agentbox-app 0.1.6 → 0.1.11

package/shared/work-items.mjs

@@ -66,7 +66,7 @@ export const CLAUDE_PERMISSION_MODES = [
 // `answerMode` used to live on the ledger: what one reply is allowed to do on
 // the founder's Mac, turned straight into `--permission-mode` on a real process
 // by spawnPlan. A guard here stripped it off any line that did not claim to be
-// hers, which closed the STRUCTURED path, the MCP and the app.
+// the founder's, which closed the STRUCTURED path, the MCP and the app.
 //
 // IT COULD NOT CLOSE THE FILE, AND NOTHING WRITTEN HERE EVER COULD. `source` is
 // a plain string in a line and nothing checks it. A worker with Bash could
@@ -78,8 +78,8 @@ export const CLAUDE_PERMISSION_MODES = [
 // own storage now, written by main and by nothing else (main/answer-modes.mjs),
 // which is the convention Claude Code uses for its standing policy. Everything
 // on the ledger today is a claim about the WORK, and a forged line can still
-// fake her archive or her answer — true of any append-only log nobody signs, and
-// filed for her rather than papered over here. What it can no longer do is hand
+// fake the founder's archive or answer, which is true of any append-only log
+// nobody signs, and is filed as a known issue rather than papered over here. What it can no longer do is hand
 // anything a permission.
 //
 // If a future field is a grant rather than an opinion, the answer is the same
@@ -90,29 +90,96 @@ export const CLAUDE_PERMISSION_MODES = [
 // state is worse than one that visibly does nothing.
 // `label` IS THE NAME ON THE ROW, AND IT EXISTS BECAUSE `title` CANNOT BE ONE.
 //
-// A message she dictates becomes an item whose title is its first line,
-// verbatim (message-split.ts). Measured on her Agentbox store, 2026-09-03: 214
-// items are hers, median title 84 characters, 145 of them over 60, 37 ending in
-// an ellipsis mid sentence, and 76 opening with "I", "I've been", "Can you" or
-// "We". Eleven of those in a column is eleven rows that look like one row.
+// A dictated message becomes an item whose title is its first line, verbatim
+// (message-split.ts). Such titles run long, are often cut off mid sentence with
+// an ellipsis, and many open with "I", "I've been", "Can you" or "We". Eleven
+// of those in a column is eleven rows that look like one row.
 //
 // The obvious fix, having a session write a better title, does not work and
-// never did: `beats` below makes her outrank an agent per field, so 208 of those
-// 214 titles are hers and an agent's rewrite of one is accepted here and then
-// dropped on the floor, silently. That is the whole reason this is a second
-// field rather than a better-behaved writer.
+// never did: `beats` below makes the founder outrank an agent per field, so
+// nearly every such title is the founder's and an agent's rewrite of one is
+// accepted here and then dropped on the floor, silently. That is the whole
+// reason this is a second field rather than a better-behaved writer.
 //
-// So `title` stays exactly what she typed and nothing about who owns it changes.
-// `label` is the short written name a session puts beside it, and the LIST
-// prefers it (`rowTitle`, list-rules.ts). Everything else still reads the title,
-// so her own words are what she finds when she opens the row, and search matches
-// either name.
+// So `title` stays exactly what the user typed and nothing about who owns it
+// changes. `label` is the short written name a session puts beside it, and the
+// LIST prefers it (`rowTitle`, list-rules.ts). Everything else still reads the
+// title, so the user's own words are what they find when they open the row, and
+// search matches either name.
 export const WORK_ITEM_FIELDS = [
   'title', 'label', 'body', 'kind', 'labels', 'priority', 'parent',
   'status', 'result', 'note', 'answer', 'product', 'runAt', 'answeredThrough',
   'engine', 'model', 'effort',
+  // WHETHER THIS HAS BEEN STARTED AT ALL. 'later' is a thread written down and
+  // deliberately not begun: it waits for a person, not for a clock, and
+  // `isDue` below is where that becomes true of the whole app. 'now' is how it
+  // is started, and a thread without the field at all is an ordinary one that
+  // started the moment it was sent.
+  'start',
+  // THE TEAM FIELDS. All four are about PEOPLE on a shared project, and a
+  // private project never sets them, so a row without them reads as before.
+  //   assignee  the person who has to act next, or 'agent' once a person has
+  //             handed it back to the agents
+  //   runner    the person whose Mac runs agents on this row; without one it
+  //             is whoever started it (`createdBy`)
+  //   due       a calendar day, YYYY-MM-DD, or 'none' to clear one
+  //   people    who is on the conversation
+  'assignee', 'runner', 'due', 'people',
+  // THE THREAD'S OWN FIELDS (the team version, approved 2026-10-01).
+  //   visibility  'team' (the default), 'people' or 'private': whether every
+  //               teammate sees this thread's summary on the Team board, only
+  //               the people named in `visibleTo`, or nobody but you
+  //   visibleTo   the people a 'people' thread reaches, by id. Ignored on the
+  //               other two, and a 'people' thread naming nobody reaches
+  //               nobody (shared/thread-cards.mjs says why it fails closed)
+  //   problem, progress, solution
+  //               the SUMMARY, one short sentence each (an agent's is held to
+  //               SUMMARY_WORDS, shared/thread-cards.mjs). The agent keeps it
+  //               current and the person can edit it in place, so these are
+  //               the fields where the later write wins whoever wrote it
+  //               (SHARED_FIELDS below)
+  //   blockedBy, blocks
+  //               other threads' ids, the summary's Linked part
+  'visibility', 'visibleTo', 'problem', 'progress', 'solution', 'blockedBy', 'blocks',
+  // A REACTION, AND IT IS THE ONE FIELD ON THIS LIST THAT IS A DELTA RATHER
+  // THAN A VALUE: `{ on, emoji }` to put one on, `{ on, emoji, off: true }` to
+  // take yours back, where `on` is the uid of the line the message was written
+  // as. Every other field here keeps the latest write and drops the rest, which
+  // for a reaction would mean your 👀 erasing the one a teammate put on the same
+  // message a second earlier. The fold accumulates these per person instead and
+  // reads them back as `reactions` (see foldWorkItems); nothing ever reads a
+  // bare `react` off an item.
+  'react',
+  // A REPLY IN A THREAD (w-920461cbe6): the uid of the message line it answers,
+  // written on the same line as the reply's own `answer`. Like `react` it is a
+  // mark on ONE line rather than a value the row holds, so the fold skips it;
+  // the chat reads it per line (renderer/src/thread-history.ts).
+  'inReplyTo',
 ];
 
+// THE SUMMARY IS SHARED BETWEEN THE PERSON AND THE AGENT. Everywhere else the
+// founder's word outranks an agent's forever, which here would mean one edit
+// of hers freezes the summary the agent is meant to keep up to date. So on
+// these fields the later write wins, whoever made it, and the source is still
+// recorded so the panel can say who touched it last.
+const SHARED_FIELDS = new Set(['problem', 'progress', 'solution', 'blockedBy', 'blocks']);
+const MAX_SUMMARY = 1200;
+
+// A person id or a line id: short, plain, never an object a writer slipped in.
+const MAX_PERSON_CHARS = 64;
+function shortId(value) {
+  return typeof value === 'string' && value && value.length <= MAX_PERSON_CHARS ? value : null;
+}
+const DAY_RE = /^(\d{4})-(\d{2})-(\d{2})$/;
+function calendarDay(value) {
+  if (value === 'none') return 'none';
+  const m = typeof value === 'string' ? DAY_RE.exec(value) : null;
+  if (!m) return undefined;
+  const [y, mo, d] = [Number(m[1]), Number(m[2]), Number(m[3])];
+  const date = new Date(Date.UTC(y, mo - 1, d));
+  return date.getUTCFullYear() === y && date.getUTCMonth() === mo - 1 && date.getUTCDate() === d ? value : undefined;
+}
+
 // How long a claim survives without a heartbeat. The MCP server heartbeats on a
 // timer while it holds any claim, so this is a liveness signal about the PROCESS
 // (session dies, child dies, heartbeats stop) rather than anything the model has
@@ -133,6 +200,9 @@ const MAX_SHORT = 200;
 // see. Four fields at this size still leave a line at half the append ceiling.
 export const MAX_TEXT_BYTES = 32 * 1024;
 const MAX_LABELS = 20;
+// How long one emoji may be, in code points. 👩🏽‍🚀 is five; eight leaves room
+// for the longest sequence anyone picks and refuses a sentence pasted in.
+const MAX_EMOJI = 8;
 const MAX_ID_CHARS = 64;
 // A single line longer than this is treated as torn or hostile and skipped
 // rather than parsed. Matches the ceiling records.mjs already uses.
@@ -235,6 +305,11 @@ export function normalizeLine(line) {
     id: raw.id,
     ts: Number.isFinite(raw.ts) ? raw.ts : 0,
     source,
+    // WHO WROTE IT and the line's own id. Stamped where a line reaches the
+    // disk on a signed-in Mac (main/store/work-items.mjs), absent everywhere
+    // else, and a line without them reads exactly as it always did.
+    by: shortId(raw.by),
+    uid: shortId(raw.uid),
     // A founder line is never fenced, so its epoch is ignored even if present.
     epoch: source === 'agent' && Number.isFinite(raw.epoch) ? raw.epoch : null,
     claim: raw.claim && typeof raw.claim === 'object' ? raw.claim : null,
@@ -321,6 +396,10 @@ function coerceField(field, value) {
     // that coerces to undefined is dropped by the fold, so without a falsy
     // sentinel a schedule could be set and never cleared.
     case 'runAt': return Number.isFinite(value) ? Math.trunc(value) : undefined;
+    // 'later' or 'now', and 'now' is the falsy sentinel for the same reason
+    // runAt keeps 0: a field that coerces to undefined is dropped by the fold,
+    // so without a real value for "started" nothing could ever clear it.
+    case 'start': return value === 'later' || value === 'now' ? value : undefined;
     // WHICH ANSWER A SESSION HAS ALREADY ACTED ON, as that answer's own ts.
     //
     // An answer had two states and the ledger recorded one. A worker finishes
@@ -340,6 +419,40 @@ function coerceField(field, value) {
       const labels = value.map((l) => str(l, MAX_SHORT)).filter(Boolean).slice(0, MAX_LABELS);
       return labels.length ? labels : undefined;
     }
+    case 'assignee': case 'runner': return shortId(value) ?? undefined;
+    case 'due': return calendarDay(value);
+    case 'people': {
+      if (!Array.isArray(value)) return undefined;
+      const people = [...new Set(value.map(shortId).filter(Boolean))].slice(0, MAX_LABELS);
+      return people.length ? people : undefined;
+    }
+    // WHICH MESSAGE AND WHICH EMOJI. `on` is a line uid, bounded like any other
+    // id; the emoji is counted in CHARACTERS rather than bytes, because a flag
+    // or a person with a skin tone is several code points joined and cutting one
+    // mid-sequence stores a glyph nobody chose.
+    case 'react': {
+      if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined;
+      const on = shortId(value.on);
+      const emoji = typeof value.emoji === 'string' ? [...value.emoji.trim()].slice(0, MAX_EMOJI).join('') : '';
+      if (!on || !emoji) return undefined;
+      return value.off === true ? { on, emoji, off: true } : { on, emoji };
+    }
+    case 'inReplyTo': return shortId(value) ?? undefined;
+    case 'visibility': return value === 'private' || value === 'team' || value === 'people' ? value : undefined;
+    // An empty list is a real value: it is how the last chosen person comes
+    // off a thread, and the thread then reaches nobody until she names one.
+    case 'visibleTo': {
+      if (!Array.isArray(value)) return undefined;
+      return [...new Set(value.map(shortId).filter(Boolean))].slice(0, MAX_LABELS);
+    }
+    // An empty string is a real value here: it is how a person clears a line
+    // of the summary, and a field that coerces to undefined cannot be cleared.
+    case 'problem': case 'progress': case 'solution':
+      return typeof value === 'string' ? value.trim().slice(0, MAX_SUMMARY) : undefined;
+    case 'blockedBy': case 'blocks': {
+      if (!Array.isArray(value)) return undefined;
+      return [...new Set(value.map(shortId).filter(Boolean))].slice(0, MAX_LABELS);
+    }
     default: return undefined;
   }
 }
@@ -355,10 +468,9 @@ function coerceField(field, value) {
 //   WHO   An agent's `done` and the founder's archive are the same word for
 //         opposite events. Her own ask, ended by an agent, is an answer she has
 //         not received; ended by her, it is filed. the app's inbox could not tell
-//         them apart, so every answer to a question she asked went straight to
-//         the archive and she reasonably concluded the work never happened
-//         (2026-08-06: she asked the same question three times in six hours,
-//         and all three had been answered within twenty minutes).
+//         them apart, so every answer to a question the founder asked went
+//         straight to the archive, and it reasonably looked as though the work
+//         never happened, so the same question got asked again and again.
 //   WHEN  Two identical nudges are two asks. A delivery keyed on the words
 //         alone treats the second as already handled and swallows it.
 //
@@ -367,6 +479,22 @@ function coerceField(field, value) {
 //   2. skip an agent line fenced out by a newer epoch (the zombie writer)
 //   3. apply the claim, if this line carries one
 //   4. apply the patch field by field, founder outranking agent
+// THE CHIPS UNDER A MESSAGE, out of the presses the ledger holds. Message by
+// message, emoji by emoji, the people still on it — oldest press first, so the
+// chips do not reorder themselves under somebody's pointer as a teammate's
+// lines arrive. Returns null when every press has been taken back, which is
+// what leaves a row with no `reactions` at all.
+function rollUpReactions(presses) {
+  const live = [...presses.values()].filter((p) => !p.off).sort((a, b) => a.ts - b.ts);
+  if (!live.length) return null;
+  const out = {};
+  for (const press of live) {
+    const message = out[press.on] ?? (out[press.on] = {});
+    (message[press.emoji] ?? (message[press.emoji] = [])).push(press.who);
+  }
+  return out;
+}
+
 export function foldWorkItems(lines, now = Date.now()) {
   const items = new Map();
 
@@ -379,10 +507,15 @@ export function foldWorkItems(lines, now = Date.now()) {
       item = {
         id: line.id, status: 'open', title: '', kind: '', labels: [],
         priority: 0, epoch: 0, claim: null, createdAt: line.ts, updatedAt: line.ts,
-        wrote: {},
+        createdBy: line.by, wrote: {},
       };
       items.set(line.id, item);
     }
+    // Who started the row is whoever wrote its EARLIEST line, not the first
+    // line this Mac happened to receive: a teammate's lines arrive late.
+    if (line.ts < item.createdAt || (line.ts === item.createdAt && !item.createdBy)) {
+      if (line.by) item.createdBy = line.by;
+    }
 
     // Fencing. An agent line written under a superseded epoch is the whole
     // reason this field exists: it is a live worker whose lease lapsed, and
@@ -392,7 +525,9 @@ export function foldWorkItems(lines, now = Date.now()) {
     if (line.claim) {
       // A claim at or above the current epoch takes the item. A heartbeat only
       // extends a lease it still legitimately holds.
-      if (line.epoch >= item.epoch) {
+      const renewsHeldClaim = !line.heartbeat || (item.claim
+        && line.epoch === item.epoch && line.claim.holder === item.claim.holder);
+      if (line.epoch >= item.epoch && renewsHeldClaim) {
         item.epoch = line.epoch;
         item.claim = {
           holder: String(line.claim.holder ?? ''),
@@ -412,16 +547,48 @@ export function foldWorkItems(lines, now = Date.now()) {
     // are already in her ledger and will be there forever.
     const patch = line.heartbeat ? {} : line.patch;
 
+    // WHO SAID WHAT, AND WHERE, for a conversation between people
+    // (w-920461cbe6). Every person's message, kept in a list of its own because
+    // the fold below keeps only the newest answer, and a busy chat needs to know
+    // who spoke last in the chat itself and in each thread. Only a person's own
+    // words count (a line with a writer), and only rows with people on them keep
+    // the result (see the end of the fold).
+    const words = typeof patch.answer === 'string' && patch.answer !== WITHDRAWN ? patch.answer
+      : typeof patch.body === 'string' ? patch.body : null;
+    if (line.by && words && words.trim()) {
+      (item.said ??= []).push({ uid: line.uid ?? null, by: line.by, ts: line.ts, text: words.trim().slice(0, TALK_TEXT), inReplyTo: patch.inReplyTo ?? null, body: typeof patch.answer !== 'string' });
+    }
+
     for (const [field, value] of Object.entries(patch)) {
+      // A REACTION IS ACCUMULATED, NOT HELD. Every other field below keeps one
+      // value and the newest writer owns it; a reaction belongs to the person
+      // who pressed it, so two people on one message have to survive each other.
+      // The key is the message, the emoji and the person, and within that one
+      // key the newest press wins — by its own timestamp, because a page pulled
+      // from the cloud is not promised in the order anybody pressed anything.
+      if (field === 'react') {
+        if (!item.reacts) item.reacts = new Map();
+        const who = line.by || 'you';
+        const key = `${value.on}\u0000${value.emoji}\u0000${who}`;
+        const was = item.reacts.get(key);
+        if (!was || line.ts >= was.ts) {
+          item.reacts.set(key, { ts: line.ts, off: value.off === true, who, on: value.on, emoji: value.emoji });
+        }
+        continue;
+      }
+      // WHICH MESSAGE A REPLY ANSWERS belongs to that reply's line alone. Held
+      // as a value, the row would carry the newest reply's parent forever.
+      if (field === 'inReplyTo') continue;
       const held = item.wrote[field];
       // There used to be an exception here, for machinery spending a one-off
       // permission mode over the founder's own grant. That field is not on the
       // ledger any more (see the note beside WORK_ITEM_FIELDS), so
       // the plain rule is the only rule: a weaker writer never overwrites a
       // stronger one's value.
-      if (held && !beats(line, held)) continue;
+      if (held && !beats(line, held, field)) continue;
       item[field] = value;
       item.wrote[field] = { ts: line.ts, source: authorityOf(line, field, value) };
+      if (line.by) item.wrote[field].by = line.by;
     }
 
     item.updatedAt = Math.max(item.updatedAt, line.ts);
@@ -440,18 +607,68 @@ export function foldWorkItems(lines, now = Date.now()) {
   for (const item of items.values()) {
     item.claimExpired = !!(item.claim && item.claim.leaseUntil < now);
     if (item.status === 'claimed' && (!item.claim || item.claimExpired)) item.status = 'open';
+    if (item.reacts) {
+      const chips = rollUpReactions(item.reacts);
+      delete item.reacts;
+      if (chips) item.reactions = chips;
+    }
+    if (item.said) {
+      const said = item.said;
+      delete item.said;
+      if (Array.isArray(item.people) && item.people.length) item.talk = talkOf(said);
+    }
   }
 
   return items;
 }
 
+// A reply taken back reads as this, and is nobody's news.
+const WITHDRAWN = '(withdrawn)';
+// How much of a message the record keeps: enough for a row's one line.
+const TALK_TEXT = 280;
+// How many of the newest messages the record keeps, in the chat and in each
+// thread. The counts it answers stop at your own newest word, which in a chat
+// you are part of is never this far back.
+const TALK_KEEP = 100;
+
+/**
+ * THE CHAT AND ITS THREADS, AS WHO SPOKE WHERE (w-920461cbe6): `chat` is the
+ * main conversation, oldest first, and `threads` the replies under each message
+ * they answer, with who wrote that message and its words. Pure bookkeeping for
+ * `whatWaits` (shared/team-rules.mjs) and the row's one line; the messages
+ * themselves are read off the ledger by the thread view, as before.
+ */
+function talkOf(said) {
+  const lines = [...said].sort((a, b) => a.ts - b.ts);
+  const chat = [];
+  const threads = {};
+  const parents = new Map();
+  const bodies = new Set();
+  for (const s of lines) {
+    // A rename that sends the same opening words again is not a new message.
+    if (s.body) { if (bodies.has(s.text)) continue; bodies.add(s.text); }
+    const said1 = { by: s.by, ts: s.ts, text: s.text };
+    const parent = s.inReplyTo ? parents.get(s.inReplyTo) : null;
+    if (parent) {
+      (threads[s.inReplyTo] ??= { by: parent.by, text: parent.text, replies: [] }).replies.push(said1);
+      continue;
+    }
+    // A reply to a message this chat does not hold is drawn in the chat, so it
+    // counts there too.
+    chat.push(said1);
+    if (s.uid) parents.set(s.uid, said1);
+  }
+  for (const t of Object.values(threads)) t.replies = t.replies.slice(-TALK_KEEP);
+  return { chat: chat.slice(-TALK_KEEP), threads };
+}
+
 /* -------------------------------- the thread ----------------------------- */
 // EVERY TURN OF ONE ROW, OLDEST FIRST. The fold answers "what does this item
 // say now"; this answers "what has been said here", which is a different
 // question and nothing could ask it before.
 //
-// She was describing a real hole. Every reply she wrote spawned a fresh session
-// holding one field, `answer`, with no sight of her earlier answers on the same
+// There was a real hole here. Every reply the user wrote spawned a fresh session
+// holding one field, `answer`, with no sight of their earlier answers on the same
 // row and no sight of the work it was replying about. One session built
 // thirty-nine images off a bare line asking for more options, because cold that
 // is what the line says. The whole exchange was on disk the entire time: the
@@ -512,7 +729,8 @@ function authorityOf(line, field, value) {
 
 // Does the incoming line outrank the one already holding this field? The founder
 // wins over any agent regardless of time; between equals, later wins.
-function beats(incoming, held) {
+function beats(incoming, held, field) {
+  if (SHARED_FIELDS.has(field)) return incoming.ts >= held.ts;
   if (held.source === 'founder' && incoming.source !== 'founder') return false;
   if (incoming.source === 'founder' && held.source !== 'founder') return true;
   return incoming.ts >= held.ts;
@@ -530,10 +748,20 @@ function beats(incoming, held) {
 // the whole reason this is a predicate over the clock rather than a timer, and
 // it is what makes a schedule survive an app restart, a reboot, and a store
 // restored onto another machine (the founder's requirement, 2026-08-06).
+// AND A THREAD IN LATER WAITS FOR A PERSON RATHER THAN A CLOCK (w-afb66e6661).
+// "Add it to Later" on the card writes `start: 'later'`, which means exactly
+// what a future moment means and never arrives on its own: not claimable, no
+// session, not in the inbox. Pressing start on the thread writes 'now'.
 export function isDue(item, now = Date.now()) {
+  if (item?.start === 'later') return false;
   return !item?.runAt || item.runAt <= now;
 }
 
+/** Written down and deliberately not begun. */
+export function notStarted(item) {
+  return item?.start === 'later';
+}
+
 export function isClaimable(item, now = Date.now()) {
   if (!item) return false;
   if (!PULLABLE.includes(item.status)) return false;