symbiot 0.50.3 → 0.51.1

package/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 What each Symbiot release brought, newest first. When Approve bumps the version, it writes that release here from the tasks it approved, worded as release notes by your connected AI (or in the tasks' own words without one). The app shows the releases newer than yours under "What's new" when it offers an update, and once more after you update.
 
+## 0.51.1
+
+- **Allowing an agent's list works when the list is fine.** An exact command such as `rm -r ~/dailify/site` no longer counts as dangerous; only Bash with no command, a shell, sudo, or a wildcard `rm`/`dd`/`chmod` does. Before, one such rule refused the whole list, silently, and the agent asked you again and again.
+- **When a list is too wide, you're told why.** The note names the rules, the agent is asked for a narrower list, and it starts again, instead of waiting on a click that can't work.
+- **An agent can never edit Symbiot's own settings.** Every list Symbiot turns on also blocks editing `config.json`, where what agents may do is kept.
+
+## 0.51.0
+
+What your agents built on the symbiot repo yesterday, merged with everything since:
+
+- **`symbiot post`.** Drafts three posts a week from your real git activity, releases and CHANGELOG (shipped, learned or fixed, and a longer one) in your voice from `voice.md`. They wait on the Dashboard for Approve, Edit or Skip; nothing is published without your approval, and every choice is logged. It can draft replies to comments too, for you to approve.
+- **Company knowledge folders.** Point Symbiot at a folder of documents (Settings → Knowledge folders) and every chat can quote them and say which file; worked examples are kept apart from facts.
+- **Reports.** What agents write up (findings, audits, plans) shows in one place, unread ones marked.
+- **Waiting on replies.** When an agent's email needs an answer, Symbiot watches your inbox for it and hands the reply on to the next step itself.
+- **Facts from a run.** An agent can hand back what it learned; Remember or Skip it on the run's block.
+- **A first-run sandbox**, to walk through Symbiot's setup like a new user, apart from your real data.
+- **Fixed:** the same task listed twice in different words, or spelled out in steps; a task you closed coming back; long tasks cut mid-sentence; mail and WhatsApp chats you've already read still counting as waiting on you; agent runs denied the Gmail, Calendar, Drive and Notion tools right after you connected them.
+
 ## 0.50.3
 
 - **Finer tags on the spheres.** A sphere's tag is the short form of its task: no "(§5 of .symbiot/BRIEF…)" asides, paths or markdown, cut at a word, in smaller type and two lines at most; point at it for the whole text. The layout makes room for every tag, so a tag never lands on another tag or sphere.

package/README.md

@@ -24,6 +24,16 @@ The newer extras are [experimental](#experimental): email, CI checks,
 local-model setup, Screens and Watch, and Symbiot on a phone. The list there says
 what's stable and what isn't.
 
+## What is Symbiot for?
+
+For developers and small teams who owe someone an update every week (a manager,
+a client, a standup, the team channel) and would rather spend that time on the
+work. The work is already in git: what you committed, merged and released, and
+what's still uncommitted or out of sync. Symbiot reads it on your machine and
+writes the update from it, so it says what actually happened, not what you
+remember on a Friday afternoon. It also hands the next tasks to your coding
+agent and brings its work back to you to approve.
+
 ## Install
 
 ```bash
@@ -103,6 +113,8 @@ It opens on [the liquid](#the-liquid-a-home-that-shapes-itself-to-you); each of
   did** — files changed and commits made, read from git, whichever agent it was.
   When an agent leaves **questions, options or ideas** for you, they show up on its
   block (see [Questions from your agent](#questions-from-your-agent)).
+- **Reports** — what your agents wrote up for you (findings, audits, plans), to
+  read in the app (see [What a run hands back](#what-a-run-hands-back-facts-to-remember-replies-to-wait-for-reports)).
 - **Settings** — [Link your work](#link-your-work), your AI, the folders to scan, your agent command, the
   [weekly write-up and start at login](#every-week-and-at-login), plus the
   [experimental](#experimental) email, model recommendations and one-click local
@@ -127,6 +139,15 @@ the chrome-less window, it uses your default browser. On an Android phone it run
 in Termux ([experimental](#on-your-phone-android-in-termux)), or as an
 [Android app](#the-android-app-apk) of its own.
 
+**Try it as someone new: `symbiot app --fresh`.** A brand-new Symbiot opens next
+to yours, marked **sandbox** by its version, to walk through first run and
+setup: no AI connected (keys in your environment are left out), no memory, no
+linked accounts, no lanes, none of your repos. It has its own home folder under
+your temp folder, deleted when you quit it (`--keep` keeps it, to see what setup
+wrote), and it never offers an update. A folder you add to it is read like any
+other, and agents it starts run as you on this computer, without your Claude
+sign-in.
+
 ### Every week, and at login
 
 Two switches in Settings do what the old `symbiot-desktop` tray app did (that
@@ -377,6 +398,13 @@ Handoff says which of your linked sites aren't wired up, and each run's `TASKS.m
 says which connectors it has and which it doesn't, so it doesn't claim to have
 checked your mail.
 
+Claude writes a claude.ai connector into `~/.claude.json` only after a session
+has connected it, so the first run after you connect Gmail used to get Gmail's
+tools with every call denied. A site you link in Symbiot (Gmail, Google Calendar,
+Google Drive, Notion) now gets its claude.ai connector's rule on every Claude run,
+even before Claude records it or while it waits to be authorized. A rule for tools
+a run doesn't have does nothing.
+
 Each run is logged to `.symbiot/agent.log` in the repo and shown live in the
 **Agents** tab. The command is saved as `agentCmd` in
 `~/.config/symbiot/config.json` — it's your command, Symbiot only fills in
@@ -548,7 +576,7 @@ Symbiot's config folder, readable by you only.
 **Connections** (on the Dashboard, and in Settings) has one entry per standard work site: Gmail,
 Outlook, Google and Outlook Calendar, GitHub, GitLab, Slack, Microsoft Teams,
 WhatsApp, Jira & Confluence, Linear, Asana, Trello, Google Drive, Notion,
-HubSpot and Salesforce. One click:
+HubSpot, Salesforce and LinkedIn. One click:
 
 1. opens the site in Symbiot's own browser, where you sign in the usual way (its
    own login, SSO and 2FA; Symbiot never sees your password). Close the window
@@ -578,6 +606,43 @@ hides the ones you don't use. An entry with a built-in's id replaces it:
 Linking stays in the app. Like trusted sites, there's no command an agent could
 call to link a site itself.
 
+## Post about your week: `symbiot post`
+
+`symbiot post` turns your last 7 days of real work into 3 draft LinkedIn posts,
+in your own voice: what you **shipped**, one thing you **learned or fixed**, and a
+**longer post** (or a short thread) about the best of it. It reads the commits,
+release tags and dated `CHANGELOG.md` sections in the repos Symbiot already scans,
+and nothing else. **It never posts by itself**, and it doesn't schedule.
+
+- **Your voice.** Put 5–10 posts you wrote in `~/.config/symbiot/voice.md`, with a
+  line of `---` between each. Or link LinkedIn (above) and click **Fill from
+  LinkedIn** on the Dashboard (`symbiot post voice --linkedin`), which reads your
+  recent posts in Symbiot's signed-in browser. Without examples it doesn't draft.
+- **Only what git shows.** Your AI gets the week as numbered facts and must say
+  which ones each post uses. A post that names a number, version, name or user
+  count the facts don't show is sent back once, then dropped.
+- **You approve each one.** The drafts wait on the **Dashboard** with **Approve**,
+  **Edit** and **Skip**. Approve copies the post to your clipboard and opens
+  LinkedIn's share box: you paste it and post it yourself.
+- **Everything is logged** in `~/.config/symbiot/posts-log.jsonl`: each draft,
+  edit, approval and skip, with its text, date and platform.
+- **Replies.** Linked LinkedIn is watched like an inbox: new comments and mentions
+  show on its Dashboard card, marked **maybe a customer** when they ask how to
+  install it, what it costs or about team use. **Draft a reply** has your agent
+  type a reply into the comment box without posting it (it can't press Post,
+  Comment, Reply or Send), and write it in its brief for you to paste.
+
+```bash
+symbiot post                    # draft this week's 3 posts
+symbiot post list               # the drafts waiting on you
+symbiot post approve <id>       # copy it, and get LinkedIn's share box (--open opens it)
+symbiot post edit <id> "text"   # change a draft's words
+symbiot post skip <id>          # drop one
+symbiot post log                # everything that happened
+```
+
+With no AI connected it says so and does nothing else.
+
 ## One Symbiot, everywhere
 
 The chat on each Dashboard card and the chat on each task aren't separate bots:
@@ -624,6 +689,33 @@ hand, a cable, which network you're on), your identity or secrets (signing in, a
 account, spending money, sending something in your name). Every brief tells the
 agent so, and such a question says which: `👤 You (only you: your Meta token): …`.
 
+### What a run hands back: facts to remember, replies to wait for, reports
+
+Every brief also tells the agent what else it can leave in `.symbiot/`:
+
+- **`REMEMBER.json`**: lasting facts it found (who someone is, which account is
+  what, a decision), as `[{ "name", "kind", "fact" }]`. A run can't write
+  Symbiot's memory itself. Once it stops, its block in the Agents tab shows them,
+  each ticked, with **Remember** and **Skip**. Remember puts the ticked ones into
+  memory, marked with the run's name; Skip drops them. Either way it's asked once.
+- **`AWAITING.json`**: an email it sent (or drafted for you to send) that waits on
+  a reply, as `[{ "to", "subject", "asked", "next", "task", "lane" }]`. Symbiot
+  watches for the reply itself, so you never have to say "they replied": in what
+  Watch finds new in your inbox, and, with Email switched on, in the inbox beside
+  the Sent folder you linked (headers only, and only the reply it waits for). When
+  it's in, the lane that does the next step (`lane`, else the one that sent it)
+  gets it as a task and its agent starts, told what was asked for and what to do
+  next. The task it's for says so in its chat, and you get a notification. The
+  Dashboard lists **Waiting on replies**, with **Stop waiting** on each. Anything
+  the reply leaves for you to decide comes back as that agent's question.
+- **A report** (findings, an audit, a plan, a pitch): any `.md` named for what it
+  is, with a `# ` title. **Reports** in the app lists every one your runs left,
+  in your repos and in runs of their own, newest first, unread ones marked; click
+  one to read it there, tables and all. Home shows how many are unread.
+  `symbiot reports` lists them in a terminal, and `symbiot reports <id>` prints
+  one. Symbiot's own files there (TASKS, QUESTIONS, ANSWERS, HANDOFF, SKIPPED)
+  and the briefs handed in (`BRIEF*.md`) aren't reports.
+
 ## Connect it (once)
 
 Pick the AI you want it to write with:
@@ -688,12 +780,44 @@ coloured) with their languages, and can receive tasks like a repo.
 gigantic folder — it stops and shows what it found so far, marked **partial**,
 instead of hanging. The CLI shows scan progress on one line as it goes.
 
+### Knowledge folders
+
+Repos are your code; a **knowledge folder** is your documents — a company folder
+of how work is done, policies, price lists, notes. Add one under **Settings →
+Knowledge folders** in the app, or with `symbiot knowledge add ~/Company`. Symbiot
+reads its Markdown, CSV and text files (Word, PDF and Excel are counted as "not
+read yet") into an index of its own, `~/.config/symbiot/knowledge.json`, readable
+only by you and kept apart from its memory. While the app runs it re-reads only
+the files that changed, every few minutes; `symbiot knowledge index` does it now.
+
+Every chat in the app — the home bar, a Dashboard card, a task — then gets the few
+passages that best answer what you asked, each with the file it came from, and
+quotes and cites that file when it uses one.
+
+- **Examples aren't facts.** Say which paths in a folder hold worked examples
+  (`--examples templates/,active/`, or the second box in Settings; `templates/`
+  unless you say otherwise, meaning any folder of that name). A file whose front
+  matter says `example: true` is one too. Examples never come back in a chat;
+  `symbiot knowledge search … --with-examples` finds them, marked as examples.
+  Add the folder again to change its examples.
+- **Cases.** A folder's `README.md` with *Who does it*, *When*, *Steps*, *Hands
+  off to* and *What Symbiot should learn and remember*, and items whose front
+  matter has `owner`, `status`, `due` and `waiting_on` (like
+  `active/<item>/STATUS.md`), answer "what's waiting on me?" and "who owns X?"
+  straight from those fields. "Me" is the name in `symbiot knowledge me "Your
+  Name"` (saved as `myName` in config.json), or else your git `user.name`; your
+  first name on its own counts too.
+- `symbiot knowledge` lists the folders and what was read; `search`, `waiting`
+  and `owner` answer from the terminal (`symbiot knowledge help`).
+
 ## What it reads, and what it doesn't
 
 - **Reads:** your local git — commit messages and changed-file names, plus
   `TODO`/`FIXME` markers and uncommitted changes for `todo`. If you switch
   [email](#your-sent-email-without-an-api-symbiot-mail) on, it also reads the headers
-  of mail you sent (subject, recipients, date). All local.
+  of mail you sent (subject, recipients, date), and, while an agent's email
+  [waits on a reply](#what-a-run-hands-back-facts-to-remember-replies-to-wait-for-reports),
+  the headers in your inbox there to find that reply (only it is kept). All local.
 - **Sends to the AI:** commit messages and dates, changed-file **names**, the
   folder structure, `TODO`/`FIXME` lines, and (for a repo review) an excerpt of
   the README and any `CLAUDE.md`/`AGENTS.md` conventions. With email on, it also
@@ -934,6 +1058,13 @@ chats with unread messages from them count on the Dashboard and in Standup, get
 notification and a brief, and the brief and the card's chat are told who each one
 is from.
 
+**Mail: only unread mail needs you.** Gmail starts each unread row with "unread".
+Symbiot keeps that mark, so an email you've already read (on your phone, say) is
+listed on the card marked "read", but it isn't counted, notified or briefed. One
+you read after Watch found it stops counting at the next read, and counts again if
+you mark it unread. Another inbox gets the same once Watch has seen it mark a row
+unread. Until then, every new email counts.
+
 **Draft a reply.** A new email under Watching has **Draft a reply**. It hands the
 email to your coding agent (the command in Settings → Handoff), which opens it in
 your inbox through Screens, reads it, writes a reply and leaves it in Drafts, for

package/adapt.mjs

@@ -48,7 +48,7 @@ const MIN_EVENTS = 12;                   // under this many uses, adaptation fad
 const HICK_COVER = 0.9, HICK_MIN = 3, HICK_MAX = 7;
 const HYSTERESIS = 0.15;
 const FITTS = { a: 0.1, b: 0.15 };       // seconds; only ratios matter here
-const SHAPES = ["board", "map", "tasks", "agents", "week", "standup", "todo", "drift", "settings"];
+const SHAPES = ["board", "map", "tasks", "agents", "week", "standup", "todo", "drift", "settings", "reports"];
 
 function loadAdapt(file = ADAPT_FILE) {
   try { const d = JSON.parse(readFileSync(file, "utf8")); return { shapes: d.shapes || {}, trans: d.trans || {}, hours: d.hours || {}, modes: d.modes || {}, slots: d.slots || {}, shown: d.shown || null, events: d.events || 0 }; }

package/agents.mjs

@@ -7,8 +7,9 @@ import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { readFileSync, writeFileSync, mkdirSync, existsSync, openSync, writeSync, unlinkSync, readdirSync, statSync } from "node:fs";
 import { randomBytes, createHash } from "node:crypto";
-import { CONFIG_DIR, loadConfig, saveConfig, loadTasks, sameTask, taskWords, sh, hasCmd } from "./core.mjs";
+import { CONFIG_DIR, loadConfig, saveConfig, loadTasks, TASK_MAX, clipWords, sameTask, taskWords, sh, hasCmd } from "./core.mjs";
 import { parseRun, lastRunText } from "./work.mjs";
+import { parseFacts } from "./handover.mjs";
 
 const HANDOFFS = []; // live registry of agents Symbiot has handed work to
 // ---- hand a repo (+ its tasks) to the user's agent — generic, settings-based
@@ -84,14 +85,20 @@ function claudeConnectors(dir = "", file = join(homedir(), ".claude.json")) {
   const proj = dir && j.projects && typeof j.projects === "object" ? j.projects[dir] : null;
   const needsAuth = new Set(names(j.mcpNeedsAuthNoticed));
   return [...new Set([...names(j.claudeAiMcpEverConnected), ...servers(j.mcpServers), ...servers(proj && proj.mcpServers)])]
-    .map((name) => ({ name, rule: "mcp__" + name.replace(/[^A-Za-z0-9_-]/g, "_"), ready: !needsAuth.has(name) }));
+    .map((name) => ({ name, rule: connectorRule(name), ready: !needsAuth.has(name) }));
 }
 // A Claude command with the ready connectors' rules added, for this run only:
 // the saved command stays as typed, so linking or unlinking one takes effect on
 // the next run. Any other agent's command runs as-is (Settings says so).
-function withConnectors(tmpl, dir, file) {
+// Claude records a claude.ai connector (claudeAiMcpEverConnected) only once a
+// session has connected it, so the first run after you connect Gmail got Gmail's
+// tools without a rule for them, and every call was denied. A site linked in
+// Symbiot is allowed its claude.ai connector's tools too, recorded or not (a rule
+// for tools a run doesn't have does nothing).
+function withConnectors(tmpl, dir, file, linked = loadConfig().linked) {
   if (!isClaudeCmd(tmpl)) return tmpl;
-  return claudeConnectors(dir, file).filter((c) => c.ready).reduce((cmd, c) => allowTool(cmd, c.rule), tmpl).replace(/\s+$/, "");
+  const rules = [...claudeConnectors(dir, file).filter((c) => c.ready).map((c) => c.rule), ...linkedRules(linked)];
+  return rules.reduce((cmd, r) => allowTool(cmd, r), tmpl).replace(/\s+$/, "");
 }
 // Linking a site in Symbiot (Links: Gmail, Drive…) signs Symbiot's own browser in;
 // it doesn't give Claude's runs that site's tools. Those come from Claude's own
@@ -101,6 +108,14 @@ function withConnectors(tmpl, dir, file) {
 // with the one it has (connector: its name, or "") and whether it's ready.
 const CLI = fileURLToPath(new URL("./index.mjs", import.meta.url));
 const LINK_CONNECTOR = { gmail: ["Gmail", /gmail/i], outlook: ["Outlook", /outlook|microsoft 365/i], gcal: ["Google Calendar", /google calendar/i], gdrive: ["Google Drive", /google drive/i], notion: ["Notion", /notion/i], slack: ["Slack", /slack/i], jira: ["Jira & Confluence", /atlassian|jira|confluence/i], linear: ["Linear", /linear/i], asana: ["Asana", /asana/i], hubspot: ["HubSpot", /hubspot/i] };
+// The claude.ai connector each of those is, by the name Claude gives it (as seen
+// in ~/.claude.json), for its rule before Claude has recorded it (withConnectors).
+const CLAUDE_AI_CONNECTOR = { gmail: "claude.ai Gmail", gcal: "claude.ai Google Calendar", gdrive: "claude.ai Google Drive", notion: "claude.ai Notion" };
+const connectorRule = (name) => "mcp__" + name.replace(/[^A-Za-z0-9_-]/g, "_");
+function linkedRules(l) {
+  if (!l || typeof l !== "object" || Array.isArray(l)) return [];
+  return Object.keys(l).filter((id) => CLAUDE_AI_CONNECTOR[id]).map((id) => connectorRule(CLAUDE_AI_CONNECTOR[id]));
+}
 function linkedConnectors(conns = claudeConnectors(), l = loadConfig().linked) {
   if (!l || typeof l !== "object" || Array.isArray(l)) return [];
   return Object.keys(l).filter((id) => LINK_CONNECTOR[id]).map((id) => {
@@ -116,7 +131,10 @@ function connectorsLine(tmpl = handoffCmd(), file, linked) {
   const nm = (s) => s.replace(/^claude\.ai\s+/i, ""), names = off.map((x) => x.name), them = names.length > 1 ? names.slice(0, -1).join(", ") + " and " + names.at(-1) : names[0];
   const has = ready.length ? `this run can use ${ready.map((c) => `${nm(c.name)} (\`${c.rule}__…\` tools)`).join(", ")}.` : "";
   const not = off.length ? ` ${them} ${off.length === 1 ? "is" : "are"} linked in Symbiot but not ${off.some((x) => x.connector) ? "ready " : ""}as a Claude connector, so this run has no tools for ${off.length === 1 ? "it" : "them"}: don't say you checked ${off.length === 1 ? "it" : "them"}. What's new there is in \`node "${CLI}" watch new\`; to read more, ask the user (👤) to connect ${them} in claude.ai → Settings → Connectors.` : "";
-  return (has + not).trim();
+  // withConnectors allows these anyway: Claude may have connected one since
+  const early = off.filter((x) => CLAUDE_AI_CONNECTOR[x.id]).map((x) => `\`${connectorRule(CLAUDE_AI_CONNECTOR[x.id])}__…\``);
+  const anyway = early.length ? ` If ${early.join(" or ")} tools are here after all, the connector was just connected: they're allowed, so use them.` : "";
+  return (has + not + anyway).trim();
 }
 // For Settings → Handoff: the connectors, whether this command's runs get them, and
 // the sites linked in Symbiot that aren't Claude connectors (so runs can't use them).
@@ -179,11 +197,11 @@ function earlierRuns() {
   const tracked = new Set(HANDOFFS.map((e) => e.path)), out = [];
   for (const r of loadRuns()) {
     if (tracked.has(r.path) || !existsSync(join(r.path, ".symbiot"))) continue;
-    const busy = runningHandoff(r.path), ask = agentQuestions(r.path, r.name), wait = waitingFor(r.path);
-    if (!busy && !ask.questions.length && !wait) continue;
+    const busy = runningHandoff(r.path), ask = agentQuestions(r.path, r.name), wait = waitingFor(r.path), facts = busy ? [] : factsOf(r.path);
+    if (!busy && !ask.questions.length && !wait && !facts.length) continue;
     const log = join(r.path, ".symbiot", "agent.log"), startedAt = (busy && busy.startedAt) || Number(r.startedAt) || Date.now();
     let tail = "", work = null, progress = null, end = Date.now(); try { ({ tail, work, progress } = workOf(r.path, readFileSync(log, "utf8"))); if (!busy) end = statSync(log).mtimeMs; } catch {}
-    out.push({ id: "earlier-" + digest(r.path).slice(0, 8), name: String(r.name || r.path.split("/").pop()), path: r.path, status: busy ? "running" : "done", earlier: true, elapsed: Math.max(0, end - startedAt), exitCode: null, tail, work, progress, changed: agentChanges(r.path, startedAt), ask, held: heldTasks(r.path), waiting: wait, fromHeld: false });
+    out.push({ id: "earlier-" + digest(r.path).slice(0, 8), name: String(r.name || r.path.split("/").pop()), path: r.path, status: busy ? "running" : "done", earlier: true, elapsed: Math.max(0, end - startedAt), exitCode: null, tail, work, progress, changed: agentChanges(r.path, startedAt), ask, held: heldTasks(r.path), waiting: wait, remember: facts.length ? facts : null, fromHeld: false });
   }
   return out;
 }
@@ -326,18 +344,44 @@ const HELD = "TASKS.next.md";
 function writeTasks(path, md) {
   const dir = join(path, ".symbiot"); mkdirSync(dir, { recursive: true });
   if (runningHandoff(path)) { writeFileSync(join(dir, HELD), md); return true; }
-  writeFileSync(join(dir, "TASKS.md"), md);
+  writeFileSync(join(dir, "TASKS.md"), md); noteHanded(path, md);
   try { unlinkSync(join(dir, HELD)); } catch {} // superseded by this brief
   return false;
 }
+// ---- a task the agent deleted from TASKS.md --------------------------------
+// TASKS.md is rebuilt from tasks.json on every send, so an agent deleting a
+// line (the user said to drop that task) changed nothing, and the next brief
+// brought it back (GhostAIChat's `pod install`). handed.json keeps what the
+// brief in TASKS.md handed out; a task it handed out that's no longer in the
+// file (ticked or not) was deleted: droppedTasks lists them, and tasks.mjs
+// closes them (applyDrops). The task lines are the `## Tasks` section's, or the
+// whole file's when it has none; a file emptied or gone deleted nothing.
+const HANDED = "handed.json", BOX = /^\s*-\s*\[[ x]\]\s*/i;
+function briefTasks(md) {
+  const lines = String(md || "").split("\n"), at = lines.findIndex((l) => /^##\s+Tasks\s*$/.test(l));
+  const end = at < 0 ? lines.length : lines.findIndex((l, i) => i > at && /^##\s/.test(l));
+  return lines.slice(at + 1, end < 0 ? lines.length : end).filter((l) => BOX.test(l)).map((l) => l.replace(BOX, "").trim()).filter(Boolean);
+}
+function noteHanded(path, md, also = []) {
+  try { writeFileSync(join(path, ".symbiot", HANDED), JSON.stringify({ at: Date.now(), tasks: [...briefTasks(md), ...also] })); } catch {}
+}
+function droppedTasks(path) {
+  let h = null; try { h = JSON.parse(readSymbiot(path, HANDED)); } catch {}
+  const md = readSymbiot(path, "TASKS.md");
+  if (!h || !Array.isArray(h.tasks) || !md.trim() || !/^##\s+Tasks\s*$|^\s*-\s*\[[ x]\]/im.test(md)) return [];
+  const now = briefTasks(md);
+  return h.tasks.filter((t) => !now.some((n) => sameTask(n, t))).map((text) => ({ text, at: h.at || 0 }));
+}
 // Swap the held brief in, keeping the ticks the agent made meanwhile: a tick
 // is how a task reaches review, so dropping one would lose that task's work.
+// A task the agent deleted meanwhile stays out, and stays deleted in handed.json.
 function releaseHeldTasks(path) {
   const held = readSymbiot(path, HELD); if (!held || runningHandoff(path)) return false;
   const isTick = /^\s*-\s*\[x\]\s*/i, key = (l) => l.replace(/^\s*-\s*\[[ x]\]\s*/i, "").trim().toLowerCase();
   const ticked = new Set(readSymbiot(path, "TASKS.md").split("\n").filter((l) => isTick.test(l)).map(key));
-  const md = held.split("\n").map((l) => /^\s*-\s*\[ \]/.test(l) && ticked.has(key(l)) ? l.replace("[ ]", "[x]") : l).join("\n");
-  try { writeFileSync(join(path, ".symbiot", "TASKS.md"), md); unlinkSync(join(path, ".symbiot", HELD)); return true; } catch { return false; }
+  const gone = droppedTasks(path).map((d) => d.text), isGone = (l) => /^\s*-\s*\[ \]/.test(l) && gone.some((g) => sameTask(g, key(l)));
+  const md = held.split("\n").filter((l) => !isGone(l)).map((l) => /^\s*-\s*\[ \]/.test(l) && ticked.has(key(l)) ? l.replace("[ ]", "[x]") : l).join("\n");
+  try { writeFileSync(join(path, ".symbiot", "TASKS.md"), md); unlinkSync(join(path, ".symbiot", HELD)); noteHanded(path, md, gone); return true; } catch { return false; }
 }
 // Land the held brief and, if it leaves anything open, start an agent on it.
 // Runs when an agent this process started exits, and when the app next checks
@@ -512,7 +556,7 @@ const readSymbiot = (path, f) => { try { return readFileSync(join(path, ".symbio
 // bullet under Questions is a question with no options.
 function parseQuestions(md) {
   const questions = [], suggestions = []; let sec = "q", cur = null;
-  const clip = (s) => String(s).trim().slice(0, 1000); // as long as a task holds (addTask), so an idea added in one click arrives whole
+  const clip = (s) => clipWords(String(s).trim(), TASK_MAX); // as long as a task holds (addTask), so an idea added in one click arrives whole
   for (const raw of String(md || "").split(/\r?\n/)) {
     const l = raw.trim(); if (!l) continue;
     let m;
@@ -547,7 +591,7 @@ function suggestionTarget(s) {
 const SKIPPED = "SKIPPED.md";
 const skippedIdeas = (path) => [...readSymbiot(path, SKIPPED).matchAll(/^-\s+(.+)$/gm)].map((m) => m[1].trim());
 function skipIdea(path, text) {
-  path = String(path || ""); text = String(text || "").replace(/\s+/g, " ").trim().slice(0, 1000);
+  path = String(path || ""); text = clipWords(String(text || "").replace(/\s+/g, " ").trim(), TASK_MAX);
   if (!path || !knownRun(path)) return { error: "No agent has run in that folder." };
   if (!text) return { error: "No idea to skip." };
   const f = join(path, ".symbiot", SKIPPED);
@@ -581,23 +625,32 @@ function agentQuestions(path, repo) {
 // An allow list an agent proposed (.symbiot/allowlist.proposed.json) is turned on for
 // that folder only (.claude/settings.local.json, merged), unless it would let an agent
 // run anything at all (a shell, sudo, rm, Bash(*)): then it stays the user's step.
-const WIDE_RULE = /^Bash(\((\*|sudo|su|rm|bash|sh|zsh|dash|dd|mkfs|chmod|chown|eval|exec)\b[^)]*\))?$|^Bash\(\*/i;
+// A rule is wide when it lets an agent run anything: Bash with no command, a shell
+// (bash, sh, eval…) or sudo in any form, or a destructive command (rm, dd, chmod…)
+// with a wildcard. The same command spelled out exactly (rm -r ~/x/site) is narrow.
+const ANY_RULE = /^Bash(\(\s*\*.*\))?$|^Bash\(\s*(sudo|su|bash|sh|zsh|dash|fish|eval|exec|env|xargs)\b/i;
+const HARM_RULE = /^Bash\(\s*(rm|dd|mkfs|chmod|chown|shred|truncate)\b/i;
+const wideRule = (r) => ANY_RULE.test(r) || (HARM_RULE.test(r) && /\*/.test(r));
+// Whatever an agent is allowed, it never edits Symbiot's own settings: that's where
+// what agents may do is kept, so an agent could widen its own permissions there.
+const GUARD = () => { const c = join(homedir(), ".config", "symbiot", "config.json"); return [`Edit(${c})`, `Write(${c})`]; };
 function installAllowlist(path) {
   let p; try { p = JSON.parse(readFileSync(join(path, ".symbiot", "allowlist.proposed.json"), "utf8")).permissions || {}; } catch { return null; }
   const list = (x) => (Array.isArray(x) ? x.filter((r) => typeof r === "string" && r.trim()).map((r) => r.trim()) : []);
   const allow = list(p.allow), deny = list(p.deny), dirs = list(p.additionalDirectories);
   if (!allow.length && !dirs.length) return null;
-  if (allow.some((r) => WIDE_RULE.test(r))) return null;
+  const wide = allow.filter(wideRule);
+  if (wide.length) return { refused: wide };
   const f = join(path, ".claude", "settings.local.json");
   let cur = {}; try { cur = JSON.parse(readFileSync(f, "utf8")); } catch {}
   const perm = cur.permissions || {}, merge = (a, b) => [...new Set([...list(a), ...b])];
-  cur.permissions = { ...perm, allow: merge(perm.allow, allow), deny: merge(perm.deny, deny), additionalDirectories: merge(perm.additionalDirectories, dirs) };
+  cur.permissions = { ...perm, allow: merge(perm.allow, allow), deny: merge(perm.deny, [...deny, ...GUARD()]), additionalDirectories: merge(perm.additionalDirectories, dirs) };
   try { mkdirSync(join(path, ".claude"), { recursive: true }); writeFileSync(f, JSON.stringify(cur, null, 2) + "\n", { mode: 0o600 }); } catch { return null; }
   return [`the allow list for this folder (${allow.length} rule${allow.length === 1 ? "" : "s"})`];
 }
-function grantFromStep(step, path = "") {
+function grantFromStep(step, path = "", notes = {}) {
   const t = String(step || "");
-  if (path && /allowlist\.proposed\.json|settings\.local\.json|press allow|\ballow list\b/i.test(t)) { const g = installAllowlist(path); if (g) return g; }
+  if (path && /allowlist\.proposed\.json|settings\.local\.json|press allow|\ballow list\b/i.test(t)) { const g = installAllowlist(path); if (g && g.refused) { notes.refused = g.refused; return null; } if (g) return g; }
   if (!/only you: a permission|only you: what (this|the) agent|\b(let|allow) (the )?agents?\b|\ballow (access|reading)\b/i.test(t)) return null;
   const got = [];
   const dir = (t.match(/(~\/[^\s,;)`'"]+|\/(?:home|Users|opt|srv|mnt|media|tmp)\/[^\s,;)`'"]+)/) || [])[1];
@@ -612,7 +665,7 @@ function answerQuestions(path, answers, opts = {}) {
   if (!path || !knownRun(path)) return { error: "No agent has run in that folder." };
   const open = new Map(agentQuestions(path, "").questions.map((x) => [qKey(x.q), x.q]));
   const rows = (Array.isArray(answers) ? answers : [])
-    .map((x) => ({ q: open.get(qKey(x && x.q)), a: String((x && x.a) || "").replace(/^\s*#+/gm, "").trim().slice(0, 2000) }))
+    .map((x) => ({ q: open.get(qKey(x && x.q)), a: String((x && x.a) || "").replace(/^\s*#+/gm, "").trim().slice(0, TASK_MAX) }))
     .filter((x) => x.q && x.a);
   if (!rows.length) return { error: "Pick or type at least one answer." };
   const prev = readSymbiot(path, "ANSWERS.md") || "# Answers from the user\nAnswers to the questions in QUESTIONS.md, newest last. Follow them; ask again in QUESTIONS.md if one is unclear.\n";
@@ -627,9 +680,18 @@ function answerQuestions(path, answers, opts = {}) {
   const youOpts = (q) => ((asked.get(qKey(q)) || {}).options || []).filter(yourStep).map((o) => o.split("🤖")[0]);
   const steps = rows.filter((x) => yourStep(x.a) || holdAnswer(x.a)).map((x) => yourStep(x.a) ? { step: stepText(x.a), named: x.a.split("🤖")[0] }
     : { step: (youOpts(x.q).map(stepText)[0] || x.a).trim(), named: [x.a, ...youOpts(x.q)].join(" ") });
-  const granted = [];
-  const yours = steps.map((s) => s.step).filter(Boolean).filter((st) => { const g = grantFromStep(st, path); if (g) granted.push(...g); return !g; });
+  const granted = [], notes = {};
+  let yours = steps.map((s) => s.step).filter(Boolean).filter((st) => { const g = grantFromStep(st, path, notes); if (g) granted.push(...g); return !g; });
   if (granted.length) out.granted = granted;
+  // A list too wide to turn on by a click: say which rules, tell the agent to ask for
+  // less, and don't leave it as the user's step (picking it again would do nothing).
+  if (notes.refused) {
+    const which = notes.refused.slice(0, 3).map((r) => "`" + r + "`").join(", ");
+    try { writeFileSync(join(path, ".symbiot", "ANSWERS.md"), readSymbiot(path, "ANSWERS.md").replace(/\s*$/, "\n") + `\n### Symbiot didn't turn your allow list on\nIt has ${which}, which would let you run anything (a shell, sudo, or a wildcard rm/dd/chmod). Write a narrower .symbiot/allowlist.proposed.json: each such command spelled out exactly, the paths it touches named, and ask again.\n_${day}_\n`); } catch {}
+    out.refused = notes.refused;
+    yours = yours.filter((st) => !/allowlist\.proposed\.json|settings\.local\.json|press allow|\ballow list\b/i.test(st));
+    out.note = `Not turned on: the list has ${which}, which would let an agent run anything. Your agent has been asked for a narrower one` + (opts.rerun ? " and is starting again." : ".");
+  }
   if (yours.length) {
     const step = yours.join(" "), files = namedFiles(steps.map((s) => s.named).join(" "), path);
     try { writeFileSync(join(path, ".symbiot", WAITING), JSON.stringify({ step, files: files.map((f) => ({ ...f, sig: fileSig(f.path) })), cmd: runCmd(path), at: Date.now(), rerun: !!opts.rerun })); } catch {}
@@ -642,6 +704,10 @@ function answerQuestions(path, answers, opts = {}) {
   if (out.granted) out.note = "Allowed " + out.granted.join(", ") + " for your agents" + (opts.rerun ? ", and carried on. " : ". ") + (out.note || "");
   return out;
 }
+// What a run left for Symbiot's memory (.symbiot/REMEMBER.json, handback.mjs):
+// shown on its block with Remember and Skip once it has stopped. [] when none.
+const FACTS = "REMEMBER.json";
+const factsOf = (path) => parseFacts(readSymbiot(path, FACTS));
 // The open tasks' titles in a held brief (TASKS.next.md), or null if nothing is held.
 function heldTasks(path) {
   const md = readSymbiot(path, HELD);
@@ -675,8 +741,9 @@ function agentsList() {
     let log = ""; try { log = readFileSync(e.log, "utf8"); } catch {}
     const { tail, work, progress } = workOf(e.path, log);
     const first = !seen.has(e.path); seen.add(e.path);
-    return { id: e.id, name: e.name, path: e.path, status: e.status, elapsed: (e.endedAt || Date.now()) - e.startedAt, exitCode: e.exitCode, tail, work, progress, changed: agentChanges(e.path, e.startedAt), ask: first ? agentQuestions(e.path, e.name) : null, held: first ? heldTasks(e.path) : null, waiting: first && e.status !== "running" ? waitingFor(e.path) : null, fromHeld: !!e.fromHeld };
+    const facts = first && e.status !== "running" ? factsOf(e.path) : [];
+    return { id: e.id, name: e.name, path: e.path, status: e.status, elapsed: (e.endedAt || Date.now()) - e.startedAt, exitCode: e.exitCode, tail, work, progress, changed: agentChanges(e.path, e.startedAt), ask: first ? agentQuestions(e.path, e.name) : null, held: first ? heldTasks(e.path) : null, waiting: first && e.status !== "running" ? waitingFor(e.path) : null, remember: facts.length ? facts : null, fromHeld: !!e.fromHeld };
   }).concat(earlierRuns());
 }
 
-export { withStream, workOf, HANDOFFS, HANDOFF_PROMPT, QUESTIONS_MAX, OPTIONS_SHOWN, IDEAS_SHOWN, shSingle, CLAUDE_CMD, ORCA_CLAUDE_CMD, handoffCmd, setHandoffCmd, grantAgent, grantRule, allowTool, claudeConnectors, withConnectors, linkedConnectors, connectorsLine, connectorsInfo, fillHandoff, runHandoff, blockedAgain, runningHandoff, loadRuns, earlierRuns, namedFiles, waitingFor, startWaiting, writeTasks, releaseHeldTasks, startHeldTasks, detectHandoffs, orcaHandoffCmd, migrateOrcaCmd, migrateClaudeCmd, track, agentChanges, parseQuestions, suggestionTarget, skipIdea, agentQuestions, answerQuestions, agentsList };
+export { FACTS, factsOf, knownRun, withStream, workOf, HANDOFFS, HANDOFF_PROMPT, QUESTIONS_MAX, OPTIONS_SHOWN, IDEAS_SHOWN, shSingle, CLAUDE_CMD, ORCA_CLAUDE_CMD, handoffCmd, setHandoffCmd, grantAgent, grantRule, allowTool, claudeConnectors, withConnectors, linkedConnectors, connectorsLine, connectorsInfo, fillHandoff, runHandoff, blockedAgain, runningHandoff, loadRuns, earlierRuns, namedFiles, waitingFor, startWaiting, writeTasks, droppedTasks, releaseHeldTasks, startHeldTasks, detectHandoffs, orcaHandoffCmd, migrateOrcaCmd, migrateClaudeCmd, track, agentChanges, parseQuestions, suggestionTarget, skipIdea, agentQuestions, answerQuestions, agentsList };

package/core.mjs

@@ -36,6 +36,12 @@ function saveConfig(cfg) {
 const TASKS_PATH = join(CONFIG_DIR, "tasks.json");
 function loadTasks() { try { return JSON.parse(readFileSync(TASKS_PATH, "utf8")); } catch { return []; } }
 function saveTasks(t) { try { mkdirSync(CONFIG_DIR, { recursive: true }); writeFileSync(TASKS_PATH, JSON.stringify(t, null, 2)); return true; } catch { return false; } }
+// How much a task holds: one line in TASKS.md, long enough for a handover or a
+// pasted list of steps (1000 cut the Jono email task off mid-sentence). Longer,
+// it keeps its whole text (full) and its line links to that (tasks.mjs addTask).
+const TASK_MAX = 4000;
+// A heading or a one-line summary: cut at a word and marked "…", never mid-word.
+const clipWords = (s, max) => { s = String(s || ""); return s.length > max ? s.slice(0, max - 1).replace(/\s+\S*$/, "") + "…" : s; };
 // Two wordings of one task: the same words once case, spacing and punctuation
 // are set aside (a colon for a bracket, `code` for code), or one is the other
 // with a clause more on the end. An extension only counts when the shorter one
@@ -48,7 +54,7 @@ function sameTask(a, b) {
   const x = taskWords(a), y = taskWords(b); if (!x || !y) return false;
   if (x === y) return true;
   const [s, l] = x.length < y.length ? [x, y] : [y, x];
-  return (s.split(" ").length >= 8 && l.startsWith(s + " ")) || nearTask(a, b) || sameAsk(a, b);
+  return (s.split(" ").length >= 8 && l.startsWith(s + " ")) || nearTask(a, b) || sameAsk(a, b) || spelledOut(a, b);
 }
 // Nearly the same task, two ways:
 // - nearly all the same words in the same order, 12+ words each ("…nothing
@@ -102,6 +108,24 @@ function sameAsk(a, b) {
   let both = 0; for (const w of x) if (y.has(w)) both++;
   return both / Math.min(x.size, y.size) >= ASK;
 }
+// A task spelled out in steps is the task it spells out: "A mail connector linked
+// in Symbiot still doesn't reach agent runs (Drive does now). Pass its tools
+// through…" and "In the symbiot repo: a mail connector linked in Symbiot still
+// doesn't reach agent runs, but the Drive connector now does. 1) Find where… 2)…".
+// The steps name much more (CONTRIBUTING.md, agentCmd), so the whole of it is
+// never the same ask; its first sentence, without "In the … repo:", is (sameAsk),
+// set against the other task or that one's first sentence. Stricter than sameAsk
+// on its own, as a first sentence is short: not when each has a word the other
+// hasn't ("a mail connector…" isn't "a calendar connector…").
+const STEPS = /(?:^|\s)1[.)]\s[\s\S]*\s2[.)]\s/;
+const firstSentence = (s) => { const m = String(s || "").match(/^(.*?[.!?])["'`)\]]*(?:\s|$)/s); return m ? m[1] : String(s || ""); };
+function bothAdd(a, b) { const x = askWords(a), y = askWords(b); return [...x].some((w) => !y.has(w)) && [...y].some((w) => !x.has(w)); }
+function spelledOut(a, b) {
+  const [s, l] = String(a || "").length < String(b || "").length ? [String(a || ""), String(b || "")] : [String(b || ""), String(a || "")];
+  if (!STEPS.test(l) || STEPS.test(s)) return false;
+  const head = firstSentence(l.split(/(?:^|\s)1[.)]\s/)[0].trim()).replace(/^in (?:the )?\S+ (?:repo|project|folder)\s*[:,]\s*/i, "");
+  return [s, firstSentence(s)].some((t) => sameAsk(head, t) && !bothAdd(head, t));
+}
 // One of each: near-duplicates collapse into the wording that says the most.
 function uniqueTasks(texts) {
   const out = [];
@@ -156,4 +180,4 @@ function repoState(repoPath) {
   return { branch, dirty, del, mod, add, stale, staleBy, behind };
 }
 
-export { VERSION, LATEST_VERSION, semverGt, REGISTRY, checkLatest, CONFIG_DIR, CONFIG_PATH, loadConfig, saveConfig, loadTasks, saveTasks, taskWords, sameTask, uniqueTasks, sh, hasCmd, chromeBinary, repoState };
+export { VERSION, LATEST_VERSION, semverGt, REGISTRY, checkLatest, CONFIG_DIR, CONFIG_PATH, loadConfig, saveConfig, loadTasks, saveTasks, TASK_MAX, clipWords, taskWords, sameTask, uniqueTasks, sh, hasCmd, chromeBinary, repoState };