synabun 2.0.10 → 2.2.0

package/CHANGELOG.md

@@ -1,3 +1,210 @@
+# SynaBun v.2.2.0
+
+2.2.0 is a reliability release: it fixes a slow memory buildup in long-running chat panels, makes closing a minimized OpenCode tab actually stop that conversation, and cleans up terminal processes left behind by a crash.
+
+## Fixed
+
+- **Long sessions no longer grow unbounded in memory** — chat transcripts stayed in memory after being closed or replaced, and streaming replies re-rendered the entire reply on every update instead of just the new part. Both are fixed, so the interface stays fast and light over many hours of use.
+- **Closing an OpenCode tab now actually stops the conversation** — clicking the × on a minimized OpenCode session only hid it before; the conversation kept running in the background. It now stops properly when you close it.
+- **Crashed terminal sessions no longer leave orphaned processes behind** — if a terminal session crashed or was force-stopped, its underlying shell process could keep running unseen. It is now always cleaned up.
+
+---
+
+# SynaBun v.2.1.7
+
+2.1.7 lets dispatched Assistant task workers ask you a question mid-task instead of guessing, and fixes a browser automation bug where one stuck tab could take down an entire MoreLogin browser session.
+
+## ✨ New
+
+- **Dispatched workers can ask you a question** — When an Assistant task worker hits a decision only you can make, it can now stop and ask right in that task's live sidepanel tab, across every provider (Claude Code, Codex, OpenCode, Antigravity) and every permission level. Answer from the panel, or by replying to the Assistant's message; the worker picks up and continues from there. Supports multiple-choice questions with more than one answer selected at once.
+
+## 🛠 Fixed
+
+- **A stuck browser tab no longer breaks the whole automation session** — On some automated browser sessions, a single tab's background service worker could get stuck, and every subsequent browser action in that session (navigating, taking a snapshot or screenshot, reading the console, running a script, reloading) would fail with a network-protection error until the server was restarted. SynaBun now detects and recovers from this automatically, without needing a restart, and a stuck tab no longer affects the rest of the session.
+
+---
+
+# SynaBun v.2.1.6
+
+A small Windows installer fix: finishing an install no longer looks stuck.
+
+## 🛠 Fixed
+
+- **Installer no longer shows "Not Responding" on finish** — On Windows, clicking Finish with "Run SynaBun" checked used to make the installer wait on its own window while Windows scanned the brand-new SynaBun.exe, so it could sit there looking frozen for 20-30 seconds before the app actually opened. The installer now closes right away and hands off to the desktop, so it never waits and never appears stuck.
+
+---
+
+# SynaBun v.2.1.5
+
+A fix-focused release: git status checks no longer pile up and spike CPU in repos with large ignored trees.
+
+## ✨ New
+
+- **One shared git status check** — Every part of SynaBun that needs a repo's git status (the File Explorer, the project greeting, and others) now shares one careful check per repo instead of each running its own.
+
+## 🛠 Fixed
+
+- **Git status checks piling up and pegging CPU** — In a repo with a huge ignored tree (for example, a large `node_modules`), overlapping git status checks could run several processes at once, each using close to a full CPU core, and some kept running even after SynaBun had stopped. Checks are now capped, deduplicated, given a time limit, and cleaned up reliably, including on Windows. A timed-out or partial check is now shown as incomplete rather than silently reported as "no changes."
+
+---
+
+# SynaBun v.2.1.4
+
+A Windows-focused release: updates now show a visible progress window, Git for Windows ships smaller and installs faster, and signed builds are supported when a certificate is configured.
+
+## Added
+
+- **Visible update progress on Windows** — checking for and installing an update now shows a window with its steps and a climbing percentage, then confirms the restart, instead of leaving you guessing.
+- **Optional code signing on Windows** — a release can now be signed with a configured certificate; builds made without one are unaffected and install exactly as before.
+
+## Changed
+
+- **Smaller, faster Windows installer** — Git for Windows (used for Claude Code's Bash tool and its hooks) now ships as a single packed file and is unpacked only on first use, instead of thousands of loose files in every installer and update.
+
+---
+
+# SynaBun v.2.1.3
+
+Windows feels lighter in this release, and OpenCode 2.2.5 is now supported.
+
+## Fixed
+
+- **Smoother on Windows** — the window's title bar and overlay chrome no longer apply a blur effect there, since it cost noticeably more on Windows than elsewhere; browsing menus and dialogs should feel snappier.
+- **Conversations open faster** — reopening a past conversation now shows its most recent messages right away instead of waiting for the whole transcript to parse; earlier messages load in as you scroll back, in the order they happened.
+- **Fewer stalls right after launch** — a couple of background lookups (the model list, a few one-time checks) now warm up without holding up the window that is waiting on them, so the window and its panels appear sooner, especially on a slower machine.
+
+## Added
+
+- **OpenCode 2.2.5 support** — the side panel now recognizes and connects to OpenCode 2.2.5 the same way it already did for 2.1.4.
+
+---
+
+# SynaBun v.2.1.2
+
+2.1.2 is a routine maintenance build. There is nothing new to try and no behavior changes to expect; it keeps the release packaging current between larger updates.
+
+## Changed
+
+- **Maintenance build** — Internal build and packaging metadata were refreshed. The app itself behaves exactly as it did in the previous release.
+
+---
+
+# SynaBun v.2.1.1
+
+A fix-focused release: Skills Studio gets a one-click fix panel, Antigravity conversations join Resume and memory, and a batch of Windows and panel bugs are cleaned up.
+
+## ✨ New
+
+- **Skills Studio fix panel** — A new "Fix" view from the health pill lists detected problems with one-click fixes, a preview before applying, and the option to dismiss or keep specific issues.
+- **Antigravity conversations in Resume and memory** — Antigravity conversations now show up in Resume's search (previously only titles matched) and are captured as memory sessions, the same as the other assistants.
+
+## 🛠 Fixed
+
+- **Assistant route cards always offer both options** — Every route card now shows a "Here" and a "Dispatch" choice, whatever the assistant proposed.
+- **MoreLogin detection on Windows** — The profile picker could come up empty when MoreLogin was installed outside its default folder, or silently show nothing on an unexpected response from MoreLogin's local API. Both are fixed.
+- **Skills Studio: false "duplicate" warning** — Installing the same skill into more than one folder a tool reads from no longer shows a spurious duplicate warning; a real name clash with a different skill still does.
+- **Skills Studio delete confirmation** — The delete dialog was redesigned for clarity.
+- **Assistant: duplicate follow-up cards** — A turn that mixed text and tool calls no longer shows a repeated follow-up or question card for each text segment.
+- **Renamed Assistant sessions on Windows** — A session renamed in the side panel no longer reverts to "SynaBun" after a file lock, server restart, or reload on Windows.
+- **Claude panel: "Think off" on models with effort levels** — Turning thinking off now actually turns it off, instead of falling back to the model's effort setting.
+- **Codex: effort level "none"** — Selecting "none" now behaves as its own choice instead of silently mapping to the model's default.
+- **Release publication: URL reputation checks** — Retries now read fresh evidence for the exact URL before submitting a new analysis, instead of reusing a stale one.
+- **Guarded workers on the newest macOS** — A protected worker's isolated network connection back to SynaBun could fail to come up on the latest macOS release; fixed, with no change in behavior on earlier macOS versions.
+
+## ⚙️ Changed
+
+- **Settings: last native dropdown removed** — The MoreLogin profile picker now uses SynaBun's own styled dropdown.
+- **Skills Studio status pills** — The library list and workspace header now share one consistent status pill style.
+- **Workspace toolbar layout** — The top-right toolbar no longer crops its buttons when space is tight.
+
+---
+
+# SynaBun v.2.1.0
+
+SynaBun 2.1.0 adds downloadable release verification reports, improves automated package publishing, and changes Windows clipboard images to explicit paste.
+
+## ✨ New
+
+- **Release verification reports** — Desktop downloads and the npm package are checked with VirusTotal before publication. Release notes include analysis dates, engine results, file hashes and links to the reports. These results describe the scans and do not guarantee that a download is safe.
+
+## 🛠 Fixed
+
+- **Automated npm publishing** — The npm package is published from the prepared release and verified against the scanned package before desktop downloads become available. This helps keep package installation and desktop updates on the same release.
+
+## ⚙️ Changed
+
+- **Explicit clipboard image paste on Windows** — Focus the whiteboard and press Ctrl+V to add a clipboard image. Background clipboard monitoring has been removed; screenshot files in the watched folder still appear automatically. This change addresses a suspected source of antivirus alerts, but resolution of the reported Kaspersky detection has not been confirmed.
+
+---
+
+# SynaBun v.2.0.121
+
+2.0.121 fixes repeated Codex MCP tool approval prompts and keeps automatic approvals aligned with the current session policy.
+
+## 🛠 Fixed
+
+- **Codex MCP approvals** — Auto-accept handles tool approvals even when Codex omits the tool name, avoiding repeated permission cards. Plan mode and remote read-only sessions continue to apply their restrictions, while questions and authorization prompts still wait for your response.
+- **Assistant routing** — Routing requests no longer need an extra tool permission card when approvals are set to Ask.
+
+---
+
+# SynaBun v.2.0.12
+
+2.0.12 makes Skills Studio easier to install from, test and maintain, keeps dispatched workers running through a server restart, and adds a guided tour of the workspace. It also moves OpenCode support to OpenCode 2 and makes the 3D memory map the default for everyone.
+
+## ✨ New
+
+- **Skill health and local usage** — Skills Studio shows local evidence of skill use in Claude Code, Codex and OpenCode runs, with native invocations distinguished from inferred reads. Optional periodic checks report integrity and eligibility changes to the Assistant.
+- **A guided workspace tour** — The help button opens a tour on SynaBun's own whiteboard, with pointing arms, handwritten labels and steps that follow the workspace. It supports narrow windows, English and Portuguese, and reduced motion. The handwriting font ships with the app.
+- **Tool lists** — Choose the SynaBun tools and external MCP servers available to a session, worker or automation from reusable tool lists. External server choices report why a requested server cannot be used, with provider context to help recover.
+
+## 🛠 Fixed
+
+- **Workers resume after a restart** — Dispatched Claude Code, Codex and OpenCode workers can pause during a SynaBun server restart and resume the same run and provider conversation in the same sidepanel tab.
+- **Server crash recovery** — SynaBun restarts a server that crashes and reports the reason. Desktop recovery shows the failure and recovery state, and a stalled Codex title request no longer holds the server open indefinitely.
+- **MoreLogin attachment and cleanup** — Connecting to a MoreLogin profile preserves its native HTTP cache and WebSocket APIs while keeping SynaBun's network guards. Closing a connected browser session also closes the automation tabs SynaBun opened for it, so they do not return on the profile's next start.
+- **Worker startup and permissions** — Codex workers start correctly when external MCP servers are disabled. Protected OpenCode workers receive MCP tools directly with Code Mode disabled, and Codex Plan mode with automatic approvals no longer repeats permission requests in the Assistant.
+- **Claude Code hooks from the desktop** — Hooks work when SynaBun starts from the macOS Dock. Settings shows their actual state and lets you switch them on or off.
+- **Stopping the intended worker** — A request naming one run stops that run. The Assistant's Stop all control requires a second press before it stops every running worker.
+- **Compact activity and app layout** — Activity bubbles use one busy indicator and at most one ellipsis, with long paths and URLs wrapping at separators. Browser tabs and Safari web apps have consistent spacing between the navigation bar and the app frame, and Codex output and tab layout handle narrow panels more reliably.
+
+## ⚙️ Changed
+
+- **Installing approved skills** — Review approval and installation have clearer, separate states. Publishing an approved skill presents one install decision with readable runtime targets, and Claude Code, Codex and OpenCode share the drafting, evaluation and installation workflow. Skill checks cover more shell wrappers, asset references and command forms while keeping passive references distinct from executable instructions.
+- **OpenCode 2 required** — OpenCode 1 support is removed. Every launch path checks the installed version before starting and explains how to install OpenCode 2 when needed.
+- **One memory map** — The memory map uses 3D. Saved 2D preferences and old links open in 3D, and the 2D switch and shortcut have been removed from the interface.
+- **Project test commands** — Browser policy permits test runners inside registered code projects and accepts syntax-only Node checks. Commands that execute preloaded code still receive the normal policy checks.
+
+---
+
+# SynaBun v.2.0.11
+
+2.0.11 rebuilds Skills Studio around a skill library: every skill in one list, a workspace to edit, test, version and publish it, native skill folders for Claude Code, Codex and OpenCode, a Review queue, and skills drafted by AI from your own sources. SynaBun's memory is also one command away for any MCP client (`npx -y synabun mcp`), the whole app has a right-click menu, desktop updates show a splash and restart in seconds, and the Schedules window speaks your language.
+
+## ✨ New
+
+- **Skills Studio 2.0** — Skills Studio is now a window with three places: Library, Review and Create. The Library lists every skill once, whichever tool or account reads it, with where it comes from, what Claude Code, Codex and OpenCode each have of it, and a health badge for what needs a look (problems, an update available, a skill defined twice, an old-style install); filters, saved views, search and bulk actions keep it in order. A skill opens in a workspace with Edit, Test, Versions and Publish: the app's code editor, a form and the YAML kept as one document, the problems each runtime would report, a description helper, the skill's files, a Markdown preview with diagrams, versions with diffs and restore, and an install of exactly the plan you see. The window is not modal, docks beside the side panels, fits narrow widths and works fully from the keyboard, in English and Portuguese.
+- **Native skill folders for Claude Code, Codex and OpenCode** — Installing a skill now puts it in each runtime's own skill folder, with a backup, a check after the install and a way back. Skills installed the old way, as Codex prompts or OpenCode commands, can be moved to the native folders from Settings › Skills › Skill folders: you see the plan first, nothing moves until you press Move, and Undo puts every one back. Nothing is moved at start, during an update or by an agent. The Codex panel runs a skill you pick as a Codex skill, and a skill's arguments are filled in the way Claude Code fills them.
+- **Skills drafted by AI, and a Review queue** — Create's AI box drafts a whole skill from your description and up to five sources: a Claude Code, Codex or OpenCode session, a web page, a registered project, memories, a library skill or an imported bundle. One worker writes it in a folder of its own and can only read and write there; the result is checked, comes with test prompts and lands in Review. While it runs you see its steps, the files written so far, the time and the cost, and you can cancel. The SynaBun Assistant creates and improves skills the same way, with its bundled skill-forge workflow. Whatever an AI makes waits in Review and is installed only after you approve it.
+- **`synabun mcp`** — The npm command now starts SynaBun's MCP server on stdio, for Cursor, Windsurf, Claude Code, Codex or any other MCP client: `"command": "npx", "args": ["-y", "synabun", "mcp"]`, or `"command": "synabun", "args": ["mcp"]` after `npm install -g synabun`. It is the same server, with the same memories and data folder, as the one SynaBun registers for your tools. Only the protocol goes to its output, and it stops when the client that started it stops it.
+- **The official MCP Registry** — The npm package now names SynaBun's entry in the official MCP Registry, `io.github.danilokhury/synabun`, which MCP clients and directories read to find a server and how to start it.
+- **Clickable follow-ups in the Assistant** — When the Assistant ends a turn with options or a question for you, they appear as buttons under its message: one click sends the answer, a set of choices becomes checkboxes with one Send, and Something else… takes you to the composer.
+- **A countdown to a usage-limit reset** — When a provider's usage limit stops the Assistant or one of its workers, a card shows a live countdown to the reset and the local reset time, then Retry now. A worker is retried on the same model.
+- **A right-click menu for the whole app** — A right-click anywhere that has no menu of its own now opens SynaBun's: page actions (Back, Forward, Reload, Copy, Full screen), then what fits what you clicked (selected text, a link, an image, a memory on the map, in the Memory Explorer or on a card, the empty space of the 3D or 2D map, the Focus mode board and its tools), then every panel and tool with its keyboard shortcut. Fields and Shift + right-click keep the browser's menu, and the terminal, the File Explorer's tree, editor tabs and graph cards keep their own. The Menu key and Shift + F10 open it from the keyboard.
+
+## 🛠 Fixed
+
+- **Skills Studio keeps your work** — The Studio could erase frontmatter it did not show, mark text typed during a save as saved, save one skill's file under another's name, lose unsaved work on Escape or close, rewrite every line ending of a Windows-style file, write into SynaBun's bundled skill, replace or delete a same-named skill SynaBun never installed, and install an imported bundle unseen. Now an edit changes only the field you touched, a save that would overwrite a change made elsewhere asks first, bundled skills are read-only with Customize a copy, a skill SynaBun did not install is backed up and changed only after you confirm, and an import is checked, scanned and shown to you before anything is written.
+- **A complete MCP server build** — SynaBun now checks that its MCP server is built completely, every module it loads and not only its entry file, and builds it again at install or start when something is missing.
+
+## ⚙️ Changed
+
+- **Desktop updates** — Updating the desktop app no longer leaves you without a window: a small splash with the mascot shows at every start and through every step of an update, with a progress bar and Details. Once an update is downloaded, the update button becomes Restart to update (also in the app menu, the File menu and the tray), which installs at once when SynaBun is idle, or when the running work ends. The safety snapshot of your data is prepared ahead in the background and compared with your data at the restart, so the new version opens in seconds instead of minutes on a large memory store, and every database copy in it passes an integrity check. On a Mac the app is without a window for about a second, and dark pages on some Macs no longer show a lighter band across the middle.
+- **`synabun help`** — `synabun help`, `synabun --help` and `synabun -h` list every command and the data folder in use. Before, they started SynaBun.
+- **Schedules in your language** — The whole Schedules window now follows the app's language: every view, row, editor, dialog and message, schedules described in plain words, and dates and times in your locale. Changing the language with the window open brings you back to the same view.
+
+---
+
 # SynaBun v.2.0.10
 
 2.0.10 works with OpenCode 2, adds a Settings › App page for updates and start at login, and opens menus, model lists and Settings at once instead of waiting on the network, most noticeably in the Windows desktop app. It also redesigns the Schedules window, shows every worker the Assistant dispatches at work, and closes a security hole in the Codex panel.

package/README.md

@@ -23,7 +23,26 @@
 
 ---
 
-SynaBun gives your AI coding tools a memory that lasts. What you decided, fixed and explained in one session is there in the next one, in every project and every tool you connect, so you stop repeating yourself. It all lives in one file on your computer: no account, no cloud service, no API key.
+**SynaBun is an open-source, self-hosted AI workspace and persistent memory MCP server: SynaBun Assistant coordinates Claude Code, Codex and OpenCode agents.** What you decided, fixed and explained in one session is there in the next one, in every project and every tool you connect, so you stop repeating yourself. It all lives in one SQLite file on your computer: no account, no cloud service, no API key.
+
+```bash
+npm install -g synabun
+```
+
+`synabun` starts the app. `synabun mcp` is the MCP server on stdio, for any MCP client:
+
+```json
+{
+  "mcpServers": {
+    "SynaBun": {
+      "command": "npx",
+      "args": ["-y", "synabun", "mcp"]
+    }
+  }
+}
+```
+
+After the global install, `"command": "synabun", "args": ["mcp"]` runs the same server. Read the [docs](https://synabun.ai/docs), or see how SynaBun [compares](https://synabun.ai/compare) with other memory tools.
 
 It connects to Claude Code, Codex CLI, Gemini CLI and OpenCode with one switch each, and to Cursor, Windsurf or any other tool that supports MCP (the Model Context Protocol) with a config snippet you copy. It comes with the Neural Interface, a local web app where you see what your tools remember and run your coding agents.
 
@@ -159,7 +178,7 @@ Everything SynaBun stores is in one folder outside the app: `~/.synabun` on macO
 
 ## Links
 
-- [Changelog](./CHANGELOG.md): what is new in 2.0.10 and before
+- [Changelog](./CHANGELOG.md): what is new in 2.2.0 and before
 - [Security](./SECURITY.md): security model and how to report a vulnerability
 - [Contributing](./CONTRIBUTING.md): bug reports and feature requests are welcome as [issues](https://github.com/danilokhury/Synabun/issues); pull requests are not accepted
 - [Website](https://synabun.ai), [docs](https://synabun.ai/docs) and [blog](https://synabun.ai/blog)
@@ -174,3 +193,7 @@ You are free to use, modify, and distribute SynaBun under Apache 2.0. Premium fe
 ## Trademark Notice
 
 "SynaBun" is a trademark of its authors. The license does not grant permission to use the SynaBun name, trademarks, service marks, or branding. If you fork this project, you must use a different name for your derivative work.
+
+<!-- synabun:verification:start -->
+Package verification: [downloadable VirusTotal reports and SHA-256 hashes](https://github.com/danilokhury/Synabun/releases/latest). Match the report to your exact version and file hash. Reports record engine coverage and analysis dates; they are not a guarantee of safety. Website results describe URL reputation, not a vulnerability audit.
+<!-- synabun:verification:end -->

package/THIRD-PARTY-LICENSES.md

@@ -59,6 +59,7 @@ runtime dependencies in the published package.
 | `playwright` | `^1.59.1` | 1.59.1 | Apache-2.0 | [npm](https://www.npmjs.com/package/playwright) |
 | `undici` | `^8.5.0` | 8.8.0 | MIT | [npm](https://www.npmjs.com/package/undici) |
 | `ws` | `^8.21.0` | 8.21.1 | MIT | [npm](https://www.npmjs.com/package/ws) |
+| `yaml` | `2.9.1` | 2.9.1 | ISC | [npm](https://www.npmjs.com/package/yaml) |
 | `zod` | `^4.4.3` | 4.4.3 | MIT | [npm](https://www.npmjs.com/package/zod) |
 
 ## Neural Interface Development Dependencies
@@ -94,6 +95,8 @@ runtime dependencies in the published package.
 | highlight.js | 11.12.0 | Bundled browser asset (`neural-interface/public/vendor/highlight/`) copied from the npm development dependency `@highlightjs/cdn-assets` | BSD-3-Clause | [GitHub](https://github.com/highlightjs/highlight.js) |
 | Mermaid | 11.17.2 | Bundled browser asset (`neural-interface/public/vendor/mermaid/`) copied from the npm development dependency | MIT | [GitHub](https://github.com/mermaid-js/mermaid) |
 | html2canvas | 1.4.1 | Bundled browser asset (`neural-interface/public/vendor/html2canvas/`) copied from the npm development dependency | MIT | [GitHub](https://github.com/niklasvh/html2canvas) |
+| yaml | 2.9.1 | Bundled browser asset (`neural-interface/public/vendor/yaml/`) built from the npm dependency | ISC | [GitHub](https://github.com/eemeli/yaml) |
+| Caveat (font) | 5.3.0 (`@fontsource/caveat`) | Bundled browser asset (`neural-interface/public/vendor/caveat/`): the Latin 400 and 700 WOFF2 files, copied unmodified with the package's license | OFL-1.1 | [GitHub](https://github.com/googlefonts/caveat) |
 
 ### CodeMirror 6
 
@@ -156,6 +159,24 @@ The card screenshot tool of the 3D map (`index.html`). Its own browser build (`d
 - **Copyright:** Copyright (c) 2012 Niklas von Hertzen
 - **URL:** https://github.com/niklasvh/html2canvas
 
+### yaml
+
+The YAML parser behind the Skills Studio: it reads the frontmatter of skills, commands and agents, and changes it one key at a time without touching the rest (`neural-interface/lib/skills/`, `neural-interface/public/shared/skills/ss-frontmatter.js`). No dependencies of its own. The Studio's metadata form uses the same package in the browser: its browser build (`browser/dist/index.js`), bundled by `neural-interface/scripts/build-vendor.mjs` into one file in `neural-interface/public/vendor/yaml/` with the package's `LICENSE` and a `manifest.json`, loaded only when the editor opens.
+
+- **Version:** 2.9.1
+- **License:** ISC
+- **Copyright:** Copyright Eemeli Aro
+- **URL:** https://github.com/eemeli/yaml
+
+### Caveat
+
+The handwriting of the whiteboard and of the Workspace tour, served by SynaBun itself instead of a font CDN. The Latin subset of weights 400 and 700 (`caveat-latin-400-normal.woff2`, `caveat-latin-700-normal.woff2`) from the npm package `@fontsource/caveat` 5.3.0, copied unmodified into `neural-interface/public/vendor/caveat/` with the package's `LICENSE` as `OFL.txt`, a `caveat.css` that declares the two faces and a `manifest.json` with the SHA-256 of each file. The font is not sold on its own and its name is not changed (OFL 1.1, conditions 1 and 3).
+
+- **Version:** 5.3.0 (`@fontsource/caveat`)
+- **License:** SIL Open Font License 1.1
+- **Copyright:** Copyright 2014 The Caveat Project Authors
+- **URL:** https://github.com/googlefonts/caveat
+
 ## Vendored Code
 
 | Component | Location | License | Project |
@@ -224,6 +245,7 @@ The model is distributed under Apache-2.0. See its
 - [BSD 2-Clause License](https://opensource.org/license/bsd-2-clause)
 - [BSD 3-Clause License](https://opensource.org/license/bsd-3-clause)
 - [GNU General Public License v3.0](https://www.gnu.org/licenses/gpl-3.0.html)
+- [ISC License](https://opensource.org/license/isc-license-txt)
 
 SynaBun's own Apache-2.0 terms are in [LICENSE](./LICENSE), and attribution
 information is in [NOTICE](./NOTICE). The

package/bin/synabun.js

@@ -1,30 +1,77 @@
 #!/usr/bin/env node
 
+/**
+ * `synabun`, the command an npm install puts on the PATH.
+ *
+ *   synabun mcp [...]   the MCP server on stdio, for an AI tool's MCP config. It
+ *                       starts mcp-server/run.mjs straight from here, as
+ *                       `node <package>/mcp-server/run.mjs` and a packaged build's
+ *                       `<entry> mcp` do (packaging/launcher/launcher.c): same
+ *                       environment, same working folder, same arguments after
+ *                       `mcp`. setup.js is never loaded, so nothing reaches stdout,
+ *                       the protocol channel, before the server does; the server
+ *                       logs to stderr.
+ *   synabun [...]       everything else: setup.js with the same arguments.
+ */
+
 import { spawn } from 'node:child_process';
+import { realpathSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
-const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
-const setupPath = resolve(packageRoot, 'setup.js');
-const child = spawn(process.execPath, [
-  '--disable-warning=ExperimentalWarning',
-  setupPath,
-  ...process.argv.slice(2),
-], {
-  cwd: process.cwd(),
-  env: process.env,
-  stdio: 'inherit',
-});
-
-child.on('error', error => {
-  console.error(`Could not start SynaBun: ${error.message}`);
-  process.exitCode = 1;
-});
-
-child.on('exit', (code, signal) => {
-  if (signal) {
-    process.kill(process.pid, signal);
-    return;
-  }
-  process.exitCode = code ?? 1;
-});
+export const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+export const MCP_COMMAND = 'mcp';
+// node:sqlite's warning: every SynaBun process starts with it off (setup.js, the packaged launcher).
+const NODE_FLAG = '--disable-warning=ExperimentalWarning';
+
+/** Node's arguments for `synabun <args>`. */
+export function nodeArgs(args, { packageRoot = PACKAGE_ROOT } = {}) {
+  if (args[0] === MCP_COMMAND) return [NODE_FLAG, resolve(packageRoot, 'mcp-server', 'run.mjs'), ...args.slice(1)];
+  return [NODE_FLAG, resolve(packageRoot, 'setup.js'), ...args];
+}
+
+/** The signals an MCP client (or a terminal) stops the server with. */
+export function forwardedSignals(platform = process.platform) {
+  return platform === 'win32' ? ['SIGINT', 'SIGTERM'] : ['SIGINT', 'SIGTERM', 'SIGHUP'];
+}
+
+/**
+ * Node on `args`, with this process's stdio, environment and working folder.
+ * This process then ends the way the child ended: its exit code, or the same
+ * signal. With `forwardSignals`, a SIGINT, SIGTERM or SIGHUP sent to this
+ * process goes to the child while it runs: an MCP client stops the server it
+ * started by signalling the process it started, which is this one.
+ */
+export function runNode(args, { execPath = process.execPath, env = process.env, cwd = process.cwd(), forwardSignals = false } = {}) {
+  const child = spawn(execPath, args, { cwd, env, stdio: 'inherit' });
+  const handlers = forwardSignals
+    ? forwardedSignals().map((signal) => [signal, () => { try { child.kill(signal); } catch {} }])
+    : [];
+  for (const [signal, handler] of handlers) process.on(signal, handler);
+  const release = () => { for (const [signal, handler] of handlers) process.removeListener(signal, handler); };
+
+  child.on('error', (error) => {
+    release();
+    console.error(`Could not start SynaBun: ${error.message}`);
+    process.exitCode = 1;
+  });
+
+  child.on('exit', (code, signal) => {
+    release();
+    if (signal) {
+      process.kill(process.pid, signal);
+      return;
+    }
+    process.exitCode = code ?? 1;
+  });
+  return child;
+}
+
+const invokedDirectly = (() => {
+  try { return !!process.argv[1] && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url)); } catch { return false; }
+})();
+
+if (invokedDirectly) {
+  const args = process.argv.slice(2);
+  runNode(nodeArgs(args), { forwardSignals: args[0] === MCP_COMMAND });
+}

package/docs/whatsapp.md

@@ -41,7 +41,7 @@ Settings → Messages → WhatsApp → **Safety** decides what a message from th
 | **Ask on my phone** (default) | Before anything that would change files, run a command or start an agent, SynaBun asks on WhatsApp as a yes / no and acts only on your **yes** (once). Any other message approves nothing and the conversation carries on (see [Questions and approvals](#questions-and-approvals)). Where a task runs is asked the same way, and that answer approves exactly one agent: a second one is asked again. Agents started from WhatsApp get no computer use and run in a registered project folder. |
 | **Autonomous** | Acts without asking, like the Assistant on the computer. It **stays on until you turn it off** in Settings → Messages → WhatsApp → **Safety** by choosing Ask on my phone or Read-only, and it survives restarts. Autonomous can read any file your computer account can, including SynaBun's WhatsApp login. Use it only with a locked phone, ideally on a second number. |
 
-**Ask and Autonomous need a Claude brain.** Which model runs the conversation is set under Conversation → **Model** (see [The model](#the-model)); the default is the Assistant panel's last-used brain. On a Codex or OpenCode brain the conversation runs **Read-only**, whatever the level says: Codex cannot ask before ordinary commands, and OpenCode keeps its own permissions. Codex runs in its read-only sandbox with the network off. OpenCode runs its plan agent, with `webfetch`, `websearch` and `codesearch` refused by SynaBun's gate plugin; if that plugin does not load, the conversation does not run. The phone is told once ("This conversation runs read-only because its brain is Codex; switch the WhatsApp brain to Claude for Ask/Autonomous.") and Safety shows the same warning.
+**Ask and Autonomous need a Claude brain.** Which model runs the conversation is set under Conversation → **Model** (see [The model](#the-model)); the default is the Assistant panel's last-used brain. On a Codex, OpenCode or Antigravity brain the conversation runs **Read-only**, whatever the level says: Codex cannot ask before ordinary commands, and OpenCode keeps its own permissions. Codex runs in its read-only sandbox with the network off. OpenCode runs its plan agent, with `webfetch`, `websearch` and `codesearch` refused by SynaBun's gate plugin; if that plugin does not load, the conversation does not run. Antigravity's policy hook refuses everything the read-only classifier does ([docs/antigravity-sidepanel.md](./antigravity-sidepanel.md#the-brain-libassistant-brainsantigravityjs)). The phone is told once ("This conversation runs read-only because its brain is Codex; switch the WhatsApp brain to Claude for Ask/Autonomous.") and Safety shows the same warning.
 
 Turning on Autonomous takes two steps so that neither a stolen phone nor a local program can do it alone:
 
@@ -50,7 +50,7 @@ Turning on Autonomous takes two steps so that neither a stolen phone nor a local
 
 There is no time limit after that: the phone's confirmation says Autonomous stays on until it is turned off in Settings → WhatsApp. `/pause` pauses acting on your messages and `/stop` stops the current task; neither changes the level. An Autonomous turned on by SynaBun 2.0.5 or earlier (which ended by itself after 8 hours) is not carried over: after the update it reads as Ask, once, and Activity says so ("Autonomous from an earlier version ended; turn it on again to keep it on without a time limit"). Turn it on again to keep it on.
 
-Lowering the level applies at once, and so does switching the conversation's brain to Codex or OpenCode. At every level:
+Lowering the level applies at once, and so does switching the conversation's brain to Codex, OpenCode or Antigravity. At every level:
 
 - Computer use (the Assistant controlling this Mac) is off unless you turned it on at this computer, and then only as the level allows: see [Computer use](#computer-use).
 - Commands, paths and tools that reach credentials, the WhatsApp session itself (its folder, its runtime, `state.db`), SynaBun's own settings (`kv_config`, `claude-code-projects.json`), persistence points (shell rc files, LaunchAgents, crontab) or browser profiles are refused (`isDeniedRemoteTool`). So is a call whose arguments the brain's host did not pass.
@@ -72,7 +72,7 @@ With the switch on, the level decides:
 | **Ask on my phone** | **One yes per task.** At Ask every task is already asked where it runs; for a task done on the Mac that question is the one about the Mac too: *"For "Tidy the desktop", want me to do it on your Mac, here with Sonnet? I'll control the screen until this task is done. (yes / no)"*. A plain **yes** from your phone turns computer use on for that task; there is no approval per click and no second question. `no` drops the task. |
 | **Autonomous** | Works without asking while Autonomous is enabled, **in a task your own plain message started**. Every other turn asks once on your phone, as at Ask: a turn SynaBun starts itself (an agent's result, a route decision, a follow-up on another model, background work), a turn typed into the conversation on the computer, and a message with forwarded or quoted text or a picture. What started the turn decides, not what was said before it. |
 
-Off as well, whatever the level: while WhatsApp is paused, in a conversation whose brain is Codex or OpenCode (it runs read-only), and when computer use is not set up on this Mac (the *Computer* switch in the Assistant panel runs the one-time setup).
+Off as well, whatever the level: while WhatsApp is paused, in a conversation whose brain is Codex, OpenCode or Antigravity (it runs read-only), and when computer use is not set up on this Mac (the *Computer* switch in the Assistant panel runs the one-time setup).
 
 **One yes, and when a second question still appears.** The Assistant is told to route a task that needs the Mac as a *computer* task done here, on its own model. The route card then says in words that the Mac will be controlled, and its yes is both answers: where the task runs and the computer approval for the turn that carries it out. That turn is the one the card was asked in when you answer while the Assistant is still waiting, and otherwise the turn SynaBun starts with your decision. You are asked a second, separate question (*"Want me to control your Mac for this? I'll stop when this task is done. (yes / no)"*) at the first computer action when the card did not say the Mac would be controlled:
 
@@ -113,7 +113,7 @@ The approval is bound to the card you saw: SynaBun records on the card, when it
 
 **What a program running as you on this Mac can and cannot do.** SynaBun's local routes trust a caller on this machine that sends the page's headers (`lib/http-guards.js`): that is the app-wide trust model, not something this feature changes. So a local process can turn the **Computer use** switch on or off through `PUT /api/whatsapp/config`, pause WhatsApp, deny a pending request over the Assistant socket, and approve a route card there (the route only). It cannot grant computer use for a WhatsApp task: neither the request nor the Mac part of a route card is granted by a socket or REST answer, only by the bridge's match on a message from the linked owner's phone. Inside SynaBun's own process the same holds: what grants is a private capability the bridge alone holds (handed to it once, when it is built; a rebuilt bridge gets a fresh one and the old one stops working), not the label `whatsapp` on an answer, which is only what the audit records. At Ask, a switch turned on by such a process therefore still needs your yes on the phone for every task; at Autonomous (which itself needs the ALLOW code from your phone) it would let your own plain messages use the Mac unasked. A process that can already run as you can of course act on the Mac without SynaBun.
 
-**How it is enforced.** `remoteComputerUse` in `lib/remote-policy.js` is the one place that decides (off, after approval, or allowed, with the reason), from the switch, the effective level, pause, the turn's trust, the brain and the desktop's setup. The runtime, the Claude brain's PreToolUse hook, the desktop gate, the persona and the panel all ask it. The layers stay independent: the brain is built with a desktop grant only when the decision is not "off", that grant is **held** (it resolves to nothing) except while a turn runs that may use the computer, the hook refuses, asks or allows each call, and the desktop service asks the runtime again at every action. A Codex or OpenCode host is refused at the gate.
+**How it is enforced.** `remoteComputerUse` in `lib/remote-policy.js` is the one place that decides (off, after approval, or allowed, with the reason), from the switch, the effective level, pause, the turn's trust, the brain and the desktop's setup. The runtime, the Claude brain's PreToolUse hook, the desktop gate, the persona and the panel all ask it. The layers stay independent: the brain is built with a desktop grant only when the decision is not "off", that grant is **held** (it resolves to nothing) except while a turn runs that may use the computer, the hook refuses, asks or allows each call, and the desktop service asks the runtime again at every action. A Codex, OpenCode or Antigravity host is refused at the gate.
 
 ## Commands
 
@@ -143,11 +143,11 @@ On WhatsApp the Assistant talks like a person in a chat. There are no numbered c
 | Asked | Example | What answers it |
 |---|---|---|
 | A tool | "I need your OK to run this: Bash: `npm test` OK to go ahead? (yes / no)" | `yes` allows once; `no` denies (`no, use staging` denies with that note) |
-| Where a task runs | "For "Fix the login test", want me to hand it to Opus? (yes / no) I could also do it here with Sonnet or use Haiku: just name it." | `yes` approves the first proposal; the name of another model it offered picks that one (`haiku`, `use haiku`, `no, use haiku`); `no` declines |
+| Where a task runs | "For "Fix the login test", want me to hand it to Opus? (yes / no) I could also do it here with Sonnet or hand it to Haiku: just name it." | `yes` approves the first proposal; the name of another model it offered picks that one (`haiku`, `use haiku`, `no, use haiku`); `here` / `do it here` picks the Assistant's own model, `dispatch` / `a worker` / `hand it off` the first worker offered; `no` declines. A model of the Assistant's own provider is done here too ("do it here with Haiku"), never "handed" |
 | A plan | "Here's my plan: … Shall I go ahead? (yes / no, or tell me what to change)" | `yes` approves; `no` keeps planning |
-| Where a Mac task runs (Ask, with the switch on) | "For "Tidy the desktop", want me to do it on your Mac, here with Sonnet? I'll control the screen until this task is done. (yes / no) I could also use Haiku: just name it. Then I ask about the Mac separately." | `yes` approves the task here **and** computer use for it (one yes); a named model picks that model only; `no` declines. See [Computer use](#computer-use) |
+| Where a Mac task runs (Ask, with the switch on) | "For "Tidy the desktop", want me to do it on your Mac, here with Sonnet? I'll control the screen until this task is done. (yes / no) I could also do it here with Haiku: just name it. Then I ask about the Mac separately." | `yes` approves the task here **and** computer use for it (one yes); a named model picks that model only; `no` declines. See [Computer use](#computer-use) |
 | Controlling the Mac, asked on its own | "Want me to control your Mac for this? I'll stop when this task is done. (yes / no)" | `yes` turns computer use on for this task (this turn); `no` keeps it off for the rest of it. Asked only when the route question did not already cover the Mac |
-| A worker's request | "One of the agents needs your OK to run this: …" | as for a tool |
+| A worker's request | "One of the agents needs your OK to run this: …"; a worker on another provider than Claude Code is named: "One of the agents (Antigravity) needs your OK to run this: …" | as for a tool |
 
 **Who else can answer a worker's request.** You, in SynaBun on the computer, always. The Assistant itself (its `agent_send` reply) only for workers its own conversation started (`403 RUN_NOT_IN_SESSION` for another conversation's worker) and only when the level lets it: with *strict worker approvals* on and below Autonomous it is refused (`403 HUMAN_APPROVAL_REQUIRED`) and the answer is yours alone; with the setting off (the default) it may answer at Ask, where its `agent_send` call is itself asked on your phone first, and at Autonomous, where nothing is asked. At Read-only no worker runs.
 
@@ -172,7 +172,7 @@ A tool approval still shows the whole request exactly as it runs, every argument
 
 A WhatsApp conversation never sits waiting for workers. The Assistant dispatches, says in one line what it started and ends its turn; you keep chatting and get answers. When a worker finishes, asks something or fails, the result reaches the Assistant as a mailbox event after the current turn, and its report is forwarded to the phone as an *Update* (or as the reply, when you had just approved that task). Results are never merged into the reply to another message.
 
-Two things hold this, besides the persona: `agent_wait` returns after one second for a WhatsApp conversation (`lib/assistant-api.js`), with what is already done and a note telling the brain to end its turn because the result arrives as a mailbox event; desktop sessions wait as they asked. And a message that arrives while a turn runs is delivered when that turn ends, for every brain (Claude, Codex, OpenCode). Adding a message to a turn that is still running is not done: the Claude CLI could take it, but the bridge would have to tell a merged turn from a queued one, and the route gate resets on every prompt.
+Two things hold this, besides the persona: `agent_wait` returns after one second for a WhatsApp conversation (`lib/assistant-api.js`), with what is already done and a note telling the brain to end its turn because the result arrives as a mailbox event; desktop sessions wait as they asked. And a message that arrives while a turn runs is delivered when that turn ends, for every brain (Claude, Codex, OpenCode, Antigravity). Adding a message to a turn that is still running is not done: the Claude CLI could take it, but the bridge would have to tell a merged turn from a queued one, and the route gate resets on every prompt.
 
 **A task continued on another model answers you here.** When the router moves your task to another model in the same conversation (a route it chose by itself, a remembered route, or a model you named on a card), the Assistant first says so in one line and ends its turn; the turn that does the task on the new model follows, and its answer is the reply to your message, sent once, whether or not *Forward background results* is on. The runtime marks that turn before any of its output (`synabun.continuation`, with where the prompt it continues came from), and it stays a turn SynaBun starts itself, not a new message of yours: what it may do is decided as for any such turn (at Autonomous it asks once on your phone before it uses the Mac; its questions and approvals reach your phone and take your answer). A task you typed into the conversation on the computer keeps its continuation on the computer, as before.
 
@@ -181,7 +181,7 @@ Two things hold this, besides the persona: `agent_wait` returns after one second
 Conversation → **Model** decides which brain (provider, model, effort) runs the WhatsApp conversation.
 
 - **Same as the Assistant** (default): the brain the Assistant panel last used, read when a conversation starts and when this setting changes. The panel picking another model later does not move a conversation that is under way.
-- **A model**: the picker is the Assistant panel's own: the same catalog (models you switched off in the Assistant's Models list are not offered), the same per-model effort list, the same names. A model from Codex or OpenCode is listed too, with the note that the conversation then runs Read-only (above).
+- **A model**: the picker is the Assistant panel's own: the same catalog (models you switched off in the Assistant's Models list are not offered), the same per-model effort list, the same names. A model from Codex, OpenCode or Antigravity is listed too, with the note that the conversation then runs Read-only (above).
 
 The choice is stored in the WhatsApp settings (`brain`: `null` or `{ provider, model, effort }`) with the same versioned write as the other settings, and checked on the server against the Assistant's catalog before it is stored: an unknown provider, a model the catalog does not list or that is switched off, or an effort the model does not run is a `400`; without a catalog the answer is `503`. Nothing unchecked is stored.
 
@@ -299,7 +299,7 @@ Ask for a file and the Assistant sends it to this chat as a real WhatsApp attach
 - password managers (1Password, Bitwarden, KeePass `*.kdbx`), `~/Library/Keychains`, GNOME Keyring and KWallet, Windows Credential Manager (with its DPAPI keys and the Vault), the Mail and Messages stores and Thunderbird;
 - shell histories (`.zsh_history`, `.bash_history`, fish's history, PowerShell's), `.netrc`, `.npmrc`, `.pypirc`, `.pgpass`, `.git-credentials` and git's `~/.config/git/credentials`, `.vault-token`, the `.docker`, `.kube`, `.aws`, `.azure`, gcloud, `gh`, `.gnupg` and `.ssh` folders, and CLI token stores (cargo, gem, Pulumi, Hugging Face, Kaggle, rclone, hub, glab, doctl, Stripe, Fly, cloudflared, OCI, Databricks);
 - key and certificate files anywhere (`*.pem`, `*.key`, `*.p12`, `*.pfx`, `*.jks`, `*.keystore`, `*.ppk`, `*.p8`, SSH `id_*` keys), `.env` files and their variants, terraform state;
-- AI tool configuration and credentials: `~/.claude.json`, `~/.claude*`, `~/.codex*`, OpenCode's configuration and `auth.json`, GitHub Copilot's tokens, `.cursor/mcp.json`, `claude_desktop_config.json`, `mcp-api-key` and `.synabun-api-key` files;
+- AI tool configuration and credentials: `~/.claude.json`, `~/.claude*`, `~/.codex*`, OpenCode's configuration, its database (`opencode.db`, where OpenCode 2 keeps credentials) and the `auth.json` OpenCode 1 kept, GitHub Copilot's tokens, `.cursor/mcp.json`, `claude_desktop_config.json`, `mcp-api-key` and `.synabun-api-key` files;
 - copies of those places' secret parts wherever they are (a backup disk, Time Machine): `.synabun/whatsapp`, `mcp-data`, `runtime` and `backups`, `sidepanel-configs`, `.claude/settings*.json` and `.claude/projects`, `.codex*/config.toml`, `sessions` and `history.jsonl`; and SynaBun's own backup archives (`synabun-<kind>-<timestamp>.zip`, `synabun-auto-backup.zip`) by their name, in whatever folder the backups go to.
 
 The list is explicit (`neural-interface/lib/whatsapp/local-file.js`, `DENYLIST`) and matched without regard to letter case. The protected folders (the session, the data home, `~/.claude*`, `~/.codex*`) are also recognized by what they are on disk, their device and inode, so another spelling of the same folder is refused like the usual one: macOS reaches every folder of the data volume under `/System/Volumes/Data/…` too, which `realpath` keeps. On Windows a name is also checked as Windows opens it, without trailing dots and spaces (`.ssh.\id_rsa` is `.ssh\id_rsa`). **The content of a file is never inspected**: a secret inside an ordinary file with an ordinary name is sent like any other file, so ask only for what you mean to receive. Keynote presentations share the `.key` extension with private keys and are refused too: export them to PDF first.
@@ -310,7 +310,7 @@ Also refused: a URL, a network share or device path (`\\server\share`, `//server
 
 **When it is refused.** The answer names the file and the reason (`…/.ssh/id_ed25519 is protected (credentials (SSH, GnuPG, cloud, registry and git logins)): SynaBun never sends it from WhatsApp`), so the Assistant can tell you why; numbers, JIDs and credentials in the path are redacted.
 
-**Who may send.** Only the active WhatsApp conversation's own Assistant brain, at any level (Read-only included) and on any brain (Claude, Codex or OpenCode). Delivering a file you asked for is a reply, like the final text: it needs no route of its own, is never asked on the phone at Ask, and works in plan mode and on the read-only Codex and OpenCode brains. It grants nothing else: no file edits, no computer use, no worker permissions. The brain proves who it is with a credential SynaBun makes for each brain launch of a WhatsApp conversation and gives only to that brain's SynaBun MCP server, through the environment of the brain's own process, never a command line or a file: the Claude CLI expands it into its MCP header, Codex forwards it to its MCP child by name, OpenCode's serve fills it into its MCP entry. The `X-Synabun-Role` and `X-Synabun-Terminal` headers, which any local program can send, prove nothing here. A worker, a desktop chat and an earlier WhatsApp conversation are refused (`403`), and so is any request while WhatsApp is off, paused or not connected (`409`). See [SECURITY.md](../SECURITY.md).
+**Who may send.** Only the active WhatsApp conversation's own Assistant brain, at any level (Read-only included) and on any brain (Claude, Codex, OpenCode or Antigravity). Delivering a file you asked for is a reply, like the final text: it needs no route of its own, is never asked on the phone at Ask, and works in plan mode and on the read-only Codex, OpenCode and Antigravity brains. It grants nothing else: no file edits, no computer use, no worker permissions. The brain proves who it is with a credential SynaBun makes for each brain launch of a WhatsApp conversation and gives only to that brain's SynaBun MCP server, through the environment of the brain's own process, never a command line or a file: the Claude CLI expands it into its MCP header, Codex forwards it to its MCP child by name, OpenCode's serve fills it into its MCP entry, Antigravity's `agy acp` passes it to its MCP children in their environment. The `X-Synabun-Role` and `X-Synabun-Terminal` headers, which any local program can send, prove nothing here. A worker, a desktop chat and an earlier WhatsApp conversation are refused (`403`), and so is any request while WhatsApp is off, paused or not connected (`409`). See [SECURITY.md](../SECURITY.md).
 
 **When the answer is uncertain.** The send is exactly one request, never retried by SynaBun or by the Assistant. A success (`{ ok, id, type, mimetype, size, fileName, path, fallback }`, `path` the canonical one) means WhatsApp took the file. A timeout (the connector gives a file 120 seconds, the tool 130; each brain's MCP client waits longer: Codex and OpenCode 180 seconds), a connector that stops during the send, or an answer lost on the way back (a reset connection) answers with `uncertain: true`: the file may or may not have arrived, and the Assistant says so instead of sending it again. Ask again if it did not arrive. `UNREACHABLE` (nothing listening for the request) means nothing was sent.
 
@@ -375,7 +375,7 @@ App-wide, every WebSocket upgrade (`/ws/*`) must carry no `Origin` or this serve
 | "The WhatsApp connector does not match this SynaBun version" (`HOST_HELD`) | The connector process speaks another IPC protocol than the running server, after an update installed while SynaBun ran. Restart SynaBun. A connector that merely crashes is restarted by itself and never shows this. |
 | Install failed | The message names the cause (`NPM_NOT_FOUND`, `OFFLINE`, `REGISTRY_REFUSED`, `DISK_FULL`, `NO_PERMISSION`, `FILE_IN_USE`, `TIMEOUT`, `VERIFY_FAILED`); *Try again*. |
 | "SynaBun could not make the WhatsApp session files private" (`AUTH_PERMS`) | The session folder or its files are not yours, or cannot be set to 700 / 600 (a shared or network drive, another user's files). Fix the permissions of the folder shown under Data & privacy, then *Reconnect*. |
-| Replies say the conversation "runs read-only because its brain is Codex / OpenCode" | Ask and Autonomous need a Claude brain: pick a Claude model under Conversation → Model. It applies from your next message. |
+| Replies say the conversation "runs read-only because its brain is Codex / OpenCode / Antigravity" | Ask and Autonomous need a Claude brain: pick a Claude model under Conversation → Model. It applies from your next message. |
 | "…is switched off in the Assistant's Models list, so WhatsApp runs on the same brain as the Assistant" | The model chosen for WhatsApp was disabled (or its provider no longer lists it). Pick another under Conversation → Model, or switch it back on in the Assistant's Models list. |
 | I answered something else and the approval was denied | By design: only a plain `yes` approves. Ask again, or say what you want; the Assistant asks again when it needs the approval. |
 | I replied `yes` to an older message and the approval was denied | A reply that quotes a message answers only that message. Quote the request itself, or send `yes` without quoting anything. |
@@ -390,7 +390,7 @@ App-wide, every WebSocket upgrade (`/ws/*`) must carry no `Origin` or this serve
 | "SynaBun is not reachable: nothing was sent" (`UNREACHABLE`) | The brain's MCP server could not reach SynaBun at all, so the file was not sent. Check that SynaBun is running, then ask again. |
 | Transcripts get words wrong | Set `transcriptionLanguage` to the language you speak (`auto` guesses per note), or point `transcriptionModelPath` at a larger ggml model. |
 
-**Not the same as the WhatsApp browser tools.** The `whatsapp` MCP profile (`browser_extract_wa_chats`, `browser_extract_wa_messages`) lets agents read WhatsApp Web in SynaBun's browser. The WhatsApp Link is you chatting with SynaBun from your phone. They share nothing.
+**Not the same as the WhatsApp browser tools.** The `browser_whatsapp` tool group (`browser_extract_wa_chats`, `browser_extract_wa_messages`) lets agents read WhatsApp Web in SynaBun's browser. The WhatsApp Link is you chatting with SynaBun from your phone. They share nothing.
 
 ## Environment
 

package/hooks/claude-code/pre-websearch.mjs

@@ -29,7 +29,11 @@ import { getDataHome } from '../../lib/paths.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const DATA_HOME = getDataHome();
 const LOOP_DIR = join(DATA_HOME, 'data', 'loop');
-const NI_BASE = process.env.SYNABUN_NI_URL || 'http://localhost:3344';
+// A guarded worker's sandbox blocks :3344, so SynaBun gives it the worker-only channel (its browser proxy forwards
+// /api/browser/*). Inside such a worker the browser-only policy must NOT fail open: if SynaBun cannot be reached
+// even over the channel, apply the worker default and deny WebSearch/WebFetch.
+const WORKER_CHANNEL = process.env.SYNABUN_WORKER_CHANNEL || null;
+const NI_BASE = WORKER_CHANNEL || process.env.SYNABUN_NI_URL || 'http://localhost:3344';
 
 const BLOCK_REASON = (toolName) =>
   `BLOCKED: ${toolName} is not allowed while a SynaBun browser session is open. Use the SynaBun browser tools (browser_navigate, browser_click, browser_content, etc.) instead. If the page requires login or CAPTCHA, STOP and tell the user what they need to do in the browser panel. Do NOT fall back to web search.`;
@@ -69,6 +73,13 @@ async function handleInput() {
     }
 
     if (!niReachable) {
+      // A guarded worker that cannot reach SynaBun even over its channel: apply the worker default (deny), so the
+      // sandbox's inability to reach :3344 never becomes a way to bypass the browser-only policy. Outside a guarded
+      // worker (no channel var) this stays fail-open and quiet — a stale loop file must not block the owner.
+      if (WORKER_CHANNEL) {
+        process.stdout.write(JSON.stringify({ decision: 'block', reason: BLOCK_REASON(tool_name) }));
+        return;
+      }
       process.stdout.write(JSON.stringify({}));
       return;
     }

package/hooks/claude-code/shared.mjs

@@ -864,8 +864,13 @@ export async function judgeText(kind, text, { project, timeoutMs = 1500, extra =
 /**
  * Fire-and-forget POST that may wait at most `waitMs` for the answer and never
  * keeps the process alive past that. Resolves true only on a 2xx.
+ * SYNABUN_HOOK_NOTICE_WAIT_MS replaces `waitMs` for the hook tests only
+ * (tests/helpers/hook-harness.mjs): on a machine running the whole suite the
+ * notice missed its 200 ms. Nothing SynaBun starts sets it.
  */
 export async function postNotice(path, body, waitMs = 200) {
+  const testWait = Number(process.env.SYNABUN_HOOK_NOTICE_WAIT_MS);
+  if (Number.isFinite(testWait) && testWait > 0) waitMs = testWait;
   let timer;
   try {
     const request = fetch(`${niUrl()}${path}`, {

package/hooks/claude-code/stop.mjs

@@ -916,7 +916,7 @@ function handleStop({ sessionId, lastMessage, cwd, transcriptPath, judged = {},
     }
 
     // CHECK 2.5: User learning (bundled with task or standalone)
-    // Skipped when waiting for user action (interactive flows like Leonardo questionnaires).
+    // Skipped when waiting for user action (interactive questionnaire flows).
     // Limited to 1 retry to minimize chat noise.
     // Never inside the Assistant's brain (SYNABUN_ASSISTANT_SESSION): SynaBun's harness learns
     // about the user there, and prompt-submit.mjs never arms this in it.