synabun 2.0.10 → 2.2.0

package/neural-interface/lib/skills/digest.js

@@ -0,0 +1,119 @@
+// ── What a skill is, byte for byte ──
+// A revision is the SHA-256 of a file's exact bytes: a save names the revision it was written over, and one
+// that does not match what is on disk now is refused (lib/skills/revision.js). A digest is the same for a whole
+// skill folder: a manifest of every entry (relative path, type, size, executable bit, the file's hash, a link's
+// target as written) sorted by path, hashed. It is what an install records as SynaBun's own and compares before
+// it replaces or removes anything (lib/skills/ownership.js), and what an import is approved by
+// (lib/skills/bundle.js).
+//
+// Reading a folder never follows a link (a link is an entry, with its target as text), never opens a FIFO or a
+// device (listed as `other`, never read), and is bounded in entries, depth and bytes.
+
+import { createHash } from 'node:crypto';
+import { lstatSync, readdirSync, readlinkSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { readConfinedFile } from '../confined-fs.js';
+import { realPathOf } from '../path-confine.js';
+
+export const sha256 = (data) => `sha256:${createHash('sha256').update(data).digest('hex')}`;
+
+/** The revision of a file's content: the hash of its exact bytes. */
+export function revisionOf(bytes) {
+  return sha256(Buffer.isBuffer(bytes) ? bytes : Buffer.from(String(bytes ?? ''), 'utf-8'));
+}
+
+/** Files the system writes into folders by itself: never part of what a skill is, never copied. */
+export const SYSTEM_NAMES = new Set(['.DS_Store', 'Thumbs.db', 'desktop.ini']);
+
+export const TREE_LIMITS = Object.freeze({ maxEntries: 5000, maxDepth: 24, maxBytes: 64 * 1024 * 1024, maxFileBytes: 32 * 1024 * 1024 });
+
+const byPath = (a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+
+/**
+ * The digest of a list of entries: `{ path, type: 'file'|'dir'|'link'|'other', size?, executable?, sha256?, target? }`.
+ * Order does not matter; the entries are sorted by path first.
+ */
+export function manifestDigest(entries) {
+  const lines = (entries || []).slice().sort(byPath).map((e) => {
+    if (e.type === 'file') return `file\t${e.path}\t${e.size}\t${e.executable ? 'x' : '-'}\t${e.sha256}`;
+    if (e.type === 'link') return `link\t${e.path}\t${e.target}`;
+    if (e.type === 'dir') return `dir\t${e.path}`;
+    return `other\t${e.path}`;
+  });
+  return sha256(lines.join('\n'));
+}
+
+/** The manifest entry of bytes about to be written as one file. */
+export function fileEntry(path, bytes, { executable = false } = {}) {
+  const buf = Buffer.isBuffer(bytes) ? bytes : Buffer.from(String(bytes ?? ''), 'utf-8');
+  return { path, type: 'file', size: buf.length, executable: !!executable, sha256: sha256(buf) };
+}
+
+/**
+ * Read what is at `path` as a manifest, without following any link.
+ * @returns {{ kind: 'absent'|'file'|'dir'|'link'|'other', entries: object[], digest: string|null, complete: boolean,
+ *   reason?: string }} `digest` is null when the folder could not be read whole (too large, changed while read):
+ *   such a destination is never taken for SynaBun's own.
+ */
+export function readManifest(path, limits = TREE_LIMITS) {
+  let st;
+  try { st = lstatSync(path); } catch { return { kind: 'absent', entries: [], digest: null, complete: true }; }
+  if (st.isSymbolicLink()) {
+    let target = '';
+    try { target = readlinkSync(path); } catch { target = ''; }
+    const entries = [{ path: '.', type: 'link', target }];
+    return { kind: 'link', entries, digest: manifestDigest(entries), complete: true };
+  }
+  if (st.isFile()) {
+    let real;
+    try {
+      real = realPathOf(path);
+      const bytes = readConfinedFile(dirname(real), real, { maxBytes: limits.maxFileBytes });
+      const entries = [fileEntry('.', bytes, { executable: (st.mode & 0o111) !== 0 })];
+      return { kind: 'file', entries, digest: manifestDigest(entries), complete: true };
+    } catch (err) {
+      return { kind: 'file', entries: [], digest: null, complete: false, reason: String(err?.message || err) };
+    }
+  }
+  if (!st.isDirectory()) return { kind: 'other', entries: [{ path: '.', type: 'other' }], digest: null, complete: false, reason: 'not a file or a folder' };
+  const entries = [];
+  const state = { bytes: 0, complete: true, reason: '' };
+  let base;
+  try { base = realPathOf(path); } catch { return { kind: 'dir', entries: [], digest: null, complete: false, reason: 'unresolvable' }; }
+  const walk = (dir, rel, depth) => {
+    if (!state.complete) return;
+    if (depth > limits.maxDepth) { state.complete = false; state.reason = 'too deep'; return; }
+    let names;
+    try { names = readdirSync(dir).sort(); } catch (err) { state.complete = false; state.reason = String(err?.message || err); return; }
+    for (const name of names) {
+      if (SYSTEM_NAMES.has(name)) continue;
+      if (entries.length >= limits.maxEntries) { state.complete = false; state.reason = 'too many entries'; return; }
+      const full = join(dir, name);
+      const relPath = rel ? `${rel}/${name}` : name;
+      let est;
+      try { est = lstatSync(full); } catch { state.complete = false; state.reason = 'changed while read'; return; }
+      if (est.isSymbolicLink()) {
+        let target = '';
+        try { target = readlinkSync(full); } catch { target = ''; }
+        entries.push({ path: relPath, type: 'link', target });
+      } else if (est.isDirectory()) {
+        entries.push({ path: relPath, type: 'dir' });
+        walk(full, relPath, depth + 1);
+        if (!state.complete) return;
+      } else if (est.isFile()) {
+        if (est.size > limits.maxFileBytes || state.bytes + est.size > limits.maxBytes) { state.complete = false; state.reason = 'too large'; return; }
+        let bytes;
+        try { bytes = readConfinedFile(base, full, { maxBytes: limits.maxFileBytes }); } catch (err) { state.complete = false; state.reason = String(err?.message || err); return; }
+        state.bytes += bytes.length;
+        entries.push(fileEntry(relPath, bytes, { executable: (est.mode & 0o111) !== 0 }));
+      } else {
+        entries.push({ path: relPath, type: 'other' });
+      }
+    }
+  };
+  walk(base, '', 0);
+  return { kind: 'dir', entries, digest: state.complete ? manifestDigest(entries) : null, complete: state.complete, ...(state.complete ? {} : { reason: state.reason }) };
+}
+
+/** A short form of a digest for people ("sha256:3f2a…9c01"). */
+export const shortDigest = (digest) => (typeof digest === 'string' && digest.length > 20 ? `${digest.slice(0, 13)}…${digest.slice(-4)}` : String(digest ?? ''));

package/neural-interface/lib/skills/discover.js

@@ -0,0 +1,111 @@
+// Discover only reads explicitly enabled public catalogs. Downloads become inert, scanned Review submissions.
+// GitHub's API is the transport for pinned upstream folders; no CLI, clone, hooks, installer or remote assets.
+import { createHash } from 'node:crypto';
+import { join } from 'node:path';
+import { localRecord } from './local-store.js';
+import { buildBundle, readBundle, createImportStaging, bundlePathProblem } from './bundle.js';
+import { readHeadOf } from './export.js';
+import { folderDigest } from './library.js';
+
+export const DISCOVER_SOURCES = Object.freeze([
+  { id: 'anthropic', label: 'Anthropic skills', repo: 'anthropics/skills', prefix: 'skills/', license: 'Per-skill terms; review LICENSE files', licenseCode: 'perSkill', transport: 'github' },
+  { id: 'openai', label: 'OpenAI skills', deprecated: true, repo: 'openai/skills', prefix: 'skills/.curated/', license: 'Per-skill terms; review LICENSE files', licenseCode: 'perSkill', transport: 'github' },
+  { id: 'claude-plugins', label: 'Claude official plugins', repo: 'anthropics/claude-plugins-official', prefix: '', license: 'Per-publisher terms', licenseCode: 'perPublisher', transport: 'github' },
+  { id: 'skills-sh', label: 'skills.sh', license: 'Upstream repository terms', licenseCode: 'upstream', transport: 'catalog-import', reason: 'No verified public catalog API contract; import a catalog of pinned GitHub sources.' },
+  { id: 'skillsmp', label: 'SkillsMP', license: 'Upstream repository terms', licenseCode: 'upstream', transport: 'catalog-import', reason: 'API credentials and terms are not configured; import a catalog of pinned GitHub sources.' },
+  { id: 'clawhub', label: 'ClawHub', license: 'MIT-0 for published skill content', licenseCode: 'mitZero', transport: 'catalog-import', reason: 'Registry artifact API contract is not configured; import a catalog of pinned GitHub mirrors with MIT-0 terms.' },
+]);
+const fail = (status, code, message) => { throw Object.assign(new Error(message), { status, code }); };
+const sha = (v) => typeof v === 'string' && /^[a-f0-9]{40}$/.test(v);
+const repoOK = (v) => typeof v === 'string' && /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(v) && !v.split('/').some((x) => x === '.' || x === '..');
+
+export async function githubJSON(path, { fetcher = globalThis.fetch, maxBytes = 8 * 1024 * 1024 } = {}) {
+  const response = await fetcher(`https://api.github.com${path}`, { redirect: 'error', signal: AbortSignal.timeout(15000), headers: { Accept: 'application/vnd.github+json', 'User-Agent': 'SynaBun-Skills-Studio' } });
+  if (!response.ok) fail(502, 'source_unavailable', `GitHub returned ${response.status}. Local skills are still available.`);
+  if (Number(response.headers.get('content-length')) > maxBytes) fail(413, 'source_limit', 'The catalog response exceeds its limit.');
+  const chunks = []; let size = 0;
+  for await (const chunk of response.body) { size += chunk.length; if (size > maxBytes) { await response.body.cancel?.().catch(() => {}); fail(413, 'source_limit', 'The catalog response exceeds its limit.'); } chunks.push(Buffer.from(chunk)); }
+  return JSON.parse(Buffer.concat(chunks).toString('utf-8'));
+}
+
+export function createSkillDiscover({ dataDir, service, settings, request = githubJSON, liveRoots, now = Date.now }) {
+  const store = localRecord(dataDir, 'discover', { catalogs: {} });
+  const staging = createImportStaging({ dir: join(dataDir, 'discover-staging'), liveRoots });
+  const sourceOf = (id) => { const s = DISCOVER_SOURCES.find((s) => s.id === id); if (!s) fail(400, 'invalid_source', 'Unknown Discover source.'); return s; };
+  function enabled(id) { sourceOf(id); if (!settings().sources.includes(id)) fail(403, 'source_disabled', 'The owner must enable this source in Discover first.'); }
+  function list({ sourceId = null, q = '' } = {}) {
+    const state = store.read();
+    const sources = DISCOVER_SOURCES.map((s) => ({ ...s, enabled: settings().sources.includes(s.id), checkedAt: state.catalogs[s.id]?.checkedAt || null, error: state.catalogs[s.id]?.error || null }));
+    const items = Object.entries(state.catalogs).filter(([id]) => (!sourceId || sourceId === id) && settings().sources.includes(id)).flatMap(([id, c]) => (c.items || []).map((i) => ({ ...i, ...(c.evidence ? {} : { licenseCode: sourceOf(id).licenseCode }) }))).filter((i) => `${i.name} ${i.repo} ${i.subpath}`.toLowerCase().includes(String(q).toLowerCase())).slice(0, 500);
+    return { sources, items, disclosure: 'Enabled refreshes send repository names and commit requests to api.github.com. No local skill content or usage is sent. Cached metadata and badges are not security approval.' };
+  }
+  async function tree(repo, commit) {
+    if (!repoOK(repo) || !sha(commit)) fail(400, 'invalid_source_pin', 'A public GitHub repository and a full commit are required.');
+    const result = await request(`/repos/${repo}/git/trees/${commit}?recursive=1`);
+    if (result.truncated || !Array.isArray(result.tree) || result.tree.length > 20000) fail(413, 'catalog_incomplete', 'The complete upstream tree could not be read.');
+    return result.tree;
+  }
+  async function refresh(sourceId) {
+    enabled(sourceId);
+    const source = sourceOf(sourceId);
+    if (!source.repo) fail(409, 'catalog_import_required', source.reason);
+    try {
+      const pin = await request(`/repos/${source.repo}/commits/HEAD`);
+      const rows = await tree(source.repo, pin.sha);
+      const items = rows.filter((e) => e.type === 'blob' && e.mode === '100644' && e.path.startsWith(source.prefix) && e.path.endsWith('/SKILL.md')).slice(0, 500).map((e) => {
+        const subpath = e.path.slice(0, -9);
+        return { sourceId, name: subpath.split('/').pop(), repo: source.repo, subpath, commit: pin.sha, license: source.license, licenseCode: source.licenseCode, id: createHash('sha256').update(`${sourceId}:${source.repo}:${subpath}:${pin.sha}`).digest('hex') };
+      });
+      const state = store.read(); state.catalogs[sourceId] = { checkedAt: now(), items, error: null }; store.write(state);
+      return list({ sourceId });
+    } catch (e) {
+      const state = store.read(); state.catalogs[sourceId] = { ...state.catalogs[sourceId], error: e.code || 'source_unavailable' }; store.write(state); throw e;
+    }
+  }
+  function importCatalog(sourceId, entries) {
+    enabled(sourceId);
+    if (!Array.isArray(entries) || entries.length > 500) fail(400, 'invalid_catalog', 'A catalog has at most 500 pinned entries.');
+    const items = entries.map((e) => {
+      if (!repoOK(e.repo) || !sha(e.commit) || bundlePathProblem(e.subpath) || typeof e.license !== 'string' || e.license.length > 500) fail(400, 'invalid_catalog', 'Each entry needs repo, full commit, safe subpath and declared license.');
+      if (sourceId === 'clawhub' && e.license !== 'MIT-0') fail(422, 'license_conflict', 'ClawHub content must carry MIT-0 terms.');
+      return { sourceId, repo: e.repo, commit: e.commit, subpath: e.subpath, name: e.subpath.split('/').pop(), license: e.license, id: createHash('sha256').update(`${sourceId}:${e.repo}:${e.subpath}:${e.commit}`).digest('hex') };
+    });
+    const state = store.read(); state.catalogs[sourceId] = { items, checkedAt: now(), error: null, evidence: 'owner-imported catalog; unverified publisher claim' }; store.write(state);
+    return list({ sourceId });
+  }
+  async function stage(itemId, author) {
+    const entry = Object.values(store.read().catalogs).flatMap((c) => c.items || []).find((i) => i.id === itemId && settings().sources.includes(i.sourceId));
+    if (!entry) fail(404, 'item_not_found', 'That enabled catalog has no such item.');
+    enabled(entry.sourceId);
+    const rows = await tree(entry.repo, entry.commit);
+    const selected = rows.filter((r) => r.path.startsWith(`${entry.subpath}/`) && r.type !== 'tree');
+    if (!selected.length || selected.length > 200 || selected.some((r) => !['100644', '100755'].includes(r.mode) || r.type !== 'blob' || !sha(r.sha) || bundlePathProblem(r.path.slice(entry.subpath.length + 1)))) fail(422, 'unsafe_source', 'The source is empty, too large, or contains links or unsupported paths.');
+    if (selected.reduce((n, r) => n + (Number(r.size) || 0), 0) > 18 * 1024 * 1024) fail(413, 'source_limit', 'The skill is larger than the staging limit.');
+    const files = []; let size = 0;
+    // Repository license is evidence too; keep it alongside the skill when it has no own LICENSE.
+    const license = rows.find((r) => /^(?:LICENSE|LICENSE\.md|LICENSE\.txt)$/.test(r.path) && r.type === 'blob' && r.mode === '100644' && sha(r.sha));
+    if (license && !selected.some((r) => /\/LICENSE(?:\.[^/]+)?$/i.test(r.path))) selected.push({ ...license, path: `${entry.subpath}/LICENSE.upstream` });
+    for (const row of selected) {
+      enabled(entry.sourceId); // revocation during a download stops the next outbound request
+      const blob = await request(`/repos/${entry.repo}/git/blobs/${row.sha}`);
+      if (blob.encoding !== 'base64' || typeof blob.content !== 'string') fail(502, 'invalid_blob', 'The upstream blob is not base64.');
+      const bytes = Buffer.from(blob.content.replace(/\s/g, ''), 'base64'); size += bytes.length;
+      if (size > 18 * 1024 * 1024 || bytes.length > 8 * 1024 * 1024) fail(413, 'source_limit', 'The skill is larger than the staging limit.');
+      const digest = createHash('sha1').update(`blob ${bytes.length}\0`).update(bytes).digest('hex');
+      if (digest !== row.sha) fail(409, 'source_changed', 'The upstream file does not match its immutable blob id.');
+      files.push({ path: row.path.slice(entry.subpath.length + 1), bytes, executable: row.mode === '100755' });
+    }
+    const name = readHeadOf(files).parsed.data?.name;
+    const read = readBundle(buildBundle({ type: 'skill', name, files, dirs: [] }).bundle);
+    const digest = folderDigest({ files: read.files, dirs: read.dirs });
+    const scan = service.scanFolder(read, { name, digest });
+    const stagingId = staging.stage(read, { provenance: entry, scan, license: entry.license });
+    const staged = staging.load(stagingId);
+    const made = service.library.createSkill({ name, files: staged.files, dirs: staged.dirs, source: { kind: 'github', uri: `https://github.com/${entry.repo}`, subpath: entry.subpath, requestedRef: entry.commit, resolvedCommit: entry.commit, stagingId },
+      author, origin: { kind: 'discover', sourceId: entry.sourceId, repo: entry.repo, license: entry.license } });
+    const review = service.submitReview({ revisionId: made.revision.revisionId, author, assumptions: [`License: ${entry.license}. Publisher claims need review.`], releaseNotes: `Discovered from ${entry.repo}@${entry.commit}:${entry.subpath}. Inert staging ${stagingId}.` });
+    service.announce({ type: 'revision.created', skillId: made.skill.skillId, revisionId: made.revision.revisionId });
+    return { stagingId, skillId: made.skill.skillId, revisionId: made.revision.revisionId, reviewId: review.review.reviewId, scan, provenance: entry, installed: false };
+  }
+  return { list, refresh, importCatalog, stage };
+}

package/neural-interface/lib/skills/draft-confinement.js

@@ -0,0 +1,216 @@
+// ── The skill-drafting worker's confinement (P3 review) ──
+// A creation (lib/skills/creation.js) drafts a skill with ONE Claude Code worker of the Assistant's dispatcher. That
+// worker reads sources that may be hostile (a web page, a transcript, someone else's skill), so what it can do is
+// enforced, not asked for: lib/native-loop-providers.js gives a confined run only the tools below (`tools`), no MCP
+// server at all (`strictMcpConfig`), no user or project settings (no user hooks, no allow rules), and checks every
+// tool call with draftToolDecision() twice: in a PreToolUse hook, which Claude Code runs before any permission mode,
+// and in canUseTool.
+//
+//   Read, Glob, Grep   inside the creation's workspace (its sources/ and what it wrote)
+//   Write, Edit        inside the workspace's out/ folder only
+//   anything else      refused: no shell, no web, no subagents, no MCP tools, no notebooks, no skills
+//
+// A path is checked as Claude Code would open it (relative to the workspace when not absolute), then at its real
+// location (lib/path-confine.js realPathOf: links resolved, a dangling link refused), so neither a link nor ".." leads
+// out; a ".." segment is refused outright. Glob and Grep patterns are relative and never climb. A file that is written
+// must be a plain file with one name (no hard link to somewhere else). Anything that cannot be checked is refused.
+// Every provider holds a drafting worker the way it can (draftConfinementSupport): Claude Code as above, exactly;
+// Codex under its sandbox (writes inside the workspace only, no network, no web search, every MCP server of its
+// config disabled; it keeps its shell, which the sandbox confines: codexDraftOptions); OpenCode with its shell, web,
+// subagent and skill tools switched off, no MCP server, and every edit asked and answered by draftToolDecision
+// inside the workspace (openCodeDraftConfig, draftOpenCodeDecision). The dispatcher refuses a provider that cannot
+// (assistant-dispatch.js normalizeSpec), never starts a run unconfined and never escalates it onto one that cannot.
+
+import { existsSync, lstatSync, readFileSync, realpathSync } from 'node:fs';
+import { isAbsolute, join, resolve } from 'node:path';
+import { isInside, realPathOf } from '../path-confine.js';
+
+export const DRAFT_CONFINEMENT = 'skill-draft';
+/** The writable folder under the workspace (creation-brief.js OUT_DIR). */
+export const DRAFT_WRITABLE = 'out';
+/** The only built-in tools a drafting worker has. */
+export const DRAFT_TOOLS = Object.freeze(['Read', 'Write', 'Edit', 'Glob', 'Grep']);
+/** Removed as well, by name (belt and braces: `tools` already leaves them out, and a hook refuses whatever is not above). */
+export const DRAFT_DISALLOWED_TOOLS = Object.freeze([
+  'Bash', 'BashOutput', 'KillShell', 'KillBash', 'Monitor', 'WebFetch', 'WebSearch', 'Task', 'Agent', 'TaskStop', 'NotebookEdit',
+  'NotebookRead', 'Skill', 'SlashCommand', 'TodoWrite', 'ExitPlanMode', 'EnterPlanMode', 'AskUserQuestion', 'ListMcpResources',
+  'ReadMcpResource', 'Workflow', 'CronCreate', 'ScheduleWakeup', 'RemoteTrigger', 'EnterWorktree', 'ExitWorktree', 'Artifact',
+]);
+const READERS = new Set(['Read', 'Glob', 'Grep']);
+const WRITERS = new Set(['Write', 'Edit']);
+const REFUSED = 'A skill-drafting run has only Read, Write, Edit, Glob and Grep, inside its own folder: no shell, no web, no MCP tools and no subagents.';
+
+/**
+ * A confinement as a run carries it, checked: { kind, root (the workspace's real path), writable (its out/) }.
+ * Throws when it cannot be used (the run must not start unconfined).
+ * @param {{ kind?: string }|null} confinement
+ * @param {string} cwd the run's working directory (the creation's workspace)
+ */
+export function resolveDraftConfinement(confinement, cwd) {
+  if (!confinement || confinement.kind !== DRAFT_CONFINEMENT) throw new Error('Unknown confinement.');
+  const root = realpathSync(String(cwd || ''));
+  const writableReal = realpathSync(join(root, DRAFT_WRITABLE));
+  if (writableReal !== join(root, DRAFT_WRITABLE) || !lstatSync(writableReal).isDirectory()) throw new Error(`The workspace's ${DRAFT_WRITABLE}/ folder is not a plain folder.`);
+  return { kind: DRAFT_CONFINEMENT, root, writable: writableReal };
+}
+
+/** A path the worker names, where it really is, or null when it cannot be one of the workspace's. */
+function placeOf(raw, root) {
+  if (typeof raw !== 'string' || !raw || raw.length > 4096 || /[\u0000-\u001f\u007f]/.test(raw) || raw.startsWith('~')) return null;
+  if (raw.split(/[\\/]+/).includes('..')) return null;
+  const abs = isAbsolute(raw) ? resolve(raw) : resolve(root, raw);
+  try { return realPathOf(abs); } catch { return null; }
+}
+
+/** A Glob / Grep pattern: relative, no "..", no home. */
+function patternProblem(p) {
+  if (p === undefined || p === null) return null;
+  if (typeof p !== 'string' || p.length > 1000 || /[\u0000-\u001f\u007f]/.test(p)) return 'is not a plain pattern';
+  if (p.startsWith('/') || p.startsWith('\\') || p.startsWith('~') || /^[A-Za-z]:/.test(p)) return 'is absolute: patterns are relative to the drafting folder';
+  if (p.split(/[\\/]+/).includes('..')) return 'climbs out with "..": patterns stay inside the drafting folder';
+  return null;
+}
+
+/**
+ * Whether a drafting worker may make this tool call: null when it may, else why not (the worker reads the reason).
+ * @param {string} toolName
+ * @param {object} input the tool's input
+ * @param {{ root: string, writable: string }} confinement resolveDraftConfinement()'s answer
+ */
+export function draftToolDecision(toolName, input, confinement) {
+  try {
+    const name = String(toolName || '');
+    const args = input && typeof input === 'object' ? input : {};
+    const { root, writable } = confinement || {};
+    if (!root || !writable) return 'This run\'s drafting folder is not known: nothing can be done.';
+    if (!READERS.has(name) && !WRITERS.has(name)) return `${name || 'That tool'} is not available. ${REFUSED}`;
+    if (name === 'Read') {
+      const at = placeOf(args.file_path, root);
+      if (!at || !isInside(root, at)) return `Read is limited to the drafting folder (${root}). ${REFUSED}`;
+      return null;
+    }
+    if (name === 'Glob' || name === 'Grep') {
+      if (args.path !== undefined && args.path !== null && args.path !== '') {
+        const at = placeOf(args.path, root);
+        if (!at || !isInside(root, at, { allowRoot: true })) return `${name} searches the drafting folder only (${root}).`;
+      }
+      const bad = name === 'Glob' ? patternProblem(args.pattern) : patternProblem(args.glob);
+      if (name === 'Glob' && (typeof args.pattern !== 'string' || !args.pattern)) return 'Glob needs a pattern.';
+      if (bad) return `The ${name === 'Glob' ? 'pattern' : 'glob'} ${bad}.`;
+      return null;
+    }
+    // Write, Edit: a plain file under out/.
+    const at = placeOf(args.file_path, root);
+    if (!at || !isInside(writable, at)) return `${name} writes inside ${writable} only: the draft goes in ${DRAFT_WRITABLE}/<name>/. ${REFUSED}`;
+    let st = null;
+    try { st = lstatSync(at); } catch { st = null; }
+    if (st && (!st.isFile() || st.nlink > 1)) return `${at} is not a plain file of the draft: it cannot be written.`;
+    return null;
+  } catch (err) {
+    return `The call could not be checked (${err?.message || err}), so it is refused.`;
+  }
+}
+
+/** The PreToolUse hook a confined run gets (no matcher: every tool call, subagents' included). */
+export function draftPreToolUseHook(confinement) {
+  return async (input) => {
+    const reason = draftToolDecision(input?.tool_name, input?.tool_input || {}, confinement);
+    return reason ? { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason } } : {};
+  };
+}
+
+// ── The other providers ──
+
+/** The providers a drafting run can be confined on, in the order the Create page lists them. */
+export const DRAFT_CONFINED_PROVIDERS = Object.freeze(['claude-code', 'codex', 'opencode']);
+
+/**
+ * What a provider can hold a drafting worker to: { ok: true, level, note } or { ok: false, reason }. `level`:
+ * 'strict' (file tools only, every call checked), 'sandbox' (the OS sandbox around a shell), 'rules' (the
+ * provider's permission rules plus its tool switches).
+ */
+export function draftConfinementSupport(provider, { platform = process.platform } = {}) {
+  const name = String(provider || '');
+  if (name === 'claude-code') return { ok: true, level: 'strict', note: 'Read, Write, Edit, Glob and Grep inside its folder only; no shell, no web, no MCP tools, no subagents.' };
+  if (name === 'codex') {
+    return {
+      ok: true, level: 'sandbox',
+      note: `Codex keeps its shell under its ${platform === 'win32' ? 'Windows' : platform === 'darwin' ? 'Seatbelt' : 'Linux'} sandbox: writes inside its folder only, no network, no web search, no MCP server.`,
+    };
+  }
+  if (name === 'opencode') return { ok: true, level: 'rules', note: 'OpenCode with its shell, web, subagent and skill tools switched off, no MCP server, and every edit answered inside its folder only.' };
+  // Antigravity (a worker of the Assistant) has no drafting confinement in SynaBun: a drafting run never starts unconfined.
+  if (name === 'antigravity') return { ok: false, reason: 'Antigravity cannot be held to a drafting folder: skill drafting runs on Claude Code, Codex and OpenCode.' };
+  return { ok: false, reason: `${name || 'That provider'} cannot be held to a drafting folder: skill drafting runs on Claude Code, Codex and OpenCode.` };
+}
+
+/** The MCP server names a Codex config.toml declares ([mcp_servers.NAME] tables), for disabling them one by one. */
+export function codexMcpServerNames(codexHome) {
+  const names = new Set();
+  try {
+    const file = join(String(codexHome || ''), 'config.toml');
+    if (!codexHome || !existsSync(file)) return [];
+    for (const line of readFileSync(file, 'utf8').split(/\r?\n/)) {
+      const m = /^\s*\[\s*mcp_servers\.(?:"([^"]+)"|'([^']+)'|([A-Za-z0-9_-]+))/.exec(line);
+      if (m) names.add(m[1] ?? m[2] ?? m[3]);
+    }
+  } catch { /* an unreadable config declares nothing we can name; SynaBun's own entry is disabled by name anyway */ }
+  return [...names];
+}
+
+/**
+ * Codex: the thread options and the config overrides of a confined drafting run. The sandbox holds the shell
+ * (writable roots: the workspace and Codex's own temp folders; no parent folder, no network); every MCP server the
+ * account's config declares, and SynaBun's, is disabled; web search is off.
+ */
+export function codexDraftOptions(confined, { codexHome = null, projectDir = null } = {}) {
+  if (!confined || confined.kind !== DRAFT_CONFINEMENT) throw new Error('Unknown confinement.');
+  // The account's config.toml and a project-level .codex/config.toml in the drafting folder (SynaBun makes that folder,
+  // so there is none; checked all the same). Servers a Codex plugin brings cannot be named here: Codex loads plugins
+  // from its own home, which the sandbox does not reach, and SynaBun installs none for a worker.
+  const servers = new Set(['SynaBun', ...codexMcpServerNames(codexHome), ...(projectDir ? codexMcpServerNames(join(String(projectDir), '.codex')) : [])]);
+  const mcp_servers = {};
+  for (const name of servers) mcp_servers[name] = { enabled: false };
+  return {
+    thread: { sandboxMode: 'workspace-write', networkAccessEnabled: false, webSearchMode: 'disabled', additionalDirectories: undefined },
+    config: { mcp_servers },
+  };
+}
+
+/**
+ * OpenCode's tools a drafting run does without: refused by its rules (OpenCode 2's permission actions). `execute` is
+ * Code Mode, whose `opencode` namespace moves the session to another folder (seen live on 2.1.4: a moved session read
+ * a file outside the workspace with external_directory denied), creates and removes worktrees and reads MCP
+ * resources; `question` would wait for an answer nobody gives.
+ */
+export const OPENCODE_DRAFT_TOOLS_OFF = Object.freeze(['shell', 'webfetch', 'websearch', 'subagent', 'skill', 'todo', 'lsp', 'external_directory', 'browser', 'execute', 'question']);
+
+/**
+ * OpenCode: the config a confined drafting run's serve and session get: OpenCode 2's permission rules (every edit
+ * asked, every other tool refused) and no MCP server.
+ */
+export function openCodeDraftConfig() {
+  return {
+    permissions: [
+      { action: 'edit', resource: '*', effect: 'ask' },
+      ...OPENCODE_DRAFT_TOOLS_OFF.map((action) => ({ action, resource: '*', effect: 'deny' })),
+    ],
+    mcp: 'off',
+  };
+}
+
+/** An OpenCode permission ask under the draft confinement: null when it may go ahead, else why not. */
+export function draftOpenCodeDecision(request, confined) {
+  const kind = String(request?.permission || request?.type || '').toLowerCase();
+  if (/^(?:edit|write|patch|multiedit|apply_patch)$/.test(kind)) {
+    const meta = request?.metadata && typeof request.metadata === 'object' ? request.metadata : {};
+    let raw = null;
+    for (const key of ['filePath', 'filepath', 'file_path', 'path']) if (typeof meta[key] === 'string' && meta[key]) { raw = meta[key]; break; }
+    if (!raw) {
+      const pattern = request?.pattern ?? request?.patterns;
+      raw = typeof pattern === 'string' ? pattern : Array.isArray(pattern) && typeof pattern[0] === 'string' ? pattern[0] : null;
+    }
+    return draftToolDecision('Write', { file_path: raw }, confined);
+  }
+  return `${kind || 'That tool'} is not available. ${REFUSED}`;
+}