symbiot 0.54.2 → 0.54.4

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 What each Symbiot release brought, newest first. When Approve bumps the version, it writes that release here from the tasks it approved, worded as release notes by your connected AI (or in the tasks' own words without one). The app shows the releases newer than yours under "What's new" when it offers an update, and once more after you update.
 
+## 0.54.4 — 2026-10-07
+
+- Removed the "Add a task" row from Tasks, since you add tasks through the bottom chat bar, and moved Send to repos beside Close.
+- Fixed agent runs that wait on you, such as unsent drafts or steps only you can take, so they now appear on Home with what to check first.
+- Moved the Reports Refresh button so it sits beside Close instead of under it.
+- Added a Marketing section with post drafts, replies marked "maybe a customer", picture tools and the 4-week table, moved off the Dashboard.
+- Reviewed where sandboxing for agent runs stands, with no changes to the app.
+- Added marks on Connections showing which sites your agents can also use, visible before you link them.
+- Changed the Dashboard to lead with what you watch; posts now appear under Marketing once drafting is possible.
+- Fixed Home's right-side orbs overlapping zone names on screens 1366–1440 pixels wide.
+- Added a "Pick your agent" step on first run that sets up the detected agent, such as Claude Code, in one click.
+
+## 0.54.3 — 2026-10-07
+
+- Added questions on Home for stuck or failed agent runs, so you can allow access, skip, or run them again right there.
+- Added a ready picture to post drafts whose idea is a screen of an app you run locally; keep it or remove it.
+- Changed post drafting to try once more by itself when every draft gets dropped for claiming things git doesn't show.
+- Added a separate sandbox for trying Symbiot's first-run setup without touching your real settings, drafts or files.
+- Fixed Orca losing track of a repo when a handover renames its folder; Symbiot now adds it again at the new location.
+- Fixed reply tracking treating a signed-out inbox as watched; Home now asks you to sign in again so replies aren't missed.
+- Added a "Where your files disagree" alert under Watching on Home when your files contradict each other on something important.
+
 ## 0.54.2
 
 - **Lighter without a graphics card.** When the liquid is drawn by the CPU (no GPU, or a headless browser like the ones agents check Symbiot's screens in), it used 6 cores or more. Now it draws at a third of the resolution, without the breathing, and only when something actually moved, at most 20 times a second: about a third of the CPU. It does the same when your system asks for less motion. With a graphics card, Home also draws half as often at rest and a sixth as often behind an open panel, where it barely shows.

package/README.md

@@ -93,8 +93,10 @@ It opens on [the liquid](#the-liquid-a-home-that-shapes-itself-to-you); each of
   a "fetch latest" toggle (and an [experimental](#experimental) "check CI").
 - **Week / Standup / Todo** — the write-ups (these use your chosen AI), set as a
   readable page with its dates; **Copy** copies the text as written.
-- **Tasks** — a checklist, grouped by kind (Fixes, Tests & CI, Docs, …). Filter by
-  type or repo, then **Send to repos** to hand just those to your agent (see
+- **Tasks** — a checklist, grouped by kind (Fixes, Tests & CI, Docs, …). You add
+  a task by telling Symbiot in the bar at the bottom: it files it under the right
+  project. Filter by type or repo, then **Send to repos** (at the top, beside
+  Close) to hand just those to your agent (see
   [`symbiot push`](#hand-tasks-to-your-coding-agent-symbiot-push)). What your agent
   finishes lands in **Awaiting your review** (see
   [Review and approve](#review-and-approve-the-agents-work)). A task you tick
@@ -387,7 +389,10 @@ preset only fills in the command box; the saved command is what runs.
 - **Orca IDE** (any OS): opens the repo in Orca — either just the repo, to use
   Orca's own agent, or with Claude running in a new tab (allowed `npm test` and
   `node` like the Claude preset, and upgraded the same way). It launches Orca if
-  it's closed and waits for it to be ready first.
+  it's closed and waits for it to be ready first. When a handover renames a
+  repo's folder, Symbiot adds it to Orca again at its new path (matched by its
+  GitHub remote, else its name). Orca keeps the old entry, marked missing, until
+  you remove it there.
 - **Editors — opens only, no review:** VS Code, Cursor, Windsurf, Zed, Sublime
   Text, IntelliJ IDEA, Neovim (on macOS, also found as `.app` bundles when the CLI
   isn't on your PATH). They just open the repo. Nothing comes back for review unless
@@ -575,6 +580,15 @@ and the blob dissolves. More than fit across go on a second page. Clicking the o
 questions and its Approve under **Needs you here** at the top of its tasks, with its
 handovers that are waiting; an ops run's question on its block in Agents.
 
+What stopped and can't go on without you is a question there too, on its lane.
+A handover that couldn't start (an ops run, limited to its own folder, handed
+"needs a run that can edit `~/Company`" to ops) asks **Allow this run access to
+~/Company?**: **Allow** starts a run of its own on it, allowed to read, edit and
+move files in that folder (that run only), and what it does goes back to the agent
+that asked; **Skip** lets it go, and that agent reads that you skipped it. It asks
+for 3 days, or until the same thing goes through another way. A run that ended in
+an error asks **Run it again?** for a day, until another run starts there.
+
 Under the band, around the core, are the parts of the app, grouped the
 **P.A.R.A.** way, each group a row with its name at its start, always in the same
 place and order:
@@ -673,28 +687,49 @@ release tags and dated `CHANGELOG.md` sections in the repos Symbiot already scan
 and nothing else. **It never posts by itself**, and it doesn't schedule.
 
 - **Your voice.** Put 5–10 posts you wrote in `~/.config/symbiot/voice.md`, with a
-  line of `---` between each. Or link LinkedIn (above) and click **Fill from
-  LinkedIn** on the Dashboard (`symbiot post voice --linkedin`), which reads your
+  line of `---` between each. Or link LinkedIn (above, or **Link LinkedIn** under
+  **Marketing**) and click **Fill from LinkedIn** there (`symbiot post voice --linkedin`), which reads your
   recent posts in Symbiot's signed-in browser. Without examples it doesn't draft.
 - **Only what git shows.** Your AI gets the week as numbered facts and must say
   which ones each post uses. A post that names a number, version, name or user
-  count the facts don't show is sent back once, then dropped.
-- **You approve each one.** The drafts wait on the **Dashboard** with **Approve**,
+  count the facts don't show is sent back once, then dropped. When every draft is
+  dropped, Symbiot tries once more from the start by itself before giving up.
+- **You approve each one.** The drafts wait under **Marketing**, a section of its
+  own (its orb shows on Home once posts can be drafted), with **Approve**,
   **Edit** and **Skip**. Approve copies the post to your clipboard and opens
   LinkedIn's share box: you paste it and post it yourself.
+- **Pictures and videos.** Each draft says in a line what picture or short video
+  would show it best. Add one of yours (**Add picture or video**: PNG, JPG, GIF,
+  MP4, MOV, WebM), or click **From a page** and give a web address (your app on
+  `localhost` works) to **Take a picture** of it, sharp enough for a feed, or
+  **Record a clip**: 5–30 seconds of it, scrolling slowly down, as an MP4 (needs
+  `ffmpeg`). A post takes a video or up to 20 pictures, as LinkedIn does. They're
+  copies, kept in `~/.config/symbiot/post-media/`; Approve opens their folder for
+  you to add them with LinkedIn's photo or video button. A draft whose idea is a
+  screen of an app you run here (listening on `localhost`, started in that repo's
+  folder, or Symbiot's own app: "the new Reports view" opens Reports) arrives with
+  its picture already on it: keep it or remove it.
 - **Everything is logged** in `~/.config/symbiot/posts-log.jsonl`: each draft,
   edit, approval and skip, with its text, date and platform.
 - **Replies.** Linked LinkedIn is watched like an inbox: new comments and mentions
-  show on its Dashboard card, marked **maybe a customer** when they ask how to
-  install it, what it costs or about team use. **Draft a reply** has your agent
+  show under **Marketing** (and on its Dashboard card), marked **maybe a customer**
+  when they ask how to install it, what it costs or about team use. **Draft a reply** has your agent
   type a reply into the comment box without posting it (it can't press Post,
   Comment, Reply or Send), and write it in its brief for you to paste.
+- **The 4-week test.** Marketing keeps a row a week: posts published (and how
+  many had a picture), replies, profile visits (LinkedIn's own count), installs
+  (npm downloads of the packages your posts are about) and pricing questions.
+  Week 1 is the first week a post goes out; to move it, put
+  `{ "start": "2026-10-13" }` in `~/.config/symbiot/post-test.json`.
 
 ```bash
 symbiot post                    # draft this week's 3 posts
 symbiot post list               # the drafts waiting on you
 symbiot post approve <id>       # copy it, and get LinkedIn's share box (--open opens it)
 symbiot post edit <id> "text"   # change a draft's words
+symbiot post add <id> <file>    # put a picture or video of yours on it
+symbiot post page <id> <page>   # a picture of a web page on it (--clip: a short video)
+symbiot post remove <id> <m>    # take a picture or video off it
 symbiot post skip <id>          # drop one
 symbiot post log                # everything that happened
 ```
@@ -765,7 +800,9 @@ Every brief also tells the agent what else it can leave in `.symbiot/`:
   gets it as a task and its agent starts, told what was asked for and what to do
   next. The task it's for says so in its chat, and you get a notification. The
   Dashboard lists **Waiting on replies**, with **Stop waiting** on each. Anything
-  the reply leaves for you to decide comes back as that agent's question.
+  the reply leaves for you to decide comes back as that agent's question. While
+  one waits and nothing can see the reply (no inbox watched and Email off, or the
+  watched inbox signed out), Home and the Dashboard say so.
 - **A report** (findings, an audit, a plan, a pitch): any `.md` named for what it
   is, with a `# ` title. **Reports** in the app lists every one your runs left,
   in your repos and in runs of their own, newest first, unread ones marked; click
@@ -861,6 +898,8 @@ CSV and Markdown tables, front matter and "Owner:" lines, and examples are never
 used as facts. The list, most pressing first and each with its files, is under
 **Settings → Knowledge folders**; it's checked again whenever a file changes, and
 **Check again** does it now. It's kept in `~/.config/symbiot/checks.json`, yours only.
+A clash that matters (a deadline on someone's leave or a holiday, a renewal or
+price told two ways) also shows on Home, under Watching, until you open it.
 
 - **Examples aren't facts.** Say which paths in a folder hold worked examples
   (`--examples templates/,active/`, or the second box in Settings; `templates/`

package/adapt.mjs

@@ -48,7 +48,7 @@ const MIN_EVENTS = 12;                   // under this many uses, adaptation fad
 const HICK_COVER = 0.9, HICK_MIN = 3, HICK_MAX = 7;
 const HYSTERESIS = 0.15;
 const FITTS = { a: 0.1, b: 0.15 };       // seconds; only ratios matter here
-const SHAPES = ["board", "map", "tasks", "agents", "week", "standup", "todo", "drift", "settings", "reports"];
+const SHAPES = ["board", "map", "tasks", "agents", "week", "standup", "todo", "drift", "settings", "reports", "marketing"];
 
 function loadAdapt(file = ADAPT_FILE) {
   try { const d = JSON.parse(readFileSync(file, "utf8")); return { shapes: d.shapes || {}, trans: d.trans || {}, hours: d.hours || {}, modes: d.modes || {}, slots: d.slots || {}, shown: d.shown || null, events: d.events || 0 }; }

package/agents.mjs

@@ -9,7 +9,7 @@ import { readFileSync, writeFileSync, mkdirSync, existsSync, openSync, writeSync
 import { randomBytes, createHash } from "node:crypto";
 import { CONFIG_DIR, loadConfig, saveConfig, loadTasks, TASK_MAX, clipWords, sameTask, taskWords, sh, hasCmd } from "./core.mjs";
 import { parseRun, lastRunText, readRunLog } from "./work.mjs";
-import { parseFacts } from "./handover.mjs";
+import { parseFacts, leftToYou } from "./handover.mjs";
 import { scanRoots, repoPathMap } from "./scan.mjs";
 import { knowledgeFolders } from "./knowledge.mjs";
 
@@ -141,6 +141,17 @@ function connectorsLine(tmpl = handoffCmd(), file, linked) {
 // For Settings → Handoff: the connectors, whether this command's runs get them, and
 // the sites linked in Symbiot that aren't Claude connectors (so runs can't use them).
 function connectorsInfo(file) { const conns = claudeConnectors("", file); return { claude: isClaudeCmd(handoffCmd()), list: conns.map(({ name, ready }) => ({ name, ready })), links: linkedConnectors(conns) }; }
+// Connections, before you link: which sites agent runs can use too. A link signs
+// Symbiot's browser in; a run reaches a site only through Claude's own connector for
+// it (LINK_CONNECTOR), and only with Claude Code as your agent (or, with none picked
+// yet, on this computer to pick). { claude, sites: { id: { name, connector, ready } } }:
+// connector "" while you haven't connected it in claude.ai.
+const claudeAgent = () => { const c = handoffCmd(); return isClaudeCmd(c) || (!c && hasCmd("claude")); };
+function linkReach(conns = claudeConnectors(), claude = claudeAgent()) {
+  const sites = {};
+  for (const [id, [name, re]] of Object.entries(LINK_CONNECTOR)) { const c = conns.find((x) => re.test(x.name)); sites[id] = { name, connector: c ? c.name : "", ready: !!c && c.ready }; }
+  return { claude, sites };
+}
 const fillHandoff = (tmpl, repoPath, prompt = HANDOFF_PROMPT) => tmpl.replace(/\{dir\}/g, shSingle(repoPath)).replace(/\{prompt\}/g, escDq(prompt));
 // ---- agents work on their own --------------------------------------------------------
 // Talk to an agent and it just does the work: permission checks skipped, one
@@ -271,14 +282,54 @@ function earlierRuns() {
   for (const r of loadRuns()) {
     if (tracked.has(r.path) || !existsSync(join(r.path, ".symbiot"))) continue;
     const busy = runningHandoff(r.path), ask = agentQuestions(r.path, r.name), wait = waitingFor(r.path), facts = busy ? [] : factsOf(r.path);
-    if (!busy && !ask.questions.length && !wait && !facts.length) continue;
     const log = join(r.path, ".symbiot", "agent.log"), startedAt = (busy && busy.startedAt) || Number(r.startedAt) || Date.now();
-    let tail = "", work = null, progress = null, end = Date.now(); try { ({ tail, work, progress } = workOf(r.path, readRunLog(log))); if (!busy) end = statSync(log).mtimeMs; } catch {}
-    out.push({ id: "earlier-" + digest(r.path).slice(0, 8), name: String(r.name || r.path.split("/").pop()), path: r.path, status: busy ? "running" : "done", earlier: true, elapsed: Math.max(0, end - startedAt), exitCode: null, tail, work, progress, changed: agentChanges(r.path, startedAt), ask, held: heldTasks(r.path), waiting: wait, remember: facts.length ? facts : null, fromHeld: false });
+    let end = Date.now(); if (!busy) try { end = statSync(log).mtimeMs; } catch {}
+    const needs = busy ? null : needsOf(r.path, { final: lastFinal(r.path), waiting: wait, end });
+    if (!busy && !ask.questions.length && !wait && !facts.length && !needs) continue;
+    let tail = "", work = null, progress = null; try { ({ tail, work, progress } = workOf(r.path, readRunLog(log))); } catch {}
+    out.push({ id: "earlier-" + digest(r.path).slice(0, 8), name: String(r.name || r.path.split("/").pop()), path: r.path, status: busy ? "running" : "done", earlier: true, startedAt, endedAt: busy ? null : end, elapsed: Math.max(0, end - startedAt), exitCode: null, tail, work, progress, changed: agentChanges(r.path, startedAt), ask, held: heldTasks(r.path), waiting: wait, needs, remember: facts.length ? facts : null, fromHeld: false });
   }
   return out;
 }
 
+// ---- what a finished run left to you ----------------------------------------
+// A run that ended saying something waits on you (handover.mjs leftToYou: "the
+// draft isn't sent", "needs sudo, and only you can do that"), or waiting on a step
+// an answer of yours picked (waitingFor), needs you, and says so: on its block in
+// Agents and on Home, with what to check first. It did end, so before this nothing
+// showed it: Home said nothing needed you while a reply to Cale sat in Drafts. It
+// stays for NEEDS_FOR, until you go ahead or skip it (settled.json keeps which, per
+// folder), a newer run there says something else, or a newer ops run took up the
+// same task. { kind: "approve"|"step", what, check, label, key, waiting? } or null.
+const NEEDS_FOR = 3 * 86400000, SETTLED = join(CONFIG_DIR, "settled.json"), ACT_DIR = join(CONFIG_DIR, "drafts") + "/";
+const loadSettled = () => { try { const o = JSON.parse(readFileSync(SETTLED, "utf8")); return o && typeof o === "object" && !Array.isArray(o) ? o : {}; } catch { return {}; } };
+function settleNeeds(path, key) {
+  const o = loadSettled(); o[path] = String(key || "");
+  try { mkdirSync(CONFIG_DIR, { recursive: true }); writeFileSync(SETTLED, JSON.stringify(o, null, 2), { mode: 0o600 }); } catch {}
+}
+// A streaming run's last words (its final answer), read once per change of its log.
+const FINALS = new Map();
+function lastFinal(path) {
+  const log = join(path, ".symbiot", "agent.log"); let m = 0; try { m = statSync(log).mtimeMs; } catch { return ""; }
+  const c = FINALS.get(path); if (c && c.m === m) return c.final;
+  let final = ""; try { const w = parseRun(lastRunText(readRunLog(log))); final = w.stream ? w.final : ""; } catch {}
+  FINALS.set(path, { m, final }); return final;
+}
+const firstTask = (path) => (readSymbiot(path, "TASKS.md").match(/^\s*-\s*\[[ x]\]\s*(.+)$/im) || [])[1] || "";
+// an ops run (a folder of its own each time) whose task a newer ops run took up
+function takenUp(path, end) {
+  if (!path.startsWith(ACT_DIR)) return false;
+  const t = firstTask(path); return !!t && loadRuns().some((r) => r.path !== path && r.path.startsWith(ACT_DIR) && Number(r.startedAt) > end && sameTask(firstTask(r.path), t));
+}
+function needsOf(path, { final = "", waiting = null, end = Date.now(), now = Date.now() } = {}) {
+  if (now - end > NEEDS_FOR) return null;
+  const n = waiting ? { kind: "step", what: clipWords(String(waiting.step || "").replace(/^\s*👤\s*(You\s*(\([^)]*\))?:)?\s*/, "").trim(), 240), check: "", label: "", waiting: true } : leftToYou(final);
+  if (!n || !n.what) return null;
+  const key = digest(n.what);
+  if (loadSettled()[path] === key || takenUp(path, end)) return null;
+  return { ...n, key };
+}
+
 // ---- a step that's yours: wait for it -----------------------------------------
 // An answer that picks a "👤 You:" option leaves a step for the user to do (put a
 // key in .env, allow a command in Settings). Starting the agent before it's done
@@ -484,6 +535,9 @@ const AGENT_LIST = [
   ["gemini", "Gemini — make changes", 'gemini --yolo -p "{prompt}"'],
   ["cursor-agent", "Cursor agent", 'cursor-agent -p "{prompt}"'],
 ];
+// The agent to offer a new user in one click (Home's "Pick your agent"): the first
+// coding agent on this computer, in AGENT_LIST's order (Claude Code first). null if none.
+function pickAgent() { const a = AGENT_LIST.find(([cmd]) => hasCmd(cmd)); return a ? { label: a[1], name: a[1].split(" — ")[0], tmpl: a[2] } : null; }
 function detectHandoffs() {
   const editors = [];
   for (const [cmd, label, app] of IDE_LIST) {
@@ -885,8 +939,10 @@ function agentsList() {
     const { tail, work, progress } = workOf(e.path, readRunLog(e.log));
     const first = !seen.has(e.path); seen.add(e.path);
     const facts = first && e.status !== "running" ? factsOf(e.path) : [];
-    return { id: e.id, name: e.name, path: e.path, status: e.status, elapsed: (e.endedAt || Date.now()) - e.startedAt, exitCode: e.exitCode, tail, work, progress, changed: agentChanges(e.path, e.startedAt), ask: first ? agentQuestions(e.path, e.name) : null, held: first ? heldTasks(e.path) : null, waiting: first && e.status !== "running" ? waitingFor(e.path) : null, remember: facts.length ? facts : null, fromHeld: !!e.fromHeld };
+    const waiting = first && e.status !== "running" ? waitingFor(e.path) : null;
+    const needs = first && e.status !== "running" ? needsOf(e.path, { final: work ? tail : "", waiting, end: e.endedAt || Date.now() }) : null;
+    return { id: e.id, name: e.name, path: e.path, status: e.status, startedAt: e.startedAt, endedAt: e.endedAt, elapsed: (e.endedAt || Date.now()) - e.startedAt, exitCode: e.exitCode, tail, work, progress, changed: agentChanges(e.path, e.startedAt), ask: first ? agentQuestions(e.path, e.name) : null, held: first ? heldTasks(e.path) : null, waiting, needs, remember: facts.length ? facts : null, fromHeld: !!e.fromHeld };
   }).concat(earlierRuns());
 }
 
-export { FACTS, factsOf, knownRun, withStream, workOf, HANDOFFS, HANDOFF_PROMPT, QUESTIONS_MAX, OPTIONS_SHOWN, IDEAS_SHOWN, shSingle, CLAUDE_CMD, ORCA_CLAUDE_CMD, handoffCmd, setHandoffCmd, grantAgent, grantRule, allowTool, claudeConnectors, withConnectors, linkedConnectors, connectorsLine, connectorsInfo, fillHandoff, runHandoff, PARKED_NOTE, parkedPaths, isParked, parkLane, agentMissing, blockedAgain, runningHandoff, loadRuns, earlierRuns, namedFiles, waitingFor, startWaiting, writeTasks, droppedTasks, releaseHeldTasks, startHeldTasks, detectHandoffs, orcaHandoffCmd, migrateOrcaCmd, migrateClaudeCmd, track, agentChanges, parseQuestions, suggestionTarget, skipIdea, agentQuestions, answerQuestions, agentsList , autoAllow, autoAllowSweep, allowlistInWork, inWork, withScope , withTrust, resumeFor, noteSession, trustFull, GUARD_SETTINGS };
+export { FACTS, factsOf, knownRun, withStream, workOf, HANDOFFS, HANDOFF_PROMPT, QUESTIONS_MAX, OPTIONS_SHOWN, IDEAS_SHOWN, shSingle, CLAUDE_CMD, ORCA_CLAUDE_CMD, handoffCmd, setHandoffCmd, grantAgent, grantRule, allowTool, claudeConnectors, withConnectors, linkedConnectors, connectorsLine, connectorsInfo, linkReach, fillHandoff, runHandoff, PARKED_NOTE, parkedPaths, isParked, parkLane, agentMissing, blockedAgain, runningHandoff, loadRuns, earlierRuns, namedFiles, waitingFor, startWaiting, writeTasks, droppedTasks, releaseHeldTasks, startHeldTasks, detectHandoffs, pickAgent, findOrcaCli, orcaHandoffCmd, migrateOrcaCmd, migrateClaudeCmd, track, agentChanges, parseQuestions, suggestionTarget, skipIdea, agentQuestions, answerQuestions, agentsList, needsOf, settleNeeds, NEEDS_FOR , autoAllow, autoAllowSweep, allowlistInWork, installAllowlist, inWork, withScope , withTrust, resumeFor, noteSession, trustFull, GUARD_SETTINGS };

package/checks.mjs

@@ -647,5 +647,20 @@ function checksState({ file = CHECKS_FILE } = {}) {
   try { const d = JSON.parse(readFileSync(file, "utf8")); return { at: d.at || 0, clashes: d.clashes || [], counts: d.counts || {}, officeDays: d.officeDays || [], folders: d.folders || [], ms: d.ms || 0 }; }
   catch { return { at: 0, clashes: [], counts: {}, officeDays: [], folders: [], ms: 0 }; }
 }
+// Home's "Where your files disagree" droplet: the high clashes (a deadline on
+// someone's leave or a holiday, a renewal or price told two ways) you haven't
+// opened from it yet. Opening it marks them seen (checks-seen.json), so the same
+// clash reaches you once; a new one, or one that changes, comes back.
+const SEEN_FILE = join(CONFIG_DIR, "checks-seen.json");
+const clashKey = (c) => c.kind + "|" + c.text;
+function seenClashes({ file = SEEN_FILE } = {}) { try { const d = JSON.parse(readFileSync(file, "utf8")); return Array.isArray(d) ? d : []; } catch { return []; } }
+function newClashes({ state = checksState(), seen = seenClashes() } = {}) {
+  const s = new Set(seen);
+  return (state.clashes || []).filter((c) => c.severity === "high" && !s.has(clashKey(c)));
+}
+function markClashesSeen({ state = checksState(), file = SEEN_FILE } = {}) {
+  const keys = [...new Set([...seenClashes({ file }), ...(state.clashes || []).filter((c) => c.severity === "high").map(clashKey)])].slice(-MAX_CLASHES);
+  try { mkdirSync(join(file, ".."), { recursive: true }); writeFileSync(file, JSON.stringify(keys), { mode: 0o600 }); return { ok: true }; } catch { return { error: "Couldn't write " + file + "." }; }
+}
 
-export { CHECKS_FILE, parseDates, timeOf, loadFiles, extractFacts, findClashes, runChecks, checksState };
+export { CHECKS_FILE, parseDates, timeOf, loadFiles, extractFacts, findClashes, runChecks, checksState, newClashes, markClashesSeen, seenClashes };

package/handback.mjs

@@ -30,7 +30,7 @@ import { CONFIG_DIR, loadConfig, loadTasks, saveTasks, sameTask, clipWords } fro
 import { OPS, parseAwaiting } from "./handover.mjs";
 import { FACTS, factsOf, knownRun, loadRuns, HANDOFFS, runningHandoff } from "./agents.mjs";
 import { remember, actIn } from "./mind.mjs";
-import { newsSince, watchState, isMail } from "./watch.mjs";
+import { newsSince, watchState, isMail, isSignedOut } from "./watch.mjs";
 import { inboxMail } from "./mail.mjs";
 import { desktopNotify } from "./desktop.mjs";
 import { repoPathMap } from "./scan.mjs";
@@ -163,11 +163,21 @@ function awaitTick({ map = repoPathMap(), now = Date.now(), news, inbox, act, no
   if (added.length || replied.length) saveWaits(d);
   return { added, replied };
 }
-// The Dashboard's list: what's still waiting, then what came in lately, newest first.
-function awaitingState() {
+// Can a reply be noticed? Email on (the inbox on this computer), or a watched
+// inbox that's signed in: a signed-out one reads nothing, so it doesn't count.
+// { sees, signedOut: [the signed-out inboxes' names] }
+function inboxSight({ mail, watches } = {}) {
+  if (!mail) { try { mail = loadConfig().mail || {}; } catch { mail = {}; } }
+  if (!watches) { try { watches = watchState().watches; } catch { watches = []; } }
+  const inboxes = watches.filter((w) => isMail(w.url)), out = inboxes.filter(isSignedOut);
+  return { sees: !!mail.enabled || inboxes.length > out.length, signedOut: out.map((w) => w.name) };
+}
+// The Dashboard's list: what's still waiting, then what came in lately, newest
+// first; and, while one waits, whether anything can see the reply arrive.
+function awaitingState({ sight = inboxSight } = {}) {
   const view = (w) => ({ id: w.id, from: w.from.lane, to: w.to, subject: w.subject, asked: w.asked, task: w.task, lane: w.lane, sent: w.sent, status: w.status, ...(w.reply ? { reply: w.reply } : {}), ...(w.handed ? { handed: w.handed } : {}), ...(w.error ? { error: w.error } : {}) });
-  const all = loadWaits().waits.slice().reverse();
-  return { waits: [...all.filter((w) => w.status === "waiting"), ...all.filter((w) => w.status !== "waiting" && w.status !== "stopped").slice(0, 10)].map(view) };
+  const all = loadWaits().waits.slice().reverse(), open = all.filter((w) => w.status === "waiting");
+  return { waits: [...open, ...all.filter((w) => w.status !== "waiting" && w.status !== "stopped").slice(0, 10)].map(view), ...(open.length ? { sight: sight() } : {}) };
 }
 // Stop waiting (its button): it stays in the file, so the run's AWAITING.json doesn't bring it back.
 function stopWaiting(id) {
@@ -175,4 +185,4 @@ function stopWaiting(id) {
   w.status = "stopped"; return saveWaits(d) ? { ok: true, ...awaitingState() } : { error: "Couldn't write " + AWAIT_FILE + "." };
 }
 
-export { AWAIT_FILE, RUNS_DIR, runFolders, laneOf, runTitle, subjectCore, keepFacts, skipFacts, loadWaits, collectWaits, answers, replyTo, nextRequest, awaitTick, awaitingState, stopWaiting };
+export { AWAIT_FILE, RUNS_DIR, runFolders, laneOf, runTitle, subjectCore, keepFacts, skipFacts, loadWaits, collectWaits, answers, replyTo, nextRequest, awaitTick, inboxSight, awaitingState, stopWaiting };

package/handover.mjs

@@ -24,7 +24,7 @@ function handoverRules(lanes = [], here = "") {
 }
 // The rule for options in QUESTIONS.md: the user gets only what no agent can do,
 // and the option says which kind it is.
-const ONLY_YOU = "- Only what no agent can do is the user's: their body (a phone in their hand, a cable, which network they're on), their identity or secrets (signing in, a 2FA code, a token from a provider's console) or a decision that's theirs (closing an account, spending money, sending something in their name). Start such an option with `👤 You (only you: <which>):`, e.g. `👤 You (only you: your Meta token): paste it into .env`. Anything an agent could do, yours or another lane's, is never a 👤 step: do it, or hand it over. An option where picking it is enough starts with `🤖 Agent:`. Tag actions only: an option that just reports what the user saw or decides (`it notified me`, `not tried yet`) gets no tag. A permission your run doesn't have (a command, a folder) is never a chore for the user. Write the rules, as narrow as the task needs, to `.symbiot/allowlist.proposed.json` (`{\"permissions\": {\"allow\": [...], \"deny\": [...], \"additionalDirectories\": [...]}}`), ask for it in QUESTIONS.md with the option `👤 You (only you: a permission): allow the list in .symbiot/allowlist.proposed.json`, and stop. If it stays inside the user's work (the folders they gave Symbiot, not ~/.ssh or ~/.config), asks for nothing wide, and doesn't publish or reach another machine, Symbiot turns it on by itself and runs you again: no question reaches the user. Their knowledge folders are already yours to read. Never ask them to copy files or run claude in a terminal for it. Decide what can be undone yourself, as a trusted colleague would: the approach, names, which of two fixes, how to lay files out; pick, do it, and say what you chose and why in your last message. Ask only about what can't be undone, costs money, goes out in the user's name, or needs who they are, and then give 2–3 options with your pick first, marked (recommended). Their answer comes back into this same conversation, so you'll remember everything when it does. Symbiot's membrane (its guard) stops the few things only the user does (pushing to main, publishing, deleting outside your folder, sudo, their keys); if it stops you, ask, don't work around it.";
+const ONLY_YOU = "- Only what no agent can do is the user's: their body (a phone in their hand, a cable, which network they're on), their identity or secrets (signing in, a 2FA code, a token from a provider's console) or a decision that's theirs (closing an account, spending money, sending something in their name). Start such an option with `👤 You (only you: <which>):`, e.g. `👤 You (only you: your Meta token): paste it into .env`. Anything an agent could do, yours or another lane's, is never a 👤 step: do it, or hand it over. An option where picking it is enough starts with `🤖 Agent:`. Tag actions only: an option that just reports what the user saw or decides (`it notified me`, `not tried yet`) gets no tag. A permission your run doesn't have (a command, a folder) is never a chore for the user. Write the rules, as narrow as the task needs, to `.symbiot/allowlist.proposed.json` (`{\"permissions\": {\"allow\": [...], \"deny\": [...], \"additionalDirectories\": [...]}}`), ask for it in QUESTIONS.md with the option `👤 You (only you: a permission): allow the list in .symbiot/allowlist.proposed.json`, and stop. If it stays inside the user's work (the folders they gave Symbiot, not ~/.ssh or ~/.config), asks for nothing wide, and doesn't publish or reach another machine, Symbiot turns it on by itself and runs you again: no question reaches the user. Their knowledge folders are already yours to read. Never ask them to copy files or run claude in a terminal for it. Decide what can be undone yourself, as a trusted colleague would: the approach, names, which of two fixes, how to lay files out; pick, do it, and say what you chose and why in your last message. Ask only about what can't be undone, costs money, goes out in the user's name, or needs who they are, and then give 2–3 options with your pick first, marked (recommended). Their answer comes back into this same conversation, so you'll remember everything when it does. Symbiot's membrane (its guard) stops the few things only the user does (pushing to main, publishing, deleting outside your folder, sudo, their keys); if it stops you, ask, don't work around it. Whatever waits on the user's OK (sending, posting, deleting, paying, closing) or on a step only they can take goes in QUESTIONS.md as a question, with what they should check first in its context line, never only in your last message: they aren't asked about what your last message says.";
 
 // What a run hands back to Symbiot itself (handback.mjs reads it): facts for
 // memory, and emails that wait on a reply, which Symbiot then watches for; and
@@ -53,6 +53,45 @@ function parseAwaiting(text) {
   })).filter((x) => x.subject).slice(0, 20);
 }
 
+// ---- what a run's last words leave to the user ----------------------------------
+// A run that ends saying something waits on the user ("the draft isn't sent",
+// "only you can do that", "needs sudo") without asking it in QUESTIONS.md left it
+// where nothing showed it: the email to Jono sat in Drafts and nothing asked for
+// the OK. leftToYou finds it: { kind, what, check, label } or null.
+// kind "approve": what an agent does once the user says go (send, post, delete, pay,
+// close); "step": what only the user can do (sudo, a password, signing in). what:
+// the sentence that says so; check: what to check first (the catch it named, else
+// the point's next sentence); label: the point's bold name ("Reply to Cale").
+const HELD = /\b(?:isn['’]t|wasn['’]t|not|never|hasn['’]t been|haven['’]t|didn['’]t) (?:yet )?(?:been )?(?:sent|send it|posted|post it)\b|\bunsent\b|\bbefore you (?:send|post)\b|\bfor you to (?:send|post)\b|\b(?:send|sending|post|posting) it yourself\b|\byou(?:['’]ll| will) (?:send|post) it\b|\bwaits? (?:on|for) your (?:ok|okay|go-ahead|approval|say-so)\b/i;
+const YOURS = /\bonly you (?:can|could|do)\b|\b(?:needs?|waits? (?:on|for)|waiting (?:on|for)) (?:your (?!review)\w+|you to)\b|\btype your password\b|\bneeds sudo\b/i;
+const DID = /\b(?:I|we)(?:['’]ve| have)? (?:sent|posted|deleted|paid|closed)\b|\balready (?:went out|sent|posted)\b|\bnothing (?:was |is )?(?:sent|posted)\b/i;
+const ACTS = /\b(?:send|sent|sending|post|posted|publish|delete|remove|pay|close|cancel)\b/i;
+const CATCH = /\b(?:catch|before you|check|make sure|careful|fix (?:that|it)|first)\b/i;
+const NOT_THEIRS = /\bconnectors?\b|\bclaude\.ai\b/i; // a connector to sign in again shows on Home already
+const SENDS = /draft|reply|email|mail|message|post/i;
+function leftToYou(text) {
+  const points = String(text || "").replace(/```[\s\S]*?```/g, (m) => m.replace(/\s+/g, " ")).split(/\n+|\s+-\s+(?=\*\*)/).map((p) => p.replace(/^\s*[-*•]\s+/, "").trim()).filter(Boolean)
+    .map((p) => { const lm = p.match(/^\*\*([^*]{2,60}?):?\*\*:?\s*/), body = lm ? p.slice(lm[0].length) : p;
+      return { label: lm ? lm[1].trim() : "", ss: body.split(/(?<=[.!?:])\s+(?=[A-Z`"*(])/).map((s) => s.trim()).filter(Boolean), off: NOT_THEIRS.test(p) }; });
+  const clean = (x, n) => { x = String(x || "").replace(/\*\*/g, "").replace(/\s+/g, " ").trim(); return x.length > n ? x.slice(0, n - 1).replace(/\s+\S*$/, "") + "…" : x; };
+  for (let k = 0; k < points.length; k++) {
+    const { label, ss, off } = points[k]; if (off) continue;
+    const i = ss.findIndex((s) => !DID.test(s) && (HELD.test(s) || YOURS.test(s)));
+    if (i < 0) continue;
+    const s = ss[i], next = points[k + 1] && !points[k + 1].off ? points[k + 1].ss : [];
+    // what to check first: the catch it named (in this point, then the next), else what it says next
+    const catches = ss.filter((x, j) => j !== i && CATCH.test(x) && !DID.test(x));
+    const elsewhere = points.filter((p, j) => j !== k && !p.off).flatMap((p) => p.ss.filter((x) => /\byourself\b|\bbefore you\b|\bcatch\b/i.test(x) && !DID.test(x)).map((x) => (p.label ? `${p.label}: ${x}` : x)));
+    let check = (catches.length ? catches.slice(0, 2).join(" ") : elsewhere[0]) || ss[i + 1] || next[0] || "";
+    if (/:$/.test(check)) { const seq = [...ss.slice(i + 1), ...next, ...((points[k + 2] && points[k + 2].ss) || [])], at = seq.indexOf(check); if (at >= 0 && seq[at + 1]) check += " " + seq[at + 1]; } // "paste this:" and then the command
+    // "The draft isn't sent." says which draft only in its own point ("**Draft:** it's in Gmail, to …")
+    const about = !label && SENDS.test(s) ? points.find((p) => p.label && SENDS.test(p.label) && p.ss.length) : null;
+    const what = label ? `${label}: ${s}` : about ? `${s} ${about.label}: ${about.ss[0]}` : s;
+    return { kind: HELD.test(s) || ACTS.test(s) ? "approve" : "step", what: clean(what, 240), check: clean(check === s ? "" : check, 240), label: clean(label || (about && about.label), 60) };
+  }
+  return null;
+}
+
 // What an agent handed over: [{ lane, text }] from its .symbiot/HANDOFF.md.
 function parseHandoffs(md) {
   const out = []; let cur = null;
@@ -65,4 +104,4 @@ function parseHandoffs(md) {
   return out.map((h) => ({ lane: h.lane, text: h.text.trim().slice(0, HANDOVER_MAX) })).filter((h) => h.lane && h.text);
 }
 
-export { OPS, HANDOVER_MAX, handoverRules, ONLY_YOU, HANDBACK, parseFacts, parseAwaiting, parseHandoffs };
+export { OPS, HANDOVER_MAX, handoverRules, ONLY_YOU, HANDBACK, parseFacts, parseAwaiting, parseHandoffs, leftToYou };

package/headless.mjs

@@ -80,7 +80,7 @@ function connect(proc) {
     function done(v) { clearTimeout(t); listeners.delete(f); resolve(v); }
     listeners.add(f);
   });
-  return { send, until, on: (f) => listeners.add(f), closed: () => closed };
+  return { send, until, on: (f) => { listeners.add(f); return () => listeners.delete(f); }, closed: () => closed };
 }
 
 // One browser at a time: they share a profile, and Chrome locks it.
@@ -139,7 +139,9 @@ async function launch() {
       // Sites serve "HeadlessChrome" something else (or a block page): look like the browser it is.
       const { userAgent } = await c.send("Browser.getVersion");
       if (userAgent) await send("Network.setUserAgentOverride", { userAgent: userAgent.replace(/HeadlessChrome/g, "Chrome") });
-      b.page = { send, until, idle };
+      // every `method` event on this tab, until the function it gives is called
+      const on = (method, f) => c.on((m) => { if (m && m.sessionId === sessionId && m.method === method) f(m.params || {}); });
+      b.page = { send, until, idle, on };
       return b;
     })();
     return await Promise.race([run, failed]);
@@ -497,6 +499,56 @@ function readTexts(input, selector, { scrolls = 3 } = {}) {
   }, false)).catch((e) => ({ error: String((e && e.message) || e) }));
 }
 
+// A picture, or a short clip, of a page, for a post (post.mjs): only on your
+// click, and it only looks, like readPage. The picture is the window at twice its
+// pixels, so it stays sharp in a feed: { png, url, title }. The clip records the
+// window for `seconds` (the DevTools screencast: a frame each time the page
+// changes, with its time), scrolling slowly down a page longer than the window,
+// so even a still page moves: { frames: [{ ts, jpeg }], end, url, title }, the
+// times in seconds. post.mjs makes it a video.
+const CLIP = { min: 3, max: 30, speed: 450 }; // seconds; pixels a second, scrolling
+const SCROLL_THROUGH = (ms) => `(() => { ${SCROLLER}
+  const sc = scroller(); if (!sc) return 0;
+  const hold = 800, run = Math.max(500, ${ms} - 2 * hold), dist = Math.min(sc.scrollHeight - sc.clientHeight, run / 1000 * ${CLIP.speed}), t0 = performance.now();
+  const ease = (x) => x < 0.5 ? 2 * x * x : 1 - Math.pow(-2 * x + 2, 2) / 2;
+  (function step(now) { const k = Math.min(1, Math.max(0, (now - t0 - hold) / run)); sc.scrollTop = Math.round(dist * ease(k)); if (k < 1) requestAnimationFrame(step); })(t0);
+  return Math.round(dist);
+})()`;
+function pagePicture(input) {
+  const url = siteUrl(input);
+  if (!url) return Promise.resolve({ error: "Give a page: a web address (localhost:3000 works), a host (github.com/you) or a site's name." });
+  return oneAtATime(() => withPage(async (page) => {
+    await page.send("Emulation.setDeviceMetricsOverride", { width: VIEW.w, height: VIEW.h, deviceScaleFactor: 2, mobile: false });
+    try {
+      await open(page, url);
+      const { data } = await page.send("Page.captureScreenshot", { format: "png" });
+      return { png: Buffer.from(data, "base64"), url: String((await evaluate(page, "location.href")) || url), title: String((await evaluate(page, "document.title")) || "") };
+    } finally { await page.send("Emulation.setDeviceMetricsOverride", { width: VIEW.w, height: VIEW.h, deviceScaleFactor: 1, mobile: false }).catch(() => {}); }
+  })).catch((e) => ({ error: String((e && e.message) || e) }));
+}
+function pageClip(input, seconds = 8) {
+  const url = siteUrl(input);
+  if (!url) return Promise.resolve({ error: "Give a page: a web address (localhost:3000 works), a host (github.com/you) or a site's name." });
+  const ms = Math.round(Math.min(CLIP.max, Math.max(CLIP.min, Number(seconds) || 8)) * 1000);
+  return oneAtATime(() => withPage(async (page) => {
+    await open(page, url);
+    const frames = [];
+    const off = page.on("Page.screencastFrame", (p) => {
+      frames.push({ ts: (p.metadata && p.metadata.timestamp) || Date.now() / 1000, jpeg: Buffer.from(p.data, "base64") });
+      page.send("Page.screencastFrameAck", { sessionId: p.sessionId }).catch(() => {});
+    });
+    try {
+      await page.send("Page.startScreencast", { format: "jpeg", quality: 88, maxWidth: VIEW.w, maxHeight: VIEW.h, everyNthFrame: 1 });
+      await evaluate(page, SCROLL_THROUGH(ms));
+      await sleep(ms);
+      await page.send("Page.stopScreencast").catch(() => {});
+    } finally { off(); }
+    const end = frames.length ? Math.max(frames[frames.length - 1].ts, frames[0].ts + ms / 1000) : 0;
+    if (!frames.length) return { error: "The page showed nothing to record." };
+    return { frames, end, url: String((await evaluate(page, "location.href")) || url), title: String((await evaluate(page, "document.title")) || "") };
+  })).catch((e) => ({ error: String((e && e.message) || e) }));
+}
+
 // Trusted sites (Settings → Screens): on a page from one of these, press and type
 // go ahead without asking, for you and for agents. Anywhere else each one asks.
 // A host covers its subdomains (google.com covers mail.google.com). Only the app's
@@ -662,4 +714,4 @@ async function signIn(input) {
   return { ok: true, url };
 }
 
-export { siteUrl, browserArgs, mapPage, wholePage, readPage, readTexts, isSend, pressRegion, typeRegion, scrollPage, SCROLLS, signIn, keepBrowserOpen, closeBrowser, browserOpen, trustedSites, isTrusted, trustSite, untrustSite, PROFILE };
+export { siteUrl, browserArgs, mapPage, wholePage, readPage, readTexts, pagePicture, pageClip, CLIP, isSend, pressRegion, typeRegion, scrollPage, SCROLLS, signIn, keepBrowserOpen, closeBrowser, browserOpen, trustedSites, isTrusted, trustSite, untrustSite, PROFILE };