symbiot 0.52.0 → 0.53.0

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 What each Symbiot release brought, newest first. When Approve bumps the version, it writes that release here from the tasks it approved, worded as release notes by your connected AI (or in the tasks' own words without one). The app shows the releases newer than yours under "What's new" when it offers an update, and once more after you update.
 
+## 0.53.0
+
+- **Agents work like Orca.** A Claude agent now just does the work, the way Claude does when you talk to it in Orca: no permission prompts, no "You" for a folder or a command. Symbiot's guard, which Claude Code runs before every action, still stops the few things only you do: pushing to main, force-pushing, publishing, deleting outside its folder, sudo, piping a script from the internet into a shell, reading your keys, changing Symbiot's settings. A stopped agent is told why and asks. Settings → Your agent → **Agents work like Orca** (on; off keeps allow lists).
+- **One conversation that goes on.** When you answer an agent, the same conversation resumes, so it carries on knowing everything it knew, instead of a new agent rereading a brief.
+- **Agents decide like a colleague.** They choose what can be undone themselves and say what they chose; they ask only about what can't be undone, costs money, goes out in your name or needs who you are, with their pick first.
+
+## 0.52.1
+
+- **Agents stop asking you for permission inside your work.** An agent reaches your knowledge folders from the start, and an ops agent your repos too. When it needs more and proposes a list that stays inside the folders you gave Symbiot, asks for nothing that could run anything, and doesn't publish or reach another machine, Symbiot turns it on by itself and the agent carries on: no question reaches you. Only a list that reaches outside your work (`~/.ssh`, `~/.config`, another machine) still asks, and it says why. Asks already waiting clear the same way.
+
 ## 0.52.0
 
 - **Your agents, on the Tasks screen.** No need to open Agents: a line at the top says where everything stands ("1 question for you · 1 ready for your OK · 2 at work"), and a blob per project shows what its agent did or is doing, what it asks you (its answers as buttons, or your own words), Review and approve when its work is ready, and the extra tasks it suggests, each with **+ task** or **Skip**. The liquid moves left to make room.

package/README.md

@@ -439,6 +439,27 @@ editor presets only open a tab and exit, so Symbiot can't see the agent you run
 in them. Send to repos stays disabled until its
 handoffs have started, so a double click can't send twice.
 
+### Agents work like Orca
+
+Talk to Symbiot and its agents just do the work, the way Claude does in Orca: a Claude
+run skips permission checks (`--dangerously-skip-permissions`), and when it asks you
+something, your answer goes back into **the same conversation** (`--resume`), so the
+agent carries on knowing everything it knew. Its brief tells it to decide what can be
+undone itself (the approach, names, which of two fixes) and say what it chose, and to
+ask only about what can't be undone, costs money, goes out in your name or needs who
+you are, with options and its pick first.
+
+What it still can't do is stopped by **Symbiot's guard** (`guard.mjs`), which Claude
+Code runs before every action, whatever the agent decided: pushing to main or master,
+force-pushing, publishing a package, deleting outside its folder (or `/`), sudo, piping
+a script from the internet into a shell, reading your SSH keys or cloud credentials,
+and changing Symbiot's own settings. A blocked agent is told why, and asks.
+
+Settings → Your agent → **Agents work like Orca** is on by default. Off, a run keeps
+its allow list, and an allow list it proposes is turned on by itself only when it stays
+inside your work: the folders you gave Symbiot, not `~/.ssh` or `~/.config`, nothing
+that could run anything, nothing that publishes or reaches another machine.
+
 ### Questions from your agent
 
 An agent working in your terminal or IDE stops to ask you things: which way to go,

package/agents.mjs

@@ -3,13 +3,15 @@
 // tab, and the questions an unattended agent leaves for the user.
 import { spawn } from "node:child_process";
 import { homedir } from "node:os";
-import { join, dirname } from "node:path";
+import { join, dirname, resolve, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 import { readFileSync, writeFileSync, mkdirSync, existsSync, openSync, writeSync, unlinkSync, readdirSync, statSync } from "node:fs";
 import { randomBytes, createHash } from "node:crypto";
 import { CONFIG_DIR, loadConfig, saveConfig, loadTasks, TASK_MAX, clipWords, sameTask, taskWords, sh, hasCmd } from "./core.mjs";
 import { parseRun, lastRunText } from "./work.mjs";
 import { parseFacts } from "./handover.mjs";
+import { scanRoots, repoPathMap } from "./scan.mjs";
+import { knowledgeFolders } from "./knowledge.mjs";
 
 const HANDOFFS = []; // live registry of agents Symbiot has handed work to
 // ---- hand a repo (+ its tasks) to the user's agent — generic, settings-based
@@ -139,7 +141,49 @@ function connectorsLine(tmpl = handoffCmd(), file, linked) {
 // For Settings → Handoff: the connectors, whether this command's runs get them, and
 // the sites linked in Symbiot that aren't Claude connectors (so runs can't use them).
 function connectorsInfo(file) { const conns = claudeConnectors("", file); return { claude: isClaudeCmd(handoffCmd()), list: conns.map(({ name, ready }) => ({ name, ready })), links: linkedConnectors(conns) }; }
-const fillHandoff = (tmpl, repoPath) => tmpl.replace(/\{dir\}/g, shSingle(repoPath)).replace(/\{prompt\}/g, escDq(HANDOFF_PROMPT));
+const fillHandoff = (tmpl, repoPath, prompt = HANDOFF_PROMPT) => tmpl.replace(/\{dir\}/g, shSingle(repoPath)).replace(/\{prompt\}/g, escDq(prompt));
+// ---- working like Orca --------------------------------------------------------------
+// In Orca you talk to Claude and it just does the work: permission checks skipped, one
+// conversation that goes on. Symbiot's Claude runs work the same way (config.agentTrust:
+// "full", the default; "ask" keeps the allow lists): --dangerously-skip-permissions, with
+// guard.mjs as a PreToolUse hook that stops the few things only the owner does (push to
+// main, publish, delete outside the folder, sudo, keys, Symbiot's settings), whatever the
+// agent decides. And an answer goes back into the same conversation (--resume), so the
+// agent that asked carries on knowing everything it knew.
+const GUARD_HOOK = fileURLToPath(new URL("./guard.mjs", import.meta.url));
+const GUARD_SETTINGS = join(CONFIG_DIR, "agent-guard.json");
+const trustFull = (cfg = loadConfig()) => cfg.agentTrust !== "ask";
+function guardSettings() {
+  const s = { hooks: { PreToolUse: [{ matcher: "Bash|Read|Edit|Write|MultiEdit|NotebookEdit|Grep|Glob", hooks: [{ type: "command", command: `node ${JSON.stringify(GUARD_HOOK)}` }] }] } };
+  try { mkdirSync(CONFIG_DIR, { recursive: true }); writeFileSync(GUARD_SETTINGS, JSON.stringify(s, null, 2) + "\n", { mode: 0o600 }); } catch {}
+  return GUARD_SETTINGS;
+}
+function withTrust(tmpl) {
+  if (!isClaudeCmd(tmpl) || !trustFull()) return tmpl;
+  let c = String(tmpl).replace(/\s--permission-mode\s+\S+/g, "");
+  if (!/--dangerously-skip-permissions\b/.test(c)) c += " --dangerously-skip-permissions";
+  if (!/--settings\b/.test(c)) c += ` --settings ${JSON.stringify(guardSettings())}`;
+  return c;
+}
+const SESSION = "session.json", RESUME_MAX = 8, RESUME_AGE = 2 * 86400000;
+const RESUME_PROMPT = "The user has answered: read the newest entries in .symbiot/ANSWERS.md and carry on with .symbiot/TASKS.md from where you were. Same rules as before.";
+function sessionOf(path) { try { return JSON.parse(readSymbiot(path, SESSION)) || null; } catch { return null; } }
+// Resume when an answer has come in since its last run, and the conversation is fresh enough
+function resumeFor(path) {
+  const s = sessionOf(path); if (!s || !s.id || (s.runs || 0) >= RESUME_MAX || Date.now() - (s.at || 0) > RESUME_AGE) return null;
+  let answered = 0; try { answered = statSync(join(path, ".symbiot", "ANSWERS.md")).mtimeMs; } catch {}
+  return answered > (s.at || 0) ? s : null;
+}
+function noteSession(path, code, resumed) {
+  const f = join(path, ".symbiot", SESSION);
+  let run = {}; try { run = parseRun(lastRunText(readSymbiot(path, "agent.log"))); } catch {}
+  if (code !== 0) {
+    if (resumed && /No conversation found|session .*not found/i.test(readSymbiot(path, "agent.log").slice(-2000))) { try { unlinkSync(f); } catch {} return "lost"; }
+    return null;
+  }
+  if (run.session) { const prev = sessionOf(path) || {}; try { writeFileSync(f, JSON.stringify({ id: run.session, at: Date.now(), runs: prev.id === run.session ? (prev.runs || 1) + 1 : 1 })); } catch {} }
+  return run.session || null;
+}
 // One agent per folder: two identical runs once started on the same repo 6s
 // apart and raced each other. The registry catches a second click in this
 // process; .symbiot/agent.pid catches another one (`symbiot push --open` while
@@ -159,15 +203,19 @@ function runHandoff(repoPath, { force = false } = {}) {
   let opts = {}; try { opts = JSON.parse(readSymbiot(repoPath, "handoff.json")) || {}; } catch {}
   const busy = runningHandoff(repoPath); if (busy) return { busy: true, id: busy.id || "", pid: busy.pid, auto: !!busy.auto };
   releaseHeldTasks(repoPath); // held for an agent another process started, which has since exited
-  tmpl = withStream(withConnectors(tmpl, repoPath));
+  tmpl = withStream(withTrust(withScope(withConnectors(tmpl, repoPath), repoPath)));
+  const resume = isClaudeCmd(tmpl) ? resumeFor(repoPath) : null;
+  const runCmd = resume ? tmpl + ` --resume ${resume.id}` : tmpl;
   if (!force) { const w = waitingFor(repoPath); if (w) { askedFor(repoPath); return { blocked: true, waiting: true, questions: 0, note: waitNote(w) }; } }
   const blocked = !force && blockedAgain(repoPath, tmpl); if (blocked) return blocked;
   try { unlinkSync(join(repoPath, ".symbiot", WAITING)); } catch {} // the step's done (or this is Start it anyway): this is the run it waited for
   const lock = join(repoPath, ".symbiot", LOCK);
   const env = opts.env && typeof opts.env === "object" ? Object.fromEntries(Object.entries(opts.env).map(([k, v]) => [k, String(v)])) : null;
-  const e = track(typeof opts.name === "string" && opts.name ? opts.name.slice(0, 80) : repoPath.split("/").pop(), fillHandoff(tmpl, repoPath), repoPath, (code) => {
+  const e = track(typeof opts.name === "string" && opts.name ? opts.name.slice(0, 80) : repoPath.split("/").pop(), fillHandoff(runCmd, repoPath, resume ? RESUME_PROMPT : HANDOFF_PROMPT), repoPath, (code) => {
+    if (noteSession(repoPath, code, !!resume) === "lost") { setTimeout(() => { try { runHandoff(repoPath, { force: true }); } catch {} }, 300); return; } // its conversation is gone: start afresh
     try { if (JSON.parse(readFileSync(lock, "utf8")).pid === e.pid) unlinkSync(lock); } catch {}
     noteBlocked(repoPath, tmpl, e.startedAt, code);
+    setTimeout(() => { try { autoAllow(repoPath); } catch {} }, 300); // a list it proposed inside your work: turned on, and on it goes
     startHeldTasks(repoPath); // tasks sent while it ran land now; start on them as that Send would have
   }, env);
   if (!e) return null;
@@ -673,6 +721,75 @@ function installAllowlist(path) {
   try { mkdirSync(join(path, ".claude"), { recursive: true }); writeFileSync(f, JSON.stringify(cur, null, 2) + "\n", { mode: 0o600 }); } catch { return null; }
   return [`the allow list for this folder (${allow.length} rule${allow.length === 1 ? "" : "s"})`];
 }
+// ---- the owner's work, and allow lists inside it ---------------------------------------
+// What the owner told Symbiot is their work: the folders it scans (Settings → Folders) and
+// their knowledge folders, but not a hidden folder at the top of their home (~/.ssh,
+// ~/.config: keys and settings), bar the folders Symbiot's own agents run in. An agent
+// reaches its knowledge folders from the start (withScope), and an allow list it proposes
+// that stays inside this work, asks for nothing wide, and doesn't publish or reach another
+// machine is turned on by itself when its run ends (autoAllow): no question for the user.
+const PUBLISH_RULE = /^Bash\(\s*(git push|git\s+-C\s+\S+\s+push|npm publish|yarn publish|pnpm publish|aws|gcloud|az|kubectl|docker|podman|terraform|ssh|scp|sftp|rsync|ftp|heroku|vercel|netlify|fly|flyctl)\b/i;
+function workRoots() {
+  const roots = new Set();
+  try { for (const r of scanRoots()) roots.add(r); } catch {}
+  try { for (const k of knowledgeFolders()) roots.add(k.path); } catch {}
+  return [...roots].filter(Boolean).map((r) => r.replace(/\/+$/, "") || "/");
+}
+function inWork(p, roots = workRoots()) {
+  if (!p) return false;
+  p = resolve(String(p).replace(/^~(?=\/|$)/, homedir()).replace(/[/*]+$/, "")) || "/";
+  const drafts = join(CONFIG_DIR, "drafts");
+  if (p === drafts || p.startsWith(drafts + "/")) return true;
+  if (!roots.some((r) => p === r || p.startsWith(r === "/" ? "/" : r + "/"))) return false;
+  const rel = relative(homedir(), p);
+  if (!rel.startsWith("..") && rel.split("/")[0].startsWith(".")) return false; // ~/.ssh, ~/.config…
+  return true;
+}
+// The paths a rule names: Read(/x/**), Bash(find /x:*), additionalDirectories' /x.
+const rulePaths = (r) => (String(r).match(/(?:~|\/)[^\s:*()"',]*/g) || []).filter((x) => x === "~" || x.length > 1);
+// Whether a proposed list can be turned on without asking: { ok } or { why }.
+function allowlistInWork(path) {
+  let p; try { p = JSON.parse(readFileSync(join(path, ".symbiot", "allowlist.proposed.json"), "utf8")).permissions || {}; } catch { return { why: "no list" }; }
+  const list = (x) => (Array.isArray(x) ? x.filter((r) => typeof r === "string" && r.trim()).map((r) => r.trim()) : []);
+  const allow = list(p.allow), dirs = list(p.additionalDirectories), roots = [...workRoots(), path];
+  const wide = allow.filter(wideRule); if (wide.length) return { why: "wide: " + wide.join(", ") };
+  const pub = allow.filter((r) => PUBLISH_RULE.test(r)); if (pub.length) return { why: "publishes or reaches another machine: " + pub.join(", ") };
+  const out = [...dirs, ...allow.flatMap(rulePaths)].filter((x) => !inWork(x, roots));
+  if (out.length) return { why: "outside your work: " + [...new Set(out)].slice(0, 3).join(", ") };
+  return { ok: true, allow, dirs };
+}
+// A run ended asking for its proposed list: inside the work, it's turned on, the
+// question is answered for the user, and the agent starts again. Once per proposal
+// (.symbiot/autoallow.json), so an agent can't loop on it; past that it's the user's.
+function autoAllow(path) {
+  if (!path || runningHandoff(path)) return null;
+  const f = join(path, ".symbiot", "allowlist.proposed.json"); let raw = ""; try { raw = readFileSync(f, "utf8"); } catch { return null; }
+  const q = agentQuestions(path, "").questions.find((x) => (x.options || []).some((o) => /allowlist\.proposed\.json/i.test(o)) || /allowlist\.proposed\.json/i.test(x.context || ""));
+  if (!q) return null;
+  const mark = join(path, ".symbiot", "autoallow.json"), d = digest(raw); let done = []; try { done = JSON.parse(readFileSync(mark, "utf8")); } catch {}
+  if (done.includes(d)) return null;
+  const v = allowlistInWork(path); if (!v.ok) return { asked: true, why: v.why };
+  const g = installAllowlist(path); if (!g || g.refused) return null;
+  try { writeFileSync(mark, JSON.stringify([...done, d].slice(-20))); } catch {}
+  const day = new Date().toISOString().slice(0, 10);
+  try { writeFileSync(join(path, ".symbiot", "ANSWERS.md"), (readSymbiot(path, "ANSWERS.md") || "# Answers from the user\nAnswers to the questions in QUESTIONS.md, newest last. Follow them; ask again in QUESTIONS.md if one is unclear.\n").replace(/\s*$/, "\n") + `\n### ${q.q}\nSymbiot turned your list on (it stays inside the user's work and asks for nothing wide): .claude/settings.local.json in this folder. Carry on.\n_answered ${day}_\n`); } catch {}
+  try { unlinkSync(join(path, ".symbiot", WAITING)); } catch {}
+  const e = runHandoff(path, { force: true });
+  return { allowed: true, rerun: e && e.id ? e.id : null };
+}
+// Every run that stopped asking for its list, now: on start and every so often, so
+// asks from before this version clear too.
+function autoAllowSweep() { const out = []; for (const r of loadRuns()) { try { const a = autoAllow(r.path); if (a && a.allowed) out.push(r.path); } catch {} } return out; }
+// Every agent reaches the owner's knowledge folders from the start; an ops run (no repo
+// of its own) their repos too, the way a person at their desk would.
+function withScope(tmpl, repoPath) {
+  if (!isClaudeCmd(tmpl)) return tmpl;
+  const dirs = new Set(); try { for (const k of knowledgeFolders()) dirs.add(k.path); } catch {}
+  if (/\/drafts\/act-[^/]+$/.test(String(repoPath || ""))) { try { for (const p of Object.values(repoPathMap() || {})) dirs.add(p); } catch {} }
+  dirs.delete(repoPath);
+  let cmd = tmpl; for (const d of dirs) if (d && !cmd.includes(`--add-dir "${d}"`)) cmd += ` --add-dir "${d}"`;
+  return cmd;
+}
 function grantFromStep(step, path = "", notes = {}) {
   const t = String(step || "");
   if (path && /allowlist\.proposed\.json|settings\.local\.json|press allow|\ballow list\b/i.test(t)) { const g = installAllowlist(path); if (g && g.refused) { notes.refused = g.refused; return null; } if (g) return g; }
@@ -771,4 +888,4 @@ function agentsList() {
   }).concat(earlierRuns());
 }
 
-export { FACTS, factsOf, knownRun, withStream, workOf, HANDOFFS, HANDOFF_PROMPT, QUESTIONS_MAX, OPTIONS_SHOWN, IDEAS_SHOWN, shSingle, CLAUDE_CMD, ORCA_CLAUDE_CMD, handoffCmd, setHandoffCmd, grantAgent, grantRule, allowTool, claudeConnectors, withConnectors, linkedConnectors, connectorsLine, connectorsInfo, fillHandoff, runHandoff, PARKED_NOTE, parkedPaths, isParked, parkLane, agentMissing, blockedAgain, runningHandoff, loadRuns, earlierRuns, namedFiles, waitingFor, startWaiting, writeTasks, droppedTasks, releaseHeldTasks, startHeldTasks, detectHandoffs, orcaHandoffCmd, migrateOrcaCmd, migrateClaudeCmd, track, agentChanges, parseQuestions, suggestionTarget, skipIdea, agentQuestions, answerQuestions, agentsList };
+export { FACTS, factsOf, knownRun, withStream, workOf, HANDOFFS, HANDOFF_PROMPT, QUESTIONS_MAX, OPTIONS_SHOWN, IDEAS_SHOWN, shSingle, CLAUDE_CMD, ORCA_CLAUDE_CMD, handoffCmd, setHandoffCmd, grantAgent, grantRule, allowTool, claudeConnectors, withConnectors, linkedConnectors, connectorsLine, connectorsInfo, fillHandoff, runHandoff, PARKED_NOTE, parkedPaths, isParked, parkLane, agentMissing, blockedAgain, runningHandoff, loadRuns, earlierRuns, namedFiles, waitingFor, startWaiting, writeTasks, droppedTasks, releaseHeldTasks, startHeldTasks, detectHandoffs, orcaHandoffCmd, migrateOrcaCmd, migrateClaudeCmd, track, agentChanges, parseQuestions, suggestionTarget, skipIdea, agentQuestions, answerQuestions, agentsList , autoAllow, autoAllowSweep, allowlistInWork, inWork, withScope , withTrust, resumeFor, noteSession, trustFull, GUARD_SETTINGS };

package/guard.mjs

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+// The guard: what an agent working "like Orca" (permission checks skipped, so it just
+// does the work) still can't do. Claude Code runs this before every tool call (a
+// PreToolUse hook, from the settings Symbiot passes the run), and a call it blocks
+// never happens, whatever the agent was told or decided. The list is short on purpose:
+// the things only the owner should do, or that can't be undone.
+//   - push to main/master, or force-push; publish a package
+//   - delete outside the agent's own folder, or wipe a disk
+//   - sudo, or pipe something from the internet into a shell
+//   - read SSH keys or cloud credentials; change Symbiot's own settings
+// judge(tool, input, { cwd, home }) → null (go ahead) or { why }.
+import { resolve, join, relative } from "node:path";
+import { homedir } from "node:os";
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const SECRET = [".ssh", ".gnupg", ".aws", ".azure", ".kube", ".docker/config.json", ".config/gcloud", ".config/gh/hosts.yml", ".netrc", ".npmrc", ".pypirc", ".git-credentials"];
+const under = (p, d) => p === d || p.startsWith(d.endsWith("/") ? d : d + "/");
+const expand = (p, home, cwd) => resolve(cwd, String(p).replace(/^~(?=\/|$)/, home).replace(/^\$HOME(?=\/|$)/, home).replace(/^\$\{HOME\}(?=\/|$)/, home));
+function secretPath(p, home) { return SECRET.some((s) => under(p, join(home, s))); }
+function symbiotConfig(p, home) { return p === join(home, ".config", "symbiot", "config.json"); }
+
+// the branch a bare `git push` pushes: the one checked out in cwd
+function currentBranch(cwd) { try { return execFileSync("git", ["-C", cwd, "rev-parse", "--abbrev-ref", "HEAD"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim(); } catch { return ""; } }
+
+function judgeBash(cmd, { cwd, home, branch }) {
+  const c = String(cmd || "");
+  // each simple command on its own (a; b && c | d)
+  for (const part of c.split(/&&|\|\||;|\n/)) {
+    const s = part.trim(); if (!s) continue;
+    const w = s.split(/\s+/);
+    if (/^(sudo|su|doas)$/.test(w[0])) return { why: "sudo: only you run things as root" };
+    if (/^(shutdown|reboot|poweroff|halt)$/.test(w[0])) return { why: "shutting the computer down is yours to do" };
+    if (/^(mkfs(\.\w+)?|fdisk|parted|wipefs)$/.test(w[0]) || (/^dd$/.test(w[0]) && /\bof=\/dev\//.test(s))) return { why: "that writes a disk directly" };
+    if (/^git$/.test(w[0]) || /^git\s/.test(s)) {
+      const args = w.slice(1).filter((x, i, a) => !(a[i - 1] === "-C" || x === "-C"));
+      if (args[0] === "push") {
+        if (args.some((a) => /^(-f|--force|--force-with-lease)(=|$)/.test(a) || /^\+/.test(a))) return { why: "force-pushing rewrites history others may have" };
+        const refs = args.slice(1).filter((a) => !a.startsWith("-"));
+        const target = refs.length >= 2 ? refs[refs.length - 1].split(":").pop() : branch;
+        if (/^(main|master)$/.test(target || "")) return { why: "pushing to " + target + ": changes go on a branch and a PR (Approve), never straight to " + target };
+      }
+    }
+    if (/^(npm|yarn|pnpm|bun)$/.test(w[0]) && w[1] === "publish") return { why: "publishing a package is yours to do (Approve ships it)" };
+    if (/^(twine|cargo|gem|poetry)$/.test(w[0]) && /\b(upload|publish|push)\b/.test(s)) return { why: "publishing a package is yours to do" };
+    if (/^rm$/.test(w[0])) {
+      const paths = w.slice(1).filter((a) => !a.startsWith("-"));
+      for (const p of paths) {
+        const abs = expand(p, home, cwd);
+        if (abs === "/" || abs === home || /^\/(\*|bin|boot|dev|etc|lib|lib64|proc|root|sbin|sys|usr|var)(\/|$)/.test(abs)) return { why: "deleting " + p + " can't be undone" };
+        if (!under(abs, cwd) && !under(abs, "/tmp") && !under(abs, join(home, ".cache"))) return { why: "deleting outside this folder (" + p + "): ask for it" };
+      }
+    }
+    if (/^(cat|less|more|head|tail|cp|scp|base64|xxd|strings|grep|rg|sed|awk)$/.test(w[0])) {
+      for (const p of w.slice(1).filter((a) => !a.startsWith("-"))) { if (secretPath(expand(p, home, cwd), home)) return { why: "your keys and cloud credentials stay yours" }; }
+    }
+    if (/(^|\s)(>|>>|tee|sed\s+-i)\s*\S*\.config\/symbiot\/config\.json/.test(s)) return { why: "Symbiot's own settings are yours to change" };
+  }
+  if (/\b(curl|wget)\b[^|]*\|\s*(sudo\s+)?(ba|z|da)?sh\b/.test(c)) return { why: "running a script straight from the internet" };
+  return null;
+}
+
+function judge(tool, input = {}, { cwd = process.cwd(), home = homedir(), branch } = {}) {
+  const t = String(tool || "");
+  if (t === "Bash") return judgeBash(input.command, { cwd, home, branch: branch != null ? branch : currentBranch(cwd) });
+  const p = input.file_path || input.path || input.notebook_path;
+  if (!p) return null;
+  const abs = expand(p, home, cwd);
+  if (secretPath(abs, home)) return { why: "your keys and cloud credentials stay yours" };
+  if (/^(Edit|Write|MultiEdit|NotebookEdit)$/.test(t) && symbiotConfig(abs, home)) return { why: "Symbiot's own settings are yours to change" };
+  return null;
+}
+
+// As a hook: Claude Code passes the call as JSON on stdin; exit 2 blocks it, and what's
+// on stderr goes back to the agent as the reason (so it can ask, or do it another way).
+const main = process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (main) {
+  let raw = ""; try { raw = readFileSync(0, "utf8"); } catch {}
+  let ev = {}; try { ev = JSON.parse(raw); } catch {}
+  const r = judge(ev.tool_name, ev.tool_input || {}, { cwd: ev.cwd || process.cwd() });
+  if (r) { process.stderr.write("Blocked by Symbiot's guard: " + r.why + ". If it's needed, ask the user in .symbiot/QUESTIONS.md with options.\n"); process.exit(2); }
+  process.exit(0);
+}
+
+export { judge, judgeBash, relative };

package/handover.mjs

@@ -24,7 +24,7 @@ function handoverRules(lanes = [], here = "") {
 }
 // The rule for options in QUESTIONS.md: the user gets only what no agent can do,
 // and the option says which kind it is.
-const ONLY_YOU = "- Only what no agent can do is the user's: their body (a phone in their hand, a cable, which network they're on), their identity or secrets (signing in, a 2FA code, a token from a provider's console) or a decision that's theirs (closing an account, spending money, sending something in their name). Start such an option with `👤 You (only you: <which>):`, e.g. `👤 You (only you: your Meta token): paste it into .env`. Anything an agent could do, yours or another lane's, is never a 👤 step: do it, or hand it over. An option where picking it is enough starts with `🤖 Agent:`. Tag actions only: an option that just reports what the user saw or decides (`it notified me`, `not tried yet`) gets no tag. A permission your run doesn't have (a command, a folder) is never a chore for the user: write the rules, as narrow as the task needs, to `.symbiot/allowlist.proposed.json` (`{\"permissions\": {\"allow\": [...], \"deny\": [...], \"additionalDirectories\": [...]}}`) and offer `👤 You (only you: a permission): allow the list in .symbiot/allowlist.proposed.json`. Picking it in Symbiot turns it on for this folder and runs you again; don't ask them to copy files or run claude in a terminal for it.";
+const ONLY_YOU = "- Only what no agent can do is the user's: their body (a phone in their hand, a cable, which network they're on), their identity or secrets (signing in, a 2FA code, a token from a provider's console) or a decision that's theirs (closing an account, spending money, sending something in their name). Start such an option with `👤 You (only you: <which>):`, e.g. `👤 You (only you: your Meta token): paste it into .env`. Anything an agent could do, yours or another lane's, is never a 👤 step: do it, or hand it over. An option where picking it is enough starts with `🤖 Agent:`. Tag actions only: an option that just reports what the user saw or decides (`it notified me`, `not tried yet`) gets no tag. A permission your run doesn't have (a command, a folder) is never a chore for the user. Write the rules, as narrow as the task needs, to `.symbiot/allowlist.proposed.json` (`{\"permissions\": {\"allow\": [...], \"deny\": [...], \"additionalDirectories\": [...]}}`), ask for it in QUESTIONS.md with the option `👤 You (only you: a permission): allow the list in .symbiot/allowlist.proposed.json`, and stop. If it stays inside the user's work (the folders they gave Symbiot, not ~/.ssh or ~/.config), asks for nothing wide, and doesn't publish or reach another machine, Symbiot turns it on by itself and runs you again: no question reaches the user. Their knowledge folders are already yours to read. Never ask them to copy files or run claude in a terminal for it. Decide what can be undone yourself, as a trusted colleague would: the approach, names, which of two fixes, how to lay files out; pick, do it, and say what you chose and why in your last message. Ask only about what can't be undone, costs money, goes out in the user's name, or needs who they are, and then give 2–3 options with your pick first, marked (recommended). Their answer comes back into this same conversation, so you'll remember everything when it does. Symbiot's guard stops the few things only the user does (pushing to main, publishing, deleting outside your folder, sudo, their keys); if it stops you, ask, don't work around it.";
 
 // What a run hands back to Symbiot itself (handback.mjs reads it): facts for
 // memory, and emails that wait on a reply, which Symbiot then watches for; and

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "symbiot",
-  "version": "0.52.0",
-  "description": "Your week, written from your real work. Reads your local git and writes it up with the AI of your choice — Claude, OpenAI, Gemini, or a local model.",
+  "version": "0.53.0",
+  "description": "Your week, written from your real work. Reads your local git and writes it up with the AI of your choice \u2014 Claude, OpenAI, Gemini, or a local model.",
   "type": "module",
   "bin": {
     "symbiot": "index.mjs"
@@ -41,7 +41,8 @@
     "CHANGELOG.md",
     "LICENSE",
     "fonts",
-    "mapknn.mjs"
+    "mapknn.mjs",
+    "guard.mjs"
   ],
   "engines": {
     "node": ">=18"
@@ -74,7 +75,7 @@
     "@anthropic-ai/sdk": "^0.128.0"
   },
   "scripts": {
-    "test": "node test/load.mjs && node test/fixtures.mjs && node test/links.mjs && node test/post.mjs && node test/peek.mjs && node test/mind.mjs && node test/knowledge.mjs && node test/checks.mjs &&node test/lanes.mjs && node test/handback.mjs && node test/reports.mjs && node test/sandbox.mjs && node test/adapt.mjs && node test/work.mjs && node test/mapknn.mjs && node test/paths.mjs && node test/smoke.mjs && node test/app.mjs && node test/install.mjs",
+    "test": "node test/load.mjs && node test/fixtures.mjs && node test/links.mjs && node test/post.mjs && node test/peek.mjs && node test/mind.mjs && node test/knowledge.mjs && node test/checks.mjs &&node test/lanes.mjs && node test/handback.mjs && node test/autoallow.mjs && node test/guard.mjs && node test/reports.mjs && node test/sandbox.mjs && node test/adapt.mjs && node test/work.mjs && node test/mapknn.mjs && node test/paths.mjs && node test/smoke.mjs && node test/app.mjs && node test/install.mjs",
     "lint": "eslint ."
   },
   "devDependencies": {

package/server.mjs

@@ -12,7 +12,7 @@ import { createServer } from "node:http";
 import { randomBytes } from "node:crypto";
 import { EMBEDDED_UI } from "./ui.mjs";
 import { VERSION, LATEST_VERSION, REGISTRY, semverGt, checkLatest, CONFIG_PATH, loadConfig, saveConfig, loadTasks, hasCmd, chromeBinary } from "./core.mjs";
-import { shSingle, handoffCmd, setHandoffCmd, grantAgent, runHandoff, track, detectHandoffs, connectorsInfo, answerQuestions, skipIdea, agentsList, startWaiting, parkLane, parkedPaths } from "./agents.mjs";
+import { shSingle, handoffCmd, setHandoffCmd, grantAgent, runHandoff, track, detectHandoffs, connectorsInfo, answerQuestions, skipIdea, agentsList, startWaiting, parkLane, parkedPaths, autoAllowSweep, trustFull } from "./agents.mjs";
 import { PROVIDERS, resolveProvider, connectProvider, detectHardware, recommendModels, hasOllama, ollamaInstall, ensureOllama, useOllamaModel } from "./ai.mjs";
 import { SCAN, SCAN_TIMEOUT_MS, scanRoots, scanHome, addScanRoot, removeScanRoot, buildMap, nodeDetail, repoPathMap } from "./scan.mjs";
 import { computeDrift } from "./drift.mjs";
@@ -245,6 +245,8 @@ async function startApp({ bin, since = 7, all = false, c = PLAIN_COLOURS } = {})
       if (u.pathname === "/api/knowledge/search") return json(res, { hits: searchKnowledge(u.searchParams.get("q") || "", { examples: u.searchParams.get("examples") === "1" }) });
       if (u.pathname === "/api/agentcfg") { const d = detectHandoffs(); return json(res, { cmd: handoffCmd(), agents: d.agents, editors: d.editors, connectors: connectorsInfo() }); }
       if (u.pathname === "/api/agentcmd" && req.method === "POST") { const b = await readBody(req); return json(res, setHandoffCmd(b.cmd)); }
+      if (u.pathname === "/api/agent/trust") return json(res, { full: trustFull() });
+      if (u.pathname === "/api/agent/trust/set" && req.method === "POST") { const b = await readBody(req); const cfg = loadConfig(); if (b.full) delete cfg.agentTrust; else cfg.agentTrust = "ask"; saveConfig(cfg); return json(res, { full: trustFull() }); }
       if (u.pathname === "/api/agent/grant" && req.method === "POST") { const b = await readBody(req); return json(res, grantAgent({ tool: b.tool, dir: b.dir })); }
       if (u.pathname === "/api/open" && req.method === "POST") { const b = await readBody(req); const e = runHandoff(String(b.path || ""), { force: !!b.force }); return json(res, { opened: !!e && !e.busy && !e.blocked, busy: !!(e && e.busy), auto: !!(e && e.auto), blocked: !!(e && e.blocked), note: (e && e.note) || "", id: (e && e.id) || "" }); }
       if (u.pathname === "/api/setup-local" && req.method === "POST") {
@@ -424,6 +426,9 @@ async function startApp({ bin, since = 7, all = false, c = PLAIN_COLOURS } = {})
   startPhone(); // Watch on your phone: the computer listens if it's switched on, the phone asks if it's paired
   setInterval(() => { try { startWaiting(); } catch {} }, 20000).unref(); // a run that waits for your step starts once the file it names changes
   setInterval(() => { try { lanesTick(); } catch {} }, 20000).unref(); // agents hand work to other lanes, and hear back when it's done
+  // an agent's allow list that stays inside your work is turned on by itself, and the agent carries on
+  setTimeout(() => { try { autoAllowSweep(); } catch {} }, 4000).unref();
+  setInterval(() => { try { autoAllowSweep(); } catch {} }, 20000).unref();
   // knowledge folders: changed files re-read (a stat per file when nothing changed), then checked again for where two files disagree (checks.mjs)
   const knowTick = () => { try { const r = knowledgeTick(); if (r && (r.read || r.removed || !checksState().at)) runChecks(); } catch {} };
   setTimeout(knowTick, 5000).unref(); setInterval(knowTick, 3 * 60 * 1000).unref();

package/ui.mjs

@@ -929,6 +929,7 @@ body.lq-light .btip .bta button:not(.quiet){background:#151A21;color:#FFFFFF}
 <h3 class="ssh">Hand off to your agent when you "Send to repos"</h3>
 <input id="agentcmd" type="text" placeholder="e.g.  aider --message &quot;{prompt}&quot; --yes   ·   code {dir}   ·   leave blank to just write the file">
 <div class="note muted">Runs in each repo after tasks are written. Use <b>{dir}</b> = repo path, <b>{prompt}</b> = the task instruction. Works with any agent or editor &mdash; it's your command.</div>
+<label class="check swl" style="margin-top:12px"><input type="checkbox" class="sw" id="agenttrust" checked> <span>Agents work like Orca: they just do it. Symbiot's guard still stops pushing to main, publishing, deleting outside their folder, sudo, your keys and Symbiot's settings. Off: they ask before anything outside their allow list.</span></label>
 <div id="agentpresets" style="margin-top:8px"></div>
 <div class="note muted" id="agentconnectors"></div>
 <div id="grantbox" style="margin-top:10px">
@@ -1951,6 +1952,7 @@ el.querySelectorAll('.bdraft').forEach(function(btn){btn.addEventListener('click
 api('/api/watch/draft',{id:n.id}).then(function(x){btn.disabled=false;if(!x||x.error){boardMsg('err',esc((x&&x.error)||'failed'));return;}boardMsg('ok',x.chat?DRAFTING_CHAT:x.social?DRAFTING_SOCIAL:DRAFTING);loadWatchUI();}).catch(function(e){btn.disabled=false;boardMsg('err',esc(String((e&&e.message)||e)));});});});}
 wire(el);wire($('boardtalk'));wire($('bsov'));BWIRE=wire;}
 $('boardrefresh').addEventListener('click',loadBoard);
+var atr=$('agenttrust');if(atr&&atr.addEventListener){api('/api/agent/trust').then(function(r){if(r)atr.checked=!!r.full;}).catch(function(){});atr.addEventListener('change',function(){api('/api/agent/trust/set',{full:atr.checked}).then(function(r){if(r)atr.checked=!!r.full;});});}
 var bw=$('boardwin');if(bw&&bw.querySelectorAll)bw.querySelectorAll('button').forEach(function(b){b.addEventListener('click',function(){BOARDH=+b.getAttribute('data-h')||24;bw.querySelectorAll('button').forEach(function(x){x.setAttribute('aria-checked',x===b?'true':'false');});loadBoard();});});
 // A web page, mapped by itself in the hidden browser (headless.mjs): no capture,
 // no dragging. It takes a few seconds, so the button says so meanwhile.

package/work.mjs

@@ -53,6 +53,7 @@ function parseRun(text) {
   const byId = new Map(), tasks = new Map(); let thinking = false;
   for (const e of events) {
     const at = e.timestamp ? Date.parse(e.timestamp) : null;
+    if (e.session_id && !out.session) out.session = String(e.session_id);
     if (e.type === "system" && e.subtype === "init") { out.model = String(e.model || ""); continue; }
     if (e.type === "assistant" && e.message && Array.isArray(e.message.content)) {
       for (const b of e.message.content) {