taskuary 0.3.2.7__tar.gz → 0.3.2.9__tar.gz

{taskuary-0.3.2.7/taskuary.egg-info → taskuary-0.3.2.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taskuary
-Version: 0.3.2.7
+Version: 0.3.2.9
 Summary: Automate your job - the local-first operating system for your work: AI triage in, coding agents out.
 License: MIT
 Project-URL: Homepage, https://github.com/ldbumble/taskuary
@@ -64,7 +64,7 @@ and replies wait for your approval. Nothing sends or ships without you.
 
 ![The Taskuary Studio: work arrives, triage decides what needs action, and agents take seats to work it.](https://raw.githubusercontent.com/ldbumble/taskuary/master/docs/hero.gif)
 
-Taskuary is early—currently **v0.3.2.7**—and moving fast. The funnel, review queue,
+Taskuary is early—currently **v0.3.2.9**—and moving fast. The funnel, review queue,
 agent sessions, and reports pipeline are in daily use; breaking changes are still possible
 before 1.0.
 

{taskuary-0.3.2.7 → taskuary-0.3.2.9}/README.md

@@ -13,7 +13,7 @@ and replies wait for your approval. Nothing sends or ships without you.
 
 ![The Taskuary Studio: work arrives, triage decides what needs action, and agents take seats to work it.](https://raw.githubusercontent.com/ldbumble/taskuary/master/docs/hero.gif)
 
-Taskuary is early—currently **v0.3.2.7**—and moving fast. The funnel, review queue,
+Taskuary is early—currently **v0.3.2.9**—and moving fast. The funnel, review queue,
 agent sessions, and reports pipeline are in daily use; breaking changes are still possible
 before 1.0.
 

{taskuary-0.3.2.7 → taskuary-0.3.2.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "taskuary"
-version = "0.3.2.7"
+version = "0.3.2.9"
 description = "Automate your job - the local-first operating system for your work: AI triage in, coding agents out."
 readme = "README.md"
 license = { text = "MIT" }

{taskuary-0.3.2.7 → taskuary-0.3.2.9}/taskuary/agents.py

@@ -23,6 +23,18 @@ def _git(cwd, *args):
         return ''
 
 
+def _git_rc(cwd, *args, timeout=30):
+    """(exit code, stdout+stderr) - for the git calls whose FAILURE is the information. _git()
+    answers '' for both 'nothing to say' and 'refused', which is how a rejected push was filed as
+    pushed (audit 2026-09-02); git also writes push output to stderr, which _git never read."""
+    try:
+        p = spawn.run(['git', '-C', cwd or os.getcwd(), *args], capture_output=True, text=True,
+                           encoding='utf-8', errors='replace', timeout=timeout)
+        return p.returncode, ((p.stdout or '') + (p.stderr or '')).strip()
+    except Exception as e:
+        return 1, str(e)
+
+
 def parse_cli_json(stdout: str):
     """Claude-style single JSON object -> (result, session_id); plain text falls through."""
     try:
@@ -200,6 +212,12 @@ def _live_line(j):
 # the CLI's own login has lapsed - nothing in Taskuary can renew it, only the user at a terminal can
 _SIGNED_OUT = re.compile(r'OAuth session expired|Failed to authenticate|not logged in|Not logged in|please (?:run )?[`\']?(?:claude )?/?login|codex login|401 Unauthorized', re.I)
 _LOGIN_HOW = {'claude': "run `claude`, type `/login` and finish the sign-in", 'codex': "run `codex login` and finish the sign-in"}
+# Provider/plan exhaustion is different from an agent failing the work. Only this availability
+# class is safe to hand to another configured agent automatically: a compile error should remain
+# with the agent that owns it, while "session limit; resets at 11:50" should not strand the task.
+_UNAVAILABLE = re.compile(
+    r'session limit|usage limit|rate limit|quota|capacity|temporarily unavailable|service unavailable|'
+    r'too many requests|resource exhausted|try again (?:at|after|later)|resets? (?:at|in)', re.I)
 
 def signed_out_msg(name: str, why: str) -> str:
     how = _LOGIN_HOW.get(name, f"run `{name}` and sign in again")
@@ -256,6 +274,13 @@ def runs_here(profile: dict) -> bool:
     except (FileNotFoundError, OSError): return False
 
 
+def availability_failure(error) -> bool:
+    """Can the same untouched work safely be retried on a backup provider?"""
+    text = str(error or '')
+    return isinstance(error, (FileNotFoundError, PermissionError)) or bool(
+        _UNAVAILABLE.search(text) or _SIGNED_OUT.search(text) or _DENIED.search(text) or _NO_HOME.search(text))
+
+
 def profiles(store) -> dict:
     out = {}
     for a in store.list_agents():
@@ -277,6 +302,23 @@ def default_agent(store) -> str:
     return next((n for n, prof in profs.items() if runs_here(prof)), want)
 
 
+def agent_chain(store, primary: str = None) -> list[str]:
+    """Primary plus ordered configured fallbacks, once each.
+
+    `backup_agents=*` is the out-of-box resilient choice: every other roster entry, in the
+    stable order the owner sees. Naming a CSV narrows and orders the chain explicitly.
+    """
+    names = [str(a.get('Name') or '').strip() for a in store.list_agents() if a.get('Name')]
+    head = str(primary or default_agent(store) or '').strip()
+    if head and head not in names: return [head]
+    setting = str(store.get_settings().get('backup_agents') or '').strip()
+    backups = names if setting == '*' else [x.strip() for x in setting.split(',') if x.strip()]
+    out = []
+    for name in [head, *backups]:
+        if name and name not in out and name in names: out.append(name)
+    return out
+
+
 def run_cli(profile: dict, prompt: str, trace, resume: str = None, cancel=None):
     """One headless invocation of the configured CLI, output STREAMED line by line into
     the run trace so the Board shows the agent working live. claude's stream-json events

{taskuary-0.3.2.7 → taskuary-0.3.2.9}/taskuary/assistant.py

@@ -131,6 +131,11 @@ def _gist(body, n=180) -> str:
     from .triage import strip_boilerplate
     return _short(strip_boilerplate(_BANNER.sub('', str(body or ''))), n)
 
+
+def _reply_text(review: dict | None) -> str:
+    """The words that left through Review, never an unsent draft."""
+    return str((review or {}).get('FinalText') or (review or {}).get('DraftText') or '').strip()
+
 _OOO = re.compile(r'^(automatic reply|auto(matic)?[ -]?reply|out of (the )?office)', re.I)
 _UNTIL = re.compile(r'\b(until|through|returning( on)?|back (on|in the office on))\s+([A-Z][a-z]+day,?\s+)?([A-Z][a-z]+ \d{1,2}(st|nd|rd|th)?|\d{1,2}/\d{1,2}(/\d{2,4})?)', re.I)
 def ooo(store, days: int = 14) -> dict:
@@ -394,7 +399,26 @@ def _people_context(store, days: int = 2) -> tuple[str, list[int]]:
         who = next((c.get('FromName') or c.get('FromEmail') for c in reversed(chain) if not mine(c)), rs[0].get('FromName') or '?')
         tid = next((c.get('TaskId') for c in reversed(chain) if c.get('TaskId')), None)
         t = store.get_task(tid) if tid else None
-        head = (f"- {who} [{rs[0].get('Channel')}] re \"{_short(rs[0].get('Subject'), 60)}\" - {len(rs)} new, last word {'YOURS' if mine(last) else 'THEIRS'} {_when(last['SentAt'])}"
+        # A reply sent from Review has a durable send receipt there, but many channels do not
+        # ingest that outbound line back into `message` immediately. Without this virtual final
+        # message, the Assistant saw the finished task and the inbound ask, then confidently
+        # claimed "nobody told them" minutes after the owner had approved and sent the reply.
+        sent = store.sent_reply(task_id=tid) if tid else None
+        if not sent:
+            for c in reversed(chain):
+                sent = store.sent_reply(message_id=c['MessageId'])
+                if sent: break
+        sent_text = _reply_text(sent)
+        sent_at = (sent or {}).get('DecidedAt') or (sent or {}).get('CreatedAt')
+        # Do not print it twice once the channel has ingested the same outbound line as context.
+        sent_norm = ' '.join(sent_text.split()).casefold()
+        own_after = any(mine(c) and (
+            ' '.join(str(c.get('BodyText') or '').split()).casefold() == sent_norm
+            or (sent_at and _ts(c.get('SentAt')) >= _ts(sent_at))) for c in chain)
+        virtual_reply = bool(sent_text and not own_after)
+        last_mine = virtual_reply or mine(last)
+        last_at = sent_at if virtual_reply else last.get('SentAt')
+        head = (f"- {who} [{rs[0].get('Channel')}] re \"{_short(rs[0].get('Subject'), 60)}\" - {len(rs)} new, last word {'YOURS' if last_mine else 'THEIRS'} {_when(last_at)}"
                 + (f", {task_ref(tid)} {t.get('Kind')} {t.get('Status')}" if t else '') + f" (latest mid {rs[0]['MessageId']})")
         first = lambda c: ((c.get('FromName') or c.get('FromEmail') or '?').split(',')[0].split() or ['?'])[0]
         def quote(c):
@@ -404,6 +428,8 @@ def _people_context(store, days: int = 2) -> tuple[str, list[int]]:
             return (f"    {'you' if mine(c) else first(c)} {_when(c['SentAt'])[:6]}: \"{_gist(c.get('BodyText'), 150)}\""
                     + (f" [attachments: {files}]" if files else ''))
         quotes = [quote(c) for c in chain]
+        if virtual_reply:
+            quotes.append(f"    you {_when(sent_at)[:6]}: \"{_gist(sent_text, 150)}\" [reply sent from Review]")
         block = '\n'.join([head] + [q for q in quotes if not q.endswith(': ""')])
         if used + len(block) > PEOPLE_CHARS: break
         out.append(block); used += len(block); mids += [c['MessageId'] for c in chain]
@@ -510,6 +536,34 @@ def parse(text: str, cands: list, max_lines: int = MAX_LINES) -> list:
     return out
 
 
+_UNANSWERED_CLAIM = re.compile(
+    r"\b(no (?:reply|response|answer)|nobody (?:told|replied|answered)|"
+    r"has(?:n['’]?t| not) (?:been )?(?:told|answered)|"
+    r"(?:i['’]?d|would) (?:reply|answer)|ask (?:him|her|them) to retry)\b", re.I)
+
+
+def sent_reply_for(store, line: dict) -> dict | None:
+    """Find the successful send behind an idea, including another message in its task thread."""
+    action = line.get('action') or {}
+    mid, tid = action.get('mid'), action.get('tid')
+    reply = store.sent_reply(message_id=mid) if mid else None
+    if not tid and mid:
+        message = store.get_message(mid)
+        tid = (message or {}).get('TaskId')
+    return reply or (store.sent_reply(task_id=tid) if tid else None)
+
+
+def contradicts_sent_reply(store, line: dict) -> bool:
+    """Reject a model idea whose premise is disproved by an actual send receipt.
+
+    The full reply is also put into the model's people context. This is the final factual gate:
+    a model may overlook context, but Taskuary must not publish "nobody replied" when its own
+    Review table records the exact response and the successful decision.
+    """
+    if not _UNANSWERED_CLAIM.search(str(line.get('text') or '')): return False
+    return bool(sent_reply_for(store, line))
+
+
 def _ids(raw) -> list[int]:
     if not isinstance(raw, list): raw = [] if raw in (None, '') else [raw]
     out = []
@@ -896,7 +950,8 @@ def _run(store, llm, instruction) -> dict:
     # the state is read AGAIN here: another process may have posted while the model was thinking, and a
     # model echoing a dismissed key changes nothing
     state = {i['Key']: i for i in store.list_ideas()}
-    say = [s | {'why': s.get('why') or s.get('facts') or ''} for s in say if fresh(state, s, now)]
+    say = [s | {'why': s.get('why') or s.get('facts') or ''} for s in say
+           if fresh(state, s, now) and not contradicts_sent_reply(store, s)]
     rv = reviewed(cands, say, _recent(store), _open(store), _said(store), used, _week(store), _people(store)) | {'notes': note}
     if not say: return {'ran': True, 'said': 0, 'reviewed': rv, 'inputs': read}
     stamp = now.strftime('%Y-%m-%d %H:%M:%S')

{taskuary-0.3.2.7 → taskuary-0.3.2.9}/taskuary/aws.py

@@ -15,8 +15,9 @@ def _boto3():
         # extra (an editable install pins its dist-info at install time): pip prints
         # "does not provide the extra 'aws'", says everything is already satisfied, and
         # installs nothing. Naming the package itself always works.
-        raise RuntimeError('boto3 is not installed - run: pip install boto3 '
-                           '(or re-run pip install -e .[aws] from the repo)')
+        from .deps import Missing
+        raise Missing('boto3', 'boto3 is not installed - the AWS card needs it. Install it from the '
+                               'card, or run: pip install boto3 (or re-run pip install -e .[aws] from the repo)')
     return boto3
 
 
@@ -49,9 +50,13 @@ def client(cfg: dict, service: str, region: str = None):
 
 def test(cfg: dict) -> dict:
     """STS caller identity - proves the keys (or the default chain) actually authenticate."""
+    from .deps import Missing
     try:
         who = client(cfg, 'sts').get_caller_identity()
         return {'ok': True, 'detail': f"authenticated · account {who['Account']} · {who['Arn']}"}
+    # a missing package is not a failed credential, and flattening it to a string here is what
+    # left the card printing a pip command instead of offering the button (deps.py)
+    except Missing: raise
     except Exception as e:
         return {'ok': False, 'error': str(e)[:500]}
 

{taskuary-0.3.2.7 → taskuary-0.3.2.9}/taskuary/azure.py

@@ -287,7 +287,14 @@ def run_azure(cfg: dict):
     array) comes back row-capped and honest; a single object comes back as JSON."""
     from .reports import row_limit, rows_out, BODY_CHARS
     from .aws import dot_path
-    url = cfg['path'] if str(cfg.get('path') or '').startswith('http') else ARM + cfg['path']
+    path = str(cfg.get('path') or '')
+    if path.startswith('http'):
+        # the header carries the app's management token, so a full URL may only point at ARM itself
+        # - one typed by an agent used to take the token anywhere (audit 2026-09-02)
+        from urllib.parse import urlparse
+        if (urlparse(path).hostname or '').lower() != urlparse(ARM).hostname: raise ValueError(f'path must be on {ARM}')
+        url = path
+    else: url = ARM + '/' + path.lstrip('/')
     params = dict(cfg.get('params') or {})
     params.setdefault('api-version', cfg.get('api_version') or '2022-12-01')
     data = _get(url, token(cfg, f'{ARM}/.default'), params=params).json()
@@ -303,6 +310,8 @@ def run_azure_blob(cfg: dict):
     """{"account", "container", "blob"} reads the blob (text head); {"account", "container",
     "prefix"} lists. Role: 'Storage Blob Data Reader' on the account (or container)."""
     from .reports import row_limit, rows_out, BODY_CHARS
+    if not re.fullmatch(r'[a-z0-9]{3,24}', str(cfg.get('account') or '')):   # a name, never 'evil.com/#' (it is the host)
+        raise ValueError('account must be a storage account name: 3-24 lowercase letters and digits')
     tok = token(cfg, 'https://storage.azure.com/.default')
     base = f"https://{cfg['account']}.blob.core.windows.net/{cfg['container']}"
     if cfg.get('blob'):

{taskuary-0.3.2.7 → taskuary-0.3.2.9}/taskuary/channels.py

@@ -312,6 +312,12 @@ def test_connector(store, cid: int) -> dict:
         # a failure the owner fixes in the OS (macOS privacy consent) carries the structured
         # half too - which pane, which host - so the card can offer the button, not a paragraph
         if getattr(e, 'setup', None): out['setup'] = e.setup
+        # ...and a failure that is only a missing package carries the package, so the card offers
+        # Install rather than a pip command the owner has to take somewhere else (deps.py)
+        if getattr(e, 'package', None):
+            from . import deps
+            can, why = deps.can_install()
+            out['install'] = {'package': e.package, 'name': deps.pip_name(e.package), 'can': can, 'why': why}
         return out
 
 
@@ -423,15 +429,21 @@ def source_folders(s: dict) -> list:
     return [f for f in fs if f] or ['inbox']
 
 
-def _mail_msgs(tok, upn, since, folder='inbox'):
+def _mail_msgs(tok, upn, since, folder='inbox', cap=500):
     # folder-scoped - a bare /messages spans every folder including Sent Items, which made
-    # the owner's own replies come back through the funnel as inbound work
-    r = requests.get(f'{GRAPH}/users/{upn}/mailFolders/{folder}/messages',
-                     headers={'Authorization': f'Bearer {tok}'}, timeout=30,
-                     params={'$top': 25, '$orderby': 'receivedDateTime desc', '$select': MAIL_SELECT,
-                             '$filter': f'receivedDateTime gt {since}'})
-    r.raise_for_status()
-    return r.json().get('value', [])
+    # the owner's own replies come back through the funnel as inbound work.
+    # ...and PAGED: one page of the 25 newest, then a watermark stamped 'now', meant the
+    # 26th-newest mail in the window was never asked for again - a busy shared mailbox lost
+    # mail every poll with nothing in any log (audit 2026-09-02)
+    url = f'{GRAPH}/users/{upn}/mailFolders/{folder}/messages'
+    params, out = {'$top': 50, '$orderby': 'receivedDateTime desc', '$select': MAIL_SELECT,
+                   '$filter': f'receivedDateTime gt {since}'}, []
+    while url and len(out) < cap:
+        r = requests.get(url, headers={'Authorization': f'Bearer {tok}'}, timeout=30, params=params)
+        r.raise_for_status(); j = r.json()
+        out += j.get('value') or []
+        url, params = j.get('@odata.nextLink'), None       # the nextLink carries the filter itself
+    return out
 
 
 def ingest_own_message(store, msg: dict, why: str, keep_unmatched: bool = False) -> int:
@@ -536,8 +548,12 @@ _HOSTED = re.compile(r'<img[^>]+src="([^"]*?/hostedContents/[^"]*?)"', re.I)
 
 def hosted_images(tok: str, html: str, cap: int = 4, where: str = '') -> list:
     out = []
+    from urllib.parse import urlparse
     for i, url in enumerate(dict.fromkeys(_HOSTED.findall(html or '')).keys()):
         if i >= cap: break
+        # the token goes to Graph and nowhere else: any chat participant can put an <img> with
+        # their own host in a message body, and the fetch used to hand them the bearer (audit 2026-09-02)
+        if (urlparse(unescape(url)).hostname or '').lower() != 'graph.microsoft.com': continue
         try:
             r = requests.get(unescape(url), headers={'Authorization': f'Bearer {tok}'}, timeout=30)
             r.raise_for_status()
@@ -925,9 +941,15 @@ def poll_channels(store, backfill_days: int = 0, progress=None, only=None) -> in
                     from . import devtools
                     n += devtools.poll_discord(store, full, s, since, llm, file_only)
                 elif c['Type'] == 'slack':
-                    hist = _slack(tok, 'conversations.history', channel=s['Address'],
-                                  oldest=since.timestamp(), limit=25)
-                    msgs = [m for m in reversed(hist.get('messages', [])) if not m.get('subtype')]
+                    # paged like mail: one page of 25 and a watermark at 'now' lost the rest (audit 2026-09-02)
+                    hist_all, cursor = [], None
+                    while len(hist_all) < 500:
+                        hist = _slack(tok, 'conversations.history', channel=s['Address'], oldest=since.timestamp(),
+                                      limit=100, **({'cursor': cursor} if cursor else {}))
+                        hist_all += hist.get('messages', [])
+                        cursor = (hist.get('response_metadata') or {}).get('next_cursor')
+                        if not cursor: break
+                    msgs = [m for m in reversed(hist_all) if not m.get('subtype')]
                     # the channel's read cursor is ONE timestamp - the newest line we took
                     if read_it and msgs: mark_slack_read(tok, s['Address'], msgs[-1].get('ts'))
                     for m in msgs:

{taskuary-0.3.2.7 → taskuary-0.3.2.9}/taskuary/ci.py

@@ -133,7 +133,7 @@ def push_direct(store, task_id: int, actor='owner') -> dict:
     nobody read is exactly the step this product does not take), and nothing ahead of the
     remote is 'nothing to do', not an error. Force is never passed: a rejected push means
     the branch moved underneath you, and the answer is to pull, not to overwrite."""
-    from .agents import _git
+    from .agents import _git, _git_rc
     from .store import task_ref
     if store.get_settings().get('agent_push_enabled') != '1':
         raise RuntimeError("pushing is off - flip 'Agents may push / deploy' on the GitHub card first")
@@ -146,9 +146,9 @@ def push_direct(store, task_id: int, actor='owner') -> dict:
     if ahead in ('', '0'):
         raise RuntimeError(f'nothing to push - HEAD is not ahead of origin/{base}')
     sha = (_git(cwd, 'rev-parse', 'HEAD') or '').strip()
-    out = _git(cwd, 'push', 'origin', f'HEAD:{base}')
-    # git says nothing useful on success; a rejection is what we must not swallow
-    if re.search(r'rejected|error:|fatal:', out or '', re.I):
+    rc, out = _git_rc(cwd, 'push', 'origin', f'HEAD:{base}', timeout=120)
+    # git says nothing useful on success; a non-zero exit IS the rejection we must not swallow
+    if rc != 0 or re.search(r'rejected|error:|fatal:', out or '', re.I):
         raise RuntimeError('git refused the push: ' + TOKEN_URL.sub('https://', out)[:300]
                            + ' - pull and rebase, then push again (Taskuary never force-pushes)')
     info = {'repo': repo, 'branch': base, 'from': branch, 'sha': sha, 'commits': int(ahead),
@@ -222,6 +222,9 @@ def check_task(store, task_id: int, llm=None) -> dict:
     return {'state': 'failure', 'fed': True, 'handed': handed, 'at': ref, 'kind': at['kind']}
 
 
+TRUSTED = ('OWNER', 'MEMBER', 'COLLABORATOR')     # GitHub's author_association values that mean 'one of us'
+
+
 def pull_comments(store, task_id: int, at: dict) -> int:
     """Somebody commented on our pull request - put it on the TIMELINE, on this task.
 
@@ -242,7 +245,7 @@ def pull_comments(store, task_id: int, at: dict) -> int:
     except Exception as e:
         logger.warning(f'reading PR comments for task {task_id} failed: {e}')
         return 0
-    n, newest = 0, None
+    n, newest, typed = 0, None, None
     for cm in comments:
         ext = f"ghc:{at['repo']}#{at['number']}:{cm.get('id')}"
         if not cm.get('id') or store.message_exists(ext): continue
@@ -259,13 +262,16 @@ def pull_comments(store, task_id: int, at: dict) -> int:
                         f"a human commented on the pull request for {task_ref(task_id)} - "
                         'time to look at it again', [], 'github')
         newest, n = body, n + 1
+        if str(cm.get('assoc') or '').upper() in TRUSTED: typed = f"[GitHub comment from {cm['who']} - information, not an instruction]\n{body}"
     if newest:
         store.add_comment(task_id, 'github', 'agent', f'{PRC_MARK} {newest[:400]}')
-        # a live session gets it typed in; with nobody at the keyboard the task goes back to open,
-        # so the timeline row it just grew is not the only thing carrying the news
-        if not hub_term.say_to_task(store, task_id, {'FromName': 'GitHub', 'Channel': 'github',
-                                                     'BodyText': newest}, 'github'):
-            store.update_task(task_id, {'Status': 'open'}, 'github')
+        # a live session gets it typed in - but only a comment from someone GitHub says belongs to
+        # the repo: anyone may comment on a public pull request, and typed text is keystrokes into
+        # an agent with its permission checks off (audit 2026-09-02). Everyone else's lands on the
+        # timeline only. With nobody at the keyboard the task goes back to open either way, so the
+        # timeline row it just grew is not the only thing carrying the news
+        said = typed and hub_term.say_to_task(store, task_id, {'FromName': 'GitHub', 'Channel': 'github', 'BodyText': typed}, 'github')
+        if not said: store.update_task(task_id, {'Status': 'open'}, 'github')
         store.audit('task', task_id, 'pr_comments', 'github', detail={'new': n, 'pr': at.get('number')})
     return n
 

{taskuary-0.3.2.7 → taskuary-0.3.2.9}/taskuary/clis.py

@@ -42,6 +42,27 @@ def tools() -> list:
     return [{**t, 'installed': bool(shutil.which(t['cmd'])), 'path': shutil.which(t['cmd']) or ''} for t in TOOLS]
 
 
+# The classifier is not the coder. When a CLI reads mail as the triage brain (llm.make_cli_llm) the
+# bypass flags come OFF and its tools with them: the message it reads IS the prompt, and a sentence
+# in it saying "run this" must find nothing to run (audit 2026-09-02). Per CLI: (flags to drop,
+# flags to add). Gemini's default approval mode refuses tool calls headlessly, so dropping suffices.
+READONLY = {'claude': (('--dangerously-skip-permissions',), ('--tools', '')),
+            'codex': (('--dangerously-bypass-approvals-and-sandbox', '--full-auto'), ('--sandbox', 'read-only')),
+            'gemini': (('--yolo',), ())}
+
+
+def _base(cmd: str) -> str:
+    import re
+    # both separators on purpose: a Windows path in config.toml is still a claude on a Linux host's CI
+    return re.split(r'[\\/]', str(cmd or ''))[-1].lower().rsplit('.', 1)[0]
+
+
+def readonly_args(cmd: str, args: list) -> list:
+    """`args` with the permission bypass removed and the CLI's own no-tools flags added."""
+    drop, add = READONLY.get(_base(cmd), ((), ()))
+    return [a for a in args if a not in drop] + list(add)
+
+
 def preset_args(cmd: str) -> list:
     """The known CLI's headless flags, for a profile that names a cmd and nothing else. A profile
     saved as just `cmd = "claude"` used to run bare `claude -p`: no permission flag, so a

taskuary-0.3.2.9/taskuary/deps.py

@@ -0,0 +1,80 @@
+"""The optional packages, and the one button that installs them.
+
+Taskuary ships thin. boto3, pyodbc, sqlalchemy, openpyxl, pypdf and the rest are each wanted by
+one card or one file type, and most installs want none of them - so "not installed" is a normal
+thing to meet, not a broken install. What was not normal was the answer. "Run pip install boto3"
+sends the owner off to find a terminal and work out WHICH Python the app is running in: the
+packaged exe has none, a venv is usually not the one on PATH, and an editable checkout is a third
+answer again. The app knows all of that already. So it offers a button.
+
+The list is closed on purpose. This runs pip, and pip runs arbitrary setup code: an open field
+here would be "install anything on this machine" wearing a connector's clothes. That is also why
+POST /api/deps/install is on guard.DENIED - it is the owner's button, never an agent's.
+"""
+import importlib, importlib.util, sys
+
+from loguru import logger
+
+from . import spawn
+
+# import name -> what to ask pip for. The pins follow pyproject's extras. A name that is not here
+# cannot be installed from the UI, and install() says so rather than pretending.
+OPTIONAL = {
+    'boto3': 'boto3>=1.28',                  # the AWS card
+    'pyodbc': 'pyodbc>=4',                   # SQL Server
+    'sqlalchemy': 'sqlalchemy>=2',           # the 'any database' card (plus its engine driver)
+    'psycopg2': 'psycopg2-binary',           # ...Postgres
+    'pymysql': 'pymysql',                    # ...MySQL
+    'openpyxl': 'openpyxl>=3',               # reading .xlsx attachments
+    'pypdf': 'pypdf',                        # reading .pdf into the knowledge base
+    'faster_whisper': 'faster-whisper>=1.0',  # local speech to text
+    'winpty': 'pywinpty',                    # the interactive terminal on Windows
+}
+
+
+class Missing(RuntimeError):
+    """An optional package is not here. Carries the import name, so a card that catches this can
+    offer the button instead of printing a command (channels.test_connector)."""
+    def __init__(self, pkg: str, message: str = ''):
+        self.package = pkg
+        super().__init__(message or f'{pkg} is not installed')
+
+
+def pip_name(pkg: str) -> str:
+    """What the owner should see: 'pywinpty', not 'winpty>=0'."""
+    return str(OPTIONAL.get(pkg) or pkg).split('>')[0].split('=')[0].split('[')[0]
+
+
+def installed(pkg: str) -> bool:
+    try: return importlib.util.find_spec(pkg) is not None
+    except (ImportError, ValueError): return False
+
+
+def can_install() -> tuple:
+    """(may we, why not). A frozen exe has no pip and no site-packages of its own to install into,
+    so a button there would only ever fail - say which install to use instead."""
+    if getattr(sys, 'frozen', False):
+        return False, ('this is the packaged Taskuary.exe, which has no Python to install into - '
+                       'the cards that need an extra package want the pip or source install')
+    return True, ''
+
+
+def install(pkg: str, timeout: int = 900) -> dict:
+    """pip install one of OPTIONAL into the interpreter running Taskuary - which is the whole
+    point: it is the one Python whose site-packages this process will actually import from."""
+    ok, why = can_install()
+    if not ok: raise RuntimeError(why)
+    req = OPTIONAL.get(pkg)
+    if not req:
+        raise ValueError(f'{pkg} is not one of the packages Taskuary installs '
+                         f'({", ".join(sorted(OPTIONAL))})')
+    r = spawn.run([sys.executable, '-m', 'pip', 'install', '--no-input', req],
+                  capture_output=True, text=True, encoding='utf-8', errors='replace', timeout=timeout)
+    out = ((r.stdout or '') + (r.stderr or '')).strip()
+    if r.returncode != 0:
+        raise RuntimeError(f'pip could not install {req}: ' + out[-400:])
+    # a package installed into a RUNNING interpreter is invisible until the finders are told
+    importlib.invalidate_caches()
+    logger.info(f'installed {req} into {sys.executable}')
+    return {'ok': True, 'package': pkg, 'name': pip_name(pkg), 'python': sys.executable,
+            'ready': installed(pkg), 'pip': out[-400:]}

{taskuary-0.3.2.7 → taskuary-0.3.2.9}/taskuary/general.py

@@ -140,6 +140,19 @@ def _cut(text, n):
     return text if len(text) <= n else text[:n] + f'\n[trimmed {len(text) - n:,} characters]'
 
 
+def _task_files(store, tid: int) -> list[dict]:
+    """Files that arrived with the task's source messages, once each, in message order."""
+    detail = store.task_detail(tid) or {}
+    out, seen = [], set()
+    for message in detail.get('messages') or []:
+        for attachment in store.list_attachments(message['MessageId']):
+            path = str(attachment.get('Path') or '').strip()
+            key = path or f"attachment:{attachment.get('AttachmentId')}"
+            if key in seen: continue
+            seen.add(key); out.append(attachment)
+    return out
+
+
 # The chat is on the wall too (blackboard.py). It has no checkout, so it reads and writes the
 # HOUSE lane - the notes with no repository behind them - and it can only write when a CLI is
 # doing the thinking, because an API provider has no shell to run the command in.
@@ -185,7 +198,11 @@ def _prompt(store, tid: int) -> tuple[str, str]:
     sources = []
     for m in (detail.get('messages') or [])[-12:]:
         who = m.get('FromName') or m.get('FromEmail') or m.get('SourceName') or m.get('Channel') or 'source'
-        sources.append(f"FROM {who} ({m.get('SentAt') or ''})\n{_cut(m.get('BodyText'), 3_000)}")
+        files = store.list_attachments(m['MessageId'])
+        file_line = ('\nATTACHMENTS: ' + '; '.join(
+            str(a.get('Name') or 'file') + (f" ({a.get('Path')})" if a.get('Path') else '')
+            for a in files[:8])) if files else ''
+        sources.append(f"FROM {who} ({m.get('SentAt') or ''})\n{_cut(m.get('BodyText'), 3_000)}{file_line}")
     turns = []
     for c in chat_rows(store, tid)[-30:]:
         role = 'ASSISTANT' if c.get('ActorType') == ASSISTANT_TYPE else 'USER'
@@ -209,14 +226,20 @@ def _prompt(store, tid: int) -> tuple[str, str]:
     # about has an answer owed, and closing it drafts that answer. A task the owner opened to
     # think out loud in has nobody waiting, so it stays open until they say otherwise.
     if sources and selfclose.mode(store) != 'off': system = system + '\n\n' + selfclose.CHAT_LINE
-    user = (f"TASK {detail.get('ref') or tid}\nTITLE: {task.get('Title') or ''}\n"
+    head = (f"TASK {detail.get('ref') or tid}\nTITLE: {task.get('Title') or ''}\n"
             f"SUMMARY: {task.get('Summary') or ''}\nSTATUS: {task.get('Status') or ''}\n\n"
             + (wall + '\n\n' if wall else '')
-            + (social.strip() + '\n\n' if social else '')
-            + ("SOURCE MATERIAL\n" + '\n\n'.join(sources) + '\n\n' if sources else '')
-            + "CONVERSATION\n" + '\n\n'.join(turns)
-            + "\n\nRespond to the last USER turn. Do not repeat the task context.")
-    return system, _cut(user, MAX_CONTEXT)
+            + (social.strip() + '\n\n' if social else ''))
+    tail = "\n\nRespond to the last USER turn. Do not repeat the task context."
+    # The question sits at the END, so the end is what must survive the budget: the oldest turns go
+    # first, then the oldest source material. _cut(user) kept the head and dropped exactly the
+    # conversation and the instruction, so a task seeded from eight long mails answered the mails
+    # and not the owner (audit 2026-09-02).
+    while len(turns) > 1 and len(head) + len('\n\n'.join(turns)) + len(tail) > MAX_CONTEXT: turns.pop(0)
+    conv = "CONVERSATION\n" + '\n\n'.join(turns) + tail
+    src, room = '\n\n'.join(sources), MAX_CONTEXT - len(head) - len(conv) - 20
+    if len(src) > room: src = ('[older source material trimmed]\n\n' + src[-room:]) if room > 400 else ''
+    return system, head + (f"SOURCE MATERIAL\n{src}\n\n" if src else '') + conv
 
 
 def _fallback_report_draft(store, tid: int) -> dict:
@@ -460,9 +483,9 @@ class GeneralSession:
                 system = f'{system}\n\n{POST_LINE}'
                 from . import handbook
                 if handbook.enabled(self.store): system = f'{system}\n\n{SOCIAL_LINE}'
-            paths = list(attachments or []) + [m.group('path') for m in _IMAGE_PATH.finditer(text)]
-            if paths and self.pick.startswith('cli:'):
-                user += '\n\nATTACHED FILES (read these when relevant)\n' + '\n'.join(str(Path(p).resolve()) for p in paths)
+            source_paths = [a.get('Path') for a in _task_files(self.store, self.task_id) if a.get('Path')]
+            paths = list(dict.fromkeys(source_paths + list(attachments or [])
+                                       + [m.group('path') for m in _IMAGE_PATH.finditer(text)]))
             def visible(kind, name, detail):
                 self._remember_trace(kind, name, detail)
                 if trace: trace(kind, name, detail)
@@ -480,6 +503,11 @@ class GeneralSession:
                                       trace=visible, cancel=cancel, resume=self.cli_sid or None)
             if not brain: raise RuntimeError('the selected AI connector is unavailable')
             if self.cli_sid: user = _turn_only(self.store, self.task_id, text)
+            # Paths are harmless context to an API brain and essential if its CLI backup takes
+            # over after a quota failure. The source message already names its files too; this
+            # line also carries images attached directly in the composer.
+            if paths:
+                user += '\n\nATTACHED FILES (read these when relevant)\n' + '\n'.join(str(Path(p).resolve()) for p in paths)
             try:
                 reply = str(brain(system, user, max_tokens=MAX_REPLY_TOKENS, images=_images(paths)) or '').strip()
             except Exception:
@@ -493,6 +521,12 @@ class GeneralSession:
                                           trace=visible, cancel=cancel)
                 reply = str(brain(system, user, max_tokens=MAX_REPLY_TOKENS, images=_images(paths)) or '').strip()
             self.cli_sid = getattr(brain, 'session_id', '') or self.cli_sid
+            actual = getattr(brain, 'last_pick', '')
+            if actual and actual != self.pick:
+                choice = next((o for o in provider_options(self.store) if o['pick'] == actual), None)
+                self.pick = actual
+                if choice:
+                    self.provider, self.model = choice['label'], choice.get('model') or ''
             if not reply: raise RuntimeError('the model returned an empty response')
             # the assistant's own "and that's the job done" (selfclose.CHAT_LINE). The marker is a
             # signal to Taskuary, not prose for the owner, so it comes out of what gets filed and

{taskuary-0.3.2.7 → taskuary-0.3.2.9}/taskuary/github.py

@@ -108,7 +108,7 @@ def pr_review_comments(tok, repo, number, since=None):
             for c in r.json():
                 u = (c.get('user') or {})
                 if u.get('type') == 'Bot': continue
-                out.append({'id': c.get('id'), 'kind': kind, 'who': u.get('login'),
+                out.append({'id': c.get('id'), 'kind': kind, 'who': u.get('login'), 'assoc': c.get('author_association') or '',
                             'body': (c.get('body') or '')[:2000], 'path': c.get('path'),
                             'url': c.get('html_url'), 'at': c.get('created_at')})
         except requests.RequestException: