synabun 2.0.10 → 2.2.0

package/neural-interface/public/shared/skills/ss-resources.js

@@ -0,0 +1,165 @@
+// ═══════════════════════════════════════════
+// SynaBun Neural Interface — Skills Studio: what a skill refers to, and its arguments
+// ═══════════════════════════════════════════
+//
+// A skill is its SKILL.md and the files it points the model to. This reads those pointers and checks them
+// against the folder (rule L-05): a link that leaves the skill, a file that is not there, one an export leaves
+// out (hidden files, node_modules), an absolute path that will not travel with it, a chain of references more
+// than one level deep, and files nothing refers to. Markdown links are references by definition; a path in
+// `code` counts only when it starts where the skill's own files do (./, a top-level folder of the skill, or the
+// skill-folder variables), so a skill about a repository can name that repository's files freely.
+//
+// It also reads the argument placeholders of the body for each runtime (rule L-08): Claude Code counts $0 as the
+// first argument; Codex and OpenCode read a native skill body as written, so $ARGUMENTS reaches the model as
+// text there. $SKILL_DIR is a convention of SynaBun's old bridges, not a variable any runtime fills.
+//
+// No DOM, no I/O: the caller hands in the files and their text.
+
+const LINK_RE = /!?\[[^\]\n]*\]\(\s*<?([^)\s>]+)>?(?:\s+(?:"[^"]*"|'[^']*'))?\s*\)/g;
+const CODE_RE = /`([^`\n]{1,300})`/g;
+const SCHEME_RE = /^[A-Za-z][A-Za-z0-9+.-]*:/;
+const VARIABLE_PREFIX_RE = /^(?:\$SKILL_DIR|\$\{CLAUDE_SKILL_DIR\}|\$CLAUDE_SKILL_DIR)(?=\/|$)/;
+const ALWAYS_KEPT = /^(?:SKILL\.md|icon\.(?:png|svg|jpe?g|webp)|LICEN[CS]E(?:\.[A-Za-z]+)?|README(?:\.md)?|agents\/openai\.yaml|evals?\/.*)$/i;
+const TEXT_EXT = /\.(?:md|markdown|mdx|txt)$/i;
+
+function lineAt(text, index) {
+  let line = 1;
+  for (let i = 0; i < index && i < text.length; i++) if (text.charCodeAt(i) === 10) line++;
+  return line;
+}
+
+/** Join a reference onto the folder of the file it is in, as the skill's own relative path; `escapes` when it climbs out. */
+function resolveRef(fromDir, target) {
+  const parts = fromDir ? fromDir.split('/') : [];
+  for (const seg of target.split('/')) {
+    if (seg === '' || seg === '.') continue;
+    if (seg === '..') { if (!parts.length) return { escapes: true, path: null }; parts.pop(); continue; }
+    parts.push(seg);
+  }
+  return { escapes: false, path: parts.join('/') };
+}
+
+/**
+ * The references of a skill folder, checked.
+ * @param {object} o
+ * @param {{ path: string, size?: number, text?: string|null }[]} o.files every file (text null for a binary)
+ * @param {string[]} [o.dirs] every folder
+ * @param {{ path: string, reason: string }[]} [o.excluded] what an export leaves out
+ * @param {string} [o.headPath]
+ * @returns {{ references: object[], orphans: string[], diagnostics: object[] }}
+ */
+export function analyzeResources({ files = [], dirs = [], excluded = [], headPath = 'SKILL.md' } = {}) {
+  const byPath = new Map(files.map((f) => [f.path, f]));
+  const dirSet = new Set(dirs);
+  for (const f of files) { const p = f.path.split('/'); for (let i = 1; i < p.length; i++) dirSet.add(p.slice(0, i).join('/')); }
+  const excludedSet = new Map(excluded.map((e) => [e.path, e.reason]));
+  const topLevel = new Set([...dirSet].filter((d) => !d.includes('/')));
+  const references = [];
+  const diagnostics = [];
+  const add = (ruleId, severity, message, file, line) => diagnostics.push({ ruleId, severity, message, file, line });
+  const referenced = new Set([headPath]);
+
+  const read = (path, depth, seen) => {
+    const file = byPath.get(path);
+    if (!file || typeof file.text !== 'string' || seen.has(path)) return;
+    seen.add(path);
+    const text = file.text;
+    const fromDir = path.includes('/') ? path.slice(0, path.lastIndexOf('/')) : '';
+    const found = [];
+    for (const m of text.matchAll(LINK_RE)) {
+      const raw = m[1];
+      if (SCHEME_RE.test(raw) || raw.startsWith('#') || raw.startsWith('//')) continue;
+      found.push({ raw: raw.split('#')[0].split('?')[0], kind: 'link', index: m.index });
+    }
+    for (const m of text.matchAll(CODE_RE)) {
+      const raw = m[1].trim();
+      if (/\s/.test(raw) || SCHEME_RE.test(raw)) continue;
+      if (VARIABLE_PREFIX_RE.test(raw)) { found.push({ raw, kind: 'variable', index: m.index }); continue; }
+      const first = raw.replace(/^\.\//, '').split('/')[0];
+      if (raw.startsWith('./') || (raw.includes('/') && topLevel.has(first))) found.push({ raw, kind: 'code', index: m.index });
+      else if (raw.startsWith('/') || /^[A-Za-z]:[\\/]/.test(raw) || raw.startsWith('~/')) {
+        if (/(?:^|\/)(?:skills?|\.claude|\.codex|\.agents|\.opencode)\//.test(raw)) found.push({ raw, kind: 'code', index: m.index });
+      }
+    }
+    for (const ref of found) {
+      if (!ref.raw) continue;
+      const line = lineAt(text, ref.index);
+      const entry = { from: path, raw: ref.raw, kind: ref.kind, line, depth, to: null, status: 'ok' };
+      if (ref.raw.startsWith('/') || /^[A-Za-z]:[\\/]/.test(ref.raw) || ref.raw.startsWith('~/')) {
+        entry.status = 'absolute';
+        add('L-05-absolute', 'warning', `${ref.raw} is a path on this computer: it does not travel with the skill. Point to a file inside the skill instead.`, path, line);
+        references.push(entry);
+        continue;
+      }
+      let target = ref.raw;
+      let base = fromDir;
+      if (ref.kind === 'variable') { target = ref.raw.replace(VARIABLE_PREFIX_RE, '').replace(/^\//, ''); base = ''; }
+      let decoded = target;
+      try { decoded = decodeURIComponent(target); } catch { decoded = target; }
+      const resolved = resolveRef(base, decoded.replace(/\\/g, '/'));
+      if (resolved.escapes) {
+        entry.status = 'escapes';
+        add('L-05-escape', 'error', `${ref.raw} leads out of the skill's folder.`, path, line);
+        references.push(entry);
+        continue;
+      }
+      entry.to = resolved.path;
+      const hiddenPart = resolved.path.split('/').find((seg) => seg.startsWith('.') || seg === 'node_modules');
+      if (excludedSet.has(resolved.path) || hiddenPart) {
+        entry.status = 'excluded';
+        add('L-05-excluded', 'error', `${ref.raw} points to ${resolved.path}, which an export leaves out (${excludedSet.get(resolved.path) || (hiddenPart === 'node_modules' ? 'node_modules' : 'hidden')}): the skill would refer to a file it does not carry.`, path, line);
+      } else if (byPath.has(resolved.path)) {
+        referenced.add(resolved.path);
+        if (depth >= 1 && TEXT_EXT.test(resolved.path) && resolved.path !== headPath) {
+          add('L-05-deep', 'info', `${path} refers on to ${resolved.path}: references more than one level deep may be read only in part. Link it from ${headPath} instead.`, path, line);
+        }
+        if (depth < 2 && TEXT_EXT.test(resolved.path)) read(resolved.path, depth + 1, seen);
+      } else if (dirSet.has(resolved.path) || resolved.path === '') {
+        entry.status = 'directory';
+        for (const f of files) if (resolved.path === '' || f.path.startsWith(`${resolved.path}/`)) referenced.add(f.path);
+      } else {
+        entry.status = 'missing';
+        add('L-05-missing', ref.kind === 'link' ? 'error' : 'warning', `${ref.raw} is not in the skill.`, path, line);
+      }
+      references.push(entry);
+    }
+  };
+  read(headPath, 0, new Set());
+
+  const orphans = files.map((f) => f.path).filter((p) => !referenced.has(p) && !ALWAYS_KEPT.test(p) && !p.split('/').some((s) => s.startsWith('.')));
+  if (orphans.length) {
+    const shown = orphans.slice(0, 12).join(', ') + (orphans.length > 12 ? `, and ${orphans.length - 12} more` : '');
+    add('L-05-orphan', 'info', `${orphans.length === 1 ? 'One file is' : `${orphans.length} files are`} not referred to from ${headPath} or the files it links: ${shown}. A model finds a file only when it is pointed to it.`, headPath, null);
+  }
+  return { references, orphans, diagnostics };
+}
+
+/**
+ * The argument placeholders of a body, for one runtime.
+ * @param {string} runtime 'claude' | 'codex' | 'opencode' | 'portable' | 'claude-cloud'
+ * @param {{ body: string, bodyLine?: number, headPath?: string, declared?: string[] }} o
+ */
+export function argumentDiagnostics(runtime, { body = '', bodyLine = 1, headPath = 'SKILL.md', declared = [] } = {}) {
+  const out = [];
+  const text = String(body);
+  const add = (ruleId, severity, message, index) => out.push({ ruleId, severity, message, file: headPath, line: index === null ? null : lineAt(text, index) + bodyLine - 1 });
+  const first = (re) => { const m = re.exec(text); return m ? m.index : -1; };
+  const skillDir = first(/(?<!\\)\$SKILL_DIR\b/);
+  if (skillDir >= 0) add('L-08-bridge-token', 'warning', '$SKILL_DIR is a convention of SynaBun\'s old bridges, not a variable a runtime fills. Use a path relative to the skill (Claude Code also has ${CLAUDE_SKILL_DIR}).', skillDir);
+  const args = first(/(?<!\\)\$ARGUMENTS\b/);
+  const positional = first(/(?<!\\)\$\d+\b/);
+  if (runtime === 'claude') {
+    const one = first(/(?<!\\)\$1\b/);
+    if (one >= 0 && first(/(?<!\\)\$0\b/) < 0) add('L-08-zero-based', 'info', 'Claude Code counts arguments from $0: $1 is the second argument.', one);
+  } else if (runtime === 'codex' || runtime === 'opencode' || runtime === 'portable' || runtime === 'claude-cloud') {
+    const where = args >= 0 ? args : positional;
+    if (where >= 0) {
+      const who = { codex: 'Codex', opencode: 'OpenCode', portable: 'The portable format', 'claude-cloud': 'Claude.ai and the API' }[runtime];
+      add('L-08-arguments-literal', 'info', `${who} reads a skill body as written: ${args >= 0 ? '$ARGUMENTS' : 'a $N placeholder'} reaches the model as text, not filled.`, where);
+    }
+    const claudeVar = first(/\$\{CLAUDE_[A-Z_]+\}/);
+    if (claudeVar >= 0 && runtime !== 'portable') add('L-08-claude-variable', 'info', 'A ${CLAUDE_*} variable is filled by Claude Code only; elsewhere it stays as written.', claudeVar);
+  }
+  if (declared.length && runtime !== 'claude') add('L-08-named-arguments', 'info', `"arguments" (${declared.join(', ')}) is a Claude Code field; other runtimes do not fill $${declared[0]}.`, null);
+  return out;
+}

package/neural-interface/public/shared/skills/ss-review-view.js

@@ -0,0 +1,190 @@
+// ═══════════════════════════════════════════
+// SynaBun Neural Interface — Skills Studio: the Review queue and install plans, as words
+// ═══════════════════════════════════════════
+//
+// What the Review queue (lib/skills/reviews.js) and an install plan (lib/skills/deploy.js) say, turned into what
+// the owner reads and decides on: a card per submission (who made it, what it does, what it can do that the
+// approved revision could not, the checks of exactly its bytes), the targets an install can choose, a row per
+// target of a plan (where, who sees it, what is there, what it needs confirmed), the decisions the confirmations
+// make, and the outcome per target. No DOM: the tests read it (Skills Studio 2.0 draws Review with studio/sx-review-view.js).
+
+export const REVIEW_STATE_LABEL = Object.freeze({
+  pending: 'Waiting for your review',
+  changes_requested: 'Changes asked for',
+  approved: 'Approved, not installed yet',
+  publishing: 'Installing',
+  published: 'Installed',
+  partial: 'Installed in part',
+  publish_failed: 'Install failed',
+  rejected: 'Rejected',
+  withdrawn: 'Withdrawn',
+});
+
+export const RUNTIME_LABEL = Object.freeze({ claude: 'Claude Code', codex: 'Codex', opencode: 'OpenCode', antigravity: 'Antigravity', agents: 'Shared (~/.agents/skills)' });
+
+/** A target as a person reads it: the runtime, and the project or the account when it is not the default one. */
+export function targetLabel(t) {
+  const runtime = RUNTIME_LABEL[t?.runtime] || t?.runtime || '?';
+  if (t?.scope === 'project' && t.projectPath) return `${runtime} (project ${t.projectPath})`;
+  if (t?.accountId && t.accountId !== 'default') return `${runtime} (account ${t.accountId})`;
+  return runtime;
+}
+
+/** A target as an install sends it: only the fields a target has (runtime, scope, projectPath, accountId). */
+function wholeTarget(t) {
+  if (typeof t === 'string') return { runtime: t };
+  const out = { runtime: t?.runtime };
+  for (const key of ['scope', 'projectPath', 'accountId']) if (typeof t?.[key] === 'string' && t[key]) out[key] = t[key];
+  return out;
+}
+const plainTarget = (t) => (!t.scope || t.scope === 'user') && !t.projectPath && (!t.accountId || t.accountId === 'default');
+
+const AUTHORITY_WORDS = {
+  scripts: 'scripts', binaries: 'files that are not text', dynamicContext: 'commands run when it loads', hooks: 'session hooks',
+  toolGrants: 'pre-approved tools', domains: 'web addresses', sensitive: 'reads of private data', persistentWrites: 'lasting configuration changes', installers: 'software installs',
+};
+
+/** What a revision can do that the approved one could not, in words. */
+export function authorityLines(delta) {
+  if (!delta || !delta.byKind) return [];
+  const out = [];
+  for (const [kind, change] of Object.entries(delta.byKind)) {
+    const words = AUTHORITY_WORDS[kind] || kind;
+    if (change.added?.length) out.push(`Adds ${words}: ${change.added.slice(0, 6).join(', ')}${change.added.length > 6 ? ` and ${change.added.length - 6} more` : ''}`);
+    if (change.removed?.length) out.push(`No longer has ${words}: ${change.removed.slice(0, 6).join(', ')}${change.removed.length > 6 ? ` and ${change.removed.length - 6} more` : ''}`);
+  }
+  return out;
+}
+
+function authorLine(author) {
+  if (!author) return 'Unknown author';
+  if (author.kind === 'owner') return 'You';
+  const who = author.kind === 'assistant' ? 'The SynaBun Assistant' : 'An agent';
+  const bits = [author.provider, author.model, author.runId ? `run ${author.runId}` : null].filter(Boolean);
+  return bits.length ? `${who} (${bits.join(', ')})` : who;
+}
+
+function scanLine(scan) {
+  if (!scan) return { text: 'Not scanned', severity: 'medium' };
+  const counts = scan.counts || {};
+  const found = Object.values(counts).reduce((n, c) => n + (Number(c) || 0), 0);
+  if (scan.status === 'error') return { text: 'The scan failed: it cannot be approved', severity: 'high' };
+  if (scan.gate === 'blocked') return { text: `The scan blocks it (${found} finding${found === 1 ? '' : 's'})`, severity: 'high' };
+  if (scan.status === 'no_findings') return { text: 'No findings in the scanned content', severity: 'none' };
+  return { text: `${found} finding${found === 1 ? '' : 's'} to review${scan.status === 'incomplete' ? '; part of it could not be read' : ''}`, severity: scan.gate === 'review' ? 'medium' : 'none' };
+}
+
+/** One submission as a card. `actions`: what the owner can do with it now. */
+export function reviewCard(review) {
+  const ev = review.evidence || {};
+  const lintErrors = Object.values(ev.lint?.profiles || {}).reduce((n, p) => n + (p.errors || 0), 0);
+  const changed = ev.diff?.files || [];
+  const scan = scanLine(ev.scan);
+  const actions = review.state === 'pending' ? ['approve', 'request_changes', 'reject']
+    : review.state === 'changes_requested' ? ['reject']
+    : ['approved', 'partial', 'publish_failed', 'published'].includes(review.state) ? ['install'] : [];
+  return {
+    id: review.reviewId,
+    title: review.skillName || review.skillId,
+    state: review.state,
+    stateLabel: REVIEW_STATE_LABEL[review.state] || review.state,
+    author: authorLine(review.author),
+    notes: review.releaseNotes || '',
+    assumptions: Array.isArray(review.assumptions) ? review.assumptions : [],
+    targets: (review.targets || []).map(targetLabel),
+    scan,
+    lint: lintErrors ? `${lintErrors} problem${lintErrors === 1 ? '' : 's'} for its targets` : 'No problems for its targets',
+    lintSeverity: lintErrors ? 'high' : 'none',
+    authority: authorityLines(ev.authority),
+    changes: ev.diff ? `${changed.length} file${changed.length === 1 ? '' : 's'} changed since the approved revision` : (review.baseApprovedRevisionId ? '' : 'A new skill'),
+    reason: review.decisionReason || '',
+    comments: (review.comments || []).slice(-5).map((c) => `${c.by?.kind === 'owner' ? 'You' : authorLine(c.by)}: ${c.body}`),
+    revisionId: review.submittedRevisionId,
+    // The folder name it installs under (its SKILL.md's), and the scan's findings for exactly its bytes.
+    installAs: typeof ev.installName === 'string' && ev.installName ? ev.installName : null,
+    findings: (ev.scan?.findings || []).slice(0, 5).map((f) => ({ severity: ['critical', 'high', 'medium', 'low'].includes(f.severity) ? f.severity : 'low', text: `${f.severity}: ${f.message}` })),
+    actions,
+  };
+}
+
+/**
+ * The targets an install can choose: the ones a submission named, whole (scope, project, account) and turned on,
+ * then each runtime's own folder for the default account, off (Claude Code on when nothing was named). Each choice
+ * carries the `target` an install sends.
+ */
+export function targetChoices({ sharedAgentsRoot = false } = {}, suggested = []) {
+  const asked = (suggested || []).map(wholeTarget).filter((t) => typeof t.runtime === 'string' && t.runtime);
+  const seen = new Set();
+  const choices = [];
+  for (const target of asked) {
+    const key = JSON.stringify(target);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    choices.push({ key, runtime: target.runtime, target, label: targetLabel(target), on: true });
+  }
+  const plainAsked = new Set(asked.filter(plainTarget).map((t) => t.runtime));
+  for (const runtime of ['claude', 'codex', 'opencode', 'antigravity', ...(sharedAgentsRoot ? ['agents'] : [])]) {
+    if (plainAsked.has(runtime)) continue;
+    const target = { runtime };
+    choices.push({ key: JSON.stringify(target), runtime, target, label: targetLabel(target), on: !asked.length && runtime === 'claude' });
+  }
+  return choices;
+}
+
+/** One row per target of a plan: where, who sees it, and what it needs. */
+export function planRows(plan) {
+  return (plan?.targets || []).map((t) => {
+    const replace = (t.needs || []).find((n) => n.code === 'confirm_replace') || null;
+    const scanAck = (t.needs || []).find((n) => n.code === 'acknowledge_scan') || null;
+    const status = t.blocked?.length ? 'blocked' : (t.needs?.length ? 'needs' : 'ready');
+    const lines = [];
+    if (t.destination) lines.push(`Goes to ${t.destination}`);
+    if (t.affectedRuntimes?.length > 1) lines.push(`Read by ${t.affectedRuntimes.map((r) => RUNTIME_LABEL[r] || r).join(' and ')}`);
+    for (const b of t.blocked || []) lines.push(b.message);
+    for (const tr of t.export?.transforms || []) lines.push(`Changed for this runtime only: ${tr.reason}`);
+    for (const o of t.overlap || []) lines.push(o.why);
+    if (t.lint?.warnings) lines.push(`${t.lint.warnings} warning${t.lint.warnings === 1 ? '' : 's'} for this runtime`);
+    return {
+      targetKey: t.targetKey,
+      label: targetLabel(t),
+      status, lines,
+      replace: replace ? { currentDigest: replace.currentDigest, message: replace.message } : null,
+      scanAck: scanAck ? { digest: scanAck.digest, message: scanAck.message, findings: (t.scan?.findings || []).slice(0, 10).map((f) => `${f.severity}: ${f.message}${f.file ? ` (${f.file}${f.line ? `:${f.line}` : ''})` : ''}`) } : null,
+      refresh: (t.refresh || []).map((r) => r.message).filter(Boolean),
+    };
+  });
+}
+
+/**
+ * The decisions an install sends: for each target, exactly what the owner confirmed (the digest of what is there
+ * now, the digest whose scan findings they reviewed). Nothing is confirmed by default.
+ * @param {object} plan @param {{ replace: Iterable<string>, scan: Iterable<string> }} confirmed target keys
+ */
+export function decisionsFor(plan, { replace = [], scan = [] } = {}) {
+  const r = new Set(replace); const s = new Set(scan);
+  const out = {};
+  for (const row of planRows(plan)) {
+    const d = {};
+    if (row.replace && r.has(row.targetKey)) d.expectedDestinationDigest = row.replace.currentDigest;
+    if (row.scanAck && s.has(row.targetKey)) d.acknowledgedDigest = row.scanAck.digest;
+    if (Object.keys(d).length) out[row.targetKey] = d;
+  }
+  return out;
+}
+
+/** Whether an install of this plan would do anything with these confirmations. */
+export function installable(plan, confirmed = {}) {
+  const r = new Set(confirmed.replace || []); const s = new Set(confirmed.scan || []);
+  return planRows(plan).some((row) => row.status !== 'blocked' && (!row.replace || r.has(row.targetKey)) && (!row.scanAck || s.has(row.targetKey)));
+}
+
+const RESULT_WORDS = { committed: 'Installed', skipped: 'Not installed', 'needs-confirmation': 'Not installed: it needs your confirmation', failed: 'Failed' };
+
+/** The outcome per target, never one word for all. */
+export function resultLines(result) {
+  return (result?.results || []).map((r) => {
+    const why = r.error || (r.reasons || []).map((x) => x.message).filter(Boolean).join(' ');
+    const refresh = (r.refresh || []).map((x) => x.message).filter(Boolean).join(' ');
+    return { targetKey: r.targetKey, ok: r.status === 'committed', text: `${RESULT_WORDS[r.status] || r.status}${r.unchanged ? ' (it was already there)' : ''}${why ? `: ${why}` : ''}${r.status === 'committed' && refresh ? ` ${refresh}` : ''}` };
+  });
+}

package/neural-interface/public/shared/skills/ss-tabs.js

@@ -0,0 +1,79 @@
+// ═══════════════════════════════════════════
+// SynaBun Neural Interface — Skills Studio: an open document
+// ═══════════════════════════════════════════
+//
+// A tab holds the file as it was last read or saved (its exact text and the revision the server gave it) and
+// the text being edited ("\n" line breaks, no byte-order mark). It is unsaved when that text is not the saved
+// text, line endings aside: opening a CRLF file or switching tabs never makes one. A save sends a snapshot,
+// the text as it is when Save is pressed, with the file's own line endings put back; when the answer comes,
+// the file is that snapshot, and anything typed meanwhile is still unsaved. No DOM and no imports beyond
+// ss-doc.js.
+
+import { toEditing, fromEditing, sameAsSaved, looksDecodedFromBinary } from './ss-doc.js';
+
+/** The key of a tab's copy of unsaved text: the same for the same file, whichever tab opens it. */
+export const draftKey = (artifactId, path) => `skills:${artifactId}::${path ?? ''}`;
+
+/**
+ * A tab from what the server answered.
+ * @param {object} o
+ * @param {object} o.artifact the library entry
+ * @param {object} o.artifactContent what GET /artifact/:id answered (subFiles…)
+ * @param {string|null} o.path null for the artifact's own file, else the sub-file
+ * @param {string} o.raw the file's text as read
+ * @param {string|null} [o.revision] what a save names (null: a server from before revisions)
+ * @param {boolean} [o.binary] not text: shown, never edited. What the server said, as it said it: `undefined`
+ *   is a server from before binary files were told apart
+ * @param {boolean} [o.readOnly] a bundled skill's source
+ */
+export function createDocTab({ artifact, artifactContent, path = null, raw = '', revision = null, binary, size = 0, readOnly = false, label }) {
+  const text = String(raw ?? '');
+  // The server's word decides. One from before binary files were told apart (it says nothing) decoded every
+  // file as text, the artifact's own file too: a text that holds what that decoding replaced is not edited.
+  const isBinary = binary === true || (binary !== false && looksDecodedFromBinary(text));
+  const editing = toEditing(isBinary ? '' : text);
+  return {
+    id: path === null ? `main:${artifact.id}` : `${artifact.id}:${path}`,
+    artifactId: artifact.id, artifact, artifactContent, path,
+    label: label ?? (path === null ? artifact.name : String(path).split('/').pop()),
+    saved: { raw: isBinary ? '' : text, revision: revision ?? null },
+    content: editing.text,
+    bom: editing.bom, eol: editing.eol, mixedEol: editing.mixed,
+    dirty: false, binary: isBinary, size: Number(size) || text.length,
+    readOnly: !!readOnly || isBinary,
+    saving: null,
+  };
+}
+
+/** Whether the tab's text differs from the file as saved (line endings and the byte-order mark aside). */
+export function refreshDirty(tab) {
+  tab.dirty = !tab.binary && !tab.readOnly && !sameAsSaved(tab.saved.raw, tab.content);
+  return tab.dirty;
+}
+
+/** What a save sends: the text as it is now, written the way the file is written. */
+export function saveSnapshot(tab) {
+  const text = tab.content;
+  return { text, raw: fromEditing(tab.saved.raw, text), expectedRevision: tab.saved.revision };
+}
+
+/** The save of `sent` arrived: the file is that now. Returns whether the tab is still unsaved (typed meanwhile). */
+export function applySaved(tab, sent, revision) {
+  tab.saved = { raw: sent.raw, revision: revision ?? null };
+  return refreshDirty(tab);
+}
+
+/** Give the unsaved text up: the tab holds the file as saved again. */
+export function revertTab(tab) {
+  tab.content = toEditing(tab.saved.raw).text;
+  return refreshDirty(tab);
+}
+
+/** The file was read again (another save won, or "reload"): the tab holds what is there now. */
+export function replaceSaved(tab, raw, revision) {
+  tab.saved = { raw: String(raw ?? ''), revision: revision ?? null };
+  const editing = toEditing(tab.saved.raw);
+  tab.content = editing.text;
+  tab.bom = editing.bom; tab.eol = editing.eol; tab.mixedEol = editing.mixed;
+  return refreshDirty(tab);
+}

package/neural-interface/public/shared/skills/ss-unicode.js

@@ -0,0 +1,135 @@
+// ═══════════════════════════════════════════
+// SynaBun Neural Interface — Skills Studio: characters a reader cannot see
+// ═══════════════════════════════════════════
+//
+// Text that hides something from the person reading it: bidirectional controls that reorder what is shown,
+// zero-width and other invisible characters, Unicode "tag" characters that spell text nobody sees, control
+// characters. Found and shown escaped (U+202E, never removed: the evidence stays as it was written), so a
+// review sees what a model reads. Ordinary multilingual text is left alone: a zero-width joiner inside an emoji
+// or between letters of a script that uses it is not flagged; one between two ASCII letters is.
+//
+// Also: names that look like other names (Cyrillic "а" in "synаbun"). No DOM and no imports.
+
+const NAMES = {
+  0x00AD: 'SOFT HYPHEN', 0x034F: 'COMBINING GRAPHEME JOINER', 0x061C: 'ARABIC LETTER MARK', 0x115F: 'HANGUL CHOSEONG FILLER',
+  0x1160: 'HANGUL JUNGSEONG FILLER', 0x17B4: 'KHMER VOWEL INHERENT AQ', 0x17B5: 'KHMER VOWEL INHERENT AA', 0x180E: 'MONGOLIAN VOWEL SEPARATOR',
+  0x200B: 'ZERO WIDTH SPACE', 0x200C: 'ZERO WIDTH NON-JOINER', 0x200D: 'ZERO WIDTH JOINER', 0x200E: 'LEFT-TO-RIGHT MARK',
+  0x200F: 'RIGHT-TO-LEFT MARK', 0x202A: 'LEFT-TO-RIGHT EMBEDDING', 0x202B: 'RIGHT-TO-LEFT EMBEDDING', 0x202C: 'POP DIRECTIONAL FORMATTING',
+  0x202D: 'LEFT-TO-RIGHT OVERRIDE', 0x202E: 'RIGHT-TO-LEFT OVERRIDE', 0x2060: 'WORD JOINER', 0x2061: 'FUNCTION APPLICATION',
+  0x2062: 'INVISIBLE TIMES', 0x2063: 'INVISIBLE SEPARATOR', 0x2064: 'INVISIBLE PLUS', 0x2066: 'LEFT-TO-RIGHT ISOLATE',
+  0x2067: 'RIGHT-TO-LEFT ISOLATE', 0x2068: 'FIRST STRONG ISOLATE', 0x2069: 'POP DIRECTIONAL ISOLATE', 0x3164: 'HANGUL FILLER',
+  0xFEFF: 'ZERO WIDTH NO-BREAK SPACE', 0xFFA0: 'HALFWIDTH HANGUL FILLER',
+};
+
+const isBidi = (cp) => (cp >= 0x202A && cp <= 0x202E) || (cp >= 0x2066 && cp <= 0x2069) || cp === 0x200E || cp === 0x200F || cp === 0x061C;
+const isTag = (cp) => cp >= 0xE0000 && cp <= 0xE007F;
+const isVariationSupplement = (cp) => cp >= 0xE0100 && cp <= 0xE01EF;
+const isControl = (cp) => (cp < 0x20 && cp !== 0x09 && cp !== 0x0A && cp !== 0x0D) || (cp >= 0x7F && cp <= 0x9F);
+const isJoiner = (cp) => cp === 0x200C || cp === 0x200D;
+const isInvisible = (cp) => cp in NAMES && !isBidi(cp) && !isJoiner(cp);
+const isAsciiLetter = (cp) => (cp >= 0x41 && cp <= 0x5A) || (cp >= 0x61 && cp <= 0x7A) || (cp >= 0x30 && cp <= 0x39);
+
+/** The name of a code point, for a message ("U+202E RIGHT-TO-LEFT OVERRIDE"). */
+export function describeCodePoint(cp) {
+  const hex = `U+${cp.toString(16).toUpperCase().padStart(4, '0')}`;
+  if (NAMES[cp]) return `${hex} ${NAMES[cp]}`;
+  if (isTag(cp)) return `${hex} TAG CHARACTER`;
+  if (isVariationSupplement(cp)) return `${hex} VARIATION SELECTOR`;
+  if (isControl(cp)) return `${hex} CONTROL CHARACTER`;
+  return hex;
+}
+
+/**
+ * The hidden characters of a text.
+ * @param {string} text
+ * @param {{ identifier?: boolean, limit?: number, onHit?: (hit: object) => void }} [o] `identifier`: the text is a name (every invisible
+ *   character counts, a joiner too); `limit`: retain this many; with `onHit`, visit every hit without retaining the whole result
+ * @returns {{ index: number, line: number, column: number, codePoint: number, kind: 'bidi'|'tag'|'invisible'|'control'|'joiner', label: string }[]}
+ */
+export function findHiddenChars(text, { identifier = false, limit = 200, onHit = null } = {}) {
+  const s = String(text ?? '');
+  const out = [];
+  let line = 1; let column = 1;
+  let prev = 0;
+  let index = 0;
+  for (const ch of s) {
+    const cp = ch.codePointAt(0);
+    let kind = null;
+    if (isBidi(cp)) kind = 'bidi';
+    else if (isTag(cp) || isVariationSupplement(cp)) kind = 'tag';
+    else if (isControl(cp)) kind = 'control';
+    else if (cp === 0xFEFF && index === 0 && !identifier) kind = null;   // a byte-order mark where one belongs
+    else if (isInvisible(cp)) kind = 'invisible';
+    else if (isJoiner(cp)) {
+      const next = s.codePointAt(index + ch.length) || 0;
+      if (identifier || (isAsciiLetter(prev) && isAsciiLetter(next))) kind = 'joiner';
+    }
+    if (kind) {
+      const hit = { index, line, column, codePoint: cp, kind, label: describeCodePoint(cp) };
+      if (onHit) onHit(hit);
+      if (out.length < limit) out.push(hit);
+      if (!onHit && out.length >= limit) break;
+    }
+    if (cp === 10) { line++; column = 1; } else column++;
+    prev = cp;
+    index += cp > 0xFFFF ? 2 : 1;
+  }
+  return out;
+}
+
+/** The text with every hidden character written out (`⟦U+202E⟧`), for showing a name or a line as evidence. */
+export function revealHidden(text, { identifier = true } = {}) {
+  const s = String(text ?? '');
+  const found = findHiddenChars(s, { identifier, limit: 10000 });
+  if (!found.length) return s;
+  let out = '';
+  let at = 0;
+  for (const hit of found) {
+    out += s.slice(at, hit.index) + `⟦U+${hit.codePoint.toString(16).toUpperCase().padStart(4, '0')}⟧`;
+    at = hit.index + (hit.codePoint > 0xFFFF ? 2 : 1);
+  }
+  return out + s.slice(at);
+}
+
+// Letters of other scripts that are drawn like Latin ones (the common skeleton cases).
+const CONFUSABLES = {
+  'а': 'a', 'в': 'b', 'е': 'e', 'ё': 'e', 'к': 'k', 'м': 'm', 'н': 'h', 'о': 'o', 'р': 'p', 'с': 'c', 'т': 't', 'у': 'y', 'х': 'x',
+  'ѕ': 's', 'і': 'i', 'ї': 'i', 'ј': 'j', 'ԁ': 'd', 'ԛ': 'q', 'ԝ': 'w', 'һ': 'h', 'ɡ': 'g', 'ɩ': 'i', 'ʏ': 'y', 'ʟ': 'l',
+  'α': 'a', 'ο': 'o', 'ν': 'v', 'ρ': 'p', 'τ': 't', 'υ': 'u', 'ι': 'i', 'κ': 'k', 'χ': 'x', 'ϲ': 'c', 'ϳ': 'j',
+  'А': 'A', 'В': 'B', 'Е': 'E', 'К': 'K', 'М': 'M', 'Н': 'H', 'О': 'O', 'Р': 'P', 'С': 'C', 'Т': 'T', 'Х': 'X', 'Ѕ': 'S', 'І': 'I', 'Ј': 'J',
+  'Α': 'A', 'Β': 'B', 'Ε': 'E', 'Ζ': 'Z', 'Η': 'H', 'Ι': 'I', 'Κ': 'K', 'Μ': 'M', 'Ν': 'N', 'Ο': 'O', 'Ρ': 'P', 'Τ': 'T', 'Υ': 'Y', 'Χ': 'X',
+  'ı': 'i', 'ℓ': 'l', '０': '0', '１': '1', 'ⅼ': 'l', 'ⅰ': 'i',
+};
+
+/** A name as it is drawn: confusable letters swapped for the Latin ones they look like, compatibility forms folded, lower case. */
+export function nameSkeleton(name) {
+  const folded = String(name ?? '').normalize('NFKC');
+  return Array.from(folded, (ch) => CONFUSABLES[ch] ?? ch).join('').toLowerCase();
+}
+
+/**
+ * What is misleading about a name: hidden characters, letters of another script that look Latin, a look-alike of
+ * a known name.
+ * @param {string} name
+ * @param {string[]} [known] names it must not pass for (the bundled skills, say)
+ * @returns {{ hidden: object[], confusable: boolean, skeleton: string, impersonates: string | null, scripts: string[] }}
+ */
+export function inspectName(name, known = []) {
+  const s = String(name ?? '');
+  const hidden = findHiddenChars(s, { identifier: true });
+  const skeleton = nameSkeleton(s);
+  const confusable = Array.from(s).some((ch) => ch in CONFUSABLES);
+  const scripts = new Set();
+  for (const ch of s) {
+    if (/\p{Script=Latin}/u.test(ch)) scripts.add('Latin');
+    else if (/\p{Script=Cyrillic}/u.test(ch)) scripts.add('Cyrillic');
+    else if (/\p{Script=Greek}/u.test(ch)) scripts.add('Greek');
+    else if (/\p{L}/u.test(ch)) scripts.add('other');
+  }
+  const plain = s.toLowerCase();
+  const impersonates = (known || []).find((k) => {
+    const ref = String(k ?? '').toLowerCase();
+    return ref && ref !== plain && nameSkeleton(ref) === skeleton;
+  }) || null;
+  return { hidden, confusable, skeleton, impersonates, scripts: [...scripts] };
+}