synabun 1.3.0 → 2.0.0

package/neural-interface/public/shared/cp/cp-session-model.js

@@ -0,0 +1,338 @@
+// ── A tab's session settings (DOM-free) ──
+// What a Claude Code session can be started or switched with beyond model,
+// effort and permission mode: a fallback model, spend and turn limits, extra
+// directories, local plugins, MCP strictness, standing instructions, the
+// sandbox, thinking, fast mode, the output style, a main-thread agent.
+// The tab keeps one object; every query sends it (`msg.session`), and the
+// bridge validates it again (lib/claude-panel-session.js).
+
+export const SESSION_DEFAULTS = Object.freeze({
+  fastMode: false,
+  thinking: 'default',          // 'default' | 'off'
+  outputStyle: '',
+  agent: '',
+  fallbackModel: '',
+  maxBudgetUsd: 0,
+  maxTurns: 0,
+  additionalDirectories: [],
+  includeParentDir: true,
+  plugins: [],
+  strictMcp: false,
+  systemPromptAppend: '',
+  sandbox: { enabled: false, autoAllowBash: false },
+  hookEvents: true,             // real hook events in the hook strip
+  promptSuggestions: true,      // a suggested next prompt after each turn
+  subagentText: true,           // what a subagent says, inside its card
+  agentSummaries: false,        // model-written progress lines for subagents (costs tokens)
+  // Advanced (a bridge with `session_settings_v2`):
+  allowedTools: [],             // permission rules approved without asking, e.g. Bash(npm test:*)
+  disallowedTools: [],          // tools removed from the session
+  tools: [],                    // the built-in tools on offer (empty = Claude Code's own set)
+  planModeInstructions: '',
+  mcpServers: [],               // [{ name, type: 'http'|'sse', url, alwaysLoad, timeoutMs }] remote servers for this tab
+  synabunAlwaysLoad: false,     // SynaBun's tools always in the prompt, never deferred behind tool search
+  agents: [],                   // [{ name, description, prompt, tools?, model? }] subagents defined for this tab
+  skills: [],                   // the skills the model may see (empty = all)
+  debug: false,                 // a verbose log of the CLI process, in a file
+  overlay: { language: '', autoCompact: 'default', promptCacheTtl: '', advisorModel: '' },
+});
+
+const text = (v, max) => (typeof v === 'string' ? v.trim().slice(0, max) : '');
+
+/** One path per line (or separated by commas), without blanks or duplicates. */
+export function parseList(value, max = 10) {
+  const items = Array.isArray(value) ? value : String(value || '').split(/[\n,]/);
+  return [...new Set(items.map(s => String(s).trim()).filter(Boolean))].slice(0, max);
+}
+
+// ── Advanced fields: text the card edits ⇄ the values the session keeps ──
+
+const MCP_NAME = /^[A-Za-z0-9_-]{1,64}$/;
+const AGENT_NAME = /^[A-Za-z][\w-]{0,63}$/;
+// A built-in tool (Read) or an MCP tool (mcp__server or mcp__server__tool): what the bridge accepts.
+const TOOL_NAME = /^(?:[A-Za-z][\w-]{0,79}|mcp__[\w-]+(?:__[\w-]+)?)$/;
+
+function cleanMcpServer(raw) {
+  if (!raw || typeof raw !== 'object') return null;
+  const name = text(raw.name, 64);
+  if (!MCP_NAME.test(name) || name.toLowerCase() === 'synabun') return null;
+  let url;
+  try { url = new URL(text(raw.url, 2000)); } catch { return null; }
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') return null;
+  const timeout = Number(raw.timeoutMs);
+  return { name, type: raw.type === 'sse' ? 'sse' : 'http', url: url.href, alwaysLoad: raw.alwaysLoad === true, timeoutMs: Number.isFinite(timeout) && timeout >= 1000 && timeout <= 3_600_000 ? Math.floor(timeout) : 0 };
+}
+
+/**
+ * One server per line: `name url [sse] [always] [timeout=60]` (timeout in seconds).
+ * @returns {{ servers: object[], errors: string[] }}
+ */
+export function parseMcpServerLines(value) {
+  const servers = [];
+  const errors = [];
+  const seen = new Set();
+  for (const line of String(value || '').split('\n').map(l => l.trim()).filter(Boolean)) {
+    const [name, url, ...flags] = line.split(/\s+/);
+    const timeout = flags.map(f => /^timeout=(\d+)$/i.exec(f)).find(Boolean);
+    const server = cleanMcpServer({ name, url, type: flags.some(f => /^sse$/i.test(f)) ? 'sse' : 'http', alwaysLoad: flags.some(f => /^always$/i.test(f)), timeoutMs: timeout ? Number(timeout[1]) * 1000 : 0 });
+    if (!server) { errors.push(`"${line.length > 60 ? `${line.slice(0, 59)}…` : line}": use a name (letters, digits, - or _; not SynaBun) and an http(s) URL`); continue; }
+    if (seen.has(server.name.toLowerCase())) { errors.push(`"${server.name}" is listed twice`); continue; }
+    seen.add(server.name.toLowerCase());
+    servers.push(server);
+  }
+  if (servers.length > 8) errors.push('At most 8 servers per tab');
+  return { servers: servers.slice(0, 8), errors };
+}
+
+export function formatMcpServerLines(servers) {
+  return (Array.isArray(servers) ? servers : []).map(cleanMcpServer).filter(Boolean)
+    .map(s => [s.name, s.url, s.type === 'sse' ? 'sse' : '', s.alwaysLoad ? 'always' : '', s.timeoutMs ? `timeout=${Math.round(s.timeoutMs / 1000)}` : ''].filter(Boolean).join(' ')).join('\n');
+}
+
+function cleanAgents(value) {
+  const entries = Array.isArray(value) ? value.map(a => [a?.name, a]) : (value && typeof value === 'object' ? Object.entries(value) : []);
+  const out = [];
+  const problems = [];
+  for (const [rawName, def] of entries) {
+    const name = text(rawName, 64);
+    if (!AGENT_NAME.test(name)) { problems.push(`"${String(rawName).slice(0, 40)}" is not a usable agent name`); continue; }
+    const description = text(def?.description, 500);
+    const prompt = text(def?.prompt, 8000);
+    if (!description || !prompt) { problems.push(`${name} needs a description and a prompt`); continue; }
+    const agent = { name, description, prompt };
+    // No "tools" key: the agent inherits its parent's tools. A list is a
+    // restriction and stays one, an empty list included ("no tools"); entries
+    // that are not tool names are dropped and named, never widened to "inherit".
+    if (Array.isArray(def.tools)) {
+      const given = parseList(def.tools, 40);
+      agent.tools = given.filter(t => TOOL_NAME.test(t));
+      if (agent.tools.length !== given.length) problems.push(`${name}: not tool names, left out: ${given.filter(t => !TOOL_NAME.test(t)).join(', ').slice(0, 120)}`);
+    } else if (def.tools !== undefined && def.tools !== null) {
+      problems.push(`${name}: "tools" must be a list ([] for no tools); leave it out to inherit`);
+      continue;
+    }
+    if (text(def.model, 120)) agent.model = text(def.model, 120);
+    out.push(agent);
+  }
+  if (out.length > 10) problems.push('At most 10 agents per tab');
+  return { agents: out.slice(0, 10), problems };
+}
+
+/**
+ * The card's JSON: { "name": { "description", "prompt", "tools"?, "model"? } }.
+ * @returns {{ agents: object[], error: string }}
+ */
+export function parseAgentsJson(value) {
+  const src = String(value || '').trim();
+  if (!src) return { agents: [], error: '' };
+  let parsed;
+  try { parsed = JSON.parse(src); } catch (err) { return { agents: [], error: `Not valid JSON: ${err.message}` }; }
+  if (!parsed || typeof parsed !== 'object') return { agents: [], error: 'Expected an object: { "name": { "description": …, "prompt": … } }' };
+  const { agents, problems } = cleanAgents(parsed);
+  return { agents, error: problems.join('; ') };
+}
+
+export function formatAgentsJson(agents) {
+  const list = cleanAgents(agents).agents;
+  if (!list.length) return '';
+  return JSON.stringify(Object.fromEntries(list.map(({ name, ...def }) => [name, def])), null, 2);
+}
+
+function cleanOverlay(raw) {
+  const r = raw && typeof raw === 'object' ? raw : {};
+  return {
+    language: text(r.language, 40),
+    autoCompact: r.autoCompact === 'on' || r.autoCompact === 'off' ? r.autoCompact : 'default',
+    promptCacheTtl: r.promptCacheTtl === '5m' || r.promptCacheTtl === '1h' ? r.promptCacheTtl : '',
+    advisorModel: text(r.advisorModel, 120),
+  };
+}
+
+export function normalizeSession(raw) {
+  const r = raw && typeof raw === 'object' ? raw : {};
+  const budget = Number(r.maxBudgetUsd);
+  const turns = Number(r.maxTurns);
+  return {
+    fastMode: r.fastMode === true,
+    thinking: r.thinking === 'off' ? 'off' : 'default',
+    outputStyle: text(r.outputStyle, 120),
+    agent: text(r.agent, 120),
+    fallbackModel: text(r.fallbackModel, 120),
+    maxBudgetUsd: Number.isFinite(budget) && budget > 0 ? Math.min(budget, 10_000) : 0,
+    maxTurns: Number.isInteger(turns) && turns >= 1 ? Math.min(turns, 1000) : 0,
+    additionalDirectories: parseList(r.additionalDirectories),
+    includeParentDir: r.includeParentDir !== false,
+    plugins: parseList(r.plugins),
+    strictMcp: r.strictMcp === true,
+    systemPromptAppend: text(r.systemPromptAppend, 8000),
+    sandbox: { enabled: r.sandbox?.enabled === true, autoAllowBash: r.sandbox?.enabled === true && r.sandbox?.autoAllowBash === true },
+    hookEvents: r.hookEvents !== false,
+    promptSuggestions: r.promptSuggestions !== false,
+    subagentText: r.subagentText !== false,
+    agentSummaries: r.agentSummaries === true,
+    allowedTools: parseList(r.allowedTools, 40),
+    disallowedTools: parseList(r.disallowedTools, 40),
+    tools: parseList(r.tools, 60),
+    planModeInstructions: text(r.planModeInstructions, 4000),
+    mcpServers: (Array.isArray(r.mcpServers) ? r.mcpServers : []).map(cleanMcpServer).filter(Boolean).slice(0, 8),
+    synabunAlwaysLoad: r.synabunAlwaysLoad === true,
+    agents: cleanAgents(r.agents).agents,
+    skills: parseList(r.skills, 60),
+    debug: r.debug === true,
+    overlay: cleanOverlay(r.overlay),
+  };
+}
+
+// Settings that are fixed when the CLI process starts: changing one restarts
+// the session (with resume) at the next message.
+const START_KEYS = {
+  thinking: 'thinking',
+  fallbackModel: 'fallback model',
+  maxBudgetUsd: 'spend limit',
+  maxTurns: 'turn limit',
+  additionalDirectories: 'directories',
+  includeParentDir: 'parent directory access',
+  plugins: 'plugins',
+  strictMcp: 'MCP servers',
+  systemPromptAppend: 'instructions',
+  sandbox: 'sandbox',
+  hookEvents: 'hook events',
+  promptSuggestions: 'prompt suggestions',
+  subagentText: 'subagent text',
+  agentSummaries: 'agent progress summaries',
+  allowedTools: 'auto-approved tools',
+  disallowedTools: 'removed tools',
+  tools: 'tool list',
+  planModeInstructions: 'plan-mode instructions',
+  mcpServers: 'MCP servers',
+  synabunAlwaysLoad: 'MCP servers',
+  agents: 'custom agents',
+  skills: 'skills',
+  debug: 'debug log',
+};
+
+/** The start-level settings that differ between two session objects, as words. */
+export function changedStartSettings(before, after) {
+  const a = normalizeSession(before);
+  const b = normalizeSession(after);
+  return [...new Set(Object.entries(START_KEYS).filter(([k]) => JSON.stringify(a[k]) !== JSON.stringify(b[k])).map(([, label]) => label))];
+}
+
+/** Short words for the statusline: what is switched on for this tab. */
+export function sessionFlags(session, { toolPolicy = 'full', fastModeState = '', account = '' } = {}) {
+  const s = normalizeSession(session);
+  const flags = [];
+  if (account && account !== 'default') flags.push(`account ${account}`);
+  if (s.fastMode) flags.push(fastModeState === 'cooldown' ? 'fast (cooldown)' : 'fast');
+  if (s.thinking === 'off') flags.push('no thinking');
+  if (s.sandbox.enabled) flags.push('sandbox');
+  if (toolPolicy && toolPolicy !== 'full') flags.push(toolPolicy);
+  if (s.strictMcp) flags.push('SynaBun MCP only');
+  if (s.agent) flags.push(`agent ${s.agent}`);
+  if (s.maxBudgetUsd > 0) flags.push(`$${s.maxBudgetUsd} cap`);
+  return flags;
+}
+
+/** Rows for /status and for the note after a change: [label, value]. */
+export function sessionRows(session) {
+  const s = normalizeSession(session);
+  const rows = [];
+  if (s.fastMode) rows.push(['Fast mode', 'on']);
+  if (s.thinking === 'off') rows.push(['Thinking', 'off']);
+  if (s.outputStyle) rows.push(['Output style', s.outputStyle]);
+  if (s.agent) rows.push(['Agent', s.agent]);
+  if (s.fallbackModel) rows.push(['Fallback model', s.fallbackModel]);
+  if (s.maxBudgetUsd > 0) rows.push(['Spend limit', `$${s.maxBudgetUsd}`]);
+  if (s.maxTurns > 0) rows.push(['Turn limit', String(s.maxTurns)]);
+  const dirs = [...s.additionalDirectories];
+  rows.push(['Directories', `${s.includeParentDir ? 'the project folder and its parent' : 'the project folder only'}${dirs.length ? `, plus ${dirs.join(', ')}` : ''}`]);
+  if (s.plugins.length) rows.push(['Plugin directories', s.plugins.join(', ')]);
+  if (s.strictMcp) rows.push(['MCP servers', 'SynaBun only']);
+  if (s.systemPromptAppend) rows.push(['Instructions', s.systemPromptAppend.length > 80 ? `${s.systemPromptAppend.slice(0, 79)}…` : s.systemPromptAppend]);
+  if (s.sandbox.enabled) rows.push(['Sandbox', s.sandbox.autoAllowBash ? 'on, sandboxed commands run without asking' : 'on']);
+  const off = [!s.hookEvents && 'hook events', !s.promptSuggestions && 'prompt suggestions', !s.subagentText && 'subagent text'].filter(Boolean);
+  if (off.length) rows.push(['Switched off', off.join(', ')]);
+  if (s.agentSummaries) rows.push(['Agent progress summaries', 'on']);
+  if (s.allowedTools.length) rows.push(['Approved without asking', s.allowedTools.join(', ')]);
+  if (s.disallowedTools.length) rows.push(['Removed tools', s.disallowedTools.join(', ')]);
+  if (s.tools.length) rows.push(['Built-in tools', `only ${s.tools.join(', ')}`]);
+  if (s.planModeInstructions) rows.push(['Plan-mode instructions', s.planModeInstructions.length > 80 ? `${s.planModeInstructions.slice(0, 79)}…` : s.planModeInstructions]);
+  if (s.mcpServers.length) rows.push(['MCP servers of this tab', s.mcpServers.map(m => `${m.name} (${m.url})`).join(', ')]);
+  if (s.synabunAlwaysLoad) rows.push(["SynaBun's tools", 'always loaded']);
+  if (s.agents.length) rows.push(['Custom agents', s.agents.map(a => a.name).join(', ')]);
+  if (s.skills.length) rows.push(['Skills', `only ${s.skills.join(', ')}`]);
+  const overlay = [s.overlay.language && `language ${s.overlay.language}`, s.overlay.autoCompact !== 'default' && `auto-compact ${s.overlay.autoCompact}`, s.overlay.promptCacheTtl && `prompt cache ${s.overlay.promptCacheTtl}`, s.overlay.advisorModel && `advisor ${s.overlay.advisorModel}`].filter(Boolean);
+  if (overlay.length) rows.push(['Settings for this tab', overlay.join(', ')]);
+  if (s.debug) rows.push(['Debug log', 'on']);
+  return rows;
+}
+
+/** Whether the model in use supports fast mode, from the session's model list. */
+export function fastModeSupported(models, modelId) {
+  const list = Array.isArray(models) ? models : [];
+  const id = String(modelId || '').toLowerCase();
+  const exact = id ? list.find(m => String(m?.value || m?.id || '').toLowerCase() === id) : null;
+  if (exact) return exact.supportsFastMode === true;
+  return list.some(m => m?.supportsFastMode === true);
+}
+
+/**
+ * The picker's catalog (from the server's discovery) brought in line with what
+ * a running session reported: a model the session can run and the catalog does
+ * not list is added, and the capability flags of the ones both know come from
+ * the session. Nothing is removed: another tab's session may differ.
+ * @returns {{ models: object[], changed: boolean }}
+ */
+export function mergeSessionModels(catalog, sessionModels) {
+  const base = Array.isArray(catalog) ? catalog : [];
+  const session = (Array.isArray(sessionModels) ? sessionModels : []).filter(m => m && typeof m.value === 'string' && m.value);
+  if (!session.length) return { models: base, changed: false };
+  const byId = new Map(session.map(m => [m.value.toLowerCase(), m]));
+  let changed = false;
+  const models = base.map((row) => {
+    const live = byId.get(String(row?.id || '').toLowerCase());
+    if (!live) return row;
+    const flags = {
+      supportsAutoMode: live.supportsAutoMode === true,
+      supportsFastMode: live.supportsFastMode === true,
+      supportsAdaptiveThinking: live.supportsAdaptiveThinking === true,
+    };
+    if (Object.entries(flags).every(([k, v]) => (row[k] === true) === v)) return row;
+    changed = true;
+    return { ...row, ...flags };
+  });
+  const known = new Set(base.map(r => String(r?.id || '').toLowerCase()));
+  for (const m of session) {
+    if (known.has(m.value.toLowerCase())) continue;
+    changed = true;
+    const effortLevels = Array.isArray(m.supportedEffortLevels) ? m.supportedEffortLevels.map(String).filter(Boolean) : [];
+    models.push({
+      id: m.value,
+      label: String(m.displayName || m.value),
+      desc: String(m.description || '').slice(0, 80),
+      description: String(m.description || ''),
+      resolvedModel: String(m.resolvedModel || ''),
+      contextWindow: /\[1m\]/i.test(m.value) ? 1_000_000 : 200_000,
+      effortLevels,
+      supportsEffort: m.supportsEffort === true && effortLevels.length > 0,
+      supportsFastMode: m.supportsFastMode === true,
+      supportsAutoMode: m.supportsAutoMode === true,
+      supportsAdaptiveThinking: m.supportsAdaptiveThinking === true,
+      cliReady: true,
+      fromSession: true,
+    });
+  }
+  return { models, changed };
+}
+
+const FAST_REASONS = {
+  free: 'not available on this plan',
+  preference: 'turned off in the settings',
+  extra_usage_disabled: 'extra usage is off',
+  network_error: 'could not be checked (network)',
+  sdk_opt_in_required: 'needs an opt-in for SDK sessions',
+  unknown: 'unavailable',
+};
+export function fastModeReason(reason) {
+  return reason ? (FAST_REASONS[reason] || String(reason).replace(/_/g, ' ')) : '';
+}

package/neural-interface/public/shared/cp/cp-session-settings.js

@@ -0,0 +1,254 @@
+// ── Session settings card (DOM glue over cp-session-model.js) ──
+// One card for everything a tab's session can be started or switched with.
+// Opened by /session; the quick commands (/fast, /add-dir, …) change single
+// fields of the same object.
+
+import { cpCtx } from './cp-ctx.js';
+import { normalizeSession, parseList, parseMcpServerLines, formatMcpServerLines, parseAgentsJson, formatAgentsJson } from './cp-session-model.js';
+
+function field(labelText, control, hint = '') {
+  const row = document.createElement('label');
+  row.className = 'cp-elicit-field cp-session-field';
+  const label = document.createElement('span');
+  label.className = 'cp-elicit-label';
+  label.textContent = labelText;
+  row.append(label, control);
+  if (hint) {
+    const h = document.createElement('span');
+    h.className = 'cp-elicit-hint';
+    h.textContent = hint;
+    row.appendChild(h);
+  }
+  return row;
+}
+
+function select(options, value) {
+  const el = document.createElement('select');
+  el.className = 'cp-elicit-input';
+  for (const [v, label] of options) {
+    const opt = document.createElement('option');
+    opt.value = v;
+    opt.textContent = label;
+    el.appendChild(opt);
+  }
+  // A stored value the session does not list (yet) stays selectable.
+  if (value && !options.some(([v]) => v === value)) {
+    const opt = document.createElement('option');
+    opt.value = value;
+    opt.textContent = value;
+    el.appendChild(opt);
+  }
+  el.value = value || '';
+  return el;
+}
+
+function input(type, value, placeholder = '') {
+  const el = document.createElement('input');
+  el.type = type;
+  el.className = 'cp-elicit-input';
+  el.value = value == null || value === 0 ? '' : String(value);
+  if (placeholder) el.placeholder = placeholder;
+  return el;
+}
+
+function checkbox(checked) {
+  const el = document.createElement('input');
+  el.type = 'checkbox';
+  el.checked = !!checked;
+  return el;
+}
+
+function area(value, placeholder, rows = 2) {
+  const el = document.createElement('textarea');
+  el.className = 'cp-elicit-input';
+  el.rows = rows;
+  el.value = value || '';
+  el.placeholder = placeholder;
+  return el;
+}
+
+/**
+ * @param o.session       the tab's current session settings
+ * @param o.models        [{value, displayName}] the session reported (may be empty before the first turn)
+ * @param o.agents        [{name, description}]
+ * @param o.outputStyles  string[]
+ * @param o.fastSupported whether the model in use supports fast mode
+ * @param o.advanced      the bridge reads the advanced fields (tools, MCP servers, agents, skills, overlay, debug)
+ * @param o.onSave        (session) => void
+ */
+export function renderSessionSettingsCard(tab, o = {}) {
+  const $msgs = tab.messagesEl;
+  if (!$msgs) return null;
+  $msgs.querySelectorAll('.cp-session-card.active-perm').forEach(n => n.remove());
+  const s = normalizeSession(o.session);
+
+  const el = document.createElement('div');
+  el.className = 'msg msg-info-card cp-session-card active-perm';
+  const body = document.createElement('div');
+  body.className = 'cp-info-body';
+  const title = document.createElement('div');
+  title.className = 'cp-info-title';
+  title.textContent = 'Session settings for this tab';
+  body.appendChild(title);
+  const form = document.createElement('div');
+  form.className = 'cp-elicit-form';
+
+  const fast = checkbox(s.fastMode);
+  fast.disabled = !o.fastSupported && !s.fastMode;
+  const thinking = select([['default', 'Model default'], ['off', 'Off']], s.thinking);
+  const style = (o.outputStyles || []).length
+    ? select([['', 'Default'], ...o.outputStyles.filter(n => n && n !== 'default').map(n => [n, n])], s.outputStyle)
+    : input('text', s.outputStyle, 'Default');
+  const agent = (o.agents || []).length
+    ? select([['', 'None'], ...o.agents.map(a => [a.name, a.description ? `${a.name}: ${String(a.description).slice(0, 60)}` : a.name])], s.agent)
+    : input('text', s.agent, 'None');
+  const fallback = (o.models || []).length
+    ? select([['', 'None'], ...o.models.map(m => [m.value, m.displayName || m.value])], s.fallbackModel)
+    : input('text', s.fallbackModel, 'None');
+  const budget = input('number', s.maxBudgetUsd, 'No limit');
+  const turns = input('number', s.maxTurns, 'No limit');
+  const dirs = area(s.additionalDirectories.join('\n'), 'One path per line');
+  const parent = checkbox(s.includeParentDir);
+  const plugins = area(s.plugins.join('\n'), 'One plugin directory per line');
+  const strict = checkbox(s.strictMcp);
+  const append = area(s.systemPromptAppend, 'Standing instructions for this tab', 3);
+  const sandbox = checkbox(s.sandbox.enabled);
+  const sandboxAuto = checkbox(s.sandbox.autoAllowBash);
+  const suggestions = checkbox(s.promptSuggestions);
+  const hookEvents = checkbox(s.hookEvents);
+  const subagentText = checkbox(s.subagentText);
+  const summaries = checkbox(s.agentSummaries);
+
+  form.append(
+    field('Fast mode', fast, o.fastSupported ? 'Faster output at a higher price, on models that support it.' : 'The model in use does not report fast mode support.'),
+    field('Thinking', thinking, 'Off starts the session without extended thinking.'),
+    field('Output style', style),
+    field('Run as agent', agent, "The main conversation uses the agent's prompt, tools and model."),
+    field('Fallback model', fallback, 'Used when the main model is overloaded or unavailable.'),
+    field('Spend limit (USD)', budget, 'The turn stops when this session has spent this much since it started.'),
+    field('Turn limit', turns, 'The most model round-trips one message may take.'),
+    field('Extra directories', dirs, 'Readable and writable without a prompt, besides the project folder.'),
+    field('Also allow the parent of the project folder', parent, 'On by default, so sibling projects can be read.'),
+    field('Plugin directories', plugins, 'Local plugins loaded for this tab only. Plugins run code and hooks.'),
+    field("Only SynaBun's MCP server", strict, 'Ignore the MCP servers from settings and .mcp.json for this tab.'),
+    field('Instructions', append, 'Appended to the system prompt when a session starts; a resumed session keeps what it started with until it compacts.'),
+    field('Sandbox commands', sandbox, 'Bash runs isolated. Depends on the platform; a missing dependency ends the turn with an error.'),
+    field('Run sandboxed commands without asking', sandboxAuto),
+    field('Suggest the next prompt', suggestions, 'After each turn, one suggestion above the input (Tab accepts). Nearly free: it reuses the prompt cache.'),
+    field('Show real hook events', hookEvents, 'The hook strip (Ctrl+Shift+H) lists the hooks that ran, with their outcome.'),
+    field('Show what subagents say', subagentText, "A subagent's own text and thinking inside its card."),
+    field('Agent progress summaries', summaries, 'A model-written line about what each subagent is doing, about every 30 s. Costs tokens.'),
+  );
+  body.appendChild(form);
+
+  // Advanced: shown only when the connected server reads these fields. Values a
+  // tab already has are kept either way (the save starts from the session).
+  const adv = {};
+  if (o.advanced) {
+    adv.allowed = area(s.allowedTools.join('\n'), 'One rule per line, e.g. Bash(npm test:*)');
+    adv.disallowed = area(s.disallowedTools.join('\n'), 'One tool or rule per line, e.g. WebFetch');
+    adv.tools = area(s.tools.join('\n'), 'Empty: every built-in tool');
+    adv.planInstructions = area(s.planModeInstructions, 'What plan mode should do differently', 2);
+    adv.mcp = area(formatMcpServerLines(s.mcpServers), 'name https://host/mcp [sse] [always] [timeout=60]');
+    adv.synabunAlways = checkbox(s.synabunAlwaysLoad);
+    adv.agents = area(formatAgentsJson(s.agents), '{ "reviewer": { "description": "…", "prompt": "…", "tools": ["Read"], "model": "haiku" } }', 4);
+    adv.skills = area(s.skills.join('\n'), 'Empty: every skill');
+    adv.language = input('text', s.overlay.language, 'From your settings');
+    adv.autoCompact = select([['default', 'From your settings'], ['on', 'On'], ['off', 'Off']], s.overlay.autoCompact);
+    adv.cacheTtl = select([['', 'From your settings'], ['5m', '5 minutes'], ['1h', '1 hour']], s.overlay.promptCacheTtl);
+    adv.advisor = input('text', s.overlay.advisorModel, 'From your settings');
+    adv.debug = checkbox(s.debug);
+    const details = document.createElement('details');
+    details.className = 'cp-tool-group cp-session-advanced';
+    const summary = document.createElement('summary');
+    summary.textContent = 'Advanced: tools, MCP servers, agents, skills, settings overrides';
+    const advForm = document.createElement('div');
+    advForm.className = 'cp-elicit-form';
+    advForm.append(
+      field('Approve without asking', adv.allowed, 'Permission rules that never prompt in this tab.'),
+      field('Remove tools', adv.disallowed, 'Added to what the tool policy (/tools) already removes.'),
+      field('Only these built-in tools', adv.tools, 'Tool names, one per line. MCP tools are not affected.'),
+      field('Plan-mode instructions', adv.planInstructions, 'Replaces the standard plan workflow text while plan mode is on.'),
+      field('MCP servers for this tab', adv.mcp, 'Remote servers only (http or sse). A server that needs a command line or a token belongs in your Claude Code settings.'),
+      field("Always load SynaBun's tools", adv.synabunAlways, 'Every SynaBun tool stays in the prompt instead of being found through tool search. Uses more context.'),
+      field('Custom agents (JSON)', adv.agents, 'Subagents only this tab has: a description, a prompt, optionally tools and a model.'),
+      field('Skills', adv.skills, 'Only these skills are offered to the model.'),
+      field('Reply language', adv.language),
+      field('Auto-compact', adv.autoCompact),
+      field('Prompt cache lifetime', adv.cacheTtl, '1 hour costs more to write and survives longer pauses.'),
+      field('Advisor model', adv.advisor),
+      field('Debug log', adv.debug, 'A verbose log of the Claude Code process, written to a file on the server.'),
+    );
+    details.append(summary, advForm);
+    body.appendChild(details);
+  }
+  const problems = document.createElement('div');
+  problems.className = 'cp-elicit-error';
+  problems.hidden = true;
+  body.appendChild(problems);
+
+  const actions = document.createElement('div');
+  actions.className = 'perm-actions';
+  const save = document.createElement('button');
+  save.className = 'perm-btn perm-btn-allow';
+  save.textContent = 'Save';
+  const cancel = document.createElement('button');
+  cancel.className = 'perm-btn perm-btn-deny';
+  cancel.textContent = 'Close';
+  const close = () => {
+    el.classList.remove('active-perm');
+    el.querySelectorAll('button, input, select, textarea').forEach(n => { n.disabled = true; });
+  };
+  save.addEventListener('click', () => {
+    let advanced = {};
+    if (o.advanced) {
+      const mcp = parseMcpServerLines(adv.mcp.value);
+      const agentDefs = parseAgentsJson(adv.agents.value);
+      const errors = [...mcp.errors.map(e => `MCP servers: ${e}`), ...(agentDefs.error ? [`Custom agents: ${agentDefs.error}`] : [])];
+      // Nothing is saved while a field cannot be read: a half-applied list would be a surprise.
+      if (errors.length) { problems.textContent = errors.join('\n'); problems.hidden = false; return; }
+      advanced = {
+        allowedTools: parseList(adv.allowed.value, 40),
+        disallowedTools: parseList(adv.disallowed.value, 40),
+        tools: parseList(adv.tools.value, 60),
+        planModeInstructions: adv.planInstructions.value,
+        mcpServers: mcp.servers,
+        synabunAlwaysLoad: adv.synabunAlways.checked,
+        agents: agentDefs.agents,
+        skills: parseList(adv.skills.value, 60),
+        debug: adv.debug.checked,
+        overlay: { language: adv.language.value, autoCompact: adv.autoCompact.value, promptCacheTtl: adv.cacheTtl.value, advisorModel: adv.advisor.value },
+      };
+    }
+    const next = normalizeSession({
+      ...s,
+      ...advanced,
+      fastMode: fast.checked,
+      thinking: thinking.value,
+      outputStyle: style.value,
+      agent: agent.value,
+      fallbackModel: fallback.value,
+      maxBudgetUsd: Number(budget.value) || 0,
+      maxTurns: Math.floor(Number(turns.value)) || 0,
+      additionalDirectories: parseList(dirs.value),
+      includeParentDir: parent.checked,
+      plugins: parseList(plugins.value),
+      strictMcp: strict.checked,
+      systemPromptAppend: append.value,
+      sandbox: { enabled: sandbox.checked, autoAllowBash: sandboxAuto.checked },
+      promptSuggestions: suggestions.checked,
+      hookEvents: hookEvents.checked,
+      subagentText: subagentText.checked,
+      agentSummaries: summaries.checked,
+    });
+    close();
+    o.onSave?.(next);
+  });
+  cancel.addEventListener('click', close);
+  actions.append(save, cancel);
+  body.appendChild(actions);
+  el.appendChild(body);
+  $msgs.appendChild(el);
+  if (tab === cpCtx.activeTab()) cpCtx.scrollEnd();
+  return el;
+}