agentbox-app 0.1.11 → 0.1.12

package/main/instruction-settings.mjs

@@ -1,15 +1,9 @@
 // A fixed allowlist exposes the instruction files, never arbitrary paths.
 // Defaults are shipped separately so an edited live file can always be reset.
 //
-// THERE ARE THREE OF THEM NOW, NOT FOUR (w-3dc46f3a67). Five editable layers of
-// prompts was too many for a person to manage, so some were merged.
-//
-// A person opening that page is answering two questions, what should agents do
-// and how should they talk to me, so the writing rules and the finishing rules
-// became ONE document: `message-rules.md`, "How agents write to you". In
-// practice a rules file is mostly about how agents write to the person rather
-// than what they do, which is why the two were one thing all along.
-// `joinMessageRules` below carries the two old files into the new one.
+// General and writing instructions are one user document (w-fb0fe5e85a).
+// The old message id remains available for callers from an older renderer;
+// once migrated, it reads, saves and restores the general instructions.
 import fs from 'node:fs';
 import path from 'node:path';
 import {fileURLToPath} from 'node:url';
@@ -25,6 +19,14 @@ import {nameSlug} from '../shared/product-name.mjs';
 const files = {rules:'founder.md',messages:'message-rules.md',adhd:'adhd-mode.md',system:'worker.md'};
 // The two names the joined document replaced, read only by the migration.
 const WAS_MESSAGES = ['writing-rules.md','finishing.md'];
+const UNIFIED = '.unified-agent-instructions';
+export function agentInstructionsUnified(appDir) {
+ return fs.existsSync(path.join(appDir,'briefs',UNIFIED));
+}
+function sectionFor(appDir,id) {
+ fileFor(id);
+ return id==='messages' && agentInstructionsUnified(appDir) ? 'rules' : id;
+}
 const defaults = JSON.parse(fs.readFileSync(fileURLToPath(new URL('../shared/instruction-defaults.json',import.meta.url)),'utf8'));
 function fileFor(id) {
  if (!Object.hasOwn(files,id)) throw new Error('Unknown instruction section');
@@ -36,6 +38,7 @@ function fileFor(id) {
 // them, so they ride on every run from the checkout and never sit in the box.
 const boxDefault=(id)=>(id==='rules'||id==='messages') ? '' : defaults[id];
 export function readInstruction(appDir,id,shippedDir=appDir) {
+ id=sectionFor(appDir,id);
  const file=fileFor(id);
  const defaultText=boxDefault(id);
  let text=defaultText;
@@ -68,7 +71,7 @@ const KEEP=20;
 const QUIET_MS=10*60*1000;
 function historyDir(appDir,id) {return path.join(appDir,HISTORY,id);}
 export function listVersions(appDir,id) {
- fileFor(id);
+ id=sectionFor(appDir,id);
  const dir=historyDir(appDir,id);
  let names;
  try {names=fs.readdirSync(dir);} catch(e) {if(e.code!=='ENOENT') throw e; return [];}
@@ -79,7 +82,7 @@ export function listVersions(appDir,id) {
  }).filter(Boolean).sort((a,b)=>b.ts-a.ts);
 }
 export function readVersion(appDir,id,ts) {
- fileFor(id);
+ id=sectionFor(appDir,id);
  const at=Number(ts);
  if(!Number.isFinite(at)) throw new Error('Unknown version');
  return {text:fs.readFileSync(path.join(historyDir(appDir,id),`${at}.md`),'utf8')};
@@ -102,6 +105,7 @@ function keepVersion(appDir,id,now=Date.now(),always=false) {
  } catch(e) {console.warn(`${nameSlug}: could not keep a restore point for ${id}: ${e.message}`);}
 }
 export function writeInstruction(appDir,id,text,now=Date.now()) {
+ id=sectionFor(appDir,id);
  const file=fileFor(id);
  if(typeof text!=='string') throw new Error('Instructions must be text');
  keepVersion(appDir,id,now);
@@ -150,6 +154,7 @@ export function carryHerBriefsAcross(fromDir,toDir) {
  if(!fromDir||!toDir||path.resolve(fromDir)===path.resolve(toDir)) return carried;
  for(const [id,file] of Object.entries(files)) {
   try {
+   if(id==='messages' && agentInstructionsUnified(toDir)) continue;
    const target=path.join(toDir,'briefs',file);
    if(fs.existsSync(target)) continue;
    let text;
@@ -196,6 +201,7 @@ export function carryHerBriefsAcross(fromDir,toDir) {
  */
 export function joinMessageRules(shippedDir,toDir) {
  try {
+  if(agentInstructionsUnified(toDir)) return null;
   const target=path.join(toDir,'briefs',files.messages);
   if(fs.existsSync(target)) return null;
   const read=(name)=>{try {return fs.readFileSync(path.join(toDir,'briefs',name),'utf8');} catch {return null;}};
@@ -225,6 +231,7 @@ export function joinMessageRules(shippedDir,toDir) {
  */
 export function setAsideShippedMessageRules(shippedDir,toDir) {
  try {
+  if(agentInstructionsUnified(toDir)) return false;
   const target=path.join(toDir,'briefs',files.messages);
   if(path.resolve(shippedDir)===path.resolve(toDir)||!fs.existsSync(target)) return false;
   const read=(name)=>{try {return fs.readFileSync(path.join(shippedDir,'briefs',name),'utf8').trim();} catch {return '';}};
@@ -241,3 +248,32 @@ export function setAsideShippedMessageRules(shippedDir,toDir) {
   return false;
  }
 }
+
+// Runs after the older migrations, before the supervisor or editors read.
+// Original message files and their histories remain on disk for recovery.
+// The completion marker prevents later boots reimporting them after an edit
+// or an intentional empty save. A failed save leaves both originals active.
+export function unifyAgentInstructions(shippedDir,toDir) {
+ try {
+  if(path.resolve(shippedDir)===path.resolve(toDir)||agentInstructionsUnified(toDir)) return null;
+  const general=readInstruction(toDir,'rules').text;
+  const writing=readInstruction(toDir,'messages').text;
+  if(writing.trim()) {
+   // If the combined save succeeded but completion was interrupted, the exact
+   // old text is already at the end. Retrying must not append it again.
+   const combined=general.endsWith(writing) ? general : general ? `${general}\n\n${writing}` : writing;
+   keepVersion(toDir,'rules',Date.now(),true);
+   keepVersion(toDir,'messages',Date.now(),true);
+   if(combined!==general) writeInstruction(toDir,'rules',combined);
+  }
+  const marker=path.join(toDir,'briefs',UNIFIED);
+  fs.mkdirSync(path.dirname(marker),{recursive:true});
+  const temporary=`${marker}.tmp-${process.pid}`;
+  fs.writeFileSync(temporary,'1\n','utf8');
+  fs.renameSync(temporary,marker);
+  return {general:general.length,writing:writing.length};
+ } catch(e) {
+  console.warn(`${nameSlug}: could not combine the agent instructions: ${e.message}`);
+  return null;
+ }
+}

package/main/ipc.mjs

@@ -400,6 +400,17 @@ export function registerIpc({ store, supervisor, config, window, analytics = NO_
       // coding agent this is one entry and an empty map, and nothing anywhere
       // draws anything new.
       engines,
+      // WHICH SUBSCRIPTION ALL OF THIS IS RUNNING ON (w-e217e577e5, 2026-10-07).
+      // A new user watched agents work and could not tell what was powering
+      // them, because the app finds whichever sign-in is already on the Mac and
+      // spends it in silence.
+      //
+      // It rides the snapshot rather than the settings model because the SIDEBAR
+      // reads it, which is on screen the whole time, and the settings model is
+      // only fetched while that screen is open. It costs no file read per tick:
+      // `main/runs-on.mjs` caches on the login files' own modification times, so
+      // this re-parses only after a sign-in or a profile refetch.
+      runsOn: supervisor.runsOnAccount(engines.workspace),
       // Whether this process is still the app on disk. It rides the snapshot
       // rather than boot-info because the staleness DEVELOPS while the app
       // runs: the case that cost her three times was a process left up for days
@@ -851,6 +862,14 @@ export function registerIpc({ store, supervisor, config, window, analytics = NO_
     return store.scheduleItem(product, id, runAt);
   });
 
+  // Snooze changes when a person sees the thread, never what an agent does.
+  ipcMain.handle('zero:snooze', (_e, { product, id, snoozedUntil }) => {
+    if (isAgentRow(id)) return { ok: false };
+    const item = store.snoozeItem(product, id, snoozedUntil);
+    push();
+    return item;
+  });
+
   // said about an agent instead of about a task. The row it moves stands for
   // somebody's terminal, so this writes to no ledger, sends no message and
   // stops no process: it records the moment her inbox should raise the agent

package/main/machine.mjs

@@ -156,5 +156,5 @@ export function perAccountAgents(total, accounts) {
 export function machineNote({ slots, memGb, cores, known = true }, at = 0) {
   if (!known) return null;
   if (at && at <= slots) return null;
-  return `This Mac has ${memGb} GB and ${cores} cores, so we suggest ${slots} at once. Go higher if you want to.`;
+  return `This computer has ${memGb} GB and ${cores} cores, so we suggest ${slots} at once. Go higher if you want to.`;
 }

package/main/main.mjs

@@ -21,7 +21,7 @@ import { storeRootEnv } from './store/home.mjs';
 import { Supervisor } from './supervisor.mjs';
 import { startCodexWatch } from './codex-watch.mjs';
 import { registerIpc } from './ipc.mjs';
-import { carryHerBriefsAcross, joinMessageRules, setAsideShippedMessageRules } from './instruction-settings.mjs';
+import { carryHerBriefsAcross, joinMessageRules, setAsideShippedMessageRules, unifyAgentInstructions } from './instruction-settings.mjs';
 import * as approvals from './approvals.mjs';
 import { recoveryToast } from '../shared/recovery.mjs';
 import { dataFolderName, isNewUserBuild } from '../shared/side-build.mjs';
@@ -206,6 +206,9 @@ try {
   // AND A BOX THAT AN OLDER JOIN FILLED WITH ONLY OUR TEXT IS EMPTIED, ONCE
   // (w-3ec9f07978). Kept as a restore point; our rules ride from the checkout.
   if (setAsideShippedMessageRules(appDir, userDir)) console.log('zero: the message rules box held only the shipped rules; set aside as a restore point');
+  // Both kinds of user rules now live in founder.md. Only user content is
+  // appended; the app's message defaults continue to come from the bundle.
+  if (unifyAgentInstructions(appDir, userDir)) console.log('zero: combined the general and writing instructions');
 } catch (err) {
   console.warn(`zero: could not carry her instructions into ${userDir}: ${err.message}`);
 }
@@ -603,6 +606,11 @@ async function createWindow() {
     },
   });
 
+  // THE MENU IS A BAR INSIDE THE WINDOW on Linux and Windows. On macOS it is
+  // the system menu, so it stays. The menu itself stays everywhere: the Ctrl
+  // chords are bound to it, and taking the menu out would take them with it.
+  if (process.platform !== 'darwin') window.setMenuBarVisibility(false);
+
   // WHICH PICTURE SET THIS WINDOW IS ON, and a shout when it changes.
   // main/screen-detail.mjs has the rule and the reasoning; this is the wiring.
   // The initial answer rides bootInfo rather than being pushed, for the same
@@ -1014,6 +1022,17 @@ if (!app.requestSingleInstanceLock()) {
     }
   });
   app.whenReady().then(() => {
+    // A from-source Linux launch keeps the launcher command installed. The
+    // entry runs that command; this only refreshes where it points. A packaged
+    // build ships its own entry and must not write one from here.
+    // LOADED HERE AND NOT AT THE TOP: scripts/ is not in the packaged app or the
+    // npx package, and a static import of it stopped main.mjs loading at all,
+    // on every Mac (tests/the-mac-app-ships-every-file-it-starts-with).
+    if (process.platform === 'linux' && !app.isPackaged) {
+      import('../scripts/linux-launcher.mjs')
+        .then(({ installLinuxLauncher }) => installLinuxLauncher({ appDir, env: process.env }))
+        .catch(() => { /* a launcher is never a reason to stop a launch */ });
+    }
     // THE ABOUT BOX SAYS AGENTBOX AND ITS OWN VERSION (w-db6f5e331e). Run from
     // source it read the bundle's, which is Electron's: "Electron 43.0.0".
     app.setAboutPanelOptions({ applicationName: NAME, applicationVersion: app.getVersion(), version: '' });

package/main/memory-gate.mjs

@@ -68,7 +68,7 @@ export const DEFAULTS = {
 
 export function refusal(waitedMs) {
   const minutes = Math.max(1, Math.round(waitedMs / 60_000));
-  return `This Mac is short of memory, so ${NAME} held this command for ${minutes} minute${minutes === 1 ? '' : 's'} `
+  return `This computer is short of memory, so ${NAME} held this command for ${minutes} minute${minutes === 1 ? '' : 's'} `
     + 'while heavier work ran, and it still cannot start it. Do not retry it straight away. Carry on with anything '
     + 'that does not need it, or end your turn and say you are waiting for memory.';
 }

package/main/notify.mjs

@@ -104,7 +104,7 @@ export function createNotifier({ window, Notification, powerMonitor, coalesceMs
     // two-minute diagnosis.
     n.on('failed', (_e, err) => {
       live = null;
-      console.warn(`zero: macOS refused the notification (${err}). Check ${NAME} in System Settings > Notifications.`);
+      console.warn(`zero: the system refused the notification (${err}). Check ${NAME} in the system notification settings.`);
     });
     live = n;
     try {

package/main/refresh-agent-models.mjs

@@ -3,11 +3,12 @@ import {createCodexAppServer} from './codex-app-server.mjs';
 import {rememberCodexModels} from './codex-models.mjs';
 import {forget,claudeModels} from './claude-models.mjs';
 import {terminalEnv} from './task-terminals.mjs';
+import {codexLaunchEnv} from './codex-launch-env.mjs';
 export async function refreshAgentModels(engine,config,home){
  if(engine==='claude'){forget();claudeModels({bin:config.claudeBin});return;}
  // Codex is optional and codexBin is null without it: nothing to ask, and spawn(null) only threw into the terminal.
  if(!config.codexBin)return;
- const client=createCodexAppServer({spawn:()=>spawn(config.codexBin,['app-server'],{cwd:config.home,env:{...terminalEnv(),CODEX_HOME:home},stdio:['pipe','pipe','pipe']}),requestTimeoutMs:10000});
+ const client=createCodexAppServer({spawn:()=>spawn(config.codexBin,['app-server'],{cwd:config.home,env:codexLaunchEnv(config.codexBin,{...terminalEnv(),CODEX_HOME:home}),stdio:['pipe','pipe','pipe']}),requestTimeoutMs:10000});
  const deadline=setTimeout(()=>client.close('Model refresh timed out'),15000);
  try{
   await client.initialize();let cursor=null;const models=[];const seen=new Set();

package/main/row-label.mjs

@@ -35,6 +35,7 @@
 // words the moment they open the row (shared/work-items.mjs).
 
 import { spawn } from 'node:child_process';
+import { codexLaunchEnv } from './codex-launch-env.mjs';
 
 /**
  * The model this runs on. Small and fast on purpose: this is a naming call, it
@@ -225,7 +226,7 @@ export function askSmallModel(prompt, clean, { claudeBin, codexBin = null, engin
         // Somewhere that is nobody's project. A naming call must not pick up a
         // CLAUDE.md, a settings file or a hook from whatever folder it lands in.
         cwd: '/tmp',
-        ...(env ? { env } : {}),
+        ...(engine === 'codex' ? { env: codexLaunchEnv(bin, env) } : env ? { env } : {}),
         stdio: ['ignore', 'pipe', 'pipe'],
       });
     } catch {

package/main/runs-on.mjs

@@ -0,0 +1,93 @@
+// WHICH ACCOUNT THE AGENTS ARE ACTUALLY RUNNING ON, read off this Mac.
+//
+// w-e217e577e5, 2026-10-07, from a session with a new user: "He didn't realize
+// it auto-connected to Claude/Codex; he wasn't sure how it was even running."
+//
+// Every fact here was already on the disk and already being read, each by the
+// screen that needed it: main/claude-plan.mjs for the Claude plan (the Accounts
+// page), main/codex-account.mjs for the ChatGPT one (the Codex card). What did
+// not exist was ONE answer to "what is powering this", in a shape small enough
+// to ride the snapshot and be drawn in a corner. That is all this is: the two
+// readers, asked about the one account the fleet is spending, and null whenever
+// the answer would be a guess.
+//
+// NULL IS AN ORDINARY ANSWER AND IT MEANS DRAW NOTHING. A Mac mid-setup, a
+// config file being rewritten under us, a login that exists with no plan string
+// in it: the first two are null, the third is the name with no plan. Nothing
+// here ever reports an account that is not there, because the corner it feeds
+// is read by somebody deciding whose money this is spending.
+//
+// IT IS CACHED ON THE LOGIN FILES' OWN TIMES, NOT ON A CLOCK. The snapshot is
+// built every ten seconds and `~/.claude.json` is 148 KB on the machine this was
+// written on, so parsing it per tick is work nobody asked for; it is also a file
+// that genuinely changes, since Claude Code refetches its own profile as it
+// runs. `signInFiles`/`signInStamp` (main/sign-in-files.mjs) already name the
+// files a login writes and read their modification times and nothing else, so
+// the cache key is the newest of those times. A moved time re-reads. A cache
+// that aged out on a timer instead would be either stale after a sign-in or
+// re-parsing for nothing, and the file itself knows which.
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { planFile, planOfAccount } from './claude-plan.mjs';
+import { codexAccount, codexAuthFile } from './codex-account.mjs';
+import { signInFiles, signInStamp } from './sign-in-files.mjs';
+
+/** keyed by engine and folder, valued by the stamp it was read at. */
+const remembered = new Map();
+
+/**
+ * WHAT THE FLEET IS RUNNING ON, or null because nothing readable is signed in.
+ *
+ * @param {object} facts
+ * @param {string} facts.engine Which coding agent the workspace runs on, which
+ *   the supervisor has already decided (`Supervisor#engineFacts`). Never worked
+ *   out here: the capability gate lives there, and a corner that guessed could
+ *   name the subscription the fleet is not spending.
+ * @param {string} [facts.claudeProfile] The Claude login, `default` or a folder.
+ * @param {string} [facts.codexHome] The CODEX_HOME this workspace runs on.
+ * @returns {{ engine: string, plan: string|null }|null} `plan` is the words the
+ *   tool itself reports, never a label of ours.
+ */
+export function runsOn({ engine = null, home = os.homedir(), claudeProfile = 'default', codexHome = null } = {}) {
+  if (engine !== 'claude' && engine !== 'codex') return null;
+  const folder = engine === 'codex'
+    ? (codexHome || path.join(home, '.codex'))
+    : (!claudeProfile || claudeProfile === 'default' ? null : claudeProfile);
+  // The home is in the key as well as the folder. A default Claude login has no
+  // folder of its own, so without it two homes share one entry, which is exactly
+  // what a test with a throwaway home does and what a packaged app would do if
+  // HOME ever moved under it.
+  const key = `${engine}:${home}:${folder ?? 'default'}`;
+  const stamp = signInStamp(signInFiles({ engine, folder, home }));
+  const seen = remembered.get(key);
+  if (seen && seen.stamp === stamp) return seen.value;
+  const value = stamp ? read(engine, { home, claudeProfile, folder }) : null;
+  remembered.set(key, { stamp, value });
+  return value;
+}
+
+function read(engine, { home, claudeProfile, folder }) {
+  if (engine === 'codex') {
+    const id = codexAccount(null, { file: codexAuthFile(folder) });
+    return id ? { engine: 'codex', plan: id.plan ?? null } : null;
+  }
+  // THE LOGIN AND THE PLAN COME OUT OF ONE READ. `readPlan` answers only the
+  // second, and "not signed in" and "signed in with no plan string" are two
+  // different screens: the first draws nothing, the second draws the name.
+  let account = null;
+  try {
+    account = JSON.parse(fs.readFileSync(planFile(claudeProfile, home), 'utf8'))?.oauthAccount ?? null;
+  } catch {
+    return null;
+  }
+  if (!account || typeof account !== 'object') return null;
+  const plan = planOfAccount(account);
+  return { engine: 'claude', plan: plan.known ? plan.label : null };
+}
+
+/** Forgets every cached reading. For tests, and for a sign-out that lands. */
+export function forgetRunsOn() {
+  remembered.clear();
+}

package/main/serve.mjs

@@ -32,6 +32,7 @@ import { spawn } from 'node:child_process';
 import { loadConfig } from './config.mjs';
 import { Store } from './store.mjs';
 import { Supervisor } from './supervisor.mjs';
+import { carryHerBriefsAcross, joinMessageRules, setAsideShippedMessageRules, unifyAgentInstructions } from './instruction-settings.mjs';
 import { registerIpc } from './ipc.mjs';
 import { reportFromRenderer } from './crash-report.mjs';
 import * as workItemsDisk from './store/work-items.mjs';
@@ -152,11 +153,17 @@ function answerWhatOnlyTheWindowAnswered(ipcMain) {
  */
 export async function bootHeadless({ dataDir = repoRoot, appDir = repoRoot, userDir = dataDir } = {}) {
   const config = loadConfig(dataDir);
+  // The browser editor uses the same user files as the desktop. Finish the
+  // older migrations first so only user content enters the combined file.
+  carryHerBriefsAcross(appDir, userDir);
+  joinMessageRules(appDir, userDir);
+  setAsideShippedMessageRules(appDir, userDir);
+  unifyAgentInstructions(appDir, userDir);
   // THE APP'S OWN HOME IS THE STORE ROOT, BEFORE ANYTHING OPENS THE STORE, as
   // main/main.mjs does for the desktop. The ledgers live under the home the
   // store reads from this variable, and every worker is handed `storeRoot` as
   // that same variable. Without this line the two disagreed: the copy wrote its
-  // rows wherever an inherited variable pointed (or `~/.agentbox`), each worker
+  // rows wherever an inherited variable pointed (or a dot-folder in $HOME), each worker
   // looked under `storeRoot`, and every store call answered "no work item".
   // tests/an-agent-in-a-browser-copy-can-reach-its-own-work-item.test.mjs.
   // Rows already written under the old home come along, or they would vanish.
@@ -224,6 +231,9 @@ export function createServer({ channels, token, listeners = new Set(), dist = pa
     // an EventSource. It guards the two doors that reach the store. The built
     // screen is the same public files for everybody, and its own script and
     // style requests carry no token, so asking for one there drew a blank tab.
+    // NOR DOES THE PAGE ITSELF ASK: the tab takes the token out of its address
+    // bar on load, so a reload asks for `/` bare, and refusing that drew
+    // "Wrong or missing token" on every reload (tests/a-browser-tab-survives-a-reload).
     const guarded = url.pathname === '/events' || url.pathname.startsWith('/api/');
     const given = req.headers['x-agentbox-token'] || url.searchParams.get('token');
     if (guarded && given !== token) {

package/main/settings.mjs

@@ -449,6 +449,10 @@ export function readSettings({ config, supervisor, store }) {
       permission: override ? permissionMode(override) : 'workspace',
       permissionArgs: override ?? null,
       codexMode: config.projectCodexMode?.[product.slug] ?? 'workspace',
+      // THE SUPERVISOR IS ASKED RATHER THAN THE CONFIG FILE, so the page shows
+      // what will actually happen: a tie naming a login that has been signed out
+      // is ignored when work is handed out, and reads 'any' here too.
+      account: supervisor._projectProfile?.(product.slug) ?? 'any',
       instructions,
       running: sessions.filter((s) => s.product === product.slug).length,
     };
@@ -727,6 +731,24 @@ export function setProjectSetting({ config, supervisor }, { product, key, value
       saveConfig(config, { projectCodexMode: Object.keys(map).length ? map : undefined });
       break;
     }
+    // WHICH CLAUDE LOGIN THIS PROJECT'S AGENTS RUN ON. 'any' is the absence of
+    // an opinion, like 'workspace' above, and it deletes the entry rather than
+    // writing a word: a config file with no `projectAccounts` is the file every
+    // Mac had before this existed.
+    //
+    // AND A NAME THIS MAC CANNOT HONOUR IS REFUSED AT THE DOOR rather than
+    // written and ignored later. The supervisor does ignore one (`_projectProfile`),
+    // because an account can be signed out after the fact, but a pick made
+    // against a list we just read has no excuse to be wrong.
+    case 'account': {
+      const known = effectiveProfiles(config.authProfiles, { home: config.home });
+      if (value !== 'any' && !known.includes(value)) throw new Error(`unknown Claude account: ${value}`);
+      const map = { ...(config.projectAccounts ?? {}) };
+      if (value === 'any') delete map[product];
+      else map[product] = value;
+      saveConfig(config, { projectAccounts: Object.keys(map).length ? map : undefined });
+      break;
+    }
     default:
       throw new Error(`unknown project setting: ${key}`);
   }
@@ -842,7 +864,7 @@ export function memoryGateSettings({ config, supervisor }) {
   if (on) {
     let s = null;
     try { s = supervisor.memoryGateStatus?.() ?? null; } catch {}
-    if (s?.role === 'standby') now = `Another ${NAME} on this Mac is coordinating.`;
+    if (s?.role === 'standby') now = `Another ${NAME} on this computer is coordinating.`;
     else if (s) {
       const heavy = (s.running ?? []).filter((r) => r.holdsSlot).length;
       const waiting = (s.waiting ?? []).length;

package/main/ship-queue.mjs

@@ -188,7 +188,7 @@ export function failureReply(output) {
     ...(died ? [
       '',
       'Its test run DIED rather than going red: nothing it printed names a failing',
-      'test. Look for what killed the run. This Mac runs a dozen agents at once, so',
+      'test. Look for what killed the run. This computer runs a dozen agents at once, so',
       'a worker that was starved or timed out is likelier than a bug in your change.',
       'Run the tests for your change again before you go looking for one.',
     ] : []),

package/main/store/home.mjs

@@ -15,7 +15,10 @@
 // and repeat rules all sat in it.
 //
 // So this is the same convention, one name over: a dot-folder in her home
-// named after this app.
+// named after this app. On Linux a fresh install does not get that dot-folder,
+// and it does not get a visible folder of the app's name in $HOME. Application
+// data belongs in $XDG_DATA_HOME (see defaultStoreRoot). An existing dot-folder
+// is still read, so a store already on disk is not orphaned.
 //
 // WHAT MOVES AND WHAT DOES NOT, because the line is not "everything of ours".
 // The app's own RECORDS move: the work item ledger, session traces, run
@@ -37,7 +40,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import crypto from 'node:crypto';
-import { WAS, envNames, nameSlug, readEnv } from '../../shared/product-name.mjs';
+import { Name, WAS, envNames, nameSlug, readEnv } from '../../shared/product-name.mjs';
 
 const isDir = (dir) => { try { return fs.statSync(dir).isDirectory(); } catch { return false; } };
 
@@ -61,6 +64,25 @@ export function storeRootEnv(storeRoot) {
   return env;
 }
 
+// Where a config that names no store keeps the inbox.
+//
+// macOS, and anything that is not Linux: a folder of the app's name in the
+// home directory. That is the folder this app has used since 2026-09-22.
+// Linux: $XDG_DATA_HOME/<slug>, or ~/.local/share/<slug> when the variable is
+// unset, blank, or not an absolute path. A visible directory in $HOME is not
+// where an application writes. Measured 2026-10-07: a config that named no
+// store created one.
+//
+// The home and the environment are arguments so a test can ask about another
+// machine. A caller that passes a stand-in home must pass an environment that
+// belongs to it. This function does not decide that; it uses the env it is given.
+export function defaultStoreRoot({ home = os.homedir(), platform = process.platform, env = process.env } = {}) {
+  if (platform !== 'linux') return path.join(home, Name);
+  const given = typeof env?.XDG_DATA_HOME === 'string' ? env.XDG_DATA_HOME.trim() : '';
+  const base = given && path.isAbsolute(given) ? given : path.join(home, '.local', 'share');
+  return path.join(base, nameSlug);
+}
+
 // One env var, for tests and for anyone who keeps their home somewhere else.
 // Read at call time rather than captured, because a test sets it per case.
 //
@@ -74,9 +96,10 @@ export function storeRootEnv(storeRoot) {
 // store goes missing on the release that renames the app.
 // `homeDir` is injected so a test can ask what this answers on a machine with
 // an old dot-folder on it, without one having to exist on the machine running
-// the test. Production never passes it.
-export function appHome(homeDir = os.homedir()) {
-  const override = readEnv('HOME');
+// the test. `platform` and `env` are the same kind of injection: this suite
+// runs on a Mac and still has to answer a Linux home. Production passes neither.
+export function appHome(homeDir = os.homedir(), { platform = process.platform, env } = {}) {
+  const override = readEnv('HOME', env);
   if (override) return override;
   const here = path.join(homeDir, `.${nameSlug}`);
   if (isDir(here)) return here;
@@ -84,6 +107,15 @@ export function appHome(homeDir = os.homedir()) {
     const older = path.join(homeDir, `.${was.toLowerCase()}`);
     if (isDir(older)) return older;
   }
+  // A fresh Linux directory has nothing of ours on disk yet. The answer has to
+  // be the same path loadConfig opens, or the desktop and this lookup write two
+  // stores. The machine's own XDG_DATA_HOME is an absolute path in the real
+  // home; applying it to a stand-in home writes that stand-in's store there.
+  // A caller that passes `env` is asking about that environment, not this one.
+  if (platform === 'linux') {
+    const real = env === undefined && path.resolve(homeDir) === path.resolve(os.homedir());
+    return defaultStoreRoot({ home: homeDir, platform: 'linux', env: real ? process.env : (env ?? {}) });
+  }
   return here;
 }
 

package/main/store/project.mjs

@@ -4,34 +4,30 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import os from 'node:os';
 import crypto from 'node:crypto';
 import { SCHEMA_VERSION, validateCreation, creationText, TEXT_CREATION_KINDS } from '../../shared/contracts.mjs';
 import { assertInside, assertCreationDir, deniesGitOrEnvPath } from './paths.mjs';
 import { migrateIndex } from './migrate.mjs';
 import { withProjectLockSync } from './project-lock.mjs';
-import { Name, readEnv } from '../../shared/product-name.mjs';
-
-// The machine-wide root: ASTRAL_HOME, else the folder named below. This is
-// where device-local files live (settings.json, ui-state.json, usage.json,
-// .runtime-pids, ...) and where a founder's PRE-account projects sit until they
-// are migrated into an account space. It is NEVER account-scoped: those files
-// stay global (Phase 1).
+import { readEnv } from '../../shared/product-name.mjs';
+import { defaultStoreRoot } from './home.mjs';
+
+// The machine-wide root: the store-home variable, else the same default
+// loadConfig uses when a config names no store. This is where device-local
+// files live (settings.json, ui-state.json, usage.json, .runtime-pids, ...)
+// and where a founder's PRE-account projects sit until they are migrated into
+// an account space. It is NEVER account-scoped: those files stay global
+// (Phase 1).
 //
-// THE FALLBACK IS THE APP'S OWN NAME NOW, where it used to be an older
-// product's folder.
+// THE FALLBACK IS defaultStoreRoot. On macOS that is a folder of the app's
+// name. On Linux it is the XDG data directory. A visible folder in $HOME was
+// the fallback until 2026-10-07, and a config that named no store created one.
 //
-// NOTHING WAS DELETED AND NOTHING MOVED. That folder is still on disk exactly
-// as it was. What changed is that this app stops reaching for it by default.
 // Her live store is named in zero.config.json and handed to every worker as
-// the app's own home variable, so this line was never the path she runs on; it
-// was only ever
-// the answer for an install carrying no config at all.
-//
-// An older product's HOME env var used to sit between these two. It is gone:
-// nothing sets it any more now that the store server carries the app's own name.
+// the app's own home variable, so this line is only ever the answer for an
+// install carrying no config and no store-home variable.
 export function legacyRoot() {
-  return readEnv('HOME') || path.join(os.homedir(), Name);
+  return readEnv('HOME') || defaultStoreRoot();
 }
 
 // The account currently signed in, if any. Set once at boot and re-resolved on

package/main/store.mjs

@@ -471,10 +471,7 @@ export class Store {
   // app restart, a reboot, and a store restored onto another machine, and so no
   // agent line can quietly move a time she set. 0 clears it.
   //
-  // This is the one write behind both gestures: deferring an agent's proposal
-  // out of the inbox and scheduling her own work to start at six. They were
-  // separate mechanisms before, and only the first existed: the old snooze was
-  // a renderer localStorage map that hid a row and deferred no work at all.
+  // Execution scheduling only. Inbox reminders use snoozeItem instead.
   scheduleItem(slug, id, runAt) {
     const { workItemsDisk } = this.modules;
     return workItemsDisk.updateWorkItem(
@@ -482,6 +479,15 @@ export class Store {
     );
   }
 
+  // Put the existing thread back in the person's inbox later. This never
+  // changes its execution schedule, answer, status, claim or delivery marks.
+  snoozeItem(slug, id, snoozedUntil) {
+    if (!Number.isFinite(snoozedUntil)) throw new Error('Snooze needs a valid time');
+    return this.modules.workItemsDisk.updateWorkItem(
+      this.productDir(slug), id, { snoozedUntil: Math.max(0, Math.trunc(snoozedUntil)) }, { source: 'founder' },
+    );
+  }
+
   // WHO A SHARED ROW IS WITH, changed by a person: handed to an agent, kept,
   // handed back, or passed on by a reply. Only the team fields, on the
   // person's own authority, so an agent writing afterwards cannot undo it.