synabun 2.0.9 → 2.1.0

package/neural-interface/public/shared/ocp-v2/{ocp-v2-profile-inheritance.js → ocp-v2-tools-inheritance.js}

@@ -16,12 +16,12 @@ export function readOpenCodeSessionLink(event = {}) {
   };
 }
 
-export function bindOpenCodeChildSessionProfile({
+export function bindOpenCodeChildSessionTools({
   eventType,
   event,
   sourceRuntime,
   sessionToRuntime,
-  sessionProfiles,
+  sessionTools,
   runtimes,
 }) {
   if (!CHILD_LINK_EVENT_TYPES.has(eventType)) return { bound: false, reason: 'event-type' };
@@ -41,10 +41,10 @@ export function bindOpenCodeChildSessionProfile({
     runtimes?.get(previousRuntimeId)?.sessions?.delete(childSessionId);
   }
 
-  const profile = sourceRuntime.mcpProfile || sessionProfiles?.get(parentSessionId) || null;
+  const tools = sourceRuntime.tools || sessionTools?.get(parentSessionId) || null;
   sessionToRuntime.set(childSessionId, sourceRuntimeId);
-  if (profile) sessionProfiles.set(childSessionId, profile);
-  else sessionProfiles.delete(childSessionId);
+  if (tools) sessionTools.set(childSessionId, tools);
+  else sessionTools.delete(childSessionId);
   sourceRuntime.sessions?.add(childSessionId);
 
   return {
@@ -52,27 +52,27 @@ export function bindOpenCodeChildSessionProfile({
     childSessionId,
     parentSessionId,
     runtimeId: sourceRuntimeId,
-    profile,
+    tools,
   };
 }
 
 /**
- * The MCP profile a sub-agent panel starts with: its parent's. The primary
+ * The MCP tools a sub-agent panel starts with: its parent's. The primary
  * panel's store speaks for the parent only while it is bound to that parent
- * (`parentSessionId`): after a switch its profile is another session's, and
- * then the parent's saved choice (`savedProfile(parentSessionId)`) or what the
+ * (`parentSessionId`): after a switch its tools is another session's, and
+ * then the parent's saved choice (`savedTools(parentSessionId)`) or what the
  * child session itself carries is used. Without `parentSessionId` the parent
  * store is trusted as before.
  */
-export function inheritChildPanelMcpProfile(childStore, parentStore, childInfo = null, { parentSessionId, savedProfile } = {}) {
+export function inheritChildPanelTools(childStore, parentStore, childInfo = null, { parentSessionId, savedTools } = {}) {
   const parentState = parentStore?.getState?.() || null;
   const parentIsBound = !parentSessionId || parentState?.sessionId === parentSessionId;
-  const parentProfile = parentIsBound ? (parentState?.mcpProfile || null) : null;
+  const parentTools = parentIsBound ? (parentState?.tools || null) : null;
   let saved = null;
-  if (!parentProfile && parentSessionId && typeof savedProfile === 'function') {
-    try { saved = savedProfile(parentSessionId) || null; } catch { saved = null; }
+  if (!parentTools && parentSessionId && typeof savedTools === 'function') {
+    try { saved = savedTools(parentSessionId) || null; } catch { saved = null; }
   }
-  const profile = parentProfile || saved || childInfo?.mcpProfile || null;
-  if (profile) childStore?.setMcpProfile?.(profile);
-  return profile;
+  const tools = parentTools || saved || childInfo?.tools || null;
+  if (tools) childStore?.setTools?.(tools);
+  return tools;
 }

package/neural-interface/public/shared/ocp-v2/ocp-v2-ws.js

@@ -6,6 +6,7 @@
 // listeners (used by the panel manager to spawn child panels).
 // ─────────────────────────────────────────────────────────────────────────────
 
+import { createOutcomeNotifications } from './ocp-v2-outcome-notifications.js';
 import { getDefaultStore } from './ocp-v2-state.js';
 import { notify as uiNotify, NOTIF_TYPE } from '../ui-notifications.js';
 import { nativeLoopWindowId } from '../ui-native-window-id.js';
@@ -13,30 +14,20 @@ import { registerAutomationSession } from './ocp-v2-automation-ownership.js';
 import { applyEvent, resolveEventTargets } from './ocp-v2-events.js';
 import { createCapabilities, gatedRequest } from './ocp-v2-caps.js';
 import { shouldAutoAccept, autoAcceptRequest, autoAcceptInherited } from './ocp-v2-approvals.js';
-import { verifyDescendant, knownDescendant, createReconnectNotifier, requestOwner } from './ocp-v2-rehydrate.js';
+import { verifyDescendant, descendantState, knownDescendant, createReconnectNotifier, requestOwner } from './ocp-v2-rehydrate.js';
+import { createAskTracker, createTurnClock, readOpenAsks, unreadAsksNotice, TURN_LIMIT_MS } from './ocp-v2-send-logic.js';
 
 // Request types the connected server answers. Empty against a server that
 // predates the list; cleared on every disconnect and refilled on reconnect.
 export const capabilities = createCapabilities();
 export const supports = (...types) => capabilities.hasAll(...types);
-// The @opencode-ai/sdk version the server answered `init` with ('' from a
-// server that does not say).
-let _sdkVersion = '';
-export const sdkVersion = () => _sdkVersion;
 
 const _notifiedPermissionIds = new Set();
-// Per-store DONE/ERROR dedup: once an outcome fires for a turn, suppress
-// duplicates until the next time `running` flips back to true (new turn).
-// ERROR locks out future DONE; DONE allows a later ERROR through.
-const _outcomeKey = new WeakMap();        // store → NOTIF_TYPE.DONE | NOTIF_TYPE.ERROR
-const _outcomeSubscribed = new WeakSet(); // stores already wired for reset
+const _outcomes = createOutcomeNotifications();
 
 function _fireOutcomeNotify(store, type) {
-  const last = _outcomeKey.get(store);
-  if (last === type) return;
-  if (last === NOTIF_TYPE.ERROR && type === NOTIF_TYPE.DONE) return;
-  _outcomeKey.set(store, type);
   const s = store.getState();
+  if (!_outcomes.take(s, type === NOTIF_TYPE.ERROR ? 'error' : 'done')) return;
   const baseLabel = s.sessionInfo?.title || s.sessionInfo?.info?.title || 'OpenCode';
   const label = s.parentSessionId ? `↳ ${baseLabel}` : baseLabel;
   try {
@@ -44,18 +35,6 @@ function _fireOutcomeNotify(store, type) {
   } catch (err) { console.warn('[ocp-v2-ws] outcome notify failed', err); }
 }
 
-function _ensureOutcomeReset(store) {
-  if (_outcomeSubscribed.has(store)) return;
-  _outcomeSubscribed.add(store);
-  try {
-    store.subscribe((event, state) => {
-      if (event?.type === 'running:set' && state.running) {
-        _outcomeKey.delete(store);
-      }
-    });
-  } catch (err) { console.warn('[ocp-v2-ws] outcome subscribe failed', err); }
-}
-
 let _ws = null;
 let _connecting = null;
 let _reqSeq = 0;
@@ -99,6 +78,7 @@ export async function connect() {
       catch (err) { console.warn('[ocp-v2-ws] identify failed', err); }
       _connecting = null;
       _reconnects.opened();
+      asksOpened();
       resolve(ws);
     });
 
@@ -114,7 +94,11 @@ export async function connect() {
       _connecting = null;
       capabilities.clear();
       _reconnects.closed();
-      for (const [, p] of _pending) p.reject(new Error('websocket closed'));
+      for (const [, p] of _pending) { p.timeout.cancel(); p.reject(new Error('websocket closed')); }
+      // What waits on the user is not known again until the server's lists are read after the reconnect
+      // (rebuildAsks): until then no turn's clock counts. A socket that never opened lost nothing.
+      if (opened) _asks.hold();
+      asksClosed();
       _pending.clear();
       broadcastServerStatus({ status: 'reconnecting' });
       setTimeout(() => { connect().catch(() => {}); }, 1500);
@@ -139,6 +123,21 @@ function broadcastServerStatus(payload) {
   for (const store of _allStores) store.setServerStatus(payload);
 }
 
+// Why OpenCode cannot be used, as the server says it (an OpenCode version
+// SynaBun does not drive, a port held by an OpenCode server it did not start,
+// a web page where the API should be): one line in each panel's error list,
+// never a second copy of the same sentence while the panel keeps retrying.
+function broadcastServerProblem(text) {
+  const message = typeof text === 'string' ? text.trim().slice(0, 600) : '';
+  if (!message) return;
+  const stores = _allStores.size ? [..._allStores] : [getDefaultStore()];
+  for (const store of stores) {
+    const errors = store.getState?.().errors || [];
+    if (errors.some((err) => err?.message === message)) continue;
+    store.pushError?.({ message, kind: 'server' });
+  }
+}
+
 export function disconnect() {
   if (_ws) {
     try { _ws.close(); } catch {}
@@ -152,7 +151,6 @@ export function disconnect() {
 export function subscribeSession(sessionId, store) {
   if (!store) return () => {};
   _allStores.add(store);
-  _ensureOutcomeReset(store);
   if (!sessionId) {
     // Not yet bound — caller should call again once a session exists.
     return () => { _allStores.delete(store); };
@@ -160,6 +158,7 @@ export function subscribeSession(sessionId, store) {
   let set = _storesBySession.get(sessionId);
   if (!set) { set = new Set(); _storesBySession.set(sessionId, set); }
   set.add(store);
+  readAsksOf(sessionId);
   return () => {
     const s = _storesBySession.get(sessionId);
     if (s) {
@@ -195,6 +194,7 @@ function handleMessage(msg) {
     // Broadcast to every registered store; also poke the default singleton
     // so legacy callers (no panel registered yet) still see status.
     broadcastServerStatus(payload);
+    if (msg.status === 'error' && msg.error) broadcastServerProblem(msg.error);
     return;
   }
 
@@ -206,6 +206,7 @@ function handleMessage(msg) {
   if (msg.type === 'capabilities') {
     capabilities.set(msg.capabilities);
     _reconnects.capabilities();
+    asksReady();
     return;
   }
 
@@ -216,6 +217,7 @@ function handleMessage(msg) {
     if (msg.nativeRunId && msg.nativeRootSessionId) {
       registerAutomationSession(msg.nativeRootSessionId, msg.nativeRunId);
     }
+    _asks.note(msg.eventType, msg.event || {});
     handleEvent(msg.eventType, msg.event || {});
     fanout(msg.eventType, msg.event || {});
     return;
@@ -224,10 +226,11 @@ function handleMessage(msg) {
   if (msg.id != null && _pending.has(msg.id)) {
     const p = _pending.get(msg.id);
     _pending.delete(msg.id);
-    clearTimeout(p.timeout);
+    p.timeout.cancel();
     if (msg.type === 'init:result') {
       capabilities.set(msg.capabilities);
-      if (typeof msg.sdkVersion === 'string') _sdkVersion = msg.sdkVersion;
+      if (msg.ready === false && msg.problem) broadcastServerProblem(msg.problem);
+      asksReady();
     }
     p.resolve(msg);
     return;
@@ -265,6 +268,18 @@ function handleEvent(eventType, ev) {
 // Lets a sub-agent's permission or question reach the panel of its parent
 // when no child panel is open for it.
 const _parentOf = new Map();
+
+// Requests that wait on the user, by session (a sub-agent's count for its parent): a turn's send does not
+// count the time they wait (createTurnClock). A permission left open for more than 30 minutes used to end
+// the turn's send with "request timeout: message:send" while the turn went on in OpenCode. Across a lost
+// socket they are held from the close and read again from the server after the reconnect (rebuildAsks); a
+// session a panel is bound to after the page loaded has its own read once (readAsksOf).
+const _asks = createAskTracker({ parentOf: _parentOf });
+/** True while `sessionId`, or a sub-agent below it, waits on a permission or a question. */
+export const sessionWaitsOnUser = (sessionId) => _asks.waits(sessionId);
+/** `listener()` whenever what waits on the user may have changed; returns an unsubscribe. */
+export const onAsksChanged = (listener) => _asks.subscribe(listener);
+
 function rememberParent(ev) {
   const info = ev?.info || ev?.session || ev || {};
   const childId = info.id || ev?.sessionID || ev?.sessionId;
@@ -316,15 +331,19 @@ const _rootSessions = new Set();
  * from the session itself. Anything that cannot be established is false.
  */
 export function isDescendantSession(sessionId, ancestorId) {
-  return verifyDescendant(sessionId, ancestorId, {
-    parentOf: _parentOf,
-    roots: _rootSessions,
-    fetchParent: async (id) => {
-      const res = await api.sessionGet(id);
-      if (!res || res.error || (typeof res.status === 'number' && res.status >= 400) || !res.data?.id) return null;
-      return String(res.data.parentID || res.data.parentId || '');
-    },
-  });
+  return verifyDescendant(sessionId, ancestorId, { parentOf: _parentOf, roots: _rootSessions, fetchParent: fetchSessionParent });
+}
+
+// The same question with "could not be read" kept apart from "no" (true, false or null): what the open
+// requests read from the server need, so that a sub-agent whose place is unknown keeps its parent waiting.
+function sessionAncestry(sessionId, ancestorId) {
+  return descendantState(sessionId, ancestorId, { parentOf: _parentOf, roots: _rootSessions, fetchParent: fetchSessionParent });
+}
+
+async function fetchSessionParent(id) {
+  const res = await api.sessionGet(id);
+  if (!res || res.error || (typeof res.status === 'number' && res.status >= 400) || !res.data?.id) return null;
+  return String(res.data.parentID || res.data.parentId || '');
 }
 
 /**
@@ -336,11 +355,135 @@ export function isKnownDescendantSession(sessionId, ancestorId) {
   return knownDescendant(sessionId, ancestorId, _parentOf);
 }
 
+// ── What waits on the user, read from the server ───────────────────────────
+// The stream says what is asked and answered while the socket is up. What was asked before (the page loaded,
+// a panel was bound to another session, the socket was down) is read from the server (permission:list and
+// question:list), one session at a time: its clocks wait until then. After a
+// reconnect every bound session is read again (rebuildAsks). A list that cannot be read is read again a few
+// times; then the session's clocks count again and its panel says so (noteUnreadAsks).
+
+// A sub-agent runs on its parent's serve, in its folder: a bound parent's lists hold its requests too.
+function underSession(sessionId, isAncestor) {
+  let cursor = parentSessionOf(sessionId);
+  for (let depth = 0; cursor && depth < 12; depth++) {
+    if (isAncestor(cursor)) return true;
+    cursor = parentSessionOf(cursor);
+  }
+  return false;
+}
+
+// The sessions whose lists were read (or are out) since the socket opened.
+const _asksRead = new Set();
+// Bound sessions waiting for the socket to say what it serves before their lists are read.
+const _asksUnread = new Set();
+let _asksReady = false;
+let _asksReadyTimer = null;
+let _asksFlushTimer = null;
+const asksKnown = (sessionId) => _asksRead.has(sessionId) || underSession(sessionId, (id) => _asksRead.has(id));
+
+function askSession(sessionId, kinds) {
+  const s = [...(_storesBySession.get(sessionId) || [])][0]?.getState?.() || {};
+  return { sessionId, cwd: s.cwd || s.sessionInfo?.directory || undefined, ...(kinds ? { kinds } : {}) };
+}
+
+// `want`: null for every bound session (not one under another), else the sessions (and lists) to read.
+// The first read of sessions bound at a page load (or later) looks up no sub-agent's place: the panel manager
+// reads the session tree right then, for the pills, and the read again a second later finds the links it
+// learned (a list holding a request whose place is not known yet is unresolved meanwhile: its session waits).
+// After a reconnect the tree is known; only a sub-agent spawned during the outage is looked up.
+function readAsks(want, { attempt = 1, partial = false } = {}) {
+  const bound = new Set(_storesBySession.keys());
+  const sessions = want
+    ? want.filter(({ sessionId }) => bound.has(sessionId)).map(({ sessionId, kinds }) => askSession(sessionId, kinds))
+    : [...bound].filter((sessionId) => !underSession(sessionId, (id) => bound.has(id))).map((sessionId) => askSession(sessionId));
+  for (const { sessionId } of sessions) _asksRead.add(sessionId);
+  return readOpenAsks(api, sessions, {
+    ancestry: sessionAncestry,
+    known: (owner, root) => knownDescendant(owner, root, _parentOf),
+    ...(partial && attempt === 1 ? { maxLookups: 0 } : {}),
+  });
+}
+
+// The tracker gave up on some lists: the panels of those sessions say that their clock counts again.
+function noteUnreadAsks(result) {
+  if (!result) return;
+  const lost = result.unread
+    ? [..._storesBySession.keys()].map((sessionId) => ({ sessionId, kinds: undefined }))
+    : result.gaveUp || [];
+  for (const { sessionId, kinds } of lost) {
+    const message = unreadAsksNotice(kinds);
+    for (const store of _storesBySession.get(sessionId) || []) {
+      if ((store.getState?.().errors || []).some((err) => err?.message === message)) continue;
+      store.pushError?.({ message, notice: true });
+    }
+  }
+}
+
+function rebuildAsks() {
+  return _asks.rebuild(readAsks).then(noteUnreadAsks);
+}
+
+// A session a panel was bound to: unless its lists (or a bound parent's) were read since the socket opened,
+// its clocks wait from now and its lists are read once the socket can serve them.
+function readAsksOf(sessionId) {
+  if (!sessionId || asksKnown(sessionId) || _asksUnread.has(sessionId)) return;
+  _asksUnread.add(sessionId);
+  _asks.expect([sessionId]);
+  flushAsksSoon();
+}
+
+function flushAsksSoon() {
+  if (_asksFlushTimer || !_asksReady || !_asksUnread.size) return;
+  _asksFlushTimer = setTimeout(() => {
+    _asksFlushTimer = null;
+    if (!_asksReady) return;
+    // Those no panel is bound to any more are let go by the tracker (not in its answer); those whose lists
+    // were read meanwhile (their own, or a bound parent's) wait for nothing more.
+    // A sub-agent read in the same go as its parent is read with it.
+    const batch = [..._asksUnread];
+    const known = batch.filter((sessionId) => _storesBySession.has(sessionId)
+      && (asksKnown(sessionId) || underSession(sessionId, (id) => id !== sessionId && batch.includes(id) && _storesBySession.has(id))));
+    const sessions = batch.filter((sessionId) => !known.includes(sessionId));
+    _asksUnread.clear();
+    if (known.length) _asks.release(known);
+    if (!sessions.length) return;
+    _asks.rebuild(readAsks, { sessions }).then(noteUnreadAsks)
+      .catch((err) => console.warn('[ocp-v2-ws] reading the open questions failed', err));
+  }, 0);
+}
+
+// The lists can be asked for once the socket said what it serves (capabilities, init:result), or, from a
+// server that does not say, a moment after it opened.
+function asksOpened() {
+  clearTimeout(_asksReadyTimer);
+  _asksReadyTimer = setTimeout(asksReady, 1500);
+}
+
+function asksReady() {
+  clearTimeout(_asksReadyTimer);
+  _asksReadyTimer = null;
+  if (!isConnected()) return;
+  _asksReady = true;
+  flushAsksSoon();
+}
+
+// (A session still to be read stays so: a socket that never opened read nothing, and after a reconnect
+// rebuildAsks reads every bound session anyway.)
+function asksClosed() {
+  clearTimeout(_asksReadyTimer);
+  clearTimeout(_asksFlushTimer);
+  _asksReadyTimer = null;
+  _asksFlushTimer = null;
+  _asksReady = false;
+  _asksRead.clear();
+}
+
 // The socket came back after an outage: whatever was sent meanwhile reached no
 // panel. Listeners re-read their session (the primary panel does it through its
 // auto-heal; the panel manager does it for the sub-agent panel).
 const _reconnectListeners = new Set();
 const _reconnects = createReconnectNotifier(() => {
+  rebuildAsks().catch((err) => console.warn('[ocp-v2-ws] reading the open questions again failed', err));
   for (const fn of _reconnectListeners) {
     try { fn(); } catch (e) { console.warn('[ocp-v2-ws] reconnect listener error', e); }
   }
@@ -462,14 +605,23 @@ function fanout(eventType, ev) {
 
 // ── Request/response (id-correlated, 30s default timeout) ──
 
-function request(payload, timeoutMs = 30000) {
+// `turnOf`: the session whose turn the request waits for (a prompt, a command). Its clock stops while that
+// session waits on the user, so only working time counts toward `timeoutMs` (createTurnClock).
+function request(payload, timeoutMs = 30000, { turnOf = '' } = {}) {
   return new Promise(async (resolve, reject) => {
     try { await connect(); } catch (e) { return reject(e); }
     const id = ++_reqSeq;
-    const timeout = setTimeout(() => {
+    const expire = () => {
       _pending.delete(id);
       reject(new Error(`request timeout: ${payload.type}`));
-    }, timeoutMs);
+    };
+    let timeout;
+    if (turnOf) {
+      timeout = createTurnClock({ ms: timeoutMs, paused: () => sessionWaitsOnUser(turnOf), subscribe: onAsksChanged, onExpire: expire });
+    } else {
+      const timer = setTimeout(expire, timeoutMs);
+      timeout = { cancel: () => clearTimeout(timer) };
+    }
     _pending.set(id, { resolve, reject, timeout });
     _ws.send(JSON.stringify({ ...payload, id }));
   });
@@ -487,17 +639,17 @@ export const api = {
   sessionMessages:(sessionId)     => request({ type: 'session:messages', sessionId }),
   sessionContext: ({ sessionId, cwd } = {}) => request({ type: 'session:context', sessionId, cwd }),
   // `human` / `greetingId`: lib/greeting/ (a server that does not know them ignores them).
-  send: ({ sessionId, parts, model, agent, mode, variant, cwd, mcpProfile, noAbortPrev, human, greetingId }) =>
-    request({ type: 'message:send', sessionId, parts, model, agent, mode, variant, cwd, mcpProfile, noAbortPrev: !!noAbortPrev, ...(human ? { human: true } : {}), ...(greetingId ? { greetingId } : {}) }, 30 * 60 * 1000),
+  send: ({ sessionId, parts, model, agent, mode, variant, cwd, tools, noAbortPrev, human, greetingId }) =>
+    request({ type: 'message:send', sessionId, parts, model, agent, mode, variant, cwd, tools, noAbortPrev: !!noAbortPrev, ...(human ? { human: true } : {}), ...(greetingId ? { greetingId } : {}) }, TURN_LIMIT_MS, { turnOf: sessionId }),
   abort: (sessionId) => request({ type: 'message:abort', sessionId }),
-  compact: ({ sessionId, cwd, mcpProfile, model } = {}) => request({ type: 'session:compact', sessionId, cwd, mcpProfile, model }, 5 * 60 * 1000),
+  compact: ({ sessionId, cwd, tools } = {}) => request({ type: 'session:compact', sessionId, cwd, tools }, 5 * 60 * 1000),
   permissionReply: ({ sessionId, permissionId, response, cwd, message }) =>
     request({ type: 'permission:reply', sessionId, permissionId, response, cwd, message }),
   questionList:   ({ cwd, sessionId } = {})   => request({ type: 'question:list', cwd, sessionId }),
   questionReply:  ({ requestId, answers, cwd, sessionId }) => request({ type: 'question:reply', requestId, answers, cwd, sessionId }),
   questionReject: ({ requestId, sessionId })  => request({ type: 'question:reject', requestId, sessionId }),
-  mcpProfileGet:  (sessionId) => request({ type: 'mcp:profile:get', sessionId }),
-  mcpProfileSet:  (sessionId, profile) => request({ type: 'mcp:profile:set', sessionId, profile }, 45_000),
+  toolsGet:  (sessionId) => gated({ type: 'mcp:tools:get', sessionId }),
+  toolsSet:  (sessionId, tools) => gated({ type: 'mcp:tools:set', sessionId, tools }, 45_000),
 
   // ── Newer request types: sent only when the server lists them (see
   //    ocp-v2-caps.js); otherwise they resolve { ok:false, unsupported:true }.
@@ -508,16 +660,12 @@ export const api = {
   sessionUnrevert: ({ sessionId, cwd } = {}) => gated({ type: 'session:unrevert', sessionId, cwd }),
   sessionFork:     ({ sessionId, messageID, cwd } = {}) => gated({ type: 'session:fork', sessionId, messageID, cwd }),
   sessionChildren: ({ sessionId, cwd } = {}) => gated({ type: 'session:children', sessionId, cwd }),
-  sessionShare:    ({ sessionId, cwd } = {}) => gated({ type: 'session:share', sessionId, cwd }),
-  sessionUnshare:  ({ sessionId, cwd } = {}) => gated({ type: 'session:unshare', sessionId, cwd }),
-  sessionSharePolicy: ({ cwd } = {}) => gated({ type: 'session:share:policy', cwd }),
-  messageDelete:   ({ sessionId, messageID, cwd } = {}) => gated({ type: 'message:delete', sessionId, messageID, cwd }),
   commandList:     ({ cwd } = {}) => gated({ type: 'command:list', cwd }),
   // A command is a turn: it can run as long as a prompt does.
-  commandRun:      ({ sessionId, command, arguments: args, agent, model, variant, parts, cwd, mcpProfile } = {}) =>
-    gated({ type: 'command:run', sessionId, command, arguments: args, agent, model, variant, parts, cwd, mcpProfile }, 30 * 60 * 1000),
-  sessionShell:    ({ sessionId, command, agent, model, cwd, mcpProfile } = {}) =>
-    gated({ type: 'session:shell', sessionId, command, agent, model, cwd, mcpProfile }, 10 * 60 * 1000),
+  commandRun:      ({ sessionId, command, arguments: args, agent, model, variant, parts, cwd, tools } = {}) =>
+    gated({ type: 'command:run', sessionId, command, arguments: args, agent, model, variant, parts, cwd, tools }, TURN_LIMIT_MS, { turnOf: sessionId }),
+  sessionShell:    ({ sessionId, command, agent, model, cwd, tools } = {}) =>
+    gated({ type: 'session:shell', sessionId, command, agent, model, cwd, tools }, 10 * 60 * 1000),
   findFiles:       ({ query, cwd, dirs } = {}) => gated({ type: 'find:files', query, cwd, dirs }, 10000),
   findSymbols:     ({ sessionId, query, cwd } = {}) => gated({ type: 'find:symbols', sessionId, query, cwd }, 10000),
   resourceList:    ({ sessionId, cwd } = {}) => gated({ type: 'resource:list', sessionId, cwd }, 15000),
@@ -527,20 +675,15 @@ export const api = {
   vcsGet:          ({ cwd } = {}) => gated({ type: 'vcs:get', cwd }),
   vcsStatus:       ({ cwd } = {}) => gated({ type: 'vcs:status', cwd }),
   vcsDiff:         ({ cwd, mode } = {}) => gated({ type: 'vcs:diff', cwd, mode }, 60_000),
-  worktreeList:    ({ cwd } = {}) => gated({ type: 'worktree:list', cwd }),
-  worktreeCreate:  ({ cwd, name } = {}) => gated({ type: 'worktree:create', cwd, name }, 60_000),
-  worktreeRemove:  ({ cwd, directory } = {}) => gated({ type: 'worktree:remove', cwd, directory }, 60_000),
   mcpStatus:       ({ sessionId, cwd } = {}) => gated({ type: 'mcp:status', sessionId, cwd }),
   mcpConnect:      ({ sessionId, name, cwd } = {}) => gated({ type: 'mcp:connect', sessionId, name, cwd }, 60_000),
   mcpDisconnect:   ({ sessionId, name, cwd } = {}) => gated({ type: 'mcp:disconnect', sessionId, name, cwd }, 60_000),
-  // OAuth: OpenCode opens the browser and waits for the callback.
-  mcpAuthenticate: ({ sessionId, name, cwd } = {}) => gated({ type: 'mcp:authenticate', sessionId, name, cwd }, 5 * 60 * 1000 + 5000),
   // Registers a server on the serve running this session and, with `persist`,
   // saves it to the OpenCode config in the same request (see ocp-v2-status.js).
   mcpAdd:          ({ sessionId, name, config, persist, cwd } = {}) => gated({ type: 'mcp:add', sessionId, name, config, persist: persist === true, cwd }, 60_000),
   envStatus:       ({ sessionId, cwd } = {}) => gated({ type: 'env:status', sessionId, cwd }),
 };
 
-function gated(payload, timeoutMs) {
-  return gatedRequest(capabilities, request, payload, timeoutMs);
+function gated(payload, timeoutMs, options) {
+  return gatedRequest(capabilities, request, payload, timeoutMs, options);
 }

package/neural-interface/public/shared/opencode-providers.js

@@ -0,0 +1,39 @@
+// ═══════════════════════════════════════════
+// SynaBun Neural Interface — OpenCode's providers, as the pickers read them
+// ═══════════════════════════════════════════
+// GET /api/opencode/providers/full?view=compact: the connected providers only,
+// with every field their models carry (the whole models.dev catalog is
+// megabytes, and only Settings → OpenCode lists it). One copy in the data
+// cache (data-cache.js) for every module that reads it: the OpenCode panel's
+// model and variant pickers, its context gauge and composer, the Assistant's
+// and the Studios' model lists. A provider change (`ocp-providers-changed`,
+// which reaches every window: the OpenCode socket where a panel is open, the
+// sync socket everywhere) drops it and asks for it again at once.
+
+import { createDataCache } from './data-cache.js';
+import { registerLaunchPrefetch } from './launch-prefetch.js';
+
+export const OPENCODE_PROVIDERS_URL = '/api/opencode/providers/full?view=compact';
+
+export const opencodeProviders = createDataCache('opencode-providers', {
+  ttlMs: 5 * 60_000,
+  persist: true,
+  load: async (_key, { force }) => {
+    const resp = await fetch(force ? `${OPENCODE_PROVIDERS_URL}&refresh=1` : OPENCODE_PROVIDERS_URL);
+    // A body that is not JSON (a web page) throws: nothing is kept.
+    return resp.json();
+  },
+  // Only a provider list is kept: `{ ok: false }` (the serve is not running, an error) never is.
+  accept: (body) => !!body && body.ok !== false && !!body.data && typeof body.data === 'object' && !Array.isArray(body.data),
+});
+
+/** The parsed body `{ ok, data: { all, default, connected } }`, connected providers only. */
+export function fetchOpencodeProviders({ force = false } = {}) {
+  return opencodeProviders.get('', { force });
+}
+
+if (typeof document !== 'undefined') {
+  document.addEventListener('ocp-providers-changed', () => opencodeProviders.invalidate('', { refetch: true }));
+  // Launch: read once the page has painted, so the first OpenCode picker opens from it.
+  registerLaunchPrefetch('opencode-providers', () => opencodeProviders.prefetch(''), { order: 8, owner: true });
+}

package/neural-interface/public/shared/page-session.js

@@ -0,0 +1,96 @@
+// ═══════════════════════════════════════════
+// SynaBun — the page secret's recovery: an open tab outlives a server restart
+// ═══════════════════════════════════════════
+//
+// The server tells the owner's own page from a local process by a secret it mints per boot and hands the page as
+// an HttpOnly cookie (lib/page-session.js). The page's code never sees or sends that cookie: the browser does. A
+// restart mints a new secret, and a tab that stayed open still carries the old cookie, so its first owner write
+// (a dispatch, Protect workers, a route card, a Skills Studio install…) would come back 403 UI_ONLY or
+// PAGE_SECRET_REQUIRED and the owner would have to reload. The owner wants zero friction, so this module wraps the
+// page's fetch once: when a same-origin write is refused with one of those two codes, it asks GET /api/page-session
+// (which sets this boot's cookie), then sends the very same request once more and hands back that answer. No
+// reload, no toast (the toast fires on the error jsonFetch throws, and it throws only on the final answer), no lost
+// action. Anything else (a read, another 403, a refusal the refresh did not cure, a body that cannot be sent
+// twice) is handed back as it came, so nothing changes for a request this is not about.
+//
+// No imports and nothing done at load under Node: tests load it with node --test and a fake fetch. In a browser it
+// installs itself on window.fetch when the page loads it (index.html, index2d.html and sidepanel-session.html load
+// it as their first module script, before any module that writes), and once only.
+
+/** The route that hands an open tab this boot's cookie (lib/page-session.js PAGE_SECRET_REFRESH_PATH). */
+export const PAGE_SECRET_REFRESH_PATH = '/api/page-session';
+/** The refusals that mean "the page secret is missing or stale", and nothing else. */
+export const PAGE_SECRET_CODES = Object.freeze(['UI_ONLY', 'PAGE_SECRET_REQUIRED']);
+const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+
+/** Whether an answer is the server refusing a write for want of this boot's page secret. */
+export function isPageSecretRefusal(status, body) {
+  return Number(status) === 403 && !!body && typeof body === 'object' && PAGE_SECRET_CODES.includes(body.code);
+}
+
+/**
+ * What a request is, for the retry: its method, whether it is same-origin, and the arguments that send it again,
+ * or null when it is not a write, goes elsewhere, or cannot be sent twice (a streamed body).
+ */
+export function replayPlan(input, init, origin = null) {
+  const isRequest = typeof Request !== 'undefined' && input instanceof Request;
+  const method = String(init?.method || (isRequest ? input.method : '') || 'GET').toUpperCase();
+  if (SAFE_METHODS.has(method)) return null;
+  const url = isRequest ? input.url : (input instanceof URL ? input.href : String(input ?? ''));
+  if (!sameOrigin(url, origin)) return null;
+  const body = init?.body;
+  if (body && typeof body === 'object' && typeof body.getReader === 'function') return null; // a stream is read once
+  // fetch(request) reads the request's body: a copy taken before the first send is what the second one sends.
+  const again = isRequest ? input.clone() : input;
+  return { method, url, args: init === undefined ? [again] : [again, init] };
+}
+
+function sameOrigin(url, origin) {
+  if (!/^[a-z][a-z0-9+.-]*:/i.test(url) && !url.startsWith('//')) return true; // a path of this page
+  if (!origin) return false;
+  try { return new URL(url).origin === new URL(origin).origin; } catch { return false; }
+}
+
+/**
+ * A fetch over `fetchImpl` that recovers the page secret once: the refresh is one request at a time (writes refused
+ * together share it), the refused request is sent again only when the refresh answered, and the second answer is
+ * final whatever it says.
+ */
+export function createPageSessionFetch(fetchImpl, { refreshPath = PAGE_SECRET_REFRESH_PATH, origin = null, onRecover = null } = {}) {
+  if (typeof fetchImpl !== 'function') throw new TypeError('createPageSessionFetch needs a fetch');
+  let refreshing = null;
+  function refreshCookie() {
+    if (!refreshing) {
+      refreshing = (async () => {
+        try {
+          const res = await fetchImpl(refreshPath, { method: 'GET', credentials: 'same-origin', cache: 'no-store', headers: { Accept: 'application/json' } });
+          return !!res && res.ok === true;
+        } catch { return false; } finally { refreshing = null; }
+      })();
+    }
+    return refreshing;
+  }
+  return async function pageSessionFetch(input, init) {
+    const plan = replayPlan(input, init, origin);
+    const res = await fetchImpl(input, init);
+    if (!plan || !res || res.status !== 403 || typeof res.clone !== 'function') return res;
+    let body = null;
+    try { body = await res.clone().json(); } catch { return res; }
+    if (!isPageSecretRefusal(res.status, body)) return res;
+    if (!(await refreshCookie())) return res;
+    try { onRecover?.({ method: plan.method, url: plan.url, code: body.code }); } catch { /* a listener's own error */ }
+    return fetchImpl(...plan.args);
+  };
+}
+
+/** Wrap `target.fetch` (the window's) once; returns true when it did, false when it already had or there is none. */
+export function installPageSessionRecovery(target = globalThis) {
+  if (!target || typeof target.fetch !== 'function' || target.__synabunPageSession) return false;
+  const original = target.fetch.bind(target);
+  const origin = target.location && typeof target.location.origin === 'string' ? target.location.origin : null;
+  target.fetch = createPageSessionFetch(original, { origin });
+  try { Object.defineProperty(target, '__synabunPageSession', { value: true, configurable: true }); } catch { target.__synabunPageSession = true; }
+  return true;
+}
+
+if (typeof window !== 'undefined' && typeof document !== 'undefined') installPageSessionRecovery(window);