">{action.label}</button>;
             }
 
-            return <button className="secondary-action" disabled key={action.id} title={action.command_preview} type="button">{action.label}</button>;
+            return <button className="secondary-action" disabled={!action.enabled} key={action.id} title={action.command_preview} type="button">{action.label}</button>;
           })}
         </div>
       </div>

package/packages/gui-web/src/InventorySurfaces.tsx

@@ -1,6 +1,10 @@
 import type { GuiAppActionId, GuiAppActionJobSummary, GuiManagedAppSummary, GuiResponseEnvelope, GuiStatusData } from "@aidevops/gui-shared";
-import { type Dispatch, type ReactElement, type SetStateAction, useEffect, useRef, useState } from "react";
-import { FiChevronDown, FiDownload, FiExternalLink, FiRefreshCw, FiRepeat, FiTrash2 } from "react-icons/fi";
+import { type Dispatch, type MouseEvent as ReactMouseEvent, type ReactElement, type SetStateAction, useEffect, useRef, useState } from "react";
+import type { IconType } from "react-icons";
+import { FaApple, FaLinux, FaWindows } from "react-icons/fa";
+import { FiChevronDown, FiCode, FiDownload, FiExternalLink, FiGlobe, FiMonitor, FiRefreshCw, FiRepeat, FiTerminal, FiTrash2 } from "react-icons/fi";
+import { IoLogoAndroid } from "react-icons/io";
+import { SiIos } from "react-icons/si";
 import type { InventoryColumn } from "./app-model";
 import { installationRows, text } from "./app-model";
 
@@ -14,13 +18,17 @@ let draftRowCounter = 0;
 export function AppsSurface({ status }: { status: GuiStatusData }): ReactElement {
   const [appCollection, setAppCollection] = useState<AppCollectionId>("aidevops");
   const [managedCategory, setManagedCategory] = useState<ManagedCategoryId>("core");
+  const [recommendedPlatform, setRecommendedPlatform] = useState<RecommendedPlatformFilterId>("all");
   const [recommendedOs, setRecommendedOs] = useState<RecommendedOsId>("all");
   const [selectedJobId, setSelectedJobId] = useState<string | null>(null);
   const [expandedAppId, setExpandedAppId] = useState<string | null>(() => sortedManagedApps(status.managed_apps).find((app) => managedCategoryForApp(app) === "core")?.id ?? null);
   const [jobs, setJobs] = useState<Record<string, GuiAppActionJobSummary>>({});
+  const [policyJobs, setPolicyJobs] = useState<Record<string, GuiAppActionJobSummary[]>>({});
+  const [policyToggles, setPolicyToggles] = useState<ManagedPolicyToggleState>(() => readManagedPolicyToggles());
   const selectedJob = selectedJobId === null ? null : jobs[selectedJobId] ?? null;
-  const visibleManagedApps = sortedManagedApps(status.managed_apps).filter((app) => managedCategoryForApp(app) === managedCategory);
-  const visibleRecommendedApps = recommendedApps.filter((app) => recommendedOs === "all" || (app.os as readonly RecommendedOsId[]).includes(recommendedOs));
+  const managedApps = sortedManagedApps(status.managed_apps).map((app) => applyManagedPolicyToggles(app, policyToggles[app.id]));
+  const visibleManagedApps = managedApps.filter((app) => managedCategoryForApp(app) === managedCategory);
+  const visibleRecommendedApps = recommendedApps.filter((app) => recommendedAppMatchesFilters(app, recommendedPlatform, recommendedOs));
 
   useEffect(() => {
     setExpandedAppId(visibleManagedApps[0]?.id ?? null);
@@ -55,22 +63,36 @@ export function AppsSurface({ status }: { status: GuiStatusData }): ReactElement
               expanded={expandedAppId === app.id}
               job={jobForApp(app.id, jobs, selectedJob)}
               key={app.id}
+              policyJobs={policyJobs[app.id] ?? []}
               onJob={(job) => {
                 setJobs((current) => ({ ...current, [job.id]: job }));
                 setSelectedJobId(job.id);
                 setExpandedAppId(app.id);
               }}
+              onPolicyToggle={(policy, value) => {
+                setPolicyToggles((current) => {
+                  const next = { ...current, [app.id]: { ...current[app.id], [policy]: value } };
+                  writeManagedPolicyToggles(next);
+                  return next;
+                });
+                const policyJob = createPolicyJob(app.id, policy, value);
+                setPolicyJobs((current) => ({ ...current, [app.id]: [...(current[app.id] ?? []), policyJob] }));
+                setSelectedJobId(policyJob.id);
+                setExpandedAppId(app.id);
+              }}
               onToggle={() => setExpandedAppId((current) => current === app.id ? null : app.id)}
             />
           ))}
         </div>
         <p className="empty-state compact-notice">Install/update actions run as allowlisted background jobs and stream inside each app panel. xterm.js with a node-pty bridge is the right next step for full TUI apps such as OpenCode; this view starts with non-interactive command logs.</p>
-      </> : <RecommendedAppsSurface apps={visibleRecommendedApps} os={recommendedOs} setOs={setRecommendedOs} />}
+      </> : <RecommendedAppsSurface apps={visibleRecommendedApps} os={recommendedOs} platform={recommendedPlatform} setOs={setRecommendedOs} setPlatform={setRecommendedPlatform} />}
     </section>
   );
 }
 
-function ManagedAppPanel({ app, expanded, job, onJob, onToggle }: { app: GuiManagedAppSummary; expanded: boolean; job: GuiAppActionJobSummary | null; onJob: (job: GuiAppActionJobSummary) => void; onToggle: () => void }): ReactElement {
+function ManagedAppPanel({ app, expanded, job, onJob, onPolicyToggle, onToggle, policyJobs }: { app: GuiManagedAppSummary; expanded: boolean; job: GuiAppActionJobSummary | null; onJob: (job: GuiAppActionJobSummary) => void; onPolicyToggle: (policy: ManagedPolicyId, value: boolean) => void; onToggle: () => void; policyJobs: GuiAppActionJobSummary[] }): ReactElement {
+  const lockedPolicy = isEssentialManagedApp(app);
+
   return (
     <article className={expanded ? "managed-app-card expanded" : "managed-app-card"}>
       <button aria-expanded={expanded} className="managed-app-summary" data-tooltip={`${expanded ? "Collapse" : "Expand"} ${app.name} controls`} onClick={onToggle} type="button">
@@ -94,16 +116,18 @@ function ManagedAppPanel({ app, expanded, job, onJob, onToggle }: { app: GuiMana
           <div className="managed-app-actions">
             {app.actions.map((action) => <AppActionButton action={action.id} app={app} disabled={!action.enabled} key={action.id} onJob={onJob} commandPreview={action.command_preview} />)}
           </div>
-        </div>
+      </div>
       <div className="managed-app-details">
-        <ToggleSwitch checked={app.aidevops_install} label="setup installs" />
-        <ToggleSwitch checked={app.aidevops_update} label="update maintains" />
+        <ToggleSwitch checked={app.aidevops_install} disabled={lockedPolicy} label="setup installs" onChange={(value) => onPolicyToggle("setup", value)} />
+        <ToggleSwitch checked={app.aidevops_update} disabled={lockedPolicy} label="update maintains" onChange={(value) => onPolicyToggle("update", value)} />
         <AppMeta label="Installed" value={app.installed_version} />
         <AppMeta label="Latest" value={app.latest_version} />
         <AppMeta label={text.path} value={app.install_path_ref} />
         {job ? <AppLogLink job={job} /> : null}
       </div>
-      {job ? <AppActionTerminal job={job} /> : <p className="empty-state compact-notice">No recent command output for this app. Run an action to open this app's terminal log.</p>}
+      {job ? <AppActionTerminal job={job} /> : null}
+      {policyJobs.map((policyJob) => <AppActionTerminal job={policyJob} key={policyJob.id} />)}
+      {job === null && policyJobs.length === 0 ? <p className="empty-state compact-notice">No recent command output for this app. Run an action or change a policy toggle to open this app's terminal log.</p> : null}
       </div> : null}
     </article>
   );
@@ -118,13 +142,11 @@ function OriginLink({ href, label }: { href: string; label: string }): ReactElem
     return <span className="origin-missing">{label}: source pending</span>;
   }
 
-  return <a data-tooltip={href} href={href} rel="noreferrer" target="_blank">{label} <FiExternalLink aria-hidden="true" /></a>;
+  return <a href={href} onClick={(event) => openExternalLink(event, href)} rel="noreferrer" target="_blank" title={href}>{label} <FiExternalLink aria-hidden="true" /></a>;
 }
 
-function ToggleSwitch({ checked, label }: { checked: boolean; label: string }): ReactElement {
-  const [isChecked, setIsChecked] = useState(checked);
-
-  return <button aria-pressed={isChecked} className={isChecked ? "managed-toggle checked" : "managed-toggle"} onClick={() => setIsChecked((current) => !current)} type="button"><span aria-hidden="true" className={isChecked ? "switch-track checked" : "switch-track"}><span /></span>{label}</button>;
+function ToggleSwitch({ checked, disabled = false, label, onChange }: { checked: boolean; disabled?: boolean; label: string; onChange: (checked: boolean) => void }): ReactElement {
+  return <button aria-pressed={checked} className={checked ? "managed-toggle checked" : "managed-toggle"} data-tooltip={disabled ? "Essential aidevops component; policy is locked on" : undefined} disabled={disabled} onClick={() => onChange(!checked)} title={disabled ? "Essential aidevops component; policy is locked on" : undefined} type="button"><span aria-hidden="true" className={checked ? "switch-track checked" : "switch-track"}><span /></span>{label}</button>;
 }
 
 function AppMeta({ label, value }: { label: string; value: string }): ReactElement {
@@ -203,7 +225,14 @@ function jobForApp(appId: string, jobs: Record<string, GuiAppActionJobSummary>,
     return selectedJob;
   }
 
-  return Object.values(jobs).reverse().find((job) => job.app_id === appId) ?? null;
+  let latestJob: GuiAppActionJobSummary | null = null;
+  for (const job of Object.values(jobs)) {
+    if (job.app_id === appId && (latestJob === null || job.started_at > latestJob.started_at)) {
+      latestJob = job;
+    }
+  }
+
+  return latestJob;
 }
 
 function sortedManagedApps(apps: GuiManagedAppSummary[]): GuiManagedAppSummary[] {
@@ -214,6 +243,9 @@ function managedCategoryForApp(app: GuiManagedAppSummary): ManagedCategoryId {
   if (["core", "safety", "automation"].includes(app.category)) {
     return "core";
   }
+  if (app.category.includes("cli")) {
+    return "cli";
+  }
   if (app.category.includes("ai")) {
     return "ai";
   }
@@ -227,9 +259,17 @@ function managedCategoryForApp(app: GuiManagedAppSummary): ManagedCategoryId {
   return "cli";
 }
 
+function isEssentialManagedApp(app: GuiManagedAppSummary): boolean {
+  return ["core", "safety", "automation"].includes(app.category);
+}
+
 type AppCollectionId = "aidevops" | "recommended";
 type ManagedCategoryId = "core" | "ai" | "cli" | "desktop" | "terminal";
 type RecommendedOsId = "all" | "macos" | "linux" | "windows" | "ios" | "android";
+type RecommendedPlatformId = "webapp" | "saas" | "cli" | "api";
+type RecommendedPlatformFilterId = "all" | RecommendedPlatformId;
+type ManagedPolicyId = "setup" | "update";
+type ManagedPolicyToggleState = Record<string, Partial<Record<ManagedPolicyId, boolean>>>;
 
 interface TabOption<T extends string> {
   id: T;
@@ -242,7 +282,12 @@ interface RecommendedApp {
   websiteUrl: string;
   alternativeToUrl?: string;
   repoUrl?: string;
+  iosUrl?: string;
+  androidUrl?: string;
+  fdroidUrl?: string;
+  obtainiumUrl?: string;
   os: RecommendedOsId[];
+  platforms: RecommendedPlatformId[];
 }
 
 const appCollectionTabs: TabOption<AppCollectionId>[] = [
@@ -258,8 +303,16 @@ const managedCategoryTabs: TabOption<ManagedCategoryId>[] = [
   { id: "terminal", label: "Terminal" },
 ];
 
-const recommendedOsTabs: TabOption<RecommendedOsId>[] = [
+const recommendedPlatformTabs: TabOption<RecommendedPlatformFilterId>[] = [
   { id: "all", label: "All" },
+  { id: "webapp", label: "WebApp" },
+  { id: "saas", label: "SaaS" },
+  { id: "cli", label: "CLI" },
+  { id: "api", label: "API" },
+];
+
+const recommendedOsTabs: TabOption<RecommendedOsId>[] = [
+  { id: "all", label: "All OS" },
   { id: "macos", label: "macOS" },
   { id: "linux", label: "Linux" },
   { id: "windows", label: "Windows" },
@@ -268,89 +321,210 @@ const recommendedOsTabs: TabOption<RecommendedOsId>[] = [
 ];
 
 const recommendedApps = ([
-  { name: "Affinity Studio", description: "Creative design suite.", websiteUrl: "https://www.affinity.studio/", alternativeToUrl: "https://alternativeto.net/software/affinity-1/", os: ["macos", "windows", "ios"] },
-  { name: "Bitwarden", description: "Open source password manager.", websiteUrl: "https://bitwarden.com", alternativeToUrl: "https://alternativeto.net/software/bitwarden--free-password-manager/", repoUrl: "https://github.com/bitwarden", os: ["macos", "linux", "windows", "ios", "android"] },
-  { name: "Brave Browser", description: "Privacy-focused web browser.", websiteUrl: "https://brave.com/", alternativeToUrl: "https://alternativeto.net/software/brave/", os: ["macos", "linux", "windows", "ios", "android"] },
-  { name: "Cloudron", description: "Self-hosted app platform.", websiteUrl: "https://www.cloudron.io/", alternativeToUrl: "https://alternativeto.net/software/cloudron/", os: ["linux"] },
-  { name: "Collabora Online", description: "Online office collaboration.", websiteUrl: "https://www.collaboraonline.com/collabora-online/", alternativeToUrl: "https://alternativeto.net/software/collabora-online/", os: ["linux"] },
-  { name: "Cometly", description: "Marketing attribution analytics.", websiteUrl: "https://www.cometly.com/", os: [] },
-  { name: "DaVinci Resolve", description: "Professional video editing, color, VFX, and audio post-production.", websiteUrl: "https://www.blackmagicdesign.com/products/davinciresolve/", alternativeToUrl: "https://alternativeto.net/software/davinci-resolve/", os: ["macos", "linux", "windows"] },
-  { name: "DocuSeal", description: "Open source document signing.", websiteUrl: "https://www.docuseal.com/", alternativeToUrl: "https://alternativeto.net/software/docuseal/", os: ["linux"] },
-  { name: "Element", description: "Matrix messaging client.", websiteUrl: "https://element.io/", alternativeToUrl: "https://alternativeto.net/software/element-app/", os: ["macos", "linux", "windows", "ios", "android"] },
-  { name: "Enpass", description: "Offline-first password manager.", websiteUrl: "https://www.enpass.io/", alternativeToUrl: "https://alternativeto.net/software/enpass/", os: ["macos", "linux", "windows", "ios", "android"] },
-  { name: "EspoCRM", description: "Open source CRM.", websiteUrl: "https://www.espocrm.com/", alternativeToUrl: "https://alternativeto.net/software/espocrm/", os: ["linux"] },
-  { name: "Fathom Analytics", description: "Privacy-first analytics.", websiteUrl: "https://usefathom.com/", alternativeToUrl: "https://alternativeto.net/software/fathom-analytics/", os: [] },
-  { name: "FonrBase", description: "Font management and reference tool.", websiteUrl: "https://fontba.se/", alternativeToUrl: "https://alternativeto.net/software/fontbase/", os: ["macos"] },
-  { name: "Forgejo", description: "Self-hosted Git forge.", websiteUrl: "https://forgejo.org/", alternativeToUrl: "https://alternativeto.net/software/forgejo/", os: ["linux"] },
-  { name: "Ghost", description: "Publishing platform.", websiteUrl: "https://ghost.org/", alternativeToUrl: "https://alternativeto.net/software/ghost/", os: ["linux"] },
-  { name: "Gitea", description: "Self-hosted Git service.", websiteUrl: "https://about.gitea.com/", alternativeToUrl: "https://alternativeto.net/software/gitea/", os: ["linux", "windows"] },
-  { name: "GitLab", description: "DevSecOps and Git hosting platform.", websiteUrl: "https://gitlab.com/", alternativeToUrl: "https://alternativeto.net/software/gitlab/", os: ["linux"] },
-  { name: "LibreOffice", description: "Open source office suite.", websiteUrl: "https://www.libreoffice.org/", alternativeToUrl: "https://alternativeto.net/software/libreoffice/", os: ["macos", "linux", "windows"] },
-  { name: "LocalWP", description: "Local WordPress development.", websiteUrl: "https://localwp.com/", alternativeToUrl: "https://alternativeto.net/software/local-by-flywheel/", os: ["macos", "linux", "windows"] },
-  { name: "Matomo", description: "Open analytics platform.", websiteUrl: "https://matomo.org/", alternativeToUrl: "https://alternativeto.net/software/piwik/", os: ["linux"] },
-  { name: "Nextcloud", description: "Open source content collaboration platform.", websiteUrl: "https://nextcloud.com/", alternativeToUrl: "https://alternativeto.net/software/nextcloud/", repoUrl: "https://github.com/nextcloud", os: ["macos", "linux", "windows", "ios", "android"] },
-  { name: "OBS Studio", description: "Open source video recording and live streaming.", websiteUrl: "https://obsproject.com/", alternativeToUrl: "https://alternativeto.net/software/open-broadcaster-software/", repoUrl: "https://github.com/obsproject/obs-studio", os: ["macos", "linux", "windows"] },
-  { name: "ONLYOFFICE", description: "Office and document collaboration.", websiteUrl: "https://www.onlyoffice.com/", alternativeToUrl: "https://alternativeto.net/software/onlyoffice/", os: ["macos", "linux", "windows", "ios", "android"] },
-  { name: "OpenScreen", description: "Open screen-sharing project.", websiteUrl: "https://github.com/getopenscreen/openscreen", alternativeToUrl: "https://alternativeto.net/software/openscreen/", repoUrl: "https://github.com/getopenscreen/openscreen", os: ["linux"] },
-  { name: "Osaurus", description: "AI app workspace.", websiteUrl: "https://osaurus.ai/", alternativeToUrl: "https://alternativeto.net/software/osaurus/", os: ["macos"] },
-  { name: "Parallels Desktop", description: "Run Windows, Linux, and virtual machines on macOS.", websiteUrl: "https://www.parallels.com/products/desktop/", alternativeToUrl: "https://alternativeto.net/software/parallels-desktop/about/", os: ["macos"] },
-  { name: "PDF Studio", description: "PDF editor.", websiteUrl: "https://www.qoppa.com/pdfstudio/", alternativeToUrl: "https://alternativeto.net/software/qoppa-pdf-studio/", os: ["macos", "linux", "windows"] },
-  { name: "PostHog", description: "Product analytics platform.", websiteUrl: "https://posthog.com/", alternativeToUrl: "https://alternativeto.net/software/posthog/", os: ["linux"] },
-  { name: "Postiz", description: "Social media scheduling.", websiteUrl: "https://postiz.com/", alternativeToUrl: "https://alternativeto.net/software/postiz/", os: ["linux"] },
-  { name: "PrivateBin", description: "Zero-knowledge pastebin.", websiteUrl: "https://privatebin.info/", alternativeToUrl: "https://alternativeto.net/software/privatebin/", repoUrl: "https://github.com/PrivateBin/PrivateBin", os: ["linux"] },
-  { name: "Proxmox", description: "Virtualization platform.", websiteUrl: "https://www.proxmox.com/", alternativeToUrl: "https://alternativeto.net/software/proxmox-virtual-environment/", os: ["linux"] },
-  { name: "QuickFile", description: "Accounting platform.", websiteUrl: "https://www.quickfile.co.uk/", os: [] },
-  { name: "Reframed", description: "Creative framing utility.", websiteUrl: "https://www.reframed.dev/", alternativeToUrl: "https://alternativeto.net/software/reframed/", os: ["macos"] },
-  { name: "Rybbit", description: "Web analytics.", websiteUrl: "https://rybbit.com/", alternativeToUrl: "https://alternativeto.net/software/rybbit/", os: ["linux"] },
-  { name: "SchildiChat", description: "Matrix messaging client.", websiteUrl: "https://schildi.chat/", alternativeToUrl: "https://alternativeto.net/software/schildichat/", os: ["macos", "linux", "windows", "android"] },
-  { name: "ScreenFlow", description: "Screen recording and editing.", websiteUrl: "https://www.telestream.net/screenflow/", alternativeToUrl: "https://alternativeto.net/software/screenflow/", os: ["macos", "ios"] },
-  { name: "SEO Utils", description: "Desktop SEO tools.", websiteUrl: "https://seoutils.app/", os: ["macos", "linux", "windows"] },
-  { name: "Shottr", description: "macOS screenshot utility.", websiteUrl: "https://shottr.cc/", alternativeToUrl: "https://alternativeto.net/software/shottr/", os: ["macos"] },
-  { name: "Signal", description: "Private messenger.", websiteUrl: "https://signal.org/", alternativeToUrl: "https://alternativeto.net/software/signal-private-messenger/", os: ["macos", "linux", "windows", "ios", "android"] },
-  { name: "SimpleX Chat", description: "Private messenger with no user IDs.", websiteUrl: "https://simplex.chat/", alternativeToUrl: "https://alternativeto.net/software/simplex-chat/about/", repoUrl: "https://github.com/simplex-chat", os: ["macos", "linux", "windows", "ios", "android"] },
-  { name: "Thunderbird", description: "Email and calendar app.", websiteUrl: "https://www.thunderbird.net/", alternativeToUrl: "https://alternativeto.net/software/mozilla-thunderbird/about/", os: ["macos", "linux", "windows"] },
-  { name: "Ubicloud", description: "Open cloud platform.", websiteUrl: "https://www.ubicloud.com/", alternativeToUrl: "https://alternativeto.net/software/ubicloud/about/", os: ["linux"] },
-  { name: "Vaultwarden", description: "Alternative Bitwarden server implementation.", websiteUrl: "https://github.com/dani-garcia/vaultwarden", alternativeToUrl: "https://alternativeto.net/software/vaultwarden/", repoUrl: "https://github.com/dani-garcia/vaultwarden", os: ["linux"] },
-  { name: "VideoProc", description: "Video processing toolkit.", websiteUrl: "https://www.videoproc.com/", alternativeToUrl: "https://alternativeto.net/software/videoproc/about/", os: ["macos", "windows"] },
-  { name: "VirtualBox", description: "Virtualization app.", websiteUrl: "https://www.virtualbox.org/", alternativeToUrl: "https://alternativeto.net/software/virtualbox/about/", os: ["macos", "linux", "windows"] },
-  { name: "WordPress", description: "Open source publishing platform.", websiteUrl: "https://wordpress.org/", alternativeToUrl: "https://alternativeto.net/software/wordpress/about/", os: ["linux"] },
+  { name: "Affinity Studio", description: "Creative design suite.", websiteUrl: "https://www.affinity.studio/", alternativeToUrl: "https://alternativeto.net/software/affinity-1/", os: ["macos", "windows", "ios"], platforms: [] },
+  { name: "Bitwarden", description: "Open source password manager.", websiteUrl: "https://bitwarden.com", alternativeToUrl: "https://alternativeto.net/software/bitwarden--free-password-manager/", repoUrl: "https://github.com/bitwarden", os: ["macos", "linux", "windows", "ios", "android"], platforms: ["webapp", "saas", "cli", "api"] },
+  { name: "Brave Browser", description: "Privacy-focused web browser.", websiteUrl: "https://brave.com/", alternativeToUrl: "https://alternativeto.net/software/brave/", os: ["macos", "linux", "windows", "ios", "android"], platforms: [] },
+  { name: "Cloudron", description: "Self-hosted app platform.", websiteUrl: "https://www.cloudron.io/", alternativeToUrl: "https://alternativeto.net/software/cloudron/", os: ["linux"], platforms: ["webapp", "cli", "api"] },
+  { name: "Collabora Online", description: "Online office collaboration.", websiteUrl: "https://www.collaboraonline.com/collabora-online/", alternativeToUrl: "https://alternativeto.net/software/collabora-online/", os: ["linux"], platforms: ["webapp", "api"] },
+  { name: "Cometly", description: "Marketing attribution analytics.", websiteUrl: "https://www.cometly.com/", os: [], platforms: ["saas", "api"] },
+  { name: "DaVinci Resolve", description: "Professional video editing, color, VFX, and audio post-production.", websiteUrl: "https://www.blackmagicdesign.com/products/davinciresolve/", alternativeToUrl: "https://alternativeto.net/software/davinci-resolve/", os: ["macos", "linux", "windows"], platforms: [] },
+  { name: "DocuSeal", description: "Open source document signing.", websiteUrl: "https://www.docuseal.com/", alternativeToUrl: "https://alternativeto.net/software/docuseal/", os: ["linux"], platforms: ["webapp", "saas", "api"] },
+  { name: "Element", description: "Matrix messaging client.", websiteUrl: "https://element.io/", alternativeToUrl: "https://alternativeto.net/software/element-app/", os: ["macos", "linux", "windows", "ios", "android"], platforms: ["webapp"] },
+  { name: "Enpass", description: "Offline-first password manager.", websiteUrl: "https://www.enpass.io/", alternativeToUrl: "https://alternativeto.net/software/enpass/", os: ["macos", "linux", "windows", "ios", "android"], platforms: [] },
+  { name: "EspoCRM", description: "Open source CRM.", websiteUrl: "https://www.espocrm.com/", alternativeToUrl: "https://alternativeto.net/software/espocrm/", os: ["linux"], platforms: ["webapp", "saas", "api"] },
+  { name: "Fathom Analytics", description: "Privacy-first analytics.", websiteUrl: "https://usefathom.com/", alternativeToUrl: "https://alternativeto.net/software/fathom-analytics/", os: [], platforms: ["saas", "api"] },
+  { name: "FontBase", description: "Font management and reference tool.", websiteUrl: "https://fontba.se/", alternativeToUrl: "https://alternativeto.net/software/fontbase/", os: ["macos"], platforms: [] },
+  { name: "Forgejo", description: "Self-hosted Git forge.", websiteUrl: "https://forgejo.org/", alternativeToUrl: "https://alternativeto.net/software/forgejo/", os: ["linux"], platforms: ["webapp", "cli", "api"] },
+  { name: "Ghost", description: "Publishing platform.", websiteUrl: "https://ghost.org/", alternativeToUrl: "https://alternativeto.net/software/ghost/", os: ["linux"], platforms: ["webapp", "saas", "cli", "api"] },
+  { name: "Gitea", description: "Self-hosted Git service.", websiteUrl: "https://about.gitea.com/", alternativeToUrl: "https://alternativeto.net/software/gitea/", os: ["linux", "windows"], platforms: ["webapp", "cli", "api"] },
+  { name: "GitLab", description: "DevSecOps and Git hosting platform.", websiteUrl: "https://gitlab.com/", alternativeToUrl: "https://alternativeto.net/software/gitlab/", os: ["linux"], platforms: ["webapp", "saas", "cli", "api"] },
+  { name: "LibreOffice", description: "Open source office suite.", websiteUrl: "https://www.libreoffice.org/", alternativeToUrl: "https://alternativeto.net/software/libreoffice/", os: ["macos", "linux", "windows"], platforms: [] },
+  { name: "LocalWP", description: "Local WordPress development.", websiteUrl: "https://localwp.com/", alternativeToUrl: "https://alternativeto.net/software/local-by-flywheel/", os: ["macos", "linux", "windows"], platforms: [] },
+  { name: "Matomo", description: "Open analytics platform.", websiteUrl: "https://matomo.org/", alternativeToUrl: "https://alternativeto.net/software/piwik/", os: ["linux"], platforms: ["webapp", "saas", "api"] },
+  { name: "Nextcloud", description: "Open source content collaboration platform.", websiteUrl: "https://nextcloud.com/", alternativeToUrl: "https://alternativeto.net/software/nextcloud/", repoUrl: "https://github.com/nextcloud", os: ["macos", "linux", "windows", "ios", "android"], platforms: ["webapp", "saas", "api"] },
+  { name: "Nextcloud Talk", description: "Open source video calls, chat, and collaboration for Nextcloud.", websiteUrl: "https://nextcloud.com/talk/", repoUrl: "https://github.com/nextcloud/spreed", iosUrl: "https://apps.apple.com/us/app/nextcloud-talk/id1296825574", androidUrl: "https://play.google.com/store/apps/details?id=com.nextcloud.talk2&hl=en", os: ["ios", "android"], platforms: ["webapp"] },
+  { name: "OBS Studio", description: "Open source video recording and live streaming.", websiteUrl: "https://obsproject.com/", alternativeToUrl: "https://alternativeto.net/software/open-broadcaster-software/", repoUrl: "https://github.com/obsproject/obs-studio", os: ["macos", "linux", "windows"], platforms: [] },
+  { name: "ONLYOFFICE", description: "Office and document collaboration.", websiteUrl: "https://www.onlyoffice.com/", alternativeToUrl: "https://alternativeto.net/software/onlyoffice/", repoUrl: "https://github.com/ONLYOFFICE/", os: ["macos", "linux", "windows", "ios", "android"], platforms: ["webapp", "saas", "api"] },
+  { name: "OpenScreen", description: "Open screen-sharing project.", websiteUrl: "https://github.com/getopenscreen/openscreen/releases", alternativeToUrl: "https://alternativeto.net/software/openscreen/", repoUrl: "https://github.com/getopenscreen/openscreen", os: ["macos", "linux", "windows"], platforms: [] },
+  { name: "Osaurus", description: "AI app workspace.", websiteUrl: "https://osaurus.ai/", alternativeToUrl: "https://alternativeto.net/software/osaurus/", os: ["macos"], platforms: [] },
+  { name: "Parallels Desktop", description: "Run Windows, Linux, and virtual machines on macOS.", websiteUrl: "https://www.parallels.com/products/desktop/", alternativeToUrl: "https://alternativeto.net/software/parallels-desktop/about/", os: ["macos"], platforms: [] },
+  { name: "PDF Studio", description: "PDF editor.", websiteUrl: "https://www.qoppa.com/pdfstudio/", alternativeToUrl: "https://alternativeto.net/software/qoppa-pdf-studio/", os: ["macos", "linux", "windows"], platforms: [] },
+  { name: "Pixelmator Pro", description: "Professional image editor for macOS.", websiteUrl: "https://www.apple.com/pixelmator-pro/", os: ["macos"], platforms: [] },
+  { name: "PostHog", description: "Product analytics platform.", websiteUrl: "https://posthog.com/", alternativeToUrl: "https://alternativeto.net/software/posthog/", os: ["linux"], platforms: ["webapp", "saas", "cli", "api"] },
+  { name: "Postiz", description: "Social media scheduling.", websiteUrl: "https://postiz.com/", alternativeToUrl: "https://alternativeto.net/software/postiz/", os: ["linux"], platforms: ["webapp", "saas", "api"] },
+  { name: "PrivateBin", description: "Zero-knowledge pastebin.", websiteUrl: "https://privatebin.info/", alternativeToUrl: "https://alternativeto.net/software/privatebin/", repoUrl: "https://github.com/PrivateBin/PrivateBin", os: ["linux"], platforms: ["webapp", "api"] },
+  { name: "Proxmox", description: "Virtualization platform.", websiteUrl: "https://www.proxmox.com/", alternativeToUrl: "https://alternativeto.net/software/proxmox-virtual-environment/", os: ["linux"], platforms: ["webapp", "cli", "api"] },
+  { name: "QuickFile", description: "Accounting platform.", websiteUrl: "https://www.quickfile.co.uk/", os: [], platforms: ["saas", "api"] },
+  { name: "Reframed", description: "Creative framing utility.", websiteUrl: "https://www.reframed.dev/", alternativeToUrl: "https://alternativeto.net/software/reframed/", os: ["macos"], platforms: [] },
+  { name: "Rybbit", description: "Web analytics.", websiteUrl: "https://rybbit.com/", alternativeToUrl: "https://alternativeto.net/software/rybbit/", os: ["linux"], platforms: ["webapp", "saas", "api"] },
+  { name: "SchildiChat", description: "Matrix messaging client.", websiteUrl: "https://schildi.chat/", alternativeToUrl: "https://alternativeto.net/software/schildichat/", os: ["macos", "linux", "windows", "android"], platforms: ["webapp"] },
+  { name: "ScreenFlow", description: "Screen recording and editing.", websiteUrl: "https://www.telestream.net/screenflow/", alternativeToUrl: "https://alternativeto.net/software/screenflow/", os: ["macos", "ios"], platforms: [] },
+  { name: "SEO Utils", description: "Desktop SEO tools.", websiteUrl: "https://seoutils.app/", os: ["macos", "linux", "windows"], platforms: [] },
+  { name: "Shottr", description: "macOS screenshot utility.", websiteUrl: "https://shottr.cc/", alternativeToUrl: "https://alternativeto.net/software/shottr/", os: ["macos"], platforms: [] },
+  { name: "Signal", description: "Private messenger.", websiteUrl: "https://signal.org/", alternativeToUrl: "https://alternativeto.net/software/signal-private-messenger/", os: ["macos", "linux", "windows", "ios", "android"], platforms: [] },
+  { name: "SimpleX Chat", description: "Private messenger with no user IDs.", websiteUrl: "https://simplex.chat/", alternativeToUrl: "https://alternativeto.net/software/simplex-chat/about/", repoUrl: "https://github.com/simplex-chat", os: ["macos", "linux", "windows", "ios", "android"], platforms: ["cli"] },
+  { name: "Telegram", description: "Cloud-based mobile and desktop messaging app.", websiteUrl: "https://telegram.org/", iosUrl: "https://telegram.org/dl/ios", androidUrl: "https://telegram.org/android", os: ["macos", "linux", "windows", "ios", "android"], platforms: ["webapp", "api"] },
+  { name: "Thunderbird", description: "Email and calendar app.", websiteUrl: "https://www.thunderbird.net/", alternativeToUrl: "https://alternativeto.net/software/mozilla-thunderbird/about/", os: ["macos", "linux", "windows"], platforms: [] },
+  { name: "Ubicloud", description: "Open cloud platform.", websiteUrl: "https://www.ubicloud.com/", alternativeToUrl: "https://alternativeto.net/software/ubicloud/about/", repoUrl: "https://github.com/ubicloud/ubicloud", os: ["linux"], platforms: ["webapp", "saas", "cli", "api"] },
+  { name: "Vaultwarden", description: "Alternative Bitwarden server implementation.", websiteUrl: "https://github.com/dani-garcia/vaultwarden", alternativeToUrl: "https://alternativeto.net/software/vaultwarden/", repoUrl: "https://github.com/dani-garcia/vaultwarden", os: ["linux"], platforms: ["webapp", "api"] },
+  { name: "VideoProc", description: "Video processing toolkit.", websiteUrl: "https://www.videoproc.com/", alternativeToUrl: "https://alternativeto.net/software/videoproc/about/", os: ["macos", "windows"], platforms: [] },
+  { name: "VirtualBox", description: "Virtualization app.", websiteUrl: "https://www.virtualbox.org/", alternativeToUrl: "https://alternativeto.net/software/virtualbox/about/", os: ["macos", "linux", "windows"], platforms: ["cli"] },
+  { name: "WordPress", description: "Open source publishing platform.", websiteUrl: "https://wordpress.org/", alternativeToUrl: "https://alternativeto.net/software/wordpress/about/", os: ["linux"], platforms: ["webapp", "saas", "cli", "api"] },
 ] satisfies RecommendedApp[]).sort((left, right) => left.name.localeCompare(right.name, undefined, { sensitivity: "base" }));
 
 function TabNav<T extends string>({ label, onChange, tabs, value }: { label: string; onChange: (value: T) => void; tabs: TabOption<T>[]; value: T }): ReactElement {
   return <div aria-label={label} className="pill-tabs app-subnav" role="tablist">{tabs.map((tab) => <button aria-selected={value === tab.id} className={value === tab.id ? "active" : ""} key={tab.id} onClick={() => onChange(tab.id)} role="tab" type="button">{tab.label}</button>)}</div>;
 }
 
-function RecommendedAppsSurface({ apps, os, setOs }: { apps: RecommendedApp[]; os: RecommendedOsId; setOs: (os: RecommendedOsId) => void }): ReactElement {
+function RecommendedAppsSurface({ apps, os, platform, setOs, setPlatform }: { apps: RecommendedApp[]; os: RecommendedOsId; platform: RecommendedPlatformFilterId; setOs: (os: RecommendedOsId) => void; setPlatform: (platform: RecommendedPlatformFilterId) => void }): ReactElement {
   return <>
-    <TabNav label="Recommended app OS filters" tabs={recommendedOsTabs} value={os} onChange={setOs} />
+    <div className="recommended-filter-tabs">
+      <TabNav label="Recommended app platform filters" tabs={recommendedPlatformTabs} value={platform} onChange={setPlatform} />
+      <TabNav label="Recommended app operating system filters" tabs={recommendedOsTabs} value={os} onChange={setOs} />
+    </div>
     <div className="recommended-app-grid">
-      {apps.map((app) => <RecommendedAppCard app={app} key={app.name} />)}
+      {apps.map((app) => <RecommendedAppCard app={app} key={app.name} setOs={setOs} setPlatform={setPlatform} />)}
     </div>
   </>;
 }
 
-function RecommendedAppCard({ app }: { app: RecommendedApp }): ReactElement {
+function RecommendedAppCard({ app, setOs, setPlatform }: { app: RecommendedApp; setOs: (os: RecommendedOsId) => void; setPlatform: (platform: RecommendedPlatformFilterId) => void }): ReactElement {
   return <article className="recommended-app-card">
     <div>
       <strong>{app.name}</strong>
       <p>{app.description}</p>
     </div>
-    <OsIconList os={app.os} />
+    <div className="app-icon-groups">
+      <PlatformIconList platforms={app.platforms} setPlatform={setPlatform} />
+      <OsIconList os={app.os} setOs={setOs} />
+    </div>
     <div className="managed-app-links plain-links">
       <OriginLink href={app.websiteUrl} label={text.website} />
       {app.alternativeToUrl ? <OriginLink href={app.alternativeToUrl} label="AlternativeTo" /> : null}
       {app.repoUrl ? <OriginLink href={app.repoUrl} label="Repo" /> : null}
+      {app.iosUrl ? <OriginLink href={app.iosUrl} label="iOS" /> : null}
+      {app.androidUrl ? <OriginLink href={app.androidUrl} label="Android" /> : null}
+      {app.fdroidUrl ? <OriginLink href={app.fdroidUrl} label="F-Droid" /> : null}
+      {app.obtainiumUrl ? <OriginLink href={app.obtainiumUrl} label="Obtainium" /> : null}
     </div>
   </article>;
 }
 
-function OsIconList({ os }: { os: RecommendedOsId[] }): ReactElement {
-  const icons: Record<RecommendedOsId, string> = { all: "*", macos: "⌘", linux: "🐧", windows: "⊞", ios: "iOS", android: "🤖" };
+function PlatformIconList({ platforms, setPlatform }: { platforms: RecommendedPlatformId[]; setPlatform: (platform: RecommendedPlatformFilterId) => void }): ReactElement | null {
+  if (platforms.length === 0) {
+    return null;
+  }
+
+  return <span className="os-icon-list platform-icon-list">{platforms.map((platform) => <PlatformIcon id={platform} key={platform} setPlatform={setPlatform} />)}</span>;
+}
+
+function PlatformIcon({ id, setPlatform }: { id: RecommendedPlatformId; setPlatform: (platform: RecommendedPlatformFilterId) => void }): ReactElement {
+  const iconMap: Record<RecommendedPlatformId, { Icon: IconType; label: string }> = {
+    webapp: { Icon: FiMonitor, label: "WebApp" },
+    saas: { Icon: FiGlobe, label: "SaaS" },
+    cli: { Icon: FiTerminal, label: "CLI" },
+    api: { Icon: FiCode, label: "API" },
+  };
+  const { Icon, label } = iconMap[id];
+
+  return <button aria-label={`Filter by ${label}`} data-tooltip={`Filter by ${label}`} onClick={() => setPlatform(id)} title={`Filter by ${label}`} type="button"><Icon aria-hidden="true" focusable="false" /></button>;
+}
+
+function OsIconList({ os, setOs }: { os: RecommendedOsId[]; setOs: (os: RecommendedOsId) => void }): ReactElement | null {
   if (os.length === 0) {
-    return <span className="os-icon-list"><span title="Web app">Web</span></span>;
+    return null;
   }
 
-  return <span className="os-icon-list">{os.map((item) => <span key={item} title={recommendedOsTabs.find((tab) => tab.id === item)?.label}>{icons[item]}</span>)}</span>;
+  return <span className="os-icon-list">{os.map((item) => <OsIcon id={item} key={item} setOs={setOs} />)}</span>;
+}
+
+function OsIcon({ id, setOs }: { id: RecommendedOsId; setOs: (os: RecommendedOsId) => void }): ReactElement {
+  const iconMap: Record<RecommendedOsId, { Icon: IconType; label: string }> = {
+    all: { Icon: FiGlobe, label: "Web app" },
+    macos: { Icon: FaApple, label: "macOS" },
+    linux: { Icon: FaLinux, label: "Linux" },
+    windows: { Icon: FaWindows, label: "Windows" },
+    ios: { Icon: SiIos, label: "iOS" },
+    android: { Icon: IoLogoAndroid, label: "Android" },
+  };
+  const { Icon, label } = iconMap[id];
+
+  return <button aria-label={`Filter by ${label}`} data-tooltip={`Filter by ${label}`} onClick={() => setOs(id)} title={`Filter by ${label}`} type="button"><Icon aria-hidden="true" focusable="false" /></button>;
+}
+
+function recommendedAppMatchesFilters(app: RecommendedApp, platform: RecommendedPlatformFilterId, os: RecommendedOsId): boolean {
+  const platformMatches = platform === "all" || app.platforms.includes(platform);
+  const osMatches = os === "all" || app.os.includes(os);
+
+  return platformMatches && osMatches;
+}
+
+function applyManagedPolicyToggles(app: GuiManagedAppSummary, policy: Partial<Record<ManagedPolicyId, boolean>> | undefined): GuiManagedAppSummary {
+  if (policy === undefined) {
+    return app;
+  }
+
+  return {
+    ...app,
+    aidevops_install: policy.setup ?? app.aidevops_install,
+    aidevops_update: policy.update ?? app.aidevops_update,
+  };
+}
+
+function createPolicyJob(appId: string, policy: ManagedPolicyId, value: boolean): GuiAppActionJobSummary {
+  const mode = value ? "on" : "off";
+  const command = `aidevops app policy set ${appId} --${policy === "setup" ? "setup-installs" : "update-maintains"} ${mode}`;
+  const now = new Date().toISOString();
+
+  return {
+    id: `policy-${appId}-${policy}-${Date.now()}`,
+    app_id: appId,
+    action: "update",
+    status: "completed",
+    command_preview: command,
+    started_at: now,
+    finished_at: now,
+    exit_code: 0,
+    output: [
+      `$ ${command}`,
+      `Saved local aidevops.app policy override for ${appId}: ${policy}=${mode}.`,
+      "Persistence: browser localStorage key aidevops-gui-managed-app-policy.",
+    ],
+  };
+}
+
+function readManagedPolicyToggles(): ManagedPolicyToggleState {
+  if (typeof window === "undefined") {
+    return {};
+  }
+
+  try {
+    const raw = window.localStorage.getItem("aidevops-gui-managed-app-policy");
+    return raw === null ? {} : JSON.parse(raw) as ManagedPolicyToggleState;
+  } catch {
+    return {};
+  }
+}
+
+function writeManagedPolicyToggles(policy: ManagedPolicyToggleState): void {
+  if (typeof window === "undefined") {
+    return;
+  }
+
+  window.localStorage.setItem("aidevops-gui-managed-app-policy", JSON.stringify(policy));
+}
+
+function openExternalLink(event: ReactMouseEvent<HTMLAnchorElement>, href: string): void {
+  event.stopPropagation();
+  if (event.defaultPrevented || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey) {
+    return;
+  }
+
+  const opened = window.open(href, "_blank", "noopener,noreferrer");
+  if (opened !== null) {
+    event.preventDefault();
+    opened.opener = null;
+  }
 }
 
 export function InstallationSurface(): ReactElement {

package/packages/gui-web/src/app-model.ts

@@ -335,6 +335,19 @@ function plannedCommsGroup(label: string, items: SurfaceNavItem[]): SurfaceNavGr
 }
 
 export const navGroups: SurfaceNavGroup[] = [
+  {
+    label: text.infrastructure,
+    mode: "devops",
+    items: [
+      { id: "devices", label: text.devices, description: "Installed aidevops machines", icon: "device", badge: text.planned },
+      { id: "apps", label: text.apps, description: "Installed tools and apps", icon: "package" },
+      { id: "vpnsProxies", label: text.vpnsProxies, description: "VPN and proxy inventory", icon: "shield", badge: text.planned },
+      { id: "installation", label: text.installation, description: "Optional setup toggles", icon: "download" },
+      { id: "registrars", label: text.registrars, description: "Domain registrars", icon: "chain" },
+      { id: "hosts", label: text.hosts, description: "Hosting providers", icon: "server" },
+      { id: "servers", label: text.servers, description: "Servers and orchestrators", icon: "hardDrive" },
+    ],
+  },
   {
     label: text.development,
     mode: "devops",
@@ -360,19 +373,6 @@ export const navGroups: SurfaceNavGroup[] = [
       { id: "routines", label: text.routines, description: "Scheduled workflows", icon: "clock", badge: text.planned },
     ],
   },
-  {
-    label: text.infrastructure,
-    mode: "devops",
-    items: [
-      { id: "devices", label: text.devices, description: "Installed aidevops machines", icon: "device", badge: text.planned },
-      { id: "vpnsProxies", label: text.vpnsProxies, description: "VPN and proxy inventory", icon: "shield", badge: text.planned },
-      { id: "apps", label: text.apps, description: "Installed tools and apps", icon: "package" },
-      { id: "installation", label: text.installation, description: "Optional setup toggles", icon: "download" },
-      { id: "registrars", label: text.registrars, description: "Domain registrars", icon: "chain" },
-      { id: "hosts", label: text.hosts, description: "Hosting providers", icon: "server" },
-      { id: "servers", label: text.servers, description: "Servers and orchestrators", icon: "hardDrive" },
-    ],
-  },
   {
     label: text.identities,
     mode: "comms",

package/packages/gui-web/src/styles.css

@@ -1,6 +1,7 @@
 :root {
   --accent-hue: 123;
   --accent: hsl(var(--accent-hue) 50% 36%);
+  --accent-aaa-bg: hsl(var(--accent-hue) 58% 24%);
   --accent-strong: hsl(var(--accent-hue) 56% 28%);
   --bg-primary: #ffffff;
   --bg-secondary: #f8f8f8;
@@ -12,6 +13,14 @@
   --font-family-app: Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
   --font-size-app: 16px;
   --glass-panel-shadow: inset 0 1px 0 rgb(255 255 255 / 58%), inset 0 -1px 0 rgb(0 0 0 / 3%), var(--shadow-soft);
+  --notification-error-bg: rgb(207 34 46 / 10%);
+  --notification-error-fg: #cf222e;
+  --notification-info-bg: rgb(9 105 218 / 10%);
+  --notification-info-fg: #0969da;
+  --notification-success-bg: rgb(26 127 55 / 10%);
+  --notification-success-fg: #1a7f37;
+  --notification-warning-bg: rgb(191 135 0 / 12%);
+  --notification-warning-fg: #9a6700;
   --shell-gutter: 8px;
   --shadow-soft: 0 18px 56px rgb(15 23 42 / 9%);
   --surface-elevated: #ffffff;
@@ -33,6 +42,7 @@
 
 :root[data-theme="dark"] {
   --accent: hsl(var(--accent-hue) 74% 66%);
+  --accent-aaa-bg: hsl(var(--accent-hue) 64% 24%);
   --accent-strong: hsl(var(--accent-hue) 75% 72%);
   --bg-primary: #0a0a0a;
   --bg-secondary: #111111;
@@ -41,6 +51,14 @@
   --border-hover: color-mix(in srgb, rgb(255 255 255 / 22%) 74%, rgb(255 255 255 / 40%));
   --code-bg: hsl(var(--accent-hue) 18% 6%);
   --glass-panel-shadow: inset 0 1px 0 rgb(255 255 255 / 10%), inset 0 -1px 0 rgb(0 0 0 / 24%), var(--shadow-soft);
+  --notification-error-bg: rgb(255 123 114 / 13%);
+  --notification-error-fg: #ff7b72;
+  --notification-info-bg: rgb(88 166 255 / 13%);
+  --notification-info-fg: #58a6ff;
+  --notification-success-bg: rgb(86 211 100 / 13%);
+  --notification-success-fg: #56d364;
+  --notification-warning-bg: rgb(210 153 34 / 15%);
+  --notification-warning-fg: #d29922;
   --shadow-soft: 0 24px 80px rgb(0 0 0 / 40%);
   --surface-elevated: #151515;
   --surface-muted: #202020;
@@ -921,6 +939,15 @@ code {
   min-width: 0;
 }
 
+.header-actions > .header-icon-button,
+.header-actions > .header-action-menu {
+  align-items: center;
+  display: inline-flex;
+  flex: 0 0 38px;
+  justify-content: center;
+  width: 38px;
+}
+
 .workspace-search {
   background: var(--surface-muted);
   border: 1px solid var(--border);
@@ -1071,11 +1098,22 @@ code {
 }
 
 .notification-preview {
+  background: var(--notification-bg, transparent);
   border: 1px solid var(--border);
   border-left: 4px solid var(--notification-color, var(--accent));
   border-radius: 12px;
+  color: var(--text-secondary);
+  cursor: pointer;
   gap: 10px;
   padding: 10px;
+  text-align: left;
+  width: 100%;
+}
+
+.notification-preview:hover,
+.notification-preview:focus-visible {
+  border-color: var(--notification-color, var(--accent));
+  outline: none;
 }
 
 .notification-preview > span {
@@ -1095,29 +1133,29 @@ code {
 
 .notification-preview.error,
 .github-notification-card.error {
-  --notification-color: #cf222e;
-  --notification-bg: rgb(207 34 46 / 10%);
+  --notification-color: var(--notification-error-fg);
+  --notification-bg: var(--notification-error-bg);
 }
 
 .notification-preview.warning,
 .github-notification-card.warning {
-  --notification-color: #9a6700;
-  --notification-bg: rgb(191 135 0 / 12%);
+  --notification-color: var(--notification-warning-fg);
+  --notification-bg: var(--notification-warning-bg);
 }
 
 .notification-preview.info,
 .github-notification-card.info {
-  --notification-color: #0969da;
-  --notification-bg: rgb(9 105 218 / 10%);
+  --notification-color: var(--notification-info-fg);
+  --notification-bg: var(--notification-info-bg);
 }
 
 .notification-preview.success,
 .github-notification-card.success {
-  --notification-color: #1a7f37;
-  --notification-bg: rgb(26 127 55 / 10%);
+  --notification-color: var(--notification-success-fg);
+  --notification-bg: var(--notification-success-bg);
 }
 
-.popover-menu button,
+.popover-menu button:not(.notification-preview),
 .popover-menu a {
   align-items: center;
   background: transparent;
@@ -1131,9 +1169,9 @@ code {
   text-decoration: none;
 }
 
-.popover-menu button:hover:not(:disabled),
+.popover-menu button:not(.notification-preview):hover:not(:disabled),
 .popover-menu a:hover,
-.popover-menu button:focus-visible,
+.popover-menu button:not(.notification-preview):focus-visible,
 .popover-menu a:focus-visible {
   background: var(--surface-muted);
   color: var(--accent);
@@ -1966,7 +2004,12 @@ code {
 
 .apps-surface {
   display: grid;
-  gap: 14px;
+  align-content: start;
+  gap: 10px;
+}
+
+.apps-surface .section-heading {
+  margin-bottom: 8px;
 }
 
 .data-table,
@@ -1990,13 +2033,21 @@ code {
   border: 1px solid var(--border);
   border-radius: 18px;
   box-shadow: inset 0 1px 0 rgb(255 255 255 / 7%);
-  overflow: visible;
+  overflow: hidden;
+  transition: background 140ms ease, border-color 140ms ease;
 }
 
 .managed-app-card.expanded {
   border-color: color-mix(in srgb, var(--accent) 32%, var(--border));
 }
 
+.managed-app-card:hover,
+.managed-app-card:focus-within {
+  background:
+    linear-gradient(135deg, color-mix(in srgb, var(--accent) 11%, transparent), transparent 40%),
+    var(--surface-muted);
+}
+
 .managed-app-summary {
   align-items: center;
   background: transparent;
@@ -2006,6 +2057,7 @@ code {
   gap: 16px;
   grid-template-columns: minmax(0, 1fr) auto;
   padding: 16px;
+  position: relative;
   text-align: left;
   width: 100%;
 }
@@ -2089,6 +2141,7 @@ code {
   display: grid;
   gap: 14px;
   padding: 0 16px 16px;
+  position: relative;
 }
 
 .managed-app-toolbar {
@@ -2116,7 +2169,7 @@ code {
   align-items: center;
   color: var(--text-secondary);
   display: inline-flex;
-  font-size: 0.78rem;
+  font-size: 0.95em;
   font-weight: 800;
   gap: 4px;
   max-width: 100%;
@@ -2167,6 +2220,11 @@ button.managed-toggle {
   text-align: left;
 }
 
+button.managed-toggle:disabled {
+  cursor: not-allowed;
+  opacity: 0.82;
+}
+
 button.managed-toggle:hover,
 button.managed-toggle:focus-visible {
   border-color: color-mix(in srgb, var(--accent) 42%, var(--border));
@@ -2363,7 +2421,7 @@ button.managed-toggle:focus-visible {
   content: attr(data-tooltip);
   font-size: 0.72rem;
   font-weight: 700;
-  left: 50%;
+  left: clamp(10px, 50%, calc(100vw - 330px));
   line-height: 1.35;
   max-width: min(320px, 72vw);
   opacity: 0;
@@ -2374,7 +2432,7 @@ button.managed-toggle:focus-visible {
   transform: translate(-50%, 4px);
   transition: opacity 140ms ease, transform 140ms ease;
   width: max-content;
-  z-index: 40;
+  z-index: 400;
 }
 
 [data-tooltip]:hover::after,
@@ -2453,14 +2511,22 @@ button.managed-toggle:focus-visible {
   background: var(--surface-muted);
   border: 1px solid var(--border);
   border-radius: 999px;
-  display: flex;
+  align-items: center;
+  display: inline-flex;
   gap: 4px;
   padding: 5px;
-  width: min(100%, 520px);
+  width: max-content;
+  max-width: 100%;
 }
 
 .app-subnav {
-  width: fit-content;
+  justify-self: start;
+}
+
+.recommended-filter-tabs {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 10px;
 }
 
 .recommended-app-grid {
@@ -2495,19 +2561,38 @@ button.managed-toggle:focus-visible {
   gap: 6px;
 }
 
-.os-icon-list span {
+.app-icon-groups {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 10px;
+}
+
+.os-icon-list span,
+.os-icon-list button {
   align-items: center;
-  background: var(--surface-elevated);
-  border: 1px solid var(--border);
-  border-radius: 999px;
+  background: transparent;
+  border: 0;
+  border-radius: 0;
   color: var(--text-secondary);
   display: inline-flex;
-  font-size: 0.72rem;
+  font-size: 1.12rem;
   font-weight: 900;
   justify-content: center;
-  min-height: 28px;
-  min-width: 28px;
-  padding: 4px 7px;
+  min-height: 24px;
+  min-width: 24px;
+  padding: 0;
+}
+
+.platform-icon-list button {
+  cursor: pointer;
+}
+
+.os-icon-list span:hover,
+.os-icon-list span:focus-visible,
+.os-icon-list button:hover,
+.os-icon-list button:focus-visible {
+  color: var(--accent);
+  outline: none;
 }
 
 .pill-tabs button {
@@ -2515,20 +2600,30 @@ button.managed-toggle:focus-visible {
   border: 0;
   border-radius: 999px;
   color: var(--text-secondary);
-  flex: 1 1 0;
+  flex: 0 0 auto;
   font-weight: 800;
   min-height: 38px;
   padding: 9px 14px;
 }
 
-.pill-tabs button.active,
+.pill-tabs button.active {
+  background: var(--accent-aaa-bg);
+  color: #ffffff;
+}
+
 .pill-tabs button:hover,
 .pill-tabs button:focus-visible {
-  background: var(--surface-elevated);
-  color: var(--text-primary);
+  background: color-mix(in srgb, var(--accent) 16%, var(--surface-elevated));
+  color: var(--accent);
   outline: none;
 }
 
+.pill-tabs button.active:hover,
+.pill-tabs button.active:focus-visible {
+  background: var(--accent-aaa-bg);
+  color: #ffffff;
+}
+
 .count-pill,
 .repo-summary-strip span {
   background: color-mix(in srgb, var(--accent) 14%, transparent);

package/setup.sh

@@ -12,7 +12,7 @@ shopt -s inherit_errexit 2>/dev/null || true
 # AI Assistant Server Access Framework Setup Script
 # Helps developers set up the framework for their infrastructure
 #
-# Version: 3.29.9
+# Version: 3.29.12
 #
 # Quick Install:
 #   npm install -g aidevops && aidevops update          (recommended)