agentbox-app 0.1.11 → 0.1.13

package/shared/spawn-trouble.mjs

@@ -133,7 +133,11 @@ const INTERRUPTED = [
   /connection (closed|lost|dropped)/i,
   /response stopped arriving/i,
   /may be incomplete/i,
-  /econnreset|enotfound|etimedout|econnrefused/i,
+  /econnreset|enotfound|etimedout|econnrefused|enetunreach|ehostunreach|eai_again/i,
+  // Codex also prefixes non-network failures with "stream disconnected".
+  // Match the request failure itself so incomplete responses keep their limit.
+  /error sending request for url/i,
+  /failed to send websocket request/i,
   /unable to connect/i,
   /can.{0,3}t reach the api/i,
   /timed out/i,
@@ -164,6 +168,18 @@ const WORKSPACE = [
   /skip-git-repo-check/i,
 ];
 
+// A MODEL THE LOGIN'S PLAN DOES NOT INCLUDE. Not the account being out and not
+// the model being unknown: the same login runs every other model, and another
+// login on a bigger plan runs this one. Codex's own words, off two dead runs on
+// 2026-10-09 and 2026-10-11 (codex-cli 0.160.0, a free-plan login handed
+// gpt-6.1-sol): "The 'gpt-6.1-sol' model is not supported when using Codex with
+// a ChatGPT account." The second line is ours, thrown before the thread starts
+// by `codexModelRefusal` when the login's own list already says so.
+const MODEL_NOT_ON_PLAN = [
+  /model is not supported when using codex with a chatgpt account/i,
+  /not a model the plan of the codex account/i,
+];
+
 // WHICH OF THE THREE THINGS WENT WRONG, from whatever the tool printed.
 // 'unknown' is a first-class answer, not a failure: an honest generic sentence
 // beats a confident wrong one.
@@ -173,6 +189,8 @@ export function troubleCause(raw) {
   // FIRST, because an organization's refusal mentions the subscription and
   // reads as a signed-out login to the list below.
   if (ORG_BLOCKED.some((re) => re.test(text))) return 'org-blocked';
+  // BEFORE SIGNED-OUT, because Codex's sentence says "ChatGPT account".
+  if (MODEL_NOT_ON_PLAN.some((re) => re.test(text))) return 'model-not-on-plan';
   if (SIGNED_OUT.some((re) => re.test(text))) return 'signed-out';
   if (AT_LIMIT.some((re) => re.test(text))) return 'at-limit';
   if (WORKSPACE.some((re) => re.test(text))) return 'workspace';
@@ -184,6 +202,16 @@ export function troubleCause(raw) {
   return 'unknown';
 }
 
+// A SUBSCRIPTION THAT HAS ENDED IS REFUSED IN AN ADMIN'S WORDS. Claude Code
+// 2.1.293 told a lapsed personal Max login "Your organization has disabled
+// Claude subscription access for Claude Code" (2026-10-11), the same line a
+// workspace policy prints, so the text alone cannot tell them apart. The
+// login's own file can: `plan` is main/claude-plan.mjs's reading of it, and
+// `ended` is its billing gone to "none". Anything else keeps its cause.
+export function refineCause(cause, plan) {
+  return cause === 'org-blocked' && plan?.ended ? 'subscription-ended' : cause;
+}
+
 // WHEN THE LIMIT LETS GO, straight off the line the CLI printed.
 //
 // carries the one thing she actually wants to know, and we were throwing it
@@ -237,7 +265,7 @@ export function needsHerHands(cause) {
   // same person: one is her, in a terminal; one is an admin of a workspace she
   // may not run. What they share is the only thing this question asks — trying
   // again in thirty minutes cannot possibly help.
-  return cause === 'signed-out' || cause === 'org-blocked';
+  return cause === 'signed-out' || cause === 'org-blocked' || cause === 'subscription-ended';
 }
 
 // WHAT SHE READS WHEN NOT ONE AGENT CAN START ANYWHERE.
@@ -246,10 +274,11 @@ export function needsHerHands(cause) {
 export function troubleSentence(cause) {
   if (cause === 'signed-out') return 'No agents can start. Your Claude login has run out.';
   if (cause === 'org-blocked') return 'No agents can start. Your organization has turned Claude Code off.';
+  if (cause === 'subscription-ended') return 'No agents can start. Your Claude subscription has ended.';
   if (cause === 'at-limit') return 'No agents can start. Your Claude plan is at its limit.';
   if (cause === 'workspace') return 'No agents can start. Claude will not run in this folder.';
   if (cause === 'interrupted') return 'No agents can start. The connection to Claude keeps dropping.';
-  return 'No agents can start on this Mac right now.';
+  return 'No agents can start on this computer right now.';
 }
 
 // THE SECOND LINE: what happens next, so the first line is never a dead end.
@@ -260,6 +289,7 @@ export function troubleRemedy(cause) {
   // thing to type.
   if (cause === 'signed-out') return 'Open Claude in a terminal, type /login, and they pick straight back up.';
   if (cause === 'org-blocked') return 'Ask an admin of that Claude workspace to turn Claude Code back on.';
+  if (cause === 'subscription-ended') return 'Renew it at claude.ai, or pick another account in Settings.';
   if (cause === 'at-limit') return 'They start again on their own when it resets.';
   if (cause === 'workspace') return 'Open the folder in Claude once and say yes to trusting it.';
   if (cause === 'interrupted') return `Nothing to do. ${Name} tries them again on its own.`;
@@ -289,10 +319,12 @@ export function accountSentence(cause, dir) {
   if (cause === 'org-blocked') {
     return 'Signed in, but its organization has turned Claude Code off. Only an admin of that workspace can turn it back on.';
   }
+  if (cause === 'subscription-ended') return 'Signed in, but its Claude subscription has ended. Renew it at claude.ai to use this account again.';
   if (cause === 'at-limit') return 'At its limit. It rejoins on its own when the limit resets.';
   if (cause === 'workspace') return 'Claude would not run in the folder this was asked to work in.';
   if (cause === 'interrupted') return `Its runs keep getting cut off. ${Name} is trying them again.`;
-  return `Its sessions are dying on arrival. ${Name} is keeping the other one busy.`;
+  // A cause we cannot name points at the account, not at the app (2026-10-11).
+  return 'Claude Code would not start on this account. Check that its plan is active at claude.ai.';
 }
 
 /* ------------------ the same fact about a whole ENGINE -------------------- */
@@ -437,8 +469,10 @@ const DEAD_RUN_OPENERS = {
   workspace: "would not start in this project's folder, so nothing has been done here.",
   'signed-out': 'could not sign in, so nothing has been done on this task.',
   'org-blocked': 'is switched off for that account by its organization, so nothing has been done.',
+  'subscription-ended': "cannot run because that account's Claude subscription has ended, so nothing has been done.",
   'at-limit': 'is at its usage limit, so nothing has been done on this task.',
   interrupted: 'was cut off in the middle, so nothing has been done on this task.',
+  'model-not-on-plan': "could not use this task's model on that account's plan, so nothing has been done.",
   unknown: 'stopped before it did anything, so this task has not been started.',
 };
 
@@ -453,10 +487,13 @@ const DEAD_RUN_OPENERS = {
  */
 const RUN_STOPPED = {
   'signed-out': 'This run stopped because the account was signed out.',
-  'org-blocked': 'This run stopped because that account is switched off by its organization.',
+  // Same refusal text for an admin's block and an ended subscription, and this
+  // line has only the text, so it says what is true of both.
+  'org-blocked': 'This run stopped because Claude Code will not run on that account.',
   'at-limit': 'This run stopped because the account hit its usage limit.',
   workspace: "This run stopped because it would not start in this project's folder.",
   interrupted: 'This run was cut off in the middle.',
+  'model-not-on-plan': "This run stopped because that account's plan does not include the model.",
   unknown: 'This run stopped before it finished.',
 };
 
@@ -464,7 +501,9 @@ export function runStoppedLine(raw) {
   return RUN_STOPPED[troubleCause(raw)] ?? RUN_STOPPED.unknown;
 }
 
-export function deadRunSentence({ engineWord = 'The agent', cause = 'unknown', runs = 1, resetsAt = null } = {}) {
+// `elsewhere` is only read for 'model-not-on-plan': whether another signed-in
+// login's plan has the model, so the task moves there rather than waiting on her.
+export function deadRunSentence({ engineWord = 'The agent', cause = 'unknown', runs = 1, resetsAt = null, elsewhere = false } = {}) {
   const opener = `${engineWord} ${DEAD_RUN_OPENERS[cause] ?? DEAD_RUN_OPENERS.unknown}`;
 
   const again = runs > 1 ? ` This has happened ${runs} times on this task.` : '';
@@ -476,10 +515,16 @@ export function deadRunSentence({ engineWord = 'The agent', cause = 'unknown', r
     ? ' Sign that account back in and it picks straight up.'
     : cause === 'org-blocked'
       ? ' Only an admin of that Claude workspace can turn it back on.'
+      : cause === 'subscription-ended'
+      ? ' Renew it at claude.ai, or pick another account in Settings.'
       : cause === 'at-limit'
       ? (resetsAt ? ` It starts again on its own at ${resetsAt}.` : ' It starts again on its own when the limit resets.')
       : cause === 'interrupted'
         ? ` ${Name} runs it again on its own.`
+        : cause === 'model-not-on-plan'
+          ? (elsewhere
+            ? ` ${Name} runs it again on a Codex account whose plan has it.`
+            : ' Pick another model for this task, or sign in a Codex account whose plan has it.')
         : ` ${Name} keeps trying, and it will keep failing the same way until this is fixed.`;
 
   return `${opener}${again}${next}`;
@@ -559,9 +604,11 @@ export function deadRunCause(text) {
 export function causeWord(cause) {
   if (cause === 'signed-out') return 'a signed-out login';
   if (cause === 'org-blocked') return 'an organization that blocks Claude Code';
+  if (cause === 'subscription-ended') return 'an ended Claude subscription';
   if (cause === 'at-limit') return 'your Claude limit';
   if (cause === 'workspace') return 'a folder Claude will not run in';
   if (cause === 'interrupted') return 'runs getting cut off';
+  if (cause === 'model-not-on-plan') return "a model the account's plan does not include";
   return 'something we cannot name';
 }
 
@@ -572,9 +619,11 @@ export function causeWhat(cause, count) {
   const n = Math.max(0, Math.trunc(count ?? 0));
   if (cause === 'signed-out') return `${n} stopped by a signed-out Claude login`;
   if (cause === 'org-blocked') return `${n} stopped by an organization that blocks Claude Code`;
+  if (cause === 'subscription-ended') return `${n} stopped by an ended Claude subscription`;
   if (cause === 'at-limit') return `${n} waiting on your Claude limit`;
   if (cause === 'workspace') return `${n} in a folder Claude will not run in`;
   if (cause === 'interrupted') return `${n} cut off mid-run`;
+  if (cause === 'model-not-on-plan') return `${n} asking for a model no signed-in Codex plan includes`;
   return `${n} stopped for a reason we cannot name`;
 }
 
@@ -583,9 +632,11 @@ export function causeWhat(cause, count) {
 export function causeNext(cause, resetsAt = null) {
   if (cause === 'signed-out') return 'Type /login in a terminal and they pick straight up.';
   if (cause === 'org-blocked') return 'Ask an admin of that Claude workspace to turn Claude Code back on.';
+  if (cause === 'subscription-ended') return 'Renew it at claude.ai, or pick another account in Settings.';
   if (cause === 'at-limit') return resetsAt ? `They start again on their own at ${resetsAt}.` : 'They start again on their own when it resets.';
   if (cause === 'workspace') return 'Open the folder in Claude once and say yes to trusting it.';
   if (cause === 'interrupted') return `Nothing to do. ${Name} is trying them again.`;
+  if (cause === 'model-not-on-plan') return 'Pick another model on each, or sign in a Codex account whose plan has it.';
   return `${Name} keeps trying on its own.`;
 }
 
@@ -614,7 +665,7 @@ export function causeBreakdown(rows = [], resetsAt = null) {
       what: causeWhat(cause, count),
       next: causeNext(cause, cause === 'at-limit' ? resetsAt : null),
       act: causeAct(cause),
-      hers: needsHerHands(cause) || cause === 'workspace',
+      hers: needsHerHands(cause) || cause === 'workspace' || cause === 'model-not-on-plan',
     }))
     .sort((a, b) => (b.hers - a.hers) || (b.count - a.count) || a.cause.localeCompare(b.cause));
 }

package/shared/terminal-input.d.mts

@@ -0,0 +1 @@
+export function inputQueue(send: (data: string) => Promise<unknown>, options?: { chunk?: number; onError?: (e: unknown) => void }): { push(data: string): void };

package/shared/terminal-input.mjs

@@ -0,0 +1,30 @@
+// KEYS TYPED WHILE ONE WRITE IS ON ITS WAY GO OUT TOGETHER, as the next write.
+//
+// The panel used to send every key as its own round trip to main, each one
+// waiting for the last, so holding Delete built a line of trips that drained
+// after she let go. Now the first key goes at once, and whatever she types
+// while it travels is one write behind it, in order. A paste still goes in
+// pieces main accepts (64 KB is its limit; `chunk` stays well under it).
+//
+// A write that fails (the shell exited) drops what was waiting behind it: those
+// keys were for a shell that is gone, and the failure is reported once.
+export function inputQueue(send, { chunk = 16384, onError } = {}) {
+  let queued = '', sending = false;
+  async function drain() {
+    if (sending) return;
+    sending = true;
+    try {
+      while (queued) {
+        const data = queued.slice(0, chunk);
+        queued = queued.slice(data.length);
+        await send(data);
+      }
+    } catch (e) {
+      queued = '';
+      onError?.(e);
+    } finally {
+      sending = false;
+    }
+  }
+  return { push(data) { queued += data; void drain(); } };
+}

package/shared/terminal-keys.d.mts

@@ -0,0 +1 @@
+export function optionWordKey(event: { type: string; key: string; altKey: boolean; ctrlKey: boolean; metaKey: boolean; shiftKey: boolean }, isMac: boolean): string | undefined;

package/shared/terminal-keys.mjs

@@ -0,0 +1,16 @@
+// OPTION+LEFT AND OPTION+RIGHT JUMP A WORD, as they do in Mac Terminal.
+// xterm 6 sends them as ESC[1;3D and ESC[1;3C, which zsh and bash do not bind,
+// so a shell typed `;3D` into the line instead. Mac Terminal sends ESC b and
+// ESC f, the backward-word and forward-word every shell already knows.
+//
+// Returns what to send for this key, '' to swallow the keyup of one we
+// handled, or undefined to leave the key to xterm. Off a Mac nothing changes:
+// Linux terminals send the same ESC[1;3D xterm does.
+const WORD = { ArrowLeft: '\x1bb', ArrowRight: '\x1bf' };
+
+export function optionWordKey(event, isMac) {
+  if (!isMac || !event.altKey || event.ctrlKey || event.metaKey || event.shiftKey) return undefined;
+  const sequence = WORD[event.key];
+  if (!sequence) return undefined;
+  return event.type === 'keydown' ? sequence : '';
+}

package/shared/terminal-size.d.mts

@@ -0,0 +1,4 @@
+export const SIZE_KEY: string;
+export const TERMINAL_MIN: { height: number; width: number };
+export function dragSize(dimension: 'height' | 'width', start: number, delta: number, room: number): number;
+export function readSavedSize(raw: string | null | undefined): { height?: number; width?: number };

package/shared/terminal-size.mjs

@@ -0,0 +1,29 @@
+// HOW BIG THE TERMINAL MAY BE DRAGGED (renderer/src/components/TaskTerminal.tsx).
+//
+// Small enough still shows a few lines; large enough still leaves the page it
+// sits in a strip to read (the thread's title and a line or two above it, or a
+// column of the conversation beside it). The size is one for the whole app,
+// remembered under SIZE_KEY, the way an editor remembers its panel.
+export const SIZE_KEY = 'zero.terminal.size';
+export const TERMINAL_MIN = { height: 120, width: 280 };
+const LEAVE = { height: 120, width: 320 };
+const LARGEST = 4000;
+
+/** `start` px, the edge moved `delta` px toward growing, in a pane `room` px across. */
+export function dragSize(dimension, start, delta, room) {
+  const min = TERMINAL_MIN[dimension];
+  const max = Math.max(min, room - LEAVE[dimension]);
+  return Math.round(Math.min(max, Math.max(min, start + delta)));
+}
+
+export function readSavedSize(raw) {
+  let saved;
+  try { saved = JSON.parse(raw ?? ''); } catch { return {}; }
+  if (!saved || typeof saved !== 'object' || Array.isArray(saved)) return {};
+  const out = {};
+  for (const dimension of ['height', 'width']) {
+    const v = saved[dimension];
+    if (Number.isFinite(v) && v >= TERMINAL_MIN[dimension] && v <= LARGEST) out[dimension] = v;
+  }
+  return out;
+}

package/shared/usage.d.mts

@@ -3,6 +3,9 @@
 // rule about which coding agent the corner is about, the zone primitives the
 // Claude reader is built on, and the words the panel prints.
 
+/** What a usage check that got nothing readable says, for any cause we have not named. */
+export const USAGE_UNREADABLE: string;
+
 export interface UsageLimit {
   span: 'session' | 'week';
   qualifier: string | null;

package/shared/usage.mjs

@@ -33,6 +33,13 @@ import { DEFAULT_ENGINE } from './engines.mjs';
 
 /* ------------------ WHICH CODING AGENT THE CORNER IS ABOUT ---------------- */
 
+// WHAT A USAGE CHECK THAT GOT NOTHING READABLE SAYS, for every reason we have
+// not named. It used to be "Could not refresh usage. Try again.", which reads
+// as the app having broken; the measured case (2026-10-11) was an account whose
+// subscription had ended, and Claude Code simply printed no limits for it. So
+// it points at the account, which is where an unnamed cause almost always is.
+export const USAGE_UNREADABLE = "Claude Code didn't report usage for this account. Check that its plan is active at claude.ai.";
+
 /**
  * THE AGENT MOST OF HER LIVE WORK IS ON, or the workspace's own when nothing is
  * running and when the fleet is level.

package/shared/where-it-runs-from.d.mts

@@ -0,0 +1,43 @@
+// Types for shared/where-it-runs-from.mjs, which is plain ESM so that main
+// (Node) and the screen (Vite) share one copy of the rule about whether this
+// copy of the app can update itself from where it is, and one copy of the
+// words that say so. The screen asks for the words and `sayWhere`; the places
+// and the move are main's.
+
+/** The place a copy of the app is in, as far as updating itself is concerned. */
+export type AppPlace =
+  | 'disk-image' | 'translocated' | 'applications' | 'elsewhere' | 'source' | 'not-mac';
+
+export const PLACE: {
+  diskImage: 'disk-image';
+  translocated: 'translocated';
+  applications: 'applications';
+  elsewhere: 'elsewhere';
+  source: 'source';
+  notMac: 'not-mac';
+};
+
+export const MOVE_SAY: {
+  cannotUpdateHere: string;
+  button: string;
+  title: string;
+  where: Record<string, string>;
+  shortWhere: Record<string, string>;
+  fix: string;
+  retry: string;
+};
+
+/** The sentence for a place, or null where there is nothing to say. */
+export function sayWhere(place: string | null | undefined, how?: { short?: boolean }): string | null;
+
+export function placeOfApp(facts?: {
+  platform?: string;
+  packaged?: boolean;
+  exePath?: string | null;
+  inApplications?: boolean;
+}): { place: AppPlace; canUpdate: boolean; offerMove: boolean };
+
+export function createPlace(host: { app: unknown; log?: unknown }): {
+  state(): { place: AppPlace; canUpdate: boolean; offerMove: boolean };
+  move(): { moved: boolean; error: string | null };
+};

package/shared/where-it-runs-from.mjs

@@ -0,0 +1,155 @@
+// AN APP IN THE WRONG PLACE CAN NEVER UPDATE ITSELF, AND NEVER SAID SO.
+//
+// macOS has two places it will happily run Agentbox from and never let it
+// replace itself:
+//
+//   THE DISK IMAGE. You double-click the .dmg, you double-click the app
+//   inside it, and it works. The volume is read-only, so Squirrel.Mac refuses
+//   the swap with "Cannot update while running on a read-only volume".
+//
+//   A TRANSLOCATED COPY. You drag the app to Downloads and open it. Because
+//   it still carries the quarantine flag and is not in Applications, macOS
+//   runs it from a read-only copy it makes under
+//   `/private/var/folders/…/AppTranslocation/<uuid>/d/`. Same refusal, and
+//   this is why Squirrel's own sentence talks about the Downloads directory.
+//
+// Measured in PostHog on 2026-10-12: 23 crash reports over three weeks, two
+// installs, both on 0.1.11, one report every six hours (`EVERY_MS` in
+// main/updater.mjs) for as long as the app was open. The reports stopped being
+// filed as crashes in 292d419. The two Macs are still on 0.1.11.
+//
+// SO THE APP READS WHERE IT IS AND OFFERS THE ONE PRESS THAT FIXES IT. Electron
+// has had `moveToApplicationsFolder` since 4: it moves the bundle, replaces an
+// older copy if you say so, and relaunches from the new place. After that the
+// ordinary six-hourly check works and the person never thinks about it again.
+//
+// EVERYTHING HERE IS A FACT AND NOT A GUESS, which is why the decision is a
+// pure function with the four facts passed in: a wrong "you are in the wrong
+// place" is a nag on a healthy install, and two of those are worse than the
+// silence this replaces.
+
+import { Name } from './product-name.mjs';
+
+// THE WORDS, IN ONE PLACE, and main and the renderer both read them from here.
+// `cannotUpdateHere` is the sentence `shortError` in main/updater.mjs puts in
+// place of Squirrel's own paragraph, which is 240 characters with a URL in the
+// middle and was arriving on the Settings row cut off at 160.
+//
+// Every sentence says where the app is and what one press does about it, and
+// none of them says "read-only volume": that is the mechanism, and nobody
+// holding the Mac asked about the mechanism.
+export const MOVE_SAY = {
+  cannotUpdateHere: `${Name} cannot update itself from where it is.`,
+  button: 'Move to Applications',
+  /** The sidebar card's heading. */
+  title: 'Updates are stuck',
+  /** What the place is, as a person would say it. */
+  where: {
+    'disk-image': `${Name} is running from the disk image it was downloaded in.`,
+    translocated: `${Name} is running from a read-only copy macOS made of it.`,
+  },
+  /** The same fact in half the words, for the sidebar card, which is one
+   *  column wide and had the row's sentence running to six lines in it. */
+  shortWhere: {
+    'disk-image': `${Name} can’t update itself from the disk image.`,
+    translocated: `${Name} can’t update itself from the copy macOS made.`,
+  },
+  /** And the press, which is the same either way. */
+  fix: 'Moving it to your Applications folder takes a few seconds and gets updates working again.',
+  retry: 'Pressing it again tries again.',
+};
+
+/** The sentence for a place, or null where there is nothing to say. `short` is
+ *  the sidebar card's half of it: the button beside it already says the fix. */
+export function sayWhere(place, { short = false } = {}) {
+  const words = short ? MOVE_SAY.shortWhere : MOVE_SAY.where;
+  return words[place] ?? null;
+}
+
+/** Where a copy of the app can be, as far as updating itself is concerned. */
+export const PLACE = {
+  /** Run out of the mounted .dmg. Read-only; cannot update. */
+  diskImage: 'disk-image',
+  /** macOS is running a read-only copy of its own. Cannot update. */
+  translocated: 'translocated',
+  /** Where it belongs. */
+  applications: 'applications',
+  /** Somewhere writable that is not Applications: updates itself fine. */
+  elsewhere: 'elsewhere',
+  /** `npm start` from a checkout: main/source-updater.mjs, nothing to move. */
+  source: 'source',
+  /** No Applications folder and no `moveToApplicationsFolder`. */
+  notMac: 'not-mac',
+};
+
+// The folder macOS puts a translocated copy in. The path is always under
+// `/private/var/folders`, but the one segment that names the mechanism is this
+// one, and it is the only part Apple has kept stable. Written with "/" and
+// not `path.sep`: these are only ever read on a Mac (`placeOfApp` returns
+// before them anywhere else), and the screen imports this file, so it may not
+// import anything from Node.
+const TRANSLOCATED = '/AppTranslocation/';
+// Every mounted volume lives here, including the disk image the download is.
+const VOLUMES = '/Volumes/';
+
+/**
+ * PURE. The whole decision, off four facts, so every case can be tested
+ * without a packaged app, a disk image, or a Mac.
+ *
+ * `exePath` is `app.getPath('exe')`, the binary inside the bundle;
+ * `inApplications` is Electron's own `app.isInApplicationsFolder()`, which
+ * knows about `~/Applications` as well as `/Applications` and is therefore
+ * never re-derived from the path here.
+ */
+export function placeOfApp({ platform, packaged, exePath, inApplications } = {}) {
+  const no = (place) => ({ place, canUpdate: true, offerMove: false });
+  if (platform !== 'darwin') return no(PLACE.notMac);
+  if (!packaged) return no(PLACE.source);
+  if (inApplications) return no(PLACE.applications);
+  if (typeof exePath !== 'string' || !exePath) return no(PLACE.elsewhere);
+  const where = exePath.includes(TRANSLOCATED) ? PLACE.translocated
+    : exePath.startsWith(VOLUMES) ? PLACE.diskImage
+    : null;
+  // THE PLACES THAT ARE NOT APPLICATIONS AND UPDATE THEMSELVES ANYWAY are left
+  // alone on purpose. A copy sitting in Downloads that macOS did not
+  // translocate is on a writable disk and Squirrel swaps it happily; offering
+  // to move it would be the app asking for something it does not need.
+  if (!where) return no(PLACE.elsewhere);
+  return { place: where, canUpdate: false, offerMove: true };
+}
+
+/**
+ * The live one, over Electron's `app`. Read ONCE, at construction: the bundle
+ * cannot move under a running process except by the move below, which
+ * relaunches.
+ */
+export function createPlace({ app, log = console }) {
+  const where = placeOfApp({
+    platform: app?.platform ?? process.platform,
+    packaged: !!app?.isPackaged,
+    exePath: (() => { try { return app?.getPath?.('exe') ?? null; } catch { return null; } })(),
+    inApplications: (() => { try { return !!app?.isInApplicationsFolder?.(); } catch { return false; } })(),
+  });
+
+  return {
+    state: () => ({ ...where }),
+
+    /**
+     * THE PRESS. Electron moves the bundle and relaunches, so nothing after a
+     * `true` here ever runs. It answers false when the person cancels its own
+     * "a copy is already there" box, which is an answer and not a failure.
+     */
+    move() {
+      if (!where.offerMove) return { moved: false, error: null };
+      try {
+        const moved = !!app.moveToApplicationsFolder();
+        return { moved, error: null };
+      } catch (e) {
+        // One line, because Settings shows this string to a person.
+        const error = String(e?.message ?? e ?? 'The move did not work.').split('\n')[0].trim();
+        log.warn?.('[place] could not move the app into Applications:', error);
+        return { moved: false, error };
+      }
+    },
+  };
+}

package/shared/work-items.mjs

@@ -108,7 +108,7 @@ export const CLAUDE_PERMISSION_MODES = [
 // search matches either name.
 export const WORK_ITEM_FIELDS = [
   'title', 'label', 'body', 'kind', 'labels', 'priority', 'parent',
-  'status', 'result', 'note', 'answer', 'product', 'runAt', 'answeredThrough',
+  'status', 'result', 'note', 'answer', 'product', 'runAt', 'snoozedUntil', 'answeredThrough',
   'engine', 'model', 'effort',
   // WHETHER THIS HAS BEEN STARTED AT ALL. 'later' is a thread written down and
   // deliberately not begun: it waits for a person, not for a clock, and
@@ -366,6 +366,14 @@ function str(value, max) {
   return trimmed.slice(0, lo) + mark(trimmed.length - lo);
 }
 
+// A text field whose empty string MEANS something: nothing chosen. Only a
+// string may clear it, so a `null` that reached here without going through
+// `answerItem` is still dropped rather than guessed at.
+function clearable(value, max) {
+  if (typeof value !== 'string') return undefined;
+  return value.trim() ? str(value, max) : '';
+}
+
 function coerceField(field, value) {
   switch (field) {
     case 'title': return str(value, MAX_TITLE);
@@ -388,7 +396,23 @@ function coerceField(field, value) {
     // shared/effort-levels.mjs, and the spawn gates on them, so a value this
     // module does not recognise is a run at Claude Code's own choice rather
     // than a row that never runs.
-    case 'kind': case 'product': case 'parent': case 'engine': case 'model': case 'effort': return str(value, MAX_SHORT);
+    case 'kind': case 'product': case 'parent': case 'engine': return str(value, MAX_SHORT);
+    // THESE TWO ARE CLEARED BY WRITING '' AND SO '' IS A REAL VALUE, exactly
+    // as runAt's 0 and start's 'now' are, and for the same reason: a field that
+    // coerces to undefined is dropped by the fold, so without a falsy value
+    // that survives, a model could be chosen and never unchosen.
+    //
+    // They used to sit on the line above, which cost us the most common crash
+    // of launch week. The reply box's drawer hands a pick back as null for
+    // "nothing chosen" and sends `{ model, effort }` whenever it was touched at
+    // all; `answerItem` turns null into '' because `modelForEngine` reads the
+    // empty string as nothing chosen. `str()` then dropped it, `pickFields`
+    // answered null, and `buildLine` threw — before the answer was written,
+    // because the model is written first on purpose. So opening the drawer,
+    // picking a model and pressing send lost the message, with nothing on
+    // screen to say so. Five of the 14 crashes since the Oct 6 launch, on two
+    // installs (PostHog, 2026-10-08).
+    case 'model': case 'effort': return clearable(value, MAX_SHORT);
     case 'status': return WORK_ITEM_STATUSES.includes(value) ? value : undefined;
     case 'priority': return Number.isFinite(value) ? Math.trunc(value) : undefined;
     // When this item may next be acted on, in epoch ms. 0 means unscheduled,
@@ -396,6 +420,8 @@ function coerceField(field, value) {
     // that coerces to undefined is dropped by the fold, so without a falsy
     // sentinel a schedule could be set and never cleared.
     case 'runAt': return Number.isFinite(value) ? Math.trunc(value) : undefined;
+    // An inbox reminder, independent of when work may start. 0 brings it back.
+    case 'snoozedUntil': return Number.isFinite(value) ? Math.max(0, Math.trunc(value)) : undefined;
     // 'later' or 'now', and 'now' is the falsy sentinel for the same reason
     // runAt keeps 0: a field that coerces to undefined is dropped by the fold,
     // so without a real value for "started" nothing could ever clear it.

package/shared/work-lines.mjs

@@ -637,7 +637,7 @@ export function groupWork(events, { min = RUN_MIN } = {}) {
   for (const e of events ?? []) {
     // SOMETHING SHE DID IS NOT THE AGENT'S WORK and never folds into it: three
     // snoozes are three lines, not one "You put it off" (w-49b4e45403).
-    if (e && e.kind === 'work' && !e.yours) { run.push(e); continue; }
+    if (e && e.kind === 'work' && !e.yours && !e.standalone) { run.push(e); continue; }
     flush();
     out.push(e);
   }

package/shared/xterm-invalid-range.d.mts

@@ -0,0 +1,2 @@
+export const INVALID_RANGE: string;
+export function guardInvalidRange(terminal: unknown, options?: { warn?: (message: string) => void }): boolean;

package/shared/xterm-invalid-range.mjs

@@ -0,0 +1,58 @@
+// XTERM'S OWN ASSERTION, CAUGHT WHERE WE CAN REACH IT.
+//
+// @xterm/xterm 6.0.0's AccessibilityManager listens on the document for
+// 'selectionchange', maps the selection onto terminal rows and columns, and
+// does `throw new Error('invalid range')` when the result covers no cells,
+// under its own comment "This should not happen unless we have some bugs". It
+// happens. Three ordinary selections reach it, measured against the published
+// bundle; the test beside this file
+// (tests/a-selection-that-covers-no-terminal-cells-is-not-a-crash.test.mjs)
+// lists them and says how.
+//
+// Only a screen reader user gets that handler at all, because the pane asks
+// `app.accessibilitySupportEnabled` before turning `screenReaderMode` on. For
+// them the throw escapes as an unhandled renderer error, and the terminal keeps
+// whatever was selected before it, so a copy afterwards takes stale text.
+//
+// WHY A WRAPPER AND NOT A PATCHED BUNDLE. What we build against is minified
+// `lib/xterm.mjs`, and rewriting a file inside node_modules at build time is
+// machinery that has to hold through `npm ci` on two CI runners and every
+// release. xterm dispatches the handler as `() => this._handleSelectionChange()`,
+// off the instance, so one own property on the manager shadows it and the
+// wrapper dies with the terminal.
+//
+// IT SWALLOWS ONE MESSAGE AND NOTHING ELSE. The same handler warns about two
+// genuine race conditions and returns; anything that is not this exact
+// assertion is somebody's bug and goes on up.
+//
+// This is a workaround, and the upstream fix is the assertion becoming a
+// clearSelection and a return. When an xterm release carries that, the test
+// above turns red on the bundle it reads, and this file goes.
+export const INVALID_RANGE = 'invalid range';
+
+/**
+ * Wrap the accessibility manager's selection handler on `terminal`, which must
+ * already be open. Answers whether there was one to wrap: false when
+ * screenReaderMode is off, which is every install not running a screen reader,
+ * and false when it is already wrapped.
+ */
+export function guardInvalidRange(terminal, { warn = console.warn } = {}) {
+  const manager = terminal?._core?._accessibilityManager?.value;
+  const handler = manager?._handleSelectionChange;
+  if (typeof handler !== 'function' || handler.guardsInvalidRange) return false;
+  const guarded = function (...args) {
+    try {
+      return handler.apply(this, args);
+    } catch (e) {
+      // Message, not instanceof: an Error from another realm is still this bug.
+      if (e?.message !== INVALID_RANGE) throw e;
+      warn(`xterm mapped the selection onto no cells and threw "${INVALID_RANGE}"; cleared the terminal's selection instead`);
+      // It threw before mirroring the selection, so the terminal is still
+      // holding the previous one. Nothing is selected; say that.
+      terminal.clearSelection();
+    }
+  };
+  guarded.guardsInvalidRange = true;
+  manager._handleSelectionChange = guarded;
+  return true;
+}