synabun 2.0.9 → 2.1.0

package/neural-interface/lib/cli-install.js

@@ -19,15 +19,11 @@
 //                checked against the SHA-256 GitHub publishes for it, or, when
 //                GitHub's API does not answer, from https://chatgpt.com/codex/
 //                (the same file). The installer checks the package it fetches.
-//   OpenCode     the install script https://opencode.ai/install (bash) on
-//                macOS and Linux. On Windows, where that script does not run:
-//                the newest OpenCode 1 release archive for the processor
-//                (opencode-windows-x64-baseline.zip, which runs on every x64
-//                CPU, or opencode-windows-arm64.zip) from the anomalyco/opencode
-//                GitHub releases, checked against its published SHA-256, its
-//                opencode.exe read out without an unzip program (the backups'
-//                streaming reader) and put in %USERPROFILE%\.opencode\bin, the
-//                folder the official installer uses (and the resolver looks in).
+//   OpenCode     OpenCode 2's install script https://opencode.ai/v2/install
+//                (bash) on macOS and Linux, the one `opencode upgrade` itself
+//                runs (it puts opencode in ~/.opencode/bin). Windows has no
+//                one-click install: OpenCode 2 comes from WinGet there
+//                (Anomaly.OpenCode), and the banner shows that command.
 //
 // Every download is HTTPS, every redirect too, and only to the vendor's own
 // hosts. Nothing runs as administrator; everything lands in the user's own
@@ -41,12 +37,11 @@
 // `code` the page has words for. Nothing here throws to a caller of start().
 
 import { spawn } from 'node:child_process';
-import { createHash, randomBytes } from 'node:crypto';
-import { createWriteStream, existsSync, mkdirSync, rmSync, renameSync, unlinkSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { existsSync, rmSync } from 'node:fs';
 import { mkdtemp, open } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { openZipArchive } from './backup-zip-reader.js';
 import { buildInstallCommand } from './cli-update-planner.js';
 import { packagedPathLast, rememberedPackagedPath, withPathEnv } from './augmented-path.js';
 
@@ -60,7 +55,6 @@ export const CLI_INSTALL_ERROR_CODES = Object.freeze([
   'timeout',                 // nothing arrived for too long, or the installer ran too long
   'installer-failed',        // the vendor's installer exited with an error
   'not-found-after-install', // it finished, but no working CLI is found
-  'unpack',                  // the archive did not hold the program
   'disk',                    // a file could not be written
   'cancelled',               // stopped (SynaBun shutting down)
   'internal',                // anything else
@@ -79,13 +73,12 @@ export class CliInstallError extends Error {
 export const CLI_INSTALL_GUIDES = Object.freeze({
   'claude-code': 'https://code.claude.com/docs/en/setup',
   codex: 'https://learn.chatgpt.com/docs/codex/cli',
-  opencode: 'https://opencode.ai/docs/',
+  opencode: 'https://opencode.ai/v2/docs',
   gemini: 'https://github.com/google-gemini/gemini-cli',
 });
 
 const GITHUB_DOWNLOAD_HOSTS = ['github.com', 'objects.githubusercontent.com', 'release-assets.githubusercontent.com', 'github-releases.githubusercontent.com'];
 const MAX_SCRIPT_BYTES = 2 * 1024 * 1024;
-const MAX_ARCHIVE_BYTES = 600 * 1024 * 1024;
 const MAX_JSON_BYTES = 8 * 1024 * 1024;
 const MAX_REDIRECTS = 6;
 const LOG_KEEP = 200;
@@ -95,12 +88,12 @@ const hostIs = (...hosts) => (url) => hosts.includes(url.hostname);
 
 /**
  * The one-click method for a tool on this system, or null when there is none
- * (Gemini CLI, a 32-bit or other system). Pure: tests ask it for every OS.
+ * (Gemini CLI, OpenCode on Windows, a 32-bit or other system). Pure: tests ask
+ * it for every OS.
  */
 export function installPlanFor(toolKey, { platform = process.platform, arch = process.arch, env = process.env, home } = {}) {
   if (!(SUPPORTED[platform] || []).includes(arch)) return null;
   const windows = platform === 'win32';
-  const homeDir = home || (windows ? env.USERPROFILE : env.HOME) || os.homedir();
   switch (toolKey) {
     case 'claude-code':
       return {
@@ -126,30 +119,16 @@ export function installPlanFor(toolKey, { platform = process.platform, arch = pr
         env: { CODEX_NON_INTERACTIVE: '1' },
       };
     case 'opencode':
-      if (windows) {
-        return {
-          tool: toolKey,
-          kind: 'archive',
-          interpreter: null,
-          repo: 'anomalyco/opencode',
-          tag: /^v1\.\d+\.\d+$/,
-          assets: arch === 'arm64' ? ['opencode-windows-arm64.zip'] : ['opencode-windows-x64-baseline.zip', 'opencode-windows-x64.zip'],
-          member: 'opencode.exe',
-          // The official installer's folder; $OPENCODE_INSTALL_DIR, which older installers honoured, when set.
-          dir: env.OPENCODE_INSTALL_DIR || path.win32.join(homeDir, '.opencode', 'bin'),
-          source: 'https://github.com/anomalyco/opencode/releases',
-          label: 'OpenCode release archive',
-          env: {},
-        };
-      }
+      // OpenCode 2's own installer is a bash script; on Windows it comes from WinGet (no one-click install).
+      if (windows) return null;
       return {
         tool: toolKey,
         kind: 'script',
         interpreter: 'bash',
-        url: 'https://opencode.ai/install',
+        url: 'https://opencode.ai/v2/install',
         allow: (url) => url.hostname === 'opencode.ai' || (url.hostname === 'raw.githubusercontent.com' && url.pathname.startsWith('/anomalyco/opencode/')),
-        source: 'https://opencode.ai/install',
-        label: 'OpenCode install script',
+        source: 'https://opencode.ai/v2/install',
+        label: 'OpenCode 2 install script',
         env: {},
       };
     default:
@@ -340,55 +319,6 @@ export function releaseAsset(release, name, repo) {
   return { name, url, size: Number(asset.size) || null, sha256: sha256OfDigest(asset.digest) };
 }
 
-/**
- * The newest OpenCode 1 release (not a draft, not a prerelease; OpenCode 2 is
- * a different program SynaBun's panel does not drive) that carries one of
- * `assets`, the first listed preferred.
- */
-export function pickOpencodeRelease(releases, { assets, repo = 'anomalyco/opencode', tag = /^v1\.\d+\.\d+$/ } = {}) {
-  for (const release of Array.isArray(releases) ? releases : []) {
-    if (!release || release.draft || release.prerelease || !tag.test(String(release.tag_name || ''))) continue;
-    for (const name of assets || []) {
-      const asset = releaseAsset(release, name, repo);
-      if (asset) return { tag: release.tag_name, version: String(release.tag_name).replace(/^v/, ''), asset };
-    }
-  }
-  return null;
-}
-
-// ── Zip ─────────────────────────────────────────────────────────────────────
-
-const unpack = (message) => new CliInstallError('unpack', message);
-
-/**
- * Read one member out of a zip archive into `destination` (a new file),
- * without an unzip program and without using a name of the archive as a path:
- * only the entry called exactly `member` is read, through the streaming
- * reader of backups (backup-zip-reader.js: ZIP64, stored or deflated, checked
- * against its size and CRC-32).
- */
-export async function extractZipMember({ archive, member, destination, maxSize = 1024 ** 3, mode = 0o755 }) {
-  let zip;
-  try { zip = await openZipArchive(archive); } catch (error) { throw unpack(`The download is not a readable zip archive (${error?.message || error}).`); }
-  let opened = false;
-  try {
-    const entry = zip.getEntry(member);
-    if (!entry) throw unpack(`The archive holds no ${member}.`);
-    if (entry.uncompressedSize > maxSize) throw unpack(`The archive's ${member} is larger than expected.`);
-    const out = createWriteStream(destination, { flags: 'wx', mode });
-    out.on('open', () => { opened = true; });
-    await zip.pipeEntry(entry, out);
-    return { size: entry.uncompressedSize };
-  } catch (error) {
-    if (opened) rmSync(destination, { force: true });
-    if (error instanceof CliInstallError) throw error;
-    if (DISK_CODES.has(errorCode(error))) throw asInstallError(error, 'disk', `The program could not be written (${errorCode(error)}).`);
-    throw unpack(`The archive's ${member} could not be read (${error?.message || error}).`);
-  } finally {
-    try { await zip.close(); } catch { /* closed */ }
-  }
-}
-
 // ── Output ──────────────────────────────────────────────────────────────────
 
 const ANSI = /\x1b\[[0-9;?]*[ -\/]*[@-~]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\x1b[()][A-Za-z0-9]|\x1b[=>78DEHMNOZc]/g;
@@ -630,52 +560,6 @@ export function createCliInstaller({
     });
   }
 
-  async function installArchive(job, plan, workDir, { step, line, progress }) {
-    step('download');
-    const releases = await fetchGithubJson(`https://api.github.com/repos/${plan.repo}/releases?per_page=20`, { fetchImpl, signal: job.abort.signal });
-    const picked = pickOpencodeRelease(releases, { assets: plan.assets, repo: plan.repo, tag: plan.tag });
-    if (!picked) throw new CliInstallError('http', `No OpenCode 1 release of ${plan.repo} carries ${plan.assets.join(' or ')}.`);
-    job.source = picked.asset.url;
-    line(`OpenCode ${picked.version}: ${picked.asset.name}`);
-    const archive = path.join(workDir, picked.asset.name);
-    const got = await downloadFile({
-      url: picked.asset.url,
-      allow: (url) => GITHUB_DOWNLOAD_HOSTS.includes(url.hostname),
-      destination: archive,
-      maxBytes: MAX_ARCHIVE_BYTES,
-      expectedSize: picked.asset.size,
-      sha256: picked.asset.sha256,
-      fetchImpl,
-      signal: job.abort.signal,
-      onProgress: progress,
-      stallMs,
-    });
-    step('verify');
-    line(picked.asset.sha256 ? `SHA-256 matches the published one (${got.sha256.slice(0, 12)}…).` : 'GitHub publishes no SHA-256 for this file; its size matches.');
-    step('extract');
-    try { mkdirSync(plan.dir, { recursive: true }); } catch (error) { throw asInstallError(error, 'disk', `${plan.dir} could not be created (${errorCode(error)}).`); }
-    const part = path.join(plan.dir, `.${plan.member}.${randomBytes(4).toString('hex')}.part`);
-    await extractZipMember({ archive, member: plan.member, destination: part });
-    step('place');
-    const head = Buffer.alloc(2);
-    const handle = await open(part, 'r');
-    try { await handle.read(head, 0, 2, 0); } finally { await handle.close(); }
-    if (head[0] !== 0x4d || head[1] !== 0x5a) {
-      rmSync(part, { force: true });
-      throw new CliInstallError('unpack', `The archive's ${plan.member} is not a Windows program.`);
-    }
-    const target = path.join(plan.dir, plan.member);
-    try {
-      renameSync(part, target);
-    } catch (error) {
-      rmSync(part, { force: true });
-      throw asInstallError(error, 'disk', `${target} could not be written (${errorCode(error)}: is an OpenCode still running from there?).`);
-    }
-    // Files SynaBun writes carry no Mark of the Web; a copy that does (a mirror, an antivirus) is cleared so it can start.
-    try { unlinkSync(`${target}:Zone.Identifier`); } catch { /* none */ }
-    line(`Placed ${target}`);
-  }
-
   async function run(job) {
     const { plan, tool } = job;
     const io = stepper(job);
@@ -685,13 +569,9 @@ export function createCliInstaller({
       emit(job, { type: 'start', tool, method: plan.kind, source: plan.source, label: plan.label, platform, arch });
       try { before = await readOsPath(); } catch { before = []; }
       workDir = await mkdtemp(path.join(tmpRoot, `synabun-cli-install-${tool}-`));
-      if (plan.kind === 'script') {
-        const script = await fetchScript(job, plan, workDir, io);
-        io.step('run');
-        await runScript(job, plan, script, workDir, before, io);
-      } else {
-        await installArchive(job, plan, workDir, io);
-      }
+      const script = await fetchScript(job, plan, workDir, io);
+      io.step('run');
+      await runScript(job, plan, script, workDir, before, io);
       io.step('check');
       const status = await resolver.resolve(tool, { force: true });
       if (status?.state !== 'installed') {

package/neural-interface/lib/cli-resolver.js

@@ -198,7 +198,10 @@ export function describeConfigured(value, toolKey, {
   return { value: raw, kind: 'command', name: text };
 }
 
-/** OpenCode's npm package: its command file runs node_modules\opencode-ai\bin\opencode.exe, the platform build its postinstall put there. */
+/**
+ * npm's opencode-ai (OpenCode 1): its command file runs node_modules\opencode-ai\bin\opencode.exe, the platform build
+ * its postinstall put there. Still found, so that SynaBun can say which version it is when it refuses it.
+ */
 export function windowsOpencodeTargets(launcher, arch = process.arch) {
   const pathImpl = path.win32;
   const folder = pathImpl.dirname(String(launcher || ''));

package/neural-interface/lib/cli-update-planner.js

@@ -16,12 +16,15 @@
 // PATH, so the update silently does nothing and the badge never clears.
 // ═══════════════════════════════════════════
 
-/** npm package name per tool key. */
+/**
+ * npm package name per tool key. OpenCode has none: npm's opencode-ai is
+ * OpenCode 1, which SynaBun does not drive, and OpenCode 2 is installed by its
+ * own script, Homebrew or WinGet (lib/opencode-protocol.js).
+ */
 export const NPM_PKGS = {
   'claude-code': '@anthropic-ai/claude-code',
   'codex': '@openai/codex',
   'gemini': '@google/gemini-cli',
-  'opencode': 'opencode-ai',
 };
 
 /**
@@ -33,7 +36,8 @@ export const BREW_FALLBACK_TOKENS = {
   'claude-code': 'claude-code',
   'codex': 'codex',
   'gemini': 'gemini-cli',
-  'opencode': 'opencode',
+  // OpenCode 2's own tap (its `opencode` formula there is still OpenCode 1).
+  'opencode': 'anomalyco/tap/opencode-v2',
 };
 
 /**
@@ -59,19 +63,18 @@ const SELF_UPDATERS = {
 };
 
 /**
- * OpenCode's `upgrade --method` accepts exactly these values. Mapping our
- * detected source onto it lets OpenCode do its own install-aware work for
- * the channels we cannot drive directly.
+ * The `upgrade --method` of OpenCode 2 for a detected source (its own installer
+ * script, a JavaScript package manager, WinGet). Mapping our detected source
+ * onto it lets OpenCode do its own install-aware work for the channels we
+ * cannot drive directly.
  */
 const OPENCODE_METHODS = {
   'standalone': 'curl',
   'npm': 'npm',
   'pnpm': 'pnpm',
   'bun': 'bun',
-  'brew-formula': 'brew',
-  'brew-cask': 'brew',
-  'choco': 'choco',
-  'scoop': 'scoop',
+  'yarn': 'yarn',
+  'winget': 'winget',
 };
 
 /** Sources that mean "a package manager other than the tool itself owns this". */
@@ -248,6 +251,15 @@ function planUpdateCommand(toolKey, installSource, { brewToken = null, platform
       : `brew upgrade ${token}`;
   }
 
+  // OpenCode 2 updates itself through the channel it came from (brew is handled above).
+  if (toolKey === 'opencode') {
+    // Its installer script is bash: a copy in %USERPROFILE%\.opencode\bin on Windows is no OpenCode 2 install.
+    if (installSource === 'standalone' && platform === 'win32') return null;
+    if (OPENCODE_METHODS[installSource]) return `opencode upgrade --method ${OPENCODE_METHODS[installSource]}`;
+    if (['volta', 'scoop', 'choco'].includes(installSource)) return null; // not an OpenCode 2 channel: the caller shows a hint
+    return selfUpdate;
+  }
+
   if (!npmPkg) return selfUpdate;
 
   switch (installSource) {
@@ -255,24 +267,15 @@ function planUpdateCommand(toolKey, installSource, { brewToken = null, platform
     case 'yarn':  return `yarn global add ${npmPkg}@latest`;
     case 'volta': return `volta install ${npmPkg}@latest`;
     case 'bun':
+      return `bun add -g ${npmPkg}@latest`;
     case 'pnpm':
-      // OpenCode drives these itself; the others take the plain global add.
-      if (toolKey === 'opencode') return `opencode upgrade --method ${OPENCODE_METHODS[installSource]}`;
-      return installSource === 'bun'
-        ? `bun add -g ${npmPkg}@latest`
-        : `pnpm add -g ${npmPkg}@latest`;
+      return `pnpm add -g ${npmPkg}@latest`;
     case 'scoop':
     case 'choco':
-      if (toolKey === 'opencode') return `opencode upgrade --method ${OPENCODE_METHODS[installSource]}`;
-      return null; // no safe automated path — caller shows a hint
     case 'winget':
-      return null;
+      return null; // no safe automated path — caller shows a hint
     case 'standalone':
       // The tool's own installer put it here, so its own updater is right.
-      // OpenCode's `curl` method runs its bash install script, which Windows
-      // does not have: a copy in %USERPROFILE%\.opencode\bin there came from
-      // the release archive (lib/cli-install.js) and has no updater to call.
-      if (toolKey === 'opencode') return platform === 'win32' ? null : 'opencode upgrade --method curl';
       return selfUpdate;
     case 'native':
       return selfUpdate;
@@ -373,10 +376,10 @@ export function installSourceLabel(source) {
 /**
  * The install command each vendor documents first for an operating system
  * (checked 2026-10-17): Anthropic's native installer (code.claude.com/docs/en/setup),
- * OpenAI's standalone installer (learn.chatgpt.com/docs/codex/cli), OpenCode's
- * install script (opencode.ai/docs; on Windows, where the script does not run,
- * npm, the first method its docs list that works in any terminal). These are
- * the same official sources the Install button runs (lib/cli-install.js).
+ * OpenAI's standalone installer (learn.chatgpt.com/docs/codex/cli), OpenCode 2's
+ * install script (https://opencode.ai/v2/install, the one `opencode upgrade`
+ * runs; on Windows, where the script does not run, WinGet). These are the same
+ * official sources the Install button runs (lib/cli-install.js).
  */
 export function vendorInstallCommand(toolKey, platform = process.platform) {
   const windows = platform === 'win32';
@@ -388,7 +391,7 @@ export function vendorInstallCommand(toolKey, platform = process.platform) {
         ? 'powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"'
         : 'curl -fsSL https://chatgpt.com/codex/install.sh | sh';
     case 'opencode':
-      return windows ? `npm install -g ${NPM_PKGS.opencode}` : 'curl -fsSL https://opencode.ai/install | bash';
+      return windows ? 'winget install --id Anomaly.OpenCode --exact' : 'curl -fsSL https://opencode.ai/v2/install | bash';
     default:
       return NPM_PKGS[toolKey] ? `npm install -g ${NPM_PKGS[toolKey]}` : '';
   }
@@ -420,6 +423,8 @@ export function buildInstallCommand(toolKey, installSource = 'unknown', { platfo
       ? `brew install --cask ${token}`
       : `brew install ${token}`;
   }
+  // OpenCode 2 has no npm package: its own installer whatever JavaScript package manager the machine uses.
+  if (toolKey === 'opencode') return vendorInstallCommand(toolKey, platform || process.platform);
   if (!npmPkg) return '';
   switch (installSource) {
     case 'bun':   return `bun add -g ${npmPkg}`;
@@ -438,10 +443,6 @@ function platformInstallCommand(toolKey, installSource, platform) {
     if (windows && installSource === 'winget') return 'winget install Anthropic.ClaudeCode';
     return vendor;
   }
-  if (toolKey === 'opencode' && windows) {
-    if (installSource === 'scoop') return 'scoop install opencode';
-    if (installSource === 'choco') return 'choco install opencode';
-  }
   // A JavaScript package manager this machine already uses: keep to it.
   if (['npm', 'bun', 'pnpm', 'yarn', 'volta'].includes(installSource)) return null;
   return vendor || null;

package/neural-interface/lib/cloudflared/tunnel.js

@@ -28,6 +28,15 @@
 //
 // An ended process is not forgotten: it is asked to end (SIGTERM), killed when
 // it is still there a moment later (SIGKILL), and kept until it has exited.
+//
+// Each cloudflared it starts is on record from its spawn until it has exited
+// (`records`: lib/opencode-serve-records.js, kind 'quick', in
+// DATA_HOME/runtime/tunnels), with a token of its start in its environment. A
+// server that ends without its exit handlers (a native crash) leaves its
+// cloudflared running on macOS and Linux (Windows ends a child with its parent),
+// the old address still pointing at the port the next server listens on: the
+// next server ends it by that record (server.js sweepLeftoverTunnels), and only
+// while the OS still reports that very process.
 
 import { spawn as nodeSpawn } from 'node:child_process';
 
@@ -69,6 +78,22 @@ export function tunnelArguments(port, source) {
   return ['tunnel', ...(source === 'system' ? [] : ['--no-autoupdate']), '--url', `http://localhost:${port}`];
 }
 
+/** The kind of the tunnel's records (lib/opencode-serve-records.js createServeRecords `kinds`). */
+export const TUNNEL_KINDS = Object.freeze(['quick']);
+
+/**
+ * Are `args` (a command line's arguments, as the platform reads them: lib/opencode-serve-records.js commandArgs) a
+ * quick tunnel to this server's `port` (`… tunnel … --url http://localhost:<port>`, as tunnelArguments makes them)?
+ * What a tunnel record must name.
+ */
+export function tunnelsToPort(args, port) {
+  const p = Number(port);
+  if (!Array.isArray(args) || !Number.isInteger(p) || p <= 0 || p > 65535) return false;
+  if (!args.includes('tunnel')) return false;
+  const url = `http://localhost:${p}`;
+  return args.some((arg, i) => arg === `--url=${url}` || (arg === '--url' && args[i + 1] === url));
+}
+
 /** What cloudflared said last that reads like a reason: its last error line, without the timestamp. */
 function lastReason(output) {
   const lines = output.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
@@ -85,8 +110,10 @@ function lastReason(output) {
  * @param {number} [o.urlTimeoutMs] how long a started cloudflared may take to print its address
  * @param {number} [o.killAfterMs] how long an ended cloudflared has to exit before it is killed
  * @param {(line: string) => void} [o.log]
+ * @param {{ newToken: () => string, tokenEnv: string, record: (entry: object) => Promise<object|null>, remove: (entry: object) => boolean }} [o.records]
+ *   where each cloudflared it starts is kept on record until it has exited (lib/opencode-serve-records.js, kind 'quick')
  */
-export function createQuickTunnel({ cloudflared, port, onUrl = () => {}, spawn = nodeSpawn, urlTimeoutMs = 90_000, killAfterMs = 1000, log = () => {} }) {
+export function createQuickTunnel({ cloudflared, port, onUrl = () => {}, spawn = nodeSpawn, urlTimeoutMs = 90_000, killAfterMs = 1000, log = () => {}, records = null }) {
   let phase = 'idle';   // idle | preparing | starting | running | failed
   let child = null;
   let url = null;
@@ -117,7 +144,19 @@ export function createQuickTunnel({ cloudflared, port, onUrl = () => {}, spawn =
     log(`  Tunnel:  ${code === 'ended' ? 'stopped' : 'not started'} (${code}): ${message}`);
   }
 
+  // On record from its spawn until it has exited: what the next server ends when this one crashed (see above).
+  function keepOnRecord(proc, token) {
+    const pid = Number(proc?.pid) || null;
+    if (!pid) return;
+    const kept = Promise.resolve().then(() => records.record({ kind: TUNNEL_KINDS[0], port: Number(port), pid, token })).catch(() => null);
+    proc.once('exit', () => { kept.then((entry) => { if (entry) records.remove(entry); }).catch(() => {}); });
+  }
+
   function launch(found, mine) {
+    // The token of this start, in its environment: made before the check below, so nothing runs between them.
+    let token = null;
+    try { token = records?.tokenEnv ? records.newToken() : null; } catch { token = null; }
+    const options = { stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true, ...(token ? { env: { ...process.env, [records.tokenEnv]: token } } : {}) };
     // Checked once more as it is about to run (the manager's confirm: the very file its check read, still where
     // nobody else can change it), and started at once by the real path that was checked: nothing runs in between.
     let path = found.path;
@@ -128,10 +167,11 @@ export function createQuickTunnel({ cloudflared, port, onUrl = () => {}, spawn =
     }
     let proc;
     try {
-      proc = spawn(path, tunnelArguments(port, found.source), { stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
+      proc = spawn(path, tunnelArguments(port, found.source), options);
     } catch (failure) {
       return fail('launch', `cloudflared could not be started (${failure?.code || failure?.message || failure}).`);
     }
+    if (token) keepOnRecord(proc, token);
     child = proc;
     copy = { source: found.source, version: found.version };
     phase = 'starting';

package/neural-interface/lib/codex-mcp-approvals.js

@@ -1,5 +1,16 @@
+import { codexMcpToolApproval } from '../public/shared/cdx/cdx-protocol.js';
+
 const CODEX_MCP_APPROVAL_MODES = new Set(['auto', 'prompt', 'writes', 'approve']);
 
+/** Auto is this session's choice; Claude's allow list is not a Codex approval prerequisite. */
+export function shouldAutoAcceptCodexMcpToolApproval(params, { autoAccept = false, role = null } = {}) {
+  const approval = codexMcpToolApproval(params);
+  if (!approval) return false;
+  // agent_route owns the model-choice card. Calling it must not require an
+  // additional permission card, even when ordinary tools are set to Ask.
+  return autoAccept || (role === 'assistant' && approval.fullName === 'mcp__SynaBun__agent_route');
+}
+
 export function codexConfigKeyPathSegment(value) {
   const text = String(value || '').trim();
   if (!text) throw new Error('Codex config key path segments cannot be empty');