agentbox-app 0.1.13 → 0.1.16

package/main/run-ledger.mjs

@@ -0,0 +1,135 @@
+// THE RUN LEDGER: one line per finished run, for agent hours (w-3d0fa23ffb).
+//
+// `<appHome>/runs.jsonl`, written when a run ends (supervisor `_recordRun`).
+// Cloud runs keep their own ledger (main/cloud/usage.mjs) and are read from
+// there. Old runs are read once from their trace logs (`backfillRuns`). Every
+// line has a key, and every reader dedupes on it, so a run written twice is
+// counted once.
+import fs from 'node:fs';
+import path from 'node:path';
+import { appHome, machineryDir } from './store/home.mjs';
+import { dedupeRuns, runFromTrace } from '../shared/agent-hours.mjs';
+
+const BACKFILL_DAYS = 400;
+const TAIL_BYTES = 400;
+// A log with no exit line that was written to this recently is a run still
+// going; it writes its own line when it ends.
+const STILL_GOING_MS = 30 * 60_000;
+
+export function runLedgerPath(home = appHome()) {
+  return path.join(home, 'runs.jsonl');
+}
+
+export function appendRun(run, { file = runLedgerPath() } = {}) {
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.appendFileSync(file, JSON.stringify(run) + '\n');
+    return true;
+  } catch {
+    // A run that cannot be written never fails the run.
+    return false;
+  }
+}
+
+export function readRuns({ file = runLedgerPath() } = {}) {
+  let text;
+  try { text = fs.readFileSync(file, 'utf8'); } catch { return []; }
+  const out = [];
+  for (const line of text.split('\n')) {
+    if (!line.trim()) continue;
+    try { out.push(JSON.parse(line)); } catch { /* one broken line loses only itself */ }
+  }
+  return out;
+}
+
+export function runsFromCloudUsage(lines) {
+  const out = [];
+  for (const l of lines ?? []) {
+    const at = Date.parse(l?.at);
+    const seconds = Number(l?.wallSeconds);
+    if (!Number.isFinite(at) || !(seconds > 0)) continue;
+    out.push({
+      key: `cloud:${l.runId ?? at}`,
+      at,
+      start: at - seconds * 1000,
+      item: l.item ?? null,
+      product: null,
+      engine: l.engine ?? null,
+      seconds,
+      failed: Number.isInteger(l.exitCode) ? l.exitCode !== 0 : null,
+      where: 'cloud',
+    });
+  }
+  return out;
+}
+
+export function allRuns({ file = runLedgerPath(), cloudLines = [] } = {}) {
+  return dedupeRuns([...readRuns({ file }), ...runsFromCloudUsage(cloudLines)]);
+}
+
+function tailOf(file) {
+  let fd;
+  try {
+    fd = fs.openSync(file, 'r');
+    const size = fs.fstatSync(fd).size;
+    const len = Math.min(size, TAIL_BYTES);
+    const buf = Buffer.alloc(len);
+    fs.readSync(fd, buf, 0, len, size - len);
+    return buf.toString('utf8');
+  } catch {
+    return '';
+  } finally {
+    if (fd !== undefined) try { fs.closeSync(fd); } catch {}
+  }
+}
+
+// Reads every run log of this store's projects into the ledger, once per run.
+// Resolves to how many runs it added. It hands the event loop back every
+// YIELD_EVERY logs: on the founder's Mac it reads 25,780 logs in 3.4 s, which
+// in one piece would freeze the window.
+const YIELD_EVERY = 200;
+const breathe = () => new Promise((r) => setImmediate(r));
+
+export async function backfillRuns({ home = appHome(), products = [], file = runLedgerPath(home), now = Date.now() } = {}) {
+  const have = new Set(readRuns({ file }).map((r) => r?.key));
+  const since = now - BACKFILL_DAYS * 86_400_000;
+  let added = 0;
+  let read = 0;
+  let pending = [];
+  const flush = () => {
+    if (!pending.length) return;
+    try {
+      fs.mkdirSync(path.dirname(file), { recursive: true });
+      fs.appendFileSync(file, pending.map((r) => JSON.stringify(r)).join('\n') + '\n');
+      added += pending.length;
+    } catch { /* the next backfill tries again */ }
+    pending = [];
+  };
+  for (const p of products) {
+    if (!p?.dir) continue;
+    const sessions = path.join(machineryDir(p.dir, home), 'sessions');
+    let items;
+    try { items = fs.readdirSync(sessions, { withFileTypes: true }); } catch { continue; }
+    for (const it of items) {
+      if (!it.isDirectory()) continue;
+      let logs;
+      try { logs = fs.readdirSync(path.join(sessions, it.name)); } catch { continue; }
+      for (const name of logs) {
+        const start = Number(/^(\d{12,14})\.log$/.exec(name)?.[1]);
+        if (!Number.isFinite(start) || start < since || start > now) continue;
+        if (++read % YIELD_EVERY === 0) { flush(); await breathe(); }
+        const full = path.join(sessions, it.name, name);
+        let mtimeMs;
+        try { mtimeMs = fs.statSync(full).mtimeMs; } catch { continue; }
+        const tail = tailOf(full);
+        if (!/# exited \(/.test(tail) && now - mtimeMs < STILL_GOING_MS) continue;
+        const run = runFromTrace({ name, text: tail, mtimeMs, item: it.name, product: p.slug ?? null });
+        if (!run || have.has(run.key)) continue;
+        pending.push({ ...run, backfilled: true });
+        have.add(run.key);
+      }
+    }
+  }
+  flush();
+  return added;
+}

package/main/save-attachments.mjs

@@ -0,0 +1,41 @@
+// SAVING THE FILES A MESSAGE CARRIES, into a project's attachments folder.
+//
+// One copy, used by the reply box (main/ipc.mjs zero:save-attachments) and by
+// a message to a person (main/team/index.mjs), whose conversation may not
+// exist until the message makes it, so it cannot save them beforehand.
+// Relative paths keep them readable by workers through the MCP and renderable
+// in the message view, and they are the names the team sync sends on
+// (main/team/sync.mjs).
+import fs from 'node:fs';
+import path from 'node:path';
+
+/**
+ * `files` are `{ name, dataBase64 }` or `{ name, srcPath }`. Answers what was
+ * saved: `{ rel, name, image }`, in order, skipping one with neither.
+ */
+export function saveAttachments(dir, files) {
+  const outDir = path.join(dir, 'attachments');
+  fs.mkdirSync(outDir, { recursive: true });
+  const saved = [];
+  for (const file of files ?? []) {
+    const safe = String(file?.name ?? 'file').replace(/[^\w.-]+/g, '-').slice(0, 80);
+    // A RANDOM SUFFIX, THE SAME ONE THE STAGING PATH ALREADY USES. The name
+    // was the millisecond plus the filename, so two files saved in the same
+    // millisecond with the same name overwrote each other and the message
+    // ended up with two links to one picture. Screenshots are often sent in
+    // pairs, which is exactly the shape that collides. It has never been observed
+    // happening; it is one line to make impossible.
+    const rel = `attachments/${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}-${safe}`;
+    const abs = path.join(dir, rel);
+    if (file?.dataBase64) fs.writeFileSync(abs, Buffer.from(file.dataBase64, 'base64'));
+    else if (file?.srcPath) fs.copyFileSync(file.srcPath, abs);
+    else continue;
+    saved.push({ rel, name: safe, image: /\.(png|jpe?g|gif|webp)$/i.test(safe) });
+  }
+  return saved;
+}
+
+/** The links a message carries for what was saved, one per line. */
+export function attachmentMarkdown(saved) {
+  return saved.map((s) => (s.image ? `![${s.name}](${s.rel})` : `[${s.name}](${s.rel})`)).join('\n');
+}

package/main/serve.mjs

@@ -30,7 +30,8 @@ import { fileURLToPath } from 'node:url';
 
 import { spawn } from 'node:child_process';
 import { Readable } from 'node:stream';
-import { mediaResponse, mediaType } from './img-scheme.mjs';
+import { mediaResponse, mediaType, servable } from './img-scheme.mjs';
+import { readPictureShape } from './picture-shape.mjs';
 import { loadConfig } from './config.mjs';
 import { Store } from './store.mjs';
 import { Supervisor } from './supervisor.mjs';
@@ -40,7 +41,9 @@ import { reportFromRenderer } from './crash-report.mjs';
 import * as workItemsDisk from './store/work-items.mjs';
 import { createTeamService, teamStateFile } from './team/index.mjs';
 import { loadCloudConfig, supabaseSession, headlessSessionFile } from './team/session.mjs';
+import { roomsSetup } from './team/room-setup.mjs';
 import { appHome, carryMisplacedMachinery, storeRootEnv } from './store/home.mjs';
+import { keepAnswerModesIn } from './answer-modes.mjs';
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const repoRoot = path.dirname(here);
@@ -143,6 +146,8 @@ export function answerWhatOnlyTheWindowAnswered(ipcMain) {
   ipcMain.handle('zero:corner-tag', () => null);
   ipcMain.handle('zero:notify', () => null);
   ipcMain.handle('zero:boot-info', () => ({ reloaded: false, builtAt: null, recovered: null }));
+  // A room invite link only ever opens the desktop app.
+  ipcMain.handle('zero:take-join', () => null);
   ipcMain.handle('zero:crash', (_e, payload) => { reportFromRenderer(payload ?? {}); return null; });
   // The phone door belongs to the desktop app (main/phone-link.mjs); a tab is told there is none.
   ipcMain.handle('zero:phone-link', () => null);
@@ -175,6 +180,7 @@ export async function bootHeadless({ dataDir = repoRoot, appDir = repoRoot, user
   const inheritedHome = appHome();
   Object.assign(process.env, storeRootEnv(config.storeRoot));
   carryMisplacedMachinery(inheritedHome, config.storeRoot);
+  keepAnswerModesIn({ userDir, storeRoot: config.storeRoot });
   const store = await new Store(config).init();
   const supervisor = new Supervisor(config, store, appDir, dataDir, userDir);
   const window = broadcastingWindow();
@@ -196,6 +202,7 @@ export async function bootHeadless({ dataDir = repoRoot, appDir = repoRoot, user
     accountRoot: config.accountRoot,
     stateFile: teamStateFile(config.storeRoot),
     onChange: () => ipc?.push?.(),
+    rooms: roomsSetup({ config, store, supervisor, userDir }),
   }) : null;
   // AND IT STOPS ITS OWN WORKERS ON THE WAY OUT, as main/main.mjs does for the
   // desktop. Control-C reaches the whole process group, so without this each
@@ -212,6 +219,23 @@ export async function bootHeadless({ dataDir = repoRoot, appDir = repoRoot, user
 /** A token in the url, because the port alone is not a door key. */
 export const newToken = () => crypto.randomBytes(24).toString('base64url');
 
+/**
+ * THE PICTURES A TAB MAY DRAW: the desktop window's own rule (`servable`,
+ * main/img-scheme.mjs) over its own roots (`imageRoots`, main/main.mjs), so a
+ * door opened for a screenshot can never hand out `zero.config.json`.
+ *
+ * Pictures only. A whole document is served under a grant the pane opens one
+ * at a time (main/doc-scheme.mjs) and this copy opens none.
+ */
+export function picturesTheAppOwns({ config, store }) {
+  return {
+    allows: (kind, file) => kind === 'img' && servable(file, [
+      config?.accountRoot,
+      ...(store?.listProducts?.() ?? []).map((p) => p.repoPath),
+    ].filter(Boolean)),
+  };
+}
+
 /**
  * THE KEY THAT ONLY READS FILES. A design page runs its own scripts and can
  * read its own address, so the address a phone loads it from must not carry
@@ -254,14 +278,24 @@ const MIME = {
  */
 async function answerFile(req, res, url, { token, files }) {
   const [, , key, kind, ...rest] = url.pathname.split('/');
-  if (kind !== 'doc' && kind !== 'img') { res.writeHead(404).end('No such kind of file.'); return; }
+  if (kind !== 'doc' && kind !== 'img' && kind !== 'shape') { res.writeHead(404).end('No such kind of file.'); return; }
   if (!sameKey(key, fileKey(typeof token === 'function' ? token() : token))) { res.writeHead(403).end('Wrong key.'); return; }
   let file;
   try { file = path.normalize('/' + rest.map(decodeURIComponent).join('/')); } catch { res.writeHead(400).end('Bad path.'); return; }
-  if (!path.isAbsolute(file) || !files.allows(kind, file)) { res.writeHead(403).end('Not available.'); return; }
+  // A shape is asked of a picture, under the picture's own rule.
+  if (!path.isAbsolute(file) || !files.allows(kind === 'shape' ? 'img' : kind, file)) { res.writeHead(403).end('Not available.'); return; }
   let stat;
   try { stat = await fs.promises.stat(file); } catch { res.writeHead(404).end('Not there.'); return; }
   if (!stat.isFile()) { res.writeHead(404).end('Not there.'); return; }
+  // ITS WIDTH AND HEIGHT, so a picture the phone has never seen holds its
+  // place before its last byte comes (main/picture-shape.mjs).
+  if (kind === 'shape') {
+    const shape = await readPictureShape(file).catch(() => null);
+    if (!shape) { res.writeHead(404).end('Not a picture this can measure.'); return; }
+    res.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+    res.end(JSON.stringify(shape));
+    return;
+  }
   const media = mediaType(file);
   if (media) {
     const out = await mediaResponse(file, req.headers.range);
@@ -316,6 +350,14 @@ export function createHandler({ channels, token, listeners = new Set(), dist = p
     // NOR DOES THE PAGE ITSELF ASK: the tab takes the token out of its address
     // bar on load, so a reload asks for `/` bare, and refusing that drew
     // "Wrong or missing token" on every reload (tests/a-browser-tab-survives-a-reload).
+    //
+    // AND THE HOST HEADER IS NOT CHECKED, asked and answered 2026-10-24.
+    // Refusing a Host that is not localhost is the usual guard against a page
+    // whose own name resolves to this machine, and it cannot go here:
+    // main/phone-link.mjs serves this same handler to a phone through a relay
+    // or over Tailscale, where the Host is neither. The token is the key,
+    // whatever name the request arrives under
+    // (tests/the-doing-half-runs-with-no-electron).
     const guarded = url.pathname === '/events' || url.pathname.startsWith('/api/') || url.pathname === '/file-key';
     const given = req.headers['x-agentbox-token'] || url.searchParams.get('token');
     if (guarded && !sameKey(given, typeof token === 'function' ? token() : token)) {