agentbox-app 0.1.7 → 0.1.12

package/main/agents.mjs

@@ -18,7 +18,7 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { NAME, Name, WAS } from '../shared/product-name.mjs';
 import {
-  WORK_CHARS, agentKey, changedFile, fullSubject, saidCount, sameInstant, threadWindow, workSubject, workVerb,
+  WORK_CHARS, agentKey, changedFile, commandWork, fullSubject, isBookkeeping, saidCount, sameInstant, threadWindow, workSubject, workVerb,
 } from '../shared/agents.mjs';
 
 const run = promisify(execFile);
@@ -64,7 +64,7 @@ function stillTheSame(rec, proc) {
 }
 
 /* ------------------------------- the sources ----------------------------- */
-// TWO SOURCES, UNIONED, because on 2026-08-16 neither one alone saw her
+// TWO SOURCES, UNIONED, because when measured neither one alone saw the whole
 // machine. `claude agents --json` (the public scripting flag) listed 3 sessions
 // while 16 were live with sockets bound; the per-session state files listed
 // those 16 and none of the 3. They disagree about which sessions they know, and
@@ -125,35 +125,29 @@ function scrubbed(env) {
 // Claude Code already writes three facts into the same transcript this function
 // is already reading, and they were simply being skipped:
 //
-//   ai-title    a one-line title the session wrote for ITSELF. Measured across
-// her 14 outside sessions 2026-08-17: 14 of 14 had one, inside the
-// 96KB tail. session-71's is "Agentbox product not displaying in
-// the app", which is the exact sentence she could not remember.
-// last-prompt the last thing SHE typed into that session. "okay no worries.
-// just make sure that auth persists across sessions…"
+//   ai-title    a one-line title the session wrote for ITSELF. Every session
+//               measured had one inside the 96KB tail, and it is usually the
+//               sentence a person would use to recall the session.
+//   last-prompt the last thing the user typed into that session.
 //   tool_use    the files it has been editing, reading and writing.
 //
 // So the reading is one pass over a tail that was already being read, and the
 // card goes from three lines about a pid to what the work actually is.
 //
-// WHAT WAS MISSING WAS THE BEGINNING. Measured over all 16 of her live sessions
-// on 2026-08-17, reading every human turn in 117MB of transcript:
-//
-// The conversation she needs to recall fits on a card. The agent's side is what
-// is megabytes.
+// WHAT WAS MISSING WAS THE BEGINNING. The human side of a conversation fits on
+// a card. The agent's side is what is megabytes.
 //
 // AND THE TAIL CANNOT SEE IT. The opening turn lands between 11KB and 614KB in
-// (her pasted images are single transcript lines of hundreds of KB), and 96KB
+// (pasted images are single transcript lines of hundreds of KB), and 96KB
 // off the end reaches none of it. Measured: a 1MB head plus a 512KB tail still
-// saw only 72 of her 155 turns — 46% — and one of the two it missed on
-// session-71 was the one she is complaining about.
+// saw only 46% of the human turns.
 //
 // So the whole file is read, ONCE, and then only what has been appended since.
-// Measured on her machine: the first pass over all 15 transcripts, 117MB, costs
-// 353ms in total and never happens again for that session; after it, a refresh
-// reads only the bytes that arrived. This is the same read the tail was already
-// doing, moved from "the last 96KB" to "everything, once" — no model sees any
-// of it, which was her condition.
+// Measured: the first pass over 15 transcripts, 117MB, costs 353ms in total
+// and never happens again for that session; after it, a refresh reads only the
+// bytes that arrived. This is the same read the tail was already doing, moved
+// from "the last 96KB" to "everything, once". No model sees any of it, by
+// design.
 const CHUNK_BYTES = 4 << 20;
 const historyCache = new Map(); // sessionId -> { file, size, mtimeMs, offset, ...facts }
 const dirCache = new Map();    // sessionId -> transcript path
@@ -186,11 +180,11 @@ function transcriptPath(sessionId, cwd) {
 const NOTHING = { lastActiveAt: 0, lastSaid: '', saidAt: 0, saidOpen: false, about: '', lastAsked: '', touched: [], asked: [] };
 
 // HOW MUCH OF THE LAST REPLY IS KEPT. The card quotes the end of it, so this is
-// a bound on the accumulator and not on what she reads. Her longest single
-// reply on this machine is under 6KB.
+// a bound on the accumulator and not on what the user reads. A human reply is
+// rarely anywhere near 6KB.
 const SAID_CHARS = 8000;
 
-// WHAT COUNTS AS SOMETHING SHE TYPED. A Claude Code transcript calls a great
+// WHAT COUNTS AS SOMETHING THE USER TYPED. A Claude Code transcript calls a great
 // many things a `user` message that no human wrote: every tool result comes
 // back as one, every system reminder is one, every slash command expands into
 // one. Reading those onto the card would fill her recall with the machine
@@ -198,7 +192,7 @@ const SAID_CHARS = 8000;
 //
 // So a turn is hers only when it is a `user` line that is not flagged meta, is
 // not a compaction summary, carries no tool result, and whose text does not
-// open with a tag. Checked against all 155 real turns in her 16 sessions.
+// open with a tag. Checked against 155 real human turns.
 //
 // THE CARD AND THE CONVERSATION READ THE SAME LINE DIFFERENTLY, which is why
 // this is two functions and not one. A card quotes a sentence, so it flattens
@@ -210,9 +204,12 @@ const RELAY_MARK = `Relayed from ${NAME},`;
 // WRITTEN UNDER THE CURRENT NAME, RECOGNISED UNDER EVERY NAME THIS APP HAS
 // HAD. A transcript is a file on her disk and it outlives a rename, so a
 // marker matched on the current name alone stops matching the day the name
-// changes, and the app's own preamble starts reading as something she typed.
-const RELAY_MARKERS = [RELAY_MARK, ...WAS.map((was) => `Relayed from ${was},`)];
-const wasRelayed = (line) => RELAY_MARKERS.some((m) => line.startsWith(m));
+// changes, and the app's own preamble starts reading as something the user typed.
+// The letter case is ignored as well: the name was written lowercase until
+// 2026-10-02, and those transcripts say "Relayed from agentbox,".
+const RELAY_MARKERS = [RELAY_MARK, ...WAS.map((was) => `Relayed from ${was},`)].map((m) => m.toLowerCase());
+const wasRelayed = (line) => RELAY_MARKERS.some((m) => line.toLowerCase().startsWith(m));
+export { wasRelayed as __wasRelayed };
 
 function herTurnRaw(obj) {
   if (obj.type !== 'user' || obj.isMeta || obj.isCompactSummary || obj.toolUseResult) return '';
@@ -225,10 +222,10 @@ function herTurnRaw(obj) {
   const clean = String(text).trim();
   const flat = clean.replace(/\s+/g, ' ');
   // AND NEVER AGENTBOX'S OWN PREAMBLE. `fromTheApp` puts a sentence of context in
-  // front of what she typed, and today Claude Code stamps the result `isMeta`
+  // front of what the user typed, and today Claude Code stamps the result `isMeta`
   // so this never sees it. If a future one records it as a plain user turn
-  // instead, the card would quote Agentbox talking to an agent back at her as her
-  // own words. `spoke` already holds what she actually typed.
+  // instead, the card would quote Agentbox talking to an agent back at the user
+  // as their own words. `spoke` already holds what the user actually typed.
   if (!flat || flat.startsWith('<') || flat.startsWith('[Request interrupted') || wasRelayed(flat)) return '';
   return clean;
 }
@@ -431,7 +428,7 @@ function fingerprint(agents) {
   // a tick and pushing on it re-renders her window for nothing. The first moves
   // only when the session's status moves, and since a row's LIST depends on it:
   // a session that went busy and back to idle between two readings shows the
-  // same `status` both times, and without this the row she replied to would sit
+  // same `status` both times, and without this the row the user replied to would sit
   // in In progress until some other push happened to come. AND WHEN IT LAST
   // SAID SOMETHING, which is the fact this list existed to notice and did
   // not.An agent that answers her while she is looking at its card moves
@@ -591,12 +588,12 @@ function defaultSocket(pid) {
 // Nothing here claims her authority.
 //
 // What it does say is the part the wrapper cannot: WHERE the message came from
-// and WHAT it is about. MEASURED on session-46, which is the session in her
-// screenshot. There was no response to see, and one sentence of context is the
-// whole of the difference.
+// and WHAT it is about. MEASURED on a session that had given no response
+// without it; one sentence of context is the whole of the difference.
 //
-// HER OWN TEXT IS UNCHANGED AND IS WHAT THE CARD QUOTES: `spoke` records what
-// she typed, never this, so nothing she never wrote is ever drawn as her words.
+// THE USER'S OWN TEXT IS UNCHANGED AND IS WHAT THE CARD QUOTES: `spoke` records
+// what the user typed, never this, so nothing the user never wrote is ever drawn
+// as their words.
 export function fromTheApp(message) {
   return [
     `${RELAY_MARK} the inbox your user reads. A person typed this, not an agent,`,
@@ -622,7 +619,7 @@ export async function reply(pid, text, { timeoutMs = 3000 } = {}) {
   const before = await watermark(agent);
   try {
     // What goes on the wire says who is asking; what is matched and recorded
-    // below stays HER words, so `heldNotice` cannot start matching every
+    // below stays the user's words, so `heldNotice` cannot start matching every
     // message by its shared opening and the card cannot quote a preamble.
     await writeToSocket(agent.socket, fromTheApp(message), tokenFor(pid));
   } catch (err) {
@@ -787,7 +784,7 @@ function heldNotice(agent, sinceSize, message) {
     const content = String(obj?.content ?? '');
     if (!HOLD_LINE.test(content)) continue;
     if (opening && !content.includes(opening.slice(0, 40))) continue;
-    // Said in her words, not the CLI's. What she can DO about it is the point:
+    // Said in plain words, not the CLI's. What the user can DO about it is the point:
     // the message is sitting in that session's own window waiting for a yes.
     return `${agent.name} held your message for approval in its own window, so it has not read it yet.`;
   }
@@ -846,8 +843,8 @@ export function reveal(pid) {
 // the one surface built to make her trust the app. readline hands the lines
 // back a chunk at a time and the app draws in between.
 //
-// NO MODEL SEES ANY OF IT, which was her condition on the whole feature, and
-// nothing is written anywhere: this opens a file she already has and reads it.
+// NO MODEL SEES ANY OF IT, which is a condition of the whole feature, and
+// nothing is written anywhere: this opens a file the user already has and reads it.
 
 // One turn is capped here rather than where it is drawn, so a pasted 600KB
 // blob never becomes 600KB of React. It is far more than anybody reads and far
@@ -894,7 +891,13 @@ function workedOn(obj, events, byId, dir = '') {
   const at = Date.parse(obj.timestamp ?? 0) || 0;
   for (const c of obj.message.content) {
     if (c.type !== 'tool_use') continue;
-    const subject = workSubject(c.input, dir, os.homedir());
+    // The store's own records are how a session talks to the app, not work it
+    // did, and a thread that opens on them reads as noise (w-0bd0d8b2ef).
+    if (isBookkeeping(c.name)) continue;
+    // WHAT A COMMAND DID, IN WORDS, when the whole of it is recognised; null on
+    // anything else, and the line is then the command it always was.
+    const plain = c.name === 'Bash' ? commandWork(c.input?.command, dir, os.homedir()) : null;
+    const subject = plain ? plain.subject : workSubject(c.input, dir, os.homedir());
     const whole = fullSubject(c.input);
     // THE FILE IT CHANGED, WHOLE, so the thread can offer it as a chip into the
     // code. Empty on everything that did not write a file, which is most calls:
@@ -903,10 +906,13 @@ function workedOn(obj, events, byId, dir = '') {
     const event = {
       kind: 'work',
       at,
-      verb: workVerb(c.name),
+      verb: plain ? plain.verb : workVerb(c.name),
       subject,
       ...(changed ? { file: changed } : {}),
-      full: whole && whole.replace(/\s+/g, ' ').trim() !== subject ? cappedHead(whole) : '',
+      // A line put in words always carries the command, even when the words name
+      // nothing ("Checked what changed"): the words replaced the only copy of it
+      // on the screen, so it has to stay one press behind them.
+      full: plain || (whole && whole.replace(/\s+/g, ' ').trim() !== subject) ? cappedHead(whole) : '',
       output: '',
       lines: 0,
       failed: false,
@@ -1057,11 +1063,11 @@ export async function conversation({ pid, sessionId, cwd, spoke = [], whole = fa
       const its = saidByIt(obj);
       if (its) addTurn(turns, 'it', its, at);
       // THE WORK GOES IN THE THREAD, IN THE ORDER IT HAPPENED, and it ends the
-      // message above it. Her shape says each thing it ran sits BETWEEN the
+      // message above it. The chosen shape says each thing it ran sits BETWEEN the
       // messages, so a reply that stopped twice for a tool is three things on
       // the screen in the order they occurred rather than one bubble with the
       // work swept behind it. This is the one place the fold is deliberately
-      // broken, and breaking it is the shape she picked.
+      // broken, and breaking it is the shape that was chosen.
       workedOn(obj, turns, byId, dir);
     }
   } catch {

package/main/analytics.mjs

@@ -204,3 +204,30 @@ export function createAnalytics({ config, version, dir, client, env = process.en
     async shutdown() { try { await posthog?.shutdown?.(); } catch {} },
   };
 }
+
+// "USED TODAY", ONCE PER CALENDAR DAY (2026-10-06). Retention is read from
+// whether an install was used on a day, and `app_opened` cannot say that: a Mac
+// app left open for a week sends it once. This is touched at launch and every
+// time the window comes forward, and sends only on the first touch of each
+// local day. Kept in memory: a relaunch on the same day may send it again,
+// which PostHog's per-install, per-day counting absorbs.
+export function createDailyCount(track) {
+  let last = null;
+  return (now) => {
+    const d = new Date(now);
+    const day = `${d.getFullYear()}-${d.getMonth()}-${d.getDate()}`;
+    if (day === last) return;
+    last = day;
+    track('day_active');
+  };
+}
+
+// WHAT AN AGENT'S RUN REPORTS WHEN IT ENDS: how long, whether it failed, and
+// which engine. Nothing about the task it was on.
+export function runEndedProps(session, now) {
+  return {
+    seconds: Math.round((now - (session.startedAt ?? now)) / 1000),
+    failed: !!session.exitFailed,
+    engine: session.engine,
+  };
+}

package/main/approval-prompt-server.mjs

@@ -26,7 +26,7 @@ import { answerIsHers, appendSpoolLine, cardDigest, readSpoolJson, removeSpoolEn
 
 const SPOOL = process.env.ZERO_APPROVALS_DIR;
 
-// THE KEY THAT SAYS AN ANSWER IS HERS, AND IT IS SAFE TO HAND US.
+// THE KEY THAT SAYS AN ANSWER IS THE USER'S, AND IT IS SAFE TO HAND US.
 //
 // This process is the worker's own child, so its environment is the worker's to
 // read and anything secret given here is a secret the forger has. This is the
@@ -93,7 +93,7 @@ async function decide(args) {
         // against the command THIS PROCESS is still holding. `request` here is
         // that memory: it was built from the tool call and has never been read
         // back off the disk, so comparing it against the digest she signed is
-        // the whole check. A mismatch is a deny -- she said yes to something
+        // the whole check. A mismatch is a deny -- the user said yes to something
         // else -- and it is loud, because only a rewrite can produce it.
         const mine = cardDigest(request);
         if (!mine || answer.card !== mine) {

package/main/approvals.mjs

@@ -387,12 +387,20 @@ const REQUEST_SUFFIX = '.request.json';
  * FORWARD to now. A worker can therefore make its own request look younger than
  * it is, which costs it the front of the stack, and can never make it look
  * older. Nanoseconds because APFS keeps them and two files written back to back
- * differ by about 170 microseconds; equal stamps keep `readdir` order, which is
- * as good as anything when two things really did happen at once.
+ * differ by about 170 microseconds.
+ *
+ * A coarse clock stamps both files the same. tmpfs does this: two writes in
+ * one poll share a ctime, and `readdir` then comes back in name order, which
+ * is the forgery the paragraph above is about. The inode breaks that tie.
+ * The kernel assigns it, a later create in a fresh directory gets a higher
+ * one, and a worker cannot move it backwards. Equal inode and equal ctime
+ * keep the order we already had.
  */
 function bornAt(dir, name) {
-  try { return fs.lstatSync(path.join(dir, name), { bigint: true }).ctimeNs; }
-  catch { return 2n ** 63n; } // gone or unreadable: never in front of something real
+  try {
+    const st = fs.lstatSync(path.join(dir, name), { bigint: true });
+    return { ctime: st.ctimeNs, ino: st.ino };
+  } catch { return { ctime: 2n ** 63n, ino: 2n ** 63n }; } // gone or unreadable: never in front of something real
 }
 
 export function listPending(storeRoot, { now = Date.now } = {}) {
@@ -409,7 +417,8 @@ export function listPending(storeRoot, { now = Date.now } = {}) {
   for (const { f } of names
     .filter((f) => !seenAt.has(prefix + f.slice(0, -REQUEST_SUFFIX.length)))
     .map((f) => ({ f, born: bornAt(dir, f) }))
-    .sort((a, b) => (a.born < b.born ? -1 : a.born > b.born ? 1 : 0))) {
+    .sort((a, b) => (a.born.ctime < b.born.ctime ? -1 : a.born.ctime > b.born.ctime ? 1
+      : a.born.ino < b.born.ino ? -1 : a.born.ino > b.born.ino ? 1 : 0))) {
     seenAt.set(prefix + f.slice(0, -REQUEST_SUFFIX.length), { at, seq: sightings += 1 });
   }
   const present = new Set();

package/main/artifact-path.mjs

@@ -125,6 +125,17 @@ export function resolveArtifact({ src, product, products = [], accountRoot, stor
     }
   } else {
     for (const root of roots) candidates.push(path.join(root, raw));
+    // AND THE WORKER'S OWN CHECKOUT, when the path names its task. Every run
+    // works in `<repo>/.claude/worktrees/<task id>` (./task-folders.mjs), so
+    // `designs/w-1b574413db/a1.png` is relative to that folder, and the hunt
+    // below never finds it because it skips every folder starting with a dot.
+    // Only a task the path itself names: a bare `shots/a.png` must not reach
+    // into some other task's checkout (2026-10-04, w-7fe215448b).
+    if (own?.repoPath) {
+      for (const segment of raw.split('/')) {
+        if (/^w-[0-9a-f]{6,}$/i.test(segment)) candidates.push(path.join(own.repoPath, '.claude', 'worktrees', segment, raw));
+      }
+    }
   }
 
   for (const full of candidates) {

package/main/claude-bin.mjs

@@ -6,7 +6,8 @@
 // the app found nothing, said "missing" on a grey dot in Settings, and gave no
 // sentence and no next step. It read as broken rather than as unfinished.
 //
-// HER RULE, 2026-08-23, and it is the one this file exists to keep:
+// THE RULE this file exists to keep: never tell someone Claude Code is
+// missing unless we are certain it is.
 //
 // So there are two different questions here and they must never be answered by
 // the same value. `found` is whether a runnable file is really there, and it
@@ -45,10 +46,10 @@
 // the same way, and it is a real state: the installer points ~/.local/bin/claude
 // at a versioned file and swaps that file on every update.
 //
-// Nothing here overrides her file. An explicit `claudeBin` in zero.config.json
-// wins untouched and is never searched around, because that file's first line
-// is "all paths explicit, no discovery magic" and a search that second-guesses
-// a setting she wrote is exactly that.
+// Nothing here overrides the config file. An explicit `claudeBin` in
+// zero.config.json wins untouched and is never searched around, because that
+// file promises explicit paths with no discovery, and a search that
+// second-guesses a written setting would break that promise.
 
 import fs from 'node:fs';
 import os from 'node:os';
@@ -70,6 +71,7 @@ export function candidatePaths(home = os.homedir()) {
     path.join(home, '.npm-packages/bin/claude'), // actually write in a guide
     path.join(home, '.yarn/bin/claude'),     // yarn global
     path.join(home, 'Library/pnpm/claude'),  // pnpm's own bin on macOS
+    path.join(home, '.local/share/pnpm/claude'), // pnpm's own bin on Linux
     path.join(home, '.deno/bin/claude'),     // deno
     path.join(home, 'bin/claude'),           // a hand-rolled ~/bin on PATH
     '/opt/local/bin/claude',                 // MacPorts
@@ -96,6 +98,27 @@ function defaultReaddir(dir) {
   try { return fs.readdirSync(dir); } catch { return []; }
 }
 
+// THE COPY THE CLAUDE APP KEEPS FOR ITSELF, one folder per version, newest
+// first. Somebody who has only ever used Claude Code inside the Claude app has
+// this and nothing else (w-9f6975906c, measured 2026-10-05: 2.1.209 there, and
+// it shared the CLI's sign-in). It is searched LAST, after the shell, because it
+// updates when the app does and a real install is fresher.
+export function appCopyPaths(home = os.homedir(), readdir = defaultReaddir) {
+  const dir = path.join(home, 'Library/Application Support/Claude/claude-code');
+  return readdir(dir)
+    .filter((v) => /^\d+(\.\d+)*$/.test(v))
+    .sort(newestFirst)
+    .map((v) => path.join(dir, v, 'claude.app/Contents/MacOS/claude'));
+}
+
+function newestFirst(a, b) {
+  const x = a.split('.').map(Number), y = b.split('.').map(Number);
+  for (let i = 0; i < Math.max(x.length, y.length); i++) {
+    if ((x[i] ?? 0) !== (y[i] ?? 0)) return (y[i] ?? 0) - (x[i] ?? 0);
+  }
+  return 0;
+}
+
 // WHAT CLAUDE CODE LEAVES BEHIND. Any one of these means it has run on this
 // Mac. None of them is a binary and none of them is ever spawned; they exist
 // only to stop the app announcing an absence it cannot support.
@@ -263,6 +286,10 @@ export function findClaudeBin({
   const fromShell = shellSaid(shellLookup());
   if (fromShell.path) return { path: fromShell.path, found: true, certain: true, from: 'shell', searched, evidence: null };
 
+  for (const candidate of appCopyPaths(home, readdir)) {
+    if (exists(candidate)) return { path: candidate, found: true, certain: true, from: 'app', searched, evidence: null };
+  }
+
   // NOT FOUND, AND WHETHER THAT IS KNOWN. Every cheap path missed and every
   // shell we could reach missed, so the last question is whether this Mac shows
   // any sign of Claude Code anyway. If it does, we looked in the wrong places

package/main/claude-input.mjs

@@ -12,6 +12,10 @@ function turnClosed(message) {
   return error;
 }
 
+// How long a finished background job may go without the agent waking for it
+// before the session is closed anyway. Measured wakes arrive in about a second.
+const WAKE_GRACE_MS = 2 * 60 * 1000;
+
 export function claudeStreamArgs(args) {
   const copy = [...args];
   const index = copy.indexOf('-p');
@@ -27,7 +31,21 @@ export function attachClaudeInput(child) {
   const controls = new Map();
   const seenUsers = new Set();
   const pending = new Map();
-  const closeInput = () => { closed = true; child.stdin.end(); };
+  // WHAT THE AGENT STARTED AND HAS NOT HEARD BACK FROM: a background command,
+  // a command Claude Code moved to the background past its time limit, a
+  // background helper. Claude Code lists them in `background_tasks_changed`
+  // and wakes the agent itself when one ends, but only while stdin is open. A
+  // result with any of these out is "I'll report once it finishes", not the
+  // end of the run, and closing there killed the suite it was waiting on
+  // (tests/an-agent-waiting-on-its-own-tests-does-not-come-back-to-you).
+  let waiting = [], wakeTimer = null;
+  // Input only ever closes at a result with nothing out, so a closed input is
+  // the one proof the run reached its end. A session that exits with input
+  // still open was stopped part-way, whatever its last turn said
+  // (tests/a-worker-whose-helpers-are-still-working-does-not-come-back-to-you).
+  let ended = false;
+  const closeInput = () => { closed = true; ended = true; clearTimeout(wakeTimer); child.stdin.end(); };
+  const mayClose = () => !held && atResult && !pending.size && !waiting.length;
   const fail = reason => {
     closed = true;
     for (const request of pending.values()) {
@@ -72,16 +90,29 @@ export function attachClaudeInput(child) {
         atResult = false;
         request.resolve({ accepted: true });
       }
+      if (event.type === 'system' && event.subtype === 'background_tasks_changed' && Array.isArray(event.tasks)) {
+        waiting = event.tasks;
+        // The last one ended between turns. Claude Code wakes the agent for
+        // it, and that turn's result closes as usual. The timer is only for a
+        // wake that never comes, so a session cannot sit open forever.
+        clearTimeout(wakeTimer);
+        if (!waiting.length && atResult && !closed) {
+          wakeTimer = setTimeout(() => { if (mayClose() && !closed) closeInput(); }, WAKE_GRACE_MS);
+          wakeTimer.unref?.();
+        }
+      }
       if (event.type === 'result') {
         atResult = true;
-        if (!held && !pending.size) closeInput();
+        if (mayClose()) closeInput();
       }
     }
   });
+  child.waitingOn = () => [...waiting];
+  child.ranToTheEnd = () => ended;
   child.holdInput = value => {
     if (closed && value) throw Error('This session has ended. Open remote control again to resume it.');
     held = !!value;
-    if (!held && atResult && !pending.size) closeInput();
+    if (mayClose()) closeInput();
   };
   child.control = (request, timeoutMs = 30000) => new Promise((resolve, reject) => {
     if (closed || !child.stdin.writable) return reject(Error('The agent connection is closed.'));
@@ -92,6 +123,17 @@ export function attachClaudeInput(child) {
     try { child.stdin.write(JSON.stringify({ type:'control_request', request_id, request }) + '\n'); }
     catch(error) { clearTimeout(timer); controls.delete(request_id); reject(error); }
   });
+  // SEND NOW: cut the step the agent is in so her waiting message is answered
+  // as a turn of its own, instead of after a command that may run for minutes
+  // (tests/send-now-cuts-the-current-step-so-the-agent-answers). Measured on a
+  // 45-second command: 43 s of waiting without it, 1.4 s to the answer with it.
+  // ONLY WHILE A MESSAGE OF HERS IS WAITING. The cut turn ends in a result,
+  // and with nothing pending that result closes the input and ends the run.
+  child.interrupt = () => {
+    if (closed || !pending.size) return Promise.resolve({ interrupted: false });
+    child.lastInterruptAt = Date.now();
+    return child.control({ subtype: 'interrupt' }).then(() => ({ interrupted: true }));
+  };
   // NO CLOCK ON THE ACKNOWLEDGEMENT. Claude replays a queued message at its next
   // break, and a break can be minutes away: a worker inside one long command
   // (a render poll, `sleep 12` fifty times) holds it until the command returns.

package/main/claude-plan.mjs

@@ -4,7 +4,7 @@
 //
 // THE PROBLEM. Agentbox runs several Claude Code sessions at once and the number
 // is a flat default (`maxConcurrentSessions: 3`, main/config.mjs) that was
-// chosen on a Max subscription and has never been anything else. Nothing
+// chosen with the biggest plan in mind and has never been anything else. Nothing
 // anywhere in the app mentions a plan: not the walk, not the Accounts page, not
 // a row that dies. So a person on a smaller plan gets three sessions started on
 // their behalf, all three burn the same allowance, and what they see is agents
@@ -12,16 +12,16 @@
 // founder was asking out loud while she watched a tester use it.
 //
 // THE ANSWER IS ALREADY ON THE DISK. Claude Code writes its own account profile
-// into its config file and refreshes it as it runs. MEASURED on her Mac
-// 2026-08-29 20:5x, both of her accounts:
+// into its config file and refreshes it as it runs. On a machine with two
+// accounts signed in, for example:
 //
 //   ~/.claude.json                  oauthAccount.organizationType        claude_max
 //                                   oauthAccount.organizationRateLimitTier  default_claude_max_20x
-//                                   profileFetchedAt                    2026-08-29 05:00Z
-//   ~/.claude-second/.claude.json   the same two values
-//                                   profileFetchedAt                    2026-08-29 20:47Z
+//                                   profileFetchedAt                    (within the day)
+//   ~/.claude-second/.claude.json   the same two fields
+//                                   profileFetchedAt                    (within the day)
 //
-// Both fetched within the day, so the field is live rather than a one-time
+// Each is refetched within the day, so the field is live rather than a one-time
 // stamp from a login months ago, and it is the honest source: it is Claude
 // Code's own answer about its own subscription, not a guess of ours.
 //
@@ -30,14 +30,14 @@
 // runs with nothing set, so its file is `~/.claude.json`; a second account runs
 // with CLAUDE_CONFIG_DIR pointing at a folder, so its file is inside that
 // folder (main/supervisor.mjs sets exactly that per spawn). Both are verified
-// above. Note that `~/.claude/.claude.json` also exists on her Mac and is NINE
-// DAYS STALE — it is what a run with CLAUDE_CONFIG_DIR=~/.claude left behind.
+// above. Note that a `~/.claude/.claude.json` can also exist and be days
+// STALE — it is what a run with CLAUDE_CONFIG_DIR=~/.claude left behind.
 // It is not read for the default account, and that is deliberate: the rule here
 // is Claude Code's own rule, not a search for the likeliest looking file.
 //
 // WHAT THIS DELIBERATELY DOES NOT DO. It does not guess the strings for plans
-// nobody here has seen. Only one plan has ever been measured on this machine,
-// and inventing `default_claude_pro` in a table would be a number nobody
+// nobody here has seen in a real file, and inventing `default_claude_pro` in
+// a table would be a number nobody
 // measured. So `max` is decided by looking for the word max, the label is
 // derived from the raw string mechanically, and anything unreadable comes back
 // `known: false` and changes nothing anywhere.
@@ -95,13 +95,25 @@ export function isMaxTier(raw) {
  *  as it was". */
 export function readPlan(profile, { home = os.homedir(), file = null } = {}) {
   const at = file ?? planFile(profile, home);
-  const none = { known: false, max: false, label: null, tier: null, from: null, file: at };
   let account = null;
   try {
     account = JSON.parse(fs.readFileSync(at, 'utf8'))?.oauthAccount ?? null;
   } catch {
-    return none;
+    return planOfAccount(null, at);
   }
+  return planOfAccount(account, at);
+}
+
+/**
+ * THE SAME ANSWER OFF AN `oauthAccount` SOMEBODY ALREADY HAS IN HAND.
+ *
+ *  Lifted out of `readPlan` so a caller that has read the file for its own
+ *  reasons (main/runs-on.mjs, which also wants to know whether there is a login
+ *  in there at all) does not carry a second copy of the tier ordering. One copy
+ *  of that rule, and the file read stays in one place per caller.
+ */
+export function planOfAccount(account, at = null) {
+  const none = { known: false, max: false, label: null, tier: null, from: null, file: at };
   if (!account || typeof account !== 'object') return none;
   // THE ORDER IS MOST SPECIFIC FIRST. A rate limit tier names the plan AND its
   // size (`max_20x` against `max_5x`), which is the thing worth showing; the

package/main/code-change.mjs

@@ -14,7 +14,7 @@
 // IT IS NOT ENOUGH ON ITS OWN, AND THAT WAS MEASURED, NOT ARGUED. An agent
 // that rewrites a file with sed or a heredoc puts nothing in its transcript,
 // and on her Mac 2026-08-24 that was 101 of the 105 runs that changed a file
-// over two days. Every one of those left David an empty card. So the disk is
+// over two days. Every one of those left a tester an empty card. So the disk is
 // read too, by main/git-change.mjs, and `mergeChange` below puts the two
 // together: git's lines, the conversation's words, git winning where they
 // disagree.
@@ -39,9 +39,9 @@ const NOT_CODE = /(^|\/)(node_modules|\.git)\//;
 // AND SCRATCH, WHICH IS NOT THE PRODUCT. A run writes throwaway scripts to
 // /tmp constantly and one of them landed in the tree as a folder called `tmp`
 // on the first real change we read (18 files, and one of them was
-// /tmp/shelf-shots.mjs). Dropped rather than shown: what David is being asked
+// /tmp/shelf-shots.mjs). Dropped rather than shown: what a tester is being asked
 // to review is the product, and a file nobody will ever open again reads as
-// work he has to account for.
+// work they have to account for.
 const SCRATCH = /^\/(private\/)?(tmp|var\/folders)\//;
 
 /**

package/main/codex-account.mjs

@@ -35,7 +35,7 @@ const AUTH_CLAIM = 'https://api.openai.com/auth';
 
 /**
  * The plan ids whose proper names are known. Everything else is printed exactly
- *  as Codex spells it, and that is deliberate: her own token reads "prolite",
+ *  as Codex spells it, and that is deliberate: a real token can read "prolite",
  *  which title-cases into "Prolite", a product name nobody at OpenAI has ever
  *  used. Inventing a label is how a screen tells a confident lie about what
  *  somebody is paying for, so an id we do not know is shown as the id. */

package/main/codex-bin.mjs

@@ -114,6 +114,7 @@ export function candidatePaths(home = os.homedir()) {
     path.join(home, '.npm-packages/bin/codex'), // actually write in a guide
     path.join(home, '.yarn/bin/codex'),
     path.join(home, 'Library/pnpm/codex'),    // pnpm's own bin on macOS
+    path.join(home, '.local/share/pnpm/codex'), // pnpm's own bin on Linux
     path.join(home, '.deno/bin/codex'),
     path.join(home, 'bin/codex'),             // a hand-rolled ~/bin on PATH
     '/opt/local/bin/codex',                   // MacPorts
@@ -140,6 +141,19 @@ function defaultReaddir(dir) {
   try { return fs.readdirSync(dir); } catch { return []; }
 }
 
+// THE COPY THE CHATGPT APP CARRIES INSIDE ITSELF. Somebody who has only ever
+// used Codex in the ChatGPT app has this and nothing else (w-9f6975906c,
+// measured 2026-10-05: codex-cli 0.158.0-alpha.2, sharing the CLI's sign-in).
+// Searched LAST, after the shell, because it moves with the app's releases.
+//
+// AND THE ONE THE CODEX DESKTOP APP CARRIES (w-d5d632e503). Its reported place,
+// not measured on a Mac here: none of the Macs this was written on had the app.
+// A path that is not there costs one missed `exists`.
+export function appCopyPaths(home = os.homedir()) {
+  const inside = ['ChatGPT.app/Contents/Resources/codex-cli/bin/codex', 'Codex.app/Contents/Resources/codex'];
+  return inside.flatMap((p) => [path.join('/Applications', p), path.join(home, 'Applications', p)]);
+}
+
 // WHAT CODEX LEAVES BEHIND. None of these is a binary and none is ever spawned.
 // They exist only to stop the app claiming an absence it has not established.
 //
@@ -214,6 +228,10 @@ export function findCodexBin({
   const fromShell = shellSaid(shellLookup());
   if (fromShell.path) return { path: fromShell.path, found: true, certain: true, from: 'shell', searched, evidence: null };
 
+  for (const candidate of appCopyPaths(home)) {
+    if (exists(candidate)) return { path: candidate, found: true, certain: true, from: 'app', searched, evidence: null };
+  }
+
   // NOT FOUND, AND WHETHER THAT IS KNOWN. Every cheap path missed and every
   // shell we could reach missed, so the last question is whether this Mac shows
   // any sign of Codex anyway.