agentbox-app 0.1.6

package/shared/library-folder.mjs

@@ -0,0 +1,28 @@
+// Which Library folder an artifact lives in. ONE rule, because main and the
+// renderer both answer this question and they were answering it differently.
+//
+// A folder-backed artifact lives at creations/<...>/<slug> on disk, and
+// `creations/` is storage, not a place the founder put anything: left in, it
+// surfaced as a top-level folder called "Creations" holding everything
+// folder-backed, which reads as nonsense when every artifact is one (founder
+// report, 2026-07-24). So the storage root is stripped and whatever is left is
+// the real folder.
+//
+// Main used to skip that strip, which is how the two views disagreed in the
+// worst possible direction: the founder saw nine apps and canvases sitting
+// loose at the top of her Library, while the agent's own list_library showed
+// them tidily filed under "creations/" and therefore never noticed anything to
+// organize.
+export const STORAGE_ROOT = 'creations';
+
+/**
+ * @param {{ path?: string, dir?: string }} envelope
+ * @returns {string} 'designs/round-1', or '' for something at the top level
+ */
+export function libraryFolderOf(envelope) {
+  const p = envelope?.path ?? envelope?.dir ?? '';
+  const cut = String(p).lastIndexOf('/');
+  const folder = cut <= 0 ? '' : String(p).slice(0, cut);
+  if (folder === STORAGE_ROOT) return '';
+  return folder.startsWith(`${STORAGE_ROOT}/`) ? folder.slice(STORAGE_ROOT.length + 1) : folder;
+}

package/shared/notify-rules.mjs

@@ -0,0 +1,120 @@
+// WHEN AGENTBOX IS ALLOWED TO INTERRUPT HER, and what the banner says when it is.
+//
+// Both halves of that sentence are rules, and the second one is the harder one:
+// a notification that fires while she is looking at the row it is about is
+// worse than no notification at all, because it costs her the flow the whole
+// product is built to protect. So the gate is closed by default and opens only
+// when she is provably somewhere else.
+//
+// This is the only copy of the rule. main/notify.mjs is the live wiring around
+// it (the window's focus, the banner's lifetime); everything decidable is here,
+// as plain functions over plain values, because that is the half worth pinning
+// with tests.
+
+// HOW LONG A STILL KEYBOARD MEANS SHE HAS GONE, and it is deliberately long.
+// The window can hold focus while she is not at the machine at all: the lid is
+// open, Agentbox is the front app, and she is in another room. That is squarely
+// "in a diff app" as she meant it, so the banner should fire.
+//
+// Five minutes rather than one, because the failure modes are not symmetric.
+// Firing late costs her a few minutes of not knowing. Firing while she is
+// reading a long message with her hands off the keyboard is exactly the
+// interruption she asked us to stop, and she would be right to read it as the
+// feature not working. Reading one card for five unbroken minutes is rare;
+// walking away for five minutes is not.
+export const AWAY_AFTER_MS = 5 * 60 * 1000;
+
+// She is at the app, so say nothing. Focus alone is not enough (see above) and
+// idleness alone is not either: a still keyboard while she is reading Slack is
+// not a reason to stay quiet.
+export function atTheApp({ focused = false, idleMs = 0 } = {}) {
+  return !!focused && idleMs < AWAY_AFTER_MS;
+}
+
+// A title long enough to be a paragraph is normal here; hers run past a
+// hundred characters. macOS will hard-truncate mid-word, so cut on a space and
+// say that it was cut.
+export function clip(text, max = 120) {
+  const s = String(text ?? '').replace(/\s+/g, ' ').trim();
+  if (s.length <= max) return s;
+  const cut = s.slice(0, max);
+  const space = cut.lastIndexOf(' ');
+  return `${(space > max * 0.6 ? cut.slice(0, space) : cut).replace(/[.,;:]$/, '')}…`;
+}
+
+// ONE BANNER FOR THE WHOLE TIME SHE IS AWAY. Not one per arrival, and not one
+// per rewrite either, which is what this file used to do.
+//
+// The version before this one already refused to STACK banners: it took the old
+// one down and put a fresh one up. That is one banner on screen, and it is
+// still twenty interruptions, because on macOS there is no way to edit a
+// notification that is already up. Rewriting it means showing another one, with
+// another sound. A forty minute meeting with an agent finishing every two
+// minutes was twenty chimes. That is the thing she is naming, and the count in
+// the old wording is what made it feel necessary to keep re-firing: a number
+// goes stale the second the next agent lands.
+//
+// So: she is told once, in words that stay true however many arrive after, and
+// the rest is waiting on the rows when she comes back. `seen` in
+// main/notify.mjs resets this the moment she has the window, so the next time
+// she walks away she can be told again.
+//
+// THE ONE EXCEPTION, and it is here because an approval card has a clock on it.
+// A finished agent waits as long as it takes. An approval is a worker frozen
+// mid-run with her as the only way through, and it is DENIED AUTOMATICALLY
+// after fifteen minutes (TIMEOUT_MS, main/approval-prompt-server.mjs). If the
+// first banner of the stretch was a finished agent, an approval landing twenty
+// minutes later would die unheard under a strict one-and-done rule. So an
+// approval gets to speak once more, and that is the cap: at most two in one
+// stretch away, never more.
+export function shouldSpeak({ spoke = false, spokeAsk = false, waiting = [] } = {}) {
+  const items = (waiting ?? []).filter(Boolean);
+  if (!items.length) return false;
+  if (!spoke) return true;
+  if (spokeAsk) return false;
+  return items.some((i) => i.kind === 'approval');
+}
+
+// WHAT THE ONE BANNER SAYS. No number in it, for two reasons that point the
+// same way. The design law rejects counts on a glance surface (STATE.md), and
+// under the rule above a count would be a lie within a minute: it can only ever
+// describe the first second and a half of a stretch that may run for hours.
+//
+// TWO LINES, NEVER THREE, AND NO PROJECT NAME ANYWHERE IN IT.
+//
+// The subtitle field went first, earlier the same day, because she read a lone
+// project name stacked under the title as the title bleeding over. Putting the
+// project into the title instead only moved the problem: a title is the one
+// line macOS will not wrap, so a project called something long pushes "An agent
+// is ready" out of the banner and the fact she needed is the part that gets
+// cut. Both fields are hers to fill with anything, and neither of them is a
+// safe place for a string we do not control the length of.
+//
+// So the title is a fixed sentence and the body is the row's own name, which is
+// where the project is recognisable anyway. Plural without a number covers the
+// rest.
+//
+// `waiting` is everything unseen, oldest first. Returns null when there is
+// nothing to say.
+export function banner(waiting) {
+  const items = (waiting ?? []).filter(Boolean);
+  if (!items.length) return null;
+
+  // A frozen worker outranks a finished one, so when both are unseen the
+  // banner speaks for the one with a clock on it.
+  const asks = items.filter((i) => i.kind === 'approval');
+  const lead = asks.length ? asks[0] : items[items.length - 1];
+  const many = items.length > 1;
+
+  const title = asks.length
+    ? (many ? 'Agents are waiting on you' : 'An agent is waiting on you')
+    : (many ? 'Agents are ready' : 'An agent is ready');
+
+  return {
+    title,
+    body: clip(lead.title),
+    // What a click opens. An approval card is already on screen the moment the
+    // window comes forward, so that one only needs the window.
+    open: lead.kind === 'approval' ? null : (lead.id ?? null),
+  };
+}

package/shared/product-name.d.mts

@@ -0,0 +1,6 @@
+export const NAME: string;
+export const WAS: readonly string[];
+export const Name: string;
+export const nameSlug: string;
+export const possessive: string;
+export const Possessive: string;

package/shared/product-name.mjs

@@ -0,0 +1,144 @@
+// THE ONE PLACE THIS APP IS NAMED. Change the two lines under NAME and every
+// screen, every notification, every agent brief and the Dock follow.
+//
+// She is right about the frequency. This app has been Zero, then Astral, then
+// the app, and is agentbox now, and each of the first three renames was a
+// hand-run search and replace over about two hundred literals
+// (scripts/rename-to-powerup.mjs is the third one, kept as history). A sweep
+// cannot be run ahead of time, so between renames the old name sat in the code
+// waiting to be missed, and one of them was: the screenshot on her row shows
+// "Import into the app?" two names later.
+//
+// HOW TO RENAME IT NEXT TIME, the whole procedure:
+//
+//   1. Change NAME below to the new name, spelled exactly as it should read in
+//      the MIDDLE of a sentence.
+//   2. Add the name it had before to WAS, at the front of the list.
+//   3. Run `node scripts/product-name.mjs --write`. That is what carries the
+//      name into package.json, which Electron reads before any of our code
+//      runs and so cannot import this file.
+//
+//   Nothing else. `tests/the-app-is-named-in-one-place.test.mjs` fails if step
+//   3 is skipped, and it fails if a new literal of the name is typed into the
+//   code by hand instead of read from here.
+//
+// CAPITALISATION IS A RULE HERE, NOT A SPELLING.
+//
+// So NAME is the mid-sentence spelling and `Name` is that same word with its
+// first letter raised. A name that is already an ordinary proper noun, as two
+// of the names in WAS are, comes out identical from both, so the rule costs
+// nothing when it does not apply, and a lowercase name gets it right without
+// anyone having to remember.
+// Pick the one the position calls for. Sentence start, a heading, a title, a
+// menu item and a button label take `Name`; anywhere else in a sentence takes
+// `name`.
+
+/** The name, spelled as it reads in the middle of a sentence. */
+export const NAME = 'agentbox';
+
+/**
+ * Every name this app has had, newest first. main/main.mjs walks this to find
+ *  the data folder an existing install already writes to, because Chromium
+ *  names that folder after the app and a rename would otherwise hand her an
+ *  empty one and lose her theme, her zoom and her project order. HISTORY IS
+ *  NEVER REWRITTEN: add to the front, never edit an entry. */
+export const WAS = Object.freeze(['Powerup', 'Astral', 'Zero']);
+
+/** The name at the start of a sentence, in a heading, or on a button. */
+export const Name = NAME.charAt(0).toUpperCase() + NAME.slice(1);
+
+/** One name as a slug, so the current one and the old ones are made the same way. */
+const slugOf = (name) => String(name).toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '');
+
+/**
+ * The name lowercased throughout, for a slug, a folder or a log prefix.
+ *  NOT for anything she reads. */
+export const nameSlug = slugOf(NAME);
+
+/**
+ * EVERY SLUG THIS APP HAS ANSWERED TO, current first.
+ *
+ * The same argument as `envNames` below, one layer up. A slug of ours is not
+ * only a folder name: it is the name of the MCP server that IS the store, so it
+ * is written into a `--allowedTools` grant in her zero.config.json, and into the
+ * config of every Codex thread that has ever run. Both of those outlive a
+ * rename, and neither is ours to rewrite: the grant is her file, and a thread
+ * started last week is a record.
+ *
+ * So a rename cannot be allowed to mean "the store stops being the store". The
+ * places that ask "is this the store server?" ask it through here, the current
+ * name wins, and a name we used to have still answers.
+ *
+ * THIS IS NOT THE OLD `LEGACY_STORE_SERVERS`. That list held another PRODUCT's
+ * name, hardcoded, and was deleted for exactly that reason. Nothing is
+ * hardcoded here: this is `WAS`, which the app already keeps for its data
+ * folder and its env vars, read one more way.
+ */
+export const WAS_SLUGS = Object.freeze(WAS.map(slugOf));
+
+/** The current slug and every slug it has had, current first. */
+export const nameSlugs = Object.freeze([nameSlug, ...WAS_SLUGS]);
+
+/** True when `slug` is this app under its current name or any name it has had. */
+export const isOurSlug = (slug) => typeof slug === 'string' && nameSlugs.includes(slug.trim());
+
+/**
+ * THE NAME AS AN ENVIRONMENT VARIABLE PREFIX, and every prefix it has had.
+ *
+ * The app's own env vars carried the name typed out: `ASTRAL_HOME` was still
+ * the store root two renames after the app stopped being the app, which is the
+ * same leak this whole module exists to close and the one an agent grepping the
+ * repo hits first. `envName('HOME')` is what code asks for now.
+ *
+ * `readEnv` FALLS BACK THROUGH THE OLD NAMES, newest first, for the same reason
+ * `WAS` exists at all: a shell, a launchd job or a running process started
+ * before the rename still exports the old one, and an app that cannot find its
+ * own store root opens empty.
+ */
+export const ENV_PREFIX = NAME.toUpperCase().replace(/[^A-Z0-9]+/g, '_');
+export const WAS_ENV_PREFIXES = Object.freeze(WAS.map((was) => was.toUpperCase().replace(/[^A-Z0-9]+/g, '_')));
+
+/** One env var of ours, by its suffix. `envName('HOME')`. */
+export const envName = (suffix) => `${ENV_PREFIX}_${suffix}`;
+
+/** Every spelling of one env var of ours, current name first. */
+export const envNames = (suffix) => [ENV_PREFIX, ...WAS_ENV_PREFIXES].map((p) => `${p}_${suffix}`);
+
+/**
+ * The value of one env var of ours, under the current name or any name this app
+ * has had. Empty and whitespace-only count as unset, because an exported-but-
+ * blank variable is how a shell says nothing rather than how it says "".
+ */
+export function readEnv(suffix, env = process.env) {
+  for (const key of envNames(suffix)) {
+    const value = env?.[key];
+    if (typeof value === 'string' && value.trim()) return value;
+  }
+  return undefined;
+}
+
+/**
+ * The possessive, because "agentbox's" and "Atlas'" are not the same rule and
+ *  a template that hardcodes 's is wrong the day the name ends in one. */
+export const possessive = `${NAME}${/s$/i.test(NAME) ? "'" : "'s"}`;
+
+/** The possessive at the start of a sentence. */
+export const Possessive = `${Name}${/s$/i.test(NAME) ? "'" : "'s"}`;
+
+/**
+ * THE NAME INTO TEXT THAT IS NOT CODE: the agent briefs in `briefs/`, which are
+ * markdown files a session reads and, for three of the four, files SHE can edit
+ * in Settings. They cannot import anything, so they carry `{{name}}` and
+ * `{{Name}}` and this fills them in.
+ *
+ * FILLED WHERE THE BRIEF IS USED, NOT WHERE IT IS READ FOR EDITING. The editor
+ * in Settings reads the same files, and substituting on the way in would show
+ * her the filled text and then save it back with the name baked into her own
+ * copy, which is the one thing this whole change exists to prevent. So
+ * `buildBrief` calls this and the settings editor does not.
+ */
+export function fillName(text) {
+  return String(text ?? '')
+    .replaceAll('{{Name}}', Name)
+    .replaceAll('{{name}}', NAME);
+}

package/shared/project-folder-check.d.mts

@@ -0,0 +1,22 @@
+// Types for shared/project-folder-check.mjs, which is plain ESM so that main
+// (Node) and the renderer (Vite) can share one copy of the rule.
+
+export interface FolderVerdict {
+  ok: boolean;
+  /** Why it was turned down. For tests and the log; never put on a screen. */
+  reason?: 'home' | 'guarded' | 'system' | 'volume';
+  /** The sentence to show as it stands, when `ok` is false. */
+  say?: string;
+}
+
+export const GUARDED: string[];
+
+export function checkProjectFolder(
+  folder: string | null | undefined,
+  opts?: { home?: string },
+): FolderVerdict;
+
+export function proposeParent(
+  existing?: string[],
+  opts?: { home?: string },
+): string;

package/shared/project-folder-check.mjs

@@ -0,0 +1,152 @@
+// THE FOLDERS A PROJECT MAY NOT BE, AND WHY macOS ASKS ABOUT MUSIC.
+//
+// That sentence is macOS, not us. Desktop, Documents, Downloads, Music,
+// Pictures, Movies and everything under ~/Library are guarded by the system's
+// privacy layer, so the FIRST time any process reads one of them the system
+// throws up a panel with our name on it. Agentbox spawns Claude Code with the
+// project folder as its working directory, and a worker that starts in the home
+// folder will list it within its first few tool calls. One folder choice is
+// therefore the difference between no panels at all and a run of them naming
+// every private corner of somebody's Mac, on the second screen they ever see.
+//
+// Nothing stopped that choice. `zero:choose-folder` handed back whatever the
+// Mac's own picker returned, and the picker opens on the home folder, so "just
+// press Open" was a live path to exactly this.
+//
+// SO THIS IS A REFUSAL, NOT A WARNING. A warning on this screen is a question
+// somebody with no way to answer it has to answer anyway. The folder is turned
+// down and the sentence says which folder to pick instead.
+//
+// It is deliberately SHORT. The only folders refused are the ones that are not
+// projects by construction: the home folder itself, the system's own top-level
+// directories, and the seven guarded folders IN THEMSELVES. A project INSIDE
+// any of them is fine and is not asked about — `~/Documents/my-app` is where
+// plenty of people keep their code, it costs one panel the first time and it is
+// genuinely their project. What is refused is pointing at `~/Documents` whole.
+//
+// Pure, so both sides of the bridge and the tests can use one copy: the
+// renderer checks as she picks, and main checks again before it writes.
+
+/**
+ * The guarded folders, by their name directly under the home folder. The
+ *  system asks about each of these separately, which is why the panels arrive
+ *  as a run rather than as one. `Library` is the one that reads as "every app":
+ *  it holds one directory per application under Application Support. */
+export const GUARDED = [
+  'Desktop', 'Documents', 'Downloads', 'Movies', 'Music', 'Pictures', 'Library', 'Public',
+];
+
+/** Top-level directories that are the Mac and not anybody's work. */
+const SYSTEM = [
+  '/', '/Applications', '/Library', '/System', '/Users', '/Volumes',
+  '/private', '/tmp', '/var', '/etc', '/usr', '/bin', '/sbin', '/opt', '/net', '/cores',
+];
+
+/**
+ * Trailing slashes off, and `~` left alone: the renderer does not know whose
+ *  home this is and hands paths through exactly as it got them. */
+function tidy(p) {
+  const s = String(p ?? '').trim();
+  if (!s) return '';
+  return s.length > 1 ? s.replace(/\/+$/, '') : s;
+}
+
+function underHome(p, home) {
+  const h = tidy(home);
+  if (!h) return null;
+  if (p === h) return '';
+  return p.startsWith(`${h}/`) ? p.slice(h.length + 1) : null;
+}
+
+/**
+ * WHETHER THIS FOLDER CAN BE A PROJECT, and the sentence to show when it
+ *  cannot. Returns `{ ok: true }` or `{ ok: false, reason, say }`.
+ *
+ *  `say` is written to be shown as it stands, on the setup screen and on the
+ *  New Project card, so it names the folder that was picked and says what to
+ *  pick instead. `reason` is for tests and for the note in the log; nothing
+ *  puts it on a screen.
+ */
+export function checkProjectFolder(folder, { home = '' } = {}) {
+  const p = tidy(folder);
+  if (!p) return { ok: true };
+
+  // `~` and `~/` are the home folder written the way our own screens write it.
+  const rel = p === '~' || p === '~/' ? '' : (p.startsWith('~/') ? p.slice(2) : underHome(p, home));
+
+  if (rel === '') {
+    return {
+      ok: false,
+      reason: 'home',
+      say: 'That is your whole home folder. Agents would work across everything on this Mac, and macOS will ask you about Downloads, Music and every app you have. Pick the folder your project’s code is in.',
+    };
+  }
+
+  if (rel !== null && GUARDED.includes(rel)) {
+    return {
+      ok: false,
+      reason: 'guarded',
+      say: `${rel} holds a lot more than one project, and macOS guards it, so choosing it means a run of permission panels. Pick the folder inside it that your project’s code is in.`,
+    };
+  }
+
+  if (SYSTEM.includes(p)) {
+    return {
+      ok: false,
+      reason: 'system',
+      say: `${p} is part of macOS rather than one of your projects. Pick the folder your project’s code is in.`,
+    };
+  }
+
+  // A volume root: /Volumes/Whatever with nothing after it.
+  if (/^\/Volumes\/[^/]+$/.test(p)) {
+    return {
+      ok: false,
+      reason: 'volume',
+      say: `${p} is a whole disk rather than one project. Pick the folder your project’s code is in.`,
+    };
+  }
+
+  return { ok: true };
+}
+
+/**
+ * WHERE A NEW PROJECT'S FOLDER IS PROPOSED, when nobody has pointed at one.
+ *
+ *  This used to be `~/Desktop/dev/<slug>` flat, which is one developer's own
+ *  filing system shipped to everybody, and it is inside Desktop, which is one
+ *  of the guarded seven above: the very first project anybody made through the
+ *  card asked macOS for the Desktop before it had drawn anything.
+ *
+ *  So the parent is LEARNED from the projects they already have, and only
+ *  guessed when there are none. `existing` is the folders of their current
+ *  projects; the commonest parent among them wins, because somebody with three
+ *  projects in `~/code` wants the fourth there too.
+ *
+ *  The guess when there is nothing to learn from is `~/dev`, which is not
+ *  guarded and costs no panel. It is a guess and the card says so by showing
+ *  the whole path, which is the same thing it has always done.
+ */
+export function proposeParent(existing = [], { home = '~' } = {}) {
+  const counts = new Map();
+  for (const f of existing) {
+    const p = tidy(f);
+    if (!p) continue;
+    const cut = p.lastIndexOf('/');
+    if (cut <= 0) continue;
+    const parent = p.slice(0, cut);
+    // The PARENT is what gets proposed, so the parent is what is judged. A
+    // project sitting directly in ~/Downloads is a real project and is allowed;
+    // proposing ~/Downloads as the home of the next one is not.
+    if (!checkProjectFolder(parent, { home }).ok) continue;
+    counts.set(parent, (counts.get(parent) ?? 0) + 1);
+  }
+  let best = null;
+  let bestN = 0;
+  for (const [parent, n] of counts) {
+    // Ties go to the shorter path, so a stable answer rather than whichever
+    // project happened to be listed first.
+    if (n > bestN || (n === bestN && best && parent.length < best.length)) { best = parent; bestN = n; }
+  }
+  return best ?? `${tidy(home) || '~'}/dev`;
+}

package/shared/provider-commands.d.mts

@@ -0,0 +1,8 @@
+import type { ClaudeCommand } from './claude-commands.mjs';
+export const CODEX_COMMANDS: ClaudeCommand[];
+export const LOCAL_COMMANDS: ClaudeCommand[];
+export function providerCommands(engine: string): ClaudeCommand[];
+export function providerCommand(text: unknown, engine: string): {name: string; args: string; route: string} | null;
+export function reviewTarget(args?: string): Record<string,string>;
+
+export function nativeCommandNames(frame: unknown): string[] | null;

package/shared/provider-commands.mjs

@@ -0,0 +1,58 @@
+// A command is an operation, never prose asking a model to imitate a CLI.
+import { CLAUDE_COMMANDS, commandWords } from './claude-commands.mjs';
+const command = (name, description, argumentHint = null, aliases = []) => ({ name, description, menuDescription: null, whole: true, argumentHint, aliases });
+export const CODEX_COMMANDS = [
+ command('model','Show models or change this task’s model','[model]'),
+ command('effort','Show or change reasoning effort','[level]'),
+ command('compact','Free up context in this conversation'),
+ command('review','Review uncommitted changes, a branch, or specific instructions','[--base branch | --commit sha | instructions]'),
+ command('status','Show this task’s configuration and conversation status'),
+ command('usage','Show the account’s last reported usage'),
+ command('skills','List skills available in this project'),
+ command('mcp','Show this conversation’s connected MCP servers'),
+ command('goal','View, pause, or clear this conversation’s goal','[pause | clear]'),
+ command('diff','Show staged and unstaged changes'),
+ command('rename','Rename this task','<name>'),
+ command('copy','Copy the last assistant response'),
+ command('help','Show available commands and remaining compatibility gaps'),
+];
+export const LOCAL_COMMANDS = CODEX_COMMANDS.filter(c=>['model','effort','diff','rename','help'].includes(c.name));
+// A FORK IS A NEW TASK THAT STARTS WHERE THIS ONE GOT TO (MP-08). It is offered
+// on both engines because both can do it natively: Claude Code resumes under a
+// new id with `--fork-session`, and Codex's own protocol has `thread/fork`. It
+// is refused on Codex for now, in a sentence that says why, because that call
+// has never been made against a real server here.
+const FORK = command('fork','Start a new task from this conversation','<what to try instead>');
+export function providerCommands(engine) {
+ // NOT ON THE CODEX MENU, because this menu's rule is that it offers nothing
+ // that engine cannot run, and Codex forking is not connected yet. Typed there
+ // it gets the ordinary unavailable refusal, which points at the native Codex
+ // client, where `codex fork` genuinely works.
+ return engine==='codex' ? CODEX_COMMANDS : [command('remote-control','Continue this conversation in Claude on another device',null,['rc']),FORK,...CLAUDE_COMMANDS.map(c=>LOCAL_COMMANDS.find(l=>l.name===c.name)??c),...LOCAL_COMMANDS.filter(l=>!CLAUDE_COMMANDS.some(c=>c.name===l.name))];
+}
+export function providerCommand(text, engine) {
+ if(typeof text!=='string')return null;
+ const m=text.trim().match(/^\/([a-z][a-z0-9:_-]*)(?:\s+([\s\S]*))?$/i);
+ if(!m)return null;
+ const word=m[1].toLowerCase(), args=(m[2]??'').trim();
+ const cmd=providerCommands(engine).find(c=>commandWords(c).includes(word));
+ if(!cmd) return {name:word,args,route:'unavailable'};
+ if(cmd.name==='fork')return {name:'fork',args,route:'fork'};
+ return {name:cmd.name,args,route:cmd.name==='remote-control'?'remote':engine==='codex'?'codex':LOCAL_COMMANDS.some(c=>c.name===cmd.name)?'local':'claude'};
+}
+export function reviewTarget(args='') {
+ args=args.trim();
+ if(!args)return {type:'uncommittedChanges'};
+ const scope=args.match(/^--(base|commit)\s+([^\s]+)$/);
+ if(scope)return scope[1]==='base'?{type:'baseBranch',branch:scope[2]}:{type:'commit',sha:scope[2]};
+ if(args.startsWith('--'))throw new Error('Use /review, /review --base branch, /review --commit sha, or /review instructions.');
+ return {type:'custom',instructions:args};
+}
+
+// Native prompt/skill commands are advertised by the running Claude session,
+// including user and plugin commands. Never guess skill names from filenames.
+export function nativeCommandNames(frame) {
+ if(frame?.type!=='system'||frame?.subtype!=='init'||!Array.isArray(frame.slash_commands))return null;
+ const blocked=new Set(['add-dir','auto-mode-setup','clear','color','config','import','design-consent','design-revoke','heapdump','exit','stop','__remote-workflow','workflow-launch-exec','usage-credits','extra-usage']);
+ return [...new Set(frame.slash_commands.filter(n=>typeof n==='string'&&/^[a-z][a-z0-9:_-]*$/i.test(n)&&!blocked.has(n)))];
+}

package/shared/rank.d.mts

@@ -0,0 +1,19 @@
+// Types for shared/rank.mjs, which is plain ESM so that main (Node) and the
+// renderer (Vite) can share one copy of the ranking rule.
+
+export const RANK_STEP: number;
+export function normalizeOrder(slugs: unknown): string[];
+export function productRankScore(order: string[], slug: string): number;
+
+export const DEFAULT_PRIORITY: number;
+
+export function itemPriority(item: { priority?: number; wrote?: Record<string, { source?: string } | undefined> } | null | undefined): number;
+export const URGENT_PRIORITY: number;
+export function isUrgent(item: { priority?: number; wrote?: Record<string, { source?: string } | undefined> } | null | undefined): boolean;
+
+export function orderFromTiers(tiers: Record<string, number> | null | undefined): string[];
+export function landingIndex(
+  rects: Array<{ top: number; bottom: number; left: number; width: number }>,
+  x: number, y: number,
+): number;
+export function moveProduct(order: string[], slug: string, toIndex: number): string[];