agentbox-app 0.1.7 → 0.1.12

package/main/team/sign-in.mjs

@@ -0,0 +1,106 @@
+// SIGNING IN WITH GOOGLE FROM A DESKTOP APP.
+//
+// Supabase does the Google part. The app opens the sign-in page in the
+// person's own browser and listens on 127.0.0.1 for the browser to come back
+// with a one-time code, which it trades for a session (PKCE, so the code is
+// useless to anyone who did not start this sign-in). The listener exists only
+// while a sign-in is in flight and answers nothing but that one path.
+//
+// The return address must be in the project's allowed list
+// (cloud/supabase/config.toml, additional_redirect_urls).
+import http from 'node:http';
+import { Name } from '../../shared/product-name.mjs';
+
+// Whatever came back in the address is the browser's to show as text, never
+// as markup: error_description is anybody's to write (review, 2026-10-01).
+const escape = (text) => String(text).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
+export const PAGE = (title, line) => `<!doctype html><meta charset="utf-8"><title>${title}</title>
+<body style="margin:0;height:100vh;display:grid;place-items:center;background:#1a1817;color:#efebe7;font:16px -apple-system,system-ui,sans-serif">
+<div style="text-align:center"><div style="font-size:22px;margin-bottom:8px">${escape(title)}</div><div style="color:#a09994">${escape(line)}</div></div>`;
+
+// ONE ATTEMPT AT A TIME, AND ANY ATTEMPT CAN BE LET GO (2026-10-04). The first
+// teammate to install this clicked Continue with Google and saw nothing: the
+// page had opened somewhere she could not see, the button then sat disabled
+// for the five minutes the listener waits, and a reload and a second click
+// failed on "address already in use", because the first attempt still held
+// the return address. A new attempt now replaces the one before it, and a
+// cancel frees the address at once.
+let inFlight = null;
+
+const cancelled = () => Object.assign(new Error('Sign-in was cancelled.'), { cancelled: true });
+
+/** Stop the Google sign-in that is waiting, if there is one. True if one was. */
+export function cancelGoogleSignIn() {
+  if (!inFlight) return false;
+  inFlight.cancel();
+  return true;
+}
+
+export async function signInWithGoogle({ client, openExternal, returnUrl, timeoutMs = 5 * 60 * 1000, onUrl = () => {}, log = () => {} }) {
+  const url = new URL(returnUrl);
+  const port = Number(url.port);
+  if (url.hostname !== '127.0.0.1' || !port) throw new Error(`the sign-in return address must be on 127.0.0.1 with a port, not ${returnUrl}`);
+
+  if (inFlight) { log('team: Google sign-in: a new attempt replaces the one still waiting'); await inFlight.cancel(); }
+
+  let finish;
+  const done = new Promise((resolve, reject) => { finish = { resolve, reject }; });
+  done.catch(() => {}); // a cancel can land before anything awaits it
+  const server = http.createServer(async (req, res) => {
+    const here = new URL(req.url, returnUrl);
+    if (here.pathname !== url.pathname) { res.writeHead(404); res.end(); return; }
+    const code = here.searchParams.get('code');
+    const problem = here.searchParams.get('error_description') || here.searchParams.get('error');
+    log(`team: Google sign-in: the browser came back ${code ? 'with a code' : `without one (${problem || 'no reason given'})`}`);
+    if (!code) {
+      res.writeHead(400, { 'content-type': 'text/html; charset=utf-8' });
+      res.end(PAGE('Sign-in did not finish', problem || `Go back to ${Name} and try again.`));
+      finish.reject(new Error(problem || 'sign-in came back without a code'));
+      return;
+    }
+    const { error: refused } = await client.auth.exchangeCodeForSession(code);
+    // "invalid flow state" is what an old tab, or one from a cancelled try, gets.
+    const error = refused && /flow state/i.test(refused.message ?? '')
+      ? new Error(`That sign-in page was from an earlier try. Go back to ${Name} and click Continue with Google again.`)
+      : refused;
+    res.writeHead(error ? 400 : 200, { 'content-type': 'text/html; charset=utf-8' });
+    res.end(error ? PAGE('Sign-in did not finish', error.message) : PAGE('You are signed in', `You can close this tab and go back to ${Name}.`));
+    if (error) finish.reject(error); else finish.resolve();
+  });
+
+  const closed = () => new Promise((resolve) => { server.close(() => resolve()); server.closeAllConnections?.(); });
+  const mine = { cancel: () => { finish.reject(cancelled()); return closed(); } };
+  inFlight = mine;
+  try {
+    await new Promise((resolve, reject) => {
+      server.once('error', reject);
+      server.listen(port, '127.0.0.1', resolve);
+    });
+  } catch (err) {
+    if (inFlight === mine) inFlight = null;
+    if (err?.code === 'EADDRINUSE') {
+      throw new Error(`Another copy of ${Name} is already waiting for a Google sign-in. Finish it there, or quit that copy and try again.`);
+    }
+    throw err;
+  }
+  const timer = setTimeout(() => finish.reject(new Error('Google sign-in timed out. Try again.')), timeoutMs);
+  try {
+    const { data, error } = await client.auth.signInWithOAuth({
+      provider: 'google',
+      options: { redirectTo: returnUrl, skipBrowserRedirect: true, queryParams: { prompt: 'select_account' } },
+    });
+    if (error) throw error;
+    log(`team: Google sign-in: opening the browser, waiting on ${returnUrl}`);
+    onUrl(data.url);
+    await Promise.race([openExternal(data.url), done]);
+    await done;
+    log('team: Google sign-in: done');
+  } catch (err) {
+    log(`team: Google sign-in: ${err?.cancelled ? 'cancelled' : `did not finish: ${err?.message ?? err}`}`);
+    throw err;
+  } finally {
+    clearTimeout(timer);
+    if (inFlight === mine) inFlight = null;
+    await closed();
+  }
+}

package/main/team/supabase-backend.mjs

@@ -0,0 +1,231 @@
+// THE SHARED CLOUD, ON SUPABASE. The same calls as memory-cloud.mjs, made
+// against the tables in cloud/supabase/migrations, through a supabase-js
+// client that is already signed in. Row level security on the server is what
+// actually keeps people apart; nothing here is trusted to.
+import { asPulled } from '../../shared/team-rules.mjs';
+import { cleanStatus } from '../../shared/team-status.mjs';
+
+const PAGE = 500;
+const PUSH_BATCH = 200;
+
+const PERSON_COLS = 'id,email,name,avatar_url,status_text,status_until';
+const personOut = (p) => p && ({
+  id: p.id, email: p.email, name: p.name, avatarUrl: p.avatar_url ?? null,
+  status: p.status_text ? { text: p.status_text, until: p.status_until ? Date.parse(p.status_until) : null } : null,
+});
+
+function must({ data, error }, what) {
+  if (error) throw new Error(`${what}: ${error.message}`);
+  return data;
+}
+
+export function supabaseBackend(client) {
+  let personId = null;
+  async function myId() {
+    if (personId) return personId;
+    const { data, error } = await client.auth.getUser();
+    if (error || !data?.user) throw new Error('not signed in');
+    personId = data.user.id;
+    return personId;
+  }
+
+  return {
+    kind: 'supabase',
+    get personId() { return personId; },
+
+    async me() {
+      const id = await myId();
+      const rows = must(await client.from('people').select(PERSON_COLS).eq('id', id).limit(1), 'reading you');
+      return personOut(rows[0]) ?? null;
+    },
+
+    // A line you wrote about yourself. The row filter is your own id and
+    // people_update_self says the same, so this can only ever be yours.
+    async setStatus({ text, until = null, personId: who = null } = {}) {
+      const me = await myId();
+      if (who && who !== me) throw new Error('refusing to write somebody else\'s status');
+      const clean = cleanStatus(text);
+      must(await client.from('people').update({
+        status_text: clean,
+        status_until: clean && until ? new Date(until).toISOString() : null,
+      }).eq('id', me), 'saving your status');
+      return clean ? { text: clean, until: clean && until ? until : null } : null;
+    },
+
+    // THE INVITES WAITING FOR YOU, to the email Google confirmed. Nothing is
+    // joined by reading them: joining is acceptInvite, one team, on a yes.
+    async pendingInvites() {
+      await myId();
+      const rows = must(await client.rpc('pending_invites'), 'reading your invites') ?? [];
+      return rows.map((r) => ({ teamId: r.team_id, teamName: r.team_name, invitedBy: r.invited_by ?? null, invitedByName: r.invited_by_name ?? null }));
+    },
+
+    async acceptInvite(teamId) {
+      await myId();
+      must(await client.rpc('accept_invite', { p_team: teamId }), 'joining the team');
+      return teamId;
+    },
+
+    // Every team you are on, oldest first. Which one this Mac is in is the
+    // Mac's own record (main/team/index.mjs), never this order alone.
+    async myTeams() {
+      const id = await myId();
+      const members = must(await client.from('team_members').select('team_id').eq('person_id', id), 'reading your team');
+      const ids = members.map((m) => m.team_id);
+      if (!ids.length) return [];
+      const rows = must(await client.from('teams').select('id,name').in('id', ids).order('created_at'), 'reading your team');
+      return rows.map((r) => ({ id: r.id, name: r.name }));
+    },
+
+    async myTeam() {
+      return (await this.myTeams())[0] ?? null;
+    },
+
+    async createTeam(name) {
+      const id = await myId();
+      const [team] = must(await client.from('teams').insert({ name, created_by: id }).select('id,name'), 'starting a team');
+      must(await client.from('team_members').insert({ team_id: team.id, person_id: id, role: 'owner' }), 'joining your new team');
+      return team;
+    },
+
+    async teamPeople(teamId) {
+      await myId();
+      const members = must(await client.from('team_members').select('person_id,role').eq('team_id', teamId), 'reading your team');
+      const ids = members.map((m) => m.person_id);
+      if (!ids.length) return [];
+      const roles = new Map(members.map((m) => [m.person_id, m.role]));
+      const people = must(await client.from('people').select(PERSON_COLS).in('id', ids), 'reading your teammates');
+      return people.map((p) => ({ ...personOut(p), role: roles.get(p.id) ?? 'member' }));
+    },
+
+    // TEAM SETTINGS (2026-10-01). The rules are the database's
+    // (20261001000600_team_settings.sql): the owner renames, removes and
+    // cancels; anyone leaves.
+    async renameTeam(teamId, name) {
+      await myId();
+      const rows = must(await client.from('teams').update({ name: String(name).trim() }).eq('id', teamId).select('id,name'), 'renaming the team');
+      if (!rows.length) throw new Error('only the team’s owner can rename it');
+      return rows[0];
+    },
+
+    async removeMember(teamId, who) {
+      await myId();
+      const rows = must(await client.from('team_members').delete().eq('team_id', teamId).eq('person_id', who).select('person_id'), 'removing them');
+      if (!rows.length) throw new Error('only the team’s owner can remove somebody');
+    },
+
+    async listInvites(teamId) {
+      await myId();
+      const rows = must(await client.from('team_invites').select('email,invited_by').eq('team_id', teamId), 'reading the invites');
+      return rows.map((r) => ({ email: r.email, invitedBy: r.invited_by ?? null }));
+    },
+
+    async cancelInvite(teamId, email) {
+      await myId();
+      must(await client.from('team_invites').delete().eq('team_id', teamId).eq('email', String(email).trim()), 'cancelling the invite');
+    },
+
+    async invite(teamId, email) {
+      const id = await myId();
+      const { error } = await client.from('team_invites').upsert(
+        { team_id: teamId, email: String(email).trim(), invited_by: id },
+        { onConflict: 'team_id,email', ignoreDuplicates: true },
+      );
+      if (error) throw new Error(`inviting ${email}: ${error.message}`);
+    },
+
+    async listProjects() {
+      await myId();
+      const projects = must(await client.from('projects').select('id,team_id,name,visibility,created_by,direct'), 'reading shared projects');
+      const ids = projects.map((p) => p.id);
+      const people = ids.length ? must(await client.from('project_people').select('project_id,person_id').in('project_id', ids), 'reading who is on them') : [];
+      return projects.map((p) => ({
+        id: p.id, teamId: p.team_id, name: p.name, visibility: p.visibility, createdBy: p.created_by, direct: !!p.direct,
+        people: people.filter((pp) => pp.project_id === p.id).map((pp) => pp.person_id),
+      }));
+    },
+
+    async shareProject({ id, teamId, name, visibility = 'team', people = [], direct = false }) {
+      const me = await myId();
+      must(await client.from('projects').upsert({ id, team_id: teamId, name, visibility, created_by: me, direct: !!direct }, { onConflict: 'id' }), 'sharing the project');
+      const current = must(await client.from('project_people').select('person_id').eq('project_id', id), 'reading who is on it');
+      const want = new Set(people);
+      const have = new Set(current.map((r) => r.person_id));
+      const gone = [...have].filter((p) => !want.has(p));
+      const added = [...want].filter((p) => !have.has(p));
+      if (gone.length) must(await client.from('project_people').delete().eq('project_id', id).in('person_id', gone), 'taking people off it');
+      if (added.length) must(await client.from('project_people').insert(added.map((p) => ({ project_id: id, person_id: p }))), 'adding people to it');
+      return { id, teamId, name, visibility, createdBy: me, people: [...want] };
+    },
+
+    async pushLines(projectId, lines) {
+      const me = await myId();
+      let added = 0;
+      for (let i = 0; i < lines.length; i += PUSH_BATCH) {
+        const batch = lines.slice(i, i + PUSH_BATCH).map((line) => {
+          if (!line?.uid || line.by !== me) throw new Error('refusing to push a line somebody else wrote');
+          return { project_id: projectId, uid: line.uid, by_person: me, body: line };
+        });
+        const rows = must(await client.from('lines').upsert(batch, { onConflict: 'uid', ignoreDuplicates: true }).select('uid'), 'sending your changes');
+        added += rows?.length ?? 0;
+      }
+      return added;
+    },
+
+    async pullLines(projectId, afterSeq = 0, limit = PAGE) {
+      const me = await myId();
+      const rows = must(await client.from('lines').select('seq,body,by_person,created_at').eq('project_id', projectId).gt('seq', afterSeq).order('seq').limit(limit), 'reading your team\'s changes');
+      // WHO WROTE A LINE IS THE COLUMN THE DATABASE CHECKED, never the copy
+      // inside the line: row level security makes by_person the signed-in
+      // writer, while the body is whatever their Mac sent. A teammate who
+      // wrote somebody else's id into a body would otherwise be believed. WHEN
+      // is the database's too, and their Mac's lease fields are dropped
+      // (shared/team-rules.mjs asPulled).
+      return rows.map((r) => ({ seq: Number(r.seq), line: asPulled(r.body, { by: r.by_person, at: Date.parse(r.created_at), me }) }));
+    },
+
+    // YOUR CARDS: one per thread worth showing the team (shared/thread-cards.mjs).
+    // Upserted whole, and any card of yours the Mac no longer lists is removed,
+    // so a thread made private or finished yesterday leaves the board. A card
+    // not marked visible never goes up at all, whatever the Mac handed over.
+    async putCards(teamId, all) {
+      const me = await myId();
+      const cards = all.filter((c) => c.visible === true);
+      if (cards.length) {
+        must(await client.from('thread_cards').upsert(cards.map((c) => ({
+          person_id: me, team_id: teamId, thread_id: c.threadId, visible: !!c.visible,
+          // WHO IT REACHES: the chosen people, or no list at all for the whole
+          // team (w-41ff964775). The read rule on the table does the enforcing.
+          people: c.people == null ? null : [...new Set(c.people.filter((p) => typeof p === 'string' && p))],
+          title: c.visible ? c.title : null, project: c.visible ? c.project : null, state: c.state,
+          priority: Number.isFinite(c.priority) ? c.priority : null,
+          problem: c.visible ? c.problem : null, progress: c.visible ? c.progress : null, solution: c.visible ? c.solution : null,
+          blocked_by: c.visible ? c.blockedBy ?? [] : [], blocks: c.visible ? c.blocks ?? [] : [],
+          updated_at: new Date(c.updatedAt).toISOString(),
+        })), { onConflict: 'person_id,thread_id' }), 'sharing your threads with the team');
+      }
+      let stale = client.from('thread_cards').delete().eq('person_id', me);
+      if (cards.length) stale = stale.not('thread_id', 'in', `(${cards.map((c) => `"${c.threadId}"`).join(',')})`);
+      must(await stale, 'clearing threads the team no longer needs to see');
+    },
+
+    async listCards() {
+      await myId();
+      const rows = must(await client.from('thread_cards').select('*'), 'reading your team\'s threads');
+      return rows.map((r) => ({
+        personId: r.person_id, threadId: r.thread_id, visible: r.visible, title: r.title, project: r.project, people: r.people ?? null,
+        state: r.state, priority: r.priority, problem: r.problem, progress: r.progress, solution: r.solution,
+        blockedBy: r.blocked_by ?? [], blocks: r.blocks ?? [], updatedAt: Date.parse(r.updated_at),
+      }));
+    },
+
+    subscribe(onChange) {
+      const channel = client.channel(`team-${Math.random().toString(36).slice(2)}`)
+        .on('postgres_changes', { event: 'INSERT', schema: 'public', table: 'lines' }, () => onChange())
+        .on('postgres_changes', { event: '*', schema: 'public', table: 'thread_cards' }, () => onChange())
+        .on('postgres_changes', { event: 'UPDATE', schema: 'public', table: 'people' }, () => onChange())
+        .subscribe();
+      return () => { client.removeChannel(channel); };
+    },
+  };
+}

package/main/team/sync.mjs

@@ -0,0 +1,163 @@
+// KEEPING A SHARED PROJECT THE SAME ON EVERY TEAMMATE'S MAC.
+//
+// One pass (`syncOnce`) does four things, in this order:
+//
+//   1. JOIN. A project somebody shared that this Mac does not have yet becomes
+//      a project of its own here, in a folder of its own.
+//   2. PUSH. Every ledger line this person wrote in a shared project since the
+//      last push goes to the cloud. A byte offset per project is the cursor,
+//      since the ledger only grows. A line written before anyone signed in
+//      (the project's history from when it was private) goes too, as this
+//      person's, with an id made from its own bytes so it can never go twice.
+//   3. PULL. Every line the cloud has that this Mac has not seen comes in
+//      through the store's one write path (`appendForeignLines`), at most
+//      once, holding only what a teammate may set here (shared/team-rules.mjs
+//      whatATeammateMaySet). A line this person wrote comes back too, in a
+//      conversation and nowhere else (whatYourOtherCopyMaySet), because a
+//      second copy of the app signed in as them is a Mac that has not seen it
+//      either; the uid is what makes pulling one back onto the copy that wrote
+//      it cost nothing.
+//   4. PRIVATE WORK. One title-free line per open task in a private project
+//      (who, what state, when it moved), and only when that set changed.
+//
+// Everything outside this file is passed in, so two "Macs" can run in one test
+// over an in-memory cloud. The app wires the real ones in main/team/index.mjs.
+import crypto from 'node:crypto';
+import { whatATeammateMaySet, whatYourOtherCopyMaySet } from '../../shared/team-rules.mjs';
+
+const PAGE = 500;
+// HOW MANY SHARED PROJECTS A MAC TAKES ON BY ITSELF. Anyone on the team can
+// share a project, and each one becomes a folder here; past this many, a pass
+// joins no more, so a teammate cannot fill this disk with folders.
+export const MAX_SHARED_PROJECTS = 50;
+
+// Where each shared project's cursors stand, kept between runs.
+export function memorySyncState() {
+  const map = new Map();
+  return {
+    get: (projectId) => ({ pushedTo: 0, pulledSeq: 0, ...(map.get(projectId) || {}) }),
+    set: (projectId, value) => { map.set(projectId, { ...value }); },
+    getCardsHash: () => map.get('__cards__')?.hash ?? null,
+    setCardsHash: (hash) => { map.set('__cards__', { hash }); },
+    getTeam: (personId) => map.get('__teams__')?.[personId] ?? null,
+    setTeam: (personId, teamId) => { map.set('__teams__', { ...(map.get('__teams__') || {}), [personId]: teamId }); },
+    getSince: (personId) => map.get('__since__')?.[personId] ?? null,
+    setSince: (personId, at) => { map.set('__since__', { ...(map.get('__since__') || {}), [personId]: at }); },
+  };
+}
+
+export function fileSyncState(file, fs) {
+  let data = {};
+  try { data = JSON.parse(fs.readFileSync(file, 'utf8')); } catch { data = {}; }
+  const save = () => {
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(data));
+    fs.renameSync(tmp, file);
+  };
+  return {
+    get: (projectId) => ({ pushedTo: 0, pulledSeq: 0, ...(data.projects?.[projectId] || {}) }),
+    set: (projectId, value) => { data.projects = { ...(data.projects || {}), [projectId]: { ...value } }; save(); },
+    getCardsHash: () => data.cardsHash ?? null,
+    setCardsHash: (hash) => { data.cardsHash = hash; save(); },
+    // WHICH TEAM THIS MAC IS IN, per person: once in one, it stays there
+    // until that person says otherwise (main/team/index.mjs).
+    getTeam: (personId) => data.teams?.[personId] ?? null,
+    setTeam: (personId, teamId) => { data.teams = { ...(data.teams || {}), [personId]: teamId }; save(); },
+    // WHEN THIS PERSON STARTED SHARING ON THIS MAC. Threads from before it stay
+    // theirs unless they share one (shared/thread-cards.mjs, `shownToTeam`).
+    getSince: (personId) => data.since?.[personId] ?? null,
+    setSince: (personId, at) => { data.since = { ...(data.since || {}), [personId]: at }; save(); },
+  };
+}
+
+// A line from before anyone signed in has no writer and no id. It is pushed as
+// the sharer's, with an id made from its bytes, so a second push is the same id.
+function adopt(line, me) {
+  if (line.by && line.uid) return line;
+  const uid = line.uid || `h-${crypto.createHash('sha256').update(JSON.stringify(line)).digest('hex').slice(0, 24)}`;
+  return { ...line, by: line.by || me, uid };
+}
+
+export function createTeamSync({ backend, disk, state, listShared, joinProject, listCards = () => [], teamIdOf = () => null }) {
+  let running = null;
+
+  async function pushProject(project, me) {
+    const cursor = state.get(project.projectId);
+    const { lines, end } = disk.readLinesFrom(project.dir, cursor.pushedTo);
+    const mine = lines.filter((l) => l && (!l.by || l.by === me)).map((l) => adopt(l, me));
+    let pushed = 0;
+    if (mine.length) pushed = await backend.pushLines(project.projectId, mine);
+    state.set(project.projectId, { ...state.get(project.projectId), pushedTo: end });
+    return pushed;
+  }
+
+  async function pullProject(project, me) {
+    let pulled = 0;
+    for (;;) {
+      const cursor = state.get(project.projectId);
+      const rows = await backend.pullLines(project.projectId, cursor.pulledSeq, PAGE);
+      if (!rows.length) break;
+      const direct = project.direct === true;
+      const bring = rows.map((r) => r.line).filter(Boolean)
+        // A line of your own comes back only in a conversation, and a line of a
+        // teammate's keeps only what they may set here (shared/team-rules.mjs).
+        .map((l) => (l.by === me ? whatYourOtherCopyMaySet(l, { direct }) : whatATeammateMaySet(l, { direct })))
+        .filter(Boolean);
+      pulled += disk.appendForeignLines(project.dir, bring);
+      // Lines pulled in move the file's end, but they were never ours to push,
+      // and a push cursor left behind them would only re-read and skip them.
+      const after = state.get(project.projectId);
+      state.set(project.projectId, { ...after, pulledSeq: rows[rows.length - 1].seq });
+      if (rows.length < PAGE) break;
+    }
+    return pulled;
+  }
+
+  // YOUR THREADS AS THE TEAM SEES THEM. Published only when they changed, so a
+  // quiet Mac costs the cloud nothing on each pass.
+  async function publishCards() {
+    const teamId = teamIdOf?.();
+    if (!teamId) return false;
+    const cards = (listCards() || []).slice().sort((a, b) => a.threadId.localeCompare(b.threadId));
+    const hash = crypto.createHash('sha256').update(teamId + JSON.stringify(cards)).digest('hex');
+    if (hash === state.getCardsHash()) return false;
+    await backend.putCards(teamId, cards);
+    state.setCardsHash(hash);
+    return true;
+  }
+
+  async function run() {
+    const me = backend.personId ?? (await backend.me())?.id;
+    if (!me) throw new Error('nobody is signed in');
+    const report = { joined: [], notJoined: 0, pushed: 0, pulled: 0, cards: false };
+
+    const cloudProjects = await backend.listProjects();
+    const local = new Map(listShared().map((p) => [p.projectId, p]));
+    for (const project of cloudProjects) {
+      if (local.has(project.id)) continue;
+      if (local.size >= MAX_SHARED_PROJECTS) { report.notJoined += 1; continue; }
+      const joined = await joinProject(project);
+      if (joined) { local.set(project.id, joined); report.joined.push(project.name); }
+    }
+
+    for (const project of cloudProjects) {
+      const here = local.get(project.id);
+      if (!here) continue;
+      report.pushed += await pushProject(here, me);
+      report.pulled += await pullProject(here, me);
+    }
+
+    report.cards = await publishCards();
+    return report;
+  }
+
+  return {
+    // One pass at a time: a second call while one runs waits for it and then
+    // runs again, so a change that lands mid-pass is never left behind.
+    async syncOnce() {
+      while (running) await running.catch(() => {});
+      running = run();
+      try { return await running; } finally { running = null; }
+    },
+  };
+}

package/main/updater.mjs

@@ -28,9 +28,10 @@
 //    the downloaded update is applied then, so the next launch is current. The
 //    button is the fast path, not the only path.
 //
-// WHERE THE UPDATE COMES FROM. `Astral-Agent/astral-releases`, the same public
-// repo astral.ac/download already redirects to, configured in package.json's
-// `build.publish`. electron-updater reads `releases/latest`, then
+// WHERE THE UPDATE COMES FROM. `agentboxhq/agentbox-releases`, the same public
+// repo agentbox.ac/download redirects to, configured in package.json's
+// `build.publish` (until 2026-10-05 it was Astral-Agent/astral-releases, which
+// is private, so no installed copy could ever read it). electron-updater reads `releases/latest`, then
 // `latest-mac.yml` on that release, and compares its `version` against this
 // build's. It downloads the `.zip`, NOT the `.dmg`: Squirrel. Mac swaps an .app
 // bundle and cannot read a disk image, which is why `build.mac.target` gained a
@@ -64,7 +65,8 @@ const EVERY_MS = 6 * 60 * 60 * 1000;
  * Electron app, a network, or a packaged build.
  */
 export function describe(state) {
-  const { phase, currentVersion, newVersion, percent, error, checkedAt, readyAt } = state;
+  const { phase, currentVersion, newVersion, percent, error, checkedAt, readyAt, source, changes, behind } = state;
+  const installing = phase === 'installing';
   return {
     phase,
     currentVersion,
@@ -79,10 +81,18 @@ export function describe(state) {
     // every other row's right end answers "how old is this". Built off the
     // clock instead it would read "now" forever, which is the app looking busy
     // about something that has been sitting on the disk since lunchtime.
-    readyAt: phase === 'ready' ? (readyAt ?? null) : null,
+    readyAt: phase === 'ready' || installing ? (readyAt ?? null) : null,
     // The one question every screen actually asks. A screen should not have to
     // learn which phase strings mean "there is a button to press".
     ready: phase === 'ready',
+    // A COPY RUN FROM SOURCE (main/source-updater.mjs) says three more things:
+    // that it is one, what changed (newest first, at most five titles, and how
+    // many there are in all), and that the button was pressed and it is
+    // rebuilding, which takes long enough that the row has to say so.
+    source: !!source,
+    changes: Array.isArray(changes) ? changes : [],
+    behind: typeof behind === 'number' ? behind : null,
+    installing,
   };
 }
 

package/main/write-before-reload.mjs

@@ -0,0 +1,50 @@
+// ⌘R WRITES WHAT THE PAGE IS HOLDING BEFORE IT RELOADS.
+//
+// A close, an approval, a picked option and a typed reply are all held in the
+// page for three seconds so Z can take them back (`deferCommit` in App.tsx),
+// and the only thing that ever writes one is a timer in that page. Reloading
+// straight away threw the timer and the action out together: she closed a
+// thread, pressed ⌘R, and it came back to her inbox as if she had never
+// touched it (w-47218417a5).
+//
+// So the reload asks first. The page writes what it holds (or answers at once
+// when it holds nothing) and says so, and only then does the window reload.
+// The wait is bounded: a page that never answers, because it crashed or is a
+// build from before this existed, still reloads, since ⌘R doing nothing is a
+// complaint this chord has had twice already.
+
+import { randomUUID } from 'node:crypto';
+
+export const WRITE_HELD = 'zero:write-held';
+export const WROTE_HELD = 'zero:wrote-held';
+
+// A store write is a local file append, so this is far more than one needs; it
+// only has to be short enough that a page that never answers is not mistaken
+// for ⌘R not arriving.
+const WAIT_MS = 2000;
+
+export async function writeHeldThenReload({ webContents, ipcMain, reload, timeoutMs = WAIT_MS }) {
+  if (!webContents || webContents.isDestroyed()) return;
+  // Each ask carries its own id, so an answer meant for another one (a page
+  // from before the last reload, a second press) is not taken for this one.
+  const nonce = randomUUID();
+  await new Promise((resolve) => {
+    const finish = () => {
+      clearTimeout(timer);
+      ipcMain.removeListener(WROTE_HELD, onWrote);
+      resolve();
+    };
+    const onWrote = (event, answered) => {
+      if (answered === nonce && event?.sender === webContents) finish();
+    };
+    const timer = setTimeout(finish, timeoutMs);
+    ipcMain.on(WROTE_HELD, onWrote);
+    try {
+      webContents.send(WRITE_HELD, nonce);
+    } catch {
+      finish();
+    }
+  });
+  if (webContents.isDestroyed()) return;
+  reload();
+}

package/mcp/core/page.mjs

@@ -1,24 +1,22 @@
 // LOOKING AT A PAGE A WORKER JUST BUILT, AND ONLY AT A LOCAL ONE.
 //
 // Where this comes from (w-5ebf7bf7bb, MP-09). The terminal clients this app is
-// keeping parity with mostly ship a browser now. Hers, 2026-09-23: a worker
-// driving a browser of OURS is good and should happen; a worker driving the
-// browser she is signed into is not, and she never wants that ability to exist,
-// because that browser holds her logins, her cookies and everything else. That
-// half is a rule in CLAUDE.md with a test behind it.
+// keeping parity with mostly ship a browser now. A worker driving a browser of
+// OURS is good and should happen; a worker driving the browser the user is
+// signed into is not, and that ability must never exist, because that browser
+// holds the user's logins, cookies and everything else. That half is a rule in
+// CLAUDE.md with a test behind it.
 //
-// The browser she meant is gone. She had the whole rest screen and the browser
-// inside the app deleted the day before (w-030026f226, for the open source cut),
-// so there is no pane left to drive. This is the smallest honest thing that
+// The app has no browser pane of its own to drive. This is the smallest honest thing that
 // still delivers what a worker actually needs: start your app, look at it, show
-// her the picture. No window, no logins, nothing of hers.
+// the user the picture. No window, no logins, nothing of the user's.
 //
 // LOCAL ONLY, AND THE RULE IS THE POINT RATHER THAN A SETTING. A worker that can
 // fetch any address is a worker that can post anything it has read to any
 // address. Loopback cannot leave the machine, so the capability is bounded by
 // what it can reach rather than by whoever remembers to review a prompt. If
-// this is ever widened it is a permission design and hers to approve, which is
-// what she said in the same breath as approving the rest of it.
+// this is ever widened it is a permission design that needs the owner's
+// explicit approval.
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
@@ -89,7 +87,7 @@ export async function lookAtPage({ product, url, width = 1280, height = 900, cap
  * stored in the browser, and it is thrown away with the profile directory.
  */
 export async function captureWithChrome({ url, width, height, chrome = findChrome(), timeoutMs = 20_000 }) {
-  if (!chrome) return { error: 'No Chrome, Chromium or Edge on this Mac, so there is nothing to open the page with.' };
+  if (!chrome) return { error: 'No Chrome, Chromium or Edge on this computer, so there is nothing to open the page with.' };
   const profile = fs.mkdtempSync(path.join(process.env.TMPDIR ?? '/tmp', 'look-at-page-'));
   const child = spawn(chrome, [
     '--headless=new', '--remote-debugging-port=0', `--user-data-dir=${profile}`,