agentbox-app 0.1.13 → 0.1.16

package/main/stage-attachment.mjs

@@ -0,0 +1,68 @@
+// STAGING A FILE FOR A REPLY BOX, before it is sent: the bytes of a paste, or
+// a copy of a picture dropped in, written into the account's .staging folder,
+// which the window may draw from (main/ipc.mjs `zero:stage-attachment` says
+// why). A picture the window cannot draw is turned into one that it can here,
+// so the box, the message and the teammate all get a picture.
+import { execFile } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { turnedName } from '../shared/picture-formats.mjs';
+
+const WEEK = 7 * 24 * 60 * 60 * 1000;
+const SIPS_MS = 30_000;
+
+/**
+ * Answers `{ path }`, and `name` too when the file was turned into another
+ * format, which is the name it goes on under.
+ */
+export async function stageAttachment(dir, { name, dataBase64, srcPath } = {}, { turn = turnIntoPicture } = {}) {
+  fs.mkdirSync(dir, { recursive: true });
+  // Sweep on the way in rather than on a timer: an abandoned paste is only
+  // ever discovered by the next one, and a week is longer than any draft has
+  // been left open. Failure to sweep must never fail the paste.
+  try {
+    const week = Date.now() - WEEK;
+    for (const f of fs.readdirSync(dir)) {
+      const p = path.join(dir, f);
+      try { if (fs.statSync(p).mtimeMs < week) fs.unlinkSync(p); } catch { /* leave it */ }
+    }
+  } catch { /* a sweep that cannot run is not a paste that failed */ }
+  const safe = String(name ?? 'pasted.png').replace(/[^\w.-]+/g, '-').slice(0, 80);
+  const abs = path.join(dir, `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}-${safe}`);
+  // A path is a drag, bytes are a paste. Already inside the folder we serve
+  // from is left alone: copying it would only make a second file to sweep.
+  if (typeof srcPath === 'string' && srcPath) {
+    if (path.resolve(srcPath) === path.resolve(path.join(dir, path.basename(srcPath)))) return { path: srcPath };
+    fs.copyFileSync(srcPath, abs);
+  } else {
+    fs.writeFileSync(abs, Buffer.from(String(dataBase64 ?? ''), 'base64'));
+  }
+  const as = turnedName(name ?? safe);
+  if (!as) return { path: abs };
+  // One that cannot be turned goes as the file it is, which is how every TIFF went before.
+  const drawn = await Promise.resolve().then(() => turn(abs)).catch(() => null);
+  if (!drawn) return { path: abs };
+  try { fs.unlinkSync(abs); } catch { /* swept within the week */ }
+  return { path: drawn, name: as };
+}
+
+/**
+ * Turns a TIFF or HEIC into a PNG or JPEG beside it with the Mac's own sips,
+ * and answers the new file's path. Null off a Mac, for any other file, or
+ * when sips fails or writes nothing.
+ */
+export async function turnIntoPicture(file, { platform = process.platform, run = sips } = {}) {
+  const as = turnedName(path.basename(file));
+  if (!as || platform !== 'darwin') return null;
+  const out = path.join(path.dirname(file), as);
+  try {
+    await run(['-s', 'format', as.endsWith('.png') ? 'png' : 'jpeg', file, '--out', out]);
+    return fs.statSync(out).size > 0 ? out : null;
+  } catch {
+    return null;
+  }
+}
+
+const sips = (args) => new Promise((resolve, reject) => {
+  execFile('/usr/bin/sips', args, { timeout: SIPS_MS }, (err) => (err ? reject(err) : resolve()));
+});

package/main/stall-watch.mjs

@@ -0,0 +1,50 @@
+// WHICH REQUEST HELD THE APP. A spinning wheel on a Mac is the main process
+// not answering, and nothing used to record what it was doing instead. This
+// times every request the window makes and keeps the longest freeze; the
+// memory log writes both into its minute line (main/memory-log.mjs).
+//
+// Only the synchronous part of a handler is timed. That is the part that holds
+// the process: once a handler waits on a promise the window is free again.
+import { monitorEventLoopDelay, performance } from 'node:perf_hooks';
+
+export const SLOW_MS = 100;
+
+export function stallWatch({ clock = () => performance.now(), loop = monitorEventLoopDelay({ resolution: 20 }) } = {}) {
+  loop.enable();
+  let slow = new Map();
+  let freezes = [];
+  return {
+    /** A freeze main/freeze-recorder.mjs caught, with the function that held it. */
+    noteFreeze({ ms, where }) {
+      freezes.push({ ms, where });
+    },
+    time(channel, fn) {
+      return (...args) => {
+        const start = clock();
+        try {
+          return fn(...args);
+        } finally {
+          const ms = Math.round(clock() - start);
+          if (ms >= SLOW_MS) {
+            const seen = slow.get(channel) ?? { channel, times: 0, maxMs: 0 };
+            seen.times += 1;
+            seen.maxMs = Math.max(seen.maxMs, ms);
+            slow.set(channel, seen);
+          }
+        }
+      };
+    },
+    /** The minute so far, and a fresh start. */
+    take() {
+      const out = {
+        longestStallMs: Math.round(loop.max / 1e6),
+        slowRequests: [...slow.values()].sort((a, b) => b.maxMs - a.maxMs).slice(0, 5),
+        ...(freezes.length ? { freezes: freezes.sort((a, b) => b.ms - a.ms).slice(0, 5) } : {}),
+      };
+      loop.reset();
+      slow = new Map();
+      freezes = [];
+      return out;
+    },
+  };
+}

package/main/store/home.mjs

@@ -1,40 +1,17 @@
-// THE APP'S OWN HOME, so nothing Agentbox generates lands in the folder a worker
-// is standing in.
+// The app's own home, so nothing Agentbox generates lands in the folder a
+// worker runs in. Claude Code keeps per-project state under
+// `~/.claude/projects/<encoded path>/` and Codex under `~/.codex`; this is the
+// same convention. A product with no code repo makes its docs folder the
+// worker's cwd (main/supervisor.mjs), so without this our records sat there.
 //
-// WHY THIS FILE EXISTS. A new user uploaded a file into her product folder,
-// watched a worker create a directory and delete things next to it, and asked
-// why it needed to.
+// Our records move: the ledger, session traces, run records, repeat rules and
+// parked writes. What describes the folder stays in it (`project.json`,
+// `index.json` and `.lock`), so the folder still opens when copied to another
+// Mac.
 //
-// MEASURED on her Mac 2026-08-24 and again 2026-08-26: Claude Code writes
-// nothing into a working directory. Per-project state goes to
-// `~/.claude/projects/<encoded path>/`, pasted files to `~/.claude/paste-cache`,
-// edit history to `~/.claude/file-history`. Codex does the same under `~/.codex`.
-// Agentbox did the opposite: a product with no code repo registered makes the
-// product docs directory the worker's own cwd (main/supervisor.mjs), which is
-// every new user's first product, and our ledger, session traces, run records
-// and repeat rules all sat in it.
-//
-// So this is the same convention, one name over: a dot-folder in her home
-// named after this app. On Linux a fresh install does not get that dot-folder,
-// and it does not get a visible folder of the app's name in $HOME. Application
-// data belongs in $XDG_DATA_HOME (see defaultStoreRoot). An existing dot-folder
-// is still read, so a store already on disk is not orphaned.
-//
-// WHAT MOVES AND WHAT DOES NOT, because the line is not "everything of ours".
-// The app's own RECORDS move: the work item ledger, session traces, run
-// records, repeat rules, parked writes. What DESCRIBES THE FOLDER ITSELF stays
-// in it: `project.json` says this directory is a product at all, `index.json`
-// catalogs the founder's own documents by their paths inside it, and `.lock`
-// guards that catalog. A folder you could copy to another Mac and still open is
-// worth more than four fewer files, and none of those three is what a worker
-// scribbles.
-//
-// WHAT THIS DOES NOT DO, said out loud so nobody reads it as more than it is.
-// It does not make the ledger unforgeable. A worker with Bash reaches that
-// folder exactly as easily as it reaches its own cwd. Claude Code has the
-// identical property and does not pretend otherwise. This moves our files out
-// of her folder; the grant that used to ride on the ledger is dealt with
-// separately, by not keeping it on the ledger at all (main/answer-modes.mjs).
+// This does not protect the ledger: a worker with Bash reaches this folder as
+// easily as its own cwd. The grant that used to sit on the ledger is handled in
+// main/answer-modes.mjs.
 
 import fs from 'node:fs';
 import os from 'node:os';
@@ -45,18 +22,10 @@ import { Name, WAS, envNames, nameSlug, readEnv } from '../../shared/product-nam
 const isDir = (dir) => { try { return fs.statSync(dir).isDirectory(); } catch { return false; } };
 
 /**
- * THE STORE ROOT AS ENVIRONMENT, FOR EVERY PROCESS WE START, UNDER EVERY NAME
- * THIS APP HAS HAD.
- *
- * `appHome` above reads the old names, so anything shipped in this repo finds
- * the root whichever spelling it is given. What is NOT in this repo does not:
- * the store MCP server of an older install, her own launchd jobs, a script she
- * wrote. Those read the one variable they were written against, and a worker
- * whose store root is missing writes its whole session to nowhere, which is the
- * 2026-08-05 failure exactly.
- *
- * So both are exported. It costs one string per spawn and it makes the rename
- * invisible to everything outside this checkout.
+ * The store root under every env name this app has had, for every process we
+ * start. Code outside this repo (an older install's MCP server, a launchd job,
+ * a user's own script) reads only the name it was written against, and a
+ * worker with no store root writes its session nowhere.
  */
 export function storeRootEnv(storeRoot) {
   const env = {};
@@ -64,18 +33,10 @@ export function storeRootEnv(storeRoot) {
   return env;
 }
 
-// Where a config that names no store keeps the inbox.
-//
-// macOS, and anything that is not Linux: a folder of the app's name in the
-// home directory. That is the folder this app has used since 2026-09-22.
-// Linux: $XDG_DATA_HOME/<slug>, or ~/.local/share/<slug> when the variable is
-// unset, blank, or not an absolute path. A visible directory in $HOME is not
-// where an application writes. Measured 2026-10-07: a config that named no
-// store created one.
-//
-// The home and the environment are arguments so a test can ask about another
-// machine. A caller that passes a stand-in home must pass an environment that
-// belongs to it. This function does not decide that; it uses the env it is given.
+// Where a config that names no store keeps the inbox. Anything but Linux: a
+// folder of the app's name in the home directory. Linux: $XDG_DATA_HOME/<slug>,
+// or ~/.local/share/<slug> when that is unset, blank or not absolute. A caller
+// that passes a stand-in home must pass an env that belongs to it.
 export function defaultStoreRoot({ home = os.homedir(), platform = process.platform, env = process.env } = {}) {
   if (platform !== 'linux') return path.join(home, Name);
   const given = typeof env?.XDG_DATA_HOME === 'string' ? env.XDG_DATA_HOME.trim() : '';
@@ -83,21 +44,11 @@ export function defaultStoreRoot({ home = os.homedir(), platform = process.platf
   return path.join(base, nameSlug);
 }
 
-// One env var, for tests and for anyone who keeps their home somewhere else.
-// Read at call time rather than captured, because a test sets it per case.
-//
-// THE NAME IS READ HERE AND THE OLD NAMES STILL ANSWER. This was a literal
-// `ASTRAL_HOME` and a literal `.astral`, two renames after the app stopped
-// being called that, so both go through the name module now. The fallbacks are
-// not politeness: a launchd job, a login shell and any process started before a
-// rename still export the old variable, and a dot-folder written under an old
-// name holds a real store. The current name wins when both are there;
-// otherwise the newest old name that is actually on disk does, so nobody's
-// store goes missing on the release that renames the app.
-// `homeDir` is injected so a test can ask what this answers on a machine with
-// an old dot-folder on it, without one having to exist on the machine running
-// the test. `platform` and `env` are the same kind of injection: this suite
-// runs on a Mac and still has to answer a Linux home. Production passes neither.
+// The env override is read at call time because a test sets it per case. Old
+// env names and old dot-folders still answer: a launchd job or a process
+// started before a rename exports the old variable, and an old dot-folder holds
+// a real store. The current name wins, then the newest old name on disk.
+// `homeDir`, `platform` and `env` are for tests; production passes none.
 export function appHome(homeDir = os.homedir(), { platform = process.platform, env } = {}) {
   const override = readEnv('HOME', env);
   if (override) return override;
@@ -107,11 +58,10 @@ export function appHome(homeDir = os.homedir(), { platform = process.platform, e
     const older = path.join(homeDir, `.${was.toLowerCase()}`);
     if (isDir(older)) return older;
   }
-  // A fresh Linux directory has nothing of ours on disk yet. The answer has to
-  // be the same path loadConfig opens, or the desktop and this lookup write two
-  // stores. The machine's own XDG_DATA_HOME is an absolute path in the real
-  // home; applying it to a stand-in home writes that stand-in's store there.
-  // A caller that passes `env` is asking about that environment, not this one.
+  // A fresh Linux home has nothing of ours yet, so answer the path loadConfig
+  // opens, or the two write separate stores. This machine's XDG_DATA_HOME
+  // belongs to the real home only; a stand-in home or an explicit `env` does
+  // not get it.
   if (platform === 'linux') {
     const real = env === undefined && path.resolve(homeDir) === path.resolve(os.homedir());
     return defaultStoreRoot({ home: homeDir, platform: 'linux', env: real ? process.env : (env ?? {}) });
@@ -119,19 +69,15 @@ export function appHome(homeDir = os.homedir(), { platform = process.platform, e
   return here;
 }
 
-// Claude Code's own encoding, checked against a real folder on her Mac:
-// `/Users/you/Zero/accounts/00000.../agentbox` becomes
-// `-Users-you-Zero-accounts-00000...-agentbox`. Every character that is not
-// a letter or a digit becomes a dash, which is readable at a glance and safe on
-// every filesystem.
+// Claude Code's own encoding: every character that is not a letter or a digit
+// becomes a dash, so `/Users/you/a.b` becomes `-Users-you-a-b`.
 export function encodeProjectPath(dir) {
   return String(dir).replace(/[^A-Za-z0-9]/g, '-');
 }
 
-// The one thing that encoding cannot do: `/a/b.c` and `/a/b/c` encode the same.
-// Claude Code lives with that. We do not, because two products sharing one
-// ledger would silently merge two founders' inboxes, so the folder carries the
-// path it belongs to and a mismatch takes a short hash suffix instead.
+// That encoding is lossy: `/a/b.c` and `/a/b/c` encode the same. Two products
+// sharing one ledger would merge their inboxes, so each folder records the
+// path it belongs to in `.origin` and a mismatch gets a short hash suffix.
 const ORIGIN = '.origin';
 
 function readOrigin(dir) {
@@ -139,28 +85,11 @@ function readOrigin(dir) {
 }
 
 /**
- * A MACHINERY DIRECTORY IS NOT A PROJECT DIRECTORY, and everything below has to
- * know the difference before it moves a byte.
- *
- * MEASURED on her Mac 2026-09-23 at 15:31:26, because this is not a hypothesis.
- * A session wrote a throwaway script to count stranded rows, listed
- * `<home>/projects`, and handed each of those directories to `readWorkItems` as
- * if it were a product folder. `readWorkItems` asks for the ledger, the ledger
- * asks for the machinery directory, and the machinery directory of a machinery
- * directory is a SECOND one nested inside the home. Then the sweep below did
- * what it is for and carried the ledger, the session traces, the run records,
- * the repeat rules and the parked writes one level down into it. Thirty eight
- * products in two seconds, and her inbox read empty until the folders were
- * carried back at 15:58.
- *
- * Nothing about that was exotic. Any agent with a shell can write that script,
- * and reading is supposed to be the safe thing to do. So the refusal lives
- * HERE, in the one place every caller passes through, rather than in a rule
- * about how to write scripts that nobody reading this will have been told.
- *
- * The test is the path itself: anything inside `<home>/projects` is ours
- * already. A product folder can never be one, because products live under the
- * account root and the home is a separate tree.
+ * True for a path inside `<home>/projects`, which is ours and never a product
+ * folder, since products live under the account root. Treating one as a
+ * product folder nests a second machinery directory inside it, and the sweep
+ * then moves every record one level down. Every caller passes through here, so
+ * this is where that is refused.
  */
 export function isMachineryDir(dir, home = appHome()) {
   const root = path.resolve(path.join(home, 'projects'));
@@ -170,10 +99,8 @@ export function isMachineryDir(dir, home = appHome()) {
 /** `<home>/projects/<encoded>` for this project directory. Creates nothing. */
 export function machineryDir(projectDir, home = appHome()) {
   const real = path.resolve(projectDir);
-  // Already ours: it is its own answer. Encoding it a second time is the
-  // 2026-09-23 fold, and returning it unchanged makes the mistake harmless
-  // rather than silent, because a caller that guessed this path still gets the
-  // right ledger back.
+  // Already a machinery directory: return it as is, so a caller that passed
+  // one still gets the right ledger rather than a nested one.
   if (isMachineryDir(real, home)) return real;
   const base = path.join(home, 'projects', encodeProjectPath(real));
   const claimed = readOrigin(base);
@@ -182,52 +109,26 @@ export function machineryDir(projectDir, home = appHome()) {
   return `${base}-${tag}`;
 }
 
-// EVERY NAME THAT IS OURS, so the move is ONE event rather than a slow leak.
-//
-// A path-by-path migration was the first shape and it is wrong for what this is
-// FOR. It moves a file the first time something asks for it, so the ledger goes
-// the moment the inbox opens and `sessions/` goes one item at a time, whenever a
-// trace happens to be read, which for a row nobody opens again is never.
-// Measured on her folder 2026-08-26: 1,785 of the 1,830 files that leave are
-// session traces. Lazily she would still be looking at nearly all of it. The
-// point is that her folder is clean, so all of it goes at once, the first time
-// this process touches the product.
+// Every name that is ours. All of them move together when a product is first
+// touched, not one at a time when read, because most of the files are session
+// traces that nothing reads again.
 export const MACHINERY = ['work-items.jsonl', 'repeats.jsonl', 'sessions', 'runs', 'pending-writes'];
 
-// THE TWO OF OUR NAMES THAT ARE APPEND-ONLY LOGS. A stray one of these holds
-// lines the real file never got, so it is folded ONTO THE END of the real file
-// rather than moved over it. Everything else here is a whole file that stands
-// on its own.
+// The append-only logs. A stray copy holds lines the real file never got, so
+// it is appended onto the real file rather than moved over it.
 const LOGS = new Set(['work-items.jsonl', 'repeats.jsonl']);
 
 /**
- * The same directory, existing, with its origin marker written once, and every
- * record of ours carried in.
- *
- * THE SWEEP RUNS ON EVERY CALL, NOT ONCE PER PROCESS. It used to run once,
- * behind a `Set`, and `machineryPath` below only adopted a name when there was
- * NOTHING at the new place. Between them that meant the move happened exactly
- * once, and one of our files that appeared in her folder afterwards was never
- * picked up again: nothing read it, nothing moved it, and it sat there.
- *
- * MEASURED on her real folder the day the move landed, not reasoned about: two
- * release lines for two different cards written into a stray `work-items.jsonl`
- * at 14:10 and never folded in, and two run records stranded under `runs/`. So
- * this is not a theoretical window, it is where her folder actually was.
- *
- * The cost of running it every time is one stat per name against a path that is
- * normally absent. Five syscalls that find nothing is cheaper than being wrong,
- * and being wrong here is silent.
+ * The machinery directory for a project, created, with its `.origin` written
+ * once and every stray record of ours carried in. The sweep runs on every
+ * call, not once per process, because a file of ours can turn up in the
+ * product folder after the first move. It costs one stat per name.
  */
 export function ensureMachineryDir(projectDir, home = appHome()) {
   const dir = machineryDir(projectDir, home);
   fs.mkdirSync(dir, { recursive: true });
-  // THE SWEEP IS WHAT DID THE DAMAGE, so it does not run on a directory that is
-  // already ours. `machineryDir` hands back its own argument in that one case,
-  // and there is nothing to carry across from a folder into itself. The origin
-  // marker is left alone too: it names the product this machinery belongs to,
-  // and overwriting it with the machinery's own path is how the folded copies
-  // came to claim themselves.
+  // A directory that is already ours is not swept, and its `.origin` is left
+  // alone: overwritten with its own path, it would claim itself.
   if (dir === path.resolve(projectDir)) return dir;
   if (readOrigin(dir) === null) {
     try { fs.writeFileSync(path.join(dir, ORIGIN), `${path.resolve(projectDir)}\n`); } catch { /* best effort */ }
@@ -237,24 +138,18 @@ export function ensureMachineryDir(projectDir, home = appHome()) {
 }
 
 /**
- * One of our names, wherever it has turned up in her folder, carried across to
- * where it belongs. NOTHING IS EVER DESTROYED HERE.
+ * Carries one of our names from the product folder to the machinery directory.
+ * Nothing is ever destroyed here. In order:
  *
- * The rules, in the order they apply:
- *
- *   - Nothing there: return. This is the ordinary case and it costs one stat.
- *   - Nothing at the target yet: rename it across whole, which is what the
- *     first move has always done.
- *   - Both directories: merge them entry by entry by these same rules, then
- *     drop the stray directory once the merge has emptied it.
+ *   - Nothing there: return.
+ *   - Nothing at the target: rename it across whole.
+ *   - Both directories: merge entry by entry by these rules, then remove the
+ *     stray directory if the merge emptied it.
  *   - Both append-only logs: append the stray's bytes onto the real file and
- *     delete the stray. Never the other way round; the real file is the one
- *     with the history in it.
- *   - Both ordinary files: the newer takes the name and the older is kept
- *     beside it as `<name>.superseded-<mtime>` rather than deleted. That is the
- *     run record case, and it is rare on purpose, because the writer of those
- *     now writes straight here (main/code-change.mjs). A conflict only happens
- *     while a process started before the move is still running.
+ *     delete the stray.
+ *   - Both ordinary files: the newer takes the name and the older is kept as
+ *     `<name>.superseded-<mtime>`. This is rare, because run records are now
+ *     written straight here (main/code-change.mjs).
  */
 export function foldStray(from, to, rel = path.basename(to)) {
   let stray;
@@ -267,14 +162,11 @@ export function foldStray(from, to, rel = path.basename(to)) {
     let entries = [];
     try { entries = fs.readdirSync(from); } catch { return false; }
     for (const name of entries) foldStray(path.join(from, name), path.join(to, name), name);
-    // Only if the merge emptied it. A directory with anything left in it holds
-    // something we did not understand, and it stays where it is.
     try { fs.rmdirSync(from); } catch { /* not empty, or gone already */ }
     return true;
   }
 
-  // A directory on one side and a file on the other is not a case we have a
-  // right answer for, so the stray is left alone and it is said out loud.
+  // A directory on one side and a file on the other has no right answer.
   if (stray.isDirectory() !== landed.isDirectory()) {
     console.warn(`${nameSlug}: ${from} and ${to} are not the same kind of thing; leaving the first alone`);
     return false;
@@ -307,23 +199,13 @@ export function foldStray(from, to, rel = path.basename(to)) {
 }
 
 /**
- * Where one of our records lives for this project, and the migration that gets
- * it there.
- *
- * THE MOVE HAPPENS ONCE, and `ensureMachineryDir` above has already done it by
- * the time this returns: anything still sitting in the product folder under one
- * of our names is RENAMED into the home. A rename on the same volume is atomic
- * and costs nothing, whether it is a 6 MB ledger or a directory of 1,785 session
- * traces, and it is undone by moving the file back.
- *
- * It is a move rather than a read-both-write-new because the ledger is an
- * append-only log: two halves of one log in two places is not a store, it is
- * two stores that disagree. Everything that reads it must therefore agree about
- * where it is, which is why the MCP server ships the same file.
+ * Where one of our records lives for this project, after any stray copy in the
+ * product folder has been renamed across. It is a move, not read-both-write-new,
+ * because two halves of an append-only ledger are two stores that disagree.
+ * The MCP server ships this same file so every reader agrees where it is.
  *
- * Races are ordinary here: a dozen processes may call this at once. Every
- * failure mode of the rename is benign and is swallowed — ENOENT means there
- * was nothing to move, EEXIST/ENOTEMPTY means somebody else moved it first.
+ * Many processes may call this at once. A failed rename is benign: ENOENT means
+ * nothing to move, EEXIST or ENOTEMPTY means another process moved it first.
  */
 export function machineryPath(projectDir, rel, home = appHome()) {
   if (typeof rel !== 'string' || !rel || path.isAbsolute(rel) || rel.split(/[\\/]/).includes('..')) {
@@ -336,25 +218,14 @@ export function machineryPath(projectDir, rel, home = appHome()) {
 }
 
 /**
- * RECORDS A COPY WROTE UNDER THE WRONG HOME, CARRIED TO ITS OWN.
+ * Carries records a copy wrote under the wrong home over to `toHome`. The
+ * headless door (main/serve.mjs) once wrote its ledgers under whatever home it
+ * inherited, and this keeps the rows it wrote then.
  *
- * The headless door (main/serve.mjs) used to open the store without pointing
- * the app's home at `storeRoot`, so it wrote its ledgers under whatever home it
- * inherited: `~/.agentbox` for `npx agentbox-app`, and on the test Mac
- * 2026-10-01 the founder's own store, because the copies were started from an
- * agent session. Its workers were handed `storeRoot`, found nothing there, and
- * answered "no work item" to every store call. Pointing the home at `storeRoot`
- * fixes the next write; this is what keeps the rows already written from
- * vanishing on the first boot after the fix.
- *
- * ONLY WHAT IS PROVABLY THIS STORE'S MOVES. A machinery directory names the
- * product it belongs to in `.origin`; one is carried only when that product is
- * inside `storeRoot`. Everything else under `fromHome` is somebody else's
- * store and is not touched. Each record goes through `foldStray`, so a ledger
- * is appended rather than overwritten and nothing is ever destroyed; the old
- * directory is removed only once nothing but its marker is left in it.
- *
- * Returns the product folders whose records were carried.
+ * Only a machinery directory whose `.origin` is inside `storeRoot` moves;
+ * anything else under `fromHome` belongs to another store. Records go through
+ * `foldStray`, and the old directory is removed only when just its marker is
+ * left. Returns the product folders whose records were carried.
  */
 export function carryMisplacedMachinery(fromHome, storeRoot, toHome = storeRoot) {
   if (!fromHome || !storeRoot) return [];
@@ -381,29 +252,14 @@ export function carryMisplacedMachinery(fromHome, storeRoot, toHome = storeRoot)
 }
 
 /**
- * EVERY RECORD OF OURS FOR ONE PROJECT, GONE.
- *
- * This exists for exactly one caller: the practice project, which the founder
- * has now ruled must not survive its own tutorial. Deleting the folder in her
- * store and leaving the ledger, the session traces and the run records behind
- * would be a half removal, and it is the half nobody can see: MEASURED on her
- * real Mac 2026-08-28, the practice folder in her account held two files and
- * the machinery for it held 168 ledger lines and 29 session traces from six
- * walks.
- *
- * IT WILL ONLY EVER DELETE A DIRECTORY THAT SAYS IT BELONGS TO THIS PROJECT.
- * `.origin` is written by `ensureMachineryDir` on first use and holds the
- * resolved path of the project the directory is the machinery for; this refuses
- * unless it is there and it matches. A directory with no `.origin` is one we did
- * not make, or one made by a version that did not write the marker, and either
- * way it is somebody else's to delete. Same instinct as `foldStray` above: when
- * two things are not the same kind of thing, leave the first alone and say so.
- *
- * Never throws. A machinery directory that will not delete is a few kilobytes
- * under the app's own home; failing a launch over it would be the worse bug.
+ * Deletes every record of ours for one project. Its caller is the practice
+ * project, which must not outlive its tutorial; deleting only its folder would
+ * leave the ledger and traces behind.
  *
- * Returns { removed, why } so a caller can report what really happened rather
- * than assume.
+ * Deletes only a directory whose `.origin` matches this project. One with no
+ * marker was made by someone else or by an older version, and is left alone.
+ * Never throws, because a leftover directory is a few kilobytes and failing a
+ * launch over it would be worse. Returns { removed, why }.
  */
 export function removeMachinery(projectDir, home = appHome()) {
   const real = path.resolve(projectDir);
@@ -425,8 +281,8 @@ export function removeMachinery(projectDir, home = appHome()) {
   }
 }
 
-// Move one legacy path in, if it is there. Never throws: a store that cannot be
-// migrated must still open on the new path rather than fail to open at all.
+// Moves one legacy path in, if it is there. Never throws, so a store that
+// cannot be migrated still opens on the new path.
 export function adoptLegacy(from, to) {
   let there = false;
   try { there = fs.existsSync(from); } catch { return false; }
@@ -445,9 +301,8 @@ export function adoptLegacy(from, to) {
   }
 }
 
-// The store on one volume and the home on another. Rare, and a rename cannot
-// cross it, so copy and then remove — in that order, so a failure halfway
-// leaves the original where it was rather than nothing anywhere.
+// A rename cannot cross volumes, so copy and then remove. In that order, a
+// failure halfway leaves the original where it was.
 function copyAcross(from, to) {
   try {
     fs.cpSync(from, to, { recursive: true, errorOnExist: true, force: false });

package/main/store/paths.mjs

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { MACHINERY } from './home.mjs';
 
 // The .git / .env deny-list, shared by EVERY creation-file access point: the
 // agent tools (main/agent/tools.mjs), the folder-backed materialize walk
@@ -31,6 +32,16 @@ export function deniesGitOrEnvPath(rel) {
   return GIT_PATH_RE.test(norm) || ENV_PATH_RE.test(norm);
 }
 
+// True iff any segment of `rel` is a MACHINERY name (main/store/home.mjs). A
+// document written to one of those names is swept into the real ledger by
+// ensureMachineryDir, so the store write boundary must reserve them. Normalized
+// like deniesGitOrEnvPath so case or a backslash cannot alias one. null -> false.
+const MACHINERY_SET = new Set(MACHINERY);
+export function deniesMachineryPath(rel) {
+  if (rel == null) return false;
+  return normalizeForDenyCheck(rel).split('/').some((seg) => MACHINERY_SET.has(seg));
+}
+
 // Containment: resolve rel against root; realpath the nearest EXISTING
 // ancestor so a symlinked directory cannot smuggle the path outside; reject
 // a symlink as the final component (lstat). Throws on any violation, returns