synabun 2.0.10 → 2.2.0

package/neural-interface/lib/cli-update-planner.js

@@ -1,7 +1,7 @@
 // ═══════════════════════════════════════════
 // SynaBun — CLI Update Planner
 //
-// Works out HOW each external CLI (Claude Code, Codex, OpenCode, Gemini) was
+// Works out HOW each external CLI (Claude Code, Codex, OpenCode, Antigravity) was
 // installed, and therefore which command actually updates it and which
 // "latest version" it should be compared against.
 //
@@ -16,12 +16,17 @@
 // PATH, so the update silently does nothing and the badge never clears.
 // ═══════════════════════════════════════════
 
-/** npm package name per tool key. */
+/**
+ * npm package name per tool key. OpenCode has none: npm's opencode-ai is
+ * OpenCode 1, which SynaBun does not drive, and OpenCode 2 is installed by its
+ * own script, Homebrew or WinGet (lib/opencode-protocol.js). Neither has the
+ * Antigravity CLI (`agy`): Google ships it as a binary, through its own
+ * installer script or the Homebrew cask antigravity-cli, and it updates itself
+ * (`agy update`).
+ */
 export const NPM_PKGS = {
   'claude-code': '@anthropic-ai/claude-code',
   'codex': '@openai/codex',
-  'gemini': '@google/gemini-cli',
-  'opencode': 'opencode-ai',
 };
 
 /**
@@ -32,21 +37,23 @@ export const NPM_PKGS = {
 export const BREW_FALLBACK_TOKENS = {
   'claude-code': 'claude-code',
   'codex': 'codex',
-  'gemini': 'gemini-cli',
-  'opencode': 'opencode',
+  'antigravity': 'antigravity-cli',
+  // OpenCode 2's own tap (its `opencode` formula there is still OpenCode 1).
+  'opencode': 'anomalyco/tap/opencode-v2',
 };
 
 /**
  * Whether each tool ships as a Homebrew cask or a formula. This is a property
- * of the package, not of the machine — claude-code and codex exist ONLY as
- * casks, gemini-cli and opencode ONLY as formulae. Needed when a tool is not
+ * of the package, not of the machine — claude-code, codex and antigravity-cli
+ * exist ONLY as casks, opencode ONLY as a formula. Needed when a tool is not
  * installed and there is no path to classify: guessing the wrong flavour
- * produces a command that simply errors ("Cask 'gemini-cli' is unavailable").
+ * produces a command that simply errors ("No available formula with the name
+ * 'antigravity-cli'").
  */
 export const BREW_KINDS = {
   'claude-code': 'cask',
   'codex': 'cask',
-  'gemini': 'formula',
+  'antigravity': 'cask',
   'opencode': 'formula',
 };
 
@@ -55,23 +62,22 @@ const SELF_UPDATERS = {
   'claude-code': 'claude update',
   'codex': 'codex update',
   'opencode': 'opencode upgrade',
-  // gemini has no self-updater.
+  'antigravity': 'agy update',
 };
 
 /**
- * OpenCode's `upgrade --method` accepts exactly these values. Mapping our
- * detected source onto it lets OpenCode do its own install-aware work for
- * the channels we cannot drive directly.
+ * The `upgrade --method` of OpenCode 2 for a detected source (its own installer
+ * script, a JavaScript package manager, WinGet). Mapping our detected source
+ * onto it lets OpenCode do its own install-aware work for the channels we
+ * cannot drive directly.
  */
 const OPENCODE_METHODS = {
   'standalone': 'curl',
   'npm': 'npm',
   'pnpm': 'pnpm',
   'bun': 'bun',
-  'brew-formula': 'brew',
-  'brew-cask': 'brew',
-  'choco': 'choco',
-  'scoop': 'scoop',
+  'yarn': 'yarn',
+  'winget': 'winget',
 };
 
 /** Sources that mean "a package manager other than the tool itself owns this". */
@@ -196,7 +202,7 @@ const TOOL_COMMANDS = {
   'claude-code': 'claude',
   'codex': 'codex',
   'opencode': 'opencode',
-  'gemini': 'gemini',
+  'antigravity': 'agy',
 };
 
 /**
@@ -248,6 +254,15 @@ function planUpdateCommand(toolKey, installSource, { brewToken = null, platform
       : `brew upgrade ${token}`;
   }
 
+  // OpenCode 2 updates itself through the channel it came from (brew is handled above).
+  if (toolKey === 'opencode') {
+    // Its installer script is bash: a copy in %USERPROFILE%\.opencode\bin on Windows is no OpenCode 2 install.
+    if (installSource === 'standalone' && platform === 'win32') return null;
+    if (OPENCODE_METHODS[installSource]) return `opencode upgrade --method ${OPENCODE_METHODS[installSource]}`;
+    if (['volta', 'scoop', 'choco'].includes(installSource)) return null; // not an OpenCode 2 channel: the caller shows a hint
+    return selfUpdate;
+  }
+
   if (!npmPkg) return selfUpdate;
 
   switch (installSource) {
@@ -255,24 +270,15 @@ function planUpdateCommand(toolKey, installSource, { brewToken = null, platform
     case 'yarn':  return `yarn global add ${npmPkg}@latest`;
     case 'volta': return `volta install ${npmPkg}@latest`;
     case 'bun':
+      return `bun add -g ${npmPkg}@latest`;
     case 'pnpm':
-      // OpenCode drives these itself; the others take the plain global add.
-      if (toolKey === 'opencode') return `opencode upgrade --method ${OPENCODE_METHODS[installSource]}`;
-      return installSource === 'bun'
-        ? `bun add -g ${npmPkg}@latest`
-        : `pnpm add -g ${npmPkg}@latest`;
+      return `pnpm add -g ${npmPkg}@latest`;
     case 'scoop':
     case 'choco':
-      if (toolKey === 'opencode') return `opencode upgrade --method ${OPENCODE_METHODS[installSource]}`;
-      return null; // no safe automated path — caller shows a hint
     case 'winget':
-      return null;
+      return null; // no safe automated path — caller shows a hint
     case 'standalone':
       // The tool's own installer put it here, so its own updater is right.
-      // OpenCode's `curl` method runs its bash install script, which Windows
-      // does not have: a copy in %USERPROFILE%\.opencode\bin there came from
-      // the release archive (lib/cli-install.js) and has no updater to call.
-      if (toolKey === 'opencode') return platform === 'win32' ? null : 'opencode upgrade --method curl';
       return selfUpdate;
     case 'native':
       return selfUpdate;
@@ -373,10 +379,13 @@ export function installSourceLabel(source) {
 /**
  * The install command each vendor documents first for an operating system
  * (checked 2026-10-17): Anthropic's native installer (code.claude.com/docs/en/setup),
- * OpenAI's standalone installer (learn.chatgpt.com/docs/codex/cli), OpenCode's
- * install script (opencode.ai/docs; on Windows, where the script does not run,
- * npm, the first method its docs list that works in any terminal). These are
- * the same official sources the Install button runs (lib/cli-install.js).
+ * OpenAI's standalone installer (learn.chatgpt.com/docs/codex/cli), OpenCode 2's
+ * install script (https://opencode.ai/v2/install, the one `opencode upgrade`
+ * runs; on Windows, where the script does not run, WinGet), and (checked
+ * 2026-10-30) Google's Antigravity CLI installer
+ * (antigravity.google/docs/getting-started). These are the same official
+ * sources the Install button runs (lib/cli-install.js), which on a Mac with
+ * Homebrew installs the Antigravity CLI's cask instead.
  */
 export function vendorInstallCommand(toolKey, platform = process.platform) {
   const windows = platform === 'win32';
@@ -388,7 +397,11 @@ export function vendorInstallCommand(toolKey, platform = process.platform) {
         ? 'powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"'
         : 'curl -fsSL https://chatgpt.com/codex/install.sh | sh';
     case 'opencode':
-      return windows ? `npm install -g ${NPM_PKGS.opencode}` : 'curl -fsSL https://opencode.ai/install | bash';
+      return windows ? 'winget install --id Anomaly.OpenCode --exact' : 'curl -fsSL https://opencode.ai/v2/install | bash';
+    case 'antigravity':
+      // Google's installer: it checks the binary against the SHA-512 of Google's release manifest and puts agy in
+      // ~/.local/bin (%LOCALAPPDATA%\agy\bin on Windows). A Homebrew machine is told the cask (buildInstallCommand).
+      return windows ? 'irm https://antigravity.google/cli/install.ps1 | iex' : 'curl -fsSL https://antigravity.google/cli/install.sh | bash';
     default:
       return NPM_PKGS[toolKey] ? `npm install -g ${NPM_PKGS[toolKey]}` : '';
   }
@@ -420,7 +433,9 @@ export function buildInstallCommand(toolKey, installSource = 'unknown', { platfo
       ? `brew install --cask ${token}`
       : `brew install ${token}`;
   }
-  if (!npmPkg) return '';
+  // OpenCode 2 and the Antigravity CLI have no npm package: their vendor's installer whatever JavaScript package
+  // manager the machine uses.
+  if (!npmPkg) return vendorInstallCommand(toolKey, platform || process.platform);
   switch (installSource) {
     case 'bun':   return `bun add -g ${npmPkg}`;
     case 'pnpm':  return `pnpm add -g ${npmPkg}`;
@@ -438,10 +453,6 @@ function platformInstallCommand(toolKey, installSource, platform) {
     if (windows && installSource === 'winget') return 'winget install Anthropic.ClaudeCode';
     return vendor;
   }
-  if (toolKey === 'opencode' && windows) {
-    if (installSource === 'scoop') return 'scoop install opencode';
-    if (installSource === 'choco') return 'choco install opencode';
-  }
   // A JavaScript package manager this machine already uses: keep to it.
   if (['npm', 'bun', 'pnpm', 'yarn', 'volta'].includes(installSource)) return null;
   return vendor || null;

package/neural-interface/lib/cloudflared/tunnel.js

@@ -28,6 +28,15 @@
 //
 // An ended process is not forgotten: it is asked to end (SIGTERM), killed when
 // it is still there a moment later (SIGKILL), and kept until it has exited.
+//
+// Each cloudflared it starts is on record from its spawn until it has exited
+// (`records`: lib/opencode-serve-records.js, kind 'quick', in
+// DATA_HOME/runtime/tunnels), with a token of its start in its environment. A
+// server that ends without its exit handlers (a native crash) leaves its
+// cloudflared running on macOS and Linux (Windows ends a child with its parent),
+// the old address still pointing at the port the next server listens on: the
+// next server ends it by that record (server.js sweepLeftoverTunnels), and only
+// while the OS still reports that very process.
 
 import { spawn as nodeSpawn } from 'node:child_process';
 
@@ -69,6 +78,22 @@ export function tunnelArguments(port, source) {
   return ['tunnel', ...(source === 'system' ? [] : ['--no-autoupdate']), '--url', `http://localhost:${port}`];
 }
 
+/** The kind of the tunnel's records (lib/opencode-serve-records.js createServeRecords `kinds`). */
+export const TUNNEL_KINDS = Object.freeze(['quick']);
+
+/**
+ * Are `args` (a command line's arguments, as the platform reads them: lib/opencode-serve-records.js commandArgs) a
+ * quick tunnel to this server's `port` (`… tunnel … --url http://localhost:<port>`, as tunnelArguments makes them)?
+ * What a tunnel record must name.
+ */
+export function tunnelsToPort(args, port) {
+  const p = Number(port);
+  if (!Array.isArray(args) || !Number.isInteger(p) || p <= 0 || p > 65535) return false;
+  if (!args.includes('tunnel')) return false;
+  const url = `http://localhost:${p}`;
+  return args.some((arg, i) => arg === `--url=${url}` || (arg === '--url' && args[i + 1] === url));
+}
+
 /** What cloudflared said last that reads like a reason: its last error line, without the timestamp. */
 function lastReason(output) {
   const lines = output.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
@@ -85,8 +110,10 @@ function lastReason(output) {
  * @param {number} [o.urlTimeoutMs] how long a started cloudflared may take to print its address
  * @param {number} [o.killAfterMs] how long an ended cloudflared has to exit before it is killed
  * @param {(line: string) => void} [o.log]
+ * @param {{ newToken: () => string, tokenEnv: string, record: (entry: object) => Promise<object|null>, remove: (entry: object) => boolean }} [o.records]
+ *   where each cloudflared it starts is kept on record until it has exited (lib/opencode-serve-records.js, kind 'quick')
  */
-export function createQuickTunnel({ cloudflared, port, onUrl = () => {}, spawn = nodeSpawn, urlTimeoutMs = 90_000, killAfterMs = 1000, log = () => {} }) {
+export function createQuickTunnel({ cloudflared, port, onUrl = () => {}, spawn = nodeSpawn, urlTimeoutMs = 90_000, killAfterMs = 1000, log = () => {}, records = null }) {
   let phase = 'idle';   // idle | preparing | starting | running | failed
   let child = null;
   let url = null;
@@ -117,7 +144,19 @@ export function createQuickTunnel({ cloudflared, port, onUrl = () => {}, spawn =
     log(`  Tunnel:  ${code === 'ended' ? 'stopped' : 'not started'} (${code}): ${message}`);
   }
 
+  // On record from its spawn until it has exited: what the next server ends when this one crashed (see above).
+  function keepOnRecord(proc, token) {
+    const pid = Number(proc?.pid) || null;
+    if (!pid) return;
+    const kept = Promise.resolve().then(() => records.record({ kind: TUNNEL_KINDS[0], port: Number(port), pid, token })).catch(() => null);
+    proc.once('exit', () => { kept.then((entry) => { if (entry) records.remove(entry); }).catch(() => {}); });
+  }
+
   function launch(found, mine) {
+    // The token of this start, in its environment: made before the check below, so nothing runs between them.
+    let token = null;
+    try { token = records?.tokenEnv ? records.newToken() : null; } catch { token = null; }
+    const options = { stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true, ...(token ? { env: { ...process.env, [records.tokenEnv]: token } } : {}) };
     // Checked once more as it is about to run (the manager's confirm: the very file its check read, still where
     // nobody else can change it), and started at once by the real path that was checked: nothing runs in between.
     let path = found.path;
@@ -128,10 +167,11 @@ export function createQuickTunnel({ cloudflared, port, onUrl = () => {}, spawn =
     }
     let proc;
     try {
-      proc = spawn(path, tunnelArguments(port, found.source), { stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
+      proc = spawn(path, tunnelArguments(port, found.source), options);
     } catch (failure) {
       return fail('launch', `cloudflared could not be started (${failure?.code || failure?.message || failure}).`);
     }
+    if (token) keepOnRecord(proc, token);
     child = proc;
     copy = { source: found.source, version: found.version };
     phase = 'starting';

package/neural-interface/lib/codex-mcp-approvals.js

@@ -1,5 +1,16 @@
+import { codexMcpToolApproval } from '../public/shared/cdx/cdx-protocol.js';
+
 const CODEX_MCP_APPROVAL_MODES = new Set(['auto', 'prompt', 'writes', 'approve']);
 
+/** Auto is this session's choice; Claude's allow list is not a Codex approval prerequisite. */
+export function shouldAutoAcceptCodexMcpToolApproval(params, { autoAccept = false, role = null } = {}) {
+  const approval = codexMcpToolApproval(params);
+  if (!approval) return false;
+  // agent_route owns the model-choice card. Calling it must not require an
+  // additional permission card, even when ordinary tools are set to Ask.
+  return autoAccept || (role === 'assistant' && approval.fullName === 'mcp__SynaBun__agent_route');
+}
+
 export function codexConfigKeyPathSegment(value) {
   const text = String(value || '').trim();
   if (!text) throw new Error('Codex config key path segments cannot be empty');

package/neural-interface/lib/codex-rollout-reader.js

@@ -0,0 +1,52 @@
+// ── A Codex rollout, read once for the preview and the history fallback ──
+// The early preview (server.js sendEarlyCodexRolloutPreview) used to readFileSync the
+// whole rollout JSONL before Codex's app-server started, for every thread a tab
+// bootstrapped, and the history fallback read it again right after. This reads it as
+// a stream (the event loop and the app-server's start are not held up) and keeps the
+// parsed items of the last few files by path, size and time, so the fallback that
+// follows reuses them while the file is unchanged.
+
+import { createReadStream, statSync } from 'node:fs';
+import { jsonlLines } from './jsonl-lines.js';
+
+export function createRolloutReader({
+  open = (path) => createReadStream(path, { encoding: 'utf-8' }),
+  stat = statSync,
+  maxEntries = 4,
+} = {}) {
+  const kept = new Map(); // path → { size, mtimeMs, items }
+  const running = new Map(); // `${path}|${size}|${mtimeMs}` → promise of items
+  const stats = { reads: 0, reused: 0 };
+
+  /** The items `parse(lines)` makes of the file at `path` (an async iterable of its lines). */
+  async function items(path, parse) {
+    if (!path) return [];
+    let st;
+    try { st = stat(path); } catch { return []; }
+    const hit = kept.get(path);
+    if (hit && hit.size === st.size && hit.mtimeMs === st.mtimeMs) {
+      stats.reused++;
+      kept.delete(path); kept.set(path, hit);
+      return hit.items;
+    }
+    const key = `${path}|${st.size}|${st.mtimeMs}`;
+    if (running.has(key)) { stats.reused++; return running.get(key); }
+    const job = (async () => {
+      stats.reads++;
+      const stream = open(path);
+      try {
+        const out = await parse(jsonlLines(stream));
+        kept.delete(path);
+        kept.set(path, { size: st.size, mtimeMs: st.mtimeMs, items: out });
+        while (kept.size > maxEntries) kept.delete(kept.keys().next().value);
+        return out;
+      } finally {
+        stream.destroy?.();
+      }
+    })();
+    running.set(key, job);
+    try { return await job; } finally { running.delete(key); }
+  }
+
+  return { items, forget: (path) => kept.delete(path), get stats() { return { ...stats }; }, get size() { return kept.size; } };
+}

package/neural-interface/lib/codex-worker-app-server.js

@@ -0,0 +1,191 @@
+// One app-server per dispatched worker. The SDK-shaped surface keeps the native
+// worker's event/usage contract while thread/resume reopens its durable thread.
+import { spawn, execFileSync } from 'node:child_process';
+import { StringDecoder } from 'node:string_decoder';
+
+const toml = (v) => Array.isArray(v) ? `[${v.map(toml).join(',')}]`
+  : v && typeof v === 'object' ? `{${Object.entries(v).filter(([, x]) => x != null).map(([k, x]) => `${JSON.stringify(k)}=${toml(x)}`).join(',')}}`
+    : JSON.stringify(v);
+
+// Match the SDK's leaf overrides: pins/switches address only their intended
+// fields and leave native command/url/env definitions in the native config.
+// Codex splits override paths literally on dots (it does not parse TOML keys).
+// Top-level keys may already be override paths; nested keys are literal segments.
+export function codexWorkerConfigOverrides(config) {
+  const overrides = [];
+  const visit = (value, path) => {
+    if (value == null) return;
+    if (typeof value === 'object' && !Array.isArray(value)) {
+      for (const [key, child] of Object.entries(value)) {
+        if (path && /[.=\x00-\x1f\x7f]/.test(key)) throw new Error('Codex override paths cannot address this config key');
+        visit(child, path ? `${path}.${key}` : key);
+      }
+    } else overrides.push(`${path}=${toml(value)}`);
+  };
+  visit(config, '');
+  return overrides;
+}
+
+export class CodexWorkerAppServer {
+  constructor({ codexPathOverride, env, config = {}, configArgs = [], apiKey, signal, onProcess = () => {}, onRequest = null, permissionPolicy = 'auto' }) {
+    this.onRequest = onRequest;
+    this.approvalPolicy = permissionPolicy === 'ask' ? 'untrusted' : 'never';
+    this.requestAbort = new AbortController();
+    this.incoming = new Map();
+    this.requestAbort.signal.addEventListener('abort', () => { for (const pending of this.incoming.values()) pending.abort(); this.incoming.clear(); }, { once: true });
+    this.pending = new Map();
+    this.seq = 0;
+    this.listener = null;
+    this.failure = null;
+    const args = [...configArgs];
+    for (const override of codexWorkerConfigOverrides(config)) args.push('-c', override);
+    // Run identity in the command line permits conservative orphan identification.
+    args.push('-c', `synabun_worker_run=${JSON.stringify(env.SYNABUN_TERMINAL_SESSION || '')}`, 'app-server');
+    this.proc = spawn(codexPathOverride, args, { env, stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true });
+    this.exited = new Promise((r) => this.proc.once('close', r));
+    onProcess({ pid: this.proc.pid, startedAt: new Date().toISOString() });
+    let buffer = '';
+    const decoder = new StringDecoder('utf8');
+    this.proc.stdout.on('data', (chunk) => {
+      buffer += decoder.write(chunk);
+      let end;
+      while ((end = buffer.indexOf('\n')) >= 0) {
+        const line = buffer.slice(0, end); buffer = buffer.slice(end + 1);
+        let msg; try { msg = JSON.parse(line); } catch { continue; }
+        if (msg.id != null && !msg.method) {
+          const p = this.pending.get(msg.id); if (!p) continue;
+          this.pending.delete(msg.id); clearTimeout(p.timer);
+          msg.error ? p.reject(new Error(msg.error.message || 'Codex RPC failed')) : p.resolve(msg.result);
+        } else if (msg.id != null) {
+          const controller = new AbortController();
+          this.incoming.set(msg.id, controller);
+          Promise.resolve().then(() => {
+            if (!this.onRequest) throw new Error('Worker has no interactive request handler');
+            return this.onRequest(msg, controller.signal);
+          }).then((reply) => {
+            if (!this.failure && !controller.signal.aborted) this.write({ id: msg.id, ...reply });
+          }, (error) => {
+            if (!this.failure && !controller.signal.aborted) this.write({ id: msg.id, error: { code: -32000, message: error.message } });
+          }).finally(() => this.incoming.delete(msg.id));
+        } else {
+          if (msg.method === 'serverRequest/resolved') this.incoming.get(msg.params?.requestId)?.abort();
+          if (msg.method === 'turn/completed') { for (const pending of this.incoming.values()) pending.abort(); this.incoming.clear(); }
+          this.listener?.(msg);
+        }
+      }
+    });
+    // Drain stderr without exposing credentials/config to the worker transcript.
+    this.proc.stderr.resume();
+    this.proc.on('error', (error) => this.fail(error));
+    this.proc.stdin.on('error', (error) => this.fail(error));
+    this.proc.on('close', (code, signal) => this.fail(new Error(`Codex app-server exited (${signal || code})`)));
+    this.ready = (async () => {
+      await this.rpc('initialize', { clientInfo: { name: 'synabun-worker', version: '1.0.0' }, capabilities: { experimentalApi: true } });
+      this.write({ method: 'initialized', params: {} });
+      if (apiKey) await this.rpc('account/login/start', { type: 'apiKey', apiKey });
+    })();
+    this.ready.catch(() => {});
+    this.startupSignal = signal;
+    this.cancelStartup = () => { this.dispose().catch(() => {}); };
+    signal?.addEventListener('abort', this.cancelStartup, { once: true });
+    if (signal?.aborted) this.cancelStartup();
+  }
+  write(value) { if (!this.proc.stdin.destroyed) this.proc.stdin.write(JSON.stringify(value) + '\n'); }
+  fail(error) {
+    this.failure = error;
+    this.requestAbort.abort();
+    for (const p of this.pending.values()) { clearTimeout(p.timer); p.reject(error); }
+    this.pending.clear();
+    this.listener?.({ method: 'synabun/exit', error });
+  }
+  rpc(method, params) {
+    if (this.failure) return Promise.reject(this.failure);
+    return new Promise((resolve, reject) => {
+      const id = ++this.seq;
+      const timer = setTimeout(() => { this.pending.delete(id); reject(new Error(`Codex ${method} timed out`)); }, 30_000);
+      this.pending.set(id, { resolve, reject, timer });
+      this.write({ id, method, params });
+    });
+  }
+  startThread(options) { return this.thread(null, options); }
+  resumeThread(id, options) { return this.thread(id, options); }
+  thread(id, options) {
+    const owner = this;
+    const sandboxPolicy = options.sandboxMode === 'read-only' ? { type: 'readOnly', networkAccess: !!options.networkAccessEnabled }
+      : options.sandboxMode === 'workspace-write' ? { type: 'workspaceWrite', writableRoots: [options.workingDirectory, ...(options.additionalDirectories || [])], networkAccess: !!options.networkAccessEnabled }
+        : { type: 'dangerFullAccess' };
+    const ready = this.ready.then(async () => {
+      const reply = await this.rpc(id ? 'thread/resume' : 'thread/start', {
+        ...(id ? { threadId: id } : {}), cwd: options.workingDirectory,
+        model: options.model || null, approvalPolicy: owner.approvalPolicy, sandbox: options.sandboxMode,
+        config: { web_search: options.webSearchMode || 'disabled', sandbox_workspace_write: { network_access: !!options.networkAccessEnabled, writable_roots: options.additionalDirectories || [] } },
+      });
+      const actual = reply?.thread?.id;
+      if (!actual || (id && actual !== id)) throw new Error('Codex did not resume the requested thread');
+      id = actual;
+    });
+    ready.catch(() => {});
+    return {
+      get id() { return id; }, ready: () => ready,
+      async runStreamed(prompt, { signal, outputSchema } = {}) {
+        await ready;
+        const queue = []; const text = new Map(); let wake; let done = false; let failure; let turnId;
+        const push = (event) => { queue.push(event); wake?.(); };
+        const abort = () => {
+          failure = Object.assign(new Error('Codex turn aborted'), { name: 'AbortError' }); done = true; wake?.();
+          if (turnId) owner.rpc('turn/interrupt', { threadId: id, turnId }).catch(() => {});
+        };
+        owner.listener = (msg) => {
+          const p = msg.params || {};
+          if (p.threadId && p.threadId !== id) return;
+          if (msg.method === 'synabun/exit') { failure = msg.error; done = true; wake?.(); }
+          if (msg.method === 'item/agentMessage/delta') {
+            const value = (text.get(p.itemId) || '') + (p.delta || '');
+            text.set(p.itemId, value);
+            push({ type: 'item.updated', item: { id: p.itemId, type: 'agent_message', text: value } });
+          }
+          if (msg.method === 'item/started' || msg.method === 'item/completed') {
+            const item = p.item || {};
+            const types = { agentMessage: 'agent_message', commandExecution: 'command_execution', fileChange: 'file_change', mcpToolCall: 'mcp_tool_call', webSearch: 'web_search', reasoning: 'reasoning' };
+            push({ type: msg.method === 'item/started' ? 'item.started' : 'item.completed', item: { ...item, type: types[item.type] || item.type, aggregated_output: item.aggregatedOutput, exit_code: item.exitCode } });
+          }
+          if (msg.method === 'turn/completed') {
+            if (p.turn?.status === 'failed') push({ type: 'turn.failed', error: p.turn.error || { message: 'Codex turn failed' } });
+            else if (p.turn?.status === 'interrupted') failure = Object.assign(new Error('Codex turn interrupted'), { name: 'AbortError' });
+            else push({ type: 'turn.completed' }); // rollout meter is authoritative across resumes
+            done = true; wake?.();
+          }
+        };
+        signal?.addEventListener('abort', abort, { once: true });
+        try {
+          if (signal?.aborted) throw Object.assign(new Error('Codex turn aborted'), { name: 'AbortError' });
+          const reply = await owner.rpc('turn/start', { threadId: id, input: [{ type: 'text', text: String(prompt), text_elements: [] }], approvalPolicy: owner.approvalPolicy, sandboxPolicy, effort: options.modelReasoningEffort || null, ...(outputSchema ? { outputSchema } : {}) });
+          turnId = reply?.turn?.id;
+          if (signal?.aborted) abort();
+        } catch (error) { owner.listener = null; signal?.removeEventListener('abort', abort); throw error; }
+        return { events: (async function* () {
+          try {
+            yield { type: 'thread.started', thread_id: id };
+            while (!done || queue.length) {
+              if (queue.length) yield queue.shift();
+              else await new Promise((r) => { wake = r; });
+            }
+            if (failure) throw failure;
+          } finally { owner.listener = null; signal?.removeEventListener('abort', abort); }
+        })() };
+      },
+    };
+  }
+  async dispose() {
+    this.requestAbort.abort();
+    this.startupSignal?.removeEventListener('abort', this.cancelStartup);
+    if (this.proc.exitCode !== null || this.proc.signalCode) return;
+    if (process.platform === 'win32') {
+      try { execFileSync('taskkill', ['/pid', String(this.proc.pid), '/T', '/F'], { timeout: 5000, stdio: 'ignore', windowsHide: true }); } catch {}
+    } else this.proc.kill('SIGTERM');
+    let timer;
+    await Promise.race([this.exited, new Promise((r) => { timer = setTimeout(r, 1500); })]);
+    clearTimeout(timer);
+    if (this.proc.exitCode === null && !this.proc.signalCode) this.proc.kill('SIGKILL');
+  }
+}

package/neural-interface/lib/confined-fs.js

@@ -19,7 +19,7 @@
 // sequence; it does not remove it.
 
 import {
-  openSync, closeSync, fstatSync, lstatSync, readSync, writeSync, ftruncateSync, fsyncSync,
+  openSync, closeSync, fstatSync, fchmodSync, lstatSync, readSync, writeSync, ftruncateSync, fsyncSync,
   mkdirSync, readdirSync, rmSync, unlinkSync, renameSync, realpathSync, createReadStream, constants,
 } from 'node:fs';
 import { randomBytes } from 'node:crypto';
@@ -142,6 +142,17 @@ export function writeConfinedFile(base, path, data, { exclusive = false, mode =
     if (!st.isFile()) throw new PathConfineError(400, 'Not a regular file.');
     if (!created) ftruncateSync(fd, 0);
     writeAll(fd, data);
+  } catch (err) {
+    // A file this call created and could not fill (the disk filled, the data could not be had) is not left
+    // half written: it is removed while it is still the file that was opened.
+    if (created) {
+      try {
+        const mine = fstatSync(fd);
+        const now = lstatSync(real);
+        if (now.dev === mine.dev && now.ino === mine.ino) unlinkSync(real);
+      } catch { /* gone already, or no longer ours */ }
+    }
+    throw err;
   } finally { try { closeSync(fd); } catch {} }
   return real;
 }
@@ -173,14 +184,29 @@ export function removeConfinedEntry(base, path) {
   return true;
 }
 
+/**
+ * What is at `path` itself, a link not followed: 'absent', 'file', 'dir', 'link' or 'other' (a FIFO, a
+ * socket, a device). Nothing is opened.
+ */
+export function entryKind(path) {
+  let st;
+  try { st = lstatSync(String(path)); } catch { return 'absent'; }
+  if (st.isSymbolicLink()) return 'link';
+  if (st.isFile()) return 'file';
+  if (st.isDirectory()) return 'dir';
+  return 'other';
+}
+
 /**
  * Replace `path` with `data` through a temporary file in the same folder:
  * created exclusively under an unpredictable name, never through a link, then
  * renamed over `path` (a rename replaces a link, it does not follow it).
  * `expect` is the file's state when it was read ({ dev, ino, mtimeMs, size }):
- * a file that changed since is not overwritten (409).
+ * a file that changed since is not overwritten (409). `exactMode`: the new
+ * file gets `mode` as it is, not narrowed by the process umask (a file that
+ * replaces another keeps the permissions that one had).
  */
-export function replaceFileAtomic(path, data, { mode = 0o600, expect = null } = {}) {
+export function replaceFileAtomic(path, data, { mode = 0o600, expect = null, exactMode = false } = {}) {
   const dir = realPathOf(dirname(String(path)));
   const target = join(dir, basename(String(path)));
   const tmp = join(dir, `.${basename(target)}.${randomBytes(12).toString('hex')}.tmp`);
@@ -190,6 +216,7 @@ export function replaceFileAtomic(path, data, { mode = 0o600, expect = null } =
     try {
       const st = verifyOpened(fd, tmp);
       if (!st.isFile()) throw moved();
+      if (exactMode) fchmodSync(fd, mode & 0o7777);
       writeAll(fd, data);
       try { fsyncSync(fd); } catch {}
     } finally { try { closeSync(fd); } catch {} }