synabun 2.0.9 → 2.1.0

package/neural-interface/public/shared/desktop-update-view.js

@@ -24,6 +24,7 @@ export const DESKTOP_COPY = Object.freeze({
     tooltip: 'SynaBun update available: v{current} → v{latest}',
     tooltipDownloading: 'Downloading SynaBun v{latest}',
     tooltipReady: 'SynaBun v{latest} is ready: it installs when SynaBun is idle',
+    tooltipReadyOff: 'SynaBun v{latest} is ready to install',
     titleAvailable: 'Update available',
     titleDownloading: 'Downloading the update',
     titleDownloaded: 'Update ready',
@@ -46,6 +47,9 @@ export const DESKTOP_COPY = Object.freeze({
     hide: 'Hide',
     hideHint: 'The download continues while this is hidden. SynaBun installs the update by itself when nothing is running.',
     readyBody: 'SynaBun v{version} is downloaded. It installs by itself once nothing is running: SynaBun shows a one-minute notice, then restarts into it. It also installs when you quit SynaBun.',
+    // Automatic updates off (Settings > App): it waits for Install now.
+    offBody: 'Automatic updates are off. Install now downloads it and restarts SynaBun into it once nothing is running.',
+    readyBodyOff: 'SynaBun v{version} is downloaded. Automatic updates are off: it installs when you choose Install now.',
     waitingBody: 'Waiting for: {list}.',
     countdownBody: 'SynaBun restarts into v{version} in {seconds} s.',
     postponedBody: 'Postponed until {time}. It also installs when you quit SynaBun.',
@@ -62,14 +66,20 @@ export const DESKTOP_COPY = Object.freeze({
     errorFallback: 'SynaBun could not check for updates. Check the connection and try again.',
     errorNext: 'SynaBun keeps the version it runs and tries again at its next check. You can try now, or download the new version yourself.',
     manualLink: 'Download it yourself',
+    settingsLink: 'Update settings',
     close: 'Close',
     retry: 'Try again',
     testFeed: 'test feed',
     metaAvailable: 'From the SynaBun app',
     metaDownloading: 'Downloading: {percent}%',
     metaDownloaded: 'Ready: installs when SynaBun is idle',
+    metaReadyOff: 'Ready to install',
     metaCountdown: 'Restarting to install it',
     metaPostponed: 'Postponed: installs on quit or later',
+    // The button at the top right while a downloaded update waits for a restart, as Discord's green one.
+    restartButton: 'Restart to update',
+    restartTooltip: 'SynaBun v{latest} is ready: restart to update',
+    restartSoon: 'Restarting soon',
   }),
   // What an update waits for (the app's server names it, GET /api/system/activity).
   busy: Object.freeze({
@@ -193,6 +203,8 @@ export function readDesktopUpdateState(state) {
     manualFile: text(s.manualFile, 4096),
     testFeed: s.testFeed === true,
     auto: readAuto(s.auto),
+    // Settings > App; an app from before the setting says nothing: on.
+    autoUpdate: s.autoUpdate !== false,
     updated: readUpdated(s.updated),
     releasesUrl: readReleasesUrl(s.releasesUrl),
   };
@@ -236,6 +248,7 @@ export function versionDataFromDesktop(state) {
     testFeed: s.testFeed,
     checkedAt: s.checkedAt,
     auto: s.auto,
+    autoUpdate: s.autoUpdate,
   };
 }
 
@@ -311,11 +324,12 @@ export function desktopUpdateView(state, {
     case 'available':
       view.dot = 1;
       view.title = say('titleAvailable');
-      view.body = [say('snapshot', { version })];
+      view.body = s.autoUpdate ? [say('snapshot', { version })] : [say('offBody'), say('snapshot', { version })];
       view.notesLabel = say('notesLabel');
       view.notes = s.notes || say('notesEmpty');
       view.backup = { id: 'backup', label: say('backup') };
-      view.actions = [action('later', 'ghost', 'later'), action('download', 'primary', 'download')];
+      // Automatic updates off: one click downloads and installs it (no download on its own to wait for).
+      view.actions = [action('later', 'ghost', 'later'), s.autoUpdate ? action('download', 'primary', 'download') : action('install-now', 'primary', 'installNow')];
       break;
     case 'downloading':
       view.dot = 2;
@@ -328,8 +342,8 @@ export function desktopUpdateView(state, {
     case 'downloaded': {
       view.dot = 3;
       view.title = say('titleDownloaded');
-      view.body = [say('readyBody', { version })];
       const auto = s.auto;
+      view.body = [s.autoUpdate || auto?.now ? say('readyBody', { version }) : say('readyBodyOff', { version })];
       if (auto?.phase === 'countdown' && auto.installAt) {
         view.body.push(say('countdownBody', { version, seconds: secondsUntil(auto.installAt, now) }));
         view.ticking = true;
@@ -395,7 +409,7 @@ export function desktopUpdateMeta(state, { t = fillDesktopCopy } = {}) {
     case 'downloaded':
       if (s.auto?.phase === 'countdown') return t('update.metaCountdown');
       if (s.auto?.phase === 'postponed') return t('update.metaPostponed');
-      return t('update.metaDownloaded');
+      return s.autoUpdate || s.auto?.now ? t('update.metaDownloaded') : t('update.metaReadyOff');
     case 'installing': return t('update.titleInstalling');
     case 'available': case 'move': case 'manual': return t('update.metaAvailable');
     default: return '';
@@ -408,10 +422,26 @@ export function desktopUpdateTooltip(state, { t = fillDesktopCopy } = {}) {
   const params = { current: s.current, latest: s.latest || '' };
   const step = desktopUpdateStep(s);
   if (step === 'downloading') return t('update.tooltipDownloading', params);
-  if (step === 'downloaded') return t('update.tooltipReady', params);
+  if (step === 'downloaded') return t(s.autoUpdate || s.auto?.now ? 'update.tooltipReady' : 'update.tooltipReadyOff', params);
   return t('update.tooltip', params);
 }
 
+/**
+ * The top right button while a downloaded update waits for a restart into it, or null: { label, tooltip, asked }.
+ * Only an update this copy installs by restarting (not one to move to Applications or to install by hand). After
+ * Restart to update, while something still runs, it says that the restart is coming (`asked`).
+ */
+export function desktopRestartButton(state, { t = fillDesktopCopy } = {}) {
+  const s = readDesktopUpdateState(state);
+  if (desktopUpdateStep(s) !== 'downloaded' || s.install !== 'restart' || s.manualFile) return null;
+  const asked = s.auto?.now === true;
+  return {
+    label: t(asked ? 'update.restartSoon' : 'update.restartButton'),
+    tooltip: t('update.restartTooltip', { latest: s.latest || '', current: s.current }),
+    asked,
+  };
+}
+
 /**
  * The notice at the bottom right, or null:
  *   countdown  SynaBun is idle and restarts into the update: the seconds left, and Later

package/neural-interface/public/shared/editor/editor-panel-logic.js

@@ -80,9 +80,9 @@ export function matchesExpectedMarkdown(content, expected) {
   return String(content).replace(/\r\n/g, '\n') === expected.replace(/\r\n/g, '\n');
 }
 
-/** Whether a path is the user's OpenCode configuration file. */
+/** Whether a path is the user's OpenCode configuration file (OpenCode 2's opencode.json or opencode.jsonc). */
 export function isOpencodeConfigPath(path) {
-  return String(path || '').replace(/\\/g, '/').endsWith('/.config/opencode/config.json');
+  return /\/\.config\/opencode\/opencode\.jsonc?$/.test(String(path || '').replace(/\\/g, '/'));
 }
 
 const OUTSIDE_ROOTS = 'Path outside registered project roots';

package/neural-interface/public/shared/file-links.js

@@ -36,20 +36,54 @@ const SCHEME_RE = /^([a-z][a-z0-9+.-]*):/i;
 const PLACE_ONLY_RE = /^\d+(?::\d+)?(?:#.*)?$/;
 const LINE_SUFFIX_RE = /:(\d+)(?::(\d+))?$/;
 const LINE_HASH_RE = /^#L(\d+)(?:C(\d+))?(?:-L?\d+(?:C\d+)?)?$/i;
+// Schemes a browser runs or draws content from: never a file's name, not even before a line number.
+const ACTIVE_SCHEMES = new Set(['javascript', 'vbscript', 'livescript', 'data', 'blob', 'filesystem', 'about', 'view-source']);
+// What a scheme can hide behind: a browser drops tabs and line breaks anywhere in a URL and controls at its
+// ends; format characters show nothing; an entity can be left over from a second escape.
+const HIDDEN_RE = /[\u0000-\u001f\u007f-\u009f\u00ad\u200b-\u200f\u2028\u2029\u2060-\u2064\ufeff]/g;
+const ENTITY_RE = /&(?:#(\d+)|#x([0-9a-f]+)|([a-z]+));?/gi;
+const NAMED_ENTITIES = { colon: ':', tab: '\t', newline: '\n', nbsp: ' ', sol: '/', bsol: '\\', num: '#', quest: '?', period: '.', amp: '&', semi: ';', lpar: '(', rpar: ')' };
 
 const slashes = (path) => String(path ?? '').replace(/\\/g, '/');
 
+function decodeEntities(text) {
+  let out = text;
+  for (let round = 0; round < 4; round += 1) { // `&amp;#106;` is `&#106;` once more
+    const next = out.replace(ENTITY_RE, (whole, dec, hex, name) => {
+      if (name) return NAMED_ENTITIES[name.toLowerCase()] ?? whole;
+      const code = dec ? Number(dec) : parseInt(hex, 16);
+      return code > 0 && code <= 0x10ffff ? String.fromCodePoint(code) : '';
+    });
+    if (next === out) break;
+    out = next;
+  }
+  return out;
+}
+
+/** A target as its scheme is read: entities decoded, hidden characters dropped, no spaces at the ends, lower case. */
+function schemeView(value) {
+  return decodeEntities(value).replace(HIDDEN_RE, '').trim().toLowerCase();
+}
+
+// An active scheme, read with its spaces squeezed out too: `java script:` is no URL to a browser, and no file either.
+const isActive = (seen) => ACTIVE_SCHEMES.has(SCHEME_RE.exec(seen.replace(/\s+/g, ''))?.[1]);
+
 /** How a target reads: a `path`, a `file` URL, a `web` address (http, https), or null for anything else. */
 function kindOf(value) {
   if (!value || value.length > MAX_TARGET_LENGTH) return null;
-  if (value.startsWith('#') || value.startsWith('?') || value.startsWith('//')) return null;
+  const seen = schemeView(value);
+  if (!seen || seen.startsWith('#') || seen.startsWith('?') || seen.startsWith('//') || isActive(seen)) return null;
   if (DRIVE_RE.test(value)) return 'path';
-  const scheme = SCHEME_RE.exec(value);
+  const scheme = SCHEME_RE.exec(seen);
   if (!scheme) return 'path';
-  const name = scheme[1].toLowerCase();
+  // A scheme put together from hidden characters or entities (`JaVa\tScript:`, `&#106;avascript:`) is no
+  // file's and no address of this app.
+  const written = SCHEME_RE.exec(value);
+  if (!written || written[1].toLowerCase() !== scheme[1]) return null;
+  const name = scheme[1];
   if (name === 'file') return 'file';
   if (name === 'http' || name === 'https') return 'web';
-  const rest = value.slice(scheme[0].length);
+  const rest = value.slice(written[0].length);
   if (rest.startsWith('//')) return null;
   return PLACE_ONLY_RE.test(rest) ? 'path' : null;
 }
@@ -231,6 +265,33 @@ export function fillFileLinkCopy(key, params = {}) {
 
 // ── The click ──
 
+/**
+ * Whether a link would run a script or draw data when the browser follows it: its `href` (or an SVG link's
+ * `xlink:href`) read the way kindOf reads a target (entities decoded, controls and invisible characters dropped,
+ * lower case), and the scheme the browser itself resolved. Nothing else an anchor carries is asked.
+ * @param {Element} anchor
+ */
+export function isActiveLink(anchor) {
+  for (const name of ['href', 'xlink:href']) {
+    const value = anchor.getAttribute?.(name);
+    if (value != null && isActive(schemeView(String(value)))) return true;
+  }
+  const resolved = typeof anchor.protocol === 'string' ? anchor.protocol.replace(/:$/, '').toLowerCase() : '';
+  return ACTIVE_SCHEMES.has(resolved);
+}
+
+// A kept target is the sanitiser's note of the href as written (safeHref resolved it against the page, or dropped
+// it). It counts only while it is a file's and the href says the same thing; anything else is the href's to say.
+function keptTarget(anchor, href) {
+  const kept = anchor.getAttribute('data-file-target');
+  if (!kept || localFileHref(kept) == null) return null;
+  if (href == null) return kept; // file:, C:\…, name.ext:12: the sanitiser writes no href for them
+  try {
+    const base = anchor.baseURI || `${new URL(href).origin}/`;
+    return new URL(kept.trim(), base).href === new URL(href, base).href ? kept : null;
+  } catch { return null; }
+}
+
 /**
  * What a link points at, as the agent wrote it.
  * @param {Element} anchor
@@ -239,9 +300,9 @@ export function fillFileLinkCopy(key, params = {}) {
  * @returns {{ raw: string, text: boolean } | null}
  */
 export function readFileLink(anchor, { textLinks = '' } = {}) {
-  const kept = anchor.getAttribute('data-file-target');
-  if (kept) return { raw: kept, text: false };
   const href = anchor.getAttribute('href');
+  const kept = keptTarget(anchor, href);
+  if (kept) return { raw: kept, text: false };
   if (textLinks && anchor.matches(textLinks) && (!href || href === '#')) return { raw: anchor.textContent || '', text: true };
   return href ? { raw: href, text: false } : null;
 }
@@ -255,7 +316,8 @@ export function readFileLink(anchor, { textLinks = '' } = {}) {
  * @param {() => string} page.origin the page's origin
  * @param {(key: string, params?: object) => string} page.say a `fileLinks.*` sentence
  * @param {(message: string) => void} page.notify shows a short message
- * @param {(anchor: Element) => void} page.follow goes where a link of this app leads, as the browser would
+ * @param {(anchor: Element) => void} page.follow goes where a link of this app leads, as the browser would (only
+ *   ever for an http(s) address of this app that is the anchor's own href: never a script link)
  */
 export function createFileLinkHandlers(page) {
   const whereOf = (anchor, options) => {
@@ -302,12 +364,15 @@ export function createFileLinkHandlers(page) {
    * @param {(message: string) => void} [options.notify] shows the reason a link was not opened
    * @returns {Promise<string> | null} null when the click is not this handler's (the browser follows the
    *   link as before); else the click is taken and the promise says how it ended: 'opened', 'copied',
-   *   'followed', or the reason the user was told
+   *   'followed', 'blocked' (a script or data link), or the reason the user was told
    */
   function handleClick(event, options = {}) {
     if (event.defaultPrevented || event.button > 0) return null;
     const anchor = event.target?.closest?.('a');
     if (!anchor || (options.within && !options.within.contains(anchor))) return null;
+    // A script or data link in an agent's message goes nowhere, however it is spelled and whatever else the anchor
+    // says (a kept target, a download): the Codex panel's Markdown is not sanitised, so its href can still be one.
+    if (isActiveLink(anchor)) { event.preventDefault(); return Promise.resolve('blocked'); }
     if (anchor.hasAttribute?.('download')) return null; // a file the app itself offers
     const link = readFileLink(anchor, options);
     if (!link) return null;

package/neural-interface/public/shared/html-shell.js

@@ -5,6 +5,7 @@
 
 import { getVariant } from './registry.js';
 import { t } from './i18n.js';
+import { FRAMED_CLASS } from './app-frame.js';
 
 /**
  * The File Explorer's editor panel (slides from the file explorer's right edge).
@@ -86,6 +87,10 @@ export function getSharedHTML() {
   const is3D = variant === '3d';
 
   return `
+<!-- App frame (styles.css APP FRAME): the card's interior under the graph, its border and gutter over the windows -->
+<div id="app-frame-surface" aria-hidden="true"></div>
+<div id="app-frame" aria-hidden="true"></div>
+
 <!-- Loading Overlay -->
 <div id="loading-overlay">
   <div id="loading-mascot" data-state="asleep">
@@ -148,12 +153,6 @@ export function getSharedHTML() {
   <div class="bar-left">
     <img src="synabun.png?v=2" alt="SynaBun" id="titlebar-logo" style="height:24px;width:auto;cursor:pointer;" data-tooltip="${t('tooltip.toggleExplorer')}">
     <div class="bar-sep"></div>
-    <div class="view-toggle">
-      <a class="view-toggle-btn${is3D ? '' : ' active'}" href="${is3D ? '/index2d.html' : '#'}" id="nav-2d-link">${t('nav.toggle2d')}</a>
-      <a class="view-toggle-btn${is3D ? ' active' : ''}" href="${is3D ? '#' : '/'}" id="nav-3d-link">${t('nav.toggle3d')}</a>
-      <span class="view-toggle-sep"></span>
-    </div>
-    <div class="bar-sep"></div>
 
     <!-- OS-style menubar -->
     <div class="menubar">
@@ -203,26 +202,30 @@ export function getSharedHTML() {
             <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><circle cx="12" cy="12" r="10"/><ellipse cx="12" cy="12" rx="4" ry="10"/><line x1="2" y1="12" x2="22" y2="12"/><path d="M4.5 7h15M4.5 17h15" stroke-width="1"/></svg></span> ${t('menu.apps.browser')}</span>
             <span class="menu-shortcut" data-keybind-for="launch-browser"></span>
           </div>
-          <div class="menu-item" id="menu-terminal-youtube">
-            <span class="menu-check"></span>
-            <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="currentColor"><path d="M23.498 6.186a3.016 3.016 0 0 0-2.122-2.136C19.505 3.545 12 3.545 12 3.545s-7.505 0-9.377.505A3.017 3.017 0 0 0 .502 6.186C0 8.07 0 12 0 12s0 3.93.502 5.814a3.016 3.016 0 0 0 2.122 2.136c1.871.505 9.376.505 9.376.505s7.505 0 9.377-.505a3.015 3.015 0 0 0 2.122-2.136C24 15.93 24 12 24 12s0-3.93-.502-5.814zM9.545 15.568V8.432L15.818 12l-6.273 3.568z"/></svg></span> ${t('menu.apps.youtube')}</span>
-            <span class="menu-shortcut" data-keybind-for="launch-youtube"></span>
-          </div>
-          <div class="menu-item" id="menu-terminal-discord">
-            <span class="menu-check"></span>
-            <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="currentColor"><path d="M20.317 4.37a19.791 19.791 0 0 0-4.885-1.515.074.074 0 0 0-.079.037c-.21.375-.444.864-.608 1.25a18.27 18.27 0 0 0-5.487 0 12.64 12.64 0 0 0-.617-1.25.077.077 0 0 0-.079-.037A19.736 19.736 0 0 0 3.677 4.37a.07.07 0 0 0-.032.027C.533 9.046-.32 13.58.099 18.057a.082.082 0 0 0 .031.057 19.9 19.9 0 0 0 5.993 3.03.078.078 0 0 0 .084-.028c.462-.63.874-1.295 1.226-1.994a.076.076 0 0 0-.041-.106 13.107 13.107 0 0 1-1.872-.892.077.077 0 0 1-.008-.128 10.2 10.2 0 0 0 .372-.292.074.074 0 0 1 .077-.01c3.928 1.793 8.18 1.793 12.062 0a.074.074 0 0 1 .078.01c.12.098.246.198.373.292a.077.077 0 0 1-.006.127 12.299 12.299 0 0 1-1.873.892.077.077 0 0 0-.041.107c.36.698.772 1.362 1.225 1.993a.076.076 0 0 0 .084.028 19.839 19.839 0 0 0 6.002-3.03.077.077 0 0 0 .032-.054c.5-5.177-.838-9.674-3.549-13.66a.061.061 0 0 0-.031-.03zM8.02 15.33c-1.183 0-2.157-1.085-2.157-2.419 0-1.333.956-2.419 2.157-2.419 1.21 0 2.176 1.095 2.157 2.42 0 1.333-.956 2.418-2.157 2.418zm7.975 0c-1.183 0-2.157-1.085-2.157-2.419 0-1.333.955-2.419 2.157-2.419 1.21 0 2.176 1.095 2.157 2.42 0 1.333-.946 2.418-2.157 2.418z"/></svg></span> Discord</span>
-          </div>
-          <div class="menu-item" id="menu-terminal-x">
-            <span class="menu-check"></span>
-            <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="currentColor"><path d="M18.244 2.25h3.308l-7.227 8.26 8.502 11.24H16.17l-5.214-6.817L4.99 21.75H1.68l7.73-8.835L1.254 2.25H8.08l4.713 6.231zm-1.161 17.52h1.833L7.084 4.126H5.117z"/></svg></span> X</span>
-          </div>
-          <div class="menu-item" id="menu-terminal-whatsapp">
-            <span class="menu-check"></span>
-            <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="currentColor"><path d="M17.472 14.382c-.297-.149-1.758-.867-2.03-.967-.273-.099-.471-.148-.67.15-.197.297-.767.966-.94 1.164-.173.199-.347.223-.644.075-.297-.15-1.255-.463-2.39-1.475-.883-.788-1.48-1.761-1.653-2.059-.173-.297-.018-.458.13-.606.134-.133.298-.347.446-.52.149-.174.198-.298.298-.497.099-.198.05-.371-.025-.52-.075-.149-.669-1.612-.916-2.207-.242-.579-.487-.5-.669-.51-.173-.008-.371-.01-.57-.01-.198 0-.52.074-.792.372-.272.297-1.04 1.016-1.04 2.479 0 1.462 1.065 2.875 1.213 3.074.149.198 2.096 3.2 5.077 4.487.709.306 1.262.489 1.694.625.712.227 1.36.195 1.871.118.571-.085 1.758-.719 2.006-1.413.248-.694.248-1.289.173-1.413-.074-.124-.272-.198-.57-.347m-5.421 7.403h-.004a9.87 9.87 0 01-5.031-1.378l-.361-.214-3.741.982.998-3.648-.235-.374a9.86 9.86 0 01-1.51-5.26c.001-5.45 4.436-9.884 9.888-9.884 2.64 0 5.122 1.03 6.988 2.898a9.825 9.825 0 012.893 6.994c-.003 5.45-4.437 9.884-9.885 9.884m8.413-18.297A11.815 11.815 0 0012.05 0C5.495 0 .16 5.335.157 11.892c0 2.096.547 4.142 1.588 5.945L.057 24l6.305-1.654a11.882 11.882 0 005.683 1.448h.005c6.554 0 11.89-5.335 11.893-11.893a11.821 11.821 0 00-3.48-8.413z"/></svg></span> WhatsApp</span>
-          </div>
-          <div class="menu-item" id="menu-app-leonardo" hidden>
-            <span class="menu-check"></span>
-            <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="currentColor"><path d="M9.5 2l1.5 3.5L14.5 7l-3.5 1.5L9.5 12l-1.5-3.5L4.5 7l3.5-1.5L9.5 2zM19 10l1 2 2 1-2 1-1 2-1-2-2-1 2-1 1-2zM5 17l1 2 2 1-2 1-1 2-1-2-2-1 2-1 1-2z"/></svg></span> Leonardo.AI</span>
+          <!-- Browser apps: a submenu (ui-menubar.js wireSubmenus) -->
+          <div class="menu-item menu-submenu-parent" id="menu-browser-apps" data-submenu="browser-apps" aria-haspopup="menu" aria-expanded="false">
+            <span class="menu-check"></span>
+            <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="7" height="7" rx="1"/><rect x="14" y="3" width="7" height="7" rx="1"/><rect x="3" y="14" width="7" height="7" rx="1"/><rect x="14" y="14" width="7" height="7" rx="1"/></svg></span> ${t('menu.apps.browserApps')}</span>
+            <span class="menu-submenu-arrow" aria-hidden="true"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg></span>
+          </div>
+          <div class="menubar-submenu" data-submenu-for="browser-apps" role="menu">
+            <div class="menu-item" id="menu-terminal-youtube">
+              <span class="menu-check"></span>
+              <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="currentColor"><path d="M23.498 6.186a3.016 3.016 0 0 0-2.122-2.136C19.505 3.545 12 3.545 12 3.545s-7.505 0-9.377.505A3.017 3.017 0 0 0 .502 6.186C0 8.07 0 12 0 12s0 3.93.502 5.814a3.016 3.016 0 0 0 2.122 2.136c1.871.505 9.376.505 9.376.505s7.505 0 9.377-.505a3.015 3.015 0 0 0 2.122-2.136C24 15.93 24 12 24 12s0-3.93-.502-5.814zM9.545 15.568V8.432L15.818 12l-6.273 3.568z"/></svg></span> ${t('menu.apps.youtube')}</span>
+              <span class="menu-shortcut" data-keybind-for="launch-youtube"></span>
+            </div>
+            <div class="menu-item" id="menu-terminal-discord">
+              <span class="menu-check"></span>
+              <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="currentColor"><path d="M20.317 4.37a19.791 19.791 0 0 0-4.885-1.515.074.074 0 0 0-.079.037c-.21.375-.444.864-.608 1.25a18.27 18.27 0 0 0-5.487 0 12.64 12.64 0 0 0-.617-1.25.077.077 0 0 0-.079-.037A19.736 19.736 0 0 0 3.677 4.37a.07.07 0 0 0-.032.027C.533 9.046-.32 13.58.099 18.057a.082.082 0 0 0 .031.057 19.9 19.9 0 0 0 5.993 3.03.078.078 0 0 0 .084-.028c.462-.63.874-1.295 1.226-1.994a.076.076 0 0 0-.041-.106 13.107 13.107 0 0 1-1.872-.892.077.077 0 0 1-.008-.128 10.2 10.2 0 0 0 .372-.292.074.074 0 0 1 .077-.01c3.928 1.793 8.18 1.793 12.062 0a.074.074 0 0 1 .078.01c.12.098.246.198.373.292a.077.077 0 0 1-.006.127 12.299 12.299 0 0 1-1.873.892.077.077 0 0 0-.041.107c.36.698.772 1.362 1.225 1.993a.076.076 0 0 0 .084.028 19.839 19.839 0 0 0 6.002-3.03.077.077 0 0 0 .032-.054c.5-5.177-.838-9.674-3.549-13.66a.061.061 0 0 0-.031-.03zM8.02 15.33c-1.183 0-2.157-1.085-2.157-2.419 0-1.333.956-2.419 2.157-2.419 1.21 0 2.176 1.095 2.157 2.42 0 1.333-.956 2.418-2.157 2.418zm7.975 0c-1.183 0-2.157-1.085-2.157-2.419 0-1.333.955-2.419 2.157-2.419 1.21 0 2.176 1.095 2.157 2.42 0 1.333-.946 2.418-2.157 2.418z"/></svg></span> Discord</span>
+            </div>
+            <div class="menu-item" id="menu-terminal-x">
+              <span class="menu-check"></span>
+              <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="currentColor"><path d="M18.244 2.25h3.308l-7.227 8.26 8.502 11.24H16.17l-5.214-6.817L4.99 21.75H1.68l7.73-8.835L1.254 2.25H8.08l4.713 6.231zm-1.161 17.52h1.833L7.084 4.126H5.117z"/></svg></span> X</span>
+            </div>
+            <div class="menu-item" id="menu-terminal-whatsapp">
+              <span class="menu-check"></span>
+              <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="currentColor"><path d="M17.472 14.382c-.297-.149-1.758-.867-2.03-.967-.273-.099-.471-.148-.67.15-.197.297-.767.966-.94 1.164-.173.199-.347.223-.644.075-.297-.15-1.255-.463-2.39-1.475-.883-.788-1.48-1.761-1.653-2.059-.173-.297-.018-.458.13-.606.134-.133.298-.347.446-.52.149-.174.198-.298.298-.497.099-.198.05-.371-.025-.52-.075-.149-.669-1.612-.916-2.207-.242-.579-.487-.5-.669-.51-.173-.008-.371-.01-.57-.01-.198 0-.52.074-.792.372-.272.297-1.04 1.016-1.04 2.479 0 1.462 1.065 2.875 1.213 3.074.149.198 2.096 3.2 5.077 4.487.709.306 1.262.489 1.694.625.712.227 1.36.195 1.871.118.571-.085 1.758-.719 2.006-1.413.248-.694.248-1.289.173-1.413-.074-.124-.272-.198-.57-.347m-5.421 7.403h-.004a9.87 9.87 0 01-5.031-1.378l-.361-.214-3.741.982.998-3.648-.235-.374a9.86 9.86 0 01-1.51-5.26c.001-5.45 4.436-9.884 9.888-9.884 2.64 0 5.122 1.03 6.988 2.898a9.825 9.825 0 012.893 6.994c-.003 5.45-4.437 9.884-9.885 9.884m8.413-18.297A11.815 11.815 0 0012.05 0C5.495 0 .16 5.335.157 11.892c0 2.096.547 4.142 1.588 5.945L.057 24l6.305-1.654a11.882 11.882 0 005.683 1.448h.005c6.554 0 11.89-5.335 11.893-11.893a11.821 11.821 0 00-3.48-8.413z"/></svg></span> WhatsApp</span>
+            </div>
           </div>
           <div class="menu-sep"></div>
           <div class="menu-item" id="menu-command-runner">
@@ -239,6 +242,48 @@ export function getSharedHTML() {
             <span class="menu-shortcut">T</span>
           </div>
           <div class="menu-sep"></div>
+${is3D ? `          <!-- Map (3D memory map) -->
+          <div class="menu-item menu-submenu-parent" id="menu-map-label" data-menu="graph" data-submenu="map" aria-haspopup="menu" aria-expanded="false">
+            <span class="menu-check"></span>
+            <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polygon points="1 6 1 22 8 18 16 22 23 18 23 2 16 6 8 2 1 6"/><line x1="8" y1="2" x2="8" y2="18"/><line x1="16" y1="6" x2="16" y2="22"/></svg></span> ${t('nav.map')}</span>
+            <span class="menu-submenu-arrow" aria-hidden="true"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg></span>
+          </div>
+          <div class="menubar-submenu" data-submenu-for="map" role="menu">
+            <div class="menu-item" id="menu-map-frame-all">
+              <span class="menu-check"></span>
+              <span class="menu-text">${t('map.menu.frameAll')}</span>
+              <span class="menu-shortcut" data-keybind-for="map-frame-all"></span>
+            </div>
+            <div class="menu-item menu-toggle" id="menu-map-neighbors">
+              <span class="menu-check">&#10003;</span>
+              <span class="menu-text">${t('map.menu.neighbors')}</span>
+            </div>
+            <div class="menu-item menu-toggle" id="menu-map-recency">
+              <span class="menu-check">&#10003;</span>
+              <span class="menu-text">${t('map.menu.recency')}</span>
+            </div>
+            <div class="menu-item menu-toggle" id="menu-map-grid">
+              <span class="menu-check">&#10003;</span>
+              <span class="menu-text">${t('map.menu.grid')}</span>
+            </div>
+            <div class="menu-item" id="menu-map-rebuild">
+              <span class="menu-check"></span>
+              <span class="menu-text">${t('map.menu.rebuild')}</span>
+            </div>
+          </div>
+` : ''}          <!-- Games -->
+          <div class="menu-item menu-submenu-parent" id="menu-games-label" data-submenu="games" aria-haspopup="menu" aria-expanded="false">
+            <span class="menu-check"></span>
+            <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="6" y1="11" x2="10" y2="11"/><line x1="8" y1="9" x2="8" y2="13"/><line x1="15" y1="12" x2="15.01" y2="12"/><line x1="18" y1="10" x2="18.01" y2="10"/><path d="M17.32 5H6.68a4 4 0 0 0-3.978 3.59c-.006.052-.01.101-.017.152C2.604 9.416 2 14.456 2 16a3 3 0 0 0 3 3c1 0 1.5-.5 2-1l1.414-1.414A2 2 0 0 1 9.828 16h4.344a2 2 0 0 1 1.414.586L17 18c.5.5 1 1 2 1a3 3 0 0 0 3-3c0-1.545-.604-6.584-.685-7.258-.007-.05-.011-.1-.017-.151A4 4 0 0 0 17.32 5z"/></svg></span> ${t('nav.games')}</span>
+            <span class="menu-submenu-arrow" aria-hidden="true"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg></span>
+          </div>
+          <div class="menubar-submenu" data-submenu-for="games" role="menu">
+            <div class="menu-item" id="menu-game-tictactoe">
+              <span class="menu-check"></span>
+              <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="8" y1="2" x2="8" y2="22"/><line x1="16" y1="2" x2="16" y2="22"/><line x1="2" y1="8" x2="22" y2="8"/><line x1="2" y1="16" x2="22" y2="16"/></svg></span> ${t('menu.games.ticTacToe')}</span>
+            </div>
+          </div>
+          <div class="menu-sep"></div>
           <div class="menu-item" id="menu-install-app" style="display:none">
             <span class="menu-check"></span>
             <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></svg></span> Install as App</span>
@@ -301,39 +346,8 @@ export function getSharedHTML() {
         </div>
       </div>
 
-${is3D ? `
-      <!-- Map menu (3D memory map) -->
-      <div class="menubar-item" data-menu="graph">
-        <button class="menubar-label">${t('nav.map')}</button>
-        <div class="menubar-dropdown glass">
-          <div class="menu-item" id="menu-map-frame-all">
-            <span class="menu-check"></span>
-            <span class="menu-text">${t('map.menu.frameAll')}</span>
-            <span class="menu-shortcut" data-keybind-for="map-frame-all"></span>
-          </div>
-          <div class="menu-sep"></div>
-          <div class="menu-item menu-toggle" id="menu-map-neighbors">
-            <span class="menu-check">&#10003;</span>
-            <span class="menu-text">${t('map.menu.neighbors')}</span>
-          </div>
-          <div class="menu-item menu-toggle" id="menu-map-recency">
-            <span class="menu-check">&#10003;</span>
-            <span class="menu-text">${t('map.menu.recency')}</span>
-          </div>
-          <div class="menu-item menu-toggle" id="menu-map-grid">
-            <span class="menu-check">&#10003;</span>
-            <span class="menu-text">${t('map.menu.grid')}</span>
-          </div>
-          <div class="menu-sep"></div>
-          <div class="menu-item" id="menu-map-rebuild">
-            <span class="menu-check"></span>
-            <span class="menu-text">${t('map.menu.rebuild')}</span>
-          </div>
-        </div>
-      </div>
-
-` : `
-      <!-- Graph menu -->
+${is3D ? '' : `
+      <!-- Graph menu (2D; the 3D Map's controls are a section of Apps) -->
       <div class="menubar-item" data-menu="graph">
         <button class="menubar-label">${t('nav.graph')}</button>
         <div class="menubar-dropdown glass">
@@ -423,23 +437,6 @@ ${is3D ? `
             <span class="menu-shortcut">A</span>
           </div>
           <div class="menu-sep"></div>
-          <div class="menu-item" id="menu-automations-schedules">
-            <span class="menu-check"></span>
-            <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><path d="M12 6v6l4 2"/></svg></span> Schedules</span>
-          </div>
-          <div class="menu-item" id="menu-automations-schedule-new">
-            <span class="menu-check"></span>
-            <span class="menu-text">New Cron Schedule</span>
-          </div>
-          <div class="menu-item" id="menu-automations-quick-timer">
-            <span class="menu-check"></span>
-            <span class="menu-text">Quick Timer</span>
-          </div>
-          <div class="menu-item" id="menu-automations-schedule-groups">
-            <span class="menu-check"></span>
-            <span class="menu-text">Schedule Groups</span>
-          </div>
-          <div class="menu-sep"></div>
           <div class="menu-item" id="menu-automations-new">
             <span class="menu-check"></span>
             <span class="menu-text">${t('menu.automations.newAutomation')}</span>
@@ -451,16 +448,8 @@ ${is3D ? `
         </div>
       </div>
 
-      <!-- Games menu -->
-      <div class="menubar-item" data-menu="games">
-        <button class="menubar-label">${t('nav.games')}</button>
-        <div class="menubar-dropdown glass">
-          <div class="menu-item" id="menu-game-tictactoe">
-            <span class="menu-check"></span>
-            <span class="menu-text"><span class="menu-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="8" y1="2" x2="8" y2="22"/><line x1="16" y1="2" x2="16" y2="22"/><line x1="2" y1="8" x2="22" y2="8"/><line x1="2" y1="16" x2="22" y2="16"/></svg></span> ${t('menu.games.ticTacToe')}</span>
-          </div>
-        </div>
-      </div>
+      <!-- Schedules (opens and closes the Schedules window; no dropdown) -->
+      <button type="button" class="menubar-label menubar-action" id="menubar-schedules-btn" aria-expanded="false" aria-controls="schedules-studio-panel">${t('nav.schedules')}</button>
 
       <!-- Settings (text button) -->
       <button class="menubar-label menubar-action" id="menubar-settings-btn">${t('nav.settings')}</button>
@@ -868,5 +857,8 @@ ${getEditorPanelHTML()}
  * Call this once at the start of variant main.js, BEFORE any DOM queries.
  */
 export function injectSharedHTML() {
+  // The workspace sits in the inset rounded frame (app-frame.js): set before the shell lands, so nothing is laid
+  // out once without it.
+  document.documentElement.classList.add(FRAMED_CLASS);
   document.body.insertAdjacentHTML('afterbegin', getSharedHTML());
 }

package/neural-interface/public/shared/i18n.js

@@ -246,6 +246,8 @@ export function setLocaleChoice(choice) {
   const value = choice === SYSTEM_LOCALE ? SYSTEM_LOCALE : (SUPPORTED_LOCALES.includes(choice) ? choice : null);
   if (!value) return false;
   storage.setItem(LOCALE_STORAGE_KEY, value);
+  // Windows that open again after the reload (the Schedules window) note it now, while they are open.
+  try { globalThis.window?.dispatchEvent?.(new CustomEvent('synabun:locale-change', { detail: { choice: value } })); } catch { /* nobody listens */ }
   // The store writes to the server after a pause; the reload must read the new choice.
   // (A write still pending when the page unloads goes out as a beacon, so a slow server only delays the reload.)
   const written = Promise.resolve().then(() => storageModule.flushStorage?.()).catch(() => {});

package/neural-interface/public/shared/launch-prefetch.js

@@ -0,0 +1,59 @@
+// ═══════════════════════════════════════════
+// SynaBun Neural Interface — launch prefetch
+// ═══════════════════════════════════════════
+// What windows, menus and dropdowns wait for when they open, read once the
+// page has painted: in idle time, one step after another with a pause
+// between two, so the page never stutters for it and the first open of each
+// window paints from the data cache (data-cache.js). Each module registers
+// its own steps (registerLaunchPrefetch); the page starts the queue after its
+// first paint (startLaunchPrefetch). A step that fails is the window's to ask
+// again when it opens. `owner` steps read what an invite guest may not.
+
+import { whenIdle } from './data-cache.js';
+
+const STEP_LIMIT_MS = 15_000; // a step that hangs does not hold the ones after it
+const STEP_GAP_MS = 120;
+
+const steps = [];
+let started = false;
+let running = false;
+let guest = () => false;
+
+/** Add a step: `run()` reads something into a cache. Lower `order` runs first. */
+export function registerLaunchPrefetch(name, run, { order = 50, owner = false } = {}) {
+  if (typeof run !== 'function' || steps.some((step) => step.name === name)) return;
+  steps.push({ name, run, order, owner, done: false });
+  steps.sort((a, b) => a.order - b.order);
+  if (started) pump();
+}
+
+/** Start the queue (once): after the first paint, `delayMs` later and in idle time. */
+export function startLaunchPrefetch({ delayMs = 600, isGuest = () => false } = {}) {
+  if (started) return;
+  started = true;
+  guest = typeof isGuest === 'function' ? isGuest : () => false;
+  setTimeout(pump, delayMs);
+}
+
+function pump() {
+  if (running) return;
+  const next = steps.find((step) => !step.done);
+  if (!next) return;
+  running = true;
+  whenIdle(async () => {
+    next.done = true;
+    let skip = false;
+    try { skip = next.owner && guest(); } catch { skip = false; }
+    if (!skip) {
+      let timer = null;
+      try {
+        await Promise.race([
+          Promise.resolve().then(next.run),
+          new Promise((done) => { timer = setTimeout(done, STEP_LIMIT_MS); }),
+        ]);
+      } catch { /* the window asks again when it opens */ }
+      clearTimeout(timer);
+    }
+    setTimeout(() => { running = false; pump(); }, STEP_GAP_MS);
+  }, { timeout: 2000 });
+}

package/neural-interface/public/shared/ocp-v2/ocp-v2-approvals.js

@@ -200,14 +200,14 @@ export async function setAutoAccept(store, api, enabled, { cwd, isDescendant } =
 }
 
 /**
- * How long an "Always allow" lasts, for the card. On OpenCode 1.18.34 the
- * answer is kept by the serve process that runs the session: the patterns are
- * allowed for the project on that serve until it restarts. It is not written
- * to OpenCode's saved-permissions store (`/api/permission/saved` stays empty
- * after an "always"; checked against a live serve), so there is no list of
- * earlier answers to show or take back.
+ * How far an "Always allow" reaches, for the card. OpenCode 2 saves the answer
+ * for the session's project: after an "always" reply on 2.1.4,
+ * `GET /api/permission/saved` lists `{ projectID, action, resource }` with the
+ * card's pattern (checked against a live serve), so it holds in every session
+ * of that project and outlives the serve. The panel shows no list of saved
+ * answers; OpenCode's own saved permissions are where one is taken back.
  */
-export const ALWAYS_ALLOW_SCOPE = 'until this session\u2019s OpenCode runtime restarts';
+export const ALWAYS_ALLOW_SCOPE = 'in every session of this project: OpenCode saves the answer';
 
 // ── Questions ───────────────────────────────────────────────────────────────
 // The answer path of a question card, whatever built the card: a request in

package/neural-interface/public/shared/ocp-v2/ocp-v2-binding.js

@@ -63,7 +63,7 @@ function frozenCopy(value, seen = new Map()) {
  *   isCurrent()  an extra veto, e.g. "this child panel is still the open one"
  * Returns a frozen token:
  *   binding, sessionId, cwd, directory (cwd, else the session's directory),
- *   model, variant, agent, mode, mcpProfile, sessionInfo (model and
+ *   model, variant, agent, mode, tools, sessionInfo (model and
  *   sessionInfo are frozen copies, nested objects included)
  *   isCurrent()  the store is still on this binding
  *   isStale()    the opposite
@@ -90,7 +90,7 @@ export function captureBinding(store, { sessionId, isCurrent } = {}) {
     variant: s.variant || null,
     agent: s.agent || null,
     mode: s.mode || null,
-    mcpProfile: s.mcpProfile || null,
+    tools: s.tools ? frozenCopy(s.tools) : null,
     sessionInfo: s.sessionInfo ? frozenCopy(s.sessionInfo) : null,
     isCurrent: current,
     isStale: () => !current(),
@@ -218,8 +218,8 @@ export function boundReader(store) {
 // another tab after it. Both were started on the same binding.
 //
 // So where the panel goes has an identity of its own. Every choice of the user
-// (a tab, a session in the menu, New session, another project, a new worktree)
-// begins an intent, and a navigation binds the panel only while its intent is
+// (a tab, a session in the menu, New session, another project) begins an
+// intent, and a navigation binds the panel only while its intent is
 // the latest one: after every wait it checks `isCurrent()`, and it binds
 // through `apply()`. A later choice always wins over an older one that is
 // still in flight. A rebinding nobody announced (the active tab was closed)