synabun 2.0.10 → 2.2.0

package/neural-interface/lib/native-loop-providers.js

@@ -1,16 +1,36 @@
-import { detectProject as memoryProject } from '../../mcp-server/dist/config.js';
+import { codexWorkerReply, CODEX_QUESTIONS, elicitationReply, openCodeAnswers, workerQuestions } from './worker-question.js';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { externalServerInventory, selectExternalServers, codexMcpEnabledOverride, referenceClaudeMap, waitForClaudeMcpScope, redactMcpValues, writePrivateMcpConfig, mcpDefinitionValues } from './mcp-external-servers.js';
+import { resolveStoredTools, runtimeToolsValue, readDefaultTools } from './tool-lists.js';
+import { waitForSynabunTools, synabunToolsTimeoutText } from './opencode-mcp-ready.js';
+import { config as memoryConfig, detectProject as memoryProject } from '../../mcp-server/dist/config.js';
 import { Codex } from '@openai/codex-sdk';
+import { CodexWorkerAppServer } from './codex-worker-app-server.js';
 import { query as claudeQuery } from '@anthropic-ai/claude-agent-sdk';
 import { CLAUDE_EFFORT_LEVELS } from './claude-model-catalog.js';
 import { CLAUDE_NOT_INSTALLED, resolveClaudeSdkExecutable } from './claude-executable.js';
 import { extractOpenCodeText } from './session-title-generator.js';
+import { withServeEnv } from './opencode-protocol.js';
 import { patchCodexLineSplitting } from './jsonl-lines.js';
-import { dirname } from 'node:path';
+import { dirname, join } from 'node:path';
 import { codexReasoningEffort } from './effort-levels.js';
+import { spawn as spawnProcess } from 'node:child_process';
 import { codexStreamMedia, collectCodexMedia, openCodeMediaPart, ownCodexImages } from './assistant-media.js';
 import { browserToolDenial } from './browser-tool-policy.js';
 import { CODEX_BROWSER_POLICY_UNTRUSTED_NOTE, codexBrowserPolicyHook } from './assistant-route-gate-codex.js';
 import { codexWindowsSandbox, codexWindowsSandboxConfig } from './agent-sandbox-elevation.js';
+import { DRAFT_DISALLOWED_TOOLS, DRAFT_TOOLS, codexDraftOptions, draftOpenCodeDecision, draftPreToolUseHook, draftToolDecision, openCodeDraftConfig, resolveDraftConfinement } from './skills/draft-confinement.js';
+import { EVAL_CONFINEMENT, codexEvalOptions, evalClaudeOptions, evalGitSafetyEnv, evalOpenCodeDecision, evalPreToolUseHook, evalToolDecision, openCodeEvalConfig, openCodeEvalEnv, placeOpenCodeEvalSkill, resolveEvalConfinement } from './skills/eval-confinement.js';
+import { WORKER_GUARD_DEFAULT, acpPermissionDecision, codexSandboxFor, confinementEvent, openCodeCodeModeDecision, openCodeCodeModeNote, openCodePermissionDecision, openCodePermissionsFor, resolveWorkerConfinement, workerShellDecision, workerToolDecision } from './worker-confinement.js';
+import { createAcpConnection } from './antigravity/acp-connection.js';
+import { acpTurnUsage } from './antigravity/usage.js';
+import { assertSafeAntigravityProject, antigravityHomeReadPolicy, antigravityHomeSettings, policyHookCommand, prepareAntigravityHome, toAntigravityMcpEntry, userAntigravityMcpServers, userAntigravitySettings, userGeminiDir } from './antigravity/home.js';
+import { acpCall, acpPolicyInput, acpReadOnlyKind, acpToolName, acpToolPaths, acpWebTool } from './antigravity/tool-call.js';
+import { splitAntigravityModel } from './antigravity/catalog.js';
+import { fileURLToPath } from 'node:url';
+
+function nativeToolSelection(options, provider) { return resolveStoredTools(options, { source: options.runMode === 'task' ? 'dispatch' : 'launch', provider, defaultTools: options.runMode === 'task' ? undefined : readDefaultTools(memoryConfig.dataHome) }); }
 
 function stringEnv(source) {
   const out = {};
@@ -112,6 +132,12 @@ export function normalizeOpenCodeModel(model) {
 export const PERMISSION_POLICIES = new Set(['auto', 'ask', 'restricted']);
 export const CAPABILITIES = new Set(['read-only', 'workspace', 'full']);
 export const CLAUDE_READ_ONLY_DISALLOWED_TOOLS = ['Write', 'Edit', 'MultiEdit', 'NotebookEdit', 'Bash'];
+// The owner's live data home (its real memory DB). A worker's shell must never inherit these: a temp server or a
+// test suite started from the worker would otherwise open the owner's real store (a reviewer's temp boot did,
+// briefly). The worker's own SynaBun MCP child gets the DB through its own env block / DOTENV_PATH (server.js
+// buildCodexMcpEnv, the OpenCode serve config), not from the shell; the Claude worker's MCP is in-process HTTP and
+// needs nothing here. Stripped for every worker (guarded and full alike): a worker never opens the live DB directly.
+export const LIVE_DATA_ENV = Object.freeze(['SQLITE_DB_PATH', 'MEMORY_DATA_DIR']);
 
 export function normalizePermissionPolicy(policy) {
   const value = String(policy || 'auto').trim().toLowerCase();
@@ -136,6 +162,99 @@ function policyUnsupportedError(provider, policy) {
   return error;
 }
 
+/** A confined run (lib/skills/draft-confinement.js) that cannot be set up on its provider: it never starts unconfined. */
+function confinementUnsupportedError(provider, reason, what = 'a drafting folder') {
+  const error = new Error(`${provider} cannot run confined to ${what}${reason ? ` (${reason})` : ''}: the run did not start.`);
+  error.code = 'CONFINEMENT_UNSUPPORTED';
+  return error;
+}
+
+/** Claude's built-in writers, kept off the tool list of an enforced read-only run (the hook refuses them too; Bash is the hook's). */
+export const CLAUDE_READ_ONLY_WRITE_TOOLS = Object.freeze(['Write', 'Edit', 'MultiEdit', 'NotebookEdit']);
+
+/**
+ * The worker confinement of a run (lib/worker-confinement.js), or null: capability full, the Protect workers
+ * setting off, or a skill-drafting run (which has its own, stricter confinement). Throws when the working
+ * directory cannot be resolved: the run must not start on a guess.
+ */
+function workerGuardFor({ capability, cwd, guardMode, scratchDir, confinement, serverPort = null, localPorts = null, localPortRange = null }) {
+  if (confinement) return null;
+  // Never rooted where the server runs: a run without a cwd is rooted at its scratch folder, or does not start.
+  return resolveWorkerConfinement({ capability, cwd: cwd || null, mode: guardMode, scratchDir: scratchDir || null, serverPort, localPorts, localPortRange });
+}
+/** The port of SynaBun's own server, from a run's MCP address (a guarded worker's shell may not call it). */
+function serverPortOf(mcpUrl, fallback = null) {
+  try { const port = Number(new URL(String(mcpUrl)).port); if (port > 0) return port; } catch { /* no address */ }
+  return Number(fallback) > 0 ? Number(fallback) : null;
+}
+
+/**
+ * What an OpenCode run's own config carries for its confinement (server.js setupOpencodeLoopConfig): null for an
+ * unguarded run (today's rules), else { permissions (OpenCode 2's rules), mcp: 'off'?, directMcp: true? }. A
+ * skill-drafting run has no shell, web, subagent or skill tool and no MCP server; a guarded worker has the rules its
+ * adapter answers by policy, and under Enforce no Code Mode: `directMcp` sets `codemode: false` on every MCP server of
+ * the run's config, which OpenCode 2.1.4 otherwise reaches only through Code Mode's `execute` (denied by the rules).
+ */
+export function openCodeRunConfigFor(state = {}) {
+  if (state.confinement?.kind === EVAL_CONFINEMENT) return openCodeEvalConfig({ role: state.confinement.role, shell: state.confinement.shell === true });
+  if (state.confinement) return openCodeDraftConfig();
+  const guard = workerGuardFor({ capability: normalizeCapability(state.capability), cwd: state.cwd, guardMode: state.guardMode ?? WORKER_GUARD_DEFAULT, scratchDir: state.scratchDir, confinement: null, serverPort: state.serverPort || null });
+  if (!guard) return null;
+  return { permissions: openCodePermissionsFor(guard), ...(guard.enforced ? { directMcp: true } : {}) };
+}
+
+/**
+ * Whether an OpenCode run is a protected worker: an Assistant task worker with capability read-only or workspace
+ * under Protect workers = Enforce (never a drafting or evaluation run, which have confinements of their own; never
+ * Warn, Off or full). Its serve reads no project configuration (openCodeRunEnvFor) and keeps its password out of every
+ * environment (server.js ensureIsolatedServe `hidePassword`: lib/opencode-protocol.js serveSpecFor passwordFrom
+ * 'stdout'). Throws like resolveWorkerConfinement when a guarded run has no folder.
+ */
+export function openCodeProtectedWorker(state = {}) {
+  if (state.confinement) return false;
+  const guard = workerGuardFor({ capability: normalizeCapability(state.capability), cwd: state.cwd, guardMode: state.guardMode ?? WORKER_GUARD_DEFAULT, scratchDir: state.scratchDir, confinement: null, serverPort: state.serverPort || null });
+  return !!guard?.enforced;
+}
+
+/**
+ * What a protected worker's serve environment holds (openCodeProtectedWorker): no project configuration at all, so
+ * nothing the worker writes in its folder runs in the serve (no opencode.json with plugins or MCP servers, no
+ * .opencode plugin, agent, command or tool, no project AGENTS.md: OPENCODE_DISABLE_PROJECT_CONFIG, and
+ * OPENCODE_CONFIG_PROJECT_DISABLE too, which OpenCode 2 reads first), and no inherited OPENCODE_CONFIG_DIR (OpenCode
+ * reads that folder in place of the run's own configuration, whose rules, `codemode: false` and SynaBun MCP pin would
+ * then be gone). Every inherited GIT_* variable is removed too: repository, index and object paths could point git
+ * outside the folder, and GIT_CONFIG_PARAMETERS or GIT_CONFIG_COUNT/KEY_n/VALUE_n could run an fsmonitor or pager.
+ * `GIT_*: null` clears the prefix before deliberate settings are applied (lib/opencode-protocol.js withServeEnv).
+ */
+export const OPENCODE_PROTECTED_WORKER_ENV = Object.freeze({
+  OPENCODE_DISABLE_PROJECT_CONFIG: '1', OPENCODE_CONFIG_PROJECT_DISABLE: '1', OPENCODE_CONFIG_DIR: null,
+  'GIT_*': null,
+});
+
+/**
+ * What an OpenCode run's serve environment carries for its confinement (server.js ensureIsolatedServe): an evaluation
+ * run's (no project configuration, no file watcher, git's safety settings: lib/skills/eval-confinement.js
+ * openCodeEvalEnv), a protected worker's (OPENCODE_PROTECTED_WORKER_ENV), else null. A value of null removes that
+ * variable from the serve's environment. Throws when the evaluation folder cannot be resolved: the serve must not start
+ * unconfined.
+ */
+export function openCodeRunEnvFor(state = {}) {
+  if (state.confinement?.kind === EVAL_CONFINEMENT) return openCodeEvalEnv(resolveEvalConfinement(state.confinement, state.cwd));
+  if (openCodeProtectedWorker(state)) return { ...OPENCODE_PROTECTED_WORKER_ENV };
+  return null;
+}
+
+/**
+ * An evaluation trial with the skill: its copy placed in the run's own OpenCode configuration folder (`configDir`,
+ * server.js setupOpencodeLoopConfig's, removed with the run's serve), where OpenCode reads it as a global skill
+ * (lib/skills/eval-confinement.js placeOpenCodeEvalSkill). → the folder, or null (not an evaluation, a baseline, a
+ * grader). Throws when it cannot be placed: the run must not start without the skill it tests.
+ */
+export function openCodeEvalSkillFor(state = {}, configDir) {
+  if (state.confinement?.kind !== EVAL_CONFINEMENT) return null;
+  return placeOpenCodeEvalSkill(resolveEvalConfinement(state.confinement, state.cwd), configDir);
+}
+
 /** Final assistant text carried by a Codex SDK stream event, or null. */
 export function codexAgentMessageText(event) {
   if (!event) return null;
@@ -241,33 +360,55 @@ function codexStructuredOutput(text, schema) {
 export async function createCodexNativeLoopAdapter(options = {}) {
   const {
     runId, cwd, model, effort, codexHome, codexPath, browserSessionId,
-    browserTabId, mcpProfile, onIdentity = () => {}, onEvent = () => {},
+    browserTabId, onIdentity = () => {}, onEvent = () => {},
     CodexClass = Codex,
-    extraEnv = {}, permissionPolicy: rawPolicy = 'auto', capability: rawCapability = 'full',
+    extraEnv = {}, permissionPolicy: rawPolicy = 'auto', permissionBroker = null, capability: rawCapability = 'full',
     outputSchema = null, desktopGrantProvider = null, modelContextWindow = null, contextMode = null,
     // Image creation runs (assistant dispatch): 'image' → each turn returns the images it generated.
     collectMedia = null,
-    // Assistant task runs: the browser policy's hook and the run's notes (a function: never in the state file).
-    runMode = 'loop', onNote = null, browserPolicyTrust = null,
+    // Assistant task runs: the browser policy's hook and the run's notes (a function: never in the state file), and
+    // the registered code projects its test runners may also run in (lib/browser-policy-roots.js, read as the run starts).
+    runMode = 'loop', onNote = null, browserPolicyTrust = null, policyRoots = [],
     // Inherited variables to remove before extraEnv applies (the Codex account's launch:
     // lib/codex-accounts.js launchFor() — inherited OpenAI/Codex credentials never reach the run).
     unsetEnv = [],
     // The Admin sandbox setting when the run started (lib/agent-sandbox-elevation.js): the Windows
     // sandbox every `codex exec` of the thread may use. The run keeps it while it lives.
     adminSandbox = false,
+    // A skill-drafting run's confinement (lib/skills/draft-confinement.js codexDraftOptions): the sandbox around the
+    // workspace, no network, no MCP server.
+    confinement = null,
+    // The Protect workers setting as the run starts (lib/worker-confinement.js), the run's own scratch folder and
+    // SynaBun's own port (a guarded worker's shell may not call it).
+    guardMode = WORKER_GUARD_DEFAULT, scratchDir = null, serverPort = null, localPortRange = null,
   } = options;
   const permissionPolicy = normalizePermissionPolicy(rawPolicy);
   const capability = normalizeCapability(rawCapability);
+  // Resolved before anything starts: a confinement that cannot be set up stops the run (never an unconfined start).
+  let drafted = null;
+  let evaluated = null;
+  if (confinement?.kind === EVAL_CONFINEMENT) {
+    // A skill-evaluation run (lib/skills/eval-confinement.js): the sandbox around its job folder (read-only for a
+    // grader, a judge or a proposer), no network, no web search, every MCP server disabled.
+    let held;
+    try { held = resolveEvalConfinement(confinement, cwd); } catch (error) { throw confinementUnsupportedError('Codex', error?.message || error, 'an evaluation folder'); }
+    evaluated = { held, ...codexEvalOptions(held, { codexHome, projectDir: cwd }) };
+  } else if (confinement) {
+    let confined;
+    try { confined = resolveDraftConfinement(confinement, cwd); } catch (error) { throw confinementUnsupportedError('Codex', error?.message || error); }
+    drafted = codexDraftOptions(confined, { codexHome, projectDir: cwd });
+  }
+  // Either confinement's options (the thread's sandbox and the config's MCP switches): one shape.
+  const boxed = drafted || evaluated;
+  const guard = boxed ? null : workerGuardFor({ capability, cwd, guardMode, scratchDir, confinement: null, serverPort, localPortRange });
   // "<id>[extended]" (the Assistant's extended-context row) runs <id> with the
   // larger window the dispatcher read from the catalog; never silently at 272k.
   const legacyExtended = /\[extended\]$/i.test(String(model || ''));
   const extended = contextMode === 'extended' || legacyExtended;
   const runModel = legacyExtended ? String(model).replace(/\[extended\]$/i, '') : model;
   if (extended && !(Number(modelContextWindow) > 0)) throw new Error(`Extended context is unavailable for ${runModel}.`);
-  // The Codex SDK drives `codex exec`, which has no approval channel: an 'ask'
-  // policy would hang or fail mid-turn. Refuse up front so the dispatcher can
-  // offer 'restricted' instead.
-  if (permissionPolicy === 'ask') throw policyUnsupportedError('Codex', permissionPolicy);
+  // Legacy exec loops have no approval channel. Task workers use an app-server.
+  if (permissionPolicy === 'ask' && runMode !== 'task') throw policyUnsupportedError('Codex', permissionPolicy);
   // Assistant task runs: SynaBun's browser policy as a PreToolUse hook the
   // user's Codex trusts (the brain's route-gate mechanism), and no web search
   // of Codex's own. Without a trusted hook the policy is instructions only
@@ -280,19 +421,41 @@ export async function createCodexNativeLoopAdapter(options = {}) {
   }
   const pins = stringEnv({
     SYNABUN_TERMINAL_SESSION: runId,
+    SYNABUN_RUN_MODE: options.runMode === 'task' ? 'task' : undefined,
     SYNABUN_PROJECT: cwd ? memoryProject(cwd) : 'global',
     SYNABUN_BROWSER_SESSION: browserSessionId,
     SYNABUN_BROWSER_TAB: browserTabId,
-    SYNABUN_PROFILE: mcpProfile,
+    SYNABUN_TOOLS: runtimeToolsValue((() => { const list = nativeToolSelection(options, 'codex'); return list.items.includes('all') ? list.items : [...list.groups, ...list.servers]; })()),
     SYNABUN_TOOL_CATALOG_MODE: 'deferred',
     // Computer-use workers: the grant unlocks the `computer` group in the MCP child.
     SYNABUN_DESKTOP_GRANT: typeof desktopGrantProvider === 'function' ? desktopGrantProvider() || undefined : undefined,
   });
   const inherited = { ...process.env };
+  for (const key of ['SYNABUN_PROFILE', 'SYNABUN_RUNTIME_PROFILE_PATH', 'SYNABUN_TOOLS', 'SYNABUN_TOOLS_PATH']) delete inherited[key];
   for (const key of Array.isArray(unsetEnv) ? unsetEnv : []) delete inherited[key];
-  const env = stringEnv({ ...inherited, ...pins, CODEX_HOME: codexHome, ...(browserPolicy ? { SYNABUN_BROWSER_POLICY_CWD: cwd || process.cwd() } : {}), ...stringEnv(extraEnv) });
+  // A worker never holds a brain's launch credential (the Assistant's own identity) or an owner's page secret.
+  delete inherited.SYNABUN_BRAIN_TOKEN;
+  // The worker's shell must not inherit the owner's live-data paths (its MCP child gets them through its own
+  // config: server.js buildCodexMcpEnv). A worker that boots a temp server or runs the suite stays off the live DB.
+  for (const key of LIVE_DATA_ENV) delete inherited[key];
+  // The hook reads the run's project and the other projects its test runners may run in (a JSON list) from its env.
+  const policyEnv = browserPolicy ? { SYNABUN_BROWSER_POLICY_CWD: cwd || process.cwd(), SYNABUN_BROWSER_POLICY_ROOTS: JSON.stringify(Array.isArray(policyRoots) ? policyRoots : []) } : {};
+  const env = withServeEnv(stringEnv({ ...inherited, ...pins, CODEX_HOME: codexHome, ...policyEnv, ...stringEnv(extraEnv) }), evaluated ? evalGitSafetyEnv(evaluated.held.root) : null);
   const config = { ...codexWindowsSandboxConfig(adminSandbox) };
-  if (Object.keys(pins).length) config.mcp_servers = { SynaBun: { env: pins } };
+  if (Object.keys(pins).length) config.mcp_servers = { SynaBun: { env: pins, ...(task ? { tool_timeout_sec: Math.ceil((options.questionTimeoutMs || 30 * 60_000) / 1000) + 30 } : {}) } };
+  if (!boxed) {
+    const inventory = externalServerInventory({ provider: 'codex', cwd, codexHome, env, home: env.HOME, dataHome: memoryConfig.dataHome, ...options.externalMcpContext });
+    const list = nativeToolSelection(options, 'codex');
+    const scope = selectExternalServers(list.servers, inventory);
+    // Leaf overrides preserve native transports/env. Codex treats quotes in a
+    // path literally; reject unaddressable names rather than launch a wider scope.
+    for (const name of scope.disabled) {
+      if (inventory.servers.find(row => row.name === name)?.reason === 'disabled-in-provider') continue;
+      config[codexMcpEnabledOverride(name)] = false;
+    }
+  }
+  // A drafting or evaluation run: every MCP server disabled (SynaBun's keeps its pins beside the switch; they never start).
+  if (boxed) config.mcp_servers = { ...(config.mcp_servers || {}), ...Object.fromEntries(Object.entries(boxed.config.mcp_servers).map(([name, value]) => [name, { ...(config.mcp_servers?.[name] || {}), ...value }])) };
   if (extended) config.model_context_window = Math.floor(Number(modelContextWindow));
   if (browserPolicy) Object.assign(config, browserPolicy.config);
   // The SDK is always told which Codex to start: the user's own installation.
@@ -303,7 +466,16 @@ export async function createCodexNativeLoopAdapter(options = {}) {
     error.code = 'CODEX_NOT_INSTALLED';
     throw error;
   }
-  const codex = new CodexClass({
+  const WorkerCodex = task && !boxed && CodexClass === Codex ? CodexWorkerAppServer : CodexClass;
+  const codex = new WorkerCodex({
+    permissionPolicy,
+    onRequest: permissionBroker && !boxed ? async (packet, signal) => {
+      const question = CODEX_QUESTIONS.has(packet.method);
+      if (!question && permissionPolicy !== 'ask') return { error: { code: -32601, message: 'Unexpected worker approval request' } };
+      const reply = await permissionBroker.request({ kind: question ? 'ask' : 'tool', toolName: packet.method, input: packet.params, questions: workerQuestions(packet.params), protocol: { provider: 'codex', method: packet.method, id: packet.id }, signal });
+      return codexWorkerReply(packet, reply);
+    } : null,
+    onProcess: options.onProcess, signal: options.signal, apiKey: options.apiKey, configArgs: options.configArgs,
     ...(codexPath ? { codexPathOverride: codexPath } : {}),
     env,
     config,
@@ -312,23 +484,67 @@ export async function createCodexNativeLoopAdapter(options = {}) {
   // U+2028 / U+2029: a command printing one ended the run with "Failed to parse item".
   patchCodexLineSplitting(codex);
   const parent = dirname(cwd || process.cwd());
-  const thread = codex.startThread({
+  // The sandbox: a drafting run's (the workspace, no network); an enforced guard's (lib/worker-confinement.js
+  // codexSandboxFor: read-only, or workspace-write with the working directory and the scratch folder, never the
+  // parent folder); else today's (the capability's mode, the parent folder writable too).
+  const sandboxed = guard?.enforced ? codexSandboxFor(guard, { parentDir: parent && parent !== cwd ? parent : null, scratchDir }) : null;
+  // A guarded Codex worker (Protect workers = Enforce) runs with network OFF in Codex's own sandbox. Codex's
+  // sandbox network is all-or-nothing (no per-host/loopback denial on this CLI), so SynaBun cannot wrap it in an
+  // outer Seatbelt (nested sandbox-exec is refused): turning the network off is the only way its shell commands
+  // (node -e, curl, a script) cannot reach SynaBun's own control port or any other local endpoint. The owner has
+  // accepted that read-only / workspace Codex workers lose internet (HTTPS, npm, git fetch) for their shell. The
+  // worker's SynaBun MCP child runs outside this command sandbox, so remember / recall / browser tools still work.
+  const codexNetworkOff = !!(boxed || guard?.enforced);
+  const threadOptions = {
     workingDirectory: cwd || process.cwd(),
     model: runModel || undefined,
     modelReasoningEffort: normalizeCodexEffort(effort),
     approvalPolicy: 'never',
-    sandboxMode: codexSandboxModeFor({ permissionPolicy, capability }),
+    sandboxMode: boxed ? boxed.thread.sandboxMode : sandboxed ? sandboxed.sandboxMode : codexSandboxModeFor({ permissionPolicy, capability }),
     skipGitRepoCheck: true,
-    networkAccessEnabled: true,
-    ...(task ? { webSearchMode: 'disabled' } : {}),
-    additionalDirectories: parent && parent !== cwd ? [parent] : undefined,
-  });
+    networkAccessEnabled: !codexNetworkOff,
+    ...(task || boxed ? { webSearchMode: 'disabled' } : {}),
+    additionalDirectories: boxed ? undefined : sandboxed ? sandboxed.additionalDirectories : parent && parent !== cwd ? [parent] : undefined,
+  };
+  const thread = options.resumeThreadId ? codex.resumeThread(options.resumeThreadId, threadOptions) : codex.startThread(threadOptions);
+  try { await thread.ready?.(); } catch (error) { await codex.dispose?.(); throw error; }
+  if (thread.id) onIdentity({ providerThreadId: thread.id, providerSessionId: thread.id });
   let alive = true;
   let activeAbort = null;
   let activeTurn = null;
-  // Every runTurn is its own `codex exec`, which numbers its items from item_0
-  // again: the sidepanel keys a turn's items by this sequence.
-  let providerTurn = 0;
+  // A guarded run says at its start what holds it: Codex's sandbox never reports to SynaBun by itself, so this is
+  // the one place the note is written before any command (the run's notes, then its events).
+  if (guard) {
+    try { onNote?.(`worker confinement (${guard.mode}, capability ${guard.capability}): Codex sandbox ${sandboxed ? sandboxed.sandboxMode : codexSandboxModeFor({ permissionPolicy, capability })}${guard.enforced ? `, writable: ${guard.writable.join(', ')}` : ' as before (warn: what Enforce would refuse is noted)'}`); } catch {}
+    // Network-off is the one way a Codex worker's shell cannot reach SynaBun's control port (Codex runs its own
+    // sandbox, which SynaBun cannot wrap, and its network is all-or-nothing). Say it plainly, once, at the start.
+    if (guard.enforced) { try { onNote?.('This protected Codex worker has NO internet for its shell commands: Codex\'s sandbox network is all-or-nothing, so to keep its commands off SynaBun\'s control port (and every local port) the network is off. HTTPS, npm install and git fetch will fail in the shell; your SynaBun MCP tools (remember, recall, browser) still work. A run that needs internet in its shell must use capability "full".'); } catch {} }
+    else { try { onNote?.('warn mode: Enforce would also turn this Codex worker\'s shell network off (no internet), so its commands could not reach SynaBun\'s control port.'); } catch {} }
+  }
+  if (drafted) { try { onNote?.('skill-draft confinement: Codex sandbox workspace-write around the drafting folder, no network, no web search, every MCP server disabled; the shell stays, inside the sandbox'); } catch {} }
+  if (evaluated) { try { onNote?.(`skill-eval confinement (${evaluated.held.role}): Codex sandbox ${evaluated.thread.sandboxMode} around the evaluation folder, no network, no web search, every MCP server disabled; the shell stays, inside the sandbox`); } catch {} }
+  /**
+   * A command Codex ran (item.completed command_execution): under warn, what Enforce would have refused is noted;
+   * under enforce, a sandbox denial in its output is explained in SynaBun's words (Codex's sandbox refuses by itself
+   * and says nothing to SynaBun).
+   */
+  const noteCommand = (item, meta) => {
+    if (!guard || item?.type !== 'command_execution') return;
+    const command = typeof item.command === 'string' ? item.command : Array.isArray(item.command) ? item.command.join(' ') : '';
+    if (!command) return;
+    const decision = workerShellDecision(command, guard);
+    const output = String(item.aggregated_output || item.output || '');
+    const denied = Number(item.exit_code) !== 0 && /operation not permitted|permission denied|read-only file system|sandbox|EPERM|EACCES|EROFS/i.test(output);
+    if (!decision && !denied) return;
+    const event = decision
+      ? confinementEvent(decision, { tool: 'shell', confinement: guard, provider: 'codex' })
+      : { type: 'synabun.confinement', action: 'refused', capability: guard.capability, tool: 'shell', rule: 'sandbox', reason: `Codex's sandbox refused "${command.slice(0, 160)}": this run (capability ${guard.capability}) writes inside ${guard.writable.join(', ')} only${guard.capability === 'read-only' ? ' (read-only: nothing at all, the temp folder included)' : ''}.`, provider: 'codex' };
+    if (decision && guard.enforced && !denied) event.action = 'noted'; // the sandbox decides; the heuristic's view is a note
+    onEvent({ provider: 'codex', runId, iteration: meta?.iteration, event });
+  };
+  // The sidepanel keys a turn's items by this sequence, including across a restart.
+  // Scheduled SDK turns restart their item IDs; app-server workers keep their thread IDs.
+  let providerTurn = Number(options.providerTurnBase) || 0;
   // Generated images already returned by an earlier turn, and when the thread began (its rollout's day).
   const mediaSeen = new Set();
   let threadStartedMs = 0;
@@ -337,9 +553,13 @@ export async function createCodexNativeLoopAdapter(options = {}) {
     identity: () => ({ providerThreadId: thread.id, providerSessionId: thread.id }),
     isAlive: () => alive,
     describe: () => ({
-      provider: 'codex', permissionPolicy, capability, sandboxMode: codexSandboxModeFor({ permissionPolicy, capability }),
+      provider: 'codex', permissionPolicy, capability, sandboxMode: boxed ? boxed.thread.sandboxMode : sandboxed ? sandboxed.sandboxMode : codexSandboxModeFor({ permissionPolicy, capability }),
+      networkOff: codexNetworkOff,
       windowsSandbox: codexWindowsSandbox(adminSandbox),
       ...(task ? { browserPolicy: browserPolicy ? 'hook' : 'instructions' } : {}),
+      ...(drafted ? { confinement: 'skill-draft', root: cwd } : {}),
+      ...(evaluated ? { confinement: EVAL_CONFINEMENT, role: evaluated.held.role, root: cwd } : {}),
+      ...(guard ? { guard: { mode: guard.mode, capability: guard.capability, writable: [...guard.writable] } } : {}),
     }),
     async runTurn(prompt, meta = {}) {
       if (!alive) throw new Error('Codex native loop is closed');
@@ -377,6 +597,7 @@ export async function createCodexNativeLoopAdapter(options = {}) {
             if (agentText !== null) text = agentText;
             const saved = codexStreamMedia(event);
             if (saved) media.push(saved);
+            if (event?.type === 'item.completed') { try { noteCommand(event.item, meta); } catch { /* a note, never the turn */ } }
             if (event?.type === 'turn.failed') failure = codexFailureMessage(event.error);
             if (event?.type === 'turn.completed') { completed = true; if (event.usage) usage = event.usage; }
             if (event?.type === 'error') failure = codexFailureMessage(event);
@@ -415,6 +636,7 @@ export async function createCodexNativeLoopAdapter(options = {}) {
     async dispose() {
       alive = false;
       if (activeAbort) activeAbort.abort(asAbortError('disposed'));
+      await codex.dispose?.();
     },
   };
 }
@@ -438,28 +660,61 @@ export async function createClaudeNativeLoopAdapter(options = {}) {
     unsetEnv = [],
     // The host's last word on the environment: on Windows the Git Bash it names (lib/git-bash/).
     childEnv = null,
+    // A skill-drafting run (lib/skills/draft-confinement.js): file tools in its folder only, nothing else.
+    confinement = null,
+    // The Protect workers setting as the run starts (lib/worker-confinement.js), the run's own scratch folder and
+    // SynaBun's own port (a guarded worker's shell may not call it; read from mcpUrl when not given).
+    guardMode = WORKER_GUARD_DEFAULT, scratchDir = null, serverPort = null, localPortRange = null,
+    // Assistant task runs: the registered code projects the browser policy lets test runners run in besides the
+    // run's own (lib/browser-policy-roots.js, read as the run starts).
+    policyRoots = [],
+    // A run resumed after a server restart (assistant-dispatch.js resumeRun): the Claude session to continue, and the
+    // cost counter the resumed CLI starts from (it restores its total from the transcript's last `cost-state` line,
+    // lib/worker-resume.js readCostState), so the first turn after it is charged only for itself.
+    resumeSessionId = null, costBaseUsd = 0,
+    // Told the CLI's process once it is spawned ({ pid, startedAt, command }): a run that outlives this server is
+    // found by it (the next start ends an orphan before it resumes the session).
+    onProcess = null,
   } = options;
   const permissionPolicy = normalizePermissionPolicy(rawPolicy);
   const capability = normalizeCapability(rawCapability);
-  const askMode = permissionPolicy === 'ask' && typeof permissionBroker?.request === 'function';
+  // Resolved before anything starts: a confinement that cannot be set up stops the run (never an unconfined start).
+  let evaluated = null;
+  if (confinement?.kind === EVAL_CONFINEMENT) {
+    try { evaluated = resolveEvalConfinement(confinement, cwd); } catch (error) { throw confinementUnsupportedError('Claude Code', error?.message || error, 'an evaluation folder'); }
+  }
+  const confined = confinement && !evaluated ? resolveDraftConfinement(confinement, cwd) : null;
+  // Either confinement (drafting, evaluation): no worker guard, nothing asked, never bypassPermissions.
+  const held = confined || evaluated;
+  const evalOptions = evaluated ? evalClaudeOptions(evaluated) : null;
+  // The worker confinement of a read-only / workspace run: a PreToolUse hook on every call (subagents' included),
+  // which Claude Code runs before any permission mode, so the run keeps bypassPermissions and nothing waits.
+  const guard = workerGuardFor({ capability, cwd, guardMode, scratchDir, confinement: held, serverPort: serverPortOf(mcpUrl, serverPort), localPortRange });
+  const askMode = !held && permissionPolicy === 'ask' && typeof permissionBroker?.request === 'function';
   const input = createInputQueue();
   const abortController = new AbortController();
   let alive = true;
   let sessionId = null;
   let activeTurn = null;
   const inherited = cleanClaudeEnvironment();
+  for (const key of ['SYNABUN_PROFILE', 'SYNABUN_RUNTIME_PROFILE_PATH', 'SYNABUN_TOOLS', 'SYNABUN_TOOLS_PATH']) delete inherited[key];
   for (const key of Array.isArray(unsetEnv) ? unsetEnv : []) delete inherited[key];
+  // A worker never holds a brain's launch credential (the Assistant's own identity) or an owner's page secret.
+  delete inherited.SYNABUN_BRAIN_TOKEN;
+  // The worker's shell must not inherit the owner's live-data paths: a Claude worker's MCP is in-process HTTP (it
+  // reaches the DB through the Neural Interface, never from this env), so nothing here needs them.
+  for (const key of LIVE_DATA_ENV) delete inherited[key];
   const ownEnv = stringEnv({
     ...inherited,
     SYNABUN_TERMINAL_SESSION: runId,
+    SYNABUN_RUN_MODE: options.runMode === 'task' ? 'task' : undefined,
     SYNABUN_PROJECT: cwd ? memoryProject(cwd) : 'global',
-    SYNABUN_PROFILE: 'full',
     SYNABUN_BROWSER_SESSION: browserSessionId,
     SYNABUN_BROWSER_TAB: browserTabId,
-    SYNABUN_RUN_MODE: runMode === 'task' ? 'task' : undefined,
     ...stringEnv(extraEnv),
   });
-  const env = typeof childEnv === 'function' ? stringEnv(childEnv(ownEnv)) : ownEnv;
+  // Apply after every inherited/child environment overlay: drop ALL GIT_* first, then SynaBun's own safety entries.
+  const env = withServeEnv(typeof childEnv === 'function' ? stringEnv(childEnv(ownEnv)) : ownEnv, evalOptions?.env);
   const brokerRequest = async (request) => {
     try {
       const reply = await permissionBroker.request({
@@ -474,27 +729,46 @@ export async function createClaudeNativeLoopAdapter(options = {}) {
     'X-Synabun-Terminal': runId,
     'X-Synabun-Project': cwd ? memoryProject(cwd) : 'global',
     'X-Synabun-Memory-Session': runId,
+    'X-Synabun-Tools': runtimeToolsValue(resolveStoredTools(options, { source: options.runMode === 'task' ? 'dispatch' : 'launch', provider: 'claude-code' }).groups),
     'X-Synabun-Browser-Session': browserSessionId,
     'X-Synabun-Browser-Tab': browserTabId,
     // Computer-use workers: the grant unlocks the `computer` MCP group.
     'X-Synabun-Desktop-Grant': typeof desktopGrantProvider === 'function' ? desktopGrantProvider() || undefined : undefined,
   });
-  // Under 'ask' the orchestrator answers permission prompts (and AskUserQuestion
-  // becomes a relayed question); otherwise the run is unattended and both
-  // interactive tools stay denied. ExitPlanMode is never useful for a worker.
-  const denyMatcher = askMode ? 'ExitPlanMode' : 'AskUserQuestion|ExitPlanMode';
-  const denyMessage = askMode
-    ? 'Dispatched workers do not use plan mode.'
-    : 'This unattended automation cannot wait for interactive input.';
+  // Questions use the broker under every policy, independently of tool approvals.
+  // ExitPlanMode stays denied: asking does not need a separate plan turn.
+  const questionMode = !held && typeof permissionBroker?.request === 'function';
+  const denyMatcher = questionMode ? 'ExitPlanMode' : 'AskUserQuestion|ExitPlanMode';
+  const denyMessage = 'Dispatched workers do not use plan mode; questions use the live run sidepanel.';
+  // A confined run asks canUseTool for every write (permission mode 'default') on top of its PreToolUse hook, and
+  // loads no settings file: no user hooks (they would ask it for memories it has no tool to write), no allow rules.
+  const bypass = !askMode && !held;
+  // The guard's decision on a tool call: refused (enforce) or noted (warn), always written into the run's events.
+  const guardHook = guard ? async (input) => {
+    const decision = workerToolDecision(input?.tool_name, input?.tool_input || {}, guard);
+    if (!decision) return {};
+    onEvent({ provider: 'claude-code', runId, event: confinementEvent(decision, { tool: input?.tool_name, confinement: guard, provider: 'claude-code' }) });
+    if (!guard.enforced) return {};
+    return { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: decision.reason } };
+  } : null;
   const queryOptions = {
     cwd: cwd || process.cwd(),
-    permissionMode: askMode ? 'default' : 'bypassPermissions',
-    ...(askMode ? {} : { allowDangerouslySkipPermissions: true }),
+    permissionMode: bypass ? 'bypassPermissions' : 'default',
+    ...(bypass ? { allowDangerouslySkipPermissions: true } : {}),
     includePartialMessages: !!includePartialMessages,
     systemPrompt: { type: 'preset', preset: 'claude_code' },
-    settingSources: ['user', 'project', 'local'],
+    // A drafting run and every evaluation run read no settings file at all (an evaluation's skill under test comes as
+    // its one plugin, below); everything else the user's, the project's and the local ones.
+    settingSources: evalOptions ? evalOptions.settingSources : confined ? [] : ['user', 'project', 'local'],
     hooks: {
-      PreToolUse: [{
+      PreToolUse: [
+      // A skill-drafting run: every call, before any permission mode (lib/skills/draft-confinement.js).
+      ...(confined ? [{ hooks: [draftPreToolUseHook(confined)] }] : []),
+      // A skill-evaluation run: every call, the same way (lib/skills/eval-confinement.js).
+      ...(evaluated ? [{ hooks: [evalPreToolUseHook(evaluated)] }] : []),
+      // A guarded worker (capability read-only / workspace): every call, subagents' included (lib/worker-confinement.js).
+      ...(guardHook ? [{ hooks: [guardHook] }] : []),
+      {
         matcher: denyMatcher,
         hooks: [async () => ({
           hookSpecificOutput: {
@@ -504,11 +778,12 @@ export async function createClaudeNativeLoopAdapter(options = {}) {
           },
         })],
       },
+      ...(questionMode ? [{ matcher: 'AskUserQuestion', hooks: [async () => ({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'ask', permissionDecisionReason: 'The user answers in this run’s sidepanel.' } })] }] : []),
       // Assistant task runs: SynaBun's browser policy (browser-tool-policy.js)
       // on every call, subagents' included, before the bypass and canUseTool.
       ...(runMode === 'task' ? [{
         hooks: [async (input) => {
-          const reason = browserToolDenial(input?.tool_name, input?.tool_input || {}, { host: 'claude', cwd: cwd || process.cwd() });
+          const reason = browserToolDenial(input?.tool_name, input?.tool_input || {}, { host: 'claude', cwd: cwd || process.cwd(), roots: policyRoots });
           return reason ? { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason } } : {};
         }],
       }] : [])],
@@ -516,9 +791,17 @@ export async function createClaudeNativeLoopAdapter(options = {}) {
     env,
     abortController,
     canUseTool: async (toolName, toolInput) => {
+      if (confined) {
+        const reason = draftToolDecision(toolName, toolInput, confined);
+        return reason ? { behavior: 'deny', message: reason } : { behavior: 'allow', updatedInput: toolInput };
+      }
+      if (evaluated) {
+        const reason = evalToolDecision(toolName, toolInput, evaluated);
+        return reason ? { behavior: 'deny', message: reason } : { behavior: 'allow', updatedInput: toolInput };
+      }
       if (toolName === 'ExitPlanMode') return { behavior: 'deny', message: denyMessage };
       if (toolName === 'AskUserQuestion') {
-        if (!askMode) return { behavior: 'deny', message: denyMessage };
+        if (!questionMode) return { behavior: 'deny', message: denyMessage };
         const reply = await brokerRequest({ kind: 'ask', toolName, input: toolInput, questions: toolInput?.questions || [] });
         if (reply.behavior === 'allow') {
           const answers = reply.answers || reply.updatedInput?.answers || {};
@@ -526,6 +809,8 @@ export async function createClaudeNativeLoopAdapter(options = {}) {
         }
         return { behavior: 'deny', message: reply.message || 'The question was not answered.' };
       }
+      // Loading a deferred question schema is a read, never a permission decision.
+      if (toolName === 'ToolSearch') return { behavior: 'allow', updatedInput: toolInput };
       // Computer use is fully autonomous: its guards live in the desktop service,
       // so the orchestrator is never asked to approve individual actions.
       if (askMode && /^mcp__SynaBun__computer(_apps|_ax|_status)?$/.test(String(toolName))) return { behavior: 'allow', updatedInput: toolInput };
@@ -541,12 +826,105 @@ export async function createClaudeNativeLoopAdapter(options = {}) {
       return { behavior: 'allow', updatedInput: toolInput };
     },
   };
-  if (mcpUrl) queryOptions.mcpServers = { SynaBun: { type: 'http', url: mcpUrl, headers } };
+  if (confined) {
+    // No MCP server at all (SynaBun's or the user's: strict), and only the file tools.
+    queryOptions.mcpServers = {};
+    queryOptions.strictMcpConfig = true;
+    queryOptions.tools = [...DRAFT_TOOLS];
+    queryOptions.disallowedTools = [...DRAFT_DISALLOWED_TOOLS];
+  } else if (evalOptions) {
+    // No MCP server at all, the role's tools only, and the skills it may use: the one under test (a baseline: none),
+    // loaded as the run's one local plugin; no hook of any settings file, plugin or skill and no inline shell.
+    queryOptions.mcpServers = {};
+    queryOptions.strictMcpConfig = true;
+    queryOptions.tools = [...evalOptions.tools];
+    queryOptions.disallowedTools = [...evalOptions.disallowedTools];
+    queryOptions.skills = [...evalOptions.skills];
+    queryOptions.settings = { ...evalOptions.settings };
+    if (evalOptions.plugins.length) queryOptions.plugins = evalOptions.plugins.map((plugin) => ({ ...plugin }));
+  } else if (mcpUrl) queryOptions.mcpServers = { SynaBun: { type: 'http', url: mcpUrl, headers } };
+  let externalScopeNames = [];
+  let externalValues = [];
+  let privateMcpServers = null;
+  let privateMcpDir = null;
+  if (!held) {
+    const inventory = externalServerInventory({ provider: 'claude-code', cwd, env, home: env.HOME, dataHome: memoryConfig.dataHome, ...options.externalMcpContext });
+    const list = nativeToolSelection(options, 'claude-code');
+    const scope = selectExternalServers(list.servers, inventory);
+    const definitions = Object.fromEntries(scope.names.map(name => [name, inventory.definitionFor(name)]));
+    if (mcpUrl) definitions.SynaBun = { type: 'http', url: mcpUrl, headers };
+    const referenced = referenceClaudeMap(definitions, env);
+    queryOptions.mcpServers = referenced.mcpServers;
+    queryOptions.strictMcpConfig = true;
+    Object.assign(env, referenced.env);
+    // OAuth and dynamic header helpers are not expanded by the CLI's generic ${VAR} pass.
+    // Keep them intact in a private file; the SDK's JSON is replaced before the OS spawn boundary.
+    privateMcpServers = structuredClone(referenced.mcpServers);
+    for (const [name, definition] of Object.entries(definitions)) {
+      if (definition.oauth) privateMcpServers[name].oauth = structuredClone(definition.oauth);
+      if (definition.headersHelper) privateMcpServers[name].headersHelper = definition.headersHelper;
+    }
+    externalValues = [...Object.values(referenced.env), ...mcpDefinitionValues(definitions)];
+    externalScopeNames = Object.keys(definitions);
+  }
   if (model) queryOptions.model = model;
   if (effort && CLAUDE_EFFORT_LEVELS.includes(effort)) queryOptions.effort = effort;
-  if (capability === 'read-only') queryOptions.disallowedTools = [...CLAUDE_READ_ONLY_DISALLOWED_TOOLS];
+  // Read-only: with the guard enforced the shell stays, limited to read-only commands by the hook, and only the
+  // built-in writers are off the list; otherwise (warn, off) today's list, Bash included.
+  if (capability === 'read-only' && !held) queryOptions.disallowedTools = guard?.enforced ? [...CLAUDE_READ_ONLY_WRITE_TOOLS] : [...CLAUDE_READ_ONLY_DISALLOWED_TOOLS];
   if (Number(maxBudgetUsd) > 0) queryOptions.maxBudgetUsd = Number(maxBudgetUsd);
   if (outputSchema && typeof outputSchema === 'object') queryOptions.outputFormat = { type: 'json_schema', schema: outputSchema };
+  // A run resumed after a server restart continues its own Claude session. A tool call the restart cut off is in its
+  // transcript without a result: the CLI records it as interrupted (outcome unknown) and the next call goes through.
+  if (resumeSessionId) queryOptions.resume = String(resumeSessionId);
+  // The CLI's process is spawned here, not inside the SDK, so its pid is known: a server shutdown ends it at once
+  // (endProcess), and the next start can tell an orphan from another program. Left to the SDK, a CLI whose server
+  // went down only gets its stdin closed: it finishes the tool call in progress (a minute of `sleep` measured) and
+  // keeps writing to its transcript, because the SDK's SIGTERM waits 2 s on a timer that dies with the server. The
+  // SDK reads no stderr from a process it did not spawn: it is drained here, its tail kept for a failure's message.
+  let child = null;
+  let stderrTail = '';
+  let terminating = false;
+  queryOptions.spawnClaudeCodeProcess = (spawnOptions) => {
+    if (!alive || abortController.signal.aborted) throw Object.assign(new Error('Claude MCP launch was stopped'), { code: 'MCP_SCOPE_UNENFORCED' });
+    const args = [...spawnOptions.args];
+    if (privateMcpServers) for (let index = 0; index < args.length - 1; index++) if (args[index] === '--mcp-config') {
+      privateMcpDir ||= mkdtempSync(join(tmpdir(), 'synabun-claude-mcp-'));
+      args[index + 1] = writePrivateMcpConfig(join(privateMcpDir, 'mcp.json'), privateMcpServers);
+    }
+    const proc = (options.spawnFactory || spawnProcess)(spawnOptions.command, args, {
+      cwd: spawnOptions.cwd, env: spawnOptions.env, signal: spawnOptions.signal,
+      stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true,
+    });
+    child = proc;
+    proc.stderr?.setEncoding?.('utf8');
+    proc.stderr?.on('data', (chunk) => { stderrTail = redactMcpValues(`${stderrTail}${chunk}`, externalValues).slice(-2048); });
+    proc.stderr?.on('error', () => {});
+    if (proc.pid) { try { onProcess?.({ pid: proc.pid, startedAt: new Date().toISOString(), command: String(spawnOptions.command || '') }); } catch { /* a note, never the run */ } }
+    return proc;
+  };
+  const processEnded = () => !child || child.exitCode !== null || (child.signalCode !== null && child.signalCode !== undefined);
+  /**
+   * End the CLI now (a server shutdown): SIGTERM, which makes it stop the tool call in progress (its process tree
+   * included), record that call's result and its cost state, and exit within a second; SIGKILL when it has not exited
+   * by `graceMs` (a killed CLI leaves its tool's processes behind, so it is the fallback only). Windows has no SIGTERM
+   * (a signal stops the CLI alone, and a dev server its tool started keeps its port): the tree is ended with taskkill.
+   * The CLI writes no cost state then; the resume reads what the CLI restores either way (lib/worker-resume.js).
+   */
+  async function endProcess(graceMs = 1500) {
+    const proc = child;
+    if (!proc || processEnded()) return;
+    const exited = new Promise((resolveExit) => { proc.once('exit', () => resolveExit()); });
+    if (process.platform === 'win32') {
+      try { spawnProcess('taskkill', ['/pid', String(proc.pid), '/T', '/F'], { windowsHide: true, stdio: 'ignore' }).on?.('error', () => {}); } catch { /* gone */ }
+    } else {
+      try { proc.kill('SIGTERM'); } catch { /* gone */ }
+    }
+    await Promise.race([exited, new Promise((resolveWait) => setTimeout(resolveWait, Math.max(100, graceMs)))]);
+    if (processEnded()) return;
+    try { proc.kill('SIGKILL'); } catch { /* gone */ }
+    await Promise.race([exited, new Promise((resolveWait) => setTimeout(resolveWait, 500))]);
+  }
   // The loop runs the user's own Claude Code: SynaBun carries none, and the SDK
   // is never left to look for one. The SDK uses pathToClaudeCodeExecutable
   // verbatim with no validation, so the path was vetted where it was resolved
@@ -565,9 +943,11 @@ export async function createClaudeNativeLoopAdapter(options = {}) {
     throw error;
   }
 
-  const q = queryFactory({ prompt: input, options: queryOptions });
+  let q;
+  try { q = queryFactory({ prompt: input, options: queryOptions }); }
+  catch (error) { if (privateMcpDir) rmSync(privateMcpDir, { recursive: true, force: true }); throw error; }
   const deltaBuffer = new Map();
-  const forwardEvent = (event) => onEvent({ provider: 'claude-code', runId, event });
+  const forwardEvent = (event) => onEvent({ provider: 'claude-code', runId, event: redactMcpValues(event, externalValues) });
   const flushDelta = (key) => {
     const slot = deltaBuffer.get(key);
     if (!slot) return;
@@ -605,8 +985,9 @@ export async function createClaudeNativeLoopAdapter(options = {}) {
   };
   // total_cost_usd is this CLI process's running total, not the turn's charge:
   // a warm task run reported $7.87 after turn 1 and $7.99 after a $0.12 turn 2.
-  // A turn resolves with its own charge (costUsd) beside the total.
-  let reportedCostUsd = 0;
+  // A turn resolves with its own charge (costUsd) beside the total. A resumed
+  // session's CLI starts from the total its transcript recorded (costBaseUsd).
+  let reportedCostUsd = Math.max(0, Number(costBaseUsd) || 0);
   const turnCost = (event) => {
     const total = Number(event?.total_cost_usd);
     if (!Number.isFinite(total) || total <= 0) return { costUsd: 0, totalCostUsd: reportedCostUsd };
@@ -618,7 +999,8 @@ export async function createClaudeNativeLoopAdapter(options = {}) {
   let pumpError = null;
   const pump = (async () => {
     try {
-      for await (const event of q) {
+      for await (const rawEvent of q) {
+        const event = redactMcpValues(rawEvent, externalValues);
         if (!alive) break;
         const eventSessionId = event?.session_id || null;
         if (eventSessionId && eventSessionId !== sessionId) {
@@ -653,6 +1035,12 @@ export async function createClaudeNativeLoopAdapter(options = {}) {
         }
       }
     } catch (error) {
+      // A process that exited is reported without what it said on stderr (the SDK keeps that only for a process it
+      // spawned itself): its tail goes with the message.
+      const message = String(error?.message || '');
+      if (stderrTail.trim() && /Claude Code process (exited|terminated)/.test(message) && !/stderr:/.test(message)) {
+        try { error.message = `${message}. stderr: ${stderrTail.trim().slice(-1000)}`; } catch { /* read-only message */ }
+      }
       pumpError = error;
     } finally {
       flushDeltas();
@@ -670,7 +1058,8 @@ export async function createClaudeNativeLoopAdapter(options = {}) {
   pump.catch((error) => {
     // dispose() aborts the query when the run ends, however it ended, and the
     // SDK throws "Claude Code process aborted by user" for it: not a failure.
-    if (abortController.signal.aborted) return;
+    // Neither is the exit of a CLI a server shutdown ended (dispose with terminate).
+    if (abortController.signal.aborted || terminating) return;
     onEvent({
       provider: 'claude-code',
       runId,
@@ -681,8 +1070,14 @@ export async function createClaudeNativeLoopAdapter(options = {}) {
   return {
     identity: () => ({ providerSessionId: sessionId }),
     isAlive: () => alive,
-    describe: () => ({ provider: 'claude-code', permissionPolicy, capability, askMode }),
-    runTurn(prompt, meta = {}) {
+    // The CLI's process while it runs ({ pid }), else null.
+    processInfo: () => (child?.pid && !processEnded() ? { pid: child.pid } : null),
+    describe: () => ({ provider: 'claude-code', permissionPolicy, capability, askMode, ...(held ? { confinement: held.kind, root: held.root, ...(evaluated ? { role: evaluated.role, skills: [...evalOptions.skills], plugins: evalOptions.plugins.map((plugin) => plugin.path) } : {}) } : {}), ...(guard ? { guard: { mode: guard.mode, capability: guard.capability, writable: [...guard.writable] } } : {}) }),
+    async runTurn(prompt, meta = {}) {
+      if (!held) {
+        try { await waitForClaudeMcpScope(q, externalScopeNames); }
+        catch { input.close(); q.close?.(); await endProcess(); throw Object.assign(new Error('Claude MCP scope could not be enforced before the first turn'), { code: 'MCP_SCOPE_UNENFORCED' }); }
+      }
       if (!alive) return Promise.reject(new Error('Claude native loop is closed'));
       if (activeTurn) return Promise.reject(new Error('Claude native loop already has an active turn'));
       onEvent({
@@ -718,16 +1113,24 @@ export async function createClaudeNativeLoopAdapter(options = {}) {
       } catch {}
       return true;
     },
-    async dispose() {
+    // `terminate` (a server shutdown, lib/native-loop-runtime.js): the CLI is ended before the query is closed
+    // (endProcess), so nothing of it outlives the server. The events it sends while it stops (the cut-off tool call's
+    // result) still reach the run; its exit is not reported as a failure.
+    async dispose(options = {}) {
       if (activeTurn) {
         const turn = activeTurn; activeTurn = null;
         turn.reject(asAbortError('disposed'));
       }
+      if (options?.terminate === true) {
+        terminating = true;
+        await endProcess(Number(options.graceMs) > 0 ? Number(options.graceMs) : 1500);
+      }
       alive = false;
       input.close();
       flushDeltas();
       try { abortController.abort(asAbortError('disposed')); } catch {}
       await Promise.race([pump, new Promise((resolveWait) => setTimeout(resolveWait, 1000))]).catch(() => {});
+      if (privateMcpDir) { rmSync(privateMcpDir, { recursive: true, force: true }); privateMcpDir = null; }
     },
   };
 }
@@ -743,13 +1146,89 @@ export async function createOpenCodeNativeLoopAdapter(options = {}) {
     agent = null, effort = null, runMode = 'loop',
     // Image / video creation runs: 'image' | 'video' → each turn returns the files its model generated.
     collectMedia = null,
+    // A skill-drafting run's confinement (lib/skills/draft-confinement.js openCodeDraftConfig): the serve's config has
+    // no shell, web, subagent or skill tool and no MCP server; every edit is asked and answered inside the folder.
+    confinement = null,
+    // The Protect workers setting as the run starts (lib/worker-confinement.js), the run's own scratch folder,
+    // SynaBun's own port, the run's own serve port and the band SynaBun keeps for its serves (a guarded worker's shell
+    // may call none of them).
+    guardMode = WORKER_GUARD_DEFAULT, scratchDir = null, serverPort = null, localPortRange = null, servePort = null,
+    onNote = null,
   } = options;
   if (!client?.session?.create || (!client?.session?.promptAsync && !client?.session?.prompt)) {
     throw new Error('OpenCode native loop requires an isolated SDK client');
   }
   const permissionPolicy = normalizePermissionPolicy(rawPolicy);
   const capability = normalizeCapability(rawCapability);
-  const askMode = permissionPolicy === 'ask' && typeof permissionBroker?.request === 'function';
+  // Resolved before anything starts: a confinement that cannot be set up stops the run (never an unconfined start).
+  let confined = null;
+  let evaluated = null;
+  if (confinement?.kind === EVAL_CONFINEMENT) {
+    try { evaluated = resolveEvalConfinement(confinement, cwd); } catch (error) { throw confinementUnsupportedError('OpenCode', error?.message || error, 'an evaluation folder'); }
+  } else if (confinement) {
+    try { confined = resolveDraftConfinement(confinement, cwd); } catch (error) { throw confinementUnsupportedError('OpenCode', error?.message || error); }
+  }
+  const held = confined || evaluated;
+  const guard = workerGuardFor({ capability, cwd, guardMode, scratchDir, confinement: held, serverPort, localPorts: servePort ? [servePort] : null, localPortRange });
+  const askMode = !held && permissionPolicy === 'ask' && typeof permissionBroker?.request === 'function';
+  // Code Mode (lib/worker-confinement.js OPENCODE_CODE_MODE_TOOL): off under Enforce, noted call by call under Warn.
+  if (guard) { try { onNote?.(openCodeCodeModeNote(guard)); } catch {} }
+  const codeModeCalls = new Set();
+  const noteCodeModeCall = (part) => {
+    if (!guard || part?.type !== 'tool') return;
+    const decision = openCodeCodeModeDecision(part.tool, guard);
+    const callID = part.callID || part.id || '';
+    if (!decision || codeModeCalls.has(callID)) return;
+    codeModeCalls.add(callID);
+    onEvent({ provider: 'opencode', runId, eventType: 'synabun.confinement', event: confinementEvent(decision, { tool: part.tool, confinement: guard, provider: 'opencode' }) });
+  };
+  // An external_directory ask identifies its originating call, not whether it reads or writes. Resolve that exact
+  // message/call pair from SSE or the message API; never infer a read from the requested path or arbitrary metadata.
+  const permissionTools = new Map();
+  const rememberPermissionTool = (part) => {
+    if (part?.type === 'tool' && part.messageID && part.callID && part.tool) permissionTools.set(`${part.messageID}:${part.callID}`, part.tool);
+  };
+  const permissionToolName = async (event) => {
+    const { messageID, callID } = event?.tool || {};
+    if (!messageID || !callID) return null;
+    const key = `${messageID}:${callID}`;
+    if (!permissionTools.has(key) && typeof client.session?.message === 'function') {
+      try {
+        const row = await settleWithin(client.session.message({ sessionID: sessionId, messageID, directory: cwd || undefined }), 5000);
+        for (const part of row?.data?.parts || []) if (part.messageID === messageID) rememberPermissionTool(part);
+      } catch { /* unknown calls fail closed */ }
+    }
+    return permissionTools.get(key) || null;
+  };
+  /**
+   * A permission ask under the run's confinement: { reply: 'once' | 'reject', message }, the decision written into
+   * the run's events. A refusal carries its reason as the reply's message: OpenCode hands it to the model as the
+   * tool's error (a reject without a message is what OpenCode's own client follows with an interrupt).
+   */
+  const policyReply = async (event) => {
+    if (evaluated) {
+      const reason = evalOpenCodeDecision(event, evaluated);
+      if (!reason) return { reply: 'once' };
+      onEvent({ provider: 'opencode', runId, eventType: 'synabun.confinement', event: { type: 'synabun.confinement', action: 'refused', capability: 'workspace', tool: event.permission || event.type || 'permission', rule: 'skill-eval', reason, provider: 'opencode' } });
+      return { reply: 'reject', message: reason };
+    }
+    if (confined) {
+      const reason = draftOpenCodeDecision(event, confined);
+      if (!reason) return { reply: 'once' };
+      onEvent({ provider: 'opencode', runId, eventType: 'synabun.confinement', event: { type: 'synabun.confinement', action: 'refused', capability: 'workspace', tool: event.permission || event.type || 'permission', rule: 'skill-draft', reason, provider: 'opencode' } });
+      return { reply: 'reject', message: reason };
+    }
+    if (guard) {
+      const toolName = String(event?.permission || event?.type || '').toLowerCase() === 'external_directory' ? await permissionToolName(event) : null;
+      const decision = openCodePermissionDecision(event, guard, { toolName });
+      if (!decision) return { reply: 'once' };
+      onEvent({ provider: 'opencode', runId, eventType: 'synabun.confinement', event: confinementEvent(decision, { tool: event.permission || event.type || 'permission', confinement: guard, provider: 'opencode' }) });
+      return guard.enforced ? { reply: 'reject', message: decision.reason } : { reply: 'once' };
+    }
+    // Unattended and unguarded: allowed, one call at a time. Never "always": OpenCode 2 saves an "always" answer for
+    // the whole project (GET /api/permission/saved), where it would stop the user's own sessions there from asking.
+    return { reply: 'once' };
+  };
   let alive = true;
   let activeAbort = null;
   let activeTurn = null;
@@ -828,6 +1307,7 @@ export async function createOpenCodeNativeLoopAdapter(options = {}) {
     } catch {}
     return '';
   };
+  const pendingQuestions = new Set();
   const brokerRequest = async (request) => {
     try {
       const reply = await permissionBroker.request({ runId, provider: 'opencode', signal: activeAbort?.signal, ...request });
@@ -845,7 +1325,8 @@ export async function createOpenCodeNativeLoopAdapter(options = {}) {
   };
   const finishTurnWithText = () => {
     const turn = activeTurn;
-    if (!turn || turn.mode !== 'async' || turn.settled || turn.finishing) return;
+    if (pendingQuestions.size) return;
+    if (!turn || turn.mode !== 'async' || turn.sent === false || turn.settled || turn.finishing) return;
     turn.finishing = true;
     fetchAssistantText()
       .then((text) => settleActiveTurn(null, { text, result: { text }, ...turnMedia() }))
@@ -867,19 +1348,27 @@ export async function createOpenCodeNativeLoopAdapter(options = {}) {
       return;
     }
     if (/^message[.:]updated$/i.test(eventType)) rememberMessage(event.info || event.message?.info || null);
-    if (/^message[.:]part[.:]updated$/i.test(eventType)) rememberPart(event.part || null);
+    if (/^message[.:]part[.:]updated$/i.test(eventType)) { rememberPart(event.part || null); rememberPermissionTool(event.part); noteCodeModeCall(event.part); }
     if (/^message[.:]part[.:]delta$/i.test(eventType)) rememberDelta(event);
     if (/question\.asked/i.test(eventType)) {
       const requestID = event.id || event.requestID;
-      if (requestID && askMode && client.question?.reply) {
-        brokerRequest({ kind: 'ask', toolName: 'question', input: event, questions: event.questions || [] })
+      if (requestID && !held && permissionBroker?.request && client.question?.reply) {
+        if (pendingQuestions.has(requestID)) return;
+        pendingQuestions.add(requestID);
+        brokerRequest({ kind: 'ask', toolName: 'question', input: event, questions: event.questions || [], protocol: { provider: 'opencode', id: requestID } })
           .then((reply) => {
+            // The tool is now answered; an idle SSE arriving before the HTTP ack is valid.
+            pendingQuestions.delete(requestID);
             if (reply.behavior === 'allow') {
-              return client.question.reply({ requestID, answers: reply.answers || [], directory: cwd || undefined });
+              return client.question.reply({ requestID, answers: openCodeAnswers(event.questions || [], reply.answers), directory: cwd || undefined });
             }
             return client.question?.reject?.({ requestID, directory: cwd || undefined });
           })
-          .catch(() => {});
+          .catch(async (error) => {
+            try { await client.question?.reject?.({ requestID, directory: cwd || undefined }); } catch {}
+            settleActiveTurn(new Error(`OpenCode question reply failed: ${providerErrorMessage(error)}`));
+          })
+          .finally(() => pendingQuestions.delete(requestID));
       } else if (requestID && client.question?.reject) {
         client.question.reject({ requestID, directory: cwd || undefined }).catch(() => {});
       }
@@ -894,7 +1383,11 @@ export async function createOpenCodeNativeLoopAdapter(options = {}) {
           })
           .catch(() => {});
       } else if (requestID && client.permission?.reply) {
-        client.permission.reply({ requestID, reply: 'always', directory: cwd || undefined }).catch(() => {});
+        // Unattended: by the run's confinement (a drafting run, a guarded worker), else allowed once.
+        policyReply(event).then((answer) => {
+          if (!alive) return;
+          return client.permission.reply({ requestID, reply: answer.reply, ...(answer.message ? { message: answer.message } : {}), directory: cwd || undefined });
+        }).catch(() => {});
       }
     }
     // promptAsync acknowledges immediately, so the durable SSE stream is the
@@ -912,11 +1405,24 @@ export async function createOpenCodeNativeLoopAdapter(options = {}) {
     }
     onEvent({ provider: 'opencode', runId, eventType, event });
   }) || (() => {});
+  // The rules of a confined run ride the session too (lib/opencode2-client.js session.create sends them as the
+  // session's own `permissions`), on top of the serve's config.
+  let sessionRules = confined ? openCodeDraftConfig().permissions : evaluated ? openCodeEvalConfig(evaluated).permissions : guard ? openCodePermissionsFor(guard) : null;
+  if (runMode === 'task' && !held) sessionRules = [...(sessionRules || []), { action: 'question', resource: '*', effect: 'allow' }];
   try {
     await client.waitUntilConnected?.(10_000);
-    const created = await client.session.create({ directory: cwd || undefined, title: title || 'SynaBun automation' });
+    const created = options.resumeSessionId
+      ? await client.session.get({ sessionID: options.resumeSessionId })
+      : await client.session.create({ directory: cwd || undefined, title: title || 'SynaBun automation', ...(sessionRules ? { permission: sessionRules } : {}) });
+    if (created?.error) throw new Error(`OpenCode session unavailable: ${providerErrorMessage(created.error)}`);
     sessionId = created?.data?.id || created?.data?.sessionID || created?.id || created?.sessionID;
     if (!sessionId) throw new Error('OpenCode did not return a session id');
+    if (options.resumeSessionId && sessionId !== options.resumeSessionId) throw new Error('OpenCode returned a different session on resume');
+    if (options.resumeSessionId && sessionRules) {
+      if (!client.session.update) throw new Error('OpenCode cannot restore the worker permission rules');
+      const updated = await client.session.update({ sessionID: sessionId, permission: sessionRules });
+      if (!updated || updated.error) throw new Error('OpenCode could not restore the worker permission rules');
+    }
     onIdentity({ providerSessionId: sessionId });
   } catch (error) {
     try { unsubscribe(); } catch {}
@@ -943,7 +1449,7 @@ export async function createOpenCodeNativeLoopAdapter(options = {}) {
   return {
     identity: () => ({ providerSessionId: sessionId }),
     isAlive: () => alive,
-    describe: () => ({ provider: 'opencode', permissionPolicy, capability, askMode }),
+    describe: () => ({ provider: 'opencode', permissionPolicy, capability, askMode, ...(held ? { confinement: held.kind, root: held.root, ...(evaluated ? { role: evaluated.role } : {}) } : {}), ...(guard ? { guard: { mode: guard.mode, capability: guard.capability, writable: [...guard.writable] } } : {}) }),
     /** { children(sessionId) → sessions, messages(sessionId) → [{ info }] } on this run's own serve. */
     usageFetchers: () => ({
       children: (id) => storedRows('children', id),
@@ -952,13 +1458,29 @@ export async function createOpenCodeNativeLoopAdapter(options = {}) {
     async runTurn(prompt, meta = {}) {
       if (!alive) throw new Error('OpenCode native loop is closed');
       if (activeTurn) throw new Error('OpenCode native loop already has an active turn');
-      await client.waitUntilConnected?.(10_000);
-      activeAbort = new AbortController();
+      const controller = new AbortController();
+      activeAbort = controller;
+      const checkReady = async () => {
+        await client.waitUntilConnected?.(10_000);
+        if (!alive || controller.signal.aborted) throw asAbortError('aborted');
+        const ready = await waitForSynabunTools(client, {
+          ...(options.mcpWait || {}), directory: cwd || undefined,
+          expected: options.synabunExpected !== false && !held, signal: controller.signal,
+          stopped: () => !alive,
+          onTimeout: (ms) => {
+            const text = synabunToolsTimeoutText(ms, 'worker');
+            onNote?.(text);
+            onEvent({ provider: 'opencode', runId, eventType: 'synabun.mcp.status', event: { sessionID: sessionId, text } });
+          },
+        });
+        if (!ready || controller.signal.aborted || !alive) throw asAbortError('aborted');
+      };
       const request = {
         sessionID: sessionId,
         parts: [{ type: 'text', text: prompt }],
         model: normalizeOpenCodeModel(model),
-        agent: capability === 'read-only' ? 'plan' : (agent ? String(agent) : 'build'),
+        // Capability is enforced by session rules, the adapter and sandbox, not OpenCode's planning workflow.
+        agent: agent ? String(agent) : 'build',
         directory: cwd || undefined,
         signal: activeAbort.signal,
       };
@@ -994,11 +1516,13 @@ export async function createOpenCodeNativeLoopAdapter(options = {}) {
         // reported as an unhandled promise before runTurn begins awaiting it.
         completion.catch(() => {});
         const turn = {
-          mode: 'async', completion,
+          mode: 'async', completion, sent: false,
           resolve: resolveTurn, reject: rejectTurn, settled: false,
         };
         activeTurn = turn;
         try {
+          await checkReady();
+          turn.sent = true;
           const response = await client.session.promptAsync(request);
           validateResponse(response);
           return await completion;
@@ -1011,6 +1535,7 @@ export async function createOpenCodeNativeLoopAdapter(options = {}) {
       const turn = { mode: 'sync' };
       activeTurn = turn;
       try {
+        await checkReady();
         const response = await client.session.prompt(request);
         validateResponse(response);
         const text = extractOpenCodeText(response);
@@ -1038,3 +1563,377 @@ export async function createOpenCodeNativeLoopAdapter(options = {}) {
     },
   };
 }
+
+// ── Antigravity (Google's `agy` CLI, over ACP) ──────────────────────────────
+//
+// One `agy acp` process and one ACP session per run (lib/antigravity/acp-connection.js), every turn a session/prompt,
+// in the run's own Antigravity home (`--gemini-dir`, lib/antigravity/home.js): its MCP servers are exactly SynaBun's
+// and the external servers its tool list names, and its PreToolUse hook asks SynaBun about every call before it runs
+// (lib/antigravity/policy.js → antigravityRunPolicy: the browser policy, the run's MCP scope, the worker's
+// confinement). A refusal reaches the model with its reason ("tool call denied by pre-tool hook: …") and the turn goes
+// on; an ACP permission refusal would end the turn without one. Approvals stay with ACP's session/request_permission:
+// the Assistant's broker answers them under 'ask', else they are allowed once. Never "always": Antigravity would save
+// it for later sessions. The model and thinking level are the session's own config options (set only to a value the
+// session offers). The home keeps the conversation, so a run resumes after a restart (session/resume, no replay).
+// SynaBun's MCP child gets the run's pins from the agent's environment, which agy's MCP children inherit.
+
+/** The hook script every SynaBun home runs before a tool call. */
+export const ANTIGRAVITY_POLICY_HOOK = fileURLToPath(new URL('./antigravity/policy-hook.mjs', import.meta.url));
+
+/** The ACP permission option for an answer: explicit kinds only, never allow-always. */
+export function acpPermissionOption(options, wanted) {
+  const list = Array.isArray(options) ? options.filter((option) => option && typeof option.optionId === 'string') : [];
+  for (const kind of wanted) {
+    if (kind === 'allow_always') continue;
+    const found = list.find((option) => option.kind === kind);
+    if (found) return found.optionId;
+  }
+  return null;
+}
+
+/** The last JSON object in a reply (an output schema's answer, which ACP has no channel for), or null. */
+export function lastJsonObject(text) {
+  const source = String(text || '');
+  const fenced = [...source.matchAll(/```(?:json)?\s*([\s\S]*?)```/g)].map((m) => m[1]).reverse();
+  for (const candidate of [...fenced, source]) {
+    const trimmed = candidate.trim();
+    for (let start = trimmed.lastIndexOf('{'); start >= 0; start = trimmed.lastIndexOf('{', start - 1)) {
+      const end = trimmed.lastIndexOf('}');
+      if (end <= start) continue;
+      try {
+        const value = JSON.parse(trimmed.slice(start, end + 1));
+        if (value && typeof value === 'object' && !Array.isArray(value)) return value;
+      } catch { /* try an earlier brace */ }
+    }
+  }
+  return null;
+}
+
+/**
+ * One Antigravity run's policy for one tool call (acpCall's shape): what its hook answers, and what a permission
+ * request is checked against again. { decision: 'deny', reason, event? } | { decision: 'ask' | 'allow', event? }.
+ *   - MCP tool schemas in the run's home may be read; home configuration is refused;
+ *   - the browser policy (lib/browser-tool-policy.js: Antigravity's own web search, URL reading and browser, a shell
+ *     that starts a browser or browser code, another server's browser tools);
+ *   - the run's MCP scope (`allowedServers`: SynaBun and the external servers its tool list names;
+ *     enabled project MCP servers are refused before agy starts);
+ *   - the worker's confinement (lib/worker-confinement.js acpPermissionDecision; warn mode reports and allows);
+ *   - then the approval: 'ask' for anything but a read under the 'ask' policy, else 'allow'.
+ */
+export function antigravityRunPolicy(call, { homeDir = null, cwd = null, allowedServers = null, guard = null, askMode = false, policyRoots = [] } = {}) {
+  if (!call || (!call.name && !call.title && (!call.kind || call.kind === 'other'))) return { decision: 'deny', reason: 'SynaBun received no valid tool call, so it is refused.' };
+  const approval = () => (askMode && !acpReadOnlyKind(call.kind) ? 'ask' : 'allow');
+  const name = acpToolName(call);
+  const input = acpPolicyInput(call);
+  const browser = browserToolDenial(acpWebTool(call) && !name.startsWith('mcp__') ? (call.name || 'search_web') : name, input, { host: 'antigravity', cwd, roots: policyRoots });
+  if (browser) return { decision: 'deny', reason: browser, event: { type: 'synabun.browser_policy', action: 'refused', tool: name, reason: browser } };
+  if (call.mcp && allowedServers && !allowedServers.has(call.mcp.server)) {
+    const reason = `SynaBun: the MCP server ${call.mcp.server} is not one of this run's servers (${[...allowedServers].join(', ') || 'none'}), so ${call.mcp.tool} is refused. Use the tools this run was given.`;
+    return { decision: 'deny', reason, event: { type: 'synabun.mcp_scope', action: 'refused', server: call.mcp.server, tool: call.mcp.tool, reason } };
+  }
+  const homeRead = antigravityHomeReadPolicy(call, { homeDir, cwd });
+  if (homeRead) return homeRead;
+  if (guard) {
+    const decision = acpPermissionDecision(call, guard);
+    if (decision) {
+      const event = confinementEvent(decision, { tool: call.title || name, confinement: guard, provider: 'antigravity' });
+      if (guard.enforced) return { decision: 'deny', reason: decision.reason, event };
+      return { decision: approval(), event };
+    }
+  }
+  return { decision: approval() };
+}
+
+/** The MCP servers of a run's home: SynaBun's own entry, then the external servers its tool list names. */
+function antigravityRunServers({ tools, synabunMcpEntry, userGemini, onNote }) {
+  const servers = {};
+  let inventory = null;
+  let names = [];
+  try {
+    inventory = externalServerInventory({ provider: 'antigravity', antigravityConfigPath: join(userGemini, 'config', 'mcp_config.json'), dataHome: memoryConfig.dataHome });
+    names = selectExternalServers(tools.items, inventory).names;
+  } catch (error) {
+    if (error?.code === 'TOOLS_INVALID') throw error;
+    onNote?.(`Antigravity: the external MCP servers could not be read (${error?.message || error}); this run has SynaBun's tools only.`);
+  }
+  const own = synabunMcpEntry || userAntigravityMcpServers(userGemini).SynaBun || null;
+  if (own) servers.SynaBun = toAntigravityMcpEntry(own);
+  for (const name of names) {
+    const definition = inventory?.definitionFor(name);
+    if (definition && name !== 'SynaBun') servers[name] = toAntigravityMcpEntry(definition);
+  }
+  return servers;
+}
+
+export async function createAntigravityNativeLoopAdapter(options = {}) {
+  const {
+    runId, cwd, model = null, effort = null, launch = null,
+    onIdentity = () => {}, onEvent = () => {}, onProcess = null, onNote = null,
+    permissionPolicy: rawPolicy = 'auto', permissionBroker = null,
+    capability: rawCapability = 'full', outputSchema = null, runMode = 'loop',
+    browserSessionId = null, browserTabId = null, desktopGrantProvider = null,
+    extraEnv = {}, unsetEnv = [], resumeSessionId = null,
+    confinement = null,
+    guardMode = WORKER_GUARD_DEFAULT, scratchDir = null, serverPort = null, localPortRange = null,
+    connect = createAcpConnection,
+    // The run's Antigravity home (lib/antigravity/home.js). null: agy runs in the user's own ~/.gemini, with every
+    // server of theirs and no hook (an older server's wiring, a test of the bare protocol).
+    homeDir = null, synabunMcpEntry = null, userGemini = userGeminiDir(),
+    // The hook's way back (lib/antigravity/policy.js): the registry, the loopback address of POST /api/antigravity/policy.
+    policy = null, policyUrl = null, policyHookScript = ANTIGRAVITY_POLICY_HOOK, policyRoots = [],
+    // ACP counts tokens per session: what the session had counted when the run was suspended (a resume books only
+    // what follows), and where each turn's count is kept for the next resume.
+    sessionUsageBase = null, onSessionUsage = null,
+  } = options;
+  if (!launch?.command) {
+    const error = new Error('The Antigravity CLI (agy) is not installed or could not be resolved.');
+    error.code = 'CLI_MISSING';
+    throw error;
+  }
+  // Skill drafting and evaluation runs hold their own confinement; Antigravity has no setup for one, and a confined
+  // run never starts unconfined.
+  if (confinement) throw confinementUnsupportedError('Antigravity', 'skill drafting and evaluation run on Claude Code, Codex and OpenCode', confinement?.kind === EVAL_CONFINEMENT ? 'an evaluation folder' : 'a drafting folder');
+  assertSafeAntigravityProject(cwd);
+  const permissionPolicy = normalizePermissionPolicy(rawPolicy);
+  const capability = normalizeCapability(rawCapability);
+  const guard = workerGuardFor({ capability, cwd, guardMode, scratchDir, confinement: null, serverPort, localPortRange });
+  const askMode = permissionPolicy === 'ask' && typeof permissionBroker?.request === 'function';
+  const tools = nativeToolSelection(options, 'antigravity');
+
+  // The run's home: its servers, its hook, its settings, the user's rules and skills.
+  let allowedServers = null;
+  let hookCommand = null;
+  if (homeDir) {
+    const servers = antigravityRunServers({ tools, synabunMcpEntry, userGemini, onNote });
+    allowedServers = new Set(Object.keys(servers));
+    if (typeof policy?.register === 'function' && policyUrl) hookCommand = policyHookCommand({ script: policyHookScript });
+    else onNote?.('Antigravity: SynaBun\'s tool-call hook is not available in this server, so the browser policy and the run\'s MCP scope are checked only when Antigravity asks for approval.');
+    prepareAntigravityHome({ dir: homeDir, mcpServers: servers, hookCommand, settings: antigravityHomeSettings({ userSettings: userAntigravitySettings(userGemini) }), userGemini });
+  }
+  const policyOptions = { homeDir, cwd, allowedServers, guard, askMode, policyRoots };
+
+  const pins = stringEnv({
+    SYNABUN_TERMINAL_SESSION: runId,
+    SYNABUN_RUN_MODE: options.runMode === 'task' ? 'task' : undefined,
+    SYNABUN_PROJECT: cwd ? memoryProject(cwd) : 'global',
+    SYNABUN_BROWSER_SESSION: browserSessionId,
+    SYNABUN_BROWSER_TAB: browserTabId,
+    SYNABUN_TOOLS: runtimeToolsValue(tools.items.includes('all') ? tools.items : [...tools.groups, ...tools.servers]),
+    SYNABUN_DESKTOP_GRANT: typeof desktopGrantProvider === 'function' ? desktopGrantProvider() || undefined : undefined,
+  });
+  const inherited = { ...process.env };
+  for (const key of ['SYNABUN_PROFILE', 'SYNABUN_RUNTIME_PROFILE_PATH', 'SYNABUN_TOOLS', 'SYNABUN_TOOLS_PATH', 'SYNABUN_TOOL_CATALOG_MODE', 'SYNABUN_ROLE', 'SYNABUN_AGY_POLICY_URL', 'SYNABUN_AGY_POLICY_TOKEN']) delete inherited[key];
+  for (const key of Array.isArray(unsetEnv) ? unsetEnv : []) delete inherited[key];
+  delete inherited.SYNABUN_BRAIN_TOKEN;
+  for (const key of LIVE_DATA_ENV) delete inherited[key];
+
+  let alive = true;
+  let sessionId = null;
+  let providerTurn = Number(options.providerTurnBase) || 0;
+  let activeTurn = null;            // { iteration, providerTurn, text, controller }
+  let lastSessionUsage = sessionUsageBase && typeof sessionUsageBase === 'object' ? sessionUsageBase : null;
+  const openPermissions = new Set(); // resolvers of permission answers still waiting
+  const startedAt = Date.now();
+
+  const emit = (eventType, event, extra = {}) => {
+    try { onEvent({ provider: 'antigravity', runId, eventType, event, ...extra }); } catch { /* observers never break a run */ }
+  };
+  const turnMeta = () => (activeTurn ? { iteration: activeTurn.iteration, providerTurn: activeTurn.providerTurn } : {});
+  // The hook's question (and, without a hook, the permission request's): the answer, its event in the run's events.
+  const checkCall = (call) => {
+    const answer = antigravityRunPolicy(call, policyOptions);
+    if (answer.event) emit(answer.event.type, answer.event, turnMeta());
+    return answer;
+  };
+  const registration = hookCommand ? policy.register((call) => (alive ? checkCall(call) : { decision: 'deny', reason: 'This run has ended.' }), { label: `run ${runId}` }) : null;
+  const env = stringEnv({
+    ...inherited, ...pins, ...stringEnv(extraEnv),
+    ...(registration ? { SYNABUN_AGY_POLICY_URL: policyUrl, SYNABUN_AGY_POLICY_TOKEN: registration.token } : {}),
+  });
+
+  const decidePermission = async (params, signal) => {
+    const call = acpCall(params);
+    const options = params?.options || [];
+    const allowOnce = () => ({ outcome: { outcome: 'selected', optionId: acpPermissionOption(options, ['allow_once']) } });
+    const rejectOnce = () => ({ outcome: { outcome: 'selected', optionId: acpPermissionOption(options, ['reject_once', 'reject_always']) } });
+    const settle = (answer) => (answer.outcome.optionId ? answer : { outcome: { outcome: 'cancelled' } });
+    if (!alive) return { outcome: { outcome: 'cancelled' } };
+    // With the hook the call was checked before Antigravity asked: checked again here without reporting it twice
+    // (a refusal here ends the turn, which only a call the hook never saw can earn).
+    const verdict = registration ? antigravityRunPolicy(call, policyOptions) : checkCall(call);
+    if (verdict.decision === 'deny') return settle(rejectOnce());
+    if (askMode && !acpReadOnlyKind(call.kind)) {
+      try {
+        // Allowed once whatever the answer said about "always": Antigravity would save an "always" for every later
+        // session of the user's, outside this run (the dispatcher drops it for Antigravity too).
+        const reply = await permissionBroker.request({ runId, provider: 'antigravity', signal, kind: 'tool', toolName: call.mcp ? `${call.mcp.server}_${call.mcp.tool}` : (call.title || call.name || call.kind || 'tool'), input: params?.toolCall || {} });
+        if (reply?.behavior === 'allow') return settle(allowOnce());
+        return settle(rejectOnce());
+      } catch {
+        return settle(rejectOnce());
+      }
+    }
+    return settle(allowOnce());
+  };
+
+  const conn = connect({
+    command: launch.command,
+    args: launch.args || [],
+    acpArgs: homeDir ? ['--gemini-dir', homeDir] : [],
+    cwd: cwd || undefined,
+    env,
+    clientInfo: { name: 'synabun', title: 'SynaBun', version: '0' },
+    onUpdate: (params) => {
+      if (!params || params.sessionId !== sessionId || !params.update) return;
+      const update = params.update;
+      if (activeTurn && update.sessionUpdate === 'agent_message_chunk' && update.content?.type === 'text') activeTurn.text += update.content.text || '';
+      emit(update.sessionUpdate || 'session/update', update, turnMeta());
+    },
+    onElicitation: async (params, { signal } = {}) => {
+      if (!alive || !activeTurn || params.sessionId !== sessionId || !permissionBroker?.request) return { action: 'cancel' };
+      const reply = await permissionBroker.request({ runId, provider: 'antigravity', signal: AbortSignal.any([activeTurn?.controller?.signal, signal].filter(Boolean)), kind: 'ask', toolName: 'choice', input: params, questions: workerQuestions(params), protocol: { provider: 'antigravity', method: 'elicitation/create' } });
+      return elicitationReply(params, reply);
+    },
+    onPermission: (params, { signal } = {}) => new Promise((resolve) => {
+      const done = (answer) => { openPermissions.delete(done); resolve(answer); };
+      openPermissions.add(done);
+      decidePermission(params, signal).then(done, () => done({ outcome: { outcome: 'cancelled' } }));
+    }),
+    onExit: (info) => {
+      alive = false;
+      for (const done of [...openPermissions]) done({ outcome: { outcome: 'cancelled' } });
+      if (info?.error || (info?.code && info.code !== 0)) emit('synabun.provider_exit', { type: 'synabun.provider_exit', code: info.code, signal: info.signal, error: info.error || null });
+    },
+  });
+  try { onProcess?.({ pid: conn.pid, startedAt, home: homeDir || null }); } catch { /* informational */ }
+
+  const fail = async (error) => {
+    alive = false;
+    registration?.dispose();
+    try { await conn.close(); } catch { /* gone */ }
+    throw error;
+  };
+  let session;
+  try {
+    const init = await conn.initialize({ clientCapabilities: { fs: { readTextFile: false, writeTextFile: false }, terminal: false, elicitation: { form: {} } } });
+    if (resumeSessionId) {
+      // session/resume picks the conversation up without replaying it; an agent without it replays (session/load),
+      // which onUpdate drops (sessionId is set only once the load answered).
+      const caps = init?.agentCapabilities?.sessionCapabilities || {};
+      const method = caps.resume ? 'session/resume' : 'session/load';
+      session = await conn.request(method, { sessionId: String(resumeSessionId), cwd, mcpServers: [] });
+      sessionId = String(session?.sessionId || resumeSessionId);
+    } else {
+      session = await conn.request('session/new', { cwd, mcpServers: [] });
+      sessionId = session.sessionId;
+    }
+  } catch (error) {
+    const message = Number(error?.code) === -32000
+      ? 'Antigravity is not signed in: open the Antigravity panel (or run `agy` in a terminal) and sign in, then try again.'
+      : providerErrorMessage(error, resumeSessionId ? 'Antigravity could not resume the run\'s session' : 'Antigravity could not start a session');
+    return fail(Object.assign(new Error(message), { code: Number(error?.code) === -32000 ? 'AUTH_REQUIRED' : (error?.code || 'START_FAILED') }));
+  }
+  onIdentity({ providerSessionId: sessionId, ...(homeDir ? { antigravityHome: homeDir } : {}) });
+
+  // The model and the thinking level, as the session's own config options name them. A model id with its level
+  // (gemini-4-argon-high, as `agy models` and ACP's model list spell it) is that model at that level.
+  let configOptions = Array.isArray(session?.configOptions) ? session.configOptions : [];
+  const offered = (category) => {
+    const option = configOptions.find((o) => o?.category === category);
+    const accepted = [];
+    for (const entry of option?.options || []) for (const v of Array.isArray(entry?.options) ? entry.options : [entry]) if (v && v.value !== undefined) accepted.push(String(v.value));
+    return { option, accepted };
+  };
+  const setOption = async (category, value, label) => {
+    if (!value) return;
+    const { option, accepted } = offered(category);
+    if (!option) {
+      if (category === 'model') {
+        try { await conn.request('session/set_model', { sessionId, modelId: String(value) }); } catch (error) { onNote?.(`Antigravity kept its default model: ${providerErrorMessage(error, 'set_model failed')}`); }
+      }
+      return;
+    }
+    if (!accepted.includes(String(value))) {
+      if (category === 'model') throw Object.assign(new Error(`Antigravity does not offer the model ${value} (it offers ${accepted.join(', ') || 'none'}).`), { code: 'MODEL_UNAVAILABLE' });
+      onNote?.(`Antigravity has no ${label} "${value}" for this model; it keeps ${option.currentValue}.`);
+      return;
+    }
+    if (String(option.currentValue) === String(value)) return;
+    const answer = await conn.request('session/set_config_option', { sessionId, configId: option.id, value: String(value) });
+    if (Array.isArray(answer?.configOptions)) configOptions = answer.configOptions;
+  };
+  const wanted = splitAntigravityModel(model, offered('model').accepted);
+  const level = effort && !['off', 'default', 'auto', 'none'].includes(String(effort).toLowerCase()) ? String(effort) : wanted.effort;
+  try {
+    await setOption('model', wanted.model, 'model');
+    await setOption('thought_level', level, 'thinking level');
+  } catch (error) {
+    return fail(error);
+  }
+  const optionValue = (category) => configOptions.find((o) => o?.category === category)?.currentValue ?? null;
+
+  return {
+    identity: () => ({ providerSessionId: sessionId, ...(homeDir ? { antigravityHome: homeDir } : {}) }),
+    isAlive: () => alive && conn.running,
+    processInfo: () => ({ pid: conn.pid, startedAt, home: homeDir || null }),
+    describe: () => ({
+      provider: 'antigravity', permissionPolicy, capability, askMode, model: optionValue('model'), effort: optionValue('thought_level'),
+      ...(homeDir ? { home: homeDir, servers: [...(allowedServers || [])], hook: !!registration } : {}),
+      ...(guard ? { guard: { mode: guard.mode, capability: guard.capability, writable: [...guard.writable] } } : {}),
+    }),
+    async runTurn(prompt, meta = {}) {
+      if (!alive || !conn.running) throw new Error('Antigravity native loop is closed');
+      if (activeTurn) throw new Error('Antigravity native loop already has an active turn');
+      providerTurn += 1;
+      const turn = { iteration: meta.iteration, providerTurn, text: '', cancelled: false, controller: new AbortController() };
+      activeTurn = turn;
+      emit('synabun.user_prompt', { type: 'synabun.user_prompt', text: String(prompt || '') }, { iteration: meta.iteration, providerTurn });
+      const schema = meta.outputSchema || outputSchema;
+      const body = schema && typeof schema === 'object'
+        ? `${String(prompt || '')}\n\nEnd your reply with one JSON object (in a \`\`\`json block) that matches this JSON Schema:\n${JSON.stringify(schema)}`
+        : String(prompt || '');
+      try {
+        const answer = await conn.request('session/prompt', { sessionId, prompt: [{ type: 'text', text: body }] }, { timeoutMs: 0 });
+        // The turn's own tokens, whatever its end (a stopped turn spent them too).
+        const usage = acpTurnUsage(answer?.usage, lastSessionUsage);
+        if (answer?.usage) {
+          lastSessionUsage = answer.usage;
+          try { onSessionUsage?.(answer.usage); } catch { /* bookkeeping */ }
+        }
+        if (answer?.stopReason === 'cancelled' || turn.cancelled) throw Object.assign(asAbortError('aborted'), { usage, sessionUsage: answer?.usage || null, providerSessionId: sessionId });
+        const text = turn.text;
+        const result = { providerSessionId: sessionId, text, usage, sessionUsage: answer?.usage || null, stopReason: answer?.stopReason || 'end_turn', result: { text, usage } };
+        if (answer?.stopReason === 'refusal') result.refused = true;
+        if (schema && typeof schema === 'object') {
+          const structured = lastJsonObject(text);
+          if (structured) result.structured = structured;
+        }
+        return result;
+      } catch (error) {
+        if (error?.name === 'AbortError') throw error;
+        if (!alive || !conn.running) throw new Error(`Antigravity stopped during the turn${conn.stderrTail() ? `: ${conn.stderrTail().slice(-400)}` : ''}`);
+        throw new Error(providerErrorMessage(error, 'Antigravity turn failed'));
+      } finally {
+        turn.controller.abort();
+        if (activeTurn === turn) activeTurn = null;
+      }
+    },
+    async abort() {
+      if (activeTurn) { activeTurn.cancelled = true; activeTurn.controller.abort(); }
+      for (const done of [...openPermissions]) done({ outcome: { outcome: 'cancelled' } });
+      try { if (sessionId && conn.running) await settleWithin(conn.notify('session/cancel', { sessionId })); } catch {}
+      return true;
+    },
+    // The process is the run's own: it always ends with the run. Its conversation stays in the run's home, where a
+    // resume after a restart finds it (the dispatcher's prune removes the home once the run is gone).
+    async dispose() {
+      const wasAlive = alive;
+      alive = false;
+      activeTurn?.controller.abort();
+      for (const done of [...openPermissions]) done({ outcome: { outcome: 'cancelled' } });
+      if (wasAlive && activeTurn && sessionId && conn.running) { try { await settleWithin(conn.notify('session/cancel', { sessionId })); } catch {} }
+      await settleWithin(conn.close(), 3000);
+      registration?.dispose();
+    },
+  };
+}