agentbox-app 0.1.12 → 0.1.13

package/shared/where-it-runs-from.d.mts

@@ -0,0 +1,43 @@
+// Types for shared/where-it-runs-from.mjs, which is plain ESM so that main
+// (Node) and the screen (Vite) share one copy of the rule about whether this
+// copy of the app can update itself from where it is, and one copy of the
+// words that say so. The screen asks for the words and `sayWhere`; the places
+// and the move are main's.
+
+/** The place a copy of the app is in, as far as updating itself is concerned. */
+export type AppPlace =
+  | 'disk-image' | 'translocated' | 'applications' | 'elsewhere' | 'source' | 'not-mac';
+
+export const PLACE: {
+  diskImage: 'disk-image';
+  translocated: 'translocated';
+  applications: 'applications';
+  elsewhere: 'elsewhere';
+  source: 'source';
+  notMac: 'not-mac';
+};
+
+export const MOVE_SAY: {
+  cannotUpdateHere: string;
+  button: string;
+  title: string;
+  where: Record<string, string>;
+  shortWhere: Record<string, string>;
+  fix: string;
+  retry: string;
+};
+
+/** The sentence for a place, or null where there is nothing to say. */
+export function sayWhere(place: string | null | undefined, how?: { short?: boolean }): string | null;
+
+export function placeOfApp(facts?: {
+  platform?: string;
+  packaged?: boolean;
+  exePath?: string | null;
+  inApplications?: boolean;
+}): { place: AppPlace; canUpdate: boolean; offerMove: boolean };
+
+export function createPlace(host: { app: unknown; log?: unknown }): {
+  state(): { place: AppPlace; canUpdate: boolean; offerMove: boolean };
+  move(): { moved: boolean; error: string | null };
+};

package/shared/where-it-runs-from.mjs

@@ -0,0 +1,155 @@
+// AN APP IN THE WRONG PLACE CAN NEVER UPDATE ITSELF, AND NEVER SAID SO.
+//
+// macOS has two places it will happily run Agentbox from and never let it
+// replace itself:
+//
+//   THE DISK IMAGE. You double-click the .dmg, you double-click the app
+//   inside it, and it works. The volume is read-only, so Squirrel.Mac refuses
+//   the swap with "Cannot update while running on a read-only volume".
+//
+//   A TRANSLOCATED COPY. You drag the app to Downloads and open it. Because
+//   it still carries the quarantine flag and is not in Applications, macOS
+//   runs it from a read-only copy it makes under
+//   `/private/var/folders/…/AppTranslocation/<uuid>/d/`. Same refusal, and
+//   this is why Squirrel's own sentence talks about the Downloads directory.
+//
+// Measured in PostHog on 2026-10-12: 23 crash reports over three weeks, two
+// installs, both on 0.1.11, one report every six hours (`EVERY_MS` in
+// main/updater.mjs) for as long as the app was open. The reports stopped being
+// filed as crashes in 292d419. The two Macs are still on 0.1.11.
+//
+// SO THE APP READS WHERE IT IS AND OFFERS THE ONE PRESS THAT FIXES IT. Electron
+// has had `moveToApplicationsFolder` since 4: it moves the bundle, replaces an
+// older copy if you say so, and relaunches from the new place. After that the
+// ordinary six-hourly check works and the person never thinks about it again.
+//
+// EVERYTHING HERE IS A FACT AND NOT A GUESS, which is why the decision is a
+// pure function with the four facts passed in: a wrong "you are in the wrong
+// place" is a nag on a healthy install, and two of those are worse than the
+// silence this replaces.
+
+import { Name } from './product-name.mjs';
+
+// THE WORDS, IN ONE PLACE, and main and the renderer both read them from here.
+// `cannotUpdateHere` is the sentence `shortError` in main/updater.mjs puts in
+// place of Squirrel's own paragraph, which is 240 characters with a URL in the
+// middle and was arriving on the Settings row cut off at 160.
+//
+// Every sentence says where the app is and what one press does about it, and
+// none of them says "read-only volume": that is the mechanism, and nobody
+// holding the Mac asked about the mechanism.
+export const MOVE_SAY = {
+  cannotUpdateHere: `${Name} cannot update itself from where it is.`,
+  button: 'Move to Applications',
+  /** The sidebar card's heading. */
+  title: 'Updates are stuck',
+  /** What the place is, as a person would say it. */
+  where: {
+    'disk-image': `${Name} is running from the disk image it was downloaded in.`,
+    translocated: `${Name} is running from a read-only copy macOS made of it.`,
+  },
+  /** The same fact in half the words, for the sidebar card, which is one
+   *  column wide and had the row's sentence running to six lines in it. */
+  shortWhere: {
+    'disk-image': `${Name} can’t update itself from the disk image.`,
+    translocated: `${Name} can’t update itself from the copy macOS made.`,
+  },
+  /** And the press, which is the same either way. */
+  fix: 'Moving it to your Applications folder takes a few seconds and gets updates working again.',
+  retry: 'Pressing it again tries again.',
+};
+
+/** The sentence for a place, or null where there is nothing to say. `short` is
+ *  the sidebar card's half of it: the button beside it already says the fix. */
+export function sayWhere(place, { short = false } = {}) {
+  const words = short ? MOVE_SAY.shortWhere : MOVE_SAY.where;
+  return words[place] ?? null;
+}
+
+/** Where a copy of the app can be, as far as updating itself is concerned. */
+export const PLACE = {
+  /** Run out of the mounted .dmg. Read-only; cannot update. */
+  diskImage: 'disk-image',
+  /** macOS is running a read-only copy of its own. Cannot update. */
+  translocated: 'translocated',
+  /** Where it belongs. */
+  applications: 'applications',
+  /** Somewhere writable that is not Applications: updates itself fine. */
+  elsewhere: 'elsewhere',
+  /** `npm start` from a checkout: main/source-updater.mjs, nothing to move. */
+  source: 'source',
+  /** No Applications folder and no `moveToApplicationsFolder`. */
+  notMac: 'not-mac',
+};
+
+// The folder macOS puts a translocated copy in. The path is always under
+// `/private/var/folders`, but the one segment that names the mechanism is this
+// one, and it is the only part Apple has kept stable. Written with "/" and
+// not `path.sep`: these are only ever read on a Mac (`placeOfApp` returns
+// before them anywhere else), and the screen imports this file, so it may not
+// import anything from Node.
+const TRANSLOCATED = '/AppTranslocation/';
+// Every mounted volume lives here, including the disk image the download is.
+const VOLUMES = '/Volumes/';
+
+/**
+ * PURE. The whole decision, off four facts, so every case can be tested
+ * without a packaged app, a disk image, or a Mac.
+ *
+ * `exePath` is `app.getPath('exe')`, the binary inside the bundle;
+ * `inApplications` is Electron's own `app.isInApplicationsFolder()`, which
+ * knows about `~/Applications` as well as `/Applications` and is therefore
+ * never re-derived from the path here.
+ */
+export function placeOfApp({ platform, packaged, exePath, inApplications } = {}) {
+  const no = (place) => ({ place, canUpdate: true, offerMove: false });
+  if (platform !== 'darwin') return no(PLACE.notMac);
+  if (!packaged) return no(PLACE.source);
+  if (inApplications) return no(PLACE.applications);
+  if (typeof exePath !== 'string' || !exePath) return no(PLACE.elsewhere);
+  const where = exePath.includes(TRANSLOCATED) ? PLACE.translocated
+    : exePath.startsWith(VOLUMES) ? PLACE.diskImage
+    : null;
+  // THE PLACES THAT ARE NOT APPLICATIONS AND UPDATE THEMSELVES ANYWAY are left
+  // alone on purpose. A copy sitting in Downloads that macOS did not
+  // translocate is on a writable disk and Squirrel swaps it happily; offering
+  // to move it would be the app asking for something it does not need.
+  if (!where) return no(PLACE.elsewhere);
+  return { place: where, canUpdate: false, offerMove: true };
+}
+
+/**
+ * The live one, over Electron's `app`. Read ONCE, at construction: the bundle
+ * cannot move under a running process except by the move below, which
+ * relaunches.
+ */
+export function createPlace({ app, log = console }) {
+  const where = placeOfApp({
+    platform: app?.platform ?? process.platform,
+    packaged: !!app?.isPackaged,
+    exePath: (() => { try { return app?.getPath?.('exe') ?? null; } catch { return null; } })(),
+    inApplications: (() => { try { return !!app?.isInApplicationsFolder?.(); } catch { return false; } })(),
+  });
+
+  return {
+    state: () => ({ ...where }),
+
+    /**
+     * THE PRESS. Electron moves the bundle and relaunches, so nothing after a
+     * `true` here ever runs. It answers false when the person cancels its own
+     * "a copy is already there" box, which is an answer and not a failure.
+     */
+    move() {
+      if (!where.offerMove) return { moved: false, error: null };
+      try {
+        const moved = !!app.moveToApplicationsFolder();
+        return { moved, error: null };
+      } catch (e) {
+        // One line, because Settings shows this string to a person.
+        const error = String(e?.message ?? e ?? 'The move did not work.').split('\n')[0].trim();
+        log.warn?.('[place] could not move the app into Applications:', error);
+        return { moved: false, error };
+      }
+    },
+  };
+}

package/shared/work-items.mjs

@@ -366,6 +366,14 @@ function str(value, max) {
   return trimmed.slice(0, lo) + mark(trimmed.length - lo);
 }
 
+// A text field whose empty string MEANS something: nothing chosen. Only a
+// string may clear it, so a `null` that reached here without going through
+// `answerItem` is still dropped rather than guessed at.
+function clearable(value, max) {
+  if (typeof value !== 'string') return undefined;
+  return value.trim() ? str(value, max) : '';
+}
+
 function coerceField(field, value) {
   switch (field) {
     case 'title': return str(value, MAX_TITLE);
@@ -388,7 +396,23 @@ function coerceField(field, value) {
     // shared/effort-levels.mjs, and the spawn gates on them, so a value this
     // module does not recognise is a run at Claude Code's own choice rather
     // than a row that never runs.
-    case 'kind': case 'product': case 'parent': case 'engine': case 'model': case 'effort': return str(value, MAX_SHORT);
+    case 'kind': case 'product': case 'parent': case 'engine': return str(value, MAX_SHORT);
+    // THESE TWO ARE CLEARED BY WRITING '' AND SO '' IS A REAL VALUE, exactly
+    // as runAt's 0 and start's 'now' are, and for the same reason: a field that
+    // coerces to undefined is dropped by the fold, so without a falsy value
+    // that survives, a model could be chosen and never unchosen.
+    //
+    // They used to sit on the line above, which cost us the most common crash
+    // of launch week. The reply box's drawer hands a pick back as null for
+    // "nothing chosen" and sends `{ model, effort }` whenever it was touched at
+    // all; `answerItem` turns null into '' because `modelForEngine` reads the
+    // empty string as nothing chosen. `str()` then dropped it, `pickFields`
+    // answered null, and `buildLine` threw — before the answer was written,
+    // because the model is written first on purpose. So opening the drawer,
+    // picking a model and pressing send lost the message, with nothing on
+    // screen to say so. Five of the 14 crashes since the Oct 6 launch, on two
+    // installs (PostHog, 2026-10-08).
+    case 'model': case 'effort': return clearable(value, MAX_SHORT);
     case 'status': return WORK_ITEM_STATUSES.includes(value) ? value : undefined;
     case 'priority': return Number.isFinite(value) ? Math.trunc(value) : undefined;
     // When this item may next be acted on, in epoch ms. 0 means unscheduled,

package/shared/work-lines.mjs

@@ -637,7 +637,7 @@ export function groupWork(events, { min = RUN_MIN } = {}) {
   for (const e of events ?? []) {
     // SOMETHING SHE DID IS NOT THE AGENT'S WORK and never folds into it: three
     // snoozes are three lines, not one "You put it off" (w-49b4e45403).
-    if (e && e.kind === 'work' && !e.yours) { run.push(e); continue; }
+    if (e && e.kind === 'work' && !e.yours && !e.standalone) { run.push(e); continue; }
     flush();
     out.push(e);
   }

package/shared/xterm-invalid-range.d.mts

@@ -0,0 +1,2 @@
+export const INVALID_RANGE: string;
+export function guardInvalidRange(terminal: unknown, options?: { warn?: (message: string) => void }): boolean;

package/shared/xterm-invalid-range.mjs

@@ -0,0 +1,58 @@
+// XTERM'S OWN ASSERTION, CAUGHT WHERE WE CAN REACH IT.
+//
+// @xterm/xterm 6.0.0's AccessibilityManager listens on the document for
+// 'selectionchange', maps the selection onto terminal rows and columns, and
+// does `throw new Error('invalid range')` when the result covers no cells,
+// under its own comment "This should not happen unless we have some bugs". It
+// happens. Three ordinary selections reach it, measured against the published
+// bundle; the test beside this file
+// (tests/a-selection-that-covers-no-terminal-cells-is-not-a-crash.test.mjs)
+// lists them and says how.
+//
+// Only a screen reader user gets that handler at all, because the pane asks
+// `app.accessibilitySupportEnabled` before turning `screenReaderMode` on. For
+// them the throw escapes as an unhandled renderer error, and the terminal keeps
+// whatever was selected before it, so a copy afterwards takes stale text.
+//
+// WHY A WRAPPER AND NOT A PATCHED BUNDLE. What we build against is minified
+// `lib/xterm.mjs`, and rewriting a file inside node_modules at build time is
+// machinery that has to hold through `npm ci` on two CI runners and every
+// release. xterm dispatches the handler as `() => this._handleSelectionChange()`,
+// off the instance, so one own property on the manager shadows it and the
+// wrapper dies with the terminal.
+//
+// IT SWALLOWS ONE MESSAGE AND NOTHING ELSE. The same handler warns about two
+// genuine race conditions and returns; anything that is not this exact
+// assertion is somebody's bug and goes on up.
+//
+// This is a workaround, and the upstream fix is the assertion becoming a
+// clearSelection and a return. When an xterm release carries that, the test
+// above turns red on the bundle it reads, and this file goes.
+export const INVALID_RANGE = 'invalid range';
+
+/**
+ * Wrap the accessibility manager's selection handler on `terminal`, which must
+ * already be open. Answers whether there was one to wrap: false when
+ * screenReaderMode is off, which is every install not running a screen reader,
+ * and false when it is already wrapped.
+ */
+export function guardInvalidRange(terminal, { warn = console.warn } = {}) {
+  const manager = terminal?._core?._accessibilityManager?.value;
+  const handler = manager?._handleSelectionChange;
+  if (typeof handler !== 'function' || handler.guardsInvalidRange) return false;
+  const guarded = function (...args) {
+    try {
+      return handler.apply(this, args);
+    } catch (e) {
+      // Message, not instanceof: an Error from another realm is still this bug.
+      if (e?.message !== INVALID_RANGE) throw e;
+      warn(`xterm mapped the selection onto no cells and threw "${INVALID_RANGE}"; cleared the terminal's selection instead`);
+      // It threw before mirroring the selection, so the terminal is still
+      // holding the previous one. Nothing is selected; say that.
+      terminal.clearSelection();
+    }
+  };
+  guarded.guardsInvalidRange = true;
+  manager._handleSelectionChange = guarded;
+  return true;
+}