synabun 2.0.10 → 2.2.0

package/neural-interface/lib/assistant-brains/antigravity.js

@@ -0,0 +1,423 @@
+// ═══════════════════════════════════════════
+// SynaBun — Assistant brain: Google Antigravity (`agy acp`, in the brain's own Antigravity home)
+// ═══════════════════════════════════════════
+//
+// One `agy acp` process and one ACP session per Assistant session (lib/antigravity/acp-connection.js), started in
+// the brain's own Antigravity home (lib/antigravity/home.js: `--gemini-dir`): SynaBun's MCP server (its child gets
+// the assistant role, the session pin, the desktop grant and the brain's credential from the agent's environment)
+// beside the user's own servers, the user's global rules and skills, and the policy hook that asks this process
+// about every tool call before it runs (lib/antigravity/policy.js → deps.policyCheck: the browser policy, plan mode,
+// a remote session's read-only rules and the route gate; a refusal reaches the model with its reason and the turn
+// goes on). The persona rides as the session's appended system prompt (_meta.antigravity.systemPrompt.append, which
+// agy advertises in initialize). ACP session/update notifications become the unified envelope
+// (assistant-envelope.js createAcpEnvelopeTranslator); a permission request the approval mode does not answer
+// becomes a card (control_request), answered once (never "always": Antigravity would save it for later sessions).
+// The model and the thinking level are the session's config options, switched per turn; images ride as ACP image
+// blocks; Stop is session/cancel; a resumed conversation is session/resume (no replay) in the same home.
+
+import { randomUUID } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { acpErrorInfo, createAcpConnection, isAuthRequired } from '../antigravity/acp-connection.js';
+import { assertSafeAntigravityProject, antigravityHomeReadPolicy, antigravityHomeSettings, homeMcpTools, policyHookCommand, prepareAntigravityHome, toAntigravityMcpEntry, userAntigravityMcpServers, userAntigravitySettings, userGeminiDir } from '../antigravity/home.js';
+import { acpCall, acpReadOnlyKind, acpToolPaths, acpUiToolName } from '../antigravity/tool-call.js';
+import { splitAntigravityModel } from '../antigravity/catalog.js';
+import { acpTurnUsage } from '../antigravity/usage.js';
+import { createAcpEnvelopeTranslator } from '../assistant-envelope.js';
+import { planModeInstructions } from '../assistant-persona.js';
+
+/** The hook script of every SynaBun Antigravity home. */
+export const ANTIGRAVITY_BRAIN_POLICY_HOOK = fileURLToPath(new URL('../antigravity/policy-hook.mjs', import.meta.url));
+const CANCEL_GRACE_MS = 8_000;
+const MCP_WATCH_MS = 120_000;
+const LEVELS = new Set(['minimal', 'low', 'medium', 'high', 'xhigh', 'max']);
+
+/** The Assistant's Antigravity approval mode: 'auto' (every call the policy allows runs) or 'default' (cards). */
+export function antigravityApprovalMode(mode) {
+  return mode === 'auto' || mode === 'acceptEdits' || mode === 'bypassPermissions' ? 'auto' : 'default';
+}
+
+/** Composer images ({ base64 | data, mediaType }) → ACP image blocks. */
+export function acpImageBlocks(images = []) {
+  const blocks = [];
+  for (const image of Array.isArray(images) ? images : []) {
+    let data = image?.base64 || image?.data || null;
+    let mimeType = image?.mediaType || image?.media_type || image?.mime || image?.mimeType || 'image/png';
+    if (!data || typeof data !== 'string') continue;
+    const inline = /^data:([^;,]+);base64,(.*)$/s.exec(data);
+    if (inline) { mimeType = inline[1]; data = inline[2]; }
+    blocks.push({ type: 'image', mimeType, data });
+  }
+  return blocks;
+}
+
+/** The ACP permission option for an answer: explicit kinds only, never allow-always. */
+function permissionOption(options, wanted) {
+  const list = Array.isArray(options) ? options.filter((option) => option && typeof option.optionId === 'string') : [];
+  for (const kind of wanted) {
+    if (kind === 'allow_always') continue;
+    const found = list.find((option) => option.kind === kind);
+    if (found) return found.optionId;
+  }
+  return null;
+}
+
+/**
+ * The MCP servers of a brain's home: SynaBun's own entry, then every enabled server of the user's own Antigravity
+ * configuration (a brain keeps the user's servers, as a Claude brain keeps the user's settings).
+ */
+export function antigravityBrainServers({ synabunMcpEntry = null, userGemini = userGeminiDir() } = {}) {
+  const servers = {};
+  const user = userAntigravityMcpServers(userGemini);
+  const own = synabunMcpEntry || user.SynaBun || null;
+  if (own) servers.SynaBun = toAntigravityMcpEntry(own);
+  for (const [name, entry] of Object.entries(user)) {
+    if (name === 'SynaBun' || entry?.disabled === true) continue;
+    servers[name] = toAntigravityMcpEntry(entry);
+  }
+  return servers;
+}
+
+export function createAntigravityBrain({ session, sink, deps = {}, persona = '' } = {}) {
+  if (typeof deps.antigravityLaunch !== 'function') throw new Error('Antigravity brain requires deps.antigravityLaunch');
+  const brain = session.brain || {};
+  const cwd = brain.cwd || deps.PACKAGE_ROOT || process.cwd();
+  const connect = typeof deps.connect === 'function' ? deps.connect : createAcpConnection;
+  const homeDir = typeof deps.antigravityHome === 'function' ? deps.antigravityHome(session.id) : null;
+  const userGemini = deps.userGemini || userGeminiDir();
+  const remoteReadOnly = deps.remoteReadOnly === true;
+  let approvalMode = antigravityApprovalMode(brain.permissionMode);
+  let planMode = brain.planMode === true || brain.permissionMode === 'plan';
+  let conn = null;
+  let sessionId = session.providerSessionId || null;
+  let resumeWanted = !!sessionId;
+  let registration = null;
+  let configOptions = [];
+  let turn = null; // { planned, cancelled, cancelTimer, model }
+  let lastSessionUsage = deps.sessionUsageBase && typeof deps.sessionUsageBase === 'object' ? deps.sessionUsageBase : null;
+  let startPromise = null;
+  let disposed = false;
+  let mcpTimer = null;
+  let mcpReported = null;
+  let replaying = false;
+  const pendingControls = new Map(); // requestId → { resolve, options }
+
+  const emit = (packet) => { if (!disposed) sink.send(packet); };
+  const note = (text) => emit({ type: 'stderr', text });
+  const optionOf = (category) => configOptions.find((o) => o?.category === category || o?.id === category) || null;
+  const valuesOf = (option) => {
+    const out = [];
+    for (const entry of option?.options || []) for (const v of Array.isArray(entry?.options) ? entry.options : [entry]) if (v && v.value !== undefined) out.push(String(v.value));
+    return out;
+  };
+  const currentValue = (category) => { const option = optionOf(category); return option?.currentValue !== undefined && option?.currentValue !== null ? String(option.currentValue) : null; };
+
+  const translator = createAcpEnvelopeTranslator({
+    emit,
+    brain: { cwd, sessionId: () => sessionId, model: () => currentValue('model') || brain.model || null },
+    planTurn: () => turn?.planned === true,
+  });
+  emit({ type: 'engine', engine: 'antigravity', brain: 'antigravity' });
+
+  function applyModes(mode, plan) {
+    if (mode === 'plan') planMode = true;
+    else if (mode) approvalMode = antigravityApprovalMode(mode);
+    if (typeof plan === 'boolean') planMode = plan;
+  }
+
+  /**
+   * The policy hook's question for this brain: first the runtime's checks (deps.policyCheck: browser policy, plan mode, remote read-only, route gate); then the approval
+   * mode: auto lets every call run, default lets reads and SynaBun's own tools run and asks about the rest.
+   */
+  function policyCheck(call) {
+    let verdict = null;
+    try { verdict = typeof deps.policyCheck === 'function' ? deps.policyCheck(call) : null; } catch (error) { return { decision: 'deny', reason: `SynaBun could not check this call (${error?.message || error}).` }; }
+    if (verdict?.decision === 'deny') return verdict;
+    const homeRead = antigravityHomeReadPolicy(call, { homeDir, cwd });
+    if (homeRead) return homeRead;
+    if (remoteReadOnly || approvalMode === 'auto') return { decision: 'allow' };
+    if (acpReadOnlyKind(call.kind)) return { decision: 'allow' };
+    if (call.mcp?.server === 'SynaBun') return { decision: 'allow' };
+    return { decision: 'ask' };
+  }
+
+  function cancelControls(reason = 'turn_ended') {
+    for (const [requestId, pending] of pendingControls) {
+      pendingControls.delete(requestId);
+      emit({ type: 'control_cancelled', request_id: requestId, reason });
+      try { pending.resolve({ outcome: { outcome: 'cancelled' } }); } catch { /* answered */ }
+    }
+  }
+
+  async function onPermission(params, { signal } = {}) {
+    if (disposed) return { outcome: { outcome: 'cancelled' } };
+    const call = acpCall(params);
+    const options = params?.options || [];
+    const pick = (kinds) => {
+      const optionId = permissionOption(options, kinds);
+      return optionId ? { outcome: { outcome: 'selected', optionId } } : { outcome: { outcome: 'cancelled' } };
+    };
+    const verdict = policyCheck(call);
+    // The hook asked first; a refusal reaching here (a call the hook never saw) ends the turn, as a user's would.
+    if (verdict.decision === 'deny') return pick(['reject_once', 'reject_always']);
+    if (verdict.decision === 'allow') return pick(['allow_once']);
+    const requestId = `agy-${randomUUID()}`;
+    const packet = {
+      type: 'control_request',
+      request_id: requestId,
+      request: {
+        subtype: 'can_use_tool', provider: 'antigravity', kind: 'permission',
+        tool_name: acpUiToolName(call),
+        input: call.mcp ? { ...call.mcp.args } : { ...call.args, ...(call.command ? { command: call.command } : {}) },
+        title: call.title || null,
+        brain_native: { kind: 'permission', toolCallId: call.id, sessionId: params?.sessionId || sessionId, toolCall: params?.toolCall || null },
+      },
+    };
+    return new Promise((resolveAnswer) => {
+      pendingControls.set(requestId, { resolve: resolveAnswer, options });
+      signal?.addEventListener?.('abort', () => {
+        if (!pendingControls.delete(requestId)) return;
+        emit({ type: 'control_cancelled', request_id: requestId, reason: 'withdrawn' });
+        resolveAnswer({ outcome: { outcome: 'cancelled' } });
+      }, { once: true });
+      emit(packet);
+    });
+  }
+
+  function reportMcp() {
+    if (!homeDir) return null;
+    const tools = homeMcpTools(homeDir, 'SynaBun');
+    const status = tools.length ? 'connected' : null;
+    if (status && mcpReported !== status) {
+      mcpReported = status;
+      emit({ type: 'event', event: { type: 'system', subtype: 'mcp_status', servers: [{ name: 'SynaBun', status, tools: tools.length }] } });
+    }
+    return status;
+  }
+  function watchMcp() {
+    if (!homeDir || mcpTimer) return;
+    const until = Date.now() + MCP_WATCH_MS;
+    mcpTimer = setInterval(() => {
+      if (disposed || reportMcp() || Date.now() > until) { clearInterval(mcpTimer); mcpTimer = null; }
+    }, 1000);
+    mcpTimer.unref?.();
+  }
+
+  async function openSession() {
+    const meta = persona ? { antigravity: { systemPrompt: { append: persona } } } : undefined;
+    const init = await conn.initialize();
+    let answer = null;
+    if (sessionId && resumeWanted) {
+      const caps = init?.agentCapabilities?.sessionCapabilities || {};
+      // agy 1.4.12 sends the conversation's history again while it resumes (session/resume as session/load): the
+      // panel has it already, so nothing that arrives before the answer is shown.
+      replaying = true;
+      try {
+        answer = await conn.request(caps.resume ? 'session/resume' : 'session/load', { sessionId, cwd, mcpServers: [], ...(meta ? { _meta: meta } : {}) });
+        sessionId = String(answer?.sessionId || sessionId);
+      } catch (error) {
+        if (isAuthRequired(error)) throw error;
+        note(`Antigravity could not resume its conversation (${acpErrorInfo(error).message}); this brain starts a new one.`);
+        answer = null;
+        sessionId = null;
+      } finally {
+        replaying = false;
+      }
+    }
+    if (!answer) {
+      answer = await conn.request('session/new', { cwd, mcpServers: [], ...(meta ? { _meta: meta } : {}) });
+      sessionId = String(answer?.sessionId || '');
+      if (!sessionId) throw new Error('Antigravity did not return a session id');
+      lastSessionUsage = null;
+    }
+    resumeWanted = false;
+    configOptions = Array.isArray(answer?.configOptions) ? answer.configOptions : [];
+    try { deps.onAntigravitySession?.(sessionId); } catch { /* bookkeeping */ }
+    reportMcp();
+    watchMcp();
+  }
+
+  async function boot() {
+    if (disposed) throw new Error('Antigravity brain disposed');
+    const launch = deps.antigravityLaunch();
+    if (!launch?.command) throw new Error('The Antigravity CLI (agy) is not installed. Install it from the Antigravity side panel, sign in there, then try again — or switch the Assistant to another provider.');
+    assertSafeAntigravityProject(cwd);
+    let hookCommand = null;
+    if (homeDir) {
+      if (deps.policy?.register && deps.policyUrl) hookCommand = policyHookCommand({ script: deps.policyHookScript || ANTIGRAVITY_BRAIN_POLICY_HOOK });
+      prepareAntigravityHome({
+        dir: homeDir,
+        mcpServers: antigravityBrainServers({ synabunMcpEntry: typeof deps.synabunMcpEntry === 'function' ? deps.synabunMcpEntry() : deps.synabunMcpEntry, userGemini }),
+        hookCommand,
+        settings: antigravityHomeSettings({ userSettings: userAntigravitySettings(userGemini) }),
+        userGemini,
+      });
+    }
+    if (hookCommand) registration = deps.policy.register((call) => (disposed ? { decision: 'deny', reason: 'This Assistant session ended.' } : policyCheck(call)), { label: `brain ${session.id}` });
+    const base = typeof deps.childEnv === 'function' ? deps.childEnv() : { ...process.env };
+    for (const key of ['SYNABUN_TOOLS', 'SYNABUN_TOOLS_PATH', 'SYNABUN_PROFILE', 'SYNABUN_RUNTIME_PROFILE_PATH', 'SYNABUN_TOOL_CATALOG_MODE', 'SYNABUN_AGY_POLICY_URL', 'SYNABUN_AGY_POLICY_TOKEN', 'SYNABUN_BROWSER_SESSION', 'SYNABUN_BROWSER_TAB']) delete base[key];
+    const env = {
+      ...base,
+      // The brain's SynaBun MCP child (stdio) reads who it serves from here (mcp-server/src/services/identity.ts).
+      SYNABUN_ROLE: 'assistant',
+      SYNABUN_TERMINAL_SESSION: String(session.id),
+      ...(deps.desktopGrant ? { SYNABUN_DESKTOP_GRANT: String(deps.desktopGrant) } : {}),
+      ...(deps.brainCredential ? { SYNABUN_BRAIN_TOKEN: String(deps.brainCredential) } : {}),
+      ...(registration ? { SYNABUN_AGY_POLICY_URL: deps.policyUrl, SYNABUN_AGY_POLICY_TOKEN: registration.token } : {}),
+    };
+    conn = connect({
+      command: launch.command,
+      args: launch.args || [],
+      acpArgs: homeDir ? ['--gemini-dir', homeDir] : [],
+      cwd,
+      env,
+      clientInfo: { name: 'synabun', title: 'SynaBun Assistant', version: '0' },
+      onUpdate: (params) => {
+        if (disposed || replaying || !params?.update || !sessionId || params.sessionId !== sessionId) return;
+        // Between turns only titles and the like count: a stray message of a turn that already ended is not shown.
+        if (!turn && params.update.sessionUpdate !== 'session_info_update') return;
+        translator.handle(params.update);
+      },
+      onPermission,
+      onExit: (info) => {
+        if (disposed) return;
+        cancelControls('agent_exited');
+        const why = info?.error || (info?.signal ? `signal ${info.signal}` : `code ${info?.code}`);
+        if (turn) finishTurn(null, new Error(`Antigravity exited (${why})${info?.stderr ? `: ${String(info.stderr).trim().split('\n').slice(-2).join(' ')}` : ''}`));
+        else note(`Antigravity exited (${why}); the next message starts it again.`);
+        conn = null;
+        startPromise = null;
+        resumeWanted = !!sessionId;
+      },
+    });
+    try {
+      await openSession();
+    } catch (error) {
+      const auth = isAuthRequired(error);
+      const message = auth ? 'Antigravity is not signed in: open the Antigravity panel (or run `agy` in a terminal) and sign in, then try again.' : `Antigravity could not start: ${acpErrorInfo(error).message}`;
+      registration?.dispose();
+      registration = null;
+      try { await conn?.close(); } catch { /* gone */ }
+      conn = null;
+      startPromise = null;
+      throw Object.assign(new Error(message), { code: auth ? 'AUTH_REQUIRED' : 'START_FAILED' });
+    }
+    return true;
+  }
+  function start() {
+    if (!startPromise) startPromise = boot();
+    return startPromise;
+  }
+
+  async function setOption(category, value, label) {
+    const option = optionOf(category);
+    if (!value || !option) return;
+    if (String(option.currentValue) === String(value)) return;
+    const accepted = valuesOf(option);
+    if (accepted.length && !accepted.includes(String(value))) { note(`Antigravity offers no ${label} "${value}" here; it keeps ${option.currentValue}.`); return; }
+    try {
+      const answer = await conn.request('session/set_config_option', { sessionId, configId: option.id, value: String(value) });
+      if (Array.isArray(answer?.configOptions)) configOptions = answer.configOptions;
+    } catch (error) { note(`Antigravity kept its ${label} (${acpErrorInfo(error).message}).`); }
+  }
+  /** The turn's model and thinking level (the record may have changed since the session started; a routed turn names its own). */
+  async function applyModel(model, effort) {
+    const wanted = splitAntigravityModel(model, valuesOf(optionOf('model')));
+    if (wanted.model) await setOption('model', wanted.model, 'model');
+    const level = effort && LEVELS.has(String(effort).toLowerCase()) ? String(effort).toLowerCase() : wanted.effort;
+    if (level) await setOption('thought_level', level, 'thinking level');
+  }
+
+  function finishTurn(answer, error = null) {
+    const current = turn;
+    if (!current) return;
+    turn = null;
+    if (current.cancelTimer) clearTimeout(current.cancelTimer);
+    cancelControls('turn_ended');
+    const usage = answer?.usage ? acpTurnUsage(answer.usage, lastSessionUsage) : null;
+    if (answer?.usage) {
+      lastSessionUsage = answer.usage;
+      try { deps.onAntigravitySessionUsage?.(sessionId, answer.usage); } catch { /* bookkeeping */ }
+    }
+    if (usage) { try { deps.onAntigravityUsage?.({ usage, model: currentValue('model') || brain.model || null, sessionId }); } catch { /* metering never breaks a turn */ } }
+    const stopReason = current.cancelled ? 'cancelled' : (answer?.stopReason || 'end_turn');
+    translator.endTurn({ stopReason, usage, error: error && !current.cancelled ? (error.message || String(error)) : null, planned: current.planned === true });
+  }
+
+  async function runPrompt(blocks, { planned = false } = {}) {
+    translator.reset();
+    turn = { planned, cancelled: false, cancelTimer: null };
+    const mine = turn;
+    conn.request('session/prompt', { sessionId, prompt: blocks }, { timeoutMs: 0 })
+      .then((answer) => { if (turn === mine) finishTurn(answer); })
+      .catch((error) => { if (turn === mine) finishTurn(null, new Error(acpErrorInfo(error).message)); });
+  }
+
+  return {
+    kind: 'antigravity',
+    start,
+    async sendUserTurn({ text, images = [], model = null, effort = null, permissionMode: mode = null, planMode: plan = null } = {}) {
+      await start();
+      if (disposed || !conn) return false;
+      if (turn) throw new Error('Antigravity is still answering the last message');
+      applyModes(mode, plan);
+      if (resumeWanted && sessionId) await openSession();
+      await applyModel(model || brain.model || null, effort || brain.effort || null);
+      // A plan turn carries what plan mode means here (a remote session's read-only brain does not).
+      const planned = planMode && !remoteReadOnly;
+      const body = planned ? `<system-reminder>\n${planModeInstructions({ provider: 'antigravity' })}\n</system-reminder>\n\n${String(text ?? '')}` : String(text ?? '');
+      await runPrompt([{ type: 'text', text: body }, ...acpImageBlocks(images)], { planned });
+      return true;
+    },
+    async abort() {
+      if (!turn) { cancelControls('stopped'); return; }
+      const current = turn;
+      current.cancelled = true;
+      cancelControls('stopped');
+      try { if (conn && sessionId) await conn.notify('session/cancel', { sessionId }); } catch { /* the answer or the grace timer ends it */ }
+      // An agent that never answers the cancelled prompt: the turn ends here anyway.
+      current.cancelTimer = setTimeout(() => { if (turn === current) finishTurn(null); }, CANCEL_GRACE_MS);
+      current.cancelTimer.unref?.();
+    },
+    async setPermissionMode(mode, { planMode: plan = null } = {}) { applyModes(mode, plan); emit({ type: 'mode_changed', mode: approvalMode, planMode }); },
+    respondControl(requestId, response = {}) {
+      const pending = pendingControls.get(String(requestId));
+      if (!pending) { emit({ type: 'error', message: `No pending Antigravity request ${requestId}` }); return; }
+      pendingControls.delete(String(requestId));
+      // Once, whatever the answer says about "always": Antigravity would save it for every later session.
+      const allow = response?.behavior === 'allow';
+      const optionId = permissionOption(pending.options, allow ? ['allow_once'] : ['reject_once', 'reject_always']);
+      pending.resolve(optionId ? { outcome: { outcome: 'selected', optionId } } : { outcome: { outcome: 'cancelled' } });
+    },
+    // Antigravity's own /compact command, as a turn of its own (busy until it ends).
+    async compact() {
+      await start();
+      if (disposed || !conn || turn) return;
+      await runPrompt([{ type: 'text', text: '/compact' }]);
+    },
+    async mcpStatus() { if (!reportMcp()) emit({ type: 'event', event: { type: 'system', subtype: 'mcp_status', servers: [] } }); },
+    // The conversation to pick up: resumed before the next message (session/resume in the brain's home).
+    async resume(id) { if (!id) return; sessionId = String(id); resumeWanted = true; lastSessionUsage = null; },
+    async listSessions() { return []; },
+    isBusy() { return !!turn || pendingControls.size > 0; },
+    // The route gate: its hook checks every call before it runs; without one (no policy wired) the runtime checks
+    // the tool starts it sees (the reactive fallback).
+    get gateMode() { return registration ? 'hook' : 'reactive'; },
+    identity() {
+      return { providerSessionId: sessionId, providerThreadId: null, accountId: null, model: currentValue('model') || brain.model || null, effort: currentValue('thought_level') || brain.effort || null, cwd, busy: !!turn, home: homeDir };
+    },
+    async dispose() {
+      if (disposed) return;
+      const wasRunning = !!turn;
+      cancelControls('brain_disposed');
+      if (wasRunning && conn && sessionId) { try { await conn.notify('session/cancel', { sessionId }); } catch { /* closing anyway */ } }
+      disposed = true;
+      if (mcpTimer) { clearInterval(mcpTimer); mcpTimer = null; }
+      if (turn?.cancelTimer) clearTimeout(turn.cancelTimer);
+      turn = null;
+      registration?.dispose();
+      registration = null;
+      try { await conn?.close(); } catch { /* gone */ }
+      conn = null;
+    },
+  };
+}

package/neural-interface/lib/assistant-brains/claude.js

@@ -123,10 +123,11 @@ export function createClaudeBrain({ session, sink, deps = {}, persona = '', hook
       'X-Synabun-Role': 'assistant', 'X-Synabun-Terminal': session.id, 'X-Synabun-Memory-Session': session.id,
       ...(deps.desktopGrant ? { 'X-Synabun-Desktop-Grant': deps.desktopGrant } : {}),
       ...mcpHeaders,
-      // A WhatsApp conversation's brain credential (whatsapp_send_file). The header names the variable and
+      // This brain launch's credential (assistant-runtime.js mintBrainCredential). The header names the variable and
       // the CLI expands it from its own environment (below): the MCP config is on its command line, which every
       // account of the computer can read, an environment only this user's processes. The in-process MCP server
-      // keeps the value for the request it arrived with, and sends it on the file route alone. Last, so nothing replaces it.
+      // keeps the value for the request it arrived with, and sends it only to the routes that ask who the brain is
+      // (whatsapp_send_file, the Skills Service). Last, so nothing replaces it.
       ...(deps.brainCredential ? { 'X-Synabun-Brain-Token': '${SYNABUN_BRAIN_TOKEN}' } : {}),
     },
     // A remote (WhatsApp) session never pre-approves computer use: its PreToolUse hook refuses, asks or allows each call.
@@ -143,7 +144,7 @@ export function createClaudeBrain({ session, sink, deps = {}, persona = '', hook
       ...(typeof deps.claudeAccountEnv === 'function' ? deps.claudeAccountEnv(brain.accountId) : {}),
       SYNABUN_ASSISTANT_SESSION: String(session.id),
       ...(deps.userContextThreads === true ? { SYNABUN_ASSISTANT_THREADS: '1' } : {}),
-      // The value of the X-Synabun-Brain-Token header above (a WhatsApp conversation's brain only).
+      // The value of the X-Synabun-Brain-Token header above.
       ...(deps.brainCredential ? { SYNABUN_BRAIN_TOKEN: deps.brainCredential } : {}),
     },
     maxBudgetUsd: Number(deps.maxBudgetUsd) > 0 ? Number(deps.maxBudgetUsd) : undefined,

package/neural-interface/lib/assistant-brains/codex-browser-policy-hook.mjs

@@ -6,7 +6,9 @@
 // PreToolUse payload from stdin and asks lib/browser-tool-policy.js here, with
 // no server round trip; a refusal becomes permissionDecision "deny" with the
 // reason. Script paths resolve against the payload's cwd, else
-// SYNABUN_BROWSER_POLICY_CWD (the run's project). An unreadable payload allows
+// SYNABUN_BROWSER_POLICY_CWD (the run's project); SYNABUN_BROWSER_POLICY_ROOTS
+// (a JSON list, written as the run starts) names the registered code projects
+// its test runners may also run in. An unreadable payload allows
 // the call: the policy is a speed bump, not a sandbox. A policy module that
 // cannot load fails closed (logged on stderr): shell commands, web search and
 // every MCP tool but SynaBun's are denied with that reason.
@@ -25,6 +27,14 @@ function unloadedDenial(tool) {
   return `SynaBun browser policy: ${tool} was refused — SynaBun's browser policy could not load (${loadError?.message || 'browserToolDenial is missing'}), so no command, web search or other server's tool can be checked for a browser launch. SynaBun's own tools still work. Stop and report this`;
 }
 
+/** The registered code projects from the env (a JSON list of paths); anything unreadable is none. */
+function policyRoots() {
+  try {
+    const list = JSON.parse(process.env.SYNABUN_BROWSER_POLICY_ROOTS || '[]');
+    return Array.isArray(list) ? list.filter((path) => typeof path === 'string') : [];
+  } catch { return []; }
+}
+
 let raw = '';
 try { for await (const chunk of process.stdin) raw += chunk; } catch {}
 let payload = {};
@@ -35,7 +45,7 @@ try {
   const input = payload.tool_input && typeof payload.tool_input === 'object' ? payload.tool_input : {};
   const cwd = (typeof payload.cwd === 'string' && payload.cwd) || process.env.SYNABUN_BROWSER_POLICY_CWD || process.cwd();
   if (typeof browserToolDenial !== 'function') process.stderr.write(`[SynaBun] browser policy could not load (${loadError?.message || 'browserToolDenial is missing'}); denying shell, web search and other servers' tools\n`);
-  const reason = !tool ? null : typeof browserToolDenial === 'function' ? browserToolDenial(tool, input, { host: 'codex', cwd }) : unloadedDenial(tool);
+  const reason = !tool ? null : typeof browserToolDenial === 'function' ? browserToolDenial(tool, input, { host: 'codex', cwd, roots: policyRoots() }) : unloadedDenial(tool);
   // Codex prints "Command blocked by PreToolUse hook: <reason>. Command: <cmd>", so
   // the reason goes without its own final period.
   if (reason) process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason.replace(/[.\s]+$/, '') } }));

package/neural-interface/lib/assistant-brains/codex-route-gate-hook.mjs

@@ -4,9 +4,19 @@
 // tool may run; a refusal becomes permissionDecision "deny" with the reason.
 // The call's whole tool_input travels (the remote denylist reads paths from
 // it), marked inputComplete; one too big to send goes as its command/action
-// only, marked incomplete. Any failure (no env, server unreachable, bad reply)
-// allows the call — except in a WhatsApp session (SYNABUN_ROUTE_GATE_REMOTE=1),
-// where a call SynaBun could not check is denied.
+// only, marked incomplete. No env or no answer at all (the server unreachable
+// or slow) allows the call — except in a WhatsApp session
+// (SYNABUN_ROUTE_GATE_REMOTE=1), where a call SynaBun could not check is
+// denied. An answer that is not a decision (the check itself refused, such as
+// 403 PEER_REFUSED, an error status, a body without `allow`) denies the call in
+// every session and says what SynaBun answered: a refusal never passes for an
+// allow.
+//
+// The request carries the session's pin (X-Synabun-Assistant): this hook runs
+// under the brain's Codex app-server, an AI agent's process tree, which
+// SynaBun's owner gate (lib/owner-authority.js) refuses unless the call says
+// it is an agent's own. The per-session token in the body is what the route
+// itself checks.
 
 const url = process.env.SYNABUN_ROUTE_GATE_URL;
 const session = process.env.SYNABUN_ROUTE_GATE_SESSION;
@@ -14,6 +24,7 @@ const token = process.env.SYNABUN_ROUTE_GATE_TOKEN;
 const remote = process.env.SYNABUN_ROUTE_GATE_REMOTE === '1';
 const MAX_INPUT_BYTES = 256 * 1024;
 const UNCHECKED = 'SynaBun could not check this call, so a WhatsApp session does not run it.';
+const PIN_HEADER = 'x-synabun-assistant';
 
 let raw = '';
 try { for await (const chunk of process.stdin) raw += chunk; } catch {}
@@ -37,20 +48,32 @@ function callArguments(toolInput) {
 function deny(reason) {
   process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: String(reason).replace(/[.\s]+$/, '') } }));
 }
+/** The refusal of a call whose check got an answer that is not a decision: what SynaBun answered, in short. */
+function notADecision(status, body) {
+  const code = body && typeof body === 'object' && typeof body.code === 'string' ? ` ${body.code.slice(0, 64)}` : '';
+  const said = body && typeof body === 'object' && typeof body.error === 'string' ? `: ${body.error.slice(0, 300)}` : '';
+  return `SynaBun could not check this call (its route gate answered ${status}${code}${said}), so it did not run.`;
+}
 
 if (url && session && token) {
+  let response = null;
   try {
-    const response = await fetch(url, {
+    response = await fetch(url, {
       method: 'POST',
-      headers: { 'content-type': 'application/json' },
+      // The session id as a header value: printable ASCII only (fetch refuses anything else before sending).
+      headers: { 'content-type': 'application/json', [PIN_HEADER]: String(session).replace(/[^\x21-\x7e]/g, '').slice(0, 200) },
       body: JSON.stringify({ session, token, host: 'codex', tool: String(input.tool_name || input.toolName || input.tool || ''), agent: input.agent_id || null, ...callArguments(input.tool_input) }),
       signal: AbortSignal.timeout(5000),
     });
-    const decision = await response.json();
-    if (decision && decision.allow === false) deny(decision.reason || 'SynaBun refused this call.');
-    else if (remote && !(decision && decision.allow === true)) deny(UNCHECKED);
-  } catch {
+  } catch { response = null; }
+  if (!response) {
     if (remote) deny(UNCHECKED);
+  } else {
+    let decision = null;
+    try { decision = await response.json(); } catch { decision = null; }
+    if (response.ok && decision && decision.allow === true) { /* allowed: Codex runs the call */ }
+    else if (response.ok && decision && decision.allow === false) deny(decision.reason || 'SynaBun refused this call.');
+    else deny(notADecision(response.status, decision));
   }
 }
 process.exit(0);

package/neural-interface/lib/assistant-brains/codex.js

@@ -14,6 +14,8 @@ import { createCodexEnvelopeTranslator, codexControlResponse } from '../assistan
 import { baseModelId, contextVariantOf } from '../assistant-catalog.js';
 import { codexPlanPermission, codexReadOnlyPermission, planDenyMessage, readOnlyDenyMessage } from '../assistant-plan-permissions.js';
 import { planModeInstructions } from '../assistant-persona.js';
+import { shouldAutoAcceptCodexMcpToolApproval } from '../codex-mcp-approvals.js';
+import { codexMcpToolApproval } from '../../public/shared/cdx/cdx-protocol.js';
 
 const READY_TIMEOUT_MS = 90_000;
 // Approvals the Codex sidepanel's Auto-accept answers on its own (cdx-requests.js).
@@ -83,7 +85,7 @@ export function createCodexBrain({ session, sink, deps = {}, persona = '' } = {}
       }
       if (planned) {
         const method = packet.request?.brain_native?.method || packet.request?.method || '';
-        const tool = packet.request?.brain_native?.params?._meta?.tool_name || packet.request?.tool_name || 'request';
+        const tool = codexMcpToolApproval(packet.request?.brain_native?.params)?.fullName || packet.request?.tool_name || 'request';
         const response = planned === 'allow'
           ? { behavior: 'allow', ...(!remoteReadOnly && approvalMode === 'auto' ? { always: true } : {}) }
           : { behavior: 'deny', decline: true, message: remoteReadOnly ? readOnlyDenyMessage(tool) : planDenyMessage(tool, { host: 'codex' }) };
@@ -91,7 +93,9 @@ export function createCodexBrain({ session, sink, deps = {}, persona = '' } = {}
         sink.send({ type: 'stderr', text: `${planMode ? 'Plan mode' : 'Read-only (WhatsApp)'}: ${planned === 'allow' ? 'allowed' : 'declined'} ${String(method).split('/').slice(1, -1).join('/') || 'request'} ${tool}${planned === 'allow' ? '' : remoteReadOnly ? ' (read-only)' : ' (no code changes)'}` });
         return;
       }
-      if (packet.type === 'control_request' && !planMode && !remoteReadOnly && approvalMode === 'auto' && AUTO_ACCEPT_METHODS.has(packet.request?.brain_native?.method || packet.request?.method)) {
+      const method = packet.request?.brain_native?.method || packet.request?.method;
+      const autoMcp = method === 'mcpServer/elicitation/request' && shouldAutoAcceptCodexMcpToolApproval(packet.request?.brain_native?.params, { autoAccept: approvalMode === 'auto', role: 'assistant' });
+      if (packet.type === 'control_request' && !planMode && !remoteReadOnly && (autoMcp || (approvalMode === 'auto' && AUTO_ACCEPT_METHODS.has(method)))) {
         // Auto-accept: approve at once (for the session when offered), as the Codex sidepanel does.
         send({ type: 'server_request_response', ...codexControlResponse(packet, { behavior: 'allow', always: true }) });
         sink.send({ type: 'stderr', text: `Auto-accepted: ${String(packet.request?.brain_native?.method || packet.request?.method).split('/').slice(1, -1).join('/')}` });
@@ -119,8 +123,8 @@ export function createCodexBrain({ session, sink, deps = {}, persona = '' } = {}
   });
   const socket = createVirtualSocket({
     name: `codex-brain-${session.id}`,
-    // A WhatsApp conversation's brain credential rides on the socket object, never in a message: the skin
-    // handler gives it to this app-server's SynaBun MCP child through its environment (whatsapp_send_file).
+    // The brain's launch credential rides on the socket object, never in a message: the skin handler gives it to
+    // this app-server's SynaBun MCP child through its environment (whatsapp_send_file, the Skills Service).
     credential: deps.brainCredential || null,
     onSend: (packet) => {
       if (disposed || !packet || typeof packet !== 'object') return;
@@ -159,7 +163,7 @@ export function createCodexBrain({ session, sink, deps = {}, persona = '' } = {}
       readyResolve = () => { clearTimeout(timer); resolve(true); };
     });
     send({
-      type: 'bootstrap', windowId, accountId: brain.accountId || 'default', mcpProfile: brain.mcpProfile || null,
+      type: 'bootstrap', windowId, accountId: brain.accountId || 'default',
       cwd: brain.cwd || deps.PACKAGE_ROOT || undefined, threadId: threadId || null, role: 'assistant',
       // Unlocks the capability-gated `computer` MCP group for this brain only.
       desktopGrant: deps.desktopGrant || null,