synabun 2.0.5 → 2.0.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "synabun",
-  "version": "2.0.5",
+  "version": "2.0.9",
   "description": "Local-first persistent vector memory, MCP tooling, and multi-agent workflows for AI assistants",
   "license": "Apache-2.0",
   "author": "The SynaBun Authors",
@@ -59,11 +59,17 @@
     "lib/paths.js",
     "lib/start-launcher.js",
     "lib/packaged-runtime.js",
+    "lib/child-path.js",
+    "lib/log-redact.js",
     "lib/desktop-pwa.js",
+    "lib/desktop-app.js",
     "lib/external-tools.js",
     "lib/paths.d.ts",
     "lib/data-home-migration.js",
     "lib/first-launch-protection.js",
+    "lib/runtime-dependencies.js",
+    "lib/package-processes.js",
+    "npm-shrinkwrap.json",
     "lib/client-config-repair.js",
     "lib/claude-hooks.js",
     "lib/claude-usage-audit.js",
@@ -95,7 +101,56 @@
     "build:windows:x86": "node packaging/build.mjs build --target windows-x86",
     "postinstall": "node postinstall.js",
     "preuninstall": "node preuninstall.js",
-    "prepublishOnly": "npm --prefix mcp-server ci --ignore-scripts && npm --prefix neural-interface ci --ignore-scripts && npm run mcp:build && node -e \"const fs = require('node:fs'); for (const path of ['mcp-server/dist/index.js', 'NOTICE', 'THIRD-PARTY-LICENSES.md']) fs.accessSync(path)\" && npm run pack:check"
+    "prepublishOnly": "npm --prefix mcp-server ci --ignore-scripts && npm --prefix neural-interface ci --ignore-scripts && npm run mcp:build && node -e \"const fs = require('node:fs'); for (const path of ['mcp-server/dist/index.js', 'NOTICE', 'THIRD-PARTY-LICENSES.md']) fs.accessSync(path)\" && npm run pack:check",
+    "prepack": "node lib/root-dependencies.mjs --check",
+    "deps:check": "node lib/root-dependencies.mjs --check",
+    "deps:sync": "node lib/root-dependencies.mjs --write"
+  },
+  "dependencies": {
+    "@anthropic-ai/claude-agent-sdk": "0.3.288",
+    "@huggingface/transformers": "^3.0.0",
+    "@inquirer/prompts": "^8.2.0",
+    "@modelcontextprotocol/sdk": "^1.12.1",
+    "@openai/codex-sdk": "^0.160.0",
+    "@opencode-ai/sdk": "1.18.34",
+    "@xterm/addon-fit": "0.11.0",
+    "@xterm/addon-search": "0.16.0",
+    "@xterm/addon-serialize": "0.14.0",
+    "@xterm/addon-unicode11": "0.9.0",
+    "@xterm/addon-web-links": "0.12.0",
+    "@xterm/addon-webgl": "0.19.0",
+    "@xterm/headless": "6.0.0",
+    "@xterm/xterm": "6.0.0",
+    "adm-zip": "^0.6.0",
+    "archiver": "^7.0.1",
+    "chalk": "^5.6.2",
+    "dotenv": "^16.4.7",
+    "express": "^4.21.2",
+    "node-html-markdown": "^2.0.0",
+    "playwright": "^1.59.1",
+    "undici": "^8.5.0",
+    "uuid": "^14.0.0",
+    "ws": "^8.21.0",
+    "zod": "^4.4.3"
+  },
+  "optionalDependencies": {
+    "node-pty": "^1.1.0"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.0",
+    "@types/node": "^22.12.0",
+    "typescript": "^5.9.3"
+  },
+  "overrides": {
+    "@hono/node-server": "^1.19.13",
+    "brace-expansion": "^2.1.2",
+    "esbuild": "^0.28.1",
+    "hono": "^4.12.25",
+    "lodash": "^4.18.1",
+    "postcss": "^8.5.10",
+    "protobufjs": "^7.6.5",
+    "tar": "^7.5.19",
+    "vite": "^8.0.16"
   },
   "keywords": [
     "ai-agents",

package/postinstall.js

@@ -3,17 +3,21 @@
 /**
  * SynaBun — NPM postinstall script
  *
- * Runs automatically after `npm install -g synabun`.
- * Installs subdependencies and builds the MCP server.
+ * Runs after `npm i -g synabun` (and after `npm install` in a checkout). npm
+ * has already installed every runtime dependency at the package root, at the
+ * versions npm-shrinkwrap.json pins, so nothing is installed here: this only
+ * finishes what npm cannot (node-pty's binary, the MCP build of a fresh
+ * checkout, the synabun:// handler, the updater shim's executable bit).
  * Does NOT start the server — that's setup.js / `synabun` command.
  */
 
-import { execSync } from 'node:child_process';
-import { existsSync, chmodSync } from 'node:fs';
-import { resolve, dirname } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { existsSync, chmodSync, lstatSync, readlinkSync, unlinkSync } from 'node:fs';
+import { resolve, dirname, basename, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { platform } from 'node:os';
 import { registerStartLauncher } from './lib/start-launcher.js';
+import { mcpCompiler } from './lib/runtime-dependencies.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -28,44 +32,22 @@ const c = {
   red:    '\x1b[31m',
 };
 
-function ok(msg)   { console.log(`  ${c.green}\u2713${c.reset} ${msg}`); }
+function ok(msg)   { console.log(`  ${c.green}✓${c.reset} ${msg}`); }
 function warn(msg) { console.log(`  ${c.yellow}!${c.reset} ${msg}`); }
-function fail(msg) { console.log(`  ${c.red}\u2717${c.reset} ${msg}`); }
-function info(msg) { console.log(`  ${c.cyan}\u2192${c.reset} ${msg}`); }
-
-// ── Dependency installation ──
-
-function needsInstall(dir) {
-  return !existsSync(resolve(dir, 'node_modules', '.package-lock.json'));
-}
-
-function installDeps(name, dir, { includeDev = false } = {}) {
-  if (!needsInstall(dir)) {
-    ok(`${name} dependencies already installed`);
-    return;
-  }
-
-  info(`Installing ${name} dependencies...`);
-  try {
-    const omitFlag = includeDev ? '' : ' --omit=dev';
-    execSync(`npm install${omitFlag} --ignore-scripts`, {
-      cwd: dir,
-      stdio: 'inherit',
-      timeout: 300_000,
-    });
-    ok(`${name} dependencies installed`);
-  } catch (err) {
-    fail(`Failed to install ${name} dependencies`);
-    console.error(err.stderr?.toString() || err.message);
-    process.exit(1);
-  }
-}
-
-function needsBuild() {
-  return !existsSync(resolve(__dirname, 'mcp-server', 'dist', 'index.js'));
-}
+function fail(msg) { console.log(`  ${c.red}✗${c.reset} ${msg}`); }
+function info(msg) { console.log(`  ${c.cyan}→${c.reset} ${msg}`); }
 
 // ── node-pty native rebuild ──
+//
+// On an install or an update npm runs no dependency's install script
+// (npm-shrinkwrap.json keeps them off: lib/root-dependencies.mjs
+// withoutInstallScript), so node-pty is this script's: its prebuilt binary on
+// macOS and Windows, with the execute bit of its spawn helper restored; a
+// compile where it has none (Linux) or the one it has does not start. Never
+// fatal: without it only the terminal is missing. A bare `npm rebuild -g`
+// reads each package's own package.json and runs those scripts after all:
+// SynaBun never runs one, and its repair is `npm i -g synabun@<version>` or
+// `npm rebuild -g synabun --ignore-scripts` followed by this script.
 
 function rebuildPty() {
   const rebuildScript = resolve(__dirname, 'neural-interface', 'scripts', 'rebuild-pty.js');
@@ -74,20 +56,23 @@ function rebuildPty() {
     return;
   }
 
-  info('Rebuilding node-pty native addon...');
+  info('Checking node-pty native addon...');
   try {
-    execSync(`node "${rebuildScript}"`, {
+    execFileSync(process.execPath, [rebuildScript], {
       cwd: resolve(__dirname, 'neural-interface'),
       stdio: 'inherit',
       timeout: 120_000,
     });
-    ok('node-pty rebuilt');
+    ok('node-pty ready');
   } catch (err) {
     warn('node-pty rebuild failed (terminal features may not work)');
   }
 }
 
 // ── MCP server build ──
+//
+// A published package carries mcp-server/dist; a fresh checkout compiles it,
+// with the TypeScript of the root's devDependencies.
 
 function buildMcpServer() {
   const distIndex = resolve(__dirname, 'mcp-server', 'dist', 'index.js');
@@ -97,8 +82,13 @@ function buildMcpServer() {
   }
 
   info('Building MCP server from source...');
+  const tsc = mcpCompiler(__dirname);
+  if (!tsc) {
+    fail('MCP server build failed: TypeScript is not installed (run npm install in the package root)');
+    return;
+  }
   try {
-    execSync('npx tsc', {
+    execFileSync(process.execPath, [tsc, '-p', resolve(__dirname, 'mcp-server')], {
       cwd: resolve(__dirname, 'mcp-server'),
       stdio: ['ignore', 'pipe', 'pipe'],
       timeout: 120_000,
@@ -114,6 +104,31 @@ function buildMcpServer() {
   }
 }
 
+// ── Links an older postinstall left ──
+//
+// Up to 2.0.8 this script ran `npm install` in mcp-server/ and neural-interface/
+// itself. Inside `npm i -g`, npm sets npm_config_global for its scripts, so each
+// of those installs put its folder in the global packages as a link of its own,
+// beside SynaBun: claude-memory-mcp -> synabun/mcp-server and
+// neural-memory-interface -> synabun/neural-interface. Only such a link, pointing
+// at this package's own folder, is removed.
+
+function removeStalePartLinks() {
+  const parent = dirname(__dirname);
+  if (basename(parent) !== 'node_modules') return;
+  const same = (a, b) => (platform() === 'win32' ? a.toLowerCase() === b.toLowerCase() : a === b);
+  for (const [name, folder] of [['claude-memory-mcp', 'mcp-server'], ['neural-memory-interface', 'neural-interface']]) {
+    const link = join(parent, name);
+    try {
+      if (!lstatSync(link).isSymbolicLink()) continue;
+      const target = readlinkSync(link).replace(/^\\\\\?\\/, '');
+      if (!same(resolve(parent, target), resolve(__dirname, folder))) continue;
+      unlinkSync(link);
+      ok(`Removed ${name}, a link an older SynaBun left in the global packages`);
+    } catch {}
+  }
+}
+
 // ── Protocol handler registration ──
 //
 // The synabun:// handler behind the offline page's Start Server button. The
@@ -151,14 +166,13 @@ function ensureUpdaterShExecutable() {
 function main() {
   console.log(`\n  ${c.cyan}SynaBun${c.reset} ${c.dim}postinstall${c.reset}\n`);
 
-  installDeps('Neural Interface', resolve(__dirname, 'neural-interface'));
-  installDeps('MCP Server', resolve(__dirname, 'mcp-server'), { includeDev: needsBuild() });
+  removeStalePartLinks();
   rebuildPty();
   buildMcpServer();
   registerProtocolHandler();
   ensureUpdaterShExecutable();
 
-  console.log(`\n  ${c.green}\u2713${c.reset} Setup complete. Run ${c.cyan}synabun${c.reset} to start.\n`);
+  console.log(`\n  ${c.green}✓${c.reset} Setup complete. Run ${c.cyan}synabun${c.reset} to start.\n`);
 }
 
 main();

package/preuninstall.js

@@ -78,50 +78,23 @@ async function tryGracefulServerShutdown() {
 // keep file handles inside the install dir open, causing EBUSY when npm
 // tries to rename it.
 //
-// We nuke any process whose command line references the SynaBun install
-// path. This catches every orphan regardless of how they got that way.
+// Windows: lib/package-processes.js, the same step the updater runs (node
+// processes with an argument inside the install path, anything whose program
+// file is inside it; never this process, its parents or its children).
+// Elsewhere: any process whose command line references the install path.
 // Skips the current PID (we are the preuninstall process itself).
 
-killOrphansInsideInstall();
+await killOrphansInsideInstall();
 
-function killOrphansInsideInstall() {
+async function killOrphansInsideInstall() {
   const installPath = __dirname;
   const selfPid = process.pid;
   const plat = platform();
 
   if (plat === 'win32') {
-    // PowerShell: Get-CimInstance returns every process with CommandLine.
-    // Pass the install path via env so this PowerShell command line does not
-    // itself contain the path we are trying to match and kill.
-    // Stop-Process -Force kills synchronously; -ErrorAction SilentlyContinue
-    // suppresses "process already exited" noise.
-    const ps = `
-$ErrorActionPreference = 'SilentlyContinue';
-$installPath = $env:SYNABUN_INSTALL_PATH;
-$selfPid = [int]$env:SYNABUN_PREUNINSTALL_PID;
-Get-CimInstance Win32_Process |
-  Where-Object {
-    $_.ProcessId -ne $selfPid -and
-    $_.ProcessId -ne $PID -and (
-      ($_.CommandLine -and $_.CommandLine -like "*$installPath*") -or
-      ($_.ExecutablePath -and $_.ExecutablePath -like "$installPath*")
-    )
-  } |
-  ForEach-Object {
-    Write-Host ('  Killing orphan PID ' + $_.ProcessId + ' (' + $_.Name + ')');
-    Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue
-  }
-	`.trim();
     try {
-      execSync(`powershell -NoProfile -ExecutionPolicy Bypass -Command "${ps.replace(/"/g, '\\"').replace(/\n/g, ' ')}"`, {
-        stdio: 'inherit',
-        timeout: 8000,
-        env: {
-          ...process.env,
-          SYNABUN_INSTALL_PATH: installPath,
-          SYNABUN_PREUNINSTALL_PID: String(selfPid),
-        },
-      });
+      const { stopPackageProcesses } = await import('./lib/package-processes.js');
+      await stopPackageProcesses({ roots: [installPath], selfPid, log: line => console.log(line) });
     } catch {
       // PowerShell unavailable, blocked, or timed out. Fall through.
     }

package/setup.js

@@ -8,17 +8,18 @@
  * 1. Checks Node.js version (>=22)
  * 2. Ensures data directory exists (~/.synabun or %APPDATA%/synabun)
  * 3. Migrates data from old scaffolded installs if detected
- * 4. Installs npm deps for neural-interface/ and mcp-server/
- * 5. Builds the MCP server TypeScript (if dist/ is missing or stale)
+ * 4. Checks that the runtime dependencies resolve (npm installs them with the
+ *    package); runs npm only for a checkout nobody installed or a missing module
+ * 5. Builds the MCP server TypeScript (if dist/ is missing)
  * 6. Takes a verified snapshot of user state before a new version first runs
  *    (lib/first-launch-protection.js). If it cannot, the launch stops here.
  * 7. Starts the Neural Interface Express server
  * 8. Auto-opens browser to onboarding wizard (or main page if setup complete)
  */
 
-import { execSync, spawn, exec } from 'node:child_process';
+import { execFileSync, spawn, exec } from 'node:child_process';
 import { existsSync, readFileSync, writeFileSync, cpSync, readdirSync, mkdirSync, unlinkSync, createWriteStream, statSync, renameSync } from 'node:fs';
-import { resolve, dirname } from 'node:path';
+import { resolve, dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { platform } from 'node:os';
 import {
@@ -48,6 +49,9 @@ import {
   RESTART_REPORT_ENV, noteSupervisorFailure, openRestartReport, openSupervisorRecord, registerStartLauncher, resolvePort,
 } from './lib/start-launcher.js';
 import { packagedRuntime } from './lib/packaged-runtime.js';
+import {
+  OPTIONAL_AT_ROOT, checkRuntimeDependencies, findInstalled, installAtPackageRoot, installKind, mcpCompiler,
+} from './lib/runtime-dependencies.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -288,54 +292,79 @@ function checkNodeVersion() {
   ok(`Node.js v${process.versions.node}`);
 }
 
-// ── Phase 2: Dependency installation ──
-
-function needsInstall(dir) {
-  const nm = resolve(dir, 'node_modules');
-  if (!existsSync(resolve(nm, '.package-lock.json'))) return true;
-  // Guard against a corrupted/partially-wiped node_modules where
-  // .package-lock.json survived but the actual packages didn't.
-  try {
-    const pkg = JSON.parse(readFileSync(resolve(dir, 'package.json'), 'utf8'));
-    const dep = Object.keys(pkg.dependencies || {})[0];
-    if (dep && !existsSync(resolve(nm, dep))) return true;
-  } catch {
-    return true;
-  }
-  return false;
+// ── Phase 2: Runtime dependencies ──
+//
+// `npm i -g synabun` installed them at the package root, at the versions
+// npm-shrinkwrap.json pins; a desktop build and a development checkout carry
+// them in each part's node_modules. This step only checks that Node finds them
+// (lib/runtime-dependencies.js). npm runs here only for what is really missing,
+// a checkout nobody installed or a module that disappeared: once, at the
+// package root, and never inside a packaged application.
+
+// The repair of an npm install: this version again, from the registry, which keeps the dependencies' install
+// scripts off as every install and update does. Never a bare `npm rebuild -g`: it reads each dependency's own
+// package.json and runs those scripts (onnxruntime-node's CUDA download, sharp's source build).
+function npmRepairCommand() {
+  let version = null;
+  try { version = JSON.parse(readFileSync(resolve(PACKAGE_ROOT, 'package.json'), 'utf-8')).version; } catch {}
+  return `npm i -g synabun${version ? `@${version}` : ''}`;
 }
 
-function installDeps(name, dir, { includeDev = false } = {}) {
-  if (!needsInstall(dir)) {
-    ok(`${name} dependencies already installed`);
+function ensureRuntimeDependencies() {
+  const report = checkRuntimeDependencies({ packageRoot: PACKAGE_ROOT });
+  // A fresh checkout compiles the MCP server, with the TypeScript of the root's devDependencies.
+  const compilerMissing = needsBuild() && !mcpCompiler(PACKAGE_ROOT);
+  if (report.ok && !compilerMissing) {
+    ok('Runtime dependencies present');
+    for (const part of report.parts) for (const name of part.optional) warn(`${name} is not installed: ${OPTIONAL_AT_ROOT[name]}`);
     return;
   }
 
-  info(`Installing ${name} dependencies...`);
-  startPhase('dependencies', { name });
-  try {
-    const omitFlag = includeDev ? '' : ' --omit=dev';
-    execSync(`npm install${omitFlag} --ignore-scripts`, {
-      cwd: dir,
-      stdio: 'inherit',
-      timeout: 300_000,
-    });
-    ok(`${name} dependencies installed`);
-  } catch (err) {
-    fail(`Failed to install ${name} dependencies`);
-    console.error(err.stderr?.toString() || err.message);
-    startFailed('DEPENDENCIES_FAILED', `npm could not install the ${name} dependencies`);
+  for (const part of report.parts) if (part.error) fail(part.error);
+  const names = [...report.missing.map(item => item.name), ...(compilerMissing ? ['typescript (builds the MCP server)'] : [])];
+  if (names.length) warn(`Missing: ${names.slice(0, 8).join(', ')}${names.length > 8 ? ` and ${names.length - 8} more` : ''}`);
+  const kind = installKind({ packageRoot: PACKAGE_ROOT, packaged: !!packagedRuntime() });
+  if (kind === 'packaged') {
+    fail('This SynaBun application is incomplete. Reinstall it from https://synabun.ai');
+    startFailed('DEPENDENCIES_MISSING', 'the application is incomplete: reinstall it');
+    process.exit(1);
+  }
+
+  info(`Installing them with npm in ${PACKAGE_ROOT}...`);
+  startPhase('dependencies', { name: 'SynaBun' });
+  const logsDir = resolve(DATA_HOME, 'data', 'npm-logs');
+  const result = installAtPackageRoot({ packageRoot: PACKAGE_ROOT, includeDev: needsBuild(), logsDir });
+  const after = result.ok ? checkRuntimeDependencies({ packageRoot: PACKAGE_ROOT }) : null;
+  if (!result.ok || !after.ok) {
+    fail('npm could not install the runtime dependencies');
+    info(`Command:   ${result.command}`);
+    info(`Folder:    ${result.cwd}`);
+    info(`Exit code: ${result.status ?? 'none'}${result.signal ? `, signal ${result.signal}` : ''}${result.timedOut ? ' (stopped after 20 minutes)' : result.error ? ` (${result.error})` : ''}`);
+    info(`npm log:   ${result.logFile || `none written (folder ${logsDir})`}`);
+    if (after && !after.ok) info(`Still missing: ${after.missing.map(item => item.name).join(', ')}`);
+    if (kind === 'npm') info(`To repair: close SynaBun and every AI client that uses it, then run  ${npmRepairCommand()}`);
+    startFailed('DEPENDENCIES_FAILED', `npm could not install the runtime dependencies (exit ${result.status ?? result.signal ?? result.error})`, { exitCode: result.status ?? undefined });
     process.exit(1);
   }
+  ok(`Runtime dependencies installed (${result.seconds} s)`);
+  // That install ran no package scripts: node-pty still needs building where it has no prebuilt binary.
+  const rebuild = resolve(PACKAGE_ROOT, 'neural-interface', 'scripts', 'rebuild-pty.js');
+  try {
+    execFileSync(process.execPath, [rebuild], { cwd: resolve(PACKAGE_ROOT, 'neural-interface'), stdio: 'inherit', timeout: 180_000, windowsHide: true });
+  } catch {
+    warn('node-pty could not be prepared: terminal features may not work');
+  }
 }
 
 // ── Phase 3: Playwright Chromium (for browser automation) ──
 
 function installPlaywrightChromium() {
   const niDir = resolve(PACKAGE_ROOT, 'neural-interface');
+  // SynaBun's own Playwright on the Node that runs SynaBun (its absolute path): a packaged application puts its
+  // runtime last on PATH, so a `node` or `npx` by name may be the user's, of any version.
   try {
-    const result = execSync('node -e "const pw=require(\'playwright\');const p=pw.chromium.executablePath();process.stdout.write(p)"', {
-      cwd: niDir, encoding: 'utf8', timeout: 10_000,
+    const result = execFileSync(process.execPath, ['-e', "const pw=require('playwright');const p=pw.chromium.executablePath();process.stdout.write(p)"], {
+      cwd: niDir, encoding: 'utf8', timeout: 10_000, windowsHide: true,
     });
     if (existsSync(result)) {
       ok('Playwright Chromium already installed');
@@ -346,11 +375,11 @@ function installPlaywrightChromium() {
   info('Installing Playwright Chromium (for browser automation)...');
   startPhase('browser');
   try {
-    execSync('npx playwright install chromium', {
-      cwd: niDir,
-      stdio: 'inherit',
-      timeout: 120_000,
-    });
+    // SynaBun's own Playwright (the package root's in an npm install, the part's in a checkout), never `npx`:
+    // npx would fetch the newest Playwright, whose Chromium is not the one this version drives.
+    const playwright = findInstalled(niDir, 'playwright', { stopAt: PACKAGE_ROOT });
+    if (!playwright) throw new Error('playwright is not installed');
+    execFileSync(process.execPath, [join(playwright.path, 'cli.js'), 'install', 'chromium'], { cwd: niDir, stdio: 'inherit', timeout: 120_000 });
     ok('Playwright Chromium installed');
   } catch (err) {
     console.log('  (optional) Playwright Chromium install failed — system Chrome will be used');
@@ -372,8 +401,13 @@ function buildMcpServer() {
 
   info('Building MCP server from source...');
   startPhase('build');
+  const tsc = mcpCompiler(PACKAGE_ROOT);
+  if (!tsc) {
+    fail('MCP server build failed: TypeScript is not installed (npm install at the package root installs it)');
+    return;
+  }
   try {
-    execSync('npx tsc', {
+    execFileSync(process.execPath, [tsc, '-p', resolve(PACKAGE_ROOT, 'mcp-server')], {
       cwd: resolve(PACKAGE_ROOT, 'mcp-server'),
       stdio: ['ignore', 'pipe', 'pipe'],
       windowsHide: !!packagedRuntime(),
@@ -840,11 +874,10 @@ async function main() {
   checkNodeVersion();
   console.log('');
 
-  // Dependencies (installed in global package location)
+  // Dependencies (npm installed them with the package; this only checks)
   // A slow step names itself when it begins (startPhase inside each); between
   // them the record goes back to 'checking', so it never names a finished one.
-  installDeps('Neural Interface', resolve(PACKAGE_ROOT, 'neural-interface'));
-  installDeps('MCP Server', resolve(PACKAGE_ROOT, 'mcp-server'), { includeDev: needsBuild() });
+  ensureRuntimeDependencies();
   startPhase('checking');
   console.log('');
 

package/skills/synabun/modules/idea.md

@@ -128,7 +128,7 @@ If the user says yes:
 2. If not, create it with the runtime's category-management tool using:
    - `name`: "ideas"
    - `description`: "Brainstormed features, experiments, and creative explorations"
-   - `parent`: the current project's parent category (e.g., "my-project") — or no parent if no project match
+   - `parent`: the current project's parent category (e.g., "my-project") only when it is in the list from step 1 — otherwise no parent (a fresh install has no categories; SynaBun also creates `ideas` with no parent on the first `remember` into it)
 3. For each idea the user wants saved, call `remember` with:
    - `content`: The full idea text (title + concept + reasoning chain + next steps)
    - `category`: "ideas"

package/skills/synabun/modules/schedule.md

@@ -139,7 +139,7 @@ Rules baked in: `model`/`profile` **top level**; `{iterations,maxMinutes}` in `o
 
 ## Phase 5 — Remember (one MCP call)
 
-`remember` `category:"schedules"` (if missing, `category` action `create` child under parent `synabun`), `project:"synabun"`, `importance:6`, `tags:["schedule","<platform/topic>","conversational-created"]`, content = 4–6 lines: name, template id, schedule id, cron, group, profile/model, date.
+`remember` `category:"schedules"` (SynaBun creates it on the first save, with no parent; if the runtime still reports it unknown, `category` action `create` it first, under parent `synabun` only when that category exists in `category` action `list`, otherwise with no parent), `project:"synabun"`, `importance:6`, `tags:["schedule","<platform/topic>","conversational-created"]`, content = 4–6 lines: name, template id, schedule id, cron, group, profile/model, date.
 
 ## Phase 6 — Done (one line)
 

package/updater.cmd

@@ -2,7 +2,7 @@
 setlocal enableextensions
 title SynaBun Updater
 
-rem ───────────────────────────────────────────────────────
+rem -------------------------------------------------------
 rem Windows shim for the cross-platform updater (updater.mjs).
 rem Invoked by the running SynaBun server via:
 rem   start "" "<install>\updater.cmd" --payload payload.json
@@ -11,7 +11,7 @@ rem We use a shim instead of spawning node directly so cmd's
 rem quoting rules don't mangle the command line, and so the
 rem window stays open for the user to read npm output even
 rem if node exits unexpectedly.
-rem ───────────────────────────────────────────────────────
+rem -------------------------------------------------------
 
 set "SCRIPT_DIR=%~dp0"
 set "EXIT_CODE=0"