synabun 2.0.5 → 2.0.9

package/neural-interface/lib/git-bash/resolver.js

@@ -0,0 +1,194 @@
+// ═══════════════════════════════════════════
+// SynaBun — Git Bash: which one Claude Code runs
+// ═══════════════════════════════════════════
+//
+// Claude Code on Windows looks for Git Bash itself, in this order (read from
+// its 2.1.302 build): CLAUDE_CODE_GIT_BASH_PATH when it names an existing
+// bash.exe / sh.exe (the `env` block of ~/.claude/settings.json is applied
+// before it looks, so a value there counts the same), then
+// C:\Program Files\Git\bin\bash.exe and C:\Program Files (x86)\Git\bin\bash.exe,
+// then the first `git` on its PATH, two folders up, bin\bash.exe. Without one,
+// its Bash tool is gone and every hook runs in PowerShell.
+//
+// resolveGitBash() answers which Git Bash a Claude Code started by SynaBun ends
+// up with, and whether SynaBun has to name it:
+//
+//   env / settings  CLAUDE_CODE_GIT_BASH_PATH of SynaBun's own environment, or
+//                   of the user's ~/.claude/settings.json: the user's choice,
+//                   which Claude Code reads by itself
+//   system          a Git Bash of the PC's own. When Claude Code finds it by
+//                   its own rules nothing is passed (SynaBun never overrides
+//                   what already works); one only SynaBun finds (git on PATH
+//                   in a layout Claude Code does not walk, a per-user or Scoop
+//                   install that is not on PATH) is passed to it
+//   bundled         SynaBun's copy inside an installed app (<resources>\git)
+//   downloaded      SynaBun's copy in the data home (a Windows npm install)
+//
+// A path inside SynaBun's own copies is never taken for the user's, whatever
+// variable or PATH entry leads to it (a server started from a SynaBun terminal
+// inherits both): it is found again as SynaBun's own, last. Every file system
+// question is injectable, so the Windows rules are tested from any system.
+
+import { statSync } from 'node:fs';
+import { win32 } from 'node:path';
+
+/** The variable Claude Code reads (and the settings `env` key SynaBun writes for the user's own CLI). */
+export const GIT_BASH_ENV = 'CLAUDE_CODE_GIT_BASH_PATH';
+
+/** The file names Claude Code accepts in CLAUDE_CODE_GIT_BASH_PATH. */
+const BASH_NAMES = new Set(['bash.exe', 'sh.exe', 'bash', 'sh']);
+
+/** Where Claude Code looks before PATH: these two, literally. */
+export const CLAUDE_FIXED_BASH = Object.freeze(['C:\\Program Files\\Git\\bin\\bash.exe', 'C:\\Program Files (x86)\\Git\\bin\\bash.exe']);
+
+const key = (path) => win32.normalize(String(path || '')).replace(/[\\/]+$/, '').toLowerCase();
+
+const defaultIsFile = (path) => { try { return statSync(path).isFile(); } catch { return false; } };
+
+/** Is `path` inside one of `roots` (or one of them)? Windows rules: case and slashes do not matter. */
+export function insideAny(path, roots) {
+  const at = key(path);
+  return roots.filter(Boolean).some((root) => { const top = key(root); return at === top || at.startsWith(`${top}\\`); });
+}
+
+/** A value of CLAUDE_CODE_GIT_BASH_PATH that Claude Code would take: a bash.exe / sh.exe that exists. */
+export function acceptableBashPath(value, { isFile = defaultIsFile } = {}) {
+  const path = String(value || '').trim();
+  if (!path || !BASH_NAMES.has(win32.basename(path).toLowerCase())) return false;
+  return isFile(path);
+}
+
+/** The PATH folders, in order, `%VARS%` of an unexpanded entry left as they are (they name no git either way). */
+function pathFolders(pathValue) {
+  return String(pathValue || '').split(';').map((entry) => entry.trim().replace(/^"(.*)"$/, '$1')).filter(Boolean);
+}
+
+/** The first git on `pathValue`, as Windows finds it (git.exe, then git.cmd), skipping SynaBun's own folders. */
+export function firstGitOnPath(pathValue, { isFile = defaultIsFile, own = [] } = {}) {
+  for (const folder of pathFolders(pathValue)) {
+    for (const name of ['git.exe', 'git.cmd']) {
+      const file = win32.join(folder, name);
+      if (!isFile(file)) continue;
+      if (insideAny(file, own)) continue;
+      return file;
+    }
+  }
+  return null;
+}
+
+/** The Git Bash a git found on PATH belongs to: Claude Code's own rule first (git\..\..\bin), then one more level up. */
+export function bashOfGit(gitFile, { isFile = defaultIsFile } = {}) {
+  if (!gitFile) return null;
+  const folder = win32.dirname(gitFile);
+  for (const candidate of [win32.join(folder, '..', 'bin', 'bash.exe'), win32.join(folder, '..', '..', 'bin', 'bash.exe')]) {
+    if (isFile(candidate)) return win32.normalize(candidate);
+  }
+  return null;
+}
+
+/** The folders Git for Windows is installed in when nothing names it: every installer's default, per machine and per user, and Scoop's. */
+export function standardGitRoots(env = {}) {
+  const roots = [];
+  const add = (base, ...rest) => { if (base) roots.push(win32.join(base, ...rest)); };
+  add(env.ProgramFiles || env.PROGRAMFILES, 'Git');
+  add(env.ProgramW6432, 'Git');
+  add(env['ProgramFiles(x86)'] || env['PROGRAMFILES(X86)'], 'Git');
+  roots.push('C:\\Program Files\\Git', 'C:\\Program Files (x86)\\Git');
+  add(env.LOCALAPPDATA, 'Programs', 'Git');
+  add(env.SCOOP, 'apps', 'git', 'current');
+  add(env.USERPROFILE, 'scoop', 'apps', 'git', 'current');
+  const seen = new Set();
+  return roots.filter((root) => { const id = key(root); if (seen.has(id)) return false; seen.add(id); return true; });
+}
+
+/**
+ * What Claude Code finds by itself, by its own rules, or null: its variable (from SynaBun's environment, then the
+ * user's settings), its two fixed places, the first git on PATH. `{ path, source }`.
+ */
+export function claudeCodeFinds({ env = {}, settingsValue = null, pathValue = '', isFile = defaultIsFile, own = [] } = {}) {
+  const fromEnv = env[GIT_BASH_ENV];
+  if (fromEnv && !insideAny(fromEnv, own) && acceptableBashPath(fromEnv, { isFile })) return { path: win32.normalize(fromEnv), source: 'env' };
+  if (settingsValue && !insideAny(settingsValue, own) && acceptableBashPath(settingsValue, { isFile })) return { path: win32.normalize(settingsValue), source: 'settings' };
+  for (const fixed of CLAUDE_FIXED_BASH) if (isFile(fixed)) return { path: fixed, source: 'system' };
+  const git = firstGitOnPath(pathValue, { isFile, own });
+  if (git) {
+    const bash = win32.normalize(win32.join(win32.dirname(git), '..', 'bin', 'bash.exe'));
+    if (isFile(bash) && !insideAny(bash, own)) return { path: bash, source: 'system' };
+  }
+  return null;
+}
+
+/** The cmd folder (with its git.exe) of the Git for Windows a bin\bash.exe belongs to, or null. */
+export function gitOfBash(bashPath, { isFile = defaultIsFile } = {}) {
+  if (!bashPath || win32.basename(win32.dirname(bashPath)).toLowerCase() !== 'bin') return null;
+  const root = win32.dirname(win32.dirname(bashPath));
+  const git = win32.join(root, 'cmd', 'git.exe');
+  return isFile(git) ? { git, cmdDir: win32.dirname(git) } : null;
+}
+
+/**
+ * Which Git Bash a Claude Code started by SynaBun ends up with, and what SynaBun has to give it.
+ *
+ * @param {object} o
+ * @param {string} [o.platform]
+ * @param {object} [o.env]            SynaBun's environment (CLAUDE_CODE_GIT_BASH_PATH, the folders above)
+ * @param {string|null} [o.settingsValue]  env.CLAUDE_CODE_GIT_BASH_PATH of the user's ~/.claude/settings.json
+ * @param {string} [o.pathValue]      the PATH a git is looked for on (this process's, then the OS PATH)
+ * @param {Array<{ source: 'bundled' | 'downloaded', root: string, ok: boolean, bash: string, git: string }>} [o.copies]
+ *                                    SynaBun's own copies, already checked (manager.js), in this order
+ * @param {string[]} [o.ownRoots]     SynaBun's own Git folders: nothing inside them is the user's
+ * @returns {{ supported: boolean, path: string|null, source: string|null, passToClaude: boolean, git: string|null, cmdDir: string|null, claudeFindsItself: boolean }}
+ */
+export function resolveGitBash({ platform = process.platform, env = process.env, settingsValue = null, pathValue = '', copies = [], ownRoots = [], isFile = defaultIsFile } = {}) {
+  const none = { supported: platform === 'win32', path: null, source: null, passToClaude: false, git: null, cmdDir: null, claudeFindsItself: false };
+  if (platform !== 'win32') return none;
+  const own = ownRoots.filter(Boolean);
+
+  // 1. What Claude Code finds by itself: nothing is passed, nothing downloaded.
+  const found = claudeCodeFinds({ env, settingsValue, pathValue, isFile, own });
+  if (found) {
+    const git = found.source === 'system' ? gitOfBash(found.path, { isFile }) : null;
+    return { ...none, path: found.path, source: found.source, git: git?.git || null, cmdDir: git?.cmdDir || null, claudeFindsItself: true };
+  }
+
+  // 2. A Git Bash of the PC that only SynaBun finds: named to Claude Code.
+  const candidates = [];
+  const onPath = firstGitOnPath(pathValue, { isFile, own });
+  const derived = bashOfGit(onPath, { isFile });
+  if (derived) candidates.push(derived);
+  for (const root of standardGitRoots(env)) candidates.push(win32.join(root, 'bin', 'bash.exe'));
+  for (const candidate of candidates) {
+    if (insideAny(candidate, own) || !isFile(candidate)) continue;
+    const git = gitOfBash(candidate, { isFile });
+    return { ...none, path: candidate, source: 'system', passToClaude: true, git: git?.git || null, cmdDir: git?.cmdDir || null };
+  }
+
+  // 3. SynaBun's own copy: the one inside the app, then the one in the data home.
+  for (const copy of copies) {
+    if (!copy?.ok) continue;
+    return { ...none, path: copy.bash, source: copy.source, passToClaude: true, git: copy.git, cmdDir: win32.dirname(copy.git) };
+  }
+  return none;
+}
+
+/** `env` with PATH (whatever its spelling: Windows keeps one, under the first name) ending in `folder`, once. */
+function appendToPath(env, folder) {
+  const keys = Object.keys(env).filter((name) => name.toUpperCase() === 'PATH');
+  const name = keys[0] || 'Path';
+  const parts = String(env[name] || '').split(';').filter(Boolean);
+  const out = { ...env };
+  for (const each of keys) delete out[each];
+  out[name] = [...parts.filter((part) => key(part) !== key(folder)), folder].join(';');
+  return out;
+}
+
+/**
+ * The environment of a Claude Code process SynaBun starts: `env` itself, unless SynaBun has to name its Git Bash
+ * (its own copy, or one only it finds): then CLAUDE_CODE_GIT_BASH_PATH, and that Git's cmd folder at the end of
+ * PATH (Claude Code's own git commands find git there). The system's PATH and registry are never changed.
+ */
+export function gitBashChildEnv(env, resolution, { platform = process.platform } = {}) {
+  if (platform !== 'win32' || !resolution?.passToClaude || !resolution.path) return env;
+  const out = { ...env, [GIT_BASH_ENV]: resolution.path };
+  return resolution.cmdDir ? appendToPath(out, resolution.cmdDir) : out;
+}

package/neural-interface/lib/git-read.js

@@ -56,9 +56,15 @@
 //
 // Writes are not run through here: a commit by the owner runs the
 // repository's hooks, and that is what a commit does.
+//
+// On a Windows PC without git, SynaBun's own copy of Git for Windows
+// (lib/git-bash/) is the git of every read: its folder is put at the end of
+// the read's PATH (setGitFallbackFolder, withGitFallback, which the commit
+// routes use too). Nothing changes where the computer has a git of its own.
 
 import { execFile, spawnSync } from 'node:child_process';
 import { devNull } from 'node:os';
+import { delimiter } from 'node:path';
 
 /** What the environment of a read adds. */
 export const GIT_READ_ENV = Object.freeze({
@@ -78,9 +84,35 @@ const PROBE_TIMEOUT_MS = 3000;
 export const MONITOR_MEMO_MS = 10_000;
 const MONITOR_MEMO_MAX = 200;
 
-/** The environment a read is run in: `env` and what a read adds to it. */
+let fallbackFolder = () => null;
+
+/**
+ * Where SynaBun's own git is on a computer that has none (Windows: the cmd folder of SynaBun's copy of Git for
+ * Windows, lib/git-bash/manager.js), as a function asked at every start; null while git is the computer's own.
+ * The folder goes at the end of PATH, so a git of the computer's, installed meanwhile, still comes first.
+ */
+export function setGitFallbackFolder(folder) {
+  fallbackFolder = typeof folder === 'function' ? folder : () => null;
+}
+
+/** `env` with the fallback folder at the end of its PATH (whatever its spelling), or `env` itself without one. */
+export function withGitFallback(env = process.env) {
+  let folder = null;
+  try { folder = fallbackFolder(); } catch { folder = null; }
+  if (!folder) return env;
+  const keys = Object.keys(env).filter((name) => name.toUpperCase() === 'PATH');
+  const name = keys[0] || (process.platform === 'win32' ? 'Path' : 'PATH');
+  const parts = String(env[name] || '').split(delimiter).filter(Boolean);
+  if (parts.some((part) => part.toLowerCase() === folder.toLowerCase())) return env;
+  const out = { ...env };
+  for (const each of keys) delete out[each];
+  out[name] = [...parts, folder].join(delimiter);
+  return out;
+}
+
+/** The environment a read is run in: `env` and what a read adds to it (and SynaBun's git, where the computer has none). */
 export function gitReadEnv(env = process.env) {
-  return { ...env, ...GIT_READ_ENV };
+  return withGitFallback({ ...env, ...GIT_READ_ENV });
 }
 
 /** Does this command compare the index with the working tree (and so ask the file system monitor)? */

package/neural-interface/lib/install-details.js

@@ -0,0 +1,163 @@
+// What this install has, for the Details areas of the setup wizard (GET /api/setup/install-details): the Node.js
+// SynaBun runs on, the npm and npx it runs (each asked for its version, the command and its answer shown as they
+// were), where `npm i -g` puts packages, the npm a terminal finds first, every part's dependencies with the
+// versions installed, the MCP server's build, and what a packaged application brought with it (the embedding
+// model, cloudflared, Git for Windows, the window's Electron) and whether the automation browser is there yet.
+//
+// Read only: nothing is installed, written or downloaded. Every command has a short time limit and a fixed
+// argument list; nothing a request says reaches one. A command that fails is reported with what it wrote, with
+// secrets taken out first (lib/log-redact.js: npm prints an invalid setting with its value, an error can name a
+// URL with its password) and then cut to OUTPUT_MAX. The whole answer goes through the same redaction before it
+// leaves (redactDeep), and nothing of it is kept.
+
+import { execFile as nodeExecFile } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { redactDeep, redactSecrets } from '../../lib/log-redact.js';
+
+const COMMAND_TIMEOUT_MS = 8000;
+const OUTPUT_MAX = 2000;
+
+const readJsonFile = (file) => { try { return JSON.parse(readFileSync(file, 'utf8')); } catch { return null; } };
+
+/** How many packages an npm install record (node_modules/.package-lock.json, or a package-lock.json) holds. */
+export function packagesInLock(lock) {
+  const entries = lock && typeof lock.packages === 'object' ? Object.keys(lock.packages) : [];
+  return entries.filter(key => /(?:^|\/)node_modules\//.test(key)).length;
+}
+
+/** How many packages of a lockfile are on disk under `root` (npm-shrinkwrap.json of an npm install). */
+export function installedFromLock(lock, root, { exists = existsSync } = {}) {
+  const entries = lock && typeof lock.packages === 'object' ? Object.keys(lock.packages) : [];
+  return entries.filter(key => /(?:^|\/)node_modules\//.test(key) && exists(path.join(root, ...key.split('/')))).length;
+}
+
+/**
+ * A part's own dependencies (its package.json), each with the version Node finds for it, or null when it is not
+ * installed. Sorted by name. Found in the part's node_modules, and with `stopAt` (the package root) in each folder
+ * up to it too: `npm i -g synabun` installs every part's dependencies at the package root.
+ */
+export function directDependencies(dir, { readJson = readJsonFile, stopAt = null } = {}) {
+  const manifest = readJson(path.join(dir, 'package.json')) || {};
+  const wanted = { ...(manifest.optionalDependencies || {}), ...(manifest.dependencies || {}) };
+  const limit = stopAt ? path.resolve(stopAt) : null;
+  const find = (name) => {
+    for (let folder = path.resolve(dir); ; folder = path.dirname(folder)) {
+      const found = readJson(path.join(folder, 'node_modules', ...name.split('/'), 'package.json'));
+      if (found || !limit || folder === limit || path.dirname(folder) === folder) return found;
+    }
+  };
+  return Object.keys(wanted).sort().map((name) => {
+    const installed = find(name);
+    return { name, wanted: String(wanted[name]), installed: installed?.version ? String(installed.version) : null };
+  });
+}
+
+/** The first file named `name` (on Windows `name.cmd`, `.exe` or the bare name) in the PATH `entries`, skipping `skip` folders. */
+export function firstOnPath(name, entries, { platform = process.platform, exists = existsSync, skip = [] } = {}) {
+  const impl = platform === 'win32' ? path.win32 : path.posix;
+  const id = (dir) => (platform === 'win32' ? String(dir).toLowerCase().replace(/[\\/]+$/, '') : String(dir).replace(/\/+$/, ''));
+  const skipped = new Set(skip.filter(Boolean).map(id));
+  const names = platform === 'win32' ? [`${name}.cmd`, `${name}.exe`, name] : [name];
+  for (const dir of entries || []) {
+    if (!dir || skipped.has(id(dir))) continue;
+    for (const candidate of names) {
+      const file = impl.join(dir, candidate);
+      if (exists(file)) return file;
+    }
+  }
+  return null;
+}
+
+/** Run `file --version` (a Windows command file through cmd.exe, the way a terminal starts it): { command, ok, output }. */
+export function runVersion(file, { platform = process.platform, env = process.env, execFile = nodeExecFile, timeoutMs = COMMAND_TIMEOUT_MS } = {}) {
+  const command = `${/\s/.test(file) ? `"${file}"` : file} --version`;
+  return new Promise((done) => {
+    const finish = (error, stdout = '', stderr = '') => {
+      const text = redactSecrets(String(stdout || '').trim() || String(stderr || '').trim() || (error ? error.message : ''));
+      done({ command: redactSecrets(command), ok: !error, output: text.length > OUTPUT_MAX ? `${text.slice(0, OUTPUT_MAX)}…` : text });
+    };
+    try {
+      if (platform === 'win32' && /\.(cmd|bat)$/i.test(file)) {
+        execFile(env.ComSpec || 'cmd.exe', ['/d', '/s', '/c', `""${file}" --version"`], { env, timeout: timeoutMs, windowsHide: true, windowsVerbatimArguments: true }, finish);
+      } else {
+        execFile(file, ['--version'], { env, timeout: timeoutMs, windowsHide: true }, finish);
+      }
+    } catch (error) {
+      finish(error);
+    }
+  });
+}
+
+/**
+ * Everything the Details areas show. `packaged` is lib/packaged-runtime.js readPackagedRuntime() (null for an
+ * npm or Git install) and `manifest` the packaged build's synabun-package.json; `osPath` the PATH a new terminal
+ * gets (lib/os-path.js); `npmPrefix` where the npm SynaBun runs puts global packages (the one absolute prefix PATH
+ * is built from: lib/child-path.js), `npmPrefixSource` why ('user' or 'synabun') and `npmPrefixFrom` what set it.
+ */
+export async function collectInstallDetails({
+  packageRoot,
+  packaged = null,
+  manifest = null,
+  platform = process.platform,
+  env = process.env,
+  execPath = process.execPath,
+  nodeVersion = process.version,
+  osPath = [],
+  npmPrefix = null,
+  npmPrefixSource = null,
+  npmPrefixFrom = null,
+  npmGlobalBin = null,
+  browserExecutable = null,
+  exists = existsSync,
+  readJson = readJsonFile,
+  version = runVersion,
+} = {}) {
+  const windows = platform === 'win32';
+  const impl = windows ? path.win32 : path.posix;
+  const runtimeBin = packaged?.runtimeBin || null;
+  const ownNpm = runtimeBin ? impl.join(runtimeBin, windows ? 'npm.cmd' : 'npm') : firstOnPath('npm', String(env.PATH || env.Path || '').split(windows ? ';' : ':'), { platform, exists });
+  const ownNpx = runtimeBin ? impl.join(runtimeBin, windows ? 'npx.cmd' : 'npx') : firstOnPath('npx', String(env.PATH || env.Path || '').split(windows ? ';' : ':'), { platform, exists });
+  const [npm, npx] = await Promise.all([
+    ownNpm ? version(ownNpm, { platform, env }) : Promise.resolve(null),
+    ownNpx ? version(ownNpx, { platform, env }) : Promise.resolve(null),
+  ]);
+  // The npm a terminal finds first: the user's own, when there is one outside SynaBun.
+  const userNpmPath = firstOnPath('npm', osPath, { platform, exists, skip: runtimeBin ? [runtimeBin, impl.dirname(execPath)] : [] });
+  const userNpm = userNpmPath && userNpmPath !== ownNpm ? { path: userNpmPath, ...(await version(userNpmPath, { platform, env })) } : null;
+
+  // A part's own install record when it has one (a development checkout, a desktop build); an npm install keeps
+  // both parts' dependencies at the package root instead, pinned by npm-shrinkwrap.json.
+  const shrinkwrap = readJson(path.join(packageRoot, 'npm-shrinkwrap.json'));
+  const parts = [['Neural Interface', 'neural-interface'], ['MCP server', 'mcp-server']].map(([name, folder]) => {
+    const dir = path.join(packageRoot, folder);
+    const installed = readJson(path.join(dir, 'node_modules', '.package-lock.json'));
+    const packages = installed ? packagesInLock(installed) : installedFromLock(shrinkwrap, packageRoot, { exists });
+    return { name, folder, packages, dependencies: directDependencies(dir, { readJson, stopAt: packageRoot }) };
+  });
+  const mcpBuilt = exists(path.join(packageRoot, 'mcp-server', 'dist', 'index.js'));
+
+  return redactDeep({
+    kind: packaged ? 'app' : 'source',
+    platform,
+    app: packaged ? {
+      version: packaged.version || null,
+      target: packaged.target || null,
+      electron: manifest?.shell?.electron || null,
+      builtAt: manifest?.builtAt || null,
+    } : null,
+    node: { version: nodeVersion, path: execPath, bundled: !!runtimeBin && execPath.startsWith(packaged.resources) },
+    npm: npm ? { path: ownNpm, bundled: !!runtimeBin, ...npm } : null,
+    npx: npx ? { path: ownNpx, bundled: !!runtimeBin, ...npx } : null,
+    globalPrefix: npmPrefix ? { path: npmPrefix, bin: npmGlobalBin || null, source: npmPrefixSource || null, from: npmPrefixFrom || null } : null,
+    userNpm,
+    parts,
+    mcp: { built: mcpBuilt, file: 'mcp-server/dist/index.js' },
+    bundled: packaged ? {
+      embeddingModel: manifest?.embeddingModel === 'bundled' ? 'Xenova/all-MiniLM-L6-v2' : null,
+      cloudflared: manifest?.cloudflared?.version || null,
+      gitBash: manifest?.gitBash?.version || null,
+    } : null,
+    browser: browserExecutable ? { path: browserExecutable, installed: exists(browserExecutable) } : null,
+  });
+}

package/neural-interface/lib/mcp-installer.js

@@ -1,6 +1,7 @@
 import { spawn, spawnSync } from 'child_process';
 import { existsSync, mkdirSync, readFileSync, writeFileSync, appendFileSync, chmodSync } from 'fs';
 import { join, resolve, isAbsolute } from 'path';
+import { withPackagedPathLast } from './augmented-path.js';
 
 const GITHUB_URL_RE = /^https?:\/\/github\.com\/([\w.-]+)\/([\w.-]+?)(?:\.git)?\/?$/i;
 
@@ -87,11 +88,22 @@ export function maskEnv(env) {
   return out;
 }
 
+/**
+ * The environment of a git / package-manager run: this process's, with a
+ * packaged application's runtime and npm's global bin after the user's own
+ * PATH (augmented-path.js withPackagedPathLast): a repository is installed
+ * with the user's npm, pnpm, yarn, uv or pip when they have one, SynaBun's
+ * bundled npm only when they have none. Unchanged for an npm or Git install.
+ */
+export function installEnv(extra = {}, base = process.env) {
+  return withPackagedPathLast({ ...base, ...extra });
+}
+
 async function runCommand(cmd, args, opts = {}) {
   return new Promise((resolvePromise) => {
     const child = spawn(cmd, args, {
       cwd: opts.cwd,
-      env: { ...process.env, ...(opts.env || {}) },
+      env: installEnv(opts.env || {}),
       stdio: ['ignore', 'pipe', 'pipe'],
       shell: false,
     });
@@ -466,7 +478,7 @@ export async function installDependencies({ dataHome, name, repoPath, onLine })
 
   if (hasPyproject || hasRequirements) {
     if (hasUvLock || hasPyproject) {
-      const uvExists = spawnSync('which', ['uv']).status === 0;
+      const uvExists = spawnSync('which', ['uv'], { env: installEnv() }).status === 0;
       if (uvExists) {
         logInstall(dataHome, name, 'running uv sync');
         const res = await runCommand('uv', ['sync'], { cwd: repoPath, onLine: (line) => { logInstall(dataHome, name, line); onLine?.(line); } });

package/neural-interface/lib/native-loop-providers.js

@@ -10,6 +10,7 @@ import { codexReasoningEffort } from './effort-levels.js';
 import { codexStreamMedia, collectCodexMedia, openCodeMediaPart, ownCodexImages } from './assistant-media.js';
 import { browserToolDenial } from './browser-tool-policy.js';
 import { CODEX_BROWSER_POLICY_UNTRUSTED_NOTE, codexBrowserPolicyHook } from './assistant-route-gate-codex.js';
+import { codexWindowsSandbox, codexWindowsSandboxConfig } from './agent-sandbox-elevation.js';
 
 function stringEnv(source) {
   const out = {};
@@ -248,6 +249,12 @@ export async function createCodexNativeLoopAdapter(options = {}) {
     collectMedia = null,
     // Assistant task runs: the browser policy's hook and the run's notes (a function: never in the state file).
     runMode = 'loop', onNote = null, browserPolicyTrust = null,
+    // Inherited variables to remove before extraEnv applies (the Codex account's launch:
+    // lib/codex-accounts.js launchFor() — inherited OpenAI/Codex credentials never reach the run).
+    unsetEnv = [],
+    // The Admin sandbox setting when the run started (lib/agent-sandbox-elevation.js): the Windows
+    // sandbox every `codex exec` of the thread may use. The run keeps it while it lives.
+    adminSandbox = false,
   } = options;
   const permissionPolicy = normalizePermissionPolicy(rawPolicy);
   const capability = normalizeCapability(rawCapability);
@@ -281,8 +288,10 @@ export async function createCodexNativeLoopAdapter(options = {}) {
     // Computer-use workers: the grant unlocks the `computer` group in the MCP child.
     SYNABUN_DESKTOP_GRANT: typeof desktopGrantProvider === 'function' ? desktopGrantProvider() || undefined : undefined,
   });
-  const env = stringEnv({ ...process.env, ...pins, CODEX_HOME: codexHome, ...(browserPolicy ? { SYNABUN_BROWSER_POLICY_CWD: cwd || process.cwd() } : {}), ...stringEnv(extraEnv) });
-  const config = {};
+  const inherited = { ...process.env };
+  for (const key of Array.isArray(unsetEnv) ? unsetEnv : []) delete inherited[key];
+  const env = stringEnv({ ...inherited, ...pins, CODEX_HOME: codexHome, ...(browserPolicy ? { SYNABUN_BROWSER_POLICY_CWD: cwd || process.cwd() } : {}), ...stringEnv(extraEnv) });
+  const config = { ...codexWindowsSandboxConfig(adminSandbox) };
   if (Object.keys(pins).length) config.mcp_servers = { SynaBun: { env: pins } };
   if (extended) config.model_context_window = Math.floor(Number(modelContextWindow));
   if (browserPolicy) Object.assign(config, browserPolicy.config);
@@ -329,6 +338,7 @@ export async function createCodexNativeLoopAdapter(options = {}) {
     isAlive: () => alive,
     describe: () => ({
       provider: 'codex', permissionPolicy, capability, sandboxMode: codexSandboxModeFor({ permissionPolicy, capability }),
+      windowsSandbox: codexWindowsSandbox(adminSandbox),
       ...(task ? { browserPolicy: browserPolicy ? 'hook' : 'instructions' } : {}),
     }),
     async runTurn(prompt, meta = {}) {
@@ -423,6 +433,11 @@ export async function createClaudeNativeLoopAdapter(options = {}) {
     extraEnv = {}, permissionPolicy: rawPolicy = 'auto', permissionBroker = null,
     capability: rawCapability = 'full', maxBudgetUsd = null, outputSchema = null, runMode = 'loop',
     desktopGrantProvider = null,
+    // Inherited variables to remove before extraEnv applies (the Claude account's launch:
+    // credentials the server was started with never reach a worker).
+    unsetEnv = [],
+    // The host's last word on the environment: on Windows the Git Bash it names (lib/git-bash/).
+    childEnv = null,
   } = options;
   const permissionPolicy = normalizePermissionPolicy(rawPolicy);
   const capability = normalizeCapability(rawCapability);
@@ -432,8 +447,10 @@ export async function createClaudeNativeLoopAdapter(options = {}) {
   let alive = true;
   let sessionId = null;
   let activeTurn = null;
-  const env = stringEnv({
-    ...cleanClaudeEnvironment(),
+  const inherited = cleanClaudeEnvironment();
+  for (const key of Array.isArray(unsetEnv) ? unsetEnv : []) delete inherited[key];
+  const ownEnv = stringEnv({
+    ...inherited,
     SYNABUN_TERMINAL_SESSION: runId,
     SYNABUN_PROJECT: cwd ? memoryProject(cwd) : 'global',
     SYNABUN_PROFILE: 'full',
@@ -442,6 +459,7 @@ export async function createClaudeNativeLoopAdapter(options = {}) {
     SYNABUN_RUN_MODE: runMode === 'task' ? 'task' : undefined,
     ...stringEnv(extraEnv),
   });
+  const env = typeof childEnv === 'function' ? stringEnv(childEnv(ownEnv)) : ownEnv;
   const brokerRequest = async (request) => {
     try {
       const reply = await permissionBroker.request({

package/neural-interface/lib/native-loop-runtime.js

@@ -373,9 +373,14 @@ export class NativeLoopRuntime {
     record.startupCancelPromise = new Promise((resolveCancel) => { record._cancelStartup = resolveCancel; });
     this.records.set(runId, record);
     this._emit('sidepanel:run-created', record);
-    const maxMs = Math.max(1, Number(nativeState.maxMinutes) || 30) * 60_000;
-    record.timer = setTimeout(() => { this.stop(runId, 'time_cap').catch(() => {}); }, maxMs);
-    record.timer.unref?.();
+    // A task run's (assistant dispatch) maxMinutes is work time, which its dispatcher counts and
+    // enforces (assistant-dispatch.js, the work clock): idle time between its turns does not count,
+    // so it gets no wall-clock cap here. A loop's maxMinutes stays the wall clock.
+    if (record.runMode !== 'task') {
+      const maxMs = Math.max(1, Number(nativeState.maxMinutes) || 30) * 60_000;
+      record.timer = setTimeout(() => { this.stop(runId, 'time_cap').catch(() => {}); }, maxMs);
+      record.timer.unref?.();
+    }
 
     const startupSignal = record.startupAbortController.signal;
     const factoryPromise = Promise.resolve().then(() => factory({
@@ -510,7 +515,7 @@ export class NativeLoopRuntime {
         return;
       }
       const elapsed = this.now() - new Date(state.startedAt || record.startedAt).getTime();
-      if (elapsed >= Math.max(1, Number(state.maxMinutes) || 30) * 60_000) {
+      if (record.runMode !== 'task' && elapsed >= Math.max(1, Number(state.maxMinutes) || 30) * 60_000) {
         await this.stop(record.runId, 'time_cap');
         return;
       }