Specification: signalbox menu bar

Icon

The beacon (radio waves) is the default icon; the list glyph is the alternate, switchable in settings. Idle shows the plain template glyph. When sessions wait, one dot appears top-right at the highest urgency: red failed, then amber needs-you, then blue output updated. The dot counts only unacked, unhidden rows, so a dealt-with board goes quiet. The icon carries a dot only, no text count.

Dropdown

One row per session in board order: status mark, agent glyph, name, age.

• Status mark uses the same temperatures as the jumplist. A menu cannot animate, so working shows a static dotted circle and failed the red ✕.
• The agent glyph is the same per-agent icon the jumplist uses (glyph only).
• Bold means unread; a faint ring means read.
• Click a row to jump.
• Hidden rows drop out, and the additional filters apply here too, so the dropdown matches the jumplist. With nothing to show, a disabled "No sessions" row appears.
• Below the sessions: Connect Phone… (small phone glyph), Settings… (⌘,), Quit Signalbox (⌘Q).
• No Refresh item; the stream resyncs on every reconnect and on wake.
• If the signalbox CLI cannot be found, a disabled banner row sits at the top (signalbox CLI not found - brew install dwmkerr/tools/signalbox (or set SIGNALBOX_BIN)). Jump, hide and remove need the CLI.

The mock above shows the bar and the open dropdown together.

Connect Phone

A small window (~360×460, titled "Connect Phone") that pairs the iPhone app with the hub, WhatsApp-Web style: show a QR, wait, then confirm. On open it POSTs to the loopback hub's /pair/new to mint a one-time code, then:

• Code minted (200). It builds the pairing deep link signalbox://pair?url=<percent-encoded http://LAN-IP:PORT>&code=<code> (the LAN IP comes from the response bind when concrete, otherwise this Mac's primary Wi-Fi IPv4), renders it as a QR (CoreImage, upscaled nearest-neighbor so it stays crisp), and shows "Scan with your iPhone camera" with the plain LAN URL beneath. It then polls /pair/status every 2s: on redeemed it swaps to a green check and "Phone paired" and auto-closes after ~2s; when the code expires (180s) it offers a "New code" button.
• Hub only answers this Mac (409). Pairing needs the hub reachable over the network, so the window explains "Signalbox only answers this Mac" and offers Allow other devices. That button writes hub.bind = "0.0.0.0" to ~/.config/signalbox/settings.json (deep-merged, other keys preserved), restarts the hub so it re-reads the config and binds every interface with an auto-generated token, waits for it to answer, then re-mints and shows the QR. A note warns that anyone on the network with the code could pair. Network access turns on only from this button or the Settings Hub checkbox.

The QR carries only the one-time code and the LAN URL, and omits the hub token. The phone learns the token by redeeming the code against the hub over the LAN, so a photo of a used or expired QR grants no access.

Notifications

• Attention and error always notify; done only after more than 30 seconds of work, skipping quick prompt turnarounds.
• Clicking a notification jumps to the session.
• Notifications are keyed by session, so a newer signal replaces the stale banner.