symbiot 0.53.0 → 0.53.1

package/CHANGELOG.md

@@ -2,9 +2,13 @@
 
 What each Symbiot release brought, newest first. When Approve bumps the version, it writes that release here from the tasks it approved, worded as release notes by your connected AI (or in the tasks' own words without one). The app shows the releases newer than yours under "What's new" when it offers an update, and once more after you update.
 
+## 0.53.1
+
+- **Named for Symbiot.** Agents working on their own is **Symbiosis** (Settings → Your agent); the guard that stops what only you do is **the membrane**; your answer going back into the same conversation is **one mind**; agents deciding what can be undone themselves is **instinct**. Same behaviour, each with what it does spelled out next to it.
+
 ## 0.53.0
 
-- **Agents work like Orca.** A Claude agent now just does the work, the way Claude does when you talk to it in Orca: no permission prompts, no "You" for a folder or a command. Symbiot's guard, which Claude Code runs before every action, still stops the few things only you do: pushing to main, force-pushing, publishing, deleting outside its folder, sudo, piping a script from the internet into a shell, reading your keys, changing Symbiot's settings. A stopped agent is told why and asks. Settings → Your agent → **Agents work like Orca** (on; off keeps allow lists).
+- **Agents work on their own.** A Claude agent now just does the work: no permission prompts, no "You" for a folder or a command. Symbiot's guard, which Claude Code runs before every action, still stops the few things only you do: pushing to main, force-pushing, publishing, deleting outside its folder, sudo, piping a script from the internet into a shell, reading your keys, changing Symbiot's settings. A stopped agent is told why and asks. Settings → Your agent → **Agents work on their own** (on; off keeps allow lists).
 - **One conversation that goes on.** When you answer an agent, the same conversation resumes, so it carries on knowing everything it knew, instead of a new agent rereading a brief.
 - **Agents decide like a colleague.** They choose what can be undone themselves and say what they chose; they ask only about what can't be undone, costs money, goes out in your name or needs who you are, with their pick first.
 

package/README.md

@@ -439,26 +439,29 @@ editor presets only open a tab and exit, so Symbiot can't see the agent you run
 in them. Send to repos stays disabled until its
 handoffs have started, so a double click can't send twice.
 
-### Agents work like Orca
-
-Talk to Symbiot and its agents just do the work, the way Claude does in Orca: a Claude
-run skips permission checks (`--dangerously-skip-permissions`), and when it asks you
-something, your answer goes back into **the same conversation** (`--resume`), so the
-agent carries on knowing everything it knew. Its brief tells it to decide what can be
-undone itself (the approach, names, which of two fixes) and say what it chose, and to
-ask only about what can't be undone, costs money, goes out in your name or needs who
-you are, with options and its pick first.
-
-What it still can't do is stopped by **Symbiot's guard** (`guard.mjs`), which Claude
-Code runs before every action, whatever the agent decided: pushing to main or master,
-force-pushing, publishing a package, deleting outside its folder (or `/`), sudo, piping
-a script from the internet into a shell, reading your SSH keys or cloud credentials,
-and changing Symbiot's own settings. A blocked agent is told why, and asks.
-
-Settings → Your agent → **Agents work like Orca** is on by default. Off, a run keeps
-its allow list, and an allow list it proposes is turned on by itself only when it stays
-inside your work: the folders you gave Symbiot, not `~/.ssh` or `~/.config`, nothing
-that could run anything, nothing that publishes or reaches another machine.
+### Symbiosis: agents work on their own
+
+Talk to Symbiot and its agents just do the work. A Claude run skips permission checks
+(`--dangerously-skip-permissions`); three things make that safe and useful:
+
+- **The membrane** (`guard.mjs`) lets the work through and stops the few things only
+  you do. Claude Code runs it before every action, whatever the agent decided:
+  pushing to main or master, force-pushing, publishing a package, deleting outside its
+  folder (or `/`), sudo, piping a script from the internet into a shell, reading your
+  SSH keys or cloud credentials, and changing Symbiot's own settings. A stopped agent
+  is told why, and asks.
+- **One mind.** When an agent asks you something, your answer goes back into the same
+  conversation (`--resume`), so it carries on knowing everything it knew. It starts
+  afresh after 8 runs or 2 days.
+- **Instinct.** Its brief tells it to decide what can be undone itself (the approach,
+  names, which of two fixes) and say what it chose, and to ask only about what can't be
+  undone, costs money, goes out in your name or needs who you are, with options and its
+  pick first.
+
+Settings → Your agent → **Symbiosis** is on by default. Off, a run keeps its allow
+list, and an allow list it proposes is turned on by itself only when it stays inside
+your work: the folders you gave Symbiot, not `~/.ssh` or `~/.config`, nothing that
+could run anything, nothing that publishes or reaches another machine.
 
 ### Questions from your agent
 

package/agents.mjs

@@ -142,9 +142,9 @@ function connectorsLine(tmpl = handoffCmd(), file, linked) {
 // the sites linked in Symbiot that aren't Claude connectors (so runs can't use them).
 function connectorsInfo(file) { const conns = claudeConnectors("", file); return { claude: isClaudeCmd(handoffCmd()), list: conns.map(({ name, ready }) => ({ name, ready })), links: linkedConnectors(conns) }; }
 const fillHandoff = (tmpl, repoPath, prompt = HANDOFF_PROMPT) => tmpl.replace(/\{dir\}/g, shSingle(repoPath)).replace(/\{prompt\}/g, escDq(prompt));
-// ---- working like Orca --------------------------------------------------------------
-// In Orca you talk to Claude and it just does the work: permission checks skipped, one
-// conversation that goes on. Symbiot's Claude runs work the same way (config.agentTrust:
+// ---- agents work on their own --------------------------------------------------------
+// Talk to an agent and it just does the work: permission checks skipped, one
+// conversation that goes on. Symbiot's Claude runs work that way (config.agentTrust:
 // "full", the default; "ask" keeps the allow lists): --dangerously-skip-permissions, with
 // guard.mjs as a PreToolUse hook that stops the few things only the owner does (push to
 // main, publish, delete outside the folder, sudo, keys, Symbiot's settings), whatever the

package/guard.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// The guard: what an agent working "like Orca" (permission checks skipped, so it just
+// The guard: what an agent working on its own (permission checks skipped, so it just
 // does the work) still can't do. Claude Code runs this before every tool call (a
 // PreToolUse hook, from the settings Symbiot passes the run), and a call it blocks
 // never happens, whatever the agent was told or decided. The list is short on purpose:
@@ -79,7 +79,7 @@ if (main) {
   let raw = ""; try { raw = readFileSync(0, "utf8"); } catch {}
   let ev = {}; try { ev = JSON.parse(raw); } catch {}
   const r = judge(ev.tool_name, ev.tool_input || {}, { cwd: ev.cwd || process.cwd() });
-  if (r) { process.stderr.write("Blocked by Symbiot's guard: " + r.why + ". If it's needed, ask the user in .symbiot/QUESTIONS.md with options.\n"); process.exit(2); }
+  if (r) { process.stderr.write("Blocked by Symbiot's membrane: " + r.why + ". If it's needed, ask the user in .symbiot/QUESTIONS.md with options.\n"); process.exit(2); }
   process.exit(0);
 }
 

package/handover.mjs

@@ -24,7 +24,7 @@ function handoverRules(lanes = [], here = "") {
 }
 // The rule for options in QUESTIONS.md: the user gets only what no agent can do,
 // and the option says which kind it is.
-const ONLY_YOU = "- Only what no agent can do is the user's: their body (a phone in their hand, a cable, which network they're on), their identity or secrets (signing in, a 2FA code, a token from a provider's console) or a decision that's theirs (closing an account, spending money, sending something in their name). Start such an option with `👤 You (only you: <which>):`, e.g. `👤 You (only you: your Meta token): paste it into .env`. Anything an agent could do, yours or another lane's, is never a 👤 step: do it, or hand it over. An option where picking it is enough starts with `🤖 Agent:`. Tag actions only: an option that just reports what the user saw or decides (`it notified me`, `not tried yet`) gets no tag. A permission your run doesn't have (a command, a folder) is never a chore for the user. Write the rules, as narrow as the task needs, to `.symbiot/allowlist.proposed.json` (`{\"permissions\": {\"allow\": [...], \"deny\": [...], \"additionalDirectories\": [...]}}`), ask for it in QUESTIONS.md with the option `👤 You (only you: a permission): allow the list in .symbiot/allowlist.proposed.json`, and stop. If it stays inside the user's work (the folders they gave Symbiot, not ~/.ssh or ~/.config), asks for nothing wide, and doesn't publish or reach another machine, Symbiot turns it on by itself and runs you again: no question reaches the user. Their knowledge folders are already yours to read. Never ask them to copy files or run claude in a terminal for it. Decide what can be undone yourself, as a trusted colleague would: the approach, names, which of two fixes, how to lay files out; pick, do it, and say what you chose and why in your last message. Ask only about what can't be undone, costs money, goes out in the user's name, or needs who they are, and then give 2–3 options with your pick first, marked (recommended). Their answer comes back into this same conversation, so you'll remember everything when it does. Symbiot's guard stops the few things only the user does (pushing to main, publishing, deleting outside your folder, sudo, their keys); if it stops you, ask, don't work around it.";
+const ONLY_YOU = "- Only what no agent can do is the user's: their body (a phone in their hand, a cable, which network they're on), their identity or secrets (signing in, a 2FA code, a token from a provider's console) or a decision that's theirs (closing an account, spending money, sending something in their name). Start such an option with `👤 You (only you: <which>):`, e.g. `👤 You (only you: your Meta token): paste it into .env`. Anything an agent could do, yours or another lane's, is never a 👤 step: do it, or hand it over. An option where picking it is enough starts with `🤖 Agent:`. Tag actions only: an option that just reports what the user saw or decides (`it notified me`, `not tried yet`) gets no tag. A permission your run doesn't have (a command, a folder) is never a chore for the user. Write the rules, as narrow as the task needs, to `.symbiot/allowlist.proposed.json` (`{\"permissions\": {\"allow\": [...], \"deny\": [...], \"additionalDirectories\": [...]}}`), ask for it in QUESTIONS.md with the option `👤 You (only you: a permission): allow the list in .symbiot/allowlist.proposed.json`, and stop. If it stays inside the user's work (the folders they gave Symbiot, not ~/.ssh or ~/.config), asks for nothing wide, and doesn't publish or reach another machine, Symbiot turns it on by itself and runs you again: no question reaches the user. Their knowledge folders are already yours to read. Never ask them to copy files or run claude in a terminal for it. Decide what can be undone yourself, as a trusted colleague would: the approach, names, which of two fixes, how to lay files out; pick, do it, and say what you chose and why in your last message. Ask only about what can't be undone, costs money, goes out in the user's name, or needs who they are, and then give 2–3 options with your pick first, marked (recommended). Their answer comes back into this same conversation, so you'll remember everything when it does. Symbiot's membrane (its guard) stops the few things only the user does (pushing to main, publishing, deleting outside your folder, sudo, their keys); if it stops you, ask, don't work around it.";
 
 // What a run hands back to Symbiot itself (handback.mjs reads it): facts for
 // memory, and emails that wait on a reply, which Symbiot then watches for; and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "symbiot",
-  "version": "0.53.0",
+  "version": "0.53.1",
   "description": "Your week, written from your real work. Reads your local git and writes it up with the AI of your choice \u2014 Claude, OpenAI, Gemini, or a local model.",
   "type": "module",
   "bin": {

package/ui.mjs

@@ -929,7 +929,7 @@ body.lq-light .btip .bta button:not(.quiet){background:#151A21;color:#FFFFFF}
 <h3 class="ssh">Hand off to your agent when you "Send to repos"</h3>
 <input id="agentcmd" type="text" placeholder="e.g.  aider --message &quot;{prompt}&quot; --yes   ·   code {dir}   ·   leave blank to just write the file">
 <div class="note muted">Runs in each repo after tasks are written. Use <b>{dir}</b> = repo path, <b>{prompt}</b> = the task instruction. Works with any agent or editor &mdash; it's your command.</div>
-<label class="check swl" style="margin-top:12px"><input type="checkbox" class="sw" id="agenttrust" checked> <span>Agents work like Orca: they just do it. Symbiot's guard still stops pushing to main, publishing, deleting outside their folder, sudo, your keys and Symbiot's settings. Off: they ask before anything outside their allow list.</span></label>
+<label class="check swl" style="margin-top:12px"><input type="checkbox" class="sw" id="agenttrust" checked> <span><b>Symbiosis</b> &middot; agents work on their own. They do the work without stopping to ask permission. <b>The membrane</b> still stops pushing to main, publishing, deleting outside their folder, sudo, reading your keys and changing Symbiot's settings. Off: they ask before anything outside their allow list.</span></label>
 <div id="agentpresets" style="margin-top:8px"></div>
 <div class="note muted" id="agentconnectors"></div>
 <div id="grantbox" style="margin-top:10px">