agentbox-app 0.1.13 → 0.1.16

package/main/shell-path.mjs

@@ -1,9 +1,24 @@
 // Finder launches inherit launchd's PATH rather than the user's shell tools.
-// Read only PATH: importing a profile's whole environment would import keys
-// and login overrides too. Workers still pass through their billing scrub.
+// Read only named variables: importing a profile's whole environment would
+// import keys and login overrides too. PATH, the two folders below, and the
+// network and locale names under NETWORK and LOCALE are all that is ever read,
+// and workers still pass through their billing scrub.
 import { execFile } from 'node:child_process';
+import fs from 'node:fs';
 import path from 'node:path';
 
+// The shell a person actually has. `$SHELL` when that file exists, then zsh,
+// bash, and sh. A machine with no zsh used to spawn `/bin/zsh`: the terminal
+// never came up, and the self-update never built.
+export function loginShell(env = process.env, exists = fs.existsSync) {
+  const preferred = env.SHELL;
+  if (preferred && exists(preferred)) return preferred;
+  for (const candidate of ['/bin/zsh', '/bin/bash', '/bin/sh']) {
+    if (exists(candidate)) return candidate;
+  }
+  return preferred || '/bin/sh';
+}
+
 const MARKER = '\0agentbox-path\0';
 function runShell(file, args, options) {
   return new Promise((resolve, reject) => {
@@ -12,6 +27,52 @@ function runShell(file, args, options) {
   });
 }
 
+/**
+ * WHICH SHELLS ARE ASKED, IN ORDER, AND WHY THERE IS MORE THAN ONE (2026-10-15).
+ *
+ *  Their own, interactive and login, first: that is the one that reads .zshrc,
+ *  where nvm and most PATH lines live.
+ *
+ *  Then their own again as a login shell that is NOT interactive, which reads
+ *  .zprofile and skips .zshrc. Measured with the real /bin/zsh: a .zshrc that
+ *  runs `[ -z "$TMUX" ] && exec tmux` (tmux exits 1 with no terminal) or
+ *  `exec fish` (exits 0 having read nothing) ended the shell before our
+ *  printf, and the app fell back to launchd's four folders, losing the
+ *  Homebrew line that .zprofile carries. Asking again without -i keeps it. A
+ *  .zshrc slower than five seconds lands here too.
+ *
+ *  Last, the system's own shell, when theirs is something else: a shell that
+ *  cannot speak `printf ... "$PATH"` (nushell hands back the words `$PATH`)
+ *  is a fact about that shell, not about where their tools are. The program
+ *  finder (main/engine-bin.mjs shellProbes) falls back the same way.
+ */
+export function loginShellAttempts(env = process.env, platform = process.platform) {
+  const system = platform === 'darwin' ? '/bin/zsh' : '/bin/bash';
+  const theirs = env.SHELL || (platform === 'darwin' ? '/bin/zsh' : '/bin/sh');
+  const out = [[theirs, '-ilc', 5000], [theirs, '-lc', 2500]];
+  if (system !== theirs) out.push([system, '-ilc', 2500]);
+  return out;
+}
+
+/** The first attempt whose output `read` accepts; the first failure otherwise. */
+async function askLoginShell({ env, platform, run, script, read }) {
+  let first = null;
+  for (const [shell, flags, timeout] of loginShellAttempts(env, platform)) {
+    try {
+      const stdout = String(await run(shell, [flags, script(shell)], {
+        // SIGKILL: a shell's exit hook can outlive SIGTERM (main/engine-bin.mjs).
+        env: { ...env }, encoding: 'utf8', timeout, killSignal: 'SIGKILL', maxBuffer: 64 * 1024,
+      }));
+      return read(stdout);
+    } catch (error) {
+      first ??= error;
+    }
+  }
+  throw first;
+}
+
+const isFish = (shell) => path.basename(shell) === 'fish';
+
 /**
  * WHERE THE SHELL SAYS CLAUDE CODE AND CODEX KEEP THEIR SESSIONS (w-e46f2e9cea).
  *
@@ -26,59 +87,146 @@ function runShell(file, args, options) {
  *  Only an absolute path is kept. A quoted `~` the shell did not expand is
  *  expanded here; anything else, or no answer at all, is left out. */
 const DIRS_MARKER = '\0agentbox-dirs\0';
-export async function readShellDataDirs({ env = process.env, platform = process.platform, run = runShell } = {}) {
-  if (platform !== 'darwin' && platform !== 'linux') return {};
-  const shell = env.SHELL || (platform === 'darwin' ? '/bin/zsh' : '/bin/sh');
-  try {
-    const stdout = String(await run(shell, ['-ilc', `printf '\\0agentbox-dirs\\0%s\\0%s\\0' "$CLAUDE_CONFIG_DIR" "$CODEX_HOME"`], {
-      env: { ...env }, encoding: 'utf8', timeout: 5000, maxBuffer: 64 * 1024,
-    }));
+const DIRS = ['CLAUDE_CONFIG_DIR', 'CODEX_HOME'];
+
+/**
+ * HOW THIS MACHINE REACHES THE NETWORK, WHEN ONLY THE SHELL PROFILE SAYS (2026-10-15).
+ *
+ *  Behind a company proxy, people export HTTPS_PROXY and the company's
+ *  certificate (NODE_EXTRA_CA_CERTS) in .zshrc, which is where Claude Code's
+ *  own error tells them to. A Dock launch never sees it. Measured with the real
+ *  Claude Code 2.1.301 against a stub model behind a CONNECT proxy and a
+ *  self-signed certificate: with both variables it answered in 240 ms; with no
+ *  proxy variable it retried for minutes (10 retries, about three) and failed;
+ *  with the proxy and no certificate it died in 371 ms on "Self-signed
+ *  certificate detected". So a worker started by the app failed on exactly the
+ *  machine where the person's terminal worked.
+ *
+ *  None of these is a key or a login, so the billing scrub has nothing to say
+ *  about them, and they go into the app's own environment where every worker,
+ *  terminal and git call inherits them. A name the launch environment already
+ *  has is left alone, and the proxies are one setting: if any proxy name is
+ *  already set, none is added.
+ */
+const PROXIES = ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy', 'ALL_PROXY', 'all_proxy', 'NO_PROXY', 'no_proxy'];
+const CERTIFICATES = ['NODE_EXTRA_CA_CERTS', 'SSL_CERT_FILE', 'SSL_CERT_DIR', 'REQUESTS_CA_BUNDLE', 'CURL_CA_BUNDLE'];
+
+/**
+ * THE LANGUAGE SETTING A DOCK LAUNCH DOES NOT HAVE (2026-10-15).
+ *
+ *  launchd gives an app no LANG and no LC_*: read off a running Dock-launched
+ *  Electron app with `ps eww`, and off a bare Electron started with launchd's
+ *  environment (process.env.LANG undefined, and none in its children).
+ *  Terminal.app sets LANG itself, so the person's own commands always had one
+ *  and their agents never did. Measured on this Mac with LANG unset: system
+ *  Ruby reads files as US-ASCII (what CocoaPods and fastlane refuse to run
+ *  under), `sed 's/./X/g'` turns "café" into five X's, `wc -m` counts five.
+ *
+ *  So the shell's own, when it has one. On macOS 26 that is usually Apple's:
+ *  /etc/zprofile exports LANG=C.UTF-8 when nothing else has, so a zsh login
+ *  answers C.UTF-8 (measured on this Mac), which fixes both of the above and
+ *  keeps every tool's messages in the English the app reads. Otherwise, on a
+ *  Mac only, en_US.UTF-8, which exists on every macOS and is what Terminal
+ *  sets for most people. Linux sessions set their own.
+ */
+const LOCALE = ['LANG', 'LC_ALL', 'LC_CTYPE'];
+const MAC_LOCALE = 'en_US.UTF-8';
+
+const SETTINGS = [...DIRS, ...PROXIES, ...CERTIFICATES, ...LOCALE];
+
+/** Everything above from one login shell, as { dirs, network, locale }. */
+export async function readShellSettings({ env = process.env, platform = process.platform, run = runShell } = {}) {
+  const none = { dirs: {}, network: {}, locale: {} };
+  if (platform !== 'darwin' && platform !== 'linux') return none;
+  const script = () => `printf '\\0agentbox-dirs\\0${'%s\\0'.repeat(SETTINGS.length)}' ${SETTINGS.map((n) => `"$${n}"`).join(' ')}`;
+  const read = (stdout) => {
     const start = stdout.lastIndexOf(DIRS_MARKER);
-    if (start < 0) return {};
-    const [claude = '', codex = ''] = stdout.slice(start + DIRS_MARKER.length).split('\0');
-    const out = {};
-    const keep = (name, raw) => {
-      let v = String(raw ?? '').trim();
-      if (!v || /[\r\n]/.test(v)) return;
-      if (v === '~' || v.startsWith('~/')) {
-        if (!env.HOME) return;
-        v = path.join(env.HOME, v.slice(1));
-      }
-      if (path.isAbsolute(v)) out[name] = v;
-    };
-    keep('CLAUDE_CONFIG_DIR', claude);
-    keep('CODEX_HOME', codex);
-    return out;
+    if (start < 0) throw Error('Your shell did not answer.');
+    return stdout.slice(start + DIRS_MARKER.length).split('\0');
+  };
+  let values;
+  try {
+    values = await askLoginShell({ env, platform, run, script, read });
   } catch {
-    return {};
+    return none;
   }
+  const raw = Object.fromEntries(SETTINGS.map((name, i) => [name, String(values[i] ?? '').trim()]));
+  const single = (v) => v && !/[\r\n]/.test(v);
+  const folder = (v) => {
+    if (!single(v)) return null;
+    if (v === '~' || v.startsWith('~/')) {
+      if (!env.HOME) return null;
+      v = path.join(env.HOME, v.slice(1));
+    }
+    return path.isAbsolute(v) ? v : null;
+  };
+  const out = { dirs: {}, network: {}, locale: {} };
+  for (const name of DIRS) if (folder(raw[name])) out.dirs[name] = folder(raw[name]);
+  for (const name of PROXIES) if (single(raw[name])) out.network[name] = raw[name];
+  for (const name of CERTIFICATES) if (folder(raw[name])) out.network[name] = folder(raw[name]);
+  for (const name of LOCALE) if (single(raw[name]) && /^[A-Za-z0-9_.@-]+$/.test(raw[name])) out.locale[name] = raw[name];
+  return out;
+}
+
+export async function readShellDataDirs(opts = {}) {
+  return (await readShellSettings(opts)).dirs;
+}
+
+/** What to add to a launch environment, given what the shell said. Never overwrites. */
+export function launchAdditions({ network = {}, locale = {} } = {}, env = process.env, platform = process.platform) {
+  const set = (name) => env[name] !== undefined && env[name] !== '';
+  const add = {};
+  if (!PROXIES.some(set)) for (const name of PROXIES) if (network[name]) add[name] = network[name];
+  for (const name of CERTIFICATES) if (network[name] && !set(name)) add[name] = network[name];
+  if (!LOCALE.some(set)) {
+    for (const name of LOCALE) if (locale[name]) add[name] = locale[name];
+    if (!LOCALE.some((n) => add[n]) && platform === 'darwin') add.LANG = MAC_LOCALE;
+  }
+  return add;
 }
 
 /**
  * What the shell answered, kept for the life of the app. Empty until it
- *  answers, which is long before setup reaches its last card. */
+ *  answers, which is long before setup reaches its last card.
+ *
+ *  AND THE NETWORK AND LANGUAGE SETTINGS ARE PUT INTO `into` (the app's own
+ *  environment) here, because this is the one shell read that both the desktop
+ *  (main/main.mjs) and the browser copy (bin/agentbox.mjs) wait for before the
+ *  first worker starts. */
 let shellDataEnv = {};
 export const shellDataDirsNow = () => shellDataEnv;
-export function learnShellDataDirs(opts) {
-  return readShellDataDirs(opts).then((found) => { shellDataEnv = found; return found; });
+export function learnShellDataDirs({ into = process.env, ...opts } = {}) {
+  return readShellSettings(opts).then((found) => {
+    shellDataEnv = found.dirs;
+    Object.assign(into, launchAdditions(found, opts.env ?? process.env, opts.platform ?? process.platform));
+    return found.dirs;
+  });
 }
 
 export async function recoverShellPath({ env = process.env, platform = process.platform, run = runShell } = {}) {
   const original = env.PATH || '';
-  if (platform !== 'darwin') return { path: original, error: null };
-  const shell = env.SHELL || '/bin/zsh';
-  const value = path.basename(shell) === 'fish' ? '(string join : $PATH)' : '"$PATH"';
-  try {
+  // LINUX TOO (2026-10-15). A launcher entry starts the app with the desktop
+  // session's environment, and that session read ~/.profile without -i, so
+  // the nvm lines its installer writes into ~/.bashrc (behind Ubuntu's "if not
+  // running interactively, return") never reached it. readShellDataDirs above
+  // already asked on Linux for the same reason.
+  if (platform !== 'darwin' && platform !== 'linux') return { path: original, error: null };
+  const script = (shell) => `printf '\\0agentbox-path\\0%s\\0' ${isFish(shell) ? '(string join : $PATH)' : '"$PATH"'}`;
+  const read = (stdout) => {
     // NUL framing keeps messages printed by .zshrc out of the returned PATH.
-    const stdout = String(await run(shell, ['-ilc', `printf '\\0agentbox-path\\0%s\\0' ${value}`], {
-      env: { ...env }, encoding: 'utf8', timeout: 5000, maxBuffer: 64 * 1024,
-    }));
     const start = stdout.lastIndexOf(MARKER);
     const end = start < 0 ? -1 : stdout.indexOf('\0', start + MARKER.length);
     const recovered = end < 0 ? '' : stdout.slice(start + MARKER.length, end);
     if (!recovered || /[\r\n]/.test(recovered)) throw Error('Your shell did not return its command search path.');
-    const entries = [...new Set([...recovered.split(':'), ...original.split(':')].filter(Boolean))];
-    if (!entries.length) throw Error('Your shell returned an empty command search path.');
+    // Only absolute folders. A shell that does not expand "$PATH" hands the
+    // words back, and a relative entry is a folder that moves with every cwd.
+    const entries = recovered.split(':').filter((p) => p.startsWith('/'));
+    if (!entries.length) throw Error('Your shell did not return its command search path.');
+    return entries;
+  };
+  try {
+    const recovered = await askLoginShell({ env, platform, run, script, read });
+    const entries = [...new Set([...recovered, ...original.split(':')].filter(Boolean))];
     return { path: entries.join(':'), error: null };
   } catch (error) {
     return { path: original, error: String(error?.message || error) };

package/main/ship-conflict-brief.mjs

@@ -0,0 +1,119 @@
+// What the other side of a merge conflict was for, so the thread that hit it
+// can resolve it without asking the person. Read-only git: nothing here
+// touches a working tree.
+
+import { execFile } from 'node:child_process';
+
+const GIT_MS = 10_000;
+const MAX_COMMITS = 8;
+const SUMMARY_CHARS = 240;
+
+export const KEEP_BOTH = 'Resolve it keeping both changes where they fit. Only ask the person if the two changes want opposite things, and then say which you kept and why.';
+
+const CONFLICT_LINE = /^CONFLICT \([^)]*\): .*$/m;
+// Main's own merges from `npm run ship`: "Merge origin/main into agentbox/<id>".
+const SHIPPED_FROM = /\binto agentbox\/([A-Za-z0-9_-]+)\s*$/;
+
+export const isMergeConflict = (output) => CONFLICT_LINE.test(String(output ?? ''));
+
+/** The files the script's own output says conflicted. */
+export function conflictedFilesIn(output) {
+  const files = new Set();
+  for (const line of String(output ?? '').split('\n')) {
+    const m = line.match(/^CONFLICT \([^)]*\): (?:Merge conflict in (.+)|(\S+) deleted in )/);
+    const file = m && (m[1] ?? m[2]);
+    if (file) files.add(file.trim());
+  }
+  return [...files];
+}
+
+function git(cwd, args) {
+  return new Promise((resolve) => {
+    execFile('git', ['-C', cwd, ...args], { encoding: 'utf8', timeout: GIT_MS, maxBuffer: 4 * 1024 * 1024 }, (err, stdout) => {
+      resolve({ ok: !err, code: err ? (typeof err.code === 'number' ? err.code : -1) : 0, out: String(stdout ?? '') });
+    });
+  });
+}
+
+/** Files that would conflict merging `upstream` into `head`, or null if git cannot say. */
+export async function filesThatConflict(cwd, head, upstream) {
+  const r = await git(cwd, ['merge-tree', '--write-tree', '--name-only', '--no-messages', head, upstream]);
+  if (r.code !== 0 && r.code !== 1) return null;
+  return r.out.split('\n').slice(1).map((l) => l.trim()).filter(Boolean);
+}
+
+// The thread whose ship brought `sha` onto main: the oldest of main's ship
+// merges after it where `sha` came in on the branch side, not main's.
+async function threadThatShipped(cwd, sha, upstream) {
+  const r = await git(cwd, ['log', '--merges', '--ancestry-path', '--reverse', '--format=%H %P%x09%s', `${sha}..${upstream}`]);
+  const merges = r.out.split('\n').filter(Boolean).slice(0, 3);
+  for (const line of merges) {
+    const [shas, subject = ''] = line.split('\t');
+    const id = subject.match(SHIPPED_FROM)?.[1];
+    const mainSide = shas.split(' ')[2];
+    if (!id || !mainSide) continue;
+    const onMainAlready = await git(cwd, ['merge-base', '--is-ancestor', sha, mainSide]);
+    if (onMainAlready.code === 1) return id;
+  }
+  return null;
+}
+
+const oneLine = (text) => String(text ?? '').replace(/\s+/g, ' ').trim();
+const clip = (text, n) => (text.length > n ? `${text.slice(0, n - 1).trimEnd()}…` : text);
+
+// The conflicting files, then what changed them on `upstream`, by thread.
+async function otherSide({ cwd, files, upstream, readThread }) {
+  const lines = [`Files: ${files.map((f) => `\`${f}\``).join(', ') || 'see the output below'}.`];
+  const since = cwd ? (await git(cwd, ['merge-base', 'HEAD', upstream])).out.trim() : '';
+  const log = since && files.length
+    ? await git(cwd, ['log', '--no-merges', `-n${MAX_COMMITS}`, '--format=%h %H%x09%s', `${since}..${upstream}`, '--', ...files])
+    : { out: '' };
+  const byThread = new Map();
+  for (const entry of log.out.split('\n').filter(Boolean)) {
+    const [shas, subject = ''] = entry.split('\t');
+    const [short, full] = shas.split(' ');
+    const id = await threadThatShipped(cwd, full, upstream);
+    if (!byThread.has(id)) byThread.set(id, []);
+    byThread.get(id).push(`${short} ${oneLine(subject)}`);
+  }
+
+  if (!byThread.size) return lines;
+  lines.push('', `What changed them on ${upstream} since this branch began:`);
+  for (const [id, commits] of [...byThread].sort(([a], [b]) => (a === null) - (b === null))) {
+    if (!id) {
+      lines.push(`- From no thread: ${commits.join('; ')}`);
+      continue;
+    }
+    let thread = null;
+    try { thread = readThread(id); } catch {}
+    const title = oneLine(thread?.title);
+    const about = clip(oneLine(thread?.progress || thread?.problem), SUMMARY_CHARS);
+    lines.push(`- Thread ${title ? `"${title}" ` : ''}(${id})${about ? `: ${about}` : ''}`, `  Commits: ${commits.join('; ')}`);
+  }
+  return lines;
+}
+
+/**
+ * The brief for a ship that failed, or null when it was not a merge conflict.
+ *
+ * @param {{ cwd: string, output: string, upstream?: string, readThread?: (id: string) => object|null }} opts
+ */
+export async function conflictBrief({ cwd, output, upstream = 'origin/main', readThread = () => null }) {
+  if (!isMergeConflict(output)) return null;
+  const fromGit = cwd ? await filesThatConflict(cwd, 'HEAD', upstream) : null;
+  const files = fromGit?.length ? fromGit : conflictedFilesIn(output);
+  return ['The other side of the conflict:', '', ...await otherSide({ cwd, files, upstream, readThread }), '', KEEP_BOTH].join('\n');
+}
+
+/** For a branch that has not shipped yet: null unless `upstream` now conflicts with it. */
+export async function earlyConflictNote({ cwd, upstream = 'origin/main', readThread = () => null }) {
+  const files = await filesThatConflict(cwd, 'HEAD', upstream);
+  if (!files?.length) return null;
+  return [
+    `${upstream} moved while this thread waited, and this branch no longer merges cleanly with it. Merge ${upstream} into it before you mark it ready to ship.`,
+    '',
+    ...await otherSide({ cwd, files, upstream, readThread }),
+    '',
+    KEEP_BOTH,
+  ].join('\n');
+}

package/main/ship-queue.mjs

@@ -22,10 +22,12 @@
 // cannot change the code that ships it. With no `ship.json`, nothing here does
 // anything at all.
 
-import { spawn } from 'node:child_process';
+import { spawn, execFile } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import { Name } from '../shared/product-name.mjs';
+import { SHIP_FAILED } from '../shared/not-shipped.mjs';
+import { conflictBrief, earlyConflictNote } from './ship-conflict-brief.mjs';
 
 export const SHIP_LABEL = 'ship';
 const SHIP_MS = 20 * 60 * 1000;
@@ -83,11 +85,16 @@ export const withoutShipLabel = (item) => labelsOf(item).filter((l) => l !== SHI
  * marking, and with a task folder to ship from. THE WINDOW READS THIS TOO
  * (w-0c1ba766eb): a row on this list is waiting on the app, not on a person,
  * so it is In progress and not Needs you until the queue has dealt with it.
+ *
+ * A CLOSED ROW STILL SHIPS, because a close is not a cancel. The window
+ * leaves closed rows out (`waitingIds`), so one stays in Done while it ships.
  */
+export const owedAShip = (item, handled = {}) => wantsShipping(item) && !(markedAt(item) <= (handled[keyOf(item)] ?? -1));
+
 export function waitingToShip(items, products, settings, { folderFor, handled = {} }) {
   const bySlug = new Map(products.map((p) => [p.slug, p]));
   return items
-    .filter((i) => wantsShipping(i) && i.status !== 'done' && !(markedAt(i) <= (handled[keyOf(i)] ?? -1)))
+    .filter((i) => owedAShip(i, handled))
     .map((item) => {
       const product = bySlug.get(item.product);
       const script = product ? shipScriptFor(product, settings) : null;
@@ -98,12 +105,24 @@ export function waitingToShip(items, products, settings, { folderFor, handled =
 }
 
 /**
- * The next task to ship, oldest ask first, or null: one the queue owes, with
- * no session on it (an agent still working may yet commit).
+ * The next task to ship, the most important first, or null.
+ *
+ * A session the row's own agent is still finishing holds its ship: its commits
+ * may not all be in. A session that started AFTER the label does not, because
+ * that is a reply, and a reply to a thread already waiting used to hold it for
+ * as long as the new session ran (2026-10-19). `liveSince` answering null
+ * means nobody can say when the live work started — a cloud run whose folder
+ * has not come home — and that waits, as it always did.
+ *
+ * Priority before age, the way `shared/work-items.mjs` orders the queue a
+ * puller sees: a thread the person is waiting on queued behind every older one.
  */
-export function nextToShip(items, products, settings, { isLive = () => false, folderFor, handled = {} }) {
-  const ready = waitingToShip(items, products, settings, { folderFor, handled }).filter(({ item }) => !isLive(item));
-  ready.sort((a, b) => markedAt(a.item) - markedAt(b.item));
+export function nextToShip(items, products, settings, {
+  isLive = () => false, liveSince = () => null, folderFor, handled = {},
+}) {
+  const ready = waitingToShip(items, products, settings, { folderFor, handled })
+    .filter(({ item }) => !isLive(item) || liveSince(item) > markedAt(item));
+  ready.sort((a, b) => (b.item.priority ?? 0) - (a.item.priority ?? 0) || markedAt(a.item) - markedAt(b.item));
   return ready[0] ?? null;
 }
 
@@ -185,7 +204,7 @@ function diagnosis({ why, failed }) {
 }
 
 /** What the agent is told when its branch did not ship. */
-export function failureReply(output) {
+export function failureReply(output, { brief = null } = {}) {
   const tail = String(output ?? '').trim().slice(-KEEP);
   const { died, ...rest } = whyItDidNotShip(output);
   return [
@@ -202,6 +221,7 @@ export function failureReply(output) {
       'a worker that was starved or timed out is likelier than a bug in your change.',
       'Run the tests for your change again before you go looking for one.',
     ] : []),
+    ...(brief ? ['', brief] : []),
     '',
     'Fix what the script says below in your task folder, commit, then add the label',
     `\`${SHIP_LABEL}\` to this row again and end your turn. Do not push or touch any`,
@@ -217,16 +237,35 @@ export function failureReply(output) {
 export function failureNote(output) {
   const { died, last, ...rest } = whyItDidNotShip(output);
   const said = died ? `${DIED}. It last said: ${last ?? 'nothing at all'}` : diagnosis(rest);
-  return `It did not ship, and it went back to its agent: ${said.slice(0, 300)}`;
+  return `${SHIP_FAILED}${said.slice(0, 300)}`;
 }
 
-export function runScript(script, cwd, { timeout = SHIP_MS, env = process.env } = {}) {
+/**
+ * The base checkout's hooks, read off the task folder's shared git dir. The
+ * ship runs with cwd = the task folder, whose core.hooksPath may be the
+ * relative 'scripts/hooks' resolving to the branch's own, worker-edited copy.
+ * Pinning the base copy here is what keeps the gate the branch cannot change.
+ */
+function baseHooksPath(cwd) {
+  return new Promise((resolve) => {
+    execFile('git', ['-C', cwd, 'rev-parse', '--path-format=absolute', '--git-common-dir'], { encoding: 'utf8', timeout: 10_000 }, (err, stdout) => {
+      const common = err ? '' : String(stdout).trim();
+      resolve(common ? path.resolve(common, '..', 'scripts', 'hooks') : null);
+    });
+  });
+}
+
+export async function runScript(script, cwd, { timeout = SHIP_MS, env = process.env } = {}) {
   const node = env.npm_node_execpath && fs.existsSync(env.npm_node_execpath) ? env.npm_node_execpath : 'node';
+  const hooks = await baseHooksPath(cwd);
+  const baseGate = hooks
+    ? { GIT_CONFIG_COUNT: '1', GIT_CONFIG_KEY_0: 'core.hooksPath', GIT_CONFIG_VALUE_0: hooks }
+    : {};
   return new Promise((resolve) => {
     let out = '';
     let child;
     try {
-      child = spawn(node, [script], { cwd, env: { ...env, GIT_TERMINAL_PROMPT: '0' }, stdio: ['ignore', 'pipe', 'pipe'] });
+      child = spawn(node, [script], { cwd, env: { ...env, GIT_TERMINAL_PROMPT: '0', ...baseGate }, stdio: ['ignore', 'pipe', 'pipe'] });
     } catch (e) {
       resolve({ code: 1, out: String(e?.message ?? e) });
       return;
@@ -245,23 +284,26 @@ export function runScript(script, cwd, { timeout = SHIP_MS, env = process.env }
  * supervisor's own tick and returns at once; the run happens beside it.
  */
 export class ShipQueue {
-  constructor({ store, userDir, folderFor, isLive, handBack = () => {}, run = runScript, afterShip = () => {}, log = console }) {
-    Object.assign(this, { store, userDir, folderFor, isLive, handBack, run, afterShip, log });
+  constructor({ store, userDir, folderFor, isLive, liveSince = () => null, handBack = () => {}, run = runScript, afterShip = () => {}, log = console }) {
+    Object.assign(this, { store, userDir, folderFor, isLive, liveSince, handBack, run, afterShip, log });
     this.busy = null;
+    this.earlyConflicts = new Map();
   }
 
   tick(items, products) {
     if (this.busy) return null;
     const settings = readShipSettings(this.userDir);
     if (!Object.keys(settings).length) return null;
-    const next = nextToShip(items, products, settings, { isLive: this.isLive, folderFor: this.folderFor, handled: readHandled(this.userDir) });
+    const next = nextToShip(items, products, settings, {
+      isLive: this.isLive, liveSince: this.liveSince, folderFor: this.folderFor, handled: readHandled(this.userDir),
+    });
     if (!next) return null;
     // Marked handled only once the run has ENDED, pass or fail. Marked before
     // it, a run cut off by an app restart was never tried again
     // (w-f37a34def6, 2026-10-04). Within one app, `busy` already stops a
     // second start; across a restart, trying again is the point.
     const done = () => writeHandled(this.userDir, { ...readHandled(this.userDir), [keyOf(next.item)]: markedAt(next.item) });
-    this.busy = this.ship(next).then(done, done).finally(() => { this.busy = null; });
+    this.busy = this.ship(next, products, items).then(done, done).finally(() => { this.busy = null; });
     return this.busy;
   }
 
@@ -270,24 +312,78 @@ export class ShipQueue {
     const settings = readShipSettings(this.userDir);
     if (!Object.keys(settings).length) return [];
     return waitingToShip(items, products, settings, { folderFor: this.folderFor, handled: readHandled(this.userDir) })
+      .filter(({ item }) => item.status !== 'done')
       .map(({ item }) => item.id);
   }
 
-  async ship({ item, product, script, cwd }) {
+  /** Whether this row's folder must stay for a ship still to come. */
+  owes(item, products) {
+    const settings = readShipSettings(this.userDir);
+    if (!Object.keys(settings).length) return false;
+    return waitingToShip([item], products, settings, { folderFor: this.folderFor, handled: readHandled(this.userDir) }).length > 0;
+  }
+
+  // A thread id from a merge on main, read from this project or another one on
+  // the same checkout.
+  _readThread(id, product, products) {
+    const slugs = [product.slug, ...(products ?? []).filter((p) => p.slug !== product.slug && p.repoPath && p.repoPath === product.repoPath).map((p) => p.slug)];
+    for (const slug of slugs) {
+      const found = this.store.readItem?.(slug, id);
+      if (found) return found;
+    }
+    return null;
+  }
+
+  // After a ship lands, every other open branch of a project that ships is
+  // checked against the new main with `git merge-tree`, which reads commits and
+  // touches no task folder. A conflict waits here for that thread's next run.
+  async _findNewConflicts(shipped, items, products) {
+    const settings = readShipSettings(this.userDir);
+    const bySlug = new Map((products ?? []).map((p) => [p.slug, p]));
+    for (const other of items ?? []) {
+      const product = bySlug.get(other.product);
+      if (other.id === shipped.id || other.status === 'done' || !product || !settings[product.slug]) continue;
+      const cwd = this.folderFor(other, product);
+      if (!cwd || !fs.existsSync(cwd)) continue;
+      try {
+        const note = await earlyConflictNote({ cwd, readThread: (id) => this._readThread(id, product, products) });
+        if (note) this.earlyConflicts.set(keyOf(other), note); else this.earlyConflicts.delete(keyOf(other));
+      } catch (e) { this.log.warn?.(`zero: could not check ${other.id} against main:`, e.message); }
+    }
+  }
+
+  /** What main's last ship means for this thread's branch, once, or null. */
+  takeEarlyConflict(item) {
+    const note = this.earlyConflicts.get(keyOf(item)) ?? null;
+    this.earlyConflicts.delete(keyOf(item));
+    return note;
+  }
+
+  async ship({ item, product, script, cwd }, products = [], items = []) {
     this.log.info?.(`zero: shipping ${item.id} from ${cwd}`);
     const { code, out } = await this.run(script, cwd);
     try {
       // Already on main: there is nothing to fix, so nobody is woken.
       const already = /There is nothing to ship/.test(out);
       if (code === 0 || already) {
-        this.store.shipped(product.slug, item.id, { sha: shippedSha(out), labels: withoutShipLabel(item) });
-        this.afterShip();
+        const sha = shippedSha(out);
+        this.store.shipped(product.slug, item.id, { sha, labels: withoutShipLabel(item) });
+        // THE COMMIT TRAVELS WITH THE NEWS. What follows a ship wants to know
+        // which commit went out: main/main-went-red.mjs waits for that
+        // commit's test run on GitHub, because nothing else is still running
+        // five minutes after the agent ended.
+        this.afterShip({ item, product, sha });
+        await this._findNewConflicts(item, items, products);
       } else {
         this.store.shipFailed(product.slug, item.id, { note: failureNote(out), labels: withoutShipLabel(item) });
+        let brief = null;
+        try {
+          brief = await conflictBrief({ cwd, output: out, readThread: (id) => this._readThread(id, product, products) });
+        } catch (e) { this.log.warn?.(`zero: could not brief the conflict on ${item.id}:`, e.message); }
         // Straight back to the session that wrote the change. Not through the
         // reply on the row: that field is hers, and the app's words written
         // there would be drawn as hers and could not replace hers anyway.
-        this.handBack(item, failureReply(out));
+        this.handBack(item, failureReply(out, { brief }));
       }
     } catch (e) {
       this.log.warn?.(`zero: could not record the ship of ${item.id}:`, e.message);

package/main/source-updater.mjs

@@ -33,6 +33,7 @@
 import { execFile, execFileSync, spawn } from 'node:child_process';
 import fs from 'node:fs';
 import { describe } from './updater.mjs';
+import { loginShell } from './shell-path.mjs';
 
 const FIRST_CHECK_MS = 20_000;
 const EVERY_MS = 30 * 60 * 1000;
@@ -103,19 +104,26 @@ function collect(bin, args, { cwd, timeout }) {
 
 // WHICH npm. Started with `npm start`, the process carries npm's own path in
 // its environment, so that one is used and nvm or a version manager never
-// matters. Started any other way, her login shell is asked, the way
-// main/claude-bin.mjs finds Claude Code. The arguments are fixed strings from
-// this file, never anything read from disk.
+// matters. Started any other way, their login shell is asked, the way
+// main/claude-bin.mjs finds Claude Code, and only a shell this machine has: a
+// Linux launcher start carries no SHELL, so the old `|| '/bin/zsh'` was a path
+// to nothing and every update on a box without zsh failed in two seconds. With
+// no shell at all, npm on PATH is the better guess. The arguments are fixed
+// strings from this file, never anything read from disk.
+export function npmCommand(args, { env = process.env, exists = fs.existsSync } = {}) {
+  const node = env.npm_node_execpath;
+  const cli = env.npm_execpath;
+  if (node && cli && exists(node) && exists(cli)) return [node, [cli, ...args]];
+  const shell = loginShell(env, exists);
+  if (!exists(shell)) return ['npm', args];
+  return [shell, ['-lic', `npm ${args.join(' ')}`]];
+}
+
 export function defaultNpm(appDir, env = process.env) {
   return (args) => {
     const timeout = args[0] === 'install' ? INSTALL_MS : BUILD_MS;
-    const node = env.npm_node_execpath;
-    const cli = env.npm_execpath;
-    if (node && cli && fs.existsSync(node) && fs.existsSync(cli)) {
-      return collect(node, [cli, ...args], { cwd: appDir, timeout });
-    }
-    const shell = env.SHELL || '/bin/zsh';
-    return collect(shell, ['-lic', `npm ${args.join(' ')}`], { cwd: appDir, timeout });
+    const [bin, argv] = npmCommand(args, { env });
+    return collect(bin, argv, { cwd: appDir, timeout });
   };
 }