symbiot 0.58.2 → 0.59.0

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 What each Symbiot release brought, newest first. When Approve bumps the version, it writes that release here from the tasks it approved, worded as release notes by your connected AI (or in the tasks' own words without one). The app shows the releases newer than yours under "What's new" when it offers an update, and once more after you update.
 
+## 0.59.0
+
+- **Symbiot Free and Symbiot Pro.** Every install starts with 14 days of Pro. After that, Free keeps the orb, Home, Talk to Symbiot, your week and standups, voice and the Away screen, with one agent at a time, up to 3 projects and one connected inbox or chat. Pro (US$12 a month or US$99 a year) adds any number of agents at once, every project, every inbox and chat, the marketing lane and Approve-and-ship. **Settings → Symbiot Pro** shows where you stand, takes a key and lets you swap one of Free's 3 projects. A limit never stops anything running: the next thing just doesn't start, with a line saying why. Keys are checked offline (signed by Ghost AI; cancelled keys are listed on symbiot.co.za).
+- **Symbiot doesn't work on its own code.** No agent runs in Symbiot's repo or a fork of it, and the guard stops agents editing Symbiot's installed files or its licence files.
+- **Elastic License 2.0** from this version on (0.58.2 and earlier stay MIT).
+- **Tests never sign in or install for real.** The test that presses every button was starting a real Claude sign-in in the browser and running Anthropic's installer; both are now switched off in tests (`SYMBIOT_NO_SIGNIN`).
+## 0.58.3 — 2026-10-09
+
+- Fixed urgent requests to a parked project: it is now unparked for the work, and other projects are released if nothing starts.
+- Fixed a stuck urgent hold that kept projects paused for hours; it now clears about two minutes after nothing starts running.
+- Changed agents so they no longer start in a folder with no open tasks or new answers, which avoids wasted sessions.
+- Fixed Symbiot saying an agent was "already on urgent work" when nothing was running.
+- Added a "posted" status for marketing drafts so a posted draft leaves the Marketing orb and can't be posted twice.
+- Added `symbiot screens upload` to attach a picture or video to a page's file field, such as a LinkedIn post.
+- Added a fact-only brand brief for the designer making the Symbiot icon and logo.
+- Changed the LinkedIn reader to capture who sent each message and what each notification is about, not just badge counts.
+- Added a review of the mobile companion spec, with follow-up tasks and open decisions.
+- Added a "superseded" status so a redone marketing post replaces the old one on the Marketing orb.
+- Added the pick tray to the Marketing page, showing captures with switchable blur boxes and one-click media selection.
+- Fixed Home cards erasing what you were typing in "answer in your own words" whenever the page updated.
+- Fixed tall question cards on Home overlapping the working-agents row below them.
+- Changed where Symbiot keeps your AI key and app token so agent runs can no longer read them.
+
 ## 0.58.2
 
 - **A voice that doesn't sound robotic, picked for you.** When Symbiot reads a reply out, it uses your computer's own voice only when that's a modern, natural one (Edge's Natural voices on Windows, Apple's Premium and Enhanced voices, a phone's own). Otherwise, as on Linux, where Chrome only has its older Google voices and espeak, Symbiot speaks with its own voice: Piper, a small open-source speech engine that runs on your computer. The accent follows where you are (British English for South Africa, the UK, Australia and the rest; American for the US and Canada), and both voices are public domain. Nothing to choose, no account, nothing leaves your computer. It downloads once (about 85 MB) the first time it's needed, while the system voice covers that first reply, and then answers sentence by sentence, the first in under a second.

package/LICENSE

@@ -1,21 +1,98 @@
-MIT License
-
-Copyright (c) 2026 Garth White (GhostAI)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+Copyright (c) 2026 Garth White (Ghost AI)
+
+Symbiot is licensed under the Elastic License 2.0, below. Versions up to and
+including 0.58.2 were released under the MIT License and stay under it.
+
+Elastic License 2.0
+
+URL: https://www.elastic.co/licensing/elastic-license
+
+## Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+## Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject to
+the limitations and conditions below.
+
+## Limitations
+
+You may not provide the software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set of
+the features or functionality of the software.
+
+You may not move, change, disable, or circumvent the license key functionality
+in the software, and you may not remove or obscure any functionality in the
+software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other notices
+of the licensor in the software. Any use of the licensor’s trademarks is subject
+to applicable law.
+
+## Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the software. If you or your company make any written claim that the software
+infringes or contributes to infringement of any patent, your patent license for
+the software granted under these terms ends immediately. If your company makes
+such a claim, your patent license ends immediately for work on behalf of your
+company.
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you
+also gets a copy of these terms.
+
+If you modify the software, you must include in any modified copies of the
+software prominent notices stating that you have modified the software.
+
+## No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+## Termination
+
+If you use the software in violation of these terms, such use is not licensed,
+and your licenses will automatically terminate. If the licensor provides you
+with a notice of your violation, and you cease all violation of this license no
+later than 30 days after you receive that notice, your licenses will be
+reinstated retroactively. However, if you violate these terms after such
+reinstatement, any additional violation of these terms will cause your licenses
+to terminate automatically and permanently.
+
+## No Liability
+
+*As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of
+legal claim.*
+
+## Definitions
+
+The **licensor** is the entity offering these terms, and the **software** is the
+software the licensor makes available under these terms, including any portion
+of it.
+
+**you** refers to the individual or entity agreeing to these terms.
+
+**your company** is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that
+organization. **control** means ownership of substantially all the assets of an
+entity, or the power to direct its management and policies by vote, contract, or
+otherwise. Control can be direct or indirect.
+
+**your licenses** are all the licenses granted to you for the software under
+these terms.
+
+**use** means anything you do with the software requiring one of your licenses.
+
+**trademark** means trademarks, service marks, and similar rights.

package/README.md

@@ -1250,6 +1250,8 @@ symbiot screens type <id> "Search mail" "invoice" --enter --yes   # type into a
                                        # (--yes isn't needed on a site under Trusted sites in Settings)
 symbiot screens type <id> To "sam@example.com" --yes   # without --enter: the text stays in the field...
 symbiot screens press <new id> Send --yes  # ...for a press on the screen that just printed
+symbiot screens upload <id> "Add media" ~/clip.mp4 --yes   # put a file in the page's file box: the field,
+                                       # or the button a site hides it behind ("used" says which box)
 symbiot screens scroll <id>            # "more": "below"? scroll down and map the next part (or up, top, bottom)
 symbiot screens whole <id>             # all of that page in one tall screen (or: symbiot screens map <site> --whole)
 symbiot screens show <id>              # a saved screen's blueprint
@@ -1417,6 +1419,32 @@ expects. Symbiot rescales for `xdotool` and for `cliclick` on a Retina screen, b
 it can't read the scale on Wayland, and ydotool's moves follow your pointer
 acceleration, so a click there can land off target.
 
+## Symbiot Free and Pro
+
+Every install starts with **14 days of Pro**, no key and no card. After that Symbiot
+carries on as **Free**:
+
+- the orb, Home and Talk to Symbiot (typed or spoken), your week, your standup and
+  what's on your plate, the Away screen;
+- **one agent at a time**, in **up to 3 projects** (the first 3 it works in; Settings →
+  Symbiot Pro can free a slot for another);
+- **one connected inbox or chat**.
+
+**Pro** (US$12 a month or US$99 a year) adds any number of agents at once, every project,
+every inbox and chat (all your mail, WhatsApp, LinkedIn, calendars), the marketing lane
+and Approve-and-ship. Get it from [symbiot.co.za](https://symbiot.co.za/#pro) and paste
+the key you're sent into **Settings → Symbiot Pro**. A limit never stops anything already
+running: it only keeps the next thing from starting, and says why.
+
+Keys are checked on your computer (they're signed by Ghost AI; there's no account and no
+server). Symbiot never works on its own code (its repo, a fork of it, or its installed
+files), so it can't be asked to take out its own limits.
+
+**Licence.** From 0.59.0 Symbiot is under the [Elastic License 2.0](LICENSE): free to use,
+change and share, but not to get round the licence key, sell it as a hosted service, or
+remove its notices. Versions up to and including 0.58.2 were released under MIT and stay
+under it.
+
 ## Config, development and releasing
 
 Config files, environment variables (`SYMBIOT_MODEL`, `SYMBIOT_PORT`, …), the test

package/agents.mjs

@@ -1,6 +1,8 @@
 // Handing a repo to the user's agent: the saved command template, the one-click
 // presets (and the Orca IDE one), the background-job registry behind the Agents
 // tab, and the questions an unattended agent leaves for the user.
+import { MARKETING_DIR } from "./marketing.mjs";
+import { licenceState, isPro, can, canWorkIn } from "./licence.mjs";
 import { spawn } from "node:child_process";
 import { homedir } from "node:os";
 import { join, dirname, resolve, relative } from "node:path";
@@ -190,7 +192,7 @@ function withTrust(tmpl, box = null) {
 // config.agentSandbox: false turns it off.
 const SANDBOX_DIR = join(CONFIG_DIR, "sandbox");
 const SANDBOX_CACHES = [".npm", ".cache"]; // npm's cache and logs; pip, uv, node-gyp, Chrome for Testing
-const SANDBOX_SECRETS = [".ssh", ".gnupg", ".aws", ".azure", ".kube", ".docker", ".config/gcloud", ".config/gh", ".netrc", ".npmrc", ".pypirc", ".git-credentials", ".config/symbiot/config.json"]; // your AI's key and the app's token too
+const SANDBOX_SECRETS = [".ssh", ".gnupg", ".aws", ".azure", ".kube", ".docker", ".config/gcloud", ".config/gh", ".netrc", ".npmrc", ".pypirc", ".git-credentials", ".config/symbiot/config.json", ".config/symbiot/secrets.json"]; // your AI's key and the app's token too
 // Local sockets are allowed (headless Chrome needs one to start, so the browser tests
 // ran in no sandboxed run), but the ones that would be a way out are hidden: Docker's,
 // and your session's (its bus starts commands outside, through systemd-run; X11 and
@@ -264,12 +266,15 @@ function noteSession(path, code, resumed) {
 // A folder whose last run stopped on questions, with nothing changed since
 // that could answer them, gets no run: { blocked, questions, note }
 // (blockedAgain). force starts one anyway (something changed elsewhere).
-function runHandoff(repoPath, { force = false } = {}) {
+// A folder with nothing to work from gets none either, forced or not (nothingToDo).
+function runHandoff(repoPath, { force = false, lost = false } = {}) {
   let tmpl = handoffCmd(); if (!tmpl || !repoPath) return null;
   if (isParked(repoPath)) return { blocked: true, parked: true, questions: 0, note: PARKED_NOTE }; // even forced: that's what parking is for
+  const lic = licenceGate(repoPath); if (lic) return lic; // Free's limits, and never Symbiot's own code (licence.mjs); even forced
   let opts = {}; try { opts = JSON.parse(readSymbiot(repoPath, "handoff.json")) || {}; } catch {}
   const busy = runningHandoff(repoPath); if (busy) return { busy: true, id: busy.id || "", pid: busy.pid, auto: !!busy.auto };
   releaseHeldTasks(repoPath); // held for an agent another process started, which has since exited
+  const idle = !lost && nothingToDo(repoPath); if (idle) return { blocked: true, idle: true, questions: 0, note: idle };
   const scoped = withScope(withConnectors(tmpl, repoPath), repoPath), box = isClaudeCmd(scoped) && trustFull() ? sandboxFor(repoPath, scoped) : null; // a repo run's sandbox, on top of the membrane
   tmpl = withStream(withTrust(scoped, box));
   const resume = isClaudeCmd(tmpl) ? resumeFor(repoPath) : null;
@@ -280,9 +285,10 @@ function runHandoff(repoPath, { force = false } = {}) {
   noteUntracked(repoPath);
   const lock = join(repoPath, ".symbiot", LOCK);
   const own = opts.env && typeof opts.env === "object" ? Object.fromEntries(Object.entries(opts.env).map(([k, v]) => [k, String(v)])) : null, boxEnv = sandboxEnv(box);
-  const env = own || boxEnv ? { ...(own || {}), ...(boxEnv || {}) } : null;
+  const owner = licenceState().plan === "owner" ? { SYMBIOT_OWNER: "1" } : null; // the guard lets only the owner's runs touch Symbiot's own files
+  const env = own || boxEnv || owner ? { ...(own || {}), ...(boxEnv || {}), ...(owner || {}) } : null;
   const e = track(typeof opts.name === "string" && opts.name ? opts.name.slice(0, 80) : repoPath.split("/").pop(), fillHandoff(runCmd, repoPath, resume ? RESUME_PROMPT : HANDOFF_PROMPT), repoPath, (code) => {
-    if (noteSession(repoPath, code, !!resume) === "lost") { setTimeout(() => { try { runHandoff(repoPath, { force: true }); } catch {} }, 300); return; } // its conversation is gone: start afresh
+    if (noteSession(repoPath, code, !!resume) === "lost") { setTimeout(() => { try { runHandoff(repoPath, { force: true, lost: true }); } catch {} }, 300); return; } // its conversation is gone: start afresh
     try { if (JSON.parse(readFileSync(lock, "utf8")).pid === e.pid) unlinkSync(lock); } catch {}
     noteBlocked(repoPath, tmpl, e.startedAt, code);
     setTimeout(() => { try { autoAllow(repoPath); } catch {} }, 300); // a list it proposed inside your work: turned on, and on it goes
@@ -296,6 +302,44 @@ function runHandoff(repoPath, { force = false } = {}) {
   noteRun(e);
   return e;
 }
+// ---- nothing to do: no run ----------------------------------------------------
+// A run in ~ started with no .symbiot/TASKS.md there, found nothing to action and
+// only cost a session (2026-10-07). A run needs something to work from: an
+// unticked task, or an answer that came in since the folder's last run started
+// (an approved post or draft, a reply to its question: those carry on with every
+// task ticked, and Marketing's folder may have no TASKS.md at all). Else the note
+// for { blocked, idle }, even forced: Start it anyway would start the same
+// nothing. Briefs are written before their run starts (actNow, draftReply,
+// pushTasks), and a held one lands first (runHandoff), so they count. Only the
+// run that restarts a lost conversation skips this: its answer is older than the
+// failed resume's start.
+const OPEN_TASK = /^\s*(?:[-*+]|\d+[.)])\s*\[ \]/m;
+function nothingToDo(path) {
+  const md = readSymbiot(path, "TASKS.md"); if (OPEN_TASK.test(md)) return "";
+  let answered = 0; try { answered = statSync(join(path, ".symbiot", "ANSWERS.md")).mtimeMs; } catch {}
+  const last = [...readSymbiot(path, "agent.log").matchAll(/^=== .* (\d{4}-\d\d-\d\dT[\d:.]+Z) ===$/gm)].pop();
+  if (answered && answered > (last ? Date.parse(last[1]) || 0 : 0)) return "";
+  const name = path === homedir() ? "~" : path.split(/[\\/]/).filter(Boolean).pop() || path;
+  return md.trim() ? `Not started: every task in ${name}'s .symbiot/TASKS.md is ticked and no answer has come in since its last run, so an agent there would have nothing to do. Send it a task first.`
+    : `Not started: ${name} has no .symbiot/TASKS.md, so an agent there would have nothing to do. Send it a task first.`;
+}
+// ---- Symbiot Free and Pro (licence.mjs) -------------------------------------
+// A run that Free doesn't cover doesn't start; it says why, the way a parked lane does.
+// Nothing running is touched. Free's 3 projects are the first 3 it works in (Settings
+// can free one); the marketing lane is Pro.
+function licenceGate(repoPath, st = licenceState()) {
+  const self = canWorkIn(repoPath, st); if (!self.ok) return { blocked: true, self: true, questions: 0, note: self.why };
+  if (isPro(st)) return null;
+  if (repoPath === MARKETING_DIR) { const m = can("marketing", {}, st); return { blocked: true, pro: true, questions: 0, note: m.why }; }
+  const running = HANDOFFS.filter((x) => x.handoff && x.status === "running" && x.path !== repoPath).length;
+  const a = can("agents", { running }, st); if (!a.ok) return { blocked: true, pro: true, questions: 0, note: a.why };
+  const cfg = loadConfig(), L = cfg.licence || {}, mine = Array.isArray(L.projects) ? L.projects : [];
+  if (!mine.includes(repoPath)) {
+    const p = can("projects", { count: mine.length }, st); if (!p.ok) return { blocked: true, pro: true, questions: 0, note: p.why + " Settings → Symbiot Pro can swap one of your 3 for this." };
+    cfg.licence = { ...L, projects: [...mine, repoPath] }; saveConfig(cfg);
+  }
+  return null;
+}
 // ---- a parked lane: its tasks start no runs ----------------------------------
 // A lane blocked on something only the user can give (a token from Meta) ran 27
 // times: every answer, handover, Go and Start it anyway started it again, to say
@@ -321,7 +365,12 @@ function parkLane(path, on) {
 // test stopped halfway would be void), stops the urgent lane's own routine run (its
 // changes stay in the folder, and the next run carries on from them) so the urgent
 // one starts now, and when that run ends, urgentDone unparks those lanes in their
-// old order and starts the ones with work waiting. Lanes you parked stay parked.
+// old order and starts the ones with work waiting. Lanes you parked stay parked,
+// except the urgent lane itself: on 2026-10-09 symbiot was parked, so every urgent
+// handover there parked marketing, started nothing, and still said "it's already on
+// urgent work, and takes this next" while 0 agents worked. Asking for urgent work in
+// a lane is the newest thing you've said about it, so it's unparked for it; and if
+// its run still doesn't start, urgentUndo takes back what urgentFirst did.
 const CAPS_OK = /^(README|TODO|FIXME|HTML|JSON|YAML|HTTP|HTTPS|OAUTH|CHANGELOG|TASKS|ANSWERS|QUESTIONS|HANDOFF|REMEMBER|AWAITING|SKIPPED|LICENSE|CLAUDE|AGENTS|NOTE|ASAP|SAST|UTC|GPU|CPU|RAM|USB|SDK|JDK|API|URL|CSS|DNS|SSH|SMS|PDF|PNG|SVG|MCP|LLM|CLI|ENV|PATH|HOME|WIP|ETA)$/;
 function isUrgent(text) {
   const t = String(text || "");
@@ -338,24 +387,43 @@ function stopRun(path) {
   try { process.kill(-r.pid, "SIGTERM"); } catch { try { process.kill(r.pid, "SIGTERM"); } catch { return false; } } // its own process group (track: detached)
   return true;
 }
-// lanes: the paths to consider ({ name: path }); returns { parked: [names], stopped }
+// lanes: the paths to consider ({ name: path }); returns { parked: [names], parkedPaths,
+// stopped, unparked (it was parked: now it isn't), busy: "urgent" | "routine" | "" (a run
+// there now: one already on urgent work, which this waits for, or one it couldn't stop) }
 function urgentFirst(path, { lanes = null, stop = stopRun, running = runningHandoff } = {}) {
-  if (!path) return { parked: [], stopped: false };
+  if (!path) return { parked: [], parkedPaths: [], stopped: false, unparked: false, busy: "" };
   const u = urgentState() || { at: Date.now(), paths: [], parked: [], runs: [] };
-  if (!u.paths.includes(path)) u.paths.push(path);
-  if (u.parked.includes(path)) { u.parked = u.parked.filter((p) => p !== path); parkLane(path, false); } // urgent itself now
+  if (!u.paths.includes(path)) { u.paths.push(path); u.at = Date.now(); }
+  if (u.parked.includes(path)) u.parked = u.parked.filter((p) => p !== path); // urgent itself now
+  const unparked = isParked(path); if (unparked) parkLane(path, false);
   const all = lanes || Object.fromEntries(loadRuns().map((r) => [String(r.name || r.path.split("/").pop()), r.path]));
-  const parked = [], already = parkedPaths();
+  const parked = [], mine = [], already = parkedPaths();
   for (const [name, p] of Object.entries(all)) {
     if (!p || u.paths.includes(p) || already.includes(p)) continue; // yours stay yours
     if (!running(p) && !readSymbiot(p, HELD)) continue; // nothing going or waiting there
-    parkLane(p, true); u.parked.push(p); parked.push(name);
+    parkLane(p, true); u.parked.push(p); parked.push(name); mine.push(p);
   }
-  // its own lane: a routine run stops so this one starts now; one that's already on urgent work keeps going
-  const busy = running(path), onIt = busy && (u.runs.includes(busy.id) || hasOpenUrgent(readSymbiot(path, "TASKS.md")));
+  // its own lane: a routine run stops so this one starts now; one that's already on urgent
+  // work keeps going, and counts as the urgent run, so its end resumes what was parked
+  const busy = running(path), onIt = !!busy && (u.runs.includes(busy.id) || hasOpenUrgent(readSymbiot(path, "TASKS.md")));
+  if (onIt && busy.id && !u.runs.includes(busy.id)) u.runs.push(busy.id);
   const stopped = !!busy && !onIt && stop(path);
   saveUrgent(u);
-  return { parked, stopped };
+  return { parked, parkedPaths: mine, stopped, unparked, busy: !busy ? "" : onIt ? "urgent" : stopped ? "" : "routine" };
+}
+// The urgent lane's run didn't start (no agent command, a step of yours first, its
+// questions unanswered) and nothing runs there: nothing will end to resume the lanes
+// urgentFirst parked, so they're unparked now, and the lane leaves the urgent record.
+function urgentUndo(path, did, { running = runningHandoff } = {}) {
+  if (!path || !did || running(path)) return false;
+  const u = urgentState(); if (!u) return false;
+  const back = (did.parkedPaths || []).filter((p) => u.parked.includes(p));
+  for (const p of back) if (parkedPaths().includes(p)) parkLane(p, false);
+  u.parked = u.parked.filter((p) => !back.includes(p));
+  u.paths = u.paths.filter((p) => p !== path);
+  saveUrgent(u.paths.length ? u : null);
+  if (!u.paths.length && u.parked.length) resumeParked(u.parked); // parked by an earlier urgent ask that never ran either
+  return true;
 }
 // the urgent lane's run started: when it ends, the parked work resumes (runHandoff's exit)
 function noteUrgentRun(path, id) { const u = urgentState(); if (u && u.paths.includes(path) && id && !u.runs.includes(id)) { u.runs.push(id); saveUrgent(u); } }
@@ -376,11 +444,13 @@ function resumeParked(paths, start = runHandoff) {
   return { unparked: paths, resumed };
 }
 // The app restarted under an urgent run (its exit never came), or it never started:
-// the parked lanes don't wait forever.
-const URGENT_MAX = 6 * 3600 * 1000;
+// the parked lanes don't wait forever. A record with no run going in any urgent lane is
+// over once URGENT_GRACE has passed (a stopped routine run takes a moment to exit, and
+// the urgent one starts then): before, one whose run never started held marketing for 6h.
+const URGENT_MAX = 6 * 3600 * 1000, URGENT_GRACE = 2 * 60 * 1000;
 function urgentSweep({ running = runningHandoff, now = Date.now(), start = runHandoff } = {}) {
   const u = urgentState(); if (!u) return null;
-  const ended = u.runs.length > 0 && !u.paths.some((p) => running(p));
+  const ended = !u.paths.some((p) => running(p)) && (u.runs.length > 0 || now - (u.at || 0) >= URGENT_GRACE);
   if (!ended && now - (u.at || 0) < URGENT_MAX) return null;
   saveUrgent(null);
   return resumeParked(u.parked, start);
@@ -999,7 +1069,7 @@ const HARM_RULE = /^Bash\(\s*(rm|dd|mkfs|chmod|chown|shred|truncate)\b/i;
 const wideRule = (r) => ANY_RULE.test(r) || (HARM_RULE.test(r) && /\*/.test(r));
 // Whatever an agent is allowed, it never edits Symbiot's own settings: that's where
 // what agents may do is kept, so an agent could widen its own permissions there.
-const GUARD = () => { const c = join(homedir(), ".config", "symbiot", "config.json"); return [`Edit(${c})`, `Write(${c})`]; };
+const GUARD = () => { const c = join(homedir(), ".config", "symbiot", "config.json"), s = join(homedir(), ".config", "symbiot", "secrets.json"); return [`Edit(${c})`, `Write(${c})`, `Read(${s})`, `Edit(${s})`, `Write(${s})`]; };
 function installAllowlist(path) {
   let p; try { p = JSON.parse(readFileSync(join(path, ".symbiot", "allowlist.proposed.json"), "utf8")).permissions || {}; } catch { return null; }
   const list = (x) => (Array.isArray(x) ? x.filter((r) => typeof r === "string" && r.trim()).map((r) => r.trim()) : []);
@@ -1190,4 +1260,4 @@ function agentsList() {
   }).concat(earlierRuns());
 }
 
-export { FACTS, factsOf, knownRun, withStream, workOf, HANDOFFS, HANDOFF_PROMPT, QUESTIONS_MAX, OPTIONS_SHOWN, IDEAS_SHOWN, shSingle, CLAUDE_CMD, ORCA_CLAUDE_CMD, handoffCmd, setHandoffCmd, grantAgent, grantRule, allowTool, claudeConnectors, withConnectors, linkedConnectors, connectorsLine, connectorsInfo, linkReach, fillHandoff, runHandoff, PARKED_NOTE, parkedPaths, isParked, parkLane, agentMissing, blockedAgain, runningHandoff, loadRuns, earlierRuns, namedFiles, waitingFor, startWaiting, noteUntracked, untrackedBefore, forgetUntracked, writeTasks, droppedTasks, releaseHeldTasks, startHeldTasks, detectHandoffs, pickAgent, findOrcaCli, orcaHandoffCmd, migrateOrcaCmd, migrateClaudeCmd, track, agentChanges, parseQuestions, suggestionTarget, skipIdea, agentQuestions, answerQuestions, agentsList, needsOf, settleNeeds, NEEDS_FOR, readLastWords, readNeeds, parseRead, READ_FILE, autoAllow, autoAllowSweep, allowlistInWork, installAllowlist, inWork, withScope, withTrust, sandboxFor, sandboxEnv, sandboxNeeds, sandboxState, sandboxWrites, SANDBOX_DIR, resumeFor, noteSession, trustFull, GUARD_SETTINGS, isUrgent, urgentFirst, urgentDone, urgentSweep, urgentState };
+export { FACTS, factsOf, knownRun, withStream, workOf, HANDOFFS, HANDOFF_PROMPT, QUESTIONS_MAX, OPTIONS_SHOWN, IDEAS_SHOWN, shSingle, CLAUDE_CMD, ORCA_CLAUDE_CMD, handoffCmd, setHandoffCmd, grantAgent, grantRule, allowTool, claudeConnectors, withConnectors, linkedConnectors, connectorsLine, connectorsInfo, linkReach, fillHandoff, runHandoff, nothingToDo, PARKED_NOTE, parkedPaths, isParked, parkLane, agentMissing, blockedAgain, runningHandoff, loadRuns, earlierRuns, namedFiles, waitingFor, startWaiting, noteUntracked, untrackedBefore, forgetUntracked, writeTasks, droppedTasks, releaseHeldTasks, startHeldTasks, detectHandoffs, pickAgent, findOrcaCli, orcaHandoffCmd, migrateOrcaCmd, migrateClaudeCmd, track, agentChanges, parseQuestions, suggestionTarget, skipIdea, agentQuestions, answerQuestions, agentsList, needsOf, settleNeeds, NEEDS_FOR, readLastWords, readNeeds, parseRead, READ_FILE, autoAllow, autoAllowSweep, allowlistInWork, installAllowlist, inWork, withScope, withTrust, sandboxFor, sandboxEnv, sandboxNeeds, sandboxState, sandboxWrites, SANDBOX_DIR, resumeFor, noteSession, trustFull, GUARD_SETTINGS, isUrgent, urgentFirst, urgentUndo, urgentDone, urgentSweep, urgentState , licenceGate };

package/claudesetup.mjs

@@ -4,7 +4,7 @@
 // sign-in page in the browser and finishes by itself once they've signed in. If the
 // page shows a code instead (the browser couldn't hand it back), setup has a box for
 // it, which goes to the sign-in that's waiting. SYMBIOT_CLAUDE_INSTALL_CMD replaces
-// the installer (tests).
+// the installer (tests); SYMBIOT_NO_SIGNIN turns both off (the smoke test presses every button).
 import { spawn } from "node:child_process";
 import { homedir } from "node:os";
 import { claudeState, claudeSpawn } from "./ai.mjs";
@@ -19,6 +19,7 @@ function installCmd(platform = process.platform) {
 }
 function installClaude() {
   if (S.installing) return claudeSetup();
+  if (process.env.SYMBIOT_NO_SIGNIN && !process.env.SYMBIOT_CLAUDE_INSTALL_CMD) { S.installError = "Installing is switched off here (SYMBIOT_NO_SIGNIN)."; return claudeSetup(); }
   S.installing = true; S.installError = ""; S.log = "";
   const c = installCmd();
   let ch; try { ch = spawn(c.cmd, c.args, { cwd: homedir(), shell: c.shell, windowsHide: true, env: process.env }); } catch (e) { S.installing = false; S.installError = String((e && e.message) || e); return claudeSetup(); }
@@ -33,6 +34,8 @@ function installClaude() {
 }
 function signInClaude() {
   if (S.signingIn) return claudeSetup();
+  // tests press every button: a real sign-in would open the browser on someone's real account
+  if (process.env.SYMBIOT_NO_SIGNIN) { S.signinError = "Signing in is switched off here (SYMBIOT_NO_SIGNIN)."; return claudeSetup(); }
   S.signingIn = true; S.signinError = "";
   let ch; try { ch = claudeSpawn(["auth", "login", "--claudeai"], { cwd: homedir(), stdio: ["pipe", "pipe", "pipe"], env: process.env }); } catch (e) { S.signingIn = false; S.signinError = String((e && e.message) || e); return claudeSetup(); }
   S.child = ch;

package/core.mjs

@@ -21,17 +21,43 @@ async function checkLatest() { try { const r = await fetch(REGISTRY + "/symbiot"
 // ---- config ---------------------------------------------------------------
 const CONFIG_DIR = join(homedir(), ".config", "symbiot");
 const CONFIG_PATH = join(CONFIG_DIR, "config.json");
+// Symbiot's own keys (your AI's API key, the app's token) live apart from its
+// settings, in secrets.json: a run outside the sandbox could `cat` config.json, and
+// with the token call Symbiot's own API and change the agent command, which the
+// membrane never sees. The membrane (guard.mjs) and a run's sandbox (agents.mjs
+// SANDBOX_SECRETS) refuse secrets.json. loadConfig joins the two and saveConfig
+// splits them, so nothing else changes; a config.json from before still reads, and
+// its keys move out on the next save (the app saves once as it starts: moveSecrets).
+const SECRETS_PATH = join(CONFIG_DIR, "secrets.json"), SECRET_KEYS = ["apiKey", "appToken"];
+const isObj = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function splitSecrets(cfg) {
+  const pub = { ...cfg }, sec = {};
+  for (const k of SECRET_KEYS) if (k in pub) { sec[k] = pub[k]; delete pub[k]; }
+  for (const [k, v] of Object.entries(pub)) if (isObj(v) && "apiKey" in v) { sec[k] = { apiKey: v.apiKey }; pub[k] = { ...v }; delete pub[k].apiKey; } // a provider's: { anthropic: { apiKey, model } }
+  return { pub, sec };
+}
+const readJson = (f) => { try { const o = JSON.parse(readFileSync(f, "utf8")); return isObj(o) ? o : {}; } catch { return {}; } };
 function loadConfig() {
-  try { return JSON.parse(readFileSync(CONFIG_PATH, "utf8")); } catch { return {}; }
+  const cfg = readJson(CONFIG_PATH), sec = readJson(SECRETS_PATH);
+  for (const [k, v] of Object.entries(sec)) {
+    if (SECRET_KEYS.includes(k)) { if (!(k in cfg)) cfg[k] = v; } // one still in config.json is newer (an older Symbiot wrote it)
+    else if (isObj(v) && "apiKey" in v && !(isObj(cfg[k]) && "apiKey" in cfg[k])) cfg[k] = { ...(isObj(cfg[k]) ? cfg[k] : {}), apiKey: v.apiKey };
+  }
+  return cfg;
 }
 function saveConfig(cfg) {
   try {
     mkdirSync(CONFIG_DIR, { recursive: true });
-    writeFileSync(CONFIG_PATH, JSON.stringify(cfg, null, 2) + "\n");
+    const { pub, sec } = splitSecrets(cfg || {});
+    writeFileSync(SECRETS_PATH, JSON.stringify(sec, null, 2) + "\n", { mode: 0o600 }); // first: a key is never only in neither
+    try { chmodSync(SECRETS_PATH, 0o600); } catch {}
+    writeFileSync(CONFIG_PATH, JSON.stringify(pub, null, 2) + "\n");
     try { chmodSync(CONFIG_PATH, 0o600); } catch {}
     return true;
   } catch { return false; }
 }
+// Keys still in config.json (from before secrets.json): moved out. True if any were.
+function moveSecrets() { const raw = readJson(CONFIG_PATH); return Object.keys(splitSecrets(raw).sec).length ? saveConfig(loadConfig()) : false; }
 // ---- tasks: a persistent checklist (~/.config/symbiot/tasks.json) ---------
 const TASKS_PATH = join(CONFIG_DIR, "tasks.json");
 function loadTasks() { try { return JSON.parse(readFileSync(TASKS_PATH, "utf8")); } catch { return []; } }
@@ -180,4 +206,4 @@ function repoState(repoPath) {
   return { branch, dirty, del, mod, add, stale, staleBy, behind };
 }
 
-export { VERSION, LATEST_VERSION, semverGt, REGISTRY, checkLatest, CONFIG_DIR, CONFIG_PATH, loadConfig, saveConfig, loadTasks, saveTasks, TASK_MAX, clipWords, taskWords, sameTask, uniqueTasks, sh, hasCmd, chromeBinary, repoState };
+export { VERSION, LATEST_VERSION, semverGt, REGISTRY, checkLatest, CONFIG_DIR, CONFIG_PATH, SECRETS_PATH, loadConfig, saveConfig, moveSecrets, splitSecrets, loadTasks, saveTasks, TASK_MAX, clipWords, taskWords, sameTask, uniqueTasks, sh, hasCmd, chromeBinary, repoState };

package/guard.mjs

@@ -7,7 +7,8 @@
 //   - push to main/master, or force-push; publish a package
 //   - delete outside the agent's own folder, or wipe a disk
 //   - sudo, or pipe something from the internet into a shell
-//   - read SSH keys or cloud credentials; change Symbiot's own settings
+//   - read SSH keys or cloud credentials, or Symbiot's own keys (secrets.json: your AI's
+//     key and the app's token); change Symbiot's own settings
 //   - open the user's running Symbiot in a browser (a check uses a sandbox copy)
 //   - in a sandboxed repo run (agents.mjs sandboxFor), edit or write a file outside its
 //     repo and your folders (SYMBIOT_WRITES): its commands are held there by the sandbox
@@ -18,13 +19,18 @@ import { execFileSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 
-const SECRET = [".ssh", ".gnupg", ".aws", ".azure", ".kube", ".docker/config.json", ".config/gcloud", ".config/gh/hosts.yml", ".netrc", ".npmrc", ".pypirc", ".git-credentials"];
+const SECRET = [".ssh", ".gnupg", ".aws", ".azure", ".kube", ".docker/config.json", ".config/gcloud", ".config/gh/hosts.yml", ".netrc", ".npmrc", ".pypirc", ".git-credentials", ".config/symbiot/secrets.json"];
 const under = (p, d) => p === d || p.startsWith(d.endsWith("/") ? d : d + "/");
 const expand = (p, home, cwd) => resolve(cwd, String(p).replace(/^~(?=\/|$)/, home).replace(/^\$HOME(?=\/|$)/, home).replace(/^\$\{HOME\}(?=\/|$)/, home));
 const BROWSER = /\b(google-chrome(-stable)?|chromium(-browser)?|chrome|firefox|msedge|playwright|puppeteer|wkhtmltoimage|cutycapt)\b/i;
 const SCP_VALUE = /^-[346ABCOpqRrTv]*[iFoPSJcl]$/; // an scp option (alone or after flags, -rpi) whose value is the next word
 function secretPath(p, home) { return SECRET.some((s) => under(p, join(home, s))); }
-function symbiotConfig(p, home) { return p === join(home, ".config", "symbiot", "config.json"); }
+function symbiotConfig(p, home) { const d = join(home, ".config", "symbiot"); return p === join(d, "config.json") || p === join(d, "licence-revoked.json"); }
+// Symbiot's own installed files (where this guard runs from): never edited by an agent, so
+// it can't be asked to take out its own limits or rules. Ghost AI's owner key lets its own
+// runs through (SYMBIOT_OWNER, set by Symbiot, not by the agent).
+const SELF = resolve(fileURLToPath(new URL(".", import.meta.url)));
+const selfFile = (p) => !process.env.SYMBIOT_OWNER && under(p, SELF);
 
 // the branch a bare `git push` pushes: the one checked out in cwd
 function currentBranch(cwd) { try { return execFileSync("git", ["-C", cwd, "rev-parse", "--abbrev-ref", "HEAD"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim(); } catch { return ""; } }
@@ -36,6 +42,7 @@ function judgeBash(cmd, { cwd, home, branch }) {
     const s = part.trim(); if (!s) continue;
     const w = s.split(/\s+/);
     if (/^(sudo|su|doas)$/.test(w[0])) return { why: "sudo: only you run things as root" };
+    if (!process.env.SYMBIOT_OWNER && (s.includes(SELF + "/") || s.includes(SELF + " ") || s.endsWith(SELF))) return { why: "Symbiot doesn't edit its own code" };
     if (/^(shutdown|reboot|poweroff|halt)$/.test(w[0])) return { why: "shutting the computer down is yours to do" };
     if (/^(mkfs(\.\w+)?|fdisk|parted|wipefs)$/.test(w[0]) || (/^dd$/.test(w[0]) && /\bof=\/dev\//.test(s))) return { why: "that writes a disk directly" };
     if (/^git$/.test(w[0]) || /^git\s/.test(s)) {
@@ -65,7 +72,7 @@ function judgeBash(cmd, { cwd, home, branch }) {
       const own = w[0] === "scp" ? SCP_VALUE : null;
       for (const p of w.slice(1).filter((a, i, all) => !a.startsWith("-") && !(own && own.test(all[i - 1] || "")))) { if (secretPath(expand(p, home, cwd), home)) return { why: "your keys and cloud credentials stay yours" }; }
     }
-    if (/(^|\s)(>|>>|tee|sed\s+-i)\s*\S*\.config\/symbiot\/config\.json/.test(s)) return { why: "Symbiot's own settings are yours to change" };
+    if (/(^|\s)(>|>>|tee|sed\s+-i)\s*\S*\.config\/symbiot\/(config|secrets)\.json/.test(s)) return { why: "Symbiot's own settings are yours to change" };
   }
   if (/\b(curl|wget)\b[^|]*\|\s*(sudo\s+)?(ba|z|da)?sh\b/.test(c)) return { why: "running a script straight from the internet" };
   // a browser on the user's running Symbiot: each page it opened counted as a new window and
@@ -82,6 +89,7 @@ function judge(tool, input = {}, { cwd = process.cwd(), home = homedir(), branch
   const abs = expand(p, home, cwd);
   if (secretPath(abs, home)) return { why: "your keys and cloud credentials stay yours" };
   if (/^(Edit|Write|MultiEdit|NotebookEdit)$/.test(t) && symbiotConfig(abs, home)) return { why: "Symbiot's own settings are yours to change" };
+  if (/^(Edit|Write|MultiEdit|NotebookEdit)$/.test(t) && selfFile(abs)) return { why: "Symbiot doesn't edit its own code" };
   if (/^(Edit|Write|MultiEdit|NotebookEdit)$/.test(t) && Array.isArray(writes) && writes.length && !writes.some((d) => under(abs, d))) return { why: "this run writes only in its repo and your folders (its sandbox), not " + p };
   return null;
 }