cowork-os 0.3.21

package/src/electron/ipc/handlers.ts

@@ -0,0 +1,3661 @@
+import { ipcMain, shell, BrowserWindow, app } from 'electron';
+import * as path from 'path';
+import * as fs from 'fs/promises';
+import * as fsSync from 'fs';
+import mammoth from 'mammoth';
+
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const pdfParseModule = require('pdf-parse');
+// Handle both ESM default export and CommonJS module.exports
+const pdfParse = (typeof pdfParseModule === 'function' ? pdfParseModule : pdfParseModule.default) as (dataBuffer: Buffer) => Promise<{
+  text: string;
+  numpages: number;
+  info: { Title?: string; Author?: string };
+}>;
+
+import { DatabaseManager } from '../database/schema';
+import {
+  WorkspaceRepository,
+  TaskRepository,
+  TaskEventRepository,
+  ArtifactRepository,
+  SkillRepository,
+  LLMModelRepository,
+} from '../database/repositories';
+import { AgentRoleRepository } from '../agents/AgentRoleRepository';
+import { ActivityRepository } from '../activity/ActivityRepository';
+import { MentionRepository } from '../agents/MentionRepository';
+import { TaskLabelRepository } from '../database/TaskLabelRepository';
+import { WorkingStateRepository } from '../agents/WorkingStateRepository';
+import { ContextPolicyManager } from '../gateway/context-policy';
+import { IPC_CHANNELS, LLMSettingsData, AddChannelRequest, UpdateChannelRequest, SecurityMode, UpdateInfo, TEMP_WORKSPACE_ID, TEMP_WORKSPACE_NAME, Workspace, AgentRole, Task, BoardColumn, XSettingsData } from '../../shared/types';
+import * as os from 'os';
+import { AgentDaemon } from '../agent/daemon';
+import { LLMProviderFactory, LLMProviderConfig, ModelKey, MODELS, GEMINI_MODELS, OPENROUTER_MODELS, OLLAMA_MODELS, OpenAIOAuth } from '../agent/llm';
+import { SearchProviderFactory, SearchSettings, SearchProviderType } from '../agent/search';
+import { ChannelGateway } from '../gateway';
+import { updateManager } from '../updater';
+import { rateLimiter, RATE_LIMIT_CONFIGS } from '../utils/rate-limiter';
+import {
+  validateInput,
+  WorkspaceCreateSchema,
+  TaskCreateSchema,
+  TaskRenameSchema,
+  TaskMessageSchema,
+  ApprovalResponseSchema,
+  LLMSettingsSchema,
+  SearchSettingsSchema,
+  XSettingsSchema,
+  AddChannelSchema,
+  UpdateChannelSchema,
+  GrantAccessSchema,
+  RevokeAccessSchema,
+  GeneratePairingSchema,
+  GuardrailSettingsSchema,
+  UUIDSchema,
+  StringIdSchema,
+} from '../utils/validation';
+import { GuardrailManager } from '../guardrails/guardrail-manager';
+import { AppearanceManager } from '../settings/appearance-manager';
+import { PersonalityManager } from '../settings/personality-manager';
+
+const normalizeMentionToken = (value: string): string =>
+  value.toLowerCase().replace(/[^a-z0-9]/g, '');
+
+const buildAgentMentionIndex = (roles: AgentRole[]) => {
+  const index = new Map<string, AgentRole>();
+  roles.forEach((role) => {
+    const baseTokens = [
+      role.name,
+      role.displayName,
+      role.name.replace(/[_-]+/g, ''),
+      role.displayName.replace(/\s+/g, ''),
+      role.displayName.replace(/\s+/g, '_'),
+      role.displayName.replace(/\s+/g, '-'),
+    ];
+    baseTokens.forEach((token) => {
+      const normalized = normalizeMentionToken(token);
+      if (normalized) {
+        index.set(normalized, role);
+      }
+    });
+  });
+  return index;
+};
+
+const CAPABILITY_KEYWORDS: Record<string, string[]> = {
+  code: ['code', 'implement', 'build', 'develop', 'feature', 'api', 'backend', 'frontend', 'refactor', 'bug', 'fix'],
+  review: ['review', 'audit', 'best practices', 'quality', 'lint'],
+  test: ['test', 'testing', 'qa', 'unit', 'integration', 'e2e', 'regression', 'coverage'],
+  design: ['design', 'ui', 'ux', 'wireframe', 'mockup', 'figma', 'layout', 'visual', 'brand'],
+  ops: ['deploy', 'ci', 'cd', 'devops', 'infra', 'infrastructure', 'docker', 'kubernetes', 'pipeline', 'monitor'],
+  security: ['security', 'vulnerability', 'threat', 'audit', 'compliance', 'encryption'],
+  research: ['research', 'investigate', 'compare', 'comparison', 'competitive', 'competitor', 'benchmark', 'study'],
+  analyze: ['analyze', 'analysis', 'data', 'metrics', 'insights', 'report', 'trend', 'dashboard'],
+  plan: ['plan', 'strategy', 'roadmap', 'architecture', 'outline', 'spec'],
+  document: ['document', 'documentation', 'docs', 'guide', 'manual', 'readme', 'spec'],
+  write: ['write', 'draft', 'copy', 'blog', 'post', 'article', 'content', 'summary'],
+  communicate: ['email', 'support', 'customer', 'communication', 'outreach', 'reply', 'respond'],
+  market: ['marketing', 'growth', 'campaign', 'social', 'seo', 'launch', 'newsletter', 'ads'],
+  manage: ['manage', 'project', 'timeline', 'milestone', 'coordination', 'sprint', 'backlog'],
+  product: ['product', 'feature', 'user story', 'requirements', 'prioritize', 'mvp'],
+};
+
+const scoreAgentForTask = (role: AgentRole, text: string) => {
+  const lowerText = text.toLowerCase();
+  let score = 0;
+  const roleText = `${role.name} ${role.displayName} ${role.description ?? ''}`.toLowerCase();
+  const tokens = roleText.split(/[^a-z0-9]+/).filter((token) => token.length > 2);
+  tokens.forEach((token) => {
+    if (lowerText.includes(token)) {
+      score += 1;
+    }
+  });
+
+  if (role.capabilities) {
+    role.capabilities.forEach((capability) => {
+      const keywords = CAPABILITY_KEYWORDS[capability];
+      if (keywords && keywords.some((keyword) => lowerText.includes(keyword))) {
+        score += 3;
+      }
+    });
+  }
+
+  return score;
+};
+
+const selectBestAgentsForTask = (text: string, roles: AgentRole[]) => {
+  if (roles.length === 0) return roles;
+  const scored = roles
+    .map((role) => ({ role, score: scoreAgentForTask(role, text) }))
+    .sort((a, b) => {
+      if (b.score !== a.score) return b.score - a.score;
+      return (a.role.sortOrder ?? 0) - (b.role.sortOrder ?? 0);
+    });
+
+  const withScore = scored.filter((entry) => entry.score > 0);
+  if (withScore.length > 0) {
+    const maxScore = withScore[0].score;
+    const threshold = Math.max(1, maxScore - 2);
+    const selected = withScore
+      .filter((entry) => entry.score >= threshold)
+      .slice(0, 4)
+      .map((entry) => entry.role);
+    return selected.length > 0 ? selected : withScore.slice(0, 3).map((entry) => entry.role);
+  }
+
+  const leads = roles
+    .filter((role) => role.autonomyLevel === 'lead')
+    .sort((a, b) => (a.sortOrder ?? 0) - (b.sortOrder ?? 0));
+  if (leads.length > 0) {
+    return leads.slice(0, 3);
+  }
+
+  return roles.slice(0, Math.min(3, roles.length));
+};
+
+const extractMentionedRoles = (
+  text: string,
+  roles: AgentRole[]
+) => {
+  const normalizedText = text.toLowerCase();
+  const useSmartSelection = /\B@everybody\b/.test(normalizedText);
+  if (/\B@all\b/.test(normalizedText) || /\B@everyone\b/.test(normalizedText)) {
+    return roles;
+  }
+
+  const index = buildAgentMentionIndex(roles);
+  const matches = new Map<string, AgentRole>();
+
+  const regex = /@([a-zA-Z0-9][a-zA-Z0-9 _-]{0,50})/g;
+  let match: RegExpExecArray | null;
+  while ((match = regex.exec(text)) !== null) {
+    const raw = match[1].replace(/[.,:;!?)]*$/, '').trim();
+    const token = normalizeMentionToken(raw);
+    const role = index.get(token);
+    if (role) {
+      matches.set(role.id, role);
+    }
+  }
+
+  if (matches.size > 0) {
+    if (useSmartSelection) {
+      const selected = selectBestAgentsForTask(text, roles);
+      const merged = new Map<string, AgentRole>();
+      selected.forEach((role) => merged.set(role.id, role));
+      matches.forEach((role) => merged.set(role.id, role));
+      return Array.from(merged.values());
+    }
+    return Array.from(matches.values());
+  }
+
+  const normalizedWithAt = text
+    .toLowerCase()
+    .replace(/[^a-z0-9@]/g, '');
+
+  index.forEach((role, token) => {
+    if (normalizedWithAt.includes(`@${token}`)) {
+      matches.set(role.id, role);
+    }
+  });
+
+  if (useSmartSelection) {
+    return selectBestAgentsForTask(text, roles);
+  }
+
+  return Array.from(matches.values());
+};
+
+const buildSoulSummary = (soul?: string): string | null => {
+  if (!soul) return null;
+  try {
+    const parsed = JSON.parse(soul) as Record<string, unknown>;
+    const parts: string[] = [];
+    if (typeof parsed.name === 'string') parts.push(`Name: ${parsed.name}`);
+    if (typeof parsed.role === 'string') parts.push(`Role: ${parsed.role}`);
+    if (typeof parsed.personality === 'string') parts.push(`Personality: ${parsed.personality}`);
+    if (typeof parsed.communicationStyle === 'string') parts.push(`Style: ${parsed.communicationStyle}`);
+    if (Array.isArray(parsed.focusAreas)) parts.push(`Focus: ${parsed.focusAreas.join(', ')}`);
+    if (Array.isArray(parsed.strengths)) parts.push(`Strengths: ${parsed.strengths.join(', ')}`);
+    if (parts.length === 0) {
+      return null;
+    }
+    return parts.join('\n');
+  } catch {
+    return soul;
+  }
+};
+
+const buildAgentDispatchPrompt = (
+  role: {
+    displayName: string;
+    description?: string | null;
+    capabilities?: string[];
+    systemPrompt?: string | null;
+    soul?: string | null;
+  },
+  parentTask: { title: string; prompt: string }
+) => {
+  const lines: string[] = [
+    `You are ${role.displayName}${role.description ? ` — ${role.description}` : ''}.`,
+  ];
+
+  if (role.capabilities && role.capabilities.length > 0) {
+    lines.push(`Capabilities: ${role.capabilities.join(', ')}`);
+  }
+
+  if (role.systemPrompt) {
+    lines.push('System guidance:');
+    lines.push(role.systemPrompt);
+  }
+
+  const soulSummary = buildSoulSummary(role.soul || undefined);
+  if (soulSummary) {
+    lines.push('Role notes:');
+    lines.push(soulSummary);
+  }
+
+  lines.push('');
+  lines.push(`Parent task: ${parentTask.title}`);
+  lines.push('Request:');
+  lines.push(parentTask.prompt);
+  lines.push('');
+  lines.push('Deliverables:');
+  lines.push('- Provide a concise summary of your findings.');
+  lines.push('- Call out risks or open questions.');
+  lines.push('- Recommend next steps.');
+
+  return lines.join('\n');
+};
+import { XSettingsManager } from '../settings/x-manager';
+import { testXConnection, checkBirdInstalled } from '../utils/x-cli';
+import { getCustomSkillLoader } from '../agent/custom-skill-loader';
+import { CustomSkill } from '../../shared/types';
+import { MCPSettingsManager } from '../mcp/settings';
+import { MCPClientManager } from '../mcp/client/MCPClientManager';
+import { MCPRegistryManager } from '../mcp/registry/MCPRegistryManager';
+import type { MCPSettings, MCPServerConfig } from '../mcp/types';
+import { MCPHostServer } from '../mcp/host/MCPHostServer';
+import { BuiltinToolsSettingsManager } from '../agent/tools/builtin-settings';
+import {
+  MCPServerConfigSchema,
+  MCPServerUpdateSchema,
+  MCPSettingsSchema,
+  MCPRegistrySearchSchema,
+  HookMappingSchema,
+} from '../utils/validation';
+import { NotificationService } from '../notifications';
+import type { NotificationType, HooksSettingsData, HookMappingData, GmailHooksSettingsData, HooksStatus } from '../../shared/types';
+import {
+  HooksSettingsManager,
+  HooksServer,
+  startGmailWatcher,
+  stopGmailWatcher,
+  isGmailWatcherRunning,
+  isGogAvailable,
+  generateHookToken,
+  DEFAULT_HOOKS_PORT,
+} from '../hooks';
+import { MemoryService } from '../memory/MemoryService';
+import type { MemorySettings } from '../database/repositories';
+import { VoiceSettingsManager } from '../voice/voice-settings-manager';
+import { getVoiceService } from '../voice/VoiceService';
+
+// Global notification service instance
+let notificationService: NotificationService | null = null;
+
+/**
+ * Get the notification service instance
+ */
+export function getNotificationService(): NotificationService | null {
+  return notificationService;
+}
+
+// Helper to check rate limit and throw if exceeded
+function checkRateLimit(channel: string, config: { maxRequests: number; windowMs: number } = RATE_LIMIT_CONFIGS.standard): void {
+  if (!rateLimiter.check(channel)) {
+    const resetMs = rateLimiter.getResetTime(channel);
+    const resetSec = Math.ceil(resetMs / 1000);
+    throw new Error(`Rate limit exceeded. Try again in ${resetSec} seconds.`);
+  }
+}
+
+// Configure rate limits for sensitive channels
+rateLimiter.configure(IPC_CHANNELS.TASK_CREATE, RATE_LIMIT_CONFIGS.expensive);
+rateLimiter.configure(IPC_CHANNELS.TASK_SEND_MESSAGE, RATE_LIMIT_CONFIGS.expensive);
+rateLimiter.configure(IPC_CHANNELS.LLM_SAVE_SETTINGS, RATE_LIMIT_CONFIGS.limited);
+rateLimiter.configure(IPC_CHANNELS.LLM_TEST_PROVIDER, RATE_LIMIT_CONFIGS.expensive);
+rateLimiter.configure(IPC_CHANNELS.LLM_GET_OLLAMA_MODELS, RATE_LIMIT_CONFIGS.standard);
+rateLimiter.configure(IPC_CHANNELS.LLM_GET_GEMINI_MODELS, RATE_LIMIT_CONFIGS.standard);
+rateLimiter.configure(IPC_CHANNELS.LLM_GET_OPENROUTER_MODELS, RATE_LIMIT_CONFIGS.standard);
+rateLimiter.configure(IPC_CHANNELS.LLM_GET_BEDROCK_MODELS, RATE_LIMIT_CONFIGS.standard);
+rateLimiter.configure(IPC_CHANNELS.SEARCH_SAVE_SETTINGS, RATE_LIMIT_CONFIGS.limited);
+rateLimiter.configure(IPC_CHANNELS.SEARCH_TEST_PROVIDER, RATE_LIMIT_CONFIGS.expensive);
+rateLimiter.configure(IPC_CHANNELS.GATEWAY_ADD_CHANNEL, RATE_LIMIT_CONFIGS.limited);
+rateLimiter.configure(IPC_CHANNELS.GATEWAY_TEST_CHANNEL, RATE_LIMIT_CONFIGS.expensive);
+rateLimiter.configure(IPC_CHANNELS.GUARDRAIL_SAVE_SETTINGS, RATE_LIMIT_CONFIGS.limited);
+
+// Helper function to get the main window
+function getMainWindow(): BrowserWindow | null {
+  const windows = BrowserWindow.getAllWindows();
+  return windows.length > 0 ? windows[0] : null;
+}
+
+export async function setupIpcHandlers(
+  dbManager: DatabaseManager,
+  agentDaemon: AgentDaemon,
+  gateway?: ChannelGateway
+) {
+  const db = dbManager.getDatabase();
+  const workspaceRepo = new WorkspaceRepository(db);
+  const taskRepo = new TaskRepository(db);
+  const taskEventRepo = new TaskEventRepository(db);
+  const artifactRepo = new ArtifactRepository(db);
+  const skillRepo = new SkillRepository(db);
+  const llmModelRepo = new LLMModelRepository(db);
+  const agentRoleRepo = new AgentRoleRepository(db);
+  const activityRepo = new ActivityRepository(db);
+  const mentionRepo = new MentionRepository(db);
+  const taskLabelRepo = new TaskLabelRepository(db);
+  const workingStateRepo = new WorkingStateRepository(db);
+  const contextPolicyManager = new ContextPolicyManager(db);
+
+  // Seed default agent roles if none exist
+  agentRoleRepo.seedDefaults();
+
+  // Helper to validate path is within workspace (prevent path traversal attacks)
+  const isPathWithinWorkspace = (filePath: string, workspacePath: string): boolean => {
+    const normalizedWorkspace = path.resolve(workspacePath);
+    const normalizedFile = path.resolve(normalizedWorkspace, filePath);
+    const relative = path.relative(normalizedWorkspace, normalizedFile);
+    // If relative path starts with '..' or is absolute, it's outside workspace
+    return !relative.startsWith('..') && !path.isAbsolute(relative);
+  };
+
+  // Temp workspace management
+  // The temp workspace is created on-demand and stored in the database with a special ID
+  // It uses the system's temp directory and is filtered from the workspace list shown to users
+  const getOrCreateTempWorkspace = async (): Promise<Workspace> => {
+    // Check if temp workspace already exists in database
+    const existing = workspaceRepo.findById(TEMP_WORKSPACE_ID);
+    if (existing) {
+      const updatedPermissions = {
+        ...existing.permissions,
+        read: true,
+        write: true,
+        delete: true,
+        network: true,
+        shell: existing.permissions.shell ?? false,
+        unrestrictedFileAccess: true,
+      };
+
+      if (!existing.permissions.unrestrictedFileAccess) {
+        workspaceRepo.updatePermissions(existing.id, updatedPermissions);
+      }
+
+      // Verify the temp directory still exists, recreate if not
+      try {
+        await fs.access(existing.path);
+        return { ...existing, permissions: updatedPermissions, isTemp: true };
+      } catch {
+        // Directory was deleted, delete the workspace record and recreate
+        workspaceRepo.delete(TEMP_WORKSPACE_ID);
+      }
+    }
+
+    // Create temp directory
+    const tempDir = path.join(os.tmpdir(), 'cowork-os-temp');
+    await fs.mkdir(tempDir, { recursive: true });
+
+    // Create the temp workspace with a known ID
+    const tempWorkspace: Workspace = {
+      id: TEMP_WORKSPACE_ID,
+      name: TEMP_WORKSPACE_NAME,
+      path: tempDir,
+      createdAt: Date.now(),
+      permissions: {
+        read: true,
+        write: true,
+        delete: true,
+        network: true,
+        shell: false,
+        unrestrictedFileAccess: true,
+      },
+      isTemp: true,
+    };
+
+    // Insert directly using raw SQL to use our specific ID
+    const stmt = db.prepare(`
+      INSERT OR REPLACE INTO workspaces (id, name, path, created_at, permissions)
+      VALUES (?, ?, ?, ?, ?)
+    `);
+    stmt.run(
+      tempWorkspace.id,
+      tempWorkspace.name,
+      tempWorkspace.path,
+      tempWorkspace.createdAt,
+      JSON.stringify(tempWorkspace.permissions)
+    );
+
+    return tempWorkspace;
+  };
+
+  // File handlers - open files and show in Finder
+  ipcMain.handle('file:open', async (_, filePath: string, workspacePath?: string) => {
+    // Security: require workspacePath and validate path is within it
+    if (!workspacePath) {
+      throw new Error('Workspace path is required for file operations');
+    }
+
+    // Resolve the path relative to workspace
+    const resolvedPath = path.isAbsolute(filePath)
+      ? filePath
+      : path.resolve(workspacePath, filePath);
+
+    // Validate path is within workspace (prevent path traversal)
+    if (!isPathWithinWorkspace(resolvedPath, workspacePath)) {
+      throw new Error('Access denied: file path is outside the workspace');
+    }
+
+    return shell.openPath(resolvedPath);
+  });
+
+  ipcMain.handle('file:showInFinder', async (_, filePath: string, workspacePath?: string) => {
+    // Security: require workspacePath and validate path is within it
+    if (!workspacePath) {
+      throw new Error('Workspace path is required for file operations');
+    }
+
+    // Resolve the path relative to workspace
+    const resolvedPath = path.isAbsolute(filePath)
+      ? filePath
+      : path.resolve(workspacePath, filePath);
+
+    // Validate path is within workspace (prevent path traversal)
+    if (!isPathWithinWorkspace(resolvedPath, workspacePath)) {
+      throw new Error('Access denied: file path is outside the workspace');
+    }
+
+    shell.showItemInFolder(resolvedPath);
+  });
+
+  // Open external URL in system browser
+  ipcMain.handle('shell:openExternal', async (_, url: string) => {
+    // Validate URL to prevent security issues
+    try {
+      const parsedUrl = new URL(url);
+      if (!['http:', 'https:'].includes(parsedUrl.protocol)) {
+        throw new Error('Only http and https URLs are allowed');
+      }
+      await shell.openExternal(url);
+    } catch (error: any) {
+      throw new Error(`Failed to open URL: ${error.message}`);
+    }
+  });
+
+  // File viewer handler - read file content for in-app preview
+  // Note: This handler allows viewing any file on the system for convenience.
+  // File operations like open/showInFinder remain workspace-restricted.
+  ipcMain.handle('file:readForViewer', async (_, data: { filePath: string; workspacePath?: string }) => {
+    const { filePath, workspacePath } = data;
+
+    // Resolve the path - if absolute use directly, otherwise resolve relative to workspace or cwd
+    const resolvedPath = path.isAbsolute(filePath)
+      ? filePath
+      : workspacePath
+        ? path.resolve(workspacePath, filePath)
+        : path.resolve(filePath);
+
+    // Check if file exists
+    try {
+      await fs.access(resolvedPath);
+    } catch {
+      return { success: false, error: 'File not found' };
+    }
+
+    // Get file stats
+    const stats = await fs.stat(resolvedPath);
+    const extension = path.extname(resolvedPath).toLowerCase();
+    const fileName = path.basename(resolvedPath);
+
+    // Determine file type
+    const getFileType = (ext: string): 'markdown' | 'code' | 'text' | 'docx' | 'pdf' | 'image' | 'pptx' | 'html' | 'unsupported' => {
+      const codeExtensions = ['.js', '.ts', '.tsx', '.jsx', '.py', '.java', '.go', '.rs', '.c', '.cpp', '.h', '.css', '.scss', '.xml', '.json', '.yaml', '.yml', '.toml', '.sh', '.bash', '.zsh', '.sql', '.graphql', '.vue', '.svelte', '.rb', '.php', '.swift', '.kt', '.scala'];
+      const textExtensions = ['.txt', '.log', '.csv', '.env', '.gitignore', '.dockerignore', '.editorconfig', '.prettierrc', '.eslintrc'];
+      const imageExtensions = ['.png', '.jpg', '.jpeg', '.gif', '.webp', '.svg', '.bmp', '.ico'];
+
+      if (ext === '.md' || ext === '.markdown') return 'markdown';
+      if (ext === '.html' || ext === '.htm') return 'html';
+      if (ext === '.docx') return 'docx';
+      if (ext === '.pdf') return 'pdf';
+      if (ext === '.pptx') return 'pptx';
+      if (imageExtensions.includes(ext)) return 'image';
+      if (codeExtensions.includes(ext)) return 'code';
+      if (textExtensions.includes(ext)) return 'text';
+
+      return 'unsupported';
+    };
+
+    const fileType = getFileType(extension);
+
+    // Size limits
+    const MAX_TEXT_SIZE = 5 * 1024 * 1024; // 5MB
+    const MAX_IMAGE_SIZE = 10 * 1024 * 1024; // 10MB
+
+    if (fileType === 'image' && stats.size > MAX_IMAGE_SIZE) {
+      return { success: false, error: 'File too large for preview (max 10MB for images)' };
+    }
+    if (fileType !== 'image' && fileType !== 'unsupported' && stats.size > MAX_TEXT_SIZE) {
+      return { success: false, error: 'File too large for preview (max 5MB for text files)' };
+    }
+
+    try {
+      let content: string | null = null;
+      let htmlContent: string | undefined;
+
+      switch (fileType) {
+        case 'markdown':
+        case 'code':
+        case 'text': {
+          content = await fs.readFile(resolvedPath, 'utf-8');
+          break;
+        }
+
+        case 'docx': {
+          const buffer = await fs.readFile(resolvedPath);
+          const result = await mammoth.convertToHtml({ buffer });
+          htmlContent = result.value;
+          content = null; // HTML content is in htmlContent
+          break;
+        }
+
+        case 'pdf': {
+          const buffer = await fs.readFile(resolvedPath);
+          const pdfData = await pdfParse(buffer);
+          content = pdfData.text;
+          break;
+        }
+
+        case 'image': {
+          const buffer = await fs.readFile(resolvedPath);
+          const mimeTypes: Record<string, string> = {
+            '.png': 'image/png',
+            '.jpg': 'image/jpeg',
+            '.jpeg': 'image/jpeg',
+            '.gif': 'image/gif',
+            '.webp': 'image/webp',
+            '.svg': 'image/svg+xml',
+            '.bmp': 'image/bmp',
+            '.ico': 'image/x-icon',
+          };
+          const mimeType = mimeTypes[extension] || 'image/png';
+          content = `data:${mimeType};base64,${buffer.toString('base64')}`;
+          break;
+        }
+
+        case 'html': {
+          htmlContent = await fs.readFile(resolvedPath, 'utf-8');
+          content = null; // HTML content is in htmlContent
+          break;
+        }
+
+        case 'pptx':
+          // PowerPoint files are complex to render, return placeholder
+          content = null;
+          break;
+
+        default:
+          return { success: false, error: 'Unsupported file type', fileType: 'unsupported' };
+      }
+
+      return {
+        success: true,
+        data: {
+          path: resolvedPath,
+          fileName,
+          fileType,
+          content,
+          htmlContent,
+          size: stats.size,
+        },
+      };
+    } catch (error: any) {
+      return { success: false, error: `Failed to read file: ${error.message}` };
+    }
+  });
+
+  // Workspace handlers
+  ipcMain.handle(IPC_CHANNELS.WORKSPACE_CREATE, async (_, data) => {
+    const validated = validateInput(WorkspaceCreateSchema, data, 'workspace');
+    const { name, path, permissions } = validated;
+
+    // Check if workspace with this path already exists
+    if (workspaceRepo.existsByPath(path)) {
+      throw new Error(`A workspace with path "${path}" already exists. Please choose a different folder.`);
+    }
+
+    // Provide default permissions if not specified
+    // Note: network is enabled by default for browser tools (web access)
+    const defaultPermissions = {
+      read: true,
+      write: true,
+      delete: false,
+      network: true,
+      shell: false,
+    };
+
+    return workspaceRepo.create(name, path, permissions ?? defaultPermissions);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.WORKSPACE_LIST, async () => {
+    // Filter out the temp workspace from the list - users shouldn't see it in their workspaces
+    const allWorkspaces = workspaceRepo.findAll();
+    return allWorkspaces.filter(w => w.id !== TEMP_WORKSPACE_ID);
+  });
+
+  // Get or create the temp workspace (used when no workspace is selected)
+  ipcMain.handle(IPC_CHANNELS.WORKSPACE_GET_TEMP, async () => {
+    return getOrCreateTempWorkspace();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.WORKSPACE_SELECT, async (_, id: string) => {
+    return workspaceRepo.findById(id);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.WORKSPACE_UPDATE_PERMISSIONS, async (_, id: string, permissions: { shell?: boolean; network?: boolean; read?: boolean; write?: boolean; delete?: boolean }) => {
+    const workspace = workspaceRepo.findById(id);
+    if (!workspace) {
+      throw new Error(`Workspace not found: ${id}`);
+    }
+    const updatedPermissions = { ...workspace.permissions, ...permissions };
+    workspaceRepo.updatePermissions(id, updatedPermissions);
+    return workspaceRepo.findById(id);
+  });
+
+  // Task handlers
+  ipcMain.handle(IPC_CHANNELS.TASK_CREATE, async (_, data) => {
+    checkRateLimit(IPC_CHANNELS.TASK_CREATE);
+    const validated = validateInput(TaskCreateSchema, data, 'task');
+    const { title, prompt, workspaceId, budgetTokens, budgetCost } = validated;
+    const task = taskRepo.create({
+      title,
+      prompt,
+      status: 'pending',
+      workspaceId,
+      budgetTokens,
+      budgetCost,
+    });
+
+    // Start task execution in agent daemon
+    try {
+      await agentDaemon.startTask(task);
+    } catch (error: any) {
+      // Update task status to failed if we can't start it
+      taskRepo.update(task.id, {
+        status: 'failed',
+        error: error.message || 'Failed to start task',
+      });
+      throw new Error(error.message || 'Failed to start task. Please check your LLM provider settings.');
+    }
+
+    // Dispatch to mentioned agents (e.g., "Please review @Vision @Loki")
+    try {
+      const activeRoles = agentRoleRepo.findAll(false).filter((role) => role.isActive);
+      const mentionedRoles = extractMentionedRoles(`${title}\n${prompt}`, activeRoles);
+      const dispatchRoles = mentionedRoles.length > 0 ? mentionedRoles : activeRoles;
+
+      if (dispatchRoles.length > 0) {
+        const taskUpdate: Partial<Task> = {
+          mentionedAgentRoleIds: dispatchRoles.map((role) => role.id),
+        };
+        taskRepo.update(task.id, taskUpdate);
+
+        // Parallelize child task creation for better performance
+        const dispatchPromises = dispatchRoles.map(async (role) => {
+          const childPrompt = buildAgentDispatchPrompt(role, task);
+          const childTask = await agentDaemon.createChildTask({
+            title: `@${role.displayName}: ${task.title}`,
+            prompt: childPrompt,
+            workspaceId: task.workspaceId,
+            parentTaskId: task.id,
+            agentType: 'sub',
+            agentConfig: {
+              ...(role.modelKey ? { modelKey: role.modelKey } : {}),
+              ...(role.personalityId ? { personalityId: role.personalityId } : {}),
+              retainMemory: false,
+            },
+          });
+
+          const childUpdate: Partial<Task> = {
+            assignedAgentRoleId: role.id,
+            boardColumn: 'todo' as BoardColumn,
+          };
+          taskRepo.update(childTask.id, childUpdate);
+
+          const dispatchActivity = activityRepo.create({
+            workspaceId: task.workspaceId,
+            taskId: task.id,
+            agentRoleId: role.id,
+            actorType: 'system',
+            activityType: 'agent_assigned',
+            title: `Dispatched to ${role.displayName}`,
+            description: childTask.title,
+          });
+          getMainWindow()?.webContents.send(IPC_CHANNELS.ACTIVITY_EVENT, { type: 'created', activity: dispatchActivity });
+
+          const mention = mentionRepo.create({
+            workspaceId: task.workspaceId,
+            taskId: task.id,
+            toAgentRoleId: role.id,
+            mentionType: 'request',
+            context: `New task: ${task.title}`,
+          });
+          getMainWindow()?.webContents.send(IPC_CHANNELS.MENTION_EVENT, { type: 'created', mention });
+
+          const mentionActivity = activityRepo.create({
+            workspaceId: task.workspaceId,
+            taskId: task.id,
+            agentRoleId: role.id,
+            actorType: 'user',
+            activityType: 'mention',
+            title: `@${role.displayName} mentioned`,
+            description: mention.context,
+            metadata: { mentionId: mention.id, mentionType: mention.mentionType },
+          });
+          getMainWindow()?.webContents.send(IPC_CHANNELS.ACTIVITY_EVENT, { type: 'created', activity: mentionActivity });
+
+          return { role, childTask };
+        });
+
+        await Promise.all(dispatchPromises);
+      }
+    } catch (error: unknown) {
+      const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+      console.error('Failed to dispatch to mentioned agents:', error);
+      // Notify user of dispatch failure via activity feed
+      const errorActivity = activityRepo.create({
+        workspaceId: task.workspaceId,
+        taskId: task.id,
+        actorType: 'system',
+        activityType: 'error',
+        title: 'Agent dispatch failed',
+        description: `Failed to dispatch task to mentioned agents: ${errorMessage}`,
+      });
+      getMainWindow()?.webContents.send(IPC_CHANNELS.ACTIVITY_EVENT, { type: 'created', activity: errorActivity });
+    }
+
+    return task;
+  });
+
+  ipcMain.handle(IPC_CHANNELS.TASK_GET, async (_, id: string) => {
+    return taskRepo.findById(id);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.TASK_LIST, async () => {
+    return taskRepo.findAll();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.TASK_CANCEL, async (_, id: string) => {
+    try {
+      await agentDaemon.cancelTask(id);
+    } finally {
+      // Always update status even if daemon cancel fails
+      taskRepo.update(id, { status: 'cancelled' });
+    }
+  });
+
+  ipcMain.handle(IPC_CHANNELS.TASK_PAUSE, async (_, id: string) => {
+    // Pause daemon first - if it fails, exception propagates and status won't be updated
+    await agentDaemon.pauseTask(id);
+    taskRepo.update(id, { status: 'paused' });
+  });
+
+  ipcMain.handle(IPC_CHANNELS.TASK_RESUME, async (_, id: string) => {
+    // Resume daemon first - if it fails, exception propagates and status won't be updated
+    await agentDaemon.resumeTask(id);
+    taskRepo.update(id, { status: 'executing' });
+  });
+
+  ipcMain.handle(IPC_CHANNELS.TASK_SEND_STDIN, async (_, data: { taskId: string; input: string }) => {
+    return agentDaemon.sendStdinToTask(data.taskId, data.input);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.TASK_KILL_COMMAND, async (_, data: { taskId: string; force?: boolean }) => {
+    return agentDaemon.killCommandInTask(data.taskId, data.force);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.TASK_RENAME, async (_, data) => {
+    const validated = validateInput(TaskRenameSchema, data, 'task rename');
+    taskRepo.update(validated.id, { title: validated.title });
+  });
+
+  ipcMain.handle(IPC_CHANNELS.TASK_DELETE, async (_, id: string) => {
+    // Cancel the task if it's running
+    await agentDaemon.cancelTask(id);
+    // Delete from database
+    taskRepo.delete(id);
+  });
+
+  // ============ Sub-Agent / Parallel Agent Handlers ============
+
+  // Get child tasks for a parent task
+  ipcMain.handle(IPC_CHANNELS.AGENT_GET_CHILDREN, async (_, parentTaskId: string) => {
+    return agentDaemon.getChildTasks(parentTaskId);
+  });
+
+  // Get status of specific agents
+  ipcMain.handle(IPC_CHANNELS.AGENT_GET_STATUS, async (_, taskIds: string[]) => {
+    const tasks = [];
+    for (const id of taskIds) {
+      const task = await agentDaemon.getTaskById(id);
+      if (task) {
+        tasks.push({
+          taskId: id,
+          status: task.status,
+          title: task.title,
+          agentType: task.agentType,
+          resultSummary: task.resultSummary,
+          error: task.error,
+        });
+      }
+    }
+    return tasks;
+  });
+
+  // Task events handler - get historical events from database
+  ipcMain.handle(IPC_CHANNELS.TASK_EVENTS, async (_, taskId: string) => {
+    return taskEventRepo.findByTaskId(taskId);
+  });
+
+  // Send follow-up message to a task
+  ipcMain.handle(IPC_CHANNELS.TASK_SEND_MESSAGE, async (_, data) => {
+    checkRateLimit(IPC_CHANNELS.TASK_SEND_MESSAGE);
+    const validated = validateInput(TaskMessageSchema, data, 'task message');
+    await agentDaemon.sendMessage(validated.taskId, validated.message);
+  });
+
+  // Approval handlers
+  ipcMain.handle(IPC_CHANNELS.APPROVAL_RESPOND, async (_, data) => {
+    const validated = validateInput(ApprovalResponseSchema, data, 'approval response');
+    await agentDaemon.respondToApproval(validated.approvalId, validated.approved);
+  });
+
+  // Artifact handlers
+  ipcMain.handle(IPC_CHANNELS.ARTIFACT_LIST, async (_, taskId: string) => {
+    return artifactRepo.findByTaskId(taskId);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.ARTIFACT_PREVIEW, async (_, id: string) => {
+    // TODO: Implement artifact preview
+    return null;
+  });
+
+  // Skill handlers
+  ipcMain.handle(IPC_CHANNELS.SKILL_LIST, async () => {
+    return skillRepo.findAll();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.SKILL_GET, async (_, id: string) => {
+    return skillRepo.findById(id);
+  });
+
+  // Custom User Skills handlers
+  const customSkillLoader = getCustomSkillLoader();
+
+  // Initialize custom skill loader
+  customSkillLoader.initialize().catch(error => {
+    console.error('[IPC] Failed to initialize custom skill loader:', error);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.CUSTOM_SKILL_LIST, async () => {
+    return customSkillLoader.listSkills();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.CUSTOM_SKILL_LIST_TASKS, async () => {
+    return customSkillLoader.listTaskSkills();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.CUSTOM_SKILL_LIST_GUIDELINES, async () => {
+    return customSkillLoader.listGuidelineSkills();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.CUSTOM_SKILL_GET, async (_, id: string) => {
+    return customSkillLoader.getSkill(id);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.CUSTOM_SKILL_CREATE, async (_, skillData: Omit<CustomSkill, 'filePath'>) => {
+    return customSkillLoader.createSkill(skillData);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.CUSTOM_SKILL_UPDATE, async (_, id: string, updates: Partial<CustomSkill>) => {
+    return customSkillLoader.updateSkill(id, updates);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.CUSTOM_SKILL_DELETE, async (_, id: string) => {
+    return customSkillLoader.deleteSkill(id);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.CUSTOM_SKILL_RELOAD, async () => {
+    return customSkillLoader.reloadSkills();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.CUSTOM_SKILL_OPEN_FOLDER, async () => {
+    return customSkillLoader.openSkillsFolder();
+  });
+
+  // Skill Registry (SkillHub) handlers
+  const { getSkillRegistry } = await import('../agent/skill-registry');
+  const skillRegistry = getSkillRegistry();
+
+  ipcMain.handle(IPC_CHANNELS.SKILL_REGISTRY_SEARCH, async (_, query: string, options?: { page?: number; pageSize?: number }) => {
+    return skillRegistry.search(query, options);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.SKILL_REGISTRY_GET_DETAILS, async (_, skillId: string) => {
+    return skillRegistry.getSkillDetails(skillId);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.SKILL_REGISTRY_INSTALL, async (_, skillId: string, version?: string) => {
+    const result = await skillRegistry.install(skillId, version);
+    if (result.success) {
+      // Reload skills to pick up the new one
+      await customSkillLoader.reloadSkills();
+      // Clear eligibility cache in case new dependencies were installed
+      customSkillLoader.clearEligibilityCache();
+    }
+    return result;
+  });
+
+  ipcMain.handle(IPC_CHANNELS.SKILL_REGISTRY_UPDATE, async (_, skillId: string, version?: string) => {
+    const result = await skillRegistry.update(skillId, version);
+    if (result.success) {
+      await customSkillLoader.reloadSkills();
+      customSkillLoader.clearEligibilityCache();
+    }
+    return result;
+  });
+
+  ipcMain.handle(IPC_CHANNELS.SKILL_REGISTRY_UPDATE_ALL, async () => {
+    const result = await skillRegistry.updateAll();
+    await customSkillLoader.reloadSkills();
+    customSkillLoader.clearEligibilityCache();
+    return result;
+  });
+
+  ipcMain.handle(IPC_CHANNELS.SKILL_REGISTRY_UNINSTALL, async (_, skillId: string) => {
+    const result = skillRegistry.uninstall(skillId);
+    if (result.success) {
+      await customSkillLoader.reloadSkills();
+    }
+    return result;
+  });
+
+  ipcMain.handle(IPC_CHANNELS.SKILL_REGISTRY_LIST_MANAGED, async () => {
+    return skillRegistry.listManagedSkills();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.SKILL_REGISTRY_CHECK_UPDATES, async (_, skillId: string) => {
+    return skillRegistry.checkForUpdates(skillId);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.SKILL_REGISTRY_GET_STATUS, async () => {
+    return customSkillLoader.getSkillStatus();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.SKILL_REGISTRY_GET_ELIGIBLE, async () => {
+    return customSkillLoader.getEligibleSkills();
+  });
+
+  // LLM Settings handlers
+  ipcMain.handle(IPC_CHANNELS.LLM_GET_SETTINGS, async () => {
+    return LLMProviderFactory.loadSettings();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.LLM_SAVE_SETTINGS, async (_, settings) => {
+    checkRateLimit(IPC_CHANNELS.LLM_SAVE_SETTINGS);
+    const validated = validateInput(LLMSettingsSchema, settings, 'LLM settings');
+
+    // Load existing settings to preserve cached models and OAuth tokens
+    const existingSettings = LLMProviderFactory.loadSettings();
+
+    // Build OpenAI settings, preserving OAuth tokens from existing settings
+    let openaiSettings = validated.openai;
+    if (existingSettings.openai?.authMethod === 'oauth') {
+      // Preserve OAuth tokens when saving settings
+      openaiSettings = {
+        ...validated.openai,
+        accessToken: existingSettings.openai.accessToken,
+        refreshToken: existingSettings.openai.refreshToken,
+        tokenExpiresAt: existingSettings.openai.tokenExpiresAt,
+        authMethod: existingSettings.openai.authMethod,
+      };
+    }
+
+    LLMProviderFactory.saveSettings({
+      providerType: validated.providerType,
+      modelKey: validated.modelKey as ModelKey,
+      anthropic: validated.anthropic,
+      bedrock: validated.bedrock,
+      ollama: validated.ollama,
+      gemini: validated.gemini,
+      openrouter: validated.openrouter,
+      openai: openaiSettings,
+      // Preserve cached models from existing settings
+      cachedGeminiModels: existingSettings.cachedGeminiModels,
+      cachedOpenRouterModels: existingSettings.cachedOpenRouterModels,
+      cachedOllamaModels: existingSettings.cachedOllamaModels,
+      cachedBedrockModels: existingSettings.cachedBedrockModels,
+      cachedOpenAIModels: existingSettings.cachedOpenAIModels,
+    });
+    // Clear cache so next task uses new settings
+    LLMProviderFactory.clearCache();
+    return { success: true };
+  });
+
+  ipcMain.handle(IPC_CHANNELS.LLM_TEST_PROVIDER, async (_, config: any) => {
+    checkRateLimit(IPC_CHANNELS.LLM_TEST_PROVIDER);
+    // For OpenAI OAuth, get tokens from stored settings if authMethod is 'oauth'
+    let openaiAccessToken: string | undefined;
+    let openaiRefreshToken: string | undefined;
+    if (config.providerType === 'openai' && config.openai?.authMethod === 'oauth') {
+      const settings = LLMProviderFactory.loadSettings();
+      openaiAccessToken = settings.openai?.accessToken;
+      openaiRefreshToken = settings.openai?.refreshToken;
+    }
+    const providerConfig: LLMProviderConfig = {
+      type: config.providerType,
+      model: LLMProviderFactory.getModelId(
+        config.modelKey as ModelKey,
+        config.providerType,
+        config.ollama?.model,
+        config.gemini?.model,
+        config.openrouter?.model,
+        config.openai?.model
+      ),
+      anthropicApiKey: config.anthropic?.apiKey,
+      awsRegion: config.bedrock?.region,
+      awsAccessKeyId: config.bedrock?.accessKeyId,
+      awsSecretAccessKey: config.bedrock?.secretAccessKey,
+      awsSessionToken: config.bedrock?.sessionToken,
+      awsProfile: config.bedrock?.profile,
+      ollamaBaseUrl: config.ollama?.baseUrl,
+      ollamaApiKey: config.ollama?.apiKey,
+      geminiApiKey: config.gemini?.apiKey,
+      openrouterApiKey: config.openrouter?.apiKey,
+      openaiApiKey: config.openai?.apiKey,
+      openaiAccessToken: openaiAccessToken,
+      openaiRefreshToken: openaiRefreshToken,
+    };
+    return LLMProviderFactory.testProvider(providerConfig);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.LLM_GET_MODELS, async () => {
+    // Get models from database
+    const dbModels = llmModelRepo.findAll();
+    return dbModels.map(m => ({
+      key: m.key,
+      displayName: m.displayName,
+      description: m.description,
+    }));
+  });
+
+  ipcMain.handle(IPC_CHANNELS.LLM_GET_CONFIG_STATUS, async () => {
+    const settings = LLMProviderFactory.loadSettings();
+    const providers = LLMProviderFactory.getAvailableProviders();
+
+    // Get models based on the current provider type
+    let models: Array<{ key: string; displayName: string; description: string }> = [];
+    let currentModel = settings.modelKey;
+
+    switch (settings.providerType) {
+      case 'anthropic':
+      case 'bedrock':
+        // Use Anthropic/Bedrock models from MODELS
+        models = Object.entries(MODELS).map(([key, value]) => ({
+          key,
+          displayName: value.displayName,
+          description: key.includes('opus') ? 'Most capable for complex work' :
+                       key.includes('sonnet') ? 'Balanced performance and speed' :
+                       'Fast and efficient',
+        }));
+        break;
+
+      case 'gemini': {
+        // For Gemini, use the specific model from settings (full model ID)
+        currentModel = settings.gemini?.model || 'gemini-2.0-flash';
+        // Use cached models if available, otherwise fall back to static list
+        const cachedGemini = LLMProviderFactory.getCachedModels('gemini');
+        if (cachedGemini && cachedGemini.length > 0) {
+          models = cachedGemini;
+        } else {
+          // Fall back to static models
+          models = Object.values(GEMINI_MODELS).map((value) => ({
+            key: value.id,
+            displayName: value.displayName,
+            description: value.description,
+          }));
+        }
+        // Ensure the currently selected model is in the list
+        if (currentModel && !models.some(m => m.key === currentModel)) {
+          models.unshift({
+            key: currentModel,
+            displayName: currentModel,
+            description: 'Selected model',
+          });
+        }
+        break;
+      }
+
+      case 'openrouter': {
+        // For OpenRouter, use the specific model from settings (full model ID)
+        currentModel = settings.openrouter?.model || 'anthropic/claude-3.5-sonnet';
+        // Use cached models if available, otherwise fall back to static list
+        const cachedOpenRouter = LLMProviderFactory.getCachedModels('openrouter');
+        if (cachedOpenRouter && cachedOpenRouter.length > 0) {
+          models = cachedOpenRouter;
+        } else {
+          // Fall back to static models
+          models = Object.values(OPENROUTER_MODELS).map((value) => ({
+            key: value.id,
+            displayName: value.displayName,
+            description: value.description,
+          }));
+        }
+        // Ensure the currently selected model is in the list
+        if (currentModel && !models.some(m => m.key === currentModel)) {
+          models.unshift({
+            key: currentModel,
+            displayName: currentModel,
+            description: 'Selected model',
+          });
+        }
+        break;
+      }
+
+      case 'ollama': {
+        // For Ollama, use the specific model from settings
+        currentModel = settings.ollama?.model || 'llama3.2';
+        // Use cached models if available, otherwise fall back to static list
+        const cachedOllama = LLMProviderFactory.getCachedModels('ollama');
+        if (cachedOllama && cachedOllama.length > 0) {
+          models = cachedOllama;
+        } else {
+          // Fall back to static models
+          models = Object.entries(OLLAMA_MODELS).map(([key, value]) => ({
+            key,
+            displayName: value.displayName,
+            description: `${value.size} parameter model`,
+          }));
+        }
+        // Ensure the currently selected model is in the list
+        if (currentModel && !models.some(m => m.key === currentModel)) {
+          models.unshift({
+            key: currentModel,
+            displayName: currentModel,
+            description: 'Selected model',
+          });
+        }
+        break;
+      }
+
+      case 'openai': {
+        // For OpenAI, use the specific model from settings
+        currentModel = settings.openai?.model || 'gpt-4o-mini';
+        // Use cached models if available, otherwise fall back to static list
+        const cachedOpenAI = LLMProviderFactory.getCachedModels('openai');
+        if (cachedOpenAI && cachedOpenAI.length > 0) {
+          models = cachedOpenAI;
+        } else {
+          // Fall back to static models
+          models = [
+            { key: 'gpt-4o', displayName: 'GPT-4o', description: 'Most capable model for complex tasks' },
+            { key: 'gpt-4o-mini', displayName: 'GPT-4o Mini', description: 'Fast and affordable for most tasks' },
+            { key: 'gpt-4-turbo', displayName: 'GPT-4 Turbo', description: 'Previous generation flagship' },
+            { key: 'gpt-3.5-turbo', displayName: 'GPT-3.5 Turbo', description: 'Fast and cost-effective' },
+            { key: 'o1', displayName: 'o1', description: 'Advanced reasoning model' },
+            { key: 'o1-mini', displayName: 'o1 Mini', description: 'Fast reasoning model' },
+          ];
+        }
+        // Ensure the currently selected model is in the list
+        if (currentModel && !models.some(m => m.key === currentModel)) {
+          models.unshift({
+            key: currentModel,
+            displayName: currentModel,
+            description: 'Selected model',
+          });
+        }
+        break;
+      }
+
+      default:
+        // Fallback to Anthropic models
+        models = Object.entries(MODELS).map(([key, value]) => ({
+          key,
+          displayName: value.displayName,
+          description: 'Claude model',
+        }));
+    }
+
+    return {
+      currentProvider: settings.providerType,
+      currentModel,
+      providers,
+      models,
+    };
+  });
+
+  // Set the current model (persists selection across sessions)
+  ipcMain.handle(IPC_CHANNELS.LLM_SET_MODEL, async (_, modelKey: string) => {
+    const settings = LLMProviderFactory.loadSettings();
+
+    // Update the model key based on the current provider
+    switch (settings.providerType) {
+      case 'gemini':
+        settings.gemini = { ...settings.gemini, model: modelKey };
+        break;
+      case 'openrouter':
+        settings.openrouter = { ...settings.openrouter, model: modelKey };
+        break;
+      case 'ollama':
+        settings.ollama = { ...settings.ollama, model: modelKey };
+        break;
+      case 'openai':
+        settings.openai = { ...settings.openai, model: modelKey };
+        break;
+      case 'anthropic':
+      case 'bedrock':
+      default:
+        // For Anthropic/Bedrock, use the modelKey field
+        settings.modelKey = modelKey as ModelKey;
+        break;
+    }
+
+    LLMProviderFactory.saveSettings(settings);
+    return { success: true };
+  });
+
+  ipcMain.handle(IPC_CHANNELS.LLM_GET_OLLAMA_MODELS, async (_, baseUrl?: string) => {
+    checkRateLimit(IPC_CHANNELS.LLM_GET_OLLAMA_MODELS);
+    console.log('[IPC] Handling LLM_GET_OLLAMA_MODELS request');
+    const models = await LLMProviderFactory.getOllamaModels(baseUrl);
+    // Cache the models for use in config status
+    const cachedModels = models.map(m => ({
+      key: m.name,
+      displayName: m.name,
+      description: `${Math.round(m.size / 1e9)}B parameter model`,
+      size: m.size,
+    }));
+    LLMProviderFactory.saveCachedModels('ollama', cachedModels);
+    return models;
+  });
+
+  ipcMain.handle(IPC_CHANNELS.LLM_GET_GEMINI_MODELS, async (_, apiKey?: string) => {
+    checkRateLimit(IPC_CHANNELS.LLM_GET_GEMINI_MODELS);
+    const models = await LLMProviderFactory.getGeminiModels(apiKey);
+    // Cache the models for use in config status
+    const cachedModels = models.map(m => ({
+      key: m.name,
+      displayName: m.displayName,
+      description: m.description,
+    }));
+    LLMProviderFactory.saveCachedModels('gemini', cachedModels);
+    return models;
+  });
+
+  ipcMain.handle(IPC_CHANNELS.LLM_GET_OPENROUTER_MODELS, async (_, apiKey?: string) => {
+    checkRateLimit(IPC_CHANNELS.LLM_GET_OPENROUTER_MODELS);
+    const models = await LLMProviderFactory.getOpenRouterModels(apiKey);
+    // Cache the models for use in config status
+    const cachedModels = models.map(m => ({
+      key: m.id,
+      displayName: m.name,
+      description: `Context: ${Math.round(m.context_length / 1000)}k tokens`,
+      contextLength: m.context_length,
+    }));
+    LLMProviderFactory.saveCachedModels('openrouter', cachedModels);
+    return models;
+  });
+
+  ipcMain.handle(IPC_CHANNELS.LLM_GET_OPENAI_MODELS, async (_, apiKey?: string) => {
+    checkRateLimit(IPC_CHANNELS.LLM_GET_OPENAI_MODELS);
+    const models = await LLMProviderFactory.getOpenAIModels(apiKey);
+    // Cache the models for use in config status
+    const cachedModels = models.map(m => ({
+      key: m.id,
+      displayName: m.name,
+      description: m.description,
+    }));
+    LLMProviderFactory.saveCachedModels('openai', cachedModels);
+    return models;
+  });
+
+  // OpenAI OAuth handlers
+  ipcMain.handle(IPC_CHANNELS.LLM_OPENAI_OAUTH_START, async () => {
+    checkRateLimit(IPC_CHANNELS.LLM_OPENAI_OAUTH_START);
+    console.log('[IPC] Starting OpenAI OAuth flow with pi-ai SDK...');
+
+    try {
+      const oauth = new OpenAIOAuth();
+      const tokens = await oauth.authenticate();
+
+      // Save tokens to settings
+      const settings = LLMProviderFactory.loadSettings();
+      settings.openai = {
+        ...settings.openai,
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token,
+        tokenExpiresAt: tokens.expires_at,
+        authMethod: 'oauth',
+        // Clear API key when using OAuth
+        apiKey: undefined,
+      };
+      LLMProviderFactory.saveSettings(settings);
+      LLMProviderFactory.clearCache();
+
+      console.log('[IPC] OpenAI OAuth successful!');
+      if (tokens.email) {
+        console.log('[IPC] Logged in as:', tokens.email);
+      }
+
+      return { success: true, email: tokens.email };
+    } catch (error: any) {
+      console.error('[IPC] OpenAI OAuth failed:', error.message);
+      return { success: false, error: error.message };
+    }
+  });
+
+  ipcMain.handle(IPC_CHANNELS.LLM_OPENAI_OAUTH_LOGOUT, async () => {
+    checkRateLimit(IPC_CHANNELS.LLM_OPENAI_OAUTH_LOGOUT);
+    console.log('[IPC] Logging out of OpenAI OAuth...');
+
+    // Clear OAuth tokens from settings
+    const settings = LLMProviderFactory.loadSettings();
+    if (settings.openai) {
+      settings.openai = {
+        ...settings.openai,
+        accessToken: undefined,
+        refreshToken: undefined,
+        tokenExpiresAt: undefined,
+        authMethod: undefined,
+      };
+      LLMProviderFactory.saveSettings(settings);
+    }
+
+    return { success: true };
+  });
+
+  ipcMain.handle(IPC_CHANNELS.LLM_GET_BEDROCK_MODELS, async (_, config?: {
+    region?: string;
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    profile?: string;
+  }) => {
+    checkRateLimit(IPC_CHANNELS.LLM_GET_BEDROCK_MODELS);
+    const models = await LLMProviderFactory.getBedrockModels(config);
+    // Cache the models for use in config status
+    const cachedModels = models.map(m => ({
+      key: m.id,
+      displayName: m.name,
+      description: m.description,
+    }));
+    LLMProviderFactory.saveCachedModels('bedrock', cachedModels);
+    return models;
+  });
+
+  // Search Settings handlers
+  ipcMain.handle(IPC_CHANNELS.SEARCH_GET_SETTINGS, async () => {
+    return SearchProviderFactory.loadSettings();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.SEARCH_SAVE_SETTINGS, async (_, settings) => {
+    checkRateLimit(IPC_CHANNELS.SEARCH_SAVE_SETTINGS);
+    const validated = validateInput(SearchSettingsSchema, settings, 'search settings');
+    SearchProviderFactory.saveSettings(validated as SearchSettings);
+    SearchProviderFactory.clearCache();
+    return { success: true };
+  });
+
+  ipcMain.handle(IPC_CHANNELS.SEARCH_GET_CONFIG_STATUS, async () => {
+    return SearchProviderFactory.getConfigStatus();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.SEARCH_TEST_PROVIDER, async (_, providerType: SearchProviderType) => {
+    checkRateLimit(IPC_CHANNELS.SEARCH_TEST_PROVIDER);
+    return SearchProviderFactory.testProvider(providerType);
+  });
+
+  // X/Twitter Settings handlers
+  ipcMain.handle(IPC_CHANNELS.X_GET_SETTINGS, async () => {
+    return XSettingsManager.loadSettings();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.X_SAVE_SETTINGS, async (_, settings) => {
+    checkRateLimit(IPC_CHANNELS.X_SAVE_SETTINGS);
+    const validated = validateInput(XSettingsSchema, settings, 'x settings') as XSettingsData;
+    XSettingsManager.saveSettings(validated);
+    XSettingsManager.clearCache();
+    return { success: true };
+  });
+
+  ipcMain.handle(IPC_CHANNELS.X_TEST_CONNECTION, async () => {
+    checkRateLimit(IPC_CHANNELS.X_TEST_CONNECTION);
+    const settings = XSettingsManager.loadSettings();
+    return testXConnection(settings);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.X_GET_STATUS, async () => {
+    checkRateLimit(IPC_CHANNELS.X_GET_STATUS);
+    const installStatus = await checkBirdInstalled();
+    if (!installStatus.installed) {
+      return { installed: false, connected: false };
+    }
+
+    const settings = XSettingsManager.loadSettings();
+    if (!settings.enabled) {
+      return { installed: true, connected: false };
+    }
+
+    const result = await testXConnection(settings);
+    return {
+      installed: true,
+      connected: result.success,
+      username: result.username,
+      error: result.success ? undefined : result.error,
+    };
+  });
+
+  // Gateway / Channel handlers
+  ipcMain.handle(IPC_CHANNELS.GATEWAY_GET_CHANNELS, async () => {
+    if (!gateway) return [];
+    return gateway.getChannels().map(ch => ({
+      id: ch.id,
+      type: ch.type,
+      name: ch.name,
+      enabled: ch.enabled,
+      status: ch.status,
+      botUsername: ch.botUsername,
+      securityMode: ch.securityConfig.mode,
+      createdAt: ch.createdAt,
+      config: ch.config,
+    }));
+  });
+
+  ipcMain.handle(IPC_CHANNELS.GATEWAY_ADD_CHANNEL, async (_, data) => {
+    checkRateLimit(IPC_CHANNELS.GATEWAY_ADD_CHANNEL);
+    if (!gateway) throw new Error('Gateway not initialized');
+
+    const validated = validateInput(AddChannelSchema, data, 'channel');
+
+    if (validated.type === 'telegram') {
+      const channel = await gateway.addTelegramChannel(
+        validated.name,
+        validated.botToken,
+        validated.securityMode || 'pairing'
+      );
+      return {
+        id: channel.id,
+        type: channel.type,
+        name: channel.name,
+        enabled: channel.enabled,
+        status: channel.status,
+        securityMode: channel.securityConfig.mode,
+        createdAt: channel.createdAt,
+      };
+    }
+
+    if (validated.type === 'discord') {
+      const channel = await gateway.addDiscordChannel(
+        validated.name,
+        validated.botToken,
+        validated.applicationId,
+        validated.guildIds,
+        validated.securityMode || 'pairing'
+      );
+      return {
+        id: channel.id,
+        type: channel.type,
+        name: channel.name,
+        enabled: channel.enabled,
+        status: channel.status,
+        securityMode: channel.securityConfig.mode,
+        createdAt: channel.createdAt,
+      };
+    }
+
+    if (validated.type === 'slack') {
+      const channel = await gateway.addSlackChannel(
+        validated.name,
+        validated.botToken,
+        validated.appToken,
+        validated.signingSecret,
+        validated.securityMode || 'pairing'
+      );
+      return {
+        id: channel.id,
+        type: channel.type,
+        name: channel.name,
+        enabled: channel.enabled,
+        status: channel.status,
+        securityMode: channel.securityConfig.mode,
+        createdAt: channel.createdAt,
+      };
+    }
+
+    if (validated.type === 'whatsapp') {
+      const channel = await gateway.addWhatsAppChannel(
+        validated.name,
+        validated.allowedNumbers,
+        validated.securityMode || 'pairing',
+        validated.selfChatMode ?? true,
+        validated.responsePrefix ?? '🤖'
+      );
+
+      // Automatically enable and connect WhatsApp to start QR code generation
+      // This is done asynchronously to not block the response
+      gateway.enableWhatsAppWithQRForwarding(channel.id).catch((err) => {
+        console.error('Failed to enable WhatsApp channel:', err);
+      });
+
+      return {
+        id: channel.id,
+        type: channel.type,
+        name: channel.name,
+        enabled: channel.enabled,
+        status: 'connecting', // Indicate we're connecting
+        securityMode: channel.securityConfig.mode,
+        createdAt: channel.createdAt,
+        config: channel.config,
+      };
+    }
+
+    if (validated.type === 'imessage') {
+      const channel = await gateway.addImessageChannel(
+        validated.name,
+        validated.cliPath,
+        validated.dbPath,
+        validated.allowedContacts,
+        validated.securityMode || 'pairing',
+        validated.dmPolicy || 'pairing',
+        validated.groupPolicy || 'allowlist'
+      );
+
+      // Automatically enable and connect iMessage
+      gateway.enableChannel(channel.id).catch((err) => {
+        console.error('Failed to enable iMessage channel:', err);
+      });
+
+      return {
+        id: channel.id,
+        type: channel.type,
+        name: channel.name,
+        enabled: channel.enabled,
+        status: 'connecting', // Indicate we're connecting
+        securityMode: channel.securityConfig.mode,
+        createdAt: channel.createdAt,
+        config: channel.config,
+      };
+    }
+
+    if (validated.type === 'signal') {
+      const channel = await gateway.addSignalChannel(
+        validated.name,
+        validated.phoneNumber,
+        validated.dataDir,
+        validated.securityMode || 'pairing',
+        validated.mode || 'native',
+        validated.trustMode || 'tofu',
+        validated.dmPolicy || 'pairing',
+        validated.groupPolicy || 'allowlist',
+        validated.sendReadReceipts ?? true,
+        validated.sendTypingIndicators ?? true
+      );
+
+      // Automatically enable and connect Signal
+      gateway.enableChannel(channel.id).catch((err) => {
+        console.error('Failed to enable Signal channel:', err);
+      });
+
+      return {
+        id: channel.id,
+        type: channel.type,
+        name: channel.name,
+        enabled: channel.enabled,
+        status: 'connecting', // Indicate we're connecting
+        securityMode: channel.securityConfig.mode,
+        createdAt: channel.createdAt,
+        config: channel.config,
+      };
+    }
+
+    if (validated.type === 'mattermost') {
+      const channel = await gateway.addMattermostChannel(
+        validated.name,
+        validated.mattermostServerUrl!,
+        validated.mattermostToken!,
+        validated.mattermostTeamId,
+        validated.securityMode || 'pairing'
+      );
+
+      // Automatically enable and connect Mattermost
+      gateway.enableChannel(channel.id).catch((err) => {
+        console.error('Failed to enable Mattermost channel:', err);
+      });
+
+      return {
+        id: channel.id,
+        type: channel.type,
+        name: channel.name,
+        enabled: channel.enabled,
+        status: 'connecting',
+        securityMode: channel.securityConfig.mode,
+        createdAt: channel.createdAt,
+        config: channel.config,
+      };
+    }
+
+    if (validated.type === 'matrix') {
+      const channel = await gateway.addMatrixChannel(
+        validated.name,
+        validated.matrixHomeserver!,
+        validated.matrixUserId!,
+        validated.matrixAccessToken!,
+        validated.matrixDeviceId,
+        validated.matrixRoomIds,
+        validated.securityMode || 'pairing'
+      );
+
+      // Automatically enable and connect Matrix
+      gateway.enableChannel(channel.id).catch((err) => {
+        console.error('Failed to enable Matrix channel:', err);
+      });
+
+      return {
+        id: channel.id,
+        type: channel.type,
+        name: channel.name,
+        enabled: channel.enabled,
+        status: 'connecting',
+        securityMode: channel.securityConfig.mode,
+        createdAt: channel.createdAt,
+        config: channel.config,
+      };
+    }
+
+    if (validated.type === 'twitch') {
+      const channel = await gateway.addTwitchChannel(
+        validated.name,
+        validated.twitchUsername!,
+        validated.twitchOauthToken!,
+        validated.twitchChannels || [],
+        validated.twitchAllowWhispers ?? false,
+        validated.securityMode || 'pairing'
+      );
+
+      // Automatically enable and connect Twitch
+      gateway.enableChannel(channel.id).catch((err) => {
+        console.error('Failed to enable Twitch channel:', err);
+      });
+
+      return {
+        id: channel.id,
+        type: channel.type,
+        name: channel.name,
+        enabled: channel.enabled,
+        status: 'connecting',
+        securityMode: channel.securityConfig.mode,
+        createdAt: channel.createdAt,
+        config: channel.config,
+      };
+    }
+
+    if (validated.type === 'line') {
+      const channel = await gateway.addLineChannel(
+        validated.name,
+        validated.lineChannelAccessToken!,
+        validated.lineChannelSecret!,
+        validated.lineWebhookPort ?? 3100,
+        validated.securityMode || 'pairing'
+      );
+
+      // Automatically enable and connect LINE
+      gateway.enableChannel(channel.id).catch((err) => {
+        console.error('Failed to enable LINE channel:', err);
+      });
+
+      return {
+        id: channel.id,
+        type: channel.type,
+        name: channel.name,
+        enabled: channel.enabled,
+        status: 'connecting',
+        securityMode: channel.securityConfig.mode,
+        createdAt: channel.createdAt,
+        config: channel.config,
+      };
+    }
+
+    if (validated.type === 'bluebubbles') {
+      const channel = await gateway.addBlueBubblesChannel(
+        validated.name,
+        validated.blueBubblesServerUrl!,
+        validated.blueBubblesPassword!,
+        validated.blueBubblesWebhookPort ?? 3101,
+        validated.blueBubblesAllowedContacts,
+        validated.securityMode || 'pairing'
+      );
+
+      // Automatically enable and connect BlueBubbles
+      gateway.enableChannel(channel.id).catch((err) => {
+        console.error('Failed to enable BlueBubbles channel:', err);
+      });
+
+      return {
+        id: channel.id,
+        type: channel.type,
+        name: channel.name,
+        enabled: channel.enabled,
+        status: 'connecting',
+        securityMode: channel.securityConfig.mode,
+        createdAt: channel.createdAt,
+        config: channel.config,
+      };
+    }
+
+    if (validated.type === 'email') {
+      const channel = await gateway.addEmailChannel(
+        validated.name,
+        validated.emailAddress!,
+        validated.emailPassword!,
+        validated.emailImapHost!,
+        validated.emailSmtpHost!,
+        validated.emailDisplayName,
+        validated.emailAllowedSenders,
+        validated.emailSubjectFilter,
+        validated.securityMode || 'pairing'
+      );
+
+      // Automatically enable and connect Email
+      gateway.enableChannel(channel.id).catch((err) => {
+        console.error('Failed to enable Email channel:', err);
+      });
+
+      return {
+        id: channel.id,
+        type: channel.type,
+        name: channel.name,
+        enabled: channel.enabled,
+        status: 'connecting',
+        securityMode: channel.securityConfig.mode,
+        createdAt: channel.createdAt,
+        config: channel.config,
+      };
+    }
+
+    // TypeScript exhaustiveness check - should never reach here due to discriminated union
+    throw new Error(`Unsupported channel type`);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.GATEWAY_UPDATE_CHANNEL, async (_, data) => {
+    if (!gateway) throw new Error('Gateway not initialized');
+
+    const validated = validateInput(UpdateChannelSchema, data, 'channel update');
+    const channel = gateway.getChannel(validated.id);
+    if (!channel) throw new Error('Channel not found');
+
+    const updates: Record<string, unknown> = {};
+    if (validated.name !== undefined) updates.name = validated.name;
+    if (validated.securityMode !== undefined) {
+      updates.securityConfig = { ...channel.securityConfig, mode: validated.securityMode };
+    }
+    if (validated.config !== undefined) {
+      updates.config = { ...channel.config, ...validated.config };
+    }
+
+    gateway.updateChannel(validated.id, updates);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.GATEWAY_REMOVE_CHANNEL, async (_, id: string) => {
+    if (!gateway) throw new Error('Gateway not initialized');
+    await gateway.removeChannel(id);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.GATEWAY_ENABLE_CHANNEL, async (_, id: string) => {
+    if (!gateway) throw new Error('Gateway not initialized');
+    await gateway.enableChannel(id);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.GATEWAY_DISABLE_CHANNEL, async (_, id: string) => {
+    if (!gateway) throw new Error('Gateway not initialized');
+    await gateway.disableChannel(id);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.GATEWAY_TEST_CHANNEL, async (_, id: string) => {
+    checkRateLimit(IPC_CHANNELS.GATEWAY_TEST_CHANNEL);
+    if (!gateway) return { success: false, error: 'Gateway not initialized' };
+    return gateway.testChannel(id);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.GATEWAY_GET_USERS, async (_, channelId: string) => {
+    if (!gateway) return [];
+    return gateway.getChannelUsers(channelId).map(u => ({
+      id: u.id,
+      channelId: u.channelId,
+      channelUserId: u.channelUserId,
+      displayName: u.displayName,
+      username: u.username,
+      allowed: u.allowed,
+      lastSeenAt: u.lastSeenAt,
+    }));
+  });
+
+  ipcMain.handle(IPC_CHANNELS.GATEWAY_GRANT_ACCESS, async (_, data) => {
+    if (!gateway) throw new Error('Gateway not initialized');
+    const validated = validateInput(GrantAccessSchema, data, 'grant access');
+    gateway.grantUserAccess(validated.channelId, validated.userId, validated.displayName);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.GATEWAY_REVOKE_ACCESS, async (_, data) => {
+    if (!gateway) throw new Error('Gateway not initialized');
+    const validated = validateInput(RevokeAccessSchema, data, 'revoke access');
+    gateway.revokeUserAccess(validated.channelId, validated.userId);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.GATEWAY_GENERATE_PAIRING, async (_, data) => {
+    if (!gateway) throw new Error('Gateway not initialized');
+    const validated = validateInput(GeneratePairingSchema, data, 'generate pairing');
+    return gateway.generatePairingCode(validated.channelId, validated.userId, validated.displayName);
+  });
+
+  // WhatsApp-specific handlers
+  ipcMain.handle('whatsapp:get-info', async () => {
+    if (!gateway) return {};
+    return gateway.getWhatsAppInfo();
+  });
+
+  ipcMain.handle('whatsapp:logout', async () => {
+    if (!gateway) throw new Error('Gateway not initialized');
+    await gateway.whatsAppLogout();
+  });
+
+  // App Update handlers
+  ipcMain.handle(IPC_CHANNELS.APP_GET_VERSION, async () => {
+    return updateManager.getVersionInfo();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.APP_CHECK_UPDATES, async () => {
+    return updateManager.checkForUpdates();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.APP_DOWNLOAD_UPDATE, async (_, updateInfo: UpdateInfo) => {
+    await updateManager.downloadAndInstallUpdate(updateInfo);
+    return { success: true };
+  });
+
+  ipcMain.handle(IPC_CHANNELS.APP_INSTALL_UPDATE, async () => {
+    await updateManager.installUpdateAndRestart();
+    return { success: true };
+  });
+
+  // Guardrail Settings handlers
+  ipcMain.handle(IPC_CHANNELS.GUARDRAIL_GET_SETTINGS, async () => {
+    return GuardrailManager.loadSettings();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.GUARDRAIL_SAVE_SETTINGS, async (_, settings) => {
+    checkRateLimit(IPC_CHANNELS.GUARDRAIL_SAVE_SETTINGS);
+    const validated = validateInput(GuardrailSettingsSchema, settings, 'guardrail settings');
+    GuardrailManager.saveSettings(validated);
+    GuardrailManager.clearCache();
+    return { success: true };
+  });
+
+  ipcMain.handle(IPC_CHANNELS.GUARDRAIL_GET_DEFAULTS, async () => {
+    return GuardrailManager.getDefaults();
+  });
+
+  // Appearance Settings handlers
+  ipcMain.handle(IPC_CHANNELS.APPEARANCE_GET_SETTINGS, async () => {
+    return AppearanceManager.loadSettings();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.APPEARANCE_SAVE_SETTINGS, async (_, settings) => {
+    AppearanceManager.saveSettings(settings);
+    return { success: true };
+  });
+
+  // Personality Settings handlers
+  // Subscribe to PersonalityManager events to broadcast changes to UI
+  // This handles both IPC changes and tool-based changes
+  PersonalityManager.onSettingsChanged((settings) => {
+    broadcastPersonalitySettingsChanged(settings);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.PERSONALITY_GET_SETTINGS, async () => {
+    return PersonalityManager.loadSettings();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.PERSONALITY_SAVE_SETTINGS, async (_, settings) => {
+    PersonalityManager.saveSettings(settings);
+    // Event emission is handled by PersonalityManager.saveSettings()
+    return { success: true };
+  });
+
+  ipcMain.handle(IPC_CHANNELS.PERSONALITY_GET_DEFINITIONS, async () => {
+    return PersonalityManager.getDefinitions();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.PERSONALITY_GET_PERSONAS, async () => {
+    return PersonalityManager.getPersonaDefinitions();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.PERSONALITY_GET_RELATIONSHIP_STATS, async () => {
+    return PersonalityManager.getRelationshipStats();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.PERSONALITY_SET_ACTIVE, async (_, personalityId) => {
+    PersonalityManager.setActivePersonality(personalityId);
+    // Event emission is handled by PersonalityManager.saveSettings()
+    return { success: true };
+  });
+
+  ipcMain.handle(IPC_CHANNELS.PERSONALITY_SET_PERSONA, async (_, personaId) => {
+    PersonalityManager.setActivePersona(personaId);
+    // Event emission is handled by PersonalityManager.saveSettings()
+    return { success: true };
+  });
+
+  ipcMain.handle(IPC_CHANNELS.PERSONALITY_RESET, async (_, preserveRelationship?: boolean) => {
+    checkRateLimit(IPC_CHANNELS.PERSONALITY_RESET);
+    PersonalityManager.resetToDefaults(preserveRelationship);
+    // Event emission is handled by PersonalityManager.resetToDefaults()
+    return { success: true };
+  });
+
+  // Agent Role / Squad handlers
+  ipcMain.handle(IPC_CHANNELS.AGENT_ROLE_LIST, async (_, includeInactive?: boolean) => {
+    return agentRoleRepo.findAll(includeInactive ?? false);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.AGENT_ROLE_GET, async (_, id: string) => {
+    const validated = validateInput(UUIDSchema, id, 'agent role ID');
+    return agentRoleRepo.findById(validated);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.AGENT_ROLE_CREATE, async (_, request) => {
+    checkRateLimit(IPC_CHANNELS.AGENT_ROLE_CREATE);
+    // Validate name format (lowercase, alphanumeric, hyphens)
+    if (!/^[a-z0-9-]+$/.test(request.name)) {
+      throw new Error('Agent role name must be lowercase alphanumeric with hyphens only');
+    }
+    // Check for duplicate name
+    if (agentRoleRepo.findByName(request.name)) {
+      throw new Error(`Agent role with name "${request.name}" already exists`);
+    }
+    return agentRoleRepo.create(request);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.AGENT_ROLE_UPDATE, async (_, request) => {
+    checkRateLimit(IPC_CHANNELS.AGENT_ROLE_UPDATE);
+    const validated = validateInput(UUIDSchema, request.id, 'agent role ID');
+    const result = agentRoleRepo.update({ ...request, id: validated });
+    if (!result) {
+      throw new Error('Agent role not found');
+    }
+    return result;
+  });
+
+  ipcMain.handle(IPC_CHANNELS.AGENT_ROLE_DELETE, async (_, id: string) => {
+    checkRateLimit(IPC_CHANNELS.AGENT_ROLE_DELETE);
+    const validated = validateInput(UUIDSchema, id, 'agent role ID');
+    const success = agentRoleRepo.delete(validated);
+    if (!success) {
+      throw new Error('Agent role not found or cannot be deleted');
+    }
+    return { success: true };
+  });
+
+  ipcMain.handle(IPC_CHANNELS.AGENT_ROLE_ASSIGN_TO_TASK, async (_, taskId: string, agentRoleId: string | null) => {
+    checkRateLimit(IPC_CHANNELS.AGENT_ROLE_ASSIGN_TO_TASK);
+    const validatedTaskId = validateInput(UUIDSchema, taskId, 'task ID');
+    if (agentRoleId !== null) {
+      const validatedRoleId = validateInput(UUIDSchema, agentRoleId, 'agent role ID');
+      const role = agentRoleRepo.findById(validatedRoleId);
+      if (!role) {
+        throw new Error('Agent role not found');
+      }
+    }
+    const taskUpdate: Partial<Task> = { assignedAgentRoleId: agentRoleId ?? undefined };
+    taskRepo.update(validatedTaskId, taskUpdate);
+    const task = taskRepo.findById(validatedTaskId);
+    if (task) {
+      if (agentRoleId) {
+        const role = agentRoleRepo.findById(agentRoleId);
+        const activity = activityRepo.create({
+          workspaceId: task.workspaceId,
+          taskId: task.id,
+          agentRoleId,
+          actorType: 'system',
+          activityType: 'agent_assigned',
+          title: `Assigned to ${role?.displayName || 'agent'}`,
+          description: task.title,
+        });
+        getMainWindow()?.webContents.send(IPC_CHANNELS.ACTIVITY_EVENT, { type: 'created', activity });
+      } else {
+        const activity = activityRepo.create({
+          workspaceId: task.workspaceId,
+          taskId: task.id,
+          actorType: 'system',
+          activityType: 'info',
+          title: 'Task unassigned',
+          description: task.title,
+        });
+        getMainWindow()?.webContents.send(IPC_CHANNELS.ACTIVITY_EVENT, { type: 'created', activity });
+      }
+    }
+    return { success: true };
+  });
+
+  ipcMain.handle(IPC_CHANNELS.AGENT_ROLE_GET_DEFAULTS, async () => {
+    const { DEFAULT_AGENT_ROLES } = await import('../../shared/types');
+    return DEFAULT_AGENT_ROLES;
+  });
+
+  ipcMain.handle(IPC_CHANNELS.AGENT_ROLE_SEED_DEFAULTS, async () => {
+    checkRateLimit(IPC_CHANNELS.AGENT_ROLE_SEED_DEFAULTS);
+    return agentRoleRepo.seedDefaults();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.AGENT_ROLE_SYNC_DEFAULTS, async () => {
+    checkRateLimit(IPC_CHANNELS.AGENT_ROLE_SYNC_DEFAULTS);
+    return agentRoleRepo.syncNewDefaults();
+  });
+
+  // Activity Feed handlers
+  ipcMain.handle(IPC_CHANNELS.ACTIVITY_LIST, async (_, query: any) => {
+    const validated = validateInput(UUIDSchema, query.workspaceId, 'workspace ID');
+    return activityRepo.list({ ...query, workspaceId: validated });
+  });
+
+  ipcMain.handle(IPC_CHANNELS.ACTIVITY_CREATE, async (_, request: any) => {
+    checkRateLimit(IPC_CHANNELS.ACTIVITY_CREATE);
+    const validatedWorkspaceId = validateInput(UUIDSchema, request.workspaceId, 'workspace ID');
+    const activity = activityRepo.create({ ...request, workspaceId: validatedWorkspaceId });
+    // Emit activity event for real-time updates
+    getMainWindow()?.webContents.send(IPC_CHANNELS.ACTIVITY_EVENT, { type: 'created', activity });
+    return activity;
+  });
+
+  ipcMain.handle(IPC_CHANNELS.ACTIVITY_MARK_READ, async (_, id: string) => {
+    checkRateLimit(IPC_CHANNELS.ACTIVITY_MARK_READ);
+    const validated = validateInput(UUIDSchema, id, 'activity ID');
+    const success = activityRepo.markRead(validated);
+    if (success) {
+      getMainWindow()?.webContents.send(IPC_CHANNELS.ACTIVITY_EVENT, { type: 'read', id: validated });
+    }
+    return { success };
+  });
+
+  ipcMain.handle(IPC_CHANNELS.ACTIVITY_MARK_ALL_READ, async (_, workspaceId: string) => {
+    checkRateLimit(IPC_CHANNELS.ACTIVITY_MARK_ALL_READ);
+    const validated = validateInput(UUIDSchema, workspaceId, 'workspace ID');
+    const count = activityRepo.markAllRead(validated);
+    getMainWindow()?.webContents.send(IPC_CHANNELS.ACTIVITY_EVENT, { type: 'all_read', workspaceId: validated });
+    return { count };
+  });
+
+  ipcMain.handle(IPC_CHANNELS.ACTIVITY_PIN, async (_, id: string) => {
+    checkRateLimit(IPC_CHANNELS.ACTIVITY_PIN);
+    const validated = validateInput(UUIDSchema, id, 'activity ID');
+    const activity = activityRepo.togglePin(validated);
+    if (activity) {
+      getMainWindow()?.webContents.send(IPC_CHANNELS.ACTIVITY_EVENT, { type: 'pinned', activity });
+    }
+    return activity;
+  });
+
+  ipcMain.handle(IPC_CHANNELS.ACTIVITY_DELETE, async (_, id: string) => {
+    checkRateLimit(IPC_CHANNELS.ACTIVITY_DELETE);
+    const validated = validateInput(UUIDSchema, id, 'activity ID');
+    const success = activityRepo.delete(validated);
+    if (success) {
+      getMainWindow()?.webContents.send(IPC_CHANNELS.ACTIVITY_EVENT, { type: 'deleted', id: validated });
+    }
+    return { success };
+  });
+
+  // @Mention handlers
+  ipcMain.handle(IPC_CHANNELS.MENTION_LIST, async (_, query: any) => {
+    return mentionRepo.list(query);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.MENTION_CREATE, async (_, request: any) => {
+    checkRateLimit(IPC_CHANNELS.MENTION_CREATE);
+    const validatedWorkspaceId = validateInput(UUIDSchema, request.workspaceId, 'workspace ID');
+    const mention = mentionRepo.create({ ...request, workspaceId: validatedWorkspaceId });
+    // Emit mention event for real-time updates
+    getMainWindow()?.webContents.send(IPC_CHANNELS.MENTION_EVENT, { type: 'created', mention });
+    // Also create an activity entry for the mention
+    const fromAgent = request.fromAgentRoleId ? agentRoleRepo.findById(request.fromAgentRoleId) : null;
+    const toAgent = agentRoleRepo.findById(request.toAgentRoleId);
+    activityRepo.create({
+      workspaceId: validatedWorkspaceId,
+      taskId: request.taskId,
+      agentRoleId: request.toAgentRoleId,
+      actorType: fromAgent ? 'agent' : 'user',
+      activityType: 'mention',
+      title: `@${toAgent?.displayName || 'Agent'} mentioned`,
+      description: request.context,
+      metadata: { mentionId: mention.id, mentionType: request.mentionType },
+    });
+    return mention;
+  });
+
+  ipcMain.handle(IPC_CHANNELS.MENTION_ACKNOWLEDGE, async (_, id: string) => {
+    checkRateLimit(IPC_CHANNELS.MENTION_ACKNOWLEDGE);
+    const validated = validateInput(UUIDSchema, id, 'mention ID');
+    const mention = mentionRepo.acknowledge(validated);
+    if (mention) {
+      getMainWindow()?.webContents.send(IPC_CHANNELS.MENTION_EVENT, { type: 'acknowledged', mention });
+    }
+    return mention;
+  });
+
+  ipcMain.handle(IPC_CHANNELS.MENTION_COMPLETE, async (_, id: string) => {
+    checkRateLimit(IPC_CHANNELS.MENTION_COMPLETE);
+    const validated = validateInput(UUIDSchema, id, 'mention ID');
+    const mention = mentionRepo.complete(validated);
+    if (mention) {
+      getMainWindow()?.webContents.send(IPC_CHANNELS.MENTION_EVENT, { type: 'completed', mention });
+    }
+    return mention;
+  });
+
+  ipcMain.handle(IPC_CHANNELS.MENTION_DISMISS, async (_, id: string) => {
+    checkRateLimit(IPC_CHANNELS.MENTION_DISMISS);
+    const validated = validateInput(UUIDSchema, id, 'mention ID');
+    const mention = mentionRepo.dismiss(validated);
+    if (mention) {
+      getMainWindow()?.webContents.send(IPC_CHANNELS.MENTION_EVENT, { type: 'dismissed', mention });
+    }
+    return mention;
+  });
+
+  // Task Board handlers
+  ipcMain.handle(IPC_CHANNELS.TASK_MOVE_COLUMN, async (_, taskId: string, column: string) => {
+    checkRateLimit(IPC_CHANNELS.TASK_MOVE_COLUMN);
+    const validatedId = validateInput(UUIDSchema, taskId, 'task ID');
+    const task = taskRepo.moveToColumn(validatedId, column);
+    if (task) {
+      getMainWindow()?.webContents.send(IPC_CHANNELS.TASK_BOARD_EVENT, { type: 'moved', task, column });
+      const columnLabels: Record<string, string> = {
+        backlog: 'Inbox',
+        todo: 'Assigned',
+        in_progress: 'In Progress',
+        review: 'Review',
+        done: 'Done',
+      };
+      const activity = activityRepo.create({
+        workspaceId: task.workspaceId,
+        taskId: task.id,
+        agentRoleId: task.assignedAgentRoleId,
+        actorType: 'system',
+        activityType: 'info',
+        title: `Moved to ${columnLabels[column] || column}`,
+        description: task.title,
+      });
+      getMainWindow()?.webContents.send(IPC_CHANNELS.ACTIVITY_EVENT, { type: 'created', activity });
+    }
+    return task;
+  });
+
+  ipcMain.handle(IPC_CHANNELS.TASK_SET_PRIORITY, async (_, taskId: string, priority: number) => {
+    checkRateLimit(IPC_CHANNELS.TASK_SET_PRIORITY);
+    const validatedId = validateInput(UUIDSchema, taskId, 'task ID');
+    const task = taskRepo.setPriority(validatedId, priority);
+    if (task) {
+      getMainWindow()?.webContents.send(IPC_CHANNELS.TASK_BOARD_EVENT, { type: 'priority_changed', task });
+    }
+    return task;
+  });
+
+  ipcMain.handle(IPC_CHANNELS.TASK_SET_DUE_DATE, async (_, taskId: string, dueDate: number | null) => {
+    checkRateLimit(IPC_CHANNELS.TASK_SET_DUE_DATE);
+    const validatedId = validateInput(UUIDSchema, taskId, 'task ID');
+    const task = taskRepo.setDueDate(validatedId, dueDate);
+    if (task) {
+      getMainWindow()?.webContents.send(IPC_CHANNELS.TASK_BOARD_EVENT, { type: 'due_date_changed', task });
+    }
+    return task;
+  });
+
+  ipcMain.handle(IPC_CHANNELS.TASK_SET_ESTIMATE, async (_, taskId: string, minutes: number | null) => {
+    checkRateLimit(IPC_CHANNELS.TASK_SET_ESTIMATE);
+    const validatedId = validateInput(UUIDSchema, taskId, 'task ID');
+    const task = taskRepo.setEstimate(validatedId, minutes);
+    if (task) {
+      getMainWindow()?.webContents.send(IPC_CHANNELS.TASK_BOARD_EVENT, { type: 'estimate_changed', task });
+    }
+    return task;
+  });
+
+  ipcMain.handle(IPC_CHANNELS.TASK_ADD_LABEL, async (_, taskId: string, labelId: string) => {
+    checkRateLimit(IPC_CHANNELS.TASK_ADD_LABEL);
+    const validatedTaskId = validateInput(UUIDSchema, taskId, 'task ID');
+    const validatedLabelId = validateInput(UUIDSchema, labelId, 'label ID');
+    const task = taskRepo.addLabel(validatedTaskId, validatedLabelId);
+    if (task) {
+      getMainWindow()?.webContents.send(IPC_CHANNELS.TASK_BOARD_EVENT, { type: 'label_added', task, labelId: validatedLabelId });
+    }
+    return task;
+  });
+
+  ipcMain.handle(IPC_CHANNELS.TASK_REMOVE_LABEL, async (_, taskId: string, labelId: string) => {
+    checkRateLimit(IPC_CHANNELS.TASK_REMOVE_LABEL);
+    const validatedTaskId = validateInput(UUIDSchema, taskId, 'task ID');
+    const validatedLabelId = validateInput(UUIDSchema, labelId, 'label ID');
+    const task = taskRepo.removeLabel(validatedTaskId, validatedLabelId);
+    if (task) {
+      getMainWindow()?.webContents.send(IPC_CHANNELS.TASK_BOARD_EVENT, { type: 'label_removed', task, labelId: validatedLabelId });
+    }
+    return task;
+  });
+
+  // Task Label handlers
+  ipcMain.handle(IPC_CHANNELS.TASK_LABEL_LIST, async (_, workspaceId: string) => {
+    const validated = validateInput(UUIDSchema, workspaceId, 'workspace ID');
+    return taskLabelRepo.list({ workspaceId: validated });
+  });
+
+  ipcMain.handle(IPC_CHANNELS.TASK_LABEL_CREATE, async (_, request: any) => {
+    checkRateLimit(IPC_CHANNELS.TASK_LABEL_CREATE);
+    const validatedWorkspaceId = validateInput(UUIDSchema, request.workspaceId, 'workspace ID');
+    return taskLabelRepo.create({ ...request, workspaceId: validatedWorkspaceId });
+  });
+
+  ipcMain.handle(IPC_CHANNELS.TASK_LABEL_UPDATE, async (_, id: string, request: any) => {
+    checkRateLimit(IPC_CHANNELS.TASK_LABEL_UPDATE);
+    const validated = validateInput(UUIDSchema, id, 'label ID');
+    return taskLabelRepo.update(validated, request);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.TASK_LABEL_DELETE, async (_, id: string) => {
+    checkRateLimit(IPC_CHANNELS.TASK_LABEL_DELETE);
+    const validated = validateInput(UUIDSchema, id, 'label ID');
+    return { success: taskLabelRepo.delete(validated) };
+  });
+
+  // Working State handlers
+  ipcMain.handle(IPC_CHANNELS.WORKING_STATE_GET, async (_, id: string) => {
+    const validated = validateInput(UUIDSchema, id, 'working state ID');
+    return workingStateRepo.findById(validated);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.WORKING_STATE_GET_CURRENT, async (_, query: any) => {
+    const validatedAgentRoleId = validateInput(UUIDSchema, query.agentRoleId, 'agent role ID');
+    const validatedWorkspaceId = validateInput(UUIDSchema, query.workspaceId, 'workspace ID');
+    return workingStateRepo.getCurrent({
+      agentRoleId: validatedAgentRoleId,
+      workspaceId: validatedWorkspaceId,
+      taskId: query.taskId,
+      stateType: query.stateType,
+    });
+  });
+
+  ipcMain.handle(IPC_CHANNELS.WORKING_STATE_UPDATE, async (_, request: any) => {
+    checkRateLimit(IPC_CHANNELS.WORKING_STATE_UPDATE);
+    const validatedAgentRoleId = validateInput(UUIDSchema, request.agentRoleId, 'agent role ID');
+    const validatedWorkspaceId = validateInput(UUIDSchema, request.workspaceId, 'workspace ID');
+    return workingStateRepo.update({
+      agentRoleId: validatedAgentRoleId,
+      workspaceId: validatedWorkspaceId,
+      taskId: request.taskId,
+      stateType: request.stateType,
+      content: request.content,
+      fileReferences: request.fileReferences,
+    });
+  });
+
+  ipcMain.handle(IPC_CHANNELS.WORKING_STATE_HISTORY, async (_, query: any) => {
+    const validatedAgentRoleId = validateInput(UUIDSchema, query.agentRoleId, 'agent role ID');
+    const validatedWorkspaceId = validateInput(UUIDSchema, query.workspaceId, 'workspace ID');
+    return workingStateRepo.getHistory({
+      agentRoleId: validatedAgentRoleId,
+      workspaceId: validatedWorkspaceId,
+      limit: query.limit,
+      offset: query.offset,
+    });
+  });
+
+  ipcMain.handle(IPC_CHANNELS.WORKING_STATE_RESTORE, async (_, id: string) => {
+    checkRateLimit(IPC_CHANNELS.WORKING_STATE_RESTORE);
+    const validated = validateInput(UUIDSchema, id, 'working state ID');
+    return workingStateRepo.restore(validated);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.WORKING_STATE_DELETE, async (_, id: string) => {
+    checkRateLimit(IPC_CHANNELS.WORKING_STATE_DELETE);
+    const validated = validateInput(UUIDSchema, id, 'working state ID');
+    return { success: workingStateRepo.delete(validated) };
+  });
+
+  ipcMain.handle(IPC_CHANNELS.WORKING_STATE_LIST_FOR_TASK, async (_, taskId: string) => {
+    const validated = validateInput(UUIDSchema, taskId, 'task ID');
+    return workingStateRepo.listForTask(validated);
+  });
+
+  // Context Policy handlers (per-context security DM vs group)
+  ipcMain.handle(IPC_CHANNELS.CONTEXT_POLICY_GET, async (_, channelId: string, contextType: string) => {
+    return contextPolicyManager.getPolicy(channelId, contextType as 'dm' | 'group');
+  });
+
+  ipcMain.handle(IPC_CHANNELS.CONTEXT_POLICY_GET_FOR_CHAT, async (_, channelId: string, chatId: string, isGroup: boolean) => {
+    return contextPolicyManager.getPolicyForChat(channelId, chatId, isGroup);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.CONTEXT_POLICY_LIST, async (_, channelId: string) => {
+    return contextPolicyManager.getPoliciesForChannel(channelId);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.CONTEXT_POLICY_UPDATE, async (_, channelId: string, contextType: string, options: { securityMode?: string; toolRestrictions?: string[] }) => {
+    checkRateLimit(IPC_CHANNELS.CONTEXT_POLICY_UPDATE);
+    return contextPolicyManager.updateByContext(
+      channelId,
+      contextType as 'dm' | 'group',
+      {
+        securityMode: options.securityMode as 'open' | 'allowlist' | 'pairing' | undefined,
+        toolRestrictions: options.toolRestrictions,
+      }
+    );
+  });
+
+  ipcMain.handle(IPC_CHANNELS.CONTEXT_POLICY_DELETE, async (_, channelId: string) => {
+    checkRateLimit(IPC_CHANNELS.CONTEXT_POLICY_DELETE);
+    return { count: contextPolicyManager.deleteByChannel(channelId) };
+  });
+
+  ipcMain.handle(IPC_CHANNELS.CONTEXT_POLICY_CREATE_DEFAULTS, async (_, channelId: string) => {
+    checkRateLimit(IPC_CHANNELS.CONTEXT_POLICY_CREATE_DEFAULTS);
+    contextPolicyManager.createDefaultPolicies(channelId);
+    return { success: true };
+  });
+
+  ipcMain.handle(IPC_CHANNELS.CONTEXT_POLICY_IS_TOOL_ALLOWED, async (_, channelId: string, contextType: string, toolName: string, toolGroups: string[]) => {
+    return { allowed: contextPolicyManager.isToolAllowed(channelId, contextType as 'dm' | 'group', toolName, toolGroups) };
+  });
+
+  // Queue handlers
+  ipcMain.handle(IPC_CHANNELS.QUEUE_GET_STATUS, async () => {
+    return agentDaemon.getQueueStatus();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.QUEUE_GET_SETTINGS, async () => {
+    return agentDaemon.getQueueSettings();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.QUEUE_SAVE_SETTINGS, async (_, settings) => {
+    checkRateLimit(IPC_CHANNELS.QUEUE_SAVE_SETTINGS);
+    agentDaemon.saveQueueSettings(settings);
+    return { success: true };
+  });
+
+  ipcMain.handle(IPC_CHANNELS.QUEUE_CLEAR, async () => {
+    checkRateLimit(IPC_CHANNELS.QUEUE_CLEAR);
+    const result = await agentDaemon.clearStuckTasks();
+    return { success: true, ...result };
+  });
+
+  // MCP handlers
+  setupMCPHandlers();
+
+  // Notification handlers
+  setupNotificationHandlers();
+
+  // Hooks (Webhooks & Gmail Pub/Sub) handlers
+  setupHooksHandlers(agentDaemon);
+
+  // Memory system handlers
+  setupMemoryHandlers();
+}
+
+/**
+ * Set up MCP (Model Context Protocol) IPC handlers
+ */
+function setupMCPHandlers(): void {
+  // Configure rate limits for MCP channels
+  rateLimiter.configure(IPC_CHANNELS.MCP_SAVE_SETTINGS, RATE_LIMIT_CONFIGS.limited);
+  rateLimiter.configure(IPC_CHANNELS.MCP_CONNECT_SERVER, RATE_LIMIT_CONFIGS.expensive);
+  rateLimiter.configure(IPC_CHANNELS.MCP_TEST_SERVER, RATE_LIMIT_CONFIGS.expensive);
+  rateLimiter.configure(IPC_CHANNELS.MCP_REGISTRY_INSTALL, RATE_LIMIT_CONFIGS.expensive);
+
+  // Initialize MCP settings manager
+  MCPSettingsManager.initialize();
+
+  // Get settings
+  ipcMain.handle(IPC_CHANNELS.MCP_GET_SETTINGS, async () => {
+    return MCPSettingsManager.getSettingsForDisplay();
+  });
+
+  // Save settings
+  ipcMain.handle(IPC_CHANNELS.MCP_SAVE_SETTINGS, async (_, settings) => {
+    checkRateLimit(IPC_CHANNELS.MCP_SAVE_SETTINGS);
+    const validated = validateInput(MCPSettingsSchema, settings, 'MCP settings') as MCPSettings;
+    MCPSettingsManager.saveSettings(validated);
+    MCPSettingsManager.clearCache();
+    return { success: true };
+  });
+
+  // Get all servers
+  ipcMain.handle(IPC_CHANNELS.MCP_GET_SERVERS, async () => {
+    const settings = MCPSettingsManager.loadSettings();
+    return settings.servers;
+  });
+
+  // Add a server
+  ipcMain.handle(IPC_CHANNELS.MCP_ADD_SERVER, async (_, serverConfig) => {
+    checkRateLimit(IPC_CHANNELS.MCP_ADD_SERVER);
+    const validated = validateInput(MCPServerConfigSchema, serverConfig, 'MCP server config');
+    const { id: _id, ...configWithoutId } = validated;
+    return MCPSettingsManager.addServer(configWithoutId as Omit<MCPServerConfig, 'id'>);
+  });
+
+  // Update a server
+  ipcMain.handle(IPC_CHANNELS.MCP_UPDATE_SERVER, async (_, serverId: string, updates) => {
+    const validatedId = validateInput(UUIDSchema, serverId, 'server ID');
+    const validatedUpdates = validateInput(MCPServerUpdateSchema, updates, 'server updates') as Partial<MCPServerConfig>;
+    return MCPSettingsManager.updateServer(validatedId, validatedUpdates);
+  });
+
+  // Remove a server
+  ipcMain.handle(IPC_CHANNELS.MCP_REMOVE_SERVER, async (_, serverId: string) => {
+    const validatedId = validateInput(UUIDSchema, serverId, 'server ID');
+
+    // Disconnect if connected
+    try {
+      await MCPClientManager.getInstance().disconnectServer(validatedId);
+    } catch {
+      // Ignore errors
+    }
+
+    return MCPSettingsManager.removeServer(validatedId);
+  });
+
+  // Connect to a server
+  ipcMain.handle(IPC_CHANNELS.MCP_CONNECT_SERVER, async (_, serverId: string) => {
+    checkRateLimit(IPC_CHANNELS.MCP_CONNECT_SERVER);
+    const validatedId = validateInput(UUIDSchema, serverId, 'server ID');
+    await MCPClientManager.getInstance().connectServer(validatedId);
+    return { success: true };
+  });
+
+  // Disconnect from a server
+  ipcMain.handle(IPC_CHANNELS.MCP_DISCONNECT_SERVER, async (_, serverId: string) => {
+    const validatedId = validateInput(UUIDSchema, serverId, 'server ID');
+    await MCPClientManager.getInstance().disconnectServer(validatedId);
+    return { success: true };
+  });
+
+  // Get status of all servers
+  ipcMain.handle(IPC_CHANNELS.MCP_GET_STATUS, async () => {
+    return MCPClientManager.getInstance().getStatus();
+  });
+
+  // Get tools from a specific server
+  ipcMain.handle(IPC_CHANNELS.MCP_GET_SERVER_TOOLS, async (_, serverId: string) => {
+    const validatedId = validateInput(UUIDSchema, serverId, 'server ID');
+    return MCPClientManager.getInstance().getServerTools(validatedId);
+  });
+
+  // Test server connection
+  ipcMain.handle(IPC_CHANNELS.MCP_TEST_SERVER, async (_, serverId: string) => {
+    checkRateLimit(IPC_CHANNELS.MCP_TEST_SERVER);
+    const validatedId = validateInput(UUIDSchema, serverId, 'server ID');
+    return MCPClientManager.getInstance().testServer(validatedId);
+  });
+
+  // MCP Registry handlers
+  ipcMain.handle(IPC_CHANNELS.MCP_REGISTRY_FETCH, async () => {
+    const registry = await MCPRegistryManager.fetchRegistry();
+    const categories = await MCPRegistryManager.getCategories();
+    const featured = registry.servers.filter(s => s.featured);
+    return { ...registry, categories, featured };
+  });
+
+  ipcMain.handle(IPC_CHANNELS.MCP_REGISTRY_SEARCH, async (_, options) => {
+    const validatedOptions = validateInput(MCPRegistrySearchSchema, options, 'registry search options');
+    return MCPRegistryManager.searchServers(validatedOptions);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.MCP_REGISTRY_INSTALL, async (_, entryId: string) => {
+    checkRateLimit(IPC_CHANNELS.MCP_REGISTRY_INSTALL);
+    const validatedId = validateInput(StringIdSchema, entryId, 'registry entry ID');
+    return MCPRegistryManager.installServer(validatedId);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.MCP_REGISTRY_UNINSTALL, async (_, serverId: string) => {
+    const validatedId = validateInput(UUIDSchema, serverId, 'server ID');
+
+    // Disconnect if connected
+    try {
+      await MCPClientManager.getInstance().disconnectServer(validatedId);
+    } catch {
+      // Ignore errors
+    }
+
+    await MCPRegistryManager.uninstallServer(validatedId);
+  });
+
+  ipcMain.handle(IPC_CHANNELS.MCP_REGISTRY_CHECK_UPDATES, async () => {
+    return MCPRegistryManager.checkForUpdates();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.MCP_REGISTRY_UPDATE_SERVER, async (_, serverId: string) => {
+    const validatedId = validateInput(UUIDSchema, serverId, 'server ID');
+    return MCPRegistryManager.updateServer(validatedId);
+  });
+
+  // MCP Host handlers
+  ipcMain.handle(IPC_CHANNELS.MCP_HOST_START, async () => {
+    const hostServer = MCPHostServer.getInstance();
+
+    // If no tool provider is set, create a minimal one that exposes MCP tools
+    // from connected servers (useful for tool aggregation/forwarding)
+    if (!hostServer.hasToolProvider()) {
+      const mcpClientManager = MCPClientManager.getInstance();
+
+      // Create a minimal tool provider that exposes MCP tools
+      hostServer.setToolProvider({
+        getTools() {
+          return mcpClientManager.getAllTools();
+        },
+        async executeTool(name: string, args: Record<string, any>) {
+          return mcpClientManager.callTool(name, args);
+        },
+      });
+    }
+
+    await hostServer.startStdio();
+    return { success: true };
+  });
+
+  ipcMain.handle(IPC_CHANNELS.MCP_HOST_STOP, async () => {
+    const hostServer = MCPHostServer.getInstance();
+    await hostServer.stop();
+    return { success: true };
+  });
+
+  ipcMain.handle(IPC_CHANNELS.MCP_HOST_GET_STATUS, async () => {
+    const hostServer = MCPHostServer.getInstance();
+    return {
+      running: hostServer.isRunning(),
+      toolCount: hostServer.hasToolProvider() ? MCPClientManager.getInstance().getAllTools().length : 0,
+    };
+  });
+
+  // =====================
+  // Built-in Tools Settings Handlers
+  // =====================
+
+  ipcMain.handle(IPC_CHANNELS.BUILTIN_TOOLS_GET_SETTINGS, async () => {
+    return BuiltinToolsSettingsManager.loadSettings();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.BUILTIN_TOOLS_SAVE_SETTINGS, async (_, settings) => {
+    BuiltinToolsSettingsManager.saveSettings(settings);
+    BuiltinToolsSettingsManager.clearCache(); // Clear cache to force reload
+    return { success: true };
+  });
+
+  ipcMain.handle(IPC_CHANNELS.BUILTIN_TOOLS_GET_CATEGORIES, async () => {
+    return BuiltinToolsSettingsManager.getToolsByCategory();
+  });
+
+  // =====================
+  // Tray (Menu Bar) Handlers
+  // =====================
+
+  ipcMain.handle(IPC_CHANNELS.TRAY_GET_SETTINGS, async () => {
+    // Import trayManager lazily to avoid circular dependencies
+    const { trayManager } = await import('../tray');
+    return trayManager.getSettings();
+  });
+
+  ipcMain.handle(IPC_CHANNELS.TRAY_SAVE_SETTINGS, async (_, settings) => {
+    const { trayManager } = await import('../tray');
+    trayManager.saveSettings(settings);
+    return { success: true };
+  });
+
+  // =====================
+  // Cron (Scheduled Tasks) Handlers
+  // =====================
+  setupCronHandlers();
+}
+
+/**
+ * Set up Cron (Scheduled Tasks) IPC handlers
+ */
+function setupCronHandlers(): void {
+  const { getCronService } = require('../cron');
+
+  // Get service status
+  ipcMain.handle(IPC_CHANNELS.CRON_GET_STATUS, async () => {
+    const service = getCronService();
+    if (!service) {
+      return {
+        enabled: false,
+        storePath: '',
+        jobCount: 0,
+        enabledJobCount: 0,
+        nextWakeAtMs: null,
+      };
+    }
+    return service.status();
+  });
+
+  // List all jobs
+  ipcMain.handle(IPC_CHANNELS.CRON_LIST_JOBS, async (_, opts?: { includeDisabled?: boolean }) => {
+    const service = getCronService();
+    if (!service) return [];
+    return service.list(opts);
+  });
+
+  // Get a single job
+  ipcMain.handle(IPC_CHANNELS.CRON_GET_JOB, async (_, id: string) => {
+    const service = getCronService();
+    if (!service) return null;
+    return service.get(id);
+  });
+
+  // Add a new job
+  ipcMain.handle(IPC_CHANNELS.CRON_ADD_JOB, async (_, jobData) => {
+    const service = getCronService();
+    if (!service) {
+      return { ok: false, error: 'Cron service not initialized' };
+    }
+    return service.add(jobData);
+  });
+
+  // Update an existing job
+  ipcMain.handle(IPC_CHANNELS.CRON_UPDATE_JOB, async (_, id: string, patch) => {
+    const service = getCronService();
+    if (!service) {
+      return { ok: false, error: 'Cron service not initialized' };
+    }
+    return service.update(id, patch);
+  });
+
+  // Remove a job
+  ipcMain.handle(IPC_CHANNELS.CRON_REMOVE_JOB, async (_, id: string) => {
+    const service = getCronService();
+    if (!service) {
+      return { ok: false, removed: false, error: 'Cron service not initialized' };
+    }
+    return service.remove(id);
+  });
+
+  // Run a job immediately
+  ipcMain.handle(IPC_CHANNELS.CRON_RUN_JOB, async (_, id: string, mode?: 'due' | 'force') => {
+    const service = getCronService();
+    if (!service) {
+      return { ok: false, error: 'Cron service not initialized' };
+    }
+    return service.run(id, mode);
+  });
+
+  // Get run history for a job
+  ipcMain.handle('cron:getRunHistory', async (_, id: string) => {
+    const service = getCronService();
+    if (!service) return null;
+    return service.getRunHistory(id);
+  });
+
+  // Clear run history for a job
+  ipcMain.handle('cron:clearRunHistory', async (_, id: string) => {
+    const service = getCronService();
+    if (!service) return false;
+    return service.clearRunHistory(id);
+  });
+
+  // Get webhook status
+  ipcMain.handle('cron:getWebhookStatus', async () => {
+    const service = getCronService();
+    if (!service) return { enabled: false };
+    const status = await service.status();
+    return status.webhook ?? { enabled: false };
+  });
+}
+
+/**
+ * Set up Notification IPC handlers
+ */
+function setupNotificationHandlers(): void {
+  // Initialize notification service with event forwarding to main window
+  notificationService = new NotificationService({
+    onEvent: (event) => {
+      // Forward notification events to renderer
+      // We need to import BrowserWindow from electron to send to all windows
+      const { BrowserWindow } = require('electron');
+      const windows = BrowserWindow.getAllWindows();
+      for (const win of windows) {
+        if (win.webContents) {
+          win.webContents.send(IPC_CHANNELS.NOTIFICATION_EVENT, event);
+        }
+      }
+    },
+  });
+
+  console.log('[Notifications] Service initialized');
+
+  // List all notifications
+  ipcMain.handle(IPC_CHANNELS.NOTIFICATION_LIST, async () => {
+    if (!notificationService) return [];
+    return notificationService.list();
+  });
+
+  // Get unread count
+  ipcMain.handle('notification:unreadCount', async () => {
+    if (!notificationService) return 0;
+    return notificationService.getUnreadCount();
+  });
+
+  // Mark notification as read
+  ipcMain.handle(IPC_CHANNELS.NOTIFICATION_MARK_READ, async (_, id: string) => {
+    if (!notificationService) return null;
+    return notificationService.markRead(id);
+  });
+
+  // Mark all notifications as read
+  ipcMain.handle(IPC_CHANNELS.NOTIFICATION_MARK_ALL_READ, async () => {
+    if (!notificationService) return;
+    await notificationService.markAllRead();
+  });
+
+  // Delete a notification
+  ipcMain.handle(IPC_CHANNELS.NOTIFICATION_DELETE, async (_, id: string) => {
+    if (!notificationService) return false;
+    return notificationService.delete(id);
+  });
+
+  // Delete all notifications
+  ipcMain.handle(IPC_CHANNELS.NOTIFICATION_DELETE_ALL, async () => {
+    if (!notificationService) return;
+    await notificationService.deleteAll();
+  });
+
+  // Add a notification (internal use, for programmatic notifications)
+  ipcMain.handle(IPC_CHANNELS.NOTIFICATION_ADD, async (_, data: {
+    type: NotificationType;
+    title: string;
+    message: string;
+    taskId?: string;
+    cronJobId?: string;
+    workspaceId?: string;
+  }) => {
+    if (!notificationService) return null;
+    return notificationService.add(data);
+  });
+}
+
+// Global hooks server instance
+let hooksServer: HooksServer | null = null;
+let hooksServerStarting = false; // Lock to prevent concurrent server creation
+
+/**
+ * Get the hooks server instance
+ */
+export function getHooksServer(): HooksServer | null {
+  return hooksServer;
+}
+
+/**
+ * Set up Hooks (Webhooks & Gmail Pub/Sub) IPC handlers
+ */
+function setupHooksHandlers(agentDaemon: AgentDaemon): void {
+  // Initialize settings manager
+  HooksSettingsManager.initialize();
+
+  // Get hooks settings
+  ipcMain.handle(IPC_CHANNELS.HOOKS_GET_SETTINGS, async (): Promise<HooksSettingsData> => {
+    const settings = HooksSettingsManager.getSettingsForDisplay();
+    return {
+      enabled: settings.enabled,
+      token: settings.token,
+      path: settings.path,
+      maxBodyBytes: settings.maxBodyBytes,
+      port: DEFAULT_HOOKS_PORT,
+      host: '127.0.0.1',
+      presets: settings.presets,
+      mappings: settings.mappings as HookMappingData[],
+      gmail: settings.gmail as GmailHooksSettingsData | undefined,
+    };
+  });
+
+  // Save hooks settings
+  ipcMain.handle(IPC_CHANNELS.HOOKS_SAVE_SETTINGS, async (_, data: Partial<HooksSettingsData>) => {
+    checkRateLimit(IPC_CHANNELS.HOOKS_SAVE_SETTINGS, RATE_LIMIT_CONFIGS.limited);
+
+    const currentSettings = HooksSettingsManager.loadSettings();
+    const updated = HooksSettingsManager.updateConfig({
+      ...currentSettings,
+      enabled: data.enabled ?? currentSettings.enabled,
+      token: data.token ?? currentSettings.token,
+      path: data.path ?? currentSettings.path,
+      maxBodyBytes: data.maxBodyBytes ?? currentSettings.maxBodyBytes,
+      presets: data.presets ?? currentSettings.presets,
+      mappings: data.mappings ?? currentSettings.mappings,
+      gmail: data.gmail ?? currentSettings.gmail,
+    });
+
+    // Restart hooks server if needed
+    if (hooksServer && updated.enabled) {
+      hooksServer.setHooksConfig(updated);
+    }
+
+    return {
+      enabled: updated.enabled,
+      token: updated.token ? '***configured***' : '',
+      path: updated.path,
+      maxBodyBytes: updated.maxBodyBytes,
+      port: DEFAULT_HOOKS_PORT,
+      host: '127.0.0.1',
+      presets: updated.presets,
+      mappings: updated.mappings as HookMappingData[],
+      gmail: updated.gmail as GmailHooksSettingsData | undefined,
+    };
+  });
+
+  // Enable hooks
+  ipcMain.handle(IPC_CHANNELS.HOOKS_ENABLE, async () => {
+    checkRateLimit(IPC_CHANNELS.HOOKS_ENABLE, RATE_LIMIT_CONFIGS.limited);
+
+    // Prevent concurrent enable attempts
+    if (hooksServerStarting) {
+      throw new Error('Hooks server is already starting. Please wait.');
+    }
+
+    const settings = HooksSettingsManager.enableHooks();
+
+    // Start the hooks server if not running
+    if (!hooksServer) {
+      hooksServerStarting = true;
+
+      const server = new HooksServer({
+        port: DEFAULT_HOOKS_PORT,
+        host: '127.0.0.1',
+        enabled: true,
+      });
+
+      server.setHooksConfig(settings);
+
+      // Set up handlers for hook actions
+      server.setHandlers({
+        onWake: async (action) => {
+          console.log('[Hooks] Wake action:', action);
+          // For now, just log. In the future, this could trigger a heartbeat
+        },
+        onAgent: async (action) => {
+          console.log('[Hooks] Agent action:', action.message.substring(0, 100));
+
+          // Create a task for the agent action
+          const task = await agentDaemon.createTask({
+            title: action.name || 'Webhook Task',
+            prompt: action.message,
+            workspaceId: action.workspaceId || TEMP_WORKSPACE_ID,
+          });
+
+          return { taskId: task.id };
+        },
+        onEvent: (event) => {
+          console.log('[Hooks] Server event:', event.action);
+          // Forward events to renderer (with error handling for destroyed windows)
+          const windows = BrowserWindow.getAllWindows();
+          for (const win of windows) {
+            try {
+              if (win.webContents && !win.isDestroyed()) {
+                win.webContents.send(IPC_CHANNELS.HOOKS_EVENT, event);
+              }
+            } catch (err) {
+              // Window may have been destroyed between check and send
+              console.warn('[Hooks] Failed to send event to window:', err);
+            }
+          }
+        },
+      });
+
+      try {
+        await server.start();
+        hooksServer = server;
+      } catch (err) {
+        console.error('[Hooks] Failed to start hooks server:', err);
+        throw new Error(`Failed to start hooks server: ${err instanceof Error ? err.message : String(err)}`);
+      } finally {
+        hooksServerStarting = false;
+      }
+    }
+
+    // Start Gmail watcher if configured (capture result for response)
+    let gmailWatcherError: string | undefined;
+    if (settings.gmail?.account) {
+      try {
+        const result = await startGmailWatcher(settings);
+        if (!result.started) {
+          gmailWatcherError = result.reason;
+          console.warn('[Hooks] Gmail watcher not started:', result.reason);
+        }
+      } catch (err) {
+        gmailWatcherError = err instanceof Error ? err.message : String(err);
+        console.error('[Hooks] Failed to start Gmail watcher:', err);
+      }
+    }
+
+    return { enabled: true, gmailWatcherError };
+  });
+
+  // Disable hooks
+  ipcMain.handle(IPC_CHANNELS.HOOKS_DISABLE, async () => {
+    checkRateLimit(IPC_CHANNELS.HOOKS_DISABLE, RATE_LIMIT_CONFIGS.limited);
+
+    HooksSettingsManager.disableHooks();
+
+    // Stop the hooks server
+    if (hooksServer) {
+      await hooksServer.stop();
+      hooksServer = null;
+    }
+
+    // Stop Gmail watcher
+    await stopGmailWatcher();
+
+    return { enabled: false };
+  });
+
+  // Regenerate hook token
+  ipcMain.handle(IPC_CHANNELS.HOOKS_REGENERATE_TOKEN, async () => {
+    checkRateLimit(IPC_CHANNELS.HOOKS_REGENERATE_TOKEN, RATE_LIMIT_CONFIGS.limited);
+    const newToken = HooksSettingsManager.regenerateToken();
+
+    // Update the running server with new token
+    if (hooksServer) {
+      const settings = HooksSettingsManager.loadSettings();
+      hooksServer.setHooksConfig(settings);
+    }
+
+    return { token: newToken };
+  });
+
+  // Get hooks status
+  ipcMain.handle(IPC_CHANNELS.HOOKS_GET_STATUS, async (): Promise<HooksStatus> => {
+    const settings = HooksSettingsManager.loadSettings();
+    const gogAvailable = await isGogAvailable();
+
+    return {
+      enabled: settings.enabled,
+      serverRunning: hooksServer?.isRunning() ?? false,
+      serverAddress: hooksServer?.getAddress() ?? undefined,
+      gmailWatcherRunning: isGmailWatcherRunning(),
+      gmailAccount: settings.gmail?.account,
+      gogAvailable,
+    };
+  });
+
+  // Add a hook mapping
+  ipcMain.handle(IPC_CHANNELS.HOOKS_ADD_MAPPING, async (_, mapping: HookMappingData) => {
+    checkRateLimit(IPC_CHANNELS.HOOKS_ADD_MAPPING, RATE_LIMIT_CONFIGS.limited);
+
+    // Validate the mapping input
+    const validated = validateInput(HookMappingSchema, mapping, 'hook mapping');
+
+    const settings = HooksSettingsManager.addMapping(validated);
+
+    // Update the server config if running
+    if (hooksServer) {
+      hooksServer.setHooksConfig(settings);
+    }
+
+    return { ok: true };
+  });
+
+  // Remove a hook mapping
+  ipcMain.handle(IPC_CHANNELS.HOOKS_REMOVE_MAPPING, async (_, id: string) => {
+    checkRateLimit(IPC_CHANNELS.HOOKS_REMOVE_MAPPING, RATE_LIMIT_CONFIGS.limited);
+
+    // Validate the mapping ID
+    const validatedId = validateInput(StringIdSchema, id, 'mapping ID');
+
+    const settings = HooksSettingsManager.removeMapping(validatedId);
+
+    // Update the server config if running
+    if (hooksServer) {
+      hooksServer.setHooksConfig(settings);
+    }
+
+    return { ok: true };
+  });
+
+  // Configure Gmail hooks
+  ipcMain.handle(IPC_CHANNELS.HOOKS_CONFIGURE_GMAIL, async (_, config: GmailHooksSettingsData) => {
+    checkRateLimit(IPC_CHANNELS.HOOKS_CONFIGURE_GMAIL, RATE_LIMIT_CONFIGS.limited);
+
+    // Generate push token if not provided
+    if (!config.pushToken) {
+      config.pushToken = generateHookToken();
+    }
+
+    const settings = HooksSettingsManager.configureGmail(config);
+
+    // Update the server config if running
+    if (hooksServer) {
+      hooksServer.setHooksConfig(settings);
+    }
+
+    return {
+      ok: true,
+      gmail: HooksSettingsManager.getGmailConfig(),
+    };
+  });
+
+  // Get Gmail watcher status
+  ipcMain.handle(IPC_CHANNELS.HOOKS_GET_GMAIL_STATUS, async () => {
+    const settings = HooksSettingsManager.loadSettings();
+    const gogAvailable = await isGogAvailable();
+
+    return {
+      configured: HooksSettingsManager.isGmailConfigured(),
+      running: isGmailWatcherRunning(),
+      account: settings.gmail?.account,
+      topic: settings.gmail?.topic,
+      gogAvailable,
+    };
+  });
+
+  // Start Gmail watcher manually
+  ipcMain.handle(IPC_CHANNELS.HOOKS_START_GMAIL_WATCHER, async () => {
+    checkRateLimit(IPC_CHANNELS.HOOKS_START_GMAIL_WATCHER, RATE_LIMIT_CONFIGS.expensive);
+
+    const settings = HooksSettingsManager.loadSettings();
+    if (!settings.enabled) {
+      return { ok: false, error: 'Hooks must be enabled first' };
+    }
+
+    if (!HooksSettingsManager.isGmailConfigured()) {
+      return { ok: false, error: 'Gmail hooks not configured' };
+    }
+
+    const result = await startGmailWatcher(settings);
+    return { ok: result.started, error: result.reason };
+  });
+
+  // Stop Gmail watcher manually
+  ipcMain.handle(IPC_CHANNELS.HOOKS_STOP_GMAIL_WATCHER, async () => {
+    checkRateLimit(IPC_CHANNELS.HOOKS_STOP_GMAIL_WATCHER, RATE_LIMIT_CONFIGS.limited);
+    await stopGmailWatcher();
+    return { ok: true };
+  });
+
+  console.log('[Hooks] IPC handlers initialized');
+}
+
+/**
+ * Broadcast personality settings changed event to all renderer windows.
+ * This allows the UI to stay in sync when settings are changed via tools.
+ */
+function broadcastPersonalitySettingsChanged(settings: any): void {
+  try {
+    const windows = BrowserWindow.getAllWindows();
+    for (const win of windows) {
+      try {
+        if (win.webContents && !win.isDestroyed()) {
+          win.webContents.send(IPC_CHANNELS.PERSONALITY_SETTINGS_CHANGED, settings);
+        }
+      } catch (err) {
+        // Window may have been destroyed between check and send
+        console.warn('[Personality] Failed to send settings changed event to window:', err);
+      }
+    }
+  } catch (err) {
+    console.error('[Personality] Failed to broadcast settings changed:', err);
+  }
+}
+
+/**
+ * Set up Memory System IPC handlers
+ */
+function setupMemoryHandlers(): void {
+  // Get memory settings for a workspace
+  ipcMain.handle(IPC_CHANNELS.MEMORY_GET_SETTINGS, async (_, workspaceId: string) => {
+    try {
+      return MemoryService.getSettings(workspaceId);
+    } catch (error) {
+      console.error('[Memory] Failed to get settings:', error);
+      // Return default settings if service not initialized
+      return {
+        workspaceId,
+        enabled: true,
+        autoCapture: true,
+        compressionEnabled: true,
+        retentionDays: 90,
+        maxStorageMb: 100,
+        privacyMode: 'normal',
+        excludedPatterns: [],
+      };
+    }
+  });
+
+  // Save memory settings for a workspace
+  ipcMain.handle(
+    IPC_CHANNELS.MEMORY_SAVE_SETTINGS,
+    async (_, data: { workspaceId: string; settings: Partial<MemorySettings> }) => {
+      checkRateLimit(IPC_CHANNELS.MEMORY_SAVE_SETTINGS, RATE_LIMIT_CONFIGS.limited);
+      try {
+        MemoryService.updateSettings(data.workspaceId, data.settings);
+        return { success: true };
+      } catch (error) {
+        console.error('[Memory] Failed to save settings:', error);
+        throw error;
+      }
+    }
+  );
+
+  // Search memories
+  ipcMain.handle(
+    IPC_CHANNELS.MEMORY_SEARCH,
+    async (_, data: { workspaceId: string; query: string; limit?: number }) => {
+      try {
+        return MemoryService.search(data.workspaceId, data.query, data.limit);
+      } catch (error) {
+        console.error('[Memory] Failed to search:', error);
+        return [];
+      }
+    }
+  );
+
+  // Get timeline context (Layer 2)
+  ipcMain.handle(
+    IPC_CHANNELS.MEMORY_GET_TIMELINE,
+    async (_, data: { memoryId: string; windowSize?: number }) => {
+      try {
+        return MemoryService.getTimelineContext(data.memoryId, data.windowSize);
+      } catch (error) {
+        console.error('[Memory] Failed to get timeline:', error);
+        return [];
+      }
+    }
+  );
+
+  // Get full details (Layer 3)
+  ipcMain.handle(IPC_CHANNELS.MEMORY_GET_DETAILS, async (_, ids: string[]) => {
+    try {
+      return MemoryService.getFullDetails(ids);
+    } catch (error) {
+      console.error('[Memory] Failed to get details:', error);
+      return [];
+    }
+  });
+
+  // Get recent memories
+  ipcMain.handle(
+    IPC_CHANNELS.MEMORY_GET_RECENT,
+    async (_, data: { workspaceId: string; limit?: number }) => {
+      try {
+        return MemoryService.getRecent(data.workspaceId, data.limit);
+      } catch (error) {
+        console.error('[Memory] Failed to get recent:', error);
+        return [];
+      }
+    }
+  );
+
+  // Get memory statistics
+  ipcMain.handle(IPC_CHANNELS.MEMORY_GET_STATS, async (_, workspaceId: string) => {
+    try {
+      return MemoryService.getStats(workspaceId);
+    } catch (error) {
+      console.error('[Memory] Failed to get stats:', error);
+      return { count: 0, totalTokens: 0, compressedCount: 0, compressionRatio: 0 };
+    }
+  });
+
+  // Clear all memories for a workspace
+  ipcMain.handle(IPC_CHANNELS.MEMORY_CLEAR, async (_, workspaceId: string) => {
+    checkRateLimit(IPC_CHANNELS.MEMORY_CLEAR, RATE_LIMIT_CONFIGS.limited);
+    try {
+      MemoryService.clearWorkspace(workspaceId);
+      return { success: true };
+    } catch (error) {
+      console.error('[Memory] Failed to clear:', error);
+      throw error;
+    }
+  });
+
+  console.log('[Memory] Handlers initialized');
+
+  // === Migration Status Handlers ===
+  // These handlers help show one-time notifications after app migration (cowork-oss → cowork-os)
+
+  const userDataPath = app.getPath('userData');
+  const migrationMarkerPath = path.join(userDataPath, '.migrated-from-cowork-oss');
+  const notificationDismissedPath = path.join(userDataPath, '.migration-notification-dismissed');
+
+  // Get migration status
+  ipcMain.handle(IPC_CHANNELS.MIGRATION_GET_STATUS, async () => {
+    try {
+      const migrated = fsSync.existsSync(migrationMarkerPath);
+      const notificationDismissed = fsSync.existsSync(notificationDismissedPath);
+
+      let timestamp: string | undefined;
+      if (migrated) {
+        try {
+          const markerContent = fsSync.readFileSync(migrationMarkerPath, 'utf-8');
+          const markerData = JSON.parse(markerContent);
+          timestamp = markerData.timestamp;
+        } catch {
+          // Old format marker or read error
+        }
+      }
+
+      return {
+        migrated,
+        notificationDismissed,
+        timestamp,
+      };
+    } catch (error) {
+      console.error('[Migration] Failed to get status:', error);
+      return { migrated: false, notificationDismissed: true }; // Default to no notification on error
+    }
+  });
+
+  // Dismiss migration notification (user has acknowledged it)
+  ipcMain.handle(IPC_CHANNELS.MIGRATION_DISMISS_NOTIFICATION, async () => {
+    try {
+      fsSync.writeFileSync(notificationDismissedPath, JSON.stringify({
+        dismissedAt: new Date().toISOString(),
+      }));
+      console.log('[Migration] Notification dismissed');
+      return { success: true };
+    } catch (error) {
+      console.error('[Migration] Failed to dismiss notification:', error);
+      throw error;
+    }
+  });
+
+  console.log('[Migration] Handlers initialized');
+
+  // === Extension / Plugin Handlers ===
+  // eslint-disable-next-line @typescript-eslint/no-var-requires
+  const { getPluginRegistry } = require('../extensions/registry');
+
+  // List all extensions
+  ipcMain.handle(IPC_CHANNELS.EXTENSIONS_LIST, async () => {
+    try {
+      const registry = getPluginRegistry();
+      const plugins = registry.getPlugins();
+      return plugins.map((p: any) => ({
+        name: p.manifest.name,
+        displayName: p.manifest.displayName,
+        version: p.manifest.version,
+        description: p.manifest.description,
+        author: p.manifest.author,
+        type: p.manifest.type,
+        state: p.state,
+        path: p.path,
+        loadedAt: p.loadedAt.getTime(),
+        error: p.error?.message,
+        capabilities: p.manifest.capabilities,
+        configSchema: p.manifest.configSchema,
+      }));
+    } catch (error) {
+      console.error('[Extensions] Failed to list:', error);
+      return [];
+    }
+  });
+
+  // Get single extension
+  ipcMain.handle(IPC_CHANNELS.EXTENSIONS_GET, async (_, name: string) => {
+    try {
+      const registry = getPluginRegistry();
+      const plugin = registry.getPlugin(name);
+      if (!plugin) return null;
+      return {
+        name: plugin.manifest.name,
+        displayName: plugin.manifest.displayName,
+        version: plugin.manifest.version,
+        description: plugin.manifest.description,
+        author: plugin.manifest.author,
+        type: plugin.manifest.type,
+        state: plugin.state,
+        path: plugin.path,
+        loadedAt: plugin.loadedAt.getTime(),
+        error: plugin.error?.message,
+        capabilities: plugin.manifest.capabilities,
+        configSchema: plugin.manifest.configSchema,
+      };
+    } catch (error) {
+      console.error('[Extensions] Failed to get:', error);
+      return null;
+    }
+  });
+
+  // Enable extension
+  ipcMain.handle(IPC_CHANNELS.EXTENSIONS_ENABLE, async (_, name: string) => {
+    try {
+      const registry = getPluginRegistry();
+      await registry.enablePlugin(name);
+      return { success: true };
+    } catch (error: any) {
+      console.error('[Extensions] Failed to enable:', error);
+      return { success: false, error: error.message };
+    }
+  });
+
+  // Disable extension
+  ipcMain.handle(IPC_CHANNELS.EXTENSIONS_DISABLE, async (_, name: string) => {
+    try {
+      const registry = getPluginRegistry();
+      await registry.disablePlugin(name);
+      return { success: true };
+    } catch (error: any) {
+      console.error('[Extensions] Failed to disable:', error);
+      return { success: false, error: error.message };
+    }
+  });
+
+  // Reload extension
+  ipcMain.handle(IPC_CHANNELS.EXTENSIONS_RELOAD, async (_, name: string) => {
+    try {
+      const registry = getPluginRegistry();
+      await registry.reloadPlugin(name);
+      return { success: true };
+    } catch (error: any) {
+      console.error('[Extensions] Failed to reload:', error);
+      return { success: false, error: error.message };
+    }
+  });
+
+  // Get extension config
+  ipcMain.handle(IPC_CHANNELS.EXTENSIONS_GET_CONFIG, async (_, name: string) => {
+    try {
+      const registry = getPluginRegistry();
+      return registry.getPluginConfig(name) || {};
+    } catch (error) {
+      console.error('[Extensions] Failed to get config:', error);
+      return {};
+    }
+  });
+
+  // Set extension config
+  ipcMain.handle(IPC_CHANNELS.EXTENSIONS_SET_CONFIG, async (_, data: { name: string; config: Record<string, unknown> }) => {
+    try {
+      const registry = getPluginRegistry();
+      await registry.setPluginConfig(data.name, data.config);
+      return { success: true };
+    } catch (error: any) {
+      console.error('[Extensions] Failed to set config:', error);
+      return { success: false, error: error.message };
+    }
+  });
+
+  // Discover extensions (re-scan directories)
+  ipcMain.handle(IPC_CHANNELS.EXTENSIONS_DISCOVER, async () => {
+    try {
+      const registry = getPluginRegistry();
+      await registry.initialize();
+      const plugins = registry.getPlugins();
+      return plugins.map((p: any) => ({
+        name: p.manifest.name,
+        displayName: p.manifest.displayName,
+        version: p.manifest.version,
+        description: p.manifest.description,
+        type: p.manifest.type,
+        state: p.state,
+      }));
+    } catch (error) {
+      console.error('[Extensions] Failed to discover:', error);
+      return [];
+    }
+  });
+
+  console.log('[Extensions] Handlers initialized');
+
+  // === Webhook Tunnel Handlers ===
+  let tunnelManager: any = null;
+
+  // Get tunnel status
+  ipcMain.handle(IPC_CHANNELS.TUNNEL_GET_STATUS, async () => {
+    try {
+      if (!tunnelManager) {
+        return { status: 'stopped' };
+      }
+      return {
+        status: tunnelManager.status,
+        provider: tunnelManager.config?.provider,
+        url: tunnelManager.url,
+        error: tunnelManager.error?.message,
+        startedAt: tunnelManager.startedAt?.getTime(),
+      };
+    } catch (error) {
+      console.error('[Tunnel] Failed to get status:', error);
+      return { status: 'stopped' };
+    }
+  });
+
+  // Start tunnel
+  ipcMain.handle(IPC_CHANNELS.TUNNEL_START, async (_, config: any) => {
+    try {
+      const { TunnelManager } = await import('../gateway/tunnel');
+      if (tunnelManager) {
+        await tunnelManager.stop();
+      }
+      tunnelManager = new TunnelManager(config);
+      const url = await tunnelManager.start();
+      return { success: true, url };
+    } catch (error: any) {
+      console.error('[Tunnel] Failed to start:', error);
+      return { success: false, error: error.message };
+    }
+  });
+
+  // Stop tunnel
+  ipcMain.handle(IPC_CHANNELS.TUNNEL_STOP, async () => {
+    try {
+      if (tunnelManager) {
+        await tunnelManager.stop();
+        tunnelManager = null;
+      }
+      return { success: true };
+    } catch (error: any) {
+      console.error('[Tunnel] Failed to stop:', error);
+      return { success: false, error: error.message };
+    }
+  });
+
+  console.log('[Tunnel] Handlers initialized');
+
+  // === Voice Mode Handlers ===
+
+  // Initialize voice settings manager with secure database storage
+  const voiceDb = DatabaseManager.getInstance().getDatabase();
+  VoiceSettingsManager.initialize(voiceDb);
+
+  // Get voice settings
+  ipcMain.handle(IPC_CHANNELS.VOICE_GET_SETTINGS, async () => {
+    try {
+      return VoiceSettingsManager.loadSettings();
+    } catch (error) {
+      console.error('[Voice] Failed to get settings:', error);
+      throw error;
+    }
+  });
+
+  // Save voice settings
+  ipcMain.handle(IPC_CHANNELS.VOICE_SAVE_SETTINGS, async (_, settings: any) => {
+    try {
+      const updated = VoiceSettingsManager.updateSettings(settings);
+      // Update the voice service with new settings
+      const voiceService = getVoiceService();
+      voiceService.updateSettings(updated);
+      return updated;
+    } catch (error) {
+      console.error('[Voice] Failed to save settings:', error);
+      throw error;
+    }
+  });
+
+  // Get voice state
+  ipcMain.handle(IPC_CHANNELS.VOICE_GET_STATE, async () => {
+    try {
+      const voiceService = getVoiceService();
+      return voiceService.getState();
+    } catch (error) {
+      console.error('[Voice] Failed to get state:', error);
+      throw error;
+    }
+  });
+
+  // Speak text - returns audio data for renderer to play
+  ipcMain.handle(IPC_CHANNELS.VOICE_SPEAK, async (_, text: string) => {
+    try {
+      const voiceService = getVoiceService();
+      const audioBuffer = await voiceService.speak(text);
+      if (audioBuffer) {
+        // Return audio data as array for serialization over IPC
+        return { success: true, audioData: Array.from(audioBuffer) };
+      }
+      return { success: true, audioData: null };
+    } catch (error: any) {
+      console.error('[Voice] Failed to speak:', error);
+      return { success: false, error: error.message, audioData: null };
+    }
+  });
+
+  // Stop speaking
+  ipcMain.handle(IPC_CHANNELS.VOICE_STOP_SPEAKING, async () => {
+    try {
+      const voiceService = getVoiceService();
+      voiceService.stopSpeaking();
+      return { success: true };
+    } catch (error: any) {
+      console.error('[Voice] Failed to stop speaking:', error);
+      return { success: false, error: error.message };
+    }
+  });
+
+  // Transcribe audio - accepts audio data as array from renderer
+  ipcMain.handle(IPC_CHANNELS.VOICE_TRANSCRIBE, async (_, audioData: number[]) => {
+    try {
+      const voiceService = getVoiceService();
+      // Convert array back to Buffer
+      const audioBuffer = Buffer.from(audioData);
+      const text = await voiceService.transcribe(audioBuffer);
+      return { text };
+    } catch (error: any) {
+      console.error('[Voice] Failed to transcribe:', error);
+      return { text: '', error: error.message };
+    }
+  });
+
+  // Get ElevenLabs voices
+  ipcMain.handle(IPC_CHANNELS.VOICE_GET_ELEVENLABS_VOICES, async () => {
+    try {
+      const voiceService = getVoiceService();
+      return await voiceService.getElevenLabsVoices();
+    } catch (error: any) {
+      console.error('[Voice] Failed to get ElevenLabs voices:', error);
+      return [];
+    }
+  });
+
+  // Test ElevenLabs connection
+  ipcMain.handle(IPC_CHANNELS.VOICE_TEST_ELEVENLABS, async () => {
+    try {
+      const voiceService = getVoiceService();
+      return await voiceService.testElevenLabsConnection();
+    } catch (error: any) {
+      console.error('[Voice] Failed to test ElevenLabs:', error);
+      return { success: false, error: error.message };
+    }
+  });
+
+  // Test OpenAI voice connection
+  ipcMain.handle(IPC_CHANNELS.VOICE_TEST_OPENAI, async () => {
+    try {
+      const voiceService = getVoiceService();
+      return await voiceService.testOpenAIConnection();
+    } catch (error: any) {
+      console.error('[Voice] Failed to test OpenAI voice:', error);
+      return { success: false, error: error.message };
+    }
+  });
+
+  // Test Azure OpenAI voice connection
+  ipcMain.handle(IPC_CHANNELS.VOICE_TEST_AZURE, async () => {
+    try {
+      const voiceService = getVoiceService();
+      return await voiceService.testAzureConnection();
+    } catch (error: any) {
+      console.error('[Voice] Failed to test Azure OpenAI voice:', error);
+      return { success: false, error: error.message };
+    }
+  });
+
+  // Initialize voice service with saved settings
+  const savedVoiceSettings = VoiceSettingsManager.loadSettings();
+  const voiceService = getVoiceService({ settings: savedVoiceSettings });
+
+  // Forward voice events to renderer
+  voiceService.on('stateChange', (state) => {
+    const mainWindow = getMainWindow();
+    if (mainWindow) {
+      mainWindow.webContents.send(IPC_CHANNELS.VOICE_EVENT, {
+        type: 'voice:state-changed',
+        data: state,
+      });
+    }
+  });
+
+  voiceService.on('speakingStart', (text) => {
+    const mainWindow = getMainWindow();
+    if (mainWindow) {
+      mainWindow.webContents.send(IPC_CHANNELS.VOICE_EVENT, {
+        type: 'voice:speaking-start',
+        data: text,
+      });
+    }
+  });
+
+  voiceService.on('speakingEnd', () => {
+    const mainWindow = getMainWindow();
+    if (mainWindow) {
+      mainWindow.webContents.send(IPC_CHANNELS.VOICE_EVENT, {
+        type: 'voice:speaking-end',
+        data: null,
+      });
+    }
+  });
+
+  voiceService.on('transcript', (text) => {
+    const mainWindow = getMainWindow();
+    if (mainWindow) {
+      mainWindow.webContents.send(IPC_CHANNELS.VOICE_EVENT, {
+        type: 'voice:transcript',
+        data: text,
+      });
+    }
+  });
+
+  voiceService.on('error', (error) => {
+    const mainWindow = getMainWindow();
+    if (mainWindow) {
+      mainWindow.webContents.send(IPC_CHANNELS.VOICE_EVENT, {
+        type: 'voice:error',
+        data: { message: error.message },
+      });
+    }
+  });
+
+  // Initialize voice service
+  voiceService.initialize().catch((err) => {
+    console.error('[Voice] Failed to initialize:', err);
+  });
+
+  console.log('[Voice] Handlers initialized');
+}