synabun 2.0.9 → 2.1.0

package/neural-interface/lib/account-usage.js

@@ -91,11 +91,13 @@ export function createAccountUsage({ accounts = {}, readCodex = null, fetchImpl
     combined.fetchedAt = new Date(Math.max(...fresh.map(w => w.at), value.windows.length ? Date.parse(value.fetchedAt) : 0)).toISOString();
     return combined;
   }
-  function peek(provider, id) {
+  // `stale`: a reading older than ttlMs still counts (a display that refreshes in the background); the
+  // account's own state must still match it, and a window past its reset is still unknown.
+  function peek(provider, id, { stale = false } = {}) {
     const row = rowOf(provider, id);
     if (row?.mode === 'apiKey' || row?.mode === 'api') return unknown('not_applicable', now());
     const item = cache.get(keyOf(provider, id));
-    const value = item?.signature === signature(row) && now() - item.at < ttlMs ? summarize(item.value.windows, item.value.source, Date.parse(item.value.fetchedAt), item.value.limited && !item.value.windows.some(w => w.usedPercent >= 100)) : unknown('unknown', now());
+    const value = item?.signature === signature(row) && (stale || now() - item.at < ttlMs) ? summarize(item.value.windows, item.value.source, Date.parse(item.value.fetchedAt), item.value.limited && !item.value.windows.some(w => w.usedPercent >= 100)) : unknown('unknown', now());
     // Do not keep a limited window alive after its reset.
     if (value.windows.some(w => w.resetsAt && Date.parse(w.resetsAt) <= now())) return overlay(provider, id, unknown('unknown', now()));
     return overlay(provider, id, value);
@@ -137,7 +139,7 @@ export function createAccountUsage({ accounts = {}, readCodex = null, fetchImpl
     await Promise.all(Object.entries(accounts).filter(([p]) => !provider || p === provider).flatMap(([p, service]) => service.list().map(row => read(p, row.id))));
     return list();
   }
-  function list() { return Object.fromEntries(Object.entries(accounts).map(([p, service]) => [p, service.listForClient().map(row => ({ ...row, usage: peek(p, row.id) }))])); }
+  function list({ stale = false } = {}) { return Object.fromEntries(Object.entries(accounts).map(([p, service]) => [p, service.listForClient().map(row => ({ ...row, usage: peek(p, row.id, { stale }) }))])); }
   function invalidate(p, id) { const key = keyOf(p, id); generations.set(key, (generations.get(key) || 0) + 1); cache.delete(key); overlays.delete(key); }
   return { read, peek, note, refresh, list, invalidate };
 }

package/neural-interface/lib/app-controls-api.js

@@ -0,0 +1,161 @@
+// ═══════════════════════════════════════════
+// SynaBun — /api/system/app: Settings > App for an npm or Git install
+// ═══════════════════════════════════════════
+//
+//   GET  /api/system/app               { ok, install, desktop, updates: { auto }, startup: { … } }
+//   PUT  /api/system/app/updates       { auto: boolean }      the automatic update check and its badge
+//   PUT  /api/system/app/startup       { enabled: boolean }   start the server at login (lib/login-start.js)
+//   POST /api/system/app/open-folder   { which: 'data' | 'logs' }
+//
+// Automatic updates here are the check: on (the default), the server looks for
+// a newer version when it starts and the page shows the update badge and asks
+// again every half hour; off, it looks only when the user asks (Check for
+// updates). Installing always goes through the update dialog and its backup
+// step; nothing installs unattended. The setting is DATA_HOME/data/app-settings.json.
+//
+// In the desktop app (`desktop: true`) the app's own settings are the
+// window's (packaging/desktop/src/app-prefs.mjs, through the preload bridge):
+// this answers what it is and changes nothing.
+//
+// These are the owner's acts on this computer (a login entry, a folder opened
+// on its screen), so the routes take the guards of /api/cli/install
+// (lib/http-guards.js): a loopback socket and no proxy header, a localhost
+// Host, no invite guest; a write also its own Origin, a JSON body,
+// X-SynaBun-UI: 1 and no agent header. (`/api/system` is admin-only in
+// lib/request-gate.js too.) A request names a switch, never a path or a command.
+
+import { Router } from 'express';
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { guestForbidden, noStore, requireLocal, requireLocalHost, requireSameOriginJson, sendGuardError, uiOnly } from './http-guards.js';
+import { runProgram } from './file-explorer-system.js';
+
+export const APP_SETTINGS_DEFAULTS = Object.freeze({ autoUpdateCheck: true });
+
+export function normalizeAppSettings(raw) {
+  const source = raw && typeof raw === 'object' && !Array.isArray(raw) ? raw : {};
+  const out = {};
+  for (const [key, value] of Object.entries(APP_SETTINGS_DEFAULTS)) out[key] = typeof source[key] === typeof value ? source[key] : value;
+  return out;
+}
+
+/** DATA_HOME/data/app-settings.json, read once and written through (this server is its only writer). */
+export function createAppSettingsStore({ path, fs = { mkdirSync, readFileSync, renameSync, writeFileSync } } = {}) {
+  let current = null;
+  const load = () => {
+    if (current) return current;
+    try { current = normalizeAppSettings(JSON.parse(fs.readFileSync(path, 'utf8'))); } catch { current = normalizeAppSettings(null); }
+    return current;
+  };
+  return {
+    get: () => ({ ...load() }),
+    set(patch) {
+      const next = normalizeAppSettings({ ...load(), ...patch });
+      fs.mkdirSync(dirname(path), { recursive: true });
+      const temp = `${path}.${process.pid}.tmp`;
+      fs.writeFileSync(temp, JSON.stringify(next, null, 2) + '\n');
+      fs.renameSync(temp, path);
+      current = next;
+      return { ...next };
+    },
+  };
+}
+
+/** The program that shows a folder in the system's file manager (no shell; the path is an argument of its own). */
+export function openFolderCommand(platform, path, { env = process.env } = {}) {
+  if (platform === 'darwin') return { file: 'open', args: [path] };
+  // explorer.exe answers 1 even when it opened the folder.
+  if (platform === 'win32') return { file: 'explorer.exe', args: [path], anyExit: true };
+  if (!env.DISPLAY && !env.WAYLAND_DISPLAY) return null;
+  return { file: 'xdg-open', args: [path] };
+}
+
+/** Open a folder on this computer's screen; resolves true when the file manager took it. */
+export async function openFolderOnScreen(path, { platform = process.platform, env = process.env, run = runProgram, mkdir = mkdirSync } = {}) {
+  const command = openFolderCommand(platform, path, { env });
+  if (!command) return false;
+  try { mkdir(path, { recursive: true }); } catch {}
+  try {
+    await run(command.file, command.args);
+    return true;
+  } catch (error) {
+    return !!command.anyExit && error?.code !== 'ENOENT';
+  }
+}
+
+function localRouter({ isGuestRequest, port }) {
+  const router = Router();
+  const portOf = () => Number(typeof port === 'function' ? port() : port);
+  const built = new Map();
+  const perPort = (name, factory) => (req, res, next) => {
+    const key = `${name}:${portOf()}`;
+    let guard = built.get(key);
+    if (!guard) {
+      try { guard = factory(portOf()); } catch { return sendGuardError(res, 500, 'BAD_PORT', 'The app settings have no valid port.'); }
+      built.set(key, guard);
+    }
+    return guard(req, res, next);
+  };
+  router.use(noStore, guestForbidden(isGuestRequest), requireLocal, perPort('host', requireLocalHost));
+  return { router, mutating: [perPort('origin', requireSameOriginJson), uiOnly] };
+}
+
+/**
+ * @param {object} deps
+ * @param {ReturnType<typeof createAppSettingsStore>} deps.store
+ * @param {ReturnType<import('./login-start.js').createLoginStart>} deps.loginStart
+ * @param {{ data: string, logs: string }} deps.folders
+ * @param {string} deps.install         'npm' | 'git' | 'app' | 'desktop'
+ * @param {(auto: boolean) => void} [deps.onAutoUpdateChange]
+ * @param {(path: string) => Promise<boolean>} [deps.openFolder]
+ */
+export function createAppControlsApi({
+  store, loginStart, folders, install = 'npm', onAutoUpdateChange = () => {}, openFolder = (path) => openFolderOnScreen(path),
+  isGuestRequest = () => false, port = 3344, log = () => {},
+} = {}) {
+  if (!store || !loginStart || !folders) throw new Error('createAppControlsApi needs the settings store, the login start and the folders');
+  const { router, mutating } = localRouter({ isGuestRequest, port });
+  const desktop = install === 'desktop';
+
+  const body = () => {
+    let startup;
+    try { startup = loginStart.status(); } catch (error) { startup = { supported: false, reason: 'unsupported', enabled: false, state: 'off', owner: null, error: String(error?.message || error) }; }
+    return { ok: true, install, desktop, updates: { auto: store.get().autoUpdateCheck !== false }, startup };
+  };
+
+  router.get('/', (req, res) => { res.json(body()); });
+
+  router.put('/updates', ...mutating, (req, res) => {
+    const auto = req.body?.auto;
+    if (typeof auto !== 'boolean') return res.status(400).json({ ok: false, code: 'BAD_REQUEST', error: 'Send { auto: true | false }.' });
+    if (desktop) return res.status(409).json({ ok: false, code: 'DESKTOP_MANAGED', error: 'The SynaBun app keeps this setting itself.' });
+    try { store.set({ autoUpdateCheck: auto }); } catch (error) {
+      return res.status(500).json({ ok: false, code: 'SAVE_FAILED', error: String(error?.message || error) });
+    }
+    try { onAutoUpdateChange(auto); } catch {}
+    res.json(body());
+  });
+
+  router.put('/startup', ...mutating, async (req, res) => {
+    const enabled = req.body?.enabled;
+    if (typeof enabled !== 'boolean') return res.status(400).json({ ok: false, code: 'BAD_REQUEST', error: 'Send { enabled: true | false }.' });
+    try {
+      await loginStart.set(enabled);
+    } catch (error) {
+      const code = String(error?.code || 'refused');
+      log(`[app] start at login could not be turned ${enabled ? 'on' : 'off'}: ${error?.message || error}`);
+      return res.status(409).json({ ...body(), ok: false, code, error: String(error?.message || error).slice(0, 300) });
+    }
+    res.json(body());
+  });
+
+  router.post('/open-folder', ...mutating, async (req, res) => {
+    const which = req.body?.which;
+    if (which !== 'data' && which !== 'logs') return res.status(400).json({ ok: false, code: 'BAD_REQUEST', error: "Send { which: 'data' | 'logs' }." });
+    const opened = await openFolder(folders[which]).catch(() => false);
+    if (!opened) return res.status(422).json({ ok: false, code: 'NO_FILE_MANAGER', error: 'No file manager opened the folder.' });
+    res.json({ ok: true });
+  });
+
+  return router;
+}

package/neural-interface/lib/assistant-api.js

@@ -7,6 +7,7 @@
 // composer attachments, Claude/Codex account management, and the sidepanel tab registry.
 // Mounted from server.js with `app.use('/api/assistant', createAssistantApi(deps))`.
 
+import { dispatchInput } from './assistant-tools.js';
 import { Router } from 'express';
 import { DispatchError } from './assistant-dispatch.js';
 import { openServable } from './assistant-media.js';
@@ -17,6 +18,7 @@ import { tooLargeMessage } from './assistant-attachments.js';
 import { getSessionPolicy, requiresHumanApproval } from './remote-policy.js';
 import { clampPlanDispatch, PLAN_DISPATCH_NOTE, runCanChangeCode } from './assistant-plan-permissions.js';
 import { noStore, requireJson, requireLocal, requireLocalHost, sendGuardError } from './http-guards.js';
+import { setUntrustedFileHeaders } from './untrusted-file-headers.js';
 
 /** The header whatsapp_send_file's caller proves it is the WhatsApp conversation's own brain with (assistant-runtime.js BRAIN_CREDENTIAL_RE). */
 export const BRAIN_CREDENTIAL_HEADER = 'x-synabun-brain-token';
@@ -41,7 +43,7 @@ const NO_CATALOG = Object.freeze({});
 function sendError(res, error, fallbackStatus = 500) {
   if (error instanceof DispatchError || (error && error.code && error.status)) {
     const status = Number(error.status) || fallbackStatus;
-    const body = typeof error.toJSON === 'function' ? error.toJSON() : { code: error.code, message: error.message };
+    const body = typeof error.toJSON === 'function' ? error.toJSON() : { code: error.code, message: error.message, ...(error.problems ? { problems: error.problems } : {}) };
     return res.status(status).json({ ok: false, error: body.message, ...body });
   }
   return res.status(fallbackStatus).json({ ok: false, error: error?.message || String(error), code: error?.code || 'INTERNAL' });
@@ -95,7 +97,7 @@ export function slimRunView(run) {
  * @param {object} [deps.runtime]        createAssistantRuntime() (sessions; optional until wired)
  * @param {object} [deps.claudeAccounts] createClaudeAccounts()
  * @param {object} [deps.codexAccounts]  createCodexAccounts() (lib/codex-accounts.js)
- * @param {Function} [deps.buildCatalog] async () => catalog object (models/accounts/projects/profiles)
+ * @param {Function} [deps.buildCatalog] async () => catalog object (models/accounts/projects/tools)
  * @param {Function} [deps.createLoginTerminal] async ({ env, cwd, profile, accountId }) => { terminalSessionId, profile }
  * @param {Function} [deps.claudeSignIn]  async (accountId) => { sessionId, status, error } — Claude Code's own
  *   `auth login` in a SynaBun terminal under the account's config directory (lib/provider-panel-terminal-auth.js)
@@ -152,6 +154,11 @@ export function createAssistantApi({
   port = 3344,
   // The Admin sandbox setting (lib/agent-sandbox-setting.js): one global value for every agent SynaBun starts.
   adminSandbox = null,
+  // Protect workers (lib/worker-guard-setting.js): what capability read-only / workspace means for every worker.
+  workerGuard = null,
+  // The page secret (lib/page-session.js): a request without an agent pin is the owner's page only when it carries
+  // this boot's cookie; a local process that merely sends no headers is nobody (never 'ui').
+  pageSession = null,
 } = {}) {
   if (!dispatcher) throw new Error('createAssistantApi requires a dispatcher');
   const router = Router();
@@ -163,20 +170,31 @@ export function createAssistantApi({
     next();
   });
 
-  // Resolve who is calling: the UI (no pin), an assistant brain (assistant-<uuid>
-  // pin), or a dispatched worker (run id pin → forbidden for orchestration).
+  // Resolve who is calling: the UI (the page secret cookie, no pin), a dispatched worker (run id pin →
+  // forbidden for orchestration), or nobody known. A brain is NOT decided here: a pin only records which
+  // session a request *claims* to be (for attribution), never that the request is that session's brain.
+  // Brain authority is the per-launch credential alone (brainCaller) — the final pre-restart review
+  // (run f283e53b) showed a forged `X-Synabun-Terminal: assistant-*`, and equally a real but non-secret
+  // session id (a worker's environment and its task text both carry one), would otherwise pass as the brain.
   function callerContext(req) {
     const pin = String(req.get('x-synabun-terminal') || req.get('x-synabun-assistant') || '').trim();
     const bodySession = req.body?.assistantSessionId || req.body?.assistant_session_id || req.query?.assistantSessionId || null;
-    if (!pin) return { kind: 'ui', assistantSessionId: bodySession ? String(bodySession) : null };
+    if (!pin) {
+      // The page: this boot's page secret cookie (the browser sends it by itself). Without a page session wired
+      // (a test, an older host) every pinless request is the page, as before.
+      if (pageSession && typeof pageSession.verify === 'function' && !pageSession.verify(req)) return { kind: 'unknown', assistantSessionId: bodySession ? String(bodySession) : null, pin: '', pageless: true };
+      return { kind: 'ui', assistantSessionId: bodySession ? String(bodySession) : null };
+    }
     if (dispatcher.get(pin)) return { kind: 'worker', forbidden: true, pin };
-    // A brain's pin resolves to its session (Claude pins the session id; the
-    // OpenCode brain pins assistant-oc-<24>, which must never be taken as an id).
+    // The session a request claims, for attribution once a credential has proven it a brain: a Claude brain's
+    // pin resolves to its session; the OpenCode brain pins assistant-oc-<24> (never taken as an id) and names
+    // the session in the body. The claim grants nothing on its own.
     const resolved = runtime?.resolveTerminal?.(pin) || null;
-    if (resolved) return { kind: 'assistant', assistantSessionId: resolved, pin };
-    if (/^assistant-oc-/.test(pin)) return { kind: 'assistant', assistantSessionId: bodySession ? String(bodySession) : null, pin };
-    if (/^assistant-/.test(pin)) return { kind: 'assistant', assistantSessionId: pin, pin };
-    return { kind: 'unknown', assistantSessionId: bodySession ? String(bodySession) : null, pin };
+    const claimed = resolved
+      || (/^assistant-oc-/.test(pin) ? (bodySession ? String(bodySession) : null)
+        : /^assistant-/.test(pin) ? pin
+          : (bodySession ? String(bodySession) : null));
+    return { kind: 'unknown', assistantSessionId: claimed, pin };
   }
   /**
    * The plan mode of the brain making this call: 'read-only' (a remote session
@@ -211,20 +229,56 @@ export function createAssistantApi({
   function orchestrationGuard(req, res, next) {
     const caller = callerContext(req);
     if (caller.forbidden) return res.status(403).json({ ok: false, code: 'AGENTS_NOT_PERMITTED', error: 'Dispatched workers cannot orchestrate other agents.' });
-    req.assistantCaller = caller;
-    next();
+    // The user's own page (this boot's page secret cookie): the only caller that orchestrates without being a brain.
+    if (caller.kind === 'ui') { req.assistantCaller = caller; return next(); }
+    // The only other caller allowed is an Assistant brain, and only its per-launch credential proves it (brainCaller):
+    // never a pin, never a session id, which a worker's environment and its task text both carry. This is the forged-
+    // and known-pin bypass the final pre-restart review found (run f283e53b, assistant-api.js:189): an
+    // `X-Synabun-Terminal: assistant-*` header, or a real live session id, used to pass here as the brain.
+    const brain = brainCaller(req);
+    if (brain) { req.assistantCaller = brain; return next(); }
+    return res.status(403).json({ ok: false, code: 'UI_ONLY', error: 'Orchestration is the user\'s (from SynaBun\'s own page) and the Assistant\'s brain\'s: this request is neither (no page secret, no brain launch credential a live session knows).' });
   }
   /**
-   * The caller when it is an assistant brain, else null. Brains pin their
-   * session (Claude) or assistant-oc-<24> (OpenCode); the Codex brain's MCP
-   * child pins codex-sp-<uuid>, which no session resolves, but it sends
-   * X-Synabun-Role: assistant. The UI, workers and other sessions never count.
+   * The caller when it is an assistant brain, else null. The one proof is the per-launch credential
+   * (X-Synabun-Brain-Token, SYNABUN_BRAIN_TOKEN in the brain's own environment only, minted per brain launch and
+   * resolved by runtime.sessionForBrainCredential over the live brains): a pin or a session id names nobody here,
+   * because any local process can send a header and a session id is not secret (a worker carries its own, and ids
+   * appear in task text). The credential's session is authoritative, whatever pin or body the request carries. The
+   * UI, workers and other sessions never count.
    */
   function brainCaller(req) {
+    if (req.assistantCaller?.credentialed) return req.assistantCaller;
+    if (String(req.get('x-synabun-role') || '').trim().toLowerCase() !== 'assistant') return null;
+    let session = null;
+    try { session = runtime?.sessionForBrainCredential?.(req.get('x-synabun-brain-token')) || null; } catch { session = null; }
+    if (!session) return null;
     const caller = req.assistantCaller || callerContext(req);
-    if (caller.kind === 'assistant') return caller;
-    if (caller.kind === 'unknown' && String(req.get('x-synabun-role') || '').trim().toLowerCase() === 'assistant') return caller;
-    return null;
+    return { ...caller, kind: 'assistant', assistantSessionId: String(session), credentialed: true };
+  }
+  /**
+   * Who may READ a run (GET /runs/:id, /result, /transcript): the owner's page (ui), a credential-verified
+   * Assistant brain (its session's runs, as today), or the worker of that very run — a worker's pin is its own
+   * run id, so it reads only itself, never another run. Everyone else (a pinless local process with no page
+   * secret, a worker naming another run) is refused. Listing and deletion are owner-or-brain only (never a worker):
+   * the list is not "its own run", and a finished run is cleared by the owner or the brain that owns its session.
+   */
+  function runReadAllowed(req, runId) {
+    const caller = callerContext(req);
+    if (caller.kind === 'ui') return true;
+    const brain = brainCaller(req);
+    if (brain) {
+      // A brain reads only its OWN session's runs (like DELETE): another session's run is not readable through the
+      // credential. A run with no session, or a sessionless brain, falls through as before (nothing to scope to).
+      const runSession = dispatcher.get(runId)?.assistantSessionId || null;
+      if (runSession && brain.assistantSessionId && String(runSession) !== String(brain.assistantSessionId)) return false;
+      return true;
+    }
+    if (caller.kind === 'worker' && caller.pin && String(caller.pin) === String(runId)) return true;
+    return false;
+  }
+  function refuseRunRead(res) {
+    return res.status(403).json({ ok: false, code: 'RUN_FORBIDDEN', error: 'This run is readable by the owner (from SynaBun\'s own page), its own worker and the Assistant brain of its session only.' });
   }
   /** A remote session whose workers only a person may answer (strict worker approvals below autonomous). */
   function humanApprovalRequired(assistantSessionId) {
@@ -301,7 +355,10 @@ export function createAssistantApi({
   // ── catalog ────────────────────────────────────────────────────────────────
   router.get('/catalog', async (req, res) => {
     try {
-      await accountUsage?.refresh();
+      // Quotas are shown as last read and read again in the background (the probe can take seconds; the
+      // dispatcher and the router read them fresh before they choose an account).
+      accountUsage?.refresh()?.catch?.(() => {});
+      const usage = () => accountUsage?.list({ stale: true });
       // refresh=1 rebuilds from the providers' endpoints; deep=1 also makes them ask the CLI / app-server again.
       const deep = req.query.deep === '1';
       const force = req.query.refresh === '1' || deep;
@@ -320,8 +377,8 @@ export function createAssistantApi({
         // names none.
         const accounts = {
           ...(brief.accounts || {}),
-          ...(claudeAccounts ? { 'claude-code': accountUsage?.list()?.['claude-code'] || claudeAccounts.listForClient() } : {}),
-          ...(codexAccounts ? { codex: accountUsage?.list()?.codex || codexAccounts.listForClient() } : {}),
+          ...(claudeAccounts ? { 'claude-code': usage()?.['claude-code'] || claudeAccounts.listForClient() } : {}),
+          ...(codexAccounts ? { codex: usage()?.codex || codexAccounts.listForClient() } : {}),
         };
         return res.json({ ok: true, generatedAt: new Date(now()).toISOString(), ...brief, accounts, claudeWorkerAccount: claudeWorkerAccountId(), codexWorkerAccount: codexWorkerAccountId(), limits: dispatcher.limits, runs: dispatcher.list({ activeOnly: true }), totals: dispatcher.totals() });
       }
@@ -329,7 +386,7 @@ export function createAssistantApi({
       // within seconds), so it is asked every time: this answer is reused only while it hands back the
       // build the answer was made from (a rebuild or invalidate() gives another one).
       const base = typeof buildCatalog === 'function' ? await buildCatalog({ force, deep }) : NO_CATALOG;
-      if (!force && catalogCache && catalogCache.base === base && now() - catalogCache.at < 30_000) return res.json(accountUsage ? { ...catalogCache.value, accounts: { ...catalogCache.value.accounts, ...accountUsage.list() } } : catalogCache.value);
+      if (!force && catalogCache && catalogCache.base === base && now() - catalogCache.at < 30_000) return res.json(accountUsage ? { ...catalogCache.value, accounts: { ...catalogCache.value.accounts, ...usage() } } : catalogCache.value);
       // Hidden rows stay server-side (view=manage lists them); the lists themselves ship.
       const { hiddenRows: _hiddenRows, ...visible } = base || {};
       const value = {
@@ -338,8 +395,8 @@ export function createAssistantApi({
         ...visible,
         accounts: {
           ...(base.accounts || {}),
-          'claude-code': accountUsage?.list()?.['claude-code'] || (claudeAccounts ? claudeAccounts.listForClient() : (base.accounts?.['claude-code'] || [])),
-          codex: accountUsage?.list()?.codex || (codexAccounts ? codexAccounts.listForClient() : (base.accounts?.codex || [])),
+          'claude-code': usage()?.['claude-code'] || (claudeAccounts ? claudeAccounts.listForClient() : (base.accounts?.['claude-code'] || [])),
+          codex: usage()?.codex || (codexAccounts ? codexAccounts.listForClient() : (base.accounts?.codex || [])),
         },
         claudeWorkerAccount: claudeWorkerAccountId(),
         codexWorkerAccount: codexWorkerAccountId(),
@@ -359,9 +416,8 @@ export function createAssistantApi({
     try {
       const body = req.body || {};
       const spec = {
-        ...body,
+        ...dispatchInput(body),
         accountId: body.accountId || body.account_id || body.codexAccountId || body.claudeAccountId || null,
-        mcpProfile: body.mcpProfile || body.mcp_profile,
         permissionPolicy: body.permissionPolicy || body.permission_policy,
         maxMinutes: body.maxMinutes ?? body.max_minutes,
         budgetUsd: body.budgetUsd ?? body.budget_usd,
@@ -720,18 +776,25 @@ export function createAssistantApi({
   });
 
   router.get('/runs', (req, res) => {
+    // Listing is owner-or-brain only: a worker reads its own run by id, never the roster of every run.
+    const caller = callerContext(req);
+    const brain = brainCaller(req);
+    if (caller.kind !== 'ui' && !brain) return refuseRunRead(res);
     try {
       const active = req.query.active === '1' || req.query.activeOnly === '1';
+      // A brain sees only its OWN session's runs (its session id forced over whatever the query asks); the owner's
+      // page may list any session.
+      const scopedSession = (brain && caller.kind !== 'ui') ? (brain.assistantSessionId || null) : (req.query.assistantSessionId || null);
       res.json({
         ok: true,
         runs: dispatcher.list({
           activeOnly: active,
-          assistantSessionId: req.query.assistantSessionId || null,
+          assistantSessionId: scopedSession,
           workflowId: req.query.workflowId || null,
           status: req.query.status || null,
           limit: clampInt(req.query.limit, 1, 500, 100),
         }),
-        totals: dispatcher.totals({ assistantSessionId: req.query.assistantSessionId || null, workflowId: req.query.workflowId || null }),
+        totals: dispatcher.totals({ assistantSessionId: scopedSession, workflowId: req.query.workflowId || null }),
       });
     } catch (error) { sendError(res, error); }
   });
@@ -764,12 +827,19 @@ export function createAssistantApi({
       if (!assistantSessionId && !workflowId && req.assistantCaller.kind !== 'ui') {
         return res.status(400).json({ ok: false, code: 'SCOPE_REQUIRED', error: 'Pass assistant_session_id (your ASSISTANT_SESSION_ID) or workflow_id to stop runs.' });
       }
-      const result = await dispatcher.killAll({ assistantSessionId, workflowId, reason: body.reason || 'kill_all' });
+      const reason = body.reason || 'kill_all';
+      const result = await dispatcher.killAll({ assistantSessionId, workflowId, reason });
+      // Who stopped every run, when: the records only say `kill_all` (2026-10-24 had to be traced by elimination).
+      const caller = req.assistantCaller.kind === 'ui' ? 'the page' : `the brain of ${req.assistantCaller.assistantSessionId || 'an unknown session'}`;
+      const scope = [assistantSessionId ? `session ${assistantSessionId}` : null, workflowId ? `workflow ${workflowId}` : null].filter(Boolean).join(', ') || 'every session';
+      const stopped = Array.isArray(result?.stopped) ? result.stopped : [];
+      log('kill-all', `${new Date(now()).toISOString()} ${caller} stopped ${stopped.length} run(s) of ${scope} (${reason})${stopped.length ? `: ${stopped.join(', ')}` : ''}`);
       res.json(result);
     } catch (error) { sendError(res, error); }
   });
 
   router.get('/runs/:runId', (req, res) => {
+    if (!runReadAllowed(req, req.params.runId)) return refuseRunRead(res);
     const run = dispatcher.get(req.params.runId);
     if (!run) return res.status(404).json({ ok: false, code: 'RUN_NOT_FOUND', error: `Unknown run ${req.params.runId}` });
     const brain = brainCaller(req);
@@ -777,6 +847,7 @@ export function createAssistantApi({
     res.json({ ok: true, run: brain ? slimRunView(run) : run });
   });
   router.get('/runs/:runId/result', (req, res) => {
+    if (!runReadAllowed(req, req.params.runId)) return refuseRunRead(res);
     try {
       const out = dispatcher.transcript(req.params.runId, { format: 'result' });
       if (out?.result) {
@@ -787,6 +858,7 @@ export function createAssistantApi({
     } catch (error) { sendError(res, error); }
   });
   router.get('/runs/:runId/transcript', (req, res) => {
+    if (!runReadAllowed(req, req.params.runId)) return refuseRunRead(res);
     try {
       const format = req.query.format || 'tail';
       const out = dispatcher.transcript(req.params.runId, {
@@ -807,6 +879,7 @@ export function createAssistantApi({
   // path from the request; owner-only like everything here. sendFile answers
   // Range requests, so a video seeks.
   router.get('/runs/:runId/media/:n', async (req, res) => {
+    if (!runReadAllowed(req, req.params.runId)) return refuseRunRead(res);
     const notFound = () => res.status(404).json({ ok: false, code: 'MEDIA_NOT_FOUND', error: `No media ${req.params.n} for run ${req.params.runId}` });
     if (!/^\d{1,4}$/.test(String(req.params.n))) return notFound();
     let file = null;
@@ -836,6 +909,8 @@ export function createAssistantApi({
       'Accept-Ranges': 'bytes', 'X-Content-Type-Options': 'nosniff', 'Cache-Control': 'private, max-age=3600',
     });
     if (range) res.set('Content-Range', `bytes ${start}-${end}/${size}`);
+    // A run's media is what a worker made: opened by its address it runs nothing, and an SVG is a download.
+    setUntrustedFileHeaders(res, file.path, file.mime);
     if (req.method === 'HEAD' || !size) { await handle.close().catch(() => {}); return res.end(); }
     const stream = handle.createReadStream({ start, end });
     stream.on('error', () => res.destroy());
@@ -894,10 +969,23 @@ export function createAssistantApi({
   router.post('/runs/:runId/stop', orchestrationGuard, async (req, res) => {
     try { res.json(await dispatcher.stop(req.params.runId, req.body?.reason || (req.assistantCaller.kind === 'ui' ? 'user' : 'assistant'))); } catch (error) { sendError(res, error); }
   });
-  // Finished runs are cleared from the agents tray by the user, never by an agent.
+  // Finished runs are cleared from the agents tray by the owner (the page) or the Assistant brain of the run's
+  // own session; never by a worker (even its own run). A brain's delete is scoped to its session's runs.
   router.delete('/runs/:runId', async (req, res) => {
-    if (callerContext(req).kind !== 'ui') return res.status(403).json({ ok: false, code: 'UI_ONLY', error: 'Finished runs are removed from the assistant panel only.' });
-    try { res.json(await dispatcher.remove(req.params.runId, { assistantSessionId: req.query.assistantSessionId || req.body?.assistantSessionId || null })); } catch (error) { sendError(res, error); }
+    const caller = callerContext(req);
+    const brain = brainCaller(req);
+    if (caller.kind !== 'ui' && !brain) return res.status(403).json({ ok: false, code: 'UI_ONLY', error: 'Finished runs are removed by the owner (from SynaBun\'s own page) or the Assistant brain of the run\'s session.' });
+    if (brain && caller.kind !== 'ui') {
+      // A brain removes only the runs of its own session: another session's run is left untouched.
+      const runSession = dispatcher.get(req.params.runId)?.assistantSessionId || null;
+      if (runSession && brain.assistantSessionId && String(runSession) !== String(brain.assistantSessionId)) {
+        return res.status(403).json({ ok: false, code: 'RUN_NOT_IN_SESSION', error: `Run ${req.params.runId} belongs to another assistant session` });
+      }
+    }
+    const assistantSessionId = (brain && caller.kind !== 'ui')
+      ? (brain.assistantSessionId || null)
+      : (req.query.assistantSessionId || req.body?.assistantSessionId || null);
+    try { res.json(await dispatcher.remove(req.params.runId, { assistantSessionId })); } catch (error) { sendError(res, error); }
   });
   router.post('/runs/clear-finished', async (req, res) => {
     if (callerContext(req).kind !== 'ui') return res.status(403).json({ ok: false, code: 'UI_ONLY', error: 'Finished runs are removed from the assistant panel only.' });
@@ -996,9 +1084,17 @@ export function createAssistantApi({
     if (!requireRuntime(res)) return;
     try { res.json({ ok: true, session: await runtime.closeSession(req.params.id) }); } catch (error) { sendError(res, error); }
   });
+  // Remove (the Sessions menu): the record, its transcript and its usage journal go for good, after its
+  // running turn and the workers it dispatched are stopped. Memories made from it stay.
   router.delete('/sessions/:id', async (req, res) => {
     if (!requireRuntime(res)) return;
-    try { res.json({ ok: true, removed: await runtime.destroySession(req.params.id) }); } catch (error) { sendError(res, error); }
+    try {
+      if (runtime.removeSession) {
+        const { removed, stoppedRuns } = await runtime.removeSession(req.params.id);
+        return res.json({ ok: true, removed, stoppedRuns });
+      }
+      res.json({ ok: true, removed: await runtime.destroySession(req.params.id) });
+    } catch (error) { sendError(res, error); }
   });
 
   // ── attachments ────────────────────────────────────────────────────────────
@@ -1249,6 +1345,23 @@ export function createAssistantApi({
     try { res.json({ ok: true, ...adminSandbox.set(value) }); } catch (error) { sendError(res, error); }
   });
 
+  // ── Protect workers (lib/worker-guard-setting.js) ──────────────────────────
+  // What capability read-only / workspace means for every worker the dispatcher starts
+  // (lib/worker-confinement.js): enforce (default), warn, off. The user's setting: an agent cannot change it.
+  router.get('/worker-guard', (req, res) => {
+    if (!workerGuard) return res.status(503).json({ ok: false, code: 'WORKER_GUARD_UNAVAILABLE', error: 'The Protect workers setting is not available on this server' });
+    res.json({ ok: true, ...workerGuard.view() });
+  });
+  router.put('/worker-guard', requireJson, (req, res) => {
+    if (!workerGuard) return res.status(503).json({ ok: false, code: 'WORKER_GUARD_UNAVAILABLE', error: 'The Protect workers setting is not available on this server' });
+    if (callerContext(req).kind !== 'ui' || req.get('x-synabun-desktop-grant') || req.get('x-synabun-role')) {
+      return res.status(403).json({ ok: false, code: 'UI_ONLY', error: 'Only the user can change Protect workers.' });
+    }
+    const value = req.body?.mode;
+    if (typeof value !== 'string' || !workerGuard.view().modes.includes(value)) return res.status(400).json({ ok: false, code: 'INVALID_VALUE', error: `mode must be one of ${workerGuard.view().modes.join(', ')}.` });
+    try { res.json({ ok: true, ...workerGuard.set(value) }); } catch (error) { sendError(res, error); }
+  });
+
   // ── sidepanel tab registry (UI heartbeat) ──────────────────────────────────
   function listTabs() {
     const cutoff = now() - tabTtlMs;

package/neural-interface/lib/assistant-brains/claude.js

@@ -123,10 +123,11 @@ export function createClaudeBrain({ session, sink, deps = {}, persona = '', hook
       'X-Synabun-Role': 'assistant', 'X-Synabun-Terminal': session.id, 'X-Synabun-Memory-Session': session.id,
       ...(deps.desktopGrant ? { 'X-Synabun-Desktop-Grant': deps.desktopGrant } : {}),
       ...mcpHeaders,
-      // A WhatsApp conversation's brain credential (whatsapp_send_file). The header names the variable and
+      // This brain launch's credential (assistant-runtime.js mintBrainCredential). The header names the variable and
       // the CLI expands it from its own environment (below): the MCP config is on its command line, which every
       // account of the computer can read, an environment only this user's processes. The in-process MCP server
-      // keeps the value for the request it arrived with, and sends it on the file route alone. Last, so nothing replaces it.
+      // keeps the value for the request it arrived with, and sends it only to the routes that ask who the brain is
+      // (whatsapp_send_file, the Skills Service). Last, so nothing replaces it.
       ...(deps.brainCredential ? { 'X-Synabun-Brain-Token': '${SYNABUN_BRAIN_TOKEN}' } : {}),
     },
     // A remote (WhatsApp) session never pre-approves computer use: its PreToolUse hook refuses, asks or allows each call.
@@ -143,7 +144,7 @@ export function createClaudeBrain({ session, sink, deps = {}, persona = '', hook
       ...(typeof deps.claudeAccountEnv === 'function' ? deps.claudeAccountEnv(brain.accountId) : {}),
       SYNABUN_ASSISTANT_SESSION: String(session.id),
       ...(deps.userContextThreads === true ? { SYNABUN_ASSISTANT_THREADS: '1' } : {}),
-      // The value of the X-Synabun-Brain-Token header above (a WhatsApp conversation's brain only).
+      // The value of the X-Synabun-Brain-Token header above.
       ...(deps.brainCredential ? { SYNABUN_BRAIN_TOKEN: deps.brainCredential } : {}),
     },
     maxBudgetUsd: Number(deps.maxBudgetUsd) > 0 ? Number(deps.maxBudgetUsd) : undefined,

package/neural-interface/lib/assistant-brains/codex-browser-policy-hook.mjs

@@ -6,7 +6,9 @@
 // PreToolUse payload from stdin and asks lib/browser-tool-policy.js here, with
 // no server round trip; a refusal becomes permissionDecision "deny" with the
 // reason. Script paths resolve against the payload's cwd, else
-// SYNABUN_BROWSER_POLICY_CWD (the run's project). An unreadable payload allows
+// SYNABUN_BROWSER_POLICY_CWD (the run's project); SYNABUN_BROWSER_POLICY_ROOTS
+// (a JSON list, written as the run starts) names the registered code projects
+// its test runners may also run in. An unreadable payload allows
 // the call: the policy is a speed bump, not a sandbox. A policy module that
 // cannot load fails closed (logged on stderr): shell commands, web search and
 // every MCP tool but SynaBun's are denied with that reason.
@@ -25,6 +27,14 @@ function unloadedDenial(tool) {
   return `SynaBun browser policy: ${tool} was refused — SynaBun's browser policy could not load (${loadError?.message || 'browserToolDenial is missing'}), so no command, web search or other server's tool can be checked for a browser launch. SynaBun's own tools still work. Stop and report this`;
 }
 
+/** The registered code projects from the env (a JSON list of paths); anything unreadable is none. */
+function policyRoots() {
+  try {
+    const list = JSON.parse(process.env.SYNABUN_BROWSER_POLICY_ROOTS || '[]');
+    return Array.isArray(list) ? list.filter((path) => typeof path === 'string') : [];
+  } catch { return []; }
+}
+
 let raw = '';
 try { for await (const chunk of process.stdin) raw += chunk; } catch {}
 let payload = {};
@@ -35,7 +45,7 @@ try {
   const input = payload.tool_input && typeof payload.tool_input === 'object' ? payload.tool_input : {};
   const cwd = (typeof payload.cwd === 'string' && payload.cwd) || process.env.SYNABUN_BROWSER_POLICY_CWD || process.cwd();
   if (typeof browserToolDenial !== 'function') process.stderr.write(`[SynaBun] browser policy could not load (${loadError?.message || 'browserToolDenial is missing'}); denying shell, web search and other servers' tools\n`);
-  const reason = !tool ? null : typeof browserToolDenial === 'function' ? browserToolDenial(tool, input, { host: 'codex', cwd }) : unloadedDenial(tool);
+  const reason = !tool ? null : typeof browserToolDenial === 'function' ? browserToolDenial(tool, input, { host: 'codex', cwd, roots: policyRoots() }) : unloadedDenial(tool);
   // Codex prints "Command blocked by PreToolUse hook: <reason>. Command: <cmd>", so
   // the reason goes without its own final period.
   if (reason) process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason.replace(/[.\s]+$/, '') } }));