symbiot 0.32.0 → 0.34.0

package/README.md

@@ -12,16 +12,17 @@ symbiot            your last 7 days, written up   (same as: symbiot week)
 symbiot standup    yesterday + today, for standup
 symbiot todo       what's still on your plate
 symbiot app        open the visual app in your browser
-symbiot drift      what's out of sync / at risk across your repos
 symbiot push       write tasks into each repo for your coding agent
-symbiot models     recommend AI models for your hardware
-symbiot setup-local  set up a free local model (Ollama), one command
+symbiot drift      what's out of sync / at risk across your repos
 symbiot login      connect it to an AI (once)
 symbiot whoami     show how it's connected
 symbiot logout     forget saved credentials
 symbiot help
 ```
 
+A few newer extras (email, CI checks, local-model setup) are
+[experimental](#experimental).
+
 ## Install
 
 ```bash
@@ -53,7 +54,7 @@ Tabs:
   **no AI key**; reviews and suggestions use your chosen model. While the scan runs
   the Map shows its progress.
 - **Drift** — the [`symbiot drift`](#whats-out-of-sync-symbiot-drift) report, with
-  "fetch latest" and "check CI" toggles.
+  a "fetch latest" toggle (and an [experimental](#experimental) "check CI").
 - **Week / Standup / Todo** — the write-ups (these use your chosen AI).
 - **Tasks** — a checklist, grouped by kind (Fixes, Tests & CI, Docs, …). Filter by
   type or repo, then **Send to repos** to hand just those to your agent (see
@@ -68,8 +69,11 @@ Tabs:
 - **Agents** — every agent run Symbiot has started (and local-model downloads):
   live status, elapsed time, exit code, the tail of its output, and **what it
   did** — files changed and commits made, read from git, whichever agent it was.
-- **Settings** — your AI, the folders to scan, your agent command, model
-  recommendations and a one-click local model.
+  When an agent leaves **questions, options or ideas** for you, they show up on its
+  block (see [Questions from your agent](#questions-from-your-agent)).
+- **Settings** — your AI, the folders to scan and your agent command, plus the
+  [experimental](#experimental) email, model recommendations and one-click local
+  model.
 
 **Stays current by itself.** The app checks npm for a newer Symbiot every couple of
 minutes (and whenever you come back to the window); the version you're on is shown
@@ -78,7 +82,10 @@ version, relaunches the app on the same address, and the open window reloads its
 onto it. Restart `symbiot app` yourself and the open window reconnects the same way.
 
 The app listens on port **7391** so its address survives restarts; set
-`SYMBIOT_PORT` to use another (it falls back to a free port if that one is busy).
+`SYMBIOT_PORT` to use another. **One app at a time:** running `symbiot app` while
+it's already running just opens the existing window instead of starting a second
+copy (`SYMBIOT_FORCE_NEW=1` starts one anyway). If something else holds the port,
+it falls back to a free one.
 It works on **Linux, macOS and Windows**; with no Chromium-family browser to open
 the chrome-less window, it uses your default browser.
 
@@ -126,7 +133,7 @@ a template — `{dir}` is the repo path, `{prompt}` is the instruction to read
 `TASKS.md` — so it works with any agent or editor:
 
 ```
-claude -p "{prompt}" --permission-mode acceptEdits
+claude -p "{prompt}" --permission-mode acceptEdits --allowedTools "Bash(npm test:*)" "Bash(node:*)"
 aider --message "{prompt}" --yes
 code {dir}
 ```
@@ -135,24 +142,55 @@ Settings shows **one-click presets** for what's installed on your machine. A
 preset only fills in the command box; the saved command is what runs.
 
 - **Agents** (all make changes, ready for your review): Claude Code, Codex
-  (OpenAI), Aider, Cursor agent, Gemini CLI.
+  (OpenAI), Aider, Cursor agent, Gemini CLI. The Claude preset may also run
+  `npm test` and `node`, so it can check its own work; a command saved from the
+  older preset is upgraded automatically, and an edited one is left alone.
 - **Orca IDE** (any OS): opens the repo in Orca — either just the repo, to use
   Orca's own agent, or with Claude running in a new tab. It launches Orca if it's
   closed and waits for it to be ready first.
-- **Editors:** VS Code, Cursor, Windsurf, Zed, Sublime Text, IntelliJ IDEA, Neovim
-  (on macOS, also found as `.app` bundles when the CLI isn't on your PATH).
+- **Editors — opens only, no review:** VS Code, Cursor, Windsurf, Zed, Sublime
+  Text, IntelliJ IDEA, Neovim (on macOS, also found as `.app` bundles when the CLI
+  isn't on your PATH). They just open the repo. Nothing comes back for review unless
+  you run an agent there yourself, and Neovim needs a terminal to open in.
 
 Each run is logged to `.symbiot/agent.log` in the repo and shown live in the
 **Agents** tab. The command is saved as `agentCmd` in
 `~/.config/symbiot/config.json` — it's your command, Symbiot only fills in
 `{dir}` and `{prompt}`. A command saved from an older preset keeps working as-is.
 
+### Questions from your agent
+
+An agent working in your terminal or IDE stops to ask you things: which way to go,
+whether to do something risky, ideas it had along the way. A handed-off run can't
+do that, because it runs unattended. So the brief gives **every** agent (Claude,
+Codex, Aider, Gemini, Cursor, whatever you run) a way to ask anyway. It writes
+**`.symbiot/QUESTIONS.md`**:
+
+```markdown
+## Questions
+### Keep the old config format working?
+Reading both costs about 40 lines.
+- Yes, read both (recommended)
+- No, migrate once and drop it
+
+## Suggestions
+- Add a --json flag to drift
+```
+
+Up to five questions show on that agent's block in the **Agents** tab, each with
+its options and room for your own answer, alongside its ideas. **Send answers &
+continue** appends your answers to `.symbiot/ANSWERS.md` and runs your agent
+command again so the agent carries on with them. **Save only** keeps them for the
+next run. **+ task** adds an idea to your Tasks for that repo. The agent is told to
+keep going with everything that doesn't depend on an answer, and to ask instead of
+doing anything destructive. Both files live in `.symbiot/`, so they're never
+committed.
+
 ## What's out of sync? `symbiot drift`
 
 ```bash
 symbiot drift          # local git facts only — fast, no network
 symbiot drift --fetch  # fetch from origin first, so "behind" is current
-symbiot drift --ci     # also check GitHub Actions state (needs gh)
 ```
 
 A **deterministic** report of what's out of sync, stuck, or at risk across your
@@ -163,10 +201,9 @@ not new work), **uncommitted work**, **behind upstream**, **multiple worktrees**
 branch** (the "merged but main didn't move" trap — split into *likely never
 landed*, when files the PR added are missing from main, and *probably re-done*,
 when they're all there), and — if you configure it — **production running code
-that isn't on your default branch**. With `--ci` it tells a real failing run apart
-from **CI that isn't running at all** (jobs never started — usually a billing or
-spending limit), quoting GitHub's reason when it can. Works on local-only repos
-too: without a remote it compares against your local default branch.
+that isn't on your default branch**. Works on local-only repos too: without a
+remote it compares against your local default branch. (CI checks with `--ci` are
+[experimental](#ci-status-symbiot-drift---ci).)
 
 For the production check, add a per-repo deploy command to
 `~/.config/symbiot/deploys.json` (read only from your own config, never from a
@@ -174,31 +211,6 @@ repo), keyed by repo path or folder name, that prints the deployed commit sha:
 `{ "/path/to/repo": "ssh prod cat ~/app/.deployed-sha" }`. Also the **Drift** tab
 in the app.
 
-## Which model? Ask your machine
-
-```bash
-symbiot models
-```
-
-Reads your RAM / CPU / GPU and recommends **local models by tier** (min / med / max,
-marking which fit your RAM) to run free & private via [Ollama](https://ollama.com),
-plus **paid** options (Claude / OpenAI / Gemini, cheap → top). Also available as
-a button in the app's Settings.
-
-### A free local model in one command: `symbiot setup-local`
-
-```bash
-symbiot setup-local                      # the best model for your RAM
-symbiot setup-local --model llama3.2:3b  # or pick one
-```
-
-Starts Ollama if it isn't running, downloads the model (with progress), and
-switches Symbiot over to it — free, private, nothing leaves your machine. If
-Ollama isn't installed yet it prints the one-line install for your OS (Homebrew on
-macOS, winget on Windows, the official script on Linux) and you re-run it after.
-Also the **Set up a free local model** button in Settings, where the download shows
-in the Agents tab and Symbiot switches over when it finishes.
-
 ## Connect it (once)
 
 Pick the AI you want it to write with:
@@ -266,11 +278,14 @@ instead of hanging. The CLI shows scan progress on one line as it goes.
 ## What it reads, and what it doesn't
 
 - **Reads:** your local git — commit messages and changed-file names, plus
-  `TODO`/`FIXME` markers and uncommitted changes for `todo`. All local.
+  `TODO`/`FIXME` markers and uncommitted changes for `todo`. If you switch
+  [email](#your-sent-email-without-an-api-symbiot-mail) on, it also reads the headers
+  of mail you sent (subject, recipients, date). All local.
 - **Sends to the AI:** commit messages and dates, changed-file **names**, the
   folder structure, `TODO`/`FIXME` lines, and (for a repo review) an excerpt of
-  the README and any `CLAUDE.md`/`AGENTS.md` conventions. It does **not** send
-  whole source files. With a **local Ollama model, nothing leaves your machine.**
+  the README and any `CLAUDE.md`/`AGENTS.md` conventions. With email on, it also
+  sends the subjects and recipient names of mail you sent. It does **not** send
+  whole source files or any email body. With a **local Ollama model, nothing leaves your machine.**
 - **Shows its work:** every report ends with a footer — path, branch, how many
   commits matched you (e.g. "1090 of 1101"), the README's age, and the
   working-tree state — so you can see exactly what it read.
@@ -278,10 +293,70 @@ instead of hanging. The CLI shows scan progress on one line as it goes.
 - **Runs only what you set:** the agent command is yours, and deploy commands are
   read only from your own `~/.config/symbiot/`, never from a repo.
 
+## Experimental
+
+These work and are tested, but are newer or depend on things Symbiot can't fully
+check, so they may change. Everything above works without them.
+
+### Your sent email, without an API: `symbiot mail`
+
+```bash
+symbiot mail                 # what mail it can read, and what you sent this week
+symbiot mail --on            # use it in week / standup   (--off to stop)
+symbiot mail --add ~/Takeout/Mail/All\ mail.mbox   # an export, or any mail folder
+```
+
+Week and Standup can include **what you sent**. It needs no Gmail or Outlook API,
+OAuth, app registration or password: Symbiot reads the mail a desktop client
+already keeps on your computer, so anyone can link theirs the same way.
+**Thunderbird** (including Snap and Flatpak), **Apple Mail**, **Evolution**,
+**KMail**, and **mutt/neomutt** or any `~/Maildir` / `~/mail` are found
+automatically, and only their **Sent** folders are read. Webmail only? Add an
+export: Google Takeout gives you an `.mbox`, and Symbiot keeps just the messages
+with Gmail's *Sent* label (or from one of your addresses). Any `.mbox` file or
+folder of `.eml` files works too.
+
+It reads **headers only** (date, recipients, subject), never a message body, and
+it's **off until you switch it on** in Settings (*Email*) or with
+`symbiot mail --on`. **Preview** shows exactly what a write-up would see. Why it's
+experimental: the tests cover mbox and Maildir, but it hasn't been tried against
+real Apple Mail, Evolution or KMail stores. On macOS, reading Apple Mail needs Full
+Disk Access for your terminal. Outlook for Windows (`.pst`) isn't supported:
+export to `.mbox` or use Thunderbird.
+
+### CI status: `symbiot drift --ci`
+
+```bash
+symbiot drift --ci     # also check GitHub Actions state (needs gh)
+```
+
+Adds CI to the drift report, telling a real failing run apart from **CI that isn't
+running at all** (jobs never started, usually a billing or spending limit) and
+quoting GitHub's reason when it can. Also the **check CI** toggle in the Drift tab.
+Why it's experimental: it needs the GitHub CLI (`gh`), only covers GitHub Actions,
+and spotting "not running" is a heuristic.
+
+### Local models: `symbiot models` and `symbiot setup-local`
+
+```bash
+symbiot models                           # recommend models for this machine
+symbiot setup-local                      # the best local model for your RAM
+symbiot setup-local --model llama3.2:3b  # or pick one
+```
+
+`models` reads your RAM / CPU / GPU and recommends **local models by tier** (min /
+med / max, marking which fit your RAM) to run free and private via
+[Ollama](https://ollama.com), plus **paid** options (Claude / OpenAI / Gemini,
+cheap → top). `setup-local` starts Ollama if it isn't running, downloads the model
+with progress, and switches Symbiot over to it. If Ollama isn't installed it prints
+the one-line install for your OS and you re-run it after. Both are buttons in
+Settings, where the download shows in the Agents tab. You can always pick a model
+yourself with `symbiot login`.
+
 ## Config
 
 Everything lives in `~/.config/symbiot/`: `config.json` (your AI, `scanRoots`,
-`agentCmd`; readable only by you), `tasks.json` (your tasks),
+`agentCmd`, `mail`; readable only by you), `tasks.json` (your tasks),
 `deploys.json` (optional, for drift's production check) and `rules.md` (optional
 conventions every repo review must respect, alongside each repo's own
 `CLAUDE.md` / `AGENTS.md` / `CONTRIBUTING.md`).
@@ -290,6 +365,7 @@ conventions every repo review must respect, alongside each repo's own
   `claude-haiku-4-5`, `gemini-1.5-pro`).
 - `SYMBIOT_SCAN_TIMEOUT` — the scan time limit, in seconds (default 60).
 - `SYMBIOT_PORT` — the app's port (default 7391).
+- `SYMBIOT_FORCE_NEW=1` — start a second app even if one is already running.
 - `symbiot whoami` shows the active provider, model, and where the credential
   came from. `symbiot logout` forgets saved credentials.
 
@@ -299,26 +375,44 @@ conventions every repo review must respect, alongside each repo's own
 npm test
 ```
 
-Runs four suites, all against throwaway repos and an isolated `HOME`:
+Runs five suites, all against throwaway repos, an isolated `HOME` and (for the
+update check) a fake npm registry:
 
 - `test/load.mjs` — the shipped files parse and load: `node --check` on each
   module, `ui.mjs` imported on its own with its page's JavaScript parsed, every
   local import listed in package.json `"files"`, and the `bin` entry point shipped.
 - `test/fixtures.mjs` — accuracy fixtures: the facts Symbiot collects (identity
   matching, stale checkouts, worktrees, drift) and the `symbiot drift` report as
-  printed, the scan time limit, the agent handoff, and the review → approve cycle.
+  printed, the scan time limit, the agent handoff, review → send back → approve →
+  ship (including a repo that gitignores `.symbiot/`), agent questions, mail
+  ingestion (`symbiot mail` end to end), and the update command.
 - `test/smoke.mjs` — boots `symbiot app`, runs the page's own JavaScript against
   a fake DOM (every tab, every button), hits every endpoint the UI calls with the
-  method the UI uses, and checks POST-only endpoints refuse GET and `/api` needs
-  the token.
+  method the UI uses, checks POST-only endpoints refuse GET and `/api` needs the
+  token, and checks the update banner can't loop.
+- `test/app.mjs` — the app's lifecycle: a second `symbiot app` reuses the running
+  one (and `SYMBIOT_FORCE_NEW` / a foreign server on the port don't), and the
+  update check only offers a higher npm version.
 - `test/install.mjs` — runs the CLI through a bin symlink, then `npm pack` +
   global install into a temp prefix: `symbiot help`, every shipped file present,
   and the installed `symbiot app` serving its page. Needs npm registry access for
   dependencies; `SYMBIOT_SKIP_INSTALL_TEST=1` skips that part.
 
-`SYMBIOT_NO_OPEN=1` stops `symbiot app` opening a window (the tests set it).
-Releases publish from a version tag via `.github/workflows/publish.yml`, and only
-after the full suite passes in CI.
+`SYMBIOT_NO_OPEN=1` stops `symbiot app` opening a window (the tests set it), and
+`SYMBIOT_REGISTRY` points its update check at another registry. CI
+(`.github/workflows/ci.yml`) runs the whole suite on every pull request.
+
+**Releasing.** Bump the version in the pull request, merge it into `main`, then tag
+`main`'s commit:
+
+```bash
+git checkout main && git pull
+git tag v$(node -p "require('./package.json').version") && git push origin --tags
+```
+
+`.github/workflows/publish.yml` publishes from that tag only if it's on `main`,
+matches `package.json`, and the full suite passes. A tag on any other branch is
+refused, so what's on npm is always what's on `main`.
 
 ---
 

package/index.mjs

@@ -9,7 +9,8 @@
 //   symbiot week      your week, written up          (default)
 //   symbiot standup   yesterday + today, for standup
 //   symbiot todo      what's still on your plate
-//   symbiot login     connect it to an AI (once)
+//   symbiot mail      add the mail you sent to write-ups (local, no API)
+//   symbiot login    connect it to an AI (once)
 //   symbiot whoami    show how it's connected
 //   symbiot help
 //
@@ -27,6 +28,7 @@ import { createServer } from "node:http";
 import { randomBytes } from "node:crypto";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { EMBEDDED_UI } from "./ui.mjs";
+import { detectMailSources, mailActivity } from "./mail.mjs";
 
 const HERE = fileURLToPath(new URL(".", import.meta.url));
 let VERSION = "0"; try { VERSION = JSON.parse(readFileSync(join(HERE, "package.json"), "utf8")).version; } catch {}
@@ -62,7 +64,17 @@ let LATEST_VERSION = ""; // newest symbiot on npm, checked in the background
 // a.b.c numeric compare: only a HIGHER npm version is an update (a local build
 // ahead of npm must not be offered a "newer" older one)
 function semverGt(a, b) { const p = (v) => String(v || "").replace(/^v/, "").split(/[.-]/).slice(0, 3).map((n) => parseInt(n, 10) || 0); const x = p(a), y = p(b); for (let i = 0; i < 3; i++) if (x[i] !== y[i]) return x[i] > y[i]; return false; }
-async function checkLatest() { try { const r = await fetch("https://registry.npmjs.org/symbiot"); if (!r.ok) return; const j = await r.json(); LATEST_VERSION = (j["dist-tags"] && j["dist-tags"].latest) || ""; } catch {} }
+// SYMBIOT_REGISTRY points the check at another registry (the tests use a fake one)
+const REGISTRY = (process.env.SYMBIOT_REGISTRY || "https://registry.npmjs.org").replace(/\/+$/, "");
+async function checkLatest() { try { const r = await fetch(REGISTRY + "/symbiot"); if (!r.ok) return; const j = await r.json(); LATEST_VERSION = (j["dist-tags"] && j["dist-tags"].latest) || ""; } catch {} }
+// The in-app update installs the EXACT newest version (not the `latest` tag, which
+// npm's cache/propagation can resolve stale — that caused an update loop where the
+// install kept re-fetching the same old version). --prefer-online skips a stale
+// cached packument.
+function updateCmd(latest, current, platform = process.platform) {
+  const target = latest && semverGt(latest, current) ? latest : "latest";
+  return { target, cmd: (platform === "win32" ? "npm i -g " : "npm install -g ") + "symbiot@" + target + " --prefer-online" };
+}
 
 // ---- colour + spinner ------------------------------------------------------
 const c = PLAIN
@@ -267,6 +279,10 @@ function buildTasksMd(name, ctx, list) {
   const keys = Object.keys(byType).sort((a, b) => TASK_ORDER.indexOf(a) - TASK_ORDER.indexOf(b));
   for (const ty of keys) { L.push(`### ${ty}`); for (const t of byType[ty]) L.push(`- [ ] ${t.text}`); L.push(""); }
   L.push("## When you finish an item", "- Tick it here (`- [x]`) as soon as it's done — that's how it reaches review. Ticking doesn't archive it: the user approves it in Symbiot, which commits it on a branch and opens a PR.", "- Leave your changes **uncommitted**, and don't tick anything you didn't finish or couldn't verify.", "");
+  L.push("## If you need a decision, or have ideas", "You may be running unattended, so you can't ask in chat. Write `.symbiot/QUESTIONS.md` instead: Symbiot shows it to the user on your block in its Agents tab, and their answers come back in `.symbiot/ANSWERS.md` (read that first if it exists).",
+    `- At most ${QUESTIONS_MAX} questions, under a \`## Questions\` heading. Each is a \`### \` heading, then an optional line of context, then 2–4 options as \`- \` bullets (put the one you recommend first).`,
+    "- Ideas, options or follow-ups outside these tasks go under `## Suggestions` as `- ` bullets — the user can add them to their tasks in one click.",
+    "- Carry on with everything that doesn't depend on an answer, and don't tick an item that does. Ask there rather than doing anything destructive.", "");
   L.push("---", 'To action these, tell your coding agent: "Read `.symbiot/TASKS.md` and implement the unchecked items in this repo, using the context above. Tick each item as you finish it and leave changes uncommitted for review. Confirm with me before anything destructive."');
   return L.join("\n") + "\n";
 }
@@ -746,8 +762,8 @@ const shSingle = (s) => "'" + String(s).replace(/'/g, "'\\''") + "'";
 const escDq = (s) => String(s).replace(/[\\"$`]/g, "\\$&");
 // Plain words only: in the Orca preset this passes through two shells, so no
 // backticks or $ (escDq covers one level).
-const HANDOFF_PROMPT = "Read .symbiot/TASKS.md and implement the unchecked items in this repo. Tick each item [x] in that file as you finish it and leave your changes uncommitted, so they can be reviewed and approved. Confirm before anything destructive.";
-function handoffCmd() { const cfg = loadConfig(); return migrateOrcaCmd(cfg.agentCmd) || (cfg.ide ? `${cfg.ide} {dir}` : ""); } // ide = legacy
+const HANDOFF_PROMPT = "Read .symbiot/TASKS.md and implement the unchecked items in this repo. Tick each item [x] in that file as you finish it and leave your changes uncommitted, so they can be reviewed and approved. If you need a decision, or have ideas or options for the user, write them to .symbiot/QUESTIONS.md as TASKS.md explains, and read .symbiot/ANSWERS.md first if it exists. Confirm before anything destructive.";
+function handoffCmd() { const cfg = loadConfig(); return migrateOrcaCmd(migrateClaudeCmd(cfg.agentCmd)) || (cfg.ide ? `${cfg.ide} {dir}` : ""); } // ide = legacy
 // Save the template ("" clears it). Either way the legacy `ide` key goes.
 function setHandoffCmd(cmd) {
   const cfg = loadConfig(); const v = String(cmd || "").trim();
@@ -766,8 +782,13 @@ const IDE_LIST = [["code", "VS Code", "Visual Studio Code"], ["cursor", "Cursor"
 // [cmd, label, template]. Only agents that leave changes to review: a handoff
 // runs unattended, so a "plan only" run can't ask anything and leaves nothing to
 // approve — that preset was dropped (a saved one still runs as-is).
+// Claude: acceptEdits alone still blocks every shell command, so a run could
+// never run its own tests and had to leave test work unticked. Allow just the
+// test runner and node.
+const CLAUDE_CMD = 'claude -p "{prompt}" --permission-mode acceptEdits --allowedTools "Bash(npm test:*)" "Bash(node:*)"';
+const CLAUDE_CMD_OLD = 'claude -p "{prompt}" --permission-mode acceptEdits'; // ≤0.33
 const AGENT_LIST = [
-  ["claude", "Claude Code — make changes", 'claude -p "{prompt}" --permission-mode acceptEdits'],
+  ["claude", "Claude Code — make changes", CLAUDE_CMD],
   ["codex", "Codex (OpenAI/GPT) — make changes", 'codex exec --full-auto "{prompt}"'],
   ["aider", "Aider — make changes", 'aider --message "{prompt}" --yes'],
   ["gemini", "Gemini — make changes", 'gemini --yolo -p "{prompt}"'],
@@ -829,6 +850,13 @@ function migrateOrcaCmd(cmd) {
   if (rebuilt !== cmd) { try { const cfg = loadConfig(); if (cfg.agentCmd === cmd) { cfg.agentCmd = rebuilt; saveConfig(cfg); } } catch {} }
   return rebuilt;
 }
+// Upgrade a saved Claude preset from ≤0.33 to the current one. Exact match only:
+// a command the user edited is theirs and runs as-is.
+function migrateClaudeCmd(cmd) {
+  if (typeof cmd !== "string" || cmd.trim() !== CLAUDE_CMD_OLD) return cmd;
+  try { const cfg = loadConfig(); if (cfg.agentCmd === cmd) { cfg.agentCmd = CLAUDE_CMD; saveConfig(cfg); } } catch {}
+  return CLAUDE_CMD;
+}
 // Cross-platform detection for the presets (and gh / the app's browser).
 // "Is this command available?": command -v on posix, where on win.
 function hasCmd(cmd) { try { return !!sh(process.platform === "win32" ? `where ${cmd}` : `command -v ${cmd}`).trim(); } catch { return false; } }
@@ -887,6 +915,81 @@ function agentChanges(path, startedAt) {
     return { dirty, stat, commits };
   } catch { return { dirty: 0, stat: "", commits: [] }; }
 }
+// ---- agent questions: decisions, options and ideas, from ANY agent ---------
+// A handoff runs unattended (claude -p, codex exec, aider --message, …), so the
+// agent can't stop and ask in chat. TASKS.md tells it to write
+// .symbiot/QUESTIONS.md instead — questions with options, plus ideas — which
+// the Agents tab shows on that agent's block. The user's answers are appended to
+// .symbiot/ANSWERS.md for the next run to read. Plain files, so it works the
+// same whichever model or tool the agent is.
+const QUESTIONS_MAX = 5;
+const qKey = (s) => String(s || "").trim().toLowerCase().replace(/\s+/g, " ");
+const readSymbiot = (path, f) => { try { return readFileSync(join(path, ".symbiot", f), "utf8"); } catch { return ""; } };
+// "## Questions" → "### question", context lines, "- option" bullets;
+// "## Suggestions" (or Ideas / Follow-ups) → "- idea" bullets. Forgiving: a bare
+// bullet under Questions is a question with no options.
+function parseQuestions(md) {
+  const questions = [], suggestions = []; let sec = "q", cur = null;
+  const clip = (s) => String(s).trim().slice(0, 300);
+  for (const raw of String(md || "").split(/\r?\n/)) {
+    const l = raw.trim(); if (!l) continue;
+    let m;
+    if ((m = l.match(/^###\s+(.+)$/))) {
+      if (sec === "s") { suggestions.push(clip(m[1])); cur = null; }
+      else { cur = { q: clip(m[1]), context: "", options: [] }; questions.push(cur); }
+      continue;
+    }
+    if ((m = l.match(/^##\s+(.+)$/))) { sec = /suggest|idea|follow|option/i.test(m[1]) ? "s" : "q"; cur = null; continue; }
+    if (/^#\s/.test(l)) continue;
+    const b = l.match(/^(?:[-*+]|\d+[.)])\s+(?:\[[ xX]\]\s+)?(.+)$/);
+    if (sec === "s") { if (b) suggestions.push(clip(b[1])); continue; }
+    if (b) { if (cur) cur.options.push(clip(b[1])); else questions.push({ q: clip(b[1]), context: "", options: [] }); continue; }
+    if (cur) cur.context = clip((cur.context ? cur.context + " " : "") + l);
+  }
+  return { questions: questions.filter((x) => x.q).slice(0, 20).map((x) => ({ ...x, options: x.options.slice(0, 6) })), suggestions: suggestions.filter(Boolean).slice(0, 10) };
+}
+// The OPEN questions (not yet in ANSWERS.md) and the agent's ideas, each marked
+// if it's already on the task list for this repo.
+function agentQuestions(path, repo) {
+  const p = parseQuestions(readSymbiot(path, "QUESTIONS.md"));
+  const done = new Set([...readSymbiot(path, "ANSWERS.md").matchAll(/^###\s+(.+)$/gm)].map((m) => qKey(m[1])));
+  const open = p.questions.filter((x) => !done.has(qKey(x.q)));
+  const tasks = p.suggestions.length ? loadTasks() : [];
+  return {
+    questions: open.slice(0, QUESTIONS_MAX), answered: p.questions.length - open.length,
+    suggestions: p.suggestions.map((text) => ({ text, added: tasks.some((t) => t.repo === repo && qKey(t.text) === qKey(text)) })),
+  };
+}
+// Save answers to .symbiot/ANSWERS.md; opts.rerun hands the repo back to the
+// agent (same saved command) so it carries on with them.
+function answerQuestions(path, answers, opts = {}) {
+  path = String(path || "");
+  if (!path || !HANDOFFS.some((e) => e.path === path)) return { error: "No agent has run in that folder." };
+  const open = new Map(agentQuestions(path, "").questions.map((x) => [qKey(x.q), x.q]));
+  const rows = (Array.isArray(answers) ? answers : [])
+    .map((x) => ({ q: open.get(qKey(x && x.q)), a: String((x && x.a) || "").replace(/^\s*#+/gm, "").trim().slice(0, 2000) }))
+    .filter((x) => x.q && x.a);
+  if (!rows.length) return { error: "Pick or type at least one answer." };
+  const prev = readSymbiot(path, "ANSWERS.md") || "# Answers from the user\nAnswers to the questions in QUESTIONS.md, newest last. Follow them; ask again in QUESTIONS.md if one is unclear.\n";
+  const day = new Date().toISOString().slice(0, 10);
+  try {
+    mkdirSync(join(path, ".symbiot"), { recursive: true });
+    writeFileSync(join(path, ".symbiot", "ANSWERS.md"), prev.replace(/\s*$/, "\n") + rows.map((x) => `\n### ${x.q}\n${x.a}\n_answered ${day}_\n`).join(""));
+  } catch (e) { return { error: "Couldn't write ANSWERS.md: " + ((e && e.message) || e) }; }
+  const out = { ok: true, saved: rows.length };
+  if (opts.rerun) { const e = runHandoff(path); if (e) out.rerun = e.id; else out.note = "Answers saved. Set an agent command in Settings to have the agent pick them up automatically."; }
+  return out;
+}
+// The Agents tab: every tracked job, its log tail, what it changed, and — on the
+// newest job per folder — the questions/ideas it left.
+function agentsList() {
+  const seen = new Set();
+  return HANDOFFS.map((e) => {
+    let tail = ""; try { tail = readFileSync(e.log, "utf8").slice(-1200); } catch {}
+    const first = !seen.has(e.path); seen.add(e.path);
+    return { id: e.id, name: e.name, path: e.path, status: e.status, elapsed: (e.endedAt || Date.now()) - e.startedAt, exitCode: e.exitCode, tail, changed: agentChanges(e.path, e.startedAt), ask: first ? agentQuestions(e.path, e.name) : null };
+  });
+}
 // ---- local model one-command setup (Ollama), OS-aware ---------------------
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function hasOllama() { return !!sh("ollama --version").trim(); } // cross-platform (not POSIX command -v)
@@ -1469,6 +1572,33 @@ function discoveredRepos() {
   if (LAST_MAP && LAST_MAP.nodes) return LAST_MAP.nodes.filter((n) => n.type === "repo" && n.meta && n.meta.path).map((n) => ({ path: n.meta.path, name: n.label, recency: 0 }));
   return findAllRepos();
 }
+// ---- email: opt-in, local, no API (see mail.mjs) ---------------------------
+// config.mail = { enabled, sources: [extra folders/.mbox files], addresses: [your
+// mail addresses, to pick your mail out of a whole-mailbox export] }.
+function mailCfg() {
+  const m = loadConfig().mail || {};
+  return { enabled: !!m.enabled, sources: Array.isArray(m.sources) ? m.sources : [], addresses: Array.isArray(m.addresses) ? m.addresses : [] };
+}
+function mailState() { return { ...mailCfg(), detected: detectMailSources() }; }
+function setMail(b = {}) {
+  const m = mailCfg();
+  if (typeof b.enabled === "boolean") m.enabled = b.enabled;
+  if (b.add) {
+    const p = expandRoot(b.add);
+    if (!p || !existsSync(p)) return { ...mailState(), error: "not found: " + (p || "(empty)") };
+    if (!m.sources.includes(p)) m.sources.push(p);
+  }
+  if (b.remove) m.sources = m.sources.filter((x) => x !== b.remove);
+  if (typeof b.addresses === "string") m.addresses = b.addresses.split(/[\s,;]+/).map((s) => s.trim().toLowerCase()).filter((s) => s.includes("@"));
+  const cfg = loadConfig(); cfg.mail = m; saveConfig(cfg);
+  return mailState();
+}
+// Mail you sent in the window — [] unless it's switched on (preview ignores that).
+function sentMail(days, preview = false) {
+  const m = mailCfg(); if (!m.enabled && !preview) return [];
+  return mailActivity({ days, sources: m.sources, addresses: [...m.addresses, me().email].filter(Boolean) });
+}
+const renderMail = (list) => list.slice(0, 60).map((x) => `- ${x.date} · to ${x.to.join(", ") || "?"} · ${x.subject}`).join("\n");
 async function produce(cmd) {
   if (!resolveProvider()) return { error: "not-connected" };
   if (cmd === "todo") {
@@ -1488,26 +1618,30 @@ async function produce(cmd) {
   // Discover the Map's repo set, then keep only those with commits in the window.
   const all = discoveredRepos();
   const repos = all.filter((r) => sh(`git -C ${JSON.stringify(r.path)} log --since="${days} days ago" --oneline -1 2>/dev/null`).trim());
-  if (!repos.length) return { text: `No commits in the last ${days} days across your ${all.length} repos.\nAdd folders to scan in Settings, or check your git identity.`, sub: "no activity" };
+  const mail = sentMail(days); // [] unless email is switched on
+  if (!repos.length && !mail.length) return { text: `No commits in the last ${days} days across your ${all.length} repos.\nAdd folders to scan in Settings, or check your git identity.`, sub: "no activity" };
   let cs = commits(repos, `${days} days ago`, !has("all"));
   if (!cs.length) cs = commits(repos, `${days} days ago`, false); // fall back to all if none matched you
   const open = label === "week" ? openWork(repos) : [];
-  if (!cs.length) return { text: "Found repos, but no commits in the window.", sub: "no commits" };
+  if (!cs.length && !mail.length) return { text: "Found repos, but no commits in the window.", sub: "no commits" };
 
   const system =
-    `You write a short, first-person work update from a person's git commits. ` +
+    `You write a short, first-person work update from a person's git commits${mail.length ? " and the emails they sent" : ""}. ` +
     `Write as them ("I"), plainly and specifically, grouped by theme or project, most important first. ` +
     `Turn commit messages into outcomes a manager or teammate would understand — not a raw commit list. ` +
+    (mail.length ? `Fold the emails into those themes (a decision, a hand-off, who they worked with); skip routine ones (receipts, scheduling, one-line replies). You only have their subjects and recipients — don't guess at what they said. ` : "") +
     `${label === "standup" ? "Keep it to 3-5 bullets: done, and what's next." : "A short paragraph or a few grouped bullets; end with a one-line 'In progress / next' if there are open items."} ` +
-    `No preamble, no sign-off, no invented work — only what the commits and open items show.`;
+    `No preamble, no sign-off, no invented work — only what the commits${mail.length ? ", emails" : ""} and open items show.`;
   const prompt =
     `Person: ${who.name || "me"}. Window: ${label === "standup" ? "since yesterday" : `last ${days} days`}.\n\n` +
-    `Commits:\n${renderCommits(cs)}\n\n` +
+    `Commits:\n${cs.length ? renderCommits(cs) : "(none)"}\n\n` +
+    (mail.length ? `Emails I sent (date · to · subject):\n${renderMail(mail)}\n\n` : "") +
     (open.length ? `Open / in progress:\n${open.map((o) => `- ${o}`).join("\n")}\n\n` : "") +
     `Write the ${label === "standup" ? "standup" : "update"}.`;
 
   const text = await write(system, prompt);
-  return { text: text || "(couldn't reach the model)", sub: `${cs.length} commits across ${new Set(cs.map((x) => x.repo)).size} repos · ${label}`, footer: `symbiot ${VERSION} · ${all.length} repos (same as the Map) · ${repos.length} active · ${cs.length} commits in last ${days}d` };
+  const mailNote = mail.length ? ` · ${mail.length} sent email${mail.length === 1 ? "" : "s"}` : "";
+  return { text: text || "(couldn't reach the model)", sub: `${cs.length} commits across ${new Set(cs.map((x) => x.repo)).size} repos${mailNote} · ${label}`, footer: `symbiot ${VERSION} · ${all.length} repos (same as the Map) · ${repos.length} active · ${cs.length} commits in last ${days}d${mailNote}` };
 }
 
 async function cmdRun(cmd) {
@@ -1677,7 +1811,7 @@ async function cmdApp() {
       if (r && r.ok) {
         const p = await r.json().catch(() => ({}));
         if (p && p.version) {
-          const url = `http://127.0.0.1:${PORT}/?t=${TOKEN}`; const how = openApp(url);
+          const url = `http://127.0.0.1:${PORT}/?t=${TOKEN}`; const how = process.env.SYMBIOT_NO_OPEN === "1" ? "" : openApp(url);
           console.log(`\n${c.g("●")} ${c.b("Symbiot")} is already running (v${p.version}) at ${c.b(url)}`);
           console.log(how ? c.d(`  Opened the existing window (a ${how}).`) : c.d("  Open that URL in your browser."));
           console.log(c.d("  (Not starting a second copy. Set SYMBIOT_FORCE_NEW=1 to force one.)"));
@@ -1731,19 +1865,19 @@ async function cmdApp() {
         const e = track("ollama pull " + model, "ollama pull " + shSingle(model), homedir(), (code) => { if (code === 0) useOllamaModel(model); });
         return json(res, { started: true, model, id: e ? e.id : "" });
       }
-      if (u.pathname === "/api/agents") return json(res, HANDOFFS.map((e) => { let tail = ""; try { tail = readFileSync(e.log, "utf8").slice(-1200); } catch {} return { id: e.id, name: e.name, path: e.path, status: e.status, elapsed: (e.endedAt || Date.now()) - e.startedAt, exitCode: e.exitCode, tail, changed: agentChanges(e.path, e.startedAt) }; }));
+      if (u.pathname === "/api/agents") return json(res, agentsList());
+      if (u.pathname === "/api/agents/answer" && req.method === "POST") { const b = await readBody(req); return json(res, answerQuestions(String(b.path || ""), b.answers, { rerun: !!b.rerun })); }
+      if (u.pathname === "/api/mail") return json(res, mailState());
+      if (u.pathname === "/api/mail/set" && req.method === "POST") { const b = await readBody(req); return json(res, setMail(b)); }
+      if (u.pathname === "/api/mail/preview") { const items = sentMail(Number(u.searchParams.get("days")) || SINCE_WEEK, true); return json(res, { count: items.length, items: items.slice(0, 20) }); }
       if (u.pathname === "/api/run" && req.method === "POST") { const b = await readBody(req); const cmd = ["week", "standup", "todo"].includes(b.cmd) ? b.cmd : "week"; return json(res, await produce(cmd)); }
       if (u.pathname === "/api/connect" && req.method === "POST") { return json(res, await connectProvider(await readBody(req))); }
       if (u.pathname === "/api/ping") { if (u.searchParams.get("fresh") === "1") await checkLatest(); return json(res, { version: VERSION, started: SERVER_STARTED, latest: LATEST_VERSION, newer: semverGt(LATEST_VERSION, VERSION) }); }
       if (u.pathname === "/api/update" && req.method === "POST") {
-        // Install the EXACT newest version (not the `latest` tag, which npm's
-        // cache/propagation can resolve stale — that caused an update loop where
-        // the install kept re-fetching the same old version), then relaunch this
-        // same app (same port+token => same URL) and exit. --prefer-online skips
-        // a stale cached packument. The page's heartbeat reconnects and reloads.
-        const target = LATEST_VERSION && semverGt(LATEST_VERSION, VERSION) ? LATEST_VERSION : "latest";
-        const pkg = "symbiot@" + target;
-        const inst = (process.platform === "win32" ? "npm i -g " : "npm install -g ") + pkg + " --prefer-online";
+        // Install the exact newest version (see updateCmd), then relaunch this
+        // same app (same port+token => same URL) and exit. The page's heartbeat
+        // reconnects and reloads.
+        const { target, cmd: inst } = updateCmd(LATEST_VERSION, VERSION);
         const e = track("symbiot update", inst, homedir(), (code) => {
           if (code !== 0) return;
           try { const ch = spawn(process.execPath, process.argv.slice(1), { detached: true, stdio: "ignore", env: process.env }); ch.unref(); } catch {}
@@ -1774,6 +1908,24 @@ async function cmdApp() {
   checkLatest(); setInterval(checkLatest, 2 * 60 * 1000).unref(); // background update check (every 2 min)
 }
 
+// `symbiot mail [--on|--off] [--add <path>]`: what mail it can read, and a preview.
+function cmdMail() {
+  if (has("on") || has("off")) setMail({ enabled: has("on") });
+  const add = flag("add", null);
+  if (add) { const r = setMail({ add }); if (r.error) console.log(c.y(r.error)); }
+  const m = mailState();
+  console.log(`\n${c.g("●")} ${c.b("Symbiot mail")} ${c.d("(experimental) · " + (m.enabled ? "on — what you sent feeds week and standup" : "off"))}\n`);
+  const srcs = [...m.detected.map((d) => [d.path, d.kind]), ...m.sources.map((p) => [p, "added"])];
+  if (!srcs.length) console.log(c.y("No mail found on this computer.") + c.d("  Use a desktop mail app (Thunderbird, Apple Mail, Evolution…), or add an export:  symbiot mail --add ~/Takeout/Mail/All.mbox"));
+  for (const [p, k] of srcs) console.log(`  ${c.g("·")} ${p}  ${c.d(k)}`);
+  if (srcs.length) {
+    const items = sentMail(SINCE_WEEK, true);
+    console.log("\n" + c.b(`${items.length} sent in the last ${SINCE_WEEK} days`) + c.d("  (headers only)"));
+    for (const x of items.slice(0, 12)) console.log(`  ${c.d(x.date)}  ${x.subject}  ${c.d("→ " + (x.to.join(", ") || "?"))}`);
+  }
+  if (!m.enabled) console.log("\n" + c.d("Switch it on with  symbiot mail --on  (or in the app's Settings)."));
+}
+
 const HELP = `${c.b("symbiot")} — your week, written from your real work.
 
 ${c.b("Usage")}
@@ -1781,15 +1933,19 @@ ${c.b("Usage")}
   symbiot standup                   yesterday + today, for standup
   symbiot todo                      what's still on your plate
   symbiot app                       open the visual app in your browser
-  symbiot drift                     what's out of sync / at risk across repos
+  symbiot drift [--fetch]           what's out of sync / at risk across repos
   symbiot push [--open]             write tasks into each repo (and run your agent)
-  symbiot models                    recommend AI models for your hardware
-  symbiot setup-local [--model X]   install/run a free local model (Ollama)
   symbiot login                     connect it to an AI (once)
   symbiot whoami                    show how it's connected
   symbiot logout                    forget saved credentials
   symbiot help
 
+${c.b("Experimental")}
+  symbiot drift --ci                also check GitHub Actions (needs gh)
+  symbiot mail [--on|--off]         use the mail you sent in write-ups (local, no API)
+  symbiot models                    recommend AI models for your hardware
+  symbiot setup-local [--model X]   install/run a free local model (Ollama)
+
 ${c.b("Options")}
   --dir <path>    where your repos are (default: ${homedir()})
   --since <days>  window for 'week' (default 7)
@@ -1802,9 +1958,10 @@ ${c.b("Setup")}  pick any AI to write with:
   ${c.d("Env keys also work: ANTHROPIC_API_KEY, OPENAI_API_KEY, GEMINI_API_KEY.")}
   ${c.d("Override the model per run with SYMBIOT_MODEL.")}
 
-${c.d("Reads only your local git. No accounts, no OAuth, no data leaves except the")}
-${c.d("commit summaries sent to the AI to write your update (nothing leaves at all")}
-${c.d("with a local Ollama model).")}`;
+${c.d("Reads only your local git (and, if you switch it on, the headers of mail you")}
+${c.d("sent). No accounts, no OAuth, no data leaves except the commit and email")}
+${c.d("subjects sent to the AI to write your update (nothing leaves at all with a")}
+${c.d("local Ollama model).")}`;
 
 // ---- main -----------------------------------------------------------------
 async function main() {
@@ -1817,6 +1974,7 @@ async function main() {
   if (cmd === "setup-local" || cmd === "setup-ollama") return cmdSetupLocal();
   if (cmd === "drift") return cmdDrift();
   if (cmd === "push") return cmdPush();
+  if (cmd === "mail" || cmd === "email") return cmdMail();
   if (cmd === "week") return cmdRun("week");
   if (cmd === "standup") return cmdRun("standup");
   if (cmd === "todo") return cmdRun("todo");
@@ -1832,4 +1990,4 @@ const isMain = (() => {
 })();
 if (isMain) main();
 
-export { authorship, repoState, readmeInfo, repoShape, houseRules, findAllRepos, buildMap, reportFooter, detectHardware, recommendModels, computeDrift, driftRepo, gitDefaultBranch, buildTasksMd, taskType, EMBEDDED_UI, orcaHandoffCmd, migrateOrcaCmd, fillHandoff, handoffCmd, setHandoffCmd, ORCA_CLAUDE_CMD, HANDOFF_PROMPT, shipChanges, syncTasks, pendingReview, approveRepo, sendBack, pushTasks, semverGt };
+export { authorship, repoState, readmeInfo, repoShape, houseRules, findAllRepos, buildMap, reportFooter, detectHardware, recommendModels, computeDrift, driftRepo, gitDefaultBranch, buildTasksMd, taskType, EMBEDDED_UI, orcaHandoffCmd, migrateOrcaCmd, migrateClaudeCmd, fillHandoff, handoffCmd, setHandoffCmd, ORCA_CLAUDE_CMD, CLAUDE_CMD, HANDOFF_PROMPT, shipChanges, syncTasks, pendingReview, approveRepo, sendBack, pushTasks, semverGt, updateCmd, parseQuestions, agentQuestions };

package/mail.mjs

@@ -0,0 +1,155 @@
+// symbiot — your email, without an API.
+//
+// Reads the mail a desktop client already keeps on this computer (Thunderbird,
+// Apple Mail, Evolution, KMail, mutt/neomutt — any Maildir or mbox) or an
+// exported .mbox (e.g. Google Takeout). No OAuth, no app registration, no
+// password, no server: it works the same for anyone with mail on disk, which is
+// how everyone else can link theirs too. Only headers are read (Date, From, To,
+// Subject, Message-ID), never a message body — and only mail YOU sent, so a
+// write-up gets "what I did over email", not your inbox.
+import { homedir } from "node:os";
+import { join, basename, dirname } from "node:path";
+import { readdirSync, statSync, openSync, readSync, closeSync, fstatSync } from "node:fs";
+
+const TAIL_BYTES = 24 * 1024 * 1024; // an mbox appends: the newest mail is at the end
+const HEAD_BYTES = 64 * 1024;        // enough for one message's headers
+const MAX_FILES = 600;               // message files read per folder
+const MAX_ITEMS = 80;
+const WALK_MS = 8000;                // one folder walk
+const READ_MS = 15000;               // everything, all sources
+const SKIP_DIRS = new Set(["node_modules", ".git", "Attachments", "attachments", "cache2", "startupCache", "crashes", "minidumps", "storage", "datareporting", "extensions"]);
+const NOT_MAIL = /\.(msf|dat|sqlite|sqlite-wal|sqlite-shm|json|plist|db|summary|cmeta|ibex|index|lock|log|txt|js|html|css|png|jpg|gif)$/i;
+const SENTNAME = /^\.?sent\b/i; // Sent, Sent Mail, Sent Items, Sent Messages(.mbox), .Sent
+
+// Bounded directory walk in plain JS (no `find`, so it also works on Windows).
+function walk(root, { depth = 6, limit = 200, dirs = false, match, deadline = Date.now() + WALK_MS }) {
+  const out = [];
+  const go = (dir, d) => {
+    if (out.length >= limit || Date.now() > deadline) return;
+    let ents; try { ents = readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of ents) {
+      if (out.length >= limit || Date.now() > deadline) return;
+      const p = join(dir, e.name);
+      if (e.isDirectory()) {
+        if (dirs && match(e.name, p)) { out.push(p); continue; }
+        if (d < depth && !SKIP_DIRS.has(e.name)) go(p, d + 1);
+      } else if (!dirs && e.isFile() && match(e.name, p)) out.push(p);
+    }
+  };
+  go(root, 0);
+  return out;
+}
+
+// Where desktop mail clients keep sent mail, per OS. Returns [{ path, kind }].
+export function detectMailSources() {
+  const H = homedir(), out = [];
+  const add = (kind, paths) => { for (const p of paths) if (!out.some((x) => x.path === p)) out.push({ path: p, kind }); };
+  const sentFile = (n) => SENTNAME.test(n) && !NOT_MAIL.test(n);
+  const tb = process.platform === "darwin" ? [join(H, "Library/Thunderbird/Profiles")]
+    : process.platform === "win32" ? [join(process.env.APPDATA || join(H, "AppData/Roaming"), "Thunderbird/Profiles")]
+    : [join(H, ".thunderbird"), join(H, "snap/thunderbird/common/.thunderbird"), join(H, ".var/app/org.mozilla.Thunderbird/.thunderbird")];
+  for (const r of tb) add("Thunderbird", walk(r, { depth: 6, limit: 12, match: sentFile })); // mbox files: Mail/…/Sent, ImapMail/…/Sent Mail
+  if (process.platform === "darwin") add("Apple Mail", walk(join(H, "Library/Mail"), { depth: 4, limit: 12, dirs: true, match: (n) => SENTNAME.test(n) && /\.mbox$/i.test(n) }));
+  if (process.platform === "linux") {
+    for (const r of [join(H, ".local/share/evolution/mail"), join(H, ".cache/evolution/mail")]) add("Evolution", walk(r, { depth: 5, limit: 8, dirs: true, match: (n) => SENTNAME.test(n) }));
+    add("KMail", walk(join(H, ".local/share/local-mail"), { depth: 3, limit: 4, dirs: true, match: (n) => SENTNAME.test(n) }));
+  }
+  for (const r of [join(H, "Maildir"), join(H, "mail"), join(H, "Mail"), join(H, ".mail")]) {
+    add("Maildir", walk(r, { depth: 3, limit: 6, dirs: true, match: (n) => SENTNAME.test(n) }));
+    add("mbox", walk(r, { depth: 3, limit: 6, match: sentFile }));
+  }
+  return out.slice(0, 24);
+}
+
+function readChunk(file, bytes, fromEnd) {
+  let fd;
+  try {
+    fd = openSync(file, "r");
+    const size = fstatSync(fd).size, len = Math.min(bytes, size), buf = Buffer.alloc(len);
+    readSync(fd, buf, 0, len, fromEnd ? size - len : 0);
+    return { text: buf.toString("utf8"), partial: fromEnd && size > len };
+  } catch { return { text: "", partial: false }; }
+  finally { if (fd !== undefined) try { closeSync(fd); } catch {} }
+}
+// RFC 5322 header block -> { lowercased name: first value }, folded lines joined.
+export function parseHeaders(raw) {
+  const s = String(raw || ""), end = s.search(/\r?\n\r?\n/);
+  const head = (end >= 0 ? s.slice(0, end) : s).replace(/\r?\n[ \t]+/g, " ");
+  const h = {};
+  for (const line of head.split(/\r?\n/)) {
+    const i = line.indexOf(":"); if (i <= 0) continue;
+    const k = line.slice(0, i).trim().toLowerCase(); if (!(k in h)) h[k] = line.slice(i + 1).trim();
+  }
+  return h;
+}
+// RFC 2047 encoded words: =?UTF-8?B?…?= / =?iso-8859-1?Q?…?=
+export function decodeWords(s) {
+  return String(s || "").replace(/=\?([^?]+)\?([bBqQ])\?([^?]*)\?=(?:\s+(?==\?))?/g, (all, cs, enc, txt) => {
+    try {
+      const buf = /b/i.test(enc) ? Buffer.from(txt, "base64")
+        : Buffer.from(txt.replace(/_/g, " ").replace(/=([0-9A-Fa-f]{2})/g, (x, hx) => String.fromCharCode(parseInt(hx, 16))), "latin1");
+      return new TextDecoder(/^(utf-?8|us-ascii)$/i.test(cs) ? "utf-8" : cs.replace(/\*.*$/, "").toLowerCase()).decode(buf);
+    } catch { return all; }
+  });
+}
+// "Ann <a@x.com>, b@y.com" -> [{ name, addr }]
+export function people(v) {
+  const out = [];
+  for (const part of decodeWords(v).split(/,(?=(?:[^"]*"[^"]*")*[^"]*$)/)) {
+    const m = part.match(/^\s*"?([^"<]*?)"?\s*<([^>]+)>/);
+    const addr = (m ? m[2] : part).trim().toLowerCase();
+    if (addr.includes("@")) out.push({ name: m ? m[1].trim() : "", addr });
+  }
+  return out;
+}
+function toItem(h, fallbackTs) {
+  if (parseInt(h["x-mozilla-status"] || "0", 16) & 0x0008) return null; // Thunderbird: deleted, not yet compacted away
+  const ts = Date.parse(String(h.date || "").replace(/\s*\([^)]*\)\s*$/, "")) || fallbackTs || 0;
+  return {
+    ts, id: String(h["message-id"] || "").trim(), labels: String(h["x-gmail-labels"] || ""),
+    from: people(h.from || "")[0] || null, to: people([h.to, h.cc].filter(Boolean).join(", ")),
+    subject: decodeWords(h.subject || "").replace(/\s+/g, " ").trim().slice(0, 200) || "(no subject)",
+  };
+}
+// One mbox file: read its tail, split on the "From " separator lines.
+function readMbox(file) {
+  const { text, partial } = readChunk(file, TAIL_BYTES, true);
+  const parts = text.split(/\r?\n(?=From )/);
+  if (partial) parts.shift(); // starts mid-message
+  return parts.map((p) => toItem(parseHeaders(p.replace(/^From [^\n]*\n/, "")), 0)).filter(Boolean);
+}
+// A folder of one-file-per-message mail: Maildir cur/new, .eml, Apple Mail .emlx.
+function readMailDir(dir, since, deadline) {
+  const msg = (n, p) => !n.startsWith(".") && !NOT_MAIL.test(n) && (/\.(eml|emlx)$/i.test(n) || /^(cur|new)$/.test(basename(dirname(p))) || /[\\/](cur|new)[\\/]/.test(p.slice(dir.length)));
+  const recent = (p) => { try { return statSync(p).mtimeMs >= since - 86400000; } catch { return false; } };
+  const files = walk(dir, { depth: 8, limit: MAX_FILES, deadline: Math.min(deadline, Date.now() + WALK_MS), match: (n, p) => msg(n, p) && recent(p) });
+  return files.map((f) => {
+    const t = readChunk(f, HEAD_BYTES, false).text.replace(/^\d+[ \t]*\r?\n/, ""); // .emlx starts with a byte count
+    let mt = 0; try { mt = statSync(f).mtimeMs; } catch {}
+    return toItem(parseHeaders(t), mt);
+  }).filter(Boolean);
+}
+const sentLabel = (l) => /(^|,)\s*"?sent"?\s*(,|$)/i.test(l); // Google Takeout's X-Gmail-Labels
+
+// Mail you sent in the last `days`: from the detected sources plus any you added.
+// Mail in a Sent folder is yours; elsewhere (e.g. a whole-mailbox export) it
+// counts only with Gmail's Sent label or a From matching one of `addresses`.
+export function mailActivity({ days = 7, sources = [], addresses = [], auto = true } = {}) {
+  const now = Date.now(), since = now - days * 86400000, deadline = now + READ_MS;
+  const me = new Set(addresses.map((a) => String(a).trim().toLowerCase()).filter(Boolean));
+  const paths = [...new Set([...(auto ? detectMailSources().map((s) => s.path) : []), ...sources])];
+  const seen = new Set(), items = [];
+  for (const p of paths) {
+    if (Date.now() > deadline) break;
+    let st; try { st = statSync(p); } catch { continue; }
+    if (!st.isDirectory() && st.mtimeMs < since) continue; // nothing appended in the window
+    const sentSrc = SENTNAME.test(basename(p));
+    for (const m of st.isDirectory() ? readMailDir(p, since, deadline) : readMbox(p)) {
+      if (m.ts < since || m.ts > now + 86400000) continue;
+      if (!(sentSrc || sentLabel(m.labels) || (m.from && me.has(m.from.addr)))) continue;
+      const k = m.id || m.ts + "|" + m.subject; if (seen.has(k)) continue; seen.add(k);
+      items.push({ ts: m.ts, date: new Date(m.ts).toISOString().slice(0, 10), to: m.to.slice(0, 3).map((x) => x.name || x.addr), subject: m.subject, source: p });
+    }
+  }
+  return items.sort((a, b) => b.ts - a.ts).slice(0, MAX_ITEMS);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "symbiot",
-  "version": "0.32.0",
+  "version": "0.34.0",
   "description": "Your week, written from your real work. Reads your local git and writes it up with the AI of your choice — Claude, OpenAI, Gemini, or a local model.",
   "type": "module",
   "bin": {
@@ -9,6 +9,7 @@
   "files": [
     "index.mjs",
     "ui.mjs",
+    "mail.mjs",
     "README.md",
     "LICENSE"
   ],
@@ -43,6 +44,6 @@
     "@anthropic-ai/sdk": "^0.128.0"
   },
   "scripts": {
-    "test": "node test/load.mjs && node test/fixtures.mjs && node test/smoke.mjs && node test/install.mjs"
+    "test": "node test/load.mjs && node test/fixtures.mjs && node test/smoke.mjs && node test/app.mjs && node test/install.mjs"
   }
 }

package/ui.mjs

@@ -105,6 +105,17 @@ footer{padding:10px 18px;border-top:1px solid var(--line);display:flex}
 .commits{margin-top:6px;font-size:12px;color:var(--text);font-family:ui-monospace,Menlo,Consolas,monospace}
 .commits code{color:var(--amber);margin-right:6px}
 @keyframes pulse{0%,100%{opacity:1;box-shadow:0 0 0 0 rgba(242,165,65,.5)}50%{opacity:.4;box-shadow:0 0 0 5px rgba(242,165,65,0)}}
+.aq{margin-top:10px;border:1px solid var(--amber);border-radius:9px;padding:10px 12px;background:var(--ink)}
+.aq h4{margin:4px 0 6px;color:var(--amber);font-size:11px;letter-spacing:.12em;text-transform:uppercase;font-weight:700}
+.aq .q{padding:8px 0;border-bottom:1px solid var(--line)}
+.aq .qt{color:var(--bone);font-weight:600;font-size:13.5px}
+.aq .qc{color:var(--faint);font-size:12.5px;margin-top:3px;line-height:1.5}
+.aq label.opt{display:flex;gap:8px;align-items:flex-start;margin:6px 0 0;font-size:13px;color:var(--text);cursor:pointer}
+.aq .opt input{width:auto;margin-top:3px;flex:none}
+.aq .qother{margin-top:7px;padding:7px 10px;font-size:13px}
+.aq .row{margin:10px 0 2px}
+label.check{display:flex;gap:8px;align-items:center;font-size:13px;color:var(--text);margin:6px 0}
+label.check input{width:auto}
 .alogout{white-space:pre-wrap;background:var(--ink);border:1px solid var(--line);border-radius:8px;padding:10px;margin-top:10px;font-family:ui-monospace,Menlo,Consolas,monospace;font-size:12px;line-height:1.5;color:var(--text);max-height:260px;overflow:auto}
 .bar{height:3px;background:var(--green-dim);border-radius:2px;overflow:hidden;margin-top:8px}
 .bar > i{display:block;height:100%;width:35%;background:var(--green);border-radius:2px;animation:slide 1.3s ease-in-out infinite}
@@ -165,13 +176,14 @@ footer{padding:10px 18px;border-top:1px solid var(--line);display:flex}
 <div id="tasklist"></div>
 </section>
 <section id="panel-agents" class="hidden">
-<div class="row"><span class="muted">Agents Symbiot has handed work to — live status and output.</span><button class="ghost" id="agentsrefresh" style="margin-left:auto">Refresh</button></div>
+<div class="row"><span class="muted">Agents Symbiot has handed work to — live status and output. Questions, options and ideas an agent leaves for you show up on its block, whichever model it runs.</span><button class="ghost" id="agentsrefresh" style="margin-left:auto">Refresh</button></div>
+<div id="agentsmsg"></div>
 <div id="agentslist"></div>
 </section>
 <section id="panel-drift" class="hidden">
 <div class="row"><span class="muted">What's out of sync, stuck or at risk across your repos — local git facts.</span>
 <label class="muted" style="margin-left:auto"><input type="checkbox" id="driftfetch"> fetch latest</label>
-<label class="muted"><input type="checkbox" id="driftci"> check CI (needs gh)</label>
+<label class="muted"><input type="checkbox" id="driftci"> check CI (needs gh, experimental)</label>
 <button class="ghost" id="driftrun">Rescan</button></div>
 <div id="driftout"></div>
 </section>
@@ -204,6 +216,16 @@ footer{padding:10px 18px;border-top:1px solid var(--line);display:flex}
 <div id="agentpresets" style="margin-top:8px"></div>
 </div>
 <div style="margin-top:20px;border-top:1px solid var(--line);padding-top:16px">
+<label>Email &mdash; add what you sent to Week and Standup <span class="muted">(experimental)</span></label>
+<label class="check"><input type="checkbox" id="mailon"> Use my sent email (subjects &amp; recipients only)</label>
+<div id="mailsources"></div>
+<div class="row" style="margin-top:6px"><input id="newmail" placeholder="add a mail folder or .mbox file  (e.g. a Google Takeout export)" style="flex:1"><button class="ghost" id="addmail">Add</button><button class="ghost" id="mailpreview">Preview</button></div>
+<input id="mailaddrs" type="text" placeholder="your email addresses, comma-separated  (only needed for a whole-mailbox export)">
+<div class="note muted" id="mailnote">No API, no OAuth, no password: Symbiot reads the mail your desktop mail app (Thunderbird, Apple Mail, Evolution, mutt&hellip;) already keeps on this computer, or an exported .mbox &mdash; so anyone can link theirs. Headers only, never a message body; off until you tick it. Experimental: tested with mbox and Maildir, not yet on real Apple Mail, Evolution or KMail stores.</div>
+<div id="mailout"></div>
+</div>
+<div style="margin-top:20px;border-top:1px solid var(--line);padding-top:16px">
+<label>Local models <span class="muted">(experimental)</span></label>
 <button class="ghost" id="recbtn">Recommend models for my machine</button>
 <button class="ghost" id="setuplocal" style="margin-left:8px">Set up a free local model</button>
 <div id="setupout" class="note muted" style="margin-top:10px"></div>
@@ -380,10 +402,47 @@ var h="<div class='tgroup'>Archived <span class='tcount'>"+list.length+"</span><
 var agentsTimer=null;
 function stopAgentsPoll(){if(agentsTimer){clearTimeout(agentsTimer);agentsTimer=null;}}
 function fmtE(ms){var s=Math.floor(ms/1000);if(s<60)return s+'s';var m=Math.floor(s/60);return m+'m '+(s%60)+'s';}
+// Questions, options and ideas an agent left in .symbiot/QUESTIONS.md (any
+// agent: it's a file). Answers go to .symbiot/ANSWERS.md; "Send & continue"
+// re-runs the agent so it picks them up. Text stays out of attributes (esc()
+// doesn't escape quotes) — rows carry indexes into AGENTLIST instead.
+var AGENTLIST=[],QDRAFT={};
+function agentById(id){for(var i=0;i<AGENTLIST.length;i++)if(AGENTLIST[i].id===id)return AGENTLIST[i];return null;}
+function nQs(a){return (a.ask&&a.ask.questions)?a.ask.questions.length:0;}
+function askHtml(a){var k=a.ask;if(!k)return '';var qs=k.questions||[],ss=k.suggestions||[];if(!qs.length&&!ss.length)return '';
+var h="<div class='aq' data-id='"+esc(a.id)+"'>";
+if(qs.length){h+="<h4>&#10067; "+qs.length+" question"+(qs.length>1?"s":"")+" for you</h4>";
+qs.forEach(function(q,i){h+="<div class='q' data-i='"+i+"'><div class='qt'>"+esc(q.q)+"</div>"+(q.context?"<div class='qc'>"+esc(q.context)+"</div>":"");
+(q.options||[]).forEach(function(o,j){h+="<label class='opt'><input type='radio' name='q_"+esc(a.id)+"_"+i+"' value='"+j+"'><span>"+esc(o)+"</span></label>";});
+h+="<input class='qother' placeholder='"+((q.options&&q.options.length)?"or answer in your own words":"your answer")+"'></div>";});
+h+="<div class='row'><button class='act qsend' title='save the answers and hand the repo back to your agent'>Send answers &amp; continue</button><button class='ghost qsave' title='save the answers for the next run'>Save only</button></div>";}
+if(ss.length){h+="<h4>&#128161; Ideas from the agent</h4>";ss.forEach(function(s,i){h+="<div class='idea'><span style='flex:1'>"+esc(s.text)+"</span>"+(s.added?"<span class='tag'>in Tasks</span>":"<button class='ghost qidea' data-i='"+i+"' style='padding:3px 9px;font-size:12px'>+ task</button>")+"</div>";});}
+return h+"</div>";}
+function qKeyOf(qe){var box=qe.closest('.aq');var a=box&&agentById(box.getAttribute('data-id'));var q=a&&a.ask.questions[+qe.getAttribute('data-i')];return q?a.path+'|'+q.q:'';}
+function saveDrafts(el){el.querySelectorAll('.aq .q').forEach(function(qe){var k=qKeyOf(qe);if(!k)return;var pick=qe.querySelector('input[type=radio]:checked');QDRAFT[k]={o:pick?pick.value:'',t:qe.querySelector('.qother').value};});}
+function restoreDrafts(el){el.querySelectorAll('.aq .q').forEach(function(qe){var d=QDRAFT[qKeyOf(qe)];if(!d)return;qe.querySelectorAll('input[type=radio]').forEach(function(r){r.checked=r.value===d.o;});qe.querySelector('.qother').value=d.t||'';});}
+function collectAnswers(box,a){var out=[];box.querySelectorAll('.q').forEach(function(qe){var q=a.ask.questions[+qe.getAttribute('data-i')];if(!q)return;
+var other=(qe.querySelector('.qother').value||'').trim();var pick=qe.querySelector('input[type=radio]:checked');var ans=other||(pick?q.options[+pick.value]:'');if(ans)out.push({q:q.q,a:ans});});return out;}
+function wireAsks(el){el.querySelectorAll('.aq').forEach(function(box){var a=agentById(box.getAttribute('data-id'));if(!a||!a.ask)return;
+function send(rerun){var msg=document.getElementById('agentsmsg');var ans=collectAnswers(box,a);
+if(!ans.length){msg.innerHTML="<div class='note err'>Pick an option or type an answer first.</div>";return;}
+box.querySelectorAll('button').forEach(function(b){b.disabled=true;});
+api('/api/agents/answer',{path:a.path,answers:ans,rerun:rerun}).then(function(r){
+if(!r||r.error){box.querySelectorAll('button').forEach(function(b){b.disabled=false;});msg.innerHTML="<div class='note err'>"+esc((r&&r.error)||'failed')+"</div>";return;}
+msg.innerHTML="<div class='note ok'>&#10003; Saved "+r.saved+" answer"+(r.saved>1?"s":"")+" for <b>"+esc(a.name)+"</b> in .symbiot/ANSWERS.md"+(r.rerun?" &middot; your agent is picking them up now.":".")+(r.note?"<div class='muted'>"+esc(r.note)+"</div>":"")+"</div>";loadAgents();});}
+var s1=box.querySelector('.qsend'),s2=box.querySelector('.qsave');
+if(s1)s1.addEventListener('click',function(){send(true);});if(s2)s2.addEventListener('click',function(){send(false);});
+box.querySelectorAll('.qidea').forEach(function(btn){btn.addEventListener('click',function(){var s=a.ask.suggestions[+btn.getAttribute('data-i')];if(!s)return;btn.disabled=true;
+api('/api/tasks/add',{text:s.text,repo:a.name}).then(function(){s.added=true;btn.outerHTML="<span class='tag'>in Tasks</span>";});});});});}
+function answering(){var f=document.activeElement;return !!(f&&f.closest&&f.closest('.aq'));}
 function loadAgents(){api('/api/agents').then(function(list){var el=document.getElementById('agentslist');
-if(!list||!list.length){el.innerHTML="<div class='muted' style='margin-top:12px'>No agents yet. In <b>Tasks</b>, tick ideas and hit <b>Send to repos</b> (with an agent command set in Settings) &mdash; you'll watch it work here.</div>";stopAgentsPoll();return;}
+if(!list||!list.length){AGENTLIST=[];el.innerHTML="<div class='muted' style='margin-top:12px'>No agents yet. In <b>Tasks</b>, tick ideas and hit <b>Send to repos</b> (with an agent command set in Settings) &mdash; you'll watch it work here.</div>";stopAgentsPoll();return;}
+var anyRunning=list.some(function(a){return a.status==='running';});
+if(answering()){stopAgentsPoll();if(anyRunning&&current==='agents')agentsTimer=setTimeout(loadAgents,2000);return;} // don't re-render under someone typing an answer
+saveDrafts(el);AGENTLIST=list;
 el.innerHTML=list.map(function(a){var cls=a.status==='running'?'run':(a.status==='done'?'ok':'fail');
 var st=a.status==='running'?('working &middot; '+fmtE(a.elapsed)):(esc(a.status)+' &middot; '+fmtE(a.elapsed)+(a.exitCode!=null?' &middot; exit '+a.exitCode:''));
+if(nQs(a))st+=" &middot; <span style='color:var(--amber)'>needs your answers</span>";
 var b="<div class='dh'><span class='adot "+cls+"'></span><span class='dn'>"+esc(a.name)+"</span><span class='dd'>"+st+"</span></div>";
 if(a.status==='running')b+="<div class='bar'><i></i></div>";
 var ch=a.changed;
@@ -396,10 +455,11 @@ if(ch&&(ch.dirty||ch.stat||(ch.commits&&ch.commits.length))){
 }else if(a.status==='done'){
   b+="<div class='changed muted'>No file changes detected (the agent may have only planned or asked).</div>";
 }
+b+=askHtml(a);
 b+="<pre class='alogout'>"+esc((a.tail&&a.tail.trim())||'(waiting for output…)')+"</pre>";
 return "<div class='agent'>"+b+"</div>";}).join("");
 el.querySelectorAll('.alogout').forEach(function(p){p.scrollTop=p.scrollHeight;});
-var anyRunning=list.some(function(a){return a.status==='running';});
+restoreDrafts(el);wireAsks(el);
 stopAgentsPoll();if(anyRunning&&current==='agents')agentsTimer=setTimeout(loadAgents,2000);});}
 function loadDrift(){var out=document.getElementById('driftout');out.innerHTML="<div class='muted' style='margin-top:12px'>Reading your repos&hellip;</div>";
 var ci=document.getElementById('driftci').checked?'1':'0';var ft=document.getElementById('driftfetch').checked?'1':'0';
@@ -430,7 +490,11 @@ function loadAgentCfg(){api('/api/agentcfg').then(function(d){document.getElemen
 var chips=[];(d.agents||[]).forEach(function(a){chips.push(a);});(d.editors||[]).forEach(function(e){chips.push(e);});
 var box=document.getElementById('agentpresets');
 if(!chips.length){box.innerHTML="<span class='muted' style='font-size:12px'>Nothing detected on PATH &mdash; type your own command above.</span>";return;}
-box.innerHTML="<span class='muted' style='font-size:12px'>Detected &mdash; click to use:</span><br>"+chips.map(function(c,i){return "<button class='ghost preset' data-i='"+i+"' style='padding:4px 10px;font-size:12px;margin:5px 5px 0 0'>"+esc(c.label)+"</button>";}).join("");
+// Agents leave changes for review; an editor preset only opens the repo, so say so.
+var na=(d.agents||[]).length;function chip(c,i){return "<button class='ghost preset' data-i='"+i+"' style='padding:4px 10px;font-size:12px;margin:5px 5px 0 0'>"+esc(c.label)+"</button>";}
+var h="<span class='muted' style='font-size:12px'>Detected &mdash; click to use:</span><br>"+chips.slice(0,na).map(chip).join("");
+if(chips.length>na)h+="<div class='muted' style='font-size:12px;margin-top:8px'>Editors &mdash; opens only, no review:</div>"+chips.slice(na).map(function(c,i){return chip(c,na+i);}).join("");
+box.innerHTML=h;
 box.querySelectorAll('.preset').forEach(function(btn){btn.addEventListener('click',function(){document.getElementById('agentcmd').value=chips[+btn.getAttribute('data-i')].tmpl;saveAgent();});});});}
 function saveAgent(){api('/api/agentcmd',{cmd:document.getElementById('agentcmd').value});}
 function loadScanRoots(){api('/api/scanroots').then(function(d){var box=document.getElementById('scanroots');var roots=d.effective||[];
@@ -438,6 +502,23 @@ box.innerHTML=roots.map(function(r){var custom=(d.roots||[]).indexOf(r)>=0;retur
 box.querySelectorAll('.rmroot').forEach(function(btn){btn.addEventListener('click',function(){api('/api/scanroots/remove',{path:btn.closest('.task').getAttribute('data-p')}).then(function(){loadScanRoots();mapLoaded=false;driftLoaded=false;});});});});}
 function addRootUI(){var i=document.getElementById('newroot');var v=(i.value||'').trim();if(!v)return;var n=document.getElementById('scanrootnote');
 api('/api/scanroots/add',{path:v}).then(function(r){if(r.error){n.innerHTML="<span class='err'>"+esc(r.error)+"</span>";return;}i.value='';n.textContent='Added — the Map/Drift will rescan.';loadScanRoots();mapLoaded=false;driftLoaded=false;});}
+// Email: opt-in, read from mail already on this computer (no API) — see mail.mjs.
+function renderMail(d){if(!d)return;document.getElementById('mailon').checked=!!d.enabled;document.getElementById('mailaddrs').value=(d.addresses||[]).join(', ');
+var rows=(d.detected||[]).map(function(s){return "<div class='task'><span class='t' style='font-family:ui-monospace,monospace;font-size:12px'>"+esc(s.path)+"</span><span class='rp'>"+esc(s.kind)+"</span></div>";});
+(d.sources||[]).forEach(function(p,i){rows.push("<div class='task' data-i='"+i+"'><span class='t' style='font-family:ui-monospace,monospace;font-size:12px'>"+esc(p)+"</span><span class='rp'>added</span><button class='rm rmmail' title='remove'>&times;</button></div>");});
+var box=document.getElementById('mailsources');
+box.innerHTML=rows.length?rows.join(''):"<div class='muted' style='font-size:12px;margin-top:6px'>No mail app data found on this computer. Use a desktop mail app, or add an export (Google Takeout gives you an .mbox).</div>";
+box.querySelectorAll('.rmmail').forEach(function(btn){btn.addEventListener('click',function(){var p=(d.sources||[])[+btn.closest('.task').getAttribute('data-i')];if(p)api('/api/mail/set',{remove:p}).then(renderMail);});});
+if(d.error)document.getElementById('mailout').innerHTML="<div class='note err'>"+esc(d.error)+"</div>";}
+function loadMail(){api('/api/mail').then(renderMail);}
+function setMailOn(){api('/api/mail/set',{enabled:document.getElementById('mailon').checked}).then(renderMail);}
+function saveMailAddrs(){api('/api/mail/set',{addresses:document.getElementById('mailaddrs').value}).then(renderMail);}
+function addMailUI(){var i=document.getElementById('newmail');var v=(i.value||'').trim();if(!v)return;document.getElementById('mailout').innerHTML='';
+api('/api/mail/set',{add:v}).then(function(d){if(d&&!d.error)i.value='';renderMail(d);});}
+function previewMail(){var o=document.getElementById('mailout');o.innerHTML="<div class='muted' style='margin-top:8px'>Reading your sent mail&hellip;</div>";
+api('/api/mail/preview?days=7').then(function(r){var items=(r&&r.items)||[];
+if(!items.length){o.innerHTML="<div class='muted' style='margin-top:8px'>Nothing sent in the last 7 days found in these sources.</div>";return;}
+o.innerHTML="<div class='out2'><b>"+r.count+"</b> sent in the last 7 days &mdash; what a write-up would see:<br>"+items.map(function(x){return esc(x.date)+" &nbsp;"+esc(x.subject)+" &nbsp;&rarr; "+esc((x.to||[]).join(', ')||'?');}).join("<br>")+"</div>";});}
 function setupLocalUI(){var o=document.getElementById('setupout');o.innerHTML="Setting up a local model&hellip;";
 api('/api/setup-local',{}).then(function(r){if(r.error==='not-installed'){var i=r.install||{};o.innerHTML="Ollama isn't installed. Run this once, then click again:<div class='out2'>"+esc(i.cmd||'')+"</div><div class='muted' style='font-size:11px'>or download: "+esc(i.alt||'https://ollama.com/download')+"</div>";return;}
 o.innerHTML="Pulling <b>"+esc(r.model)+"</b> &mdash; watch it in the <b>Agents</b> tab. Symbiot switches to it automatically when the download finishes.";setTimeout(function(){setTab('agents');},700);}).catch(function(e){o.innerHTML="<span class='err'>Setup failed: "+esc(String((e&&e.message)||e))+"</span>";});}
@@ -481,6 +562,11 @@ document.getElementById('agentsrefresh').addEventListener('click',loadAgents);
 document.getElementById('addtask').addEventListener('click',addTaskUI);
 document.getElementById('pushtasks').addEventListener('click',pushTasksUI);
 document.getElementById('agentcmd').addEventListener('change',saveAgent);
+document.getElementById('mailon').addEventListener('change',setMailOn);
+document.getElementById('mailaddrs').addEventListener('change',saveMailAddrs);
+document.getElementById('addmail').addEventListener('click',addMailUI);
+document.getElementById('newmail').addEventListener('keydown',function(e){if(e.key==='Enter')addMailUI();});
+document.getElementById('mailpreview').addEventListener('click',previewMail);
 document.getElementById('newtask').addEventListener('keydown',function(e){if(e.key==='Enter')addTaskUI();});
 var SRV_STARTED=null,srvDown=false,updBusy=false;
 function ubar(){return document.getElementById('updatebar');}
@@ -514,5 +600,5 @@ function heartbeat(fresh){
 function doUpdate(){updBusy=true;try{localStorage.setItem('symbiot_update_tried',document.getElementById('ver').textContent.replace(/^v/,''));}catch(e){}var b=ubar();b.className='updatebar show';b.textContent='Updating & restarting… this page will reload itself when it is back.';api('/api/update',{});}
 setInterval(heartbeat,4000);heartbeat(true);
 window.addEventListener('focus',function(){heartbeat(true);}); // re-check for updates when you come back to the window
-initGraphEvents();syncP();refresh();loadMap();loadAgentCfg();loadScanRoots();
+initGraphEvents();syncP();refresh();loadMap();loadAgentCfg();loadScanRoots();loadMail();
 </script></body></html>`;