agentbox-app 0.1.11 → 0.1.13

package/main/memory-log.mjs

@@ -0,0 +1,124 @@
+// A LINE A MINUTE: HOW SHORT MEMORY IS, AND WHICH TASK IS HOLDING IT (w-ec27ff1a51).
+//
+// 2026-10-11 the Mac ran out of memory with Agentbox at 22 GB. By the time
+// anyone looked it had calmed down, and nothing had been written down, so which
+// task had been holding the memory could only be guessed. This writes one JSON
+// line a minute to `memory-<day>.jsonl` in the app's own folder, kept a week:
+// the kernel's reading, the agents running and the limit, whether new agents
+// were being held (main/start-hold.mjs), the app's own processes, every task's
+// programs with what they hold, and the biggest programs that are not ours.
+//
+// It stays on this computer. Nothing here is sent anywhere.
+//
+// A program belongs to the task of the nearest process at or above it that
+// carries ZERO_ITEM (main/leftovers.mjs reads the tag), which is what catches a
+// dev server that renamed itself and hid its environment.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { listProcesses } from './leftovers.mjs';
+import { readMacPressure } from './memory-gate-server.mjs';
+import { pressureFrom } from './memory-gate.mjs';
+
+/** Days of files kept, today included. */
+export const KEEP_DAYS = 7;
+const FILE = /^memory-(\d{4}-\d{2}-\d{2})\.jsonl$/;
+
+const name = (exe) => String(exe ?? '').split('/').filter(Boolean).pop() || String(exe ?? '');
+const top = (list, n) => [...list].sort((a, b) => b.mb - a.mb).slice(0, n).map((p) => ({ name: name(p.exe), mb: Math.round(p.mb) }));
+
+/** One minute's line, from one listing. Pure. */
+export function summarizeMemory(procs, { appPid = process.pid, at = Date.now(), reading = {} } = {}) {
+  const byPid = new Map(procs.map((p) => [p.pid, p]));
+  const owner = new Map();
+  const ownerOf = (p) => {
+    if (owner.has(p.pid)) return owner.get(p.pid);
+    let found = null;
+    const seen = new Set();
+    for (let q = p; q && !seen.has(q.pid); q = byPid.get(q.ppid)) {
+      seen.add(q.pid);
+      if (q.item) { found = { item: q.item, product: q.product ?? null }; break; }
+      if (q.pid === appPid) { found = 'app'; break; }
+    }
+    owner.set(p.pid, found);
+    return found;
+  };
+  const tasks = new Map();
+  const app = [];
+  const others = [];
+  for (const p of procs) {
+    const o = ownerOf(p);
+    if (o === 'app') app.push(p);
+    else if (o) {
+      const t = tasks.get(o.item) ?? { item: o.item, product: o.product, list: [] };
+      t.product ??= o.product;
+      t.list.push(p);
+      tasks.set(o.item, t);
+    } else others.push(p);
+  }
+  const sum = (list) => Math.round(list.reduce((n, p) => n + (Number(p.mb) || 0), 0));
+  const level = Number.isFinite(reading?.level) ? reading.level : null;
+  const freePct = Number.isFinite(reading?.freePct) ? reading.freePct : null;
+  return {
+    at: new Date(at).toISOString(),
+    pressure: level === null && freePct === null ? null : pressureFrom({ level, freePct }),
+    level,
+    freePct,
+    totalMb: sum(procs),
+    app: { mb: sum(app), procs: app.length },
+    tasks: [...tasks.values()]
+      .map((t) => ({ item: t.item, product: t.product, mb: sum(t.list), procs: t.list.length, top: top(t.list, 3) }))
+      .sort((a, b) => b.mb - a.mb),
+    others: top(others, 5),
+  };
+}
+
+const dayOf = (ms) => {
+  const d = new Date(ms);
+  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
+};
+
+export class MemoryLog {
+  constructor({
+    dir, appPid = process.pid, list = listProcesses, readPressure = readMacPressure,
+    now = Date.now, facts = () => ({}), keepDays = KEEP_DAYS,
+  }) {
+    Object.assign(this, { dir, appPid, list, readPressure, now, facts, keepDays });
+    this._pruned = null;
+  }
+
+  /** Writes this minute's line. Never throws: a log that breaks the app is worse than a gap in the log. */
+  async tick() {
+    if (this._busy) return;
+    this._busy = true;
+    try {
+      const [procs, reading] = await Promise.all([
+        Promise.resolve().then(() => this.list()).catch(() => []),
+        Promise.resolve().then(() => this.readPressure()).catch(() => ({})),
+      ]);
+      const at = this.now();
+      let facts = {};
+      try { facts = this.facts() ?? {}; } catch { /* the line goes without them */ }
+      const line = { ...summarizeMemory(procs, { appPid: this.appPid, at, reading }), ...facts };
+      fs.mkdirSync(this.dir, { recursive: true });
+      fs.appendFileSync(path.join(this.dir, `memory-${dayOf(at)}.jsonl`), `${JSON.stringify(line)}\n`);
+      this._prune(at);
+    } catch (err) {
+      console.warn('zero: memory log:', err.message);
+    } finally {
+      this._busy = false;
+    }
+  }
+
+  /** Once a day: removes this log's own files older than `keepDays`, and nothing else. */
+  _prune(at) {
+    const today = dayOf(at);
+    if (this._pruned === today) return;
+    this._pruned = today;
+    const oldest = dayOf(new Date(at).setDate(new Date(at).getDate() - (this.keepDays - 1)));
+    for (const f of fs.readdirSync(this.dir)) {
+      const m = f.match(FILE);
+      if (m && m[1] < oldest) fs.rmSync(path.join(this.dir, f), { force: true });
+    }
+  }
+}

package/main/notify.mjs

@@ -13,16 +13,46 @@
 // AND ONCE, NOT TWENTY TIMES. One at a time is not once. `spoke` below is the
 // fix, and shared/notify-rules.mjs carries the rule.
 
+import path from 'node:path';
 import { atTheApp, banner, shouldSpeak } from '../shared/notify-rules.mjs';
 import { NAME } from '../shared/product-name.mjs';
 
+// THE MARK THE BANNER WEARS, and why it is a png and not the .icns every other
+// part of this repo uses.
+//
+// macOS draws the app's OWN bundle icon down the left of a banner, and no app
+// can override that. From a source checkout the bundle being asked is the
+// Electron.app in node_modules, which scripts/brand-electron.mjs renames and
+// re-icons, and macOS still drew a generic grey square: "it shows a plain
+// placeholder", looking at a real one, 2026-10-07.
+//
+// An image handed to the notification is the half we DO control; macOS attaches
+// it to the banner. Measured the same day in the Electron the app runs from:
+// nativeImage.createFromPath on build/icon.icns comes back empty, 0x0, so the
+// icns is not a candidate however convenient it would be. The png beside it,
+// drawn from the same art, reads 256x256.
+//
+// AN EMPTY IMAGE IS NOT A MARK. createFromPath answers a missing or unreadable
+// file with an empty image rather than an error, so "it returned something" is
+// the wrong question, and handing that something to macOS is how this goes
+// quietly back to a grey square. Returns null when there is nothing to show,
+// and the banner then looks exactly as it did before any of this.
+export const MARK_FILE = path.join('build', 'notification-icon.png');
+
+export function markFor({ root, createFromPath }) {
+  try {
+    const img = createFromPath(path.join(root, MARK_FILE));
+    return img && !img.isEmpty() ? img : null;
+  } catch { return null; }
+}
+
 // A BURST IS ONE PIECE OF NEWS. Four workers finishing inside the same
 // supervisor tick is the ordinary case, and it arrives as four pushes over a
 // second or two. Waiting a beat before speaking turns that into one banner
 // with one sound instead of four rewrites and four chimes.
 const COALESCE_MS = 1500;
 
-export function createNotifier({ window, Notification, powerMonitor, coalesceMs = COALESCE_MS }) {
+export function createNotifier({ window, Notification, powerMonitor, icon = null, coalesceMs = COALESCE_MS }) {
   // Everything she has not seen since she last had the window, keyed by id so
   // a repeated push is idempotent. Insertion order is arrival order.
   const unseen = new Map();
@@ -81,6 +111,9 @@ export function createNotifier({ window, Notification, powerMonitor, coalesceMs
         title: say.title,
         body: say.body,
         silent: false,
+        // Omitted rather than passed empty when there is nothing to show, so a
+        // banner with no mark is byte for byte the banner that shipped before.
+        ...(icon ? { icon } : {}),
       });
     } catch { return; }
     // A banner she can act on. Clicking it brings Agentbox forward and opens the
@@ -104,7 +137,7 @@ export function createNotifier({ window, Notification, powerMonitor, coalesceMs
     // two-minute diagnosis.
     n.on('failed', (_e, err) => {
       live = null;
-      console.warn(`zero: macOS refused the notification (${err}). Check ${NAME} in System Settings > Notifications.`);
+      console.warn(`zero: the system refused the notification (${err}). Check ${NAME} in the system notification settings.`);
     });
     live = n;
     try {
@@ -138,18 +171,28 @@ export function createNotifier({ window, Notification, powerMonitor, coalesceMs
   };
 }
 
-export function installNotifier({ app, window, Notification, powerMonitor, ipcMain }) {
+// `onArrivals` hears every arrival too, for the phone's alerts
+// (main/phone-link.mjs), which make their own call about speaking.
+export function installNotifier({ app, window, Notification, powerMonitor, ipcMain, nativeImage, onArrivals = () => {} }) {
   if (Notification.isSupported && !Notification.isSupported()) {
+    ipcMain.handle('zero:notify', (_e, payload = {}) => { try { onArrivals(Array.isArray(payload.arrivals) ? payload.arrivals : []); } catch {} });
     return { add() {}, seen() {} };
   }
-  const notifier = createNotifier({ window, Notification, powerMonitor });
+  // app.getAppPath() is the repo from source and the asar inside the bundle
+  // when it is packaged, and the mark sits at the same place in both.
+  const icon = nativeImage
+    ? markFor({ root: app.getAppPath(), createFromPath: (p) => nativeImage.createFromPath(p) })
+    : null;
+  const notifier = createNotifier({ window, Notification, powerMonitor, icon });
   window.on('focus', () => notifier.seen());
   // Unlocking with Agentbox already the front app never fires 'focus' (it never
   // lost it), so without this the banner that fired while the screen was
   // locked would sit in Notification Center after she is back at the row.
   try { powerMonitor.on('unlock-screen', () => { if (window.isFocused()) notifier.seen(); }); } catch {}
   ipcMain.handle('zero:notify', (_e, payload = {}) => {
-    notifier.add(Array.isArray(payload.arrivals) ? payload.arrivals : []);
+    const arrivals = Array.isArray(payload.arrivals) ? payload.arrivals : [];
+    try { onArrivals(arrivals); } catch {}
+    notifier.add(arrivals);
   });
   return notifier;
 }

package/main/opencode-server.mjs

@@ -0,0 +1,271 @@
+// OPENCODE'S OWN TRANSPORT, AND WHY IT IS THE SERVER AND NOT THE CLI.
+//
+// Measured against a real OpenCode 1.18.35 on 2026-10-07. `opencode run` is
+// the obvious road -- it is non-interactive, `--format json` prints one JSON
+// object per line, and that is nearly the shape main/harnesses/claude-stream
+// already reads. It is also the wrong road, and the measurement says so in one
+// line. Run with `permission: { bash: "ask" }` in config, the CLI printed:
+//
+//   ! permission requested: bash (echo probe-run-mode); auto-rejecting
+//
+// and handed the model "The user rejected permission to use this specific tool
+// call." With no permission config at all it ran the command with no card.
+// `--auto` approves everything not explicitly denied. So the CLI offers
+// approve-everything or refuse-everything, and an Agentbox card is neither.
+//
+// The HTTP server does carry a real approval. `opencode serve` raises
+// `permission.asked` on its `/event` stream with the command in
+// `metadata.command`, and `POST /session/:id/permissions/:id` with
+// `{ response: "once" }` releases it while `{ response: "reject" }` refuses it.
+// Both measured end to end against the real binary, both answers, 200 each
+// time, the tool running in the first case and coming back
+// "The user rejected permission to use this specific tool call." in the second.
+// That is the same card contract main/codex-approvals.mjs already fills, which
+// is why this file exists and a second stream parser does not.
+//
+// AND IT IS WHY WE DO NOT PASS `--auto` ANYWHERE. A grep for it is a test
+// (tests/opencode-asks-before-it-runs-a-command), because the flag would make
+// every run quietly approve its own file writes and shell commands.
+import { EventEmitter } from 'node:events';
+import { Name } from '../shared/product-name.mjs';
+
+/** How long a single HTTP call to the local server may take. */
+const CALL_MS = 60_000;
+
+/**
+ * A client for one `opencode serve`.
+ *
+ * `password` is the server's own basic-auth secret, which Agentbox generates
+ * per server and which OpenCode reads from `OPENCODE_SERVER_PASSWORD`. It is
+ * NOT a provider credential: OpenCode loads those itself, from its own
+ * `~/.local/share/opencode/auth.json`. Agentbox never has one to pass, which
+ * is the rule in CLAUDE.md and the reason this harness can exist at all.
+ */
+export function openCodeClient({ baseUrl, password = null, username = 'opencode', fetchImpl = globalThis.fetch } = {}) {
+  if (!baseUrl) throw Error('openCodeClient needs the address of a running OpenCode server');
+  const root = String(baseUrl).replace(/\/+$/, '');
+  const authorization = password ? `Basic ${Buffer.from(`${username}:${password}`).toString('base64')}` : null;
+
+  const request = async (path, { method = 'GET', body, signal, stream = false } = {}) => {
+    const response = await fetchImpl(root + path, {
+      method,
+      headers: {
+        ...(authorization ? { authorization } : {}),
+        ...(body === undefined ? {} : { 'content-type': 'application/json' }),
+        ...(stream ? { accept: 'text/event-stream' } : {}),
+      },
+      ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+      signal: signal ?? AbortSignal.timeout(CALL_MS),
+    });
+    if (!response.ok) throw Error(`OpenCode answered ${response.status} for ${method} ${path}`);
+    if (stream) return response;
+    const text = await response.text();
+    if (!text) return null;
+    try { return JSON.parse(text); } catch { return text; }
+  };
+
+  return {
+    url: root,
+    request,
+    createSession: (body = {}) => request('/session', { method: 'POST', body }),
+    prompt: (sessionId, body) => request(`/session/${encodeURIComponent(sessionId)}/prompt_async`, { method: 'POST', body }),
+    abort: sessionId => request(`/session/${encodeURIComponent(sessionId)}/abort`, { method: 'POST', body: {} }),
+    // `{ response }` and not `{ action }`: the field name is off the real
+    // OpenAPI document the running server serves at /doc.
+    replyPermission: (sessionId, permissionId, response) =>
+      request(`/session/${encodeURIComponent(sessionId)}/permissions/${encodeURIComponent(permissionId)}`, { method: 'POST', body: { response } }),
+    summarize: (sessionId, model) =>
+      request(`/session/${encodeURIComponent(sessionId)}/summarize`, { method: 'POST', body: splitModel(model) }),
+    runCommand: (sessionId, body) => request(`/session/${encodeURIComponent(sessionId)}/command`, { method: 'POST', body }),
+    providers: () => request('/config/providers'),
+    commands: () => request('/command'),
+    config: () => request('/config'),
+    health: () => request('/global/health'),
+    events: ({ signal } = {}) => eventStream(request, signal),
+  };
+}
+
+/**
+ * `provider/model` as the two fields OpenCode's API wants.
+ *
+ * Its model ids are provider-qualified and the slash is part of the id people
+ * see (`opencode/big-pickle`, `anthropic/claude-sonnet-4-5`), but every server
+ * endpoint takes `providerID` and `modelID` apart. A model with no slash is not
+ * guessed at: it is left for the server's own default to answer, because
+ * inventing a provider here is how a run dies on a model nobody chose.
+ */
+export function splitModel(model) {
+  const text = typeof model === 'string' ? model.trim() : '';
+  const at = text.indexOf('/');
+  if (at <= 0 || at === text.length - 1) return {};
+  return { providerID: text.slice(0, at), modelID: text.slice(at + 1) };
+}
+
+/** The `/event` stream, as an async iterable of `{ type, properties }`. */
+function eventStream(request, outerSignal) {
+  const controller = new AbortController();
+  outerSignal?.addEventListener('abort', () => controller.abort(), { once: true });
+  const opened = request('/event', { stream: true, signal: controller.signal });
+
+  return {
+    close: () => controller.abort(),
+    async *[Symbol.asyncIterator]() {
+      const response = await opened;
+      const reader = response.body.getReader();
+      const decoder = new TextDecoder();
+      let buffer = '';
+      try {
+        while (true) {
+          const { value, done } = await reader.read();
+          if (done) return;
+          buffer += decoder.decode(value, { stream: true });
+          let index;
+          while ((index = buffer.indexOf('\n')) >= 0) {
+            const line = buffer.slice(0, index).trim();
+            buffer = buffer.slice(index + 1);
+            if (!line.startsWith('data:')) continue;
+            const payload = line.slice(5).trim();
+            if (!payload) continue;
+            try { yield JSON.parse(payload); } catch { /* a half-written frame is not news */ }
+          }
+        }
+      } finally {
+        try { await reader.cancel(); } catch { /* already gone */ }
+      }
+    },
+  };
+}
+
+/** The permission events, old and new, that mean "a card is wanted". */
+const ASKED = new Set(['permission.asked', 'permission.v2.asked']);
+/** What the reply endpoint calls yes and no. */
+const ALLOW = 'once';
+const DENY = 'reject';
+
+/**
+ * ONE OPENCODE RUN, SHAPED LIKE A CHILD PROCESS.
+ *
+ * The supervisor's spawn path wants something with `stderr`, `on('event')` and
+ * one `exit`, because that is what a Claude Code child and a Codex worker both
+ * look like from there (main/supervisor.mjs, `_spawnWorker`). This is the third
+ * one, and it owns nothing the other two own: its events are OpenCode's own
+ * names, passed through untranslated, exactly as the Codex adapter passes its
+ * notifications through rather than pretending to be Claude's JSON lines.
+ *
+ * DENY IS THE ANSWER NOBODY HAS TO CHOOSE. A card that is never answered, a
+ * handler that throws, a spool that has gone away, a worker killed mid-question
+ * -- every one of those refuses the tool call. The opposite default would mean
+ * a crashed inbox silently approves shell commands, which is the one failure
+ * here that cannot be taken back.
+ */
+export function createOpenCodeWorker({
+  client,
+  plan = {},
+  cwd = null,
+  resumeSessionId = null,
+  onApproval = null,
+  title = null,
+} = {}) {
+  if (!client) throw Error('createOpenCodeWorker needs a client for a running OpenCode server');
+
+  const worker = new EventEmitter();
+  worker.stderr = new EventEmitter();
+  worker.stdout = new EventEmitter();
+  worker.sessionId = resumeSessionId ?? null;
+
+  const say = text => {
+    const line = String(text ?? '').trim();
+    if (line) worker.stderr.emit('data', line);
+  };
+
+  let ended = false;
+  let stream = null;
+  const answered = new Set();
+
+  const stop = async () => {
+    if (ended) return;
+    ended = true;
+    try { stream?.close(); } catch { /* already closed */ }
+    if (worker.sessionId) { try { await client.abort(worker.sessionId); } catch { /* the run is over either way */ } }
+  };
+
+  /**
+   * One card, and the reply that releases or refuses the tool.
+   *
+   * The id is remembered BEFORE the card is raised, so a request the stream
+   * repeats -- which it does, `permission.asked` can arrive again for a request
+   * still open -- costs one card and not two.
+   */
+  const decide = async (type, properties) => {
+    const id = properties?.id;
+    const session = properties?.sessionID;
+    if (!id || session !== worker.sessionId || answered.has(id)) return;
+    answered.add(id);
+
+    let allowed = false;
+    try {
+      allowed = onApproval ? await onApproval(type, properties) === true : false;
+    } catch (error) {
+      say(`${Name} could not ask about ${String(properties?.metadata?.command ?? 'a tool call')}: ${error?.message ?? error}`);
+      allowed = false;
+    }
+    if (ended) allowed = false;
+
+    try {
+      await client.replyPermission(session, id, allowed ? ALLOW : DENY);
+    } catch (error) {
+      say(`OpenCode did not take the answer to that question: ${error?.message ?? error}`);
+    }
+  };
+
+  const run = async () => {
+    try {
+      if (!worker.sessionId) {
+        const session = await client.createSession({ ...(title ? { title } : {}), ...(cwd ? { directory: cwd } : {}) });
+        worker.sessionId = session?.id ?? null;
+        if (!worker.sessionId) throw Error('OpenCode did not name the session it opened');
+      }
+
+      // The stream is opened BEFORE the prompt. Opening it after is a race the
+      // fast answers win: `permission.asked` for the first tool call can beat
+      // our own subscription, and nothing would ever answer that card.
+      stream = client.events();
+      const reading = (async () => {
+        for await (const event of stream) {
+          if (ended) return;
+          const type = String(event?.type ?? '');
+          const properties = event?.properties ?? {};
+          worker.emit('event', type, properties);
+          if (ASKED.has(type)) { await decide(type, properties); continue; }
+          if (properties?.sessionID && properties.sessionID !== worker.sessionId) continue;
+          if (type === 'session.error') {
+            worker.error = properties?.error ?? 'OpenCode reported an error';
+            return;
+          }
+          if (type === 'session.idle') return;
+        }
+      })();
+
+      await client.prompt(worker.sessionId, {
+        ...splitModel(plan.model),
+        ...(plan.agent ? { agent: plan.agent } : {}),
+        parts: [{ type: 'text', text: String(plan.prompt ?? '') }],
+      });
+
+      await reading;
+    } catch (error) {
+      worker.error = error?.message ?? String(error);
+      say(worker.error);
+    } finally {
+      const already = ended;
+      ended = true;
+      try { stream?.close(); } catch { /* already closed */ }
+      if (!already && worker.sessionId) { try { await client.abort(worker.sessionId); } catch { /* nothing left to stop */ } }
+      worker.emit('exit', worker.error ? 1 : 0, null);
+    }
+  };
+
+  worker.kill = () => { void stop(); };
+  worker.done = run();
+  return worker;
+}