symbiot 0.40.4 → 0.41.0

package/tasks.mjs

@@ -0,0 +1,445 @@
+// Tasks, from your list to a merged PR: the checklist (tasks.json), the brief
+// each repo gets (.symbiot/TASKS.md), what the agent ticked (review), and
+// Approve: branch, commit, push, PR, and the version bump and npm release facts
+// it shows.
+import { spawnSync } from "node:child_process";
+import { join } from "node:path";
+import { readFileSync, writeFileSync, existsSync, readdirSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { VERSION, LATEST_VERSION, REGISTRY, semverGt, loadConfig, saveConfig, loadTasks, saveTasks, sh, hasCmd, repoState } from "./core.mjs";
+import { QUESTIONS_MAX, handoffCmd, runningHandoff, writeTasks, startHeldTasks } from "./agents.mjs";
+import { gitDefaultBranch } from "./drift.mjs";
+import { repoPathMap, openWork, detectRepo } from "./scan.mjs";
+
+// ---- tasks: a persistent checklist (stored by core.mjs) -------------------
+// One line (TASKS.md has a task per line, and a tick only matches a whole one),
+// long enough for a pasted list of next steps: 300 cut one off mid-list.
+function addTask(text, repo) {
+  text = String(text || "").replace(/\s+/g, " ").trim().slice(0, 1000);
+  if (!text) return { error: "empty" };
+  const t = loadTasks();
+  // The same text already open in the same repo (in review counts): that task, not a duplicate.
+  const same = (s) => String(s || "").replace(/\s+/g, " ").trim().toLowerCase();
+  const dup = t.find((x) => !x.done && !x.archived && (x.repo || "") === (repo || "") && same(x.text) === same(text));
+  if (dup) return { ...dup, duplicate: true };
+  const item = { id: randomBytes(6).toString("hex"), text, repo: repo || "", done: false, ts: Date.now() };
+  t.unshift(item); saveTasks(t); return item;
+}
+function toggleTask(id) { const t = loadTasks(); const it = t.find((x) => x.id === id); if (it) { it.done = !it.done; saveTasks(t); } return it || { error: "not found" }; }
+function removeTask(id) { saveTasks(loadTasks().filter((x) => x.id !== id)); return { ok: true }; }
+function restoreTask(id) { const t = loadTasks(); const it = t.find((x) => x.id === id); if (it) { it.archived = false; it.done = false; delete it.archivedAt; saveTasks(t); } return it || { error: "not found" }; }
+// Which task texts the agent checked off in a repo's .symbiot/TASKS.md
+function completedInRepo(repoPath) {
+  try { return readFileSync(join(repoPath, ".symbiot", "TASKS.md"), "utf8").split("\n").filter((l) => /^\s*-\s*\[x\]/i.test(l)).map((l) => l.replace(/^\s*-\s*\[x\]\s*/i, "").trim().toLowerCase()); }
+  catch { return []; }
+}
+
+// "Check what was handed out, see what's completed, then archive it" — with an
+// approval step in between. An agent ticking an item in TASKS.md means "done,
+// please review", NOT archived: it waits in review until the user approves it
+// (approveRepo: branch + commit + push + PR, then archive) or sends it back
+// (sendBack: unticked, open again). Only a task the USER ticks archives directly.
+// Tasks held for an agent that has since finished land here too, and an agent
+// starts on what's still open in them (one `push --open` started can't do that).
+function syncTasks() {
+  const t = loadTasks(); const map = repoPathMap(); let review = 0, archived = 0, started = 0; const checkedByRepo = {};
+  for (const x of t) {
+    if (x.archived || x.done || x.review || !x.repo) continue;
+    if (!(x.repo in checkedByRepo)) { const p = map[x.repo]; if (p && startHeldTasks(p)) started++; checkedByRepo[x.repo] = p ? completedInRepo(p) : []; }
+    if (checkedByRepo[x.repo].includes(x.text.toLowerCase())) { x.review = true; x.reviewAt = Date.now(); review++; }
+  }
+  for (const x of t) { if (x.done && !x.archived) { x.archived = true; x.archivedAt = Date.now(); archived++; } }
+  saveTasks(t);
+  return { review, archived, started };
+}
+// git with an argv (task text goes into commit messages — never through a shell)
+function git(repo, args, timeout = 30000) {
+  const r = spawnSync("git", ["-C", repo, ...args], { encoding: "utf8", timeout, maxBuffer: 32 * 1024 * 1024, env: { ...process.env, GIT_TERMINAL_PROMPT: "0" } });
+  return { ok: r.status === 0, out: String(r.stdout || "").replace(/\s+$/, ""), err: String(r.stderr || (r.error && r.error.message) || "").trim() };
+}
+const NOT_SYMBIOT = ["--", ".", ":(exclude).symbiot"]; // .symbiot/ is Symbiot's scratch (brief + agent log), never shipped
+function workingChanges(path) {
+  const st = git(path, ["status", "--porcelain", "-uall", ...NOT_SYMBIOT]);
+  const files = st.out ? st.out.split("\n").map((l) => ({ st: l.slice(0, 2).trim(), file: l.slice(3) })) : [];
+  const short = git(path, ["diff", "--shortstat", "HEAD", ...NOT_SYMBIOT]).out, n = (re) => +((short.match(re) || [])[1] || 0);
+  const ins = n(/(\d+) insertion/), del = n(/(\d+) deletion/), fresh = files.filter((f) => f.st === "??").length;
+  const stat = [ins && `+${ins}`, del && `−${del}`, fresh && `${fresh} new`].filter(Boolean).join(" ");
+  return { branch: git(path, ["rev-parse", "--abbrev-ref", "HEAD"]).out, files, stat };
+}
+// The full diff the agent left behind: tracked changes + new files, capped.
+function workingDiff(path, cap = 400000) {
+  let d = git(path, ["diff", "HEAD", ...NOT_SYMBIOT]).out;
+  for (const f of workingChanges(path).files.filter((x) => x.st === "??")) {
+    if (d.length > cap) break;
+    d += (d ? "\n" : "") + git(path, ["diff", "--no-index", "--", "/dev/null", f.file]).out; // exits 1 on a difference — output is what we want
+  }
+  return d.length > cap ? d.slice(0, cap) + "\n… (diff truncated)" : d;
+}
+// A repo that publishes on merge: a GitHub workflow runs `npm publish` on a push
+// to a branch, not only on a tag. Its release is the version npm has; a v* tag,
+// if any, is a best-effort record that can lag or be missing.
+function publishesOnMerge(path) {
+  const dir = join(path, ".github", "workflows"); let files = []; try { files = readdirSync(dir).filter((f) => /\.ya?ml$/.test(f)); } catch { return false; }
+  return files.some((f) => { let t = ""; try { t = readFileSync(join(dir, f), "utf8"); } catch {} return /\bnpm publish\b/.test(t) && /^\s*push:\s*\n\s+branches:/m.test(t); });
+}
+// Merged work that isn't released yet, or null when there's none, or the repo
+// has no releases to measure from. bump: the version these uncommitted changes
+// set in package.json, if they change it.
+// - Released by v* tag: how many commits the default branch (or origin's copy,
+//   where approved PRs merge) is past its last v* tag.
+// - Publishes on merge (npm: true): how many commits it's past the one that set
+//   the version npm has (since), once learnNpm knows. A branch whose version
+//   isn't on npm yet is merged and due to publish: { pending: version }.
+function unreleased(path) {
+  const base = gitDefaultBranch(path), pom = publishesOnMerge(path); let best = null;
+  for (const ref of ["refs/heads/" + base, "refs/remotes/origin/" + base]) {
+    if (!git(path, ["rev-parse", "-q", "--verify", ref]).ok) continue;
+    let r = null;
+    if (pom) {
+      const k = npmKey(path, ref), v = k.slice(k.lastIndexOf("@") + 1), known = k && NPM_HAS.get(k); if (!known) continue;
+      if (!known.yes) r = { base, npm: true, pending: v, ahead: 0 };
+      else {
+        const set = git(path, ["log", "-1", "--format=%H", "-G", `"version"[[:space:]]*:[[:space:]]*"${v.replace(/\./g, "\\.")}"`, ref, "--", "package.json"]).out;
+        r = { base, npm: true, since: v, ahead: set ? +git(path, ["rev-list", "--count", set + ".." + ref]).out || 0 : 0 };
+      }
+    } else {
+      const tag = git(path, ["describe", "--tags", "--abbrev=0", "--match", "v*", ref]).out; if (!tag) continue;
+      r = { base, tag, ahead: +git(path, ["rev-list", "--count", tag + ".." + ref]).out || 0 };
+    }
+    // the copy furthest ahead; a merged version still to publish says more than a count
+    if (!best || (r.pending && !best.pending) || (!best.pending && r.ahead > best.ahead)) best = r;
+  }
+  if (!best || (!best.ahead && !best.pending)) return null;
+  const ver = (s) => { try { return String(JSON.parse(s).version || ""); } catch { return ""; } };
+  let now = ""; try { now = ver(readFileSync(join(path, "package.json"), "utf8")); } catch {}
+  const was = ver(git(path, ["show", "HEAD:package.json"]).out);
+  return { ...best, ...(now && was && now !== was ? { bump: now } : {}) };
+}
+// Approve can bump the version in the PR itself: offered when the committed
+// version is already released and these changes don't change it. Released: its
+// v* tag exists, or npm has it (a repo that publishes on merge may have no tag,
+// or one its release couldn't push). { version, patch, minor } or null.
+function bumpOffer(path) {
+  const ver = (s) => { try { return String(JSON.parse(s).version || ""); } catch { return ""; } };
+  const was = ver(git(path, ["show", "HEAD:package.json"]).out), m = was.match(/^(\d+)\.(\d+)\.(\d+)$/); if (!m) return null;
+  let now = ""; try { now = ver(readFileSync(join(path, "package.json"), "utf8")); } catch {}
+  if (now !== was || !(git(path, ["rev-parse", "-q", "--verify", "refs/tags/v" + was]).ok || onNpm(path))) return null;
+  return { version: was, patch: `${m[1]}.${m[2]}.${+m[3] + 1}`, minor: `${m[1]}.${+m[2] + 1}.0` };
+}
+// Whether npm has the committed version, as learnNpm last found ("name@version" →
+// { yes, at }). bumpOffer only reads this; learnNpm asks the registry first.
+const NPM_HAS = new Map();
+function npmKey(path, ref = "HEAD") {
+  let p = {}; try { p = JSON.parse(git(path, ["show", ref + ":package.json"]).out) || {}; } catch {}
+  return typeof p.name === "string" && p.name && !p.private && typeof p.version === "string" && p.version ? p.name + "@" + p.version : "";
+}
+function onNpm(path) { const k = npmKey(path); return !!(k && NPM_HAS.get(k) && NPM_HAS.get(k).yes); }
+// Ask the registry about each repo's committed version, and for a repo that
+// publishes on merge, its default branch's (unreleased measures from that). A
+// yes is kept; a no is asked again after 5 minutes (it may have just been
+// published). True when it learned of a version on npm.
+async function learnNpm(paths, registry = REGISTRY) {
+  let learned = false;
+  const keys = new Set();
+  for (const path of new Set(paths.filter(Boolean))) {
+    keys.add(npmKey(path));
+    if (publishesOnMerge(path)) { const base = gitDefaultBranch(path); for (const ref of ["refs/heads/" + base, "refs/remotes/origin/" + base]) keys.add(npmKey(path, ref)); }
+  }
+  await Promise.all([...keys].map(async (k) => {
+    const was = NPM_HAS.get(k); if (!k || (was && (was.yes || Date.now() - was.at < 300000))) return;
+    const at = k.lastIndexOf("@"), name = k.slice(0, at), version = k.slice(at + 1);
+    try {
+      const r = await fetch(`${registry}/${encodeURIComponent(name).replace(/^%40/, "@")}/${encodeURIComponent(version)}`, { signal: AbortSignal.timeout(5000) });
+      const yes = r.ok && String((await r.json().catch(() => ({}))).version || "") === version;
+      NPM_HAS.set(k, { yes, at: Date.now() }); learned = learned || yes;
+    } catch {}
+  }));
+  return learned;
+}
+// An agent's question that needs a release ("Once 0.41.0 is installed: …") names
+// a version of the repo's own npm package. The Agents tab shows it next to the
+// version installed here and the one on npm, and doesn't offer a "Done" answer
+// until the step is possible: a release that isn't out, or isn't installed yet,
+// can't have been tried. The version asked about is the highest one the question
+// names in the package's major, up to its next minor (not "ydotool 0.1.8").
+function releaseNeeded(text, current) {
+  const p = (v) => v.split(".").map(Number), [maj, min] = p(current);
+  let best = "";
+  for (const [v] of String(text || "").matchAll(/\b\d+\.\d+\.\d+\b/g)) { const [a, b] = p(v); if (a === maj && b <= min + 1 && (!best || semverGt(v, best))) best = v; }
+  return best;
+}
+// The version npm -g installed, or for Symbiot this app's own; "" if not installed.
+function installedVersion(name) {
+  if (name === "symbiot") return VERSION;
+  const root = process.platform === "win32" ? join(process.execPath, "..", "node_modules") : join(process.execPath, "..", "..", "lib", "node_modules");
+  try { return String(JSON.parse(readFileSync(join(root, name, "package.json"), "utf8")).version || ""); } catch { return ""; }
+}
+// The newest version on npm ("" if unknown), asked again after 5 minutes.
+const NPM_LATEST = new Map();
+async function npmLatest(name, registry = REGISTRY) {
+  if (name === "symbiot" && LATEST_VERSION) return LATEST_VERSION;
+  const was = NPM_LATEST.get(name); if (was && Date.now() - was.at < 300000) return was.v;
+  let v = was ? was.v : "";
+  try {
+    const r = await fetch(`${registry}/${encodeURIComponent(name).replace(/^%40/, "@")}`, { headers: { accept: "application/vnd.npm.install-v1+json" }, signal: AbortSignal.timeout(5000) });
+    if (r.ok) v = String(((await r.json())["dist-tags"] || {}).latest || "");
+  } catch {}
+  NPM_LATEST.set(name, { v, at: Date.now() });
+  return v;
+}
+// Mark each open question that needs a release with { name, needs, installed,
+// npm, waiting }. waiting: "npm" (not published yet), "install" (published, not
+// installed here) or "" (possible now).
+async function withReleases(agents, registry = REGISTRY) {
+  for (const a of agents) {
+    const qs = (a.ask && a.ask.questions) || []; if (!qs.length) continue;
+    let pkg = {}; try { pkg = JSON.parse(readFileSync(join(a.path, "package.json"), "utf8")) || {}; } catch {}
+    if (typeof pkg.name !== "string" || !pkg.name || pkg.private || !/^\d+\.\d+\.\d+/.test(String(pkg.version || ""))) continue;
+    const asks = qs.map((q) => [q, releaseNeeded(q.q + " " + q.context, pkg.version)]).filter((x) => x[1]); if (!asks.length) continue;
+    const npm = await npmLatest(pkg.name, registry), installed = installedVersion(pkg.name);
+    for (const [q, needs] of asks) q.release = { name: pkg.name, needs, installed, npm, waiting: npm && semverGt(needs, npm) ? "npm" : installed && semverGt(needs, installed) ? "install" : "" };
+  }
+  return agents;
+}
+// Set the version in package.json and in package-lock.json / npm-shrinkwrap.json
+// (top level and its "" package), keeping each file's indent. Gives back a
+// function that restores them, for when the ship fails.
+function setVersion(path, to) {
+  const saved = [];
+  for (const f of ["package.json", "package-lock.json", "npm-shrinkwrap.json"]) {
+    const file = join(path, f); let text = "", j = null;
+    try { text = readFileSync(file, "utf8"); j = JSON.parse(text); } catch { continue; }
+    if (!j || typeof j !== "object" || (f !== "package.json" && !("version" in j))) continue;
+    j.version = to; if (f !== "package.json" && j.packages && j.packages[""]) j.packages[""].version = to;
+    writeFileSync(file, JSON.stringify(j, null, (text.match(/^[ \t]+(?=")/m) || ["  "])[0]) + (text.endsWith("\n") ? "\n" : ""));
+    saved.push([file, text]);
+  }
+  return () => { for (const [file, text] of saved) try { writeFileSync(file, text); } catch {} };
+}
+// Ship with the version bumped when opts.bump is "patch" or "minor" and the repo
+// is offered one (bumpOffer). The bump is put back if the ship fails.
+function shipWithBump(path, texts, opts) {
+  const offer = (opts.bump === "patch" || opts.bump === "minor") && bumpOffer(path);
+  if (!offer) return shipChanges(path, texts, opts);
+  const to = offer[opts.bump], undo = setVersion(path, to);
+  const r = shipChanges(path, texts, { ...opts, bumped: to });
+  if (r.error) { undo(); return r; }
+  return { ...r, bumped: to };
+}
+// Repos with tasks awaiting review, plus repos Symbiot sent tasks to that have
+// uncommitted changes no ticked task covers (untasked: approve them as-is).
+// running: an agent is still editing there, so its changes may be half done.
+function pendingReview() {
+  const t = loadTasks(), by = {}; for (const x of t) if (x.review && !x.done && !x.archived) (by[x.repo] = by[x.repo] || []).push(x);
+  const sent = [...new Set(t.filter((x) => x.repo && !x.archived && !by[x.repo]).map((x) => x.repo))];
+  const map = Object.keys(by).length || sent.length ? repoPathMap() : {};
+  const am = autoMergeRepos();
+  const out = Object.keys(by).sort().map((repo) => { const path = map[repo] || ""; return { repo, path, tasks: by[repo], autoMerge: am.includes(repo), running: !!(path && runningHandoff(path)), ...(path ? { ...workingChanges(path), unreleased: unreleased(path), bumpOffer: bumpOffer(path), publishesOnMerge: publishesOnMerge(path) } : { branch: "", files: [], stat: "" }) }; });
+  for (const repo of sent.sort()) {
+    const path = map[repo]; if (!path || !existsSync(join(path, ".symbiot", "TASKS.md"))) continue;
+    const wc = workingChanges(path); if (wc.files.length) out.push({ repo, path, tasks: [], untasked: true, autoMerge: am.includes(repo), running: !!runningHandoff(path), ...wc, unreleased: unreleased(path), bumpOffer: bumpOffer(path), publishesOnMerge: publishesOnMerge(path) });
+  }
+  return out;
+}
+// Approving while the agent is still editing would commit its half-done work.
+const stillWorking = (repo, path) => path && runningHandoff(path) ? { error: `The agent is still working in ${repo}. Approve once it finishes.`, running: true } : null;
+const branchSlug = (s) => String(s).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40).replace(/-+$/, "") || "tasks";
+// Whether everything committed on this branch is on the default branch already,
+// because an earlier PR from it merged. Squash-merged, main has the same changes
+// under a different history, so a new PR from the branch carries them twice and
+// can't merge (how #80 got stuck behind #79). Seen two ways: the branch's files
+// are main's though main doesn't hold its commits, or GitHub says a PR from it
+// merged and nothing was committed on it since. Gives the ref to start the next
+// branch from, or "".
+function mergedAlready(path, branch, base) {
+  const origin = git(path, ["remote", "get-url", "origin"]);
+  if (origin.ok) git(path, ["fetch", "-q", "origin", base], 30000); // best effort: main as GitHub has it
+  const ref = git(path, ["rev-parse", "-q", "--verify", "refs/remotes/origin/" + base]).ok ? "origin/" + base : base;
+  if (!git(path, ["rev-parse", "-q", "--verify", ref]).ok) return "";
+  if (!git(path, ["merge-base", "--is-ancestor", "HEAD", ref]).ok && git(path, ["diff", "--quiet", "HEAD", ref, ...NOT_SYMBIOT]).ok) return ref;
+  if (!origin.ok || !/github/i.test(origin.out) || !hasCmd("gh")) return "";
+  const r = spawnSync("gh", ["pr", "list", "--head", branch, "--state", "merged", "--limit", "1", "--json", "headRefOid"], { cwd: path, encoding: "utf8", timeout: 30000 });
+  let head = ""; try { head = String(JSON.parse(r.stdout)[0].headRefOid || ""); } catch {}
+  const since = head && git(path, ["rev-list", "--count", head + "..HEAD"]);
+  return since && since.ok && since.out === "0" ? ref : "";
+}
+// The commit's (and PR's) subject: what was approved, so `git log --oneline`
+// reads as a history ("Watch GitHub too (+2 more)"), not twenty "symbiot: 3
+// approved tasks". The first task's first line, its markdown dropped, clipped
+// at a word to fit 72 characters with the count of the rest. The body lists
+// them all.
+function commitSubject(texts) {
+  if (!texts.length) return "symbiot: changes approved without a task";
+  const more = texts.length > 1 ? ` (+${texts.length - 1} more)` : "", max = 72 - more.length;
+  const t = String(texts[0]).split("\n").find((l) => l.trim()) || "";
+  const s = t.replace(/^\s*(#+|[-*+]|\d+[.)])\s+/, "").replace(/\*\*|__/g, "").replace(/\s+/g, " ").trim() || `${texts.length} approved tasks`;
+  return (s.length > max ? s.slice(0, max - 1).replace(/\s+\S*$/, "") + "…" : s) + more;
+}
+// Sync approved work: off the default branch onto symbiot/<task>, commit the
+// working tree (minus .symbiot/), push, and open a PR with gh. On a branch whose
+// earlier PR already merged, it starts a fresh symbiot/ branch from the default
+// one instead (mergedAlready). Each step that can't happen (no remote, push
+// rejected, no gh) stops there and says so — the commit is never lost.
+// opts.push=false stops after the commit, opts.pr=false after the push.
+function shipChanges(path, texts, opts = {}) {
+  const ch = workingChanges(path);
+  if (!ch.files.length) return { ok: true, nothing: true, note: "No uncommitted changes — approved without a commit." };
+  if (!ch.branch || ch.branch === "HEAD") return { error: "Detached HEAD — check out a branch first." };
+  const base = gitDefaultBranch(path), day = new Date().toISOString().slice(0, 10); let branch = ch.branch, fresh = "";
+  const newBranch = () => {
+    const stem = "symbiot/" + branchSlug(!texts.length ? `changes-${day}` : texts.length === 1 ? texts[0] : `${texts.length}-tasks-${day}`);
+    let b = stem; for (let i = 2; git(path, ["rev-parse", "--verify", "-q", "refs/heads/" + b]).ok; i++) b = `${stem}-${i}`;
+    return b;
+  };
+  if (branch === base) {
+    branch = newBranch();
+    const sw = git(path, ["switch", "-c", branch]); if (!sw.ok) return { error: "Could not create branch: " + sw.err };
+  } else {
+    const from = mergedAlready(path, branch, base);
+    if (from) {
+      // The changes come along; if main changed a file they touch, git refuses and they stay put.
+      const next = newBranch(), sw = git(path, ["switch", "-c", next, "--no-track", from]);
+      fresh = sw.ok ? `${branch}'s earlier PR already merged, so this starts a fresh branch from ${from}.`
+        : `${branch}'s earlier PR already merged, but these changes couldn't move to a fresh branch from ${from} (${sw.err.split("\n")[0]}), so they're on ${branch}, and its PR may not merge.`;
+      if (sw.ok) branch = next;
+    }
+  }
+  // Stage everything, then drop .symbiot. A `. :(exclude).symbiot` pathspec
+  // warns+exits-1 once .symbiot is gitignored ("paths are ignored, use -f"),
+  // which falsely aborted the ship. `add -A` skips gitignored paths silently;
+  // the reset also covers repos where .symbiot isn't ignored.
+  const add = git(path, ["add", "-A"]); if (!add.ok) return { error: "git add failed: " + add.err, branch };
+  git(path, ["reset", "-q", "--", ".symbiot"]); // never ship Symbiot's own scratch
+  const subject = commitSubject(texts);
+  const body = (texts.length ? texts.map((x) => "- " + x).join("\n") : "No ticked task covers these changes.") + (opts.bumped ? `\n\nBumps the version to ${opts.bumped}. ` + (publishesOnMerge(path) ? `It publishes to npm when this merges.` : `After this merges, tag v${opts.bumped} on ${base} to release it.`) : "");
+  const cm = git(path, ["commit", "-m", subject, "-m", body]); if (!cm.ok) return { error: "Commit failed: " + (cm.err || cm.out), branch };
+  const out = { ok: true, branch, base, commit: git(path, ["rev-parse", "--short", "HEAD"]).out, subject, ...(fresh ? { note: fresh } : {}) };
+  const noted = (note) => ({ ...out, note: (fresh ? fresh + " " : "") + note });
+  if (opts.push === false) return out;
+  if (!git(path, ["remote", "get-url", "origin"]).ok) return noted("No origin remote — committed locally.");
+  const ps = git(path, ["push", "-u", "origin", branch], 120000);
+  if (!ps.ok) return noted("Committed, but the push failed: " + (ps.err.split("\n").filter(Boolean).pop() || "unknown error"));
+  out.pushed = true;
+  if (opts.pr === false) return out;
+  if (!hasCmd("gh")) return noted("Pushed. Install the GitHub CLI (gh) to open the PR automatically.");
+  const gh = (args) => spawnSync("gh", args, { cwd: path, encoding: "utf8", timeout: 60000 });
+  const pr = gh(["pr", "create", "--head", branch, "--base", base, "--title", subject, "--body", body + "\n\nApproved in Symbiot."]);
+  const url = (String(pr.stdout || "").match(/https?:\/\/\S+/) || [])[0] || String(gh(["pr", "view", branch, "--json", "url", "-q", ".url"]).stdout || "").trim();
+  if (!url) return noted("Pushed, but gh couldn't open the PR: " + String(pr.stderr || "").trim().split("\n").pop());
+  out.pr = url;
+  // Opt-in auto-merge: queue GitHub's native auto-merge, which lands the PR only
+  // once its required checks (CI) pass — never immediately on its own if the repo
+  // has branch protection. Needs 'Allow auto-merge' on the repo; if off, we say so.
+  if (opts.autoMerge) {
+    const am = gh(["pr", "merge", branch, "--auto", "--squash", "--delete-branch"]);
+    if (am.status === 0) out.autoMerge = "queued";
+    else { out.autoMerge = "unavailable"; out.autoMergeErr = String(am.stderr || "").trim().split("\n").filter(Boolean).pop() || "gh pr merge failed"; }
+  }
+  return out;
+}
+// Per-repo opt-in to auto-merge Approve PRs once CI passes (default off).
+function autoMergeRepos() { const a = loadConfig().autoMerge; return Array.isArray(a) ? a : []; }
+function setAutoMerge(repo, on) { const cfg = loadConfig(); let a = (Array.isArray(cfg.autoMerge) ? cfg.autoMerge : []).filter((x) => x !== repo); if (on && repo) a.push(repo); if (a.length) cfg.autoMerge = a; else delete cfg.autoMerge; saveConfig(cfg); return { ok: true, repos: cfg.autoMerge || [] }; }
+function approveRepo(repo, opts = {}) {
+  const t = loadTasks(); const items = t.filter((x) => x.repo === repo && x.review && !x.done && !x.archived);
+  if (!items.length) return { error: "Nothing awaiting review for " + (repo || "(no repo)") + "." };
+  const path = repoPathMap()[repo]; if (!path) return { error: "Repo not found: " + repo };
+  const busy = stillWorking(repo, path); if (busy) return busy;
+  const r = shipWithBump(path, items.map((x) => x.text), { ...opts, autoMerge: opts.autoMerge !== undefined ? opts.autoMerge : autoMergeRepos().includes(repo) });
+  if (r.error) return r;
+  const now = Date.now();
+  for (const x of items) { x.review = false; x.done = true; x.archived = true; x.archivedAt = now; x.approvedAt = now; for (const k of ["branch", "commit", "pr"]) if (r[k]) x[k] = r[k]; }
+  saveTasks(t);
+  return { ...r, approved: items.length };
+}
+// "Approve changes without a task": ship the uncommitted changes even though no
+// ticked task is behind them (a fix the agent made but didn't tick). If tasks are
+// awaiting review in the repo, this is just Approve.
+function approveChanges(repo, opts = {}) {
+  if (loadTasks().some((x) => x.repo === repo && x.review && !x.done && !x.archived)) return approveRepo(repo, opts);
+  const path = repoPathMap()[repo]; if (!path) return { error: "Repo not found: " + (repo || "(no repo)") };
+  const busy = stillWorking(repo, path); if (busy) return busy;
+  if (!workingChanges(path).files.length) return { error: "No uncommitted changes in " + repo + "." };
+  const r = shipWithBump(path, [], { ...opts, autoMerge: opts.autoMerge !== undefined ? opts.autoMerge : autoMergeRepos().includes(repo) });
+  return r.error ? r : { ...r, approved: 0 };
+}
+// Not right: reopen it and untick it in TASKS.md so the agent picks it up again.
+function sendBack(id) {
+  const t = loadTasks(); const it = t.find((x) => x.id === id); if (!it) return { error: "not found" };
+  it.review = false; delete it.reviewAt; saveTasks(t);
+  const path = it.repo && repoPathMap()[it.repo];
+  if (path) { const f = join(path, ".symbiot", "TASKS.md"); try { const want = it.text.trim().toLowerCase(); writeFileSync(f, readFileSync(f, "utf8").split("\n").map((l) => /^\s*-\s*\[x\]/i.test(l) && l.replace(/^\s*-\s*\[x\]\s*/i, "").trim().toLowerCase() === want ? l.replace(/\[x\]/i, "[ ]") : l).join("\n")); } catch {} }
+  return it;
+}
+// Deterministic task classification (no model) so tasks batch by kind instead
+// of arriving as a flat, mixed pile. Order matters (most specific first).
+const TASK_ORDER = ["Fixes", "Tests & CI", "Security", "Performance", "Refactor", "UI/UX", "Docs", "Features & other"];
+function taskType(text) {
+  const s = String(text || "").toLowerCase();
+  if (/\b(test|tests|spec|coverage|smoke|fixture|ci\b)/.test(s)) return "Tests & CI";
+  if (/\b(secur|auth|token|secret|vulnerab|permission|sanitiz|escap|injection)/.test(s)) return "Security";
+  if (/\b(readme|docs?|document|changelog|comment|guide)/.test(s)) return "Docs";
+  if (/\b(perf|performance|slow|optimi|latency|throughput|speed up|memory leak)/.test(s)) return "Performance";
+  if (/\b(refactor|simplify|split|extract|clean ?up|consolidat|dedupe|modular|rename)/.test(s)) return "Refactor";
+  if (/\b(bug|fix|broken|error|crash|regress|hang|race|leak)/.test(s)) return "Fixes";
+  if (/\b(ui|ux|design|layout|style|button|screen|view\b|page\b|responsive)/.test(s)) return "UI/UX";
+  return "Features & other";
+}
+// Push tasks into the repos as an agent-readable brief (.symbiot/TASKS.md):
+// a checklist plus the deterministic context an agent needs to get oriented.
+function buildTasksMd(name, ctx, list) {
+  const L = [];
+  L.push(`# Symbiot tasks — ${name}`);
+  L.push(`_generated ${new Date().toISOString().slice(0, 10)}${ctx.branch ? ` · branch ${ctx.branch}` : ""} · by symbiot ${VERSION}_`, "");
+  L.push("## Context for an AI agent", `Tasks for the \`${name}\` repo. Get oriented from the signals below before actioning them.`);
+  if (ctx.stack) L.push(`- **Stack:** ${ctx.stack}`);
+  if (ctx.commits && ctx.commits.length) { L.push("- **Recent commits:**"); for (const c of ctx.commits) L.push(`  - ${c}`); }
+  if (ctx.open && ctx.open.length) { L.push("- **Open markers (TODO/FIXME + uncommitted):**"); for (const o of ctx.open) L.push(`  - ${o}`); }
+  if (ctx.drift && ctx.drift.length) { L.push("- **Current drift / risk:**"); for (const d of ctx.drift) L.push(`  - ${d}`); }
+  L.push("", "## Tasks");
+  const byType = {}; for (const t of list) { const ty = taskType(t.text); (byType[ty] = byType[ty] || []).push(t); }
+  const keys = Object.keys(byType).sort((a, b) => TASK_ORDER.indexOf(a) - TASK_ORDER.indexOf(b));
+  for (const ty of keys) { L.push(`### ${ty}`); for (const t of byType[ty]) L.push(`- [ ] ${t.text}`); L.push(""); }
+  L.push("## When you finish an item", "- Tick it here (`- [x]`) as soon as it's done — that's how it reaches review. Ticking doesn't archive it: the user approves it in Symbiot, which commits it on a branch and opens a PR.", "- Leave your changes **uncommitted**, and don't tick anything you didn't finish or couldn't verify.", "");
+  L.push("## If you need a decision, or have ideas", "You may be running unattended, so you can't ask in chat. Write `.symbiot/QUESTIONS.md` instead: Symbiot shows it to the user on your block in its Agents tab, and their answers come back in `.symbiot/ANSWERS.md` (read that first if it exists).",
+    `- At most ${QUESTIONS_MAX} questions, under a \`## Questions\` heading. Each is a \`### \` heading, then an optional line of context, then 2–4 options as \`- \` bullets (put the one you recommend first).`,
+    "- Start every option with who acts, because the user reads it as something they'd be agreeing to do: `👤 You:` when they have to do something (a setting, a click, a command), `🤖 Agent:` when picking it is enough and the next run does the work. If it takes both, put their step first: `👤 You: allow npm install in Settings. 🤖 Agent: the next run adds ESLint`.",
+    "- If a step needs a release that isn't out yet, name its version in the question (\"Once 0.41.0 is installed: …\"). Symbiot shows it next to the installed and npm versions, and holds back an answer that starts \"Done\" until that release is out and installed.",
+    "- Ideas, options or follow-ups outside these tasks go under `## Suggestions` as `- ` bullets — the user can add them to their tasks in one click.",
+    "- An idea for a different project than this one (Symbiot itself, say, the app that sent you this brief) starts with that project's folder name, `- [repo: symbiot] …`, so it goes to that project's tasks instead of this one's.",
+    "- Carry on with everything that doesn't depend on an answer, and don't tick an item that does. Ask there rather than doing anything destructive.", "");
+  L.push("---", 'To action these, tell your coding agent: "Read `.symbiot/TASKS.md` and implement the unchecked items in this repo, using the context above. Tick each item as you finish it and leave changes uncommitted for review. Confirm with me before anything destructive."');
+  return L.join("\n") + "\n";
+}
+function pushTasks(filter) {
+  let tasks = loadTasks().filter((t) => !t.done && !t.archived && !t.review);
+  if (filter && filter.type) tasks = tasks.filter((t) => taskType(t.text) === filter.type);
+  if (filter && filter.repo) tasks = tasks.filter((t) => t.repo === filter.repo);
+  if (!tasks.length) return { empty: true, written: [], unresolved: [] };
+  const byName = repoPathMap(); // from the already-scanned map when there is one
+  const groups = {}; for (const t of tasks) { const k = t.repo || ""; (groups[k] = groups[k] || []).push(t); }
+  const written = [], unresolved = [];
+  for (const name of Object.keys(groups)) {
+    const list = groups[name], path = name && byName[name];
+    if (!path) { unresolved.push({ name: name || "(no repo)", count: list.length }); continue; }
+    try {
+      // Cheap, per-repo signals only — no full drift scan (that can be very slow
+      // on big repos and would block the request).
+      const st = repoState(path);
+      const commits = sh(`git -C ${JSON.stringify(path)} log --format='%s' -10 2>/dev/null`).split("\n").filter(Boolean);
+      const open = openWork([{ path, name }]).slice(0, 12);
+      const det = detectRepo({ path, name, recency: 0 });
+      const stack = [...det.langs.slice(0, 4), ...det.tools].join(", ");
+      const risk = [];
+      if (st.stale) risk.push("stale checkout — working tree is an old snapshot, not new work");
+      if (st.behind) risk.push(`${st.behind} behind upstream on ${st.branch}`);
+      if (st.dirty && !st.stale) risk.push(`${st.dirty} uncommitted (${st.mod} mod / ${st.del} del / ${st.add} new)`);
+      // held: an agent is still running there, so it lands when that one exits
+      const held = writeTasks(path, buildTasksMd(name, { branch: st.branch, commits, open, drift: risk, stack }, list));
+      written.push({ name, file: join(path, ".symbiot", "TASKS.md"), path, count: list.length, held });
+    } catch (e) { unresolved.push({ name, count: list.length, error: String((e && e.message) || e) }); }
+  }
+  return { empty: false, written, unresolved, handoff: handoffCmd() };
+}
+
+export { addTask, toggleTask, removeTask, restoreTask, completedInRepo, syncTasks, workingChanges, workingDiff, publishesOnMerge, unreleased, bumpOffer, learnNpm, releaseNeeded, withReleases, setVersion, shipWithBump, pendingReview, commitSubject, shipChanges, autoMergeRepos, setAutoMerge, approveRepo, approveChanges, sendBack, TASK_ORDER, taskType, buildTasksMd, pushTasks };

package/ui.mjs

@@ -112,6 +112,8 @@ footer{padding:10px 18px;border-top:1px solid var(--line);display:flex}
 .aq .qc{color:var(--faint);font-size:12.5px;margin-top:3px;line-height:1.5}
 .aq label.opt{display:flex;gap:8px;align-items:flex-start;margin:6px 0 0;font-size:13px;color:var(--text);cursor:pointer}
 .aq .opt input{width:auto;margin-top:3px;flex:none}
+.who{display:inline-block;font-size:11px;font-weight:700;border-radius:999px;padding:0 7px;margin-right:2px;white-space:nowrap}
+.who.you{color:var(--amber);border:1px solid var(--amber)}.who.agent{color:var(--green);border:1px solid var(--green)}
 .aq .qrel{font-size:12px;margin-top:4px;color:var(--green)}.aq .qrel.wait{color:var(--amber)}
 .aq label.opt.off{color:var(--faint);cursor:default}.aq .opt.off i{font-size:12px}
 .aq .qother{margin-top:7px;padding:7px 10px;font-size:13px}
@@ -268,6 +270,10 @@ label.check input{width:auto}
 <div class="note muted" id="desktopnote"></div>
 </div>
 <div style="margin-top:20px;border-top:1px solid var(--line);padding-top:16px">
+<label>Watch on your phone <span class="muted">(experimental)</span></label>
+<div id="phonelink"></div>
+</div>
+<div style="margin-top:20px;border-top:1px solid var(--line);padding-top:16px">
 <label>Local models <span class="muted">(experimental)</span></label>
 <button class="ghost" id="recbtn">Recommend models for my machine</button>
 <button class="ghost" id="setuplocal" style="margin-left:8px">Set up a free local model</button>
@@ -317,6 +323,9 @@ api('/api/connect',cfg).then(function(r){$('saveMsg').textContent=r.message||(r.
 $('quit').addEventListener('click',function(){api('/api/quit');document.body.innerHTML='<div style=\\'padding:40px;color:#7E9690;font-family:sans-serif\\'>Symbiot stopped. You can close this window.</div>';});
 var GRAPH=null,sel=null,view={k:1,x:0,y:0},GW=960,GH=620;
 function esc(s){return String(s).replace(/[&<>]/g,function(ch){return ch==='&'?'&amp;':ch==='<'?'&lt;':'&gt;';});}
+// An agent's option, with its who-acts markers as badges: 👤 You (you do this
+// step) and 🤖 Agent (picking it is enough; the next run does it). Escaped first.
+function whoHtml(o){return esc(o).replace(/👤[ ]*(You:|You(?=[ ]))?/g,"<span class='who you'>&#128100; You</span> ").replace(/🤖[ ]*(Agent:|Agent(?=[ ]))?/g,"<span class='who agent'>&#129302; Agent</span> ");}
 function layout(nodes,edges){var idx={};nodes.forEach(function(n){n.x=GW/2+(Math.random()-0.5)*GW*0.8;n.y=GH/2+(Math.random()-0.5)*GH*0.8;n.vx=0;n.vy=0;idx[n.id]=n;});
 for(var it=0;it<340;it++){for(var i=0;i<nodes.length;i++)for(var j=i+1;j<nodes.length;j++){var a=nodes[i],b=nodes[j];var dx=a.x-b.x,dy=a.y-b.y;var d2=dx*dx+dy*dy+0.01;var d=Math.sqrt(d2);var f=4600/d2;a.vx+=f*dx/d;a.vy+=f*dy/d;b.vx-=f*dx/d;b.vy-=f*dy/d;}
 edges.forEach(function(e){var a=idx[e.source],b=idx[e.target];if(!a||!b)return;var dx=b.x-a.x,dy=b.y-a.y;var d=Math.sqrt(dx*dx+dy*dy)+0.01;var f=(d-115)*0.03;a.vx+=f*dx/d;a.vy+=f*dy/d;b.vx-=f*dx/d;b.vy-=f*dy/d;});
@@ -485,10 +494,10 @@ function askHtml(a){var k=a.ask;if(!k)return '';var qs=k.questions||[],ss=k.sugg
 var h="<div class='aq' data-id='"+esc(a.id)+"'>";
 if(qs.length){h+="<h4>&#10067; "+qs.length+" question"+(qs.length>1?"s":"")+" for you</h4>";
 qs.forEach(function(q,i){var rl=q.release;h+="<div class='q' data-i='"+i+"'><div class='qt'>"+esc(q.q)+"</div>"+(q.context?"<div class='qc'>"+esc(q.context)+"</div>":"")+(rl?relHtml(rl):"");
-(q.options||[]).forEach(function(o,j){var off=rl&&rl.waiting&&DONEOPT.test(o);h+="<label class='opt"+(off?" off":"")+"'><input type='radio' name='q_"+esc(a.id)+"_"+i+"' value='"+j+"'"+(off?" disabled":"")+"><span>"+esc(o)+(off?" <i>(once "+esc(rl.name+" "+rl.needs)+" is installed)</i>":"")+"</span></label>";});
+(q.options||[]).forEach(function(o,j){var off=rl&&rl.waiting&&DONEOPT.test(o);h+="<label class='opt"+(off?" off":"")+"'><input type='radio' name='q_"+esc(a.id)+"_"+i+"' value='"+j+"'"+(off?" disabled":"")+"><span>"+whoHtml(o)+(off?" <i>(once "+esc(rl.name+" "+rl.needs)+" is installed)</i>":"")+"</span></label>";});
 h+="<input class='qother' placeholder='"+((q.options&&q.options.length)?"or answer in your own words":"your answer")+"'></div>";});
 h+="<div class='row'><button class='act qsend' title='save the answers and hand the repo back to your agent'>Send answers &amp; continue</button><button class='ghost qsave' title='save the answers for the next run'>Save only</button></div>";}
-if(ss.length){h+="<h4>&#128161; Ideas from the agent</h4>";ss.forEach(function(s,i){h+="<div class='idea'><span style='flex:1'>"+esc(s.text)+"</span>"+(s.added?"<span class='tag'>in Tasks</span>":"<button class='ghost qidea' data-i='"+i+"' style='padding:3px 9px;font-size:12px'>+ task</button>")+"</div>";});}
+if(ss.length){h+="<h4>&#128161; Ideas from the agent</h4>";ss.forEach(function(s,i){h+="<div class='idea'><span style='flex:1'>"+esc(s.text)+(s.other?" <span class='tag' title='this idea is for another project, so + task adds it to that one'>for "+esc(s.repo)+"</span>":"")+"</span>"+(s.added?"<span class='tag'>in Tasks</span>":"<button class='ghost qidea' data-i='"+i+"' style='padding:3px 9px;font-size:12px'>+ task</button>")+"</div>";});}
 return h+"</div>";}
 function qKeyOf(qe){var box=qe.closest('.aq');var a=box&&agentById(box.getAttribute('data-id'));var q=a&&a.ask.questions[+qe.getAttribute('data-i')];return q?a.path+'|'+q.q:'';}
 function saveDrafts(el){el.querySelectorAll('.aq .q').forEach(function(qe){var k=qKeyOf(qe);if(!k)return;var pick=qe.querySelector('input[type=radio]:checked');QDRAFT[k]={o:pick?pick.value:'',t:qe.querySelector('.qother').value};});}
@@ -505,7 +514,7 @@ msg.innerHTML="<div class='note ok'>&#10003; Saved "+r.saved+" answer"+(r.saved>
 var s1=box.querySelector('.qsend'),s2=box.querySelector('.qsave');
 if(s1)s1.addEventListener('click',function(){send(true);});if(s2)s2.addEventListener('click',function(){send(false);});
 box.querySelectorAll('.qidea').forEach(function(btn){btn.addEventListener('click',function(){var s=a.ask.suggestions[+btn.getAttribute('data-i')];if(!s)return;btn.disabled=true;
-api('/api/tasks/add',{text:s.text,repo:a.name}).then(function(){s.added=true;btn.outerHTML="<span class='tag'>in Tasks</span>";});});});});}
+api('/api/tasks/add',{text:s.text,repo:s.repo||a.name}).then(function(){s.added=true;btn.outerHTML="<span class='tag'>in Tasks</span>";});});});});}
 function answering(){var f=document.activeElement;return !!(f&&f.closest&&f.closest('.aq'));}
 function loadAgents(){api('/api/agents').then(function(list){var el=document.getElementById('agentslist');
 if(!list||!list.length){AGENTLIST=[];el.innerHTML="<div class='muted' style='margin-top:12px'>No agents yet. In <b>Tasks</b>, tick ideas and hit <b>Send to repos</b> (with an agent command set in Settings) &mdash; you'll watch it work here.</div>";stopAgentsPoll();return;}
@@ -588,6 +597,30 @@ function phoneTermux(){var A=window.SymbiotAndroid,t={};if(A&&A.termux){try{t=JS
 function loadPhone(){var t=phoneTermux();if(!t.installed&&!t.on)return;$('phonebox').classList.remove('hidden');
 $('phonenote').innerHTML=t.on?"This window shows the Symbiot running in Termux, so it sees the projects in Termux's home folder and runs your agents there. The app's own Symbiot sees only shared storage.":"Termux keeps its home folder (<code>~</code>) private, so the app's own Symbiot can't see the projects there. Symbiot running in Termux can, and this app can show it. <b>Open Termux</b> copies the command that starts it (it installs Node and Symbiot there first if they're missing). Paste it in Termux, and Termux opens it here.";
 var b=$('phonebtn');b.textContent=t.on?"Use the app's own Symbiot":"Open Termux";b.onclick=function(){if(t.on)SymbiotAndroid.builtIn();else SymbiotAndroid.openTermux();};}
+// Watch on your phone (phone.mjs): the computer lets a paired phone ask what
+// Watch found; the phone pairs once with its address and code, then asks every 2 minutes.
+function loadPhoneLink(msg){api('/api/phone').then(function(d){renderPhoneLink(d,msg);});}
+function renderPhoneLink(d,msg){if(!d||!d.role)return;var box=$('phonelink'),h='';
+if(d.role==='phone'){
+if(d.paired){h+="<div class='task'><span class='t'>Paired with <b>"+esc(d.name)+"</b> <span class='muted' style='font-size:12px'>"+esc(d.url)+(d.last?" &middot; asked "+agoTxt(d.last):"")+"</span>"+(d.error?"<br><span class='err' style='font-size:12px'>"+esc(d.error)+"</span>":"")+"</span><button class='ghost' id='pcheck' title='ask your computer now'>Check now</button><button class='rm' id='pforget' title='stop getting its notifications'>&times;</button></div>";
+h+="<div class='note muted'>While Symbiot runs on this phone, it asks your computer every 2 minutes and shows what Watch found there as a notification, with its brief if you switched that on there.</div>";}
+else h+="<div class='row'><input id='paddr' placeholder='your computer&rsquo;s address, e.g. 192.168.8.50:7392' style='flex:1'><input id='pcode' placeholder='code' inputmode='numeric' style='flex:0 0 90px'><button class='act' id='ppair'>Pair</button></div><div class='note muted'>Get what Watch finds on your computer (new mail, review requests, failed CI runs) as notifications here. On your computer, in Symbiot&rsquo;s Settings, tick <b>Watch on your phone</b>: it shows its address and a 6-digit code. Type both here. The phone has to be on the same Wi-Fi.</div>";
+if(!d.notify)h+="<div class='note err'>Notifications from Termux need the Termux:API app: install it, then run <b>pkg install termux-api</b> in Termux.</div>";}
+else{h+="<label class='check'><input type='checkbox' id='plinkon'"+(d.on?" checked":"")+"> Let the Symbiot app on my phone get Watch&rsquo;s notifications, over this network</label>";
+if(d.on&&d.error)h+="<div class='note err'>"+esc(d.error)+"</div>";
+else if(d.on&&d.listening){var ad=(d.addresses||[]).map(function(a){return a+":"+d.port;});
+h+=d.code?"<div class='note ok'>On your phone, open Symbiot &rarr; Settings &rarr; <b>Watch on your phone</b>, and type the address <b>"+esc(ad[0]||"(this computer&rsquo;s address)")+"</b>"+(ad.length>1?" <span class='muted'>(or "+esc(ad.slice(1).join(", "))+")</span>":"")+" and the code <b style='letter-spacing:2px'>"+esc(d.code)+"</b>. <span class='muted'>The code works for 10 minutes.</span></div>"
+:"<div class='row' style='margin-top:4px'><button class='ghost' id='pnewcode'>Pair a phone</button></div>";
+h+=(d.phones||[]).map(function(p){return "<div class='task' data-id='"+esc(p.id)+"'><span class='t'>"+esc(p.name)+" <span class='muted' style='font-size:12px'>paired "+agoTxt(p.added)+(p.seen?" &middot; asked "+agoTxt(p.seen):"")+"</span></span><button class='rm punpair' title='unpair it: it gets nothing more'>&times;</button></div>";}).join('');}
+h+="<div class='note muted'>"+(d.on?"Symbiot listens on port "+d.port+" of your network for this alone: the pairing code, then what&rsquo;s new for a phone that paired. Nothing can be changed from there, and the rest of Symbiot stays on this computer. What&rsquo;s new (your mail&rsquo;s senders and subjects) crosses your Wi-Fi unencrypted, so use it on a network you trust. Pairing fails? A firewall here may need to allow port "+d.port+".":"New mail, review requests and failed CI runs that Watch finds here, as notifications on your phone, through the Symbiot app there. It asks this computer every 2 minutes while both are running, on the same Wi-Fi.")+"</div>";}
+if(msg)h+="<div class='note "+(msg.ok?"ok":"err")+"'>"+esc(msg.text)+"</div>";
+box.innerHTML=h;
+var on=$('plinkon');if(on)on.addEventListener('change',function(){on.disabled=true;api('/api/phone/link',{on:on.checked}).then(function(x){renderPhoneLink(x);});});
+var nc=$('pnewcode');if(nc)nc.addEventListener('click',function(){api('/api/phone/code',{}).then(function(x){renderPhoneLink(x);});});
+box.querySelectorAll('.punpair').forEach(function(b){b.addEventListener('click',function(){if(typeof confirm==='function'&&!confirm('Unpair this phone? It gets no more notifications from here.'))return;api('/api/phone/unpair',{id:b.closest('.task').getAttribute('data-id')}).then(function(x){renderPhoneLink(x);});});});
+var pp=$('ppair');if(pp)pp.addEventListener('click',function(){var a=$('paddr').value,cd=$('pcode').value;pp.disabled=true;pp.textContent='Pairing...';api('/api/phone/pair',{address:a,code:cd}).then(function(x){renderPhoneLink(x,x&&x.error?{text:x.error}:{ok:true,text:'Paired. What Watch finds on '+x.name+' shows up here as a notification.'});if(x&&x.error&&$('paddr')){$('paddr').value=a;$('pcode').value=cd;}});});
+var pc=$('pcheck');if(pc)pc.addEventListener('click',function(){pc.disabled=true;api('/api/phone/check',{}).then(function(x){renderPhoneLink(x,x&&!x.error?{ok:true,text:x.shown?'Showed '+x.shown+' notification(s).':'Asked: nothing new.'}:null);});});
+var pf=$('pforget');if(pf)pf.addEventListener('click',function(){if(typeof confirm==='function'&&!confirm('Forget your computer? Its notifications stop.'))return;api('/api/phone/forget',{}).then(function(x){renderPhoneLink(x);});});}
 // Trusted sites: where Screens' Press and Type don't ask first (headless.mjs).
 function loadTrusted(){api('/api/screens/trusted').then(function(d){var box=document.getElementById('trustedsites');var sites=(d&&d.sites)||[];
 box.innerHTML=sites.length?sites.map(function(h){return "<div class='task' data-h='"+esc(h)+"'><span class='t' style='font-family:ui-monospace,monospace;font-size:12px'>"+esc(h)+"</span><button class='rm rmtrusted' title='stop trusting it: press and type ask first again'>&times;</button></div>";}).join(""):"<div class='muted' style='font-size:12px'>None yet: Press and Type ask first on every site.</div>";
@@ -707,12 +740,21 @@ if(w){if(typeof confirm==='function'&&!confirm('Stop watching '+w.name+'? What i
 b.disabled=true;api('/api/watch/add',{screen:s.id,every:15}).then(function(x){b.disabled=false;if(!x||x.error){screenErr((x&&x.error)||'failed');return;}
 $('screenmsg').innerHTML="<div class='note ok'>&#10003; Watching "+esc(x.name)+". Symbiot reads it every "+x.every+" minutes while it runs (first within a minute, to learn what's there) and notifies you of anything new. It's listed under Watching, just below.</div>";
 api('/api/watch').then(function(d){if(d&&d.watches)WATCH=d;renderWatch();renderScreen();});});}
-function renderWatch(){var box=$('watchbox'),ws=WATCH.watches||[],ns=WATCH.news||[];if(!ws.length){box.innerHTML='';return;}
-var h="<div class='tgroup'>Watching <span class='tcount'>read again while Symbiot runs &middot; only reads, never presses</span></div>";
-h+=ws.map(function(w,i){return "<div class='task' data-i='"+i+"'><span class='t'><b>"+esc(w.name)+"</b> <span class='muted' style='font-size:12px'>"+(w.checked?"read "+agoTxt(w.checked):w.last?"tried "+agoTxt(w.last):"first read within a minute")+"</span>"+(w.error?"<br><span class='err' style='font-size:12px'>"+esc(w.error)+"</span>":"")+"</span><select class='wevery' title='how often to read it' style='flex:0 0 auto;width:auto'>"+(WATCH.every||[]).map(function(m){return "<option value='"+m+"'"+(m===w.every?" selected":"")+">every "+m+" min</option>";}).join('')+"</select><button class='ghost wcheck' title='read it now'>Check now</button><button class='rm wrm' title='stop watching it'>&times;</button></div>";}).join('');
+function renderWatch(){var box=$('watchbox'),ws=WATCH.watches||[],ns=WATCH.news||[],bs=WATCH.briefs||[],h='';
+var gh=ws.some(function(w){return String(w.url).indexOf('://github.com/notifications')>=0;});
+if(ws.length){h+="<div class='tgroup'>Watching <span class='tcount'>read again while Symbiot runs &middot; only reads, never presses</span></div>";
+h+=ws.map(function(w,i){return "<div class='task' data-i='"+i+"'><span class='t'><b>"+esc(w.name)+"</b> <span class='muted' style='font-size:12px'>"+(w.checked?"read "+agoTxt(w.checked):w.last?"tried "+agoTxt(w.last):"first read within a minute")+(w.via==='gh'?" &middot; through gh":"")+"</span>"+(w.error?"<br><span class='err' style='font-size:12px'>"+esc(w.error)+"</span>":"")+"</span><select class='wevery' title='how often to read it' style='flex:0 0 auto;width:auto'>"+(WATCH.every||[]).map(function(m){return "<option value='"+m+"'"+(m===w.every?" selected":"")+">every "+m+" min</option>";}).join('')+"</select><button class='ghost wcheck' title='read it now'>Check now</button><button class='rm wrm' title='stop watching it'>&times;</button></div>";}).join('');}
+// GitHub's notifications need no map: gh reads them (watch.mjs readGitHub)
+if(!gh)h+="<div class='row' style='margin-top:8px'><span class='muted' style='font-size:12px;flex:1'>Watch GitHub too: new review requests, failed CI runs and mentions reach you the same way. With the GitHub CLI signed in (<b>gh auth login</b>), Symbiot reads them through it; without, it reads github.com/notifications in its browser (click Sign in above with github.com first).</span><button class='ghost' id='wgithub'>Watch GitHub</button></div>";
+if(ws.length){h+="<label class='check' style='margin-top:8px'><input type='checkbox' id='wbrief'"+(WATCH.brief?" checked":"")+"> <span>Brief me: the AI connected in Settings says what needs me and what can wait, here and in the notification. <span class='muted'>It's sent what's new: for mail, the sender, subject and preview. With a local Ollama model nothing leaves this computer.</span></span></label>";
+var b0=bs[0]&&ns.some(function(n){return n.ts===bs[0].ts&&n.watch===bs[0].watch;})?bs[0]:null;
+if(b0)h+="<div class='note' style='white-space:pre-line;margin-top:6px'><b>Brief</b> <span class='muted' style='font-size:12px'>"+esc(b0.name)+" &middot; "+b0.count+" new &middot; "+agoTxt(b0.ts)+"</span><br>"+esc(b0.text)+"</div>";
 h+=ns.length?"<div class='row' style='margin-top:8px'><span class='fl' style='margin-left:0;flex:1'>New &middot; "+ns.length+"</span><button class='ghost' id='wclear' title='clear this list (Symbiot still remembers what it has seen)'>Clear</button></div>"+ns.slice(0,20).map(function(n,i){return "<div class='task' data-i='"+i+"'><span class='t'>"+esc(n.text)+" <span class='muted' style='font-size:12px'>"+esc(n.name)+" &middot; "+agoTxt(n.ts)+"</span></span>"+(n.href?"<button class='ghost wopen' title='open it in your browser'>Open</button>":"")+"</div>";}).join('')
-:"<div class='muted' style='font-size:12px;margin-top:6px'>Nothing new yet. New rows show up here, and as a notification. Your agent reads them with <b>symbiot watch new</b>.</div>";
+:"<div class='muted' style='font-size:12px;margin-top:6px'>Nothing new yet. New rows show up here, and as a notification. Standup counts what's waiting on you, and your agent reads them with <b>symbiot watch new</b>.</div>";}
 box.innerHTML=h;
+var wg=$('wgithub');if(wg)wg.addEventListener('click',function(){wg.disabled=true;api('/api/watch/add',{site:'github',every:5}).then(function(x){wg.disabled=false;if(!x||x.error){screenErr((x&&x.error)||'failed');return;}
+$('screenmsg').innerHTML="<div class='note ok'>&#10003; Watching "+esc(x.name)+" every "+x.every+" minutes while Symbiot runs. The first read, within a minute, learns what's unread there now; after that, a new review request or failed CI run notifies you.</div>";loadWatchUI();});});
+var wbr=$('wbrief');if(wbr)wbr.addEventListener('change',function(){api('/api/watch/brief',{on:wbr.checked}).then(loadWatchUI);});
 box.querySelectorAll('.wevery').forEach(function(sel){sel.addEventListener('change',function(){var w=ws[+sel.closest('.task').getAttribute('data-i')];api('/api/watch/every',{id:w.id,every:+sel.value}).then(loadWatchUI);});});
 box.querySelectorAll('.wrm').forEach(function(b){b.addEventListener('click',function(){var w=ws[+b.closest('.task').getAttribute('data-i')];if(typeof confirm==='function'&&!confirm('Stop watching '+w.name+'? What it found goes too.'))return;api('/api/watch/remove',{id:w.id}).then(function(){api('/api/watch').then(function(d){if(d&&d.watches)WATCH=d;renderWatch();renderScreen();});});});});
 box.querySelectorAll('.wcheck').forEach(function(b){b.addEventListener('click',function(){var w=ws[+b.closest('.task').getAttribute('data-i')];b.disabled=true;b.textContent='Reading…';
@@ -861,5 +903,5 @@ function appBar(p){var b=$('appbar');if(!b||!p.termux||window.SymbiotAndroid||ty
 function doUpdate(){updBusy=true;try{localStorage.setItem('symbiot_update_tried',document.getElementById('ver').textContent.replace(/^v/,''));}catch(e){}var b=ubar();b.className='updatebar show';b.textContent='Updating & restarting… this page will reload itself when it is back.';api('/api/update',{});}
 setInterval(heartbeat,4000);heartbeat(true);
 window.addEventListener('focus',function(){heartbeat(true);}); // re-check for updates when you come back to the window
-initGraphEvents();syncP();refresh();loadMap();loadAgentCfg();loadScanRoots();loadPhone();loadTrusted();loadMail();loadScreensUI();loadMonitorsUI();loadDesktop();loadWatchUI();setInterval(loadWatchUI,60000);
+initGraphEvents();syncP();refresh();loadMap();loadAgentCfg();loadScanRoots();loadPhone();loadTrusted();loadMail();loadScreensUI();loadMonitorsUI();loadDesktop();loadWatchUI();setInterval(loadWatchUI,60000);loadPhoneLink();
 </script></body></html>`;