synabun 2.0.7 → 2.0.10

package/neural-interface/public/shared/desktop-update-view.js

@@ -24,6 +24,7 @@ export const DESKTOP_COPY = Object.freeze({
     tooltip: 'SynaBun update available: v{current} → v{latest}',
     tooltipDownloading: 'Downloading SynaBun v{latest}',
     tooltipReady: 'SynaBun v{latest} is ready: it installs when SynaBun is idle',
+    tooltipReadyOff: 'SynaBun v{latest} is ready to install',
     titleAvailable: 'Update available',
     titleDownloading: 'Downloading the update',
     titleDownloaded: 'Update ready',
@@ -46,6 +47,9 @@ export const DESKTOP_COPY = Object.freeze({
     hide: 'Hide',
     hideHint: 'The download continues while this is hidden. SynaBun installs the update by itself when nothing is running.',
     readyBody: 'SynaBun v{version} is downloaded. It installs by itself once nothing is running: SynaBun shows a one-minute notice, then restarts into it. It also installs when you quit SynaBun.',
+    // Automatic updates off (Settings > App): it waits for Install now.
+    offBody: 'Automatic updates are off. Install now downloads it and restarts SynaBun into it once nothing is running.',
+    readyBodyOff: 'SynaBun v{version} is downloaded. Automatic updates are off: it installs when you choose Install now.',
     waitingBody: 'Waiting for: {list}.',
     countdownBody: 'SynaBun restarts into v{version} in {seconds} s.',
     postponedBody: 'Postponed until {time}. It also installs when you quit SynaBun.',
@@ -62,12 +66,14 @@ export const DESKTOP_COPY = Object.freeze({
     errorFallback: 'SynaBun could not check for updates. Check the connection and try again.',
     errorNext: 'SynaBun keeps the version it runs and tries again at its next check. You can try now, or download the new version yourself.',
     manualLink: 'Download it yourself',
+    settingsLink: 'Update settings',
     close: 'Close',
     retry: 'Try again',
     testFeed: 'test feed',
     metaAvailable: 'From the SynaBun app',
     metaDownloading: 'Downloading: {percent}%',
     metaDownloaded: 'Ready: installs when SynaBun is idle',
+    metaReadyOff: 'Ready to install',
     metaCountdown: 'Restarting to install it',
     metaPostponed: 'Postponed: installs on quit or later',
   }),
@@ -193,6 +199,8 @@ export function readDesktopUpdateState(state) {
     manualFile: text(s.manualFile, 4096),
     testFeed: s.testFeed === true,
     auto: readAuto(s.auto),
+    // Settings > App; an app from before the setting says nothing: on.
+    autoUpdate: s.autoUpdate !== false,
     updated: readUpdated(s.updated),
     releasesUrl: readReleasesUrl(s.releasesUrl),
   };
@@ -236,6 +244,7 @@ export function versionDataFromDesktop(state) {
     testFeed: s.testFeed,
     checkedAt: s.checkedAt,
     auto: s.auto,
+    autoUpdate: s.autoUpdate,
   };
 }
 
@@ -311,11 +320,12 @@ export function desktopUpdateView(state, {
     case 'available':
       view.dot = 1;
       view.title = say('titleAvailable');
-      view.body = [say('snapshot', { version })];
+      view.body = s.autoUpdate ? [say('snapshot', { version })] : [say('offBody'), say('snapshot', { version })];
       view.notesLabel = say('notesLabel');
       view.notes = s.notes || say('notesEmpty');
       view.backup = { id: 'backup', label: say('backup') };
-      view.actions = [action('later', 'ghost', 'later'), action('download', 'primary', 'download')];
+      // Automatic updates off: one click downloads and installs it (no download on its own to wait for).
+      view.actions = [action('later', 'ghost', 'later'), s.autoUpdate ? action('download', 'primary', 'download') : action('install-now', 'primary', 'installNow')];
       break;
     case 'downloading':
       view.dot = 2;
@@ -328,8 +338,8 @@ export function desktopUpdateView(state, {
     case 'downloaded': {
       view.dot = 3;
       view.title = say('titleDownloaded');
-      view.body = [say('readyBody', { version })];
       const auto = s.auto;
+      view.body = [s.autoUpdate || auto?.now ? say('readyBody', { version }) : say('readyBodyOff', { version })];
       if (auto?.phase === 'countdown' && auto.installAt) {
         view.body.push(say('countdownBody', { version, seconds: secondsUntil(auto.installAt, now) }));
         view.ticking = true;
@@ -395,7 +405,7 @@ export function desktopUpdateMeta(state, { t = fillDesktopCopy } = {}) {
     case 'downloaded':
       if (s.auto?.phase === 'countdown') return t('update.metaCountdown');
       if (s.auto?.phase === 'postponed') return t('update.metaPostponed');
-      return t('update.metaDownloaded');
+      return s.autoUpdate || s.auto?.now ? t('update.metaDownloaded') : t('update.metaReadyOff');
     case 'installing': return t('update.titleInstalling');
     case 'available': case 'move': case 'manual': return t('update.metaAvailable');
     default: return '';
@@ -408,7 +418,7 @@ export function desktopUpdateTooltip(state, { t = fillDesktopCopy } = {}) {
   const params = { current: s.current, latest: s.latest || '' };
   const step = desktopUpdateStep(s);
   if (step === 'downloading') return t('update.tooltipDownloading', params);
-  if (step === 'downloaded') return t('update.tooltipReady', params);
+  if (step === 'downloaded') return t(s.autoUpdate || s.auto?.now ? 'update.tooltipReady' : 'update.tooltipReadyOff', params);
   return t('update.tooltip', params);
 }
 

package/neural-interface/public/shared/file-links.js

@@ -36,20 +36,54 @@ const SCHEME_RE = /^([a-z][a-z0-9+.-]*):/i;
 const PLACE_ONLY_RE = /^\d+(?::\d+)?(?:#.*)?$/;
 const LINE_SUFFIX_RE = /:(\d+)(?::(\d+))?$/;
 const LINE_HASH_RE = /^#L(\d+)(?:C(\d+))?(?:-L?\d+(?:C\d+)?)?$/i;
+// Schemes a browser runs or draws content from: never a file's name, not even before a line number.
+const ACTIVE_SCHEMES = new Set(['javascript', 'vbscript', 'livescript', 'data', 'blob', 'filesystem', 'about', 'view-source']);
+// What a scheme can hide behind: a browser drops tabs and line breaks anywhere in a URL and controls at its
+// ends; format characters show nothing; an entity can be left over from a second escape.
+const HIDDEN_RE = /[\u0000-\u001f\u007f-\u009f\u00ad\u200b-\u200f\u2028\u2029\u2060-\u2064\ufeff]/g;
+const ENTITY_RE = /&(?:#(\d+)|#x([0-9a-f]+)|([a-z]+));?/gi;
+const NAMED_ENTITIES = { colon: ':', tab: '\t', newline: '\n', nbsp: ' ', sol: '/', bsol: '\\', num: '#', quest: '?', period: '.', amp: '&', semi: ';', lpar: '(', rpar: ')' };
 
 const slashes = (path) => String(path ?? '').replace(/\\/g, '/');
 
+function decodeEntities(text) {
+  let out = text;
+  for (let round = 0; round < 4; round += 1) { // `&amp;#106;` is `&#106;` once more
+    const next = out.replace(ENTITY_RE, (whole, dec, hex, name) => {
+      if (name) return NAMED_ENTITIES[name.toLowerCase()] ?? whole;
+      const code = dec ? Number(dec) : parseInt(hex, 16);
+      return code > 0 && code <= 0x10ffff ? String.fromCodePoint(code) : '';
+    });
+    if (next === out) break;
+    out = next;
+  }
+  return out;
+}
+
+/** A target as its scheme is read: entities decoded, hidden characters dropped, no spaces at the ends, lower case. */
+function schemeView(value) {
+  return decodeEntities(value).replace(HIDDEN_RE, '').trim().toLowerCase();
+}
+
+// An active scheme, read with its spaces squeezed out too: `java script:` is no URL to a browser, and no file either.
+const isActive = (seen) => ACTIVE_SCHEMES.has(SCHEME_RE.exec(seen.replace(/\s+/g, ''))?.[1]);
+
 /** How a target reads: a `path`, a `file` URL, a `web` address (http, https), or null for anything else. */
 function kindOf(value) {
   if (!value || value.length > MAX_TARGET_LENGTH) return null;
-  if (value.startsWith('#') || value.startsWith('?') || value.startsWith('//')) return null;
+  const seen = schemeView(value);
+  if (!seen || seen.startsWith('#') || seen.startsWith('?') || seen.startsWith('//') || isActive(seen)) return null;
   if (DRIVE_RE.test(value)) return 'path';
-  const scheme = SCHEME_RE.exec(value);
+  const scheme = SCHEME_RE.exec(seen);
   if (!scheme) return 'path';
-  const name = scheme[1].toLowerCase();
+  // A scheme put together from hidden characters or entities (`JaVa\tScript:`, `&#106;avascript:`) is no
+  // file's and no address of this app.
+  const written = SCHEME_RE.exec(value);
+  if (!written || written[1].toLowerCase() !== scheme[1]) return null;
+  const name = scheme[1];
   if (name === 'file') return 'file';
   if (name === 'http' || name === 'https') return 'web';
-  const rest = value.slice(scheme[0].length);
+  const rest = value.slice(written[0].length);
   if (rest.startsWith('//')) return null;
   return PLACE_ONLY_RE.test(rest) ? 'path' : null;
 }
@@ -231,6 +265,33 @@ export function fillFileLinkCopy(key, params = {}) {
 
 // ── The click ──
 
+/**
+ * Whether a link would run a script or draw data when the browser follows it: its `href` (or an SVG link's
+ * `xlink:href`) read the way kindOf reads a target (entities decoded, controls and invisible characters dropped,
+ * lower case), and the scheme the browser itself resolved. Nothing else an anchor carries is asked.
+ * @param {Element} anchor
+ */
+export function isActiveLink(anchor) {
+  for (const name of ['href', 'xlink:href']) {
+    const value = anchor.getAttribute?.(name);
+    if (value != null && isActive(schemeView(String(value)))) return true;
+  }
+  const resolved = typeof anchor.protocol === 'string' ? anchor.protocol.replace(/:$/, '').toLowerCase() : '';
+  return ACTIVE_SCHEMES.has(resolved);
+}
+
+// A kept target is the sanitiser's note of the href as written (safeHref resolved it against the page, or dropped
+// it). It counts only while it is a file's and the href says the same thing; anything else is the href's to say.
+function keptTarget(anchor, href) {
+  const kept = anchor.getAttribute('data-file-target');
+  if (!kept || localFileHref(kept) == null) return null;
+  if (href == null) return kept; // file:, C:\…, name.ext:12: the sanitiser writes no href for them
+  try {
+    const base = anchor.baseURI || `${new URL(href).origin}/`;
+    return new URL(kept.trim(), base).href === new URL(href, base).href ? kept : null;
+  } catch { return null; }
+}
+
 /**
  * What a link points at, as the agent wrote it.
  * @param {Element} anchor
@@ -239,9 +300,9 @@ export function fillFileLinkCopy(key, params = {}) {
  * @returns {{ raw: string, text: boolean } | null}
  */
 export function readFileLink(anchor, { textLinks = '' } = {}) {
-  const kept = anchor.getAttribute('data-file-target');
-  if (kept) return { raw: kept, text: false };
   const href = anchor.getAttribute('href');
+  const kept = keptTarget(anchor, href);
+  if (kept) return { raw: kept, text: false };
   if (textLinks && anchor.matches(textLinks) && (!href || href === '#')) return { raw: anchor.textContent || '', text: true };
   return href ? { raw: href, text: false } : null;
 }
@@ -255,7 +316,8 @@ export function readFileLink(anchor, { textLinks = '' } = {}) {
  * @param {() => string} page.origin the page's origin
  * @param {(key: string, params?: object) => string} page.say a `fileLinks.*` sentence
  * @param {(message: string) => void} page.notify shows a short message
- * @param {(anchor: Element) => void} page.follow goes where a link of this app leads, as the browser would
+ * @param {(anchor: Element) => void} page.follow goes where a link of this app leads, as the browser would (only
+ *   ever for an http(s) address of this app that is the anchor's own href: never a script link)
  */
 export function createFileLinkHandlers(page) {
   const whereOf = (anchor, options) => {
@@ -302,12 +364,15 @@ export function createFileLinkHandlers(page) {
    * @param {(message: string) => void} [options.notify] shows the reason a link was not opened
    * @returns {Promise<string> | null} null when the click is not this handler's (the browser follows the
    *   link as before); else the click is taken and the promise says how it ended: 'opened', 'copied',
-   *   'followed', or the reason the user was told
+   *   'followed', 'blocked' (a script or data link), or the reason the user was told
    */
   function handleClick(event, options = {}) {
     if (event.defaultPrevented || event.button > 0) return null;
     const anchor = event.target?.closest?.('a');
     if (!anchor || (options.within && !options.within.contains(anchor))) return null;
+    // A script or data link in an agent's message goes nowhere, however it is spelled and whatever else the anchor
+    // says (a kept target, a download): the Codex panel's Markdown is not sanitised, so its href can still be one.
+    if (isActiveLink(anchor)) { event.preventDefault(); return Promise.resolve('blocked'); }
     if (anchor.hasAttribute?.('download')) return null; // a file the app itself offers
     const link = readFileLink(anchor, options);
     if (!link) return null;

package/neural-interface/public/shared/html-shell.js

@@ -203,26 +203,34 @@ export function getSharedHTML() {
             <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><circle cx="12" cy="12" r="10"/><ellipse cx="12" cy="12" rx="4" ry="10"/><line x1="2" y1="12" x2="22" y2="12"/><path d="M4.5 7h15M4.5 17h15" stroke-width="1"/></svg></span> ${t('menu.apps.browser')}</span>
             <span class="menu-shortcut" data-keybind-for="launch-browser"></span>
           </div>
-          <div class="menu-item" id="menu-terminal-youtube">
-            <span class="menu-check"></span>
-            <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="currentColor"><path d="M23.498 6.186a3.016 3.016 0 0 0-2.122-2.136C19.505 3.545 12 3.545 12 3.545s-7.505 0-9.377.505A3.017 3.017 0 0 0 .502 6.186C0 8.07 0 12 0 12s0 3.93.502 5.814a3.016 3.016 0 0 0 2.122 2.136c1.871.505 9.376.505 9.376.505s7.505 0 9.377-.505a3.015 3.015 0 0 0 2.122-2.136C24 15.93 24 12 24 12s0-3.93-.502-5.814zM9.545 15.568V8.432L15.818 12l-6.273 3.568z"/></svg></span> ${t('menu.apps.youtube')}</span>
-            <span class="menu-shortcut" data-keybind-for="launch-youtube"></span>
-          </div>
-          <div class="menu-item" id="menu-terminal-discord">
-            <span class="menu-check"></span>
-            <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="currentColor"><path d="M20.317 4.37a19.791 19.791 0 0 0-4.885-1.515.074.074 0 0 0-.079.037c-.21.375-.444.864-.608 1.25a18.27 18.27 0 0 0-5.487 0 12.64 12.64 0 0 0-.617-1.25.077.077 0 0 0-.079-.037A19.736 19.736 0 0 0 3.677 4.37a.07.07 0 0 0-.032.027C.533 9.046-.32 13.58.099 18.057a.082.082 0 0 0 .031.057 19.9 19.9 0 0 0 5.993 3.03.078.078 0 0 0 .084-.028c.462-.63.874-1.295 1.226-1.994a.076.076 0 0 0-.041-.106 13.107 13.107 0 0 1-1.872-.892.077.077 0 0 1-.008-.128 10.2 10.2 0 0 0 .372-.292.074.074 0 0 1 .077-.01c3.928 1.793 8.18 1.793 12.062 0a.074.074 0 0 1 .078.01c.12.098.246.198.373.292a.077.077 0 0 1-.006.127 12.299 12.299 0 0 1-1.873.892.077.077 0 0 0-.041.107c.36.698.772 1.362 1.225 1.993a.076.076 0 0 0 .084.028 19.839 19.839 0 0 0 6.002-3.03.077.077 0 0 0 .032-.054c.5-5.177-.838-9.674-3.549-13.66a.061.061 0 0 0-.031-.03zM8.02 15.33c-1.183 0-2.157-1.085-2.157-2.419 0-1.333.956-2.419 2.157-2.419 1.21 0 2.176 1.095 2.157 2.42 0 1.333-.956 2.418-2.157 2.418zm7.975 0c-1.183 0-2.157-1.085-2.157-2.419 0-1.333.955-2.419 2.157-2.419 1.21 0 2.176 1.095 2.157 2.42 0 1.333-.946 2.418-2.157 2.418z"/></svg></span> Discord</span>
-          </div>
-          <div class="menu-item" id="menu-terminal-x">
-            <span class="menu-check"></span>
-            <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="currentColor"><path d="M18.244 2.25h3.308l-7.227 8.26 8.502 11.24H16.17l-5.214-6.817L4.99 21.75H1.68l7.73-8.835L1.254 2.25H8.08l4.713 6.231zm-1.161 17.52h1.833L7.084 4.126H5.117z"/></svg></span> X</span>
-          </div>
-          <div class="menu-item" id="menu-terminal-whatsapp">
-            <span class="menu-check"></span>
-            <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="currentColor"><path d="M17.472 14.382c-.297-.149-1.758-.867-2.03-.967-.273-.099-.471-.148-.67.15-.197.297-.767.966-.94 1.164-.173.199-.347.223-.644.075-.297-.15-1.255-.463-2.39-1.475-.883-.788-1.48-1.761-1.653-2.059-.173-.297-.018-.458.13-.606.134-.133.298-.347.446-.52.149-.174.198-.298.298-.497.099-.198.05-.371-.025-.52-.075-.149-.669-1.612-.916-2.207-.242-.579-.487-.5-.669-.51-.173-.008-.371-.01-.57-.01-.198 0-.52.074-.792.372-.272.297-1.04 1.016-1.04 2.479 0 1.462 1.065 2.875 1.213 3.074.149.198 2.096 3.2 5.077 4.487.709.306 1.262.489 1.694.625.712.227 1.36.195 1.871.118.571-.085 1.758-.719 2.006-1.413.248-.694.248-1.289.173-1.413-.074-.124-.272-.198-.57-.347m-5.421 7.403h-.004a9.87 9.87 0 01-5.031-1.378l-.361-.214-3.741.982.998-3.648-.235-.374a9.86 9.86 0 01-1.51-5.26c.001-5.45 4.436-9.884 9.888-9.884 2.64 0 5.122 1.03 6.988 2.898a9.825 9.825 0 012.893 6.994c-.003 5.45-4.437 9.884-9.885 9.884m8.413-18.297A11.815 11.815 0 0012.05 0C5.495 0 .16 5.335.157 11.892c0 2.096.547 4.142 1.588 5.945L.057 24l6.305-1.654a11.882 11.882 0 005.683 1.448h.005c6.554 0 11.89-5.335 11.893-11.893a11.821 11.821 0 00-3.48-8.413z"/></svg></span> WhatsApp</span>
-          </div>
-          <div class="menu-item" id="menu-app-leonardo" hidden>
-            <span class="menu-check"></span>
-            <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="currentColor"><path d="M9.5 2l1.5 3.5L14.5 7l-3.5 1.5L9.5 12l-1.5-3.5L4.5 7l3.5-1.5L9.5 2zM19 10l1 2 2 1-2 1-1 2-1-2-2-1 2-1 1-2zM5 17l1 2 2 1-2 1-1 2-1-2-2-1 2-1 1-2z"/></svg></span> Leonardo.AI</span>
+          <!-- Browser apps: a submenu (ui-menubar.js wireSubmenus) -->
+          <div class="menu-item menu-submenu-parent" id="menu-browser-apps" data-submenu="browser-apps" aria-haspopup="menu" aria-expanded="false">
+            <span class="menu-check"></span>
+            <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7" rx="1"/><rect x="14" y="3" width="7" height="7" rx="1"/><rect x="3" y="14" width="7" height="7" rx="1"/><rect x="14" y="14" width="7" height="7" rx="1"/></svg></span> ${t('menu.apps.browserApps')}</span>
+            <span class="menu-submenu-arrow" aria-hidden="true"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg></span>
+          </div>
+          <div class="menubar-submenu" data-submenu-for="browser-apps" role="menu">
+            <div class="menu-item" id="menu-terminal-youtube">
+              <span class="menu-check"></span>
+              <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="currentColor"><path d="M23.498 6.186a3.016 3.016 0 0 0-2.122-2.136C19.505 3.545 12 3.545 12 3.545s-7.505 0-9.377.505A3.017 3.017 0 0 0 .502 6.186C0 8.07 0 12 0 12s0 3.93.502 5.814a3.016 3.016 0 0 0 2.122 2.136c1.871.505 9.376.505 9.376.505s7.505 0 9.377-.505a3.015 3.015 0 0 0 2.122-2.136C24 15.93 24 12 24 12s0-3.93-.502-5.814zM9.545 15.568V8.432L15.818 12l-6.273 3.568z"/></svg></span> ${t('menu.apps.youtube')}</span>
+              <span class="menu-shortcut" data-keybind-for="launch-youtube"></span>
+            </div>
+            <div class="menu-item" id="menu-terminal-discord">
+              <span class="menu-check"></span>
+              <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="currentColor"><path d="M20.317 4.37a19.791 19.791 0 0 0-4.885-1.515.074.074 0 0 0-.079.037c-.21.375-.444.864-.608 1.25a18.27 18.27 0 0 0-5.487 0 12.64 12.64 0 0 0-.617-1.25.077.077 0 0 0-.079-.037A19.736 19.736 0 0 0 3.677 4.37a.07.07 0 0 0-.032.027C.533 9.046-.32 13.58.099 18.057a.082.082 0 0 0 .031.057 19.9 19.9 0 0 0 5.993 3.03.078.078 0 0 0 .084-.028c.462-.63.874-1.295 1.226-1.994a.076.076 0 0 0-.041-.106 13.107 13.107 0 0 1-1.872-.892.077.077 0 0 1-.008-.128 10.2 10.2 0 0 0 .372-.292.074.074 0 0 1 .077-.01c3.928 1.793 8.18 1.793 12.062 0a.074.074 0 0 1 .078.01c.12.098.246.198.373.292a.077.077 0 0 1-.006.127 12.299 12.299 0 0 1-1.873.892.077.077 0 0 0-.041.107c.36.698.772 1.362 1.225 1.993a.076.076 0 0 0 .084.028 19.839 19.839 0 0 0 6.002-3.03.077.077 0 0 0 .032-.054c.5-5.177-.838-9.674-3.549-13.66a.061.061 0 0 0-.031-.03zM8.02 15.33c-1.183 0-2.157-1.085-2.157-2.419 0-1.333.956-2.419 2.157-2.419 1.21 0 2.176 1.095 2.157 2.42 0 1.333-.956 2.418-2.157 2.418zm7.975 0c-1.183 0-2.157-1.085-2.157-2.419 0-1.333.955-2.419 2.157-2.419 1.21 0 2.176 1.095 2.157 2.42 0 1.333-.946 2.418-2.157 2.418z"/></svg></span> Discord</span>
+            </div>
+            <div class="menu-item" id="menu-terminal-x">
+              <span class="menu-check"></span>
+              <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="currentColor"><path d="M18.244 2.25h3.308l-7.227 8.26 8.502 11.24H16.17l-5.214-6.817L4.99 21.75H1.68l7.73-8.835L1.254 2.25H8.08l4.713 6.231zm-1.161 17.52h1.833L7.084 4.126H5.117z"/></svg></span> X</span>
+            </div>
+            <div class="menu-item" id="menu-terminal-whatsapp">
+              <span class="menu-check"></span>
+              <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="currentColor"><path d="M17.472 14.382c-.297-.149-1.758-.867-2.03-.967-.273-.099-.471-.148-.67.15-.197.297-.767.966-.94 1.164-.173.199-.347.223-.644.075-.297-.15-1.255-.463-2.39-1.475-.883-.788-1.48-1.761-1.653-2.059-.173-.297-.018-.458.13-.606.134-.133.298-.347.446-.52.149-.174.198-.298.298-.497.099-.198.05-.371-.025-.52-.075-.149-.669-1.612-.916-2.207-.242-.579-.487-.5-.669-.51-.173-.008-.371-.01-.57-.01-.198 0-.52.074-.792.372-.272.297-1.04 1.016-1.04 2.479 0 1.462 1.065 2.875 1.213 3.074.149.198 2.096 3.2 5.077 4.487.709.306 1.262.489 1.694.625.712.227 1.36.195 1.871.118.571-.085 1.758-.719 2.006-1.413.248-.694.248-1.289.173-1.413-.074-.124-.272-.198-.57-.347m-5.421 7.403h-.004a9.87 9.87 0 01-5.031-1.378l-.361-.214-3.741.982.998-3.648-.235-.374a9.86 9.86 0 01-1.51-5.26c.001-5.45 4.436-9.884 9.888-9.884 2.64 0 5.122 1.03 6.988 2.898a9.825 9.825 0 012.893 6.994c-.003 5.45-4.437 9.884-9.885 9.884m8.413-18.297A11.815 11.815 0 0012.05 0C5.495 0 .16 5.335.157 11.892c0 2.096.547 4.142 1.588 5.945L.057 24l6.305-1.654a11.882 11.882 0 005.683 1.448h.005c6.554 0 11.89-5.335 11.893-11.893a11.821 11.821 0 00-3.48-8.413z"/></svg></span> WhatsApp</span>
+            </div>
+            <div class="menu-item" id="menu-app-leonardo" hidden>
+              <span class="menu-check"></span>
+              <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="currentColor"><path d="M9.5 2l1.5 3.5L14.5 7l-3.5 1.5L9.5 12l-1.5-3.5L4.5 7l3.5-1.5L9.5 2zM19 10l1 2 2 1-2 1-1 2-1-2-2-1 2-1 1-2zM5 17l1 2 2 1-2 1-1 2-1-2-2-1 2-1 1-2z"/></svg></span> Leonardo.AI</span>
+            </div>
           </div>
           <div class="menu-sep"></div>
           <div class="menu-item" id="menu-command-runner">
@@ -239,6 +247,48 @@ export function getSharedHTML() {
             <span class="menu-shortcut">T</span>
           </div>
           <div class="menu-sep"></div>
+${is3D ? `          <!-- Map (3D memory map) -->
+          <div class="menu-item menu-submenu-parent" id="menu-map-label" data-submenu="map" aria-haspopup="menu" aria-expanded="false">
+            <span class="menu-check"></span>
+            <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polygon points="1 6 1 22 8 18 16 22 23 18 23 2 16 6 8 2 1 6"/><line x1="8" y1="2" x2="8" y2="18"/><line x1="16" y1="6" x2="16" y2="22"/></svg></span> ${t('nav.map')}</span>
+            <span class="menu-submenu-arrow" aria-hidden="true"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg></span>
+          </div>
+          <div class="menubar-submenu" data-submenu-for="map" role="menu">
+            <div class="menu-item" id="menu-map-frame-all">
+              <span class="menu-check"></span>
+              <span class="menu-text">${t('map.menu.frameAll')}</span>
+              <span class="menu-shortcut" data-keybind-for="map-frame-all"></span>
+            </div>
+            <div class="menu-item menu-toggle" id="menu-map-neighbors">
+              <span class="menu-check">&#10003;</span>
+              <span class="menu-text">${t('map.menu.neighbors')}</span>
+            </div>
+            <div class="menu-item menu-toggle" id="menu-map-recency">
+              <span class="menu-check">&#10003;</span>
+              <span class="menu-text">${t('map.menu.recency')}</span>
+            </div>
+            <div class="menu-item menu-toggle" id="menu-map-grid">
+              <span class="menu-check">&#10003;</span>
+              <span class="menu-text">${t('map.menu.grid')}</span>
+            </div>
+            <div class="menu-item" id="menu-map-rebuild">
+              <span class="menu-check"></span>
+              <span class="menu-text">${t('map.menu.rebuild')}</span>
+            </div>
+          </div>
+` : ''}          <!-- Games -->
+          <div class="menu-item menu-submenu-parent" id="menu-games-label" data-submenu="games" aria-haspopup="menu" aria-expanded="false">
+            <span class="menu-check"></span>
+            <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="6" y1="11" x2="10" y2="11"/><line x1="8" y1="9" x2="8" y2="13"/><line x1="15" y1="12" x2="15.01" y2="12"/><line x1="18" y1="10" x2="18.01" y2="10"/><path d="M17.32 5H6.68a4 4 0 0 0-3.978 3.59c-.006.052-.01.101-.017.152C2.604 9.416 2 14.456 2 16a3 3 0 0 0 3 3c1 0 1.5-.5 2-1l1.414-1.414A2 2 0 0 1 9.828 16h4.344a2 2 0 0 1 1.414.586L17 18c.5.5 1 1 2 1a3 3 0 0 0 3-3c0-1.545-.604-6.584-.685-7.258-.007-.05-.011-.1-.017-.151A4 4 0 0 0 17.32 5z"/></svg></span> ${t('nav.games')}</span>
+            <span class="menu-submenu-arrow" aria-hidden="true"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg></span>
+          </div>
+          <div class="menubar-submenu" data-submenu-for="games" role="menu">
+            <div class="menu-item" id="menu-game-tictactoe">
+              <span class="menu-check"></span>
+              <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="8" y1="2" x2="8" y2="22"/><line x1="16" y1="2" x2="16" y2="22"/><line x1="2" y1="8" x2="22" y2="8"/><line x1="2" y1="16" x2="22" y2="16"/></svg></span> ${t('menu.games.ticTacToe')}</span>
+            </div>
+          </div>
+          <div class="menu-sep"></div>
           <div class="menu-item" id="menu-install-app" style="display:none">
             <span class="menu-check"></span>
             <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></svg></span> Install as App</span>
@@ -301,39 +351,8 @@ export function getSharedHTML() {
         </div>
       </div>
 
-${is3D ? `
-      <!-- Map menu (3D memory map) -->
-      <div class="menubar-item" data-menu="graph">
-        <button class="menubar-label">${t('nav.map')}</button>
-        <div class="menubar-dropdown glass">
-          <div class="menu-item" id="menu-map-frame-all">
-            <span class="menu-check"></span>
-            <span class="menu-text">${t('map.menu.frameAll')}</span>
-            <span class="menu-shortcut" data-keybind-for="map-frame-all"></span>
-          </div>
-          <div class="menu-sep"></div>
-          <div class="menu-item menu-toggle" id="menu-map-neighbors">
-            <span class="menu-check">&#10003;</span>
-            <span class="menu-text">${t('map.menu.neighbors')}</span>
-          </div>
-          <div class="menu-item menu-toggle" id="menu-map-recency">
-            <span class="menu-check">&#10003;</span>
-            <span class="menu-text">${t('map.menu.recency')}</span>
-          </div>
-          <div class="menu-item menu-toggle" id="menu-map-grid">
-            <span class="menu-check">&#10003;</span>
-            <span class="menu-text">${t('map.menu.grid')}</span>
-          </div>
-          <div class="menu-sep"></div>
-          <div class="menu-item" id="menu-map-rebuild">
-            <span class="menu-check"></span>
-            <span class="menu-text">${t('map.menu.rebuild')}</span>
-          </div>
-        </div>
-      </div>
-
-` : `
-      <!-- Graph menu -->
+${is3D ? '' : `
+      <!-- Graph menu (2D; the 3D Map's controls are a section of Apps) -->
       <div class="menubar-item" data-menu="graph">
         <button class="menubar-label">${t('nav.graph')}</button>
         <div class="menubar-dropdown glass">
@@ -423,23 +442,6 @@ ${is3D ? `
             <span class="menu-shortcut">A</span>
           </div>
           <div class="menu-sep"></div>
-          <div class="menu-item" id="menu-automations-schedules">
-            <span class="menu-check"></span>
-            <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><path d="M12 6v6l4 2"/></svg></span> Schedules</span>
-          </div>
-          <div class="menu-item" id="menu-automations-schedule-new">
-            <span class="menu-check"></span>
-            <span class="menu-text">New Cron Schedule</span>
-          </div>
-          <div class="menu-item" id="menu-automations-quick-timer">
-            <span class="menu-check"></span>
-            <span class="menu-text">Quick Timer</span>
-          </div>
-          <div class="menu-item" id="menu-automations-schedule-groups">
-            <span class="menu-check"></span>
-            <span class="menu-text">Schedule Groups</span>
-          </div>
-          <div class="menu-sep"></div>
           <div class="menu-item" id="menu-automations-new">
             <span class="menu-check"></span>
             <span class="menu-text">${t('menu.automations.newAutomation')}</span>
@@ -451,16 +453,8 @@ ${is3D ? `
         </div>
       </div>
 
-      <!-- Games menu -->
-      <div class="menubar-item" data-menu="games">
-        <button class="menubar-label">${t('nav.games')}</button>
-        <div class="menubar-dropdown glass">
-          <div class="menu-item" id="menu-game-tictactoe">
-            <span class="menu-check"></span>
-            <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="8" y1="2" x2="8" y2="22"/><line x1="16" y1="2" x2="16" y2="22"/><line x1="2" y1="8" x2="22" y2="8"/><line x1="2" y1="16" x2="22" y2="16"/></svg></span> ${t('menu.games.ticTacToe')}</span>
-          </div>
-        </div>
-      </div>
+      <!-- Schedules (opens and closes the Schedules window; no dropdown) -->
+      <button type="button" class="menubar-label menubar-action" id="menubar-schedules-btn" aria-expanded="false" aria-controls="schedules-studio-panel">${t('nav.schedules')}</button>
 
       <!-- Settings (text button) -->
       <button class="menubar-label menubar-action" id="menubar-settings-btn">${t('nav.settings')}</button>

package/neural-interface/public/shared/launch-prefetch.js

@@ -0,0 +1,59 @@
+// ═══════════════════════════════════════════
+// SynaBun Neural Interface — launch prefetch
+// ═══════════════════════════════════════════
+// What windows, menus and dropdowns wait for when they open, read once the
+// page has painted: in idle time, one step after another with a pause
+// between two, so the page never stutters for it and the first open of each
+// window paints from the data cache (data-cache.js). Each module registers
+// its own steps (registerLaunchPrefetch); the page starts the queue after its
+// first paint (startLaunchPrefetch). A step that fails is the window's to ask
+// again when it opens. `owner` steps read what an invite guest may not.
+
+import { whenIdle } from './data-cache.js';
+
+const STEP_LIMIT_MS = 15_000; // a step that hangs does not hold the ones after it
+const STEP_GAP_MS = 120;
+
+const steps = [];
+let started = false;
+let running = false;
+let guest = () => false;
+
+/** Add a step: `run()` reads something into a cache. Lower `order` runs first. */
+export function registerLaunchPrefetch(name, run, { order = 50, owner = false } = {}) {
+  if (typeof run !== 'function' || steps.some((step) => step.name === name)) return;
+  steps.push({ name, run, order, owner, done: false });
+  steps.sort((a, b) => a.order - b.order);
+  if (started) pump();
+}
+
+/** Start the queue (once): after the first paint, `delayMs` later and in idle time. */
+export function startLaunchPrefetch({ delayMs = 600, isGuest = () => false } = {}) {
+  if (started) return;
+  started = true;
+  guest = typeof isGuest === 'function' ? isGuest : () => false;
+  setTimeout(pump, delayMs);
+}
+
+function pump() {
+  if (running) return;
+  const next = steps.find((step) => !step.done);
+  if (!next) return;
+  running = true;
+  whenIdle(async () => {
+    next.done = true;
+    let skip = false;
+    try { skip = next.owner && guest(); } catch { skip = false; }
+    if (!skip) {
+      let timer = null;
+      try {
+        await Promise.race([
+          Promise.resolve().then(next.run),
+          new Promise((done) => { timer = setTimeout(done, STEP_LIMIT_MS); }),
+        ]);
+      } catch { /* the window asks again when it opens */ }
+      clearTimeout(timer);
+    }
+    setTimeout(() => { running = false; pump(); }, STEP_GAP_MS);
+  }, { timeout: 2000 });
+}

package/neural-interface/public/shared/ocp-v2/ocp-v2-caps.js

@@ -39,14 +39,15 @@ export function createCapabilities() {
 /**
  * Send `payload` only when the server lists its type; otherwise resolve the
  * reply a failed request would have produced, without touching the socket.
+ * `options` go to `send` as they are (ocp-v2-ws.js: `turnOf`).
  */
-export function gatedRequest(caps, send, payload, timeoutMs) {
+export function gatedRequest(caps, send, payload, timeoutMs, options) {
   if (!caps.has(payload?.type)) {
     return Promise.resolve({
       type: `${payload?.type}:result`, ok: false, unsupported: true, status: 501, error: UNSUPPORTED_MESSAGE,
     });
   }
-  return send(payload, timeoutMs);
+  return options === undefined ? send(payload, timeoutMs) : send(payload, timeoutMs, options);
 }
 
 /** True when a reply is a failure: transport error, ok:false, or HTTP >= 400. */

package/neural-interface/public/shared/ocp-v2/ocp-v2-childpanel.js

@@ -117,7 +117,8 @@ export function createChildPanel({
 
     // The chain of parents (replaces the session-menu dropdown — a sub-agent
     // panel has only one session). The first crumb is the session in the main
-    // panel; one after it is a sub-agent that has this one as its sub-agent.
+    // panel (the way back, on screen at every width); one after it is a
+    // sub-agent that has this one as its sub-agent.
     _crumbsEl = document.createElement('div');
     _crumbsEl.className = 'ocpv2-child-crumbs';
     header.appendChild(_crumbsEl);
@@ -361,10 +362,14 @@ export function createChildPanel({
       // (The first crumb keeps the class the single parent link had.)
       crumb.className = index ? 'ocpv2-child-crumb' : 'ocpv2-child-crumb ocpv2-child-parent-link';
       crumb.dataset.sessionId = String(parent.sessionId || '');
-      crumb.setAttribute('data-tooltip', index ? `Open sub-agent ${title}` : `Back to ${title}`);
+      // Named by what it does: in a narrow header the way back is its arrow alone.
+      const name = index ? `Open sub-agent ${title}` : `Back to ${title}`;
+      crumb.setAttribute('data-tooltip', name);
+      crumb.setAttribute('aria-label', name);
       if (!index) {
         const arrow = document.createElement('span');
         arrow.className = 'ocpv2-child-parent-arrow';
+        arrow.setAttribute('aria-hidden', 'true');
         arrow.textContent = '↳';
         crumb.appendChild(arrow);
       }
@@ -419,9 +424,12 @@ export function createChildPanel({
         _statusEl.removeAttribute('data-tooltip');
       }
     }
+    const title = sessionTitleFor(store);
     if (_titleEl && !_titleEl.querySelector('.ocpv2-rename-input')) {
-      _titleEl.textContent = sessionTitleFor(store);
+      _titleEl.textContent = title;
     }
+    // The whole name, for when the header shows only part of it.
+    if (_titleEl?.parentElement) _titleEl.parentElement.title = title;
     if (_renameBtn) _renameBtn.disabled = !s.sessionId;
     renderCrumbs();
     renderPill();