synabun 2.1.0 → 2.2.0

package/neural-interface/lib/browser-network-guard.js

@@ -6,6 +6,16 @@
 // Auto-attach pauses new pages, OOPIFs and workers so
 // their FIRST request is guarded too. Closing this client releases its sessions;
 // it never closes a user's target or browser.
+//
+// Faults are per target first. A target is protected once its Fetch rules are in
+// place; releasing it (Runtime.runIfWaitingForDebugger) is not part of that, and its
+// reply comes from the target itself once it actually runs: Chromium holds a new
+// service worker until EVERY auto-attached CDP client has released it, and does not
+// answer a stopped worker's Runtime commands until it runs again. A slow or silent
+// reply is therefore never a fault. A paused service/shared worker whose rules cannot
+// be installed stays paused and is retried; pages, frames, dedicated workers and
+// targets already running still fail closed for the whole context, and a faulted
+// context re-arms with a fresh attachment (recoverBrowserNetworkGuard).
 import { connectGuardCdp } from './browser-guard-cdp.js';
 const guards = new WeakMap();
 const endpoints = new WeakMap();
@@ -15,35 +25,68 @@ const AUTO = { autoAttach: true, waitForDebuggerOnStart: true, flatten: true, fi
 const gone = error => /closed|detached|No session|No target|Target.*not found|Session with given id not found/i.test(error?.message || '');
 const expiredRequest = error => /^Fetch\.(?:continueRequest|failRequest)$/.test(error?.method || '')
   && /Invalid InterceptionId|Invalid interception id/i.test(error.message);
+// Workers whose own requests only their own Fetch rules intercept. Dedicated workers
+// are intercepted by their owning page or frame instead.
+const OWN_FETCH_WORKERS = new Set(['service_worker', 'shared_worker']);
+const TIMING = {
+  quarantineRetryMs: [1000, 5000, 15000, 60000], // the last delay repeats while the worker exists
+  rearmBackoffMs: [2000, 5000, 15000, 30000, 60000], // after a failed re-arm; the last repeats
+  recoverTimeoutMs: 10000, // the longest a caller waits for one re-arm
+};
 export const NETWORK_GUARD_FAULT_EVENT = 'synabun-network-guard-fault';
+export const NETWORK_GUARD_RECOVERED_EVENT = 'synabun-network-guard-recovered';
 
 /** Register only externally owned Chromium contexts with an existing endpoint. */
-export function registerBrowserNetworkEndpoint(context, endpoint, { connect = connectGuardCdp } = {}) {
-  endpoints.set(context, { endpoint, connect });
+export function registerBrowserNetworkEndpoint(context, endpoint, { connect = connectGuardCdp, timing } = {}) {
+  endpoints.set(context, { endpoint, connect, timing: { ...TIMING, ...timing } });
 }
 
 export function usesNativeBrowserNetworkGuard(context) { return endpoints.has(context); }
 
-class ContextGuard {
-  get fault() { return this._fault; }
-  set fault(error) {
-    if (this.disposed) return;
-    this._fault = error;
-    if (error) {
-      this.context.__browserNetworkGuardError = error.message;
-      this.context.emit?.(NETWORK_GUARD_FAULT_EVENT, error.message);
-    }
-  }
-  constructor(context) {
-    this.context = context;
-    this.rules = new Map();
+/** One flattened CDP connection and every session it holds. Re-arming replaces it whole. */
+class GuardLink {
+  constructor(guard) {
+    this.guard = guard;
     this.children = new Map();
     this.installing = new Set();
+    this.timers = new Set();
     this.fault = null;
-    this.queue = Promise.resolve();
+    this.closed = false;
   }
-  patterns() {
-    return [...new Set([...this.rules.values()].flatMap(rule => rule.patterns))].map(urlPattern => ({ urlPattern, requestStage: 'Request' }));
+  /** A fault of this link. It is the context's fault only while this link is the current one. */
+  failed(error) {
+    if (this.closed) return;
+    this.fault ||= error;
+    if (this.guard.link === this) this.guard.fault = error;
+  }
+  later(delay, work) {
+    if (this.closed) return;
+    const timer = setTimeout(() => { this.timers.delete(timer); if (!this.closed) work(); }, delay);
+    timer.unref?.();
+    this.timers.add(timer);
+  }
+  async open() {
+    const { endpoint, connect } = endpoints.get(this.guard.context);
+    this.connecting = connect(endpoint);
+    this.root = await this.connecting;
+    if (this.closed) { await this.root.detach(); throw new Error('Network guard disposed during setup'); }
+    this.root.on('event', event => this.dispatch(event.sessionId ? this.children.get(event.sessionId) : this.root, event.method, event.params));
+    this.root.on('close', () => {
+      if (this.closed) return;
+      this.failed(new Error('Network guard CDP disconnected; reconnect the browser session'));
+      // Cancel pending automation and refuse subsequent actions until a fresh
+      // protected attachment exists. Never reinstate context.route on MoreLogin:
+      // it would mutate unrelated native traffic and cache even during teardown.
+      console.error('[browser-network-guard] CDP disconnected; browser automation refused until the guard re-arms');
+    });
+    // A page-target attachment can arrive after a popup's initial navigation
+    // has started (another CDP client may resume it). The browser Fetch domain
+    // closes that gap for selective Document requests only. Attribute each to
+    // this profile before deciding; never apply rules to a foreign context.
+    await this.configure(this.root);
+    await this.root.send('Target.setAutoAttach', AUTO);
+    while (this.installing.size) await Promise.all([...this.installing]);
+    if (this.fault) throw this.fault;
   }
   async configure(child) {
     // Dedicated workers have no Fetch domain in Chromium. Their requests are
@@ -51,68 +94,89 @@ class ContextGuard {
     // Playwright's CRNetworkManager workerFrame path. Never resume a worker
     // until that parent's current selective guard is installed.
     if (child.target?.type === 'worker') {
-      if (!child.parent?.guarded || !child.parent.configuration) {
+      if (!child.parent?.guarded || child.parent.quarantined || !child.parent.configuration) {
         throw new Error(`Network guard worker ${child.target.targetId} has no protected network parent`);
       }
       await child.parent.configuration;
       return;
     }
-    const patterns = this.patterns().map(pattern => child === this.root ? { ...pattern, resourceType: 'Document' } : pattern);
+    const patterns = this.guard.patterns().map(pattern => child === this.root ? { ...pattern, resourceType: 'Document' } : pattern);
     await child.send(patterns.length ? 'Fetch.enable' : 'Fetch.disable', patterns.length ? { patterns } : {});
   }
+  /** Rules in place for the target and for what it starts next. */
+  async protect(child) {
+    await (child.configuration = this.configure(child));
+    if (this.closed) return;
+    await child.send('Target.setAutoAttach', AUTO);
+    child.protected = true;
+  }
+  /** Release a target this client holds paused. Never awaited and never a fault: the
+   * reply comes from the target once it actually runs, which another CDP client of the
+   * profile, or a stopped service worker, can delay indefinitely. The target's rules are
+   * already in place, so its requests are guarded whenever it runs. */
+  resume(child) {
+    child.send('Runtime.runIfWaitingForDebugger').catch(error => {
+      if (this.closed || gone(error)) return;
+      console.warn(`[browser-network-guard] ${error.message}; the target keeps its rules and runs when Chromium releases it`);
+    });
+  }
+  /** Whether a failed command's target is gone, which is no fault. A reply can be lost
+   * while its target is destroyed, so a timeout asks the browser before deciding. */
+  async vanished(child, error) {
+    if (this.closed || gone(error) || this.children.get(child.id) !== child) return true;
+    try {
+      const { targetInfo } = await this.root.send('Target.getTargetInfo', { targetId: child.target.targetId });
+      return !targetInfo;
+    } catch (probe) {
+      return /No target with given id/i.test(probe.protocolMessage || probe.message);
+    }
+  }
+  /** A paused service/shared worker whose rules could not be installed. Nothing else
+   * intercepts its requests, so it must not run unprotected: keep holding it paused
+   * (no other target is affected), retry, and release it once its rules are in place. */
+  quarantine(child, error, attempt = 0) {
+    child.quarantined = error;
+    const delays = this.guard.timing.quarantineRetryMs;
+    const delay = delays[Math.min(attempt, delays.length - 1)];
+    if (!attempt) console.error(`[browser-network-guard] ${error.message}; this worker stays paused, retrying its protection`);
+    this.later(delay, async () => {
+      if (this.children.get(child.id) !== child) return;
+      try {
+        await this.protect(child);
+      } catch (retryError) {
+        if (await this.vanished(child, retryError)) return;
+        this.quarantine(child, retryError, attempt + 1);
+        return;
+      }
+      if (this.closed) return;
+      child.quarantined = null;
+      console.warn(`[browser-network-guard] worker ${child.target.targetId} protected after ${attempt + 1} retr${attempt ? 'ies' : 'y'}; releasing it`);
+      this.resume(child);
+    });
+  }
   async ownsDocument(frameId) {
     try {
       const { targetInfo } = await this.root.send('Target.getTargetInfo', { targetId: frameId });
-      return targetInfo.browserContextId === this.contextId;
+      return targetInfo.browserContextId === this.guard.contextId;
     } catch (error) {
       // Same-process subframes have frame IDs, but no separate Target. Find
       // their owning protected page; unrelated incognito frames stay native.
       if (!/No target with given id found/i.test(error.message)) throw error;
       const contains = tree => tree.frame.id === frameId || tree.childFrames?.some(contains);
+      let uncertain = false;
       for (const child of this.children.values()) {
         if (!child.guarded || !['page', 'iframe'].includes(child.target.type)) continue;
         try {
           if (contains((await child.send('Page.getFrameTree')).frameTree)) return true;
-        } catch (error) { if (!gone(error)) throw error; }
+        } catch (treeError) { if (!gone(treeError)) uncertain = true; }
       }
-      return false;
+      // A protected page that cannot list its frames may hold this one. Decide it as
+      // the profile's (the stricter answer) instead of faulting every tab.
+      return uncertain;
     }
   }
-  async start() {
-    this.onContextClose = () => { void this.dispose(); };
-    this.onBrowserDisconnect = () => { void this.dispose(); };
-    this.context.once('close', this.onContextClose);
-    this.context.browser().once('disconnected', this.onBrowserDisconnect);
-    const page = this.context.pages().find(page => !page.isClosed());
-    if (!page) throw new Error('Network guard requires the attachment tab');
-    const probe = await this.context.newCDPSession(page);
-    try { this.contextId = (await probe.send('Target.getTargetInfo')).targetInfo.browserContextId; }
-    finally { await probe.detach(); }
-    if (this.disposed) throw new Error('Network guard disposed during setup');
-    const { endpoint, connect } = endpoints.get(this.context);
-    this.connecting = connect(endpoint);
-    this.root = await this.connecting;
-    if (this.disposed) { await this.root.detach(); throw new Error('Network guard disposed during setup'); }
-    this.root.on('event', event => this.dispatch(event.sessionId ? this.children.get(event.sessionId) : this.root, event.method, event.params));
-    this.root.on('close', () => {
-      if (this.disposed) return;
-      this.fault = new Error('Network guard CDP disconnected; reconnect the browser session');
-      // Cancel pending automation and refuse subsequent actions until a fresh
-      // protected attachment exists. Never reinstate context.route on MoreLogin:
-      // it would mutate unrelated native traffic and cache even during teardown.
-      console.error('[browser-network-guard] CDP disconnected; browser automation disabled until reconnection');
-    });
-    // A page-target attachment can arrive after a popup's initial navigation
-    // has started (another CDP client may resume it). The browser Fetch domain
-    // closes that gap for selective Document requests only. Attribute each to
-    // this profile before deciding; never apply rules to a foreign context.
-    await this.configure(this.root);
-    await this.root.send('Target.setAutoAttach', AUTO);
-    while (this.installing.size) await Promise.all([...this.installing]);
-    if (this.fault) throw this.fault;
-  }
   dispatch(parent, method, event) {
-    if (this.disposed) return;
+    if (this.closed) return;
     if (method === 'Target.attachedToTarget') {
       const child = {
         id: event.sessionId, parent, target: event.targetInfo,
@@ -130,9 +194,9 @@ class ContextGuard {
       this.children.set(event.sessionId, child);
       const installing = this.attach(child, event).catch(error => {
         if (!gone(error)) {
-          this.fault = error;
+          this.failed(error);
           // Do not resume an unguarded new target. Existing user tabs are never
-          // closed. Future tool operations fail until a clean reconnect.
+          // closed. Tool operations fail until the guard re-arms.
           console.error('[browser-network-guard] target protection failed:', error.message);
         }
       }).finally(() => this.installing.delete(installing));
@@ -143,35 +207,51 @@ class ContextGuard {
     } else if (method === 'Fetch.requestPaused') {
       if (!parent) return; // event queued before this target's detach arrived
       void this.request(parent, event).catch(error => {
-        if (!gone(error)) { this.fault = error; console.error('[browser-network-guard] request refused after guard failure:', error.message); }
+        if (!gone(error)) { this.failed(error); console.error('[browser-network-guard] request refused after guard failure:', error.message); }
       });
+    } else if (method === 'Inspector.targetReloadedAfterCrash') {
+      // A stopped service worker that runs again keeps this session and its rules.
+      // Release it as Playwright does, so this client never holds it.
+      if (parent?.protected && !parent.quarantined) this.resume(parent);
     }
   }
   async attach(child, event) {
-    if (this.disposed) return;
+    if (this.closed) return;
+    const waiting = !!event.waitingForDebugger;
     const inherited = !event.targetInfo.browserContextId && child.parent?.guarded;
-    if (event.targetInfo.browserContextId !== this.contextId && !inherited) {
-      // A browser-level CDP connection also sees other incognito contexts.
-      if (event.waitingForDebugger) await child.send('Runtime.runIfWaitingForDebugger');
-      await child.parent.send('Target.detachFromTarget', { sessionId: child.id });
+    if (event.targetInfo.browserContextId !== this.guard.contextId && !inherited) {
+      // A browser-level CDP connection also sees other incognito contexts. Our
+      // session there intercepts nothing: releasing it is never this profile's fault.
+      if (waiting) this.resume(child);
+      await child.parent.send('Target.detachFromTarget', { sessionId: child.id }).catch(error => {
+        if (!gone(error)) console.warn('[browser-network-guard] could not release a foreign target:', error.message);
+      });
       return;
     }
     child.guarded = true;
-    await (child.configuration = this.configure(child));
-    if (this.disposed) return;
-    await child.send('Target.setAutoAttach', AUTO);
-    await child.send('Runtime.runIfWaitingForDebugger');
+    try {
+      await this.protect(child);
+    } catch (error) {
+      if (await this.vanished(child, error)) return;
+      if (waiting && OWN_FETCH_WORKERS.has(child.target.type)) { this.quarantine(child, error); return; }
+      // Pages, frames, dedicated workers and anything already running fail closed.
+      throw error;
+    }
+    if (this.closed) return;
+    // Only a target that waits for us is released; a running or stopped one is not.
+    if (waiting) this.resume(child);
   }
   async request(child, event) {
     const { requestId, request } = event;
     try {
-      if (this.fault) throw this.fault;
+      const fault = this.fault || this.guard.fault;
+      if (fault) throw fault;
       if (child === this.root && !await this.ownsDocument(event.frameId)) {
         await child.send('Fetch.continueRequest', { requestId });
         return;
       }
       let headers;
-      for (const rule of this.rules.values()) {
+      for (const rule of this.guard.rules.values()) {
         const decision = rule.decide(request);
         if (decision?.abort) {
           await child.send('Fetch.failRequest', { requestId, errorReason: 'BlockedByClient' });
@@ -195,36 +275,148 @@ class ContextGuard {
       throw error;
     }
   }
+  /** Current rules onto every protected target of this link. */
+  async reconfigure() {
+    await this.configure(this.root);
+    // A quarantined worker takes the current rules on its next retry.
+    await Promise.all([...this.children.values()].filter(child => child.guarded && !child.quarantined).map(async child => {
+      try { await (child.configuration = this.configure(child)); }
+      catch (error) { if (!await this.vanished(child, error)) throw error; }
+    }));
+  }
+  close() {
+    if (this.closing) return this.closing;
+    this.closed = true;
+    for (const timer of this.timers) clearTimeout(timer);
+    this.timers.clear();
+    // Detaching our browser CDP session also detaches its child sessions and
+    // releases paused targets. No Target.closeTarget or Browser.close.
+    this.closing = (async () => {
+      // Closing may race a handshake. Await and detach that late connection
+      // as well; returning early would briefly leave a new client attached.
+      if (!this.root && this.connecting) this.root = await this.connecting.catch(() => null);
+      await this.root?.detach().catch(() => {});
+      for (const child of this.children.values()) child.close();
+      this.children.clear();
+    })();
+    return this.closing;
+  }
+}
+
+class ContextGuard {
+  get fault() { return this._fault; }
+  set fault(error) {
+    if (this.disposed) return;
+    this._fault = error;
+    if (error) {
+      this.context.__browserNetworkGuardError = error.message;
+      this.context.emit?.(NETWORK_GUARD_FAULT_EVENT, error.message);
+    }
+  }
+  constructor(context) {
+    this.context = context;
+    this.timing = endpoints.get(context)?.timing || TIMING;
+    this.rules = new Map();
+    this.fault = null;
+    this.queue = Promise.resolve();
+    this.rearmFailures = 0;
+    this.rearmAt = 0;
+  }
+  patterns() {
+    return [...new Set([...this.rules.values()].flatMap(rule => rule.patterns))].map(urlPattern => ({ urlPattern, requestStage: 'Request' }));
+  }
+  async start() {
+    this.onContextClose = () => { void this.dispose(); };
+    this.onBrowserDisconnect = () => { void this.dispose(); };
+    this.context.once('close', this.onContextClose);
+    this.context.browser().once('disconnected', this.onBrowserDisconnect);
+    const page = this.context.pages().find(page => !page.isClosed());
+    if (!page) throw new Error('Network guard requires the attachment tab');
+    const probe = await this.context.newCDPSession(page);
+    try { this.contextId = (await probe.send('Target.getTargetInfo')).targetInfo.browserContextId; }
+    finally { await probe.detach(); }
+    if (this.disposed) throw new Error('Network guard disposed during setup');
+    this.link = new GuardLink(this);
+    await this.link.open();
+  }
   async update(key, rule) {
     if (this.disposed) throw new Error('Network guard disposed');
     if (this.fault) throw this.fault;
     if (rule) this.rules.set(key, rule); else this.rules.delete(key);
     if (!this.ready) this.ready = this.start().catch(async error => { await this.dispose(); throw error; });
     await this.ready;
-    await this.configure(this.root);
-    await Promise.all([...this.children.values()].filter(child => child.guarded).map(child =>
-      (child.configuration = this.configure(child)).catch(error => { if (!gone(error)) throw error; })));
+    await this.link.reconfigure();
+  }
+  /** Re-arm a faulted guard; resolves true once the context is protected again. One
+   * attempt at a time, in order with rule updates, and none during the backoff that
+   * follows a failed one. */
+  rearm() {
+    if (this.disposed || !this.link) return Promise.resolve(false);
+    if (!this.fault) return Promise.resolve(true);
+    if (this.rearming) return this.rearming;
+    if (Date.now() < this.rearmAt) return Promise.resolve(false);
+    const attempt = this.queue.then(() => this.replaceLink());
+    this.queue = attempt.catch(() => {});
+    this.rearming = attempt.catch(() => false).finally(() => { this.rearming = null; });
+    return this.rearming;
+  }
+  async replaceLink() {
+    if (this.disposed) return false;
+    if (!this.fault) return true;
+    // The faulted link stays attached (failing its own paused requests closed) until
+    // the fresh one has every current target protected, so no target is ever left
+    // without an attachment holding its rules.
+    const fresh = this.pendingLink = new GuardLink(this);
+    try {
+      await fresh.open();
+    } catch (error) {
+      await fresh.close();
+      const delays = this.timing.rearmBackoffMs;
+      this.rearmAt = Date.now() + delays[Math.min(this.rearmFailures++, delays.length - 1)];
+      console.error('[browser-network-guard] re-arm failed; actions stay refused:', error.message);
+      return false;
+    } finally { this.pendingLink = null; }
+    if (this.disposed) { await fresh.close(); return false; }
+    const old = this.link;
+    this.link = fresh;
+    this.rearmFailures = 0;
+    this.rearmAt = 0;
+    this._fault = null;
+    delete this.context.__browserNetworkGuardError;
+    this.context.emit?.(NETWORK_GUARD_RECOVERED_EVENT);
+    console.warn('[browser-network-guard] re-armed with a fresh protected attachment');
+    await old.close();
+    return true;
   }
   dispose() {
     if (this.disposal) return this.disposal;
     this.disposed = true;
     if (this.onContextClose) this.context.removeListener('close', this.onContextClose);
     if (this.onBrowserDisconnect) this.context.browser().removeListener('disconnected', this.onBrowserDisconnect);
-    // Detaching our browser CDP session also detaches its child sessions and
-    // releases paused targets. No Target.closeTarget or Browser.close.
     this.disposal = (async () => {
-      // Disposal may race a handshake. Await and detach that late connection
-      // as well; returning early would briefly leave a new client attached.
-      if (!this.root && this.connecting) this.root = await this.connecting.catch(() => null);
-      await this.root?.detach().catch(() => {});
-      for (const child of this.children.values()) child.close();
-      this.children.clear();
+      await Promise.all([this.link?.close(), this.pendingLink?.close()]);
       if (guards.get(this.context) === this) guards.delete(this.context);
     })();
     return this.disposal;
   }
 }
 
+/** Re-arm a faulted native guard: a fresh protected attachment replaces the broken one,
+ * so the context needs no server restart. Resolves true when the context is protected
+ * (again), false while its actions stay refused. Never rejects. */
+export async function recoverBrowserNetworkGuard(context, { timeoutMs } = {}) {
+  const guard = guards.get(context);
+  if (!guard) return !context?.__browserNetworkGuardError;
+  let timer;
+  try {
+    return await Promise.race([
+      guard.rearm(),
+      new Promise(resolve => { timer = setTimeout(() => resolve(false), timeoutMs ?? guard.timing.recoverTimeoutMs); timer.unref?.(); }),
+    ]);
+  } catch { return false; }
+  finally { clearTimeout(timer); }
+}
+
 /** Explicitly release only this context's safety transport, including failed setup. */
 export async function disposeBrowserNetworkGuard(context) {
   await guards.get(context)?.dispose();

package/neural-interface/lib/browser-tool-policy.js

@@ -2,7 +2,7 @@
 // SynaBun — Browser tool policy: every page through the SynaBun browser
 // ═══════════════════════════════════════════
 //
-// The Assistant's brain (Claude, Codex, OpenCode) and the workers it
+// The Assistant's brain (Claude, Codex, OpenCode, Antigravity) and the workers it
 // dispatches look at pages — public or localhost — only through SynaBun's
 // browser tools (browser_*), which open the browser configured in SynaBun
 // (MoreLogin). They never start a browser of their own, and when the SynaBun
@@ -48,13 +48,14 @@ const MAX_DEPTH = 4;
 
 // ── the rule text ───────────────────────────────────────────────────────────
 
-const HOSTS = { claude: 'claude', 'claude-code': 'claude', codex: 'codex', opencode: 'opencode' };
+const HOSTS = { claude: 'claude', 'claude-code': 'claude', codex: 'codex', opencode: 'opencode', antigravity: 'antigravity' };
 const hostKey = (host) => HOSTS[String(host || '').toLowerCase()] || null;
 // Each host's own web search / fetch (the rule names the host's; unknown: all of them).
 const WEB_TOOL_WORDS = {
   claude: 'WebSearch / WebFetch',
   codex: 'Codex\'s web_search',
   opencode: 'webfetch / websearch',
+  antigravity: 'Antigravity\'s own web search, URL reading or browser',
 };
 
 /**
@@ -78,7 +79,7 @@ const TEST_RUN_RULE = 'Automated tests run through their test runner (npm test,
 /**
  * The browser rule, as bullet lines: the brain's persona (its host's tool
  * names in `tools`), the worker prompts of browser runs. `host`: claude /
- * codex / opencode (names that host's own web tools), else all of them.
+ * codex / opencode / antigravity (names that host's own web tools), else all of them.
  */
 export function browserPolicyText({ tools = '', host = null } = {}) {
   const t = browserToolNames(tools);
@@ -114,9 +115,11 @@ const OPENCODE_BROWSER_TOOL = new RegExp(`^([a-z0-9-]*?(?:${BROWSER_SERVER_WORD}
 const PAGE_TOOL = /^(?:browser_.+|navigate(?:_(?:page|to|to_url|url|back|forward))?|go_?to(?:_(?:url|page))?|go_(?:back|forward)|open_(?:url|page|link|website|webpage|browser|in_browser)|new_page|launch_browser|(?:take|capture)_(?:page_|full_page_|web_?page_|website_)?screenshot|(?:page|full_page|web_?page|website)_screenshot|screenshot(?:_(?:page|url|website|webpage))?)$/;
 const snakeName = (text) => String(text || '').replace(/([a-z0-9])([A-Z])/g, '$1_$2').replace(/[-.\s]+/g, '_').toLowerCase();
 // Web search / fetch outside the SynaBun browser: Claude's, OpenCode's, Codex's.
-const WEB_TOOLS = new Set(['websearch', 'webfetch', 'web_search', 'web_fetch', 'web_search_preview']);
+const WEB_TOOLS = new Set(['websearch', 'webfetch', 'web_search', 'web_fetch', 'web_search_preview', 'search_web', 'read_url_content', 'execute_url']);
+// Antigravity's own browser and browser subagent (its tools' own names, lib/antigravity/tool-call.js).
+const ANTIGRAVITY_BROWSER_TOOLS = new Set(['open_browser_url', 'read_browser_page', 'browser_subagent', 'list_browser_pages', 'capture_browser_screenshot', 'capture_browser_console_logs', 'execute_browser_javascript', 'click_browser_pixel']);
 // Shell tools: Claude's Bash / PowerShell, Codex's shell family, OpenCode's bash.
-const SHELL_TOOLS = new Set(['bash', 'powershell', 'shell', 'shell_command', 'exec_command', 'local_shell', 'container.exec', 'unified_exec']);
+const SHELL_TOOLS = new Set(['bash', 'powershell', 'shell', 'shell_command', 'exec_command', 'local_shell', 'container.exec', 'unified_exec', 'run_command']);
 
 /**
  * What another MCP server's tool does to a browser (for the refusal), else null:
@@ -983,8 +986,8 @@ function argvDenial(argv, ctx) {
 }
 
 // Where each host puts a shell tool's command and its working directory.
-const COMMAND_KEYS = ['command', 'cmd', 'commands', 'script'];
-const WORKDIR_KEYS = ['workdir', 'cwd', 'working_directory', 'workingDirectory', 'dir'];
+const COMMAND_KEYS = ['command', 'cmd', 'commands', 'script', 'CommandLine'];
+const WORKDIR_KEYS = ['workdir', 'cwd', 'working_directory', 'workingDirectory', 'dir', 'Cwd'];
 
 function shellDenial(input, ctx) {
   const args = input && typeof input === 'object' ? input : {};
@@ -1043,6 +1046,8 @@ export function browserToolDenial(tool, input = {}, { host = null, cwd = null, r
   if (WEB_TOOLS.has(lower)) return refusal(name, 'web search / fetch outside the SynaBun browser');
   // OpenCode's own browser tool drives a browser that is not SynaBun's.
   if (kind === 'opencode' && lower === 'browser') return refusal(name, 'OpenCode\'s own browser');
+  // Antigravity's own browser and browser subagent (its built-in tools carry no server: never SynaBun's browser_*).
+  if (kind === 'antigravity' && (ANTIGRAVITY_BROWSER_TOOLS.has(lower) || /^browser_/.test(lower))) return refusal(name, 'Antigravity\'s own browser');
   if (!SHELL_TOOLS.has(lower)) return null;
   const project = cwd ? resolve(String(cwd)) : process.cwd();
   const why = shellDenial(args, { roots: testRoots(project, roots), cwd: project, readFile: typeof readFile === 'function' ? readFile : defaultReadFile, depth: 0 });

package/neural-interface/lib/claude-agent-bridge.js

@@ -104,6 +104,7 @@ export const PANEL_CAPABILITIES = Object.freeze([
   'ask_annotations',  // AskUserQuestion answers keep their `annotations`
   'tool_policy',      // query `toolPolicy`: 'full' | 'read-only' | 'no-web'
   'elicitation',      // MCP elicitation as control_request subtype `elicitation` (for clients that declare the feature)
+  'effort_off', // query `effort: 'off'`: thinking disabled, over any effortLevel in the user's settings
   'session_settings', // query `session`: fallback model, limits, directories, plugins, strict MCP, instructions, sandbox, thinking, fast mode, output style, agent
   'reload_plugins',   // inbound `reload_plugins` → `reload_result` + fresh commands_list / mcp_status / plugins_list
   'message_flags',    // session.hookEvents / promptSuggestions / subagentText / agentSummaries → the matching SDK options
@@ -754,6 +755,9 @@ export class ClaudeSession {
       if (this.sessionId && this._resumeAt) { options.resumeSessionAt = this._resumeAt; this._resumeAt = null; }
     }
     if (this.model) options.model = this.model;
+    // Off is the user's pick, not the model's default: without it an
+    // effortLevel in the user's settings would still apply.
+    if (this.panel && this.effort === 'off') options.thinking = { type: 'disabled' };
     if (this.effort && CLAUDE_EFFORT_LEVELS.includes(this.effort)) {
       // Panel sessions use the typed option; every other caller keeps the flag it had.
       if (this.panel) options.effort = this.effort;
@@ -2966,6 +2970,7 @@ export class ClaudeSession {
     if (cwd) this.cwd = cwd;
     // A panel tab that sends no effort means "the model's default": a level that
     // was set goes back to it, live when a session exists.
+    const prevEffort = this.effort;
     const effortCleared = this.panel && !effort && !!this.effort;
     if (effort) this.effort = effort;
     else if (effortCleared) this.effort = null;
@@ -3006,7 +3011,9 @@ export class ClaudeSession {
 
     // Effort alone switches on the live CLI. A restart would cold-start the
     // session and kill any background agents it is running.
+    // (Off disables thinking, a start-up option: to or from it the session restarts.)
     if (this.q && effortChanged && !cwdChanged && !sessionChanged && !newChat
+      && prevEffort !== 'off' && effort !== 'off'
       && typeof this.q.applyFlagSettings === 'function') {
       const effortLevel = CLAUDE_EFFORT_LEVELS.includes(effort) ? effort : null;
       this.q.applyFlagSettings({ effortLevel }).catch(err => log('applyFlagSettings(effort) failed:', err.message));