"Be ashamed to guess APIs blindly; be proud to look things up carefully" —
until now the agents had no way to look anything up: no search, no fetch,
so market research, API usage, and competitive claims were all invented
from model memory.
agent-web-tools.ts, carried by every agent in every run (same pattern as
the workspace tools, no grant needed):
- web_search: keyless DuckDuckGo HTML backend; parses titles, unwraps the
/l/?uddg= redirect hrefs, pairs snippets; reports honestly when nothing
parses instead of fabricating results. Verified against the live endpoint.
- fetch_url: readable-text extraction (dependency-free HTML-to-text with
entity decoding), 20k-char page cap, 2MB body cap read in chunks, 30s
timeout.
- SSRF guard on both: hostnames resolve before connecting and loopback,
private, link-local, CGNAT, and reserved ranges are refused — re-checked
on every redirect hop, so a public page cannot bounce the agent into
127.0.0.1 or the cloud metadata address. IPv6 and v4-mapped forms covered.
- The fetcher is injectable, so the test suite covers the guard, redirect
policy, truncation, extraction, and the DuckDuckGo parser without
touching the network.
The board draining to 280/280 done left the company idle under a
still-active goal, with 24 markdown files and zero code as its life's work.
Two structural gaps caused it: goals had no lifecycle (status was written
once as 'active' and never read again — nothing re-engages anyone when the
last task closes), and nothing anywhere distinguished plans from product,
so every "engineering" objective closed on documents.
The loop, closed:
- tasks.origin (migration 055) records provenance: chat_wake for mention
vehicles (backfilled from their runs), goal_review for checkpoints, null
for real work. Chatter and checkpoints can therefore never count as
progress.
- spawnGoalReviews (each worker tick): an active goal with zero open tasks
and real progress since the last review gets ONE review task for the goal
owner. The review demands evidence — list the workspace, read the code,
run the tests; documents are how work starts, not proof it happened — and
must end in exactly one of: complete_goal, or the next wave of tasks with
requires_filesystem engineering. A review closed with neither spawns
nothing: termination is structural, not a counter.
- complete_goal (CEO or goal owner) finally lets someone say a goal is
achieved, audited.
- CEO and department-head voices now state the doctrine: a goal that
promises software closes on code that builds and passes tests in the
workspace, and implementation is delegated with requires_filesystem: true.
On the live profile this arms one review: the active platform goal has 0
open tasks and 21 real completed ones, so the CEO gets the checkpoint on
next launch and the company starts building instead of stopping.
Every "engineering" deliverable the company ever produced was a markdown
skeleton, because documentation was the ceiling of the toolset:
write_deliverable and create_document were the only artifact tools. An
engineer could not see the files that exist, read a line of code, or run a
single command — and create_task hardcoded requires_filesystem to false, so
the entire approval-gated read_write mount plumbing was dead code.
New workspace capability (agent-workspace-tools.ts):
- list_files / read_file: explore the bound workspace, traversal-guarded by
the same resolveWorkspacePath used for writes, size- and count-capped.
- run_command: real shell execution with the workspace as cwd, 120s timeout,
16k output cap. Gated on the task's approved filesystem grant — the same
requires_filesystem flag that flips the mount to read_write and routes the
task through operator approval (auto-approved only in AI-CEO mode, which
is that mode's explicit contract).
- create_task now takes requires_filesystem, so the CEO and officers can
delegate engineering work that is allowed to change code and run tests.
- Prompts brief every agent on the tools, and filesystem tasks state the
bar directly: real output is code that builds and tests that pass — a
document describing the work does not close an engineering task.
Tests: tool registry, dependency-folder-skipping listing, traversal refusal,
the run_command access gate plus exit-code reporting, and the create_task
approval path for filesystem work.
The two real goal tasks from July 9 each got exactly one session: the run
completed, the agent never moved the task off backlog, and the heartbeat's
"has a completed run" exclusion locked them out forever. The agents could
not have closed them anyway — update_task_status requires a task_id the
prompt never carried.
The progress contract, made explicit end to end:
- The task prompt now carries "Task id: ..." and tells the agent exactly how
to end a session: done via update_task_status when the work is complete,
in_progress with a note on what remains when it is not.
- The heartbeat re-enqueues any open task with no run in flight — a
completed run that left its task open earns a follow-up session, with the
prompt stating how many prior sessions were spent so the agent continues
instead of redoing work. The retry budget (3 non-transient runs) still
bounds every task; a task that spends it parks with one log line naming it.
- Scripted agents in the integration suites now close their tasks the way
the contract expects real ones to.
Of the 202 tasks stranded in the backlog on July 9, 200 were "Reply to ..."
wake vehicles: every agent @mention creates a task plus a queued run, the
reply goes out, and nothing ever closed the task — a task with a completed
run is never enqueued again, so each one became a permanent zombie row. On
top of that, every message in an active thread minted a fresh wake even when
the target already had one queued, multiplying runs that would each read the
same conversation.
The lifecycle contract, made explicit:
- The reply run IS the wake task's deliverable. Completing a chat_mention
run now closes its task (backlog/in_progress -> done, via the audited
status path). Tasks an agent moved to review are left alone.
- One pending wake per (agent, thread): wakeFromMention returns the queued
run instead of minting a duplicate — that run reads the thread's newest
messages when it executes anyway.
- Migration 054 heals existing rows: wake tasks whose runs are all spent
close as done; in-flight wakes keep working. This also stops Fix 1's
retry-budget healing from resurrecting 31 stale replies on next launch.
The chat-governance loop test now completes each pending wake run between
posts, matching how the exchange actually interleaves in production.
The July 9 run died at 07:22 when the GPT account hit its plan-side usage
limit: every later request failed with "The usage limit has been reached",
each failure counted against the 3-attempt retry budget, and 31 tasks were
abandoned for good while the worker kept hammering 12 doomed requests a
minute until the queue drained.
Root fix, three parts sharing one classifier:
- isTransientProviderFailure() in provider-runtime-domain recognises
provider-side verdicts (usage limit, rate limit, 429, overloaded) plus the
internal monthly-quota message; matching is against recorded
task_runs.error_message rows, so historical damage heals retroactively.
- enqueueHeartbeatRuns computes the retry budget with that predicate instead
of an exact match on the internal quota string alone.
- A transient failure parks the provider for a 10-minute cooldown: the
heartbeat stops enqueuing its tasks and the worker leaves its queued runs
unclaimed, then a single probe run re-arms or clears the park. Transitions
are logged once each way.
Tests: predicate unit tests, budget-exemption regression on the raw provider
message, cooldown park/resume with an injected clock, claim exclusion.
- Bump to 1.2.0 (language-aware humanizer house style with the bundled
humanizer-zh skill, resizable chat split and composer, topbar pause
toggle consistency)
- Packaged the NSIS installer with both humanizer variants verified in
resources/built-in-skills; uploaded to AC/AgentCompany-1.2.0-x64.exe
(public 200, byte-exact) and deleted the 1.1.0 build per the release
cleanup rule (verified 404)
- Landing manifest points at 1.2.0; landing e2e green; deployed to
Cloudflare Pages and verified live: page shows 1.2.0, tracked
download 302s to the new installer, stats API healthy
House style now follows the app language: Chinese UI forces the new
bundled humanizer-zh skill into every run, English forces humanizer -
one variant per run, picked by preference with cross-language fallback
so an older catalogue never silently loses house style. Both variants
are protected from grant/revoke, list_skills labels each with its
language, the bundle guard requires both, and startup sync imports the
new skill into existing orgs on next launch. Covered by a unit test
that flips app_state.language and asserts which humanizer compiles.
The chat split is now adjustable: drag the conversation list's right
edge (200-480px, persisted in localStorage) and the composer textarea
grew a native vertical resize grip capped at 40vh.
Deleting the old Windows build from R2 surfaced something worse: the
two macOS DMG links had no objects behind them at all - the mac builds
were never uploaded, so every mac download click has been a 404.
- R2 now holds exactly one desktop artifact: AC/AgentCompany-1.1.0-x64
.exe (old exe deleted on operator instruction, verified 404)
- The release manifest drops the macOS entry with a comment explaining
how it comes back (upload real DMGs first); footer mac links removed;
hero reads "Available on Windows - macOS build coming soon"
- Root fix in platform-support: FAQ/JSON-LD copy now derives from
whatever platforms the manifest actually ships instead of
hard-requiring macos+windows, so the site structurally cannot
advertise a platform without a real artifact behind it
- Landing e2e updated (>=1 tracked asset) and green; redeployed and
verified live: no r2.dev leaks, no mac links, coming-soon copy shown,
tracked download 302s to the 1.1.0 installer
The pause control was a hand-rolled pill (999px radius, its own
padding and font size) sitting next to the standard "New task" button,
so the two never matched. It now renders as the shared .button class -
one source of truth for height, padding, and corner radius - with a
single amber modifier for the paused state. Verified side by side in
the captured Work-page screenshot.
Two operator asks, one review gate:
Avatar portraits (migration 052): the avatar editor gains "Upload
photo" - the renderer downscales the chosen picture to a ~96px cover
crop and stores it as a small data URL (PNG keeps transparency, the
rest compresses to JPEG), so the snapshot stays light and the CSP needs
nothing new. The portrait wins over emoji and initials everywhere the
shared Avatar renders (chat, org chart, office card, sidebar), and
"Remove photo" falls back cleanly. The main process validates scheme
and size (base64 image data URL, <=300k chars) so a rogue caller cannot
re-bloat the snapshot. e2e uploads a real PNG through the profile
dialog and sees the portrait land in the sidebar.
Global pause (migration 053): when agents start talking in circles,
one topbar toggle - visible on every page - pulls the handbrake.
app_state.autorun_paused survives restarts; the queue worker checks it
each tick and neither enqueues nor claims while set (the run already in
flight finishes). Queued work simply waits and the paused state renders
as an amber "resume" pill. A unit test drives the real worker: paused
leaves a queued run untouched through many ticks, resuming claims it
within moments; e2e flips the toggle in the live shell.
The conversation pane had no scroll management at all - it opened at
the top of history, ignored arriving messages, and offered no way back
down other than dragging through long replies.
- Opening a conversation lands on the newest message (the component is
keyed by space, so mount = open)
- A reader at the bottom stays pinned as new messages arrive; a reader
up in history is left undisturbed
- The moment the reader leaves the bottom, a floating "Jump to latest"
pill appears above the composer; clicking it smooth-scrolls back and
the pill hides itself again
- The scroll region is a proper role="log" landmark; e2e seeds a dozen
multi-line messages over real IPC, scrolls to the top, and drives the
pill's appear -> click -> return-to-bottom -> disappear cycle
The renderer half of the project review surfaced five real defects:
- One unresolvable message sender or mention target blanked the whole
Messages page mid-render; both now degrade to a visible "Former
member" placeholder instead of throwing
- A failed initial snapshot load left a permanently blank window with a
swallowed rejection; loads now log loudly and retry every 1.5s until
the main process answers
- With no conversation selected, the view followed the recency sort:
any incoming message yanked the visible conversation to the newest
space and marked it read unseen. The implicit default now pins itself
once (render-time state adjustment)
- The avatar directory keyed names across ALL organizations, so a
same-named principal in another org hijacked the custom avatar; it
now scopes to the active org
- The conversation search query survived switching spaces, silently
filtering the new space by the old term; ChatConversation is keyed by
space id so per-space UI state resets
Also verified clean by the same sweep: no lingering references to the
removed snapshot fields, no stale closures in the office rAF loop,
org-chart zoom math, and the chat message ordering invariant is
guaranteed at the data layer (created_at desc limit + reverse).
A systematic review of the whole codebase (main process, renderer,
IPC/migration/packaging seams) surfaced four real defects; each is
fixed at its root:
- Legacy catalogue drift: the operator's profile still carried 89
active skills from the removed ~/.agents import era next to the 228
built-ins. Catalogue sync now mirrors the bundle - actives whose slug
the bundle does not ship retire (bindings keep resolving via their
pinned revisions; retired skills leave list_skills and cannot be
granted anew)
- Broken-bundle guard: staging now refuses a bundle without the
humanizer skill, so an empty or quarantined resources folder can
never trigger the mirror pass into retiring a healthy catalogue
- Duplicate agent names: @mentions, DM routing, and task assignment all
resolve by name, so createAgent and updateAgent renames now reject a
name already held by an active agent (case-insensitive); the mention
resolver still refuses to guess between legacy duplicates
- Stale DM titles: agent-to-agent conversation rows titled themselves
from the frozen creation-time space name, so renames never reached
the sidebar; direct titles now derive from members' current names
Verified clean in the same sweep: IPC surface (82 channels, handler +
preload + api aligned), per-migration transactions with rollback,
quota-parking month rollover, retry-budget counting, meeting spot
reuse across floor-plan rebuilds.
Every whip click now lands visibly, wherever the target is standing:
- simulation.whip() always registers a WhipCrackEffect at the struck
agent and starts their hit reaction; step() ages both away. The
discipline rule is unchanged - only snack-bar/restroom slackers are
sent hustling home; desk, CEO office, and meeting stay safe
- office-renderer draws the strike: a lash sweeping in from the upper
right that collapses into an impact starburst with an expanding ring
(~450ms), while the struck agent shakes with anime-style pain sparks
over their head (~600ms), fading as the flinch drains
- The office e2e now collects pageerror during the run and lets the
effect play out after a whip-mode click, so a throwing frame in the
rAF loop fails the suite instead of dying silently
The whole app turned to molasses because snapshot.load() shipped the
entire skill_runtime_snapshots table - unbounded, compiled_prompt
included - over IPC on every refresh. A real profile carried 142 rows
totaling 144MB (1.1MB each from the pre-cap CEO compile-all era), so
every coalesced refresh serialized ~144MB of JSON. The forced-humanizer
rework made it worse by adding a row per run for every agent.
- Drop skillRuntimeSnapshots, skillRevisions, skillTests, and
skillBindings from the renderer snapshot: no renderer surface reads
them; skill internals are main-process state. Only the lightweight
skillDefinitions catalogue still ships.
- Project provider_requests without raw_response_json (4.1MB across the
newest 100 rows; RunsPage only reads responseText)
- Migration 051 purges the bug-era compiled prompts from existing DBs
- resolveRuntimeSnapshot is now idempotent per run: a run re-queued by
startup recovery reuses its frozen snapshot instead of dying on the
uniqueness guard and burning real retry budget
- Regression test pins the contract: a 2MB database row must not add
bytes to the snapshot (payload asserted under 400KB)
- New bottom toolbar on the pixel office floor with a Whip tool;
toggling it turns the cursor to a crosshair, clicks whip instead of
opening the detail card, Escape puts the whip away
- Simulation.whip(): an agent inside the snack bar or restroom drops
whatever they are carrying and hustles back to their desk at 1.8x
speed for a few seconds; agents at their desks, in the CEO office,
or in the meeting room are working and stay untouched
- Room membership decides the outcome (rectContains against the same
floor-plan rooms the renderer draws), so the rule matches what the
player sees
- Unit tests cover the whip matrix; e2e drives the toolbar toggle in
the live shell
Researched how OKR-run companies cascade (company objective -> C-suite
officers per function -> department objectives -> individual key
results) and encoded that shape into how the CEO builds the org.
- hire_agent gains seniority (director/lead/staff; c_suite stays
reserved for the CEO's privileges) and a business-card title, so the
CEO hires a CTO/CFO/CMO as directors instead of a flat pool of ICs
- CEO persona + goal kickoff now direct the OKR cascade: hire 2-4
officers, hand each a department objective, let them build teams;
department heads get their own doctrine (hire leads/staff, cascade
key results as tasks, report up)
- Migration 050 adds Finance and Sales to every org's canonical
departments (backfilled for existing DBs) so a real C-suite has
somewhere to hire
- Org chart viewport is a fixed-height scroll region: zooming rescales
the diagram inside it instead of resizing the card
- Unit test drives a live three-level chain: CEO -> CTO (director) ->
Engineering Manager (lead) -> staff, with rank/title persisted
- The detail card now rides beside the clicked agent (flipping and
clamping at viewport edges via a pure cardPositionFor helper) instead
of pinning to the top-right corner; it follows a walking agent
- Every agent - the CEO and busy agents included - periodically visits
the coffee machine, snack bar, and restroom; work status no longer
recalls a walker mid-break
- The office convenes meetings around the meeting table every few
minutes: at least two settled attendees walk over, dwell together on
distinct table spots, and head back; a solo office never meets
- Meeting spots ship as lane-wired amenities so pathing stays correct
by construction; floor-plan invariants (collider-free, reachable)
cover them automatically
- e2e asserts the card opens beside the sprite, not in a corner
- Migration 049: avatar_emoji/avatar_color on agents and employees
- updateAgent accepts a new name (mention-name validated) and avatar;
new updateEmployeeProfile renames the operator and sets their avatar
- Avatars are emoji-on-color tiles (renderer CSP blocks remote images);
an AvatarDirectoryContext built from the snapshot lets the shared
Avatar component honor custom looks at every call site - chat rows,
conversation list, org chart, office card, sidebar - without
threading props through pages
- Team edit dialog gains Name + avatar editor (CEO included); the
sidebar foot opens an Edit-profile dialog for the operator
- e2e: rename an agent to a new mention handle with an emoji avatar,
edit the operator profile, both verified in the live shell
Skills no longer come from the user's ~/.agents library - most users have
none, and the CEO branch that compiled the entire catalogue into its
prompt overflowed the model context (1.1MB) and failed every CEO run.
- Bundle "built-in skills/" with the app (extraResources) and stage it
at startup into <profile>/builtin-skills as one dir-per-skill copy -
both bundle shapes (SKILL.md dirs and flat category .md files)
normalize into the same importable layout
- Import the staged catalogue per org at startup and inside onboarding,
so the CEO's first run already carries it
- Forced house style: resolveRuntimeSnapshot unions the humanizer skill
into every agent's runtime (CEO included) as a resolution rule - no
binding row to forget, delete, or bypass; revoke_skill refuses it
- CEO staffs hires with skills: hire_agent accepts a skills array,
grant_skill/revoke_skill adjust later, list_skills now shows
descriptions from skill frontmatter
- Kill the c_suite compile-all branch; everyone resolves bindings-only,
capped at 200k chars with omissions named in the prompt
- Remove the Skills settings page and its import/sync/test IPC surface;
drop ~/.agents discovery and the AGENTCOMPANY_NEW_SKILLS_ROOT seam in
favor of AGENTCOMPANY_NEW_BUILTIN_SKILLS_DIR
- Tests: staging/import/forced-resolution/cap units, real-bundle CI
check, e2e asserts the tab is gone and the catalogue self-imports
A human message in a channel woke agents only through @mentions, DM
counterparts, or prior thread participants - and the flat composer
always sends threadId=null, so typing in #general summoned nobody and
the room stayed silent.
- Track which agents each wake path summoned in one woken set (also
prevents latent double-wakes between the paths)
- When a non-slash human message in a channel wakes nobody, wake the
channel's most senior active agent member with an enabled provider
(c_suite > director > lead > staff, then hire date); they can pull
teammates in with @mentions
- Log when a channel has no runnable agent so silence is diagnosable
- Integration test: plain #general message wakes the CEO who replies;
an explicit mention still wakes exactly one agent
The heartbeat scheduler enqueued runs even while a provider's monthly
usage window was full, so every task burned its 3-attempt retry budget
on instant quota failures within seconds and stayed dead forever -
raising the limit (or restarting) never revived anything.
- Park tasks (skip enqueue) while their provider is at its
monthly_request_limit instead of creating runs doomed to fail
- Exclude quota-blocked failures from the 3-attempt retry budget,
retroactively reviving tasks abandoned by past filled windows
- Share the gate message as PROVIDER_MONTHLY_LIMIT_MESSAGE and log
quota-block transitions once per state change for diagnosability
- Ignore landing/ (self-contained Next.js sub-project) and
built-in skills/ (prompt content) in eslint so verify:ci lints only
application code
Architecture review (hai-architecture / APoSD) of the shipped redesign found one
structural smell: the shared lib/ layer imported the release manifest from
components/ — data in the presentation layer, dependency pointing the wrong way.
- move components/release-links.generated.ts -> lib/; update the four importers
and the README. lib/ no longer imports from components/.
- downloads.ts: reuse PlatformDownload["id"] instead of re-declaring the union.
No behavior change (download counter + tracked hrefs identical); build + e2e 12/12.
- release-links: bump to 1.0.0; Windows now points at AgentCompany-1.0.0-x64.exe
(signed x64 NSIS, uploaded to R2); remove the Linux platform. macOS stays on
0.4.182 until the 1.0.0 mac build is ready.
- platform-support / product-narrative / footer / layout / faq: remove Linux
from availability copy, the FAQ, JSON-LD, and footer download links
- e2e: adjust the tracked-download-link count (macOS x2 + Windows = 3)
The old favicon/logo were pinned by `Cache-Control: immutable` (1 year), so
browsers never refetched the new glass-bloom mark.
- _headers: favicon.ico + icon.png now cache for a day (revalidating), not
immutable; drop dead /screenshots + /assets rules; cache /images for a week
- version icon references (?v=2) so existing immutable caches are busted now
- add a modern PNG icon link (/icon.png) that browsers prefer over the .ico
- remove the dead root _headers duplicate (only public/_headers ships)
- icon-mark: render the glass-bloom app icon as the nav and footer logo (from
resources/icon.png)
- public/icon.png: 180px, serves the apple-touch icon, JSON-LD logo, and logo
- public/favicon.ico: 16/32/48 multi-resolution from the new icon
- remove the old unused assets/icon.svg
Float each screenshot over an ambient wash painted from its own colours (a tiny
blurred thumbnail), layered with the aurora, a designed green->teal gradient,
and fine film grain — the "based on our real product screenshot" treatment.
- ui/art-stage: reusable atmospheric stage (ambient LQIP + aurora + grain + a
floating shot with depth)
- hero + bento: swap the flat frames for ArtStage
- public/images/ambient: per-screenshot colour-wash thumbnails (<250B each)
- remove the now-unused media-frame
e2e green (12 passed).
Close the flat-vs-adaline gap by adding depth and motion to our product shots:
- bento: replace the flat stacked features with a varied 12-column grid (org
chart, cost, office, messages, connectors, plus a local-first highlight card),
each with a corner glow and hover
- showcase: a dark aurora "Set the goal" statement band (Newsreader serif over a
drifting northern-lights glow) for a light -> dark -> light rhythm
- hero + footer: aurora glow staging behind the dashboard and under the CTA
- ui/aurora + globals: mint/teal/lime drift-animated glow tokens
- remove the superseded flat feature components
e2e green (12 passed); build verified.
- playwright.config.ts: desktop (1440) + mobile (Pixel 5) projects, static
webServer over the exported out/; a PW_CHROME env override for the browser
- tests/e2e: render + all core sections, tracked download hrefs with no R2
exposure, the live counter (mocked function), theme toggle, image loading,
zero console errors, and responsive nav (desktop links / mobile menu reveal)
- navbar: hide the closed mobile menu with `invisible` so its links stay out of
the tab order and the accessibility tree, not merely clipped
- add the test:e2e script and ignore test-results/ + playwright-report/
- footer: dark #050e11 band with an Instrument Serif display CTA, an inverted
Download button, link columns (tracked download hrefs preserved) and copyright
- structure: move icon-mark to brand/, theme provider+toggle to theme/,
site-constants to lib/; sections/layout/ui/brand/theme now fully separated
- button: add an inverted variant for dark surfaces
- metadata: point OpenGraph/Twitter at a 1200x630 og.jpg and the JSON-LD
screenshot at dashboard.webp; drop the old /screenshots references
- remove orphans: framer-motion (replaced by CSS + IntersectionObserver),
ascii-background, and the seven superseded product screenshots
- add @playwright/test for the e2e suite
- adaline heading + version/count line + three platform cards with Reicon
download icons (components/sections)
- preserve all business logic verbatim: the /api/download-stats count fetch with
seeded fallback, and every asset link routed through getTrackedDownloadHref
(/api/download?asset=...) so downloads stay counted and the real R2 URLs
remain behind the server redirect
- runtimes: bordered "supported runtimes" strip, text-based for consistency
(Reicon brand coverage is partial); all eight runtimes preserved
- how-it-works: centered heading + clean numbered stepper for the seven-step
first-run flow; drop the framer-motion terminal demo
- faq: adaline accordion (grid-rows expand, Reicon plus icon); all answers
preserved, including the platform-support-derived ones
- move all three into components/sections and remove the old flat components
Foundation for the adaline-based landing rebuild:
- globals.css: warm-cream light theme + Material-3 dark theme mapped onto the
existing CSS-var names; CSS-keyframe entrance + IntersectionObserver reveal
motion (to replace framer-motion incrementally)
- layout.tsx: self-host Instrument Sans/Serif, Newsreader and JetBrains Mono via
next/font/google; drop the external Google Fonts <link>
- _headers: tighten CSP style/font-src to 'self' now that fonts are local
- components/ui: Container, Reveal, Eyebrow, Badge, Button, SectionHeading
- lib/landing-content.ts: feature-section copy for the six product screens
- public/images: six product screenshots optimized to WebP
- add reicon-react/reicon-brands (bundled, CSP-safe SVG icons)
Business logic (D1 download counter, platform metadata, theme, SEO) unchanged.
ZacharyZhang-NY