synabun 2.0.10 → 2.2.0

package/neural-interface/lib/assistant-runtime.js

@@ -1,3 +1,5 @@
+import { OPENCODE_BRAIN_TOOLS } from './assistant-tools.js';
+import { storedToolList, toolListRecord } from './tool-lists.js';
 // ═══════════════════════════════════════════
 // SynaBun — Assistant runtime (sessions, brains, unified WebSocket, mailbox)
 // ═══════════════════════════════════════════
@@ -14,6 +16,10 @@ import { dirname, resolve } from 'node:path';
 import { createClaudeBrain } from './assistant-brains/claude.js';
 import { createCodexBrain } from './assistant-brains/codex.js';
 import { createOpenCodeBrain } from './assistant-brains/opencode.js';
+import { createAntigravityBrain } from './assistant-brains/antigravity.js';
+import { acpPolicyInput, acpReadOnlyKind, acpToolName } from './antigravity/tool-call.js';
+import { antigravityUsageTokens } from './assistant-usage.js';
+import { UNPRICED_PROVIDER_REASON } from './assistant-budget-split.js';
 import { buildAssistantPersona, formatMailbox, reconcileRouteItems } from './assistant-persona.js';
 import { normalizeTestDensity, testDensityStamp } from './assistant-test-density.js';
 import { codexUsageCostUsd, floorCents } from './assistant-budget.js';
@@ -31,13 +37,18 @@ import { codexRouteGateBootstrap } from './assistant-route-gate-codex.js';
 import { proposedPlanText } from './assistant-envelope.js';
 import { clampBrainModes, clampRouteMode, defaultRemotePolicyRegistry, effectiveLevel, isComputerTool, readRegisteredProjects, remoteBrainLimited, remoteComputerDenial, remoteComputerUse, remoteToolDenial, runExceedsPolicy } from './remote-policy.js';
 import { browserToolDenial } from './browser-tool-policy.js';
+import { browserPolicyRoots } from './browser-policy-roots.js';
+import { stripFollowups } from '../public/shared/assistant/asst-followups.js';
+import { readJsonStrict } from './rulesets/fs-safe.js';
 
-export const BRAIN_PROVIDERS = new Set(['claude-code', 'codex', 'opencode']);
+export const BRAIN_PROVIDERS = new Set(['claude-code', 'codex', 'opencode', 'antigravity']);
 // Every tab is called SynaBun; the session title (the history list) comes from
 // the first prompt. Legacy "Assistant N" titles still count as unnamed.
 export const DEFAULT_SESSION_TITLE = 'SynaBun';
 export function isDefaultSessionTitle(title) { return !title || /^(?:SynaBun|Assistant(?: \d+)?)$/.test(String(title).trim()); }
-const MAILBOX_REASONS = new Set(['turn_completed', 'needs_input', 'permission_request', 'failed', 'interrupted', 'stalled', 'budget_warning', 'budget_exceeded', 'budget_unpriced', 'queue_started', 'user_intervened', 'stopped']);
+// suspended / resumed: a Claude Code worker a server restart cut off, and its resume on the next start
+// (lib/assistant-dispatch.js); a run that could not be resumed arrives as interrupted, with why.
+const MAILBOX_REASONS = new Set(['turn_completed', 'needs_input', 'permission_request', 'failed', 'interrupted', 'stalled', 'budget_warning', 'budget_exceeded', 'budget_unpriced', 'queue_started', 'user_intervened', 'stopped', 'suspended', 'resumed']);
 // A stopped run reaches the brain when the user stopped it or it ran out of money.
 const MAILBOX_STOP_REASONS = new Set(['user', 'budget_cap', 'session_budget_cap', 'budget_unpriced', 'budget_share']);
 /** The `[SynaBun Budget]` line: a change of the session budget reaches the brain as one line before its next turn. */
@@ -129,25 +140,37 @@ function readJson(path, fallback) { try { return JSON.parse(readFileSync(path, '
 function writeJsonAtomic(path, value) {
   mkdirSync(dirname(path), { recursive: true });
   const tmp = `${path}.${process.pid}.tmp`;
-  writeFileSync(tmp, JSON.stringify(value, null, 2) + '\n', 'utf8');
-  renameSync(tmp, path);
+  try {
+    writeFileSync(tmp, JSON.stringify(value, null, 2) + '\n', 'utf8');
+    renameSync(tmp, path);
+  } catch (error) {
+    try { rmSync(tmp, { force: true }); } catch { /* held too: the next write replaces it */ }
+    throw error;
+  }
 }
+// What Windows answers, now and then, to a rename over a file another process holds open for a
+// moment (an antivirus or indexer scanning it, a backup, the desktop app's pre-update snapshot).
+const HELD_FILE_CODES = new Set(['EPERM', 'EACCES', 'EBUSY']);
+// A write of the sessions index refused that way is tried again after these waits.
+const INDEX_RETRY_MS = [200, 500, 1000, 2000, 5000, 10_000];
 function clip(value, max = 200) { const text = String(value ?? '').replace(/\s+/g, ' ').trim(); return text.length > max ? `${text.slice(0, max - 1)}…` : text; }
 
 /**
  * A brain effort checked against its model (effort-levels.js). "off" (or a
  * model with no levels) stays "off" for Claude and Codex, which reset to the
- * model's default on it; OpenCode has no such variant, so it gets null.
+ * model's default on it; OpenCode has no such variant and Antigravity's thinking
+ * level no "off" (its session keeps the model's own level), so they get null.
  */
 export function checkBrainEffort(provider, model, effort, catalog) {
   if (!effort) return null;
+  if (provider === 'antigravity' && /^(?:off|default|auto|none)$/i.test(String(effort))) return null;
   if (!catalog) return String(effort);
   const next = normalizeEffort({ provider, model, effort, catalog }).effort;
-  return next || (provider === 'opencode' ? null : 'off');
+  return next || (provider === 'opencode' || provider === 'antigravity' ? null : 'off');
 }
 
 /** `catalog` (a catalog value) checks the effort against the brain's model (effort-levels.js). */
-export function normalizeBrain(input = {}, defaults = {}, { catalog = null } = {}) {
+export function normalizeBrain(input = {}, defaults = {}, { catalog = null, customPresets = null } = {}) {
   // Plan mode is a flag beside the approval mode ('plan' as a mode is the legacy form).
   const legacyPlan = input?.permissionMode === 'plan';
   const provider = BRAIN_PROVIDERS.has(input?.provider) ? input.provider : (BRAIN_PROVIDERS.has(defaults.provider) ? defaults.provider : 'claude-code');
@@ -158,9 +181,10 @@ export function normalizeBrain(input = {}, defaults = {}, { catalog = null } = {
     model,
     effort: checkBrainEffort(provider, model, effort, catalog),
     agent: input?.agent ? String(input.agent) : null,
-    accountId: input?.accountId ? String(input.accountId) : (provider === 'opencode' ? null : 'default'),
+    // OpenCode and Antigravity sign in inside their own CLI: SynaBun keeps no account of theirs.
+    accountId: provider === 'antigravity' ? null : input?.accountId ? String(input.accountId) : (provider === 'opencode' ? null : 'default'),
     cwd: input?.cwd ? String(input.cwd) : (input?.project ? String(input.project) : (defaults.cwd || null)),
-    mcpProfile: input?.mcpProfile ? String(input.mcpProfile) : (provider === 'claude-code' ? 'full' : (defaults.mcpProfile || null)),
+    tools: provider === 'opencode' ? (storedToolList(input, { customPresets }) ?? storedToolList(defaults, { customPresets }) ?? [...OPENCODE_BRAIN_TOOLS]) : ['all'],
     permissionMode: input?.permissionMode && !legacyPlan ? String(input.permissionMode) : 'default',
     planMode: typeof input?.planMode === 'boolean' ? input.planMode : (legacyPlan || defaults?.planMode === true),
   };
@@ -188,6 +212,7 @@ export function mergeHooks(a, b) {
 }
 
 export function createAssistantRuntime({
+  toolListOptions = () => ({}),
   dispatcher = null,
   claudeAccounts = null,
   // lib/codex-accounts.js: a Codex brain whose account cannot run is refused before it starts.
@@ -199,6 +224,10 @@ export function createAssistantRuntime({
   ensureIsolatedServe = null,
   stopIsolatedServe = null,
   setupOpencodeSidepanelConfig = null,
+  // Antigravity brains (assistant-brains/antigravity.js): the CLI's launch spec, the environment its process gets,
+  // the brain's home (lib/antigravity/home.js), SynaBun's own MCP entry there, and the policy registry and loopback
+  // address its hook asks (lib/antigravity/policy.js).
+  antigravity = null,
   broadcastSync = () => {},
   dataDir,
   memory = null,
@@ -250,6 +279,7 @@ export function createAssistantRuntime({
   adminSandbox = null,
 } = {}) {
   if (!dataDir) throw new Error('createAssistantRuntime requires dataDir');
+  const normalizeSessionBrain = (input, defaults, options) => normalizeBrain(input, defaults, { ...options, ...toolListOptions() });
   const settings = {
     idleDisposeMs: Math.max(60_000, Number(config.idleDisposeMinutes || 120) * 60_000),
     // A draft (a session the panel opened, before its first prompt) with no socket attached goes after this.
@@ -314,12 +344,45 @@ export function createAssistantRuntime({
       || !!row.remote || !!row.channel || Number(row.costUsd) > 0;
     return holds ? 'unstarted' : 'empty';
   }
+  // Whether the index file may be written: it was read, or there was none. A file that could not be
+  // read (Windows: held by an antivirus or a backup) is never replaced by what this process holds;
+  // reading it is tried again (INDEX_RETRY_MS), and sessions made meanwhile join what it held.
+  let indexReady = false;
+  let indexReadTries = 0;
+  let indexBlockedLogged = false;
+  function readIndexRows() {
+    try {
+      const rows = readJsonStrict(indexPath);
+      if (Array.isArray(rows)) return rows;
+      const error = new Error(`${indexPath} does not hold a list`);
+      error.code = 'INVALID_JSON';
+      throw error;
+    } catch (error) {
+      if (error?.code === 'ENOENT') return [];
+      if (error?.code !== 'INVALID_JSON') throw error;
+      // A corrupt file is moved aside, never deleted, and the index starts again from what is live.
+      const aside = `${indexPath}.corrupt-${Date.now()}`;
+      renameSync(indexPath, aside);
+      log('assistant:index-corrupt', `${error.message}; moved to ${aside}`);
+      return [];
+    }
+  }
   function loadIndex() {
-    const rows = readJson(indexPath, []);
-    if (!Array.isArray(rows)) return;
+    let rows;
+    try { rows = readIndexRows(); } catch (error) {
+      log('assistant:index-unreadable', `${error?.code || ''} ${error?.message || String(error)}`.trim());
+      if (indexReadTries < INDEX_RETRY_MS.length) {
+        setTimeout(loadIndex, INDEX_RETRY_MS[indexReadTries++]).unref?.();
+      } else log('assistant:index-unreadable', `${indexPath} is left as it is; sessions of this run stay in memory only, until a restart reads it`);
+      return;
+    }
+    indexReady = true;
+    const late = sessions.size > 0; // sessions made while the file could not be read
     let dropped = 0;
     for (const row of rows) {
-      if (!row?.id) continue;
+      if (!row?.id || sessions.has(row.id)) continue;
+      try { row.brain = normalizeSessionBrain(row.brain); }
+      catch (error) { row.brain = { ...row.brain, tools: [], toolListError: { code: error.code, message: error.message, original: row.brain?.tools ?? row.brain?.mcpProfile } }; delete row.brain.mcpProfile; }
       if (settleLegacyRow(row) === 'empty') { dropped += 1; continue; }
       sessions.set(row.id, makeLive({ ...row, status: row.status === 'ended' ? 'ended' : 'idle', windowIds: [] }));
       // A remote session nobody registered again since the restart reads as read-only.
@@ -329,16 +392,34 @@ export function createAssistantRuntime({
       }
     }
     // The index is written again without them (and with the started marks).
-    if (dropped) { log('assistant:index', `${dropped} session record(s) without a conversation dropped`); persist(); }
+    if (dropped) log('assistant:index', `${dropped} session record(s) without a conversation dropped`);
+    if (dropped || late) persist();
   }
   let persistTimer = null;
+  let persistRetries = 0; // index writes Windows refused in a row (INDEX_RETRY_MS)
   function persist({ force = false } = {}) {
     const write = () => {
+      if (!indexReady) {
+        if (!indexBlockedLogged) { indexBlockedLogged = true; log('assistant:index', 'not written: the sessions index has not been read'); }
+        return;
+      }
       // A draft is never written: it exists on disk only once its first prompt was sent (startChat).
       const rows = [...sessions.values()].filter((live) => !live.draft).map((live) => publicRecord(live.record, { withLive: false, persisted: true }))
         .sort((a, b) => String(b.updatedAt || '').localeCompare(String(a.updatedAt || '')))
         .slice(0, settings.retention);
-      try { writeJsonAtomic(indexPath, rows); } catch (error) { log('assistant:index-error', error?.message || String(error)); }
+      try {
+        writeJsonAtomic(indexPath, rows);
+        persistRetries = 0;
+      } catch (error) {
+        log('assistant:index-error', error?.message || String(error));
+        // The records changed (a rename already answered as saved, among them) and the file did not: on
+        // Windows it is written again shortly, with whatever the records hold by then, instead of waiting
+        // for the next change (a restart before it would bring the old records back).
+        if (process.platform === 'win32' && HELD_FILE_CODES.has(error?.code) && persistRetries < INDEX_RETRY_MS.length && !persistTimer) {
+          persistTimer = setTimeout(() => { persistTimer = null; write(); }, INDEX_RETRY_MS[persistRetries++]);
+          persistTimer.unref?.();
+        } else persistRetries = 0;
+      }
     };
     if (force) { if (persistTimer) { clearTimeout(persistTimer); persistTimer = null; } write(); return; }
     if (persistTimer) return;
@@ -379,7 +460,7 @@ export function createAssistantRuntime({
       // Claude brains: the turns sent, keyed by their final text, for the in-process recall hook.
       turnMeta: new Map(),
       desktopGrant: null,
-      // A WhatsApp conversation's brain credential (mintBrainCredential): this launch only, never persisted.
+      // This brain launch's credential (mintBrainCredential): this launch only, never persisted.
       brainCredential: null,
       // Route gate (assistant-route-gate.js): one per session while routing is wired.
       // gatePluginAt: when the OpenCode serve loaded the gate plugin (until then, reactive).
@@ -903,17 +984,19 @@ export function createAssistantRuntime({
     if (!disabled && !defaultIsHidden(value, provider) && !providerAllHidden(value, provider)) return { brain, fallback: null };
     const note = (reason, row, to) => ({ reason, from: reason === 'model' ? model : provider, fromProvider: provider, to: row.id, provider: to, label: row.label || row.id });
     const same = enabledStandIn(value, provider, model);
-    if (same) return { brain: normalizeBrain({ ...brain, model: same.id }, {}, { catalog: value }), fallback: disabled ? note('model', same, provider) : null };
+    if (same) return { brain: normalizeSessionBrain({ ...brain, model: same.id }, {}, { catalog: value }), fallback: disabled ? note('model', same, provider) : null };
     // Every model of this provider is disabled (or an OpenCode model is, whose default is OpenCode's own).
     if (!fallback) throw disabled ? modelDisabledError(model) : everyModelDisabledError(provider);
     const other = [settings.defaultBrain.provider, 'claude-code'].find((p) => BRAIN_PROVIDERS.has(p) && p !== provider);
     const row = other ? enabledStandIn(value, other) : null;
     if (!row) throw disabled ? modelDisabledError(model) : everyModelDisabledError(provider);
-    const next = normalizeBrain({ provider: other, model: row.id, cwd: brain.cwd, mcpProfile: brain.mcpProfile, permissionMode: 'default' }, {}, { catalog: value });
+    const next = normalizeSessionBrain({ provider: other, model: row.id, cwd: brain.cwd, tools: brain.tools, permissionMode: 'default' }, {}, { catalog: value });
     return { brain: next, fallback: note(disabled ? 'model' : 'provider', row, other) };
   }
   function publicRecord(record, { withLive = true, live = null, persisted = false } = {}) {
     const out = { ...record };
+    // Run 4 removes the old brain picker projection; persisted records use only tools.
+    if (!persisted) out.brain = toolListRecord(record.brain, toolListOptions());
     if (!persisted) delete out.usageState;
     // The user-context state (frozen digest, delivery ledgers) is the server's own.
     if (!persisted) delete out.userContext;
@@ -1012,7 +1095,8 @@ export function createAssistantRuntime({
       // A run the dispatcher dropped has ended: its tokens stay, under a short name.
       if (!run) return { ...agent, title: `Run ${String(agent.runId || agent.key).slice(0, 8)}`, state: 'done' };
       const state = run.state || 'idle';
-      const displayState = state === 'completed' ? 'done' : state === 'starting' || state === 'awaiting_route' ? 'queued' : state === 'awaiting_permission' ? 'running' : state === 'interrupted' ? 'stopped' : state;
+      // A run a server restart cut off: suspended (its turn waits for the server) reads as running, resuming as queued.
+      const displayState = state === 'completed' ? 'done' : state === 'starting' || state === 'awaiting_route' || state === 'resuming' ? 'queued' : state === 'awaiting_permission' || state === 'suspended' ? 'running' : state === 'interrupted' ? 'stopped' : state;
       return { ...agent, title: run.title || agent.runId, state: ['queued', 'running', 'idle', 'done', 'failed', 'stopped'].includes(displayState) ? displayState : 'idle' };
     });
     if (live?.running && currentTask(sessionId) === view.task.id && !view.task.agents.some((agent) => agent.key === 'brain')) {
@@ -1287,7 +1371,8 @@ export function createAssistantRuntime({
         if (event.subtype === 'error_max_budget_usd' && live.brainProvider === 'claude-code') live.brainCapHit = true;
         if (live.planTurn) live.planText = planTurnText(event);
         // The reply the user's next message answers (context for the learning loop; a subagent's result is not it).
-        if (typeof event.result === 'string' && event.result.trim() && !event.parent_tool_use_id) live.lastReply = clip(event.result, 600);
+        // The follow-ups block is the panel's buttons, not words of the reply.
+        if (typeof event.result === 'string' && event.result.trim() && !event.parent_tool_use_id) live.lastReply = clip(stripFollowups(event.result), 600);
         touch(live);
       }
       if (TRANSCRIPT_EVENT_TYPES.has(event.type) && !(event.type === 'system' && event.subtype !== 'init')) appendTranscript(id, { at: iso(now()), packet });
@@ -1813,6 +1898,8 @@ export function createAssistantRuntime({
   function brainCostBasis(live) {
     const brain = live.record.brain || {};
     if (brain.provider === 'claude-code') return 'reported';
+    // Antigravity reports tokens, not prices: its spend has no dollar figure.
+    if (brain.provider === 'antigravity') return null;
     const info = brainCapabilities(live.record) || {};
     if (brain.provider === 'codex') {
       if (!pricing?.codexPrice) return null;
@@ -1854,6 +1941,10 @@ export function createAssistantRuntime({
     const money = sessionMoney(live.record.id);
     if (!money || money.unlimited) return null;
     // Fail closed: a brain whose spend has no price could spend past the budget.
+    // Antigravity has no price at all (whatever the pricing tables): a dollar budget cannot hold its turns.
+    if (live.record.brain?.provider === 'antigravity') {
+      return { code: 'BRAIN_UNPRICED', message: `${UNPRICED_PROVIDER_REASON}, so the session budget cannot hold an Antigravity brain's spend. Switch the budget to No limit in ⋯ → Budget…, or pick another provider for the brain.` };
+    }
     if (pricing && brainCostBasis(live) === null) {
       const model = live.record.brain?.model || brainCapabilities(live.record)?.id || 'its default model';
       return { code: 'BRAIN_UNPRICED', message: `No price is known for the ${live.record.brain?.provider || ''} brain model ${model}, so the session budget cannot hold its spend. Pick a priced or free model for the brain, or switch the budget to No limit.` };
@@ -1937,7 +2028,7 @@ export function createAssistantRuntime({
       brain,
       project: live.record.project || 'global',
       toolPrefix: brain.provider === 'claude-code' ? 'mcp__SynaBun__' : 'SynaBun_',
-      catalog: { models: catalogValue.models || {}, accounts: catalogValue.accounts || {}, projects: catalogValue.projects || [], profiles: catalogValue.profiles || catalogValue.mcpProfiles?.presets || [] },
+      catalog: { models: catalogValue.models || {}, accounts: catalogValue.accounts || {}, projects: catalogValue.projects || [], tools: catalogValue.tools },
       limits: dispatcher?.refreshLimits?.() || dispatcher?.limits || {},
       defaults: settings.defaultBrain,
       extra: settings.personaExtra,
@@ -2003,9 +2094,12 @@ export function createAssistantRuntime({
         live.computerGrantLive = false;
       } catch (error) { log('assistant:desktop-grant-error', error?.message || String(error)); }
     }
-    // whatsapp_send_file: one credential per brain launch of a WhatsApp conversation (BRAIN_CREDENTIAL_RE),
-    // for that brain's SynaBun MCP server alone. Every other session's brain gets none.
-    live.brainCredential = (live.record.channel || live.record.remote?.channel) === 'whatsapp' ? mintBrainCredential() : null;
+    // One credential per brain launch (BRAIN_CREDENTIAL_RE), for that brain's SynaBun MCP server alone: how SynaBun
+    // knows a call comes from this session's own brain, never from a process that only sent X-Synabun-Role or
+    // X-Synabun-Terminal. Skill creation (lib/skills/creation-api.js) and the Skills Service's assistant author
+    // (lib/skills/api-v2.js principalOf) take it; whatsapp_send_file takes it and then only the active WhatsApp
+    // conversation's session (lib/whatsapp/service.js sendFile).
+    live.brainCredential = mintBrainCredential();
     const cliCap = brain.provider === 'claude-code' ? brainCliCap(live) : null;
     const deps = {
       ClaudeSession, sdkVersion, PACKAGE_ROOT, handleCodexSkinWebSocket, ensureIsolatedServe, stopIsolatedServe, setupOpencodeSidepanelConfig,
@@ -2038,6 +2132,8 @@ export function createAssistantRuntime({
       remoteReadOnly: !!remote && remoteBrainLimited(brain.provider),
       // The engine keeps this conversation's thread record: pre-compact.mjs asks for no conversation memory.
       userContextThreads: brain.provider === 'claude-code' && userSuffix.nudges === true,
+      // Antigravity (assistant-brains/antigravity.js): where it runs, and what its policy hook asks of this session.
+      ...(brain.provider === 'antigravity' ? antigravityBrainDeps(live) : {}),
     };
     const gate = ensureGate(live);
     // A remote session's hook / plugin refuses a call it could not check (fail closed).
@@ -2047,7 +2143,7 @@ export function createAssistantRuntime({
         ? () => codexGateBootstrap({ url: gateUrl, session: live.record.id, token: live.gateToken, codexBin: typeof codexBin === 'function' ? codexBin() : codexBin, ...(remote ? { remote: true } : {}) })
         : async () => null;
     }
-    const factories = brainFactories || { 'claude-code': createClaudeBrain, codex: createCodexBrain, opencode: createOpenCodeBrain };
+    const factories = brainFactories || { 'claude-code': createClaudeBrain, codex: createCodexBrain, opencode: createOpenCodeBrain, antigravity: createAntigravityBrain };
     const factory = factories[brain.provider];
     if (!factory) throw new Error(`Unsupported brain provider ${brain.provider}`);
     const memoryHooks = brain.provider === 'claude-code' && memory?.claudeHooks ? memory.claudeHooks({
@@ -2698,6 +2794,7 @@ export function createAssistantRuntime({
     if (message.type === 'assistant:permission-request') {
       sendToSockets(live, { type: 'event', event: { type: 'synabun.dispatch_control_request', runId: message.runId, request_id: message.request?.requestId, provider: dispatcher?.get?.(message.runId)?.provider || null, request: message.request } });
     } else if (message.type === 'assistant:permission-resolved') {
+      live.mailbox = live.mailbox.filter((item) => !(item.run?.runId === message.runId && item.request?.requestId === message.requestId));
       sendToSockets(live, { type: 'event', event: { type: 'synabun.dispatch_control_resolved', runId: message.runId, request_id: message.requestId, resolvedBy: message.resolvedBy, behavior: message.behavior } });
     }
   }
@@ -2778,8 +2875,9 @@ export function createAssistantRuntime({
     return { ...brain, accountId: row.id };
   }
   async function createSession({ brain = {}, label = null, cwd = null, windowId = null, fallback = false, channel = null, draft = false } = {}, internal = {}) {
+    if (brain?.mcpProfile !== undefined) throw Object.assign(new Error('Use tools: [group ids].'), { code: 'MCP_PROFILE_REMOVED', status: 400 });
     const id = `assistant-${randomUUID()}`;
-    const requested = normalizeBrain({ ...brain, cwd: brain?.cwd || cwd || settings.defaultBrain.cwd || PACKAGE_ROOT }, settings.defaultBrain, { catalog: catalog?.peek?.() || null });
+    const requested = normalizeSessionBrain({ ...brain, cwd: brain?.cwd || cwd || settings.defaultBrain.cwd || PACKAGE_ROOT }, settings.defaultBrain, { catalog: catalog?.peek?.() || null });
     const enabled = await enabledBrain(requested, { fallback: fallback === true, named: !!brain?.model });
     const normalized = await resolveAutoAccount(enabled.brain);
     const record = {
@@ -2856,14 +2954,17 @@ export function createAssistantRuntime({
       // default, never from the old provider's model id.
       const switching = BRAIN_PROVIDERS.has(patch.brain.provider) && patch.brain.provider !== live.record.brain.provider;
       const base = switching && !patch.brain.model ? { ...live.record.brain, model: null } : live.record.brain;
-      let next = normalizeBrain({ ...base, ...patch.brain, model: patch.brain.model || base.model }, base, { catalog: catalog?.peek?.() || null });
+      // Public picker updates use arrays; stored records still convert on read.
+      const input = { ...base, ...patch.brain, model: patch.brain.model || base.model };
+      if (patch.brain.mcpProfile !== undefined) throw Object.assign(new Error('Use tools: [group ids].'), { code: 'MCP_PROFILE_REMOVED', status: 400 });
+      let next = normalizeSessionBrain(input, base, { catalog: catalog?.peek?.() || null });
       next = await resolveAutoAccount(next);
       const modelChanged = next.model !== live.record.brain.model || next.provider !== live.record.brain.provider;
       if (modelChanged) next = (await enabledBrain(next)).brain;
       // A remote session keeps what was asked for and runs what its level allows.
       if ('permissionMode' in patch.brain || 'planMode' in patch.brain) next = clampModeWrite(live, next);
       else next = clampedBrain(live, next);
-      const providerChanged = patch.restartBrain === true || next.provider !== live.record.brain.provider || next.accountId !== live.record.brain.accountId || next.cwd !== live.record.brain.cwd || next.mcpProfile !== live.record.brain.mcpProfile;
+      const providerChanged = patch.restartBrain === true || next.provider !== live.record.brain.provider || next.accountId !== live.record.brain.accountId || next.cwd !== live.record.brain.cwd || JSON.stringify(next.tools) !== JSON.stringify(live.record.brain.tools);
       // A usage limit is the account's: another provider or account starts without the notice.
       if (next.provider !== live.record.brain.provider || next.accountId !== live.record.brain.accountId) setLimit(live, null);
       live.record.brain = next;
@@ -3373,7 +3474,7 @@ export function createAssistantRuntime({
         for (const card of clarifier?.pendingCards?.(live.record.id) || []) { try { ws.send(JSON.stringify(card)); } catch {} }
         return;
       case 'switch_brain':
-        await updateSession(live.record.id, { brain: { provider: msg.brain || msg.provider, model: msg.model, effort: msg.effort, accountId: msg.accountId, mcpProfile: msg.mcpProfile, cwd: msg.cwd, agent: msg.agent, permissionMode: msg.permissionMode, planMode: typeof msg.planMode === 'boolean' ? msg.planMode : undefined } });
+        await updateSession(live.record.id, { brain: { provider: msg.brain || msg.provider, model: msg.model, effort: msg.effort, accountId: msg.accountId, tools: msg.tools, cwd: msg.cwd, agent: msg.agent, permissionMode: msg.permissionMode, planMode: typeof msg.planMode === 'boolean' ? msg.planMode : undefined } });
         return;
       case 'list_sessions': {
         const rows = listSessions();
@@ -3672,6 +3773,69 @@ export function createAssistantRuntime({
     const decision = decide(live, tool);
     return decision.allow ? { allow: true } : { allow: false, reason: decision.reason, refusals: decision.refusals, stopped: !!decision.abort };
   }
+  /**
+   * An Antigravity brain's tool call (its policy hook, lib/antigravity/policy.js), checked in this process the way
+   * gateCheck checks the OpenCode plugin's and the Codex hook's: plan mode, a remote session's read-only rules,
+   * the browser policy (every session, plan mode and subagents included), then the route gate. → { decision:
+   * 'deny', reason } or null (no objection: the brain's approval mode decides). `call`: lib/antigravity/tool-call.js
+   * acpCall. Antigravity's own bookkeeping steps (task boundaries, notes to the user) are never routed.
+   */
+  function antigravityGateCheck(live, call) {
+    const name = acpToolName(call);
+    const input = acpPolicyInput(call);
+    const planned = planGate(live, 'antigravity', name, input);
+    if (planned) return { decision: 'deny', reason: planned.reason };
+    // A remote (WhatsApp) session's Antigravity brain is read-only for good, at every level.
+    if (live.brainRemoteReadOnly && readOnlyToolDecision(name, input, { host: 'antigravity' }) === 'deny') {
+      log('assistant:remote-policy', `${live.record.id}: refused ${name} (read-only)`);
+      return { decision: 'deny', reason: `${readOnlyDenyMessage(name)} Tell the user to do this in SynaBun on their computer if they need it.` };
+    }
+    if (call.mcp) {
+      const remoteDenied = remoteGate(live, name, input, { argsComplete: true, host: 'antigravity' });
+      if (remoteDenied) return { decision: 'deny', reason: remoteDenied.reason };
+    }
+    const browserDenied = browserGate(live, name, input, { host: 'antigravity' });
+    if (browserDenied) return { decision: 'deny', reason: browserDenied.reason };
+    if (!live.gate || call.kind === 'think') return null;
+    const decision = decide(live, name);
+    return decision.allow ? null : { decision: 'deny', reason: decision.reason };
+  }
+  /** What an Antigravity brain needs from this session (assistant-brains/antigravity.js deps). */
+  function antigravityBrainDeps(live) {
+    const ag = antigravity || {};
+    const saved = live.record.usageState?.antigravity;
+    return {
+      antigravityLaunch: typeof ag.launch === 'function' ? ag.launch : () => null,
+      childEnv: typeof ag.childEnv === 'function' ? ag.childEnv : undefined,
+      antigravityHome: typeof ag.home === 'function' ? (sessionId) => ag.home(sessionId) : null,
+      synabunMcpEntry: typeof ag.synabunMcpEntry === 'function' ? ag.synabunMcpEntry : null,
+      policy: ag.policy || null,
+      policyUrl: typeof ag.policyUrl === 'function' ? ag.policyUrl() : (ag.policyUrl || null),
+      connect: ag.connect || undefined,
+      userGemini: ag.userGemini || undefined,
+      policyCheck: (call) => antigravityGateCheck(live, call),
+      // ACP counts tokens per session: what the session the record names had counted (a resume books only what follows).
+      sessionUsageBase: saved && saved.sessionId && saved.sessionId === live.record.providerSessionId ? saved.usage || null : null,
+      onAntigravitySession: (sessionId) => { if (sessionId && live.record.providerSessionId !== sessionId) { live.record.providerSessionId = sessionId; touch(live); } },
+      onAntigravitySessionUsage: (sessionId, total) => { live.record.usageState ||= {}; live.record.usageState.antigravity = { sessionId, usage: total }; },
+      onAntigravityUsage: (info) => settleAntigravityBrain(live, info),
+    };
+  }
+  /** One Antigravity brain turn's tokens into the ledger: unpriced (tokens, not prices), exact when its total agrees. */
+  function settleAntigravityBrain(live, { usage: turnUsage = null, model = null } = {}) {
+    if (!usage || !turnUsage) return;
+    metered('antigravity-settle', () => {
+      const { tokens, mismatch } = antigravityUsageTokens(turnUsage);
+      if (totalTokens(tokens) === 0) return;
+      const taskId = currentTask(live.record.id) || ensureTaskId(live.record.id);
+      usage.settle({
+        sessionId: live.record.id, taskId, scope: 'brain', runId: null, turn: live.record.turns, provider: 'antigravity',
+        model: model || live.record.brain?.model || null, part: 'main', tokens, costUsd: null, costBasis: 'unpriced',
+        fidelity: mismatch ? 'partial' : 'exact', reason: mismatch ? 'antigravity-total-mismatch' : null, source: 'antigravity-acp-usage',
+      });
+    });
+    persist({ force: true });
+  }
   /**
    * A remote session's hard refusal for one tool call (every level), else null.
    * `argsComplete: false`: the host did not pass the call's arguments. An
@@ -3682,6 +3846,9 @@ export function createAssistantRuntime({
     let reason = null;
     if (host === 'opencode' && REMOTE_OPENCODE_WEB_TOOLS.has(String(tool || '').toLowerCase())) {
       reason = `${tool}: a WhatsApp conversation on OpenCode is read-only and does not reach the web on its own; use SynaBun's browser tools, or switch the WhatsApp brain to Claude.`;
+    } else if (host === 'opencode' && String(tool || '').toLowerCase() === 'execute') {
+      // Code Mode's `execute` runs arbitrary code (fetch included) that no argument check can read: never remote.
+      reason = `${tool}: a WhatsApp conversation on OpenCode does not run Code Mode; call SynaBun's tools directly, or switch the WhatsApp brain to Claude.`;
     } else if (isComputerTool(tool)) {
       // `computer`: what computerAccess said for this call (the Claude hook passes it). Any other
       // caller (the Codex hook, the OpenCode plugin) asks here: those brains never get past "off".
@@ -3696,16 +3863,30 @@ export function createAssistantRuntime({
     log('assistant:remote-policy', `${live.record.id}: refused ${tool} (${reason})`);
     return { allow: false, remote: true, reason: `${reason} Tell the user to do this in SynaBun on their computer if they need it.` };
   }
+  // The registered code projects a brain's test runners may run in besides its session's project
+  // (lib/browser-policy-roots.js): read again at most every 10 s, so a project registered while a
+  // session lives counts from its next calls on.
+  const BROWSER_ROOTS_TTL_MS = 10_000;
+  let browserRoots = { at: -Infinity, roots: [] };
+  function browserTestRoots() {
+    const at = now();
+    if (at - browserRoots.at < BROWSER_ROOTS_TTL_MS && at >= browserRoots.at) return browserRoots.roots;
+    let roots = [];
+    try { roots = browserPolicyRoots(registeredProjectPaths()); } catch { roots = []; }
+    browserRoots = { at, roots };
+    return roots;
+  }
   /**
    * The browser policy (lib/browser-tool-policy.js) for one brain tool call:
    * { allow:false, browser:true, reason } or null. Every provider and session,
    * plan mode and subagents included; scripts resolve against the session's
-   * project cwd. `argsComplete: false` (the host sent only the command /
+   * project cwd, and test runners run there or in a registered code project
+   * (browserTestRoots). `argsComplete: false` (the host sent only the command /
    * action of an oversized call): checked on what arrived.
    */
   function browserGate(live, tool, input = {}, { host = null, argsComplete = true } = {}) {
     const kind = host || (live.brainProvider === 'claude-code' ? 'claude' : live.brainProvider);
-    const reason = browserToolDenial(tool, input && typeof input === 'object' ? input : {}, { host: kind, cwd: live.record.brain?.cwd || PACKAGE_ROOT });
+    const reason = browserToolDenial(tool, input && typeof input === 'object' ? input : {}, { host: kind, cwd: live.record.brain?.cwd || PACKAGE_ROOT, roots: browserTestRoots() });
     if (!reason) return null;
     log('assistant:browser-policy', `${live.record.id}: refused ${tool}${argsComplete ? '' : ' (partial arguments)'}`);
     return { allow: false, browser: true, reason };
@@ -3875,6 +4056,9 @@ export function createAssistantRuntime({
   return {
     handleWebSocket, listSessions, getSession, createSession, updateSession, closeSession, destroySession, removeSession,
     resolveTerminal, accountInUse, ownsIsolatedServe, noteDispatch, subscribe, shutdown,
+    // The sessions index written now, synchronously: the server's exit handler runs it on every way out,
+    // since an exit through process.exit() never reaches shutdown()'s own write.
+    flushIndex: () => persist({ force: true }),
     observeBroadcast: onPermissionBroadcast,
     testDensityFor, routerSession, routerSend, routerEvent, routerMailbox, routerContinue, routerSinks, routerRouted, routerRouteFailed, routerComputerApproved, gateCheck, isPlanning, isPlanReadOnly,
     clarifySession, clarifyEvent, clarifyGate, clarifySinks,