test(repl-approval): poll the mock for the recorded tool output instead of single-sampling (#523 )

Stabilizes the shard-2 nightly flake where test_repl_tool_result_ask_passes_output_through failed with `assert 'echo: mangosteen' in ''` (E2E run 27826291552, 2026-06-19). Root cause: the four `get_mock_requests` assertions in this file waited on a PROXY signal — the REPL rendering the follow-up reply text — and then sampled the mock server's recorded requests exactly once. The REPL can render the follow-up a beat before the mock finishes persisting the request that carried the `function_call_output`, so the single sample races and returns `''` (~3% flake; the inline comment already acknowledged it and the "expect the follow-up text first" trick was only a partial mitigation). Fix: wait on the EXACT post-condition the tests assert on. New helper `_wait_for_function_call_outputs` polls `get_mock_requests` until a `function_call_output` is actually recorded (the real signal), capped at 120s as a safety net rather than the thing we time against. Replaces the identical extract-once block at all four sites (approval-allows, refusal-blocks, tool_result-ask-does-not-prompt, tool_result-ask-passes-through). No behavior asserted changes; this only removes the sampling race. Verified 4/4 pass locally; 50× CI flake-stress gate kicked off. Co-authored-by: Isaac
test: un-quarantine inline_tool_streaming — stale-green (#523 ) (#845 )
2026-06-20 10:16:28 +08:00 · 2026-06-20 09:37:14 +08:00 · 2026-06-20 09:36:59 +08:00 · 2026-06-20 08:11:10 +08:00 · 2026-06-20 01:17:29 +08:00 · 2026-06-19 16:30:55 +00:00
356 changed files with 30105 additions and 13426 deletions
@@ -0,0 +1,2 @@
+# Treat the AppIcon bundle's contents as binary and never merge them.
+ap-web/electron/icons/AppIcon.icon/** binary -merge
@@ -2,9 +2,10 @@
  "name": "e2e-ci-deps",
  "version": "0.0.0",
  "private": true,
-  "description": "Pinned npm CLIs the e2e workflow installs (claude-code, codex).",
+  "description": "Pinned npm CLIs the e2e workflow installs (claude-code, codex, pi).",
  "dependencies": {
    "@anthropic-ai/claude-code": "2.1.124",
-    "@openai/codex": "0.128.0-alpha.1"
+    "@earendil-works/pi-coding-agent": "0.75.5",
+    "@openai/codex": "0.139.0"
  }
 }
@@ -10,18 +10,11 @@
 # `if:` skip of a matrixed job would instead leave one check-run with an
 # unexpanded `Integration (${{ matrix.name }})` name.
 #
-# One leg per wrapped harness, no pytest-shard splitting: the journey suite is
-# a handful of tests per leg. The `Integration (...)` leg-name prefix is load-
-# bearing -- nightly.yml's notify jq filter keys on it.
-#
-# Model pinning rationale:
-# - claude-sdk on sonnet-4-6: tier 4, most TPM headroom.
-# - codex on gpt-5-5: gpt-5-4-mini hit 429s historically; also halve its
-#   workers (least rate-limit headroom; burn-in failures were codex-only,
-#   clustered at peak PR traffic).
-# - openai-agents on gpt-5-4-mini: green there historically.
-# OMNIGENT_TEST_MODEL_SPREAD in the workflow may rebalance within the same
-# provider/tier pool (tests/_model_pools.py).
+# Single openai-agents leg: all tests now run against the mock LLM server.
+# claude-sdk and codex reject "mock-model" as an unknown model (they validate
+# against the Databricks model catalog even when mock_llm_base_url is set), so
+# only openai-agents works without real credentials. The model name is unused
+# in mock mode (model_name fixture returns "mock-model" regardless).
 #
 # Env in:  EVENT_NAME (github.event_name), IS_DRAFT, IS_FORK (both may be empty
 #          on non-PR events).
@@ -46,9 +39,7 @@ fi

 read -r -d '' matrix <<'JSON' || true
 {"include":[
-{"name":"claude-sdk","harness":"claude-sdk","model":"databricks-claude-sonnet-4-6","workers":4},
-{"name":"openai-agents","harness":"openai-agents","model":"databricks-gpt-5-4-mini","workers":4},
-{"name":"codex","harness":"codex","model":"databricks-gpt-5-5","workers":2}
+{"name":"openai-agents","harness":"openai-agents","model":"databricks-gpt-5-4-mini","workers":4}
 ]}
 JSON
 # Collapse to one line so the GITHUB_OUTPUT key=value contract holds.
@@ -3,25 +3,25 @@
 # fork-e2e/pr-N branch (which lets e2e run as a `push` with the test-gateway
 # secrets). Called by .github/workflows/fork-e2e-mirror.yml.
 #
-# Gate: the PR currently carries the `e2e-approved` label AND that label was
-# last applied by a maintainer (in .github/MAINTAINER@main). GitHub only lets
-# Triage+ users apply labels, so an external fork author can never apply it; the
-# maintainer check further narrows "anyone with Triage" down to the MAINTAINER
-# list. We read the *labeler* from the issue-events timeline rather than the
-# event sender, so the check still holds on `synchronize` (where the sender is
-# the fork author pushing new commits, not the maintainer who labeled earlier).
+# Gate (either condition opens it):
+#   1. The PR has an approving review from a maintainer (in
+#      .github/MAINTAINER@main), OR
+#   2. The PR carries the `e2e-approved` label applied by a maintainer.
 #
-# The label is intentionally separate from the merge gate (maintainer-approval.yml):
-# labeling runs e2e but does NOT approve the PR for merge, and approving for
-# merge does NOT run e2e. New commits while the label is present re-mirror
-# automatically (this script re-runs on `synchronize`); the security scan plus
-# the maintainer's review are the safety net for post-approval pushes. Removing
-# the label (or closing the PR) deletes the mirror branch -- see the workflow.
+# Path 1 (approval) is the primary flow: approving the PR both satisfies the
+# merge gate and triggers e2e. Path 2 (label) is a manual escape hatch for
+# running e2e without approving for merge (e.g. early CI validation).
+#
+# New commits while the gate is open re-mirror automatically (this script
+# re-runs on `synchronize`); the security scan plus the maintainer's review
+# are the safety net for post-approval pushes. Revoking approval AND removing
+# the label (or closing the PR) stops future mirrors and cleans up the mirror
+# branch -- see the workflow.
 #
 # Fail closed: any error or unexpected state leaves the gate shut, so secrets
 # never run on an unverified PR.
 #
-# Env in:  GH_TOKEN, REPO, PR, LABEL (gate label name, default e2e-approved),
+# Env in:  GH_TOKEN, REPO, PR,
 #          MAINTAINERS (space-separated, from merge-ready/load-maintainers.sh).
 # Out:     `mirror=true|false` and `reason=<text>` on $GITHUB_OUTPUT.

@@ -33,7 +33,6 @@ emit() {
  echo "mirror=$1 ($2)"
 }

-LABEL="${LABEL:-e2e-approved}"
 MAINTAINERS_LC=$(echo "${MAINTAINERS:-}" | tr '[:upper:]' '[:lower:]')

 if [[ -z "${MAINTAINERS_LC// /}" ]]; then
@@ -41,32 +40,39 @@ if [[ -z "${MAINTAINERS_LC// /}" ]]; then
  exit 0
 fi

-# 1. Label currently present? Read into a variable first so grep's early exit
-#    can't SIGPIPE the producer, then match against a here-string.
-LABELS=$(gh pr view "$PR" --repo "$REPO" --json labels --jq '.labels[].name')
-if ! grep -qxF "$LABEL" <<<"$LABELS"; then
-  emit false "awaiting '$LABEL' label from a maintainer"
-  exit 0
-fi
+# --- Path 1: maintainer approval via PR review ---

-# 2. Who applied it last? Latest `labeled` event for this label on the timeline.
-#    (Re-applying after a removal makes the most recent labeler authoritative.)
-LABELER=$(gh api "repos/$REPO/issues/$PR/events" --paginate \
-  --jq "[.[] | select(.event == \"labeled\" and .label.name == \"$LABEL\")] | last | .actor.login // empty")
+APPROVERS=$(gh api "repos/$REPO/pulls/$PR/reviews" --paginate \
+  --jq '[.[] | select(.state != "COMMENTED")] | group_by(.user.login) | map(max_by(.submitted_at)) | .[] | select(.state == "APPROVED") | .user.login')

-if [[ -z "$LABELER" ]]; then
-  # Label is present but no labeled event found (e.g. created with the PR via a
-  # template) -- can't attribute it to a maintainer, so stay shut.
-  emit false "'$LABEL' present but no attributable labeler; treating as ungated"
-  exit 0
-fi
-
-LABELER_LC=$(echo "$LABELER" | tr '[:upper:]' '[:lower:]')
-for m in $MAINTAINERS_LC; do
-  if [[ "$m" == "$LABELER_LC" ]]; then
-    emit true "'$LABEL' applied by maintainer @$LABELER"
-    exit 0
-  fi
+for u in $APPROVERS; do
+  u_lc=$(echo "$u" | tr '[:upper:]' '[:lower:]')
+  for m in $MAINTAINERS_LC; do
+    if [[ "$m" == "$u_lc" ]]; then
+      emit true "approved by maintainer @$u"
+      exit 0
+    fi
+  done
 done

-emit false "'$LABEL' applied by non-maintainer @$LABELER; ignoring"
+# --- Path 2: e2e-approved label applied by a maintainer ---
+
+LABEL="e2e-approved"
+LABELS=$(gh pr view "$PR" --repo "$REPO" --json labels --jq '.labels[].name')
+if grep -qxF "$LABEL" <<<"$LABELS"; then
+  LABELER=$(gh api "repos/$REPO/issues/$PR/events" --paginate \
+    --jq "[.[] | select(.event == \"labeled\" and .label.name == \"$LABEL\")] | last | .actor.login // empty")
+
+  if [[ -n "$LABELER" ]]; then
+    LABELER_LC=$(echo "$LABELER" | tr '[:upper:]' '[:lower:]')
+    for m in $MAINTAINERS_LC; do
+      if [[ "$m" == "$LABELER_LC" ]]; then
+        emit true "'$LABEL' applied by maintainer @$LABELER"
+        exit 0
+      fi
+    done
+  fi
+fi
+
+# Neither path opened the gate.
+emit false "awaiting approval from a maintainer or '$LABEL' label"
@@ -2,17 +2,19 @@
 # Single source of truth for the Merge Ready outcome. Downstream steps
 # just consume `state`, `short_desc`, and `long_desc`.
 #
-# The gate is green iff every required check is green on its own merits.
-# There is no CI bypass: to land despite red required checks, quarantine the
-# flaky test (tests/known_failures.yaml) or have a repo admin use GitHub's
-# native "merge without waiting for requirements" affordance.
+# The gate is green iff every required check is green on its own merits
+# AND (for fork PRs) a maintainer has approved. There is no CI bypass: to
+# land despite red required checks, quarantine the flaky test
+# (tests/known_failures.yaml) or have a repo admin use GitHub's native
+# "merge without waiting for requirements" affordance.
 #
-#   CI eval  | state    | meaning
-#   ---------+----------+---------------------------
-#   success  | success  | CI green on its own merits
-#   failure  | failure  | CI red
+#   CI eval  | fork approval | state    | meaning
+#   ---------+---------------+----------+---------------------------------
+#   success  | n/a or true   | success  | CI green on its own merits
+#   success  | false         | failure  | fork PR awaiting maintainer approval
+#   failure  | any           | failure  | CI red
 #
-# Env in: EVAL, FAILED, FORK_NEEDS_E2E_LABEL (optional, default false)
+# Env in: EVAL, FAILED, FORK_NEEDS_E2E_APPROVAL (optional, default false)
 # Out:    state, short_desc, long_desc on $GITHUB_OUTPUT

 set -euo pipefail
@@ -28,13 +30,14 @@ else
 fi

 # Fork PRs never run e2e on their own: the fork `pull_request` run resolves to
-# an empty shard matrix, so the suite only runs once a maintainer applies the
-# `e2e-approved` label (which mirrors the head to a trusted fork-e2e/** branch).
-# Without it the e2e checks are satisfied-via-skip and the PR can go green with
-# e2e never having executed -- so nudge a maintainer to apply the label. Appended
-# to the comment only (long_desc); short_desc is the 140-char commit status.
-if [[ "${FORK_NEEDS_E2E_LABEL:-false}" == "true" ]]; then
-  LONG="$LONG"$'\n\n:information_source: e2e tests do not run automatically on fork PRs. A maintainer can apply the `e2e-approved` label to run the full e2e suite against this PR.'
+# an empty shard matrix, so the suite only runs once a maintainer approves the
+# PR (which mirrors the head to a trusted fork-e2e/** branch). Without approval
+# the e2e checks are satisfied-via-skip and the PR would go green with e2e never
+# having executed -- so block merge until a maintainer approves.
+if [[ "${FORK_NEEDS_E2E_APPROVAL:-false}" == "true" ]]; then
+  STATE=failure
+  SHORT="Awaiting maintainer approval for e2e"
+  LONG="$LONG"$'\n\n:no_entry: **E2e tests are required for fork PRs.** A maintainer must approve this PR or apply the `e2e-approved` label to trigger the e2e suite. The merge gate will stay red until e2e passes.'
 fi

 # GitHub commit-status descriptions max out at 140 chars.
@@ -13,7 +13,7 @@
 # (FIRST_TIME_CONTRIBUTOR / NONE).
 #
 # This gate is independent of fork-e2e/should-mirror.sh: that one gates secret-
-# bearing e2e on the maintainer-applied `e2e-approved` label, whereas this gate
+# bearing e2e on a maintainer's approving PR review, whereas this gate
 # decides whether to inspect for attacks and so errs toward scanning more (it
 # scans returning CONTRIBUTORs that the label gate would not by itself run).
 #
@@ -21,21 +21,29 @@
 # repo at event time; it is not attacker-settable from PR contents.
 #
 # Maintainer escape hatch: an untrusted PR can be waived by the
-# `skip-security-scan` label, but ONLY when the waiver is maintainer-effective
-# -- the label is present AND the author is a maintainer, or a maintainer's
-# latest decisive review is APPROVED. Same semantics as e2e-ui-required's
-# `skip-e2e-ui-test`: the label alone is not enough, so a fork
-# author cannot self-waive (applying labels needs triage access anyway, and the
-# extra maintainer check is defence in depth). All state is read from the API
-# (trusted), and this script always runs from `main`, so a PR cannot edit the
-# decision. The waiver is only evaluated when MAINTAINERS is passed (the scan
-# does; the per-workflow pollers do not -- they just mirror the scan's result).
+# `skip-security-scan` label alone. Applying a label requires GitHub Triage
+# permission (or higher), which a fork author never has, so the label IS the
+# maintainer gate and no separate approval is required.
+#
+# ACCEPTED RISK (repo policy, not GitHub-enforced): GitHub allows the Triage role
+# to be granted independently of Write, so in principle a triage-only collaborator
+# could self-waive. We accept this because this repo grants Triage only to
+# write/admin collaborators -- everyone who can apply the label can already push
+# code, so the waiver grants no privilege they don't already have. This invariant
+# lives in repo settings, not in code; if Triage is ever granted without Write,
+# revisit (e.g. re-add a maintainer-list check). See the PR for the full rationale.
+#
+# The label is read from the API (trusted), and this script always runs from
+# `main`, so a PR cannot edit the decision. The waiver is only evaluated when the
+# lookup vars (GH_TOKEN/REPO/PR) are passed (the scan does; the per-workflow
+# pollers do not -- they just mirror the scan's result).
 #
 # Env in:  EVENT_NAME          (github.event_name)
 #          AUTHOR_ASSOCIATION  (github.event.pull_request.author_association)
 #          MAINTAINERS         (space-separated, from merge-ready/load-maintainers.sh;
-#                               optional -- when empty the skip label is ignored)
-#          GH_TOKEN, REPO, PR  (for the waiver lookup; needed only with MAINTAINERS)
+#                               optional -- used only to trust private-membership
+#                               maintainer AUTHORS, not for the label waiver)
+#          GH_TOKEN, REPO, PR  (for the label lookup + author check)
 # Out:     `scan=true|false` and `reason=<text>` on $GITHUB_OUTPUT.

 set -euo pipefail
@@ -48,49 +56,27 @@ emit() {
  echo "scan=$1 ($2)"
 }

-# 0 = the skip label is present AND backed by a maintainer; 1 otherwise.
-# Mirrors e2e-ui-required/check.sh cases 3-4. Fails closed on any gap.
-skip_label_effective() {
+# 0 = the skip label is present; 1 otherwise. Label-only: applying the label
+# already requires Triage permission (or higher), so its mere presence is the
+# maintainer gate (see the accepted-risk note in the header). Fails closed on any
+# gap (missing token, etc).
+has_skip_label() {
  [[ -n "${GH_TOKEN:-}" && -n "${REPO:-}" && -n "${PR:-}" ]] || return 1
-  [[ -n "${MAINTAINERS:-}" && -n "${MAINTAINERS// /}" ]] || return 1

  local has_label
  has_label=$(gh api "repos/$REPO/pulls/$PR" \
    --jq "[.labels[].name] | index(\"$SKIP_LABEL\") != null" 2>/dev/null || echo "false")
-  [[ "$has_label" == "true" ]] || return 1
-
-  local maint_lc author_lc approvers u_lc
-  maint_lc=$(echo "$MAINTAINERS" | tr '[:upper:]' '[:lower:]')
-
-  # Author is a maintainer?
-  author_lc=$(gh pr view "$PR" --repo "$REPO" --json author --jq '.author.login' 2>/dev/null \
-    | tr '[:upper:]' '[:lower:]')
-  for m in $maint_lc; do
-    [[ "$m" == "$author_lc" ]] && return 0
-  done
-
-  # A maintainer's latest decisive (non-COMMENTED) review is APPROVED?
-  approvers=$(gh api "repos/$REPO/pulls/$PR/reviews" --paginate \
-    --jq '[.[] | select(.state != "COMMENTED")] | group_by(.user.login) | map(max_by(.submitted_at)) | .[] | select(.state == "APPROVED") | .user.login' 2>/dev/null || echo "")
-  for u in $approvers; do
-    u_lc=$(echo "$u" | tr '[:upper:]' '[:lower:]')
-    for m in $maint_lc; do
-      [[ "$m" == "$u_lc" ]] && return 0
-    done
-  done
-
-  return 1
+  [[ "$has_label" == "true" ]]
 }

 # Only PRs carry untrusted contributor code through the gate. Every other
 # trigger -- push to main / fork-e2e/** (the mirror branch only exists after a
 # returning-contributor / maintainer-approval gate), schedule, dispatch -- is a
-# trusted context, so proceed without scanning. pull_request_review is included
-# for two reasons: (1) the security-scan workflow itself re-runs on review so a
-# maintainer's approval can complete a skip-security-scan waiver that was labeled
-# first; (2) the fork-e2e mirror fires on a maintainer's approval and must still
-# consult the head SHA's Security Scan. Both carry the same pull_request +
-# author_association fields, so the gate is evaluated identically.
+# trusted context, so proceed without scanning. pull_request_review is still
+# accepted (it carries the same pull_request + author_association fields, so the
+# gate evaluates identically) in case a workflow_call caller is wired to it, but
+# no workflow triggers a scan on review any more: the skip-security-scan waiver
+# is label-only, so the label event alone re-runs the scan and flips the check.
 case "${EVENT_NAME:-}" in
  pull_request | pull_request_target | pull_request_review) ;;
  *)
@@ -127,8 +113,8 @@ case "${AUTHOR_ASSOCIATION:-}" in
  *)
    if author_is_maintainer; then
      emit false "trusted author (maintainer; author_association=${AUTHOR_ASSOCIATION:-unknown})"
-    elif skip_label_effective; then
-      emit false "maintainer-effective '$SKIP_LABEL' waiver"
+    elif has_skip_label; then
+      emit false "'$SKIP_LABEL' waiver (label requires a Triage+ collaborator to apply)"
    else
      emit true "untrusted author (author_association=${AUTHOR_ASSOCIATION:-unknown})"
    fi
@@ -39,7 +39,7 @@ jobs:

    steps:
      - name: Check out repo
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      - name: Set up Node.js
        uses: ./.github/actions/setup-node
@@ -26,7 +26,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          persist-credentials: false
      - name: Run reviewer-assignment unit test
@@ -46,7 +46,7 @@ jobs:
      # Trusted default branch only (.github sparse). Never the PR head, so no
      # PR-authored code runs.
      - name: Check out .github
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          ref: ${{ github.event.repository.default_branch }}
          sparse-checkout: .github
@@ -30,7 +30,7 @@ jobs:

    steps:
      - name: Checkout default-branch helper
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          ref: ${{ github.event.repository.default_branch }}
          sparse-checkout: .github/scripts/pr-template
@@ -115,7 +115,7 @@ jobs:

    steps:
      - name: Check out repo
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
@@ -209,7 +209,7 @@ jobs:
    timeout-minutes: 30
    steps:
      - name: Check out repo
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
@@ -289,7 +289,7 @@ jobs:
    timeout-minutes: 10
    steps:
      - name: Check out repo
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          persist-credentials: false

@@ -24,7 +24,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          persist-credentials: false
      - name: Run duplicate-PR unit test
@@ -34,7 +34,7 @@ jobs:
      # Trusted default branch only (.github sparse). Pin the ref explicitly so
      # manual workflow_dispatch runs can't execute a script from another
      # branch. Never the PR head, so no PR-authored code runs.
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          ref: ${{ github.event.repository.default_branch }}
          persist-credentials: false
@@ -49,7 +49,7 @@ jobs:
    timeout-minutes: 5
    steps:
      - name: Check out gate scripts from main
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          ref: main             # trusted base; never the PR head
          sparse-checkout: .github/scripts
@@ -77,7 +77,7 @@ jobs:
      matrix: ${{ steps.matrix.outputs.matrix }}
    steps:
      - name: Check out CI scripts
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          # Triggering ref (not main): the script must exist on it, and it
          # only shards tests -- no secrets exposure, so the PR's copy is fine.
@@ -110,7 +110,7 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          ref: ${{ github.event.inputs.branch || github.ref }}

@@ -200,7 +200,7 @@ jobs:
          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
        run: |
          mkdir -p "${GITHUB_WORKSPACE}/.codex-cli" && cd "${GITHUB_WORKSPACE}/.codex-cli"
-          npm install --ignore-scripts --no-audit --no-fund @openai/codex@0.128.0-alpha.1
+          npm install --ignore-scripts --no-audit --no-fund @openai/codex@0.139.0
          echo "${GITHUB_WORKSPACE}/.codex-cli/node_modules/.bin" >> "$GITHUB_PATH"

      - name: Configure native-claude/codex gateway provider
@@ -258,11 +258,12 @@ jobs:
        # --ui-skip-build: the SPA was built in the previous step.
        # --tracing/--screenshot/--video default to off; retain-on-failure
        # keeps green runs cheap while capturing artifacts on failures.
-        # OPENAI_API_KEY / OPENAI_BASE_URL flow into the spawned server via
-        # the conftest's live_server fixture for the openai-agents harness.
+        # OPENAI_API_KEY / OPENAI_BASE_URL are set by the conftest's
+        # live_server fixture to point at the in-process mock LLM server —
+        # no real gateway credentials needed for the openai-agents harness.
+        # Native render-parity tests (claude-sdk/codex) still use the
+        # ~/.omnigent/config.yaml written in the step above.
        env:
-          OPENAI_API_KEY: ${{ env.LLM_API_KEY }}
-          OPENAI_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
          # Scheduled / manually dispatched runs are the full pass;
          # PR and push runs exclude @pytest.mark.nightly tests.
          NIGHTLY_FULL: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
@@ -365,3 +366,40 @@ jobs:
              echo "- 📜 server.log: _no artifact uploaded (glob matched nothing)_"
            fi
          } >> "$GITHUB_STEP_SUMMARY"
+
+  # Explicitly re-dispatch Merge Ready (same-repo PR or fork-e2e push): the
+  # workflow_run hop is brittle and was dropped on #751/#792. No checkout,
+  # actions:write only; GITHUB_TOKEN workflow_dispatch is exempt from recursion.
+  merge-ready-rerun:
+    name: Merge Ready rerun
+    needs: e2e-ui
+    if: >-
+      always()
+      && needs.e2e-ui.result != 'skipped'
+      && (
+        (github.event_name == 'pull_request'
+          && github.event.pull_request.head.repo.full_name == github.repository)
+        || (github.event_name == 'push'
+          && startsWith(github.ref_name, 'fork-e2e/pr-'))
+      )
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      actions: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+      REPO: ${{ github.repository }}
+      REF_NAME: ${{ github.ref_name }}
+      PR_NUMBER: ${{ github.event.pull_request.number }}
+    steps:
+      - name: Re-dispatch Merge Ready
+        run: |
+          set -euo pipefail
+          # same-repo PR -> event number; fork-e2e push -> parse fork-e2e/pr-<N>
+          PR="${PR_NUMBER:-${REF_NAME##*/pr-}}"
+          if ! [[ "$PR" =~ ^[0-9]+$ ]]; then
+            echo "::notice::could not resolve PR number (ref='$REF_NAME'); nothing to do."
+            exit 0
+          fi
+          echo "Re-dispatching merge-ready.yml for PR #$PR after $GITHUB_WORKFLOW."
+          gh workflow run merge-ready.yml --repo "$REPO" -f pr="$PR"
@@ -1,7 +1,8 @@
 name: E2E Tests

-# Runs the `tests/e2e/` suite against a live LLM (Databricks gateway):
-# sub-agent spawning, parking, tunneled client tools, PATCH/GET routes.
+# Runs the `tests/e2e/` suite against the in-process mock LLM server.
+# All tests use mock LLM by default; real-credential tests skip cleanly
+# when no DATABRICKS_TOKEN is present.
 #
 # Triggers:
 #   schedule            09:00 UTC daily (alongside nightly.yml).
@@ -9,8 +10,9 @@ name: E2E Tests
 #                       `parallelism` (pytest `-n` worker count).
 #   pull_request        PR gate for SAME-REPO PRs only. Fork PRs skip
 #                       here (no secrets) and run via the fork-e2e/**
-#                       push after fork-e2e-mirror.yml mirrors them. The
-#                       four shard checks are required by merge-ready.yml.
+#                       push after a maintainer approves the PR and
+#                       fork-e2e-mirror.yml mirrors them. The four shard
+#                       checks are required by merge-ready.yml.
 #   push (fork-e2e/**)  e2e run for mirrored fork PRs (trusted branch,
 #                       so secrets flow).

@@ -19,11 +21,11 @@ on:
    - cron: "0 9 * * *"
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled]
-    paths-ignore: ['ap-web/**']
+    paths-ignore: ['ap-web/**', 'tests/e2e_ui/**']
  push:
    branches:
      - 'fork-e2e/**'
-    paths-ignore: ['ap-web/**']
+    paths-ignore: ['ap-web/**', 'tests/e2e_ui/**']
  workflow_dispatch:
    inputs:
      branch:
@@ -72,7 +74,7 @@ jobs:
      matrix: ${{ steps.matrix.outputs.matrix }}
    steps:
      - name: Check out CI scripts
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          # Triggering ref (not main): the script must exist on it, and it
          # only shards tests -- no secrets exposure, so the PR's copy is fine.
@@ -107,7 +109,7 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          # Same-repo PRs test the merge result (refs/pull/N/merge -- absent
          # when the PR conflicts, so a conflicted PR fails checkout by design).
@@ -132,23 +134,6 @@ jobs:
        with:
          path: .venv
          key: venv-${{ runner.os }}-${{ hashFiles('.python-version') }}-${{ hashFiles('uv.lock') }}
-      - name: Set LLM credentials
-        run: echo "LLM_API_KEY=${{ secrets.LLM_API_KEY }}" >> "$GITHUB_ENV"
-      - name: Write gateway profile (~/.databrickscfg)
-        env:
-          GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
-          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
-        run: |
-          # Strip the /serving-endpoints suffix the conftest re-appends.
-          host="${GATEWAY_BASE_URL%/serving-endpoints}"
-          cat > "$HOME/.databrickscfg" <<EOF
-          [default]
-          host  = $host
-          token = $LLM_API_KEY
-          EOF
-          # PAT passthrough for the codex / claude-sdk auth commands.
-          echo "DATABRICKS_BEARER=$LLM_API_KEY" >> "$GITHUB_ENV"
-
      - name: Install project and dev dependencies
        run: |
          uv sync --extra all --extra dev
@@ -158,8 +143,9 @@ jobs:
        # --ignore-scripts to block postinstall on every package. The
        # claude-code stub binary needs its install.cjs (audited:
        # platform detect + same-tree hardlink, no network/exec) so we run
-        # that one explicitly; codex has no postinstall; pi is intentionally
-        # absent (its e2e rows skip via skip_if_harness_cli_missing).
+        # that one explicitly; codex and pi have no install scripts and
+        # ship prebuilt CLIs, so --ignore-scripts + the PATH line below
+        # make them runnable directly.
        #
        # bubblewrap: the linux_bwrap sandbox backend fails loud if `bwrap`
        # is missing, and the e2e runner runs real agents with os_env. The
@@ -193,12 +179,6 @@ jobs:
          # recover the last-started test when a runner wedges.
          PYTEST_PROGRESS_LOG_DIR: /tmp/omnigent-e2e-${{ github.run_id }}-shard${{ matrix.shard_id }}/progress
          OMNIGENT_TOKEN_USAGE_JSON: /tmp/omnigent-e2e-${{ github.run_id }}-shard${{ matrix.shard_id }}/tokens.json
-          # Spread interchangeable gateway models across tests (deterministic
-          # per nodeid; tests/_model_pools.py).
-          OMNIGENT_TEST_MODEL_SPREAD: '1'
-          # Drain gpt-5-4 from the pool: its FMAPI quota is far below the
-          # others, so tests hashed to it fail on sustained 429s.
-          OMNIGENT_TEST_MODEL_POOL_GPT: 'databricks-gpt-5-5,databricks-gpt-5-4-mini'
        run: |
          # Validate parallelism (untrusted input -- bind to env, never
          # interpolate a GitHub expression into the shell).
@@ -225,9 +205,6 @@ jobs:
          # fails the shard fast instead of letting loadscope requeue deadlock
          # the controller (the 2026-06-11 shard-2 wedge).
          uv run pytest tests/e2e/ \
-            --llm-api-key "$LLM_API_KEY" \
-            --profile default \
-            --harness databricks \
            -n "$WORKERS" \
            --dist=loadscope \
            --max-worker-restart=0 \
@@ -272,3 +249,40 @@ jobs:
          # `warn` not `ignore`: every shard makes LLM calls, so a missing
          # tokens file means the recorder broke.
          if-no-files-found: warn
+
+  # Explicitly re-dispatch Merge Ready (same-repo PR or fork-e2e push): the
+  # workflow_run hop is brittle and was dropped on #751/#792. No checkout,
+  # actions:write only; GITHUB_TOKEN workflow_dispatch is exempt from recursion.
+  merge-ready-rerun:
+    name: Merge Ready rerun
+    needs: e2e
+    if: >-
+      always()
+      && needs.e2e.result != 'skipped'
+      && (
+        (github.event_name == 'pull_request'
+          && github.event.pull_request.head.repo.full_name == github.repository)
+        || (github.event_name == 'push'
+          && startsWith(github.ref_name, 'fork-e2e/pr-'))
+      )
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      actions: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+      REPO: ${{ github.repository }}
+      REF_NAME: ${{ github.ref_name }}
+      PR_NUMBER: ${{ github.event.pull_request.number }}
+    steps:
+      - name: Re-dispatch Merge Ready
+        run: |
+          set -euo pipefail
+          # same-repo PR -> event number; fork-e2e push -> parse fork-e2e/pr-<N>
+          PR="${PR_NUMBER:-${REF_NAME##*/pr-}}"
+          if ! [[ "$PR" =~ ^[0-9]+$ ]]; then
+            echo "::notice::could not resolve PR number (ref='$REF_NAME'); nothing to do."
+            exit 0
+          fi
+          echo "Re-dispatching merge-ready.yml for PR #$PR after $GITHUB_WORKFLOW."
+          gh workflow run merge-ready.yml --repo "$REPO" -f pr="$PR"
@@ -192,7 +192,7 @@ jobs:

    steps:
      - name: Check out repo
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          ref: ${{ github.event.inputs.target_branch }}

@@ -126,7 +126,7 @@ jobs:

    steps:
      - name: Check out repo
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          ref: ${{ github.event.inputs.target_branch }}

@@ -4,16 +4,28 @@ name: Fork e2e mirror
 # there as a `push` (with secrets). It's a pure git-ref update via a GitHub App
 # token (refs pushed by the default GITHUB_TOKEN don't trigger workflows); it
 # never checks out or runs fork code. Mirroring requires BOTH the contributor
-# Security Scan to pass (the blocking `gate` job, via security-gate.yml) AND the
-# `e2e-approved` label, present and applied by a maintainer (should-mirror.sh).
+# Security Scan to pass (the blocking `gate` job, via security-gate.yml) AND a
+# maintainer's approving PR review (should-mirror.sh).
 #
-# The `e2e-approved` label is the sole human gate for running secret-bearing e2e
-# on a fork PR. Only Triage+ users can apply labels, and the gate further
-# verifies the labeler is in .github/MAINTAINER, so an external fork author can
-# never open it. It is intentionally separate from the merge gate
-# (maintainer-approval.yml): labeling runs e2e but does NOT approve for merge,
-# and vice-versa. Removing the label (or closing the PR) tears down the mirror
-# branch and stops further secret runs.
+# Maintainer approval is the sole human gate for running secret-bearing e2e on a
+# fork PR. Only users with write access can submit approving reviews, and the
+# gate further verifies the approver is in .github/MAINTAINER, so an external
+# fork author can never open it. It is intentionally tied to the merge gate
+# (maintainer-approval.yml): approving the PR runs e2e AND approves for merge.
+# Requesting changes or dismissing the review stops future mirrors; closing the
+# PR tears down the mirror branch.
+#
+# Triggers:
+#   pull_request_target   opened/synchronize/reopened/closed — handles new
+#                         pushes and PR lifecycle. Reviews don't fire
+#                         pull_request_target, so approval reaches here via
+#                         workflow_dispatch (dispatched by
+#                         maintainer-approval-rerun-run.yml on approval).
+#   workflow_dispatch     re-evaluation of a single PR (used by the approval
+#                         relay and for manual re-runs). Safe because
+#                         should-mirror.sh always re-checks approval before
+#                         any secret-bearing run; a spurious dispatch with an
+#                         arbitrary PR number cannot trigger e2e.
 #
 # leak-scan-allow: pull_request_target
 on:
@@ -22,21 +34,31 @@ on:
    # down the mirror immediately, not only on the PR's next push.
    types: [opened, synchronize, reopened, closed, labeled, unlabeled]

+  workflow_dispatch:
+    inputs:
+      pr:
+        description: PR number to evaluate for mirroring.
+        required: true
+        type: string
+
 permissions:
  contents: read

 concurrency:
-  group: fork-e2e-mirror-${{ github.event.pull_request.number }}
+  group: fork-e2e-mirror-${{ github.event.pull_request.number || inputs.pr }}
  cancel-in-progress: false

 jobs:
  # Delete the trusted mirror branch when the PR closes or the gate label is
  # removed. Ungated -- cleanup must always run so a closed PR (or one whose
-  # approval was withdrawn) never leaves a stale fork-e2e/pr-N branch behind.
+  # label was removed) never leaves a stale fork-e2e/pr-N branch behind.
+  # Note: approval revocation cleanup is handled by the mirror job's
+  # "Delete stale mirror branch on revocation" step (workflow_dispatch path).
  cleanup:
    name: cleanup
    if: >-
-      github.event.pull_request.head.repo.fork
+      github.event_name == 'pull_request_target'
+      && github.event.pull_request.head.repo.fork
      && (
        github.event.action == 'closed'
        || (github.event.action == 'unlabeled' && github.event.label.name == 'e2e-approved')
@@ -67,48 +89,76 @@ jobs:
  # The single contributor Security Scan, consulted as a BLOCKING gate before we
  # mirror fork code onto a trusted branch where e2e runs WITH the gateway secret.
  # The scan itself runs once on the PR (security-scan.yml); this poller mirrors
-  # its result, blocking the mirror on a finding. Skipped on the teardown actions
-  # (handled by `cleanup`) and on label churn other than `e2e-approved`.
+  # its result, blocking the mirror on a finding. Skipped on the teardown action
+  # (handled by `cleanup`).
  gate:
    name: security gate
    if: >-
-      github.event.pull_request.head.repo.fork
-      && github.event.action != 'closed'
-      && github.event.action != 'unlabeled'
-      && (github.event.action != 'labeled' || github.event.label.name == 'e2e-approved')
+      (
+        github.event_name == 'workflow_dispatch'
+      ) || (
+        github.event_name == 'pull_request_target'
+        && github.event.pull_request.head.repo.fork
+        && github.event.action != 'closed'
+        && github.event.action != 'unlabeled'
+        && (github.event.action != 'labeled' || github.event.label.name == 'e2e-approved')
+      )
    uses: ./.github/workflows/security-gate.yml

  mirror:
    name: mirror
    needs: gate
-    # Fork PRs only -- same-repo PRs run e2e directly via `pull_request`. Mirror
-    # only when not tearing down and (for label events) only for the gate label.
+    # Fork PRs only -- same-repo PRs run e2e directly via `pull_request`.
+    # workflow_dispatch is validated at the step level (verify fork before
+    # mirroring) but runs the gate unconditionally to keep the flow simple.
    if: >-
-      github.event.pull_request.head.repo.fork
-      && github.event.action != 'closed'
-      && github.event.action != 'unlabeled'
-      && (github.event.action != 'labeled' || github.event.label.name == 'e2e-approved')
+      (
+        github.event_name == 'workflow_dispatch'
+      ) || (
+        github.event_name == 'pull_request_target'
+        && github.event.pull_request.head.repo.fork
+        && github.event.action != 'closed'
+        && github.event.action != 'unlabeled'
+        && (github.event.action != 'labeled' || github.event.label.name == 'e2e-approved')
+      )
    permissions:
      contents: read
-      issues: read          # read the labeled-by timeline (issues/N/events)
      pull-requests: read
    runs-on: ubuntu-latest
    timeout-minutes: 5
    env:
      GH_TOKEN: ${{ github.token }}
      REPO: ${{ github.repository }}
-      PR: ${{ github.event.pull_request.number }}
-      HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-      MIRROR_BRANCH: fork-e2e/pr-${{ github.event.pull_request.number }}
+      PR: ${{ github.event.pull_request.number || inputs.pr }}
    steps:
+      - name: Resolve PR context
+        id: ctx
+        run: |
+          if [[ -n "${{ github.event.pull_request.head.sha || '' }}" ]]; then
+            echo "sha=${{ github.event.pull_request.head.sha }}" >> "$GITHUB_OUTPUT"
+            echo "is_fork=true" >> "$GITHUB_OUTPUT"
+          else
+            # workflow_dispatch: resolve from the PR object.
+            INFO=$(gh pr view "$PR" --repo "$REPO" --json headRefOid,isCrossRepository)
+            SHA=$(echo "$INFO" | jq -r '.headRefOid')
+            IS_FORK=$(echo "$INFO" | jq -r '.isCrossRepository')
+            echo "sha=$SHA" >> "$GITHUB_OUTPUT"
+            echo "is_fork=$IS_FORK" >> "$GITHUB_OUTPUT"
+            if [[ "$IS_FORK" != "true" ]]; then
+              echo "::notice::PR #$PR is same-repo; skipping mirror (same-repo PRs run e2e directly)."
+            fi
+          fi
+
      - name: Check out gate scripts from main
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        if: steps.ctx.outputs.is_fork == 'true'
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          ref: main             # trusted; never the PR head
          sparse-checkout: .github/scripts
          persist-credentials: false

      - name: Mint mirror App token
+        if: steps.ctx.outputs.is_fork == 'true'
        id: app-token
        # App token, not GITHUB_TOKEN: its pushes DO trigger the downstream e2e.
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
@@ -116,23 +166,26 @@ jobs:
          app-id: ${{ vars.FORK_E2E_APP_ID }}
          private-key: ${{ secrets.FORK_E2E_APP_PRIVATE_KEY }}

-      # MAINTAINER@main, never the PR head: the gate verifies the *labeler* is a
+      # MAINTAINER@main, never the PR head: the gate verifies the *approver* is a
      # maintainer, so a PR can't self-grant by editing its own MAINTAINER copy.
      - name: Load maintainers
+        if: steps.ctx.outputs.is_fork == 'true'
        id: maintainers
        run: bash .github/scripts/merge-ready/load-maintainers.sh

      - name: Evaluate mirror gate
+        if: steps.ctx.outputs.is_fork == 'true'
        id: gate
        env:
-          LABEL: e2e-approved
          MAINTAINERS: ${{ steps.maintainers.outputs.list }}
        run: bash .github/scripts/fork-e2e/should-mirror.sh

      - name: Mirror head SHA onto trusted branch
-        if: ${{ steps.gate.outputs.mirror == 'true' }}
+        if: steps.ctx.outputs.is_fork == 'true' && steps.gate.outputs.mirror == 'true'
        env:
          TOKEN: ${{ steps.app-token.outputs.token }}
+          HEAD_SHA: ${{ steps.ctx.outputs.sha }}
+          MIRROR_BRANCH: fork-e2e/pr-${{ env.PR }}
        run: |
          set -euo pipefail
          # Move git OBJECTS, don't just point a ref. A fork PR's head commit
@@ -159,3 +212,16 @@ jobs:
          fi
          git -C "$work" push -q -f "$origin" "${HEAD_SHA}:refs/heads/${MIRROR_BRANCH}"
          echo "Mirrored $MIRROR_BRANCH -> $HEAD_SHA"
+
+      # Tear down the mirror branch when approval is revoked (review dismissed
+      # or changes requested). Without this, a stale fork-e2e/pr-N branch
+      # would remain until the next push or PR close.
+      - name: Delete stale mirror branch on revocation
+        if: steps.ctx.outputs.is_fork == 'true' && steps.gate.outputs.mirror == 'false'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          MIRROR_BRANCH: fork-e2e/pr-${{ env.PR }}
+        run: |
+          gh api -X DELETE "repos/$REPO/git/refs/heads/$MIRROR_BRANCH" >/dev/null 2>&1 \
+            && echo "Deleted stale $MIRROR_BRANCH (approval revoked)" \
+            || echo "No $MIRROR_BRANCH to delete"
@@ -0,0 +1,75 @@
+# Create a GitHub Release entry (the `…/releases` page) when a version tag is
+# pushed. This is METADATA ONLY — it does NOT build or publish any installable
+# artifact. PyPI publishing lives in the central secure-release repo
+# (databricks/secure-public-registry-releases-eng → `omnigent` workflow), on
+# hardened runners with OIDC Trusted Publishing and a mandatory dependency
+# scan. Keeping those concerns separate is deliberate (see RELEASING.md):
+#
+#   * This job runs NO project or third-party code — no build, no `pip
+#     install`/`npm ci`, no tests. Its only action is SHA-pinned
+#     `actions/checkout` plus `gh release create`. A malicious tagged commit
+#     therefore cannot execute anything here.
+#   * It uses the ephemeral `GITHUB_TOKEN` (no stored secret / PAT). The single
+#     elevated scope, `contents: write`, is the minimum GitHub requires to
+#     create a release and nothing else in the job uses it.
+#   * It attaches NO wheels. The release carries only generated notes and the
+#     source tarball GitHub auto-attaches, so PyPI (the scanned, securely
+#     published channel) stays the single source of installable artifacts.
+#   * The release is created as a DRAFT: a human verifies/edits the generated
+#     notes and publishes it (ideally after the prod PyPI publish lands), so a
+#     bot never makes a public release on its own.
+name: GitHub Release
+
+on:
+  push:
+    tags:
+      # Version tags only (v0.2.0, v0.2.0rc1, …) — `v[0-9]*` avoids triggering
+      # on non-release tags like `v-infra-*`.
+      - "v[0-9]*"
+
+# Least privilege: creating a release requires `contents: write`; nothing here
+# needs anything more.
+permissions:
+  contents: write
+
+jobs:
+  draft-release:
+    # Inert in forks / mirrors — only the canonical repo should cut releases.
+    if: github.repository == 'omnigent-ai/omnigent'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      # Full history so `--generate-notes` can diff against the previous tag.
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+
+      - name: Draft release with generated notes
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          # Rerun-safe: if a release for this tag already exists (a rerun, a
+          # deleted-and-re-pushed tag, or a manual release), skip instead of
+          # failing the job. An `if` so this can't trip `set -e`.
+          if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            echo "Release $TAG already exists — skipping." | tee -a "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+          # rc / dev / alpha / beta tags are flagged as pre-releases.
+          pre=""
+          case "$TAG" in
+            *rc*|*dev*|*a[0-9]*|*b[0-9]*) pre="--prerelease" ;;
+          esac
+          # $pre is intentionally UNQUOTED: it word-splits to nothing when empty,
+          # and is only ever "" or "--prerelease" (set just above, never from
+          # external input). Quoting it would pass an empty positional arg.
+          gh release create "$TAG" \
+            --repo "$GITHUB_REPOSITORY" \
+            --draft \
+            --verify-tag \
+            --generate-notes \
+            --title "$TAG" \
+            $pre
+          echo "Drafted release $TAG — review/edit the notes and publish from the Releases page." \
+            | tee -a "$GITHUB_STEP_SUMMARY"
@@ -1,12 +1,11 @@
 name: Integration Tests

-# Per-PR twin of nightly.yml's journey-suite matrix (tests/integration/),
-# once per wrapped harness against the real Databricks gateway. Burn-in:
-# NOT in merge-ready's REQUIRED list yet (reports for signal; flip in
-# .github/scripts/merge-ready/required.sh after a clean week). Triggers:
-# daily schedule, same-repo PR gate (secrets flow; fork PRs skip and run
-# via the fork-e2e/** push after fork-e2e-mirror.yml), the fork-e2e/**
-# push itself, and workflow_dispatch.
+# Per-PR journey-suite matrix (tests/integration/), once per wrapped harness
+# using the mock LLM server (no real gateway credentials required). All tests
+# are mock_only: they script the LLM responses via configure_mock_llm and run
+# against a local mock FastAPI server. Triggers: daily schedule, same-repo PR
+# gate (fork PRs skip and run via the fork-e2e/** push after
+# fork-e2e-mirror.yml), the fork-e2e/** push itself, and workflow_dispatch.

 on:
  schedule:
@@ -62,7 +61,7 @@ jobs:
      matrix: ${{ steps.matrix.outputs.matrix }}
    steps:
      - name: Check out CI scripts
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          # Triggering ref (not pinned to main): the script must exist on the
          # running ref, and it is not a security gate -- it only selects which
@@ -99,7 +98,7 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          ref: ${{ github.event.inputs.branch || github.ref }}

@@ -121,23 +120,6 @@ jobs:
        with:
          path: .venv
          key: venv-${{ runner.os }}-${{ hashFiles('.python-version') }}-${{ hashFiles('uv.lock') }}
-      - name: Set LLM credentials
-        run: echo "LLM_API_KEY=${{ secrets.LLM_API_KEY }}" >> "$GITHUB_ENV"
-      - name: Write gateway profile (~/.databrickscfg)
-        env:
-          GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
-          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
-        run: |
-          # Strip the /serving-endpoints suffix the conftest re-appends.
-          host="${GATEWAY_BASE_URL%/serving-endpoints}"
-          cat > "$HOME/.databrickscfg" <<EOF
-          [default]
-          host  = $host
-          token = $LLM_API_KEY
-          EOF
-          # PAT passthrough for the codex / claude-sdk auth commands.
-          echo "DATABRICKS_BEARER=$LLM_API_KEY" >> "$GITHUB_ENV"
-
      - name: Install project and dev dependencies
        run: uv sync --extra all --extra dev

@@ -188,11 +170,8 @@ jobs:
          # --timeout=180 caps a single hung test (see e2e.yml).
          env -u OPENAI_API_KEY -u ANTHROPIC_API_KEY -u DATABRICKS_TOKEN \
            uv run pytest tests/integration/ \
-              --integration \
              --model "$MODEL" \
              --harness "$HARNESS" \
-              --profile default \
-              --llm-api-key "$LLM_API_KEY" \
              -n "$WORKERS" \
              --dist=loadscope \
              --timeout=180 \
@@ -221,3 +200,40 @@ jobs:
          path: artifacts/
          retention-days: 14
          if-no-files-found: ignore
+
+  # Explicitly re-dispatch Merge Ready (same-repo PR or fork-e2e push): the
+  # workflow_run hop is brittle and was dropped on #751/#792. No checkout,
+  # actions:write only; GITHUB_TOKEN workflow_dispatch is exempt from recursion.
+  merge-ready-rerun:
+    name: Merge Ready rerun
+    needs: integration
+    if: >-
+      always()
+      && needs.integration.result != 'skipped'
+      && (
+        (github.event_name == 'pull_request'
+          && github.event.pull_request.head.repo.full_name == github.repository)
+        || (github.event_name == 'push'
+          && startsWith(github.ref_name, 'fork-e2e/pr-'))
+      )
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      actions: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+      REPO: ${{ github.repository }}
+      REF_NAME: ${{ github.ref_name }}
+      PR_NUMBER: ${{ github.event.pull_request.number }}
+    steps:
+      - name: Re-dispatch Merge Ready
+        run: |
+          set -euo pipefail
+          # same-repo PR -> event number; fork-e2e push -> parse fork-e2e/pr-<N>
+          PR="${PR_NUMBER:-${REF_NAME##*/pr-}}"
+          if ! [[ "$PR" =~ ^[0-9]+$ ]]; then
+            echo "::notice::could not resolve PR number (ref='$REF_NAME'); nothing to do."
+            exit 0
+          fi
+          echo "Re-dispatching merge-ready.yml for PR #$PR after $GITHUB_WORKFLOW."
+          gh workflow run merge-ready.yml --repo "$REPO" -f pr="$PR"
@@ -57,7 +57,7 @@ jobs:

      - name: Check out repo
        if: steps.creds.outputs.available == 'true'
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          ref: ${{ github.event.repository.default_branch }}
          persist-credentials: false
@@ -43,7 +43,7 @@ jobs:

    steps:
      - name: Check out repo
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
@@ -80,3 +80,30 @@ jobs:
              core.info(`Re-running Maintainer Approval run ${run_id} for PR #${pull_number}`);
              await github.rest.actions.reRunWorkflowFailedJobs({ owner, repo, run_id: Number(run_id) });
            }
+
+      # Fork PRs: maintainer approval also gates e2e (replacing the old
+      # e2e-approved label). Dispatch the fork-e2e-mirror workflow so the
+      # approval triggers e2e on the trusted mirror branch.
+      - name: Dispatch fork e2e mirror for fork PRs
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const fs = require('fs');
+            const { owner, repo } = context.repo;
+            if (!fs.existsSync('pr_number')) {
+              core.info('No pr_number file; nothing to do.');
+              return;
+            }
+            const pull_number = Number(fs.readFileSync('pr_number', 'utf8').trim());
+            const { data: pr } = await github.rest.pulls.get({ owner, repo, pull_number });
+            if (!pr.head.repo || pr.head.repo.full_name === `${owner}/${repo}`) {
+              core.info(`PR #${pull_number} is same-repo; skipping fork-e2e-mirror dispatch.`);
+              return;
+            }
+            core.info(`PR #${pull_number} is a fork PR; dispatching fork-e2e-mirror.`);
+            await github.rest.actions.createWorkflowDispatch({
+              owner, repo,
+              workflow_id: 'fork-e2e-mirror.yml',
+              ref: 'main',
+              inputs: { pr: String(pull_number) },
+            });
@@ -20,8 +20,10 @@ concurrency:

 jobs:
  record:
-    # Only approvals can flip the check green; skip everything else.
-    if: github.event.review.state == 'approved'
+    # Approvals flip the check green; dismissals and changes-requested flip
+    # it red and revoke the fork-e2e mirror. Skip COMMENTED reviews (they
+    # don't change review state).
+    if: github.event.review.state != 'commented'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
@@ -3,7 +3,7 @@ name: Merge Ready
 # Posts the "Merge Ready" commit status on the PR head SHA -- the single
 # required branch-protection check, backed by the REQUIRED list inside
 # this workflow. Triggers: `/merge` comment (write-access commenter only),
-# `pull_request` labeled (acts only with `automerge`),
+# `pull_request_target` labeled (acts only with `automerge`),
 # `workflow_run` on same-repo CI completion, `check_suite` completion on a
 # `fork-e2e/**` branch (the mirrored fork PR e2e -- a delivery that actually
 # fires, unlike the brittle fork-PR `workflow_run` hop it replaces), and
@@ -24,7 +24,9 @@ name: Merge Ready
 on:
  # `labeled` only; `workflow_run` re-evaluates on CI completion (same-repo PRs
  # and the fork-e2e/** mirror push -- see the job `if`).
-  pull_request:
+  # pull_request_target (not pull_request) so this workflow always runs from
+  # main -- a PR cannot modify the gate logic by editing this file.
+  pull_request_target:
    types: [labeled]
  workflow_run:
    workflows: [PR Template, CI, Lint, E2E UI Tests, E2E Tests, Integration Tests]
@@ -71,7 +73,7 @@ jobs:
    # open PR (push to main, etc.) are dropped by the ctx step.
    if: >-
      (
-        github.event_name == 'pull_request' &&
+        github.event_name == 'pull_request_target' &&
        github.event.label.name == 'automerge'
      ) ||
      (
@@ -104,8 +106,9 @@ jobs:
    timeout-minutes: 5
    steps:
      - name: Check out scripts
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
+          ref: main             # trusted gate scripts; never the PR head
          sparse-checkout: .github/scripts/merge-ready
          persist-credentials: false

@@ -128,7 +131,7 @@ jobs:
            gh api "repos/$REPO/commits/$1/pulls" \
              --jq 'map(select(.state == "open")) | .[0].number // empty' 2>/dev/null || true
          }
-          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+          if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then
            PR="${{ github.event.pull_request.number }}"
            SHA="${{ github.event.pull_request.head.sha }}"
          elif [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
@@ -178,13 +181,22 @@ jobs:
          echo "pr=$PR"   >> "$GITHUB_OUTPUT"
          echo "sha=$SHA" >> "$GITHUB_OUTPUT"

-      - name: Read PR labels
+      - name: Load maintainers
+        id: maintainers
+        if: steps.ctx.outputs.skip != 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+        run: bash .github/scripts/merge-ready/load-maintainers.sh
+
+      - name: Read PR labels and fork approval state
        id: labels
        if: steps.ctx.outputs.skip != 'true'
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          PR: ${{ steps.ctx.outputs.pr }}
+          MAINTAINERS: ${{ steps.maintainers.outputs.list }}
        run: |
          INFO=$(gh pr view "$PR" --repo "$REPO" --json labels,isCrossRepository)
          NAMES=$(echo "$INFO" | jq -r '.labels[].name')
@@ -193,15 +205,36 @@ jobs:
          else
            echo "automerge=false" >> "$GITHUB_OUTPUT"
          fi
-          # A fork PR without the maintainer-only `e2e-approved` label never
-          # runs e2e (the fork pull_request run is an empty matrix), so the gate
-          # message nudges a maintainer to apply it. Same-repo PRs run e2e with
-          # secrets directly and need no label.
-          if [[ "$(echo "$INFO" | jq -r '.isCrossRepository')" == "true" ]] \
-             && ! echo "$NAMES" | grep -qx "e2e-approved"; then
-            echo "fork_needs_e2e_label=true" >> "$GITHUB_OUTPUT"
+          # A fork PR without a maintainer's approving review or the
+          # `e2e-approved` label never runs e2e (the fork pull_request run is
+          # an empty matrix), so the gate blocks until one of these is present.
+          # Same-repo PRs run e2e with secrets directly and need no gate.
+          if [[ "$(echo "$INFO" | jq -r '.isCrossRepository')" == "true" ]]; then
+            # Check path 1: maintainer approval via PR review.
+            MAINTAINERS_LC=$(echo "${MAINTAINERS:-}" | tr '[:upper:]' '[:lower:]')
+            APPROVERS=$(gh api "repos/$REPO/pulls/$PR/reviews" --paginate \
+              --jq '[.[] | select(.state != "COMMENTED")] | group_by(.user.login) | map(max_by(.submitted_at)) | .[] | select(.state == "APPROVED") | .user.login')
+            HAS_GATE=false
+            for u in $APPROVERS; do
+              u_lc=$(echo "$u" | tr '[:upper:]' '[:lower:]')
+              for m in $MAINTAINERS_LC; do
+                if [[ "$m" == "$u_lc" ]]; then
+                  HAS_GATE=true
+                  break 2
+                fi
+              done
+            done
+            # Check path 2: e2e-approved label.
+            if [[ "$HAS_GATE" == "false" ]] && echo "$NAMES" | grep -qx "e2e-approved"; then
+              HAS_GATE=true
+            fi
+            if [[ "$HAS_GATE" == "false" ]]; then
+              echo "fork_needs_e2e_approval=true" >> "$GITHUB_OUTPUT"
+            else
+              echo "fork_needs_e2e_approval=false" >> "$GITHUB_OUTPUT"
+            fi
          else
-            echo "fork_needs_e2e_label=false" >> "$GITHUB_OUTPUT"
+            echo "fork_needs_e2e_approval=false" >> "$GITHUB_OUTPUT"
          fi

      # post_red gates posting a red status: /merge needs it, automerge opts
@@ -241,7 +274,7 @@ jobs:
        env:
          EVAL: ${{ steps.eval.outcome }}
          FAILED: ${{ steps.eval.outputs.failed }}
-          FORK_NEEDS_E2E_LABEL: ${{ steps.labels.outputs.fork_needs_e2e_label }}
+          FORK_NEEDS_E2E_APPROVAL: ${{ steps.labels.outputs.fork_needs_e2e_approval }}
        run: bash .github/scripts/merge-ready/compute-gate.sh

      # Skipped when post_red is false AND gate is red: leaves prior
@@ -298,7 +331,7 @@ jobs:
      - name: Enable auto-merge on automerge label
        if: >-
          steps.ctx.outputs.skip != 'true' &&
-          github.event_name == 'pull_request' &&
+          github.event_name == 'pull_request_target' &&
          github.event.action == 'labeled' &&
          github.event.label.name == 'automerge'
        env:
@@ -307,7 +340,7 @@ jobs:
          PR: ${{ steps.ctx.outputs.pr }}
        run: bash .github/scripts/merge-ready/enable-automerge-label.sh

-      # Not on pull_request-labeled: auto-merge was enabled in an earlier
+      # Not on pull_request_target-labeled: auto-merge was enabled in an earlier
      # step there, so failing here would make the label look broken even
      # though it worked. Safe on workflow_run/check_suite/workflow_dispatch.
      - name: Fail job when gate is red
@@ -81,7 +81,7 @@ jobs:
    timeout-minutes: 30
    steps:
      - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      - name: Set up Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4.1.0
@@ -164,6 +164,7 @@ jobs:

      # No build-args: the Dockerfile ARGs default to public registries.
      - name: Build and push
+        id: build-server
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
        with:
          context: .
@@ -179,6 +180,7 @@ jobs:
      # Host image: same Dockerfile, `host` target. Runs after the server build
      # so it reuses the shared builder-stage layers from the gha cache.
      - name: Build and push host image
+        id: build-host
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
        with:
          context: .
@@ -191,6 +193,55 @@ jobs:
          cache-to: type=gha,mode=max
          provenance: false
          sbom: true
+    outputs:
+      server-digest: ${{ steps.build-server.outputs.digest }}
+      host-digest: ${{ steps.build-host.outputs.digest }}
+
+  generate-sbom:
+    # Runs in a separate job with read-only permissions so the Syft
+    # install script cannot influence the image push. Scans the
+    # already-pushed images by digest (immutable).
+    needs: build-and-push
+    permissions:
+      contents: read
+      packages: read
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Log in to GHCR (read-only)
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install Syft
+        uses: anchore/sbom-action/download-syft@fc46e51fd3cb168ffb36c6d1915723c47db58abb  # v0.17.7
+
+      - name: Generate server SBOM
+        run: |
+          set -euo pipefail
+          syft "ghcr.io/omnigent-ai/omnigent-server@${{ needs.build-and-push.outputs.server-digest }}" \
+            -o cyclonedx-json=server-sbom.cdx.json \
+            -o spdx-json=server-sbom.spdx.json
+
+      - name: Generate host SBOM
+        run: |
+          set -euo pipefail
+          syft "ghcr.io/omnigent-ai/omnigent-host@${{ needs.build-and-push.outputs.host-digest }}" \
+            -o cyclonedx-json=host-sbom.cdx.json \
+            -o spdx-json=host-sbom.spdx.json
+
+      - name: Upload SBOMs
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        with:
+          name: sbom
+          path: |
+            server-sbom.cdx.json
+            server-sbom.spdx.json
+            host-sbom.cdx.json
+            host-sbom.spdx.json
+          retention-days: 90

  promote-nightly:
    # Daily cron (or a manual force_nightly dispatch): move :latest-nightly to
@@ -243,7 +294,7 @@ jobs:
    timeout-minutes: 10
    steps:
      - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      - name: Set up crane
        uses: imjasonh/setup-crane@59c71e96a00b28651f10369ba3359a6d730740a0  # v0.6
@@ -42,7 +42,7 @@ jobs:
      # Checkout main only for load-maintainers.sh; the PR branch is checked
      # out later (regen job), after authorization passes.
      - name: Checkout (for the maintainer script)
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      - name: Load maintainers from .github/MAINTAINER
        id: maint
@@ -114,7 +114,7 @@ jobs:
      # build backends, which must not find a push token on disk. The App token
      # is minted only after `uv lock` and enters only at the push step.
      - name: Checkout the PR branch
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          ref: ${{ needs.authorize.outputs.head }}
          persist-credentials: false
@@ -33,7 +33,7 @@ jobs:
    timeout-minutes: 30
    steps:
      - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      - name: Set up uv (clean public resolution, no proxy cache)
        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a  # v4
@@ -46,7 +46,7 @@ jobs:

      - name: Checkout
        if: steps.gate.outputs.ready == 'true'
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          persist-credentials: false

@@ -13,7 +13,7 @@ name: Polly Review Approval Dispatch
 # workflow_dispatch entry point) for that PR.
 #
 # Maintainer approval is the trust gate that authorizes spending the LLM gateway
-# secret on fork code -- the same model as the fork-e2e `e2e-approved` gate.
+# secret on fork code -- the same model as the fork-e2e maintainer-approval gate.
 # Polly itself never runs PR code: it reviews the diff fetched via the API from
 # a default-branch checkout.
 #
@@ -127,7 +127,7 @@ jobs:
      # out untrusted PR code in a privileged workflow.
      - name: Check out repo
        if: steps.trigger.outputs.skip != 'true' && steps.creds.outputs.available == 'true'
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          ref: ${{ github.event.repository.default_branch }}
          persist-credentials: false
@@ -181,7 +181,7 @@ jobs:
          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
        run: |
          mkdir -p "${GITHUB_WORKSPACE}/.codex-cli" && cd "${GITHUB_WORKSPACE}/.codex-cli"
-          npm install --ignore-scripts --no-audit --no-fund @openai/codex@0.128.0-alpha.1
+          npm install --ignore-scripts --no-audit --no-fund @openai/codex@0.139.0
          echo "${GITHUB_WORKSPACE}/.codex-cli/node_modules/.bin" >> "$GITHUB_PATH"

      - name: Set LLM credentials
@@ -230,13 +230,13 @@ jobs:
                      'anthropic': {
                          'base_url': gw + '/anthropic',
                          'api_key_ref': 'env:LLM_API_KEY',
-                          'models': {'default': 'databricks-claude-sonnet-4-6'},
+                          'models': {'default': 'databricks-claude-opus-4-8'},
                      },
                      'openai': {
                          'base_url': host + '/ai-gateway/codex/v1',
                          'api_key_ref': 'env:LLM_API_KEY',
                          'wire_api': 'responses',
-                          'models': {'default': 'databricks-gpt-5-4-mini'},
+                          'models': {'default': 'databricks-gpt-5-5'},
                      },
                  }
              }
@@ -302,8 +302,10 @@ jobs:

          IMPORTANT: Your output will be posted directly as a PR comment. Output
          ONLY the final structured review — no coordination messages, no status
-          updates about dispatching sub-agents, no "waiting for results" narration.
-          Start your response with the review content itself.
+          updates about dispatching sub-agents, no referring to "reviewers", no "waiting for results" narration.
+          Begin your response with the exact marker <!-- POLLY_REVIEW_START -->
+          on its own line, then the review content. Nothing before the marker
+          will be shown.
          """
          pathlib.Path("/tmp/review_prompt.txt").write_text(prompt)
          PYEOF
@@ -328,6 +330,25 @@ jobs:
            | tee /tmp/polly_output.txt \
            || { echo "::warning::Polly review exited non-zero"; cat polly-stderr.log; }

+          # Strip any sub-agent coordination preamble that leaks before
+          # the actual review.  Primary: look for the sentinel we asked the
+          # model to emit.  Fallback: first markdown heading.  If neither is
+          # found the output is intermediate narration (subagents timed out
+          # before synthesis) — write empty string so the post step is skipped
+          # and raw coordination messages are never posted as a PR comment.
+          python3 -c "
+          import re, pathlib
+          raw = pathlib.Path('/tmp/polly_output.txt').read_text()
+          sentinel = '<!-- POLLY_REVIEW_START -->'
+          idx = raw.find(sentinel)
+          if idx >= 0:
+              cleaned = raw[idx + len(sentinel):].lstrip('\n')
+          else:
+              m = re.search(r'^#{1,6} ', raw, re.MULTILINE)
+              cleaned = raw[m.start():] if m else ''
+          pathlib.Path('/tmp/polly_output.txt').write_text(cleaned)
+          "
+
          # Use a collision-resistant random delimiter so model output
          # containing "REVIEW_EOF" cannot truncate the output.
          delim="REVIEW_$(openssl rand -hex 8)"
@@ -336,10 +357,18 @@ jobs:
          head -c 61440 /tmp/polly_output.txt >> "$GITHUB_OUTPUT"
          echo "${delim}" >> "$GITHUB_OUTPUT"

+      - name: Mint App token
+        id: app-token
+        if: steps.trigger.outputs.skip != 'true' && steps.creds.outputs.available == 'true' && vars.OMNIGENT_BOT_APP_ID != ''
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.OMNIGENT_BOT_APP_ID }}
+          private-key: ${{ secrets.OMNIGENT_BOT_APP_KEY }}
+
      - name: Post review comment
        if: steps.polly.outputs.review_text != ''
        env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
          REPO: ${{ github.repository }}
          PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
          REVIEW_TEXT: ${{ steps.polly.outputs.review_text }}
@@ -29,7 +29,7 @@ jobs:
    timeout-minutes: 5
    steps:
      - name: Checkout default-branch script
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          ref: ${{ github.event.repository.default_branch }}
          sparse-checkout: .github/scripts/pr-size
@@ -64,7 +64,7 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      - name: Set up uv (clean public resolution, no proxy cache)
        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4
@@ -80,10 +80,14 @@ jobs:
      #    load-bearing: the wheel packages on-disk files, so the bundle must
      #    exist before `uv build`. `rm -rf` backstops Vite's emptyOutDir
      #    against stale bundles; `npm ci` installs the exact locked deps.
+      #    `--legacy-peer-deps` matches how ap-web's lockfile is generated and
+      #    validated everywhere else (lint, e2e-ui, ap-web-tests, the regen
+      #    jobs) — required for the React 19 peer conflict; without it `npm ci`
+      #    rejects the lockfile ("Missing: yaml@1.10.3 from lock file").
      - name: Build web UI (clean, fresh)
        run: |
          rm -rf omnigent/server/static/web-ui
-          npm --prefix ap-web ci
+          npm --prefix ap-web ci --legacy-peer-deps
          npm --prefix ap-web run build # Vite outDir -> omnigent/server/static/web-ui

      # 2. Tag-driven: the tag must match the version in all three pyprojects
@@ -9,9 +9,19 @@ name: Rerun Security Gate Run
 # `Security Gate` job failed -- so a workflow that already self-triggered on the
 # label (ci/e2e trigger on `labeled` for force-all-tests etc.) is in-progress or
 # green and skipped, avoiding a double-run. fork-e2e-mirror is excluded: it is
-# e2e-approved-driven mirror plumbing with branch side effects, not a
+# approval-driven mirror plumbing with branch side effects, not a
 # gate-mirroring check.
 #
+# RACE GUARD: the label event fires this relay AND the Security Scan re-run
+# concurrently. Before re-running anything we WAIT for the Security Scan check on
+# the head SHA to settle and only proceed once it is passing. Otherwise we would
+# re-run gate workflows while the scan is still failing / not yet recreated --
+# they would just re-mirror a non-passing check and fail again, and (as seen on
+# PR #556) those re-runs left runs in-progress that the decisive relay could no
+# longer re-run ("could not re-run", GitHub rejects rerun of an in-flight run),
+# stranding stale failing checks. Waiting for scan success makes the relay
+# deterministic: every gate it re-runs polls an already-completed passing scan.
+#
 # The triggering run may have been initiated by an untrusted fork PR, so the
 # recorded artifact is treated as untrusted input (the PR number is GitHub-
 # provided, but it is still sanitised to digits). No PR code is checked out.
@@ -34,7 +44,10 @@ jobs:
    name: Rerun Security Gate
    if: github.event.workflow_run.conclusion == 'success'
    runs-on: ubuntu-latest
-    timeout-minutes: 5
+    # >= the race guard's max wait (~6 min, below) PLUS the artifact download and
+    # the per-workflow rerun loop, so a slow Security Scan can never cancel the
+    # job mid-wait and strand the gate re-runs this relay exists to issue.
+    timeout-minutes: 10
    permissions:
      actions: write        # gh run rerun + read workflow runs/artifacts
      pull-requests: read   # resolve the PR head SHA
@@ -80,6 +93,43 @@ jobs:
          SHA="$(gh api "repos/$REPO/pulls/$PR_NUMBER" --jq '.head.sha')"
          echo "PR #$PR_NUMBER head $SHA"

+          # Race guard: re-running gate workflows is only useful once the
+          # Security Scan has actually flipped to passing for this SHA. The
+          # label event triggers this relay AND the scan re-run together, so wait
+          # for the latest Security Scan check to complete; bail unless it passed.
+          # (A non-passing scan means the gate failures are correct -- nothing to
+          # re-run; and re-running now would strand in-progress runs the relay
+          # can't later re-run. See the header.)
+          #
+          # KNOWN GAP: if the scan takes longer than this ~6-min budget, we exit
+          # without re-running and the gates stay red until the next label event
+          # (add/remove/re-add re-fires this relay). CI/E2E also self-recover via
+          # their own `labeled` trigger. Acceptable: scans settle well under this.
+          #
+          # status + conclusion come from ONE response (sorted by id, monotonic)
+          # so the two fields can't be read from different snapshots of "latest".
+          echo "Waiting for the Security Scan check on $SHA to settle..."
+          scan_q='[.check_runs[] | select(.name=="Security Scan")] | sort_by(.id) | last'
+          scan_conclusion=""
+          for _ in $(seq 1 72); do   # up to ~6 min (72 * 5s)
+            read -r scan_status scan_concl < <(
+              gh api "repos/$REPO/commits/$SHA/check-runs" \
+                --jq "$scan_q | \"\(.status // \"none\") \(.conclusion // \"none\")\"" 2>/dev/null || echo "")
+            if [ "${scan_status:-}" = "completed" ]; then
+              scan_conclusion="$scan_concl"
+              break
+            fi
+            sleep 5
+          done
+          case "$scan_conclusion" in
+            success | skipped | neutral)
+              echo "Security Scan is '$scan_conclusion' -- proceeding to re-run failed gates." ;;
+            "")
+              echo "Security Scan did not complete in time; nothing to re-run."; exit 0 ;;
+            *)
+              echo "Security Scan is '$scan_conclusion' (not passing); gate failures are correct -- nothing to re-run."; exit 0 ;;
+          esac
+
          # Every workflow whose first job is the reusable Security Gate. We
          # re-run one only when its LATEST run for this SHA is a completed
          # gate-failure (below), so a workflow that already re-ran via its own
@@ -120,7 +170,13 @@ jobs:
            )
            if [ "${gate_failed:-0}" -gt 0 ]; then
              echo "• $wf: Security Gate failed in run $id -- re-running"
-              gh run rerun "$id" || echo "::warning::$wf: could not re-run $id"
+              # `--repo` is REQUIRED: unlike the `gh api "repos/$REPO/..."` calls
+              # above (repo is in the URL path), `gh run rerun` resolves the repo
+              # from -R / GH_REPO / the local git remote. This job has no checkout,
+              # so without -R it dies client-side ("failed to determine base repo:
+              # ... not a git repository") and never reaches GitHub -- the silent
+              # failure that stranded Lint/Integration/E2E UI on #556 and #644.
+              gh run rerun "$id" --repo "$REPO" || echo "::warning::$wf: could not re-run $id"
            else
              echo "• $wf: run $id failed but not at the Security Gate -- skipping"
            fi
@@ -2,28 +2,25 @@ name: Rerun Security Gate

 # Stage 1 of a two-stage relay (the privileged half is rerun-security-gate-run.yml).
 #
-# When a skip-security-scan waiver could change verdict -- the label is added or
-# removed, or a review is submitted/dismissed -- the per-workflow `Security Gate`
-# pollers must re-run so they re-mirror the (now-flipped) single `Security Scan`
-# check. Re-running another workflow needs `actions: write`, but on a FORK PR the
-# `pull_request_review` token is read-only and held behind the fork-approval gate,
-# so it cannot re-run anything itself (see maintainer-approval-rerun.yml, which
-# solves the identical problem the same way). So this stage only RECORDS the PR
-# number as an artifact (read-only, works on forks); the privileged re-run runs in
+# When the skip-security-scan waiver could change verdict -- the label is added
+# or removed -- the per-workflow `Security Gate` pollers must re-run so they
+# re-mirror the (now-flipped) single `Security Scan` check. Re-running another
+# workflow needs `actions: write`, but on a FORK PR the `pull_request_target`
+# token is held behind the fork-approval gate, so it cannot re-run anything
+# itself (see maintainer-approval-rerun.yml, which solves the identical problem
+# the same way). So this stage only RECORDS the PR number as an artifact
+# (read-only, works on forks); the privileged re-run runs in
 # rerun-security-gate-run.yml on `workflow_run`, which gets a writable token even
 # for forks and is not held behind the fork-approval gate.
 # https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
 #
-# Triggers (the two halves of the maintainer waiver):
-#   - skip-security-scan labeled/unlabeled  -> the label half changed
-#   - a review submitted/dismissed          -> the approval half changed
+# Trigger: skip-security-scan labeled/unlabeled is the ONLY thing that can flip
+# the waiver (it is label-only -- see should-scan.sh; there is no approval half).
 # Other labels are ignored by the job `if:` below (stage 2 then no-ops).

 on:
  pull_request_target:
    types: [labeled, unlabeled]
-  pull_request_review:
-    types: [submitted, dismissed]

 permissions:
  contents: read
@@ -39,14 +36,8 @@ jobs:
  record:
    name: Record PR for gate re-run
    # Only when the waiver state could have changed: the skip-security-scan
-    # label was added/removed, or a DECISIVE review changed. A plain `commented`
-    # review can't flip the waiver -- should-scan.sh keys on the latest
-    # non-COMMENTED review -- so skip it; `approved`/`changes_requested` (and a
-    # `dismissed` event, whose review.state is `dismissed`) all can, so they
-    # pass. Unrelated labels record nothing, so stage 2 no-ops.
-    if: >-
-      (github.event_name == 'pull_request_review' && github.event.review.state != 'commented') ||
-      github.event.label.name == 'skip-security-scan'
+    # label was added/removed. Unrelated labels record nothing, so stage 2 no-ops.
+    if: github.event.label.name == 'skip-security-scan'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
@@ -26,7 +26,7 @@ jobs:
    timeout-minutes: 8
    steps:
      - name: Check out trust check from main
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          ref: main             # trusted; never the PR head
          sparse-checkout: .github/scripts/security-scan
@@ -61,11 +61,11 @@ jobs:
          # workflow RUN with conclusion=action_required and NO check-run, so the
          # poll below never sees it and spins the full ~6 min before failing
          # open. Detect the held state and proceed now (same fail-open outcome);
-          # the gate re-runs on the next push or e2e-approved label event.
+          # the gate re-runs on the next push or maintainer approval event.
          held=$(gh api "repos/$REPO/actions/runs?head_sha=$HEAD_SHA&event=pull_request" \
            --jq '[.workflow_runs[] | select(.name=="Security Scan")] | sort_by(.created_at) | last | .conclusion' 2>/dev/null || echo "")
          if [ "$held" = "action_required" ]; then
-            echo "::warning::Security Scan is awaiting maintainer approval (action_required); proceeding (fail-open). It will re-gate on the next push or the e2e-approved label event."
+            echo "::warning::Security Scan is awaiting maintainer approval (action_required); proceeding (fail-open). It will re-gate on the next push or maintainer approval event."
            exit 0
          fi
          q='[.check_runs[] | select(.name=="Security Scan")] | sort_by(.started_at) | last'
@@ -22,22 +22,16 @@ name: Security Scan

 on:
  pull_request:
-    # labeled/unlabeled so applying or removing the maintainer skip label
-    # (skip-security-scan) re-runs the scan and flips this check.
+    # labeled/unlabeled so applying or removing the skip label
+    # (skip-security-scan) re-runs the scan and flips this check. The waiver is
+    # label-only (should-scan.sh): applying it needs Triage permission, so the
+    # label alone is the maintainer gate -- no separate approval, hence no
+    # pull_request_review trigger.
    types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled]
-  # A maintainer's approval is the OTHER half of the skip-security-scan waiver
-  # (the label alone is not maintainer-effective -- see should-scan.sh). Without
-  # this trigger a PR that is labeled FIRST and approved LATER never re-runs, so
-  # the stale failing check sticks. `submitted` flips the check once a maintainer
-  # approves; `dismissed` re-gates if that approval is later removed. should-scan.sh
-  # already accepts the pull_request_review payload (same pull_request +
-  # author_association fields), so no script change is needed.
-  pull_request_review:
-    types: [submitted, dismissed]

 permissions:
  contents: read
-  pull-requests: read   # read PR labels + reviews for the maintainer skip waiver
+  pull-requests: read   # read PR labels for the skip waiver

 concurrency:
  group: security-scan-${{ github.event.pull_request.number }}
@@ -53,7 +47,7 @@ jobs:
      UV_INDEX_URL: https://pypi.org/simple
    steps:
      - name: Check out scanner from main
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          ref: main             # trusted; never the PR head
          sparse-checkout: |
@@ -74,7 +68,7 @@ jobs:
        env:
          EVENT_NAME: ${{ github.event_name }}
          AUTHOR_ASSOCIATION: ${{ github.event.pull_request.author_association }}
-          # For the maintainer-effective skip-security-scan waiver (read-only).
+          # For the skip-security-scan label waiver + author check (read-only).
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          PR: ${{ github.event.pull_request.number }}
@@ -121,7 +115,7 @@ jobs:

      - name: Check out PR head for static analysis
        if: ${{ steps.gate.outputs.scan == 'true' }}
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          ref: ${{ github.event.pull_request.head.sha }}  # untrusted: only statically scanned
          path: pr
@@ -162,14 +156,14 @@ jobs:

      # Surfaced on ANY detector failure above (sensitive-path / secret / exfil
      # / workflow-misuse / semgrep): the detectors say WHAT they found; this
-      # says HOW a maintainer can waive it. The waiver needs BOTH a maintainer
-      # approval AND the label -- the label alone is not maintainer-effective
-      # (see should-scan.sh). Either action re-runs this scan via the labeled /
-      # pull_request_review triggers above.
+      # says HOW a maintainer can waive it. The waiver is label-only: applying
+      # the 'skip-security-scan' label needs Triage permission, so the label is
+      # itself the maintainer gate (see should-scan.sh). Applying it re-runs this
+      # scan via the labeled trigger above.
      - name: Explain the maintainer waiver (on failure)
        if: ${{ failure() }}
        run: |
-          MSG="A maintainer can skip the Security Scan by approving this PR AND applying the 'skip-security-scan' label (the label alone is not enough -- the author must be a maintainer or a maintainer must have approved). Either action re-runs this scan automatically."
+          MSG="A maintainer can skip the Security Scan by applying the 'skip-security-scan' label (this requires Triage permission, so a fork author cannot self-waive). Applying the label re-runs this scan automatically."
          echo "::error::$MSG"
          {
            echo "### Security Scan failed"
@@ -41,7 +41,9 @@ repos:
        language: system
        entry: npm --prefix ap-web exec -- prettier --write
        files: ^ap-web/.*\.(css|html|js|jsx|json|md|mdx|ts|tsx|yaml|yml)$
-        exclude: ^omnigent/server/static/web-ui/assets/
+        # Exclude generated assets: web-ui build output and Apple Icon
+        # Composer `.icon` bundles (machine-formatted; prettier fights the tooling).
+        exclude: ^(omnigent/server/static/web-ui/assets/|ap-web/electron/icons/.*\.icon/)

      # Local `uv` runs rewrite uv.lock's registry to whatever index is
      # configured on the developer's machine (e.g. the Databricks PyPI
@@ -63,7 +65,9 @@ repos:
        exclude: \.(md|svg)$
      - id: end-of-file-fixer
        name: ensure files end with newline
-        exclude: \.(md|svg)$
+        # AppIcon.icon/ is generated by Apple's Icon Composer, which writes
+        # icon.json without a trailing newline — don't "fix" it.
+        exclude: (\.(md|svg)$|/AppIcon\.icon/)
      - id: check-yaml
        name: check yaml syntax
        # docker-compose override files use non-standard tags
@@ -3,3 +3,6 @@ dist
 ../omnigent/server/static/web-ui
 src/components/ui
 package-lock.json
+
+# Generated Apple Icon Composer bundles (machine-formatted; prettier fights the tooling)
+electron/icons/**/*.icon
@@ -1,16 +0,0 @@
-<svg width="1024" height="1024" viewBox="0 0 1024 1024" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_26_3760)">
-<path d="M601.6 0C749.453 0 823.381 0.000134204 879.854 28.7744C929.528 54.085 969.915 94.4718 995.226 144.146C1024 200.619 1024 274.547 1024 422.4V601.6C1024 749.453 1024 823.381 995.226 879.854C969.915 929.528 929.528 969.915 879.854 995.226C823.381 1024 749.453 1024 601.6 1024H422.4C274.547 1024 200.619 1024 144.146 995.226C94.4718 969.915 54.085 929.528 28.7744 879.854C0.000134204 823.381 0 749.453 0 601.6V422.4C0 274.547 0.000134204 200.619 28.7744 144.146C54.085 94.4718 94.4718 54.085 144.146 28.7744C200.619 0.000134204 274.547 0 422.4 0H601.6ZM386.4 60C272.15 60 215.024 59.9997 171.386 82.2344C133.001 101.793 101.793 133.001 82.2344 171.386C59.9997 215.024 60 272.15 60 386.4V637.6C60 751.85 59.9997 808.976 82.2344 852.614C101.793 890.999 133.001 922.207 171.386 941.766C215.024 964 272.15 964 386.4 964H637.6C751.85 964 808.976 964 852.614 941.766C890.999 922.207 922.207 890.999 941.766 852.614C964 808.976 964 751.85 964 637.6V386.4C964 272.15 964 215.024 941.766 171.386C922.207 133.001 890.999 101.793 852.614 82.2344C808.976 59.9997 751.85 60 637.6 60H386.4Z" fill="url(#paint0_linear_26_3760)"/>
-<rect x="60" y="60" width="904" height="904" rx="204" stroke="#DADADA" stroke-opacity="0.6" stroke-width="5"/>
-</g>
-<defs>
-<linearGradient id="paint0_linear_26_3760" x1="147" y1="-98.5" x2="966" y2="1039.5" gradientUnits="userSpaceOnUse">
-<stop stop-color="white"/>
-<stop offset="0.5" stop-color="#939393"/>
-<stop offset="1" stop-color="#B6B6B6"/>
-</linearGradient>
-<clipPath id="clip0_26_3760">
-<rect width="1024" height="1024" fill="white"/>
-</clipPath>
-</defs>
-</svg>
@@ -1,73 +1,57 @@
 {
-  "fill": {
-    "automatic-gradient": "display-p3:0.17673,0.38168,0.68246,1.00000",
-    "orientation": {
-      "start": {
-        "x": 0.5,
-        "y": 0
+  "fill" : {
+    "linear-gradient" : [
+      "display-p3:0.12164,0.15594,0.26582,1.00000",
+      "display-p3:0.11859,0.15173,0.25830,1.00000"
+    ],
+    "orientation" : {
+      "start" : {
+        "x" : 0.5,
+        "y" : 0
      },
-      "stop": {
-        "x": 0.5,
-        "y": 0.7
+      "stop" : {
+        "x" : 0.5,
+        "y" : 0.7
      }
    }
  },
-  "groups": [
+  "groups" : [
    {
-      "layers": [
+      "layers" : [
        {
-          "image-name": "SVG Image.svg",
-          "name": "SVG Image",
-          "position": {
-            "scale": 1.05,
-            "translation-in-points": [0, 0]
+          "image-name" : "SVG Image.svg",
+          "name" : "SVG Image",
+          "position" : {
+            "scale" : 1.05,
+            "translation-in-points" : [
+              0,
+              0
+            ]
          }
        }
      ],
-      "position": {
-        "scale": 0.85,
-        "translation-in-points": [0, 0]
+      "position" : {
+        "scale" : 1,
+        "translation-in-points" : [
+          0,
+          0
+        ]
      },
-      "shadow": {
-        "kind": "layer-color",
-        "opacity": 0.5
+      "shadow" : {
+        "kind" : "layer-color",
+        "opacity" : 0.5
      },
-      "specular": true,
-      "translucency": {
-        "enabled": false,
-        "value": 0.5
-      }
-    },
-    {
-      "blend-mode-specializations": [
-        {
-          "appearance": "dark",
-          "value": "soft-light"
-        },
-        {
-          "appearance": "tinted",
-          "value": "overlay"
-        }
-      ],
-      "layers": [
-        {
-          "image-name": "SVG Image 6.svg",
-          "name": "SVG Image 6"
-        }
-      ],
-      "shadow": {
-        "kind": "neutral",
-        "opacity": 0.5
-      },
-      "specular": false,
-      "translucency": {
-        "enabled": false,
-        "value": 0.5
+      "specular" : true,
+      "translucency" : {
+        "enabled" : false,
+        "value" : 0.5
      }
    }
  ],
-  "supported-platforms": {
-    "circles": ["watchOS"],
-    "squares": "shared"
+  "supported-platforms" : {
+    "circles" : [
+      "watchOS"
+    ],
+    "squares" : "shared"
  }
-}
+}
@@ -1,7 +1,7 @@
 {
  "name": "omnigent-desktop-electron",
  "productName": "Omnigent",
-  "version": "0.1.0",
+  "version": "0.1.1",
  "description": "Omnigent desktop shell (Electron edition) — a thin native wrapper around the server-served web UI.",
  "private": true,
  "main": "src/main.js",
@@ -1677,6 +1677,9 @@ function registerIpc() {
      title,
      body: String(params?.body ?? ""),
    });
+    // In-app path the SPA wants opened on click (e.g. "/c/conv_abc"). Captured
+    // here so the click handler can tell the renderer where to route.
+    const navigatePath = typeof params?.navigatePath === "string" ? params.navigatePath : "";
    // Focus the window that fired the notification (so a click lands on the
    // right one in a multi-window setup), falling back to any open window.
    notification.on("click", () => {
@@ -1685,6 +1688,17 @@ function registerIpc() {
        if (win.isMinimized()) win.restore();
        win.focus();
      }
+      // Route only the originating window (it owns that conversation's state).
+      // isDestroyed() and send() aren't atomic — the window can close between
+      // them — so the try/catch absorbs the benign "Object has been destroyed"
+      // throw instead of crashing the main process from this async callback.
+      if (navigatePath && !event.sender.isDestroyed()) {
+        try {
+          event.sender.send("omnigent:notification-activated", navigatePath);
+        } catch {
+          // Sender went away after the notification was posted; nothing to do.
+        }
+      }
    });
    notification.show();
    signalForeground();
@@ -27,13 +27,31 @@ contextBridge.exposeInMainWorld("omnigentDesktop", {
  },
  /**
   * Fire an OS notification. Resolves true when shown, false otherwise.
-   * @param {{title: string, body?: string}} params
+   * @param {{title: string, body?: string, navigatePath?: string}} params
   */
  notify: (params) =>
    ipcRenderer.invoke("omnigent:notify", {
      title: params?.title,
      body: params?.body,
+      navigatePath: params?.navigatePath,
    }),
+  /**
+   * Subscribe to OS-notification clicks. The main process sends the in-app
+   * path the clicked notification carried, which we forward to the SPA so it
+   * can route there. Returns an unsubscribe function.
+   * @param {(path: string) => void} callback
+   * @returns {() => void}
+   */
+  onNotificationActivated: (callback) => {
+    const listener = (_event, path) => {
+      // Defense-in-depth: only forward in-app, same-origin paths. A leading
+      // "/" rejects absolute/cross-origin URLs and `javascript:` shapes before
+      // the renderer routes on the value, even if main ever sends junk.
+      if (typeof path === "string" && path.startsWith("/")) callback(path);
+    };
+    ipcRenderer.on("omnigent:notification-activated", listener);
+    return () => ipcRenderer.removeListener("omnigent:notification-activated", listener);
+  },
  /**
   * Title-bar server picker data: the window's current server origin and the
   * recently-connected server URLs (most recent first). Resolves null on
@@ -97,13 +97,13 @@
      "license": "MIT"
    },
    "node_modules/@ai-sdk/gateway": {
-      "version": "3.0.127",
-      "resolved": "https://registry.npmjs.org/@ai-sdk/gateway/-/gateway-3.0.127.tgz",
-      "integrity": "sha512-Obmw5hmE5x+ccRrMp/Djx5r0rpFVX87YqE6OY06g5fwYlRI30dA84ARfTzX45ivCvkW4eCnBpOVXVWQ/pjH85w==",
+      "version": "3.0.129",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/gateway/-/gateway-3.0.129.tgz",
+      "integrity": "sha512-KEQpZGJuCksc4iFxYtVHeHHG7yH0izGFzJLmRZlriI0hFIzJF9bT2AzJoaTHUI6minlxtP0WKYh84dP18o/Cuw==",
      "license": "Apache-2.0",
      "dependencies": {
        "@ai-sdk/provider": "3.0.10",
-        "@ai-sdk/provider-utils": "4.0.27",
+        "@ai-sdk/provider-utils": "4.0.29",
        "@vercel/oidc": "3.2.0"
      },
      "engines": {
@@ -126,9 +126,9 @@
      }
    },
    "node_modules/@ai-sdk/provider-utils": {
-      "version": "4.0.27",
-      "resolved": "https://registry.npmjs.org/@ai-sdk/provider-utils/-/provider-utils-4.0.27.tgz",
-      "integrity": "sha512-ubkAJ+xODouwtmN1tYlvTPphH1hPOBfZaEQe8U7skGvFAnIRs9PPpsq57bC2+Ky/MB4yzhd6YOsxTAx9sGpazw==",
+      "version": "4.0.29",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/provider-utils/-/provider-utils-4.0.29.tgz",
+      "integrity": "sha512-uhukHaCBvqkwBHkT8C2PrnqKTCoLn3pdHXqtcR9I8ErH+flbzgW4o7VHSNIup9LRu+WBvZIZDQLsx6rwl2tiOA==",
      "license": "Apache-2.0",
      "dependencies": {
        "@ai-sdk/provider": "3.0.10",
@@ -889,9 +889,9 @@
      }
    },
    "node_modules/@csstools/css-color-parser": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-4.1.1.tgz",
-      "integrity": "sha512-eZ5XOtyhK+mggRafYUWzA0tvaYOFgdY8AkgQiCJF9qNAePnUo/zmsqqYubBBb3sQ8uNUaSKTY9s9klfRaAXL0g==",
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-4.1.3.tgz",
+      "integrity": "sha512-DOgvIPkikIOixQRlD4YF31VN6fLLUTdrzhfRbis8vm0kMTgIbEPX0Ip/YX9fOeV9iywAS4sUUbTclpan7yYP8Q==",
      "dev": true,
      "funding": [
        {
@@ -1068,9 +1068,9 @@
      }
    },
    "node_modules/@dotenvx/dotenvx": {
-      "version": "1.71.2",
-      "resolved": "https://registry.npmjs.org/@dotenvx/dotenvx/-/dotenvx-1.71.2.tgz",
-      "integrity": "sha512-Xj9T3Wr+Bo4ILKf9PZJBYJ4SJiZGC/pqIdzOMbX9jgAFb0oGuKkusLleYHN/N6zanZixNvmuMVWYR1T3YJuVTA==",
+      "version": "1.71.3",
+      "resolved": "https://registry.npmjs.org/@dotenvx/dotenvx/-/dotenvx-1.71.3.tgz",
+      "integrity": "sha512-WSmox5aD+XxJEUEOTk7gKLpd5+Iz9Nik89Zpbu5DijMln6LsFiv3xpNKBMc/b9sSkUlKvAblzrhik2TqKFE7NA==",
      "license": "BSD-3-Clause",
      "dependencies": {
        "commander": "^11.1.0",
@@ -1771,9 +1771,9 @@
      }
    },
    "node_modules/@lobehub/ui": {
-      "version": "5.15.12",
-      "resolved": "https://registry.npmjs.org/@lobehub/ui/-/ui-5.15.12.tgz",
-      "integrity": "sha512-Pyie7j2UzbdTDqCdHjR3J9dw6ewpoqHDrwnkWWMDtJpqeEzPywLhwen90DQ6ETHfXrlbsIfuczgoEkBKirtAPg==",
+      "version": "5.15.15",
+      "resolved": "https://registry.npmjs.org/@lobehub/ui/-/ui-5.15.15.tgz",
+      "integrity": "sha512-nbake8F9Lp6/g1AaBnbt+l0Q8/u5/RjpSeE67ABOf5BV2MMV4Vhac5rTkkS7F4DpRYXug7i4A/ZvGwn3/F+jmA==",
      "license": "MIT",
      "dependencies": {
        "@ant-design/cssinjs": "^2.1.2",
@@ -1789,30 +1789,30 @@
        "@giscus/react": "^3.1.0",
        "@mdx-js/mdx": "^3.1.1",
        "@mdx-js/react": "^3.1.1",
-        "@pierre/diffs": "^1.1.19",
-        "@radix-ui/react-slot": "^1.2.4",
-        "@shikijs/core": "^4.0.2",
-        "@shikijs/transformers": "^4.0.2",
+        "@pierre/diffs": "1.2.8",
+        "@radix-ui/react-slot": "^1.2.5",
+        "@shikijs/core": "^4.2.0",
+        "@shikijs/transformers": "^4.2.0",
        "@splinetool/runtime": "0.9.526",
        "ahooks": "^3.9.7",
        "antd-style": "^4.1.0",
        "chroma-js": "^3.2.0",
        "class-variance-authority": "^0.7.1",
        "clsx": "^2.1.1",
-        "dayjs": "^1.11.20",
+        "dayjs": "^1.11.21",
        "emoji-mart": "^5.6.0",
-        "es-toolkit": "^1.46.0",
+        "es-toolkit": "^1.47.0",
        "fast-deep-equal": "^3.1.3",
-        "immer": "^11.1.4",
-        "katex": "^0.16.45",
+        "immer": "^11.1.8",
+        "katex": "^0.16.47",
        "leva": "^0.10.1",
-        "lucide-react": "^1.11.0",
+        "lucide-react": "^1.17.0",
        "marked": "^17.0.6",
-        "mermaid": "^11.14.0",
-        "motion": "^12.38.0",
+        "mermaid": "^11.15.0",
+        "motion": "^12.40.0",
        "numeral": "^2.0.6",
        "polished": "^4.3.1",
-        "query-string": "^9.3.1",
+        "query-string": "^9.4.0",
        "rc-collapse": "^4.0.0",
        "rc-footer": "^0.6.8",
        "rc-image": "^7.12.0",
@@ -1820,8 +1820,8 @@
        "rc-menu": "^9.16.1",
        "re-resizable": "^6.11.2",
        "react-avatar-editor": "^15.1.0",
-        "react-error-boundary": "^6.1.1",
-        "react-hotkeys-hook": "^5.2.4",
+        "react-error-boundary": "^6.1.2",
+        "react-hotkeys-hook": "^5.3.2",
        "react-markdown": "^10.1.0",
        "react-merge-refs": "^3.0.2",
        "react-rnd": "^10.5.3",
@@ -1835,14 +1835,14 @@
        "remark-github": "^12.0.0",
        "remark-math": "^6.0.0",
        "remend": "^1.3.0",
-        "shiki": "^4.0.2",
-        "shiki-stream": "^0.1.4",
+        "shiki": "^4.2.0",
+        "shiki-stream": "^0.1.5",
        "swr": "^2.4.1",
        "ts-md5": "^2.0.1",
        "unified": "^11.0.5",
        "url-join": "^5.0.0",
        "use-merge-value": "^1.2.0",
-        "uuid": "^13.0.0",
+        "uuid": "^13.0.2",
        "virtua": "^0.49.1"
      },
      "peerDependencies": {
@@ -2004,14 +2004,14 @@
      "license": "MIT"
    },
    "node_modules/@napi-rs/wasm-runtime": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
-      "integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==",
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.5.tgz",
+      "integrity": "sha512-AWPoBRJ9tsnVhor4sjO7rkni+7p+2IAEFj6cx06UgP10jkQHqay/36uRV/bFkgrh18D9vb4cr8Q0Pthskgzy+Q==",
      "dev": true,
      "license": "MIT",
      "optional": true,
      "dependencies": {
-        "@tybys/wasm-util": "^0.10.1"
+        "@tybys/wasm-util": "^0.10.2"
      },
      "funding": {
        "type": "github",
@@ -4102,9 +4102,9 @@
      "license": "MIT"
    },
    "node_modules/@rc-component/async-validator": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/@rc-component/async-validator/-/async-validator-5.1.1.tgz",
-      "integrity": "sha512-T03+Wk31Kz/28OC+rLlHtSNwD5Io3OWw6rPFPAp898sqALB/XnTrr3trB3mPoj379v0aRaW6t09HUG6dUyHR3g==",
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@rc-component/async-validator/-/async-validator-6.0.0.tgz",
+      "integrity": "sha512-D3AGQwdyE58gmvx6waVSXJ80JGO+IY5L2O8HDnSOex7JNlzB3GuN/4hyHNTdhy2qtOhkpbIjmeAN3tL993wKbA==",
      "license": "MIT",
      "dependencies": {
        "@babel/runtime": "^7.24.4"
@@ -4114,14 +4114,14 @@
      }
    },
    "node_modules/@rc-component/cascader": {
-      "version": "1.15.0",
-      "resolved": "https://registry.npmjs.org/@rc-component/cascader/-/cascader-1.15.0.tgz",
-      "integrity": "sha512-ZzpMtwFCRo3fbXHuDnncARJMZQjdqA2w7aDuPofNQt+aDx39st1hgfIpEwTBLhe2Hqsvs/zOr8RTtgxTkCPySw==",
+      "version": "1.16.1",
+      "resolved": "https://registry.npmjs.org/@rc-component/cascader/-/cascader-1.16.1.tgz",
+      "integrity": "sha512-wxLopwM+EBed0zNNGdnGE4coYoqcO+XD42fHgn+pDvO+XzhNFbdgSlSNXdKocIYqccvqgWvoxDPNb0OVRdi59A==",
      "license": "MIT",
      "dependencies": {
-        "@rc-component/select": "~1.6.0",
-        "@rc-component/tree": "~1.3.0",
-        "@rc-component/util": "^1.4.0",
+        "@rc-component/select": "~1.7.1",
+        "@rc-component/tree": "~1.3.2",
+        "@rc-component/util": "^1.11.1",
        "clsx": "^2.1.1"
      },
      "peerDependencies": {
@@ -4235,12 +4235,12 @@
      }
    },
    "node_modules/@rc-component/form": {
-      "version": "1.8.2",
-      "resolved": "https://registry.npmjs.org/@rc-component/form/-/form-1.8.2.tgz",
-      "integrity": "sha512-ZidCvOLmM9Xr+3vzk4UAoR7Aj1W/5IHyrzlBB7sNkygpTeRVrohQSo4TN7W/nARTH+nt8zSAPsn4BEl4zLEO2g==",
+      "version": "1.8.3",
+      "resolved": "https://registry.npmjs.org/@rc-component/form/-/form-1.8.3.tgz",
+      "integrity": "sha512-jNkat3uxZ246ELudKwnjQhnDI8+rSxgLxjztvQU3Mrb0G+LwDyOrPu9RNfekOjqU5GQ5QJepi225x+9LhCizJw==",
      "license": "MIT",
      "dependencies": {
-        "@rc-component/async-validator": "^5.1.0",
+        "@rc-component/async-validator": "^6.0.0",
        "@rc-component/util": "^1.11.1",
        "clsx": "^2.1.1"
      },
@@ -4409,12 +4409,12 @@
      }
    },
    "node_modules/@rc-component/pagination": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/@rc-component/pagination/-/pagination-1.2.0.tgz",
-      "integrity": "sha512-YcpUFE8dMLfSo6OARJlK6DbHHvrxz7pMGPGmC/caZSJJz6HRKHC1RPP001PRHCvG9Z/veD039uOQmazVuLJzlw==",
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@rc-component/pagination/-/pagination-1.3.0.tgz",
+      "integrity": "sha512-12ahTY+HPITg1L2bjWKXUqBJe/oOnpA2QsChdCjthqLVf/e19StiCsv8OLKpWoHbc+8PFEkNjRqRqrLoRBHjFw==",
      "license": "MIT",
      "dependencies": {
-        "@rc-component/util": "^1.3.0",
+        "@rc-component/util": "^1.11.1",
        "clsx": "^2.1.1"
      },
      "peerDependencies": {
@@ -4492,9 +4492,9 @@
      }
    },
    "node_modules/@rc-component/qrcode": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@rc-component/qrcode/-/qrcode-1.1.2.tgz",
-      "integrity": "sha512-CTXG18eP3sO3gc+96ep9HyVI/RzMup7L59apM/D0wWo1SHRdwOb7xyD4bMbmpu4dPlTch59Kxb8lU7U9ME60fg==",
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@rc-component/qrcode/-/qrcode-2.0.0.tgz",
+      "integrity": "sha512-aAv3QhPP1xyafuTZOxub6a54pCeBnN3IwQkpETrBtthq4BL5IgxnCbuoBWPDpdLw1y1j6BgBUCAKV92+yX06Dw==",
      "license": "MIT",
      "dependencies": {
        "@babel/runtime": "^7.24.7"
@@ -4554,15 +4554,15 @@
      }
    },
    "node_modules/@rc-component/select": {
-      "version": "1.6.15",
-      "resolved": "https://registry.npmjs.org/@rc-component/select/-/select-1.6.15.tgz",
-      "integrity": "sha512-SyVCWnqxCQZZcQvQJ/CxSjx2bGma6ds/HtnpkIfZVnt6RoEgbqUmHgD6vrzNarNXwbLXerwVzWwq8F3d1sst7g==",
+      "version": "1.7.1",
+      "resolved": "https://registry.npmjs.org/@rc-component/select/-/select-1.7.1.tgz",
+      "integrity": "sha512-GZ1cMJk2xQh0VHyOQjjG8drYL4iu24NcbkXioUcReQOCUr+ub/3fmRonZe6cRPEZhWMbJdeHsqnEltogDaZ5Tg==",
      "license": "MIT",
      "dependencies": {
        "@rc-component/overflow": "^1.0.0",
        "@rc-component/trigger": "^3.0.0",
-        "@rc-component/util": "^1.3.0",
-        "@rc-component/virtual-list": "^1.0.1",
+        "@rc-component/util": "^1.11.1",
+        "@rc-component/virtual-list": "^1.2.0",
        "clsx": "^2.1.1"
      },
      "engines": {
@@ -4716,12 +4716,12 @@
      }
    },
    "node_modules/@rc-component/tree-select": {
-      "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/@rc-component/tree-select/-/tree-select-1.9.0.tgz",
-      "integrity": "sha512-GXcFe15a+trUl1/J3OHWQhsVWFpwFpGFK2cqYWZ1sK22Zs3KZTvMwDpzr75PIo1s6QVioVxpE/pRwRopkeDQ6w==",
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/@rc-component/tree-select/-/tree-select-1.10.0.tgz",
+      "integrity": "sha512-E1U4pn2LAbXEhLJdzIzid7WYbIuFbkTIctuFoeC6weppf8UbPR3+YYB6/ay0c0ksand4gXMRQpa1Z60Auo7VJA==",
      "license": "MIT",
      "dependencies": {
-        "@rc-component/select": "~1.6.0",
+        "@rc-component/select": "~1.7.0",
        "@rc-component/tree": "~1.3.0",
        "@rc-component/util": "^1.4.0",
        "clsx": "^2.1.1"
@@ -5196,6 +5196,34 @@
        "node": ">=20"
      }
    },
+    "node_modules/@shikijs/stream": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/@shikijs/stream/-/stream-4.2.0.tgz",
+      "integrity": "sha512-OaMUUStdIZ+l1GJad9uVACR3Xvgwo4y+RmEuDMU62cgFMMg1IBCaIFmvzAR2HiCpGtwoc/qPfpNnP+ivgrPXZg==",
+      "license": "MIT",
+      "dependencies": {
+        "@shikijs/core": "4.2.0"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "peerDependencies": {
+        "react": "^19.0.0",
+        "solid-js": "^1.9.0",
+        "vue": "^3.2.0"
+      },
+      "peerDependenciesMeta": {
+        "react": {
+          "optional": true
+        },
+        "solid-js": {
+          "optional": true
+        },
+        "vue": {
+          "optional": true
+        }
+      }
+    },
    "node_modules/@shikijs/themes": {
      "version": "4.2.0",
      "resolved": "https://registry.npmjs.org/@shikijs/themes/-/themes-4.2.0.tgz",
@@ -6747,9 +6775,9 @@
      "license": "MIT"
    },
    "node_modules/@types/node": {
-      "version": "24.13.1",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.1.tgz",
-      "integrity": "sha512-RSpUJGmvsJ1ZeBehQZFhIdpsz+bIpES0nIQXko4Ybq+N+kX6XvOq3Jo+iJ82FWLdblFq85AsMikd3m35jgezYg==",
+      "version": "24.13.2",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.2.tgz",
+      "integrity": "sha512-fRa09kZTgu8o71KFcDjUFuc7F+dEbZYZmkI0mg5YBTRs0yMKjYHsq/c0urDKeDb+D5qVgXOdFcuu+DZPKOITwA==",
      "license": "MIT",
      "dependencies": {
        "undici-types": "~7.18.0"
@@ -7151,9 +7179,9 @@
      }
    },
    "node_modules/acorn": {
-      "version": "8.16.0",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.16.0.tgz",
-      "integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==",
+      "version": "8.17.0",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.17.0.tgz",
+      "integrity": "sha512-xRQbDb9BnwDafYNn6Vwl839DYVjqXYb1XVGtWAZ1kcDc6iwAL4hg3B1dZlRiuENFeO2H53gFG3in621AdERVAg==",
      "license": "MIT",
      "bin": {
        "acorn": "bin/acorn"
@@ -7203,14 +7231,14 @@
      }
    },
    "node_modules/ai": {
-      "version": "6.0.199",
-      "resolved": "https://registry.npmjs.org/ai/-/ai-6.0.199.tgz",
-      "integrity": "sha512-6H9RPEjzBQECM+eU1JxAh6jHcZPU/6q5QZ8D8QV8agubf0Mm/kcBlwqrFcFtup6RQzmEvMkVaQOoLCZ8bQ13lA==",
+      "version": "6.0.203",
+      "resolved": "https://registry.npmjs.org/ai/-/ai-6.0.203.tgz",
+      "integrity": "sha512-2Qi1ZPGF/FnlvnRqntVgRbUYGeA5ZKFYwTtgu8rcUzMmddArM/nLsvCW69Ip99B1cop6XHRHl+GCKk9t9B+GDA==",
      "license": "Apache-2.0",
      "dependencies": {
-        "@ai-sdk/gateway": "3.0.127",
+        "@ai-sdk/gateway": "3.0.129",
        "@ai-sdk/provider": "3.0.10",
-        "@ai-sdk/provider-utils": "4.0.27",
+        "@ai-sdk/provider-utils": "4.0.29",
        "@opentelemetry/api": "^1.9.0"
      },
      "engines": {
@@ -7316,54 +7344,54 @@
      }
    },
    "node_modules/antd": {
-      "version": "6.4.3",
-      "resolved": "https://registry.npmjs.org/antd/-/antd-6.4.3.tgz",
-      "integrity": "sha512-6H2avkxCGfxcF67r3J2mwm9Ck50el1pks/73vfM1wDsPL/tPtj5vHuauMgJFnrqmq7CH3g8aoZ0VBQbt+jpAsw==",
+      "version": "6.4.4",
+      "resolved": "https://registry.npmjs.org/antd/-/antd-6.4.4.tgz",
+      "integrity": "sha512-lgPz4KhfhiYddV/qPYo0ieqWimCVgV2OQF72mbeGNixE753JWNnmEc7UNGy08wBS/zZ7hxrmX0pc5aX7EUaIIg==",
      "license": "MIT",
      "dependencies": {
        "@ant-design/colors": "^8.0.1",
        "@ant-design/cssinjs": "^2.1.2",
        "@ant-design/cssinjs-utils": "^2.1.2",
        "@ant-design/fast-color": "^3.0.1",
-        "@ant-design/icons": "^6.2.3",
+        "@ant-design/icons": "^6.2.5",
        "@ant-design/react-slick": "~2.0.0",
        "@babel/runtime": "^7.29.2",
-        "@rc-component/cascader": "~1.15.0",
+        "@rc-component/cascader": "~1.16.1",
        "@rc-component/checkbox": "~2.0.0",
        "@rc-component/collapse": "~1.2.0",
        "@rc-component/color-picker": "~3.1.1",
        "@rc-component/dialog": "~1.9.0",
        "@rc-component/drawer": "~1.4.2",
        "@rc-component/dropdown": "~1.0.2",
-        "@rc-component/form": "~1.8.1",
+        "@rc-component/form": "~1.8.3",
        "@rc-component/image": "~1.9.0",
-        "@rc-component/input": "~1.3.0",
+        "@rc-component/input": "~1.3.1",
        "@rc-component/input-number": "~1.6.2",
        "@rc-component/mentions": "~1.9.0",
-        "@rc-component/menu": "~1.3.0",
-        "@rc-component/motion": "^1.3.2",
+        "@rc-component/menu": "~1.3.1",
+        "@rc-component/motion": "^1.3.3",
        "@rc-component/mutate-observer": "^2.0.1",
        "@rc-component/notification": "~2.0.7",
-        "@rc-component/pagination": "~1.2.0",
+        "@rc-component/pagination": "~1.3.0",
        "@rc-component/picker": "~1.10.0",
        "@rc-component/progress": "~1.0.2",
-        "@rc-component/qrcode": "~1.1.1",
+        "@rc-component/qrcode": "~2.0.0",
        "@rc-component/rate": "~1.0.1",
        "@rc-component/resize-observer": "^1.1.2",
        "@rc-component/segmented": "~1.3.0",
-        "@rc-component/select": "~1.6.15",
+        "@rc-component/select": "~1.7.1",
        "@rc-component/slider": "~1.0.1",
        "@rc-component/steps": "~1.2.2",
        "@rc-component/switch": "~1.0.3",
-        "@rc-component/table": "~1.10.0",
-        "@rc-component/tabs": "~1.9.0",
+        "@rc-component/table": "~1.10.2",
+        "@rc-component/tabs": "~1.9.1",
        "@rc-component/tooltip": "~1.4.0",
        "@rc-component/tour": "~2.4.0",
-        "@rc-component/tree": "~1.3.1",
-        "@rc-component/tree-select": "~1.9.0",
-        "@rc-component/trigger": "^3.9.0",
-        "@rc-component/upload": "~1.1.0",
-        "@rc-component/util": "^1.11.0",
+        "@rc-component/tree": "~1.3.2",
+        "@rc-component/tree-select": "~1.10.0",
+        "@rc-component/trigger": "^3.9.1",
+        "@rc-component/upload": "~1.1.1",
+        "@rc-component/util": "^1.11.1",
        "clsx": "^2.1.1",
        "dayjs": "^1.11.11",
        "scroll-into-view-if-needed": "^3.1.0",
@@ -7458,9 +7486,9 @@
      }
    },
    "node_modules/ast-v8-to-istanbul": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/ast-v8-to-istanbul/-/ast-v8-to-istanbul-1.0.3.tgz",
-      "integrity": "sha512-jCMQ6ZylLPudp0CDfBmQBZUsrh1/8psbmu9ibeVWKuHWD0YrH9YABwlKu5kVEFoT0GCQQW9Z/SxfuEbbkGQCRg==",
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/ast-v8-to-istanbul/-/ast-v8-to-istanbul-1.0.4.tgz",
+      "integrity": "sha512-0bC0/4bTSrnwdhU3IsZDwEdojvuPrSg59OYZfKsLRtJZ0u8VBx9DebfqqG8bRdCC0I7vjgxmPi41P0lpkhJHtA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -7549,9 +7577,9 @@
      "license": "MIT"
    },
    "node_modules/baseline-browser-mapping": {
-      "version": "2.10.35",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.35.tgz",
-      "integrity": "sha512-honAfLBde0HAFLdNyBEfuuENkF6zR+ozxqxa/2zJKHBe1qzLqyTSeRKpdPEHAP03rlDGyQOPnCSxnVpVqQo9Mg==",
+      "version": "2.10.36",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.36.tgz",
+      "integrity": "sha512-lVq/Df7LXlO79MVaaUHztSwWiG9oXoWHlgvNS51v8Dpd4+G4/VIy6qYePTw31nAVls33nUtnfezYeLkYAak9dg==",
      "license": "Apache-2.0",
      "bin": {
        "baseline-browser-mapping": "dist/cli.cjs"
@@ -7745,9 +7773,9 @@
      }
    },
    "node_modules/caniuse-lite": {
-      "version": "1.0.30001797",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001797.tgz",
-      "integrity": "sha512-l8xKG+gwAIExZGl9FrF7KUwuOmk6wbEPC9Xoy/RtnWv1XG0Q4LFlagaLpUv3Kiza3W/wm27zy0yWJEieYKAP6w==",
+      "version": "1.0.30001799",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001799.tgz",
+      "integrity": "sha512-hG1bReV+OUU+MOqK4t/ZWI0tZOyz3rqS9XuhOUz1cIcbwBKjOyJEJuw9ER5JuNyqxNk8u/JUVbGibBOL1yrjFw==",
      "funding": [
        {
          "type": "opencollective",
@@ -8916,9 +8944,9 @@
      "license": "MIT"
    },
    "node_modules/dompurify": {
-      "version": "3.4.8",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.8.tgz",
-      "integrity": "sha512-yb1cEmaOum7wFvOCSQxyfgVlv5D47Rc30iZWoMpbDIWTnJ6grDDQyu2KFJzB2k7u0pMuJcQ1zphH//fFnw2tjQ==",
+      "version": "3.4.10",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.10.tgz",
+      "integrity": "sha512-0xzNv0e7oYC6yyuOGZIABPM4qtg3QxLFniDNPP4ZP90wR8Yq3zgwpRbrNiT4N3IKqDbbYFEJLV+JWEs19aZ//w==",
      "license": "(MPL-2.0 OR Apache-2.0)",
      "optionalDependencies": {
        "@types/trusted-types": "^2.0.7"
@@ -8983,9 +9011,9 @@
      "license": "MIT"
    },
    "node_modules/electron-to-chromium": {
-      "version": "1.5.370",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.370.tgz",
-      "integrity": "sha512-D5tSHJReAb/Kf3Hu9F/GO4lJuSWzEWHwvQ/kKSUP7pimNgvxkSKj+gUQhHpKKACwrin7rS3byU7IxreF56rl5g==",
+      "version": "1.5.372",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.372.tgz",
+      "integrity": "sha512-M3yhbAlilnwqC8D21t28UCDGHyitShTmmLRU/H+b74P6Ski16Nb9HONYEaVpMj/pwC7BEo5B95FpjODLCWbtfA==",
      "license": "ISC"
    },
    "node_modules/embla-carousel": {
@@ -9038,9 +9066,9 @@
      }
    },
    "node_modules/enhanced-resolve": {
-      "version": "5.23.0",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.23.0.tgz",
-      "integrity": "sha512-yJN/BOOLxcOW2aQgeif9mSnaUB8KtvmMMp56oA1kx1CRfBKbhZm2pJ+NBY+3eOboHxix8lfjWpHE0Ei5U8RbSA==",
+      "version": "5.24.0",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.24.0.tgz",
+      "integrity": "sha512-SkE2t82KlkkxQRVMVLAGKxLfORGQfrkx5dkj+vlgXRVNEdPc4eZcR+J/Fvj8C+yKSFH5L0q3NFlyufOVQnCcYQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -9133,9 +9161,9 @@
      }
    },
    "node_modules/es-toolkit": {
-      "version": "1.47.0",
-      "resolved": "https://registry.npmjs.org/es-toolkit/-/es-toolkit-1.47.0.tgz",
-      "integrity": "sha512-n1GuoD0WEQZMBk5tttoZSqwgyLx01oqa5XsBmCHwPyNe1S9jPBEmtR2pSgp2kJuWE3ciFZ6yRHmY4pM4C3OOkw==",
+      "version": "1.47.1",
+      "resolved": "https://registry.npmjs.org/es-toolkit/-/es-toolkit-1.47.1.tgz",
+      "integrity": "sha512-5RAqEwf4P4E17p+W75KLOWw/nOvKZzSQpxM32IpI2KZLaVonjTrZ0Ai5ghMaVI9eKC2p8eoQgcBdkEDgzFk6+Q==",
      "license": "MIT",
      "workspaces": [
        "docs",
@@ -11607,9 +11635,9 @@
      }
    },
    "node_modules/lucide-react": {
-      "version": "1.17.0",
-      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-1.17.0.tgz",
-      "integrity": "sha512-9FA9evdox/JQL5PT57fdA1x/yg8T7knJ98+zjTL3UfKza6pflQUUh3XtaQIHKvnsJw1lmsEyHVlt5jchYxOQ5w==",
+      "version": "1.18.0",
+      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-1.18.0.tgz",
+      "integrity": "sha512-LZDb7H/0YfM+RJncD0hDQRCAu+vSGODqpe35TuVI8EuXaRjkczbsx7p8dY4J87F/MUSj6bpYqeI8nw8qXaAdmA==",
      "license": "ISC",
      "peerDependencies": {
        "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0"
@@ -12046,9 +12074,9 @@
      "license": "CC0-1.0"
    },
    "node_modules/media-chrome": {
-      "version": "4.19.1",
-      "resolved": "https://registry.npmjs.org/media-chrome/-/media-chrome-4.19.1.tgz",
-      "integrity": "sha512-1+x2l0mNulHKZN0lBxGJwJ+TV2W/KzLjaAd//UCGZz8GE5O5YNafFskWTcv/D6Ty0d9drX9SSfimOzGwob8eVQ==",
+      "version": "4.19.2",
+      "resolved": "https://registry.npmjs.org/media-chrome/-/media-chrome-4.19.2.tgz",
+      "integrity": "sha512-4ai1ITN8wBhwugQcRgqe3tN0z6OSKGOXqHLNrS04MgKFfsLqu6Dm8MPq02pI9Y9ZKoXtFjIl85jOryIW9es3BA==",
      "license": "MIT",
      "dependencies": {
        "ce-la-react": "^0.3.2"
@@ -13358,9 +13386,9 @@
      }
    },
    "node_modules/obug": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.2.tgz",
-      "integrity": "sha512-AWGB9WFcRXOQs48Z/udjI5ZcZMHXwX8XPByNpOydgcGsDLIzjGizhoMWJyKAWze7AVW/2W1i+/gPX4YtKe5cyg==",
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.3.tgz",
+      "integrity": "sha512-9miFgM2OFba7hB+pRgvtV84pYTBaoTHohvmIgiRt6dRIzbwEOIaNaP+dIlGs2fNFoB0SeISs0Jz5WFVRid6Xyg==",
      "dev": true,
      "funding": [
        "https://github.com/sponsors/sxzz",
@@ -14005,9 +14033,9 @@
      }
    },
    "node_modules/prosemirror-model": {
-      "version": "1.25.7",
-      "resolved": "https://registry.npmjs.org/prosemirror-model/-/prosemirror-model-1.25.7.tgz",
-      "integrity": "sha512-A79aN8QEFUwI6cax8Yq4Rpcx1TJZ3Kagn+ii7qLo4/V8H3mMiHrhFyhTyHHvpSnOgMPpWiDGSwM3etwrxE50ug==",
+      "version": "1.25.8",
+      "resolved": "https://registry.npmjs.org/prosemirror-model/-/prosemirror-model-1.25.8.tgz",
+      "integrity": "sha512-BswA4BLSFEiORV6Vjj/yZBXDbos1zTEnhyeSSgT8psGFhstQS7UJ8/WOLiDos9Byaee27+tml0/DuMNxYR84zg==",
      "license": "MIT",
      "dependencies": {
        "orderedmap": "^2.0.0"
@@ -14058,12 +14086,12 @@
      }
    },
    "node_modules/prosemirror-view": {
-      "version": "1.41.8",
-      "resolved": "https://registry.npmjs.org/prosemirror-view/-/prosemirror-view-1.41.8.tgz",
-      "integrity": "sha512-TnKDdohEatgyZNGCDWIdccOHXhYloJwbwU+phw/a23KBvJIR9lWQWW7WHHK3vBdOLDNuF7TaX98GObUZOWkOnA==",
+      "version": "1.41.9",
+      "resolved": "https://registry.npmjs.org/prosemirror-view/-/prosemirror-view-1.41.9.tgz",
+      "integrity": "sha512-clTunTX+eaLbr87L1V1QPheRlEQJyTlL3gXe9x3jQIk3rL0RVWxviDGz8tFaydwIVm+hKhYCyr+R/zBtWr9s6A==",
      "license": "MIT",
      "dependencies": {
-        "prosemirror-model": "^1.20.0",
+        "prosemirror-model": "^1.25.8",
        "prosemirror-state": "^1.0.0",
        "prosemirror-transform": "^1.1.0"
      }
@@ -15557,9 +15585,9 @@
      }
    },
    "node_modules/semver": {
-      "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.3.tgz",
-      "integrity": "sha512-wnilbGyMxzbY7dNOl7jpKbLSjcfeweJWU5j4+u5qW+6/wuGD9KzIGOyZnQVSBM9E7DtWaaH3CyHkppYrKYoxwg==",
+      "version": "7.8.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.4.tgz",
+      "integrity": "sha512-rUCObTnP32Q08R2uuIrt7r9PlEonuTmtuXYcW6s5kjdlj3xbnwe+21yXptAUYcMAABLkYYTtnmzb3w3EDZfueA==",
      "license": "ISC",
      "bin": {
        "semver": "bin/semver.js"
@@ -15736,9 +15764,9 @@
      }
    },
    "node_modules/shadcn/node_modules/postcss-selector-parser": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.2.tgz",
-      "integrity": "sha512-Wjvt4scRFouioIInHf51IFNP4ltJ2EngJM+cZPGiqbKetBfmP3vpdPV8ID2S6JS6/jdo74N8+aEYH9lQr2C6sA==",
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.4.tgz",
+      "integrity": "sha512-HeP7D2wyhkR+XaK6v4W8oRF62Dsz4flyuczALJp61GckGm42u1saSSJ/0auvcBqxs3jMRFEcPK34At/0JBKdOg==",
      "license": "MIT",
      "dependencies": {
        "cssesc": "^3.0.0",
@@ -15798,12 +15826,13 @@
      }
    },
    "node_modules/shiki-stream": {
-      "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/shiki-stream/-/shiki-stream-0.1.4.tgz",
-      "integrity": "sha512-4pz6JGSDmVTTkPJ/ueixHkFAXY4ySCc+unvCaDZV7hqq/sdJZirRxgIXSuNSKgiFlGTgRR97sdu2R8K55sPsrw==",
+      "version": "0.1.5",
+      "resolved": "https://registry.npmjs.org/shiki-stream/-/shiki-stream-0.1.5.tgz",
+      "integrity": "sha512-DzkqVlqf02Tp4zTFNgJp+3rOG2RkuoONBq+Pm2sHslAlJ5M0QbR1devn4dr9SgcBTrtHTf6Rqyj3wVJi0g16Bw==",
+      "deprecated": "shiki-stream is now @shikijs/stream, please migrate by renaming the package",
      "license": "MIT",
      "dependencies": {
-        "@shikijs/core": "^3.0.0"
+        "@shikijs/stream": "^4.2.0"
      },
      "funding": {
        "url": "https://github.com/sponsors/antfu"
@@ -15825,28 +15854,6 @@
        }
      }
    },
-    "node_modules/shiki-stream/node_modules/@shikijs/core": {
-      "version": "3.23.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/core/-/core-3.23.0.tgz",
-      "integrity": "sha512-NSWQz0riNb67xthdm5br6lAkvpDJRTgB36fxlo37ZzM2yq0PQFFzbd8psqC2XMPgCzo1fW6cVi18+ArJ44wqgA==",
-      "license": "MIT",
-      "dependencies": {
-        "@shikijs/types": "3.23.0",
-        "@shikijs/vscode-textmate": "^10.0.2",
-        "@types/hast": "^3.0.4",
-        "hast-util-to-html": "^9.0.5"
-      }
-    },
-    "node_modules/shiki-stream/node_modules/@shikijs/types": {
-      "version": "3.23.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/types/-/types-3.23.0.tgz",
-      "integrity": "sha512-3JZ5HXOZfYjsYSk0yPwBrkupyYSLpAE26Qc0HLghhZNGTZg/SKxXIIgoxOpmmeQP0RRSDJTk1/vPfw9tbw+jSQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@shikijs/vscode-textmate": "^10.0.2",
-        "@types/hast": "^3.0.4"
-      }
-    },
    "node_modules/side-channel": {
      "version": "1.1.1",
      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
@@ -16497,9 +16504,9 @@
      }
    },
    "node_modules/ts-dedent": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/ts-dedent/-/ts-dedent-2.2.0.tgz",
-      "integrity": "sha512-q5W7tVM71e2xjHZTlgfTDoPF/SmqKG5hddq9SzR49CH2hayqRKJtQ4mtRlSxKaJlR/+9rEM+mnBHf7I2/BQcpQ==",
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/ts-dedent/-/ts-dedent-2.3.0.tgz",
+      "integrity": "sha512-JfJeIHke7y2egdGGgRAvpCwYFUsHlM2gPcrVOxFkznt/4uzQ7HFmvE63iFHVLBJNDuyDOQgijDK/tXH/f6Msjg==",
      "license": "MIT",
      "engines": {
        "node": ">=6.10"
@@ -17,6 +17,7 @@ function stub(name: string) {

 vi.mock("@/components/icons/ClaudeIcon", () => ({ ClaudeIcon: stub("claude") }));
 vi.mock("@/components/icons/CodexIcon", () => ({ CodexIcon: stub("codex") }));
+vi.mock("@/components/icons/CursorIcon", () => ({ CursorIcon: stub("cursor") }));
 vi.mock("@/components/icons/NessieIcon", () => ({ NessieIcon: stub("nessie") }));
 vi.mock("@/components/icons/PiIcon", () => ({ PiIcon: stub("pi") }));
 vi.mock("lucide-react", () => ({ BotIcon: stub("bot") }));
@@ -48,6 +49,9 @@ describe("AgentCard icon selection", () => {
    { name: "codex-native-ui", harness: "codex-native", expected: "codex" },
    { name: "claude-native-ui", harness: "claude-native", expected: "claude" },
    { name: "pi-native-ui", harness: "pi-native", expected: "pi" },
+    { name: "cursor-native-ui", harness: "cursor-native", expected: "cursor" },
+    // The SDK "cursor" harness also reads as Cursor via the harness fallback.
+    { name: "x", harness: "cursor", expected: "cursor" },
    { name: "x", harness: "claude-sdk", expected: "claude" },
    { name: "pi", harness: "pi", expected: "pi" },
    // The pi match is exact: a harness merely containing "pi" stays generic.
@@ -1,6 +1,7 @@
 import { BotIcon } from "lucide-react";
 import { ClaudeIcon } from "@/components/icons/ClaudeIcon";
 import { CodexIcon } from "@/components/icons/CodexIcon";
+import { CursorIcon } from "@/components/icons/CursorIcon";
 import { NessieIcon } from "@/components/icons/NessieIcon";
 import { PiIcon } from "@/components/icons/PiIcon";
 import type { ComponentType, SVGProps } from "react";
@@ -26,9 +27,12 @@ function iconForAgent(agent: AvailableAgent): ComponentType<SVGProps<SVGSVGEleme
  if (nativeAgent?.iconKind === "claude") return ClaudeIcon;
  if (nativeAgent?.iconKind === "codex") return CodexIcon;
  if (nativeAgent?.iconKind === "pi") return PiIcon;
+  if (nativeAgent?.iconKind === "cursor") return CursorIcon;
  // A null harness (spec couldn't load) flows through to the bot fallback.
  if (agent.harness?.includes("codex")) return CodexIcon;
  if (agent.harness?.includes("claude")) return ClaudeIcon;
+  // Both the SDK "cursor" harness and "cursor-native" get the Cursor glyph.
+  if (agent.harness?.includes("cursor")) return CursorIcon;
  // Exact match — a substring check would false-match e.g. "openapi".
  if (agent.harness === "pi") return PiIcon;
  return BotIcon;
@@ -0,0 +1,3 @@
+import Cursor from "@lobehub/icons/es/Cursor";
+
+export const CursorIcon = Cursor;
@@ -0,0 +1,86 @@
+// Cmd/Ctrl+Enter accepts the newest pending accept/decline prompt; skips
+// already-responded prompts and AskUserQuestion (which needs an explicit
+// choice); ignores bare Enter and Alt/Shift-modified Enter.
+
+import { renderHook } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const submitApproval = vi.fn();
+let blocks: Array<Record<string, unknown>> = [];
+vi.mock("@/store/chatStore", () => ({
+  useChatStore: { getState: () => ({ blocks, submitApproval }) },
+}));
+
+import { useApproveHotkey } from "./useApproveHotkey";
+
+/** Dispatch a keydown that reaches window from body (default: Cmd+Enter). */
+function press(
+  mods: Partial<Pick<KeyboardEvent, "metaKey" | "ctrlKey" | "altKey" | "shiftKey">> = {
+    metaKey: true,
+  },
+  key = "Enter",
+): void {
+  document.body.dispatchEvent(
+    new KeyboardEvent("keydown", { key, bubbles: true, cancelable: true, ...mods }),
+  );
+}
+
+beforeEach(() => {
+  submitApproval.mockClear();
+  blocks = [];
+});
+afterEach(() => {
+  blocks = [];
+});
+
+describe("useApproveHotkey", () => {
+  const pending = { type: "elicitation", elicitationId: "e1", status: "pending" };
+
+  it("Cmd+Enter accepts the pending approval", () => {
+    blocks = [pending];
+    renderHook(() => useApproveHotkey());
+    press();
+    expect(submitApproval).toHaveBeenCalledWith("e1", "accept");
+  });
+
+  it("Ctrl+Enter also accepts (Win/Linux)", () => {
+    blocks = [pending];
+    renderHook(() => useApproveHotkey());
+    press({ ctrlKey: true });
+    expect(submitApproval).toHaveBeenCalledWith("e1", "accept");
+  });
+
+  it("accepts the most recent pending approval", () => {
+    blocks = [
+      { type: "elicitation", elicitationId: "old", status: "pending" },
+      { type: "text" },
+      { type: "elicitation", elicitationId: "new", status: "pending" },
+    ];
+    renderHook(() => useApproveHotkey());
+    press();
+    expect(submitApproval).toHaveBeenCalledWith("new", "accept");
+  });
+
+  it("ignores already-responded prompts", () => {
+    blocks = [{ type: "elicitation", elicitationId: "e1", status: "responded" }];
+    renderHook(() => useApproveHotkey());
+    press();
+    expect(submitApproval).not.toHaveBeenCalled();
+  });
+
+  it("skips AskUserQuestion (needs an explicit choice)", () => {
+    blocks = [{ type: "elicitation", elicitationId: "q1", status: "pending", askUserQuestion: {} }];
+    renderHook(() => useApproveHotkey());
+    press();
+    expect(submitApproval).not.toHaveBeenCalled();
+  });
+
+  it("ignores bare Enter and Alt/Shift-modified Enter", () => {
+    blocks = [pending];
+    renderHook(() => useApproveHotkey());
+    press({}); // bare Enter
+    press({ metaKey: true, shiftKey: true });
+    press({ metaKey: true, altKey: true });
+    expect(submitApproval).not.toHaveBeenCalled();
+  });
+});
@@ -0,0 +1,48 @@
+// Cmd+Enter (Ctrl+Enter on Win/Linux) accepts the pending harness approval
+// prompt — the keyboard equivalent of clicking "Accept" on an ApprovalCard.
+// Bind ONCE at the app shell.
+//
+// Runs in the CAPTURE phase so it can intercept the keystroke before the
+// composer's own Enter-to-send handler (which fires during bubble and would
+// otherwise submit the draft first). When it actually accepts an approval it
+// stops the event so the composer never sees it; when nothing is pending it
+// leaves the event untouched, so Cmd/Ctrl+Enter keeps whatever meaning it had.
+//
+// Only plain accept/decline prompts (command, edit, plan, codex command) are
+// accepted. AskUserQuestion elicitations are skipped: they require choosing a
+// specific option, so a blanket "accept" carries no answer and the user must
+// pick on the card itself.
+
+import { useEffect } from "react";
+
+import type { ElicitationBlock } from "@/lib/blocks";
+import { useChatStore } from "@/store/chatStore";
+
+export function useApproveHotkey(): void {
+  useEffect(() => {
+    const handler = (e: globalThis.KeyboardEvent): void => {
+      // Cmd/Ctrl, not Alt/Shift (mirrors the session-switch hotkey's guard).
+      if (!(e.metaKey || e.ctrlKey) || e.altKey || e.shiftKey) return;
+      if (e.key !== "Enter") return;
+
+      const { blocks, submitApproval } = useChatStore.getState();
+      // Newest-first: accept the most recent still-pending prompt that takes a
+      // plain verdict. Skip AskUserQuestion (needs an explicit choice).
+      const pending = [...blocks]
+        .reverse()
+        .find(
+          (b): b is ElicitationBlock =>
+            b.type === "elicitation" && b.status === "pending" && !b.askUserQuestion,
+        );
+      if (!pending) return;
+
+      // Intercept before the composer's Enter-to-send handler runs.
+      e.preventDefault();
+      e.stopPropagation();
+      void submitApproval(pending.elicitationId, "accept");
+    };
+
+    window.addEventListener("keydown", handler, true);
+    return () => window.removeEventListener("keydown", handler, true);
+  }, []);
+}
@@ -11,6 +11,9 @@ import { useSessionUpdatesConnected } from "./useSessionUpdatesConnected";
 import {
  deleteConversation,
  renameConversation,
+  useBulkArchiveConversations,
+  useBulkDeleteConversations,
+  useBulkStopSessions,
  useConversations,
  useRenameConversation,
  useStopAndDeleteConversation,
@@ -486,3 +489,173 @@ describe("useStopSession invalidation", () => {
    expect(invalidateSpy).toHaveBeenCalledWith({ queryKey: ["session", "conv_x"] });
  });
 });
+
+describe("useBulkArchiveConversations", () => {
+  function renderBulkArchiveHook() {
+    const queryClient = new QueryClient({
+      defaultOptions: { mutations: { retry: false } },
+    });
+    const invalidateSpy = vi.spyOn(queryClient, "invalidateQueries");
+    const wrapper = ({ children }: { children: ReactNode }) =>
+      createElement(QueryClientProvider, { client: queryClient }, children);
+    const rendered = renderHook(() => useBulkArchiveConversations(), { wrapper });
+    return { queryClient, invalidateSpy, rendered };
+  }
+
+  it("PATCHes each session and invalidates the list on success", async () => {
+    fetchMock
+      .mockResolvedValueOnce(
+        mockResponse({
+          id: "conv_a",
+          object: "conversation",
+          title: "A",
+          created_at: 0,
+          updated_at: 10,
+          labels: {},
+        }),
+      )
+      .mockResolvedValueOnce(
+        mockResponse({
+          id: "conv_b",
+          object: "conversation",
+          title: "B",
+          created_at: 0,
+          updated_at: 11,
+          labels: {},
+        }),
+      );
+
+    const { invalidateSpy, rendered } = renderBulkArchiveHook();
+    rendered.result.current.mutate({ ids: ["conv_a", "conv_b"], archived: true });
+    await waitFor(() => expect(rendered.result.current.isSuccess).toBe(true));
+
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    for (const [, init] of fetchMock.mock.calls as [string, RequestInit][]) {
+      expect(init.method).toBe("PATCH");
+      expect(JSON.parse(init.body as string)).toEqual({ archived: true });
+    }
+    expect(invalidateSpy).toHaveBeenCalledWith({ queryKey: ["conversations"] });
+  });
+
+  it("throws with failed ids when some archives fail", async () => {
+    fetchMock
+      .mockResolvedValueOnce(
+        mockResponse({
+          id: "conv_a",
+          object: "conversation",
+          title: "A",
+          created_at: 0,
+          updated_at: 10,
+          labels: {},
+        }),
+      )
+      .mockResolvedValueOnce(mockResponse({}, { ok: false, status: 500 }));
+
+    const { rendered } = renderBulkArchiveHook();
+    rendered.result.current.mutate({ ids: ["conv_a", "conv_b"], archived: true });
+    await waitFor(() => expect(rendered.result.current.isError).toBe(true));
+
+    expect((rendered.result.current.error as any).failed).toEqual(["conv_b"]);
+  });
+});
+
+describe("useBulkDeleteConversations", () => {
+  function renderBulkDeleteHook() {
+    const queryClient = new QueryClient({
+      defaultOptions: { mutations: { retry: false } },
+    });
+    queryClient.setQueryData(
+      ["conversations", "", false],
+      infinitePage([
+        conversation({ id: "conv_a" }),
+        conversation({ id: "conv_b" }),
+        conversation({ id: "conv_keep" }),
+      ]),
+    );
+    const wrapper = ({ children }: { children: ReactNode }) =>
+      createElement(QueryClientProvider, { client: queryClient }, children);
+    const rendered = renderHook(() => useBulkDeleteConversations(), { wrapper });
+    return { queryClient, rendered };
+  }
+
+  it("stops and deletes each session, then removes them from cache", async () => {
+    // For each id: stop (POST) then delete (DELETE) = 4 calls for 2 ids.
+    fetchMock
+      .mockResolvedValueOnce(mockResponse({ queued: false })) // stop conv_a
+      .mockResolvedValueOnce(mockResponse({ deleted: true })) // delete conv_a
+      .mockResolvedValueOnce(mockResponse({ queued: false })) // stop conv_b
+      .mockResolvedValueOnce(mockResponse({ deleted: true })); // delete conv_b
+
+    const { queryClient, rendered } = renderBulkDeleteHook();
+    rendered.result.current.mutate(["conv_a", "conv_b"]);
+    await waitFor(() => expect(rendered.result.current.isSuccess).toBe(true));
+
+    const data = queryClient.getQueryData<ConversationsInfiniteData>(["conversations", "", false]);
+    expect(data!.pages[0].data.map((c) => c.id)).toEqual(["conv_keep"]);
+  });
+
+  it("evicts succeeded ids from cache even when some deletes fail", async () => {
+    // conv_a succeeds (stop+delete), conv_b fails on delete.
+    fetchMock
+      .mockResolvedValueOnce(mockResponse({ queued: false })) // stop conv_a
+      .mockResolvedValueOnce(mockResponse({ deleted: true })) // delete conv_a
+      .mockResolvedValueOnce(mockResponse({ queued: false })) // stop conv_b
+      .mockResolvedValueOnce(mockResponse({}, { ok: false, status: 500 })); // delete conv_b fails
+
+    const { queryClient, rendered } = renderBulkDeleteHook();
+    rendered.result.current.mutate(["conv_a", "conv_b"]);
+    await waitFor(() => expect(rendered.result.current.isError).toBe(true));
+
+    // conv_a was successfully deleted and should be evicted; conv_b stays.
+    const data = queryClient.getQueryData<ConversationsInfiniteData>(["conversations", "", false]);
+    const ids = data!.pages[0].data.map((c) => c.id);
+    expect(ids).not.toContain("conv_a");
+    expect(ids).toContain("conv_b");
+    expect(ids).toContain("conv_keep");
+  });
+});
+
+describe("useBulkStopSessions", () => {
+  function renderBulkStopHook() {
+    const queryClient = new QueryClient({
+      defaultOptions: { mutations: { retry: false } },
+    });
+    const invalidateSpy = vi.spyOn(queryClient, "invalidateQueries");
+    const wrapper = ({ children }: { children: ReactNode }) =>
+      createElement(QueryClientProvider, { client: queryClient }, children);
+    const rendered = renderHook(() => useBulkStopSessions(), { wrapper });
+    return { invalidateSpy, rendered };
+  }
+
+  it("POSTs stop_session for each id and invalidates the list", async () => {
+    fetchMock
+      .mockResolvedValueOnce(mockResponse({ queued: false }))
+      .mockResolvedValueOnce(mockResponse({ queued: false }));
+
+    const { invalidateSpy, rendered } = renderBulkStopHook();
+    rendered.result.current.mutate(["conv_a", "conv_b"]);
+    await waitFor(() => expect(rendered.result.current.isSuccess).toBe(true));
+
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    for (const [url, init] of fetchMock.mock.calls as [string, RequestInit][]) {
+      expect(url).toMatch(/\/v1\/sessions\/conv_[ab]\/events$/);
+      expect(init.method).toBe("POST");
+      expect(JSON.parse(init.body as string)).toEqual({ type: "stop_session", data: {} });
+    }
+    expect(invalidateSpy).toHaveBeenCalledWith({ queryKey: ["conversations"] });
+  });
+
+  it("throws with failed ids when some stops fail", async () => {
+    fetchMock
+      .mockResolvedValueOnce(mockResponse({ queued: false }))
+      .mockResolvedValueOnce(mockResponse({}, { ok: false, status: 503 }));
+
+    const { rendered } = renderBulkStopHook();
+    rendered.result.current.mutate(["conv_a", "conv_b"]);
+    await waitFor(() => expect(rendered.result.current.isError).toBe(true));
+
+    const err = rendered.result.current.error as any;
+    expect(err.succeeded).toEqual(["conv_a"]);
+    expect(err.failed).toEqual(["conv_b"]);
+  });
+});
@@ -433,6 +433,126 @@ export function useStopSession() {
  });
 }

+/**
+ * Archive multiple conversations in parallel via `PATCH /v1/sessions/{id}`.
+ *
+ * Each session is archived independently — individual failures don't
+ * block the rest. The conversations list is invalidated once on
+ * completion so the sidebar refreshes. Returns an array of session IDs
+ * that failed.
+ */
+export function useBulkArchiveConversations() {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async ({ ids, archived }: { ids: string[]; archived: boolean }) => {
+      const results = await Promise.allSettled(ids.map((id) => archiveConversation(id, archived)));
+      const failed: string[] = [];
+      for (let i = 0; i < results.length; i++) {
+        if (results[i].status === "rejected") failed.push(ids[i]);
+        else
+          markConversationSeen(
+            ids[i],
+            (results[i] as PromiseFulfilledResult<Conversation>).value.updated_at,
+          );
+      }
+      if (failed.length > 0) throw { failed, total: ids.length };
+      return results
+        .filter((r): r is PromiseFulfilledResult<Conversation> => r.status === "fulfilled")
+        .map((r) => r.value);
+    },
+    onSettled: () => {
+      void queryClient.invalidateQueries({ queryKey: ["conversations"] });
+    },
+  });
+}
+
+/**
+ * Delete multiple conversations in parallel (stop + delete each).
+ *
+ * Each session is stopped (best-effort) then deleted independently.
+ * The conversations list cache is patched to remove successful
+ * deletions. Returns an array of session IDs that failed.
+ */
+export function useBulkDeleteConversations() {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async (ids: string[]) => {
+      const results = await Promise.allSettled(
+        ids.map(async (id) => {
+          try {
+            await stopSession(id);
+          } catch {
+            // Best-effort stop
+          }
+          await deleteConversation(id);
+        }),
+      );
+      const succeeded: string[] = [];
+      const failed: string[] = [];
+      for (let i = 0; i < results.length; i++) {
+        if (results[i].status === "fulfilled") succeeded.push(ids[i]);
+        else failed.push(ids[i]);
+      }
+      if (failed.length > 0) throw { failed, succeeded, total: ids.length };
+      return { succeeded, failed };
+    },
+    onSuccess: (_data, ids) => {
+      const idSet = new Set(ids);
+      for (const [key, data] of queryClient.getQueriesData<ConversationsInfiniteData>({
+        queryKey: ["conversations"],
+      })) {
+        const { data: next, removed } = removeIdsFromPages(data, idSet);
+        if (removed) queryClient.setQueryData(key, next);
+      }
+      for (const id of ids) {
+        queryClient.removeQueries({ queryKey: ["conversation-backfill", id] });
+        queryClient.removeQueries({ queryKey: ["session", id] });
+      }
+    },
+    onError: (err: any) => {
+      if (err?.succeeded) {
+        const idSet = new Set(err.succeeded as string[]);
+        for (const [key, data] of queryClient.getQueriesData<ConversationsInfiniteData>({
+          queryKey: ["conversations"],
+        })) {
+          const { data: next, removed } = removeIdsFromPages(data, idSet);
+          if (removed) queryClient.setQueryData(key, next);
+        }
+        for (const id of err.succeeded) {
+          queryClient.removeQueries({ queryKey: ["conversation-backfill", id] });
+          queryClient.removeQueries({ queryKey: ["session", id] });
+        }
+      }
+    },
+  });
+}
+
+/**
+ * Stop multiple live sessions in parallel.
+ *
+ * Each session is stopped independently — individual failures don't
+ * block the rest. Returns arrays of succeeded/failed IDs.
+ */
+export function useBulkStopSessions() {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async (ids: string[]) => {
+      const results = await Promise.allSettled(ids.map((id) => stopSession(id)));
+      const succeeded: string[] = [];
+      const failed: string[] = [];
+      for (let i = 0; i < results.length; i++) {
+        if (results[i].status === "fulfilled") succeeded.push(ids[i]);
+        else failed.push(ids[i]);
+      }
+      if (failed.length > 0) throw { failed, succeeded, total: ids.length };
+      return { succeeded, failed };
+    },
+    onSettled: () => {
+      void queryClient.invalidateQueries({ queryKey: ["conversations"] });
+    },
+  });
+}
+
 /**
 * Fetch pinned sessions that aren't present in the loaded paginated
 * data. Returns the backfilled conversations so the caller can merge
@@ -21,6 +21,9 @@ vi.mock("@/lib/browserNotifications", () => ({
 vi.mock("@/lib/nativeBridge", () => ({
  isNativeShell: vi.fn(),
  setBadgeCount: vi.fn().mockResolvedValue(undefined),
+  // Returns an unsubscribe fn; tests that exercise native click routing
+  // capture the registered callback via this mock's calls.
+  onNativeNotificationActivated: vi.fn().mockReturnValue(() => {}),
 }));

 // The turn-end notification body is enriched by an async fetch of the agent's
@@ -38,7 +41,7 @@ import {
  requestNotificationPermission,
  showNotification,
 } from "@/lib/browserNotifications";
-import { isNativeShell, setBadgeCount } from "@/lib/nativeBridge";
+import { isNativeShell, onNativeNotificationActivated, setBadgeCount } from "@/lib/nativeBridge";
 import { fetchLastAssistantText } from "@/lib/lastAssistantText";
 import { markConversationSeen } from "@/hooks/useUnseenConversations";
 import { useIdleNotifications } from "./useIdleNotifications";
@@ -48,6 +51,7 @@ const getPermMock = vi.mocked(getNotificationPermission);
 const requestPermMock = vi.mocked(requestNotificationPermission);
 const showMock = vi.mocked(showNotification);
 const isNativeMock = vi.mocked(isNativeShell);
+const onNativeActivatedMock = vi.mocked(onNativeNotificationActivated);
 const setBadgeMock = vi.mocked(setBadgeCount);
 const fetchPreviewMock = vi.mocked(fetchLastAssistantText);

@@ -95,6 +99,8 @@ beforeEach(() => {
  showMock.mockReset();
  requestPermMock.mockReset();
  setBadgeMock.mockClear();
+  onNativeActivatedMock.mockClear();
+  onNativeActivatedMock.mockReturnValue(() => {});
  fetchPreviewMock.mockReset();
  fetchPreviewMock.mockResolvedValue(undefined);
  getPermMock.mockReturnValue("granted");
@@ -159,6 +165,25 @@ describe("useIdleNotifications turn-end transitions", () => {
    showMock.mock.calls[0][0].onClick?.();
    // Click routes to the session's chat page.
    expect(navigateMock).toHaveBeenCalledWith("/c/a");
+    // The desktop shell can't carry the onClick closure across IPC, so the
+    // same destination is also passed as a plain path for the native path.
+    expect(showMock.mock.calls[0][0].navigatePath).toBe("/c/a");
+  });
+
+  it("routes to the conversation when the desktop shell reports a notification click", async () => {
+    isNativeMock.mockReturnValue(true);
+    setConversations([conv("a", "running")]);
+    renderHook(() => useIdleNotifications());
+
+    // The hook registers one native-activation listener; grab its callback
+    // and simulate the shell delivering a clicked notification's path.
+    expect(onNativeActivatedMock).toHaveBeenCalledOnce();
+    const activatedCb = onNativeActivatedMock.mock.calls[0][0];
+    act(() => {
+      activatedCb("/c/a");
+    });
+
+    expect(navigateMock).toHaveBeenCalledWith("/c/a");
  });

  it("does not notify on a fresh load with already-idle sessions", () => {
@@ -35,7 +35,7 @@ import {
  requestNotificationPermission,
  showNotification,
 } from "@/lib/browserNotifications";
-import { isNativeShell, setBadgeCount } from "@/lib/nativeBridge";
+import { isNativeShell, onNativeNotificationActivated, setBadgeCount } from "@/lib/nativeBridge";
 import { fetchLastAssistantText } from "@/lib/lastAssistantText";
 import {
  buildElicitationMap,
@@ -124,6 +124,21 @@ export function useIdleNotifications(activeConversationId?: string): void {
  const activeIdRef = useRef<string | undefined>(activeConversationId);
  activeIdRef.current = activeConversationId;

+  // Keep the latest `navigate` readable from the once-mounted native-click
+  // listener below without re-subscribing whenever the router identity changes.
+  const navigateRef = useRef(navigate);
+  navigateRef.current = navigate;
+
+  // Desktop shell only: clicking an OS notification can't run the web
+  // `onClick` closure (it never crosses the IPC boundary), so the shell sends
+  // back the notification's in-app path and we route to it here — making a
+  // native toast click open its conversation, matching the browser path.
+  useEffect(() => {
+    return onNativeNotificationActivated((path) => navigateRef.current(path));
+    // navigateRef is stable; the listener is mounted once for the app's life.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+
  // Send the badge count when it differs from the last one sent. No-op in a
  // plain browser (`setBadgeCount` is inert outside the desktop shell).
  const pushBadge = (count: number) => {
@@ -209,13 +224,18 @@ function notify(
  body: string,
  navigate: ReturnType<typeof useNavigate>,
 ): void {
+  const path = `/c/${conversation.id}`;
  showNotification({
    title: conversationDisplayLabel(conversation),
    body,
    // Tag by id so a later update for the same session replaces its
    // toast instead of stacking duplicates.
    tag: `omnigent:session:${conversation.id}`,
-    onClick: () => navigate(`/c/${conversation.id}`),
+    // Browser path: run navigation directly on click. Desktop shell path:
+    // `navigatePath` is forwarded over IPC and routed on click instead, since
+    // this closure can't cross the process boundary.
+    onClick: () => navigate(path),
+    navigatePath: path,
  });
 }

@@ -477,6 +477,12 @@ describe("inventoryTerminals", () => {
    session: "main",
    running: true,
  };
+  const cursorPane: TerminalInfo = {
+    id: "terminal_cursor_main",
+    name: "cursor",
+    session: "main",
+    running: true,
+  };
  const bash: TerminalInfo = {
    id: "terminal_bash_s1",
    name: "bash",
@@ -491,6 +497,13 @@ describe("inventoryTerminals", () => {
    expect(inventoryTerminals([piPane, bash], true)).toEqual([bash]);
  });

+  it("drops the cursor vendor pane for native Cursor sessions", () => {
+    // Regression: terminal_cursor_main was missing from AGENT_TERMINAL_IDS,
+    // same failure mode as the pi pane above — leaked into Shells and hid
+    // the Chat/Terminal pill in Terminal view.
+    expect(inventoryTerminals([cursorPane, bash], true)).toEqual([bash]);
+  });
+
  it("drops the embedded REPL terminal for terminal-first SDK sessions", () => {
    // The REPL terminal backs the pill's Terminal view; listing it in
    // the rail reads as a phantom "main" terminal on agents that don't
@@ -528,6 +541,8 @@ describe("isAgentTerminalKey", () => {
    // pi-native: missing here is what hid the Chat/Terminal pill in
    // Terminal view (isShellView wrongly true) for Pi sessions.
    expect(isAgentTerminalKey("terminal:terminal_pi_main")).toBe(true);
+    // cursor-native: same regression class as pi above.
+    expect(isAgentTerminalKey("terminal:terminal_cursor_main")).toBe(true);
  });

  it("treats a user shell as not-the-agent-terminal", () => {
@@ -49,8 +49,9 @@ export const PANEL_NO_TERMINAL_KEY = "";
 * Resource ids of the AGENT's own terminal — the pane behind the
 * connection pill's Terminal view, runner-created per session shape:
 * the embedded Omnigent REPL (``tui``/``main``) for SDK sessions,
- * and the vendor pane (``claude``/``main``, ``codex``/``main``, or
- * ``pi``/``main``) for native-wrapper sessions. These are plumbing, not
+ * and the vendor pane (``claude``/``main``, ``codex``/``main``,
+ * ``pi``/``main``, or ``cursor``/``main``) for native-wrapper sessions.
+ * These are plumbing, not
 * part of the session's shell inventory, and at most one exists per session.
 *
 * Missing an entry here makes that pane read as a *user shell*: the
@@ -63,6 +64,7 @@ export const AGENT_TERMINAL_IDS: ReadonlySet<string> = new Set([
  "terminal_claude_main",
  "terminal_codex_main",
  "terminal_pi_main",
+  "terminal_cursor_main",
 ]);

 /**
@@ -127,4 +127,29 @@ describe("showNotification", () => {
    expect(onClick).toHaveBeenCalledOnce();
    expect(instances[0].close).toHaveBeenCalledOnce();
  });
+
+  it("hands off to the native shell (with navigatePath) instead of a web toast", () => {
+    // Under the Electron shell, showNotification routes to the OS notification
+    // and forwards navigatePath (not the onClick closure, which can't cross
+    // IPC) so the shell can open the conversation on click. No web toast.
+    installNotification("granted");
+    const electronNotify = vi.fn().mockResolvedValue(true);
+    (window as unknown as Record<string, unknown>).omnigentDesktop = {
+      kind: "electron",
+      setBadgeCount: vi.fn(),
+      notify: electronNotify,
+    };
+    try {
+      const result = showNotification({ title: "X", body: "done", navigatePath: "/c/a" });
+      expect(result).toBeNull();
+      expect(instances).toHaveLength(0);
+      expect(electronNotify).toHaveBeenCalledWith({
+        title: "X",
+        body: "done",
+        navigatePath: "/c/a",
+      });
+    } finally {
+      delete (window as unknown as Record<string, unknown>).omnigentDesktop;
+    }
+  });
 });
@@ -55,6 +55,13 @@ export interface ShowNotificationParams {
  tag?: string;
  /** Invoked when the user clicks the notification (after focusing). */
  onClick?: () => void;
+  /**
+   * In-app path to open when the notification is clicked, e.g. `"/c/abc"`.
+   * The browser path runs `onClick` directly; the Electron path can't carry a
+   * JS closure across the process boundary, so it forwards this string to the
+   * shell, which routes to it on click (see `onNativeNotificationActivated`).
+   */
+  navigatePath?: string;
 }

 /**
@@ -69,13 +76,16 @@ export function showNotification({
  body,
  tag,
  onClick,
+  navigatePath,
 }: ShowNotificationParams): Notification | null {
  // Desktop shell: hand off to the native OS notification and skip the web
  // toast entirely. `nativeNotify` is async/best-effort; we don't await it
  // (callers treat this function as fire-and-forget) and return null because
-  // no web `Notification` object is created in the native path.
+  // no web `Notification` object is created in the native path. We forward
+  // `navigatePath` (not the `onClick` closure, which can't cross the IPC
+  // boundary) so the shell can route to the conversation on click.
  if (isNativeShell()) {
-    void nativeNotify({ title, body });
+    void nativeNotify({ title, body, navigatePath });
    return null;
  }
  if (!isNotificationSupported() || Notification.permission !== "granted") return null;
@@ -4,20 +4,33 @@ import {
  isElectronShell,
  isNativeShell,
  nativeNotify,
+  onNativeNotificationActivated,
  setBadgeCount as bridgeSetBadge,
 } from "./nativeBridge";

 // The Electron preload bridge mock, installed on window.omnigentDesktop.
 const electronSetBadge = vi.fn();
 const electronNotify = vi.fn().mockResolvedValue(true);
+const electronUnsubscribe = vi.fn();
+const electronOnNotificationActivated = vi.fn().mockReturnValue(electronUnsubscribe);

-/** Simulate running inside / outside the Electron shell via the preload key. */
-function setElectron(on: boolean): void {
+/**
+ * Simulate running inside / outside the Electron shell via the preload key.
+ * `withClickRouting` toggles the optional `onNotificationActivated` method so
+ * tests can also exercise a shell too old to support click routing.
+ */
+function setElectron(on: boolean, withClickRouting = true): void {
  if (on) {
    (window as unknown as Record<string, unknown>).omnigentDesktop = {
      kind: "electron",
      setBadgeCount: (...args: unknown[]) => electronSetBadge(...args),
      notify: (...args: unknown[]) => electronNotify(...args),
+      ...(withClickRouting
+        ? {
+            onNotificationActivated: (...args: unknown[]) =>
+              electronOnNotificationActivated(...args),
+          }
+        : {}),
    };
  } else {
    delete (window as unknown as Record<string, unknown>).omnigentDesktop;
@@ -64,7 +77,21 @@ describe("nativeNotify", () => {
  it("routes the notification through the Electron bridge with title+body", async () => {
    setElectron(true);
    await expect(nativeNotify({ title: "Session 1", body: "done" })).resolves.toBe(true);
-    expect(electronNotify).toHaveBeenCalledWith({ title: "Session 1", body: "done" });
+    expect(electronNotify).toHaveBeenCalledWith({
+      title: "Session 1",
+      body: "done",
+      navigatePath: undefined,
+    });
+  });
+
+  it("forwards navigatePath so the shell can route on click", async () => {
+    setElectron(true);
+    await nativeNotify({ title: "Session 1", body: "done", navigatePath: "/c/a" });
+    expect(electronNotify).toHaveBeenCalledWith({
+      title: "Session 1",
+      body: "done",
+      navigatePath: "/c/a",
+    });
  });

  it("returns false when the bridge throws", async () => {
@@ -74,6 +101,43 @@ describe("nativeNotify", () => {
  });
 });

+describe("onNativeNotificationActivated", () => {
+  it("returns a no-op unsubscribe outside the shell", () => {
+    setElectron(false);
+    const cb = vi.fn();
+    const unsubscribe = onNativeNotificationActivated(cb);
+    // No bridge -> nothing subscribed, and the returned unsubscribe is safe.
+    expect(electronOnNotificationActivated).not.toHaveBeenCalled();
+    expect(() => unsubscribe()).not.toThrow();
+  });
+
+  it("returns a no-op unsubscribe under a shell lacking click routing", () => {
+    setElectron(true, false);
+    const cb = vi.fn();
+    const unsubscribe = onNativeNotificationActivated(cb);
+    expect(electronOnNotificationActivated).not.toHaveBeenCalled();
+    expect(() => unsubscribe()).not.toThrow();
+  });
+
+  it("subscribes through the bridge and returns its unsubscribe", () => {
+    setElectron(true);
+    const cb = vi.fn();
+    const unsubscribe = onNativeNotificationActivated(cb);
+    expect(electronOnNotificationActivated).toHaveBeenCalledWith(cb);
+    unsubscribe();
+    expect(electronUnsubscribe).toHaveBeenCalledOnce();
+  });
+
+  it("returns a no-op unsubscribe when the bridge throws", () => {
+    setElectron(true);
+    electronOnNotificationActivated.mockImplementationOnce(() => {
+      throw new Error("ipc down");
+    });
+    const unsubscribe = onNativeNotificationActivated(vi.fn());
+    expect(() => unsubscribe()).not.toThrow();
+  });
+});
+
 describe("setBadgeCount", () => {
  it("is a no-op outside the shell", async () => {
    setElectron(false);
@@ -33,6 +33,14 @@ interface ElectronDesktopApi {
  setBadgeCount: (count: number) => void;
  /** Fire an OS notification; resolves true when it was shown. */
  notify: (params: NativeNotifyParams) => Promise<boolean>;
+  // Optional: a shell older than this SPA may lack notification-click routing,
+  // in which case clicking a desktop toast only focuses the window (the prior
+  // behavior) instead of also navigating.
+  /**
+   * Subscribe to OS-notification clicks. The main process sends the in-app
+   * path the notification carried (its `navigatePath`); returns an unsubscribe.
+   */
+  onNotificationActivated?: (callback: (path: string) => void) => () => void;
  // The server-picker trio is optional: the SPA is server-served and may be
  // newer than the installed shell, whose preload then lacks these methods.
  /** Current server origin + recent servers, or null on a foreign page. */
@@ -92,6 +100,13 @@ export interface NativeNotifyParams {
  title: string;
  /** Secondary line, e.g. "Agent finished and is ready for your input." */
  body?: string;
+  /**
+   * In-app path the shell should open when the user clicks this notification,
+   * e.g. `"/c/conv_abc123"`. A click closure can't cross the process boundary,
+   * so we forward the destination as a string and route to it on click via
+   * `onNativeNotificationActivated`. Omitted -> click only focuses the window.
+   */
+  navigatePath?: string;
 }

 /**
@@ -102,11 +117,15 @@ export interface NativeNotifyParams {
 * not running under Electron or anything went wrong (so the caller can fall
 * back to the Web Notifications API).
 */
-export async function nativeNotify({ title, body }: NativeNotifyParams): Promise<boolean> {
+export async function nativeNotify({
+  title,
+  body,
+  navigatePath,
+}: NativeNotifyParams): Promise<boolean> {
  const electron = electronApi();
  if (!electron) return false;
  try {
-    return await electron.notify({ title, body });
+    return await electron.notify({ title, body, navigatePath });
  } catch (err) {
    // Only reachable inside the desktop shell. Log rather than swallow so a
    // broken bridge is visible instead of silently dropping notifications.
@@ -115,6 +134,27 @@ export async function nativeNotify({ title, body }: NativeNotifyParams): Promise
  }
 }

+/**
+ * Subscribe to native notification clicks from the desktop shell. The shell
+ * fires the in-app path the clicked notification carried (its `navigatePath`),
+ * so the renderer can route to it — restoring the in-browser behavior where
+ * clicking a toast opens its conversation.
+ *
+ * Returns an unsubscribe function. A no-op (returning a no-op unsubscribe)
+ * outside the Electron shell or under a shell too old to support click
+ * routing, so callers can register it unconditionally.
+ */
+export function onNativeNotificationActivated(callback: (path: string) => void): () => void {
+  const electron = electronApi();
+  if (!electron?.onNotificationActivated) return () => {};
+  try {
+    return electron.onNotificationActivated(callback);
+  } catch (err) {
+    console.warn("[nativeBridge] electron onNotificationActivated failed:", err);
+    return () => {};
+  }
+}
+
 /**
 * Paint the dock / taskbar badge with a count (macOS dock badge, Linux Unity
 * launcher count). Pass `0` (or omit) to clear it.
@@ -4,7 +4,7 @@ export const WRAPPER_LABEL_KEY = "omnigent.wrapper";
 export const UI_MODE_LABEL_KEY = "omnigent.ui";
 export const UI_MODE_TERMINAL_VALUE = "terminal";

-export type NativeCodingAgentIconKind = "claude" | "codex" | "pi";
+export type NativeCodingAgentIconKind = "claude" | "codex" | "pi" | "cursor";
 export type NativeCodingAgentCapability = "permissionMode" | "approvalMode";

 export interface NativeCodingAgentSpec {
@@ -39,6 +39,15 @@ export const NATIVE_CODING_AGENTS = [
    sortRank: 20,
    capabilities: ["approvalMode"],
  },
+  {
+    key: "cursor",
+    agentName: "cursor-native-ui",
+    harness: "cursor-native",
+    wrapperLabel: "cursor-native-ui",
+    displayName: "Cursor",
+    iconKind: "cursor",
+    sortRank: 30,
+  },
  {
    key: "pi",
    agentName: "pi-native-ui",
@@ -46,7 +55,7 @@ export const NATIVE_CODING_AGENTS = [
    wrapperLabel: "pi-native-ui",
    displayName: "Pi",
    iconKind: "pi",
-    sortRank: 30,
+    sortRank: 40,
  },
 ] as const satisfies readonly NativeCodingAgentSpec[];

@@ -65,6 +74,7 @@ const BY_WRAPPER: Map<string, NativeCodingAgentSpec> = new Map(
 // supported reversed alias (claude/codex use the canonical form).
 const HARNESS_ALIASES: Record<string, string> = {
  "native-pi": "pi-native",
+  "native-cursor": "cursor-native",
 };

 export function nativeCodingAgentForAgentName(
@@ -155,6 +155,7 @@ describe("JumpToTopButton", () => {
  afterEach(() => {
    cleanup();
    useChatStore.setState({ loadMoreHistory: originalLoadMoreHistory, hasMoreHistory: false });
+    vi.useRealTimers();
  });

  // Query by the aria-label attribute rather than role/accessible-name: when
@@ -226,6 +227,51 @@ describe("JumpToTopButton", () => {
    expect(pill().className).toContain("pointer-events-none");
  });

+  it("reveals when the user scrolls up, then auto-hides after the linger timeout", () => {
+    vi.useFakeTimers();
+    const { container, scroll, scroller } = makeScroller({
+      scrollTop: 500,
+      scrollHeight: 1000,
+      clientHeight: 400,
+    });
+    const metrics = scroll as unknown as { scrollTop: number };
+
+    render(<JumpToTopButton containerEl={container} scroller={scroller} hasMoreHistory={true} />);
+    // Mount reads the initial position; no scroll yet, so the pill stays hidden.
+    expect(pill().className).toContain("pointer-events-none");
+
+    // Scroll up (scrollTop decreases): the pill reveals without any hover.
+    act(() => {
+      metrics.scrollTop = 300;
+      fireEvent.scroll(scroll);
+    });
+    expect(pill().className).toContain("pointer-events-auto");
+
+    // After the linger window with no further upward scroll, it fades back out.
+    act(() => {
+      vi.advanceTimersByTime(2000);
+    });
+    expect(pill().className).toContain("pointer-events-none");
+  });
+
+  it("does not reveal on a downward scroll", () => {
+    const { container, scroll, scroller } = makeScroller({
+      scrollTop: 300,
+      scrollHeight: 1000,
+      clientHeight: 400,
+    });
+    const metrics = scroll as unknown as { scrollTop: number };
+
+    render(<JumpToTopButton containerEl={container} scroller={scroller} hasMoreHistory={true} />);
+
+    // Scrolling down (scrollTop increases) must not surface the pill.
+    act(() => {
+      metrics.scrollTop = 600;
+      fireEvent.scroll(scroll);
+    });
+    expect(pill().className).toContain("pointer-events-none");
+  });
+
  it("releases the bottom-lock, pages in all history, then scrolls to the top", async () => {
    const { container, scroller, scroll } = makeScroller({
      scrollTop: 500,
@@ -1771,6 +1771,12 @@ export function JumpToTopButton({
  const [atTop, setAtTop] = useState(true);
  const [hovering, setHovering] = useState(false);
  const [jumping, setJumping] = useState(false);
+  // Reveal the pill while the user is scrolling up, then fade it back out once
+  // they pause — so it's reachable without having to find the top hover band.
+  const [scrolledUp, setScrolledUp] = useState(false);
+
+  // How long the pill lingers after the last upward scroll before fading out.
+  const SCROLL_REVEAL_MS = 2000;

  // Pixels below the conversation's top edge that count as "hovering the top".
  // Comfortably clears the pill (anchored at the fade border, ~50px) so moving
@@ -1795,23 +1801,38 @@ export function JumpToTopButton({
    };
  }, [containerEl]);

-  // Track whether the loaded window is scrolled to its very top.
+  // Track whether the loaded window is scrolled to its very top, and reveal the
+  // pill whenever the user scrolls up (auto-hiding after they pause).
  const scrollEl = scroller?.el ?? null;
  useEffect(() => {
    if (!scrollEl) return;
+    let lastTop = scrollEl.scrollTop;
+    let hideTimer: ReturnType<typeof setTimeout> | undefined;
    const onScroll = () => {
-      const next = scrollEl.scrollTop <= 1;
+      const top = scrollEl.scrollTop;
+      const next = top <= 1;
      setAtTop((prev) => (prev === next ? prev : next));
+      // Upward scroll (and not already pinned to the top): show the pill and
+      // (re)arm the idle timer that fades it out once scrolling settles.
+      if (top < lastTop - 1 && top > 1) {
+        setScrolledUp(true);
+        clearTimeout(hideTimer);
+        hideTimer = setTimeout(() => setScrolledUp(false), SCROLL_REVEAL_MS);
+      }
+      lastTop = top;
    };
    onScroll();
    scrollEl.addEventListener("scroll", onScroll, { passive: true });
-    return () => scrollEl.removeEventListener("scroll", onScroll);
+    return () => {
+      clearTimeout(hideTimer);
+      scrollEl.removeEventListener("scroll", onScroll);
+    };
  }, [scrollEl]);

  // Somewhere to go: older pages exist, or we're scrolled down within the
  // loaded window. At the very first message there's nothing to jump to.
  const canJump = hasMoreHistory || !atTop;
-  const visible = jumping || (hovering && canJump);
+  const visible = jumping || ((hovering || scrolledUp) && canJump);

  const jumpToTop = useCallback(async () => {
    if (!scroller) return;
@@ -3427,7 +3448,11 @@ export function Composer({
    // within the wrapped line.  Gating on position 0 / length ensures the
    // browser gets to move the caret through wrapped lines first; only the
    // final ArrowUp-at-start / ArrowDown-at-end triggers recall.
-    if (e.key === "ArrowUp" || e.key === "ArrowDown") {
+    // Recall is for UNmodified arrows only. Cmd/Ctrl+↑/↓ (switch session) and
+    // Cmd/Alt+↑/↓ (jump between messages) are global window hotkeys meant to
+    // fire even mid-compose; without this guard the recall below intercepts
+    // them (replacing the draft) and the hotkeys appear broken in the composer.
+    if ((e.key === "ArrowUp" || e.key === "ArrowDown") && !e.metaKey && !e.ctrlKey && !e.altKey) {
      const ta = e.currentTarget;
      if (e.key === "ArrowUp" && ta.selectionStart === 0) {
        const recalled = recallPrevious(value);
@@ -3,6 +3,7 @@ import { useQueryClient } from "@tanstack/react-query";
 import { Outlet, useParams, useSearchParams } from "@/lib/routing";
 import { useConversations } from "@/hooks/useConversations";
 import { useSessionAgent } from "@/hooks/useAgents";
+import { useApproveHotkey } from "@/hooks/useApproveHotkey";
 import { AgentInfoContent, agentHasInfo } from "@/components/AgentInfo";
 import { useIdleNotifications } from "@/hooks/useIdleNotifications";
 import { readFilesPanelPreferences, writeFilesPanelPreferences } from "@/lib/filesPanelPreferences";
@@ -102,6 +103,10 @@ import type { RightRailTab } from "./railTabs";
 * more than one agent (the root has at least one child).
 */
 export function AppShell() {
+  // Cmd/Ctrl+Enter accepts the pending harness approval prompt. Bound once
+  // here so it works on every chat route, regardless of where focus sits.
+  useApproveHotkey();
+
  // Read early: the conversationId scopes the per-session workspace state
  // (rail open/width/tab/open files) used throughout this component.
  const { conversationId } = useParams<{ conversationId: string }>();
@@ -2,6 +2,7 @@ import { cleanup, fireEvent, render, screen } from "@testing-library/react";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import type { useFileContent } from "@/hooks/useFileContent";
 import { CodeViewer } from "./CodeViewer";
+import { HTML_PREVIEW_SANDBOX } from "./codeViewerHelpers";

 // ── Module mocks ──────────────────────────────────────────────────────────────

@@ -213,3 +214,29 @@ describe("CodeViewer truncated preview", () => {
    expect(screen.queryByText(/too large to load fully/)).toBeNull();
  });
 });
+
+describe("CodeViewer HTML preview sandbox", () => {
+  // The HTML preview is the security-load-bearing surface: artifact content is
+  // untrusted (agent/user-generated), so these assertions lock in the iframe's
+  // isolation. A regression here (e.g. adding `allow-same-origin`) would let
+  // artifact JS reach the host app's cookies, storage, and credentialed API.
+  it("enables scripts but withholds same-origin, and forces links to a new tab", () => {
+    const { container } = renderViewer(
+      "<html><head></head><body><a href='https://example.com'>link</a></body></html>",
+      true,
+      "page.html",
+      { viewMode: "preview" },
+    );
+    const iframe = container.querySelector('iframe[title="HTML preview"]');
+    expect(iframe).not.toBeNull();
+    const sandbox = iframe!.getAttribute("sandbox") ?? "";
+    // Full-string lock: any change to the sandbox flags must be deliberate.
+    expect(sandbox).toBe(HTML_PREVIEW_SANDBOX);
+    // #778: scripts must run inside the preview.
+    expect(sandbox).toContain("allow-scripts");
+    // Security invariant: the artifact must never share the app's origin.
+    expect(sandbox).not.toContain("allow-same-origin");
+    // #777: every link opens in a new tab via the injected base tag.
+    expect(iframe!.getAttribute("srcdoc")).toContain('<base target="_blank">');
+  });
+});
@@ -40,11 +40,13 @@ import { MarkdownRichTextViewer } from "./MarkdownRichTextViewer";
 import {
  type ActiveSelection,
  type SaveStatus,
+  HTML_PREVIEW_SANDBOX,
  detectLang,
  getSelectionOffsets,
  indexToLine,
  isBinaryPath,
  lineOverlapsSelection,
+  prepareHtmlPreviewDoc,
 } from "./codeViewerHelpers";
 import { renderLineTokens } from "./codeViewerRendering";
 import { TruncatedBanner } from "./TruncatedBanner";
@@ -392,8 +394,9 @@ export function CodeViewer({
        <MarkdownPreview content={content} />
      ) : (
        <iframe
-          srcDoc={content}
-          sandbox=""
+          srcDoc={prepareHtmlPreviewDoc(content)}
+          // oxlint-disable-next-line eslint-plugin-react(iframe-missing-sandbox)
+          sandbox={HTML_PREVIEW_SANDBOX}
          title="HTML preview"
          className="w-full h-full border-0"
        />
@@ -39,6 +39,7 @@ import {
  PencilLineIcon,
  RowsIcon,
  SearchIcon,
+  SquareArrowOutUpRightIcon,
  Trash2Icon,
 } from "lucide-react";
 import { useSearchParams } from "@/lib/routing";
@@ -76,7 +77,12 @@ import { cn } from "@/lib/utils";
 import { readFileViewPreferences, writeFileViewPreferences } from "@/lib/fileViewPreferences";
 import { type ChangedSort, compareChangedFiles } from "./FlatFileList";
 import { CodeViewer } from "./CodeViewer";
-import { detectLang, MONACO_SPLIT_BREAKPOINT, type SaveStatus } from "./codeViewerHelpers";
+import {
+  MONACO_SPLIT_BREAKPOINT,
+  type SaveStatus,
+  detectLang,
+  openHtmlArtifactInNewTab,
+} from "./codeViewerHelpers";
 import { CommentsPanel, type ActiveSelection } from "./CommentsPanel";

 // Monaco diff is heavy (~MBs + worker); load it only when the diff view is
@@ -463,6 +469,20 @@ function FileViewerBody({
    triggerBrowserDownload(fileContentToBlob(data), path.split("/").pop() ?? path);
  }, [fileQuery.data, path]);

+  // Pop the HTML artifact into its own browser tab. The artifact is rendered in
+  // a sandboxed, opaque-origin iframe (see `openHtmlArtifactInNewTab`), so it
+  // stays isolated from the host app — full-window rendering, no origin sharing.
+  const openHtmlInNewTab = useCallback(() => {
+    const data = fileQuery.data;
+    if (!data) return;
+    const opened = openHtmlArtifactInNewTab(data.content, path.split("/").pop() ?? path);
+    if (!opened) {
+      // window.open returned null — almost always a popup blocker. There's no
+      // toast surface here, so log it rather than failing silently.
+      console.warn("Open in new tab: the browser blocked the popup window.");
+    }
+  }, [fileQuery.data, path]);
+
  const copyFileLink = useCallback(() => {
    if (typeof navigator === "undefined" || !navigator.clipboard?.writeText) return;
    const url = new URL(window.location.href);
@@ -699,6 +719,17 @@ function FileViewerBody({
      },
    });
  }
+  // HTML artifacts can be popped out into their own browser tab for full-window
+  // viewing. The artifact still runs in the same sandboxed, opaque-origin iframe
+  // as the in-app preview (isolated from the host app) — just full-screen.
+  if (lang === "html" && fileQuery.data && viewMode !== "diff") {
+    toolbarActions.push({
+      key: "open-new-tab",
+      label: "Open in new tab",
+      icon: <SquareArrowOutUpRightIcon className="size-4" />,
+      onSelect: openHtmlInNewTab,
+    });
+  }
  toolbarActions.push({
    key: "comments",
    label: commentsOpen ? "Hide comments" : "Show comments",
@@ -611,6 +611,48 @@ describe("NewChatLandingScreen", () => {
    expect(screen.getByText("No agents")).toBeTruthy();
  });

+  it("orders Cursor above Pi in the built-in agent picker", () => {
+    mockAgents([
+      {
+        id: "a_pi",
+        name: "pi-native-ui",
+        display_name: "Pi",
+        description: null,
+        harness: "pi-native",
+        skills: [],
+      },
+      {
+        id: "a_cursor",
+        name: "cursor-native-ui",
+        display_name: "Cursor",
+        description: null,
+        harness: "cursor-native",
+        skills: [],
+      },
+      {
+        id: "a_codex",
+        name: "codex-native-ui",
+        display_name: "Codex",
+        description: null,
+        harness: "codex-native",
+        skills: [],
+      },
+      {
+        id: "a_claude",
+        name: "claude-native-ui",
+        display_name: "Claude Code",
+        description: null,
+        harness: "claude-native",
+        skills: [],
+      },
+    ]);
+    renderLanding();
+    fireEvent.pointerDown(screen.getByTestId("new-chat-landing-agent-select"), { button: 0 });
+    const cursor = screen.getByTestId("new-chat-landing-agent-a_cursor");
+    const pi = screen.getByTestId("new-chat-landing-agent-a_pi");
+    expect(cursor.compareDocumentPosition(pi) & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy();
+  });
+
  it("seeds the working directory from the host's most-recent path", async () => {
    renderLanding();
    // host_1's recent ("/Users/corey/repo") seeds the field; the chip shows
@@ -70,7 +70,7 @@ import { AgentRowTooltip } from "@/components/AgentHoverCard";
 // returns agents newest-registered first (agent_store.list sorts by
 // created_at desc), so pin the order users expect; any agent not listed
 // here falls after, in server order.
-const AGENT_DISPLAY_ORDER = ["Claude Code", "Codex", "Pi", "Polly", "Debby"];
+const AGENT_DISPLAY_ORDER = ["Claude Code", "Codex", "Cursor", "Pi", "Polly", "Debby"];

 // Built-in agents (by name slug) — the long-lived agents the server
 // ships out of the box. The picker groups these first, then a divider,
@@ -80,6 +80,7 @@ const BUILTIN_AGENTS = new Set([
  "claude-native-ui", // Claude Code
  "codex-native-ui", // Codex
  "pi-native-ui", // Pi
+  "cursor-native-ui", // Cursor
  "polly",
  "debby",
 ]);
@@ -34,6 +34,9 @@ vi.mock("@/hooks/useConversations", () => ({
  usePinnedConversationBackfill: () => [],
  useRenameConversation: () => ({ mutate: vi.fn() }),
  useArchiveConversation: () => mocks.archive,
+  useBulkArchiveConversations: () => ({ mutate: vi.fn(), isPending: false, isError: false }),
+  useBulkDeleteConversations: () => ({ mutate: vi.fn(), isPending: false, isError: false }),
+  useBulkStopSessions: () => ({ mutate: vi.fn(), isPending: false, isError: false }),
  useStopSession: () => mocks.stop,
 }));

@@ -33,6 +33,9 @@ vi.mock("@/hooks/useConversations", () => ({
  // stubs keep the row from crashing on mount.
  useRenameConversation: () => ({ mutate: vi.fn() }),
  useArchiveConversation: () => ({ mutate: vi.fn() }),
+  useBulkArchiveConversations: () => ({ mutate: vi.fn(), isPending: false, isError: false }),
+  useBulkDeleteConversations: () => ({ mutate: vi.fn(), isPending: false, isError: false }),
+  useBulkStopSessions: () => ({ mutate: vi.fn(), isPending: false, isError: false }),
  useStopSession: () => ({ mutate: vi.fn() }),
 }));

@@ -31,6 +31,9 @@ vi.mock("@/hooks/useConversations", () => ({
  usePinnedConversationBackfill: () => [],
  useRenameConversation: () => mocks.rename,
  useArchiveConversation: () => ({ mutate: vi.fn() }),
+  useBulkArchiveConversations: () => ({ mutate: vi.fn(), isPending: false, isError: false }),
+  useBulkDeleteConversations: () => ({ mutate: vi.fn(), isPending: false, isError: false }),
+  useBulkStopSessions: () => ({ mutate: vi.fn(), isPending: false, isError: false }),
  useStopSession: () => ({ mutate: vi.fn() }),
 }));

@@ -32,6 +32,9 @@ vi.mock("@/hooks/useConversations", () => ({
  usePinnedConversationBackfill: () => [],
  useRenameConversation: () => ({ mutate: vi.fn() }),
  useArchiveConversation: () => ({ mutate: vi.fn() }),
+  useBulkArchiveConversations: () => ({ mutate: vi.fn(), isPending: false, isError: false }),
+  useBulkDeleteConversations: () => ({ mutate: vi.fn(), isPending: false, isError: false }),
+  useBulkStopSessions: () => ({ mutate: vi.fn(), isPending: false, isError: false }),
  useStopSession: () => mocks.stop,
 }));

@@ -16,6 +16,9 @@ import type { Conversation } from "@/hooks/useConversations";
 vi.mock("@/hooks/useConversations", () => ({
  useConversations: vi.fn(),
  useArchiveConversation: () => ({ mutate: vi.fn() }),
+  useBulkArchiveConversations: () => ({ mutate: vi.fn(), isPending: false, isError: false }),
+  useBulkDeleteConversations: () => ({ mutate: vi.fn(), isPending: false, isError: false }),
+  useBulkStopSessions: () => ({ mutate: vi.fn(), isPending: false, isError: false }),
  useConnectedConversations: () => [],
  useStopAndDeleteConversation: () => ({ mutate: vi.fn() }),
  usePinnedConversationBackfill: () => [],
@@ -17,6 +17,7 @@ import {
  CircleStopIcon,
  GitBranchIcon,
  InboxIcon,
+  ListChecksIcon,
  Loader2Icon,
  MoreHorizontalIcon,
  PanelRightOpenIcon,
@@ -25,6 +26,8 @@ import {
  PinOffIcon,
  SearchIcon,
  ShareIcon,
+  SquareIcon,
+  SquareCheckIcon,
  Trash2Icon,
  XIcon,
 } from "lucide-react";
@@ -47,6 +50,8 @@ import {
 import {
  type Conversation,
  useArchiveConversation,
+  useBulkArchiveConversations,
+  useBulkDeleteConversations,
  useConversations,
  usePinnedConversationBackfill,
  useRenameConversation,
@@ -132,6 +137,30 @@ export function Sidebar({ open, onClose }: SidebarProps) {
  const [searchQuery, setSearchQuery] = useState("");
  const [debouncedSearchQuery, setDebouncedSearchQuery] = useState("");
  const [pinnedConversationIds, setPinnedConversationIds] = useState(readPinnedConversationIds);
+  const [selectionMode, setSelectionMode] = useState(false);
+  const [selectedIds, setSelectedIds] = useState<Set<string>>(new Set());
+
+  const toggleSelected = useCallback((id: string) => {
+    setSelectedIds((prev) => {
+      const next = new Set(prev);
+      if (next.has(id)) next.delete(id);
+      else next.add(id);
+      return next;
+    });
+  }, []);
+
+  const selectAll = useCallback((conversations: Conversation[]) => {
+    setSelectedIds(new Set(conversations.map((c) => c.id)));
+  }, []);
+
+  const deselectAll = useCallback(() => {
+    setSelectedIds(new Set());
+  }, []);
+
+  const exitSelectionMode = useCallback(() => {
+    setSelectionMode(false);
+    setSelectedIds(new Set());
+  }, []);

  // Debounce search input so we don't fire a server request on every
  // keystroke. 300 ms is fast enough to feel responsive.
@@ -325,24 +354,51 @@ export function Sidebar({ open, onClose }: SidebarProps) {
            )}
          </Link>
        </Button>
-        <div className="relative mt-3">
-          <SearchIcon className="-translate-y-1/2 pointer-events-none absolute top-1/2 left-2.5 size-3.5 text-muted-foreground" />
-          <input
-            type="search"
-            value={searchQuery}
-            onChange={(e) => setSearchQuery(e.target.value)}
-            aria-label="Search sessions"
-            placeholder="Search sessions"
-            className="min-h-8 w-full rounded-full border border-input pr-3 pl-8 text-sm transition placeholder:text-muted-foreground focus-visible:outline-1"
+        {selectionMode ? (
+          <BulkActionBar
+            selectedIds={selectedIds}
+            allConversations={(conversationsQuery.data?.pages ?? []).flatMap((page) => page.data)}
+            onSelectAll={() =>
+              selectAll((conversationsQuery.data?.pages ?? []).flatMap((page) => page.data))
+            }
+            onDeselectAll={deselectAll}
+            onClear={deselectAll}
+            onExit={exitSelectionMode}
          />
-        </div>
+        ) : (
+          <div className="relative mt-3 flex items-center gap-1.5">
+            <div className="relative flex-1">
+              <SearchIcon className="-translate-y-1/2 pointer-events-none absolute top-1/2 left-2.5 size-3.5 text-muted-foreground" />
+              <input
+                type="search"
+                value={searchQuery}
+                onChange={(e) => setSearchQuery(e.target.value)}
+                aria-label="Search sessions"
+                placeholder="Search sessions"
+                className="min-h-8 w-full rounded-full border border-input pr-3 pl-8 text-sm transition placeholder:text-muted-foreground focus-visible:outline-1"
+              />
+            </div>
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <Button
+                  type="button"
+                  variant="ghost"
+                  size="icon-sm"
+                  aria-label="Select sessions"
+                  data-testid="toggle-selection-mode"
+                  className="shrink-0 rounded-full"
+                  onClick={() => setSelectionMode(true)}
+                >
+                  <ListChecksIcon className="size-3.5" />
+                </Button>
+              </TooltipTrigger>
+              <TooltipContent side="bottom">Select sessions</TooltipContent>
+            </Tooltip>
+          </div>
+        )}
      </div>

-      {/* [scrollbar-gutter:stable]: with macOS classic (space-taking)
-          scrollbars, the list's scrollbar appearing/disappearing (e.g. while
-          a Radix menu locks scrolling) resizes every row — titles gain/lose
-          a character. Reserving the gutter keeps row width constant. */}
-      <nav className="flex-1 overflow-y-auto px-3 pb-3 [scrollbar-gutter:stable]">
+      <nav className="relative flex-1 overflow-y-auto px-3 pb-3 [scrollbar-gutter:stable]">
        <ConversationList
          conversationsQuery={conversationsQuery}
          onRowClick={onNavClick}
@@ -350,6 +406,9 @@ export function Sidebar({ open, onClose }: SidebarProps) {
          pinnedConversationIds={pinnedConversationIds}
          onPinnedConversationIdsChange={setPinnedConversationIds}
          onTogglePinned={togglePinnedConversation}
+          selectionMode={selectionMode}
+          selectedIds={selectedIds}
+          onToggleSelected={toggleSelected}
        />
      </nav>

@@ -369,6 +428,9 @@ interface ConversationListProps {
  pinnedConversationIds: string[];
  onPinnedConversationIdsChange: (ids: string[]) => void;
  onTogglePinned: (conversationId: string) => void;
+  selectionMode: boolean;
+  selectedIds: Set<string>;
+  onToggleSelected: (conversationId: string) => void;
 }

 // permission_level null (no ACL row / legacy) or >= 4 both mean owner.
@@ -383,6 +445,9 @@ function ConversationList({
  pinnedConversationIds,
  onPinnedConversationIdsChange,
  onTogglePinned,
+  selectionMode,
+  selectedIds,
+  onToggleSelected,
 }: ConversationListProps) {
  // All loaded conversations from the single paginated list (for pinned
  // backfill, normalization, and the flat session list).
@@ -517,6 +582,9 @@ function ConversationList({
              onToggleCollapsed={toggleSectionCollapsed}
              onRowClick={onRowClick}
              onTogglePinned={onTogglePinned}
+              selectionMode={selectionMode}
+              selectedIds={selectedIds}
+              onToggleSelected={onToggleSelected}
            />
          )}
          {sections.sessions.length > 0 && (
@@ -528,6 +596,9 @@ function ConversationList({
              onToggleCollapsed={toggleSectionCollapsed}
              onRowClick={onRowClick}
              onTogglePinned={onTogglePinned}
+              selectionMode={selectionMode}
+              selectedIds={selectedIds}
+              onToggleSelected={onToggleSelected}
            />
          )}
          {sections.shared.length > 0 && (
@@ -539,12 +610,11 @@ function ConversationList({
              onToggleCollapsed={toggleSectionCollapsed}
              onRowClick={onRowClick}
              onTogglePinned={onTogglePinned}
+              selectionMode={selectionMode}
+              selectedIds={selectedIds}
+              onToggleSelected={onToggleSelected}
            />
          )}
-          {/* Archived sessions, grouped at the very bottom (below "Shared
-              with me"). Collapsible + persisted like the other sections; this
-              is also the surface that makes the per-row "Unarchive" action
-              reachable again. */}
          {sections.archived.length > 0 && (
            <ConversationSection
              title="Archived"
@@ -554,6 +624,9 @@ function ConversationList({
              onToggleCollapsed={toggleSectionCollapsed}
              onRowClick={onRowClick}
              onTogglePinned={onTogglePinned}
+              selectionMode={selectionMode}
+              selectedIds={selectedIds}
+              onToggleSelected={onToggleSelected}
            />
          )}
          {/* Pagination extends the Recent list, so the button hides with
@@ -591,25 +664,26 @@ function ConversationSection({
  onToggleCollapsed,
  onRowClick,
  onTogglePinned,
+  selectionMode,
+  selectedIds,
+  onToggleSelected,
 }: {
-  // Section header, e.g. "Recent". Untitled sections render as a bare
-  // list and cannot collapse (there is no header to click).
  title?: string;
  conversations: Conversation[];
  pinnedConversationIds: string[];
-  /** Titles currently collapsed; an untitled section can't collapse. */
  collapsedSections: string[];
  onToggleCollapsed: (sectionTitle: string) => void;
  onRowClick: (e: MouseEvent<HTMLAnchorElement>) => void;
  onTogglePinned: (conversationId: string) => void;
+  selectionMode: boolean;
+  selectedIds: Set<string>;
+  onToggleSelected: (conversationId: string) => void;
 }) {
  const collapsed = title != null && collapsedSections.includes(title);
  return (
    <section>
      {title && (
        <h2>
-          {/* Full-width header button = a comfortable touch target on the
-              mobile drawer, where a chevron-sized hit area would be fiddly. */}
          <button
            type="button"
            aria-expanded={!collapsed}
@@ -617,9 +691,6 @@ function ConversationSection({
            className="group flex w-full items-center gap-1 rounded-md px-2 py-1 text-left text-xs font-medium text-muted-foreground transition-colors hover:text-foreground"
          >
            {title}
-            {/* Chevron trails the label (Codex/Cursor-style). Hidden until
-                hover when expanded; always visible when collapsed so the
-                hidden content stays discoverable. */}
            <ChevronRightIcon
              className={cn(
                "size-3.5 shrink-0 transition-transform",
@@ -638,6 +709,9 @@ function ConversationSection({
              isPinned={pinnedConversationIds.includes(conv.id)}
              onClick={onRowClick}
              onTogglePinned={onTogglePinned}
+              selectionMode={selectionMode}
+              isSelected={selectedIds.has(conv.id)}
+              onToggleSelected={onToggleSelected}
            />
          ))}
        </ul>
@@ -651,11 +725,17 @@ function ConversationRow({
  isPinned,
  onClick,
  onTogglePinned,
+  selectionMode,
+  isSelected,
+  onToggleSelected,
 }: {
  conversation: Conversation;
  isPinned: boolean;
  onClick: (e: MouseEvent<HTMLAnchorElement>) => void;
  onTogglePinned: (conversationId: string) => void;
+  selectionMode: boolean;
+  isSelected: boolean;
+  onToggleSelected: (conversationId: string) => void;
 }) {
  // `useParams` reads from the active matched route. On `/`, the param is
  // undefined; on `/c/:conversationId`, it carries the active id.
@@ -827,29 +907,26 @@ function ConversationRow({
  return (
    <li className="group relative">
      <Link
-        to={`/c/${conversation.id}`}
+        to={selectionMode ? "#" : `/c/${conversation.id}`}
        className={cn(
-          // Right padding reserves room for the trailing controls so long
-          // titles truncate before colliding with them. On desktop the time
-          // marker shares a slot with the hover controls (pin + kebab,
-          // swapped in on hover), so reserve room for both (pr-16). On
-          // mobile there's no hover, so the marker, pin, and kebab are all
-          // visible side by side — reserve pr-28 to clear the marker that
-          // sits left of them. The wide "Needs response" tag replaces the
-          // timestamp in that slot, so reserve extra room for it
-          // (pr-44 / md:pr-28). flex-col stacks the name row over the
-          // git-branch subtitle row.
          "relative flex w-full flex-col gap-0.5 rounded-md px-4 py-2 text-left text-sm hover:bg-muted",
-          sessionState?.kind === "awaiting" ? "pr-44 md:pr-28" : "pr-28 md:pr-16",
+          !selectionMode &&
+            (sessionState?.kind === "awaiting" ? "pr-44 md:pr-28" : "pr-28 md:pr-16"),
+          selectionMode && "pr-10",
          isActive && "bg-muted font-semibold",
+          selectionMode && isSelected && "bg-primary/5",
        )}
-        onClick={onClick}
-        // Double-click renames inline (a quick alternative to the kebab's
-        // Rename item). The first click of the gesture still selects/navigates
-        // the row natively; the dblclick then swaps in the edit field. Gated on
-        // edit permission so a viewer-only row stays read-only. preventDefault
-        // suppresses the browser's double-click text selection on the title.
+        onClick={(e) => {
+          if (selectionMode) {
+            e.preventDefault();
+            e.stopPropagation();
+            onToggleSelected(conversation.id);
+            return;
+          }
+          onClick(e);
+        }}
        onDoubleClick={(e) => {
+          if (selectionMode) return;
          if (!canEdit) return;
          e.preventDefault();
          setIsEditing(true);
@@ -878,17 +955,15 @@ function ConversationRow({
          </span>
        )}
      </Link>
-      {/* Time-marker slot. On desktop it shares the controls' slot (right-2)
-          and fades out on hover/focus so the pin + kebab can take over in
-          place. On mobile there is no hover, so it sits to the left of the
-          always-visible pin + kebab (right-[4.5rem]) and stays put — they
-          read side by side. When the session has a state badge (working dot,
-          "Needs response", unseen dot), the badge takes this slot INSTEAD of
-          the timestamp — the row shows one trailing marker, never both. */}
-      {sessionState !== null ? (
-        // pointer-events-none keeps clicks falling through to the row, so
-        // the badge's hover tooltip is intentionally inert here; screen
-        // readers still get the badge's own role="img" aria-label.
+      {selectionMode ? (
+        <span className="-translate-y-1/2 pointer-events-none absolute top-1/2 right-2.5 flex items-center">
+          {isSelected ? (
+            <SquareCheckIcon className="size-4 text-primary" />
+          ) : (
+            <SquareIcon className="size-4 text-muted-foreground" />
+          )}
+        </span>
+      ) : sessionState !== null ? (
        <span className={TIME_MARKER_SLOT_CLASS}>
          <SessionStateBadge state={sessionState} />
        </span>
@@ -901,188 +976,193 @@ function ConversationRow({
          {relativeTime(conversation.updated_at * 1000)}
        </span>
      )}
-      {/* Quick pin/unpin — the sole pin affordance now (removed from the
-          kebab menu). Sits just left of the kebab. On mobile (no hover) it's
-          always visible alongside the kebab; on desktop it reveals on
-          hover/focus, and stays surfaced while the kebab menu is open so it
-          doesn't vanish when the row's controls are otherwise visible. */}
-      <Button
-        type="button"
-        variant="ghost"
-        size="icon-sm"
-        aria-label={isPinned ? "Unpin conversation" : "Pin conversation"}
-        data-testid="quick-pin-conversation"
-        className={cn(
-          "-translate-y-1/2 absolute top-1/2 right-9 transition-opacity",
-          "md:opacity-0 md:group-hover:opacity-100",
-          "md:group-has-[:focus-visible]:opacity-100 md:group-has-[[aria-expanded=true]]:opacity-100",
-        )}
-        onClick={(e) => {
-          // Keep the toggle click off the surrounding Link (no navigation).
-          e.preventDefault();
-          e.stopPropagation();
-          onTogglePinned(conversation.id);
-        }}
-      >
-        {isPinned ? <PinOffIcon className="size-3.5" /> : <PinIcon className="size-3.5" />}
-      </Button>
-      <DropdownMenu>
-        <DropdownMenuTrigger asChild>
-          <Button
-            type="button"
-            variant="ghost"
-            size="icon-sm"
-            aria-label="Conversation actions"
-            data-testid="conversation-actions"
-            // Absolute-positioned trigger. On mobile (no hover state)
-            // it's always visible. On desktop it stays hidden until
-            // hover / keyboard focus, with `aria-expanded` keeping it
-            // surfaced while the menu is open so the trigger doesn't
-            // vanish under the cursor.
-            className={cn(
-              "-translate-y-1/2 absolute top-1/2 right-1 transition-opacity",
-              "md:opacity-0 md:group-hover:opacity-100 md:group-has-[:focus-visible]:opacity-100",
-              "md:aria-expanded:opacity-100",
-            )}
-            onClick={(e) => {
-              // Keep the trigger click from bubbling into the Link.
-              e.preventDefault();
-              e.stopPropagation();
-            }}
-          >
-            <MoreHorizontalIcon className="size-3.5" />
-          </Button>
-        </DropdownMenuTrigger>
-        <DropdownMenuContent align="end" className="min-w-36">
-          {isOwner ? (
-            <DropdownMenuItem data-testid="archive-conversation" onSelect={runArchive}>
-              {isArchived ? (
-                <ArchiveRestoreIcon className="size-3.5" />
-              ) : (
-                <ArchiveIcon className="size-3.5" />
+      {!selectionMode && (
+        <Button
+          type="button"
+          variant="ghost"
+          size="icon-sm"
+          aria-label={isPinned ? "Unpin conversation" : "Pin conversation"}
+          data-testid="quick-pin-conversation"
+          className={cn(
+            "-translate-y-1/2 absolute top-1/2 right-9 transition-opacity",
+            "md:opacity-0 md:group-hover:opacity-100",
+            "md:group-has-[:focus-visible]:opacity-100 md:group-has-[[aria-expanded=true]]:opacity-100",
+          )}
+          onClick={(e) => {
+            // Keep the toggle click off the surrounding Link (no navigation).
+            e.preventDefault();
+            e.stopPropagation();
+            onTogglePinned(conversation.id);
+          }}
+        >
+          {isPinned ? <PinOffIcon className="size-3.5" /> : <PinIcon className="size-3.5" />}
+        </Button>
+      )}
+      {!selectionMode && (
+        <DropdownMenu>
+          <DropdownMenuTrigger asChild>
+            <Button
+              type="button"
+              variant="ghost"
+              size="icon-sm"
+              aria-label="Conversation actions"
+              data-testid="conversation-actions"
+              // Absolute-positioned trigger. On mobile (no hover state)
+              // it's always visible. On desktop it stays hidden until
+              // hover / keyboard focus, with `aria-expanded` keeping it
+              // surfaced while the menu is open so the trigger doesn't
+              // vanish under the cursor.
+              className={cn(
+                "-translate-y-1/2 absolute top-1/2 right-1 transition-opacity",
+                "md:opacity-0 md:group-hover:opacity-100 md:group-has-[:focus-visible]:opacity-100",
+                "md:aria-expanded:opacity-100",
              )}
-              {isArchived ? "Unarchive" : "Archive"}
-            </DropdownMenuItem>
-          ) : (
-            <Tooltip>
-              <TooltipTrigger asChild>
-                <div>
-                  <DropdownMenuItem data-testid="archive-conversation" disabled>
-                    {isArchived ? (
-                      <ArchiveRestoreIcon className="size-3.5" />
-                    ) : (
-                      <ArchiveIcon className="size-3.5" />
-                    )}
-                    {isArchived ? "Unarchive" : "Archive"}
-                  </DropdownMenuItem>
-                </div>
-              </TooltipTrigger>
-              <TooltipContent side="left">
-                Only the session owner can {isArchived ? "unarchive" : "archive"} this session
-              </TooltipContent>
-            </Tooltip>
-          )}
-          {canManage ? (
-            <DropdownMenuItem data-testid="share-conversation" onSelect={() => setShareOpen(true)}>
-              <ShareIcon className="size-3.5" />
-              Share
-            </DropdownMenuItem>
-          ) : (
-            <Tooltip>
-              <TooltipTrigger asChild>
-                <div>
-                  <DropdownMenuItem data-testid="share-conversation" disabled>
-                    <ShareIcon className="size-3.5" />
-                    Share
-                  </DropdownMenuItem>
-                </div>
-              </TooltipTrigger>
-              <TooltipContent side="left">
-                You need manage permissions to share this session
-              </TooltipContent>
-            </Tooltip>
-          )}
-          {canEdit ? (
-            <DropdownMenuItem data-testid="rename-conversation" onSelect={() => setIsEditing(true)}>
-              <PencilIcon className="size-3.5" />
-              Rename
-            </DropdownMenuItem>
-          ) : (
-            <Tooltip>
-              <TooltipTrigger asChild>
-                <div>
-                  <DropdownMenuItem data-testid="rename-conversation" disabled>
-                    <PencilIcon className="size-3.5" />
-                    Rename
-                  </DropdownMenuItem>
-                </div>
-              </TooltipTrigger>
-              <TooltipContent side="left">
-                You need edit permissions to rename this session
-              </TooltipContent>
-            </Tooltip>
-          )}
-          {/* Stop session — only on stoppable sessions whose runner isn't
-              already known-offline (canStop). Owner-gated like Delete:
-              non-owners see it disabled with an explanatory tooltip. */}
-          {canStop &&
-            (isOwner ? (
-              <DropdownMenuItem
-                data-testid="stop-conversation"
-                variant="destructive"
-                onSelect={() => {
-                  // Clear any prior failure so a stale "couldn't stop"
-                  // message doesn't greet the next attempt. Must happen
-                  // here: Radix only fires the Dialog's onOpenChange for
-                  // Radix-initiated changes, not this programmatic open.
-                  stopSession.reset();
-                  setStopOpen(true);
-                }}
-              >
-                <CircleStopIcon className="size-3.5" />
-                Stop session
+              onClick={(e) => {
+                // Keep the trigger click from bubbling into the Link.
+                e.preventDefault();
+                e.stopPropagation();
+              }}
+            >
+              <MoreHorizontalIcon className="size-3.5" />
+            </Button>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent align="end" className="min-w-36">
+            {isOwner ? (
+              <DropdownMenuItem data-testid="archive-conversation" onSelect={runArchive}>
+                {isArchived ? (
+                  <ArchiveRestoreIcon className="size-3.5" />
+                ) : (
+                  <ArchiveIcon className="size-3.5" />
+                )}
+                {isArchived ? "Unarchive" : "Archive"}
              </DropdownMenuItem>
            ) : (
              <Tooltip>
                <TooltipTrigger asChild>
                  <div>
-                    <DropdownMenuItem data-testid="stop-conversation" disabled>
-                      <CircleStopIcon className="size-3.5" />
-                      Stop session
+                    <DropdownMenuItem data-testid="archive-conversation" disabled>
+                      {isArchived ? (
+                        <ArchiveRestoreIcon className="size-3.5" />
+                      ) : (
+                        <ArchiveIcon className="size-3.5" />
+                      )}
+                      {isArchived ? "Unarchive" : "Archive"}
                    </DropdownMenuItem>
                  </div>
                </TooltipTrigger>
                <TooltipContent side="left">
-                  Only the session owner can stop this session
+                  Only the session owner can {isArchived ? "unarchive" : "archive"} this session
                </TooltipContent>
              </Tooltip>
-            ))}
-          {isOwner ? (
-            <DropdownMenuItem
-              data-testid="delete-conversation"
-              variant="destructive"
-              onSelect={() => setDeleteOpen(true)}
-            >
-              <Trash2Icon className="size-3.5" />
-              Delete
-            </DropdownMenuItem>
-          ) : (
-            <Tooltip>
-              <TooltipTrigger asChild>
-                <div>
-                  <DropdownMenuItem data-testid="delete-conversation" disabled>
-                    <Trash2Icon className="size-3.5" />
-                    Delete
-                  </DropdownMenuItem>
-                </div>
-              </TooltipTrigger>
-              <TooltipContent side="left">
-                Only the session owner can delete this session
-              </TooltipContent>
-            </Tooltip>
-          )}
-        </DropdownMenuContent>
-      </DropdownMenu>
+            )}
+            {canManage ? (
+              <DropdownMenuItem
+                data-testid="share-conversation"
+                onSelect={() => setShareOpen(true)}
+              >
+                <ShareIcon className="size-3.5" />
+                Share
+              </DropdownMenuItem>
+            ) : (
+              <Tooltip>
+                <TooltipTrigger asChild>
+                  <div>
+                    <DropdownMenuItem data-testid="share-conversation" disabled>
+                      <ShareIcon className="size-3.5" />
+                      Share
+                    </DropdownMenuItem>
+                  </div>
+                </TooltipTrigger>
+                <TooltipContent side="left">
+                  You need manage permissions to share this session
+                </TooltipContent>
+              </Tooltip>
+            )}
+            {canEdit ? (
+              <DropdownMenuItem
+                data-testid="rename-conversation"
+                onSelect={() => setIsEditing(true)}
+              >
+                <PencilIcon className="size-3.5" />
+                Rename
+              </DropdownMenuItem>
+            ) : (
+              <Tooltip>
+                <TooltipTrigger asChild>
+                  <div>
+                    <DropdownMenuItem data-testid="rename-conversation" disabled>
+                      <PencilIcon className="size-3.5" />
+                      Rename
+                    </DropdownMenuItem>
+                  </div>
+                </TooltipTrigger>
+                <TooltipContent side="left">
+                  You need edit permissions to rename this session
+                </TooltipContent>
+              </Tooltip>
+            )}
+            {/* Stop session — only on stoppable sessions whose runner isn't
+              already known-offline (canStop). Owner-gated like Delete:
+              non-owners see it disabled with an explanatory tooltip. */}
+            {canStop &&
+              (isOwner ? (
+                <DropdownMenuItem
+                  data-testid="stop-conversation"
+                  variant="destructive"
+                  onSelect={() => {
+                    // Clear any prior failure so a stale "couldn't stop"
+                    // message doesn't greet the next attempt. Must happen
+                    // here: Radix only fires the Dialog's onOpenChange for
+                    // Radix-initiated changes, not this programmatic open.
+                    stopSession.reset();
+                    setStopOpen(true);
+                  }}
+                >
+                  <CircleStopIcon className="size-3.5" />
+                  Stop session
+                </DropdownMenuItem>
+              ) : (
+                <Tooltip>
+                  <TooltipTrigger asChild>
+                    <div>
+                      <DropdownMenuItem data-testid="stop-conversation" disabled>
+                        <CircleStopIcon className="size-3.5" />
+                        Stop session
+                      </DropdownMenuItem>
+                    </div>
+                  </TooltipTrigger>
+                  <TooltipContent side="left">
+                    Only the session owner can stop this session
+                  </TooltipContent>
+                </Tooltip>
+              ))}
+            {isOwner ? (
+              <DropdownMenuItem
+                data-testid="delete-conversation"
+                variant="destructive"
+                onSelect={() => setDeleteOpen(true)}
+              >
+                <Trash2Icon className="size-3.5" />
+                Delete
+              </DropdownMenuItem>
+            ) : (
+              <Tooltip>
+                <TooltipTrigger asChild>
+                  <div>
+                    <DropdownMenuItem data-testid="delete-conversation" disabled>
+                      <Trash2Icon className="size-3.5" />
+                      Delete
+                    </DropdownMenuItem>
+                  </div>
+                </TooltipTrigger>
+                <TooltipContent side="left">
+                  Only the session owner can delete this session
+                </TooltipContent>
+              </Tooltip>
+            )}
+          </DropdownMenuContent>
+        </DropdownMenu>
+      )}
      <PermissionsModal sessionId={conversation.id} open={shareOpen} onOpenChange={setShareOpen} />
      <Dialog
        open={deleteOpen}
@@ -1374,6 +1454,292 @@ function ConversationEditRow({ initialTitle, onCommit, onCancel }: ConversationE
  );
 }

+function BulkActionBar({
+  selectedIds,
+  allConversations,
+  onSelectAll,
+  onDeselectAll,
+  onClear,
+  onExit,
+}: {
+  selectedIds: Set<string>;
+  allConversations: Conversation[];
+  onSelectAll: () => void;
+  onDeselectAll: () => void;
+  onClear: () => void;
+  onExit: () => void;
+}) {
+  const navigate = useNavigate();
+  const { conversationId: activeId } = useParams<{ conversationId: string }>();
+  const bulkArchive = useBulkArchiveConversations();
+  const bulkDelete = useBulkDeleteConversations();
+
+  const selectedConversations = useMemo(
+    () => allConversations.filter((c) => selectedIds.has(c.id)),
+    [allConversations, selectedIds],
+  );
+
+  const ownedSelected = useMemo(
+    () => selectedConversations.filter((c) => isOwnedByViewer(c)),
+    [selectedConversations],
+  );
+
+  const archivedSelected = useMemo(
+    () => ownedSelected.filter((c) => c.archived === true),
+    [ownedSelected],
+  );
+
+  const nonArchivedSelected = useMemo(
+    () => ownedSelected.filter((c) => c.archived !== true),
+    [ownedSelected],
+  );
+
+  const allSelectedSameArchiveGroup =
+    ownedSelected.length > 0 && (archivedSelected.length === 0 || nonArchivedSelected.length === 0);
+
+  const count = selectedIds.size;
+  const allSelected = count > 0 && count === allConversations.length;
+  const isBusy = bulkArchive.isPending || bulkDelete.isPending;
+
+  const [confirmDeleteOpen, setConfirmDeleteOpen] = useState(false);
+
+  function handleArchive() {
+    if (nonArchivedSelected.length === 0) return;
+    bulkArchive.mutate(
+      { ids: nonArchivedSelected.map((c) => c.id), archived: true },
+      {
+        onSuccess: () => {
+          onDeselectAll();
+        },
+      },
+    );
+  }
+
+  function handleUnarchive() {
+    if (archivedSelected.length === 0) return;
+    bulkArchive.mutate(
+      { ids: archivedSelected.map((c) => c.id), archived: false },
+      {
+        onSuccess: () => {
+          onDeselectAll();
+        },
+      },
+    );
+  }
+
+  function handleDelete() {
+    const ids = ownedSelected.map((c) => c.id);
+    if (ids.length === 0) return;
+    setConfirmDeleteOpen(false);
+    bulkDelete.mutate(ids, {
+      onSuccess: () => {
+        if (activeId && ids.includes(activeId)) navigate("/", { replace: true });
+        onDeselectAll();
+      },
+      onError: (err: any) => {
+        if (activeId && err?.succeeded?.includes(activeId)) navigate("/", { replace: true });
+      },
+    });
+  }
+
+  return (
+    <>
+      <div className="relative mt-3 flex flex-col gap-1.5">
+        <div className="relative flex min-h-8 items-center gap-1.5 px-2 pr-9">
+          <span className="shrink-0 whitespace-nowrap text-sm text-muted-foreground">
+            {count === 0 ? "None selected" : `${count} selected`}
+          </span>
+          <Button
+            type="button"
+            variant="ghost"
+            size="sm"
+            className="h-6 px-1.5 text-sm"
+            onClick={allSelected ? onDeselectAll : onSelectAll}
+          >
+            {allSelected ? "Deselect all" : "Select all"}
+          </Button>
+          <Button
+            type="button"
+            variant="ghost"
+            size="sm"
+            className="h-6 px-1.5 text-sm"
+            disabled={count === 0}
+            onClick={onClear}
+          >
+            Clear
+          </Button>
+          {count > 0 && (
+            <div className="flex items-center gap-1.5 md:hidden">
+              {allSelectedSameArchiveGroup && nonArchivedSelected.length > 0 && (
+                <Button
+                  type="button"
+                  variant="outline"
+                  size="sm"
+                  className="h-7 gap-1.5 text-xs"
+                  disabled={isBusy}
+                  onClick={handleArchive}
+                >
+                  {bulkArchive.isPending ? (
+                    <Loader2Icon className="size-3 animate-spin" />
+                  ) : (
+                    <ArchiveIcon className="size-3" />
+                  )}
+                  Archive
+                </Button>
+              )}
+              {allSelectedSameArchiveGroup && archivedSelected.length > 0 && (
+                <Button
+                  type="button"
+                  variant="outline"
+                  size="sm"
+                  className="h-7 gap-1.5 text-xs"
+                  disabled={isBusy}
+                  onClick={handleUnarchive}
+                >
+                  {bulkArchive.isPending ? (
+                    <Loader2Icon className="size-3 animate-spin" />
+                  ) : (
+                    <ArchiveRestoreIcon className="size-3" />
+                  )}
+                  Unarchive
+                </Button>
+              )}
+              <Button
+                type="button"
+                variant="outline"
+                size="sm"
+                className="h-7 gap-1.5 text-xs text-destructive"
+                disabled={isBusy || ownedSelected.length === 0}
+                onClick={() => setConfirmDeleteOpen(true)}
+              >
+                {bulkDelete.isPending ? (
+                  <Loader2Icon className="size-3 animate-spin" />
+                ) : (
+                  <Trash2Icon className="size-3" />
+                )}
+                Delete {ownedSelected.length > 0 ? ownedSelected.length : ""}
+              </Button>
+            </div>
+          )}
+          <Tooltip>
+            <TooltipTrigger asChild>
+              <Button
+                type="button"
+                variant="secondary"
+                size="icon-sm"
+                className="-translate-y-1/2 absolute top-1/2 right-0 shrink-0 rounded-full"
+                aria-label="Exit selection mode"
+                data-testid="toggle-selection-mode"
+                onClick={onExit}
+              >
+                <XIcon className="size-3.5" />
+              </Button>
+            </TooltipTrigger>
+            <TooltipContent side="bottom">Exit selection</TooltipContent>
+          </Tooltip>
+        </div>
+
+        {count > 0 && (
+          <div className="hidden items-center gap-1.5 px-2 md:flex">
+            {allSelectedSameArchiveGroup && nonArchivedSelected.length > 0 && (
+              <Button
+                type="button"
+                variant="outline"
+                size="sm"
+                className="h-7 gap-1.5 text-xs"
+                disabled={isBusy}
+                onClick={handleArchive}
+                data-testid="bulk-archive"
+              >
+                {bulkArchive.isPending ? (
+                  <Loader2Icon className="size-3 animate-spin" />
+                ) : (
+                  <ArchiveIcon className="size-3" />
+                )}
+                Archive
+              </Button>
+            )}
+            {allSelectedSameArchiveGroup && archivedSelected.length > 0 && (
+              <Button
+                type="button"
+                variant="outline"
+                size="sm"
+                className="h-7 gap-1.5 text-xs"
+                disabled={isBusy}
+                onClick={handleUnarchive}
+                data-testid="bulk-unarchive"
+              >
+                {bulkArchive.isPending ? (
+                  <Loader2Icon className="size-3 animate-spin" />
+                ) : (
+                  <ArchiveRestoreIcon className="size-3" />
+                )}
+                Unarchive
+              </Button>
+            )}
+            <Button
+              type="button"
+              variant="outline"
+              size="sm"
+              className="h-7 gap-1.5 text-xs text-destructive"
+              disabled={isBusy || ownedSelected.length === 0}
+              onClick={() => setConfirmDeleteOpen(true)}
+              data-testid="bulk-delete"
+            >
+              {bulkDelete.isPending ? (
+                <Loader2Icon className="size-3 animate-spin" />
+              ) : (
+                <Trash2Icon className="size-3" />
+              )}
+              Delete {ownedSelected.length > 0 ? ownedSelected.length : ""}
+            </Button>
+          </div>
+        )}
+
+        {(bulkArchive.isError || bulkDelete.isError) && (
+          <p className="text-xs text-destructive" role="alert">
+            Some actions failed. Retry or dismiss.
+          </p>
+        )}
+      </div>
+
+      <Dialog open={confirmDeleteOpen} onOpenChange={setConfirmDeleteOpen}>
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>Delete {ownedSelected.length} session(s)?</DialogTitle>
+            <DialogDescription>
+              This will permanently delete the selected sessions and all their history. This cannot
+              be undone.
+            </DialogDescription>
+          </DialogHeader>
+          <p className="flex items-start gap-2 rounded-md border border-warning/40 bg-warning/5 p-3 text-xs text-muted-foreground">
+            <AlertTriangleIcon className="mt-0.5 size-3.5 shrink-0 text-warning" />
+            Branches are not cleaned up. Use single-session delete for branch surgery.
+          </p>
+          <DialogFooter className="border-t-0 bg-transparent">
+            <Button
+              type="button"
+              variant="ghost"
+              onClick={() => setConfirmDeleteOpen(false)}
+              disabled={bulkDelete.isPending}
+            >
+              Cancel
+            </Button>
+            <Button
+              type="button"
+              variant="destructive"
+              onClick={handleDelete}
+              disabled={bulkDelete.isPending}
+            >
+              Delete {ownedSelected.length} session(s)
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+    </>
+  );
+}
+
 /**
 * Returns true on mobile viewports (below the `md` breakpoint of
 * 768px). Used to gate the auto-close-on-navigation behavior — on
@@ -32,6 +32,7 @@ import { Link, useLocation } from "@/lib/routing";
 import { Badge } from "@/components/ui/badge";
 import { ClaudeIcon } from "@/components/icons/ClaudeIcon";
 import { CodexIcon } from "@/components/icons/CodexIcon";
+import { CursorIcon } from "@/components/icons/CursorIcon";
 import { NessieIcon } from "@/components/icons/NessieIcon";
 import { OttoIcon } from "@/components/icons/OttoIcon";
 import { PiIcon } from "@/components/icons/PiIcon";
@@ -304,6 +305,7 @@ function brandChildIcon(child: ChildSessionInfo): AgentRowIcon | null {
  if (nativeAgent?.iconKind === "claude") return ClaudeIcon;
  if (nativeAgent?.iconKind === "codex") return CodexIcon;
  if (nativeAgent?.iconKind === "pi") return PiIcon;
+  if (nativeAgent?.iconKind === "cursor") return CursorIcon;
  // Exact match — substring checks would false-match names like "pipeline".
  if (child.tool === PI_AGENT_NAME) return PiIcon;
  return null;
@@ -462,9 +464,11 @@ function MainRow({ rootSessionId, isActive }: { rootSessionId: string; isActive:
        ? CodexIcon
        : nativeAgent?.iconKind === "pi"
          ? PiIcon
-          : isNessie
-            ? NessieIcon
-            : BotIcon;
+          : nativeAgent?.iconKind === "cursor"
+            ? CursorIcon
+            : isNessie
+              ? NessieIcon
+              : BotIcon;
  // Native wrappers show the product name (mirroring the sidebar) instead
  // of the spec's YAML name (e.g. "claude-native-ui"); other agents show
  // their agent name, with "main" only while the session loads or when it
@@ -1,10 +1,13 @@
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, vi } from "vitest";
 import {
+  HTML_PREVIEW_SANDBOX,
  detectLang,
  getSelectionOffsets,
  indexToLine,
  isBinaryPath,
  lineOverlapsSelection,
+  openHtmlArtifactInNewTab,
+  prepareHtmlPreviewDoc,
 } from "./codeViewerHelpers";

 // ---------------------------------------------------------------------------
@@ -164,6 +167,115 @@ describe("indexToLine", () => {
  });
 });

+// ---------------------------------------------------------------------------
+// prepareHtmlPreviewDoc — force links to open in a new tab (issue #777)
+// ---------------------------------------------------------------------------
+
+describe("prepareHtmlPreviewDoc", () => {
+  const BASE = '<base target="_blank">';
+
+  it("injects the base tag inside an existing <head>", () => {
+    const html = "<!DOCTYPE html><html><head><title>x</title></head><body>hi</body></html>";
+    const out = prepareHtmlPreviewDoc(html);
+    expect(out).toContain(`<head>${BASE}<title>x</title>`);
+    // Doctype stays first so the document keeps standards mode.
+    expect(out.indexOf("<!DOCTYPE html>")).toBe(0);
+  });
+
+  it("matches <head> with attributes", () => {
+    const out = prepareHtmlPreviewDoc('<head lang="en"><meta></head>');
+    expect(out).toContain(`<head lang="en">${BASE}<meta>`);
+  });
+
+  it("creates a <head> after <html> when none exists", () => {
+    const out = prepareHtmlPreviewDoc("<!DOCTYPE html><html><body>hi</body></html>");
+    expect(out).toContain(`<html><head>${BASE}</head><body>`);
+    expect(out.indexOf("<!DOCTYPE html>")).toBe(0);
+  });
+
+  it("prepends the base tag for a bare fragment (no doctype to displace)", () => {
+    const out = prepareHtmlPreviewDoc('<a href="https://example.com">link</a>');
+    expect(out).toBe(`${BASE}<a href="https://example.com">link</a>`);
+  });
+
+  it("is case-insensitive on the HEAD tag", () => {
+    const out = prepareHtmlPreviewDoc("<HEAD></HEAD>");
+    expect(out).toContain(`<HEAD>${BASE}`);
+  });
+
+  it("preserves an existing <base href>; the injected target tag wins by order", () => {
+    // Browsers use the first <base> for each attribute, so injecting our
+    // `target` tag ahead of the artifact's keeps its `href` intact while still
+    // forcing links to a new tab.
+    const html = '<head><base href="https://cdn.example.com/"></head>';
+    const out = prepareHtmlPreviewDoc(html);
+    expect(out).toBe(`<head>${BASE}<base href="https://cdn.example.com/"></head>`);
+    expect(out.indexOf(BASE)).toBeLessThan(out.indexOf("<base href"));
+  });
+
+  it("injects exactly one base tag per call (no duplicates)", () => {
+    const out = prepareHtmlPreviewDoc("<head></head>");
+    expect(out.match(/<base target="_blank">/g)).toHaveLength(1);
+  });
+
+  it("is idempotent: re-preparing already-prepared content adds no second base tag", () => {
+    const once = prepareHtmlPreviewDoc("<head></head>");
+    const twice = prepareHtmlPreviewDoc(once);
+    expect(twice).toBe(once);
+    expect(twice.match(/<base target="_blank">/g)).toHaveLength(1);
+  });
+
+  it("still injects a real base when the literal base string only appears in content", () => {
+    // Regression: a loose `html.includes(baseTag)` idempotency check wrongly
+    // skipped injection for content that merely *mentions* the string (e.g. a
+    // comment or code sample), leaving links to navigate the preview in place
+    // instead of opening a new tab. The base must still land in <head>.
+    const html = '<html><head></head><body><!-- <base target="_blank"> --></body></html>';
+    const out = prepareHtmlPreviewDoc(html);
+    expect(out).toContain(`<head>${BASE}</head>`);
+  });
+
+  it("documents the matcher limitation: a <head> literal in earlier markup is matched textually", () => {
+    // A simple regex (not a full parser) matches the first <head> string, even
+    // inside a comment. This only mis-places the harmless base tag inside the
+    // sandboxed preview — never a security issue — so we lock in the behavior.
+    const out = prepareHtmlPreviewDoc("<!-- <head> --><html><head></head></html>");
+    expect(out).toBe(`<!-- <head>${BASE} --><html><head></head></html>`);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// openHtmlArtifactInNewTab — pop-out renders in an isolated sandboxed iframe
+// ---------------------------------------------------------------------------
+
+describe("openHtmlArtifactInNewTab", () => {
+  it("renders the artifact in a sandboxed, opaque-origin iframe (never the app origin)", () => {
+    // A real (detached) document stands in for the popped tab's document.
+    const shellDoc = document.implementation.createHTMLDocument("");
+    const open = vi.fn(() => ({ document: shellDoc }) as unknown as Window);
+
+    const ok = openHtmlArtifactInNewTab("<h1>hi</h1>", "art.html", { open });
+
+    expect(ok).toBe(true);
+    // Critically: the artifact is NOT navigated to as a top-level blob:/data:
+    // page (which would inherit the app origin) — it's hosted in about:blank.
+    expect(open).toHaveBeenCalledWith("about:blank", "_blank");
+    const frame = shellDoc.querySelector("iframe");
+    expect(frame).not.toBeNull();
+    const sandbox = frame!.getAttribute("sandbox") ?? "";
+    expect(sandbox).toBe(HTML_PREVIEW_SANDBOX);
+    // Security invariant: the artifact must never share the app's origin.
+    expect(sandbox).not.toContain("allow-same-origin");
+    // Links still open in a new tab inside the pop-out (#777).
+    expect(frame!.getAttribute("srcdoc")).toContain('<base target="_blank">');
+  });
+
+  it("returns false when the popup is blocked (window.open → null)", () => {
+    const open = vi.fn(() => null);
+    expect(openHtmlArtifactInNewTab("<h1>hi</h1>", "art.html", { open })).toBe(false);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // lineOverlapsSelection
 // ---------------------------------------------------------------------------
@@ -186,6 +186,130 @@ export function detectLang(path: string): BundledLanguage | "text" {
  return map[ext] ?? "text";
 }

+// ---------------------------------------------------------------------------
+// HTML preview helpers
+// ---------------------------------------------------------------------------
+
+/**
+ * Sandbox flags for the HTML artifact preview iframe.
+ *
+ * - `allow-scripts` — run the page's JavaScript (without this, JS in rendered
+ *   HTML is silently dropped — see issue #778).
+ * - `allow-popups` + `allow-popups-to-escape-sandbox` — let links/`window.open`
+ *   open a new browsing context that is NOT itself sandboxed, so clicking a
+ *   link actually navigates a real tab (see issue #777).
+ * - `allow-forms` / `allow-modals` — typical interactive artifacts submit forms
+ *   and call `alert`/`confirm`.
+ *
+ * NOTE: we deliberately omit `allow-same-origin`. The iframe is fed via
+ * `srcDoc`, which would otherwise inherit the embedder's origin — combining
+ * that with `allow-scripts` would let untrusted artifact code reach into the
+ * parent app (cookies, storage, DOM). Withholding it gives the document an
+ * opaque origin, so scripts run fully sandboxed away from the host page.
+ *
+ * Accepted trade-offs from these flags: `allow-popups-to-escape-sandbox` lets
+ * artifact JS spawn fully-capable new windows (phishing / window-spam surface),
+ * and `allow-modals` lets it raise blocking `alert`/`confirm`/`prompt` dialogs.
+ * Neither can reach app data (the opaque origin still applies / the spawned
+ * window's `opener` is the opaque frame), so these are bounded nuisance risks
+ * we accept in exchange for links and interactive artifacts behaving normally.
+ */
+export const HTML_PREVIEW_SANDBOX =
+  "allow-scripts allow-popups allow-popups-to-escape-sandbox allow-forms allow-modals";
+
+/**
+ * Prepare HTML artifact content for the preview iframe by forcing every link to
+ * open in a new tab (issue #777: "We should always make it open in a new
+ * window").
+ *
+ * We inject `<base target="_blank">` rather than rewriting individual anchors so
+ * it covers links created at runtime by scripts too. Placement matters: a
+ * `<base>` (or anything) before the `<!DOCTYPE>` would push the document into
+ * quirks mode and change how the artifact renders, so we insert *inside* the
+ * existing `<head>`/`<html>` when present and only fall back to prepending for
+ * bare fragments that have no doctype to displace.
+ *
+ * The matcher is a deliberately simple regex, NOT a full HTML parser: parsing
+ * and re-serializing untrusted artifact content could subtly alter how it
+ * renders. The known trade-off is that a `<head>` literal appearing earlier in
+ * the source (e.g. inside a comment or a script string) is matched textually.
+ * That only ever mis-places the base tag *inside the sandboxed preview* — it
+ * can break that one artifact's own link-targeting, never the host app's
+ * security — so it's an accepted limitation rather than a bug to parse around.
+ */
+export function prepareHtmlPreviewDoc(html: string): string {
+  const baseTag = '<base target="_blank">';
+
+  const headMatch = html.match(/<head[^>]*>/i);
+  if (headMatch?.index !== undefined) {
+    const insertAt = headMatch.index + headMatch[0].length;
+    // Idempotency guard, scoped to the actual injection point: only skip if our
+    // base tag is ALREADY right after <head> (i.e. content was prepared twice).
+    // We must NOT use a loose `html.includes(baseTag)` — the literal string can
+    // legitimately appear elsewhere in artifact content (a comment, a code
+    // sample), and skipping injection there would leave the document with no
+    // real <base>, so links navigate the preview in place instead of opening a
+    // new tab.
+    if (html.startsWith(baseTag, insertAt)) return html;
+    return html.slice(0, insertAt) + baseTag + html.slice(insertAt);
+  }
+
+  // No <head>: create one right after <html> so the base still lands inside the
+  // document head (after the doctype, preserving standards mode). A second pass
+  // matches the <head> we created above, so this path is idempotent too.
+  const htmlMatch = html.match(/<html[^>]*>/i);
+  if (htmlMatch?.index !== undefined) {
+    const insertAt = htmlMatch.index + htmlMatch[0].length;
+    return `${html.slice(0, insertAt)}<head>${baseTag}</head>${html.slice(insertAt)}`;
+  }
+
+  // Bare fragment (no <html>/<head>, hence no doctype to displace) — the browser
+  // wraps it in an implicit head, so a leading base tag is safe.
+  if (html.startsWith(baseTag)) return html;
+  return baseTag + html;
+}
+
+/**
+ * Open an HTML artifact in its own browser tab, isolated from the host app.
+ *
+ * Renders the (untrusted, agent-generated) artifact inside a sandboxed iframe
+ * within a blank, app-controlled tab, so it runs in an opaque origin — the same
+ * isolation as the in-app preview, just full-window. We deliberately do NOT use
+ * a `blob:` or `data:` document: a top-level page there inherits the app's own
+ * origin, which would let artifact JS read the app's storage and issue
+ * credentialed same-origin requests to our API. The sandboxed-iframe shell
+ * avoids that — the artifact cannot reach this shell tab, its `window.opener`,
+ * or the host app.
+ *
+ * `opener` is injectable so this is unit-testable without a real browser window.
+ * Returns `false` if the popup was blocked (the caller can surface feedback).
+ */
+export function openHtmlArtifactInNewTab(
+  content: string,
+  filename: string,
+  opener: Pick<Window, "open"> = window,
+): boolean {
+  const win = opener.open("about:blank", "_blank");
+  if (!win) return false; // popup blocked by the browser
+  // Sever the back-reference to us (defense in depth): the shell tab never
+  // needs its `opener`, and nulling it removes any tab-nabbing vector if the
+  // tab is ever navigated away. Safe because the tab is same-origin (about:blank
+  // inherits our origin), so we can still touch its document below.
+  win.opener = null;
+  const doc = win.document;
+  doc.title = filename;
+  doc.body.style.margin = "0";
+  // oxlint-disable-next-line iframe-missing-sandbox -- sandbox set via setAttribute below
+  const frame = doc.createElement("iframe");
+  // No `allow-same-origin`: the artifact runs in an opaque origin, isolated from
+  // this shell tab and the host app.
+  frame.setAttribute("sandbox", HTML_PREVIEW_SANDBOX);
+  frame.srcdoc = prepareHtmlPreviewDoc(content);
+  frame.style.cssText = "position:fixed;inset:0;height:100%;width:100%;border:0";
+  doc.body.appendChild(frame);
+  return true;
+}
+
 // ---------------------------------------------------------------------------
 // DOM → absolute character offset helpers
 // ---------------------------------------------------------------------------
@@ -21,7 +21,7 @@ export const CLAUDE_NATIVE_DEFAULT_LABEL = "Claude Code";
 export const CODEX_NATIVE_DEFAULT_LABEL = "Codex";
 export const PI_NATIVE_DEFAULT_LABEL = "Pi";

-export type ConversationIconKind = "claude" | "codex" | "pi" | "nessie" | null;
+export type ConversationIconKind = "claude" | "codex" | "pi" | "cursor" | "nessie" | null;

 // Display label for a session with no title and no native-wrapper name —
 // shown in the sidebar row and as the browser tab title fallback.
@@ -10,6 +10,9 @@ vi.mock("@/components/icons/ClaudeIcon", () => ({
 vi.mock("@/components/icons/CodexIcon", () => ({
  CodexIcon: () => null,
 }));
+vi.mock("@/components/icons/CursorIcon", () => ({
+  CursorIcon: () => null,
+}));

 // Radix UI primitives (DropdownMenu, etc.) call these pointer-capture and
 // scroll APIs that jsdom doesn't implement. Stub them so component tests
@@ -64,6 +64,12 @@ deploy/
 │   ├── modal_app.py
 │   └── README.md
 │
+├── cloudflare/        ← Cloudflare Containers + D1 + R2 (serverless, scale-to-zero)
+│   ├── Dockerfile        server image + D1 dialect
+│   ├── src/index.js      the Worker that fronts the container
+│   ├── wrangler.jsonc
+│   └── README.md
+│
 ├── trycloudflare/     ← Cloudflare quick tunnel (public URL for a LOCAL server)
 │   └── README.md
 │
@@ -99,6 +105,7 @@ deploy/
 | Run on any host you already have (VPS, home server, on-prem) | Docker compose | [`docker/README.md`](docker/README.md): copy the compose stack, `./bootstrap.sh`, then `docker compose up -d` |
 | Deploy to Fly.io | Fly | [`fly/README.md`](fly/README.md): `fly deploy`, SQLite on a volume |
 | Deploy to Modal (durable artifact Volume) | Modal | [`modal/README.md`](modal/README.md): `modal deploy`, BYO Neon Postgres |
+| Deploy serverless (scale-to-zero, no VM/Postgres to manage) | Cloudflare Containers + D1 + R2 | [`cloudflare/README.md`](cloudflare/README.md): `wrangler deploy` |
 | Stand up a quick demo (no DB to provision) | HF Spaces | [`hf-spaces/README.md`](hf-spaces/README.md): Docker Space, SQLite |
 | Share a server running on your **laptop**: demo it to teammates, or let remote runners & cloud sandboxes connect back to it (nothing to deploy) | Cloudflare quick tunnel | `cloudflared tunnel --url http://localhost:6767` |
 | Cloud Run / Kubernetes / other | Docker image | [`docker/README.md`](docker/README.md), then point your platform at the image |
@@ -0,0 +1,8 @@
+# Trim the Docker build context. `wrangler deploy` builds the container image
+# from this directory, but the Dockerfile only needs sitecustomize.py — keep
+# node deps, wrangler state, and Python caches out of the context sent to the
+# Docker daemon.
+node_modules/
+.wrangler/
+__pycache__/
+*.pyc
@@ -0,0 +1,32 @@
+# Omnigent server on Cloudflare Containers, backed by D1 (database) and R2
+# (artifact store via omnigent's native S3 backend). Derived from the official
+# server image; adds the Cloudflare D1 SQLAlchemy dialect + a behavior shim, and
+# boto3 for the S3/R2 artifact store.
+#
+# No FUSE mount: the server writes artifacts straight to R2 over the S3 API,
+# selected with ``OMNIGENT_ARTIFACT_URI=s3://<bucket>`` (set by the Worker).
+#
+# Requires an omnigent-server image that includes the S3 artifact backend —
+# i.e. the ``deploy/docker/entrypoint.py`` change that ships alongside this
+# directory. (Until that lands in the published image, build a server image
+# from this branch.)
+FROM ghcr.io/omnigent-ai/omnigent-server:latest
+
+ARG SITE=/opt/venv/lib/python3.12/site-packages
+USER root
+
+# Cloudflare D1 SQLAlchemy dialect + boto3 (for the S3/R2 artifact store).
+RUN /opt/venv/bin/pip install --no-cache-dir \
+        "sqlalchemy-cloudflare-d1==0.3.10" "boto3>=1.30,<2"
+
+# Shim: re-register the D1 dialect as a proper SQLite subclass (auto-loaded).
+COPY sitecustomize.py ${SITE}/sitecustomize.py
+RUN /opt/venv/bin/python -c "\
+import sitecustomize; \
+from sqlalchemy import create_engine; \
+from sqlalchemy.dialects.sqlite.base import SQLiteDialect; \
+from alembic.ddl.impl import _impls; \
+e = create_engine('cloudflare_d1://a:b@c'); \
+assert isinstance(e.dialect, SQLiteDialect); \
+assert 'cloudflare_d1' in _impls; \
+print('D1 dialect + shim OK')"
@@ -0,0 +1,170 @@
+# Omnigent on Cloudflare (Containers + D1 + R2)
+
+Run the Omnigent server on **Cloudflare Containers**, with **D1** as the
+database and **R2** as the durable artifact store. This is the serverless,
+scale-to-zero option: no VM or Postgres to manage, a public `*.workers.dev`
+URL (or your domain), and the container sleeps when idle.
+
+> [!NOTE]
+> This is **not** the same as [`deploy/trycloudflare/`](../trycloudflare/),
+> which is a quick tunnel that exposes a server running on **your laptop**.
+> Here the server itself runs **on Cloudflare**.
+
+> [!NOTE]
+> This path uses a small SQLAlchemy dialect shim (`sitecustomize.py`) because
+> Cloudflare D1 isn't yet first-class in Omnigent. It works end to end — it's how
+> this directory was validated — and the normal on-boot migrations run unmodified.
+> The R2 artifact store, by contrast, already uses a first-class backend
+> (`S3ArtifactStore`) added alongside this directory.
+
+## How it works
+
+```
+        HTTPS / WebSocket
+browser ───────────────►  Worker (src/index.js)
+                              │   getContainer("singleton").fetch(req)
+                              ▼
+                          Container  ──►  the omnigent server (port 8000)
+                          (1 instance)        │            │
+                          DATABASE_URL ───────┘            │  S3 API (boto3)
+                          cloudflare_d1://…                ▼
+                                 │                  OMNIGENT_ARTIFACT_URI
+                                 ▼                  s3://omnigent-artifacts
+                          Cloudflare D1                    │
+                          (SQLite, the DB)                 ▼
+                                                    Cloudflare R2
+                                                    (artifact store)
+```
+
+- **Worker** — a thin front that proxies every request to **one** container
+  instance (Omnigent keeps an in-memory runner registry, so it's single-replica).
+- **Container** — the official `ghcr.io/omnigent-ai/omnigent-server` image plus
+  the D1 SQLAlchemy dialect, a shim that re-registers it as a proper SQLite
+  dialect, and `boto3` (this directory's `Dockerfile`).
+- **D1** is the database. The server reaches it through the
+  `sqlalchemy-cloudflare-d1` dialect, which speaks D1's HTTP API — so
+  `DATABASE_URL` is `cloudflare_d1://<account>:<api-token>@<database-id>`.
+- **R2** is the artifact store. Cloudflare container disk is **ephemeral**, so
+  artifacts (agent bundles, user files) go to R2 over its **S3 API** via
+  Omnigent's native `S3ArtifactStore`, selected with
+  `OMNIGENT_ARTIFACT_URI=s3://<bucket>`. No FUSE mount, no sidecar.
+
+## What's in here
+
+| File | Purpose |
+|---|---|
+| `Dockerfile` | derived image: server + D1 dialect + shim + boto3 |
+| `sitecustomize.py` | shim re-registering `cloudflare_d1` as a SQLite dialect (auto-loaded) |
+| `src/index.js` | the Worker that proxies to the container |
+| `wrangler.jsonc` | Worker + Container + Durable Object config |
+| `package.json` | `wrangler` + `@cloudflare/containers` |
+
+## Prerequisites
+
+- A Cloudflare account on the **Workers Paid** plan — Containers require it.
+- **Docker** running locally (`wrangler deploy` builds the image).
+- **Node** (for `wrangler`).
+- `wrangler login` (or a `CLOUDFLARE_API_TOKEN`).
+
+```bash
+cd deploy/cloudflare
+npm install
+npx wrangler login
+```
+
+## Deploy
+
+### 1. Create the D1 database
+
+```bash
+npx wrangler d1 create omnigent
+# note the "database_id" it prints — call it <DATABASE_ID>
+```
+
+### 2. Create the R2 bucket
+
+```bash
+npx wrangler r2 bucket create omnigent-artifacts
+```
+
+### 3. A D1 API token (for `DATABASE_URL`)
+
+The dialect authenticates to D1's REST API with a Cloudflare **API token**.
+Create one at **dash.cloudflare.com → My Profile → API Tokens → Create Token →
+Custom**, with permission **Account → D1 → Edit**. Your `DATABASE_URL` is then:
+
+```
+cloudflare_d1://<ACCOUNT_ID>:<D1_API_TOKEN>@<DATABASE_ID>
+```
+
+### 4. R2 S3 credentials (for the artifact store)
+
+The artifact store uses R2's **S3 API**, which needs an Access Key ID + Secret
+Access Key. Create them at **dash.cloudflare.com → R2 → Manage R2 API Tokens →
+Create API Token → Object Read & Write**. It shows an **Access Key ID** and
+**Secret Access Key** once — save both.
+
+<details>
+<summary>Alternative: derive S3 keys from an existing API token</summary>
+
+Any API token with R2 permissions can be used as S3 credentials without minting
+a separate R2 token ([docs](https://developers.cloudflare.com/r2/api/tokens/)):
+**Access Key ID** = the token's *id*, **Secret Access Key** = `sha256(token value)`.
+
+```bash
+python3 -c 'import hashlib,sys; print(hashlib.sha256(sys.argv[1].encode()).hexdigest())' "<TOKEN_VALUE>"
+```
+</details>
+
+### 5. Configure and set secrets
+
+In `wrangler.jsonc`, set `AWS_ENDPOINT_URL_S3` to your account's R2 endpoint
+(`https://<ACCOUNT_ID>.r2.cloudflarestorage.com`). Then set the four secrets:
+
+```bash
+# DATABASE_URL — the cloudflare_d1:// string from step 3
+npx wrangler secret put DATABASE_URL
+
+# Session cookie secret — any 64-hex string
+openssl rand -hex 32 | npx wrangler secret put OMNIGENT_ACCOUNTS_COOKIE_SECRET
+
+# R2 S3 credentials from step 4
+npx wrangler secret put AWS_ACCESS_KEY_ID
+npx wrangler secret put AWS_SECRET_ACCESS_KEY
+```
+
+### 6. Deploy
+
+```bash
+npx wrangler deploy
+# -> https://omnigent.<your-subdomain>.workers.dev
+```
+
+The container cold-starts on the first request (~10s), then stays warm:
+
+```bash
+curl https://omnigent.<your-subdomain>.workers.dev/health   # {"status":"ok"}
+```
+
+On a brand-new D1, the **first** boot runs all migrations before the server
+starts listening (~1 minute against D1's REST API), so the first few requests
+may return a 5xx while it migrates — just retry. Later boots are fast.
+
+### 7. First admin + connect a host
+
+Open the URL and the Setup screen claims the first admin (username + password).
+Then connect a machine to actually run agents (the server is just the control
+plane):
+
+```bash
+omnigent login https://omnigent.<your-subdomain>.workers.dev
+omnigent host  --server https://omnigent.<your-subdomain>.workers.dev
+```
+
+## Verifying durability
+
+The point of R2 is that state survives the ephemeral container. To prove it,
+note your data, force a fresh container (`npx wrangler deploy` again, or let it
+idle to sleep), and confirm it's still there — agents still load, sessions still
+exist. The database lives in D1 and the artifacts in R2; the container holds
+nothing durable.
@@ -0,0 +1,16 @@
+{
+  "name": "omnigent-cloudflare",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "deploy": "wrangler deploy",
+    "tail": "wrangler tail"
+  },
+  "devDependencies": {
+    "wrangler": "^4.0.0"
+  },
+  "dependencies": {
+    "@cloudflare/containers": "^0.3.0"
+  }
+}
@@ -0,0 +1,118 @@
+"""Auto-loaded shim that makes Omnigent work against Cloudflare D1.
+
+D1 is SQLite reached over an HTTP REST API. The third-party
+``sqlalchemy-cloudflare-d1`` dialect subclasses the *generic* ``DefaultDialect``
+and then hand-reimplements SQLite's SQL compilation and schema reflection —
+incompletely. That breaks DDL (a composite primary key emits two ``PRIMARY
+KEY`` clauses, which D1 rejects; reserved words like ``key`` go unquoted) and
+migrations (``get_unique_constraints`` is unimplemented; ``get_foreign_keys``
+drops keys reflection needs).
+
+The fix is to subclass SQLAlchemy's real ``SQLiteDialect`` and keep only the
+*transport*: the HTTP DBAPI, the URL parser, and the D1 type processors (which
+base64-encode blobs and ISO-format dates for the JSON REST API — SQLite's file
+DBAPI does this natively, D1's API does not). Everything above the transport —
+DDL compiler, type compiler, identifier quoting, and full reflection — is then
+inherited from SQLite, correctly. This is the change that belongs upstream in
+the dialect package (just change its base class); until it ships, sitecustomize
+re-registers a corrected dialect here. Python imports ``sitecustomize`` at
+interpreter startup, so it runs before Omnigent builds an engine.
+
+Two small adaptations remain, both expressing facts about D1 rather than SQLite
+shortcomings:
+
+  * **Alembic.** Its DDL-impl registry (``alembic.ddl.impl._impls``) is keyed by
+    ``dialect.name`` with no inheritance fallback, so the (correctly named)
+    ``cloudflare_d1`` dialect ``KeyError``s in ``MigrationContext.__init__``.
+    Register SQLite's impl under that name.
+  * **No ``temp`` schema.** D1 exposes a single ``main`` schema and forbids the
+    ``temp`` schema (``SQLITE_AUTH``). SQLite's reflection probes ``temp``
+    (``PRAGMA temp.*``, ``sqlite_temp_master``, ``PRAGMA database_list``); the
+    three touchpoints are overridden to read only ``main``.
+"""
+
+import sys
+
+# ── Alembic: register a DDL impl for the cloudflare_d1 name ──────────────
+try:
+    from alembic.ddl.sqlite import SQLiteImpl
+
+    class CloudflareD1Impl(SQLiteImpl):  # auto-registers via __dialect__
+        __dialect__ = "cloudflare_d1"
+except Exception as exc:  # noqa: BLE001 -- defensive: never block server startup
+    print(f"[d1-shim] could not register Alembic impl: {exc}", file=sys.stderr)
+
+# ── Dialect: re-register cloudflare_d1 as a real SQLite subclass ─────────
+try:
+    from sqlalchemy import exc as _sa_exc
+    from sqlalchemy.dialects import registry
+    from sqlalchemy.dialects.sqlite.base import SQLiteDialect
+    from sqlalchemy_cloudflare_d1.dialect import CloudflareD1Dialect as _UpstreamD1
+
+    # SQLiteDialect.__init__ reads self.dbapi.sqlite_version_info to gate
+    # features. D1 runs a modern SQLite; advertise it (the live version is also
+    # read in _get_server_version_info below).
+    _D1_SQLITE_VERSION = (3, 45, 0)
+    _dbapi = _UpstreamD1.import_dbapi()
+    if not hasattr(_dbapi, "sqlite_version_info"):
+        _dbapi.sqlite_version_info = _D1_SQLITE_VERSION
+        _dbapi.sqlite_version = ".".join(str(p) for p in _D1_SQLITE_VERSION)
+
+    class CloudflareD1Dialect(SQLiteDialect):
+        """The cloudflare_d1 dialect: SQLite behavior over D1's HTTP transport."""
+
+        name = "cloudflare_d1"
+        driver = "httpx"
+        default_paramstyle = "qmark"
+        supports_statement_cache = True
+
+        # D1's JSON REST API needs the transport type processors (blob->base64,
+        # date/time->ISO); layer them over SQLite's defaults.
+        colspecs = {**SQLiteDialect.colspecs, **_UpstreamD1.colspecs}  # noqa: RUF012
+
+        # ── transport (from the upstream dialect) ──
+        @classmethod
+        def import_dbapi(cls):
+            return _UpstreamD1.import_dbapi()
+
+        create_connect_args = _UpstreamD1.create_connect_args
+
+        # D1 has no isolation levels — keep these no-ops so SQLite's
+        # PRAGMA read_uncommitted machinery never runs over the REST API.
+        def get_isolation_level(self, dbapi_connection):  # noqa: ARG002
+            return None
+
+        def set_isolation_level(self, dbapi_connection, level):
+            pass
+
+        def _get_server_version_info(self, connection):
+            try:
+                v = connection.exec_driver_sql("SELECT sqlite_version()").scalar()
+                return tuple(int(x) for x in str(v).split("."))
+            except Exception:  # noqa: BLE001
+                return _D1_SQLITE_VERSION
+
+        # ── D1 has a single "main" schema and forbids "temp" ──
+        def get_schema_names(self, connection, **kw):  # noqa: ARG002
+            return ["main"]
+
+        def _get_table_sql(self, connection, table_name, schema=None, **kw):  # noqa: ARG002
+            schema_expr = f"{self.identifier_preparer.quote_identifier(schema)}." if schema else ""
+            s = (
+                f"SELECT sql FROM {schema_expr}sqlite_master "
+                "WHERE name = ? AND type in ('table', 'view')"
+            )
+            value = connection.exec_driver_sql(s, (table_name,)).scalar()
+            if value is None and not self._is_sys_table(table_name):
+                raise _sa_exc.NoSuchTableError(f"{schema_expr}{table_name}")
+            return value
+
+        def _get_table_pragma(self, connection, pragma, table_name, schema=None):
+            quote = self.identifier_preparer.quote_identifier
+            prefix = f"{quote(schema)}." if schema is not None else "main."
+            cursor = connection.exec_driver_sql(f"PRAGMA {prefix}{pragma}({quote(table_name)})")
+            return cursor.fetchall() if not cursor._soft_closed else []
+
+    registry.register("cloudflare_d1", __name__, "CloudflareD1Dialect")
+except Exception as exc:  # noqa: BLE001 -- defensive: never block server startup
+    print(f"[d1-shim] could not register D1 dialect: {exc}", file=sys.stderr)
@@ -0,0 +1,41 @@
+// Worker that fronts the Omnigent container and proxies all HTTP (and
+// WebSocket) traffic to it. Omnigent needs a SINGLE server instance (in-memory
+// runner registry), so every request routes to one fixed container instance.
+import { Container, getContainer } from "@cloudflare/containers";
+
+export class OmnigentServer extends Container {
+  // Port the omnigent server listens on inside the container.
+  defaultPort = 8000;
+  // Keep the container warm so D1-backed sessions don't cold-start constantly.
+  sleepAfter = "30m";
+
+  constructor(ctx, env) {
+    super(ctx, env);
+    // Env passed into the container. Secrets (DATABASE_URL, the cookie secret,
+    // the AWS_* R2 keys) come from `wrangler secret put`; the rest are plain
+    // vars in wrangler.jsonc.
+    this.envVars = {
+      DATABASE_URL: env.DATABASE_URL,
+      OMNIGENT_ACCOUNTS_COOKIE_SECRET: env.OMNIGENT_ACCOUNTS_COOKIE_SECRET,
+      OMNIGENT_AUTH_ENABLED: "1",
+      OMNIGENT_AUTH_PROVIDER: "accounts",
+      OMNIGENT_ACCOUNTS_AUTO_OPEN: "0",
+      HOST: "0.0.0.0",
+      PORT: "8000",
+      // Artifact store -> R2 over the S3 API (omnigent's native S3 backend).
+      // OMNIGENT_ARTIFACT_URI selects it; AWS_* point boto3 at R2.
+      OMNIGENT_ARTIFACT_URI: env.OMNIGENT_ARTIFACT_URI,
+      AWS_ENDPOINT_URL_S3: env.AWS_ENDPOINT_URL_S3,
+      AWS_DEFAULT_REGION: "auto",
+      AWS_ACCESS_KEY_ID: env.AWS_ACCESS_KEY_ID,
+      AWS_SECRET_ACCESS_KEY: env.AWS_SECRET_ACCESS_KEY,
+    };
+  }
+}
+
+export default {
+  async fetch(request, env) {
+    // One shared instance for the whole app (single-replica requirement).
+    return await getContainer(env.OMNIGENT, "singleton").fetch(request);
+  },
+};
@@ -0,0 +1,36 @@
+{
+  // Omnigent server on Cloudflare Containers, backed by D1 (database) and
+  // R2 (artifact store, via omnigent's native S3 backend over the R2 S3 API).
+  // Full walkthrough: deploy/cloudflare/README.md.
+  "name": "omnigent",
+  "main": "src/index.js",
+  "compatibility_date": "2026-06-01",
+
+  // Built from ./Dockerfile (omnigent-server + D1 dialect + boto3). Single
+  // replica only (in-memory runner registry) — do NOT raise max_instances.
+  // "basic" = 0.25 vCPU / 1 GiB; bump to "standard" for faster cold starts.
+  "containers": [
+    {
+      "class_name": "OmnigentServer",
+      "image": "./Dockerfile",
+      "instance_type": "basic",
+      "max_instances": 1
+    }
+  ],
+
+  "durable_objects": {
+    "bindings": [{ "class_name": "OmnigentServer", "name": "OMNIGENT" }]
+  },
+  "migrations": [
+    { "tag": "v1", "new_sqlite_classes": ["OmnigentServer"] }
+  ],
+
+  // Non-secret config. Replace <YOUR_CLOUDFLARE_ACCOUNT_ID> with your account ID
+  // (it's in the R2 S3 endpoint). DATABASE_URL, OMNIGENT_ACCOUNTS_COOKIE_SECRET,
+  // AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are SECRETS — set them with
+  // `wrangler secret put` (see README).
+  "vars": {
+    "OMNIGENT_ARTIFACT_URI": "s3://omnigent-artifacts",
+    "AWS_ENDPOINT_URL_S3": "https://<YOUR_CLOUDFLARE_ACCOUNT_ID>.r2.cloudflarestorage.com"
+  }
+}
@@ -44,6 +44,8 @@ from typing import TYPE_CHECKING, Any
 if TYPE_CHECKING:
    from fastapi import FastAPI

+    from omnigent.stores.artifact_store import ArtifactStore
+
 logging.basicConfig(level=logging.INFO, stream=sys.stderr, force=True)
 logger = logging.getLogger("omnigent-docker")

@@ -66,6 +68,10 @@ class _ResolvedConfig:
    cfg: dict[str, Any]
    database_url: str
    artifact_dir: Path
+    # When set (an ``s3://bucket[/prefix]`` URI), the artifact store is remote
+    # (S3/R2) and ``artifact_dir`` is only a local scratch dir (cookie secret,
+    # on-disk cache). ``None`` -> the local filesystem store at ``artifact_dir``.
+    artifact_store_uri: str | None
    host: str
    port: int

@@ -146,12 +152,22 @@ def _resolve_config() -> _ResolvedConfig:
    port = int(cfg.get("port") or os.environ.get("PORT") or _DEFAULT_PORT)
    artifact_dir.mkdir(parents=True, exist_ok=True)

+    # Optional remote artifact store (S3 / Cloudflare R2 / MinIO / …). When set,
+    # the artifact STORE is remote and durable; artifact_dir stays local for the
+    # cookie secret and on-disk cache. Mirrors how DATABASE_URL selects the DB.
+    artifact_store_uri = cfg.get("artifact_store_uri") or os.environ.get("OMNIGENT_ARTIFACT_URI")
+    if artifact_store_uri and not artifact_store_uri.startswith("s3://"):
+        raise RuntimeError(
+            "OMNIGENT_ARTIFACT_URI (or `artifact_store_uri:` in config) must be an "
+            f"'s3://bucket[/prefix]' URI, got: {artifact_store_uri!r}"
+        )
+
    logger.info(
        "Config: HOST=%s PORT=%d DB=%s ARTIFACTS=%s",
        host,
        port,
        database_url.split("@", 1)[-1] if "@" in database_url else database_url,
-        artifact_dir,
+        artifact_store_uri or artifact_dir,
    )

    # Containerized / remote deploys default to authenticated auth.
@@ -209,11 +225,35 @@ def _resolve_config() -> _ResolvedConfig:
        cfg=cfg,
        database_url=database_url,
        artifact_dir=artifact_dir,
+        artifact_store_uri=artifact_store_uri,
        host=host,
        port=port,
    )


+def _select_artifact_store(resolved_config: _ResolvedConfig) -> ArtifactStore:
+    """
+    Pick the artifact store implementation from the resolved config.
+
+    An ``s3://bucket[/prefix]`` ``artifact_store_uri`` selects the remote,
+    durable :class:`~omnigent.stores.artifact_store.s3.S3ArtifactStore` (AWS S3,
+    Cloudflare R2, MinIO, …), which survives an ephemeral or multi-replica
+    deploy. Otherwise the local-filesystem store at ``artifact_dir`` is used.
+    Mirrors how ``DATABASE_URL`` selects the database backend.
+
+    :param resolved_config: The resolved startup configuration.
+    :returns: The selected
+        :class:`~omnigent.stores.artifact_store.ArtifactStore`.
+    """
+    from omnigent.stores.artifact_store.local import LocalArtifactStore
+
+    if resolved_config.artifact_store_uri:
+        from omnigent.stores.artifact_store.s3 import S3ArtifactStore
+
+        return S3ArtifactStore(resolved_config.artifact_store_uri)
+    return LocalArtifactStore(str(resolved_config.artifact_dir))
+
+
 def build_app(resolved_config: _ResolvedConfig | None = None) -> _BuiltApp:
    """Resolve config if needed, wire the stores, and build the app.

@@ -238,7 +278,6 @@ def build_app(resolved_config: _ResolvedConfig | None = None) -> _BuiltApp:
    from omnigent.runtime.caps import RuntimeCaps
    from omnigent.server.managed_hosts import parse_sandbox_config
    from omnigent.stores.agent_store.sqlalchemy_store import SqlAlchemyAgentStore
-    from omnigent.stores.artifact_store.local import LocalArtifactStore
    from omnigent.stores.comment_store.sqlalchemy_store import (
        SqlAlchemyCommentStore,
    )
@@ -263,7 +302,7 @@ def build_app(resolved_config: _ResolvedConfig | None = None) -> _BuiltApp:
    # typo should not surface as a runtime 502 on the first managed
    # session); the startup catch-all below logs it.
    sandbox_config = parse_sandbox_config(cfg.get("sandbox"))
-    artifact_store = LocalArtifactStore(str(artifact_dir))
+    artifact_store = _select_artifact_store(resolved_config)

    agent_cache = AgentCache(
        artifact_store=artifact_store,
@@ -0,0 +1,193 @@
+# Omnigent bot identities & attribution setup
+
+This doc explains how commits and automated PR reviews in the
+`omnigent-ai/omnigent` repo are attributed, and how the supporting GitHub App
+was set up. There are **two deliberately distinct identities** — do not
+conflate them:
+
+| Identity | Used for | Why this identity |
+| --- | --- | --- |
+| `omnigent <noreply@omnigent.ai>` | Co-author trailer on commits authored by **polly's coding sub-agents** | These commits are produced by `git commit` in a worker's local worktree — they are **not** GitHub Actions runs, so a plain org co-author is the honest attribution. No GitHub App user is involved. |
+| `omnigent-ci[bot]` (GitHub App) | **CI automation**: lockfile-regen commits/PRs **and** automated PR-review comments | These actions genuinely run inside GitHub Actions, where the App's private key lives and a short-lived installation token is minted per run. The App is an org-owned, least-privilege identity. |
+
+> **Why two identities and not one?** An earlier draft of this work tried to use
+> `omnigent-ci[bot]` everywhere, including the sub-agent commit trailer. That was
+> corrected: polly's workers don't run in Actions and never touch the App key, so
+> attributing their commits to the Actions-minted bot user was misleading. Local
+> work → plain org co-author; Actions-minted work → the App bot.
+
+---
+
+## The GitHub App: `omnigent-ci[bot]`
+
+> **Naming note.** The App was registered as **`omnigent-ci`** (the bare
+> `omnigent` name was unavailable), so GitHub renders the actor as
+> **`omnigent-ci[bot]`**.
+
+| Field | Value |
+| --- | --- |
+| App name | `omnigent-ci` |
+| Bot actor | `omnigent-ci[bot]` |
+| App ID | `4082516` |
+| Bot numeric user ID | `294685417` |
+| CI git author email | `294685417+omnigent-ci[bot]@users.noreply.github.com` |
+
+The numeric user ID (`294685417`) is what links GitHub's no-reply commit email
+back to the bot's profile; it is distinct from the App ID (`4082516`), which is
+used only to mint installation tokens.
+
+> **Why a GitHub App (not a PAT or a plain machine user)?** An App is an
+> org-owned identity with scoped, least-privilege permissions and a short-lived
+> installation token minted per run — no long-lived personal credential to leak.
+
+---
+
+## Org-admin setup (one-time, completed)
+
+These steps required org-admin and are **done**. They are recorded here because
+they are not captured anywhere in the repo and would otherwise have to be
+reverse-engineered.
+
+### 1. Create the App
+
+Created at `https://github.com/organizations/omnigent-ai/settings/apps/new`:
+
+- **GitHub App name:** `omnigent-ci` → actor `omnigent-ci[bot]`.
+- **Homepage URL:** any valid URL.
+- **Webhook:** **Active** unchecked — token-minting only, no webhook.
+- **Repository permissions** (least privilege):
+  - **Contents:** Read and write — push branches / commits.
+  - **Pull requests:** Read and write — open/update PRs **and post reviews**.
+  - **Metadata:** Read-only (mandatory).
+  - Everything else **No access**.
+- **Where can this App be installed?** Only on `omnigent-ai`.
+- Installed into `omnigent-ai`, scoped to the `omnigent` repo.
+
+**App ID `4082516`.** A private key (`.pem`) was generated and stored as a
+secret (step 3).
+
+> Optional/cosmetic: App settings → **Display information** → upload a square
+> logo. Purely visual — does not affect the user ID, attribution, or wiring.
+
+### 2. Resolve the bot's numeric user ID
+
+GitHub's no-reply commit email embeds a numeric user ID assigned after install:
+
+```bash
+gh api users/omnigent-ci%5Bbot%5D --jq '.id'
+# -> 294685417
+```
+
+(`%5Bbot%5D` is the URL-encoding of `[bot]`.)
+
+### 3. Store the App credentials
+
+In **`omnigent-ai/omnigent` → Settings → Secrets and variables → Actions**:
+
+- **Variable** `OMNIGENT_BOT_APP_ID` = `4082516`
+- **Secret** `OMNIGENT_BOT_APP_KEY` = the App's `.pem` private key
+
+> The workflows gate on `vars.OMNIGENT_BOT_APP_ID != ''`. If the variable is
+> absent or misnamed, the token-mint step is skipped and the workflow falls back
+> to `GITHUB_TOKEN` (attributing the action to `github-actions[bot]`) — so the
+> exact names matter.
+
+> **`omnigent-ci[bot]` replaced the old OSS regen bot.** The previous
+> `OSS_REGEN_APP_ID` / `OSS_REGEN_APP_KEY` config and its App have been
+> **retired**; nothing in the repo references `OSS_REGEN_*` anymore.
+
+---
+
+## In-repo wiring (shipped)
+
+### Sub-agent commit co-author trailer
+
+polly never commits directly; its coding sub-agents (`claude_code`, `codex`,
+`pi`) run `git commit` / `gh pr create` in their own worktrees. Each such commit
+ends with a co-author trailer attributing it to the org:
+
+```
+Co-authored-by: omnigent <noreply@omnigent.ai>
+```
+
+This requirement lives in the worker IMPLEMENT instructions:
+
+- `examples/polly/agents/claude_code/config.yaml`
+- `examples/polly/agents/codex/config.yaml`
+- `examples/polly/agents/pi/config.yaml`
+
+> A `Co-authored-by` trailer is GitHub's lightweight attribution mechanism — it
+> attributes the commit to the org in addition to the worker author and needs no
+> signing key. It is **not** cryptographic signing (GPG/sigstore), which is a
+> separate, heavier concern.
+
+> The packaged copies under `omnigent/resources/examples/polly/...` are a
+> **symlink** to the `examples/polly/...` source, so there is a single source of
+> truth — no dual copies to keep in sync.
+
+### CI commits/PRs as `omnigent-ci[bot]`
+
+The lockfile-regen workflows (`.github/workflows/oss-regenerate-and-smoke.yml`
+and `oss-regen-on-comment.yml`) mint the App token and set the git identity so
+regen commits/PRs are authored by the bot:
+
+```yaml
+- name: Mint App token
+  id: app-token
+  if: vars.OMNIGENT_BOT_APP_ID != ''
+  uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+  with:
+    app-id: ${{ vars.OMNIGENT_BOT_APP_ID }}
+    private-key: ${{ secrets.OMNIGENT_BOT_APP_KEY }}
+```
+
+```bash
+git config user.name  "omnigent-ci[bot]"
+git config user.email "294685417+omnigent-ci[bot]@users.noreply.github.com"
+```
+
+The push uses `steps.app-token.outputs.token || secrets.GITHUB_TOKEN`, so a
+missing App config falls back to `github-actions[bot]` rather than failing.
+
+### Automated PR review posted as `omnigent-ci[bot]`
+
+`.github/workflows/polly-review.yml` runs a full cross-vendor Polly review of a
+PR diff (on PR open/reopen/ready, a `/review` comment from a write-access user,
+or `workflow_dispatch`) and posts the findings as a PR comment. It mints the App
+token and posts the review **as `omnigent-ci[bot]`**:
+
+```yaml
+- name: Mint App token
+  id: app-token
+  if: steps.trigger.outputs.skip != 'true' && steps.creds.outputs.available == 'true' && vars.OMNIGENT_BOT_APP_ID != ''
+  uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+  with:
+    app-id: ${{ vars.OMNIGENT_BOT_APP_ID }}
+    private-key: ${{ secrets.OMNIGENT_BOT_APP_KEY }}
+
+- name: Post review comment
+  env:
+    GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
+    # ...
+```
+
+> **Fail-open by design.** If the App vars are absent, the post falls back to
+> `github.token` and the review still posts (as `github-actions[bot]`). The
+> review *content* is valuable regardless of who signs it — this is deliberately
+> the opposite of a fail-closed posting gate. The workflow always checks out the
+> **trusted default branch** and fetches the PR diff via the API; PR-authored
+> code is never executed, and the minted token is scoped to the post step only.
+
+---
+
+## Quick reference
+
+| Surface | Identity on the artifact | Where it's wired |
+| --- | --- | --- |
+| polly sub-agent commits | `omnigent <noreply@omnigent.ai>` (co-author trailer) | `examples/polly/agents/*/config.yaml` |
+| Lockfile-regen commits/PRs | `omnigent-ci[bot]` | `oss-regenerate-and-smoke.yml`, `oss-regen-on-comment.yml` |
+| Automated PR review comments | `omnigent-ci[bot]` (fallback `github-actions[bot]`) | `polly-review.yml` |
+
+**Config:** variable `OMNIGENT_BOT_APP_ID` = `4082516`, secret
+`OMNIGENT_BOT_APP_KEY` = App private key. The old `OSS_REGEN_APP_*` config and
+App are retired.
@@ -55,3 +55,29 @@ def echo_native_resume_hint(
        server=server,
    )
    click.echo(f"Resume with: {command}", err=True)
+
+
+def echo_native_cold_resume_hint(
+    *,
+    agent_label: str = "Cursor",
+) -> None:
+    """
+    Warn that a cold resume is starting a fresh session, not restoring one.
+
+    Some native wrappers (notably Cursor) cannot reattach to a prior
+    chat once the session terminal has exited: the TUI records no
+    resumable chat id, so ``--resume`` relaunches a *fresh* agent with
+    none of the prior turns. The reattach-to-a-live-terminal path is
+    unaffected; this hint only fires when the terminal is gone and we
+    are cold-starting a new TUI, so the user is not misled into
+    thinking their earlier conversation came back.
+
+    :param agent_label: Human-readable agent name for the message,
+        e.g. ``"Cursor"``.
+    :returns: None.
+    """
+    click.echo(
+        f"Terminal not running - starting a fresh {agent_label} session "
+        "(prior chat not restored).",
+        err=True,
+    )
@@ -49,3 +49,7 @@ CODEX_NATIVE_WRAPPER_VALUE = "codex-native-ui"
 # Value the ``omnigent pi`` wrapper writes into
 # ``conversations.labels[WRAPPER_LABEL_KEY]``.
 PI_NATIVE_WRAPPER_VALUE = "pi-native-ui"
+
+# Value the ``omnigent cursor`` wrapper writes into
+# ``conversations.labels[WRAPPER_LABEL_KEY]``.
+CURSOR_NATIVE_WRAPPER_VALUE = "cursor-native-ui"
@@ -2248,12 +2248,69 @@ async def _query_sessions_once(
        if reconciled is not None:
            return reconciled
        raise
+    all_text_parts: list[str] = []
    if result.text:
-        return result.text
-    reconciled = await _persisted_turn_text(client, bound.id)
-    if reconciled is not None:
-        return reconciled
-    # No assistant text for this turn. If the runner persisted a terminal
+        all_text_parts.append(result.text)
+    elif (reconciled := await _persisted_turn_text(client, bound.id)) is not None:
+        all_text_parts.append(reconciled)
+
+    # Multi-turn loop for async orchestrators (e.g. polly) that dispatch
+    # sub-agents and are auto-woken by inbox completions across multiple
+    # turns.
+    #
+    # Fast-exit: refresh() at the TOP of each iteration catches the common
+    # case (single-turn agent, session already idle) with one HTTP round-
+    # trip (~100 ms) instead of waiting up to _PER_TURN_TIMEOUT_S for a
+    # stream subscription to time out.
+    #
+    # Race window: a turn MAY complete in the gap between the top-of-loop
+    # refresh() showing "waiting" and await_turn() opening its subscription.
+    # The window is O(ms) in practice (subagents take seconds). If it fires,
+    # await_turn() times out, the bottom refresh() shows "idle", and we exit
+    # — the only cost is one _PER_TURN_TIMEOUT_S wait and possibly missing
+    # that turn's text.
+    #
+    # Timeouts: 120 s per turn bounds the race-window penalty. A global
+    # 1800 s wall-clock budget caps the loop regardless of turn count.
+    _MAX_EXTRA_TURNS = 30
+    _PER_TURN_TIMEOUT_S = 120.0
+    _LOOP_TIMEOUT_S = 1800.0
+
+    async def _drain_extra_turns() -> None:
+        for _ in range(_MAX_EXTRA_TURNS):
+            # Fast-exit for single-turn agents.
+            await chat.refresh()
+            if chat.status not in ("waiting", "running", "launching"):
+                return
+            # Session still active; subscribe before the next check to
+            # reduce (not eliminate) the race where a turn completes
+            # between refresh and subscribe.
+            extra = await chat.await_turn(timeout=_PER_TURN_TIMEOUT_S)
+            if extra.text:
+                all_text_parts.append(extra.text)
+            await chat.refresh()
+            if chat.status not in ("waiting", "running", "launching"):
+                return
+        logger.warning(
+            "headless -p hit the %d-turn guard for session %s; "
+            "the orchestrator may still be running",
+            _MAX_EXTRA_TURNS,
+            bound.id,
+        )
+
+    try:
+        async with asyncio.timeout(_LOOP_TIMEOUT_S):
+            await _drain_extra_turns()
+    except asyncio.TimeoutError:
+        logger.warning(
+            "headless -p timed out after %.0fs waiting for session %s to complete",
+            _LOOP_TIMEOUT_S,
+            bound.id,
+        )
+
+    if all_text_parts:
+        return "\n\n".join(p for p in all_text_parts if p)
+    # No assistant text at all. If the runner persisted a terminal
    # ``error`` item (e.g. a harness start failure like the cursor SDK's
    # invalid-model rejection), surface it instead of returning ``None`` —
    # otherwise the headless caller renders a failed turn as a silent,
@@ -185,8 +185,8 @@ def _trusted_parent_for_bridge_dir(target: Path) -> Path:
    Return the trusted parent for an allowed bridge directory.

    Claude-native files live below the uid-scoped temp bridge root.
-    Codex-native reuses the relay/MCP implementation but keeps bridge
-    files below ``~/.omnigent/codex-native``. Both roots use the same
+    Codex- and Cursor-native reuse the relay/MCP implementation but keep bridge
+    files below their own bridge roots. All roots use the same
    owner-only ancestor validation; only the trusted anchor differs.

    :param target: Normalized bridge directory path being created or validated,
@@ -211,9 +211,15 @@ def _trusted_parent_for_bridge_dir(target: Path) -> Path:
            trusted_parent = codex_root.parent.parent
        return _absolute_syntactic_path(trusted_parent)

+    from omnigent.cursor_native_bridge import bridge_root as cursor_bridge_root
+
+    cursor_root = _absolute_syntactic_path(cursor_bridge_root())
+    if target.is_relative_to(cursor_root):
+        return _absolute_syntactic_path(cursor_root.parent.parent)
+
    raise RuntimeError(
        f"bridge dir {target!s} is not under an allowed bridge root "
-        f"({claude_root!s}, {codex_root!s})"
+        f"({claude_root!s}, {codex_root!s}, {cursor_root!s})"
    )


@@ -3314,8 +3320,29 @@ def _stdio_jsonrpc_loop(
        active tool relay.
    :returns: None when stdin reaches EOF.
    """
-    for raw_line in sys.stdin:
-        line = raw_line.strip()
+    use_content_length = False
+    while True:
+        raw_line = sys.stdin.buffer.readline()
+        if raw_line == b"":
+            return
+        if raw_line.lower().startswith(b"content-length:"):
+            use_content_length = True
+            try:
+                length = int(raw_line.decode("ascii", errors="ignore").split(":", 1)[1].strip())
+            except ValueError:
+                continue
+            while True:
+                header = sys.stdin.buffer.readline()
+                if header in {b"\r\n", b"\n", b""}:
+                    break
+            if length <= 0:
+                continue
+            raw_payload = sys.stdin.buffer.read(length)
+            if len(raw_payload) != length:
+                return
+            line = raw_payload.decode("utf-8", errors="replace").strip()
+        else:
+            line = raw_line.decode("utf-8", errors="replace").strip()
        if not line:
            continue
        try:
@@ -3350,7 +3377,7 @@ def _stdio_jsonrpc_loop(
                # -32603 is the JSON-RPC 2.0 "Internal error" code.
                "error": {"code": -32603, "message": f"internal error: {exc}"},
            }
-        _write_jsonrpc(response, stdout_lock)
+        _write_jsonrpc(response, stdout_lock, framed=use_content_length)


 def _handle_mcp_request(
@@ -3651,17 +3678,29 @@ def _build_tools(config: dict[str, Any]) -> tuple[dict[str, Tool], Callable[[],
    return tools, _close_tools


-def _write_jsonrpc(payload: dict[str, Any], stdout_lock: threading.Lock) -> None:
+def _write_jsonrpc(
+    payload: dict[str, Any],
+    stdout_lock: threading.Lock,
+    *,
+    framed: bool = False,
+) -> None:
    """
    Write one JSON-RPC message to stdout.

    :param payload: JSON-RPC object to serialize.
    :param stdout_lock: Lock protecting stdout.
+    :param framed: When ``True``, write MCP ``Content-Length`` framed output.
    :returns: None.
    """
    raw = json.dumps(payload, separators=(",", ":"))
    with stdout_lock:
-        print(raw, flush=True)
+        if framed:
+            encoded = raw.encode("utf-8")
+            sys.stdout.buffer.write(f"Content-Length: {len(encoded)}\r\n\r\n".encode("ascii"))
+            sys.stdout.buffer.write(encoded)
+            sys.stdout.buffer.flush()
+        else:
+            print(raw, flush=True)


 def _model_from_transcript_entry(entry: dict[str, Any]) -> str | None:
--- a/Show More
+++ b/Show More