synabun 2.0.9 → 2.1.0

package/neural-interface/lib/browser-tool-policy.js

@@ -15,14 +15,18 @@
 //                       reactive fallback); Assistant task runs' workers in
 //                       native-loop-providers.js (Claude),
 //                       assistant-brains/codex-browser-policy-hook.mjs and
-//                       assistant-brains/opencode-browser-policy.js
+//                       assistant-brains/opencode2-browser-policy/
 //
 // Lexical, like remote-policy.js: a speed bump, not a sandbox. A shell that
 // builds a program name at run time, or a script loading a browser library
 // from a file SynaBun cannot read, gets past it. Mentions (rg playwright,
-// cat pw.cjs, sed -i … pw.cjs, git, code that only names a library) and a
-// project's own automated tests (npm test, node --test, vitest, jest, npx
-// playwright test run inside the project on files inside it) always pass.
+// cat pw.cjs, sed -i … pw.cjs, git, code that only names a library), a
+// syntax check (node --check <file>: Node parses it and runs nothing) and
+// automated tests (npm test, node --test, vitest, jest, npx playwright test)
+// run from inside one allowed project on files inside that same project
+// always pass. The allowed projects are the session's own and the `roots` its
+// caller passes: the registered SynaBun projects that are code projects
+// (lib/browser-policy-roots.js, read by the caller as a run starts).
 // Computer use on a browser window is refused by the desktop guards
 // (lib/desktop/guards.js), which know the app a click or a key lands in.
 // Pure ESM with no imports of SynaBun's own, loaded by Node and by OpenCode's
@@ -68,6 +72,9 @@ function browserToolNames(tools) {
   };
 }
 
+// Where automated tests run, and the syntax check: one sentence for the rule text and every refusal.
+const TEST_RUN_RULE = 'Automated tests run through their test runner (npm test, node --test, vitest, jest, npx playwright test, not its UI or debug mode) from inside the project they belong to: cd into that project first and name only its own files. That project may be this session\'s or any registered SynaBun project that is a code project (git, package.json or deno.json at its top; never the Downloads folder). A syntax check (node --check <file>) always runs.';
+
 /**
  * The browser rule, as bullet lines: the brain's persona (its host's tool
  * names in `tools`), the worker prompts of browser runs. `host`: claude /
@@ -78,7 +85,8 @@ export function browserPolicyText({ tools = '', host = null } = {}) {
   const web = WEB_TOOL_WORDS[hostKey(host)] || 'WebSearch / WebFetch (OpenCode webfetch / websearch, Codex web_search)';
   return [
     `- Every page, public or localhost, goes through SynaBun's browser tools (${t.navigate}, ${t.snapshot}, ${t.screenshot}, ${t.console} and the other browser_* tools); they open the browser configured in SynaBun (MoreLogin). Nothing else opens a page.`,
-    '- Never run Playwright, Puppeteer or Selenium code of your own to look at a page (a script, node -e, python -c, a heredoc), and never `npx playwright` except to run the project\'s automated tests (npx playwright test).',
+    '- Never run Playwright, Puppeteer or Selenium code of your own to look at a page (a script, node -e, python -c, a heredoc), and never `npx playwright` except to run automated tests (npx playwright test).',
+    `- ${TEST_RUN_RULE}`,
     '- Never launch Chrome, Chromium, Edge, chrome-headless-shell or any other browser binary, and never take headless screenshots (--headless, --screenshot).',
     '- Never `open` a URL or a browser app, and never use computer use on a browser app.',
     `- Never use the Playwright, Chrome DevTools, Claude-in-Chrome or any other browser MCP tools, nor ${web}.`,
@@ -230,6 +238,27 @@ function insideDir(path, dir) {
   const rel = relative(resolve(dir), resolve(path));
   return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));
 }
+// macOS and Windows name a folder in any letter case: an exclusion below compares that way.
+const caseless = (path) => (process.platform === 'darwin' || process.platform === 'win32' ? path.toLowerCase() : path);
+
+/**
+ * Where a test runner may run: the session's project, then each of `roots`
+ * (the caller's registered code projects) that is an absolute path, never
+ * the home folder or a folder above it, never the Downloads folder or
+ * anything in it (the caller's rule, held here too by name alone).
+ */
+function testRoots(project, roots) {
+  const out = [project];
+  const home = caseless(resolve(homedir()));
+  const downloads = caseless(resolve(homedir(), 'Downloads'));
+  for (const root of Array.isArray(roots) ? roots : []) {
+    if (typeof root !== 'string' || !isAbsolute(root)) continue;
+    const path = resolve(root);
+    if (insideDir(home, caseless(path)) || insideDir(caseless(path), downloads)) continue;
+    if (!out.includes(path)) out.push(path);
+  }
+  return out;
+}
 /** A regular file up to MAX_SCRIPT_BYTES, else null. */
 function defaultReadFile(path) {
   const stat = statSync(path);
@@ -549,13 +578,12 @@ function pathArgs(args) {
 }
 
 /**
- * A project's own automated tests: npm|pnpm|yarn|bun test (and run test*),
- * node --test, deno test, vitest, jest, playwright test — through a package
- * runner too — run from inside the project (`cwd`, where the command runs, `cd`
- * included) on file arguments, if any, that lie inside it too.
+ * A test runner's command, wherever it runs: { rest (its arguments, the files
+ * among them), playwright } for npm|pnpm|yarn|bun test (and run test*), node
+ * --test, deno test, vitest, jest, playwright test — through a package runner
+ * too — else null.
  */
-function isTestRun(words, { cwd, project }) {
-  if (!insideDir(cwd, project)) return false;
+function testRunner(words) {
   const [head, ...args] = words;
   const name = programName(head);
   let rest = null;
@@ -575,14 +603,58 @@ function isTestRun(words, { cwd, project }) {
     if (run?.pkg === 'vitest' || run?.pkg === 'jest') rest = run.args;
     else if (PLAYWRIGHT_TEST.has(run?.pkg) && run.args[0] === 'test') { rest = run.args.slice(1); playwright = true; }
   }
-  if (rest === null) return false;
-  if (playwright && rest.some((arg) => PLAYWRIGHT_INTERACTIVE.test(arg))) return false;
-  return pathArgs(rest).every((path) => insideDir(resolvePath(cwd, path), project));
+  return rest === null ? null : { rest, playwright };
+}
+/** The allowed projects (ctx.roots) the command runs from (`cwd`, where it runs, `cd` included). */
+const rootsHolding = (cwd, roots) => roots.filter((root) => insideDir(cwd, root));
+
+/**
+ * Automated tests: a test runner (testRunner) run from inside one of the
+ * allowed projects (the session's own, or a registered code project the
+ * caller passed) on file arguments, if any, that lie inside that same one.
+ */
+function isTestRun(words, { cwd, roots }) {
+  const run = testRunner(words);
+  if (!run) return false;
+  if (run.playwright && run.rest.some((arg) => PLAYWRIGHT_INTERACTIVE.test(arg))) return false;
+  const files = pathArgs(run.rest).map((path) => resolvePath(cwd, path));
+  return rootsHolding(cwd, roots).some((root) => files.every((file) => insideDir(file, root)));
+}
+/** Where a test run that is not exempt ran from, for its refusal. */
+function testRunWhere({ cwd, roots }) {
+  return rootsHolding(cwd, roots).length
+    ? 'on files outside the project it runs in'
+    : `run from ${cwd}, outside this session's project and every registered code project`;
 }
 /** Why a `playwright test` that is not an automated test run is refused. */
-function playwrightTestWhy(runner, args, { cwd, project }) {
+function playwrightTestWhy(runner, args, ctx) {
   if (args.some((arg) => PLAYWRIGHT_INTERACTIVE.test(arg))) return `${runner} test in its UI or debug mode (a browser window)`;
-  return insideDir(cwd, project) ? `${runner} test on files outside the project` : `${runner} test run from ${cwd}, outside the project`;
+  return `${runner} test ${testRunWhere(ctx)}`;
+}
+
+/**
+ * `node --check <file>` / `node -c <file>` (or its program on stdin): Node
+ * parses the program and runs none of it. Checked on Node 24: the forms
+ * below run code and are not exempt, so the usual check applies to them:
+ * any other option before the file (-r / --require and --import run the
+ * module they name, --env-file and --experimental-config-file can add a
+ * --require, --run runs a package.json script; -e / -p, --test and --watch
+ * Node refuses to combine with --check), NODE_OPTIONS set anywhere on the
+ * line (it can hold a --require), `inspect` as the file (node inspect
+ * starts the next file under the debugger) and arguments xargs supplies.
+ * Only node / nodejs started directly: a package runner's (npx node) is not.
+ */
+function syntaxCheckOnly(args, seg, ctx) {
+  if (ctx.nodeOptions || seg.words.some((word) => word.includes('NODE_OPTIONS') || programName(word) === 'xargs')) return false;
+  let check = false;
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === '--check' || arg === '-c') { check = true; continue; }
+    if (arg === '--') return check && args[i + 1] !== 'inspect';
+    if (arg.startsWith('-') && arg !== '-') return false;
+    return check && arg !== 'inspect';
+  }
+  return check;
 }
 
 /** What `open` / xdg-open is asked to show when it is a browser, a URL or a web page, else null. */
@@ -660,14 +732,28 @@ const RUNTIME_VALUE_OPTIONS = {
   ts: new Set(['--tsconfig', '-P', '--project', '-O', '--compiler-options', '-r', '--require', '--import', '--loader', '-C', '--conditions', '--env-file', '--config', '--root', '--mode', '-I', '--ignore']),
 };
 const EVAL_FLAG = /^(?:--eval|--print|-[A-Za-z]*[ep])$/;
+// Options whose value is a module the runtime loads and runs before the program (node -r, --import, a loader; bun --preload).
+const PRELOAD_OPTIONS = new Set(['-r', '--require', '--import', '--loader', '--experimental-loader', '--preload']);
+const PRELOAD_INLINE = /^(--require|--import|--loader|--experimental-loader|--preload)=(.*)$/;
+
+/** The modules a list of runtime options preloads (`-r x`, `--import=x` …), in order. */
+function preloadsIn(words) {
+  const out = [];
+  for (let i = 0; i < words.length; i += 1) {
+    if (PRELOAD_OPTIONS.has(words[i])) { if (words[i + 1] !== undefined) out.push(words[i + 1]); i += 1; continue; }
+    const inline = PRELOAD_INLINE.exec(words[i]);
+    if (inline) out.push(inline[2]);
+  }
+  return out;
+}
 
 /**
- * A JS runtime's arguments → { code: [inline code], script, stdin }: node,
+ * A JS runtime's arguments → { code: [inline code], script, preload }: node,
  * bun, deno, tsx, ts-node and friends. `script` "-" or none (and no code):
- * the program comes from stdin.
+ * the program comes from stdin. `preload`: the modules its options load first.
  */
 function jsProgram(name, args) {
-  const out = { code: [], script: null };
+  const out = { code: [], script: null, preload: [] };
   let list = args;
   let valued = NODE_VALUE_OPTIONS;
   if (name === 'bun') {
@@ -683,14 +769,25 @@ function jsProgram(name, args) {
     valued = RUNTIME_VALUE_OPTIONS.ts;
     if (list[0] === 'watch') list = list.slice(1); // tsx watch <file>
   }
+  const node = name === 'node' || name === 'nodejs';
   for (let i = 0; i < list.length; i += 1) {
     const arg = list[i];
     if (arg === '-') { out.script = '-'; return out; }
-    if (arg === '--') { out.script = list[i + 1] ?? null; return out; }
+    if (arg === '--') {
+      // `node -- inspect <file>` is node inspect too.
+      const inspect = node && !out.inspect && list[i + 1] === 'inspect';
+      out.script = list[i + (inspect ? 2 : 1)] ?? null;
+      return out;
+    }
     if (/^--(?:eval|print)=/.test(arg)) { out.code.push(arg.slice(arg.indexOf('=') + 1)); return out; }
     if (EVAL_FLAG.test(arg)) { if (list[i + 1] !== undefined) out.code.push(list[i + 1]); return out; }
+    if (PRELOAD_OPTIONS.has(arg) && valued.has(arg)) { if (list[i + 1] !== undefined) out.preload.push(list[i + 1]); i += 1; continue; }
+    const inline = PRELOAD_INLINE.exec(arg);
+    if (inline) { out.preload.push(inline[2]); continue; }
     if (valued.has(arg)) { i += 1; continue; }
     if (arg.startsWith('-')) continue;
+    // `node inspect <file>` runs <file> under the debugger.
+    if (arg === 'inspect' && node && !out.inspect) { out.inspect = true; continue; }
     out.script = arg;
     return out;
   }
@@ -723,6 +820,17 @@ const FILE_READERS = new Set(['cat', 'type', 'head', 'tail', 'bat', 'more', 'les
 function interpreterDenial(name, args, seg, ctx) {
   const python = PYTHON.test(name);
   const program = python ? pythonProgram(args) : jsProgram(name, args);
+  // A preloaded file runs before the program (with --check too): its options', and NODE_OPTIONS set on the command itself.
+  if (!python) {
+    const inherited = seg.words.filter((word) => word.startsWith('NODE_OPTIONS=')).flatMap((word) => preloadsIn(word.slice(13).trim().split(/\s+/)));
+    for (const module of [...inherited, ...program.preload]) {
+      if (!PATH_LIKE.test(module)) continue; // a package name: not read
+      let file = module;
+      if (/^file:/i.test(module)) { try { file = decodeURIComponent(new URL(module).pathname); } catch { continue; } }
+      const what = codeMarker(readScript(ctx, resolvePath(ctx.cwd, file)));
+      if (what) return `preloading ${module}, a script that ${what}, into ${name}`;
+    }
+  }
   for (const code of program.code) {
     const what = codeMarker(code);
     if (what) return `inline code that ${what} (${name} ${python ? '-c' : '-e'})`;
@@ -818,7 +926,12 @@ function segmentDenial(words, seg, ctx) {
   }
   if (name === 'playwright' && args[0] === 'test') return playwrightTestWhy(name, args.slice(1), ctx);
   if (BROWSER_CLIS.has(name)) return `${name}${args[0] ? ` ${args[0]}` : ''} (a browser CLI)`;
-  if (JS_RUNTIMES.has(name) || PYTHON.test(name)) return interpreterDenial(name, args, seg, ctx);
+  if ((name === 'node' || name === 'nodejs') && syntaxCheckOnly(args, seg, ctx)) return null;
+  if (JS_RUNTIMES.has(name) || PYTHON.test(name)) {
+    const why = interpreterDenial(name, args, seg, ctx);
+    // node --test / deno test of a browser test from outside the project it belongs to: say where it may run.
+    return why && testRunner(words) ? `${why} (${name === 'deno' ? 'deno test' : `${name} --test`} ${testRunWhere(ctx)})` : why;
+  }
   // A script run as a program (./shot.sh, ./pw.cjs, /tmp/x): by its shebang, else its extension.
   if (/[/\\]/.test(head)) {
     const text = readScript(ctx, resolvePath(ctx.cwd, head));
@@ -838,7 +951,10 @@ function segmentDenial(words, seg, ctx) {
 function commandDenial(text, ctx) {
   if (ctx.depth > MAX_DEPTH) return null;
   let cwd = ctx.cwd;
+  // NODE_OPTIONS set or exported earlier on the line reaches every later node (syntaxCheckOnly).
+  let nodeOptions = ctx.nodeOptions === true;
   for (const seg of simpleCommands(text)) {
+    if (seg.words.some((word) => word.includes('NODE_OPTIONS'))) nodeOptions = true;
     const words = commandWords(seg.words);
     // `cd dir && node pw.cjs`: the rest of the line runs there (a bare cd: the home folder).
     if (words[0] === 'cd' || words[0] === 'pushd') {
@@ -847,7 +963,7 @@ function commandDenial(text, ctx) {
       else if (words[0] === 'cd' && words.length === 1) cwd = homedir();
       continue;
     }
-    const why = segmentDenial(words, seg, { ...ctx, cwd });
+    const why = segmentDenial(words, seg, { ...ctx, cwd, nodeOptions });
     if (why) return why;
   }
   return null;
@@ -855,13 +971,15 @@ function commandDenial(text, ctx) {
 
 /** A shell tool's command: a string (a command line) or an argv array (Codex). */
 function argvDenial(argv, ctx) {
-  const words = commandWords(argv.map((arg) => String(arg ?? '')));
+  const raw = argv.map((arg) => String(arg ?? ''));
+  const words = commandWords(raw);
   if (!words.length) return null;
   if (SHELLS.has(programName(words[0]))) {
     const script = shellScript(words.slice(1));
     if (script !== null) return commandDenial(script, ctx);
   }
-  return segmentDenial(words, { words, heredocs: [], inputs: [], pipedFrom: null }, ctx);
+  // The segment keeps its wrappers and assignments (env NODE_OPTIONS=… node --check …).
+  return segmentDenial(words, { words: raw, heredocs: [], inputs: [], pipedFrom: null }, ctx);
 }
 
 // Where each host puts a shell tool's command and its working directory.
@@ -889,18 +1007,22 @@ function shellDenial(input, ctx) {
 // ── the refusal ─────────────────────────────────────────────────────────────
 
 function refusal(tool, what) {
-  return `SynaBun browser policy: ${tool} was refused — ${what}. Every page, public or localhost, goes through SynaBun's browser tools (browser_navigate, browser_snapshot, browser_screenshot, browser_console and the other browser_* tools), which open the browser configured in SynaBun. If the SynaBun browser fails or cannot do this, stop and report it; do not switch to another browser or tool. The project's own automated tests still run through its test runner (npm test, node --test, npx playwright test).`;
+  return `SynaBun browser policy: ${tool} was refused — ${what}. Every page, public or localhost, goes through SynaBun's browser tools (browser_navigate, browser_snapshot, browser_screenshot, browser_console and the other browser_* tools), which open the browser configured in SynaBun. If the SynaBun browser fails or cannot do this, stop and report it; do not switch to another browser or tool. ${TEST_RUN_RULE}`;
 }
 
 /**
  * Why this tool call may not run under the browser policy (the refusal text),
  * else null. `host`: claude / codex / opencode (null: any). `cwd`: the
- * project directory: relative script paths resolve against it, and a test
- * runner's files must lie inside it. `readFile(path)` returns an executed
- * script's text or null (tests); by default a regular file up to
- * MAX_SCRIPT_BYTES is read, and anything unreadable is allowed.
+ * session's project directory: relative script paths resolve against it, and
+ * a test runner may run inside it. `roots`: the other projects a test runner
+ * may run inside (absolute paths: the registered code projects,
+ * lib/browser-policy-roots.js; the home folder, a folder above it and the
+ * Downloads folder are dropped). A test run's directory and its files lie in
+ * one of them. `readFile(path)` returns an executed script's text or null
+ * (tests); by default a regular file up to MAX_SCRIPT_BYTES is read, and
+ * anything unreadable is allowed.
  */
-export function browserToolDenial(tool, input = {}, { host = null, cwd = null, readFile = defaultReadFile } = {}) {
+export function browserToolDenial(tool, input = {}, { host = null, cwd = null, roots = [], readFile = defaultReadFile } = {}) {
   const name = String(tool ?? '').trim();
   if (!name) return null;
   const kind = hostKey(host);
@@ -919,8 +1041,41 @@ export function browserToolDenial(tool, input = {}, { host = null, cwd = null, r
   }
   if (isSynabunTool(name) || /^mcp__/i.test(name)) return null;
   if (WEB_TOOLS.has(lower)) return refusal(name, 'web search / fetch outside the SynaBun browser');
+  // OpenCode's own browser tool drives a browser that is not SynaBun's.
+  if (kind === 'opencode' && lower === 'browser') return refusal(name, 'OpenCode\'s own browser');
   if (!SHELL_TOOLS.has(lower)) return null;
   const project = cwd ? resolve(String(cwd)) : process.cwd();
-  const why = shellDenial(args, { project, cwd: project, readFile: typeof readFile === 'function' ? readFile : defaultReadFile, depth: 0 });
+  const why = shellDenial(args, { roots: testRoots(project, roots), cwd: project, readFile: typeof readFile === 'function' ? readFile : defaultReadFile, depth: 0 });
   return why ? refusal(name, why) : null;
 }
+
+// ── SynaBun's own OpenCode serves ───────────────────────────────────────────
+
+/**
+ * The port a web address (http, https, ws, wss) opens: its own, else the scheme's (80 / 443); null for any other
+ * address (about:blank, data:, file:, chrome:) or one that cannot be read.
+ */
+export function addressPort(url) {
+  let parsed;
+  try { parsed = new URL(String(url ?? '')); } catch { return null; }
+  if (!/^(?:https?|wss?):$/.test(parsed.protocol)) return null;
+  const port = Number(parsed.port || (parsed.protocol === 'https:' || parsed.protocol === 'wss:' ? 443 : 80));
+  return Number.isInteger(port) && port > 0 ? port : null;
+}
+
+/**
+ * Why the SynaBun browser may not open this address (the refusal text), else null: it is on the port of one of
+ * SynaBun's own OpenCode serves running now (`ports`, a Set or a list: server.js liveOpencodeServePorts). Such a
+ * serve's API changes a session's rules or moves it; nothing a page does needs it. Any host counts, not only
+ * localhost: a name that resolves to this computer reaches the serve too. server.js refuses a navigation to it and
+ * aborts every request and WebSocket of the browser to it (installServePortGuard), whatever opened the page.
+ */
+export function browserServePortDenial(url, ports) {
+  const port = addressPort(url);
+  if (!port) return null;
+  const live = ports instanceof Set ? ports : new Set(Array.isArray(ports) ? ports.map(Number) : []);
+  if (!live.has(port)) return null;
+  let host = '';
+  try { host = new URL(String(url)).hostname; } catch { /* addressPort read it */ }
+  return `SynaBun browser policy: ${host}:${port} is one of SynaBun's own OpenCode servers, which the SynaBun browser never opens (their API changes what a session may do). Use your tools instead; whatever they cannot do is yours to report.`;
+}

package/neural-interface/lib/claude-agent-bridge.js

@@ -2895,10 +2895,12 @@ export class ClaudeSession {
       catch { this._greetingNote = ''; }
     }
 
-    // SynaBun skill injection runs FIRST; unrecognized /commands pass through to the CLI
+    // SynaBun skill injection runs FIRST; unrecognized /commands pass through to the CLI. A skill Claude Code
+    // loads by itself in this session (the account's or the project's) is left to it (server.js
+    // resolveSkillPrompt), so its own settings apply; only a SynaBun skill it cannot see is handed over as text.
     if (prompt && prompt.startsWith('/')) {
       try {
-        const injected = deps.maybeInjectSkillPrompt(prompt);
+        const injected = deps.maybeInjectSkillPrompt(prompt, { cwd: cwd || this.cwd || null, runtime: 'claude', accountId: (queryAccount?.account ?? this.accountId) || 'default' });
         if (injected.command === 'clear' && !injected.skill) return; // client-only
         if (injected.skill) {
           log('skill injection: /' + injected.command);

package/neural-interface/lib/claude-hooks-status.js

@@ -0,0 +1,103 @@
+// ═══════════════════════════════════════════
+// SynaBun — the real state of SynaBun's Claude Code hooks (Settings → Automations)
+// ═══════════════════════════════════════════
+//
+// What GET /api/claude-code/integrations reports as `claudeHooks`, read from the files Claude Code itself reads:
+// the user's ~/.claude/settings.json (SynaBun's handlers live there), the managed settings an organization may
+// install, and the registered projects' .claude/settings.json and settings.local.json. It answers "would a Claude
+// Code session the owner starts by themselves run SynaBun's hooks?", which a count of entries alone does not:
+//   • Claude Code's own switches: disableAllHooks (any scope) runs no hook at all; allowManagedHooksOnly (managed
+//     settings) runs none of the user's or a project's;
+//   • a project whose SynaBun handlers differ from the user's: Claude Code runs one copy of identical handlers from
+//     both files and both copies of different ones (every hook twice: the 2026-09-15 bug);
+//   • macOS / Linux: a Claude Code started from the Dock, Finder, a desktop app or launchd has no login PATH. The
+//     handlers then look for Node in the usual folders and SYNABUN_NODE (lib/claude-hooks.js); `node: null` says
+//     such a launch would find none.
+// Pure apart from the file reads, which are injected (tests drive it with an in-memory tree).
+
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { hookInstallBlocker, hookInstallState, hookNodeWithoutPath, hooksSwitchedOff, managedClaudeSettingsPath, projectHooksAgree } from '../../lib/claude-hooks.js';
+import { packagedRuntime } from '../../lib/packaged-runtime.js';
+
+/** Bumped when the shape changes; the page shows the hooks' state only from a server that sends one. */
+export const CLAUDE_HOOKS_STATUS_VERSION = 1;
+
+/** A settings file: { settings } (parsed), { missing: true }, or { error } (it exists and cannot be read or parsed: why). */
+export function readSettingsFile(path, { read = (p) => readFileSync(p, 'utf8'), exists = existsSync } = {}) {
+  try {
+    if (!path || !exists(path)) return { missing: true };
+  } catch { return { missing: true }; }
+  let raw;
+  try { raw = read(path); } catch (error) { return { error: String(error?.code || error?.message || error) }; }
+  try {
+    const settings = JSON.parse(raw);
+    return settings && typeof settings === 'object' && !Array.isArray(settings) ? { settings } : { error: 'not a JSON object' };
+  } catch (error) { return { error: `not valid JSON: ${error?.message || error}` }; }
+}
+
+/**
+ * @param {object} o
+ * @param {string} o.userPath the user's ~/.claude/settings.json
+ * @param {Array<{path:string,label?:string}>} [o.projects] the registered projects
+ * @param {string} [o.managedPath] managed settings (managedClaudeSettingsPath)
+ * @param {string} [o.platform]
+ * @param {object|null} [o.runtime] lib/packaged-runtime.js packagedRuntime()
+ * @param {(path:string) => string} [o.read] @param {(path:string) => boolean} [o.exists]
+ * @param {(path:string) => boolean} [o.runnable] a file Node could be started from (tests)
+ * @param {string} [o.home]
+ */
+export function claudeHooksStatus({ userPath, projects = [], managedPath = managedClaudeSettingsPath(), platform = process.platform, runtime = packagedRuntime(), read, exists, runnable, home = homedir() } = {}) {
+  const io = { ...(read ? { read } : {}), ...(exists ? { exists } : {}) };
+  const base = { version: CLAUDE_HOOKS_STATUS_VERSION, settingsPath: userPath || null, installBlocker: hookInstallBlocker(runtime) };
+  const user = readSettingsFile(userPath, io);
+  if (user.error) return { ...base, state: 'error', error: user.error, installed: 0, current: 0, duplicates: 0, total: 0, events: {}, blockedBy: null, projects: [], node: null, nodeMissing: false, needsRepair: false };
+  const settings = user.settings || {};
+  const install = hookInstallState(settings, { runtime, platform });
+  const state = install.installed === 0 ? 'off' : install.installed === install.total ? 'on' : 'partial';
+
+  // Claude Code's own switches. Managed settings first: nothing below them can turn hooks back on.
+  let blockedBy = null;
+  const managed = readSettingsFile(managedPath, io);
+  const managedSwitch = hooksSwitchedOff(managed.settings, { managed: true });
+  if (managedSwitch) blockedBy = { setting: managedSwitch, scope: 'managed', path: managedPath };
+  else {
+    const userSwitch = hooksSwitchedOff(settings);
+    if (userSwitch) blockedBy = { setting: userSwitch, scope: 'user', path: userPath };
+  }
+
+  // The registered projects: hooks switched off there, or SynaBun handlers that would run next to the user's.
+  const projectIssues = [];
+  for (const project of Array.isArray(projects) ? projects : []) {
+    if (!project?.path) continue;
+    for (const name of ['settings.json', 'settings.local.json']) {
+      const file = join(project.path, '.claude', name);
+      const found = readSettingsFile(file, io);
+      if (!found.settings) continue;
+      let issue = hooksSwitchedOff(found.settings) ? 'disableAllHooks' : projectHooksAgree(settings, found.settings) === 'different' ? 'different' : null;
+      // Off for the user, still on there: that project's sessions keep running them.
+      if (!issue && install.installed === 0 && hookInstallState(found.settings, { targetProjectPath: project.path, runtime, platform }).installed > 0) issue = 'project-only';
+      if (issue) projectIssues.push({ path: project.path, label: project.label || null, file, issue });
+    }
+  }
+
+  // Asked of the packaged application too: its entry finds its own Node, so the answer is only shown for the others.
+  const node = platform === 'win32' || runtime ? null : hookNodeWithoutPath({ env: settings.env || {}, home, platform, ...(runnable ? { runnable } : {}) });
+  const nodeMissing = install.installed > 0 && platform !== 'win32' && !runtime && !node;
+  return {
+    ...base,
+    state,
+    installed: install.installed,
+    current: install.current,
+    duplicates: install.duplicates,
+    total: install.total,
+    events: install.events,
+    blockedBy,
+    projects: projectIssues,
+    node,
+    nodeMissing,
+    // What turning the hooks on again would put right: an old command form, an extra copy, a project out of step.
+    needsRepair: install.installed > 0 && (install.current < install.installed || install.duplicates > 0 || projectIssues.some((p) => p.issue === 'different') || nodeMissing),
+  };
+}

package/neural-interface/lib/claude-model-catalog.js

@@ -43,7 +43,39 @@ const DISCOVERY_TIMEOUT_MS = 15000;
 const CACHE_TTL_MS = 10 * 60 * 1000;
 
 let _cache = { at: 0, key: '', models: [] };
-let _inflight = null;
+const _inflight = new Map(); // cache key → the discovery running for it
+// Where the last verified list is kept across restarts ({ read(), write(entry) },
+// lib/launch-cache.js createSnapshotStore): a start answers with it at once and
+// asks the CLI again in the background.
+let _store = null;
+let _storeRead = false;
+
+export function setClaudeModelStore(store) {
+  _store = store && typeof store.read === 'function' && typeof store.write === 'function' ? store : null;
+  _storeRead = false;
+}
+
+// The list the last run verified, for this very binary and account: given at once
+// after a restart (as an old answer, so the first read asks the CLI again).
+function adoptStoredModels(key) {
+  if (_storeRead || !_store) return;
+  _storeRead = true;
+  if (_cache.models.length) return;
+  try {
+    const saved = _store.read();
+    const models = saved?.key === key && Array.isArray(saved.models)
+      ? saved.models.filter(m => m && typeof m === 'object' && typeof m.id === 'string' && m.id)
+      : [];
+    if (models.length) _cache = { at: 0, key, models };
+  } catch { /* nothing kept: the first read asks the CLI */ }
+}
+
+// What the list depends on: the binary (an update changes it, binaryIdentity) and
+// the account it was read under (another account can be entitled to other models).
+function cacheKeyOf(bin, account) {
+  const who = String(account || '');
+  return who ? `${binaryIdentity(bin)}#${who}` : binaryIdentity(bin);
+}
 
 // Who else keeps a copy of this list (the Assistant's model catalog). Told when a
 // discovery returns a list that differs from the one before it, so a copy is
@@ -286,37 +318,55 @@ export function queryClaudeCliModels(claudeBin, { cwd, timeoutMs = DISCOVERY_TIM
 }
 
 // Cached discovery. `source` lets the UI distinguish a verified list from the
-// baked-in fallback. Cache is keyed on the binary's identity, so switching the
-// configured CLI (Settings > Terminal) or updating it re-discovers.
-export async function discoverClaudeModels(claudeBin, { force = false, cwd, query = queryClaudeCliModels } = {}) {
+// baked-in fallback. Cache is keyed on the binary's identity (and the account
+// the list was read under, `account`), so switching the configured CLI
+// (Settings > Terminal), updating it or signing in to another account
+// re-discovers. A list that is merely old is still given at once, and the CLI is
+// asked again in the background (one discovery at a time): only a first read, a
+// changed key or `force` waits for the CLI.
+export async function discoverClaudeModels(claudeBin, { force = false, cwd, query = queryClaudeCliModels, account = '' } = {}) {
   const bin = String(claudeBin || '');
-  const key = binaryIdentity(bin);
-  const fresh = _cache.models.length
-    && _cache.key === key
-    && Date.now() - _cache.at < CACHE_TTL_MS;
-  if (!force && fresh) return { source: 'cache', models: _cache.models };
-  if (_inflight) return _inflight;
-
-  _inflight = (async () => {
+  const key = cacheKeyOf(bin, account);
+  adoptStoredModels(key);
+  const known = _cache.models.length && _cache.key === key;
+  if (!force && known) {
+    if (Date.now() - _cache.at >= CACHE_TTL_MS) discover(bin, key, cwd, query).catch(() => {});
+    return { source: 'cache', models: _cache.models };
+  }
+  return discover(bin, key, cwd, query);
+}
+
+function discover(bin, key, cwd, query) {
+  if (_inflight.has(key)) return _inflight.get(key);
+  const job = (async () => {
     try {
       const raw = await query(bin, { cwd });
       const models = normalizeClaudeModels(raw);
       if (models.length) {
         const changed = claudeModelsSignature(models) !== claudeModelsSignature(_cache.models);
         _cache = { at: Date.now(), key, models };
+        try { _store?.write({ key, at: _cache.at, models }); } catch { /* kept in memory still */ }
         if (changed) notifyModelsChanged(models);
         return { source: 'cli', models };
       }
       return { source: 'fallback', models: [...CLAUDE_FALLBACK_MODELS] };
     } finally {
-      _inflight = null;
+      if (_inflight.get(key) === job) _inflight.delete(key);
     }
   })();
-  return _inflight;
+  _inflight.set(key, job);
+  return job;
+}
+
+/** The kept list is due again: the next read still answers with it and asks the CLI in the background. */
+export function markClaudeModelsStale() {
+  _cache = { ..._cache, at: 0 };
 }
 
 export function clearClaudeModelCache() {
   _cache = { at: 0, key: '', models: [] };
+  _inflight.clear();
+  _storeRead = !!_store;
   _skewCache = { key: null, result: undefined };
   _skewInflight.clear();
 }

package/neural-interface/lib/claude-temporary.js

@@ -49,7 +49,7 @@ const READ_TOOLS = new Set([
 ]);
 // One tool, both: the actions that only read. Any other action is refused, an
 // action nobody listed included. `''` is the tool's own default action.
-// (`profile`: `set` writes the runtime's profile, to a file and to the server.)
+// (`tool_groups`: `add` / `set` write the runtime list, to a file and to the server.)
 const READ_ACTIONS = Object.freeze({
   memories: new Set(['recent', 'stats', 'by-category', 'by-project', 'get', 'get-batch', 'history', 'context']),
   category: new Set(['list']),
@@ -57,7 +57,7 @@ const READ_ACTIONS = Object.freeze({
   fb_groups: new Set(['worklist', 'list', 'stats']),
   image_staged: new Set(['list']),
   morelogin: new Set(['status', 'list']),
-  profile: new Set(['get']),
+  tool_groups: new Set(['get']),
 });
 // Acting on the outside world through the browser, an API or the desktop: what
 // Bash and Edit do too. They leave what they do where they do it (a post, a
@@ -84,19 +84,13 @@ const ACT_TOOLS = new Set([
   'gsc_removals_cancel', 'gsc_screenshot', 'gsc_security_issues', 'gsc_settings', 'gsc_shopping', 'gsc_sitemap', 'gsc_users', 'gsc_videos_report',
   'youtube_analytics', 'youtube_channel', 'youtube_download', 'youtube_endscreen', 'youtube_metadata', 'youtube_navigate',
   'youtube_playlist', 'youtube_schedule', 'youtube_source', 'youtube_thumbnail',
-  'leonardo_browser_download', 'leonardo_browser_generate', 'leonardo_browser_library', 'leonardo_browser_navigate',
   'computer', 'computer_apps', 'computer_ax', 'computer_status',
   'git',
 ]);
 // An acting tool that also changes one of SynaBun's stores unless it is told
-// not to: allowed with that input only. (`leonardo_browser_reference` deletes
-// the staged images it uploaded from SynaBun's image store by default.)
-const ACT_WHEN = Object.freeze({
-  leonardo_browser_reference: {
-    ok: (input) => input?.autoClear === false,
-    why: 'it removes the staged images from SynaBun\'s store unless it is called with autoClear: false',
-  },
-});
+// not to: allowed with that input only, as `{ ok: (input) => boolean, why }`.
+// No tool of the server needs one today.
+const ACT_WHEN = Object.freeze({});
 // Why a storing tool that looks like an acting one is off.
 const STORE_REASONS = Object.freeze({
   youtube_upload: 'it records every upload as a memory',