symbiot 0.40.5 → 0.41.0

package/README.md

@@ -20,8 +20,9 @@ symbiot logout     forget saved credentials
 symbiot help
 ```
 
-A few newer extras (email, CI checks, local-model setup) are
-[experimental](#experimental).
+The newer extras are [experimental](#experimental): email, CI checks,
+local-model setup, Screens and Watch, and Symbiot on a phone. The list there says
+what's stable and what isn't.
 
 ## Install
 
@@ -114,7 +115,8 @@ repo is now archived), without Electron:
 
 ### On your phone (Android, in Termux)
 
-Experimental, and not yet tried on a real phone. Symbiot is a Node CLI, so it runs
+Experimental, and tried on one phone so far (a Galaxy A26, Android 16), where it
+found the projects in Termux's home and in a Debian `proot-distro`. Symbiot is a Node CLI, so it runs
 in [Termux](https://termux.dev) (install it from F-Droid; the Play Store build is
 out of date) next to the coding agent you use there. It works on the repos on your
 phone, the same way it works on your computer's:
@@ -228,24 +230,36 @@ your review** at the top of the Tasks tab, grouped by repo, with the branch, the
 size of the uncommitted change and a **Show diff** button. For each repo:
 
 - **Approve → PR** syncs the work. If you're on the default branch it creates
-  `symbiot/<task>`, commits everything except `.symbiot/` with the approved tasks as
-  the message, pushes, and opens a PR with the GitHub CLI (`gh`). If you're already
-  on a feature branch it commits and opens the PR from there. Each step that can't
+  `symbiot/<task>`, commits everything except `.symbiot/`, pushes, and opens a PR
+  with the GitHub CLI (`gh`). The commit's subject (and the PR's title) is the
+  first approved task, with how many more there are ("Watch GitHub too (+2
+  more)"), and its message lists them all, so `git log` reads as a history. If
+  you're already on a feature branch it commits and opens the PR from there,
+  unless that branch's earlier PR was already squash-merged: then it starts a
+  fresh `symbiot/` branch from the default one, so the new PR can merge. Each step that can't
   happen stops there and says why: no `origin` remote means a local commit only, and
   without `gh` it pushes and stops. Your commit is never lost. Then the tasks are
   archived with their commit and PR link. With no changes to commit the button
   reads **Approve → archive** and just archives them.
 - **↩ (send back)** is for one that isn't right: it reopens the task and unticks it in
   `TASKS.md`, so the next **Send to repos** hands it to the agent again.
+- **Auto-merge when CI passes** (a switch on the card, per repo, off by default)
+  queues GitHub's own auto-merge on the PR Approve opens, so it merges once its
+  required checks pass. It needs "Allow auto-merge" in the repo's GitHub
+  settings; without it, the card says so.
 
-Tasks waiting for review aren't re-sent to the agent.
+Tasks waiting for review aren't re-sent to the agent, and while the repo's agent
+is still running, Approve waits ("agent still working"), so half-done work isn't
+committed.
 
-**Releases.** For a repo that releases with `v*` tags, the review card warns when
-the default branch is past its last tag (merged work that isn't released). If
-`package.json`'s version is already released and the changes don't touch it, a
-**Version** picker next to Approve bumps it in the same PR: a patch by default, or a
-minor, or keep it. It updates `package.json` and the lockfile's own version, and the
-PR says which tag to push once it merges.
+**Releases.** The review card warns about merged work that isn't released yet,
+measured the way the repo releases: from its last `v*` tag, or, for a repo whose
+GitHub workflow runs `npm publish` on every push to its default branch, from the
+version npm has. If `package.json`'s version is already released and the changes
+don't touch it, a **Version** picker next to Approve bumps it in the same PR: a
+patch by default, or a minor, or keep it. It updates `package.json` and the
+lockfile's own version, and the PR says what happens next: it publishes when it
+merges, or which tag to push once it does.
 
 If a repo you sent tasks to has uncommitted changes but no ticked task (say the
 agent made a fix and didn't tick anything), it still shows up here, with
@@ -317,18 +331,25 @@ Codex, Aider, Gemini, Cursor, whatever you run) a way to ask anyway. It writes
 ## Questions
 ### Keep the old config format working?
 Reading both costs about 40 lines.
-- Yes, read both (recommended)
-- No, migrate once and drop it
+- 🤖 Agent: read both (recommended)
+- 👤 You: migrate your config once, then the agent drops the old format
 
 ## Suggestions
 - Add a --json flag to drift
+- [repo: symbiot] Show the drift report in Standup
 ```
 
 Up to five questions show on that agent's block in the **Agents** tab, each with
-its options and room for your own answer, alongside its ideas. **Send answers &
+its options and room for your own answer, alongside its ideas. Each option says
+who acts: **You** (a setting, a click, a command) or **Agent** (picking it is
+enough). A question that needs a release ("Once 0.41.0 is installed: …") shows
+the version installed here and the one on npm, and holds back a "Done" answer
+until that release is out and installed. **Send answers &
 continue** appends your answers to `.symbiot/ANSWERS.md` and runs your agent
 command again so the agent carries on with them. **Save only** keeps them for the
-next run. **+ task** adds an idea to your Tasks for that repo. The agent is told to
+next run. **+ task** adds an idea to your Tasks for that repo, or, for an idea
+that starts with `[repo: <name>]`, to that repo's Tasks: an agent working on one
+project can have ideas for another (Symbiot itself, say). The agent is told to
 keep going with everything that doesn't depend on an answer, and to ask instead of
 doing anything destructive. Both files live in `.symbiot/`, so they're never
 committed.
@@ -431,19 +452,50 @@ instead of hanging. The CLI shows scan progress on one line as it goes.
 - **Sends to the AI:** commit messages and dates, changed-file **names**, the
   folder structure, `TODO`/`FIXME` lines, and (for a repo review) an excerpt of
   the README and any `CLAUDE.md`/`AGENTS.md` conventions. With email on, it also
-  sends the subjects and recipient names of mail you sent. It does **not** send
-  whole source files or any email body. With a **local Ollama model, nothing leaves your machine.**
+  sends the subjects and recipient names of mail you sent. When you ask about a
+  task (💬) the agent has finished, it sends the first 6 KB of the agent's diff,
+  which can include a new file's contents. Standup sends up to 10 of what's new
+  on each page you [Watch](#screens-blueprints-for-screen-automation) since
+  yesterday, and the brief (if you switch it on) sends each batch of it: for
+  Gmail, that's the sender, subject and one-line preview. Otherwise it does
+  **not** send source files, and it never sends a whole email body. With a **local Ollama model, nothing leaves your machine.**
 - **Shows its work:** every report ends with a footer — path, branch, how many
   commits matched you (e.g. "1090 of 1101"), the README's age, and the
   working-tree state — so you can see exactly what it read.
-- **Never:** no keylogging, no screen capture, no browsing history, no accounts.
+- **Never:** no keylogging, no browsing history, no accounts. The
+  [experimental](#screens-blueprints-for-screen-automation) Screens takes a
+  screenshot only when you click Capture, and opens only the web pages you map
+  or Watch (in a browser profile of its own). What it maps and what Watch finds
+  stay on your computer, unless you pair your phone (Watch on your phone) or
+  switch on the brief, which sends what's new to your AI.
 - **Runs only what you set:** the agent command is yours, and deploy commands are
   read only from your own `~/.config/symbiot/`, never from a repo.
 
 ## Experimental
 
-These work and are tested, but are newer or depend on things Symbiot can't fully
-check, so they may change. Everything above works without them.
+**Stable:** `week`, `standup`, `todo`; the app's Map, Drift, Tasks, Agents and
+Settings; folders to scan (including project folders without git); `push` and
+the agent handoff; agent questions; review, Approve, the version bump and
+auto-merge; `drift` from local git facts; the weekly write-up and start at
+login. The test suite covers each of them.
+
+**Experimental:** the rest, below, and Symbiot on a phone ([Termux](#on-your-phone-android-in-termux)
+and the [Android app](#the-android-app-apk)). These work and are tested, but are
+newer, have only been tried on one or two setups, or depend on things Symbiot
+can't fully check, so they may change. Everything above works without them.
+
+- **Email** (`symbiot mail`): tested on mbox and Maildir, not yet on real Apple
+  Mail, Evolution or KMail stores.
+- **CI status** (`drift --ci`): GitHub Actions only, and "not running" is a guess.
+- **Local models** (`models`, `setup-local`).
+- **Screens**: Capture depends on your desktop allowing screenshots; Click here
+  hasn't been confirmed on Wayland (ydotool) or on Windows yet; Map page, Press,
+  Type and Trusted sites work on web pages only.
+- **Watch**: reads your Gmail inbox, but hasn't yet been seen to notify a new
+  email on a real one. GitHub through `gh` has been read from a real account,
+  but not yet left running. The brief, Standup's "Waiting on you" line and
+  **Watch on your phone** are new; the phone side hasn't been tried on a real
+  phone yet.
 
 ### Your sent email, without an API: `symbiot mail`
 
@@ -471,6 +523,9 @@ real Apple Mail, Evolution or KMail stores. On macOS, reading Apple Mail needs F
 Disk Access for your terminal. Outlook for Windows (`.pst`) isn't supported:
 export to `.mbox` or use Thunderbird.
 
+This is mail you **sent**, for write-ups. To be told about **new mail in your
+inbox**, map it in Screens and [Watch](#screens-blueprints-for-screen-automation) it.
+
 ### CI status: `symbiot drift --ci`
 
 ```bash
@@ -575,12 +630,53 @@ Your coding agent reads it too, so it can act on it with `symbiot screens`:
 
 ```bash
 symbiot watch add <screen id> --every 15   # watch a mapped page (or: symbiot watch add gmail)
+symbiot watch add github                   # your GitHub notifications (see below)
 symbiot watch new --hours 24               # what's new, newest first (JSON)
 symbiot watch check                        # read them all now (JSON)
+symbiot watch brief on                     # your AI says what needs you (off to stop)
 symbiot watch                              # what you watch, and what's new
 symbiot watch remove <id>
 ```
 
+**GitHub too.** **Watch GitHub** (under Watching) or `symbiot watch add github`
+watches your GitHub notifications: review requests, failed CI runs, mentions,
+assignments. With the GitHub CLI signed in (`gh auth login`), Symbiot reads them
+through it (GitHub's API, your unread notifications), so nothing needs mapping or
+signing in. Without `gh`, it reads `github.com/notifications` in the hidden browser
+like any page (click **Sign in** with `github.com` once). Each notification is new
+when its thread changes, so a CI run that fails again on the same branch, or a new
+comment on a pull request, notifies you again. Failed CI runs reach you only if
+GitHub notifies you about them (GitHub → Settings → Notifications → Actions).
+
+**The brief.** Tick **Brief me** under Watching (or `symbiot watch brief on`) and
+the AI you connected reads each batch of what's new and says, in a line or three,
+what needs you and what can wait. The brief shows above what's new, and it's the
+text of the notification. The AI is sent what the page lists for each new item
+(for Gmail, the sender, subject and the one-line preview), and nothing at all
+leaves your computer with a local Ollama model. It's off until you tick it.
+
+**In Standup.** Standup ends with what's waiting on you since yesterday, counted
+from what Watch found: `Waiting on you: 3 emails, 2 GitHub notifications`. Symbiot
+counts them itself, so the numbers are right; the AI only sees them to know
+what's next.
+
+**On your phone.** What Watch finds on your computer can show up as a
+notification on your phone, through Symbiot there (the [Android app](#the-android-app-apk),
+or Symbiot in [Termux](#on-your-phone-android-in-termux)). On the computer, tick
+**Watch on your phone** in Settings: it shows the computer's address and a 6-digit
+code, good for 10 minutes. On the phone, in Settings → **Watch on your phone**,
+type both and click **Pair**. From then on, while Symbiot runs on both, the phone
+asks the computer every 2 minutes and notifies what's new there, with its brief.
+They have to be on the same network (or both on a VPN such as Tailscale, whose
+address is listed too). For this, the computer listens on port 7392 of your
+network, and serves only two things there: pairing with that code (5 wrong tries
+and the code is gone), and what's new for a phone that paired (with a token of its
+own; unpair it in Settings). Nothing can be changed from there, and the rest of
+Symbiot stays on `127.0.0.1`. What's new crosses your network unencrypted, so
+switch it on at home, not on a café's Wi-Fi. A firewall on the computer may need
+to allow the port. In Termux, notifications need the Termux:API app and
+`pkg install termux-api`.
+
 **More than one display?** Symbiot reads how your displays are laid out
 (`cosmic-randr`, `wlr-randr`, `kscreen-doctor` or `xrandr` on Linux, PowerShell on
 Windows, AppKit on macOS) and a picker appears next to Capture: **each display**

package/agents.mjs

@@ -305,8 +305,17 @@ function parseQuestions(md) {
   }
   return { questions: questions.filter((x) => x.q).slice(0, 20).map((x) => ({ ...x, options: x.options.slice(0, 6) })), suggestions: suggestions.filter(Boolean).slice(0, 10) };
 }
-// The OPEN questions (not yet in ANSWERS.md) and the agent's ideas, each marked
-// if it's already on the task list for this repo.
+// An idea for another project names it first: "[repo: symbiot] Watch GitHub
+// too" is for the symbiot repo's tasks, whichever repo's agent had it (an agent
+// working on coral may have ideas for Symbiot, the app that sent it). Gives
+// { repo, text }, repo "" when the idea doesn't name one.
+function suggestionTarget(s) {
+  const m = String(s || "").match(/^\[repo:\s*([^\]]*?)\s*\]\s*(.+)$/i);
+  return m && m[1] ? { repo: m[1], text: m[2].trim() } : { repo: "", text: String(s || "") };
+}
+// The OPEN questions (not yet in ANSWERS.md) and the agent's ideas, each with
+// the repo whose tasks it goes to (this one unless it names another) and marked
+// if it's already on that repo's task list.
 function agentQuestions(path, repo) {
   const p = parseQuestions(readSymbiot(path, "QUESTIONS.md"));
   const done = new Set([...readSymbiot(path, "ANSWERS.md").matchAll(/^###\s+(.+)$/gm)].map((m) => qKey(m[1])));
@@ -314,7 +323,7 @@ function agentQuestions(path, repo) {
   const tasks = p.suggestions.length ? loadTasks() : [];
   return {
     questions: open.slice(0, QUESTIONS_MAX), answered: p.questions.length - open.length,
-    suggestions: p.suggestions.map((text) => ({ text, added: tasks.some((t) => t.repo === repo && qKey(t.text) === qKey(text)) })),
+    suggestions: p.suggestions.map(suggestionTarget).map(({ repo: to, text }) => ({ text, repo: to || repo, other: !!to && to !== repo, added: tasks.some((t) => t.repo === (to || repo) && qKey(t.text) === qKey(text)) })),
   };
 }
 // Save answers to .symbiot/ANSWERS.md; opts.rerun hands the repo back to the
@@ -353,4 +362,4 @@ function agentsList() {
   });
 }
 
-export { HANDOFFS, HANDOFF_PROMPT, QUESTIONS_MAX, shSingle, CLAUDE_CMD, ORCA_CLAUDE_CMD, handoffCmd, setHandoffCmd, grantAgent, grantRule, fillHandoff, runHandoff, runningHandoff, writeTasks, releaseHeldTasks, startHeldTasks, detectHandoffs, orcaHandoffCmd, migrateOrcaCmd, migrateClaudeCmd, track, agentChanges, parseQuestions, agentQuestions, answerQuestions, agentsList };
+export { HANDOFFS, HANDOFF_PROMPT, QUESTIONS_MAX, shSingle, CLAUDE_CMD, ORCA_CLAUDE_CMD, handoffCmd, setHandoffCmd, grantAgent, grantRule, fillHandoff, runHandoff, runningHandoff, writeTasks, releaseHeldTasks, startHeldTasks, detectHandoffs, orcaHandoffCmd, migrateOrcaCmd, migrateClaudeCmd, track, agentChanges, parseQuestions, suggestionTarget, agentQuestions, answerQuestions, agentsList };

package/ai.mjs

@@ -0,0 +1,213 @@
+// The AI Symbiot writes with: the providers, which one is set up, one call per
+// provider (same in, same out), and the local-model (Ollama) setup.
+import Anthropic from "@anthropic-ai/sdk";
+import { spawn } from "node:child_process";
+import { homedir, totalmem, cpus as oscpus } from "node:os";
+import { join } from "node:path";
+import { existsSync } from "node:fs";
+import { loadConfig, saveConfig, sh } from "./core.mjs";
+
+const MAX_TOKENS = 1600;
+
+// The providers Symbiot can write with. Models are sensible defaults; override
+// per provider at login, or globally with SYMBIOT_MODEL.
+const PROVIDERS = {
+  anthropic: { label: "Claude (Anthropic)", env: ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"], keyUrl: "https://console.anthropic.com/settings/keys", keyName: "Anthropic API key (sk-ant-…)", model: "claude-opus-5-5" },
+  openai:    { label: "OpenAI (GPT)",       env: ["OPENAI_API_KEY"],                            keyUrl: "https://platform.openai.com/api-keys",       keyName: "OpenAI API key (sk-…)",     model: "gpt-4o-mini" },
+  gemini:    { label: "Gemini (Google)",    env: ["GEMINI_API_KEY", "GOOGLE_API_KEY"],          keyUrl: "https://aistudio.google.com/apikey",         keyName: "Google AI API key",         model: "gemini-1.5-flash" },
+  ollama:    { label: "Local model (Ollama)", local: true,                                       keyUrl: "https://ollama.com",                         keyName: null,                        model: "llama3.1" },
+};
+
+// ---- config + provider resolution (config files: core.mjs) -----------------
+function antProfileExists() {
+  try { return existsSync(join(homedir(), ".config", "anthropic")); } catch { return false; }
+}
+
+function envKey(provider) {
+  for (const e of (PROVIDERS[provider].env || [])) if (process.env[e]) return process.env[e];
+  return null;
+}
+// Returns { provider, key?, baseUrl?, model, source } or null if nothing set up.
+// Order: saved choice → legacy saved key → env keys → an `ant` profile.
+function resolveProvider() {
+  const cfg = loadConfig();
+  const m = process.env.SYMBIOT_MODEL;
+  if (cfg.provider && PROVIDERS[cfg.provider]) {
+    const p = cfg.provider, pc = cfg[p] || {};
+    if (p === "ollama") return { provider: p, baseUrl: pc.baseUrl || "http://localhost:11434", model: m || pc.model || PROVIDERS.ollama.model, source: "saved login" };
+    const key = pc.apiKey || envKey(p);
+    if (key || (p === "anthropic" && (process.env.ANTHROPIC_AUTH_TOKEN || antProfileExists())))
+      return { provider: p, key, model: m || pc.model || PROVIDERS[p].model, source: pc.apiKey ? "saved login" : "environment" };
+  }
+  if (cfg.apiKey) return { provider: "anthropic", key: cfg.apiKey, model: m || PROVIDERS.anthropic.model, source: "saved login (~/.config/symbiot)" };
+  if (process.env.ANTHROPIC_API_KEY || process.env.ANTHROPIC_AUTH_TOKEN) return { provider: "anthropic", key: process.env.ANTHROPIC_API_KEY, model: m || PROVIDERS.anthropic.model, source: "ANTHROPIC_* (environment)" };
+  if (process.env.OPENAI_API_KEY) return { provider: "openai", key: process.env.OPENAI_API_KEY, model: m || PROVIDERS.openai.model, source: "OPENAI_API_KEY (environment)" };
+  if (process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY) return { provider: "gemini", key: process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY, model: m || PROVIDERS.gemini.model, source: "GEMINI/GOOGLE_API_KEY (environment)" };
+  if (antProfileExists()) return { provider: "anthropic", model: m || PROVIDERS.anthropic.model, source: "Anthropic CLI profile (ant auth login)" };
+  return null;
+}
+
+// ---- model calls (one per provider, same in/out) --------------------------
+async function callAnthropic(r, system, prompt) {
+  const client = new Anthropic(r.key ? { apiKey: r.key } : {});
+  const base = { model: r.model, max_tokens: MAX_TOKENS, system, messages: [{ role: "user", content: prompt }] };
+  let res;
+  try { res = await client.messages.create({ ...base, output_config: { effort: "low" } }); }
+  catch (e) {
+    // effort/output_config isn't accepted on every model (e.g. Haiku) — retry plain
+    if (/effort|output_config|thinking|budget|400/i.test(e?.message || "")) res = await client.messages.create(base);
+    else throw e;
+  }
+  if (res.stop_reason === "refusal") return "(the model declined this one — odd for a work summary; try again)";
+  return res.content.filter((b) => b.type === "text").map((b) => b.text).join("\n").trim();
+}
+async function callOpenAI(r, system, prompt) {
+  const messages = [{ role: "system", content: system }, { role: "user", content: prompt }];
+  // Newer models want max_completion_tokens instead of max_tokens; try both.
+  for (const tokKey of ["max_tokens", "max_completion_tokens"]) {
+    const res = await fetch("https://api.openai.com/v1/chat/completions", {
+      method: "POST",
+      headers: { Authorization: `Bearer ${r.key}`, "Content-Type": "application/json" },
+      body: JSON.stringify({ model: r.model, [tokKey]: MAX_TOKENS, messages }),
+    });
+    const text = await res.text();
+    if (res.ok) return (JSON.parse(text).choices?.[0]?.message?.content || "").trim();
+    if (res.status === 400 && tokKey === "max_tokens" && /max_tokens|max_completion_tokens/i.test(text)) continue;
+    throw new Error(`OpenAI ${res.status}: ${text.slice(0, 200)}`);
+  }
+  return "";
+}
+async function callGemini(r, system, prompt) {
+  const url = `https://generativelanguage.googleapis.com/v1beta/models/${encodeURIComponent(r.model)}:generateContent?key=${encodeURIComponent(r.key)}`;
+  const res = await fetch(url, {
+    method: "POST", headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      systemInstruction: { parts: [{ text: system }] },
+      contents: [{ role: "user", parts: [{ text: prompt }] }],
+      generationConfig: { maxOutputTokens: MAX_TOKENS },
+    }),
+  });
+  const text = await res.text();
+  if (!res.ok) throw new Error(`Gemini ${res.status}: ${text.slice(0, 200)}`);
+  const parts = JSON.parse(text).candidates?.[0]?.content?.parts || [];
+  return parts.map((p) => p.text || "").join("").trim();
+}
+async function callOllama(r, system, prompt) {
+  const res = await fetch(`${r.baseUrl}/api/chat`, {
+    method: "POST", headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ model: r.model, stream: false, messages: [{ role: "system", content: system }, { role: "user", content: prompt }] }),
+  });
+  const text = await res.text();
+  if (!res.ok) {
+    if (/not found|no such model|try pulling/i.test(text)) throw new Error(`the model "${r.model}" isn't downloaded yet — run  symbiot setup-local --model ${r.model}  (or click "Set up a free local model" in Settings)`);
+    throw new Error(`Ollama ${res.status}: ${text.slice(0, 200)}`);
+  }
+  return (JSON.parse(text).message?.content || "").trim();
+}
+
+// What write() shows in a terminal while it works: the CLI sets these (its
+// spinner, its coloured hints); imported on its own, it stays quiet.
+const AI_UI = {
+  spinner: () => () => {},
+  notConnected: () => console.log("Symbiot needs an AI to write your updates. Connect one with: symbiot login"),
+  rejected: (label) => console.log(`Your ${label} credentials were rejected. Reconnect with:  symbiot login --force`),
+};
+async function write(system, prompt) {
+  const r = resolveProvider();
+  if (!r) { AI_UI.notConnected(); return null; }
+  const stop = AI_UI.spinner("thinking…");
+  try {
+    if (r.provider === "anthropic") return await callAnthropic(r, system, prompt);
+    if (r.provider === "openai") return await callOpenAI(r, system, prompt);
+    if (r.provider === "gemini") return await callGemini(r, system, prompt);
+    if (r.provider === "ollama") return await callOllama(r, system, prompt);
+    return null;
+  } catch (err) {
+    if (/\b401\b|\b403\b|invalid|authentication|api key|unauthor/i.test(err?.message || "")) {
+      AI_UI.rejected(PROVIDERS[r.provider].label);
+      return null;
+    }
+    return `Couldn't reach the model: ${err?.message || err}`;
+  } finally { stop(); }
+}
+
+async function validate(provider, { key, baseUrl } = {}) {
+  try {
+    if (provider === "anthropic") { await new Anthropic({ apiKey: key }).models.list(); return true; }
+    if (provider === "openai") return (await fetch("https://api.openai.com/v1/models", { headers: { Authorization: `Bearer ${key}` } })).ok;
+    if (provider === "gemini") return (await fetch(`https://generativelanguage.googleapis.com/v1beta/models?key=${encodeURIComponent(key)}`)).ok;
+    if (provider === "ollama") return (await fetch(`${baseUrl}/api/tags`)).ok;
+  } catch { return false; }
+  return false;
+}
+
+// ---- hardware -> model recommendations ------------------------------------
+function detectGpu() {
+  const nv = sh("nvidia-smi --query-gpu=name,memory.total --format=csv,noheader,nounits 2>/dev/null").trim();
+  if (nv) { const p = nv.split("\n")[0].split(","); return { name: (p[0] || "NVIDIA GPU").trim(), vramGB: Math.round(Number(p[1]) / 1024) || null, kind: "nvidia" }; }
+  if (process.platform === "linux") { const vga = sh("lspci 2>/dev/null | grep -iE 'vga|3d controller|display' | head -1").replace(/^.*?: /, "").trim(); if (vga) return { name: vga, vramGB: null, kind: "other" }; }
+  if (process.platform === "darwin") { const chip = sh("sysctl -n machdep.cpu.brand_string 2>/dev/null").trim(); if (/apple/i.test(chip)) return { name: chip + " (unified memory)", vramGB: null, kind: "apple" }; }
+  return null;
+}
+function detectHardware() {
+  const cpus = oscpus() || [];
+  return { platform: process.platform, arch: process.arch, ramGB: Math.round(totalmem() / 1073741824), cpuCount: cpus.length, cpuModel: ((cpus[0] && cpus[0].model) || "CPU").trim(), gpu: detectGpu() };
+}
+function recommendModels(hw) {
+  const ram = hw.ramGB || 8;
+  const local = [
+    { tier: "min", model: "llama3.2:3b", needGB: 6, note: "fast & light — fine for summaries" },
+    { tier: "med", model: "llama3.1:8b", needGB: 10, note: "solid all-rounder" },
+    { tier: "max", model: "qwen2.5:14b", needGB: 18, note: "stronger reasoning" },
+  ];
+  if (ram >= 40) local.push({ tier: "max+", model: "llama3.1:70b", needGB: 48, note: "top local quality — big machine/GPU" });
+  local.forEach((m) => { m.fits = ram >= m.needGB; });
+  const paid = [
+    { provider: "anthropic", tier: "cheap", model: "claude-haiku-4-5", note: "cheapest Claude" },
+    { provider: "anthropic", tier: "top", model: "claude-opus-5-5", note: "best Claude (default)" },
+    { provider: "openai", tier: "cheap", model: "gpt-4o-mini", note: "cheap OpenAI" },
+    { provider: "openai", tier: "top", model: "gpt-4o", note: "stronger OpenAI" },
+    { provider: "gemini", tier: "cheap", model: "gemini-1.5-flash", note: "cheap Google" },
+    { provider: "gemini", tier: "top", model: "gemini-1.5-pro", note: "stronger Google" },
+  ];
+  const best = (local.slice().reverse().find((m) => m.fits) || local[0]).model;
+  return { local, paid, best };
+}
+// ---- local model one-command setup (Ollama), OS-aware ---------------------
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function hasOllama() { return !!sh("ollama --version").trim(); } // cross-platform (not POSIX command -v)
+function ollamaInstall() {
+  if (process.platform === "darwin") return { cmd: "brew install ollama", alt: "https://ollama.com/download" };
+  if (process.platform === "win32") return { cmd: "winget install Ollama.Ollama", alt: "https://ollama.com/download" };
+  return { cmd: "curl -fsSL https://ollama.com/install.sh | sh", alt: "https://ollama.com/download" };
+}
+async function ollamaUp() { try { const r = await fetch("http://127.0.0.1:11434/api/tags"); return r.ok; } catch { return false; } }
+async function ensureOllama() {
+  if (await ollamaUp()) return true;
+  try { spawn("ollama", ["serve"], { detached: true, stdio: "ignore" }).unref(); } catch {}
+  for (let i = 0; i < 16; i++) { await sleep(500); if (await ollamaUp()) return true; }
+  return false;
+}
+function useOllamaModel(model) { const cfg = loadConfig(); cfg.provider = "ollama"; cfg.ollama = { baseUrl: "http://localhost:11434", model }; delete cfg.apiKey; saveConfig(cfg); }
+
+// Save a provider connection (used by the web Settings panel); mirrors cmdLogin.
+async function connectProvider(b) {
+  const provider = b && b.provider;
+  if (!PROVIDERS[provider]) return { ok: false, message: "Unknown provider." };
+  const cfg = loadConfig();
+  if (provider === "ollama") {
+    const baseUrl = (b.baseUrl || "http://localhost:11434").trim();
+    const model = (b.model || "").trim() || PROVIDERS.ollama.model;
+    if (!(await validate("ollama", { baseUrl }))) return { ok: false, message: `Couldn't reach Ollama at ${baseUrl}. Is it running?` };
+    cfg.provider = "ollama"; cfg.ollama = { baseUrl, model }; delete cfg.apiKey;
+    return saveConfig(cfg) ? { ok: true, message: `Connected: ${PROVIDERS.ollama.label} · ${model}` } : { ok: false, message: "Couldn't write the config file." };
+  }
+  const key = (b.key || "").trim();
+  if (!key) return { ok: false, message: "No key entered." };
+  const model = (b.model || "").trim() || PROVIDERS[provider].model;
+  if (!(await validate(provider, { key }))) return { ok: false, message: `That key didn't work for ${PROVIDERS[provider].label}.` };
+  cfg.provider = provider; cfg[provider] = { apiKey: key, model }; delete cfg.apiKey;
+  return saveConfig(cfg) ? { ok: true, message: `Connected: ${PROVIDERS[provider].label} · ${model}` } : { ok: false, message: "Couldn't write the config file." };
+}
+
+export { PROVIDERS, AI_UI, resolveProvider, write, validate, connectProvider, detectHardware, recommendModels, hasOllama, ollamaInstall, ensureOllama, useOllamaModel };

package/core.mjs

@@ -1,9 +1,22 @@
-// Shared basics for every module: Symbiot's config and task files, the one
-// shell helper (never throws, never hangs) and a repo's working-tree state.
+// Shared basics for every module: Symbiot's version (and npm's newest), its
+// config and task files, the one shell helper (never throws, never hangs) and a
+// repo's working-tree state.
 import { execSync } from "node:child_process";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { readFileSync, writeFileSync, mkdirSync, chmodSync, existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+// ---- version ----------------------------------------------------------------
+const HERE = fileURLToPath(new URL(".", import.meta.url));
+let VERSION = "0"; try { VERSION = JSON.parse(readFileSync(join(HERE, "package.json"), "utf8")).version; } catch {}
+let LATEST_VERSION = ""; // newest symbiot on npm, checked in the background
+// a.b.c numeric compare: only a HIGHER npm version is an update (a local build
+// ahead of npm must not be offered a "newer" older one)
+function semverGt(a, b) { const p = (v) => String(v || "").replace(/^v/, "").split(/[.-]/).slice(0, 3).map((n) => parseInt(n, 10) || 0); const x = p(a), y = p(b); for (let i = 0; i < 3; i++) if (x[i] !== y[i]) return x[i] > y[i]; return false; }
+// SYMBIOT_REGISTRY points the check at another registry (the tests use a fake one)
+const REGISTRY = (process.env.SYMBIOT_REGISTRY || "https://registry.npmjs.org").replace(/\/+$/, "");
+async function checkLatest() { try { const r = await fetch(REGISTRY + "/symbiot"); if (!r.ok) return; const j = await r.json(); LATEST_VERSION = (j["dist-tags"] && j["dist-tags"].latest) || ""; } catch {} }
 
 // ---- config ---------------------------------------------------------------
 const CONFIG_DIR = join(homedir(), ".config", "symbiot");
@@ -71,4 +84,4 @@ function repoState(repoPath) {
   return { branch, dirty, del, mod, add, stale, staleBy, behind };
 }
 
-export { CONFIG_DIR, CONFIG_PATH, loadConfig, saveConfig, loadTasks, saveTasks, sh, hasCmd, chromeBinary, repoState };
+export { VERSION, LATEST_VERSION, semverGt, REGISTRY, checkLatest, CONFIG_DIR, CONFIG_PATH, loadConfig, saveConfig, loadTasks, saveTasks, sh, hasCmd, chromeBinary, repoState };

package/desktop.mjs

@@ -84,8 +84,12 @@ function notifyCmd(title, body, platform = OS) {
     const q = (s) => "'" + String(s).replace(/'/g, "''") + "'";
     return ["powershell", ["-NoProfile", "-WindowStyle", "Hidden", "-Command", `Add-Type -AssemblyName System.Windows.Forms; $n = New-Object System.Windows.Forms.NotifyIcon; $n.Icon = [System.Drawing.SystemIcons]::Information; $n.Visible = $true; $n.ShowBalloonTip(10000, ${q(title)}, ${q(body)}, 'Info'); Start-Sleep -Seconds 11; $n.Dispose()`]];
   }
-  // Android (Termux): termux-notification, from the termux-api package + the Termux:API app
-  if (platform === "android") return hasCmd("termux-notification") ? ["termux-notification", ["--id", "symbiot", "--title", title, "--content", body]] : null;
+  // Android (Termux): termux-notification, from the termux-api package + the Termux:API app.
+  // One per source: Watch's "3 new · Inbox" replaces Inbox's last one, not GitHub's.
+  if (platform === "android") {
+    const from = (String(title).match(/ · (.+)$/) || [])[1], id = from ? "symbiot-" + from.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 40) : "symbiot";
+    return hasCmd("termux-notification") ? ["termux-notification", ["--id", id, "--title", title, "--content", body]] : null;
+  }
   return hasCmd("notify-send") ? ["notify-send", ["--app-name=Symbiot", title, body]] : null;
 }
 // In the app: a line in a file its service watches, and it posts the notification.

package/drift.mjs

@@ -1,8 +1,9 @@
-// Drift facts for one repo: what's out of sync, stuck or at risk, from git
-// alone (plus gh for --ci and the user's own deploy commands).
+// Drift: what's out of sync, stuck or at risk in each repo, from git alone
+// (plus gh for --ci and the user's own deploy commands), and across all of them.
 import { join } from "node:path";
 import { readFileSync, statSync } from "node:fs";
 import { CONFIG_DIR, sh, hasCmd, repoState } from "./core.mjs";
+import { SCAN, scanBegin, scanPhase, scanTick, scanExpired, scanEnd, scanBase, findAllRepos } from "./scan.mjs";
 
 // ---- drift: what's out of sync / stuck / at risk (deterministic git facts) -
 function gitDefaultBranch(repo) {
@@ -121,4 +122,19 @@ function driftRepo(p, opts = {}) {
   return { name, path: p, def, flags, fetchAgeDays: fa };
 }
 
-export { gitDefaultBranch, loadDeploys, driftRepo };
+// ---- drift across every repo (the same repos the Map finds) ----------------
+function computeDrift(opts = {}) {
+  const own = scanBegin();
+  try {
+    const deploys = loadDeploys();
+    const found = findAllRepos().slice(0, 20), repos = [];
+    scanPhase("checking drift", found.length);
+    for (const r of found) {
+      if (scanExpired()) break;
+      repos.push(driftRepo(r.path, { deploys, ci: opts.ci, fetch: opts.fetch })); scanTick(r.name);
+    }
+    return { repos, ci: !!opts.ci, partial: SCAN.partial, base: scanBase() };
+  } finally { scanEnd(own); }
+}
+
+export { gitDefaultBranch, loadDeploys, driftRepo, computeDrift };