synabun 2.0.0 → 2.0.7

package/CHANGELOG.md

@@ -1,3 +1,100 @@
+# SynaBun v.2.0.7
+
+2.0.7 brings the SynaBun desktop app for macOS, Windows and Linux, with updates that install themselves and a Windows installer that shows every step. SynaBun now finds every installed Claude Code, Codex and OpenCode the same way and installs a missing one with one click, you can sign in from the Claude and Codex panels, and the WhatsApp Assistant can send you files and understand voice notes.
+
+## ✨ New
+
+- **SynaBun desktop app** — The installers are now a real desktop app: SynaBun opens in its own window on macOS (Apple Silicon and Intel), Windows x64 and Linux x64, around the same server, runtime and interface as before. The window has SynaBun's own title bar instead of the system's: the window buttons sit at its right end on Windows and Linux, where a button at the left opens the menu, and the traffic lights sit inside it on macOS. Closing the window keeps SynaBun running; the app menu, the Dock or the tray bring it back. npm and Git installs are unchanged.
+- **Updates that install themselves** — The desktop app checks the public releases shortly after it starts and every few hours. A newer version downloads at once. When SynaBun is idle, a one-minute notice with **Later** counts down, then the update installs, the window reopens as it was and a notice says what it updated to. While work is running it waits, and it also installs when you quit or at the next start. **Install now** is in the update dialog and the menus. If an update fails, the version you have keeps running, you get a link to download the new one yourself, and it tries again later.
+- **A Windows installer that shows every step** — The installer lists each step as it goes, with the seconds since it started: the check for a running SynaBun, the unpacking with its progress, each part as it is put in place, the shortcuts and the **Settings → Apps** entry. The uninstaller lists its steps too, and the whole list is saved to a log you can open from the last page. If SynaBun is running, the installer asks once and closes it for you, letting the server shut down cleanly first; it never touches a SynaBun installed with npm or Git. Installing is faster: the files are unpacked straight into place, and the app carries about 6,600 fewer files. An install counts as finished only when every file is in place, and an update that cannot finish leaves the version you have running. Updates from the app stay silent.
+- **See what the desktop app is doing while it starts** — **Details** on the start screen shows a live log of the start: the checks, the browser download with its progress, the build and the server's first lines. It opens by itself on the first start and when something fails, and keeps the real error. In the setup wizard, **Details** under Environment Check and Install & Build show the commands that ran with their answers, and what the app came with.
+- **npm and npx come with the desktop app** — They work even when your computer has no Node.js. Your own npm and tools always come first; the bundled ones are only a fallback, and their global installs go to a folder in SynaBun's data folder instead of into the app, unless you set an npm prefix of your own.
+- **Git Bash for Claude Code on Windows** — On a Windows PC without Git for Windows, Claude Code ran its hooks in PowerShell, where SynaBun's hooks do not work. SynaBun now brings its own unchanged copy of Git for Windows and uses it only when your PC has none: the Windows installer carries it, and an npm install on Windows downloads it once and checks it against a pinned checksum before unpacking it. A Git you installed yourself always wins, and **Settings → AI connections → Executable paths** shows which one Claude Code gets.
+- **Settings → About** — A new last page in Settings shows your version and how SynaBun is installed, with **Check for updates** and **Copy info** (version, install type, Node.js, SQLite, the desktop app's Electron and Chromium, your system and the dependency versions; no paths, ports, keys or settings). It also has the project's links, system details and every dependency with its version and license.
+- **SynaBun finds your Claude Code, Codex and OpenCode** — The side panels, Settings and every launcher find each CLI the same way: the path you set in Settings first, then your PATH as a new terminal sees it, then the folders the official installers use. A CLI that is found but does not start shows its real error instead of "not installed".
+- **One-click install of a missing CLI** — When Claude Code, Codex or OpenCode is not installed, its panel shows a banner with **Install**, which runs the vendor's official installer for your system and shows its progress, next to the manual command and the install guide. The OpenCode panel gets this banner too. **Add to PATH** makes an installed CLI available to new terminals.
+- **Sign in from the Claude and Codex panels** — `/login` and the new account button open a sign-in card that drives each CLI's own sign-in: open the sign-in page, finish in your browser, and the panel shows who is signed in. Codex also offers a device code. Tokens stay with Claude Code and Codex, SynaBun stores none, and sign-in cards are never saved into stored chats.
+- **Auto · most usage left** — Claude Code and Codex routes and the composer's model menu can pick the subscription account with the most usage left. Usage windows show beside each account, and an exhausted account falls back to another one of the same provider.
+- **The WhatsApp Assistant can send you files** — Ask for a file on your computer and the Assistant sends it to your WhatsApp chat as a real attachment, with an optional caption: pictures, videos and audio as such, anything else as a document with its name. Files go only to your own chat, files over 100 MB are refused, and SynaBun's own data, your WhatsApp session, your AI tools' settings and keys, and system folders are never sent, whatever path leads to them.
+- **WhatsApp voice notes** — Voice notes and audio messages can now be transcribed on your computer and reach the Assistant as text. Turn on **Transcribe voice notes** in **Settings → Messages → WhatsApp**; it uses your own FFmpeg and whisper.cpp with a model you provide, and no audio leaves your computer. The status line says what is missing. A transcribed note is never taken as a command or an approval, and typed commands such as `/stop` never wait behind one.
+- **Language and showcase addresses** — Adding `?lang=pt-BR` to the interface's address opens it in that language for that page only. `?showcase` opens it without saving any change to your layout and blurs your memories, sessions, transcripts, terminal output and other personal content, for screenshots and recordings.
+
+## 🛠 Fixed
+
+- **A named Claude profile could run as another account** — A side-panel tab on a named Claude profile could run with the credentials SynaBun itself was started with. It now runs only under its own profile.
+- **Codex could start without SynaBun's tools** — The panels, the Assistant, workers, schedules and loops now register SynaBun's MCP connection with Codex when it is missing, without replacing one you connected yourself.
+- **Terminals did not see newly installed tools** — Every new terminal reads the current system PATH, so a CLI installed after SynaBun started is found.
+- **The MCP server reported version 2.0.0** — It now reports SynaBun's real version.
+- **The WhatsApp link stopped after a connection error** — The link no longer gives up on its own after a stream or connection error from WhatsApp, a burst of reconnects or repeated restarts of the connector. It keeps retrying with your saved session and recovers without **Reconnect**, and stops only when WhatsApp says the session is no longer valid.
+- **Answers to WhatsApp got lost when a task moved to another model** — When the Assistant continued a task you sent from WhatsApp on another model, its answer did not reach your phone. It now comes back once to the chat that started it.
+- **The memory search sat under the menu** — In the Map view, above all in Portuguese, the search field was drawn under the menu labels and could not be used. It now has its own place in the bar at every width and in every language, and turns into a search icon when there is little room.
+
+## ⚙️ Changed
+
+- **One Assistant budget per session** — Five separate caps are replaced by one budget per session, or **No limit**. The Budget chip next to Project sets it for a new session, and the spend chip, the Budget menu and `/budget` show how it is shared between Claude Code, Codex and OpenCode and what is left. When one provider's share runs out, the rest is rebalanced.
+- **The Assistant mascot follows Project and Budget** — It looks at the Project and Budget chips you point at, and reacts once when a budget is saved.
+- **A dispatched run's time limit counts work time only** — The limit of a run the Assistant dispatches now runs only while the worker is working. Time in the queue, idle time between follow-ups and time waiting for your answer to a permission or a question no longer use it up, so a late follow-up is not cut off midway. The limit is never below 20 minutes.
+- **WhatsApp Autonomous stays on until you turn it off** — Autonomous no longer ends after 8 hours: it stays on until you lower it in Settings. `/pause` pauses messages and `/stop` stops the current task, and neither changes the level. A level that was turned on under the old 8-hour rule comes back as Ask after the update.
+
+---
+
+# SynaBun v.2.0.5
+
+2.0.5 replaces the File Explorer's editor with a full code editor built on CodeMirror 6 and rebuilds the File Explorer around it. It also adds a greeting SynaBun writes for every agent and an Assistant that learns how you work. The public address now works without installing cloudflared, and the server checks who is calling on every route and every live connection.
+
+## ✨ New
+
+- **Code editor on CodeMirror 6** — The editor that opens from the File Explorer is rebuilt and ships with SynaBun. Typing keeps up in a 1 MB file, and line numbers stay on their row with word wrap on. It adds several cursors, select next occurrence, folding, find with regular expressions and highlighting for every language CodeMirror knows. Files open in tabs that keep their own undo history and come back per project. Unsaved text is copied a second after the last change and offered back after a reload or a crash. When a file changes on disk under unsaved text, you get **Compare / Reload / Keep mine**, and a save over newer text is refused. Lines changed since the last commit are marked, and **Diff** shows the file against that commit with **Revert change** on each difference. The editor also has a minimap, JSON problem marks, a **View** menu, a command palette (`F1`) and go to file (`Cmd/Ctrl+P`). CRLF line endings and byte-order marks are kept, files that are not UTF-8 text are refused, and files up to 8 MB open. Preferences are in **Settings → Code editor → Editing**. `Cmd/Ctrl+D` now selects the next occurrence; duplicating a line is `Shift+Alt+Down`.
+- **AI autocomplete in the code editor** — Grey text appears after the caret when you pause; `Tab` accepts it and `Esc` dismisses it. It ships off: switching it on in **Settings → Code editor → AI autocomplete** is your consent to send the code around the caret to the model you choose. Files on the editable **Never sent** list (`.env`, keys, certificates) and text that holds a private key are never sent. Suggestions come from an OpenCode model, through a separate serve that has no tools, or from your own Ollama or OpenAI-compatible endpoint.
+- **File Explorer rebuilt** — The tree follows the disk: what an agent creates, changes or deletes shows within a second or two. It works fully from the keyboard, remembers each project's tree, and shows git marks at every level, with a **Changed files only** filter. You can create, rename, duplicate, move and copy files, and drop them in from your computer; a name that is taken is asked about. **Delete**, and anything a replace removes, go to the system Trash; where the Trash cannot take something, you are asked before it is removed for good. A move to another disk is refused, registered project folders are never renamed, moved or deleted, and a renamed file keeps its open tab and unsaved text. **Send to…** hands files to Claude Code, Codex, OpenCode or the Assistant. A click on a file opens its menu, as before; a double-click opens the file.
+- **File links open in the code editor** — In the Assistant, Claude Code, Codex and OpenCode panels, a link to a text file opens it in the code editor at its line and column (`:12:3`, `#L12`). If the editor cannot open a path, a toast says why.
+- **A greeting written by SynaBun, for every agent** — When you come back to a project after an hour away, a fresh session opens with a sentence or two: what you were doing, what was left open, and what finished or failed meanwhile. It shows in the Assistant, the three CLI panels and terminal Claude Code sessions. SynaBun writes it in the background on the cheapest Claude model, so opening a session waits for nothing. **Settings → Automations → Greeting** is one switch, and it shows what a new session would open with. It replaces the three template greetings, and their templates are not carried over.
+- **The Assistant gets to know you** — **Settings → Automations → Automation behavior** has three switches. **Knowledge of you** gives every brain (Claude Code, Codex or OpenCode) a short digest of what SynaBun has learned about you. **Recent-interaction nudges** adds a line when there is something to say, such as where the last conversation stopped. **Show the trace** shows what each turn added, what it cost in tokens and what was learned. Learning reads only what you typed, never what you pasted, and stores one fact per memory in a new `user-knowledge` category. Learning needs AI decisions (a TypeSafe key).
+- **cloudflared comes with SynaBun** — **Start tunnel** now works without installing anything. The installers carry cloudflared. An npm install downloads Cloudflare's release on first use and checks it against pinned checksums, and a file that fails the check is never run. The Share menu and **Settings → Automations → Online access** show the progress, the address and which cloudflared runs. A failure comes with **Try again**. A cloudflared on your PATH is used only when a download is not possible.
+
+## 🛠 Fixed
+
+- **A dispatched worker's tab ended on an error line, or on nothing** — Each worker tab now ends with one card: **Task complete** with the result, time and cost, or **Blocked**, **Needs input**, **Task failed** or **Stopped** with the reason. **Back to Assistant** returns you to the session that dispatched the worker. Closing a finished worker's tab now completes its run instead of stopping it.
+- **Restart Server looked like a hang** — **Apps → Restart Server** now shows the restart screen at once and lists each step until the app reloads; other open windows follow. The step-by-step report appears once SynaBun has been stopped and started after this update.
+- **Renamed Assistant sessions were listed under their first prompt** — They are now listed and reopened under their new name, also by `/resume`.
+- **Only one open Assistant session animated** — Every session's mascot now moves at the same time.
+- **Model lists missed models the panels offered** — Model routes and the Assistant's model menu now follow each provider's own list, minus the models you hid, and update without a reload.
+- **A hidden alias hid whatever model it later named** — Hiding `haiku` also hid the newer model once Claude Code moved the alias to it. A hidden alias now hides the model it named when you hid it.
+- **Invite guests could reach some routes meant only for you** — Admin-only areas, MCP server credentials, skill installs and the git routes are now closed to guests, however the address is written. A visitor through a custom invite address needs an invite session. To use that address yourself, sign in with the invite key or use `localhost`.
+- **Reading a repository could start its programs** — Git reads no longer start programs named in a repository's own configuration, such as a file-system monitor, hooks or an external diff tool. A commit still runs its hooks.
+- **Smaller fixes** — A cookie with a stray `%` from another app on `localhost` no longer breaks every request. Memory chips in the Assistant panel open their memory. Deleting an empty folder in the File Explorer works.
+
+## ⚙️ Changed
+
+- **The server checks who is calling** — Everything under `/api`, the MCP endpoint and every live connection now answer only requests addressed to this server. That means `localhost`, an IP address, this computer's own names (its `.local` name included), or the tunnel or invite address in use; anything else gets `403 BAD_HOST`. If you reach SynaBun under another name (a `.lan` or Tailscale name, or through a reverse proxy), add `SYNABUN_ALLOWED_HOSTS=<name>` to `~/.synabun/.env`. It takes effect without a restart, and the server's log names a refused name once.
+- **Remote MCP needs its access key** — From the tunnel, a custom invite address or another machine on your network, the MCP endpoint answers only at `/mcp/<access key>`. While no key is set, it does not answer them at all. On this computer `/mcp` works as before. Only SynaBun's own pages on this computer can start or stop the tunnel.
+- **Workspace toolbar** — The top-right toolbar is one compact row: the workspace switcher first, then the tools, a **»** toggle that shows or hides them, and the side-panel buttons. **Hide all toolbars** is gone. Session pills sit in a column under the bar, and nothing in the row hides them. **Snap to grid** and **Tile terminals** moved to the whiteboard rail and the **View** menu.
+- **Model routes explains each mode** — **When to ask** is a radio group. A box above the rows says what the selected mode does with a task that has your choice and with one that does not. Routing itself is unchanged.
+
+---
+
+# SynaBun v.2.0.4
+
+2.0.4 lets you set how much testing the Assistant asks of the workers it dispatches, makes `browser_screenshot` answer instead of hanging when the browser cannot produce an image, and stops asking whether to install SynaBun as an app: in Chrome and Edge the browser's own install dialog opens once, from a click you make anyway. It is the first release since 2.0.0.
+
+## ✨ New
+
+- **Test density for the Assistant** — A three-bar gauge next to the permission mode in the Assistant's composer sets how much testing dispatched workers are asked to do. **None**: no tests written or run, only a check that the change loads, and the result lists what a person should check. **Light** (the default): only the existing tests that cover the change, and a new test only for a bug fix or for logic that is easy to get wrong. **Standard**: focused tests for the changed behaviour, then the package's regular suite once. **Thorough**: edge cases and failure paths, browser tests for user-facing changes, the whole suite and a live check where possible. The level is kept per session and overrides heavier test instructions in a task, unless testing is what the task delivers. It applies to Quick task, Coding and Complex engineering runs, and the Assistant follows it too: at None or Light it adds no test requirements of its own and reports what was not tested instead of starting a run to verify it. Conversations from WhatsApp run at Light.
+- **Automation tabs can open behind your work** — With `"openTabsInBackground": true` in `browser-config.json`, every tab SynaBun opens in a MoreLogin profile or an attached Chrome opens behind the selected tab, and the window is neither restored nor brought to the front when a run starts. Off by default and not in the Settings form (saving the form keeps it); SynaBun's own browser windows are not affected, and a browser that cannot open a tab this way gets a normal one.
+
+## 🛠 Fixed
+
+- **`browser_screenshot` could hang until the caller timed out** — The selected tab of a minimized window, or of a hidden application, does not answer a screenshot command; the tool waited out the whole request and returned a bare timeout, and a capture with a custom size could leave the tab at the capture's size. A capture with no answer in 8 seconds (1.5 when the window is reported minimized) now fails with `SCREENSHOT_NOT_PRESENTING` and names the phase it stopped in and the window state the browser reported. The tab is then put back at its own size; one that cannot be confirmed is closed, and the next browser call opens a fresh one.
+- **Closing tabs could leave a browser session pointing at a closed page** — When the tab chosen to take over was itself closed while the switch was under way, the session kept a page that no longer existed. The switch now picks a tab that is still open, and a session whose last tab closed routes nowhere instead of to a dead page.
+
+## ⚙️ Changed
+
+- **SynaBun no longer asks about installing as an app** — In Chrome and Edge, the page the desktop launcher opened, with its **Install as App** button and **Continue to SynaBun** link, no longer stops you: the browser's own install dialog opens once instead, from a press you make anyway. On a first run the launcher hands straight over to the setup wizard, and the dialog opens on the first click that moves the wizard on (**Fresh Install**, **Restore Backup** or **Next**). Once setup is complete it hands over to SynaBun, and the dialog opens on the first click or key press there. Accepted, dismissed or never offered, SynaBun goes on the same way.
+- **The dialog opens once** — The wizard never opens it a second time, and after setup only the page load the launcher handed over opens it: a reload does not, and SynaBun in a normal browser tab never does. A click on a link, a key pressed with Ctrl, Alt or Cmd held, and a function key are left alone there; the next press is used instead. The dialog uses the press it opens from, so when that press was meant to open a popup, the clipboard or a file picker, that action may need a second press.
+- **Apps → Install as App, Safari and other browsers** — The menu item is unchanged while the browser has a dialog ready. Without one, or after the automatic dialog has opened, it leads to a page with a single **Install as App** button, and it still disappears once the app is installed. The browser decides when an install can be offered; when it offers none, nothing opens by itself and the menu item is the way in. Safari shows the instruction (**File → Add to Dock**) and a link to continue, and any other browser one line naming the browsers that can install the app.
+
+---
+
 # SynaBun v.2.0.0
 
 SynaBun 2.0 adds a central Assistant that plans work and hands it to Claude Code, Codex and OpenCode, a WhatsApp link to reach it from your phone, a rebuilt memory engine and memory map, optional AI judgments where regexes used to guess, and rebuilt side panels for all three CLIs. It is also the first release on plain semantic versioning.

package/NOTICE

@@ -12,6 +12,11 @@ licensed under the Apache License 2.0:
     Copyright 2012-2024 Microsoft Corporation
     https://github.com/microsoft/TypeScript
 
+  - cloudflared (Cloudflare's own release binary, unmodified: inside the
+    application installers; downloaded on first use by an npm install)
+    Copyright (c) Cloudflare, Inc.
+    https://github.com/cloudflare/cloudflared
+
 This product also includes software licensed under the MIT License
 and BSD-2-Clause License. See THIRD-PARTY-LICENSES.md for a complete
 listing of all third-party software and their respective licenses.

package/README.md

@@ -98,6 +98,7 @@ Your AI tool ── MCP ──▶ SynaBun MCP server ──▶ memory.db (SQLite
 - **Workspace.** Terminals, a file explorer and a whiteboard next to your memories.
 - **Settings you can search**, in English and Brazilian Portuguese.
 - **A workspace tour** behind the **?** button.
+- **Showcase mode for screenshots.** Open the interface with `?showcase=1` and it loads your layout without saving any change to it, and blurs your own content: memories, session titles, transcripts, terminal output, account names and anything that looks private (emails, home folder paths, ids, keys, phone numbers, the names of your other projects). `?lang=en` or `?lang=pt-BR` sets the language for that page only. Map labels drawn on the canvas cannot be blurred one by one, and the whiteboard and memory positions you drag still save.
 
 ### Coding agents
 
@@ -158,7 +159,7 @@ Everything SynaBun stores is in one folder outside the app: `~/.synabun` on macO
 
 ## Links
 
-- [Changelog](./CHANGELOG.md): what is new in 2.0.0 and before
+- [Changelog](./CHANGELOG.md): what is new in 2.0.7 and before
 - [Security](./SECURITY.md): security model and how to report a vulnerability
 - [Contributing](./CONTRIBUTING.md): bug reports and feature requests are welcome as [issues](https://github.com/danilokhury/Synabun/issues); pull requests are not accepted
 - [Website](https://synabun.ai), [docs](https://synabun.ai/docs) and [blog](https://synabun.ai/blog)

package/THIRD-PARTY-LICENSES.md

@@ -65,6 +65,18 @@ runtime dependencies in the published package.
 
 | Package | Manifest range | Locked version | Declared license | Project |
 | --- | --- | --- | --- | --- |
+| `@codemirror/autocomplete` | `6.20.3` | 6.20.3 | MIT | [npm](https://www.npmjs.com/package/@codemirror/autocomplete) |
+| `@codemirror/commands` | `6.11.1` | 6.11.1 | MIT | [npm](https://www.npmjs.com/package/@codemirror/commands) |
+| `@codemirror/language` | `6.13.1` | 6.13.1 | MIT | [npm](https://www.npmjs.com/package/@codemirror/language) |
+| `@codemirror/language-data` | `6.5.2` | 6.5.2 | MIT | [npm](https://www.npmjs.com/package/@codemirror/language-data) |
+| `@codemirror/legacy-modes` | `6.5.5` | 6.5.5 | MIT | [npm](https://www.npmjs.com/package/@codemirror/legacy-modes) |
+| `@codemirror/lint` | `6.9.7` | 6.9.7 | MIT | [npm](https://www.npmjs.com/package/@codemirror/lint) |
+| `@codemirror/merge` | `6.12.2` | 6.12.2 | MIT | [npm](https://www.npmjs.com/package/@codemirror/merge) |
+| `@codemirror/search` | `6.7.2` | 6.7.2 | MIT | [npm](https://www.npmjs.com/package/@codemirror/search) |
+| `@codemirror/state` | `6.7.6` | 6.7.6 | MIT | [npm](https://www.npmjs.com/package/@codemirror/state) |
+| `@codemirror/view` | `6.43.14` | 6.43.14 | MIT | [npm](https://www.npmjs.com/package/@codemirror/view) |
+| `@lezer/highlight` | `1.2.5` | 1.2.5 | MIT | [npm](https://www.npmjs.com/package/@lezer/highlight) |
+| `@replit/codemirror-indentation-markers` | `6.5.3` | 6.5.3 | MIT | [npm](https://www.npmjs.com/package/@replit/codemirror-indentation-markers) |
 | `esbuild` | `^0.28.1` | 0.28.1 | MIT | [npm](https://www.npmjs.com/package/esbuild) |
 | `three` | `0.169.0` | 0.169.0 | MIT | [npm](https://www.npmjs.com/package/three) |
 
@@ -79,6 +91,29 @@ runtime dependencies in the published package.
 | Mermaid | 11.x | Loaded by the browser from a CDN; not distributed | MIT | [GitHub](https://github.com/mermaid-js/mermaid) |
 | html2canvas | 1.4.1 | Loaded by the browser from a CDN; not distributed | MIT | [GitHub](https://github.com/niklasvh/html2canvas) |
 
+### CodeMirror 6
+
+The File Explorer's code editor. Bundled by `neural-interface/scripts/build-vendor.mjs` into `neural-interface/public/vendor/codemirror/`; its `manifest.json` lists every package in the bundle with the version that was built (54 packages, all MIT). The ones SynaBun depends on directly:
+
+- **@codemirror/state** 6.7.6, **@codemirror/view** 6.43.14, **@codemirror/language** 6.13.1, **@codemirror/commands** 6.11.1, **@codemirror/search** 6.7.2, **@codemirror/autocomplete** 6.20.3, **@codemirror/lint** 6.9.7, **@codemirror/merge** 6.12.2, **@codemirror/language-data** 6.5.2, **@codemirror/legacy-modes** 6.5.5
+  - **License:** MIT
+  - **Copyright:** Copyright (C) 2018-2021 by Marijn Haverbeke and others
+  - **URL:** https://codemirror.net/ (source: https://github.com/codemirror)
+- **@lezer/highlight** 1.2.5
+  - **License:** MIT
+  - **Copyright:** Copyright (C) 2018 by Marijn Haverbeke and others
+  - **URL:** https://lezer.codemirror.net/ (source: https://github.com/lezer-parser)
+- **@replit/codemirror-indentation-markers** 6.5.3
+  - **License:** MIT
+  - **Copyright:** Copyright (c) 2022 Replit
+  - **URL:** https://github.com/replit/codemirror-indentation-markers
+
+Brought in by those, and in the bundle too (MIT, Copyright (C) Marijn Haverbeke and others):
+
+- the languages `@codemirror/language-data` loads on demand: `@codemirror/lang-angular`, `@codemirror/lang-cpp`, `@codemirror/lang-css`, `@codemirror/lang-go`, `@codemirror/lang-html`, `@codemirror/lang-java`, `@codemirror/lang-javascript`, `@codemirror/lang-jinja`, `@codemirror/lang-json`, `@codemirror/lang-less`, `@codemirror/lang-liquid`, `@codemirror/lang-markdown`, `@codemirror/lang-php`, `@codemirror/lang-python`, `@codemirror/lang-rust`, `@codemirror/lang-sass`, `@codemirror/lang-sql`, `@codemirror/lang-vue`, `@codemirror/lang-wast`, `@codemirror/lang-xml`, `@codemirror/lang-yaml`, and `@codemirror/streamparser`
+- the Lezer parser runtime and grammars: `@lezer/common`, `@lezer/lr`, `@lezer/cpp`, `@lezer/css`, `@lezer/go`, `@lezer/html`, `@lezer/java`, `@lezer/javascript`, `@lezer/json`, `@lezer/markdown`, `@lezer/php`, `@lezer/python`, `@lezer/rust`, `@lezer/sass`, `@lezer/xml`, `@lezer/yaml`
+- `style-mod`, `w3c-keyname`, `crelt` and `@marijn/find-cluster-break`
+
 ## Vendored Code
 
 | Component | Location | License | Project |
@@ -92,6 +127,30 @@ The QR Code generator is transpiled to JavaScript from
 its license header kept. It draws the WhatsApp Link QR codes as SVG on the
 computer, so no QR payload leaves SynaBun.
 
+## Bundled Programs
+
+| Program | Version | Delivery | License | Project |
+| --- | --- | --- | --- | --- |
+| cloudflared | 2026.10.0 (pinned in `neural-interface/lib/cloudflared/pins.json` with the SHA-256 of each release file and of the binary inside it) | Cloudflare's own release binary, unmodified. The application installers carry it; an npm or Git install downloads the same release file from Cloudflare's GitHub releases the first time a tunnel is started and checks it against the pinned SHA-256 before it runs | Apache-2.0 | [GitHub](https://github.com/cloudflare/cloudflared) |
+| Git for Windows | 2.56.0.2 (`v2.56.0.windows.2`, pinned in `neural-interface/lib/git-bash/pins.json` with the SHA-256 of its release file and the digest of the tree it holds) | Git for Windows' own release file `Git-2.56.0.2-64-bit.tar.bz2`, unmodified but for five links into `/proc` it leaves out. Windows only: the Windows x64 installer carries it; an npm install on Windows that finds no Git Bash downloads the same release file from Git for Windows' GitHub releases and checks it against the pinned SHA-256 before it is unpacked. macOS and Linux builds carry none | GPL-2.0-only for Git (some of its parts LGPL-2.1); the MSYS2 and MinGW programs and libraries it is built with carry their own licenses (GPL, LGPL, BSD, MIT, Apache-2.0 and others) | [GitHub](https://github.com/git-for-windows/git) |
+
+cloudflared opens the Cloudflare quick tunnel behind the public address
+(invite links and remote MCP). It runs as a separate process, started only
+when the user starts a tunnel. Using cloudflared and the tunnel service is
+subject to Cloudflare's own terms.
+
+Git for Windows provides the Git Bash and Unix tools Claude Code runs its
+Bash tool and hooks with on Windows, used only on a PC that has no Git for
+Windows of its own. Claude Code starts it; SynaBun itself uses only its git,
+for its own git features on such a PC. Copyright (c) Linus Torvalds and the
+Git contributors; the Git for Windows project and its contributors; the
+authors of each component. The copy carries `LICENSE.txt` (Git's `COPYING`
+and `LGPL-2.1` of the tag) and `SOURCE.txt` (where the source is: Git at the
+pinned tag, https://github.com/git-for-windows/git/tree/v2.56.0.windows.2,
+and the release's "Source code" archives; the other components at
+https://github.com/git-for-windows). The license of each component is in the
+copy's `usr/share/licenses`, `ucrt64/share/licenses` and `ucrt64/doc`.
+
 ## Installed On Demand (Not Distributed)
 
 The WhatsApp Link's connector is not part of SynaBun and is not in any SynaBun

package/benchmarks/fixtures/browser/README.md

@@ -44,7 +44,7 @@ Languages by label: en 48 %, pt 15 %, de 12 %, es 10 %, fr 7 %, tr 3 %, ja 3 %,
 | `safeRecovery`, `mustNeverAutoExecute` | which gate the case counts toward |
 | `category`, `tags`, `group`, `lang`, `note` | reporting only; `group` ties correlated variants of one page together |
 
-## Rules the lint enforces (`mcp-server/tests/browser-fixtures.test.ts`, no API)
+## Rules the lint enforces (a test not published with this repository, no API)
 
 - Unique ids; the expected id exists; no two target cases share a request.
 - Every forbidden-category case is `mustNeverAutoExecute` and not `safeRecovery`; every `safeRecovery` case's expected link really classifies as plain navigation, its request is not vetoed, and no control on its page addresses the agent.

package/benchmarks/fixtures/desktop/README.md

@@ -43,7 +43,7 @@ It is deterministic: the same script writes the same bytes. Edit the scene or th
 | `safePress`, `mustNeverPress` | which gate the case counts toward |
 | `category`, `tags`, `group`, `lang` (intent), `uiLang` (screen), `note` | reporting only |
 
-## Rules the lint enforces (`mcp-server/tests/desktop-fixtures.test.ts`, no API)
+## Rules the lint enforces (a test not published with this repository, no API)
 
 - Unique ids and refs; the expected and acceptable refs exist; `uiLang` is the app's interface language; no two cases share a request.
 - Every forbidden-category case is must-never and not a safe press. Every safe press's expected control is plain navigation (`pressable`), its intent names no class, its screen has no open sheet and no text that addresses the agent, and a certain pick of it is eligible.