symbiot 0.58.2 → 0.59.0

package/headless.mjs

@@ -2,11 +2,12 @@
 // screenshot and map every button, link and field on it by itself, as a screen
 // whose regions are already named (screens.mjs). Nothing to bring to the front,
 // nothing to drag. Each region keeps how to find it again (a CSS selector), so it
-// can be pressed (or a field typed into) in that same hidden browser, which maps
-// the page it lands on: map → press → map is how an agent finds its way around a
-// site. On a site you trust (Settings), that goes ahead without asking. In the
-// app the browser stays open for a few minutes after each action, so the next
-// one carries on from the page as it is (type into a field, then press Send).
+// can be pressed (a field typed into, a file put in a file box) in that same
+// hidden browser, which maps the page it lands on: map → press → map is how an
+// agent finds its way around a site. On a site you trust (Settings), that goes
+// ahead without asking. In the app the browser stays open for a few minutes
+// after each action, so the next one carries on from the page as it is (type
+// into a field, then press Send).
 // A map has what fits in the window: Scroll down maps the next part, and Whole
 // page maps all of it in one tall screenshot: the page, or, where a list scrolls
 // inside it (Gmail's mail), that list opened out to its full length.
@@ -19,8 +20,8 @@
 // site once there (signIn opens it as a normal window) and later maps see it
 // signed in. It's separate from your everyday browser profile.
 import { spawn } from "node:child_process";
-import { join } from "node:path";
-import { mkdirSync, existsSync } from "node:fs";
+import { join, resolve as resolvePath } from "node:path";
+import { mkdirSync, existsSync, statSync } from "node:fs";
 import { CONFIG_DIR, chromeBinary, loadConfig, saveConfig } from "./core.mjs";
 import { loadScreens, addPageScreen, center, stitchPng, stitchListPng } from "./screens.mjs";
 
@@ -499,6 +500,39 @@ function readTexts(input, selector, { scrolls = 3 } = {}) {
   }, false)).catch((e) => ({ error: String((e && e.message) || e) }));
 }
 
+// LinkedIn's own lists, for Watch (watch.mjs linkedinDetail): its top bar's badges
+// say "Messaging, 1 new notification", never who, and the brief could only say
+// "2 new notifications" (2026-10-09). This reads who and what, in the signed-in
+// hidden browser, only looking, like readPage: "messages" (each conversation: who,
+// its last line, when, unread) or "notifications" (each card: its words, who, its
+// link, unread). LinkedIn's class names drift, so each has a fallback: its heading,
+// its first paragraph. { items } or { busy } / { error }.
+const LI_TEXT = "const tx = (r, s) => { const e = r.querySelector(s); return e ? String(e.innerText || e.textContent || '').replace(/\\s+/g, ' ').trim() : ''; };";
+const LI_UNREAD = "const un = (r) => /unread/i.test(String(r.className || '')) || !!r.querySelector('[class*=unread],.notification-badge--show') || /\\bunread\\b/i.test(r.getAttribute('aria-label') || '');";
+const LI_READ = {
+  messages: ["https://www.linkedin.com/messaging/", `(() => { ${LI_TEXT} ${LI_UNREAD}
+    return [...document.querySelectorAll('li.msg-conversation-listitem, li.msg-conversations-container__convo-item')].slice(0, 20).map((r) => ({
+      name: tx(r, '.msg-conversation-listitem__participant-names, .msg-conversation-card__participant-names, h3'),
+      preview: tx(r, '.msg-conversation-card__message-snippet, .msg-conversation-card__message-snippet-body, p').slice(0, 200),
+      time: tx(r, 'time, .msg-conversation-listitem__time-stamp, .msg-conversation-card__time-stamp'), unread: un(r) })).filter((x) => x.name);
+  })()`],
+  notifications: ["https://www.linkedin.com/notifications/", `(() => { ${LI_TEXT} ${LI_UNREAD}
+    return [...document.querySelectorAll('article.nt-card, .nt-card-list article, main article')].slice(0, 20).map((r) => ({
+      text: (tx(r, '.nt-card__text--3-line, .nt-card__headline, .nt-card__text') || String(r.innerText || '').replace(/\\s+/g, ' ').trim()).slice(0, 300),
+      actor: tx(r, '.nt-card__text--3-line strong, .nt-card__headline strong, strong').slice(0, 80),
+      href: String((r.querySelector('a[href*="linkedin.com/"], a[href^="/"]') || {}).href || '').slice(0, 500), unread: un(r) })).filter((x) => x.text);
+  })()`],
+};
+function readLinkedIn(kind) {
+  const it = LI_READ[kind]; if (!it) return Promise.resolve({ error: "messages or notifications" });
+  return oneAtATime(() => browserOpen() ? { busy: true } : withPage(async (page) => {
+    await open(page, it[0]);
+    const at = String((await evaluate(page, "location.href")) || it[0]);
+    if (signInPage(at)) return { login: true, url: at };
+    return { url: at, items: (await evaluate(page, it[1])) || [] };
+  }, false)).catch((e) => ({ error: String((e && e.message) || e) }));
+}
+
 // A picture, or a short clip, of a page, for a post (post.mjs): only on your
 // click, and it only looks, like readPage. The picture is the window at twice its
 // pixels, so it stays sharp in a feed: { png, url, title }. The clip records the
@@ -630,7 +664,7 @@ function actOnRegion(id, regionId, verb, confirmed, check, act) {
   const r = (s.regions || []).find((x) => x.id === regionId); if (!r) return Promise.resolve({ error: "That region is gone. Reload the screen." });
   const bad = check(r); if (bad) return Promise.resolve({ error: bad });
   const host = hostOf(s.page.url);
-  if (!confirmed && !isTrusted(s.page.url)) return Promise.resolve({ error: `${verb === "Type" ? "Typing into" : "Pressing"} "${r.label}" acts on the real site, signed in as you, and ${host} isn't one of your trusted sites.`, confirm: true, host });
+  if (!confirmed && !isTrusted(s.page.url)) return Promise.resolve({ error: `${verb === "Type" ? "Typing into" : verb === "Upload" ? "Attaching a file with" : "Pressing"} "${r.label}" acts on the real site, signed in as you, and ${host} isn't one of your trusted sites.`, confirm: true, host });
   return oneAtATime(() => withPage(async (page, b) => {
     const here = await showScreen(page, b, s);
     // A new tab would leave this one where it was, so a link opens here instead.
@@ -701,6 +735,68 @@ function typeRegion(id, regionId, text, { enter = false, confirmed = false, noSe
   });
 }
 
+// Upload: put a file (or a few) in a page's file box, as picking it in the file
+// dialog would (DevTools' DOM.setFileInputFiles): a picture or video for a LinkedIn
+// post. Sites hide the real <input type=file> behind a button ("Add media"), and a
+// map only has what shows, so the field is usually that button: the box is then
+// the one inside it, its label's, else the nearest one going up from it, and
+// `used` says which. A page that makes its box only once the button is pressed:
+// pressed, with the file dialog caught instead of shown, and the file put in the
+// box that dialog was for. The files are checked (absolute, there) before a
+// browser starts, and off your trusted sites it asks first, like press and type.
+const FILE_BOX = (sel, at) => `(() => {
+  const isBox = (x) => !!x && x.tagName === 'INPUT' && String(x.type).toLowerCase() === 'file', all = [...document.querySelectorAll('input[type=file]')];
+  let e = null; try { e = ${JSON.stringify(sel || "")} && document.querySelector(${JSON.stringify(sel || "")}); } catch (x) {}
+  e = e || document.elementFromPoint(${Number(at.x) || 0}, ${Number(at.y) || 0});
+  let box = null, how = '';
+  if (isBox(e)) { box = e; how = 'the field itself'; }
+  else if (e) {
+    const lab = e.closest('label'), inside = e.querySelector('input[type=file]');
+    if (inside) { box = inside; how = 'the file box inside it'; }
+    else if (lab && isBox(lab.control)) { box = lab.control; how = "its label's file box"; }
+    else for (let n = e.parentElement; n && !box; n = n.parentElement) { const f = n.querySelector('input[type=file]'); if (f) { box = f; how = all.length === 1 ? 'the only file box on the page' : "the nearest of the page's " + all.length + ' file boxes'; } }
+  }
+  if (!box && all.length === 1) { box = all[0]; how = 'the only file box on the page'; }
+  if (!box) return null;
+  window.__symbiotFileBox = box;
+  const name = box.getAttribute('aria-label') || box.name || box.id || '';
+  return { how, box: 'input[type=file]' + (name ? ' "' + name + '"' : '') + (box.accept ? ' (takes ' + box.accept + ')' : ''), multiple: !!box.multiple };
+})()`;
+async function attachFiles(page, at, r, files) {
+  const box = await evaluate(page, FILE_BOX(r.selector, at));
+  if (box) {
+    if (files.length > 1 && !box.multiple) throw new Error(`${box.box} takes one file at a time.`);
+    const { result } = await page.send("Runtime.evaluate", { expression: "window.__symbiotFileBox" });
+    if (!result || !result.objectId) throw new Error("Lost the page's file box. Map the page again.");
+    await page.send("DOM.setFileInputFiles", { files, objectId: result.objectId });
+    await page.send("Runtime.evaluate", { expression: "delete window.__symbiotFileBox" }).catch(() => {});
+    return { used: `${box.box}, ${box.how}` };
+  }
+  // no box on the page yet: press it, and catch the file dialog that opens
+  await page.send("Page.setInterceptFileChooserDialog", { enabled: true });
+  try {
+    const opened = page.until("Page.fileChooserOpened", 5000);
+    await clickAt(page, at);
+    const m = await opened, p = (m && m.params) || {};
+    if (!p.backendNodeId) throw new Error(`No file box on the page, and pressing "${r.label}" didn't open a file dialog. Press it, then upload with what the new map shows.`);
+    if (files.length > 1 && p.mode !== "selectMultiple") throw new Error("That file box takes one file at a time.");
+    await page.send("DOM.setFileInputFiles", { files, backendNodeId: p.backendNodeId });
+    return { used: "the file box the file dialog it opened was for" };
+  } finally { await page.send("Page.setInterceptFileChooserDialog", { enabled: false }).catch(() => {}); }
+}
+// files: a path or a list of them, relative to where you are
+function uploadFiles(files) {
+  const list = (Array.isArray(files) ? files : [files]).filter((f) => f != null && String(f).trim()).map((f) => resolvePath(String(f)));
+  if (!list.length) return { error: "Give the file to upload." };
+  const bad = list.find((f) => { try { return !statSync(f).isFile(); } catch { return true; } });
+  return bad ? { error: `No file at ${bad}.` } : { files: list };
+}
+function uploadRegion(id, regionId, files, { confirmed = false } = {}) {
+  const f = uploadFiles(files);
+  return actOnRegion(id, regionId, "Upload", confirmed, () => f.error || "",
+    async (page, at, r) => ({ uploaded: r.label, files: f.files, ...(await attachFiles(page, at, r, f.files)) }));
+}
+
 // Open the site in Symbiot's browser profile as a normal window, to sign in (or
 // accept cookies) once. Close it before mapping: the profile is shared. The hidden
 // browser is closed first, or the window would open in it, out of sight.
@@ -714,4 +810,4 @@ async function signIn(input) {
   return { ok: true, url };
 }
 
-export { siteUrl, browserArgs, mapPage, wholePage, readPage, readTexts, pagePicture, pageClip, CLIP, isSend, pressRegion, typeRegion, scrollPage, SCROLLS, signIn, keepBrowserOpen, closeBrowser, browserOpen, trustedSites, isTrusted, trustSite, untrustSite, PROFILE };
+export { siteUrl, browserArgs, mapPage, wholePage, readPage, readTexts, readLinkedIn, LI_READ, pagePicture, pageClip, CLIP, isSend, pressRegion, typeRegion, uploadRegion, uploadFiles, attachFiles, FILE_BOX, scrollPage, SCROLLS, signIn, keepBrowserOpen, closeBrowser, browserOpen, trustedSites, isTrusted, trustSite, untrustSite, PROFILE };

package/home.mjs

@@ -28,7 +28,7 @@ import { reportsNews, listReports, readReport, decide } from "./reports.mjs";
 import { awaitingState, inboxSight } from "./handback.mjs";
 import { newClashes } from "./checks.mjs";
 import { postsState } from "./post.mjs";
-import { MARKETING, MARKETING_DIR, MARKETING_WORDS, displayName, productNames, productOf, untagged, tagged, draftFiles, setDraftStatus } from "./marketing.mjs";
+import { MARKETING, MARKETING_DIR, MARKETING_WORDS, displayName, productNames, productOf, untagged, tagged, draftFiles, setDraftStatus, postedCmd } from "./marketing.mjs";
 
 const KEEP = 15000; // the slower reads (git per repo awaiting review) are cached this long
 let cached = null;
@@ -223,7 +223,9 @@ function goLane(repo, map, { push = pushTasks, run = runHandoff } = {}) {
   if (!map[repo]) return { error: `${repo} isn't one of your projects any more.` };
   const p = (push || pushTasks)({ repo }); if (!p || !p.written || !p.written.length) return { error: `Nothing of ${repo}'s is waiting to start.` };
   const e = (run || runHandoff)(map[repo]); if (!e) return { error: "The agent didn't start. Check its command in Settings → Handoff." };
-  return e.parked ? { error: `${repo} is parked: unpark it to start its agent.` } : { ok: true, ...(e.busy || e.blocked ? { queued: true } : { job: e.id }) };
+  if (e.parked) return { error: `${repo} is parked: unpark it to start its agent.` };
+  if (e.blocked && !e.busy) return { error: `${repo}'s agent didn't start: ${e.note || "it's waiting on something"}` }; // queued only behind a run that's really going
+  return { ok: true, ...(e.busy ? { queued: true } : { job: e.id }) };
 }
 
 // ---- Marketing: a lane of its own, across products (marketing.mjs) ----------------------
@@ -280,7 +282,7 @@ function marketingDraftAnswer(rel, status, deps = {}) {
   cached = null;
   const d = r.draft, when = d.when ? `, scheduled in ${d.platform}'s own scheduler for ${d.when}` : "";
   if (status === "skipped") { noteAnswer(dir, `Skipped: ${rel}`, "Don't post it. Leave the draft where it is."); return { ok: true, said: "Skipped. Its agent won't post it." }; }
-  noteAnswer(dir, `Approved: ${rel}`, `The user approved its preview. Post it on ${d.platform}${when}, through Symbiot's signed-in browser, with exactly the text under its post (${d.body.length} characters, unchanged)${d.media.length ? ` and ${d.media.join(", ")} attached` : ""}. Then check it's there, and say so in your last message.`);
+  noteAnswer(dir, `Approved: ${rel}`, `The user approved its preview. Post it on ${d.platform}${when}, through Symbiot's signed-in browser, with exactly the text under its post (${d.body.length} characters, unchanged)${d.media.length ? ` and ${d.media.join(", ")} attached` : ""}. Then check it's there, mark it posted (\`${postedCmd(rel)}\`), and say so in your last message.`);
   if ((deps.running || runningHandoff)(dir)) return { ok: true, said: "Approved. Its agent posts it once the run there now finishes." };
   const e = (deps.run || runHandoff)(dir, { force: true });
   return e && e.id && !e.blocked ? { ok: true, said: `Approved. Its agent is ${d.when ? "scheduling" : "posting"} it now.`, rerun: e.id } : { ok: true, said: `Approved. ${(e && e.note) || "Start its agent to post it."}` };
@@ -491,12 +493,12 @@ async function homeAsk(question, { ask, now = Date.now(), state, images = [] } =
   const h = state || homeState({ now });
   let map = {}; try { map = laneMap(); } catch {}
   const role = "Here they're on Symbiot's home: one liquid surface that shows what only they can do, what's new on what they watch, and the lanes. Answer from what it shows, and act on what they ask.";
-  const r = await converse({ where: "Home", role, context: homeContext(h), question: question + (pics.length ? `\n(The user attached ${pics.length} screenshot${pics.length > 1 ? "s" : ""}: you can see ${pics.length > 1 ? "them" : "it"}.)` : ""), map, now, images: pics.map(({ mime, data, path }) => ({ mime, data, path })), ...(ask ? { ask } : {}),
+  const r = await converse({ where: "Home", role, nav: true, context: homeContext(h), question: question + (pics.length ? `\n(The user attached ${pics.length} screenshot${pics.length > 1 ? "s" : ""}: you can see ${pics.length > 1 ? "them" : "it"}.)` : ""), map, now, images: pics.map(({ mime, data, path }) => ({ mime, data, path })), ...(ask ? { ask } : {}),
     act: {
       agent: (req, known, repo) => (repo ? actIn(req + shotNote, repo, { map, known, title: "Home" }) : actNow(req + shotNote, { title: "Home", known })),
       task: (text, repo) => taskIn(text + shotNote, repo, { map }),
     } });
-  return { answer: r.reply, ...(r.did ? { did: r.did } : {}), steps: r.steps || [] };
+  return { answer: r.reply, spoken: r.spoken, ...(r.did ? { did: r.did } : {}), ...(r.go ? { go: r.go } : {}), steps: r.steps || [] };
 }
 
 // ---- acting on a report, where you read it (reports.mjs reportIdeas) -------------------
@@ -527,7 +529,7 @@ async function reportAsk(id, question, { ask, deps = {} } = {}) {
       agent: (req, known, repo) => ((repo || lane) ? actIn(req, repo || lane, { map, known, title: "Reports" }) : actNow(req, { title: "Reports", known })),
       task: (text, repo) => taskIn(text, repo || lane, { map }),
     } });
-  return { answer: res.reply, ...(res.did ? { did: res.did } : {}), steps: res.steps || [] };
+  return { answer: res.reply, spoken: res.spoken, ...(res.did ? { did: res.did } : {}), steps: res.steps || [] };
 }
 // Approve or Reject on a draft report: its agent is told in ANSWERS.md, and an approved
 // one goes ahead (its agent starts, or takes it once the run there finishes).

package/index.mjs

@@ -38,7 +38,7 @@ import { gitDefaultBranch, loadDeploys, driftRepo, computeDrift } from "./drift.
 import { buildTasksMd, taskType, shipChanges, shipWithBump, bumpOffer, learnNpm, releaseNeeded, withReleases, setVersion, syncTasks, pendingReview, unreleased, publishesOnMerge, addTask, approveRepo, approveChanges, sendBack, pushTasks } from "./tasks.mjs";
 import { produce, mailState, setMail, sentMail } from "./writeups.mjs";
 import { loadScreens, screenImage, blueprint } from "./screens.mjs";
-import { mapPage, wholePage, pressRegion, typeRegion, scrollPage, signIn, isTrusted } from "./headless.mjs";
+import { mapPage, wholePage, pressRegion, typeRegion, uploadRegion, uploadFiles, scrollPage, signIn, isTrusted } from "./headless.mjs";
 import { watchState, addWatch, removeWatch, seenWatch, newsSince, markNews, checkWatch, setBrief, draftReply, watchBoard, boardLine, boardChat, boardTalk, clearBoardChat } from "./watch.mjs";
 import { PORT as PHONE_PORT, phoneState, pairComputer, pollComputer, forgetComputer } from "./phone.mjs";
 import { KIND_LABEL as POST_KIND, PATHS as POST_PATHS, draftPosts, postsState, postLog, approvePost, editPost, skipPost, voiceFromLinkedIn, addMedia as addPostMedia, removeMedia as removePostMedia, mediaDir as postMediaDir, pictureOfPage, clipOfPage } from "./post.mjs";
@@ -320,7 +320,7 @@ function screenJson(s) {
   if (!s || s.error) return s;
   const bp = blueprint(s), image = screenImage(s.id), sc = s.page && s.page.scroll;
   const more = sc ? [sc.y > 0 && "above", sc.y < sc.max && "below"].filter(Boolean).join(" and ") : "";
-  return { id: s.id, ...(image ? { image } : {}), ...(s.note ? { note: s.note } : {}), ...(more ? { more } : {}), ...(s.scrolled ? { scrolled: s.scrolled } : {}), ...(s.pressed ? { pressed: s.pressed, found: s.found } : {}), ...(s.typed ? { typed: s.typed, entered: s.entered, found: s.found } : {}), ...(s.kept ? { kept: true } : {}), ...(s.page ? { trusted: isTrusted(s.page.url) } : {}), ...bp, regions: bp.regions.map((r, i) => ({ id: s.regions[i].id, ...r })) };
+  return { id: s.id, ...(image ? { image } : {}), ...(s.note ? { note: s.note } : {}), ...(more ? { more } : {}), ...(s.scrolled ? { scrolled: s.scrolled } : {}), ...(s.pressed ? { pressed: s.pressed, found: s.found } : {}), ...(s.typed ? { typed: s.typed, entered: s.entered, found: s.found } : {}), ...(s.uploaded ? { uploaded: s.uploaded, files: s.files, used: s.used, found: s.found } : {}), ...(s.kept ? { kept: true } : {}), ...(s.page ? { trusted: isTrusted(s.page.url) } : {}), ...bp, regions: bp.regions.map((r, i) => ({ id: s.regions[i].id, ...r })) };
 }
 
 // map, press, type and signin go through the app when it's running, whose hidden
@@ -389,7 +389,7 @@ async function cmdUninstall() {
   if (existsSync(CONFIG_DIR) && !keep) console.log(c.d("(Something wrote to " + CONFIG_DIR + " meanwhile; delete it if you like.)"));
 }
 async function cmdScreens() {
-  const [sub = "list", a1, a2, a3] = argv.slice(1).filter((x, i, all) => !x.startsWith("--") && all[i - 1] !== "--name");
+  const [sub = "list", a1, a2, a3, ...more] = argv.slice(1).filter((x, i, all) => !x.startsWith("--") && all[i - 1] !== "--name");
   const out = (x) => { console.log(JSON.stringify(x, null, 2)); if (x && x.error) process.exitCode = 1; };
   const find = (id) => loadScreens().find((s) => s.id === id);
   if (sub === "list") {
@@ -410,14 +410,17 @@ async function cmdScreens() {
   }
   if (sub === "show") { const s = find(a1); return out(s ? screenJson(s) : { error: "No screen " + (a1 || "") + ". symbiot screens lists them." }); }
   if (sub === "signin") { const r = (await viaApp("/api/screens/signin", { site: a1 })) || await signIn(a1); return out(r.ok ? { ...r, next: "Sign in in the window that opened, close it, then map again." } : r); }
-  if (sub === "press" || sub === "type") {
+  if (sub === "press" || sub === "type" || sub === "upload") {
     const s = find(a1); if (!s) return out({ error: "No screen " + (a1 || "") + ". symbiot screens lists them." });
     const want = String(a2 || "").toLowerCase(), rs = s.regions || [];
     const r = rs.find((x) => x.id === a2) || rs.find((x) => x.label.toLowerCase() === want) || (rs.filter((x) => x.label.toLowerCase().includes(want)).length === 1 && rs.find((x) => x.label.toLowerCase().includes(want)));
     if (!want || !r) return out({ error: `No region "${a2 || ""}" on that screen (give its id, or a label that matches one region).` });
     // a draft reply's agent (SYMBIOT_DRAFT, watch.mjs) never presses Send, or Enter (it sends in a chat)
-    const body = { id: s.id, region: r.id, confirmed: has("yes"), noSend: !!process.env.SYMBIOT_DRAFT, ...(sub === "type" ? { text: a3, enter: has("enter") } : {}) };
-    const done = (await viaApp("/api/screens/" + sub, body)) || (sub === "press" ? await pressRegion(s.id, r.id, { confirmed: body.confirmed, noSend: body.noSend }) : await typeRegion(s.id, r.id, a3, { enter: body.enter, confirmed: body.confirmed, noSend: body.noSend }));
+    // upload: the files resolved and checked here, where a relative path means something
+    const f = sub === "upload" ? uploadFiles([a3, ...more]) : null; if (f && f.error) return out(f);
+    const body = { id: s.id, region: r.id, confirmed: has("yes"), noSend: !!process.env.SYMBIOT_DRAFT, ...(sub === "type" ? { text: a3, enter: has("enter") } : {}), ...(f ? { files: f.files } : {}) };
+    const done = (await viaApp("/api/screens/" + sub, body)) || (sub === "press" ? await pressRegion(s.id, r.id, { confirmed: body.confirmed, noSend: body.noSend }) : sub === "type" ? await typeRegion(s.id, r.id, a3, { enter: body.enter, confirmed: body.confirmed, noSend: body.noSend }) : await uploadRegion(s.id, r.id, f.files, { confirmed: body.confirmed }));
+    if (f && done && /answered 404/.test(done.error || "")) return out({ error: "The Symbiot app that's running is older than this command and can't upload: restart it (symbiot app), then try again." });
     // not a trusted site: say how to go ahead (only you can trust a site, in the app's Settings)
     if (done && done.confirm) return out({ error: `${done.error} Add --yes to go ahead, or list ${done.host} under Trusted sites in Symbiot's Settings.` });
     return out(screenJson(done));
@@ -432,6 +435,11 @@ async function cmdScreens() {
   symbiot screens press <id> <region> [--yes]  press a region there, map where it lands
   symbiot screens type <id> <field> "text" [--enter] [--yes]
                                                type into a field (Enter sends it), map the result
+  symbiot screens upload <id> <field> <file> [<file>…] [--yes]
+                                               put a file in the page's file box (a picture or
+                                               video for a post): <field> is the box, or the
+                                               button it hides behind ("Add media"); says which
+                                               box it used, maps the result
   symbiot screens scroll <id> [down|up|top|bottom]
                                                scroll the page, map what's in the window then
                                                (a map's "more" says there's more below or above)
@@ -439,7 +447,7 @@ async function cmdScreens() {
                                                (where a list scrolls inside the page, like
                                                Gmail's mail, that list opened out)
   symbiot screens signin <site>               sign in once, in Symbiot's browser window
-  --yes is needed unless the page's site is under Trusted sites in the app's Settings.
+  --yes is needed (press, type, upload) unless the page's site is under Trusted sites in the app's Settings.
   While the app runs, these use its hidden browser, which stays open a few minutes:
   press on the screen the last command printed carries on from that page as it is
   (type without --enter, then press the form's button).`);
@@ -785,6 +793,47 @@ async function cmdPost() {
   if (sub !== "help") process.exitCode = 1;
 }
 
+// ---- `symbiot marketing`: a draft of Marketing's lane, marked posted or superseded ----
+// What its agent runs once a post is out, or redone in a new file (marketing.mjs): either
+// takes it off the Marketing orb for good, and it can't be approved or posted again.
+async function cmdMarketing() {
+  const VAL = ["--url", "--on", "--where", "--at", "--by"];
+  const [sub = "help", rel, ...more] = argv.slice(1).filter((x, i, all) => !x.startsWith("--") && !VAL.includes(all[i - 1]));
+  const fail = (msg) => { console.log(c.y(msg)); process.exitCode = 1; };
+  const M = await import("./marketing.mjs");
+  if (sub === "posted" || sub === "superseded") {
+    if (!rel) return fail(`Give the draft:  symbiot marketing ${sub} drafts/<product>/<post>.md`);
+    const r = M.setDraftStatus(rel, sub, { url: flag("url", ""), on: flag("on", flag("where", "")), at: flag("at", ""), by: flag("by", "") });
+    if (r.error) return fail(r.error);
+    if (r.already) { console.log(c.d(r.said)); return; }
+    const s = M.draftStatuses()[r.rel] || {};
+    console.log(`${c.g("✓")} ${r.rel}: ${sub}${s.postedOn ? ` on ${s.postedOn}` : ""}${s.posted ? `, ${M.day(s.posted)}` : ""}${s.url ? ` (${s.url})` : ""}${(s.by || []).length ? ` by ${s.by.join(", ")}` : ""}. It's off the Marketing orb, and can't be approved or posted again.`);
+    return;
+  }
+  if (sub === "media") {
+    if (!rel) return fail("Give the draft and its pictures or video:  symbiot marketing media <draft> <file>…");
+    const r = M.setDraftMedia(rel, more);
+    if (r.error) return fail(r.error);
+    console.log(`${c.g("✓")} ${r.rel}: ${r.media.length ? "media: " + r.media.join(", ") : "no media"}${r.reopened ? c.y("  (it was approved with another: it asks for the user's OK again)") : ""}`); return;
+  }
+  if (sub === "list" || sub === "status") {
+    const fs = M.draftFiles(M.MARKETING_DIR, [], { max: 200 }), all = M.draftStatuses();
+    if (!fs.length) console.log(c.d("No drafts in Marketing's lane yet."));
+    for (const f of fs) { const s = all[f.rel] || {}; console.log(`${(f.status || "waiting").padEnd(10)} ${f.rel}${s.url ? c.d("  " + s.url) : ""}${(s.by || []).length ? c.d("  by " + [].concat(s.by).join(", ")) : ""}`); }
+    return;
+  }
+  console.log(`${c.b("symbiot marketing")} ${c.d("— Marketing's drafts (drafts/<product>/<post>.md in its lane)")}
+  symbiot marketing list                    each draft and its status
+  symbiot marketing posted <draft> [--url <link>] [--on linkedin] [--at "YYYY-MM-DD HH:MM"]
+                                            it's out (or in the platform's scheduler)
+  symbiot marketing superseded <draft> [--by <new draft>[,<another>]]
+                                            a new draft replaces it
+  symbiot marketing media <draft> <file>…   its picture(s) or video, by path in the lane
+  Posted and superseded take a draft off the Marketing orb for good: it can't be
+  approved or posted again.`);
+  if (sub !== "help") process.exitCode = 1;
+}
+
 // ---- `symbiot reports`: what agents wrote up for you (reports.mjs) ---------------
 function cmdReports() {
   const id = argv.slice(1).find((x) => !x.startsWith("--"));
@@ -834,6 +883,9 @@ ${c.b("Experimental")}
   symbiot post                      draft 3 LinkedIn posts from this week's git,
                                     in your voice; never posts by itself
                                     (symbiot post help for more)
+  symbiot marketing posted <draft> --url <link>
+                                    mark a Marketing draft posted (or superseded);
+                                    symbiot marketing help for more
   symbiot screens map <site>        map a web page's buttons in a hidden browser
                                     (symbiot screens help for more)
   symbiot watch add <screen id>     keep track of a mapped page: what's new on it
@@ -885,6 +937,7 @@ async function main() {
   if (cmd === "watch") return cmdWatch();
   if (cmd === "phone") return cmdPhone();
   if (cmd === "post" || cmd === "posts") return cmdPost();
+  if (cmd === "marketing") return cmdMarketing();
   if (cmd === "knowledge" || cmd === "know") return cmdKnowledge();
   if (cmd === "reports" || cmd === "report") return cmdReports();
   if (cmd === "week")return cmdRun("week");

package/lanes.mjs

@@ -12,7 +12,8 @@
 // The ledger, ~/.config/symbiot/lanes.json: { handoffs: [{ id, key, from: { lane,
 // path }, to: { lane, path }, text, at, chain, status, job?, task?, error?,
 // result?, reportedAt? }] }. status: started, held (that lane's agent was busy:
-// it starts when it's free), done (reported back) or error (reported back too).
+// it starts when it's free), blocked (it didn't start, and nothing running there will
+// start it: note says why), done (reported back) or error (reported back too).
 // chain: how many handovers in a row led here; past MAX_CHAIN it stops, so two
 // lanes can't hand the same thing back and forth forever.
 import { join, basename, dirname, resolve, relative } from "node:path";
@@ -50,6 +51,9 @@ function laneTarget(lane, map) {
   const name = Object.keys(map).find((n) => n.toLowerCase() === lane.toLowerCase());
   return name ? { lane: name, path: map[name] } : null;
 }
+// Where a handover to a repo stands once its agent was asked to start (runHandoff's
+// result): started; held behind a run that's really going there; or blocked, with why.
+const startedAs = (r) => r.id && !r.busy && !r.blocked ? { status: "started", job: r.id } : r.busy ? { status: "held", ...(r.id ? { job: r.id } : {}) } : { status: "blocked", note: String(r.note || "its agent didn't start").slice(0, 200) };
 
 // A handover whose text changed while the run doing the earlier version is still
 // going (the LinkedIn auto-poster spec reached ops twice, on top of a run already
@@ -62,7 +66,7 @@ function laneTarget(lane, map) {
 // back, about the same thing (alike), and its run still going (ops) or its task
 // still open (a repo). null when there's none.
 function supersedes(h, from, ledger, { running, tasks }) {
-  return ledger.handoffs.slice().reverse().find((x) => x.from.path === from.path && x.to.lane.toLowerCase() === h.lane.toLowerCase() && !x.reportedAt && (x.status === "started" || x.status === "held") && x.text !== h.text && alike(x.text, h.text)
+  return ledger.handoffs.slice().reverse().find((x) => x.from.path === from.path && x.to.lane.toLowerCase() === h.lane.toLowerCase() && !x.reportedAt && (x.status === "started" || x.status === "held" || x.status === "blocked") && x.text !== h.text && alike(x.text, h.text)
     && (x.to.lane === OPS ? !!x.to.path && !!running(x.to.path) : !!x.task && tasks().some((t) => t.id === x.task && !t.done && !t.archived && !t.review))) || null;
 }
 function resupply(e, text, { now, title, context }) {
@@ -97,7 +101,7 @@ function dispatch(path, { map = laneMap(), act = actNow, run = runHandoff, add =
         if (t.error) { Object.assign(prior, { status: "error", error: t.error, text: h.text, key, was }); started.push(prior); continue; }
         push({ repo: prior.to.lane });
         const r = run(prior.to.path) || {};
-        Object.assign(prior, { text: h.text, key, was, at: now, task: t.id, superseded: (prior.superseded || 0) + 1, status: r.id && !r.busy && !r.blocked ? "started" : "held", ...(r.id ? { job: r.id } : {}) });
+        Object.assign(prior, { text: h.text, key, was, at: now, task: t.id, superseded: (prior.superseded || 0) + 1, ...startedAs(r) });
       }
       started.push(prior); continue;
     }
@@ -116,7 +120,7 @@ function dispatch(path, { map = laneMap(), act = actNow, run = runHandoff, add =
       else {
         push({ repo: to.lane });
         const r = run(to.path) || {};
-        Object.assign(e, { to, task: t.id, status: r.id && !r.busy && !r.blocked ? "started" : "held", ...(r.id ? { job: r.id } : {}) });
+        Object.assign(e, { to, task: t.id, ...startedAs(r) });
       }
     }
     ledger.handoffs.push(e); started.push(e);
@@ -342,7 +346,7 @@ function lanesState() {
   for (const e of loadLedger().handoffs.slice().reverse()) {
     const k = [e.from.lane, e.to.lane, firstLine(e.text).replace(/\s+/g, " ").trim()].join("\n").toLowerCase();
     if (byKey.has(k)) { byKey.get(k).times++; continue; }
-    const row = { id: e.id, from: e.from.lane, to: e.to.lane, text: clipWords(firstLine(e.text), 160), ...(e.text.trim() !== firstLine(e.text).trim() || e.text.length > 160 ? { full: e.text } : {}), at: e.at, status: e.status, ...(e.error ? { error: e.error } : {}), ...(e.result ? { result: e.result } : {}), times: 1 };
+    const row = { id: e.id, from: e.from.lane, to: e.to.lane, text: clipWords(firstLine(e.text), 160), ...(e.text.trim() !== firstLine(e.text).trim() || e.text.length > 160 ? { full: e.text } : {}), at: e.at, status: (e.status === "held" || e.status === "blocked") && e.to.path && lastRunStart(e.to.path) >= e.at ? "started" : e.status, ...(e.status === "blocked" && e.note ? { note: e.note } : {}), ...(e.error ? { error: e.error } : {}), ...(e.result ? { result: e.result } : {}), times: 1 };
     byKey.set(k, row); out.push(row);
   }
   return { handoffs: out.slice(0, 30) };

package/licence.mjs

@@ -0,0 +1,144 @@
+// symbiot — Symbiot Free and Symbiot Pro.
+//
+// Free: the orb and Home, the week, standups, voice, the Away screen, one agent at a
+// time, up to 3 projects and one connected inbox. Pro: any number of agents at once,
+// every project, every inbox and chat, the marketing lane and Approve-and-ship.
+//
+// A Pro key is a few lines of text signed by Ghost AI's private key (Ed25519); every
+// copy of Symbiot carries the public key below and checks keys offline: no account,
+// no server. Keys can carry an end date; a key that's been cancelled is listed at
+// symbiot.co.za/licences/revoked.json, which Symbiot reads about once a day (missing
+// it changes nothing). Everyone gets a 14-day Pro trial, from the first time this
+// version runs. Nothing already running is ever stopped: a limit only stops the next
+// thing from starting, with a line saying why and what Pro adds.
+//
+// Symbiot never works on its own code (its repo, a fork of it, or its installed
+// files), so it can't be asked to take its own limits out; Ghost AI's owner key is
+// the exception. This is part of the licence (Elastic License 2.0: no getting round
+// the licence key).
+//
+// SYMBIOT_LICENCE_PUBLIC_KEY replaces the public key (tests sign with their own).
+import { createPublicKey, verify as edVerify } from "node:crypto";
+import { existsSync, readFileSync, writeFileSync, realpathSync } from "node:fs";
+import { join, dirname, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "node:child_process";
+import { CONFIG_DIR, loadConfig, saveConfig } from "./core.mjs";
+
+const PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAGLISPmrOCX+t/KVY/u99rmFhjbXFbvRCGw1tStG1t8A=
+-----END PUBLIC KEY-----`;
+const REVOKED_URL = "https://symbiot.co.za/licences/revoked.json";
+const TRIAL_DAYS = 14, GRACE_DAYS = 7, DAY = 86400000;
+const FREE = { agents: 1, projects: 3, inboxes: 1 };
+const PRICE = "US$12 a month or US$99 a year";
+const UPGRADE_URL = "https://symbiot.co.za/#pro";
+
+const unb64u = (s) => Buffer.from(String(s).replace(/-/g, "+").replace(/_/g, "/"), "base64");
+const pubKey = () => createPublicKey(process.env.SYMBIOT_LICENCE_PUBLIC_KEY || PUBLIC_KEY);
+
+// "SYM1-<payload>.<signature>", whitespace and line breaks ignored (keys get pasted from mail).
+function readKey(text) {
+  const t = String(text || "").replace(/\s+/g, "");
+  const m = /^SYM1-([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]+)$/.exec(t);
+  if (!m) return { ok: false, why: "That isn't a Symbiot key. It starts with SYM1-." };
+  let p;
+  try {
+    if (!edVerify(null, Buffer.from(m[1]), pubKey(), unb64u(m[2]))) return { ok: false, why: "That key wasn't issued by Ghost AI (its signature doesn't match)." };
+    p = JSON.parse(unb64u(m[1]).toString("utf8"));
+  } catch { return { ok: false, why: "That key is damaged. Copy it again, all of it." }; }
+  if (!p || p.v !== 1 || !["pro", "owner"].includes(p.p) || !p.id) return { ok: false, why: "That key is for something this version of Symbiot doesn't know." };
+  return { ok: true, key: t, id: String(p.id), plan: p.p, email: String(p.e || ""), name: String(p.n || ""), issued: Number(p.i) || 0, expires: Number(p.x) || 0 };
+}
+
+// Cancelled keys, from symbiot.co.za, refreshed at most once a day; a failed fetch keeps the last list.
+const REVOKED_FILE = () => join(CONFIG_DIR, "licence-revoked.json");
+function revokedIds() { try { return new Set(JSON.parse(readFileSync(REVOKED_FILE(), "utf8")).ids || []); } catch { return new Set(); } }
+async function refreshRevoked(now = Date.now()) {
+  try {
+    const cur = existsSync(REVOKED_FILE()) ? JSON.parse(readFileSync(REVOKED_FILE(), "utf8")) : {};
+    if (cur.at && now - cur.at < DAY) return false;
+    const r = await fetch(process.env.SYMBIOT_REVOKED_URL || REVOKED_URL, { signal: AbortSignal.timeout(8000) });
+    if (!r.ok) return false;
+    const j = await r.json();
+    writeFileSync(REVOKED_FILE(), JSON.stringify({ at: now, ids: Array.isArray(j.ids) ? j.ids.map(String) : [] }));
+    return true;
+  } catch { return false; }
+}
+
+// Where you stand: { plan: "pro" | "owner" | "trial" | "free", ... }. Starts the trial clock on first sight.
+function licenceState(now = Date.now(), cfg = loadConfig()) {
+  const L = cfg.licence || {};
+  if (!L.trialStart) { L.trialStart = now; cfg.licence = L; try { saveConfig(cfg); } catch {} }
+  const base = { limits: FREE, price: PRICE, upgrade: UPGRADE_URL };
+  if (L.key) {
+    const k = readKey(L.key);
+    if (k.ok && revokedIds().has(k.id)) return { ...base, plan: "free", keyProblem: "This key has been cancelled. If that's a mistake, reply to the email it came in." };
+    if (k.ok) {
+      const left = k.expires ? k.expires - now : Infinity;
+      const who = { email: k.email, name: k.name, keyId: k.id, ...(k.expires ? { expires: k.expires } : {}) };
+      if (left > 0) return { ...base, plan: k.plan, ...who, ...(left < 14 * DAY ? { renewSoon: Math.ceil(left / DAY) } : {}) };
+      if (left > -GRACE_DAYS * DAY) return { ...base, plan: k.plan, ...who, grace: Math.ceil((left + GRACE_DAYS * DAY) / DAY) };
+      return { ...base, plan: "free", ...who, keyProblem: "Your Pro key has ended. Renew it to keep Pro." };
+    }
+    return { ...base, plan: "free", keyProblem: k.why };
+  }
+  const trialLeft = L.trialStart + TRIAL_DAYS * DAY - now;
+  if (trialLeft > 0) return { ...base, plan: "trial", trialDaysLeft: Math.ceil(trialLeft / DAY) };
+  return { ...base, plan: "free", trialEnded: true };
+}
+const isPro = (st = licenceState()) => st.plan === "pro" || st.plan === "owner" || st.plan === "trial";
+
+function setKey(text) {
+  const k = readKey(text);
+  if (!k.ok) return { error: k.why };
+  if (revokedIds().has(k.id)) return { error: "This key has been cancelled." };
+  const cfg = loadConfig(); cfg.licence = { ...(cfg.licence || {}), key: k.key }; saveConfig(cfg);
+  return licenceState();
+}
+function clearKey() { const cfg = loadConfig(); if (cfg.licence) { delete cfg.licence.key; saveConfig(cfg); } return licenceState(); }
+
+// What Free stops, and how it says so. ctx: { running } agents now, { count } projects/inboxes now.
+const WHY = {
+  agents: (n) => `Symbiot Free runs one agent at a time, and one is at work. This one starts when it's done, or Pro runs as many as you like at once (${PRICE}).`,
+  projects: () => `Symbiot Free works in ${FREE.projects} projects. Pro works in all of them (${PRICE}).`,
+  inboxes: () => `Symbiot Free connects one inbox or chat. Pro connects all of them: every mail account, WhatsApp, LinkedIn and your calendars (${PRICE}).`,
+  marketing: () => `The marketing lane is part of Symbiot Pro (${PRICE}).`,
+  ship: () => `Approve-and-ship (Symbiot opening the pull request and shipping it) is part of Symbiot Pro (${PRICE}). Your agent's changes are kept on their branch either way.`,
+};
+function can(feature, ctx = {}, st = licenceState()) {
+  if (isPro(st)) return { ok: true };
+  const n = Number(ctx.count ?? ctx.running ?? 0);
+  if (feature === "agents" && n < FREE.agents) return { ok: true };
+  if (feature === "projects" && n < FREE.projects) return { ok: true };
+  if (feature === "inboxes" && n < FREE.inboxes) return { ok: true };
+  if (!WHY[feature]) return { ok: true };
+  return { ok: false, pro: true, feature, why: WHY[feature](n), upgrade: UPGRADE_URL };
+}
+
+// ---- Symbiot never works on its own code -------------------------------------
+const HERE = (() => { try { return realpathSync(dirname(fileURLToPath(import.meta.url))); } catch { return dirname(fileURLToPath(import.meta.url)); } })();
+const real = (p) => { try { return realpathSync(p); } catch { return resolve(p); } };
+const inside = (p, root) => { const a = real(p), b = real(root); return a === b || a.startsWith(b + sep); };
+// Its repo or a fork (whatever it's renamed to), or the copy of Symbiot that's installed.
+function isSymbiotCode(dir) {
+  if (!dir) return false;
+  const d = real(dir);
+  if (inside(d, HERE)) return true;
+  let top = d;
+  try { const r = spawnSync("git", ["rev-parse", "--show-toplevel"], { cwd: d, encoding: "utf8", timeout: 5000, windowsHide: true }); if (r.status === 0 && r.stdout.trim()) top = r.stdout.trim(); } catch {}
+  try { const pj = JSON.parse(readFileSync(join(top, "package.json"), "utf8")); if (pj.name === "symbiot" || pj.name === "symbiot-desktop") return true; } catch {}
+  const has = (f) => existsSync(join(top, f));
+  if (has("licence.mjs") && has("ui.mjs") && has("server.mjs")) return true;
+  try { if (/EMBEDDED_UI/.test(readFileSync(join(top, "ui.mjs"), "utf8"))) return true; } catch {}
+  try { const r = spawnSync("git", ["remote", "-v"], { cwd: top, encoding: "utf8", timeout: 5000, windowsHide: true }); if (/[/:]symbiot(\.git)?\s/i.test(r.stdout || "")) return true; } catch {}
+  return false;
+}
+const SELF_WHY = "Symbiot doesn't work on its own code (Symbiot's repo, a copy of it, or its installed files). That keeps its licence and its safety rules from being edited away.";
+function canWorkIn(dir, st = licenceState()) {
+  if (!isSymbiotCode(dir)) return { ok: true };
+  if (st.plan === "owner") return { ok: true };
+  return { ok: false, self: true, why: SELF_WHY };
+}
+
+export { readKey, licenceState, isPro, setKey, clearKey, can, refreshRevoked, isSymbiotCode, canWorkIn, FREE, PRICE, TRIAL_DAYS, SELF_WHY, HERE as SYMBIOT_HOME };

package/links.mjs

@@ -18,6 +18,7 @@
 // trusted sites, there's no command an agent could call to link a site itself.
 //
 // What's linked is config.linked: { <id>: { at, watch?, hosts: [trusted by the link] } }.
+import { can } from "./licence.mjs";
 import { join } from "node:path";
 import { readFileSync } from "node:fs";
 import { CONFIG_DIR, loadConfig, saveConfig } from "./core.mjs";
@@ -100,10 +101,16 @@ function linksState() {
 // Link one: trust its hosts, watch its page, open it to sign in. Clicking a link
 // that's already there just opens it again to sign in (signed out, or a second
 // account). Gives { ok, url, item } or { error }.
+// what counts as an inbox or chat for Free's one
+const INBOX_GROUPS = new Set(["Mail", "Calendar", "Chat", "Social"]);
 async function linkSite(id, { open = signIn } = {}) {
   const e = catalog().list.find((x) => x.id === id);
   if (!e) return { error: `No link called ${id}.` };
   const l = linked(), had = l[id], before = new Set(trustedSites()), added = [];
+  if (!had && INBOX_GROUPS.has(e.group)) { // Free connects one inbox or chat (licence.mjs)
+    const n = Object.keys(l).filter((k) => { const x = catalog().list.find((c) => c.id === k); return x && INBOX_GROUPS.has(x.group); }).length;
+    const ok = can("inboxes", { count: n }); if (!ok.ok) return { error: ok.why, pro: true };
+  }
   for (const h of e.hosts) if (!before.has(h)) { const r = trustSite(h); if (r && r.ok) added.push(h); }
   let watch = had && had.watch;
   if (e.watch && !(watch && watchState().watches.some((x) => x.id === watch))) {