agentbox-app 0.1.12 → 0.1.16

package/shared/relay-crypto.mjs

@@ -0,0 +1,165 @@
+// THE RELAY'S LOCKS (relay/worker.mjs, main/relay-client.mjs, relay/phone/).
+//
+// A phone away from home reaches the Mac through a relay we run. Everything
+// that crosses it is sealed on one end and opened on the other with keys made
+// from the phone's key, which is in the QR code and nowhere else: it never
+// leaves the Mac except into the code, and the phone keeps it in the address's
+// fragment, which a browser never sends. So the relay can pass messages and
+// cannot read, alter or forge one.
+//
+// What the relay does see: a room name, and the Mac's proof that it may hold
+// that room. The room is a hash of the proof, so the relay can check a Mac
+// against it, and neither one tells it the key.
+//
+// Plain WebCrypto, so this one file runs on the Mac (Node), on Cloudflare, and
+// in the phone's service worker.
+
+const enc = new TextEncoder();
+const subtle = () => globalThis.crypto.subtle;
+const SALT = enc.encode('agentbox-relay-v1');
+
+export function b64u(bytes) {
+  let s = '';
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+async function bits(key, info, length = 256) {
+  const ikm = await subtle().importKey('raw', enc.encode(String(key)), 'HKDF', false, ['deriveBits']);
+  return new Uint8Array(await subtle().deriveBits({ name: 'HKDF', hash: 'SHA-256', salt: SALT, info: enc.encode(info) }, ikm, length));
+}
+
+async function roomOf(proof) {
+  return b64u(new Uint8Array(await subtle().digest('SHA-256', enc.encode(`agentbox-room:${proof}`))));
+}
+
+/** The room the relay knows this pair by, and the Mac's proof that it is the Mac's. */
+export async function relayIds(key) {
+  const proof = b64u(await bits(key, 'mac-proof'));
+  return { room: await roomOf(proof), proof };
+}
+
+/** Is `proof` the proof for `room`? The relay asks this of every Mac. */
+export async function macMayJoin(room, proof) {
+  if (typeof room !== 'string' || typeof proof !== 'string' || !proof) return false;
+  const want = await roomOf(proof);
+  if (want.length !== room.length) return false;
+  let diff = 0;
+  for (let i = 0; i < want.length; i += 1) diff |= want.charCodeAt(i) ^ room.charCodeAt(i);
+  return diff === 0;
+}
+
+const aes = async (raw) => subtle().importKey('raw', raw, { name: 'AES-GCM' }, false, ['encrypt', 'decrypt']);
+
+/** One key for each direction, so nothing sealed one way opens the other. */
+export async function relayKeys(key) {
+  return { up: await aes(await bits(key, 'phone-to-mac')), down: await aes(await bits(key, 'mac-to-phone')) };
+}
+
+/**
+ * Seal `bytes` for the other end. `aad` names what it is (a request, or the
+ * n-th frame of the answer to one request), so a frame cannot be passed off
+ * as another. Out: 12 bytes of nonce, then the sealed bytes.
+ */
+export async function seal(key, bytes, aad) {
+  const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
+  const ct = new Uint8Array(await subtle().encrypt({ name: 'AES-GCM', iv, additionalData: enc.encode(aad) }, key, bytes));
+  const out = new Uint8Array(12 + ct.length);
+  out.set(iv, 0);
+  out.set(ct, 12);
+  return out;
+}
+
+/** Open what `seal` made, or throw if a single bit of it was changed. */
+export async function open(key, sealed, aad) {
+  if (!(sealed instanceof Uint8Array) || sealed.length < 28) throw new Error('Too short to be sealed.');
+  const pt = await subtle().decrypt({ name: 'AES-GCM', iv: sealed.subarray(0, 12), additionalData: enc.encode(aad) }, key, sealed.subarray(12));
+  return new Uint8Array(pt);
+}
+
+/* ------------------------------------------------------------- the wire */
+
+// A request, phone to Mac, before it is sealed: four bytes giving the length of
+// a json head, the head, then the body. The head carries a time and a random
+// nonce, so the Mac can turn away one it has already answered.
+export function packRequest(head, body = new Uint8Array(0)) {
+  const h = enc.encode(JSON.stringify(head));
+  const out = new Uint8Array(4 + h.length + body.length);
+  new DataView(out.buffer).setUint32(0, h.length);
+  out.set(h, 4);
+  out.set(body, 4 + h.length);
+  return out;
+}
+
+export function unpackRequest(bytes) {
+  const n = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).getUint32(0);
+  const head = JSON.parse(new TextDecoder().decode(bytes.subarray(4, 4 + n)));
+  return { head, body: bytes.subarray(4 + n) };
+}
+
+// An answer, Mac to phone, is a run of frames, each sealed on its own: a head
+// (status and headers), the body in pieces, and an end. The end is sealed too,
+// so an answer cut short by anyone in between is seen to be cut short.
+//
+// WAIT comes before the head and says only "still working". A reply to an
+// agent mid-step is answered when the agent takes it, which can be minutes,
+// and the room gives a Mac 30 seconds to start answering. A phone that asks
+// for these (`wait` in its request's head) skips them; one that does not
+// never gets one.
+export const FRAME = Object.freeze({ HEAD: 0, DATA: 1, END: 2, WAIT: 3 });
+
+export const frameAad = (nonce, seq) => `res:${nonce}:${seq}`;
+
+// ON THE MAC'S SOCKET TO THE RELAY one byte says what a message is, then eight
+// bytes of request number, then whatever it carries:
+//   to the Mac     0x01 a request (the sealed bytes)   0x02 the phone gave up
+//                  0x03 a piece of a request too big for one message; the
+//                       0x01 that follows carries the last piece
+//   from the Mac   0x10 one sealed frame of the answer  0x11 done
+//                  0x12 refused: it would not open, or it was a replay
+export const TO_MAC = Object.freeze({ REQUEST: 0x01, CANCEL: 0x02, PART: 0x03 });
+/** The most the relay puts in one socket message to the Mac. Cloudflare's limit is 1 MB. */
+export const PART_BYTES = 512 * 1024;
+export const FROM_MAC = Object.freeze({ FRAME: 0x10, DONE: 0x11, REFUSED: 0x12 });
+export const ID_BYTES = 8;
+
+export function tag(type, id, rest = new Uint8Array(0)) {
+  const out = new Uint8Array(1 + ID_BYTES + rest.length);
+  out[0] = type;
+  out.set(id, 1);
+  out.set(rest, 1 + ID_BYTES);
+  return out;
+}
+
+// Between the relay and either end each sealed piece goes with its length in
+// front, so one stream of bytes can carry many.
+export function lengthPrefixed(bytes) {
+  const out = new Uint8Array(4 + bytes.length);
+  new DataView(out.buffer).setUint32(0, bytes.length);
+  out.set(bytes, 4);
+  return out;
+}
+
+/** Split a stream (or a reader of one) of length-prefixed pieces back into the pieces. */
+export async function* pieces(source) {
+  const reader = typeof source.getReader === 'function' ? source.getReader() : source;
+  let buf = new Uint8Array(0);
+  try {
+    for (;;) {
+      while (buf.length >= 4) {
+        const n = new DataView(buf.buffer, buf.byteOffset, buf.byteLength).getUint32(0);
+        if (buf.length < 4 + n) break;
+        yield buf.slice(4, 4 + n);
+        buf = buf.subarray(4 + n);
+      }
+      const { value, done } = await reader.read();
+      if (done) return;
+      const next = new Uint8Array(buf.length + value.length);
+      next.set(buf, 0);
+      next.set(value, buf.length);
+      buf = next;
+    }
+  } finally {
+    try { reader.releaseLock(); } catch { /* cancelled under us */ }
+  }
+}

package/shared/repeats.d.mts

@@ -28,6 +28,10 @@ export const REPEAT_LABEL_PREFIX: string;
 export function repeatLabel(ruleId: string): string;
 export function ruleIdOf(item: { labels?: string[] } | null | undefined): string | null;
 export function isCleanRun(item: { labels?: string[] } | null | undefined): boolean;
+export function runToOpen<T extends { id: string; product: string; labels?: string[]; createdAt: number }>(
+  rule: { id: string; product: string; lastOccurrence?: string },
+  items: T[],
+): T | null;
 export const DAY_NAMES: string[];
 export function isRepeatRule(rule: unknown): boolean;
 export function ruleLabel(rule: unknown): string;
@@ -43,3 +47,7 @@ export function foldRepeats(
   lines: Array<{ id: string; ts: number; patch: Record<string, unknown> } | null>,
   now?: number,
 ): Map<string, RepeatRule>;
+export const PROTOCOL_OPENS: string;
+export const INSTRUCTION_MARK: string;
+/** A repeating run's body without the agent's rules in front of it; any other body whole. */
+export function instructionOf(body: string | null | undefined): string;

package/shared/repeats.mjs

@@ -15,6 +15,16 @@ const KEY_RE = /^\d{4}-\d{2}-\d{2}$/;
 export const CLEAN_LABEL = 'clean';
 export const REPEAT_LABEL_PREFIX = 'repeat:';
 
+// A run's body is the app's rules for the agent (main/repeats.mjs), then the
+// person's instruction after INSTRUCTION_MARK. Screens show the instruction.
+export const PROTOCOL_OPENS = 'THIS IS ONE RUN OF A REPEATING TASK.';
+export const INSTRUCTION_MARK = 'HER INSTRUCTION FOLLOWS.';
+export function instructionOf(body) {
+  const text = String(body ?? '');
+  const at = text.indexOf(`\n${INSTRUCTION_MARK}\n`);
+  return text.startsWith(PROTOCOL_OPENS) && at >= 0 ? text.slice(at + INSTRUCTION_MARK.length + 2).trim() : text;
+}
+
 export function repeatLabel(ruleId) {
   return `${REPEAT_LABEL_PREFIX}${ruleId}`;
 }
@@ -24,14 +34,35 @@ export function ruleIdOf(item) {
   return found ? found.slice(REPEAT_LABEL_PREFIX.length) : null;
 }
 
+// THE STANDING INSTRUCTION: the words every run after this one is briefed with.
+// `serve` copies this into each occurrence's body under the protocol, and the
+// store tool an agent changes it through reads and writes the same thing, so
+// what the tool shows a run is what the next run gets.
+export function standingInstruction(rule) {
+  return rule?.body ?? rule?.title;
+}
+
 // A clean run is one the worker EXPLICITLY marked clean. Everything else is news
 // and reaches her, including a run that died without saying anything: this
 // predicate exists to hide, never to show, so it fails open by construction.
 export function isCleanRun(item) {
-  return !!ruleIdOf(item) && (item?.labels ?? []).includes(CLEAN_LABEL);
+  const labels = item?.labels ?? [];
+  const aRun = !!ruleIdOf(item) || labels.some((l) => typeof l === 'string' && (l.startsWith('teammate:') || l === 'teammate-offer'));
+  return aRun && labels.includes(CLEAN_LABEL);
+}
+
+// THE THREAD AN OPENED REPEATING TASK LANDS ON: its latest run, an ordinary
+// work item, so the Reply box under it messages that run's agent like any
+// other thread (w-5e3f2e047f). The run it last served first; when that one has
+// left the store's window, the newest of its runs still on file. Null before
+// the first run, and never a run of another rule or another project.
+export function runToOpen(rule, items) {
+  const mine = (items ?? []).filter((i) => i.product === rule.product && ruleIdOf(i) === rule.id);
+  return mine.find((i) => i.id === rule.lastOccurrence)
+    ?? mine.reduce((newest, i) => (!newest || i.createdAt > newest.createdAt ? i : newest), null);
 }
 
-export const DAY_NAMES = ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday'];
+export const DAY_NAMES = ['Sunday','Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday'];
 
 // Three shapes, because they are the three a founder actually asks for:
 //   { every: 'day',     at }        every morning

package/shared/room-cards.mjs

@@ -0,0 +1,167 @@
+// A ROOM'S WALL AND THE ROW MY MAC PUBLISHES FOR IT (w-3d0fa23ffb).
+//
+// Pure. Rows are as the cloud sends them (cloud/supabase/migrations/
+// 20261021000000_rooms.sql): `room_profiles` say what a person lets a card
+// show, `room_presence` is one row per Mac. docs/team/ROOMS-PLAN.md has the
+// rules; the test is tests/a-room-wall-shows-each-person-as-they-chose.
+import { levelFor, localDate, streakOf } from './agent-hours.mjs';
+import { visibilityOf } from './thread-cards.mjs';
+
+export const PRESENCE_STALE_MS = 15 * 60_000;
+export const WORKING_ON_MAX = 64;
+const DAY_MS = 86_400_000;
+
+export function displayNameOf(name, { full = false } = {}) {
+  let s = String(name ?? '').trim();
+  if (s.includes('@')) s = s.split('@')[0];
+  const words = s.split(/\s+/).filter(Boolean);
+  if (words.length < 2 || full) return words.join(' ');
+  return `${words[0]} ${words.at(-1)[0].toUpperCase()}.`;
+}
+
+const ms = (v) => (v == null ? NaN : typeof v === 'number' ? v : Date.parse(v));
+// A date the publisher wrote in their own zone, read as local midnight here.
+const dayMs = (d) => (typeof d === 'string' ? new Date(`${d}T00:00:00`).getTime() : NaN);
+const num = (v) => (Number.isFinite(Number(v)) ? Number(v) : 0);
+
+function sumPresence(rows, now) {
+  let agents = 0, total = 0, week = 0, today = 0;
+  const days = new Set();
+  const months = new Map();
+  let lead = null;
+  for (const r of rows) {
+    if (r.gone) continue;
+    total += num(r.hours_total);
+    if (now < dayMs(r.week_start) + 7 * DAY_MS) week += num(r.hours_week);
+    if (now < dayMs(r.day) + DAY_MS) today += num(r.hours_today);
+    for (const d of r.active_days ?? []) days.add(String(d).slice(0, 10));
+    for (const m of Array.isArray(r.hours_by_month) ? r.hours_by_month : []) {
+      if (typeof m?.month === 'string') months.set(m.month, (months.get(m.month) ?? 0) + num(m.hours));
+    }
+    const fresh = now - ms(r.updated_at) < PRESENCE_STALE_MS;
+    if (!fresh || !(num(r.agents_running) > 0)) continue;
+    agents += num(r.agents_running);
+    if (!lead || (ms(r.working_at) || 0) > (ms(lead.working_at) || 0)) lead = r;
+  }
+  const byMonth = [...months].sort(([a], [b]) => a.localeCompare(b)).map(([month, hours]) => ({ month, hours }));
+  return { agents, total, week, today, streak: streakOf([...days], now), byMonth, lead };
+}
+
+function workingOf({ profile, lead, teammate, cards }) {
+  const none = { workingOn: null, workingPrivate: false };
+  if (!lead) return none;
+  if (profile.show_working === 'none' || lead.working_private) return { workingOn: null, workingPrivate: true };
+  if (profile.show_working === 'everyone' && lead.working_on) return { workingOn: lead.working_on, workingPrivate: false };
+  // Running, and no name this viewer may read: it says Private thread.
+  const hidden = { workingOn: null, workingPrivate: true };
+  if (!teammate) return hidden;
+  const card = cards
+    .filter((c) => c.state === 'running' && c.visible !== false && c.title)
+    .sort((a, b) => num(b.updatedAt) - num(a.updatedAt))[0];
+  return card ? { workingOn: String(card.title).slice(0, WORKING_ON_MAX), workingPrivate: false } : hidden;
+}
+
+// One card per member with a profile, sorted by name so cards never jump.
+// Invisible people are already hidden from others by the cloud; my own
+// profile still reaches me, so I leave my own wall too. `mine` is what this
+// Mac knows I am working on, which my own card shows whatever others see.
+// `names` is the cloud's room_names for this room, or null on a cloud without
+// it: a member with no card at all is on the wall, named, as not on Rooms yet.
+// In a `listed` room, open to anyone, my own card shows me what strangers see.
+export function wallCards({ members = [], profiles = [], presence = [], teammates = [], teamCards = [], meId = null, now = Date.now(), mine = null, names = null, listed = false }) {
+  const inRoom = new Set(members);
+  const mates = new Set(teammates);
+  const out = [];
+  for (const p of profiles) {
+    if (!p?.person_id || !inRoom.has(p.person_id)) continue;
+    if (now < ms(p.invisible_until)) continue;
+    const id = p.person_id;
+    const s = sumPresence(presence.filter((r) => r.person_id === id), now);
+    const cards = teamCards.filter((c) => c.personId === id);
+    out.push({
+      id,
+      me: id === meId,
+      name: p.display_name || '',
+      avatarUrl: p.avatar_url ?? null,
+      headline: p.headline ?? null,
+      bio: p.bio ?? null,
+      // My own count is this Mac's, not the cloud's last word on it.
+      agents: p.show_agents === false ? null : id === meId && Number.isFinite(mine?.agents) ? mine.agents : s.agents,
+      level: p.show_level === false ? null : levelFor(s.total),
+      hoursTotal: s.total,
+      hoursWeek: s.week,
+      hoursToday: s.today,
+      streak: s.streak,
+      byMonth: s.byMonth,
+      teammate: mates.has(id) && id !== meId,
+      showActivity: p.show_activity !== false,
+      // A list of threads an older Mac still sends is read by nobody.
+      activity: null,
+      status: p.show_status !== false && p.status_text && !(ms(p.status_until) <= now) ? p.status_text : null,
+      ...(id === meId && mine ? ownWorking(mine, listed && p.show_working !== 'everyone')
+        : workingOf({ profile: p, lead: s.lead, teammate: mates.has(id) && id !== meId, cards })),
+    });
+  }
+  for (const n of names ?? []) {
+    if (n.has_card || !inRoom.has(n.person_id) || n.person_id === meId) continue;
+    out.push({
+      id: n.person_id, me: false, away: true, name: displayNameOf(n.name), avatarUrl: n.avatar_url ?? null, headline: null, bio: null,
+      agents: null, level: null, hoursTotal: 0, hoursWeek: 0, hoursToday: 0, streak: 0, byMonth: [],
+      teammate: mates.has(n.person_id), showActivity: false, activity: null, status: null, workingOn: null, workingPrivate: false,
+    });
+  }
+  return out.sort((a, b) => a.name.localeCompare(b.name) || a.id.localeCompare(b.id));
+}
+
+const ownWorking = (mine, hidden) => (hidden
+  ? { workingOn: null, workingPrivate: !!mine.workingOn }
+  : { workingOn: mine.workingOn ?? null, workingPrivate: false });
+
+const shortName = (item) => (String(item?.label ?? '').trim() || String(item?.title ?? '')).slice(0, WORKING_ON_MAX);
+
+// The presence row this Mac sends. `running` is the supervisor's running
+// sessions ({itemId, product, startedAt}); `summary` is summarizeRuns'.
+// A thread is named only when its project and its own word leave it to the
+// whole team, and only when I let everyone see it: realtime sends whole rows,
+// so a name on the row reaches everyone in my rooms.
+export function myPresence({ running = [], items = [], products = [], summary, now = Date.now(), showWorking = 'everyone' }) {
+  const lead = [...running].sort((a, b) => num(b.startedAt) - num(a.startedAt))[0];
+  let working_on = null;
+  let working_private = false;
+  if (lead && showWorking !== 'none') {
+    const item = items.find((i) => i.id === lead.itemId);
+    const product = products.find((p) => p.slug === (item?.product ?? lead.product));
+    const v = item ? visibilityOf(item, product) : 'private';
+    if (v !== undefined && v !== 'team') working_private = true;
+    else if (showWorking === 'everyone') working_on = shortName(item) || null;
+  }
+  return {
+    agents_running: running.length,
+    working_on,
+    working_private,
+    working_at: lead ? new Date(num(lead.startedAt) || now).toISOString() : null,
+    hours_total: round2(summary?.total),
+    hours_week: round2(summary?.week),
+    week_start: summary?.weekStart ?? localDate(now),
+    hours_today: round2(summary?.today),
+    day: summary?.day ?? localDate(now),
+    streak_days: summary?.streak ?? 0,
+    active_days: summary?.activeDays ?? [],
+    hours_by_month: summary?.byMonth ?? [],
+    // Never a list of threads: it reached everyone in my rooms.
+    activity: [],
+  };
+}
+
+const round2 = (v) => Math.round(num(v) * 100) / 100;
+
+// A switch turned off keeps that value off the cloud, so nobody can read it
+// from the row, a realtime event or an invite preview.
+export function withoutHidden(row, profile) {
+  const out = { ...row };
+  if (profile?.show_agents === false) out.agents_running = 0;
+  if (profile?.show_level === false) {
+    Object.assign(out, { hours_total: 0, hours_week: 0, hours_today: 0, streak_days: 0, active_days: [], hours_by_month: [] });
+  }
+  return out;
+}

package/shared/room-links.d.mts

@@ -0,0 +1,4 @@
+export const JOIN_SCHEME: string;
+export const JOIN_SITE: string;
+export function joinLink(token: string): string;
+export function tokenFromLink(text: unknown): string | null;

package/shared/room-links.mjs

@@ -0,0 +1,21 @@
+// A room's invite link (docs/team/ROOMS-PLAN.md, Joining): the web address
+// people share, and the app's own scheme that page opens.
+import { nameSlug } from './product-name.mjs';
+
+export const JOIN_SCHEME = nameSlug;
+export const JOIN_SITE = `https://${nameSlug}.ac/join/`;
+
+export const joinLink = (token) => `${JOIN_SITE}${token}`;
+
+/** Any link on the app's own scheme: a room invite, or Stripe's way back. */
+export const ourLink = (url) => typeof url === 'string' && url.startsWith(`${JOIN_SCHEME}://`);
+
+const TOKEN = /^[A-Za-z0-9_-]{16,64}$/;
+
+/** The token in a pasted link or a deep link, or the token itself; null for anything else. */
+export function tokenFromLink(text) {
+  const s = String(text ?? '').trim();
+  if (TOKEN.test(s)) return s;
+  const m = /^(?:https?:\/\/[^/\s]+\/join\/|[a-z][a-z0-9+.-]*:\/\/join\/)([A-Za-z0-9_-]+)\/?(?:[?#].*)?$/i.exec(s);
+  return m && TOKEN.test(m[1]) ? m[1] : null;
+}

package/shared/runs-on.d.mts

@@ -1,20 +1,10 @@
 export interface RunsOn {
-  /** 'claude' or 'codex', or null on a Mac where nothing is signed in. */
+  /** 'claude' or 'codex', or null on a computer where nothing is signed in. */
   engine?: string | null;
-  /**
-   * The plan in words, as the tool itself reports it: 'Max 20x', 'Pro'. Null
-   *  where the file could not be read, and then only the name is drawn. */
-  plan?: string | null;
 }
 
 /** The word for the plan behind an engine, or null for one we cannot name. */
 export declare function runsOnName(engine?: string | null): string | null;
 
-/** The glance line: 'Claude · Max 20x', or 'Claude' with no plan. Null for null. */
-export declare function runsOnLine(facts?: RunsOn): string | null;
-
-/** The whole sentence, for a hover and for a screen reader. Null for null. */
-export declare function runsOnTitle(facts?: RunsOn): string | null;
-
-/** The one line the walk says on a Mac that was already set up. Null for null. */
-export declare function foundOnThisMac(facts?: RunsOn): string | null;
+/** The one line the walk says where it was already set up. Null for null. */
+export declare function foundOnThisComputer(facts?: RunsOn): string | null;

package/shared/runs-on.mjs

@@ -1,30 +1,39 @@
-// WHAT THE AGENTS ARE RUNNING ON, IN WORDS.
+// THE ONE LINE SAYING IT FOUND AN ACCOUNT ALREADY ON THIS COMPUTER.
 //
-// From a session with a new user, 2026-10-07: "He didn't realize it
-// auto-connected to Claude/Codex; he wasn't sure how it was even running. Would
-// be nice to have some small indication."
+// From a session with a new user, 2026-10-07, in her words: a new user came in,
+// started running an agent, and was "like, 'Oh my God, where are the tokens
+// coming from? I didn't even connect my account.'"
 //
 // He was right that nothing said. The app finds whichever coding agent is
-// already signed in on the Mac and runs every worker on that subscription
+// already signed in on the computer and runs every worker on that subscription
 // (main/claude-plan.mjs, main/codex-account.mjs), and the walk is SILENT about
 // it by design: `needsPlan` in renderer/src/plan-setup.ts skips the plan
 // question entirely when one tool is found and signed in, which is the right
-// call and leaves nobody told. The only screen that has ever named the account
-// is Settings, two clicks in, and you have to suspect there is something to
-// look for before you go.
+// call and leaves nobody told.
+//
+// IT IS A ONE-TIME SURPRISE, SO IT GETS A ONE-TIME ANSWER. A row saying this
+// permanently, in the sidebar's foot, is what this file held first; it shipped
+// on 2026-10-07 and came out the same day. Her words: "we have to get rid of
+// this. It should never say that on the sidebar." Somebody asks where the
+// tokens are coming from ONCE, on their first day, so the place for the answer
+// is the walk they are standing in.
+//
+// AND IT NAMES NO PLAN. The row said "Claude · Max 20x" and that was the half
+// she wanted gone most: "very critically, I want to get rid of that Claude Max
+// 20x plan." The question being answered is "did it connect to something of
+// mine", not "what am I paying for", and the second one is already answered
+// properly on each agent's own page in Settings, where somebody goes when they
+// want it.
 //
 // THE PLAN'S VOCABULARY, NOT THE TOOL'S. "Claude" and "ChatGPT" here, never
 // "Claude Code" and "Codex", which is the rule the walk already follows
 // (renderer/src/plan-setup.ts: words people know, "never the names of the tools
-// underneath"). The fact being shown is WHOSE SUBSCRIPTION IS BEING SPENT, and
-// nobody pays for a CLI. The tool names stay where they belong: on a byline
-// about which agent is working a row (`engineWordFor`, renderer/src/byline.ts),
-// which is a different question with a different answer.
+// underneath"). The tool names stay where they belong: on a byline about which
+// agent is working a row (`engineWordFor`, renderer/src/byline.ts).
 //
-// NOTHING IS SAID UNTIL SOMETHING IS KNOWN. Every function here answers null on
-// an engine it cannot name, and the screens draw nothing at all for null rather
-// than "checking…" or a dash. A corner that says it does not know is worse than
-// a corner that says nothing: it spends the glance and answers no question.
+// NOTHING IS SAID UNTIL SOMETHING IS KNOWN. Both functions answer null on an
+// engine they cannot name, and the walk draws nothing at all for null rather
+// than "checking…" or a dash.
 
 /** The word for the plan behind an engine. Null for an engine we cannot name. */
 export function runsOnName(engine) {
@@ -34,46 +43,16 @@ export function runsOnName(engine) {
 }
 
 /**
- * THE LINE ON A GLANCE SURFACE. "Claude · Max 20x", or just "Claude" where the
- *  plan cannot be read.
- *
- *  The plan is the raw label the tool itself reports, already turned into words
- *  by whoever read it (`planLabel` in main/claude-plan.mjs for Claude, the
- *  named-plan table in main/codex-account.mjs for ChatGPT). It is never
- *  invented here: a plan nobody measured, printed confidently, is the app
- *  lying about what somebody is paying for.
- */
-export function runsOnLine({ engine = null, plan = null } = {}) {
-  const name = runsOnName(engine);
-  if (!name) return null;
-  const words = String(plan ?? '').trim();
-  return words ? `${name} · ${words}` : name;
-}
-
-/**
- * THE WHOLE SENTENCE, for a hover and for whatever reads the screen aloud. The
- *  glance surface carries two words and a plan; this is where the rest of the
- *  answer lives, and it is the half that tells a new person what they are
- *  looking at.
- */
-export function runsOnTitle({ engine = null, plan = null } = {}) {
-  const name = runsOnName(engine);
-  if (!name) return null;
-  const words = String(plan ?? '').trim();
-  const plansentence = words ? ` Your ${words} plan.` : '';
-  return `Your agents run on the ${name} account already signed in on this Mac.${plansentence}`;
-}
-
-/**
- * THE ONE LINE DURING THE WALK, on the Mac where there was nothing to ask.
+ * THE ONE LINE DURING THE WALK, on the computer where there was nothing to ask.
  *
  *  It replaces silence, not a question: somebody with no coding agent set up
  *  still gets the plan question and the setup card, and never sees this.
+ *
+ *  It says computer rather than Mac: Agentbox runs on Linux too, and one
+ *  sentence beats a branch, since "this computer" is true on a Mac as well.
  */
-export function foundOnThisMac({ engine = null, plan = null } = {}) {
+export function foundOnThisComputer({ engine = null } = {}) {
   const name = runsOnName(engine);
   if (!name) return null;
-  const words = String(plan ?? '').trim();
-  if (words) return `Your agents will run on the ${name} ${words} plan already signed in on this Mac.`;
-  return `Your agents will run on the ${name} account already signed in on this Mac.`;
+  return `Your agents will run on the ${name} account already signed in on this computer.`;
 }

package/shared/shipped-note.d.mts

@@ -0,0 +1,4 @@
+// Types for shared/shipped-note.mjs.
+
+export function shippedNote(sha?: string | null): string;
+export function isShippedNote(text: unknown): boolean;

package/shared/shipped-note.mjs

@@ -0,0 +1,6 @@
+// The note the app writes on a row once its ship lands (main/store.mjs), and
+// the one reader that has to know it is the app's and not an agent's
+// (renderer/src/format.ts, offerIsLive).
+export const shippedNote = (sha) => (sha ? `Shipped to main as ${sha}.` : 'Shipped to main.');
+
+export const isShippedNote = (text) => /^Shipped to main(?: as [0-9a-f]{7,40})?\.$/.test(String(text ?? '').trim());