agenter-app 1.0.3 → 1.1.0

package/Agenter.vbs

@@ -1,5 +1,5 @@
 ' Double-click (or use the shortcut) to open Agenter without a console window.
-' "Agenter.vbs server" only starts the background server (used at Windows login).
+' "Agenter.vbs server" only starts the background server and tray icon (used at Windows login).
 Set fso = CreateObject("Scripting.FileSystemObject")
 dir = fso.GetParentFolderName(WScript.ScriptFullName)
 cmd = "node """ & dir & "\open.js"""

package/README.md

@@ -29,7 +29,12 @@ From a clone instead: `npm run install-hooks` and `npm run shortcuts`, then `npm
 ## Running it
 
 You mostly don't have to: **the server starts itself** the first time any Claude session fires a hook,
-and keeps running in the background. Just open the window when you want it:
+and keeps running in the background, with an icon in the Windows system tray. Closing the window leaves
+it running there. Click the icon to open the dashboard.
+
+**To stop it, right-click the tray icon and choose Quit Agenter.** That closes the windows and stops the
+server. Anything waiting goes back to VS Code, and turns Agenter is running are stopped. Hooks won't restart
+it; it stays off until you open Agenter again.
 
 | Way | What it does |
 |---|---|
@@ -37,9 +42,9 @@ and keeps running in the background. Just open the window when you want it:
 | `agenter` | Same thing, from a terminal. |
 | `agenter start` | Runs the server in the foreground with logs (handy for debugging). |
 | `agenter doctor` | Checks the hooks, port, Claude Code and login, and says how to fix anything that's wrong. Start here if sessions don't show up. |
-| `agenter shortcuts --startup` | Also starts the server silently when you log in to Windows. |
+| `agenter shortcuts` | Creates the shortcuts, and starts Agenter in the system tray when you log in to Windows. |
 
-Set `AGENTER_AUTOSTART=0` to stop hooks from starting the server.
+Set `AGENTER_AUTOSTART=0` to stop hooks from starting the server, or `AGENTER_TRAY=0` to hide the tray icon.
 Dashboard settings are kept in `~/.agenter/settings.json`.
 
 To remove everything: `agenter uninstall`, then `npm uninstall -g agenter-app`.
@@ -75,7 +80,8 @@ Each session has a **Drive from** switch in its header.
   reply from Agenter the VS Code panel shows its spinner, and an idle session waits for VS Code.
 - **Agenter**: Agenter runs the turns itself with the Claude Code that ships with the VS Code extension
   (`claude -p --resume <session>`), in the same session. Nothing ever waits on VS Code, idle and closed
-  sessions can be continued, permission prompts and questions come to Agenter, and **Stop** ends a running turn.
+  sessions can be continued, permission prompts and questions come to Agenter and wait there for your answer
+  while a dashboard is open, and **Stop** ends a running turn and everything it started.
   The VS Code panel doesn't show these turns until you reopen the session there (Claude panel → session
   history), and don't type in VS Code's panel for that session at the same time.
 
@@ -146,7 +152,10 @@ forwards the event to the local server (`server.js`) and prints the server's ans
   and nothing new gets held, and anything already waiting goes back to VS Code after 5 seconds.
 - **Dashboard closed?** Same, after 15 seconds.
 - **Interrupt in VS Code** while something is waiting? The dashboard item disappears.
-- The server only listens on `127.0.0.1` and rejects requests from other websites.
+- The server only listens on `127.0.0.1`, rejects requests from other websites, and requires the token in
+  `~/.agenter/token`. Hooks read it from there, and the Agenter shortcut and `agenter` sign the dashboard in,
+  so open it that way rather than from a bookmark on a new browser. The token keeps out other Windows users
+  and anything that can only make HTTP requests. A program running as you can still read the file.
 
 ## Plan usage
 

package/cli.js

@@ -86,7 +86,7 @@ Usage: agenter [command]
   uninstall        Remove the hooks and shortcuts
   doctor           Check hooks, port, Claude Code and login, and say how to fix what's wrong
   start            Run the server in the foreground with logs
-  shortcuts        (Re)create the Windows shortcuts; --startup also starts the server at login
+  shortcuts        (Re)create the Windows shortcuts, and start Agenter in the tray at login
   version          Print the version
 
 After installing, reload your VS Code windows so Claude sessions pick up the hooks.`;
@@ -117,7 +117,7 @@ After installing, reload your VS Code windows so Claude sessions pick up the hoo
       break;
     }
     case 'shortcuts':
-      status = shortcuts(rest.includes('--startup') ? ['-Startup'] : []);
+      status = shortcuts(['-Startup']);
       break;
     case 'version':
     case '--version':

package/hook.js

@@ -2,16 +2,21 @@
 // Claude Code hook bridge. Claude Code runs this for every hook event and pipes the
 // event JSON on stdin. We forward it to the Agenter server and print whatever it
 // answers. If the server isn't running we start it in the background (unless
-// AGENTER_AUTOSTART=0) and exit silently so Claude behaves normally this time.
+// AGENTER_AUTOSTART=0, or you quit the app) and exit silently so Claude behaves
+// normally this time.
 'use strict';
+const fs = require('node:fs');
 const http = require('node:http');
+const os = require('node:os');
 const path = require('node:path');
 const { spawn } = require('node:child_process');
+const { readToken } = require('./lib/token');
 
 const PORT = Number(process.env.AGENTER_PORT) || 4317;
 
 function startServer() {
   if (process.env.AGENTER_AUTOSTART === '0') return;
+  if (fs.existsSync(path.join(os.homedir(), '.agenter', 'stopped'))) return;
   try {
     spawn(process.execPath, [path.join(__dirname, 'server.js'), '--no-open'], { detached: true, stdio: 'ignore', windowsHide: true }).unref();
   } catch {}
@@ -27,7 +32,7 @@ process.stdin.on('end', () => {
       port: PORT,
       path: '/hook',
       method: 'POST',
-      headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(input) },
+      headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(input), 'x-agenter-token': readToken() },
     },
     (res) => {
       let body = '';

package/lib/open-dashboard.js

@@ -4,6 +4,7 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const { spawn, exec } = require('node:child_process');
+const { getToken } = require('./token');
 
 function findAppBrowser() {
   if (process.platform !== 'win32') return null;
@@ -13,7 +14,9 @@ function findAppBrowser() {
   return null;
 }
 
-module.exports = function openDashboard(url) {
+module.exports = function openDashboard(baseUrl) {
+  // In the fragment, so it never reaches a server or a log. The page keeps it from there.
+  const url = `${baseUrl}/#token=${getToken()}`;
   const browser = findAppBrowser();
   if (browser) {
     const child = spawn(browser, [`--app=${url}`, '--window-size=1280,860'], { detached: true, stdio: 'ignore' });

package/lib/token.js

@@ -0,0 +1,47 @@
+'use strict';
+// The shared secret every caller of the local server must present, kept in
+// ~/.agenter/token. server.js checks it, hook.js sends it for any agent, and the launchers
+// hand it to the dashboard. It stays the same across restarts, so open dashboards and
+// running sessions keep working.
+//
+// This keeps out other Windows users on the machine and anything that can only make
+// HTTP requests to localhost. A program running as you can still read the file.
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const tokenFile = () => path.join(os.homedir(), '.agenter', 'token');
+
+function readToken() {
+  try {
+    return fs.readFileSync(tokenFile(), 'utf8').trim();
+  } catch {
+    return '';
+  }
+}
+
+// Creates the token the first time. 'wx' so two processes starting together agree on one.
+function getToken() {
+  const existing = readToken();
+  if (existing) return existing;
+  const file = tokenFile();
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const token = crypto.randomBytes(32).toString('hex');
+  try {
+    fs.writeFileSync(file, token, { flag: 'wx', mode: 0o600 });
+    return token;
+  } catch (err) {
+    if (err.code === 'EEXIST') return readToken();
+    throw err;
+  }
+}
+
+function sameToken(given, expected) {
+  if (typeof given !== 'string' || !expected) return false;
+  const a = Buffer.from(given);
+  const b = Buffer.from(expected);
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+
+module.exports = { getToken, readToken, sameToken, tokenFile };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agenter-app",
-  "version": "1.0.3",
+  "version": "1.1.0",
   "description": "One local dashboard to watch, approve and steer every Claude Code and Codex session on your machine.",
   "keywords": [
     "claude",

package/public/app.js

@@ -44,7 +44,25 @@ function ago(t) {
   return `${Math.floor(s / 86400)}d`;
 }
 
-const post = (url, body) => fetch(url, { method: 'POST', headers: { 'content-type': 'application/json', 'x-agenter': '1' }, body: JSON.stringify(body) });
+// The launchers open the dashboard with #token=…; it's kept here, out of the address bar.
+const TOKEN = (() => {
+  const key = 'agenter.token';
+  const m = location.hash.match(/^#token=([0-9a-f]+)$/);
+  if (m) {
+    history.replaceState(null, '', location.pathname + location.search);
+    try {
+      localStorage.setItem(key, m[1]);
+    } catch {}
+    return m[1];
+  }
+  try {
+    return localStorage.getItem(key) || '';
+  } catch {
+    return '';
+  }
+})();
+const authHeaders = { 'x-agenter-token': TOKEN };
+const post = (url, body) => fetch(url, { method: 'POST', headers: { 'content-type': 'application/json', ...authHeaders }, body: JSON.stringify(body) });
 
 const STATUS_LABEL = { working: 'Working', waiting: 'Needs you', vscode: 'Waiting in VS Code', idle: 'Idle', dormant: 'Not connected', ended: 'Ended' };
 const isLive = (s) => s.status !== 'dormant' && s.status !== 'ended';
@@ -190,10 +208,18 @@ window.addEventListener('blur', () => setTimeout(reportFocus));
 document.addEventListener('visibilitychange', () => reportFocus());
 
 function connect() {
-  const es = new EventSource(`/events?client=${CLIENT_ID}&focused=${hasAttention() ? 1 : 0}`);
+  const es = new EventSource(`/events?client=${CLIENT_ID}&focused=${hasAttention() ? 1 : 0}&token=${encodeURIComponent(TOKEN)}`);
   es.addEventListener('state', (e) => apply(JSON.parse(e.data)));
+  es.addEventListener('quit', () => window.close());
   es.onopen = () => (setConn(true), reportFocus(true)); // after a reconnect the URL's focus flag may be stale
-  es.onerror = () => setConn(false);
+  es.onerror = async () => {
+    setConn(false);
+    // EventSource doesn't say why it failed, and it gives up for good on a refused request.
+    const refused = await post('/api/focus', {}).then((r) => r.status === 401, () => false);
+    if (!refused) return;
+    es.close();
+    if (!$('#authLost')) document.body.insertAdjacentHTML('afterbegin', '<div class="auth-lost" id="authLost" role="alert">This window isn\'t signed in to Agenter. Open it from the Agenter shortcut, or run <code>agenter</code>.</div>');
+  };
 }
 
 function setConn(ok) {
@@ -632,7 +658,7 @@ async function scanApps() {
   loadFrame();
   let r = null;
   try {
-    r = await fetch(`/api/preview/apps?session=${encodeURIComponent(sid)}`).then((res) => res.json());
+    r = await fetch(`/api/preview/apps?session=${encodeURIComponent(sid)}`, { headers: authHeaders }).then((res) => res.json());
   } catch {}
   if (cwd !== preview.cwd) return; // switched project meanwhile; that one has its own scan
   preview.scanning = false;
@@ -748,13 +774,23 @@ const sortPending = (list) => [...list].sort((a, b) => a.createdAt - b.createdAt
 
 // ---------- session view ----------
 
+// Messages you sent that the agent's transcript hasn't recorded yet, by session.
+const sentEchoes = new Map();
+
+function clearEchoes(sid, messages) {
+  const left = (sentEchoes.get(sid) || []).filter((text) => !messages.some((m) => m.role === 'user' && m.text.trim() === text));
+  if (left.length) sentEchoes.set(sid, left);
+  else sentEchoes.delete(sid);
+}
+
 function renderLiveRow() {
   const s = sessionById(state.selected);
   const el = $('#liveRow');
   if (!s || !el) return;
-  let html = '';
-  if (s.status === 'working') html = `<div class="live-row"><span class="dots"><i></i><i></i><i></i></span><span class="targ">${esc(s.lastAction || 'Working…')}</span></div>`;
-  else if (s.status === 'vscode') html = `<div class="live-row">${icon('info')}<span>Waiting for you in VS Code</span></div>`;
+  if (!s.running) sentEchoes.delete(s.id); // The turn is over, so the transcript has the last word.
+  let html = (sentEchoes.get(s.id) || []).map((text) => `<div class="live-echo"><div class="msg-user">${esc(text)}</div></div>`).join('');
+  if (s.status === 'working') html += `<div class="live-row"><span class="dots"><i></i><i></i><i></i></span><span class="targ">${esc(s.lastAction || 'Working…')}</span></div>`;
+  else if (s.status === 'vscode') html += `<div class="live-row">${icon('info')}<span>Waiting for you in VS Code</span></div>`;
   if (el.innerHTML !== html) {
     const stick = nearBottom();
     el.innerHTML = html;
@@ -793,7 +829,7 @@ function renderSteer(s) {
     .join('');
   let when;
   if (isCodex(s)) {
-    if (agenter && busy) when = 'Codex gets this as its next turn, when the current one ends.';
+    if (s.running || (agenter && busy)) when = 'Codex gets this as its next turn, when the current one ends.';
     else if (agenter) when = 'Runs here in Agenter, sandboxed to the project folder (no network).';
     else when = `Queued in Codex: it runs as the next turn when this session is open in Codex (VS Code or the desktop app). Or <button class="link" type="button" data-drive="agenter">drive from Agenter</button>.`;
   } else if (busy) when = 'Claude gets this after its current step.';
@@ -827,6 +863,11 @@ async function steer(card) {
     return toast("Couldn't send that");
   }
   const { result } = await r.json();
+  // A turn Agenter just started: show your message now, ahead of the transcript.
+  if (result === 'started') {
+    sentEchoes.set(state.selected, [...(sentEchoes.get(state.selected) || []), message]);
+    renderLiveRow();
+  }
   const FAILED = {
     'no-claude': "Couldn't find Claude Code. Install the VS Code extension, or set AGENTER_CLAUDE to claude.exe",
     'no-codex': "Couldn't find Codex. Install the Codex VS Code extension, or set AGENTER_CODEX_BIN to codex.exe",
@@ -1134,7 +1175,7 @@ function loadTranscript(sid) {
       const have = state.transcript.sessionId === sid && state.transcript.messages ? state.transcript : null;
       const lastSeq = () => have?.messages.at(-1)?.seq ?? 0;
       const since = have ? `&epoch=${encodeURIComponent(have.epoch)}&after=${lastSeq()}` : '';
-      const r = await fetch(`/api/transcript?session=${encodeURIComponent(sid)}${since}`);
+      const r = await fetch(`/api/transcript?session=${encodeURIComponent(sid)}${since}`, { headers: authHeaders });
       if (!r.ok) return;
       const { epoch, reset, messages } = await r.json();
       if (sid !== state.selected) return;
@@ -1142,7 +1183,9 @@ function loadTranscript(sid) {
       // A request that overlapped another may repeat messages; seq tells them apart.
       const merged = reset || !have ? messages : [...have.messages, ...messages.filter((m) => m.seq > lastSeq())].slice(-KEEP_MESSAGES);
       state.transcript = { sessionId: sid, epoch, messages: merged };
+      clearEchoes(sid, messages);
       renderConvo(same);
+      renderLiveRow();
     } catch {}
   }, 150);
 }

package/public/index.html

@@ -11,17 +11,7 @@
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
   <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Geist:wght@400;500;600;700&family=Geist+Mono:wght@400;500;600&display=swap">
   <link rel="stylesheet" href="/style.css">
-  <script>
-    // Applied before first paint so there's no flash of the wrong theme.
-    (() => {
-      const read = (k) => { try { return JSON.parse(localStorage.getItem('agenter.' + k)); } catch { return null; } };
-      const theme = read('theme') || 'system';
-      const dark = theme === 'dark' || (theme === 'system' && matchMedia('(prefers-color-scheme: dark)').matches);
-      document.documentElement.dataset.theme = dark ? 'dark' : 'light';
-      const accent = read('accent');
-      if (accent && accent !== 'sage') document.documentElement.dataset.accent = accent;
-    })();
-  </script>
+  <script src="/theme.js"></script>
 </head>
 <body>
   <div class="app" id="app">

package/public/style.css

@@ -363,6 +363,7 @@ dialog.new-dialog { max-width: 520px; }
 .convo { display: flex; flex-direction: column; gap: 10px; }
 .msg-user { align-self: flex-end; max-width: 78%; background: var(--accent-soft); border: 1px solid transparent; padding: 9px 14px; border-radius: 14px 14px 4px 14px; white-space: pre-wrap; word-break: break-word; }
 .msg-user.from-dash { border-color: var(--accent-ink); }
+.live-echo { display: flex; justify-content: flex-end; margin-top: 12px; }
 .msg-claude { display: grid; grid-template-columns: 26px 1fr; gap: 10px; align-items: start; }
 .claude-mark { width: 26px; height: 26px; border-radius: 8px; background: var(--panel); border: 1px solid var(--border); display: grid; place-items: center; color: var(--accent-ink); }
 .claude-mark .ic { width: 14px; height: 14px; }
@@ -555,3 +556,5 @@ dialog form { text-align: right; }
   .splitter { display: none; }
   .preview { order: -1; width: auto; max-width: none; min-width: 0; height: 48vh; border-bottom: 1px solid var(--border); }
 }
+
+.auth-lost { position: fixed; top: 12px; left: 50%; transform: translateX(-50%); z-index: 1000; max-width: calc(100vw - 32px); padding: 10px 14px; border-radius: 10px; background: #5c2a26; color: #fff; font-size: 13px; }

package/public/theme.js

@@ -0,0 +1,9 @@
+// Applied before first paint so there's no flash of the wrong theme.
+(() => {
+  const read = (k) => { try { return JSON.parse(localStorage.getItem('agenter.' + k)); } catch { return null; } };
+  const theme = read('theme') || 'system';
+  const dark = theme === 'dark' || (theme === 'system' && matchMedia('(prefers-color-scheme: dark)').matches);
+  document.documentElement.dataset.theme = dark ? 'dark' : 'light';
+  const accent = read('accent');
+  if (accent && accent !== 'sage') document.documentElement.dataset.accent = accent;
+})();

package/scripts/install-shortcuts.ps1

@@ -1,5 +1,5 @@
 # Creates "Agenter" shortcuts on the Desktop and in the Start Menu (pin it to the taskbar from there).
-# -Startup also starts the Agenter server silently when you log in to Windows.
+# -Startup also starts Agenter in the system tray when you log in to Windows.
 param([switch]$Startup, [switch]$Remove)
 
 $root = Split-Path -Parent $PSScriptRoot
@@ -31,6 +31,7 @@ if ($Startup) {
   $lnk.TargetPath = "$env:SystemRoot\System32\wscript.exe"
   $lnk.Arguments = "`"$root\Agenter.vbs`" server"
   $lnk.WorkingDirectory = $root
+  $lnk.IconLocation = "$root\public\agenter.ico,0"
   $lnk.Save()
-  "Created $startupLink (server starts at login)"
+  "Created $startupLink (Agenter starts in the tray at login)"
 }

package/scripts/tray.ps1

@@ -0,0 +1,40 @@
+# The Agenter icon in the Windows system tray. server.js starts this, and it lives exactly as
+# long as the server does. Open shows the dashboard; Quit stops the server, and with it this.
+param([int]$ServerPid, [string]$Node, [int]$Port)
+
+Add-Type -AssemblyName System.Windows.Forms, System.Drawing
+
+$root = Split-Path -Parent $PSScriptRoot
+
+$open = {
+  Start-Process -FilePath $Node -ArgumentList "`"$root\open.js`"" -WindowStyle Hidden
+}
+$quit = {
+  $token = (Get-Content (Join-Path $env:USERPROFILE '.agenter\token') -Raw).Trim()
+  Invoke-RestMethod -Method Post -Uri "http://127.0.0.1:$Port/api/quit" -Headers @{ 'x-agenter-token' = $token } -ContentType 'application/json' -Body '{}' | Out-Null
+}
+
+$menu = New-Object System.Windows.Forms.ContextMenuStrip
+$menu.Items.Add('Open Agenter').add_Click($open)
+$menu.Items.Add('Quit Agenter').add_Click($quit)
+
+$tray = New-Object System.Windows.Forms.NotifyIcon
+$tray.Icon = New-Object System.Drawing.Icon (Join-Path $root 'public\agenter.ico')
+$tray.Text = 'Agenter'
+$tray.ContextMenuStrip = $menu
+$tray.add_MouseClick({ if ($_.Button -eq 'Left') { & $open } })
+$tray.Visible = $true
+
+# However the server ended, don't leave a dead icon behind.
+$watch = New-Object System.Windows.Forms.Timer
+$watch.Interval = 1000
+$watch.add_Tick({
+  if (-not (Get-Process -Id $ServerPid -ErrorAction SilentlyContinue)) {
+    $tray.Visible = $false
+    [System.Windows.Forms.Application]::Exit()
+  }
+})
+$watch.Start()
+
+[System.Windows.Forms.Application]::Run()
+$tray.Dispose()

package/server.js

@@ -12,6 +12,7 @@ const openDashboard = require('./lib/open-dashboard');
 const { truncate, describeTool, readTail, readHead, parseCodexItem, readTranscript, lastAssistantText, transcriptInfo } = require('./lib/transcript');
 const { normalizeLimits, codexWindowLabel } = require('./lib/limits');
 const { buildDiffs } = require('./lib/diff');
+const { getToken, sameToken } = require('./lib/token');
 
 const PORT = Number(process.env.AGENTER_PORT) || 4317;
 const HOST = '127.0.0.1';
@@ -26,6 +27,8 @@ const MAX_ACTIVITY = 200;
 const DISCONNECT_GRACE_MS = 15000;
 // If you switch away from the dashboard (to VS Code, say) this long, same thing.
 const BLUR_GRACE_MS = 5000;
+// While this exists hook.js won't restart the server, so an app you quit stays quit.
+const STOPPED_FILE = path.join(SETTINGS_DIR, 'stopped');
 const DISCOVER_INTERVAL_MS = 30000;
 const DISCOVER_FULL_SCAN_MS = 5 * 60 * 1000; // when a file watcher catches changes in between
 // Plan usage (5-hour session / weekly limits) comes from the same endpoint Claude
@@ -339,9 +342,12 @@ async function checkRollout(file) {
     s.codexTurnOpen = tail.turnOpen;
     s.status = codexStatus(s);
     const last = tail.last;
+    // While working, only a running tool is current; the last reply may be from the previous turn.
     s.lastAction =
-      s.status === 'working' && last?.kind === 'tool'
-        ? `${last.name}: ${last.text.split('\n')[0]}`.slice(0, 160)
+      s.status === 'working'
+        ? last?.kind === 'tool'
+          ? `${last.name}: ${last.text.split('\n')[0]}`.slice(0, 160)
+          : ''
         : (lastAssistantText(file) || '').split('\n')[0].slice(0, 160);
     return true;
   } catch {
@@ -543,7 +549,9 @@ async function findApps(cwd) {
 function addActivity(s, kind, text, extra = {}) {
   s.activity.push({ t: Date.now(), kind, text: truncate(text, 4000), ...extra });
   if (s.activity.length > MAX_ACTIVITY) s.activity.splice(0, s.activity.length - MAX_ACTIVITY);
-  s.lastAction = (extra.tool ? `${extra.tool}: ` : '') + String(text).split('\n')[0].slice(0, 160);
+  // lastAction is what the agent is doing. A prompt is what you said, so it starts blank
+  // (the dashboard shows "Working…") until the agent reports something.
+  s.lastAction = kind === 'prompt' ? '' : (extra.tool ? `${extra.tool}: ` : '') + String(text).split('\n')[0].slice(0, 160);
 }
 
 // Who drives a session: 'vscode' (Agenter only answers inside VS Code's turns) or
@@ -562,7 +570,8 @@ function hold(s, kind, data, payload, res) {
   const item = { id: crypto.randomUUID(), sessionId: s.id, kind, createdAt: Date.now(), headless: runners.has(s.id), ...data };
   const entry = { item, res, payload, timer: null };
   const minutes = Number(settings.holdMinutes) || 0;
-  if (minutes > 0) {
+  // A turn Agenter runs has no VS Code to go back to, so it waits for your answer.
+  if (minutes > 0 && !item.headless) {
     item.releaseAt = item.createdAt + minutes * 60000;
     entry.timer = setTimeout(() => respond(item.id, 'pass', { auto: true }), minutes * 60000);
   }
@@ -579,6 +588,17 @@ function hold(s, kind, data, payload, res) {
   broadcast();
 }
 
+// A turn Agenter ran is over, so anything it was waiting on can't be answered any more.
+function releaseRun(s) {
+  for (const [id, e] of [...pending]) {
+    if (e.item.sessionId !== s.id || !e.item.headless) continue;
+    clearTimeout(e.timer);
+    pending.delete(id);
+    e.res.writeHead(200, { 'content-type': 'application/json' });
+    e.res.end('{}');
+  }
+}
+
 // action: allow | always | deny | answer | reply | pass
 function respond(id, action, body = {}) {
   const entry = pending.get(id);
@@ -652,6 +672,30 @@ function onAttentionChanged() {
   }, clients.size ? BLUR_GRACE_MS : DISCONNECT_GRACE_MS);
 }
 
+// Quit, from the tray. Open windows close themselves on the 'quit' event.
+function stopServer() {
+  for (const c of clients.keys()) c.write('event: quit\ndata: {}\n\n');
+  for (const id of [...pending.keys()]) respond(id, 'pass');
+  for (const child of runners.values()) {
+    child.interrupted = true;
+    killRun(child);
+  }
+  fs.mkdirSync(SETTINGS_DIR, { recursive: true });
+  fs.writeFileSync(STOPPED_FILE, '');
+  // Long enough for the hooks to receive those answers.
+  setTimeout(() => process.exit(0), 300);
+}
+
+// The tray icon. It watches this process, so it goes away when the server does.
+function startTray() {
+  if (process.platform !== 'win32' || process.env.AGENTER_TRAY === '0') return;
+  const args = ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-STA', '-WindowStyle', 'Hidden', '-File', path.join(__dirname, 'scripts', 'tray.ps1'), '-ServerPid', String(process.pid), '-Node', process.execPath, '-Port', String(PORT)];
+  // Not detached: PowerShell exits at once without a console.
+  const child = spawn('powershell.exe', args, { stdio: 'ignore', windowsHide: true });
+  child.on('error', () => {});
+  child.unref();
+}
+
 // ---------- steering ----------
 // Messages typed in the dashboard while Claude isn't waiting for a reply. Hooks only run
 // at events, so they wait here and go out with the next one: after the current tool
@@ -729,6 +773,7 @@ function startRun(s, text, { fresh = false } = {}) {
   child.on('error', (e) => (err = e.message));
   child.on('close', (code) => {
     runners.delete(s.id);
+    releaseRun(s);
     if (code && !child.interrupted) addActivity(s, 'notice', `Claude stopped with an error${err.trim() ? `: ${err.trim()}` : ''}`);
     if (child.interrupted) addActivity(s, 'notice', 'Stopped from Agenter');
     settleStatus(s, 'idle');
@@ -742,6 +787,12 @@ function startRun(s, text, { fresh = false } = {}) {
   return true;
 }
 
+// Ends a turn along with what it started: tools, and hooks still waiting on the dashboard.
+function killRun(child) {
+  if (process.platform !== 'win32') return child.kill();
+  execFile('taskkill', ['/pid', String(child.pid), '/T', '/F'], { windowsHide: true }, (err) => err && child.kill());
+}
+
 // ---------- steering Codex ----------
 // Driven from the Codex app (default): `codex queue` hands the message to Codex, which runs
 // it as the next turn of that session in the VS Code extension or the desktop app.
@@ -780,22 +831,37 @@ function findCodex() {
   return null;
 }
 
+// Windows only runs a .cmd through a shell, which would treat your message as commands.
+// npm's codex.cmd just starts a script with Node, so start that script directly.
+function codexCommand(bin) {
+  if (!bin.endsWith('.cmd')) return [bin];
+  try {
+    const script = fs.readFileSync(bin, 'utf8').match(/"%~?dp0%?[\\/]([^"]+\.js)"/i)?.[1];
+    if (script) return [process.execPath, path.join(path.dirname(bin), script)];
+  } catch {}
+  return null;
+}
+
 async function steerCodex(s, text) {
+  // A turn Agenter is running keeps the session here, even if the switch moved since it started.
+  if (runners.has(s.id)) {
+    // `exec` can't take messages mid-turn; this runs as the next turn.
+    s.queue.push({ id: crypto.randomUUID(), text, t: Date.now() });
+    broadcast();
+    return 'queued';
+  }
   if (driveOf(s) === 'agenter') {
-    if (runners.has(s.id)) {
-      // `exec` can't take messages mid-turn; this runs as the next turn.
-      s.queue.push({ id: crypto.randomUUID(), text, t: Date.now() });
-      broadcast();
-      return 'queued';
-    }
     if (!(await startCodexRun(s, text))) return 'no-codex';
     addActivity(s, 'prompt', text, { fromDashboard: true });
     return 'started';
   }
   const bin = findCodex();
   if (!bin) return 'no-codex';
+  const command = codexCommand(bin);
+  if (!command) return 'error';
+  const [file, ...prefix] = command;
   return new Promise((resolve) => {
-    execFile(bin, ['queue', '--thread', s.id, '--message', text], { windowsHide: true, timeout: 30000, shell: bin.endsWith('.cmd') }, (err) => {
+    execFile(file, [...prefix, 'queue', '--thread', s.id, '--message', text], { windowsHide: true, timeout: 30000 }, (err) => {
       if (err) return resolve('error');
       addActivity(s, 'prompt', text, { fromDashboard: true });
       resolve('codex-queued');
@@ -849,6 +915,7 @@ function startCodexRun(s, text, { fresh = false } = {}) {
       // Never got going (Codex missing a login, bad folder…): report why to whoever asked.
       if (runners.get(s.id) !== child) return resolve(fresh ? { error: failure || err.trim().split('\n').pop() || `Codex exited (${code}).` } : false);
       runners.delete(s.id);
+      releaseRun(s);
       s.codexTurnOpen = false;
       if ((code || failure) && !child.interrupted) addActivity(s, 'notice', `Codex stopped with an error${failure || err.trim() ? `: ${failure || err.trim().split('\n').pop()}` : ''}`);
       if (child.interrupted) addActivity(s, 'notice', 'Stopped from Agenter');
@@ -994,11 +1061,29 @@ const json = (res, code, obj) => {
 const STATIC = {
   '/': ['index.html', 'text/html; charset=utf-8'],
   '/app.js': ['app.js', 'text/javascript; charset=utf-8'],
+  '/theme.js': ['theme.js', 'text/javascript; charset=utf-8'],
   '/style.css': ['style.css', 'text/css; charset=utf-8'],
   '/icon.png': ['icon.png', 'image/png'],
   '/favicon.ico': ['agenter.ico', 'image/x-icon'],
 };
 
+// frame-src stays open for http(s): Preview shows whatever app address you type.
+const CSP = [
+  "default-src 'none'",
+  "script-src 'self'",
+  "style-src-elem 'self' https://fonts.googleapis.com",
+  "style-src-attr 'unsafe-inline'",
+  'font-src https://fonts.gstatic.com',
+  "img-src 'self' data:",
+  "connect-src 'self'",
+  'frame-src http: https:',
+  "base-uri 'none'",
+  "form-action 'none'",
+  "frame-ancestors 'none'",
+].join('; ');
+
+const TOKEN = require.main === module ? getToken() : '';
+
 const ALLOWED_HOSTS = new Set([`127.0.0.1:${PORT}`, `localhost:${PORT}`]);
 const ALLOWED_ORIGINS = new Set([...ALLOWED_HOSTS].map((h) => `http://${h}`));
 
@@ -1008,6 +1093,10 @@ const server = http.createServer(async (req, res) => {
     return json(res, 403, { error: 'forbidden' });
   }
   const url = new URL(req.url, `http://${req.headers.host}`);
+  // The page itself holds no secrets. Everything else needs the token; a custom header also
+  // forces a CORS preflight, which we never approve. EventSource can't set headers.
+  const given = req.headers['x-agenter-token'] ?? (url.pathname === '/events' ? url.searchParams.get('token') : null);
+  if (!(req.method === 'GET' && STATIC[url.pathname]) && !sameToken(given, TOKEN)) return json(res, 401, { error: 'unauthorized' });
 
   try {
     if (req.method === 'POST' && url.pathname === '/hook') {
@@ -1016,7 +1105,7 @@ const server = http.createServer(async (req, res) => {
 
     if (req.method === 'GET' && STATIC[url.pathname]) {
       const [file, type] = STATIC[url.pathname];
-      res.writeHead(200, { 'content-type': type, 'cache-control': 'no-store' });
+      res.writeHead(200, { 'content-type': type, 'cache-control': 'no-store', 'content-security-policy': CSP });
       return res.end(fs.readFileSync(path.join(PUBLIC_DIR, file)));
     }
 
@@ -1053,10 +1142,12 @@ const server = http.createServer(async (req, res) => {
     }
 
     if (req.method === 'POST' && url.pathname.startsWith('/api/')) {
-      // A custom header forces a CORS preflight, which we never approve.
-      if (req.headers['x-agenter'] !== '1') return json(res, 403, { error: 'forbidden' });
       const body = await readBody(req);
 
+      if (url.pathname === '/api/quit') {
+        stopServer();
+        return json(res, 200, {});
+      }
       if (url.pathname === '/api/respond') {
         const s = sessions.get(pending.get(body.id)?.item.sessionId);
         const ok = respond(body.id, body.action, body);
@@ -1138,7 +1229,7 @@ const server = http.createServer(async (req, res) => {
         const child = runners.get(body.sessionId);
         if (child) {
           child.interrupted = true;
-          child.kill();
+          killRun(child);
         }
         return json(res, child ? 200 : 404, {});
       }
@@ -1195,6 +1286,8 @@ if (require.main === module) {
   server.listen(PORT, HOST, () => {
     const url = `http://localhost:${PORT}`;
     console.log(`Agenter dashboard: ${url}`);
+    fs.rmSync(STOPPED_FILE, { force: true });
+    startTray();
     startDiscovery();
     startCodexDiscovery();
     fetchUsage();
@@ -1207,5 +1300,5 @@ module.exports = {
   sessions, pending, clients, runners, dismissed,
   get settings() { return settings; },
   handleHook, hold, respond, steer, takeQueue, touchSession, snapshot, driveOf, effectiveHold,
-  findClaude, findCodex,
+  findClaude, findCodex, codexCommand, releaseRun,
 };