agentbox-app 0.1.12 → 0.1.13

package/shared/relay-address.mjs

@@ -0,0 +1,6 @@
+// THE RELAY EVERY COPY OF THE APP USES (relay/worker.mjs), deployed to the
+// founder's Cloudflare account on 2026-10-12. With an address here every
+// computer offers "Anywhere" in Settings, then Phone, and starts new people on
+// it; AGENTBOX_RELAY_URL or relay/relay.local.json still take precedence
+// (main/relay-address.mjs). Redeploy with `cd relay && npx wrangler deploy`.
+export const RELAY_URL = 'https://agentbox-relay.agentbox-app.workers.dev';

package/shared/relay-crypto.mjs

@@ -0,0 +1,165 @@
+// THE RELAY'S LOCKS (relay/worker.mjs, main/relay-client.mjs, relay/phone/).
+//
+// A phone away from home reaches the Mac through a relay we run. Everything
+// that crosses it is sealed on one end and opened on the other with keys made
+// from the phone's key, which is in the QR code and nowhere else: it never
+// leaves the Mac except into the code, and the phone keeps it in the address's
+// fragment, which a browser never sends. So the relay can pass messages and
+// cannot read, alter or forge one.
+//
+// What the relay does see: a room name, and the Mac's proof that it may hold
+// that room. The room is a hash of the proof, so the relay can check a Mac
+// against it, and neither one tells it the key.
+//
+// Plain WebCrypto, so this one file runs on the Mac (Node), on Cloudflare, and
+// in the phone's service worker.
+
+const enc = new TextEncoder();
+const subtle = () => globalThis.crypto.subtle;
+const SALT = enc.encode('agentbox-relay-v1');
+
+export function b64u(bytes) {
+  let s = '';
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+async function bits(key, info, length = 256) {
+  const ikm = await subtle().importKey('raw', enc.encode(String(key)), 'HKDF', false, ['deriveBits']);
+  return new Uint8Array(await subtle().deriveBits({ name: 'HKDF', hash: 'SHA-256', salt: SALT, info: enc.encode(info) }, ikm, length));
+}
+
+async function roomOf(proof) {
+  return b64u(new Uint8Array(await subtle().digest('SHA-256', enc.encode(`agentbox-room:${proof}`))));
+}
+
+/** The room the relay knows this pair by, and the Mac's proof that it is the Mac's. */
+export async function relayIds(key) {
+  const proof = b64u(await bits(key, 'mac-proof'));
+  return { room: await roomOf(proof), proof };
+}
+
+/** Is `proof` the proof for `room`? The relay asks this of every Mac. */
+export async function macMayJoin(room, proof) {
+  if (typeof room !== 'string' || typeof proof !== 'string' || !proof) return false;
+  const want = await roomOf(proof);
+  if (want.length !== room.length) return false;
+  let diff = 0;
+  for (let i = 0; i < want.length; i += 1) diff |= want.charCodeAt(i) ^ room.charCodeAt(i);
+  return diff === 0;
+}
+
+const aes = async (raw) => subtle().importKey('raw', raw, { name: 'AES-GCM' }, false, ['encrypt', 'decrypt']);
+
+/** One key for each direction, so nothing sealed one way opens the other. */
+export async function relayKeys(key) {
+  return { up: await aes(await bits(key, 'phone-to-mac')), down: await aes(await bits(key, 'mac-to-phone')) };
+}
+
+/**
+ * Seal `bytes` for the other end. `aad` names what it is (a request, or the
+ * n-th frame of the answer to one request), so a frame cannot be passed off
+ * as another. Out: 12 bytes of nonce, then the sealed bytes.
+ */
+export async function seal(key, bytes, aad) {
+  const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
+  const ct = new Uint8Array(await subtle().encrypt({ name: 'AES-GCM', iv, additionalData: enc.encode(aad) }, key, bytes));
+  const out = new Uint8Array(12 + ct.length);
+  out.set(iv, 0);
+  out.set(ct, 12);
+  return out;
+}
+
+/** Open what `seal` made, or throw if a single bit of it was changed. */
+export async function open(key, sealed, aad) {
+  if (!(sealed instanceof Uint8Array) || sealed.length < 28) throw new Error('Too short to be sealed.');
+  const pt = await subtle().decrypt({ name: 'AES-GCM', iv: sealed.subarray(0, 12), additionalData: enc.encode(aad) }, key, sealed.subarray(12));
+  return new Uint8Array(pt);
+}
+
+/* ------------------------------------------------------------- the wire */
+
+// A request, phone to Mac, before it is sealed: four bytes giving the length of
+// a json head, the head, then the body. The head carries a time and a random
+// nonce, so the Mac can turn away one it has already answered.
+export function packRequest(head, body = new Uint8Array(0)) {
+  const h = enc.encode(JSON.stringify(head));
+  const out = new Uint8Array(4 + h.length + body.length);
+  new DataView(out.buffer).setUint32(0, h.length);
+  out.set(h, 4);
+  out.set(body, 4 + h.length);
+  return out;
+}
+
+export function unpackRequest(bytes) {
+  const n = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).getUint32(0);
+  const head = JSON.parse(new TextDecoder().decode(bytes.subarray(4, 4 + n)));
+  return { head, body: bytes.subarray(4 + n) };
+}
+
+// An answer, Mac to phone, is a run of frames, each sealed on its own: a head
+// (status and headers), the body in pieces, and an end. The end is sealed too,
+// so an answer cut short by anyone in between is seen to be cut short.
+//
+// WAIT comes before the head and says only "still working". A reply to an
+// agent mid-step is answered when the agent takes it, which can be minutes,
+// and the room gives a Mac 30 seconds to start answering. A phone that asks
+// for these (`wait` in its request's head) skips them; one that does not
+// never gets one.
+export const FRAME = Object.freeze({ HEAD: 0, DATA: 1, END: 2, WAIT: 3 });
+
+export const frameAad = (nonce, seq) => `res:${nonce}:${seq}`;
+
+// ON THE MAC'S SOCKET TO THE RELAY one byte says what a message is, then eight
+// bytes of request number, then whatever it carries:
+//   to the Mac     0x01 a request (the sealed bytes)   0x02 the phone gave up
+//                  0x03 a piece of a request too big for one message; the
+//                       0x01 that follows carries the last piece
+//   from the Mac   0x10 one sealed frame of the answer  0x11 done
+//                  0x12 refused: it would not open, or it was a replay
+export const TO_MAC = Object.freeze({ REQUEST: 0x01, CANCEL: 0x02, PART: 0x03 });
+/** The most the relay puts in one socket message to the Mac. Cloudflare's limit is 1 MB. */
+export const PART_BYTES = 512 * 1024;
+export const FROM_MAC = Object.freeze({ FRAME: 0x10, DONE: 0x11, REFUSED: 0x12 });
+export const ID_BYTES = 8;
+
+export function tag(type, id, rest = new Uint8Array(0)) {
+  const out = new Uint8Array(1 + ID_BYTES + rest.length);
+  out[0] = type;
+  out.set(id, 1);
+  out.set(rest, 1 + ID_BYTES);
+  return out;
+}
+
+// Between the relay and either end each sealed piece goes with its length in
+// front, so one stream of bytes can carry many.
+export function lengthPrefixed(bytes) {
+  const out = new Uint8Array(4 + bytes.length);
+  new DataView(out.buffer).setUint32(0, bytes.length);
+  out.set(bytes, 4);
+  return out;
+}
+
+/** Split a stream (or a reader of one) of length-prefixed pieces back into the pieces. */
+export async function* pieces(source) {
+  const reader = typeof source.getReader === 'function' ? source.getReader() : source;
+  let buf = new Uint8Array(0);
+  try {
+    for (;;) {
+      while (buf.length >= 4) {
+        const n = new DataView(buf.buffer, buf.byteOffset, buf.byteLength).getUint32(0);
+        if (buf.length < 4 + n) break;
+        yield buf.slice(4, 4 + n);
+        buf = buf.subarray(4 + n);
+      }
+      const { value, done } = await reader.read();
+      if (done) return;
+      const next = new Uint8Array(buf.length + value.length);
+      next.set(buf, 0);
+      next.set(value, buf.length);
+      buf = next;
+    }
+  } finally {
+    try { reader.releaseLock(); } catch { /* cancelled under us */ }
+  }
+}

package/shared/runs-on.d.mts

@@ -1,20 +1,10 @@
 export interface RunsOn {
   /** 'claude' or 'codex', or null on a Mac where nothing is signed in. */
   engine?: string | null;
-  /**
-   * The plan in words, as the tool itself reports it: 'Max 20x', 'Pro'. Null
-   *  where the file could not be read, and then only the name is drawn. */
-  plan?: string | null;
 }
 
 /** The word for the plan behind an engine, or null for one we cannot name. */
 export declare function runsOnName(engine?: string | null): string | null;
 
-/** The glance line: 'Claude · Max 20x', or 'Claude' with no plan. Null for null. */
-export declare function runsOnLine(facts?: RunsOn): string | null;
-
-/** The whole sentence, for a hover and for a screen reader. Null for null. */
-export declare function runsOnTitle(facts?: RunsOn): string | null;
-
 /** The one line the walk says on a Mac that was already set up. Null for null. */
 export declare function foundOnThisMac(facts?: RunsOn): string | null;

package/shared/runs-on.mjs

@@ -1,30 +1,39 @@
-// WHAT THE AGENTS ARE RUNNING ON, IN WORDS.
+// THE ONE LINE SAYING IT FOUND AN ACCOUNT ALREADY ON THIS MAC.
 //
-// From a session with a new user, 2026-10-07: "He didn't realize it
-// auto-connected to Claude/Codex; he wasn't sure how it was even running. Would
-// be nice to have some small indication."
+// From a session with a new user, 2026-10-07, in her words: a new user came in,
+// started running an agent, and was "like, 'Oh my God, where are the tokens
+// coming from? I didn't even connect my account.'"
 //
 // He was right that nothing said. The app finds whichever coding agent is
 // already signed in on the Mac and runs every worker on that subscription
 // (main/claude-plan.mjs, main/codex-account.mjs), and the walk is SILENT about
 // it by design: `needsPlan` in renderer/src/plan-setup.ts skips the plan
 // question entirely when one tool is found and signed in, which is the right
-// call and leaves nobody told. The only screen that has ever named the account
-// is Settings, two clicks in, and you have to suspect there is something to
-// look for before you go.
+// call and leaves nobody told.
+//
+// IT IS A ONE-TIME SURPRISE, SO IT GETS A ONE-TIME ANSWER. A row saying this
+// permanently, in the sidebar's foot, is what this file held first; it shipped
+// on 2026-10-07 and came out the same day. Her words: "we have to get rid of
+// this. It should never say that on the sidebar." Somebody asks where the
+// tokens are coming from ONCE, on their first day, so the place for the answer
+// is the walk they are standing in.
+//
+// AND IT NAMES NO PLAN. The row said "Claude · Max 20x" and that was the half
+// she wanted gone most: "very critically, I want to get rid of that Claude Max
+// 20x plan." The question being answered is "did it connect to something of
+// mine", not "what am I paying for", and the second one is already answered
+// properly on each agent's own page in Settings, where somebody goes when they
+// want it.
 //
 // THE PLAN'S VOCABULARY, NOT THE TOOL'S. "Claude" and "ChatGPT" here, never
 // "Claude Code" and "Codex", which is the rule the walk already follows
 // (renderer/src/plan-setup.ts: words people know, "never the names of the tools
-// underneath"). The fact being shown is WHOSE SUBSCRIPTION IS BEING SPENT, and
-// nobody pays for a CLI. The tool names stay where they belong: on a byline
-// about which agent is working a row (`engineWordFor`, renderer/src/byline.ts),
-// which is a different question with a different answer.
+// underneath"). The tool names stay where they belong: on a byline about which
+// agent is working a row (`engineWordFor`, renderer/src/byline.ts).
 //
-// NOTHING IS SAID UNTIL SOMETHING IS KNOWN. Every function here answers null on
-// an engine it cannot name, and the screens draw nothing at all for null rather
-// than "checking…" or a dash. A corner that says it does not know is worse than
-// a corner that says nothing: it spends the glance and answers no question.
+// NOTHING IS SAID UNTIL SOMETHING IS KNOWN. Both functions answer null on an
+// engine they cannot name, and the walk draws nothing at all for null rather
+// than "checking…" or a dash.
 
 /** The word for the plan behind an engine. Null for an engine we cannot name. */
 export function runsOnName(engine) {
@@ -33,47 +42,14 @@ export function runsOnName(engine) {
   return null;
 }
 
-/**
- * THE LINE ON A GLANCE SURFACE. "Claude · Max 20x", or just "Claude" where the
- *  plan cannot be read.
- *
- *  The plan is the raw label the tool itself reports, already turned into words
- *  by whoever read it (`planLabel` in main/claude-plan.mjs for Claude, the
- *  named-plan table in main/codex-account.mjs for ChatGPT). It is never
- *  invented here: a plan nobody measured, printed confidently, is the app
- *  lying about what somebody is paying for.
- */
-export function runsOnLine({ engine = null, plan = null } = {}) {
-  const name = runsOnName(engine);
-  if (!name) return null;
-  const words = String(plan ?? '').trim();
-  return words ? `${name} · ${words}` : name;
-}
-
-/**
- * THE WHOLE SENTENCE, for a hover and for whatever reads the screen aloud. The
- *  glance surface carries two words and a plan; this is where the rest of the
- *  answer lives, and it is the half that tells a new person what they are
- *  looking at.
- */
-export function runsOnTitle({ engine = null, plan = null } = {}) {
-  const name = runsOnName(engine);
-  if (!name) return null;
-  const words = String(plan ?? '').trim();
-  const plansentence = words ? ` Your ${words} plan.` : '';
-  return `Your agents run on the ${name} account already signed in on this Mac.${plansentence}`;
-}
-
 /**
  * THE ONE LINE DURING THE WALK, on the Mac where there was nothing to ask.
  *
  *  It replaces silence, not a question: somebody with no coding agent set up
  *  still gets the plan question and the setup card, and never sees this.
  */
-export function foundOnThisMac({ engine = null, plan = null } = {}) {
+export function foundOnThisMac({ engine = null } = {}) {
   const name = runsOnName(engine);
   if (!name) return null;
-  const words = String(plan ?? '').trim();
-  if (words) return `Your agents will run on the ${name} ${words} plan already signed in on this Mac.`;
   return `Your agents will run on the ${name} account already signed in on this Mac.`;
 }

package/shared/shortcuts.mjs

@@ -166,8 +166,8 @@ export const SHORTCUTS = [
     ],
   },
   {
-    // The one group that cannot be named by WHERE she is, because all four of
-    // its keys work both in the list and inside an open task. So it is named by
+    // The one group that cannot be named by WHERE she is, because all of its
+    // keys work both in the list and inside an open task. So it is named by
     // what the keys do, literally and in the order they are drawn.
     label: 'Closing, scheduling and undoing',
     keys: [
@@ -179,10 +179,16 @@ export const SHORTCUTS = [
       // the summary inside a thread and still meant the schedule picker in the
       // list, so this page taught one letter for two different things and an
       // office manager testing the app met both inside a minute. One meaning
-      // per letter: S is the summary, L is later.
-      { keys: ['L'], what: 'Put the task off until a time you pick.' },
+      // per letter: S is the summary, L is later. And the page says the word
+      // the key stands for, because that word is the action's name now
+      // (w-66e3ece93d): the ⌘K row, the picker and the toast all say Later.
+      { keys: ['L'], what: 'Later: put the task off until a time you pick.' },
       // focused branch and list switch: 'z' → undo
       { keys: ['Z'], what: 'Undo the last thing you did.' },
+      // opensTheToast(e.key, toast) above the focused branch → openToastRow.
+      // Z's other half: Z takes back what the toast announced, O goes into it.
+      // Only while a toast with somewhere to go is up (w-f0bfe32859).
+      { keys: ['O'], what: 'Open the task you just sent or answered, while its note is on screen.' },
       // (meta||ctrl) && 'a' && !inInput && !modal → tick the whole list
       { keys: ['⌘A'], what: 'Tick every task in the list. Press it again to untick.' },
     ],

package/shared/spawn-trouble.mjs

@@ -133,7 +133,11 @@ const INTERRUPTED = [
   /connection (closed|lost|dropped)/i,
   /response stopped arriving/i,
   /may be incomplete/i,
-  /econnreset|enotfound|etimedout|econnrefused/i,
+  /econnreset|enotfound|etimedout|econnrefused|enetunreach|ehostunreach|eai_again/i,
+  // Codex also prefixes non-network failures with "stream disconnected".
+  // Match the request failure itself so incomplete responses keep their limit.
+  /error sending request for url/i,
+  /failed to send websocket request/i,
   /unable to connect/i,
   /can.{0,3}t reach the api/i,
   /timed out/i,
@@ -164,6 +168,18 @@ const WORKSPACE = [
   /skip-git-repo-check/i,
 ];
 
+// A MODEL THE LOGIN'S PLAN DOES NOT INCLUDE. Not the account being out and not
+// the model being unknown: the same login runs every other model, and another
+// login on a bigger plan runs this one. Codex's own words, off two dead runs on
+// 2026-10-09 and 2026-10-11 (codex-cli 0.160.0, a free-plan login handed
+// gpt-6.1-sol): "The 'gpt-6.1-sol' model is not supported when using Codex with
+// a ChatGPT account." The second line is ours, thrown before the thread starts
+// by `codexModelRefusal` when the login's own list already says so.
+const MODEL_NOT_ON_PLAN = [
+  /model is not supported when using codex with a chatgpt account/i,
+  /not a model the plan of the codex account/i,
+];
+
 // WHICH OF THE THREE THINGS WENT WRONG, from whatever the tool printed.
 // 'unknown' is a first-class answer, not a failure: an honest generic sentence
 // beats a confident wrong one.
@@ -173,6 +189,8 @@ export function troubleCause(raw) {
   // FIRST, because an organization's refusal mentions the subscription and
   // reads as a signed-out login to the list below.
   if (ORG_BLOCKED.some((re) => re.test(text))) return 'org-blocked';
+  // BEFORE SIGNED-OUT, because Codex's sentence says "ChatGPT account".
+  if (MODEL_NOT_ON_PLAN.some((re) => re.test(text))) return 'model-not-on-plan';
   if (SIGNED_OUT.some((re) => re.test(text))) return 'signed-out';
   if (AT_LIMIT.some((re) => re.test(text))) return 'at-limit';
   if (WORKSPACE.some((re) => re.test(text))) return 'workspace';
@@ -184,6 +202,16 @@ export function troubleCause(raw) {
   return 'unknown';
 }
 
+// A SUBSCRIPTION THAT HAS ENDED IS REFUSED IN AN ADMIN'S WORDS. Claude Code
+// 2.1.293 told a lapsed personal Max login "Your organization has disabled
+// Claude subscription access for Claude Code" (2026-10-11), the same line a
+// workspace policy prints, so the text alone cannot tell them apart. The
+// login's own file can: `plan` is main/claude-plan.mjs's reading of it, and
+// `ended` is its billing gone to "none". Anything else keeps its cause.
+export function refineCause(cause, plan) {
+  return cause === 'org-blocked' && plan?.ended ? 'subscription-ended' : cause;
+}
+
 // WHEN THE LIMIT LETS GO, straight off the line the CLI printed.
 //
 // carries the one thing she actually wants to know, and we were throwing it
@@ -237,7 +265,7 @@ export function needsHerHands(cause) {
   // same person: one is her, in a terminal; one is an admin of a workspace she
   // may not run. What they share is the only thing this question asks — trying
   // again in thirty minutes cannot possibly help.
-  return cause === 'signed-out' || cause === 'org-blocked';
+  return cause === 'signed-out' || cause === 'org-blocked' || cause === 'subscription-ended';
 }
 
 // WHAT SHE READS WHEN NOT ONE AGENT CAN START ANYWHERE.
@@ -246,6 +274,7 @@ export function needsHerHands(cause) {
 export function troubleSentence(cause) {
   if (cause === 'signed-out') return 'No agents can start. Your Claude login has run out.';
   if (cause === 'org-blocked') return 'No agents can start. Your organization has turned Claude Code off.';
+  if (cause === 'subscription-ended') return 'No agents can start. Your Claude subscription has ended.';
   if (cause === 'at-limit') return 'No agents can start. Your Claude plan is at its limit.';
   if (cause === 'workspace') return 'No agents can start. Claude will not run in this folder.';
   if (cause === 'interrupted') return 'No agents can start. The connection to Claude keeps dropping.';
@@ -260,6 +289,7 @@ export function troubleRemedy(cause) {
   // thing to type.
   if (cause === 'signed-out') return 'Open Claude in a terminal, type /login, and they pick straight back up.';
   if (cause === 'org-blocked') return 'Ask an admin of that Claude workspace to turn Claude Code back on.';
+  if (cause === 'subscription-ended') return 'Renew it at claude.ai, or pick another account in Settings.';
   if (cause === 'at-limit') return 'They start again on their own when it resets.';
   if (cause === 'workspace') return 'Open the folder in Claude once and say yes to trusting it.';
   if (cause === 'interrupted') return `Nothing to do. ${Name} tries them again on its own.`;
@@ -289,10 +319,12 @@ export function accountSentence(cause, dir) {
   if (cause === 'org-blocked') {
     return 'Signed in, but its organization has turned Claude Code off. Only an admin of that workspace can turn it back on.';
   }
+  if (cause === 'subscription-ended') return 'Signed in, but its Claude subscription has ended. Renew it at claude.ai to use this account again.';
   if (cause === 'at-limit') return 'At its limit. It rejoins on its own when the limit resets.';
   if (cause === 'workspace') return 'Claude would not run in the folder this was asked to work in.';
   if (cause === 'interrupted') return `Its runs keep getting cut off. ${Name} is trying them again.`;
-  return `Its sessions are dying on arrival. ${Name} is keeping the other one busy.`;
+  // A cause we cannot name points at the account, not at the app (2026-10-11).
+  return 'Claude Code would not start on this account. Check that its plan is active at claude.ai.';
 }
 
 /* ------------------ the same fact about a whole ENGINE -------------------- */
@@ -437,8 +469,10 @@ const DEAD_RUN_OPENERS = {
   workspace: "would not start in this project's folder, so nothing has been done here.",
   'signed-out': 'could not sign in, so nothing has been done on this task.',
   'org-blocked': 'is switched off for that account by its organization, so nothing has been done.',
+  'subscription-ended': "cannot run because that account's Claude subscription has ended, so nothing has been done.",
   'at-limit': 'is at its usage limit, so nothing has been done on this task.',
   interrupted: 'was cut off in the middle, so nothing has been done on this task.',
+  'model-not-on-plan': "could not use this task's model on that account's plan, so nothing has been done.",
   unknown: 'stopped before it did anything, so this task has not been started.',
 };
 
@@ -453,10 +487,13 @@ const DEAD_RUN_OPENERS = {
  */
 const RUN_STOPPED = {
   'signed-out': 'This run stopped because the account was signed out.',
-  'org-blocked': 'This run stopped because that account is switched off by its organization.',
+  // Same refusal text for an admin's block and an ended subscription, and this
+  // line has only the text, so it says what is true of both.
+  'org-blocked': 'This run stopped because Claude Code will not run on that account.',
   'at-limit': 'This run stopped because the account hit its usage limit.',
   workspace: "This run stopped because it would not start in this project's folder.",
   interrupted: 'This run was cut off in the middle.',
+  'model-not-on-plan': "This run stopped because that account's plan does not include the model.",
   unknown: 'This run stopped before it finished.',
 };
 
@@ -464,7 +501,9 @@ export function runStoppedLine(raw) {
   return RUN_STOPPED[troubleCause(raw)] ?? RUN_STOPPED.unknown;
 }
 
-export function deadRunSentence({ engineWord = 'The agent', cause = 'unknown', runs = 1, resetsAt = null } = {}) {
+// `elsewhere` is only read for 'model-not-on-plan': whether another signed-in
+// login's plan has the model, so the task moves there rather than waiting on her.
+export function deadRunSentence({ engineWord = 'The agent', cause = 'unknown', runs = 1, resetsAt = null, elsewhere = false } = {}) {
   const opener = `${engineWord} ${DEAD_RUN_OPENERS[cause] ?? DEAD_RUN_OPENERS.unknown}`;
 
   const again = runs > 1 ? ` This has happened ${runs} times on this task.` : '';
@@ -476,10 +515,16 @@ export function deadRunSentence({ engineWord = 'The agent', cause = 'unknown', r
     ? ' Sign that account back in and it picks straight up.'
     : cause === 'org-blocked'
       ? ' Only an admin of that Claude workspace can turn it back on.'
+      : cause === 'subscription-ended'
+      ? ' Renew it at claude.ai, or pick another account in Settings.'
       : cause === 'at-limit'
       ? (resetsAt ? ` It starts again on its own at ${resetsAt}.` : ' It starts again on its own when the limit resets.')
       : cause === 'interrupted'
         ? ` ${Name} runs it again on its own.`
+        : cause === 'model-not-on-plan'
+          ? (elsewhere
+            ? ` ${Name} runs it again on a Codex account whose plan has it.`
+            : ' Pick another model for this task, or sign in a Codex account whose plan has it.')
         : ` ${Name} keeps trying, and it will keep failing the same way until this is fixed.`;
 
   return `${opener}${again}${next}`;
@@ -559,9 +604,11 @@ export function deadRunCause(text) {
 export function causeWord(cause) {
   if (cause === 'signed-out') return 'a signed-out login';
   if (cause === 'org-blocked') return 'an organization that blocks Claude Code';
+  if (cause === 'subscription-ended') return 'an ended Claude subscription';
   if (cause === 'at-limit') return 'your Claude limit';
   if (cause === 'workspace') return 'a folder Claude will not run in';
   if (cause === 'interrupted') return 'runs getting cut off';
+  if (cause === 'model-not-on-plan') return "a model the account's plan does not include";
   return 'something we cannot name';
 }
 
@@ -572,9 +619,11 @@ export function causeWhat(cause, count) {
   const n = Math.max(0, Math.trunc(count ?? 0));
   if (cause === 'signed-out') return `${n} stopped by a signed-out Claude login`;
   if (cause === 'org-blocked') return `${n} stopped by an organization that blocks Claude Code`;
+  if (cause === 'subscription-ended') return `${n} stopped by an ended Claude subscription`;
   if (cause === 'at-limit') return `${n} waiting on your Claude limit`;
   if (cause === 'workspace') return `${n} in a folder Claude will not run in`;
   if (cause === 'interrupted') return `${n} cut off mid-run`;
+  if (cause === 'model-not-on-plan') return `${n} asking for a model no signed-in Codex plan includes`;
   return `${n} stopped for a reason we cannot name`;
 }
 
@@ -583,9 +632,11 @@ export function causeWhat(cause, count) {
 export function causeNext(cause, resetsAt = null) {
   if (cause === 'signed-out') return 'Type /login in a terminal and they pick straight up.';
   if (cause === 'org-blocked') return 'Ask an admin of that Claude workspace to turn Claude Code back on.';
+  if (cause === 'subscription-ended') return 'Renew it at claude.ai, or pick another account in Settings.';
   if (cause === 'at-limit') return resetsAt ? `They start again on their own at ${resetsAt}.` : 'They start again on their own when it resets.';
   if (cause === 'workspace') return 'Open the folder in Claude once and say yes to trusting it.';
   if (cause === 'interrupted') return `Nothing to do. ${Name} is trying them again.`;
+  if (cause === 'model-not-on-plan') return 'Pick another model on each, or sign in a Codex account whose plan has it.';
   return `${Name} keeps trying on its own.`;
 }
 
@@ -614,7 +665,7 @@ export function causeBreakdown(rows = [], resetsAt = null) {
       what: causeWhat(cause, count),
       next: causeNext(cause, cause === 'at-limit' ? resetsAt : null),
       act: causeAct(cause),
-      hers: needsHerHands(cause) || cause === 'workspace',
+      hers: needsHerHands(cause) || cause === 'workspace' || cause === 'model-not-on-plan',
     }))
     .sort((a, b) => (b.hers - a.hers) || (b.count - a.count) || a.cause.localeCompare(b.cause));
 }

package/shared/terminal-input.d.mts

@@ -0,0 +1 @@
+export function inputQueue(send: (data: string) => Promise<unknown>, options?: { chunk?: number; onError?: (e: unknown) => void }): { push(data: string): void };

package/shared/terminal-input.mjs

@@ -0,0 +1,30 @@
+// KEYS TYPED WHILE ONE WRITE IS ON ITS WAY GO OUT TOGETHER, as the next write.
+//
+// The panel used to send every key as its own round trip to main, each one
+// waiting for the last, so holding Delete built a line of trips that drained
+// after she let go. Now the first key goes at once, and whatever she types
+// while it travels is one write behind it, in order. A paste still goes in
+// pieces main accepts (64 KB is its limit; `chunk` stays well under it).
+//
+// A write that fails (the shell exited) drops what was waiting behind it: those
+// keys were for a shell that is gone, and the failure is reported once.
+export function inputQueue(send, { chunk = 16384, onError } = {}) {
+  let queued = '', sending = false;
+  async function drain() {
+    if (sending) return;
+    sending = true;
+    try {
+      while (queued) {
+        const data = queued.slice(0, chunk);
+        queued = queued.slice(data.length);
+        await send(data);
+      }
+    } catch (e) {
+      queued = '';
+      onError?.(e);
+    } finally {
+      sending = false;
+    }
+  }
+  return { push(data) { queued += data; void drain(); } };
+}

package/shared/terminal-keys.d.mts

@@ -0,0 +1 @@
+export function optionWordKey(event: { type: string; key: string; altKey: boolean; ctrlKey: boolean; metaKey: boolean; shiftKey: boolean }, isMac: boolean): string | undefined;

package/shared/terminal-keys.mjs

@@ -0,0 +1,16 @@
+// OPTION+LEFT AND OPTION+RIGHT JUMP A WORD, as they do in Mac Terminal.
+// xterm 6 sends them as ESC[1;3D and ESC[1;3C, which zsh and bash do not bind,
+// so a shell typed `;3D` into the line instead. Mac Terminal sends ESC b and
+// ESC f, the backward-word and forward-word every shell already knows.
+//
+// Returns what to send for this key, '' to swallow the keyup of one we
+// handled, or undefined to leave the key to xterm. Off a Mac nothing changes:
+// Linux terminals send the same ESC[1;3D xterm does.
+const WORD = { ArrowLeft: '\x1bb', ArrowRight: '\x1bf' };
+
+export function optionWordKey(event, isMac) {
+  if (!isMac || !event.altKey || event.ctrlKey || event.metaKey || event.shiftKey) return undefined;
+  const sequence = WORD[event.key];
+  if (!sequence) return undefined;
+  return event.type === 'keydown' ? sequence : '';
+}

package/shared/terminal-size.d.mts

@@ -0,0 +1,4 @@
+export const SIZE_KEY: string;
+export const TERMINAL_MIN: { height: number; width: number };
+export function dragSize(dimension: 'height' | 'width', start: number, delta: number, room: number): number;
+export function readSavedSize(raw: string | null | undefined): { height?: number; width?: number };

package/shared/terminal-size.mjs

@@ -0,0 +1,29 @@
+// HOW BIG THE TERMINAL MAY BE DRAGGED (renderer/src/components/TaskTerminal.tsx).
+//
+// Small enough still shows a few lines; large enough still leaves the page it
+// sits in a strip to read (the thread's title and a line or two above it, or a
+// column of the conversation beside it). The size is one for the whole app,
+// remembered under SIZE_KEY, the way an editor remembers its panel.
+export const SIZE_KEY = 'zero.terminal.size';
+export const TERMINAL_MIN = { height: 120, width: 280 };
+const LEAVE = { height: 120, width: 320 };
+const LARGEST = 4000;
+
+/** `start` px, the edge moved `delta` px toward growing, in a pane `room` px across. */
+export function dragSize(dimension, start, delta, room) {
+  const min = TERMINAL_MIN[dimension];
+  const max = Math.max(min, room - LEAVE[dimension]);
+  return Math.round(Math.min(max, Math.max(min, start + delta)));
+}
+
+export function readSavedSize(raw) {
+  let saved;
+  try { saved = JSON.parse(raw ?? ''); } catch { return {}; }
+  if (!saved || typeof saved !== 'object' || Array.isArray(saved)) return {};
+  const out = {};
+  for (const dimension of ['height', 'width']) {
+    const v = saved[dimension];
+    if (Number.isFinite(v) && v >= TERMINAL_MIN[dimension] && v <= LARGEST) out[dimension] = v;
+  }
+  return out;
+}

package/shared/usage.d.mts

@@ -3,6 +3,9 @@
 // rule about which coding agent the corner is about, the zone primitives the
 // Claude reader is built on, and the words the panel prints.
 
+/** What a usage check that got nothing readable says, for any cause we have not named. */
+export const USAGE_UNREADABLE: string;
+
 export interface UsageLimit {
   span: 'session' | 'week';
   qualifier: string | null;

package/shared/usage.mjs

@@ -33,6 +33,13 @@ import { DEFAULT_ENGINE } from './engines.mjs';
 
 /* ------------------ WHICH CODING AGENT THE CORNER IS ABOUT ---------------- */
 
+// WHAT A USAGE CHECK THAT GOT NOTHING READABLE SAYS, for every reason we have
+// not named. It used to be "Could not refresh usage. Try again.", which reads
+// as the app having broken; the measured case (2026-10-11) was an account whose
+// subscription had ended, and Claude Code simply printed no limits for it. So
+// it points at the account, which is where an unnamed cause almost always is.
+export const USAGE_UNREADABLE = "Claude Code didn't report usage for this account. Check that its plan is active at claude.ai.";
+
 /**
  * THE AGENT MOST OF HER LIVE WORK IS ON, or the workspace's own when nothing is
  * running and when the fleet is level.