chore(openapi): regenerate spec against latest main

Rebased onto current main, which added new routes. Regenerated the spec
to cover them:
- POST /v1/sessions/{session_id}/hooks/antigravity-elicitation-request
- POST /v1/sessions/{session_id}/hooks/native-permission-request
- GET/POST  /v1/sessions/{session_id}/agent/mcp-servers
- PUT/DELETE /v1/sessions/{session_id}/agent/mcp-servers/{server_name}

The MCP routes carry a new `session_mcp_servers` tag, so add a matching
_TAGS entry ("Session MCP Servers", placed after Session Resources) with
a display name and description — otherwise the reference would render a
raw, undescribed snake_case group (the latent gap Polly flagged).

Spec is the output of `python scripts/dump_openapi.py`; drift test
passes and the zero-reST invariant holds.

Co-authored-by: Isaac

.claude/skills/cli-setup-verify/SKILL.md

@@ -0,0 +1,210 @@
+---
+name: cli-setup-verify
+description: Verify the Omnigent CLI's setup/onboarding flow, terminal UI/UX, and critical user journeys in a completely isolated, reproducible loop. Drives the real `omnigent` binary through a PTY (pexpect) inside a throwaway OMNIGENT_CONFIG_HOME / OMNIGENT_DATA_DIR sandbox that never touches the user's real ~/.omnigent, captures ANSI-stripped frames for UX inspection, and proves a change is verifiable via a before→fix→after baseline diff. Load when developing or reviewing a CLI setup/onboarding/REPL/picker change (omnigent/cli.py, omnigent/onboarding/*, omnigent/repl/*, scripts/install_oss.sh), reproducing a cold-start/first-run UX bug, or confirming a fix actually lands. Several agents can run it concurrently on separate worktrees.
+---
+
+# Verifying the Omnigent CLI setup & UX in a closed loop
+
+The Omnigent CLI's first impression is: `curl | sh` → run `omnigent` → pick a
+model credential → start a session. This skill lets an agent **enter that flow,
+examine the UI/UX, and prove whether a change is verifiable** — without a
+browser, without real credentials, and **without ever touching the developer's
+real `~/.omnigent`**.
+
+The engine is `verify_cli.py` (next to this file). It drives the real
+`omnigent` binary through a pseudo-terminal (`pexpect`) inside a throwaway
+sandbox, captures what renders, runs assertions, and prints one machine-readable
+`SUMMARY {json}` line.
+
+> **The whole point is a verifiable loop**, not a one-shot check:
+> 1. Run a scenario on the **unfixed** code → baseline (`--label before`).
+> 2. Make the change.
+> 3. Run the **same** scenario → `--label after`.
+> 4. Diff the two `SUMMARY` lines. A fix is "verifiable" only if a concrete
+>    check or note **flips** between the two runs. If it doesn't flip, you
+>    can't prove the fix did anything — go back to step 2.
+
+## Why this is safe (read first)
+
+The real `~/.omnigent` here can be **many GB** (chat DB, runner logs, native
+harness state). The sandbox isolates every write three ways:
+
+- **`HOME` is redirected into the sandbox by default.** This is the load-bearing
+  one. `OMNIGENT_CONFIG_HOME` / `OMNIGENT_DATA_DIR` (`omnigent/cli.py`
+  `_CONFIG_HOME_ENV_VAR` / `_DATA_DIR_ENV_VAR`) redirect config + data — but the
+  CLI's **diagnostics logger ignores them**: it writes a per-invocation
+  `cli-*.log` under `state_dir()`, hardcoded to `Path.home()/.omnigent/logs`
+  (`omnigent_ui_sdk/terminal/_config.py`). So only redirecting `HOME` keeps a
+  non-help command (`config list`, the setup PTY spawns, `server stop`) from
+  writing into the real home. The driver does this for you.
+- `--strip-path` reduces `PATH` so `node`/`tmux`/`claude`/`codex` read as "not
+  installed" → the true fresh-machine cold start.
+- Ambient model keys (`ANTHROPIC_API_KEY`, …) are stripped from the child env
+  unless you pass `--keep-env-creds`.
+
+**`--inherit-home` opts out** of `HOME` isolation — use it only to reach a real
+credentialed REPL via ambient `~/.claude` / `~/.databrickscfg` auth. It is
+**less safe**: a non-help command then writes `cli-*.log` into the real
+`~/.omnigent/logs`.
+
+Every run **fingerprints the real `~/.omnigent` before and after** (stat-only,
+no content reads): the top-level config files **and** the set of
+`logs/cli-*.log` diagnostic files. A new config file/mtime *or* a new `cli-*.log`
+basename trips `real_config_untouched: false`. With the default isolation that
+never happens; under `--inherit-home` it correctly does — which is exactly the
+violation the guard is meant to catch. If that check is ever `false`, stop and
+investigate. Run `check-isolation` first to confirm the loop is safe on your
+machine.
+
+## Prerequisites
+
+- You're in the **worktree whose code you want to test** (each parallel agent
+  on its own worktree). The driver runs `omnigent` from `--repo`'s checkout.
+- A Python with `pexpect` — the project's `.venv/bin/python` bundles it
+  (`pexpect>=4.9` in `pyproject.toml`). Run the driver with that interpreter.
+- An `omnigent` binary: the driver auto-finds `<repo>/.venv/bin/omnigent`, or
+  pass `--omnigent <path>`.
+- The setup / picker / help / cold-start scenarios need **no credentials and no
+  harness**. Only `repl-commands` needs a working harness + credential: pass
+  `--inherit-home` (ambient `~/.claude` auth) and/or `--keep-env-creds` (env API
+  key) with `--agent`. It reports `skipped`, never a false pass, when the prompt
+  isn't reachable.
+
+## Quick start
+
+```bash
+REPO=/path/to/your/worktree
+PY=$REPO/.venv/bin/python
+DRV=$REPO/.claude/skills/cli-setup-verify/verify_cli.py
+
+# 0. Prove the sandbox is safe on this machine (do this once).
+#    HOME is isolated by default — no flag needed.
+$PY $DRV --scenario check-isolation --repo "$REPO"
+
+# 1. See exactly what a brand-new user sees on a fresh machine.
+$PY $DRV --scenario cold-start --strip-path --keep-sandbox --repo "$REPO"
+#    → reads the printed `artifacts` path, then `cat <that>/cold_start.txt`
+
+# 2. Lint the top-level help (and any subcommand's).
+$PY $DRV --scenario help-snapshot --repo "$REPO"
+$PY $DRV --scenario help-snapshot --subcommand server --repo "$REPO"
+```
+
+Each run prints `SUMMARY {…}` and exits non-zero if any check failed (a
+`skipped` scenario exits 0). Pipe to `… | grep '^SUMMARY' | python -m json.tool`
+to read it.
+
+## Scenario catalog
+
+| Scenario | What it drives | Key checks / notes | Maps to findings |
+|---|---|---|---|
+| `check-isolation` | `omnigent config list` in the sandbox (no PTY) | `config_list_ran`, `sandbox_config_home_used`, `real_config_untouched` | safety gate for everything |
+| `cold-start` | `omnigent setup` via PTY on a simulated fresh machine | `onboarding_rendered`, `harness_menu_present`; note `guided_default_affordance` | cold-start dead-end; missing "recommended start here" |
+| `setup-snapshot` | `omnigent setup`, optional `--nav-down N` arrow steps | `menu_rendered`; saves a frame per step | picker markers/footer/alignment; narrow-terminal at 80×24 |
+| `help-snapshot` | `omnigent [--subcommand] --help` (no PTY) | `help_rendered`, `no_param_leak`, `no_update_dup`; note `top_level_command_count` | `:param` leak, duplicate `update`/`upgrade`, command sprawl |
+| `repl-commands` | `omnigent run <agent>` REPL, sends `/help` + `/quit` | `help_lists_commands`; note `quit_advertised` | REPL discoverability (`/help`, `/quit`) |
+
+`--list-scenarios` prints them too. Captured frames land in the printed
+`artifacts` dir as both `<name>.txt` (ANSI-stripped, for reading/asserting) and
+`<name>.ansi.txt` (raw, to see real colors with `less -R`).
+
+## The verifiable loop — a worked example
+
+Finding: *"`server --help` leaks Sphinx `:param`/`:returns` into user help."*
+
+```bash
+# BEFORE the fix (on the unfixed code):
+$PY $DRV --scenario help-snapshot --subcommand server --label before --repo "$REPO"
+#   → "no_param_leak": {"ok": false, ...}      ← bug reproduced (the baseline)
+
+# ... make the change (move :param docs into # comments) ...
+
+# AFTER the fix:
+$PY $DRV --scenario help-snapshot --subcommand server --label after --repo "$REPO"
+#   → "no_param_leak": {"ok": true, "detail": "clean"}   ← flipped → fix is verifiable
+```
+
+The same shape proves the `update`/`upgrade` duplicate (`no_update_dup`), the
+cold-start dead-end (`guided_default_affordance` note flips `absent`→`present`),
+or REPL `/quit` discoverability (`quit_advertised` note flips `no`→`yes`). **If
+the check/note doesn't flip, the fix isn't proven** — that is the signal to keep
+working, and it's exactly the judgment the loop exists to force.
+
+If a finding has no machine check yet, add one (see "Adding a scenario") so the
+fix becomes provable instead of asserted.
+
+## Examining UI/UX deliberately
+
+- **Narrow terminal is the default.** The driver uses **80×24** — the size a
+  new user's window actually is, and where banner overflow and picker
+  redraw-past-the-bottom bugs appear. Re-run with `--cols 120 --rows 40` to
+  compare the roomy layout; diff the two frames.
+- **Read the frame, don't just trust the check.** `cat <artifacts>/cold_start.txt`
+  shows the literal screen — the all-`✗` menu, the footer hint (`Esc back` at
+  the root), the marker (`❯`), alignment of the status gutter. The frame *is*
+  the UX evidence.
+- **Compare pickers for consistency.** `setup-snapshot --nav-down 3` captures
+  the harness menu as you move; eyeball marker/footer/highlight drift against
+  the theme and resume pickers (different engines render differently).
+
+## Covering all critical user journeys
+
+This skill owns the **setup / onboarding / first-run / TUI** journeys. The repo
+already has complementary CUJ coverage — use both:
+
+- **Live setup/UX journeys → this skill's scenarios** (cold-start, setup,
+  pickers, help, REPL discoverability).
+- **Deeper end-to-end journeys → `tests/e2e/test_journey_*.py`** (first session
+  to code, resume/disconnect, fork/explore, file upload, collaboration, …).
+  Run a slice with the project's gated runner, e.g.
+  `uv run --frozen --extra dev python -m pytest tests/e2e/test_journey_first_session_to_code.py -q`.
+- **Reusable PTY helpers** live in `tests/e2e/omnigent/_pexpect_harness.py`
+  (`spawn_omnigent_run`, `wait_for_ready`, `submit_prompt`, `await_turn_complete`,
+  `clean_exit`) and the snapshot comparator in `tests/e2e/omnigent/_snapshot.py`
+  — prefer extending those over re-inventing.
+
+To drive a surface this skill doesn't script yet, spawn it by hand with the
+sandbox env and the keys the driver exports (`KEY_UP`/`KEY_DOWN`/`KEY_ENTER`/
+`KEY_ESC`), then `drain()` and `save_frame()` the result.
+
+## Teardown — non-negotiable
+
+- The driver force-kills the PTY child and its descendants, and runs
+  `omnigent server stop` against the sandbox to reap any spawned background
+  server. After a run, confirm nothing leaked:
+  `pgrep -af "omnigent.*(server|runner|host._daemon)"` — anything bound to your
+  sandbox's data dir is yours to kill.
+- The sandbox temp dir is deleted unless `--keep-sandbox`. If you keep one for
+  inspection, `rm -rf` it when done.
+- Always drive the CLI through the driver (which redirects `HOME` + the
+  config/data knobs), never a bare `omnigent setup` — that would write to the
+  real `~/.omnigent`. If you pass `--inherit-home`, expect `cli-*.log` writes to
+  the real `~/.omnigent/logs` and a `real_config_untouched: false` — that's the
+  guard working, not a bug.
+
+## Honesty
+
+If you can't reach the surface under test (no harness, no credential, headless
+limit), the scenario must report `skipped` — **do not claim a CUJ passed**. The
+strongest evidence for a fix is a reproduced baseline (`before`) plus the flipped
+`after`; report both `SUMMARY` lines, not a summary of a summary.
+
+## Adding a scenario
+
+Write `scenario_<name>(args, sandbox, result)` in `verify_cli.py`: drive the CLI
+(reuse `pexpect.spawn(... env=sandbox.env, dimensions=(args.rows, args.cols))`,
+`drain()`, `save_frame()`, the `KEY_*` constants), record findings with
+`result.add(name, ok, detail)` (fails the run) or `result.notes.append(...)`
+(informational, for before/after flips), register it in `SCENARIOS`, and add a
+row to the catalog above. Keep one assertion per real, observable behavior so a
+fix is provable as a single check flip.
+
+## Code under test
+
+- First-run dispatch / no-arg routing: `omnigent/cli.py` (`run`, the first-run
+  plan, `_run_configure_harnesses_interactive`).
+- Onboarding: `omnigent/onboarding/*` (`setup.py`, `interactive.py`,
+  `configure_models.py`, `provider_selection.py`, `detected.py`).
+- TUI / REPL & pickers: `omnigent/repl/*` (`_repl.py`, `_theme_picker.py`,
+  `_resume_picker.py`), `omnigent/_terminal_picker_theme.py`.
+- Installer: `scripts/install_oss.sh`.

.claude/skills/cli-setup-verify/verify_cli.py

@@ -0,0 +1,715 @@
+#!/usr/bin/env python3
+"""Drive the Omnigent CLI through a PTY in a throwaway sandbox and verify it.
+
+This is the reusable engine behind the ``cli-setup-verify`` skill (see
+``SKILL.md`` next to this file for the playbook and CUJ catalog). One run:
+
+1. Builds an **isolated config/data sandbox** so nothing the CLI writes ever
+   lands in the real ``~/.omnigent`` — it sets the purpose-built
+   ``OMNIGENT_CONFIG_HOME`` / ``OMNIGENT_DATA_DIR`` knobs (``omnigent/cli.py``
+   ``_CONFIG_HOME_ENV_VAR`` / ``_DATA_DIR_ENV_VAR``), strips leaked model
+   credentials from the child env, and (optionally) points ``HOME`` and a
+   minimal ``PATH`` at the sandbox to simulate a brand-new machine.
+2. Drives the real ``omnigent`` binary through ``pexpect`` (a real PTY with a
+   sane ``TERM`` so prompt-toolkit / the raw-termios pickers actually render).
+3. Captures ANSI-stripped frames into an artifacts dir for UX inspection.
+4. Runs the named scenario's assertions and prints a single machine-readable
+   ``SUMMARY {json}`` line; exits non-zero on failure.
+5. Proves it left the real ``~/.omnigent`` byte-for-byte unchanged.
+
+The point is a **verifiable loop**: run a scenario on the *unfixed* code
+(``--label before``) to capture the baseline, make the change, run the same
+scenario again (``--label after``), and diff the two SUMMARY lines. If you
+cannot reach the surface under test (missing harness, no credential), the
+scenario reports ``skipped`` — never a false ``pass``.
+"""
+
+from __future__ import annotations
+
+import argparse
+import contextlib
+import json
+import os
+import re
+import shutil
+import signal
+import subprocess
+import sys
+import time
+from collections.abc import Sequence
+from dataclasses import dataclass, field
+from pathlib import Path
+from tempfile import mkdtemp
+
+try:
+    import pexpect
+except ImportError:  # pragma: no cover - guidance, not logic
+    sys.stderr.write(
+        "verify_cli.py needs `pexpect`. Run it with the omnigent project's "
+        "venv python (it bundles pexpect), e.g.\n"
+        "  <repo>/.venv/bin/python verify_cli.py ...\n"
+    )
+    raise
+
+# --- PTY constants (mirrors tests/e2e/omnigent/_pexpect_harness.py) ---------
+
+# prompt-toolkit refuses to draw on TERM=dumb; this is what the REPL tests use.
+TERM = "xterm-256color"
+# 80x24 is the default new-user window — exactly where narrow-terminal bugs
+# (banner overflow, picker redraw past the bottom row) show up. Override with
+# --cols/--rows to also exercise the roomy 120x40 layout.
+DEFAULT_COLS = 80
+DEFAULT_ROWS = 24
+
+ANSI_RE = re.compile(r"\x1b\[[0-9;?]*[a-zA-Z]")
+
+# Stable onboarding anchors (omnigent/cli.py:520, :10064, :10300).
+ANCHOR_SEARCHING = "Searching for existing credentials"
+ANCHOR_CONFIGURE = "Configure harnesses"
+ANCHOR_NO_HARNESS = "Found no harnesses configured"
+# REPL readiness signals (the toolbar state line, with the input prompt as a
+# fallback for PTY combos that suppress the bottom toolbar).
+REPL_READY = [r"state: sleeping", r"❯ "]
+
+# Keys for driving the raw-termios + prompt-toolkit pickers.
+KEY_UP = "\x1b[A"
+KEY_DOWN = "\x1b[B"
+KEY_ENTER = "\r"
+KEY_ESC = "\x1b"
+
+# Model-provider credentials we strip from the child env so a "cold" sandbox
+# is genuinely credential-free (the CLI auto-adopts ambient keys otherwise).
+LEAKED_CRED_VARS = (
+    "ANTHROPIC_API_KEY",
+    "ANTHROPIC_AUTH_TOKEN",
+    "OPENAI_API_KEY",
+    "CLAUDE_API_KEY",
+    "CLAUDE_CODE_OAUTH_TOKEN",
+    "GEMINI_API_KEY",
+    "GOOGLE_API_KEY",
+    "CURSOR_API_KEY",
+    "GH_TOKEN",
+    "GITHUB_TOKEN",
+    "DATABRICKS_TOKEN",
+    "DATABRICKS_HOST",
+    "DATABRICKS_CONFIG_PROFILE",
+)
+
+
+def strip_ansi(text: str) -> str:
+    """Remove ANSI control sequences so frames can be asserted as plain text."""
+    return ANSI_RE.sub("", text)
+
+
+# --- sandbox ----------------------------------------------------------------
+
+
+@dataclass
+class Sandbox:
+    """A throwaway config/data/home for one verification run.
+
+    :param root: Temp directory holding ``config/``, ``data/`` and (unless
+        ``--inherit-home``) ``home/``. Removed on cleanup unless ``--keep-sandbox``.
+    :param env: The child-process environment with the isolation knobs set.
+    :param home_isolated: Whether ``HOME`` was redirected into the sandbox.
+    """
+
+    root: Path
+    env: dict[str, str]
+    home_isolated: bool
+
+
+def build_sandbox(
+    *,
+    keep_env_creds: bool,
+    inherit_home: bool,
+    strip_path: bool,
+    omnigent_bin: Path,
+) -> Sandbox:
+    """Create an isolated sandbox env that cannot touch the real ``~/.omnigent``.
+
+    ``HOME`` is redirected into the sandbox **by default**. This is load-bearing,
+    not cosmetic: the CLI's diagnostics logger writes a per-invocation
+    ``cli-*.log`` under ``state_dir()`` which is hardcoded to ``Path.home() /
+    ".omnigent"`` (``omnigent_ui_sdk/terminal/_config.py``) and ignores
+    ``OMNIGENT_CONFIG_HOME`` / ``OMNIGENT_DATA_DIR``. So redirecting ``HOME`` is
+    the *only* thing that keeps non-help commands (``config list``, the setup
+    PTY spawns, ``server stop`` teardown) from writing into the real home.
+
+    :param keep_env_creds: Keep ambient model keys (e.g. ``ANTHROPIC_API_KEY``)
+        in the child env. Default False → a genuinely cold, credential-free run.
+    :param inherit_home: Opt OUT of home isolation — use the real ``HOME`` (and
+        thus its ambient ``~/.claude`` / ``~/.databrickscfg`` auth). Needed to
+        reach a real credentialed REPL, but **relaxes the safety guarantee**:
+        non-help commands will then write ``cli-*.log`` into the real
+        ``~/.omnigent/logs`` (the broadened fingerprint catches this).
+    :param strip_path: Reduce ``PATH`` to just the omnigent binary's dir + an
+        empty dir, so node/npm/tmux/claude/codex read as "not installed" — i.e.
+        a brand-new machine.
+    :param omnigent_bin: Path to the ``omnigent`` console script being driven.
+    :returns: A :class:`Sandbox`.
+    """
+    root = Path(mkdtemp(prefix="omnigent-verify-"))
+    (root / "config").mkdir()
+    (root / "data").mkdir()
+
+    env = dict(os.environ)
+    if not keep_env_creds:
+        for var in LEAKED_CRED_VARS:
+            env.pop(var, None)
+
+    env["OMNIGENT_CONFIG_HOME"] = str(root / "config")
+    env["OMNIGENT_DATA_DIR"] = str(root / "data")
+    env["OMNIGENT_NO_UPDATE_CHECK"] = "1"  # keep the update nag out of frames
+    env["TERM"] = TERM
+    env["COLUMNS"] = str(DEFAULT_COLS)
+    env["LINES"] = str(DEFAULT_ROWS)
+
+    if not inherit_home:
+        home = root / "home"
+        home.mkdir()
+        env["HOME"] = str(home)
+
+    if strip_path:
+        empty = root / "emptybin"
+        empty.mkdir()
+        env["PATH"] = f"{omnigent_bin.parent}:{empty}"
+
+    return Sandbox(root=root, env=env, home_isolated=not inherit_home)
+
+
+def fingerprint_real_config() -> dict[str, str]:
+    """Fingerprint the real ``~/.omnigent`` so we can prove we never wrote to it.
+
+    Stat-only (size + mtime, no content reads). It captures two things, both
+    cheap:
+
+    * the top-level config files (``*.yaml`` / ``*.json`` / ``*.toml`` plus the
+      known names) — what onboarding writes; and
+    * the set of ``logs/cli-*.log`` diagnostic files — what *any* non-help CLI
+      invocation writes via the hardcoded ``Path.home()/.omnigent`` state dir.
+      A new ``cli-*.log`` basename after the run means we wrote into the real
+      home (the precise violation that slips through ``OMNIGENT_CONFIG_HOME`` /
+      ``OMNIGENT_DATA_DIR``). With home isolation on (the default) none appear;
+      under ``--inherit-home`` they do — and this is what trips the guard.
+
+    It deliberately does **not** read the multi-GB ``logs/*.log`` bodies,
+    ``db-backups/`` or native-state dirs (reading them would hang, and other
+    running omnigent daemons churn them → false alarms). The single ``logs/``
+    glob is bounded by the diagnostics log cap.
+
+    :returns: Mapping of relative path → ``"<size>:<mtime_ns>"`` (config files)
+        or ``"<mtime_ns>"`` (cli logs). Empty if the directory does not exist.
+    """
+    base = Path.home() / ".omnigent"
+    out: dict[str, str] = {}
+    if not base.exists():
+        return out
+    candidates: set[Path] = set()
+    for pattern in ("*.yaml", "*.yml", "*.json", "*.toml"):
+        candidates.update(base.glob(pattern))
+    for name in ("config.yaml", "secrets.json", "auth_tokens.json", "providers.yaml"):
+        candidates.add(base / name)
+    for p in sorted(candidates):
+        if p.is_file():
+            st = p.stat()
+            out[p.name] = f"{st.st_size}:{st.st_mtime_ns}"
+    logs = base / "logs"
+    if logs.is_dir():
+        for p in sorted(logs.glob("cli-*.log")):
+            with contextlib.suppress(OSError):
+                out[f"logs/{p.name}"] = str(p.stat().st_mtime_ns)
+    return out
+
+
+# --- result model -----------------------------------------------------------
+
+
+@dataclass
+class Check:
+    name: str
+    ok: bool
+    detail: str = ""
+
+
+@dataclass
+class Result:
+    scenario: str
+    label: str
+    status: str = "pass"  # pass | fail | skipped
+    checks: list[Check] = field(default_factory=list)
+    notes: list[str] = field(default_factory=list)
+    artifacts: list[str] = field(default_factory=list)
+
+    def add(self, name: str, ok: bool, detail: str = "") -> None:
+        self.checks.append(Check(name, ok, detail))
+        if not ok and self.status == "pass":
+            self.status = "fail"
+
+    def skip(self, reason: str) -> None:
+        self.status = "skipped"
+        self.notes.append(reason)
+
+    def to_dict(self) -> dict[str, object]:
+        return {
+            "scenario": self.scenario,
+            "label": self.label,
+            "status": self.status,
+            "checks": [{"name": c.name, "ok": c.ok, "detail": c.detail} for c in self.checks],
+            "notes": self.notes,
+            "artifacts": self.artifacts,
+        }
+
+
+# --- frame capture ----------------------------------------------------------
+
+
+def drain(child: pexpect.spawn, *, seconds: float) -> str:
+    """Read everything the child renders for ``seconds`` and return it raw.
+
+    Used to capture a settled screen (a menu, a help body) without depending on
+    a specific completion marker.
+    """
+    buf: list[str] = []
+    deadline = time.time() + seconds
+    while time.time() < deadline:
+        try:
+            chunk = child.read_nonblocking(size=4096, timeout=0.3)
+        except pexpect.TIMEOUT:
+            continue
+        except pexpect.EOF:
+            break
+        if chunk:
+            buf.append(chunk)
+    return "".join(buf)
+
+
+def save_frame(result: Result, artifacts: Path, name: str, raw: str) -> None:
+    """Persist a raw + ANSI-stripped frame and register it on the result."""
+    artifacts.mkdir(parents=True, exist_ok=True)
+    stripped = strip_ansi(raw)
+    (artifacts / f"{name}.ansi.txt").write_text(raw, encoding="utf-8")
+    (artifacts / f"{name}.txt").write_text(stripped, encoding="utf-8")
+    result.artifacts.append(str(artifacts / f"{name}.txt"))
+
+
+# --- scenarios --------------------------------------------------------------
+
+
+def scenario_check_isolation(args, sandbox: Sandbox, result: Result) -> None:
+    """Smoke-test the sandbox: a read-only CLI call must not touch real config.
+
+    Runs ``omnigent config list`` inside the sandbox (no PTY needed) and
+    asserts (a) it executed, (b) the sandbox config home is now used, (c) the
+    real ``~/.omnigent`` fingerprint is unchanged. This is the first thing to
+    run to trust every other scenario.
+    """
+    proc = subprocess.run(
+        [str(args.omnigent), "config", "list"],
+        env=sandbox.env,
+        cwd=str(args.repo),
+        capture_output=True,
+        text=True,
+        timeout=args.timeout,
+    )
+    save_frame(result, Path(args.artifacts), "config_list", proc.stdout + proc.stderr)
+    result.add("config_list_ran", proc.returncode == 0, f"exit={proc.returncode}")
+    # The sandbox config home should exist; the real one is checked globally in
+    # main() via the before/after fingerprint.
+    result.add(
+        "sandbox_config_home_used",
+        Path(sandbox.env["OMNIGENT_CONFIG_HOME"]).exists(),
+        sandbox.env["OMNIGENT_CONFIG_HOME"],
+    )
+
+
+def scenario_cold_start(args, sandbox: Sandbox, result: Result) -> None:
+    """Spawn the first-time setup surface a brand-new user sees and capture it.
+
+    Home isolation is on by default (so this is already a fresh machine for
+    credentials); add ``--strip-path`` to also make node/tmux/claude read as
+    not installed. Asserts the onboarding surface renders (the credential search
+    banner or the ``Configure harnesses`` menu), saves the frame for UX review,
+    then aborts cleanly.
+    """
+    child = pexpect.spawn(
+        str(args.omnigent),
+        ["setup"],
+        env=sandbox.env,
+        cwd=str(args.repo),
+        encoding="utf-8",
+        timeout=args.timeout,
+        dimensions=(args.rows, args.cols),
+    )
+    try:
+        idx = child.expect(
+            [ANCHOR_CONFIGURE, ANCHOR_SEARCHING, ANCHOR_NO_HARNESS, pexpect.EOF],
+            timeout=args.timeout,
+        )
+    except pexpect.TIMEOUT:
+        save_frame(result, Path(args.artifacts), "cold_start_timeout", child.before or "")
+        result.add("onboarding_rendered", False, "no onboarding anchor within timeout")
+        _kill_tree(child)
+        return
+
+    pre = child.before or ""
+    # Let the menu settle so the captured frame holds the whole harness list.
+    settle = drain(child, seconds=2.0)
+    frame = pre + (child.after or "") + settle
+    save_frame(result, Path(args.artifacts), "cold_start", frame)
+
+    result.add("onboarding_rendered", idx in (0, 1, 2), f"anchor_index={idx}")
+    stripped = strip_ansi(frame)
+    menu_present = ANCHOR_CONFIGURE in stripped
+    result.add(
+        "harness_menu_present",
+        menu_present,
+        "'Configure harnesses' title shown" if menu_present else "menu title missing",
+    )
+    # Informational UX probe (does NOT fail the run): is there any guided
+    # "recommended / start here" affordance, or just a wall of options? This is
+    # the cold-start dead-end finding — a fix should flip this note.
+    has_recommendation = bool(
+        re.search(r"recommend|start here|new here|get started", stripped, re.I)
+    )
+    result.notes.append(
+        f"guided_default_affordance={'present' if has_recommendation else 'absent'}"
+    )
+    _abort_picker(child)
+    _kill_tree(child)
+
+
+def scenario_setup_snapshot(args, sandbox: Sandbox, result: Result) -> None:
+    """Capture the setup menu, then optionally arrow-navigate and snapshot each
+    frame, for picker UX review (markers, footer hints, alignment, width).
+
+    Use ``--nav-down N`` to step down N rows capturing a frame each time.
+    """
+    child = pexpect.spawn(
+        str(args.omnigent),
+        ["setup"],
+        env=sandbox.env,
+        cwd=str(args.repo),
+        encoding="utf-8",
+        timeout=args.timeout,
+        dimensions=(args.rows, args.cols),
+    )
+    try:
+        child.expect([ANCHOR_CONFIGURE, ANCHOR_SEARCHING], timeout=args.timeout)
+    except pexpect.TIMEOUT:
+        result.add("menu_rendered", False, "setup menu did not render")
+        _kill_tree(child)
+        return
+    frame = (child.before or "") + (child.after or "") + drain(child, seconds=1.5)
+    save_frame(result, Path(args.artifacts), "setup_menu_0", frame)
+    result.add("menu_rendered", ANCHOR_CONFIGURE in strip_ansi(frame))
+
+    for i in range(1, args.nav_down + 1):
+        child.send(KEY_DOWN)
+        frame = drain(child, seconds=1.0)
+        save_frame(result, Path(args.artifacts), f"setup_menu_{i}", frame)
+
+    _abort_picker(child)
+    _kill_tree(child)
+
+
+def scenario_help_snapshot(args, sandbox: Sandbox, result: Result) -> None:
+    """Render ``omnigent [SUBCOMMAND] --help`` and lint it for known UX issues.
+
+    No PTY needed. The lint checks map directly to top-20 findings, so a fix is
+    verifiable as a before/after flip:
+      * ``no_param_leak``    — no ``:param``/``:returns`` Sphinx dump (finding X3)
+      * ``no_update_dup``    — top-level help doesn't list both update & upgrade (X2)
+    Use ``--subcommand server`` (etc.) to lint a specific command's help.
+    """
+    cmd = [str(args.omnigent)]
+    if args.subcommand:
+        cmd.append(args.subcommand)
+    cmd.append("--help")
+    proc = subprocess.run(
+        cmd,
+        env={**sandbox.env, "COLUMNS": str(args.cols)},
+        cwd=str(args.repo),
+        capture_output=True,
+        text=True,
+        timeout=args.timeout,
+    )
+    out = proc.stdout + proc.stderr
+    label = args.subcommand or "root"
+    save_frame(result, Path(args.artifacts), f"help_{label}", out)
+    result.add(
+        "help_rendered",
+        proc.returncode == 0 and "Usage:" in out,
+        f"exit={proc.returncode}",
+    )
+    param_leak = ":param" in out or ":returns:" in out
+    result.add(
+        "no_param_leak",
+        not param_leak,
+        "Sphinx :param/:returns leaked into --help" if param_leak else "clean",
+    )
+    if not args.subcommand:
+        both = "\n  update" in out and "\n  upgrade" in out
+        result.add(
+            "no_update_dup",
+            not both,
+            "both `update` and `upgrade` listed (duplicate)"
+            if both
+            else "single canonical upgrade",
+        )
+        cmd_count = len(re.findall(r"^  [a-z][\w-]+\s{2,}", out, re.M))
+        result.notes.append(f"top_level_command_count={cmd_count}")
+
+
+def scenario_repl_commands(args, sandbox: Sandbox, result: Result) -> None:
+    """Boot the REPL and check command discoverability.
+
+    Asserts the ``/help`` command list renders; separately records whether
+    ``/quit`` is advertised (the ``quit_advertised`` note — finding U2).
+
+    Requires a working harness + credential to reach the prompt: pass
+    ``--inherit-home`` (for ambient ``~/.claude`` auth) and/or
+    ``--keep-env-creds`` (for an env API key) plus an ``--agent``/``--harness``.
+    If the prompt is not reachable the scenario reports ``skipped`` (never a
+    false pass).
+    """
+    if not args.agent:
+        result.skip("repl-commands needs --agent <dir/yaml> (and a working harness/credential)")
+        return
+    spawn_args = ["run", args.agent, "--harness", args.harness]
+    if args.model:
+        spawn_args += ["--model", args.model]
+    child = pexpect.spawn(
+        str(args.omnigent),
+        spawn_args,
+        env=sandbox.env,
+        cwd=str(args.repo),
+        encoding="utf-8",
+        timeout=args.timeout,
+        dimensions=(args.rows, args.cols),
+    )
+    try:
+        child.expect(REPL_READY, timeout=args.timeout)
+    except (pexpect.TIMEOUT, pexpect.EOF):
+        save_frame(result, Path(args.artifacts), "repl_boot_fail", child.before or "")
+        result.skip("REPL prompt not reachable (missing harness/credential?) — see repl_boot_fail")
+        _kill_tree(child)
+        return
+    child.send("/help")
+    child.send(KEY_ENTER)
+    frame = drain(child, seconds=2.5)
+    save_frame(result, Path(args.artifacts), "repl_help", frame)
+    stripped = strip_ansi(frame)
+    # The /help command list rendered (the `/help` row is always present). Note
+    # `/quit` discoverability separately — finding U2 is that it is NOT
+    # advertised, so a fix flips quit_advertised no→yes.
+    result.add("help_lists_commands", "/help" in stripped, "/help output")
+    result.notes.append(
+        f"quit_advertised={'yes' if '/quit' in stripped else 'no'}"  # discoverability finding U2
+    )
+    child.send("/quit")
+    child.send(KEY_ENTER)
+    with contextlib.suppress(Exception):
+        child.expect(pexpect.EOF, timeout=10)
+    _kill_tree(child)
+
+
+SCENARIOS = {
+    "check-isolation": scenario_check_isolation,
+    "cold-start": scenario_cold_start,
+    "setup-snapshot": scenario_setup_snapshot,
+    "help-snapshot": scenario_help_snapshot,
+    "repl-commands": scenario_repl_commands,
+}
+
+
+# --- teardown helpers -------------------------------------------------------
+
+
+def _abort_picker(child: pexpect.spawn) -> None:
+    """Send the menu's abort gestures (q, then Esc) so it exits cleanly."""
+    with contextlib.suppress(Exception):
+        child.send("q")
+        time.sleep(0.2)
+        child.send(KEY_ESC)
+        time.sleep(0.2)
+
+
+def _descendant_pids(root_pid: int) -> list[int]:
+    """Collect the full descendant tree of ``root_pid`` via repeated ``pgrep -P``.
+
+    Walks children, grandchildren, etc. — a spawned server/runner can re-parent
+    its own children, so a single ``pgrep -P`` only reaches one level.
+    """
+    found: list[int] = []
+    frontier = [root_pid]
+    seen = {root_pid}
+    while frontier:
+        parent = frontier.pop()
+        with contextlib.suppress(Exception):
+            out = subprocess.run(
+                ["pgrep", "-P", str(parent)], capture_output=True, text=True
+            ).stdout
+            for tok in out.split():
+                with contextlib.suppress(ValueError):
+                    pid = int(tok)
+                    if pid not in seen:
+                        seen.add(pid)
+                        found.append(pid)
+                        frontier.append(pid)
+    return found
+
+
+def _kill_tree(child: pexpect.spawn) -> None:
+    """Force-kill the child and its whole descendant tree; never raise."""
+    pid = child.pid
+    # Snapshot descendants BEFORE close() — closing the PTY can reparent them to
+    # init, after which pgrep -P can no longer find them via the child.
+    descendants = _descendant_pids(pid) if pid else []
+    with contextlib.suppress(Exception):
+        child.close(force=True)
+    for dpid in descendants:
+        with contextlib.suppress(ProcessLookupError, PermissionError):
+            os.kill(dpid, signal.SIGKILL)
+
+
+def stop_sandbox_server(args, sandbox: Sandbox) -> None:
+    """Best-effort: stop any background server bound to the sandbox data dir."""
+    with contextlib.suppress(Exception):
+        subprocess.run(
+            [str(args.omnigent), "server", "stop"],
+            env=sandbox.env,
+            cwd=str(args.repo),
+            capture_output=True,
+            text=True,
+            timeout=30,
+        )
+
+
+# --- main -------------------------------------------------------------------
+
+
+def resolve_omnigent(repo: Path, explicit: str | None) -> Path:
+    """Find the ``omnigent`` console script to drive."""
+    if explicit:
+        return Path(explicit).resolve()
+    venv = repo / ".venv" / "bin" / "omnigent"
+    if venv.exists():
+        return venv.resolve()
+    found = shutil.which("omnigent")
+    if found:
+        return Path(found).resolve()
+    sys.exit("Could not find an `omnigent` binary; pass --omnigent <path>.")
+
+
+def parse_args(argv: Sequence[str]) -> argparse.Namespace:
+    p = argparse.ArgumentParser(
+        description=__doc__,
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+    )
+    p.add_argument("--scenario", choices=sorted(SCENARIOS), help="Scenario to run.")
+    p.add_argument("--list-scenarios", action="store_true", help="List scenarios and exit.")
+    p.add_argument(
+        "--repo",
+        default=os.getcwd(),
+        type=lambda s: Path(s).resolve(),
+        help="Repo root (child cwd).",
+    )
+    p.add_argument(
+        "--omnigent",
+        help="Path to the omnigent binary (default: <repo>/.venv/bin/omnigent or PATH).",
+    )
+    p.add_argument(
+        "--label",
+        default="run",
+        help="Label for this run, e.g. before/after, in the SUMMARY line.",
+    )
+    p.add_argument("--artifacts", help="Dir for captured frames (default: <sandbox>/artifacts).")
+    p.add_argument("--cols", type=int, default=DEFAULT_COLS, help="PTY columns (default 80).")
+    p.add_argument("--rows", type=int, default=DEFAULT_ROWS, help="PTY rows (default 24).")
+    p.add_argument("--timeout", type=float, default=60.0, help="Per-expect timeout seconds.")
+    p.add_argument(
+        "--inherit-home",
+        action="store_true",
+        help="Opt out of HOME isolation (use real HOME + ambient auth). "
+        "Less safe: non-help commands then write cli-*.log into the real "
+        "~/.omnigent/logs. Use only to reach a real credentialed REPL.",
+    )
+    p.add_argument(
+        "--strip-path",
+        action="store_true",
+        help="Minimal PATH so node/tmux/claude read as not installed.",
+    )
+    p.add_argument(
+        "--keep-env-creds",
+        action="store_true",
+        help="Keep ambient model API keys in the child env.",
+    )
+    p.add_argument(
+        "--keep-sandbox",
+        action="store_true",
+        help="Do not delete the sandbox (for inspection).",
+    )
+    p.add_argument(
+        "--nav-down",
+        type=int,
+        default=0,
+        help="(setup-snapshot) arrow-down N times, capturing each frame.",
+    )
+    p.add_argument(
+        "--subcommand",
+        help="(help-snapshot) subcommand to lint, e.g. server. Omit for top-level.",
+    )
+    p.add_argument("--agent", help="(repl-commands) agent dir/yaml to run.")
+    p.add_argument("--harness", default="claude-sdk", help="(repl-commands) harness.")
+    p.add_argument("--model", help="(repl-commands) model override.")
+    return p.parse_args(argv)
+
+
+def main(argv: Sequence[str]) -> int:
+    args = parse_args(argv)
+    if args.list_scenarios:
+        for name, fn in sorted(SCENARIOS.items()):
+            print(f"{name:16} {(fn.__doc__ or '').strip().splitlines()[0]}")
+        return 0
+    if not args.scenario:
+        sys.exit("Pass --scenario <name> (or --list-scenarios).")
+
+    args.omnigent = resolve_omnigent(args.repo, args.omnigent)
+    sandbox = build_sandbox(
+        keep_env_creds=args.keep_env_creds,
+        inherit_home=args.inherit_home,
+        strip_path=args.strip_path,
+        omnigent_bin=args.omnigent,
+    )
+    if not args.artifacts:
+        args.artifacts = str(sandbox.root / "artifacts")
+
+    before = fingerprint_real_config()
+    result = Result(scenario=args.scenario, label=args.label)
+    try:
+        SCENARIOS[args.scenario](args, sandbox, result)
+    except Exception as exc:  # noqa: BLE001 - report any scenario error as a failed check, never crash the loop
+        result.add("scenario_exception", False, f"{type(exc).__name__}: {exc}")
+    finally:
+        stop_sandbox_server(args, sandbox)
+
+    after = fingerprint_real_config()
+    untouched = before == after
+    result.add(
+        "real_config_untouched",
+        untouched,
+        "~/.omnigent unchanged" if untouched else "REAL CONFIG MUTATED — investigate",
+    )
+
+    if not args.keep_sandbox:
+        shutil.rmtree(sandbox.root, ignore_errors=True)
+    else:
+        result.notes.append(f"sandbox_kept={sandbox.root}")
+
+    print("SUMMARY " + json.dumps(result.to_dict()))
+    return 0 if result.status in ("pass", "skipped") else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))

.claude/skills/copilot-sdk-e2e-dev/SKILL.md

@@ -0,0 +1,214 @@
+---
+name: copilot-sdk-e2e-dev
+description: Spin up a live local Omnigent server and exercise the GitHub Copilot SDK harness end-to-end — build copilot agents, run real turns, smoke-test, and bug-bash. Load when developing, testing, or debugging the copilot harness (omnigent/inner/copilot_executor.py, copilot_harness.py, omnigent/onboarding/copilot_auth.py) or its auth / model / tool-bridge behavior.
+---
+
+# Copilot SDK harness: end-to-end dev & testing
+
+The `copilot` harness drives the **GitHub Copilot SDK** (`github-copilot-sdk`,
+imported as `copilot`) — a persistent `CopilotClient` + `CopilotSession` per
+Omnigent conversation — and bridges Omnigent's `sys_*` tools into Copilot as SDK
+`Tool`s. The Python SDK **bundles the Copilot CLI binary it drives** as a backing
+server, so there is no separate `@github/copilot` install. This skill is the
+proven recipe for running it **for real** against a live local server — not just
+the unit tests.
+
+> The harness runs as a **local runner** from your current checkout, so
+> `omni run <bundle> --server <url>` exercises exactly the code you're on.
+
+## Prerequisites (check these first)
+
+1. **You're on the branch you want to test.** The copilot harness is an
+   optional extra — install it (without disturbing other extras) with
+   `uv sync --frozen --extra dev --extra copilot`. NB: a bare
+   `uv run --frozen --extra dev` re-syncs the venv and **prunes** the copilot
+   SDK; for live testing call `.venv/bin/omni` / `.venv/bin/python` directly and
+   avoid `uv run` mid-session.
+2. **The SDK is installed:**
+   `.venv/bin/python -c "import copilot; print(copilot.__file__)"`.
+3. **A GitHub token with Copilot access is configured.** Copilot needs a
+   fine-grained PAT with the "Copilot Requests" permission, or an OAuth token
+   from the GitHub CLI / Copilot CLI app (classic `ghp_` PATs are rejected).
+   Verify (booleans only — never print the token):
+   ```bash
+   .venv/bin/python -c "from omnigent.onboarding.copilot_auth import copilot_github_token_configured; import os; print('config:', copilot_github_token_configured(), 'env:', bool(os.environ.get('GH_TOKEN') or os.environ.get('COPILOT_GITHUB_TOKEN')))"
+   ```
+   If both are `False`, run `omni setup` and register a Copilot token, or
+   `export GH_TOKEN=$(gh auth token)` (when `gh` is logged into an account with
+   Copilot). Check the account's entitlement with
+   `gh api /copilot_internal/user` (look for `chat_enabled`/`cli_enabled`).
+4. **Network egress to GitHub's Copilot backend.** A turn that hangs or fails to
+   connect on a locked-down host is usually egress, not a harness bug.
+
+## Step 1 — start a local server
+
+```bash
+cd /path/to/omnigent
+.venv/bin/omni server --port 7788 --no-open    # foreground; or `omni server start` for detached
+curl -s http://127.0.0.1:7788/health           # {"status":"ok"}
+```
+
+Use the URL below as `$SERVER`.
+
+## Step 2 — build a copilot agent bundle
+
+A spec with `spec_version` **must be a directory containing `config.yaml`** —
+not a single `.yaml` file. Minimal copilot agent:
+
+```bash
+mkdir -p /tmp/copilot-dev
+cat > /tmp/copilot-dev/config.yaml <<'YAML'
+spec_version: 1
+name: copilot-dev
+description: Copilot SDK dev/test agent.
+executor:
+  type: omnigent
+  config:
+    harness: copilot
+    # model: gpt-5-mini      # optional; omit for Copilot auto-select
+prompt: |
+  You are a terse test agent. Answer in as few words as possible.
+YAML
+```
+
+For sub-agents, tools, guardrails/policies, copy the field shapes from
+`examples/polly/config.yaml` and `examples/debby/config.yaml`. (Declare policies
+under `guardrails.policies:` — a top-level `policies:` key is silently dropped on
+the `spec_version` + `config.yaml` path.)
+
+## Step 3 — run a turn (and smoke-test)
+
+```bash
+SERVER=http://127.0.0.1:7788
+timeout 280 .venv/bin/omni run /tmp/copilot-dev \
+  -p "Reply with exactly the single word: PONG" \
+  --server "$SERVER" 2>&1
+```
+
+A healthy run prints connection lines then the reply (`PONG`). If that works,
+the full stack is good: token, egress, bundled CLI, harness.
+
+- **Shell / file tools:** add `--tools coding`.
+- **Specific model:** add `--model gpt-5-mini` (or `claude-haiku-4.5`, `auto`).
+
+## Targeted scenarios
+
+| Goal | How |
+|------|-----|
+| Native tools (shell/edit/read) | `--tools coding`, prompt to create→read→edit a file; confirm it actually touches disk |
+| Bridged `sys_*` / sub-agent dispatch | declare a sub-agent (harness `copilot` so auth is satisfied), prompt the parent to delegate — exercises the SDK `Tool` async-handler bridge into `_tool_executor` |
+| Model routing | run the same bundle with several `--model` values; an unknown id fails **loud**, a `databricks-*` id is dropped to auto with a warning |
+| LLM-phase policy | add a guardrail that denies a keyword; confirm `PHASE_LLM_REQUEST`/`PHASE_LLM_RESPONSE` blocks it |
+| Concurrency / leaks | fire several `omni run … &` at once; then `pgrep -af "copilot/bin/copilot"` to check for orphaned bundled-CLI subprocesses |
+
+## Running polly (or any orchestrator) on a copilot brain
+
+The copilot harness can serve as an **async orchestrator** brain (polly / debby),
+not just a standalone agent — it dispatches to sub-agents via the bridged
+`sys_*` tools and synthesizes their results. Two ways to exercise it:
+
+**1. Committed regression guard (brain smoke).**
+`tests/e2e/test_polly_copilot_e2e.py` boots a local server from your checkout and
+runs `examples/polly` with `--harness copilot --model auto`, asserting the brain
+boots and replies. It is **skipped** unless a Copilot token is configured (so CI
+without one skips it). Run it with:
+
+```bash
+.venv/bin/python -m pytest -o addopts="" tests/e2e/test_polly_copilot_e2e.py -v
+```
+
+**2. Full orchestration (dispatch → collect → synthesize).** Use the
+`polly-e2e-dev` driver (in the internal `agent-framework` clone) — it boots a
+local server, polls the AP API, auto-answers elicitations, and asserts the
+fan-out. Drive the brain on copilot with `--brain-harness copilot`, and **always
+pass a Copilot-catalog `--brain-model`** (`auto`, `claude-haiku-4.5`,
+`gpt-5-mini`): the driver's default `--brain-model` is a Claude id that Copilot
+(no Databricks gateway) can't route. From the agent-framework clone:
+
+```bash
+.venv/bin/python .claude/skills/polly-e2e-dev/polly_driver.py \
+  --local --code-dir <this-worktree> \
+  --cuj smoke --brain-harness copilot --brain-model auto      # brain only
+# --cuj fanout  …  and  --cuj review-pr --repo omnigent-ai/omnigent --pr <n>  …
+#   exercise real sub-agent dispatch (claude_code + codex) under a copilot brain.
+```
+
+All three CUJs (smoke / fanout / review-pr) pass on a copilot brain (verified
+live: fanout dispatched 8 sub-agents, 8/8 OK + a synthesis). Note `omni run -p`
+exits after the dispatch turn (the brain parks until woken), so a sub-agent's
+final answer lands server-side — read it over the AP API
+(`GET /v1/sessions/{id}/items`, child sessions), not just stdout.
+
+## Gotchas (these cost real time)
+
+1. **`config.yaml`'s `server:` defaults to a *remote* server.** Omitting
+   `--server` sends your turn to that remote deploy — which may be **stale** and
+   reject the copilot harness with `executor.config.harness: must be one of […]`.
+   **Always pass `--server http://127.0.0.1:<port>`.** (If a *local* server
+   rejects `copilot`, it's running stale code — restart it from your checkout.)
+2. **A spec with `spec_version` must be a directory + `config.yaml`**, never a
+   single `.yaml` file.
+3. **Copilot needs a GitHub token** (fine-grained PAT w/ Copilot Requests, or a
+   gh/Copilot-CLI OAuth token). Resolution precedence: spec `executor.auth`
+   (api_key) > stored `copilot:` config block (`omni setup`) > ambient
+   `COPILOT_GITHUB_TOKEN` / `GH_TOKEN` / `GITHUB_TOKEN`. Classic `ghp_` rejected.
+4. **No Databricks gateway.** Copilot talks only to GitHub's backend, so a
+   `databricks-*` model is silently resolved to Copilot's auto-select — it will
+   *not* route through the AI Gateway like claude-sdk/codex/pi.
+5. **Use a model id from the account's catalog.** free_limited offers `auto`,
+   `claude-haiku-4.5`, `gpt-5-mini`. Run `.venv/bin/python` + `client.list_models()`
+   to discover the live set; an unknown id fails loud (server-side failed session).
+6. **Turns take 30–90s** — always wrap in `timeout 280`.
+7. **Never print/echo the GitHub token** in logs or commands.
+
+## Code & tests
+
+- **Executor (SDK bridge):** `omnigent/inner/copilot_executor.py`
+- **Wrap (HARNESS_COPILOT_* env → executor):** `omnigent/inner/copilot_harness.py`
+- **Auth / token resolution:** `omnigent/onboarding/copilot_auth.py`
+- **Spawn env:** `_build_copilot_spawn_env` in `omnigent/runtime/workflow.py`
+
+```bash
+uv run --frozen --extra dev python -m pytest \
+  tests/inner/test_copilot_executor.py \
+  tests/inner/test_copilot_harness.py \
+  tests/runtime/test_copilot_spawn_env.py \
+  tests/onboarding/test_copilot_auth.py -q
+```
+
+## Bug-bash (fan out)
+
+To stress the harness, run several scenario probes in parallel — each builds a
+bundle and runs real turns against the same `$SERVER`, then reports what broke.
+Highest-value targets: the `Tool` async-handler bridge (hangs / lost tool
+results / errors reported as success), model routing, policy enforcement,
+streamed-output rendering, and orphaned bundled-CLI processes after teardown.
+Cross-check the AP API (`GET /v1/sessions/{id}/items`) — a start failure can exit
+0 with empty stdout while the server records a `failed` session.
+
+## Known sharp edges (found via live bug-bash — "as of this writing")
+
+- **Native tools bypass `on:[tool_call]` policies and aren't recorded.** Copilot's
+  built-in `create`/`view`/`edit`/`bash` run inside the SDK, so an
+  `on:[tool_call]` DENY guardrail (e.g. `blast_radius`) never sees them, and they
+  leave no `function_call` item in the transcript (only streamed narration).
+  **Bridged `sys_*` tools ARE gated and recorded.** Gate Copilot's built-ins at
+  the LLM phase (`PHASE_LLM_REQUEST`/`RESPONSE`, which fire) or via the OS-env
+  sandbox — not `on:[tool_call]`. (Same shape as the cursor harness.)
+- **Copilot fails loud (unlike cursor's swallowed start failures).** Bad token,
+  empty/invalid model, and unknown model ids all exit non-zero with a clear error
+  AND a server-side failed session + error item — verified, not swallowed.
+- **`omni run -p` against an async orchestrator exits after the dispatch turn**,
+  so a delegated sub-agent's final answer is persisted server-side but may not
+  reach stdout in one-shot mode. Read the session over the AP API to see it.
+- **Non-graceful exit can orphan the bundled CLI.** Graceful teardown reaps it
+  (`client.stop()`); after a `SIGKILL`/hard-exit, sweep
+  `pgrep -af "copilot/bin/copilot"`.
+
+## Cleanup
+
+```bash
+.venv/bin/omni server stop        # or kill the foreground `omni server`
+rm -rf /tmp/copilot-dev           # remove scratch bundles
+pgrep -af "copilot/bin/copilot"   # confirm no orphaned bundled-CLI subprocesses linger
+```

.github/pull_request_template.md

@@ -1,6 +1,6 @@
 <!--
 For AI-written descriptions:
-- Follow this template (Related issue, Summary, Type of change, Test coverage, Coverage rationale).
+- Follow this template (Related issue, Summary, Test Plan, Type of change, Test coverage, Coverage notes).
 - Keep it concise; reviewers skim long descriptions.
 - For non-trivial changes, include an ELI5 and a diagram (ASCII or mermaid).
 - Leave every checkbox in place. The PR Template check fails if required sections
@@ -23,6 +23,10 @@ Closes #
 
 <!-- What changed and why, in 1-3 bullets or a short paragraph. -->
 
+## Test Plan
+
+<!-- How was this change tested? Describe the steps, commands, or scenarios used to verify it. Include a screenshot or recording where helpful. -->
+
 ## Type of change
 
 - [ ] Bug fix
@@ -43,11 +47,10 @@ Closes #
 - [ ] Existing tests cover this change
 - [ ] Not applicable
 
-## Coverage rationale
+## Coverage notes
 
 <!--
-Describe the exact commands run and the coverage added/updated. If you did not
-add or run tests, explain why the existing coverage is enough or why tests are
-not applicable. For E2E-relevant changes, call out the E2E scenario exercised or
-why no E2E coverage was added.
+Optional — but required if you checked "Manual verification completed" or
+"Not applicable" above. Describe what you verified manually, or why automated
+test coverage is not needed for this change.
 -->

.github/reviewers

@@ -23,7 +23,7 @@
 /.github/                    @PattaraS @serena-ruan @dhruv0811 @TomeHirata
 
 # Web UI
-/ap-web/                     @SabhyaC26 @serena-ruan @daniellok-db @hzub
+/ap-web/                     @SabhyaC26 @serena-ruan @daniellok-db
 
 # Core agent runtime & harnesses
 /omnigent/inner/             @SabhyaC26 @TomeHirata @dhruv0811 @dbczumar

.github/scripts/ci/e2e-shard-matrix.sh

@@ -1,19 +1,14 @@
 #!/usr/bin/env bash
-# Emits the e2e shard matrix as `matrix=<json>` on $GITHUB_OUTPUT. Shared by
-# e2e.yml and e2e-ui.yml (they differ only in NUM_SHARDS).
+# Emits the e2e shard matrix as `matrix=<json>` on $GITHUB_OUTPUT, or an EMPTY
+# matrix ({"include":[]}) to skip. Empty yields zero jobs and thus NO check-runs
+# -- the point of the indirection: a job-level `if:` skip would instead leave a
+# check-run with an unexpanded `E2E Tests (shard ${{ matrix.shard_id }}/...)` name.
 #
-# Returns an EMPTY matrix ({"include":[]}) when the run should be skipped:
-#   - draft PRs, or
-#   - a fork's pull_request (no secrets there; forks run via the fork-e2e/**
-#     mirror push instead).
-# An empty matrix yields zero jobs and therefore NO check-runs. This is the
-# whole reason for the indirection: a job-level `if:` skip of a matrixed job
-# would instead leave one check-run with an unexpanded
-# `E2E Tests (shard ${{ matrix.shard_id }}/...)` name.
+# Skips only draft PRs. These suites are mock-LLM (no secrets), so fork PRs run
+# directly, like CI.
 #
-# Env in:  EVENT_NAME (github.event_name), IS_DRAFT, IS_FORK (both may be empty
-#          on non-PR events), NUM_SHARDS.
-# Out:     matrix={"include":[{"shard_id":0,"num_shards":N}, ...]}  (or [] empty)
+# Env in:  EVENT_NAME, IS_DRAFT, NUM_SHARDS.
+# Shared by e2e.yml and e2e-ui.yml (differ in NUM_SHARDS).
 
 set -euo pipefail
 
@@ -21,13 +16,10 @@ skip=false
 if [[ "${IS_DRAFT:-false}" == "true" ]]; then
   skip=true
 fi
-if [[ "$EVENT_NAME" == "pull_request" && "${IS_FORK:-false}" == "true" ]]; then
-  skip=true
-fi
 
 if [[ "$skip" == "true" ]]; then
   echo 'matrix={"include":[]}' >> "$GITHUB_OUTPUT"
-  echo "skip: empty matrix (event=$EVENT_NAME draft=${IS_DRAFT:-} fork=${IS_FORK:-})"
+  echo "skip: empty matrix (event=$EVENT_NAME draft=${IS_DRAFT:-})"
   exit 0
 fi
 

.github/scripts/ci/integration-matrix.sh

@@ -1,14 +1,13 @@
 #!/usr/bin/env bash
 # Emits the integration-test harness matrix as `matrix=<json>` on $GITHUB_OUTPUT.
 #
-# Returns an EMPTY matrix ({"include":[]}) when the run should be skipped:
-#   - draft PRs, or
-#   - a fork's pull_request (no secrets there; forks run via the fork-e2e/**
-#     mirror push instead).
-# An empty matrix yields zero jobs and therefore NO check-runs. This is the
-# whole reason for the indirection (mirrors e2e-shard-matrix.sh): a job-level
-# `if:` skip of a matrixed job would instead leave one check-run with an
-# unexpanded `Integration (${{ matrix.name }})` name.
+# Returns an EMPTY matrix ({"include":[]}) to skip: zero jobs, NO check-runs.
+# This is the whole reason for the indirection (mirrors e2e-shard-matrix.sh): a
+# job-level `if:` skip would instead leave one check-run with an unexpanded
+# `Integration (${{ matrix.name }})` name.
+#
+# Skips only draft PRs. Integration is mock-LLM (no secrets), so fork PRs run
+# directly, like CI -- no fork-e2e/** mirror needed.
 #
 # Single openai-agents leg: all tests now run against the mock LLM server.
 # claude-sdk and codex reject "mock-model" as an unknown model (they validate
@@ -16,8 +15,7 @@
 # only openai-agents works without real credentials. The model name is unused
 # in mock mode (model_name fixture returns "mock-model" regardless).
 #
-# Env in:  EVENT_NAME (github.event_name), IS_DRAFT, IS_FORK (both may be empty
-#          on non-PR events).
+# Env in:  EVENT_NAME (github.event_name), IS_DRAFT.
 # Out:     matrix={"include":[{"name":..,"harness":..,"model":..,"workers":..}, ...]}
 #          (or {"include":[]} when skipped).
 
@@ -27,13 +25,10 @@ skip=false
 if [[ "${IS_DRAFT:-false}" == "true" ]]; then
   skip=true
 fi
-if [[ "$EVENT_NAME" == "pull_request" && "${IS_FORK:-false}" == "true" ]]; then
-  skip=true
-fi
 
 if [[ "$skip" == "true" ]]; then
   echo 'matrix={"include":[]}' >> "$GITHUB_OUTPUT"
-  echo "skip: empty matrix (event=$EVENT_NAME draft=${IS_DRAFT:-} fork=${IS_FORK:-})"
+  echo "skip: empty matrix (event=$EVENT_NAME draft=${IS_DRAFT:-})"
   exit 0
 fi
 

.github/scripts/fork-e2e/should-mirror.sh

@@ -1,78 +0,0 @@
-#!/usr/bin/env bash
-# Decides whether a fork PR's head commit should be mirrored onto the trusted
-# fork-e2e/pr-N branch (which lets e2e run as a `push` with the test-gateway
-# secrets). Called by .github/workflows/fork-e2e-mirror.yml.
-#
-# Gate (either condition opens it):
-#   1. The PR has an approving review from a maintainer (in
-#      .github/MAINTAINER@main), OR
-#   2. The PR carries the `e2e-approved` label applied by a maintainer.
-#
-# Path 1 (approval) is the primary flow: approving the PR both satisfies the
-# merge gate and triggers e2e. Path 2 (label) is a manual escape hatch for
-# running e2e without approving for merge (e.g. early CI validation).
-#
-# New commits while the gate is open re-mirror automatically (this script
-# re-runs on `synchronize`); the security scan plus the maintainer's review
-# are the safety net for post-approval pushes. Revoking approval AND removing
-# the label (or closing the PR) stops future mirrors and cleans up the mirror
-# branch -- see the workflow.
-#
-# Fail closed: any error or unexpected state leaves the gate shut, so secrets
-# never run on an unverified PR.
-#
-# Env in:  GH_TOKEN, REPO, PR,
-#          MAINTAINERS (space-separated, from merge-ready/load-maintainers.sh).
-# Out:     `mirror=true|false` and `reason=<text>` on $GITHUB_OUTPUT.
-
-set -euo pipefail
-
-emit() {
-  echo "mirror=$1" >> "$GITHUB_OUTPUT"
-  echo "reason=$2" >> "$GITHUB_OUTPUT"
-  echo "mirror=$1 ($2)"
-}
-
-MAINTAINERS_LC=$(echo "${MAINTAINERS:-}" | tr '[:upper:]' '[:lower:]')
-
-if [[ -z "${MAINTAINERS_LC// /}" ]]; then
-  emit false "no maintainers loaded (.github/MAINTAINER@main empty/missing)"
-  exit 0
-fi
-
-# --- Path 1: maintainer approval via PR review ---
-
-APPROVERS=$(gh api "repos/$REPO/pulls/$PR/reviews" --paginate \
-  --jq '[.[] | select(.state != "COMMENTED")] | group_by(.user.login) | map(max_by(.submitted_at)) | .[] | select(.state == "APPROVED") | .user.login')
-
-for u in $APPROVERS; do
-  u_lc=$(echo "$u" | tr '[:upper:]' '[:lower:]')
-  for m in $MAINTAINERS_LC; do
-    if [[ "$m" == "$u_lc" ]]; then
-      emit true "approved by maintainer @$u"
-      exit 0
-    fi
-  done
-done
-
-# --- Path 2: e2e-approved label applied by a maintainer ---
-
-LABEL="e2e-approved"
-LABELS=$(gh pr view "$PR" --repo "$REPO" --json labels --jq '.labels[].name')
-if grep -qxF "$LABEL" <<<"$LABELS"; then
-  LABELER=$(gh api "repos/$REPO/issues/$PR/events" --paginate \
-    --jq "[.[] | select(.event == \"labeled\" and .label.name == \"$LABEL\")] | last | .actor.login // empty")
-
-  if [[ -n "$LABELER" ]]; then
-    LABELER_LC=$(echo "$LABELER" | tr '[:upper:]' '[:lower:]')
-    for m in $MAINTAINERS_LC; do
-      if [[ "$m" == "$LABELER_LC" ]]; then
-        emit true "'$LABEL' applied by maintainer @$LABELER"
-        exit 0
-      fi
-    done
-  fi
-fi
-
-# Neither path opened the gate.
-emit false "awaiting approval from a maintainer or '$LABEL' label"

.github/scripts/merge-ready/compute-gate.sh

@@ -2,19 +2,20 @@
 # Single source of truth for the Merge Ready outcome. Downstream steps
 # just consume `state`, `short_desc`, and `long_desc`.
 #
-# The gate is green iff every required check is green on its own merits
-# AND (for fork PRs) a maintainer has approved. There is no CI bypass: to
-# land despite red required checks, fix or delete the failing test, or
-# have a repo admin use GitHub's native "merge without waiting for
-# requirements" affordance.
+# The gate is green iff every required check is green on its own merits. There is
+# no CI bypass: to land despite red required checks, fix or delete the failing
+# test, or have a repo admin use GitHub's native "merge without waiting for
+# requirements" affordance. (Fork PRs still need a maintainer's approving review
+# to merge -- that is enforced by the separate `Maintainer Approval` check, not
+# here. No CI suite needs secrets on a fork PR anymore, so there is no
+# e2e-specific approval gate.)
 #
-#   CI eval  | fork approval | state    | meaning
-#   ---------+---------------+----------+---------------------------------
-#   success  | n/a or true   | success  | CI green on its own merits
-#   success  | false         | failure  | fork PR awaiting maintainer approval
-#   failure  | any           | failure  | CI red
+#   CI eval  | state    | meaning
+#   ---------+----------+----------------------------
+#   success  | success  | all required checks green
+#   failure  | failure  | a required check is red
 #
-# Env in: EVAL, FAILED, FORK_NEEDS_E2E_APPROVAL (optional, default false)
+# Env in: EVAL, FAILED
 # Out:    state, short_desc, long_desc on $GITHUB_OUTPUT
 
 set -euo pipefail
@@ -29,17 +30,6 @@ else
   LONG=$':hourglass: gate not green yet. Required checks not satisfied:\n\n'"$FAILED"$'\nThe merge will fire once these turn green.'
 fi
 
-# Fork PRs never run e2e on their own: the fork `pull_request` run resolves to
-# an empty shard matrix, so the suite only runs once a maintainer approves the
-# PR (which mirrors the head to a trusted fork-e2e/** branch). Without approval
-# the e2e checks are satisfied-via-skip and the PR would go green with e2e never
-# having executed -- so block merge until a maintainer approves.
-if [[ "${FORK_NEEDS_E2E_APPROVAL:-false}" == "true" ]]; then
-  STATE=failure
-  SHORT="Awaiting maintainer approval for e2e"
-  LONG="$LONG"$'\n\n:no_entry: **E2e tests are required for fork PRs.** A maintainer must approve this PR or apply the `e2e-approved` label to trigger the e2e suite. The merge gate will stay red until e2e passes.'
-fi
-
 # GitHub commit-status descriptions max out at 140 chars.
 if [[ ${#SHORT} -gt 140 ]]; then
   SHORT="${SHORT:0:137}..."

.github/scripts/merge-ready/required.sh

@@ -1,10 +1,9 @@
-# Sourced by evaluate-checks.sh. The unit/lint/type-check checks gate every PR.
-# The e2e + e2e-ui suites also gate PRs, but only run with secrets on same-repo
-# PRs (maintainer branches); fork PRs cannot read the LLM_API_KEY /
-# GATEWAY_BASE_URL secrets, so their e2e jobs skip via a workflow fork guard.
-# The e2e and integration check names are therefore in BOTH REQUIRED (a
-# same-repo PR must pass them) and ALLOW_SKIP (a fork PR's skipped check still
-# satisfies the gate).
+# Sourced by evaluate-checks.sh. These checks gate every PR. e2e, e2e-ui, and
+# integration are mock-LLM (no secrets) and run on ALL PRs -- same-repo and fork
+# -- directly, like CI. They are in ALLOW_SKIP too because they are legitimately
+# absent in some runs: draft PRs (empty matrix) and path-ignored PRs (the
+# workflow doesn't run). The real-gateway e2e-ui tests run nightly only and are
+# NOT PR checks, so they are not listed here.
 # Generated file -- do not hand-edit; it is replaced wholesale on every sync.
 
 REQUIRED=(
@@ -22,6 +21,7 @@ REQUIRED=(
   "Pytest (server-rest)"
   "Pytest (spec-llms)"
   "Pytest (misc)"
+  "Pytest (databricks)"
   "E2E Tests (shard 0/4)"
   "E2E Tests (shard 1/4)"
   "E2E Tests (shard 2/4)"
@@ -48,6 +48,7 @@ ALLOW_SKIP=(
   "Pytest (server-rest)"
   "Pytest (spec-llms)"
   "Pytest (misc)"
+  "Pytest (databricks)"
   "E2E Tests (shard 0/4)"
   "E2E Tests (shard 1/4)"
   "E2E Tests (shard 2/4)"
@@ -63,9 +64,9 @@ ALLOW_SKIP=(
 is_allow_skip() { printf '%s\n' "${ALLOW_SKIP[@]}" | grep -qxF "$1"; }
 
 # Maps an ALLOW_SKIP check to the workflow that produces it, so
-# evaluate-checks.sh can tell a genuine skip (a CI Pytest shard path-skip, or
-# the fork guard skipping an e2e job) from a check that is merely absent
-# because its workflow is still queued or re-running.
+# evaluate-checks.sh can tell a genuine skip (a CI Pytest shard path-skip, or a
+# draft/path-ignored run) from a check that is merely absent because its
+# workflow is still queued or re-running.
 workflow_for() {
   case "$1" in
     "Pytest ("*)             echo "CI" ;;

.github/scripts/pr-template/format_body.py

@@ -40,6 +40,12 @@ def format_body(body: str) -> str:
     elif not _has_heading(body, "Summary"):
         body = f"## Summary\n\n{body}"
 
+    body = _append_section(
+        body,
+        "Test Plan",
+        "How was this change tested? Describe the steps, commands, or scenarios "
+        "used to verify it (autoformat added this section — please replace it).",
+    )
     body = _append_section(
         body,
         "ELI5",
@@ -54,9 +60,9 @@ def format_body(body: str) -> str:
     body = _append_section(body, "Test coverage", _checkbox_block(TEST_LABELS))
     body = _append_section(
         body,
-        "Coverage rationale",
-        "Autoformat added this section; please add commands run or explain why "
-        "coverage is sufficient.",
+        "Coverage notes",
+        "<!-- Optional; required if you checked 'Manual verification completed' "
+        "or 'Not applicable' above. -->",
     )
     return body.rstrip() + "\n"
 

.github/scripts/pr-template/validate.py

@@ -14,9 +14,9 @@ import sys
 
 REQUIRED_HEADINGS = (
     "Summary",
+    "Test Plan",
     "Type of change",
     "Test coverage",
-    "Coverage rationale",
 )
 
 TYPE_LABELS = (
@@ -40,10 +40,8 @@ TEST_LABELS = (
 PLACEHOLDER_FRAGMENTS = (
     "what changed and why",
     "check all that apply",
-    "describe the exact commands",
     "describe below",
-    "explain why",
-    "if you did not add or run tests",
+    "how was this change tested",
 )
 
 
@@ -121,6 +119,12 @@ def validate_pr_body(body: str) -> ValidationResult:
     elif _contains_placeholder(summary):
         errors.append("Summary still contains template placeholder text.")
 
+    test_plan = _meaningful_text(_section(body, spans, "Test Plan"))
+    if not test_plan:
+        errors.append("Test Plan must describe how the change was tested.")
+    elif _contains_placeholder(test_plan):
+        errors.append("Test Plan still contains template placeholder text.")
+
     type_section = _section(body, spans, "Type of change")
     missing_type_labels = _missing_labels(type_section, TYPE_LABELS)
     if missing_type_labels:
@@ -141,31 +145,19 @@ def validate_pr_body(body: str) -> ValidationResult:
     if not checked_tests:
         errors.append("Check at least one Test coverage checkbox.")
 
-    rationale = _meaningful_text(_section(body, spans, "Coverage rationale"))
-    if not rationale:
-        errors.append(
-            "Coverage rationale must explain tests run/added, or why more coverage is not needed."
-        )
-    elif _contains_placeholder(rationale):
-        errors.append("Coverage rationale still contains template placeholder text.")
-
-    automated_tests = {
-        "Unit tests added / updated",
-        "Integration tests added / updated",
-        "E2E tests added / updated",
-        "Existing tests cover this change",
-    }
-    if checked_tests and checked_tests.isdisjoint(automated_tests):
-        if len(rationale.split()) < 8:
+    # Coverage notes are optional in general, but required whenever "Manual
+    # verification completed" or "Not applicable" is checked — those choices
+    # need a written justification.
+    if checked_tests & {"Manual verification completed", "Not applicable"}:
+        coverage_notes = _meaningful_text(_section(body, spans, "Coverage notes"))
+        if not coverage_notes:
             errors.append(
-                "When no automated test coverage checkbox is selected, "
-                "the rationale must explain why."
+                "Coverage notes are required when 'Manual verification completed' or "
+                "'Not applicable' is selected — describe what you verified or why "
+                "automated coverage is not needed."
             )
-
-    if "Not applicable" in checked_tests and rationale and len(rationale.split()) < 8:
-        errors.append(
-            "Not applicable test coverage requires a concrete explanation in Coverage rationale."
-        )
+        elif _contains_placeholder(coverage_notes):
+            errors.append("Coverage notes still contains template placeholder text.")
 
     return ValidationResult(ok=not errors, errors=errors)
 

.github/scripts/security-scan/exfil-scan.py

@@ -4,9 +4,8 @@
 Part of the single contributor Security Scan (.github/workflows/security-scan.yml),
 the companion to secret-scan.py: that one flags secrets a PR *commits*, this one
 flags code a PR adds to *steal* the CI secrets it runs with (the test-gateway
-token, GITHUB_TOKEN). It is the detector the fork-e2e mirror relied on before the
-scan was unified -- the mirror runs contributor code with the gateway secret, so
-an env-secret read piped to the network is the shape that matters there.
+token, GITHUB_TOKEN) -- an env-secret read piped to the network is the shape that
+matters.
 
 It reads diff TEXT only -- it never checks out or executes the PR's code -- so it
 is safe on any event. It is defense-in-depth + a reviewer aid, NOT a guarantee:

.github/scripts/security-scan/should-scan.sh

@@ -12,10 +12,8 @@
 # does not vouch for the contents of this one) and first-timers
 # (FIRST_TIME_CONTRIBUTOR / NONE).
 #
-# This gate is independent of fork-e2e/should-mirror.sh: that one gates secret-
-# bearing e2e on a maintainer's approving PR review, whereas this gate
-# decides whether to inspect for attacks and so errs toward scanning more (it
-# scans returning CONTRIBUTORs that the label gate would not by itself run).
+# This gate decides whether to inspect a PR for attacks and errs toward scanning
+# more (it scans returning CONTRIBUTORs, not just first-timers).
 #
 # author_association is computed by GitHub from the actor's relationship to the
 # repo at event time; it is not attacker-settable from PR contents.
@@ -70,9 +68,8 @@ has_skip_label() {
 }
 
 # Only PRs carry untrusted contributor code through the gate. Every other
-# trigger -- push to main / fork-e2e/** (the mirror branch only exists after a
-# returning-contributor / maintainer-approval gate), schedule, dispatch -- is a
-# trusted context, so proceed without scanning. pull_request_review is still
+# trigger -- push to main, schedule, dispatch -- is a trusted context, so
+# proceed without scanning. pull_request_review is still
 # accepted (it carries the same pull_request + author_association fields, so the
 # gate evaluates identically) in case a workflow_call caller is wired to it, but
 # no workflow triggers a scan on review any more: the skip-security-scan waiver

.github/workflows/auto-assign-reviewer.test.js

@@ -71,10 +71,10 @@ function assert(name, cond, detail) {
   r = await run({
     files: ["README.md"],
     load: { PattaraS: 9, "serena-ruan": 9, dhruv0811: 9, TomeHirata: 9, SabhyaC26: 9,
-            "daniellok-db": 9, hzub: 0, dbczumar: 1, fanzeyi: 9, "ckcuslife-source": 9,
+            "daniellok-db": 9, dbczumar: 0, fanzeyi: 9, "ckcuslife-source": 9,
             bbqiu: 9, Edwinhe03: 9 },
   });
-  assert("unowned -> lowest from full pool", JSON.stringify(r.added) === JSON.stringify(["hzub"]), JSON.stringify(r));
+  assert("unowned -> lowest from full pool", JSON.stringify(r.added) === JSON.stringify(["dbczumar"]), JSON.stringify(r));
 
   // 3. db area (fanzeyi, SabhyaC26) -> the lower-load one selected.
   r = await run({ files: ["omnigent/db/x.py"], load: { SabhyaC26: 1 } });

.github/workflows/ci.yml

@@ -112,6 +112,14 @@ jobs:
               --ignore=tests/spec
               --ignore=tests/llms
               --ignore=tests/codex_parity
+          # Databricks-coupled tests (Lakebase token engine, psycopg). This is
+          # the only lane that installs the `databricks` extra; the
+          # @pytest.mark.databricks marker keeps these tests off the lean lanes
+          # (which run -m "not databricks") and selects them here.
+          - group: databricks
+            paths: tests/db tests/deploy
+            extra: databricks
+            markexpr: databricks
 
     steps:
       - name: Check out repo
@@ -144,7 +152,9 @@ jobs:
           key: venv-${{ runner.os }}-${{ hashFiles('.python-version') }}-${{ hashFiles('uv.lock') }}
 
       - name: Install dependencies
-        run: uv sync --locked --extra all --extra dev
+        # matrix.extra (e.g. "databricks") adds an extra for lanes that need it;
+        # empty for the default lanes.
+        run: uv sync --locked --extra all --extra dev ${{ matrix.extra && format('--extra {0}', matrix.extra) || '' }}
 
       - name: Run pytest
         shell: bash
@@ -165,6 +175,7 @@ jobs:
           # shellcheck disable=SC2086
           env -u OPENAI_API_KEY -u ANTHROPIC_API_KEY -u DATABRICKS_TOKEN \
             uv run pytest ${{ matrix.paths }} \
+              -m "${{ matrix.markexpr || 'not databricks' }}" \
               -n ${{ matrix.workers || '8' }} \
               --dist=${{ matrix.dist || 'loadfile' }} \
               --timeout=${{ matrix.timeout || '300' }} \

.github/workflows/e2e-ui.yml

@@ -1,14 +1,14 @@
 name: E2E UI Tests
 
-# Runs the Playwright UI suite against a freshly built ap-web SPA + a
-# hello_world test agent, split across a 3-shard matrix. Separate from
-# nightly.yml because the Node + Playwright + SPA-build setup is disjoint
-# from the inner-only legs.
+# Runs the Playwright UI suite against a freshly built ap-web SPA, split across
+# a 3-shard matrix. The whole suite (including the native Claude/Codex/Cursor
+# render-parity tests) runs against the in-process mock LLM and needs NO
+# secrets, so it runs on ALL PRs -- same-repo AND fork -- directly, like ci.yml.
+# (The native_*_mock_session fixtures use the real gateway only when LLM_API_KEY
+# is set, e.g. local dev; CI never sets it.)
 #
 # Triggers:
-#   pull_request        SAME-REPO PRs only; draft / fork PRs skip the job
-#                       (forks run via the fork-e2e/** push after approval).
-#   push (fork-e2e/**)  UI suite for mirrored fork PRs (trusted, secrets flow).
+#   pull_request        ALL PRs (same-repo + fork). Draft PRs skip.
 #   schedule            09:00 UTC daily, alongside nightly.yml.
 #   workflow_dispatch   manual run. Input `branch` selects a non-main ref.
 
@@ -18,9 +18,6 @@ on:
     # Security Gate via rerun-security-gate.yml, so label churn need not re-run
     # the heavy Playwright suite. (#399 added these for the gate; superseded.)
     types: [opened, synchronize, reopened, ready_for_review]
-  push:
-    branches:
-      - 'fork-e2e/**'
   schedule:
     - cron: "0 9 * * *"
   workflow_dispatch:
@@ -88,14 +85,13 @@ jobs:
         env:
           EVENT_NAME: ${{ github.event_name }}
           IS_DRAFT: ${{ github.event.pull_request.draft }}
-          IS_FORK: ${{ github.event.pull_request.head.repo.fork }}
           NUM_SHARDS: "3"
         run: bash .github/scripts/ci/e2e-shard-matrix.sh
 
   e2e-ui:
     name: E2E UI Tests (shard ${{ matrix.shard_id }}/${{ matrix.num_shards }})
-    # Draft / fork pull_request events resolve to an EMPTY matrix in `setup`
-    # (forks run via the fork-e2e/** mirror push), so no shard runs for them.
+    # Draft PRs resolve to an EMPTY matrix in `setup`, so no shard runs for
+    # them. Fork PRs DO run (mock LLM, no secrets) -- same as ci.yml.
     # `ready_for_review` re-fires when a draft is converted.
     needs: setup
     runs-on: ubuntu-latest
@@ -317,40 +313,3 @@ jobs:
               echo "- 📜 server.log: _no artifact uploaded (glob matched nothing)_"
             fi
           } >> "$GITHUB_STEP_SUMMARY"
-
-  # Explicitly re-dispatch Merge Ready (same-repo PR or fork-e2e push): the
-  # workflow_run hop is brittle and was dropped on #751/#792. No checkout,
-  # actions:write only; GITHUB_TOKEN workflow_dispatch is exempt from recursion.
-  merge-ready-rerun:
-    name: Merge Ready rerun
-    needs: e2e-ui
-    if: >-
-      always()
-      && needs.e2e-ui.result != 'skipped'
-      && (
-        (github.event_name == 'pull_request'
-          && github.event.pull_request.head.repo.full_name == github.repository)
-        || (github.event_name == 'push'
-          && startsWith(github.ref_name, 'fork-e2e/pr-'))
-      )
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      actions: write
-    env:
-      GH_TOKEN: ${{ github.token }}
-      REPO: ${{ github.repository }}
-      REF_NAME: ${{ github.ref_name }}
-      PR_NUMBER: ${{ github.event.pull_request.number }}
-    steps:
-      - name: Re-dispatch Merge Ready
-        run: |
-          set -euo pipefail
-          # same-repo PR -> event number; fork-e2e push -> parse fork-e2e/pr-<N>
-          PR="${PR_NUMBER:-${REF_NAME##*/pr-}}"
-          if ! [[ "$PR" =~ ^[0-9]+$ ]]; then
-            echo "::notice::could not resolve PR number (ref='$REF_NAME'); nothing to do."
-            exit 0
-          fi
-          echo "Re-dispatching merge-ready.yml for PR #$PR after $GITHUB_WORKFLOW."
-          gh workflow run merge-ready.yml --repo "$REPO" -f pr="$PR"

.github/workflows/e2e.yml

@@ -8,13 +8,12 @@ name: E2E Tests
 #   schedule            09:00 UTC daily (alongside nightly.yml).
 #   workflow_dispatch   manual run. Inputs: `branch` (non-main ref) and
 #                       `parallelism` (pytest `-n` worker count).
-#   pull_request        PR gate for SAME-REPO PRs only. Fork PRs skip
-#                       here (no secrets) and run via the fork-e2e/**
-#                       push after a maintainer approves the PR and
-#                       fork-e2e-mirror.yml mirrors them. The four shard
-#                       checks are required by merge-ready.yml.
-#   push (fork-e2e/**)  e2e run for mirrored fork PRs (trusted branch,
-#                       so secrets flow).
+#   pull_request        PR gate for ALL PRs -- same-repo AND fork. This suite
+#                       runs entirely against the in-process mock LLM (no
+#                       secrets), so fork PRs run it directly here just like
+#                       ci.yml, with no fork-e2e/** mirror (#802 removed the
+#                       credential setup). The four shard checks are required by
+#                       merge-ready.yml.
 
 on:
   schedule:
@@ -22,10 +21,6 @@ on:
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled]
     paths-ignore: ['ap-web/**', 'tests/e2e_ui/**']
-  push:
-    branches:
-      - 'fork-e2e/**'
-    paths-ignore: ['ap-web/**', 'tests/e2e_ui/**']
   workflow_dispatch:
     inputs:
       branch:
@@ -38,8 +33,8 @@ on:
         default: "2"
 
 concurrency:
-  # PRs key by number, dispatch by branch (so re-runs cancel); push /
-  # schedule key by SHA so each merge to `main` gets its own run.
+  # PRs key by number, dispatch by branch (so re-runs cancel); schedule keys
+  # by SHA so each merge to `main` gets its own run.
   group: e2e-${{ github.workflow }}-${{ github.event.pull_request.number || github.event.inputs.branch || github.sha }}
   cancel-in-progress: true
 
@@ -62,9 +57,8 @@ jobs:
   gate:
     uses: ./.github/workflows/security-gate.yml
 
-  # Compute the shard matrix once. A skipped run (draft / fork pull_request)
-  # yields an EMPTY matrix -> zero shard jobs -> no skipped placeholder check.
-  # Shared with e2e-ui.yml via e2e-shard-matrix.sh (only NUM_SHARDS differs).
+  # Shard matrix (e2e-shard-matrix.sh, shared with e2e-ui.yml). Fork PRs run by
+  # default; draft PRs resolve to an empty matrix.
   setup:
     name: setup
     needs: gate
@@ -85,7 +79,6 @@ jobs:
         env:
           EVENT_NAME: ${{ github.event_name }}
           IS_DRAFT: ${{ github.event.pull_request.draft }}
-          IS_FORK: ${{ github.event.pull_request.head.repo.fork }}
           NUM_SHARDS: "4"
         run: bash .github/scripts/ci/e2e-shard-matrix.sh
 
@@ -96,8 +89,8 @@ jobs:
     # -n 2 per shard => 4 x 2 = 8 concurrent gateway calls, below the
     # nightly's 429 pain point; drop -n before max-parallel if rate-limited.
     name: E2E Tests (shard ${{ matrix.shard_id }}/${{ matrix.num_shards }})
-    # Draft / fork pull_request events resolve to an EMPTY matrix in `setup`
-    # (forks run via the fork-e2e/** mirror push), so no shard runs for them.
+    # Draft PRs resolve to an EMPTY matrix in `setup`, so no shard runs for
+    # them. Fork PRs DO run (mock LLM, no secrets) -- same as ci.yml.
     needs: setup
     runs-on: ubuntu-latest
     # Job-level cap (composite-action run steps can't set timeout-minutes):
@@ -114,9 +107,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
-          # Same-repo PRs test the merge result (refs/pull/N/merge -- absent
-          # when the PR conflicts, so a conflicted PR fails checkout by design).
-          # Push (fork-e2e/**) and dispatch fall back to the branch / ref.
+          # PRs (same-repo and fork) test the merge result (refs/pull/N/merge --
+          # absent when the PR conflicts, so a conflicted PR fails checkout by
+          # design). Schedule / dispatch fall back to the branch / ref.
           ref: ${{ github.event.pull_request.number && format('refs/pull/{0}/merge', github.event.pull_request.number) || github.event.inputs.branch || github.ref }}
 
       # Steps below are shared verbatim with server-compat.yml's backcompat-e2e
@@ -129,40 +122,3 @@ jobs:
           num_shards: ${{ matrix.num_shards }}
           parallelism: ${{ github.event.inputs.parallelism || '2' }}
           nightly_full: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
-
-  # Explicitly re-dispatch Merge Ready (same-repo PR or fork-e2e push): the
-  # workflow_run hop is brittle and was dropped on #751/#792. No checkout,
-  # actions:write only; GITHUB_TOKEN workflow_dispatch is exempt from recursion.
-  merge-ready-rerun:
-    name: Merge Ready rerun
-    needs: e2e
-    if: >-
-      always()
-      && needs.e2e.result != 'skipped'
-      && (
-        (github.event_name == 'pull_request'
-          && github.event.pull_request.head.repo.full_name == github.repository)
-        || (github.event_name == 'push'
-          && startsWith(github.ref_name, 'fork-e2e/pr-'))
-      )
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      actions: write
-    env:
-      GH_TOKEN: ${{ github.token }}
-      REPO: ${{ github.repository }}
-      REF_NAME: ${{ github.ref_name }}
-      PR_NUMBER: ${{ github.event.pull_request.number }}
-    steps:
-      - name: Re-dispatch Merge Ready
-        run: |
-          set -euo pipefail
-          # same-repo PR -> event number; fork-e2e push -> parse fork-e2e/pr-<N>
-          PR="${PR_NUMBER:-${REF_NAME##*/pr-}}"
-          if ! [[ "$PR" =~ ^[0-9]+$ ]]; then
-            echo "::notice::could not resolve PR number (ref='$REF_NAME'); nothing to do."
-            exit 0
-          fi
-          echo "Re-dispatching merge-ready.yml for PR #$PR after $GITHUB_WORKFLOW."
-          gh workflow run merge-ready.yml --repo "$REPO" -f pr="$PR"

.github/workflows/fork-e2e-mirror.yml

@@ -1,227 +0,0 @@
-name: Fork e2e mirror
-
-# Mirrors a gated fork PR's head onto a trusted fork-e2e/pr-N branch so e2e runs
-# there as a `push` (with secrets). It's a pure git-ref update via a GitHub App
-# token (refs pushed by the default GITHUB_TOKEN don't trigger workflows); it
-# never checks out or runs fork code. Mirroring requires BOTH the contributor
-# Security Scan to pass (the blocking `gate` job, via security-gate.yml) AND a
-# maintainer's approving PR review (should-mirror.sh).
-#
-# Maintainer approval is the sole human gate for running secret-bearing e2e on a
-# fork PR. Only users with write access can submit approving reviews, and the
-# gate further verifies the approver is in .github/MAINTAINER, so an external
-# fork author can never open it. It is intentionally tied to the merge gate
-# (maintainer-approval.yml): approving the PR runs e2e AND approves for merge.
-# Requesting changes or dismissing the review stops future mirrors; closing the
-# PR tears down the mirror branch.
-#
-# Triggers:
-#   pull_request_target   opened/synchronize/reopened/closed — handles new
-#                         pushes and PR lifecycle. Reviews don't fire
-#                         pull_request_target, so approval reaches here via
-#                         workflow_dispatch (dispatched by
-#                         maintainer-approval-rerun-run.yml on approval).
-#   workflow_dispatch     re-evaluation of a single PR (used by the approval
-#                         relay and for manual re-runs). Safe because
-#                         should-mirror.sh always re-checks approval before
-#                         any secret-bearing run; a spurious dispatch with an
-#                         arbitrary PR number cannot trigger e2e.
-#
-# leak-scan-allow: pull_request_target
-on:
-  pull_request_target:
-    # labeled/unlabeled so applying or removing `e2e-approved` opens or tears
-    # down the mirror immediately, not only on the PR's next push.
-    types: [opened, synchronize, reopened, closed, labeled, unlabeled]
-
-  workflow_dispatch:
-    inputs:
-      pr:
-        description: PR number to evaluate for mirroring.
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-concurrency:
-  group: fork-e2e-mirror-${{ github.event.pull_request.number || inputs.pr }}
-  cancel-in-progress: false
-
-jobs:
-  # Delete the trusted mirror branch when the PR closes or the gate label is
-  # removed. Ungated -- cleanup must always run so a closed PR (or one whose
-  # label was removed) never leaves a stale fork-e2e/pr-N branch behind.
-  # Note: approval revocation cleanup is handled by the mirror job's
-  # "Delete stale mirror branch on revocation" step (workflow_dispatch path).
-  cleanup:
-    name: cleanup
-    if: >-
-      github.event_name == 'pull_request_target'
-      && github.event.pull_request.head.repo.fork
-      && (
-        github.event.action == 'closed'
-        || (github.event.action == 'unlabeled' && github.event.label.name == 'e2e-approved')
-      )
-    permissions:
-      contents: read
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    env:
-      REPO: ${{ github.repository }}
-      MIRROR_BRANCH: fork-e2e/pr-${{ github.event.pull_request.number }}
-    steps:
-      - name: Mint mirror App token
-        id: app-token
-        # App token, not GITHUB_TOKEN: its pushes DO trigger the downstream e2e.
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
-        with:
-          app-id: ${{ vars.FORK_E2E_APP_ID }}
-          private-key: ${{ secrets.FORK_E2E_APP_PRIVATE_KEY }}
-
-      - name: Delete mirror branch
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: |
-          gh api -X DELETE "repos/$REPO/git/refs/heads/$MIRROR_BRANCH" >/dev/null 2>&1 \
-            && echo "Deleted $MIRROR_BRANCH" || echo "No $MIRROR_BRANCH to delete"
-
-  # The single contributor Security Scan, consulted as a BLOCKING gate before we
-  # mirror fork code onto a trusted branch where e2e runs WITH the gateway secret.
-  # The scan itself runs once on the PR (security-scan.yml); this poller mirrors
-  # its result, blocking the mirror on a finding. Skipped on the teardown action
-  # (handled by `cleanup`).
-  gate:
-    name: security gate
-    if: >-
-      (
-        github.event_name == 'workflow_dispatch'
-      ) || (
-        github.event_name == 'pull_request_target'
-        && github.event.pull_request.head.repo.fork
-        && github.event.action != 'closed'
-        && github.event.action != 'unlabeled'
-        && (github.event.action != 'labeled' || github.event.label.name == 'e2e-approved')
-      )
-    uses: ./.github/workflows/security-gate.yml
-
-  mirror:
-    name: mirror
-    needs: gate
-    # Fork PRs only -- same-repo PRs run e2e directly via `pull_request`.
-    # workflow_dispatch is validated at the step level (verify fork before
-    # mirroring) but runs the gate unconditionally to keep the flow simple.
-    if: >-
-      (
-        github.event_name == 'workflow_dispatch'
-      ) || (
-        github.event_name == 'pull_request_target'
-        && github.event.pull_request.head.repo.fork
-        && github.event.action != 'closed'
-        && github.event.action != 'unlabeled'
-        && (github.event.action != 'labeled' || github.event.label.name == 'e2e-approved')
-      )
-    permissions:
-      contents: read
-      pull-requests: read
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    env:
-      GH_TOKEN: ${{ github.token }}
-      REPO: ${{ github.repository }}
-      PR: ${{ github.event.pull_request.number || inputs.pr }}
-    steps:
-      - name: Resolve PR context
-        id: ctx
-        run: |
-          if [[ -n "${{ github.event.pull_request.head.sha || '' }}" ]]; then
-            echo "sha=${{ github.event.pull_request.head.sha }}" >> "$GITHUB_OUTPUT"
-            echo "is_fork=true" >> "$GITHUB_OUTPUT"
-          else
-            # workflow_dispatch: resolve from the PR object.
-            INFO=$(gh pr view "$PR" --repo "$REPO" --json headRefOid,isCrossRepository)
-            SHA=$(echo "$INFO" | jq -r '.headRefOid')
-            IS_FORK=$(echo "$INFO" | jq -r '.isCrossRepository')
-            echo "sha=$SHA" >> "$GITHUB_OUTPUT"
-            echo "is_fork=$IS_FORK" >> "$GITHUB_OUTPUT"
-            if [[ "$IS_FORK" != "true" ]]; then
-              echo "::notice::PR #$PR is same-repo; skipping mirror (same-repo PRs run e2e directly)."
-            fi
-          fi
-
-      - name: Check out gate scripts from main
-        if: steps.ctx.outputs.is_fork == 'true'
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-        with:
-          ref: main             # trusted; never the PR head
-          sparse-checkout: .github/scripts
-          persist-credentials: false
-
-      - name: Mint mirror App token
-        if: steps.ctx.outputs.is_fork == 'true'
-        id: app-token
-        # App token, not GITHUB_TOKEN: its pushes DO trigger the downstream e2e.
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
-        with:
-          app-id: ${{ vars.FORK_E2E_APP_ID }}
-          private-key: ${{ secrets.FORK_E2E_APP_PRIVATE_KEY }}
-
-      # MAINTAINER@main, never the PR head: the gate verifies the *approver* is a
-      # maintainer, so a PR can't self-grant by editing its own MAINTAINER copy.
-      - name: Load maintainers
-        if: steps.ctx.outputs.is_fork == 'true'
-        id: maintainers
-        run: bash .github/scripts/merge-ready/load-maintainers.sh
-
-      - name: Evaluate mirror gate
-        if: steps.ctx.outputs.is_fork == 'true'
-        id: gate
-        env:
-          MAINTAINERS: ${{ steps.maintainers.outputs.list }}
-        run: bash .github/scripts/fork-e2e/should-mirror.sh
-
-      - name: Mirror head SHA onto trusted branch
-        if: steps.ctx.outputs.is_fork == 'true' && steps.gate.outputs.mirror == 'true'
-        env:
-          TOKEN: ${{ steps.app-token.outputs.token }}
-          HEAD_SHA: ${{ steps.ctx.outputs.sha }}
-          MIRROR_BRANCH: fork-e2e/pr-${{ env.PR }}
-        run: |
-          set -euo pipefail
-          # Move git OBJECTS, don't just point a ref. A fork PR's head commit
-          # reaches the base repo only through the shared fork network (the
-          # `refs/pull/N/head` pull ref); the Git Data refs API refuses to
-          # anchor a NEW branch to a commit the base repo doesn't own, returning
-          # `422 Reference does not exist`. Fetching the pull ref into a scratch
-          # repo and pushing the SHA materializes the object in the base repo so
-          # the ref is valid -- and the App-token push is what triggers the
-          # downstream e2e (a GITHUB_TOKEN push would not). No working tree is
-          # checked out and no fork code runs in this privileged job; only git
-          # objects move. `push -f` covers both first create and re-sync.
-          work="$(mktemp -d)"
-          git -C "$work" init -q
-          origin="https://x-access-token:${TOKEN}@github.com/${REPO}.git"
-          git -C "$work" fetch -q --no-tags "$origin" "refs/pull/${PR}/head"
-          got="$(git -C "$work" rev-parse FETCH_HEAD)"
-          # Mirror EXACTLY the SHA the security scan gated: if the fork raced a
-          # new push after approval, the pull ref would carry an unscanned
-          # commit -- refuse rather than run secret-bearing e2e on it.
-          if [ "$got" != "$HEAD_SHA" ]; then
-            echo "::error::pull/$PR/head is $got but the approved head is $HEAD_SHA; refusing to mirror." >&2
-            exit 1
-          fi
-          git -C "$work" push -q -f "$origin" "${HEAD_SHA}:refs/heads/${MIRROR_BRANCH}"
-          echo "Mirrored $MIRROR_BRANCH -> $HEAD_SHA"
-
-      # Tear down the mirror branch when approval is revoked (review dismissed
-      # or changes requested). Without this, a stale fork-e2e/pr-N branch
-      # would remain until the next push or PR close.
-      - name: Delete stale mirror branch on revocation
-        if: steps.ctx.outputs.is_fork == 'true' && steps.gate.outputs.mirror == 'false'
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          MIRROR_BRANCH: fork-e2e/pr-${{ env.PR }}
-        run: |
-          gh api -X DELETE "repos/$REPO/git/refs/heads/$MIRROR_BRANCH" >/dev/null 2>&1 \
-            && echo "Deleted stale $MIRROR_BRANCH (approval revoked)" \
-            || echo "No $MIRROR_BRANCH to delete"

.github/workflows/integration.yml

@@ -3,9 +3,10 @@ name: Integration Tests
 # Per-PR journey-suite matrix (tests/integration/), once per wrapped harness
 # using the mock LLM server (no real gateway credentials required). All tests
 # are mock_only: they script the LLM responses via configure_mock_llm and run
-# against a local mock FastAPI server. Triggers: daily schedule, same-repo PR
-# gate (fork PRs skip and run via the fork-e2e/** push after
-# fork-e2e-mirror.yml), the fork-e2e/** push itself, and workflow_dispatch.
+# against a local mock FastAPI server. Because it uses NO secrets, it runs on
+# ALL PRs -- same-repo AND fork -- directly via `pull_request`, like ci.yml; no
+# fork-e2e/** mirror needed. Triggers: daily schedule, the PR gate, and
+# workflow_dispatch.
 
 on:
   schedule:
@@ -16,10 +17,6 @@ on:
     # the heavy integration suite. (#399 added these for the gate; superseded.)
     types: [opened, synchronize, reopened, ready_for_review]
     paths-ignore: ['ap-web/**']
-  push:
-    branches:
-      - 'fork-e2e/**'
-    paths-ignore: ['ap-web/**']
   workflow_dispatch:
 
 permissions:
@@ -47,11 +44,8 @@ jobs:
   gate:
     uses: ./.github/workflows/security-gate.yml
 
-  # Compute the harness matrix once. A skipped run (draft, or a fork's
-  # pull_request) yields an EMPTY matrix -> zero jobs -> no skipped check-runs
-  # with an unexpanded `Integration (${{ matrix.name }})` name. Mirrors the
-  # e2e.yml / e2e-ui.yml setup-job pattern via
-  # .github/scripts/ci/integration-matrix.sh.
+  # Harness matrix (integration-matrix.sh). Fork PRs run by default; draft PRs
+  # resolve to an empty matrix.
   setup:
     name: setup
     needs: gate
@@ -74,14 +68,13 @@ jobs:
         env:
           EVENT_NAME: ${{ github.event_name }}
           IS_DRAFT: ${{ github.event.pull_request.draft }}
-          IS_FORK: ${{ github.event.pull_request.head.repo.fork }}
         run: bash .github/scripts/ci/integration-matrix.sh
 
   integration:
     name: Integration (${{ matrix.name }})
-    # Draft PRs and fork pull_request events resolve to an EMPTY matrix in
-    # `setup` (forks run via the fork-e2e/** mirror push instead), so this job
-    # produces zero leg runs for them -- and thus no skipped placeholder check.
+    # Draft PRs resolve to an EMPTY matrix in `setup`, so this job produces zero
+    # leg runs (and thus no skipped placeholder check). Fork PRs DO run (mock
+    # LLM, no secrets) -- same as ci.yml.
     needs: setup
     runs-on: ubuntu-latest
     # Per-leg ceiling; inner test step caps at 25 min, rest covers install +
@@ -111,40 +104,3 @@ jobs:
           harness: ${{ matrix.harness }}
           model: ${{ matrix.model }}
           workers: ${{ matrix.workers }}
-
-  # Explicitly re-dispatch Merge Ready (same-repo PR or fork-e2e push): the
-  # workflow_run hop is brittle and was dropped on #751/#792. No checkout,
-  # actions:write only; GITHUB_TOKEN workflow_dispatch is exempt from recursion.
-  merge-ready-rerun:
-    name: Merge Ready rerun
-    needs: integration
-    if: >-
-      always()
-      && needs.integration.result != 'skipped'
-      && (
-        (github.event_name == 'pull_request'
-          && github.event.pull_request.head.repo.full_name == github.repository)
-        || (github.event_name == 'push'
-          && startsWith(github.ref_name, 'fork-e2e/pr-'))
-      )
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      actions: write
-    env:
-      GH_TOKEN: ${{ github.token }}
-      REPO: ${{ github.repository }}
-      REF_NAME: ${{ github.ref_name }}
-      PR_NUMBER: ${{ github.event.pull_request.number }}
-    steps:
-      - name: Re-dispatch Merge Ready
-        run: |
-          set -euo pipefail
-          # same-repo PR -> event number; fork-e2e push -> parse fork-e2e/pr-<N>
-          PR="${PR_NUMBER:-${REF_NAME##*/pr-}}"
-          if ! [[ "$PR" =~ ^[0-9]+$ ]]; then
-            echo "::notice::could not resolve PR number (ref='$REF_NAME'); nothing to do."
-            exit 0
-          fi
-          echo "Re-dispatching merge-ready.yml for PR #$PR after $GITHUB_WORKFLOW."
-          gh workflow run merge-ready.yml --repo "$REPO" -f pr="$PR"

.github/workflows/maintainer-approval-rerun-run.yml

@@ -80,30 +80,3 @@ jobs:
               core.info(`Re-running Maintainer Approval run ${run_id} for PR #${pull_number}`);
               await github.rest.actions.reRunWorkflowFailedJobs({ owner, repo, run_id: Number(run_id) });
             }
-
-      # Fork PRs: maintainer approval also gates e2e (replacing the old
-      # e2e-approved label). Dispatch the fork-e2e-mirror workflow so the
-      # approval triggers e2e on the trusted mirror branch.
-      - name: Dispatch fork e2e mirror for fork PRs
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const fs = require('fs');
-            const { owner, repo } = context.repo;
-            if (!fs.existsSync('pr_number')) {
-              core.info('No pr_number file; nothing to do.');
-              return;
-            }
-            const pull_number = Number(fs.readFileSync('pr_number', 'utf8').trim());
-            const { data: pr } = await github.rest.pulls.get({ owner, repo, pull_number });
-            if (!pr.head.repo || pr.head.repo.full_name === `${owner}/${repo}`) {
-              core.info(`PR #${pull_number} is same-repo; skipping fork-e2e-mirror dispatch.`);
-              return;
-            }
-            core.info(`PR #${pull_number} is a fork PR; dispatching fork-e2e-mirror.`);
-            await github.rest.actions.createWorkflowDispatch({
-              owner, repo,
-              workflow_id: 'fork-e2e-mirror.yml',
-              ref: 'main',
-              inputs: { pr: String(pull_number) },
-            });

.github/workflows/maintainer-approval-rerun.yml

@@ -21,8 +21,7 @@ concurrency:
 jobs:
   record:
     # Approvals flip the check green; dismissals and changes-requested flip
-    # it red and revoke the fork-e2e mirror. Skip COMMENTED reviews (they
-    # don't change review state).
+    # it red. Skip COMMENTED reviews (they don't change review state).
     if: github.event.review.state != 'commented'
     runs-on: ubuntu-latest
     timeout-minutes: 5

.github/workflows/merge-ready.yml

@@ -4,12 +4,11 @@ name: Merge Ready
 # required branch-protection check, backed by the REQUIRED list inside
 # this workflow. Triggers: `/merge` comment (write-access commenter only),
 # `pull_request_target` labeled (acts only with `automerge`),
-# `workflow_run` on same-repo CI completion, `check_suite` completion on a
-# `fork-e2e/**` branch (the mirrored fork PR e2e -- a delivery that actually
-# fires, unlike the brittle fork-PR `workflow_run` hop it replaces), and
-# `workflow_dispatch` (programmatic/manual re-evaluation of one PR). Posted
-# via the REST API (not the job's implicit check run) so the status lands on
-# the PR head SHA, since these jobs run on the default branch.
+# `workflow_run` on CI completion (same-repo and fork PRs -- ctx resolves the
+# PR from the head SHA), and `workflow_dispatch` (programmatic/manual
+# re-evaluation of one PR). Posted via the REST API (not the job's implicit
+# check run) so the status lands on the PR head SHA, since these jobs run on
+# the default branch.
 #
 # Labels:
 #   automerge    enable GitHub auto-merge (one-shot on label add) + opt
@@ -21,8 +20,8 @@ name: Merge Ready
 # (branch protection has enforce_admins=false).
 
 on:
-  # `labeled` only; `workflow_run` re-evaluates on CI completion (same-repo PRs
-  # and the fork-e2e/** mirror push -- see the job `if`).
+  # `labeled` only; `workflow_run` re-evaluates on CI completion for all PRs
+  # (same-repo and fork -- ctx resolves the PR from the head SHA).
   # pull_request_target (not pull_request) so this workflow always runs from
   # main -- a PR cannot modify the gate logic by editing this file.
   pull_request_target:
@@ -30,14 +29,9 @@ on:
   workflow_run:
     workflows: [PR Template, CI, Lint, E2E UI Tests, E2E Tests, Integration Tests]
     types: [completed]
-  # check_suite is a fork-PR fallback (workflow_run on the fork-e2e/** push is
-  # primary); ctx maps the head SHA back to the open PR.
-  check_suite:
-    types: [completed]
   issue_comment:
     types: [created]
-  # Programmatic / manual re-evaluation of a single PR -- a reliable entry
-  # point that does not depend on the fork-e2e mirror at all.
+  # Programmatic / manual re-evaluation of a single PR.
   workflow_dispatch:
     inputs:
       pr:
@@ -54,7 +48,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: merge-ready-${{ github.event.pull_request.number || github.event.issue.number || inputs.pr || github.event.check_suite.head_sha || github.event.workflow_run.head_sha }}
+  group: merge-ready-${{ github.event.pull_request.number || github.event.issue.number || inputs.pr || github.event.workflow_run.head_sha }}
   cancel-in-progress: true
 
 jobs:
@@ -66,9 +60,8 @@ jobs:
       checks: read
       actions: read         # evaluate-checks.sh reads GET /actions/runs to classify missing checks
       statuses: write
-    # Fire on automerge label adds, PR CI workflow_run completions
-    # (same-repo and the fork-e2e/** mirror push), `/merge` comments, or a
-    # workflow_dispatch re-eval; check_suite is a fork-PR fallback. Runs with no
+    # Fire on automerge label adds, PR CI workflow_run completions (same-repo
+    # and fork), `/merge` comments, or a workflow_dispatch re-eval. Runs with no
     # open PR (push to main, etc.) are dropped by the ctx step.
     if: >-
       (
@@ -77,17 +70,7 @@ jobs:
       ) ||
       (
         github.event_name == 'workflow_run' &&
-        (
-          github.event.workflow_run.event == 'pull_request' ||
-          (
-            github.event.workflow_run.event == 'push' &&
-            startsWith(github.event.workflow_run.head_branch, 'fork-e2e/')
-          )
-        )
-      ) ||
-      (
-        github.event_name == 'check_suite' &&
-        startsWith(github.event.check_suite.head_branch, 'fork-e2e/')
+        github.event.workflow_run.event == 'pull_request'
       ) ||
       github.event_name == 'workflow_dispatch' ||
       (
@@ -119,7 +102,6 @@ jobs:
           # Via env, not interpolated: author-controlled, so direct
           # interpolation would be a shell-injection vector.
           WF_PRS: ${{ toJSON(github.event.workflow_run.pull_requests) }}
-          CS_PRS: ${{ toJSON(github.event.check_suite.pull_requests) }}
           COMMENT_BODY: ${{ github.event.comment.body }}
           PR_INPUT: ${{ inputs.pr }}
           SHA_INPUT: ${{ inputs.sha }}
@@ -156,17 +138,6 @@ jobs:
             fi
             PR="${{ github.event.issue.number }}"
             SHA=$(gh pr view "$PR" --repo "$REPO" --json headRefOid --jq '.headRefOid')
-          elif [[ "${{ github.event_name }}" == "check_suite" ]]; then
-            # Mirrored fork e2e completed on fork-e2e/pr-N; its head SHA is
-            # the PR head (the mirror pushes the exact fork head SHA).
-            SHA="${{ github.event.check_suite.head_sha }}"
-            PR=$(echo "$CS_PRS" | jq -r '.[0].number // empty')
-            [[ -z "$PR" ]] && PR=$(resolve_pr_from_sha "$SHA")
-            if [[ -z "$PR" ]]; then
-              echo "::notice::Skipped: check_suite has no associated open PR"
-              echo "skip=true" >> "$GITHUB_OUTPUT"
-              exit 0
-            fi
           else
             PR=$(echo "$WF_PRS" | jq -r '.[0].number // empty')
             SHA="${{ github.event.workflow_run.head_sha }}"
@@ -180,61 +151,20 @@ jobs:
           echo "pr=$PR"   >> "$GITHUB_OUTPUT"
           echo "sha=$SHA" >> "$GITHUB_OUTPUT"
 
-      - name: Load maintainers
-        id: maintainers
-        if: steps.ctx.outputs.skip != 'true'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-        run: bash .github/scripts/merge-ready/load-maintainers.sh
-
-      - name: Read PR labels and fork approval state
+      - name: Read PR labels
         id: labels
         if: steps.ctx.outputs.skip != 'true'
         env:
           GH_TOKEN: ${{ github.token }}
           REPO: ${{ github.repository }}
           PR: ${{ steps.ctx.outputs.pr }}
-          MAINTAINERS: ${{ steps.maintainers.outputs.list }}
         run: |
-          INFO=$(gh pr view "$PR" --repo "$REPO" --json labels,isCrossRepository)
-          NAMES=$(echo "$INFO" | jq -r '.labels[].name')
+          NAMES=$(gh pr view "$PR" --repo "$REPO" --json labels --jq '.labels[].name')
           if echo "$NAMES" | grep -qx "automerge"; then
             echo "automerge=true" >> "$GITHUB_OUTPUT"
           else
             echo "automerge=false" >> "$GITHUB_OUTPUT"
           fi
-          # A fork PR without a maintainer's approving review or the
-          # `e2e-approved` label never runs e2e (the fork pull_request run is
-          # an empty matrix), so the gate blocks until one of these is present.
-          # Same-repo PRs run e2e with secrets directly and need no gate.
-          if [[ "$(echo "$INFO" | jq -r '.isCrossRepository')" == "true" ]]; then
-            # Check path 1: maintainer approval via PR review.
-            MAINTAINERS_LC=$(echo "${MAINTAINERS:-}" | tr '[:upper:]' '[:lower:]')
-            APPROVERS=$(gh api "repos/$REPO/pulls/$PR/reviews" --paginate \
-              --jq '[.[] | select(.state != "COMMENTED")] | group_by(.user.login) | map(max_by(.submitted_at)) | .[] | select(.state == "APPROVED") | .user.login')
-            HAS_GATE=false
-            for u in $APPROVERS; do
-              u_lc=$(echo "$u" | tr '[:upper:]' '[:lower:]')
-              for m in $MAINTAINERS_LC; do
-                if [[ "$m" == "$u_lc" ]]; then
-                  HAS_GATE=true
-                  break 2
-                fi
-              done
-            done
-            # Check path 2: e2e-approved label.
-            if [[ "$HAS_GATE" == "false" ]] && echo "$NAMES" | grep -qx "e2e-approved"; then
-              HAS_GATE=true
-            fi
-            if [[ "$HAS_GATE" == "false" ]]; then
-              echo "fork_needs_e2e_approval=true" >> "$GITHUB_OUTPUT"
-            else
-              echo "fork_needs_e2e_approval=false" >> "$GITHUB_OUTPUT"
-            fi
-          else
-            echo "fork_needs_e2e_approval=false" >> "$GITHUB_OUTPUT"
-          fi
 
       # post_red gates posting a red status: /merge needs it, automerge opts
       # in; otherwise post green only so partial CI doesn't paint red.
@@ -273,7 +203,6 @@ jobs:
         env:
           EVAL: ${{ steps.eval.outcome }}
           FAILED: ${{ steps.eval.outputs.failed }}
-          FORK_NEEDS_E2E_APPROVAL: ${{ steps.labels.outputs.fork_needs_e2e_approval }}
         run: bash .github/scripts/merge-ready/compute-gate.sh
 
       # Skipped when post_red is false AND gate is red: leaves prior
@@ -341,12 +270,11 @@ jobs:
 
       # Not on pull_request_target-labeled: auto-merge was enabled in an earlier
       # step there, so failing here would make the label look broken even
-      # though it worked. Safe on workflow_run/check_suite/workflow_dispatch.
+      # though it worked. Safe on workflow_run/workflow_dispatch.
       - name: Fail job when gate is red
         if: >-
           (
             github.event_name == 'workflow_run' ||
-            github.event_name == 'check_suite' ||
             github.event_name == 'workflow_dispatch'
           ) &&
           steps.ctx.outputs.skip != 'true' &&

.github/workflows/oss-publish-images.yml

@@ -123,16 +123,19 @@ jobs:
           set -euo pipefail
           IMAGE="ghcr.io/omnigent-ai/omnigent-server"
           HOST_IMAGE="ghcr.io/omnigent-ai/omnigent-host"
+          OPENSHELL_IMAGE="ghcr.io/omnigent-ai/omnigent-server-openshell"
           SHORT_SHA=$(git rev-parse --short HEAD)
 
           # Immutable per-commit pin, always.
           TAGS="${IMAGE}:sha-${SHORT_SHA}"
           HOST_TAGS="${HOST_IMAGE}:sha-${SHORT_SHA}"
+          OPENSHELL_TAGS="${OPENSHELL_IMAGE}:sha-${SHORT_SHA}"
 
-          # Append a floating/version tag to both images.
+          # Append a floating/version tag to all images.
           add_tag() {
             TAGS="${TAGS},${IMAGE}:$1"
             HOST_TAGS="${HOST_TAGS},${HOST_IMAGE}:$1"
+            OPENSHELL_TAGS="${OPENSHELL_TAGS},${OPENSHELL_IMAGE}:$1"
           }
 
           # Every qualifying main commit moves :latest-dev (bleeding edge).
@@ -171,6 +174,7 @@ jobs:
 
           echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"
           echo "host_tags=${HOST_TAGS}" >> "$GITHUB_OUTPUT"
+          echo "openshell_tags=${OPENSHELL_TAGS}" >> "$GITHUB_OUTPUT"
 
       # No build-args: the Dockerfile ARGs default to public registries.
       # Multi-arch: each tag publishes as a manifest list spanning amd64 + arm64,
@@ -210,9 +214,30 @@ jobs:
           cache-to: type=gha,mode=max
           provenance: false
           sbom: true
+
+      # OpenShell server variant: the default server image plus the
+      # openshell SDK extra (OMNIGENT_EXTRAS=openshell). Used by the
+      # deploy/kubernetes/overlays/openshell kustomize overlay. Reuses
+      # the shared builder-stage layers from the gha cache.
+      - name: Build and push openshell server image
+        id: build-openshell
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
+        with:
+          context: .
+          file: deploy/docker/Dockerfile
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.tags.outputs.openshell_tags }}
+          build-args: |
+            OMNIGENT_EXTRAS=openshell
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          provenance: false
+          sbom: true
     outputs:
       server-digest: ${{ steps.build-server.outputs.digest }}
       host-digest: ${{ steps.build-host.outputs.digest }}
+      openshell-digest: ${{ steps.build-openshell.outputs.digest }}
 
   generate-sbom:
     # Runs in a separate job with read-only permissions so the Syft
@@ -249,6 +274,13 @@ jobs:
             -o cyclonedx-json=host-sbom.cdx.json \
             -o spdx-json=host-sbom.spdx.json
 
+      - name: Generate openshell server SBOM
+        run: |
+          set -euo pipefail
+          syft "ghcr.io/omnigent-ai/omnigent-server-openshell@${{ needs.build-and-push.outputs.openshell-digest }}" \
+            -o cyclonedx-json=openshell-sbom.cdx.json \
+            -o spdx-json=openshell-sbom.spdx.json
+
       - name: Upload SBOMs
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
         with:
@@ -258,6 +290,8 @@ jobs:
             server-sbom.spdx.json
             host-sbom.cdx.json
             host-sbom.spdx.json
+            openshell-sbom.cdx.json
+            openshell-sbom.spdx.json
           retention-days: 90
 
   promote-nightly:
@@ -288,7 +322,7 @@ jobs:
           set -euo pipefail
           # crane tag points a new tag at an EXISTING manifest digest without
           # re-serializing it, so :latest-nightly keeps :latest-dev's exact digest.
-          for img in ghcr.io/omnigent-ai/omnigent-server ghcr.io/omnigent-ai/omnigent-host; do
+          for img in ghcr.io/omnigent-ai/omnigent-server ghcr.io/omnigent-ai/omnigent-host ghcr.io/omnigent-ai/omnigent-server-openshell; do
             if crane digest "${img}:latest-dev" >/dev/null 2>&1; then
               crane tag "${img}:latest-dev" latest-nightly
               echo "promoted ${img}:latest-dev -> :latest-nightly ($(crane digest "${img}:latest-nightly"))"
@@ -359,7 +393,7 @@ jobs:
             fi
           }
 
-          for img in ghcr.io/omnigent-ai/omnigent-server ghcr.io/omnigent-ai/omnigent-host; do
+          for img in ghcr.io/omnigent-ai/omnigent-server ghcr.io/omnigent-ai/omnigent-host ghcr.io/omnigent-ai/omnigent-server-openshell; do
             retag "${img}" "latest-rc" "${RC_TAG}"
             retag "${img}" "latest" "${LATEST_TAG}"
           done

.github/workflows/polly-review-approval-dispatch.yml

@@ -13,9 +13,8 @@ name: Polly Review Approval Dispatch
 # workflow_dispatch entry point) for that PR.
 #
 # Maintainer approval is the trust gate that authorizes spending the LLM gateway
-# secret on fork code -- the same model as the fork-e2e maintainer-approval gate.
-# Polly itself never runs PR code: it reviews the diff fetched via the API from
-# a default-branch checkout.
+# secret on fork code. Polly itself never runs PR code: it reviews the diff
+# fetched via the API from a default-branch checkout.
 #
 # This workflow checks out NO code and runs NO PR code -- it only reads API data
 # and dispatches a workflow, so it is not a "dangerous" workflow_run consumer.

.github/workflows/polly-review.yml

@@ -257,48 +257,29 @@ jobs:
         run: |
           set -euo pipefail
 
-          # Fetch the diff (capped at 512 KB — covers the vast majority of
-          # real PRs; truncation is surfaced to Polly in the prompt).
-          # The write-scoped github.token stays in this trusted step and is
-          # NOT passed to the Polly run.
-          # || true: head -c closes the pipe once the cap is reached, causing
-          # gh to get SIGPIPE (exit 141). Under pipefail that would abort the
-          # step; || true degrades it into the DIFF_TRUNCATED path instead.
+          # Fetch the full diff to a file — no size cap needed since the diff
+          # is read from disk by Polly via sys_os_shell, not embedded in the
+          # CLI argument (which would hit ARG_MAX for large PRs).
           gh api "repos/${REPO}/pulls/${PR_NUMBER}" \
             -H "Accept: application/vnd.github.v3.diff" \
-            | head -c 524288 > /tmp/pr_diff.txt || true
+            > /tmp/pr_diff.txt || true
 
-          DIFF_SIZE=$(wc -c < /tmp/pr_diff.txt)
-          [ "$DIFF_SIZE" -ge 524288 ] && DIFF_TRUNCATED=true || DIFF_TRUNCATED=false
-          export DIFF_TRUNCATED
-
-          # Extract lockfile pin changes from the already-fetched diff —
-          # no second network call needed.
+          # Extract lockfile pin changes from the diff.
           grep -E '^[+-]name = |^[+-]version = ' /tmp/pr_diff.txt \
             | head -500 > /tmp/lockfile_pins.txt || true
 
-          # Fetch PR metadata to separate files — avoids embedding
-          # attacker-controlled strings (PR title/body) into heredocs.
+          # Fetch PR metadata.
           gh pr view "$PR_NUMBER" --repo "$REPO" \
             --json title,body,baseRefName,headRefName,additions,deletions,changedFiles \
             > /tmp/pr_meta.json
 
-          # Build the review prompt safely using python — all untrusted
-          # fields (title, body, diff) are read from files, never
-          # interpolated into shell heredocs.
+          # Build the review prompt — the diff is NOT embedded in the prompt.
+          # Polly reads it from /tmp/pr_diff.txt via sys_os_shell at review time.
           python3 -u <<'PYEOF'
-          import json, os, pathlib
+          import json, pathlib
 
           meta = json.loads(pathlib.Path("/tmp/pr_meta.json").read_text())
-          diff = pathlib.Path("/tmp/pr_diff.txt").read_text(encoding="utf-8", errors="replace")
           lockfile_pins = pathlib.Path("/tmp/lockfile_pins.txt").read_text(encoding="utf-8", errors="replace").strip()
-          truncated = os.environ.get("DIFF_TRUNCATED", "false") == "true"
-
-          truncation_notice = """
-          > ⚠️ **Diff truncated at 512 KB** — this review covers only the first
-          > portion of the diff. Flag this as a non-blocking note and recommend
-          > a manual review of the remaining changes.
-          """ if truncated else ""
 
           lockfile_section = f"""
           ## Changed lockfile pins (uv.lock / package-lock.json)
@@ -317,14 +298,12 @@ jobs:
 
           ## PR Description
           {(meta.get('body') or '')[:4096]}{"  *(truncated)*" if len(meta.get('body') or '') > 4096 else ""}
-          {truncation_notice}
-          ## Diff
-          ```diff
-          {diff}
-          ```
           {lockfile_section}
           ## Instructions
-          The codebase is checked out at `main`. Read source files freely for
+
+          **Step 1 — read the diff.** The full PR diff has been pre-fetched to
+          `/tmp/pr_diff.txt`. Read it with `sys_os_shell("cat /tmp/pr_diff.txt")`.
+          The codebase is checked out at `main` — read source files freely for
           additional context when needed.
 
           **Security:** you are running in a CI environment with access to secrets
@@ -332,7 +311,7 @@ jobs:
           credentials in your output, and never make outbound network calls
           except to the configured LLM gateway.
 
-          Review the diff against the PR description. Report:
+          **Step 2 — review.** Report:
           1. **Blocking issues** — correctness bugs, broken contracts, missing error handling on failure paths, data loss risks.
           2. **Security vulnerabilities** — injection (SQL, command, template), authentication/authorization bypasses, secret exposure, unsafe deserialization, path traversal, SSRF, and any change that weakens an existing security boundary. Flag even subtle issues.
           3. **Non-blocking notes** — design concerns or edge cases worth flagging (brief).

.github/workflows/rerun-security-gate-run.yml

@@ -8,9 +8,7 @@ name: Rerun Security Gate Run
 # workflow whose latest run for that SHA is a completed failure whose
 # `Security Gate` job failed -- so a workflow that already self-triggered on the
 # label (ci/e2e trigger on `labeled` to re-poll the security gate) is in-progress or
-# green and skipped, avoiding a double-run. fork-e2e-mirror is excluded: it is
-# approval-driven mirror plumbing with branch side effects, not a
-# gate-mirroring check.
+# green and skipped, avoiding a double-run.
 #
 # RACE GUARD: the label event fires this relay AND the Security Scan re-run
 # concurrently. Before re-running anything we WAIT for the Security Scan check on

.github/workflows/security-scan.yml

@@ -145,8 +145,16 @@ jobs:
             echo "uv.lock not changed; skipping OSV scan."
             exit 0
           fi
+          # Drop editable local packages (the project itself + sdks/*) before
+          # auditing. pip-audit can't hash an editable path requirement and
+          # errors out when one is present, so without this filter any PR that
+          # actually changes uv.lock fails here. We only want to audit
+          # third-party pinned packages anyway — OSV has no advisories for
+          # local source. Filtering all `-e` lines (rather than naming each
+          # workspace member) keeps this correct if members are added later.
           uv export --frozen --format requirements-txt --all-extras \
-            > /tmp/uv-req.txt
+            > /tmp/uv-req-full.txt
+          grep -v '^-e ' /tmp/uv-req-full.txt > /tmp/uv-req.txt
           uvx pip-audit --requirement /tmp/uv-req.txt --no-deps
 
       - name: Semgrep (changed files, local rules)

.github/workflows/sync-openapi-to-site.yml

@@ -0,0 +1,95 @@
+name: Sync OpenAPI to site
+
+# Keeps the public API reference on the omnigent website in sync with
+# the spec generated here. When openapi.json changes on main, copy it
+# into omnigent-site/public/openapi.json and open (or update) a PR there.
+#
+# Cross-repo writes can't use the workflow's own GITHUB_TOKEN (it's
+# scoped to this repo), so we mint a short-lived token from the
+# omnigent-ci GitHub App — the same App used by oss-regen-on-comment.yml
+# — scoped to omnigent-site. The App must be installed on omnigent-site
+# with contents + pull-requests write.
+on:
+  push:
+    branches: [main]
+    paths: [openapi.json]
+  # Manual trigger for backfills / re-syncs after editing this workflow.
+  workflow_dispatch:
+
+# One sync at a time; a newer spec supersedes an in-flight run.
+concurrency:
+  group: sync-openapi-to-site
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  sync:
+    name: Open sync PR on omnigent-site
+    runs-on: ubuntu-latest
+    # Skip cleanly on forks / installs where the App isn't configured,
+    # rather than failing the token step with a confusing error.
+    if: ${{ vars.OMNIGENT_BOT_APP_ID != '' }}
+    env:
+      SYNC_BRANCH: auto/openapi-sync
+      TARGET_REPO: ${{ github.repository_owner }}/omnigent-site
+    steps:
+      - name: Checkout omnigent (spec source)
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          path: omnigent
+
+      - name: Mint App token for omnigent-site
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.OMNIGENT_BOT_APP_ID }}
+          private-key: ${{ secrets.OMNIGENT_BOT_APP_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: omnigent-site
+
+      - name: Checkout omnigent-site (sync target)
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          repository: ${{ env.TARGET_REPO }}
+          token: ${{ steps.app-token.outputs.token }}
+          path: site
+
+      - name: Copy spec into the site
+        run: cp omnigent/openapi.json site/public/openapi.json
+
+      # Commit + push to a fixed branch and open a PR if one isn't
+      # already open. If a PR exists, the force-push updates it in place
+      # — so repeated spec changes collapse into a single rolling PR.
+      - name: Open or update sync PR
+        working-directory: site
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          if [ -z "$(git status --porcelain -- public/openapi.json)" ]; then
+            echo "openapi.json already in sync — nothing to do."
+            exit 0
+          fi
+
+          git config user.name "omnigent-ci[bot]"
+          git config user.email "294685417+omnigent-ci[bot]@users.noreply.github.com"
+          git switch -C "$SYNC_BRANCH"
+          git add public/openapi.json
+          git commit -m "chore(api): sync openapi.json from omnigent@${GITHUB_SHA:0:7}"
+          git push --force origin "$SYNC_BRANCH"
+
+          if [ -n "$(gh pr list --head "$SYNC_BRANCH" --state open --json number --jq '.[].number')" ]; then
+            echo "PR already open for $SYNC_BRANCH — the force-push updated it."
+            exit 0
+          fi
+
+          # Build the body with printf so YAML block indentation never
+          # leaks leading spaces into the Markdown.
+          short="${GITHUB_SHA:0:7}"
+          body="$(printf 'Automated sync of `public/openapi.json` from [omnigent@`%s`](https://github.com/%s/commit/%s).\n\nGenerated by `.github/workflows/sync-openapi-to-site.yml`. Merging publishes the updated API reference at `/reference`.' "$short" "$GITHUB_REPOSITORY" "$GITHUB_SHA")"
+          gh pr create \
+            --base main \
+            --head "$SYNC_BRANCH" \
+            --title "chore(api): sync OpenAPI reference from omnigent" \
+            --body "$body"

.github/workflows/ui-snapshot-update.yml

@@ -113,37 +113,17 @@ jobs:
       - name: Compare the baselines (no --update-snapshots)
         # Deliberately NOT --update-snapshots: that rewrites EVERY PNG, churning
         # baselines that already pass (a sub-threshold re-render still changes the
-        # bytes). In plain compare mode the plugin instead leaves passing
-        # baselines untouched and surfaces only the drift -- a mismatching
-        # baseline's fresh render lands in snapshot_failures/.../actual_*.png (the
-        # committed PNG is left in place), and a MISSING baseline is created
-        # directly under snapshots/. The run "fails" by design on any drift, so
-        # don't gate on its exit code.
+        # bytes). In plain compare mode the plugin leaves passing baselines
+        # untouched and rewrites only the drift: under GitHub Actions it updates a
+        # mismatching baseline IN PLACE (and creates a MISSING one) under
+        # snapshots/, so the tree below already holds exactly the changed PNGs.
+        # The run "fails" by design on any drift, so don't gate on its exit code.
         run: |
           uv run pytest tests/e2e_ui/visual -m visual \
             -v --tb=long --log-level=INFO -r a \
             -p no:rerunfailures \
             --ui-skip-build || true
 
-      - name: Adopt only the changed renders over their baselines
-        # Copy each mismatching test's actual_<name>.png over its committed
-        # baseline; previously-missing baselines were already written under
-        # snapshots/ by the compare above. Baselines that passed are not in
-        # snapshot_failures, so they stay byte-for-byte unchanged.
-        run: |
-          fail_dir=tests/e2e_ui/visual/snapshot_failures
-          if [ -d "$fail_dir" ]; then
-            while IFS= read -r src; do
-              rel=${src#"$fail_dir"/}                  # <module>/<test>/actual_<name>.png
-              dest="tests/e2e_ui/visual/snapshots/$(dirname "$rel")/$(basename "$rel" | sed 's/^actual_//')"
-              mkdir -p "$(dirname "$dest")"
-              cp "$src" "$dest"
-              echo "adopted: $dest"
-            done < <(find "$fail_dir" -type f -name 'actual_*.png')
-          else
-            echo "No snapshot_failures dir -- no existing baseline drifted (only new baselines, if any, were created)."
-          fi
-
       # Tar the snapshots tree (paths intact) so the commit job can restore it
       # wholesale. Only genuinely-changed/created PNGs differ from the committed
       # tree, so git add in the commit job stages exactly those.

.github/workflows/ui-snapshot.yml

@@ -22,7 +22,13 @@ name: UI Snapshot
 #   pull_request       compare the rendered pages against the committed
 #                      baselines; fail (with actual/expected/diff PNGs in the
 #                      artifact) on any mismatch. No secrets, so fork PRs run
-#                      fine.
+#                      fine. The render job is gated on the `detect` job (below):
+#                      a PR that touches none of the render inputs (ap-web, the
+#                      visual tests + fixtures, the pinned toolchain) SKIPS the
+#                      render. We gate at the job (not via `on: paths:`) on
+#                      purpose -- a job skipped by `if` reports SUCCESS, so this
+#                      stays safe to register as a required check, whereas a
+#                      path-filtered *workflow* would sit "pending" and block.
 #   workflow_dispatch  regenerate the baselines with --update-snapshots in the
 #                      same pinned image; the regenerated PNGs are in the
 #                      `ui-snapshot-<run_id>` artifact to download and commit.
@@ -45,6 +51,7 @@ on:
 
 permissions:
   contents: read
+  pull-requests: read  # detect: list the PR's changed files
 
 concurrency:
   group: ui-snapshot-${{ github.workflow }}-${{ github.event.pull_request.number || github.event.inputs.ref || github.ref }}
@@ -62,8 +69,48 @@ env:
   UV_PYTHON_PREFERENCE: only-system
 
 jobs:
+  # Cheap pre-flight (no container/build): does this PR touch anything that can
+  # change the render? The heavy job below is `if`-gated on it, so non-UI PRs
+  # skip the render (no wasted CI, no flaking against unrelated changes). The
+  # render is a pure function of the ap-web bundle + the visual tests + their
+  # shared fixtures + the pinned toolchain (npm pin, the image digest in THIS
+  # file, and the playwright/plugin versions in the lock), so watch exactly
+  # those. Fails open: if the file list can't be fetched, render rather than
+  # risk a false pass.
+  detect:
+    name: Detect render-affecting changes
+    runs-on: ubuntu-latest
+    outputs:
+      ui: ${{ steps.changes.outputs.ui }}
+    steps:
+      - id: changes
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+        run: |
+          if [ -z "${PR:-}" ]; then
+            echo "ui=true" >> "$GITHUB_OUTPUT"; echo "no PR (dispatch) -> render"; exit 0
+          fi
+          if ! files=$(gh api "repos/$REPO/pulls/$PR/files" --paginate --jq '.[].filename'); then
+            echo "ui=true" >> "$GITHUB_OUTPUT"; echo "file list unavailable -> render"; exit 0
+          fi
+          pattern='^(ap-web/|tests/e2e_ui/visual/|tests/e2e_ui/conftest\.py|\.github/actions/setup-node/|\.github/workflows/ui-snapshot\.yml|pyproject\.toml|uv\.lock)'
+          if printf '%s\n' "$files" | grep -qE "$pattern"; then
+            echo "ui=true" >> "$GITHUB_OUTPUT"
+            echo "render-affecting files changed:"
+            printf '%s\n' "$files" | grep -E "$pattern" | sed 's/^/  /'
+          else
+            echo "ui=false" >> "$GITHUB_OUTPUT"
+            echo "no render-affecting files changed -> skip the render"
+          fi
+
   ui-snapshot:
-    name: UI Snapshot (visual baselines)
+    name: UI Snapshot (visual baselines) [non-blocking]
+    needs: detect
+    # Skipped (not failed) when no render input changed -> reports SUCCESS, so a
+    # non-UI PR neither runs the render nor blocks a required check.
+    if: ${{ needs.detect.outputs.ui == 'true' }}
     runs-on: ubuntu-24.04
     # Render in the digest-pinned Playwright image (browsers + fonts baked in),
     # so the committed baseline and the PR comparison are byte-identical and a

.gitignore

@@ -73,6 +73,8 @@ omnigent/server/static/web-ui/
 # bundle deploy` respects .gitignore for its file sync — gitignored
 # wheels would silently fail to reach the deployed app's source folder
 # and the install would error with "No such file or directory".
+# The per-deploy app payload (src/pyproject.toml, src/uv.lock) is regenerated
+# by deploy.py and likewise kept untracked rather than gitignored, for the same
+# reason — `bundle deploy` must be able to sync it to the app source folder.
 # DAB local state directory (created by `databricks bundle deploy`).
 deploy/databricks/.databricks/
-deploy/databricks/**/*.whl

README.md

@@ -4,7 +4,7 @@
 
 ### The open-source AI agent framework and meta-harness for all your AI agents.
 
-Omnigent is an open-source **AI agent framework** and meta-harness that gives you a common orchestration layer over Claude Code, Codex, Cursor, Pi, and the agents you write yourself: swap or combine harnesses without rewriting, enforce policies and sandboxing, and collaborate in real time from any device.
+Omnigent is an open-source **AI agent framework** and meta-harness that gives you a common orchestration layer over Claude Code, Codex, Cursor, Kimi Code, Pi, and the agents you write yourself: swap or combine harnesses without rewriting, enforce policies and sandboxing, and collaborate in real time from any device.
 
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://github.com/omnigent-ai/omnigent/blob/main/LICENSE)
 ![Status: alpha](https://img.shields.io/badge/status-alpha-orange.svg)
@@ -41,9 +41,12 @@ Omnigent lets you:
   conversation to continue on their own.
 
 - **☁️ Run agents in cloud sandboxes.** No laptop required: run sessions in
-  disposable [Modal](https://modal.com), [Daytona](https://www.daytona.io), or
-  [Islo](https://islo.dev) sandboxes, launched from the CLI or provisioned by
-  the server per session (*managed hosts*).
+  disposable [Modal](https://modal.com), [Daytona](https://www.daytona.io),
+  [Islo](https://islo.dev), [E2B](https://e2b.dev),
+  [CoreWeave](https://docs.coreweave.com/products/sandboxes),
+  [Kubernetes](https://kubernetes.io), [OpenShell](https://github.com/NVIDIA/OpenShell),
+  or [Boxlite](https://github.com/boxlite-ai/boxlite) sandboxes, launched from the
+  CLI or provisioned by the server per session (*managed hosts*).
 
 - **🛡️ Govern your agents.** Create
   [policies](#6-govern-your-agents-with-policies) to pause for your approval
@@ -94,15 +97,18 @@ uv tool install -q --python 3.12 git+https://github.com/omnigent-ai/omnigent.git
 - **Node.js 22 LTS or newer** with **`npm`**, for the Claude, Codex, and Pi
   coding harnesses. `omnigent run` installs the harness CLI you pick.
   https://docs.npmjs.com/downloading-and-installing-node-js-and-npm
-- **`tmux`**, required by the native `omnigent claude` / `omnigent codex`
+- **Kiro CLI** (optional), for `omnigent kiro`: install with
+  `curl -fsSL https://cli.kiro.dev/install | bash`, then sign in with Kiro.
+- **`tmux`**, required by the native `omnigent claude` / `omnigent codex` /
+  `omnigent kiro`
   wrappers (`brew install tmux` / `apt install tmux`; the installer offers
   to install it for you).
 - **`bubblewrap`** (`bwrap`), **Linux only**. The native `omnigent claude` /
-  `omnigent codex` and `pi` harnesses wrap each agent terminal in a `bwrap`
-  OS-sandbox; on Linux that isolation is mandatory, so a missing `bwrap`
-  binary makes those terminals fail to start (`apt install bubblewrap`; the
-  installer offers to install it for you). macOS uses the built-in `seatbelt`
-  sandbox and needs nothing extra.
+  `omnigent codex` / `omnigent kiro` and `pi` harnesses wrap each agent
+  terminal in a `bwrap` OS-sandbox; on Linux that isolation is mandatory, so a
+  missing `bwrap` binary makes those terminals fail to start
+  (`apt install bubblewrap`; the installer offers to install it for you). macOS
+  uses the built-in `seatbelt` sandbox and needs nothing extra.
 - **Databricks** (optional). To use a Databricks workspace as your model
   provider, install Omnigent with the `databricks` extra:
   `uv tool install "omnigent[databricks]"` — or pass it to the bootstrap
@@ -161,6 +167,8 @@ Or launch a specific agent runtime, or your own agent:
 ```bash
 omnigent claude                      # Claude Code, in a session your team can join
 omnigent codex                       # Codex
+omnigent kiro                        # Kiro CLI
+omnigent kimi                        # Kimi Code (https://kimi.com), headless
 omnigent run path/to/agent.yaml      # your own agent (see "Write your own agent")
 ```
 
@@ -177,6 +185,7 @@ omnigent run examples/scribe/
 omnigent run examples/polly/ --harness pi
 omnigent run examples/debby/ --harness openai-agents
 omnigent run examples/polly/ --harness cursor  # Cursor CLI (needs cursor-agent + CURSOR_API_KEY)
+omnigent run examples/polly/ --harness copilot # GitHub Copilot SDK (needs a GitHub token w/ Copilot, e.g. GH_TOKEN)
 ```
 
 **🐙 Polly** is a multi-agent coding orchestrator who writes no code herself.
@@ -375,7 +384,7 @@ name: my_agent
 prompt: You are a helpful data analyst.
 
 executor:
-  harness: claude-sdk          # or: claude-native, codex, codex-native, cursor, cursor-native, openai-agents, pi, pi-native, antigravity, qwen
+  harness: claude-sdk          # or: claude-native, codex, codex-native, cursor, cursor-native, kiro-native, openai-agents, pi, pi-native, antigravity, qwen, kimi, copilot
 
 tools:
   # A local Python function (schema auto-generated from the signature)

ap-web/electron/package.json

@@ -9,6 +9,7 @@
   "scripts": {
     "start": "electron .",
     "dev": "electron .",
+    "test": "node --test",
     "build": "electron-builder",
     "build:mac": "electron-builder --mac",
     "build:mac:release": "electron-builder --mac -c.mac.notarize=true",

ap-web/electron/setup/index.html

@@ -180,16 +180,17 @@
         <div id="recents-list"></div>
       </div>
     </div>
+    <script src="../src/url.js"></script>
     <script>
+      // Shared URL helpers (electron/src/url.js), exposed as window.omnigentUrl
+      // — the same module the main process uses, so the two never drift.
+      const { isPlainHttpRemote } = window.omnigentUrl;
       // Uses the Electron preload bridge (electron/src/preload.js).
       const setup = window.omnigentSetup;
       const input = document.getElementById("url");
       const button = document.getElementById("connect");
       const err = document.getElementById("err");
 
-      // Hosts where plain http:// is fine (no network path to speak of).
-      const LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
-
       // The main process loads this page with ?error=…&url=… when a server
       // navigation fails (server down, DNS, TLS), so the user sees what went
       // wrong and can retry or change the URL.
@@ -254,22 +255,6 @@
         })
         .catch(() => {});
 
-      // True when the entered URL is unencrypted http:// to a non-local
-      // host. Mirrors the scheme-defaulting of the main process's
-      // normalizeUrl; invalid URLs return false so the real error comes
-      // from normalizeUrl on Connect.
-      function isPlainHttpRemote(raw) {
-        const trimmed = (raw || "").trim();
-        const withScheme = trimmed.includes("://") ? trimmed : "http://" + trimmed;
-        let url;
-        try {
-          url = new URL(withScheme);
-        } catch {
-          return false;
-        }
-        return url.protocol === "http:" && !LOCAL_HOSTS.has(url.hostname);
-      }
-
       // The exact URL value the user has already been warned about — a
       // second Connect click on the same value proceeds; editing the input
       // re-arms the warning.

ap-web/electron/src/main.js

@@ -31,6 +31,7 @@ const fs = require("node:fs");
 const path = require("node:path");
 const { pathToFileURL } = require("node:url");
 const { registerLocalhostCors } = require("./localhost_cors");
+const { normalizeUrl, expandDatabricksWorkspaceUrl, WORKSPACE_UI_PATH } = require("./url");
 
 /** Absolute path to the bundled setup page (the "connect to server" form). */
 const SETUP_PAGE = path.join(__dirname, "..", "setup", "index.html");
@@ -596,44 +597,6 @@ function rememberRecentServer(settings, url) {
   ].slice(0, MAX_RECENT_SERVERS);
 }
 
-/**
- * Normalize a user-entered server URL into something navigable. Accepts bare
- * `host:port` (assumes http), trims whitespace, and rejects anything that
- * isn't an http(s) URL — fail loud rather than navigate to garbage.
- *
- * @param {string} raw
- * @returns {string} A normalized absolute http(s) URL.
- */
-function normalizeUrl(raw) {
-  const trimmed = (raw ?? "").trim();
-  if (trimmed === "") throw new Error("server URL is empty");
-  const withScheme = trimmed.includes("://") ? trimmed : `http://${trimmed}`;
-  let url;
-  try {
-    url = new URL(withScheme);
-  } catch (e) {
-    throw new Error(`invalid URL: ${e.message}`);
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    throw new Error(`unsupported scheme '${url.protocol}' (use http/https)`);
-  }
-  return url.toString();
-}
-
-/**
- * Path under a Databricks workspace where the Omnigent web UI is mounted. A
- * bare workspace URL serves the workspace's own web app at the root, so a user
- * who pastes just the workspace host (e.g.
- * ``https://<ws>.azuredatabricks.net``) lands on a 404 unless this suffix is
- * appended.
- *
- * NOTE: the Python CLI records the same UI mount as ``/ml/omnigent``
- * (singular) in ``omnigent/conversation_browser.py`` (WORKSPACE_UI_PATH); the
- * plural here is the path that actually resolves on the live workspace. The
- * two should be reconciled — see also that file's WORKSPACE_API_PATH.
- */
-const WORKSPACE_UI_PATH = "/ml/omnigents";
-
 /**
  * CSS that hides the Databricks workspace navigation chrome around a
  * workspace-hosted Omnigent SPA.
@@ -657,62 +620,6 @@ const WORKSPACE_CHROME_HIDE_CSS = `
   }
 `;
 
-/**
- * Probe timeout for Databricks workspace detection. Deliberately short: a slow
- * or unreachable host must not stall the connect flow — on timeout we fall
- * back to loading the URL exactly as entered.
- */
-const WORKSPACE_PROBE_TIMEOUT_MS = 8000;
-
-/**
- * Expand a bare Databricks workspace URL to its Omnigent web-UI mount.
- *
- * Mirrors the omni CLI's behavioral detection
- * (``omnigent/cli.py:_workspace_api_server_url``): rather than match
- * hostnames, probe the URL and adopt the mount only when the host answers
- * like a Databricks workspace — a response carrying the ``server: databricks``
- * header. URLs that already carry a path, or aren't https, are returned
- * untouched WITHOUT a probe, so a user who pastes the full ``…/ml/omnigents``
- * URL (or connects to any non-workspace server) is never second-guessed.
- *
- * The CLI appends the API mount because it's an API client; the desktop shell
- * loads the web UI, so it appends the SPA mount instead.
- *
- * @param {string} normalized A normalized http(s) URL from {@link normalizeUrl}.
- * @returns {Promise<string>} The workspace UI URL when expansion applies, else
- *   the input unchanged.
- */
-async function expandDatabricksWorkspaceUrl(normalized) {
-  let url;
-  try {
-    url = new URL(normalized);
-  } catch {
-    return normalized;
-  }
-  // Only bare https roots are candidates: a non-root path means the user
-  // already pointed at a specific mount, and Databricks workspaces are
-  // https-only.
-  if (url.protocol !== "https:" || (url.pathname !== "/" && url.pathname !== "")) {
-    return normalized;
-  }
-  let probe;
-  try {
-    probe = await fetch(`${url.origin}/`, {
-      method: "HEAD",
-      redirect: "manual",
-      signal: AbortSignal.timeout(WORKSPACE_PROBE_TIMEOUT_MS),
-    });
-  } catch {
-    // Unreachable / DNS / TLS / timeout: connect to the URL as given and let
-    // the did-fail-load fallback surface any real failure.
-    return normalized;
-  }
-  if ((probe.headers.get("server") ?? "").toLowerCase() !== "databricks") {
-    return normalized;
-  }
-  return `${url.origin}${WORKSPACE_UI_PATH}`;
-}
-
 // ---------------------------------------------------------------------------
 // Window + navigation
 // ---------------------------------------------------------------------------

ap-web/electron/src/url.js

@@ -0,0 +1,182 @@
+// Shared URL-normalization helpers for the desktop shell.
+//
+// Loaded by both the Electron main process (`require("./url")` in
+// `src/main.js`) and the bundled setup page (`<script src="../src/url.js">` in
+// `setup/index.html`, where it publishes `window.omnigentUrl`). One copy keeps
+// the two from drifting — the setup page's plain-http warning and the main
+// process's navigation must agree on what a bare URL means.
+//
+// Only web/Node globals (URL, fetch, AbortSignal) are used, so the same source
+// runs unchanged under CommonJS (main) and in the renderer (setup page).
+(function (root, factory) {
+  const api = factory();
+  if (typeof module === "object" && module.exports) {
+    module.exports = api;
+  } else {
+    root.omnigentUrl = api;
+  }
+})(typeof globalThis !== "undefined" ? globalThis : this, function () {
+  "use strict";
+
+  /**
+   * Hostnames that resolve to the local machine. A schemeless URL defaults to
+   * https:// (the workspace / remote case the internal user guide documents),
+   * but these default to http:// — local dev servers are virtually always plain
+   * http, and the setup placeholder shows http://localhost.
+   */
+  const LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+
+  /**
+   * The scheme a schemeless input should default to: http:// for loopback
+   * hosts (local dev is plain http), https:// for everything else (the pasted
+   * workspace-URL case). Unparseable input falls back to https:// so the
+   * caller's own URL parse raises the real error.
+   *
+   * @param {string} trimmed A trimmed, scheme-less `host[:port][/path]`.
+   * @returns {"http" | "https"}
+   */
+  function defaultSchemeFor(trimmed) {
+    let host;
+    try {
+      host = new URL(`https://${trimmed}`).hostname;
+    } catch {
+      host = "";
+    }
+    return LOCAL_HOSTS.has(host) ? "http" : "https";
+  }
+
+  /**
+   * Normalize a user-entered server URL into something navigable. Accepts a
+   * bare `host[:port][/path]` and defaults the scheme (https://, or http:// for
+   * loopback hosts), trims whitespace, and rejects anything that isn't an
+   * http(s) URL — fail loud rather than navigate to garbage.
+   *
+   * @param {string} raw
+   * @returns {string} A normalized absolute http(s) URL.
+   */
+  function normalizeUrl(raw) {
+    const trimmed = (raw ?? "").trim();
+    if (trimmed === "") throw new Error("server URL is empty");
+    const withScheme = trimmed.includes("://")
+      ? trimmed
+      : `${defaultSchemeFor(trimmed)}://${trimmed}`;
+    let url;
+    try {
+      url = new URL(withScheme);
+    } catch (e) {
+      throw new Error(`invalid URL: ${e.message}`);
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+      throw new Error(`unsupported scheme '${url.protocol}' (use http/https)`);
+    }
+    return url.toString();
+  }
+
+  /**
+   * True when the entered URL is unencrypted http:// to a non-local host — the
+   * setup page warns before connecting. Mirrors normalizeUrl's scheme-
+   * defaulting (https:// by default, http:// for loopback), so a bare remote
+   * host — now https — does not trip the warning; only an explicit http:// to a
+   * remote host does. Invalid URLs return false so the real error comes from
+   * normalizeUrl on Connect.
+   *
+   * @param {string} raw
+   * @returns {boolean}
+   */
+  function isPlainHttpRemote(raw) {
+    const trimmed = (raw || "").trim();
+    if (trimmed === "") return false;
+    const withScheme = trimmed.includes("://")
+      ? trimmed
+      : `${defaultSchemeFor(trimmed)}://${trimmed}`;
+    let url;
+    try {
+      url = new URL(withScheme);
+    } catch {
+      return false;
+    }
+    return url.protocol === "http:" && !LOCAL_HOSTS.has(url.hostname);
+  }
+
+  /**
+   * Path under a Databricks workspace where the Omnigent web UI is mounted. A
+   * bare workspace URL serves the workspace's own web app at the root, so a
+   * user who pastes just the workspace host (e.g.
+   * ``https://<ws>.azuredatabricks.net``) lands on a 404 unless this suffix is
+   * appended.
+   *
+   * NOTE: the Python CLI records the UI mount as ``/omnigent`` in
+   * ``omnigent/conversation_browser.py`` (WORKSPACE_UI_PATH), whereas the
+   * desktop deliberately keeps ``/ml/omnigents`` for now — that is the path the
+   * live workspace serves the embedded SPA on. The two are intentionally
+   * divergent pending reconciliation; do not "fix" this to ``/omnigent``
+   * without verifying what the workspace actually serves to the desktop shell.
+   */
+  const WORKSPACE_UI_PATH = "/ml/omnigents";
+
+  /**
+   * Probe timeout for Databricks workspace detection. Deliberately short: a
+   * slow or unreachable host must not stall the connect flow — on timeout we
+   * fall back to loading the URL exactly as entered.
+   */
+  const WORKSPACE_PROBE_TIMEOUT_MS = 8000;
+
+  /**
+   * Expand a bare Databricks workspace URL to its Omnigent web-UI mount.
+   *
+   * Mirrors the omni CLI's behavioral detection
+   * (``omnigent/cli.py:_workspace_api_server_url``): rather than match
+   * hostnames, probe the URL and adopt the mount only when the host answers
+   * like a Databricks workspace — a response carrying the ``server: databricks``
+   * header. URLs that already carry a path, or aren't https, are returned
+   * untouched WITHOUT a probe, so a user who pastes the full ``…/ml/omnigents``
+   * URL (or connects to any non-workspace server) is never second-guessed.
+   *
+   * The CLI appends the API mount because it's an API client; the desktop shell
+   * loads the web UI, so it appends the SPA mount instead.
+   *
+   * @param {string} normalized A normalized http(s) URL from normalizeUrl().
+   * @returns {Promise<string>} The workspace UI URL when expansion applies,
+   *   else the input unchanged.
+   */
+  async function expandDatabricksWorkspaceUrl(normalized) {
+    let url;
+    try {
+      url = new URL(normalized);
+    } catch {
+      return normalized;
+    }
+    // Only bare https roots are candidates: a non-root path means the user
+    // already pointed at a specific mount, and Databricks workspaces are
+    // https-only.
+    if (url.protocol !== "https:" || (url.pathname !== "/" && url.pathname !== "")) {
+      return normalized;
+    }
+    let probe;
+    try {
+      probe = await fetch(`${url.origin}/`, {
+        method: "HEAD",
+        redirect: "manual",
+        signal: AbortSignal.timeout(WORKSPACE_PROBE_TIMEOUT_MS),
+      });
+    } catch {
+      // Unreachable / DNS / TLS / timeout: connect to the URL as given and let
+      // the did-fail-load fallback surface any real failure.
+      return normalized;
+    }
+    if ((probe.headers.get("server") ?? "").toLowerCase() !== "databricks") {
+      return normalized;
+    }
+    return `${url.origin}${WORKSPACE_UI_PATH}`;
+  }
+
+  return {
+    LOCAL_HOSTS,
+    defaultSchemeFor,
+    normalizeUrl,
+    isPlainHttpRemote,
+    WORKSPACE_UI_PATH,
+    WORKSPACE_PROBE_TIMEOUT_MS,
+    expandDatabricksWorkspaceUrl,
+  };
+});

ap-web/electron/test/url.test.js

@@ -0,0 +1,196 @@
+// Tests for the shared desktop URL helpers (src/url.js), run with
+// `node --test` (no extra deps). Covers the scheme-defaulting that lets a
+// pasted workspace URL (schemeless, /omnigent suffix from the internal user
+// guide) connect, the plain-http warning, and the workspace probe/expansion.
+
+const { describe, it } = require("node:test");
+const assert = require("node:assert/strict");
+
+const {
+  defaultSchemeFor,
+  normalizeUrl,
+  isPlainHttpRemote,
+  expandDatabricksWorkspaceUrl,
+  WORKSPACE_UI_PATH,
+} = require("../src/url");
+
+describe("defaultSchemeFor", () => {
+  it("defaults remote hosts to https", () => {
+    assert.equal(defaultSchemeFor("dbc-x.cloud.databricks.com/omnigent"), "https");
+    assert.equal(defaultSchemeFor("example.com"), "https");
+  });
+
+  it("defaults loopback hosts to http", () => {
+    assert.equal(defaultSchemeFor("localhost:6767"), "http");
+    assert.equal(defaultSchemeFor("127.0.0.1:6767"), "http");
+    assert.equal(defaultSchemeFor("[::1]:6767"), "http");
+  });
+
+  it("defaults unparseable input to https", () => {
+    assert.equal(defaultSchemeFor("exa mple"), "https");
+  });
+});
+
+describe("normalizeUrl", () => {
+  it("defaults a schemeless workspace /omnigent URL to https", () => {
+    assert.equal(
+      normalizeUrl("dbc-a5d4177a-49dc.cloud.databricks.com/omnigent"),
+      "https://dbc-a5d4177a-49dc.cloud.databricks.com/omnigent",
+    );
+  });
+
+  it("defaults a bare remote host to https", () => {
+    assert.equal(
+      normalizeUrl("example.cloud.databricks.com"),
+      "https://example.cloud.databricks.com/",
+    );
+  });
+
+  it("defaults loopback hosts to http", () => {
+    assert.equal(normalizeUrl("localhost:6767"), "http://localhost:6767/");
+    assert.equal(normalizeUrl("127.0.0.1:6767"), "http://127.0.0.1:6767/");
+    assert.equal(normalizeUrl("[::1]:6767"), "http://[::1]:6767/");
+  });
+
+  it("preserves an explicit scheme (even http to a remote host)", () => {
+    assert.equal(normalizeUrl("http://localhost:6767"), "http://localhost:6767/");
+    assert.equal(normalizeUrl("https://example.com"), "https://example.com/");
+    assert.equal(normalizeUrl("http://example.databricks.com"), "http://example.databricks.com/");
+  });
+
+  it("trims surrounding whitespace", () => {
+    assert.equal(normalizeUrl("  example.com/omnigent  "), "https://example.com/omnigent");
+  });
+
+  it("rejects empty input", () => {
+    assert.throws(() => normalizeUrl(""), /server URL is empty/);
+    assert.throws(() => normalizeUrl("   "), /server URL is empty/);
+  });
+
+  it("rejects a non-http(s) scheme", () => {
+    assert.throws(() => normalizeUrl("ftp://example.com"), /unsupported scheme/);
+  });
+});
+
+describe("isPlainHttpRemote", () => {
+  it("does not warn for a bare remote host (now https)", () => {
+    assert.equal(isPlainHttpRemote("example.databricks.com"), false);
+    assert.equal(isPlainHttpRemote("dbc-x.cloud.databricks.com/omnigent"), false);
+  });
+
+  it("warns for an explicit http:// to a remote host", () => {
+    assert.equal(isPlainHttpRemote("http://example.databricks.com"), true);
+  });
+
+  it("does not warn for loopback hosts", () => {
+    assert.equal(isPlainHttpRemote("localhost:6767"), false);
+    assert.equal(isPlainHttpRemote("http://localhost:6767"), false);
+    assert.equal(isPlainHttpRemote("http://127.0.0.1:6767"), false);
+  });
+
+  it("does not warn for https or empty/invalid input", () => {
+    assert.equal(isPlainHttpRemote("https://example.databricks.com"), false);
+    assert.equal(isPlainHttpRemote(""), false);
+    assert.equal(isPlainHttpRemote("ht tp://nope"), false);
+  });
+});
+
+/**
+ * Run `fn` with `globalThis.fetch` swapped for `stub` and `AbortSignal.timeout`
+ * neutralized (no real timer), restoring both afterward.
+ */
+async function withFetch(stub, fn) {
+  const realFetch = globalThis.fetch;
+  const realTimeout = AbortSignal.timeout;
+  globalThis.fetch = stub;
+  AbortSignal.timeout = () => new AbortController().signal;
+  try {
+    return await fn();
+  } finally {
+    globalThis.fetch = realFetch;
+    AbortSignal.timeout = realTimeout;
+  }
+}
+
+/** A minimal Response stand-in exposing only `.headers.get`. */
+function fakeResponse(serverHeader) {
+  return { headers: { get: (name) => (name === "server" ? serverHeader : null) } };
+}
+
+describe("expandDatabricksWorkspaceUrl", () => {
+  it("expands a bare https Databricks workspace root to the UI mount", async () => {
+    const calls = [];
+    await withFetch(
+      async (url, opts) => {
+        calls.push({ url, method: opts.method });
+        return fakeResponse("databricks");
+      },
+      async () => {
+        const out = await expandDatabricksWorkspaceUrl("https://ws.cloud.databricks.com/");
+        assert.equal(out, `https://ws.cloud.databricks.com${WORKSPACE_UI_PATH}`);
+      },
+    );
+    // Probed the root with a HEAD request.
+    assert.deepEqual(calls, [{ url: "https://ws.cloud.databricks.com/", method: "HEAD" }]);
+  });
+
+  it("leaves a non-Databricks root unchanged", async () => {
+    await withFetch(
+      async () => fakeResponse("nginx"),
+      async () => {
+        assert.equal(
+          await expandDatabricksWorkspaceUrl("https://example.com"),
+          "https://example.com",
+        );
+      },
+    );
+  });
+
+  it("leaves a URL that already carries a path untouched, without probing", async () => {
+    let probed = false;
+    await withFetch(
+      async () => {
+        probed = true;
+        return fakeResponse("databricks");
+      },
+      async () => {
+        const url = "https://ws.cloud.databricks.com/omnigent";
+        assert.equal(await expandDatabricksWorkspaceUrl(url), url);
+      },
+    );
+    assert.equal(probed, false);
+  });
+
+  it("leaves a non-https URL untouched, without probing", async () => {
+    let probed = false;
+    await withFetch(
+      async () => {
+        probed = true;
+        return fakeResponse("databricks");
+      },
+      async () => {
+        assert.equal(
+          await expandDatabricksWorkspaceUrl("http://localhost:6767/"),
+          "http://localhost:6767/",
+        );
+      },
+    );
+    assert.equal(probed, false);
+  });
+
+  it("falls back to the input when the probe fails", async () => {
+    await withFetch(
+      async () => {
+        throw new Error("ECONNREFUSED");
+      },
+      async () => {
+        const url = "https://unreachable.example.com";
+        assert.equal(await expandDatabricksWorkspaceUrl(url), url);
+      },
+    );
+  });
+
+  it("returns unparseable input unchanged", async () => {
+    assert.equal(await expandDatabricksWorkspaceUrl("not a url"), "not a url");
+  });
+});

ap-web/ios/Omnigent/ChatTerminalBar.swift

@@ -18,7 +18,7 @@ struct ChatTerminalBar: View {
       segment(.chat, title: "Chat", systemImage: "message")
       segment(.terminal, title: "Terminal", systemImage: "terminal")
     }
-    .padding(4)
+    .padding(InsetMetrics.barCapsulePadding)
     .modifier(GlassCapsule(colorScheme: colorScheme))
     .animation(.easeInOut(duration: 0.18), value: mode)
     .accessibilityElement(children: .contain)
@@ -50,7 +50,7 @@ struct ChatTerminalBar: View {
           ? DesignTokens.foreground(colorScheme) : DesignTokens.mutedForeground(colorScheme)
       )
       .padding(.horizontal, 14)
-      .frame(height: 34)
+      .frame(height: InsetMetrics.barSegmentHeight)
       .background {
         if isSelected {
           Capsule(style: .continuous)

ap-web/ios/Omnigent/ConnectView.swift

@@ -55,25 +55,26 @@ struct ConnectView: View {
             }
             .submitLabel(.go)
             .onSubmit(connect)
+            .disabled(isConnecting)
         }
 
         Button(action: connect) {
           if isConnecting {
-            ProgressView()
-              .tint(primaryForeground)
+            HStack(spacing: 8) {
+              ProgressView()
+                .tint(primaryForeground)
+              Text("Connecting…")
+            }
           } else {
             Text("Connect")
           }
         }
-        .buttonStyle(.plain)
-        .font(.system(size: 14, weight: .medium))
-        .frame(maxWidth: .infinity)
-        .frame(height: 38)
-        .background(primary)
-        .foregroundStyle(primaryForeground)
-        .clipShape(RoundedRectangle(cornerRadius: DesignTokens.radius))
+        .buttonStyle(PrimaryButtonStyle(background: primary, foreground: primaryForeground))
         .padding(.top, 16)
         .disabled(isConnecting)
+        // Fires the moment connect() flips isConnecting, so the tap is
+        // acknowledged by touch even before the spinner appears.
+        .sensoryFeedback(.impact(weight: .light), trigger: isConnecting)
 
         Text(message ?? "")
           .font(.system(size: 13))
@@ -110,6 +111,7 @@ struct ConnectView: View {
             }
           }
           .padding(.top, 12)
+          .disabled(isConnecting)
         }
       }
       .frame(maxWidth: 384)
@@ -152,6 +154,28 @@ struct ConnectView: View {
   }
 }
 
+// Primary (filled) button appearance plus an instant touch-down response.
+// `.buttonStyle(.plain)` gave no press feedback, so the tap felt dead until
+// the spinner swapped in; the opacity/scale here acknowledges the press the
+// moment the finger lands.
+private struct PrimaryButtonStyle: ButtonStyle {
+  let background: Color
+  let foreground: Color
+
+  func makeBody(configuration: Configuration) -> some View {
+    configuration.label
+      .font(.system(size: 14, weight: .medium))
+      .frame(maxWidth: .infinity)
+      .frame(height: 38)
+      .background(background)
+      .foregroundStyle(foreground)
+      .clipShape(RoundedRectangle(cornerRadius: DesignTokens.radius))
+      .opacity(configuration.isPressed ? 0.85 : 1)
+      .scaleEffect(configuration.isPressed ? 0.98 : 1)
+      .animation(.easeOut(duration: 0.12), value: configuration.isPressed)
+  }
+}
+
 private let defaultServerURL: String = {
   #if DEBUG
     "http://localhost:6767"

ap-web/ios/Omnigent/OmnigentWebView.swift

@@ -42,6 +42,15 @@ struct OmnigentWebView: UIViewRepresentable {
     webView.scrollView.backgroundColor = .clear
     webView.scrollView.contentInsetAdjustmentBehavior = .never
 
+    // Allow Safari Web Inspector to attach to the web content. Since iOS 16.4 a
+    // WKWebView is inspectable only when this is opt-in. Debug-only so shipping
+    // builds aren't inspectable.
+    #if DEBUG
+      if #available(iOS 16.4, *) {
+        webView.isInspectable = true
+      }
+    #endif
+
     let edgePan = UIScreenEdgePanGestureRecognizer(
       target: context.coordinator,
       action: #selector(Coordinator.handleLeftEdgePan(_:))
@@ -135,6 +144,21 @@ struct OmnigentWebView: UIViewRepresentable {
           try { callback(mode); } catch {}
         }
       });
+      const insetCallbacks = new Set();
+      // Cache the last footprint so a subscriber that registers AFTER native
+      // first emitted (the React app mounts later than document-start) still
+      // gets the current value immediately on subscribe.
+      let lastInsets = null;
+      defineEmit("__omnigentNativeEmitInsets", (topBar, bottomBar) => {
+        const insets = {
+          topBar: typeof topBar === "number" && Number.isFinite(topBar) ? topBar : 0,
+          bottomBar: typeof bottomBar === "number" && Number.isFinite(bottomBar) ? bottomBar : 0,
+        };
+        lastInsets = insets;
+        for (const callback of insetCallbacks) {
+          try { callback(insets); } catch {}
+        }
+      });
       const sidebarDragCallbacks = new Set();
       Object.defineProperty(window, "__omnigentNativeEmitSidebarDrag", {
         configurable: false,
@@ -208,6 +232,12 @@ struct OmnigentWebView: UIViewRepresentable {
           viewModeCallbacks.add(callback);
           return () => viewModeCallbacks.delete(callback);
         },
+        onNativeInsets(callback) {
+          if (typeof callback !== "function") return () => {};
+          insetCallbacks.add(callback);
+          if (lastInsets) { try { callback(lastInsets); } catch {} }
+          return () => insetCallbacks.delete(callback);
+        },
       });
     })();
     """
@@ -230,6 +260,7 @@ struct OmnigentWebView: UIViewRepresentable {
     }
 
     func detach() {
+      parent.model.cancelServerSwitcherWatchdog()
       webView = nil
     }
 
@@ -284,6 +315,9 @@ struct OmnigentWebView: UIViewRepresentable {
       _ userContentController: WKUserContentController, didReceive message: WKScriptMessage
     ) {
       guard isTrustedBridgeMessage(message) else { return }
+      // Any trusted message proves the page is alive and driving the bridge, so
+      // stand down the liveness watchdog — the page owns the switcher from here.
+      parent.model.cancelServerSwitcherWatchdog()
       guard let body = message.body as? [String: Any],
         let method = body["method"] as? String
       else { return }
@@ -322,6 +356,7 @@ struct OmnigentWebView: UIViewRepresentable {
       parent.model.isLoading = true
       parent.model.currentURL = webView.url ?? parent.model.currentURL
       parent.model.serverSwitcherHidden = true
+      parent.model.armServerSwitcherWatchdog()
     }
 
     func webView(_ webView: WKWebView, didCommit navigation: WKNavigation!) {
@@ -468,6 +503,7 @@ struct OmnigentWebView: UIViewRepresentable {
       let nsError = error as NSError
       guard nsError.code != NSURLErrorCancelled else { return }
       parent.model.isLoading = false
+      parent.model.cancelServerSwitcherWatchdog()
 
       let failedURL = failedURL(from: nsError) ?? webView.url ?? pinnedURL ?? parent.initialURL
       guard failedURL.omnigentOrigin == pinnedOrigin else { return }

ap-web/ios/Omnigent/WebShellView.swift

@@ -33,7 +33,7 @@ struct WebShellView: View {
           connectToNewServer: connectToNewServer,
           reload: model.reload
         )
-        .padding(.top, 8)
+        .padding(.top, InsetMetrics.serverSwitcherTopPadding)
         .opacity(model.serverSwitcherHidden ? 0 : 1)
         .scaleEffect(model.serverSwitcherHidden ? 0.96 : 1, anchor: .top)
         .allowsHitTesting(!model.serverSwitcherHidden)
@@ -56,7 +56,7 @@ struct WebShellView: View {
             model.emitViewModeChanged(newMode)
           }
         )
-        .padding(.bottom, 6)
+        .padding(.bottom, InsetMetrics.barBottomPadding)
         .opacity(model.bottomBarVisible ? 1 : 0)
         .allowsHitTesting(model.bottomBarVisible)
         .accessibilityHidden(!model.bottomBarVisible)
@@ -69,6 +69,16 @@ struct WebShellView: View {
         model.emitNotificationActivation(path)
       }
     }
+    .onChange(of: model.isLoading) { _, loading in
+      // Re-push the native bar footprints once each load completes; the JS
+      // bridge caches the value so a later-mounting subscriber still gets it.
+      if !loading {
+        model.emitInsets(
+          topBar: InsetMetrics.topBarFootprint,
+          bottomBar: InsetMetrics.bottomBarFootprint
+        )
+      }
+    }
   }
 
   private func switchServer(_ urlString: String) {
@@ -141,7 +151,7 @@ private struct ServerSwitcher: View {
       .font(.system(size: 12))
       .foregroundStyle(DesignTokens.foreground(colorScheme))
       .padding(.horizontal, 10)
-      .frame(height: 28)
+      .frame(height: InsetMetrics.serverSwitcherHeight)
       .frame(maxWidth: maxWidth)
       .contentShape(RoundedRectangle(cornerRadius: 9, style: .continuous))
     }
@@ -166,3 +176,25 @@ private enum ServerSwitcherMetrics {
     min(172, max(120, containerWidth * 0.38))
   }
 }
+
+/// Single source of truth for the floating native bars' dimensions. These drive
+/// both the SwiftUI layout (the `.frame`/`.padding` calls above and in
+/// `ChatTerminalBar`) and the footprint pushed to the web layer via
+/// `WebViewModel.emitInsets`, so the web's content insets can never drift from
+/// the bars' real size. Values are CSS points, excluding the OS safe area (the
+/// web layer adds that with `env(safe-area-inset-*)`).
+enum InsetMetrics {
+  // Server switcher — the top floating pill.
+  static let serverSwitcherHeight: CGFloat = 28
+  static let serverSwitcherTopPadding: CGFloat = 8
+  static var topBarFootprint: CGFloat { serverSwitcherHeight + serverSwitcherTopPadding }
+
+  // Chat/Terminal bar — the bottom floating capsule. The capsule wraps the
+  // segment row (`barSegmentHeight`) in `barCapsulePadding` on every side.
+  static let barSegmentHeight: CGFloat = 34
+  static let barCapsulePadding: CGFloat = 4
+  static let barBottomPadding: CGFloat = 6
+  static var bottomBarFootprint: CGFloat {
+    barSegmentHeight + barCapsulePadding * 2 + barBottomPadding
+  }
+}

ap-web/ios/Omnigent/WebViewModel.swift

@@ -24,10 +24,39 @@ final class WebViewModel: ObservableObject {
 
   weak var webView: WKWebView?
 
+  /// How long, after a navigation begins, we wait for the web app to prove it's
+  /// alive by talking over the JS bridge. If the page never speaks within this
+  /// window — a blank render, crashed JS, or a hang that never reaches
+  /// `didFinish` — we surface the server switcher so the user is never stranded
+  /// on a broken page with no way back to server selection.
+  private static let bridgeLivenessTimeout: TimeInterval = 6
+
+  private var serverSwitcherWatchdog: Task<Void, Never>?
+
   func reload() {
     webView?.reload()
   }
 
+  /// Arm (or re-arm) the liveness watchdog. Called whenever a navigation
+  /// begins. The switcher has just been hidden for the load; if the page never
+  /// claims it back over the bridge, the watchdog reveals it as an escape hatch.
+  func armServerSwitcherWatchdog() {
+    serverSwitcherWatchdog?.cancel()
+    serverSwitcherWatchdog = Task { @MainActor [weak self] in
+      try? await Task.sleep(nanoseconds: UInt64(Self.bridgeLivenessTimeout * 1_000_000_000))
+      guard !Task.isCancelled, let self else { return }
+      self.serverSwitcherHidden = false
+      self.serverSwitcherWatchdog = nil
+    }
+  }
+
+  /// Stand the watchdog down. Called the moment the page proves it's alive over
+  /// the bridge, and when a load fails (we route to server selection anyway).
+  func cancelServerSwitcherWatchdog() {
+    serverSwitcherWatchdog?.cancel()
+    serverSwitcherWatchdog = nil
+  }
+
   func emitNotificationActivation(_ path: String) {
     guard path.starts(with: "/") else { return }
     let script =
@@ -35,6 +64,17 @@ final class WebViewModel: ObservableObject {
     webView?.evaluateJavaScript(script)
   }
 
+  /// Push the footprint (in CSS px, excluding the OS safe area which the web
+  /// layer adds via `env()`) of the native floating bars to the web app. The
+  /// web side folds these into its `--omnigent-inset-*` variables so page
+  /// content reserves the right amount of space — making native bar dimensions
+  /// the single source of truth instead of magic numbers duplicated in CSS.
+  func emitInsets(topBar: CGFloat, bottomBar: CGFloat) {
+    let script =
+      "window.__omnigentNativeEmitInsets?.(\(jsNumber(topBar)), \(jsNumber(bottomBar)));"
+    webView?.evaluateJavaScript(script)
+  }
+
   /// Tell the web app the user tapped a segment in the native switcher.
   func emitViewModeChanged(_ mode: WebViewMode) {
     let script =
@@ -49,6 +89,12 @@ final class WebViewModel: ObservableObject {
     webView?.evaluateJavaScript(script)
   }
 
+  /// Format a CGFloat as a bare JS number literal (no units, finite-guarded).
+  private func jsNumber(_ value: CGFloat) -> String {
+    guard value.isFinite else { return "0" }
+    return String(format: "%g", Double(value))
+  }
+
   static func javascriptString(_ value: String) -> String {
     guard let data = try? JSONEncoder().encode(value),
       let encoded = String(data: data, encoding: .utf8)

ap-web/package-lock.json

@@ -2264,9 +2264,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2284,9 +2281,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2304,9 +2298,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2324,9 +2315,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2344,9 +2332,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2364,9 +2349,6 @@
         "s390x"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2384,9 +2366,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2404,9 +2383,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4918,9 +4894,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4938,9 +4911,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4958,9 +4928,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4978,9 +4945,6 @@
         "s390x"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4998,9 +4962,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5018,9 +4979,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5566,9 +5524,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5586,9 +5541,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5606,9 +5558,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5626,9 +5575,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -11374,9 +11320,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -11398,9 +11341,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -11422,9 +11362,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -11446,9 +11383,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [

ap-web/src/App.tsx

@@ -26,6 +26,9 @@ const ApprovePage = lazy(() =>
   import("@/pages/ApprovePage").then((m) => ({ default: m.ApprovePage })),
 );
 const InboxPage = lazy(() => import("@/pages/InboxPage").then((m) => ({ default: m.InboxPage })));
+const SettingsPage = lazy(() =>
+  import("@/pages/SettingsPage").then((m) => ({ default: m.SettingsPage })),
+);
 
 interface AppProps {
   /**
@@ -120,6 +123,13 @@ function App({ basename }: AppProps = {}) {
           <Route path={prefix || "/"} element={<ChatPage />} />
           <Route path={`${prefix}/c/:conversationId`} element={<ChatPage />} />
           <Route path={`${prefix}/inbox`} element={<InboxPage />} />
+          {/* Settings renders into the chat outlet so the conversations
+              sidebar stays put — entering settings only swaps the card's
+              content (the section nav) and the main area. The active section
+              is carried in the URL (/settings/<section>); bare /settings
+              defaults to Appearance. */}
+          <Route path={`${prefix}/settings`} element={<SettingsPage />} />
+          <Route path={`${prefix}/settings/:section`} element={<SettingsPage />} />
           {info.accounts_enabled && (
             <>
               <Route path={`${prefix}/members`} element={<MembersPage />} />

ap-web/src/components/AgentCard.test.tsx

@@ -20,7 +20,9 @@ vi.mock("@/components/icons/CodexIcon", () => ({ CodexIcon: stub("codex") }));
 vi.mock("@/components/icons/CursorIcon", () => ({ CursorIcon: stub("cursor") }));
 vi.mock("@/components/icons/GooseIcon", () => ({ GooseIcon: stub("goose") }));
 vi.mock("@/components/icons/NessieIcon", () => ({ NessieIcon: stub("nessie") }));
+vi.mock("@/components/icons/OpenCodeIcon", () => ({ OpenCodeIcon: stub("opencode") }));
 vi.mock("@/components/icons/PiIcon", () => ({ PiIcon: stub("pi") }));
+vi.mock("@/components/icons/AntigravityIcon", () => ({ AntigravityIcon: stub("antigravity") }));
 vi.mock("lucide-react", () => ({ BotIcon: stub("bot") }));
 
 function agent(overrides: Partial<AvailableAgent> = {}): AvailableAgent {
@@ -48,6 +50,7 @@ describe("AgentCard icon selection", () => {
     // "design-reviewer" must still read as Codex, not fall back to bot.
     { name: "design-reviewer", harness: "codex", expected: "codex" },
     { name: "codex-native-ui", harness: "codex-native", expected: "codex" },
+    { name: "opencode-native-ui", harness: "opencode-native", expected: "opencode" },
     { name: "claude-native-ui", harness: "claude-native", expected: "claude" },
     { name: "pi-native-ui", harness: "pi-native", expected: "pi" },
     { name: "cursor-native-ui", harness: "cursor-native", expected: "cursor" },
@@ -58,6 +61,9 @@ describe("AgentCard icon selection", () => {
     { name: "x", harness: "goose", expected: "goose" },
     // The SDK "cursor" harness also reads as Cursor via the harness fallback.
     { name: "x", harness: "cursor", expected: "cursor" },
+    { name: "antigravity-native-ui", harness: "antigravity-native", expected: "antigravity" },
+    // The in-process Antigravity SDK harness shares the same glyph.
+    { name: "x", harness: "antigravity", expected: "antigravity" },
     { name: "x", harness: "claude-sdk", expected: "claude" },
     { name: "pi", harness: "pi", expected: "pi" },
     // The pi match is exact: a harness merely containing "pi" stays generic.

ap-web/src/components/AgentCard.tsx

@@ -1,9 +1,12 @@
 import { BotIcon } from "lucide-react";
+import { AntigravityIcon } from "@/components/icons/AntigravityIcon";
 import { ClaudeIcon } from "@/components/icons/ClaudeIcon";
 import { CodexIcon } from "@/components/icons/CodexIcon";
 import { CursorIcon } from "@/components/icons/CursorIcon";
 import { GooseIcon } from "@/components/icons/GooseIcon";
+import { KimiIcon } from "@/components/icons/KimiIcon";
 import { NessieIcon } from "@/components/icons/NessieIcon";
+import { OpenCodeIcon } from "@/components/icons/OpenCodeIcon";
 import { PiIcon } from "@/components/icons/PiIcon";
 import type { ComponentType, SVGProps } from "react";
 import type { AvailableAgent } from "@/hooks/useAvailableAgents";
@@ -28,18 +31,28 @@ function iconForAgent(agent: AvailableAgent): ComponentType<SVGProps<SVGSVGEleme
   const nativeAgent = nativeCodingAgentForAvailableAgent(agent);
   if (nativeAgent?.iconKind === "claude") return ClaudeIcon;
   if (nativeAgent?.iconKind === "codex") return CodexIcon;
+  if (nativeAgent?.iconKind === "opencode") return OpenCodeIcon;
   if (nativeAgent?.iconKind === "pi") return PiIcon;
   if (nativeAgent?.iconKind === "cursor") return CursorIcon;
+  if (nativeAgent?.iconKind === "kiro") return CursorIcon;
   if (nativeAgent?.iconKind === "goose") return GooseIcon;
+  if (nativeAgent?.iconKind === "kimi") return KimiIcon;
+  if (nativeAgent?.iconKind === "antigravity") return AntigravityIcon;
   // A null harness (spec couldn't load) flows through to the bot fallback.
   if (agent.harness?.includes("codex")) return CodexIcon;
   if (agent.harness?.includes("claude")) return ClaudeIcon;
   // Both the SDK "cursor" harness and "cursor-native" get the Cursor glyph.
   if (agent.harness?.includes("cursor")) return CursorIcon;
+  if (agent.harness?.includes("kiro")) return CursorIcon;
   if (agent.harness?.includes("goose")) return GooseIcon;
+  // Both the SDK "kimi"/"kimi-code" harness and "kimi-native" get the Kimi glyph.
+  if (agent.harness?.includes("kimi")) return KimiIcon;
   // qwen falls back to generic BotIcon for now; see docs/QWEN_FOLLOWUPS.md
   // Exact match — a substring check would false-match e.g. "openapi".
   if (agent.harness === "pi") return PiIcon;
+  // Both the native (`antigravity-native`) and SDK (`antigravity`) harnesses
+  // share the Antigravity glyph.
+  if (agent.harness?.includes("antigravity")) return AntigravityIcon;
   return BotIcon;
 }
 

ap-web/src/components/AgentInfo.test.tsx

@@ -13,14 +13,41 @@ const { addMutate, deleteMutate, copyTextMock } = vi.hoisted(() => ({
   deleteMutate: vi.fn(),
   copyTextMock: vi.fn(() => Promise.resolve()),
 }));
+const { createMcpMutate, updateMcpMutate, deleteMcpMutate } = vi.hoisted(() => ({
+  createMcpMutate: vi.fn((_payload, options?: { onSuccess?: () => void }) =>
+    options?.onSuccess?.(),
+  ),
+  updateMcpMutate: vi.fn((_payload, options?: { onSuccess?: () => void }) =>
+    options?.onSuccess?.(),
+  ),
+  deleteMcpMutate: vi.fn(),
+}));
 const policiesData = { current: [] as unknown[] };
 const registryData = { current: [] as unknown[] };
+// Session owner + viewer identity, controllable per test. Dereferenced lazily
+// inside the mock hooks (same pattern as policiesData) so the closures are safe
+// despite vi.mock hoisting. Default null → no owner row, keeping the pre-existing
+// cost/id/usage tests untouched.
+const ownerData = { current: null as string | null | undefined };
+const viewerData = { current: null as string | null };
 vi.mock("@/hooks/usePolicies", () => ({
   usePolicies: () => ({ data: policiesData.current }),
   usePolicyRegistry: () => ({ data: registryData.current }),
   useAddPolicy: () => ({ mutate: addMutate, isPending: false, isError: false, error: null }),
   useDeletePolicy: () => ({ mutate: deleteMutate }),
 }));
+vi.mock("@/hooks/useAgents", () => ({
+  useCreateMcpServer: () => ({ mutate: createMcpMutate, isPending: false, error: null }),
+  useUpdateMcpServer: () => ({ mutate: updateMcpMutate, isPending: false, error: null }),
+  useDeleteMcpServer: () => ({ mutate: deleteMcpMutate, isPending: false, error: null }),
+}));
+vi.mock("@/hooks/usePermissions", () => ({
+  useSessionOwner: () => ({ data: ownerData.current }),
+}));
+vi.mock("@/lib/identity", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@/lib/identity")>()),
+  getCurrentUserId: () => viewerData.current,
+}));
 vi.mock("@/lib/clipboard", () => ({ copyText: copyTextMock }));
 
 import { AgentInfoButton, AgentInfoContent, agentDisplayLabel } from "./AgentInfo";
@@ -28,6 +55,11 @@ import { AgentInfoButton, AgentInfoContent, agentDisplayLabel } from "./AgentInf
 afterEach(() => {
   cleanup();
   copyTextMock.mockClear();
+  createMcpMutate.mockClear();
+  updateMcpMutate.mockClear();
+  deleteMcpMutate.mockClear();
+  ownerData.current = null;
+  viewerData.current = null;
 });
 
 function renderButton(agent: Agent | undefined) {
@@ -61,6 +93,7 @@ const AGENT_WITH_BOTH: Agent = {
   id: "agent_1",
   name: "databricks_coding_agent",
   description: "Codes against Databricks.",
+  mcp_servers_editable: true,
   mcp_servers: [
     { name: "slack", transport: "http", description: "Slack MCP", url: "https://example/slack" },
     { name: "jira", transport: "stdio", command: "jira-mcp" },
@@ -173,6 +206,54 @@ describe("AgentInfoButton session id row", () => {
   });
 });
 
+describe("AgentInfoButton session owner row", () => {
+  // The owner row lets a viewer see whose session a shared chat is. It reads
+  // the owner via useSessionOwner (mocked) and the viewer via getCurrentUserId
+  // (mocked); both reset to null in afterEach.
+
+  it("shows the session owner in the popover when one is known", () => {
+    ownerData.current = "alice@example.com";
+    renderButtonWithSession(AGENT_WITH_BOTH, "conv_owner");
+    // Closed popover: the owner row is not mounted yet.
+    expect(screen.queryByTestId("agent-info-session-owner")).toBeNull();
+
+    fireEvent.click(screen.getByTestId("agent-info-trigger"));
+
+    expect(screen.getByTestId("agent-info-session-owner")).toHaveTextContent("alice@example.com");
+  });
+
+  it("appends (you) when the viewer owns the session", () => {
+    ownerData.current = "alice@example.com";
+    viewerData.current = "alice@example.com";
+    renderButtonWithSession(AGENT_WITH_BOTH, "conv_owner");
+    fireEvent.click(screen.getByTestId("agent-info-trigger"));
+
+    const row = screen.getByTestId("agent-info-session-owner");
+    expect(row).toHaveTextContent("alice@example.com");
+    expect(row).toHaveTextContent("(you)");
+  });
+
+  it("omits (you) when someone else owns the session", () => {
+    ownerData.current = "alice@example.com";
+    viewerData.current = "bob@example.com";
+    renderButtonWithSession(AGENT_WITH_BOTH, "conv_owner");
+    fireEvent.click(screen.getByTestId("agent-info-trigger"));
+
+    const row = screen.getByTestId("agent-info-session-owner");
+    expect(row).toHaveTextContent("alice@example.com");
+    expect(row).not.toHaveTextContent("(you)");
+  });
+
+  it("omits the owner row when no owner is known (permissions off / loading)", () => {
+    // owner null → no row at all, rather than an empty placeholder. The rest of
+    // the popover still renders (agent name proves it opened).
+    renderButtonWithSession(AGENT_WITH_BOTH, "conv_owner");
+    fireEvent.click(screen.getByTestId("agent-info-trigger"));
+    expect(screen.getByText("Databricks_coding_agent")).toBeInTheDocument();
+    expect(screen.queryByTestId("agent-info-session-owner")).toBeNull();
+  });
+});
+
 describe("AgentInfoButton per-model usage breakdown", () => {
   // The breakdown reads `sessionUsageByModel` from the store; reset between
   // cases so they stay independent.
@@ -246,6 +327,42 @@ describe("AgentInfoButton per-model usage breakdown", () => {
     expect(screen.getByText("Databricks_coding_agent")).toBeInTheDocument();
     expect(screen.queryByTestId("agent-info-usage-by-model")).toBeNull();
   });
+
+  it("toggles the arrow indicator when expanding/collapsing the details", () => {
+    useChatStore.setState({
+      sessionUsageByModel: {
+        "claude-sonnet-4-6": {
+          inputTokens: 1000,
+          outputTokens: 500,
+          totalTokens: 1500,
+          cacheReadInputTokens: null,
+          cacheCreationInputTokens: null,
+          totalCostUsd: 0.1,
+        },
+      },
+    });
+    renderButtonWithSession(AGENT_WITH_BOTH, "conv_arrow");
+    fireEvent.click(screen.getByTestId("agent-info-trigger"));
+
+    const details = screen.getByTestId("agent-info-usage-by-model") as HTMLDetailsElement;
+    const summary = details.querySelector("summary")!;
+
+    // Initially collapsed — arrow points right.
+    expect(summary).toHaveTextContent("▶");
+    expect(summary).not.toHaveTextContent("▼");
+
+    // Expand the details by setting the open attribute and firing toggle.
+    details.open = true;
+    fireEvent(details, new Event("toggle"));
+    expect(summary).toHaveTextContent("▼");
+    expect(summary).not.toHaveTextContent("▶");
+
+    // Collapse again.
+    details.open = false;
+    fireEvent(details, new Event("toggle"));
+    expect(summary).toHaveTextContent("▶");
+    expect(summary).not.toHaveTextContent("▼");
+  });
 });
 
 // ---------------------------------------------------------------------------
@@ -376,11 +493,86 @@ describe("SessionPoliciesSection", () => {
   });
 });
 
+describe("McpServersSection", () => {
+  beforeEach(() => {
+    createMcpMutate.mockClear();
+    updateMcpMutate.mockClear();
+    deleteMcpMutate.mockClear();
+  });
+
+  it("creates an HTTP MCP server from the manager dialog", () => {
+    renderContent("conv_mcp");
+
+    fireEvent.click(screen.getByRole("button", { name: "Manage MCP servers" }));
+    const dialog = screen.getByRole("dialog");
+    fireEvent.change(within(dialog).getByLabelText("Name"), { target: { value: "github" } });
+    fireEvent.change(within(dialog).getByLabelText("URL"), {
+      target: { value: "https://example.com/sse" },
+    });
+    fireEvent.click(within(dialog).getByRole("button", { name: /Save/ }));
+
+    expect(createMcpMutate).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: "github",
+        transport: "http",
+        url: "https://example.com/sse",
+      }),
+      expect.anything(),
+    );
+  });
+
+  it("updates an existing stdio MCP server", () => {
+    renderContent("conv_mcp");
+
+    fireEvent.click(screen.getByRole("button", { name: "Manage MCP servers" }));
+    const dialog = screen.getByRole("dialog");
+    fireEvent.click(within(dialog).getByRole("button", { name: "Edit jira" }));
+    fireEvent.change(within(dialog).getByLabelText("Command"), {
+      target: { value: "jira-mcp-new" },
+    });
+    fireEvent.click(within(dialog).getByRole("button", { name: /Save/ }));
+
+    expect(updateMcpMutate).toHaveBeenCalledWith(
+      {
+        serverName: "jira",
+        payload: expect.objectContaining({
+          name: "jira",
+          transport: "stdio",
+          command: "jira-mcp-new",
+        }),
+      },
+      expect.anything(),
+    );
+  });
+
+  it("deletes an MCP server from the manager dialog", () => {
+    renderContent("conv_mcp");
+
+    fireEvent.click(screen.getByRole("button", { name: "Manage MCP servers" }));
+    const dialog = screen.getByRole("dialog");
+    fireEvent.click(within(dialog).getByRole("button", { name: "Delete slack" }));
+
+    expect(deleteMcpMutate).toHaveBeenCalledWith("slack", expect.anything());
+  });
+
+  it("deletes an MCP server from the inline pill popover", () => {
+    renderContent("conv_mcp");
+
+    // Click the pill to open its popover
+    fireEvent.click(screen.getByRole("button", { name: "slack" }));
+    // Click "Remove" in the popover
+    fireEvent.click(screen.getByRole("button", { name: /Remove/ }));
+
+    expect(deleteMcpMutate).toHaveBeenCalledWith("slack", expect.anything());
+  });
+});
+
 describe("agentDisplayLabel", () => {
   it("maps native wrapper slugs to their display name", () => {
     expect(agentDisplayLabel("pi-native-ui")).toBe("Pi");
     expect(agentDisplayLabel("claude-native-ui")).toBe("Claude");
     expect(agentDisplayLabel("codex-native-ui")).toBe("Codex");
+    expect(agentDisplayLabel("antigravity-native-ui")).toBe("Antigravity");
   });
 
   it("strips the fork/switch clone suffix before resolving the native label", () => {

ap-web/src/components/AgentInfo.tsx

@@ -5,14 +5,24 @@ import { useEffect, useRef, useState } from "react";
 import {
   CheckIcon,
   CopyIcon,
+  PencilIcon,
   InfoIcon,
   PlusIcon,
+  SaveIcon,
   ServerIcon,
   ShieldCheckIcon,
   TrashIcon,
+  XIcon,
 } from "lucide-react";
+import {
+  useCreateMcpServer,
+  useDeleteMcpServer,
+  useUpdateMcpServer,
+  type UpsertMcpServerInput,
+} from "@/hooks/useAgents";
 import type { Agent, McpServerSummary } from "@/hooks/useAgents";
 import type { ModelUsage } from "@/lib/types";
+import { showToast } from "@/components/ui/toast";
 import {
   usePolicies,
   usePolicyRegistry,
@@ -20,7 +30,11 @@ import {
   useDeletePolicy,
   type PolicyRegistryEntry,
 } from "@/hooks/usePolicies";
+import { useSessionOwner } from "@/hooks/usePermissions";
+import { getCurrentUserId } from "@/lib/identity";
 import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Textarea } from "@/components/ui/textarea";
 import {
   Dialog,
   DialogContent,
@@ -59,19 +73,64 @@ export function agentDisplayLabel(name: string): string {
 }
 
 /** Compact pill row listing MCP servers attached to an agent. */
-export function McpServerList({ servers }: { servers: McpServerSummary[] }) {
+export function McpServerList({
+  servers,
+  onDelete,
+}: {
+  servers: McpServerSummary[];
+  onDelete?: (name: string) => void;
+}) {
   return (
     <div className="flex flex-wrap gap-1">
-      {servers.map((srv) => (
-        <span
-          key={srv.name}
-          title={srv.description ?? srv.name}
-          className="flex items-center gap-0.5 rounded-full border border-border bg-muted px-1.5 py-0.5 font-mono text-[10px] text-muted-foreground"
-        >
-          <ServerIcon className="size-2.5 shrink-0" />
-          {srv.name}
-        </span>
-      ))}
+      {servers.map((srv) =>
+        onDelete ? (
+          <Popover key={srv.name}>
+            <PopoverTrigger asChild>
+              <button
+                type="button"
+                className="flex cursor-pointer items-center gap-0.5 rounded-full border border-border bg-muted px-1.5 py-0.5 font-mono text-[10px] text-muted-foreground hover:bg-muted/80"
+                onClick={(e) => e.stopPropagation()}
+              >
+                <ServerIcon className="size-2.5 shrink-0" />
+                {srv.name}
+              </button>
+            </PopoverTrigger>
+            <PopoverContent
+              side="top"
+              align="start"
+              className="w-64"
+              onClick={(e) => e.stopPropagation()}
+            >
+              <div className="flex flex-col gap-2">
+                <div className="flex items-center gap-1.5">
+                  <ServerIcon className="size-3.5 text-muted-foreground" />
+                  <span className="font-medium text-sm">{srv.name}</span>
+                </div>
+                {srv.description && (
+                  <p className="text-xs text-muted-foreground">{srv.description}</p>
+                )}
+                <button
+                  type="button"
+                  onClick={() => onDelete(srv.name)}
+                  className="flex items-center gap-1 self-end rounded px-2 py-1 text-xs text-destructive hover:bg-destructive/10"
+                >
+                  <TrashIcon className="size-3" />
+                  Remove
+                </button>
+              </div>
+            </PopoverContent>
+          </Popover>
+        ) : (
+          <span
+            key={srv.name}
+            title={srv.description ?? srv.name}
+            className="flex items-center gap-0.5 rounded-full border border-border bg-muted px-1.5 py-0.5 font-mono text-[10px] text-muted-foreground"
+          >
+            <ServerIcon className="size-2.5 shrink-0" />
+            {srv.name}
+          </span>
+        ),
+      )}
     </div>
   );
 }
@@ -128,18 +187,22 @@ const MODEL_TOKEN_ROWS: ReadonlyArray<{ key: keyof ModelUsage; label: string }>
  * @param usageByModel - Map of raw harness model id to its cumulative usage.
  */
 function ModelUsageBreakdown({ usageByModel }: { usageByModel: Record<string, ModelUsage> }) {
+  const [isOpen, setIsOpen] = useState(false);
   // Stable display order: most total tokens first, so the dominant model
   // leads. Falls back to 0 for models that haven't recorded a total yet.
   const models = Object.entries(usageByModel).sort(
     ([, a], [, b]) => (b.totalTokens ?? 0) - (a.totalTokens ?? 0),
   );
   return (
-    <details data-testid="agent-info-usage-by-model">
+    <details
+      data-testid="agent-info-usage-by-model"
+      onToggle={(e) => setIsOpen(e.currentTarget.open)}
+    >
       <summary className="cursor-pointer select-none list-none">
         <SectionLabel>
           <span className="inline-flex items-center gap-1">
             Token usage
-            <span className="text-[9px]">▶</span>
+            <span className="text-[9px]">{isOpen ? "▼" : "▶"}</span>
           </span>
         </SectionLabel>
       </summary>
@@ -504,6 +567,375 @@ function AddPolicyDialog({
   );
 }
 
+// ---------------------------------------------------------------------------
+// MCP server management
+// ---------------------------------------------------------------------------
+
+interface McpFormState {
+  originalName: string | null;
+  name: string;
+  transport: "http" | "stdio";
+  description: string;
+  url: string;
+  command: string;
+  argsText: string;
+}
+
+const EMPTY_MCP_FORM: McpFormState = {
+  originalName: null,
+  name: "",
+  transport: "http",
+  description: "",
+  url: "",
+  command: "",
+  argsText: "",
+};
+
+function mcpFormFromServer(server: McpServerSummary): McpFormState {
+  return {
+    originalName: server.name,
+    name: server.name,
+    transport: server.transport === "stdio" ? "stdio" : "http",
+    description: server.description ?? "",
+    url: server.url ?? "",
+    command: server.command ?? "",
+    argsText: (server.args ?? []).join("\n"),
+  };
+}
+
+function payloadFromMcpForm(form: McpFormState): UpsertMcpServerInput {
+  const base = {
+    name: form.name.trim(),
+    transport: form.transport,
+    description: form.description.trim() || null,
+  };
+  if (form.transport === "http") {
+    return {
+      ...base,
+      transport: "http",
+      url: form.url.trim(),
+      command: null,
+      args: [],
+    };
+  }
+  return {
+    ...base,
+    transport: "stdio",
+    url: null,
+    command: form.command.trim(),
+    args: form.argsText
+      .split("\n")
+      .map((arg) => arg.trim())
+      .filter(Boolean),
+  };
+}
+
+function validateMcpForm(form: McpFormState): string | null {
+  const name = form.name.trim();
+  if (!name) return "Name is required.";
+  if (!/^[A-Za-z0-9_-][A-Za-z0-9_.-]{0,127}$/.test(name)) {
+    return "Name can use letters, numbers, dots, dashes, and underscores.";
+  }
+  if (form.transport === "http") {
+    const url = form.url.trim();
+    if (!url) return "URL is required.";
+    if (!url.startsWith("http://") && !url.startsWith("https://")) {
+      return "URL must start with http:// or https://.";
+    }
+  }
+  if (form.transport === "stdio" && !form.command.trim()) {
+    return "Command is required.";
+  }
+  return null;
+}
+
+function McpServerManagerDialog({
+  sessionId,
+  servers,
+  open,
+  onOpenChange,
+}: {
+  sessionId: string;
+  servers: McpServerSummary[];
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+}) {
+  const [form, setForm] = useState<McpFormState>(EMPTY_MCP_FORM);
+  const [formError, setFormError] = useState<string | null>(null);
+  const createServer = useCreateMcpServer(sessionId);
+  const updateServer = useUpdateMcpServer(sessionId);
+  const deleteServer = useDeleteMcpServer(sessionId);
+  const mutationError =
+    createServer.error?.message ?? updateServer.error?.message ?? deleteServer.error?.message;
+  const saving = createServer.isPending || updateServer.isPending;
+
+  function resetForm() {
+    setForm(EMPTY_MCP_FORM);
+    setFormError(null);
+  }
+
+  function notifyRestart() {
+    showToast(
+      <span className="text-sm">MCP servers updated. Restart the session to apply changes.</span>,
+    );
+  }
+
+  function handleSave() {
+    const error = validateMcpForm(form);
+    if (error) {
+      setFormError(error);
+      return;
+    }
+    const payload = payloadFromMcpForm(form);
+    setFormError(null);
+    if (form.originalName) {
+      updateServer.mutate(
+        { serverName: form.originalName, payload },
+        {
+          onSuccess: () => {
+            resetForm();
+            notifyRestart();
+          },
+        },
+      );
+      return;
+    }
+    createServer.mutate(payload, {
+      onSuccess: () => {
+        resetForm();
+        notifyRestart();
+      },
+    });
+  }
+
+  return (
+    <Dialog
+      open={open}
+      onOpenChange={(next) => {
+        onOpenChange(next);
+        if (!next) resetForm();
+      }}
+    >
+      <DialogContent className="max-h-[85vh] overflow-y-auto sm:max-w-lg">
+        <DialogHeader>
+          <DialogTitle>Manage MCP Servers</DialogTitle>
+          <DialogDescription>Add, edit, or remove MCP servers for this session.</DialogDescription>
+        </DialogHeader>
+        <div className="grid gap-4 pt-1 md:grid-cols-[minmax(0,0.9fr)_minmax(0,1.1fr)]">
+          <div className="flex min-w-0 flex-col gap-1.5">
+            <SectionLabel>Servers</SectionLabel>
+            {servers.length > 0 ? (
+              <div className="flex max-h-56 flex-col divide-y divide-border overflow-y-auto rounded border border-border">
+                {servers.map((server) => (
+                  <div key={server.name} className="flex min-w-0 items-center gap-1.5 px-2 py-2">
+                    <ServerIcon className="size-3.5 shrink-0 text-muted-foreground" />
+                    <button
+                      type="button"
+                      onClick={() => {
+                        setForm(mcpFormFromServer(server));
+                        setFormError(null);
+                      }}
+                      className="min-w-0 flex-1 text-left"
+                    >
+                      <span className="block truncate font-mono text-xs">{server.name}</span>
+                      <span className="block truncate text-[11px] text-muted-foreground">
+                        {server.transport}
+                      </span>
+                    </button>
+                    <Button
+                      type="button"
+                      variant="ghost"
+                      size="icon-xs"
+                      aria-label={`Edit ${server.name}`}
+                      onClick={() => {
+                        setForm(mcpFormFromServer(server));
+                        setFormError(null);
+                      }}
+                    >
+                      <PencilIcon className="size-3" />
+                    </Button>
+                    <Button
+                      type="button"
+                      variant="ghost"
+                      size="icon-xs"
+                      aria-label={`Delete ${server.name}`}
+                      onClick={() => deleteServer.mutate(server.name, { onSuccess: notifyRestart })}
+                      disabled={deleteServer.isPending}
+                    >
+                      <TrashIcon className="size-3 text-destructive" />
+                    </Button>
+                  </div>
+                ))}
+              </div>
+            ) : (
+              <p className="py-3 text-xs text-muted-foreground">No MCP servers</p>
+            )}
+            {form.originalName && (
+              <Button type="button" variant="ghost" size="sm" onClick={resetForm}>
+                <PlusIcon className="size-3.5" />
+                New server
+              </Button>
+            )}
+          </div>
+
+          <div className="flex min-w-0 flex-col gap-2">
+            <SectionLabel>{form.originalName ? "Edit Server" : "New Server"}</SectionLabel>
+            <label className="flex flex-col gap-1 text-xs text-muted-foreground">
+              Name
+              <Input
+                value={form.name}
+                onChange={(e) => setForm((prev) => ({ ...prev, name: e.target.value }))}
+                className="font-mono"
+                placeholder="github"
+              />
+            </label>
+            <label className="flex flex-col gap-1 text-xs text-muted-foreground">
+              Transport
+              <select
+                value={form.transport}
+                onChange={(e) =>
+                  setForm((prev) => ({
+                    ...prev,
+                    transport: e.target.value === "stdio" ? "stdio" : "http",
+                  }))
+                }
+                className="h-8 rounded-lg border border-input bg-background px-2 text-sm text-foreground outline-none focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50"
+              >
+                <option value="http">HTTP</option>
+                <option value="stdio">stdio</option>
+              </select>
+            </label>
+            {form.transport === "http" ? (
+              <label className="flex flex-col gap-1 text-xs text-muted-foreground">
+                URL
+                <Input
+                  value={form.url}
+                  onChange={(e) => setForm((prev) => ({ ...prev, url: e.target.value }))}
+                  placeholder="https://example.com/sse"
+                />
+              </label>
+            ) : (
+              <>
+                <label className="flex flex-col gap-1 text-xs text-muted-foreground">
+                  Command
+                  <Input
+                    value={form.command}
+                    onChange={(e) => setForm((prev) => ({ ...prev, command: e.target.value }))}
+                    placeholder="npx"
+                  />
+                </label>
+                <label className="flex flex-col gap-1 text-xs text-muted-foreground">
+                  Args
+                  <Textarea
+                    value={form.argsText}
+                    onChange={(e) => setForm((prev) => ({ ...prev, argsText: e.target.value }))}
+                    className="min-h-20 font-mono text-xs"
+                    placeholder={"-y\n@modelcontextprotocol/server-github"}
+                  />
+                </label>
+              </>
+            )}
+            <label className="flex flex-col gap-1 text-xs text-muted-foreground">
+              Description
+              <Input
+                value={form.description}
+                onChange={(e) => setForm((prev) => ({ ...prev, description: e.target.value }))}
+                placeholder="Optional"
+              />
+            </label>
+            {(formError || mutationError) && (
+              <div
+                role="alert"
+                className="rounded-md border border-destructive/40 bg-destructive/10 px-3 py-2 text-sm text-destructive"
+              >
+                {formError ?? mutationError}
+              </div>
+            )}
+            <div className="flex justify-end gap-2 pt-1">
+              <Button type="button" variant="ghost" size="sm" onClick={resetForm}>
+                <XIcon className="size-3.5" />
+                Clear
+              </Button>
+              <Button
+                type="button"
+                size="sm"
+                onClick={handleSave}
+                disabled={saving || validateMcpForm(form) !== null}
+              >
+                <SaveIcon className="size-3.5" />
+                {saving ? "Saving..." : "Save"}
+              </Button>
+            </div>
+          </div>
+        </div>
+      </DialogContent>
+    </Dialog>
+  );
+}
+
+function McpServersSection({
+  sessionId,
+  servers,
+  editable,
+}: {
+  sessionId?: string | null;
+  servers: McpServerSummary[];
+  editable: boolean;
+}) {
+  const [managerOpen, setManagerOpen] = useState(false);
+  const canEdit = !!(sessionId && editable);
+  const deleteServer = useDeleteMcpServer(canEdit ? sessionId : "");
+  const showSection = servers.length > 0 || canEdit;
+  if (!showSection) return null;
+
+  return (
+    <div className="flex flex-col gap-1.5">
+      <div className="flex items-center justify-between">
+        <SectionLabel>Tools</SectionLabel>
+        {canEdit && (
+          <button
+            type="button"
+            onClick={() => setManagerOpen(true)}
+            className="rounded p-0.5 hover:bg-muted"
+            title="Manage MCP servers"
+            aria-label="Manage MCP servers"
+          >
+            <PlusIcon className="size-3 text-muted-foreground" />
+          </button>
+        )}
+      </div>
+      {servers.length > 0 ? (
+        <McpServerList
+          servers={servers}
+          onDelete={
+            canEdit
+              ? (name) =>
+                  deleteServer.mutate(name, {
+                    onSuccess: () =>
+                      showToast(
+                        <span className="text-sm">
+                          MCP servers updated. Restart the session to apply changes.
+                        </span>,
+                      ),
+                  })
+              : undefined
+          }
+        />
+      ) : (
+        <p className="text-xs text-muted-foreground">No MCP servers</p>
+      )}
+      {canEdit && (
+        <McpServerManagerDialog
+          sessionId={sessionId!}
+          servers={servers}
+          open={managerOpen}
+          onOpenChange={setManagerOpen}
+        />
+      )}
+    </div>
+  );
+}
+
 // ---------------------------------------------------------------------------
 // Session policies section (user-editable only)
 // ---------------------------------------------------------------------------
@@ -618,6 +1050,7 @@ export function agentHasInfo(agent: Agent | undefined, sessionId?: string | null
  */
 export function AgentInfoContent({ agent, sessionId }: AgentInfoProps) {
   const servers = agent?.mcp_servers ?? [];
+  const mcpEditable = agent?.mcp_servers_editable === true;
   const displayName = agent ? agentDisplayLabel(agent.name) : null;
   const [sessionIdCopied, setSessionIdCopied] = useState(false);
   const copyResetTimeoutRef = useRef<number | null>(null);
@@ -630,6 +1063,12 @@ export function AgentInfoContent({ agent, sessionId }: AgentInfoProps) {
   // popover renders it directly — the frontend derives any aggregate view
   // from this map rather than receiving flat token fields.
   const usageByModel = useChatStore((s) => s.sessionUsageByModel);
+  // Session owner (the user_id granted LEVEL_OWNER), so a viewer can see whose
+  // session this is — e.g. a chat shared into a workspace group. ``null`` /
+  // undefined when permissions are off (single-user) or still loading, in
+  // which case the row is omitted rather than showing a placeholder.
+  const { data: owner } = useSessionOwner(sessionId ?? null);
+  const viewerId = getCurrentUserId();
 
   useEffect(() => {
     return () => {
@@ -660,6 +1099,19 @@ export function AgentInfoContent({ agent, sessionId }: AgentInfoProps) {
           )}
         </div>
       )}
+      {sessionId && owner && (
+        <div className="flex flex-col gap-1.5">
+          <SectionLabel>Owner</SectionLabel>
+          <span
+            className="truncate font-mono text-xs text-muted-foreground"
+            data-testid="agent-info-session-owner"
+            title={owner}
+          >
+            {owner}
+            {owner === viewerId && <span className="ml-1 text-muted-foreground/60">(you)</span>}
+          </span>
+        </div>
+      )}
       {sessionId && (
         <div className="flex flex-col gap-1.5">
           <SectionLabel>Session ID</SectionLabel>
@@ -703,12 +1155,7 @@ export function AgentInfoContent({ agent, sessionId }: AgentInfoProps) {
       {sessionId && usageByModel != null && Object.keys(usageByModel).length > 0 && (
         <ModelUsageBreakdown usageByModel={usageByModel} />
       )}
-      {servers.length > 0 && (
-        <div className="flex flex-col gap-1.5">
-          <SectionLabel>Tools</SectionLabel>
-          <McpServerList servers={servers} />
-        </div>
-      )}
+      <McpServersSection sessionId={sessionId} servers={servers} editable={mcpEditable} />
       {sessionId && <SessionPoliciesSection sessionId={sessionId} />}
     </div>
   );

ap-web/src/components/KeyboardShortcutsDialog.test.tsx

@@ -30,11 +30,12 @@ describe("KeyboardShortcutsDialog", () => {
     toggleViaHotkey();
 
     expect(screen.getByText("Keyboard shortcuts")).toBeTruthy();
-    // General / In chats / Navigation / Slash commands — one representative each.
+    // General / In chats / Navigation / View / Slash commands — one each.
     expect(screen.getByText("Show keyboard shortcuts")).toBeTruthy();
     expect(screen.getByText("Send message")).toBeTruthy();
     expect(screen.getByText("Recall previous prompt")).toBeTruthy();
     expect(screen.getByText("Previous session")).toBeTruthy();
+    expect(screen.getByText("Toggle conversations sidebar")).toBeTruthy();
     expect(screen.getByText("Navigate suggestions")).toBeTruthy();
   });
 

ap-web/src/components/KeyboardShortcutsDialog.tsx

@@ -42,6 +42,7 @@ export const MOD_KEY = IS_MAC ? "⌘" : "Ctrl";
 // Glyphs match the in-app tooltips (e.g. UserMessageNav's "⌘⌥↑").
 const ENTER = "↵";
 const SHIFT = "⇧";
+const ALT = IS_MAC ? "⌥" : "Alt";
 const UP = "↑";
 const DOWN = "↓";
 
@@ -84,6 +85,13 @@ const SHORTCUT_GROUPS: ShortcutGroup[] = [
       { label: "Next session", keys: [MOD_KEY, DOWN] },
     ],
   },
+  {
+    title: "View",
+    items: [
+      { label: "Toggle conversations sidebar", keys: [MOD_KEY, ALT, "["] },
+      { label: "Toggle workspace sidebar", keys: [MOD_KEY, ALT, "]"] },
+    ],
+  },
   {
     title: "Slash commands",
     note: "while the suggestions menu is open",
@@ -121,10 +129,47 @@ function Kbd({ children }: { children: ReactNode }) {
   );
 }
 
-export function KeyboardShortcutsDialog() {
-  const [open, setOpen] = useState(false);
+/**
+ * The shortcut reference, grouped, as plain inline content (no dialog
+ * chrome). Shared by the {@link KeyboardShortcutsDialog} overlay and the
+ * Settings page, which embeds it directly instead of behind a trigger.
+ */
+export function KeyboardShortcutsList() {
   // Feature-based, stable per session; computed at render so tests can vary it.
   const groups = shortcutGroupsFor(isNativeShell());
+  return (
+    <>
+      {groups.map((group) => (
+        <section key={group.title} className="mb-4 last:mb-0">
+          <h3 className="mb-1 text-xs font-medium text-muted-foreground">
+            {group.title}
+            {group.note ? (
+              <span className="ml-1.5 font-normal text-muted-foreground/70">· {group.note}</span>
+            ) : null}
+          </h3>
+          <ul>
+            {group.items.map((item) => (
+              <li
+                key={item.label}
+                className="flex items-center justify-between gap-4 border-b border-border/60 py-2.5 last:border-b-0"
+              >
+                <span className="text-sm text-foreground">{item.label}</span>
+                <span className="flex shrink-0 items-center gap-1">
+                  {item.keys.map((key) => (
+                    <Kbd key={`${item.label}-${key}`}>{key}</Kbd>
+                  ))}
+                </span>
+              </li>
+            ))}
+          </ul>
+        </section>
+      ))}
+    </>
+  );
+}
+
+export function KeyboardShortcutsDialog() {
+  const [open, setOpen] = useState(false);
 
   useEffect(() => {
     const onKeyDown = (e: KeyboardEvent) => {
@@ -154,33 +199,7 @@ export function KeyboardShortcutsDialog() {
           </DialogDescription>
         </DialogHeader>
         <div className="max-h-[70vh] overflow-y-auto pr-1">
-          {groups.map((group) => (
-            <section key={group.title} className="mb-4 last:mb-0">
-              <h3 className="mb-1 text-xs font-medium text-muted-foreground">
-                {group.title}
-                {group.note ? (
-                  <span className="ml-1.5 font-normal text-muted-foreground/70">
-                    · {group.note}
-                  </span>
-                ) : null}
-              </h3>
-              <ul>
-                {group.items.map((item) => (
-                  <li
-                    key={item.label}
-                    className="flex items-center justify-between gap-4 border-b border-border/60 py-2.5 last:border-b-0"
-                  >
-                    <span className="text-sm text-foreground">{item.label}</span>
-                    <span className="flex shrink-0 items-center gap-1">
-                      {item.keys.map((key) => (
-                        <Kbd key={`${item.label}-${key}`}>{key}</Kbd>
-                      ))}
-                    </span>
-                  </li>
-                ))}
-              </ul>
-            </section>
-          ))}
+          <KeyboardShortcutsList />
         </div>
       </DialogContent>
     </Dialog>

ap-web/src/components/PageScroll.tsx

@@ -0,0 +1,75 @@
+import type { CSSProperties, ReactNode } from "react";
+
+import { cn } from "@/lib/utils";
+
+/**
+ * The single scroll primitive for routed pages. It owns the one thing every
+ * page used to reinvent by hand: keeping content clear of the chrome at the top
+ * (the AppShell header + OS safe area) and bottom (the iOS native chat/terminal
+ * bar + OS safe area).
+ *
+ * All of that comes from the shared inset variables defined in index.css
+ * (`--omnigent-header-height`, `--omnigent-inset-top/bottom`). Off the iOS shell
+ * those resolve to `0` / plain `env(safe-area-*)`, so the SAME component renders
+ * correctly in the browser, Electron, and the iOS shell with no runtime branch.
+ *
+ * This is the "respect the inset" side of the system. Full-bleed elements that
+ * intentionally ignore the inset (the webview, app-shell background, sidebar
+ * drawer) simply don't use this — they stay edge-to-edge as before.
+ */
+interface PageScrollProps {
+  children: ReactNode;
+  /** Reserve room for the AppShell's absolute header at the top. Default true. */
+  clearHeader?: boolean;
+  /** Reserve the top OS safe-area inset. Default true. */
+  insetTop?: boolean;
+  /** Reserve the bottom inset (safe area + native chat/terminal bar). Default true. */
+  insetBottom?: boolean;
+  /** Extra top padding beyond the header/inset, as a CSS length. */
+  extraTop?: string;
+  /** Extra bottom padding beyond the inset, as a CSS length. */
+  extraBottom?: string;
+  /** Max-width class for the centered content column. Default "max-w-3xl". */
+  maxWidthClassName?: string;
+  /** Extra classes for the centered content column (e.g. horizontal padding). */
+  contentClassName?: string;
+  /** Extra classes for the scroll container itself. */
+  className?: string;
+  /** Forwarded to the scroll container (e.g. data-testid). */
+  "data-testid"?: string;
+}
+
+export function PageScroll({
+  children,
+  clearHeader = true,
+  insetTop = true,
+  insetBottom = true,
+  extraTop = "1.5rem",
+  extraBottom = "2rem",
+  maxWidthClassName = "max-w-3xl",
+  contentClassName,
+  className,
+  "data-testid": testId,
+}: PageScrollProps) {
+  // Padding is composed from the shared inset vars rather than the old fixed
+  // `pt-14 py-8`, so the bottom always clears the native bar + home indicator
+  // and the top always clears the header + notch — the bug those magic numbers
+  // missed. The padding lives on the scroll container so the last item can
+  // scroll up clear of the bar.
+  const style: CSSProperties = {
+    paddingTop: `calc(${extraTop}${clearHeader ? " + var(--omnigent-header-height)" : ""}${
+      insetTop ? " + var(--omnigent-inset-top)" : ""
+    })`,
+    paddingBottom: `calc(${extraBottom}${insetBottom ? " + var(--omnigent-inset-bottom)" : ""})`,
+  };
+
+  return (
+    <div
+      data-testid={testId}
+      className={cn("min-h-0 w-full flex-1 overflow-y-auto", className)}
+      style={style}
+    >
+      <div className={cn("mx-auto w-full", maxWidthClassName, contentClassName)}>{children}</div>
+    </div>
+  );
+}

ap-web/src/components/blocks/ApprovalCard.test.tsx

@@ -624,6 +624,37 @@ describe("ApprovalCard — AskUserQuestion form (parsed from content_preview)",
     expect(screen.queryByText("Claude has questions")).toBeNull();
   });
 
+  it("labels Antigravity structured input prompts as Antigravity prompts", () => {
+    // Antigravity (agy) reuses the same AskUserQuestion renderer via the
+    // ``ask_user_question`` extra, so the title must reflect the producer
+    // rather than defaulting to "Claude has questions".
+    render(
+      <ApprovalCard
+        elicitationId="elic_agy_label"
+        message="Antigravity needs your input"
+        phase="agy_ask_question"
+        policyName="agy_native_ask_question"
+        contentPreview=""
+        requestedSchema={{}}
+        status="pending"
+        response={null}
+        askUserQuestion={{
+          questions: [
+            {
+              id: "0",
+              question: "What type of project?",
+              options: [{ label: "Web app" }, { label: "CLI tool" }],
+              multiSelect: false,
+            },
+          ],
+        }}
+      />,
+    );
+
+    expect(screen.getByText("Antigravity needs your input")).toBeDefined();
+    expect(screen.queryByText("Claude has questions")).toBeNull();
+  });
+
   it("submits multi-select answers as an array", () => {
     const submitSpy = vi.fn().mockResolvedValue(undefined);
     useChatStore.setState({ submitApproval: submitSpy } as Partial<

ap-web/src/components/blocks/ApprovalCard.tsx

@@ -49,6 +49,7 @@ import {
   parseAskUserQuestionPreview,
 } from "@/lib/askUserQuestion";
 import { formatPreview } from "@/lib/previewFormat";
+import type { RenderItem } from "@/lib/renderItems";
 import type { RememberScope } from "@/lib/types";
 import { useChatStore } from "@/store/chatStore";
 import { AskUserQuestionForm, type AskUserQuestionAnswers } from "./AskUserQuestionForm";
@@ -245,9 +246,11 @@ export function ApprovalCard({
   // paths are handled inline with approve/reject buttons.
   const isExternalUrl = typeof url === "string" && url.length > 0 && !url.startsWith("/approve/");
   const askUserQuestionTitle =
-    policyName.startsWith("codex_") || phase.startsWith("codex_")
-      ? "Codex needs input"
-      : "Claude has questions";
+    policyName.startsWith("agy_") || phase.startsWith("agy_")
+      ? "Antigravity needs your input"
+      : policyName.startsWith("codex_") || phase.startsWith("codex_")
+        ? "Codex needs input"
+        : "Claude has questions";
 
   // Hide the raw JSON preview for AskUserQuestion (the form already
   // renders the questions + options structurally) and for option-
@@ -548,3 +551,38 @@ export function ApprovalCard({
     </Alert>
   );
 }
+
+/**
+ * Render an elicitation ``RenderItem`` as an ``ApprovalCard``. The prop
+ * mapping lives here, in one place, so the two callers stay in sync:
+ * ``BlockRenderer`` (inline in the message stream) and ``ChatPage``'s
+ * pinned tray (pending cards lifted above the composer). Pass ``onSubmit``
+ * to route the verdict somewhere other than the active chat store.
+ */
+export function ElicitationCard({
+  item,
+  onSubmit,
+}: {
+  item: Extract<RenderItem, { kind: "elicitation" }>;
+  onSubmit?: SubmitApprovalFn;
+}) {
+  return (
+    <ApprovalCard
+      elicitationId={item.elicitationId}
+      message={item.message}
+      phase={item.phase}
+      policyName={item.policyName}
+      contentPreview={item.contentPreview}
+      requestedSchema={item.requestedSchema}
+      url={item.url}
+      status={item.status}
+      response={item.response}
+      askUserQuestion={item.askUserQuestion}
+      exitPlanMode={item.exitPlanMode}
+      codexCommand={item.codexCommand}
+      allowAllEdits={item.allowAllEdits}
+      rememberScope={item.rememberScope}
+      onSubmit={onSubmit}
+    />
+  );
+}

ap-web/src/components/blocks/BlockRenderer.tsx

@@ -30,7 +30,7 @@ import {
   useWorkspacePaths,
 } from "@/shell/FileViewerContext";
 import { toWorkspaceRelativePath, useWorkspaceFileExists } from "@/hooks/useWorkspaceChangedFiles";
-import { ApprovalCard } from "./ApprovalCard";
+import { ElicitationCard } from "./ApprovalCard";
 import { ReasoningView } from "./ReasoningView";
 import { SlashCommandCard } from "./SlashCommandCard";
 import { TerminalCommandCard } from "./TerminalCommandCard";
@@ -467,25 +467,7 @@ function renderItem(item: RenderItem, index: number, isReasoningStreaming: boole
         />
       );
     case "elicitation":
-      return (
-        <ApprovalCard
-          key={key}
-          elicitationId={item.elicitationId}
-          message={item.message}
-          phase={item.phase}
-          policyName={item.policyName}
-          contentPreview={item.contentPreview}
-          requestedSchema={item.requestedSchema}
-          url={item.url}
-          status={item.status}
-          response={item.response}
-          askUserQuestion={item.askUserQuestion}
-          exitPlanMode={item.exitPlanMode}
-          codexCommand={item.codexCommand}
-          allowAllEdits={item.allowAllEdits}
-          rememberScope={item.rememberScope}
-        />
-      );
+      return <ElicitationCard key={key} item={item} />;
   }
 }
 

ap-web/src/components/blocks/ExitPlanModeReview.tsx

@@ -46,7 +46,12 @@ export function ExitPlanModeReview({
 
   return (
     <div className="flex flex-col gap-2" data-testid="exit-plan-mode-review">
-      <div className="text-sm">
+      {/* text-foreground: the plan body is the card's primary content, so it
+          renders in normal text color like a regular assistant message —
+          escaping AlertDescription's muted default (which otherwise washes
+          the whole plan out). The short lead-in caption above stays muted
+          for hierarchy, matching the Codex command card. */}
+      <div className="text-sm text-foreground">
         <MessageResponse>{plan}</MessageResponse>
       </div>
       {rejecting ? (

ap-web/src/components/icons/AntigravityIcon.tsx

@@ -0,0 +1,3 @@
+import Antigravity from "@lobehub/icons/es/Antigravity";
+
+export const AntigravityIcon = Antigravity;

ap-web/src/components/icons/KimiIcon.tsx

@@ -0,0 +1,9 @@
+// Import the Mono glyph directly instead of the package index. The Kimi index
+// barrel pulls in a `Color` component whose transitive `@lobehub/fluent-emoji`
+// dependency uses an ESM directory import that vitest can't resolve (it breaks
+// AgentCard.test collection). `Mono` is the monochrome `currentColor` glyph the
+// other harness icons (Cursor/Claude/…) render anyway, and it only depends on
+// React. See node_modules/@lobehub/icons/es/Kimi/index.d.ts.
+import Kimi from "@lobehub/icons/es/Kimi/components/Mono";
+
+export const KimiIcon = Kimi;

ap-web/src/components/icons/OpenCodeIcon.tsx

@@ -0,0 +1,3 @@
+import OpenCode from "@lobehub/icons/es/OpenCode";
+
+export const OpenCodeIcon = OpenCode;

ap-web/src/components/theme/ThemeModeMenu.test.tsx

@@ -1,129 +0,0 @@
-// Tests for ThemeModeMenu — the compact sidebar button that cycles the theme
-// system → dark → light on each click.
-//
-// The icon shows the *current* mode, while the aria-label/title announce the
-// *next* mode the click will apply (see nextThemeMode). It hides entirely when
-// embedded (the host owns the theme). `next-themes` and `@/lib/embedded` are
-// mocked so each test pins the current theme, system theme, and embed state;
-// the real themeMode helpers (pure) run unmocked.
-
-import { cleanup, fireEvent, render, screen } from "@testing-library/react";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { TooltipProvider } from "@/components/ui/tooltip";
-
-const setTheme = vi.fn();
-let currentTheme: string | undefined;
-let systemTheme: string | undefined;
-let embedded: boolean;
-
-vi.mock("next-themes", () => ({
-  useTheme: () => ({ theme: currentTheme, systemTheme, setTheme }),
-}));
-
-vi.mock("@/lib/embedded", () => ({
-  useIsEmbedded: () => embedded,
-}));
-
-import { ThemeModeMenu } from "./ThemeModeMenu";
-
-function renderMenu() {
-  return render(
-    <TooltipProvider>
-      <ThemeModeMenu />
-    </TooltipProvider>,
-  );
-}
-
-beforeEach(() => {
-  currentTheme = "system";
-  systemTheme = undefined;
-  embedded = false;
-});
-
-afterEach(() => {
-  cleanup();
-  vi.clearAllMocks();
-});
-
-describe("ThemeModeMenu", () => {
-  it("renders nothing when embedded", () => {
-    // WHY: the host owns the theme in embed mode, so the switcher must be a
-    // no-op and render no button at all.
-    embedded = true;
-    const { container } = renderMenu();
-    expect(container).toBeEmptyDOMElement();
-  });
-
-  it("labels the button with the next mode in the cycle (system → dark)", () => {
-    // WHY: at "system" the next click applies "dark", so the action label must
-    // announce "Switch to Dark".
-    currentTheme = "system";
-    renderMenu();
-    expect(screen.getByRole("button", { name: "Switch to Dark" })).toBeInTheDocument();
-  });
-
-  it("clicking from system selects dark", () => {
-    // WHY: a click must advance one step in the cycle, calling setTheme with
-    // the previewed next mode rather than the current one.
-    currentTheme = "system";
-    renderMenu();
-    fireEvent.click(screen.getByRole("button", { name: "Switch to Dark" }));
-    expect(setTheme).toHaveBeenCalledWith("dark");
-  });
-
-  it("clicking from dark selects light", () => {
-    // WHY: dark's next mode is light — pins the middle hop of the cycle.
-    currentTheme = "dark";
-    renderMenu();
-    fireEvent.click(screen.getByRole("button", { name: "Switch to Light" }));
-    expect(setTheme).toHaveBeenCalledWith("light");
-  });
-
-  it("clicking from light wraps back to system", () => {
-    // WHY: light's next mode is system — pins the wrap-around so the cycle
-    // visits every mode rather than trapping in two states.
-    currentTheme = "light";
-    renderMenu();
-    fireEvent.click(screen.getByRole("button", { name: "Switch to System" }));
-    expect(setTheme).toHaveBeenCalledWith("system");
-  });
-
-  it("treats an unknown stored theme as system", () => {
-    // WHY: a garbage/legacy stored value must normalize to "system", whose
-    // next mode is dark — so the button still offers "Switch to Dark".
-    currentTheme = "sepia";
-    renderMenu();
-    expect(screen.getByRole("button", { name: "Switch to Dark" })).toBeInTheDocument();
-  });
-
-  it("skips dark when the system theme is dark", () => {
-    // WHY: at "system" on a dark OS, pinning dark would render identically, so
-    // the cycle jumps straight to light.
-    currentTheme = "system";
-    systemTheme = "dark";
-    renderMenu();
-    fireEvent.click(screen.getByRole("button", { name: "Switch to Light" }));
-    expect(setTheme).toHaveBeenCalledWith("light");
-  });
-
-  it("does not offer light first when the system theme is light", () => {
-    // WHY: from "system" the cycle's first stop is dark regardless of OS, so a
-    // light OS still advances to dark before anything else.
-    currentTheme = "system";
-    systemTheme = "light";
-    renderMenu();
-    fireEvent.click(screen.getByRole("button", { name: "Switch to Dark" }));
-    expect(setTheme).toHaveBeenCalledWith("dark");
-  });
-
-  it("skips light when an explicit dark theme sits on a light system", () => {
-    // WHY: dark's next stop is light, but a light OS already renders light, so
-    // skip the redundant hop and go straight to system. This is the asymmetry
-    // the system-theme check fixes — `resolvedTheme` would have offered light.
-    currentTheme = "dark";
-    systemTheme = "light";
-    renderMenu();
-    fireEvent.click(screen.getByRole("button", { name: "Switch to System" }));
-    expect(setTheme).toHaveBeenCalledWith("system");
-  });
-});

ap-web/src/components/theme/ThemeModeMenu.tsx

@@ -1,60 +0,0 @@
-import { LaptopMinimalIcon, MoonIcon, SunIcon } from "lucide-react";
-import { useTheme } from "next-themes";
-import { Button } from "@/components/ui/button";
-import { Tooltip, TooltipContent, TooltipTrigger } from "@/components/ui/tooltip";
-import { useIsEmbedded } from "@/lib/embedded";
-import { type ThemeMode, nextThemeMode, normalizeThemeMode } from "./themeMode";
-
-const themeModeLabels: Record<ThemeMode, string> = {
-  light: "Light",
-  dark: "Dark",
-  system: "System",
-};
-
-const themeModeIcons: Record<ThemeMode, typeof SunIcon> = {
-  light: SunIcon,
-  dark: MoonIcon,
-  system: LaptopMinimalIcon,
-};
-
-/**
- * Compact sidebar control that cycles system → dark → light on click.
- *
- * A single icon button rather than a dropdown. The icon shows the
- * current mode — a sun for light, a moon for dark, and a laptop for
- * system — while the tooltip and aria-label announce the mode the next
- * click will apply (see {@link nextThemeMode}).
- *
- * @returns Theme cycle button.
- */
-export function ThemeModeMenu() {
-  // Embedded: the host owns the theme and `embed.tsx` forces light, so a theme
-  // switcher would be a no-op. Hide it.
-  const isEmbedded = useIsEmbedded();
-  const { theme, systemTheme, setTheme } = useTheme();
-  const mode = normalizeThemeMode(theme);
-  const next = nextThemeMode(mode, systemTheme);
-  const Icon = themeModeIcons[mode];
-  const action = `Switch to ${themeModeLabels[next]}`;
-
-  if (isEmbedded) return null;
-
-  return (
-    <Tooltip>
-      <TooltipTrigger asChild>
-        <Button
-          type="button"
-          variant="ghost"
-          size="icon"
-          aria-label={action}
-          title={action}
-          className="rounded-full"
-          onClick={() => setTheme(next)}
-        >
-          <Icon className="size-4" />
-        </Button>
-      </TooltipTrigger>
-      <TooltipContent side="bottom">{action}</TooltipContent>
-    </Tooltip>
-  );
-}

ap-web/src/components/ui/toast.test.tsx

@@ -0,0 +1,26 @@
+// Unit tests for the minimal toast system: showToast() renders content into a
+// mounted <Toaster />, and the dismiss control removes it.
+
+import { act, cleanup, fireEvent, render, screen } from "@testing-library/react";
+import { afterEach, describe, expect, it } from "vitest";
+import { showToast, Toaster } from "./toast";
+
+afterEach(cleanup);
+
+describe("Toaster", () => {
+  it("renders nothing until a toast is shown", () => {
+    render(<Toaster />);
+    expect(screen.queryByTestId("toast")).toBeNull();
+  });
+
+  it("shows toast content and dismisses on the close button", () => {
+    render(<Toaster />);
+    act(() => showToast(<span>Hello there</span>, { duration: 0 }));
+
+    const toast = screen.getByTestId("toast");
+    expect(toast).toHaveTextContent("Hello there");
+
+    fireEvent.click(screen.getByRole("button", { name: "Dismiss" }));
+    expect(screen.queryByTestId("toast")).toBeNull();
+  });
+});

ap-web/src/components/ui/toast.tsx

@@ -0,0 +1,91 @@
+// A minimal, dependency-free toast system.
+//
+// Self-contained in the same spirit as KeyboardShortcutsDialog: a module-level
+// `showToast()` dispatches a window event, and a single `<Toaster />` (mounted
+// once near the app shell) listens and renders a top-center stack. Toasts
+// auto-dismiss after a timeout and carry a manual dismiss control.
+//
+// Content is an arbitrary ReactNode so callers can embed links/actions (e.g.
+// a routing <Link>); it renders inside the Toaster, which sits within the
+// Router, so links resolve normally.
+
+import { type ReactNode, useCallback, useEffect, useState } from "react";
+import { XIcon } from "lucide-react";
+
+const TOAST_EVENT = "omnigent:toast";
+const DEFAULT_DURATION_MS = 6000;
+
+interface ToastItem {
+  id: number;
+  content: ReactNode;
+  duration: number;
+}
+
+let counter = 0;
+
+/** Show a transient toast. `duration <= 0` keeps it until manually dismissed. */
+export function showToast(content: ReactNode, opts?: { duration?: number }): void {
+  if (typeof window === "undefined") return;
+  counter += 1;
+  const detail: ToastItem = {
+    id: counter,
+    content,
+    duration: opts?.duration ?? DEFAULT_DURATION_MS,
+  };
+  window.dispatchEvent(new CustomEvent(TOAST_EVENT, { detail }));
+}
+
+/** Mount once near the app shell; renders the active toast stack. */
+export function Toaster() {
+  const [toasts, setToasts] = useState<ToastItem[]>([]);
+
+  const dismiss = useCallback((id: number) => {
+    setToasts((prev) => prev.filter((t) => t.id !== id));
+  }, []);
+
+  useEffect(() => {
+    const onToast = (e: Event) => {
+      const item = (e as CustomEvent<ToastItem>).detail;
+      setToasts((prev) => [...prev, item]);
+    };
+    window.addEventListener(TOAST_EVENT, onToast);
+    return () => window.removeEventListener(TOAST_EVENT, onToast);
+  }, []);
+
+  if (toasts.length === 0) return null;
+
+  return (
+    <div className="pointer-events-none fixed inset-x-0 top-4 z-[100] flex flex-col items-center gap-2 px-4">
+      {toasts.map((t) => (
+        <ToastRow key={t.id} item={t} onDismiss={dismiss} />
+      ))}
+    </div>
+  );
+}
+
+function ToastRow({ item, onDismiss }: { item: ToastItem; onDismiss: (id: number) => void }) {
+  useEffect(() => {
+    if (item.duration <= 0) return;
+    const timer = setTimeout(() => onDismiss(item.id), item.duration);
+    return () => clearTimeout(timer);
+  }, [item.id, item.duration, onDismiss]);
+
+  return (
+    <div
+      role="status"
+      aria-live="polite"
+      data-testid="toast"
+      className="pointer-events-auto flex max-w-full items-center gap-3 rounded-full border border-border bg-card px-4 py-2 text-sm shadow-lg"
+    >
+      <span className="min-w-0">{item.content}</span>
+      <button
+        type="button"
+        aria-label="Dismiss"
+        onClick={() => onDismiss(item.id)}
+        className="shrink-0 text-muted-foreground transition-colors hover:text-foreground"
+      >
+        <XIcon className="size-4" />
+      </button>
+    </div>
+  );
+}

ap-web/src/hooks/useAgents.ts

@@ -7,7 +7,7 @@
 // fetches the full `AgentObject` for a single session via
 // `GET /v1/sessions/{sessionId}/agent`.
 
-import { useQuery } from "@tanstack/react-query";
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import { authenticatedFetch } from "@/lib/identity";
 
 export interface McpServerSummary {
@@ -46,6 +46,8 @@ export interface Agent {
   harness?: string | null;
   /** MCP server declarations from the agent spec. Empty when none configured. */
   mcp_servers?: McpServerSummary[];
+  /** Whether the active session's agent bundle can be edited through the UI. */
+  mcp_servers_editable?: boolean;
   /** Guardrails policies declared on the agent. Empty when none configured. */
   policies?: PolicySummary[];
   /** Terminal names declared in the spec's `terminals:` block, in
@@ -117,6 +119,7 @@ interface AgentObjectWire {
   description?: string | null;
   harness?: string | null;
   mcp_servers?: McpServerSummary[];
+  mcp_servers_editable?: boolean;
   policies?: PolicySummary[];
   terminals?: string[];
 }
@@ -137,6 +140,7 @@ async function fetchSessionAgent(sessionId: string): Promise<Agent> {
     description: json.description,
     harness: json.harness ?? null,
     mcp_servers: json.mcp_servers,
+    mcp_servers_editable: json.mcp_servers_editable,
     policies: json.policies,
     terminals: json.terminals,
   };
@@ -155,3 +159,93 @@ export function useSessionAgent(sessionId: string | null) {
     staleTime: Infinity,
   });
 }
+
+export interface UpsertMcpServerInput {
+  name: string;
+  transport: "http" | "stdio";
+  description?: string | null;
+  url?: string | null;
+  command?: string | null;
+  args?: string[];
+}
+
+async function parseMutationError(res: Response): Promise<Error> {
+  try {
+    const body = (await res.json()) as { error?: { message?: string }; detail?: unknown };
+    if (body.error?.message) return new Error(body.error.message);
+    if (typeof body.detail === "string") return new Error(body.detail);
+  } catch {
+    // Fall through to the status text.
+  }
+  return new Error(`${res.status} ${res.statusText}`);
+}
+
+function sessionAgentQueryKey(sessionId: string) {
+  return ["session-agent", sessionId];
+}
+
+function invalidateSessionAgent(queryClient: ReturnType<typeof useQueryClient>, sessionId: string) {
+  void queryClient.invalidateQueries({ queryKey: sessionAgentQueryKey(sessionId) });
+}
+
+export function useCreateMcpServer(sessionId: string) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async (payload: UpsertMcpServerInput) => {
+      const res = await authenticatedFetch(
+        `/v1/sessions/${encodeURIComponent(sessionId)}/agent/mcp-servers`,
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(payload),
+        },
+      );
+      if (!res.ok) throw await parseMutationError(res);
+      return (await res.json()) as McpServerSummary;
+    },
+    onSuccess: () => invalidateSessionAgent(queryClient, sessionId),
+  });
+}
+
+export function useUpdateMcpServer(sessionId: string) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async ({
+      serverName,
+      payload,
+    }: {
+      serverName: string;
+      payload: UpsertMcpServerInput;
+    }) => {
+      const res = await authenticatedFetch(
+        `/v1/sessions/${encodeURIComponent(sessionId)}/agent/mcp-servers/${encodeURIComponent(
+          serverName,
+        )}`,
+        {
+          method: "PUT",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(payload),
+        },
+      );
+      if (!res.ok) throw await parseMutationError(res);
+      return (await res.json()) as McpServerSummary;
+    },
+    onSuccess: () => invalidateSessionAgent(queryClient, sessionId),
+  });
+}
+
+export function useDeleteMcpServer(sessionId: string) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async (serverName: string) => {
+      const res = await authenticatedFetch(
+        `/v1/sessions/${encodeURIComponent(sessionId)}/agent/mcp-servers/${encodeURIComponent(
+          serverName,
+        )}`,
+        { method: "DELETE" },
+      );
+      if (!res.ok) throw await parseMutationError(res);
+    },
+    onSuccess: () => invalidateSessionAgent(queryClient, sessionId),
+  });
+}

ap-web/src/hooks/useAvailableAgents.test.tsx

@@ -107,6 +107,24 @@ describe("useAvailableAgents", () => {
             description: null,
             harness: "pi-native",
           },
+          {
+            id: "ag_kiro_native",
+            name: "kiro-native-ui",
+            description: null,
+            harness: "kiro-native",
+          },
+          {
+            id: "ag_agy_native",
+            name: "antigravity-native-ui",
+            description: null,
+            harness: "antigravity-native",
+          },
+          {
+            id: "ag_opencode_native",
+            name: "opencode-native-ui",
+            description: null,
+            harness: "opencode-native",
+          },
           {
             id: "ag_nessie",
             name: "nessie",
@@ -162,6 +180,30 @@ describe("useAvailableAgents", () => {
         harness: "pi-native",
         skills: [],
       },
+      {
+        id: "ag_kiro_native",
+        name: "kiro-native-ui",
+        display_name: "Kiro",
+        description: null,
+        harness: "kiro-native",
+        skills: [],
+      },
+      {
+        id: "ag_agy_native",
+        name: "antigravity-native-ui",
+        display_name: "Antigravity",
+        description: null,
+        harness: "antigravity-native",
+        skills: [],
+      },
+      {
+        id: "ag_opencode_native",
+        name: "opencode-native-ui",
+        display_name: "OpenCode",
+        description: null,
+        harness: "opencode-native",
+        skills: [],
+      },
       {
         id: "ag_nessie",
         name: "nessie",
@@ -337,6 +379,53 @@ describe("useAvailableAgents", () => {
     expect(enrichCalls).toEqual(["/v1/sessions/conv_3/agent"]);
   });
 
+  it("dedupes native built-ins and hides session-discovered native shadows", async () => {
+    routeFetch({
+      [BUILTINS_URL]: mockResponse({
+        object: "list",
+        data: [
+          // Stale/non-canonical native row from older local state; it
+          // resolves by harness but must not compete with the seeded row.
+          { id: "ag_stale_kiro", name: "kiro-naitive", harness: "kiro-native" },
+          { id: "ag_kiro", name: "kiro-native-ui", harness: "kiro-native" },
+        ],
+        has_more: false,
+      }),
+      [SCAN_URL]: mockResponse({
+        object: "list",
+        data: [
+          // This distinct session-bound id used to enrich into a second
+          // Kiro row because it did not shadow the built-in by name/id.
+          { id: "conv_kiro", agent_id: "ag_session_kiro", agent_name: "kiro-naitive" },
+          // Legacy failed Kiro attempts used a plain "kiro" agent name and
+          // no harness; that row must not surface as a custom Kiro picker row.
+          { id: "conv_legacy", agent_id: "ag_legacy_kiro", agent_name: "kiro" },
+        ],
+        has_more: false,
+      }),
+      "/v1/sessions/conv_kiro/agent": mockResponse({
+        id: "ag_session_kiro",
+        object: "agent",
+        name: "kiro-naitive",
+        harness: "kiro-native",
+      }),
+    });
+
+    const { result } = renderHook(() => useAvailableAgents(), { wrapper });
+    await waitFor(() => expect(result.current.isSuccess).toBe(true));
+
+    expect(result.current.data).toEqual([
+      {
+        id: "ag_kiro",
+        name: "kiro-native-ui",
+        display_name: "Kiro",
+        description: null,
+        harness: "kiro-native",
+        skills: [],
+      },
+    ]);
+  });
+
   it("collapses same-named custom agents with distinct agent_ids to the newest session's row", async () => {
     routeFetch({
       [BUILTINS_URL]: mockResponse({ object: "list", data: [], has_more: false }),

ap-web/src/hooks/useAvailableAgents.ts

@@ -3,6 +3,7 @@ import { authenticatedFetch } from "@/lib/identity";
 import { agentRootName } from "@/lib/forkHarness";
 import { capitalizeAgentName } from "@/lib/agentLabels";
 import {
+  nativeCodingAgentForAvailableAgent,
   nativeCodingAgentForAgentName,
   nativeCodingAgentForHarness,
 } from "@/lib/nativeCodingAgents";
@@ -40,6 +41,29 @@ function displayNameForAgent(name: string, harness?: string | null): string {
   );
 }
 
+function dedupeNativeAgents(agents: AvailableAgent[]): AvailableAgent[] {
+  const result: AvailableAgent[] = [];
+  const nativeIndex = new Map<string, number>();
+  for (const agent of agents) {
+    const nativeAgent = nativeCodingAgentForAvailableAgent(agent);
+    if (nativeAgent?.key !== "kiro") {
+      result.push(agent);
+      continue;
+    }
+    const existingIndex = nativeIndex.get(nativeAgent.key);
+    if (existingIndex === undefined) {
+      nativeIndex.set(nativeAgent.key, result.length);
+      result.push(agent);
+      continue;
+    }
+    const existing = result[existingIndex];
+    if (agent.name === nativeAgent.agentName && existing.name !== nativeAgent.agentName) {
+      result[existingIndex] = agent;
+    }
+  }
+  return result;
+}
+
 /** Wire row of the built-in list, GET /v1/agents. */
 interface BuiltinAgentWire {
   id: string;
@@ -64,14 +88,16 @@ async function fetchBuiltinAgents(): Promise<AvailableAgent[]> {
   const res = await authenticatedFetch("/v1/agents");
   if (!res.ok) throw new Error(`${res.status} ${res.statusText}`);
   const body = (await res.json()) as { data: BuiltinAgentWire[] };
-  return body.data.map((a) => ({
-    id: a.id,
-    name: a.name,
-    display_name: displayNameForAgent(a.name, a.harness),
-    description: a.description ?? null,
-    harness: a.harness ?? null,
-    skills: a.skills ?? [],
-  }));
+  return dedupeNativeAgents(
+    body.data.map((a) => ({
+      id: a.id,
+      name: a.name,
+      display_name: displayNameForAgent(a.name, a.harness),
+      description: a.description ?? null,
+      harness: a.harness ?? null,
+      skills: a.skills ?? [],
+    })),
+  );
 }
 
 /**
@@ -192,6 +218,10 @@ async function fetchAvailableAgents(): Promise<AvailableAgent[]> {
   ]);
   const builtinIds = new Set(builtins.map((a) => a.id));
   const builtinNames = new Set(builtins.map((a) => a.name));
+  const hasKiroBuiltin = builtins.some(
+    (a) => nativeCodingAgentForAvailableAgent(a)?.key === "kiro",
+  );
+  const kiroLegacyNames = new Set(["kiro"]);
   // One row per custom base name, newest session first (scan order):
   // same-named agent_ids are per-session mints of the same agent, and
   // identical-name rows are indistinguishable in the picker anyway.
@@ -203,9 +233,15 @@ async function fetchAvailableAgents(): Promise<AvailableAgent[]> {
     // the clone would slip past the shadow check and pollute the picker.
     const base = agentRootName(agent.agentName);
     if (builtinIds.has(agent.agentId) || builtinNames.has(base)) continue;
+    if (hasKiroBuiltin && kiroLegacyNames.has(base.toLocaleLowerCase())) continue;
     if (!customByName.has(base)) customByName.set(base, agent);
   }
-  const enriched = await Promise.all(Array.from(customByName.values()).map(enrichSessionAgent));
+  const enriched = (
+    await Promise.all(Array.from(customByName.values()).map(enrichSessionAgent))
+  ).filter((agent) => {
+    const nativeKey = nativeCodingAgentForAvailableAgent(agent)?.key;
+    return nativeKey !== "kiro" || !hasKiroBuiltin;
+  });
   // Built-ins first; custom agents follow in scan order (newest session
   // first). NewChatDialog's display-order sort is stable, so unranked
   // custom names keep this relative order.

ap-web/src/hooks/useIOSNativeKeyboardInset.ts

@@ -85,11 +85,17 @@ function getIOSNativeKeyboardInset(): number {
   const viewport = window.visualViewport;
   if (!viewport) return 0;
 
-  const shellBottom =
-    document.querySelector<HTMLElement>("[data-ios-native].app-shell")?.getBoundingClientRect()
-      .bottom ?? window.innerHeight;
+  // Keyboard height = the layout viewport (the full webview, kept keyboard-
+  // independent by the native shell's `.ignoresSafeArea(.keyboard)`) minus the
+  // visible visual viewport. Measured against `window.innerHeight`, NOT the
+  // app-shell: useIOSViewportLock resizes the shell down to the visual viewport
+  // when the keyboard opens, so an app-shell-relative measurement would always
+  // read ~0. This value is for fixed, full-viewport overlays (e.g. the mobile
+  // TerminalsPanel) that the shell-lock does not resize — flow content inside
+  // the shell is handled by the lock and needs no manual padding.
+  const layoutBottom = window.innerHeight;
   const visibleBottom = viewport.offsetTop + viewport.height;
-  return Math.max(0, Math.round(shellBottom - visibleBottom));
+  return Math.max(0, Math.round(layoutBottom - visibleBottom));
 }
 
 function isEditableElementFocused(): boolean {

ap-web/src/hooks/useIOSViewportLock.ts

@@ -0,0 +1,71 @@
+import { useEffect } from "react";
+
+import { isIOSShell } from "@/lib/nativeBridge";
+
+/**
+ * Lock the iOS shell to the visual viewport so the soft keyboard can never pan
+ * the whole document.
+ *
+ * The native shell keeps the WKWebView full-height when the keyboard opens
+ * (`.ignoresSafeArea(.keyboard)`), so the layout viewport (`window.innerHeight`,
+ * `100lvh`) stays full while the keyboard overlays the bottom. Left alone, the
+ * composer/inputs sit *behind* the keyboard and WebKit pans the whole document
+ * up to reveal the focused field — hiding the header and letting the user scroll
+ * the entire page.
+ *
+ * `visualViewport.height` *does* track the keyboard here (verified: it drops to
+ * the area above the keyboard while `innerHeight` stays full), so we publish it
+ * to `--omnigent-viewport-height`; the app-shell sizes to that (see index.css).
+ * The focused input is then always within the visible area, WebKit never needs
+ * to pan, the header stays put, and only the inner scroll panes move. As a
+ * safety net we also snap any residual document pan back to the top.
+ *
+ * No-op off the iOS shell — the browser and Electron handle the keyboard via
+ * normal layout, and the CSS var falls back to `100lvh`.
+ */
+export function useIOSViewportLock(): void {
+  useEffect(() => {
+    if (!isIOSShell()) return;
+    const viewport = window.visualViewport;
+    if (!viewport) return;
+
+    const root = document.documentElement;
+    let frame = 0;
+
+    // With the shell sized to the visual viewport there is nothing to scroll, so
+    // counter any pan WebKit applies while revealing a focused field — that pan
+    // is what moves the whole page (and the absolute header). Wired as its own
+    // listener too, so it fires the instant WebKit scrolls, not just on the
+    // rAF-coalesced resize.
+    const resetPan = () => {
+      if (viewport.offsetTop !== 0 || window.scrollY !== 0) window.scrollTo(0, 0);
+    };
+
+    const apply = () => {
+      frame = 0;
+      root.style.setProperty("--omnigent-viewport-height", `${Math.round(viewport.height)}px`);
+      resetPan();
+    };
+
+    // Coalesce the burst of resize/scroll events the keyboard animation fires.
+    const schedule = () => {
+      if (frame) return;
+      frame = window.requestAnimationFrame(apply);
+    };
+
+    apply();
+    viewport.addEventListener("resize", schedule);
+    viewport.addEventListener("scroll", schedule);
+    window.addEventListener("scroll", resetPan, { passive: true });
+    window.addEventListener("orientationchange", schedule);
+
+    return () => {
+      if (frame) window.cancelAnimationFrame(frame);
+      viewport.removeEventListener("resize", schedule);
+      viewport.removeEventListener("scroll", schedule);
+      window.removeEventListener("scroll", resetPan);
+      window.removeEventListener("orientationchange", schedule);
+      root.style.removeProperty("--omnigent-viewport-height");
+    };
+  }, []);
+}

ap-web/src/hooks/usePermissions.ts

@@ -8,6 +8,7 @@ import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import {
   type Permission,
   derivePermissionLevel,
+  getSessionOwner,
   grantPermission,
   listPermissions,
   revokePermission,
@@ -19,6 +20,10 @@ function permissionsKey(sessionId: string) {
   return ["permissions", sessionId] as const;
 }
 
+function sessionOwnerKey(sessionId: string) {
+  return ["sessionOwner", sessionId] as const;
+}
+
 /** Fetch all permission grants for a session. */
 export function usePermissions(sessionId: string | null) {
   return useQuery({
@@ -28,6 +33,23 @@ export function usePermissions(sessionId: string | null) {
   });
 }
 
+/**
+ * Fetch the owner (the ``user_id`` granted ``LEVEL_OWNER``) of a session.
+ *
+ * Returns ``null`` when permissions are disabled (single-user mode), so the
+ * caller can omit any owner UI. Requires only read access, so it resolves for
+ * anyone a session is shared with — letting the info popover answer "whose
+ * session is this?" for chats shared into a workspace group. Disabled until a
+ * sessionId is known.
+ */
+export function useSessionOwner(sessionId: string | null) {
+  return useQuery({
+    queryKey: sessionOwnerKey(sessionId ?? ""),
+    queryFn: () => getSessionOwner(sessionId!),
+    enabled: !!sessionId,
+  });
+}
+
 /** Grant or update a permission. Invalidates the permissions list on success. */
 export function useGrantPermission(sessionId: string) {
   const qc = useQueryClient();

ap-web/src/hooks/useSidebarToggleHotkeys.test.tsx

@@ -0,0 +1,112 @@
+// ⌘⌥[ toggles the left sidebar, ⌘⌥] the right; matches the physical bracket
+// keys (not the glyph ⌥ produces), ignores the bare keys / missing-Alt / Shift
+// variants / auto-repeat / AltGraph, fully claims the event, and unbinds on
+// unmount.
+
+import { renderHook } from "@testing-library/react";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { useSidebarToggleHotkeys } from "./useSidebarToggleHotkeys";
+
+/** Dispatch a keydown that reaches window from body (default: Ctrl+Alt+[). */
+function press(
+  mods: Partial<Pick<KeyboardEvent, "metaKey" | "ctrlKey" | "altKey" | "shiftKey" | "repeat">> = {
+    ctrlKey: true,
+    altKey: true,
+  },
+  code = "BracketLeft",
+): void {
+  document.body.dispatchEvent(
+    new KeyboardEvent("keydown", { code, bubbles: true, cancelable: true, ...mods }),
+  );
+}
+
+afterEach(() => vi.restoreAllMocks());
+
+function setup() {
+  const onToggleLeft = vi.fn();
+  const onToggleRight = vi.fn();
+  const utils = renderHook(() => useSidebarToggleHotkeys({ onToggleLeft, onToggleRight }));
+  return { onToggleLeft, onToggleRight, ...utils };
+}
+
+describe("useSidebarToggleHotkeys", () => {
+  it("Ctrl+Alt+[ toggles only the left sidebar", () => {
+    const { onToggleLeft, onToggleRight } = setup();
+    press({ ctrlKey: true, altKey: true }, "BracketLeft");
+    expect(onToggleLeft).toHaveBeenCalledTimes(1);
+    expect(onToggleRight).not.toHaveBeenCalled();
+  });
+
+  it("Ctrl+Alt+] toggles only the right sidebar", () => {
+    const { onToggleLeft, onToggleRight } = setup();
+    press({ ctrlKey: true, altKey: true }, "BracketRight");
+    expect(onToggleRight).toHaveBeenCalledTimes(1);
+    expect(onToggleLeft).not.toHaveBeenCalled();
+  });
+
+  it("Cmd variants also fire (macOS)", () => {
+    const { onToggleLeft, onToggleRight } = setup();
+    press({ metaKey: true, altKey: true }, "BracketLeft");
+    press({ metaKey: true, altKey: true }, "BracketRight");
+    expect(onToggleLeft).toHaveBeenCalledTimes(1);
+    expect(onToggleRight).toHaveBeenCalledTimes(1);
+  });
+
+  it("ignores the bare keys, missing-Alt, and Shift variants", () => {
+    const { onToggleLeft, onToggleRight } = setup();
+    press({}, "BracketLeft"); // bare [
+    press({ ctrlKey: true }, "BracketLeft"); // ⌘[ alone = browser Back, not ours
+    press({ metaKey: true, altKey: true, shiftKey: true }, "BracketRight");
+    expect(onToggleLeft).not.toHaveBeenCalled();
+    expect(onToggleRight).not.toHaveBeenCalled();
+  });
+
+  it("ignores other keys held with the modifiers", () => {
+    const { onToggleLeft, onToggleRight } = setup();
+    press({ ctrlKey: true, altKey: true }, "Backslash");
+    press({ metaKey: true, altKey: true }, "Period");
+    expect(onToggleLeft).not.toHaveBeenCalled();
+    expect(onToggleRight).not.toHaveBeenCalled();
+  });
+
+  it("ignores auto-repeat (holding the chord doesn't flap the panel)", () => {
+    const { onToggleLeft } = setup();
+    press({ ctrlKey: true, altKey: true, repeat: true }, "BracketLeft");
+    expect(onToggleLeft).not.toHaveBeenCalled();
+  });
+
+  it("ignores AltGraph chords (Ctrl+Alt produced by intl layouts)", () => {
+    const { onToggleLeft, onToggleRight } = setup();
+    const altGraph = vi
+      .spyOn(KeyboardEvent.prototype, "getModifierState")
+      .mockImplementation((keyArg) => keyArg === "AltGraph");
+    press({ ctrlKey: true, altKey: true }, "BracketLeft");
+    press({ ctrlKey: true, altKey: true }, "BracketRight");
+    expect(onToggleLeft).not.toHaveBeenCalled();
+    expect(onToggleRight).not.toHaveBeenCalled();
+    altGraph.mockRestore();
+  });
+
+  it("claims the event (preventDefault + stopPropagation)", () => {
+    setup();
+    const ev = new KeyboardEvent("keydown", {
+      code: "BracketLeft",
+      ctrlKey: true,
+      altKey: true,
+      bubbles: true,
+      cancelable: true,
+    });
+    const stopSpy = vi.spyOn(ev, "stopPropagation");
+    document.body.dispatchEvent(ev);
+    expect(ev.defaultPrevented).toBe(true);
+    expect(stopSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it("unbinds on unmount", () => {
+    const { onToggleLeft, unmount } = setup();
+    unmount();
+    press({ ctrlKey: true, altKey: true }, "BracketLeft");
+    expect(onToggleLeft).not.toHaveBeenCalled();
+  });
+});

ap-web/src/hooks/useSidebarToggleHotkeys.ts

@@ -0,0 +1,56 @@
+// ⌘⌥[ / ⌘⌥] (Ctrl+Alt+[ / Ctrl+Alt+] on Win/Linux) toggle the left
+// (Conversations) and right (Workspace) sidebars. Siblings to the session-switch
+// (⌘↑/↓) and approve (⌘↵) hotkeys; like them they fire even inside a focused
+// text field, so a panel can be collapsed mid-compose.
+//
+// Why this chord: the bare ⌘[ / ⌘] are the browser's Back/Forward gestures, and
+// single ⌘+punctuation combos (e.g. ⌘\) get swallowed by global hotkey utilities
+// (Raycast/Rectangle/…) before the page ever sees them. Adding ⌥ dodges both —
+// it's not a browser gesture and is essentially never grabbed system-wide — and
+// it shares the ⌘⌥ chord with ChatPage's message-nav hotkey. Bind ONCE at the
+// app shell, where the sidebar open-state lives.
+
+import { useEffect, useRef } from "react";
+
+export interface SidebarToggleHandlers {
+  /** Flip the left (Conversations) sidebar. Bound to ⌘/Ctrl + ⌥/Alt + [. */
+  onToggleLeft: () => void;
+  /** Flip the right (Workspace) sidebar. Bound to ⌘/Ctrl + ⌥/Alt + ]. */
+  onToggleRight: () => void;
+}
+
+export function useSidebarToggleHotkeys(handlers: SidebarToggleHandlers): void {
+  // Held in a ref so the bound handler always calls the latest closures without
+  // re-registering each render.
+  const latest = useRef(handlers);
+  latest.current = handlers;
+
+  useEffect(() => {
+    const handler = (e: globalThis.KeyboardEvent): void => {
+      // Require Cmd/Ctrl AND Alt (the ⌘⌥ message-nav chord) and additionally
+      // reject Shift, so ⌘⌥⇧ combos stay free for future bindings.
+      if (!(e.metaKey || e.ctrlKey) || !e.altKey || e.shiftKey) return;
+      // AltGr often reports as Ctrl+Alt; ignore it so intl-layout typing doesn't
+      // accidentally toggle sidebars while focused in an editor/composer.
+      if (e.getModifierState("AltGraph")) return;
+      // Ignore auto-repeat: holding the chord would flap the panel open/closed.
+      if (e.repeat) return;
+      // Match the physical key, not the character: ⌥ turns "[" / "]" into "“" /
+      // "‘" on macOS, but e.code is stable across layouts and modifiers.
+      // Claim the chord: preventDefault drops any default action and
+      // stopPropagation keeps it from reaching other keydown listeners.
+      if (e.code === "BracketLeft") {
+        e.preventDefault();
+        e.stopPropagation();
+        latest.current.onToggleLeft();
+      } else if (e.code === "BracketRight") {
+        e.preventDefault();
+        e.stopPropagation();
+        latest.current.onToggleRight();
+      }
+    };
+
+    window.addEventListener("keydown", handler);
+    return () => window.removeEventListener("keydown", handler);
+  }, []);
+}

ap-web/src/hooks/useTerminals.test.ts

@@ -483,12 +483,42 @@ describe("inventoryTerminals", () => {
     session: "main",
     running: true,
   };
+  const kiroPane: TerminalInfo = {
+    id: "terminal_kiro_main",
+    name: "kiro",
+    session: "main",
+    running: true,
+  };
   const goosePane: TerminalInfo = {
     id: "terminal_goose_main",
     name: "goose",
     session: "main",
     running: true,
   };
+  const qwenPane: TerminalInfo = {
+    id: "terminal_qwen_main",
+    name: "qwen",
+    session: "main",
+    running: true,
+  };
+  const kimiPane: TerminalInfo = {
+    id: "terminal_kimi_main",
+    name: "kimi",
+    session: "main",
+    running: true,
+  };
+  const hermesPane: TerminalInfo = {
+    id: "terminal_hermes_main",
+    name: "hermes",
+    session: "main",
+    running: true,
+  };
+  const antigravityPane: TerminalInfo = {
+    id: "terminal_antigravity_main",
+    name: "antigravity",
+    session: "main",
+    running: true,
+  };
   const bash: TerminalInfo = {
     id: "terminal_bash_s1",
     name: "bash",
@@ -510,6 +540,13 @@ describe("inventoryTerminals", () => {
     expect(inventoryTerminals([cursorPane, bash], true)).toEqual([bash]);
   });
 
+  it("drops the kiro vendor pane for native Kiro sessions", () => {
+    // Regression: terminal_kiro_main was missing from AGENT_TERMINAL_IDS,
+    // so Kiro's Terminal pill opened a shell view with an X close button
+    // instead of preserving the Chat/Terminal toggle.
+    expect(inventoryTerminals([kiroPane, bash], true)).toEqual([bash]);
+  });
+
   it("drops the goose vendor pane for native Goose sessions", () => {
     // Regression: terminal_goose_main was missing from AGENT_TERMINAL_IDS, so
     // the goose TUI pane leaked into the Shells inventory and (via isShellView)
@@ -519,6 +556,42 @@ describe("inventoryTerminals", () => {
     expect(isAgentTerminalKey("terminal:terminal_goose_main")).toBe(true);
   });
 
+  it("drops the qwen vendor pane for native Qwen sessions", () => {
+    // Regression: terminal_qwen_main was missing from AGENT_TERMINAL_IDS, so
+    // clicking Terminal opened the qwen TUI pane as a plain shell (shell-header
+    // chrome) while hiding the Chat/Terminal pill via isShellView — same failure
+    // mode as the pi/cursor/goose panes above.
+    expect(inventoryTerminals([qwenPane, bash], true)).toEqual([bash]);
+    expect(isAgentTerminalKey("terminal:terminal_qwen_main")).toBe(true);
+  });
+
+  it("drops the kimi vendor pane for native Kimi sessions", () => {
+    // Regression: terminal_kimi_main was missing from AGENT_TERMINAL_IDS,
+    // same failure mode as the pi/cursor panes above — leaked into Shells
+    // and hid the Chat/Terminal pill in Terminal view.
+    expect(inventoryTerminals([kimiPane, bash], true)).toEqual([bash]);
+    expect(isAgentTerminalKey("terminal:terminal_kimi_main")).toBe(true);
+  });
+
+  it("drops the hermes vendor pane for native Hermes sessions", () => {
+    // Regression: terminal_hermes_main was missing from AGENT_TERMINAL_IDS, so
+    // the hermes TUI pane leaked into the Shells inventory and (via isShellView)
+    // opened as a plain shell while hiding the Chat/Terminal pill — same failure
+    // mode as the pi/cursor/goose/qwen panes above.
+    expect(inventoryTerminals([hermesPane, bash], true)).toEqual([bash]);
+    expect(isAgentTerminalKey("terminal:terminal_hermes_main")).toBe(true);
+  });
+
+  it("drops the antigravity vendor pane for native Antigravity sessions", () => {
+    // Regression (#1157): terminal_antigravity_main was missing from
+    // AGENT_TERMINAL_IDS, so the agy TUI pane leaked into the Shells inventory
+    // and (via isShellView) hid the Chat/Terminal pill in Terminal view —
+    // stranding the user with no way back to Chat. Same failure mode as the
+    // pi/cursor/goose/qwen panes above.
+    expect(inventoryTerminals([antigravityPane, bash], true)).toEqual([bash]);
+    expect(isAgentTerminalKey("terminal:terminal_antigravity_main")).toBe(true);
+  });
+
   it("drops the embedded REPL terminal for terminal-first SDK sessions", () => {
     // The REPL terminal backs the pill's Terminal view; listing it in
     // the rail reads as a phantom "main" terminal on agents that don't
@@ -553,11 +626,16 @@ describe("isAgentTerminalKey", () => {
     expect(isAgentTerminalKey("terminal:terminal_tui_main")).toBe(true);
     expect(isAgentTerminalKey("terminal:terminal_claude_main")).toBe(true);
     expect(isAgentTerminalKey("terminal:terminal_codex_main")).toBe(true);
+    expect(isAgentTerminalKey("terminal:terminal_opencode_main")).toBe(true);
     // pi-native: missing here is what hid the Chat/Terminal pill in
     // Terminal view (isShellView wrongly true) for Pi sessions.
     expect(isAgentTerminalKey("terminal:terminal_pi_main")).toBe(true);
     // cursor-native: same regression class as pi above.
     expect(isAgentTerminalKey("terminal:terminal_cursor_main")).toBe(true);
+    // kiro-/goose-/qwen-native: same regression class as cursor/pi above.
+    expect(isAgentTerminalKey("terminal:terminal_kiro_main")).toBe(true);
+    expect(isAgentTerminalKey("terminal:terminal_goose_main")).toBe(true);
+    expect(isAgentTerminalKey("terminal:terminal_qwen_main")).toBe(true);
   });
 
   it("treats a user shell as not-the-agent-terminal", () => {

ap-web/src/hooks/useTerminals.ts

@@ -50,9 +50,11 @@ export const PANEL_NO_TERMINAL_KEY = "";
  * connection pill's Terminal view, runner-created per session shape:
  * the embedded Omnigent REPL (``tui``/``main``) for SDK sessions,
  * and the vendor pane (``claude``/``main``, ``codex``/``main``,
- * ``pi``/``main``, or ``cursor``/``main``) for native-wrapper sessions.
- * These are plumbing, not
- * part of the session's shell inventory, and at most one exists per session.
+ * ``pi``/``main``, ``cursor``/``main``, ``kiro``/``main``, ``goose``/``main``,
+ * ``qwen``/``main``, ``antigravity``/``main``, or ``kimi``/``main``) for
+ * native-wrapper sessions.
+ * These are plumbing, not part of the session's shell inventory, and at most
+ * one exists per session.
  *
  * Missing an entry here makes that pane read as a *user shell*: the
  * Chat/Terminal pill self-hides in Terminal view (``isShellView``), so the
@@ -63,9 +65,15 @@ export const AGENT_TERMINAL_IDS: ReadonlySet<string> = new Set([
   "terminal_tui_main",
   "terminal_claude_main",
   "terminal_codex_main",
+  "terminal_opencode_main",
   "terminal_pi_main",
   "terminal_cursor_main",
+  "terminal_kiro_main",
   "terminal_goose_main",
+  "terminal_qwen_main",
+  "terminal_antigravity_main",
+  "terminal_kimi_main",
+  "terminal_hermes_main",
 ]);
 
 /**

ap-web/src/index.css

@@ -99,6 +99,43 @@
  * buttons stay neutral grey (hue 240). See designs/UI/WEB_UI.md (still
  * describes the older cobalt direction). */
 :root {
+  /* ---- Inset system -------------------------------------------------------
+   * Single source of truth for how far content must stay clear of screen
+   * chrome. The SAME bundle runs in a browser, in Electron, and inside the
+   * iOS WKWebView shell, so these variables are defined universally and the
+   * runtime-specific inputs default to zero — `<PageScroll>` and the scoped
+   * rules below consume them without any `isIOSShell()` branching.
+   *
+   * Three inputs combine:
+   *   1. OS safe area  — `env(safe-area-inset-*)`, nonzero only on notched /
+   *      home-indicator devices (and only when `viewport-fit=cover`).
+   *   2. Native bar footprint — the pixel height of the iOS shell's floating
+   *      server switcher (top) and chat/terminal bar (bottom). The native
+   *      layer owns these dimensions and pushes them over the bridge (see
+   *      src/lib/nativeInsets.ts); they stay 0 off-shell.
+   *   3. Bar visibility — 0|1, owned by the web app (it is what tells the
+   *      shell to show/hide each bar). Folded in via a unitless multiply so a
+   *      hidden bar contributes nothing.
+   *
+   * The bottom chat/terminal bar overlays page content, so it feeds the
+   * content inset. The top server switcher floats within the web header band
+   * (ChatHeader, --omnigent-header-height) and is narrower than it, so content
+   * that already clears the header also clears the switcher — its size is
+   * tracked here for symmetry/introspection but is intentionally NOT added to
+   * the content top inset to avoid double-counting the header band. */
+  --omnigent-header-height: 3.5rem; /* web ChatHeader (h-14) */
+  --omnigent-safe-top: env(safe-area-inset-top, 0px);
+  --omnigent-safe-bottom: env(safe-area-inset-bottom, 0px);
+  --omnigent-native-top-bar: 0px; /* set by native bridge (px) */
+  --omnigent-native-bottom-bar: 0px; /* set by native bridge (px) */
+  --omnigent-top-bar-visible: 0; /* web-owned 0|1 */
+  --omnigent-bottom-bar-visible: 0; /* web-owned 0|1 */
+  --omnigent-inset-top: var(--omnigent-safe-top);
+  --omnigent-inset-bottom: calc(
+    var(--omnigent-safe-bottom) + var(--omnigent-native-bottom-bar) *
+      var(--omnigent-bottom-bar-visible)
+  );
+
   /* Brand palette (light). Hex values are the brand spec, kept verbatim
      * for fidelity. --background is white: the lavender brand canvas is
      * expressed by the .app-shell gradient (see index.css .app-shell), so
@@ -408,18 +445,51 @@
  * bridge marker so normal iOS Safari keeps its existing browser-safe layout. */
 @media (width < 48rem) {
   [data-ios-native].app-shell {
-    height: 100vh;
+    /* Lock the shell to the live visual viewport so the soft keyboard can never
+       pan the whole document (which hides the header). --omnigent-viewport-
+       height is published by useIOSViewportLock from visualViewport.height; it
+       shrinks when the keyboard opens so inputs stay above it and only inner
+       panes scroll. Falls back to the large viewport before JS runs / on older
+       WebKit. The two-line pattern keeps the lvh fallback for browsers without
+       the var. */
     height: 100lvh;
-    min-height: 100vh;
+    height: var(--omnigent-viewport-height, 100lvh);
     min-height: 100lvh;
-    max-height: 100vh;
+    min-height: var(--omnigent-viewport-height, 100lvh);
     max-height: 100lvh;
+    max-height: var(--omnigent-viewport-height, 100lvh);
     overflow: hidden;
   }
 
+  /* Slide animation for the mobile drawer. Covers BOTH paths that move the
+     panel: the edge-swipe drag settles via an inline `transform`, while the
+     button toggle (and the drag's resting open/closed state) is driven by
+     Tailwind v4's `translate-x` utilities — which animate the `translate`
+     property, not `transform`. Listing only `transform` (as before) left the
+     toggle un-transitioned, so tapping the collapse/expand button snapped the
+     drawer instantly with no animation. Transition both so the toggle slides
+     too. Suppressed inline (`transition: none`) while a drag is live so the
+     overlay tracks the finger 1:1. */
   [data-ios-native] .conversations-sidebar {
-    transition: transform 360ms cubic-bezier(0.32, 0.72, 0, 1);
-    will-change: transform;
+    transition-property: transform, translate;
+    transition-duration: 360ms;
+    transition-timing-function: cubic-bezier(0.32, 0.72, 0, 1);
+    will-change: transform, translate;
+  }
+
+  /* Leading-edge shadow so the drawer reads as a native layer lifted above the
+     chat while it slides, instead of a flat sheet. Scoped to the open/dragging
+     state via `:not([data-collapsed])` (the sidebar sets `data-collapsed` only
+     when closed) so the full-bleed overlay doesn't cast a sliver along the
+     screen's left edge while parked off-screen. It's visible only mid-slide and
+     mid-drag — fully open the drawer covers the viewport, so its right edge (and
+     the shadow) sit past the screen. iOS-only: the web overlay is unchanged. */
+  [data-ios-native] .conversations-sidebar:not([data-collapsed]) {
+    box-shadow: 8px 0 28px -6px rgb(0 0 0 / 0.22);
+  }
+
+  .dark [data-ios-native] .conversations-sidebar:not([data-collapsed]) {
+    box-shadow: 8px 0 30px -4px rgb(0 0 0 / 0.55);
   }
 
   [data-ios-native] :is(input, textarea, select, [contenteditable="true"]) {
@@ -431,28 +501,30 @@
   }
 
   [data-ios-native] .chat-conversation-content {
-    padding-top: calc(5rem + env(safe-area-inset-top, 0px));
+    /* header band + 1.5rem breathing room + OS safe area, sourced from the
+       shared inset vars (was a hardcoded 5rem). */
+    padding-top: calc(var(--omnigent-header-height) + 1.5rem + var(--omnigent-inset-top));
   }
 
   [data-ios-native] .main-terminal-view {
-    padding-top: calc(3.25rem + env(safe-area-inset-top, 0px));
+    padding-top: calc(3.25rem + var(--omnigent-inset-top));
   }
 
   [data-ios-native] .chat-scroll-fade {
     mask-image: linear-gradient(
       to bottom,
-      transparent calc(48px + env(safe-area-inset-top, 0px)),
-      black calc(80px + env(safe-area-inset-top, 0px))
+      transparent calc(48px + var(--omnigent-inset-top)),
+      black calc(80px + var(--omnigent-inset-top))
     );
     -webkit-mask-image: linear-gradient(
       to bottom,
-      transparent calc(48px + env(safe-area-inset-top, 0px)),
-      black calc(80px + env(safe-area-inset-top, 0px))
+      transparent calc(48px + var(--omnigent-inset-top)),
+      black calc(80px + var(--omnigent-inset-top))
     );
   }
 
   [data-ios-native] .chat-composer-form {
-    padding-bottom: calc(0.75rem + env(safe-area-inset-bottom, 0px));
+    padding-bottom: calc(0.75rem + var(--omnigent-safe-bottom));
   }
 
   [data-ios-native] .chat-composer-form.terminal-first-composer-form {
@@ -460,20 +532,22 @@
   }
 
   [data-ios-native] .terminal-first-switcher-container {
-    padding-bottom: calc(0.35rem + env(safe-area-inset-bottom, 0px));
+    padding-bottom: calc(0.35rem + var(--omnigent-safe-bottom));
   }
 
   /* Reserve room for the native Liquid Glass switcher that floats over the web
-     view (the in-page pill is suppressed in the iOS shell). Fixed height: the
-     bar's footprint above the home-indicator inset (env). Chat sits 1rem
-     tighter — its composer status line already cushions the gap to the bar. */
+     view (the in-page pill is suppressed in the iOS shell). Height is the
+     shared bottom inset — the native bar footprint (sourced from the shell, see
+     nativeInsets.ts) plus the home-indicator safe area — so it can never drift
+     from the bar's real size. Chat sits 1rem tighter: its composer status line
+     already cushions the gap to the bar. */
   [data-ios-native] .omnigent-native-bottom-spacer {
-    height: calc(3rem + env(safe-area-inset-bottom, 0px));
+    height: var(--omnigent-inset-bottom);
     flex: none;
   }
 
   [data-ios-native] .omnigent-native-bottom-spacer--chat {
-    height: calc(2rem + env(safe-area-inset-bottom, 0px));
+    height: calc(var(--omnigent-inset-bottom) - 1rem);
   }
 
   [data-ios-native] .terminal-first-switcher {
@@ -549,8 +623,8 @@
       [data-testid="subagents-panel-drawer"],
       [data-testid="todos-panel-drawer"]
     ) {
-    padding-top: env(safe-area-inset-top, 0px);
-    padding-bottom: env(safe-area-inset-bottom, 0px);
+    padding-top: var(--omnigent-safe-top);
+    padding-bottom: var(--omnigent-safe-bottom);
   }
 }
 
@@ -702,6 +776,22 @@
   font-size: 1em;
 }
 
+/* GitHub task lists in chat messages (Streamdown + remark-gfm). remark-gfm tags
+   each task item `task-list-item` with a disabled <input type="checkbox">, but
+   Streamdown also applies Tailwind `list-disc`, so a disc renders right next to
+   the checkbox (bullet + checkbox). Drop the marker per ITEM (not on the whole
+   `.contains-task-list` list) so a list mixing task and plain items only loses
+   the bullet on the task items — matching GitHub. `list-style-type` is
+   inherited, so setting it on the <li> overrides the list's `list-disc`. Space
+   the checkbox from its label. */
+[data-streamdown="list-item"].task-list-item {
+  list-style: none;
+}
+[data-streamdown="list-item"].task-list-item > input[type="checkbox"] {
+  margin-right: 0.4em;
+  vertical-align: -0.075em;
+}
+
 /* Flash highlight on nav jump. Duration must match FLASH_DURATION_MS in chatStore.ts. */
 @keyframes user-msg-flash {
   0% {

ap-web/src/lib/agentBundle.test.ts

@@ -0,0 +1,200 @@
+import { describe, expect, it } from "vitest";
+
+// We can't use buildAgentBundle directly in jsdom because
+// CompressionStream is not available. Instead, test the YAML
+// generation logic by importing the module and calling the
+// internal config builder. Since it's not exported, we test
+// indirectly through buildAgentBundle and inspect the generated
+// YAML by mocking the compression + tar layer.
+
+// The module's functions are all private except buildAgentBundle.
+// We mock CompressionStream and verify the config.yaml content
+// that gets fed to the tar/gzip pipeline.
+
+import type { AgentBundleInput } from "./agentBundle";
+
+// Capture what buildAgentBundle passes to `new File(...)` by
+// mocking CompressionStream (not in jsdom) to be a passthrough.
+class PassthroughStream {
+  readable: ReadableStream;
+  writable: WritableStream;
+  constructor() {
+    let controller: ReadableStreamDefaultController;
+    this.readable = new ReadableStream({
+      start(c) {
+        controller = c;
+      },
+    });
+    this.writable = new WritableStream({
+      write(chunk) {
+        controller.enqueue(new Uint8Array(chunk));
+      },
+      close() {
+        controller.close();
+      },
+    });
+  }
+}
+
+// Install mock before importing buildAgentBundle.
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+(globalThis as any).CompressionStream = PassthroughStream;
+
+// Now import the function (it will use our mock CompressionStream).
+const { buildAgentBundle } = await import("./agentBundle");
+
+/** Extract the config.yaml from the raw tar bytes inside the File. */
+async function extractConfigYaml(file: File): Promise<string> {
+  const buf = await file.arrayBuffer();
+  const tar = new Uint8Array(buf);
+  // First tar entry: 512-byte header, then content.
+  // File size is at offset 124, 12 bytes, octal null-terminated.
+  const sizeStr = new TextDecoder().decode(tar.slice(124, 135)).replace(/\0/g, "");
+  const size = parseInt(sizeStr, 8);
+  return new TextDecoder().decode(tar.slice(512, 512 + size));
+}
+
+/** Extract AGENTS.md (second tar entry) from the raw tar bytes. */
+async function extractAgentsMd(file: File): Promise<string | null> {
+  const buf = await file.arrayBuffer();
+  const tar = new Uint8Array(buf);
+  const size0Str = new TextDecoder().decode(tar.slice(124, 135)).replace(/\0/g, "");
+  const size0 = parseInt(size0Str, 8);
+  const blocks0 = Math.ceil(size0 / 512);
+  const entry1Start = 512 + blocks0 * 512;
+  if (entry1Start + 512 > tar.length) return null;
+  const name1 = new TextDecoder()
+    .decode(tar.slice(entry1Start, entry1Start + 100))
+    .replace(/\0/g, "");
+  if (!name1.startsWith("AGENTS.md")) return null;
+  const size1Str = new TextDecoder()
+    .decode(tar.slice(entry1Start + 124, entry1Start + 135))
+    .replace(/\0/g, "");
+  const size1 = parseInt(size1Str, 8);
+  return new TextDecoder().decode(tar.slice(entry1Start + 512, entry1Start + 512 + size1));
+}
+
+describe("buildAgentBundle", () => {
+  it("produces a tar.gz file with correct config.yaml for minimal input", async () => {
+    const input: AgentBundleInput = {
+      name: "test-agent",
+      harness: "claude-sdk",
+      model: "claude-sonnet-4-20250514",
+    };
+    const file = await buildAgentBundle(input);
+    expect(file.name).toBe("agent.tar.gz");
+    expect(file.type).toBe("application/gzip");
+
+    const yaml = await extractConfigYaml(file);
+    expect(yaml).toContain("spec_version: 1");
+    expect(yaml).toContain("name: test-agent");
+    expect(yaml).toContain("model: claude-sonnet-4-20250514");
+    expect(yaml).toContain("harness: claude-sdk");
+    expect(yaml).toContain("web_search");
+    expect(yaml).toContain("web_fetch");
+    expect(yaml).not.toContain("instructions:");
+    expect(yaml).not.toContain("description:");
+  });
+
+  it("includes description when provided", async () => {
+    const input: AgentBundleInput = {
+      name: "my-agent",
+      description: "A helpful assistant",
+      harness: "claude-sdk",
+      model: "claude-sonnet-4-20250514",
+    };
+    const yaml = await extractConfigYaml(await buildAgentBundle(input));
+    expect(yaml).toContain("description: A helpful assistant");
+  });
+
+  it("quotes description with special characters", async () => {
+    const input: AgentBundleInput = {
+      name: "my-agent",
+      description: 'Has: colons and "quotes"',
+      harness: "claude-sdk",
+      model: "claude-sonnet-4-20250514",
+    };
+    const yaml = await extractConfigYaml(await buildAgentBundle(input));
+    expect(yaml).toContain('description: "Has: colons and \\"quotes\\""');
+  });
+
+  it("includes AGENTS.md when instructions are provided", async () => {
+    const input: AgentBundleInput = {
+      name: "my-agent",
+      instructions: "You are a helpful assistant.",
+      harness: "claude-sdk",
+      model: "claude-sonnet-4-20250514",
+    };
+    const file = await buildAgentBundle(input);
+    const yaml = await extractConfigYaml(file);
+    expect(yaml).toContain("instructions: AGENTS.md");
+
+    const md = await extractAgentsMd(file);
+    expect(md).toBe("You are a helpful assistant.");
+  });
+
+  it("omits AGENTS.md when no instructions", async () => {
+    const input: AgentBundleInput = {
+      name: "my-agent",
+      harness: "claude-sdk",
+      model: "claude-sonnet-4-20250514",
+    };
+    const md = await extractAgentsMd(await buildAgentBundle(input));
+    expect(md).toBeNull();
+  });
+
+  it("includes inline MCP servers (stdio)", async () => {
+    const input: AgentBundleInput = {
+      name: "mcp-agent",
+      harness: "claude-sdk",
+      model: "claude-sonnet-4-20250514",
+      mcpServers: [
+        {
+          name: "github",
+          transport: "stdio",
+          command: "npx",
+          args: ["-y", "@modelcontextprotocol/server-github"],
+          env: { GITHUB_TOKEN: "ghp_test" },
+        },
+      ],
+    };
+    const yaml = await extractConfigYaml(await buildAgentBundle(input));
+    expect(yaml).toContain("  github:");
+    expect(yaml).toContain("    type: mcp");
+    expect(yaml).toContain("    command: npx");
+    expect(yaml).toContain('    args: [-y, "@modelcontextprotocol/server-github"]');
+    expect(yaml).toContain("      GITHUB_TOKEN: ghp_test");
+  });
+
+  it("includes inline MCP servers (http)", async () => {
+    const input: AgentBundleInput = {
+      name: "http-agent",
+      harness: "claude-sdk",
+      model: "claude-sonnet-4-20250514",
+      mcpServers: [
+        {
+          name: "search",
+          transport: "http",
+          url: "https://mcp.example.com/sse",
+          headers: { Authorization: "Bearer tok_123" },
+        },
+      ],
+    };
+    const yaml = await extractConfigYaml(await buildAgentBundle(input));
+    expect(yaml).toContain("  search:");
+    expect(yaml).toContain("    type: mcp");
+    expect(yaml).toContain('    url: "https://mcp.example.com/sse"');
+    expect(yaml).toContain("      Authorization: Bearer tok_123");
+  });
+
+  it("uses different harness and model values", async () => {
+    const input: AgentBundleInput = {
+      name: "oai-agent",
+      harness: "openai-agents",
+      model: "gpt-4o",
+    };
+    const yaml = await extractConfigYaml(await buildAgentBundle(input));
+    expect(yaml).toContain("harness: openai-agents");
+    expect(yaml).toContain("model: gpt-4o");
+  });
+});

ap-web/src/lib/agentBundle.ts

@@ -0,0 +1,226 @@
+/**
+ * Client-side agent bundle builder.
+ *
+ * Produces a minimal `.tar.gz` bundle accepted by the server's
+ * multipart `POST /v1/sessions` endpoint. The bundle contains a
+ * `config.yaml` and optionally an `AGENTS.md` instructions file.
+ */
+
+/** An MCP server to include in the agent bundle. */
+export interface MCPServerInput {
+  name: string;
+  /** "http" for SSE endpoints, "stdio" for local subprocesses. */
+  transport: "http" | "stdio";
+  /** SSE endpoint URL (http transport only). */
+  url?: string;
+  /** HTTP headers (http transport only), e.g. {"Authorization": "Bearer ..."} */
+  headers?: Record<string, string>;
+  /** Executable to spawn (stdio transport only), e.g. "npx". */
+  command?: string;
+  /** Args for the command (stdio transport only). */
+  args?: string[];
+  /** Env vars for the subprocess (stdio transport only). */
+  env?: Record<string, string>;
+}
+
+export interface AgentBundleInput {
+  name: string;
+  description?: string;
+  instructions?: string;
+  /** Harness kind, e.g. "claude-sdk", "openai-agents". */
+  harness: string;
+  /** Model identifier, e.g. "claude-sonnet-4-20250514". Required by the omnigent executor. */
+  model: string;
+  /** MCP server declarations to include as inline tools entries. */
+  mcpServers?: MCPServerInput[];
+}
+
+/**
+ * Build a `.tar.gz` agent bundle from the given input fields.
+ *
+ * Uses the pako library (already a transitive dep via codemirror) for
+ * gzip compression and a hand-rolled POSIX tar header for the two
+ * files. The result is a `File` suitable for `FormData.append`.
+ */
+export async function buildAgentBundle(input: AgentBundleInput): Promise<File> {
+  // Build config.yaml content
+  const lines: string[] = ["spec_version: 1", ""];
+  lines.push(`name: ${input.name}`);
+  if (input.description) {
+    lines.push(`description: ${yamlQuote(input.description)}`);
+  }
+  lines.push("");
+
+  lines.push("executor:");
+  lines.push("  type: omnigent");
+  lines.push(`  model: ${input.model}`);
+  lines.push("  config:");
+  lines.push(`    harness: ${input.harness}`);
+  lines.push("");
+
+  lines.push("tools:");
+  lines.push("  builtins:");
+  lines.push("    - web_search");
+  lines.push("    - web_fetch");
+  // Inline MCP server declarations (parsed by _parse_inline_mcp_servers).
+  if (input.mcpServers?.length) {
+    for (const mcp of input.mcpServers) {
+      lines.push(`  ${mcp.name}:`);
+      lines.push("    type: mcp");
+      if (mcp.transport === "stdio") {
+        if (mcp.command) lines.push(`    command: ${yamlQuote(mcp.command)}`);
+        if (mcp.args?.length) {
+          lines.push(`    args: [${mcp.args.map((a) => yamlQuote(a)).join(", ")}]`);
+        }
+        if (mcp.env && Object.keys(mcp.env).length > 0) {
+          lines.push("    env:");
+          for (const [k, v] of Object.entries(mcp.env)) {
+            lines.push(`      ${k}: ${yamlQuote(v)}`);
+          }
+        }
+      } else {
+        if (mcp.url) lines.push(`    url: ${yamlQuote(mcp.url)}`);
+        if (mcp.headers && Object.keys(mcp.headers).length > 0) {
+          lines.push("    headers:");
+          for (const [k, v] of Object.entries(mcp.headers)) {
+            lines.push(`      ${k}: ${yamlQuote(v)}`);
+          }
+        }
+      }
+    }
+  }
+  lines.push("");
+
+  if (input.instructions) {
+    lines.push("instructions: AGENTS.md");
+    lines.push("");
+  }
+
+  const configYaml = lines.join("\n");
+
+  // Build tar archive
+  const files: TarEntry[] = [
+    { name: "config.yaml", content: new TextEncoder().encode(configYaml) },
+  ];
+  if (input.instructions) {
+    files.push({ name: "AGENTS.md", content: new TextEncoder().encode(input.instructions) });
+  }
+
+  const tarBytes = createTar(files);
+  const gzipped = await gzip(tarBytes);
+  return new File([gzipped.buffer as ArrayBuffer], "agent.tar.gz", {
+    type: "application/gzip",
+  });
+}
+
+// ── Helpers ──────────────────────────────────────────────────────
+
+/** Quote a YAML string value if it contains special characters. */
+function yamlQuote(s: string): string {
+  if (/[:\n"'#{}[\],&*?|>!%@`]/.test(s) || s.trim() !== s) {
+    return JSON.stringify(s);
+  }
+  return s;
+}
+
+interface TarEntry {
+  name: string;
+  content: Uint8Array;
+}
+
+/**
+ * Create a minimal POSIX tar archive (uncompressed) from file entries.
+ * Each entry gets a 512-byte header followed by content padded to 512.
+ * Archive ends with two 512-byte zero blocks.
+ */
+function createTar(entries: TarEntry[]): Uint8Array {
+  const blocks: Uint8Array[] = [];
+
+  for (const entry of entries) {
+    const header = new Uint8Array(512);
+    const encoder = new TextEncoder();
+
+    // File name (0..99)
+    const nameBytes = encoder.encode(entry.name);
+    header.set(nameBytes.slice(0, 100), 0);
+
+    // File mode (100..107) — 0644
+    writeOctal(header, 100, 8, 0o644);
+    // Owner ID (108..115)
+    writeOctal(header, 108, 8, 0);
+    // Group ID (116..123)
+    writeOctal(header, 116, 8, 0);
+    // File size (124..135)
+    writeOctal(header, 124, 12, entry.content.length);
+    // Modification time (136..147) — current time
+    writeOctal(header, 136, 12, Math.floor(Date.now() / 1000));
+    // Type flag (156) — '0' for regular file
+    header[156] = 0x30;
+    // Magic (257..262) — "ustar\0"
+    header.set(encoder.encode("ustar\0"), 257);
+    // Version (263..264) — "00"
+    header.set(encoder.encode("00"), 263);
+
+    // Checksum (148..155) — fill with spaces first, compute, then write
+    for (let i = 148; i < 156; i++) header[i] = 0x20;
+    let checksum = 0;
+    for (let i = 0; i < 512; i++) checksum += header[i];
+    writeOctal(header, 148, 7, checksum);
+    header[155] = 0x20; // trailing space per POSIX
+
+    blocks.push(header);
+
+    // Content blocks (padded to 512-byte boundary)
+    const contentBlocks = Math.ceil(entry.content.length / 512);
+    const padded = new Uint8Array(contentBlocks * 512);
+    padded.set(entry.content);
+    blocks.push(padded);
+  }
+
+  // End-of-archive marker: two 512-byte zero blocks
+  blocks.push(new Uint8Array(1024));
+
+  // Concatenate all blocks
+  const totalSize = blocks.reduce((sum, b) => sum + b.length, 0);
+  const result = new Uint8Array(totalSize);
+  let offset = 0;
+  for (const block of blocks) {
+    result.set(block, offset);
+    offset += block.length;
+  }
+  return result;
+}
+
+/** Write a number as null-terminated octal string into a tar header field. */
+function writeOctal(header: Uint8Array, offset: number, length: number, value: number): void {
+  const str = value.toString(8).padStart(length - 1, "0");
+  const encoder = new TextEncoder();
+  const bytes = encoder.encode(str);
+  header.set(bytes.slice(0, length - 1), offset);
+  header[offset + length - 1] = 0; // null terminator
+}
+
+/** Gzip compress bytes using the Compression Streams API. */
+async function gzip(data: Uint8Array): Promise<Uint8Array> {
+  const cs = new CompressionStream("gzip");
+  const writer = cs.writable.getWriter();
+  writer.write(data.buffer as ArrayBuffer);
+  writer.close();
+
+  const reader = cs.readable.getReader();
+  const chunks: Uint8Array[] = [];
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    chunks.push(value);
+  }
+
+  const totalSize = chunks.reduce((sum, c) => sum + c.length, 0);
+  const result = new Uint8Array(totalSize);
+  let offset = 0;
+  for (const chunk of chunks) {
+    result.set(chunk, offset);
+    offset += chunk.length;
+  }
+  return result;
+}

ap-web/src/lib/agentGrouping.ts

@@ -0,0 +1,84 @@
+/**
+ * Shared agent-picker grouping: the built-in vs custom split and the
+ * preferred display order, used by both the new-session picker
+ * (NewChatDialog) and the fork/switch picker (ForkSessionDialog) so the
+ * two surfaces group and order agents identically.
+ */
+import type { AvailableAgent } from "@/hooks/useAvailableAgents";
+import { nativeAgentSortRank } from "@/lib/nativeCodingAgents";
+
+// Built-in agents (by name slug) — the long-lived agents the server ships
+// out of the box. Pickers group these first, then a divider, then custom
+// (user-registered) agents. GET /v1/agents doesn't yet distinguish the
+// two, so this is a frontend allowlist for now.
+export const BUILTIN_AGENTS = new Set([
+  "claude-native-ui", // Claude Code
+  "codex-native-ui", // Codex
+  "opencode-native-ui", // OpenCode
+  "pi-native-ui", // Pi
+  "cursor-native-ui", // Cursor
+  "kiro-native-ui", // Kiro
+  "antigravity-native-ui", // Antigravity
+  "goose-native-ui", // Goose
+  "qwen-native-ui", // Qwen Code
+  "kimi-native-ui", // Kimi
+  "polly",
+  "debby",
+]);
+
+// Preferred display order for the built-in group. The server returns
+// agents newest-registered first (agent_store.list sorts by created_at
+// desc), so pin the order users expect; any agent not listed here falls
+// after, in server order.
+export const AGENT_DISPLAY_ORDER = [
+  "Claude Code",
+  "Codex",
+  "OpenCode",
+  "Cursor",
+  "Pi",
+  "Kiro",
+  "Antigravity",
+  "Qwen Code",
+  "Kimi",
+  "Polly",
+  "Debby",
+];
+
+function displayRank(name: string): number {
+  const i = AGENT_DISPLAY_ORDER.indexOf(name);
+  return i === -1 ? AGENT_DISPLAY_ORDER.length : i;
+}
+
+/**
+ * Sort agents into the picker's canonical order: native coding agents by
+ * their sort rank first, then by {@link AGENT_DISPLAY_ORDER}. Stable, so
+ * unranked names keep their incoming (server / scan) relative order.
+ *
+ * @param agents - Agents to sort (not mutated; a copy is returned).
+ */
+export function sortAgentsForDisplay<T extends AvailableAgent>(agents: readonly T[]): T[] {
+  return [...agents].sort(
+    (a, b) =>
+      nativeAgentSortRank(a) - nativeAgentSortRank(b) ||
+      displayRank(a.display_name) - displayRank(b.display_name),
+  );
+}
+
+/**
+ * Sort then split agents into the built-in group and the custom group,
+ * for rendering with a divider between. Built-ins are the
+ * {@link BUILTIN_AGENTS} slugs; everything else is custom.
+ *
+ * @param agents - Agents to group (e.g. the picker's full candidate list).
+ * @returns ``{ builtins, customs }``, each sorted via
+ *   {@link sortAgentsForDisplay}.
+ */
+export function partitionAgentsByKind<T extends AvailableAgent>(
+  agents: readonly T[],
+): { builtins: T[]; customs: T[] } {
+  const sorted = sortAgentsForDisplay(agents);
+  return {
+    builtins: sorted.filter((a) => BUILTIN_AGENTS.has(a.name)),
+    customs: sorted.filter((a) => !BUILTIN_AGENTS.has(a.name)),
+  };
+}

ap-web/src/lib/agentLabels.ts

@@ -20,6 +20,7 @@ export const BRAIN_HARNESS_LABELS: Record<string, string> = {
   cursor: "Cursor",
   pi: "Pi",
   antigravity: "Antigravity",
+  copilot: "Copilot",
 };
 
 /**

ap-web/src/lib/attachments.test.ts

@@ -0,0 +1,73 @@
+import { describe, expect, it } from "vitest";
+import { ATTACHMENT_SIZE_LIMITS_MB, classifyAttachment, validateAttachments } from "./attachments";
+
+function makeFile(name: string, type: string, bytes = 10): File {
+  return new File([new Uint8Array(bytes)], name, { type });
+}
+
+const MB = 1024 * 1024;
+
+describe("classifyAttachment", () => {
+  it("classifies images by MIME", () => {
+    expect(classifyAttachment(makeFile("a.png", "image/png"))).toBe("image");
+    expect(classifyAttachment(makeFile("a.jpg", "image/jpeg"))).toBe("image");
+  });
+
+  it("classifies PDF by MIME or extension", () => {
+    expect(classifyAttachment(makeFile("a.pdf", "application/pdf"))).toBe("pdf");
+    // Some browsers report an empty type for PDFs — fall back to extension.
+    expect(classifyAttachment(makeFile("a.pdf", ""))).toBe("pdf");
+  });
+
+  it("classifies text/code, including code files with empty/wrong MIME", () => {
+    expect(classifyAttachment(makeFile("a.txt", "text/plain"))).toBe("text");
+    expect(classifyAttachment(makeFile("a.json", "application/json"))).toBe("text");
+    // .ts reports video/mp2t in some browsers; extension wins.
+    expect(classifyAttachment(makeFile("a.ts", "video/mp2t"))).toBe("text");
+    expect(classifyAttachment(makeFile("main.rs", ""))).toBe("text");
+    expect(classifyAttachment(makeFile("notebook.ipynb", ""))).toBe("text");
+    // Windows/Excel tags .csv as application/vnd.ms-excel — extension wins.
+    expect(classifyAttachment(makeFile("data.csv", "application/vnd.ms-excel"))).toBe("text");
+  });
+
+  it("rejects office/binary types", () => {
+    const pptx = "application/vnd.openxmlformats-officedocument.presentationml.presentation";
+    expect(classifyAttachment(makeFile("deck.pptx", pptx))).toBeNull();
+    expect(classifyAttachment(makeFile("a.zip", "application/zip"))).toBeNull();
+    expect(classifyAttachment(makeFile("a.bin", "application/octet-stream"))).toBeNull();
+    expect(classifyAttachment(makeFile("a.mp4", "video/mp4"))).toBeNull();
+  });
+});
+
+describe("validateAttachments", () => {
+  it("accepts supported files within their size limit", () => {
+    const files = [makeFile("a.png", "image/png"), makeFile("a.pdf", "application/pdf")];
+    const { accepted, errors } = validateAttachments(files);
+    expect(accepted).toHaveLength(2);
+    expect(errors).toHaveLength(0);
+  });
+
+  it("rejects unsupported types with a message", () => {
+    const pptx = "application/vnd.openxmlformats-officedocument.presentationml.presentation";
+    const { accepted, errors } = validateAttachments([makeFile("deck.pptx", pptx)]);
+    expect(accepted).toHaveLength(0);
+    expect(errors).toHaveLength(1);
+    expect(errors[0]).toContain("deck.pptx");
+  });
+
+  it("rejects files over their per-type size limit", () => {
+    const bigImage = makeFile("huge.png", "image/png", ATTACHMENT_SIZE_LIMITS_MB.image * MB + 1);
+    const { accepted, errors } = validateAttachments([bigImage]);
+    expect(accepted).toHaveLength(0);
+    expect(errors[0]).toContain("too large");
+  });
+
+  it("partitions a mixed batch into accepted + errors", () => {
+    const ok = makeFile("a.png", "image/png");
+    const badType = makeFile("a.zip", "application/zip");
+    const tooBig = makeFile("big.pdf", "application/pdf", ATTACHMENT_SIZE_LIMITS_MB.pdf * MB + 1);
+    const { accepted, errors } = validateAttachments([ok, badType, tooBig]);
+    expect(accepted).toEqual([ok]);
+    expect(errors).toHaveLength(2);
+  });
+});

ap-web/src/lib/attachments.ts

@@ -0,0 +1,165 @@
+/**
+ * Client-side attachment validation: which files can be attached, and how
+ * large each type may be.
+ *
+ * This mirrors the authoritative server-side checks in
+ * omnigent/runtime/content_resolver.py (`attachment_upload_limit`) and the
+ * upload route (415 for unsupported types, 413 for oversized). Keeping a
+ * copy here lets us reject a bad file at paste/drop/pick time — before a
+ * slow upload — with a friendly message. The server still enforces; this is
+ * UX only. Keep the limits in sync with the Python constants.
+ */
+
+/** Per-type upload size limits, in megabytes. Mirrors the server caps. */
+export const ATTACHMENT_SIZE_LIMITS_MB = {
+  image: 5,
+  pdf: 20,
+  text: 10,
+} as const;
+
+export type AttachmentCategory = keyof typeof ATTACHMENT_SIZE_LIMITS_MB;
+
+// Text-bearing application/* MIME types (the rest of the text-like surface
+// is text/*). Mirrors _TEXT_LIKE_APPLICATION_MIMES on the server.
+const TEXT_LIKE_APPLICATION_MIMES = new Set([
+  "application/json",
+  "application/javascript",
+  "application/jsonl",
+  "application/x-ndjson",
+  "application/x-ipynb+json",
+]);
+
+// Text/code extensions whose browser-reported MIME type is often empty or
+// wrong (e.g. a .ts file reports video/mp2t, .rs reports nothing). Mirrors
+// the code entries in _EXTRA_MIME_TYPES on the server so we accept the same
+// files the backend resolves to a text/* type.
+const TEXT_CODE_EXTENSIONS = new Set([
+  ".txt",
+  ".log",
+  ".md",
+  ".markdown",
+  ".csv",
+  ".json",
+  ".jsonl",
+  ".ndjson",
+  ".yaml",
+  ".yml",
+  ".toml",
+  ".ini",
+  ".cfg",
+  ".env",
+  ".lock",
+  ".proto",
+  ".graphql",
+  ".gql",
+  ".html",
+  ".htm",
+  ".xml",
+  ".css",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".ts",
+  ".tsx",
+  ".py",
+  ".rb",
+  ".go",
+  ".rs",
+  ".java",
+  ".kt",
+  ".scala",
+  ".swift",
+  ".c",
+  ".h",
+  ".cc",
+  ".cpp",
+  ".hpp",
+  ".cs",
+  ".php",
+  ".pl",
+  ".r",
+  ".jl",
+  ".lua",
+  ".ex",
+  ".exs",
+  ".erl",
+  ".hs",
+  ".clj",
+  ".dart",
+  ".vue",
+  ".svelte",
+  ".sh",
+  ".bash",
+  ".zsh",
+  ".fish",
+  ".sql",
+  ".tf",
+  ".hcl",
+  ".gradle",
+  ".dockerfile",
+  ".ipynb",
+]);
+
+function extensionOf(filename: string): string {
+  const dot = filename.lastIndexOf(".");
+  return dot >= 0 ? filename.slice(dot).toLowerCase() : "";
+}
+
+/**
+ * Classify a file into an attachment category, or `null` if its type is not
+ * supported (e.g. pptx, docx, xlsx, zip, binaries). Uses the browser MIME
+ * type first, falling back to the filename extension for code/text files
+ * whose MIME is unreliable.
+ */
+export function classifyAttachment(file: File): AttachmentCategory | null {
+  const type = file.type || "";
+  const ext = extensionOf(file.name || "");
+
+  if (type.startsWith("image/")) return "image";
+  if (type === "application/pdf" || ext === ".pdf") return "pdf";
+  if (
+    type.startsWith("text/") ||
+    TEXT_LIKE_APPLICATION_MIMES.has(type) ||
+    TEXT_CODE_EXTENSIONS.has(ext)
+  ) {
+    return "text";
+  }
+  return null;
+}
+
+export interface AttachmentValidation {
+  /** Files that passed type + size checks. */
+  accepted: File[];
+  /** Human-readable rejection messages, one per rejected file. */
+  errors: string[];
+}
+
+/**
+ * Split *files* into accepted attachments and rejection messages. A file is
+ * rejected when its type is unsupported, or when it exceeds the per-type
+ * size limit.
+ */
+export function validateAttachments(files: File[]): AttachmentValidation {
+  const accepted: File[] = [];
+  const errors: string[] = [];
+
+  for (const file of files) {
+    const name = file.name || "file";
+    const category = classifyAttachment(file);
+    if (category === null) {
+      errors.push(
+        `"${name}" can't be attached — only images, PDF, and text/code files are supported.`,
+      );
+      continue;
+    }
+    const limitMb = ATTACHMENT_SIZE_LIMITS_MB[category];
+    if (file.size > limitMb * 1024 * 1024) {
+      errors.push(`"${name}" is too large — the limit for ${category} files is ${limitMb} MB.`);
+      continue;
+    }
+    accepted.push(file);
+  }
+
+  return { accepted, errors };
+}

ap-web/src/lib/blockStream.test.ts

@@ -1314,6 +1314,31 @@ describe("BlockStream — status events", () => {
     }
   });
 
+  it("output_item.done error event preserves persisted ids", () => {
+    const blocks = reduce([
+      {
+        type: "error",
+        source: "execution",
+        toolName: null,
+        error: {
+          code: "kiro_native_prompt_not_recorded",
+          message: "Kiro did not accept this web message.",
+        },
+        itemId: "err_kiro",
+        responseId: "resp_kiro_failed_input",
+      },
+    ]);
+
+    const err = blocks.find((b) => b.type === "error");
+    expect(err).toBeDefined();
+    if (err && err.type === "error") {
+      expect(err.ctx.itemId).toBe("err_kiro");
+      expect(err.ctx.responseId).toBe("resp_kiro_failed_input");
+      expect(err.message).toBe("Kiro did not accept this web message.");
+      expect(err.code).toBe("kiro_native_prompt_not_recorded");
+    }
+  });
+
   it("retry event → RetryBlock with attempt/max/delay fields", () => {
     const blocks = reduce([
       { type: "response_created", response: makeResponse() },

ap-web/src/lib/blockStream.ts

@@ -757,7 +757,7 @@ function* processEvent(state: ReducerState, event: StreamEvent): Generator<AnyBl
       // shows just `[llm]` with no hint as to what went wrong).
       yield {
         type: "error",
-        ctx: ctx(state),
+        ctx: ctx(state, event.itemId ?? null, event.responseId ?? null),
         message: event.error.message,
         source: event.source,
         code: event.error.code,

ap-web/src/lib/changedSort.ts

@@ -0,0 +1,7 @@
+export type ChangedSort = "alpha" | "recent" | "size" | "type";
+
+const VALID_SORTS = new Set<ChangedSort>(["alpha", "recent", "size", "type"]);
+
+export function isValidSort(value: string): value is ChangedSort {
+  return VALID_SORTS.has(value as ChangedSort);
+}

ap-web/src/lib/events.ts

@@ -359,6 +359,10 @@ export interface ErrorEvent {
   source: string;
   toolName: string | null;
   error: ErrorInfo;
+  /** Server-assigned item id when parsed from `response.output_item.done`. */
+  itemId?: string;
+  /** Server-assigned response id when parsed from `response.output_item.done`. */
+  responseId?: string;
 }
 
 // ── Compaction ───────────────────────────────────────────

ap-web/src/lib/filesPanelPreferences.test.ts

@@ -20,10 +20,12 @@ describe("filesPanelPreferences", () => {
   });
 
   it("round-trips a written preference", () => {
-    writeFilesPanelPreferences({ changedOnly: true });
-    // The written value must come back — proves the write serialized and the
-    // read parsed/validated the field.
-    expect(readFilesPanelPreferences()).toEqual({ changedOnly: true });
+    writeFilesPanelPreferences({ changedOnly: true, sort: "alpha", collapsed: false });
+    expect(readFilesPanelPreferences()).toEqual({
+      changedOnly: true,
+      sort: "alpha",
+      collapsed: false,
+    });
   });
 
   it("falls back to defaults on malformed JSON", () => {
@@ -43,6 +45,19 @@ describe("filesPanelPreferences", () => {
     // A record present but with a non-boolean changedOnly must default the
     // field rather than pass a garbage value through to the panel.
     localStorage.setItem(STORAGE_KEY, JSON.stringify({ changedOnly: "yes" }));
-    expect(readFilesPanelPreferences()).toEqual({ changedOnly: false });
+    expect(readFilesPanelPreferences()).toEqual({
+      changedOnly: false,
+      sort: "recent",
+      collapsed: false,
+    });
+  });
+
+  it("defaults sort when the stored value is invalid", () => {
+    localStorage.setItem(STORAGE_KEY, JSON.stringify({ changedOnly: true, sort: "bogus" }));
+    expect(readFilesPanelPreferences()).toEqual({
+      changedOnly: true,
+      sort: "recent",
+      collapsed: false,
+    });
   });
 });

ap-web/src/lib/filesPanelPreferences.ts

@@ -13,9 +13,15 @@
 // the last choice instead of the hardcoded default. A deep-link ?view= URL
 // param overrides the stored preference transiently without mutating it.
 
+import { type ChangedSort, isValidSort } from "@/lib/changedSort";
+
 export interface FilesPanelPreferences {
   /** true = changed-files-only flat list, false = full folder tree ("All"). */
   changedOnly: boolean;
+  /** Sort order for the changed-files flat list. */
+  sort: ChangedSort;
+  /** true = the panel header is collapsed (content hidden). */
+  collapsed: boolean;
 }
 
 const STORAGE_KEY = "omnigent:files-panel-preferences";
@@ -24,6 +30,8 @@ const STORAGE_KEY = "omnigent:files-panel-preferences";
 // the working folder, not just the changed subset.
 export const DEFAULT_FILES_PANEL_PREFERENCES: FilesPanelPreferences = {
   changedOnly: false,
+  sort: "recent",
+  collapsed: false,
 };
 
 /**
@@ -46,6 +54,12 @@ export function readFilesPanelPreferences(): FilesPanelPreferences {
         typeof p.changedOnly === "boolean"
           ? p.changedOnly
           : DEFAULT_FILES_PANEL_PREFERENCES.changedOnly,
+      sort:
+        typeof p.sort === "string" && isValidSort(p.sort)
+          ? p.sort
+          : DEFAULT_FILES_PANEL_PREFERENCES.sort,
+      collapsed:
+        typeof p.collapsed === "boolean" ? p.collapsed : DEFAULT_FILES_PANEL_PREFERENCES.collapsed,
     };
   } catch {
     return DEFAULT_FILES_PANEL_PREFERENCES;

ap-web/src/lib/forkHarness.test.ts

@@ -18,6 +18,9 @@ describe("harnessFamily", () => {
     ["openai-agents", "openai"],
     ["openai-agents-sdk", "openai"],
     ["agents_sdk", "openai"],
+    ["antigravity-native", "gemini"],
+    ["native-antigravity", "gemini"],
+    ["antigravity", "gemini"],
   ])("maps %s → %s", (harness, family) => {
     expect(harnessFamily(harness)).toBe(family);
   });
@@ -38,12 +41,18 @@ describe("isNativeHarness", () => {
     ["native-codex", true],
     ["pi-native", true],
     ["native-pi", true],
+    // Antigravity-native spellings are native too — aligned with Python
+    // NATIVE_HARNESSES (the in-process `antigravity` SDK harness is NOT).
+    ["antigravity-native", true],
+    ["native-antigravity", true],
     ["claude-sdk", false],
     ["claude_sdk", false],
     ["openai-agents", false],
     ["codex", false],
     // The SDK `pi` harness is in-process, not a native CLI wrapper.
     ["pi", false],
+    // The in-process Antigravity SDK harness is likewise not native.
+    ["antigravity", false],
     [null, false],
   ])("classifies %s as native=%s", (harness, expected) => {
     expect(isNativeHarness(harness as string | null)).toBe(expected);
@@ -54,12 +63,17 @@ describe("forkTargetCarriesHistory", () => {
   // SDK targets always carry history as context, regardless of source or
   // family — including native → SDK and cross-family. A false here would
   // wrongly hide a fully-supported switch from the picker.
-  it.each([["claude-sdk"], ["claude_sdk"], ["codex"], ["openai-agents"], ["agents_sdk"]])(
-    "SDK target %s carries history",
-    (target) => {
-      expect(forkTargetCarriesHistory(target)).toBe(true);
-    },
-  );
+  it.each([
+    ["claude-sdk"],
+    ["claude_sdk"],
+    ["codex"],
+    ["openai-agents"],
+    ["agents_sdk"],
+    // antigravity is the Gemini-family SDK target.
+    ["antigravity"],
+  ])("SDK target %s carries history", (target) => {
+    expect(forkTargetCarriesHistory(target)).toBe(true);
+  });
 
   // Native targets carry from ANY source: the runner clones the source's
   // native transcript when the source is same-family native, else rebuilds
@@ -77,6 +91,8 @@ describe("forkTargetCarriesHistory", () => {
     // still be offered, or the fork/switch-agent pickers silently drop it.
     ["pi-native"],
     ["native-pi"],
+    ["antigravity-native"],
+    ["native-antigravity"],
   ])("native target %s carries history", (target) => {
     expect(forkTargetCarriesHistory(target)).toBe(true);
   });

ap-web/src/lib/forkHarness.ts

@@ -19,7 +19,9 @@
 // and tests/e2e/test_host_cross_family_fork_e2e.py).
 
 /** Provider family a harness consumes, or null when unknown. */
-export function harnessFamily(harness: string | null | undefined): "anthropic" | "openai" | null {
+export function harnessFamily(
+  harness: string | null | undefined,
+): "anthropic" | "openai" | "gemini" | null {
   if (!harness) return null;
   switch (harness) {
     case "claude-native":
@@ -34,12 +36,24 @@ export function harnessFamily(harness: string | null | undefined): "anthropic" |
     case "openai-agents-sdk":
     case "agents_sdk":
       return "openai";
+    // Antigravity is Gemini-family: the native CLI (`antigravity-native`)
+    // and the in-process SDK (`antigravity`, plus reversed spellings) all
+    // consume Gemini models.
+    case "antigravity-native":
+    case "native-antigravity":
+    case "antigravity":
+      return "gemini";
     default:
       return null;
   }
 }
 
-/** Whether a harness is a native CLI harness (Claude Code / Codex / Pi). */
+/**
+ * Whether a harness is a native CLI harness (Claude Code / Codex / Pi /
+ * Antigravity). Mirrors Python `NATIVE_HARNESSES` (`omnigent/harness_aliases.py`)
+ * — including both native-antigravity spellings (the in-process `antigravity`
+ * SDK harness is NOT native) — so both sides classify the same set.
+ */
 export function isNativeHarness(harness: string | null | undefined): boolean {
   return (
     harness === "claude-native" ||
@@ -47,7 +61,9 @@ export function isNativeHarness(harness: string | null | undefined): boolean {
     harness === "codex-native" ||
     harness === "native-codex" ||
     harness === "pi-native" ||
-    harness === "native-pi"
+    harness === "native-pi" ||
+    harness === "antigravity-native" ||
+    harness === "native-antigravity"
   );
 }
 

ap-web/src/lib/nativeBridge.ts

@@ -76,6 +76,22 @@ interface NativeShellApi {
   setViewMode?: (params: NativeViewModeParams) => void;
   /** Subscribe to taps on the native switcher; returns an unsubscribe. */
   onViewModeChanged?: (callback: (mode: NativeViewMode) => void) => () => void;
+  /**
+   * Subscribe to the footprint (CSS px, excluding the OS safe area) of the
+   * native floating bars. The shell pushes this whenever it changes — and
+   * immediately on subscribe, since it caches the last value — so the web
+   * layer can fold the real bar dimensions into its inset variables instead of
+   * hardcoding them. Absent on older shells. Returns an unsubscribe.
+   */
+  onNativeInsets?: (callback: (insets: NativeInsets) => void) => () => void;
+}
+
+/** Footprints (CSS px) of the native floating bars, reported by the shell. */
+export interface NativeInsets {
+  /** Server switcher pill height + its top padding. */
+  topBar: number;
+  /** Chat/Terminal bar capsule height + its bottom padding. */
+  bottomBar: number;
 }
 
 export type NativeViewMode = "chat" | "terminal";
@@ -264,11 +280,25 @@ export async function setBadgeCount(count: number): Promise<void> {
   }
 }
 
+/**
+ * Set one of the inset-system CSS variables on the document root. Visibility of
+ * the native bars is web-owned (the web app is what shows/hides them), so the
+ * setters below fold it into `--omnigent-*-bar-visible`; the bars' size comes
+ * from the native bridge (see {@link onNativeInsets} / nativeInsets.ts). Both
+ * combine in `--omnigent-inset-*` (index.css). Harmless off-shell — the size
+ * vars stay 0 there, so a stray visibility flag contributes nothing.
+ */
+function setInsetVar(name: string, value: string): void {
+  if (typeof document === "undefined") return;
+  document.documentElement.style.setProperty(name, value);
+}
+
 /**
  * Inform a native shell that its server switcher should hide. Older shells
  * simply lack this optional method, so this degrades to a no-op.
  */
 export function setNativeServerSwitcherHidden(hidden: boolean): void {
+  setInsetVar("--omnigent-top-bar-visible", hidden ? "0" : "1");
   const native = nativeApi();
   const setter = native?.setServerSwitcherHidden ?? native?.setSidebarOpen;
   if (!setter) return;
@@ -292,6 +322,7 @@ export function setNativeSidebarOpen(open: boolean): void {
  * caller renders its own in-page pill there.
  */
 export function setNativeViewMode(params: NativeViewModeParams): void {
+  setInsetVar("--omnigent-bottom-bar-visible", params.visible ? "1" : "0");
   const native = nativeApi();
   if (!native?.setViewMode) return;
   try {
@@ -317,6 +348,24 @@ export function onNativeViewModeChanged(callback: (mode: NativeViewMode) => void
   }
 }
 
+/**
+ * Subscribe to the native bars' footprint from the shell. The shell pushes the
+ * current value immediately on subscribe (it caches the last emit), then again
+ * on any change. Returns an unsubscribe; a no-op outside a shell that reports
+ * insets (Electron, plain browser, older iOS shells), where the bars don't
+ * exist and the inset CSS vars stay 0.
+ */
+export function onNativeInsets(callback: (insets: NativeInsets) => void): () => void {
+  const native = nativeApi();
+  if (!native?.onNativeInsets) return () => {};
+  try {
+    return native.onNativeInsets(callback);
+  } catch (err) {
+    console.warn("[nativeBridge] native onNativeInsets failed:", err);
+    return () => {};
+  }
+}
+
 /**
  * Fetch the title-bar server picker data from the Electron shell: the
  * window's current server origin plus the recently-connected server list.

ap-web/src/lib/nativeCodingAgents.test.ts

@@ -12,6 +12,22 @@ describe("nativeCodingAgentForHarness", () => {
     expect(nativeCodingAgentForHarness("pi-native")?.key).toBe("pi");
   });
 
+  it("resolves the canonical opencode-native harness", () => {
+    expect(nativeCodingAgentForHarness("opencode-native")?.key).toBe("opencode");
+  });
+
+  it("resolves the canonical qwen-native harness", () => {
+    const agent = nativeCodingAgentForHarness("qwen-native");
+    expect(agent?.key).toBe("qwen");
+    expect(agent?.displayName).toBe("Qwen Code");
+  });
+
+  it("folds the reversed native-qwen alias to the qwen-native spec", () => {
+    expect(nativeCodingAgentForHarness("native-qwen")).toBe(
+      nativeCodingAgentForHarness("qwen-native"),
+    );
+  });
+
   // The server's harness_kind returns the raw executor.config.harness, so a
   // `native-pi` agent must fold to the same spec — else fork/switch into it
   // would miss the terminal-first wrapper labels and render as chat.
@@ -19,8 +35,33 @@ describe("nativeCodingAgentForHarness", () => {
     expect(nativeCodingAgentForHarness("native-pi")).toBe(nativeCodingAgentForHarness("pi-native"));
   });
 
+  it("resolves Kiro and folds the reversed native-kiro alias", () => {
+    const kiro = nativeCodingAgentForHarness("kiro-native");
+    expect(kiro).toMatchObject({
+      key: "kiro",
+      displayName: "Kiro",
+      harness: "kiro-native",
+      wrapperLabel: "kiro-native-ui",
+    });
+    expect(nativeCodingAgentForHarness("native-kiro")).toBe(kiro);
+  });
+
+  it("resolves the canonical antigravity-native harness", () => {
+    expect(nativeCodingAgentForHarness("antigravity-native")?.key).toBe("antigravity");
+  });
+
+  // Same reversed-alias contract as native-pi: `native-antigravity` must
+  // fold to the canonical antigravity-native spec.
+  it("folds the reversed native-antigravity alias to the antigravity-native spec", () => {
+    expect(nativeCodingAgentForHarness("native-antigravity")).toBe(
+      nativeCodingAgentForHarness("antigravity-native"),
+    );
+  });
+
   it("leaves unknown / non-native harnesses unresolved", () => {
     expect(nativeCodingAgentForHarness("claude-sdk")).toBeUndefined();
+    // The in-process Antigravity SDK harness is not a native CLI wrapper.
+    expect(nativeCodingAgentForHarness("antigravity")).toBeUndefined();
     expect(nativeCodingAgentForHarness(null)).toBeUndefined();
     expect(nativeCodingAgentForHarness(undefined)).toBeUndefined();
   });
@@ -33,4 +74,20 @@ describe("nativeWrapperLabelsForAgent", () => {
       [WRAPPER_LABEL_KEY]: "pi-native-ui",
     });
   });
+
+  it("stamps terminal-first labels for a native-antigravity agent", () => {
+    expect(nativeWrapperLabelsForAgent({ name: "my-agy", harness: "native-antigravity" })).toEqual({
+      [UI_MODE_LABEL_KEY]: UI_MODE_TERMINAL_VALUE,
+      [WRAPPER_LABEL_KEY]: "antigravity-native-ui",
+    });
+  });
+
+  it("stamps terminal-first labels for an opencode-native agent", () => {
+    expect(
+      nativeWrapperLabelsForAgent({ name: "my-opencode", harness: "opencode-native" }),
+    ).toEqual({
+      [UI_MODE_LABEL_KEY]: UI_MODE_TERMINAL_VALUE,
+      [WRAPPER_LABEL_KEY]: "opencode-native-ui",
+    });
+  });
 });

ap-web/src/lib/nativeCodingAgents.ts

@@ -4,7 +4,18 @@ export const WRAPPER_LABEL_KEY = "omnigent.wrapper";
 export const UI_MODE_LABEL_KEY = "omnigent.ui";
 export const UI_MODE_TERMINAL_VALUE = "terminal";
 
-export type NativeCodingAgentIconKind = "claude" | "codex" | "pi" | "cursor" | "goose";
+export type NativeCodingAgentIconKind =
+  | "claude"
+  | "codex"
+  | "opencode"
+  | "pi"
+  | "cursor"
+  | "kiro"
+  | "goose"
+  | "qwen"
+  | "antigravity"
+  | "kimi"
+  | "hermes";
 export type NativeCodingAgentCapability = "permissionMode" | "approvalMode";
 
 export interface NativeCodingAgentSpec {
@@ -39,6 +50,16 @@ export const NATIVE_CODING_AGENTS = [
     sortRank: 20,
     capabilities: ["approvalMode"],
   },
+  {
+    key: "opencode",
+    agentName: "opencode-native-ui",
+    harness: "opencode-native",
+    wrapperLabel: "opencode-native-ui",
+    displayName: "OpenCode",
+    iconKind: "opencode",
+    sortRank: 25,
+    capabilities: ["approvalMode"],
+  },
   {
     key: "cursor",
     agentName: "cursor-native-ui",
@@ -57,6 +78,29 @@ export const NATIVE_CODING_AGENTS = [
     iconKind: "pi",
     sortRank: 40,
   },
+  {
+    key: "kiro",
+    agentName: "kiro-native-ui",
+    harness: "kiro-native",
+    wrapperLabel: "kiro-native-ui",
+    displayName: "Kiro",
+    iconKind: "kiro",
+    sortRank: 50,
+  },
+  {
+    // Antigravity's native CLI (Gemini-family). Mirrors the server's
+    // canonical `antigravity-native` harness and the `antigravity-native-ui`
+    // wrapper the runner keys off to boot the terminal. Added ALONGSIDE the
+    // upstream in-process `antigravity` SDK harness (see BRAIN_HARNESS_LABELS
+    // in agentLabels.ts) — they are distinct rows.
+    key: "antigravity",
+    agentName: "antigravity-native-ui",
+    harness: "antigravity-native",
+    wrapperLabel: "antigravity-native-ui",
+    displayName: "Antigravity",
+    iconKind: "antigravity",
+    sortRank: 45,
+  },
   {
     key: "goose",
     agentName: "goose-native-ui",
@@ -64,7 +108,42 @@ export const NATIVE_CODING_AGENTS = [
     wrapperLabel: "goose-native-ui",
     displayName: "Goose",
     iconKind: "goose",
-    sortRank: 50,
+    sortRank: 60,
+  },
+  {
+    // qwen has no brand glyph yet, so it falls back to the generic bot icon
+    // (see AgentCard.iconForAgent / SubagentsPanel) — the `iconKind: "qwen"`
+    // intentionally matches no icon branch. Auth/approval surface in the
+    // embedded terminal, so no capability flags are declared here.
+    key: "qwen",
+    agentName: "qwen-native-ui",
+    harness: "qwen-native",
+    wrapperLabel: "qwen-native-ui",
+    displayName: "Qwen Code",
+    iconKind: "qwen",
+    sortRank: 60,
+  },
+  {
+    key: "kimi",
+    agentName: "kimi-native-ui",
+    harness: "kimi-native",
+    wrapperLabel: "kimi-native-ui",
+    displayName: "Kimi",
+    iconKind: "kimi",
+    sortRank: 70,
+  },
+  {
+    // hermes has no brand glyph yet, so it falls back to the generic bot icon
+    // (see AgentCard.iconForAgent / SubagentsPanel) — the `iconKind: "hermes"`
+    // intentionally matches no icon branch. Auth/approval surface in the
+    // embedded terminal, so no capability flags are declared here.
+    key: "hermes",
+    agentName: "hermes-native-ui",
+    harness: "hermes-native",
+    wrapperLabel: "hermes-native-ui",
+    displayName: "Hermes",
+    iconKind: "hermes",
+    sortRank: 80,
   },
 ] as const satisfies readonly NativeCodingAgentSpec[];
 
@@ -79,12 +158,18 @@ const BY_WRAPPER: Map<string, NativeCodingAgentSpec> = new Map(
 );
 
 // Reversed harness spellings that fold to a canonical native `harness`.
-// Mirrors omnigent.harness_aliases on the server: only `native-pi` is a
-// supported reversed alias (claude/codex use the canonical form).
+// Mirrors omnigent.harness_aliases.NATIVE_HARNESSES on the server, which
+// accepts both the canonical and reversed native spellings (claude/codex
+// only use the canonical form, so they need no reversed entry here).
 const HARNESS_ALIASES: Record<string, string> = {
   "native-pi": "pi-native",
   "native-cursor": "cursor-native",
+  "native-kiro": "kiro-native",
+  "native-antigravity": "antigravity-native",
   "native-goose": "goose-native",
+  "native-qwen": "qwen-native",
+  "native-kimi": "kimi-native",
+  "native-hermes": "hermes-native",
 };
 
 export function nativeCodingAgentForAgentName(

ap-web/src/lib/nativeInsets.ts

@@ -0,0 +1,27 @@
+// Applies the native iOS shell's reported bar footprints to the inset CSS
+// variables the layout consumes.
+//
+// The iOS shell pushes the pixel height of its floating server switcher (top)
+// and chat/terminal bar (bottom) over the bridge — the one piece of the inset
+// system that CSS/JS cannot compute on its own. This module writes those onto
+// `--omnigent-native-top-bar` / `--omnigent-native-bottom-bar`; index.css folds
+// them (together with the web-owned visibility flags and `env(safe-area-*)`)
+// into `--omnigent-inset-top` / `--omnigent-inset-bottom`, which `<PageScroll>`
+// and the scoped iOS rules read.
+//
+// No-op off the iOS shell: the size vars keep their `0px` defaults, so the same
+// inset variables resolve to plain `env(safe-area-*)` (browser, Electron).
+
+import { onNativeInsets } from "@/lib/nativeBridge";
+
+/**
+ * Start mirroring native bar footprints into the inset CSS variables. Call once
+ * at app startup. Returns an unsubscribe (a no-op outside the iOS shell).
+ */
+export function initNativeInsets(): () => void {
+  return onNativeInsets(({ topBar, bottomBar }) => {
+    const root = document.documentElement.style;
+    root.setProperty("--omnigent-native-top-bar", `${topBar}px`);
+    root.setProperty("--omnigent-native-bottom-bar", `${bottomBar}px`);
+  });
+}

ap-web/src/lib/policyParams.test.ts

@@ -65,6 +65,46 @@ describe("coercePolicyParams", () => {
     });
   });
 
+  it("parses browser number input notation for integer fields", () => {
+    const result = coercePolicyParams(
+      ["threshold"],
+      { threshold: { type: "integer" } },
+      { threshold: "1e2" },
+    );
+    expect(result).toEqual({
+      ok: true,
+      params: { threshold: 100 },
+    });
+  });
+
+  it("rejects decimal and non-numeric input for integer fields", () => {
+    const decimal = coercePolicyParams(
+      ["threshold"],
+      { threshold: { type: "integer" } },
+      { threshold: "12.9" },
+    );
+    expect(decimal.ok).toBe(false);
+    if (!decimal.ok) expect(decimal.error).toContain("integer");
+
+    const invalid = coercePolicyParams(
+      ["threshold"],
+      { threshold: { type: "integer" } },
+      { threshold: "abc" },
+    );
+    expect(invalid.ok).toBe(false);
+    if (!invalid.ok) expect(invalid.error).toContain("integer");
+  });
+
+  it("rejects partial numeric strings for number fields", () => {
+    const result = coercePolicyParams(
+      ["ratio"],
+      { ratio: { type: "number" } },
+      { ratio: "1.2abc" },
+    );
+    expect(result.ok).toBe(false);
+    if (!result.ok) expect(result.error).toContain("number");
+  });
+
   it("passes string and unmapped types through verbatim", () => {
     const result = coercePolicyParams(
       ["state_key"],

ap-web/src/lib/policyParams.ts

@@ -40,9 +40,23 @@ export function coercePolicyParams(
     if (raw === undefined || raw === "") continue;
     const type = properties[key]?.type;
     if (type === "integer") {
-      params[key] = parseInt(raw, 10);
+      const value = Number(raw);
+      if (!Number.isFinite(value) || !Number.isInteger(value)) {
+        return {
+          ok: false,
+          error: `${key} must be an integer, e.g. 20`,
+        };
+      }
+      params[key] = value;
     } else if (type === "number") {
-      params[key] = parseFloat(raw);
+      const value = Number(raw);
+      if (!Number.isFinite(value)) {
+        return {
+          ok: false,
+          error: `${key} must be a number, e.g. 0.5`,
+        };
+      }
+      params[key] = value;
     } else if (type === "boolean") {
       params[key] = raw === "true";
     } else if (type === "array") {

ap-web/src/lib/sessionEvents.test.ts

@@ -452,6 +452,36 @@ describe("response.output_item.done (message)", () => {
   });
 });
 
+describe("response.output_item.done (error)", () => {
+  it("lifts persisted error items for live transcript rendering", () => {
+    const out = parse("response.output_item.done", {
+      type: "response.output_item.done",
+      item: {
+        id: "err_kiro",
+        type: "error",
+        status: "completed",
+        response_id: "resp_kiro_failed_input",
+        source: "execution",
+        code: "kiro_native_prompt_not_recorded",
+        message: "Kiro did not accept this web message.",
+      },
+    });
+
+    expect(out).toHaveLength(1);
+    expect(out[0]).toEqual({
+      type: "error",
+      source: "execution",
+      toolName: null,
+      error: {
+        code: "kiro_native_prompt_not_recorded",
+        message: "Kiro did not accept this web message.",
+      },
+      itemId: "err_kiro",
+      responseId: "resp_kiro_failed_input",
+    });
+  });
+});
+
 describe("response.output_item.done (slash_command)", () => {
   // parseOutputItem returns null for unknown item.types; without
   // these cases the live UI silently drops every Skill invocation.

ap-web/src/lib/sessionsApi.ts

@@ -417,6 +417,49 @@ export async function createSession(
   return sessionFromWire(await readJsonOrThrow<SessionResponseWire>(res));
 }
 
+/**
+ * Create a session with an inline agent bundle via multipart
+ * `POST /v1/sessions`.
+ *
+ * The server creates a session-scoped agent from the uploaded bundle
+ * (a `.tar.gz` containing `config.yaml` and optionally `AGENTS.md`)
+ * and binds it to the new session in one atomic operation. Session
+ * metadata (host, workspace, labels, etc.) is sent as a JSON string
+ * in the `metadata` form part.
+ *
+ * @param bundle - The agent bundle as a `File` (`.tar.gz`).
+ * @param metadata - Session-level metadata (host_id, workspace, labels, etc.).
+ * @returns The created session's id.
+ */
+export async function createBundledSession(
+  bundle: File,
+  metadata: {
+    host_id?: string;
+    host_type?: string;
+    workspace?: string;
+    labels?: Record<string, string>;
+    terminal_launch_args?: string[];
+    git?: { branch_name: string; base_branch?: string };
+  } = {},
+): Promise<{ id: string }> {
+  const form = new FormData();
+  form.append("metadata", JSON.stringify(metadata));
+  form.append("bundle", bundle);
+  const res = await authenticatedFetch("/v1/sessions", {
+    method: "POST",
+    body: form,
+  });
+  if (!res.ok) {
+    const text = await res.text();
+    throw new Error(`Failed to create bundled session: ${res.status} ${text}`);
+  }
+  // The multipart response uses `session_id` (CreatedSessionResponse),
+  // while the JSON path uses `id` (SessionResponse). Normalize to `id`
+  // so callers don't need to care which path was taken.
+  const body = (await res.json()) as { session_id: string };
+  return { id: body.session_id };
+}
+
 /**
  * Fork (clone) a session into a new one via
  * POST /v1/sessions/{source_id}/fork.

ap-web/src/lib/sse.ts

@@ -923,6 +923,20 @@ function parseOutputItem(data: Record<string, unknown>): StreamEvent | null {
     } satisfies MessageDone;
   }
 
+  if (itemType === "error") {
+    return {
+      type: "error",
+      source: String(rec.source ?? ""),
+      toolName: null,
+      error: {
+        code: String(rec.code ?? ""),
+        message: String(rec.message ?? ""),
+      },
+      itemId,
+      responseId,
+    } satisfies ErrorEvent;
+  }
+
   if (itemType === "slash_command") {
     // Coerce a missing ``output`` (server-side exclude_none) to null
     // so downstream code branches on a single shape.

ap-web/src/main.tsx

@@ -10,6 +10,7 @@ import { SessionUpdatesProvider } from "./hooks/SessionUpdatesProvider";
 import { resolveServerInfo, type ServerInfo } from "./lib/capabilities";
 import { CapabilitiesProvider } from "./lib/CapabilitiesContext";
 import { resolveIdentity } from "./lib/identity";
+import { initNativeInsets } from "./lib/nativeInsets";
 import { initChatStore } from "./store/chatStore";
 import "./index.css";
 
@@ -35,6 +36,10 @@ initChatStore(queryClient);
 // routes know who's making the request.
 void resolveIdentity();
 
+// Mirror the iOS shell's native bar footprints into the inset CSS variables.
+// No-op off the iOS shell (the inset vars stay at their env()-only defaults).
+initNativeInsets();
+
 // Probe /v1/info BEFORE the first render so the route table knows
 // whether to mount accounts routes. The probe is unauthed and the
 // failure path resolves to "accounts off" — so even a stalled or

ap-web/src/pages/ChatPage.composer.test.tsx

@@ -1,4 +1,4 @@
-import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { cleanup, fireEvent, render, screen, waitFor, within } from "@testing-library/react";
 import type { ReactElement } from "react";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { useChatStore } from "@/store/chatStore";
@@ -76,7 +76,9 @@ describe("Composer slash-command menu", () => {
   });
 
   it("highlights the first match as soon as the menu opens", () => {
-    render(<Composer {...composerProps()} />);
+    // /compact is native-wrapper-only (#1139); render a native session so it
+    // appears as the first built-in and is the default highlight.
+    render(<Composer {...composerProps({ isNativeWrapper: true })} />);
     fireEvent.change(textarea(), { target: { value: "/" } });
     // Built-ins are inserted first, so "/compact" tops the list and is the
     // default highlight — the crux of the fix (was -1 / nothing selected).
@@ -148,7 +150,9 @@ describe("Composer slash-command menu", () => {
   });
 
   it("ArrowDown moves the highlight to the next match", () => {
-    render(<Composer {...composerProps()} />);
+    // /compact is native-wrapper-only (#1139); render a native session so the
+    // first built-in is "/compact" and ArrowDown advances to "/context".
+    render(<Composer {...composerProps({ isNativeWrapper: true })} />);
     const ta = textarea();
     fireEvent.change(ta, { target: { value: "/" } });
     expect(activeRow()?.textContent).toContain("/compact");
@@ -417,6 +421,75 @@ describe("Composer slash-command submit routing", () => {
   });
 });
 
+describe("AgentPicker trigger label", () => {
+  beforeEach(() => {
+    useChatStore.setState({
+      conversationId: "conv_test",
+      skills: [],
+      selectedModel: null,
+      selectedEffort: null,
+      llmModel: null,
+      codexModelOptions: [],
+      nativeVendorOwnsModel: false,
+    });
+  });
+  afterEach(() => {
+    cleanup();
+    vi.restoreAllMocks();
+  });
+
+  it("shows the model in the foreground and effort muted (model/effort swapped into the trigger)", () => {
+    useChatStore.setState({ selectedModel: "opus", selectedEffort: "high" });
+    renderWithTooltips(
+      <Composer
+        {...composerProps({
+          agents: [{ id: "a1", name: "claude" }],
+          selectedAgentId: "a1",
+          modelPickerKind: "claude",
+          showModels: true,
+        })}
+      />,
+    );
+    const trigger = screen.getByTestId("agent-picker-trigger");
+    expect(trigger).toHaveTextContent("Opus");
+    expect(trigger).toHaveTextContent("High");
+    // The harness identity ("Claude") is NOT in the trigger anymore — it
+    // moved to the status tray below.
+    expect(trigger).not.toHaveTextContent("Claude");
+    // Model black, effort grey.
+    expect(within(trigger).getByText("Opus")).toHaveClass("text-foreground");
+    expect(within(trigger).getByText("High")).toHaveClass("text-muted-foreground");
+  });
+
+  it("still renders an enabled trigger when the model/effort label is unresolved", () => {
+    // Regression guard: a claude-native session before the snapshot fills
+    // llmModel/selectedEffort has no model label, no effort label, and no
+    // agent switcher — but CLAUDE_NATIVE_MODELS still gives the dropdown
+    // model rows to switch (hasPickerActions). The trigger must NOT vanish
+    // (which would also take the model dropdown and the bare-`/model` path
+    // with it); it falls back to a stable identity label and stays enabled.
+    useChatStore.setState({ selectedModel: null, selectedEffort: null, llmModel: null });
+    renderWithTooltips(
+      <Composer
+        {...composerProps({
+          agents: [{ id: "a1", name: "claude" }],
+          selectedAgentId: "a1",
+          modelPickerKind: "claude",
+          showModels: true,
+          showEffort: false,
+        })}
+      />,
+    );
+    const trigger = screen.getByTestId("agent-picker-trigger");
+    expect(trigger).toBeVisible();
+    // Enabled because there are still model rows to switch — so the dropdown
+    // (and the bare-`/model` open path) stays reachable.
+    expect(trigger).toBeEnabled();
+    // Falls back to the bound agent's display label rather than rendering empty.
+    expect(trigger).toHaveTextContent("Claude");
+  });
+});
+
 describe("Composer effort slash-command visibility", () => {
   beforeEach(() => {
     useChatStore.setState({ conversationId: "conv_test", skills: [] });
@@ -428,13 +501,15 @@ describe("Composer effort slash-command visibility", () => {
   });
 
   it("omits /effort from suggestions when effort controls are hidden", () => {
-    render(<Composer {...composerProps({ showEffort: false })} />);
+    // /compact is native-wrapper-only (#1139); render a native session so it
+    // stays present as the control row used to anchor this assertion.
+    render(<Composer {...composerProps({ showEffort: false, isNativeWrapper: true })} />);
     fireEvent.change(textarea(), { target: { value: "/" } });
 
-    // Row testids — the active entry ("/compact") also renders in the
-    // detail card, so a text query would double-match.
+    // Row testids — /compact is hidden for non-native-wrapper sessions,
+    // so verify /context is present instead.
     expect(screen.queryByTestId("slash-menu-item-effort")).toBeNull();
-    expect(screen.getByTestId("slash-menu-item-compact")).toBeInTheDocument();
+    expect(screen.getByTestId("slash-menu-item-context")).toBeInTheDocument();
   });
 
   it("shows /model in suggestions for in-process and picker-backed native sessions", () => {