synabun 2.0.7 → 2.0.9

package/mcp-server/src/tools/youtube/upload.ts

@@ -14,12 +14,12 @@
  * look successful).
  */
 
-import { z } from 'zod';
+import { z } from 'zod/v3';
 import { v4 as uuidv4 } from 'uuid';
 import * as ni from '../../services/neural-interface.js';
 import { generateEmbedding } from '../../services/local-embeddings.js';
 import { upsertMemory } from '../../services/sqlite.js';
-import { categoryExists, addCategory } from '../../services/categories.js';
+import { ensureCategory, FEATURE_CATEGORIES } from '../../services/categories.js';
 import { detectProject } from '../../config.js';
 import type { MemoryPayload } from '../../types.js';
 import { text } from '../response.js';
@@ -63,17 +63,9 @@ async function ensureOnStudio(r: Resolved): Promise<string | null> {
   return ensureAuth(r);
 }
 
-/** Ensure the dedup-ledger category exists (so it shows in the UI and routing). */
+/** Ensure the dedup-ledger category exists (so it shows in the UI and routing): made on the first upload, under "social" when that exists. */
 function ensureTrailerCategory(): void {
-  try {
-    if (!categoryExists(TRAILER_CATEGORY)) {
-      addCategory(
-        TRAILER_CATEGORY,
-        'One memory per uploaded YouTube trailer — the dedup ledger. Written automatically by youtube_upload; tagged with canonical source ids (igdb:/appid:/ytid:/name:) that youtube_source reads to skip already-posted trailers. Do not store anything else here.',
-        categoryExists('social') ? 'social' : undefined,
-      );
-    }
-  } catch { /* non-fatal — upsertMemory does not require a registered category */ }
+  ensureCategory(TRAILER_CATEGORY, FEATURE_CATEGORIES[TRAILER_CATEGORY].description, { parent: 'social' });
 }
 
 /** Write the dedup-ledger memory for a just-uploaded trailer. Returns the memory id, or null on failure. */

package/mcp-server/src/tui.ts

@@ -2,11 +2,11 @@
 import { retrieveMemory } from './services/memory-retrieval.js';
 
 // Load .env from parent directory before any service imports
-import { readFileSync } from 'fs';
-import { resolve } from 'path';
-import { getDataHome } from '../../lib/paths.js';
-
-const envPath = process.env.DOTENV_PATH || resolve(getDataHome(), '.env');
+import { readFileSync } from 'fs';
+import { resolve } from 'path';
+import { getDataHome } from '../../lib/paths.js';
+
+const envPath = process.env.DOTENV_PATH || resolve(getDataHome(), '.env');
 try {
   const envContent = readFileSync(envPath, 'utf-8');
   for (const line of envContent.split('\n')) {
@@ -407,6 +407,10 @@ async function editMemory(id: string, payload: MemoryPayload): Promise<void> {
     console.log(success(`  ${ICONS.check} Content updated & re-embedded.`));
   } else if (field === 'category') {
     const cats = getAllCategories();
+    if (cats.length === 0) {
+      console.log(warn(`  ${ICONS.cross} No categories yet. Create one under Categories first.`));
+      return;
+    }
     const val = await safePrompt(() =>
       select({
         message: '  Category:',
@@ -608,6 +612,13 @@ async function searchScreen(): Promise<void> {
 async function createScreen(): Promise<void> {
   printScreenHeader(`${ICONS.plus} Create Memory`, 'Store a new piece of knowledge');
 
+  // A fresh install has no categories until a project is added or one is created.
+  const cats = getAllCategories();
+  if (cats.length === 0) {
+    console.log(warn(`  ${ICONS.cross} No categories yet. Create one under Categories first.`));
+    return;
+  }
+
   // Content
   const content = await safePrompt(() =>
     input({
@@ -618,7 +629,6 @@ async function createScreen(): Promise<void> {
   if (content === null) return;
 
   // Category
-  const cats = getAllCategories();
   const category = await safePrompt(() =>
     select({
       message: accent(`  ${ICONS.folder} Category:`),
@@ -793,12 +803,15 @@ async function categoriesScreen(): Promise<void> {
         );
         if (reassign === null || !reassign) continue;
 
+        const others = getAllCategories().filter(c => c !== name);
+        if (others.length === 0) {
+          console.log(warn(`  ${ICONS.cross} No other category to move them to. Create one first.`));
+          continue;
+        }
         const target = await safePrompt(() =>
           select({
             message: accent('  Reassign to:'),
-            choices: getAllCategories()
-              .filter(c => c !== name)
-              .map(c => ({ name: `  ${colorCategory(c)}`, value: c })),
+            choices: others.map(c => ({ name: `  ${colorCategory(c)}`, value: c })),
           })
         );
         if (target === null) continue;

package/neural-interface/i18n/en.json

@@ -6355,6 +6355,12 @@
       "left": "{percent}% left",
       "resets": "resets {time}"
     },
+    "accountMenu": {
+      "uses": "{label} uses",
+      "workers": "Workers use",
+      "workersHint": "Used when a dispatch names no account.",
+      "switchNote": "Another account starts a new conversation."
+    },
     "usage": {
       "task": "Current task",
       "tokens": "tokens",
@@ -7315,6 +7321,8 @@
       "variant": "Model variant",
       "variantDefault": "default variant",
       "account": "Account profile",
+      "accountShort": "Account",
+      "accountAutoShort": "Auto",
       "accountHint": "as",
       "project": "Working project",
       "projectHint": "in",
@@ -7365,6 +7373,16 @@
         "thorough": "Full coverage, whole suite, live checks."
       }
     },
+    "adminSandbox": {
+      "group": "Every agent",
+      "label": "Admin sandbox",
+      "on": "On",
+      "off": "Off",
+      "hint": "Only changes anything when SynaBun runs on Windows. On: Codex can set up its strongest sandbox, which asks for administrator approval once per account. Off: no admin prompt; Codex uses a sandbox that needs no admin, with weaker isolation.",
+      "aria": "{label}: {value}. Only changes anything when SynaBun runs on Windows.",
+      "statusOn": "Admin sandbox: on. On Windows, Codex may ask for administrator approval once per account to set up its sandbox.",
+      "statusOff": "Admin sandbox: off. No agent SynaBun starts asks for administrator approval for a sandbox."
+    },
     "accounts": {
       "signInAccount": "Sign in to {label}…",
       "title": "{provider} accounts",

package/neural-interface/i18n/pt-BR.json

@@ -6307,6 +6307,12 @@
       "left": "{percent}% disponível",
       "resets": "renova em {time}"
     },
+    "accountMenu": {
+      "uses": "{label} usa",
+      "workers": "Workers usam",
+      "workersHint": "Usada quando o despacho não indica uma conta.",
+      "switchNote": "Outra conta inicia uma nova conversa."
+    },
     "usage": {
       "task": "Tarefa atual",
       "tokens": "tokens",
@@ -7267,6 +7273,8 @@
       "variant": "Variante do modelo",
       "variantDefault": "variante padrão",
       "account": "Perfil da conta",
+      "accountShort": "Conta",
+      "accountAutoShort": "Auto",
       "accountHint": "como",
       "project": "Projeto de trabalho",
       "projectHint": "entrada",
@@ -7317,6 +7325,16 @@
         "thorough": "Cobertura completa, suíte inteira, verificações ao vivo."
       }
     },
+    "adminSandbox": {
+      "group": "Todos os agentes",
+      "label": "Sandbox de administrador",
+      "on": "Ativado",
+      "off": "Desativado",
+      "hint": "Só muda algo quando o SynaBun roda no Windows. Ativado: o Codex pode configurar seu sandbox mais forte, que pede aprovação de administrador uma vez por conta. Desativado: nenhum pedido de administrador; o Codex usa um sandbox que não precisa de administrador, com isolamento mais fraco.",
+      "aria": "{label}: {value}. Só muda algo quando o SynaBun roda no Windows.",
+      "statusOn": "Sandbox de administrador: ativado. No Windows, o Codex pode pedir aprovação de administrador uma vez por conta para configurar seu sandbox.",
+      "statusOff": "Sandbox de administrador: desativado. Nenhum agente iniciado pelo SynaBun pede aprovação de administrador para um sandbox."
+    },
     "accounts": {
       "signInAccount": "Entrar em {label}…",
       "title": "Contas de {provider}",

package/neural-interface/lib/agent-sandbox-elevation.js

@@ -0,0 +1,102 @@
+// ═══════════════════════════════════════════
+// SynaBun — Admin sandbox: what it means for each agent (pure)
+// ═══════════════════════════════════════════
+//
+// One global setting (lib/agent-sandbox-setting.js, the Assistant's permission
+// menu) decides whether an agent SynaBun starts may use a sandbox whose setup
+// needs Windows administrator approval (a UAC prompt). Off is the default:
+// then nothing SynaBun starts can ask for one. Each provider says here what
+// the setting means for it; a launcher asks this module and never decides by
+// itself. A provider SynaBun can start must have an entry
+// (tests/agent-sandbox-elevation.test.mjs fails otherwise).
+//
+// The setting never changes a provider's sandbox policy (read-only,
+// workspace-write, full access): only which implementation of it may need an
+// administrator. It is a launch override, never written into a config file.
+
+export const ADMIN_SANDBOX_DEFAULT = false;
+
+const CODEX_SETTING = 'windows.sandbox';
+
+export const SANDBOX_ELEVATION = Object.freeze({
+  // `windows.sandbox` (Codex 0.163: "elevated" | "unelevated" | "mxc"): "elevated"
+  // provisions two local sandbox accounts with codex-windows-sandbox-setup.exe, a
+  // UAC prompt once per CODEX_HOME (SynaBun's accounts each have one);
+  // "unelevated" is Codex's restricted-token sandbox: no administrator, weaker isolation.
+  codex: Object.freeze({
+    changes: true,
+    setting: CODEX_SETTING,
+    off: 'unelevated',
+    on: 'elevated',
+    reason: 'Codex picks its Windows sandbox with windows.sandbox: "elevated" needs a one-time administrator setup per account, "unelevated" needs none.',
+  }),
+  // Claude Code 2.1.303 has a Windows sandbox whose one-time install asks for
+  // administrator approval, but only `claude sandbox install` or `/sandbox install`
+  // starts it: a session never does, and SynaBun never runs either command.
+  'claude-code': Object.freeze({
+    changes: false,
+    reason: 'Claude Code installs its Windows sandbox only through `claude sandbox install` or `/sandbox install`, which SynaBun never runs; a session never asks for administrator approval by itself.',
+  }),
+  // OpenCode has no operating-system sandbox: permission rules only (its
+  // "sandboxes" are worktree folders).
+  opencode: Object.freeze({
+    changes: false,
+    reason: 'OpenCode has no operating-system sandbox, only permission rules, so nothing it starts needs administrator approval.',
+  }),
+});
+
+/** Only `true` turns it on: anything else (missing, a string, null) is the default, off. */
+export function normalizeAdminSandbox(value) {
+  return value === true;
+}
+
+/** Providers the setting changes (['codex']): what the panel's copy may name. */
+export function adminSandboxProviders() {
+  return Object.keys(SANDBOX_ELEVATION).filter((provider) => SANDBOX_ELEVATION[provider].changes);
+}
+
+/**
+ * What a launcher of `provider` adds for the setting: `args` (CLI words, before
+ * the subcommand or anywhere an override is taken), `config` (the same as an
+ * SDK config object) and `value`. A provider the setting does not change gets
+ * nothing to add and its reason. An unknown provider throws: it must declare
+ * its mapping in SANDBOX_ELEVATION first.
+ */
+export function sandboxElevationFor(provider, adminSandbox) {
+  const entry = SANDBOX_ELEVATION[provider];
+  if (!entry) throw new Error(`No admin sandbox mapping for provider "${provider}": add it to SANDBOX_ELEVATION.`);
+  const on = normalizeAdminSandbox(adminSandbox);
+  if (!entry.changes) return { provider, changes: false, adminSandbox: on, value: null, args: [], config: {}, reason: entry.reason };
+  const value = on ? entry.on : entry.off;
+  return { provider, changes: true, adminSandbox: on, value, args: ['-c', `${entry.setting}=${JSON.stringify(value)}`], config: configAt(entry.setting, value), reason: entry.reason };
+}
+
+function configAt(dotted, value) {
+  const keys = dotted.split('.');
+  const out = {};
+  let node = out;
+  keys.forEach((key, index) => { node[key] = index === keys.length - 1 ? value : {}; node = node[key]; });
+  return out;
+}
+
+/** 'elevated' when the setting is on, else 'unelevated'. */
+export function codexWindowsSandbox(adminSandbox) {
+  return sandboxElevationFor('codex', adminSandbox).value;
+}
+
+/** ['-c', 'windows.sandbox="unelevated"'] (or "elevated"): a Codex launch override. */
+export function codexWindowsSandboxArgs(adminSandbox) {
+  return sandboxElevationFor('codex', adminSandbox).args;
+}
+
+/** { windows: { sandbox: 'unelevated' } } (or 'elevated'): the same for the Codex SDK's `config`. */
+export function codexWindowsSandboxConfig(adminSandbox) {
+  return sandboxElevationFor('codex', adminSandbox).config;
+}
+
+/**
+ * A Codex process that runs no command and no turn (a probe in a throwaway
+ * home: hooks, settings schema, feature switches) needs no sandbox at all: it
+ * is always started with the one that needs no administrator, whatever the setting.
+ */
+export const CODEX_PROBE_SANDBOX_ARGS = Object.freeze([...codexWindowsSandboxArgs(false)]);

package/neural-interface/lib/agent-sandbox-setting.js

@@ -0,0 +1,57 @@
+// ═══════════════════════════════════════════
+// SynaBun — Admin sandbox: the one global value
+// ═══════════════════════════════════════════
+//
+// DATA_HOME/data/agent-sandbox.json ({ adminSandbox, updatedAt }), read live:
+// one value for every agent SynaBun starts, not per session or tab. No file
+// (or one that cannot be read) is the default, off. What the value means for
+// each provider is lib/agent-sandbox-elevation.js. Only the UI changes it
+// (PUT /api/assistant/admin-sandbox answers UI_ONLY to agents); a change
+// reaches every window as `agents:admin-sandbox-changed` and every listener
+// (server.js restarts the idle Codex app-servers there).
+
+import { mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { ADMIN_SANDBOX_DEFAULT, adminSandboxProviders, normalizeAdminSandbox } from './agent-sandbox-elevation.js';
+
+export const ADMIN_SANDBOX_EVENT = 'agents:admin-sandbox-changed';
+
+export function createAdminSandboxSetting({ path, broadcast = () => {}, log = () => {}, now = Date.now } = {}) {
+  if (!path) throw new Error('createAdminSandboxSetting requires a path');
+  const listeners = new Set();
+  let cache = null; // { mtimeMs, value }
+
+  function read() {
+    try {
+      const stat = statSync(path);
+      if (cache && cache.mtimeMs === stat.mtimeMs) return cache.value;
+      const data = JSON.parse(readFileSync(path, 'utf8'));
+      const value = normalizeAdminSandbox(data?.adminSandbox);
+      cache = { mtimeMs: stat.mtimeMs, value };
+      return value;
+    } catch {
+      return ADMIN_SANDBOX_DEFAULT;
+    }
+  }
+  /** What the UI shows: the value and the providers it changes. */
+  function view() {
+    return { adminSandbox: read(), providers: adminSandboxProviders() };
+  }
+  function set(value) {
+    const next = normalizeAdminSandbox(value);
+    const before = read();
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify({ adminSandbox: next, updatedAt: new Date(now()).toISOString() }, null, 2) + '\n', 'utf8');
+    renameSync(tmp, path);
+    cache = null;
+    const changed = next !== before;
+    if (changed) log('agent-sandbox', `admin sandbox ${next ? 'on' : 'off'}`);
+    try { broadcast({ type: ADMIN_SANDBOX_EVENT, ...view() }); } catch { /* nobody listening */ }
+    if (changed) for (const listener of [...listeners]) { try { listener(next); } catch { /* the listener's own failure */ } }
+    return view();
+  }
+  function subscribe(listener) { listeners.add(listener); return () => listeners.delete(listener); }
+
+  return { enabled: read, view, set, subscribe, path };
+}

package/neural-interface/lib/assistant-api.js

@@ -150,6 +150,8 @@ export function createAssistantApi({
   // after this router), and the port the server listens on (the Host check of that route).
   whatsapp = null,
   port = 3344,
+  // The Admin sandbox setting (lib/agent-sandbox-setting.js): one global value for every agent SynaBun starts.
+  adminSandbox = null,
 } = {}) {
   if (!dispatcher) throw new Error('createAssistantApi requires a dispatcher');
   const router = Router();
@@ -1230,6 +1232,23 @@ export function createAssistantApi({
     } catch (error) { sendError(res, error); }
   });
 
+  // ── Admin sandbox (lib/agent-sandbox-setting.js) ───────────────────────────
+  // Whether an agent SynaBun starts may use a sandbox whose setup needs Windows administrator
+  // approval. Global, not per session. The user's setting: an agent cannot change it.
+  router.get('/admin-sandbox', (req, res) => {
+    if (!adminSandbox) return res.status(503).json({ ok: false, code: 'ADMIN_SANDBOX_UNAVAILABLE', error: 'The Admin sandbox setting is not available on this server' });
+    res.json({ ok: true, ...adminSandbox.view() });
+  });
+  router.put('/admin-sandbox', requireJson, (req, res) => {
+    if (!adminSandbox) return res.status(503).json({ ok: false, code: 'ADMIN_SANDBOX_UNAVAILABLE', error: 'The Admin sandbox setting is not available on this server' });
+    if (callerContext(req).kind !== 'ui' || req.get('x-synabun-desktop-grant')) {
+      return res.status(403).json({ ok: false, code: 'UI_ONLY', error: 'Only the user can change the Admin sandbox.' });
+    }
+    const value = req.body?.adminSandbox;
+    if (typeof value !== 'boolean') return res.status(400).json({ ok: false, code: 'INVALID_VALUE', error: 'adminSandbox must be true or false.' });
+    try { res.json({ ok: true, ...adminSandbox.set(value) }); } catch (error) { sendError(res, error); }
+  });
+
   // ── sidepanel tab registry (UI heartbeat) ──────────────────────────────────
   function listTabs() {
     const cutoff = now() - tabTtlMs;

package/neural-interface/lib/assistant-route-gate-codex.js

@@ -19,6 +19,7 @@ import { mkdirSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { CODEX_PROBE_SANDBOX_ARGS } from './agent-sandbox-elevation.js';
 
 export const CODEX_GATE_HOOK_PATH = resolve(dirname(fileURLToPath(import.meta.url)), 'assistant-brains', 'codex-route-gate-hook.mjs');
 export const CODEX_BROWSER_POLICY_HOOK_PATH = resolve(dirname(fileURLToPath(import.meta.url)), 'assistant-brains', 'codex-browser-policy-hook.mjs');
@@ -80,7 +81,8 @@ function probe({ codexBin, command, timeoutMs, spawnImpl }) {
     if (codexNeedsShell(bin)) { done(null); return; }
     const home = resolve(tmpdir(), 'synabun-codex-gate-probe');
     try { mkdirSync(home, { recursive: true }); } catch {}
-    const args = [...codexGateHookFlags(command), 'app-server'];
+    // A probe runs no command: the Windows sandbox that needs no administrator (lib/agent-sandbox-elevation.js).
+    const args = [...codexGateHookFlags(command), ...CODEX_PROBE_SANDBOX_ARGS, 'app-server'];
     if (/\.js$/i.test(bin)) { args.unshift(bin); bin = process.execPath; }
     let proc;
     try {

package/neural-interface/lib/assistant-runtime.js

@@ -246,6 +246,8 @@ export function createAssistantRuntime({
   // (capability) → boolean, the verifier of lib/remote-policy.js createPhoneAuthority(): is this the
   // capability of the one WhatsApp bridge? Without a verifier nothing can grant computer use remotely.
   phoneAuthority = null,
+  // The Admin sandbox setting (lib/agent-sandbox-setting.js): global, shown in every session view.
+  adminSandbox = null,
 } = {}) {
   if (!dataDir) throw new Error('createAssistantRuntime requires dataDir');
   const settings = {
@@ -906,7 +908,9 @@ export function createAssistantRuntime({
       out.testDensity = testDensityOf(record);
       out.testDensityExplicit = normalizeTestDensity(record.testDensity, null);
       // `rename`: this server keeps a rename on the record (userRenamed), so a panel writes it here.
-      out.features = { routing: !!router, computer: computerSupported(), testDensity: true, rename: true };
+      // `adminSandbox`: the global setting is served here (PUT /api/assistant/admin-sandbox).
+      out.features = { routing: !!router, computer: computerSupported(), testDensity: true, rename: true, adminSandbox: !!adminSandbox };
+      if (adminSandbox) { try { out.adminSandbox = adminSandbox.enabled() === true; } catch { out.adminSandbox = false; } }
       out.budget = sessionMoney(record.id);
       out.remoteLevel = policy ? effectiveLevel(policy, { untrusted: live.turnUntrusted === true, now: now() }) : null;
     }

package/neural-interface/lib/codex-account-auth.js

@@ -9,7 +9,7 @@
 import { spawn } from 'node:child_process';
 import { verifyOpenAiApiKey } from './claude-profile-api-key.js';
 import { validateProviderApiKey } from './provider-panel-api-key-auth.js';
-import { applyCodexLaunchEnv } from './codex-accounts.js';
+import { applyCodexLaunchEnv, codexLaunchArgs } from './codex-accounts.js';
 
 const fail = (message, status = 409, code = null) => Object.assign(new Error(message), { status, ...(code ? { code } : {}) });
 
@@ -32,13 +32,15 @@ export function createCodexAccountAuth({
   }
   // Codex run under the account's own store: inherited credentials out, its
   // CODEX_HOME in, never the key SynaBun holds (that is not Codex's store).
-  function launch(id, args) {
+  // The launch's overrides (the Windows sandbox of the Admin sandbox setting) follow the subcommand.
+  function launch(id, words) {
     account(id);
     const plan = accounts.launchFor(id);
     if (!plan.ok) throw fail(plan.message, 404);
     prepareConfig(plan.home);
     let file = codexBin();
     if (!file) throw fail('Codex CLI not found. Install Codex to sign in.', 503);
+    const args = [...words, ...codexLaunchArgs(plan)];
     const script = /\.[cm]?js$/i.test(file);
     const shell = process.platform === 'win32' && /\.(cmd|bat)$/i.test(file);
     const proc = spawnProcess(script ? process.execPath : file, script ? [file, ...args] : args, {

package/neural-interface/lib/codex-accounts.js

@@ -32,6 +32,7 @@ import { dirname, join, resolve, sep } from 'node:path';
 import { homedir } from 'node:os';
 import { readProfileApiKey, saveProfileApiKey, clearProfileApiKey } from './claude-profile-api-key.js';
 import { apiKeyHint, resolveClaudeAuth } from './claude-accounts.js';
+import { normalizeAdminSandbox, sandboxElevationFor } from './agent-sandbox-elevation.js';
 
 export const CODEX_DEFAULT_ACCOUNT_ID = 'default';
 export const CODEX_AUTH_MODES = Object.freeze(['subscription', 'apiKey']);
@@ -123,9 +124,13 @@ export function applyCodexLaunchEnv(base, launch) {
 export function codexExecEnv(launch) {
   return { ...(launch?.env || {}), ...(launch?.apiKey ? { CODEX_API_KEY: launch.apiKey } : {}) };
 }
+/** The `-c` overrides every Codex process of the launch starts with: the Windows sandbox the Admin sandbox setting allows. */
+export function codexLaunchArgs(launch) {
+  return [...(launch?.configArgs || [])];
+}
 /** The `-c` overrides an app-server of the account starts with (before the subcommand). */
 export function codexAppServerArgs(launch) {
-  return launch?.apiKey ? [...CODEX_EPHEMERAL_STORE_ARGS] : [];
+  return [...codexLaunchArgs(launch), ...(launch?.apiKey ? CODEX_EPHEMERAL_STORE_ARGS : [])];
 }
 
 export function createCodexAccounts({
@@ -141,6 +146,8 @@ export function createCodexAccounts({
   statusTimeoutMs = 20_000,
   // Called before a new account links Default's config.toml (server.js repairs it there).
   prepareDefaultConfig = () => {},
+  // () => the Admin sandbox setting (lib/agent-sandbox-setting.js): which Windows sandbox every launch may use.
+  adminSandbox = () => false,
 } = {}) {
   if (!dataHome) throw new Error('createCodexAccounts requires dataHome');
   const registryPath = resolve(dataHome, 'data', 'codex-accounts.json');
@@ -273,11 +280,17 @@ export function createCodexAccounts({
     }
     const { row, key } = describeProfile(profile, data);
     const apiKey = row.mode === 'apiKey' && row.apiKey.source === 'synabun' && key ? key : null;
+    // A launch override, never written into config.toml: Default's home is the user's own ~/.codex.
+    let on = false;
+    try { on = normalizeAdminSandbox(adminSandbox()); } catch { on = false; }
+    const sandbox = sandboxElevationFor('codex', on);
     return {
       ok: true, accountId: wanted, label: row.label, mode: row.mode, signedIn: row.signedIn, identity: row.identity, home: row.home,
       env: { CODEX_HOME: row.home }, unset: [...CODEX_CREDENTIAL_ENV], apiKey,
       // Which credential a process started with: a change means the account's idle processes restart.
       credential: [row.mode || 'none', row.apiKey.source || '', row.apiKey.hint || '', row.subscription.email || ''].join(':'),
+      // The Windows sandbox it may use ('elevated' | 'unelevated'): a change restarts idle app-servers too.
+      windowsSandbox: sandbox.value, configArgs: sandbox.args,
     };
   }
 

package/neural-interface/lib/codex-settings-schema.js

@@ -2,6 +2,8 @@ import { spawnSync } from 'node:child_process';
 import { mkdtempSync, readFileSync, rmSync, statSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+// The probes run no command: always the Windows sandbox that needs no administrator (lib/agent-sandbox-elevation.js).
+import { CODEX_PROBE_SANDBOX_ARGS } from './agent-sandbox-elevation.js';
 
 const cache = new Map();
 const featureCache = new Map();
@@ -45,7 +47,7 @@ export function readCodexSettingsSchema(codexBin) {
   const home = mkdtempSync(join(tmpdir(), 'synabun-codex-schema-'));
   try {
     const out = join(home, 'schema');
-    const run = spawnSync(codexBin, ['app-server', 'generate-json-schema', '--experimental', '--out', out], {
+    const run = spawnSync(codexBin, ['app-server', 'generate-json-schema', '--experimental', '--out', out, ...CODEX_PROBE_SANDBOX_ARGS], {
       env: { ...process.env, CODEX_HOME: home }, encoding: 'utf8', timeout: 15000, windowsHide: true,
     });
     if (run.error || run.status !== 0) throw new Error('Codex could not report its settings schema');
@@ -56,7 +58,7 @@ export function readCodexSettingsSchema(codexBin) {
     // `features list` validates config locally and never runs a model or tool.
     for (const [fieldKey, field] of Object.entries(schema.fields)) {
       field.values = field.values.filter(value => {
-        const check = spawnSync(codexBin, ['-c', `${fieldKey}=${JSON.stringify(value)}`, 'features', 'list'], {
+        const check = spawnSync(codexBin, [...CODEX_PROBE_SANDBOX_ARGS, '-c', `${fieldKey}=${JSON.stringify(value)}`, 'features', 'list'], {
           env: { ...process.env, CODEX_HOME: home }, encoding: 'utf8', timeout: 5000, windowsHide: true,
         });
         return !check.error && check.status === 0;
@@ -105,7 +107,7 @@ export function readCodexFeatureSupport(codexBin, features) {
   const home = mkdtempSync(join(tmpdir(), 'synabun-feature-support-'));
   try {
     const states = [false, true].map(value => {
-      const check = spawnSync(codexBin, ['-c', `features={${names.map(name => `${name}=${value}`).join(',')}}`, 'features', 'list'], {
+      const check = spawnSync(codexBin, [...CODEX_PROBE_SANDBOX_ARGS, '-c', `features={${names.map(name => `${name}=${value}`).join(',')}}`, 'features', 'list'], {
         env: { ...process.env, CODEX_HOME: home }, encoding: 'utf8', timeout: 10000, windowsHide: true,
       });
       if (check.error || check.status !== 0) throw new Error('Codex could not validate feature switches');

package/neural-interface/lib/exec-loop-command.js

@@ -82,6 +82,8 @@ export function buildExecInvocation({
   model,
   effort,
   mcpEnvOverrides = [],
+  // Codex: launch overrides as `-c` words (the Windows sandbox of the Admin sandbox setting).
+  codexConfigArgs = [],
   platform = process.platform,
   commandExists = existsSync,
 } = {}) {
@@ -94,7 +96,7 @@ export function buildExecInvocation({
 
   switch (profile) {
     case 'codex': {
-      args.push('exec', '--dangerously-bypass-approvals-and-sandbox');
+      args.push('exec', '--dangerously-bypass-approvals-and-sandbox', ...codexConfigArgs);
       for (const [key, value] of mcpEnvOverrides) {
         args.push('-c', `mcp_servers.SynaBun.env.${key}=${codexConfigString(value)}`);
       }

package/neural-interface/lib/install-details.js

@@ -26,15 +26,29 @@ export function packagesInLock(lock) {
   return entries.filter(key => /(?:^|\/)node_modules\//.test(key)).length;
 }
 
+/** How many packages of a lockfile are on disk under `root` (npm-shrinkwrap.json of an npm install). */
+export function installedFromLock(lock, root, { exists = existsSync } = {}) {
+  const entries = lock && typeof lock.packages === 'object' ? Object.keys(lock.packages) : [];
+  return entries.filter(key => /(?:^|\/)node_modules\//.test(key) && exists(path.join(root, ...key.split('/')))).length;
+}
+
 /**
- * A part's own dependencies (its package.json), each with the version installed in its node_modules, or null
- * when it is not installed. Sorted by name.
+ * A part's own dependencies (its package.json), each with the version Node finds for it, or null when it is not
+ * installed. Sorted by name. Found in the part's node_modules, and with `stopAt` (the package root) in each folder
+ * up to it too: `npm i -g synabun` installs every part's dependencies at the package root.
  */
-export function directDependencies(dir, { readJson = readJsonFile } = {}) {
+export function directDependencies(dir, { readJson = readJsonFile, stopAt = null } = {}) {
   const manifest = readJson(path.join(dir, 'package.json')) || {};
   const wanted = { ...(manifest.optionalDependencies || {}), ...(manifest.dependencies || {}) };
+  const limit = stopAt ? path.resolve(stopAt) : null;
+  const find = (name) => {
+    for (let folder = path.resolve(dir); ; folder = path.dirname(folder)) {
+      const found = readJson(path.join(folder, 'node_modules', ...name.split('/'), 'package.json'));
+      if (found || !limit || folder === limit || path.dirname(folder) === folder) return found;
+    }
+  };
   return Object.keys(wanted).sort().map((name) => {
-    const installed = readJson(path.join(dir, 'node_modules', ...name.split('/'), 'package.json'));
+    const installed = find(name);
     return { name, wanted: String(wanted[name]), installed: installed?.version ? String(installed.version) : null };
   });
 }
@@ -112,10 +126,14 @@ export async function collectInstallDetails({
   const userNpmPath = firstOnPath('npm', osPath, { platform, exists, skip: runtimeBin ? [runtimeBin, impl.dirname(execPath)] : [] });
   const userNpm = userNpmPath && userNpmPath !== ownNpm ? { path: userNpmPath, ...(await version(userNpmPath, { platform, env })) } : null;
 
+  // A part's own install record when it has one (a development checkout, a desktop build); an npm install keeps
+  // both parts' dependencies at the package root instead, pinned by npm-shrinkwrap.json.
+  const shrinkwrap = readJson(path.join(packageRoot, 'npm-shrinkwrap.json'));
   const parts = [['Neural Interface', 'neural-interface'], ['MCP server', 'mcp-server']].map(([name, folder]) => {
     const dir = path.join(packageRoot, folder);
     const installed = readJson(path.join(dir, 'node_modules', '.package-lock.json'));
-    return { name, folder, packages: packagesInLock(installed), dependencies: directDependencies(dir, { readJson }) };
+    const packages = installed ? packagesInLock(installed) : installedFromLock(shrinkwrap, packageRoot, { exists });
+    return { name, folder, packages, dependencies: directDependencies(dir, { readJson, stopAt: packageRoot }) };
   });
   const mcpBuilt = exists(path.join(packageRoot, 'mcp-server', 'dist', 'index.js'));
 

package/neural-interface/lib/native-loop-providers.js

@@ -10,6 +10,7 @@ import { codexReasoningEffort } from './effort-levels.js';
 import { codexStreamMedia, collectCodexMedia, openCodeMediaPart, ownCodexImages } from './assistant-media.js';
 import { browserToolDenial } from './browser-tool-policy.js';
 import { CODEX_BROWSER_POLICY_UNTRUSTED_NOTE, codexBrowserPolicyHook } from './assistant-route-gate-codex.js';
+import { codexWindowsSandbox, codexWindowsSandboxConfig } from './agent-sandbox-elevation.js';
 
 function stringEnv(source) {
   const out = {};
@@ -251,6 +252,9 @@ export async function createCodexNativeLoopAdapter(options = {}) {
     // Inherited variables to remove before extraEnv applies (the Codex account's launch:
     // lib/codex-accounts.js launchFor() — inherited OpenAI/Codex credentials never reach the run).
     unsetEnv = [],
+    // The Admin sandbox setting when the run started (lib/agent-sandbox-elevation.js): the Windows
+    // sandbox every `codex exec` of the thread may use. The run keeps it while it lives.
+    adminSandbox = false,
   } = options;
   const permissionPolicy = normalizePermissionPolicy(rawPolicy);
   const capability = normalizeCapability(rawCapability);
@@ -287,7 +291,7 @@ export async function createCodexNativeLoopAdapter(options = {}) {
   const inherited = { ...process.env };
   for (const key of Array.isArray(unsetEnv) ? unsetEnv : []) delete inherited[key];
   const env = stringEnv({ ...inherited, ...pins, CODEX_HOME: codexHome, ...(browserPolicy ? { SYNABUN_BROWSER_POLICY_CWD: cwd || process.cwd() } : {}), ...stringEnv(extraEnv) });
-  const config = {};
+  const config = { ...codexWindowsSandboxConfig(adminSandbox) };
   if (Object.keys(pins).length) config.mcp_servers = { SynaBun: { env: pins } };
   if (extended) config.model_context_window = Math.floor(Number(modelContextWindow));
   if (browserPolicy) Object.assign(config, browserPolicy.config);
@@ -334,6 +338,7 @@ export async function createCodexNativeLoopAdapter(options = {}) {
     isAlive: () => alive,
     describe: () => ({
       provider: 'codex', permissionPolicy, capability, sandboxMode: codexSandboxModeFor({ permissionPolicy, capability }),
+      windowsSandbox: codexWindowsSandbox(adminSandbox),
       ...(task ? { browserPolicy: browserPolicy ? 'hook' : 'instructions' } : {}),
     }),
     async runTurn(prompt, meta = {}) {