symbiot 0.57.6 → 0.57.8

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 What each Symbiot release brought, newest first. When Approve bumps the version, it writes that release here from the tasks it approved, worded as release notes by your connected AI (or in the tasks' own words without one). The app shows the releases newer than yours under "What's new" when it offers an update, and once more after you update.
 
+## 0.57.8
+
+- **An approved deploy with your server key goes through.** The membrane read `scp -i ~/.ssh/oracle_key …` as copying your key, when the key is only what scp signs in with (`ssh -i` already passed). So argena's deploy to the game server stayed blocked even after you approved it twice. Now scp's sign-in options don't count as files it copies. Copying a key or credentials themselves (`scp ~/.ssh/id_rsa host:`) is still stopped.
+- **Agents check Symbiot in a copy of their own.** Every brief now says to see Symbiot working in a sandbox (`symbiot app --fresh`), and the membrane stops a browser or screenshot pointed at your running app. That's what closed your window five times on 2026-10-08. Reading its API with curl is still fine.
+
+## 0.57.7
+
+- **A reply you sent yourself leaves Home.** If you paste a drafted reply in and send it yourself, then say so, its card goes, and so does a draft its agent noted as sent. Before, 0.57.6 kept asking for your OK on Frikkie's reply, already sent at 14:10, and showed the agent's note "Sent by the user… shortened to…" as if it were part of the reply.
+- **One Symbiot, even mid-update.** A launch that found Symbiot still restarting after an update used to start a second copy on another port, with its own window, and every timer then ran twice. Now it waits for the restarted app, opens that window and leaves it at that.
+
 ## 0.57.6
 
 - **See a drafted reply before you OK it.** A card like "Draft: Messaging, 1 new notification waits for your OK" used to say "The reply to Frikkie is ready for you to send" without showing the reply, so to check it you had to open LinkedIn. Now the card is "Reply to Frikkie on LinkedIn", with the reply itself on it, as it will look there (a LinkedIn message, a WhatsApp bubble or an email) and with none of the agent's notes. **Go ahead** sends it from your account in Symbiot's signed-in browser, exactly as shown. **Skip** drops it. **Change it** takes what you'd change in your own words: the agent redrafts, and the new version shows on the same card. The card no longer says the agent can't send it.

package/guard.mjs

@@ -8,6 +8,7 @@
 //   - delete outside the agent's own folder, or wipe a disk
 //   - sudo, or pipe something from the internet into a shell
 //   - read SSH keys or cloud credentials; change Symbiot's own settings
+//   - open the user's running Symbiot in a browser (a check uses a sandbox copy)
 //   - in a sandboxed repo run (agents.mjs sandboxFor), edit or write a file outside its
 //     repo and your folders (SYMBIOT_WRITES): its commands are held there by the sandbox
 // judge(tool, input, { cwd, home }) → null (go ahead) or { why }.
@@ -20,6 +21,8 @@ import { fileURLToPath } from "node:url";
 const SECRET = [".ssh", ".gnupg", ".aws", ".azure", ".kube", ".docker/config.json", ".config/gcloud", ".config/gh/hosts.yml", ".netrc", ".npmrc", ".pypirc", ".git-credentials"];
 const under = (p, d) => p === d || p.startsWith(d.endsWith("/") ? d : d + "/");
 const expand = (p, home, cwd) => resolve(cwd, String(p).replace(/^~(?=\/|$)/, home).replace(/^\$HOME(?=\/|$)/, home).replace(/^\$\{HOME\}(?=\/|$)/, home));
+const BROWSER = /\b(google-chrome(-stable)?|chromium(-browser)?|chrome|firefox|msedge|playwright|puppeteer|wkhtmltoimage|cutycapt)\b/i;
+const SCP_VALUE = /^-[346ABCOpqRrTv]*[iFoPSJcl]$/; // an scp option (alone or after flags, -rpi) whose value is the next word
 function secretPath(p, home) { return SECRET.some((s) => under(p, join(home, s))); }
 function symbiotConfig(p, home) { return p === join(home, ".config", "symbiot", "config.json"); }
 
@@ -55,11 +58,19 @@ function judgeBash(cmd, { cwd, home, branch }) {
       }
     }
     if (/^(cat|less|more|head|tail|cp|scp|base64|xxd|strings|grep|rg|sed|awk)$/.test(w[0])) {
-      for (const p of w.slice(1).filter((a) => !a.startsWith("-"))) { if (secretPath(expand(p, home, cwd), home)) return { why: "your keys and cloud credentials stay yours" }; }
+      // scp's sign-in options take a value (`-i ~/.ssh/key` is the key it signs in with, as
+      // ssh's is, never a file it copies): those aren't what it reads. Only what it copies
+      // counts: `scp ~/.ssh/id_rsa host:` stays blocked. The argena lane's approved deploy
+      // (`scp -i ~/.ssh/oracle_key server/x.py ubuntu@host:…`) was blocked (2026-10-08).
+      const own = w[0] === "scp" ? SCP_VALUE : null;
+      for (const p of w.slice(1).filter((a, i, all) => !a.startsWith("-") && !(own && own.test(all[i - 1] || "")))) { if (secretPath(expand(p, home, cwd), home)) return { why: "your keys and cloud credentials stay yours" }; }
     }
     if (/(^|\s)(>|>>|tee|sed\s+-i)\s*\S*\.config\/symbiot\/config\.json/.test(s)) return { why: "Symbiot's own settings are yours to change" };
   }
   if (/\b(curl|wget)\b[^|]*\|\s*(sudo\s+)?(ba|z|da)?sh\b/.test(c)) return { why: "running a script straight from the internet" };
+  // a browser on the user's running Symbiot: each page it opened counted as a new window and
+  // closed theirs, five times in four minutes (2026-10-08). Its API (curl) is fine to read.
+  if (BROWSER.test(c) && /\b(127\.0\.0\.1|localhost):7391\b/.test(c)) return { why: "that's the user's running Symbiot (their window and data): check it in a copy of your own, `symbiot app --fresh`" };
   return null;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "symbiot",
-  "version": "0.57.6",
+  "version": "0.57.8",
   "description": "Your week, written from your real work. Reads your local git and writes it up with the AI of your choice \u2014 Claude, OpenAI, Gemini, or a local model.",
   "type": "module",
   "bin": {

package/server.mjs

@@ -527,12 +527,23 @@ async function startApp({ bin, since = 7, all = false, c = PLAIN_COLOURS } = {})
   });
   server.on("error", (e) => {
     // Stable port busy (an older instance still exiting during an update, or a
-    // second app): retry briefly, then fall back to a random port.
+    // second app): retry briefly, then fall back to a random port unless it's Symbiot's.
     if (e && e.code === "EADDRINUSE" && tries < (RELAUNCH ? 40 : 8)) { tries++; setTimeout(() => { try { server.listen(PORT, "127.0.0.1"); } catch {} }, 500); }
     // after an update, the window only ever looks for the stable port: a copy on another
     // port would serve nobody and linger (one did, for hours), so it bows out
     else if (RELAUNCH) process.exit(0);
-    else { try { server.listen(0, "127.0.0.1"); } catch {} }
+    // still busy: if it's a Symbiot (one restarting after an update answers late), open its
+    // window and bow out. A copy on another port runs every timer a second time: one started
+    // just as 0.57.6 relaunched itself, and two apps ran side by side (2026-10-08).
+    else (process.env.SYMBIOT_FORCE_NEW ? Promise.resolve(null) : askRunningApp("ping", { port: PORT, token: TOKEN, ms: 2500 })).then((p) => {
+      if (p && p.version) {
+        const url = `http://127.0.0.1:${PORT}/?t=${TOKEN}`, how = process.env.SYMBIOT_NO_OPEN === "1" ? "" : openApp(url);
+        console.log(`\n${c.g("●")} ${c.b("Symbiot")} is already running (v${p.version}) at ${c.b(url)}`);
+        console.log(how ? c.d(`  Opened the existing window (${/^[aeiou]/.test(how) ? "an" : "a"} ${how}).`) : c.d("  Open that URL in your browser."));
+        process.exit(0);
+      }
+      try { server.listen(0, "127.0.0.1"); } catch {}
+    });
   });
   server.listen(PORT, "127.0.0.1");
   checkLatest(); setInterval(checkLatest, 2 * 60 * 1000).unref(); // background update check (every 2 min)

package/tasks.mjs

@@ -635,7 +635,7 @@ function buildTasksMd(name, ctx, list) {
   const byType = {}; for (const t of list) { const ty = taskType(t.text); (byType[ty] = byType[ty] || []).push(t); }
   const keys = Object.keys(byType).sort((a, b) => TASK_ORDER.indexOf(a) - TASK_ORDER.indexOf(b));
   for (const ty of keys) { L.push(`### ${ty}`); for (const t of byType[ty]) L.push(`- [ ] ${t.text}`); L.push(""); }
-  L.push("## When you finish an item", "- Tick it here (`- [x]`) as soon as it's done — that's how it reaches review. Ticking doesn't archive it: the user approves it in Symbiot, which commits it on a branch and opens a PR.", "- Leave your changes **uncommitted**, and don't tick anything you didn't finish or couldn't verify.", "- If an item has numbered steps (1), 2), …), say `Step N: …` as you start each one, so Home shows how far along you are.", "- If the user says to drop an item (in ANSWERS.md, say), delete its line here: Symbiot closes it, so it isn't sent again. Don't delete one for any other reason.", "");
+  L.push("## When you finish an item", "- Tick it here (`- [x]`) as soon as it's done — that's how it reaches review. Ticking doesn't archive it: the user approves it in Symbiot, which commits it on a branch and opens a PR.", "- Leave your changes **uncommitted**, and don't tick anything you didn't finish or couldn't verify.", "- If an item has numbered steps (1), 2), …), say `Step N: …` as you start each one, so Home shows how far along you are.", "- To see Symbiot itself working (its Home, a layout, a card), run a copy of your own: `node index.mjs app --fresh` from this repo, or `symbiot app --fresh`. Never point a browser, a screenshot or a proxy at the user's running Symbiot (127.0.0.1:7391): it's their window and their data.", "- If the user says to drop an item (in ANSWERS.md, say), delete its line here: Symbiot closes it, so it isn't sent again. Don't delete one for any other reason.", "");
   L.push(...handoverRules(ctx.lanes || [], name), ...HANDBACK);
   L.push("## If you need a decision, or have ideas", "You may be running unattended, so you can't ask in chat. Write `.symbiot/QUESTIONS.md` instead: Symbiot shows it to the user on your block in its Workdesk, and their answers come back in `.symbiot/ANSWERS.md` (read that first if it exists).",
     `- At most ${QUESTIONS_MAX} questions, under a \`## Questions\` heading. Each is a \`### \` heading, then a line of context, then exactly ${OPTIONS_SHOWN} options as \`- \` bullets, the one you recommend first, marked \`(recommended)\`. Symbiot shows only the first ${OPTIONS_SHOWN}; the user can always answer in their own words.`,

package/watch.mjs

@@ -561,22 +561,33 @@ const PLATFORM = { chat: "WhatsApp", social: "LinkedIn" };
 function replyOf(md) {
   const s = String(md || ""), m = s.match(/^##\s+The reply\s*$/m); if (!m) return null;
   let body = s.slice(m.index + m[0].length); const nx = body.search(/^##\s/m); if (nx >= 0) body = body.slice(0, nx);
-  const lines = body.replace(/^\s*\n/, "").replace(/\s+$/, "").split("\n");
+  let lines = body.replace(/^\s*\n/, "").replace(/\s+$/, "").split("\n");
   const to = /^\s*To:\s*/i.test(lines[0] || "") ? lines.shift().replace(/^\s*To:\s*/i, "").trim() : "";
+  // a run's note that it went out ("Sent by the user on … at 2:10 PM, shortened to: …") isn't the reply
+  const at = lines.findIndex((l) => SENT_NOTE.test(l)), sent = at >= 0; if (sent) lines = lines.slice(0, at);
   const text = lines.join("\n").trim();
-  return text ? { to, text } : null;
+  return text ? { to, text, ...(sent ? { sent: true } : {}) } : null;
+}
+const SENT_NOTE = /^\s*(sent|posted|replied)\b.*\b(by|on|at)\b/i;
+// The user sent it themselves (they pasted it in, say) and said so: the newest answer in
+// its ANSWERS.md ("Pasted and sent, so this one's done", then "Done: the user did it").
+// Frikkie's reply went out at 14:10, and 0.57.6 still put it on Home for an OK (2026-10-08).
+function sentByUser(answers) {
+  const blocks = String(answers || "").split(/^###\s+/m).slice(1);
+  const last = blocks.slice(-2).join("\n");
+  return /\b(pasted and sent|i sent|sent it|already sent|it'?s sent|was sent|sent, so)\b/i.test(last);
 }
 const readDraftFile = (dir, f) => { try { return readFileSync(join(dir, ".symbiot", f), "utf8"); } catch { return ""; } };
 const draftMeta = (dir) => { try { return JSON.parse(readDraftFile(dir, "handoff.json")) || {}; } catch { return {}; } };
 const isDraftDir = (dir) => { const h = draftMeta(dir); return !!(h.draft || (h.env && h.env.SYMBIOT_DRAFT)); };
 // A draft waiting for the user: its run drafted it (the task ticked) and wrote the
-// reply down, and it hasn't been sent or skipped. { id, dir, platform, kind, to, text } or null.
+// reply down, and it hasn't been sent (by Symbiot, or by the user, who said so) or skipped. { id, dir, platform, kind, to, text } or null.
 function draftCard(dir) {
   const h = draftMeta(dir); if (!h.draft && !(h.env && h.env.SYMBIOT_DRAFT)) return null;
   const d = h.draft || {}; if (d.state === "skipped" || d.state === "sent") return null;
   const md = readDraftFile(dir, "TASKS.md");
   if (!/^\s*-\s*\[x\]\s*Draft a reply/im.test(md)) return null; // still drafting, sending, or never got that far
-  const r = replyOf(md); if (!r) return null;
+  const r = replyOf(md); if (!r || r.sent || sentByUser(readDraftFile(dir, "ANSWERS.md"))) return null; // gone out already: nothing to OK
   const kind = d.kind || (/^# Draft a reply: .*(LinkedIn)/m.test(md) ? "social" : /WhatsApp/.test(md) ? "chat" : "mail");
   const platform = d.platform || PLATFORM[kind] || (md.match(/^# Draft a reply: (.+)$/m) || [])[1] || "your mail";
   return { id: dir.split(/[\\/]/).pop(), dir, platform, kind, to: r.to, text: r.text };