taskuary 0.3.4.2__tar.gz → 0.3.4.4__tar.gz

{taskuary-0.3.4.2/taskuary.egg-info → taskuary-0.3.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taskuary
-Version: 0.3.4.2
+Version: 0.3.4.4
 Summary: Automate your job - the local-first operating system for your work: AI triage in, coding agents out.
 License: MIT
 Project-URL: Homepage, https://github.com/ldbumble/taskuary
@@ -66,7 +66,7 @@ Dynamic: license-file
 # Taskuary
 
 [![CI](https://github.com/ldbumble/taskuary/actions/workflows/ci.yml/badge.svg)](https://github.com/ldbumble/taskuary/actions/workflows/ci.yml)
-[![PyPI](https://img.shields.io/pypi/v/taskuary.svg?cacheSeconds=300&release=0.3.4.2&asof=2026-09-10)](https://pypi.org/project/taskuary/)
+[![PyPI](https://img.shields.io/pypi/v/taskuary.svg?cacheSeconds=300&release=0.3.4.4&asof=2026-09-11)](https://pypi.org/project/taskuary/)
 [![Python 3.10+](https://img.shields.io/badge/python-3.10%2B-3776ab.svg)](https://github.com/ldbumble/taskuary)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
@@ -77,7 +77,7 @@ your agents, and brings decisions back to you. Nothing sends or ships without yo
 
 ![The Taskuary Studio assembling as work arrives and AI agents take their seats.](https://raw.githubusercontent.com/ldbumble/taskuary/master/docs/hero.gif?v=workspace)
 
-Taskuary is early—currently **v0.3.4.2**—so breaking changes are still possible before 1.0.
+Taskuary is early—currently **v0.3.4.4**—so breaking changes are still possible before 1.0.
 
 <p align="center">
   <a href="https://taskuary.com/demo/"><img
@@ -114,6 +114,11 @@ review the work, make the call, and approve what happens next.
 **Agents in your own repos**
 
 Send coding work to Claude Code, Codex, Gemini, Cursor, Copilot, Muse Code, or another CLI.
+Install and sign in under Connections → AI CLI agents. Manage named workers, their CLI settings,
+and their instructions under Docs → Profiles.
+Use **Add profile** to choose a CLI and describe when triage should select it. Leave
+**Available to triage for new tasks** on to include it automatically. Each profile starts with
+editable instructions; coding workers such as Coder and Codex share `CODER.md`.
 
 **Live workspaces**
 

{taskuary-0.3.4.2 → taskuary-0.3.4.4}/README.md

@@ -1,7 +1,7 @@
 # Taskuary
 
 [![CI](https://github.com/ldbumble/taskuary/actions/workflows/ci.yml/badge.svg)](https://github.com/ldbumble/taskuary/actions/workflows/ci.yml)
-[![PyPI](https://img.shields.io/pypi/v/taskuary.svg?cacheSeconds=300&release=0.3.4.2&asof=2026-09-10)](https://pypi.org/project/taskuary/)
+[![PyPI](https://img.shields.io/pypi/v/taskuary.svg?cacheSeconds=300&release=0.3.4.4&asof=2026-09-11)](https://pypi.org/project/taskuary/)
 [![Python 3.10+](https://img.shields.io/badge/python-3.10%2B-3776ab.svg)](https://github.com/ldbumble/taskuary)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
@@ -12,7 +12,7 @@ your agents, and brings decisions back to you. Nothing sends or ships without yo
 
 ![The Taskuary Studio assembling as work arrives and AI agents take their seats.](https://raw.githubusercontent.com/ldbumble/taskuary/master/docs/hero.gif?v=workspace)
 
-Taskuary is early—currently **v0.3.4.2**—so breaking changes are still possible before 1.0.
+Taskuary is early—currently **v0.3.4.4**—so breaking changes are still possible before 1.0.
 
 <p align="center">
   <a href="https://taskuary.com/demo/"><img
@@ -49,6 +49,11 @@ review the work, make the call, and approve what happens next.
 **Agents in your own repos**
 
 Send coding work to Claude Code, Codex, Gemini, Cursor, Copilot, Muse Code, or another CLI.
+Install and sign in under Connections → AI CLI agents. Manage named workers, their CLI settings,
+and their instructions under Docs → Profiles.
+Use **Add profile** to choose a CLI and describe when triage should select it. Leave
+**Available to triage for new tasks** on to include it automatically. Each profile starts with
+editable instructions; coding workers such as Coder and Codex share `CODER.md`.
 
 **Live workspaces**
 

{taskuary-0.3.4.2 → taskuary-0.3.4.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "taskuary"
-version = "0.3.4.2"
+version = "0.3.4.4"
 description = "Automate your job - the local-first operating system for your work: AI triage in, coding agents out."
 readme = "README.md"
 license = { text = "MIT" }

{taskuary-0.3.4.2 → taskuary-0.3.4.4}/taskuary/agents.py

@@ -235,7 +235,8 @@ _SIGNED_OUT = re.compile(r'OAuth session expired|Failed to authenticate|not logg
 _LOGIN_HOW = {'claude': "run `claude` and type `/login`", 'copilot': "run `copilot` and type `/login`",
               'codex': "run `codex login`", 'cursor': "run `cursor-agent login`",
               'gemini': "run `gemini` once and finish Google's sign-in",
-              'muse': "run `muse` once and finish the browser sign-in at dev.meta.ai"}
+              'muse': "run `muse` once and finish the browser sign-in at dev.meta.ai",
+              'devin': "run `devin auth login` and finish the browser sign-in"}
 # Provider/plan exhaustion is different from an agent failing the work. Only this availability
 # class is safe to hand to another configured agent automatically: a compile error should remain
 # with the agent that owns it, while "session limit; resets at 11:50" should not strand the task.
@@ -300,6 +301,55 @@ def rate_limit_msg(name: str, info: dict) -> str:
             f'report or its setup - it will run normally once the allowance resets.{extra}')
 
 
+# A CLI's REASON is on stdout, with its events; stderr is where it says it is getting started.
+# Reading the reason off stderr made "codex exit 1: Reading prompt from stdin..." the whole
+# account of a run that had in fact been told, in JSON on stdout, that the model in
+# ~/.codex/config.toml needed a newer Codex. Thirteen hours of "Agent is working" over a two-second
+# failure nobody could see (the owner, TQ-0496, 2026-09-11).
+_NOISE = re.compile(r'^\s*reading prompt from stdin\.*\s*$', re.I)
+
+
+def _said(msg) -> str:
+    """The sentence inside an error envelope. A provider's 400 reaches the owner through two
+    layers of JSON-as-a-string, and what they need out of it is the one line in English."""
+    text = str(msg or '').strip()
+    for _ in range(3):                                # deep enough for provider-in-CLI-in-event
+        if not text.startswith('{'): break
+        try: j = json.loads(text)
+        except ValueError: break
+        if not isinstance(j, dict): break
+        inner = j.get('error') if isinstance(j.get('error'), dict) else {}
+        nxt = str(inner.get('message') or j.get('message') or '').strip()
+        if not nxt: break
+        text = nxt
+    return text
+
+
+def _event_error(line: str) -> str:
+    """The failure one event line reports, or '' - an ordinary event is not a fault."""
+    try: j = json.loads(line)
+    except ValueError: return ''
+    if not isinstance(j, dict): return ''
+    if j.get('type') in ('error', 'turn.failed'):
+        inner = j.get('error') if isinstance(j.get('error'), dict) else {}
+        return _said(inner.get('message') or j.get('message'))
+    item = j.get('item') if isinstance(j.get('item'), dict) else {}
+    return _said(item.get('message')) if item.get('type') == 'error' else ''
+
+
+def cli_failure(raw, err: str = '') -> str:
+    """Why the run failed: the CLI's own newest error event, else what it put on stderr.
+
+    The newest wins because an earlier one is usually a warning the run carried on past - codex
+    grumbles about unknown model metadata and then fails on the refusal that actually stopped it.
+    """
+    for line in reversed(list(raw or [])):
+        said = _event_error(str(line))
+        if said: return said
+    clean = '\n'.join(ln for ln in str(err or '').splitlines() if ln.strip() and not _NOISE.match(ln))
+    return clean.strip() or '\n'.join(list(raw or [])[-5:]) or 'no output'
+
+
 _DENIED = re.compile(r'access is denied|winerror 5|permission denied|operation not permitted', re.I)
 _NO_HOME = re.compile(r'could not find home directory|finding codex home|HOME.{0,20}not set', re.I)
 
@@ -403,6 +453,45 @@ def seed_profiles(cfg: dict) -> list:
     return added
 
 
+def profile_purpose(name: str, prof: dict, kind: str = 'coding') -> str:
+    return str(prof.get('purpose') or DEFAULT_PROFILES.get(name, {}).get('purpose')
+               or ('writes and changes code, in a repository' if kind == 'coding' else '')).strip()
+
+
+def profile_document(store, name: str, prof: dict = None) -> str:
+    """The job owns the instructions; changing its CLI does not create CODEX.md."""
+    row = store.get_agent(name) or {}
+    if prof is None:
+        try: prof = json.loads(row.get('Config') or '{}')
+        except ValueError: prof = {}
+    explicit = str(prof.get('rules_doc') or '').strip()
+    if explicit and re.fullmatch(r'[a-z0-9][a-z0-9_-]*', explicit): return explicit
+    kind = prof.get('kind') or DEFAULT_PROFILES.get(name, {}).get('kind') or row.get('Kind')
+    return 'coder' if kind == 'coding' else name
+
+
+def profile_template(store, name: str) -> str:
+    """A shipped role, or useful starter instructions for a new named worker."""
+    if not re.fullmatch(r'[a-z0-9][a-z0-9_-]*', name): return ''
+    folder = Path(__file__).parent / 'templates'
+    source = folder / f'{name}.md'
+    if source.is_file(): return source.read_text(encoding='utf-8')
+    row = store.get_agent(name)
+    if not row: return ''
+    try: prof = json.loads(row.get('Config') or '{}')
+    except ValueError: prof = {}
+    purpose = profile_purpose(name, prof, row.get('Kind') or 'coding') or 'Complete the task assigned by the owner.'
+    return (folder / 'profile.md').read_text(encoding='utf-8').replace('PROFILE_NAME', name.upper()).replace('PROFILE_PURPOSE', purpose)
+
+
+def ensure_profile_document(store, name: str) -> str:
+    doc = profile_document(store, name)
+    if not str(store.get_doc(doc) or '').strip():
+        starter = profile_template(store, doc)
+        if starter.strip(): store.save_doc(doc, starter, 'template')
+    return doc
+
+
 def roster(store) -> str:
     """The workers triage may choose between: one line each, name and purpose. Same shape as the
     playbook menu (playbooks.menu) because triage validates the answer against these very lines -
@@ -412,8 +501,8 @@ def roster(store) -> str:
         if not a.get('Active', 1): continue
         try: prof = json.loads(a.get('Config') or '{}')
         except ValueError: prof = {}
-        purpose = str(prof.get('purpose') or DEFAULT_PROFILES.get(a['Name'], {}).get('purpose')
-                      or ('writes and changes code, in a repository' if a.get('Kind') == 'coding' else '')).strip()
+        if prof.get('triage_enabled') is False: continue
+        purpose = profile_purpose(a['Name'], prof, a.get('Kind') or 'coding')
         if purpose: out.append(f"- {a['Name']}: {purpose}")
     return '\n'.join(out)
 
@@ -567,15 +656,19 @@ def run_cli(profile: dict, prompt: str, trace, resume: str = None, cancel=None,
     err_t.join(5)      # the exit code can land before the stderr reader has appended - 'boom' read as 'no output' on a fast CI box
     if p.returncode != 0:
         if cancel is not None and cancel.is_set(): raise RuntimeError('cancelled')
-        why = f'timed out after {profile.get("timeout", 1200)}s' if timed.is_set() else \
-            ((err_buf[0] if err_buf else '') or '\n'.join(raw[-5:]) or 'no output')[:500]
-        limit = rate_limited(raw) or rate_limited(why)
+        err = ''.join(err_buf)
+        said = cli_failure(raw, err)
+        why = (f'timed out after {profile.get("timeout", 1200)}s' if timed.is_set() else said)[:500]
+        # the CLASSIFYING patterns read both streams: a sign-in refusal or a Windows launch
+        # refusal lands on stderr, while the reason the owner reads now comes off stdout
+        hay = f'{said}\n{err}'
+        limit = rate_limited(raw) or rate_limited(hay)
         if limit: raise RuntimeError(rate_limit_msg(name, limit))
-        if _SIGNED_OUT.search(why): raise RuntimeError(signed_out_msg(name, why, cmd[0] if cmd else ''))
+        if _SIGNED_OUT.search(hay): raise RuntimeError(signed_out_msg(name, said, cmd[0] if cmd else ''))
         # a refusal to START, not a failed run: the CLI produced no output of its own and the
         # only thing on stderr is the refusal
-        if _DENIED.search(why) and not raw: raise RuntimeError(denied_msg(name, cmd[0] if cmd else '', why))
-        if _NO_HOME.search(why): raise RuntimeError(no_home_msg(_cli_name(name) or name))
+        if _DENIED.search(hay) and not raw: raise RuntimeError(denied_msg(name, cmd[0] if cmd else '', said))
+        if _NO_HOME.search(hay): raise RuntimeError(no_home_msg(_cli_name(name) or name))
         raise RuntimeError(f'{name} exit {p.returncode}: {why}')
     if final is not None: out, sid = str(final.get('result') or '').strip(), final.get('session_id')
     elif streamed_out: out, sid = streamed_out, streamed_sid

{taskuary-0.3.4.2 → taskuary-0.3.4.4}/taskuary/cliinstall.py

@@ -27,7 +27,7 @@ the rest of the day:
   3. the registry (Windows) or the shell rc file (posix), so a terminal opened tomorrow has it.
 Only (3) is what people mean by "on PATH", and it is the one that helps least today.
 """
-import os, platform, shutil, threading, time
+import os, platform, shutil, subprocess, threading, time
 from pathlib import Path
 
 from loguru import logger
@@ -61,11 +61,24 @@ RECIPES = {
     # plan() then returns [] on Windows and the row draws no Install button over a road that
     # hard-fails. A Windows owner reaches Muse Spark through the `meta` connector instead.
     'muse': [{'how': 'script', 'os': 'posix', 'cmd': ['bash', '-lc', 'curl -fsSL https://dev.meta.ai/install.sh | bash']}],
+    # devin publishes a script per OS and nothing else - no npm package, and its releases are
+    # laid out by the installer's own versioned scheme rather than as triple-named archives, so
+    # `binary` is not a road. Both scripts END BY RUNNING `devin setup`, the CLI's interactive
+    # wizard, which has no terminal to run in when it is spawned from here: the short timeout is
+    # how long we wait for a wizard that may never return, and install() treats a timeout with a
+    # binary on disk as the success it is.
+    'devin': [
+        {'how': 'script', 'os': 'nt', 'timeout': 300,
+         'cmd': ['powershell', '-NoProfile', '-ExecutionPolicy', 'Bypass',
+                 '-Command', 'irm https://static.devin.ai/cli/setup.ps1 | iex']},
+        {'how': 'script', 'os': 'posix', 'timeout': 300,
+         'cmd': ['bash', '-lc', 'curl -fsSL https://cli.devin.ai/install.sh | bash']},
+    ],
 }
 
 # what to look for once an installer says it is done - the bin name, not the profile's nickname
 BINARY = {'claude': 'claude', 'codex': 'codex', 'gemini': 'gemini', 'copilot': 'copilot', 'cursor': 'cursor-agent',
-          'muse': 'muse'}
+          'muse': 'muse', 'devin': 'devin'}
 CMD2NAME = {v: k for k, v in BINARY.items()}       # cursor-agent -> cursor: the bin is not the recipe
 
 
@@ -81,13 +94,75 @@ def recipe_for(cmd: str) -> str:
     return base if base in RECIPES else CMD2NAME.get(base, '')
 
 
-_STATE = {'phase': 'idle', 'name': '', 'detail': '', 'path': '', 'at': 0.0}   # idle|installing|done|failed
+# UPDATING IS NOT INSTALLING AGAIN. A CLI that ships its own updater is the one thing that knows
+# where it put itself - codex keeps its releases under ~/.codex/packages/standalone/<version>
+# behind a junction, and an `npm -g` over that leaves a second copy with the old one still first
+# on PATH. So the vendor's updater first, the package manager only as the fallback.
+#
+# The button exists because a CLI too old for its own configured model fails every single run and
+# says so only in the JSON it writes to stdout: codex 0.148.0 answering "The 'gpt-6-astra' model
+# requires a newer version of Codex" to everything Taskuary asked it (the owner, 2026-09-11).
+# A closed table, for the same reason RECIPES is one: this runs a program on the owner's machine.
+UPDATES = {
+    'claude': [{'how': 'self', 'args': ['update']}, {'how': 'npm', 'pkg': '@anthropic-ai/claude-code@latest'}],
+    'codex': [{'how': 'self', 'args': ['update']}, {'how': 'npm', 'pkg': '@openai/codex@latest'}],
+    'gemini': [{'how': 'npm', 'pkg': '@google/gemini-cli@latest'}],
+    'copilot': [{'how': 'npm', 'pkg': '@github/copilot@latest'}],
+}
+
+_STATE = {'phase': 'idle', 'name': '', 'verb': 'install', 'detail': '', 'path': '', 'at': 0.0}   # idle|installing|done|failed
 _LOCK = threading.Lock()
 
 
 def state() -> dict: return dict(_STATE)
-def reset() -> None: _STATE.update(phase='idle', name='', detail='', path='', at=0.0)
-def _set(phase, name='', detail='', path=''): _STATE.update(phase=phase, name=name, detail=str(detail)[-400:], path=path, at=time.time())
+def reset() -> None: _STATE.update(phase='idle', name='', verb='install', detail='', path='', at=0.0)
+def _set(phase, name='', detail='', path='', verb='install'):
+    _STATE.update(phase=phase, name=name, verb=verb, detail=str(detail)[-400:], path=path, at=time.time())
+
+
+def update_plan(name: str, has_npm: bool = None) -> list:
+    """The update roads that could run here, best first. Pure, like `plan` - `updatable` in the UI
+    is `bool(update_plan(...))`, so a button is never drawn over a road that does not exist."""
+    have_npm = bool(npm()) if has_npm is None else has_npm
+    return [r for r in UPDATES.get(name, ()) if r['how'] != 'npm' or have_npm]
+
+
+def update(name: str) -> dict:
+    """Bring an already-installed CLI up to date. Synchronous - `start_update` is the API's."""
+    roads = update_plan(name)
+    if not roads:
+        _set('failed', name, f'Taskuary has no updater for {name} - reinstall it the way you installed it', verb='update')
+        return state()
+    # An update is not an install: with nothing here there is nothing to bring up to date, and
+    # running a package manager would quietly become an install the owner did not press.
+    exe = find(name)
+    if not exe:
+        _set('failed', name, f'{name} is not on this machine - install it first', verb='update')
+        return state()
+    _set('installing', name, f'updating {name}…', verb='update')
+    last = ''
+    for r in roads:
+        try:
+            cmd = [exe] + list(r['args']) if r['how'] == 'self' else [npm() or 'npm', 'install', '-g', r['pkg']]
+            rc, out = _run(cmd, timeout=r.get('timeout', 900))
+        except Exception as e:
+            last = str(e); logger.warning(f'{name}: {r["how"]} update raised - {e}'); continue
+        if rc != 0:
+            last = out or f'{r["how"]} exited {rc}'; logger.warning(f'{name}: {r["how"]} update failed - {last[-200:]}'); continue
+        _set('done', name, out.strip()[-400:] or f'{name} is up to date', find(name) or exe, verb='update')
+        logger.info(f'updated {name}')
+        return state()
+    _set('failed', name, f'could not update {name}: {last}', verb='update')
+    return state()
+
+
+def start_update(name: str, **kw) -> dict:
+    """Update in the background, for the same reason `start` installs in one."""
+    with _LOCK:
+        if _STATE['phase'] == 'installing': return state()
+        _set('installing', name, f'updating {name}…', verb='update')
+    threading.Thread(target=update, args=(name,), kwargs=kw, daemon=True, name=f'update-{name}').start()
+    return state()
 
 
 def npm() -> str:
@@ -144,7 +219,11 @@ def find(name: str) -> str:
     if found: return found
     home = Path.home()
     roots = [bin_dir(), home / '.local' / 'bin', home / 'bin']
-    if WINDOWS: roots += [Path(os.getenv('APPDATA', '')) / 'npm', home / '.local' / 'bin']
+    # devin's own scheme: %LOCALAPPDATA%\devin\cli\bin on Windows, which its installer puts on the
+    # USER path - a path this long-running process will not see until it is restarted, so looking
+    # there is the difference between "installed" and "the installer said yes and left nothing"
+    if WINDOWS: roots += [Path(os.getenv('APPDATA', '')) / 'npm', home / '.local' / 'bin',
+                          Path(os.getenv('LOCALAPPDATA', '')) / 'devin' / 'cli' / 'bin']
     else: roots += [Path('/usr/local/bin'), Path('/opt/homebrew/bin')]
     for d in roots:
         for ext in ('.exe', '.cmd', '.bat', '') if WINDOWS else ('',):
@@ -259,11 +338,17 @@ def install(name: str, has_npm: bool = None, system: str = None) -> dict:
                 _binary(name, r)
             else:
                 cmd = list(r['cmd']) if r['how'] == 'script' else [npm() or 'npm', 'install', '-g', r['pkg']]
-                rc, out = _run(cmd)
+                rc, out = _run(cmd, timeout=r.get('timeout', 900))
                 if rc != 0: last = out or f'{r["how"]} exited {rc}'; logger.warning(f'{name}: {r["how"]} failed - {last[-200:]}'); continue
                 last = out
         except Exception as e:
-            last = str(e); logger.warning(f'{name}: {r["how"]} raised - {e}'); continue
+            last = str(e); logger.warning(f'{name}: {r["how"]} raised - {e}')
+            # A TIMEOUT IS NOT PROOF OF FAILURE. An installer that ends by starting the CLI's own
+            # interactive wizard (devin's does) never returns when it is spawned with no terminal
+            # - while the binary it wrote a second earlier is installed and runnable. Only a
+            # timeout gets this second look: any other exception left the install where it fell.
+            if not (isinstance(e, subprocess.TimeoutExpired) and find(name)): continue
+            last = 'the installer finished but its setup wizard needed a terminal'
         # rc 0 proves the installer ran, not that anything is runnable: only a binary does that
         found = find(name)
         if found:

{taskuary-0.3.4.2 → taskuary-0.3.4.4}/taskuary/clis.py

@@ -20,8 +20,6 @@ KNOWN = [
      'args': ['exec', '--dangerously-bypass-approvals-and-sandbox'], 'timeout': 1500},
     {'name': 'gemini', 'cmd': 'gemini', 'label': 'Gemini CLI',
      'args': ['-p', '--yolo'], 'timeout': 1500},
-    {'name': 'aider', 'cmd': 'aider', 'label': 'Aider',
-     'args': ['--yes-always', '--no-auto-commits', '--message'], 'timeout': 1500},
     {'name': 'cursor', 'cmd': 'cursor-agent', 'label': 'Cursor CLI',
      'args': ['-p', '--force', '--output-format', 'text'], 'timeout': 1500},
     {'name': 'copilot', 'cmd': 'copilot', 'label': 'GitHub Copilot CLI',
@@ -32,6 +30,16 @@ KNOWN = [
     # the run is read as plain text. POSIX only - see cliinstall.RECIPES.
     {'name': 'muse', 'cmd': 'muse', 'label': 'Meta Muse Code',
      'args': ['exec', '--yolo'], 'timeout': 1500},
+    # Cognition's Devin for Terminal - claude's shape (-p is the headless turn), different
+    # spellings for the two things a headless run cannot do without:
+    #   --permission-mode dangerous  the approval bypass, a MODE here rather than a flag;
+    #   --respect-workspace-trust    --print cannot draw the trust prompt, so in an untrusted
+    #     folder it refuses to start - and half of what this app runs is ~/.taskuary/scratch,
+    #     not a checkout (the same dead end codex's --skip-git-repo-check answers). The `=`
+    #     form on purpose: the value is optional, and a space-separated one is read as a prompt.
+    # No stream-json equivalent, so the Board reads the run as plain text.
+    {'name': 'devin', 'cmd': 'devin', 'label': 'Devin CLI',
+     'args': ['--permission-mode', 'dangerous', '--respect-workspace-trust=false', '-p'], 'timeout': 1500},
 ]
 
 
@@ -61,7 +69,11 @@ READONLY = {'claude': (('--dangerously-skip-permissions',), ('--tools', '')),
             'gemini': (('--yolo',), ()),
             # muse: same reasoning as gemini. --yolo is what turns approval AND the sandbox off, so
             # dropping it puts both back; its default on-request mode has nobody to ask in `exec`.
-            'muse': (('--yolo',), ())}
+            'muse': (('--yolo',), ()),
+            # devin: the bypass is a mode, so it is swapped rather than dropped. `normal` auto-
+            # approves reads inside the folder and asks before every write or shell command -
+            # and headlessly there is nobody to ask, which is exactly the point.
+            'devin': (('--permission-mode', 'dangerous'), ('--permission-mode', 'normal'))}
 
 # A report is allowed to LOOK, but not to act. That is deliberately different from the mail
 # classifier above, which gets no tools at all because the text it classifies is untrusted input.
@@ -83,6 +95,7 @@ REPORT_READ = {
     'codex': READONLY['codex'],
     'gemini': READONLY['gemini'],
     'muse': READONLY['muse'],
+    'devin': READONLY['devin'],
 }
 
 
@@ -164,6 +177,9 @@ def detect(store=None) -> list:
         # `installable`: never draw a button over a road that does not exist
         out.append({**k, 'installed': bool(found), 'path': found or '', 'runs': runs, 'store': blocked,
                     'install': recipe, 'installable': installable, 'configured': k['name'] in have,
+                    # a CLI that IS here can still be too old to run: `updatable` is the Update
+                    # button's own road test, and only a CLI already on this machine has one
+                    'updatable': bool(found and cliinstall.update_plan(recipe)),
                     'why_not': '' if (found or installable) else cliinstall.why_not(recipe),
                     'setup': recipe if recipe in clisetup.SETUP else ''})
     import json, os
@@ -183,6 +199,7 @@ def detect(store=None) -> list:
                     'args': list(prof.get('args') or []), 'installed': bool(found), 'path': found or '',
                     'runs': runs, 'store': blocked, 'install': recipe,
                     'installable': bool(cliinstall.plan(recipe)), 'configured': True,
+                    'updatable': bool(found and cliinstall.update_plan(recipe)),
                     'why_not': '' if (found or cliinstall.plan(recipe)) else cliinstall.why_not(recipe),
                     'setup': recipe if recipe in clisetup.SETUP else ''})
     return out

{taskuary-0.3.4.2 → taskuary-0.3.4.4}/taskuary/clisetup.py

@@ -33,13 +33,17 @@ KIND = aisetup.KIND                   # a set-up is a setup task, and Done alrea
 finish = aisetup.finish               # ...so its ending is aisetup's, unchanged
 
 # The CLIs whose first run Taskuary will open. Closed, and keyed by RECIPE name (cursor, not
-# cursor-agent) so this, cliinstall.RECIPES and clis.detect's `install` field all agree. aider is
-# not here: it takes an API key in a config file and has no interactive setup to walk.
+# cursor-agent) so this, cliinstall.RECIPES and clis.detect's `install` field all agree. A CLI
+# that only takes an API key out of a config file has no first run to open, and does not belong
+# on this tab at all - a key is the connectors' door, not this one (aider, removed 2026-09-11).
 # muse belongs here for the usual reason: its first run opens a browser sign-in against a Meta
 # developer account and mints the CLI's own key, and that is exactly the conversation this pane
 # exists to let the owner have. argv() still refuses it when the binary is absent, which on
 # Windows it always will be.
-SETUP = frozenset({'claude', 'codex', 'gemini', 'copilot', 'cursor', 'muse'})
+# devin belongs here twice over: its installer already tried to run `devin setup` and could not
+# (no terminal), and its sign-in is a browser round trip that falls back to pasting a token back
+# into the CLI - a conversation that needs the pane, not a spawn nobody can see.
+SETUP = frozenset({'claude', 'codex', 'gemini', 'copilot', 'cursor', 'muse', 'devin'})
 
 
 def tag(name: str) -> str: return f'cli:{name}'

{taskuary-0.3.4.2 → taskuary-0.3.4.4}/taskuary/concierge.py

@@ -1562,6 +1562,36 @@ def close_task(store, tid: int, actor: str = 'owner') -> bool:
 # no repository, no checkout, nothing built. Real building is a hand-off the owner asks for by name.
 SETUP_KIND = 'general'
 
+WALK_SORT = ('The owner asked for something to be set up. Decide which of two jobs this is. '
+             'CONFIGURING TASKUARY ITSELF: its AI brain, a connector card, a source it reads, a '
+             'report or workflow, one of its operator documents - anything that has a screen in '
+             'this app. OPERATING ANOTHER SYSTEM on their behalf: signing into a site, driving a '
+             'portal, a tool this app has no card for. Answer with JSON only: {"taskuary": true} '
+             'for the first, {"taskuary": false} for the second.')
+
+
+def walk_is_external(store, text: str, llm=None) -> bool:
+    """Is this walk over the owner's OWN systems rather than over configuring Taskuary?
+
+    The shipped taskuary-setup SKILL is the procedure for configuring this install, and the wrong
+    map for anything else: asked to log into a payroll portal and clock in every morning, a walk
+    carrying it reads out the AI-brain-and-inbound-source checklist instead (the owner, 2026-09-10:
+    "it's supposed to walk me through this?").
+
+    The MODEL reads the intent - there is no word list here - and only a clear "no" moves the walk
+    off the skill. An unsure answer, a brain that is not there, one that returns prose or dies
+    keeps it, because most set-ups really are about this install."""
+    try: brain_ = llm or brain(store, fast=True)
+    except Exception as e:
+        logger.debug(f'the walk sort has no brain - {e}'); return False
+    if not brain_: return False
+    from . import compose
+    try: out = compose._json(brain_(WALK_SORT, str(text or '')[:2_000], max_tokens=60)) or {}
+    except Exception as e:
+        logger.info(f'the walk sort did not answer, so the walk keeps the skill - {str(e)[:200]}'); return False
+    return out.get('taskuary') is False
+
+
 def setup_task(store, text: str, actor: str = 'owner', title: str = '', kind: str = SETUP_KIND,
                agent_job: bool = False) -> dict:
     """'Set up a report that...': a task with the owner's words in it, opened for the agent that can

{taskuary-0.3.4.2 → taskuary-0.3.4.4}/taskuary/funnel.py

@@ -22,6 +22,24 @@ LANES = ('blocked', 'time', 'approve', 'asked', 'queued', 'broken', 'forgotten',
 LANE_WORDS = {'blocked': ('agent waiting', 'you'), 'broken': ('a check failed', 'bad'), 'time': ('coming up', 'working'), 'approve': ('needs your yes', 'you'),
               'asked': ('asked you', 'working'), 'queued': ('waiting to start', 'working'), 'forgotten': ('slipped', 'info'), 'report': ('landed', 'info'), 'fyi': ('fyi', None),
               'working': ('agent working', 'working')}   # visible in band 5 until the agent stops or asks
+# A chat cannot draw an icon, so it wears the emoji the desktop already uses - these ARE the marks in
+# website/src/funnelPile.js (LANE_META/KIND_META), and the two tables must stay in step. A few KINDS
+# outrank their lane: an agent's own finish and a report you set up share the 'report' lane.
+LANE_MARKS = {'blocked': '👋', 'time': '⏱', 'approve': '✉️', 'broken': '🛠', 'asked': '🙋', 'queued': '⏳',
+              'forgotten': '🧵', 'report': '📄', 'fyi': '👀', 'working': '⚙️'}
+KIND_MARKS = {'agentdone': '✅', 'wrapup': '🗂'}
+# ...and where it came from. The desktop paints a brand logo here; a chat gets one emoji per source,
+# and a source we have no mark for gets NONE - an invented glyph says something untrue about it.
+CHANNEL_MARKS = {'email': '📧', 'teams': '👥', 'slack': '💬', 'telegram': '✈️', 'whatsapp': '📱', 'imessage': '📱',
+                 'discord': '🎮', 'github': '🐙', 'gitlab': '🦊', 'jira': '🐞', 'sentry': '🚨', 'pagerduty': '📟',
+                 'report': '📄', 'own': '📝', 'assistant': '✨', 'ai': '✨', 'idea': '💡', 'meeting': '📅',
+                 'promise': '🤝', 'followup': '📨', 'prep': '📅', 'cold': '🥶'}
+
+
+def mark_for(item: dict) -> str:
+    """The one emoji that identifies a row: its kind's when that says more than its lane's."""
+    if not item: return ''
+    return KIND_MARKS.get(str(item.get('kind') or '')) or LANE_MARKS.get(str(item.get('lane') or ''), '')
 SOON_MIN, ALERT_MIN, STARTED_MIN = 120, 15, 5   # calendar visibility window; attention boundary; grace after the start
 SETUP_GRACE_MIN = 15              # a walk-through the owner is still in does not raise its own hand
 LATER_HOURS = 3                   # "not now" - it comes back this much later
@@ -892,15 +910,34 @@ def notify(store, e: dict, by: str = 'assistant'):
     store.set_funnel_state(f"notice:{e['tid']}", 'notice', by, None, json.dumps({k: v for k, v in e.items() if k != 'card'}))
 
 
+def worked_now(store) -> set:
+    """The tasks an agent is on RIGHT NOW - a live session or a running run."""
+    from . import terminal as term
+    try: live = {t.get('taskId') for t in term.live_sessions(tail=0, details=False)}
+    except Exception: live = set()
+    return {t for t in live if t} | {r['TaskId'] for r in store.running_runs() if r.get('TaskId')}
+
+
 def notices(store, states: dict = None) -> list:
-    """The strip's own notices: the watcher's events, in the shape of an alert, until Open or Later."""
+    """The strip's own notices: the watcher's events, in the shape of an alert, until Open or Later.
+
+    A `working` notice is a CLAIM about live state, so it is checked against live state when it is
+    read. The transition that would retire it (working -> done) is seen only by the in-memory watcher,
+    and a restart makes its first look remember instead of announce - so the row outlived its agent by
+    days and every fresh phone walk re-told it (the owner, 2026-09-10: "there are no agents open??").
+    A `done` notice is history and stands until the owner puts it down.
+    """
     states = states if states is not None else store.funnel_states()
-    out = []
+    out, worked = [], None
     for k, st in states.items():
         if not k.startswith('notice:') or st.get('Status') != 'notice' or not st.get('Note'): continue
         try: e = json.loads(st['Note'])
         except ValueError: continue
         working = e.get('kind') == 'working'
+        if working:
+            if worked is None: worked = worked_now(store)
+            if e.get('tid') not in worked or (store.get_task(e.get('tid')) or {}).get('Status') in ('done', 'dropped'):
+                store.clear_funnel_state(k); continue
         out.append({'key': k, 'item': f"{'agent' if working else 'task'}:{e.get('tid')}", 'kind': e.get('kind'), 'lane': 'working' if working else 'report',
                     'text': e.get('text') or '', 'notice': True, 'order_band': 3, 'at': st.get('At'), 'tid': e.get('tid'), 'ref': e.get('ref')})
     return sorted(out, key=lambda a: str(a.get('at') or ''))