2026.08.22.02 — theme favourites, ctrl+? shortcuts, command hq in two columns

Schema change this time: theme_favorites is new, and without the push the theme dropdown fails on a missing
relation the first time it reads a starred list. The plan names db:push as a step rather than leaving it to
be inferred from a diff.

Two things the plan states that a reader could not infer. Command HQ MIGRATES a saved layout on load, so
anyone who has opened that screen sees their arrangement replaced once — deliberate, and the screen is
locked so the only loss is column sizes. And the email plugin's multi-account work arrives through
plugins:update from another repository, affecting only hosts where that plugin is installed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

TODO.md

@@ -20,31 +20,32 @@ the owner's OS user and can never be granted. Indirection there really is accide
 
 ## Themes
 
-**78 open, 20 closed**, across 28 themes.
+**87 open, 25 closed**, across 29 themes.
 
 | Theme                                                                                      | Open | Closed |
 | ------------------------------------------------------------------------------------------ | ---- | ------ |
 | [Affordances](todo/affordances/)                                                           | 1    | 0      |
 | [Speaking into a session from the backend](todo/agent-delivery/)                           | 2    | 0      |
 | [Backburner](todo/backburner/)                                                             | 2    | 0      |
-| [Background jobs](todo/background-jobs/)                                                   | 1    | 0      |
+| [Background jobs](todo/background-jobs/)                                                   | 2    | 0      |
 | [Chat interface](todo/chat/)                                                               | 1    | 0      |
 | [Code editor](todo/code-editor/)                                                           | 1    | 0      |
 | [Components — the shared UI layer](todo/components/)                                       | 1    | 0      |
 | [File watchers](todo/file-watchers/)                                                       | 1    | 0      |
-| [Fleet — one command across every server](todo/fleet/)                                     | 3    | 0      |
+| [Fleet — one command across every server](todo/fleet/)                                     | 5    | 2      |
 | [Headscale](todo/headscale/)                                                               | 0    | 5      |
 | [Infra (alpha)](todo/infra/)                                                               | 6    | 0      |
-| [Known bugs](todo/known-bugs/)                                                             | 2    | 1      |
-| [Mobile apps](todo/mobile-apps/)                                                           | 2    | 0      |
-| [Multi-user](todo/multi-user/)                                                             | 17   | 3      |
+| [Known bugs](todo/known-bugs/)                                                             | 3    | 2      |
+| [Mobile apps](todo/mobile-apps/)                                                           | 3    | 0      |
+| [Multi-user](todo/multi-user/)                                                             | 16   | 5      |
 | [Notifications](todo/notifications/)                                                       | 1    | 0      |
 | [Plugin ecosystem — before it opens to third parties (2026-08-18)](todo/plugin-ecosystem/) | 3    | 0      |
 | [Plugin infrastructure](todo/plugin-infrastructure/)                                       | 2    | 0      |
 | [Plugin repos — what writing their READMEs turned up](todo/plugin-repos/)                  | 10   | 9      |
 | [Plugin system — gaps the email extraction found (2026-08-18)](todo/plugin-system/)        | 3    | 0      |
 | [Prompt library](todo/prompt-library/)                                                     | 1    | 0      |
-| [Shell — spotlight and the dock](todo/shell/)                                              | 1    | 1      |
+| [Settings — portable, and readable by an agent](todo/settings/)                            | 2    | 0      |
+| [Shell — spotlight and the dock](todo/shell/)                                              | 4    | 1      |
 | [Sub-agents — agents spawning agents](todo/sub-agents/)                                    | 1    | 1      |
 | [Sudo terminal modal](todo/sudo-terminal-modal/)                                           | 1    | 0      |
 | [Tooling — the list about the list](todo/tooling/)                                         | 1    | 0      |
@@ -62,13 +63,13 @@ the owner's OS user and can never be granted. Indirection there really is accide
 
 ## Newest ten
 
+- `2026-08-22` **A plugin's permission should be on for every role by default, off only on request** — [multi-user/a-plugin-s-permission-should-be-on-for-every](todo/multi-user/a-plugin-s-permission-should-be-on-for-every.md)
+- `2026-08-22` **A user's settings should export and import as a plain file** — [settings/a-user-s-settings-should-export-and-import-as](todo/settings/a-user-s-settings-should-export-and-import-as.md)
+- `2026-08-22` **The same for system settings, owned by the Super Admin** — [settings/the-same-for-system-settings-owned-by-the](todo/settings/the-same-for-system-settings-owned-by-the.md)
+- `2026-08-22` **All keyboard shortcuts configurable** — [shell/all-keyboard-shortcuts-configurable](todo/shell/all-keyboard-shortcuts-configurable.md)
+- `2026-08-22` **Ctrl+? shows every keyboard shortcut in a modal** — [shell/ctrl-shows-every-keyboard-shortcut-in-a-modal](todo/shell/ctrl-shows-every-keyboard-shortcut-in-a-modal.md)
+- `2026-08-22` **Revamp the menus — spotlight, themes — toward an Omarchy-like shape** — [shell/revamp-the-menus-toward-an-omarchy-like-shape](todo/shell/revamp-the-menus-toward-an-omarchy-like-shape.md)
 - `2026-08-21` **No way to see which affordances are reaching your agents, or to turn one off** — [affordances/no-way-to-see-which-affordances-are-reaching](todo/affordances/no-way-to-see-which-affordances-are-reaching.md)
 - `2026-08-21` **Generalise it: deliver a turn to a named session, from anywhere in the backend** — [agent-delivery/generalise-it-deliver-a-turn-to-a-named](todo/agent-delivery/generalise-it-deliver-a-turn-to-a-named.md)
 - `2026-08-21` **The cost of resuming grows with the transcript** — [agent-delivery/the-cost-of-resuming-grows-with-the-transcript](todo/agent-delivery/the-cost-of-resuming-grows-with-the-transcript.md)
-- `2026-08-21` **Show how long a turn took, beside its cost and tokens** — [chat/show-how-long-a-turn-took-beside-its-cost](todo/chat/show-how-long-a-turn-took-beside-its-cost.md)
-- `2026-08-21` **Map every custom component, centralise it, and let a theme override it** — [components/map-every-custom-component-and-centralise-it](todo/components/map-every-custom-component-and-centralise-it.md)
-- `2026-08-21` **Watch a directory, and attach actions to what lands in it** — [file-watchers/watch-a-directory-and-attach-actions-to-what](todo/file-watchers/watch-a-directory-and-attach-actions-to-what.md)
-- `2026-08-21` **Settings to choose which server each feature uses** — [fleet/settings-to-choose-which-server-each-feature](todo/fleet/settings-to-choose-which-server-each-feature.md)
-- `2026-08-21` **A way to mark a commit "this one ships", so a release is not just `master`'s tip** — [fleet/a-way-to-mark-a-commit-this-one-ships-so-a](todo/fleet/a-way-to-mark-a-commit-this-one-ships-so-a.md)
-- `2026-08-21` **OPM — Officer's own process manager, or at least its own PM2** — [infra/opm-officer-s-own-process-manager](todo/infra/opm-officer-s-own-process-manager.md)
-- `2026-08-21` **iPhone Action Button → run an Officer task from a locked phone** — [mobile-apps/iphone-action-button-run-an-officer-task-from](todo/mobile-apps/iphone-action-button-run-an-officer-task-from.md)
+- `2026-08-21` **'An agent spawned by a background job is invisible in the interface'** — [background-jobs/a-spawned-agent-is-invisible-in-the-interface](todo/background-jobs/a-spawned-agent-is-invisible-in-the-interface.md)

deploy/2026.08.21.02.md

@@ -0,0 +1,33 @@
+# 2026.08.21.02
+
+Command HQ made usable: a commander's transcript renders, and Live separates commanders from the
+conversations somebody is having.
+
+Frontend and one chat API route. **No schema change, no dependency change** — verified against
+`deploy/2026.08.21.01..HEAD`: nothing touched `src/schema.ts`, `package.json` dependencies or `bun.lock`.
+So there is no `db:push` and no `bun install` in this plan, and a host that runs one has run something
+this release did not ask for.
+
+## What is in it
+
+- Three separate defects that each made a commander's conversation invisible: the pane navigated to
+  officer's session key instead of Claude's transcript id, then remounted and discarded the live chat at
+  the end of the first turn, then seeded `useChat` with messages that had not arrived yet.
+- Live splits into `Agents (n)` / `Commanders (n)`, and `/chat/live` now carries `isCommander` so a client
+  with no room for tabs — the iPhone app's swipe order — can filter on it.
+- The handoff watcher's controls, which were built and never rendered.
+
+## Every host
+
+In the order the procedure gives. Nothing here is host-specific.
+
+1. `git pull --ff-only`
+2. `bun run plugins:update`
+3. `pm2 restart officer`
+
+**`officer` only.** No sidecar changed. Restarting `officer` rebuilds the SPA on boot, which is what
+ships the frontend — there is no separate build step to run.
+
+## Then check
+
+`pm2 jlist`: `officer` is `online` and its `restart_time` moved. Nothing else should have restarted.

deploy/2026.08.21.02.report.md

@@ -0,0 +1,76 @@
+# 2026.08.21.02 — deployed
+
+**6/6 hosts.** Every platform the plan reaches is on `55ecbf4f`, `officer` restarted and back `online`,
+and no other process on any host was touched by the restart step.
+
+`officer-dev` is the seventh platform and was **skipped entirely** — it is the host this commander runs
+on. See below.
+
+Rolled out one host at a time from `officer-dev`, by the procedure in `prompts/deploy-commander.md`.
+
+## The release
+
+Tag `deploy/2026.08.21.02` → `55ecbf4f`; `package.json` says `2026.08.21.02`. They agree.
+Plan: `deploy/2026.08.21.02.md` — pull, `plugins:update`, restart `officer` only. No `bun install`,
+no `db:push`, and neither was run anywhere.
+
+| Host                         | Before     | After      | plugins        | restarted | restart_time | back    |
+| ---------------------------- | ---------- | ---------- | -------------- | --------- | ------------ | ------- |
+| `alpha`                      | `eee73e77` | `55ecbf4f` | 12/12          | officer   | 60 → 61      | online  |
+| `fofos`                      | `eee73e77` | `55ecbf4f` | 1/1            | officer   | 15 → 16      | online  |
+| `macbookpro`                 | `eee73e77` | `55ecbf4f` | none installed | officer   | 2 → 3        | online  |
+| `edge-pertento-bridge`       | `eee73e77` | `55ecbf4f` | 2/2            | officer   | 4 → 5        | online  |
+| `production-pertento-bridge` | `eee73e77` | `55ecbf4f` | 1/1            | officer   | 6 → 7        | online  |
+| `deadpool-rezio-bridge`      | `bd41dff5` | `55ecbf4f` | none installed | officer   | 0 → 1        | online  |
+| `officer-dev`                | `55ecbf4f` | `55ecbf4f` | not run        | **none**  | 155          | skipped |
+
+Every host was clean of TRACKED changes and every pull was a real fast-forward. `pm2 jlist` after each
+restart showed zero processes in any state other than `online`, so nothing was collaterally bounced.
+
+Checkout paths were taken from each `officer` process's `pm_cwd`, not assumed — so `alpha`'s stale
+second checkout at `~/dockers/officer.dev/platform` was never touched.
+
+## What was NOT done, and why
+
+- **`officer-dev` was skipped completely** — no pull, no `plugins:update`, no restart. This session runs
+  inside `officer-claude-code` on it, and its `officer` process would have been restarted out from under
+  the rollout. Its checkout is already at `55ecbf4f` (the tag was cut here), so **the code is present and
+  the running process is a build behind**. `pm2 restart officer` on `officer-dev`, when the owner is happy
+  with the rest, finishes this release. **Outstanding.**
+
+- **`deadpool-rezio-bridge` was two releases behind, not one.** It came in at `bd41dff5` — the
+  `deploy/2026.08.21.01` commit — while every other host was at `eee73e77`. The fast-forward carried both,
+  14 files, and it is now level. Nothing was wrong with it; it simply had not had the interim commits.
+
+- **`fofos` still cannot sync its capabilities.** Same `dubious ownership` refusal as `2026.08.21.01`,
+  same unexplained cause, still not papered over with a `safe.directory` entry. New this time and probably
+  the same root: its gitea plugin could not publish affordances —
+  `EACCES: permission denied, mkdir '/home/pastilhas/officerdev/capabilities/affordances/officerdev'`.
+  Both point at that capabilities checkout being owned by somebody other than `pastilhas`, which is worth
+  one `stat` before the next deploy. `plugins:update` exited 0 and the plugin itself updated. **Unexplained,
+  and now costing two things instead of one.**
+
+- **`fofos` carries one untracked file**, `scripts/chk.ts`. A note, not a skip — that is the rule the last
+  report asked for and it worked.
+
+- **No `bun install` and no `db:push` ran anywhere.** The plan says this release needs neither.
+
+## Notes for the next one
+
+- **`macbookpro` needs the PATH helped after all — carefully.** The last report said "`$SHELL -ic` and
+  nothing else"; that is right for `pm2` and wrong for `bun`. `bun` is at `/opt/homebrew/bin/bun`, and
+  `.zshrc` does not put `/opt/homebrew/bin` on the interactive PATH, so `bun run plugins:update` failed
+  `command not found` before it ran a line. What works is **appending** that one directory for that one
+  command (`export PATH=$PATH:/opt/homebrew/bin`) and running `pm2` as a separate command. Appending
+  shadows nothing — `pm2` stays at `~/.local/bin/pm2` and `node` at `node@22`. **Replacing** the PATH is
+  what broke `pm2` last time. `docs/servers.md` says "do not help the PATH" and should say "append, never
+  replace, and only for `bun`".
+
+- **`$SHELL -ic` on `macbookpro` also aliases `ls` to `eza`**, which is not installed, so a probe using
+  `ls` reports a missing file that is plainly there. Use `command ls` or a plain non-interactive shell for
+  file tests.
+
+- **`plugins:update` restarts sidecars itself.** It prints `sidecar: started` per plugin, so on `alpha`
+  twelve sidecars bounced during step 3 — before the plan's restart step, and not something the plan asked
+  for. That is the script's own behaviour and it is not new, but a report that only lists `officer` under
+  "restarted" is understating it. Worth a line in the plan format.

deploy/2026.08.21.03.md

@@ -0,0 +1,30 @@
+# 2026.08.21.03 — a drill
+
+**No code change.** This release exists to watch the watcher fire, and to exercise the claim rule that
+landed after the last one.
+
+There is nothing to bump but the version and this file, and that is deliberate rather than lazy: a tag
+whose `package.json` disagrees with it makes the commander stop, and a tag with no plan beside it makes it
+stop too, so the smallest honest release is still a version and a plan.
+
+## What is being tested
+
+- The watcher noticing a tag and spawning an agent on its own, with nobody watching the composer.
+- `scripts/deploy-claim.sh` taking the claim before anything is deployed, and the deploy recording success
+  through the same script.
+- A second pass over the same version being refused rather than repeated.
+
+## Every host
+
+1. `git pull --ff-only`
+2. `bun run plugins:update`
+3. `pm2 restart officer`
+
+`officer` only. No `bun install`, no `db:push` — nothing in this range touches a schema, a dependency or
+the lockfile, and `git diff deploy/2026.08.21.02..HEAD` is two files.
+
+## Then check
+
+`pm2 jlist`: `officer` is `online` and its `restart_time` moved. Nothing else restarted.
+
+`scripts/deploy-claim.sh state 2026.08.21.03` says `done`.

deploy/2026.08.21.03.report.md

@@ -0,0 +1,83 @@
+# 2026.08.21.03 — deployed
+
+**6/6 hosts.** Every platform the plan reaches is on `3343b21a`, `officer` restarted and back `online`,
+and no other process on any host was left in a state other than `online`.
+
+`officer-dev` is the seventh platform and was **skipped entirely** — it is the host this deploy ran on.
+See below; its skip is now two releases deep.
+
+This was a drill. The release changes `package.json` and adds its own plan file, nothing else, and it
+exists to watch the claim rule work. It did: `scripts/deploy-claim.sh claim 2026.08.21.03` was taken
+before any host was touched, and `state` reads `done`.
+
+## The release
+
+Tag `deploy/2026.08.21.03` → `3343b21a`; `package.json` at that commit says `2026.08.21.03`. They agree.
+Plan: `deploy/2026.08.21.03.md` — pull, `plugins:update`, restart `officer` only. No `bun install`, no
+`db:push`, and neither ran anywhere.
+
+| Host                         | Before     | After      | plugins        | restarted | restart_time | back    |
+| ---------------------------- | ---------- | ---------- | -------------- | --------- | ------------ | ------- |
+| `alpha`                      | `55ecbf4f` | `3343b21a` | 12/12          | officer   | 61 → 62      | online  |
+| `fofos`                      | `55ecbf4f` | `3343b21a` | 1/1            | officer   | 16 → 17      | online  |
+| `macbookpro`                 | `55ecbf4f` | `3343b21a` | none installed | officer   | 3 → 4        | online  |
+| `edge-pertento-bridge`       | `55ecbf4f` | `3343b21a` | 2/2            | officer   | 5 → 6        | online  |
+| `production-pertento-bridge` | `55ecbf4f` | `3343b21a` | 1/1            | officer   | 7 → 8        | online  |
+| `deadpool-rezio-bridge`      | `55ecbf4f` | `3343b21a` | none installed | officer   | 1 → 2        | online  |
+| `officer-dev`                | `3343b21a` | `3343b21a` | not run        | **none**  | 155          | skipped |
+
+Every host came in at `55ecbf4f` — the previous release, level for the first time in three deploys — and
+every pull was a real fast-forward. Checkout paths were taken from each `officer` process's `pm_cwd`, so
+`alpha`'s stale second checkout at `~/dockers/officer.dev/platform` was never touched. `macbookpro` was
+awake.
+
+**More than `officer` restarted, and the plan did not ask for it.** `bun run plugins:update` bounces each
+plugin's sidecar as it goes: twelve on `alpha`, two on `edge`, one each on `fofos` and
+`production-pertento-bridge`. Every one came back `online`. Nothing was left down.
+
+## What was NOT done, and why
+
+- **`officer-dev` was skipped completely** — no pull (it is already at the tag, which was cut here), no
+  `plugins:update`, no restart. This session runs inside `officer-claude-code` on it, and restarting
+  `officer` there ends the rollout mid-flight.
+
+  **Its running process is now two releases old.** `restart_time` is 155, unchanged since before
+  `2026.08.21.02` — so the same restart the last report left outstanding is still outstanding, and it now
+  carries both releases. The code for both is on disk. `pm2 restart officer` on `officer-dev` finishes
+  them, whenever the owner wants it. **Outstanding, and no longer new.**
+
+- **`fofos` still cannot sync its capabilities.** Third deploy running, same two failures, same
+  unexplained cause:
+
+  - `capabilities: failed — fatal: detected dubious ownership in repository at
+    '/home/pastilhas/officerdev/capabilities'`
+  - `affordances: NOT published — EACCES: permission denied, mkdir
+    '/home/pastilhas/officerdev/capabilities/affordances/officerdev'`
+
+  Both say that checkout is not owned by `pastilhas`. Still not papered over with a `safe.directory`
+  entry, because a `safe.directory` line would silence the first message and leave the `EACCES` — they are
+  one cause, and one `stat` settles it. `plugins:update` exited 0 and the gitea plugin itself updated, so
+  this costs capability sync on that host and nothing else. **Unexplained.**
+
+- **`fofos` still carries one untracked file**, `scripts/chk.ts`. A note, not a skip — the rule works.
+
+- **No `bun install` and no `db:push` ran anywhere.** The plan says this release needs neither, and
+  `deploy/2026.08.21.02..deploy/2026.08.21.03` is two files.
+
+- **Nothing was verified beyond `pm2`.** `officer` is `online` with a moved `restart_time` on all six
+  hosts; no HTTP request was made to any domain. That is what the plan asked to check.
+
+## Notes for the next one
+
+- **The `macbookpro` PATH rule in `docs/servers.md` is now correct and was followed as written.**
+  `export PATH=$PATH:/opt/homebrew/bin` for the `bun` command, `pm2` as a separate command, and both
+  worked first time. Nothing to change.
+
+- **`$SHELL -ic "pm2 jlist"` with stderr discarded came back empty once**, on `edge-pertento-bridge`, and
+  the same command with `2>&1` a second later returned the full list. Transient, and it looked exactly
+  like a dead pm2. Capture stderr and parse the JSON out of the stream rather than trusting the whole of
+  stdout to be JSON — an interactive shell puts its own noise (`starship`, aliases) in there.
+
+- **`officer-dev`'s skip needs a home other than a report.** It has been carried forward twice now, and a
+  report is not a place work waits — the next deploy will write the same paragraph. Either the owner
+  restarts it, or it belongs in `TODO.md`.

deploy/2026.08.21.04.md

@@ -0,0 +1,51 @@
+# 2026.08.21.04
+
+`/login` in the chat window, switching between Anthropic accounts from the usage pills, and a Spotlight
+that can actually reach the plugins.
+
+**This release has a SCHEMA CHANGE.** The previous two did not, and said so; this one adds
+`anthropic_accounts`. Without the push, `GET /api/claude-auth/accounts` fails on a missing relation the
+first time the usage panel is opened — so `bun db:push` is a step here, not an optional tidy.
+
+No dependency change: nothing in `deploy/2026.08.21.03..HEAD` touches `package.json` dependencies or
+`bun.lock`. Do not run `bun install`.
+
+## What is in it
+
+- **`/login` works in the chat composer.** `claude auth login` behaves the same through plain pipes as
+  through a terminal, so it is a subprocess with two reads and one write — no pty. Copy-link beside the
+  open-link button, because opening it here opens it in the browser already signed into the account you are
+  leaving.
+- **Account switching from the usage pills.** `anthropic_accounts` keeps each login's OAuth credential
+  encrypted under a per-account key from the secret store, so a switch needs no browser round trip. An
+  account with no saved credential still gets a chip you can read — cached percentages and a correct reset
+  time — marked as needing `/login`.
+- **Spotlight reached eight items.** Core filled all eight slots, so on a populated server every plugin was
+  unreachable. The cap is gone, rows draw the dock's own tiles, and the settings list went from nine
+  hand-written rows to twenty read off the screens that declare them.
+- The ephemeral pane opens from the markup rather than an effect.
+
+## Every host
+
+1. `git pull --ff-only`
+2. **`bun db:push`** — new this release, see above
+3. `bun run plugins:update`
+4. `pm2 restart officer`
+
+`officer` only; no sidecar changed. Restarting it rebuilds the SPA, which is what ships the frontend.
+
+**`alpha` is already at this code**, deployed by hand as a preview before the tag. Its pull will be a
+no-op and that is expected — run the remaining steps anyway rather than skipping the host, so its
+`restart_time` moves with everyone else's.
+
+**On `macbookpro`, append to the PATH for `bun`** — `export PATH=$PATH:/opt/homebrew/bin` — and run `pm2`
+as a separate command. `docs/servers.md` has the detail; replacing the PATH is what broke `pm2` on an
+earlier deploy.
+
+## Then check
+
+`pm2 jlist`: `officer` is `online` and `restart_time` moved. Nothing else restarted by step 4 — note that
+step 3 restarts every plugin's sidecar on its own, which is the script's behaviour and worth recording
+rather than omitting.
+
+`scripts/deploy-claim.sh state 2026.08.21.04` says `done`.

deploy/2026.08.21.04.report.md

@@ -0,0 +1,102 @@
+# 2026.08.21.04 — deploy report
+
+**6 of 6 hosts in scope succeeded.** `officer-dev` was skipped entirely — it is the host this agent runs
+on. Seven platforms exist; six were deployable.
+
+Target commit `98177c3b`, tag `deploy/2026.08.21.04`, `package.json` version `2026.08.21.04` — tag and
+version agree.
+
+Every host ran the same four steps from `deploy/2026.08.21.04.md`: `git pull --ff-only`, `bun db:push`
+(the schema change), `bun run plugins:update`, `pm2 restart officer`. No host ran `bun install` — the plan
+said not to.
+
+---
+
+## Per host
+
+### `alpha` — succeeded
+
+- HEAD `3cab16ca` → `98177c3b`. Tree clean, no untracked files.
+- The pull moved only `deploy/2026.08.21.04.md` and `package.json`: the code was already there from the
+  hand deploy the plan describes. Expected, and the remaining steps ran anyway.
+- `db:push` — changes applied. `anthropic_accounts` verified present by direct query.
+- `plugins:update` — 12/12 updated in 44s, exit 0. **Twelve sidecars restarted by that step**: atelier,
+  bitcoin-wallet, email, gitea, invoices, jellyfin, music, offscale, photos, soulseek, transmission,
+  vault. That is the script's own behaviour, not something the plan asked for.
+- `pm2 restart officer` — `restart_time` 63 → 64, `online`.
+
+### `fofos` — succeeded
+
+- HEAD `3343b21a` → `98177c3b`. No tracked changes.
+- **Untracked file present: `scripts/chk.ts`.** Left alone — a fast-forward cannot touch it, and it is
+  not a reason to skip a host.
+- `db:push` — changes applied. `anthropic_accounts` verified by direct query.
+- `plugins:update` — 1/1 (gitea), exit 0. One sidecar restarted: `officer-gitea`.
+- `pm2 restart officer` — 17 → 18, `online`.
+- The capabilities ownership fault recorded in `docs/servers.md` did not recur: `capabilities: pulled`.
+
+### `macbookpro` — succeeded
+
+- HEAD `b10a49c0` → `98177c3b`. Tree clean.
+- Awake and reachable; no skip needed.
+- `bun` reached with `export PATH=$PATH:/opt/homebrew/bin` appended for the `bun` commands only, `pm2`
+  run as a separate command, per the plan and `docs/servers.md`.
+- `db:push` — changes applied.
+- `plugins:update` — "no plugins installed — nothing to update", exit 0. No sidecar restarted.
+- `pm2 restart officer` — 4 → 5, `online`.
+- **The one thing not verified here:** `psql` is not on this machine's PATH under any prefix tried, so
+  `anthropic_accounts` was confirmed only by `db:push` reporting "Changes applied", not by querying the
+  table. Every other host was checked directly.
+- Cosmetic noise from the interactive shell: `.zshrc:123: command not found: starship`. Harmless, and
+  unrelated to the deploy.
+
+### `edge-pertento-bridge` — succeeded
+
+- HEAD `3343b21a` → `98177c3b`. Tree clean.
+- `db:push` — changes applied. `anthropic_accounts` verified by direct query.
+- `plugins:update` — 2/2 (gitea, offscale), exit 0. Two sidecars restarted.
+- `pm2 restart officer` — 6 → 7, `online`.
+
+### `production-pertento-bridge` — succeeded
+
+- HEAD `3343b21a` → `98177c3b`. Tree clean.
+- `db:push` — changes applied. `anthropic_accounts` verified by direct query.
+- `plugins:update` — 1/1 (gitea), exit 0. One sidecar restarted.
+- `pm2 restart officer` — 8 → 9, `online`.
+
+### `deadpool-rezio-bridge` — succeeded
+
+- Logged in as `br`, checkout `/home/br/officerdev/platform`.
+- HEAD `3343b21a` → `98177c3b`. Tree clean.
+- `db:push` — changes applied. `anthropic_accounts` verified by direct query.
+- `plugins:update` — "no plugins installed — nothing to update", exit 0. No sidecar restarted.
+- `pm2 restart officer` — 2 → 3, `online`.
+
+### `officer-dev` — SKIPPED, deliberately
+
+Not pulled, no schema push, no plugin update, nothing restarted. This agent is a session inside
+`officer-claude-code` on this machine, and restarting `officer` here ends the rollout mid-report. The
+host is therefore one release behind the other six until the owner deploys it by hand — checkout
+`~/officer-dev/platform`, and its working tree is already at `98177c3b` plus this report.
+
+---
+
+## What was checked, and how
+
+- Every checkout path came from PM2 (`officer`'s `pm_cwd`), not from the table — so `alpha`'s second,
+  stale checkout was never a candidate.
+- `pm2 jlist` after each restart: `officer` `online` with `restart_time` moved, on all six.
+- A full sweep for anything not `online` on all six hosts afterwards: **none**. No process came back
+  `errored`, including the sixteen sidecars that `plugins:update` bounced across four hosts.
+- `anthropic_accounts` queried directly with `to_regclass` on five hosts; on `macbookpro` only the
+  `db:push` output stands behind it.
+
+## What was not done
+
+- `officer-dev` — the whole host, as above.
+- No host was skipped for a dirty tree; none had tracked changes.
+- No process other than `officer` was restarted by this agent. The sidecars that moved were restarted by
+  `plugins:update` itself.
+- `bun install` was not run anywhere, per the plan.
+
+Local record: `data/deploys/2026.08.21.04.done`, written before this report.

deploy/2026.08.22.01.md

@@ -0,0 +1,53 @@
+# 2026.08.22.01
+
+349 community themes, Spotlight made usable, prompt history that stops eating drafts, and the email
+plugin's multi-account backend.
+
+**No schema change and no dependency change.** Verified against `deploy/2026.08.21.04..HEAD`: nothing
+touches a `databases/*/schema.ts`, `package.json` dependencies or `bun.lock`. So **no `bun db:push` and no
+`bun install`** — a host that runs either has run something this release did not ask for. Note that the
+previous release DID need a push; that was `anthropic_accounts` and it is already applied everywhere.
+
+## What is in it
+
+- **The theme collection.** 147 ports from omarchythemes.com, then 44 more rescued by supporting
+  `colors.toml` and `0x`-prefixed hex, then a fix to accent/secondary foreground derivation across 202 of
+  them. This is the bulk of the diff: 229 files, ~22.5k lines, almost all data.
+- **Spotlight.** Opens on **alt-space** and nothing else, from anywhere including a focused text field.
+  The eight-item cap is gone — core items filled it, so every plugin tile was unreachable on a populated
+  server. Rows draw the dock's own tiles, and the settings list went from nine hand-written entries to
+  twenty read off the screens that declare them.
+- **Prompt history.** Up/Down only recall from an empty composer, and any other keystroke ends a recall —
+  so a half-written thought is never swapped for one from last week.
+- **The email plugin's multi-account backend**, which arrives via `plugins:update` rather than through this
+  repository. `?account=<id>` names a mailbox, `?account=all` spans them. **Absent is unchanged**, so
+  nothing that calls those routes today behaves differently — including the mobile app and the agent's
+  `email_db` tool. Only hosts with the email plugin installed are affected at all.
+
+## Every host
+
+1. `git pull --ff-only` — larger than usual, ~22.5k lines of theme data
+2. `bun run plugins:update`
+3. `pm2 restart officer`
+
+`officer` only. Step 2 restarts each plugin's own sidecar, which is that script's behaviour and worth
+recording in the report rather than omitting.
+
+**`macbookpro`:** append `/opt/homebrew/bin` to PATH for the `bun` commands and run `pm2` separately. See
+`docs/servers.md` — replacing the PATH is what broke `pm2` on an earlier deploy.
+
+## `officer-dev` — skip it, and do NOT report it as behind
+
+The commander runs there and skips its own host, as always. But this time the host is **already on this
+code**: `officer` was restarted there many times during the night as the work landed, so it is running the
+tree this tag names rather than lagging. Report it as skipped and current, not skipped and stale.
+
+## Then check
+
+`pm2 jlist`: `officer` is `online` and `restart_time` moved. Nothing `errored`, including the sidecars step
+2 bounced.
+
+A theme picker still lists themes and one loads — the diff is data, so a bad parse would show as a missing
+or unreadable theme rather than as a failed boot.
+
+`scripts/deploy-claim.sh state 2026.08.22.01` says `done`.

deploy/2026.08.22.01.report.md

@@ -0,0 +1,104 @@
+# 2026.08.22.01 — deploy report
+
+**6 of 6 hosts succeeded.** `officer-dev` skipped (the commander's own host) and already on this code.
+No host failed, no process came back `errored`.
+
+Tag `deploy/2026.08.22.01` → `78db9c8c`. `package.json` reads `2026.08.22.01` at that commit — they agree.
+Every host went `98177c3b` → `78db9c8c`, a clean fast-forward.
+
+Per the plan: **no `bun install` and no `bun db:push` ran anywhere.**
+
+## Per host
+
+### `alpha` — succeeded
+
+- Checkout `/home/pastilhas/officerdev/platform`, from PM2's `pm_cwd` (the stale second checkout at
+  `~/dockers/officer.dev/platform` was not touched).
+- Tree clean, tracked and untracked both. HEAD `98177c3b` → `78db9c8c`.
+- `bun run plugins:update`: `12/12 updated in 48s`, no plugin reported a failure. It bounced twelve plugin
+  sidecars of its own accord — atelier, bitcoin-wallet, email, gitea, invoices, jellyfin, music, offscale,
+  photos, soulseek, transmission, vault.
+- `pm2 restart officer`: `restart_time` 64 → 65, `online`.
+- All 19 processes `online` afterwards.
+
+One gap, stated because it is the kind of thing a report should not quietly round up: **the exit code of
+`plugins:update` was lost on this host** — the shell wrapper swallowed it. Success is asserted from the
+`12/12 updated` line and the absence of any per-plugin failure, not from an exit status. Every other host
+captured an explicit `0`.
+
+### `fofos` — succeeded
+
+- Checkout `/home/pastilhas/officerdev/platform`. HEAD `98177c3b` → `78db9c8c`.
+- **One untracked file present: `scripts/chk.ts`.** Noted, not a reason to skip — a fast-forward cannot
+  touch it, and it was left alone. No tracked change.
+- `plugins:update` exit 0: `1/1 updated in 7s` (gitea), its sidecar restarted.
+- `pm2 restart officer`: 18 → 19, `online`. All 8 processes `online`.
+- The capabilities sync that failed here for three deploys ran clean: `capabilities: pulled`. The ownership
+  fix of 2026-08-21 is holding.
+
+### `macbookpro` — succeeded
+
+- Awake and reachable. Checkout `/Users/pastilhas/projects/officer-suite/platform`.
+- HEAD `98177c3b` → `78db9c8c`, tree clean.
+- `bun` run with `PATH=$PATH:/opt/homebrew/bin` **appended**, `pm2` run as a separate command through the
+  interactive shell, exactly as the plan and `docs/servers.md` require.
+- `plugins:update` exit 0: `no plugins installed — nothing to update`. No sidecar bounced.
+- `pm2 restart officer`: 5 → 6, `online`. All 6 processes `online`.
+
+### `edge-pertento-bridge` — succeeded
+
+- Checkout `/home/pastilhas/officerdev/platform`. HEAD `98177c3b` → `78db9c8c`, tree clean.
+- `plugins:update` exit 0: `2/2 updated in 9s` (gitea, offscale), both sidecars restarted.
+- `pm2 restart officer`: 7 → 8, `online`. All 8 processes `online`.
+
+### `production-pertento-bridge` — succeeded
+
+- Checkout `/home/pastilhas/officerdev/platform`. HEAD `98177c3b` → `78db9c8c`, tree clean.
+- `plugins:update` exit 0: `1/1 updated in 4s` (gitea), its sidecar restarted.
+  nvm printed its `.npmrc` `globalconfig`/`prefix` warning first. Pre-existing, unrelated to this release,
+  and the command still exited 0 — recorded so the next reader does not chase it.
+- `pm2 restart officer`: 9 → 10, `online`.
+- This host also runs a **non-Officer** PM2 set (`Dashboard`, `Tracking`, `Uptime`, five `Crons *` entries).
+  All `online`, none touched.
+
+### `deadpool-rezio-bridge` — succeeded
+
+- Login `br`, not `pastilhas`. Checkout `/home/br/officerdev/platform`.
+- HEAD `98177c3b` → `78db9c8c`, tree clean.
+- `plugins:update` exit 0: `2/2 updated in 8s` (email, offscale), both sidecars restarted.
+  Printed `capabilities: adopted` rather than `pulled` — this host's capabilities checkout is newer than
+  the others'. Not an error.
+- `pm2 restart officer`: 3 → 4, `online`. All 9 processes `online`.
+
+### `officer-dev` — SKIPPED, and current
+
+The commander runs here, inside `officer-claude-code`. Nothing was pulled and nothing restarted.
+
+It is **not behind**: `deploy/2026.08.22.01` is an ancestor of the local HEAD. The checkout is in fact
+**two commits past** the tag — `c9823533` and `0c2ff88c`, neither on `origin` when this ran — written by
+another agent working in this same tree during the rollout. Its work was left alone; only this report was
+staged, by path.
+
+Worth knowing rather than discovering: **pushing this report carries those two commits to `origin/master`
+with it**, because they are its ancestors. Nothing was deployed from them — every host in this rollout is
+at `78db9c8c`, the tag — but the next release will include them.
+
+`officer` here is `online` at `restart_time` 180, running the tree this tag names.
+
+## Verification
+
+- **Every restarted process came back.** `pm2 jlist` re-read on each host after the restart: `officer`
+  `online` with `restart_time` incremented, and no process anywhere in state `errored` or `stopped`.
+- **The theme data landed.** The release is mostly data, so a bad file shows up as a missing or unreadable
+  theme rather than a failed boot. All six hosts carry **227** theme CSS files under
+  `src/workspaces/theme/css/themes/`, matching the release tree exactly.
+- `scripts/deploy-claim.sh state 2026.08.22.01` → `done`.
+
+## What was not done
+
+- **`officer-dev` was skipped entirely** — its own host, by design. The owner restarts it deliberately when
+  happy with the rest. It needs no pull.
+- **No theme was loaded through a UI.** The plan asks that a theme picker still lists themes and one loads.
+  A commander cannot click. The file-count check above is the substitute, and it is weaker: it proves the
+  files arrived, not that each parses.
+- **`alpha`'s `plugins:update` exit code was not captured** (see above). Judged from output, not status.

deploy/2026.08.22.02.md

@@ -0,0 +1,57 @@
+# 2026.08.22.02
+
+Theme favourites, a shortcuts modal on `Ctrl+?`, Command HQ rebuilt into two columns, 27 tests on the
+authorization resolver, and the email plugin's multi-account backend.
+
+**SCHEMA CHANGE.** `theme_favorites` is new, so `bun db:push` is a step. Without it, opening the theme
+dropdown fails on a missing relation the first time it reads a starred list.
+
+**No dependency change** — nothing in `deploy/2026.08.22.01..HEAD` touches `package.json` dependencies or
+`bun.lock`. Do not run `bun install`.
+
+## What is in it
+
+- **Theme favourites**, per account, in `theme_favorites`. Star from the dropdown, from the browser
+  (`f`), or from anywhere (`Ctrl+Shift+F`). The lists rotate to the theme you are wearing rather than
+  sorting it to the top, so neighbours survive.
+- **`Ctrl+?`** renders every shell shortcut from a registry — `state/shortcuts.ts` — ported in shape from
+  the owner's `vimazing`.
+- **Spotlight is on `Shift+Space`.** It was `alt-space` in the last release. `Ctrl+Space` cannot work:
+  Brave claims it at the browser level and the key never reaches the page.
+- **Command HQ is two columns** — navigation stacked into one 24% rail, transcript at 76%. **It migrates a
+  saved layout on load**, so anyone who has opened that screen will see their arrangement replaced once.
+  That is deliberate; the screen is `locked` and the only user contribution was column sizes.
+- **27 tests on `permissions/authorize.ts`**, which had none. Its decisions are now pure functions, split
+  from the database calls. No behaviour change.
+- **`assertPermissionTotality` reads the sockets that are served**, generated from one `WS_ROUTES`
+  declaration, instead of a parallel list of handlers.
+- **The email plugin's multi-account backend**, via `plugins:update` — `?account=<id>` names a mailbox,
+  `?account=all` spans them, absent is unchanged. Only hosts with that plugin installed are affected.
+
+## Every host
+
+1. `git pull --ff-only`
+2. **`bun db:push`** — new this release
+3. `bun run plugins:update`
+4. `pm2 restart officer`
+
+`officer` only. Step 3 restarts each plugin's own sidecar; that is the script's behaviour and belongs in the
+report rather than being omitted.
+
+**`macbookpro`:** append `/opt/homebrew/bin` to PATH for the `bun` commands, run `pm2` separately. See
+`docs/servers.md`.
+
+## `officer-dev` — skip it, and it is already current
+
+The commander runs there and skips its own host. That host was restarted repeatedly through the day as this
+work landed, so it is running this tree rather than lagging. Report it as skipped and current.
+
+## Then check
+
+`pm2 jlist`: `officer` is `online` and `restart_time` moved; nothing `errored`.
+
+`theme_favorites` exists — `to_regclass('theme_favorites')` is not null. This is the one step whose absence
+shows up as a broken dropdown rather than a failed boot, so verify it directly where `psql` is available and
+say where it is not.
+
+`scripts/deploy-claim.sh state 2026.08.22.02` says `done`.

deploy/README.md

@@ -11,7 +11,13 @@ deploy/
 The plan is written by hand before the release commit. The report is written by the deploy commander
 afterwards and pushed back here.
 
-**The report's presence is what marks a release deployed.** That is the whole idempotence mechanism: a
-watcher that restarts checks for the report before acting, so it cannot roll the same release out twice.
+**A release is a tag**, `deploy/<version>`, and nothing else triggers a deploy — not a commit message,
+not a branch. A tag cannot be written into prose by accident, which a code word can and which every
+document about deploying does.
+
+**What marks a release deployed is LOCAL**: `$OFFICER_ROOT/data/deploys/<version>.done`. Not the report.
+If the lock were the pushed report, a failed push would mean the release looked undeployed and the next
+tick would roll it out again — and pushes here fail for unrelated reasons. So the report is an artefact,
+valuable and not load-bearing.
 
 See `prompts/deploy-commander.md`.

docs/servers.md

@@ -4,59 +4,131 @@ Every machine the owner runs, how to reach it, and what of Officer is on it. Kep
 orchestrator ("pull and update every platform", "restart officer everywhere", "which host is behind")
 has one place to read rather than a fact re-derived per session.
 
-**Started 2026-08-21.** Everything below was verified from `officer-dev` on that date by SSH and
-`pm2 jlist`, except where marked assumed. Commit SHAs are a snapshot and go stale immediately — they
-are here to show which checkout is live, not as a status board.
+**Verified 2026-08-21** from `officer-dev` by SSH and `pm2 jlist`, except where marked assumed.
 
 ## How access works
 
-All of it is over the tailnet. There is **no `~/.ssh/config`** — names resolve by MagicDNS and the
-login is key-based, so `ssh <name>` as `pastilhas` is the whole story:
+All of it is over the tailnet, key-based, no `~/.ssh/config`, no passwords, no jump hosts, no ports.
+
+**The login user is NOT always `pastilhas`.** It is per host and it is in the table below. `deadpool` runs
+as `br` and always will — the owner's key is authorised for that account. An orchestrator that hard-codes
+a username fails on that host and will fail on the next one like it.
 
 ```bash
-ssh alpha
-ssh fofos
+ssh alpha                       # pastilhas, implied
+ssh br@deadpool-rezio-bridge    # not implied
 ```
 
-Nothing here needs a password, a jump host or a port. A host that refuses port 22 is not
-misconfigured — see "Not SSH-reachable" below.
-
 ## Officer platforms
 
-| Host | Tailnet IP | Live checkout | Runs `officer` | Git remote |
-| --- | --- | --- | --- | --- |
-| `officer-dev` | 100.64.0.13 | `~/officer-dev/platform` | yes (this host) | `git@gitea.officer.dev:officerdev/platform.git` |
-| `alpha` | 100.64.0.1 | `~/officerdev/platform` | yes | `git@gitea.officer.dev:officerdev/platform.git` |
-| `fofos` | 100.64.0.17 | `~/officerdev/platform` | yes | `https://gitea.officer.dev/officerdev/platform.git` |
-| `headscale` | 100.64.0.2 | `~/dockers/officerdev/platform` | no | `ssh://git@gitea.pastilhas.dev:2222/officerdev/platform.git` |
-| `omega` | 100.64.0.3 | `~/projects/officerdev/platform` | no | none set |
+Seven, all running.
 
-Three things an orchestrator has to handle, all verified and none of them cosmetic:
+| Host                         | Tailnet IP  | Login       | Checkout                            | Domain                            |
+| ---------------------------- | ----------- | ----------- | ----------------------------------- | --------------------------------- |
+| `officer-dev`                | 100.64.0.13 | `pastilhas` | `~/officer-dev/platform`            | `platform.officer.dev`            |
+| `alpha`                      | 100.64.0.1  | `pastilhas` | `~/officerdev/platform`             | `officer.pastilhas.dev`           |
+| `fofos`                      | 100.64.0.17 | `pastilhas` | `~/officerdev/platform`             | `officer.fofosfluffybastards.com` |
+| `macbookpro`                 | 100.64.0.9  | `pastilhas` | `~/projects/officer-suite/platform` | `macbookpro.pastilhas.dev`        |
+| `edge-pertento-bridge`       | 100.64.0.15 | `pastilhas` | `~/officerdev/platform`             | `edge.pertento.ai`                |
+| `production-pertento-bridge` | 100.64.0.12 | `pastilhas` | `~/officerdev/platform`             | `officer.pertento.ai`             |
+| `deadpool-rezio-bridge`      | 100.64.0.21 | **`br`**    | `/home/br/officerdev/platform`      | `officer.rezio.dev` `[pending]`   |
 
-- **The checkout path differs per host.** There is no single path to hard-code. Take it from PM2 —
-  `pm2 jlist` gives the `officer` process's `pm_cwd`, which is the checkout that is actually serving.
-- **`alpha` has a SECOND, stale checkout** at `~/dockers/officer.dev/platform` (same remote, different
-  HEAD). Pulling the wrong one updates nothing and looks like success. PM2's `pm_cwd` is the tiebreak.
-- **The remotes are not the same URL.** `fofos` pulls over HTTPS and `headscale` points at a different
-  Gitea entirely (`gitea.pastilhas.dev:2222`). An orchestrator that assumes SSH to `gitea.officer.dev`
-  breaks on two of five.
+Only `platform.officer.dev` is public (77.42.39.155). The rest resolve to tailnet addresses and are
+reachable from inside only.
 
-`headscale` and `omega` hold a checkout but run no `officer` process (no PM2 on either). Whether those
-are retired, staging or half-installed is **not established** — ask before treating them as targets.
+### Names that disagree with themselves
+
+Three hosts answer to more than one name, and `tailscale status` is not always the one in use:
+
+| In `tailscale status`   | Also                         | The machine's own hostname |
+| ----------------------- | ---------------------------- | -------------------------- |
+| `edge-bridge`           | `edge-pertento-bridge`       | `edge-pertento`            |
+| `gitea-bridge`          | `production-pertento-bridge` | `PPROD`                    |
+| `deadpool-rezio-bridge` | —                            | `deadpool`                 |
+
+The middle column is what to use. `edge-bridge` and `gitea-bridge` are the old names and are being
+retired; anything reading `tailscale status` will still see them.
+
+### Things that will catch out an orchestrator
+
+All verified, none cosmetic.
+
+- **The checkout path differs per host** — four distinct shapes across seven machines. Take it from PM2:
+  the `officer` process's `pm_cwd`. `alpha` carries a SECOND, stale checkout at
+  `~/dockers/officer.dev/platform`, and pulling that one succeeds while changing nothing.
+- **`pm2` is not on a non-interactive PATH.** It lives under nvm, and nvm's setup is in `.zshrc`, which a
+  _login_ shell does not read. Use `ssh <host> '$SHELL -ic "pm2 jlist"'`. `-lc` is **not** enough — it
+  reports "command not found" on machines where pm2 is plainly running, which cost two wrong conclusions
+  on 2026-08-21.
+- **On `macbookpro`, APPEND to the PATH for `bun`. Never replace it.** This said "do not help the PATH"
+  until 2026-08-21, and that was half right in a way that cost a deploy step: `pm2` is only on the
+  interactive shell's PATH, so replacing it breaks `pm2` — but `bun` is at `/opt/homebrew/bin/bun` and
+  `.zshrc` does not put that directory on the interactive PATH either, so `bun run plugins:update` fails
+  `command not found` before it runs a line. `export PATH=$PATH:/opt/homebrew/bin` for that one command
+  shadows nothing: `pm2` stays at `~/.local/bin/pm2` and `node` at `node@22`. Run `pm2` as a separate
+  command.
+- **`$SHELL -ic` on `macbookpro` aliases `ls` to `eza`, which is not installed.** A probe using `ls`
+  reports a missing file that is plainly there. Use `command ls`, or a non-interactive shell for file tests.
+- **The git remotes differ.** `fofos` pulls over HTTPS; the others over SSH. Never assume a URL — pull in
+  place.
+- **A "dirty tree" means TRACKED changes.** `git status --porcelain` counts untracked files, and a stray
+  script a fast-forward could never touch is not a reason to skip a host. Use `--untracked-files=no`.
+- **`macbookpro` is a laptop.** It may be asleep. Unreachable is a skip with a note, not a failed deploy.
+- **`bun run plugins:update` restarts sidecars itself**, printing `sidecar: started` per plugin — on
+  `alpha` that is twelve processes bouncing during the plugins step, before any restart the plan asked for.
+  Not a fault, but a deploy report that lists only `officer` under "restarted" is understating what moved.
+- **`fofos` failed its capabilities sync for three deploys, and it was ownership.** Fixed 2026-08-21.
+  Two errors that read as unrelated problems — `dubious ownership` from git, and
+  `EACCES … mkdir '…/capabilities/affordances/officerdev'` from the gitea plugin — were one cause in two
+  dialects: fifty paths under that checkout were owned by `root`, including `.git` and `affordances`, all
+  stamped `19 Aug 21:43`. Something was run with `sudo` and left them behind. Mode `755` is why the split
+  looked odd: everything could be READ, so git saw the repo and refused it on ownership while the plugin
+  saw `affordances` and could not write into it.
+
+  One `stat` settled it, and that is the general lesson — `stat` prints the owner rather than inferring
+  anything, so it either proves ownership is the cause or eliminates it, in one command. Fixed with
+  `sudo chown -R pastilhas:pastilhas ~/officerdev/capabilities`; verified after by a `mkdir` into the
+  directory that used to refuse one.
+
+  **A `safe.directory` entry was deliberately NOT used**, and that call is worth keeping. It would have
+  silenced the git message and left the `EACCES` untouched — one symptom of a two-symptom cause hidden,
+  with the obvious explanation spent.
+
+## Not platforms — ignore for now
+
+A checkout may be present; no `officer` process runs on any of these. Whether they are retired, staging
+or half-installed is **not established** — ask before treating them as targets.
+
+| Host        | Tailnet IP |
+| ----------- | ---------- |
+| `headscale` | 100.64.0.2 |
+| `omega`     | 100.64.0.3 |
+| `gateway`   | 100.64.0.4 |
 
 ## Other machines on the tailnet
 
-- `gateway` (100.64.0.4) — reachable over SSH as `pastilhas`, no platform checkout, no PM2.
-- **Not SSH-reachable** (port 22 refused): `edge-dns` (100.64.0.8), `edge-bridge` (100.64.0.15),
-  `gitea-bridge` (100.64.0.12), `officer-bridge` (100.64.0.5). Assumed to be service-only
-  containers rather than hosts to log into — not confirmed.
-- **Client devices, not servers:** `macbookpro`, `iphone16`, `andres-ipad`, `pixel9a`, plus other
-  people's devices in the tailnet (`diogos-ipad`, `iphone-diogo`, `iphone-bruno`,
+- **Not SSH-reachable** (port 22 refused): `edge-dns` (100.64.0.8), `officer-bridge` (100.64.0.5).
+  Assumed service-only containers — not confirmed. `edge-bridge` was listed here until 2026-08-21 and was
+  wrong: its SSH was simply down at the time of checking.
+- **Client devices, not servers:** `iphone16`, `andres-ipad`, `pixel9a`, plus other people's devices in
+  the tailnet (`diogos-ipad`, `iphone-diogo`, `iphone-bruno`, `fedras-iphone`,
   `guilhermes-macbook-pro`, `macbook-pro-de-joo`).
 
+## Known wrong, waiting on someone else
+
+- **`officer.rezio.dev` resolves to 100.64.0.4** — that is `gateway`, not `deadpool` (100.64.0.21). Not
+  merely unavailable: pointed at a different machine, so it will serve the wrong box the moment gateway
+  answers on 443. Ports 80 and 443 are closed on `deadpool`, so nothing fronts it yet. Waiting on the
+  domain owner.
+
 ## Keeping this list true
 
-It is a running list, so it is worth saying what makes it rot: a new server, a moved checkout, a
-platform retired, or a remote changed. Re-verify with the same three commands the list was built from
-— `tailscale status`, `pm2 jlist` for the `officer` entry's `pm_cwd`, and `git -C <cwd> remote get-url
-origin`.
+It rots when a server is added, a checkout moves, a platform is retired, a remote changes or a login
+differs. Re-verify with the four commands it was built from:
+
+```bash
+tailscale status
+ssh <login>@<host> '$SHELL -ic "pm2 jlist"'   # the officer entry's pm_cwd
+ssh <login>@<host> 'git -C <cwd> remote get-url origin'
+getent hosts <domain>
+```

package.json

@@ -1,6 +1,6 @@
 {
   "name": "officer",
-  "version": "2026.08.21.01",
+  "version": "2026.08.22.02",
   "private": true,
   "type": "module",
   "workspaces": [

prompts/deploy-commander.md

@@ -15,30 +15,98 @@ You are not a loop. Something fires you, and each time you fire you do exactly o
 there is a release to deploy that has not been deployed.
 
 ```bash
-cd ~/officer-dev/platform && git fetch --quiet origin HEAD
-git log --oneline HEAD..FETCH_HEAD | grep DEPLOY_NOW
+git ls-remote --tags origin 'refs/tags/deploy/*'
 ```
 
-- **Nothing matching** → say "no release pending" and stop. Do not pull, do not touch a server.
-- **A commit whose subject begins `DEPLOY_NOW`** → that is the release. Continue.
+**Poll a LOCAL remote, never the public hostname.** On `officer-dev`, gitea is a plugin on the same machine
+— it listens on `100.64.0.13:10023` and on loopback — so `origin` points there. `gitea.officer.dev` resolves
+to the public address and arrives through Nginx Proxy Manager, where every connection appears to come from
+one container IP: internet bots get that IP penalised by `srclimit_penalise`, and SSH is then refused for
+long stretches.
 
-`DEPLOY_NOW` must be at the **start of the subject line**, not merely present. This document contains the
-word repeatedly and must never trigger a deploy; so must any commit that discusses one.
+That is not hypothetical and it is not subtle when it happens. On 2026-08-21 a tag pushed at 21:47 was not
+noticed until 23:07 — eighty minutes of `ls-remote` being closed on, forty-odd ticks, all correctly logged
+and retried. On 2026-08-22 it refused at 08:35 and again at 12:58. The loop is not at fault in any of those:
+it logs the exit code, sleeps, and carries on. It is simply asking through a door that is sometimes shut.
 
-**Already deployed?** A release is deployed when `deploy/<version>.report.md` exists on `origin`. Check
-before acting. A watcher that restarts must not redeploy, and this is the only thing standing between it
-and doing so.
+If `ls-remote` fails with `Connection closed by <public ip> port 22`, that is this, and the remote is wrong
+rather than the credentials. Loopback needs a `known_hosts` entry that may not exist; the tailnet address is
+already trusted.
 
----
+A release is **a tag**, named `deploy/<version>` — `deploy/2026.08.21.01`. Nothing else triggers you: not
+a commit message, not a branch, not a push.
+
+**Why a tag and not a code word in a commit.** A code word can be written by accident. Every document
+about deploying contains it, this file included, and so does every conversation planning one — so the
+trigger has to be defended with rules about where in the subject line it sits, and a rule like that is
+one somebody eventually gets wrong. A tag cannot be typed into prose. It is created deliberately, it
+names its own version, and `git ls-remote` answers "is there one" in a single call without fetching.
+
+- **No untagged release** → say "no release pending" and stop. Do not pull, do not touch a server.
+- **A `deploy/*` tag with no local record** → that is the release. Continue.
+
+### One attempt per release, and you do not enforce that yourself
+
+**Before you spawn or run anything for a version, claim it:**
+
+```bash
+scripts/deploy-claim.sh claim <version>   # exit 0 = it is yours, exit 1 = do not proceed
+```
+
+Exit 1 means somebody already attempted this release. **Stop. Do not retry it, do not deploy it, and do
+not decide the previous attempt does not count.** Say what the script said and move on.
+
+On success, record it through the same script:
+
+```bash
+scripts/deploy-claim.sh done <version>
+```
+
+**Why this is a script and not a rule you follow.** A watcher loop is written fresh each time one arms, so
+a rule that lives only in this file gets re-implemented from scratch every time — and the wrong version of
+it looks right: test for the `.done` file, which exists only on SUCCESS. Write that and a failing release
+spawns a new agent every poll, all night, each one costing money. That is not hypothetical. It is what the
+first watcher did on 2026-08-21: a careful loop, honest logging, and an unbounded retry inside it.
+
+So the rule is code. `mkdir` is the claim — atomic, one syscall that both tests and takes, no window
+between checking and acting. The script refuses a second claim and keeps refusing, whatever happened to the
+first attempt.
+
+**A failed release is therefore not retried. It is looked at.** Clearing a claim is a deliberate human act
+(`rm -rf …/<version>.claim`) or a new tag. A loop cannot undo its own claim, which is the property that
+makes the storm impossible rather than unlikely.
+
+### The record is LOCAL, not in git
+
+```
+$OFFICER_ROOT/data/deploys/<version>.done
+```
+
+That file's existence means deployed. Written after the rollout, before the report is pushed.
+
+**This is deliberate and it is the important part.** The obvious design makes the pushed report the
+marker — and then a failed `git push` means the release looks undeployed and the next tick **does it all
+again**. Pushes here are genuinely unreliable: gitea's public SSH is rate-limited because every
+connection arrives from one proxy container IP and internet bots get it penalised, which cost several
+retries on 2026-08-21.
+
+So the lock is local and cannot fail for a network reason. The report is an ARTEFACT — valuable, and not
+load-bearing. A missing report is a missing record; a missing lock is a second deploy.
+
+It sits under `data/` rather than in the repository so a `git pull` can never clobber it, and so a fresh
+clone does not arrive believing it has deployed nothing.
 
 ## The release
 
-The triggering commit carries everything:
+The tag names the version. The commit it points at carries the rest:
 
-- `package.json` — `version` bumped to `yyyy.mm.dd.NN` (`2026.08.21.01`), the mobile apps' scheme. `NN`
-  increments for a second deploy on the same day.
+- `package.json` — `version` matching the tag, `yyyy.mm.dd.NN` (`2026.08.21.01`), the mobile apps'
+  scheme. `NN` increments for a second deploy on the same day.
 - `deploy/<version>.md` — **the plan**. What to run, in order, and on which hosts. Written by hand.
 
+If the tag and `package.json` disagree, **stop and say so**. One of them is a mistake and guessing which
+is how the wrong tree gets deployed.
+
 If the plan file is missing, **stop and say so**. A release with no plan is not a release you can guess
 at, and guessing is how a database gets a schema it was not ready for.
 
@@ -49,8 +117,13 @@ at, and guessing is how a database gets a schema it was not ready for.
 **Read `docs/servers.md`.** Do not take a list of hosts from this file — there is deliberately none here,
 because a copy rots the day a server moves and the copy is always the one somebody trusts.
 
-That document holds every machine, its tailnet name, its checkout and whether a platform runs on it. Read
-it at the start of every deploy, and treat the hosts marked as having no platform as out of scope.
+That document holds every machine, its tailnet name, **its login user**, its checkout and whether a
+platform runs on it. Read it at the start of every deploy, and treat the hosts marked as having no
+platform as out of scope.
+
+**The login is not always `pastilhas`.** `deadpool-rezio-bridge` runs as `br`, permanently, and more will.
+Take the user from the table — an orchestrator that hard-codes one fails on that host silently, because
+`Permission denied (publickey)` looks like a broken key rather than a wrong username.
 
 Four things that will catch you out, all verified rather than assumed:
 
@@ -71,8 +144,10 @@ Four things that will catch you out, all verified rather than assumed:
 Per host, in this order. Do them **one host at a time** and keep a record as you go — a report you
 assemble at the end from memory is a report that will be wrong about the host that failed.
 
-1. **Refuse a dirty tree.** `git status --porcelain` — if anything is uncommitted, skip this host and say
-   so. Never discard someone's work to ship a release.
+1. **Refuse a dirty tree — TRACKED changes only.** `git status --porcelain --untracked-files=no`. Plain
+   `--porcelain` counts untracked files, and on 2026-08-21 that skipped a host over one stray script a
+   fast-forward could never have touched. Untracked files get a note in the report, not a skip. Never
+   discard someone's work to ship a release.
 2. `git pull --ff-only`. A non-fast-forward means that checkout has diverged: skip and report.
 3. **Update the plugins.** `bun run plugins:update`. Sequential by design, one plugin failing does not
    stop the rest, and it exits non-zero if any did — so a failure is something you report rather than
@@ -89,13 +164,32 @@ assemble at the end from memory is a report that will be wrong about the host th
 If a host fails, **continue to the next one**. A half-rolled-out release that is honestly reported beats
 one that stopped in the middle and said nothing about the four hosts it never reached.
 
+### Skip the host you are running on
+
+Entirely. Do not pull it, do not restart anything on it, and **name it in the report as skipped**.
+
+You are a session inside `officer-claude-code` on that machine. Restarting it ends you mid-rollout —
+which is not a hypothetical: on 2026-08-21 a manual deploy reached its own host last and had to leave
+that one sidecar alone to survive writing its own report.
+
+Restarting only `officer` and leaving your own sidecar behind would work, and it is worse: it puts one
+host in a state nobody chose, a step behind the others, discovered later. So skip the whole host and say
+which one. The owner restarts it deliberately, as the last step, once they are happy with the rest.
+
+Find it with `hostname` and match it against the list — do not assume you are on any particular one.
+
 ---
 
 ## The report
 
-Commit `deploy/<version>.report.md` to the platform repository and push it. Subject line: the version and
-the outcome, **without the code word** — a report is not a release, and a report that triggers a deploy
-would loop forever.
+Write the local record FIRST — `$OFFICER_ROOT/data/deploys/<version>.done` — then commit
+`deploy/<version>.report.md` and push it.
+
+That order matters. The record is what stops a second deploy, and the push is the part that can fail for
+reasons having nothing to do with the rollout. **If the push fails, say so and stop — do not retry into a
+loop and do not treat it as a failed deploy.** The deploy succeeded; its paperwork is pending.
+
+Never tag the report. A tag is the trigger, and a report that tags itself deploys itself forever.
 
 Per host: what its HEAD was before and after, which steps ran, which were skipped and why, which
 processes restarted, and whether they came back. Then one line at the top saying how many hosts
@@ -107,7 +201,24 @@ that are hard to reconstruct afterwards.
 
 ---
 
-## What is missing, as of writing
+## Being woken
 
-**Nothing wakes you yet.** A watcher, a cron entry or a repeating prompt has to exist and does not. Until
-then this runs when a person starts it.
+A background job does it, armed from the composer's background-job dialog with **Exit and hand back to the
+agent, then re-arm**. The wait happens in the shell, not in a model tick — a loop polling
+`git ls-remote`, which is one network call and no tokens.
+
+The loop cannot do a deploy: it cannot read a plan, judge a host or write a report. So on firing it spawns
+a headless agent — `claude -p "<read this file and follow it>" --dangerously-skip-permissions
+--output-format=stream-json --verbose` — and pipes the events through `jq` so the job panel shows progress
+instead of a blank box for twenty minutes.
+
+Two things that loop must get right, both learned by getting them wrong on 2026-08-21:
+
+- **Claim the version first**, per the section above. This is the one that costs money when missed.
+- **Set `OFFICER_ROOT` explicitly.** It is empty in the sidecar's environment, so the lock path resolves to
+  `/data/deploys` and the release looks permanently undeployed.
+
+The deploy therefore runs in a **separate** agent, not in the commander's own conversation: no Command HQ
+row, no cost on the commander's line, and its reasoning lives in that child's transcript. That is the price
+of putting the wait in the shell, and it is worth it — a model-side tick that re-reads a whole conversation
+to learn nothing is the thing being avoided.

scripts/deploy-claim.sh

@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+#
+# One attempt per release, enforced by the filesystem.
+#
+# A watcher loop asks this before it spawns anything. Exit 0 means "you have the claim, go". Exit 1 means
+# "somebody already had it" — and that answer never changes back, whatever happened to the attempt that
+# held it. A release that fails is not retried; it is looked at.
+#
+# WHY THIS IS A SCRIPT AND NOT A PARAGRAPH IN prompts/deploy-commander.md
+#
+# The watcher loop is written fresh by an agent each time it arms, so a rule that lives only in prose is
+# re-implemented from scratch on every arming, and "skip a version already attempted" has a wrong version
+# that looks right: test the .done file, which only exists on SUCCESS. Write that and a failing deploy
+# spawns a fresh agent every poll, all night, each one costing money. That is exactly what happened on
+# 2026-08-21 — the loop was careful, logged honestly, and still had an unbounded retry in it.
+#
+# WHY BASH AND NOT bun
+#
+# The thing that stops a retry storm must not depend on the checkout being healthy. A deploy that dies on
+# `bun install` is precisely when this has to work.
+#
+# WHY mkdir
+#
+# It is atomic on every POSIX filesystem and it fails if the target exists — one syscall that both tests
+# and claims. `[ -f x ] && ...` is two steps with a race between them, and two pollers a second apart is
+# not a hypothetical when a watcher is restarted.
+set -u
+
+DEPLOYS_DIR="${DEPLOYS_DIR:-$HOME/officer-dev/data/deploys}"
+
+usage() {
+  cat >&2 <<'USAGE'
+usage: deploy-claim.sh claim <version>    take the one attempt for this release (exit 0 = yours, 1 = taken)
+       deploy-claim.sh done  <version>    record that the attempt succeeded
+       deploy-claim.sh state <version>    print unclaimed | claimed | done
+       deploy-claim.sh list               every release this host knows about
+
+To retry a release deliberately: rm -rf <deploys-dir>/<version>.claim
+That is a human act on purpose. A loop cannot undo its own claim.
+USAGE
+  exit 2
+}
+
+version_ok() {
+  # The version reaches here from a git tag, so it is attacker-adjacent input used to build a path.
+  case "$1" in
+    *[!0-9.]* | '' | *..*) return 1 ;;
+    *) return 0 ;;
+  esac
+}
+
+CMD="${1:-}"
+[ -n "$CMD" ] || usage
+
+case "$CMD" in
+  list)
+    mkdir -p "$DEPLOYS_DIR"
+    found=0
+    for d in "$DEPLOYS_DIR"/*.claim; do
+      [ -e "$d" ] || continue
+      found=1
+      v=$(basename "$d" .claim)
+      if [ -f "$DEPLOYS_DIR/$v.done" ]; then s="done"; else s="claimed, no success recorded"; fi
+      printf '%-16s %s\n' "$v" "$s"
+    done
+    [ "$found" = 1 ] || echo "no releases attempted on this host"
+    ;;
+
+  claim | done | state)
+    V="${2:-}"
+    [ -n "$V" ] || usage
+    version_ok "$V" || { echo "deploy-claim: refusing a version that is not digits and dots: $V" >&2; exit 2; }
+    mkdir -p "$DEPLOYS_DIR" || exit 2
+    CLAIM="$DEPLOYS_DIR/$V.claim"
+    DONE="$DEPLOYS_DIR/$V.done"
+
+    case "$CMD" in
+      state)
+        if [ -f "$DONE" ]; then echo done
+        elif [ -d "$CLAIM" ]; then echo claimed
+        else echo unclaimed; fi
+        ;;
+      claim)
+        # A pre-existing .done with no .claim is a release deployed before this script existed. Honour it.
+        if [ -f "$DONE" ]; then
+          echo "deploy-claim: $V is already deployed" >&2
+          exit 1
+        fi
+        if mkdir "$CLAIM" 2>/dev/null; then
+          printf '%s claimed on %s by pid %s\n' "$(date -Iseconds)" "$(hostname)" "$$" > "$CLAIM/by"
+          echo "deploy-claim: $V is yours"
+          exit 0
+        fi
+        printf 'deploy-claim: %s was already attempted — %s\n' "$V" "$(cat "$CLAIM/by" 2>/dev/null || echo 'claim exists')" >&2
+        echo "deploy-claim: NOT retrying. Look at what failed, then rm -rf $CLAIM to allow another attempt." >&2
+        exit 1
+        ;;
+      done)
+        [ -d "$CLAIM" ] || echo "deploy-claim: warning — recording success for $V that was never claimed" >&2
+        printf '%s succeeded on %s\n' "$(date -Iseconds)" "$(hostname)" >> "$DONE"
+        echo "deploy-claim: $V recorded as deployed"
+        ;;
+    esac
+    ;;
+
+  *) usage ;;
+esac

scripts/deploy-claim.test.ts

@@ -0,0 +1,60 @@
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+const SCRIPT = join(import.meta.dir, 'deploy-claim.sh');
+let dir: string;
+
+const run = (...args: string[]) => {
+  const p = Bun.spawnSync([SCRIPT, ...args], { env: { ...process.env, DEPLOYS_DIR: dir } });
+  return { code: p.exitCode, out: p.stdout.toString(), err: p.stderr.toString() };
+};
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), 'deploy-claim-'));
+});
+afterEach(() => rmSync(dir, { recursive: true, force: true }));
+
+// The whole point of this script is that the SECOND caller is refused. Everything else is scaffolding.
+describe('deploy-claim', () => {
+  it('grants once and refuses after, whatever the outcome was', () => {
+    expect(run('claim', '2026.09.01.01').code).toBe(0);
+    expect(run('claim', '2026.09.01.01').code).toBe(1);
+    // Still refused after a failure — no .done was ever written. This is the retry storm not happening.
+    expect(run('claim', '2026.09.01.01').code).toBe(1);
+    expect(run('state', '2026.09.01.01').out.trim()).toBe('claimed');
+  });
+
+  it('refuses a release already deployed, even with no claim beside it', () => {
+    // A release deployed by hand before this script existed. `deploy/2026.08.21.01` is exactly this case.
+    writeFileSync(join(dir, '2026.08.21.01.done'), 'deployed by hand\n');
+    expect(run('claim', '2026.08.21.01').code).toBe(1);
+    expect(run('claim', '2026.08.21.01').err).toContain('already deployed');
+  });
+
+  it('lets a human hand the claim back, and only a human', () => {
+    expect(run('claim', '2026.09.01.02').code).toBe(0);
+    rmSync(join(dir, '2026.09.01.02.claim'), { recursive: true });
+    expect(run('claim', '2026.09.01.02').code).toBe(0);
+  });
+
+  it('records success separately from the claim', () => {
+    run('claim', '2026.09.01.03');
+    run('done', '2026.09.01.03');
+    expect(run('state', '2026.09.01.03').out.trim()).toBe('done');
+    expect(existsSync(join(dir, '2026.09.01.03.done'))).toBe(true);
+  });
+
+  // The version comes off a git tag, and it is concatenated into a path.
+  it('refuses anything that is not digits and dots', () => {
+    for (const bad of ['../../etc/passwd', 'x; rm -rf /', '2026.08.21.01/..', '', 'v1']) {
+      expect(run('claim', bad).code).toBe(2);
+    }
+    expect(existsSync(join(dir, '..', 'etc'))).toBe(false);
+  });
+
+  it('says so plainly when nothing has been attempted', () => {
+    expect(run('list').out).toContain('no releases attempted');
+  });
+});

scripts/port-community-themes.ts

@@ -0,0 +1,340 @@
+#!/usr/bin/env bun
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { execSync } from 'node:child_process';
+import { join } from 'node:path';
+import { mapPalette } from './themes/map';
+import type { Palette } from './themes/palette';
+import { paletteFromRecord, parseTomlText } from './themes/palette';
+import { deriveOmarchyPalette } from './themes/from-ansi';
+import { parseAlacrittyToml, parseColor16Toml, parseGhosttyConf } from './themes/ansi-source';
+import { contrast, ensureContrast, TEXT, UI } from './themes/contrast';
+
+// Port community Omarchy themes from omarchythemes.com into the same 84-token shape the official
+// pipeline produces — see `generate-themes.ts` for that one. This is its sibling for themes that have no
+// `colors.toml`: a single-theme repo instead ships per-app configs, so `from-ansi.ts` reconstructs the
+// same `Palette` from `alacritty.toml` or `ghostty.conf`, and everything downstream (mapping, contrast
+// checking) is identical. What's NOT identical: these are unofficial, one author's repo can vanish or
+// change, and the reconstruction is a heuristic, not Omarchy's own curated palette — every generated file
+// says so in its header.
+//
+//   bun scripts/port-community-themes.ts [--limit=N] [--slug=<one-slug>] [--redo]
+//
+// State lives in `scripts/themes/community-manifest.json` — one entry per theme successfully ported, so a
+// re-run only fetches what's missing (or everything, with --redo) and the registry/index blocks are
+// always rewritten fresh from the whole manifest, never hand-edited.
+
+const CSS_THEME_DIR = join(import.meta.dir, '..', 'src', 'workspaces', 'theme', 'css', 'themes');
+const INDEX_CSS = join(CSS_THEME_DIR, '..', 'index.css');
+const REGISTRY = join(import.meta.dir, '..', 'src', 'workspaces', 'theme', 'src', 'themes.ts');
+const MANIFEST_PATH = join(import.meta.dir, 'themes', 'community-manifest.json');
+const SITE = 'https://omarchythemes.com';
+const CONCURRENCY = 8;
+
+const REDO = process.argv.includes('--redo');
+const ONLY_SLUG = process.argv.find((a) => a.startsWith('--slug='))?.split('=')[1];
+const LIMIT = Number(process.argv.find((a) => a.startsWith('--limit='))?.split('=')[1] ?? Infinity);
+
+type ManifestEntry = {
+  id: string;
+  name: string;
+  repo: string;
+  /** Omitted means GitHub, which is where all but a couple of these live. */
+  host?: 'gitlab';
+  kind: string;
+  dark: boolean;
+};
+
+type Repo = { host: 'github' | 'gitlab'; path: string };
+
+const repoUrl = (r: Repo): string => `https://${r.host === 'gitlab' ? 'gitlab.com' : 'github.com'}/${r.path}`;
+
+// Same pairs `generate-themes.ts` checks, kept in sync by hand since this is the only other place that
+// needs them and duplicating a 20-line array beats a shared module for one caller each.
+const PAIRS: [string, string, number][] = [
+  ['--foreground', '--background', TEXT],
+  ['--card-foreground', '--card', TEXT],
+  ['--popover-foreground', '--popover', TEXT],
+  ['--muted-foreground', '--muted', TEXT],
+  ['--accent-foreground', '--accent', TEXT],
+  ['--primary-foreground', '--primary', TEXT],
+  ['--secondary-foreground', '--secondary', TEXT],
+  ['--cta-foreground', '--cta', TEXT],
+  ['--success-foreground', '--success', TEXT],
+  ['--warning-foreground', '--warning', TEXT],
+  ['--destructive-foreground', '--destructive', TEXT],
+  ['--info-foreground', '--info', TEXT],
+  ['--busy-foreground', '--busy', TEXT],
+  ['--busy-ink', '--background', TEXT],
+  ['--input', '--background', 1.35],
+  ['--ring', '--background', UI],
+];
+
+const title = (id: string): string =>
+  id
+    .split('-')
+    .map((w) => (w.length <= 2 ? w.toUpperCase() : w[0]!.toUpperCase() + w.slice(1)))
+    .join(' ');
+
+function loadManifest(): ManifestEntry[] {
+  if (!existsSync(MANIFEST_PATH)) return [];
+  return JSON.parse(readFileSync(MANIFEST_PATH, 'utf8'));
+}
+
+function saveManifest(entries: ManifestEntry[]): void {
+  writeFileSync(MANIFEST_PATH, `${JSON.stringify(entries, null, 2)}\n`);
+}
+
+function ghApiDefaultBranch(repo: string): string {
+  try {
+    const out = execSync(`gh api repos/${repo} --jq .default_branch`, {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    return out.trim() || 'main';
+  } catch {
+    return 'main';
+  }
+}
+
+async function gitlabDefaultBranch(path: string): Promise<string> {
+  const json = await fetchText(`https://gitlab.com/api/v4/projects/${encodeURIComponent(path)}`);
+  if (!json) return 'main';
+  try {
+    return (JSON.parse(json).default_branch as string) || 'main';
+  } catch {
+    return 'main';
+  }
+}
+
+async function fetchText(url: string): Promise<string | undefined> {
+  try {
+    const res = await fetch(url);
+    if (!res.ok) return undefined;
+    return await res.text();
+  } catch {
+    return undefined;
+  }
+}
+
+async function discoverRepo(slug: string): Promise<Repo | undefined> {
+  const html = await fetchText(`${SITE}/themes/${slug}`);
+  if (!html) return undefined;
+  const gh = html.match(/https:\/\/github\.com\/([\w.-]+)\/([\w.-]+)/);
+  if (gh) return { host: 'github', path: `${gh[1]}/${gh[2]}` };
+  // A couple of authors host on GitLab instead. Its group paths can nest, hence the greedier match.
+  const gl = html.match(/https:\/\/gitlab\.com\/([\w.-]+(?:\/[\w.-]+)+?)(?=["'\s<]|$)/);
+  if (gl) return { host: 'gitlab', path: gl[1]!.replace(/\.git$/, '') };
+  return undefined;
+}
+
+async function sourceFor(
+  repo: Repo,
+  slug: string,
+): Promise<{ palette: Palette; kind: string; derived: boolean } | undefined> {
+  const branch = repo.host === 'gitlab' ? await gitlabDefaultBranch(repo.path) : ghApiDefaultBranch(repo.path);
+  const raw = (p: string) =>
+    repo.host === 'gitlab'
+      ? `https://gitlab.com/${repo.path}/-/raw/${branch}/${p}`
+      : `https://raw.githubusercontent.com/${repo.path}/${branch}/${p}`;
+
+  // Most repos hold one theme at the root. A few are packs that nest one directory per theme, so also
+  // look under the directory named after THIS slug — an exact match is the only safe pick, since a pack
+  // with variant names of its own (`abyss-dark`, `lagoon-light`, …) has no one theme that is "the" one.
+  const prefixes = ['', `themes/${slug}/`, `omarchy/themes/${slug}/`, `${slug}/`];
+
+  for (const prefix of prefixes) {
+    // `colors.toml` is ambiguous across community repos: it might genuinely be Omarchy 4's own semantic
+    // schema (in which case no derivation is needed at all — same quality as the official 22), or it might
+    // reuse the filename for an unrelated flat `color0..color15` ANSI scheme. Try the real schema first;
+    // only fall through to the ANSI reading if the required keys aren't there.
+    const tomlText = await fetchText(raw(`${prefix}colors.toml`));
+    if (tomlText) {
+      const kv = parseTomlText(tomlText);
+      try {
+        return {
+          palette: paletteFromRecord(kv, `${repo.path}/${prefix}colors.toml`),
+          kind: 'colors.toml (Omarchy schema)',
+          derived: false,
+        };
+      } catch {
+        const ansi = parseColor16Toml(kv);
+        if (ansi) return { palette: deriveOmarchyPalette(ansi), kind: 'colors.toml (16-colour ANSI)', derived: true };
+      }
+    }
+
+    for (const path of [
+      'alacritty.toml',
+      '.config/alacritty.toml',
+      'alacritty/alacritty.toml',
+      'config/alacritty.toml',
+    ]) {
+      const text = await fetchText(raw(`${prefix}${path}`));
+      if (!text) continue;
+      const ansi = parseAlacrittyToml(text);
+      if (ansi) return { palette: deriveOmarchyPalette(ansi), kind: 'alacritty.toml', derived: true };
+    }
+    for (const path of ['ghostty.conf', 'ghostty-theme', '.config/ghostty/config']) {
+      const text = await fetchText(raw(`${prefix}${path}`));
+      if (!text) continue;
+      const ansi = parseGhosttyConf(text);
+      if (ansi) return { palette: deriveOmarchyPalette(ansi), kind: 'ghostty.conf', derived: true };
+    }
+  }
+  return undefined;
+}
+
+async function portOne(slug: string): Promise<{ entry: ManifestEntry; css: string } | { skip: string }> {
+  const repo = await discoverRepo(slug);
+  if (!repo) return { skip: 'no github/gitlab repo link found on its omarchythemes.com page' };
+
+  const source = await sourceFor(repo, slug);
+  if (!source) return { skip: `no parseable colors.toml/alacritty.toml/ghostty.conf in ${repo.path}` };
+
+  const palette = source.palette;
+  const tokens = mapPalette(palette);
+
+  // `--input` carries a real accessibility requirement (a field boundary you can't see) where `--border`
+  // is decoration and isn't held to one — see the README. `map.ts` derives both from the same mix for
+  // every theme, official ones included, and it normally clears 1.35:1 on its own; a few derived palettes
+  // land just under it, so nudge only this one rather than loosening the check.
+  tokens['--input'] = ensureContrast(tokens['--input']!, tokens['--background']!, 1.35);
+
+  const failures: string[] = [];
+  for (const [fgKey, bgKey, min] of PAIRS) {
+    const fg = tokens[fgKey]!;
+    const bg = tokens[bgKey]!;
+    if (!fg.startsWith('#') || !bg.startsWith('#')) continue;
+    const ratio = contrast(fg, bg);
+    if (ratio < min) failures.push(`${fgKey} on ${bgKey} is ${ratio.toFixed(2)}:1, needs ${min}:1`);
+  }
+  if (failures.length > 0) return { skip: `contrast failed after derivation: ${failures.join('; ')}` };
+
+  const name = title(slug);
+  const body = Object.entries(tokens)
+    .map(([k, v]) => `  ${k}: ${v};`)
+    .join('\n');
+  const modeLine = source.kind.startsWith('colors.toml (Omarchy')
+    ? `${palette.mode === 'dark' ? 'Dark theme' : 'Light theme'} (${palette.mode}) — the source repo's own colors.toml says so directly.`
+    : `${palette.mode === 'dark' ? 'Dark theme' : 'Light theme'} (${palette.mode}), by luminance of its own background — the source repo carries no mode flag of its own to read.`;
+  const provenanceLine = source.derived
+    ? `went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4\n  colors.toml — some tokens here are reconstructed, not authored.`
+    : `came straight from the repo's own colors.toml — the same schema and reader the official 22 themes\n  use, so nothing here is reconstructed.`;
+  const css = `/*
+  ${name} — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  ${modeLine}
+
+  Source: ${repoUrl(repo)} (${source.kind}), read by scripts/port-community-themes.ts. Values
+  ${provenanceLine} Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='${slug}'] {
+${body}
+}
+`;
+
+  return {
+    entry: {
+      id: slug,
+      name,
+      repo: repo.path,
+      ...(repo.host === 'gitlab' ? { host: 'gitlab' as const } : {}),
+      kind: source.kind,
+      dark: palette.mode === 'dark',
+    },
+    css,
+  };
+}
+
+function rewriteIndexCss(entries: ManifestEntry[]): void {
+  const index = readFileSync(INDEX_CSS, 'utf8');
+  const marker = '/* Community themes';
+  const startIdx = index.indexOf(marker);
+  const head = startIdx >= 0 ? index.slice(0, startIdx) : index.replace(/\n@import '\.\/chrome\.css';\n$/, '\n');
+  const imports = entries.map((e) => `@import './themes/${e.id}.css';`).join('\n');
+  writeFileSync(
+    INDEX_CSS,
+    `${head}/* Community themes — ported from omarchythemes.com by scripts/port-community-themes.ts. Do not edit this block. */\n${imports}\n\n@import './chrome.css';\n`,
+  );
+}
+
+function rewriteRegistry(entries: ManifestEntry[]): void {
+  const registry = readFileSync(REGISTRY, 'utf8');
+  const START = '  /* COMMUNITY THEMES — start */';
+  const END = '  /* COMMUNITY THEMES — end */';
+  const rows = entries
+    .map((e) => `  { id: '${e.id}', name: '${e.name}', family: '${e.name}', applyDarkClass: ${e.dark} },`)
+    .join('\n');
+  const block = `${START}\n${rows}\n${END}`;
+
+  if (registry.includes(START) && registry.includes(END)) {
+    // Snap to the start of the marker's own line — `indexOf` on a string with leading spaces can match
+    // partway into stray indentation left by an earlier write, which would otherwise accumulate.
+    const startLineBegin = registry.lastIndexOf('\n', registry.indexOf(START)) + 1;
+    const before = registry.slice(0, startLineBegin);
+    const after = registry.slice(registry.indexOf(END) + END.length);
+    writeFileSync(REGISTRY, `${before}${block}${after}`);
+  } else {
+    const anchor = '] as const;';
+    const idx = registry.indexOf(anchor);
+    writeFileSync(REGISTRY, `${registry.slice(0, idx)}${block}\n${registry.slice(idx)}`);
+  }
+}
+
+async function main() {
+  const slugsFile = process.argv.find((a) => a.startsWith('--slugs='))?.split('=')[1];
+  const allSlugs: string[] = slugsFile ? readFileSync(slugsFile, 'utf8').trim().split('\n').filter(Boolean) : [];
+
+  const manifest = loadManifest();
+  const known = new Set(manifest.map((e) => e.id));
+  // Never take a slug the OFFICIAL/hand-authored part of the registry already owns — that's everything
+  // before this script's own block, which it is free to redo.
+  const registryHead = readFileSync(REGISTRY, 'utf8').split('/* COMMUNITY THEMES — start */')[0]!;
+  const registryIds = new Set(Array.from(registryHead.matchAll(/id: '([\w-]+)'/g)).map((m) => m[1]!));
+
+  let todo = ONLY_SLUG ? [ONLY_SLUG] : allSlugs.filter((s) => !registryIds.has(s) && (REDO || !known.has(s)));
+  todo = todo.slice(0, LIMIT);
+
+  console.log(`community theme port: ${todo.length} to try, ${manifest.length} already in the manifest`);
+
+  const results: ManifestEntry[] = [...manifest.filter((e) => !todo.includes(e.id))];
+  let done = 0;
+  let ok = 0;
+  let skipped = 0;
+
+  async function worker() {
+    while (todo.length > 0) {
+      const slug = todo.shift();
+      if (!slug) break;
+      try {
+        const result = await portOne(slug);
+        done++;
+        if ('skip' in result) {
+          skipped++;
+          console.log(`[${done}] SKIP  ${slug} — ${result.skip}`);
+        } else {
+          writeFileSync(join(CSS_THEME_DIR, `${slug}.css`), result.css);
+          results.push(result.entry);
+          ok++;
+          console.log(`[${done}] OK    ${slug} — from ${result.entry.repo} (${result.entry.kind})`);
+        }
+      } catch (err) {
+        done++;
+        skipped++;
+        console.log(`[${done}] ERROR ${slug} — ${(err as Error).message}`);
+      }
+    }
+  }
+
+  await Promise.all(Array.from({ length: CONCURRENCY }, worker));
+
+  results.sort((a, b) => a.id.localeCompare(b.id));
+  saveManifest(results);
+  rewriteIndexCss(results);
+  rewriteRegistry(results);
+
+  console.log(`\ndone: ${ok} ported, ${skipped} skipped, ${results.length} total in manifest`);
+}
+
+main();

scripts/themes/ansi-source.ts

@@ -0,0 +1,205 @@
+// Reading a community theme's actual shipped format.
+//
+// Omarchy's own 22 themes carry a `colors.toml` in the semantic shape `palette.ts` expects — three
+// background depths, four foreground weights, an accent, a selection, a muted. A community theme on
+// omarchythemes.com ships none of that: it's per-app config files in the classic 16-ANSI-slot style,
+// because that's what predates Omarchy 4's own format and what most single-theme repos still use.
+//
+// This file reads the two shapes that cover almost every repo: `alacritty.toml` (structured, typed,
+// preferred) and `ghostty.conf`/`ghostty-theme` (flat `key = value` lines, fallback). Either becomes an
+// `AnsiSource` — the 16 ANSI slots plus primary background/foreground — which `from-ansi.ts` turns into
+// the same `Palette` shape the official pipeline consumes, so every downstream guarantee (contrast
+// checking, the 84-token mapping) applies unchanged.
+
+export type AnsiSource = {
+  background: string;
+  foreground: string;
+  black: string;
+  red: string;
+  green: string;
+  yellow: string;
+  blue: string;
+  magenta: string;
+  cyan: string;
+  white: string;
+  brightBlack: string;
+  brightRed: string;
+  brightGreen: string;
+  brightYellow: string;
+  brightBlue: string;
+  brightMagenta: string;
+  brightCyan: string;
+  brightWhite: string;
+};
+
+// `#rrggbb` is standard; `0xrrggbb` shows up in a handful of community alacritty.toml files (their
+// authors apparently ported from a scheme that used C-style hex literals).
+const HEX = /#[0-9a-fA-F]{3,8}|0x[0-9a-fA-F]{3,8}/;
+
+function normalizeHex(v: string): string | undefined {
+  const m = v.match(HEX);
+  if (!m) return undefined;
+  let h = m[0].replace(/^(#|0x)/, '').toLowerCase();
+  if (h.length === 3)
+    h = h
+      .split('')
+      .map((c) => c + c)
+      .join('');
+  if (h.length >= 6) h = h.slice(0, 6);
+  return `#${h}`;
+}
+
+/** A deliberately small TOML reader: flat `key = "value"` lines plus `[section]` headers. */
+export function parseAlacrittyToml(text: string): AnsiSource | undefined {
+  let section = '';
+  const rows: Record<string, Record<string, string>> = {};
+  for (const rawLine of text.split('\n')) {
+    const line = rawLine.trim();
+    const sectionMatch = line.match(/^\[([\w.]+)]$/);
+    if (sectionMatch) {
+      section = sectionMatch[1]!;
+      rows[section] ??= {};
+      continue;
+    }
+    // Quoted specifically, not "anything but a comment" — a hex value starts with `#`, the same
+    // character that opens a trailing comment, so the two can only be told apart by the quotes.
+    const kv = line.match(/^([\w-]+)\s*=\s*(['"])(.*?)\2/);
+    if (kv && section) {
+      const hex = normalizeHex(kv[3]!);
+      if (hex) rows[section]![kv[1]!] = hex;
+    }
+  }
+
+  const primary = rows['colors.primary'];
+  const normal = rows['colors.normal'];
+  const bright = rows['colors.bright'];
+  if (!primary?.background || !primary?.foreground || !normal || !bright) return undefined;
+
+  const need = (r: Record<string, string>, k: string): string | undefined => r[k];
+  const n = (k: string) => need(normal, k);
+  const b = (k: string) => need(bright, k);
+  if (
+    !n('black') ||
+    !n('red') ||
+    !n('green') ||
+    !n('yellow') ||
+    !n('blue') ||
+    !n('magenta') ||
+    !n('cyan') ||
+    !n('white')
+  )
+    return undefined;
+  if (
+    !b('black') ||
+    !b('red') ||
+    !b('green') ||
+    !b('yellow') ||
+    !b('blue') ||
+    !b('magenta') ||
+    !b('cyan') ||
+    !b('white')
+  )
+    return undefined;
+
+  return {
+    background: primary.background,
+    foreground: primary.foreground,
+    black: n('black')!,
+    red: n('red')!,
+    green: n('green')!,
+    yellow: n('yellow')!,
+    blue: n('blue')!,
+    magenta: n('magenta')!,
+    cyan: n('cyan')!,
+    white: n('white')!,
+    brightBlack: b('black')!,
+    brightRed: b('red')!,
+    brightGreen: b('green')!,
+    brightYellow: b('yellow')!,
+    brightBlue: b('blue')!,
+    brightMagenta: b('magenta')!,
+    brightCyan: b('cyan')!,
+    brightWhite: b('white')!,
+  };
+}
+
+/** Ghostty's config: flat `key = value`, ANSI palette as sixteen `palette = N=#hex` lines. */
+export function parseGhosttyConf(text: string): AnsiSource | undefined {
+  let background: string | undefined;
+  let foreground: string | undefined;
+  const palette: Record<number, string> = {};
+
+  for (const rawLine of text.split('\n')) {
+    const line = rawLine.trim();
+    if (line.startsWith('#')) continue;
+    const bg = line.match(/^background\s*=\s*(#[0-9a-fA-F]{3,8})/);
+    if (bg) background = normalizeHex(bg[1]!);
+    const fg = line.match(/^foreground\s*=\s*(#[0-9a-fA-F]{3,8})/);
+    if (fg) foreground = normalizeHex(fg[1]!);
+    const pal = line.match(/^palette\s*=\s*(\d+)\s*=\s*(#[0-9a-fA-F]{3,8})/);
+    if (pal) {
+      const hex = normalizeHex(pal[2]!);
+      if (hex) palette[Number(pal[1])] = hex;
+    }
+  }
+
+  if (!background || !foreground) return undefined;
+  for (let i = 0; i <= 15; i++) if (!palette[i]) return undefined;
+
+  return {
+    background,
+    foreground,
+    black: palette[0]!,
+    red: palette[1]!,
+    green: palette[2]!,
+    yellow: palette[3]!,
+    blue: palette[4]!,
+    magenta: palette[5]!,
+    cyan: palette[6]!,
+    white: palette[7]!,
+    brightBlack: palette[8]!,
+    brightRed: palette[9]!,
+    brightGreen: palette[10]!,
+    brightYellow: palette[11]!,
+    brightBlue: palette[12]!,
+    brightMagenta: palette[13]!,
+    brightCyan: palette[14]!,
+    brightWhite: palette[15]!,
+  };
+}
+
+/**
+ * A third shape some community repos name `colors.toml` too, unrelated to Omarchy 4's own — flat
+ * `color0`..`color15` in standard ANSI order, plus `background`/`foreground`. Try this only after
+ * `paletteFromRecord` (the real Omarchy schema) has already failed on the same file: the two are
+ * distinguished only by which keys are present, and a file can't be both.
+ */
+export function parseColor16Toml(t: Record<string, string>): AnsiSource | undefined {
+  const at = (i: number): string | undefined => (t[`color${i}`] ? normalizeHex(t[`color${i}`]!) : undefined);
+  const background = t.background ? normalizeHex(t.background) : undefined;
+  const foreground = t.foreground ? normalizeHex(t.foreground) : undefined;
+  if (!background || !foreground) return undefined;
+  const slots = Array.from({ length: 16 }, (_, i) => at(i));
+  if (slots.some((s) => !s)) return undefined;
+
+  return {
+    background,
+    foreground,
+    black: slots[0]!,
+    red: slots[1]!,
+    green: slots[2]!,
+    yellow: slots[3]!,
+    blue: slots[4]!,
+    magenta: slots[5]!,
+    cyan: slots[6]!,
+    white: slots[7]!,
+    brightBlack: slots[8]!,
+    brightRed: slots[9]!,
+    brightGreen: slots[10]!,
+    brightYellow: slots[11]!,
+    brightBlue: slots[12]!,
+    brightMagenta: slots[13]!,
+    brightCyan: slots[14]!,
+    brightWhite: slots[15]!,
+  };
+}

scripts/themes/from-ansi.ts

@@ -0,0 +1,76 @@
+import type { Palette } from './palette';
+import type { AnsiSource } from './ansi-source';
+import { UI, contrast, ensureContrast, luminance, mix, parseHex } from './contrast';
+
+// An `AnsiSource` (16 ANSI slots + primary bg/fg) has no notion of "three background depths" or "an
+// accent" — Omarchy 4's `colors.toml` is a richer, hand-curated shape that a sixteen-slot terminal scheme
+// was never designed to fill. This derives one anyway, by role rather than by guessing a fixed value:
+//
+//   - accent is whichever blue-ish slot actually stands out from the background (every official palette
+//     picks blue too — this just guards against a scheme that reused the background for it).
+//   - the three depths are the background pushed a fixed distance toward black or white, in the direction
+//     each mode's surfaces already move (dark themes rise lighter, light themes recede darker — see the
+//     ratios comment below, calibrated against Nord and Rosé Pine's real colors.toml).
+//   - the three foreground weights are the foreground pulled toward the background by a fixed fraction,
+//     standing in for "faint", "muted" and "strong" text.
+//
+// None of this has to be exact. `mapPalette`'s `ensureContrast` re-checks every text/surface pair
+// afterward and nudges anything that fails — the approximation only has to be plausible, not correct.
+
+function pickAccent(a: AnsiSource): string {
+  const candidates = [a.blue, a.brightBlue, a.cyan, a.brightCyan];
+  const best = candidates.reduce((hi, c) => (contrast(c, a.background) > contrast(hi, a.background) ? c : hi));
+  // `--ring` is this colour laid directly on `--background` (see `map.ts`), and it's in the contract's
+  // PAIRS check same as the official themes — so guarantee it the way `ensureContrast` guarantees text,
+  // rather than only guarding against a background-coloured accent.
+  return ensureContrast(best, a.background, UI);
+}
+
+export function deriveOmarchyPalette(a: AnsiSource): Palette {
+  const dark = luminance(parseHex(a.background)) < 0.5;
+  const mode: Palette['mode'] = dark ? 'dark' : 'light';
+
+  const darkerBackground = dark ? mix(a.background, '#000000', 0.45) : mix(a.background, '#000000', 0.1);
+  const darkBackground = dark ? mix(a.background, '#000000', 0.22) : mix(a.background, '#000000', 0.06);
+  const lighterBackground = dark ? mix(a.background, '#ffffff', 0.07) : mix(a.background, '#000000', 0.035);
+
+  // Faintest → strongest, all pulled toward the background rather than toward a fixed grey, so a warm
+  // palette's dim text stays warm instead of turning neutral.
+  const darkForeground = mix(a.foreground, a.background, 0.55);
+  const lightForeground = mix(a.foreground, a.background, 0.3);
+
+  const accent = pickAccent(a);
+  const muted = contrast(a.brightBlack, a.background) >= 1.15 ? a.brightBlack : mix(a.foreground, a.background, 0.6);
+
+  return {
+    mode,
+    accent,
+    // Unused by `mapPalette` today (grep confirms `p.selection` has no reader) — kept only because the
+    // `Palette` type requires it.
+    selection: mix(a.background, a.foreground, 0.2),
+    muted,
+    background: a.background,
+    darkBackground,
+    darkerBackground,
+    lighterBackground,
+    foreground: a.foreground,
+    darkForeground,
+    lightForeground,
+    brightForeground: a.foreground,
+    red: a.red,
+    yellow: a.yellow,
+    green: a.green,
+    cyan: a.cyan,
+    blue: a.blue,
+    magenta: a.magenta,
+    // Standard ANSI has no orange slot. Mixing red and yellow reads better as "busy" than falling back to
+    // plain yellow the way `loadPalette` does for the 3 official themes that omit it.
+    orange: mix(a.red, a.yellow, 0.5),
+    brightRed: a.brightRed,
+    brightYellow: a.brightYellow,
+    brightGreen: a.brightGreen,
+    brightCyan: a.brightCyan,
+    brightBlue: a.brightBlue,
+    brightMagenta: a.brightMagenta,
+  };
+}

scripts/themes/map.ts

@@ -49,6 +49,13 @@ export function mapPalette(p: Palette): Tokens {
   // miasma at 4.00 — close enough to look fine and still fail, which is the kind of near-miss that a
   // person eyeballing a screenshot would have shipped.
   const fgMuted = ensureContrast(p.lightForeground, s.high);
+  // Same reasoning as `fgMuted`, for the same surface: `--accent` and `--secondary` are BOTH `s.high`,
+  // so their text has to be checked against `s.high` too. It was deriving from `fgRaised` — the weight
+  // for `s.raised` — which is the identical near-miss the comment above describes, just one token over.
+  // A no-op for all 22 official palettes (each already clears 4.5:1 on `s.high` by 1.4x or more, and
+  // `ensureContrast` returns its input untouched when it passes); what it fixes is the ported palettes
+  // whose foreground sits between the two surfaces' thresholds.
+  const fgHigh = ensureContrast(p.foreground, s.high);
   const fgFaint = ensureContrast(p.darkForeground, s.raised, UI);
 
   /**
@@ -88,13 +95,13 @@ export function mapPalette(p: Palette): Tokens {
     '--muted': s.high,
     '--muted-foreground': fgMuted,
     '--accent': s.high,
-    '--accent-foreground': fgRaised,
+    '--accent-foreground': fgHigh,
 
     // ── Actions ──
     '--primary': accent,
     '--primary-foreground': on(accent),
     '--secondary': s.high,
-    '--secondary-foreground': fgRaised,
+    '--secondary-foreground': fgHigh,
     '--cta': accent,
     '--cta-foreground': on(accent),
     '--ctahover': mix(accent, s.dark ? '#ffffff' : '#000000', 0.12),

scripts/themes/palette.ts

@@ -38,21 +38,28 @@ export type Palette = {
   brightMagenta: string;
 };
 
-/** A deliberately small TOML reader: this file is flat `key = "value"` and nothing else. */
-function readToml(path: string): Record<string, string> {
+/**
+ * A deliberately small TOML reader: this file is flat `key = "value"` and nothing else.
+ *
+ * Exported (not just used by `loadPalette` below) because a community theme can ship this exact shape
+ * too — see `port-community-themes.ts`, which reads it from a fetched string rather than a file path.
+ */
+export function parseTomlText(text: string): Record<string, string> {
   const out: Record<string, string> = {};
-  for (const line of readFileSync(path, 'utf8').split('\n')) {
+  for (const line of text.split('\n')) {
     const m = line.match(/^\s*([a-z_0-9]+)\s*=\s*"([^"]*)"/i);
-    if (m) out[m[1]!] = m[2]!;
+    // basecamp/omarchy's own files are already lowercase hex; a community `colors.toml` isn't guaranteed
+    // to be, so normalize here rather than leaving the two sources visibly inconsistent.
+    if (m) out[m[1]!] = m[2]!.toLowerCase();
   }
   return out;
 }
 
-export function loadPalette(tomlPath: string): Palette {
-  const t = readToml(tomlPath);
+/** The 24-key contract, given an already-parsed record rather than a path — see `parseTomlText`. */
+export function paletteFromRecord(t: Record<string, string>, label: string): Palette {
   const need = (key: string): string => {
     const v = t[key];
-    if (!v) throw new Error(`${tomlPath}: missing "${key}"`);
+    if (!v) throw new Error(`${label}: missing "${key}"`);
     return v;
   };
 
@@ -84,3 +91,7 @@ export function loadPalette(tomlPath: string): Palette {
     brightMagenta: need('bright_magenta'),
   };
 }
+
+export function loadPalette(tomlPath: string): Palette {
+  return paletteFromRecord(parseTomlText(readFileSync(tomlPath, 'utf8')), tomlPath);
+}

src/apps/officer-web/Screens/Dashboard/CommandHQ/CommandHqScreen.tsx

@@ -1,15 +1,29 @@
+import { useEffect } from 'react';
 import type { LayoutNode } from 'officerdev';
 import { WorkspaceView } from 'officerdev';
 import { useDashboardState } from 'state/useDashboardState';
-import { defaultLayout } from './defaultLayout';
+import { defaultLayout, isLegacyThreeColumn } from './defaultLayout';
 
-// /command-hq: nav + grid + detail, all three always mounted (like /chat), selection carried by the URL
+// /command-hq: navigation and detail, all panels always mounted (like /chat), selection carried by the URL
 // — `?category=` for the nav filter, `:sessionId` for the open commander. See `docs/command-hq.md` →
-// "Route, surface, placement" and "Layout, v1".
+// "Route, surface, placement".
 
 export const CommandHqScreen = () => {
   const workspace = useDashboardState<LayoutNode>('screens/command-hq', defaultLayout);
 
+  /*
+    Move a saved three-column layout onto the two-column one.
+
+    The default alone cannot do it: this key is persisted per account, so anybody who has opened the screen
+    keeps the arrangement they had. See `isLegacyThreeColumn` for why the test is structural rather than an
+    appType check, and why replacing outright is the safe direction on a `locked` screen.
+  */
+  useEffect(() => {
+    if (!workspace.isLoaded) return;
+    if (!isLegacyThreeColumn(workspace.value)) return;
+    workspace.setValue(defaultLayout);
+  }, [workspace.isLoaded, workspace.value, workspace.setValue]);
+
   return (
     <div className="h-full w-full pt-2">
       <WorkspaceView

src/apps/officer-web/Screens/Dashboard/CommandHQ/defaultLayout.ts

@@ -1,14 +1,60 @@
 import type { LayoutNode } from 'officerdev';
 
-// Three columns, per `docs/command-hq.md` → "Layout, v1": category nav, commander grid, detail pane. The
-// detail pane gets the most room because it is a live chat transcript once something is selected.
+/*
+  Two columns, with the navigation stacked into the left one.
+
+  ── Why it changed from three ──
+
+  It was `16 / 34 / 50`: a category column, a commander column, and the transcript. So half the screen was
+  navigation for a list that holds a handful of commanders — one, on the machine this was written on — while
+  the only thing anybody reads got the other half. A category pane of its own is a filter for a list short
+  enough to see whole.
+
+  Now: commanders on top, categories beneath them, transcript taking three quarters.
+
+  ── Why the categories are BELOW the commanders ──
+
+  Because the commanders are the thing you came for and the categories are how you narrow them when there
+  are too many to scan. Above, the filter would push the list down the screen and be the first thing read;
+  below, the list is at the top where a list belongs and the filter is where you reach for it. It also means
+  the categories can grow their own scrollbar without ever taking room from the commanders.
+*/
 export const defaultLayout: LayoutNode = {
   type: 'group',
   id: 'command-hq-root',
   direction: 'horizontal',
   children: [
-    { node: { type: 'panel', id: 'command-hq-categories', appType: 'command-hq-categories' }, size: 16 },
-    { node: { type: 'panel', id: 'command-hq-grid', appType: 'command-hq-grid' }, size: 34 },
-    { node: { type: 'panel', id: 'command-hq-detail', appType: 'command-hq-detail' }, size: 50 },
+    {
+      node: {
+        type: 'group',
+        id: 'command-hq-nav',
+        direction: 'vertical',
+        children: [
+          { node: { type: 'panel', id: 'command-hq-grid', appType: 'command-hq-grid' }, size: 62 },
+          { node: { type: 'panel', id: 'command-hq-categories', appType: 'command-hq-categories' }, size: 38 },
+        ],
+      },
+      size: 24,
+    },
+    { node: { type: 'panel', id: 'command-hq-detail', appType: 'command-hq-detail' }, size: 76 },
   ],
 };
+
+/**
+ * Is this a saved copy of the three-column layout this replaced?
+ *
+ * No appType was retired — all three panels survive and only their arrangement changed — so `hasAppType`
+ * cannot see this the way the /chat migration could. The test is structural instead: the old shape is a
+ * horizontal root with THREE children, and the new one has two.
+ *
+ * It terminates for that reason: the replacement does not satisfy the test.
+ *
+ * Replacing outright is safe because the screen is `locked` — its structure is dictated by code, and the
+ * only thing a person can have contributed is the column sizes, which is a cheap thing to lose once. The
+ * same reasoning, and the same warning, as `ChatHistory/index.tsx`: get the test backwards and a stranded
+ * panel collapses onto `appTypes.fallback` and is written back, which is how /offscale once rendered three
+ * copies of one picker.
+ */
+export function isLegacyThreeColumn(node: LayoutNode): boolean {
+  return node.type === 'group' && node.direction === 'horizontal' && node.children.length === 3;
+}

src/apps/officer-web/Screens/Dashboard/Layout/DashboardLayout.tsx

@@ -8,6 +8,7 @@ import { Background } from './Background';
 import { Header } from './Header';
 import { Dock, CORE_DOCK_ITEMS, dockItemsFromPlugins, defaultDockPaths } from './Dock';
 import { Spotlight } from './Spotlight/Spotlight';
+import { ShortcutsModal } from './ShortcutsModal';
 import { useIsTouch } from './useIsTouch';
 import { usePageTitleSync } from '@/state/usePageTitle';
 import { RouteGate } from './RouteGate';
@@ -51,6 +52,9 @@ export function DashboardLayout({ children }: DashboardLayoutProps) {
       {/* Outside the content region on purpose, like the header and the dock: whatever a screen is doing
           — maximised panel, error boundary, mid-navigation — ctrl-space still gets you off it. */}
       <Spotlight />
+      {/* Outside the content region for the same reason Spotlight is: ctrl+? has to work from a maximised
+          panel, an error boundary, or mid-navigation. */}
+      <ShortcutsModal />
       {/* overflow-CLIP, not hidden: `hidden` still makes this a scroll container, and the nav Dock —
           absolute, parked below the bottom edge by translateY while hidden — adds its transformed box to
           the scrollable overflow. So clicking a link let the browser scroll this section ~70px to reveal

src/apps/officer-web/Screens/Dashboard/Layout/Header/Header.tsx

@@ -11,6 +11,7 @@ import { JobsIndicator } from './JobsIndicator';
 import { ThemeSwitcher } from './ThemeSwitcher';
 import { RescanButton } from '../Rescan/RescanButton';
 import { usePageTitle } from '@/state/usePageTitle';
+import { useAuth } from 'hooks/useAuth';
 import { useThemeAsset } from '@/components/ui/ThemeProvider';
 // import { BugReportButton } from '../BugReport/BugReportButton';
 
@@ -46,6 +47,7 @@ type HeaderProps = {
 export function Header({ dockItems, hidden }: HeaderProps) {
   const [open, setOpen] = useState(false);
   const isTouch = useIsTouch();
+  const { user } = useAuth();
   // The mark comes from the theme — a white-labelled build replaces it without touching this file.
   const logo = useThemeAsset('--logo-src');
 
@@ -100,9 +102,15 @@ export function Header({ dockItems, hidden }: HeaderProps) {
           */}
           {/* Bug Report — hidden */}
           {/* <BugReportButton /> */}
-          <JobsIndicator />
-          <RescanButton />
           <ThemeSwitcher />
+          {/* Owner only, and tidiness rather than access control — /jobs stays reachable and the rescan
+              endpoint is gated server-side, because a hidden button is not a permission. */}
+          {user?.role === 'Super Admin' && (
+            <>
+              <JobsIndicator />
+              <RescanButton />
+            </>
+          )}
           <UserMenu />
         </div>
       </div>

src/apps/officer-web/Screens/Dashboard/Layout/Header/ThemeSwitcher.tsx

@@ -1,8 +1,10 @@
+import { useMemo, useState } from 'react';
 import { createPortal } from 'react-dom';
-import { Palette, Check } from 'lucide-react';
+import { Check, Star } from 'lucide-react';
+import { favouritesFirst, groupByFamily, rotateToSelected } from 'theme';
 import * as Dropdown from '@/components/ui/dropdown-menu';
-import type { Theme } from '@/components/ui/ThemeProvider';
 import { useTheme, useThemeKeys } from '@/components/ui/ThemeProvider';
+import { useThemeFavorites } from '@/state/useThemeFavorites';
 
 const {
   DropdownMenu,
@@ -21,7 +23,7 @@ const {
  *
  * ── The overlay ──
  *
- * `ctrl+alt+space` opens a list in the middle of the screen; `j`/`k` move through it and `l` applies the
+ * `ctrl+shift+space` opens a list in the middle of the screen; `j`/`k` move through it and `l` applies the
  * focused theme to the app BEHIND it. That is the whole idea, and it is why this is a portal over a
  * translucent backdrop rather than a modal dialog: you are meant to watch the application change while
  * you browse, so as little of it as possible should be covered.
@@ -30,43 +32,115 @@ const {
  */
 export const ThemeSwitcher = () => {
   const { theme, themeId, setTheme, themes } = useTheme();
-  const { open, setOpen, focused, setFocused } = useThemeKeys();
+  const { favorites, isFavorite, toggle } = useThemeFavorites();
+  // Declared before the key hook, which needs the toggle: `f` in the list and `ctrl+shift+f` from anywhere.
+  const { open, setOpen, focused, setFocused } = useThemeKeys({ onToggleFavorite: toggle });
+  const [onlyFavorites, setOnlyFavorites] = useState(false);
 
-  // Grouped by family, so `Duck Light`/`Duck Dark` and the two Catppuccins sit together. The registry is
-  // readonly, so this builds mutable arrays rather than pushing into its own type.
-  const families = themes.reduce<Record<string, Theme[]>>((acc, t) => {
-    (acc[t.family] ??= []).push(t);
-    return acc;
-  }, {});
+  /*
+    One ordering, used by both lists.
+
+    ROTATED to the theme you are wearing rather than sorted: with 200+ installed, the list's only structure
+    is the registry order — families sit together in it — and lifting the selected theme out of its family
+    would answer "which am I on" by destroying "what is next to it". A rotation answers both. See
+    `theme/rotate.ts`.
+
+    Then favourites first, which is a second rotation-preserving pass rather than a filter: each half keeps
+    the order it was given, so the theme you are wearing still leads.
+  */
+  const ordered = useMemo(() => {
+    const rotated = rotateToSelected(themes, themeId);
+    const listed = onlyFavorites ? rotated.filter((t) => favorites.has(t.id)) : rotated;
+    return favouritesFirst(listed, favorites);
+    // `favorites` is a fresh Set each render; its CONTENTS are what matter, so key on those.
+  }, [themes, themeId, onlyFavorites, [...favorites].sort().join(',')]);
+
+  const families = useMemo(() => groupByFamily(ordered), [ordered]);
 
   return (
     <>
       <DropdownMenu>
         <DropdownMenuTrigger asChild>
           <button
-            title={`Theme: ${theme.name}  ·  ctrl+shift+←/→ to cycle · ctrl+shift+space for the list`}
-            aria-label="Theme"
-            className="flex h-8 w-8 items-center justify-center rounded-full transition-transform hover:scale-110 cursor-pointer"
+            title={`Theme: ${theme.name}  ·  ctrl+shift+←/→ cycle · ctrl+shift+space browse · ctrl+shift+f ${
+              isFavorite(themeId) ? 'unstar' : 'star'
+            }`}
+            aria-label={`Theme: ${theme.name}`}
+            // Named rather than a palette glyph: with 227 themes the one you are wearing is worth
+            // reading at a glance, and an icon cannot say which that is. Same pill as JobsIndicator so
+            // the cluster stays one shape.
+            className="flex h-8 cursor-pointer items-center rounded-full bg-black/25 px-2.5 text-xs font-semibold transition-colors hover:bg-black/35"
             style={{ color: 'var(--header-fg)' }}
           >
-            <Palette className="h-4 w-4" />
+            {theme.name}
+            {/* A star on the pill, so "is this one of mine" is answerable without opening anything. Only
+                when true — a hollow star on every theme would be chrome that says nothing 200 times. */}
+            {isFavorite(themeId) && <Star className="ml-1.5 h-3 w-3 fill-current opacity-80" />}
           </button>
         </DropdownMenuTrigger>
-        <DropdownMenuContent align="end" className="z-50 max-h-[70vh] w-56 overflow-y-auto">
-          <DropdownMenuLabel className="text-xs font-normal text-muted-foreground">
-            ctrl+shift+←/→ · ctrl+shift+space
-          </DropdownMenuLabel>
-          <DropdownMenuSeparator />
-          {Object.entries(families).map(([family, entries]) => (
-            <div key={family}>
-              {entries.map((t) => (
-                <DropdownMenuItem key={t.id} onClick={() => setTheme(t.id)} className="cursor-pointer">
-                  <Check className={`mr-2 h-4 w-4 ${t.id === themeId ? 'opacity-100' : 'opacity-0'}`} />
-                  {t.name}
-                </DropdownMenuItem>
-              ))}
-            </div>
-          ))}
+        {/*
+          The CONTENT does not scroll — the list inside it does.
+
+          It used to carry `overflow-y-auto` itself, which scrolled the instruction line away with the
+          themes. Two hundred entries meant the one line telling you the keyboard shortcuts existed was
+          visible for the first half-second and then gone for good, which is the same as not having written
+          it. Header and footer are now siblings of a scroll box rather than passengers in one.
+        */}
+        <DropdownMenuContent align="end" className="z-50 flex max-h-[70vh] w-64 flex-col overflow-hidden p-0">
+          <div className="shrink-0 border-b border-border px-2 py-1.5">
+            <DropdownMenuLabel className="px-0 py-0 text-xs font-normal leading-relaxed text-muted-foreground">
+              <span className="block">ctrl+shift+←/→ cycle · ctrl+shift+space browse</span>
+              <span className="block">ctrl+? for every shortcut</span>
+            </DropdownMenuLabel>
+            <button
+              type="button"
+              onClick={(ev) => {
+                // The dropdown closes on any item activation, and this is a filter rather than a choice.
+                ev.preventDefault();
+                ev.stopPropagation();
+                setOnlyFavorites((was) => !was);
+              }}
+              className={`mt-1 inline-flex cursor-pointer items-center gap-1.5 rounded px-1.5 py-0.5 text-xs font-medium transition-colors ${
+                onlyFavorites ? 'bg-primary/15 text-primary' : 'text-muted-foreground hover:text-foreground'
+              }`}
+            >
+              <Star className={`h-3.5 w-3.5 ${onlyFavorites ? 'fill-current' : ''}`} />
+              {onlyFavorites ? `Favourites only (${favorites.size})` : `Favourites (${favorites.size})`}
+            </button>
+          </div>
+
+          <div className="min-h-0 flex-1 overflow-y-auto p-1">
+            {ordered.length === 0 ? (
+              <p className="px-2 py-6 text-center text-xs text-muted-foreground">
+                No favourites yet — star one with the button on its row.
+              </p>
+            ) : (
+              families.map(([family, entries]) => (
+                <div key={family}>
+                  {entries.map((t) => (
+                    <DropdownMenuItem key={t.id} onClick={() => setTheme(t.id)} className="cursor-pointer pr-1">
+                      <Check className={`mr-2 h-4 w-4 shrink-0 ${t.id === themeId ? 'opacity-100' : 'opacity-0'}`} />
+                      <span className="min-w-0 flex-1 truncate">{t.name}</span>
+                      {/* A sibling of the row's action, never nested inside it — starring is not choosing. */}
+                      <button
+                        type="button"
+                        aria-label={isFavorite(t.id) ? `Unstar ${t.name}` : `Star ${t.name}`}
+                        title={isFavorite(t.id) ? 'Remove from favourites' : 'Add to favourites'}
+                        onClick={(ev) => {
+                          ev.preventDefault();
+                          ev.stopPropagation();
+                          toggle(t.id);
+                        }}
+                        className="ml-1 shrink-0 rounded p-1 text-muted-foreground hover:text-primary"
+                      >
+                        <Star className={`h-3.5 w-3.5 ${isFavorite(t.id) ? 'fill-current text-primary' : ''}`} />
+                      </button>
+                    </DropdownMenuItem>
+                  ))}
+                </div>
+              ))
+            )}
+          </div>
         </DropdownMenuContent>
       </DropdownMenu>
 
@@ -87,8 +161,11 @@ export const ThemeSwitcher = () => {
               }}
               onClick={(ev) => ev.stopPropagation()}
             >
-              <ul className="flex flex-col gap-1">
-                {themes.map((t) => {
+              {/* The SAME `ordered` list as the dropdown — rotated to what you are wearing, favourites
+                  first. Both lists agreeing is the point: "the one below the one I have on" has to mean the
+                  same thing in both, or the browse teaches you an order the menu then contradicts. */}
+              <ul className="flex max-h-[70vh] flex-col gap-1 overflow-y-auto">
+                {ordered.map((t) => {
                   const isFocused = t.id === focused;
                   return (
                     <li key={t.id}>
@@ -98,19 +175,43 @@ export const ThemeSwitcher = () => {
                           setTheme(t.id);
                           setOpen(false);
                         }}
-                        className={`w-full rounded-md px-4 py-1 text-left transition-all cursor-pointer ${
+                        className={`flex w-full items-center gap-2 rounded-md px-4 py-1 text-left transition-all cursor-pointer ${
                           isFocused ? 'text-2xl font-extrabold' : 'text-lg opacity-60 hover:opacity-100'
                         }`}
                       >
-                        {t.name}
-                        {t.id === themeId && <span className="ml-2 align-middle text-xs opacity-70">active</span>}
+                        <span className="min-w-0 flex-1 truncate">{t.name}</span>
+                        {t.id === themeId && <span className="shrink-0 text-xs opacity-70">active</span>}
+                        {/*
+                          A span, not a button: this sits inside the row's own <button>, and a button inside
+                          a button is invalid HTML that browsers resolve by dropping one of them. The click
+                          handler and the role are set explicitly instead, and `f` does the same thing from
+                          the keyboard.
+                        */}
+                        <span
+                          role="button"
+                          tabIndex={-1}
+                          aria-label={isFavorite(t.id) ? `Unstar ${t.name}` : `Star ${t.name}`}
+                          title={isFavorite(t.id) ? 'Remove from favourites (f)' : 'Add to favourites (f)'}
+                          onClick={(ev) => {
+                            // Or the row's own onClick applies the theme and closes the overlay, which is
+                            // the opposite of what starring is for.
+                            ev.preventDefault();
+                            ev.stopPropagation();
+                            toggle(t.id);
+                          }}
+                          className="shrink-0 rounded p-1 opacity-70 hover:opacity-100"
+                        >
+                          <Star className={`h-4 w-4 ${isFavorite(t.id) ? 'fill-current' : ''}`} />
+                        </span>
                       </button>
                     </li>
                   );
                 })}
               </ul>
+              {/* Always visible: it sits outside the scroll box above, for the same reason the dropdown's
+                  header does. */}
               <p className="mt-6 text-center text-xs opacity-60">
-                j/k or ↑/↓ move · l or → preview · h or ← reset · enter keep · esc cancel
+                j/k or ↑/↓ move · l or → preview · f star · h or ← reset · enter keep · esc cancel
               </p>
             </div>
           </div>,

src/apps/officer-web/Screens/Dashboard/Layout/ShortcutsModal.tsx

@@ -0,0 +1,81 @@
+import { useEffect, useState } from 'react';
+import { Keyboard } from 'lucide-react';
+import { isShortcutsChord, SHORTCUT_SECTIONS } from '@/state/shortcuts';
+
+/*
+  `Ctrl+?` — every shortcut the shell owns, on one screen.
+
+  Ported in shape from `vimazing`, where the controls are declared as data and the help screen renders them.
+  Its renderer was a recursive `any` walk over arbitrary content, which is right for a game whose help also
+  carries rules and scoring; here the content is one shape, so the renderer is typed and boring and the
+  interesting part is `state/shortcuts.ts`.
+
+  Card per section, two columns on anything wider than a phone — the same arrangement vimazing used for its
+  controls grid, and for the same reason: these are short lists that read badly as one long column.
+*/
+
+const Row = ({ keys, description }: { keys: string; description: string }) => (
+  <div className="flex items-baseline gap-3 py-1">
+    {/* Fixed width, tabular: the chords line up into a column you can scan, which is the whole point of
+        putting them on the left. */}
+    <kbd className="w-32 shrink-0 rounded border border-border bg-muted/60 px-1.5 py-0.5 text-center font-mono text-[11px] text-foreground/90">
+      {keys}
+    </kbd>
+    <span className="text-sm text-muted-foreground">{description}</span>
+  </div>
+);
+
+export const ShortcutsModal = () => {
+  const [open, setOpen] = useState(false);
+
+  useEffect(() => {
+    const onKey = (ev: KeyboardEvent) => {
+      if (isShortcutsChord(ev)) {
+        // No focus check: `Ctrl+?` types nothing in a text field, and a help list you cannot open from the
+        // composer is a help list you cannot open — the lesson from the Spotlight guard.
+        ev.preventDefault();
+        setOpen((was) => !was);
+        return;
+      }
+      if (ev.key === 'Escape' && open) setOpen(false);
+    };
+    // Capture, so a panel with its own key handling cannot swallow it first.
+    window.addEventListener('keydown', onKey, true);
+    return () => window.removeEventListener('keydown', onKey, true);
+  }, [open]);
+
+  if (!open) return null;
+
+  return (
+    <div
+      className="fixed inset-0 z-[901] flex items-start justify-center bg-black/50 pt-[8vh] backdrop-blur-sm"
+      onMouseDown={() => setOpen(false)}
+    >
+      <div
+        className="flex max-h-[80vh] w-[min(94vw,860px)] flex-col overflow-hidden rounded-2xl border border-border bg-background/95 shadow-2xl"
+        onMouseDown={(ev) => ev.stopPropagation()}
+      >
+        <div className="flex shrink-0 items-center gap-2 border-b border-border px-5 py-3">
+          <Keyboard className="h-4 w-4 text-muted-foreground" />
+          <h2 className="text-sm font-semibold">Keyboard shortcuts</h2>
+          <span className="ml-auto text-xs text-muted-foreground">Ctrl+? · Esc to close</span>
+        </div>
+
+        {/* Only this scrolls — the header stays, for the same reason the theme dropdown's does. */}
+        <div className="grid min-h-0 flex-1 gap-5 overflow-y-auto p-5 sm:grid-cols-2">
+          {SHORTCUT_SECTIONS.map((section) => (
+            <section key={section.title} className="rounded-xl border border-border bg-muted/20 p-4">
+              <h3 className="text-xs font-semibold uppercase tracking-wide text-foreground/80">{section.title}</h3>
+              {section.note && <p className="mt-1 text-[11px] leading-snug text-muted-foreground">{section.note}</p>}
+              <div className="mt-2">
+                {section.shortcuts.map((shortcut) => (
+                  <Row key={shortcut.keys} keys={shortcut.keys} description={shortcut.description} />
+                ))}
+              </div>
+            </section>
+          ))}
+        </div>
+      </div>
+    </div>
+  );
+};

src/apps/officer-web/Screens/Dashboard/Layout/Spotlight/Spotlight.tsx

@@ -11,34 +11,71 @@ import { useSpotlightItems, type SpotlightItem } from './useSpotlightItems';
 //
 // ── Keyboard first, and the trigger ──
 //
-// `shift-space`. The two obvious chords were both taken: `ctrl-space` focuses the address bar in Brave,
-// and `alt-space` is load-bearing for the owner elsewhere. `cmd-k` belongs to the browser on some
-// platforms and to text fields on others.
+// `shift-space`, and ONLY that. Fifth setting: ctrl-space → shift-space → alt-space → ctrl-space →
+// shift-space. Every move was the owner naming a collision, and by now the list is the useful part:
 //
-// **Shift-space is a real key combination inside a text field** — it types a space, and people hold shift
-// through one more often than they think while typing capitals. So the trigger is IGNORED when focus is
-// in an input, a textarea or anything contenteditable, and the space is typed as normal.
+//   ctrl-space   Brave takes it for the address bar, at the browser level. Tried twice, on the theory that
+//                preventDefault would win. It does not — the key never reaches this handler.
+//   alt-space    the GNOME window menu. He rebound the desktop to keep it, disliked the replacement, and
+//                would rather move the app than the window manager.
+//   shift-space  where it lands, with BOTH of its stock behaviours deliberately overridden.
 //
-// The cost of that is worth stating: focus usually IS in the chat composer, so opening Spotlight from
-// there means clicking out first. If that turns out to be the common case, a double-tap of shift is the
-// escape hatch — it conflicts with nothing anywhere.
+// ── Shift-space overrides two things, on purpose ──
+//
+// It types a space in a text field, and it scrolls a page UP when nothing has focus. The owner's judgement,
+// and it is his to make: neither is worth a launcher. Page-up-by-shift-space is a fossil nobody reaches for,
+// and typing a space is what the unmodified spacebar is for.
+//
+// The cost, stated once because it is the one that will bite: typing in CAPS by holding shift rather than
+// using caps lock puts a shift-space between every word. That opens the launcher mid-sentence. If it turns
+// out to be a nuisance, the fix is a guard for text fields only — which this had for a day, and which is
+// what made the launcher unopenable from the composer, where it is most wanted.
+//
+// This is also why the ctrl+? registry names the file that implements each chord: five moves in three days
+// is the argument for making them configurable, not for choosing better.
+//
+// **Shift-space was never a good choice**, and that is why it did not last a day. It is a real key
+// combination inside a text field: it types a space, and people hold shift through one more often than
+// they think while typing capitals. Guarding it meant IGNORING the trigger whenever focus was in an input
+// — which is where focus usually is, the chat composer — so opening Spotlight meant clicking out first.
+// A launcher you have to prepare for is not a launcher.
+//
+// There is NO focus check, and here that is a choice with a cost rather than a free one — see above. The guard shift-space
+// needed was kept for one commit as "belt-and-braces" and was simply the old bug wearing a new hat: focus
+// is usually in the chat composer, so a launcher that stands down there is a launcher that does not open
+// when you want it. `preventDefault` on the handler covers the only real risk the guard addressed.
+//
+// Nothing else opens it. There is deliberately no second chord — two triggers for one thing means two
+// things to collide with, and this one moved twice already.
 //
 // Escape closes, arrows move, enter goes. The mouse works, but nothing here is designed around it.
+//
+// ── Sizing ──
+//
+// Loosened 2026-08-22: the first pass reused the app's list metrics (7px tile, text-sm, py-2) and read as
+// cramped, because this is not a list inside a panel — it is a modal you look at for two seconds with
+// nothing else competing for the eye. So the search input leads at `text-base`, rows are `py-2.5` with a
+// 9px tile, and the label is `text-[15px]` with the hint and path kept deliberately subordinate.
+//
+// The panel widened with them (560 → 640). Rows now carry a label, a hint and a route on one line, and the
+// route is the first thing to be squeezed out — it is also the thing that disambiguates two rows with the
+// same name.
+//
+// The results box grew 52vh → 60vh for the arithmetic reason: taller rows in the same box show fewer
+// results, and the cap on how many are listed was removed for a reason.
 
-const MAX_RESULTS = 8;
+/*
+  No cap, deliberately, and it used to be 8.
 
-/**
- * Is the user typing into something?
- *
- * `shift-space` types a space in any text field, so the trigger has to stand down there or it eats a
- * keystroke people make by accident all day. `isContentEditable` covers the editor and any rich input a
- * panel brings with it.
- */
-function isTyping(target: EventTarget | null): boolean {
-  const el = target as HTMLElement | null;
-  if (!el || !el.tagName) return false;
-  return el.tagName === 'INPUT' || el.tagName === 'TEXTAREA' || el.isContentEditable === true;
-}
+  Eight was fine on the machine it was written on, which has few plugins. On a populated server the dock
+  carries fourteen plugin tiles and the core items alone fill all eight slots — so with an empty query the
+  list stopped at Browser and every plugin was unreachable unless you already knew its name well enough to
+  type it. A launcher you can only use for things you can already name is not doing the job.
+
+  The container has scrolled since it was written (`max-h-[52vh] overflow-y-auto`), so there was never a
+  layout reason for the limit, and the truncation was silent — nothing said "and 20 more", which is how a
+  cap becomes indistinguishable from a missing feature.
+*/
 
 /** Label with the matched characters picked out, so it is obvious WHY a result is here. */
 const Highlighted = ({ label, hits }: { label: string; hits: number[] }) => {
@@ -71,8 +108,15 @@ const Row = ({
   onPick: () => void;
 }) => {
   const Icon = item.icon;
+  // Keyboard navigation has to survive a list taller than the box. `block: 'nearest'` scrolls only when the
+  // row is actually out of sight, so arrowing through the visible middle of the list does not jump it.
+  const ref = useRef<HTMLButtonElement | null>(null);
+  useEffect(() => {
+    if (active) ref.current?.scrollIntoView({ block: 'nearest' });
+  }, [active]);
   return (
     <button
+      ref={ref}
       type="button"
       // `onMouseDown`, not `onClick`: the input holds focus and a click would blur it first, closing the
       // overlay on the blur handler before the navigation ever ran.
@@ -80,29 +124,52 @@ const Row = ({
         ev.preventDefault();
         onPick();
       }}
-      className={`flex w-full items-center gap-3 rounded-lg px-3 py-2 text-left transition-colors ${
+      className={`flex w-full items-center gap-3.5 rounded-lg px-3.5 py-2.5 text-left transition-colors ${
         active ? 'bg-accent' : 'hover:bg-accent/50'
       }`}
     >
+      {/*
+        The dock's tile, at row size. Same two cases and the same rule for choosing between them, because
+        these are the SAME things and a second visual language for them is what made this list read as
+        somebody else's menu:
+
+          badge  a filled square of the item's colour with a white glyph — a white glyph on nothing is
+                 invisible, which is why the fill is not decoration
+          bare   no background, artwork fills the box — a logo framed in an arbitrary swatch reads as a
+                 mistake, and every plugin shipping its own art is this case
+
+        The tinted `${color}22` square this used for everything was a third style belonging to neither, and
+        it put a coloured pane behind Calendar, Contacts and every plugin logo.
+      */}
       <span
-        className="flex h-7 w-7 shrink-0 items-center justify-center rounded-md"
-        style={item.color ? { backgroundColor: `${item.color}22`, color: item.color } : undefined}
+        className="flex h-9 w-9 shrink-0 items-center justify-center rounded-md"
+        style={{
+          background: item.tile === 'bare' ? 'transparent' : (item.color ?? 'transparent'),
+          // No colour at all is a settings row: keep the muted glyph rather than inventing a swatch.
+          color: item.color ? '#fff' : undefined,
+        }}
       >
         {item.image ? (
-          <img src={item.image} alt="" className="h-5 w-5 object-contain" />
+          <img
+            src={item.image}
+            alt=""
+            className={item.tile === 'bare' ? 'h-full w-full object-contain' : 'h-5 w-5 object-contain'}
+          />
         ) : Icon ? (
-          <Icon className="h-4 w-4" />
+          <Icon className={`h-[18px] w-[18px] ${item.color ? '' : 'text-muted-foreground'}`} />
         ) : (
-          <Search className="h-4 w-4" />
+          <Search className="h-[18px] w-[18px] text-muted-foreground" />
         )}
       </span>
       <span className="min-w-0 flex-1">
-        <span className="block truncate text-sm text-foreground">
+        <span className="block truncate text-[15px] leading-snug text-foreground">
           <Highlighted label={item.label} hits={hits} />
         </span>
-        {item.hint ? <span className="block truncate text-xs text-muted-foreground">{item.hint}</span> : null}
+        {item.hint ? (
+          <span className="block truncate text-[13px] leading-snug text-muted-foreground">{item.hint}</span>
+        ) : null}
       </span>
-      <span className="shrink-0 font-mono text-[10px] text-muted-foreground/60">{item.to}</span>
+      <span className="shrink-0 font-mono text-[11px] text-muted-foreground/60">{item.to}</span>
     </button>
   );
 };
@@ -115,7 +182,20 @@ export const Spotlight = () => {
   const navigate = useNavigate();
   const items = useSpotlightItems();
 
-  const results = useMemo(() => rank(items, query).slice(0, MAX_RESULTS), [items, query]);
+  const results = useMemo(() => rank(items, query), [items, query]);
+
+  /*
+    The window handler reads these through refs.
+
+    It has to: the listener is registered once per open, and closing over `results` and `active` would pin
+    it to their values at registration — so arrowing down would read a stale list and Enter would open
+    whatever was first when the panel appeared. Adding them to the effect's deps instead would tear down and
+    re-register the listener on every keystroke, which is the same bug wearing a costume.
+  */
+  const resultsRef = useRef(results);
+  resultsRef.current = results;
+  const activeRef = useRef(active);
+  activeRef.current = active;
 
   const close = useCallback(() => {
     setOpen(false);
@@ -136,16 +216,51 @@ export const Spotlight = () => {
   // anywhere — including inside a panel that has its own key handling.
   useEffect(() => {
     const onKey = (ev: KeyboardEvent) => {
-      if (ev.shiftKey && ev.code === 'Space' && !isTyping(ev.target)) {
+      // `code`, not `key`: shift+space reports `key: ' '` on most layouts and something else on a few, while
+      // the physical key is `Space` everywhere.
+      //
+      // Every other modifier must be ABSENT. `ctrl+shift+space` is the theme browser, and one chord opening
+      // both is the bug that took a capture-phase listener to fix on the theme side.
+      //
+      // No focus check. There was one, inherited from shift-space where it was mandatory, and keeping it
+      // "as belt-and-braces" was wrong in the plainest way: focus is usually IN the chat composer, so the
+      // guard meant the launcher did not open from the place it is most often wanted. `preventDefault`
+      // below covers the only thing the guard was protecting against — a layout that would otherwise type
+      // a character.
+      if (ev.shiftKey && !ev.ctrlKey && !ev.altKey && !ev.metaKey && ev.code === 'Space') {
         ev.preventDefault();
+        // Take focus off whatever had it, explicitly, before the overlay mounts. The effect below focuses
+        // this panel's own input, and on paper that is enough — but "on paper" is what produced arrow keys
+        // that sometimes did nothing: focus stayed in the composer, so ArrowDown went to the textarea and
+        // the launcher never saw it. Blurring the outgoing element is one line and removes the race rather
+        // than narrowing it.
+        (document.activeElement as HTMLElement | null)?.blur?.();
         setOpen((wasOpen) => !wasOpen);
         return;
       }
-      if (ev.key === 'Escape' && open) close();
+      if (!open) return;
+      if (ev.key === 'Escape') {
+        close();
+        return;
+      }
+      // Navigation is handled HERE rather than on the input, so it works no matter what has focus — a
+      // panel that grabbed it back, a blur that lost the race, an element with its own key handling. The
+      // input's own onKeyDown used to own this, which made every keystroke conditional on focus having
+      // landed where we expected.
+      if (ev.key === 'ArrowDown') {
+        ev.preventDefault();
+        setActive((i) => Math.min(i + 1, resultsRef.current.length - 1));
+      } else if (ev.key === 'ArrowUp') {
+        ev.preventDefault();
+        setActive((i) => Math.max(i - 1, 0));
+      } else if (ev.key === 'Enter') {
+        ev.preventDefault();
+        pick(resultsRef.current[activeRef.current]?.item);
+      }
     };
     window.addEventListener('keydown', onKey);
     return () => window.removeEventListener('keydown', onKey);
-  }, [open, close]);
+  }, [open, close, pick]);
 
   useEffect(() => {
     if (open) inputRef.current?.focus();
@@ -162,34 +277,22 @@ export const Spotlight = () => {
       onMouseDown={close}
     >
       <div
-        className="w-[min(92vw,560px)] overflow-hidden rounded-2xl border border-border bg-background/95 shadow-2xl"
+        className="w-[min(92vw,640px)] overflow-hidden rounded-2xl border border-border bg-background/95 shadow-2xl"
         // The backdrop closes on mousedown; this stops a click INSIDE the panel counting as one.
         onMouseDown={(ev) => ev.stopPropagation()}
       >
         <div className="flex items-center gap-2 border-b border-border px-4">
-          <Search className="h-4 w-4 shrink-0 text-muted-foreground" />
+          <Search className="h-5 w-5 shrink-0 text-muted-foreground" />
           <input
             ref={inputRef}
             value={query}
             onChange={(ev) => setQuery(ev.target.value)}
-            onKeyDown={(ev) => {
-              if (ev.key === 'ArrowDown') {
-                ev.preventDefault();
-                setActive((i) => Math.min(i + 1, results.length - 1));
-              } else if (ev.key === 'ArrowUp') {
-                ev.preventDefault();
-                setActive((i) => Math.max(i - 1, 0));
-              } else if (ev.key === 'Enter') {
-                ev.preventDefault();
-                pick(results[active]?.item);
-              }
-            }}
             placeholder="Go to…"
-            className="w-full bg-transparent py-3.5 text-sm text-foreground outline-none placeholder:text-muted-foreground"
+            className="w-full bg-transparent py-4 text-base text-foreground outline-none placeholder:text-muted-foreground"
           />
         </div>
 
-        <div className="max-h-[52vh] overflow-y-auto p-2">
+        <div className="max-h-[60vh] overflow-y-auto p-2">
           {results.length === 0 ? (
             <p className="px-3 py-6 text-center text-sm text-muted-foreground">Nothing matches “{query}”.</p>
           ) : (

src/apps/officer-web/Screens/Dashboard/Layout/Spotlight/useSpotlightItems.ts

@@ -1,6 +1,23 @@
 import { useMemo } from 'react';
 import type { LucideIcon } from 'lucide-react';
-import { Settings, User, Puzzle, Server, Cpu, Users } from 'lucide-react';
+import {
+  Bot,
+  CalendarDays,
+  Cpu,
+  Globe,
+  KeyRound,
+  LayoutGrid,
+  Lock,
+  Mail,
+  Mic,
+  ScanText,
+  ShieldCheck,
+  Sparkles,
+  User,
+  Users,
+  Volume2,
+  Wrench,
+} from 'lucide-react';
 import { usePermissions } from 'hooks/usePermissions';
 import { CORE_DOCK_ITEMS, dockItemsFromPlugins } from '../Dock';
 
@@ -32,6 +49,15 @@ export type SpotlightItem = {
   /** Plugin artwork, when the tile has some. */
   image?: string;
   color?: string;
+  /**
+   * Copied from the dock tile, and it has to be.
+   *
+   * `bare` means the artwork brings its own frame — calendar, contacts, and every plugin shipping a logo.
+   * Dropping it here painted a coloured swatch behind those logos, which the dock's own comment calls out
+   * as reading like a mistake. It was dropped, so Spotlight looked like a different app's list of the same
+   * things.
+   */
+  tile?: 'badge' | 'bare';
 };
 
 /**
@@ -41,19 +67,67 @@ export type SpotlightItem = {
  * will not appear here until someone adds it. The alternative is exporting every settings screen's
  * section array up into the shell, which couples five screens to this one to save five lines.
  *
- * Worth revisiting if it drifts. `hint` is what makes them findable — typing "keys" should reach the API
- * keys screen, and the label alone does not say where it lives.
+ * IT DRIFTED, and within two days. The first version listed nine rows against a settings area that has
+ * twenty-one, missed Languages and Voice entirely, pointed `/settings/users` at a route that does not
+ * exist (it is `/settings/user-management/users`), and gave four different rows the same User glyph —
+ * which is most of why the whole panel read as a generic list rather than as the app's own.
+ *
+ * So the cost is now measured rather than predicted, and deriving these from the screens is the fix if it
+ * happens a third time. Each group below names the file it is copied from, so checking is one grep.
+ *
+ * `hint` is what makes them findable — typing "keys" should reach the API keys screen, and the label alone
+ * does not say where it lives.
  */
 const SETTINGS_ITEMS: SpotlightItem[] = [
+  // Profile — ProfileSettings/index.tsx
   { id: 'set:profile', label: 'Profile', to: '/settings/profile', hint: 'avatar, name, email', icon: User },
-  { id: 'set:password', label: 'Change password', to: '/settings/profile/change-password', icon: User },
-  { id: 'set:api-keys', label: 'API keys', to: '/settings/profile/api-keys', hint: 'per-app keys', icon: User },
-  { id: 'set:dock', label: 'Dock', to: '/settings/profile/dock', hint: 'choose and reorder', icon: User },
-  { id: 'set:integrations', label: 'Integrations', to: '/settings/integrations', icon: Puzzle },
-  { id: 'set:server', label: 'Server settings', to: '/settings/server', icon: Server },
-  { id: 'set:system', label: 'System', to: '/settings/system', icon: Cpu },
-  { id: 'set:users', label: 'Users', to: '/settings/users', hint: 'accounts and permissions', icon: Users },
-  { id: 'set:ai', label: 'AI', to: '/settings/ai', hint: 'models and harnesses', icon: Settings },
+  { id: 'set:password', label: 'Change password', to: '/settings/profile/change-password', icon: Lock },
+  {
+    id: 'set:api-keys',
+    label: 'API keys',
+    to: '/settings/profile/api-keys',
+    hint: 'keys that sign in as you',
+    icon: KeyRound,
+  },
+  {
+    id: 'set:languages',
+    label: 'Languages',
+    to: '/settings/profile/languages',
+    hint: 'spoken and translation',
+    icon: Globe,
+  },
+  { id: 'set:voice', label: 'Voice', to: '/settings/profile/voice', hint: 'text-to-speech', icon: Volume2 },
+  { id: 'set:dock', label: 'Dock', to: '/settings/profile/dock', hint: 'choose and reorder', icon: LayoutGrid },
+  // AI — AISettings.tsx
+  { id: 'set:ai-my-models', label: 'My Models', to: '/settings/ai/my-models', icon: Sparkles },
+  { id: 'set:ai-channel-models', label: 'Channel Models', to: '/settings/ai/member-models', icon: Sparkles },
+  { id: 'set:ai-default-models', label: 'Default Models', to: '/settings/ai/default-models', icon: Sparkles },
+  { id: 'set:ai-harnesses', label: 'Providers', to: '/settings/ai/ai-harnesses', hint: 'harnesses', icon: Bot },
+  // System — SystemSettings.tsx
+  { id: 'set:tts', label: 'Text to Speech', to: '/settings/system/tts', icon: Volume2 },
+  { id: 'set:stt', label: 'Speech to Text', to: '/settings/system/stt', icon: Mic },
+  { id: 'set:ocr', label: 'OCR', to: '/settings/system/ocr', icon: ScanText },
+  {
+    id: 'set:maintenance',
+    label: 'Rebuild & restart',
+    to: '/settings/system/maintenance',
+    hint: 'maintenance',
+    icon: Cpu,
+  },
+  { id: 'set:smtp', label: 'SMTP', to: '/settings/system/smtp', hint: 'outgoing mail', icon: Mail },
+  // Integrations — IntegrationsSettings
+  { id: 'set:google-oauth', label: 'Google OAuth', to: '/settings/integrations/google-oauth', icon: KeyRound },
+  { id: 'set:apify', label: 'Apify', to: '/settings/integrations/apify', icon: Wrench },
+  {
+    id: 'set:dav',
+    label: 'Calendar & Contacts sync',
+    to: '/settings/integrations/dav-app-passwords',
+    hint: 'app passwords',
+    icon: CalendarDays,
+  },
+  // Users — UserManagement
+  { id: 'set:users', label: 'Accounts', to: '/settings/user-management/users', hint: 'users', icon: Users },
+  { id: 'set:permissions', label: 'Permissions', to: '/settings/user-management/permissions', icon: ShieldCheck },
 ];
 
 /** Everything Spotlight can offer this account, in a stable order. */
@@ -70,6 +144,7 @@ export function useSpotlightItems(): SpotlightItem[] {
         icon: item.icon,
         image: item.image,
         color: item.color,
+        tile: item.tile,
       }));
 
     // Settings go through `canVisit` too. `usePermissions` fails OPEN by design — hiding a door is a

src/apps/officer-web/state/shortcuts.ts

@@ -0,0 +1,127 @@
+/*
+  Every keyboard shortcut the shell owns, as data.
+
+  ── Why a registry ──
+
+  Ported in shape from the owner's `vimazing` (`vim-maze/src/gameInfo.ts`), where the controls are declared
+  once and the help screen renders them. The alternative is what this replaced: chords spelled out inside
+  three separate key handlers, and a help text nobody updates because it lives somewhere else.
+
+  Two things follow from having it. `Ctrl+?` can render an accurate list without anybody maintaining prose.
+  And when shortcuts become configurable — the next big piece — this is the table a binding UI edits, rather
+  than a grep across handlers.
+
+  ── What it is NOT, yet ──
+
+  Declarative but not authoritative: the handlers still contain their own conditions, so a chord changed here
+  does not move. Making this the single source is part of the configurable-shortcuts work, and doing it now
+  would mean a rewrite of three handlers for no visible gain. Where a chord appears in both places the file
+  that owns it is named in `implementedIn`, so the pair can be found in one search.
+*/
+
+export type Shortcut = {
+  /** As a person reads it — `Ctrl+Shift+Space`, not a KeyboardEvent spelling. */
+  keys: string;
+  description: string;
+  /** The file whose handler actually implements it, until this registry is authoritative. */
+  implementedIn: string;
+};
+
+export type ShortcutSection = {
+  title: string;
+  /** Shown under the title when the section needs a caveat that a per-row description cannot carry. */
+  note?: string;
+  shortcuts: Shortcut[];
+};
+
+export const SHORTCUT_SECTIONS: ShortcutSection[] = [
+  {
+    title: 'Navigation',
+    shortcuts: [
+      {
+        keys: 'Shift+Space',
+        description: 'Spotlight — go to any screen, plugin or setting by name',
+        implementedIn: 'Layout/Spotlight/Spotlight.tsx',
+      },
+      { keys: 'Ctrl+?', description: 'This list', implementedIn: 'Layout/ShortcutsModal.tsx' },
+    ],
+  },
+  {
+    title: 'Themes',
+    note: 'The browser applies as you move, so you watch the app change rather than reading names.',
+    shortcuts: [
+      {
+        keys: 'Ctrl+Shift+Space',
+        description: 'Open the theme browser',
+        implementedIn: 'theme/useThemeKeys.ts',
+      },
+      {
+        keys: 'Ctrl+Shift+← / →',
+        description: 'Previous / next theme, without opening anything',
+        implementedIn: 'theme/useThemeKeys.ts',
+      },
+      {
+        keys: 'Ctrl+Shift+F',
+        description: 'Star or unstar the current theme, from anywhere',
+        implementedIn: 'theme/useThemeKeys.ts',
+      },
+    ],
+  },
+  {
+    title: 'In the theme browser',
+    shortcuts: [
+      { keys: 'j / k  ↑ / ↓', description: 'Move through the list', implementedIn: 'theme/useThemeKeys.ts' },
+      {
+        keys: 'l  →',
+        description: 'Apply the focused theme and keep browsing',
+        implementedIn: 'theme/useThemeKeys.ts',
+      },
+      { keys: 'h  ←', description: 'Put back the theme you started on', implementedIn: 'theme/useThemeKeys.ts' },
+      { keys: 'f', description: 'Star or unstar the focused theme', implementedIn: 'theme/useThemeKeys.ts' },
+      { keys: 'Enter', description: 'Keep what you are looking at', implementedIn: 'theme/useThemeKeys.ts' },
+      { keys: 'Esc', description: 'Cancel and restore', implementedIn: 'theme/useThemeKeys.ts' },
+    ],
+  },
+  {
+    title: 'In Spotlight',
+    shortcuts: [
+      { keys: '↑ / ↓', description: 'Move through the results', implementedIn: 'Layout/Spotlight/Spotlight.tsx' },
+      { keys: 'Enter', description: 'Go there', implementedIn: 'Layout/Spotlight/Spotlight.tsx' },
+      { keys: 'Esc', description: 'Close', implementedIn: 'Layout/Spotlight/Spotlight.tsx' },
+    ],
+  },
+  {
+    title: 'Chat',
+    note: 'Recall only takes the arrow key from an EMPTY composer, and any other key ends a recall — so a draft is never overwritten.',
+    shortcuts: [
+      {
+        keys: '↑ / ↓',
+        description: 'Previous / next prompt you sent, shell-style',
+        implementedIn: 'Chat/EmbeddableChat/useEmbeddableChat.ts',
+      },
+      {
+        keys: 'Enter',
+        description: 'Send · on an empty composer with something queued, send that now',
+        implementedIn: 'Chat/EmbeddableChat/useEmbeddableChat.ts',
+      },
+      { keys: 'Shift+Enter', description: 'Newline', implementedIn: 'Chat/EmbeddableChat/useEmbeddableChat.ts' },
+      {
+        keys: 'Esc',
+        description: 'Stop the turn that is generating',
+        implementedIn: 'Chat/EmbeddableChat/useEmbeddableChat.ts',
+      },
+    ],
+  },
+];
+
+/**
+ * Is this the `Ctrl+?` chord?
+ *
+ * `?` is `Shift+/` on most layouts and its own key on some, so both spellings are accepted rather than
+ * guessing which keyboard is attached. `code === 'Slash'` is the physical key, which is stable where `key`
+ * is not.
+ */
+export function isShortcutsChord(ev: KeyboardEvent): boolean {
+  if (!ev.ctrlKey) return false;
+  return ev.key === '?' || (ev.shiftKey && ev.code === 'Slash');
+}

src/apps/officer-web/state/useThemeFavorites.ts

@@ -0,0 +1,55 @@
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { useClient } from 'hooks/useClient';
+
+/*
+  Starred themes, per account.
+
+  With 200+ installed, "which of these did I like" is a question the list cannot answer by itself, and the
+  answer belongs to the account rather than to the browser — the same taste follows you to the phone.
+
+  Optimistic, and that is not a nicety here: the star sits in a dropdown you are about to close, so a
+  round trip before the icon fills means the confirmation arrives after the thing it confirms has gone.
+*/
+
+const KEY = ['themes', 'favorites'];
+
+export function useThemeFavorites() {
+  const client = useClient();
+  const queryClient = useQueryClient();
+
+  const query = useQuery<{ favorites: string[] }>({
+    queryKey: KEY,
+    queryFn: () => client.get<{ favorites: string[] }>('/theme-favorites'),
+    // Taste does not change while you look at it, and the mutation below keeps the cache honest.
+    staleTime: 5 * 60_000,
+    refetchOnWindowFocus: false,
+    retry: false,
+  });
+
+  const toggle = useMutation({
+    mutationFn: ({ themeId, favorite }: { themeId: string; favorite: boolean }) =>
+      client.put<{ themeId: string; favorite: boolean }>(`/theme-favorites/${themeId}`, { favorite }),
+    onMutate: async ({ themeId, favorite }) => {
+      await queryClient.cancelQueries({ queryKey: KEY });
+      const previous = queryClient.getQueryData<{ favorites: string[] }>(KEY);
+      const current = previous?.favorites ?? [];
+      queryClient.setQueryData(KEY, {
+        favorites: favorite ? [...new Set([...current, themeId])] : current.filter((id) => id !== themeId),
+      });
+      return { previous };
+    },
+    // Put it back on failure. A star that stayed filled after the write was refused is worse than one that
+    // never filled: it reports a preference the server does not hold.
+    onError: (_err, _vars, context) => {
+      if (context?.previous) queryClient.setQueryData(KEY, context.previous);
+    },
+  });
+
+  const favorites = new Set(query.data?.favorites ?? []);
+
+  return {
+    favorites,
+    isFavorite: (themeId: string) => favorites.has(themeId),
+    toggle: (themeId: string) => toggle.mutate({ themeId, favorite: !favorites.has(themeId) }),
+  };
+}

src/databases/officer_db/src/anthropic-accounts/index.ts

@@ -0,0 +1,2 @@
+export * from './schema';
+export * from './queries';

src/databases/officer_db/src/anthropic-accounts/queries.ts

@@ -0,0 +1,147 @@
+import { and, desc, eq, lt } from 'drizzle-orm';
+import { db } from '../db';
+import { decryptSecret, encryptSecret } from '../crypto';
+import { anthropicAccounts } from './schema';
+
+/*
+  A stored Anthropic login, and the two shapes it comes in.
+
+  `StoredAccount` is what an API may return: who it is, how stale, whether it can still be used. It carries
+  no secret. `revealAccount` is the only way to the credential itself and exists for exactly one caller —
+  the switch, which writes it back to disk.
+*/
+
+/** The encryption purpose for one account. Per-account by design; see the schema note. */
+const purposeFor = (accountUuid: string) => `anthropic-account:${accountUuid}`;
+
+export type StoredAccount = {
+  accountUuid: string;
+  emailAccount: string;
+  orgName: string | null;
+  plan: string | null;
+  capturedAt: string;
+  lastUsedAt: string | null;
+  refreshExpiresAt: string | null;
+  /** False once the refresh token is past its expiry: switching would fail, so the UI must offer /login. */
+  usable: boolean;
+};
+
+type SaveParams = {
+  userId: number;
+  accountUuid: string;
+  emailAccount: string;
+  orgName: string | null;
+  plan: string | null;
+  /** The `claudeAiOauth` object, verbatim, as JSON. */
+  credentialsJson: string;
+  /** The `oauthAccount` object, verbatim, as JSON. */
+  oauthAccountJson: string;
+  refreshExpiresAt: Date | null;
+};
+
+const publish = (row: typeof anthropicAccounts.$inferSelect): StoredAccount => ({
+  accountUuid: row.accountUuid,
+  emailAccount: row.emailAccount,
+  orgName: row.orgName,
+  plan: row.plan,
+  capturedAt: row.capturedAt.toISOString(),
+  lastUsedAt: row.lastUsedAt?.toISOString() ?? null,
+  refreshExpiresAt: row.refreshExpiresAt?.toISOString() ?? null,
+  usable: !row.refreshExpiresAt || row.refreshExpiresAt.getTime() > Date.now(),
+});
+
+/**
+ * Record (or re-record) one account's credential.
+ *
+ * Upsert on `(userId, accountUuid)` rather than insert, because capturing happens every time the current
+ * account is noticed to have changed — so the common case is refreshing a row that already exists with a
+ * newer token. `capturedAt` moves; `lastUsedAt` deliberately does not, since capturing is not using.
+ */
+export async function saveAnthropicAccount(p: SaveParams): Promise<void> {
+  const purpose = purposeFor(p.accountUuid);
+  const values = {
+    userId: p.userId,
+    accountUuid: p.accountUuid,
+    emailAccount: p.emailAccount,
+    orgName: p.orgName,
+    plan: p.plan,
+    credentials: encryptSecret(purpose, p.credentialsJson),
+    oauthAccount: encryptSecret(purpose, p.oauthAccountJson),
+    refreshExpiresAt: p.refreshExpiresAt,
+    capturedAt: new Date(),
+  };
+  await db
+    .insert(anthropicAccounts)
+    .values(values)
+    .onConflictDoUpdate({
+      target: [anthropicAccounts.userId, anthropicAccounts.accountUuid],
+      set: {
+        emailAccount: values.emailAccount,
+        orgName: values.orgName,
+        plan: values.plan,
+        credentials: values.credentials,
+        oauthAccount: values.oauthAccount,
+        refreshExpiresAt: values.refreshExpiresAt,
+        capturedAt: values.capturedAt,
+      },
+    });
+}
+
+/** Every account this Officer user can switch to, most recently used first. Carries no secret. */
+export async function listAnthropicAccounts(userId: number): Promise<StoredAccount[]> {
+  const rows = await db
+    .select()
+    .from(anthropicAccounts)
+    .where(eq(anthropicAccounts.userId, userId))
+    .orderBy(desc(anthropicAccounts.lastUsedAt), desc(anthropicAccounts.capturedAt));
+  return rows.map(publish);
+}
+
+/**
+ * The credential itself, for the switch. Decrypts, so every call is a secret leaving the database.
+ *
+ * Returns null for an unknown account AND for one whose refresh token has expired: a caller that wrote an
+ * expired credential to disk would have signed the owner out with no message, which is the worst of the
+ * available failures.
+ */
+export async function revealAnthropicAccount(
+  userId: number,
+  accountUuid: string,
+): Promise<{ credentialsJson: string; oauthAccountJson: string; emailAccount: string } | null> {
+  const [row] = await db
+    .select()
+    .from(anthropicAccounts)
+    .where(and(eq(anthropicAccounts.userId, userId), eq(anthropicAccounts.accountUuid, accountUuid)))
+    .limit(1);
+  if (!row) return null;
+  if (row.refreshExpiresAt && row.refreshExpiresAt.getTime() <= Date.now()) return null;
+  const purpose = purposeFor(row.accountUuid);
+  return {
+    credentialsJson: decryptSecret(purpose, row.credentials),
+    oauthAccountJson: decryptSecret(purpose, row.oauthAccount),
+    emailAccount: row.emailAccount,
+  };
+}
+
+/** Marks the switch. Separate from reveal so a failed write does not claim the account is in use. */
+export async function markAnthropicAccountUsed(userId: number, accountUuid: string): Promise<void> {
+  await db
+    .update(anthropicAccounts)
+    .set({ lastUsedAt: new Date() })
+    .where(and(eq(anthropicAccounts.userId, userId), eq(anthropicAccounts.accountUuid, accountUuid)));
+}
+
+/**
+ * Drop credentials that can no longer be used.
+ *
+ * A dead refresh token is not a credential, it is a liability with a thirty-day head start already spent —
+ * so it goes rather than sitting in the table for ever. Called opportunistically on list, not scheduled: a
+ * cron for one DELETE is a moving part that can silently stop.
+ */
+export async function purgeExpiredAnthropicAccounts(userId: number): Promise<number> {
+  const gone = await db
+    .delete(anthropicAccounts)
+    .where(and(eq(anthropicAccounts.userId, userId), lt(anthropicAccounts.refreshExpiresAt, new Date())))
+    .returning({ id: anthropicAccounts.id });
+  return gone.length;
+}

src/databases/officer_db/src/anthropic-accounts/schema.ts

@@ -0,0 +1,72 @@
+import { integer, pgTable, serial, text, timestamp, uniqueIndex } from 'drizzle-orm/pg-core';
+import { users } from '../auth/schema';
+
+/**
+ * The OAuth credential for each Anthropic account the owner signs into, so they can be switched between
+ * without a browser round trip.
+ *
+ * ── Why keep them at all ──
+ *
+ * The owner has a personal account and a company one and moves between them during a day — by what they are
+ * working on, and sometimes because one has hit a limit and the work has to continue. `claude auth login`
+ * handles the first switch and every switch after it, at the cost of a browser round trip each time, and it
+ * cannot switch BACK to an account whose credential the CLI has already overwritten.
+ *
+ * `ai_provider_usage` already answers "which of my accounts has room". This answers the question that
+ * immediately follows it: "then use that one".
+ *
+ * ── One key per account, not one key for the table ──
+ *
+ * `credentials` and `oauthAccount` are encrypted with `encryptSecret('anthropic-account:<uuid>', …)`, so the
+ * secret store mints a separate key per Anthropic account. One leaked key is one account rather than all of
+ * them, which is the same reasoning that split `VAULT_STORE_KEY` into purposes in the first place. The uuid
+ * comes from Anthropic (`oauthAccount.accountUuid`) so it is stable across a re-login, where the email is
+ * also stable but is user-editable at the provider.
+ *
+ * ── What is stored, and what that is worth to somebody who steals it ──
+ *
+ * The whole `claudeAiOauth` object, which includes a REFRESH token — deliberately, because the access token
+ * lives hours and the refresh token is what makes a switch work a week later. So a row plus the key is
+ * thirty days of acting as that account. That is a real escalation over holding one credential on disk, it
+ * was accepted knowingly, and two things reduce it: the per-account key above, and `refreshExpiresAt` being
+ * a column so a dead credential can be purged rather than sitting here for ever.
+ *
+ * ── Owner only, and per Officer user regardless ──
+ *
+ * Only the owner's `~/.claude` is switched today; a member's `claude` reads their own home and is untouched.
+ * The rows are keyed by Officer user anyway, because the same mechanism per home is the obvious extension
+ * and a table that assumed one user would have to be migrated to get there.
+ */
+export const anthropicAccounts = pgTable(
+  'anthropic_accounts',
+  {
+    id: serial('id').primaryKey(),
+    userId: integer('user_id')
+      .notNull()
+      .references(() => users.id, { onDelete: 'cascade' }),
+    /** Anthropic's own id for the account. The encryption purpose is derived from this. */
+    accountUuid: text('account_uuid').notNull(),
+    /** What the pill reads, and what `ai_provider_usage.email_account` joins on in practice. */
+    emailAccount: text('email_account').notNull(),
+    /** `Pertento`, or null on a personal account with no organisation. Display only. */
+    orgName: text('org_name'),
+    /** `Team`, `Max 20x`, `Pro`. Display only. */
+    plan: text('plan'),
+    /** `claudeAiOauth` from `.credentials.json`, encrypted. Never logged, never returned by an API. */
+    credentials: text('credentials').notNull(),
+    /** `oauthAccount` from `.claude.json`, encrypted. Identity rather than credential, but it travels with it. */
+    oauthAccount: text('oauth_account').notNull(),
+    /**
+     * When the refresh token dies. Past this, a switch cannot succeed and the UI must say so instead of
+     * failing at spawn time — which would look like the agent being broken rather than a sign-in expiring.
+     */
+    refreshExpiresAt: timestamp('refresh_expires_at', { withTimezone: true }),
+    /** When this credential was captured — how stale the thing you are switching to is. */
+    capturedAt: timestamp('captured_at', { withTimezone: true }).notNull().defaultNow(),
+    /** Last time it was switched TO. Orders the pills by what the owner actually uses. */
+    lastUsedAt: timestamp('last_used_at', { withTimezone: true }),
+  },
+  // uniqueIndex, never unique().on() — drizzle-kit mis-diffs named composite unique CONSTRAINTS and
+  // re-creates them on every push. See src/databases/CLAUDE.md → "Composite keys".
+  (table) => [uniqueIndex('uq_anthropic_accounts_account').on(table.userId, table.accountUuid)],
+);

src/databases/officer_db/src/index.ts

@@ -37,6 +37,8 @@ export * from './chat-session-models';
 export * from './chat-notification-prefs';
 export * from './nudges';
 export * from './ai-provider-usage';
+export * from './anthropic-accounts';
+export * from './theme-favorites';
 export * from './command-hq';
 export * from './dashboards';
 export * from './integrations';

src/databases/officer_db/src/schema.ts

@@ -34,6 +34,8 @@ export * from './chat-events/schema'; // chat_session_events
 export * from './chat-session-models/schema'; // chat_session_models
 export * from './chat-notification-prefs/schema'; // chat_notification_prefs
 export * from './ai-provider-usage/schema'; // ai_provider_usage — last usage reading per AI account
+export * from './anthropic-accounts/schema'; // anthropic_accounts — switchable OAuth credentials
+export * from './theme-favorites/schema'; // theme_favorites — starred themes, per account
 export * from './command-hq/schema'; // command_hq_categories, command_hq_sessions, command_hq_tags, command_hq_session_tags
 export * from './agent-panels/schema'; // agent_panels
 

src/databases/officer_db/src/theme-favorites/index.ts

@@ -0,0 +1,2 @@
+export * from './schema';
+export * from './queries';

src/databases/officer_db/src/theme-favorites/queries.ts

@@ -0,0 +1,28 @@
+import { and, eq } from 'drizzle-orm';
+import { db } from '../db';
+import { themeFavorites } from './schema';
+
+/** The theme ids this account has starred. Order is not meaningful — the caller owns the ordering. */
+export async function listThemeFavorites(userId: number): Promise<string[]> {
+  const rows = await db
+    .select({ themeId: themeFavorites.themeId })
+    .from(themeFavorites)
+    .where(eq(themeFavorites.userId, userId));
+  return rows.map((r) => r.themeId);
+}
+
+/**
+ * Star or unstar, returning the state it ended in.
+ *
+ * Idempotent in both directions on purpose: a double-tap, or two tabs racing, must not end with the star
+ * in a state neither of them asked for. `onConflictDoNothing` makes the insert safe to repeat, and the
+ * delete is naturally so.
+ */
+export async function setThemeFavorite(userId: number, themeId: string, favorite: boolean): Promise<boolean> {
+  if (favorite) {
+    await db.insert(themeFavorites).values({ userId, themeId }).onConflictDoNothing();
+    return true;
+  }
+  await db.delete(themeFavorites).where(and(eq(themeFavorites.userId, userId), eq(themeFavorites.themeId, themeId)));
+  return false;
+}

src/databases/officer_db/src/theme-favorites/schema.ts

@@ -0,0 +1,37 @@
+import { integer, pgTable, serial, text, timestamp, uniqueIndex } from 'drizzle-orm/pg-core';
+import { users } from '../auth/schema';
+
+/**
+ * Which themes an account has starred.
+ *
+ * ── Why a table, when a preference could be one JSON column ──
+ *
+ * Because it is per account and unbounded. `user_settings` would hold an array that grows with taste and
+ * has to be read-modify-written by whoever toggles a star, and two tabs doing that at once lose one of the
+ * stars. A row per favourite makes a toggle an INSERT or a DELETE, which cannot race with itself.
+ *
+ * ── Why the theme id is text with no foreign key ──
+ *
+ * Themes are not database rows. Most are compiled into the bundle; the rest are directories under
+ * `platform/themes/` discovered at request time, so a theme can appear or vanish without anything writing
+ * SQL. A foreign key would either be unenforceable or would make installing a theme a migration.
+ *
+ * The consequence is deliberate: a star can outlive its theme. That is why the reader intersects with the
+ * live registry rather than trusting the table — a favourite naming a theme nobody has installed is
+ * ignored, not shown as a broken entry, and it costs one row until the account unstars something.
+ */
+export const themeFavorites = pgTable(
+  'theme_favorites',
+  {
+    id: serial('id').primaryKey(),
+    userId: integer('user_id')
+      .notNull()
+      .references(() => users.id, { onDelete: 'cascade' }),
+    /** The theme's registry id — `duck-dark`, `catppuccin`. Not a foreign key; see above. */
+    themeId: text('theme_id').notNull(),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  // uniqueIndex, never unique().on() — drizzle-kit re-creates named composite constraints on every push.
+  // See src/databases/CLAUDE.md → "Composite keys".
+  (table) => [uniqueIndex('uq_theme_favorites_user_theme').on(table.userId, table.themeId)],
+);

src/server.tsx

@@ -162,16 +162,60 @@ const handlers: Record<string, any> = {
   sidecar: sidecarWebsocket,
 };
 
-// Both doors into the platform, checked against the permission registry before either opens.
-//
-// This throws rather than warns, and it throws HERE — before serve() — so a surface nobody has gated
-// cannot be reached even once. The HTTP half comes from hono.ts's own mount table and the socket half
-// from the map directly above, so neither list can be a stale copy of the thing it describes.
+/**
+ * Every websocket path Bun serves, and the provider each one upgrades to.
+ *
+ * ── Why this exists rather than a hand-written route table ──
+ *
+ * The boot check below used to be fed `Object.keys(handlers)` — the map of provider implementations — while
+ * Bun served a SEPARATE, hand-listed set of routes. Two lists describing one thing, and the comment beside
+ * the check said neither could be a stale copy of the other, which was simply not true: a socket route with
+ * no handler, or with no registry claim, was invisible to the very check that exists to refuse it.
+ *
+ * It had a live instance. `/api/cliamp/ws` and `/api/cliamp/audio/ws` stayed in the route table for two
+ * days after their handlers and registry entries were commented out — not exploitable, since
+ * `isWsProviderAllowed` finds no permission and 403s a member while the owner upgrades onto a dead socket,
+ * but exactly the drift the guard is for. Deleting cliamp on 2026-08-15 removed the symptom and left the
+ * shape.
+ *
+ * Now the routes are GENERATED from this, and this is what totality reads. A path added here without a
+ * handler or without a registry claim fails the boot rather than serving quietly.
+ */
+const WS_ROUTES: Record<string, UpgradableProvider> = {
+  '/api/tasks/run/ws': 'task-runner',
+  '/api/tasks/pipeline/ws': 'pipeline',
+  '/api/terminal/ws': 'terminal',
+  '/api/chat/ws': 'chat',
+  '/api/chat/notify/ws': 'chat-notify',
+};
+
+// Every provider named by a served route, plus the two that upgrade through their own handlers rather than
+// `upgradeWs`: `sidecar` (loopback process-to-process, its own route below) and `dev-proxy` (upgraded from
+// inside the proxy router). Named explicitly so their absence from WS_ROUTES cannot read as an oversight.
+const SERVED_WS_PROVIDERS = [...new Set([...Object.values(WS_ROUTES), 'sidecar', 'dev-proxy'])];
+
+/*
+  Both doors into the platform, checked against the permission registry before either opens.
+
+  This throws rather than warns, and it throws HERE — before serve() — so a surface nobody has gated cannot
+  be reached even once. The HTTP half comes from hono.ts's own mount table. The socket half now comes from
+  WS_ROUTES, which the route table is BUILT from, so the check reads what is actually served rather than a
+  parallel list that agrees with it by hand.
+
+  A provider with a handler and no route is fine and is not checked: unreachable is the safe direction. The
+  failure this catches is the other one — a route reachable with nothing claiming it.
+*/
 assertPermissionTotality({
   apiPrefixes: [...PROTECTED_API_PREFIXES, ...UNPROTECTED_API_PREFIXES],
-  wsProviders: Object.keys(handlers),
+  wsProviders: SERVED_WS_PROVIDERS,
 });
 
+// A route cannot name a provider that has no implementation. Cheap, and it turns a 500 on first connect
+// into a refusal to boot with the name in it.
+for (const [path, provider] of Object.entries(WS_ROUTES)) {
+  if (!handlers[provider]) throw new Error(`${path} upgrades to '${provider}', which has no handler`);
+}
+
 // Chat's phone channel. Subscribes to the same signal the browser bell uses and asks the same question;
 // it just answers it into APNs/FCM instead of a websocket. Registered here, and explicitly, because a
 // module whose only job is a side effect is one an import sweep quietly deletes.
@@ -312,11 +356,16 @@ console.log(
     : '[web] serving via the HTML import (dev) — HMR is live, and `build/` is not used',
 );
 
-async function upgradeWs(
-  req: Request,
-  server: any,
-  provider: 'terminal' | 'chat' | 'chat-notify' | 'task-runner' | 'pipeline',
-) {
+/**
+ * A provider reachable by upgrading a URL.
+ *
+ * Named rather than inline so `WS_ROUTES` is checked against it: a route naming a provider this function
+ * cannot serve is now a typecheck failure instead of a runtime one. `sidecar` and `dev-proxy` are
+ * deliberately absent — they upgrade through their own handlers, not through here.
+ */
+type UpgradableProvider = 'terminal' | 'chat' | 'chat-notify' | 'task-runner' | 'pipeline';
+
+async function upgradeWs(req: Request, server: any, provider: UpgradableProvider) {
   const token = new URL(req.url).searchParams.get('token');
   if (!token) return new Response('Unauthorized', { status: 401 });
 
@@ -441,11 +490,13 @@ const server = serve({
       });
       if (!ok) return new Response('Upgrade failed', { status: 500 });
     },
-    '/api/tasks/run/ws': (req, server) => upgradeWs(req, server, 'task-runner'),
-    '/api/tasks/pipeline/ws': (req, server) => upgradeWs(req, server, 'pipeline'),
-    '/api/terminal/ws': (req, server) => upgradeWs(req, server, 'terminal'),
-    '/api/chat/ws': (req, server) => upgradeWs(req, server, 'chat'),
-    '/api/chat/notify/ws': (req, server) => upgradeWs(req, server, 'chat-notify'),
+    // Generated from WS_ROUTES, so this table and the boot check cannot describe different sets.
+    ...Object.fromEntries(
+      Object.entries(WS_ROUTES).map(([path, provider]) => [
+        path,
+        (req: Request, server: any) => upgradeWs(req, server, provider),
+      ]),
+    ),
     // CalDAV/CardDAV. These live OUTSIDE /api because DAV clients are given a bare domain and probe
     // fixed, spec-defined paths — `/.well-known/caldav` unauthenticated, before they hold any
     // credential at all. They need naming explicitly here or the `/*` SPA fallback below swallows them

src/servers/api/auth/claude-login.ts

@@ -0,0 +1,384 @@
+import type { ChildProcessWithoutNullStreams } from 'node:child_process';
+import { spawn } from 'node:child_process';
+import { readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import {
+  listAnthropicAccounts,
+  markAnthropicAccountUsed,
+  purgeExpiredAnthropicAccounts,
+  revealAnthropicAccount,
+  saveAnthropicAccount,
+} from 'officerdb';
+import { createRouter } from '../../create-router';
+import { getHomeDir, getOwnerHomeDir } from '../../data-path';
+import { claudeBinIn } from '../../os-user-claude';
+import { runAsArgv } from '../../os-user';
+
+/*
+  `/login` in the chat composer, doing what it does in a terminal.
+
+  Officer's members and its owner both authenticate `claude` with a Claude SUBSCRIPTION over OAuth, not with
+  an Anthropic API key — see `sidecar/claude/state.ts`. That flow is a browser round trip: the CLI prints a
+  URL, you authorise in claude.com, and you paste a code back. It is the one part of running an agent that
+  a browser-only user could not do from the browser: they had to open a terminal panel and drive the CLI by
+  hand, which works and is exactly the thing this removes.
+
+  It needs no pty. `claude auth login` behaves identically through plain pipes — verified 2026-08-21 by
+  capturing its raw bytes — so this is an ordinary subprocess with two reads and one write:
+
+      spawn ─► read stdout until the URL ─► [person authorises] ─► write the code to stdin ─► exit
+
+  The one non-obvious piece is the parsing. The CLI wraps the URL in an OSC-8 hyperlink escape AND prints it
+  again as visible text, so a naive `https://\S+` match returns two URLs concatenated with no separator.
+  Stripping the escape wrappers first leaves exactly one.
+*/
+
+/** OSC-8 hyperlink: `ESC ] 8 ; ; <uri> BEL` … `ESC ] 8 ; ; BEL`. Both halves go. */
+const OSC8 = /\x1b\]8;;[^\x07\x1b]*(?:\x07|\x1b\\)/g;
+const SGR = /\x1b\[[0-9;]*m/g;
+
+const visibleText = (raw: string): string => raw.replace(OSC8, '').replace(SGR, '');
+
+/** The URL the person has to open, or null while the CLI has not printed it yet. */
+export function extractLoginUrl(raw: string): string | null {
+  const m = visibleText(raw).match(/https:\/\/\S+/);
+  return m ? m[0] : null;
+}
+
+/** The CLI is waiting on stdin. Distinct from "printed a URL" — it prints the URL first. */
+export const awaitingCode = (raw: string): boolean => /Paste code here/i.test(visibleText(raw));
+
+type Pending = {
+  userId: number;
+  child: ChildProcessWithoutNullStreams;
+  url: string;
+  out: string;
+  reaper: ReturnType<typeof setTimeout>;
+};
+
+/*
+  In memory, and deliberately not in Postgres.
+
+  A pending login is worth nothing after the process holding its PKCE verifier dies, so persisting it would
+  store a row that can only ever be stale. A restart losing them is correct: the code in the person's
+  clipboard is already useless, and the honest recovery is to type `/login` again.
+*/
+const pending = new Map<string, Pending>();
+
+/*
+  The authorisation code expires and so does the person's patience. Ten minutes is long enough to find a
+  password manager and short enough that a forgotten tab does not leave a `claude` process parked on a
+  read of stdin for the rest of the week.
+*/
+const TTL_MS = 10 * 60 * 1000;
+
+function abandon(id: string): void {
+  const p = pending.get(id);
+  if (!p) return;
+  clearTimeout(p.reaper);
+  pending.delete(id);
+  try {
+    p.child.kill('SIGTERM');
+  } catch {
+    // Already gone. Nothing to do and nothing worth logging.
+  }
+}
+
+type Who = { id: number; isOwner: boolean; osUser: string | null; email: string };
+
+/**
+ * The login process for one account.
+ *
+ * The owner runs it as themselves, in their real home, so it refreshes the very credentials
+ * `officer-anthropic-proxy` reads. A member runs through `runAsArgv` — `setpriv --reset-env` — as their own
+ * Linux user, writing into their own home, which is the whole point: their turns bill their subscription
+ * rather than the owner's, and that only holds if the credential is theirs.
+ *
+ * Nothing Anthropic-shaped is inherited in either case. For the owner those variables point at the local
+ * proxy, and the proxy exists to swap a shared secret for the owner's bearer token — handing them to a
+ * login is how you get a "success" that authenticates nothing.
+ */
+function spawnLogin(who: Who): ChildProcessWithoutNullStreams {
+  const stripped = { ...process.env };
+  for (const name of [
+    'ANTHROPIC_API_KEY',
+    'ANTHROPIC_AUTH_TOKEN',
+    'ANTHROPIC_BASE_URL',
+    'ANTHROPIC_FOUNDRY_API_KEY',
+    '_CLAUDE_CODE_ASSUME_FIRST_PARTY_BASE_URL',
+    'CLAUDE_CODE_OAUTH_TOKEN',
+  ])
+    delete stripped[name];
+
+  if (who.isOwner) {
+    return spawn('claude', ['auth', 'login', '--claudeai'], {
+      env: stripped,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    }) as ChildProcessWithoutNullStreams;
+  }
+
+  if (!who.osUser) throw new Error('no Linux account: an agent for this member cannot hold its own credentials');
+
+  const home = getHomeDir(who.email);
+  // `env` inside the argv, because `--reset-env` discards anything handed to `setpriv` itself. Only PATH,
+  // and only so `claude` can find `node`; nothing here carries a credential.
+  const [launcher, ...args] = runAsArgv(who.osUser, [claudeBinIn(home), 'auth', 'login', '--claudeai']);
+  if (!launcher) throw new Error('runAsArgv returned an empty argv');
+  return spawn(launcher, args, { cwd: home, stdio: ['pipe', 'pipe', 'pipe'] }) as ChildProcessWithoutNullStreams;
+}
+
+/** Reads until the URL appears, or the process dies, or we run out of patience waiting for it. */
+function urlFrom(child: ChildProcessWithoutNullStreams): Promise<{ url: string; out: string }> {
+  return new Promise((resolve, reject) => {
+    let out = '';
+    // Separate from TTL_MS: this is the CLI failing to start, which shows up as silence rather than an error.
+    const giveUp = setTimeout(
+      () => reject(new Error(`no login URL after 25s. Output so far: ${visibleText(out)}`)),
+      25_000,
+    );
+    const settle = (fn: () => void) => {
+      clearTimeout(giveUp);
+      fn();
+    };
+    const onChunk = (b: Buffer) => {
+      out += b.toString();
+      const url = extractLoginUrl(out);
+      if (url) settle(() => resolve({ url, out }));
+    };
+    child.stdout.on('data', onChunk);
+    // The CLI prints the URL to stdout, but its warnings go to stderr and one of them explains a failure.
+    child.stderr.on('data', (b: Buffer) => {
+      out += b.toString();
+    });
+    child.on('error', (err) => settle(() => reject(err)));
+    child.on('exit', (code) =>
+      settle(() => reject(new Error(`claude auth login exited ${code} before printing a URL: ${visibleText(out)}`))),
+    );
+  });
+}
+
+export const claudeLoginRouter = createRouter();
+
+// POST /auth/claude-login — start one, and hand back the URL to open.
+claudeLoginRouter.post('/', async (ctx) => {
+  const user = ctx.get('user');
+  const who: Who = { id: user.id, isOwner: user.id === 1, osUser: user.osUser ?? null, email: user.email };
+
+  // One at a time per account. A second `/login` while one is open is a person retrying, not a person
+  // wanting two, and two processes racing to write one credentials file is a corrupt file.
+  for (const [id, p] of pending) if (p.userId === who.id) abandon(id);
+
+  let child: ChildProcessWithoutNullStreams;
+  try {
+    child = spawnLogin(who);
+  } catch (err) {
+    return ctx.json({ error: err instanceof Error ? err.message : 'could not start the login' }, 400);
+  }
+
+  try {
+    const { url, out } = await urlFrom(child);
+    const id = crypto.randomUUID();
+    pending.set(id, { userId: who.id, child, url, out, reaper: setTimeout(() => abandon(id), TTL_MS) });
+    // Keep reading, or the pipe fills and the child blocks — and we want its later output for the result.
+    child.stdout.on('data', (b: Buffer) => {
+      const p = pending.get(id);
+      if (p) p.out += b.toString();
+    });
+    return ctx.json({ id, url, expiresInMs: TTL_MS });
+  } catch (err) {
+    try {
+      child.kill('SIGTERM');
+    } catch {
+      // Nothing to clean up.
+    }
+    return ctx.json({ error: err instanceof Error ? err.message : 'the login did not start' }, 502);
+  }
+});
+
+// POST /auth/claude-login/:id/code — hand over what claude.com gave them.
+claudeLoginRouter.post('/:id/code', async (ctx) => {
+  const user = ctx.get('user');
+  const id = ctx.req.param('id');
+  const p = pending.get(id);
+  // Same answer for "expired", "never existed" and "somebody else's": all three are equally not-yours.
+  if (!p || p.userId !== user.id) return ctx.json({ error: 'that login is no longer open — run /login again' }, 404);
+
+  const body = await ctx.req.json().catch(() => ({}) as Record<string, unknown>);
+  const code = typeof body.code === 'string' ? body.code.trim() : '';
+  if (!code) return ctx.json({ error: 'no code' }, 400);
+
+  const finished = new Promise<number | null>((resolve) => p.child.once('exit', (c) => resolve(c)));
+  p.child.stdin.write(`${code}\n`);
+
+  // The exchange is a network round trip on the CLI's side.
+  const exit = await Promise.race([finished, new Promise<'timeout'>((r) => setTimeout(() => r('timeout'), 45_000))]);
+  const tail = visibleText(p.out).slice(-600);
+  abandon(id);
+
+  if (exit === 'timeout') return ctx.json({ ok: false, error: 'the CLI did not finish in 45s', detail: tail }, 504);
+  if (exit !== 0) return ctx.json({ ok: false, error: `claude auth login exited ${exit}`, detail: tail }, 400);
+
+  // Record what was just signed into, so it can be switched BACK to later without another round trip. Only
+  // for the owner: a member's credential is in their own home and this module only ever reads the owner's.
+  if (user.id === 1) await captureCurrentAnthropicAccount(user.id);
+  const now = user.id === 1 ? await readCurrentAccount() : null;
+
+  // The account is the answer the person opened this for. Two accounts on one machine means "signed in" on
+  // its own is not enough to act on.
+  return ctx.json({ ok: true, detail: tail, email: now?.emailAccount ?? null, orgName: now?.orgName ?? null });
+});
+
+// DELETE /auth/claude-login/:id — they closed the dialog.
+claudeLoginRouter.delete('/:id', (ctx) => {
+  const user = ctx.get('user');
+  const id = ctx.req.param('id');
+  const p = pending.get(id);
+  if (p && p.userId === user.id) abandon(id);
+  return ctx.json({ ok: true });
+});
+
+/* ────────────────────────────────────────────────────────────────────────────
+   Switching between accounts that have already been signed into.
+
+   The owner keeps a personal account and a company one and moves between them during a day. `/login` above
+   handles arriving at an account; this handles going back to one, without a browser round trip, using the
+   credential kept from last time.
+
+   Owner only, and structurally: `getOwnerHomeDir` ignores the email it is passed, so every path below is
+   the owner's whatever the caller claims. A member's `claude` reads their own home and is untouched by any
+   of this — the isolation is the same as it was, and this feature does not widen it.
+   ──────────────────────────────────────────────────────────────────────────── */
+
+/** `.credentials.json` holds one key. `.claude.json` holds a whole config and must be PATCHED, not written. */
+const credentialsPath = () => join(getOwnerHomeDir(''), '.claude', '.credentials.json');
+const configPath = () => join(getOwnerHomeDir(''), '.claude.json');
+
+async function readJson(path: string): Promise<Record<string, unknown> | null> {
+  try {
+    return JSON.parse(await readFile(path, 'utf-8')) as Record<string, unknown>;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * What the CLI is signed in as right now, read from its own two files.
+ *
+ * Both are needed and neither is sufficient: the credential lives in `.claude/.credentials.json` and the
+ * identity — email, org, account uuid — lives in `.claude.json` beside it.
+ */
+async function readCurrentAccount(): Promise<{
+  accountUuid: string;
+  emailAccount: string;
+  orgName: string | null;
+  plan: string | null;
+  credentialsJson: string;
+  oauthAccountJson: string;
+  refreshExpiresAt: Date | null;
+} | null> {
+  const creds = await readJson(credentialsPath());
+  const config = await readJson(configPath());
+  const oauth = creds?.claudeAiOauth as Record<string, unknown> | undefined;
+  const account = config?.oauthAccount as Record<string, unknown> | undefined;
+  if (!oauth || !account) return null;
+
+  const accountUuid = typeof account.accountUuid === 'string' ? account.accountUuid : '';
+  const emailAccount = typeof account.emailAddress === 'string' ? account.emailAddress : '';
+  if (!accountUuid || !emailAccount) return null;
+
+  const sub = typeof oauth.subscriptionType === 'string' ? oauth.subscriptionType : '';
+  const refreshMs = typeof oauth.refreshTokenExpiresAt === 'number' ? oauth.refreshTokenExpiresAt : null;
+  return {
+    accountUuid,
+    emailAccount,
+    orgName: typeof account.organizationName === 'string' ? account.organizationName : null,
+    plan: sub ? sub[0]!.toUpperCase() + sub.slice(1) : null,
+    credentialsJson: JSON.stringify(oauth),
+    oauthAccountJson: JSON.stringify(account),
+    refreshExpiresAt: refreshMs ? new Date(refreshMs) : null,
+  };
+}
+
+/**
+ * Keep whatever the CLI is currently signed in as.
+ *
+ * Called after a `/login` here AND whenever the account list is read, which is what makes an account signed
+ * into from a TERMINAL switchable too. Without that second call this would only know about logins that
+ * happened to go through this dialog — a switcher that silently omits half your accounts.
+ *
+ * Never throws into a caller: failing to record a credential must not fail the request that noticed it.
+ */
+export async function captureCurrentAnthropicAccount(userId: number): Promise<void> {
+  try {
+    const now = await readCurrentAccount();
+    if (!now) return;
+    await saveAnthropicAccount({ userId, ...now });
+  } catch (err) {
+    console.warn('[claude-auth] could not record the current account:', err instanceof Error ? err.message : err);
+  }
+}
+
+// GET /claude-auth/accounts — who can be switched to, and who is current. No secrets.
+claudeLoginRouter.get('/accounts', async (ctx) => {
+  const user = ctx.get('user');
+  if (user.id !== 1) return ctx.json({ error: 'Anthropic accounts belong to the owner of this machine' }, 403);
+
+  // Record before listing, so an account signed into elsewhere appears the first time the panel is opened
+  // rather than only after the next login through this dialog.
+  await captureCurrentAnthropicAccount(user.id);
+  await purgeExpiredAnthropicAccounts(user.id).catch(() => 0);
+
+  const current = await readCurrentAccount();
+  const accounts = (await listAnthropicAccounts(user.id)).map((a) => ({
+    ...a,
+    current: a.accountUuid === current?.accountUuid,
+  }));
+  return ctx.json({ accounts });
+});
+
+// POST /claude-auth/switch — become one of them.
+claudeLoginRouter.post('/switch', async (ctx) => {
+  const user = ctx.get('user');
+  if (user.id !== 1) return ctx.json({ error: 'Anthropic accounts belong to the owner of this machine' }, 403);
+
+  const body = await ctx.req.json().catch(() => ({}) as Record<string, unknown>);
+  const accountUuid = typeof body.accountUuid === 'string' ? body.accountUuid : '';
+  if (!accountUuid) return ctx.json({ error: 'no account' }, 400);
+
+  // Keep the outgoing credential before overwriting it, or switching away from an account signed into
+  // outside this UI loses it — the one-way trip this feature exists to remove.
+  await captureCurrentAnthropicAccount(user.id);
+
+  const target = await revealAnthropicAccount(user.id, accountUuid);
+  if (!target) return ctx.json({ error: 'that sign-in has expired — run /login for it again' }, 409);
+
+  try {
+    // `.credentials.json` is replaced wholesale: it holds this one key and nothing else of ours.
+    // `.claude.json` is PATCHED — it is the CLI's whole config, and overwriting it would take out every
+    // project entry, tip counter and preference in it.
+    const existingCreds = (await readJson(credentialsPath())) ?? {};
+    await writeFile(
+      credentialsPath(),
+      JSON.stringify({ ...existingCreds, claudeAiOauth: JSON.parse(target.credentialsJson) }),
+      {
+        mode: 0o600,
+      },
+    );
+
+    const config = (await readJson(configPath())) ?? {};
+    await writeFile(
+      configPath(),
+      JSON.stringify({ ...config, oauthAccount: JSON.parse(target.oauthAccountJson) }, null, 2),
+      {
+        mode: 0o600,
+      },
+    );
+  } catch (err) {
+    return ctx.json({ error: `could not write the credential: ${err instanceof Error ? err.message : err}` }, 500);
+  }
+
+  await markAnthropicAccountUsed(user.id, accountUuid);
+  // A turn already running keeps the credential it was spawned with. Said here rather than guessed at in
+  // the UI, because "it did not take effect" and "it takes effect next turn" look identical from outside.
+  return ctx.json({ ok: true, email: target.emailAccount, appliesTo: 'the next turn, and every new claude' });
+});

src/servers/api/chat/chat.ts

@@ -27,6 +27,7 @@ import {
   stopBackgroundTask,
   claudeSessionContext,
   liveSessionTitle,
+  isCommandersDir,
 } from './claude-sessions';
 import {
   listOpenCodeSessions,
@@ -256,6 +257,16 @@ chatRouter.get('/sessions/:id', async (ctx) => {
     offset: windowed ? start : 0,
     title: context?.title ?? null,
     partCount: context?.partCount ?? 1,
+    /*
+      Whether this conversation is a commander, derived from ITS OWN cwd rather than from the screen asking.
+
+      The composer offers "exit and hand back, then re-arm" — the only fire behaviour a watcher wants — and
+      decided whether to by looking at the route it was rendered on. So the same commander, opened from
+      /chat instead of Command HQ, silently lost the control that is the whole point of it. A commander is a
+      commander wherever it is rendered, and `detail.cwd` is the transcript's own directory, so this answer
+      travels with the conversation.
+    */
+    isCommander: isCommandersDir(who.email, detail.cwd),
   });
 });
 
@@ -287,7 +298,21 @@ chatRouter.get('/live', async (ctx) => {
     // genuinely not been written yet.
     const transcriptId = session.claudeSessionId;
     const resolved = transcriptId && !isOpenCodeSessionId(transcriptId) ? liveSessionTitle(who, transcriptId) : null;
-    return { ...session, harness: 'claude' as const, title: resolved?.title ?? null, cwd: resolved?.cwd ?? null };
+    const cwd = resolved?.cwd ?? null;
+    return {
+      ...session,
+      harness: 'claude' as const,
+      title: resolved?.title ?? null,
+      cwd,
+      // Derived from the cwd rather than looked up in `command_hq_sessions`, for the same reason the
+      // history listing does it: every commander shares one directory, so the directory IS the answer and
+      // it needs no query. It also stays right for a commander mid-first-turn, before any row exists.
+      //
+      // This field is why the route changed at all. The iPhone app swipes between LIVE chats and has no
+      // room for tabs, so it can only exclude commanders if the payload says which ones they are — and a
+      // deploy commander turning up in that swipe order is exactly what it must not do.
+      isCommander: cwd ? isCommandersDir(who.email, cwd) : false,
+    };
   });
 
   // OpenCode rows carry less, and the shape says so rather than faking parity. `isGenerating` is always
@@ -326,6 +351,9 @@ chatRouter.get('/live', async (ctx) => {
       // shown a live row without a name.
       title: meta?.title && meta.title !== '(untitled)' ? meta.title : (getOpenCodePrompt(sessionKey) ?? null),
       cwd: meta?.cwd || null,
+      // Always false rather than absent: a commander is started through Command HQ, which runs claude.
+      // Stating it keeps the two row shapes answerable by one client filter.
+      isCommander: false,
     };
   });
 

src/servers/api/chat/claude-sessions.ts

@@ -1,5 +1,5 @@
-import { dirname, join } from 'node:path';
-import { DATA_PATH } from '../../data-path';
+import { dirname, join, resolve } from 'node:path';
+import { DATA_PATH, getCommandersDir } from '../../data-path';
 import {
   appendTextAs,
   findPathAs,
@@ -108,6 +108,24 @@ export type ClaudeSessionSummary = {
    * one conversation — see `mergeChains`. Absent means the ordinary case: one row, one transcript.
    */
   partCount?: number;
+  /**
+   * This is a Command HQ commander, not an ordinary chat.
+   *
+   * ── Why it is a field and not a frontend detail ──
+   *
+   * A commander IS a Claude session, and this list reads transcripts from disk, so nothing distinguished
+   * the two and commanders appeared in the chat list looking like conversations somebody started and
+   * forgot. The web can now split them into tabs — but the reason this belongs in the PAYLOAD is the
+   * phone: the iPhone chat app swipes left and right between live chats, and with no tabs to hide behind
+   * it has to be able to filter commanders out of that gesture itself. A flag only the web knew about
+   * would fix one surface and leave the other wrong.
+   *
+   * Derived from the CWD rather than from a database join. Every commander a user has shares one
+   * directory — `getCommandersDir(email)`, never per-commander and never client-chosen — and this list
+   * already reads each session's `cwd`. So it costs a string comparison, works for a commander whose
+   * `command_hq_sessions` row was lost, and adds no query.
+   */
+  isCommander?: boolean;
 };
 
 /** `ClaudeSessionSummary` plus the bits only lineage resolution needs. Never leaves this module. */
@@ -968,11 +986,31 @@ function scanGroup(who: ChatIdentity, cwd: string): TranscriptSummary[] {
 
 /** Conversations Claude has stored for a working directory, newest first, one row per `/clear` chain. */
 export function listClaudeSessions(who: ChatIdentity, cwd: string): ClaudeSessionSummary[] {
+  // Every commander a user has lives in ONE directory, so this is a property of the group rather than of
+  // each transcript — computed once here instead of per row. See `isCommander` on the summary type for
+  // why the flag has to reach the payload at all.
+  const commander = isCommandersDir(who.email, cwd);
   return mergeChains(scanGroup(who, cwd))
     .map(publish)
+    .map((entry) => (commander ? { ...entry, isCommander: true } : entry))
     .sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
 }
 
+/**
+ * Is this directory the one every commander shares?
+ *
+ * Compared after `resolve`, so a trailing slash or a `..` cannot make the same directory look like a
+ * different one — the cwd here comes from a transcript rather than from code, and transcripts record
+ * whatever the process was actually in.
+ */
+export function isCommandersDir(email: string, cwd: string): boolean {
+  try {
+    return resolve(cwd) === resolve(getCommandersDir(email));
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Every conversation in every directory, newest first.
  *

src/servers/api/chat/is-commanders-dir.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, it } from 'bun:test';
+import { resolve } from 'node:path';
+import { isCommandersDir } from './claude-sessions';
+import { getCommandersDir } from '../../data-path';
+
+const EMAIL = 'pastilhas@officer.dev';
+
+// The live payload's `isCommander` is derived from a cwd read out of a transcript, so it is whatever the
+// process was actually in — not a path this code composed. These are the shapes that arrive.
+describe('isCommandersDir', () => {
+  const dir = getCommandersDir(EMAIL);
+
+  it('recognises the commanders directory', () => {
+    expect(isCommandersDir(EMAIL, dir)).toBe(true);
+  });
+
+  it('survives a trailing slash and a .. hop', () => {
+    expect(isCommandersDir(EMAIL, `${dir}/`)).toBe(true);
+    expect(isCommandersDir(EMAIL, `${dir}/sub/..`)).toBe(true);
+  });
+
+  it('rejects a sibling and a child', () => {
+    expect(isCommandersDir(EMAIL, resolve(dir, '..'))).toBe(false);
+    expect(isCommandersDir(EMAIL, resolve(dir, 'nested'))).toBe(false);
+  });
+
+  // A commander's cwd belongs to the account that owns it. Reading one user's directory as another's
+  // would file their commanders under the wrong person and, in the iPhone swipe order, show them.
+  it('is per account', () => {
+    expect(isCommandersDir('someone-else@officer.dev', dir)).toBe(false);
+  });
+
+  it('never throws on rubbish', () => {
+    expect(isCommandersDir(EMAIL, '')).toBe(false);
+    expect(isCommandersDir(EMAIL, '\0')).toBe(false);
+  });
+});

src/servers/api/themes/favorites.ts

@@ -0,0 +1,44 @@
+import type { Context } from 'hono';
+import { listThemeFavorites, setThemeFavorite } from 'officerdb';
+import { createRouter } from '../../create-router';
+
+/*
+  Starred themes, per account.
+
+  ── Why this is not on `/themes` ──
+
+  Because that prefix is deliberately UNAUTHENTICATED: the sign-in screen renders in the chosen theme, so
+  the list and the stylesheets have to be readable before anyone has an account. A per-account preference on
+  an anonymous prefix has no caller to attribute it to — the first version of this lived there and answered
+  500 to an anonymous GET, which was the honest consequence arriving early.
+
+  ── Why the `account` permission ──
+
+  It is `core`, so every account holds it and it cannot be denied, and it already owns `/user`, `/dock` and
+  `/api-keys` — preferences and credentials belonging to the caller themselves. A theme favourite is the
+  same shape as a dock preference: it grants nothing, it is about this account's own eyes, and denying it
+  would only mean an account that can choose a theme cannot remember which ones it liked.
+
+  Every route here reads `user.id` from the token. None of them names an account, so there is nothing to get
+  wrong about whose stars these are.
+*/
+export const themeFavoritesRouter = createRouter();
+
+// GET /theme-favorites — this account's starred theme ids.
+themeFavoritesRouter.get('/', async (ctx: Context) => {
+  const user = ctx.get('user');
+  return ctx.json({ favorites: await listThemeFavorites(user.id) });
+});
+
+// PUT /theme-favorites/:id — star or unstar one.
+//
+// PUT rather than POST because it SETS a state rather than appending: sending `{favorite:true}` twice ends
+// where sending it once does, which is what a double-tap and two racing tabs both need. The store is
+// idempotent in both directions for the same reason.
+themeFavoritesRouter.put('/:id', async (ctx: Context) => {
+  const user = ctx.get('user');
+  const themeId = ctx.req.param('id');
+  const body = await ctx.req.json().catch(() => ({}) as Record<string, unknown>);
+  const favorite = body.favorite !== false;
+  return ctx.json({ themeId, favorite: await setThemeFavorite(user.id, themeId, favorite) });
+});

src/servers/api/themes/themes.ts

@@ -5,6 +5,12 @@ import { discoverThemes, readThemeCss } from '../../themes/discover';
 /**
  * Installed themes — the ones in `platform/themes/`, not the ones the platform ships.
  *
+ * **This prefix is UNAUTHENTICATED** (`UNPROTECTED_API_PREFIXES` in hono.ts) and must stay that way: the
+ * sign-in screen paints in the chosen theme, before any account exists to ask. So nothing per-account can
+ * live here — theme FAVOURITES are on `/theme-favorites`, behind the `account` permission, for exactly that
+ * reason. Adding them here returned 500 on an anonymous request, which was the polite version of the
+ * problem.
+ *
  * The shipped themes are compiled into the bundle and need no server. These are read off disk at request
  * time, so dropping a directory in makes a theme appear on the next page load. No install step, no
  * rebuild, no restart — a theme is CSS custom properties, and none of that needs compiling.

src/servers/hono.ts

@@ -6,6 +6,7 @@ import { authRouter } from './api/auth';
 import { serverSettingsRouter } from './api/server-settings/server-settings';
 import { landingPageDataRouter } from './api/landing-page-data/landing-page-data';
 import { themesRouter } from './api/themes/themes';
+import { themeFavoritesRouter } from './api/themes/favorites';
 import { waitlistRouter } from './api/waitlist/waitlist';
 import { usersRouter } from './api/users/users-router';
 import { apiKeysRouter } from './api/api-keys/router';
@@ -41,6 +42,7 @@ import { queueRouter } from './api/queue/queue';
 // registry's claim on '/browser' in the same commit, or assertPermissionTotality refuses to boot.
 import { bugReportRouter } from './api/bug-report/bug-report';
 import { agentStatusRouter } from './api/agent-status/router';
+import { claudeLoginRouter } from './api/auth/claude-login';
 import { chatRouter } from './api/chat/chat';
 import { commandHqRouter } from './api/command-hq/router';
 import { pipelineJobsRouter } from './api/tasks/pipeline-jobs-routes';
@@ -121,6 +123,8 @@ const isDavPath = (path: string) =>
 // disambiguate. `/pipeline-jobs` and `/jobs` deliberately share one router.
 const PROTECTED_MOUNTS: [prefix: string, router: ReturnType<typeof createRouter>][] = [
   ['/server-settings', serverSettingsRouter],
+  // Protected, unlike `/themes` beside it — see api/themes/favorites.ts for why they are separate mounts.
+  ['/theme-favorites', themeFavoritesRouter],
   ['/users', usersRouter],
   ['/skills', skillsRouter],
   ['/tasks', tasksRouter],
@@ -149,6 +153,7 @@ const PROTECTED_MOUNTS: [prefix: string, router: ReturnType<typeof createRouter>
   ['/queue', queueRouter],
   ['/bug-report', bugReportRouter],
   ['/agent-status', agentStatusRouter],
+  ['/claude-auth', claudeLoginRouter],
   ['/chat', chatRouter],
   ['/command-hq', commandHqRouter],
   ['/pipeline-jobs', pipelineJobsRouter],

src/servers/permissions/authorize.test.ts

@@ -0,0 +1,216 @@
+import { describe, expect, test } from 'bun:test';
+import type { UserRole } from 'officerdb';
+import type { EffectivePermissions } from './authorize';
+import { decideApiRequest, decideWsProvider, resolveEffectivePermissions } from './authorize';
+import type { PermissionLevel } from './registry';
+import { CORE_PERMISSIONS } from './registry';
+
+/*
+  The resolver, which its own header calls the file standing between a Member and a shell — and which had no
+  automated tests at all until 2026-08-22.
+
+  It had none because every path needed two database calls. The decisions are now split from the fetching
+  (`resolveEffectivePermissions`, `decideApiRequest`, `decideWsProvider` are pure), so this file needs no
+  mock, no database and no `officerdb` stub — which matters beyond convenience: the one file in this
+  repository that mocks `officerdb` leaks its stub into whatever runs after it.
+
+  REAL registry keys throughout, deliberately. A suite built on invented permissions would keep passing
+  after a rename, which is the failure mode a test of an authorization table can least afford. If a key here
+  disappears, this file should go red.
+*/
+
+const member = (osUser: string | null = 'm1'): { role: UserRole; osUser: string | null } => ({
+  role: 'Member',
+  osUser,
+});
+const grants = (...pairs: Array<[string, PermissionLevel]>) => new Map<string, PermissionLevel>(pairs);
+const resolve = (user: { role: UserRole; osUser: string | null }, g = grants()) => resolveEffectivePermissions(user, g);
+
+/** No account at all — an unauthenticated or deleted caller, as the async wrapper reports it. */
+const NOBODY: EffectivePermissions = { isOwner: false, grants: new Map() };
+
+describe('resolving what an account holds', () => {
+  test('the owner bypasses, and carries no grants to consult', () => {
+    const owner = resolve({ role: 'Super Admin', osUser: null });
+    expect(owner.isOwner).toBe(true);
+    // Empty on purpose: an owner's grants are never read, and filling them would invite somebody to.
+    expect(owner.grants.size).toBe(0);
+  });
+
+  test('a member gets every core permission at write, granted nothing', () => {
+    const held = resolve(member()).grants;
+    for (const permission of CORE_PERMISSIONS) expect(held.get(permission.key)).toBe('write');
+  });
+
+  test('core is write even though nothing granted it', () => {
+    // A read-only "change your own password" is not a coherent thing to offer, which is why core is not
+    // levelled. Pinned because a future levels-everywhere refactor would silently break it.
+    expect(resolve(member()).grants.get('account')).toBe('write');
+  });
+
+  test('an app grant is honoured at the level given', () => {
+    expect(resolve(member(), grants(['calendar', 'read'])).grants.get('calendar')).toBe('read');
+    expect(resolve(member(), grants(['calendar', 'write'])).grants.get('calendar')).toBe('write');
+  });
+
+  // The rule that only exists because getOwnerHomeDir ignores its argument: a confined grant with no Linux
+  // user to confine to would resolve to the OWNER's home.
+  test('a confined grant needs a Linux account', () => {
+    expect(resolve(member('m1'), grants(['files', 'write'])).grants.get('files')).toBe('write');
+    expect(resolve(member(null), grants(['files', 'write'])).grants.has('files')).toBe(false);
+  });
+
+  test('every confined permission is dropped together, not one by one', () => {
+    const held = resolve(member(null), grants(['files', 'write'], ['terminal', 'write'], ['chat', 'write']));
+    for (const key of ['files', 'terminal', 'chat']) expect(held.grants.has(key)).toBe(false);
+  });
+
+  // The database has no CHECK stopping these rows; the API refuses to write one. This is the layer that
+  // has to hold if one ever exists.
+  test('an execution grant in the table is ignored', () => {
+    expect(resolve(member(), grants(['tasks', 'write'])).grants.has('tasks')).toBe(false);
+  });
+
+  test('an admin grant in the table is ignored', () => {
+    expect(resolve(member(), grants(['user-admin', 'write'])).grants.has('user-admin')).toBe(false);
+    expect(resolve(member(), grants(['server-admin', 'write'])).grants.has('server-admin')).toBe(false);
+  });
+
+  test('a grant naming a permission that no longer exists is ignored', () => {
+    const held = resolve(member(), grants(['cliamp', 'write'], ['a-plugin-uninstalled-last-year', 'read']));
+    expect(held.grants.has('cliamp')).toBe(false);
+    expect(held.grants.has('a-plugin-uninstalled-last-year')).toBe(false);
+    // …and does not disturb what is legitimately held.
+    expect(held.grants.get('account')).toBe('write');
+  });
+});
+
+describe('deciding an HTTP request', () => {
+  const owner: EffectivePermissions = { isOwner: true, grants: new Map() };
+
+  test('the owner is allowed anything, including paths nothing serves', () => {
+    expect(decideApiRequest(owner, 'DELETE', '/api/users/9').allowed).toBe(true);
+    expect(decideApiRequest(owner, 'GET', '/api/nothing-serves-this').allowed).toBe(true);
+  });
+
+  test('a path no permission covers is refused, not allowed by default', () => {
+    const d = decideApiRequest(NOBODY, 'GET', '/api/nothing-serves-this');
+    expect(d.allowed).toBe(false);
+    expect(d.reason).toContain('no permission covers this path');
+  });
+
+  test('an execution permission is refused however it is granted', () => {
+    // Refused by KIND, before any grant lookup — so a row granting it changes nothing.
+    const forged = resolve(member(), grants(['tasks', 'write']));
+    const d = decideApiRequest(forged, 'GET', '/api/tasks');
+    expect(d.allowed).toBe(false);
+    expect(d.reason).toContain('runs as the server owner');
+  });
+
+  test('an admin permission is refused', () => {
+    const d = decideApiRequest(resolve(member()), 'GET', '/api/users');
+    expect(d.allowed).toBe(false);
+    expect(d.reason).toContain('restricted to the server owner');
+  });
+
+  // The one self-service route in the registry: updating your own profile lives on the router that also
+  // holds account administration.
+  test('a self-service route is allowed with no grant at all', () => {
+    expect(decideApiRequest(resolve(member()), 'PUT', '/api/users').allowed).toBe(true);
+  });
+
+  test('self-service is exact — neither the method nor the path may drift', () => {
+    expect(decideApiRequest(resolve(member()), 'POST', '/api/users').allowed).toBe(false);
+    expect(decideApiRequest(resolve(member()), 'PUT', '/api/users/7').allowed).toBe(false);
+  });
+
+  test('no grant means no access, with the permission named', () => {
+    const d = decideApiRequest(resolve(member()), 'GET', '/api/file-browser');
+    expect(d.allowed).toBe(false);
+    expect(d.reason).toContain('your role does not have access to');
+  });
+
+  test('read grants reads and refuses writes', () => {
+    const held = resolve(member('m1'), grants(['files', 'read']));
+    expect(decideApiRequest(held, 'GET', '/api/file-browser').allowed).toBe(true);
+    const write = decideApiRequest(held, 'POST', '/api/file-browser');
+    expect(write.allowed).toBe(false);
+    expect(write.reason).toContain('read-only');
+  });
+
+  test('write grants both', () => {
+    const held = resolve(member('m1'), grants(['files', 'write']));
+    expect(decideApiRequest(held, 'GET', '/api/file-browser').allowed).toBe(true);
+    expect(decideApiRequest(held, 'POST', '/api/file-browser').allowed).toBe(true);
+  });
+
+  // A read that has to be a POST — the body is too big for a query string — must not need write.
+  //
+  // The path is `/api/file-browser/download`, not `/api/download`: readOnlyWrites entries are RELATIVE to
+  // the permission's own api prefix. Worth a comment because the absolute form looks right, is what I wrote
+  // first, and fails as "no permission covers this path" rather than as a level problem — a misleading
+  // error for a misleading path.
+  test('a readOnlyWrites path is allowed at read level', () => {
+    const held = resolve(member('m1'), grants(['files', 'read']));
+    expect(decideApiRequest(held, 'POST', '/api/file-browser/download').allowed).toBe(true);
+    // And the same POST elsewhere under the prefix still needs write.
+    expect(decideApiRequest(held, 'POST', '/api/file-browser/move').allowed).toBe(false);
+  });
+
+  // The two rules composing: granted, but with no kernel boundary to be granted inside.
+  test('a granted confined permission is still refused without a Linux account', () => {
+    const held = resolve(member(null), grants(['files', 'write']));
+    expect(decideApiRequest(held, 'GET', '/api/file-browser').allowed).toBe(false);
+  });
+
+  test('an unauthenticated caller is refused everything', () => {
+    for (const path of ['/api/file-browser', '/api/chat', '/api/users', '/api/tasks']) {
+      expect(decideApiRequest(NOBODY, 'GET', path).allowed).toBe(false);
+    }
+  });
+});
+
+describe('deciding a websocket', () => {
+  test('the owner opens anything', () => {
+    expect(decideWsProvider({ isOwner: true, grants: new Map() }, 'terminal')).toBe(true);
+  });
+
+  test('a provider no permission claims is refused', () => {
+    expect(decideWsProvider(resolve(member()), 'not-a-provider')).toBe(false);
+  });
+
+  test('a confined socket needs the grant AND the Linux account', () => {
+    expect(decideWsProvider(resolve(member('m1'), grants(['terminal', 'read'])), 'terminal')).toBe(true);
+    expect(decideWsProvider(resolve(member(null), grants(['terminal', 'read'])), 'terminal')).toBe(false);
+  });
+
+  // No method to reason about, so any level opens it. Pinned because "read-only socket" is a tempting idea
+  // that would silently close terminals granted at read.
+  test('read is enough — a socket has no method', () => {
+    expect(decideWsProvider(resolve(member('m1'), grants(['chat', 'read'])), 'chat')).toBe(true);
+    expect(decideWsProvider(resolve(member('m1'), grants(['chat', 'read'])), 'chat-notify')).toBe(true);
+  });
+
+  test("an execution permission's socket is refused however it is granted", () => {
+    const forged = resolve(member('m1'), grants(['tasks', 'write']));
+    expect(decideWsProvider(forged, 'task-runner')).toBe(false);
+    expect(decideWsProvider(forged, 'pipeline')).toBe(false);
+  });
+
+  test('an unauthenticated caller opens nothing', () => {
+    for (const p of ['terminal', 'chat', 'task-runner', 'sidecar']) expect(decideWsProvider(NOBODY, p)).toBe(false);
+  });
+});
+
+/*
+  NOT covered here, and stated rather than left as a gap somebody has to notice:
+
+  - `isOwnerOnlyRoute`. No permission in the registry declares `ownerOnly` yet — the field was added on
+    2026-08-21 for plugin settings routes and has no user. It is checked before self-service and before
+    kind, which is the part worth a test, and it cannot get one until a real permission uses it. Covering it
+    with an invented permission would test this file's fixtures rather than the registry.
+  - The grant cache and `invalidateRoleGrants`. They live on the async side, around a database call, which
+    is exactly the half this split moved away from. Their contract — the one writer in
+    `api/users/permissions-routes.ts` calls the invalidator — is a claim about call sites, not about logic,
+    and a test here could only re-state it.
+*/

src/servers/permissions/authorize.ts

@@ -65,6 +65,57 @@ async function grantsForRole(role: UserRole): Promise<Map<string, PermissionLeve
  * write such a row, but this is the layer that has to hold if one ever exists — a constraint the database
  * does not enforce is a constraint the reader must.
  */
+/**
+ * The resolution itself, with no database in it.
+ *
+ * Split out on 2026-08-22 so it can be tested. `authorize.ts` is described in its own header as the file
+ * standing between a Member and a shell, and it had no automated tests at all — because every path through
+ * it needed two database calls, and the only file in this repository that mocks `officerdb` has a stub that
+ * leaks into whatever runs after it. Pulling the decision away from the fetching removes the need for a
+ * mock rather than working around one: everything below this line is a pure function of two arguments.
+ *
+ * The async wrapper keeps the caching, the error handling and the single-question shape callers rely on.
+ */
+export function resolveEffectivePermissions(
+  user: { role: UserRole; osUser: string | null },
+  roleGrants: Map<string, PermissionLevel>,
+): EffectivePermissions {
+  if (user.role === 'Super Admin') return { isOwner: true, grants: new Map() };
+
+  const grants = new Map<string, PermissionLevel>();
+  for (const permission of CORE_PERMISSIONS) grants.set(permission.key, 'write');
+
+  // Whether the kernel can enforce a boundary for this account. `confined` permissions are dropped
+  // without it — see below.
+  const hasOsAccount = !!user.osUser;
+
+  for (const [key, level] of roleGrants) {
+    const permission = PERMISSION_BY_KEY.get(key);
+    // Unknown key: a permission that was renamed or removed while a grant survived. Ignore it — the
+    // alternative is honouring a name nothing defines.
+    if (!permission) continue;
+
+    // A confined permission touches the filesystem or runs a process, and is safe only because the
+    // account has its own Linux user to be confined to. Without one there is no boundary, so the grant
+    // resolves to nothing rather than to the owner's home — which is what it WOULD resolve to, since
+    // `getOwnerHomeDir` ignores the email it is passed, always.
+    //
+    // Dropped here rather than refused per-router so that one rule covers the HTTP routes, the
+    // websocket doors and the dock all at once. A member with `files` granted but no OS account sees no
+    // Files icon, gets a 403 from /api/file-browser, and cannot open the terminal socket — from this.
+    if (permission.kind === 'confined') {
+      if (!hasOsAccount) continue;
+      grants.set(key, level);
+      continue;
+    }
+
+    if (permission.kind !== 'app') continue;
+    grants.set(key, level);
+  }
+
+  return { isOwner: false, grants };
+}
+
 export async function getEffectivePermissions(userId: number | undefined): Promise<EffectivePermissions> {
   const empty: EffectivePermissions = { isOwner: false, grants: new Map() };
   if (!userId) return empty;
@@ -73,39 +124,7 @@ export async function getEffectivePermissions(userId: number | undefined): Promi
     const user = await getUserById(userId);
     if (!user) return empty;
     if (user.role === 'Super Admin') return { isOwner: true, grants: new Map() };
-
-    const grants = new Map<string, PermissionLevel>();
-    for (const permission of CORE_PERMISSIONS) grants.set(permission.key, 'write');
-
-    // Whether the kernel can enforce a boundary for this account. `confined` permissions are dropped
-    // without it — see below.
-    const hasOsAccount = !!user.osUser;
-
-    for (const [key, level] of await grantsForRole(user.role)) {
-      const permission = PERMISSION_BY_KEY.get(key);
-      // Unknown key: a permission that was renamed or removed while a grant survived. Ignore it — the
-      // alternative is honouring a name nothing defines.
-      if (!permission) continue;
-
-      // A confined permission touches the filesystem or runs a process, and is safe only because the
-      // account has its own Linux user to be confined to. Without one there is no boundary, so the grant
-      // resolves to nothing rather than to the owner's home — which is what it WOULD resolve to, since
-      // `getOwnerHomeDir` ignores the email it is passed, always.
-      //
-      // Dropped here rather than refused per-router so that one rule covers the HTTP routes, the
-      // websocket doors and the dock all at once. A member with `files` granted but no OS account sees no
-      // Files icon, gets a 403 from /api/file-browser, and cannot open the terminal socket — from this.
-      if (permission.kind === 'confined') {
-        if (!hasOsAccount) continue;
-        grants.set(key, level);
-        continue;
-      }
-
-      if (permission.kind !== 'app') continue;
-      grants.set(key, level);
-    }
-
-    return { isOwner: false, grants };
+    return resolveEffectivePermissions(user, await grantsForRole(user.role));
   } catch {
     // A transient database error must never grant anything. Deny, and let the next request retry.
     return empty;
@@ -123,7 +142,16 @@ export async function isApiRequestAllowed(
   method: string,
   path: string,
 ): Promise<{ allowed: boolean; reason?: string }> {
-  const { isOwner, grants } = await getEffectivePermissions(userId);
+  return decideApiRequest(await getEffectivePermissions(userId), method, path);
+}
+
+/** The decision, given an already-resolved account. Pure, and where every rule below actually lives. */
+export function decideApiRequest(
+  effective: EffectivePermissions,
+  method: string,
+  path: string,
+): { allowed: boolean; reason?: string } {
+  const { isOwner, grants } = effective;
   if (isOwner) return { allowed: true };
 
   const permission = permissionForApiPath(path);
@@ -170,7 +198,12 @@ export async function isApiRequestAllowed(
  * rather than by being left off a list. The rule stays because the first plugin to own a socket needs it.
  */
 export async function isWsProviderAllowed(userId: number | undefined, provider: string): Promise<boolean> {
-  const { isOwner, grants } = await getEffectivePermissions(userId);
+  return decideWsProvider(await getEffectivePermissions(userId), provider);
+}
+
+/** The decision, given an already-resolved account. See `isWsProviderAllowed` for why level is not read. */
+export function decideWsProvider(effective: EffectivePermissions, provider: string): boolean {
+  const { isOwner, grants } = effective;
   if (isOwner) return true;
 
   const permission = permissionForWsProvider(provider);

src/servers/permissions/registry.ts

@@ -147,7 +147,10 @@ const CORE_REGISTRY: Permission[] = [
     // to present the authority the account already has, so denying it would only force the holder to keep
     // using a password in places a password should not go. What a key can then DO is decided by the same
     // permission checks as any other request from that user; nothing here widens them.
-    api: ['/user', '/dock', '/api-keys'],
+    // `/theme-favorites` sits here rather than on `/themes`, which is unauthenticated so the sign-in screen
+    // can paint. A starred theme is the same shape as a dock preference: the caller's own taste, granting
+    // nothing, and not a sensible thing to deny an account that can already choose a theme.
+    api: ['/user', '/dock', '/api-keys', '/theme-favorites'],
     routes: ['/settings/profile'],
   },
   {
@@ -278,7 +281,17 @@ const CORE_REGISTRY: Permission[] = [
     // non-owners wholesale — so an endpoint there could not be read by the accounts that need it. It reports
     // two booleans about the caller's own home and nothing about anyone else, which is what lets a member be
     // told "run `claude` once to sign in" instead of being shown a tile that 403s.
-    api: ['/chat', '/agent-status'],
+    // `/claude-auth` is the `/login` flow — it spawns `claude auth login` AS THE CALLER and writes the
+    // credential into the caller's own home. It rides this permission rather than earning its own for the
+    // reason that makes the pairing exact: an account that may use the agent must be able to authenticate
+    // the agent, and an account that may not has nothing to authenticate. `confined` then carries the rest
+    // for free — `authorize.ts` drops a confined grant for an account with no `osUser`, which is precisely
+    // the account that cannot hold credentials of its own.
+    //
+    // NOT under `/auth`, which `totality.ts` exempts from the gate entirely because it is where a caller
+    // goes to BECOME authenticated. Mounted there, an unauthenticated request could start a login as the
+    // owner.
+    api: ['/chat', '/agent-status', '/claude-auth'],
     // 'chat-notify' is a session-independent socket (the bell feature): it carries no sessionId and no
     // transcript, just a ping that a chat this account can already reach has finished a turn or needs
     // input. Riding this permission rather than a new one, because it is meaningless without `chat`

src/workspaces/helpers/clipboard.ts

@@ -7,9 +7,12 @@
  * is not localhost the whole object is undefined, so `navigator.clipboard.writeText`
  * throws `TypeError: Cannot read properties of undefined`.
  *
- * Officer is reached over the tailnet — `http://officer-dev:9000` — which is
- * neither https nor localhost. Twenty call sites were affected, in three states
- * that all looked fine in review:
+ * Officer is reachable over plain http — `http://officer-dev:9000` on the tailnet —
+ * which is neither https nor localhost. The owner's own browsing is over https
+ * (`platform.officer.dev`) and was already https when this was written; the http
+ * origins are the other ways in, and an install with no certificate has no other
+ * way in at all. Twenty call sites were affected, in three states that all looked
+ * fine in review:
  *
  *   bare `navigator.clipboard.writeText(x)`   threw, killing the handler
  *   `navigator.clipboard?.writeText(x)`       did nothing, silently

src/workspaces/officerdev/src/apps/Chat/ChatPanelWrapper.tsx

@@ -19,6 +19,8 @@ type ResumeState = {
   messages: ChatMessage[];
   total: number;
   offset: number;
+  /** Carried so the composer offers a commander's own controls here, not only in Command HQ. */
+  isCommander: boolean;
 };
 
 // Transcripts get extremely long, so only the tail is loaded up front; the chat pages older messages in
@@ -104,6 +106,9 @@ const ChatPanelInner = ({
         promptPrefix={promptPrefix}
         panelId={panelId}
         sessionId={sessionKey ?? undefined}
+        // From the SESSION, so a commander opened here gets a commander's composer. `chatContext` may also
+        // set it via `context`; either being true is enough — see `manager.isCommander`.
+        isCommander={resume?.isCommander === true}
         {...chatContext}
       />
     </div>
@@ -221,6 +226,7 @@ export const ChatPanelWrapper = ({ panelId, promptPrefix }: ChatPanelWrapperProp
           messages: detail.messages as unknown as ChatMessage[],
           total: detail.total,
           offset: detail.offset,
+          isCommander: detail.isCommander === true,
         });
       } catch {
         // A stale id — the transcript was deleted or pruned from under us. Open a NEW conversation rather

src/workspaces/officerdev/src/apps/Chat/EmbeddableChat/EmbeddableChat.tsx

@@ -23,6 +23,14 @@ type EmbeddableChatProps = {
   chat?: UseChatType;
   context?: string;
   contextId?: string;
+  /**
+   * This SESSION is a commander, as reported by `GET /chat/sessions/:id`.
+   *
+   * Separate from `context`, which says which SCREEN is rendering. Both can make the composer offer the
+   * handoff watcher and only this one is true of the conversation wherever it is opened — which is the bug:
+   * a commander opened in /chat had `context: 'chat'` and silently lost the control.
+   */
+  isCommander?: boolean;
   onMessageComplete?: () => void;
 };
 

src/workspaces/officerdev/src/apps/Chat/EmbeddableChat/prompt-recall.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, it } from 'bun:test';
+
+/*
+  The rule, as a pure function, because the interesting part is not the DOM.
+
+  History must never clobber text the person typed, and must still be walkable once a recalled prompt is
+  sitting in the box. Those two pull in opposite directions and the second is what a naive "only when empty"
+  check breaks.
+*/
+const mayRecall = (value: string, recalling: boolean): boolean => value.trim() === '' || recalling;
+
+describe('when history may take the arrow key', () => {
+  it('takes it on an empty composer', () => {
+    expect(mayRecall('', false)).toBe(true);
+  });
+
+  // The bug this rule exists for: the caret is on the first line of a one-line draft, so every position
+  // test passes, and Up used to replace what you were writing.
+  it('leaves a draft alone', () => {
+    expect(mayRecall('half a thought', false)).toBe(false);
+  });
+
+  // Without this, you could step back exactly once and then be refused, because the recalled prompt is
+  // itself text in the box.
+  it('keeps walking once it is in the history', () => {
+    expect(mayRecall('a prompt from earlier', true)).toBe(true);
+  });
+
+  it('treats whitespace as empty', () => {
+    expect(mayRecall('   ', false)).toBe(true);
+    expect(mayRecall('\n\t ', false)).toBe(true);
+  });
+
+  it('protects a draft that merely starts with whitespace', () => {
+    expect(mayRecall('  still typing', false)).toBe(false);
+  });
+});

src/workspaces/officerdev/src/apps/Chat/EmbeddableChat/useEmbeddableChat.ts

@@ -49,8 +49,19 @@ type UseEmbeddableChatParams = {
   chat?: UseChatType;
   context?: string;
   contextId?: string;
+  /** This session is a commander, per `GET /chat/sessions/:id`. See the note where it is surfaced. */
+  isCommander?: boolean;
 };
 
+/**
+ * Keys that are held rather than typed.
+ *
+ * A modifier press is not editing, and ending a recall on one would break the ordinary act of holding Shift
+ * between two presses of Up. `Dead` is a pending accent on layouts that compose — also not a keystroke you
+ * have finished making.
+ */
+const MODIFIER_KEYS = new Set(['Shift', 'Control', 'Alt', 'Meta', 'CapsLock', 'Dead']);
+
 export function useEmbeddableChat(params: UseEmbeddableChatParams, onMessageComplete?: () => void) {
   const { initialMessage, defaultInput = '', promptPrefix, cwd, autoSend = false, chat: externalChat } = params;
 
@@ -389,15 +400,26 @@ export function useEmbeddableChat(params: UseEmbeddableChatParams, onMessageComp
   /**
    * Recall a previous prompt, the way a shell does.
    *
-   * Up only reaches the history from the FIRST line and Down only from the last, so in a multi-line draft
-   * the arrows still move the caret — there is a line above to go to, and taking the key would strand the
-   * cursor. On the first line there is nowhere up to go, which is exactly when history is what you meant.
-   * `step` returning null (empty history, or already at the oldest) leaves the key alone too.
+   * **Only from an empty composer.** The caret-on-the-first-line test below is not enough on its own, and
+   * that was the bug: with a one-line draft you were typing, the caret IS on the first line, so Up replaced
+   * what you had written with something from last week. A draft is not recoverable from anywhere, and
+   * history is — so the tie goes to the draft, always.
+   *
+   * `isRecalling` is what keeps the rule from making the feature useless. Once a recalled prompt is in the
+   * box the box is not empty, so a plain emptiness test would allow one step back and then refuse; walking
+   * further is still allowed because that text came from the history rather than from you.
+   *
+   * Whitespace counts as empty. A composer holding two spaces is not a draft anybody would miss, and an
+   * invisible character silently blocking Up is worse than losing it.
+   *
+   * The line tests stay on top of that: in a recalled prompt spanning three lines, Up from the middle moves
+   * the caret, because there is a line above to go to and taking the key would strand the cursor.
    */
   const recallPrompt = (ev: KeyboardEvent<HTMLTextAreaElement>, direction: -1 | 1): void => {
     const field = ev.currentTarget;
     const { selectionStart, selectionEnd, value } = field;
     if (selectionStart !== selectionEnd) return; // a selection means the arrows are extending/collapsing it
+    if (value.trim() !== '' && !history.isRecalling()) return;
     const onEdge =
       direction === -1 ? !value.slice(0, selectionStart).includes('\n') : !value.slice(selectionEnd).includes('\n');
     if (!onEdge) return;
@@ -429,6 +451,18 @@ export function useEmbeddableChat(params: UseEmbeddableChatParams, onMessageComp
     }
     if (ev.key === 'ArrowUp') return recallPrompt(ev, -1);
     if (ev.key === 'ArrowDown') return recallPrompt(ev, 1);
+    /*
+      Anything else ends the recall, and Left/Right are the ones that matter.
+
+      A recalled prompt you have started moving around in is a prompt you have adopted — so the next Up must
+      not walk further back over it, for the same reason Up does not overwrite a fresh draft. Arrowing left
+      into the middle of it is the clearest signal of intent there is, and it types nothing, so a rule based
+      on the text changing would miss it entirely.
+
+      Bare modifiers are excluded: holding Shift to capitalise the next letter is not editing, and treating
+      it as such would end the recall between two presses of Up.
+    */
+    if (!MODIFIER_KEYS.has(ev.key)) history.leave();
     if (ev.key === 'Enter' && !ev.shiftKey) {
       ev.preventDefault();
       // Enter on an EMPTY composer with something queued means "don't wait — say it now". The keystroke
@@ -575,6 +609,19 @@ export function useEmbeddableChat(params: UseEmbeddableChatParams, onMessageComp
   }, [autoSend, isConnected, messages.length, input]);
 
   return {
+    // Surfaced so the composer can offer what only makes sense here. The Command HQ context is the one
+    // place a `handoff` watcher can be promised — see BackgroundJobDialog — and it was invisible to the
+    // composer, so the option was never rendered anywhere at all.
+    context: params.context,
+    /*
+      One answer to "is this a commander", from either of the two things that can know.
+
+      The SCREEN knows when Command HQ starts one, before the session exists and before any route could
+      report on it. The SESSION knows once it has a transcript, wherever it is opened. Neither alone is
+      enough: screen-only was the original bug (a commander in /chat lost its controls) and session-only
+      would lose the brand-new composer, which has no session yet.
+    */
+    isCommander: params.context === 'command-hq' || params.isCommander === true,
     messages,
     historicalCount,
     streamingText,

src/workspaces/officerdev/src/apps/Chat/EmbeddableChat/usePromptHistory.test.tsx

@@ -103,3 +103,44 @@ describe('what gets remembered', () => {
     expect(current.step(-1, '')).toBe('three');
   });
 });
+
+describe('leaving the history', () => {
+  // The rule this exists for: a recalled prompt you have started editing — or merely arrowed into — is
+  // yours now, and the next Up must not walk further back over it.
+  test('a keystroke after a recall ends it, so Up no longer walks', () => {
+    const { current } = mount();
+    current.record('one');
+    current.record('two');
+
+    expect(current.step(-1, '')).toBe('two');
+    expect(current.isRecalling()).toBe(true);
+
+    current.leave();
+    expect(current.isRecalling()).toBe(false);
+  });
+
+  // The composer's guard is "empty, or recalling". Once we have left, a non-empty box is a draft — so the
+  // two halves together are what stop Up from eating an edited prompt.
+  test('after leaving, the recalled text is treated as a draft', () => {
+    const { current } = mount();
+    current.record('one');
+    current.step(-1, '');
+    current.leave();
+
+    const mayRecall = (value: string) => value.trim() === '' || current.isRecalling();
+    expect(mayRecall('one, edited')).toBe(false);
+    expect(mayRecall('')).toBe(true);
+  });
+
+  // The stashed draft goes with it. Handing an older draft back after you have started editing something
+  // else would paste the wrong text over the right one.
+  test('the stashed draft does not come back later', () => {
+    const { current } = mount();
+    current.record('sent');
+    expect(current.step(-1, 'a draft')).toBe('sent');
+    current.leave();
+    // Entering again stashes what is there NOW, and Down returns that rather than the abandoned draft.
+    expect(current.step(-1, 'something else')).toBe('sent');
+    expect(current.step(1, 'sent')).toBe('something else');
+  });
+});

src/workspaces/officerdev/src/apps/Chat/EmbeddableChat/usePromptHistory.ts

@@ -25,6 +25,26 @@ export type PromptHistory = {
    * whatever it normally does.
    */
   step: (direction: -1 | 1, current: string) => string | null;
+  /**
+   * Are we currently walking the history, rather than composing?
+   *
+   * The caller needs this to answer "may Up take this key" without also making the history unusable. The
+   * rule is that history must never clobber text the PERSON typed — but once a recalled prompt is in the
+   * box, the box is not empty any more, and a plain emptiness test would allow exactly one step back and
+   * then refuse. This is the difference between "there is text" and "there is text of yours".
+   */
+  isRecalling: () => boolean;
+  /**
+   * Stop being in the history — the recalled text is now the person's own draft.
+   *
+   * Called on any keystroke that is not Up or Down. The moment you edit a recalled prompt, or even just
+   * move the caret through it with Left, you have adopted it: pressing Up after that would throw away
+   * something you were working on, which is the same fault as recalling over a fresh draft.
+   *
+   * The stashed draft goes too. It belonged to the composing session this leaves, and handing it back after
+   * you have started editing something else would paste an older draft over a newer one.
+   */
+  leave: () => void;
 };
 
 export function usePromptHistory(): PromptHistory {
@@ -87,5 +107,12 @@ export function usePromptHistory(): PromptHistory {
     return list[at - 1] ?? null;
   }, []);
 
-  return { record, step };
+  const isRecalling = useCallback(() => indexRef.current !== null, []);
+
+  const leave = useCallback(() => {
+    indexRef.current = null;
+    draftRef.current = '';
+  }, []);
+
+  return { record, step, isRecalling, leave };
 }

src/workspaces/officerdev/src/apps/Chat/components/ClaudeLoginDialog.tsx

@@ -0,0 +1,182 @@
+import { useEffect, useRef, useState } from 'react';
+import { Check, Copy, ExternalLink, Loader2 } from 'lucide-react';
+import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@/components/ui/dialog';
+import { Input } from '@/components/ui/input';
+import { useClient } from 'hooks/useClient';
+import { errorText } from 'helpers/error-text';
+import { copyToClipboard } from 'helpers/clipboard';
+
+/*
+  `/login` — the same flow as the terminal, without the terminal.
+
+  Officer authenticates `claude` with a Claude SUBSCRIPTION over OAuth, which is a browser round trip:
+  open a URL, authorise, paste a code back. Until now the only way to do that here was to open a terminal
+  panel and drive the CLI by hand — which works, and is a strange thing to ask of somebody whose whole
+  session is a browser.
+
+  Three states, and the middle one is the person leaving to do something else:
+
+    starting → waiting for the code → done
+*/
+
+type Started = { id: string; url: string; expiresInMs: number };
+
+type Props = { open: boolean; onOpenChange: (open: boolean) => void };
+
+export const ClaudeLoginDialog = ({ open, onOpenChange }: Props) => {
+  const client = useClient();
+  const [started, setStarted] = useState<Started | null>(null);
+  const [code, setCode] = useState('');
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [done, setDone] = useState(false);
+  const [copied, setCopied] = useState(false);
+  const codeRef = useRef<HTMLInputElement>(null);
+
+  // Start on open, and abandon on close. The server holds a live `claude` process per pending login, so a
+  // dialog dismissed without telling it leaves that process parked on a read of stdin.
+  useEffect(() => {
+    if (!open) return;
+    let cancelled = false;
+    setStarted(null);
+    setCode('');
+    setError(null);
+    setDone(false);
+    void (async () => {
+      try {
+        const res = await client.post<Started>('/claude-auth', {});
+        if (!cancelled) setStarted(res);
+      } catch (err) {
+        if (!cancelled) setError(errorText(err, 'could not start the login'));
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [open]);
+
+  useEffect(() => {
+    if (!open && started) void client.delete(`/claude-auth/${started.id}`).catch(() => {});
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [open]);
+
+  const submit = async () => {
+    if (!started || !code.trim() || busy) return;
+    setBusy(true);
+    setError(null);
+    try {
+      await client.post(`/claude-auth/${started.id}/code`, { code: code.trim() });
+      setDone(true);
+    } catch (err) {
+      setError(errorText(err, 'that code was not accepted'));
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-lg">
+        <DialogHeader>
+          <DialogTitle>Sign in to Claude</DialogTitle>
+        </DialogHeader>
+
+        {done ? (
+          <div className="flex items-center gap-2 py-4 text-sm">
+            <Check className="h-4 w-4 text-success" />
+            Signed in. New turns use these credentials — no restart needed.
+          </div>
+        ) : !started ? (
+          <div className="flex items-center gap-2 py-6 text-sm text-muted-foreground">
+            {error ? (
+              <span className="text-destructive">{error}</span>
+            ) : (
+              <>
+                <Loader2 className="h-4 w-4 animate-spin" />
+                Asking the CLI for a sign-in link…
+              </>
+            )}
+          </div>
+        ) : (
+          <div className="space-y-4 py-2">
+            <div className="space-y-2">
+              <p className="text-sm text-muted-foreground">
+                Open this, authorise, and paste back the code it gives you.
+              </p>
+              <div className="flex items-center gap-2">
+                {/* A real anchor. Every link here opens a new tab, which is what you want for this one —
+                    losing the dialog would lose the process holding the other half of the exchange. */}
+                <a
+                  href={started.url}
+                  target="_blank"
+                  rel="noreferrer"
+                  className="inline-flex items-center gap-1.5 rounded-md bg-primary px-3 py-1.5 text-sm font-medium text-primary-foreground hover:opacity-90"
+                >
+                  Authorise in claude.com
+                  <ExternalLink className="h-3.5 w-3.5" />
+                </a>
+                {/* Copy, because opening here opens in THIS browser — already signed into whichever account
+                    you are trying to move away from. Pasting into another profile or another device is how
+                    you sign in as somebody else, and this dialog exists precisely for the machine with two
+                    Anthropic accounts on it. */}
+                <button
+                  type="button"
+                  onClick={() => {
+                    void copyToClipboard(started.url).then((ok) => {
+                      setCopied(ok);
+                      if (ok) setTimeout(() => setCopied(false), 2_000);
+                      else setError('could not reach the clipboard — select the link and copy it by hand');
+                    });
+                  }}
+                  title="Copy the link, to open it in another browser or on your phone"
+                  className="inline-flex items-center gap-1.5 rounded-md border border-border px-3 py-1.5 text-sm font-medium hover:bg-foreground/5"
+                >
+                  {copied ? <Check className="h-3.5 w-3.5 text-success" /> : <Copy className="h-3.5 w-3.5" />}
+                  {copied ? 'Copied' : 'Copy link'}
+                </button>
+              </div>
+            </div>
+
+            <div className="space-y-1">
+              <Input
+                ref={codeRef}
+                autoFocus
+                value={code}
+                onChange={(ev) => setCode(ev.target.value)}
+                onKeyDown={(ev) => {
+                  if (ev.key === 'Enter') void submit();
+                }}
+                placeholder="paste the code"
+                className="font-mono text-sm"
+              />
+              <p className="text-xs text-muted-foreground">
+                Expires in {Math.round(started.expiresInMs / 60_000)} minutes. Run <code>/login</code> again if it does.
+              </p>
+            </div>
+
+            {error && <p className="text-sm text-destructive">{error}</p>}
+
+            <div className="flex justify-end gap-2">
+              <button
+                type="button"
+                onClick={() => onOpenChange(false)}
+                className="rounded-md px-3 py-1.5 text-sm text-muted-foreground hover:text-foreground"
+              >
+                Cancel
+              </button>
+              <button
+                type="button"
+                disabled={!code.trim() || busy}
+                onClick={() => void submit()}
+                className="inline-flex items-center gap-2 rounded-md bg-primary px-3 py-1.5 text-sm font-medium text-primary-foreground disabled:opacity-40"
+              >
+                {busy && <Loader2 className="h-3.5 w-3.5 animate-spin" />}
+                Sign in
+              </button>
+            </div>
+          </div>
+        )}
+      </DialogContent>
+    </Dialog>
+  );
+};

src/workspaces/officerdev/src/apps/Chat/components/InputArea.tsx

@@ -5,6 +5,7 @@ import { Button } from '@/components/ui/button';
 import type { QueuedPrompt, UseEmbeddableChatType } from '../EmbeddableChat/useEmbeddableChat';
 import { ModelSelector } from './ModelSelector';
 import { BackgroundJobDialog } from './BackgroundJobDialog';
+import { ClaudeLoginDialog } from './ClaudeLoginDialog';
 import { armBackgroundJob } from '../../../background-job-origin';
 import { useWorkspace } from '../../../components/Workspace';
 import { AttachmentList } from './AttachmentList';
@@ -17,6 +18,7 @@ type InputAreaProps = {
 };
 
 export const InputArea = ({ manager }: InputAreaProps) => {
+  const [loginOpen, setLoginOpen] = useState(false);
   const {
     input,
     setInput,
@@ -105,7 +107,17 @@ export const InputArea = ({ manager }: InputAreaProps) => {
           ref={textareaRef}
           value={input}
           onChange={(ev) => setInput(ev.target.value)}
-          onKeyDown={handleKeyDown}
+          onKeyDown={(ev) => {
+            // Enter is how anybody actually sends, so the interception has to be here as well as on the
+            // button. Shift-Enter is a newline and stays one.
+            if (ev.key === 'Enter' && !ev.shiftKey && input.trim() === '/login') {
+              ev.preventDefault();
+              setInput('');
+              setLoginOpen(true);
+              return;
+            }
+            handleKeyDown(ev);
+          }}
           onPaste={(ev) => {
             // Let an image paste fall through to the browser's default (nothing) rather than attaching
             // something this model will discard.
@@ -141,7 +153,16 @@ export const InputArea = ({ manager }: InputAreaProps) => {
           </Button>
         )}
         <Button
-          onClick={handleSend}
+          onClick={() => {
+            // `/login` never reaches the agent. It is not a prompt — it is the browser-only user doing the
+            // one thing that used to need a terminal panel, so the composer answers it locally.
+            if (input.trim() === '/login') {
+              setInput('');
+              setLoginOpen(true);
+              return;
+            }
+            handleSend();
+          }}
           disabled={!input.trim() || !isConnected}
           size="icon"
           title={isGenerating ? 'Queue — sends when the current turn finishes' : 'Send'}
@@ -169,10 +190,25 @@ export const InputArea = ({ manager }: InputAreaProps) => {
       />
 
       <WebpageDialog open={urlDialogOpen} onOpenChange={setUrlDialogOpen} onSubmit={attachWebpage} />
+      <ClaudeLoginDialog open={loginOpen} onOpenChange={setLoginOpen} />
       <BackgroundJobDialog
         open={jobDialogOpen}
         onOpenChange={setJobDialogOpen}
         cwd={cwd}
+        /*
+          `handoff` — exit, act, re-arm — is only offered inside a Command HQ commander, because it is a
+          promise the platform has to keep rather than only a sentence in the prompt.
+
+          Read from the MANAGER rather than recomputed from the route, which is what it was: a commander
+          opened from /chat reported `context: 'chat'` and lost the option, having gained it two hours
+          earlier. `manager.isCommander` is true when either the screen or the session says so.
+
+          This prop was never passed by anybody, so `isCommander` defaulted to false everywhere and the
+          option was rendered NOWHERE — including in a commander, where the dialog's own code makes it the
+          default. The whole mechanism existed: the fire behaviour, the contract, `armWatcher` reaching the
+          server. Only the radio button was missing, so the feature looked unbuilt.
+        */
+        isCommander={manager.isCommander}
         onSubmit={(intent, preamble, armWatcher) => {
           // Claimed by the next job to start, which is how the preview tells this one apart from the
           // background jobs an agent starts on its own.

src/workspaces/officerdev/src/apps/Chat/components/UsagePopover.tsx

@@ -1,8 +1,11 @@
 import { useEffect, useState } from 'react';
+import { Loader2 } from 'lucide-react';
 import { usePermissions } from 'hooks/usePermissions';
 import { Popover, PopoverContent, PopoverTrigger } from '@/components/ui/popover';
 import type { UsageAccount } from '../useClaudeUsage';
 import { currentLimit, formatAge, formatReset, formatTokens, useClaudeUsage, weekdayLabel } from '../useClaudeUsage';
+import type { SwitchableAccount } from '../useAnthropicAccounts';
+import { useAnthropicAccounts } from '../useAnthropicAccounts';
 
 /**
  * Claude Code's own usage display, on the harness pill — for every account, not just the one signed in.
@@ -129,38 +132,70 @@ const Models = ({ account }: { account: UsageAccount }) => {
 };
 
 /**
- * One chip per account, and only when there is more than one.
+ * A chip per Anthropic account this machine has seen, and clicking one does one of two things.
  *
- * A tab strip over a single account is chrome that never does anything — the same reasoning that collapses
- * the provider strip to a label when there is one harness on offer.
+ *   switch  — a stored credential exists, so the click BECOMES that account
+ *   view    — only a stored reading exists, so the click shows its cached numbers and nothing changes
+ *
+ * The second kind is not a degraded version of the first, it is a different question. An account whose
+ * sign-in is gone still has percentages and a reset time worth reading — "has my other allowance come back
+ * yet" is answerable from a snapshot, because a reset time is an absolute instant and `currentLimit` rolls a
+ * past window forward rather than showing a stale one. What you cannot do is act on the answer without a
+ * `/login`, and that is what the chip has to make obvious BEFORE it is clicked.
+ *
+ * So: filled for the account you are, plain for one you can become, and dashed-outline for one you can only
+ * look at.
  */
-const AccountTabs = ({
-  accounts,
-  selected,
-  onSelect,
+type Chip = {
+  key: string;
+  email: string;
+  title: string;
+  kind: 'current' | 'switch' | 'view';
+  busy: boolean;
+};
+
+const AccountChips = ({
+  chips,
+  isSwitching,
+  viewing,
+  onClick,
 }: {
-  accounts: UsageAccount[];
-  selected: string;
-  onSelect: (email: string) => void;
+  chips: Chip[];
+  isSwitching: boolean;
+  viewing: string | null;
+  onClick: (chip: Chip) => void;
 }) => (
-  <div className="flex items-center gap-1 overflow-x-auto border-t border-border px-2 py-2">
-    {accounts.map((account) => (
-      <button
-        key={account.email}
-        type="button"
-        onClick={() => onSelect(account.email)}
-        // The local part alone: the domain is what the accounts have in common and the part before it is
-        // what tells them apart, and the panel is 320px wide.
-        title={account.email}
-        className={`shrink-0 cursor-pointer rounded-md px-2 py-1 text-xs font-medium transition-colors ${
-          account.email === selected
-            ? 'bg-primary text-primary-foreground'
-            : 'text-muted-foreground hover:bg-foreground/10 hover:text-foreground'
-        }`}
-      >
-        {account.email.split('@')[0]}
-      </button>
-    ))}
+  <div className="flex flex-wrap items-center gap-1 border-t border-border px-2 py-2">
+    {chips.map((chip) => {
+      const looking = chip.kind === 'view' && viewing === chip.email;
+      return (
+        <button
+          key={chip.key}
+          type="button"
+          disabled={isSwitching || (chip.kind === 'current' && !viewing)}
+          onClick={() => onClick(chip)}
+          title={chip.title}
+          className={`inline-flex shrink-0 items-center gap-1.5 rounded-md px-2 py-1 text-xs font-medium transition-colors ${
+            chip.kind === 'current' && !viewing
+              ? 'bg-primary text-primary-foreground'
+              : chip.kind === 'view'
+                ? // Dashed and unfilled: the border says "not a real destination" without greying it out to
+                  // the point of looking broken, because it IS clickable — just not for switching.
+                  `cursor-pointer border border-dashed border-border ${
+                    looking ? 'bg-foreground/10 text-foreground' : 'text-muted-foreground/70 hover:text-foreground'
+                  }`
+                : 'cursor-pointer text-muted-foreground hover:bg-foreground/10 hover:text-foreground'
+          } ${isSwitching && !chip.busy ? 'opacity-50' : ''}`}
+        >
+          {chip.busy && <Loader2 className="h-3 w-3 animate-spin" />}
+          {/* The WHOLE address. This showed the local part alone, on the reasoning that the domain is what
+              accounts have in common — which is wrong for the case that matters: a personal and a work
+              account belonging to one person share the local part, so the domain is the half that tells
+              them apart. Two chips read as the same account. */}
+          {chip.email}
+        </button>
+      );
+    })}
   </div>
 );
 
@@ -193,7 +228,8 @@ export function UsagePopover({ label, harness }: UsagePopoverProps) {
   const enabled = isOwner && harness === 'claude-code';
 
   const [open, setOpen] = useState(false);
-  const { accounts, isLoading, isRefreshing, isError } = useClaudeUsage(enabled && open);
+  const { accounts: switchable, isSwitching, switchingTo, switchTo, switchError } = useAnthropicAccounts(open);
+  const { accounts, allAccounts, isLoading, isRefreshing, isError } = useClaudeUsage(enabled && open);
 
   /*
     Which tab is showing.
@@ -204,8 +240,57 @@ export function UsagePopover({ label, harness }: UsagePopoverProps) {
     Null means "whichever is current", resolved at render — so the panel opens on the signed-in account
     without needing an effect to select it once the data arrives.
   */
-  const [selectedEmail, setSelectedEmail] = useState<string | null>(null);
-  const selected = accounts.find((a) => a.email === selectedEmail) ?? accounts[0] ?? null;
+  /*
+    No selection state any more, deliberately.
+
+    The panel shows the account you are SIGNED INTO, full stop, and `useClaudeUsage` already filters to it.
+    A selection would let the numbers and the chips disagree — reading one account's percentages with
+    another's chip lit — and that disagreement is the exact confusion this whole change set out to remove.
+  */
+  /*
+    `viewing` is null for the normal case — the account you are signed into — and an email when you have
+    clicked an archived chip to read its cached numbers.
+
+    It is deliberately NOT a general tab selection. Only accounts with no stored credential can be viewed,
+    because for any other one the useful gesture is switching to it and then reading live numbers. That keeps
+    the invariant that made phase one worth doing: if the panel shows a signed-in account, it is THE
+    signed-in account.
+  */
+  const [viewing, setViewing] = useState<string | null>(null);
+  useEffect(() => {
+    if (!open) setViewing(null);
+  }, [open]);
+
+  const selected = (viewing ? allAccounts.find((a) => a.email === viewing) : accounts[0]) ?? accounts[0] ?? null;
+  /*
+    Accounts with a stored READING but no stored credential — an old login that can be looked at and not
+    returned to. That is what is worth saying out loud.
+
+    This counted `allAccounts - accounts` until the switcher existed, which then double-counted: it called
+    an account "not shown" while its chip sat two lines below.
+  */
+  const archived = allAccounts.filter((a) => !switchable.some((s) => s.emailAccount === a.email));
+
+  const chips: Chip[] = [
+    ...switchable.map((a) => ({
+      key: a.accountUuid,
+      email: a.emailAccount,
+      kind: (a.current ? 'current' : 'switch') as Chip['kind'],
+      busy: isSwitching && switchingTo === a.accountUuid,
+      title: a.current
+        ? `${a.emailAccount} — signed in`
+        : a.usable
+          ? `Switch to ${a.emailAccount}${a.orgName ? ` (${a.orgName})` : ''}`
+          : `${a.emailAccount} — sign-in expired, run /login`,
+    })),
+    ...archived.map((a) => ({
+      key: `archived:${a.email}`,
+      email: a.email,
+      kind: 'view' as Chip['kind'],
+      busy: false,
+      title: `${a.email} — no saved sign-in. Click to read its last known usage; run /login to use it.`,
+    })),
+  ];
 
   // The countdowns tick. Only while the panel is open — an interval running behind a closed popover is a
   // re-render a minute for something nobody is looking at.
@@ -234,13 +319,32 @@ export function UsagePopover({ label, harness }: UsagePopoverProps) {
           {/* Plan and account in the accent rather than muted: this line is the ANSWER to "whose numbers am
               I looking at", which matters more the moment there is a second tab, and it was reading as
               chrome under the title. */}
-          <div className="truncate text-xs text-primary">
-            {selected
-              ? [selected.plan, selected.email].filter(Boolean).join(' · ')
-              : isLoading
-                ? 'Reading usage…'
-                : 'Not signed in'}
-          </div>
+          {/* The email on its own line, unshared. It is the answer to the only question this panel is
+              being opened to settle — which account am I spending — and joined with the plan it was the
+              half that got truncated first in a 320px popover. */}
+          {selected ? (
+            <>
+              <div className="truncate text-xs font-medium text-primary" title={selected.email}>
+                {selected.email}
+              </div>
+              {selected.plan && <div className="text-[11px] text-muted-foreground">{selected.plan}</div>}
+            </>
+          ) : (
+            <div className="text-xs text-primary">{isLoading ? 'Reading usage…' : 'Not signed in'}</div>
+          )}
+          {/* Said out loud rather than silently dropped. Phase one shows one account; knowing another
+              exists and is hidden on purpose is different from wondering where it went. */}
+          {switchError && (
+            <div className="mt-1 text-[11px] text-destructive">
+              {switchError instanceof Error ? switchError.message : 'could not switch account'}
+            </div>
+          )}
+          {/* Said on the account being LOOKED AT rather than as a count somewhere else. The numbers below are
+              real and the reset times are still correct; the only thing missing is the ability to act on
+              them, and naming the fix beats naming the problem. */}
+          {viewing && (
+            <div className="mt-0.5 text-[10px] text-warning">No saved sign-in — run /login to use this one</div>
+          )}
           {/*
             How old this reading is, and it earns its line only when it is not live.
 
@@ -258,8 +362,24 @@ export function UsagePopover({ label, harness }: UsagePopoverProps) {
           )}
         </div>
 
-        {accounts.length > 1 && (
-          <AccountTabs accounts={accounts} selected={selected?.email ?? ''} onSelect={setSelectedEmail} />
+        {chips.length > 1 && (
+          <AccountChips
+            chips={chips}
+            isSwitching={isSwitching}
+            viewing={viewing}
+            onClick={(chip) => {
+              if (chip.kind === 'view') {
+                setViewing(chip.email);
+                return;
+              }
+              // Switching returns the panel to live numbers: the account you just became is the one whose
+              // percentages you want, and leaving an archived snapshot on screen after a switch is how the
+              // numbers and the chips end up disagreeing.
+              setViewing(null);
+              const target = switchable.find((a) => a.emailAccount === chip.email);
+              if (target && !target.current) void switchTo(target.accountUuid).catch(() => {});
+            }}
+          />
         )}
 
         {/* A failure never blanks the panel: the two halves are independent server-side, so a limits problem

src/workspaces/officerdev/src/apps/Chat/useAnthropicAccounts.ts

@@ -0,0 +1,65 @@
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { useClient } from 'hooks/useClient';
+
+/*
+  The Anthropic accounts this machine's owner can BE, and the act of becoming one.
+
+  Separate from `useClaudeUsage`, which answers a different question. Usage is a measurement — how much room
+  is left — and is only readable for the account currently signed in. This is identity: who could I be, and
+  make me them. They meet in the popover, where the numbers belong to whichever pill is lit.
+*/
+
+export type SwitchableAccount = {
+  accountUuid: string;
+  emailAccount: string;
+  orgName: string | null;
+  plan: string | null;
+  capturedAt: string;
+  lastUsedAt: string | null;
+  refreshExpiresAt: string | null;
+  /** False once the refresh token has expired: the pill has to offer `/login` rather than a switch. */
+  usable: boolean;
+  current: boolean;
+};
+
+const KEY = ['anthropic', 'accounts'];
+
+export function useAnthropicAccounts(enabled: boolean) {
+  const client = useClient();
+  const queryClient = useQueryClient();
+
+  const query = useQuery<{ accounts: SwitchableAccount[] }>({
+    queryKey: KEY,
+    queryFn: () => client.get<{ accounts: SwitchableAccount[] }>('/claude-auth/accounts'),
+    enabled,
+    // Cheap — two small file reads and one SELECT — and it must not be stale, because a switch made from a
+    // terminal is exactly the case this is here to notice.
+    staleTime: 0,
+    refetchOnWindowFocus: false,
+    // A member gets a 403 here by design. Retrying it just spends three round trips arriving at the same no.
+    retry: false,
+  });
+
+  const switchTo = useMutation({
+    mutationFn: (accountUuid: string) =>
+      client.post<{ ok: boolean; email: string; appliesTo: string }>('/claude-auth/switch', { accountUuid }),
+    onSuccess: async () => {
+      // Both, and in this order. The account list decides which pill is lit; the usage numbers belong to
+      // whichever account that is, and showing the old account's percentages under the new name is the one
+      // outcome that would make somebody distrust the whole panel.
+      await queryClient.invalidateQueries({ queryKey: KEY });
+      await queryClient.invalidateQueries({ queryKey: ['chat', 'usage'] });
+      await queryClient.invalidateQueries({ queryKey: ['chat', 'usage', 'fresh'] });
+    },
+  });
+
+  return {
+    accounts: query.data?.accounts ?? [],
+    isLoading: query.isLoading,
+    /** True while a switch is in flight — the panel must say so, or nobody believes it happened. */
+    isSwitching: switchTo.isPending,
+    switchingTo: switchTo.variables ?? null,
+    switchError: switchTo.error,
+    switchTo: switchTo.mutateAsync,
+  };
+}

src/workspaces/officerdev/src/apps/Chat/useClaudeUsage.ts

@@ -76,8 +76,27 @@ export function useClaudeUsage(enabled: boolean) {
     if (fresh.data) queryClient.setQueryData(KEY, fresh.data);
   }, [fresh.data, queryClient]);
 
+  const all = fresh.data?.accounts ?? cached.data?.accounts ?? [];
+
+  /*
+    PHASE ONE — the signed-in account only. Temporary, and a one-line revert: delete `onlyCurrent` and
+    return `all`.
+
+    The stored snapshots for other accounts are a real feature and the server still serves them. The problem
+    is what they do to the question being asked. This machine's owner has a personal account and a
+    work one, both appear as tabs, and after signing in you cannot tell from a glance WHICH tab you are
+    now spending — the panel answers "here is usage for two accounts" when the question is "whose am I on".
+
+    So while that is the question, show one account and let its absence mean something: no row marked
+    `current` renders as "Not signed in", which is a true and useful answer rather than a tab that happens
+    to be selected.
+  */
+  const onlyCurrent = all.filter((a) => a.current);
+
   return {
-    accounts: fresh.data?.accounts ?? cached.data?.accounts ?? [],
+    accounts: onlyCurrent,
+    /** Every account the server knows about — kept so a caller can say how many are being hidden. */
+    allAccounts: all,
     /** Only true when there is nothing at all to show. A stale list is not a loading state. */
     isLoading: cached.isLoading && fresh.isLoading,
     /** A refresh in flight over an already-painted panel. Worth a hint, never a spinner over the numbers. */

src/workspaces/officerdev/src/apps/ChatHistory/SessionList.tsx

@@ -1,6 +1,6 @@
 import { useEffect, useMemo, useRef, useState } from 'react';
 import { useNavigate, useParams } from 'react-router';
-import { MessageSquare, Plus, RefreshCw } from 'lucide-react';
+import { MessageSquare, Plus, Radar, RefreshCw } from 'lucide-react';
 import { Tabs, TabsList, TabsTrigger } from '@/components/ui/tabs';
 import { DataList, DataRow, EmptyBlock, ErrorBlock, LoadingBlock, MetaItem } from '@/components/Data';
 import { useLocalStorageState } from 'hooks/useLocalStorageState';
@@ -47,6 +47,8 @@ const TABS: { value: View; label: string }[] = [
   localStorage also happens to be the right scope: a phone and a desktop wanting different tabs is reasonable.
 */
 const VIEW_KEY = 'chat.sessions.view';
+/* Which half of Live is showing. Same store and the same reasoning as the tab above it. */
+const LIVE_KIND_KEY = 'chat.sessions.liveKind';
 const EXPANDED_KEY = 'chat.sessions.expanded';
 
 export const SessionList = () => {
@@ -273,8 +275,24 @@ export const SessionList = () => {
   few seconds before the harness announces one, and a row that navigates nowhere is worse than one that
   plainly cannot be clicked.
 */
+type LiveKind = 'agents' | 'commanders';
+
+const LIVE_TABS: { value: LiveKind; label: string }[] = [
+  { value: 'agents', label: 'Agents' },
+  { value: 'commanders', label: 'Commanders' },
+];
+
 const LiveView = ({ activeId, home }: { activeId?: string; home: string | null }) => {
   const { live: sessions, isLoading, error, refetch } = useLiveSessions();
+  const [kind, setKind] = useLocalStorageState<LiveKind>(LIVE_KIND_KEY, 'agents');
+
+  /*
+    Split, not filtered-on-demand, because both counts are always on screen — the tabs exist to be
+    compared, so both numbers have to be right whichever one is showing.
+  */
+  const agents = useMemo(() => sessions.filter((s) => !s.isCommander), [sessions]);
+  const commanders = useMemo(() => sessions.filter((s) => s.isCommander), [sessions]);
+  const shown = kind === 'commanders' ? commanders : agents;
 
   if (error) {
     return (
@@ -293,22 +311,49 @@ const LiveView = ({ activeId, home }: { activeId?: string; home: string | null }
     );
   }
   if (isLoading && sessions.length === 0) return <LoadingBlock label="Asking the agent…" />;
-  if (!sessions.length) {
-    return (
-      <EmptyBlock
-        icon={MessageSquare}
-        title="Nothing running"
-        hint="Conversations with an agent behind them right now show up here."
-      />
-    );
-  }
 
   return (
-    <DataList>
-      {sessions.map((session) => (
-        <LiveRow key={session.sessionKey} session={session} activeId={activeId} home={home} />
-      ))}
-    </DataList>
+    <div className="flex min-h-0 flex-1 flex-col">
+      {/* Counts shown even at zero, unlike the badge on the Live tab above. That badge answers "is anything
+          running", where a standing `0` says nothing. These two answer "which kind, and how many", and the
+          empty one is half the answer — `Commanders (0)` tells you the watcher is not running, which is
+          the thing you came to check. */}
+      <Tabs value={kind} onValueChange={(v) => setKind(v as LiveKind)} className="shrink-0 px-2 pt-2">
+        <TabsList className="flex h-auto w-full items-center gap-1 bg-transparent p-0 text-muted-foreground">
+          {LIVE_TABS.map((tab) => {
+            const count = tab.value === 'commanders' ? commanders.length : agents.length;
+            return (
+              <TabsTrigger
+                key={tab.value}
+                value={tab.value}
+                className="flex-1 cursor-pointer rounded-md border border-transparent px-2 py-1 text-xs font-medium leading-normal ring-0 transition-all hover:bg-foreground/5 hover:text-foreground focus-visible:ring-0 data-[state=active]:border-border data-[state=active]:bg-background data-[state=active]:text-foreground data-[state=active]:shadow-sm"
+              >
+                {tab.label}
+                <span className={`ml-1 tabular-nums ${count > 0 ? 'text-success' : 'opacity-50'}`}>({count})</span>
+              </TabsTrigger>
+            );
+          })}
+        </TabsList>
+      </Tabs>
+
+      {shown.length === 0 ? (
+        <EmptyBlock
+          icon={kind === 'commanders' ? Radar : MessageSquare}
+          title={kind === 'commanders' ? 'No commander running' : 'Nothing running'}
+          hint={
+            kind === 'commanders'
+              ? 'A commander appears here while it is taking a turn — including a turn nobody asked for.'
+              : 'Conversations with an agent behind them right now show up here.'
+          }
+        />
+      ) : (
+        <DataList>
+          {shown.map((session) => (
+            <LiveRow key={session.sessionKey} session={session} activeId={activeId} home={home} />
+          ))}
+        </DataList>
+      )}
+    </div>
   );
 };
 
@@ -322,6 +367,14 @@ const LiveView = ({ activeId, home }: { activeId?: string; home: string | null }
  */
 const LiveRow = ({ session, activeId, home }: { session: LiveSession; activeId?: string; home: string | null }) => {
   const transcriptId = session.claudeSessionId;
+  // A commander opens HERE, in /chat, like any other row.
+  //
+  // This briefly linked to Command HQ, on the argument that /chat renders the transcript without the
+  // category, cost, watcher state or the disarm control. That argument loses to a simpler one: sending
+  // somebody out of the screen they are reading, into a different route with a different layout, is a
+  // bigger loss than the metadata they did not ask for. A commander IS a chat — the same harness, the same
+  // transcript, resumable by the same route. Command HQ is where you go to MANAGE one, which is a separate
+  // errand from reading what it just said.
   return (
     <DataRow
       to={transcriptId ? chatSessionPath(transcriptId) : undefined}

src/workspaces/officerdev/src/apps/CommandHQ/CommandHqCategories.tsx

@@ -1,6 +1,6 @@
 import { useState } from 'react';
 import { Link, useSearchParams } from 'react-router';
-import { Plus, Radar } from 'lucide-react';
+import { Plus } from 'lucide-react';
 import { toast } from '@/components/ui/sonner';
 import { errorText } from 'helpers/error-text';
 import { categoryFromParam, commandHqListPath } from './command-hq-routes';
@@ -55,23 +55,21 @@ export const CommandHqCategories = () => {
   };
 
   return (
-    <div className="flex h-full flex-col overflow-y-auto bg-muted/30">
-      <div className="flex items-center gap-3 px-4 py-4">
-        <div className="flex h-9 w-9 items-center justify-center rounded-xl bg-primary/10">
-          <Radar className="h-5 w-5 text-primary" />
-        </div>
-        <div className="min-w-0">
-          <div className="truncate text-sm font-semibold leading-tight">Command HQ</div>
-          <div className="truncate text-xs text-muted-foreground">Watchers &amp; long-running jobs</div>
-        </div>
-      </div>
+    /*
+      One scrollable list, and a heading that does not scroll with it.
 
-      <nav className="flex flex-col gap-0.5 px-2 pb-3">
-        <Row label="All commanders" active={active === undefined} to={commandHqListPath(undefined)} />
-        <Row label="Uncategorised" active={active === 'none'} to={commandHqListPath('none')} />
-      </nav>
+      This was a nav COLUMN with the screen's branding at the top — a 9px Radar tile, "Command HQ", and
+      "Watchers & long-running jobs" — costing about seventy pixels. All three are gone: the panel now sits
+      at the FOOT of the left column rather than owning it, so the vertical room is the whole budget, and the
+      screen's own header already says Command HQ two inches above. Repeating it in a filter panel was
+      branding where a list should be.
 
-      <div className="mt-2 flex items-center justify-between px-4 pb-1">
+      `All commanders` and `Uncategorised` are inside the scroll box with the categories rather than in a
+      separate nav above it. They are the same kind of thing — a filter over the list — and splitting them
+      into two nav blocks made the second look like a different mechanism.
+    */
+    <div className="flex h-full min-h-0 flex-col bg-muted/30">
+      <div className="flex shrink-0 items-center justify-between border-b border-border px-3 py-2">
         <span className="text-xs font-medium uppercase tracking-wide text-muted-foreground">Categories</span>
         <button
           type="button"
@@ -83,7 +81,9 @@ export const CommandHqCategories = () => {
         </button>
       </div>
 
-      <nav className="flex flex-col gap-0.5 px-2 pb-3">
+      <nav className="flex min-h-0 flex-1 flex-col gap-0.5 overflow-y-auto p-2">
+        <Row label="All commanders" active={active === undefined} to={commandHqListPath(undefined)} />
+        <Row label="Uncategorised" active={active === 'none'} to={commandHqListPath('none')} />
         {categories.map((category) => (
           <Row
             key={category.id}

src/workspaces/officerdev/src/apps/CommandHQ/CommandHqDetail.tsx

@@ -33,35 +33,77 @@ function EmptyState() {
 }
 
 /**
- * Starts a brand-new commander. `useChat` mints the transcript id on the harness's first response
- * (`session:claude`) — once that lands, the URL is replaced onto the real id so a refresh resumes the
- * same conversation instead of starting a second one. `replaceUrl: false` because `useChat`'s own permalink
- * always writes `/chat/<id>` (see `writePermalink` in `useChat.ts`), which is the wrong screen here.
+ * A commander started in THIS pane, and it keeps the same live chat for as long as the pane is open.
+ *
+ * `useChat` mints the transcript id on the harness's first response (`session:claude`); once that lands the
+ * URL is replaced onto it so a refresh resumes this conversation instead of starting a second one.
+ * `replaceUrl: false` because `useChat`'s own permalink always writes `/chat/<id>` (see `writePermalink`),
+ * which is the wrong screen here.
+ *
+ * **The URL change must not remount anything.** It used to: the pane swapped to `ExistingCommander`, which
+ * tore down the live websocket and re-read the transcript from the API. The whole conversation vanished at
+ * the end of the first turn — the messages were in memory, the replacement read a file still being
+ * written, and what the owner saw was an empty composer under a metadata bar reading `1 turn · $0.66`.
+ * Tearing down mid-turn is worse than it looks with a commander, whose turns are long: the pane would drop
+ * the stream and the reader would watch nothing happen for twenty minutes.
+ *
+ * So this component holds the session from the composer through to the end, exactly as `/chat` does — a
+ * permalink is for a refresh, not an instruction to reload. `CommandHqDetail` keeps it mounted by
+ * remembering which id started here.
  */
-function NewCommander({ category }: { category: number | 'none' | undefined }) {
+function NewCommander({
+  category,
+  onStarted,
+}: {
+  category: number | 'none' | undefined;
+  onStarted: (id: string) => void;
+}) {
   const navigate = useNavigate();
   const chat = useChat(undefined, undefined, { replaceUrl: false, context: 'command-hq' });
-  const { setCategory } = useCommandHqCommanderActions(chat.sessionId ?? '');
+  // Also the transcript id: `command_hq_sessions` is keyed on it, so an action addressed by officer's key
+  // updates nothing and says nothing. Same root cause as the navigate below.
+  const { setCategory } = useCommandHqCommanderActions(chat.claudeSessionId ?? '');
   const [filed, setFiled] = useState(false);
 
   useEffect(() => {
-    if (!chat.sessionId || filed) return;
+    // `claudeSessionId`, NOT `sessionId`. The commander is filed under Claude's transcript id
+    // (`fileAsCommander` in websocket.ts), and this URL has to match or the detail pane fetches an id
+    // nothing knows. `sessionId` arrives FIRST — `session:init` sets it to officer's own key — so
+    // navigating on it sent the page to an id that 404s, and `filed` then blocked the correction when the
+    // real one arrived. A commander that had run and answered correctly rendered as "Send a message to
+    // start". Waiting for the transcript id costs one more round trip and is the only id that works.
+    if (!chat.claudeSessionId || filed) return;
     setFiled(true);
     // `fileAsCommander` (websocket.ts) always files with no category — it has no way to know one was
     // requested from here. The same race the `/commanders/new` HTTP route resolves server-side by always
     // running its UPDATE last; done client-side here for the same reason, since the web composer goes
     // through the websocket path instead.
     if (typeof category === 'number') void setCategory.mutateAsync(category).catch(() => {});
-    navigate(commandHqSessionPath(chat.sessionId, category), { replace: true });
+    onStarted(chat.claudeSessionId);
+    navigate(commandHqSessionPath(chat.claudeSessionId, category), { replace: true });
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [chat.sessionId, filed]);
+  }, [chat.claudeSessionId, filed]);
 
   return (
     <div className="flex h-full flex-col">
-      <div className="flex shrink-0 items-center gap-2 border-b border-border bg-background/60 px-4 py-2 text-sm font-medium text-foreground/80">
-        New commander
-      </div>
-      <EmbeddableChat chat={chat} sessionId={undefined} className="min-h-0 flex-1" />
+      {chat.claudeSessionId ? (
+        <MetaBar
+          sessionId={chat.claudeSessionId}
+          title={undefined}
+          isConnected={chat.isConnected}
+          isGenerating={chat.isGenerating}
+          onDisconnect={chat.disconnectSession}
+        />
+      ) : (
+        <div className="flex shrink-0 items-center gap-2 border-b border-border bg-background/60 px-4 py-2 text-sm font-medium text-foreground/80">
+          New commander
+        </div>
+      )}
+      {/* `context` is a prop of EmbeddableChat, and it is NOT the `context` handed to `useChat` above.
+          `useEmbeddableChat(params)` builds the manager from these props, and `manager.context` is what the
+          composer reads to decide whether to offer "exit and hand back, then re-arm". Passing it to the hook
+          and not to the component left that radio hidden inside a commander — the one place it exists for. */}
+      <EmbeddableChat chat={chat} sessionId={undefined} context="command-hq" className="min-h-0 flex-1" />
     </div>
   );
 }
@@ -220,6 +262,50 @@ type ResumeState = {
   title: string | null;
 };
 
+/**
+ * The chat itself, mounted only once the transcript is in hand and keyed on the session.
+ *
+ * Split from the fetch above, and that split is the whole point. `useChat` seeds its message list with
+ * `useState(initialMessages ?? [])` — read on the FIRST render and never again. So a component that
+ * fetches and calls `useChat` in one body seeds itself empty, because on that first render the fetch has
+ * not landed. The early `Loading…` return does not save it: hooks run before it. The messages arrive, the
+ * hook ignores them, and a commander that had run and answered showed "Send a message to start" over a
+ * metadata bar reading `1 turn · $0.28`.
+ *
+ * `ChatPanelWrapper` has always done it this way — `if (selectedSessionId && resuming) return null` sits
+ * ABOVE the component that owns the hook, so the hook's first render is its only render with real data.
+ * Same shape here.
+ */
+function ResumedCommander({ sessionId, resume }: { sessionId: string; resume: ResumeState }) {
+  const chat = useChat(undefined, resume.model ?? undefined, {
+    replaceUrl: false,
+    context: 'command-hq',
+    resumeSessionId: sessionId,
+    initialMessages: resume.messages,
+    paginate: { sessionId, total: resume.total, initialOffset: resume.offset },
+  });
+
+  return (
+    <div className="flex h-full flex-col">
+      <MetaBar
+        sessionId={sessionId}
+        title={resume.title ?? undefined}
+        isConnected={chat.isConnected}
+        isGenerating={chat.isGenerating}
+        onDisconnect={chat.disconnectSession}
+      />
+      <EmbeddableChat
+        chat={chat}
+        sessionId={undefined}
+        context="command-hq"
+        panelId={`command-hq:${sessionId}`}
+        className="min-h-0 flex-1"
+      />
+    </div>
+  );
+}
+
+/** Fetches the transcript and nothing else. Mounts the chat only when it has one. */
 function ExistingCommander({ sessionId }: { sessionId: string }) {
   const client = useClient();
   const [resume, setResume] = useState<ResumeState | undefined>(undefined);
@@ -252,40 +338,11 @@ function ExistingCommander({ sessionId }: { sessionId: string }) {
     };
   }, [sessionId]);
 
-  const chat = useChat(undefined, resume?.model ?? undefined, {
-    replaceUrl: false,
-    context: 'command-hq',
-    ...(resume
-      ? {
-          resumeSessionId: sessionId,
-          initialMessages: resume.messages,
-          paginate: { sessionId, total: resume.total, initialOffset: resume.offset },
-        }
-      : {}),
-  });
-
   if (resuming || !resume) {
     return <div className="flex h-full items-center justify-center text-sm text-muted-foreground">Loading…</div>;
   }
 
-  return (
-    <div className="flex h-full flex-col">
-      <MetaBar
-        sessionId={sessionId}
-        title={resume.title ?? undefined}
-        isConnected={chat.isConnected}
-        isGenerating={chat.isGenerating}
-        onDisconnect={chat.disconnectSession}
-      />
-      <EmbeddableChat
-        key={sessionId}
-        chat={chat}
-        sessionId={undefined}
-        panelId={`command-hq:${sessionId}`}
-        className="min-h-0 flex-1"
-      />
-    </div>
-  );
+  return <ResumedCommander key={sessionId} sessionId={sessionId} resume={resume} />;
 }
 
 export const CommandHqDetail = () => {
@@ -293,7 +350,18 @@ export const CommandHqDetail = () => {
   const [searchParams] = useSearchParams();
   const category = categoryFromParam(searchParams.get('category'));
 
+  // The id of a commander started in this pane. While the URL still names it, `NewCommander` stays mounted
+  // and keeps its live socket — swapping to `ExistingCommander` here is what used to make the conversation
+  // disappear the moment the URL was replaced. Cleared as soon as the owner opens a different commander,
+  // so coming back later resumes from the transcript properly instead of showing an empty remount.
+  const [startedHere, setStartedHere] = useState<string | null>(null);
+
+  useEffect(() => {
+    if (startedHere && sessionId !== 'new' && sessionId !== startedHere) setStartedHere(null);
+  }, [sessionId, startedHere]);
+
   if (!sessionId) return <EmptyState />;
-  if (sessionId === 'new') return <NewCommander category={category} />;
+  if (sessionId === 'new' || sessionId === startedHere)
+    return <NewCommander category={category} onStarted={setStartedHere} />;
   return <ExistingCommander key={sessionId} sessionId={sessionId} />;
 };

src/workspaces/officerdev/src/apps/CommandHQ/CommandHqGrid.tsx

@@ -140,7 +140,16 @@ export const CommandHqGrid = () => {
         </Link>
       </div>
 
-      <div className="grid grid-cols-1 gap-3 p-4 sm:grid-cols-2 xl:grid-cols-3">
+      {/*
+        One per line, full width — a grid of one.
+
+        It was `sm:grid-cols-2 xl:grid-cols-3`, which was reasonable when this panel owned 34% of the screen
+        and is not now that it owns part of a 24% column: two columns of card inside it left each one too
+        narrow for a title, so every card truncated and the cost line wrapped. Nothing about the card changed
+        — same rounded pill, same `p-4`, same `gap-3` between them — it simply stops being asked to share a
+        row.
+      */}
+      <div className="flex flex-col gap-3 p-4">
         {commanders.map((commander) => (
           <Card
             key={commander.id}

src/workspaces/officerdev/src/apps/FileBrowser/FileBrowserApp/components/Breadcrumb.tsx

@@ -33,10 +33,7 @@ export const Breadcrumb = ({ path, onNavigate, basePath = '/', hrefForPath }: Br
   return (
     <div className="shrink-0 border-b border-duck-dark/10 px-4 py-2">
       <nav className="flex items-center gap-1 text-sm flex-wrap">
-        <Crumb
-          to={basePath}
-          className="flex items-center gap-1 text-duck-forest hover:text-duck-teal transition-colors cursor-pointer font-medium"
-        >
+        <Crumb to={basePath} className="flex items-center gap-1 text-duck-teal cursor-pointer font-medium">
           <Home className="h-4 w-4" />
           <span>{basePath === '/' ? 'home' : basePath.split('/').pop()}</span>
         </Crumb>
@@ -52,10 +49,7 @@ export const Breadcrumb = ({ path, onNavigate, basePath = '/', hrefForPath }: Br
               {isLast ? (
                 <span className="text-duck-dark font-semibold">{segment}</span>
               ) : (
-                <Crumb
-                  to={segmentPath}
-                  className="text-duck-forest hover:text-duck-teal transition-colors cursor-pointer font-medium"
-                >
+                <Crumb to={segmentPath} className="text-duck-teal cursor-pointer font-medium">
                   {segment}
                 </Crumb>
               )}

src/workspaces/officerdev/src/hooks/useChat.ts

@@ -185,6 +185,19 @@ export function useChat(initialSessionId?: string, initialModel?: string | null,
   // `session:claude` (start of turn) and `result` (end), so a chat started in this tab becomes
   // reattachable the moment the harness names its transcript rather than when the turn finishes.
   const claudeSessionIdRef = useRef<string | null>(resumeSessionId ?? null);
+  /**
+   * The same value as state, for callers that have to RENDER or navigate on it.
+   *
+   * The ref above cannot serve that: it is deliberately a ref so the reconnect handshake can read it
+   * synchronously, which means writing it triggers no re-render and nothing outside can react to it.
+   *
+   * Command HQ needed exactly that and could not have it. `NewCommander` navigates once the transcript
+   * id is known, so a refresh resumes the same conversation — but the only id it could see was
+   * `sessionId`, which `session:init` sets to OFFICER's key. So it navigated to the wrong id, the
+   * commander was filed under the transcript id, and every fetch for that page 404'd: a commander that
+   * had genuinely run, cost money and answered correctly showed "Send a message to start".
+   */
+  const [claudeSessionId, setClaudeSessionId] = useState<string | null>(resumeSessionId ?? null);
 
   const client = useClient();
 
@@ -328,6 +341,7 @@ export function useChat(initialSessionId?: string, initialModel?: string | null,
         // here rather than at `result` is the difference between "refresh mid-turn and lose the turn" and
         // "refresh mid-turn and watch it carry on".
         claudeSessionIdRef.current = msg.claudeSessionId;
+        setClaudeSessionId(msg.claudeSessionId);
         if (replaceUrl) writePermalink(msg.claudeSessionId);
         break;
 
@@ -391,6 +405,7 @@ export function useChat(initialSessionId?: string, initialModel?: string | null,
         // (`msg.sessionId || randomUUID()`) that `/chat/sessions/:id` cannot resolve.
         if (msg.claudeSessionId) {
           claudeSessionIdRef.current = msg.claudeSessionId;
+          setClaudeSessionId(msg.claudeSessionId);
           if (replaceUrl) writePermalink(msg.claudeSessionId);
         }
         commitStreaming();
@@ -830,6 +845,8 @@ export function useChat(initialSessionId?: string, initialModel?: string | null,
     isConnected,
     isGenerating,
     sessionId,
+    /** Claude's own transcript id — what a commander is filed under, and what a permalink must use. */
+    claudeSessionId,
     model,
     selectedModel,
     hasStarted,

src/workspaces/state/src/useClaudeSessions.ts

@@ -96,6 +96,14 @@ export type ClaudeSessionDetail = {
   title?: string | null;
   /** Transcripts spliced into `messages` — `> 1` when this is a merged `/clear` chain. */
   partCount?: number;
+  /**
+   * A commander rather than an ordinary conversation, derived server-side from this session's own cwd.
+   *
+   * It travels with the SESSION and not with the screen, which is the whole point. The composer decides
+   * whether to offer "exit and hand back, then re-arm" — the only fire behaviour a watcher wants — and used
+   * to decide it from the route, so the same commander opened in /chat quietly lost it.
+   */
+  isCommander?: boolean;
 };
 
 export type ClaudePwd = { cwd: string; sessionCount: number; updatedAt: string; isDefault: boolean };

src/workspaces/state/src/useLiveSessions.ts

@@ -26,6 +26,14 @@ export type LiveSession = {
    */
   title: string | null;
   cwd: string | null;
+  /**
+   * A commander rather than an ordinary chat, derived server-side from the cwd.
+   *
+   * Every consumer of this list needs it, and one of them cannot work around its absence. The sessions
+   * panel splits Live into two tabs; the iPhone app swipes between live chats, has no tabs, and so can only
+   * keep a deploy commander out of that swipe order if the payload names it.
+   */
+  isCommander: boolean;
 };
 
 const LIVE_KEY = 'CHAT_LIVE_SESSIONS';

src/workspaces/theme/css/index.css

@@ -41,4 +41,208 @@
 @import './themes/vantablack.css';
 @import './themes/white.css';
 
+/* Community themes — ported from omarchythemes.com by scripts/port-community-themes.ts. Do not edit this block. */
+@import './themes/aamis.css';
+@import './themes/ado.css';
+@import './themes/adrift.css';
+@import './themes/aetheria.css';
+@import './themes/akaito.css';
+@import './themes/all-hallows-eve.css';
+@import './themes/amberbyte.css';
+@import './themes/amekoji.css';
+@import './themes/andromeda.css';
+@import './themes/anonymous.css';
+@import './themes/apocalypse.css';
+@import './themes/arc-blueberry.css';
+@import './themes/archriot.css';
+@import './themes/archwave.css';
+@import './themes/artzen.css';
+@import './themes/ash.css';
+@import './themes/astrodark.css';
+@import './themes/atari.css';
+@import './themes/atelier.css';
+@import './themes/aura.css';
+@import './themes/ayu-dark.css';
+@import './themes/ayu-light.css';
+@import './themes/ayu-mirage.css';
+@import './themes/azure.css';
+@import './themes/azure-glow.css';
+@import './themes/bad-hand.css';
+@import './themes/batman.css';
+@import './themes/batou.css';
+@import './themes/bauhaus.css';
+@import './themes/beachvan.css';
+@import './themes/beta.css';
+@import './themes/biscuit-de-mar-dark.css';
+@import './themes/black-arch.css';
+@import './themes/black-gold.css';
+@import './themes/black-money.css';
+@import './themes/blackturq.css';
+@import './themes/blackwall.css';
+@import './themes/blueridge.css';
+@import './themes/brutalism.css';
+@import './themes/caroline-skyline.css';
+@import './themes/catppuccin-mocha.css';
+@import './themes/cattpuccin-glass.css';
+@import './themes/city-783.css';
+@import './themes/copper-night.css';
+@import './themes/corporate.css';
+@import './themes/cpunk.css';
+@import './themes/crimson.css';
+@import './themes/crimson-gold.css';
+@import './themes/cyberpunk-2.css';
+@import './themes/dark-xp.css';
+@import './themes/dayfox.css';
+@import './themes/dead-space.css';
+@import './themes/deckard.css';
+@import './themes/delete.css';
+@import './themes/delorean.css';
+@import './themes/demon.css';
+@import './themes/desert-gleam.css';
+@import './themes/desert-twilight.css';
+@import './themes/dotrb.css';
+@import './themes/drac.css';
+@import './themes/dracula.css';
+@import './themes/dragon.css';
+@import './themes/dreamwave.css';
+@import './themes/elysian.css';
+@import './themes/ember-n-ash.css';
+@import './themes/eva-unit-01.css';
+@import './themes/event-horizon.css';
+@import './themes/everblush.css';
+@import './themes/evergarden.css';
+@import './themes/farline.css';
+@import './themes/felix.css';
+@import './themes/fiery-ocean.css';
+@import './themes/fireside.css';
+@import './themes/firesky.css';
+@import './themes/flat-dracula.css';
+@import './themes/flexoki-dark.css';
+@import './themes/florida-man.css';
+@import './themes/fluid-glass.css';
+@import './themes/forest-green.css';
+@import './themes/frost.css';
+@import './themes/futurism.css';
+@import './themes/ghost-pastel.css';
+@import './themes/glory-antic.css';
+@import './themes/gold-rush.css';
+@import './themes/gornergrat-station.css';
+@import './themes/gotham-city.css';
+@import './themes/greek-noir.css';
+@import './themes/green-city.css';
+@import './themes/green-garden.css';
+@import './themes/gruber-tsoding.css';
+@import './themes/grudark.css';
+@import './themes/harbor.css';
+@import './themes/harbor-dark.css';
+@import './themes/hex.css';
+@import './themes/himalaya.css';
+@import './themes/hinterlands.css';
+@import './themes/hollow-knight.css';
+@import './themes/infernium.css';
+@import './themes/infernium-dark.css';
+@import './themes/inkypinky.css';
+@import './themes/kanso.css';
+@import './themes/killer-klowns.css';
+@import './themes/kimiko.css';
+@import './themes/koyanagi.css';
+@import './themes/kurayami.css';
+@import './themes/lain.css';
+@import './themes/lairetam.css';
+@import './themes/latch.css';
+@import './themes/latch-dark.css';
+@import './themes/lilly.css';
+@import './themes/lowlight.css';
+@import './themes/lunar.css';
+@import './themes/manga.css';
+@import './themes/mapquest.css';
+@import './themes/mars.css';
+@import './themes/mecha-no-onna.css';
+@import './themes/memento-mori.css';
+@import './themes/midnight.css';
+@import './themes/miles-morales.css';
+@import './themes/milkmatcha-light.css';
+@import './themes/mocha.css';
+@import './themes/monochrome.css';
+@import './themes/monokai.css';
+@import './themes/monokai-dark.css';
+@import './themes/monolith.css';
+@import './themes/monolith-2.css';
+@import './themes/moodpeak.css';
+@import './themes/moon-orbit.css';
+@import './themes/nagai-poolside.css';
+@import './themes/nagai-twilight.css';
+@import './themes/nebulite.css';
+@import './themes/neo-sploosh.css';
+@import './themes/neon-street.css';
+@import './themes/neovoid.css';
+@import './themes/nes.css';
+@import './themes/night-owl.css';
+@import './themes/nyc.css';
+@import './themes/one-dark-pro.css';
+@import './themes/oxford.css';
+@import './themes/oxocarbon-dark.css';
+@import './themes/pandora.css';
+@import './themes/phosphor-os.css';
+@import './themes/pina.css';
+@import './themes/pink-blood.css';
+@import './themes/pmndrs.css';
+@import './themes/pulsar.css';
+@import './themes/purple-moon.css';
+@import './themes/purplewave.css';
+@import './themes/rainy-night.css';
+@import './themes/rdddcs.css';
+@import './themes/red-monarch.css';
+@import './themes/retropc.css';
+@import './themes/reverie.css';
+@import './themes/robco.css';
+@import './themes/robco-mojave.css';
+@import './themes/rose-pine-dark.css';
+@import './themes/roseofdune.css';
+@import './themes/royal.css';
+@import './themes/rustleaf.css';
+@import './themes/saga.css';
+@import './themes/sakura.css';
+@import './themes/sapphire.css';
+@import './themes/seashells.css';
+@import './themes/serenity.css';
+@import './themes/shadesofjade.css';
+@import './themes/snow.css';
+@import './themes/snow-black.css';
+@import './themes/solarized.css';
+@import './themes/solarized-light.css';
+@import './themes/solarized-osaka.css';
+@import './themes/space-bound.css';
+@import './themes/space-monkey.css';
+@import './themes/spark.css';
+@import './themes/spectra.css';
+@import './themes/stellar.css';
+@import './themes/stillmoon.css';
+@import './themes/sunkissed.css';
+@import './themes/sunset.css';
+@import './themes/synthetica.css';
+@import './themes/synthwave-84.css';
+@import './themes/taikami.css';
+@import './themes/tarot.css';
+@import './themes/temerald.css';
+@import './themes/terramour.css';
+@import './themes/thegreek.css';
+@import './themes/turbonite.css';
+@import './themes/tycho.css';
+@import './themes/type-17.css';
+@import './themes/unicorn-dream.css';
+@import './themes/van-gogh.css';
+@import './themes/velocity.css';
+@import './themes/velvet-night.css';
+@import './themes/vesper.css';
+@import './themes/vhs80.css';
+@import './themes/vice-city.css';
+@import './themes/void.css';
+@import './themes/vurple.css';
+@import './themes/wasteland.css';
+@import './themes/waveform-dark.css';
+@import './themes/white-gold.css';
+@import './themes/x-1632.css';
+@import './themes/yuugure.css';
+
 @import './chrome.css';

src/workspaces/theme/css/themes/aamis.css

@@ -0,0 +1,97 @@
+/*
+  Aamis — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/vyrx-dev/omarchy-aamis-theme (colors.toml (16-colour ANSI)), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='aamis'] {
+  --background: #080808;
+  --foreground: #eadccc;
+  --card: #0f0f0f;
+  --card-foreground: #eadccc;
+  --popover: #0f0f0f;
+  --popover-foreground: #eadccc;
+  --muted: #202020;
+  --muted-foreground: #a89f93;
+  --accent: #202020;
+  --accent-foreground: #eadccc;
+  --primary: #eacea7;
+  --primary-foreground: #080808;
+  --secondary: #202020;
+  --secondary-foreground: #eadccc;
+  --cta: #eacea7;
+  --cta-foreground: #080808;
+  --ctahover: #edd4b2;
+  --success: #cea37f;
+  --success-foreground: #080808;
+  --warning: #f4bb54;
+  --warning-foreground: #080808;
+  --destructive: #e25d6c;
+  --destructive-foreground: #080808;
+  --info: #e2be8a;
+  --info-foreground: #080808;
+  --busy: #eb8c60;
+  --busy-foreground: #080808;
+  --busy-ink: #eb8c60;
+  --border: #3a3734;
+  --input: #3a3734;
+  --ring: #eacea7;
+  --radius: 0.625rem;
+  --chart-primary: #eacea7;
+  --chart-secondary: #ede4c8;
+  --status-success: #cea37f;
+  --status-warning: #f4bb54;
+  --status-in-progress: #e2be8a;
+  --page-bg: #080808;
+  --page-bg-src: '';
+  --panel-bg: rgb(15 15 15 / 0.72);
+  --panel-border: rgb(58 55 52 / 0.9);
+  --panel-border-bare: rgb(58 55 52 / 0.55);
+  --panel-raised-bg: rgb(15 15 15 / 0.95);
+  --panel-raised-border: rgb(58 55 52 / 1);
+  --panel-accent: #eacea7;
+  --panel-header-bg: rgb(32 32 32 / 0.6);
+  --panel-header-fg: #eadccc;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #0f0f0f;
+  --glass-bg: rgb(15 15 15 / 0.55);
+  --glass-border: rgb(58 55 52 / 0.7);
+  --dock-bg: rgb(15 15 15 / 0.7);
+  --dock-border: rgb(58 55 52 / 0.8);
+  --dock-tooltip-bg: #202020;
+  --header-bg: rgb(15 15 15 / 0.8);
+  --header-border: rgb(58 55 52 / 0.9);
+  --header-fg: #eadccc;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(114 107 100 / 0.07);
+  --card-grid-color: rgb(114 107 100 / 0.05);
+  --panel-grid-color: rgb(114 107 100 / 0.06);
+  --scrollbar-thumb: rgb(112 106 106 / 0.6);
+  --scrollbar-thumb-hover: rgb(112 106 106 / 0.85);
+  --scrollbar-thin-thumb: rgb(112 106 106 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(112 106 106 / 0.7);
+  --brand: #eacea7;
+  --brand-foreground: #080808;
+  --brand-primary: #eacea7;
+  --brand-accent: #e8ab3b;
+  --brand-warm: #eb8c60;
+  --brand-deep: #080808;
+  --brand-muted: #706a6a;
+  --ink: #eadccc;
+  --surface-warm: #0f0f0f;
+  --naturegreen: #cea37f;
+  --naturegreen-foreground: #080808;
+  --duck-dark: #eadccc;
+  --duck-teal: #e8ab3b;
+  --duck-yellow: #f4bb54;
+  --duck-orange: #eb8c60;
+  --duck-forest: #cea37f;
+  --duck-beige: #252422;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/ado.css

@@ -0,0 +1,97 @@
+/*
+  Ado — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/errantProgrammer/omarchy-ado-theme (alacritty.toml), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='ado'] {
+  --background: #070708;
+  --foreground: #dfdee6;
+  --card: #0d0d0f;
+  --card-foreground: #dfdee6;
+  --popover: #0d0d0f;
+  --popover-foreground: #dfdee6;
+  --muted: #1e1e20;
+  --muted-foreground: #a09fa6;
+  --accent: #1e1e20;
+  --accent-foreground: #dfdee6;
+  --primary: #a2e0ee;
+  --primary-foreground: #070708;
+  --secondary: #1e1e20;
+  --secondary-foreground: #dfdee6;
+  --cta: #a2e0ee;
+  --cta-foreground: #070708;
+  --ctahover: #ade4f0;
+  --success: #014761;
+  --success-foreground: #dfdee6;
+  --warning: #8bb0c6;
+  --warning-foreground: #070708;
+  --destructive: #903034;
+  --destructive-foreground: #dfdee6;
+  --info: #4545f5;
+  --info-foreground: #dfdee6;
+  --busy: #8e707d;
+  --busy-foreground: #070708;
+  --busy-ink: #8e707d;
+  --border: #363639;
+  --input: #363639;
+  --ring: #a2e0ee;
+  --radius: 0.625rem;
+  --chart-primary: #a2e0ee;
+  --chart-secondary: #25516a;
+  --status-success: #014761;
+  --status-warning: #8bb0c6;
+  --status-in-progress: #4545f5;
+  --page-bg: #070708;
+  --page-bg-src: '';
+  --panel-bg: rgb(13 13 15 / 0.72);
+  --panel-border: rgb(54 54 57 / 0.9);
+  --panel-border-bare: rgb(54 54 57 / 0.55);
+  --panel-raised-bg: rgb(13 13 15 / 0.95);
+  --panel-raised-border: rgb(54 54 57 / 1);
+  --panel-accent: #a2e0ee;
+  --panel-header-bg: rgb(30 30 32 / 0.6);
+  --panel-header-fg: #dfdee6;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #0d0d0f;
+  --glass-bg: rgb(13 13 15 / 0.55);
+  --glass-border: rgb(54 54 57 / 0.7);
+  --dock-bg: rgb(13 13 15 / 0.7);
+  --dock-border: rgb(54 54 57 / 0.8);
+  --dock-tooltip-bg: #1e1e20;
+  --header-bg: rgb(13 13 15 / 0.8);
+  --header-border: rgb(54 54 57 / 0.9);
+  --header-fg: #dfdee6;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(107 107 112 / 0.07);
+  --card-grid-color: rgb(107 107 112 / 0.05);
+  --panel-grid-color: rgb(107 107 112 / 0.06);
+  --scrollbar-thumb: rgb(144 142 170 / 0.6);
+  --scrollbar-thumb-hover: rgb(144 142 170 / 0.85);
+  --scrollbar-thin-thumb: rgb(144 142 170 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(144 142 170 / 0.7);
+  --brand: #a2e0ee;
+  --brand-foreground: #070708;
+  --brand-primary: #a2e0ee;
+  --brand-accent: #45c1dd;
+  --brand-warm: #8e707d;
+  --brand-deep: #070708;
+  --brand-muted: #908eaa;
+  --ink: #dfdee6;
+  --surface-warm: #0d0d0f;
+  --naturegreen: #014761;
+  --naturegreen-foreground: #dfdee6;
+  --duck-dark: #dfdee6;
+  --duck-teal: #45c1dd;
+  --duck-yellow: #8bb0c6;
+  --duck-orange: #8e707d;
+  --duck-forest: #014761;
+  --duck-beige: #222225;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/adrift.css

@@ -0,0 +1,97 @@
+/*
+  Adrift — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/jaredb1011/omarchy-adrift-theme (alacritty.toml), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='adrift'] {
+  --background: #0e1715;
+  --foreground: #ddd6c2;
+  --card: #1a2927;
+  --card-foreground: #ddd6c2;
+  --popover: #1a2927;
+  --popover-foreground: #ddd6c2;
+  --muted: #2a3836;
+  --muted-foreground: #a3a294;
+  --accent: #2a3836;
+  --accent-foreground: #ddd6c2;
+  --primary: #94d0d0;
+  --primary-foreground: #0e1715;
+  --secondary: #2a3836;
+  --secondary-foreground: #ddd6c2;
+  --cta: #94d0d0;
+  --cta-foreground: #0e1715;
+  --ctahover: #a1d6d6;
+  --success: #66987b;
+  --success-foreground: #0e1715;
+  --warning: #bfa26b;
+  --warning-foreground: #0e1715;
+  --destructive: #cb645d;
+  --destructive-foreground: #0e1715;
+  --info: #a9bfbf;
+  --info-foreground: #0e1715;
+  --busy: #c58364;
+  --busy-foreground: #0e1715;
+  --busy-ink: #c58364;
+  --border: #404b46;
+  --input: #404b46;
+  --ring: #94d0d0;
+  --radius: 0.625rem;
+  --chart-primary: #94d0d0;
+  --chart-secondary: #9a5840;
+  --status-success: #66987b;
+  --status-warning: #bfa26b;
+  --status-in-progress: #a9bfbf;
+  --page-bg: #0e1715;
+  --page-bg-src: '';
+  --panel-bg: rgb(26 41 39 / 0.72);
+  --panel-border: rgb(64 75 70 / 0.9);
+  --panel-border-bare: rgb(64 75 70 / 0.55);
+  --panel-raised-bg: rgb(26 41 39 / 0.95);
+  --panel-raised-border: rgb(64 75 70 / 1);
+  --panel-accent: #94d0d0;
+  --panel-header-bg: rgb(42 56 54 / 0.6);
+  --panel-header-fg: #ddd6c2;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #1a2927;
+  --glass-bg: rgb(26 41 39 / 0.55);
+  --glass-border: rgb(64 75 70 / 0.7);
+  --dock-bg: rgb(26 41 39 / 0.7);
+  --dock-border: rgb(64 75 70 / 0.8);
+  --dock-tooltip-bg: #2a3836;
+  --header-bg: rgb(26 41 39 / 0.8);
+  --header-border: rgb(64 75 70 / 0.9);
+  --header-fg: #ddd6c2;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(114 119 109 / 0.07);
+  --card-grid-color: rgb(114 119 109 / 0.05);
+  --panel-grid-color: rgb(114 119 109 / 0.06);
+  --scrollbar-thumb: rgb(181 181 181 / 0.6);
+  --scrollbar-thumb-hover: rgb(181 181 181 / 0.85);
+  --scrollbar-thin-thumb: rgb(181 181 181 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(181 181 181 / 0.7);
+  --brand: #94d0d0;
+  --brand-foreground: #0e1715;
+  --brand-primary: #94d0d0;
+  --brand-accent: #a9bfbf;
+  --brand-warm: #c58364;
+  --brand-deep: #0e1715;
+  --brand-muted: #b5b5b5;
+  --ink: #ddd6c2;
+  --surface-warm: #1a2927;
+  --naturegreen: #66987b;
+  --naturegreen-foreground: #0e1715;
+  --duck-dark: #ddd6c2;
+  --duck-teal: #a9bfbf;
+  --duck-yellow: #bfa26b;
+  --duck-orange: #c58364;
+  --duck-forest: #66987b;
+  --duck-beige: #2e3a37;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/aetheria.css

@@ -0,0 +1,97 @@
+/*
+  Aetheria — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/JJDizz1L/aetheria (colors.toml (16-colour ANSI)), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='aetheria'] {
+  --background: #080510;
+  --foreground: #14b9b5;
+  --card: #0e091d;
+  --card-foreground: #14b9b5;
+  --popover: #0e091d;
+  --popover-foreground: #14b9b5;
+  --muted: #1f1a2d;
+  --muted-foreground: #309396;
+  --accent: #1f1a2d;
+  --accent-foreground: #14b9b5;
+  --primary: #ffbe74;
+  --primary-foreground: #080510;
+  --secondary: #1f1a2d;
+  --secondary-foreground: #14b9b5;
+  --cta: #ffbe74;
+  --cta-foreground: #080510;
+  --ctahover: #ffc685;
+  --success: #e20342;
+  --success-foreground: #f9f9f9;
+  --warning: #7cd699;
+  --warning-foreground: #080510;
+  --destructive: #c8e967;
+  --destructive-foreground: #080510;
+  --info: #be3f50;
+  --info-foreground: #f3f3f3;
+  --busy: #a2e080;
+  --busy-foreground: #080510;
+  --busy-ink: #a2e080;
+  --border: #0f2b3b;
+  --input: #0f2b3b;
+  --ring: #ffbe74;
+  --radius: 0.625rem;
+  --chart-primary: #ffbe74;
+  --chart-secondary: #9147a8;
+  --status-success: #e20342;
+  --status-warning: #7cd699;
+  --status-in-progress: #be3f50;
+  --page-bg: #080510;
+  --page-bg-src: '';
+  --panel-bg: rgb(14 9 29 / 0.72);
+  --panel-border: rgb(15 43 59 / 0.9);
+  --panel-border-bare: rgb(15 43 59 / 0.55);
+  --panel-raised-bg: rgb(14 9 29 / 0.95);
+  --panel-raised-border: rgb(15 43 59 / 1);
+  --panel-accent: #ffbe74;
+  --panel-header-bg: rgb(31 26 45 / 0.6);
+  --panel-header-fg: #14b9b5;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #0e091d;
+  --glass-bg: rgb(14 9 29 / 0.55);
+  --glass-border: rgb(15 43 59 / 0.7);
+  --dock-bg: rgb(14 9 29 / 0.7);
+  --dock-border: rgb(15 43 59 / 0.8);
+  --dock-tooltip-bg: #1f1a2d;
+  --header-bg: rgb(14 9 29 / 0.8);
+  --header-border: rgb(15 43 59 / 0.9);
+  --header-fg: #14b9b5;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(41 105 113 / 0.07);
+  --card-grid-color: rgb(41 105 113 / 0.05);
+  --panel-grid-color: rgb(41 105 113 / 0.06);
+  --scrollbar-thumb: rgb(197 50 83 / 0.6);
+  --scrollbar-thumb-hover: rgb(197 50 83 / 0.85);
+  --scrollbar-thin-thumb: rgb(197 50 83 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(197 50 83 / 0.7);
+  --brand: #ffbe74;
+  --brand-foreground: #080510;
+  --brand-primary: #ffbe74;
+  --brand-accent: #ff7f41;
+  --brand-warm: #a2e080;
+  --brand-deep: #080510;
+  --brand-muted: #c53253;
+  --ink: #14b9b5;
+  --surface-warm: #0e091d;
+  --naturegreen: #e20342;
+  --naturegreen-foreground: #f9f9f9;
+  --duck-dark: #14b9b5;
+  --duck-teal: #ff7f41;
+  --duck-yellow: #7cd699;
+  --duck-orange: #a2e080;
+  --duck-forest: #e20342;
+  --duck-beige: #0f1b2c;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/akaito.css

@@ -0,0 +1,97 @@
+/*
+  Akaito — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Light theme (light), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/stannorbvb-cmd/akaito (colors.toml (16-colour ANSI)), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='akaito'] {
+  --background: #f3e4cb;
+  --foreground: #4d2e1a;
+  --card: #eadcc4;
+  --card-foreground: #4d2e1a;
+  --popover: #eadcc4;
+  --popover-foreground: #4d2e1a;
+  --muted: #e4d6bf;
+  --muted-foreground: #6f5845;
+  --accent: #e4d6bf;
+  --accent-foreground: #4d2e1a;
+  --primary: #a32f1a;
+  --primary-foreground: #dbcdb7;
+  --secondary: #e4d6bf;
+  --secondary-foreground: #4d2e1a;
+  --cta: #a32f1a;
+  --cta-foreground: #dbcdb7;
+  --ctahover: #8f2917;
+  --success: #a46d2d;
+  --success-foreground: #0b0a09;
+  --warning: #a8611f;
+  --warning-foreground: #faf8f4;
+  --destructive: #a4373c;
+  --destructive-foreground: #e0d5c2;
+  --info: #a32f1a;
+  --info-foreground: #dbcdb7;
+  --busy: #a64c2e;
+  --busy-foreground: #ece5d9;
+  --busy-ink: #a64c2e;
+  --border: #d8c7b0;
+  --input: #d3c2ac;
+  --ring: #a32f1a;
+  --radius: 0.625rem;
+  --chart-primary: #a32f1a;
+  --chart-secondary: #9c3521;
+  --status-success: #a46d2d;
+  --status-warning: #a8611f;
+  --status-in-progress: #a32f1a;
+  --page-bg: #f3e4cb;
+  --page-bg-src: '';
+  --panel-bg: rgb(234 220 196 / 0.72);
+  --panel-border: rgb(216 199 176 / 0.9);
+  --panel-border-bare: rgb(216 199 176 / 0.55);
+  --panel-raised-bg: rgb(234 220 196 / 0.95);
+  --panel-raised-border: rgb(216 199 176 / 1);
+  --panel-accent: #a32f1a;
+  --panel-header-bg: rgb(228 214 191 / 0.6);
+  --panel-header-fg: #4d2e1a;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #eadcc4;
+  --glass-bg: rgb(234 220 196 / 0.55);
+  --glass-border: rgb(216 199 176 / 0.7);
+  --dock-bg: rgb(234 220 196 / 0.7);
+  --dock-border: rgb(216 199 176 / 0.8);
+  --dock-tooltip-bg: #e4d6bf;
+  --header-bg: rgb(234 220 196 / 0.8);
+  --header-border: rgb(216 199 176 / 0.9);
+  --header-fg: #4d2e1a;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(139 120 101 / 0.07);
+  --card-grid-color: rgb(139 120 101 / 0.05);
+  --panel-grid-color: rgb(139 120 101 / 0.06);
+  --scrollbar-thumb: rgb(159 130 83 / 0.6);
+  --scrollbar-thumb-hover: rgb(159 130 83 / 0.85);
+  --scrollbar-thin-thumb: rgb(159 130 83 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(159 130 83 / 0.7);
+  --brand: #a32f1a;
+  --brand-foreground: #dbcdb7;
+  --brand-primary: #a32f1a;
+  --brand-accent: #755833;
+  --brand-warm: #a64c2e;
+  --brand-deep: #e4d6bf;
+  --brand-muted: #9f8253;
+  --ink: #4d2e1a;
+  --surface-warm: #eadcc4;
+  --naturegreen: #a46d2d;
+  --naturegreen-foreground: #0b0a09;
+  --duck-dark: #4d2e1a;
+  --duck-teal: #755833;
+  --duck-yellow: #a8611f;
+  --duck-orange: #a64c2e;
+  --duck-forest: #a46d2d;
+  --duck-beige: #dacbb3;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/all-hallows-eve.css

@@ -0,0 +1,97 @@
+/*
+  All Hallows Eve — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/guilhermetk/omarchy-all-hallows-eve-theme (alacritty.toml), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='all-hallows-eve'] {
+  --background: #000000;
+  --foreground: #ffffff;
+  --card: #000000;
+  --card-foreground: #ffffff;
+  --popover: #000000;
+  --popover-foreground: #ffffff;
+  --muted: #121212;
+  --muted-foreground: #b3b3b3;
+  --accent: #121212;
+  --accent-foreground: #ffffff;
+  --primary: #cccc33;
+  --primary-foreground: #000000;
+  --secondary: #121212;
+  --secondary-foreground: #ffffff;
+  --cta: #cccc33;
+  --cta-foreground: #000000;
+  --ctahover: #d2d24b;
+  --success: #66cc33;
+  --success-foreground: #000000;
+  --warning: #cc7833;
+  --warning-foreground: #000000;
+  --destructive: #c83730;
+  --destructive-foreground: #ffffff;
+  --info: #3387cc;
+  --info-foreground: #000000;
+  --busy: #ca5832;
+  --busy-foreground: #000000;
+  --busy-ink: #ca5832;
+  --border: #323232;
+  --input: #323232;
+  --ring: #cccc33;
+  --radius: 0.625rem;
+  --chart-primary: #cccc33;
+  --chart-secondary: #9933cc;
+  --status-success: #66cc33;
+  --status-warning: #cc7833;
+  --status-in-progress: #3387cc;
+  --page-bg: #000000;
+  --page-bg-src: '';
+  --panel-bg: rgb(0 0 0 / 0.72);
+  --panel-border: rgb(50 50 50 / 0.9);
+  --panel-border-bare: rgb(50 50 50 / 0.55);
+  --panel-raised-bg: rgb(0 0 0 / 0.95);
+  --panel-raised-border: rgb(50 50 50 / 1);
+  --panel-accent: #cccc33;
+  --panel-header-bg: rgb(18 18 18 / 0.6);
+  --panel-header-fg: #ffffff;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #000000;
+  --glass-bg: rgb(0 0 0 / 0.55);
+  --glass-border: rgb(50 50 50 / 0.7);
+  --dock-bg: rgb(0 0 0 / 0.7);
+  --dock-border: rgb(50 50 50 / 0.8);
+  --dock-tooltip-bg: #121212;
+  --header-bg: rgb(0 0 0 / 0.8);
+  --header-border: rgb(50 50 50 / 0.9);
+  --header-fg: #ffffff;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(115 115 115 / 0.07);
+  --card-grid-color: rgb(115 115 115 / 0.05);
+  --panel-grid-color: rgb(115 115 115 / 0.06);
+  --scrollbar-thumb: rgb(64 64 64 / 0.6);
+  --scrollbar-thumb-hover: rgb(64 64 64 / 0.85);
+  --scrollbar-thin-thumb: rgb(64 64 64 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(64 64 64 / 0.7);
+  --brand: #cccc33;
+  --brand-foreground: #000000;
+  --brand-primary: #cccc33;
+  --brand-accent: #cccc33;
+  --brand-warm: #ca5832;
+  --brand-deep: #000000;
+  --brand-muted: #404040;
+  --ink: #ffffff;
+  --surface-warm: #000000;
+  --naturegreen: #66cc33;
+  --naturegreen-foreground: #000000;
+  --duck-dark: #ffffff;
+  --duck-teal: #cccc33;
+  --duck-yellow: #cc7833;
+  --duck-orange: #ca5832;
+  --duck-forest: #66cc33;
+  --duck-beige: #1a1a1a;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/amberbyte.css

@@ -0,0 +1,97 @@
+/*
+  Amberbyte — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/tahfizhabib/omarchy-amberbyte-theme (alacritty.toml), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='amberbyte'] {
+  --background: #0f090a;
+  --foreground: #f2e8e8;
+  --card: #1b1112;
+  --card-foreground: #f2e8e8;
+  --popover: #1b1112;
+  --popover-foreground: #f2e8e8;
+  --muted: #2b2223;
+  --muted-foreground: #b2a8a8;
+  --accent: #2b2223;
+  --accent-foreground: #f2e8e8;
+  --primary: #f7b3b3;
+  --primary-foreground: #0f090a;
+  --secondary: #2b2223;
+  --secondary-foreground: #f2e8e8;
+  --cta: #f7b3b3;
+  --cta-foreground: #0f090a;
+  --ctahover: #f8bcbc;
+  --success: #c05a5a;
+  --success-foreground: #0f090a;
+  --warning: #d66b6b;
+  --warning-foreground: #0f090a;
+  --destructive: #b44a4a;
+  --destructive-foreground: #f5eded;
+  --info: #d66b6b;
+  --info-foreground: #0f090a;
+  --busy: #c55b5b;
+  --busy-foreground: #0f090a;
+  --busy-ink: #c55b5b;
+  --border: #453b3c;
+  --input: #453b3c;
+  --ring: #f7b3b3;
+  --radius: 0.625rem;
+  --chart-primary: #f7b3b3;
+  --chart-secondary: #d66b6b;
+  --status-success: #c05a5a;
+  --status-warning: #d66b6b;
+  --status-in-progress: #d66b6b;
+  --page-bg: #0f090a;
+  --page-bg-src: '';
+  --panel-bg: rgb(27 17 18 / 0.72);
+  --panel-border: rgb(69 59 60 / 0.9);
+  --panel-border-bare: rgb(69 59 60 / 0.55);
+  --panel-raised-bg: rgb(27 17 18 / 0.95);
+  --panel-raised-border: rgb(69 59 60 / 1);
+  --panel-accent: #f7b3b3;
+  --panel-header-bg: rgb(43 34 35 / 0.6);
+  --panel-header-fg: #f2e8e8;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #1b1112;
+  --glass-bg: rgb(27 17 18 / 0.55);
+  --glass-border: rgb(69 59 60 / 0.7);
+  --dock-bg: rgb(27 17 18 / 0.7);
+  --dock-border: rgb(69 59 60 / 0.8);
+  --dock-tooltip-bg: #2b2223;
+  --header-bg: rgb(27 17 18 / 0.8);
+  --header-border: rgb(69 59 60 / 0.9);
+  --header-fg: #f2e8e8;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(124 114 114 / 0.07);
+  --card-grid-color: rgb(124 114 114 / 0.05);
+  --panel-grid-color: rgb(124 114 114 / 0.06);
+  --scrollbar-thumb: rgb(113 103 104 / 0.6);
+  --scrollbar-thumb-hover: rgb(113 103 104 / 0.85);
+  --scrollbar-thin-thumb: rgb(113 103 104 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(113 103 104 / 0.7);
+  --brand: #f7b3b3;
+  --brand-foreground: #0f090a;
+  --brand-primary: #f7b3b3;
+  --brand-accent: #f48a8a;
+  --brand-warm: #c55b5b;
+  --brand-deep: #0f090a;
+  --brand-muted: #716768;
+  --ink: #f2e8e8;
+  --surface-warm: #1b1112;
+  --naturegreen: #c05a5a;
+  --naturegreen-foreground: #0f090a;
+  --duck-dark: #f2e8e8;
+  --duck-teal: #f48a8a;
+  --duck-yellow: #d66b6b;
+  --duck-orange: #c55b5b;
+  --duck-forest: #c05a5a;
+  --duck-beige: #312727;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/amekoji.css

@@ -0,0 +1,97 @@
+/*
+  Amekoji — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/atif-1402/omarchy-amekoji-theme (colors.toml (16-colour ANSI)), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='amekoji'] {
+  --background: #131617;
+  --foreground: #dcd6d6;
+  --card: #232829;
+  --card-foreground: #dcd6d6;
+  --popover: #232829;
+  --popover-foreground: #dcd6d6;
+  --muted: #323738;
+  --muted-foreground: #a5a2a2;
+  --accent: #323738;
+  --accent-foreground: #dcd6d6;
+  --primary: #98b3b3;
+  --primary-foreground: #131617;
+  --secondary: #323738;
+  --secondary-foreground: #dcd6d6;
+  --cta: #98b3b3;
+  --cta-foreground: #131617;
+  --ctahover: #a4bcbc;
+  --success: #98b3a3;
+  --success-foreground: #131617;
+  --warning: #93b3a6;
+  --warning-foreground: #131617;
+  --destructive: #b39a98;
+  --destructive-foreground: #131617;
+  --info: #85abbc;
+  --info-foreground: #131617;
+  --busy: #a3a79f;
+  --busy-foreground: #131617;
+  --busy-ink: #a3a79f;
+  --border: #474a4b;
+  --input: #474a4b;
+  --ring: #98b3b3;
+  --radius: 0.625rem;
+  --chart-primary: #98b3b3;
+  --chart-secondary: #bea7b0;
+  --status-success: #98b3a3;
+  --status-warning: #93b3a6;
+  --status-in-progress: #85abbc;
+  --page-bg: #131617;
+  --page-bg-src: '';
+  --panel-bg: rgb(35 40 41 / 0.72);
+  --panel-border: rgb(71 74 75 / 0.9);
+  --panel-border-bare: rgb(71 74 75 / 0.55);
+  --panel-raised-bg: rgb(35 40 41 / 0.95);
+  --panel-raised-border: rgb(71 74 75 / 1);
+  --panel-accent: #98b3b3;
+  --panel-header-bg: rgb(50 55 56 / 0.6);
+  --panel-header-fg: #dcd6d6;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #232829;
+  --glass-bg: rgb(35 40 41 / 0.55);
+  --glass-border: rgb(71 74 75 / 0.7);
+  --dock-bg: rgb(35 40 41 / 0.7);
+  --dock-border: rgb(71 74 75 / 0.8);
+  --dock-tooltip-bg: #323738;
+  --header-bg: rgb(35 40 41 / 0.8);
+  --header-border: rgb(71 74 75 / 0.9);
+  --header-fg: #dcd6d6;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(118 118 119 / 0.07);
+  --card-grid-color: rgb(118 118 119 / 0.05);
+  --panel-grid-color: rgb(118 118 119 / 0.06);
+  --scrollbar-thumb: rgb(120 133 135 / 0.6);
+  --scrollbar-thumb-hover: rgb(120 133 135 / 0.85);
+  --scrollbar-thin-thumb: rgb(120 133 135 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(120 133 135 / 0.7);
+  --brand: #98b3b3;
+  --brand-foreground: #131617;
+  --brand-primary: #98b3b3;
+  --brand-accent: #98b3b3;
+  --brand-warm: #a3a79f;
+  --brand-deep: #131617;
+  --brand-muted: #788587;
+  --ink: #dcd6d6;
+  --surface-warm: #232829;
+  --naturegreen: #98b3a3;
+  --naturegreen-foreground: #131617;
+  --duck-dark: #dcd6d6;
+  --duck-teal: #98b3b3;
+  --duck-yellow: #93b3a6;
+  --duck-orange: #a3a79f;
+  --duck-forest: #98b3a3;
+  --duck-beige: #36393a;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/andromeda.css

@@ -0,0 +1,97 @@
+/*
+  Andromeda — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/signaldirective/andromeda (colors.toml (16-colour ANSI)), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='andromeda'] {
+  --background: #131519;
+  --foreground: #e5e5e5;
+  --card: #23262e;
+  --card-foreground: #e5e5e5;
+  --popover: #23262e;
+  --popover-foreground: #e5e5e5;
+  --muted: #32353d;
+  --muted-foreground: #abacae;
+  --accent: #32353d;
+  --accent-foreground: #e5e5e5;
+  --primary: #00e8c6;
+  --primary-foreground: #131519;
+  --secondary: #32353d;
+  --secondary-foreground: #e5e5e5;
+  --cta: #00e8c6;
+  --cta-foreground: #131519;
+  --ctahover: #1febcd;
+  --success: #00e8c6;
+  --success-foreground: #131519;
+  --warning: #ffe66d;
+  --warning-foreground: #131519;
+  --destructive: #f92672;
+  --destructive-foreground: #131519;
+  --info: #7cb7ff;
+  --info-foreground: #131519;
+  --busy: #fc8670;
+  --busy-foreground: #131519;
+  --busy-ink: #fc8670;
+  --border: #494c52;
+  --input: #494c52;
+  --ring: #00e8c6;
+  --radius: 0.625rem;
+  --chart-primary: #00e8c6;
+  --chart-secondary: #c74ded;
+  --status-success: #00e8c6;
+  --status-warning: #ffe66d;
+  --status-in-progress: #7cb7ff;
+  --page-bg: #131519;
+  --page-bg-src: '';
+  --panel-bg: rgb(35 38 46 / 0.72);
+  --panel-border: rgb(73 76 82 / 0.9);
+  --panel-border-bare: rgb(73 76 82 / 0.55);
+  --panel-raised-bg: rgb(35 38 46 / 0.95);
+  --panel-raised-border: rgb(73 76 82 / 1);
+  --panel-accent: #00e8c6;
+  --panel-header-bg: rgb(50 53 61 / 0.6);
+  --panel-header-fg: #e5e5e5;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #23262e;
+  --glass-bg: rgb(35 38 46 / 0.55);
+  --glass-border: rgb(73 76 82 / 0.7);
+  --dock-bg: rgb(35 38 46 / 0.7);
+  --dock-border: rgb(73 76 82 / 0.8);
+  --dock-tooltip-bg: #32353d;
+  --header-bg: rgb(35 38 46 / 0.8);
+  --header-border: rgb(73 76 82 / 0.9);
+  --header-fg: #e5e5e5;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(122 124 128 / 0.07);
+  --card-grid-color: rgb(122 124 128 / 0.05);
+  --panel-grid-color: rgb(122 124 128 / 0.06);
+  --scrollbar-thumb: rgb(102 102 102 / 0.6);
+  --scrollbar-thumb-hover: rgb(102 102 102 / 0.85);
+  --scrollbar-thin-thumb: rgb(102 102 102 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(102 102 102 / 0.7);
+  --brand: #00e8c6;
+  --brand-foreground: #131519;
+  --brand-primary: #00e8c6;
+  --brand-accent: #96e072;
+  --brand-warm: #fc8670;
+  --brand-deep: #131519;
+  --brand-muted: #666666;
+  --ink: #e5e5e5;
+  --surface-warm: #23262e;
+  --naturegreen: #00e8c6;
+  --naturegreen-foreground: #131519;
+  --duck-dark: #e5e5e5;
+  --duck-teal: #96e072;
+  --duck-yellow: #ffe66d;
+  --duck-orange: #fc8670;
+  --duck-forest: #00e8c6;
+  --duck-beige: #363940;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/anonymous.css

@@ -0,0 +1,97 @@
+/*
+  Anonymous — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/j4v3l/omarchy-anonymous-theme (alacritty.toml), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='anonymous'] {
+  --background: #000000;
+  --foreground: #fefefe;
+  --card: #000000;
+  --card-foreground: #fefefe;
+  --popover: #000000;
+  --popover-foreground: #fefefe;
+  --muted: #121212;
+  --muted-foreground: #b2b2b2;
+  --accent: #121212;
+  --accent-foreground: #fefefe;
+  --primary: #bdbdbd;
+  --primary-foreground: #000000;
+  --secondary: #121212;
+  --secondary-foreground: #fefefe;
+  --cta: #bdbdbd;
+  --cta-foreground: #000000;
+  --ctahover: #c5c5c5;
+  --success: #bdbdbd;
+  --success-foreground: #000000;
+  --warning: #cfcfcf;
+  --warning-foreground: #000000;
+  --destructive: #fefefe;
+  --destructive-foreground: #000000;
+  --info: #bdbdbd;
+  --info-foreground: #000000;
+  --busy: #e7e7e7;
+  --busy-foreground: #000000;
+  --busy-ink: #e7e7e7;
+  --border: #323232;
+  --input: #323232;
+  --ring: #bdbdbd;
+  --radius: 0.625rem;
+  --chart-primary: #bdbdbd;
+  --chart-secondary: #bdbdbd;
+  --status-success: #bdbdbd;
+  --status-warning: #cfcfcf;
+  --status-in-progress: #bdbdbd;
+  --page-bg: #000000;
+  --page-bg-src: '';
+  --panel-bg: rgb(0 0 0 / 0.72);
+  --panel-border: rgb(50 50 50 / 0.9);
+  --panel-border-bare: rgb(50 50 50 / 0.55);
+  --panel-raised-bg: rgb(0 0 0 / 0.95);
+  --panel-raised-border: rgb(50 50 50 / 1);
+  --panel-accent: #bdbdbd;
+  --panel-header-bg: rgb(18 18 18 / 0.6);
+  --panel-header-fg: #fefefe;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #000000;
+  --glass-bg: rgb(0 0 0 / 0.55);
+  --glass-border: rgb(50 50 50 / 0.7);
+  --dock-bg: rgb(0 0 0 / 0.7);
+  --dock-border: rgb(50 50 50 / 0.8);
+  --dock-tooltip-bg: #121212;
+  --header-bg: rgb(0 0 0 / 0.8);
+  --header-border: rgb(50 50 50 / 0.9);
+  --header-fg: #fefefe;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(114 114 114 / 0.07);
+  --card-grid-color: rgb(114 114 114 / 0.05);
+  --panel-grid-color: rgb(114 114 114 / 0.06);
+  --scrollbar-thumb: rgb(26 26 26 / 0.6);
+  --scrollbar-thumb-hover: rgb(26 26 26 / 0.85);
+  --scrollbar-thin-thumb: rgb(26 26 26 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(26 26 26 / 0.7);
+  --brand: #bdbdbd;
+  --brand-foreground: #000000;
+  --brand-primary: #bdbdbd;
+  --brand-accent: #bdbdbd;
+  --brand-warm: #e7e7e7;
+  --brand-deep: #000000;
+  --brand-muted: #1a1a1a;
+  --ink: #fefefe;
+  --surface-warm: #000000;
+  --naturegreen: #bdbdbd;
+  --naturegreen-foreground: #000000;
+  --duck-dark: #fefefe;
+  --duck-teal: #bdbdbd;
+  --duck-yellow: #cfcfcf;
+  --duck-orange: #e7e7e7;
+  --duck-forest: #bdbdbd;
+  --duck-beige: #191919;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/apocalypse.css

@@ -0,0 +1,97 @@
+/*
+  Apocalypse — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/atif-1402/omarchy-apocalypse-theme (alacritty.toml), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='apocalypse'] {
+  --background: #090707;
+  --foreground: #ffffff;
+  --card: #110d0c;
+  --card-foreground: #ffffff;
+  --popover: #110d0c;
+  --popover-foreground: #ffffff;
+  --muted: #221e1d;
+  --muted-foreground: #b8b6b6;
+  --accent: #221e1d;
+  --accent-foreground: #ffffff;
+  --primary: #e7e9e9;
+  --primary-foreground: #090707;
+  --secondary: #221e1d;
+  --secondary-foreground: #ffffff;
+  --cta: #e7e9e9;
+  --cta-foreground: #090707;
+  --ctahover: #eaecec;
+  --success: #98a09b;
+  --success-foreground: #090707;
+  --warning: #d3c4b8;
+  --warning-foreground: #090707;
+  --destructive: #ab7c7c;
+  --destructive-foreground: #090707;
+  --info: #a8a8ae;
+  --info-foreground: #090707;
+  --busy: #bfa09a;
+  --busy-foreground: #090707;
+  --busy-ink: #bfa09a;
+  --border: #403c3c;
+  --input: #403c3c;
+  --ring: #e7e9e9;
+  --radius: 0.625rem;
+  --chart-primary: #e7e9e9;
+  --chart-secondary: #b6afb5;
+  --status-success: #98a09b;
+  --status-warning: #d3c4b8;
+  --status-in-progress: #a8a8ae;
+  --page-bg: #090707;
+  --page-bg-src: '';
+  --panel-bg: rgb(17 13 12 / 0.72);
+  --panel-border: rgb(64 60 60 / 0.9);
+  --panel-border-bare: rgb(64 60 60 / 0.55);
+  --panel-raised-bg: rgb(17 13 12 / 0.95);
+  --panel-raised-border: rgb(64 60 60 / 1);
+  --panel-accent: #e7e9e9;
+  --panel-header-bg: rgb(34 30 29 / 0.6);
+  --panel-header-fg: #ffffff;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #110d0c;
+  --glass-bg: rgb(17 13 12 / 0.55);
+  --glass-border: rgb(64 60 60 / 0.7);
+  --dock-bg: rgb(17 13 12 / 0.7);
+  --dock-border: rgb(64 60 60 / 0.8);
+  --dock-tooltip-bg: #221e1d;
+  --header-bg: rgb(17 13 12 / 0.8);
+  --header-border: rgb(64 60 60 / 0.9);
+  --header-fg: #ffffff;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(124 122 121 / 0.07);
+  --card-grid-color: rgb(124 122 121 / 0.05);
+  --panel-grid-color: rgb(124 122 121 / 0.06);
+  --scrollbar-thumb: rgb(140 123 118 / 0.6);
+  --scrollbar-thumb-hover: rgb(140 123 118 / 0.85);
+  --scrollbar-thin-thumb: rgb(140 123 118 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(140 123 118 / 0.7);
+  --brand: #e7e9e9;
+  --brand-foreground: #090707;
+  --brand-primary: #e7e9e9;
+  --brand-accent: #b8bdbc;
+  --brand-warm: #bfa09a;
+  --brand-deep: #090707;
+  --brand-muted: #8c7b76;
+  --ink: #ffffff;
+  --surface-warm: #110d0c;
+  --naturegreen: #98a09b;
+  --naturegreen-foreground: #090707;
+  --duck-dark: #ffffff;
+  --duck-teal: #b8bdbc;
+  --duck-yellow: #d3c4b8;
+  --duck-orange: #bfa09a;
+  --duck-forest: #98a09b;
+  --duck-beige: #292524;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/arc-blueberry.css

@@ -0,0 +1,97 @@
+/*
+  Arc Blueberry — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/vale-c/omarchy-arc-blueberry (alacritty.toml), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='arc-blueberry'] {
+  --background: #090b13;
+  --foreground: #bcc1dc;
+  --card: #111422;
+  --card-foreground: #bcc1dc;
+  --popover: #111422;
+  --popover-foreground: #bcc1dc;
+  --muted: #222431;
+  --muted-foreground: #898da4;
+  --accent: #222431;
+  --accent-foreground: #bcc1dc;
+  --primary: #0fffeb;
+  --primary-foreground: #090b13;
+  --secondary: #222431;
+  --secondary-foreground: #bcc1dc;
+  --cta: #0fffeb;
+  --cta-foreground: #090b13;
+  --ctahover: #2cffed;
+  --success: #3cec85;
+  --success-foreground: #090b13;
+  --warning: #eacd61;
+  --warning-foreground: #090b13;
+  --destructive: #e35535;
+  --destructive-foreground: #090b13;
+  --info: #69c3ff;
+  --info-foreground: #090b13;
+  --busy: #e7914b;
+  --busy-foreground: #090b13;
+  --busy-ink: #e7914b;
+  --border: #333646;
+  --input: #333646;
+  --ring: #0fffeb;
+  --radius: 0.625rem;
+  --chart-primary: #0fffeb;
+  --chart-secondary: #f38cec;
+  --status-success: #3cec85;
+  --status-warning: #eacd61;
+  --status-in-progress: #69c3ff;
+  --page-bg: #090b13;
+  --page-bg-src: '';
+  --panel-bg: rgb(17 20 34 / 0.72);
+  --panel-border: rgb(51 54 70 / 0.9);
+  --panel-border-bare: rgb(51 54 70 / 0.55);
+  --panel-raised-bg: rgb(17 20 34 / 0.95);
+  --panel-raised-border: rgb(51 54 70 / 1);
+  --panel-accent: #0fffeb;
+  --panel-header-bg: rgb(34 36 49 / 0.6);
+  --panel-header-fg: #bcc1dc;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #111422;
+  --glass-bg: rgb(17 20 34 / 0.55);
+  --glass-border: rgb(51 54 70 / 0.7);
+  --dock-bg: rgb(17 20 34 / 0.7);
+  --dock-border: rgb(51 54 70 / 0.8);
+  --dock-tooltip-bg: #222431;
+  --header-bg: rgb(17 20 34 / 0.8);
+  --header-border: rgb(51 54 70 / 0.9);
+  --header-fg: #bcc1dc;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(94 98 118 / 0.07);
+  --card-grid-color: rgb(94 98 118 / 0.05);
+  --panel-grid-color: rgb(94 98 118 / 0.06);
+  --scrollbar-thumb: rgb(49 59 98 / 0.6);
+  --scrollbar-thumb-hover: rgb(49 59 98 / 0.85);
+  --scrollbar-thin-thumb: rgb(49 59 98 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(49 59 98 / 0.7);
+  --brand: #0fffeb;
+  --brand-foreground: #090b13;
+  --brand-primary: #0fffeb;
+  --brand-accent: #22ecdb;
+  --brand-warm: #e7914b;
+  --brand-deep: #090b13;
+  --brand-muted: #313b62;
+  --ink: #bcc1dc;
+  --surface-warm: #111422;
+  --naturegreen: #3cec85;
+  --naturegreen-foreground: #090b13;
+  --duck-dark: #bcc1dc;
+  --duck-teal: #22ecdb;
+  --duck-yellow: #eacd61;
+  --duck-orange: #e7914b;
+  --duck-forest: #3cec85;
+  --duck-beige: #222535;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/archriot.css

@@ -0,0 +1,97 @@
+/*
+  Archriot — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/CyphrRiot/omarchy-archriot-theme (alacritty.toml), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='archriot'] {
+  --background: #0e0f15;
+  --foreground: #ffffff;
+  --card: #1a1b26;
+  --card-foreground: #ffffff;
+  --popover: #1a1b26;
+  --popover-foreground: #ffffff;
+  --muted: #2a2b35;
+  --muted-foreground: #babbbe;
+  --accent: #2a2b35;
+  --accent-foreground: #ffffff;
+  --primary: #73daca;
+  --primary-foreground: #0e0f15;
+  --secondary: #2a2b35;
+  --secondary-foreground: #ffffff;
+  --cta: #73daca;
+  --cta-foreground: #0e0f15;
+  --ctahover: #84ded0;
+  --success: #9ece6a;
+  --success-foreground: #0e0f15;
+  --warning: #e0af68;
+  --warning-foreground: #0e0f15;
+  --destructive: #ff7a93;
+  --destructive-foreground: #0e0f15;
+  --info: #7da6ff;
+  --info-foreground: #0e0f15;
+  --busy: #f0957e;
+  --busy-foreground: #0e0f15;
+  --busy-ink: #f0957e;
+  --border: #474851;
+  --input: #474851;
+  --ring: #73daca;
+  --radius: 0.625rem;
+  --chart-primary: #73daca;
+  --chart-secondary: #bb9af7;
+  --status-success: #9ece6a;
+  --status-warning: #e0af68;
+  --status-in-progress: #7da6ff;
+  --page-bg: #0e0f15;
+  --page-bg-src: '';
+  --panel-bg: rgb(26 27 38 / 0.72);
+  --panel-border: rgb(71 72 81 / 0.9);
+  --panel-border-bare: rgb(71 72 81 / 0.55);
+  --panel-raised-bg: rgb(26 27 38 / 0.95);
+  --panel-raised-border: rgb(71 72 81 / 1);
+  --panel-accent: #73daca;
+  --panel-header-bg: rgb(42 43 53 / 0.6);
+  --panel-header-fg: #ffffff;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #1a1b26;
+  --glass-bg: rgb(26 27 38 / 0.55);
+  --glass-border: rgb(71 72 81 / 0.7);
+  --dock-bg: rgb(26 27 38 / 0.7);
+  --dock-border: rgb(71 72 81 / 0.8);
+  --dock-tooltip-bg: #2a2b35;
+  --header-bg: rgb(26 27 38 / 0.8);
+  --header-border: rgb(71 72 81 / 0.9);
+  --header-fg: #ffffff;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(129 130 136 / 0.07);
+  --card-grid-color: rgb(129 130 136 / 0.05);
+  --panel-grid-color: rgb(129 130 136 / 0.06);
+  --scrollbar-thumb: rgb(86 95 137 / 0.6);
+  --scrollbar-thumb-hover: rgb(86 95 137 / 0.85);
+  --scrollbar-thin-thumb: rgb(86 95 137 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(86 95 137 / 0.7);
+  --brand: #73daca;
+  --brand-foreground: #0e0f15;
+  --brand-primary: #73daca;
+  --brand-accent: #0db9d7;
+  --brand-warm: #f0957e;
+  --brand-deep: #0e0f15;
+  --brand-muted: #565f89;
+  --ink: #ffffff;
+  --surface-warm: #1a1b26;
+  --naturegreen: #9ece6a;
+  --naturegreen-foreground: #0e0f15;
+  --duck-dark: #ffffff;
+  --duck-teal: #0db9d7;
+  --duck-yellow: #e0af68;
+  --duck-orange: #f0957e;
+  --duck-forest: #9ece6a;
+  --duck-beige: #31323c;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/archwave.css

@@ -0,0 +1,97 @@
+/*
+  Archwave — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/davidguttman/archwave (alacritty.toml), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='archwave'] {
+  --background: #0e0719;
+  --foreground: #d4a5ff;
+  --card: #1a0d2e;
+  --card-foreground: #d4a5ff;
+  --popover: #1a0d2e;
+  --popover-foreground: #d4a5ff;
+  --muted: #2a1e3d;
+  --muted-foreground: #a17ec3;
+  --accent: #2a1e3d;
+  --accent-foreground: #d4a5ff;
+  --primary: #8ffef4;
+  --primary-foreground: #0e0719;
+  --secondary: #2a1e3d;
+  --secondary-foreground: #d4a5ff;
+  --cta: #8ffef4;
+  --cta-foreground: #0e0719;
+  --ctahover: #9cfef5;
+  --success: #5ffbf1;
+  --success-foreground: #0e0719;
+  --warning: #f9f871;
+  --warning-foreground: #0e0719;
+  --destructive: #ff6ec7;
+  --destructive-foreground: #0e0719;
+  --info: #8b9aff;
+  --info-foreground: #0e0719;
+  --busy: #fcb39c;
+  --busy-foreground: #0e0719;
+  --busy-ink: #fcb39c;
+  --border: #3e2b57;
+  --input: #3e2b57;
+  --ring: #8ffef4;
+  --radius: 0.625rem;
+  --chart-primary: #8ffef4;
+  --chart-secondary: #f4a5ff;
+  --status-success: #5ffbf1;
+  --status-warning: #f9f871;
+  --status-in-progress: #8b9aff;
+  --page-bg: #0e0719;
+  --page-bg-src: '';
+  --panel-bg: rgb(26 13 46 / 0.72);
+  --panel-border: rgb(62 43 87 / 0.9);
+  --panel-border-bare: rgb(62 43 87 / 0.55);
+  --panel-raised-bg: rgb(26 13 46 / 0.95);
+  --panel-raised-border: rgb(62 43 87 / 1);
+  --panel-accent: #8ffef4;
+  --panel-header-bg: rgb(42 30 61 / 0.6);
+  --panel-header-fg: #d4a5ff;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #1a0d2e;
+  --glass-bg: rgb(26 13 46 / 0.55);
+  --glass-border: rgb(62 43 87 / 0.7);
+  --dock-bg: rgb(26 13 46 / 0.7);
+  --dock-border: rgb(62 43 87 / 0.8);
+  --dock-tooltip-bg: #2a1e3d;
+  --header-bg: rgb(26 13 46 / 0.8);
+  --header-border: rgb(62 43 87 / 0.9);
+  --header-fg: #d4a5ff;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(117 90 146 / 0.07);
+  --card-grid-color: rgb(117 90 146 / 0.05);
+  --panel-grid-color: rgb(117 90 146 / 0.06);
+  --scrollbar-thumb: rgb(84 58 110 / 0.6);
+  --scrollbar-thumb-hover: rgb(84 58 110 / 0.85);
+  --scrollbar-thin-thumb: rgb(84 58 110 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(84 58 110 / 0.7);
+  --brand: #8ffef4;
+  --brand-foreground: #0e0719;
+  --brand-primary: #8ffef4;
+  --brand-accent: #5ffbf1;
+  --brand-warm: #fcb39c;
+  --brand-deep: #0e0719;
+  --brand-muted: #543a6e;
+  --ink: #d4a5ff;
+  --surface-warm: #1a0d2e;
+  --naturegreen: #5ffbf1;
+  --naturegreen-foreground: #0e0719;
+  --duck-dark: #d4a5ff;
+  --duck-teal: #5ffbf1;
+  --duck-yellow: #f9f871;
+  --duck-orange: #fcb39c;
+  --duck-forest: #5ffbf1;
+  --duck-beige: #2d1c43;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/artzen.css

@@ -0,0 +1,97 @@
+/*
+  Artzen — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/tahfizhabib/omarchy-artzen-theme (alacritty.toml), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='artzen'] {
+  --background: #0d0f11;
+  --foreground: #fdf9f8;
+  --card: #181c1f;
+  --card-foreground: #fdf9f8;
+  --popover: #181c1f;
+  --popover-foreground: #fdf9f8;
+  --muted: #282c2f;
+  --muted-foreground: #b8b7b7;
+  --accent: #282c2f;
+  --accent-foreground: #fdf9f8;
+  --primary: #ecbeb9;
+  --primary-foreground: #0d0f11;
+  --secondary: #282c2f;
+  --secondary-foreground: #fdf9f8;
+  --cta: #ecbeb9;
+  --cta-foreground: #0d0f11;
+  --ctahover: #eec6c1;
+  --success: #9f6769;
+  --success-foreground: #000000;
+  --warning: #bb6d6c;
+  --warning-foreground: #0d0f11;
+  --destructive: #9b584d;
+  --destructive-foreground: #fdf9f8;
+  --info: #b97670;
+  --info-foreground: #0d0f11;
+  --busy: #ab635d;
+  --busy-foreground: #060606;
+  --busy-ink: #af6b65;
+  --border: #45474a;
+  --input: #45474a;
+  --ring: #ecbeb9;
+  --radius: 0.625rem;
+  --chart-primary: #ecbeb9;
+  --chart-secondary: #9a8c8a;
+  --status-success: #9f6769;
+  --status-warning: #bb6d6c;
+  --status-in-progress: #b97670;
+  --page-bg: #0d0f11;
+  --page-bg-src: '';
+  --panel-bg: rgb(24 28 31 / 0.72);
+  --panel-border: rgb(69 71 74 / 0.9);
+  --panel-border-bare: rgb(69 71 74 / 0.55);
+  --panel-raised-bg: rgb(24 28 31 / 0.95);
+  --panel-raised-border: rgb(69 71 74 / 1);
+  --panel-accent: #ecbeb9;
+  --panel-header-bg: rgb(40 44 47 / 0.6);
+  --panel-header-fg: #fdf9f8;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #181c1f;
+  --glass-bg: rgb(24 28 31 / 0.55);
+  --glass-border: rgb(69 71 74 / 0.7);
+  --dock-bg: rgb(24 28 31 / 0.7);
+  --dock-border: rgb(69 71 74 / 0.8);
+  --dock-tooltip-bg: #282c2f;
+  --header-bg: rgb(24 28 31 / 0.8);
+  --header-border: rgb(69 71 74 / 0.9);
+  --header-fg: #fdf9f8;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(127 127 129 / 0.07);
+  --card-grid-color: rgb(127 127 129 / 0.05);
+  --panel-grid-color: rgb(127 127 129 / 0.06);
+  --scrollbar-thumb: rgb(177 141 133 / 0.6);
+  --scrollbar-thumb-hover: rgb(177 141 133 / 0.85);
+  --scrollbar-thin-thumb: rgb(177 141 133 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(177 141 133 / 0.7);
+  --brand: #ecbeb9;
+  --brand-foreground: #0d0f11;
+  --brand-primary: #ecbeb9;
+  --brand-accent: #da7a6f;
+  --brand-warm: #ab635d;
+  --brand-deep: #0d0f11;
+  --brand-muted: #b18d85;
+  --ink: #fdf9f8;
+  --surface-warm: #181c1f;
+  --naturegreen: #9f6769;
+  --naturegreen-foreground: #000000;
+  --duck-dark: #fdf9f8;
+  --duck-teal: #da7a6f;
+  --duck-yellow: #bb6d6c;
+  --duck-orange: #ab635d;
+  --duck-forest: #9f6769;
+  --duck-beige: #2f3235;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/ash.css

@@ -0,0 +1,97 @@
+/*
+  Ash — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/bjarneo/omarchy-ash-theme (colors.toml (16-colour ANSI)), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='ash'] {
+  --background: #0a0a0a;
+  --foreground: #e0e0e0;
+  --card: #121212;
+  --card-foreground: #e0e0e0;
+  --popover: #121212;
+  --popover-foreground: #e0e0e0;
+  --muted: #232323;
+  --muted-foreground: #a2a2a2;
+  --accent: #232323;
+  --accent-foreground: #e0e0e0;
+  --primary: #9e9e9e;
+  --primary-foreground: #0a0a0a;
+  --secondary: #232323;
+  --secondary-foreground: #e0e0e0;
+  --cta: #9e9e9e;
+  --cta-foreground: #0a0a0a;
+  --ctahover: #aaaaaa;
+  --success: #767676;
+  --success-foreground: #040404;
+  --warning: #9e9e9e;
+  --warning-foreground: #0a0a0a;
+  --destructive: #8a8a8a;
+  --destructive-foreground: #0a0a0a;
+  --info: #626262;
+  --info-foreground: #e0e0e0;
+  --busy: #949494;
+  --busy-foreground: #0a0a0a;
+  --busy-ink: #949494;
+  --border: #3a3a3a;
+  --input: #3a3a3a;
+  --ring: #9e9e9e;
+  --radius: 0.625rem;
+  --chart-primary: #9e9e9e;
+  --chart-secondary: #8a8a8a;
+  --status-success: #767676;
+  --status-warning: #9e9e9e;
+  --status-in-progress: #626262;
+  --page-bg: #0a0a0a;
+  --page-bg-src: '';
+  --panel-bg: rgb(18 18 18 / 0.72);
+  --panel-border: rgb(58 58 58 / 0.9);
+  --panel-border-bare: rgb(58 58 58 / 0.55);
+  --panel-raised-bg: rgb(18 18 18 / 0.95);
+  --panel-raised-border: rgb(58 58 58 / 1);
+  --panel-accent: #9e9e9e;
+  --panel-header-bg: rgb(35 35 35 / 0.6);
+  --panel-header-fg: #e0e0e0;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #121212;
+  --glass-bg: rgb(18 18 18 / 0.55);
+  --glass-border: rgb(58 58 58 / 0.7);
+  --dock-bg: rgb(18 18 18 / 0.7);
+  --dock-border: rgb(58 58 58 / 0.8);
+  --dock-tooltip-bg: #232323;
+  --header-bg: rgb(18 18 18 / 0.8);
+  --header-border: rgb(58 58 58 / 0.9);
+  --header-fg: #e0e0e0;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(111 111 111 / 0.07);
+  --card-grid-color: rgb(111 111 111 / 0.05);
+  --panel-grid-color: rgb(111 111 111 / 0.06);
+  --scrollbar-thumb: rgb(138 138 138 / 0.6);
+  --scrollbar-thumb-hover: rgb(138 138 138 / 0.85);
+  --scrollbar-thin-thumb: rgb(138 138 138 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(138 138 138 / 0.7);
+  --brand: #9e9e9e;
+  --brand-foreground: #0a0a0a;
+  --brand-primary: #9e9e9e;
+  --brand-accent: #767676;
+  --brand-warm: #949494;
+  --brand-deep: #0a0a0a;
+  --brand-muted: #8a8a8a;
+  --ink: #e0e0e0;
+  --surface-warm: #121212;
+  --naturegreen: #767676;
+  --naturegreen-foreground: #040404;
+  --duck-dark: #e0e0e0;
+  --duck-teal: #767676;
+  --duck-yellow: #9e9e9e;
+  --duck-orange: #949494;
+  --duck-forest: #767676;
+  --duck-beige: #272727;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/astrodark.css

@@ -0,0 +1,97 @@
+/*
+  Astrodark — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark) — the source repo's own colors.toml says so directly.
+
+  Source: https://github.com/JamsMendez/omarchy-astrodark-theme (colors.toml (Omarchy schema)), read by scripts/port-community-themes.ts. Values
+  came straight from the repo's own colors.toml — the same schema and reader the official 22 themes
+  use, so nothing here is reconstructed. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='astrodark'] {
+  --background: #0b0c0f;
+  --foreground: #9b9fa9;
+  --card: #1a1d23;
+  --card-foreground: #9b9fa9;
+  --popover: #1a1d23;
+  --popover-foreground: #9b9fa9;
+  --muted: #26343f;
+  --muted-foreground: #b8bcc6;
+  --accent: #26343f;
+  --accent-foreground: #9b9fa9;
+  --primary: #5eb7ff;
+  --primary-foreground: #0b0c0f;
+  --secondary: #26343f;
+  --secondary-foreground: #9b9fa9;
+  --cta: #5eb7ff;
+  --cta-foreground: #0b0c0f;
+  --ctahover: #71c0ff;
+  --success: #87c05f;
+  --success-foreground: #0b0c0f;
+  --warning: #dfab25;
+  --warning-foreground: #0b0c0f;
+  --destructive: #ff838b;
+  --destructive-foreground: #0b0c0f;
+  --info: #5eb7ff;
+  --info-foreground: #0b0c0f;
+  --busy: #e8925a;
+  --busy-foreground: #0b0c0f;
+  --busy-ink: #e8925a;
+  --border: #464a51;
+  --input: #464a51;
+  --ring: #5eb7ff;
+  --radius: 0.625rem;
+  --chart-primary: #5eb7ff;
+  --chart-secondary: #dd97f1;
+  --status-success: #87c05f;
+  --status-warning: #dfab25;
+  --status-in-progress: #5eb7ff;
+  --page-bg: #0b0c0f;
+  --page-bg-src: '';
+  --panel-bg: rgb(26 29 35 / 0.72);
+  --panel-border: rgb(70 74 81 / 0.9);
+  --panel-border-bare: rgb(70 74 81 / 0.55);
+  --panel-raised-bg: rgb(26 29 35 / 0.95);
+  --panel-raised-border: rgb(70 74 81 / 1);
+  --panel-accent: #5eb7ff;
+  --panel-header-bg: rgb(38 52 63 / 0.6);
+  --panel-header-fg: #9b9fa9;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #1a1d23;
+  --glass-bg: rgb(26 29 35 / 0.55);
+  --glass-border: rgb(70 74 81 / 0.7);
+  --dock-bg: rgb(26 29 35 / 0.7);
+  --dock-border: rgb(70 74 81 / 0.8);
+  --dock-tooltip-bg: #26343f;
+  --header-bg: rgb(26 29 35 / 0.8);
+  --header-border: rgb(70 74 81 / 0.9);
+  --header-fg: #9b9fa9;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(107 111 121 / 0.07);
+  --card-grid-color: rgb(107 111 121 / 0.05);
+  --panel-grid-color: rgb(107 111 121 / 0.06);
+  --scrollbar-thumb: rgb(52 54 58 / 0.6);
+  --scrollbar-thumb-hover: rgb(52 54 58 / 0.85);
+  --scrollbar-thin-thumb: rgb(52 54 58 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(52 54 58 / 0.7);
+  --brand: #5eb7ff;
+  --brand-foreground: #0b0c0f;
+  --brand-primary: #5eb7ff;
+  --brand-accent: #4ac2b8;
+  --brand-warm: #e8925a;
+  --brand-deep: #0b0c0f;
+  --brand-muted: #34363a;
+  --ink: #9b9fa9;
+  --surface-warm: #1a1d23;
+  --naturegreen: #87c05f;
+  --naturegreen-foreground: #0b0c0f;
+  --duck-dark: #9b9fa9;
+  --duck-teal: #4ac2b8;
+  --duck-yellow: #dfab25;
+  --duck-orange: #e8925a;
+  --duck-forest: #87c05f;
+  --duck-beige: #272a30;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/atari.css

@@ -0,0 +1,97 @@
+/*
+  Atari — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/atif-1402/omarchy-atari-theme (alacritty.toml), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='atari'] {
+  --background: #171317;
+  --foreground: #dcd6d6;
+  --card: #292329;
+  --card-foreground: #dcd6d6;
+  --popover: #292329;
+  --popover-foreground: #dcd6d6;
+  --muted: #383238;
+  --muted-foreground: #a6a0a2;
+  --accent: #383238;
+  --accent-foreground: #dcd6d6;
+  --primary: #dff1e8;
+  --primary-foreground: #171317;
+  --secondary: #383238;
+  --secondary-foreground: #dcd6d6;
+  --cta: #dff1e8;
+  --cta-foreground: #171317;
+  --ctahover: #e3f3eb;
+  --success: #79be9a;
+  --success-foreground: #171317;
+  --warning: #c3b283;
+  --warning-foreground: #171317;
+  --destructive: #b9746f;
+  --destructive-foreground: #171317;
+  --info: #9db9b2;
+  --info-foreground: #171317;
+  --busy: #be9379;
+  --busy-foreground: #171317;
+  --busy-ink: #be9379;
+  --border: #4c464b;
+  --input: #4c464b;
+  --ring: #dff1e8;
+  --radius: 0.625rem;
+  --chart-primary: #dff1e8;
+  --chart-secondary: #cd9b98;
+  --status-success: #79be9a;
+  --status-warning: #c3b283;
+  --status-in-progress: #9db9b2;
+  --page-bg: #171317;
+  --page-bg-src: '';
+  --panel-bg: rgb(41 35 41 / 0.72);
+  --panel-border: rgb(76 70 75 / 0.9);
+  --panel-border-bare: rgb(76 70 75 / 0.55);
+  --panel-raised-bg: rgb(41 35 41 / 0.95);
+  --panel-raised-border: rgb(76 70 75 / 1);
+  --panel-accent: #dff1e8;
+  --panel-header-bg: rgb(56 50 56 / 0.6);
+  --panel-header-fg: #dcd6d6;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #292329;
+  --glass-bg: rgb(41 35 41 / 0.55);
+  --glass-border: rgb(76 70 75 / 0.7);
+  --dock-bg: rgb(41 35 41 / 0.7);
+  --dock-border: rgb(76 70 75 / 0.8);
+  --dock-tooltip-bg: #383238;
+  --header-bg: rgb(41 35 41 / 0.8);
+  --header-border: rgb(76 70 75 / 0.9);
+  --header-fg: #dcd6d6;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(122 116 119 / 0.07);
+  --card-grid-color: rgb(122 116 119 / 0.05);
+  --panel-grid-color: rgb(122 116 119 / 0.06);
+  --scrollbar-thumb: rgb(135 120 135 / 0.6);
+  --scrollbar-thumb-hover: rgb(135 120 135 / 0.85);
+  --scrollbar-thin-thumb: rgb(135 120 135 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(135 120 135 / 0.7);
+  --brand: #dff1e8;
+  --brand-foreground: #171317;
+  --brand-primary: #dff1e8;
+  --brand-accent: #a2d2b9;
+  --brand-warm: #be9379;
+  --brand-deep: #171317;
+  --brand-muted: #877887;
+  --ink: #dcd6d6;
+  --surface-warm: #292329;
+  --naturegreen: #79be9a;
+  --naturegreen-foreground: #171317;
+  --duck-dark: #dcd6d6;
+  --duck-teal: #a2d2b9;
+  --duck-yellow: #c3b283;
+  --duck-orange: #be9379;
+  --duck-forest: #79be9a;
+  --duck-beige: #3b353a;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/atelier.css

@@ -0,0 +1,97 @@
+/*
+  Atelier — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/atif-1402/omarchy-atelier-theme (colors.toml (16-colour ANSI)), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='atelier'] {
+  --background: #13130f;
+  --foreground: #dcd9d6;
+  --card: #22221b;
+  --card-foreground: #dcd9d6;
+  --popover: #22221b;
+  --popover-foreground: #dcd9d6;
+  --muted: #31312b;
+  --muted-foreground: #a4a29e;
+  --accent: #31312b;
+  --accent-foreground: #dcd9d6;
+  --primary: #7bbf7a;
+  --primary-foreground: #13130f;
+  --secondary: #31312b;
+  --secondary-foreground: #dcd9d6;
+  --cta: #7bbf7a;
+  --cta-foreground: #13130f;
+  --ctahover: #8bc78a;
+  --success: #7d9726;
+  --success-foreground: #13130f;
+  --warning: #a5980d;
+  --warning-foreground: #13130f;
+  --destructive: #ba6236;
+  --destructive-foreground: #0d0d0b;
+  --info: #36a166;
+  --info-foreground: #13130f;
+  --busy: #b07d22;
+  --busy-foreground: #13130f;
+  --busy-ink: #b07d22;
+  --border: #464640;
+  --input: #464640;
+  --ring: #7bbf7a;
+  --radius: 0.625rem;
+  --chart-primary: #7bbf7a;
+  --chart-secondary: #9d6c7c;
+  --status-success: #7d9726;
+  --status-warning: #a5980d;
+  --status-in-progress: #36a166;
+  --page-bg: #13130f;
+  --page-bg-src: '';
+  --panel-bg: rgb(34 34 27 / 0.72);
+  --panel-border: rgb(70 70 64 / 0.9);
+  --panel-border-bare: rgb(70 70 64 / 0.55);
+  --panel-raised-bg: rgb(34 34 27 / 0.95);
+  --panel-raised-border: rgb(70 70 64 / 1);
+  --panel-accent: #7bbf7a;
+  --panel-header-bg: rgb(49 49 43 / 0.6);
+  --panel-header-fg: #dcd9d6;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #22221b;
+  --glass-bg: rgb(34 34 27 / 0.55);
+  --glass-border: rgb(70 70 64 / 0.7);
+  --dock-bg: rgb(34 34 27 / 0.7);
+  --dock-border: rgb(70 70 64 / 0.8);
+  --dock-tooltip-bg: #31312b;
+  --header-bg: rgb(34 34 27 / 0.8);
+  --header-border: rgb(70 70 64 / 0.9);
+  --header-fg: #dcd9d6;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(118 116 111 / 0.07);
+  --card-grid-color: rgb(118 116 111 / 0.05);
+  --panel-grid-color: rgb(118 116 111 / 0.06);
+  --scrollbar-thumb: rgb(108 107 90 / 0.6);
+  --scrollbar-thumb-hover: rgb(108 107 90 / 0.85);
+  --scrollbar-thin-thumb: rgb(108 107 90 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(108 107 90 / 0.7);
+  --brand: #7bbf7a;
+  --brand-foreground: #13130f;
+  --brand-primary: #7bbf7a;
+  --brand-accent: #5b9d48;
+  --brand-warm: #b07d22;
+  --brand-deep: #13130f;
+  --brand-muted: #6c6b5a;
+  --ink: #dcd9d6;
+  --surface-warm: #22221b;
+  --naturegreen: #7d9726;
+  --naturegreen-foreground: #13130f;
+  --duck-dark: #dcd9d6;
+  --duck-teal: #5b9d48;
+  --duck-yellow: #a5980d;
+  --duck-orange: #b07d22;
+  --duck-forest: #7d9726;
+  --duck-beige: #35342e;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/aura.css

@@ -0,0 +1,97 @@
+/*
+  Aura — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/bjarneo/omarchy-aura-theme (alacritty.toml), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='aura'] {
+  --background: #16171e;
+  --foreground: #f8f8f2;
+  --card: #282a36;
+  --card-foreground: #f8f8f2;
+  --popover: #282a36;
+  --popover-foreground: #f8f8f2;
+  --muted: #373944;
+  --muted-foreground: #bababa;
+  --accent: #373944;
+  --accent-foreground: #f8f8f2;
+  --primary: #bde0fe;
+  --primary-foreground: #16171e;
+  --secondary: #373944;
+  --secondary-foreground: #f8f8f2;
+  --cta: #bde0fe;
+  --cta-foreground: #16171e;
+  --ctahover: #c5e4fe;
+  --success: #8be9fd;
+  --success-foreground: #16171e;
+  --warning: #cbc3e3;
+  --warning-foreground: #16171e;
+  --destructive: #ffafcc;
+  --destructive-foreground: #16171e;
+  --info: #8be9fd;
+  --info-foreground: #16171e;
+  --busy: #e5b9d8;
+  --busy-foreground: #16171e;
+  --busy-ink: #e5b9d8;
+  --border: #51525b;
+  --input: #51525b;
+  --ring: #bde0fe;
+  --radius: 0.625rem;
+  --chart-primary: #bde0fe;
+  --chart-secondary: #ffc8dd;
+  --status-success: #8be9fd;
+  --status-warning: #cbc3e3;
+  --status-in-progress: #8be9fd;
+  --page-bg: #16171e;
+  --page-bg-src: '';
+  --panel-bg: rgb(40 42 54 / 0.72);
+  --panel-border: rgb(81 82 91 / 0.9);
+  --panel-border-bare: rgb(81 82 91 / 0.55);
+  --panel-raised-bg: rgb(40 42 54 / 0.95);
+  --panel-raised-border: rgb(81 82 91 / 1);
+  --panel-accent: #bde0fe;
+  --panel-header-bg: rgb(55 57 68 / 0.6);
+  --panel-header-fg: #f8f8f2;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #282a36;
+  --glass-bg: rgb(40 42 54 / 0.55);
+  --glass-border: rgb(81 82 91 / 0.7);
+  --dock-bg: rgb(40 42 54 / 0.7);
+  --dock-border: rgb(81 82 91 / 0.8);
+  --dock-tooltip-bg: #373944;
+  --header-bg: rgb(40 42 54 / 0.8);
+  --header-border: rgb(81 82 91 / 0.9);
+  --header-fg: #f8f8f2;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(134 135 139 / 0.07);
+  --card-grid-color: rgb(134 135 139 / 0.05);
+  --panel-grid-color: rgb(134 135 139 / 0.06);
+  --scrollbar-thumb: rgb(68 71 90 / 0.6);
+  --scrollbar-thumb-hover: rgb(68 71 90 / 0.85);
+  --scrollbar-thin-thumb: rgb(68 71 90 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(68 71 90 / 0.7);
+  --brand: #bde0fe;
+  --brand-foreground: #16171e;
+  --brand-primary: #bde0fe;
+  --brand-accent: #8be9fd;
+  --brand-warm: #e5b9d8;
+  --brand-deep: #16171e;
+  --brand-muted: #44475a;
+  --ink: #f8f8f2;
+  --surface-warm: #282a36;
+  --naturegreen: #8be9fd;
+  --naturegreen-foreground: #16171e;
+  --duck-dark: #f8f8f2;
+  --duck-teal: #8be9fd;
+  --duck-yellow: #cbc3e3;
+  --duck-orange: #e5b9d8;
+  --duck-forest: #8be9fd;
+  --duck-beige: #3d3f49;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/ayu-dark.css

@@ -0,0 +1,97 @@
+/*
+  Ayu Dark — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/fdidron/omarchy-ayu-dark-theme (alacritty.toml), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='ayu-dark'] {
+  --background: #06080b;
+  --foreground: #bfbdb6;
+  --card: #0b0e14;
+  --card-foreground: #bfbdb6;
+  --popover: #0b0e14;
+  --popover-foreground: #bfbdb6;
+  --muted: #1c1f24;
+  --muted-foreground: #898985;
+  --accent: #1c1f24;
+  --accent-foreground: #bfbdb6;
+  --primary: #95e6cb;
+  --primary-foreground: #06080b;
+  --secondary: #1c1f24;
+  --secondary-foreground: #bfbdb6;
+  --cta: #95e6cb;
+  --cta-foreground: #06080b;
+  --ctahover: #a2e9d1;
+  --success: #7fd962;
+  --success-foreground: #06080b;
+  --warning: #f9af4f;
+  --warning-foreground: #06080b;
+  --destructive: #ea6c73;
+  --destructive-foreground: #06080b;
+  --info: #53bdfa;
+  --info-foreground: #06080b;
+  --busy: #f28e61;
+  --busy-foreground: #06080b;
+  --busy-ink: #f28e61;
+  --border: #2e3034;
+  --input: #2e3034;
+  --ring: #95e6cb;
+  --radius: 0.625rem;
+  --chart-primary: #95e6cb;
+  --chart-secondary: #cda1fa;
+  --status-success: #7fd962;
+  --status-warning: #f9af4f;
+  --status-in-progress: #53bdfa;
+  --page-bg: #06080b;
+  --page-bg-src: '';
+  --panel-bg: rgb(11 14 20 / 0.72);
+  --panel-border: rgb(46 48 52 / 0.9);
+  --panel-border-bare: rgb(46 48 52 / 0.55);
+  --panel-raised-bg: rgb(11 14 20 / 0.95);
+  --panel-raised-border: rgb(46 48 52 / 1);
+  --panel-accent: #95e6cb;
+  --panel-header-bg: rgb(28 31 36 / 0.6);
+  --panel-header-fg: #bfbdb6;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #0b0e14;
+  --glass-bg: rgb(11 14 20 / 0.55);
+  --glass-border: rgb(46 48 52 / 0.7);
+  --dock-bg: rgb(11 14 20 / 0.7);
+  --dock-border: rgb(46 48 52 / 0.8);
+  --dock-tooltip-bg: #1c1f24;
+  --header-bg: rgb(11 14 20 / 0.8);
+  --header-border: rgb(46 48 52 / 0.9);
+  --header-fg: #bfbdb6;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(96 97 97 / 0.07);
+  --card-grid-color: rgb(96 97 97 / 0.05);
+  --panel-grid-color: rgb(96 97 97 / 0.06);
+  --scrollbar-thumb: rgb(104 104 104 / 0.6);
+  --scrollbar-thumb-hover: rgb(104 104 104 / 0.85);
+  --scrollbar-thin-thumb: rgb(104 104 104 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(104 104 104 / 0.7);
+  --brand: #95e6cb;
+  --brand-foreground: #06080b;
+  --brand-primary: #95e6cb;
+  --brand-accent: #90e1c6;
+  --brand-warm: #f28e61;
+  --brand-deep: #06080b;
+  --brand-muted: #686868;
+  --ink: #bfbdb6;
+  --surface-warm: #0b0e14;
+  --naturegreen: #7fd962;
+  --naturegreen-foreground: #06080b;
+  --duck-dark: #bfbdb6;
+  --duck-teal: #90e1c6;
+  --duck-yellow: #f9af4f;
+  --duck-orange: #f28e61;
+  --duck-forest: #7fd962;
+  --duck-beige: #1d2024;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/ayu-light.css

@@ -0,0 +1,97 @@
+/*
+  Ayu Light — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Light theme (light), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/fdidron/omarchy-ayu-light-theme (alacritty.toml), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='ayu-light'] {
+  --background: #f8f9fa;
+  --foreground: #5c6166;
+  --card: #eff0f1;
+  --card-foreground: #5c6166;
+  --popover: #eff0f1;
+  --popover-foreground: #5c6166;
+  --muted: #e9eaeb;
+  --muted-foreground: #65686a;
+  --accent: #e9eaeb;
+  --accent-foreground: #5c6166;
+  --primary: #3095db;
+  --primary-foreground: #272727;
+  --secondary: #e9eaeb;
+  --secondary-foreground: #5c6166;
+  --cta: #3095db;
+  --cta-foreground: #272727;
+  --ctahover: #2a83c1;
+  --success: #6cbf43;
+  --success-foreground: #3c3f42;
+  --warning: #eca944;
+  --warning-foreground: #43464a;
+  --destructive: #ea6c6d;
+  --destructive-foreground: #2d2d2d;
+  --info: #3199e1;
+  --info-foreground: #272727;
+  --busy: #eb8b59;
+  --busy-foreground: #373a3d;
+  --busy-ink: #a5613e;
+  --border: #dedfe1;
+  --input: #d3d4d6;
+  --ring: #3095db;
+  --radius: 0.625rem;
+  --chart-primary: #3095db;
+  --chart-secondary: #9e75c7;
+  --status-success: #6cbf43;
+  --status-warning: #eca944;
+  --status-in-progress: #3199e1;
+  --page-bg: #f8f9fa;
+  --page-bg-src: '';
+  --panel-bg: rgb(239 240 241 / 0.72);
+  --panel-border: rgb(222 223 225 / 0.9);
+  --panel-border-bare: rgb(222 223 225 / 0.55);
+  --panel-raised-bg: rgb(239 240 241 / 0.95);
+  --panel-raised-border: rgb(222 223 225 / 1);
+  --panel-accent: #3095db;
+  --panel-header-bg: rgb(233 234 235 / 0.6);
+  --panel-header-fg: #5c6166;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #eff0f1;
+  --glass-bg: rgb(239 240 241 / 0.55);
+  --glass-border: rgb(222 223 225 / 0.7);
+  --dock-bg: rgb(239 240 241 / 0.7);
+  --dock-border: rgb(222 223 225 / 0.8);
+  --dock-tooltip-bg: #e9eaeb;
+  --header-bg: rgb(239 240 241 / 0.8);
+  --header-border: rgb(222 223 225 / 0.9);
+  --header-fg: #5c6166;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(134 136 137 / 0.07);
+  --card-grid-color: rgb(134 136 137 / 0.05);
+  --panel-grid-color: rgb(134 136 137 / 0.06);
+  --scrollbar-thumb: rgb(104 104 104 / 0.6);
+  --scrollbar-thumb-hover: rgb(104 104 104 / 0.85);
+  --scrollbar-thin-thumb: rgb(104 104 104 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(104 104 104 / 0.7);
+  --brand: #3095db;
+  --brand-foreground: #272727;
+  --brand-primary: #3095db;
+  --brand-accent: #46ba94;
+  --brand-warm: #eb8b59;
+  --brand-deep: #e9eaeb;
+  --brand-muted: #686868;
+  --ink: #5c6166;
+  --surface-warm: #eff0f1;
+  --naturegreen: #6cbf43;
+  --naturegreen-foreground: #3c3f42;
+  --duck-dark: #5c6166;
+  --duck-teal: #46ba94;
+  --duck-yellow: #eca944;
+  --duck-orange: #eb8b59;
+  --duck-forest: #6cbf43;
+  --duck-beige: #e0e2e3;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/ayu-mirage.css

@@ -0,0 +1,97 @@
+/*
+  Ayu Mirage — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/fdidron/omarchy-ayu-mirage-theme (alacritty.toml), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='ayu-mirage'] {
+  --background: #11141a;
+  --foreground: #cccac2;
+  --card: #1f2430;
+  --card-foreground: #cccac2;
+  --popover: #1f2430;
+  --popover-foreground: #cccac2;
+  --muted: #2f333e;
+  --muted-foreground: #9b9b99;
+  --accent: #2f333e;
+  --accent-foreground: #cccac2;
+  --primary: #95e6cb;
+  --primary-foreground: #11141a;
+  --secondary: #2f333e;
+  --secondary-foreground: #cccac2;
+  --cta: #95e6cb;
+  --cta-foreground: #11141a;
+  --ctahover: #a2e9d1;
+  --success: #87d96c;
+  --success-foreground: #11141a;
+  --warning: #facc6e;
+  --warning-foreground: #11141a;
+  --destructive: #ed8274;
+  --destructive-foreground: #11141a;
+  --info: #6dcbfa;
+  --info-foreground: #11141a;
+  --busy: #f4a771;
+  --busy-foreground: #11141a;
+  --busy-ink: #f4a771;
+  --border: #41444d;
+  --input: #41444d;
+  --ring: #95e6cb;
+  --radius: 0.625rem;
+  --chart-primary: #95e6cb;
+  --chart-secondary: #dabafa;
+  --status-success: #87d96c;
+  --status-warning: #facc6e;
+  --status-in-progress: #6dcbfa;
+  --page-bg: #11141a;
+  --page-bg-src: '';
+  --panel-bg: rgb(31 36 48 / 0.72);
+  --panel-border: rgb(65 68 77 / 0.9);
+  --panel-border-bare: rgb(65 68 77 / 0.55);
+  --panel-raised-bg: rgb(31 36 48 / 0.95);
+  --panel-raised-border: rgb(65 68 77 / 1);
+  --panel-accent: #95e6cb;
+  --panel-header-bg: rgb(47 51 62 / 0.6);
+  --panel-header-fg: #cccac2;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #1f2430;
+  --glass-bg: rgb(31 36 48 / 0.55);
+  --glass-border: rgb(65 68 77 / 0.7);
+  --dock-bg: rgb(31 36 48 / 0.7);
+  --dock-border: rgb(65 68 77 / 0.8);
+  --dock-tooltip-bg: #2f333e;
+  --header-bg: rgb(31 36 48 / 0.8);
+  --header-border: rgb(65 68 77 / 0.9);
+  --header-fg: #cccac2;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(109 111 114 / 0.07);
+  --card-grid-color: rgb(109 111 114 / 0.05);
+  --panel-grid-color: rgb(109 111 114 / 0.06);
+  --scrollbar-thumb: rgb(104 104 104 / 0.6);
+  --scrollbar-thumb-hover: rgb(104 104 104 / 0.85);
+  --scrollbar-thin-thumb: rgb(104 104 104 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(104 104 104 / 0.7);
+  --brand: #95e6cb;
+  --brand-foreground: #11141a;
+  --brand-primary: #95e6cb;
+  --brand-accent: #90e1c6;
+  --brand-warm: #f4a771;
+  --brand-deep: #11141a;
+  --brand-muted: #686868;
+  --ink: #cccac2;
+  --surface-warm: #1f2430;
+  --naturegreen: #87d96c;
+  --naturegreen-foreground: #11141a;
+  --duck-dark: #cccac2;
+  --duck-teal: #90e1c6;
+  --duck-yellow: #facc6e;
+  --duck-orange: #f4a771;
+  --duck-forest: #87d96c;
+  --duck-beige: #30353f;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/azure-glow.css

@@ -0,0 +1,97 @@
+/*
+  Azure Glow — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/Hydradevx/omarchy-azure-glow-theme (alacritty.toml), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='azure-glow'] {
+  --background: #06080e;
+  --foreground: #a8dfff;
+  --card: #0a0f1a;
+  --card-foreground: #a8dfff;
+  --popover: #0a0f1a;
+  --popover-foreground: #a8dfff;
+  --muted: #1b202a;
+  --muted-foreground: #79a1ba;
+  --accent: #1b202a;
+  --accent-foreground: #a8dfff;
+  --primary: #99eeff;
+  --primary-foreground: #06080e;
+  --secondary: #1b202a;
+  --secondary-foreground: #a8dfff;
+  --cta: #99eeff;
+  --cta-foreground: #06080e;
+  --ctahover: #a5f0ff;
+  --success: #00e0b8;
+  --success-foreground: #06080e;
+  --warning: #33ccff;
+  --warning-foreground: #06080e;
+  --destructive: #0099cc;
+  --destructive-foreground: #06080e;
+  --info: #00aaff;
+  --info-foreground: #06080e;
+  --busy: #1ab3e6;
+  --busy-foreground: #06080e;
+  --busy-ink: #1ab3e6;
+  --border: #293847;
+  --input: #293847;
+  --ring: #99eeff;
+  --radius: 0.625rem;
+  --chart-primary: #99eeff;
+  --chart-secondary: #3399ff;
+  --status-success: #00e0b8;
+  --status-warning: #33ccff;
+  --status-in-progress: #00aaff;
+  --page-bg: #06080e;
+  --page-bg-src: '';
+  --panel-bg: rgb(10 15 26 / 0.72);
+  --panel-border: rgb(41 56 71 / 0.9);
+  --panel-border-bare: rgb(41 56 71 / 0.55);
+  --panel-raised-bg: rgb(10 15 26 / 0.95);
+  --panel-raised-border: rgb(41 56 71 / 1);
+  --panel-accent: #99eeff;
+  --panel-header-bg: rgb(27 32 42 / 0.6);
+  --panel-header-fg: #a8dfff;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #0a0f1a;
+  --glass-bg: rgb(10 15 26 / 0.55);
+  --glass-border: rgb(41 56 71 / 0.7);
+  --dock-bg: rgb(10 15 26 / 0.7);
+  --dock-border: rgb(41 56 71 / 0.8);
+  --dock-tooltip-bg: #1b202a;
+  --header-bg: rgb(10 15 26 / 0.8);
+  --header-border: rgb(41 56 71 / 0.9);
+  --header-fg: #a8dfff;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(81 109 129 / 0.07);
+  --card-grid-color: rgb(81 109 129 / 0.05);
+  --panel-grid-color: rgb(81 109 129 / 0.06);
+  --scrollbar-thumb: rgb(18 50 71 / 0.6);
+  --scrollbar-thumb-hover: rgb(18 50 71 / 0.85);
+  --scrollbar-thin-thumb: rgb(18 50 71 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(18 50 71 / 0.7);
+  --brand: #99eeff;
+  --brand-foreground: #06080e;
+  --brand-primary: #99eeff;
+  --brand-accent: #66e0ff;
+  --brand-warm: #1ab3e6;
+  --brand-deep: #06080e;
+  --brand-muted: #123247;
+  --ink: #a8dfff;
+  --surface-warm: #0a0f1a;
+  --naturegreen: #00e0b8;
+  --naturegreen-foreground: #06080e;
+  --duck-dark: #a8dfff;
+  --duck-teal: #66e0ff;
+  --duck-yellow: #33ccff;
+  --duck-orange: #1ab3e6;
+  --duck-forest: #00e0b8;
+  --duck-beige: #1a2431;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/azure.css

@@ -0,0 +1,97 @@
+/*
+  Azure — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/tahfizhabib/omarchy-azure-theme (alacritty.toml), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='azure'] {
+  --background: #0d141f;
+  --foreground: #eff3f8;
+  --card: #182538;
+  --card-foreground: #eff3f8;
+  --popover: #182538;
+  --popover-foreground: #eff3f8;
+  --muted: #283446;
+  --muted-foreground: #afb5be;
+  --accent: #283446;
+  --accent-foreground: #eff3f8;
+  --primary: #cad4e7;
+  --primary-foreground: #0d141f;
+  --secondary: #283446;
+  --secondary-foreground: #eff3f8;
+  --cta: #cad4e7;
+  --cta-foreground: #0d141f;
+  --ctahover: #d0d9ea;
+  --success: #61a7d6;
+  --success-foreground: #0d141f;
+  --warning: #6cabda;
+  --warning-foreground: #0d141f;
+  --destructive: #969293;
+  --destructive-foreground: #0d141f;
+  --info: #8da1c8;
+  --info-foreground: #0d141f;
+  --busy: #819fb7;
+  --busy-foreground: #0d141f;
+  --busy-ink: #819fb7;
+  --border: #424d5e;
+  --input: #424d5e;
+  --ring: #cad4e7;
+  --radius: 0.625rem;
+  --chart-primary: #cad4e7;
+  --chart-secondary: #a0adc5;
+  --status-success: #61a7d6;
+  --status-warning: #6cabda;
+  --status-in-progress: #8da1c8;
+  --page-bg: #0d141f;
+  --page-bg-src: '';
+  --panel-bg: rgb(24 37 56 / 0.72);
+  --panel-border: rgb(66 77 94 / 0.9);
+  --panel-border-bare: rgb(66 77 94 / 0.55);
+  --panel-raised-bg: rgb(24 37 56 / 0.95);
+  --panel-raised-border: rgb(66 77 94 / 1);
+  --panel-accent: #cad4e7;
+  --panel-header-bg: rgb(40 52 70 / 0.6);
+  --panel-header-fg: #eff3f8;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #182538;
+  --glass-bg: rgb(24 37 56 / 0.55);
+  --glass-border: rgb(66 77 94 / 0.7);
+  --dock-bg: rgb(24 37 56 / 0.7);
+  --dock-border: rgb(66 77 94 / 0.8);
+  --dock-tooltip-bg: #283446;
+  --header-bg: rgb(24 37 56 / 0.8);
+  --header-border: rgb(66 77 94 / 0.9);
+  --header-fg: #eff3f8;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(121 130 142 / 0.07);
+  --card-grid-color: rgb(121 130 142 / 0.05);
+  --panel-grid-color: rgb(121 130 142 / 0.06);
+  --scrollbar-thumb: rgb(73 88 109 / 0.6);
+  --scrollbar-thumb-hover: rgb(73 88 109 / 0.85);
+  --scrollbar-thin-thumb: rgb(73 88 109 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(73 88 109 / 0.7);
+  --brand: #cad4e7;
+  --brand-foreground: #0d141f;
+  --brand-primary: #cad4e7;
+  --brand-accent: #5693c4;
+  --brand-warm: #819fb7;
+  --brand-deep: #0d141f;
+  --brand-muted: #49586d;
+  --ink: #eff3f8;
+  --surface-warm: #182538;
+  --naturegreen: #61a7d6;
+  --naturegreen-foreground: #0d141f;
+  --duck-dark: #eff3f8;
+  --duck-teal: #5693c4;
+  --duck-yellow: #6cabda;
+  --duck-orange: #819fb7;
+  --duck-forest: #61a7d6;
+  --duck-beige: #2e3a4b;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/bad-hand.css

@@ -0,0 +1,97 @@
+/*
+  Bad Hand — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/bjornramberg/omarchy-bad-hand-theme (colors.toml (16-colour ANSI)), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='bad-hand'] {
+  --background: #110b09;
+  --foreground: #bdb09d;
+  --card: #1e1411;
+  --card-foreground: #bdb09d;
+  --popover: #1e1411;
+  --popover-foreground: #bdb09d;
+  --muted: #2e2422;
+  --muted-foreground: #988e81;
+  --accent: #2e2422;
+  --accent-foreground: #bdb09d;
+  --primary: #f5efe1;
+  --primary-foreground: #110b09;
+  --secondary: #2e2422;
+  --secondary-foreground: #bdb09d;
+  --cta: #f5efe1;
+  --cta-foreground: #110b09;
+  --ctahover: #f6f1e5;
+  --success: #921416;
+  --success-foreground: #c2b6a4;
+  --warning: #856839;
+  --warning-foreground: #f3f3f3;
+  --destructive: #5a0a0a;
+  --destructive-foreground: #bdb09d;
+  --info: #4d3a2b;
+  --info-foreground: #bdb09d;
+  --busy: #703922;
+  --busy-foreground: #c2b6a4;
+  --busy-ink: #9b7464;
+  --border: #3d332c;
+  --input: #3d332c;
+  --ring: #f5efe1;
+  --radius: 0.625rem;
+  --chart-primary: #f5efe1;
+  --chart-secondary: #c2b28c;
+  --status-success: #921416;
+  --status-warning: #856839;
+  --status-in-progress: #4d3a2b;
+  --page-bg: #110b09;
+  --page-bg-src: '';
+  --panel-bg: rgb(30 20 17 / 0.72);
+  --panel-border: rgb(61 51 44 / 0.9);
+  --panel-border-bare: rgb(61 51 44 / 0.55);
+  --panel-raised-bg: rgb(30 20 17 / 0.95);
+  --panel-raised-border: rgb(61 51 44 / 1);
+  --panel-accent: #f5efe1;
+  --panel-header-bg: rgb(46 36 34 / 0.6);
+  --panel-header-fg: #bdb09d;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #1e1411;
+  --glass-bg: rgb(30 20 17 / 0.55);
+  --glass-border: rgb(61 51 44 / 0.7);
+  --dock-bg: rgb(30 20 17 / 0.7);
+  --dock-border: rgb(61 51 44 / 0.8);
+  --dock-tooltip-bg: #2e2422;
+  --header-bg: rgb(30 20 17 / 0.8);
+  --header-border: rgb(61 51 44 / 0.9);
+  --header-fg: #bdb09d;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(110 98 89 / 0.07);
+  --card-grid-color: rgb(110 98 89 / 0.05);
+  --panel-grid-color: rgb(110 98 89 / 0.06);
+  --scrollbar-thumb: rgb(53 41 36 / 0.6);
+  --scrollbar-thumb-hover: rgb(53 41 36 / 0.85);
+  --scrollbar-thin-thumb: rgb(53 41 36 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(53 41 36 / 0.7);
+  --brand: #f5efe1;
+  --brand-foreground: #110b09;
+  --brand-primary: #f5efe1;
+  --brand-accent: #e4d8c1;
+  --brand-warm: #703922;
+  --brand-deep: #110b09;
+  --brand-muted: #352924;
+  --ink: #bdb09d;
+  --surface-warm: #1e1411;
+  --naturegreen: #921416;
+  --naturegreen-foreground: #c2b6a4;
+  --duck-dark: #bdb09d;
+  --duck-teal: #e4d8c1;
+  --duck-yellow: #856839;
+  --duck-orange: #703922;
+  --duck-forest: #921416;
+  --duck-beige: #2e241f;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/batman.css

@@ -0,0 +1,97 @@
+/*
+  Batman — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/OldJobobo/omarchy-batman-theme (colors.toml (16-colour ANSI)), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='batman'] {
+  --background: #0f1011;
+  --foreground: #a7a8a3;
+  --card: #1b1d1e;
+  --card-foreground: #a7a8a3;
+  --popover: #1b1d1e;
+  --popover-foreground: #a7a8a3;
+  --muted: #2b2d2e;
+  --muted-foreground: #949592;
+  --accent: #2b2d2e;
+  --accent-foreground: #a7a8a3;
+  --primary: #a2a2a5;
+  --primary-foreground: #0f1011;
+  --secondary: #2b2d2e;
+  --secondary-foreground: #a7a8a3;
+  --cta: #a2a2a5;
+  --cta-foreground: #0f1011;
+  --ctahover: #adadb0;
+  --success: #c8be46;
+  --success-foreground: #0f1011;
+  --warning: #f3fd21;
+  --warning-foreground: #0f1011;
+  --destructive: #e6db43;
+  --destructive-foreground: #0f1011;
+  --info: #737074;
+  --info-foreground: #f9f9f9;
+  --busy: #edec32;
+  --busy-foreground: #0f1011;
+  --busy-ink: #edec32;
+  --border: #363838;
+  --input: #363838;
+  --ring: #a2a2a5;
+  --radius: 0.625rem;
+  --chart-primary: #a2a2a5;
+  --chart-secondary: #737271;
+  --status-success: #c8be46;
+  --status-warning: #f3fd21;
+  --status-in-progress: #737074;
+  --page-bg: #0f1011;
+  --page-bg-src: '';
+  --panel-bg: rgb(27 29 30 / 0.72);
+  --panel-border: rgb(54 56 56 / 0.9);
+  --panel-border-bare: rgb(54 56 56 / 0.55);
+  --panel-raised-bg: rgb(27 29 30 / 0.95);
+  --panel-raised-border: rgb(54 56 56 / 1);
+  --panel-accent: #a2a2a5;
+  --panel-header-bg: rgb(43 45 46 / 0.6);
+  --panel-header-fg: #a7a8a3;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #1b1d1e;
+  --glass-bg: rgb(27 29 30 / 0.55);
+  --glass-border: rgb(54 56 56 / 0.7);
+  --dock-bg: rgb(27 29 30 / 0.7);
+  --dock-border: rgb(54 56 56 / 0.8);
+  --dock-tooltip-bg: #2b2d2e;
+  --header-bg: rgb(27 29 30 / 0.8);
+  --header-border: rgb(54 56 56 / 0.9);
+  --header-fg: #a7a8a3;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(102 104 102 / 0.07);
+  --card-grid-color: rgb(102 104 102 / 0.05);
+  --panel-grid-color: rgb(102 104 102 / 0.06);
+  --scrollbar-thumb: rgb(109 111 110 / 0.6);
+  --scrollbar-thumb-hover: rgb(109 111 110 / 0.85);
+  --scrollbar-thin-thumb: rgb(109 111 110 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(109 111 110 / 0.7);
+  --brand: #a2a2a5;
+  --brand-foreground: #0f1011;
+  --brand-primary: #a2a2a5;
+  --brand-accent: #615f5e;
+  --brand-warm: #edec32;
+  --brand-deep: #0f1011;
+  --brand-muted: #6d6f6e;
+  --ink: #a7a8a3;
+  --surface-warm: #1b1d1e;
+  --naturegreen: #c8be46;
+  --naturegreen-foreground: #0f1011;
+  --duck-dark: #a7a8a3;
+  --duck-teal: #615f5e;
+  --duck-yellow: #f3fd21;
+  --duck-orange: #edec32;
+  --duck-forest: #c8be46;
+  --duck-beige: #292b2b;
+  --logo-src: '/officer-logo.svg';
+}

src/workspaces/theme/css/themes/batou.css

@@ -0,0 +1,97 @@
+/*
+  Batou — ported from a community Omarchy theme, not from basecamp/omarchy's own set.
+
+  Dark theme (dark), by luminance of its own background — the source repo carries no mode flag of its own to read.
+
+  Source: https://github.com/HANCORE-linux/omarchy-batou-theme (colors.toml (16-colour ANSI)), read by scripts/port-community-themes.ts. Values
+  went through deriveOmarchyPalette (scripts/themes/from-ansi.ts) because the source has no Omarchy 4
+  colors.toml — some tokens here are reconstructed, not authored. Every text/surface pair is contrast-checked the same way the official themes are.
+
+  DO NOT EDIT BY HAND. Re-run the script to refresh from the source repo.
+*/
+[data-theme='batou'] {
+  --background: #0a0a0a;
+  --foreground: #a4a4a4;
+  --card: #121212;
+  --card-foreground: #a4a4a4;
+  --popover: #121212;
+  --popover-foreground: #a4a4a4;
+  --muted: #232323;
+  --muted-foreground: #8c8c8c;
+  --accent: #232323;
+  --accent-foreground: #a4a4a4;
+  --primary: #c2bbb0;
+  --primary-foreground: #0a0a0a;
+  --secondary: #232323;
+  --secondary-foreground: #a4a4a4;
+  --cta: #c2bbb0;
+  --cta-foreground: #0a0a0a;
+  --ctahover: #c9c3b9;
+  --success: #a5a297;
+  --success-foreground: #0a0a0a;
+  --warning: #c6c4b0;
+  --warning-foreground: #0a0a0a;
+  --destructive: #e19e74;
+  --destructive-foreground: #0a0a0a;
+  --info: #605d5b;
+  --info-foreground: #dadada;
+  --busy: #d4b192;
+  --busy-foreground: #0a0a0a;
+  --busy-ink: #d4b192;
+  --border: #2f2f2f;
+  --input: #2f2f2f;
+  --ring: #c2bbb0;
+  --radius: 0.625rem;
+  --chart-primary: #c2bbb0;
+  --chart-secondary: #8a8575;
+  --status-success: #a5a297;
+  --status-warning: #c6c4b0;
+  --status-in-progress: #605d5b;
+  --page-bg: #0a0a0a;
+  --page-bg-src: '';
+  --panel-bg: rgb(18 18 18 / 0.72);
+  --panel-border: rgb(47 47 47 / 0.9);
+  --panel-border-bare: rgb(47 47 47 / 0.55);
+  --panel-raised-bg: rgb(18 18 18 / 0.95);
+  --panel-raised-border: rgb(47 47 47 / 1);
+  --panel-accent: #c2bbb0;
+  --panel-header-bg: rgb(35 35 35 / 0.6);
+  --panel-header-fg: #a4a4a4;
+  --panel-radius: 0.75rem;
+  --panel-blur: 12px;
+  --card-bg: #121212;
+  --glass-bg: rgb(18 18 18 / 0.55);
+  --glass-border: rgb(47 47 47 / 0.7);
+  --dock-bg: rgb(18 18 18 / 0.7);
+  --dock-border: rgb(47 47 47 / 0.8);
+  --dock-tooltip-bg: #232323;
+  --header-bg: rgb(18 18 18 / 0.8);
+  --header-border: rgb(47 47 47 / 0.9);
+  --header-fg: #a4a4a4;
+  --header-blur: 12px;
+  --pixel-grid-color: rgb(97 97 97 / 0.07);
+  --card-grid-color: rgb(97 97 97 / 0.05);
+  --panel-grid-color: rgb(97 97 97 / 0.06);
+  --scrollbar-thumb: rgb(56 55 53 / 0.6);
+  --scrollbar-thumb-hover: rgb(56 55 53 / 0.85);
+  --scrollbar-thin-thumb: rgb(56 55 53 / 0.45);
+  --scrollbar-thin-thumb-hover: rgb(56 55 53 / 0.7);
+  --brand: #c2bbb0;
+  --brand-foreground: #0a0a0a;
+  --brand-primary: #c2bbb0;
+  --brand-accent: #c2bbb0;
+  --brand-warm: #d4b192;
+  --brand-deep: #0a0a0a;
+  --brand-muted: #383735;
+  --ink: #a4a4a4;
+  --surface-warm: #121212;
+  --naturegreen: #a5a297;
+  --naturegreen-foreground: #0a0a0a;
+  --duck-dark: #a4a4a4;
+  --duck-teal: #c2bbb0;
+  --duck-yellow: #c6c4b0;
+  --duck-orange: #d4b192;
+  --duck-forest: #a5a297;
+  --duck-beige: #212121;
+  --logo-src: '/officer-logo.svg';
+}