agentbox-app 0.1.7 → 0.1.11

package/main/task-commands.mjs

@@ -26,10 +26,10 @@ const exec = promisify(execFile);
  * a chat of its own, that takes over and nothing forks twice.
  */
 /**
- * A row name out of the sentence she typed after `/fork`: her first sentence,
+ * A row name out of the sentence typed after `/fork`: its first sentence,
  * or the first sixty characters of it, so the inbox line says which fork this
  * is rather than which row it came from. Whitespace flattened because a title
- * is one line and she can paste a paragraph.
+ * is one line and a paragraph can be pasted.
  */
 export function forkTitle(words, cap = 60) {
   const flat = String(words ?? '').replace(/\s+/g, ' ').trim();
@@ -45,18 +45,16 @@ function forkTask(sup, productSlug, id, item, engine, op, publish) {
   }
   // NAMING THE KEY, because the menu closes at the space and plain return then
   // writes a newline, the way it does on every other reply here. Without that
-  // sentence she types the words, presses return, and is back to a key that
-  // does nothing (hers, 2026-09-23: "Fork does nothing when I type /fork then
-  // hit return").
+  // sentence the user types the words, presses return, and is back to a key
+  // that does nothing, so a bare /fork looks as if it did nothing.
   if (!op.args) return publish('failed', 'Say what the fork should try, as in /fork try it without the modal, then press command and return.', op.name);
   const chat = sup.rowSessionFor(item, sup.store.listProducts().find((p) => p.slug === productSlug));
   if (!chat?.sessionId) return publish('failed', 'This task has no saved conversation to fork yet. Send a message first.', op.name);
   const made = sup.store.composeItem(productSlug, {
-    // THE FORK IS NAMED AFTER WHAT SHE ASKED IT TO TRY, not after the row it
-    // came from. Naming it `<parent title> · fork` put two rows in her inbox
-    // whose names differ by one word at the end, and the first thing she said
-    // after using it was that she could not tell which agent she was talking to
-    // (2026-09-23). The instruction is the only thing that distinguishes them,
+    // THE FORK IS NAMED AFTER WHAT IT WAS ASKED TO TRY, not after the row it
+    // came from. Naming it `<parent title> · fork` put two rows in the inbox
+    // whose names differ by one word at the end, so there was no telling which
+    // agent was which. The instruction is the only thing that distinguishes them,
     // so it is what the row is called; the parent is still on the row as the
     // `fork:` label, which is where the machinery reads it anyway.
     title: forkTitle(op.args),

package/main/task-folders.mjs

@@ -1,8 +1,7 @@
 // ONE FOLDER PER TASK, OWNED BY THE APP RATHER THAN BY THE AGENT IN IT.
 //
-// the founder, 2026-09-22, choosing between letting Claude Code make its own
-// worktree and doing it ourselves: "the app makes the folder for both agents".
-// The two engines are not equal here. Claude Code has isolation built in
+// Between letting Claude Code make its own worktree and doing it ourselves, the
+// app makes the folder for both agents. The two engines are not equal here. Claude Code has isolation built in
 // (`--worktree`), makes the folder under `.claude/worktrees/`, locks it, reuses
 // it by name and deletes it when it leaves nothing behind. Codex has none of
 // that, only `--cd` for choosing where to work. So the rules have to live on
@@ -11,7 +10,7 @@
 // exactly where Claude Code would, so a person who opens the repository in a
 // terminal sees the layout they already know.
 //
-// WHAT WAS MEASURED, ON HER MAC, 2026-09-22. This repository had 25 leftover
+// WHAT WAS MEASURED, 2026-09-22. This repository had 25 leftover
 // agent copies holding 26 GB: twelve with edits committed nowhere, twelve on
 // branches never merged, one safe to delete. Isolation was a rule in the worker
 // brief; the rule's first half (make a copy) was kept and its second half (fold
@@ -51,6 +50,9 @@ const BRANCH_PREFIX = `${nameSlug}/`;
 /** Ids are `w-` plus hex today. This is the guard for the day they are not. */
 const SAFE_NAME = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
 
+/** What an unfinished folder is called. A task name may never start with a dot. */
+const BUILDING = '.building-';
+
 const git = (cwd, args) => execFileSync('git', args, {
   cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
 }).trim();
@@ -81,6 +83,32 @@ export function taskFolderPath(repoPath, id) {
   return path.join(real(repoPath), ...WORKTREES, safeTaskName(id));
 }
 
+/**
+ * WHERE A FOLDER IS BUILT, WHICH IS NEVER WHERE IT IS RUN IN.
+ *
+ * Making one is a worktree plus a block clone of the checkout. It used to be
+ * built AT the path a session runs in, so for the whole of that a directory sat
+ * there, registered with git and holding almost none of the code. MEASURED on
+ * astral-video, the repository this happened in, 2026-10-01: the build takes 115
+ * seconds now that the checkout is 14 GB, and the path a session runs in
+ * appeared 2.7 seconds in. That is 112 seconds of a folder that looked ready and
+ * was not, against a supervisor tick of fifteen seconds, so seven ticks could
+ * read it. Everything that asks whether a row's folder is ready asks the disk,
+ * which means for those 112 seconds every one of them said yes:
+ * the supervisor started a session in a half written folder, and when the build
+ * finished it started a second session on the same row (2026-09-30,
+ * w-4d722ecf92, where the second one's claim came back refused and the first
+ * one's folder was deleted under it a minute in).
+ *
+ * Built here and MOVED into place once it is finished and checked, so a
+ * directory at the real path means a folder that is complete. That makes every
+ * existing question correct without any of them learning a new one, and it
+ * leaves the rollback below nothing to delete but its own unfinished copy.
+ */
+export function buildingFolderPath(repoPath, id) {
+  return path.join(real(repoPath), ...WORKTREES, `${BUILDING}${safeTaskName(id)}`);
+}
+
 export function taskBranch(id) { return `${BRANCH_PREFIX}${safeTaskName(id)}`; }
 
 /** The repository root, or null when this is not a checkout at all. */
@@ -156,20 +184,48 @@ export function ensureTaskFolder(dir, id, { pid = process.pid, dependencies = tr
 
   hideFromTheCheckout(root);
 
+  // EVERY STEP BELOW HAPPENS SOMEWHERE ELSE, and the folder appears at its own
+  // path in one move at the end. `buildingFolderPath` is why. A build the app
+  // died in the middle of leaves an unfinished copy there, which nobody wants
+  // and which would refuse the next attempt, so it goes first.
+  const staging = buildingFolderPath(root, name);
+  clearUnfinished(root, staging);
+
   const branchExists = tryGit(root, ['rev-parse', '--verify', '-q', `refs/heads/${branch}`]).ok;
   const from = branchExists ? branch : baseRef(root);
-  if (!cloneCheckout(root, folder, branch, from, branchExists)) {
+  if (!cloneCheckout(root, staging, branch, from, branchExists)) {
     const add = branchExists
-      ? tryGit(root, ['worktree', 'add', folder, branch])
-      : tryGit(root, ['worktree', 'add', '-b', branch, folder, baseRef(root)]);
+      ? tryGit(root, ['worktree', 'add', staging, branch])
+      : tryGit(root, ['worktree', 'add', '-b', branch, staging, baseRef(root)]);
     if (!add.ok) throw Error(`Could not make a folder for ${name}: ${add.out}`);
-    if (dependencies) cloneDependencies(root, folder);
+    if (dependencies) cloneDependencies(root, staging);
+  }
+
+  // `worktree move` rather than a rename, so git's own record of where this
+  // worktree lives moves with it. It refuses if anything is already at the
+  // destination, which is the last guard against walking over a live folder.
+  const moved = tryGit(root, ['worktree', 'move', staging, folder]);
+  if (!moved.ok) {
+    clearUnfinished(root, staging);
+    throw Error(`Could not make a folder for ${name}: ${moved.out}`);
   }
 
   lock(root, folder, pid);
   return { path: folder, branch, created: true };
 }
 
+/**
+ * Throw away an unfinished copy. Nothing is ever lost here: a staging folder
+ * has never been handed to anybody, so the most it can hold is a checkout that
+ * did not finish. The branch is left alone, as everywhere else in this file.
+ */
+function clearUnfinished(root, staging) {
+  if (!fs.existsSync(staging) && !record(root, staging)) return;
+  tryGit(root, ['worktree', 'remove', '--force', staging]);
+  try { fs.rmSync(staging, { recursive: true, force: true }); } catch { /* already gone */ }
+  tryGit(root, ['worktree', 'prune']);
+}
+
 /**
  * MAKING THE FOLDER WITHOUT PAYING FOR IT TWICE.
  *
@@ -217,10 +273,12 @@ function cloneCheckout(root, folder, branch, from, branchExists) {
     if (!after.ok || after.out.length > 0) throw Error('the clone did not match the commit');
     return true;
   } catch {
-    // Back to nothing, so the ordinary path starts from a clean sheet.
-    tryGit(root, ['worktree', 'remove', '--force', folder]);
-    try { fs.rmSync(folder, { recursive: true, force: true }); } catch { /* already gone */ }
-    tryGit(root, ['worktree', 'prune']);
+    // Back to nothing, so the ordinary path starts from a clean sheet. What is
+    // thrown away here is the UNFINISHED COPY and never a folder anybody is in:
+    // `folder` is the staging path, which no session has ever been given. It
+    // used to be the real one, and a `remove --force` of that is how a running
+    // agent lost the ground under it.
+    clearUnfinished(root, folder);
     return false;
   }
 }
@@ -390,7 +448,10 @@ export function listTaskFolders(dir) {
   if (!root) return [];
   const home = path.join(root, ...WORKTREES);
   return registered(root)
-    .filter((w) => path.dirname(w.path) === home && !w.prunable)
+    // A folder still being built is not one of hers: it has no row standing in
+    // it and nothing in it is wanted, so it may never be listed, shown or swept.
+    .filter((w) => path.dirname(w.path) === home && !w.prunable
+      && !path.basename(w.path).startsWith(BUILDING))
     .map((w) => {
       const { dirty, merged } = folderState(root, w.path);
       let touchedAt = null;

package/main/task-remote-control.mjs

@@ -18,9 +18,9 @@ export async function taskRemoteControl(sup,product,id,action='status') {
  if(sup._engineFor(item)==='codex')throw Error('Remote Control is currently available for Claude Code conversations only.');
  if(action==='dismiss')return current()?.state==='failed'&&!current()?.mayBeActive?publish('off'):current();
  if(current()?.state==='connecting'||current()?.state==='disconnecting')return current();
- // Typing the command IS the decision, so it never stops at a card asking again.
- // Her words, w-79bffd7ec3: "should trigger it to turn on or off, depending on
- // its current state, without multiple confirmations."
+ // Typing the command IS the decision, so it never stops at a card asking again
+ // (w-79bffd7ec3): it turns remote control on or off depending on its current
+ // state, with no further confirmation.
  if(action==='toggle')action=['connected','ready','reconnecting'].includes(current()?.state)||current()?.mayBeActive?'disable':'enable';
  if(action==='enable'&&['connected','ready','reconnecting'].includes(current()?.state))return current();
  let session=sup.sessions.get(id);

package/main/task-terminals.mjs

@@ -133,7 +133,8 @@ export class TaskTerminals {
     }
     const place=this.resolve(key);
     const cwd=typeof place==='string'?place:place.cwd;
-    const pty=this.spawn(this.shell,['-l'],{cwd,env:this.env,cols:80,rows:24,name:'xterm-256color'});
+    const command=place?.command;
+    const pty=this.spawn(command?.file??this.shell,command?.args??['-l'],{cwd,env:{...this.env,...command?.env},cols:80,rows:24,name:'xterm-256color'});
     let resolveExit;const exitPromise=new Promise(resolve=>{resolveExit=resolve;});
     const session={token:randomUUID(),pty,cwd,buffer:'',offset:0,exitCode:null,exited:false,exitPromise,lastReadAt:this.now()};this.sessions.set(key,session);
     /*

package/main/team/index.mjs

@@ -0,0 +1,440 @@
+// THE TEAM SERVICE: who is signed in on this Mac, their team, and the sync
+// that keeps shared projects the same on every teammate's Mac.
+//
+// It owns one session (Supabase in the app, memory in tests) and, once someone
+// is signed in:
+//   - stamps every ledger line this Mac writes with their person id, here and
+//     in the store server the supervisor starts (AGENTBOX_PERSON_ID);
+//   - shows them the invites waiting for their email, and joins one only when
+//     they say yes (acceptInvite). Once this Mac is in a team it stays in that
+//     team: an invite, or an older team somebody made, never moves it;
+//   - syncs every few seconds, and at once when a teammate writes;
+//   - answers the window's questions: who am I, who is on my team, what are
+//     my teammates' private tasks doing.
+import path from 'node:path';
+import { createTeamSync, fileSyncState } from './sync.mjs';
+import { listSharedProjects, joinSharedProject, markShared, makeDirect } from './projects.mjs';
+import { firstSentence } from '../../shared/thread-cards.mjs';
+import { cardsFor } from '../../shared/thread-cards.mjs';
+import fs from 'node:fs';
+import { hasLapsed, statusEnds } from '../../shared/team-status.mjs';
+
+// `signingIn` is { url } while a Google sign-in waits on the browser, so the
+// page can offer that link again rather than a button that does nothing.
+const EMPTY = { configured: false, started: false, signedIn: false, signingIn: null, me: null, team: null, invites: [], sent: [], people: [], cards: [], lastSyncAt: null, error: null };
+
+export function createTeamService({
+  session, store, disk, accountRoot, stateFile, onChange = () => {}, log = () => {}, intervalMs = 5000, startRetryMs = 1500,
+  // The clock, so a test can move past the moment a status runs out.
+  now = Date.now,
+}) {
+  let state = { ...EMPTY, configured: !!session?.configured };
+  let backend = null;
+  let sync = null;
+  let timer = null;
+  let unsubscribe = null;
+  let pending = null;
+  // The sync cursors and which team this Mac is in, in one file.
+  let local = null;
+  const kept = () => (local ??= fileSyncState(stateFile, fs));
+
+  const set = (patch) => { state = { ...state, ...patch }; onChange(); };
+
+  function products() {
+    try { return store.listProducts(); } catch { return []; }
+  }
+
+  // A status the owner set has run out: wipe it where it is stored, so old
+  // text does not sit in the cloud. Everyone who READS it already saw it go,
+  // on their own clock (shared/team-status.mjs); this is the tidying.
+  async function clearLapsedStatus() {
+    if (!backend || !hasLapsed(state.me?.status, now())) return;
+    await backend.setStatus({ text: null, until: null });
+    set({ me: { ...state.me, status: null } });
+  }
+
+  // THE MESSAGE RECORD OF EXACTLY TWO PEOPLE, made by one of them (see
+  // `message` below for why both halves matter).
+  // `to` is one person or several (2026-10-01: messages to a few people at
+  // once). The record must hold EXACTLY you and them, and one of you made it.
+  function directWith(me, to) {
+    const two = new Set([me, ...[].concat(to)]);
+    const justUs = (t) => {
+      const on = new Set([...t.people, ...(t.sharedBy ? [t.sharedBy] : [])]);
+      return two.has(t.sharedBy) && on.size === two.size && [...on].every((p) => two.has(p));
+    };
+    // ONE RECORD FOR THE TWO OF YOU, THE SAME ONE ON BOTH MACS. Two people who
+    // write each other first within the same second each make one (measured
+    // 2026-10-01 on two test copies), and each Mac then kept writing into its
+    // own. Both now settle on the record with the lowest id, so the talk
+    // comes back together the moment both records are known.
+    return products().filter((p) => p.team?.direct && justUs(p.team))
+      .sort((a, b) => String(a.team.projectId).localeCompare(String(b.team.projectId)))[0] ?? null;
+  }
+
+  // THE CONVERSATION IN A MESSAGE RECORD: its most recently touched row. Older
+  // records may hold one row per message, from before a message continued the
+  // conversation, and the newest of those is where the talk is.
+  function conversationIn(slug) {
+    let rows = [];
+    try { rows = store.listItems().filter((i) => i.product === slug && !i.agent); } catch { rows = []; }
+    return rows.sort((a, b) => (b.updatedAt ?? 0) - (a.updatedAt ?? 0))[0] ?? null;
+  }
+
+  // THE TEAM THIS MAC IS IN IS THE ONE IT REMEMBERS. Found by review
+  // 2026-10-01: the app took whichever of your teams was oldest, and joined
+  // every team that invited you at each start, so a team made with a
+  // backdated created_at and an invite moved your work into it unasked. Now
+  // the first team is remembered, and a remembered team you are no longer on
+  // leaves you in no team rather than in another one.
+  async function refreshTeam() {
+    const me = state.me?.id;
+    const teams = await backend.myTeams();
+    const remembered = me ? kept().getTeam(me) : null;
+    // '' is "left a team, and joins nothing until asked": never quietly the next one.
+    const team = remembered === '' ? null : remembered ? teams.find((t) => t.id === remembered) ?? null : teams[0] ?? null;
+    if (team && !remembered && me) kept().setTeam(me, team.id);
+    // The moment sharing starts on this Mac, kept so it never moves later.
+    if (team && me && !kept().getSince(me)) kept().setSince(me, Date.now());
+    const people = team ? await backend.teamPeople(team.id) : [];
+    const cards = team ? await backend.listCards() : [];
+    // An invite lookup that fails (an older cloud, a dropped request) leaves
+    // you signed in with nothing offered, never signed out.
+    const invites = team ? [] : await backend.pendingInvites().catch((err) => { log(`team: invites: ${err.message}`); return []; });
+    // The invites this team has out, so the settings page can say who has not
+    // joined yet and let them be cancelled.
+    const sent = team && backend.listInvites ? await backend.listInvites(team.id).catch(() => []) : [];
+    set({ team, people, cards, invites, sent, since: me ? kept().getSince(me) : null });
+  }
+
+  async function syncNow() {
+    if (!sync) return null;
+    if (pending) return pending;
+    // THE BODY WAITS A MICROTASK, SO `pending` IS SET BEFORE ANY OF IT RUNS.
+    // Written as `pending = (async () => {...})()` the body's synchronous
+    // prefix runs BEFORE the assignment, so `pending` was still null while it
+    // ran. That was harmless until a pass wrote to the cloud: clearing a
+    // lapsed status makes the memory cloud emit, the emit calls back into
+    // syncNow, the guard is still null, and it recurses until the stack ends.
+    // Measured on the first run of the lapse test: a stack overflow, every
+    // frame this function.
+    pending = Promise.resolve().then(async () => {
+      try {
+        // An invite sent after this person signed in shows up here, not at
+        // their next sign-in. It is offered, never taken up.
+        if (!state.team) await refreshTeam();
+        await clearLapsedStatus();
+        const report = await sync.syncOnce();
+        // The people are read again on every pass, with the activity, so a
+        // teammate who joined after this Mac signed in has a name and a face
+        // on the first line of theirs that arrives here.
+        const [cards, people, me] = state.team
+          ? await Promise.all([backend.listCards(), backend.teamPeople(state.team.id), backend.me()])
+          : [[], [], state.me];
+        set({ lastSyncAt: Date.now(), error: null, cards, people, me: me ?? state.me });
+        if (report.joined.length || report.pulled) log(`team: joined ${report.joined.length}, pulled ${report.pulled}, pushed ${report.pushed}`);
+        if (report.notJoined) log(`team: left ${report.notJoined} shared project(s) unjoined, this Mac already holds the most it takes on by itself`);
+        return report;
+      } catch (err) {
+        set({ error: String(err?.message ?? err) });
+        return null;
+      } finally {
+        pending = null;
+      }
+    });
+    return pending;
+  }
+
+  function stopLoop() {
+    if (timer) clearInterval(timer);
+    timer = null;
+    unsubscribe?.();
+    unsubscribe = null;
+  }
+
+  async function signedIn(b) {
+    backend = b;
+    const me = await backend.me();
+    if (!me) throw new Error('signed in, but no person record came back');
+    disk.setLineAuthor(me.id);
+    process.env.AGENTBOX_PERSON_ID = me.id;
+    set({ signedIn: true, me, error: null });
+    // MY WORKSPACE IS NOT MADE HERE ANY MORE (w-f8d123be62, approved
+    // 2026-10-05). It was, and that was the whole bug: the only caller was this
+    // one, inside signing in, and this service is not even built on a Mac with
+    // no team cloud. So the single-person app opened on no projects at all.
+    // Everybody gets one at boot now (main/main.mjs), signed in or not.
+    await refreshTeam();
+    sync = createTeamSync({
+      backend,
+      disk,
+      state: kept(),
+      // ARCHIVED ONES COUNT AS HERE. Asked of the visible list, a shared
+      // project you archived read as missing and was joined again beside it.
+      listShared: () => { try { return listSharedProjects(store.listProducts({ includeArchived: true })); } catch { return []; } },
+      joinProject: (project) => joinSharedProject(accountRoot, project),
+      listCards: () => cardsFor({ products: products(), readItems: (p) => disk.readWorkItems(p.dir), since: state.me ? kept().getSince(state.me.id) : null }),
+      teamIdOf: () => state.team?.id ?? null,
+    });
+    stopLoop();
+    timer = setInterval(() => { syncNow(); }, intervalMs);
+    timer.unref?.();
+    unsubscribe = backend.subscribe(() => { syncNow(); });
+    await syncNow();
+  }
+
+  return {
+    state: () => state,
+
+    // THREE TRIES AT START, because one dropped request left the app signed
+    // out until it was restarted (measured 2026-10-01 on a loaded Mac: the
+    // sign-in went through and the very next call failed). A session that is
+    // simply not there is not an error and is not retried.
+    // `started` says the first look for a saved sign-in is over, so the window
+    // can tell "signed out" from "still finding out" and never flashes the
+    // sign-in page at somebody who is signed in.
+    async start() {
+      if (!session?.configured) return state;
+      for (let attempt = 0; attempt < 3; attempt += 1) {
+        try {
+          const b = await session.restore();
+          if (b) await signedIn(b);
+          set({ started: true });
+          return state;
+        } catch (err) {
+          set({ error: String(err?.message ?? err) });
+          if (attempt < 2) await new Promise((r) => setTimeout(r, startRetryMs * (attempt + 1)));
+        }
+      }
+      set({ started: true });
+      return state;
+    },
+
+    async signIn() {
+      let b;
+      try {
+        b = await session.signIn({ onUrl: (url) => set({ signingIn: { url } }), log });
+      } finally {
+        if (state.signingIn) set({ signingIn: null });
+      }
+      await signedIn(b);
+      return state;
+    },
+
+    /** Open the waiting Google sign-in's own link again. False if none waits. */
+    async reopenSignIn() {
+      const url = state.signingIn?.url;
+      if (!url || !session?.reopen) return false;
+      log('team: Google sign-in: opening the browser again');
+      await session.reopen(url);
+      return true;
+    },
+
+    cancelSignIn() {
+      return session?.cancelSignIn?.() ?? false;
+    },
+
+    async signInWithEmail(email, password) {
+      if (!session?.signInWithPassword) throw new Error('this build cannot sign in with email');
+      const b = await session.signInWithPassword(email, password);
+      await signedIn(b);
+      return state;
+    },
+
+    /** A new account: signed in at once, or { confirm: true } until the email is confirmed. */
+    async signUp(email, password, name) {
+      if (!session?.signUp) throw new Error('this build cannot make accounts');
+      const out = await session.signUp({ email, password, name });
+      if (out?.backend) { await signedIn(out.backend); return state; }
+      return { ...state, confirm: true };
+    },
+
+    async signOut() {
+      stopLoop();
+      await session.signOut?.();
+      disk.setLineAuthor(null);
+      delete process.env.AGENTBOX_PERSON_ID;
+      backend = null;
+      sync = null;
+      // Signed out is a known answer, so the window shows the sign-in page at once.
+      state = { ...EMPTY, configured: !!session?.configured, started: true };
+      onChange();
+      return state;
+    },
+
+    async createTeam(name) {
+      if (!backend) throw new Error('sign in first');
+      const clean = String(name ?? '').trim();
+      if (!clean) throw new Error('a team needs a name');
+      const made = await backend.createTeam(clean);
+      kept().setTeam(state.me.id, made.id);
+      await refreshTeam();
+      return state;
+    },
+
+    // TEAM SETTINGS (2026-10-01): an invite page and team settings beside it.
+    // The database decides who may (owners rename,
+    // remove and cancel; anyone leaves); these only ask it and say what it said.
+    async renameTeam(name) {
+      if (!backend || !state.team) throw new Error('start or join a team first');
+      const clean = String(name ?? '').trim();
+      if (!clean) throw new Error('a team needs a name');
+      await backend.renameTeam(state.team.id, clean);
+      await refreshTeam();
+      return state;
+    },
+
+    // A line you write about yourself, held until the end of today, tomorrow
+    // or this week, or until you clear it. Saying nothing clears it.
+    async setStatus({ text, hold = 'open', until } = {}) {
+      if (!backend) throw new Error('sign in first');
+      const status = await backend.setStatus({ text, until: statusEnds({ hold, until }, now()) });
+      set({ me: { ...state.me, status } });
+      return state;
+    },
+
+    async removeMember(personId) {
+      if (!backend || !state.team) throw new Error('start or join a team first');
+      if (personId === state.me?.id) throw new Error('to leave the team, use Leave team');
+      await backend.removeMember(state.team.id, personId);
+      await refreshTeam();
+      return state;
+    },
+
+    async leaveTeam() {
+      if (!backend || !state.team || !state.me) throw new Error('you are not on a team');
+      await backend.removeMember(state.team.id, state.me.id);
+      kept().setTeam(state.me.id, '');
+      await refreshTeam();
+      return state;
+    },
+
+    async cancelInvite(email) {
+      if (!backend || !state.team) throw new Error('start or join a team first');
+      await backend.cancelInvite(state.team.id, email);
+      await refreshTeam();
+      return state;
+    },
+
+    // JOIN A TEAM BECAUSE ITS INVITE WAS ANSWERED YES, and only then. A Mac
+    // already in a team does not move: that is a choice nobody offers here.
+    async acceptInvite(teamId) {
+      if (!backend || !state.me) throw new Error('sign in first');
+      if (state.team) throw new Error(`this Mac is already in ${state.team.name}`);
+      if (!state.invites.some((i) => i.teamId === teamId)) throw new Error('that invite is no longer waiting');
+      await backend.acceptInvite(teamId);
+      kept().setTeam(state.me.id, teamId);
+      await refreshTeam();
+      await syncNow();
+      return state;
+    },
+
+    async invite(email) {
+      if (!backend || !state.team) throw new Error('start or join a team first');
+      const clean = String(email ?? '').trim();
+      if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(clean)) throw new Error(`${clean || 'that'} is not an email address`);
+      await backend.invite(state.team.id, clean);
+      // So the settings page lists it as invited straight away.
+      await refreshTeam().catch(() => {});
+      return state;
+    },
+
+    // Share a local project with the whole team or with specific people. The
+    // project keeps one cloud id for good (markShared), so changing who sees
+    // it is the same project.
+    async share(slug, { visibility = 'team', people = [] } = {}) {
+      if (!backend || !state.team) throw new Error('start or join a team first');
+      const product = products().find((p) => p.slug === slug);
+      if (!product) throw new Error(`no project ${slug}`);
+      const team = markShared(product.dir, { teamId: state.team.id, visibility, people, sharedBy: state.me.id });
+      await backend.shareProject({ id: team.projectId, teamId: state.team.id, name: product.name, visibility: team.visibility, people: team.people });
+      onChange();
+      await syncNow();
+      return state;
+    },
+
+    // A MESSAGE TO A PERSON (approved 2026-10-01: people get messages, never
+    // tasks). It goes into the record the two of them share, made the first
+    // time and reused after, and it waits in their inbox until they answer.
+    /** The conversation in a message record: its newest row, if it has one. */
+    conversation(to) {
+      const me = state.me?.id;
+      if (!me || !to) return null;
+      const product = directWith(me, to);
+      const convo = product ? conversationIn(product.slug) : null;
+      return convo ? { product: product.slug, id: convo.id } : null;
+    },
+
+    /**
+     * `priority` is the level the sender picked on the card, and it counts on
+     * the FIRST message only (w-7ba439c883): the conversation's place in the
+     * other person's inbox was settled when it opened, and a reply three days
+     * later is not a chance to lift it. Nothing picked means nothing sent, so
+     * the row keeps composeItem's 0, which the inbox reads as Medium.
+     */
+    async message(toIn, body, priority) {
+      if (!backend || !state.team || !state.me) throw new Error('start or join a team first');
+      const me = state.me.id;
+      // One person or a few: the same conversation for the same people.
+      const others = [...new Set([].concat(toIn ?? []).filter((p) => p && p !== me))].sort();
+      if (!others.length) throw new Error('pick someone to message');
+      if (others.length > 11) throw new Error('a message goes to at most eleven people');
+      if (others.some((p) => !state.people.some((q) => q.id === p))) throw new Error('that person is not on your team');
+      const to = others.length === 1 ? others[0] : others;
+      const text = String(body ?? '').trim();
+      if (!text) throw new Error('a message needs some words');
+      // THE RECORD IS REUSED ONLY IF IT IS EXACTLY THE TWO OF YOU AND ONE OF
+      // YOU MADE IT. Found by review 2026-10-01: a teammate could make a
+      // "direct" record holding you and somebody else, and the next message
+      // either of you sent the other went into it, where its maker read it.
+      let product = directWith(me, to);
+      // Before making a record, look once more: the other person may have just
+      // made one, and the pull is what brings it here.
+      if (!product) { await syncNow(); product = directWith(me, to); }
+      if (!product) {
+        const made = makeDirect(accountRoot, { teamId: state.team.id, me, others });
+        // A START THAT FAILS LEAVES NOTHING BEHIND. A record shared only in
+        // part (the cloud refused its people) was reused by the next send and
+        // never reached anyone (found 2026-10-01 on a test copy).
+        try {
+          await backend.shareProject({ id: made.projectId, teamId: state.team.id, name: 'Direct', visibility: 'people', people: others, direct: true });
+        } catch (err) {
+          try { fs.rmSync(made.dir, { recursive: true, force: true }); } catch { /* the error below still says what failed */ }
+          throw err;
+        }
+        product = products().find((p) => p.dir === made.dir) ?? { slug: made.slug, dir: made.dir };
+      }
+      // ONE CONVERSATION PER PERSON (decided 2026-10-01 from user research:
+      // people expect to click a name and see what was said before, and a
+      // subject line on every message between two coworkers makes talking
+      // feel like filing tickets). So a message goes on the end of the
+      // conversation the two of you already have, reopened if it was put away,
+      // and only the first message ever starts one. Work stays in threads; this
+      // is talk.
+      const title = firstSentence(text, 90) || text.slice(0, 90);
+      const convo = conversationIn(product.slug);
+      if (convo) {
+        store.answerItem(product.slug, convo.id, { answer: text });
+        // Who answers next is whoever did not speak last (shared/team-rules.mjs,
+        // `inMyInbox`); the assignee stays for a Mac on an older build.
+        store.teamPatch(product.slug, convo.id, { assignee: others[0] });
+        onChange();
+        await syncNow();
+        return store.readItem(product.slug, convo.id);
+      }
+      const level = Number.isFinite(priority) && priority > 0 ? Math.trunc(priority) : 0;
+      const item = store.composeItem(product.slug, { title, body: text, priority: level, assignee: others[0], people: [me, ...others] });
+      onChange();
+      await syncNow();
+      return item;
+    },
+
+    syncNow,
+    stop: stopLoop,
+  };
+}
+
+// Where the service keeps its sync cursors: beside the store's own records.
+export function teamStateFile(storeRoot) {
+  return path.join(storeRoot, '.team-sync.json');
+}