agentbox-app 0.1.6

package/main/updater.mjs

@@ -0,0 +1,240 @@
+// THE APP UPDATES ITSELF, so nobody is ever asked to download it twice.
+//
+// There is a signed, notarised build on astral.ac now, so the horse is in
+// front.
+//
+// WHAT IT DOES, in the order it happens. A few seconds after the window is up
+// it asks GitHub whether there is a newer Agentbox. If there is, it downloads it
+// quietly in the background, and when the download finishes it says so in
+// Settings and in ⌘K. Nothing restarts under her. The restart is the button she
+// pressed, which is the half she asked for by name.
+//
+// FOUR THINGS ABOUT THE SHAPE, each load-bearing:
+//
+// 1. IT NEVER OPENS A DIALOG AND NEVER STEALS FOCUS. electron-updater will pop
+//    a native box on some paths if you let it; every one of those is off here.
+//    An app that interrupts her to tell her it is healthy is the thing her
+//    whole inbox exists to stop.
+// 2. IT IS SILENT WHEN IT FAILS. A laptop on a plane, a GitHub outage, a
+//    corporate proxy: none of those are her problem and none of them get a
+//    banner. The failure is recorded, `state` reports it, and the Settings row
+//    is the one place that ever says so, because that is the screen you open
+//    when you want to know something.
+// 3. IT DOES NOTHING AT ALL FROM SOURCE. `autoUpdater.isUpdaterActive` is false
+//    when `app.isPackaged` is false, so a dev run skips the check rather than
+//    erroring against a feed it has no business reading. We report that state
+//    as `unsupported` with a reason rather than pretending to be idle.
+// 4. IT INSTALLS ON QUIT TOO. If she never presses the button and just quits,
+//    the downloaded update is applied then, so the next launch is current. The
+//    button is the fast path, not the only path.
+//
+// WHERE THE UPDATE COMES FROM. `Astral-Agent/astral-releases`, the same public
+// repo astral.ac/download already redirects to, configured in package.json's
+// `build.publish`. electron-updater reads `releases/latest`, then
+// `latest-mac.yml` on that release, and compares its `version` against this
+// build's. It downloads the `.zip`, NOT the `.dmg`: Squirrel. Mac swaps an .app
+// bundle and cannot read a disk image, which is why `build.mac.target` gained a
+// zip beside the dmg and why a release that ships only a dmg fails with
+// ERR_UPDATER_ZIP_FILE_NOT_FOUND. `scripts/publish-download.mjs` is what puts
+// all three files on the release together.
+//
+// AND THE ONE THING THAT IS NOT TRUE ANY MORE. `main/analytics.mjs` opens by
+// calling itself the only place anything leaves this machine. Since this file
+// exists that is no longer so: an update check is a request to github.com. It
+// carries no identity, no key and no account, and it is not routed through
+// PostHog, but it IS traffic, and `legal/privacy.html` should say so in a
+// sentence. That page is in the website repo, not this one.
+
+import { createRequire } from 'node:module';
+import { Name } from '../shared/product-name.mjs';
+
+const require = createRequire(import.meta.url);
+
+// How long after launch the first check happens. Long enough that it is never
+// competing with the window painting or the supervisor waking its sessions up.
+const FIRST_CHECK_MS = 20_000;
+// And then this often, for the app somebody leaves open for days, which is the
+// normal way Agentbox is used.
+const EVERY_MS = 6 * 60 * 60 * 1000;
+
+/**
+ * PURE, and the whole of what the screens are allowed to know.
+ *
+ * Kept separate from the class below so the states can be tested without an
+ * Electron app, a network, or a packaged build.
+ */
+export function describe(state) {
+  const { phase, currentVersion, newVersion, percent, error, checkedAt, readyAt } = state;
+  return {
+    phase,
+    currentVersion,
+    newVersion: newVersion ?? null,
+    // Whole percent, because a progress number with decimals on it reads as
+    // machinery rather than as an answer.
+    percent: typeof percent === 'number' ? Math.max(0, Math.min(100, Math.round(percent))) : null,
+    error: error ?? null,
+    checkedAt: checkedAt ?? null,
+    // WHEN THE DOWNLOAD FINISHED, which is the moment the news is true. The
+    // inbox row this feeds wears it at its right end like every other row, and
+    // every other row's right end answers "how old is this". Built off the
+    // clock instead it would read "now" forever, which is the app looking busy
+    // about something that has been sitting on the disk since lunchtime.
+    readyAt: phase === 'ready' ? (readyAt ?? null) : null,
+    // The one question every screen actually asks. A screen should not have to
+    // learn which phase strings mean "there is a button to press".
+    ready: phase === 'ready',
+  };
+}
+
+export function createUpdater({ app, log = console, onChanged = () => {} }) {
+  let state = {
+    phase: 'idle',
+    currentVersion: app.getVersion(),
+    newVersion: null,
+    percent: null,
+    error: null,
+    checkedAt: null,
+    readyAt: null,
+  };
+  let timer = null;
+  let stopped = false;
+
+  const set = (next) => {
+    state = { ...state, ...next };
+    try { onChanged(describe(state)); } catch {}
+  };
+
+  // Loaded lazily and inside a try, so a build that somehow shipped without the
+  // dependency degrades to "no updates" instead of failing to boot at all. The
+  // app not starting is a strictly worse outcome than the app not updating.
+  let autoUpdater = null;
+  try {
+    ({ autoUpdater } = require('electron-updater'));
+  } catch (e) {
+    set({ phase: 'unsupported', error: 'This build has no updater in it.' });
+    log.warn?.('[updater] electron-updater is not available:', e?.message ?? e);
+  }
+
+  if (autoUpdater) {
+    // Quiet by construction. `autoDownload` is the only one of these that is
+    // already the default; the rest are here because their defaults interrupt.
+    autoUpdater.autoDownload = true;
+    autoUpdater.autoInstallOnAppQuit = true;
+    autoUpdater.allowPrerelease = false;
+    // electron-updater logs to console by default, which is fine, but its
+    // `logger` is also what it uses to report errors it swallows. Ours keeps
+    // them out of the crash reporter and in the terminal where a build is
+    // being watched.
+    autoUpdater.logger = {
+      info: (...a) => log.info?.('[updater]', ...a),
+      warn: (...a) => log.warn?.('[updater]', ...a),
+      error: (...a) => log.error?.('[updater]', ...a),
+      debug: () => {},
+    };
+
+    autoUpdater.on('checking-for-update', () => set({ phase: 'checking', error: null }));
+    autoUpdater.on('update-not-available', () => set({
+      phase: 'current', newVersion: null, percent: null, error: null, checkedAt: Date.now(),
+    }));
+    autoUpdater.on('update-available', (info) => set({
+      phase: 'downloading', newVersion: info?.version ?? null, percent: 0, error: null, checkedAt: Date.now(),
+    }));
+    autoUpdater.on('download-progress', (p) => set({ phase: 'downloading', percent: p?.percent ?? null }));
+    // STAMPED ONCE, not on every redraw: a second `update-downloaded` for the
+    // same version would otherwise make the row young again and move it back to
+    // the top of her list for news she has already read.
+    autoUpdater.on('update-downloaded', (info) => set({
+      phase: 'ready', newVersion: info?.version ?? state.newVersion, percent: 100, error: null,
+      readyAt: state.phase === 'ready' && state.readyAt ? state.readyAt : Date.now(),
+    }));
+    // SILENT ON PURPOSE. See point 2 at the top of this file.
+    autoUpdater.on('error', (e) => set({
+      phase: 'error',
+      // The message only. electron-updater puts a whole stack on some of these
+      // and Settings shows this string to a person.
+      error: shortError(e),
+      checkedAt: Date.now(),
+    }));
+  }
+
+  async function check({ manual = false } = {}) {
+    if (stopped || !autoUpdater) return describe(state);
+    if (!autoUpdater.isUpdaterActive()) {
+      // A build run from source. Say which it is rather than reporting a
+      // healthy "up to date" that was never checked.
+      set({
+        phase: 'unsupported',
+        error: `${Name} only updates itself when it is installed as an app.`,
+        checkedAt: Date.now(),
+      });
+      return describe(state);
+    }
+    // Once it is downloaded there is nothing left to check for; checking again
+    // would walk the state backwards under a button that says Restart.
+    if (state.phase === 'ready') return describe(state);
+    if (state.phase === 'checking' || (state.phase === 'downloading' && !manual)) return describe(state);
+    try {
+      await autoUpdater.checkForUpdates();
+    } catch (e) {
+      set({ phase: 'error', error: shortError(e), checkedAt: Date.now() });
+    }
+    return describe(state);
+  }
+
+  // THE BUTTON. Quit, swap the app, come back up on the new one.
+  function install() {
+    if (!autoUpdater || state.phase !== 'ready') return false;
+    // `isSilent` true so macOS does not put its own progress window over her
+    // screen; `isForceRunAfter` true so the app comes back, which is the whole
+    // point of pressing a button that says Restart.
+    setImmediate(() => autoUpdater.quitAndInstall(true, true));
+    return true;
+  }
+
+  function start() {
+    if (stopped || timer) return;
+    const tick = () => { void check(); };
+    setTimeout(tick, FIRST_CHECK_MS).unref?.();
+    timer = setInterval(tick, EVERY_MS);
+    timer.unref?.();
+  }
+
+  function stop() {
+    stopped = true;
+    if (timer) clearInterval(timer);
+    timer = null;
+  }
+
+  return { start, stop, check, install, state: () => describe(state) };
+}
+
+// electron-updater's errors arrive as Error objects whose `message` is
+// occasionally the entire server response. One line, and a sentence a person
+// can read, for the few we can name.
+export function shortError(e) {
+  const raw = String(e?.message ?? e ?? 'Something went wrong.').split('\n')[0].trim();
+  // AND THE NAME IS ON `code`, NOT IN THE MESSAGE. electron-updater builds
+  // these through builder-util-runtime's `newError`, which puts the
+  // ERR_UPDATER_ name on the error's `code` and leaves the message as prose
+  // with the whole URL in it. Matching the message alone reached none of them.
+  // Measured 2026-08-29 in a packaged build against the real GitHub feed: the
+  // published v0.1.0 carries only the .dmg, so the check 404s on
+  // latest-mac.yml and Settings read "Cannot find latest-mac.yml in the latest
+  // release artifacts (https://github.com/Astral-Agent/astral-releases/
+  // releases/download/v0.1.0/latest-mac.yml): HttpErr…" to her. The sentence
+  // for exactly that failure was already on the line below it.
+  const named = `${e?.code ?? ''} ${raw}`;
+  if (/ERR_UPDATER_ZIP_FILE_NOT_FOUND/.test(named)) return 'That release has no app in it to install.';
+  if (/ERR_UPDATER_CHANNEL_FILE_NOT_FOUND/.test(named)) return 'That release is missing its update file.';
+  if (/ERR_UPDATER_NO_PUBLISHED_VERSIONS|LATEST_VERSION_NOT_FOUND/.test(named)) return 'No published version to update to yet.';
+  if (/ENOTFOUND|EAI_AGAIN|ENETDOWN|ETIMEDOUT|ECONNREFUSED|ECONNRESET/.test(raw)) return 'Could not reach the internet.';
+  // AND THE SAME FAILURE UNDER CHROMIUM'S NAME FOR IT. The line above catches
+  // Node's codes, and electron-updater does not always use Node: the check
+  // runs through Electron's own `net` module, whose errors read
+  // `net::ERR_CONNECTION_REFUSED`. That is not `ECONNREFUSED`, so it fell
+  // through to the last line and Settings said `net::ERR_CONNECTION_REFUSED`
+  // to her. Measured on 2026-08-29, in a packaged build with the update feed
+  // switched off mid-run: that exact string was on the screen.
+  if (/^net::ERR_/.test(raw)) return 'Could not reach the internet.';
+  return raw.length > 160 ? `${raw.slice(0, 157)}…` : raw;
+}

package/main/zoom-keys.mjs

@@ -0,0 +1,54 @@
+// Which keystrokes mean zoom. Kept apart from the menu so it imports without
+// Electron and can be tested for real rather than asserted against source text.
+//
+// Her window has been sitting at zoom level 1 (1.2x) since before it was
+// launched, because Chromium stores zoom per page URL in the profile and hands
+// it back on every load. The chords are the only way out of that, so they have
+// to arrive.
+//
+// "Cmd +" is really ⇧⌘= on a US keyboard, which reports key '+' and code
+// 'Equal'. Matching on BOTH key and code is what makes the shifted form, the
+// unshifted form and the numpad all land on the same command.
+
+const IN = { Equal: 0.5, NumpadAdd: 0.5, Minus: -0.5, NumpadSubtract: -0.5, Digit0: 0, Numpad0: 0 };
+const KEYS = { '=': 0.5, '+': 0.5, '-': -0.5, _: -0.5, 0: 0 };
+
+/**
+ * The zoom step a before-input-event describes, or null if it is not a zoom
+ * chord. 0.5 in, -0.5 out, 0 actual size. The app is a real answer here, so
+ * callers must test for null, not for falsiness.
+ */
+export function zoomDeltaFor(input) {
+  if (!input || input.type !== 'keyDown') return null;
+  if (!(input.meta || input.control)) return null;
+  if (input.alt) return null; // ⌥⌘- and friends belong to whoever else wants them
+  const byCode = IN[String(input.code ?? '')];
+  if (byCode !== undefined) return byCode;
+  const byKey = KEYS[String(input.key ?? '')];
+  return byKey === undefined ? null : byKey;
+}
+
+// WHICH CONTENTS GETS ZOOMED, and why this is not just `getFocusedWebContents`.
+//
+// That is the CLICK, not the keystroke, and it rules out the accelerator being
+// the only fault. A click had no contents of its own and asked for the focused
+// one, which returns null whenever nothing on screen claims focus, and on macOS
+// the menu itself holds the keyboard while she is choosing from it. Null was a
+// silent no-op, and the silent no-op is the whole complaint.
+//
+// Electron hands a menu click the window it was chosen from, so the click now
+// carries a target and never has to guess. This is the same move `Reload` made
+// on 2026-08-06; zoom was the last item in this menu still guessing.
+
+/**
+ * The web contents a zoom should act on, first non-destroyed of: the one the
+ * caller named (the keystroke's own contents, or the window a menu click came
+ * from), then whatever is focused, then the app's own window. Returns null only
+ * if there is genuinely nothing on screen.
+ */
+export function zoomTarget({ named = null, focused = null, appWindow = null } = {}) {
+  for (const contents of [named, focused, appWindow]) {
+    if (contents && !contents.isDestroyed?.()) return contents;
+  }
+  return null;
+}

package/main/zoom-readout.mjs

@@ -0,0 +1,20 @@
+// What the zoom readout says. Kept apart from the menu, like zoom-keys.mjs, so
+// it imports without Electron and the ladder can be tested for real.
+//
+// So this file computes one number and nothing else. Chromium's zoom factor is
+// 1.2 to the power of the level, which is why her ladder reads 76, 83, 91, 100,
+// 110, 120 rather than the round numbers other apps step through. Moving the
+// ladder onto 75/80/90/100/110/125 was offered and she did not ask for it, so
+// the steps stay exactly as they were and only the readout is new.
+
+const CHROMIUM_ZOOM_BASE = 1.2;
+
+/**
+ * The percentage to show for a Chromium zoom level. Level 0 is 100%, level 1 is
+ * 120%, level -0.5 is 91%. Returns null for a level that is not a number, so a
+ * caller can tell "no readout" from a readout of 0.
+ */
+export function zoomPercentFor(level) {
+  if (typeof level !== 'number' || !Number.isFinite(level)) return null;
+  return Math.round(CHROMIUM_ZOOM_BASE ** level * 100);
+}

package/mcp/agentbox-mcp.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+# Launcher for this app's own store server.
+#
+# It exists because node is installed through nvm on this machine and is NOT on
+# a login shell's PATH, so an MCP client spawning `node mcp/stdio.mjs` gets
+# "command not found" and reports the server as failed with nothing useful in
+# it. Hard-coding the current nvm path would work until the next node upgrade
+# silently moved it, so resolve it at launch instead.
+#
+# STDOUT IS THE JSON-RPC STREAM. Anything nvm prints on the way in would be
+# parsed as protocol and corrupt the session, hence the redirects: every setup
+# step here sends its output to stderr or /dev/null, and the only thing that
+# ever writes to stdout is the server itself.
+
+if ! command -v node >/dev/null 2>&1; then
+  export NVM_DIR="${NVM_DIR:-$HOME/.nvm}"
+  # shellcheck disable=SC1091
+  [ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh" >/dev/null 2>&1
+fi
+
+if ! command -v node >/dev/null 2>&1; then
+  # Last resort: the newest version nvm has on disk, without sourcing anything.
+  for bin in "$HOME"/.nvm/versions/node/*/bin; do
+    [ -x "$bin/node" ] && PATH="$bin:$PATH"
+  done
+  export PATH
+fi
+
+if ! command -v node >/dev/null 2>&1; then
+  echo "[store] cannot find node (looked on PATH and in $HOME/.nvm)" >&2
+  exit 1
+fi
+
+exec node "$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)/stdio.mjs" "$@"

package/mcp/core/account.mjs

@@ -0,0 +1,77 @@
+// Which founder's store are we operating on, and which product.
+//
+// The app answers this from a live auth session. The MCP server has no session:
+// it is a child process spawned by whatever agent wanted it, so the account is
+// configuration, resolved once at startup.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { legacyRoot, setAccountScope, dataRoot, listProjects, sanitizeName } from '../../main/store/project.mjs';
+import { envName } from '../../shared/product-name.mjs';
+
+/**
+ * Resolve the account whose store this server serves.
+ *
+ * STORE_ACCOUNT_ID wins. Failing that, if exactly one account exists on disk
+ * we use it, because that is unambiguous and asking would be pedantic. If
+ * several exist we REFUSE rather than pick: silently operating on the wrong
+ * founder's store would be discovered late and by writing to it.
+ */
+export function resolveAccount({ accountId = process.env.STORE_ACCOUNT_ID } = {}) {
+  const accountsDir = path.join(legacyRoot(), 'accounts');
+
+  if (accountId) {
+    const dir = path.join(accountsDir, accountId);
+    if (!fs.existsSync(dir)) throw new Error(`no such account on disk: ${accountId} (looked in ${accountsDir})`);
+    setAccountScope(accountId);
+    return { accountId, root: dataRoot() };
+  }
+
+  let found = [];
+  try {
+    found = fs.readdirSync(accountsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    throw new Error(`no accounts found at ${accountsDir}; is ${envName('HOME')} set correctly?`);
+  }
+
+  if (found.length === 1) {
+    setAccountScope(found[0]);
+    return { accountId: found[0], root: dataRoot() };
+  }
+  if (!found.length) throw new Error(`no accounts found at ${accountsDir}`);
+  throw new Error(
+    `several accounts on disk (${found.join(', ')}); set STORE_ACCOUNT_ID so this server cannot write to the wrong one`,
+  );
+}
+
+/**
+ * Find a product by id, slug, or name. Agents refer to products the way a
+ * person would ("kestrel"), not by generated id, so accept all three and say
+ * clearly when a name is ambiguous rather than guessing which one was meant.
+ */
+export function resolveProduct(ref) {
+  const wanted = String(ref ?? '').trim();
+  if (!wanted) throw new Error('which product? pass its name or id (list_products shows them)');
+  const projects = listProjects();
+
+  const exact = projects.find((p) => p.id === wanted) ?? projects.find((p) => path.basename(p.dir) === wanted);
+  if (exact) return exact;
+
+  const lower = wanted.toLowerCase();
+  const byName = projects.filter((p) => (p.name ?? '').toLowerCase() === lower);
+  if (byName.length === 1) return byName[0];
+  if (byName.length > 1) throw new Error(`several products are called "${wanted}"; use its id instead (${byName.map((p) => p.id).join(', ')})`);
+
+  // THE NAME IT WAS MADE WITH. A rename changes the label and never the folder,
+  // and the folder is that first name slugged, so an agent that still says the
+  // old name is pointing at this folder. After the current names, so a name she
+  // has since given another project wins.
+  const madeAs = projects.find((p) => path.basename(p.dir) === sanitizeName(wanted));
+  if (madeAs) return madeAs;
+
+  const partial = projects.filter((p) => (p.name ?? '').toLowerCase().includes(lower) || path.basename(p.dir).includes(lower));
+  if (partial.length === 1) return partial[0];
+  if (partial.length > 1) throw new Error(`"${wanted}" matches several products: ${partial.map((p) => p.name ?? p.id).join(', ')}`);
+
+  throw new Error(`no product called "${wanted}"; list_products shows what exists`);
+}

package/mcp/core/chat.mjs

@@ -0,0 +1,61 @@
+// Past in-app conversations, read-only.
+//
+// This is continuity, not a feature: a founder and the in-app agent have already
+// decided things in these logs that never made it into a document, and an
+// external agent picking up a product months later should be able to find out
+// why something is the way it is instead of re-deciding it.
+//
+// Strictly read-only, deliberately. The MCP has no business appending to a
+// conversation the app owns and renders live; a message written here would
+// appear in a chat with no session behind it, which reads to the founder as the
+// agent talking to itself.
+
+import { listChats, readChatLog } from '../../main/store/chats.mjs';
+import { resolveProduct } from './account.mjs';
+
+const DEFAULT_LIMIT = 100;
+const MAX_LIMIT = 500;
+const MAX_TEXT = 4000;
+
+export function listProductChats(ref) {
+  const project = resolveProduct(ref);
+  return listChats(project.dir).map((c) => ({
+    id: c.id,
+    title: c.title,
+    createdAt: c.createdAt ?? null,
+    updatedAt: c.updatedAt ?? null,
+  }));
+}
+
+/**
+ * The tail of one conversation. Tail rather than head because the recent end is
+ * almost always what a reader wants, and a long chat would otherwise spend the
+ * whole budget on its opening.
+ */
+export function readProductChat(ref, { chatId = null, limit = DEFAULT_LIMIT } = {}) {
+  const project = resolveProduct(ref);
+  const chats = listChats(project.dir);
+  if (!chats.length) return { chatId: null, title: null, messages: [] };
+
+  const chat = chatId ? chats.find((c) => c.id === chatId) : chats[0]; // newest by default
+  if (!chat) throw new Error(`no chat ${chatId} in ${project.name} (list_chats shows what exists)`);
+
+  const n = Math.min(Math.max(1, Number(limit) || DEFAULT_LIMIT), MAX_LIMIT);
+  const log = readChatLog(project.dir, chat.id);
+
+  return {
+    chatId: chat.id,
+    title: chat.title,
+    total: log.length,
+    messages: log.slice(-n).map((m) => ({
+      role: m.role,
+      // Truncated per message rather than per response: one enormous message
+      // must not crowd out the twenty around it that give it meaning.
+      text: typeof m.text === 'string' && m.text.length > MAX_TEXT ? `${m.text.slice(0, MAX_TEXT)}\n[truncated]` : (m.text ?? ''),
+      ts: m.ts ?? null,
+      // An unanswered question from a past session is a live loose end, so it
+      // stays visible rather than being flattened into prose.
+      ask: m.ask ? { status: m.ask.status, questions: (m.ask.questions ?? []).map((q) => q.question) } : undefined,
+    })),
+  };
+}