synabun 2.0.10 → 2.2.0

package/neural-interface/package-lock.json

@@ -1,19 +1,19 @@
 {
   "name": "neural-memory-interface",
-  "version": "2.0.10",
+  "version": "2.2.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "neural-memory-interface",
-      "version": "2.0.10",
+      "version": "2.2.0",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
+        "@agentclientprotocol/sdk": "2.2.0",
         "@anthropic-ai/claude-agent-sdk": "0.3.288",
         "@huggingface/transformers": "^3.0.0",
         "@openai/codex-sdk": "^0.160.0",
-        "@opencode-ai/sdk": "1.18.34",
         "@xterm/addon-fit": "0.11.0",
         "@xterm/addon-search": "0.16.0",
         "@xterm/addon-serialize": "0.14.0",
@@ -31,6 +31,7 @@
         "playwright": "^1.59.1",
         "undici": "^8.5.0",
         "ws": "^8.21.0",
+        "yaml": "2.9.1",
         "zod": "^4.4.3"
       },
       "devDependencies": {
@@ -57,6 +58,21 @@
         "node": ">=22.19.0"
       }
     },
+    "node_modules/@agentclientprotocol/sdk": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@agentclientprotocol/sdk/-/sdk-2.2.0.tgz",
+      "integrity": "sha512-o1+eDQVb05yzPY+5v54awHyONU1oeLsbLVavkwrMQaZDuJDh/38pQiXJS4ix4d6QA3Y4bU0lHFRjwg99KKKSaQ==",
+      "license": "Apache-2.0",
+      "peerDependencies": {
+        "@modelcontextprotocol/server": "^2.4.0",
+        "zod": "^3.25.76 || ^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@modelcontextprotocol/server": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/@antfu/install-pkg": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/@antfu/install-pkg/-/install-pkg-2.1.0.tgz",
@@ -2205,15 +2221,6 @@
         "node": ">=18"
       }
     },
-    "node_modules/@opencode-ai/sdk": {
-      "version": "1.18.34",
-      "resolved": "https://registry.npmjs.org/@opencode-ai/sdk/-/sdk-1.18.34.tgz",
-      "integrity": "sha512-R9QWUpcngtdQ6FCixz7NC6n1WsSho6CEuRUzYHz/CzZcp3miSklDzXkm0oDwXVCnuEu+ANoeM0f6RDp51kOMzQ==",
-      "license": "MIT",
-      "dependencies": {
-        "cross-spawn": "7.0.6"
-      }
-    },
     "node_modules/@pkgjs/parseargs": {
       "version": "0.11.0",
       "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
@@ -6391,6 +6398,21 @@
         "node": ">=18"
       }
     },
+    "node_modules/yaml": {
+      "version": "2.9.1",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz",
+      "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==",
+      "license": "ISC",
+      "bin": {
+        "yaml": "bin.mjs"
+      },
+      "engines": {
+        "node": ">= 14.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/eemeli"
+      }
+    },
     "node_modules/zip-stream": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/zip-stream/-/zip-stream-6.0.1.tgz",

package/neural-interface/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neural-memory-interface",
-  "version": "2.0.10",
+  "version": "2.2.0",
   "private": true,
   "description": "Private local SynaBun interface for memory visualization and multi-agent workflows",
   "license": "Apache-2.0",
@@ -21,10 +21,10 @@
     "postinstall": "node scripts/rebuild-pty.js && node scripts/build-vendor.mjs"
   },
   "dependencies": {
+    "@agentclientprotocol/sdk": "2.2.0",
     "@anthropic-ai/claude-agent-sdk": "0.3.288",
     "@huggingface/transformers": "^3.0.0",
     "@openai/codex-sdk": "^0.160.0",
-    "@opencode-ai/sdk": "1.18.34",
     "@xterm/addon-fit": "0.11.0",
     "@xterm/addon-search": "0.16.0",
     "@xterm/addon-serialize": "0.14.0",
@@ -42,6 +42,7 @@
     "playwright": "^1.59.1",
     "undici": "^8.5.0",
     "ws": "^8.21.0",
+    "yaml": "2.9.1",
     "zod": "^4.4.3"
   },
   "overrides": {

package/neural-interface/public/index.html

@@ -13,7 +13,8 @@
 <link rel="manifest" href="/manifest.json">
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-<link href="https://fonts.googleapis.com/css2?family=Caveat:wght@400;700&family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500&family=Space+Grotesk:wght@500;600;700&display=swap" rel="stylesheet">
+<link rel="stylesheet" href="/vendor/caveat/caveat.css">
+<link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500&family=Space+Grotesk:wght@500;600;700&display=swap" rel="stylesheet">
 <link href="https://db.onlinewebfonts.com/c/3284c3a32cf946466fb963369b3c5b2d?family=Disket+Mono" rel="stylesheet">
 <link rel="stylesheet" href="/shared/styles.css">
 <!-- three.js is vendored (scripts/build-vendor.mjs); only the map renderer imports it.
@@ -59,6 +60,7 @@
 <!-- html2canvas for card screenshot MCP tool (vendored: public/vendor/html2canvas/) -->
 <script src="/vendor/html2canvas/html2canvas-1.4.1.min.js" defer></script>
 
+<script type="module" src="/shared/page-session.js"></script>
 <script type="module" src="/variant/3d/main.js"></script>
 </body>
 </html>

package/neural-interface/public/index2d.html

@@ -1,4 +1,5 @@
 <!DOCTYPE html>
+<!-- DEPRECATED: 2D source retained on disk. Old bookmarks redirect to the 3D memory map. -->
 <html lang="en">
 <head>
 <meta charset="UTF-8">
@@ -13,21 +14,26 @@
 <link rel="manifest" href="/manifest.json">
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-<link href="https://fonts.googleapis.com/css2?family=Caveat:wght@400;700&family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500&family=Space+Grotesk:wght@500;600;700&display=swap" rel="stylesheet">
+<link rel="stylesheet" href="/vendor/caveat/caveat.css">
+<link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500&family=Space+Grotesk:wght@500;600;700&display=swap" rel="stylesheet">
 <link href="https://db.onlinewebfonts.com/c/3284c3a32cf946466fb963369b3c5b2d?family=Disket+Mono" rel="stylesheet">
 <link rel="stylesheet" href="/shared/styles.css">
 <style>
   /* ═══════════════════════════════════════════
      2D VARIANT — Main Canvas
      ═══════════════════════════════════════════ */
+  /* The graph fills the app frame (styles.css APP FRAME); graph.js sizes its buffer and reads pointers from this box.
+     A canvas does not stretch between left and right: its size is written out. */
   #canvas-main {
     position: fixed;
-    top: 0; left: 0;
-    width: 100%; height: 100%;
+    top: var(--frame-top); left: var(--frame-left);
+    width: calc(100% - var(--sidebar-total-width, 0px) - 2 * var(--frame-gap));
+    height: calc(100dvh - var(--frame-top) - var(--frame-gap));
+    border-radius: var(--frame-radius);
     z-index: 1;
-    cursor: grab;
+    cursor: move;
   }
-  #canvas-main:active { cursor: grabbing; }
+  #canvas-main:active { cursor: move; }
 
   /* ═══════════════════════════════════════════
      2D VARIANT — Minimap
@@ -48,10 +54,10 @@
     box-shadow: 0 2px 20px rgba(0,0,0,0.4);
     transition: opacity 0.2s ease;
     opacity: 0; pointer-events: none;
-    cursor: grab;
+    cursor: move;
     user-select: none;
   }
-  #minimap:active { cursor: grabbing; }
+  #minimap:active { cursor: move; }
   #minimap.visible { opacity: 1; pointer-events: auto; }
   #minimap-canvas { width: 100%; height: 100%; display: block; }
   #minimap-label {
@@ -89,8 +95,9 @@
      ═══════════════════════════════════════════ */
   #lasso-canvas {
     position: fixed;
-    top: 0; left: 0;
-    width: 100%; height: 100%;
+    top: var(--frame-top); left: var(--frame-left);
+    width: calc(100% - var(--sidebar-total-width, 0px) - 2 * var(--frame-gap));
+    height: calc(100dvh - var(--frame-top) - var(--frame-gap));
     z-index: 5;
     pointer-events: none;
   }
@@ -123,7 +130,8 @@
   <div class="ctx-item ctx-item--danger" data-action="trash">Move to Trash</div>
 </div>
 
-<!-- Boot 2D variant -->
-<script type="module" src="/variant/2d/main.js"></script>
+<!-- Redirect the deprecated entry point (also works with a static host) -->
+<script type="module" src="/shared/page-session.js"></script>
+<script type="module" src="/shared/retired-2d.js"></script>
 </body>
 </html>

package/neural-interface/public/onboarding.html

@@ -1489,9 +1489,9 @@ const wizardState = {
 // `id` is also the host name of the rules API (/api/setup/rules/:host).
 const TOOLS = [
   { id: 'claude',   name: 'Claude Code', api: '/api/claude-code/mcp', configPath: '~/.claude.json' },
-  { id: 'gemini',   name: 'Gemini CLI',  api: '/api/setup/gemini/mcp', configPath: '~/.gemini/settings.json' },
+  { id: 'antigravity', name: 'Antigravity CLI', api: '/api/setup/antigravity/mcp', configPath: '~/.gemini/config/mcp_config.json' },
   { id: 'codex',    name: 'Codex CLI',   api: '/api/setup/codex/mcp',  configPath: '~/.codex/config.toml' },
-  { id: 'opencode', name: 'OpenCode',    api: '/api/opencode/mcp',     configPath: '~/.config/opencode/config.json' },
+  { id: 'opencode', name: 'OpenCode',    api: '/api/opencode/mcp',     configPath: '~/.config/opencode/opencode.json' },
 ];
 
 // ═══════════════════════════════════════════
@@ -2636,7 +2636,7 @@ function showToggleRules(id, rules, { connected, wanted }) {
     else if (rules.path) text = `Rules installed: ${rules.path}`;
   } else if (rules && rules.ok !== false && rules.kept && rules.kept.length) {
     // Disconnected. A copy the user edited is theirs: SynaBun left it where it is (and for OpenCode, so is a copy
-    // their own line in config.json points at).
+    // their own line in opencode.json points at).
     text = `Your ${rules.kept[0].reason === 'listed-in-config' ? '' : 'edited '}rules were left in place: ${rules.kept[0].path}`;
   } else if (rules && rules.ok === false && rules.error) {
     // Disconnected, but rules could not be taken out (damaged markers, a symlink): say which and why.

package/neural-interface/public/shared/account-menu.js

@@ -14,6 +14,7 @@
 import {
   accountManageModel, accountMenuModel, accountText, apiKeyErrorText, serverAccountId,
 } from './account-view.js';
+import { frameRect } from './app-frame.js';
 
 const STYLE_ID = 'account-menu-styles';
 // Values come from the panel's own tokens: Claude's global --t-* / --s-* scale, Codex's --cxp-* scale
@@ -338,15 +339,17 @@ export function mountAccountMenu({ provider = 'claude', container, before = null
     if (!rect.width && !rect.height && trigger.parentElement) rect = trigger.parentElement.getBoundingClientRect();
     const owner = layer?.() || trigger.closest('[class*="panel"]');
     const ownerWidth = owner?.getBoundingClientRect?.().width;
-    popup.style.width = `${Math.max(0, Math.min(320, ownerWidth > 240 ? ownerWidth - 16 : 320, window.innerWidth - 16))}px`;
+    // Inside the app frame (app-frame.js; the whole window on a page without it), 8px clear of its edges.
+    const f = frameRect();
+    popup.style.width = `${Math.max(0, Math.min(320, ownerWidth > 240 ? ownerWidth - 16 : 320, f.width - 16))}px`;
     const width = popup.offsetWidth || 300;
-    const left = Math.max(8, Math.min(rect.right - width, window.innerWidth - width - 8));
-    const below = window.innerHeight - rect.bottom - 14;
-    const above = rect.top - 14;
+    const left = Math.max(f.left + 8, Math.min(rect.right - width, f.right - width - 8));
+    const below = f.bottom - rect.bottom - 14;
+    const above = rect.top - f.top - 14;
     const flip = below < 180 && above > below;
     popup.style.maxHeight = `${Math.max(80, Math.min(520, flip ? above : below))}px`;
     popup.style.left = `${Math.round(left)}px`;
-    popup.style.top = `${Math.round(flip ? Math.max(8, rect.top - 6 - popup.offsetHeight) : rect.bottom + 6)}px`;
+    popup.style.top = `${Math.round(flip ? Math.max(f.top + 8, rect.top - 6 - popup.offsetHeight) : rect.bottom + 6)}px`;
     let z = 201;
     try { z = (parseInt(getComputedStyle(owner).zIndex, 10) || 200) + 1; } catch {}
     popup.style.zIndex = String(z);

package/neural-interface/public/shared/agent-runtime-options.js

@@ -6,16 +6,36 @@ import { fetchOpencodeProviders, opencodeProviders } from './opencode-providers.
 export const CLI_PROFILES = [
   { id: 'claude-code', label: 'Claude Code', desc: 'Anthropic' },
   { id: 'codex', label: 'Codex CLI', desc: 'OpenAI' },
-  { id: 'gemini', label: 'Gemini CLI', desc: 'Google' },
+  { id: 'antigravity', label: 'Antigravity CLI', desc: 'Google' },
   { id: 'opencode', label: 'OpenCode CLI', desc: 'Multi-provider' },
 ];
 
-const STATIC_MODELS = {
-  gemini: [
-    { id: 'gemini-2.5-pro', label: '2.5 Pro', desc: 'Most capable', tier: 'default' },
-    { id: 'gemini-2.5-flash', label: '2.5 Flash', desc: 'Lightweight' },
-  ],
-};
+// Google Antigravity replaced the Gemini CLI (provider id `gemini` → `antigravity`). What was saved before
+// (a launch profile, a resume tab, a template's CLI or icon) can still say `gemini`: it reads as Antigravity.
+// The server moves its own files the same way (lib/antigravity/migrate-gemini.js).
+export function migrateProviderId(id) { return id === 'gemini' ? 'antigravity' : id; }
+
+// The Gemini CLI's own model ids (gemini-1.x, gemini-2.x) are not Antigravity's: one saved for it reads as
+// none, so Antigravity's default runs (the same rule as isGeminiCliModel in lib/antigravity/migrate-gemini.js).
+const GEMINI_CLI_MODEL_RE = /^gemini-[12](?:[.-]|$)/i;
+export function migrateProviderModel(profileId, model) {
+  return migrateProviderId(profileId) === 'antigravity' && typeof model === 'string' && GEMINI_CLI_MODEL_RE.test(model.trim()) ? null : model;
+}
+
+/** Saved launch records (loop templates, schedules, groups, timers) with a Gemini CLI profile or icon read as Antigravity's. */
+export function migrateLaunchRecords(list) {
+  if (!Array.isArray(list)) return list;
+  return list.map((record) => {
+    if (!record || typeof record !== 'object' || (record.profile !== 'gemini' && record.icon !== 'gemini')) return record;
+    const next = { ...record };
+    if (next.icon === 'gemini') next.icon = migrateProviderId(next.icon);
+    if (next.profile === 'gemini') {
+      next.profile = migrateProviderId(next.profile);
+      if (migrateProviderModel(next.profile, next.model) !== next.model) next.model = null;
+    }
+    return next;
+  });
+}
 
 // Claude Code models are discovered live from the installed CLI via
 // /api/claude/models (see lib/claude-model-catalog.js) — the CLI is the only
@@ -59,6 +79,15 @@ export const EFFORT_LEVELS_BY_PROFILE = {
     { id: 'max', label: 'Max', desc: 'Maximum' },
     { id: 'ultra', label: 'Ultra', desc: 'Maximum, with delegation', tier: 'top' },
   ],
+  // The levels `agy --effort` takes; `off` passes none, so Antigravity uses its own default.
+  antigravity: [
+    { id: 'off', label: 'Default', desc: 'Model default' },
+    { id: 'low', label: 'Low', desc: 'Light' },
+    { id: 'medium', label: 'Med', desc: 'Balanced' },
+    { id: 'high', label: 'High', desc: 'Deep' },
+    { id: 'xhigh', label: 'XHigh', desc: 'Very deep' },
+    { id: 'max', label: 'Max', desc: 'Maximum', tier: 'top' },
+  ],
 };
 
 // One effort vocabulary, lowest first (the server keeps the same table in
@@ -145,11 +174,16 @@ let _opencodeModelsCache = null;
 let _opencodeModelsLoading = null;
 let _claudeModelsCache = null;
 let _claudeModelsLoading = null;
-let _mcpProfilePresets = null;
-let _mcpProfilePresetsLoading = null;
-
-// The verified Claude and Codex lists are also kept in sessionStorage (this tab only): after a reload the
-// pickers paint from them at once (a list read back is due, so the first load still asks the server).
+let _antigravityModelsCache = null;
+let _antigravityModelsLoading = null;
+let _toolCatalog = null;
+const _toolCatalogLoads = new Map();
+const _toolCatalogByCwd = new Map();
+const _toolCatalogAt = new Map();
+let _toolCatalogEpoch = 0;
+
+// The verified Claude, Codex and Antigravity lists are also kept in sessionStorage (this tab only): after a reload
+// the pickers paint from them at once (a list read back is due, so the first load still asks the server).
 const LIST_STORE_PREFIX = 'synabun:runtime-models:v1:';
 function keepList(key, list) {
   try { if (typeof sessionStorage !== 'undefined') sessionStorage.setItem(LIST_STORE_PREFIX + key, JSON.stringify(list)); } catch { /* full or unavailable */ }
@@ -166,6 +200,8 @@ function keptList(key) {
   if (claude && !_claudeModelsCache) _claudeModelsCache = claude;
   const codex = keptList('codex:default');
   if (codex && !_codexModelsCache.has('default')) _codexModelsCache.set('default', codex);
+  const antigravity = keptList('antigravity');
+  if (antigravity && !_antigravityModelsCache) _antigravityModelsCache = antigravity;
 })();
 
 function localJsonArray(key) {
@@ -535,16 +571,59 @@ export async function fetchClaudeModels(force = false) {
   return _claudeModelsLoading;
 }
 
+// GET /api/antigravity/models answers { models: [{ id, label, description?, default? }], source: 'live' | 'unavailable' }.
+function antigravityModelOption(model) {
+  const id = String(model?.id || '').trim();
+  if (!id) return null;
+  return {
+    id,
+    provider: 'antigravity',
+    cliReady: true,
+    label: String(model.label || id),
+    desc: String(model.description || ''),
+    ...(model.default === true ? { tier: 'default', isDefault: true } : {}),
+  };
+}
+
+// Antigravity's models come only from the installed `agy`: there is no list of SynaBun's own to fall back on,
+// so until it answers the pickers are empty and a launch runs Antigravity's default. A list it gave once is
+// kept through a failed or unavailable answer.
+export async function fetchAntigravityModels(force = false) {
+  if (!force && _antigravityModelsCache?.length && modelListIsFresh('antigravity')) return _antigravityModelsCache;
+  if (_antigravityModelsLoading) return _antigravityModelsLoading;
+  _antigravityModelsLoading = (async () => {
+    try {
+      const resp = await fetch('/api/antigravity/models');
+      const data = await resp.json().catch(() => ({}));
+      const models = resp.ok && data?.source !== 'unavailable' && Array.isArray(data?.models)
+        ? data.models.map(antigravityModelOption).filter(Boolean)
+        : [];
+      if (models.length) {
+        _antigravityModelsCache = models;
+        _modelListAt.set('antigravity', Date.now());
+        keepList('antigravity', models);
+      }
+      return _antigravityModelsCache || [];
+    } catch {
+      return _antigravityModelsCache || [];
+    } finally {
+      _antigravityModelsLoading = null;
+    }
+  })();
+  return _antigravityModelsLoading;
+}
+
 // Profiles whose model list is fetched at runtime rather than baked in. Callers use
 // this to decide whether to kick off an async load and re-render when it lands.
 export function isDynamicModelProfile(profileId) {
-  return profileId === 'opencode' || profileId === 'codex' || profileId === 'claude-code';
+  return profileId === 'opencode' || profileId === 'codex' || profileId === 'claude-code' || profileId === 'antigravity';
 }
 
 export async function ensureModelsForProfile(profileId, force = false, accountId = 'default') {
   if (profileId === 'codex') return fetchCodexModels(force, accountId);
   if (profileId === 'opencode') return fetchOpencodeModels(force);
   if (profileId === 'claude-code') return fetchClaudeModels(force);
+  if (profileId === 'antigravity') return fetchAntigravityModels(force);
   return getModelsForProfile(profileId, accountId);
 }
 
@@ -562,7 +641,8 @@ export function getModelsForProfile(profileId, accountId = 'default') {
   if (profileId === 'codex') return _codexModelsCache.get(String(accountId || 'default')) || [];
   if (profileId === 'opencode') return _opencodeModelsCache || keptOpencodeModels() || [];
   if (profileId === 'claude-code') return _claudeModelsCache || [];
-  return STATIC_MODELS[profileId] || [];
+  if (profileId === 'antigravity') return _antigravityModelsCache || [];
+  return [];
 }
 
 // Live Claude and Codex options are spawn-ready ids. Only legacy Claude options
@@ -633,27 +713,40 @@ export function normalizeEffortForProfile(profileId, effort) {
   return levels.some(e => e.id === value) ? value : null;
 }
 
-export async function fetchMcpProfilePresets(force = false) {
-  if (!force && _mcpProfilePresets) return _mcpProfilePresets;
-  // Callers asking at the same time share one request.
-  if (_mcpProfilePresetsLoading) return _mcpProfilePresetsLoading;
-  _mcpProfilePresetsLoading = (async () => {
+export async function fetchToolCatalog(force = false, { cwd = '' } = {}) {
+  const key = String(cwd || '');
+  if (force) invalidateToolCatalog();
+  const epoch = _toolCatalogEpoch;
+  if (!force && _toolCatalogAt.get(key) === epoch && _toolCatalogByCwd.has(key)) { _toolCatalog = _toolCatalogByCwd.get(key); return _toolCatalog; }
+  if (_toolCatalogLoads.has(key)) return _toolCatalogLoads.get(key);
+  const loading = (async () => {
     try {
-      const resp = await fetch('/api/mcp/profile');
+      const resp = await fetch(`/api/mcp/tools${key ? `?cwd=${encodeURIComponent(key)}` : ''}`);
       const data = await resp.json().catch(() => ({}));
-      _mcpProfilePresets = data?.ok && data.presets ? data.presets : {};
-      return _mcpProfilePresets;
-    } catch {
-      return {};
-    } finally {
-      _mcpProfilePresetsLoading = null;
-    }
+      let catalog = resp.ok && data?.ok && Array.isArray(data.groups) ? data : null;
+      if (epoch !== _toolCatalogEpoch) return fetchToolCatalog(false, { cwd: key });
+      if (catalog) { const previous = _toolCatalogByCwd.get(key); if (previous) catalog = Object.assign(previous, catalog); _toolCatalogByCwd.set(key, catalog); _toolCatalogAt.set(key, epoch); _toolCatalog = catalog; }
+      return catalog;
+    } catch { return null; }
+    finally { if (epoch === _toolCatalogEpoch) _toolCatalogLoads.delete(key); }
   })();
-  return _mcpProfilePresetsLoading;
+  _toolCatalogLoads.set(key, loading);
+  return loading;
+}
+
+export function invalidateToolCatalog(change) {
+  _toolCatalogEpoch++; _toolCatalogLoads.clear();
+  if (change?.name && typeof change.enabled === 'boolean') for (const catalog of _toolCatalogByCwd.values()) {
+    const row = catalog.servers?.find(row => row.ref === `mcp:${change.name}`); if (row) row.blocked = !change.enabled;
+  }
+}
+
+export function updateCachedToolDefault(tools) {
+  if (Array.isArray(tools)) for (const catalog of _toolCatalogByCwd.values()) catalog.defaultTools = [...tools];
 }
 
-export function getCachedMcpProfilePresets() {
-  return _mcpProfilePresets || {};
+export function getCachedToolCatalog(cwd) {
+  return cwd === undefined ? _toolCatalog : _toolCatalogByCwd.get(String(cwd || '')) || null;
 }
 
 export function clearRuntimeOptionCaches() {
@@ -662,8 +755,9 @@ export function clearRuntimeOptionCaches() {
   _opencodeModelsCache = null;
   opencodeProviders.invalidate('');
   _claudeModelsCache = null;
+  _antigravityModelsCache = null;
   _modelListAt.clear();
-  _mcpProfilePresets = null;
+  invalidateToolCatalog(); _toolCatalog = null; _toolCatalogByCwd.clear(); _toolCatalogAt.clear();
   _claudeAccountsCache = null;
   _opencodeAgentsCache = null;
 }

package/neural-interface/public/shared/agy/agy-bypass.js

@@ -0,0 +1,47 @@
+// ═══════════════════════════════════════════
+// SynaBun — Antigravity panel: a tab's Bypass (no DOM)
+// ═══════════════════════════════════════════
+//
+// Bypass is a tab's choice, like the Claude Code panel's: off by default, turned on only by the owner in the
+// permissions picker (after one confirm each time), saved with the tab, and stated to the bridge with every session
+// the tab opens (`bypass` on session:new / load / resume) and at once for a running one (session:bypass). The bridge
+// answers each permission request of that session "allow once" itself, except what SynaBun's hard rails refuse
+// (lib/antigravity/bypass.js: the browser policy and the protected folders). A server without the `bypass`
+// capability cannot run it: the pick waits there, shown as unavailable, and the tab asks as before.
+
+export const PERMISSION_DEFAULT = 'default';
+export const PERMISSION_BYPASS = 'bypass';
+
+/** The permissions picker of a tab: its entries, the state the control is styled by and its tooltip. */
+export function bypassControl({ bypass = false, supported = true } = {}, T = (key) => key) {
+  const on = bypass === true;
+  const entries = [
+    { value: PERMISSION_DEFAULT, label: T('permDefault'), title: T('permDefaultHint'), selected: !on },
+    { value: PERMISSION_BYPASS, label: T('permBypass'), title: supported ? T('permBypassHint') : T('permBypassRestart'), selected: on, disabled: !supported && !on },
+  ];
+  if (on && !supported) return { entries, state: 'bypass', waiting: true, title: T('permBypassWaiting') };
+  if (on) return { entries, state: 'bypass', waiting: false, title: T('permBypassOnTitle') };
+  return { entries, state: '', waiting: false, title: supported ? T('permDefaultHint') : T('permBypassRestart') };
+}
+
+/** What a pick in the picker does: { confirm: true } to ask first, { set: boolean } to apply, or null for no change. */
+export function pickPermission(value, { bypass = false, supported = true } = {}) {
+  const want = value === PERMISSION_BYPASS;
+  if (want === (bypass === true)) return null;
+  if (want && !supported) return null;
+  return want ? { confirm: true } : { set: false };
+}
+
+/** A saved tab's Bypass: only a literal true counts (anything else in storage is off). */
+export function restoredBypass(value) {
+  return value === true;
+}
+
+/** A permission:auto event as one transcript row: { severity, text }. */
+export function autoAnswerRow(message, T = (key) => key) {
+  const tool = String(message?.toolCall?.title || message?.toolCall?.kind || T('permTool')).slice(0, 160);
+  if (message?.decision === 'refused') {
+    return { severity: 'error', text: T('permAutoRefused', { tool, reason: String(message.reason || '').slice(0, 400) }) };
+  }
+  return { severity: 'info', text: T('permAutoAllowed', { tool }) };
+}