symbiot 0.57.3 → 0.57.6

package/server.mjs

@@ -16,7 +16,7 @@ import { EMBEDDED_UI } from "./ui.mjs";
 import { VERSION, LATEST_VERSION, REGISTRY, semverGt, checkLatest, CONFIG_PATH, loadConfig, saveConfig, loadTasks, hasCmd, chromeBinary, CONFIG_DIR } from "./core.mjs";
 import { shSingle, handoffCmd, setHandoffCmd, grantAgent, runHandoff, track, detectHandoffs, connectorsInfo, linkReach, answerQuestions, skipIdea, agentsList, startWaiting, parkLane, parkedPaths, autoAllowSweep, trustFull, readLastWords, sandboxState } from "./agents.mjs";
 import { PROVIDERS, resolveProvider, connectProvider, detectHardware, recommendModels, hasOllama, ollamaInstall, ensureOllama, useOllamaModel } from "./ai.mjs";
-import { SCAN, SCAN_TIMEOUT_MS, scanRoots, scanHome, addScanRoot, removeScanRoot, buildMap, nodeDetail, repoPathMap, laneMap, setScanOptions, refreshRepos, REPO_STATE } from "./scan.mjs";
+import { SCAN, SCAN_TIMEOUT_MS, scanRoots, scanHome, addScanRoot, removeScanRoot, buildMap, nodeDetail, repoPathMap, laneMap, setScanOptions, refreshRepos, REPO_STATE, reposState } from "./scan.mjs";
 import { computeDrift } from "./drift.mjs";
 import { addTask, toggleTask, removeTask, restoreTask, syncTasks, taskType, pushTasks, pendingReview, workingDiff, learnNpm, withReleases, releaseInput, approveRepo, approveChanges, sendBack, setAutoMerge } from "./tasks.mjs";
 import { repoReview, repoSuggest, folderSuggest, taskChat, clearTaskChat, mailState, setMail, sentMail, produce, releaseNotes } from "./writeups.mjs";
@@ -30,9 +30,9 @@ import { mindState, forget } from "./mind.mjs";
 import { lanesTick, lanesState, partlyDone, orcaRelink } from "./lanes.mjs";
 import { keepFacts, skipFacts, awaitTick, awaitingState, stopWaiting } from "./handback.mjs";
 import { adaptState, noteUse } from "./adapt.mjs";
-import { homeState, homeAsk, homeAnswer, homeNext, workScene, workGo, firstSteps, marketingState, marketingGo, marketingTask, moveToMarketing, onboarding, setOnboarding } from "./home.mjs";
-import { MARKETING_DIR } from "./marketing.mjs";
-import { listReports, readReport, markAllRead } from "./reports.mjs";
+import { reportIdeasAdd, reportAsk, reportDraftAnswer, homeState, homeAsk, homeAnswer, homeNext, workScene, workGo, workTick, firstSteps, marketingState, marketingGo, marketingDraftAnswer, marketingTask, moveToMarketing, onboarding, setOnboarding } from "./home.mjs";
+import { MARKETING_DIR, MARKETING, draftPreview, laneMedia, displayName } from "./marketing.mjs";
+import { listReports, readReport, reportImage, markAllRead } from "./reports.mjs";
 import { phoneState, setPhoneLink, newCode, unpairPhone, pairComputer, forgetComputer, pollComputer, startPhone } from "./phone.mjs";
 import { knowledgeState, addKnowledgeFolder, removeKnowledgeFolder, indexKnowledge, knowledgeTick, searchKnowledge } from "./knowledge.mjs";
 import { runChecks, checksState, markClashesSeen } from "./checks.mjs";
@@ -52,6 +52,14 @@ function updateCmd(latest, current, platform = process.platform) {
 // update the app shows once what came with it (config.seenVersion is the version
 // you last saw it for). Before an update, the new version's own CHANGELOG.md is
 // read from its package on npm (registryChangelog).
+
+// A folder's lane as people say it: the repo (or Marketing) it is, else "" (an ops run).
+function laneOfFolder(path) {
+  if (path === MARKETING_DIR) return "Marketing";
+  let map = {}; try { map = laneMap() || {}; } catch {}
+  const n = Object.keys(map).find((k) => map[k] === path);
+  return n ? (n === MARKETING ? "Marketing" : displayName(path, n)) : "";
+}
 const CHANGELOG = fileURLToPath(new URL("./CHANGELOG.md", import.meta.url));
 function changesSince(md, from, to) {
   const out = [];
@@ -62,6 +70,8 @@ function changesSince(md, from, to) {
   }
   return out.slice(0, 15);
 }
+// A headless browser: an agent or a test looking at the page, not someone using it.
+const headlessAgent = (ua) => /Headless/i.test(String(ua || ""));
 const localChangelog = () => { try { return readFileSync(CHANGELOG, "utf8"); } catch { return ""; } };
 // After an update: what's new since the version you last saw it for. The first
 // time (no seenVersion yet) that's just this version's own release.
@@ -273,12 +283,12 @@ async function startApp({ bin, since = 7, all = false, c = PLAIN_COLOURS } = {})
         await learnNpm(ask); return json(res, partly(pendingReview()));
       }
       if (u.pathname === "/api/pending/diff") { const p = laneMap()[u.searchParams.get("repo") || ""]; return json(res, { diff: p ? workingDiff(p) : "" }); }
-      if (u.pathname === "/api/pending/approve" && req.method === "POST") { const b = await readBody(req), repo = String(b.repo || ""); if (b.bump) await learnNpm([laneMap()[repo]]); const notes = await releaseNotes(releaseInput(repo, { bump: b.bump })); return json(res, approveRepo(repo, { bump: b.bump, notes })); }
-      if (u.pathname === "/api/pending/approve-changes" && req.method === "POST") { const b = await readBody(req), repo = String(b.repo || ""); if (b.bump) await learnNpm([laneMap()[repo]]); const notes = await releaseNotes(releaseInput(repo, { bump: b.bump, tick: b.tick })); return json(res, approveChanges(repo, { bump: b.bump, tick: b.tick, notes })); }
+      if (u.pathname === "/api/pending/approve" && req.method === "POST") { const b = await readBody(req), repo = String(b.repo || ""); if (b.bump) await learnNpm([laneMap()[repo]]); const notes = await releaseNotes(releaseInput(repo, { bump: b.bump })); return json(res, await approveRepo(repo, { bump: b.bump, notes })); }
+      if (u.pathname === "/api/pending/approve-changes" && req.method === "POST") { const b = await readBody(req), repo = String(b.repo || ""); if (b.bump) await learnNpm([laneMap()[repo]]); const notes = await releaseNotes(releaseInput(repo, { bump: b.bump, tick: b.tick })); return json(res, await approveChanges(repo, { bump: b.bump, tick: b.tick, notes })); }
       if (u.pathname === "/api/pending/sendback" && req.method === "POST") { const b = await readBody(req); return json(res, sendBack(String(b.id || ""))); }
       if (u.pathname === "/api/automerge" && req.method === "POST") { const b = await readBody(req); return json(res, setAutoMerge(String(b.repo || ""), !!b.on)); }
       if (u.pathname === "/api/tasks/push" && req.method === "POST") { const b = await readBody(req); return json(res, pushTasks(b)); }
-      if (u.pathname === "/api/scanroots") return json(res, { roots: loadConfig().scanRoots || [], effective: scanRoots(), home: scanHome() });
+      if (u.pathname === "/api/scanroots") { const st = reposState(); return json(res, { roots: loadConfig().scanRoots || [], effective: scanRoots(), home: scanHome(), searching: st.searching, searched: st.at || 0, found: st.list.length }); }
       if (u.pathname === "/api/scanroots/add" && req.method === "POST") { const b = await readBody(req); return json(res, addScanRoot(String(b.path || ""))); }
       if (u.pathname === "/api/scanroots/remove" && req.method === "POST") { const b = await readBody(req); return json(res, removeScanRoot(String(b.path || ""))); }
       // knowledge folders (knowledge.mjs): added or removed, the index catches up at once
@@ -307,7 +317,9 @@ async function startApp({ bin, since = 7, all = false, c = PLAIN_COLOURS } = {})
         return json(res, { started: true, model, id: e ? e.id : "" });
       }
       if (u.pathname === "/api/agents") return json(res, await withReleases(agentsList()));
-      if (u.pathname === "/api/agents/answer" && req.method === "POST") { const b = await readBody(req); return json(res, answerQuestions(String(b.path || ""), b.answers, { rerun: !!b.rerun })); }
+      // the answer, saved in the folder that asked; it says which lane that is, so "Sent to …"
+      // names where it went (a Marketing answer said "Sent to Paperclip Steve")
+      if (u.pathname === "/api/agents/answer" && req.method === "POST") { const b = await readBody(req), path = String(b.path || ""), r = answerQuestions(path, b.answers, { rerun: !!b.rerun }); return json(res, r && r.ok ? { ...r, lane: laneOfFolder(path) } : r); }
       if (u.pathname === "/api/agents/skip" && req.method === "POST") { const b = await readBody(req); return json(res, skipIdea(String(b.path || ""), b.text)); }
       // What a run handed back (handback.mjs): facts for memory, kept only on Remember; replies it waits on.
       if (u.pathname === "/api/agents/remember" && req.method === "POST") { const b = await readBody(req); return json(res, b.skip === true ? skipFacts(String(b.path || "")) : keepFacts(String(b.path || ""), { only: Array.isArray(b.only) ? b.only.map(Number) : undefined })); }
@@ -356,8 +368,8 @@ async function startApp({ bin, since = 7, all = false, c = PLAIN_COLOURS } = {})
       if (u.pathname === "/api/links/link" && req.method === "POST") { const b = await readBody(req); return json(res, await linkSite(String(b.id || ""))); }
       if (u.pathname === "/api/links/check" && req.method === "POST") { const b = await readBody(req); return json(res, await checkLink(String(b.id || ""))); }
       if (u.pathname === "/api/links/unlink" && req.method === "POST") { const b = await readBody(req); return json(res, unlinkSite(String(b.id || ""))); }
-      // Posts (post.mjs): the week's drafts, waiting on you. Approve only records your yes:
-      // the page copies the post itself and opens LinkedIn's share box; nothing is posted.
+      // Posts (post.mjs): the week's drafts, waiting on you. Approve is your yes: Marketing's
+      // agent posts it through Symbiot's signed-in browser.
       if (u.pathname === "/api/posts") return json(res, postsState());
       // Marketing: replies on LinkedIn (its watched notifications, marked "maybe a customer"),
       // and the 4-week test's table, with npm installs of the packages the posts are about
@@ -373,9 +385,14 @@ async function startApp({ bin, since = 7, all = false, c = PLAIN_COLOURS } = {})
       if (u.pathname === "/api/marketing/task" && req.method === "POST") { const b = await readBody(req); return json(res, marketingTask(b.text, b.product)); }
       if (u.pathname === "/api/marketing/move" && req.method === "POST") { const b = await readBody(req); return json(res, moveToMarketing(b.id, b.product)); }
       if (u.pathname === "/api/marketing/go" && req.method === "POST") return json(res, marketingGo());
+      // a draft as the post it will be (its preview, notes apart), its picture or video, and
+      // your Approve or Skip on it: approved, its agent posts it through Symbiot's browser
+      if (u.pathname === "/api/marketing/draft") return json(res, draftPreview(String(u.searchParams.get("rel") || "")));
+      if (u.pathname === "/api/marketing/media") { const m = laneMedia(String(u.searchParams.get("rel") || "")); if (!m) { res.writeHead(404); res.end("not found"); return; } res.writeHead(200, { "content-type": m.type, "cache-control": "private, max-age=300" }); res.end(readFileSync(m.file)); return; }
+      if (u.pathname === "/api/marketing/draft/answer" && req.method === "POST") { const b = await readBody(req); return json(res, marketingDraftAnswer(String(b.rel || ""), b.skip ? "skipped" : "approved")); }
       if (u.pathname === "/api/marketing/open" && req.method === "POST") { const b = await readBody(req), f = join(MARKETING_DIR, String(b.rel || "")); return json(res, f.startsWith(MARKETING_DIR + "/") && existsSync(f) ? { ok: openUrl(f) } : { error: "That draft isn't there any more." }); }
       if (u.pathname === "/api/posts/draft" && req.method === "POST") return json(res, await draftPosts());
-      if (u.pathname === "/api/posts/approve" && req.method === "POST") { const b = await readBody(req); return json(res, approvePost(String(b.id || ""), { copy: null })); }
+      if (u.pathname === "/api/posts/approve" && req.method === "POST") { const b = await readBody(req); return json(res, approvePost(String(b.id || ""))); }
       if (u.pathname === "/api/posts/edit" && req.method === "POST") { const b = await readBody(req); return json(res, editPost(String(b.id || ""), b.text)); }
       if (u.pathname === "/api/posts/skip" && req.method === "POST") { const b = await readBody(req); return json(res, skipPost(String(b.id || ""))); }
       // a draft's pictures and video: yours (the file itself as the body), a picture or clip of a page, shown, removed, their folder opened
@@ -389,7 +406,12 @@ async function startApp({ bin, since = 7, all = false, c = PLAIN_COLOURS } = {})
       // Reports (reports.mjs): what runs wrote up in their .symbiot/; read by id, never by path.
       if (u.pathname === "/api/reports") return json(res, { reports: listReports() });
       if (u.pathname === "/api/reports/read") return json(res, readReport(u.searchParams.get("id") || ""));
+      // A report's image (an <img> src, so its token is in ?t=): by the report's id and a src it shows, from its allowed folders only.
+      if (u.pathname === "/api/reports/image") { const f = reportImage(u.searchParams.get("id") || "", u.searchParams.get("src") || ""); if (f.error) { res.writeHead(404, { "content-type": "text/plain" }); res.end(f.error); return; } res.writeHead(200, { "content-type": f.type, "cache-control": "private, no-cache", "x-content-type-options": "nosniff" }); res.end(readFileSync(f.file)); return; }
       if (u.pathname === "/api/reports/seen" && req.method === "POST") return json(res, markAllRead());
+      if (u.pathname === "/api/reports/ideas" && req.method === "POST") { const b = await readBody(req); return json(res, reportIdeasAdd(String(b.id || ""), b.ideas)); }
+      if (u.pathname === "/api/reports/ask" && req.method === "POST") { const b = await readBody(req); return json(res, await reportAsk(String(b.id || ""), b.question)); }
+      if (u.pathname === "/api/reports/draft" && req.method === "POST") { const b = await readBody(req); return json(res, reportDraftAnswer(String(b.id || ""), !!b.approve)); }
       // Home (home.mjs): the liquid's live data, and its talk; Adapt (adapt.mjs): its
       // shape from how you use it (commit=1 when it wakes from rest, never mid-gesture).
       if (u.pathname === "/api/home") return json(res, homeState({ fresh: u.searchParams.get("fresh") === "1" }));
@@ -448,8 +470,10 @@ async function startApp({ bin, since = 7, all = false, c = PLAIN_COLOURS } = {})
       // the Week tab's week is saved to weeks/ too, as Write it now saves it (no notification: you're looking at it)
       if (u.pathname === "/api/run" && req.method === "POST") { const b = await readBody(req); const cmd = ["week", "standup", "todo"].includes(b.cmd) ? b.cmd : "week"; return json(res, cmd === "week" ? await runWeekly(writeup, { notify: false }) : await writeup(cmd)); }
       if (u.pathname === "/api/connect" && req.method === "POST") { return json(res, await connectProvider(await readBody(req))); }
-      // a sandbox (symbiot app --fresh) never offers an update: it would replace your real install
-      if (u.pathname === "/api/ping") { if (u.searchParams.get("fresh") === "1" && !SANDBOX) await checkLatest(); const w = u.searchParams.get("w") || ""; if (/^[a-z0-9]{6,20}$/.test(w) && u.searchParams.get("new") === "1") NEWEST_WIN = w; return json(res, { ...(NEWEST_WIN ? { window: NEWEST_WIN } : {}), version: VERSION, started: SERVER_STARTED, latest: LATEST_VERSION, newer: !SANDBOX && semverGt(LATEST_VERSION, VERSION), ...(UPDATING && UPDATING.retrying ? { retrying: UPDATING } : {}), ...(IN_TERMUX ? { termux: true } : {}), ...(SANDBOX ? { sandbox: true } : {}) }); }
+      // a sandbox (symbiot app --fresh) never offers an update: it would replace your real install.
+      // A headless browser (an agent's screenshot of Home) never becomes the newest window:
+      // that closed the user's real one, again and again (2026-10-08, "symbiot keeps crashing").
+      if (u.pathname === "/api/ping") { if (u.searchParams.get("fresh") === "1" && !SANDBOX) await checkLatest(); const w = u.searchParams.get("w") || ""; if (/^[a-z0-9]{6,20}$/.test(w) && u.searchParams.get("new") === "1" && !headlessAgent(req.headers["user-agent"])) NEWEST_WIN = w; return json(res, { ...(NEWEST_WIN ? { window: NEWEST_WIN } : {}), version: VERSION, started: SERVER_STARTED, latest: LATEST_VERSION, newer: !SANDBOX && semverGt(LATEST_VERSION, VERSION), ...(UPDATING && UPDATING.retrying ? { retrying: UPDATING } : {}), ...(IN_TERMUX ? { termux: true } : {}), ...(SANDBOX ? { sandbox: true } : {}) }); }
       // What's new: after an update, since the version you last saw (until you click Got it);
       // ?latest=1, what the update on offer brings, from its package on npm
       if (u.pathname === "/api/whatsnew") {
@@ -516,6 +540,7 @@ async function startApp({ bin, since = 7, all = false, c = PLAIN_COLOURS } = {})
   startWatches(); // pages you watch (Screens → Watch), read every few minutes
   startPhone(); // Watch on your phone: the computer listens if it's switched on, the phone asks if it's paired
   setInterval(() => { try { startWaiting(); } catch {} }, 20000).unref(); // a run that waits for your step starts once the file it names changes
+  setInterval(() => { try { workTick(); } catch {} }, 20000).unref(); // a waiting task starts once its lane is free (config.autoStart: false leaves it to Go)
   setInterval(() => { try { lanesTick(); } catch {} }, 20000).unref(); // agents hand work to other lanes, and hear back when it's done
   setTimeout(() => { orcaRelink().catch(() => {}); }, 15000).unref(); // a lane folder a handover renamed, added again in Orca where it is now
   // an agent's allow list that stays inside your work is turned on by itself, and the agent carries on
@@ -529,4 +554,4 @@ async function startApp({ bin, since = 7, all = false, c = PLAIN_COLOURS } = {})
   setInterval(() => { try { awaitTick(); } catch {} }, 60000).unref(); // a reply an agent's email waits on: found, and handed on
 }
 
-export { updateCmd, changesSince, whatsNew, tarFile, registryChangelog, BROWSER_KEEP, startApp, askRunningApp, isAppRunningWeekly, openApp };
+export { headlessAgent, updateCmd, changesSince, whatsNew, tarFile, registryChangelog, BROWSER_KEEP, startApp, askRunningApp, isAppRunningWeekly, openApp };

package/tasks.mjs

@@ -2,14 +2,14 @@
 // each repo gets (.symbiot/TASKS.md), what the agent ticked (review), and
 // Approve: branch, commit, push, PR, and the version bump and npm release facts
 // it shows.
-import { spawnSync } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { join } from "node:path";
-import { readFileSync, writeFileSync, existsSync, readdirSync, mkdirSync } from "node:fs";
+import { readFileSync, writeFileSync, existsSync, readdirSync, mkdirSync, statSync } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { VERSION, LATEST_VERSION, REGISTRY, semverGt, loadConfig, saveConfig, loadTasks, saveTasks, TASK_MAX, clipWords, taskWords, sameTask, uniqueTasks, sh, hasCmd, repoState } from "./core.mjs";
 import { handoverRules, ONLY_YOU, HANDBACK } from "./handover.mjs";
 import { userStyleLine } from "./adapt.mjs";
-import { QUESTIONS_MAX, OPTIONS_SHOWN, IDEAS_SHOWN, handoffCmd, runningHandoff, writeTasks, droppedTasks, startHeldTasks, connectorsLine } from "./agents.mjs";
+import { QUESTIONS_MAX, OPTIONS_SHOWN, IDEAS_SHOWN, isUrgent, handoffCmd, runningHandoff, untrackedBefore, forgetUntracked, writeTasks, droppedTasks, startHeldTasks, connectorsLine } from "./agents.mjs";
 import { gitDefaultBranch } from "./drift.mjs";
 import { readRunLog } from "./work.mjs";
 import { repoPathMap, laneMap, openWork, detectRepo } from "./scan.mjs";
@@ -125,6 +125,29 @@ function git(repo, args, timeout = 30000) {
   const r = spawnSync("git", ["-C", repo, ...args], { encoding: "utf8", timeout, maxBuffer: 32 * 1024 * 1024, env: { ...process.env, GIT_TERMINAL_PROMPT: "0" } });
   return { ok: r.status === 0, out: String(r.stdout || "").replace(/\s+$/, ""), err: String(r.stderr || (r.error && r.error.message) || "").trim() };
 }
+// The same, in the background: Approve's status and add can take minutes in a big
+// tree, and spawnSync held the whole app up until it timed out (ETIMEDOUT). On a
+// timeout git gets SIGTERM first, so it lets go of .git/index.lock.
+function gitAsync(repo, args, timeout = 30000, { input = null, env = {} } = {}) {
+  return new Promise((resolve) => {
+    let out = "", err = "", timedOut = false, done = false, kill = null;
+    const p = spawn("git", ["-C", repo, ...args], { env: { ...process.env, GIT_TERMINAL_PROMPT: "0", ...env }, stdio: [input == null ? "ignore" : "pipe", "pipe", "pipe"] });
+    const t = setTimeout(() => { timedOut = true; p.kill("SIGTERM"); kill = setTimeout(() => p.kill("SIGKILL"), 5000); }, timeout);
+    const end = (code, e) => { if (done) return; done = true; clearTimeout(t); clearTimeout(kill); resolve({ ok: code === 0 && !timedOut, out: out.replace(/\s+$/, ""), err: String(err || (e && e.message) || "").trim(), timedOut, timeout }); };
+    p.stdout.setEncoding("utf8"); p.stderr.setEncoding("utf8");
+    p.stdout.on("data", (d) => { out += d; }); p.stderr.on("data", (d) => { err += d; });
+    p.on("error", (e) => end(-1, e)); p.on("close", (code) => end(code));
+    if (input != null) { p.stdin.on("error", () => {}); p.stdin.end(input); }
+  });
+}
+// At least 2 minutes, and more for a long list of paths: 2 ms a path, up to 10.
+const gitTimeout = (n = 0) => Math.min(600000, 120000 + 2 * n);
+// What to tell the user when git didn't finish: never a bare ETIMEDOUT.
+function gitFailed(what, r, n = 0) {
+  if (!r.timedOut) return `${what} failed: ` + (r.err.split("\n").filter(Boolean).pop() || "unknown error");
+  const many = n > 5000 ? `this repo has about ${n.toLocaleString("en")} changed or untracked files` : "this repo may have a big untracked tree";
+  return `${what} timed out after ${Math.round(r.timeout / 1000)} s: ${many}, probably a venv, node_modules, a dataset or a cache missing from .gitignore. Add it to .gitignore, then approve again.`;
+}
 const NOT_SYMBIOT = ["--", ".", ":(exclude).symbiot"]; // .symbiot/ is Symbiot's scratch (brief + agent log), never shipped
 function workingChanges(path) {
   const st = git(path, ["status", "--porcelain", "-uall", ...NOT_SYMBIOT]);
@@ -134,6 +157,31 @@ function workingChanges(path) {
   const stat = [ins && `+${ins}`, del && `−${del}`, fresh && `${fresh} new`].filter(Boolean).join(" ");
   return { branch: git(path, ["rev-parse", "--abbrev-ref", "HEAD"]).out, files, stat };
 }
+// `git status --porcelain -z`: [{ st, file, from }], from being a rename's old path.
+function parseStatusZ(out) {
+  const parts = String(out || "").split("\0"), files = [];
+  for (let i = 0; i < parts.length; i++) {
+    const l = parts[i]; if (l.length < 4) continue;
+    const f = { st: l.slice(0, 2).trim(), file: l.slice(3) };
+    if (/^[RC]/.test(l)) f.from = parts[++i];
+    files.push(f);
+  }
+  return files;
+}
+// The paths Approve stages: every tracked change, and the untracked files the
+// agent's runs made. An untracked file that was already there before the first
+// run since the last approve (agents.mjs untrackedBefore) and hasn't changed
+// since is left out: scratch's 170k files of venvs and datasets timed out
+// `git add -A`, and staging the whole tree took in an unignored .env too. With
+// no note of what was there (a run started before Symbiot kept one), it's
+// every change.
+function taskPaths(path, files) {
+  const before = untrackedBefore(path), had = before ? new Set(before.files) : null;
+  const changed = (f) => { try { return statSync(join(path, f)).mtimeMs >= before.at; } catch { return true; } };
+  const mine = (f) => f.st !== "??" || !had || !had.has(f.file) || changed(f.file);
+  const keep = files.filter(mine);
+  return { paths: keep.flatMap((f) => (f.from ? [f.file, f.from] : [f.file])), left: files.length - keep.length };
+}
 // The full diff the agent left behind: tracked changes + new files, capped.
 function workingDiff(path, cap = 400000) {
   let d = git(path, ["diff", "HEAD", ...NOT_SYMBIOT]).out;
@@ -332,14 +380,21 @@ function releaseInput(repo, opts = {}) {
 // Ship with the version bumped when opts.bump is "patch" or "minor" and the repo
 // is offered one (bumpOffer), noted in its CHANGELOG.md if it keeps one (in
 // opts.notes' words, when given). Both are put back if the ship fails.
-function shipWithBump(path, texts, opts) {
-  const offer = (opts.bump === "patch" || opts.bump === "minor") && bumpOffer(path);
-  if (!offer) return shipChanges(path, texts, opts);
-  const to = offer[opts.bump], files = workingChanges(path).files.map((f) => f.file);
-  const undo = setVersion(path, to), undoLog = noteChangelog(path, to, texts, files, opts.notes);
-  const r = shipChanges(path, texts, { ...opts, bumped: to });
-  if (r.error) { undo(); undoLog(); return r; }
-  return { ...r, bumped: to };
+// One ship at a time per folder: Approve no longer holds the app up while git
+// runs, so a second click could start another on the same tree.
+const SHIPPING = new Set();
+async function shipWithBump(path, texts, opts) {
+  if (SHIPPING.has(path)) return { error: "Already approving here: wait for that one to finish." };
+  SHIPPING.add(path);
+  try {
+    const offer = (opts.bump === "patch" || opts.bump === "minor") && bumpOffer(path);
+    if (!offer) return await shipChanges(path, texts, opts);
+    const to = offer[opts.bump], files = workingChanges(path).files.map((f) => f.file);
+    const undo = setVersion(path, to), undoLog = noteChangelog(path, to, texts, files, opts.notes);
+    const r = await shipChanges(path, texts, { ...opts, bumped: to });
+    if (r.error) { undo(); undoLog(); return r; }
+    return { ...r, bumped: to };
+  } finally { SHIPPING.delete(path); }
 }
 // What the last run in a folder said when it finished: agent.log after the last
 // run's "=== name time ===" and "$ command" lines.
@@ -427,9 +482,13 @@ function commitSubject(texts) {
 // one instead (mergedAlready). Each step that can't happen (no remote, push
 // rejected, no gh) stops there and says so — the commit is never lost.
 // opts.push=false stops after the commit, opts.pr=false after the push.
-function shipChanges(path, texts, opts = {}) {
-  const ch = workingChanges(path);
+async function shipChanges(path, texts, opts = {}) {
+  const st = await gitAsync(path, ["status", "--porcelain", "-z", "-uall", ...NOT_SYMBIOT], gitTimeout());
+  if (!st.ok) return { error: gitFailed("git status", st) };
+  const ch = { files: parseStatusZ(st.out), branch: git(path, ["rev-parse", "--abbrev-ref", "HEAD"]).out };
   if (!ch.files.length) return { ok: true, nothing: true, note: "No uncommitted changes — approved without a commit." };
+  const { paths, left } = taskPaths(path, ch.files), leftNote = left ? `${left.toLocaleString("en")} untracked file${left === 1 ? " that was" : "s that were"} already there before the agent ran ${left === 1 ? "was" : "were"} left out.` : "";
+  if (!paths.length) return { ok: true, nothing: true, note: "No changes from the agent's runs — approved without a commit. " + leftNote };
   if (!ch.branch || ch.branch === "HEAD") return { error: "Detached HEAD — check out a branch first." };
   const base = gitDefaultBranch(path), day = new Date().toISOString().slice(0, 10); let branch = ch.branch, fresh = "";
   const newBranch = () => {
@@ -453,17 +512,20 @@ function shipChanges(path, texts, opts = {}) {
       if (sw.ok) branch = next;
     }
   }
-  // Stage everything, then drop .symbiot. A `. :(exclude).symbiot` pathspec
-  // warns+exits-1 once .symbiot is gitignored ("paths are ignored, use -f"),
-  // which falsely aborted the ship. `add -A` skips gitignored paths silently;
-  // the reset also covers repos where .symbiot isn't ignored.
-  const add = git(path, ["add", "-A"]); if (!add.ok) return { error: "git add failed: " + add.err, branch };
+  // Stage just the task's paths (taskPaths), in the background, given on stdin
+  // (170k of them don't fit in an argv) and taken literally (a `[` or `*` in a
+  // name isn't a glob). They come from a status that leaves .symbiot out; the
+  // reset also covers anything of it staged before.
+  const add = await gitAsync(path, ["add", "-A", "--pathspec-from-file=-", "--pathspec-file-nul"], gitTimeout(paths.length), { input: paths.join("\0"), env: { GIT_LITERAL_PATHSPECS: "1" } });
+  if (!add.ok) return { error: gitFailed("git add", add, paths.length), branch };
   git(path, ["reset", "-q", "--", ".symbiot"]); // never ship Symbiot's own scratch
   const subject = commitSubject(texts);
   const body = (texts.length ? texts.map((x) => "- " + x).join("\n") : "No ticked task covers these changes.") + (opts.bumped ? `\n\nBumps the version to ${opts.bumped}. ` + (publishesOnMerge(path) ? `It publishes to npm when this merges.` : `After this merges, tag v${opts.bumped} on ${base} to release it.`) : "");
   const cm = git(path, ["commit", "-m", subject, "-m", body]); if (!cm.ok) return { error: "Commit failed: " + (cm.err || cm.out), branch };
-  const out = { ok: true, branch, base, commit: git(path, ["rev-parse", "--short", "HEAD"]).out, subject, ...(fresh ? { note: fresh } : {}) };
-  const noted = (note) => ({ ...out, note: (fresh ? fresh + " " : "") + note });
+  forgetUntracked(path); // committed: the next run notes what's there afresh
+  const said = [fresh, leftNote].filter(Boolean).join(" ");
+  const out = { ok: true, branch, base, commit: git(path, ["rev-parse", "--short", "HEAD"]).out, subject, ...(said ? { note: said } : {}) };
+  const noted = (note) => ({ ...out, note: (said ? said + " " : "") + note });
   if (opts.push === false) return out;
   if (!git(path, ["remote", "get-url", "origin"]).ok) return noted("No origin remote — committed locally.");
   let ps = git(path, ["push", "-u", "origin", branch], 120000);
@@ -495,14 +557,16 @@ function shipChanges(path, texts, opts = {}) {
 // Per-repo opt-in to auto-merge Approve PRs once CI passes (default off).
 function autoMergeRepos() { const a = loadConfig().autoMerge; return Array.isArray(a) ? a : []; }
 function setAutoMerge(repo, on) { const cfg = loadConfig(); let a = (Array.isArray(cfg.autoMerge) ? cfg.autoMerge : []).filter((x) => x !== repo); if (on && repo) a.push(repo); if (a.length) cfg.autoMerge = a; else delete cfg.autoMerge; saveConfig(cfg); return { ok: true, repos: cfg.autoMerge || [] }; }
-function approveRepo(repo, opts = {}) {
-  const t = loadTasks(); const items = t.filter((x) => x.repo === repo && x.review && !x.done && !x.archived);
-  if (!items.length) return { error: "Nothing awaiting review for " + (repo || "(no repo)") + "." };
+async function approveRepo(repo, opts = {}) {
+  const waiting = (t) => t.filter((x) => x.repo === repo && x.review && !x.done && !x.archived);
+  const shipped = waiting(loadTasks());
+  if (!shipped.length) return { error: "Nothing awaiting review for " + (repo || "(no repo)") + "." };
   const path = laneMap()[repo]; if (!path) return { error: "Repo not found: " + repo };
   const busy = stillWorking(repo, path); if (busy) return busy;
-  const r = shipWithBump(path, uniqueTasks(items.map((x) => x.text)), { ...opts, autoMerge: opts.autoMerge !== undefined ? opts.autoMerge : autoMergeRepos().includes(repo) });
+  const r = await shipWithBump(path, uniqueTasks(shipped.map((x) => x.text)), { ...opts, autoMerge: opts.autoMerge !== undefined ? opts.autoMerge : autoMergeRepos().includes(repo) });
   if (r.error) return r;
-  const now = Date.now();
+  // read again: the ship took a while, and the list may have changed meanwhile
+  const ids = new Set(shipped.map((x) => x.id)), t = loadTasks(), items = waiting(t).filter((x) => ids.has(x.id)), now = Date.now();
   for (const x of items) { x.review = false; x.done = true; x.archived = true; x.archivedAt = now; x.approvedAt = now; for (const k of ["branch", "commit", "pr"]) if (r[k]) x[k] = r[k]; }
   const removed = applyRemovals(t);
   saveTasks(t);
@@ -513,14 +577,14 @@ function approveRepo(repo, opts = {}) {
 // awaiting review in the repo, this is just Approve. opts.tick: ids of the
 // repo's open tasks the changes finished (the run didn't tick them): they're
 // approved with the changes, as Approve does, so they don't go out again.
-function approveChanges(repo, opts = {}) {
-  if (loadTasks().some((x) => x.repo === repo && x.review && !x.done && !x.archived)) return approveRepo(repo, opts);
+async function approveChanges(repo, opts = {}) {
+  if (loadTasks().some((x) => x.repo === repo && x.review && !x.done && !x.archived)) return await approveRepo(repo, opts);
   const path = laneMap()[repo]; if (!path) return { error: "Repo not found: " + (repo || "(no repo)") };
   const busy = stillWorking(repo, path); if (busy) return busy;
   if (!workingChanges(path).files.length) return { error: "No uncommitted changes in " + repo + "." };
   const ids = new Set(Array.isArray(opts.tick) ? opts.tick.map(String) : []);
   const ticked = (t) => t.filter((x) => ids.has(x.id) && x.repo === repo && !x.done && !x.archived && !x.review);
-  const r = shipWithBump(path, uniqueTasks(ticked(loadTasks()).map((x) => x.text)), { ...opts, autoMerge: opts.autoMerge !== undefined ? opts.autoMerge : autoMergeRepos().includes(repo) });
+  const r = await shipWithBump(path, uniqueTasks(ticked(loadTasks()).map((x) => x.text)), { ...opts, autoMerge: opts.autoMerge !== undefined ? opts.autoMerge : autoMergeRepos().includes(repo) });
   if (r.error) return r;
   // read again: the ship took a while, and the list may have changed meanwhile
   const t = loadTasks(), items = ticked(t), now = Date.now();
@@ -565,6 +629,9 @@ function buildTasksMd(name, ctx, list) {
   if (ctx.connectors) L.push(`- **Connectors:** ${ctx.connectors}`);
   if (ctx.about && ctx.about.length) L.push("", ...ctx.about);
   L.push("", "## Tasks");
+  // urgent first, whatever kind it is (a crash fix filed under Docs waited behind 5 tasks, 2026-10-08)
+  const urgent = list.filter((t) => isUrgent(t.text)); list = list.filter((t) => !urgent.includes(t));
+  if (urgent.length) { L.push("### Urgent: do these first", "Stop at a safe point in anything else you're on (your changes stay), do these, then carry on with the rest."); for (const t of urgent) L.push(`- [ ] ${t.text}`); L.push(""); }
   const byType = {}; for (const t of list) { const ty = taskType(t.text); (byType[ty] = byType[ty] || []).push(t); }
   const keys = Object.keys(byType).sort((a, b) => TASK_ORDER.indexOf(a) - TASK_ORDER.indexOf(b));
   for (const ty of keys) { L.push(`### ${ty}`); for (const t of byType[ty]) L.push(`- [ ] ${t.text}`); L.push(""); }
@@ -630,4 +697,4 @@ function pushTasks(filter) {
   return { empty: false, written, unresolved, handoff: handoffCmd() };
 }
 
-export { addTask, toggleTask, removeTask, restoreTask, completedInRepo, removalOf, applyRemovals, applyDrops, syncTasks, workingChanges, workingDiff, publishesOnMerge, unreleased, bumpOffer, learnNpm, releaseNeeded, withReleases, setVersion, changelogEntry, changelogSection, noteChangelog, releaseInput, shipWithBump, runSummary, saidFinished, pendingReview, commitSubject, shipChanges, autoMergeRepos, setAutoMerge, approveRepo, approveChanges, sendBack, TASK_ORDER, taskType, buildTasksMd, pushTasks };
+export { gitFailed, taskPaths, addTask, toggleTask, removeTask, restoreTask, completedInRepo, removalOf, applyRemovals, applyDrops, syncTasks, workingChanges, workingDiff, publishesOnMerge, unreleased, bumpOffer, learnNpm, releaseNeeded, withReleases, setVersion, changelogEntry, changelogSection, noteChangelog, releaseInput, shipWithBump, runSummary, saidFinished, pendingReview, commitSubject, shipChanges, autoMergeRepos, setAutoMerge, approveRepo, approveChanges, sendBack, TASK_ORDER, taskType, buildTasksMd, pushTasks };