agentbox-app 0.1.7 → 0.1.11

package/shared/shortcuts.mjs

@@ -0,0 +1,236 @@
+// PURE. EVERY KEY AGENTBOX HAS, IN THE ORDER A PERSON MEETS THEM.
+//
+// A shortcuts page in settings, because onboarding a non-technical tester
+// meant saying each key out loud, one at a time: the app had a switch for
+// whether it WHISPERS its keys and no page anywhere that says what they are.
+//
+// WHY THIS IS A FILE AND NOT MARKUP IN THE COMPONENT. A page that prints a key
+// the handler does not have is worse than no page at all — that is the rule
+// `list-rules.ts` already keeps for the hint on a row, and the reason it holds
+// even harder here is that a hint is read for a second and a reference page is
+// believed. So the list is a value, and
+// `tests/the-shortcuts-page-lists-keys-that-work.test.mjs` reads every entry
+// below against the branch in App.tsx (or main/main.mjs, or Compose.tsx) that
+// actually runs it. A key added here without a handler fails the suite.
+//
+// WHY IT IS IN shared/ AND PLAIN ESM (w-7ec8553e23, 2026-10-04). It lived in
+// renderer/src as TypeScript until an agent told the user to "Press S on this
+// task" three days after S stopped scheduling: nothing a session is handed
+// said what the keys are, so it went by an old memory. The supervisor now
+// hands every run `keysForAgents()`, read off this same list, and main cannot
+// import TypeScript. Types are in shortcuts.d.mts beside it.
+//
+// ONE SENTENCE A ROW, AND IT IS SHORT (w-1bc916a880). Every
+// sentence here is now under seventy characters and the test enforces it. A row
+// that wants a second idea becomes its own row, or it does not go on the page.
+//
+// AND NO KEY HIDES INSIDE A SENTENCE.
+//
+// HOW IT IS GROUPED, and it is not how the code is arranged. The code has one
+// switch for the list, one branch for an open task, a chord block above both
+// and a main-process handler under all of it. Nobody thinks in those. Four
+// headings, and every key sits under the one that matches when she would want
+// it: in your inbox, in a task you have opened, closing and scheduling and
+// undoing, anywhere in the app.
+//
+// EVERY HEADING IS LITERAL AND THERE IS NO SUBHEADING AT ALL (w-1bc916a880,
+// second round).
+//
+// The plainest point first: that heading named one of the two
+// directions its own rows draw. Three of the four were figures of speech, and a
+// figure of speech is a second thing to decode on a page whose only job is to
+// be looked up. So a heading now says WHEN the keys under it work, in the words
+// the app itself uses for those places, and the one group that cannot be named
+// that way is named by what its keys do instead, because all four of its keys
+// work in both places.
+//
+// What the three of them carried, and where it went:
+//
+//   "In Scheduled, E brings a task back instead of closing it." This was the
+//   most confusing one. It is also the same class of thing as G, B and
+//   the import letters below: a behaviour that only happens in one view. The
+//   page's existing rule is that those stay off it, so this now obeys the rule
+//   the rest of the file already kept.
+//
+// The two ↵ rows say what ↵ does when it does something.
+//
+//   "Anything without a key of its own is in ⌘K by name." The lede at the top
+//   of the page already says this, so it was the same sentence twice.
+//
+// WHAT IS DELIBERATELY NOT HERE, so nobody adds it back as an oversight:
+//
+// ⌘1..4, for PRIORITY or for anything else. Priority was removed deliberately
+// and that handler no longer fires. The chord then went to a section of the
+// sidebar until 2026-10-02, and that is gone as well: Tab moves along the tabs
+// now and is listed above.
+//
+//   Y, N and I on a row in the list. Real since w-9741ed0e0b, but they answer
+//   a Codex conversation's import row and are dead on every other row in the
+//   app. A reference page that lists a key which does nothing on nineteen
+//   screens out of twenty teaches somebody that the app ignores them.
+//
+//   ⇥ inside the new task card, which changes the project it goes to. It is
+//   gated to that one card, the card draws its projects where she can see
+//   them, and it used to ride along inside the C row's sentence, which is the
+//   fault the NO KEY HIDES INSIDE A SENTENCE block above is about.
+//
+//   ⇧⇥ in the reply box, which cycles Claude Code's permission modes. Real,
+//   and it belongs to the reply box rather than to the app; it is also the one
+//   key here that cannot be said without the word "permissions", and Settings
+//   already has a whole group explaining those.
+//
+//   ⌘R, ⌘=, ⌘- and ⌘0. The Mac's own chords, answered in main.mjs so they work
+//   over the game. Nobody needs to be taught reload and zoom.
+//
+// EVERY SENTENCE IS PLAIN. A tester does not know what a modal, a pane, a
+// binary or a view is. No row uses a word the app does not print on screen
+// somewhere she can see it. THE SIDEBAR ROW IS WHY THAT NOW MATTERS TWICE: it
+// used to name the sections, "Inbox, Scheduled, In progress, Closed", and
+// that went wrong in both halves. The real order is Inbox, In
+// progress, Scheduled, Closed (`workspaceDestinations`), and Scheduled is
+// drawn only when something is actually scheduled. A reference
+// page that recites a list the sidebar can change goes stale without anybody
+// touching it, so the row names no sections at all.
+
+import { NAME } from './product-name.mjs';
+
+/** @type {import('./shortcuts.d.mts').ShortcutGroup[]} */
+export const SHORTCUTS = [
+  {
+    // App.tsx, the `switch (e.key)` at the foot of the key handler: this is the
+    // list with nothing open, which is where anybody starts.
+    //
+    // "IN YOUR INBOX", BECAUSE INBOX IS A WORD THE APP PRINTS AND TASK LIST IS
+    // NOT (w-1bc916a880, third round).
+    //
+    // The mistake is worth naming because it is the same one
+    // the round before was meant to fix. "Task list" was reached for to cover
+    // the fact that these keys work in all four sidebar sections rather than
+    // only the first, which is an accurate thing about the code and a phrase
+    // nobody sees on a screen. Inbox is the first row of the
+    // sidebar. The heading claims these keys work there; it does not claim they
+    // work ONLY there, and one of its rows moves between the sections anyway.
+    label: 'In your inbox',
+    keys: [
+      // case 'j': case 'J': case 'ArrowDown' → selected + 1
+      { keys: ['J', '↓'], join: 'or', what: 'Move down the list.' },
+      // case 'k': case 'K': case 'ArrowUp' → selected - 1
+      { keys: ['K', '↑'], join: 'or', what: 'Move up the list.' },
+      // case 'ArrowLeft': case 'ArrowRight' → boardSideways (w-23fc91bff5).
+      // "Board" is the word the View and filters menu prints.
+      { keys: ['←', '→'], what: 'Move to the next column on the board.' },
+      // case 'Enter' → setFocused(pointed)
+      { keys: ['↵'], what: 'Open the task you are on.' },
+      // App.tsx, `if (e.key === 'Tab')`: nextTab(stateTabOrder, view, shiftKey)
+      // walks the tabs along the top of the inbox, wrapping. It replaced ⌘1 to
+      // ⌘4 on 2026-10-02 (w-914b16eab6), which jumped through the sidebar's
+      // sections before those became these tabs. Shift-Tab goes back and is
+      // left unlisted on her word: "just show the Next tab".
+      { keys: ['⇥'], what: 'Move to the next tab along the top.' },
+      // case 'b': case 'B' → setInboxDisplay(flipView(inboxDisplay)), asked
+      // for by name (w-58c8f466e7). "List" and "Board" are the words the View
+      // and filters menu prints, so the sentence uses those.
+      { keys: ['B'], what: 'Switch between the list and the board.' },
+      // Escape in the focused branch: doc → task → list. In the list switch it
+      // clears a selection and closes search.
+      { keys: ['esc'], what: 'Go back one step: a file, then the task, then the list.' },
+    ],
+  },
+  {
+    // App.tsx, the `if (focused)` branch: a task open in front of her. NOT
+    // "answering an agent" any more, because ⌘J opens its terminal and that is
+    // not an answer; the heading says when the keys work, which is the scheme.
+    label: 'In a task you have opened',
+    keys: [
+      // focused branch: 'r' → setModal('reply'); list switch: 'r' in the inbox
+      { keys: ['R'], what: 'Write back to the agent.' },
+      // Compose.tsx onKeyDown: (meta||ctrl) && Enter → send; Focus.tsx the same
+      { keys: ['⌘↵'], what: 'Send what you have typed.' },
+      // focused branch: ArrowDown / ArrowUp walk opts
+      { keys: ['↑', '↓'], what: 'Move through the options an agent has offered.' },
+      // focused branch: Enter sends optionSel. Its own row rather than a clause
+      // at the end of the one above, so somebody scanning for ↵ finds it.
+      { keys: ['↵'], what: 'Send the option you have selected.' },
+      // focused branch: /^[1-9]$/ → pickOption(focused, Number(e.key))
+      { keys: ['1', '9'], join: 'to', what: 'Pick an option by its number.' },
+      // ⌘J, above the inInput gate in App.tsx: dispatches task-terminal-toggle,
+      // and toasts "Open a task to use its terminal" when there is none
+      // (w-ef92663cb1). It landed after this list last changed, so it was
+      // missing here at first.
+      { keys: ['⌘J'], what: 'Show or hide this task’s terminal.' },
+      // threads/Summary.tsx, `useSummaryShortcut`: it listens in the capture
+      // phase and stops the key there, so S belongs to the summary on a thread
+      // that has one. It is under THIS heading and not the one below because it
+      // is the one key in the app that works only inside an open thread.
+      { keys: ['S'], what: 'Show or hide the summary.' },
+    ],
+  },
+  {
+    // The one group that cannot be named by WHERE she is, because all four of
+    // its keys work both in the list and inside an open task. So it is named by
+    // what the keys do, literally and in the order they are drawn.
+    label: 'Closing, scheduling and undoing',
+    keys: [
+      // focused branch: 'e' → markDone. List switch: inbox → markDone,
+      // snoozed → unsnooze. It never approves anything.
+      { keys: ['E'], what: 'Close the task and take it out of your inbox.' },
+      // focused branch and list switch: 'l' → openSnooze. IT WAS S UNTIL
+      // 2026-10-01 AND THAT IS THE WHOLE OF WHY IT MOVED. S had come to mean
+      // the summary inside a thread and still meant the schedule picker in the
+      // list, so this page taught one letter for two different things and an
+      // office manager testing the app met both inside a minute. One meaning
+      // per letter: S is the summary, L is later.
+      { keys: ['L'], what: 'Put the task off until a time you pick.' },
+      // focused branch and list switch: 'z' → undo
+      { keys: ['Z'], what: 'Undo the last thing you did.' },
+      // (meta||ctrl) && 'a' && !inInput && !modal → tick the whole list
+      { keys: ['⌘A'], what: 'Tick every task in the list. Press it again to untick.' },
+    ],
+  },
+  {
+    label: 'Anywhere in the app',
+    keys: [
+      // (meta||ctrl) && 'k' → the palette, above every other branch, and
+      // forwarded from inside an open file by main.mjs as well.
+      { keys: ['⌘K'], what: `The command bar: everything ${NAME} can do, by name.` },
+      // 'n' in both branches → setModal('compose'). C does the same and is
+      // left off: N is the default (w-fb9051e597).
+      // "Threads", not tasks, since w-ec62ab6b38.
+      { keys: ['N'], what: 'Start a new thread.' },
+      // '/' above the focused branch → openSearch
+      { keys: ['/'], what: 'Search your threads.' },
+      // '\\' above the focused branch → togglePanel
+      { keys: ['\\'], what: 'Show or hide the left sidebar.' },
+      // main/main.mjs before-input-event: ⌘Y / ⌘N answer the oldest approval.
+      // Its own card prints "⌘Y / ⌘N" beside Allow and Deny, so the words here
+      // are the card's words. It lives under this heading rather than under an
+      // open task because it is answered from anywhere at all.
+      { keys: ['⌘Y', '⌘N'], join: 'or', what: 'Allow or deny a card asking to run something.' },
+    ],
+  },
+];
+
+/** Every cap drawn on the page, flattened. The test walks this. */
+export function everyKey(groups = SHORTCUTS) {
+  return groups.flatMap((g) => g.keys.flatMap((k) => k.keys));
+}
+
+// WHAT AN AGENT IS TOLD, and it is this page and nothing else, so a key that
+// moves here has moved for every agent on its next run. The closing line is
+// the point: an agent's own saved memory is read before anything we hand it,
+// and on 2026-10-04 one said "press S" three days after S stopped scheduling.
+/** The keys as one block of plain text, for an agent's system prompt. */
+export function keysForAgents(groups = SHORTCUTS) {
+  const lines = [
+    `The keys in ${NAME}, the app this person reads you in, as they are today.`,
+    'When you tell them to press something, use these. Keys have moved before,',
+    'so a key you remember from an earlier session, a memory or a note that',
+    'disagrees with this list is out of date. Anything without a key is in ⌘K',
+    'by name.',
+  ];
+  for (const g of groups) {
+    lines.push('', `${g.label}:`);
+    for (const k of g.keys) lines.push(`- ${k.keys.join(k.join ? ` ${k.join} ` : ' ')}: ${k.what}`);
+  }
+  return lines.join('\n');
+}

package/shared/spawn-trouble.d.mts

@@ -6,3 +6,5 @@
 // main and by the tests, which are both plain JS and need nothing here.
 
 export function strandedTitle(count: number): string;
+/** The line in a thread where a run stopped, in our words; `raw` is the tool's own refusal. */
+export function runStoppedLine(raw: string): string;

package/shared/spawn-trouble.mjs

@@ -6,11 +6,11 @@
 // across the top of her inbox. Her three complaints were all correct. There is
 // no OAuth in Agentbox, so the sentence names a thing that does not exist here.
 // It is ugly. And it was on screen while agents were working perfectly well,
-// because it was about one of her two Claude accounts and not about the app.
+// because it was about one Claude account among several and not about the app.
 //
 // So the raw text never reaches the renderer again. It goes in the session's
 // own trace log, which is where a person debugging wants it, and what she is
-// shown is one sentence of ours written in her words.
+// shown is one sentence of ours written in plain words.
 //
 // Every sentence here has to survive the same test: read it out loud to
 // somebody who has never heard of a subprocess, and they know what happened
@@ -24,7 +24,7 @@
 // CODEX. It is right about Codex anyway, and that is measured rather than
 // assumed. On 2026-09-05 `codex app-server` (codex-cli 0.148.0) was driven the
 // way main/codex-app-server.mjs drives it, with CODEX_HOME pointed at an empty
-// directory so there was no auth.json and her real ~/.codex login was neither
+// directory so there was no auth.json and the real ~/.codex login was neither
 // read nor written. The turn retried ten times and failed with
 //
 // unexpected status 401 Unauthorized: Missing bearer or basic authentication in
@@ -41,18 +41,18 @@
 
 // AN ACCOUNT THAT IS SIGNED IN AND NOT ALLOWED TO RUN.
 //
-// She was. Her second login was intact and her browser sign-in succeeded every
-// time she did it; the WORKSPACE that account belongs to has Claude Code turned
-// off. Run by hand on her Mac, this is the whole of what the CLI says:
+// It happens. A login can be intact, with the browser sign-in succeeding every
+// time, while the WORKSPACE that account belongs to has Claude Code turned
+// off. Run by hand, this is the whole of what the CLI says:
 //
 //   Your organization has disabled Claude subscription access for Claude Code ·
 //   Use an Anthropic API key instead, or ask your admin to enable access
 //
 // "subscription access" is in the list below, so every one of those was filed
-// as a login that had run out and she was told to type /login. She did, twice
-// in one afternoon; both logins worked; nothing changed, because no login can
-// change an admin's policy. FOUR dead runs on one row that day, all four
-// carrying "Sign that account back in and it picks straight up."
+// as a login that had run out and the person was told to type /login. Doing
+// it again and again changes nothing, because no login can change an admin's
+// policy, and every dead run on the row carried "Sign that account back in
+// and it picks straight up."
 //
 // TESTED BEFORE SIGNED_OUT, which is the whole of the fix: these lines say
 // "subscription" and "access" and mean something else entirely.
@@ -188,9 +188,8 @@ export function troubleCause(raw) {
 //
 // carries the one thing she actually wants to know, and we were throwing it
 // away and then telling her the vaguer "when the limit resets". The timezone
-// is dropped rather than shown: this Mac is set to America/Los_Angeles and
-// every limit line in her store prints that same zone, so naming it would only
-// add a word she has to read. Null when there is no time to quote, and then
+// is dropped rather than shown: the limit line prints the zone the Mac is
+// already set to, so naming it would only add a word she has to read. Null when there is no time to quote, and then
 // the sentence falls back to the wording that has always been there.
 export function limitResetsAt(raw) {
   // Both wordings are real: the CLI's own line is "resets 6pm" and the API's
@@ -202,14 +201,14 @@ export function limitResetsAt(raw) {
 const MONTHS = ['jan', 'feb', 'mar', 'apr', 'may', 'jun', 'jul', 'aug', 'sep', 'oct', 'nov', 'dec'];
 
 // THE SAME HOUR AS A MOMENT, so the fleet can wait exactly until it
-// (2026-09-22: a limit that reset at 6:50pm held every agent until 7:03pm,
+// (a limit that reset at, say, 6:50pm could hold every agent until 7:03pm,
 // because the app waited a fixed thirty minutes instead of reading this line).
 // The next local occurrence of that clock time at or after `from`; null when
 // the line names no hour.
 export function limitResetMoment(raw, from = Date.now()) {
   // CODEX NAMES A DAY, NOT AN HOUR: "try again at Sep 28th, 2026 1:05 PM"
   // (codex-cli 0.153.4, 2026-09-24). A weekly limit read as "thirty minutes"
-  // put the capped login back in the pool every half hour for four days.
+  // put the capped login back in the pool every half hour for days.
   const dated = /try again at ([a-z]{3,9})\.? (\d{1,2})(?:st|nd|rd|th)?,? (\d{4}),? (\d{1,2}):(\d{2})\s*(am|pm)/i.exec(String(raw ?? ''));
   if (dated) {
     const month = MONTHS.indexOf(dated[1].slice(0, 3).toLowerCase());
@@ -343,8 +342,8 @@ export function engineTroubleNote(cause, engineWord = 'Codex') {
 // The count is the point, and it is why this is a different sentence from
 // `troubleSentence` above rather than a rewording of it. That one is about the
 // FLEET, and it can only ever be true when every account on the Mac is down at
-// once. That is why her screen stayed quiet: four Codex tasks and four on a
-// signed-out login sat there all day while her other agents worked, so the
+// once. That is why the screen could stay quiet: Codex tasks and tasks on a
+// signed-out login could sit there all day while the other agents worked, so the
 // fleet was never down and the one line the app owns was structurally unable to
 // speak. The subject here is her TASKS, which is the thing she went looking for
 // and the thing that was actually stuck.
@@ -443,6 +442,28 @@ const DEAD_RUN_OPENERS = {
   unknown: 'stopped before it did anything, so this task has not been started.',
 };
 
+/**
+ * THE LINE IN A THREAD WHERE A RUN STOPPED, in our words.
+ *
+ * The CLI types its own refusal into the run as if the agent had said it
+ * ("Failed to authenticate: OAuth session expired..."), and the thread drew it
+ * as the agent's message. This is about one run, not the task: a run that
+ * stops mid-thread has usually done plenty before it, so it says nothing about
+ * what has or has not been done.
+ */
+const RUN_STOPPED = {
+  'signed-out': 'This run stopped because the account was signed out.',
+  'org-blocked': 'This run stopped because that account is switched off by its organization.',
+  'at-limit': 'This run stopped because the account hit its usage limit.',
+  workspace: "This run stopped because it would not start in this project's folder.",
+  interrupted: 'This run was cut off in the middle.',
+  unknown: 'This run stopped before it finished.',
+};
+
+export function runStoppedLine(raw) {
+  return RUN_STOPPED[troubleCause(raw)] ?? RUN_STOPPED.unknown;
+}
+
 export function deadRunSentence({ engineWord = 'The agent', cause = 'unknown', runs = 1, resetsAt = null } = {}) {
   const opener = `${engineWord} ${DEAD_RUN_OPENERS[cause] ?? DEAD_RUN_OPENERS.unknown}`;
 
@@ -468,7 +489,7 @@ export function deadRunSentence({ engineWord = 'The agent', cause = 'unknown', r
 // WHAT GOES ON HER ROW WHEN THE RUN WAS FINE AND HER ANSWER STILL WENT NOWHERE.
 //
 // `settleDelivery` is two independent tests joined with an AND: did the process
-// exit cleanly, and did an agent leave a word on the row since she wrote. A run
+// exit cleanly, and did an agent leave a word on the row since the user wrote. A run
 // can pass the first and fail the second, and several ordinary ones do -- a
 // Codex turn that talks in its thread and never calls a store tool, a worker
 // that claims a row and finishes without writing, any session on an install

package/shared/team-rules.d.mts

@@ -0,0 +1,17 @@
+// Types for shared/team-rules.mjs, read by the renderer.
+type Row = { createdBy?: string | null; assignee?: string; runner?: string; people?: string[]; status?: string };
+type ProductLike = { team?: { projectId?: string; sharedBy?: string | null } | null } | null | undefined;
+
+export function isShared(product: ProductLike): boolean;
+export function runnerOf(item: Row, product: ProductLike): string | null;
+export function heldByAPerson(item: Row): boolean;
+export function mayRunHere(item: Row, product: ProductLike, me: string | null): boolean;
+export function inMyInbox(item: Row, product: ProductLike, me: string | null): boolean;
+export function lastSpeaker(item: Row): string | null;
+export function iSpokeLast(item: Row, product: ProductLike, me: string | null): boolean;
+export function handedOnByReply(item: Row, product: ProductLike, me: string | null): string | null;
+/** One thread you are in where somebody spoke after you (w-920461cbe6). */
+export interface ThreadWaiting { uid: string; mine: boolean; fresh: number; people: string[]; text: string; last: string; lastBy: string }
+/** What in a conversation waits on you; null on a row from before threads. */
+export interface Waits { chat: number; threads: ThreadWaiting[] }
+export function whatWaits(item: Row & { talk?: unknown }, me: string | null): Waits | null;

package/shared/team-rules.mjs

@@ -0,0 +1,230 @@
+// THE TEAM'S RULES ABOUT ROWS, IN ONE PLACE. Pure and browser-safe: the
+// supervisor asks them before it runs anything, and the window asks them
+// before it puts a row in somebody's inbox, so the two can never disagree about
+// whose a row is.
+//
+// A project is shared when its record carries a team id (main/team/projects.mjs).
+// Everything here leaves a private project exactly as it always was.
+import { pickFields } from './work-items.mjs';
+
+export const isShared = (product) => !!product?.team?.projectId;
+
+// THE PERSON WHOSE MAC RUNS AGENTS ON A ROW: whoever it was handed to, else
+// whoever started it, else (a row from before anyone signed in) whoever shared
+// the project.
+export function runnerOf(item, product) {
+  return item?.runner || item?.createdBy || product?.team?.sharedBy || null;
+}
+
+// A row a person has been given waits for that person, not for an agent.
+export const heldByAPerson = (item) => !!item?.assignee && item.assignee !== 'agent';
+
+// May a worker run on this row on this Mac, signed in as `me`?
+export function mayRunHere(item, product, me) {
+  if (!isShared(product)) return true;
+  if (!me) return false;
+  // A MESSAGE BETWEEN TWO PEOPLE NEVER RUNS AN AGENT, on either Mac. Turning
+  // one into work is @-mentioning an agent in the reply box, which starts a new
+  // thread of your own in the project the mention names; nothing a teammate
+  // writes into the shared record can start one here.
+  if (product?.team?.direct) return false;
+  if (heldByAPerson(item)) return false;
+  // ONLY YOU PUT YOUR MAC IN CHARGE OF A ROW. A runner naming you that somebody
+  // else's line wrote is a teammate trying to start an agent on your Mac with
+  // their words, so it does not count.
+  const runnerBy = item?.wrote?.runner?.by;
+  if (item?.runner === me && runnerBy && runnerBy !== me) return false;
+  // NOR DOES A TEAMMATE'S WORD START ONE. Lines pulled from teammates may not
+  // set these fields at all (whatATeammateMaySet below); this is the second
+  // wall, for a ledger that already holds such a line from before that rule.
+  // A field with no writer is from before anyone signed in, and is yours.
+  for (const field of STARTS_A_RUN) {
+    const by = item?.wrote?.[field]?.by;
+    if (by && by !== me) return false;
+  }
+  return runnerOf(item, product) === me;
+}
+const STARTS_A_RUN = ['body', 'answer', 'status', 'runAt'];
+
+// WHOSE INBOX A SHARED ROW IS IN: one person's at a time, whoever has to act.
+// A row given to a person is theirs until it is done; an agent's row is its
+// runner's. True leaves the row to the inbox's ordinary rules, which is what a
+// private row, or any row on a Mac nobody is signed in on, always gets.
+// WHO SPOKE LAST IN A CONVERSATION: the writer of its newest message.
+export function lastSpeaker(item) {
+  const a = item?.wrote?.answer;
+  const b = item?.wrote?.body;
+  const latest = a && (!b || (a.ts ?? 0) >= (b.ts ?? 0)) ? a : b;
+  return latest?.by ?? item?.createdBy ?? null;
+}
+
+/**
+ * WHAT IN A CONVERSATION IS WAITING ON YOU (w-920461cbe6). Asked the day
+ * threads shipped: in a busy chat, with three people answering your thread and
+ * others carrying on in the chat, what reaches your inbox? Not a row per
+ * message, and not a thread you are not in; and a thread waiting on you must
+ * not be lost because you said something in the chat.
+ *
+ * So: `chat` is how many messages in the main chat came after your own newest
+ * one there, and `threads` is every thread you are IN (you wrote the message it
+ * hangs off, or replied in it) where somebody else spoke after you, newest
+ * first, with how many replies are new, who wrote them, what the thread is
+ * about and its newest words. Null for a row with no record of who spoke where
+ * (one from before threads), which then reads by `lastSpeaker` as it always did.
+ */
+export function whatWaits(item, me) {
+  const talk = item?.talk;
+  if (!talk || !me) return null;
+  const since = (list) => { let n = 0; for (let k = list.length - 1; k >= 0 && list[k].by !== me; k -= 1) n += 1; return n; };
+  const threads = [];
+  for (const [uid, t] of Object.entries(talk.threads ?? {})) {
+    const replies = t.replies ?? [];
+    if (t.by !== me && !replies.some((r) => r.by === me)) continue;
+    const fresh = since(replies);
+    if (!fresh) continue;
+    const news = replies.slice(-fresh);
+    threads.push({
+      uid, mine: t.by === me, fresh,
+      people: [...new Set(news.map((r) => r.by))],
+      text: t.text, last: news[news.length - 1].text, lastBy: news[news.length - 1].by,
+      at: news[news.length - 1].ts,
+    });
+  }
+  threads.sort((a, b) => b.at - a.at);
+  return { chat: since(talk.chat ?? []), threads: threads.map(({ at, ...t }) => t) };
+}
+
+export function inMyInbox(item, product, me) {
+  if (!isShared(product) || !me) return true;
+  // A CONVERSATION NEEDS WHOEVER DID NOT SPEAK LAST (2026-10-01), so a message
+  // to three people is in all three inboxes until one of them answers, and the
+  // answer puts it back in everyone else's. One person to one works the same.
+  // WITH THREADS (w-920461cbe6) the same rule is read per place: the chat, and
+  // each thread you are in. One row, whichever of them is waiting.
+  if (product?.team?.direct) {
+    if (item.status === 'done') return false;
+    const waits = whatWaits(item, me);
+    if (waits) return waits.chat > 0 || waits.threads.length > 0;
+    const by = lastSpeaker(item);
+    return by ? by !== me : item.assignee === me;
+  }
+  if (heldByAPerson(item)) return item.assignee === me && item.status !== 'done';
+  return runnerOf(item, product) === me;
+}
+
+// A CONVERSATION WHERE YOU SPOKE LAST IS DONE FOR YOU (w-57a202a968), until
+// the other person writes again and `inMyInbox` brings it back. Without it a
+// message you answered was on no tab and no column: out of your inbox by the
+// rule above, never In progress, and not Done because its status is not done.
+// Her words: "It's not supposed to leave the board; it's supposed to go in Done."
+export function iSpokeLast(item, product, me) {
+  if (!me || !product?.team?.direct || item?.status === 'done') return false;
+  // Done for you means nothing in it waits on you: the chat or any thread.
+  const waits = whatWaits(item, me);
+  if (waits) return waits.chat === 0 && waits.threads.length === 0;
+  return lastSpeaker(item) === me;
+}
+
+// A REPLY HANDS A PERSON-TO-PERSON ROW TO THE OTHER PERSON, so a conversation
+// goes back and forth between two inboxes instead of sitting in both. Returns
+// who it goes to, or null when a reply changes nothing about whose it is.
+export function handedOnByReply(item, product, me) {
+  if (!isShared(product) || !me || !heldByAPerson(item) || item.assignee !== me) return null;
+  const people = Array.isArray(item.people) ? item.people : [];
+  return people.find((p) => p !== me) || (item.createdBy && item.createdBy !== me ? item.createdBy : null);
+}
+
+// WHAT A TEAMMATE'S LINE MAY SET ON THIS MAC. Found by review 2026-10-01: a
+// teammate's line with source "founder" could set the body, the answer, the
+// status, the schedule or the model of any row in a shared project, including
+// a row whose runner is you, and the supervisor then started an agent here on
+// their words. So a pulled line keeps only the summary (which the board shows
+// anyway), who has to act next, and, in a message between two people (which
+// never runs an agent), the message itself. Everything else is dropped before
+// it reaches the disk, claims and epochs included. Returns null when nothing
+// is left.
+const A_TEAMMATE_MAY_SET = ['problem', 'progress', 'solution', 'blockedBy', 'blocks', 'assignee'];
+// The status rides too: a new message reopens a conversation put away, and a
+// message record never starts an agent (mayRunHere).
+//
+// AND A REACTION, which is the chips under a message (w-560647d4db). It is on
+// this list rather than the one above because it is only ever drawn in a
+// conversation, and because an unrecognised delta on an ordinary shared task
+// would be a teammate writing a field nothing there reads. It cannot start an
+// agent: `STARTS_A_RUN` above names the four fields that can, and a reaction
+// touches none of them, so a chip never puts the row in anybody's inbox.
+//
+// AND WHICH MESSAGE A REPLY ANSWERS (w-920461cbe6), for the same two reasons:
+// only a conversation draws a thread, and the mark rides beside an `answer`
+// this list already lets through. Without it a teammate's thread reply would
+// land in the middle of your chat instead of in the thread.
+const IN_A_MESSAGE_ALSO = ['title', 'body', 'answer', 'people', 'status', 'react', 'inReplyTo'];
+// AND THE LEVEL THE SENDER PICKED, ON THE OPENING LINE ALONE (w-7ba439c883).
+// A message now carries how urgent its sender thought it was, and that number
+// decides where it sits in the inbox it lands in, so it has to survive the
+// pull. It may not become a way to re-rank a row afterwards, though: the level
+// rides the line that MAKES the row and no other.
+//
+// `kind` is how that line is known. Only a row's first line sets it, and a
+// teammate may not set it here at all, so it is a marker rather than a field:
+// it is read, then dropped with everything else that is not allowed.
+//
+// WHAT THIS DOES NOT STOP, said plainly: a teammate who forges a line carrying
+// a kind can still re-rank the one conversation the two of you share. They can
+// already rewrite that row's title, body, answer and status (above), so this
+// opens no row that was closed to them, and nothing outside a conversation is
+// reachable either way.
+const WHEN_A_MESSAGE_OPENS = ['priority'];
+const opensARow = (patch) => 'kind' in patch;
+export function whatATeammateMaySet(line, { direct = false } = {}) {
+  if (!line || typeof line !== 'object' || !line.patch || typeof line.patch !== 'object') return null;
+  const allowed = direct
+    ? [...A_TEAMMATE_MAY_SET, ...IN_A_MESSAGE_ALSO, ...(opensARow(line.patch) ? WHEN_A_MESSAGE_OPENS : [])]
+    : A_TEAMMATE_MAY_SET;
+  const kept = {};
+  for (const field of allowed) if (field in line.patch) kept[field] = line.patch[field];
+  const patch = pickFields(kept);
+  if (!patch) return null;
+  return { id: line.id, ts: line.ts, source: line.source, by: line.by, uid: line.uid, patch };
+}
+
+// A LEASE BELONGS TO THE MAC THAT TOOK IT. A claim, an epoch, a release or a
+// heartbeat is a worker's hold on one Mac, so it never rides a line across to
+// another one — not even to a second copy of the app that is also yours.
+export function withoutALease(line) {
+  const out = { ...line };
+  delete out.claim; delete out.epoch; delete out.release; delete out.heartbeat;
+  return out;
+}
+
+// A LINE AS IT COMES BACK FROM THE CLOUD, the same on both backends. Who wrote
+// it and when are the database's (by_person, created_at), never the copy in
+// the body, and a teammate's line carries no lease (above).
+export function asPulled(body, { by, at, me }) {
+  const line = { ...body, by };
+  if (by === me) return line;
+  const kept = withoutALease(line);
+  if (Number.isFinite(at)) kept.ts = at;
+  return kept;
+}
+
+// YOUR OWN LINE, COMING BACK FROM A SECOND COPY OF THE APP SIGNED IN AS YOU.
+//
+// Reported 2026-10-04 (w-2fce569057): a message sent to a teammate never came
+// back. It had been sent from a second copy. It reached the cloud and it
+// reached the teammate's app; what it never reached was the everyday copy,
+// because the pull skipped every line whose writer was you, on the reasoning
+// that a line you wrote is already here. True of the copy that wrote it, false
+// of every other copy you own, and a conversation missing your own half reads
+// as a message that never sent.
+//
+// ONLY IN A MESSAGE RECORD, where no agent ever runs (mayRunHere). On an
+// ordinary shared row your own answer, body or status is exactly what starts
+// one, and `mayRunHere` believes a line whose writer is you, because it is you:
+// carrying those across would start a second agent on the same row on your
+// other Mac. So nothing crosses there, and your own words stay where you typed
+// them. Returns null when the line is not yours to bring back.
+export function whatYourOtherCopyMaySet(line, { direct = false } = {}) {
+  if (!direct || !line || typeof line !== 'object') return null;
+  return withoutALease(line);
+}

package/shared/team-status.d.mts

@@ -0,0 +1,11 @@
+export interface PersonStatus { text: string; until: number | null }
+export type HoldId = 'today' | 'tomorrow' | 'week' | 'open';
+
+export const STATUS_MAX: number;
+export const HOLDS: { id: HoldId; label: string }[];
+
+export function cleanStatus(text: unknown): string | null;
+export function liveStatus(status: PersonStatus | null | undefined, now?: number): PersonStatus | null;
+export function hasLapsed(status: PersonStatus | null | undefined, now?: number): boolean;
+export function holdsUntil(until: number | null | undefined, now?: number): string;
+export function holdEnds(id: HoldId | string, now?: number): number | null;