synabun 2.0.7 → 2.0.10

package/neural-interface/lib/app-controls-api.js

@@ -0,0 +1,161 @@
+// ═══════════════════════════════════════════
+// SynaBun — /api/system/app: Settings > App for an npm or Git install
+// ═══════════════════════════════════════════
+//
+//   GET  /api/system/app               { ok, install, desktop, updates: { auto }, startup: { … } }
+//   PUT  /api/system/app/updates       { auto: boolean }      the automatic update check and its badge
+//   PUT  /api/system/app/startup       { enabled: boolean }   start the server at login (lib/login-start.js)
+//   POST /api/system/app/open-folder   { which: 'data' | 'logs' }
+//
+// Automatic updates here are the check: on (the default), the server looks for
+// a newer version when it starts and the page shows the update badge and asks
+// again every half hour; off, it looks only when the user asks (Check for
+// updates). Installing always goes through the update dialog and its backup
+// step; nothing installs unattended. The setting is DATA_HOME/data/app-settings.json.
+//
+// In the desktop app (`desktop: true`) the app's own settings are the
+// window's (packaging/desktop/src/app-prefs.mjs, through the preload bridge):
+// this answers what it is and changes nothing.
+//
+// These are the owner's acts on this computer (a login entry, a folder opened
+// on its screen), so the routes take the guards of /api/cli/install
+// (lib/http-guards.js): a loopback socket and no proxy header, a localhost
+// Host, no invite guest; a write also its own Origin, a JSON body,
+// X-SynaBun-UI: 1 and no agent header. (`/api/system` is admin-only in
+// lib/request-gate.js too.) A request names a switch, never a path or a command.
+
+import { Router } from 'express';
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { guestForbidden, noStore, requireLocal, requireLocalHost, requireSameOriginJson, sendGuardError, uiOnly } from './http-guards.js';
+import { runProgram } from './file-explorer-system.js';
+
+export const APP_SETTINGS_DEFAULTS = Object.freeze({ autoUpdateCheck: true });
+
+export function normalizeAppSettings(raw) {
+  const source = raw && typeof raw === 'object' && !Array.isArray(raw) ? raw : {};
+  const out = {};
+  for (const [key, value] of Object.entries(APP_SETTINGS_DEFAULTS)) out[key] = typeof source[key] === typeof value ? source[key] : value;
+  return out;
+}
+
+/** DATA_HOME/data/app-settings.json, read once and written through (this server is its only writer). */
+export function createAppSettingsStore({ path, fs = { mkdirSync, readFileSync, renameSync, writeFileSync } } = {}) {
+  let current = null;
+  const load = () => {
+    if (current) return current;
+    try { current = normalizeAppSettings(JSON.parse(fs.readFileSync(path, 'utf8'))); } catch { current = normalizeAppSettings(null); }
+    return current;
+  };
+  return {
+    get: () => ({ ...load() }),
+    set(patch) {
+      const next = normalizeAppSettings({ ...load(), ...patch });
+      fs.mkdirSync(dirname(path), { recursive: true });
+      const temp = `${path}.${process.pid}.tmp`;
+      fs.writeFileSync(temp, JSON.stringify(next, null, 2) + '\n');
+      fs.renameSync(temp, path);
+      current = next;
+      return { ...next };
+    },
+  };
+}
+
+/** The program that shows a folder in the system's file manager (no shell; the path is an argument of its own). */
+export function openFolderCommand(platform, path, { env = process.env } = {}) {
+  if (platform === 'darwin') return { file: 'open', args: [path] };
+  // explorer.exe answers 1 even when it opened the folder.
+  if (platform === 'win32') return { file: 'explorer.exe', args: [path], anyExit: true };
+  if (!env.DISPLAY && !env.WAYLAND_DISPLAY) return null;
+  return { file: 'xdg-open', args: [path] };
+}
+
+/** Open a folder on this computer's screen; resolves true when the file manager took it. */
+export async function openFolderOnScreen(path, { platform = process.platform, env = process.env, run = runProgram, mkdir = mkdirSync } = {}) {
+  const command = openFolderCommand(platform, path, { env });
+  if (!command) return false;
+  try { mkdir(path, { recursive: true }); } catch {}
+  try {
+    await run(command.file, command.args);
+    return true;
+  } catch (error) {
+    return !!command.anyExit && error?.code !== 'ENOENT';
+  }
+}
+
+function localRouter({ isGuestRequest, port }) {
+  const router = Router();
+  const portOf = () => Number(typeof port === 'function' ? port() : port);
+  const built = new Map();
+  const perPort = (name, factory) => (req, res, next) => {
+    const key = `${name}:${portOf()}`;
+    let guard = built.get(key);
+    if (!guard) {
+      try { guard = factory(portOf()); } catch { return sendGuardError(res, 500, 'BAD_PORT', 'The app settings have no valid port.'); }
+      built.set(key, guard);
+    }
+    return guard(req, res, next);
+  };
+  router.use(noStore, guestForbidden(isGuestRequest), requireLocal, perPort('host', requireLocalHost));
+  return { router, mutating: [perPort('origin', requireSameOriginJson), uiOnly] };
+}
+
+/**
+ * @param {object} deps
+ * @param {ReturnType<typeof createAppSettingsStore>} deps.store
+ * @param {ReturnType<import('./login-start.js').createLoginStart>} deps.loginStart
+ * @param {{ data: string, logs: string }} deps.folders
+ * @param {string} deps.install         'npm' | 'git' | 'app' | 'desktop'
+ * @param {(auto: boolean) => void} [deps.onAutoUpdateChange]
+ * @param {(path: string) => Promise<boolean>} [deps.openFolder]
+ */
+export function createAppControlsApi({
+  store, loginStart, folders, install = 'npm', onAutoUpdateChange = () => {}, openFolder = (path) => openFolderOnScreen(path),
+  isGuestRequest = () => false, port = 3344, log = () => {},
+} = {}) {
+  if (!store || !loginStart || !folders) throw new Error('createAppControlsApi needs the settings store, the login start and the folders');
+  const { router, mutating } = localRouter({ isGuestRequest, port });
+  const desktop = install === 'desktop';
+
+  const body = () => {
+    let startup;
+    try { startup = loginStart.status(); } catch (error) { startup = { supported: false, reason: 'unsupported', enabled: false, state: 'off', owner: null, error: String(error?.message || error) }; }
+    return { ok: true, install, desktop, updates: { auto: store.get().autoUpdateCheck !== false }, startup };
+  };
+
+  router.get('/', (req, res) => { res.json(body()); });
+
+  router.put('/updates', ...mutating, (req, res) => {
+    const auto = req.body?.auto;
+    if (typeof auto !== 'boolean') return res.status(400).json({ ok: false, code: 'BAD_REQUEST', error: 'Send { auto: true | false }.' });
+    if (desktop) return res.status(409).json({ ok: false, code: 'DESKTOP_MANAGED', error: 'The SynaBun app keeps this setting itself.' });
+    try { store.set({ autoUpdateCheck: auto }); } catch (error) {
+      return res.status(500).json({ ok: false, code: 'SAVE_FAILED', error: String(error?.message || error) });
+    }
+    try { onAutoUpdateChange(auto); } catch {}
+    res.json(body());
+  });
+
+  router.put('/startup', ...mutating, async (req, res) => {
+    const enabled = req.body?.enabled;
+    if (typeof enabled !== 'boolean') return res.status(400).json({ ok: false, code: 'BAD_REQUEST', error: 'Send { enabled: true | false }.' });
+    try {
+      await loginStart.set(enabled);
+    } catch (error) {
+      const code = String(error?.code || 'refused');
+      log(`[app] start at login could not be turned ${enabled ? 'on' : 'off'}: ${error?.message || error}`);
+      return res.status(409).json({ ...body(), ok: false, code, error: String(error?.message || error).slice(0, 300) });
+    }
+    res.json(body());
+  });
+
+  router.post('/open-folder', ...mutating, async (req, res) => {
+    const which = req.body?.which;
+    if (which !== 'data' && which !== 'logs') return res.status(400).json({ ok: false, code: 'BAD_REQUEST', error: "Send { which: 'data' | 'logs' }." });
+    const opened = await openFolder(folders[which]).catch(() => false);
+    if (!opened) return res.status(422).json({ ok: false, code: 'NO_FILE_MANAGER', error: 'No file manager opened the folder.' });
+    res.json({ ok: true });
+  });
+
+  return router;
+}

package/neural-interface/lib/assistant-api.js

@@ -17,6 +17,7 @@ import { tooLargeMessage } from './assistant-attachments.js';
 import { getSessionPolicy, requiresHumanApproval } from './remote-policy.js';
 import { clampPlanDispatch, PLAN_DISPATCH_NOTE, runCanChangeCode } from './assistant-plan-permissions.js';
 import { noStore, requireJson, requireLocal, requireLocalHost, sendGuardError } from './http-guards.js';
+import { setUntrustedFileHeaders } from './untrusted-file-headers.js';
 
 /** The header whatsapp_send_file's caller proves it is the WhatsApp conversation's own brain with (assistant-runtime.js BRAIN_CREDENTIAL_RE). */
 export const BRAIN_CREDENTIAL_HEADER = 'x-synabun-brain-token';
@@ -150,6 +151,8 @@ export function createAssistantApi({
   // after this router), and the port the server listens on (the Host check of that route).
   whatsapp = null,
   port = 3344,
+  // The Admin sandbox setting (lib/agent-sandbox-setting.js): one global value for every agent SynaBun starts.
+  adminSandbox = null,
 } = {}) {
   if (!dispatcher) throw new Error('createAssistantApi requires a dispatcher');
   const router = Router();
@@ -299,7 +302,10 @@ export function createAssistantApi({
   // ── catalog ────────────────────────────────────────────────────────────────
   router.get('/catalog', async (req, res) => {
     try {
-      await accountUsage?.refresh();
+      // Quotas are shown as last read and read again in the background (the probe can take seconds; the
+      // dispatcher and the router read them fresh before they choose an account).
+      accountUsage?.refresh()?.catch?.(() => {});
+      const usage = () => accountUsage?.list({ stale: true });
       // refresh=1 rebuilds from the providers' endpoints; deep=1 also makes them ask the CLI / app-server again.
       const deep = req.query.deep === '1';
       const force = req.query.refresh === '1' || deep;
@@ -318,8 +324,8 @@ export function createAssistantApi({
         // names none.
         const accounts = {
           ...(brief.accounts || {}),
-          ...(claudeAccounts ? { 'claude-code': accountUsage?.list()?.['claude-code'] || claudeAccounts.listForClient() } : {}),
-          ...(codexAccounts ? { codex: accountUsage?.list()?.codex || codexAccounts.listForClient() } : {}),
+          ...(claudeAccounts ? { 'claude-code': usage()?.['claude-code'] || claudeAccounts.listForClient() } : {}),
+          ...(codexAccounts ? { codex: usage()?.codex || codexAccounts.listForClient() } : {}),
         };
         return res.json({ ok: true, generatedAt: new Date(now()).toISOString(), ...brief, accounts, claudeWorkerAccount: claudeWorkerAccountId(), codexWorkerAccount: codexWorkerAccountId(), limits: dispatcher.limits, runs: dispatcher.list({ activeOnly: true }), totals: dispatcher.totals() });
       }
@@ -327,7 +333,7 @@ export function createAssistantApi({
       // within seconds), so it is asked every time: this answer is reused only while it hands back the
       // build the answer was made from (a rebuild or invalidate() gives another one).
       const base = typeof buildCatalog === 'function' ? await buildCatalog({ force, deep }) : NO_CATALOG;
-      if (!force && catalogCache && catalogCache.base === base && now() - catalogCache.at < 30_000) return res.json(accountUsage ? { ...catalogCache.value, accounts: { ...catalogCache.value.accounts, ...accountUsage.list() } } : catalogCache.value);
+      if (!force && catalogCache && catalogCache.base === base && now() - catalogCache.at < 30_000) return res.json(accountUsage ? { ...catalogCache.value, accounts: { ...catalogCache.value.accounts, ...usage() } } : catalogCache.value);
       // Hidden rows stay server-side (view=manage lists them); the lists themselves ship.
       const { hiddenRows: _hiddenRows, ...visible } = base || {};
       const value = {
@@ -336,8 +342,8 @@ export function createAssistantApi({
         ...visible,
         accounts: {
           ...(base.accounts || {}),
-          'claude-code': accountUsage?.list()?.['claude-code'] || (claudeAccounts ? claudeAccounts.listForClient() : (base.accounts?.['claude-code'] || [])),
-          codex: accountUsage?.list()?.codex || (codexAccounts ? codexAccounts.listForClient() : (base.accounts?.codex || [])),
+          'claude-code': usage()?.['claude-code'] || (claudeAccounts ? claudeAccounts.listForClient() : (base.accounts?.['claude-code'] || [])),
+          codex: usage()?.codex || (codexAccounts ? codexAccounts.listForClient() : (base.accounts?.codex || [])),
         },
         claudeWorkerAccount: claudeWorkerAccountId(),
         codexWorkerAccount: codexWorkerAccountId(),
@@ -834,6 +840,8 @@ export function createAssistantApi({
       'Accept-Ranges': 'bytes', 'X-Content-Type-Options': 'nosniff', 'Cache-Control': 'private, max-age=3600',
     });
     if (range) res.set('Content-Range', `bytes ${start}-${end}/${size}`);
+    // A run's media is what a worker made: opened by its address it runs nothing, and an SVG is a download.
+    setUntrustedFileHeaders(res, file.path, file.mime);
     if (req.method === 'HEAD' || !size) { await handle.close().catch(() => {}); return res.end(); }
     const stream = handle.createReadStream({ start, end });
     stream.on('error', () => res.destroy());
@@ -994,9 +1002,17 @@ export function createAssistantApi({
     if (!requireRuntime(res)) return;
     try { res.json({ ok: true, session: await runtime.closeSession(req.params.id) }); } catch (error) { sendError(res, error); }
   });
+  // Remove (the Sessions menu): the record, its transcript and its usage journal go for good, after its
+  // running turn and the workers it dispatched are stopped. Memories made from it stay.
   router.delete('/sessions/:id', async (req, res) => {
     if (!requireRuntime(res)) return;
-    try { res.json({ ok: true, removed: await runtime.destroySession(req.params.id) }); } catch (error) { sendError(res, error); }
+    try {
+      if (runtime.removeSession) {
+        const { removed, stoppedRuns } = await runtime.removeSession(req.params.id);
+        return res.json({ ok: true, removed, stoppedRuns });
+      }
+      res.json({ ok: true, removed: await runtime.destroySession(req.params.id) });
+    } catch (error) { sendError(res, error); }
   });
 
   // ── attachments ────────────────────────────────────────────────────────────
@@ -1230,6 +1246,23 @@ export function createAssistantApi({
     } catch (error) { sendError(res, error); }
   });
 
+  // ── Admin sandbox (lib/agent-sandbox-setting.js) ───────────────────────────
+  // Whether an agent SynaBun starts may use a sandbox whose setup needs Windows administrator
+  // approval. Global, not per session. The user's setting: an agent cannot change it.
+  router.get('/admin-sandbox', (req, res) => {
+    if (!adminSandbox) return res.status(503).json({ ok: false, code: 'ADMIN_SANDBOX_UNAVAILABLE', error: 'The Admin sandbox setting is not available on this server' });
+    res.json({ ok: true, ...adminSandbox.view() });
+  });
+  router.put('/admin-sandbox', requireJson, (req, res) => {
+    if (!adminSandbox) return res.status(503).json({ ok: false, code: 'ADMIN_SANDBOX_UNAVAILABLE', error: 'The Admin sandbox setting is not available on this server' });
+    if (callerContext(req).kind !== 'ui' || req.get('x-synabun-desktop-grant')) {
+      return res.status(403).json({ ok: false, code: 'UI_ONLY', error: 'Only the user can change the Admin sandbox.' });
+    }
+    const value = req.body?.adminSandbox;
+    if (typeof value !== 'boolean') return res.status(400).json({ ok: false, code: 'INVALID_VALUE', error: 'adminSandbox must be true or false.' });
+    try { res.json({ ok: true, ...adminSandbox.set(value) }); } catch (error) { sendError(res, error); }
+  });
+
   // ── sidepanel tab registry (UI heartbeat) ──────────────────────────────────
   function listTabs() {
     const cutoff = now() - tabTtlMs;

package/neural-interface/lib/assistant-brains/opencode.js

@@ -36,6 +36,12 @@ export function opencodeImageParts(images = []) {
 
 /** The route-gate plugin (opencode-route-gate.js) as a file URL the serve can load. */
 export const OPENCODE_ROUTE_GATE_PLUGIN = pathToFileURL(resolve(dirname(fileURLToPath(import.meta.url)), 'opencode-route-gate.js')).href;
+/**
+ * The same gate for OpenCode 2 (opencode2-route-gate/: OpenCode 2 loads a plugin
+ * folder from the config's `plugins` list). Both entries are written: OpenCode 1
+ * ignores `plugins`, OpenCode 2 skips the 1.x file (a warning in its log).
+ */
+export const OPENCODE2_ROUTE_GATE_PLUGIN = pathToFileURL(resolve(dirname(fileURLToPath(import.meta.url)), 'opencode2-route-gate')).href;
 
 /**
  * SynaBun's plan agent. OpenCode adds its own read-only reminder ("commands may
@@ -96,9 +102,15 @@ export function patchOpenCodeAssistantConfig(xdgRoot, { persona = '', role = 'as
   // read-only classifier decides on the whole line.
   config.agent.plan = { ...(config.agent.plan || {}), permission: { ...(config.agent.plan?.permission || {}), bash: 'ask' } };
   const plugins = (Array.isArray(config.plugin) ? config.plugin : []).filter((entry) => (Array.isArray(entry) ? entry[0] : entry) !== OPENCODE_ROUTE_GATE_PLUGIN);
+  const plugins2 = (Array.isArray(config.plugins) ? config.plugins : []).filter((entry) => (entry && typeof entry === 'object' ? entry.package : entry) !== OPENCODE2_ROUTE_GATE_PLUGIN);
   // `remote`: a WhatsApp session's serve — the plugin refuses a call it could not check (fail closed).
-  if (routeGate?.url && routeGate?.session && routeGate?.token) plugins.push([OPENCODE_ROUTE_GATE_PLUGIN, { url: routeGate.url, session: routeGate.session, token: routeGate.token, ...(routeGate.remote === true ? { remote: true } : {}) }]);
+  if (routeGate?.url && routeGate?.session && routeGate?.token) {
+    const options = { url: routeGate.url, session: routeGate.session, token: routeGate.token, ...(routeGate.remote === true ? { remote: true } : {}) };
+    plugins.push([OPENCODE_ROUTE_GATE_PLUGIN, options]);
+    plugins2.push({ package: OPENCODE2_ROUTE_GATE_PLUGIN, options });
+  }
   if (plugins.length) config.plugin = plugins; else delete config.plugin;
+  if (plugins2.length) config.plugins = plugins2; else delete config.plugins;
   writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n', 'utf8');
   // It carries this brain's grants (the desktop grant): readable by this user only.
   try { chmodSync(configPath, 0o600); } catch { /* a filesystem without modes */ }

package/neural-interface/lib/assistant-brains/opencode2-browser-policy/index.js

@@ -0,0 +1,44 @@
+// SynaBun — an Assistant task run's browser policy as an OpenCode 2 plugin.
+// The same policy as ../opencode-browser-policy.js (read that file for what it
+// does and why), for OpenCode 2's plugin API: a directory OpenCode loads from
+// the config's `plugins` entry, whose default export is `{ id, setup(context) }`
+// with a hook on `tool.execute.before`; a refusal is thrown. OpenCode 2 calls
+// the shell tool `shell` and the sub-agent tool `subagent`: the policy, written
+// for OpenCode 1's names, is asked with `bash` and `task`.
+
+// An absolute file URL: the policy loads from SynaBun's lib/ wherever OpenCode imports this file from.
+const POLICY_URL = new URL('../../browser-tool-policy.js', import.meta.url).href;
+const V1_NAMES = { shell: 'bash', subagent: 'task' };
+
+// OpenCode's own tools that run no command and fetch no page (OpenCode 1's names).
+const OWN_TOOLS = new Set([
+  'read', 'list', 'glob', 'grep', 'edit', 'write', 'patch', 'multiedit', 'apply_patch', 'todowrite', 'todoread',
+  'task', 'skill', 'lsp', 'codesearch', 'question', 'batch', 'invalid', 'plan_exit', 'plan_enter',
+]);
+
+export default {
+  id: 'synabun.browser-policy',
+  async setup(context) {
+    const options = context?.options || {};
+    let policy = null;
+    let loadError = null;
+    try { policy = await import(POLICY_URL); } catch (error) { loadError = error; }
+    const cwd = (typeof options.cwd === 'string' && options.cwd) || context?.location?.directory || process.cwd();
+    if (typeof policy?.browserToolDenial !== 'function') {
+      const why = loadError?.message || 'browserToolDenial is missing';
+      console.error(`[SynaBun] browser policy could not load from ${POLICY_URL} (${why}); refusing bash, webfetch, websearch and other servers' tools for this run`);
+      await context.tool.hook('execute.before', async (call) => {
+        const raw = String(call?.tool || '');
+        const tool = V1_NAMES[raw] || raw;
+        if (/^synabun_/i.test(tool) || OWN_TOOLS.has(tool.toLowerCase())) return;
+        throw new Error(`SynaBun browser policy: ${tool} was refused — SynaBun's browser policy could not load (${why}), so no command, web tool or other server's tool can be checked for a browser launch. SynaBun's own tools (SynaBun_*) and file tools still work. Stop and report this.`);
+      });
+      return;
+    }
+    await context.tool.hook('execute.before', async (call) => {
+      const raw = String(call?.tool || '');
+      const reason = policy.browserToolDenial(V1_NAMES[raw] || raw, call?.input || {}, { host: 'opencode', cwd });
+      if (reason) throw new Error(reason);
+    });
+  },
+};

package/neural-interface/lib/assistant-brains/opencode2-route-gate/index.js

@@ -0,0 +1,57 @@
+// SynaBun — the Assistant's route gate as an OpenCode 2 plugin.
+// The same gate as ../opencode-route-gate.js (read that file for what it does
+// and why), for OpenCode 2's plugin API: a directory OpenCode loads from the
+// config's `plugins` entry ({ package: <this folder as a file URL>, options }),
+// whose default export is `{ id, setup(context) }`; a hook on
+// `tool.execute.before` sees `{ tool, sessionID, input }` and refuses a call by
+// throwing (OpenCode records the message as that tool's error). OpenCode 2
+// calls two tools by other names than OpenCode 1 (`shell` for bash,
+// `subagent` for task): the gate is asked with OpenCode 1's names, which the
+// rest of SynaBun knows. OpenCode 1 never reads this folder (it loads the
+// `plugin` entry), and OpenCode 2 never loads the 1.x file.
+
+const MAX_INPUT_BYTES = 256 * 1024;
+const UNCHECKED = 'SynaBun could not check this call, so a WhatsApp session does not run it.';
+const V1_NAMES = { shell: 'bash', subagent: 'task' };
+
+/** { input, inputComplete }: the whole arguments when small enough to send, else their command/action. */
+function callArguments(args) {
+  if (!args || typeof args !== 'object' || Array.isArray(args)) return { input: {}, inputComplete: false };
+  let size = Infinity;
+  try { size = JSON.stringify(args).length; } catch {}
+  if (size <= MAX_INPUT_BYTES) return { input: args, inputComplete: true };
+  const subset = {};
+  for (const key of ['command', 'action']) {
+    if (typeof args[key] === 'string' && args[key].length <= 64 * 1024) subset[key] = args[key];
+  }
+  return { input: subset, inputComplete: false };
+}
+
+export default {
+  id: 'synabun.route-gate',
+  async setup(context) {
+    const { url, session, token, remote = false } = context?.options || {};
+    if (!url || !session || !token) return;
+    const post = (body) => fetch(url, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ session, token, host: 'opencode', ...body }),
+      signal: AbortSignal.timeout(5000),
+    });
+    // Never blocks loading; a lost hello only keeps the reactive fallback on.
+    post({ hello: true }).catch(() => {});
+    await context.tool.hook('execute.before', async (call) => {
+      const name = String(call?.tool || '');
+      let decision = null;
+      try {
+        const response = await post({ tool: V1_NAMES[name] || name, providerSessionId: call?.sessionID || null, ...callArguments(call?.input) });
+        decision = await response.json();
+      } catch {
+        if (remote === true) throw new Error(UNCHECKED);
+        return;
+      }
+      if (decision && decision.allow === false) throw new Error(String(decision.reason || 'SynaBun route gate: call agent_route first.'));
+      if (remote === true && !(decision && decision.allow === true)) throw new Error(UNCHECKED);
+    });
+  },
+};

package/neural-interface/lib/assistant-catalog.js

@@ -605,6 +605,8 @@ export function compactRow(row) {
  * @param {(change:{providers:string[], generatedAt:string})=>void} [deps.onChange] a build listed other
  *   models than the build before it (hiding has its own event and does not count)
  * @param {number} [deps.retryMs] how soon a build is redone while Claude Code or Codex gave no verified list
+ * @param {boolean} [deps.staleWhileRevalidate] an old build (past its lifetime) is given at once and built
+ *   again in the background, one build at a time; only a first build, invalidate() and force wait for one
  */
 export function createAssistantCatalog({
   fetchJson,
@@ -617,6 +619,7 @@ export function createAssistantCatalog({
   onChange = null,
   ttlMs = 30_000,
   retryMs = 5_000,
+  staleWhileRevalidate = false,
   now = Date.now,
   log = () => {},
 } = {}) {
@@ -753,7 +756,17 @@ export function createAssistantCatalog({
    */
   async function full({ force = false, deep = false } = {}) {
     if (!force && !deep && cache && now() - cache.at < cache.ttl) return cache.value;
+    // Past its lifetime: with staleWhileRevalidate the old build is the answer while the next one is made
+    // (never a build that began before an invalidate(): `current` says it was made for the lists as they are).
+    if (staleWhileRevalidate && !force && !deep && cache?.current) {
+      if (!inflight) startBuild({ deep: false }).catch((error) => log('catalog:background-error', error?.message || String(error)));
+      return cache.value;
+    }
     if (inflight) return inflight;
+    return startBuild({ deep });
+  }
+
+  function startBuild({ deep = false } = {}) {
     const started = epoch;
     inflight = build({ deep }).then((built) => {
       const { changedProviders, ...value } = built;
@@ -762,7 +775,7 @@ export function createAssistantCatalog({
       const degraded = ['claude-code', 'codex'].some((p) => value.sources[p] !== 'live');
       degradedBuilds = degraded ? degradedBuilds + 1 : 0;
       const ttl = degraded ? Math.min(ttlMs, retryMs * 2 ** (degradedBuilds - 1)) : ttlMs;
-      cache = { at: now(), value, ttl: started === epoch ? ttl : 0 };
+      cache = { at: now(), value, ttl: started === epoch ? ttl : 0, current: started === epoch };
       if (changedProviders.length && typeof onChange === 'function') {
         try { onChange({ providers: changedProviders, generatedAt: value.generatedAt }); } catch (error) { log('catalog:onchange-error', error?.message || String(error)); }
       }
@@ -872,6 +885,8 @@ export function createAssistantCatalog({
   }
 
   function invalidate() { cache = null; epoch += 1; }
+  /** The lists may have changed (a serve restarted, a CLI updated): the next read still answers with this build and makes the next one. */
+  function markStale() { if (cache) cache = { ...cache, at: -Infinity }; }
   /** A provider's own list changed: drop the copy and build the next one now (onChange reports the difference). */
   function refresh() {
     invalidate();
@@ -879,5 +894,5 @@ export function createAssistantCatalog({
     return pending ? pending.catch(() => null).then(() => full()) : full();
   }
 
-  return { get, full, peek, find, hiddenId, manageRows, manageSnapshot, brainInfo, invalidate, refresh };
+  return { get, full, peek, find, hiddenId, manageRows, manageSnapshot, brainInfo, invalidate, markStale, refresh };
 }

package/neural-interface/lib/assistant-dispatch.js

@@ -1894,6 +1894,9 @@ export function createAssistantDispatcher({
       liveState.turnTokens = null;
       entry.turns = [...(entry.turns || []), turn].slice(-50);
       entry.lastResult = parsed;
+      // The run's own descriptor (lib/native-loop-runtime.js) carries it too, for the surfaces that read that one
+      // (the OpenCode panel's pill): a warm worker whose turn ended asking waits on the user, it does not rest.
+      ctx.setOutcome?.(parsed.status || null);
       entry.lastText = text.slice(0, 20_000);
       // The turn has ended: its result is in. Idle time from here on is not work.
       pauseWork(entry, liveState);

package/neural-interface/lib/assistant-envelope.js

@@ -449,7 +449,7 @@ export function opencodeControlResponse(pending, response = {}) {
 export function createOpenCodeEnvelopeTranslator({ sessionId, emit, onTurnEnd = () => {}, onUsageEvent = () => {}, brain = {}, planTurn = () => false } = {}) {
   // costUsd is the session's running total: OpenCode reports cost per assistant
   // message, so costs are summed by message id (the runtime takes deltas).
-  const state = { sessionId, roles: new Map(), order: [], textParts: new Map(), reasoningParts: new Map(), tools: new Map(), started: false, announcedInit: false, lastText: '', costUsd: 0, costByMessage: new Map(), usage: null };
+  const state = { sessionId, roles: new Map(), order: [], textParts: new Map(), reasoningParts: new Map(), partKinds: new Map(), tools: new Map(), started: false, announcedInit: false, lastText: '', costUsd: 0, costByMessage: new Map(), usage: null };
   const event = (payload) => emit({ type: 'event', event: payload });
   const belongs = (ev) => {
     const sid = ev?.sessionID || ev?.sessionId || ev?.part?.sessionID || ev?.info?.sessionID || ev?.info?.id || ev?.session?.id || null;
@@ -485,12 +485,15 @@ export function createOpenCodeEnvelopeTranslator({ sessionId, emit, onTurnEnd =
   function handlePart(part = {}) {
     if (!part.messageID) return;
     if (state.roles.get(part.messageID) === 'user') return;
+    if ((part.type === 'text' || part.type === 'reasoning') && part.id) state.partKinds.set(part.id, { messageID: part.messageID, type: part.type });
     if (part.type === 'text' && typeof part.text === 'string') {
       let parts = state.textParts.get(part.messageID);
       if (!parts) { parts = new Map(); state.textParts.set(part.messageID, parts); }
       const key = part.id || `${parts.size}`;
       const prev = parts.get(key) || '';
       const next = part.text;
+      // An update made before the deltas that already arrived streams nothing again.
+      if (prev.length > next.length && prev.startsWith(next)) return;
       parts.set(key, next);
       const delta = next.startsWith(prev) ? next.slice(prev.length) : next;
       const shown = delta && planTurn() === true ? planTextDelta(`${part.messageID}:${key}`, delta) : delta;
@@ -500,6 +503,7 @@ export function createOpenCodeEnvelopeTranslator({ sessionId, emit, onTurnEnd =
     if (part.type === 'reasoning' && typeof part.text === 'string') {
       const key = `${part.messageID}:${part.id || 'r'}`;
       const prev = state.reasoningParts.get(key) || '';
+      if (prev.length > part.text.length && prev.startsWith(part.text)) return;
       state.reasoningParts.set(key, part.text);
       const delta = part.text.startsWith(prev) ? part.text.slice(prev.length) : part.text;
       if (delta) { startIfNeeded(); event(thinkingDelta(delta)); }
@@ -521,6 +525,19 @@ export function createOpenCodeEnvelopeTranslator({ sessionId, emit, onTurnEnd =
       }
     }
   }
+  // A part's text arrives as `message.part.delta` between the update that announces the part and the one that
+  // ends it (OpenCode 2 streams only this way, through lib/opencode2-translate.js): each delta extends that part,
+  // and streams as an update would. A delta for a part not announced yet is left to the update that ends it,
+  // which carries the whole text.
+  function handleDelta(ev = {}) {
+    if ((ev.field && ev.field !== 'text') || typeof ev.delta !== 'string' || !ev.delta) return;
+    const known = state.partKinds.get(ev.partID);
+    if (!known || (ev.messageID && ev.messageID !== known.messageID)) return;
+    const prev = known.type === 'text'
+      ? state.textParts.get(known.messageID)?.get(ev.partID) || ''
+      : state.reasoningParts.get(`${known.messageID}:${ev.partID}`) || '';
+    handlePart({ id: ev.partID, messageID: known.messageID, type: known.type, text: `${prev}${ev.delta}` });
+  }
   return {
     state,
     handle(eventType, ev = {}) {
@@ -546,6 +563,7 @@ export function createOpenCodeEnvelopeTranslator({ sessionId, emit, onTurnEnd =
         return true;
       }
       if (/^message[.:]part[.:]updated$/i.test(eventType)) { handlePart(ev.part || {}); return true; }
+      if (/^message[.:]part[.:]delta$/i.test(eventType)) { handleDelta(ev); return true; }
       if (/^session[.:]idle$/i.test(eventType)) {
         if (state.errored) { state.errored = false; state.started = false; return true; } // error already closed this turn
         const said = latestAssistantText();

package/neural-interface/lib/assistant-route-gate-codex.js

@@ -19,6 +19,7 @@ import { mkdirSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { CODEX_PROBE_SANDBOX_ARGS } from './agent-sandbox-elevation.js';
 
 export const CODEX_GATE_HOOK_PATH = resolve(dirname(fileURLToPath(import.meta.url)), 'assistant-brains', 'codex-route-gate-hook.mjs');
 export const CODEX_BROWSER_POLICY_HOOK_PATH = resolve(dirname(fileURLToPath(import.meta.url)), 'assistant-brains', 'codex-browser-policy-hook.mjs');
@@ -80,7 +81,8 @@ function probe({ codexBin, command, timeoutMs, spawnImpl }) {
     if (codexNeedsShell(bin)) { done(null); return; }
     const home = resolve(tmpdir(), 'synabun-codex-gate-probe');
     try { mkdirSync(home, { recursive: true }); } catch {}
-    const args = [...codexGateHookFlags(command), 'app-server'];
+    // A probe runs no command: the Windows sandbox that needs no administrator (lib/agent-sandbox-elevation.js).
+    const args = [...codexGateHookFlags(command), ...CODEX_PROBE_SANDBOX_ARGS, 'app-server'];
     if (/\.js$/i.test(bin)) { args.unshift(bin); bin = process.execPath; }
     let proc;
     try {