synabun 2.0.9 → 2.1.0

package/neural-interface/lib/assistant-brains/codex-route-gate-hook.mjs

@@ -4,9 +4,19 @@
 // tool may run; a refusal becomes permissionDecision "deny" with the reason.
 // The call's whole tool_input travels (the remote denylist reads paths from
 // it), marked inputComplete; one too big to send goes as its command/action
-// only, marked incomplete. Any failure (no env, server unreachable, bad reply)
-// allows the call — except in a WhatsApp session (SYNABUN_ROUTE_GATE_REMOTE=1),
-// where a call SynaBun could not check is denied.
+// only, marked incomplete. No env or no answer at all (the server unreachable
+// or slow) allows the call — except in a WhatsApp session
+// (SYNABUN_ROUTE_GATE_REMOTE=1), where a call SynaBun could not check is
+// denied. An answer that is not a decision (the check itself refused, such as
+// 403 PEER_REFUSED, an error status, a body without `allow`) denies the call in
+// every session and says what SynaBun answered: a refusal never passes for an
+// allow.
+//
+// The request carries the session's pin (X-Synabun-Assistant): this hook runs
+// under the brain's Codex app-server, an AI agent's process tree, which
+// SynaBun's owner gate (lib/owner-authority.js) refuses unless the call says
+// it is an agent's own. The per-session token in the body is what the route
+// itself checks.
 
 const url = process.env.SYNABUN_ROUTE_GATE_URL;
 const session = process.env.SYNABUN_ROUTE_GATE_SESSION;
@@ -14,6 +24,7 @@ const token = process.env.SYNABUN_ROUTE_GATE_TOKEN;
 const remote = process.env.SYNABUN_ROUTE_GATE_REMOTE === '1';
 const MAX_INPUT_BYTES = 256 * 1024;
 const UNCHECKED = 'SynaBun could not check this call, so a WhatsApp session does not run it.';
+const PIN_HEADER = 'x-synabun-assistant';
 
 let raw = '';
 try { for await (const chunk of process.stdin) raw += chunk; } catch {}
@@ -37,20 +48,32 @@ function callArguments(toolInput) {
 function deny(reason) {
   process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: String(reason).replace(/[.\s]+$/, '') } }));
 }
+/** The refusal of a call whose check got an answer that is not a decision: what SynaBun answered, in short. */
+function notADecision(status, body) {
+  const code = body && typeof body === 'object' && typeof body.code === 'string' ? ` ${body.code.slice(0, 64)}` : '';
+  const said = body && typeof body === 'object' && typeof body.error === 'string' ? `: ${body.error.slice(0, 300)}` : '';
+  return `SynaBun could not check this call (its route gate answered ${status}${code}${said}), so it did not run.`;
+}
 
 if (url && session && token) {
+  let response = null;
   try {
-    const response = await fetch(url, {
+    response = await fetch(url, {
       method: 'POST',
-      headers: { 'content-type': 'application/json' },
+      // The session id as a header value: printable ASCII only (fetch refuses anything else before sending).
+      headers: { 'content-type': 'application/json', [PIN_HEADER]: String(session).replace(/[^\x21-\x7e]/g, '').slice(0, 200) },
       body: JSON.stringify({ session, token, host: 'codex', tool: String(input.tool_name || input.toolName || input.tool || ''), agent: input.agent_id || null, ...callArguments(input.tool_input) }),
       signal: AbortSignal.timeout(5000),
     });
-    const decision = await response.json();
-    if (decision && decision.allow === false) deny(decision.reason || 'SynaBun refused this call.');
-    else if (remote && !(decision && decision.allow === true)) deny(UNCHECKED);
-  } catch {
+  } catch { response = null; }
+  if (!response) {
     if (remote) deny(UNCHECKED);
+  } else {
+    let decision = null;
+    try { decision = await response.json(); } catch { decision = null; }
+    if (response.ok && decision && decision.allow === true) { /* allowed: Codex runs the call */ }
+    else if (response.ok && decision && decision.allow === false) deny(decision.reason || 'SynaBun refused this call.');
+    else deny(notADecision(response.status, decision));
   }
 }
 process.exit(0);

package/neural-interface/lib/assistant-brains/codex.js

@@ -14,6 +14,8 @@ import { createCodexEnvelopeTranslator, codexControlResponse } from '../assistan
 import { baseModelId, contextVariantOf } from '../assistant-catalog.js';
 import { codexPlanPermission, codexReadOnlyPermission, planDenyMessage, readOnlyDenyMessage } from '../assistant-plan-permissions.js';
 import { planModeInstructions } from '../assistant-persona.js';
+import { shouldAutoAcceptCodexMcpToolApproval } from '../codex-mcp-approvals.js';
+import { codexMcpToolApproval } from '../../public/shared/cdx/cdx-protocol.js';
 
 const READY_TIMEOUT_MS = 90_000;
 // Approvals the Codex sidepanel's Auto-accept answers on its own (cdx-requests.js).
@@ -83,7 +85,7 @@ export function createCodexBrain({ session, sink, deps = {}, persona = '' } = {}
       }
       if (planned) {
         const method = packet.request?.brain_native?.method || packet.request?.method || '';
-        const tool = packet.request?.brain_native?.params?._meta?.tool_name || packet.request?.tool_name || 'request';
+        const tool = codexMcpToolApproval(packet.request?.brain_native?.params)?.fullName || packet.request?.tool_name || 'request';
         const response = planned === 'allow'
           ? { behavior: 'allow', ...(!remoteReadOnly && approvalMode === 'auto' ? { always: true } : {}) }
           : { behavior: 'deny', decline: true, message: remoteReadOnly ? readOnlyDenyMessage(tool) : planDenyMessage(tool, { host: 'codex' }) };
@@ -91,7 +93,9 @@ export function createCodexBrain({ session, sink, deps = {}, persona = '' } = {}
         sink.send({ type: 'stderr', text: `${planMode ? 'Plan mode' : 'Read-only (WhatsApp)'}: ${planned === 'allow' ? 'allowed' : 'declined'} ${String(method).split('/').slice(1, -1).join('/') || 'request'} ${tool}${planned === 'allow' ? '' : remoteReadOnly ? ' (read-only)' : ' (no code changes)'}` });
         return;
       }
-      if (packet.type === 'control_request' && !planMode && !remoteReadOnly && approvalMode === 'auto' && AUTO_ACCEPT_METHODS.has(packet.request?.brain_native?.method || packet.request?.method)) {
+      const method = packet.request?.brain_native?.method || packet.request?.method;
+      const autoMcp = method === 'mcpServer/elicitation/request' && shouldAutoAcceptCodexMcpToolApproval(packet.request?.brain_native?.params, { autoAccept: approvalMode === 'auto', role: 'assistant' });
+      if (packet.type === 'control_request' && !planMode && !remoteReadOnly && (autoMcp || (approvalMode === 'auto' && AUTO_ACCEPT_METHODS.has(method)))) {
         // Auto-accept: approve at once (for the session when offered), as the Codex sidepanel does.
         send({ type: 'server_request_response', ...codexControlResponse(packet, { behavior: 'allow', always: true }) });
         sink.send({ type: 'stderr', text: `Auto-accepted: ${String(packet.request?.brain_native?.method || packet.request?.method).split('/').slice(1, -1).join('/')}` });
@@ -119,8 +123,8 @@ export function createCodexBrain({ session, sink, deps = {}, persona = '' } = {}
   });
   const socket = createVirtualSocket({
     name: `codex-brain-${session.id}`,
-    // A WhatsApp conversation's brain credential rides on the socket object, never in a message: the skin
-    // handler gives it to this app-server's SynaBun MCP child through its environment (whatsapp_send_file).
+    // The brain's launch credential rides on the socket object, never in a message: the skin handler gives it to
+    // this app-server's SynaBun MCP child through its environment (whatsapp_send_file, the Skills Service).
     credential: deps.brainCredential || null,
     onSend: (packet) => {
       if (disposed || !packet || typeof packet !== 'object') return;
@@ -159,7 +163,7 @@ export function createCodexBrain({ session, sink, deps = {}, persona = '' } = {}
       readyResolve = () => { clearTimeout(timer); resolve(true); };
     });
     send({
-      type: 'bootstrap', windowId, accountId: brain.accountId || 'default', mcpProfile: brain.mcpProfile || null,
+      type: 'bootstrap', windowId, accountId: brain.accountId || 'default',
       cwd: brain.cwd || deps.PACKAGE_ROOT || undefined, threadId: threadId || null, role: 'assistant',
       // Unlocks the capability-gated `computer` MCP group for this brain only.
       desktopGrant: deps.desktopGrant || null,

package/neural-interface/lib/assistant-brains/opencode.js

@@ -1,20 +1,23 @@
+import { OPENCODE_BRAIN_TOOLS } from '../assistant-tools.js';
 // ═══════════════════════════════════════════
 // SynaBun — Assistant brain: OpenCode (isolated serve + SDK client)
 // ═══════════════════════════════════════════
 //
 // One isolated `opencode serve` per assistant session (same helpers the
 // OpenCode sidepanel uses). The persona is installed as a custom primary agent
-// (`agent.assistant.prompt`) in the per-serve config so the model sees it as
-// its system prompt; SSE events are translated to the unified envelope.
+// (`agents.assistant.system`) in the per-serve opencode.json so the model sees
+// it as its system prompt; SSE events are translated to the unified envelope.
 
-import { chmodSync, existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { chmodSync, writeFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { normalizeOpenCodeModel } from '../native-loop-providers.js';
-import { compactOrSummarize } from '../opencode-v2-client.js';
+import { agentOf, mcpServersOf, opencodeConfigFilePath, readOpencodeConfigDocument, setAgent, setMcpServer, withPlugin, withoutPlugin } from '../opencode-config.js';
 import { createOpenCodeEnvelopeTranslator, opencodeControlResponse } from '../assistant-envelope.js';
 import { opencodePlanPermission, opencodeReadOnlyPermission, planDenyMessage, readOnlyDenyMessage } from '../assistant-plan-permissions.js';
 import { planModeInstructions } from '../assistant-persona.js';
+import { waitForSynabunTools, synabunConfigured, synabunToolsTimeoutText, OPENCODE_MCP_READY_TIMEOUT_MS, OPENCODE_MCP_SETTLE_MS, OPENCODE_MCP_LIST_GRACE_MS } from '../opencode-mcp-ready.js';
+export { synabunMcpState } from '../opencode-mcp-ready.js';
 
 /** The MCP terminal pin of an assistant session's OpenCode brain. */
 export function opencodeTermIdFor(sessionId) {
@@ -34,8 +37,8 @@ export function opencodeImageParts(images = []) {
   return parts;
 }
 
-/** The route-gate plugin (opencode-route-gate.js) as a file URL the serve can load. */
-export const OPENCODE_ROUTE_GATE_PLUGIN = pathToFileURL(resolve(dirname(fileURLToPath(import.meta.url)), 'opencode-route-gate.js')).href;
+/** The route-gate plugin (opencode2-route-gate/, a plugin folder OpenCode loads from `plugins`) as a file URL. */
+export const OPENCODE_ROUTE_GATE_PLUGIN = pathToFileURL(resolve(dirname(fileURLToPath(import.meta.url)), 'opencode2-route-gate')).href;
 
 /**
  * SynaBun's plan agent. OpenCode adds its own read-only reminder ("commands may
@@ -46,65 +49,111 @@ export const OPENCODE_ROUTE_GATE_PLUGIN = pathToFileURL(resolve(dirname(fileURLT
  */
 export const OPENCODE_PLAN_AGENT = 'synabun-plan';
 
+/**
+ * Tools this brain's agents must never call. Code Mode's `execute` runs arbitrary code (a `fetch`
+ * included) that no argument check can read, so the route gate refuses it before routing - and this
+ * brain's SynaBun tools are direct (codemode: false), so the only thing `execute` can do here is earn
+ * that refusal. Denied at the agent, the model is not offered it at all.
+ */
+export const OPENCODE_BRAIN_DENIED_TOOLS = Object.freeze(['execute']);
+
 /** The brain's SynaBun MCP tool-call timeout (ms): as long as the Codex brain's tool_timeout_sec (server.js). */
 export const OPENCODE_BRAIN_MCP_TIMEOUT_MS = 180_000;
 
+// Compatibility exports for the brain's existing consumers and tests.
+export const OPENCODE_BRAIN_MCP_READY_TIMEOUT_MS = OPENCODE_MCP_READY_TIMEOUT_MS;
+export const OPENCODE_BRAIN_MCP_SETTLE_MS = OPENCODE_MCP_SETTLE_MS;
+export const OPENCODE_BRAIN_MCP_LIST_GRACE_MS = OPENCODE_MCP_LIST_GRACE_MS;
+export const assistantSynabunConfigured = synabunConfigured;
+export { OPENCODE_BRAIN_TOOLS } from '../assistant-tools.js';
+
+/**
+ * Why the brain's serve would start with SynaBun behind Code Mode (`execute` only, which the route gate
+ * refuses before routing, so agent_route would be unreachable), read back from the written config; null
+ * when it is fine. No config file at all: the serve has no SynaBun server, the gate turns itself off.
+ */
+export function assistantConfigProblem(xdgRoot) {
+  let doc;
+  try { doc = readOpencodeConfigDocument(opencodeConfigFilePath(resolve(xdgRoot, 'opencode'))); } catch (err) { return `its OpenCode configuration could not be read (${err?.message || err})`; }
+  if (!doc.exists) return null;
+  if (doc.error) return 'its OpenCode configuration could not be read';
+  const synabun = mcpServersOf(doc.config).SynaBun;
+  if (synabun && synabun.codemode !== false) return 'SynaBun\'s tools could not be set up for direct use (OpenCode Code Mode stayed on)';
+  return null;
+}
+
 /**
  * `routeGate` ({ url, session, token }) installs the route-gate plugin in this
- * isolated serve's config only (assistant brains; never the shared sidepanel setup).
+ * isolated serve's opencode.json only (assistant brains; never the shared
+ * sidepanel setup). Everything is written in OpenCode 2's schema.
  */
 export function patchOpenCodeAssistantConfig(xdgRoot, { persona = '', role = 'assistant', model = null, desktopGrant = null, routeGate = null, brainCredential = null } = {}) {
-  const configPath = resolve(xdgRoot, 'opencode', 'config.json');
-  if (!existsSync(configPath)) return false;
-  const config = JSON.parse(readFileSync(configPath, 'utf8'));
-  if (config.mcp?.SynaBun && typeof config.mcp.SynaBun === 'object') {
-    const envKey = config.mcp.SynaBun.environment ? 'environment' : (config.mcp.SynaBun.env ? 'env' : 'environment');
-    const env = { ...(config.mcp.SynaBun[envKey] || {}), SYNABUN_ROLE: role };
+  const configPath = opencodeConfigFilePath(resolve(xdgRoot, 'opencode'));
+  const doc = readOpencodeConfigDocument(configPath);
+  if (!doc.exists || doc.error) return false;
+  const config = doc.config;
+  const synabun = mcpServersOf(config).SynaBun;
+  if (synabun) {
+    const env = { ...(synabun.environment || {}), SYNABUN_ROLE: role };
     // Computer use: an unforgeable per-brain grant unlocks the `computer` group.
     if (desktopGrant) env.SYNABUN_DESKTOP_GRANT = desktopGrant;
     else delete env.SYNABUN_DESKTOP_GRANT;
-    // A WhatsApp conversation's brain credential (whatsapp_send_file), for this serve's SynaBun MCP child only.
+    // The brain's launch credential (whatsapp_send_file, the Skills Service), for this serve's SynaBun MCP child only.
     // This file names the variable; the value is in the serve's own environment (ensureIsolatedServe), so
     // neither this file (it is in every backup of data/) nor OPENCODE_CONFIG_CONTENT ever holds it.
     if (brainCredential) env.SYNABUN_BRAIN_TOKEN = '{env:SYNABUN_BRAIN_TOKEN}';
     else delete env.SYNABUN_BRAIN_TOKEN;
-    config.mcp.SynaBun[envKey] = env;
     // OpenCode gives an MCP tool call 60 s unless the server says otherwise; agent_route may wait on the
     // user's route card and whatsapp_send_file on an upload (130 s): the Codex brain's 180 s here too.
-    config.mcp.SynaBun.timeout = OPENCODE_BRAIN_MCP_TIMEOUT_MS;
+    // OpenCode 2.1's MCP default is Code Mode: only `execute` reaches these tools. The route gate must
+    // refuse arbitrary execute code until routed, so wrapping agent_route (and exempt memory tools) deadlocks
+    // the brain. Expose this brain's SynaBun tools directly instead. The serve's OPENCODE_CONFIG_CONTENT
+    // overlay carries this entry past project config too; other servers, workers and sidepanels keep their mode.
+    setMcpServer(config, 'SynaBun', { ...synabun, codemode: false, environment: env, timeout: { ...(synabun.timeout || {}), execution: OPENCODE_BRAIN_MCP_TIMEOUT_MS } });
   }
-  config.agent = { ...(config.agent || {}) };
-  config.agent.assistant = {
-    ...(config.agent.assistant || {}),
+  const rule = (action, effect, resource = '*') => ({ action, resource, effect });
+  // An agent's rules with ours last, in place of any it had for the same tools (as OpenCode 1's
+  // `permission.<tool>` replaced the user's value): every command asks whatever was allowed before, and the
+  // list stays as it is when the config is patched again.
+  const withOurRules = (agent, ours) => [...(agent.permissions || []).filter((own) => !ours.some((r) => r.action === own?.action)), ...ours];
+  const withoutExecute = OPENCODE_BRAIN_DENIED_TOOLS.map((name) => rule(name, 'deny'));
+  const assistant = agentOf(config, 'assistant');
+  setAgent(config, 'assistant', {
+    ...assistant,
     mode: 'primary',
     description: 'SynaBun central assistant',
-    prompt: persona || undefined,
+    ...(persona ? { system: persona } : {}),
     ...(model ? { model } : {}),
-  };
+    permissions: withOurRules(assistant, withoutExecute),
+  });
   // SynaBun's plan agent (desktop plan turns): no code changes, anything else as the approval mode says.
-  config.agent[OPENCODE_PLAN_AGENT] = {
-    ...(config.agent[OPENCODE_PLAN_AGENT] || {}),
+  const synabunPlan = agentOf(config, OPENCODE_PLAN_AGENT);
+  setAgent(config, OPENCODE_PLAN_AGENT, {
+    ...synabunPlan,
     mode: 'primary',
     hidden: true,
     description: 'SynaBun plan mode: explore, run commands and use every tool; no code changes',
-    prompt: persona || undefined,
+    ...(persona ? { system: persona } : {}),
     ...(model ? { model } : {}),
-    permission: { ...(config.agent[OPENCODE_PLAN_AGENT]?.permission || {}), edit: 'deny', bash: 'ask', question: 'allow', task: { general: 'deny' } },
-  };
+    permissions: withOurRules(synabunPlan, [...withoutExecute, rule('edit', 'deny'), rule('shell', 'ask'), rule('question', 'allow'), rule('subagent', 'deny', 'general')]),
+  });
   // OpenCode's own plan agent (a WhatsApp session's read-only brain) refuses only
   // edits and runs any command without asking: here every command asks, so the
   // read-only classifier decides on the whole line.
-  config.agent.plan = { ...(config.agent.plan || {}), permission: { ...(config.agent.plan?.permission || {}), bash: 'ask' } };
-  const plugins = (Array.isArray(config.plugin) ? config.plugin : []).filter((entry) => (Array.isArray(entry) ? entry[0] : entry) !== OPENCODE_ROUTE_GATE_PLUGIN);
+  const plan = agentOf(config, 'plan');
+  setAgent(config, 'plan', { ...plan, permissions: withOurRules(plan, [rule('shell', 'ask')]) });
+  withoutPlugin(config, OPENCODE_ROUTE_GATE_PLUGIN);
   // `remote`: a WhatsApp session's serve — the plugin refuses a call it could not check (fail closed).
-  if (routeGate?.url && routeGate?.session && routeGate?.token) plugins.push([OPENCODE_ROUTE_GATE_PLUGIN, { url: routeGate.url, session: routeGate.session, token: routeGate.token, ...(routeGate.remote === true ? { remote: true } : {}) }]);
-  if (plugins.length) config.plugin = plugins; else delete config.plugin;
-  writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n', 'utf8');
+  if (routeGate?.url && routeGate?.session && routeGate?.token) {
+    withPlugin(config, OPENCODE_ROUTE_GATE_PLUGIN, { url: routeGate.url, session: routeGate.session, token: routeGate.token, ...(routeGate.remote === true ? { remote: true } : {}) });
+  }
+  writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
   // It carries this brain's grants (the desktop grant): readable by this user only.
   try { chmodSync(configPath, 0o600); } catch { /* a filesystem without modes */ }
   return true;
 }
 
+
 /** The assistant's OpenCode approval mode: 'auto' (auto-accept) or 'default'. */
 export function opencodeApprovalMode(mode) {
   return mode === 'auto' || mode === 'acceptEdits' || mode === 'bypassPermissions' ? 'auto' : 'default';
@@ -157,8 +206,13 @@ export function createOpenCodeBrain({ session, sink, deps = {}, persona = '' } =
   let keepAliveTimer = null;
   let costUsd = 0;
   let startPromise = null;
-  // The model the last turn ran on: what a compaction summarises with.
-  let lastTurnModel = null;
+  let synabunExpected = false;
+  let stops = 0;
+  let waitingAbort = null;
+  const mcpWait = {
+    readyTimeoutMs: deps.mcpReadyTimeoutMs, settleMs: deps.mcpSettleMs,
+    listGraceMs: deps.mcpListGraceMs, pollMs: deps.mcpPollMs,
+  };
   // Plan mode runs SynaBun's plan agent (OPENCODE_PLAN_AGENT; OpenCode's own
   // `plan` agent, the persona riding as `system`, when the config patch failed).
   let approvalMode = opencodeApprovalMode(brain.permissionMode);
@@ -207,17 +261,29 @@ export function createOpenCodeBrain({ session, sink, deps = {}, persona = '' } =
   }
 
   /** The serve's MCP servers as an `mcp_status` event (the runtime reads whether SynaBun, and so agent_route, is reachable). */
+  function sendMcpStatus(servers) { sink.send({ type: 'event', event: { type: 'system', subtype: 'mcp_status', servers } }); }
   async function reportMcpStatus() {
-    try { const status = await client?.mcp?.status?.({ directory: cwd }); sink.send({ type: 'event', event: { type: 'system', subtype: 'mcp_status', servers: status?.data || status || [] } }); } catch {}
+    try { const status = await client?.mcp?.status?.({ directory: cwd }); sendMcpStatus(status?.data || status || []); } catch {}
   }
 
   async function start() {
     if (disposed) throw new Error('OpenCode brain disposed');
     if (startPromise) return startPromise;
     startPromise = (async () => {
-      const xdgRoot = deps.setupOpencodeSidepanelConfig(termId, brain.mcpProfile || null);
-      try { personaInstalled = patchOpenCodeAssistantConfig(xdgRoot, { persona, model: null, desktopGrant: deps.desktopGrant || null, routeGate: deps.routeGate || null, brainCredential: deps.brainCredential || null }); } catch { personaInstalled = false; }
-      entry = await deps.ensureIsolatedServe(termId, { xdgRoot, keepAlive: true, mcpProfile: brain.mcpProfile || null, brainCredential: deps.brainCredential || null });
+      const xdgRoot = deps.setupOpencodeSidepanelConfig(termId, brain.tools ?? OPENCODE_BRAIN_TOOLS, { cwd: brain.cwd, scopeExternal: false });
+      // A brain whose config could not be patched would start with Code Mode on: SynaBun's tools only behind
+      // `execute`, which the route gate refuses before routing, so agent_route is unreachable. Refuse to start.
+      let patchError = null;
+      try { personaInstalled = patchOpenCodeAssistantConfig(xdgRoot, { persona, model: null, desktopGrant: deps.desktopGrant || null, routeGate: deps.routeGate || null, brainCredential: deps.brainCredential || null }); } catch (err) { personaInstalled = false; patchError = err; }
+      const unready = assistantConfigProblem(xdgRoot);
+      if (unready) {
+        throw new Error(`OpenCode Assistant could not start: ${unready}${patchError?.message ? ` (${patchError.message})` : ''}. Check Settings → OpenCode, or switch the Assistant to another provider.`);
+      }
+      // Its turns go out once SynaBun's tools are on the model's list (waitForSynabunTools).
+      synabunExpected = assistantSynabunConfigured(xdgRoot);
+      // An inherited OPENCODE_CONFIG_DIR would replace this isolated configuration (route-gate plugin,
+      // the assistant and plan agents): the brain's serve never reads it.
+      entry = await deps.ensureIsolatedServe(termId, { xdgRoot, keepAlive: true, tools: brain.tools ?? OPENCODE_BRAIN_TOOLS, brainCredential: deps.brainCredential || null, extraEnv: { OPENCODE_CONFIG_DIR: null } });
       if (!entry?.client) throw new Error('OpenCode isolated serve failed to start');
       client = entry.client;
       await client.waitUntilConnected?.(20_000);
@@ -241,7 +307,9 @@ export function createOpenCodeBrain({ session, sink, deps = {}, persona = '' } =
     kind: 'opencode',
     start,
     async sendUserTurn({ text, images = [], model = null, effort = null, permissionMode: mode = null, planMode: plan = null } = {}) {
+      const stop = stops;
       await start();
+      if (disposed || stops !== stop) return false;
       applyModes(mode, plan);
       turnActive = true;
       // The runtime passes the effective model/effort on every turn (the record
@@ -250,7 +318,6 @@ export function createOpenCodeBrain({ session, sink, deps = {}, persona = '' } =
       const request = {
         sessionID: sessionId, parts, model: normalizeOpenCodeModel(model || brain.model), directory: cwd,
       };
-      if (request.model) lastTurnModel = request.model;
       if (effort) request.variant = String(effort);
       turnPlanned = planMode && !remoteReadOnly;
       if (turnPlanned && personaInstalled) {
@@ -265,14 +332,25 @@ export function createOpenCodeBrain({ session, sink, deps = {}, persona = '' } =
       else if (personaInstalled) request.agent = brain.agent || 'assistant';
       else { request.agent = brain.agent || 'build'; if (persona) request.system = persona; }
       if (entry) entry.lastUsed = Date.now();
-      // SynaBun may have connected (or failed) since the last turn: the route gate follows it.
-      await reportMcpStatus();
+      // SynaBun's tools on the model's list first (a fresh serve may still be connecting them); the route gate
+      // follows what was seen. Stopped meanwhile (its `aborted` is out) or disposed: the turn never goes out.
+      const controller = new AbortController();
+      waitingAbort = controller;
+      let ready;
+      try {
+        ready = await waitForSynabunTools(client, { ...mcpWait, directory: cwd, expected: synabunExpected,
+          signal: controller.signal, stopped: () => disposed || stops !== stop,
+          onStatus: sendMcpStatus,
+          onTimeout: (ms) => sink.send({ type: 'event', event: { type: 'system', subtype: 'status', text: synabunToolsTimeoutText(ms, 'brain') } }),
+        });
+      } finally { if (waitingAbort === controller) waitingAbort = null; }
+      if (!ready || disposed || stops !== stop) { turnActive = false; return false; }
       const response = await client.session.promptAsync(request);
       const status = Number(response?.status);
       if (Number.isFinite(status) && status >= 400) { turnActive = false; throw new Error(`OpenCode prompt failed (${status})`); }
       return true;
     },
-    async abort() { if (client && sessionId) await client.session.abort({ sessionID: sessionId, directory: cwd }).catch(() => {}); emit({ type: 'aborted' }); },
+    async abort() { stops += 1; waitingAbort?.abort(); if (client && sessionId) await client.session.abort({ sessionID: sessionId, directory: cwd }).catch(() => {}); emit({ type: 'aborted' }); },
     async setPermissionMode(mode, { planMode: plan = null } = {}) { applyModes(mode, plan); sink.send({ type: 'mode_changed', mode: approvalMode, planMode }); },
     respondControl(requestId, response) {
       const pending = pendingControls.get(String(requestId));
@@ -284,12 +362,11 @@ export function createOpenCodeBrain({ session, sink, deps = {}, persona = '' } =
         : client.permission.reply({ requestID: body.requestID, reply: body.reply, directory: cwd });
       Promise.resolve(call).catch((error) => sink.send({ type: 'error', message: `OpenCode reply failed: ${error?.message || error}` }));
     },
-    // OpenCode 1.18.34 answers v2.session.compact with 503 "not available yet":
-    // compactOrSummarize then summarises on the model of the last turn.
+    // OpenCode compacts the session on the model it runs on.
     async compact() {
       await start();
       turnPlanned = false;
-      await compactOrSummarize(client, { sessionID: sessionId, directory: cwd, model: lastTurnModel || normalizeOpenCodeModel(brain.model) });
+      await client.session.compact({ sessionID: sessionId, directory: cwd });
     },
     async mcpStatus() { await reportMcpStatus(); },
     async reconcileUsage(meter) {
@@ -325,6 +402,7 @@ export function createOpenCodeBrain({ session, sink, deps = {}, persona = '' } =
     async dispose() {
       if (disposed) return;
       disposed = true;
+      waitingAbort?.abort();
       if (keepAliveTimer) clearInterval(keepAliveTimer);
       if (unsubscribe) { try { unsubscribe(); } catch {} }
       try { deps.stopIsolatedServe(termId); } catch {}

package/neural-interface/lib/assistant-brains/opencode2-browser-policy/index.js

@@ -0,0 +1,59 @@
+// SynaBun — OpenCode plugin: the browser policy of an Assistant task run.
+// Loaded only by the isolated `opencode serve` of a worker the Assistant
+// dispatched (its opencode.json's `plugins` entry, { package: <this folder as a
+// file URL>, options }, added by withOpenCodeBrowserPolicy from server.js
+// setupOpencodeLoopConfig); loops, schedules and the OpenCode sidepanel never
+// load it. OpenCode 2's plugin API: the default export is `{ id, setup(context) }`,
+// registering `context.tool.hook('execute.before', …)`, which sees `{ tool, sessionID, input }`;
+// a refusal is thrown as a plain Error, which OpenCode records as that tool's
+// error, and the loop continues. Before every tool call it asks
+// lib/browser-tool-policy.js here, with no server round trip. OpenCode calls the
+// shell tool `shell` and the sub-agent tool `subagent`: the policy is asked with
+// the names the rest of SynaBun knows (`bash`, `task`). Script paths resolve
+// against the run's cwd (the plugin options), else the serve's directory; the
+// options' `roots` name the registered code projects its test runners may also
+// run in (the serve is sandboxed and cannot read SynaBun's data home: server.js
+// lists them as the run starts). A
+// policy module that cannot load fails closed: the failure is logged once, and
+// the shell, webfetch, websearch and every tool that is not OpenCode's own or
+// SynaBun's (another MCP server's, another plugin's) are refused with that
+// reason until the run ends.
+
+// An absolute file URL: the policy loads from SynaBun's lib/ wherever OpenCode imports this file from.
+const POLICY_URL = new URL('../../browser-tool-policy.js', import.meta.url).href;
+const V1_NAMES = { shell: 'bash', subagent: 'task' };
+
+// OpenCode's own tools that run no command, fetch no page and open no browser (by the names above). The shell,
+// webfetch, websearch and OpenCode's browser are not here; any other name belongs to an MCP server or a plugin.
+const OWN_TOOLS = new Set([
+  'read', 'list', 'glob', 'grep', 'edit', 'write', 'patch', 'todo', 'task', 'skill', 'lsp', 'question',
+  'invalid', 'plan_exit', 'plan_enter',
+]);
+
+export default {
+  id: 'synabun.browser-policy',
+  async setup(context) {
+    const options = context?.options || {};
+    let policy = null;
+    let loadError = null;
+    try { policy = await import(POLICY_URL); } catch (error) { loadError = error; }
+    const cwd = (typeof options.cwd === 'string' && options.cwd) || context?.location?.directory || process.cwd();
+    const roots = Array.isArray(options.roots) ? options.roots.filter((path) => typeof path === 'string') : [];
+    if (typeof policy?.browserToolDenial !== 'function') {
+      const why = loadError?.message || 'browserToolDenial is missing';
+      console.error(`[SynaBun] browser policy could not load from ${POLICY_URL} (${why}); refusing the shell, webfetch, websearch and other servers' tools for this run`);
+      await context.tool.hook('execute.before', async (call) => {
+        const raw = String(call?.tool || '');
+        const tool = V1_NAMES[raw] || raw;
+        if (/^synabun_/i.test(tool) || OWN_TOOLS.has(tool.toLowerCase())) return;
+        throw new Error(`SynaBun browser policy: ${raw} was refused — SynaBun's browser policy could not load (${why}), so no command, web tool or other server's tool can be checked for a browser launch. SynaBun's own tools (SynaBun_*) and file tools still work. Stop and report this.`);
+      });
+      return;
+    }
+    await context.tool.hook('execute.before', async (call) => {
+      const raw = String(call?.tool || '');
+      const reason = policy.browserToolDenial(V1_NAMES[raw] || raw, call?.input || {}, { host: 'opencode', cwd, roots });
+      if (reason) throw new Error(reason);
+    });
+  },
+};

package/neural-interface/lib/assistant-brains/opencode2-route-gate/index.js

@@ -0,0 +1,97 @@
+// SynaBun — OpenCode plugin for the Assistant's route gate.
+// Loaded only by the assistant brain's isolated `opencode serve` (its
+// opencode.json's `plugins` entry, { package: <this folder as a file URL>,
+// options }, written by patchOpenCodeAssistantConfig); the OpenCode sidepanel
+// never loads it. OpenCode 2's plugin API: the default export is
+// `{ id, setup(context) }`; the hook it registers with
+// `context.tool.hook('execute.before', …)` sees `{ tool, sessionID, input }`
+// and refuses a call by throwing (OpenCode records
+// the message as that tool's error and the loop continues; only
+// permission/question rejections stop a turn). Before every tool call it asks
+// the Neural Interface whether the call may run (the route gate, and plan
+// mode's read-only policy on every session of this serve). When the gate
+// allows, the user's own OpenCode permission rules apply exactly as before.
+// OpenCode calls two tools by other names than the rest of SynaBun knows
+// (`shell` for bash, `subagent` for task): the gate is asked with those names.
+// The call's whole arguments travel (the remote denylist reads paths from
+// them), marked inputComplete; arguments too big to send go as their
+// command/action only. No answer at all (the server unreachable or slow)
+// allows the call — except with `remote` (a WhatsApp session's serve), where a
+// call SynaBun could not check is refused. An answer that is not a decision
+// (the check itself refused, such as 403 PEER_REFUSED, an error status, a body
+// without `allow`) refuses the call in every session and says what SynaBun
+// answered: a refusal never passes for an allow.
+//
+// Every request carries the session's pin (X-Synabun-Assistant): this plugin
+// runs inside the brain's `opencode serve`, an AI agent's process tree, which
+// SynaBun's owner gate (lib/owner-authority.js) refuses unless the call says
+// it is an agent's own. The per-session `token` in the body is what the route
+// itself checks.
+//
+// On load it says hello: until the Neural Interface hears it, it enforces the
+// gate reactively (interrupting a turn after an unrouted tool started), so a
+// plugin that never loads still leaves the brain gated. A WhatsApp session
+// runs no turn at all until the hello arrives.
+
+const MAX_INPUT_BYTES = 256 * 1024;
+const UNCHECKED = 'SynaBun could not check this call, so a WhatsApp session does not run it.';
+const V1_NAMES = { shell: 'bash', subagent: 'task' };
+const PIN_HEADER = 'x-synabun-assistant';
+
+/** The session id as a header value (printable ASCII only: fetch refuses anything else before sending). */
+function pinOf(session) {
+  return String(session).replace(/[^\x21-\x7e]/g, '').slice(0, 200);
+}
+
+/** The refusal of a call whose check got an answer that is not a decision: what SynaBun answered, in short. */
+function notADecision(status, body) {
+  const code = body && typeof body === 'object' && typeof body.code === 'string' ? ` ${body.code.slice(0, 64)}` : '';
+  const said = body && typeof body === 'object' && typeof body.error === 'string' ? `: ${body.error.slice(0, 300)}` : '';
+  return `SynaBun could not check this call (its route gate answered ${status}${code}${said}), so it did not run.`;
+}
+
+/** { input, inputComplete }: the whole arguments when small enough to send, else their command/action. */
+function callArguments(args) {
+  if (!args || typeof args !== 'object' || Array.isArray(args)) return { input: {}, inputComplete: false };
+  let size = Infinity;
+  try { size = JSON.stringify(args).length; } catch {}
+  if (size <= MAX_INPUT_BYTES) return { input: args, inputComplete: true };
+  const subset = {};
+  for (const key of ['command', 'action']) {
+    if (typeof args[key] === 'string' && args[key].length <= 64 * 1024) subset[key] = args[key];
+  }
+  return { input: subset, inputComplete: false };
+}
+
+export default {
+  id: 'synabun.route-gate',
+  async setup(context) {
+    const { url, session, token, remote = false } = context?.options || {};
+    if (!url || !session || !token) return;
+    const post = (body) => fetch(url, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', [PIN_HEADER]: pinOf(session) },
+      body: JSON.stringify({ session, token, host: 'opencode', ...body }),
+      signal: AbortSignal.timeout(5000),
+    });
+    // Never blocks loading; a lost hello only keeps the reactive fallback on (a refused one is said in the serve's log).
+    post({ hello: true }).then((response) => {
+      if (!response.ok) console.error(`[SynaBun] the route gate refused this serve's hello (${response.status}); every tool call will be refused until it answers`);
+    }).catch(() => {});
+    await context.tool.hook('execute.before', async (call) => {
+      const name = String(call?.tool || '');
+      let response;
+      try {
+        response = await post({ tool: V1_NAMES[name] || name, providerSessionId: call?.sessionID || null, ...callArguments(call?.input) });
+      } catch {
+        if (remote === true) throw new Error(UNCHECKED);
+        return;
+      }
+      let decision = null;
+      try { decision = await response.json(); } catch { decision = null; }
+      if (response.ok && decision && decision.allow === true) return;
+      if (response.ok && decision && decision.allow === false) throw new Error(String(decision.reason || 'SynaBun route gate: call agent_route first.'));
+      throw new Error(notADecision(response.status, decision));
+    });
+  },
+};