relay-companion 0.1.70 → 0.1.72

package/bin/relay.js

@@ -28,6 +28,7 @@ import { pillStatusPath, waitForPillReady } from "../src/pill-control.js";
 import { liveToolRequirement, requiredLiveHosts, shouldRequireLiveTools } from "../src/setup-activation.js";
 import { openRelay, openTask } from "../src/materializer.js";
 import { runClaudeHook } from "../src/claude-hook.js";
+import { normalizePairingCode, persistPairedAccount } from "../src/account.js";
 import { resetCompanionStateForAccount } from "../src/notifications.js";
 import { finishSetupOpenRelay, normalizeSetupHost, setupOpenRelayToken, setupOpenStatus } from "../src/setup-open.js";
 
@@ -95,8 +96,10 @@ async function cmdPair(flags, { promptForDefaults = true } = {}) {
   }
   writeConfig({ apiUrl: url, webUrl: appUrl });
   const client = new RelayClient({ url });
-  const res = await client.registerDevice({ pairingCode: code, name, platform: process.platform });
-  writeConfig({ apiUrl: url, webUrl: appUrl, deviceToken: res.deviceToken, deviceId: res.deviceId, user: res.user });
+  const res = await client.registerDevice({ pairingCode: normalizePairingCode(code), name, platform: process.platform });
+  // The same persistence the pill's Settings tab uses (src/account.js), so the
+  // stored credential shape can never drift between the two pairing surfaces.
+  persistPairedAccount({ apiUrl: url, webUrl: appUrl, deviceName: name, registration: res });
   resetCompanionStateForAccount({ user: res.user, deviceId: res.deviceId });
   console.log(`Paired as ${res.user.name} <${res.user.email}>. This device is now connected to Relay.`);
 }

package/overlay/inbox.html

@@ -647,6 +647,62 @@
   }
   .sent-chip.read { background:rgba(46,160,67,.14); color:#1a7f37; border:1px solid rgba(46,160,67,.28); }
   .sent-chip.unread { background:transparent; color:var(--muted-2); border:1px solid rgba(31,26,23,.18); }
+
+  /* ---- Settings tab ---- */
+  /* The account block is flat content on the sheet, like rows: serif identity,
+     sans metadata, a tinted avatar disc. Depth only ever comes from tint and
+     the reused .open-actions light-built panel — never from borders. */
+  .sv-head { display:flex; align-items:center; justify-content:space-between; padding:10px 16px 8px; }
+  .sv-title { font-family:var(--serif); font-size:16px; font-weight:500; color:var(--ink); }
+  .sv-account { display:flex; align-items:center; gap:12px; padding:4px 16px 0; }
+  .sv-avatar {
+    flex:0 0 auto; width:38px; height:38px; border-radius:50%;
+    background:var(--accent-soft); color:var(--accent);
+    font-size:13px; font-weight:600; letter-spacing:.02em;
+    display:flex; align-items:center; justify-content:center;
+  }
+  .sv-id { min-width:0; display:flex; flex-direction:column; }
+  .sv-name { font-family:var(--serif); font-size:16px; font-weight:500; color:var(--ink); line-height:1.25; white-space:nowrap; overflow:hidden; text-overflow:ellipsis; }
+  .sv-email { font-size:11.5px; color:var(--muted); margin-top:1px; white-space:nowrap; overflow:hidden; text-overflow:ellipsis; }
+  .sv-device { font-size:11px; color:var(--muted-2); margin-top:2px; white-space:nowrap; overflow:hidden; text-overflow:ellipsis; }
+  .sv-copy { padding:2px 16px 0; font-size:12px; line-height:1.5; color:var(--muted); }
+  .sv-actions { margin:14px 12px 0; }
+  /* armed sign-out: the same flat menu row, flipped to the danger ink */
+  .oa-item.sv-signout-armed { color:#b4332a; }
+  .oa-item.sv-signout-armed:hover { background:rgba(180,51,42,.07); }
+  .oa-item.sv-signout-armed:active { background:rgba(180,51,42,.12); }
+  /* inline pairing-code entry: mono, tracked, uppercase — the code is the content */
+  .sv-pair { display:flex; gap:8px; margin:12px 16px 0; align-items:center; }
+  .sv-code {
+    flex:1 1 auto; min-width:0; appearance:none;
+    border:1px solid rgba(31,26,23,.14); border-radius:9px; padding:8px 11px;
+    font-family:var(--mono); font-size:13px; letter-spacing:.14em; text-transform:uppercase;
+    color:var(--ink); background:#fff; outline:none;
+    transition:border-color .15s var(--settle), box-shadow .15s var(--settle);
+  }
+  .sv-code::placeholder { font-family:var(--sans); letter-spacing:0; text-transform:none; color:var(--muted-3); }
+  .sv-code:focus { border-color:rgba(48,85,102,.42); box-shadow:0 0 0 3px rgba(48,85,102,.08); }
+  .sv-connect {
+    flex:0 0 auto; appearance:none; border:0; background:var(--accent); color:#fff;
+    font-family:var(--sans); font-size:12.5px; font-weight:600; padding:8px 15px; border-radius:9px;
+    cursor:pointer; transition:opacity .2s var(--settle);
+  }
+  .sv-connect:hover { opacity:.9; }
+  .sv-connect:disabled { opacity:.4; cursor:default; }
+  .sv-hint { padding:7px 16px 0; font-size:11px; line-height:1.45; color:var(--muted-2); }
+  .sv-err { margin-top:8px; padding:0 16px; }
+  .sv-note { padding:10px 16px 0; font-size:11.5px; color:#1a7f37; line-height:1.4; }
+  .sv-version { padding:20px 16px 12px; font-family:var(--mono); font-size:10.5px; color:var(--muted-3); }
+  /* signed-out call-to-action on the Relays empty state — quiet filled pill (th-count language) */
+  .sv-signin-banner {
+    appearance:none; border:0; cursor:pointer; margin-top:2px;
+    font-family:var(--sans); font-size:12px; font-weight:600; letter-spacing:.01em;
+    color:var(--accent); background:color-mix(in srgb, var(--accent) 9%, transparent);
+    box-shadow:inset 0 0 0 0.5px color-mix(in srgb, var(--accent) 14%, transparent);
+    border-radius:999px; padding:7px 15px;
+    transition:background-color .2s var(--settle);
+  }
+  .sv-signin-banner:hover { background:color-mix(in srgb, var(--accent) 15%, transparent); }
 </style>
 </head>
 <body>
@@ -684,6 +740,7 @@
       </button>
       <button class="tab" type="button" data-view="sent">Sent</button>
       <button class="tab" type="button" data-view="contacts">Contacts</button>
+      <button class="tab" type="button" data-view="settings">Settings</button>
       <button class="mark-all-read gone" id="markAllRead" type="button">Mark all as read</button>
     </nav>
 
@@ -697,6 +754,7 @@
           </svg>
           <div class="t1">No relays yet</div>
           <div class="t2">Questions, results, and notices will land here.</div>
+          <button class="sv-signin-banner gone" id="signInBanner" type="button">Sign in to Relay</button>
         </div>
       </section>
 
@@ -767,6 +825,9 @@
         <div class="cv-list" id="cvList"></div>
         <div id="contactsEmpty" class="cv-empty gone">No contacts yet.<br>Add someone, or your agent saves them as you relay.</div>
       </section>
+
+      <!-- Settings view (account card + sign-out / switch-account; rendered by JS) -->
+      <section class="view hidden" id="settingsView"></section>
     </div>
   </div>
 
@@ -811,6 +872,8 @@
   const thBackEl = document.getElementById("thBack");
   const thDetailNameEl = document.getElementById("thDetailName");
   const thHistoryEl = document.getElementById("thHistory");
+  const settingsViewEl = document.getElementById("settingsView");
+  const signInBannerEl = document.getElementById("signInBanner");
 
   const REDUCED = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   const EXPANDED = { w: 344, h: 524 };
@@ -1432,6 +1495,7 @@
   }
   function openRelayFromUI(id, source = "relay", mode = "open") {
     if (!id || openingIds.has(id)) return;
+    clearRowNote(id); // a previous open's failure text must not outlive the retry
     openingIds.set(id, performance.now());
     for (const el of openingTargets(id)) el.classList.add("opening");
     setTimeout(() => stopOpening(id), 6000); // safety: never spin forever if openDone is missed
@@ -1634,6 +1698,14 @@
     if (el) el.textContent = message || "";
   }
   function cssId(id) { return String(id).replace(/"/g, '\\"'); }
+  // The .row-err slot carries both inline errors and the green injection note, and one
+  // relay can be rendered into more than one list, so wipe every copy of the row's slot.
+  function clearRowNote(id) {
+    for (const el of document.querySelectorAll(`[data-err="${CSS.escape(id)}"]`)) {
+      el.textContent = "";
+      el.classList.remove("ok");
+    }
+  }
 
   async function runRowAction(id, btn, fn) {
     if (!btn || btn.disabled) return;
@@ -2573,6 +2645,201 @@
     applyView();
   }
 
+  // ---------- Settings view ----------
+  // The account card + sign-out / switch-account lifecycle. Renders from its own
+  // relay:accountInfo load (like Contacts), never from inbox pushes, so a typed
+  // pairing code is never rebuilt away mid-entry. Switch/sign-out succeed by
+  // RESTARTING the pill into the new account, so the success note is brief.
+  let settingsInfo = null;      // last relay:accountInfo payload (null while loading)
+  let settingsLoadSeq = 0;
+  let svPairOpen = false;       // inline code-entry row revealed
+  let svDraft = "";             // pairing-code text preserved across re-renders
+  let svBusy = false;           // pair / sign-out in flight
+  let svNote = "";              // success note while the pill restarts
+  let svError = "";
+  let svSignOutArmed = false;
+  let svSignOutTimer = null;
+  let svFocusCodeOnce = false;
+
+  function resetSignOutArm() {
+    svSignOutArmed = false;
+    if (svSignOutTimer) { clearTimeout(svSignOutTimer); svSignOutTimer = null; }
+  }
+  function svPairRowHtml() {
+    return `
+      <div class="sv-pair" data-stop="1">
+        <input class="sv-code" id="svCode" type="text" inputmode="text" autocomplete="off" spellcheck="false"
+          maxlength="16" placeholder="Pairing code" value="${esc(svDraft)}" ${svBusy ? "disabled" : ""} />
+        <button class="sv-connect" type="button" id="svConnect" ${svBusy ? "disabled" : ""}>${svBusy ? "Connecting…" : "Connect"}</button>
+      </div>
+      <div class="sv-hint">Your browser opened the Relay setup page — paste the pairing code it shows.</div>`;
+  }
+  function renderSettings() {
+    if (activeView !== "settings") return;
+    const info = settingsInfo;
+    if (!info) {
+      settingsViewEl.innerHTML = '<div class="td-quiet">Loading account…</div>';
+      return;
+    }
+    let html = "";
+    if (info.paired) {
+      const name = info.name || info.email || "Relay account";
+      html += `
+        <div class="sv-head"><span class="sv-title">Your account.</span></div>
+        <div class="sv-account">
+          <span class="sv-avatar">${esc(cvInitials(info.name, info.email))}</span>
+          <span class="sv-id">
+            <span class="sv-name">${esc(name)}</span>
+            ${info.email ? `<span class="sv-email">${esc(info.email)}</span>` : ""}
+            <span class="sv-device">This device · ${esc(info.deviceName || "")}</span>
+          </span>
+        </div>
+        <div class="open-actions sv-actions" data-stop="1" role="menu">
+          <button class="oa-item oa-primary" type="button" role="menuitem" id="svSwitch" ${svBusy ? "disabled" : ""}>Switch Account…</button>
+          <div class="oa-sep" role="separator"></div>
+          <button class="oa-item${svSignOutArmed ? " sv-signout-armed" : ""}" type="button" role="menuitem" id="svSignOut" ${svBusy ? "disabled" : ""}>${svSignOutArmed ? "Sign Out — click again to confirm" : "Sign Out"}</button>
+        </div>`;
+    } else {
+      html += `
+        <div class="sv-head"><span class="sv-title">Sign in to Relay.</span></div>
+        <div class="sv-copy">This device isn’t connected to an account yet. Sign in from your browser, then enter the pairing code here.</div>
+        <div class="open-actions sv-actions" data-stop="1" role="menu">
+          <button class="oa-item oa-primary" type="button" role="menuitem" id="svSwitch" ${svBusy ? "disabled" : ""}>Sign In to Relay</button>
+        </div>`;
+    }
+    if (svPairOpen) html += svPairRowHtml();
+    if (svNote) html += `<div class="sv-note">${esc(svNote)}</div>`;
+    html += `<div class="row-err sv-err" id="svErr">${esc(svError)}</div>`;
+    html += `<div class="sv-version">${esc(info.version ? `Relay ${info.version}` : "Relay")}</div>`;
+    settingsViewEl.innerHTML = html;
+    wireSettings();
+  }
+  function wireSettings() {
+    for (const z of settingsViewEl.querySelectorAll('[data-stop="1"]')) {
+      z.addEventListener("click", (e) => e.stopPropagation());
+    }
+    const switchEl = document.getElementById("svSwitch");
+    if (switchEl) switchEl.addEventListener("click", beginPairFlow);
+    const signOutEl = document.getElementById("svSignOut");
+    if (signOutEl) signOutEl.addEventListener("click", onSignOutClick);
+    const connectEl = document.getElementById("svConnect");
+    if (connectEl) connectEl.addEventListener("click", submitPairCode);
+    const codeEl = document.getElementById("svCode");
+    if (codeEl) {
+      // Same focusability contract as the contact form / quick reply: the window
+      // may take keyboard focus only while a text field needs it.
+      codeEl.addEventListener("focus", () => { if (window.relay.setFocusable) window.relay.setFocusable(true); });
+      codeEl.addEventListener("blur", () => { if (activeView !== "contacts" && window.relay.setFocusable) window.relay.setFocusable(false); });
+      codeEl.addEventListener("mousedown", () => setInteractive(true));
+      codeEl.addEventListener("input", () => {
+        svDraft = codeEl.value;
+        svError = "";
+        const errEl = document.getElementById("svErr");
+        if (errEl) errEl.textContent = ""; // clear inline, no rebuild mid-typing
+      });
+      codeEl.addEventListener("keydown", (ev) => {
+        if (ev.key === "Enter") { ev.preventDefault(); submitPairCode(); }
+      });
+      if (svFocusCodeOnce) {
+        svFocusCodeOnce = false;
+        if (window.relay.setFocusable) window.relay.setFocusable(true);
+        setTimeout(() => codeEl.focus(), 30);
+      }
+    }
+  }
+  // Switch account / sign in: open the pairing page in the browser and reveal
+  // the inline code-entry row in the same motion.
+  function beginPairFlow() {
+    if (svBusy) return;
+    resetSignOutArm();
+    svError = "";
+    svNote = "";
+    svPairOpen = true;
+    svFocusCodeOnce = true;
+    if (window.relay.openUrl) window.relay.openUrl((settingsInfo && settingsInfo.setupPath) || "/app/setup");
+    renderSettings();
+  }
+  async function submitPairCode() {
+    if (svBusy) return;
+    const codeEl = document.getElementById("svCode");
+    const code = (codeEl ? codeEl.value : svDraft).trim();
+    if (!code) {
+      svError = "Enter the pairing code from your browser.";
+      renderSettings();
+      return;
+    }
+    svBusy = true;
+    svError = "";
+    renderSettings();
+    let res = null;
+    try {
+      res = await window.relay.pairWithCode({ code });
+    } catch (err) {
+      res = { ok: false, error: (err && err.message) || "Could not connect this device." };
+    }
+    svBusy = false;
+    if (res && res.ok) {
+      svDraft = "";
+      svPairOpen = false;
+      svNote = res.email ? `Connected as ${res.email} — restarting Relay…` : "Connected — restarting Relay…";
+    } else {
+      svError = (res && res.error) || "Could not connect this device.";
+    }
+    renderSettings();
+  }
+  // Sign out is destructive-ish (this device stops receiving relays), so the
+  // button arms on the first click and only a second click within 4s commits.
+  async function onSignOutClick() {
+    if (svBusy) return;
+    if (!svSignOutArmed) {
+      svSignOutArmed = true;
+      if (svSignOutTimer) clearTimeout(svSignOutTimer);
+      svSignOutTimer = setTimeout(() => {
+        svSignOutTimer = null;
+        svSignOutArmed = false;
+        renderSettings();
+      }, 4000);
+      renderSettings();
+      return;
+    }
+    resetSignOutArm();
+    svBusy = true;
+    svError = "";
+    svNote = "";
+    renderSettings();
+    let res = null;
+    try {
+      res = await window.relay.signOut();
+    } catch (err) {
+      res = { ok: false, error: (err && err.message) || "Could not sign out." };
+    }
+    svBusy = false;
+    if (res && res.ok) svNote = "Signed out — restarting Relay…";
+    else svError = (res && res.error) || "Could not sign out.";
+    renderSettings();
+  }
+  async function loadSettings() {
+    const seq = ++settingsLoadSeq;
+    let info = null;
+    try {
+      info = window.relay.accountInfo ? await window.relay.accountInfo() : null;
+    } catch {}
+    if (seq !== settingsLoadSeq) return; // navigated / reloaded while fetching
+    const prevSig = JSON.stringify(settingsInfo);
+    settingsInfo = info && info.ok !== false ? info : { paired: false, name: "", email: "", deviceName: "", version: "" };
+    // Unchanged info: leave the DOM alone so a focused code input (and its
+    // caret) survives the refresh that happens on every visit to the tab.
+    if (JSON.stringify(settingsInfo) !== prevSig) renderSettings();
+  }
+  if (signInBannerEl) signInBannerEl.addEventListener("click", (e) => {
+    e.stopPropagation();
+    activeView = "settings";
+    syncTabs();
+    applyView();
+    renderAll();
+    beginPairFlow(); // the banner IS the sign-in affordance: browser + code row
+  });
+
   // ---------- views / tabs ----------
   function syncTabs() {
     // taskDetail belongs to Sent; the thread-detail view belongs to Relays —
@@ -2586,6 +2853,13 @@
     sentViewEl.classList.toggle("hidden", activeView !== "sent");
     taskDetailViewEl.classList.toggle("hidden", activeView !== "taskDetail");
     contactsViewEl.classList.toggle("hidden", activeView !== "contacts");
+    settingsViewEl.classList.toggle("hidden", activeView !== "settings");
+    if (activeView === "settings") {
+      renderSettings(); // paint immediately from the last known info…
+      loadSettings();   // …then refresh it from config
+    } else {
+      resetSignOutArm(); // leaving the view disarms the confirm state
+    }
     if (activeView === "threads") {
       // Entered only by clicking a conversation row (threadDetailId set there).
       renderThreads();
@@ -2621,6 +2895,10 @@
 
   function renderAll() {
     syncDismissControl();
+    // Signed out: the Relays empty state carries a slim sign-in affordance.
+    if (signInBannerEl) {
+      signInBannerEl.classList.toggle("gone", !payload.account || payload.account.paired !== false);
+    }
     // Relays badge/count reflect only the items that show in the Relays tab
     // (the clean split keeps task_request / share_approval out of this count).
     const unread = (payload.relays || []).filter((r) => r.unread && isRelayListKind(r)).length;
@@ -2711,6 +2989,16 @@
       }, 12000));
     }
   });
+  // An open that failed leaves the relay UNREAD on purpose (it never reached the user),
+  // so the row has to say what happened — otherwise the spinner just stops and the click
+  // looks like it worked. Cleared by the next open of the same row.
+  if (window.relay.onOpenError) window.relay.onOpenError((id, message) => {
+    if (!message) return;
+    for (const el of document.querySelectorAll(`[data-err="${CSS.escape(id)}"]`)) {
+      el.classList.remove("ok");
+      el.innerHTML = esc(message);
+    }
+  });
   window.relay.refresh().then((p) => {
     onPayload(p);
     console.log("[overlay] booted ok, relays=" + (p && p.relays ? p.relays.length : 0) + " sent=" + (p && p.sent ? p.sent.length : 0));

package/overlay/main.cjs

@@ -228,6 +228,24 @@ function loadRelayModules() {
   return relayModulesPromise;
 }
 
+// Account lifecycle deps (ESM, lazy like the modules above): src/account.js is
+// the shared pair/sign-out config persistence, src/notifications.js owns the
+// packet-store reset that re-stages the new account's inbox cleanly.
+let accountModulesPromise = null;
+function loadAccountModules() {
+  if (!accountModulesPromise) {
+    const accountUrl = pathToFileURL(path.join(__dirname, "..", "src", "account.js")).href;
+    const notificationsUrl = pathToFileURL(path.join(__dirname, "..", "src", "notifications.js")).href;
+    accountModulesPromise = Promise.all([import(accountUrl), import(notificationsUrl)])
+      .then(([account, notifications]) => ({ account, notifications }))
+      .catch((error) => {
+        accountModulesPromise = null;
+        throw error;
+      });
+  }
+  return accountModulesPromise;
+}
+
 let sentStagerPromise = null;
 function loadSentStager() {
   if (!sentStagerPromise) {
@@ -332,6 +350,118 @@ function account() {
   };
 }
 
+function pillVersion() {
+  try {
+    return String(require("../package.json").version || "");
+  } catch {
+    return "";
+  }
+}
+
+// The Settings account card: who this pill is signed in as, on which device,
+// running which build. deviceName is remembered from pairing when available.
+function accountInfo() {
+  const cfg = readConfigFile();
+  const user = cfg.user || {};
+  return {
+    ok: true,
+    paired: Boolean(deviceToken()),
+    name: user.name || "",
+    email: user.email || "",
+    deviceName: String(cfg.deviceName || "").trim() || os.hostname(),
+    version: pillVersion(),
+    setupPath: "/app/setup",
+  };
+}
+
+// After an account change the daemon must restart into the new credentials, or
+// it keeps polling (and staging) as the OLD account until its next launch.
+function restartCompanionDaemon() {
+  try {
+    let cmd = null;
+    let args = null;
+    if (process.platform === "darwin") {
+      const uid = typeof process.getuid === "function" ? process.getuid() : 501;
+      cmd = "/bin/launchctl";
+      args = ["kickstart", "-k", `gui/${uid}/work.relay.companion`];
+    } else if (process.platform === "win32") {
+      cmd = "cmd";
+      args = ["/c", 'schtasks /End /TN "Relay Companion Daemon" & schtasks /Run /TN "Relay Companion Daemon"'];
+    }
+    if (!cmd) return;
+    const child = spawn(cmd, args, { detached: true, stdio: "ignore" });
+    child.on("error", (error) => console.error("[overlay] daemon restart spawn failed:", error && error.message));
+    child.unref();
+  } catch (error) {
+    console.error("[overlay] daemon restart failed:", error && error.message);
+  }
+}
+
+// Relaunch the pill itself so every cache (sent, contacts, attention queue,
+// renderer state) is rebuilt from the new account. launchd / the Scheduled Task
+// respawns it; app.relaunch() covers a bare `relay pill` run. Delayed a beat so
+// the invoking IPC reply reaches the renderer first.
+function relaunchPillSoon() {
+  setTimeout(() => {
+    try {
+      app.relaunch();
+    } catch (error) {
+      console.error("[overlay] relaunch failed:", error && error.message);
+    }
+    app.exit(0);
+  }, 600);
+}
+
+// Switch account: register this device against the pairing code, persist the
+// fresh credentials with the SAME shape `relay pair` writes, wipe the local
+// packet store for the new account, then restart the daemon and the pill.
+async function pairWithCode(input) {
+  try {
+    const raw = input && typeof input === "object" ? input.code : input;
+    const [{ account: accountMod, notifications }, { RelayClient }] = await Promise.all([
+      loadAccountModules(),
+      loadRelayModules(),
+    ]);
+    const code = accountMod.normalizePairingCode(raw);
+    if (!code) return { ok: false, error: "Enter the pairing code from your browser." };
+    const deviceName = accountMod.deviceNameForPairing(readConfigFile());
+    const client = new RelayClient();
+    const res = await client.registerDevice({ pairingCode: code, name: deviceName, platform: process.platform });
+    accountMod.persistPairedAccount({ deviceName, registration: res });
+    notifications.resetCompanionStateForAccount(
+      { user: res.user, deviceId: res.deviceId, force: true },
+      { statePath: STATE_PATH },
+    );
+    restartCompanionDaemon();
+    relaunchPillSoon();
+    return { ok: true, email: (res.user && res.user.email) || "" };
+  } catch (error) {
+    const message = error && error.message ? error.message : String(error);
+    console.error("[overlay] pair with code failed:", message);
+    return { ok: false, error: message };
+  }
+}
+
+// Sign out: drop the credentials (keeping URLs + device name), wipe the local
+// packet store, then restart the daemon and the pill into the signed-out state.
+async function signOutAccount() {
+  try {
+    const { account: accountMod, notifications } = await loadAccountModules();
+    accountMod.persistSignedOutAccount();
+    notifications.resetCompanionStateForAccount(
+      { user: null, deviceId: "", force: true },
+      { statePath: STATE_PATH },
+    );
+    restartCompanionDaemon();
+    relaunchPillSoon();
+    return { ok: true };
+  } catch (error) {
+    const message = error && error.message ? error.message : String(error);
+    console.error("[overlay] sign out failed:", message);
+    return { ok: false, error: message };
+  }
+}
+
 // Turn an actionUrl (absolute https, or a relative path) into an absolute URL.
 function absoluteUrl(pathOrUrl) {
   const value = String(pathOrUrl || "").trim();
@@ -546,6 +676,7 @@ async function markAllVisibleRelaysRead() {
 let sentCache = [];
 let sentLoadedOnce = null;
 async function refreshSent() {
+  if (!deviceToken()) return sentCache; // signed out: nothing to fetch, no 401 log storm
   try {
     const client = await relayClient();
     const res = await client.sent();
@@ -569,6 +700,7 @@ async function refreshTasks() {
     tasksCache = [];
     return tasksCache;
   }
+  if (!deviceToken()) return tasksCache; // signed out: skip the poll entirely
   try {
     const client = await relayClient();
     const res = await client.listTasks();
@@ -594,6 +726,7 @@ function ensureTasksLoaded() {
 let contactsCache = [];
 let contactsLoadedOnce = null;
 async function refreshContacts() {
+  if (!deviceToken()) return contactsCache; // signed out: skip the poll entirely
   try {
     const client = await relayClient();
     const res = await client.listContacts();
@@ -1375,6 +1508,95 @@ function openClaudeDeepLinkVerified(url, fallbackUrl, label, { freshlyForged = f
   }, 1000);
 }
 
+// The CLI's `open` prints ONE pretty-printed JSON object on stdout and sends every
+// log line to stderr, so a plain parse should suffice — but a single stray stdout
+// line (a Node warning, a dep's console.log) used to turn a SUCCESSFUL open into a
+// browser fallback, so recover by slicing the outermost {...} instead of giving up.
+function parseOpenResult(out) {
+  const text = String(out || "").trim();
+  const read = (raw) => {
+    const parsed = JSON.parse(raw);
+    return {
+      url: parsed.url || null,
+      skipExternalOpen: Boolean(parsed.skipExternalOpen),
+      freshlyForged: Boolean(parsed.claudeFreshlyForged),
+    };
+  };
+  try {
+    return read(text);
+  } catch {}
+  const start = text.indexOf("{");
+  const end = text.lastIndexOf("}");
+  if (start >= 0 && end > start) {
+    try {
+      return read(text.slice(start, end + 1));
+    } catch {}
+  }
+  return { url: null, skipExternalOpen: false, freshlyForged: false };
+}
+
+// Both stdout and stderr in the failure log: a Windows field report where stdout
+// was empty is the whole reason the "exit" -> "close" fix below exists.
+function tailFor(stream) {
+  return String(stream || "").trim().split("\n").slice(-2).join(" | ");
+}
+
+// Whether the `relay claude-hook` runtime is registered in ~/.claude/settings.json.
+// "Open in current chat" stages a file that ONLY that runtime consumes, so without
+// it the click is a silent no-op. Loaded lazily like the modules above (install.js
+// is ESM; this overlay is CommonJS).
+let claudeHooksModulePromise = null;
+function loadClaudeHooksModule() {
+  if (!claudeHooksModulePromise) {
+    const installUrl = pathToFileURL(path.join(__dirname, "..", "src", "install.js")).href;
+    claudeHooksModulePromise = import(installUrl).catch((error) => {
+      claudeHooksModulePromise = null;
+      throw error;
+    });
+  }
+  return claudeHooksModulePromise;
+}
+
+// A missing or unparseable settings file counts as NOT installed: staging into a
+// machine with no hook runtime is worse than a fresh open, so fail closed.
+function claudeHooksInstalled(install) {
+  let settings;
+  try {
+    settings = JSON.parse(fs.readFileSync(install.claudeSettingsPath(), "utf8")) || {};
+  } catch {
+    return false;
+  }
+  const hooks = settings.hooks;
+  if (!hooks || typeof hooks !== "object" || Array.isArray(hooks)) return false;
+  for (const entries of Object.values(hooks)) {
+    for (const entry of Array.isArray(entries) ? entries : []) {
+      for (const hook of entry && Array.isArray(entry.hooks) ? entry.hooks : []) {
+        if (install.isRelayClaudeHookCommand(hook && hook.command)) return true;
+      }
+    }
+  }
+  return false;
+}
+
+// Register the claude-hook runtime for FUTURE Claude sessions (idempotent; it preserves
+// every user hook). installClaudeHooks defaults its node to process.execPath, which under
+// Electron is the OVERLAY binary — a hook command Claude could never run, and one that
+// would make the presence check above pass forever. So resolve a real node first and skip
+// the repair entirely when the machine has none.
+function repairClaudeHooks(install) {
+  execFile(process.platform === "win32" ? "where" : "/usr/bin/which", ["node"], (error, out) => {
+    const node = String(out || "").split("\n")[0].trim();
+    if (error || !node) {
+      console.error("[overlay] cannot register the claude-hook runtime: no node found on PATH");
+      return;
+    }
+    const result = install.installClaudeHooks(undefined, install.stableNodePath(node));
+    if (!result || !result.ok) {
+      console.error("[overlay] claude-hook registration failed:", (result && result.reason) || "unknown");
+    }
+  });
+}
+
 // Click-to-open a Relay row. A relay materializes a REAL native agent session
 // inside the already-running foregrounded host (Claude Desktop or Codex) via the
 // companion CLI's `open` command, so it appears in that app's recents rail. The
@@ -1404,20 +1626,29 @@ async function openPacket(packetId, { sent = false, fresh = false } = {}) {
   }
   const row = rowById(materializationId);
   if (win && !win.isDestroyed()) win.webContents.send("opening", packetId);
-  const finish = () => {
+  // Ack marks the row read AND drops it from the attention queue, so a relay that
+  // never reached the user must NOT be acked — otherwise a failed click silently
+  // retires the notification. The spinner stop, in contrast, owes every path.
+  const finishOpened = () => {
     if (!sent) ackPacket(packetId);
     if (win && !win.isDestroyed()) win.webContents.send("openDone", packetId); // stop the row spinner
   };
+  const finishFailed = (message) => {
+    if (win && !win.isDestroyed()) {
+      if (message) win.webContents.send("openError", packetId, message);
+      win.webContents.send("openDone", packetId);
+    }
+  };
   if (!TASK_FEATURES_ALLOWED && (row?.taskId || isRelayTaskWebTarget(row?.actionUrl))) {
     console.error("[overlay] refusing to open a Relay Task in messages-only mode:", packetId);
-    return finish();
+    return finishFailed();
   }
-  if (process.env.RELAY_OVERLAY_TEST_NO_HOST_OPEN === "1") return finish();
+  if (process.env.RELAY_OVERLAY_TEST_NO_HOST_OPEN === "1") return finishOpened();
   if (row && row.relayNotificationKind === "connector_reauth") {
     shell
       .openExternal(`${webBase()}/app/connectors`)
       .catch((error) => console.error("[overlay] open failed:", error && error.message));
-    return finish();
+    return finishOpened();
   }
   frontmostBundleId((bundle) => {
     const host = resolveClickHost(bundle);
@@ -1446,16 +1677,11 @@ async function openPacket(packetId, { sent = false, fresh = false } = {}) {
     let err = "";
     child.stdout.on("data", (data) => (out += data));
     child.stderr.on("data", (data) => (err += data));
-    child.on("exit", (code) => {
-      let url = null;
-      let skipExternalOpen = false;
-      let freshlyForged = false;
-      try {
-        const parsed = JSON.parse(out.trim());
-        url = parsed.url || null;
-        skipExternalOpen = Boolean(parsed.skipExternalOpen);
-        freshlyForged = Boolean(parsed.claudeFreshlyForged);
-      } catch {}
+    // "close", never "exit": on Windows "exit" routinely fires BEFORE the stdout pipe
+    // drains, so `out` was empty, the parse failed, and a perfectly successful open was
+    // routed to the web fallback — the user got a browser instead of Claude.
+    child.on("close", (code) => {
+      const { url, skipExternalOpen, freshlyForged } = parseOpenResult(out);
       if (url || skipExternalOpen) {
         // Raise the host so the relay is visible, whichever open path ran (Claude deep
         // link, Codex bridge, or a plain url). This is the fix for "opened in the right
@@ -1469,6 +1695,7 @@ async function openPacket(packetId, { sent = false, fresh = false } = {}) {
             shell.openExternal(url).catch((error) => console.error("[overlay] openExternal failed:", error && error.message));
           }
         }
+        finishOpened();
       } else {
         console.error(
           "[overlay] open failed for",
@@ -1477,22 +1704,25 @@ async function openPacket(packetId, { sent = false, fresh = false } = {}) {
           host,
           "code",
           code,
+          "stdout:",
+          tailFor(out),
           "stderr:",
-          err.trim().split("\n").slice(-2).join(" | "),
+          tailFor(err),
         );
-        // Last-resort web fallback so the click is never a dead end.
+        // Last-resort web fallback so the click is never a dead end — but the relay
+        // did not open where it was meant to, so it stays unread and in the queue.
         const target = row && row.taskId
           ? taskWebUrl(row.taskId)
           : row && row.actionUrl
             ? absoluteUrl(row.actionUrl)
             : webBase();
         shell.openExternal(target).catch((e) => console.error("[overlay] web fallback failed:", e && e.message));
+        finishFailed("Couldn't open in Claude — opened on the web instead.");
       }
-      finish();
     });
     child.on("error", (error) => {
       console.error("[overlay] open spawn error:", error && error.message);
-      finish();
+      finishFailed("Couldn't open — Relay's open helper failed to start.");
     });
   });
 }
@@ -1594,22 +1824,50 @@ async function openPacketInCurrent(packetId) {
       }
     }
     if (!target) return fallbackFresh();
-    try {
-      claudeInject.stageInjection(RELAY_HOME, target.sessionId, {
-        relayId: packetId,
-        senderName: row.senderName || "",
-        title: row.title || row.displayTitle || "",
-        ...threadInfoFor(row),
-      });
-    } catch (error) {
-      console.error("[overlay] claude injection staging failed:", error && error.message);
-      return fallbackFresh();
-    }
-    // Raise Claude Desktop so the user watches the instruction land; a
-    // terminal-only session stays where it is (its window is not ours to raise).
-    if (target.source === "desktop") activateHost("claude", bundle);
-    confirmInjected("claude");
-    finish();
+    const stageNow = () => {
+      try {
+        claudeInject.stageInjection(RELAY_HOME, target.sessionId, {
+          relayId: packetId,
+          senderName: row.senderName || "",
+          title: row.title || row.displayTitle || "",
+          ...threadInfoFor(row),
+        });
+      } catch (error) {
+        console.error("[overlay] claude injection staging failed:", error && error.message);
+        return fallbackFresh();
+      }
+      // Raise Claude Desktop so the user watches the instruction land; a
+      // terminal-only session stays where it is (its window is not ours to raise).
+      if (target.source === "desktop") activateHost("claude", bundle);
+      confirmInjected("claude");
+      finish();
+    };
+    // NOTHING but the `relay claude-hook` runtime registered in ~/.claude/settings.json
+    // ever reads the staged file. Where setup never wrote those hooks (Windows installs
+    // where the `claude` CLI isn't on PATH — see src/install.js runSetupInstall) staging
+    // succeeds and the click is a silent, acked no-op. Check before staging. Two-arg
+    // then, not .catch: a throw out of stageNow must not re-enter the failure handler
+    // and finish the click twice.
+    loadClaudeHooksModule().then(
+      (install) => {
+        if (claudeHooksInstalled(install)) return stageNow();
+        // Repair for FUTURE sessions — but a Claude session that is already running
+        // loaded its hooks at startup and will never consume a file staged now, so this
+        // click has to take the fresh-open path, the only one that actually shows the
+        // relay. No ack here: openPacket owns the read state for the fresh open.
+        console.error(
+          "[overlay] claude-hook runtime not registered in",
+          install.claudeSettingsPath(),
+          "— 'Open in current chat' would have been a silent no-op; installing it for future sessions and opening a fresh chat instead (restart Claude to use it)",
+        );
+        repairClaudeHooks(install);
+        fallbackFresh();
+      },
+      (error) => {
+        console.error("[overlay] claude-hook runtime check failed:", error && error.message);
+        fallbackFresh();
+      },
+    );
   });
 }
 
@@ -1645,16 +1903,10 @@ function openTaskDetail(taskId) {
     let err = "";
     child.stdout.on("data", (data) => (out += data));
     child.stderr.on("data", (data) => (err += data));
-    child.on("exit", (code) => {
-      let url = null;
-      let skipExternalOpen = false;
-      let freshlyForged = false;
-      try {
-        const parsed = JSON.parse(out.trim());
-        url = parsed.url || null;
-        skipExternalOpen = Boolean(parsed.skipExternalOpen);
-        freshlyForged = Boolean(parsed.claudeFreshlyForged);
-      } catch {}
+    // "close", never "exit" — same Windows stdout-drain race as openPacket: an empty
+    // parse used to send a successful task open to the browser.
+    child.on("close", (code) => {
+      const { url, skipExternalOpen, freshlyForged } = parseOpenResult(out);
       if (url || skipExternalOpen) {
         activateHost(host, bundle); // raise the host so the opened task is visible
         if (url && !skipExternalOpen) {
@@ -1672,8 +1924,10 @@ function openTaskDetail(taskId) {
           host,
           "code",
           code,
+          "stdout:",
+          tailFor(out),
           "stderr:",
-          err.trim().split("\n").slice(-2).join(" | "),
+          tailFor(err),
         );
         // Last-resort web fallback so the click is never a dead end.
         shell
@@ -1696,6 +1950,12 @@ function openUrlTarget(url) {
     return;
   }
   const target = absoluteUrl(url);
+  // Sandboxed harness runs must never pop the user's real browser (the same
+  // contract that keeps them from launching Claude/Codex).
+  if (process.env.RELAY_OVERLAY_TEST_NO_HOST_OPEN === "1") {
+    console.error("[overlay] test seam: suppressed external open:", target);
+    return;
+  }
   shell.openExternal(target).catch((error) => console.error("[overlay] open failed:", error && error.message));
 }
 
@@ -1704,7 +1964,21 @@ function openUrlTarget(url) {
 function anchorTopRight() {
   const display = screen.getDisplayNearestPoint(screen.getCursorScreenPoint()) || screen.getPrimaryDisplay();
   const wa = display.workArea;
-  return { x: wa.x + wa.width - WIN.width - MARGIN, y: wa.y + MARGIN, width: WIN.width, height: WIN.height };
+  const anchor = { x: wa.x + wa.width - WIN.width - MARGIN, y: wa.y + MARGIN, width: WIN.width, height: WIN.height };
+  if (process.env.RELAY_OVERLAY_TEST === "1") {
+    // Sandboxed harness runs must never materialize under the user's parked
+    // cursor: a pointer resting on the card holds notifications open BY DESIGN
+    // (macOS banners do the same), which would wedge every dwell-based scenario
+    // when the mouse happens to sit in the top-right corner. Flip the sandbox
+    // window to the opposite edge instead. Production placement is unchanged.
+    try {
+      const p = screen.getCursorScreenPoint();
+      const overlaps =
+        p.x >= anchor.x && p.x < anchor.x + anchor.width && p.y >= anchor.y && p.y < anchor.y + anchor.height;
+      if (overlaps) anchor.x = wa.x + MARGIN;
+    } catch {}
+  }
+  return anchor;
 }
 
 // Show the overlay window. Electron's forwarded-mousemove stream (the thing that
@@ -1834,6 +2108,12 @@ let hitTimer = null;
 let hitIgnoring = true; // mirrors the last setIgnoreMouseEvents call
 let hitHover = false;
 let lastHostProbeAt = 0;
+// Harness seam: a sandboxed e2e run shares the screen with the user's REAL
+// mouse, and a pointer that happens to rest on the card rect legitimately
+// holds notifications open (the macOS-banner rule) — wedging every dwell-based
+// scenario. The harness drives only synthetic input, so in this mode the hit
+// test ignores the physical cursor entirely. Never set outside the harness.
+const HIT_TEST_POINTER_BLIND = process.env.RELAY_OVERLAY_TEST_IGNORE_POINTER === "1";
 
 function applyIgnore(next) {
   if (next === hitIgnoring) return;
@@ -1874,6 +2154,14 @@ function scheduleHit(ms) {
 function hitTick() {
   hitTimer = null;
   if (!win || win.isDestroyed()) return;
+  if (HIT_TEST_POINTER_BLIND) {
+    // Interactive everywhere, hover never asserted: synthetic-input runs must
+    // not have their dwell/fold behavior steered by the user's parked mouse.
+    applyIgnore(false);
+    applyHover(false);
+    scheduleHit(POLL_HIDDEN_MS);
+    return;
+  }
   if (!win.isVisible()) {
     // A hidden window must never hold clicks, and must not cost a cursor read.
     applyIgnore(true);
@@ -1949,7 +2237,10 @@ function createWindow() {
     },
   });
 
-  win.setAlwaysOnTop(true, "floating");
+  // Windows strips WS_EX_TOPMOST from a scheduled-task-launched overlay that only asks
+  // politely ("floating"); "screen-saver" is the level that survives. The periodic
+  // re-assert that recovers from later demotions lives in space-presence.cjs.
+  win.setAlwaysOnTop(true, process.platform === "win32" ? "screen-saver" : "floating");
   win.setVisibleOnAllWorkspaces(true, { visibleOnFullScreen: true });
   // Empty canvas is click-through; startHitTest() below owns this from here on.
   win.setIgnoreMouseEvents(true, { forward: true });
@@ -2291,6 +2582,11 @@ ipcMain.handle("relay:contacts", () => readContacts());
 ipcMain.handle("relay:contactSave", (_e, input) => saveContact(input));
 ipcMain.handle("relay:contactDelete", (_e, input) => deleteContactFromBook(input));
 
+// Settings tab: account card + the sign-out / switch-account lifecycle.
+ipcMain.handle("relay:accountInfo", () => accountInfo());
+ipcMain.handle("relay:pairWithCode", (_e, input) => pairWithCode(input));
+ipcMain.handle("relay:signOut", () => signOutAccount());
+
 // The overlay is normally focusable:false so it never steals keyboard focus from
 // Claude/Codex. Text fields (the contact form, quick reply) need focus, so the renderer
 // asks us to grant it while a field is open and revoke it the moment the form closes.

package/overlay/preload.cjs

@@ -8,6 +8,9 @@ contextBridge.exposeInMainWorld("relay", {
   // "Open in current chat" staged an injection: the UI confirms it so the
   // click has visible feedback (delivery is checkpoint-based, not instant).
   onInjected: (cb) => ipcRenderer.on("injected", (_e, id, info) => cb(id, info || {})),
+  // The open failed (CLI error / helper wouldn't spawn). The row stays unread, so
+  // say why inline instead of letting the spinner just stop.
+  onOpenError: (cb) => ipcRenderer.on("openError", (_e, id, message) => cb(id, message || "")),
   onOpenFull: (cb) => ipcRenderer.on("openFull", () => cb()), // status-area icon clicked
   onShown: (cb) => ipcRenderer.on("shown", () => cb()), // window re-shown; reset hover handshake
 
@@ -43,6 +46,11 @@ contextBridge.exposeInMainWorld("relay", {
   contactSave: (input) => ipcRenderer.invoke("relay:contactSave", input),
   contactDelete: (input) => ipcRenderer.invoke("relay:contactDelete", input),
 
+  // settings / account (switch + sign-out relaunch the pill on success)
+  accountInfo: () => ipcRenderer.invoke("relay:accountInfo"),
+  pairWithCode: (input) => ipcRenderer.invoke("relay:pairWithCode", input),
+  signOut: () => ipcRenderer.invoke("relay:signOut"),
+
 
   // window plumbing
   setFocusable: (v) => ipcRenderer.send("relay:setFocusable", v),

package/overlay/space-presence.cjs

@@ -18,22 +18,40 @@ function resetWindowZoom(win) {
   return true;
 }
 
-function reinforceSpacePresence(win, { moveTop = false } = {}) {
+function reinforceSpacePresence(win, { moveTop = false, platform = process.platform } = {}) {
   if (!isUsableWindow(win)) return false;
   resetWindowZoom(win);
-  // Only touch window-server state that actually drifted. Re-asserting
-  // setVisibleOnAllWorkspaces / setAlwaysOnTop unconditionally (every 1.5s poll +
-  // every Space change) reorders the window each time and reads as flicker.
-  try {
-    if (typeof win.isVisibleOnAllWorkspaces !== "function" || !win.isVisibleOnAllWorkspaces()) {
-      win.setVisibleOnAllWorkspaces(true, { visibleOnFullScreen: true });
-    }
-  } catch {}
-  try {
-    if (typeof win.isAlwaysOnTop !== "function" || !win.isAlwaysOnTop()) {
-      win.setAlwaysOnTop(true, "floating");
-    }
-  } catch {}
+  const isWindows = platform === "win32";
+  // All-Spaces is a macOS Spaces concept. On Windows isVisibleOnAllWorkspaces()
+  // always reports false, so the drift check below re-called the setter on every
+  // 1.5s poll for nothing.
+  if (!isWindows) {
+    // Only touch window-server state that actually drifted. Re-asserting
+    // setVisibleOnAllWorkspaces / setAlwaysOnTop unconditionally (every 1.5s poll +
+    // every Space change) reorders the window each time and reads as flicker.
+    try {
+      if (typeof win.isVisibleOnAllWorkspaces !== "function" || !win.isVisibleOnAllWorkspaces()) {
+        win.setVisibleOnAllWorkspaces(true, { visibleOnFullScreen: true });
+      }
+    } catch {}
+  }
+  if (isWindows) {
+    // Re-assert unconditionally: Electron's isAlwaysOnTop() is a cached flag from
+    // its own last setAlwaysOnTop call and cannot observe the OS stripping
+    // WS_EX_TOPMOST (scheduled-task-launched windows come up without it and sink
+    // behind maximized windows). Trusting the getter made the repair a permanent
+    // no-op. SetWindowPos-to-topmost on an already-topmost window is not a visible
+    // reorder here, so the macOS flicker rationale above does not apply.
+    try {
+      win.setAlwaysOnTop(true, "screen-saver");
+    } catch {}
+  } else {
+    try {
+      if (typeof win.isAlwaysOnTop !== "function" || !win.isAlwaysOnTop()) {
+        win.setAlwaysOnTop(true, "floating");
+      }
+    } catch {}
+  }
   // moveTop is macOS orderWindow:NSWindowAbove — on a HIDDEN window that orders it
   // back on-screen. That made the dismissed pill flash on every Space switch (shown
   // here, then hidden again by the visibility sync). Raising only means anything

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "relay-companion",
-  "version": "0.1.70",
+  "version": "0.1.72",
   "description": "Relay companion for ordinary messages, with dormant coordination features available only by explicit opt-in.",
   "type": "module",
   "bin": {

package/src/account.js

@@ -0,0 +1,65 @@
+import os from "node:os";
+import { readConfig, writeConfigObject } from "./config.js";
+
+/**
+ * Account lifecycle for the companion: the ONE config-write shape shared by
+ * `relay pair` (bin/relay.js cmdPair) and the pill's Settings tab, so switching
+ * accounts from either surface persists identical credentials. The pure shapes
+ * are exported separately from the fs-touching persist helpers for unit tests.
+ */
+
+/**
+ * Pairing codes are 8 chars from an unambiguous uppercase alphabet
+ * (services/devices.ts). The server only trims + uppercases, so typed
+ * "abcd-efgh" / "ABCD EFGH" variants are folded here before the request.
+ */
+export function normalizePairingCode(raw) {
+  return String(raw ?? "")
+    .replace(/[\s-]+/g, "")
+    .toUpperCase();
+}
+
+/** The device name a re-pair should register: the remembered one, else the hostname. */
+export function deviceNameForPairing(config = readConfig()) {
+  const stored = String((config && config.deviceName) || "").trim();
+  return stored || os.hostname();
+}
+
+/**
+ * The post-registration config: everything the old config had, plus the fresh
+ * credentials. apiUrl/webUrl/deviceName are only written when explicitly given
+ * (the pill switches accounts without touching the URLs it was launched with).
+ */
+export function pairedAccountConfig(existing, { apiUrl, webUrl, deviceName, registration } = {}) {
+  const res = registration || {};
+  return {
+    ...(existing || {}),
+    ...(apiUrl ? { apiUrl } : {}),
+    ...(webUrl ? { webUrl } : {}),
+    ...(deviceName ? { deviceName } : {}),
+    deviceToken: res.deviceToken || "",
+    deviceId: res.deviceId || "",
+    user: res.user || null,
+  };
+}
+
+/**
+ * Sign-out clears the credential set — user, deviceToken, and the deviceId that
+ * belongs to that token — while preserving apiUrl/webUrl, the device name, the
+ * companion mode, and any other settings on the file.
+ */
+export function signedOutAccountConfig(existing) {
+  const next = { ...(existing || {}) };
+  delete next.user;
+  delete next.deviceToken;
+  delete next.deviceId;
+  return next;
+}
+
+export function persistPairedAccount({ apiUrl, webUrl, deviceName, registration } = {}) {
+  return writeConfigObject(pairedAccountConfig(readConfig(), { apiUrl, webUrl, deviceName, registration }));
+}
+
+export function persistSignedOutAccount() {
+  return writeConfigObject(signedOutAccountConfig(readConfig()));
+}

package/src/config.js

@@ -23,7 +23,9 @@ export function configDir() {
 }
 
 export function configPath() {
-  return path.join(configDir(), "config.json");
+  // RELAY_CONFIG (a full file path) matches the overlay's readConfigFile
+  // resolution, so a sandboxed pill and these helpers agree on ONE file.
+  return process.env.RELAY_CONFIG || path.join(configDir(), "config.json");
 }
 
 export function readConfig() {
@@ -51,19 +53,25 @@ export function readConfig() {
   }
 }
 
-export function writeConfig(patch) {
-  const dir = configDir();
-  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-  const next = { ...readConfig(), ...patch };
+/**
+ * Replace config.json with exactly `next` (no merge). This is the primitive that
+ * lets sign-out REMOVE keys — writeConfig's patch merge can only add or overwrite.
+ */
+export function writeConfigObject(next) {
+  const file = configPath();
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
   // Atomic write: a crash mid-write must not truncate config.json and wipe the
   // device token (which would put the daemon into a launchd crash loop).
-  const file = configPath();
   const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
   fs.writeFileSync(tmp, JSON.stringify(next, null, 2), { mode: 0o600 });
   fs.renameSync(tmp, file);
   return next;
 }
 
+export function writeConfig(patch) {
+  return writeConfigObject({ ...readConfig(), ...patch });
+}
+
 export function apiUrl() {
   return (
     process.env.RELAY_API_URL ||

package/src/install.js

@@ -501,6 +501,21 @@ export function claudeSettingsPath() {
   );
 }
 
+/**
+ * True when Claude looks present on this machine, judged ONLY by the directory
+ * that holds claudeSettingsPath() (so CLAUDE_SETTINGS / CLAUDE_HOME overrides are
+ * respected for tests). Deliberately not a `claude` CLI probe: Windows installs
+ * routinely have Claude Code/Desktop with ~/.claude configured by hand and no
+ * `claude` on PATH, and those installs still need the hook runtime.
+ */
+export function claudeAppearsPresent({ settingsPath = claudeSettingsPath() } = {}) {
+  try {
+    return fs.existsSync(path.dirname(settingsPath));
+  } catch {
+    return false;
+  }
+}
+
 function shellArg(value) {
   const clean = String(value);
   return /\s/.test(clean) ? `"${clean.replaceAll('"', '\\"')}"` : clean;
@@ -1009,14 +1024,19 @@ export async function runSetupInstall({ mode = DEFAULT_COMPANION_MODE } = {}) {
   if (claude.ok) {
     installed.push("Claude Code");
     activations.push(verifyClaudeMcpRegistration({ configPath: claude.configPath }));
-    // The Open-in-current-chat hook runtime rides along with the MCP
-    // registration (both are what "Relay is installed into Claude" means).
-    claudeHooks = installClaudeHooks(bin, node);
   } else if (claude.reason === "claude_code_not_found") {
     missing.push("Claude Code");
   } else {
     missing.push("Claude Code (registration failed)");
   }
+  // The Open-in-current-chat hook runtime rides along with the MCP registration
+  // (both are what "Relay is installed into Claude" means) — but it must NOT
+  // depend on the `claude` CLI being on PATH. On Windows installClaudeCode fails
+  // with claude_code_not_found whenever the CLI is absent even though Claude
+  // Code/Desktop is installed and the MCP was registered by hand; without this
+  // fallback the hook is never written and the pill's "Open in current chat" is a
+  // silent no-op on exactly those machines.
+  if (claude.ok || claudeAppearsPresent()) claudeHooks = installClaudeHooks(bin, node);
   const codex = installCodex(bin, node, { mode: normalizedMode });
   if (codex.ok) {
     installed.push("Codex");