@inetafrica/open-claudia 3.0.26 → 3.0.28

package/core/agency/ledger.js

@@ -0,0 +1,294 @@
+// Agency ledger — read-only work aggregator (Track B0).
+//
+// Unifies three sources into one normalized, ranked work list:
+//   • persistent per-channel tasks (core/tasks) — the agent's own plan/subtasks
+//   • Spaces tasks assigned to the owner (`spaces mine`, via the spaces tool)
+//   • connector inbox notifications (core/connected-apps) — awareness items
+//
+// Pure visibility, zero autonomy: this module only reads and normalizes. The
+// deliberation/act layer (Track B1+) consumes build()/collect() output; it never
+// writes here. Credentials never touch this module — the Spaces fetch is
+// delegated to the `spaces` tool subprocess (keyring-injected), so core holds no
+// secrets. build() is a pure function (no I/O) so it is unit-testable in full;
+// collect() is the thin impure orchestrator that gathers the three sources.
+
+const { execFile } = require("child_process");
+
+const DAY_MS = 86400000;
+const DEFAULT_STALE_DAYS = 14;
+
+function toMs(v) {
+  if (!v) return 0;
+  if (typeof v === "number") return v;
+  const t = Date.parse(v);
+  return Number.isFinite(t) ? t : 0;
+}
+
+function staleDaysOf(lastTouched, now) {
+  if (!lastTouched) return null;
+  return Math.max(0, (now - lastTouched) / DAY_MS);
+}
+
+// --- normalizers: each source → the common entry shape ------------------
+// { source, kind, id, title, status, priority, due, lastTouched, staleDays,
+//   blockedOn, overdue, meta }
+
+function normalizeTask(t, now) {
+  const lastTouched = toMs(t.updatedAt || t.createdAt);
+  const status = t.status === "in_progress" ? "in_progress"
+    : t.status === "completed" ? "done"
+    : "open";
+  return {
+    source: "task",
+    kind: t.parentId ? "subtask" : "task",
+    id: String(t.id || ""),
+    title: t.content || "(untitled)",
+    status,
+    priority: null,
+    due: null,
+    lastTouched,
+    staleDays: staleDaysOf(lastTouched, now),
+    blockedOn: null,
+    overdue: false,
+    meta: { parentId: t.parentId || null, description: t.description || null },
+  };
+}
+
+function normalizeSpacesTask(t, now) {
+  const lastTouched = toMs(t.updatedAt || t.createdAt);
+  const due = t.dueDate || null;
+  const dueMs = toMs(due);
+  const status = t.status === "in_progress" ? "in_progress"
+    : (t.status === "completed" || t.status === "done" || t.completedAt) ? "done"
+    : "open";
+  const space = t.spaceId && typeof t.spaceId === "object" ? (t.spaceId.name || "") : "";
+  return {
+    source: "spaces",
+    kind: "assignment",
+    id: String(t.id || t._id || ""),
+    title: t.title || "(untitled)",
+    status,
+    priority: t.priority || null,
+    due,
+    lastTouched,
+    staleDays: staleDaysOf(lastTouched, now),
+    blockedOn: t.parentTaskId || null,
+    overdue: !!(dueMs && dueMs < now && status !== "done"),
+    meta: {
+      space,
+      subtasks: t.subtaskCount || 0,
+      subtasksDone: t.subtaskCompletedCount || 0,
+      tags: Array.isArray(t.tags) ? t.tags : [],
+    },
+  };
+}
+
+function normalizeInbox(item, now) {
+  const lastTouched = toMs(item.createdAt);
+  const actor = item.actorName ? `${item.actorName} ` : "";
+  const verb = item.type || "notification";
+  const on = item.taskTitle ? ` on "${item.taskTitle}"` : "";
+  const title = `${actor}${verb}${on}`.trim() || item.text || "(notification)";
+  return {
+    source: "notification",
+    kind: item.type || "notification",
+    id: String(item.id || ""),
+    title,
+    status: "info",
+    priority: null,
+    due: null,
+    lastTouched,
+    staleDays: staleDaysOf(lastTouched, now),
+    blockedOn: null,
+    overdue: false,
+    meta: {
+      app: item.appName || item.appId || "",
+      actor: item.actorName || "",
+      taskId: item.taskId || "",
+      text: item.text || "",
+    },
+  };
+}
+
+// Pure-visibility ordering (NOT the Track B1 deliberation score): overdue first,
+// then anything with a due date by soonest, then in-progress, then most recently
+// touched. Stable + explainable so the ledger always reads sensibly.
+function rankKey(e) {
+  const dueMs = toMs(e.due);
+  return [
+    e.overdue ? 0 : 1,
+    dueMs || Number.MAX_SAFE_INTEGER,
+    e.status === "in_progress" ? 0 : 1,
+    -(e.lastTouched || 0),
+  ];
+}
+
+function cmpKey(a, b) {
+  for (let i = 0; i < a.length; i++) {
+    if (a[i] < b[i]) return -1;
+    if (a[i] > b[i]) return 1;
+  }
+  return 0;
+}
+
+// Pure: raw source arrays → normalized, de-completed, ranked ledger + counts.
+function build({ tasks = [], spacesMine = [], inboxes = [], now = Date.now(), staleDays = DEFAULT_STALE_DAYS } = {}) {
+  const entries = [];
+  for (const t of tasks) entries.push(normalizeTask(t, now));
+  for (const t of spacesMine) entries.push(normalizeSpacesTask(t, now));
+  for (const it of inboxes) entries.push(normalizeInbox(it, now));
+
+  // The ledger is a live work list — completed items drop off.
+  const open = entries.filter((e) => e.status !== "done");
+  open.sort((a, b) => cmpKey(rankKey(a), rankKey(b)));
+
+  const byStatus = {};
+  const bySource = {};
+  let overdue = 0;
+  let stale = 0;
+  for (const e of open) {
+    byStatus[e.status] = (byStatus[e.status] || 0) + 1;
+    bySource[e.source] = (bySource[e.source] || 0) + 1;
+    if (e.overdue) overdue += 1;
+    if (e.staleDays != null && e.staleDays > staleDays) stale += 1;
+  }
+
+  return {
+    generatedAt: now,
+    counts: { total: open.length, overdue, stale, byStatus, bySource },
+    entries: open,
+  };
+}
+
+// Default Spaces fetch: shell the read-only `spaces mine` tool verb. Keyring
+// creds are injected only into that subprocess, so this module never holds the
+// central login. Best-effort — any failure yields [] and the ledger still shows
+// tasks + notifications.
+function defaultFetchSpacesMine({ timeoutMs = 15000 } = {}) {
+  return new Promise((resolve) => {
+    execFile(
+      "open-claudia",
+      ["tool", "run", "spaces", "mine", "--json"],
+      { timeout: timeoutMs, maxBuffer: 8 * 1024 * 1024 },
+      (err, stdout) => {
+        if (err || !stdout) return resolve([]);
+        try {
+          // Tool stdout can carry ExperimentalWarning/SQLite noise before the JSON.
+          const start = stdout.indexOf("[");
+          const parsed = JSON.parse(start >= 0 ? stdout.slice(start) : stdout);
+          resolve(Array.isArray(parsed) ? parsed : []);
+        } catch (e) { resolve([]); }
+      },
+    );
+  });
+}
+
+// Impure orchestrator: gather the three sources, then build(). Every source is
+// best-effort so a single failure never blanks the ledger.
+async function collect({ adapter, channelId, now = Date.now(), staleDays = DEFAULT_STALE_DAYS, includeSpaces = true, fetchSpacesMine } = {}) {
+  let tasks = [];
+  try {
+    if (adapter && channelId) tasks = require("../tasks").list(adapter, channelId);
+  } catch (e) { tasks = []; }
+
+  let spacesMine = [];
+  if (includeSpaces) {
+    try {
+      const fetch = fetchSpacesMine || defaultFetchSpacesMine;
+      const r = await fetch({});
+      spacesMine = Array.isArray(r) ? r : [];
+    } catch (e) { spacesMine = []; }
+  }
+
+  let inboxes = [];
+  try {
+    inboxes = require("../connected-apps").getAllInboxes() || [];
+  } catch (e) { inboxes = []; }
+
+  return build({ tasks, spacesMine, inboxes, now, staleDays });
+}
+
+// --- rendering ----------------------------------------------------------
+
+function ago(ms, now) {
+  if (!ms) return "";
+  const s = Math.max(0, Math.round((now - ms) / 1000));
+  if (s < 90) return "just now";
+  const m = Math.round(s / 60);
+  if (m < 90) return `${m}m ago`;
+  const h = Math.round(m / 60);
+  if (h < 36) return `${h}h ago`;
+  return `${Math.round(h / 24)}d ago`;
+}
+
+function dueLabel(due, now) {
+  const dueMs = toMs(due);
+  if (!dueMs) return "";
+  const days = Math.round((dueMs - now) / DAY_MS);
+  if (days < 0) return `overdue ${-days}d`;
+  if (days === 0) return "due today";
+  if (days === 1) return "due tomorrow";
+  return `due ${days}d`;
+}
+
+const SOURCE_LABEL = {
+  spaces: "Spaces (assigned to me)",
+  task: "Local tasks (this channel)",
+  notification: "Notifications (inbox)",
+};
+const SOURCE_ORDER = ["spaces", "task", "notification"];
+
+function mark(e) {
+  if (e.overdue) return "!";
+  if (e.status === "in_progress") return "~";
+  if (e.source === "notification") return "•";
+  return " ";
+}
+
+function renderEntry(e, now, showIds) {
+  const bits = [];
+  const d = dueLabel(e.due, now);
+  if (d) bits.push(d);
+  if (e.status === "in_progress" && !e.overdue) bits.push("in progress");
+  if (e.priority && e.priority !== "medium") bits.push(e.priority);
+  if (e.meta && e.meta.space) bits.push(e.meta.space);
+  const a = ago(e.lastTouched, now);
+  if (a && (e.source !== "spaces" || !d)) bits.push(a);
+  const tail = bits.length ? `  · ${bits.join(" · ")}` : "";
+  const id = showIds && e.id ? `  (${e.id})` : "";
+  return ` ${mark(e)} ${e.title}${tail}${id}`;
+}
+
+function render(ledger, opts = {}) {
+  const now = opts.now || ledger.generatedAt || Date.now();
+  const limit = Number.isFinite(opts.limitPerSource) ? opts.limitPerSource : 10;
+  const showIds = !!opts.showIds;
+  const c = ledger.counts || { total: 0, overdue: 0, stale: 0 };
+  const lines = ["Agenda", "──────"];
+  const summary = [`${c.total} open`];
+  if (c.overdue) summary.push(`${c.overdue} overdue`);
+  if (c.stale) summary.push(`${c.stale} stale`);
+  lines.push(summary.join(" · "));
+
+  for (const src of SOURCE_ORDER) {
+    const items = (ledger.entries || []).filter((e) => e.source === src);
+    if (!items.length) continue;
+    lines.push("");
+    lines.push(`${SOURCE_LABEL[src] || src} — ${items.length}`);
+    for (const e of items.slice(0, limit)) lines.push(renderEntry(e, now, showIds));
+    if (items.length > limit) lines.push(`   …and ${items.length - limit} more`);
+  }
+  if (!(ledger.entries || []).length) lines.push("", "Nothing on your plate. 🎉");
+  return lines.join("\n");
+}
+
+module.exports = {
+  build,
+  collect,
+  render,
+  normalizeTask,
+  normalizeSpacesTask,
+  normalizeInbox,
+  defaultFetchSpacesMine,
+  DEFAULT_STALE_DAYS,
+};

package/core/connected-apps.js

@@ -204,6 +204,20 @@ function snapshot() {
   };
 }
 
+// Public: flat, normalized list of every connector inbox item across all apps,
+// each tagged with the app it came from. Read-only; lazily loads the on-disk
+// store so it works from any process (the parent poller keeps the file fresh).
+function getAllInboxes() {
+  if (!store) store = loadStore();
+  const nameById = new Map(store.apps.map((a) => [String(a.id || a.name), a.name || String(a.id || "")]));
+  const out = [];
+  for (const [appId, state] of Object.entries(store.perApp || {})) {
+    const appName = nameById.get(appId) || appId;
+    for (const it of state.inbox || []) out.push({ appId, appName, ...it });
+  }
+  return out;
+}
+
 function initConnectedApps() {
   if (!truthy(config.OC_CONNECTED_APPS || process.env.OC_CONNECTED_APPS, false)) {
     return { started: false, reason: "OC_CONNECTED_APPS disabled" };
@@ -231,5 +245,6 @@ module.exports = {
   registerConnector,
   fetchConnectedApps,
   snapshot,
+  getAllInboxes,
   STORE_FILE,
 };

package/core/guardrail.js

@@ -0,0 +1,251 @@
+// Track C — dynamic owner-guardrail capture. When the OWNER states a durable
+// behavioural rule mid-chat ("from now on ...", "never ...", "stop ...ing"), a
+// deterministic post-turn detector either captures it straight into lessons.md
+// (always-loaded) or asks first, so the correction holds on the next turn with
+// no code change and no deploy.
+//
+// Invariants:
+//  - Owner-only, HARD. Rules are NEVER captured from external speakers — the
+//    caller gates on relationship.guardActive(speaker) and consider() re-checks.
+//  - Advisory-tier. A captured rule layers ABOVE lessons but can never override
+//    the code-fixed hard rules (tool-first, enforcer). Safety rails stay in code.
+//  - No model call. Detection is phrase-based and default-silent; the ambiguous
+//    tier defers to the owner (a Y/N button), not to a model that could invent
+//    a rule. Clear "from now on / never / stop" phrasings auto-capture with an
+//    announce + one-tap undo; softer imperatives ask first.
+//  - Dedupe against existing lessons (normalized text) so the same rule
+//    reinforces instead of cluttering the always-on budget.
+
+const fs = require("fs");
+const path = require("path");
+const crypto = require("crypto");
+const { atomicWriteFileSync } = require("./fsutil");
+
+const CONFIG_DIR = require("../config-dir");
+const lessons = require("./lessons");
+
+const PENDING_FILE = path.join(CONFIG_DIR, "guardrail-pending.json");
+const PENDING_TTL_MS = Number(process.env.GUARDRAIL_PENDING_TTL_MS || 24 * 60 * 60 * 1000);
+const MIN_RULE_CHARS = 10;
+const MIN_RULE_WORDS = 3;
+const MAX_RULE_CHARS = lessons.MAX_LESSON_CHARS || 240;
+
+// Operability control (mirrors pack-review's PACK_REVIEW gate). Default ON —
+// this is not a hidden kill-switch; it lets the capture path be disabled
+// without a deploy if it ever misfires, and lets tests force it off.
+function enabled() {
+  return String(process.env.GUARDRAIL_CAPTURE || "on").toLowerCase() !== "off";
+}
+
+// ── detection (pure, deterministic) ─────────────────────────────────
+
+// Explicit durable markers → high confidence (auto-capture). Matched anywhere.
+const HIGH_MARKERS = [
+  /\bfrom now on\b/i,
+  /\bfrom here on(?: out)?\b/i,
+  /\bgoing forward\b/i,
+  /\bin (?:the )?future\b/i,
+  /\bnever again\b/i,
+  /\bmake (?:it|this|that) a (?:standing )?rule\b/i,
+  /\bas a (?:standing )?rule\b/i,
+  /\balways remember to\b/i,
+];
+// Clear negative directive at the start of a (cleaned) clause → high. "stop"
+// must be followed by a gerund so "stop summarizing" captures but "stop the
+// server" (a one-off action) does not.
+const HIGH_NEG = /^(?:never\s+\w+|stop\s+\w+ing|(?:don'?t|do not) ever\b)/i;
+// Softer imperatives → medium (ask the owner first).
+const MED_OPENER = /^(?:always|don'?t|do not|make sure|be sure|remember to|prefer|avoid)\b/i;
+
+// Junk that pattern-matches a directive but is never a rule.
+const STOP_RULES = new Set(["never mind", "nevermind", "stop it", "never ever", "don't worry", "do not worry"]);
+
+function splitSentences(text) {
+  return String(text || "")
+    .split(/(?<=[.!?])\s+|\n+/)
+    .map((s) => s.trim())
+    .filter(Boolean);
+}
+
+function endsAsQuestion(s) {
+  return /\?\s*$/.test(String(s || ""));
+}
+
+function stripOpener(s) {
+  return String(s || "").replace(/^(?:ok(?:ay)?|hey|so|and|also|well|please|now)[,:\s]+/i, "").trim();
+}
+
+// Turn a directive sentence into a clean, imperative one-line rule: drop soft
+// openers, leading durable markers, and polite lead-ins; collapse whitespace;
+// capitalize; cap length. Keeps "never/stop/always/make sure" intact — those
+// are the rule's core and drive classification.
+function cleanRule(sentence) {
+  let s = stripOpener(sentence);
+  s = s.replace(/^(?:from now on|from here on(?: out)?|going forward|in (?:the )?future)[,:\s]+/i, "");
+  s = s.replace(/^(?:can you|could you|i(?:'d| would)? (?:like|want) you to|i want you to)\s+/i, "");
+  s = s.replace(/\s+/g, " ").trim().replace(/[\s,;:]+$/g, "");
+  if (s) s = s[0].toUpperCase() + s.slice(1);
+  return s.slice(0, MAX_RULE_CHARS);
+}
+
+function ruleOk(rule) {
+  if (!rule || rule.length < MIN_RULE_CHARS) return false;
+  const low = rule.toLowerCase();
+  if (STOP_RULES.has(low)) return false;
+  if (low.split(/\s+/).length < MIN_RULE_WORDS) return false;
+  return true;
+}
+
+// Returns { isRule, confidence: "high"|"medium", rule, trigger } or { isRule:false }.
+// High short-circuits; a medium hit is remembered as the fallback.
+function detect(text) {
+  let medium = null;
+  for (const s of splitSentences(text)) {
+    if (endsAsQuestion(s)) continue;
+    const rule = cleanRule(s);
+    if (!ruleOk(rule)) continue;
+    const hasMarker = HIGH_MARKERS.some((re) => re.test(s));
+    if (hasMarker || HIGH_NEG.test(rule)) {
+      return { isRule: true, confidence: "high", rule, trigger: hasMarker ? "marker" : "directive" };
+    }
+    if (!medium && MED_OPENER.test(rule)) medium = { isRule: true, confidence: "medium", rule, trigger: "soft" };
+  }
+  return medium || { isRule: false };
+}
+
+// ── capture (dedupe against existing lessons) ───────────────────────
+
+function findDuplicate(rule) {
+  const norm = lessons.normalize(rule);
+  return lessons.readLessons().find((l) => lessons.normalize(l.text) === norm) || null;
+}
+
+// Add the rule as a lesson, or reinforce the existing twin. origin marks
+// provenance (guardrail = owner stated it in chat); lessons meta carries the date.
+function capture(rule, { origin = "guardrail" } = {}) {
+  const dup = findDuplicate(rule);
+  const target = dup ? dup.text : rule;
+  const r = lessons.addLesson({ text: target, origin });
+  return {
+    added: !!r.added,
+    reinforced: !!r.reinforced,
+    duplicate: !!dup,
+    id: r.id || (dup && dup.id) || lessons.lessonId(target),
+    text: target,
+    count: r.count,
+    overCap: !!r.overCap,
+  };
+}
+
+// ── pending store (medium-confidence Y/N confirms) ──────────────────
+
+function readPending() {
+  try { return JSON.parse(fs.readFileSync(PENDING_FILE, "utf-8")) || {}; }
+  catch (e) { return {}; }
+}
+
+function writePending(obj) {
+  fs.mkdirSync(path.dirname(PENDING_FILE), { recursive: true, mode: 0o700 });
+  atomicWriteFileSync(PENDING_FILE, JSON.stringify(obj, null, 2) + "\n", { mode: 0o600 });
+}
+
+function prunePending(obj, now) {
+  for (const [tok, rec] of Object.entries(obj)) {
+    if (!rec || now - (rec.createdAt || 0) > PENDING_TTL_MS) delete obj[tok];
+  }
+  return obj;
+}
+
+function putPending(rule, meta = {}, now = Date.now()) {
+  const obj = prunePending(readPending(), now);
+  const token = crypto.randomBytes(5).toString("hex");
+  obj[token] = { rule, channel: meta.channel || null, createdAt: now };
+  writePending(obj);
+  return token;
+}
+
+function takePending(token, now = Date.now()) {
+  const obj = prunePending(readPending(), now);
+  const rec = obj[token] || null;
+  if (rec) { delete obj[token]; }
+  writePending(obj);
+  return rec;
+}
+
+// ── render (pure) ───────────────────────────────────────────────────
+
+function clip(s) {
+  return String(s || "").replace(/\s+/g, " ").trim().slice(0, 200);
+}
+
+function renderCaptured(res) {
+  if (!res.added) return `📌 Already a standing rule — reinforced: "${clip(res.text)}"`;
+  return `📌 Got it — I'll keep this loaded as a standing rule from now on:\n"${clip(res.text)}"` +
+    `${res.overCap ? "\n(Over the lessons cap — the nightly dream will tidy.)" : ""}` +
+    `\nTap Undo if that's not what you meant.`;
+}
+
+function renderAsk(rule) {
+  return `Want me to make this a standing rule (always loaded)?\n"${clip(rule)}"`;
+}
+
+// ── orchestrator ────────────────────────────────────────────────────
+
+// Owner-gated. `announce(text, opts?)` sends to the chat (opts may carry a
+// keyboard); omit it for a dry run. Returns a small result for testability.
+async function consider({ text, speaker, announce, now = Date.now() } = {}) {
+  if (!enabled()) return { action: "disabled" };
+  const relationship = require("./relationship");
+  if (relationship.guardActive(speaker)) return { action: "external-skip" };
+
+  const d = detect(text);
+  if (!d.isRule) return { action: "silent" };
+
+  if (d.confidence === "high") {
+    const res = capture(d.rule);
+    if (typeof announce === "function") {
+      const opts = res.added
+        ? { keyboard: { inline_keyboard: [[{ text: "↩️ Undo", callback_data: `grd:undo:${res.id}` }]] } }
+        : undefined;
+      try { await announce(renderCaptured(res), opts); } catch (e) {}
+    }
+    return { action: res.added ? "captured" : "reinforced", id: res.id, rule: res.text, duplicate: res.duplicate };
+  }
+
+  const token = putPending(d.rule, { channel: speaker && speaker.channelId }, now);
+  if (typeof announce === "function") {
+    const opts = { keyboard: { inline_keyboard: [[
+      { text: "✅ Make it a rule", callback_data: `grd:save:${token}` },
+      { text: "Skip", callback_data: `grd:no:${token}` },
+    ]] } };
+    try { await announce(renderAsk(d.rule), opts); } catch (e) {}
+  }
+  return { action: "asked", token, rule: d.rule };
+}
+
+// ── callback actions (owner-gated by the caller) ────────────────────
+
+function confirmPending(token, now = Date.now()) {
+  const rec = takePending(token, now);
+  if (!rec) return { ok: false, reason: "expired" };
+  const res = capture(rec.rule);
+  return { ok: true, ...res };
+}
+
+function dropPending(token, now = Date.now()) {
+  const rec = takePending(token, now);
+  return { ok: !!rec, rule: rec ? rec.rule : "" };
+}
+
+function undo(lessonId) {
+  return { ok: !!lessons.removeLesson(lessonId) };
+}
+
+module.exports = {
+  PENDING_FILE, PENDING_TTL_MS,
+  enabled, detect, cleanRule, ruleOk, splitSentences,
+  findDuplicate, capture,
+  putPending, takePending, prunePending,
+  consider, confirmPending, dropPending, undo,
+  renderCaptured, renderAsk,
+};

package/core/handlers.js

@@ -12,7 +12,8 @@ const {
   CHAT_ID, discoverProviderExecutable, SOUL_FILE,
 } = require("./config");
 const { register } = require("./commands");
-const { send, deleteMessage } = require("./io");
+const { send, deleteMessage, typing } = require("./io");
+const { currentAdapter, currentChannelId } = require("./context");
 const {
   currentState, saveState, rootSession,
   freshUsage, getActiveProvider, getProjectKey, getProviderSession, setProviderSession, clearProviderSession,
@@ -623,7 +624,7 @@ async function requestAgentSpaceUpgrade() {
       res.on("end", () => resolve({ status: res.statusCode, body: data }));
     });
     req.on("error", (e) => resolve({ status: 0, body: String(e.message || e) }));
-    req.setTimeout(15000, () => { req.destroy(new Error("timeout")); });
+    req.setTimeout(30000, () => { req.destroy(new Error("timeout")); });
     req.end();
   });
 }
@@ -677,6 +678,14 @@ register({
           await send("Upgrade requested — AgentSpace will pull latest image and restart, see you in a minute.");
           return;
         }
+        // A client-side timeout is not a failure: the control plane triggers the
+        // rollout fire-and-forget, and a pod being rolled is exactly when its own
+        // in-flight request gets cut off. Framing it as "failed" invites a retry
+        // storm of redundant rollouts, so surface it as pending instead.
+        if (result && result.status === 0 && /timeout/i.test(result.body || "")) {
+          await send("Upgrade request sent but the reply timed out — likely because I'm already restarting. Give it a minute before re-running; I should come back on the new image.");
+          return;
+        }
         await send(`Upgrade request failed (status ${result?.status || "?"}). ${(result?.body || "").slice(0, 300)}`);
         return;
       } catch (e) {
@@ -1063,6 +1072,45 @@ register({
   },
 });
 
+register({
+  name: "agenda", aliases: ["agency"], description: "Aggregated read-only work list (tasks + Spaces + notifications)",
+  handler: async (env) => {
+    if (!authorized(env)) return;
+    const adapter = currentAdapter();
+    const channelId = currentChannelId();
+    const ledger = require("./agency/ledger");
+    try { typing(); } catch (_) {}
+    let result;
+    try {
+      result = await ledger.collect({ adapter: adapter && adapter.id, channelId });
+    } catch (e) {
+      return send(`Couldn't build the agenda: ${e.message}`);
+    }
+    send(ledger.render(result, { now: result.generatedAt, limitPerSource: 8 }));
+  },
+});
+
+register({
+  name: "next", description: "Advisory: what I'd pick to do next, and why (acts on nothing)",
+  handler: async (env) => {
+    if (!authorized(env)) return;
+    const adapter = currentAdapter();
+    const channelId = currentChannelId();
+    const ledger = require("./agency/ledger");
+    const deliberate = require("./agency/deliberate");
+    try { typing(); } catch (_) {}
+    let proposal;
+    try {
+      const result = await ledger.collect({ adapter: adapter && adapter.id, channelId });
+      proposal = await deliberate.deliberate(result, { now: result.generatedAt });
+      try { deliberate.record(proposal, { channel: adapter && adapter.id ? `${adapter.id}:${channelId}` : null }); } catch (_) {}
+    } catch (e) {
+      return send(`Couldn't deliberate: ${e.message}`);
+    }
+    send(deliberate.render(proposal));
+  },
+});
+
 register({
   name: "toolmode", description: "Tooling enforcement mode (strict = forced CLI, relaxed = scripting allowed)", args: "[strict|relaxed]", ownerOnly: true,
   handler: async (env, { tail }) => {