@jossuealcala/madre 0.5.2 → 0.7.0

package/src/adapters/claude.mjs

@@ -21,6 +21,10 @@ export function mcpServersFor({ imageStudio = null, memoryServer = null, mcpServ
 // Claude's permission names for a module's server: each tool, or the whole server when the list is open.
 export const claudeMcpTools = (server) => (server.tools?.length ? server.tools.map((tool) => `mcp__${server.name}__${tool}`) : [`mcp__${server.name}`]);
 
+// Every spelling of the lease directory. One unless the path given to MADRE goes through a
+// symlink, in which case the resolved one travels too — see the note in createLease.
+export const leaseRoots = (lease) => [...new Set([lease?.outDir, lease?.realOutDir].filter(Boolean))];
+
 export function buildClaudeArgs({ prompt, model = null, attachmentsDir = null, lease = null, scopes = null, imageStudio = null, memoryServer = null, mcpServers = [] }) {
   const tools = claudeTools({ lease, scopes });
   const mcpTools = [
@@ -34,7 +38,7 @@ export function buildClaudeArgs({ prompt, model = null, attachmentsDir = null, l
     // Claude Code grants Write only when Edit is allowed on the same paths (verified with the real
     // CLI: a lone Write rule is denied under dontAsk), so both come together; in CREATE the room
     // restores existing files after the turn.
-    ...(lease ? [`Write(//${lease.outDir}/**)`, `Edit(//${lease.outDir}/**)`] : []),
+    ...(lease ? leaseRoots(lease).flatMap((root) => [`Write(//${root}/**)`, `Edit(//${root}/**)`]) : []),
     ...(lease?.airlock ? ['Bash'] : []),
     ...(scopes?.web ? ['WebFetch', 'WebSearch'] : []),
     ...mcpTools,
@@ -53,7 +57,7 @@ export function buildClaudeArgs({ prompt, model = null, attachmentsDir = null, l
     '--tools', tools.join(','),
     ...(lease || scopes?.web || anyMcp ? ['--allowedTools', allowed.join(',')] : []),
     // CONTROL: the whole project is writable except MADRE's forbidden zones.
-    ...(lease?.control || lease?.create ? ['--disallowedTools', ['.git/**', '.pulse/**', '.madre/**', '.env', '.env.*', '**/.env', '**/.env.*', '.claude/settings.local.json'].flatMap((glob) => [`Write(//${lease.outDir}/${glob})`, `Edit(//${lease.outDir}/${glob})`]).join(',')] : []),
+    ...(lease?.control || lease?.create ? ['--disallowedTools', ['.git/**', '.pulse/**', '.madre/**', '.env', '.env.*', '**/.env', '**/.env.*', '.claude/settings.local.json'].flatMap((glob) => leaseRoots(lease).flatMap((root) => [`Write(//${root}/${glob})`, `Edit(//${root}/${glob})`])).join(',')] : []),
     // --safe-mode disables every MCP server, ours included. With a MADRE server
     // attached we drop it and instead load no setting sources at all: no user
     // hooks, plugins or MCP servers, only the project's CLAUDE.md and ours.

package/src/adapters/gemini.mjs

@@ -28,13 +28,21 @@ export const geminiCredentialFiles = ['oauth_creds.json', 'google_accounts.json'
 // whose file_path argument starts with the lease directory. Plan mode would
 // block every write regardless of policy, so a lease uses approval "default":
 // headless Gemini cannot prompt, so anything the policy does not allow fails.
-export function geminiLeasePolicy(outDir, { control = false, create = false, airlock = false } = {}) {
-  const escaped = outDir.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+export function geminiLeasePolicy(outDir, { control = false, create = false, airlock = false, alsoAt = null } = {}) {
+  const quote = (path) => path.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  // Every spelling of the same directory. When the path MADRE was given goes through a symlink,
+  // an agent that resolves before writing asks for a path that does not start with the one these
+  // rules were built from: the allow rule misses and the write dies in silence. Both go in the
+  // allow rule AND in the deny rule — allowing a second spelling while forbidding the zones under
+  // only the first would leave .git and .pulse reachable by the other name.
+  const roots = [...new Set([outDir, alsoAt].filter(Boolean))];
+  const escaped = roots.map(quote).join('|');
+  const anyRoot = roots.length > 1 ? `(?:${escaped})` : escaped;
   // The whole project is the lease in #2 and #3: MADRE's zones stay out of reach.
   const forbidden = control || create ? `
 [[rule]]
 toolName = ["write_file", "replace", "edit", "run_shell_command"]
-argsPattern = '${escaped}/(\\.git|\\.pulse|\\.madre|\\.env|\\.claude/settings\\.local\\.json)'
+argsPattern = '${anyRoot}/(\\.git|\\.pulse|\\.madre|\\.env|\\.claude/settings\\.local\\.json)'
 decision = "deny"
 priority = 1100
 interactive = false
@@ -52,7 +60,7 @@ interactive = false
   return `${geminiReadonlyPolicy}${commands}
 [[rule]]
 toolName = ${tools}
-argsPattern = '"file_path"\\s*:\\s*"${escaped}/'
+argsPattern = '"file_path"\\s*:\\s*"${anyRoot}/'
 decision = "allow"
 priority = 1000
 interactive = false
@@ -68,7 +76,7 @@ interactive = false
 `;
 
 export function geminiPolicy({ lease = null, scopes = null, imageStudio = null, memoryServer = null, mcpServers = [] } = {}) {
-  return `${lease ? geminiLeasePolicy(lease.outDir, { control: Boolean(lease.control), create: Boolean(lease.create), airlock: Boolean(lease.airlock) }) : geminiReadonlyPolicy}${scopes?.web ? geminiWebPolicy : ''}${imageStudio && lease ? geminiImagePolicy(imageStudio) : ''}${memoryServer ? geminiMemoryPolicy(memoryServer) : ''}${mcpServers.map(geminiMemoryPolicy).join('')}`;
+  return `${lease ? geminiLeasePolicy(lease.outDir, { control: Boolean(lease.control), create: Boolean(lease.create), airlock: Boolean(lease.airlock), alsoAt: lease.realOutDir ?? null }) : geminiReadonlyPolicy}${scopes?.web ? geminiWebPolicy : ''}${imageStudio && lease ? geminiImagePolicy(imageStudio) : ''}${memoryServer ? geminiMemoryPolicy(memoryServer) : ''}${mcpServers.map(geminiMemoryPolicy).join('')}`;
 }
 
 // Allow rules for a server's tools, by bare name and by server-prefixed name; an open tool list allows the server's prefix.
@@ -251,6 +259,19 @@ export function diagnoseGeminiStderr(stderr) {
   if (/status:\s*40[13]|PERMISSION_DENIED|API key not valid|IneligibleTierError/i.test(text)) {
     return { code: 'AUTH', message: t('Google rejected the Gemini credentials.'), hint: t('Run `gemini` and use /auth, or check GEMINI_API_KEY.') };
   }
+  // A subagent, refused. The policy is right to refuse it — a subagent answers outside the lease
+  // and outside everything the room counts — but the CLI does not treat the refusal as an answer:
+  // it waits, and the turn dies on MADRE's clock three minutes later with nothing to show.
+  //
+  // Only this tool. A blocked `write_file` leaves the CLI working and it goes on to answer, so
+  // treating every refusal as fatal would cut turns that were going to finish.
+  if (/Unauthorized tool call:\s*'?invoke_agent'?|Blocked call:[^\n]*invoke_agent/i.test(text)) {
+    return {
+      code: 'SUBAGENT_BLOCKED',
+      message: t('Gemini tried to hand this turn to one of its own subagents. MADRE does not allow that: a subagent answers outside the lease, so nothing it wrote would be checked, shown or undoable.'),
+      hint: t('Ask again saying it should do the work itself, without subagents.'),
+    };
+  }
   return null;
 }
 

package/src/adapters/madre.mjs

@@ -105,6 +105,11 @@ export function roundTable(text, { crew = [], maxSteps = 4 } = {}) {
     if (!step || !step[0]) break;
     rest = rest.slice(step[0].length);
   }
+  // Whatever punctuation the hinge left behind. The loop above eats the linking words, but the
+  // colon in «pregúntale al crew: …» only goes with them when another connective follows it —
+  // and what is left starts the question the room announces, sends to four agents and quotes
+  // again when it closes.
+  rest = rest.trim().replace(/^[\s,:;.\-–—]+/, '');
   rest = rest.trim().replace(/^[«"“'`]+|[»"”'`.!]+$/g, '').trim();
   const question = rest.length >= 6 ? rest : (es ? DEFAULT_ES : DEFAULT_EN);
   const agents = crew.slice(0, maxSteps);

package/src/choices.mjs

@@ -0,0 +1,64 @@
+// An agent asking the human to choose.
+//
+// The room already has one fenced channel, ```pulse, and it puts other agents to work. This is
+// its inert sibling: ```pulse-ask carries a question and the options an agent sees, and running
+// it does nothing at all. MADRE renders the options under the answer; pressing one writes that
+// option into the composer as the human's next message. Nothing is sent, nothing is decided and
+// no turn is spent until the human presses.
+//
+// Separate from the delegation parser on purpose. That one is load-bearing — it starts real
+// turns with real permissions — and a question is not a step. Teaching it a second grammar would
+// put a parser that can spend money in the path of a parser that cannot.
+//
+//   ```pulse-ask
+//   Where should the exported dataset live?
+//   - Beside the room log, with the rest of the archive
+//   - In the project, so it travels with the repository
+//   - Somewhere the human names each time
+//   ```
+//
+// Two options are a yes/no, which a sentence already handles; the block earns its place from
+// three. Above six it is a list, not a choice, and the room says so by refusing it.
+
+export const MIN_OPTIONS = 3;
+export const MAX_OPTIONS = 6;
+const MAX_QUESTION = 200;
+const MAX_OPTION = 120;
+
+// The last ```pulse-ask block of a reply, if it closes the reply. Returns null for anything
+// else: a block quoted mid-answer is an example, and an example is not a question.
+export function parseChoice(text) {
+  const source = String(text ?? '');
+  const blocks = [...source.matchAll(/```pulse-ask\s*\n([\s\S]*?)```/gi)];
+  if (!blocks.length) return null;
+  const last = blocks.at(-1);
+  if (source.slice(last.index + last[0].length).trim()) return null;
+
+  const lines = last[1].split('\n').map((line) => line.trim()).filter(Boolean);
+  if (!lines.length) return null;
+  const question = lines[0].startsWith('-') ? null : lines[0].slice(0, MAX_QUESTION);
+  const options = [];
+  const seen = new Set();
+  for (const line of lines.slice(question ? 1 : 0)) {
+    const match = line.match(/^[-*•]\s+(.+)$/);
+    if (!match) continue;
+    const label = match[1].trim().slice(0, MAX_OPTION);
+    // The same option twice is a mistake, and a choice that offers it twice reads as rigged.
+    const key = label.toLowerCase();
+    if (!label || seen.has(key)) continue;
+    seen.add(key);
+    options.push(label);
+  }
+  if (!question) return null;
+  if (options.length < MIN_OPTIONS || options.length > MAX_OPTIONS) return null;
+  return { question, options };
+}
+
+// What the reply reads as once the block has been lifted out of it: the room shows the question
+// as bubbles, so leaving the raw fence in the text would say everything twice.
+export function withoutChoice(text) {
+  const source = String(text ?? '');
+  if (!parseChoice(source)) return source;
+  const last = [...source.matchAll(/```pulse-ask\s*\n[\s\S]*?```/gi)].at(-1);
+  return source.slice(0, last.index).trimEnd();
+}

package/src/dataset.mjs

@@ -8,7 +8,7 @@
 import { mkdir, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { redact } from './sentinel-errors.mjs';
-import { ABERRATION } from './memory.mjs';
+import { ABERRATION, VERDICTS, NEGATIVE_VERDICTS, POSITIVE_VERDICTS } from './memory.mjs';
 
 const MIN_ANSWER_CHARS = 40;
 
@@ -19,16 +19,21 @@ function system(project, agent) {
 // Pairs a question with the reply that answered it (parentMessageId). The question is the
 // human's message, or an orchestrator's delegated step: both are real instructions with a
 // real answer. What never trains MADRE: @madre's own answers (the student is not the teacher),
-// MADRE's canned replies, replies the human rated bad, ghosts, one-liners.
+// MADRE's canned replies, replies the human judged bad or never, ghosts, one-liners.
 const guard = (privacy) => (text) => (privacy ? privacy.redact(text).text : text);
 export const STUDENT = 'madre';
 export const DATASET_TARGET = 300;
 
+// The ledger folded to the last word said about each reply. Read against the vocabulary and not
+// against a pair of literals: for a while this knew two verdicts and treated everything else as a
+// clearing, so a verdict the room had just learned to say would be deleted here on the way out,
+// in silence, with the export looking perfectly healthy.
 export function ratingsFrom(events) {
   const ratings = new Map();
   for (const event of events) {
     if (event.type !== 'message.rated' || !event.payload?.messageId) continue;
-    if (event.payload.rating === 'good' || event.payload.rating === 'bad') ratings.set(event.payload.messageId, event.payload.rating);
+    const verdict = event.payload.rating;
+    if (VERDICTS.includes(verdict) && verdict !== 'none') ratings.set(event.payload.messageId, verdict);
     else ratings.delete(event.payload.messageId);
   }
   return ratings;
@@ -51,7 +56,7 @@ export function pairsFromEvents(events, { project = 'project', home, user, priva
       continue;
     }
     if (p.sender === STUDENT || p.synthetic) continue;
-    if (ratings.get(p.messageId) === 'bad') continue;
+    if (NEGATIVE_VERDICTS.includes(ratings.get(p.messageId))) continue;
     const ask = asks.get(p.parentMessageId);
     if (!ask) continue;
     const answer = (p.originalText ?? p.text).trim();
@@ -82,7 +87,7 @@ export function readiness(events, notes = [], { target = DATASET_TARGET } = {})
   for (const rating of ratings.values()) if (rating === 'bad') bad += 1;
   const turns = pairs.filter((pair) => pair.kind === 'turn').length;
   const delegated = pairs.length - turns;
-  const good = pairs.filter((pair) => pair.rating === 'good').length;
+  const good = pairs.filter((pair) => POSITIVE_VERDICTS.includes(pair.rating)).length;
   // Aberrations are counted apart: they never become one of the pairs the model learns to
   // answer with, so counting them toward readiness would say the room is further along than it is.
   const standing = notes.filter((note) => note.kind !== ABERRATION && !note.refutedBy);
@@ -173,7 +178,7 @@ export async function exportDataset({ events, notes = [], dir, project = 'projec
   await writeFile(join(dir, 'preferences.jsonl'), preferences.map((pair) => JSON.stringify({ prompt: pair.prompt, chosen: pair.chosen, rejected: pair.rejected })).join('\n') + (preferences.length ? '\n' : ''));
   const byAgent = {};
   for (const pair of pairs) byAgent[pair.agent] = (byAgent[pair.agent] ?? 0) + 1;
-  const manifest = { project, exportedAt: new Date().toISOString(), pairs: pairs.length, turns: pairs.filter((p) => p.kind === 'turn').length, delegated: pairs.filter((p) => p.kind === 'delegated').length, good: pairs.filter((p) => p.rating === 'good').length, notes: pairs.filter((p) => p.kind === 'note').length, aberrations: preferences.length, train: train.length, valid: valid.length, byAgent, files: ['train.jsonl', 'valid.jsonl', 'preferences.jsonl'], format: 'chat · {"messages":[{role,content}]} · mlx-lm / llama-factory / axolotl', preferenceFormat: 'preference · {"prompt","chosen","rejected"} · DPO / ORPO' };
+  const manifest = { project, exportedAt: new Date().toISOString(), pairs: pairs.length, turns: pairs.filter((p) => p.kind === 'turn').length, delegated: pairs.filter((p) => p.kind === 'delegated').length, good: pairs.filter((p) => POSITIVE_VERDICTS.includes(p.rating)).length, notes: pairs.filter((p) => p.kind === 'note').length, aberrations: preferences.length, train: train.length, valid: valid.length, byAgent, files: ['train.jsonl', 'valid.jsonl', 'preferences.jsonl'], format: 'chat · {"messages":[{role,content}]} · mlx-lm / llama-factory / axolotl', preferenceFormat: 'preference · {"prompt","chosen","rejected"} · DPO / ORPO' };
   await writeFile(join(dir, 'manifest.json'), `${JSON.stringify(manifest, null, 2)}\n`);
   return { dir, ...manifest };
 }

package/src/distiller.mjs

@@ -11,6 +11,9 @@ export const DISTILLER_ORDER = ['ollama', 'gemini', 'opencode', 'codex', 'claude
 export const OLLAMA_ARCHIVIST = { id: 'ollama', label: 'Ollama', detected: true, ready: true, adapter: 'ollama', path: null, version: null, local: true };
 export const MAX_MEMORIES_PER_RUN = 5;
 export const MAX_MEMORY_CHARS = 240;
+// A discard is matched against, not learned from, so it travels clipped: the room pays about
+// half for the same effect.
+export const DISCARDED_CHARS = 110;
 
 // The agent that pays for distillation: the human's pick if it is usable, else
 // the cheapest ready one that has an adapter and no turn in flight.
@@ -28,13 +31,20 @@ export function pickDistiller(agents, { preferred = null, busy = new Set(), invo
   return agents.find(usable) ?? null;
 }
 
-export function distillPrompt({ entries, projectName = 'the project', existing = [], json = false }) {
+const shorten = (value, max) => (value.length > max ? `${value.slice(0, max - 1)}…` : value);
+
+export function distillPrompt({ entries, projectName = 'the project', existing = [], discarded = [], json = false }) {
   const transcript = entries.map((entry) => {
     const who = entry.role === 'command' ? entry.sender : `@${entry.sender}`;
     const to = entry.target && entry.target !== 'room' ? ` → ${entry.target === 'you' ? 'human' : `@${entry.target}`}` : '';
     return `[#${entry.sequence} · ${who} (${entry.role})${to}] ${entry.text}`;
   }).join('\n\n');
+  // Two lists, because they say opposite things. What the room holds is not to be written twice;
+  // what the room threw out is not to be written at all — and before this the archivist was handed
+  // the newest notes whatever their standing, false ones included, under one heading that only
+  // said «do not repeat». A list with nothing in it is left out rather than printed empty.
   const known = existing.length ? `\nAlready remembered (do not repeat these):\n${existing.map((memory) => `- ${memory.text}`).join('\n')}\n` : '';
+  const thrownOut = discarded.length ? `\nAlready discarded — the room took these out of circulation. Do not write them again, in these words or others:\n${discarded.map((memory) => `- ${shorten(memory.text, DISCARDED_CHARS)}`).join('\n')}\n` : '';
   return [
     `You are the archivist of a MADRE project room for "${projectName}", shared by a human and several AI agents. Do not read or modify any file: everything you need is below.`,
     'Read these room exchanges (each stamped with its ledger sequence) and write only the memories worth keeping for future turns of any agent:',
@@ -50,6 +60,7 @@ export function distillPrompt({ entries, projectName = 'the project', existing =
     json ? null : `{"kind":"${MEMORY_KINDS.join('|')}","text":"one self-contained sentence in the language the room uses, at most ${MAX_MEMORY_CHARS} characters, naming files, agents and numbers exactly","correction":"only on an aberration: what is true instead","sources":[sequence numbers it comes from]}`,
     json ? null : 'If nothing durable was said, output exactly: NONE',
     known,
+    thrownOut,
     '<exchanges>',
     transcript,
     '</exchanges>',

package/src/file-ops.mjs

@@ -0,0 +1,45 @@
+// Copying and moving a file, from the human's own hands.
+//
+// Everything else in MADRE that writes into a project is an agent under a permission mode. This
+// is not that: it is the human, in their own project, doing what a file manager does. So there
+// is no mode and no lease — but there are still two fences, because a slip of the hand is not
+// an argument for losing a .env.
+//
+//   · the project is the world. Both ends resolve inside it or the operation does not happen,
+//     and that is checked after following symlinks, not before.
+//   · the zones MADRE protects from agents are protected from accidents too. Touching .git,
+//     .pulse, .madre, a .env or the local settings asks for the project's designation first —
+//     the same word the room asks for before CONTROL. Typing a folder name is a small ceremony;
+//     restoring a deleted key is not.
+
+import { isForbidden } from './checkpoint.mjs';
+
+export const OPERATIONS = ['copy', 'move', 'new-file', 'new-folder'];
+// The two that make something out of nothing: they have a destination and no source.
+export const CREATIONS = ['new-file', 'new-folder'];
+
+// Whether a path is one the room guards. Both ends count: moving something harmless ONTO a
+// protected path is how a protected path gets overwritten.
+export function needsDesignation(...paths) {
+  return paths.filter(Boolean).some((path) => isForbidden(String(path).replace(/^\.\//, '')));
+}
+
+// What the room will say about an operation before doing any of it.
+export function planFileOp({ operation, from, to }) {
+  if (!OPERATIONS.includes(operation)) return { ok: false, error: `Unknown operation: ${operation}.` };
+  const source = String(from ?? '').replace(/^\/+/, '').trim();
+  const target = String(to ?? '').replace(/^\/+/, '').trim();
+  if (CREATIONS.includes(operation)) {
+    if (!target) return { ok: false, error: 'A name is needed.' };
+    // A name, not a path: making something is done where the human is looking, and a slash in
+    // the box would quietly write somewhere else.
+    const name = target.slice(target.lastIndexOf('/') + 1);
+    if (!name || name === '.' || name === '..') return { ok: false, error: 'That is not a name.' };
+    return { ok: true, operation, from: null, to: target, guarded: needsDesignation(target) };
+  }
+  if (!source || !target) return { ok: false, error: 'Both a source and a destination are needed.' };
+  if (source === target) return { ok: false, error: 'The source and the destination are the same path.' };
+  // Moving a folder into itself leaves nothing behind and no way back.
+  if (operation === 'move' && `${target}/`.startsWith(`${source}/`)) return { ok: false, error: 'A folder cannot be moved inside itself.' };
+  return { ok: true, operation, from: source, to: target, guarded: needsDesignation(source, target) };
+}

package/src/lease.mjs

@@ -1,4 +1,4 @@
-import { mkdir, readdir, stat } from 'node:fs/promises';
+import { mkdir, readdir, realpath, stat } from 'node:fs/promises';
 import { join, relative, sep } from 'node:path';
 import { contentTypeFor } from './files.mjs';
 
@@ -24,7 +24,41 @@ export async function createLease({ projectRoot, leaseId }) {
   const relativeDir = join(LEASE_ROOT, name);
   const outDir = join(projectRoot, relativeDir);
   await mkdir(outDir, { recursive: true, mode: 0o755 });
-  return { leaseId, outDir, relativeDir };
+  // The same directory said the other way, when the path given to MADRE goes through a symlink.
+  // On macOS `/tmp` is a link to `/private/tmp`, so an agent that resolves a path before writing
+  // asks to write somewhere that does not begin with the string the permission rule was built
+  // from. The rule misses, a headless CLI cannot stop to ask, the write fails without a word, and
+  // the model reports the file as created. Both spellings travel so both can be allowed — and,
+  // just as importantly, so the forbidden zones can be denied under either one.
+  const realOutDir = await realpath(outDir).catch(() => outDir);
+  return { leaseId, outDir, relativeDir, ...(realOutDir === outDir ? {} : { realOutDir }) };
+}
+
+// The files a reply names, as paths and not as intentions.
+//
+// A CLI whose write was refused in silence answers as if it had written: the room shows no
+// artifacts, and the text says «Archivos creados: …». Rather than read the prose for a claim —
+// which means guessing in two languages and warning wrongly when an agent merely SUGGESTS a
+// path — this collects the paths it names under the project and lets the disk settle it. What
+// is on disk is never mentioned; only what is named and absent.
+export function namedPaths(text, { roots = [] } = {}) {
+  const said = String(text ?? '');
+  const bases = roots.filter(Boolean);
+  const found = new Set();
+  // A path, absolute or project-relative, ending in a short extension. Trailing punctuation and
+  // the closing of a quote, a bracket or a sentence are not part of a filename.
+  for (const match of said.matchAll(/(?:^|[\s(`"'«\[>])((?:\/|\.{0,2}\/)?[\w.@+-]+(?:\/[\w.@+-]+)+\.[A-Za-z][\w]{0,8})/g)) {
+    let path = match[1].replace(/[.,;:)\]»"'`]+$/, '');
+    if (!path.includes('/')) continue;
+    if (path.startsWith('/')) {
+      const under = bases.find((base) => path === base || path.startsWith(`${base}/`));
+      if (!under) continue;                       // somewhere else entirely: not ours to check
+      found.add(path);
+      continue;
+    }
+    found.add(path.replace(/^\.\//, ''));
+  }
+  return [...found];
 }
 
 // name → { size, mtimeMs } for every file under `dir`, recursively.
@@ -85,6 +119,7 @@ export function leaseInstructions({ outDir, agentId, scopes = { write: true, ima
       : canImage ? `You can generate images; save them${create ? ' where images live in this project, or in the scratch folder,' : ' into the lease directory'} with a descriptive file name.`
       : couldImage ? 'Image generation is switched off for this request; if asked for an image, say so and do not attempt it.'
         : 'You cannot generate images from this CLI; if asked for one, say so plainly instead of attempting it.',
+    'Do this work yourself. Do not hand it to a subagent or spawn another agent: a subagent writes outside this lease, so nothing it did would be checked, shown to the human or undoable — and the tools for it are blocked, which can leave you waiting instead of answering.',
     'List the files you created (or "none") before any plan block; nothing may follow a plan block.',
   ].filter(Boolean).join('\n');
 }

package/src/mcp/smtp-server.mjs

@@ -0,0 +1,189 @@
+#!/usr/bin/env node
+// MADRE CORREO: a tiny MCP server (stdio, JSON-RPC 2.0) exposing one tool, send_email, that
+// hands one message to the user's own mail provider over SMTP+TLS with the user's own app
+// password. There is no MADRE in the middle: this process talks to smtp.gmail.com (or whatever
+// host the module was pointed at) and to nothing else.
+//
+// This is the first MADRE tool whose effect does not come back. A file can be undone; a sent
+// message cannot. So three things hold, and each is enforced somewhere a module cannot reach:
+//
+//   · The room only hands this server's tool to a turn at #4 AIRLOCK (toolsForTurn, `sends`),
+//     where the agent must already say in one line what leaves and where before it leaves.
+//   · The password arrives in this process's environment from the vault, and is never written
+//     anywhere: not in the tool result, not in the outbound log, not in the ledger.
+//   · If the module set a list of allowed recipients, a message to anybody else is refused here
+//     rather than in the prompt, because a prompt is a suggestion.
+//
+// Environment:
+//   PULSE_SMTP_FROM       required, the address messages are sent from
+//   PULSE_SMTP_PASSWORD   required, the app password (from the vault)
+//   PULSE_SMTP_USER       the account to authenticate as; defaults to PULSE_SMTP_FROM
+//   PULSE_SMTP_FROM_NAME  optional display name
+//   PULSE_SMTP_HOST       default smtp.gmail.com
+//   PULSE_SMTP_PORT       default 465 (implicit TLS)
+//   PULSE_SMTP_ALLOW      optional comma list of addresses or @domains; empty means anyone
+//   PULSE_OUTBOUND_LOG    where to append the one line this send leaves behind
+//   PULSE_SMTP_FAKE=1     write the message to PULSE_SMTP_FAKE_FILE instead of sending (tests)
+
+import { appendFile, realpath } from 'node:fs/promises';
+import { OutboundLog, declareDestinations } from '../outbound.mjs';
+import { SMTP_PORT, buildMessage, sendMail, validAddress } from '../smtp.mjs';
+
+const SERVER_NAME = 'pulse-correo';
+const SERVER_VERSION = '0.1.0';
+const DEFAULT_HOST = 'smtp.gmail.com';
+
+// The four answers `src/outbound.mjs` demands of any destination. They live here rather than in
+// the module because this server is a different process — `declareDestinations` in the room says
+// nothing to `declareDestinations` here — and both sides must give the same answers.
+//
+// The id stays `smtp` whatever the host is, so re-declaring a changed host REPLACES the entry
+// rather than leaving the room vouching for a server it no longer talks to.
+export const reachesFor = (host = DEFAULT_HOST) => [{
+  id: 'smtp',
+  host,
+  to: host === DEFAULT_HOST ? 'Google · Gmail, with your own account' : `${host}, with your own account`,
+  what: 'The message you asked to send: its recipients, subject and body, and your app password to sign in.',
+  when: 'Only when an agent in #4 AIRLOCK calls send_email, and only for that one message.',
+  where: 'Switch off the CORREO module, or forget its app password, and nothing can leave.',
+}];
+export const REACHES = reachesFor();
+
+// Who may receive. An empty list is "anyone" — deliberate, because narrowing it is a setting the
+// human turns on, not a default that would quietly swallow the first thing they try to send.
+export function parseAllow(raw) {
+  return String(raw ?? '').split(',').map((one) => one.trim().toLowerCase()).filter(Boolean);
+}
+
+export function allowed(address, allow = []) {
+  if (!allow.length) return true;
+  const one = String(address ?? '').toLowerCase();
+  const domain = one.slice(one.indexOf('@'));
+  return allow.some((rule) => (rule.startsWith('@') ? rule === domain : rule === one));
+}
+
+// A TLS socket is not `fetch`, so the wrapper that watches every other outbound call cannot see
+// this one. The server writes its own line instead: the host, whether it went, how long it took
+// and how many bytes. Never a recipient, never a subject, never the password — the log says that
+// something left and where to, the same as it does for every other destination.
+function noteSend({ env, host, ok, ms, bytes, error = null }) {
+  if (!env.PULSE_OUTBOUND_LOG) return;
+  declareDestinations('correo', reachesFor(host));
+  try {
+    new OutboundLog({ file: env.PULSE_OUTBOUND_LOG })
+      .record({ url: `smtps://${host}:${env.PULSE_SMTP_PORT || SMTP_PORT}/`, method: 'SMTP', ok, ms, bytes, ...(error ? { error } : {}) });
+  } catch { /* the log must never be the reason a message fails */ }
+}
+
+export async function send({ to, subject, body, env = process.env, send: sendImpl = sendMail }) {
+  const from = env.PULSE_SMTP_FROM ?? '';
+  if (!validAddress(from)) throw Object.assign(new Error('CORREO has no sending address configured.'), { code: 'NO_FROM' });
+  const recipients = (Array.isArray(to) ? to : String(to ?? '').split(',')).map((one) => String(one).trim()).filter(Boolean);
+  if (!recipients.length) throw Object.assign(new Error('Say who it goes to.'), { code: 'NO_RECIPIENT' });
+  const allow = parseAllow(env.PULSE_SMTP_ALLOW);
+  const refused = recipients.filter((one) => !allowed(one, allow));
+  if (refused.length) throw Object.assign(new Error(`CORREO is limited to ${allow.join(', ')}; it will not write to ${refused.join(', ')}.`), { code: 'NOT_ALLOWED' });
+  if (!String(subject ?? '').trim()) throw Object.assign(new Error('A message with no subject reads as spam. Give it one.'), { code: 'NO_SUBJECT' });
+  if (!String(body ?? '').trim()) throw Object.assign(new Error('There is nothing in the message.'), { code: 'NO_BODY' });
+
+  const host = env.PULSE_SMTP_HOST || DEFAULT_HOST;
+  const started = Date.now();
+
+  if (env.PULSE_SMTP_FAKE === '1') {
+    const message = buildMessage({ from, fromName: env.PULSE_SMTP_FROM_NAME ?? '', to: recipients, subject, body });
+    if (env.PULSE_SMTP_FAKE_FILE) await appendFile(env.PULSE_SMTP_FAKE_FILE, `${JSON.stringify({ host, from, to: recipients, message })}\n`);
+    noteSend({ env, host, ok: true, ms: Date.now() - started, bytes: Buffer.byteLength(message, 'utf8') });
+    return { to: recipients, bytes: Buffer.byteLength(message, 'utf8'), host, reply: 'fake' };
+  }
+
+  try {
+    const result = await sendImpl({
+      host,
+      port: Number(env.PULSE_SMTP_PORT) || SMTP_PORT,
+      user: env.PULSE_SMTP_USER || from,
+      password: env.PULSE_SMTP_PASSWORD ?? '',
+      from,
+      fromName: env.PULSE_SMTP_FROM_NAME ?? '',
+      to: recipients,
+      subject,
+      body,
+    });
+    noteSend({ env, host, ok: true, ms: Date.now() - started, bytes: result.bytes });
+    return { ...result, host };
+  } catch (error) {
+    noteSend({ env, host, ok: false, ms: Date.now() - started, bytes: null, error: error.code ?? 'ERROR' });
+    throw error;
+  }
+}
+
+export const TOOL = {
+  name: 'send_email',
+  description: 'Send one plain-text email from the human\'s own mail account. This cannot be undone and the message carries their name: before calling it, state in one line exactly who it goes to and what it says. Attachments, HTML and CC/BCC are not supported.',
+  inputSchema: {
+    type: 'object',
+    properties: {
+      to: { type: 'string', description: 'Recipient address. Several are allowed, separated by commas.' },
+      subject: { type: 'string', description: 'The subject line.' },
+      body: { type: 'string', description: 'The message, as plain text. Line breaks are kept.' },
+    },
+    required: ['to', 'subject', 'body'],
+  },
+};
+
+export function handleRequest(message, { env = process.env, sendImpl = send } = {}) {
+  const reply = (result) => ({ jsonrpc: '2.0', id: message.id, result });
+  const fail = (code, text) => ({ jsonrpc: '2.0', id: message.id, error: { code, message: text } });
+  switch (message.method) {
+    case 'initialize':
+      return Promise.resolve(reply({ protocolVersion: message.params?.protocolVersion ?? '2025-06-18', capabilities: { tools: {} }, serverInfo: { name: SERVER_NAME, version: SERVER_VERSION } }));
+    case 'notifications/initialized':
+    case 'initialized':
+      return Promise.resolve(null);
+    case 'ping':
+      return Promise.resolve(reply({}));
+    case 'tools/list':
+      return Promise.resolve(reply({ tools: [TOOL] }));
+    case 'tools/call': {
+      const { name, arguments: args = {} } = message.params ?? {};
+      if (name !== TOOL.name) return Promise.resolve(fail(-32602, `Unknown tool: ${name}`));
+      return sendImpl({ to: args.to, subject: args.subject, body: args.body, env })
+        .then((result) => reply({ content: [{ type: 'text', text: `Sent to ${result.to.join(', ')} via ${result.host} (${result.bytes} bytes).` }], isError: false }))
+        .catch((error) => reply({ content: [{ type: 'text', text: `Nothing was sent (${error.code ?? 'ERROR'}): ${error.message}` }], isError: true }));
+    }
+    default:
+      return Promise.resolve(message.id === undefined ? null : fail(-32601, `Method not found: ${message.method}`));
+  }
+}
+
+export function serve({ input = process.stdin, output = process.stdout, env = process.env } = {}) {
+  let buffer = '';
+  let pending = 0;
+  let ended = false;
+  const finish = () => { if (ended && pending === 0) process.exit(0); };
+  input.setEncoding('utf8');
+  input.on('data', (chunk) => {
+    buffer += chunk;
+    let index;
+    while ((index = buffer.indexOf('\n')) >= 0) {
+      const line = buffer.slice(0, index).trim();
+      buffer = buffer.slice(index + 1);
+      if (!line) continue;
+      let message;
+      try { message = JSON.parse(line); } catch { output.write(`${JSON.stringify({ jsonrpc: '2.0', id: null, error: { code: -32700, message: 'Parse error' } })}\n`); continue; }
+      pending += 1;
+      void handleRequest(message, { env })
+        .then((response) => { if (response) output.write(`${JSON.stringify(response)}\n`); })
+        .finally(() => { pending -= 1; finish(); });
+    }
+  });
+  input.on('end', () => { ended = true; finish(); });
+}
+
+const invokedDirectly = process.argv[1] && (await realpath(process.argv[1]).catch(() => process.argv[1])) === (await realpath(new URL(import.meta.url).pathname).catch(() => null));
+if (invokedDirectly) {
+  if (!process.env.PULSE_SMTP_FROM || !process.env.PULSE_SMTP_PASSWORD) {
+    process.stderr.write('PULSE_SMTP_FROM and PULSE_SMTP_PASSWORD are required.\n');
+    process.exit(2);
+  }
+  serve();
+}

package/src/memory-dashboard.mjs

@@ -0,0 +1,69 @@
+// What the MEMORY dashboard draws, shaped from counts the archive already keeps.
+//
+// Pure functions. The room hands in `RoomMemory#activity()` and the stats it already reports;
+// nothing here reads a file, and nothing here ever sees the text of a memory. A day with nothing
+// in it is still a day: the series are filled to the window, so a quiet week reads as quiet
+// instead of collapsing out of the chart.
+
+import { PASS } from './exam.mjs';
+
+export const DASHBOARD_DAYS = 30;
+
+const pad = (n) => String(n).padStart(2, '0');
+// The calendar day of this machine, the same day SQLite's `localtime` names.
+export const localDay = (date) => `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}`;
+
+export function windowDays(days = DASHBOARD_DAYS, now = new Date()) {
+  const out = [];
+  for (let back = days - 1; back >= 0; back -= 1) {
+    const day = new Date(now.getFullYear(), now.getMonth(), now.getDate() - back);
+    out.push(localDay(day));
+  }
+  return out;
+}
+
+const fill = (pairs, days) => {
+  const seen = new Map(pairs ?? []);
+  return days.map((day) => Number(seen.get(day) ?? 0));
+};
+const sum = (list) => list.reduce((total, n) => total + n, 0);
+
+// This week against the one before it, from the same filled series. `null` when there is no week
+// before to compare with, so a new room never shows a rise from nothing as +100%.
+function week(series) {
+  const last = sum(series.slice(-7));
+  const before = sum(series.slice(-14, -7));
+  return { last, before, delta: last - before };
+}
+
+export function memoryDashboard({ activity = null, stats = null, days = DASHBOARD_DAYS, now = new Date() } = {}) {
+  if (!activity) return null;
+  const axis = windowDays(days, now);
+  const series = {
+    entries: fill(activity.entries, axis),
+    memories: fill(activity.memories, axis),
+    recalls: fill(activity.recalls, axis),
+  };
+  const search = Number(activity.via?.search ?? 0);
+  const cascade = Number(activity.via?.cascade ?? 0);
+  const total = Number(stats?.memories ?? sum(Object.values(activity.kinds ?? {})));
+  return {
+    days: axis,
+    series,
+    weeks: { entries: week(series.entries), memories: week(series.memories), recalls: week(series.recalls) },
+    totals: {
+      entries: Number(stats?.entries ?? 0),
+      memories: total,
+      pending: Number(stats?.pending ?? 0),
+      turns: Number(activity.turns ?? 0),
+      reached: Number(activity.reached ?? 0),
+    },
+    kinds: activity.kinds ?? {},
+    agents: activity.agents ?? {},
+    zones: activity.zones ?? {},
+    via: { search, cascade },
+    // The rate each test has to reach to pass, so a chart can draw the line it is measured against.
+    pass: PASS,
+    vectors: stats?.embeddings ? { model: stats.embeddings.model, entries: Number(stats.embeddings.entries ?? 0), memories: Number(stats.embeddings.memories ?? 0) } : null,
+  };
+}