agentbox-app 0.1.13 → 0.1.16

package/shared/analytics-events.mjs

@@ -34,6 +34,18 @@ export const EVENTS = {
   task_written: 'A task was written',
   run_started: 'An agent started work',
   run_finished: 'An agent stopped work',
+  // WHAT HAPPENS IN THE MINUTES AFTER SETUP (2026-10-16). Most installs on
+  // 0.1.13 went quiet within minutes of finishing setup, and nothing said
+  // whether they quit, put the corner tag away, or what the import brought in
+  // (tests/what-people-do-after-setup-is-counted.test.mjs).
+  app_quit: `${Name} was quit`,
+  tag_hidden: 'The corner tag was hidden',
+  tag_turned_off: 'The corner tag was turned off',
+  import_offered: 'Setup offered agents to import',
+  import_taken: 'Setup imported agents',
+  // Sent as the switch goes off and never again, so an install that opted out
+  // is not read as one that stopped using the app.
+  counts_turned_off: 'Counts were turned off',
 };
 
 export const EVENT_NAMES = Object.keys(EVENTS);

package/shared/approval-card.mjs

@@ -0,0 +1,36 @@
+// A PERMISSION CARD'S FINGERPRINT, the one string the computer and the cloud
+// server (cloud/gateway/phone.mjs) each take of a card on their own, and the
+// phone sends back with her answer. main/approvals.mjs has why it is a digest
+// of what was shown rather than of the request file.
+//
+// If the two sides canonicalise differently, every approval is denied with no
+// reason shown. So the digest is taken after one JSON round trip, which does
+// what the write to disk did, and then keys are sorted.
+import crypto from 'node:crypto';
+
+function canonical(value) {
+  if (Array.isArray(value)) return `[${value.map((v) => canonical(v) ?? 'null').join(',')}]`;
+  if (value && typeof value === 'object') {
+    const fields = [];
+    for (const key of Object.keys(value).sort()) {
+      const v = canonical(value[key]);
+      if (v !== undefined) fields.push(`${JSON.stringify(key)}:${v}`);
+    }
+    return `{${fields.join(',')}}`;
+  }
+  return JSON.stringify(value);
+}
+
+/**
+ * The card as one string either side can compute on its own. Null for a
+ * non-object or anything JSON cannot express; null never equals a digest, so
+ * callers deny. No Unicode normalisation: two byte strings that look the same
+ * are still two different commands to her shell.
+ */
+export function cardDigest(request) {
+  if (!request || typeof request !== 'object' || Array.isArray(request)) return null;
+  let text;
+  try { text = canonical(JSON.parse(JSON.stringify(request))); } catch { return null; }
+  if (typeof text !== 'string') return null;
+  return crypto.createHash('sha256').update(text, 'utf8').digest('base64');
+}

package/shared/bridge-map.mjs

@@ -16,6 +16,7 @@ export const REQUEST_CHANNELS = {
   agentUpdate: 'zero:agent-update',
   snapshot: 'zero:snapshot',
   refreshUsage: 'zero:refresh-usage',
+  accountUsage: 'zero:account-usage',
   // Whether a screen reader is running, which is the terminal pane's question
   // before it builds xterm's accessibility tree.
   assistiveTech: 'zero:assistiveTech',
@@ -53,8 +54,18 @@ export const REQUEST_CHANNELS = {
   teamSync: 'zero:team-sync',
   teamRoute: 'zero:team-route',
   teamReact: 'zero:team-react',
+  // New words for a message you sent to a teammate, or the message taken back.
+  teamEdit: 'zero:team-edit',
+  // The microphone, asked for when a voice note starts recording.
+  micAccess: 'zero:mic-access',
   teamMessage: 'zero:team-message',
+  rooms: 'zero:rooms',
+  // Teammates: make, describe, start, edit, write to, and what they remember.
+  teammates: 'zero:teammates',
+  takeJoin: 'zero:take-join',
   threadEdit: 'zero:thread-edit',
+  // Move a thread to another project (shared/move-thread.mjs).
+  moveItem: 'zero:move-item',
   repeats: 'zero:repeats',
   composeRepeat: 'zero:compose-repeat',
   setRepeat: 'zero:set-repeat',
@@ -75,6 +86,7 @@ export const REQUEST_CHANNELS = {
   agentFolders: 'zero:agent-folders',
   importAgents: 'zero:import-agents',
   agentThreads: 'zero:agent-threads',
+  searchAgentThreads: 'zero:search-agent-threads',
   importThreads: 'zero:import-threads',
   badge: 'zero:badge',
   cornerTag: 'zero:corner-tag',
@@ -106,6 +118,18 @@ export const REQUEST_CHANNELS = {
   claudeAddAccount: 'zero:claude-add-account',
   setProjectSetting: 'zero:settings-set-project',
   setWorkspaceSetting: 'zero:settings-set-workspace',
+  // The cloud setup's sign-in for one account, made in the cloud (main/cloud/logins.mjs).
+  cloudSignIn: 'zero:cloud-signin',
+  // Claude's sign-in code, read from the clipboard while one is waiting for it.
+  cloudClipboardCode: 'zero:cloud-clipboard-code',
+  // Signing in to Agentbox Cloud itself, on the app's sign-in page (main/cloud/account.mjs).
+  cloudAccountSignIn: 'zero:cloud-account-sign-in',
+  cloudAccountCancel: 'zero:cloud-account-cancel',
+  cloudAccountReopen: 'zero:cloud-account-reopen',
+  cloudAccountSignOut: 'zero:cloud-account-sign-out',
+  cloudAccountPlan: 'zero:cloud-account-plan',
+  cloudAccountPay: 'zero:cloud-account-pay',
+  cloudAccountBilling: 'zero:cloud-account-billing',
   projectRename: 'zero:project-rename',
   projectArchive: 'zero:project-archive',
   projectSeenBy: 'zero:project-seen-by',
@@ -140,6 +164,7 @@ export const REQUEST_CHANNELS = {
   setProductOrder: 'zero:set-product-order',
   setThreadPlaces: 'zero:set-thread-places',
   setThreadPins: 'zero:set-thread-pins',
+  setThreadOnMac: 'zero:set-thread-on-mac',
   setProductHidden: 'zero:set-product-hidden',
   approve: 'zero:approve',
   // The phone door's Settings page (main/phone-link.mjs): its state, on, off,
@@ -154,6 +179,7 @@ export const PUSH_CHANNELS = {
   onFind: 'zero:find',
   onZoomPercent: 'zero:zoom-percent',
   onRecovered: 'zero:recovered',
+  onJoinRoom: 'zero:join-room',
   onOpenItem: 'zero:open-item',
   onOpenSettings: 'zero:open-settings',
   onScreenDetail: 'zero:screen-detail',
@@ -167,7 +193,7 @@ export const PUSH_CHANNELS = {
 // and the handler on the far side reads an object, so the key each value goes
 // under is part of the contract and belongs here beside the channel.
 export const WRAPPED_ARGS = {
-  notify: ['arrivals'],
+  notify: ['arrivals', 'needsYou'],
   track: ['name'],
   instructionWrite: ['id', 'text'],
   instructionVersion: ['id', 'at'],

package/shared/claude-code-shape.mjs

@@ -0,0 +1,6 @@
+// WHAT CLAUDE'S SIGN-IN CODE LOOKS LIKE: the authorization code, a `#`, and
+// the state, as Claude's sign-in page shows it to copy. Used to fill the code
+// in from the clipboard (main/ipc.mjs) without taking anything else she copied.
+export function looksLikeClaudeCode(text) {
+  return /^[A-Za-z0-9._~+/=-]{10,}#[A-Za-z0-9._~+/=-]{6,}$/.test(String(text || '').trim());
+}

package/shared/claude-usage.d.mts

@@ -10,6 +10,7 @@ import type { UsageLimit } from './usage.d.mts';
 
 export declare function resetAt(text: string, now?: number, zoneNow?: string | null): number | null;
 export declare function readUsage(text: string | null | undefined, now?: number, zoneNow?: string | null): UsageLimit[];
+export declare function readUsageReport(value: unknown, now?: number): UsageLimit[];
 export declare function pillText(
   limits: UsageLimit[] | null | undefined,
   now?: number,

package/shared/claude-usage.mjs

@@ -22,7 +22,7 @@
 // timezone stamp it prints, and the refusal to count down from a stamp computed
 // somewhere else. What belongs to a LIMIT, any limit, is next door.
 
-import { instantIn, localZone, sessionLimit, untilReset, wallIn } from './usage.mjs';
+import { instantIn, localZone, resetDay, sessionLimit, toMinute, untilReset, wallIn } from './usage.mjs';
 
 /** One limit, as the CLI reported it. */
 // { span, qualifier, name, percent, resetsAt|null, resetsText, resetsOn, zone }
@@ -153,6 +153,47 @@ export function readUsage(text, now = Date.now(), zoneNow = localZone()) {
   return out;
 }
 
+/** Provider limits from Claude Code's get_usage response, without local activity estimates. */
+export function readUsageReport(value, now = Date.now()) {
+  let report = value;
+  if (typeof report === 'string') {
+    try { report = JSON.parse(report); } catch { return []; }
+  }
+  if (report?.rate_limits_available !== true || !report.rate_limits) return [];
+  const data = report.rate_limits;
+  const windows = [
+    ['session', null, data.five_hour],
+    ['week', 'all models', data.seven_day],
+    ['week', 'OAuth apps', data.seven_day_oauth_apps],
+    ['week', 'Opus', data.seven_day_opus],
+    ['week', 'Sonnet', data.seven_day_sonnet],
+    ...(Array.isArray(data.model_scoped) ? data.model_scoped : [])
+      .filter(row => typeof row?.display_name === 'string' && row.display_name.trim())
+      .map(row => ['week', row.display_name, row]),
+  ];
+  return windows.flatMap(([span, qualifier, row]) => {
+    const percent = row?.utilization;
+    // Over 100 is a limit past its allowance, which is full, not unreadable.
+    if (typeof percent !== 'number' || !Number.isFinite(percent) || percent < 0) return [];
+    const at = typeof row.resets_at === 'string' ? Date.parse(row.resets_at) : NaN;
+    // Whole percents, as the text report printed them; only a full limit reads 100, only an unused one 0.
+    const whole = percent === 0 || percent >= 100 ? Math.min(100, percent) : Math.min(99, Math.max(1, Math.round(percent)));
+    const known = Number.isFinite(at);
+    return [{ span, qualifier, name: limitName(span, qualifier), percent: whole, resetsAt: known ? at : null,
+      ...(known ? clockWords(at, now) : { resetsText: null, resetsOn: null }), zone: known ? localZone() : null }];
+  });
+}
+
+// The words the text report used to carry, in this machine's zone, so the
+// panel keeps saying "Resets 6:19pm" and not a countdown (limitRows, shared/usage.mjs).
+function clockWords(at, now) {
+  const d = new Date(toMinute(at));
+  const h = d.getHours();
+  const m = d.getMinutes();
+  const resetsText = `${h % 12 || 12}${m ? `:${String(m).padStart(2, '0')}` : ''}${h < 12 ? 'am' : 'pm'}`;
+  return { resetsText, resetsOn: resetDay(at, now) };
+}
+
 /**
  * WHAT THE PILL SAYS. Null when there is nothing honest to print, and then
  * nothing is drawn at all rather than a pill saying it does not know.

package/shared/cloud-hand-back.d.mts

@@ -0,0 +1,7 @@
+// Types for shared/cloud-hand-back.mjs, read by the supervisor and the thread.
+
+/** The line a cloud run ends on when its request needs this computer. */
+export const HAND_BACK: string;
+
+/** Whether a reply hands its thread back: the marked line, at a line's start. */
+export function handsBack(result: string | null | undefined): boolean;

package/shared/cloud-hand-back.mjs

@@ -0,0 +1,20 @@
+// THE LINE A CLOUD RUN ENDS ON WHEN ITS REQUEST NEEDS THIS COMPUTER. The cloud
+// run is told to write it (main/cloud/run.mjs CLOUD_NOTE); the supervisor reads
+// it and moves the thread here (Supervisor#_noteCloudHandBack). No leading
+// bracket: a trace line that starts with one is read as a tool call.
+export const HAND_BACK = 'AGENTBOX-NEEDS-THE-COMPUTER:';
+
+/** Whether a reply hands its thread back: the marked line, at a line's start. */
+export function handsBack(result) {
+  return String(result ?? '').split('\n').some((line) => line.trimStart().startsWith(HAND_BACK));
+}
+
+/** What the run said it was missing, cut to fit a card; null when it said nothing. */
+export function handBackWhat(result, max = 90) {
+  const line = String(result ?? '').split('\n').map((l) => l.trimStart()).find((l) => l.startsWith(HAND_BACK));
+  const what = line?.slice(HAND_BACK.length).trim().replace(/[.\s]+$/, '') ?? '';
+  if (!what) return null;
+  if (what.length <= max) return what;
+  const cut = what.lastIndexOf(' ', max);
+  return `${what.slice(0, cut > 0 ? cut : max)}…`;
+}

package/shared/cloud-kit.d.mts

@@ -0,0 +1,219 @@
+// Types for shared/cloud-kit.mjs, the kit a cloud run is started from.
+//
+// The screen asks it one thing, `runOfClaim` (renderer/src/phone-rows.ts), and
+// a declaration that stopped there would come through as `any` the day the
+// screen asks it a second. So every export is here, and the kit's own fields
+// are the ones `checkKit` reads: that function is the agreement between the
+// computer, the server and the phone, and this says the same thing in types.
+
+/** Where a reply goes in a turn's prompt. */
+export interface ReplyFrame {
+  before: string;
+  after: string;
+}
+
+/** What an agent said, as this file reads it off a run's event log. */
+export interface Answer {
+  text: string;
+  isError: boolean;
+}
+
+/** The lines that open a Codex kit's thread, and the settings its turns carry. */
+export interface CodexKit {
+  open: string[];
+  /** A new thread starts one (`thread/start`); a kept thread resumes one. */
+  startId?: number;
+  resumeId?: number;
+  firstTurnId: number;
+  turn: { threadId?: string } & Record<string, unknown>;
+}
+
+/** A thread's next turn, left in storage for the cloud to start. */
+export interface Kit {
+  v: number;
+  engine: 'claude' | 'codex';
+  madeAt: number;
+  cwd: string;
+  argv: string[];
+  frame: ReplyFrame;
+  login: { engine: 'claude' | 'codex'; key: string; id?: string | null };
+  /** Which thread, on which computer, in which project. */
+  item?: string;
+  device?: string;
+  project?: string;
+  /** What a computer joining this run needs to write its own marker. */
+  marker?: { configDir?: string } & Record<string, unknown>;
+  /** The cloud's note at the top of the agent's first line. */
+  note?: string | null;
+  /** Carried into the run's `offline.kept`. */
+  kept?: unknown;
+  env?: Record<string, string>;
+  /** A folder with no repository behind it, so no bundle and no branch. */
+  plain?: boolean;
+  branch?: string | null;
+  bundleKey?: string | null;
+  base?: { key: string; sha: string } | null;
+  refs?: Record<string, string> | null;
+  changesRef?: string;
+  remote?: string | null;
+  docs?: unknown;
+  files?: { path: string; key: string; untar?: string }[];
+  homeFiles?: { rel: string; key: string }[];
+  bringDirs?: { name: string; dir: string }[];
+  /** Servers whose calls wait for an answer rather than being refused. */
+  hold?: string[];
+  handshakes?: Record<string, unknown>;
+  codex?: CodexKit;
+  /** On a project's new-thread kit: the first prompt, the main to branch at,
+   *  and what that kit runs, which a phone's choices have to match. */
+  newThread?: {
+    brief: string;
+    mainSha: string;
+    model?: string | null;
+    effort?: string | null;
+    defaultEngine?: 'claude' | 'codex';
+  };
+}
+
+/** What a sandbox is handed to start a run from a kit. */
+export interface StartPayload {
+  action: 'start';
+  runId: string;
+  cwd: string;
+  branch: string | null;
+  bundleUrl?: string;
+  plain?: true;
+  base?: { url: string; sha: string };
+  refs?: Record<string, string> | null;
+  argv: string[];
+  env: Record<string, string>;
+  files: { path: string; url: string; untar?: string }[];
+  changesRef?: string;
+  remote?: string | null;
+  docs?: unknown;
+  homeFiles?: { rel: string; url: string }[];
+  login: { engine: string; id: string | null; url: string };
+  results: {
+    bundleUrl: string;
+    changesUrl: string;
+    docsUrl: string;
+    eventsUrl: string;
+    doneUrl: string;
+    bring: { dir: string; url: string }[];
+  };
+  tails: true;
+  offline: {
+    afterMs: number;
+    endTurn: string;
+    kept: unknown;
+    hold?: string[];
+    handshakes?: Record<string, unknown>;
+    away?: true;
+  };
+}
+
+/** A turn carried across reads of a Codex run's lines. */
+export interface CodexReadState {
+  resumeId?: number;
+  turnIds?: number[];
+  /** True once the resume was answered, or why it was refused. */
+  resumed?: true | string;
+  threadId?: string;
+  result?: string | null;
+  final?: boolean;
+}
+
+export const KIT_VERSION: number;
+export const REPLY_MARK: string;
+export const CLOUD_TAKES_AFTER_MS: number;
+export const CLOUD_TAKES_UNTIL_MS: number;
+export const KIT_FRESH_MS: number;
+
+/** The command a cloud run claims a reply with. */
+export function cloudClaim(runId: string): string;
+/** The run id inside such a claim, or null when it is not one. */
+export function runOfClaim(claimedBy: unknown): string | null;
+/** The session name a run gets, whoever starts it. */
+export function cloudSessionId(item: string | null | undefined, runId: string): string;
+
+/** Where a thread's kit lives in the person's own storage. */
+export function kitKey(device: string | null | undefined, project: string | null | undefined, item: string | null | undefined): string;
+/** What the server keeps about a run it started, for the moment it ends. */
+export function serverRunKey(runId: string | null | undefined): string;
+/** Written by a computer that has joined a run the server started. */
+export function serverJoinedKey(runId: string | null | undefined): string;
+/** The objects a run writes as it ends. */
+export function runKey(runId: string, name: string): string;
+
+/** The text either side of the reply, or null when the prompt has no one place for it. */
+export function replyFrame(prompt: string | null | undefined): ReplyFrame | null;
+export function replyPrompt(frame: ReplyFrame, reply: string | null | undefined): string;
+/** The first line on the agent's input, as the computer writes one. */
+export function cloudUserLine(text: string, opts?: { note?: string | null; uuid?: string }): string;
+
+/** Why a kit cannot be started from, or null. */
+export function checkKit(kit: unknown, opts?: { now?: number }): string | null;
+
+/** The sandbox's `start` for a run from this kit. */
+export function startPayload(kit: Kit, opts: {
+  runId: string;
+  getUrl: (key: string) => string | Promise<string>;
+  putUrl: (key: string) => string | Promise<string>;
+  loginName: (key: string) => string;
+  offlineAfterMs?: number;
+  kept?: unknown;
+  endTurn?: string;
+  refs?: Record<string, string> | null;
+  away?: boolean;
+}): Promise<StartPayload>;
+
+export const APPROVALS_SERVER: string;
+/** A held request's card id, marked as the cloud's. */
+export function askId(runId: string | number, conn: string | number, id: string | number): string;
+/** Whether a card's id is one the cloud put on the phone. */
+export function cloudCard(approval: unknown): boolean;
+export const DECLINED: string;
+/** The answer to a held approval_prompt call, as the app's own server would write it. */
+export function approvalAnswerLine(id: string | number, opts?: { allow: boolean; note?: string | null; input?: Record<string, unknown> }): string;
+
+/** Each of Claude Code's `result` lines, in order, off a run's event log. */
+export function answersIn(eventsText: string | null | undefined): Answer[];
+/** The `result`s among stream-json lines. */
+export function resultsInLines(lines: string[]): Answer[];
+/** What the agent last said, or null when the run never got that far. */
+export function lastAnswerIn(eventsText: string | null | undefined): Answer | null;
+
+// These two take the parts of a kit they read rather than a whole one, because
+// the server writes a turn from what it kept of a run and not from the kit
+// (cloud/gateway/phone.mjs).
+/** What opens a Codex kit's thread in the cloud, as one input. */
+export function codexOpenLines(kit: { codex: Pick<CodexKit, 'open'> }): string;
+/** A reply as one turn of the kit's thread, with request id `id`. */
+export function codexTurnLines(
+  kit: { frame: ReplyFrame; codex: Pick<CodexKit, 'turn'> },
+  reply: string | null | undefined,
+  opts: { id: number; raw?: string | null; threadId?: string | null },
+): string;
+/** Each answer among a Codex run's lines, with `state` carrying a turn across reads. */
+export function codexReadLines(lines: string[], state?: CodexReadState): Answer[];
+/** Each Codex turn's answer, in order, off a run's event log. */
+export function codexAnswersIn(eventsText: string | null | undefined, state?: CodexReadState): Answer[];
+/** A Codex run's last answer off its event log, or null. */
+export function codexAnswerIn(eventsText: string | null | undefined): Answer | null;
+
+export const NEW_THREAD: string;
+export const NEW_ITEM_MARK: string;
+export const NEW_TITLE_MARK: string;
+export const NEW_BODY_MARK: string;
+export const NEW_THREAD_CODEX: string;
+export function newThreadKitKey(device: string | null | undefined, project: string | null | undefined, engine?: 'claude' | 'codex'): string;
+
+/**
+ * A project's new-thread kit made the kit of thread `itemId`, or null for a kit
+ * that is not one. */
+export function fillNewThreadKit(kit: Kit | null | undefined, who: { itemId: string; title?: string; body?: string }): {
+  kit: Kit;
+  prompt: string;
+  refs: Record<string, string>;
+  mainSha: string;
+} | null;