agentbox-app 0.1.7 → 0.1.12

package/main/team/memory-cloud.mjs

@@ -0,0 +1,247 @@
+// THE SHARED CLOUD, IN MEMORY, WITH THE SAME RULES AS THE REAL ONE.
+//
+// The team version talks to Supabase through one small set of calls (see
+// supabase-backend.mjs). This is the same set of calls over plain objects, so
+// the sync engine and the app can be tested without a network, and so two
+// stores in one test can be two teammates. Every rule the database's row level
+// security enforces is enforced here too, and tests/team-cloud-backends-agree
+// runs one scenario against both to keep them honest.
+import { EventEmitter } from 'node:events';
+import crypto from 'node:crypto';
+import { asPulled } from '../../shared/team-rules.mjs';
+import { cleanStatus } from '../../shared/team-status.mjs';
+
+export function createMemoryCloud() {
+  return {
+    people: new Map(), // id -> { id, email, name, avatarUrl }
+    teams: new Map(), // id -> { id, name, createdBy }
+    members: [], // { teamId, personId, role }
+    invites: [], // { teamId, email }
+    projects: new Map(), // id -> { id, teamId, name, visibility, createdBy }
+    projectPeople: [], // { projectId, personId }
+    lines: [], // { seq, projectId, uid, byPerson, body, createdAt }
+    cards: new Map(), // `${personId}:${threadId}` -> a thread card, as shared/thread-cards.mjs makes them
+    seq: 0,
+    teamsMade: 0, // the order teams were made in, which is their age
+    now: () => Date.now(), // the server's clock
+    events: new EventEmitter(),
+  };
+}
+
+// A sign-in, the way Supabase's trigger turns one into a person. Google
+// confirms the email; `confirmed: false` is somebody who never proved theirs.
+export function signUpMemory(cloud, { id = crypto.randomUUID(), email, name, avatarUrl = null, confirmed = true }) {
+  cloud.people.set(id, { id, email, name: name || String(email).split('@')[0], avatarUrl, status: null });
+  if (!confirmed) (cloud.unconfirmed ??= new Set()).add(id);
+  return id;
+}
+
+export function memoryBackend(cloud, personId) {
+  const myTeams = () => cloud.members.filter((m) => m.personId === personId).map((m) => m.teamId)
+    .sort((a, b) => (cloud.teams.get(a)?.made ?? 0) - (cloud.teams.get(b)?.made ?? 0));
+  // The email the sign-in confirmed, never one a person could have typed.
+  const confirmedEmail = () => {
+    const me = cloud.people.get(personId);
+    return me && !cloud.unconfirmed?.has(personId) ? String(me.email).toLowerCase() : null;
+  };
+  const owns = (teamId) => cloud.members.some((m) => m.teamId === teamId && m.personId === personId && m.role === 'owner');
+  const canSee = (projectId) => {
+    const p = cloud.projects.get(projectId);
+    if (!p || !myTeams().includes(p.teamId)) return false;
+    return p.visibility === 'team' || p.createdBy === personId
+      || cloud.projectPeople.some((pp) => pp.projectId === projectId && pp.personId === personId);
+  };
+  const projectOut = (p) => ({
+    id: p.id, teamId: p.teamId, name: p.name, visibility: p.visibility, createdBy: p.createdBy, direct: !!p.direct,
+    people: cloud.projectPeople.filter((pp) => pp.projectId === p.id).map((pp) => pp.personId),
+  });
+  const refuse = (what) => { throw new Error(`not allowed: ${what}`); };
+  const personOut = (p) => p && ({ id: p.id, email: p.email, name: p.name, avatarUrl: p.avatarUrl ?? null, status: p.status ?? null });
+
+  return {
+    kind: 'memory',
+    personId,
+
+    async me() {
+      const me = cloud.people.get(personId);
+      return me ? personOut(me) : null;
+    },
+
+    // A line you wrote about yourself. Only ever your own: the database's
+    // people_update_self says the same thing, and the personId argument is
+    // here so a test can try to write somebody else's and be refused.
+    async setStatus({ text, until = null, personId: who = personId } = {}) {
+      if (who !== personId) refuse('write somebody else\'s status');
+      const me = cloud.people.get(personId);
+      if (!me) refuse('set a status before signing in');
+      const clean = cleanStatus(text);
+      me.status = clean ? { text: clean, until: until ?? null } : null;
+      cloud.events.emit('people', {});
+      return me.status;
+    },
+
+    async pendingInvites() {
+      const email = confirmedEmail();
+      if (!email) return [];
+      return cloud.invites
+        .filter((inv) => inv.email.toLowerCase() === email && !myTeams().includes(inv.teamId))
+        .map((inv) => ({ teamId: inv.teamId, teamName: cloud.teams.get(inv.teamId)?.name ?? '', invitedBy: inv.invitedBy ?? null, invitedByName: cloud.people.get(inv.invitedBy)?.name ?? null }));
+    },
+
+    // One team, on a yes, and the invite is used up.
+    async acceptInvite(teamId) {
+      const email = confirmedEmail();
+      if (!email) refuse('join a team without a confirmed email');
+      const at = cloud.invites.findIndex((inv) => inv.teamId === teamId && inv.email.toLowerCase() === email);
+      if (at < 0) refuse('join a team that did not invite you');
+      cloud.invites.splice(at, 1);
+      if (!cloud.members.some((m) => m.teamId === teamId && m.personId === personId)) cloud.members.push({ teamId, personId, role: 'member' });
+      return teamId;
+    },
+
+    async myTeams() {
+      return myTeams().map((id) => cloud.teams.get(id)).filter(Boolean).map((t) => ({ id: t.id, name: t.name }));
+    },
+
+    async myTeam() {
+      return (await this.myTeams())[0] ?? null;
+    },
+
+    async createTeam(name) {
+      const id = crypto.randomUUID();
+      cloud.teamsMade += 1;
+      cloud.teams.set(id, { id, name, createdBy: personId, made: cloud.teamsMade });
+      cloud.members.push({ teamId: id, personId, role: 'owner' });
+      return { id, name };
+    },
+
+    async teamPeople(teamId) {
+      if (!myTeams().includes(teamId)) return [];
+      const rows = cloud.members.filter((m) => m.teamId === teamId);
+      return rows.map((m) => ({ ...personOut(cloud.people.get(m.personId)), role: m.role })).filter((p) => p.id);
+    },
+
+    // A line you wrote about yourself. Only ever your own: the database's
+    // people_update_self says the same thing, and the personId argument is
+    // here so a test can try to write somebody else's and be refused.
+    async setStatus({ text, until = null, personId: who = personId } = {}) {
+      if (who !== personId) refuse('write somebody else\'s status');
+      const me = cloud.people.get(personId);
+      if (!me) refuse('set a status before signing in');
+      const clean = cleanStatus(text);
+      me.status = clean ? { text: clean, until: until ?? null } : null;
+      cloud.events.emit('people', {});
+      return me.status;
+    },
+
+    // TEAM SETTINGS (2026-10-01), the same rules as 20261001000600_team_settings.sql.
+    async renameTeam(teamId, name) {
+      if (!owns(teamId)) refuse('rename a team you do not own');
+      const t = cloud.teams.get(teamId);
+      t.name = String(name).trim();
+      return { id: t.id, name: t.name };
+    },
+
+    async removeMember(teamId, who) {
+      if (who !== personId && !owns(teamId)) refuse('remove somebody from a team you do not own');
+      cloud.members = cloud.members.filter((m) => !(m.teamId === teamId && m.personId === who));
+    },
+
+    async listInvites(teamId) {
+      if (!myTeams().includes(teamId)) return [];
+      return cloud.invites.filter((i) => i.teamId === teamId).map((i) => ({ email: i.email, invitedBy: i.invitedBy ?? null }));
+    },
+
+    async cancelInvite(teamId, email) {
+      const clean = String(email).trim().toLowerCase();
+      const inv = cloud.invites.find((i) => i.teamId === teamId && i.email.toLowerCase() === clean);
+      if (!inv) return;
+      if (!owns(teamId) && inv.invitedBy !== personId) refuse('cancel an invite you did not send');
+      cloud.invites = cloud.invites.filter((i) => i !== inv);
+    },
+
+    async invite(teamId, email) {
+      if (!myTeams().includes(teamId)) refuse('invite to a team you are not on');
+      const clean = String(email).trim();
+      if (!cloud.invites.some((i) => i.teamId === teamId && i.email.toLowerCase() === clean.toLowerCase())) {
+        cloud.invites.push({ teamId, email: clean, invitedBy: personId });
+      }
+    },
+
+    async listProjects() {
+      return [...cloud.projects.values()].filter((p) => canSee(p.id)).map(projectOut);
+    },
+
+    async shareProject({ id, teamId, name, visibility = 'team', people = [], direct = false }) {
+      const existing = cloud.projects.get(id);
+      if (existing && existing.createdBy !== personId) refuse('change a project somebody else shared');
+      if (!myTeams().includes(teamId)) refuse('share into a team you are not on');
+      // A test can make the cloud refuse a share, to prove a failed start leaves nothing.
+      if (cloud.refuseShares) refuse(cloud.refuseShares);
+      // A message thread is its maker and up to eleven others, as the database
+      // insists (migration 20261001000700_group_messages.sql).
+      if (direct && (visibility !== 'people' || new Set(people.filter((p) => p !== personId)).size > 11)) refuse('put more than twelve people on a message thread');
+      cloud.projects.set(id, { id, teamId, name, visibility, createdBy: personId, direct: !!direct });
+      cloud.projectPeople = cloud.projectPeople.filter((pp) => pp.projectId !== id);
+      for (const person of new Set(people)) cloud.projectPeople.push({ projectId: id, personId: person });
+      return projectOut(cloud.projects.get(id));
+    },
+
+    async pushLines(projectId, lines) {
+      if (!canSee(projectId)) refuse('write to a project you cannot see');
+      let added = 0;
+      for (const line of lines) {
+        if (!line?.uid || line.by !== personId) refuse('write a line as somebody else');
+        if (cloud.lines.some((l) => l.uid === line.uid)) continue;
+        cloud.seq += 1;
+        cloud.lines.push({ seq: cloud.seq, projectId, uid: line.uid, byPerson: personId, body: structuredClone(line), createdAt: cloud.now() });
+        added += 1;
+      }
+      if (added) cloud.events.emit('lines', { projectId });
+      return added;
+    },
+
+    async pullLines(projectId, afterSeq = 0, limit = 500) {
+      if (!canSee(projectId)) return [];
+      return cloud.lines.filter((l) => l.projectId === projectId && l.seq > afterSeq)
+        .slice(0, limit).map((l) => ({ seq: l.seq, line: asPulled(structuredClone(l.body), { by: l.byPerson, at: l.createdAt, me: personId }) }));
+    },
+
+    async putCards(teamId, cards) {
+      if (!myTeams().includes(teamId)) throw new Error('not on that team');
+      for (const key of [...cloud.cards.keys()]) if (key.startsWith(`${personId}:`)) cloud.cards.delete(key);
+      // A private card never goes up at all, whatever the Mac handed over, as
+      // supabase-backend does; the database refuses words on one besides.
+      for (const c of cards) {
+        if (c.visible !== true) continue;
+        // NO LIST IS THE WHOLE TEAM, and an empty one is refused rather than
+        // stored, as the table's own check does: it would have to mean both
+        // everyone and nobody (20261001000800_chosen_people.sql).
+        const people = c.people == null ? null : [...new Set(c.people.filter((p) => typeof p === 'string' && p))];
+        if (people && !people.length) refuse('share a thread with nobody');
+        cloud.cards.set(`${personId}:${c.threadId}`, { ...structuredClone(c), people, personId, teamId });
+      }
+      cloud.events.emit('cards', {});
+    },
+
+    // A CARD REACHES WHOEVER IT NAMES, and everyone on the team when it names
+    // nobody (w-41ff964775). The hosted database says the same thing in its
+    // own row level security (20261001000800_chosen_people.sql), which is what
+    // actually stops a teammate's app asking for a card it was not sent.
+    async listCards() {
+      const teams = new Set(myTeams());
+      return [...cloud.cards.values()]
+        .filter((c) => teams.has(c.teamId))
+        .filter((c) => c.people == null || c.personId === personId || c.people.includes(personId))
+        .map(({ teamId, ...c }) => structuredClone(c));
+    },
+
+    subscribe(onChange) {
+      const fire = () => onChange();
+      cloud.events.on('lines', fire);
+      cloud.events.on('cards', fire);
+      cloud.events.on('people', fire);
+      return () => { cloud.events.off('lines', fire); cloud.events.off('cards', fire); cloud.events.off('people', fire); };
+    },
+  };
+}

package/main/team/projects.mjs

@@ -0,0 +1,162 @@
+// A PROJECT ON THIS MAC, SEEN AS SHARED OR PRIVATE.
+//
+// A shared project is an ordinary local project whose project.json carries a
+// `team` record: the project's id in the cloud, the team, and who can see it.
+// That id is the same on every teammate's Mac; the folder, its name on disk and
+// the code it points at are each person's own. A project without `team` is
+// private, and private projects never leave the Mac (only the title-free
+// activity below does).
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+
+const PROJECT_FILE = 'project.json';
+
+function readProject(dir) {
+  try { return JSON.parse(fs.readFileSync(path.join(dir, PROJECT_FILE), 'utf8')); } catch { return null; }
+}
+
+function writeProject(dir, project) {
+  const file = path.join(dir, PROJECT_FILE);
+  const tmp = `${file}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(project, null, 2));
+  fs.renameSync(tmp, file);
+}
+
+// The `team` record, cleaned, or null for a private project.
+export function teamOf(project) {
+  const t = project?.team;
+  if (!t || typeof t !== 'object' || typeof t.projectId !== 'string' || !t.projectId) return null;
+  return {
+    projectId: t.projectId,
+    teamId: typeof t.teamId === 'string' ? t.teamId : null,
+    visibility: t.visibility === 'people' ? 'people' : 'team',
+    people: Array.isArray(t.people) ? t.people.filter((p) => typeof p === 'string') : [],
+    // Who shared it. Runs the rows written before anyone signed in
+    // (shared/team-rules.mjs runnerOf).
+    sharedBy: typeof t.sharedBy === 'string' ? t.sharedBy : null,
+    // A MESSAGE THREAD between two people (approved 2026-10-01): a shared
+    // record the two of them only can see, kept out of every project list.
+    direct: t.direct === true,
+  };
+}
+
+export function readTeam(dir) {
+  return teamOf(readProject(dir));
+}
+
+// Every shared project on this Mac, as sync wants them.
+export function listSharedProjects(products) {
+  return products
+    .filter((p) => p.team?.projectId)
+    .map((p) => ({ projectId: p.team.projectId, dir: p.dir, name: p.name, slug: p.slug, direct: p.team.direct === true }));
+}
+
+// YOUR PERSONAL PROJECT (w-b989839656): one per person, made when they sign
+// in, where a thread with no visibility of its own is Only you
+// (shared/thread-cards.mjs visibilityOf). It says so about itself in
+// project.json rather than by its name, because "personal" is a name somebody
+// may already have given a project of their own, and that one must stay as it
+// is. Never shared, never remade once it exists, archived or not.
+export const PERSONAL_FLAG = 'personal';
+// CALLED MY WORKSPACE, in title case: the founder's pick on 2026-10-04. It is
+// a workspace of your own rather than a label for private things, and every
+// word of a project's name is capitalised.
+const PERSONAL_NAME = 'My Workspace';
+const PERSONAL_SLUG = 'my-workspace';
+// What it was called when it first shipped (9e2a626). One still carrying it
+// takes the new name; a name the person gave it is theirs.
+const FIRST_NAME = 'Personal';
+
+export function ensurePersonalProject(accountRoot) {
+  let entries = [];
+  try { entries = fs.readdirSync(accountRoot); } catch { entries = []; }
+  for (const slug of entries.sort()) {
+    const dir = path.join(accountRoot, slug);
+    const project = readProject(dir);
+    if (project?.[PERSONAL_FLAG] !== true) continue;
+    if (project.name === FIRST_NAME) writeProject(dir, { ...project, name: PERSONAL_NAME });
+    return { slug, made: false };
+  }
+  let slug = PERSONAL_SLUG;
+  for (let n = 2; fs.existsSync(path.join(accountRoot, slug)); n += 1) slug = `${PERSONAL_SLUG}-${n}`;
+  const dir = path.join(accountRoot, slug);
+  fs.mkdirSync(dir, { recursive: true });
+  writeProject(dir, {
+    schemaVersion: 1,
+    id: slug,
+    name: PERSONAL_NAME,
+    createdAt: new Date().toISOString(),
+    [PERSONAL_FLAG]: true,
+  });
+  return { slug, made: true };
+}
+
+// Mark a local project shared. Its cloud id is minted the first time and kept
+// for good, so sharing, unsharing to specific people and sharing again is one
+// project in the cloud, not three.
+export function markShared(dir, { teamId, visibility = 'team', people = [], sharedBy = null }) {
+  const project = readProject(dir);
+  if (!project) throw new Error(`no project.json in ${dir}`);
+  // Sharing it would put every line of it in the cloud, which is the one thing
+  // this project exists to make hard. A thread in it is shared one at a time.
+  if (project[PERSONAL_FLAG] === true) throw new Error(`${PERSONAL_NAME} stays on this computer. Share a thread in it instead.`);
+  const projectId = project.team?.projectId || crypto.randomUUID();
+  project.team = {
+    projectId, teamId, visibility: visibility === 'people' ? 'people' : 'team', people: [...new Set(people)],
+    sharedBy: project.team?.sharedBy || sharedBy,
+  };
+  writeProject(dir, project);
+  return teamOf(project);
+}
+
+// A project a teammate shared, made into a project here. Its folder is named
+// from the project's name, and a name already taken on this Mac gets -2, -3.
+export function joinSharedProject(accountRoot, cloudProject) {
+  const base = cloudProject.direct ? `direct-${String(cloudProject.id).slice(0, 8)}` : String(cloudProject.name || 'shared').toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '').slice(0, 40) || 'shared';
+  let slug = base;
+  for (let n = 2; fs.existsSync(path.join(accountRoot, slug)); n += 1) {
+    // The same project joined before (a folder that already carries its id) is
+    // not joined twice.
+    if (readTeam(path.join(accountRoot, slug))?.projectId === cloudProject.id) {
+      return { projectId: cloudProject.id, dir: path.join(accountRoot, slug), name: cloudProject.name, slug, direct: readTeam(path.join(accountRoot, slug))?.direct === true };
+    }
+    slug = `${base}-${n}`;
+  }
+  const dir = path.join(accountRoot, slug);
+  fs.mkdirSync(dir, { recursive: true });
+  writeProject(dir, {
+    schemaVersion: 1,
+    id: slug,
+    name: cloudProject.name,
+    createdAt: new Date().toISOString(),
+    team: {
+      projectId: cloudProject.id,
+      teamId: cloudProject.teamId ?? null,
+      visibility: cloudProject.visibility === 'people' ? 'people' : 'team',
+      people: cloudProject.people ?? [],
+      sharedBy: cloudProject.createdBy ?? null,
+      ...(cloudProject.direct ? { direct: true } : {}),
+    },
+  });
+  return { projectId: cloudProject.id, dir, name: cloudProject.name, slug, direct: cloudProject.direct === true };
+}
+
+// THE RECORD A MESSAGE BETWEEN TWO PEOPLE LIVES IN, made on the sender's Mac
+// the first time they write to that person. Its folder is named for nobody, so
+// it can never collide with a project, and both people are on it from the
+// start; the other Mac joins it like any shared record.
+export function makeDirect(accountRoot, { teamId, me, other, others = other ? [other] : [] }) {
+  const projectId = crypto.randomUUID();
+  const slug = `direct-${projectId.slice(0, 8)}`;
+  const dir = path.join(accountRoot, slug);
+  fs.mkdirSync(dir, { recursive: true });
+  writeProject(dir, {
+    schemaVersion: 1,
+    id: slug,
+    name: 'Direct',
+    createdAt: new Date().toISOString(),
+    team: { projectId, teamId, visibility: 'people', people: [me, ...others], sharedBy: me, direct: true },
+  });
+  return { projectId, dir, slug };
+}

package/main/team/session.mjs

@@ -0,0 +1,225 @@
+// THE SIGNED-IN SESSION, KEPT ON THIS MAC.
+//
+// A supabase-js client whose session lives in one file beside the store,
+// encrypted with the Mac's keychain-backed safeStorage when the app has it, so
+// a person stays signed in across restarts and nothing readable sits on disk.
+// Each store root has its own file, which is what lets two copies of the app
+// on one Mac be two different teammates.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { nameSlug } from '../../shared/product-name.mjs';
+import { runningAsAFreshUser } from '../../shared/fresh-user-home.mjs';
+import { supabaseBackend } from './supabase-backend.mjs';
+import { signInWithGoogle, cancelGoogleSignIn } from './sign-in.mjs';
+
+// A BUILD SOMEONE INSTALLED IGNORES THE TWO TEST SWITCHES BELOW. Found by
+// review 2026-10-01: AGENTBOX_TEAM_CONFIG and AGENTBOX_TEAM_TEST_LOGIN were
+// honoured in the packaged app, so anything that could set an environment
+// variable for it could point it at another server or sign it in as somebody
+// else. Electron sets defaultApp only when run from a checkout.
+export const isPackagedElectron = () => !!process.versions?.electron && !process.defaultApp;
+
+// THE TEAM KEY BELONGS TO THE MAC, NOT TO THE FOLDER THE APP RUNS FROM.
+//
+// Asked for 2026-10-04 (w-2fce569057): "we want to run the team version and i
+// need to see my team!" A key per folder is the wrong unit, and the cost of it
+// was a whole hour. Measured that day: the only Agentbox running was a copy out
+// of a task folder with no key, the app in the Dock had none either, and the one
+// folder on the machine that had a key was not running. So no window open could
+// show a teammate, and a message to one looked lost when it had arrived fine.
+//
+// A person has one team. Their Mac holds its key once, at
+// ~/.<app>/team.config.json, and whichever copy they open is the team version:
+// the checkout, a worktree, or the app in the Dock.
+//
+// IT IS READ OFF THE REAL HOME DIRECTORY AND NEVER OFF AGENTBOX_HOME. A review
+// on 2026-10-01 found an installed build honouring AGENTBOX_TEAM_CONFIG, so
+// anything that could set an environment variable could point the app at
+// another server. appHome() reads AGENTBOX_HOME, so using it here would reopen
+// that door; os.homedir() cannot be talked into lying.
+export function teamConfigOnThisMac(home = os.homedir()) {
+  return path.join(home, `.${nameSlug}`, 'team.config.json');
+}
+
+// The hosted project's address and public key. Row level security, not secrecy,
+// is what protects the data, but the file is kept out of the repository (it is
+// ignored), so a checkout with no key on its Mac runs as the single-person app;
+// cloud/team.config.example.json shows its shape.
+//
+// THE FOLDER'S OWN KEY WINS when it has one, so a worktree set up against
+// another team is never quietly moved onto this Mac's. AGENTBOX_TEAM_CONFIG
+// points at another file from a checkout only, and is first because that is
+// what the tests run on.
+//
+// AN INSTALLED BUILD IS ALWAYS THE SINGLE-PERSON APP (2026-10-06). The first
+// download from agentbox.ac opened on the team's sign-in page, because the Mac
+// it ran on kept a team key. The founder: "users are no longer using the
+// multiplayer version so this should never be visible." The team version still
+// runs from a checkout (npm run app). See
+// tests/the-installed-app-is-the-single-person-app.test.mjs.
+// AND SO IS ⌘K's NEW-USER WINDOW (w-9f6975906c, 2026-10-05). It runs from her
+// checkout, which holds a team key, so it opened on the same sign-in page:
+// "when i run this command i got the login screen again ... this was the
+// critical thing to fix". A new user is a new user of the single-person app.
+export function loadCloudConfig(appDir, { packaged = isPackagedElectron(), home = os.homedir(), env = process.env } = {}) {
+  if (packaged || runningAsAFreshUser(env)) return null;
+  const tries = [
+    !packaged && process.env.AGENTBOX_TEAM_CONFIG,
+    path.join(appDir, 'cloud', 'team.config.json'),
+    teamConfigOnThisMac(home),
+  ];
+  for (const file of tries) {
+    if (!file) continue;
+    try {
+      const c = JSON.parse(fs.readFileSync(file, 'utf8'));
+      if (typeof c.url === 'string' && typeof c.anonKey === 'string') return c;
+    } catch { /* try the next place; none of them is the single-person app */ }
+  }
+  return null;
+}
+
+function fileStorage(file, { encrypt, decrypt }) {
+  const read = () => {
+    try {
+      const raw = fs.readFileSync(file);
+      const text = decrypt ? decrypt(raw) : raw.toString('utf8');
+      return JSON.parse(text);
+    } catch { return {}; }
+  };
+  const write = (data) => {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const text = JSON.stringify(data);
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, encrypt ? encrypt(text) : text, { mode: 0o600 });
+    fs.renameSync(tmp, file);
+  };
+  return {
+    getItem: (key) => read()[key] ?? null,
+    setItem: (key, value) => { const d = read(); d[key] = value; write(d); },
+    removeItem: (key) => { const d = read(); delete d[key]; write(d); },
+  };
+}
+
+export function supabaseSession({ cloudConfig, sessionFile, encrypt = null, decrypt = null, openExternal, packaged = isPackagedElectron(), testLogin = process.env.AGENTBOX_TEAM_TEST_LOGIN }) {
+  const configured = !!cloudConfig;
+  if (packaged) testLogin = null;
+  let client = null;
+
+  async function getClient() {
+    if (client) return client;
+    const { createClient } = await import('@supabase/supabase-js');
+    client = createClient(cloudConfig.url, cloudConfig.anonKey, {
+      auth: {
+        flowType: 'pkce',
+        storage: fileStorage(sessionFile, { encrypt, decrypt }),
+        persistSession: true,
+        autoRefreshToken: true,
+        detectSessionInUrl: false,
+      },
+    });
+    return client;
+  }
+
+  return {
+    configured,
+
+    async restore() {
+      if (!configured) return null;
+      const c = await getClient();
+      const { data } = await c.auth.getSession();
+      if (data?.session) return supabaseBackend(c);
+      // A test harness signs a throwaway person in with a password, since a
+      // test cannot click through Google. Never set in the app itself.
+      if (testLogin) {
+        const at = testLogin.indexOf(':');
+        const { error } = await c.auth.signInWithPassword({ email: testLogin.slice(0, at), password: testLogin.slice(at + 1) });
+        if (error) throw new Error(`test sign-in: ${error.message}`);
+        return supabaseBackend(c);
+      }
+      return null;
+    },
+
+    async signIn({ onUrl, log } = {}) {
+      if (!configured) throw new Error('this build has no team cloud configured');
+      const c = await getClient();
+      await signInWithGoogle({ client: c, openExternal, onUrl, log, returnUrl: cloudConfig.signInReturn || 'http://127.0.0.1:54783/auth/callback' });
+      return supabaseBackend(c);
+    },
+
+    // EMAIL AND PASSWORD, beside Google (2026-10-01: the team version needs
+    // a real sign-in page). Google stays the first way in; this is the one that works
+    // before a team has set Google up, and for anyone who would rather not.
+    async signInWithPassword(email, password) {
+      if (!configured) throw new Error('this build has no team cloud configured');
+      const c = await getClient();
+      const { error } = await c.auth.signInWithPassword({ email: String(email ?? '').trim(), password: String(password ?? '') });
+      if (error) throw new Error(plainAuthError(error.message));
+      return supabaseBackend(c);
+    },
+
+    // A new account. With email confirmation on (the hosted project's setting)
+    // there is no session until the link in the email is followed, so this
+    // answers { confirm: true } and the page says to check the inbox.
+    async signUp({ email, password, name }) {
+      if (!configured) throw new Error('this build has no team cloud configured');
+      const c = await getClient();
+      const { data, error } = await c.auth.signUp({
+        email: String(email ?? '').trim(),
+        password: String(password ?? ''),
+        options: { data: { full_name: String(name ?? '').trim() || undefined } },
+      });
+      if (error) throw new Error(plainAuthError(error.message));
+      return data?.session ? { backend: supabaseBackend(c) } : { confirm: true };
+    },
+
+    cancelSignIn: () => cancelGoogleSignIn(),
+    // Only ever the link this sign-in made; the window never names one.
+    reopen: (url) => openExternal(url),
+
+    async signOut() {
+      if (client) await client.auth.signOut().catch(() => {});
+    },
+  };
+}
+
+// The cloud's words, said the way the page says everything else.
+export function plainAuthError(message) {
+  const m = String(message ?? '');
+  if (/invalid login credentials/i.test(m)) return 'That email and password do not match an account.';
+  if (/email not confirmed/i.test(m)) return 'Confirm your email first: follow the link we sent, then sign in.';
+  if (/already registered|already been registered/i.test(m)) return 'There is already an account with that email. Sign in instead.';
+  if (/password should be at least/i.test(m)) return 'Use a password of at least 6 characters.';
+  if (/rate limit/i.test(m)) return 'Too many tries just now. Wait a minute and try again.';
+  return m || 'That did not work. Try again.';
+}
+
+// WHERE THE HEADLESS APP KEEPS ITS SIGN-IN: in its own data folder, readable by
+// this user only, never in the store root. The store is the folder people
+// copy, sync and hand to agents, and this file holds a refresh token in plain
+// JSON (review, 2026-10-01). One left in the store by an older copy is moved.
+export function headlessSessionFile({ userDir, storeRoot }) {
+  const file = path.join(userDir, 'team-session.json');
+  const old = path.join(storeRoot, '.team-session');
+  try {
+    if (!fs.existsSync(file) && fs.existsSync(old)) {
+      fs.mkdirSync(userDir, { recursive: true });
+      fs.renameSync(old, file);
+    }
+    if (fs.existsSync(file)) fs.chmodSync(file, 0o600);
+  } catch { /* a session that cannot be moved is a sign-in to do again */ }
+  return file;
+}
+
+// The same session shape over the in-memory cloud, for tests.
+export function memorySession(backendFor) {
+  let signedIn = null;
+  return {
+    configured: true,
+    async restore() { return signedIn; },
+    async signIn() { signedIn = backendFor(); return signedIn; },
+    async signInWithPassword() { signedIn = backendFor(); return signedIn; },
+    async signUp() { return { confirm: true }; },
+    async signOut() { signedIn = null; },
+  };
+}