synabun 2.0.10 → 2.2.0

package/neural-interface/lib/pty-host/core.js

@@ -19,6 +19,7 @@ import { evaluateFlow } from './flow.js';
 import { EV, OP, HOST_DEFAULTS } from './protocol.js';
 import { createEventLoopMonitor } from '../event-loop-monitor.js';
 import { withPathEnv } from '../augmented-path.js';
+import { killOwnedPty } from './lifetime.js';
 
 const IS_WIN = process.platform === 'win32';
 const IS_LINUX = process.platform === 'linux';
@@ -39,8 +40,14 @@ export function createPtyHostCore({ send, config = {}, pty: injectedPty = null }
   let pty = injectedPty;
   let ptyError = null;
   let shuttingDown = false;
+  let shutdownTimer = null;
 
   const emit = (msg) => { try { send(msg); } catch {} };
+  // Covers process.exit(), including host.js's bounded shutdown, and the
+  // in-process transport. This must be synchronous: exit cannot await PTYs.
+  const onOwnerExit = () => {
+    for (const s of sessions.values()) if (!s.exited) killOwnedPty(s.proc.pid);
+  };
 
   // ── Startup ──
   async function init() {
@@ -65,6 +72,10 @@ export function createPtyHostCore({ send, config = {}, pty: injectedPty = null }
   // ── Spawn ──
   function spawnSession(spec) {
     const { id } = spec;
+    if (shuttingDown) {
+      emit({ t: EV.SPAWN_ERROR, id, message: 'Terminal host is shutting down' });
+      return;
+    }
     if (!id || sessions.has(id)) {
       emit({ t: EV.SPAWN_ERROR, id, message: 'Duplicate or missing session id' });
       return;
@@ -133,6 +144,7 @@ export function createPtyHostCore({ send, config = {}, pty: injectedPty = null }
       graceTimer: null,
       exited: false,
     };
+    if (!sessions.size) process.once('exit', onOwnerExit);
     sessions.set(id, s);
     counters.spawns++;
 
@@ -490,6 +502,11 @@ export function createPtyHostCore({ send, config = {}, pty: injectedPty = null }
     for (const f of s.tempFiles.splice(0)) unlink(f).catch(() => {});
     try { s.model.dispose(); } catch {}
     sessions.delete(s.id);
+    if (!sessions.size) {
+      process.removeListener('exit', onOwnerExit);
+      clearTimeout(shutdownTimer);
+      shutdownTimer = null;
+    }
   }
 
   function killSession(s, signal) {
@@ -571,7 +588,11 @@ export function createPtyHostCore({ send, config = {}, pty: injectedPty = null }
     return out;
   }
 
-  function shutdownAll() {
+  function shutdownAll({ force = false } = {}) {
+    // The server's synchronous exit handler kills itself before later exit
+    // listeners can run. Its killNow() path must reap the PTYs right here.
+    if (force) onOwnerExit();
+    if (shuttingDown) return;
     shuttingDown = true;
     for (const s of sessions.values()) {
       s.draining = true;
@@ -581,6 +602,12 @@ export function createPtyHostCore({ send, config = {}, pty: injectedPty = null }
     for (const s of sessions.values()) {
       for (const c of s.clients) { try { c.ws.close(1001, 'terminal host shutting down'); } catch {} }
     }
+    // HUP can be ignored, or arrive while the macOS helper is attaching.
+    // Bound the grace period in both transports, even if the owner stays up.
+    if (sessions.size) {
+      shutdownTimer = setTimeout(onOwnerExit, 100);
+      shutdownTimer.unref?.();
+    }
   }
 
   function dispose() {

package/neural-interface/lib/pty-host/lifetime.js

@@ -0,0 +1,12 @@
+// node-pty's macOS helper starts a new session before exec. If its host dies
+// before the helper acquires the controlling terminal, closing the master
+// does not hang it up. Kill the known PTY process group as well as its leader.
+// Callers must forget a PID on EXIT: these are owned children, never a sweep
+// of unrelated processes or a list retained across host restarts.
+export function killOwnedPty(pid, { kill = process.kill, platform = process.platform } = {}) {
+  if (!Number.isSafeInteger(pid) || pid <= 1) return;
+  if (platform !== 'win32') {
+    try { kill(-pid, 'SIGKILL'); } catch {}
+  }
+  try { kill(pid, 'SIGKILL'); } catch {}
+}

package/neural-interface/lib/pty-host/manager.js

@@ -10,6 +10,7 @@ import { fork } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { EV, OP, UPGRADE_HEADER_WHITELIST } from './protocol.js';
 import { createPtyHostCore } from './core.js';
+import { killOwnedPty } from './lifetime.js';
 
 const HOST_PATH = fileURLToPath(new URL('./host.js', import.meta.url));
 const BACKOFF_MS = [0, 1000, 2000, 4000, 8000, 16000, 30000];
@@ -39,6 +40,7 @@ export function createPtyHostManager({
   const handlers = new Map();     // id → { onSpawned, onTap, onResized, onClients, onExit }
   const spawnWaiters = new Map(); // id → waiter
   const preparing = new Map();   // id → operations queued while PATH is read
+  const ptyPids = new Map();     // id → live PTY PID owned by the current host
   const requests = new Map();     // reqId → { resolve, reject, timer }
   let reqSeq = 0;
   let child = null;
@@ -76,6 +78,7 @@ export function createPtyHostManager({
         releaseHeldSockets();
         break;
       case EV.SPAWNED:
+        ptyPids.set(m.id, m.pid);
         try { handlers.get(m.id)?.onSpawned?.(m); } catch (err) { log.warn?.('[pty-host] onSpawned', err?.message); }
         settleSpawn(m.id, null, m);
         break;
@@ -97,6 +100,7 @@ export function createPtyHostManager({
         try { handlers.get(m.id)?.onClients?.(m); } catch {}
         break;
       case EV.EXIT: {
+        ptyPids.delete(m.id);
         const h = handlers.get(m.id);
         handlers.delete(m.id);
         spawnWaiters.delete(m.id);
@@ -150,6 +154,11 @@ export function createPtyHostManager({
   }
 
   function onChildExit(code, signal) {
+    // A SIGKILL cannot run host.js's disconnect/shutdown handlers. In
+    // particular, a macOS helper still attaching its terminal may survive
+    // closing the PTY master. Reap only this host's still-owned children.
+    for (const pid of ptyPids.values()) killOwnedPty(pid);
+    ptyPids.clear();
     child = null;
     ready = false;
     hostPid = null;
@@ -358,8 +367,10 @@ export function createPtyHostManager({
     for (const id of preparing.keys()) settleSpawn(id, new Error('Terminal host is shutting down'));
     preparing.clear();
     if (restartTimer) { clearTimeout(restartTimer); restartTimer = null; }
+    for (const pid of ptyPids.values()) killOwnedPty(pid);
+    ptyPids.clear();
     try { child?.kill('SIGTERM'); } catch {}
-    try { core?.shutdownAll(); } catch {}
+    try { core?.shutdownAll({ force: true }); } catch {}
   }
 
   return {

package/neural-interface/lib/remote-policy.js

@@ -49,7 +49,7 @@ const RANK = Object.freeze({ 'read-only': 0, ask: 1, autonomous: 2 });
 
 /** Brain providers that can hold a remote session at Ask and Autonomous (the in-process hook). */
 export const REMOTE_ENFORCING_PROVIDERS = Object.freeze(['claude-code']);
-const PROVIDER_LABELS = Object.freeze({ 'claude-code': 'Claude', codex: 'Codex', opencode: 'OpenCode' });
+const PROVIDER_LABELS = Object.freeze({ 'claude-code': 'Claude', codex: 'Codex', opencode: 'OpenCode', antigravity: 'Antigravity' });
 export function providerLabel(provider) { return PROVIDER_LABELS[provider] || String(provider || 'this brain'); }
 /** True for a known brain other than Claude: a remote session on it is read-only. */
 export function remoteBrainLimited(provider) {

package/neural-interface/lib/request-gate.js

@@ -67,15 +67,18 @@ export const ADMIN_ONLY_PREFIXES = Object.freeze([
   '/api/settings', '/api/display-settings',
   '/api/connections', '/api/setup', '/api/system',
   '/api/invite/key', '/api/invite/sessions', '/api/invite/proxy', '/api/invite/permissions',
-  '/api/claude-code', '/api/mcp-key', '/api/mcp/runtime-profile',
+  '/api/claude-code', '/api/mcp-key', '/api/mcp/runtime-tools',
   // MCP servers and plugins as the owner set them up: their credentials (GET /api/mcp/env/<name>?reveal=1
   // answers with them), the registry of the commands that are started, installs, what is written into the
-  // CLIs' own configuration, and the tool profile. Everything under /api/mcp, the two entries above included.
+  // CLIs' own configuration, and tool lists. Everything under /api/mcp, the two entries above included.
   '/api/mcp',
   '/api/plugins',
   // Installing a skill into one of the owner's runtimes, or removing it (Settings; its older address is under
   // /api/claude-code above). The "Skills Studio" permission opens /api/skills-studio, not this.
   '/api/skills/install',
+  // The Skills Service's installs, rollbacks and removals, the move of the old bridges, and its settings: the
+  // owner's, from the app's own page (lib/skills/api-v2.js refuses guests and agents on its own too).
+  '/api/skills-studio/v2/installations', '/api/skills-studio/v2/migrations', '/api/skills-studio/v2/config',
   '/api/tunnel/start', '/api/tunnel/stop',
   '/api/bridges', '/api/keybinds',
   '/api/cli',
@@ -93,6 +96,9 @@ export const ADMIN_ONLY_PREFIXES = Object.freeze([
   '/api/project-files',
   '/api/browse-folder',
   '/api/codex/plans',
+  // Antigravity's own conversations and models: each uncached answer starts the owner's `agy` (its side panel
+  // socket is refused to guests too).
+  '/api/antigravity',
   '/api/sidepanel',
   '/api/sidepanel-runs',
   '/api/loop',
@@ -124,6 +130,13 @@ export const FEATURE_PERMISSION_MAP = Object.freeze([
   { prefix: '/api/style-guide',   perm: 'styleGuide' },
 ].map(Object.freeze));
 
+/**
+ * What an invite guest only reads, whatever the owner opened to guests: the "Skills Studio" permission shows the
+ * skills, and every change (save, create, delete, files, icons, install, customize, import, the Skills Service's
+ * drafts and reviews) is the owner's, as lib/skills/api-v2.js and each legacy Studio route say on their own too.
+ */
+export const GUEST_READ_ONLY_PREFIXES = Object.freeze(['/api/skills-studio']);
+
 /**
  * The GETs a guest does not get for the asking. The terminal's lists of a folder's files and of its branches take
  * any folder of the disk from the request, so they are the terminal's: a guest reads them with the permission
@@ -579,6 +592,11 @@ export function createRequestGates({
       ? FEATURE_READ_PATHS.find((entry) => read.some((form) => startsWithSegment(form, entry.path)))
       : FEATURE_PERMISSION_MAP.find((entry) => read.some((form) => form.startsWith(entry.prefix)));
     if (match && !permissions()?.[match.perm]) return res.status(403).json({ error: 'Feature not enabled' });
+    // And a feature opened to guests that they only read: no change, whatever was opened.
+    const reading = req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS';
+    if (!reading && GUEST_READ_ONLY_PREFIXES.some((prefix) => read.some((form) => startsWithSegment(form, prefix)))) {
+      return sendGuardError(res, 403, 'GUEST_FORBIDDEN', 'Guests can read skills, not change them.');
+    }
     return next();
   }
 

package/neural-interface/lib/rulesets/api.js

@@ -27,7 +27,7 @@
 // lock file that cannot be used at all is `LOCK_UNAVAILABLE`, a 500: nothing
 // was changed, and trying again will not help until the data home is fixed. A
 // remove that leaves a copy to the user (an edited one, or for OpenCode one
-// that the user's own line in config.json points at) is not a refusal: 200,
+// that the user's own line in opencode.json points at) is not a refusal: 200,
 // `ok: true`, `kept: [{path, reason}]`.
 //
 // Every installer call is synchronous and runs to its end inside the handler,
@@ -41,9 +41,10 @@
 
 import { isRulesetHost, readRulesetManifest, renderCoexistenceSnippet, renderRuleset, RULESET_HOSTS } from './render.js';
 
-// The pre-2.0 `format` names, as the onboarding wizard and Settings still send them.
-const LEGACY_FORMATS = Object.freeze({ claude: 'claude', codex: 'codex', cursor: 'cursor', generic: 'opencode', opencode: 'opencode', gemini: 'gemini' });
-const LEGACY_VERSION_FORMATS = Object.freeze(['claude', 'codex', 'cursor', 'generic', 'gemini']);
+// The pre-2.0 `format` names, as the onboarding wizard and Settings still send them. `gemini` is what a page from
+// before Antigravity replaced Gemini CLI asks for: Antigravity's text, which reads the same files.
+const LEGACY_FORMATS = Object.freeze({ claude: 'claude', codex: 'codex', cursor: 'cursor', generic: 'opencode', opencode: 'opencode', antigravity: 'antigravity', gemini: 'antigravity' });
+const LEGACY_VERSION_FORMATS = Object.freeze(['claude', 'codex', 'cursor', 'generic', 'antigravity']);
 // A copy someone edited, damaged markers, a CLI that is not there: the request was fine, the files said no.
 const REFUSED_STATES = new Set(['not-installed', 'modified', 'conflict', 'error']);
 const REFUSED_CODES = new Set(['REMOVE_INCOMPLETE', 'CHANGED_UNDERNEATH', 'BUSY']);
@@ -133,7 +134,7 @@ export function legacyRulesetPayload(format, { render = renderRuleset } = {}) {
   const name = String(format || 'claude').toLowerCase();
   if (name === 'coexistence') return { ok: true, ruleset: renderCoexistenceSnippet().text, format: name };
   const host = LEGACY_FORMATS[name];
-  if (!host) return { status: 400, error: `Invalid format: ${name}. Use claude, cursor, generic, gemini, codex, or coexistence.` };
+  if (!host) return { status: 400, error: `Invalid format: ${name}. Use claude, cursor, generic, antigravity, codex, or coexistence.` };
   return { ok: true, ruleset: render(host).text, format: name };
 }
 
@@ -155,7 +156,7 @@ export function legacyRulesetVersionsPayload() {
 
 /** The two endpoints the pre-2.0 UI reads. Same shapes as before, served from the renderer. */
 export function registerLegacyRulesetRoutes(app, { render = renderRuleset } = {}) {
-  // Supports ?format=claude (default) | cursor | generic | gemini | codex | coexistence
+  // Supports ?format=claude (default) | cursor | generic | antigravity | codex | coexistence
   app.get('/api/claude-code/ruleset', (req, res) => {
     try {
       const payload = legacyRulesetPayload(req.query.format, { render });

package/neural-interface/lib/rulesets/fs-safe.js

@@ -3,7 +3,7 @@
 // ═══════════════════════════════════════════
 //
 // The rules installer edits files that belong to the user and to other CLIs
-// (~/.codex/AGENTS.md, ~/.gemini/GEMINI.md, OpenCode's config.json). These
+// (~/.codex/AGENTS.md, ~/.gemini/config/GEMINI.md, OpenCode's opencode.json). These
 // helpers make each write all-or-nothing, keep a symlinked file a symlink,
 // refuse to write through a link that points at nothing, keep a copy of what
 // was there before, never read a corrupt JSON file as `{}`, and never write