agentbox-app 0.1.12 → 0.1.16

package/main/source-updater.mjs

@@ -33,6 +33,7 @@
 import { execFile, execFileSync, spawn } from 'node:child_process';
 import fs from 'node:fs';
 import { describe } from './updater.mjs';
+import { loginShell } from './shell-path.mjs';
 
 const FIRST_CHECK_MS = 20_000;
 const EVERY_MS = 30 * 60 * 1000;
@@ -55,7 +56,13 @@ const SAY = {
 // on this Mac, and the restart below runs that build. Counted as her changes,
 // they made every update after the first say "changes of your own" for good
 // (tests/a-build-does-not-stop-the-next-update.test.mjs).
-const isBuildOutput = (file) => /^shared\/[^/]+\.generated\.[cm]?[jt]s$/.test(file);
+//
+// THE LOCKFILE IS NPM'S, TOO (2026-10-07). The restart's `npm install` rewrote
+// package-lock.json (this npm drops its `libc` lines), and the card never came
+// back while main ran 21 commits ahead. An edit to the dependencies themselves
+// is in package.json, which still blocks
+// (tests/a-package-install-does-not-stop-the-next-update.test.mjs).
+const isBuildOutput = (file) => file === 'package-lock.json' || /^shared\/[^/]+\.generated\.[cm]?[jt]s$/.test(file);
 // The status code is one or two letters and `gitIn` trims the output, which
 // takes the leading space off the first line, so it is matched, not sliced.
 const changedPaths = (porcelain) => String(porcelain ?? '').split('\n').filter(Boolean).map((l) => l.replace(/^[ MADRCUT?!]{1,2} /, '').replace(/^"|"$/g, ''));
@@ -97,19 +104,26 @@ function collect(bin, args, { cwd, timeout }) {
 
 // WHICH npm. Started with `npm start`, the process carries npm's own path in
 // its environment, so that one is used and nvm or a version manager never
-// matters. Started any other way, her login shell is asked, the way
-// main/claude-bin.mjs finds Claude Code. The arguments are fixed strings from
-// this file, never anything read from disk.
+// matters. Started any other way, their login shell is asked, the way
+// main/claude-bin.mjs finds Claude Code, and only a shell this machine has: a
+// Linux launcher start carries no SHELL, so the old `|| '/bin/zsh'` was a path
+// to nothing and every update on a box without zsh failed in two seconds. With
+// no shell at all, npm on PATH is the better guess. The arguments are fixed
+// strings from this file, never anything read from disk.
+export function npmCommand(args, { env = process.env, exists = fs.existsSync } = {}) {
+  const node = env.npm_node_execpath;
+  const cli = env.npm_execpath;
+  if (node && cli && exists(node) && exists(cli)) return [node, [cli, ...args]];
+  const shell = loginShell(env, exists);
+  if (!exists(shell)) return ['npm', args];
+  return [shell, ['-lic', `npm ${args.join(' ')}`]];
+}
+
 export function defaultNpm(appDir, env = process.env) {
   return (args) => {
     const timeout = args[0] === 'install' ? INSTALL_MS : BUILD_MS;
-    const node = env.npm_node_execpath;
-    const cli = env.npm_execpath;
-    if (node && cli && fs.existsSync(node) && fs.existsSync(cli)) {
-      return collect(node, [cli, ...args], { cwd: appDir, timeout });
-    }
-    const shell = env.SHELL || '/bin/zsh';
-    return collect(shell, ['-lic', `npm ${args.join(' ')}`], { cwd: appDir, timeout });
+    const [bin, argv] = npmCommand(args, { env });
+    return collect(bin, argv, { cwd: appDir, timeout });
   };
 }
 
@@ -128,6 +142,18 @@ export function createSourceUpdater({
   log = console,
   onChanged = () => {},
   npm = defaultNpm(appDir),
+  // THE STEP `npm start` DOES AND THIS DID NOT. A from-source run gets its
+  // name, icon and bundle id from scripts/brand-electron.mjs, which npm runs
+  // before Electron. An update does not go through npm: it builds and calls
+  // app.relaunch(), which re-executes the same binary. So the branding had
+  // never once run on a self-restart, and a fix to it could sit on disk for
+  // days without reaching the bundle (measured 2026-10-09, with the
+  // Info.plist four days older than the fix meant to change it).
+  // Imported here and not at the top of the file: scripts/ is deliberately not
+  // in the downloadable build (`build.files`, and a test holds it there), and
+  // a static import would stop that build booting at all. This path only ever
+  // runs from source, where the script is on disk.
+  brand = async () => (await import('../scripts/brand-electron.mjs')).brandElectron(),
   relaunch = () => { app?.relaunch(); app?.quit(); },
 } = {}) {
   const git = gitIn(appDir);
@@ -251,12 +277,20 @@ export function createSourceUpdater({
         set({ phase: 'ready', error: `The new packages would not install: ${failureLine(installed.out)}` });
         return;
       }
+      // What the install rewrote goes back, so the folder is left as main has
+      // it and anything else that fast-forwards it cannot trip on the file.
+      await git(['checkout', '--', 'package-lock.json']);
     }
     const built = await npm(['run', 'build']);
     if (built.code !== 0) {
       set({ phase: 'ready', error: `The new code would not build: ${failureLine(built.out)}` });
       return;
     }
+    // Before the relaunch, never after: the next launch is the one that reads
+    // the Info.plist. And never fatally, for the reason brand-electron.mjs
+    // opens with about itself — an app that does not come back up is worse
+    // than one wearing the wrong icon.
+    try { await brand(); } catch (e) { log.warn?.('[source-updater] could not rebrand the bundle:', e?.message ?? e); }
     log.info?.('[source-updater] built', state.newVersion, '- relaunching');
     relaunch();
   }

package/main/stage-attachment.mjs

@@ -0,0 +1,68 @@
+// STAGING A FILE FOR A REPLY BOX, before it is sent: the bytes of a paste, or
+// a copy of a picture dropped in, written into the account's .staging folder,
+// which the window may draw from (main/ipc.mjs `zero:stage-attachment` says
+// why). A picture the window cannot draw is turned into one that it can here,
+// so the box, the message and the teammate all get a picture.
+import { execFile } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { turnedName } from '../shared/picture-formats.mjs';
+
+const WEEK = 7 * 24 * 60 * 60 * 1000;
+const SIPS_MS = 30_000;
+
+/**
+ * Answers `{ path }`, and `name` too when the file was turned into another
+ * format, which is the name it goes on under.
+ */
+export async function stageAttachment(dir, { name, dataBase64, srcPath } = {}, { turn = turnIntoPicture } = {}) {
+  fs.mkdirSync(dir, { recursive: true });
+  // Sweep on the way in rather than on a timer: an abandoned paste is only
+  // ever discovered by the next one, and a week is longer than any draft has
+  // been left open. Failure to sweep must never fail the paste.
+  try {
+    const week = Date.now() - WEEK;
+    for (const f of fs.readdirSync(dir)) {
+      const p = path.join(dir, f);
+      try { if (fs.statSync(p).mtimeMs < week) fs.unlinkSync(p); } catch { /* leave it */ }
+    }
+  } catch { /* a sweep that cannot run is not a paste that failed */ }
+  const safe = String(name ?? 'pasted.png').replace(/[^\w.-]+/g, '-').slice(0, 80);
+  const abs = path.join(dir, `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}-${safe}`);
+  // A path is a drag, bytes are a paste. Already inside the folder we serve
+  // from is left alone: copying it would only make a second file to sweep.
+  if (typeof srcPath === 'string' && srcPath) {
+    if (path.resolve(srcPath) === path.resolve(path.join(dir, path.basename(srcPath)))) return { path: srcPath };
+    fs.copyFileSync(srcPath, abs);
+  } else {
+    fs.writeFileSync(abs, Buffer.from(String(dataBase64 ?? ''), 'base64'));
+  }
+  const as = turnedName(name ?? safe);
+  if (!as) return { path: abs };
+  // One that cannot be turned goes as the file it is, which is how every TIFF went before.
+  const drawn = await Promise.resolve().then(() => turn(abs)).catch(() => null);
+  if (!drawn) return { path: abs };
+  try { fs.unlinkSync(abs); } catch { /* swept within the week */ }
+  return { path: drawn, name: as };
+}
+
+/**
+ * Turns a TIFF or HEIC into a PNG or JPEG beside it with the Mac's own sips,
+ * and answers the new file's path. Null off a Mac, for any other file, or
+ * when sips fails or writes nothing.
+ */
+export async function turnIntoPicture(file, { platform = process.platform, run = sips } = {}) {
+  const as = turnedName(path.basename(file));
+  if (!as || platform !== 'darwin') return null;
+  const out = path.join(path.dirname(file), as);
+  try {
+    await run(['-s', 'format', as.endsWith('.png') ? 'png' : 'jpeg', file, '--out', out]);
+    return fs.statSync(out).size > 0 ? out : null;
+  } catch {
+    return null;
+  }
+}
+
+const sips = (args) => new Promise((resolve, reject) => {
+  execFile('/usr/bin/sips', args, { timeout: SIPS_MS }, (err) => (err ? reject(err) : resolve()));
+});

package/main/stall-watch.mjs

@@ -0,0 +1,50 @@
+// WHICH REQUEST HELD THE APP. A spinning wheel on a Mac is the main process
+// not answering, and nothing used to record what it was doing instead. This
+// times every request the window makes and keeps the longest freeze; the
+// memory log writes both into its minute line (main/memory-log.mjs).
+//
+// Only the synchronous part of a handler is timed. That is the part that holds
+// the process: once a handler waits on a promise the window is free again.
+import { monitorEventLoopDelay, performance } from 'node:perf_hooks';
+
+export const SLOW_MS = 100;
+
+export function stallWatch({ clock = () => performance.now(), loop = monitorEventLoopDelay({ resolution: 20 }) } = {}) {
+  loop.enable();
+  let slow = new Map();
+  let freezes = [];
+  return {
+    /** A freeze main/freeze-recorder.mjs caught, with the function that held it. */
+    noteFreeze({ ms, where }) {
+      freezes.push({ ms, where });
+    },
+    time(channel, fn) {
+      return (...args) => {
+        const start = clock();
+        try {
+          return fn(...args);
+        } finally {
+          const ms = Math.round(clock() - start);
+          if (ms >= SLOW_MS) {
+            const seen = slow.get(channel) ?? { channel, times: 0, maxMs: 0 };
+            seen.times += 1;
+            seen.maxMs = Math.max(seen.maxMs, ms);
+            slow.set(channel, seen);
+          }
+        }
+      };
+    },
+    /** The minute so far, and a fresh start. */
+    take() {
+      const out = {
+        longestStallMs: Math.round(loop.max / 1e6),
+        slowRequests: [...slow.values()].sort((a, b) => b.maxMs - a.maxMs).slice(0, 5),
+        ...(freezes.length ? { freezes: freezes.sort((a, b) => b.ms - a.ms).slice(0, 5) } : {}),
+      };
+      loop.reset();
+      slow = new Map();
+      freezes = [];
+      return out;
+    },
+  };
+}

package/main/start-hold.mjs

@@ -0,0 +1,73 @@
+// NO NEW AGENT STARTS WHILE MEMORY IS SHORT (w-ec27ff1a51).
+//
+// 2026-10-11, a 16 GB Mac ran out of application memory with Agentbox at
+// 22 GB and six agents running. The memory check (main/memory-gate.mjs) held
+// tests and builds back, but nothing asked memory before STARTING an agent, so
+// the fleet filled every slot it had into a Mac that was already short.
+//
+// So while the memory switch is on and the Mac reads tight or very short, a new
+// agent waits. That is the whole rule. Everything else here is a way out of it,
+// because the founder's condition was that urgent work still comes first and
+// that nothing sits stuck for long on a misread:
+//
+//   - NOTHING RUNNING, ONE STARTS. Whatever is filling memory then is not us,
+//     and an app with no agent running at all is broken rather than careful.
+//   - AN URGENT ROW, OR ONE SHE ASKED FOR BY NAME, starts while tight and waits
+//     only while very short: the command gate's rule for urgent commands.
+//   - A SWAP IS NOT A NEW AGENT. A row something was paused for (an Urgent row
+//     taking a lesser session's slot, or Run now) always starts, so urgent work
+//     still takes over while memory is very short, by replacing, not adding.
+//   - A READING THAT IS MISSING, UNREADABLE OR OLDER THAN A MINUTE IS NOT A
+//     REASON TO HOLD. The hold acts only on a reading it actually has.
+//   - TEN MINUTES HELD, ONE STARTS ANYWAY, and the ten minutes start again from
+//     it. A reading stuck on "tight" by mistake costs a slow queue, never a
+//     stopped one.
+//
+// Pure, so every one of those is a test (tests/no-new-agent-starts-while-memory-is-short).
+
+import { execFileSync } from 'node:child_process';
+import { pressureFrom } from './memory-gate.mjs';
+
+/** One reading, synchronously, for the moment before a restart brings the
+ *  fleet back. Nulls (so no hold) when it cannot be read. */
+export function readMacPressureNow() {
+  let level = null;
+  let freePct = null;
+  try {
+    const out = execFileSync('/usr/sbin/sysctl', ['-n', 'kern.memorystatus_vm_pressure_level', 'kern.memorystatus_level'],
+      { timeout: 2_000, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+    [level, freePct] = out.trim().split(/\s+/).map(Number);
+  } catch { /* not a Mac, or sysctl did not answer */ }
+  return { level: Number.isFinite(level) ? level : null, freePct: Number.isFinite(freePct) ? freePct : null, at: Date.now() };
+}
+
+/** A reading older than this is not acted on. */
+export const STALE_MS = 60_000;
+/** The longest new work waits on memory before one agent starts anyway. */
+export const MAX_HOLD_MS = 10 * 60_000;
+
+/**
+ * Whether one more agent may start now, and why. `reading` is
+ * `{ level, freePct, at }` from `readMacPressure`, stamped when it arrived.
+ * `heldSince` is when the current hold began (null when nothing is held);
+ * `lastStartAt` is when an agent last started.
+ */
+export function startDecision({
+  on, reading, now, running,
+  urgent = false, asked = false, swap = false,
+  lastStartAt = 0, heldSince = null,
+  staleMs = STALE_MS, maxHoldMs = MAX_HOLD_MS,
+}) {
+  if (!on) return { start: true, why: 'off' };
+  if (!(running > 0)) return { start: true, why: 'nothing-running' };
+  if (swap) return { start: true, why: 'swap' };
+  const at = Number(reading?.at);
+  const known = reading && (Number.isFinite(reading.level) || Number.isFinite(reading.freePct));
+  if (!known || !Number.isFinite(at) || Math.abs(now - at) > staleMs) return { start: true, why: 'no-reading' };
+  const pressure = pressureFrom(reading);
+  if (pressure === 'normal') return { start: true, why: 'normal' };
+  if (pressure === 'tight' && (urgent || asked)) return { start: true, why: 'urgent' };
+  const waitingSince = Math.max(heldSince ?? now, Number(lastStartAt) || 0);
+  if (now - waitingSince >= maxHoldMs) return { start: true, why: 'overdue' };
+  return { start: false, why: pressure };
+}