agentbox-app 0.1.12 → 0.1.16

package/main/settings.mjs

@@ -12,27 +12,34 @@
 // place a grant is reviewed; what changed is that she edits them as fields on
 // the project they belong to instead of in a text editor.
 
+import { teammatesOn } from '../shared/teammates.mjs';
+import { phoneChoiceOf, phoneProjectsOf, withPhoneAll, withPhoneProject, phoneEligible } from '../shared/phone-snapshot.mjs';
 import fs from 'node:fs';
+import { harnessFor } from './harnesses.mjs';
 import os from 'node:os';
 import path from 'node:path';
 import { codexChoiceToOpen, saveConfig } from './config.mjs';
-import { resolveClaudeBin, forgetClaudeBin, INSTALL_URL } from './claude-bin.mjs';
+import { forgetClaudeBin, INSTALL_URL } from './claude-bin.mjs';
+import { lookAgain } from './engine-bin.mjs';
 import { AGENT_MODES } from '../shared/agents.mjs';
 import { analyticsKey, diagnosticsOn } from './analytics.mjs';
 import { CLAUDE_PERMISSION_MODES } from '../shared/work-items.mjs';
-import { accountSentence, engineTroubleNote } from '../shared/spawn-trouble.mjs';
+import { accountSentence, engineTroubleNote, refineCause } from '../shared/spawn-trouble.mjs';
 import { readPlan } from './claude-plan.mjs';
-import { effectiveProfiles } from './account-discovery.mjs';
+import { effectiveProfiles, troubleForProfile } from './account-discovery.mjs';
 import { machineSlots, machineNote, autoAgents, MAX_SLOTS } from './machine.mjs';
-import { NAME } from '../shared/product-name.mjs';
+import { shortPath } from './agent-files.mjs';
+import { NAME, Name } from '../shared/product-name.mjs';
 import { autoSlots } from './memory-gate.mjs';
 import { accountIdentity, claudeLoginCommand, duplicateAccountNote, linkAccountTooling, makeClaudeHome } from './account-tooling.mjs';
 import { isEngine } from '../shared/engines.mjs';
-import { codexAccount, codexLoginCommand, makeCodexHome } from './codex-account.mjs';
-import { codexDefaultModel, codexModels } from './codex-models.mjs';
+import { codexAccount, codexFreePlan, codexLoginCommand, makeCodexHome } from './codex-account.mjs';
+import { codexDefaultModel, codexModelsAcross } from './codex-models.mjs';
 import { CODEX_DEFAULT_MODE, isCodexMode } from '../shared/codex-modes.mjs';
+import { CLOUD_SAME, CLOUD_CLAUDE_DEFAULT, CLOUD_CODEX_DEFAULT } from './cloud-permission.mjs';
+import { isPackagedElectron } from './team/session.mjs';
 import { claudeModels } from './claude-models.mjs';
-import { resolveCodexBin, forgetCodexBin, INSTALL_URL as CODEX_INSTALL_URL } from './codex-bin.mjs';
+import { forgetCodexBin, INSTALL_URL as CODEX_INSTALL_URL } from './codex-bin.mjs';
 
 // Her Claude Code sessions in her inbox: all of them, only the ones stopped on
 // a question, or none. One reader, here, so the settings screen and the
@@ -213,6 +220,8 @@ export function buildSessionArgs(base, mode) {
   return [...model, ...(tools.length ? ['--allowedTools', ...tools] : []), ...grant, ...parsed.other];
 }
 
+export { cloudPermissionArgs } from './cloud-permission.mjs';
+
 // THE MODEL, WRITTEN BACK INTO THE SAME LIST buildSessionArgs READS FROM.The
 // screen had no control over this at all; the flag was already there and only
 // a text editor could change it.
@@ -245,16 +254,42 @@ export function setModelArg(base, model) {
 
 const lineCount = (text) => (text.trim() ? text.trim().split('\n').length : 0);
 
+// What launch found, or the last Check again, in the finder's own shape. For a
+// read nobody is looking at: the search starts a login shell on the window's
+// thread, and the phone reads settings every minute.
+function knownEngine(config, engine) {
+  if (engine === 'claude') {
+    return {
+      path: config.claudeBin ?? null,
+      found: !!config.claudeFound,
+      certain: config.claudeCertain !== false,
+      from: config.claudeBinConfigured ? 'settings' : (config.claudeFrom ?? null),
+    };
+  }
+  // recheckCodex moves codexBin and not codexFound, so the path is the answer.
+  return {
+    path: config.codexBin ?? null,
+    found: !!config.codexBin,
+    certain: config.codexCertain !== false,
+    from: config.codexBinConfigured ? 'settings' : (config.codexFrom ?? null),
+  };
+}
+
 // Claude Code: the path, whether it is really there, and where to get it when
 // it is not. One reader, here, so the screen and the config cannot disagree.
-export function claudeState(config) {
-  const found = resolveClaudeBin(config.claudeBinConfigured ?? null);
+export function claudeState(config, { search = true } = {}) {
+  const found = search ? harnessFor('claude').discover(config.claudeBinConfigured ?? null) : knownEngine(config, 'claude');
   return {
     claudeBin: found.path ?? config.claudeBin,
     claudeFound: found.found,
     // Whether the search got an answer at all.
     claudeCertain: found.certain !== false,
     claudeInstallUrl: INSTALL_URL,
+    // WHETHER SOMEBODY POINTED AT THIS FILE THEMSELVES, which is the one thing
+    // the card cannot work out from the path alone. A chosen path is never
+    // searched around, so the row that offers the search back has to know
+    // (`pointAtEngineBin` below).
+    claudeChosen: found.from === 'settings',
   };
 }
 
@@ -267,6 +302,20 @@ export function claudeState(config) {
 // `forgetClaudeBin` exists for.
 export function recheckClaude(config) {
   forgetClaudeBin();
+  return takeClaude(config);
+}
+
+/**
+ * Check again without holding the window: the shell is asked in the background
+ * and this settles once its answer is on the config. For every caller that can
+ * wait (the buttons, setup, the update check).
+ */
+export async function lookAgainFor(engine, config) {
+  await lookAgain(engine);
+  return engine === 'claude' ? takeClaude(config) : takeCodex(config);
+}
+
+function takeClaude(config) {
   const state = claudeState(config);
   // The config carries the path everything else spawns from, so a search that
   // has just found Claude Code updates it rather than leaving the rest of the
@@ -275,7 +324,10 @@ export function recheckClaude(config) {
   // And whether it is here at all, which is what decides that a Mac with only
   // Codex runs on Codex (`Supervisor#_enginesFound`). Only a certain answer
   // moves it, so an unsure search never takes Claude Code away from anybody.
-  if (state.claudeFound || state.claudeCertain) config.claudeFound = state.claudeFound;
+  if (state.claudeFound || state.claudeCertain) {
+    config.claudeFound = state.claudeFound;
+    config.claudeCertain = state.claudeCertain;
+  }
   return state;
 }
 
@@ -309,8 +361,8 @@ export function recheckClaude(config) {
  * checked by uninstalling Codex from the machine running the suite is a card
  * whose unsure state is not checked. Nothing in the app passes it.
  */
-export function codexState(config, where = {}) {
-  const found = resolveCodexBin(config.codexBinConfigured ?? null, where);
+export function codexState(config, where = {}, { search = true } = {}) {
+  const found = search ? harnessFor('codex').discover(config.codexBinConfigured ?? null, where) : knownEngine(config, 'codex');
   return {
     // Empty rather than a path when there is nothing there, which is the same
     // asymmetry `config.codexBin` already keeps (main/config.mjs): a configured
@@ -322,12 +374,14 @@ export function codexState(config, where = {}) {
     // Whether the search got an answer at all.
     certain: found.certain !== false,
     url: CODEX_INSTALL_URL,
+    // Whether somebody pointed at this file themselves. See `claudeState`.
+    chosen: found.from === 'settings',
   };
 }
 
 /** `codexState` under the names the walk's last card reads beside Claude's. */
-export function codexFoundState(config, where = {}) {
-  const state = codexState(config, where);
+export function codexFoundState(config, where = {}, how = {}) {
+  const state = codexState(config, where, how);
   return { codexFound: state.found, codexCertain: state.certain, codexInstallUrl: state.url };
 }
 
@@ -339,8 +393,13 @@ export function codexFoundState(config, where = {}) {
  *  without a restart. */
 export function recheckCodex(config) {
   forgetCodexBin();
+  return takeCodex(config);
+}
+
+function takeCodex(config) {
   const state = codexState(config);
   config.codexBin = state.found ? state.bin : null;
+  config.codexCertain = state.certain;
   // Found while the app is open, by this button or the plan setup: the choice
   // opens now, as it would have at the next launch (main/config.mjs).
   const opened = codexChoiceToOpen(config, state.found);
@@ -348,7 +407,100 @@ export function recheckCodex(config) {
   return state;
 }
 
-export function readSettings({ config, supervisor, store }) {
+/* ------------------- POINTING AT IT YOURSELF, AND BACK -------------------- */
+/**
+ * THE WAY OUT OF A SEARCH THAT MISSED, AND IT IS NOT A RELEASE (w-ce8c1a9275).
+ *
+ * The note this came from: "It has a really hard time finding the install on the
+ * person's computer, and we keep having bug reports and then patching that
+ * specific case." Asking the login shell first (main/engine-bin.mjs) covers
+ * every installer a person's own PATH knows about, which is most of them. It
+ * cannot cover a wrapper script somewhere nobody would guess, a tool on a
+ * volume, or a machine whose login shell will not start at all -- and for those,
+ * every fix used to be a path WE ship and a release THEY wait for.
+ *
+ * `claudeBin` in zero.config.json already won over the search and always has.
+ * What was missing is that nobody is told about that file and the app gave no
+ * way to edit it. These two functions are that door, and the second one matters
+ * as much as the first: a wrong choice that could only be undone by hand-editing
+ * a file nobody has heard of is not a door, it is a trap.
+ *
+ * THE REFUSALS ARE MOST OF THE WORK. Each thing refused here was possible by
+ * hand before and each one becomes a spawn that fails once per row, naming a
+ * file nobody meant to name. The sentence comes back to the screen instead.
+ *
+ * NO PATH FROM THE WINDOW IS EVER TRUSTED: main/ipc.mjs opens the picker and
+ * calls this in the same trip, so the only path that reaches here is one the
+ * open panel itself produced. The sibling rule is
+ * tests/where-codex-runs-from-is-not-a-file-a-worker-can-write.test.mjs.
+ */
+const BIN_KEY = { claude: 'claudeBin', codex: 'codexBin' };
+
+/** The sentence, or null when the file really is one we could run. */
+function whyNotAnAgent(chosen) {
+  if (typeof chosen !== 'string' || !path.isAbsolute(chosen)) {
+    return `${Name} needs the file itself, picked from your computer.`;
+  }
+  let stat;
+  try { stat = fs.statSync(chosen); } catch { stat = null; }
+  if (!stat) return `${Name} could not find anything there. It may have moved since.`;
+  if (stat.isDirectory()) return 'That is a folder. Open it and pick the file inside.';
+  try { fs.accessSync(chosen, fs.constants.X_OK); } catch {
+    return 'That file cannot be run, so it is not the one.';
+  }
+  return null;
+}
+
+/**
+ * Take a file somebody picked for one coding agent.
+ *
+ * Written to zero.config.json so it survives a restart AND set on the live
+ * config, because every consumer reads `config.*` per call and a setting that
+ * waits for a relaunch is the same failure as a fix that is not running. The
+ * recheck afterwards is what puts the path the fleet spawns from in step with
+ * it, the same way the Check again button does.
+ */
+export function pointAtEngineBin(config, engine, chosen) {
+  const key = BIN_KEY[engine];
+  if (!key) return { ok: false, say: `${Name} does not know a coding agent called that.` };
+  const why = whyNotAnAgent(chosen);
+  if (why) return { ok: false, say: why };
+  if (!config.appDir) return { ok: false, say: `${Name} has nowhere to save that.` };
+  saveConfig(config, { [key]: chosen });
+  config[`${engine}BinConfigured`] = chosen;
+  const state = engine === 'claude' ? recheckClaude(config) : recheckCodex(config);
+  return { ok: true, state };
+}
+
+/**
+ * Give the choice back, so the search is in charge again. The key is REMOVED
+ * from the file rather than emptied: `saveConfig` reads an explicit undefined as
+ * a deletion, and an empty string left behind would read as a setting that means
+ * something else (main/config.mjs only treats a non-empty string as chosen).
+ */
+export function searchForEngineBin(config, engine) {
+  const key = BIN_KEY[engine];
+  if (!key) return { ok: false, say: `${Name} does not know a coding agent called that.` };
+  if (!config.appDir) return { ok: false, say: `${Name} has nowhere to save that.` };
+  saveConfig(config, { [key]: undefined });
+  config[`${engine}BinConfigured`] = null;
+  const state = engine === 'claude' ? recheckClaude(config) : recheckCodex(config);
+  return { ok: true, state };
+}
+
+// THE ALPHA FEATURES SWITCHES (w-3d0fa23ffb). Off unless someone turned them
+// on in Settings; only a real `true` counts. Multiplayer, the team version, is
+// the exception in a checkout, where it was always on.
+export function alphaFeatures(config, { packaged = isPackagedElectron() } = {}) {
+  return {
+    rooms: config?.alphaRooms === true,
+    teammates: teammatesOn(config),
+    multiplayer: packaged ? config?.alphaMultiplayer === true : config?.alphaMultiplayer !== false,
+  };
+}
+
+// `search: false` is for a read on a timer (`knownEngine`).
+export function readSettings({ config, supervisor, store }, { search = true } = {}) {
   const products = store.listProducts();
   const status = supervisor.status();
   const sessions = [...supervisor.sessions.values()];
@@ -379,21 +531,36 @@ export function readSettings({ config, supervisor, store }) {
   // waiting, because a page she chose to open interrupts nobody.
   const troubles = status.accountTrouble ?? {};
   const accounts = (profiles.length ? profiles : ['default']).map((profile) => {
-    const trouble = troubles[profile] ?? null;
+    // THE HOME THE WORKSPACE IS CONFIGURED WITH, not this process's own. Both
+    // of these read a login out of a folder, and both of them defaulted to
+    // `os.homedir()` while the list of folders above came from `config.home`,
+    // so a workspace pointed anywhere else drew rows for its own folders and
+    // read somebody else's login into them.
+    const plan = readPlan(profile, { home: config.home });
+    // A reason filed before an ended subscription had its own name still reads
+    // as an admin's block; the login's file says which it is.
+    // THE SUBSCRIPTION'S TROUBLE, not the folder's: one row stands for every
+    // folder holding this account (account-discovery.mjs says why).
+    const filed = troubleForProfile(troubles, profile, { home: config.home });
+    const trouble = filed ? { ...filed, cause: refineCause(filed.cause, plan) } : null;
     const resting = (supervisor._profileCooldown?.[profile] ?? 0) >= now;
     // WHOSE SUBSCRIPTION THIS ROW IS, not merely which folder it lives in.
     // The page named its rows after folders, so nothing on it could tell a
     // person that one of their accounts had been replaced by the other;
     // main/account-tooling.mjs has how that happens. Null when the
     // folder holds no login, and then the row reads as it always did.
-    const identity = accountIdentity(profile === 'default' ? null : profile);
+    const identity = accountIdentity(profile === 'default' ? null : profile, { home: config.home });
     return {
       profile,
       email: identity?.email ?? null,
       accountUuid: identity?.accountUuid ?? null,
-      // WHICH ONE RUNS, when she has picked one. False on every row while she
-      // has not, and then every account runs as it always has.
-      chosen: (config.activeAccount?.claude ?? null) === profile,
+      // WHICH ONE RUNS, AND ONE OF THEM ALWAYS DOES (w-dac993a554). This was
+      // false on every row until somebody picked, because until then every
+      // account really did take a share of the work. One account runs it now,
+      // so the supervisor is asked which rather than the config file: with
+      // nothing picked that is the primary login, and the page says so instead
+      // of leaving a person to guess which of their two plans is being spent.
+      chosen: (supervisor._profilesFor?.('claude') ?? [])[0] === profile,
       // The default profile is whatever ~/.claude holds; anything else is a
       // second logged-in home directory, and its path is the only name it has.
       label: profile === 'default' ? 'default' : path.basename(profile),
@@ -421,10 +588,12 @@ export function readSettings({ config, supervisor, store }) {
       // Read here rather than kept, because Claude Code refreshes its own
       // profile as it runs and this page is opened by hand a few times a day.
       // `null` when the file cannot be read, and then no screen says anything.
-      plan: (() => { const p = readPlan(profile); return p.known ? { label: p.label, max: p.max } : null; })(),
+      plan: plan.known ? { label: plan.label, max: plan.max } : null,
     };
   });
 
+  // On her phone: every project unless she kept it here (shared/phone-snapshot.mjs).
+  const phoneSlugs = new Set(phoneProjectsOf(config.phoneProducts, process.env.AGENTBOX_PERSON_ID, phoneEligible(products)));
   const projects = products.map((product) => {
     let instructions = '';
     try { instructions = supervisor.readProjectInstructions(product.slug); } catch {}
@@ -446,6 +615,9 @@ export function readSettings({ config, supervisor, store }) {
       // workspace default and never a strip of Claude Code jargon on a page
       // she opens to change her rules.
       autonomous: (config.autonomousProducts ?? []).includes(product.slug),
+      // ON HER PHONE WITH THE MAC SHUT (docs/cloud/PHONE-PLAN.md): its threads
+      // go up to her own rows online on every sync (main/phone-inbox.mjs).
+      onPhone: phoneSlugs.has(product.slug),
       permission: override ? permissionMode(override) : 'workspace',
       permissionArgs: override ?? null,
       codexMode: config.projectCodexMode?.[product.slug] ?? 'workspace',
@@ -470,8 +642,12 @@ export function readSettings({ config, supervisor, store }) {
   return {
     archivedProjects,
     workspace: {
+      // THE PHONE AS A WHOLE: on unless she turned it off (shared/phone-snapshot.mjs).
+      phoneAll: phoneChoiceOf(config.phoneProducts, process.env.AGENTBOX_PERSON_ID, phoneEligible(products)).all,
       agentsRunning: !supervisor.paused,
-      sessionsAtOnce: config.maxConcurrentSessions,
+      // The number picked on the menu, for the whole computer, or what is
+      // running as the limit now when nothing was picked.
+      sessionsAtOnce: typeof config.agentsAtOnce === 'number' ? config.agentsAtOnce : status.capacity,
       // AUTOMATIC, AND WHAT IT WORKS OUT TO (w-e5225b62ba). `agentsAuto` is who
       // is deciding; `agentsTotal` is what the whole Mac is running at once,
       // which is the number the page shows, because the per-account one is
@@ -499,6 +675,7 @@ export function readSettings({ config, supervisor, store }) {
       machineNote: machineNote(slotsHere, config.maxConcurrentSessions),
       memoryGate: memoryGateSettings({ config, supervisor }),
       leftovers: leftoverSettings({ config, supervisor }),
+      strayFolders: strayFolderSettings({ supervisor }),
       capacity: status.capacity,
       running: sessions.length,
       model: parseSessionArgs(workspaceArgs).model,
@@ -511,9 +688,11 @@ export function readSettings({ config, supervisor, store }) {
       // comes back with ONE entry and this screen draws exactly what it drew
       // before. A page that derived its own list would offer her a choice the
       // supervisor is about to refuse.
-      ...engineSettings(supervisor, config),
+      ...engineSettings(supervisor, config, { search }),
       permission: permissionMode(workspaceArgs),
       permissionArgs: workspaceArgs,
+      cloudPermission: config.cloudPermission ?? CLOUD_CLAUDE_DEFAULT,
+      cloudCodexMode: config.cloudCodexMode ?? CLOUD_CODEX_DEFAULT,
       // ONE SWITCH FOR EVERYTHING THAT LEAVES THE MACHINE, and it is on when
       // Agentbox is installed (legal/privacy.html, section 10). Off stops the
       // counts AND the crash reports; there is deliberately no partial mode and
@@ -526,6 +705,11 @@ export function readSettings({ config, supervisor, store }) {
       // ADHD mode: whether the ADHD rules ride under hers (w-5737fe67cf). Off
       // unless she turned it on, so only `true` means on.
       adhdMode: config.adhdMode === true,
+      importNew: config.importNew === true,
+      alpha: alphaFeatures(config),
+      // The corner tag over other apps (w-dafae58a23). On unless she turned it
+      // off here, which is the only place it turns off for good.
+      cornerTag: config.cornerTag !== false,
       // How much of her own Claude Code goes in her inbox: all / waiting / off.
       // All by default, because the machine nobody has opened this page on is
       // the one with thirteen forgotten sessions on it.
@@ -550,11 +734,11 @@ export function readSettings({ config, supervisor, store }) {
       // Looked up again on every read of this screen, not taken from boot.
       // Someone who reads "install it, then open this screen again" and does
       // exactly that has to see it turn found, without restarting the app.
-      ...claudeState(config),
+      ...claudeState(config, { search }),
       // AND WHETHER CODEX IS, because the app needs one of the two and not
       // both: the last card of the walk only shuts the inbox when neither is
       // here (renderer/src/App.tsx).
-      ...codexFoundState(config),
+      ...codexFoundState(config, {}, { search }),
       // AND WHAT THIS MAC'S CLAUDE CODE CALLS ITS MODELS.
       //
       // In the same trip, and for the same reason the line above is looked up
@@ -606,7 +790,7 @@ function engineTroubleFor(supervisor, engine) {
   return trouble ? engineTroubleNote(trouble.cause) : null;
 }
 
-function engineSettings(supervisor, config) {
+function engineSettings(supervisor, config, { search = true } = {}) {
   const choices = supervisor.engineChoices();
   const engine = supervisor.engineFacts().workspace;
   // WHETHER THIS MAC HAS ASKED TO HEAR ABOUT CODEX AT ALL, which is a different
@@ -631,7 +815,7 @@ function engineSettings(supervisor, config) {
   // links the install, which is the question that person had.
   const codexIsHome = engine === 'codex';
   const codex = {
-    ...codexState(config),
+    ...codexState(config, {}, { search }),
     trouble: engineTroubleFor(supervisor, 'codex'),
     account: codexAccount(supervisor._codexHome()),
     // EVERY CODEX LOGIN ON THE MAC, NOT JUST THE FIRST. The supervisor has
@@ -646,6 +830,7 @@ function engineSettings(supervisor, config) {
     return { engine, engineChoices: choices, codex, codexModels: [], codexModelDefault: null, codexModel: null };
   }
   const home = supervisor._codexHome();
+  const offered = supervisor._codexOfferHomes();
   return {
     engine,
     engineChoices: choices,
@@ -654,9 +839,12 @@ function engineSettings(supervisor, config) {
     // strip in the model drawer draws the picked model's list, so they travel
     // beside the name rather than as a list of their own that could disagree
     // with it.
-    codexModels: codexModels({ home }).map((m) => ({
+    codexModels: codexModelsAcross(offered).map((m) => ({
       id: m.id, label: m.label, levels: m.levels.map((l) => l.id), defaultLevel: m.defaultLevel,
     })),
+    // Set when every login offered is on ChatGPT's free plan, so the menu can
+    // say why Codex lists so few models.
+    codexFreePlan: codexFreePlan(offered),
     // What her own `codex` in a terminal runs, so the card's word and her
     // terminal cannot disagree. Null is a real answer and the card says
     // "Codex's own" for it rather than guessing (renderer/src/models.ts).
@@ -686,12 +874,15 @@ const withSlug = (list, slug, on) => {
 // `paused` and `driven` were the other three and all three are gone from the
 // app: the first two because she could not tell what they did and would never
 // have used them, the third because the self-driving it belonged to is deleted.
-export function setProjectSetting({ config, supervisor }, { product, key, value }) {
+export function setProjectSetting({ config, supervisor, store }, { product, key, value }) {
   if (!product) throw new Error('no project');
   switch (key) {
     case 'autonomous':
       saveConfig(config, { autonomousProducts: withSlug(config.autonomousProducts, product, !!value) });
       break;
+    case 'phone':
+      saveConfig(config, { phoneProducts: withPhoneProject(config.phoneProducts, process.env.AGENTBOX_PERSON_ID, product, !!value, phoneEligible(store?.listProducts?.() ?? [])) });
+      break;
     // WHICH OF HER CLAUDE CODE AGENTS THIS PROJECT TOOK. Names only: the files
     // stay where their author put them and Agentbox never copies or moves one,
     // so a list here that has gone stale costs nothing and an agent she
@@ -769,7 +960,9 @@ export function setProjectSetting({ config, supervisor }, { product, key, value
  * not signed in.
  */
 function codexAccountRows(supervisor) {
-  const chosen = supervisor.config.activeAccount?.codex ?? null;
+  // THE ONE THAT RUNS, the same way the Claude rows answer it: the supervisor's
+  // own pick, which is the chosen account or the primary login (w-dac993a554).
+  const chosen = supervisor._profilesFor?.('codex')?.[0] ?? null;
   return supervisor._codexProfiles().map((profile) => {
     const home = supervisor._codexProfileHome(profile);
     const id = codexAccount(home);
@@ -781,8 +974,7 @@ function codexAccountRows(supervisor) {
       planNamed: id?.planNamed ?? false,
       accountId: id?.accountId ?? null,
       signedIn: !!id,
-      // WHICH ONE RUNS. Null when she has never picked, and then every account
-      // runs and the card says so rather than marking one at random.
+      // WHICH ONE RUNS, and one of them always does (`chosen` above).
       chosen: chosen === profile,
     };
   });
@@ -827,9 +1019,12 @@ export function addCodexAccount({ config, supervisor }) {
  * ordinary reason for wanting it: a work login and a personal login, both
  * live, on one Mac.
  *
- * Everything else is the Codex flow exactly. Main makes the folder and
- * registers the profile, so the row appears immediately reading "Not signed
- * in"; the terminal is left with the browser half, which is genuinely hers.
+ * Main makes the folder and the terminal is left with the browser half, which
+ * is genuinely hers. UNLIKE CODEX, NOTHING IS WRITTEN INTO THE CONFIG: the
+ * folder is the shape main/account-discovery.mjs finds, so the account appears
+ * the moment its sign-in lands and never before. Registering it first put an
+ * abandoned sign-in in Settings as a "Not signed in" account and handed it
+ * every other task (tests/an-account-shows-once-and-only-once-it-is-signed-in).
  *
  * THE TOOLING IS LINKED AT CREATION, which the Codex side has no equivalent of.
  * `linkAccountTooling` otherwise runs at the first spawn, and the first thing
@@ -839,9 +1034,6 @@ export function addCodexAccount({ config, supervisor }) {
  */
 export function addClaudeAccount({ config, supervisor }) {
   const made = makeClaudeHome({ home: config.home });
-  const existing = (config.authProfiles ?? []).map((x) => x || 'default');
-  const list = existing.length ? existing : ['default'];
-  saveConfig(config, { authProfiles: [...list, made.profile] });
   // A failure here is a folder without her skills in it, which is a smaller
   // thing than a sign in that does not happen: the links are retried at every
   // spawn anyway.
@@ -891,6 +1083,9 @@ export function memoryGateSettings({ config, supervisor }) {
 export function memoryReading({ config, supervisor }) {
   const out = { heavy: null, waiting: null, pressure: null, usedPct: null, asked: null, waited: null, refused: null };
   if (!config.memoryGate) return out;
+  // The supervisor's own hold on new agents (main/start-hold.mjs), which does
+  // not depend on which copy of the app is coordinating the command queue.
+  try { out.holding = !!supervisor.startHoldStatus?.()?.holding; } catch { out.holding = false; }
   let s = null;
   try { s = supervisor.memoryGateStatus?.() ?? null; } catch { return out; }
   if (!s || s.role === 'standby') return out;
@@ -923,22 +1118,26 @@ export function leftoverSettings({ config, supervisor }) {
   // Codex, 2026-10-05).
   if (!on) {
     if (total && stoppable) {
-      now = `Right now finished agents have left ${total} program${total === 1 ? '' : 's'} running; turning this on stops ${stoppable === total ? (total === 1 ? 'it' : 'them') : `${stoppable} of them`}, two hours from then.`;
+      now = `Right now finished agents have left ${total} program${total === 1 ? '' : 's'} running; turning this on stops ${stoppable === total ? (total === 1 ? 'it' : 'them') : `${stoppable} of them`} when you close their tasks.`;
     }
     return { on, now };
   }
   {
     if (!total) now = 'Nothing left running by finished agents.';
     else {
-      const next = list.filter((l) => l.programs && l.stopsAt).map((l) => l.stopsAt).sort((a, b) => a - b)[0];
+      const timed = list.filter((l) => l.programs && l.stopsAt);
+      const next = timed.map((l) => l.stopsAt).sort((a, b) => a - b)[0];
+      const soon = timed.reduce((n, l) => n + l.programs, 0);
+      const open = stoppable - soon;
       const when = (ms) => {
         const m = Math.max(1, Math.round((ms - Date.now()) / 60_000));
         return m >= 60 ? `${Math.floor(m / 60)} h${m % 60 ? ` ${m % 60} m` : ''}` : `${m} m`;
       };
-      now = `Finished agents have left ${total} program${total === 1 ? '' : 's'} running.`;
-      if (stoppable) now += ` ${stoppable} ${next && next > Date.now() ? `stop in ${when(next)}` : 'are stopping'}`;
-      if (kept) now += `${stoppable ? ';' : ''} ${kept} ${kept === 1 ? 'is' : 'are'} kept`;
-      now += '.';
+      const parts = [];
+      if (soon) parts.push(`${soon} ${next > Date.now() ? `stop${soon === 1 ? 's' : ''} in ${when(next)}` : `${soon === 1 ? 'is' : 'are'} stopping`}`);
+      if (open) parts.push(`${open} stop${open === 1 ? 's' : ''} when you close ${open === 1 ? 'its task' : 'their tasks'}`);
+      if (kept) parts.push(`${kept} ${kept === 1 ? 'is' : 'are'} kept`);
+      now = `Finished agents have left ${total} program${total === 1 ? '' : 's'} running. ${parts.join('; ')}.`;
       const survivors = s?.survivors?.length ?? 0;
       if (survivors) now += ` ${survivors} did not stop when asked.`;
     }
@@ -946,8 +1145,59 @@ export function leftoverSettings({ config, supervisor }) {
   return { on, now };
 }
 
-export function setWorkspaceSetting({ config, supervisor }, { key, value }) {
+/**
+ * COPIES OF A PROJECT THE APP DID NOT MAKE, SAID OUT LOUD (w-330eea6c66).
+ *
+ * MEASURED 2026-10-07: thirteen worktrees of one repository sat outside the
+ * folder the app keeps its own in, about 740 MB, and nothing in the app could
+ * list, show or sweep one. That is the same invisibility that stranded 26 GB on
+ * 2026-09-22, and the half that fixes it for a person is being told.
+ *
+ * NO BUTTON, DELIBERATELY. A folder the app did not make is not the app's to
+ * remove: it is the only copy of whatever is uncommitted inside it, and somebody
+ * made it on purpose. So this is a sentence and nothing else, and it is absent
+ * entirely when there is nothing to say, because a row that is usually quiet
+ * trains the reaction it exists to prevent.
+ */
+export function strayFolderSettings({ supervisor }, home = os.homedir()) {
+  let list = [];
+  try { list = supervisor?.strayFolders?.() ?? []; } catch { list = []; }
+  if (!list.length) return null;
+  const count = list.length;
+  const one = count === 1;
+  const projects = [...new Set(list.map((w) => w.project).filter(Boolean))];
+  const named = list.slice(0, 3).map((w) => shortPath(w.path, home));
+  const rest = count - named.length;
+  const of = projects.length ? ` of ${projects.slice(0, 2).join(' and ')}${projects.length > 2 ? ' and other projects' : ''}` : '';
+  const now = `${count} ${one ? 'copy' : 'copies'}${of} ${one ? 'was' : 'were'} made by hand outside the folder ${NAME} keeps its own in, and ${one ? 'is' : 'are'} holding disk until you remove ${one ? 'it' : 'them'}: ${named.join(', ')}${rest > 0 ? ` and ${rest} more` : ''}. ${NAME} never removes a folder it did not make.`;
+  return { count, now };
+}
+
+export function cornerTagTurnedOff({ key, value } = {}) {
+  return key === 'cornerTag' && !value;
+}
+
+export function countsTurnedOff({ key, value } = {}) {
+  return key === 'diagnostics' && !value;
+}
+
+export function setWorkspaceSetting({ config, supervisor, store }, { key, value }) {
   switch (key) {
+    // EVERY PROJECT ON HER PHONE, or none (shared/phone-snapshot.mjs). Which
+    // ones she keeps here is remembered either way.
+    case 'phoneAll':
+      saveConfig(config, { phoneProducts: withPhoneAll(config.phoneProducts, process.env.AGENTBOX_PERSON_ID, !!value, phoneEligible(store?.listProducts?.() ?? [])) });
+      break;
+    // THE DROPDOWN'S WHOLE ANSWER AT ONCE: on or off, and which projects stay
+    // on this computer. Only project slugs that exist are kept.
+    case 'phoneProjects': {
+      const person = process.env.AGENTBOX_PERSON_ID;
+      if (!person) throw new Error('sign in first');
+      const every = phoneEligible(store?.listProducts?.() ?? []);
+      const except = Array.isArray(value?.except) ? value.except.filter((s) => every.includes(s)) : [];
+      saveConfig(config, { phoneProducts: { owner: person, all: value?.all !== false, except } });
+      break;
+    }
     case 'agentsRunning':
       supervisor.paused = !value;
       supervisor.onChange?.();
@@ -979,7 +1229,9 @@ export function setWorkspaceSetting({ config, supervisor }, { key, value }) {
       const n = Math.max(1, Math.min(MAX_SLOTS, Math.round(Number(value) || 1)));
       // Setting a number by hand IS taking the decision back, so the page never
       // shows a stepper that the supervisor is quietly ignoring.
-      saveConfig(config, { maxConcurrentSessions: n, agentsAuto: false });
+      // FOR THE WHOLE COMPUTER (w-ec27ff1a51), under its own key, so a number
+      // written per login before 5 Oct can never be read as this choice.
+      saveConfig(config, { agentsAtOnce: n, agentsAuto: false });
       // An explicit choice replaces the startup plan suggestion for BOTH
       // engines. Leaving this marker set makes Codex ignore the new number
       // until loadConfig runs again at restart. It is derived, not persisted.
@@ -1006,6 +1258,43 @@ export function setWorkspaceSetting({ config, supervisor }, { key, value }) {
       break;
     // STOP WHAT FINISHED AGENTS LEAVE RUNNING (main/leftovers.mjs). Turning it
     // on records the moment, which is the earliest the clock may start from.
+    // WHERE THREADS RUN (renderer/src/cloud-menu.ts): 'mac' turns cloud runs
+    // off, 'full' sends what does not fit here, 'all' sends everything first.
+    // Read by the supervisor per call, so it takes effect on the next tick.
+    case 'cloudRuns': {
+      const map = { mac: false, full: null, all: 'all' };
+      if (!(value in map)) throw new Error(`unknown cloud mode: ${value}`);
+      // Turning the cloud on to one meaning makes that the one C goes back to.
+      const patch = value === 'mac' ? { cloudRuns: false } : { cloudRuns: map[value], cloudWhenOn: value };
+      saveConfig(config, patch);
+      Object.assign(config, patch);
+      supervisor.wake?.();
+      supervisor.onChange?.();
+      break;
+    }
+    // WHAT "ON" MEANS (renderer/src/cloud-menu.ts): kept while the cloud is
+    // off, and taking effect at once while it is on.
+    case 'cloudWhenOn': {
+      if (value !== 'full' && value !== 'all') throw new Error(`unknown meaning of on: ${value}`);
+      const patch = config.cloudRuns === false ? { cloudWhenOn: value } : { cloudWhenOn: value, cloudRuns: value === 'all' ? 'all' : null };
+      saveConfig(config, patch);
+      Object.assign(config, patch);
+      supervisor.wake?.();
+      supervisor.onChange?.();
+      break;
+    }
+    // THE CLOUD'S OWN MODE PER ENGINE, CLOUD_SAME for this computer's, or null
+    // for the cloud's default (main/cloud-permission.mjs).
+    case 'cloudPermission':
+    case 'cloudCodexMode': {
+      const known = key === 'cloudPermission' ? CLAUDE_MODES.includes(value) : isCodexMode(value);
+      if (value != null && value !== CLOUD_SAME && !known) throw new Error(`unknown permission mode: ${value}`);
+      const patch = { [key]: value ?? null };
+      saveConfig(config, patch);
+      Object.assign(config, patch);
+      supervisor.onChange?.();
+      break;
+    }
     case 'cleanupLeftovers':
       saveConfig(config, value ? { cleanupLeftovers: true, cleanupLeftoversSince: Date.now() } : { cleanupLeftovers: false });
       supervisor.setLeftoverCleanup?.(!!value)?.catch?.((e) => console.warn('zero: leftovers:', e.message));
@@ -1029,6 +1318,31 @@ export function setWorkspaceSetting({ config, supervisor }, { key, value }) {
     case 'adhdMode':
       saveConfig(config, { adhdMode: !!value });
       break;
+    // New chats from Claude Code and Codex come in on their own
+    // (main/new-chats-watch.mjs), only those started after it went on.
+    case 'importNew':
+      if (!value) saveConfig(config, { importNew: false });
+      else if (config.importNew !== true) saveConfig(config, { importNew: true, importNewSince: Date.now() });
+      break;
+    // Rooms is read on every snapshot.
+    case 'alphaRooms':
+      saveConfig(config, { alphaRooms: !!value });
+      supervisor.onChange?.();
+      break;
+    case 'alphaTeammates':
+      saveConfig(config, { alphaTeammates: !!value });
+      supervisor.onChange?.();
+      supervisor.wake?.();
+      break;
+    case 'alphaMultiplayer':
+      saveConfig(config, { alphaMultiplayer: !!value });
+      supervisor.onChange?.();
+      break;
+    // THE CORNER TAG (w-dafae58a23). Turning it back on also ends any hide, so
+    // the switch does what it says the moment she flips it.
+    case 'cornerTag':
+      saveConfig(config, value ? { cornerTag: true, cornerTagHiddenUntil: 0 } : { cornerTag: false });
+      break;
     // WHICH ACCOUNT HER WORK RUNS ON.
     //
     // ONE KEY HOLDS BOTH ENGINES, because a profile word means different things
@@ -1037,15 +1351,15 @@ export function setWorkspaceSetting({ config, supervisor }, { key, value }) {
     // in one object keyed by engine is what stops a Codex pick being read as a
     // Claude one, which is the collision `_accountKey` exists to prevent.
     //
-    // NULL CLEARS IT, and clearing means every account runs again, which is what
-    // this machine did before she ever picked. `Supervisor#_narrowToChosen` also
-    // ignores a name that no longer exists, so a login she removes cannot wedge
-    // the fleet.
+    // NULL CLEARS IT, and clearing means the primary login runs the work again.
+    // `Supervisor#_theOneAccount` also ignores a name that no longer exists, so
+    // a login she removes cannot wedge the fleet.
     case 'activeAccount': {
       const engineId = value?.engine;
       if (!isEngine(engineId)) throw new Error(`unknown coding agent: ${engineId}`);
       const profile = typeof value?.profile === 'string' && value.profile ? value.profile : null;
       saveConfig(config, { activeAccount: { ...(config.activeAccount ?? {}), [engineId]: profile } });
+      supervisor.accountChosen?.(engineId, profile);
       supervisor.onChange?.();
       break;
     }