agentbox-app 0.1.12 → 0.1.16

package/main/quit-sequence.mjs

@@ -0,0 +1,143 @@
+// THE WAY OUT, AND NOTHING ON IT MAY KILL THE APP (w-60c8ddbab6, 2026-10-15).
+//
+// Quitting used to be six bare `app.on('before-quit', ...)` listeners and one
+// `will-quit` that started the analytics flush and did not wait for it. Both
+// halves of that cost us the end of every session.
+//
+// ONE STEP THAT THROWS ENDED THE WHOLE QUIT. On 0.1.13 the phone step did:
+// closing the main window nulls `window`, and `phone.close()` makes the relay
+// report the change back to a handler that asked the window whether it was
+// destroyed (main/main.mjs, the `zero:phone-changed` line). An EventEmitter
+// stops calling listeners at the first one that throws, `main/crash-report.mjs`
+// rethrows an uncaught main error on purpose, and the process then dies
+// fatally. Measured on an Electron harness: `updater.stop()` never ran,
+// `will-quit` never fired, `analytics.flush()` never ran, and `quit` never
+// came. The window's own guard is fixed where it lives, but the shape was the
+// real fault: a quit built so that any one step can swallow the rest is a quit
+// that will do this again for some other reason.
+//
+// AND THE FLUSH WAS FIRE AND FORGET. `will-quit` without `preventDefault` means
+// the process goes as soon as the listeners return, so a batch handed to
+// `posthog-node` a moment earlier is a POST that never leaves. Measured the
+// same way: the flush resolved AFTER `process.on('exit')` had already run, and
+// it only resolved at all because the harness's destination was in the same
+// process. Against us.i.posthog.com it is a race the app loses.
+//
+// WHICH MATTERS BECAUSE THE END OF A SESSION IS WHAT WE READ RETENTION FROM.
+// Of the fourteen installs that arrived on 0.1.13 or 0.1.14, thirteen opened
+// the app once and never opened it again (PostHog, 2026-10-15), so for thirteen
+// of fourteen people the batch dropped here is the LAST thing we would ever
+// have heard, and the crash report explaining it is still sitting on their disk
+// waiting for a launch that is not coming.
+
+/** How long the quit is held open for the last batch of counts, and no longer. */
+export const FLUSH_DEADLINE_MS = 2000;
+
+/**
+ * How long a quit we asked for is given before the process is ended outright.
+ *  Longer than the flush above on purpose: a quit holding itself open for the
+ *  last counts is a quit that is working. */
+export const EXIT_DEADLINE_MS = 8000;
+
+/**
+ * How long the second ask gets, once the counts are out and there is nothing
+ *  left to wait for. On Linux a quit asked for with a window still open — the
+ *  menu's Quit, the tray's Quit — ignores it outright
+ *  (tests/a-quit-held-for-the-last-counts-still-ends-the-app), and by then the
+ *  window is gone and there is nothing left to show anybody. */
+export const SECOND_QUIT_DEADLINE_MS = 2000;
+
+/**
+ * A STEP ON THE WAY OUT, which runs once and cannot throw.
+ *
+ *  `name` is in the warning rather than in a comment, because the one thing
+ *  somebody reading a log needs to know is which step gave up. A swallow with
+ *  nothing said is how this bug lived through three releases.
+ *
+ *  ONCE, not once per `app.quit()`. Holding the quit for the flush below means
+ *  calling `app.quit()` a second time, which emits `before-quit` again, and a
+ *  `killAll` or a `close` run twice is at best wasted and at worst a second
+ *  teardown of something already gone.
+ */
+export function quitStep(app, event, name, fn, { log = console } = {}) {
+  let ran = false;
+  app.on(event, () => {
+    if (ran) return;
+    ran = true;
+    try {
+      fn();
+    } catch (err) {
+      // Never rethrown: the app is on its way out and every step after this one
+      // still has to happen.
+      log?.warn?.(`zero: ${name} failed while quitting: ${err?.message ?? err}`);
+    }
+  });
+}
+
+/**
+ * HOLD THE QUIT OPEN FOR THE LAST BATCH OF COUNTS.
+ *
+ *  Three things it will not do, each of them a way a quit becomes a hang:
+ *
+ *   - It will not wait past `FLUSH_DEADLINE_MS`. A machine with no network, or
+ *     a destination that accepts the connection and never answers, must cost
+ *     somebody two seconds on the way out and not their afternoon.
+ *   - It will not care whether the flush worked. There is nothing to be done
+ *     about a flush that failed, and a count is never worth a quit.
+ *   - It will not hold twice. `will-quit` comes round again when we ask again,
+ *     and holding that one too is a quit that never happens.
+ *   - It will not trust the second ask either. On Linux, a quit that began with
+ *     a window open ignores it and the process stays for ever, which is what
+ *     `quitThenExit` is for
+ *     (tests/a-quit-held-for-the-last-counts-still-ends-the-app).
+ */
+export function flushBeforeQuit(app, flush, { deadlineMs = FLUSH_DEADLINE_MS, log = console } = {}) {
+  let held = false;
+  app.on('will-quit', (event) => {
+    if (held) return;          // the second time round is the one we asked for
+    held = true;
+    event?.preventDefault?.();
+    let gone = false;
+    const go = () => {
+      if (gone) return;
+      gone = true;
+      clearTimeout(timer);
+      quitThenExit(app, { what: 'the last counts', deadlineMs: SECOND_QUIT_DEADLINE_MS, log });
+    };
+    const timer = setTimeout(go, deadlineMs);
+    // The deadline is armed before the flush is even called, so a `flush` that
+    // throws synchronously is covered by the same promise as one that rejects.
+    Promise.resolve()
+      .then(() => flush())
+      .catch((err) => { log?.warn?.(`zero: the last counts did not get out: ${err?.message ?? err}`); })
+      .then(go, go);
+  });
+}
+
+/**
+ * ASK TO QUIT, AND GO ANYWAY IF THE QUIT DOES NOT COME.
+ *
+ *  `app.quit()` only asks, and on Linux an app that has already refused one
+ *  `will-quit` ignores every ask after it: the measurement is in
+ *  tests/a-quit-held-for-the-last-counts-still-ends-the-app. It is still asked,
+ *  because that is what runs the quit steps, lets the workers go and fires
+ *  `quit` for whoever is listening, and the deadline ends the process when the
+ *  quit has not.
+ *
+ *  Both callers pass a deadline that suits what they are waiting for: a
+ *  screenshot run has a whole quit ahead of it, the flush above has nothing
+ *  left but the `quit` event. The timer is unreffed: an app with nothing left
+ *  to do must not be kept alive by the thing watching it. */
+export function quitThenExit(app, { what = 'this run', deadlineMs = EXIT_DEADLINE_MS, log = console } = {}) {
+  let over = false;
+  const timer = setTimeout(() => {
+    if (over) return;
+    over = true;
+    log?.warn?.(`zero: ${what} asked the app to quit ${deadlineMs} ms ago and it is still here, so it is ending now`);
+    app.exit(0);
+  }, deadlineMs);
+  timer.unref?.();
+  app.once?.('quit', () => { over = true; clearTimeout(timer); });
+  app.quit();
+  return timer;
+}

package/main/refresh-agent-models.mjs

@@ -4,11 +4,24 @@ import {rememberCodexModels} from './codex-models.mjs';
 import {forget,claudeModels} from './claude-models.mjs';
 import {terminalEnv} from './task-terminals.mjs';
 import {codexLaunchEnv} from './codex-launch-env.mjs';
-export async function refreshAgentModels(engine,config,home){
+import {ensureCodexHome} from './codex-account.mjs';
+// `homes` is every Codex login to ask, one after another. A login that cannot
+// answer keeps its last list and does not cost the others theirs; only all of
+// them failing is an error.
+export async function refreshAgentModels(engine,config,homes,{open=home=>openAppServer(config,home)}={}){
  if(engine==='claude'){forget();claudeModels({bin:config.claudeBin});return;}
  // Codex is optional and codexBin is null without it: nothing to ask, and spawn(null) only threw into the terminal.
  if(!config.codexBin)return;
- const client=createCodexAppServer({spawn:()=>spawn(config.codexBin,['app-server'],{cwd:config.home,env:codexLaunchEnv(config.codexBin,{...terminalEnv(),CODEX_HOME:home}),stdio:['pipe','pipe','pipe']}),requestTimeoutMs:10000});
+ const list=[...new Set([homes].flat().filter(Boolean))];const errors=[];
+ for(const home of list){try{await refreshOne(open(home),home);}catch(error){errors.push(error);}}
+ if(list.length&&errors.length===list.length)throw errors[0];
+}
+function openAppServer(config,home){
+ // codex-cli refuses a CODEX_HOME that does not exist rather than making it.
+ ensureCodexHome(home);
+ return createCodexAppServer({spawn:()=>spawn(config.codexBin,['app-server'],{cwd:config.home,env:codexLaunchEnv(config.codexBin,{...terminalEnv(),CODEX_HOME:home}),stdio:['pipe','pipe','pipe']}),requestTimeoutMs:10000});
+}
+async function refreshOne(client,home){
  const deadline=setTimeout(()=>client.close('Model refresh timed out'),15000);
  try{
   await client.initialize();let cursor=null;const models=[];const seen=new Set();

package/main/relay-address.mjs

@@ -0,0 +1,28 @@
+// WHICH RELAY THIS MAC USES (tests/the-mac-finds-the-relay-the-deploy-wrote-down).
+// AGENTBOX_RELAY_URL first, for trying one by hand; then the address
+// `npm run relay:deploy` wrote to relay/relay.local.json; then the one built
+// into the app, which is empty until a deployed address is committed.
+import fs from 'node:fs';
+import path from 'node:path';
+import { RELAY_URL } from '../shared/relay-address.mjs';
+
+function usable(url) {
+  if (typeof url !== 'string' || !url) return null;
+  let u;
+  try { u = new URL(url); } catch { return null; }
+  const local = u.hostname === 'localhost' || u.hostname === '127.0.0.1';
+  if (u.protocol !== 'https:' && !(u.protocol === 'http:' && local)) return null;
+  return url.replace(/\/+$/, '');
+}
+
+export function relayAddress({ env = process.env, appDir } = {}) {
+  const byHand = usable(env.AGENTBOX_RELAY_URL);
+  if (byHand) return byHand;
+  if (appDir) {
+    try {
+      const deployed = usable(JSON.parse(fs.readFileSync(path.join(appDir, 'relay', 'relay.local.json'), 'utf8'))?.url);
+      if (deployed) return deployed;
+    } catch { /* not deployed from this folder */ }
+  }
+  return usable(RELAY_URL) ?? RELAY_URL;
+}

package/main/relay-client.mjs

@@ -0,0 +1,314 @@
+// THE MAC'S END OF THE RELAY (relay/worker.mjs is the middle, relay/phone/ the
+// far end). With phones let in from "Anywhere", the Mac holds one socket open
+// out to the relay, so nothing has to reach in to it: no port opened, no
+// router touched, nothing installed on the phone.
+//
+// Each request that arrives is opened with the key only the Mac and the phone
+// have (shared/relay-crypto.mjs), checked for a replay, and then asked of this
+// Mac's own phone server on 127.0.0.1, exactly as a phone on the Wi-Fi would
+// ask it. So the token, the files and every channel are guarded by the same
+// code either way. The answer goes back sealed, a frame at a time, so the
+// live event stream and a large picture both work.
+import {
+  relayIds, relayKeys, open, seal, unpackRequest, FRAME, frameAad, TO_MAC, FROM_MAC, ID_BYTES, tag,
+} from '../shared/relay-crypto.mjs';
+
+/** How far a phone's clock may be from this Mac's before a request is stale. */
+const SKEW_MS = 5 * 60_000;
+/** One sealed frame's most. Cloudflare takes up to 1MB per socket message. */
+const CHUNK = 256 * 1024;
+/** The most one request may carry, as the relay allows (relay/worker.mjs). */
+const MAX_REQUEST = 32 * 1024 * 1024;
+/** What a phone's request may carry on to the phone server. */
+const PASS = ['accept', 'content-type', 'range', 'user-agent', 'if-none-match', 'x-agentbox-token', 'x-agentbox-device'];
+/**
+ * How often a slow answer says "still working" (FRAME.WAIT), well inside the
+ * 30 s the room gives a Mac to start answering (relay/room.mjs).
+ */
+const WAIT_MS = 10_000;
+/**
+ * THE LINK IS CHECKED, NOT TRUSTED (tests/the-computer-notices-a-dead-relay-link-and-reconnects).
+ * A socket that carries nothing cannot tell this end it has died: a laptop that
+ * slept or changed networks kept one it believed open while the relay had let
+ * it go, and phones were told the computer was not connected. So this end says
+ * "ping" this often and the relay answers "pong" without waking the room.
+ */
+export const PING_MS = 25_000;
+/** How long past a ping's turn a missing pong is allowed before the link is called dead. */
+export const PONG_GRACE_MS = 10_000;
+/** What the platform sends as text on the socket. Never a request: those are bytes. */
+const PING = 'ping';
+const PONG = 'pong';
+/** What the phone does not want back: the relay's stream is its own framing. */
+const DROP = new Set(['connection', 'keep-alive', 'transfer-encoding', 'content-length', 'content-encoding']);
+
+const enc = new TextEncoder();
+const hex = (bytes) => Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+
+export function createRelayClient({
+  relayUrl, key, port, WebSocketImpl = globalThis.WebSocket, fetchImpl = (...a) => globalThis.fetch(...a),
+  log = console, onChange = () => {}, waitMs = WAIT_MS, pingMs = PING_MS, graceMs = PONG_GRACE_MS,
+}) {
+  let ws = null;
+  let pinger = null;
+  /** When the relay last answered a ping on this link; null until it ever has. */
+  let ponged = null;
+  /** When the ping timer last ran, to tell a sleep from a slow tick. */
+  let ticked = 0;
+  let want = false;
+  let connected = false;
+  let error = null;
+  let retry = 1000;
+  let timer = null;
+  let gen = 0;
+  let forKey = null;
+  let ids = null;
+  let keys = null;
+  /** Requests answered lately, by nonce, so a recorded one sent again is refused. */
+  const answered = new Map();
+  /** Answers being sent, so a phone that gives up stops them. */
+  const live = new Map();
+  /** Pieces of requests too big for one message, until their last piece. */
+  const parts = new Map();
+
+  async function ready() {
+    const k = key();
+    if (k === forKey) return;
+    ids = await relayIds(k);
+    keys = await relayKeys(k);
+    forKey = k;
+    answered.clear();
+  }
+
+  function fresh(head) {
+    const now = Date.now();
+    for (const [n, at] of answered) if (now - at > 2 * SKEW_MS) answered.delete(n);
+    if (typeof head?.nonce !== 'string' || head.nonce.length < 16) return false;
+    if (!Number.isFinite(head.ts) || Math.abs(now - head.ts) > SKEW_MS) return false;
+    if (answered.has(head.nonce)) return false;
+    answered.set(head.nonce, now);
+    return true;
+  }
+
+  const send = (sock, bytes) => { try { sock.send(bytes); } catch { /* the socket went; the phone hears from the relay */ } };
+
+  async function answer(sock, id, sealed) {
+    const k = keys;
+    let head;
+    let body;
+    try {
+      ({ head, body } = unpackRequest(await open(k.up, sealed, 'req')));
+    } catch {
+      send(sock, tag(FROM_MAC.REFUSED, id));
+      return;
+    }
+    if (!fresh(head) || typeof head.path !== 'string' || !head.path.startsWith('/')) {
+      send(sock, tag(FROM_MAC.REFUSED, id));
+      return;
+    }
+    const ctl = new AbortController();
+    const idh = hex(id);
+    live.set(idh, ctl);
+    let seq = 0;
+    // One at a time, in order: each frame's number is sealed into it, and a
+    // "still working" frame from the timer must not overtake the head.
+    let queue = Promise.resolve();
+    const frame = (type, payload) => (queue = queue.then(async () => {
+      const plain = new Uint8Array(1 + payload.length);
+      plain[0] = type;
+      plain.set(payload, 1);
+      send(sock, tag(FROM_MAC.FRAME, id, await seal(k.down, plain, frameAad(head.nonce, seq++))));
+    }));
+    // Until the answer starts, a phone that asked for it hears "still working".
+    let waiting = head.wait ? setInterval(() => { frame(FRAME.WAIT, new Uint8Array(0)).catch(() => {}); }, waitMs) : null;
+    const answering = () => { if (waiting) clearInterval(waiting); waiting = null; };
+    let sentHead = false;
+    try {
+      const headers = { 'x-agentbox-relay': '1', 'x-forwarded-for': 'relay' };
+      for (const name of PASS) if (head.headers?.[name]) headers[name] = String(head.headers[name]);
+      const method = String(head.method || 'GET').toUpperCase();
+      const res = await fetchImpl(`http://127.0.0.1:${port()}${head.path}`, {
+        method, headers, body: method === 'GET' || method === 'HEAD' ? undefined : body, signal: ctl.signal,
+      });
+      answering();
+      const out = {};
+      res.headers.forEach((v, name) => { if (!DROP.has(name)) out[name] = v; });
+      sentHead = true;
+      await frame(FRAME.HEAD, enc.encode(JSON.stringify({ status: res.status, headers: out })));
+      if (res.body) {
+        const reader = res.body.getReader();
+        for (;;) {
+          const { value, done } = await reader.read();
+          if (done) break;
+          for (let i = 0; i < value.length; i += CHUNK) await frame(FRAME.DATA, value.subarray(i, i + CHUNK));
+        }
+      }
+      await frame(FRAME.END, new Uint8Array(0));
+      send(sock, tag(FROM_MAC.DONE, id));
+    } catch (err) {
+      answering();
+      if (ctl.signal.aborted) return;
+      log.warn?.('[relay] answering failed:', err?.message ?? err);
+      try {
+        await queue.catch(() => {});
+        if (!sentHead) {
+          await frame(FRAME.HEAD, enc.encode(JSON.stringify({ status: 502, headers: { 'content-type': 'application/json' } })));
+          await frame(FRAME.DATA, enc.encode(JSON.stringify({ error: 'Your computer could not answer that.' })));
+        }
+        await frame(FRAME.END, new Uint8Array(0));
+      } catch { /* nothing more to say */ }
+      send(sock, tag(FROM_MAC.DONE, id));
+    } finally {
+      answering();
+      live.delete(idh);
+    }
+  }
+
+  async function onMessage(sock, data) {
+    if (typeof data === 'string') {
+      if (data === PONG) ponged = Date.now();
+      return;
+    }
+    const bytes = data instanceof ArrayBuffer ? new Uint8Array(data)
+      : data instanceof Uint8Array ? data
+        : new Uint8Array(await data.arrayBuffer());
+    if (bytes.length < 1 + ID_BYTES) return;
+    const id = bytes.slice(1, 1 + ID_BYTES);
+    const idh = hex(id);
+    if (bytes[0] === TO_MAC.CANCEL) {
+      live.get(idh)?.abort();
+      live.delete(idh);
+      parts.delete(idh);
+    } else if (bytes[0] === TO_MAC.PART) {
+      // A big request comes in pieces (relay/room.mjs); keep them until the
+      // last, within a limit, so a stream of pieces cannot fill memory.
+      const held = parts.get(idh) ?? { chunks: [], size: 0 };
+      held.chunks.push(bytes.slice(1 + ID_BYTES));
+      held.size += bytes.length - 1 - ID_BYTES;
+      if (held.size > MAX_REQUEST) { parts.delete(idh); send(sock, tag(FROM_MAC.REFUSED, id)); return; }
+      parts.set(idh, held);
+    } else if (bytes[0] === TO_MAC.REQUEST) {
+      const held = parts.get(idh);
+      parts.delete(idh);
+      const last = bytes.slice(1 + ID_BYTES);
+      if (!held) { await answer(sock, id, last); return; }
+      const whole = new Uint8Array(held.size + last.length);
+      let at = 0;
+      for (const c of held.chunks) { whole.set(c, at); at += c.length; }
+      whole.set(last, at);
+      await answer(sock, id, whole);
+    }
+  }
+
+  // Two ways a link is known dead without waiting on the operating system: a
+  // relay that has answered pings stops answering, or this timer ran far too
+  // late, which is a laptop waking from sleep with every socket gone under it.
+  // A relay that never answers (one deployed before pings) is only ever judged
+  // by the second, so an old relay is not mistaken for a dead link.
+  function startPinging(sock) {
+    stopPinging();
+    ponged = null;
+    ticked = Date.now();
+    pinger = setInterval(() => {
+      const now = Date.now();
+      const slept = now - ticked > pingMs * 2;
+      ticked = now;
+      const silent = ponged !== null && now - ponged > pingMs + graceMs;
+      if (slept || silent) {
+        log.info?.(`[relay] the link went quiet (${slept ? 'woke from sleep' : 'no answer to ping'}); reconnecting`);
+        replace(sock);
+        return;
+      }
+      send(sock, PING);
+    }, pingMs);
+  }
+
+  function stopPinging() {
+    if (pinger) clearInterval(pinger);
+    pinger = null;
+  }
+
+  /** Let a dead link go and open a new one now, not after the backoff. */
+  function replace(sock) {
+    if (ws !== sock) return;
+    stopPinging();
+    ws = null;
+    connected = false;
+    for (const c of live.values()) c.abort();
+    live.clear();
+    try { sock.close(4002, 'No answer; reconnecting.'); } catch { /* already gone */ }
+    if (timer) { clearTimeout(timer); timer = null; }
+    retry = 1000;
+    onChange();
+    void connect();
+  }
+
+  function schedule() {
+    if (!want || timer) return;
+    timer = setTimeout(() => { timer = null; void connect(); }, retry);
+    retry = Math.min(retry * 2, 30_000);
+  }
+
+  async function connect() {
+    const mine = ++gen;
+    try { await ready(); } catch (err) { error = String(err?.message ?? err); onChange(); schedule(); return; }
+    if (!want || mine !== gen) return;
+    const url = `${relayUrl.replace(/^http/, 'ws').replace(/\/+$/, '')}/mac/${ids.room}?proof=${encodeURIComponent(ids.proof)}`;
+    let sock;
+    try { sock = new WebSocketImpl(url); } catch (err) { error = `Could not reach the relay: ${err?.message ?? err}`; onChange(); schedule(); return; }
+    ws = sock;
+    sock.binaryType = 'arraybuffer';
+    sock.onopen = () => {
+      if (ws !== sock) return;
+      connected = true;
+      error = null;
+      retry = 1000;
+      startPinging(sock);
+      onChange();
+    };
+    sock.onmessage = (event) => { if (ws === sock) void onMessage(sock, event.data); };
+    sock.onerror = () => { if (ws === sock && !connected) error = 'Could not reach the relay.'; };
+    sock.onclose = (event) => {
+      if (ws !== sock) return;
+      stopPinging();
+      ws = null;
+      const was = connected;
+      connected = false;
+      for (const c of live.values()) c.abort();
+      live.clear();
+      if (event?.code === 4001) error = 'The relay turned this computer away.';
+      else if (was) error = null;
+      onChange();
+      schedule();
+    };
+  }
+
+  return {
+    start() {
+      if (want) return;
+      want = true;
+      retry = 1000;
+      void connect();
+    },
+    stop() {
+      want = false;
+      gen += 1;
+      stopPinging();
+      if (timer) { clearTimeout(timer); timer = null; }
+      const sock = ws;
+      ws = null;
+      connected = false;
+      for (const c of live.values()) c.abort();
+      live.clear();
+      try { sock?.close(1000, 'Phones from anywhere turned off.'); } catch { /* already */ }
+      onChange();
+    },
+    /** The key was reset: the room is a new one. */
+    restart() {
+      if (!want) return;
+      this.stop();
+      this.start();
+    },
+    state: () => ({ connected, error, connecting: want && !connected && !error }),
+  };
+}

package/main/repeats.mjs

@@ -16,6 +16,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import {
   DAY_NAMES, foldRepeats, isOwed, isRepeatRule, occurrenceId, periodKey, repeatLabel,
+  standingInstruction, PROTOCOL_OPENS, INSTRUCTION_MARK,
 } from '../shared/repeats.mjs';
 import { machineryPath } from './store/home.mjs';
 import { NAME } from '../shared/product-name.mjs';
@@ -41,8 +42,8 @@ const MISSES_BEFORE_ALERT = 3;
 // last can be truncated away entirely, and a worker that never saw it cannot
 // know that a quiet finish has to be marked.
 export const OCCURRENCE_PROTOCOL = [
-  'THIS IS ONE RUN OF A REPEATING TASK. It runs again tomorrow whatever happens',
-  'here, so this run does not have to carry the future.',
+  `${PROTOCOL_OPENS} It runs again at its next time whatever`,
+  'happens here, so this run does not have to carry the future.',
   '',
   'FINISH ONE OF TWO WAYS.',
   '',
@@ -60,7 +61,12 @@ export const OCCURRENCE_PROTOCOL = [
   `only place in ${NAME} where finishing quietly hides something, so the marker is`,
   'required to hide, never to show.',
   '',
-  'HER INSTRUCTION FOLLOWS.',
+  'IF THEY TELL YOU HOW THIS TASK SHOULD GO FROM NOW ON, CHANGE IT YOURSELF with',
+  'the store tool set_repeating_task. Editing this run or writing a memory note',
+  'reaches no later run: this body is a copy, and every run gets a new task',
+  'folder. Never ask them to go and edit the task by hand.',
+  '',
+  INSTRUCTION_MARK,
 ].join('\n');
 
 export class Repeats {
@@ -212,7 +218,7 @@ export class Repeats {
 
       const { created } = workItemsDisk.createWorkItemIfAbsent(productDir, id, {
         title: `${rule.title} · ${dayStamp(key)}`,
-        body: `${OCCURRENCE_PROTOCOL.replace('<REPEAT_LABEL>', repeatLabel(ruleId))}\n\n${rule.body ?? rule.title}`,
+        body: `${OCCURRENCE_PROTOCOL.replace('<REPEAT_LABEL>', repeatLabel(ruleId))}\n\n${standingInstruction(rule)}`,
         kind: 'directive',
         priority: rule.priority ?? 5,
         labels: ['founder', repeatLabel(ruleId)],

package/main/row-label.mjs

@@ -1,3 +1,5 @@
+import { harnessFor } from './harnesses.mjs';
+import { teammateIdOf } from '../shared/teammates.mjs';
 // THE NAME ON THE ROW, WRITTEN RATHER THAN TAKEN FROM THE FIRST SENTENCE.
 //
 // A dictated message keeps its first line as its title, verbatim and forever
@@ -61,51 +63,18 @@ export const NAME_MAX = 64;
  *  archive; everything else is a row that can still appear in a list. */
 const LIVE = new Set(['open', 'claimed', 'blocked']);
 
-/**
- * PURE. Is this title already a name somebody wrote?
- *
- * The one question that decides whether this module speaks at all, and it is
- * answered off the words alone because that is all there is: nothing on a row
- * records whether its title was typed or derived.
- *
- * Three marks, and together they separate the two shapes `splitMessage` makes
- * (renderer/src/message-split.ts). A first line of 120 characters or less is
- * kept VERBATIM and is the name its person wrote. A longer one is clipped into
- * a title by the app, and every clip it can produce is either a whole sentence
- * of at least 25 characters or a hard cut ending in an ellipsis.
- *
- *   as short as a name we would write   NAME_MAX, so a title already that tight
- *                                       has nothing for us to improve,
- *   as few words as a name has          the same eight `cleanName` allows,
- *   not ending as a sentence does       '.', '!', '?' and '…' are how a clipped
- *                                       title ends and not how a name does.
- *
- * It errs towards leaving the words alone, which is the right way to be wrong:
- * the cost is a short typed sentence keeping its own first line, and the cost
- * the other way is somebody losing the thread they named.
- */
-export function isWrittenName(title) {
-  const t = String(title ?? '').trim();
-  if (!t) return false;
-  if (t.length > NAME_MAX) return false;
-  if (t.split(/\s+/).length > 8) return false;
-  return !/[.!?…]$/.test(t);
-}
-
 /**
  * PURE. Does this row want naming?
  *
- * Four ways to say no, and the last two are the fix for a tester losing their
- * own threads on 2026-10-01: "Add comment to cart.js" became "Improve cart.js
- * header comment" and then "Update cart file comment" inside two minutes.
+ * Three ways to say no:
  *
  *   - it is done, so nobody is scanning for it,
  *   - it has nothing to name from, which is a row with no words on it yet,
- *   - ITS PERSON ALREADY NAMED IT. A short clear title is the name they will
- *     look for, and on a team it is the name they will point someone else at.
- *     Improving it is not an improvement.
  *   - IT HAS BEEN NAMED. Once, when the thread was made, and then never again.
  *
+ * A short typed title is named too: a list where some rows are typed lines and
+ * the rest are names reads as two styles. The prompt keeps such a line's words.
+ *
  * That last line used to read `wroteAt < contentTouchedAt(item)`, so the name
  * followed where the thread stood: an agent writes a note and a result on every
  * run, so every run earned a new name. Following the thread was the intended
@@ -121,8 +90,8 @@ export function isWrittenName(title) {
  */
 export function wantsName(item) {
   if (!item || !LIVE.has(item.status)) return false;
+  if (teammateIdOf(item)) return false;
   if (!String(item.title ?? '').trim() && !String(item.body ?? '').trim()) return false;
-  if (isWrittenName(item.title)) return false;
   return !String(item.label ?? '').trim();
 }
 
@@ -138,12 +107,15 @@ export function namePrompt(item) {
     'Here is a work thread: the message that opened it, and the latest thing',
     'written on it. Write a short name for the thread AS IT STANDS NOW: 3 to 7',
     'words, sentence case, no quotes, no trailing punctuation, naming the thing',
-    'being worked on rather than restating the sentence. Reply with the name and',
-    'nothing else.',
+    'being worked on rather than restating the sentence. If the opening line is',
+    'already a short name, keep its words and only fix the case. Reply with the',
+    'name and nothing else.',
     '',
     '--- opened with ---',
     cut(item?.title, 300),
-    cut(item?.body, 1200),
+    // A teammate's run is titled with its own part of a message that may have
+    // woken several (shared/teammates.mjs `runTitle`); the whole would mix them.
+    (item?.labels ?? []).some((l) => String(l).startsWith('teammate:')) ? '' : cut(item?.body, 1200),
     '--- latest ---',
     latest || '(nothing written yet)',
     '---',
@@ -188,10 +160,7 @@ export function codexNameArgs(item) {
 }
 
 function codexArgs(prompt) {
-  return [
-    'exec', '--skip-git-repo-check', '--ephemeral', '--ignore-user-config', '--ignore-rules',
-    '-s', 'read-only', '-c', 'model_reasoning_effort=low', prompt,
-  ];
+  return harnessFor('codex').smallModelArgs(prompt);
 }
 
 /**
@@ -218,11 +187,13 @@ export function nameRow(item, opts = {}) {
  */
 export function askSmallModel(prompt, clean, { claudeBin, codexBin = null, engine = 'claude', model = NAME_MODEL, timeoutMs = NAME_TIMEOUT_MS, env } = {}) {
   return new Promise((resolve) => {
-    const bin = engine === 'codex' ? codexBin : claudeBin;
+    let harness;
+    try { harness = harnessFor(engine); } catch { return resolve(''); }
+    const bin = harness.binary({ claudeBin, codexBin });
     if (!bin) return resolve('');
     let child;
     try {
-      child = spawn(bin, engine === 'codex' ? codexArgs(prompt) : ['-p', prompt, '--model', model], {
+      child = spawn(bin, harness.smallModelArgs(prompt, model), {
         // Somewhere that is nobody's project. A naming call must not pick up a
         // CLAUDE.md, a settings file or a hook from whatever folder it lands in.
         cwd: '/tmp',