symbiot 0.61.1 → 0.62.0

package/index.mjs

@@ -40,7 +40,8 @@ import { produce, mailState, setMail, sentMail } from "./writeups.mjs";
 import { loadScreens, screenImage, blueprint } from "./screens.mjs";
 import { mapPage, wholePage, pressRegion, typeRegion, uploadRegion, uploadFiles, scrollPage, signIn, isTrusted } from "./headless.mjs";
 import { watchState, addWatch, removeWatch, seenWatch, newsSince, markNews, checkWatch, setBrief, draftReply, watchBoard, boardLine, boardChat, boardTalk, clearBoardChat } from "./watch.mjs";
-import { PORT as PHONE_PORT, phoneState, pairComputer, pollComputer, forgetComputer } from "./phone.mjs";
+import { PORT as PHONE_PORT, phoneState, pairComputer, pollComputer, forgetComputer, parsePairLink } from "./phone.mjs";
+import { qrMatrix } from "./qr.mjs";
 import { KIND_LABEL as POST_KIND, PATHS as POST_PATHS, draftPosts, postsState, postLog, approvePost, editPost, skipPost, voiceFromLinkedIn, addMedia as addPostMedia, removeMedia as removePostMedia, mediaDir as postMediaDir, pictureOfPage, clipOfPage } from "./post.mjs";
 import { startApp, updateCmd, isAppRunningWeekly, askRunningApp, openApp } from "./server.mjs";
 import { listReports, readReport } from "./reports.mjs";
@@ -617,26 +618,35 @@ function cmdKnowledge() {
   if (sub !== "help") process.exitCode = 1;
 }
 
-// ---- `symbiot phone`: Watch on your phone, from a terminal ----------------------
+// ---- `symbiot phone`: Your phone, from a terminal --------------------------------
 // On the phone (Termux), pair with your computer without the app window; on the
-// computer, the addresses and a code to pair with. Through the app when it runs:
+// computer, a code (and its QR) to pair with. Through the app when it runs:
 // that's where the computer listens and the phone asks.
+// A QR in the terminal: two rows of modules per line, in half blocks, with the
+// quiet zone a camera needs (light on dark terminals too: it draws the light parts).
+function terminalQr(text) {
+  const { modules, size } = qrMatrix(text), q = 2, n = size + 2 * q, dark = (r, c) => r >= q && c >= q && r < size + q && c < size + q && modules[r - q][c - q];
+  const lines = [];
+  for (let r = 0; r < n; r += 2) { let l = ""; for (let c = 0; c < n; c++) { const a = !dark(r, c), b = r + 1 < n && !dark(r + 1, c); l += a && b ? "█" : a ? "▀" : b ? "▄" : " "; } lines.push(l); }
+  return lines.join("\n");
+}
 async function cmdPhone() {
   const [sub = "status", ...rest] = argv.slice(1).filter((x) => !x.startsWith("--"));
   const fail = (msg) => { console.log(c.y(msg)); process.exitCode = 1; };
   const app = await viaApp("/api/phone", {}), st = app && !app.error ? app : phoneState();
   const phone = st.role === "phone", ask = "symbiot phone pair <address> <code>";
-  const notPaired = `Not paired with a computer. On the computer, switch on Settings → Watch on your phone in Symbiot (or run  symbiot phone code  there), then here:  ${ask}`;
+  const notPaired = `Not paired with a computer. On the computer, switch on Settings → Your phone in Symbiot (or run  symbiot phone code  there), then here:  ${ask}`;
   const onlyPhone = () => fail(`That's for the phone. In Termux there:  ${ask},  with an address and the code this computer shows (symbiot phone code).`);
   const onlyComputer = () => fail("That's for the computer your phone pairs with: run it there.");
-  const noApp = "Symbiot's app isn't running here, so nothing listens for your phone. Start it with  symbiot app,  switch on Settings → Watch on your phone, then run this again.";
+  const noApp = "Symbiot's app isn't running here, so nothing listens for your phone. Start it with  symbiot app,  switch on Settings → Your phone, then run this again.";
   const asks = (r) => (app ? `Symbiot here asks ${r.name} what's new every 2 minutes and notifies you.` : `Symbiot here asks ${r.name} what's new every 2 minutes while  symbiot app  runs: start it to be notified.`) + (r.notify === false ? c.d("  For notifications in Termux: pkg install termux-api, and the Termux:API app.") : "");
   if (sub === "pair") {
     if (!phone) return onlyPhone();
-    // the code may be typed as shown, in two halves: 123 456
-    const [address, ...code] = rest;
-    if (!address || !code.length) return fail(`Give the computer's address and the 6-digit code it shows:  ${ask}  (like 192.168.1.21:7392 123456)`);
-    const r = (app && await viaApp("/api/phone/pair", { address, code: code.join("") })) || await pairComputer(address, code.join(""));
+    // the code may be typed as shown, in two halves: 123 456; or the whole link the QR holds
+    const [address, ...code] = rest, link = parsePairLink(address) ? address : "";
+    if (!link && (!address || !code.length)) return fail(`Give the computer's address and the 6-digit code it shows:  ${ask}  (like 192.168.1.21:7392 123456)`);
+    const body = link ? { link } : { address, code: code.join("") };
+    const r = (app && await viaApp("/api/phone/pair", body)) || await pairComputer(body.address, body.code, { link });
     if (r.error || !r.paired) return fail(r.error || "Pairing didn't work.");
     console.log(`${c.g("✓")} Paired with ${c.b(r.name)} ${c.d(r.url)}\n  ${asks(r)}`);
     return;
@@ -658,27 +668,30 @@ async function cmdPhone() {
   if (sub === "code") {
     if (phone) return onlyComputer();
     if (!app) return fail(noApp);
-    if (!st.on) return fail("Watch on your phone is off. Switch it on in Symbiot: Settings → Watch on your phone.");
+    if (!st.on) return fail("Your phone's link is off. Switch it on in Symbiot: Settings → Your phone.");
     const r = await viaApp("/api/phone/code", {});
     if (!r || r.error || !r.code) return fail((r && r.error) || "No code came back.");
-    console.log(`Code ${c.b(r.code)}  ${c.d(`for ${Math.max(1, Math.round((r.until - Date.now()) / 60000))} minutes, 5 tries`)}\nOn the phone, in Termux, with this computer's address:`);
+    if (r.link && process.stdout.isTTY) console.log(terminalQr(r.link) + "\n" + c.d("Scan it with your phone's camera: Symbiot's app pairs with this computer.") + "\n");
+    console.log(`Code ${c.b(r.code)}  ${c.d(`for ${Math.max(1, Math.round((r.until - Date.now()) / 60000))} minutes, 5 tries`)}\nOr on the phone, in Termux, with this computer's address:`);
     for (const a of r.addresses || []) console.log(`  symbiot phone pair ${a}:${r.port || PHONE_PORT} ${r.code}`);
     return;
   }
   if (sub === "status") {
     if (phone) {
       if (!st.paired) return console.log(notPaired);
-      console.log(`Paired with ${c.b(st.name)} ${c.d(st.url)}` + (st.last ? c.d(`  · asked ${new Date(st.last).toLocaleString()}`) : ""));
+      console.log(`Paired with ${c.b(st.name)} ${c.d(st.url)}` + (st.last ? c.d(`  · asked ${new Date(st.last).toLocaleString()}${st.via === "relay" ? " through the relay" : ""}`) : ""));
       if (st.error) console.log(c.y(st.error));
+      if (st.queued) console.log(c.d(`  ${st.queued} change${st.queued > 1 ? "s" : ""} waiting to send`));
       console.log("  " + asks(st));
       return;
     }
     if (!app) return console.log(c.y(noApp));
-    if (!st.on) return console.log(c.y("Watch on your phone is off.") + c.d("  Switch it on in Symbiot: Settings → Watch on your phone."));
+    if (!st.on) return console.log(c.y("Your phone's link is off.") + c.d("  Switch it on in Symbiot: Settings → Your phone."));
     if (st.error) console.log(c.y(st.error));
     if (st.listening) console.log(`Listening for your phone at ${(st.addresses || []).map((a) => c.b(`${a}:${st.port || PHONE_PORT}`)).join(", ") || c.y("(no network address found)")}`);
+    if (st.relay && st.relay.on && (st.phones || []).length) console.log(c.d(st.relay.connected ? "Away from home, your phone reaches it through relay.symbiot.co.za (sealed: the relay can't read it)." : `Away from home: not connected to the relay yet${st.relay.error ? ` (${st.relay.error})` : ""}.`));
     console.log(st.code ? `Code ${c.b(st.code)}  ${c.d(`until ${new Date(st.until).toLocaleTimeString()}`)}` : c.d("No pairing code open:  symbiot phone code  for one."));
-    for (const p of st.phones || []) console.log(`  ${c.g("·")} ${p.name}  ${c.d("paired " + new Date(p.added).toLocaleDateString() + (p.seen ? ", asked " + new Date(p.seen).toLocaleString() : ""))}`);
+    for (const p of st.phones || []) console.log(`  ${c.g("·")} ${p.name}  ${c.d("paired " + new Date(p.added).toLocaleDateString() + (p.seen ? ", asked " + new Date(p.seen).toLocaleString() : "") + (p.old ? " (paired before the link was sealed: pair it again)" : ""))}`);
     console.log(c.d(`On the phone, in Termux:  ${ask}`));
     return;
   }
@@ -687,11 +700,12 @@ async function cmdPhone() {
   symbiot phone                         the computer it's paired with
   symbiot phone pair <address> <code>   pair with your computer, with its address
                                         (like 192.168.1.21:7392) and the code it shows
+  symbiot phone pair <link>             or with the link its QR holds
   symbiot phone check                   ask it what's new now
   symbiot phone forget                  stop asking it
-  On the computer (while  symbiot app  runs, Watch on your phone switched on):
+  On the computer (while  symbiot app  runs, Your phone switched on):
   symbiot phone                         where it listens, and the phones paired
-  symbiot phone code                    a new 6-digit code to pair a phone with`);
+  symbiot phone code                    a new code (and its QR) to pair a phone with`);
   if (sub !== "help") process.exitCode = 1;
 }
 
@@ -903,7 +917,7 @@ ${c.b("Experimental")}
                                     (symbiot watch help for more)
   symbiot phone pair <address> <code>
                                     in Termux: pair with your computer for
-                                    Watch on your phone (symbiot phone help)
+                                    Your phone (symbiot phone help)
   symbiot knowledge add <folder>    documents chats quote and cite (Markdown,
                                     CSV, text); waiting / owner from case files
                                     (symbiot knowledge help for more)

package/links.mjs

@@ -50,6 +50,9 @@ const CATALOG = [
   { id: "linkedin", name: "LinkedIn", group: "Social", url: "https://www.linkedin.com/notifications/", hosts: ["linkedin.com"], watch: true },
 ];
 const GROUPS = ["Mail", "Calendar", "Code", "Chat", "Work", "Docs", "Sales", "Social"];
+// Any other site, added by you (Settings → Connections → Add a site): domains.co.za, a
+// supplier's portal. config.sites: [{ id, name, url, hosts }], linked like the buttons.
+const OWN = "Your sites";
 
 const hostOf = (url) => { try { return new URL(url).hostname.replace(/^www\./, "").toLowerCase(); } catch { return ""; } };
 const linksFile = () => process.env.SYMBIOT_LINKS || join(CONFIG_DIR, "links.json");
@@ -69,11 +72,13 @@ function catalog() {
   try { file = JSON.parse(readFileSync(linksFile(), "utf8")); } catch (e) { if (e && e.code !== "ENOENT") error = `${linksFile()} isn't valid JSON, so it was skipped.`; }
   const extra = ((file && Array.isArray(file.links) && file.links) || []).map(cleanEntry).filter(Boolean);
   const hide = new Set(((file && Array.isArray(file.hide) && file.hide) || []).map((x) => String(x).toLowerCase()));
-  const byId = new Map(); for (const e of [...CATALOG, ...extra]) byId.set(e.id, e);
+  const own = ownSites().map((e) => ({ ...cleanEntry(e), group: OWN, own: true, company: false })).filter((e) => e.id);
+  const byId = new Map(); for (const e of [...CATALOG, ...extra, ...own]) if (!(e.own && byId.has(e.id))) byId.set(e.id, e);
   const list = [...byId.values()].filter((e) => !hide.has(e.id));
   return { list, error, file: file ? linksFile() : "" };
 }
 
+function ownSites() { const s = loadConfig().sites; return Array.isArray(s) ? s.filter((x) => x && typeof x === "object" && x.id && x.url) : []; }
 function linked() { const l = loadConfig().linked; return l && typeof l === "object" && !Array.isArray(l) ? l : {}; }
 function saveLinked(l) { const cfg = loadConfig(); if (Object.keys(l).length) cfg.linked = l; else delete cfg.linked; return saveConfig(cfg); }
 
@@ -93,8 +98,8 @@ function stateOf(e, l, watches) {
 }
 function linksState() {
   const c = catalog(), l = linked(), watches = watchState().watches;
-  const items = c.list.map((e) => ({ id: e.id, name: e.name, group: e.group, url: e.url, ...(e.company ? { company: true } : {}), ...stateOf(e, l[e.id], watches) }));
-  const groups = [...new Set([...GROUPS, ...items.map((x) => x.group)])].filter((g) => items.some((x) => x.group === g));
+  const items = c.list.map((e) => ({ id: e.id, name: e.name, group: e.group, url: e.url, ...(e.company ? { company: true } : {}), ...(e.own ? { own: true } : {}), ...stateOf(e, l[e.id], watches) }));
+  const groups = [...new Set([...GROUPS, ...items.map((x) => x.group).filter((g) => g !== OWN), OWN])].filter((g) => items.some((x) => x.group === g));
   return { items, groups, linked: items.filter((x) => x.state !== "off").length, ...(c.file ? { file: c.file } : {}), ...(c.error ? { error: c.error } : {}) };
 }
 
@@ -130,7 +135,7 @@ async function checkLink(id, { check = checkWatch, read = readPage } = {}) {
   if (!e || !l[id]) return { error: `${e ? e.name : id} isn't linked.` };
   if (l[id].watch) { const r = await check(l[id].watch); if (r && r.busy) return { busy: true, item: linksState().items.find((x) => x.id === id) }; }
   else {
-    const p = await read(e.url);
+    const p = await read(e.url, { password: true });
     if (p && p.busy) return { busy: true, item: linksState().items.find((x) => x.id === id) };
     const l2 = linked(); if (!l2[id]) return { error: `${e.name} isn't linked.` };
     l2[id] = { ...l2[id], ok: !!(p && !p.error && !p.login), checked: Date.now() }; saveLinked(l2);
@@ -153,7 +158,37 @@ function unlinkSite(id) {
     else untrustSite(h);
   }
   saveLinked(l);
+  if (ownSites().some((x) => x.id === id)) { const cfg = loadConfig(); cfg.sites = ownSites().filter((x) => x.id !== id); if (!cfg.sites.length) delete cfg.sites; saveConfig(cfg); }
   return { ok: true, ...linksState() };
 }
+// Add a site that isn't one of the buttons, and link it: trusted, opened in the Symbiot
+// Browser to sign in, checked when you click Done there (server.mjs /api/browser/done). A site that is one (gmail,
+// linkedin.com) links that one. input: a host or a web address, best the page you see
+// once signed in (www.domains.co.za/client/dashboard), so the check can tell.
+async function addSite(input, opts = {}) {
+  const url = siteUrl(input), host = hostOf(url);
+  if (!url || !host || !host.includes(".")) return { error: "Give the site: a host like domains.co.za, or the page you see once you're signed in." };
+  const known = catalog().list.find((e) => !e.own && e.hosts.some((h) => host === h || host.endsWith("." + h)));
+  if (known) return linkSite(known.id, opts);
+  const id = "site-" + host.replace(/[^a-z0-9]+/g, "-").slice(0, 34), cfg = loadConfig(), had = ownSites().find((x) => x.id === id);
+  cfg.sites = [...ownSites().filter((x) => x.id !== id), { id, name: host, url: had && /^https?:\/\/[^/]+\/?$/.test(url) ? had.url : url, hosts: [host] }];
+  saveConfig(cfg);
+  return linkSite(id, opts);
+}
+// A card or a reply that asks you to sign in to a site (an agent's "sign in to
+// domains.co.za in Symbiot's browser"): which, so it carries a button that opens it
+// in the Symbiot Browser (addSite). { site, name } or null. A site among the buttons by its name (LinkedIn) too.
+const ASKS_SIGNIN = /\b(?:sign(?:ed)?[ -]?in|log[ -]?in)(?:\s+again)?(?:\s+(?:to|at|on|into))?\s+(?:your\s+|the\s+)?/gi;
+function signInAsked(text) {
+  const t = String(text || "");
+  for (const m of t.matchAll(ASKS_SIGNIN)) {
+    const rest = t.slice(m.index + m[0].length, m.index + m[0].length + 80);
+    const d = rest.match(/^(?:https?:\/\/)?((?:[a-z0-9-]+\.)+[a-z]{2,})(\/[^\s"'`)]*)?/i);
+    if (d && !/\.(?:md|json|mjs|js|txt|env|pem)$/i.test(d[1])) return { site: (d[1] + (d[2] || "")).replace(/[.,;:]+$/, ""), name: d[1].toLowerCase().replace(/^www\./, "") };
+    const e = catalog().list.find((x) => new RegExp("^" + x.name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "\\b", "i").test(rest));
+    if (e) return { site: e.hosts[0], name: e.name, id: e.id };
+  }
+  return null;
+}
 
-export { CATALOG, catalog, cleanEntry, linksState, linkSite, checkLink, unlinkSite };
+export { CATALOG, catalog, cleanEntry, linksState, linkSite, checkLink, unlinkSite, addSite, ownSites, signInAsked, OWN };

package/mdns.mjs

@@ -0,0 +1,135 @@
+// symbiot — the computer says it's here on your network (multicast DNS, the way
+// printers and AirPlay are found), so your phone finds it after the router hands
+// it a new address, without pairing again (phone.mjs).
+//
+// announce() answers queries for _symbiot._tcp.local while the phone link is on:
+// a neutral name ("Symbiot-1a2b", never this computer's hostname), its port, and
+// a TXT record with the link key's fingerprint, which is how a paired phone knows
+// it's its computer. browse() asks the network and gives what answers (the tests,
+// and Symbiot in Termux, which has no Android discovery). Only node:dgram.
+import { createSocket } from "node:dgram";
+
+const GROUP = "224.0.0.251", PORT = 5353, SERVICE = "_symbiot._tcp.local", TTL = 120;
+const T = { A: 1, PTR: 12, TXT: 16, SRV: 33, ANY: 255 };
+
+// ---- DNS messages ------------------------------------------------------------------
+function encName(name) {
+  const parts = String(name).replace(/\.$/, "").split("."), out = [];
+  for (const p of parts) { const b = Buffer.from(p, "utf8"); out.push(Buffer.from([Math.min(63, b.length)]), b.subarray(0, 63)); }
+  out.push(Buffer.from([0]));
+  return Buffer.concat(out);
+}
+function readName(buf, at, depth = 0) {
+  const labels = []; let end = -1;
+  for (let guard = 0; guard < 128; guard++) {
+    if (at >= buf.length) throw new Error("short");
+    const len = buf[at];
+    if (len === 0) { at++; break; }
+    if ((len & 0xc0) === 0xc0) {
+      if (depth > 8) throw new Error("loop");
+      const ptr = ((len & 0x3f) << 8) | buf[at + 1];
+      if (end < 0) end = at + 2;
+      labels.push(readName(buf, ptr, depth + 1).name); at = -1; break;
+    }
+    labels.push(buf.toString("utf8", at + 1, at + 1 + len)); at += 1 + len;
+  }
+  return { name: labels.filter(Boolean).join("."), next: end >= 0 ? end : at };
+}
+const u16 = (n) => { const b = Buffer.alloc(2); b.writeUInt16BE(n); return b; };
+const u32 = (n) => { const b = Buffer.alloc(4); b.writeUInt32BE(n >>> 0); return b; };
+function encRecord({ name, type, ttl = TTL, flush = false, data }) {
+  let rd;
+  if (type === T.A) rd = Buffer.from(String(data).split(".").map(Number));
+  else if (type === T.PTR) rd = encName(data);
+  else if (type === T.SRV) rd = Buffer.concat([u16(0), u16(0), u16(data.port), encName(data.target)]);
+  else if (type === T.TXT) rd = Buffer.concat(Object.entries(data).map(([k, v]) => { const s = Buffer.from(`${k}=${v}`, "utf8").subarray(0, 255); return Buffer.concat([Buffer.from([s.length]), s]); }));
+  return Buffer.concat([encName(name), u16(type), u16((flush ? 0x8000 : 0) | 1), u32(ttl), u16(rd.length), rd]);
+}
+function encMessage({ id = 0, response = false, questions = [], answers = [], additionals = [] }) {
+  const head = Buffer.concat([u16(id), u16(response ? 0x8400 : 0), u16(questions.length), u16(answers.length), u16(0), u16(additionals.length)]);
+  return Buffer.concat([head, ...questions.map((q) => Buffer.concat([encName(q.name), u16(q.type), u16(q.unicast ? 0x8001 : 1)])), ...answers.map(encRecord), ...additionals.map(encRecord)]);
+}
+function decMessage(buf) {
+  const id = buf.readUInt16BE(0), flags = buf.readUInt16BE(2), qd = buf.readUInt16BE(4), an = buf.readUInt16BE(6), ns = buf.readUInt16BE(8), ar = buf.readUInt16BE(10);
+  let at = 12; const questions = [], records = [];
+  for (let i = 0; i < qd; i++) { const n = readName(buf, at); at = n.next; questions.push({ name: n.name, type: buf.readUInt16BE(at), unicast: !!(buf.readUInt16BE(at + 2) & 0x8000) }); at += 4; }
+  for (let i = 0; i < an + ns + ar; i++) {
+    const n = readName(buf, at); at = n.next;
+    const type = buf.readUInt16BE(at), ttl = buf.readUInt32BE(at + 4), len = buf.readUInt16BE(at + 8); at += 10;
+    const rd = buf.subarray(at, at + len); let data = null;
+    if (type === T.A && len === 4) data = [...rd].join(".");
+    else if (type === T.PTR) data = readName(buf, at).name;
+    else if (type === T.SRV) data = { port: rd.readUInt16BE(4), target: readName(buf, at + 6).name };
+    else if (type === T.TXT) { data = {}; for (let j = 0; j < rd.length;) { const l = rd[j], s = rd.toString("utf8", j + 1, j + 1 + l), eq = s.indexOf("="); if (s) data[eq < 0 ? s : s.slice(0, eq)] = eq < 0 ? "" : s.slice(eq + 1); j += 1 + l; } }
+    records.push({ name: n.name, type, ttl, data }); at += len;
+  }
+  return { id, response: !!(flags & 0x8000), questions, records };
+}
+
+// ---- the computer: answer while the link is on ------------------------------------------
+// opts: { id (a few hex characters, from the fingerprint), port, fp, addresses: () => [...] }.
+// Gives { stop() } (a goodbye, so phones forget it at once), or null where nothing
+// can listen on 5353 (it's in use without sharing, or there's no network).
+// (socket: a dgram-like factory, for the tests)
+const udp = (o) => createSocket(o);
+function announce({ id, port, fp, addresses }, { onError = () => {}, socket = udp } = {}) {
+  const inst = `Symbiot-${id}.${SERVICE}`, host = `symbiot-${id}.local`;
+  const records = (ttl = TTL) => {
+    const ips = addresses();
+    return { answers: [{ name: SERVICE, type: T.PTR, ttl, data: inst }],
+      additionals: [{ name: inst, type: T.SRV, ttl, flush: true, data: { port, target: host } }, { name: inst, type: T.TXT, ttl, flush: true, data: { v: 1, fp } },
+        ...ips.map((ip) => ({ name: host, type: T.A, ttl, flush: true, data: ip }))] };
+  };
+  const ours = (q) => { const n = q.name.toLowerCase(); return (n === SERVICE.toLowerCase() && (q.type === T.PTR || q.type === T.ANY)) || (n === inst.toLowerCase() && [T.SRV, T.TXT, T.ANY].includes(q.type)) || (n === host && [T.A, T.ANY].includes(q.type)); };
+  let sock; try { sock = socket({ type: "udp4", reuseAddr: true }); } catch (e) { onError(e); return null; }
+  let closed = false;
+  const send = (msg, port_ = PORT, to = GROUP) => { if (!closed) try { sock.send(msg, port_, to); } catch {} };
+  sock.on("error", (e) => { onError(e); try { sock.close(); } catch {} closed = true; });
+  sock.on("message", (buf, from) => {
+    let m; try { m = decMessage(buf); } catch { return; }
+    if (m.response || !m.questions.some(ours)) return;
+    const legacy = from.port !== PORT; // a one-shot query from any port: answered to it directly (RFC 6762 6.7)
+    const msg = encMessage({ id: legacy ? m.id : 0, response: true, questions: legacy ? m.questions.filter(ours) : [], ...records(legacy ? 10 : TTL) });
+    if (legacy || m.questions.some((q) => q.unicast)) send(msg, from.port, from.address); else send(msg);
+  });
+  sock.bind(PORT, () => {
+    try { sock.setMulticastTTL(255); sock.setMulticastLoopback(true); } catch {}
+    const ips = addresses(); let joined = 0;
+    for (const ip of ips) try { sock.addMembership(GROUP, ip); joined++; } catch {}
+    if (!joined) try { sock.addMembership(GROUP); } catch (e) { onError(e); }
+    // say it's here, twice a second apart, as RFC 6762 8.3 asks
+    send(encMessage({ response: true, ...records() })); setTimeout(() => send(encMessage({ response: true, ...records() })), 1000).unref();
+  });
+  sock.unref();
+  return { stop() { if (closed) return; send(encMessage({ response: true, ...records(0) })); setTimeout(() => { closed = true; try { sock.close(); } catch {} }, 50); } };
+}
+
+// ---- the phone (and the tests): who answers -------------------------------------------
+// [{ name, host, port, addresses, fp }] after `timeout` ms. Asked from a passing
+// port, so answers come straight back here and nothing else needs 5353.
+function browse({ timeout = 2500, iface, socket = udp } = {}) {
+  return new Promise((resolve) => {
+    const found = new Map(); let sock;
+    try { sock = socket({ type: "udp4" }); } catch { return resolve([]); }
+    const done = () => { try { sock.close(); } catch {} resolve([...found.values()].filter((x) => x.port && x.addresses.length)); };
+    sock.on("error", done);
+    sock.on("message", (buf) => {
+      let m; try { m = decMessage(buf); } catch { return; }
+      if (!m.response) return;
+      const recs = m.records;
+      for (const p of recs.filter((r) => r.type === T.PTR && r.name.toLowerCase() === SERVICE.toLowerCase())) {
+        const inst = p.data, srv = recs.find((r) => r.type === T.SRV && r.name === inst), txt = recs.find((r) => r.type === T.TXT && r.name === inst);
+        if (!srv) continue;
+        const addrs = recs.filter((r) => r.type === T.A && r.name.toLowerCase() === srv.data.target.toLowerCase()).map((r) => r.data);
+        found.set(inst, { name: inst.split(".")[0], host: srv.data.target, port: srv.data.port, addresses: addrs, fp: (txt && txt.data && txt.data.fp) || "" });
+      }
+    });
+    sock.bind(0, () => {
+      try { sock.setMulticastLoopback(true); if (iface) sock.setMulticastInterface(iface); } catch {}
+      try { sock.send(encMessage({ id: Math.floor(Math.random() * 65535), questions: [{ name: SERVICE, type: T.PTR }] }), PORT, GROUP); } catch { return done(); }
+      setTimeout(done, timeout);
+    });
+  });
+}
+
+export { announce, browse, encMessage, decMessage, SERVICE, T };

package/mind.mjs

@@ -204,6 +204,7 @@ function rulesFor(lanes = [], self = "", nav = false) {
 When they ask you to do something (look into it, find out, fix, set up, sign in, close, send, chase), do it, don't explain what you can't do: "agent" starts a coding agent now, with their tools and connectors (MCP, the command line, a browser signed in to their linked sites). With a "repo", it's that project's agent, working in it; empty, an agent for everything outside a repo (this computer, accounts, services). Use "task" for what's for later. Don't ask their permission to hand it over: the agent asks them first, on the Workdesk, before anything hard to undo (closing an account, deleting, paying, sending); say so in your reply when it applies, with what to check first. A question you can answer from what's here: answer it, "do": null.
 Lanes ("repo" is one of these, exactly): ${lanes.length ? lanes.slice(0, 60).join(", ") : "(none found)"}.${lanes.includes(MARKETING) ? ` "${MARKETING}" is a lane of its own for marketing any of their products (posts, demo videos, launches, campaigns, pricing pages' copy): marketing work goes there, starting with the product it's for in brackets, "[Dailify] a launch post".` : ""}${self ? ` Symbiot itself is "${self}": a flaw in how Symbiot works (how it read a page, what a brief or a card said, anything in the app) goes there.` : ""}
 Don't wait to be asked to fix Symbiot. When you notice it got something wrong (you misread a page, a brief or a card misled them, a step made them do an agent's job), say so plainly and, in the same reply, start the fix: "agent"${self ? ` with "repo": "${self}"` : ""}, saying what went wrong, an example, and what it should do instead.
+When only they can sign in to a site (their password, an SMS code), say where, with the site's address: "sign in to www.domains.co.za/client/dashboard in the Symbiot Browser (Settings → Connections → Add a site)", never just "in Symbiot's browser": your reply then carries a Sign in button that opens that window on it.
 A short answer (yes, yeah, ok, sure, go, do it, that one, 2) answers what you last said in "This chat so far", never something from elsewhere in the app. If you'd proposed a task or an agent and they agree, do it now in "do", in the lane you named.
 Hash it out first: when they bring an idea rather than a clear ask, sharpen it with them: say what's strong, push back where it's weak, add what's missing, and propose it as a task (naming the lane) once it holds up. "do" stays null until they agree.
 When an ask could mean two or more things (which lane, how much, what done looks like), don't guess: "do" stays null, and the reply gives 2-3 short numbered readings, your pick first, and asks which. A clear ask goes straight through.${nav ? ` Where to go is the exception: see "go".` : ""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "symbiot",
-  "version": "0.61.1",
+  "version": "0.62.0",
   "description": "Your week, written from your real work. Reads your local git and writes it up with the AI of your choice \u2014 Claude, OpenAI, Gemini, or a local model.",
   "type": "module",
   "bin": {
@@ -55,7 +55,9 @@
     "voice.mjs",
     "licence.mjs",
     "lang.mjs",
-    "browser.html"
+    "browser.html",
+    "qr.mjs",
+    "mdns.mjs"
   ],
   "engines": {
     "node": ">=18"
@@ -88,7 +90,7 @@
     "@anthropic-ai/sdk": "^0.128.0"
   },
   "scripts": {
-    "test": "node test/load.mjs && node test/fixtures.mjs && node test/links.mjs && node test/post.mjs && node test/peek.mjs && node test/mind.mjs && node test/knowledge.mjs && node test/checks.mjs &&node test/lanes.mjs && node test/handback.mjs && node test/autoallow.mjs && node test/guard.mjs && node test/reports.mjs && node test/sandbox.mjs && node test/adapt.mjs && node test/urgent.mjs && node test/drafts.mjs && node test/linkedin.mjs && node test/secrets.mjs && node test/work.mjs && node test/mapknn.mjs && node test/away.mjs && node test/voice.mjs && node test/licence.mjs && node test/lang.mjs && node test/browser.mjs && node test/subscription.mjs && node test/claudesetup.mjs && node test/launcher.mjs && node test/onboarding.mjs && node test/windows.mjs && node test/marketing.mjs && node test/tray.mjs && node test/paths.mjs && node test/smoke.mjs && node test/app.mjs && node test/install.mjs",
+    "test": "node test/load.mjs && node test/fixtures.mjs && node test/links.mjs && node test/signin.mjs && node test/post.mjs && node test/peek.mjs && node test/mind.mjs && node test/knowledge.mjs && node test/checks.mjs &&node test/lanes.mjs && node test/handback.mjs && node test/autoallow.mjs && node test/guard.mjs && node test/reports.mjs && node test/sandbox.mjs && node test/adapt.mjs && node test/urgent.mjs && node test/drafts.mjs && node test/linkedin.mjs && node test/secrets.mjs && node test/work.mjs && node test/mapknn.mjs && node test/away.mjs && node test/voice.mjs && node test/licence.mjs && node test/lang.mjs && node test/browser.mjs && node test/subscription.mjs && node test/claudesetup.mjs && node test/launcher.mjs && node test/onboarding.mjs && node test/phone.mjs && node test/windows.mjs && node test/marketing.mjs && node test/tray.mjs && node test/paths.mjs && node test/smoke.mjs && node test/app.mjs && node test/install.mjs",
     "lint": "eslint .",
     "postinstall": "node postinstall.mjs"
   },