agentbox-app 0.1.12 → 0.1.16

package/shared/terminal-focus.d.mts

@@ -0,0 +1 @@
+export function terminalKeys(options?: { startOpen?: boolean; wasOpen?: boolean }): { takesKeys(revision?: number): boolean; hidden(): void };

package/shared/terminal-focus.mjs

@@ -0,0 +1,13 @@
+// Whether a terminal takes the keyboard when TaskTerminal builds it. Opening
+// it, showing it again, Retry and New session do. Coming back to a thread that
+// left its terminal open does not: xterm's input is a textarea, and the app's
+// shortcuts stand aside for a textarea. `startOpen` is a page that is only a
+// terminal, which always takes it.
+// Pinned by tests/coming-back-to-an-open-terminal-leaves-the-keyboard-alone.test.mjs.
+export function terminalKeys({ startOpen = false, wasOpen = false } = {}) {
+  let cameBack = wasOpen === true && !startOpen;
+  return {
+    takesKeys: (revision = 0) => !cameBack || revision > 0,
+    hidden: () => { cameBack = false; },
+  };
+}

package/shared/terminal-input.d.mts

@@ -0,0 +1 @@
+export function inputQueue(send: (data: string) => Promise<unknown>, options?: { chunk?: number; onError?: (e: unknown) => void }): { push(data: string): void };

package/shared/terminal-input.mjs

@@ -0,0 +1,30 @@
+// KEYS TYPED WHILE ONE WRITE IS ON ITS WAY GO OUT TOGETHER, as the next write.
+//
+// The panel used to send every key as its own round trip to main, each one
+// waiting for the last, so holding Delete built a line of trips that drained
+// after she let go. Now the first key goes at once, and whatever she types
+// while it travels is one write behind it, in order. A paste still goes in
+// pieces main accepts (64 KB is its limit; `chunk` stays well under it).
+//
+// A write that fails (the shell exited) drops what was waiting behind it: those
+// keys were for a shell that is gone, and the failure is reported once.
+export function inputQueue(send, { chunk = 16384, onError } = {}) {
+  let queued = '', sending = false;
+  async function drain() {
+    if (sending) return;
+    sending = true;
+    try {
+      while (queued) {
+        const data = queued.slice(0, chunk);
+        queued = queued.slice(data.length);
+        await send(data);
+      }
+    } catch (e) {
+      queued = '';
+      onError?.(e);
+    } finally {
+      sending = false;
+    }
+  }
+  return { push(data) { queued += data; void drain(); } };
+}

package/shared/terminal-keys.d.mts

@@ -0,0 +1 @@
+export function optionWordKey(event: { type: string; key: string; altKey: boolean; ctrlKey: boolean; metaKey: boolean; shiftKey: boolean }, isMac: boolean): string | undefined;

package/shared/terminal-keys.mjs

@@ -0,0 +1,16 @@
+// OPTION+LEFT AND OPTION+RIGHT JUMP A WORD, as they do in Mac Terminal.
+// xterm 6 sends them as ESC[1;3D and ESC[1;3C, which zsh and bash do not bind,
+// so a shell typed `;3D` into the line instead. Mac Terminal sends ESC b and
+// ESC f, the backward-word and forward-word every shell already knows.
+//
+// Returns what to send for this key, '' to swallow the keyup of one we
+// handled, or undefined to leave the key to xterm. Off a Mac nothing changes:
+// Linux terminals send the same ESC[1;3D xterm does.
+const WORD = { ArrowLeft: '\x1bb', ArrowRight: '\x1bf' };
+
+export function optionWordKey(event, isMac) {
+  if (!isMac || !event.altKey || event.ctrlKey || event.metaKey || event.shiftKey) return undefined;
+  const sequence = WORD[event.key];
+  if (!sequence) return undefined;
+  return event.type === 'keydown' ? sequence : '';
+}

package/shared/terminal-size.d.mts

@@ -0,0 +1,4 @@
+export const SIZE_KEY: string;
+export const TERMINAL_MIN: { height: number; width: number };
+export function dragSize(dimension: 'height' | 'width', start: number, delta: number, room: number): number;
+export function readSavedSize(raw: string | null | undefined): { height?: number; width?: number };

package/shared/terminal-size.mjs

@@ -0,0 +1,29 @@
+// HOW BIG THE TERMINAL MAY BE DRAGGED (renderer/src/components/TaskTerminal.tsx).
+//
+// Small enough still shows a few lines; large enough still leaves the page it
+// sits in a strip to read (the thread's title and a line or two above it, or a
+// column of the conversation beside it). The size is one for the whole app,
+// remembered under SIZE_KEY, the way an editor remembers its panel.
+export const SIZE_KEY = 'zero.terminal.size';
+export const TERMINAL_MIN = { height: 120, width: 280 };
+const LEAVE = { height: 120, width: 320 };
+const LARGEST = 4000;
+
+/** `start` px, the edge moved `delta` px toward growing, in a pane `room` px across. */
+export function dragSize(dimension, start, delta, room) {
+  const min = TERMINAL_MIN[dimension];
+  const max = Math.max(min, room - LEAVE[dimension]);
+  return Math.round(Math.min(max, Math.max(min, start + delta)));
+}
+
+export function readSavedSize(raw) {
+  let saved;
+  try { saved = JSON.parse(raw ?? ''); } catch { return {}; }
+  if (!saved || typeof saved !== 'object' || Array.isArray(saved)) return {};
+  const out = {};
+  for (const dimension of ['height', 'width']) {
+    const v = saved[dimension];
+    if (Number.isFinite(v) && v >= TERMINAL_MIN[dimension] && v <= LARGEST) out[dimension] = v;
+  }
+  return out;
+}

package/shared/thread-cards.mjs

@@ -16,6 +16,8 @@
 //                private thread publishes no card at all (decided 2026-10-01
 //                from user research): not a wordless one, not a count.
 
+import { shownPriority } from './rank.mjs';
+
 export const THREAD_STATES = ['waiting', 'running', 'scheduled', 'done'];
 
 /** Which of the four states a thread is in. */
@@ -245,7 +247,8 @@ export function cardsFor({ products, readItems, now = Date.now(), since = null }
       // team. Never an empty list, which would have to mean both. Both clouds
       // carry it and refuse to show the card to anybody else.
       people: shownToPeople(item, product).length ? shownToPeople(item, product) : null,
-      state, priority: Number.isFinite(item.priority) ? item.priority : null,
+      // The level it runs at, so a teammate reads what the owner reads.
+      state, priority: shownPriority(item),
       problem: s.problem || null, progress: s.progress || null, solution: s.solution || null,
       blockedBy: linked(item.blockedBy), blocks: linked(item.blocks), updatedAt: item.updatedAt ?? now,
     });

package/shared/usage.d.mts

@@ -3,6 +3,9 @@
 // rule about which coding agent the corner is about, the zone primitives the
 // Claude reader is built on, and the words the panel prints.
 
+/** What a usage check that got nothing readable says, for any cause we have not named. */
+export const USAGE_UNREADABLE: string;
+
 export interface UsageLimit {
   span: 'session' | 'week';
   qualifier: string | null;
@@ -39,8 +42,17 @@ export declare function sessionLimit(limits: UsageLimit[] | null | undefined): U
 export declare function headlineLimit(limits: UsageLimit[] | null | undefined): UsageLimit | null;
 export declare const ANY_MOMENT: string;
 export declare function spanLeft(ms: number): string;
+export declare const toMinute: (at: number) => number;
+export declare function resetDay(at: number, now?: number): string | null;
 export declare function untilReset(ms: number): string;
 
+/** The windows a reading can still answer for: one whose reset has gone past
+ *  measures a window nobody is in any more. */
+export declare function limitsStillRunning(
+  limits: UsageLimit[] | null | undefined,
+  now?: number,
+): UsageLimit[];
+
 export declare function limitRows(
   limits: UsageLimit[] | null | undefined,
   now?: number,

package/shared/usage.mjs

@@ -33,6 +33,13 @@ import { DEFAULT_ENGINE } from './engines.mjs';
 
 /* ------------------ WHICH CODING AGENT THE CORNER IS ABOUT ---------------- */
 
+// WHAT A USAGE CHECK THAT GOT NOTHING READABLE SAYS, for every reason we have
+// not named. It used to be "Could not refresh usage. Try again.", which reads
+// as the app having broken; the measured case (2026-10-11) was an account whose
+// subscription had ended, and Claude Code simply printed no limits for it. So
+// it points at the account, which is where an unnamed cause almost always is.
+export const USAGE_UNREADABLE = "Claude Code didn't report usage for this account. Check that its plan is active at claude.ai.";
+
 /**
  * THE AGENT MOST OF HER LIVE WORK IS ON, or the workspace's own when nothing is
  * running and when the fleet is level.
@@ -227,6 +234,51 @@ export function spanLeft(ms) {
   return `${hours}h ${minutes % 60}m`;
 }
 
+/**
+ * HOW LONG A WINDOW GOES ON BEING DRAWN AFTER ITS RESET, so a countdown
+ *  crossing zero does not flicker out of the panel a minute before the next
+ *  reading lands. Inside it "any moment" is what it says: the reset is here.
+ */
+const JUST_RESET_MS = 2 * 60_000;
+
+/**
+ * THE WINDOWS A READING CAN STILL ANSWER FOR (w-7b7182ef61).
+ *
+ * A window whose reset has gone past is over, and the one running in its place
+ * has never been read. shared/codex-usage.mjs already holds the rule for that:
+ * absence of data and a real zero are different facts and must never look the
+ * same. So it is DROPPED rather than relabelled -- no wording makes a
+ * percentage about a window nobody is in worth reading -- and the corner falls
+ * back to whatever the reading can still answer for (`headlineLimit`).
+ *
+ * A RESET WE COULD NOT PLACE ON A CLOCK KEEPS ITS ROW. `resetsAt` is null
+ * whenever Claude Code printed its stamp in a timezone we could not honestly
+ * convert, and a limit we cannot time is not a limit we may call finished.
+ */
+export function limitsStillRunning(limits, now = Date.now()) {
+  return (limits ?? []).filter((l) => !Number.isFinite(l?.resetsAt) || l.resetsAt + JUST_RESET_MS > now);
+}
+
+/**
+ * A reset to the nearest minute. Claude Code gives one a moment before the
+ * minute (11:59:59.6) and the cloud's header the minute itself, and both name
+ * the same reset.
+ */
+export const toMinute = (at) => Math.round(at / 60_000) * 60_000;
+
+/**
+ * THE DAY A RESET FALLS ON, in this machine's calendar: null today, "Thu" this
+ * week, and "Tue Oct 27" six or more days out, where a weekday alone would
+ * read as today.
+ */
+export function resetDay(at, now = Date.now()) {
+  const d = new Date(toMinute(at));
+  if (d.toDateString() === new Date(now).toDateString()) return null;
+  const weekday = d.toLocaleDateString('en-US', { weekday: 'short' });
+  if (at - now < 6 * 86_400_000) return weekday;
+  return `${weekday} ${d.toLocaleDateString('en-US', { month: 'short', day: 'numeric' })}`;
+}
+
 /* -------------------------------- the panel ------------------------------- */
 
 /**
@@ -274,7 +326,7 @@ export function spanLeft(ms) {
  */
 export function limitRows(limits, now = Date.now()) {
   const here = localZone();
-  return (limits ?? []).map((l) => ({
+  return limitsStillRunning(limits, now).map((l) => ({
     // Stable across redraws, and it has to carry the qualifier: Claude Code's
     // two week rows are otherwise the same string.
     key: `${l.span}:${l.qualifier ?? ''}`,
@@ -309,8 +361,9 @@ function whenItStartsOver(l, now, here) {
  * 2026-09-01.
  */
 export function usageSentence(limits, now = Date.now(), engineWord = null) {
-  if (!limits?.length) return null;
-  const said = limits.map((l) => {
+  const live = limitsStillRunning(limits, now);
+  if (!live.length) return null;
+  const said = live.map((l) => {
     const when = l.resetsAt ? `, ${untilReset(l.resetsAt - now)}` : l.resetsText ? `, resets ${l.resetsText}` : '';
     return `${l.name}: ${l.percent}% used${when}.`;
   }).join(' ');

package/shared/websites.d.mts

@@ -0,0 +1,15 @@
+// Types for shared/websites.mjs, the rules the main process and the screen
+// share about a page off the open web: which addresses are one, what the
+// pane's header calls it, and where its sign-ins go.
+
+/** The session partition a website's cookies and sign-ins live in. */
+export const WEBSITE_PARTITION: string;
+
+/** Is this an ordinary page on the web, rather than a local app or a file? */
+export function isWebsiteAddress(src: string | undefined | null): boolean;
+
+/** What an address typed into the pane's bar means, with its scheme, or null. */
+export function addressYouTyped(typed: string | undefined | null): string | null;
+
+/** Can this page embed a website in a browser of its own (Electron only)? */
+export function canFrameAWebsite(doc: { createElement(tag: string): unknown } | null | undefined): boolean;

package/shared/websites.mjs

@@ -0,0 +1,61 @@
+// PURE. What counts as a website, and where its sign-ins live. Shared because
+// the main process pins what an embedded page may do and the screen decides
+// what to draw, and the two must agree.
+//
+// A local address is NOT a website here. A dev server is drawn in an ordinary
+// frame with a liveness check in front of it (renderer/src/local-preview.ts)
+// and its framing headers rewritten below the page (main/local-app-frames.mjs);
+// none of that applies to a site on the web.
+
+/**
+ * The store a website's cookies and sign-ins go into. Not `persist:junk`:
+ * that one is safe for an agent to drive precisely because it carries
+ * nothing, and a person may sign into a page here.
+ */
+export const WEBSITE_PARTITION = 'persist:websites';
+
+const LOOPBACK = new Set(['localhost', '127.0.0.1', '[::1]', '::1']);
+
+/** Is this an ordinary page on the web, the kind the pane opens in a browser? */
+export function isWebsiteAddress(src) {
+  if (typeof src !== 'string' || !src) return false;
+  try {
+    const url = new URL(src);
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') return false;
+    return !LOOPBACK.has(url.hostname);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * What an address typed into the pane's bar means: a page on the web or a
+ * local app, with the scheme a browser would add, or null. Never a search,
+ * which would send what you typed to somebody else.
+ */
+export function addressYouTyped(typed) {
+  const text = typeof typed === 'string' ? typed.trim() : '';
+  if (!text || /\s/.test(text)) return null;
+  const hasScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(text);
+  const bareHost = text.split(/[/?#]/)[0].replace(/:\d+$/, '').toLowerCase();
+  const full = hasScheme ? text : `${LOOPBACK.has(bareHost) ? 'http' : 'https'}://${text}`;
+  let url;
+  try { url = new URL(full); } catch { return null; }
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') return null;
+  if (url.username || url.password) return null;
+  if (!LOOPBACK.has(url.hostname) && !url.hostname.includes('.')) return null;
+  return url.href;
+}
+
+/**
+ * Can this page embed a website in a browser of its own? Only the desktop
+ * window can: `<webview>` is Electron's, and nothing registers the tag in an
+ * ordinary tab or on a phone. Asking the tag beats guessing which door this is.
+ */
+export function canFrameAWebsite(doc) {
+  try {
+    return !!doc && 'partition' in doc.createElement('webview');
+  } catch {
+    return false;
+  }
+}

package/shared/where-it-runs-from.d.mts

@@ -0,0 +1,43 @@
+// Types for shared/where-it-runs-from.mjs, which is plain ESM so that main
+// (Node) and the screen (Vite) share one copy of the rule about whether this
+// copy of the app can update itself from where it is, and one copy of the
+// words that say so. The screen asks for the words and `sayWhere`; the places
+// and the move are main's.
+
+/** The place a copy of the app is in, as far as updating itself is concerned. */
+export type AppPlace =
+  | 'disk-image' | 'translocated' | 'applications' | 'elsewhere' | 'source' | 'not-mac';
+
+export const PLACE: {
+  diskImage: 'disk-image';
+  translocated: 'translocated';
+  applications: 'applications';
+  elsewhere: 'elsewhere';
+  source: 'source';
+  notMac: 'not-mac';
+};
+
+export const MOVE_SAY: {
+  cannotUpdateHere: string;
+  button: string;
+  title: string;
+  where: Record<string, string>;
+  shortWhere: Record<string, string>;
+  fix: string;
+  retry: string;
+};
+
+/** The sentence for a place, or null where there is nothing to say. */
+export function sayWhere(place: string | null | undefined, how?: { short?: boolean }): string | null;
+
+export function placeOfApp(facts?: {
+  platform?: string;
+  packaged?: boolean;
+  exePath?: string | null;
+  inApplications?: boolean;
+}): { place: AppPlace; canUpdate: boolean; offerMove: boolean };
+
+export function createPlace(host: { app: unknown; log?: unknown }): {
+  state(): { place: AppPlace; canUpdate: boolean; offerMove: boolean };
+  move(): { moved: boolean; error: string | null };
+};

package/shared/where-it-runs-from.mjs

@@ -0,0 +1,155 @@
+// AN APP IN THE WRONG PLACE CAN NEVER UPDATE ITSELF, AND NEVER SAID SO.
+//
+// macOS has two places it will happily run Agentbox from and never let it
+// replace itself:
+//
+//   THE DISK IMAGE. You double-click the .dmg, you double-click the app
+//   inside it, and it works. The volume is read-only, so Squirrel.Mac refuses
+//   the swap with "Cannot update while running on a read-only volume".
+//
+//   A TRANSLOCATED COPY. You drag the app to Downloads and open it. Because
+//   it still carries the quarantine flag and is not in Applications, macOS
+//   runs it from a read-only copy it makes under
+//   `/private/var/folders/…/AppTranslocation/<uuid>/d/`. Same refusal, and
+//   this is why Squirrel's own sentence talks about the Downloads directory.
+//
+// Measured in PostHog on 2026-10-12: 23 crash reports over three weeks, two
+// installs, both on 0.1.11, one report every six hours (`EVERY_MS` in
+// main/updater.mjs) for as long as the app was open. The reports stopped being
+// filed as crashes in 292d419. The two Macs are still on 0.1.11.
+//
+// SO THE APP READS WHERE IT IS AND OFFERS THE ONE PRESS THAT FIXES IT. Electron
+// has had `moveToApplicationsFolder` since 4: it moves the bundle, replaces an
+// older copy if you say so, and relaunches from the new place. After that the
+// ordinary six-hourly check works and the person never thinks about it again.
+//
+// EVERYTHING HERE IS A FACT AND NOT A GUESS, which is why the decision is a
+// pure function with the four facts passed in: a wrong "you are in the wrong
+// place" is a nag on a healthy install, and two of those are worse than the
+// silence this replaces.
+
+import { Name } from './product-name.mjs';
+
+// THE WORDS, IN ONE PLACE, and main and the renderer both read them from here.
+// `cannotUpdateHere` is the sentence `shortError` in main/updater.mjs puts in
+// place of Squirrel's own paragraph, which is 240 characters with a URL in the
+// middle and was arriving on the Settings row cut off at 160.
+//
+// Every sentence says where the app is and what one press does about it, and
+// none of them says "read-only volume": that is the mechanism, and nobody
+// holding the Mac asked about the mechanism.
+export const MOVE_SAY = {
+  cannotUpdateHere: `${Name} cannot update itself from where it is.`,
+  button: 'Move to Applications',
+  /** The sidebar card's heading. */
+  title: 'Updates are stuck',
+  /** What the place is, as a person would say it. */
+  where: {
+    'disk-image': `${Name} is running from the disk image it was downloaded in.`,
+    translocated: `${Name} is running from a read-only copy macOS made of it.`,
+  },
+  /** The same fact in half the words, for the sidebar card, which is one
+   *  column wide and had the row's sentence running to six lines in it. */
+  shortWhere: {
+    'disk-image': `${Name} can’t update itself from the disk image.`,
+    translocated: `${Name} can’t update itself from the copy macOS made.`,
+  },
+  /** And the press, which is the same either way. */
+  fix: 'Moving it to your Applications folder takes a few seconds and gets updates working again.',
+  retry: 'Pressing it again tries again.',
+};
+
+/** The sentence for a place, or null where there is nothing to say. `short` is
+ *  the sidebar card's half of it: the button beside it already says the fix. */
+export function sayWhere(place, { short = false } = {}) {
+  const words = short ? MOVE_SAY.shortWhere : MOVE_SAY.where;
+  return words[place] ?? null;
+}
+
+/** Where a copy of the app can be, as far as updating itself is concerned. */
+export const PLACE = {
+  /** Run out of the mounted .dmg. Read-only; cannot update. */
+  diskImage: 'disk-image',
+  /** macOS is running a read-only copy of its own. Cannot update. */
+  translocated: 'translocated',
+  /** Where it belongs. */
+  applications: 'applications',
+  /** Somewhere writable that is not Applications: updates itself fine. */
+  elsewhere: 'elsewhere',
+  /** `npm start` from a checkout: main/source-updater.mjs, nothing to move. */
+  source: 'source',
+  /** No Applications folder and no `moveToApplicationsFolder`. */
+  notMac: 'not-mac',
+};
+
+// The folder macOS puts a translocated copy in. The path is always under
+// `/private/var/folders`, but the one segment that names the mechanism is this
+// one, and it is the only part Apple has kept stable. Written with "/" and
+// not `path.sep`: these are only ever read on a Mac (`placeOfApp` returns
+// before them anywhere else), and the screen imports this file, so it may not
+// import anything from Node.
+const TRANSLOCATED = '/AppTranslocation/';
+// Every mounted volume lives here, including the disk image the download is.
+const VOLUMES = '/Volumes/';
+
+/**
+ * PURE. The whole decision, off four facts, so every case can be tested
+ * without a packaged app, a disk image, or a Mac.
+ *
+ * `exePath` is `app.getPath('exe')`, the binary inside the bundle;
+ * `inApplications` is Electron's own `app.isInApplicationsFolder()`, which
+ * knows about `~/Applications` as well as `/Applications` and is therefore
+ * never re-derived from the path here.
+ */
+export function placeOfApp({ platform, packaged, exePath, inApplications } = {}) {
+  const no = (place) => ({ place, canUpdate: true, offerMove: false });
+  if (platform !== 'darwin') return no(PLACE.notMac);
+  if (!packaged) return no(PLACE.source);
+  if (inApplications) return no(PLACE.applications);
+  if (typeof exePath !== 'string' || !exePath) return no(PLACE.elsewhere);
+  const where = exePath.includes(TRANSLOCATED) ? PLACE.translocated
+    : exePath.startsWith(VOLUMES) ? PLACE.diskImage
+    : null;
+  // THE PLACES THAT ARE NOT APPLICATIONS AND UPDATE THEMSELVES ANYWAY are left
+  // alone on purpose. A copy sitting in Downloads that macOS did not
+  // translocate is on a writable disk and Squirrel swaps it happily; offering
+  // to move it would be the app asking for something it does not need.
+  if (!where) return no(PLACE.elsewhere);
+  return { place: where, canUpdate: false, offerMove: true };
+}
+
+/**
+ * The live one, over Electron's `app`. Read ONCE, at construction: the bundle
+ * cannot move under a running process except by the move below, which
+ * relaunches.
+ */
+export function createPlace({ app, log = console }) {
+  const where = placeOfApp({
+    platform: app?.platform ?? process.platform,
+    packaged: !!app?.isPackaged,
+    exePath: (() => { try { return app?.getPath?.('exe') ?? null; } catch { return null; } })(),
+    inApplications: (() => { try { return !!app?.isInApplicationsFolder?.(); } catch { return false; } })(),
+  });
+
+  return {
+    state: () => ({ ...where }),
+
+    /**
+     * THE PRESS. Electron moves the bundle and relaunches, so nothing after a
+     * `true` here ever runs. It answers false when the person cancels its own
+     * "a copy is already there" box, which is an answer and not a failure.
+     */
+    move() {
+      if (!where.offerMove) return { moved: false, error: null };
+      try {
+        const moved = !!app.moveToApplicationsFolder();
+        return { moved, error: null };
+      } catch (e) {
+        // One line, because Settings shows this string to a person.
+        const error = String(e?.message ?? e ?? 'The move did not work.').split('\n')[0].trim();
+        log.warn?.('[place] could not move the app into Applications:', error);
+        return { moved: false, error };
+      }
+    },
+  };
+}