synabun 2.0.5 → 2.0.9

package/mcp-server/src/services/budget-judgments.ts

@@ -0,0 +1,183 @@
+/**
+ * The SynaBun Assistant's budget split (surface budget-split) — the questions,
+ * not the transport.
+ *
+ * A session has one dollar budget for the assistant's own turns and every
+ * worker run. What is left is divided across the providers (Claude Code,
+ * Codex, OpenCode) so each provider's runs draw from a share. Jev cannot
+ * answer an amount, so each provider gets one Score question over the same
+ * state: how much of the spend still to come will land on it. The questions
+ * cannot see each other's answers; the caller (neural-interface
+ * lib/assistant-budget-split.js) turns the scores into weights, normalises
+ * them, applies the brain's reserve, rounds to cents and makes the shares add
+ * up to exactly what is left.
+ *
+ * Jev only divides money the user already allowed: the total, what was spent
+ * and what is left are facts in the state, never something it sets. It never
+ * picks a model for a task: the questions are about providers' shares of the
+ * spend, and routing stays with the brain and the router.
+ *
+ * Keep the wording of the instructions and levels stable: changing it
+ * invalidates the cache and moves the numbers the split was tuned on (the
+ * caller's SHARE_LEVEL_FRACTIONS map these five levels). Returns null
+ * whenever no judgment is available, including an answer missing for any
+ * provider asked; the caller then uses its deterministic split.
+ */
+
+import { judge, score, readScore, type Answer } from './typesafe.js';
+import { redactCredentials } from './typesafe-config.js';
+import type { JudgeContext } from './memory-judgments.js';
+
+export const BUDGET_PROVIDERS = ['claude-code', 'codex', 'opencode'] as const;
+export type BudgetProvider = typeof BUDGET_PROVIDERS[number];
+const NAMES: Record<BudgetProvider, string> = { 'claude-code': 'Claude Code', codex: 'Codex', opencode: 'OpenCode' };
+/** Question ids (code only; never sent as meaning). */
+const QUESTION_IDS: Record<BudgetProvider, string> = { 'claude-code': 'share_claude_code', codex: 'share_codex', opencode: 'share_opencode' };
+
+/** The ordered levels of every provider's question, lowest first. */
+export const SHARE_LEVELS = [
+  'None of it: no remaining work is likely to run on this provider, or it cannot run anything now.',
+  'A small part: an occasional task, such as one review or a side task, or only cheap work.',
+  'A moderate part: a regular share of the remaining tasks, alongside the other providers.',
+  'A large part: most of the expensive remaining work, such as the main coding tasks.',
+  'Nearly all of it: practically every remaining dollar is spent on this provider.',
+] as const;
+
+export interface BudgetSplitModel { id?: string | null; price?: string | null; billing?: string | null; tier?: string | null }
+export interface BudgetSplitProvider {
+  eligible?: boolean; why?: string | null;
+  spentUsd?: number; brainUsd?: number; runsUsd?: number; shareUsd?: number | null; leftUsd?: number | null;
+  liveRuns?: number; runningRuns?: number; recentUsd?: number | null;
+  account?: { mode?: string | null; usageLeftPercent?: number | null; limited?: boolean | null } | null;
+  models?: BudgetSplitModel[];
+}
+export interface BudgetSplitTask { taskClass?: string | null; summary?: string | null; provider?: string | null; model?: string | null }
+export interface BudgetSplitInput {
+  /** The providers to ask about (eligible ones); the rest get no share. */
+  ask: string[];
+  budget: { amountUsd: number; spentUsd: number; leftUsd: number; warnAtUsd?: number | null };
+  checkpoint?: { reason?: string | null; needs?: string[] } | null;
+  brain?: { provider?: string | null; model?: string | null; price?: string | null; billing?: string | null } | null;
+  routeMode?: string | null;
+  savedRoutes?: Array<{ taskClass?: string | null; provider?: string | null; model?: string | null; effort?: string | null; price?: string | null; billing?: string | null }>;
+  providers?: Partial<Record<string, BudgetSplitProvider>>;
+  tasks?: BudgetSplitTask[];
+  task?: BudgetSplitTask | null;
+}
+
+export interface BudgetShareScore { score: number; confidence: number; probabilities: Record<string, number> | null }
+export interface BudgetSplitJudgment { scores: Partial<Record<BudgetProvider, BudgetShareScore>> }
+
+// State budgets (characters, items).
+const SUMMARY_CLIP = 200;
+const MAX_TASKS = 12;
+const MAX_ROUTES = 16;
+const MAX_MODELS = 4;
+
+const text = (value: unknown) => (typeof value === 'string' ? value : value === null || value === undefined ? '' : String(value));
+/** Credentials out first, then the cut: a secret split by a cut would slip past the patterns. */
+const safe = (value: unknown, max: number) => {
+  const clean = redactCredentials(text(value));
+  return clean.length > max ? `${clean.slice(0, max - 1)}…` : clean;
+};
+const usd = (value: unknown) => (Number.isFinite(Number(value)) ? Math.round(Number(value) * 100) / 100 : null);
+const isProvider = (value: unknown): value is BudgetProvider => typeof value === 'string' && (BUDGET_PROVIDERS as readonly string[]).includes(value);
+const label = (value: unknown) => (isProvider(value) ? value : value ? safe(value, 40) : null);
+
+function taskRow(row: BudgetSplitTask | null | undefined) {
+  if (!row || typeof row !== 'object') return null;
+  return { task_class: row.taskClass ? safe(row.taskClass, 20) : null, summary: row.summary ? safe(row.summary, SUMMARY_CLIP) : null, provider: label(row.provider), model: row.model ? safe(row.model, 80) : null };
+}
+
+/** The state every provider's question reads, bounded and redacted. Amounts in US dollars. */
+export function budgetSplitState(input: BudgetSplitInput): Record<string, unknown> {
+  const budget = input.budget || { amountUsd: 0, spentUsd: 0, leftUsd: 0 };
+  const providers: Record<string, unknown> = {};
+  for (const provider of BUDGET_PROVIDERS) {
+    const row = input.providers?.[provider];
+    if (!row) continue;
+    providers[provider] = {
+      name: NAMES[provider],
+      can_run: row.eligible !== false,
+      why_not: row.eligible === false && row.why ? safe(row.why, 40) : null,
+      spent_usd: usd(row.spentUsd) ?? 0,
+      spent_by_assistant_usd: usd(row.brainUsd) ?? 0,
+      spent_by_workers_usd: usd(row.runsUsd) ?? 0,
+      current_share_usd: usd(row.shareUsd),
+      current_share_left_usd: usd(row.leftUsd),
+      runs_live: Math.max(0, Math.floor(Number(row.liveRuns) || 0)),
+      runs_working_now: Math.max(0, Math.floor(Number(row.runningRuns) || 0)),
+      recent_spend_usd: usd(row.recentUsd),
+      account: row.account ? {
+        billing: row.account.mode ? safe(row.account.mode, 20) : null,
+        usage_left_percent: Number.isFinite(Number(row.account.usageLeftPercent)) ? Math.round(Number(row.account.usageLeftPercent)) : null,
+        limited: typeof row.account.limited === 'boolean' ? row.account.limited : null,
+      } : null,
+      models_routed_here: (Array.isArray(row.models) ? row.models : []).slice(0, MAX_MODELS).map((m) => ({
+        model: m?.id ? safe(m.id, 80) : null, list_price_per_mtok: m?.price ? safe(m.price, 40) : null, billing: m?.billing ? safe(m.billing, 20) : null, tier: m?.tier ? safe(m.tier, 10) : null,
+      })),
+    };
+  }
+  return {
+    session_budget: {
+      total_usd: usd(budget.amountUsd) ?? 0,
+      spent_usd: usd(budget.spentUsd) ?? 0,
+      left_usd: usd(budget.leftUsd) ?? 0,
+      warning_at_usd: usd(budget.warnAtUsd),
+      note: 'Spend is counted at list price for every provider, subscription work included. The budget pays for the assistant\'s own turns and every worker run.',
+    },
+    checkpoint: {
+      reason: input.checkpoint?.reason ? safe(input.checkpoint.reason, 40) : null,
+      providers_short_of_money: (Array.isArray(input.checkpoint?.needs) ? input.checkpoint!.needs : []).filter(isProvider),
+    },
+    assistant: input.brain ? {
+      runs_on: label(input.brain.provider), model: input.brain.model ? safe(input.brain.model, 80) : null,
+      list_price_per_mtok: input.brain.price ? safe(input.brain.price, 40) : null, billing: input.brain.billing ? safe(input.brain.billing, 20) : null,
+    } : null,
+    route_mode: input.routeMode ? safe(input.routeMode, 20) : null,
+    saved_routes: (Array.isArray(input.savedRoutes) ? input.savedRoutes : []).slice(0, MAX_ROUTES).map((r) => ({
+      task_class: r?.taskClass ? safe(r.taskClass, 20) : null, provider: label(r?.provider), model: r?.model ? safe(r.model, 80) : null,
+      list_price_per_mtok: r?.price ? safe(r.price, 40) : null, billing: r?.billing ? safe(r.billing, 20) : null,
+    })),
+    providers,
+    session_tasks_so_far: (Array.isArray(input.tasks) ? input.tasks : []).slice(-MAX_TASKS).map(taskRow).filter(Boolean),
+    task_being_routed_now: taskRow(input.task),
+  };
+}
+
+const shareQuestion = (provider: BudgetProvider) => score(
+  'An AI assistant session has a dollar budget (`session_budget`). It pays for the assistant\'s own turns (the assistant runs on `assistant.runs_on`) ' +
+  'and for worker runs on three providers (`providers`). `saved_routes` say which provider each kind of task is sent to, `session_tasks_so_far` are the tasks routed so far, ' +
+  '`task_being_routed_now` is the task being routed at this moment, and `checkpoint` says why the budget is being divided again. ' +
+  `Of the money still to be spent in this session (\`session_budget.left_usd\`), how much will go to work on ${NAMES[provider]} (\`providers.${provider}\`): its worker runs, ` +
+  `plus the assistant's own turns when \`assistant.runs_on\` is ${provider}? Judge from the tasks likely to come next, where the saved routes send them, the runs still working, and what the models cost.`,
+  [...SHARE_LEVELS],
+);
+
+function probabilitiesOf(answer: Answer | undefined): Record<string, number> | null {
+  if (answer?.type !== 'score' || !answer.probabilities || typeof answer.probabilities !== 'object') return null;
+  const out: Record<string, number> = {};
+  for (const [key, value] of Object.entries(answer.probabilities)) if (Number.isFinite(Number(value))) out[key] = Number(value);
+  return Object.keys(out).length ? out : null;
+}
+
+/**
+ * One request: a Score for each provider in `input.ask`. All or nothing: a
+ * missing or wrong-typed answer for any provider asked is no judgment (null).
+ */
+export async function judgeBudgetSplit(input: BudgetSplitInput, options: JudgeContext = {}): Promise<BudgetSplitJudgment | null> {
+  const ask = [...new Set((Array.isArray(input?.ask) ? input.ask : []).filter(isProvider))];
+  if (!ask.length) return null;
+  const questions: Record<string, ReturnType<typeof score>> = {};
+  for (const provider of ask) questions[QUESTION_IDS[provider]] = shareQuestion(provider);
+  const answers = await judge(budgetSplitState(input), questions, { ...options, surface: 'budget-split' });
+  if (!answers) return null;
+  const scores: BudgetSplitJudgment['scores'] = {};
+  for (const provider of ask) {
+    const answer = answers[QUESTION_IDS[provider]];
+    const read = readScore(answer);
+    if (!read) return null;
+    scores[provider] = { score: read.score, confidence: read.confidence, probabilities: probabilitiesOf(answer) };
+  }
+  return { scores };
+}

package/mcp-server/src/services/categories.ts

@@ -166,39 +166,12 @@ function saveCategoriesToDisk(categories: CustomCategory[]): void {
   });
 }
 
-/**
- * Built-in categories that must always exist (created if missing on startup).
- * youtube-videos is the trailer dedup ledger that youtube_upload writes and
- * youtube_source reads — pre-seeding it means manual remember / the UI / routing
- * all see it, not just the validation-bypassing auto-record path.
- */
-const BUILTIN_CATEGORIES: Array<{ name: string; description: string; parent?: string }> = [
-  {
-    name: 'youtube-videos',
-    description: 'One memory per uploaded YouTube trailer — the dedup ledger. Written automatically by youtube_upload; tagged with canonical source ids (igdb:/appid:/ytid:/name:) that youtube_source reads to skip already-posted trailers. Do not store anything else here.',
-    parent: 'social',
-  },
-];
-
-/** Append any missing built-in categories and persist. Idempotent. */
-function ensureBuiltinCategories(): void {
-  const cats = loadCategoriesFromDisk();
-  const have = new Set(cats.map((c) => c.name));
-  let changed = false;
-  for (const b of BUILTIN_CATEGORIES) {
-    if (have.has(b.name)) continue;
-    const cat: CustomCategory = { name: b.name, description: b.description, created_at: new Date().toISOString() };
-    if (b.parent && have.has(b.parent)) cat.parent = b.parent; // only attach the parent if it exists
-    cats.push(cat);
-    changed = true;
-  }
-  if (changed) saveCategoriesToDisk(cats);
-}
-
 /**
  * Initialize the local category cache for the active connection.
- * Seeds the cache file from SQLite (source of truth) or empty, then ensures the
- * built-in categories exist — even when the cache file already existed.
+ * Seeds the cache file from SQLite (source of truth), or empty when the DB has none.
+ * No category is created here: a fresh install has none. A project's defaults are
+ * made when the project is added, a feature's category the first time it saves
+ * (ensureCategory / ensureFeatureCategory).
  */
 export async function initCategoryCache(): Promise<void> {
   const filePath = getCategoriesPath();
@@ -214,10 +187,82 @@ export async function initCategoryCache(): Promise<void> {
     fs.writeFileSync(filePath, JSON.stringify(data, null, 2), 'utf-8');
   }
 
-  ensureBuiltinCategories();
   invalidateCategoryCache();
 }
 
+/**
+ * Categories that features save into by name. None exists on a fresh install:
+ * each is created the first time something is stored in it (ensureFeatureCategory),
+ * whether the writer is SynaBun itself or a model told to use that name by a hook.
+ * Keep the descriptions in step with hooks/claude-code/shared.mjs FEATURE_CATEGORIES.
+ */
+export const FEATURE_CATEGORIES: Record<string, { description: string; is_parent?: boolean }> = {
+  conversations: {
+    description: 'Indexed conversation sessions with compacted summaries for cross-session recall: session metadata (date, branch, session id) and topic summaries, so past conversations can be found by asking for them.',
+  },
+  'communication-style': {
+    description: 'How the user communicates and works: patterns in how they give instructions, correct, decide and signal frustration, and their stated preferences.',
+  },
+  plans: {
+    description: 'Implementation plans stored after plan mode approval, one child category per project.',
+    is_parent: true,
+  },
+  uncategorized: {
+    description: 'Fallback for memories stored without a category.',
+  },
+  ideas: {
+    description: 'Brainstormed features, experiments, and creative explorations (the /synabun idea skill).',
+  },
+  schedules: {
+    description: 'One memory per schedule created from a conversation (the /synabun schedule skill): name, template, schedule id, cron, group, profile and model.',
+  },
+  'youtube-videos': {
+    description: 'One memory per uploaded YouTube trailer — the dedup ledger. Written automatically by youtube_upload; tagged with canonical source ids (igdb:/appid:/ytid:/name:) that youtube_source reads to skip already-posted trailers. Do not store anything else here.',
+  },
+};
+
+/**
+ * Create a category the first time something saves into it. Idempotent: an existing
+ * category is left exactly as it is. The parent is attached only when it already
+ * exists. Returns true when the category exists afterwards.
+ */
+export function ensureCategory(name: string, description: string, options: { parent?: string; is_parent?: boolean } = {}): boolean {
+  try {
+    if (categoryExists(name)) return true;
+    const parent = options.parent && categoryExists(options.parent) ? options.parent : undefined;
+    addCategory(name, description, parent, undefined, options.is_parent && !parent);
+    return true;
+  } catch (err) {
+    console.error(`Failed to create category "${name}":`, err instanceof Error ? err.message : err);
+    return categoryExists(name);
+  }
+}
+
+/**
+ * ensureCategory for a name of FEATURE_CATEGORIES, or a project's plan category
+ * `plans-<project>` (made under "plans", as hooks/claude-code/post-plan.mjs does);
+ * false for any other name.
+ */
+export function ensureFeatureCategory(name: string): boolean {
+  const feature = Object.prototype.hasOwnProperty.call(FEATURE_CATEGORIES, name) ? FEATURE_CATEGORIES[name] : null;
+  if (feature) return ensureCategory(name, feature.description, { is_parent: feature.is_parent });
+  if (/^plans-[a-z0-9][a-z0-9-]*$/.test(name) && name.length <= MAX_LENGTH && ensureFeatureCategory('plans')) {
+    return ensureCategory(name, `Implementation plans for ${name.slice('plans-'.length)} project`, { parent: 'plans' });
+  }
+  return false;
+}
+
+/**
+ * The name of a project's default parent category, as the project's defaults
+ * are created (hooks/claude-code/shared.mjs projectCategoryLabel): the label
+ * normalized and cut to 16 characters, so `<label>-architecture` stays within 30.
+ */
+export function projectCategoryLabel(project: string): string {
+  let label = String(project || '').toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '');
+  if (label.length > 16) label = label.slice(0, 16).replace(/-$/, '');
+  return label || 'global';
+}
+
 /**
  * Call after a connection switch to re-point the file watcher
  * at the new connection's category file and sync from database if needed.

package/mcp-server/src/services/codex-config-heal.ts

@@ -7,8 +7,9 @@
  * Having both forms defines the same TOML key twice, so Codex rejects the
  * configuration and starts with defaults.
  *
- * This module deliberately edits only the SynaBun MCP tables. All unrelated
- * Codex configuration is left byte-for-byte intact. File writes are atomic,
+ * This module edits the SynaBun MCP tables and the known ignored feature keys
+ * emitted by its old Settings writer. All unrelated configuration is left
+ * byte-for-byte intact. Repairs keep a backup; file writes are atomic,
  * preserve the original mode, and are idempotent.
  */
 import {
@@ -56,6 +57,7 @@ export interface CodexMcpDefinition {
 }
 
 export type HealReason =
+  | 'removed_ignored_settings'
   | 'removed_duplicate_inline_env'
   | 'normalized_inline_env'
   | 'removed_managed_profile_override'
@@ -364,15 +366,20 @@ export function healCodexConfig(configPath: string): HealResult {
   }
 
   const before = inspectCodexConfigContent(content);
-  if (!before.connected && !before.issues.length) {
+  const cleaned = removeIgnoredCodexSettings(content);
+  if (cleaned === content && !before.connected && !before.issues.length) {
     return { healed: false, reason: 'no_synabun_section' };
   }
-  const repaired = repairCodexConfigContent(content);
+  const repaired = repairCodexConfigContent(cleaned);
+  if (cleaned !== content) repaired.reason = 'removed_ignored_settings';
   if (!repaired.reason || repaired.content === content) {
     return { healed: false, reason: 'no_duplicate', inspection: before };
   }
 
   try {
+    // Keep the exact original, including unrelated tables and its permissions.
+    const backup = `${configPath}.synabun-backup-${Date.now()}-${process.pid}`;
+    copyFileSync(configPath, backup);
     atomicWrite(configPath, repaired.content);
   } catch (err) {
     return { healed: false, reason: 'write_error', error: err instanceof Error ? err.message : String(err) };
@@ -384,6 +391,30 @@ export function healCodexConfig(configPath: string): HealResult {
   };
 }
 
+/** Narrow repair for keys emitted by the old Settings writer. These literal
+ * dotted keys are ignored by Codex; personality's feature flag is removed.
+ * Do not sweep arbitrary user flags or normalize unrelated TOML. */
+export function removeIgnoredCodexSettings(content: string): string {
+  let section = '';
+  let multiline: string | null = null;
+  return content.split(/(?<=\n)/).filter(line => {
+    // Avoid treating text inside TOML multiline strings as configuration.
+    const delimiters = line.match(/"""|'''/g) || [];
+    if (multiline) {
+      if (delimiters.filter(d => d === multiline).length % 2) multiline = null;
+      return true;
+    }
+    for (const delimiter of delimiters) if (delimiters.filter(d => d === delimiter).length % 2) multiline = delimiter;
+    const header = /^\s*\[([^\]]+)\]\s*(?:#.*)?$/.exec(line.trim());
+    if (header) section = header[1].replace(/["']/g, '').trim();
+    else if (/^\s*\[/.test(line)) section = '__other_table__';
+    if (!section && /^\s*["']features\.(?:personality|fast_mode|apps|unified_exec)["']\s*=\s*(?:true|false)\s*(?:#.*)?$/.test(line.trim())) return false;
+    if ((!section && /^\s*features\.personality\s*=\s*(?:true|false)\s*(?:#.*)?$/.test(line.trim()))
+      || (section === 'features' && /^\s*(?:personality|"personality"|'personality')\s*=\s*(?:true|false)\s*(?:#.*)?$/.test(line.trim()))) return false;
+    return true;
+  }).join('');
+}
+
 export function upsertCodexMcpConfig(configPath: string, definition: CodexMcpDefinition): CodexConfigInspection {
   let content = '';
   if (existsSync(configPath)) content = readFileSync(configPath, 'utf-8');

package/mcp-server/src/services/desktop-bench.ts

@@ -16,7 +16,7 @@
 import { readdirSync, readFileSync } from 'node:fs';
 import path from 'node:path';
 import { performance } from 'node:perf_hooks';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 import type { JudgeUsage } from './typesafe.js';
 import { typesafeConfig, mutateTypeSafeConfig, type TypeSafeConfig } from './typesafe-config.js';
 import { hashCorpusFiles, isPinnedModel } from './browser-assist-gate.js';

package/mcp-server/src/services/identity.ts

@@ -173,6 +173,33 @@ export function callerDesktopGrant(): string | null {
   return sanitizeDesktopGrant(process.env.SYNABUN_DESKTOP_GRANT);
 }
 
+/** WhatsApp brain credentials look exactly like the ones the Neural Interface mints (assistant-runtime.js mintBrainCredential). */
+export function sanitizeBrainCredential(v: string | undefined | null): string | null {
+  return typeof v === 'string' && /^sbb_[A-Za-z0-9_-]{43}$/.test(v.trim()) ? v.trim() : null;
+}
+
+// The brain credential of the request being handled (whatsapp_send_file). Its own context per HTTP
+// request, never a field of the CallerIdentity: identities are shared by every request that names the
+// same X-Synabun-Terminal pin (not a secret), so a credential kept there could be read by a concurrent
+// request that only forged the pin.
+const credentialAls = new AsyncLocalStorage<string | null>();
+
+/** Run `fn` with this request's brain credential (http.ts, around every transport.handleRequest). */
+export function runWithBrainCredential<T>(credential: string | null, fn: () => T): T {
+  return credentialAls.run(credential, fn);
+}
+
+/**
+ * The WhatsApp brain credential of the current caller (whatsapp_send_file sends it on its one request
+ * and nowhere else): the request's own header over HTTP (X-Synabun-Brain-Token, the Claude brain),
+ * SYNABUN_BRAIN_TOKEN for stdio children (the Codex and OpenCode brains). Never the host process's
+ * env for an HTTP caller.
+ */
+export function callerBrainCredential(): string | null {
+  if (httpMode) return credentialAls.getStore() ?? null;
+  return sanitizeBrainCredential(process.env.SYNABUN_BRAIN_TOKEN);
+}
+
 /**
  * Role of the current caller: the ALS identity's role over HTTP (derived from
  * X-Synabun-Role on every request), or SYNABUN_ROLE for stdio children —

package/mcp-server/src/services/neural-interface.ts

@@ -132,7 +132,8 @@ async function requestOnce(
   method: string,
   path: string,
   body?: Record<string, unknown>,
-  timeout = DEFAULT_TIMEOUT
+  timeout = DEFAULT_TIMEOUT,
+  extraHeaders: Record<string, string> = {},
 ): Promise<NiResponse> {
   const cancellation = browserCancellation.getStore();
   const callerSignal = cancellation?.signal;
@@ -166,6 +167,8 @@ async function requestOnce(
     headers['X-Synabun-Deadline'] = String(deadline);
     // Lets the server refuse advisory payloads and auto-heal for a batch step on its own authority.
     if (batchContext.getStore()) headers['X-Synabun-Batch'] = '1';
+    // One request's own headers (whatsappSendFile's brain credential): never sent on any other request.
+    for (const [name, value] of Object.entries(extraHeaders)) if (value) headers[name] = value;
     const opts: RequestInit = {
       method,
       headers,
@@ -199,7 +202,9 @@ async function requestOnce(
     if (controller.signal.aborted || /abort/i.test(msg)) {
       return { error: `Request timed out after ${timeout}ms; outcome may be uncertain. Inspect the page before retrying.`, code: 'REQUEST_TIMEOUT', outcome: 'uncertain' };
     }
-    return { error: `Neural Interface unreachable: ${msg}. Is the Neural Interface server running?`, code: 'TRANSPORT_ERROR', outcome: 'uncertain' };
+    // The system's own code for it (fetch puts it on `cause`): ECONNREFUSED means the request never left.
+    const cause = (err as { cause?: { code?: unknown }; code?: unknown } | null)?.cause?.code ?? (err as { code?: unknown } | null)?.code ?? /\b(E[A-Z_]{3,})\b/.exec(msg)?.[1];
+    return { error: `Neural Interface unreachable: ${msg}. Is the Neural Interface server running?`, code: 'TRANSPORT_ERROR', outcome: 'uncertain', ...(typeof cause === 'string' ? { transportCode: cause } : {}) };
   } finally {
     clearTimeout(timer);
     callerSignal?.removeEventListener('abort', cancel);
@@ -1486,3 +1491,30 @@ export async function assistantKillAll(body: { assistantSessionId?: string; work
 export async function assistantFocus(runId: string, focus: boolean): Promise<NiResponse> {
   return request('POST', assistantRunPath(runId, '/focus'), { focus });
 }
+
+// whatsapp_send_file: the server's own deadline for the send is 120 s (lib/whatsapp/manager.js); this
+// one outlives it so a server timeout is reported as the server's.
+const WHATSAPP_SEND_FILE_TIMEOUT = 130_000;
+export const WHATSAPP_SEND_FILE_UNCERTAIN = 'SynaBun did not answer in time: the file may or may not have arrived. Do not send it again unless the user asks.';
+export const WHATSAPP_SEND_FILE_LOST = 'SynaBun\'s answer was lost: the file may or may not have arrived. Do not send it again unless the user asks.';
+// The request never reached SynaBun (nothing listens, no route to it): nothing was sent, for certain.
+const WHATSAPP_SEND_FILE_NEVER_LEFT = new Set(['ECONNREFUSED', 'ENOTFOUND', 'EAI_AGAIN', 'EHOSTUNREACH', 'ENETUNREACH', 'EADDRNOTAVAIL']);
+
+/**
+ * whatsapp_send_file → POST /api/assistant/whatsapp/send-file: exactly one request (requestOnce, no
+ * retry of any kind), because a timeout may come after WhatsApp took the file. `credential` (the
+ * WhatsApp brain's own, identity.ts callerBrainCredential) rides on this request alone; without it
+ * the server refuses (403).
+ */
+export async function whatsappSendFile(body: { path: string; caption?: string; as?: string }, credential: string | null): Promise<NiResponse> {
+  const result = await requestOnce('POST', '/api/assistant/whatsapp/send-file', body as Record<string, unknown>, WHATSAPP_SEND_FILE_TIMEOUT,
+    credential ? { 'X-Synabun-Brain-Token': credential } : {});
+  if (result.code === 'REQUEST_TIMEOUT') return { ok: false, code: 'TIMEOUT', uncertain: true, error: WHATSAPP_SEND_FILE_UNCERTAIN };
+  // Any other failure of the transport after the request left (a reset socket, an answer that is not JSON) may
+  // come after WhatsApp took the file: as uncertain as a timeout, never "is the server running?".
+  if (result.code === 'TRANSPORT_ERROR') {
+    if (WHATSAPP_SEND_FILE_NEVER_LEFT.has(String(result.transportCode))) return { ok: false, code: 'UNREACHABLE', error: 'SynaBun is not reachable (is it running?): nothing was sent.' };
+    return { ok: false, code: 'TRANSPORT_ERROR', uncertain: true, error: WHATSAPP_SEND_FILE_LOST };
+  }
+  return result;
+}

package/mcp-server/src/services/typesafe-config.ts

@@ -31,7 +31,7 @@ export const SURFACES = [
   'browser-page-state', 'browser-target', 'browser-social',
   'task-boundary', 'session-lookup', 'user-learning', 'claim-check',
   'edit-stale', 'supersession', 'compact-digest', 'plan-conflict',
-  'worker-outcome', 'worker-claim', 'desktop-target',
+  'worker-outcome', 'worker-claim', 'desktop-target', 'budget-split',
 ] as const;
 export type SurfaceName = typeof SURFACES[number];
 
@@ -94,6 +94,7 @@ export const SURFACE_META: Record<SurfaceName, SurfaceMeta> = {
   'worker-outcome': { label: 'Worker outcome', description: 'Assistant workers: reads done / blocked / needs input from a final message that has no ## Result block (instead of spending a retry turn), and what kept a failed or blocked run from finishing (capability, access, needs the user, transient), which decides whether escalation is offered.', fallback: 'one result-retry worker turn; every failed, blocked or result-less run offers a one-tier escalation' },
   'worker-claim': { label: 'Worker claim', description: 'Assistant workers: whether a run reported done while claiming success (tests pass, fixed, verified) that its own command output does not show. Flags the run so the Assistant verifies before reporting; asked only when the turn exposed commands or tool results.', fallback: 'no check', ridesWith: 'worker-outcome' },
   'desktop-target': { label: 'Desktop target', description: 'Computer use: ranks the visible controls of the front window against a computer_ax intent. Advisory; one low-risk press by intent only behind the desktop benchmark gate.', fallback: 'the full accessibility tree, or a word-overlap ranking when an intent is given' },
+  'budget-split': { label: 'Budget split', description: 'Assistant sessions with a budget: how much of the money still to be spent will land on each provider (Claude Code, Codex, OpenCode), asked at the first route and at checkpoints (a share used up, a budget change, a run ending). It only divides what the user allowed: shares never add up to more than is left, and it never picks a model.', fallback: 'weights from the saved routes, the session\'s tasks and live runs, times the list price of the routed models; the brain keeps its reserve either way' },
 };
 
 const SURFACE_DEFAULTS: Record<SurfaceName, SurfaceSettings> = {
@@ -132,6 +133,8 @@ const SURFACE_DEFAULTS: Record<SurfaceName, SurfaceSettings> = {
   // Rider of worker-outcome. Flags a run for verification, so the bar is the claim-check bar.
   'worker-claim': { enabled: true, timeoutMs: 2500, minProbability: 0.9 },
   'desktop-target': { ...DESKTOP_TARGET_DEFAULTS },
+  // On the route path (agent_route waits for the first split), never per tick: one call per checkpoint.
+  'budget-split': { enabled: true, timeoutMs: 2000 },
 };
 
 // --- Config shape ---