v0.8.1

Added

• The desktop app updates itself. Automatic updates are on by default
  (Settings → Advanced → Install updates automatically turns them off):
  a downloaded app release — engine first, then the app — or an engine-only
  release installs on its own once you've been away for 10 minutes (system
  idle, or the screen locked; a minimized window also counts for an
  engine-only update) and no session on this machine is mid-turn, waiting at
  most 2 hours for that. "Skip this version" is honoured, each version is
  tried at most once per run, an update the app can't apply here (e.g. macOS
  refusing the swap) is left to the toast's button, and nothing installs on
  quit. Afterwards the app says once what happened ("Updated MindFlock to
  0.8.1 while you were away"). The decision is a pure function
  (autoUpdateVerdict in electron/update.js) with its own tests.

• Shared folders on macOS. A peer-link shared session now runs on a Mac,
  under a deny-by-default Seatbelt profile (sandbox-exec, built into
  macOS). Linux keeps bubblewrap. The profile gives the agent the same set
  the Linux sandbox does, at the same paths:

  • read-only: system code, the agent's own runtime and the repo's git dir;
  • read-write: work/ (but not its .git file) and its own home (with a
    private TMPDIR);
  • network: the in-sandbox bridge to the egress proxy, and nothing else.
    That means no DNS, no other local port (the MindFlock server included)
    and no other host.

  It also takes back what Apple's baseline profile would leak: other
  processes' argv and environment (kern.procargs2) and process info. The
  keychain stays unreachable. The agent runs in its own session, so
  keystroke injection into the pane (TIOCSTI) fails, while a small
  supervisor outside relays resize and signals. The doctor reports the
  built-in sandbox on macOS, and Settings → People no longer says a Mac can't
  share a folder. On a Mac, claude's login is read from the keychain. New
  provider profile field tmpdir_env (TOML [peer] tmpdir_env): claude
  sets CLAUDE_CODE_TMPDIR, which otherwise uses a fixed /tmp/claude-<uid>.

Fixed

• A desktop app run from source no longer offers updates it can't do.
  The dev shell (and any unpackaged electron . run) used to show the
  "Update available" toast and an OS notification for every release, and its
  Update button fell through to "This app can't update itself here — install
  the download that just opened". A source run now skips release checks
  entirely (logged in main.log), refuses the update run, and Settings →
  Advanced says "running from source — update the checkout with git" instead
  of a button. A packaged app pointed at a developer checkout
  (MINDFLOCK_REPO, or an editable engine) no longer shows the engine-update
  toast either.

• A shared session no longer logs Claude Code out on the host computer.
  The sandbox used to get a copy of claude's whole login, refresh token
  included. Refreshing rotates that token, so once the sandboxed claude
  refreshed, the host's stored copy was dead and every other claude on that
  computer had to log in again. Only the access token is seeded now (Linux
  and macOS). CLAUDE_CODE_OAUTH_TOKEN (claude setup-token) and
  ANTHROPIC_API_KEY pass through when the server has them. A launch with
  no login, or one about to expire, is refused with the fix ("run claude
  here once") instead of starting an agent that can't log in.