agentbox-app 0.1.13 → 0.1.16

package/main/engine-setup.mjs

@@ -66,10 +66,10 @@ const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 /**
  * One setup per tool, held for the life of the app.
  *
- * `find(engine)` is the finder, looking again from scratch (the caller passes
- * `recheckClaude` / `recheckCodex`, which also move the config so the rest of
- * the app runs on what was just installed). `spawn` and `wait` are seams for
- * the tests; nothing in the app passes them.
+ * `find(engine)` is the finder, looking again from scratch, and may answer
+ * with a promise (the caller passes `lookAgainFor`, which also moves the
+ * config so the rest of the app runs on what was just installed). `spawn` and
+ * `wait` are seams for the tests; nothing in the app passes them.
  */
 export function createEngineSetup({ find, spawn = realSpawn, wait = sleep, env = process.env, poll = POLL, onSignIn = () => {} } = {}) {
   const runEnv = terminalEnv(env);
@@ -109,7 +109,11 @@ export function createEngineSetup({ find, spawn = realSpawn, wait = sleep, env =
 
   async function go(j, run) {
     const live = () => j.run === run;
-    let hit = find(j.engine);
+    let hit = await find(j.engine);
+    if (!live()) return;
+    // The card's first row says Found or Install off this, because it ticks
+    // that row either way.
+    j.already = !!hit?.found;
     if (!hit?.found) {
       j.phase = 'installing';
       const { file, args } = installCommand(j.engine);
@@ -119,7 +123,7 @@ export function createEngineSetup({ find, spawn = realSpawn, wait = sleep, env =
       j.running = null;
       if (!live()) return;
       if (code !== 0) return fail(j, `The installer stopped: ${lastLine(j.log) || `exit ${code}`}`);
-      hit = find(j.engine);
+      hit = await find(j.engine);
       if (!hit?.found) return fail(j, 'The installer finished, but the app still cannot find it.');
     }
     j.bin = hit.path;
@@ -140,7 +144,15 @@ export function createEngineSetup({ find, spawn = realSpawn, wait = sleep, env =
         ended = false;
         watchLogin(login);
       }
-      if (ended) return fail(j, `The sign-in was closed before it finished.${lastLine(j.log) ? ` ${lastLine(j.log)}` : ''}`);
+      // ASK ONCE MORE BEFORE CALLING IT CLOSED. A sign-in that finishes while
+      // the check above is running exits before that check answers, and the
+      // check, asked a moment too early, says no. Without this, somebody who
+      // had just approved it was told it was closed.
+      if (ended) {
+        if (await signedIn(j, hit.path)) { if (live()) ready(j); return; }
+        if (!live()) return;
+        return fail(j, `The sign-in was closed before it finished.${lastLine(j.log) ? ` ${lastLine(j.log)}` : ''}`);
+      }
     }
   }
 
@@ -172,14 +184,14 @@ export function createEngineSetup({ find, spawn = realSpawn, wait = sleep, env =
     },
     status(engine) {
       const j = job(engine);
-      return { engine, phase: j.phase, error: j.error, log: j.log };
+      return { engine, phase: j.phase, error: j.error, log: j.log, bin: j.bin ?? null, already: !!j.already };
     },
     /**
      * WHETHER THIS TOOL CAN RUN AN AGENT RIGHT NOW: found, and signed in by its
      *  own account. The walk asks before it asks anything, so a Mac that is
      *  already set up never sees the plan question. */
     async readiness(engine) {
-      const hit = find(engine);
+      const hit = await find(engine);
       if (!hit?.found) return { engine, found: false, signedIn: false };
       try { return { engine, found: true, signedIn: await signedIn({ engine, log: '' }, hit.path) }; }
       catch (error) { return { engine, found: true, signedIn: false, error: error.message }; }

package/main/feedback.mjs

@@ -16,8 +16,9 @@
 // It is not behind the diagnostics switch. That switch is about what Agentbox
 // sends on its own; this is something a person typed and pressed Send on.
 import { createRequire } from 'node:module';
-import { checkFeedback } from '../shared/feedback.mjs';
-import { Name, readEnv } from '../shared/product-name.mjs';
+import { readEnv } from '../shared/product-name.mjs';
+
+export { sendFeedback } from '../shared/feedback.mjs';
 
 export const FEEDBACK_ADDRESS = 'https://lywvthwkhkfzhqivvond.supabase.co/functions/v1/feedback';
 
@@ -35,26 +36,3 @@ const clean = (v) => (typeof v === 'string' && v.trim() ? v.trim() : null);
 export function feedbackUrl(config, baked = BAKED, env = process.env) {
   return clean(config?.feedbackUrl) ?? clean(readEnv('FEEDBACK_URL', env)) ?? clean(baked);
 }
-
-// Answers { ok: true } or { ok: false, error } with the error as a sentence.
-// It never throws, so the card always has something to say.
-export async function sendFeedback({ url, payload, fetchImpl = globalThis.fetch, timeoutMs = 60_000 }) {
-  if (!url) return { ok: false, error: `Feedback is not set up in this copy of ${Name}.` };
-  // Checked again here, off the bytes that would actually travel, since the
-  // renderer is not the last word on what leaves this machine.
-  const sized = (payload?.files ?? []).map((f) => ({ size: Math.floor((String(f?.data ?? '').length * 3) / 4) }));
-  const check = checkFeedback({ text: payload?.text, files: sized });
-  if (!check.ok) return { ok: false, error: check.reason };
-  try {
-    const res = await fetchImpl(url, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify(payload),
-      signal: AbortSignal.timeout(timeoutMs),
-    });
-    if (res?.ok) return { ok: true };
-    return { ok: false, error: 'It did not send. Try again in a moment.' };
-  } catch {
-    return { ok: false, error: 'It did not send. Check your connection and try again.' };
-  }
-}

package/main/folder-pictures.mjs

@@ -17,10 +17,10 @@ import { servable } from './img-scheme.mjs';
 
 const PICTURE = /\.(png|jpe?g|gif|webp|avif)$/i;
 
-export function folderPictures({ src, product, products = [], accountRoot, storeRoot, limit = 60, fs = fsDefault }) {
+export async function folderPictures({ src, product, products = [], accountRoot, storeRoot, limit = 60, fs = fsDefault }) {
   if (typeof src !== 'string' || !src.trim()) return { ok: false, error: 'No folder was named.' };
   const named = src.replace(/\/+$/, '');
-  const found = resolveArtifact({ src: named, product, products, accountRoot, storeRoot, fs });
+  const found = await resolveArtifact({ src: named, product, products, accountRoot, storeRoot, fs });
   if (!found.ok) return { ok: false, error: found.error };
   const own = products.find((p) => p.slug === product) ?? null;
   const roots = [accountRoot, own?.dir, own?.repoPath].filter(Boolean);

package/main/freeze-recorder-thread.mjs

@@ -0,0 +1,86 @@
+// THE OTHER END OF main/freeze-recorder.mjs: the watcher, on its own thread.
+//
+// The profile is rotated every `rotateMs` so it never grows, and at the end of
+// each freeze so the freeze is in the one it hands back. The one before is
+// kept too, because a freeze can start before a rotation and end after it.
+import { Session } from 'node:inspector';
+import { parentPort, workerData } from 'node:worker_threads';
+import { freezeFrom, writeFreeze } from './freeze-recorder.mjs';
+
+const { beat, dir, appDir, thresholdMs, rotateMs, intervalUs } = workerData;
+const stamp = new BigInt64Array(beat);
+const nowUs = () => Number(process.hrtime.bigint() / 1000n);
+// The main thread asleep rather than stuck (App Nap timers, say) has an idle
+// profile. Below this share of busy samples it is not a freeze.
+const BUSY_ENOUGH = 0.5;
+
+const session = new Session();
+const post = (method, params = {}) => new Promise((resolve, reject) => {
+  session.post(method, params, (err, out) => (err ? reject(err) : resolve(out)));
+});
+
+let running = null;  // { anchorUs } of the profile being taken
+let previous = null; // { profile, offsetUs } of the last one stopped
+let frozeAt = null;  // the last stamp before the freeze in progress, in µs
+const seen = [];     // freezes ended and not yet cut out of a profile
+let busy = false;
+
+async function start() {
+  const before = nowUs();
+  await post('Profiler.start');
+  running = { anchorUs: (before + nowUs()) / 2 };
+}
+
+async function rotate() {
+  const { profile } = await post('Profiler.stop');
+  const stopped = { profile, offsetUs: profile.startTime - running.anchorUs };
+  await start();
+  const profiles = [previous, stopped].filter(Boolean);
+  previous = stopped;
+  for (const f of seen.splice(0)) {
+    const read = freezeFrom(profiles, { fromUs: f.fromUs, toUs: f.toUs, appDir });
+    if (read.busy < BUSY_ENOUGH) continue;
+    const line = { at: new Date(Date.now() - (nowUs() - f.fromUs) / 1000).toISOString(), ms: Math.round((f.toUs - f.fromUs) / 1000), ...read };
+    writeFreeze(dir, line);
+    parentPort.postMessage({ freeze: { at: line.at, ms: line.ms, where: line.where } });
+  }
+}
+
+// A freeze that ends while a rotation is under way goes round again.
+async function turn() {
+  if (busy || !running) return;
+  busy = true;
+  try {
+    do { await rotate(); } while (seen.length);
+  } catch (err) { quit(err); } finally { busy = false; }
+}
+
+function watch() {
+  const last = Number(Atomics.load(stamp, 0) / 1000n);
+  if (nowUs() - last > thresholdMs * 1000) { frozeAt ??= last; return; }
+  if (frozeAt === null) return;
+  seen.push({ fromUs: frozeAt, toUs: last });
+  frozeAt = null;
+  void turn();
+}
+
+let watching = null;
+let rotating = null;
+function quit(err) {
+  clearInterval(watching);
+  clearInterval(rotating);
+  try { session.disconnect(); } catch { /* already gone */ }
+  parentPort.postMessage({ gaveUp: String(err?.message ?? err) });
+}
+
+// The timers go first: an inspector reply does not keep this thread alive.
+watching = setInterval(watch, 50);
+rotating = setInterval(() => { if (frozeAt === null) void turn(); }, rotateMs);
+try {
+  session.connectToMainThread();
+  await post('Profiler.enable');
+  await post('Profiler.setSamplingInterval', { interval: intervalUs });
+  await start();
+} catch (err) {
+  quit(err);
+}

package/main/freeze-recorder.mjs

@@ -0,0 +1,146 @@
+// WHAT THE MAIN THREAD WAS DOING WHEN THE APP FROZE.
+//
+// The spinning wheel is this thread not answering, and it comes when nobody is
+// profiling. So a thread of its own watches all the time: the main thread
+// stamps a clock every 100 ms, the
+// watcher keeps a low-rate CPU profile of it running through the inspector,
+// and when the stamps stop for longer than `thresholdMs` it cuts that stretch
+// out of the profile and writes one line saying which of our functions held
+// it, to `freeze-<day>.jsonl` beside the memory log, kept a week.
+//
+// It stays on this computer. Nothing here is sent anywhere.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Worker } from 'node:worker_threads';
+
+export const THRESHOLD_MS = 500;
+export const KEEP_DAYS = 7;
+const BEAT_MS = 100;
+const FILE = /^freeze-(\d{4}-\d{2}-\d{2})\.jsonl$/;
+const IDLE = new Set(['(idle)', '(program)']);
+const GC = '(garbage collector)';
+const FRAMES_KEPT = 12;
+
+export const dayOf = (ms) => {
+  const d = new Date(ms);
+  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
+};
+
+function fileOf(url, appDirs) {
+  if (!url) return '';
+  let file = url;
+  if (url.startsWith('file://')) { try { file = fileURLToPath(url); } catch { /* keep the url */ } }
+  const appDir = appDirs.find((d) => file.startsWith(d + path.sep));
+  if (appDir) return file.slice(appDir.length + 1);
+  if (file.startsWith('node:') || !path.isAbsolute(file)) return file;
+  // Never a home path in the log: a file outside the app is named by its last parts.
+  return `…/${file.split(path.sep).slice(-2).join('/')}`;
+}
+
+// The profile names a file by its real path, which on macOS is /private/var for /var.
+const realPath = (dir) => { try { return dir ? fs.realpathSync(dir) : ''; } catch { return ''; } };
+
+const ours = (frame) => /\.(m?js|cjs|ts)$/.test(frame.file) && !/^(node:|…\/)/.test(frame.file) && !frame.file.includes('node_modules');
+const named = (f) => (f.file ? `${f.fn} ${f.file}:${f.line}` : f.fn);
+
+/**
+ * What held the thread between `fromUs` and `toUs`, read off one or more CPU
+ * profiles. Times are on the watcher's clock; `offsetUs` is each profile's
+ * clock minus that one. `appDir` is one path or several. Pure.
+ */
+export function freezeFrom(profiles, { fromUs, toUs, appDir = '' }) {
+  const appDirs = [appDir].flat().filter(Boolean);
+  const groups = new Map();
+  let total = 0;
+  let idle = 0;
+  let gc = 0;
+  for (const { profile, offsetUs = 0 } of profiles) {
+    if (!profile?.nodes?.length || !profile.samples?.length) continue;
+    const byId = new Map(profile.nodes.map((n) => [n.id, n]));
+    const parent = new Map();
+    for (const n of profile.nodes) for (const c of n.children ?? []) parent.set(c, n.id);
+    const stacks = new Map();
+    const stackOf = (id) => {
+      if (stacks.has(id)) return stacks.get(id);
+      const frames = [];
+      for (let at = id; at != null; at = parent.get(at)) {
+        const cf = byId.get(at)?.callFrame;
+        if (!cf || cf.functionName === '(root)') continue;
+        frames.push({ fn: cf.functionName || '(anonymous)', file: fileOf(cf.url, appDirs), line: cf.url ? cf.lineNumber + 1 : 0 });
+      }
+      const leaf = frames[0]?.fn ?? '(program)';
+      const kind = frames.length <= 1 && IDLE.has(leaf) ? 'idle' : leaf === GC ? 'gc' : 'busy';
+      const first = frames.findIndex(ours);
+      const mine = first < 0 ? [] : frames.slice(first);
+      const s = { kind, frames, where: mine[0] ? named(mine[0]) : leaf, key: `${leaf}|${mine.slice(0, 10).map(named).join('<')}` };
+      stacks.set(id, s);
+      return s;
+    };
+    let t = profile.startTime - offsetUs;
+    for (let i = 0; i < profile.samples.length; i += 1) {
+      t += profile.timeDeltas?.[i] ?? 0;
+      if (t < fromUs || t > toUs) continue;
+      total += 1;
+      const s = stackOf(profile.samples[i]);
+      if (s.kind === 'idle') { idle += 1; continue; }
+      if (s.kind === 'gc') gc += 1;
+      const g = groups.get(s.key) ?? { samples: 0, s };
+      g.samples += 1;
+      groups.set(s.key, g);
+    }
+  }
+  const busy = total - idle;
+  const top = [...groups.values()].sort((a, b) => b.samples - a.samples).slice(0, 3);
+  return {
+    samples: total,
+    busy: total ? Math.round((busy / total) * 100) / 100 : 0,
+    gc: busy ? Math.round((gc / busy) * 100) / 100 : 0,
+    where: top[0]?.s.where ?? null,
+    stacks: top.map((g) => ({ share: Math.round((g.samples / busy) * 100) / 100, frames: g.s.frames.slice(0, FRAMES_KEPT).map(named) })),
+  };
+}
+
+/** One freeze's line, appended to today's file; older files than a week go. */
+export function writeFreeze(dir, line, { keepDays = KEEP_DAYS } = {}) {
+  fs.mkdirSync(dir, { recursive: true });
+  const at = Date.parse(line.at) || Date.now();
+  fs.appendFileSync(path.join(dir, `freeze-${dayOf(at)}.jsonl`), `${JSON.stringify(line)}\n`);
+  const oldest = dayOf(new Date(at).setDate(new Date(at).getDate() - (keepDays - 1)));
+  for (const f of fs.readdirSync(dir)) {
+    const m = f.match(FILE);
+    if (m && m[1] < oldest) fs.rmSync(path.join(dir, f), { force: true });
+  }
+}
+
+/**
+ * Starts the watcher for this thread. `onFreeze` hears each line as it is
+ * written. Never throws: a recorder that breaks the app is worse than a gap.
+ */
+export function startFreezeRecorder({ dir, appDir = '', thresholdMs = THRESHOLD_MS, rotateMs = 60_000, intervalUs = 10_000, onFreeze = () => {} } = {}) {
+  const beat = new SharedArrayBuffer(8);
+  const stamp = new BigInt64Array(beat);
+  const tick = () => Atomics.store(stamp, 0, process.hrtime.bigint());
+  tick();
+  const timer = setInterval(tick, BEAT_MS);
+  timer.unref?.();
+  let worker = null;
+  try {
+    worker = new Worker(new URL('./freeze-recorder-thread.mjs', import.meta.url), {
+      workerData: { beat, dir, appDir: [appDir, realPath(appDir)], thresholdMs, rotateMs, intervalUs },
+    });
+  } catch (err) {
+    clearInterval(timer);
+    console.warn(`zero: freezes will not be recorded: ${err.message}`);
+    return { stop() {} };
+  }
+  worker.unref();
+  worker.on('message', (m) => {
+    if (m?.freeze) { try { onFreeze(m.freeze); } catch { /* the line is already on disk */ } }
+    if (m?.gaveUp) console.warn(`zero: freezes will not be recorded: ${m.gaveUp}`);
+  });
+  worker.on('error', (err) => { clearInterval(timer); console.warn(`zero: the freeze recorder stopped: ${err.message}`); });
+  return {
+    stop() { clearInterval(timer); worker?.terminate().catch(() => {}); },
+  };
+}

package/main/fresh-user.mjs

@@ -44,6 +44,22 @@ export function relaunchCommand({ execPath = process.execPath, argv = process.ar
   return { bin: execPath, args: appPath ? [appPath] : [] };
 }
 
+/**
+ * THE NOTES ARE THE HONEST PART. Each is something a fresh copy can be missing
+ *  without looking broken, and a copy that quietly cannot run an agent is one
+ *  that lies, so they are said rather than assumed.
+ *
+ *  Pure, and reads nothing, because what it says about a missing Claude Code
+ *  otherwise depends on whether the computer running the test has one.
+ */
+export function freshUserNotes({ claudeBin, keychain, agents } = {}, { withTools = true, withAgents = true } = {}) {
+  const notes = [];
+  if (withTools && !claudeBin) notes.push('That copy has no Claude Code of its own, so its setup offers to set one up or to use ChatGPT.');
+  if (!keychain) notes.push('There is no ~/Library/Keychains here, so Claude Code will say it is not logged in.');
+  if (withAgents && !agents) notes.push('There is no ~/.claude on this computer, so it will have no agents to offer.');
+  return notes;
+}
+
 /**
  * Open one. Returns what happened, in the words the app will show her: this
  *  is reported to the window rather than thrown, because a row in ⌘K that
@@ -90,15 +106,10 @@ export function openFreshUser({
     return { ok: false, error: `Could not start a second ${NAME}: ${err?.message ?? err}`, home: prepared.home };
   }
 
-  // THE NOTES ARE THE HONEST PART. Both of these are things a fresh copy can
-  // be missing without looking broken, and a test that quietly cannot run an
-  // agent is a test that lies. They are said rather than assumed.
-  const notes = [];
-  if (withTools && !prepared.claudeBin) notes.push('Claude Code is not at ~/.local/bin/claude, so agents will not run in it.');
-  if (!prepared.keychain) notes.push('There is no ~/Library/Keychains here, so Claude Code will say it is not logged in.');
-  if (withAgents && !prepared.agents) notes.push('There is no ~/.claude on this computer, so it will have no agents to offer.');
-
-  return { ok: true, home: prepared.home, agents: prepared.agents, notes, pid: child?.pid ?? null };
+  return {
+    ok: true, home: prepared.home, agents: prepared.agents, pid: child?.pid ?? null,
+    notes: freshUserNotes(prepared, { withTools, withAgents }),
+  };
 }
 
 /**

package/main/git-change-offthread.mjs

@@ -9,9 +9,11 @@
 // runs whole inside a worker thread, and if the thread cannot start the job
 // runs here, the old way.
 import { Worker } from 'node:worker_threads';
-import * as change from './git-change.mjs';
+import * as git from './git-change.mjs';
+import { saveRunChange } from './run-change.mjs';
 
-const JOBS = new Set(['snapshotRepo']);
+const change = { ...git, saveRunChange };
+const JOBS = new Set(['snapshotRepo', 'saveRunChange']);
 
 let worker = null;
 let broken = false;
@@ -55,6 +57,11 @@ function thread() {
   return worker;
 }
 
+/** Settles once no job is waiting on the thread. */
+export async function __gitJobsIdle() {
+  while (waiting.size) await new Promise((resolve) => { setTimeout(resolve, 10); });
+}
+
 /** Run one of git-change.mjs's exports without blocking this thread. */
 export function gitJob(name, ...args) {
   if (!JOBS.has(name)) return Promise.reject(new Error(`not a git job: ${name}`));
@@ -65,6 +72,13 @@ export function gitJob(name, ...args) {
     const id = ++seq;
     waiting.set(id, job);
     w.ref();
-    w.postMessage({ id, name, args });
+    try {
+      w.postMessage({ id, name, args });
+    } catch (error) {
+      // Arguments a thread cannot be handed (a function, say) run here.
+      waiting.delete(id);
+      if (!waiting.size) w.unref();
+      runHere(job);
+    }
   });
 }

package/main/git-change-thread.mjs

@@ -1,10 +1,13 @@
 // THE OTHER END OF main/git-change-offthread.mjs. One job at a time, in order.
 import { parentPort } from 'node:worker_threads';
-import * as change from './git-change.mjs';
+import * as git from './git-change.mjs';
+import { saveRunChange } from './run-change.mjs';
+
+const jobs = { ...git, saveRunChange };
 
 parentPort.on('message', ({ id, name, args }) => {
   try {
-    parentPort.postMessage({ id, ok: true, value: change[name](...args) });
+    parentPort.postMessage({ id, ok: true, value: jobs[name](...args) });
   } catch (error) {
     parentPort.postMessage({ id, ok: false, error: String(error?.message ?? error) });
   }

package/main/harnesses/claude.mjs

@@ -10,11 +10,20 @@ import { claudeModelRows } from '../claude-models.mjs';
 import { linkAccountTooling } from '../account-tooling.mjs';
 import { streamInputArgs, attachClaudeInput } from '../claude-input.mjs';
 import { claudeLaunchEnv } from '../claude-launch-env.mjs';
+import { cloudClaudeMode, cloudPermissionArgs } from '../cloud-permission.mjs';
 import { claudeActivity } from '../agent-activity.mjs';
 import { captureStream, streamingText, summarizeStreamLine, traceStreamLine } from './claude-stream.mjs';
 import { definitionMethods, commonUpdatePlan } from './common.mjs';
+import { findTranscript } from '../transcript-search.mjs';
 const definition = harnessDefinition('claude');
 
+// THE SETTINGS LAYER THAT TAKES A METERED KEY BACK OFF A RUN. Claude Code reads
+// `env.ANTHROPIC_API_KEY` and `apiKeyHelper` out of a person's own and a
+// project's settings files, past any scrub of the environment, and `--settings`
+// outranks both (measured on 2.1.301, w-6d8c543a43). Every Claude Code run the
+// app starts carries it: workers in their settings file, small calls inline.
+export const NO_METERED_KEY = Object.freeze({ env: Object.freeze({ ANTHROPIC_API_KEY: '' }), apiKeyHelper: '' });
+
 export const claudeHarness = {
   ...definitionMethods(definition),
   discover: resolveClaudeBin,
@@ -33,7 +42,27 @@ export const claudeHarness = {
     return [path.join(home, '.claude.json'), ...definition.credentialFiles.map(file => path.join(dir, file))];
   },
   tooling: profile => linkAccountTooling(profile),
-  spawn(sup, plan, { cwd, item, profile, env }) {
+  // A cloud run's command line and environment. A kit for the phone is made
+  // from the same two (Supervisor#_writeKit), so the cloud's turn is this one.
+  cloudLaunch(sup, plan, { item, profile, env }) {
+    return {
+      args: streamInputArgs(definition.run, cloudPermissionArgs(plan.args, cloudClaudeMode(sup.config.cloudPermission, plan.answerMode))),
+      env: { ...env, STORE_ACCOUNT_ID: sup.config.accountId, ...storeRootEnv(sup.config.storeRoot),
+        CLAUDE_CONFIG_DIR: sup._claudeConfigDir(profile), ZERO_PRODUCT: item.product, ZERO_ITEM: item.id, ...sup._cloudDocsEnv(item) },
+    };
+  },
+  spawn(sup, plan, { cwd, item, profile, env, cloud = false }) {
+    // A CLOUD RUN: THE SAME ARGUMENTS, A DIFFERENT PROGRAM (docs/cloud/PLAN.md).
+    // main/cloud/run-cli.mjs runs Claude Code in the sandbox with exactly these
+    // arguments and is, to everything above, the worker: its stdout is the
+    // agent's stream, its stdin reaches the agent, its exit comes after the
+    // agent's work is back in `cwd`. The account folder is always named,
+    // because the run unpacks the transcript and tooling into exactly that
+    // path. No memory-gate variables: that gate is about this Mac's memory.
+    if (cloud) {
+      const launch = claudeHarness.cloudLaunch(sup, plan, { item, profile, env });
+      return sup._spawnCloudRelay(launch.args, { cwd, env: launch.env });
+    }
     // The binary is the one this definition names, not a field spelled out
     // here: that is the last place an engine of this family needed code.
     return spawn(sup.config[definition.binKey], streamInputArgs(definition.run, plan.args), {
@@ -60,20 +89,12 @@ export const claudeHarness = {
   transcript(sup, rec) {
     if (!rec?.sessionId) return null;
     const home = rec.profile && rec.profile !== 'default' ? rec.profile : path.join(os.homedir(), '.claude');
-    const projects = path.join(home, 'projects');
-    const slug = String(rec.cwd ?? '').replace(/[^a-zA-Z0-9]/g, '-');
-    const direct = path.join(projects, slug, `${rec.sessionId}.jsonl`);
-    if (fs.existsSync(direct)) return direct;
-    try { for (const dir of fs.readdirSync(projects)) {
-      const file = path.join(projects, dir, `${rec.sessionId}.jsonl`);
-      if (fs.existsSync(file)) return file;
-    } } catch {}
-    return null;
+    return findTranscript(path.join(home, 'projects'), rec.sessionId, rec.cwd, { look: rec.cloud ? 'never' : 'now' });
   },
   change: () => null,
   release: () => {},
   memoryGate: (sup, item) => sup.memoryGateEnv(item),
-  smallModelArgs: (prompt, model) => ['-p', prompt, '--model', model],
+  smallModelArgs: (prompt, model) => ['-p', prompt, '--model', model, '--settings', JSON.stringify(NO_METERED_KEY)],
   updateSettings: ({ home }) => {
     try { return JSON.parse(fs.readFileSync(path.join(process.env.CLAUDE_CONFIG_DIR || path.join(home, '.claude'), 'settings.json'), 'utf8')); }
     catch { return {}; }

package/main/harnesses/codex.mjs

@@ -3,7 +3,8 @@ import { harnessDefinition } from '../../shared/harness-definitions.mjs';
 import { resolveCodexBin } from '../codex-bin.mjs';
 import { codexLaunchEnv } from '../codex-launch-env.mjs';
 import { codexModels, codexDefaultModel, codexModelLevels } from '../codex-models.mjs';
-import { codexTranscriptFile, workerThreadParams } from '../codex-session.mjs';
+import { codexTranscriptFile, workerThreadParams, refusedCodexWorker } from '../codex-session.mjs';
+import { codexKeyRefusal } from '../codex-account.mjs';
 import { compactCodexThread } from '../codex-compaction.mjs';
 import { captureCodexEvent, codexStreamingText, summarizeCodexEvent, traceCodexEvent, rememberCodexChange, changeFromCodexTurn } from '../codex.mjs';
 import { codexActivity } from '../agent-activity.mjs';
@@ -29,7 +30,13 @@ export const codexHarness = {
   // rather than inheriting the refusal meant for an engine that has nowhere to
   // put them (main/harnesses/instructions-file.mjs).
   instructions: () => ({ by: 'thread' }),
-  spawn: (sup, plan, context) => sup._spawnCodexWorker(plan, context),
+  // AN API-KEY LOGIN IS REFUSED HERE, before an app-server is asked anything:
+  // Codex reads the key out of auth.json itself, past the worker scrub, and
+  // bills every call to it (main/codex-account.mjs `codexKeyRefusal`).
+  spawn: (sup, plan, context) => {
+    const refusal = codexKeyRefusal(sup._codexProfileHome(context?.profile ?? 'default'));
+    return refusal ? refusedCodexWorker(refusal) : sup._spawnCodexWorker(plan, context);
+  },
   readers: () => ({ capture: captureCodexEvent, stream: codexStreamingText, summarize: summarizeCodexEvent, trace: traceCodexEvent, activity: codexActivity }),
   subscribe(child, session, absorb) {
     child.on('event', (method, params) => { rememberCodexChange(session, method, params); absorb(method, params); });

package/main/importable-threads.mjs

@@ -17,22 +17,80 @@
 
 import os from 'node:os';
 import { appSessionFolders } from './agent-homes.mjs';
-import { RECENT_DAYS, readSessionThreads } from './agent-sessions.mjs';
+import { RECENT_DAYS, readProjectChats, readSessionThreads } from './agent-sessions.mjs';
 import { readCodexThreads } from './codex-threads.mjs';
 
 export const OLDER_DAYS = 90;
 export const OLDER_MOST = 20;
 
-export function readImportableThreads({ config = null, supervisor = null, env = process.env, shellEnv, home = os.homedir(), now = Date.now() } = {}) {
+// `readCodex` is the app's own reader off the main process (codex-threads.mjs
+// readCodexThreadsOffThread): a large Codex folder takes seconds to read.
+export async function readImportableThreads({ config = null, supervisor = null, env = process.env, shellEnv, home = os.homedir(), now = Date.now(), readCodex = readCodexThreads } = {}) {
   const { dirs, codexDirs } = appSessionFolders({ config, supervisor, env, home, ...(shellEnv ? { shellEnv } : {}) });
-  const read = (days, max) => {
+  const read = async (days, max) => {
     let claude = [];
     let codex = [];
     try { ({ threads: claude } = readSessionThreads({ home, dirs, now, days, ...(max ? { max } : {}) })); } catch { claude = []; }
-    try { ({ threads: codex } = readCodexThreads({ home, codexDirs, now, days })); } catch { codex = []; }
+    try { ({ threads: codex } = await readCodex({ home, codexDirs, now, days })); } catch { codex = []; }
     return [...claude, ...codex].sort((a, b) => (b.when ?? 0) - (a.when ?? 0));
   };
-  const recent = read(RECENT_DAYS);
+  const recent = await read(RECENT_DAYS);
   if (recent.length) return recent;
-  return read(OLDER_DAYS, OLDER_MOST).slice(0, OLDER_MOST);
+  return (await read(OLDER_DAYS, OLDER_MOST)).slice(0, OLDER_MOST);
+}
+
+/** What the watch that brings new chats in reads (main/new-chats-watch.mjs):
+ *  Claude Code chats in the projects' own folders since `since`, and the last
+ *  `days` of Codex. */
+export async function readRecentThreads({
+  config = null, supervisor = null, env = process.env, home = os.homedir(), now = Date.now(),
+  days = 1, since = 0, folders = [], readCodex = readCodexThreads,
+} = {}) {
+  const { dirs, codexDirs } = appSessionFolders({ config, supervisor, env, home });
+  let claude = [];
+  let codex = [];
+  try { claude = readProjectChats({ home, dirs, folders, since }); } catch { claude = []; }
+  try { ({ threads: codex } = await readCodex({ home, codexDirs, now, days })); } catch { codex = []; }
+  return [...claude, ...codex];
+}
+
+/* ------------------------ AND THE ONE THE SEARCH USES ---------------------- */
+// THE CARD'S LIST IS TEN DAYS. THE NAME FIELD IS NOT (w-6418318cd5, from
+// GitHub #31). A chat you had in July could not be brought in at all, so a
+// field that only searched the same ten days would be decoration.
+//
+// IT IS A SECOND READ, NOT A WIDER FIRST ONE. The ten-day list is what the
+// card draws the moment it opens and it has to be quick; this one is taken
+// once, lazily, the first time somebody types, and the window keeps it (see
+// `zero:search-agent-threads` in main/ipc.mjs) so every keystroke after that
+// is a filter rather than a disk walk.
+//
+// AND IT CANNOT PROMISE EVERYTHING. A chat's name lives inside its transcript,
+// and the Mac this was written on holds 29,703 of them. So it goes newest
+// first until the cap or the budget stops it and reports `reached`, the moment
+// it gave up at, which the card prints. Eight seconds rather than three: this
+// is the read somebody is waiting on, watching a spinner, having already typed
+// the word they want.
+
+export const SEARCH_DAYS = 365;
+const SEARCH_MOST = 6000;
+const SEARCH_BUDGET_MS = 8000;
+
+export async function readSearchableThreads({
+  config = null, supervisor = null, env = process.env, shellEnv, home = os.homedir(), now = Date.now(),
+  days = SEARCH_DAYS, max = SEARCH_MOST, budgetMs = SEARCH_BUDGET_MS, readCodex = readCodexThreads,
+} = {}) {
+  const { dirs, codexDirs } = appSessionFolders({ config, supervisor, env, home, ...(shellEnv ? { shellEnv } : {}) });
+  let claude = [];
+  let codex = [];
+  let reached = 0;
+  try {
+    ({ threads: claude, reached } = readSessionThreads({ home, dirs, now, days, max, budgetMs, ends: false }));
+  } catch { claude = []; }
+  // Codex keeps its names in an index of its own (main/codex-threads.mjs), so
+  // its side costs no transcript reads and never gives up early. Only the
+  // Claude side can run out of budget, which is why `reached` comes off it.
+  try { ({ threads: codex } = await readCodex({ home, codexDirs, now, days })); } catch { codex = []; }
+  const threads = [...claude, ...codex].sort((a, b) => (b.when ?? 0) - (a.when ?? 0));
+  return { threads, reached };
 }