synabun 2.1.0 → 2.2.0

package/neural-interface/lib/native-loop-runtime.js

@@ -3,7 +3,7 @@ import { storedToolList, toolListRecord, readStoredToolListRecord } from './tool
 import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 
-export const NATIVE_LOOP_PROFILES = new Set(['claude-code', 'codex', 'opencode']);
+export const NATIVE_LOOP_PROFILES = new Set(['claude-code', 'codex', 'opencode', 'antigravity']);
 
 export function isNativeLoopProfile(profile) {
   return NATIVE_LOOP_PROFILES.has(String(profile || ''));
@@ -22,6 +22,7 @@ function cleanDescriptor(record) {
     provider: record.provider,
     providerSessionId: record.providerSessionId || null,
     providerThreadId: record.providerThreadId || null,
+    ...(record.antigravityHome ? { antigravityHome: record.antigravityHome } : {}),
     source: record.source,
     focus: !!record.focus,
     status: record.status,
@@ -53,6 +54,7 @@ function cleanDescriptor(record) {
     // existing consumers (router, sidepanels, schedules) are unaffected.
     runMode: record.runMode || 'loop',
     turnState: record.turnState || null,
+    pending: record.status === 'running' ? (record.pendingRequests || []) : [],
     // What the last turn's result said (task mode: done, blocked or needs_input; the dispatcher's
     // lastResult.status): an idle warm worker whose turn ended asking waits on the user.
     outcome: record.outcome || null,
@@ -184,6 +186,14 @@ export class NativeLoopRuntime {
     return this._emit('sidepanel:run-updated', record, { reason: 'turn-state' });
   }
 
+  /** A live worker's requests, durable for a late attach or page reload. Resolvers stay in the dispatcher. */
+  setPendingRequests(runId, requests) {
+    const record = this.records.get(runId);
+    if (!record) return null;
+    record.pendingRequests = structuredClone(requests || []);
+    return this._emit('sidepanel:run-updated', record, { reason: 'pending-requests' });
+  }
+
   /**
    * Task-mode helper: records what the wrapper's last turn reported ('done' |
    * 'blocked' | 'needs_input', the dispatcher's lastResult.status) and
@@ -224,6 +234,7 @@ export class NativeLoopRuntime {
         record.suspendedAt = record.suspendedAt || iso(this.now());
         record.suspendReason = record.suspendReason || 'server_restart';
         record.turnState = 'suspended';
+        record.pendingRequests = [];
         record.stopping = false;
         this.records.set(record.runId, record);
         this._hold(record);
@@ -314,7 +325,8 @@ export class NativeLoopRuntime {
   }
 
   _writeState(runId, state) {
-    writeJsonAtomic(this._statePath(runId), toolListRecord(state, this.toolListOptions()));
+    const { permissionBroker: _broker, ...stored } = state;
+    writeJsonAtomic(this._statePath(runId), toolListRecord(stored, this.toolListOptions()));
   }
 
   _writeTerminalState(record, patch) {
@@ -344,6 +356,7 @@ export class NativeLoopRuntime {
   _setIdentity(record, identity = {}) {
     const providerSessionId = identity.providerSessionId || identity.sessionId || null;
     const providerThreadId = identity.providerThreadId || identity.threadId || null;
+    const antigravityHome = typeof identity.antigravityHome === "string" && identity.antigravityHome ? identity.antigravityHome : null;
     let changed = false;
     if (providerSessionId && providerSessionId !== record.providerSessionId) {
       record.providerSessionId = providerSessionId;
@@ -353,6 +366,10 @@ export class NativeLoopRuntime {
       record.providerThreadId = providerThreadId;
       changed = true;
     }
+    if (antigravityHome && antigravityHome !== record.antigravityHome) {
+      record.antigravityHome = antigravityHome;
+      changed = true;
+    }
     if (changed) this._emit('sidepanel:run-updated', record, { reason: 'identity' });
     if ((record.providerSessionId || record.providerThreadId) && record._resolveIdentity) {
       record._resolveIdentity(cleanDescriptor(record));
@@ -397,6 +414,7 @@ export class NativeLoopRuntime {
       provider: state.profile,
       providerSessionId: null,
       providerThreadId: null,
+      antigravityHome: typeof state.antigravityHome === "string" && state.antigravityHome ? state.antigravityHome : null,
       source,
       focus,
       status: 'starting',
@@ -544,6 +562,7 @@ export class NativeLoopRuntime {
               runId,
               emit: (event) => this._emitProviderEvent(record, event),
               setTurnState: (turnState) => this.setTurnState(runId, turnState),
+              setPendingRequests: (requests) => this.setPendingRequests(runId, requests),
               setOutcome: (outcome) => this.setOutcome(runId, outcome),
               readState: () => this._readState(runId),
             })
@@ -639,6 +658,7 @@ export class NativeLoopRuntime {
       browserTabId: state.browserTabId || null,
       suspendedAt: null,
       suspendReason: null,
+      ...(typeof state.antigravityHome === "string" && state.antigravityHome ? { antigravityHome: state.antigravityHome } : {}),
       resumes: (Number(record.resumes) || 0) + 1,
       resumedAt: iso(this.now()),
       buildPrompt,
@@ -830,6 +850,7 @@ export class NativeLoopRuntime {
     record.startupAbortController = null;
     record.buildPrompt = null;
     record.wrapAdapter = null;
+    record.pendingRequests = [];
     if (turnState === 'suspended') record.turnState = 'suspended';
     else if (record.turnState && record.turnState !== 'terminal') record.turnState = 'terminal';
   }

package/neural-interface/lib/opencode-native-boundary.js

@@ -2,14 +2,23 @@
 // listen time. This is a capability allowlist, not a generic OpenCode version
 // check: 2.1.4's HTTP/upgrade authentication and stdout password path were
 // inspected and tested. Unknown binaries/command wrappers keep the old guard.
+// 2.2.5 (Homebrew anomalyco/tap/opencode-v2) checked 2026-11-01 against throwaway
+// serves on 127.0.0.1: no password variable → it prints "server password <secret>"
+// on stdout; every /api route (session, config, event, pty, shell, file, mcp, and
+// the new tunnel and pairing) answers 401 without it, both plain and as a
+// WebSocket upgrade, and 200 with it; one listener, bound to 127.0.0.1 only.
+// Non-/api paths serve the static web UI (HTML), as before.
+export const NATIVE_SERVE_VERSIONS = Object.freeze(['2.1.4', '2.2.5']);
+
 export function nativeServeCapability({ version, commandLine = false, passwordFrom } = {}) {
-  return !commandLine && passwordFrom === 'stdout' && /^(?:opencode\s+)?v?2\.1\.4$/.test(String(version || '').trim());
+  const bare = String(version || '').trim().replace(/^opencode\s+/, '').replace(/^v/, '');
+  return !commandLine && passwordFrom === 'stdout' && NATIVE_SERVE_VERSIONS.includes(bare);
 }
 
 export function createNativeServeBoundary() {
   const processes = new Map();
   const contexts = new Map();
-  const error = () => new Error('Native browser WebSockets require authenticated OpenCode 2.1.4 serves with private stdout credentials; wait for startup, stop unverified serves or use the verified executable path.');
+  const error = () => new Error(`Native browser WebSockets require authenticated OpenCode ${NATIVE_SERVE_VERSIONS.join(' or ')} serves with private stdout credentials; wait for startup, stop unverified serves or use the verified executable path.`);
   return {
     assertLaunch(safe) { if (!safe && contexts.size) throw error(); },
     track(proc, { port, safe = false }) {

package/neural-interface/lib/owner-authority.js

@@ -74,7 +74,7 @@ export const AGENT_CALL_KINDS = Object.freeze(['agent', 'synabun-mcp']);
  */
 export const OWNER_READ_PREFIXES = Object.freeze([...ADMIN_ONLY_PREFIXES.filter((prefix) => prefix !== '/api/hook-'), '/api/git']);
 /** The owner's sockets: a terminal, the agent panels, the Assistant, the browser panel. */
-export const OWNER_SOCKET_PREFIXES = Object.freeze(['/ws/terminal/', '/ws/claude-skin', '/ws/codex-skin', '/ws/opencode-v2', '/ws/assistant/', '/ws/browser/']);
+export const OWNER_SOCKET_PREFIXES = Object.freeze(['/ws/terminal/', '/ws/claude-skin', '/ws/codex-skin', '/ws/opencode-v2', '/ws/antigravity', '/ws/assistant/', '/ws/browser/']);
 /** Sockets that stay open for the app's pages to draw, read-only for a peer the owner's powers are refused to. */
 export const READ_ONLY_SOCKET_PATHS = Object.freeze(['/ws/sync']);
 

package/neural-interface/lib/path-confine.js

@@ -19,13 +19,15 @@ export class PathConfineError extends Error {
 export const SESSION_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 export const isSessionId = (id) => typeof id === 'string' && SESSION_ID_RE.test(id);
 
-const fold = process.platform === 'win32' ? (s) => s.toLowerCase() : (s) => s;
+const foldForPlatform = (platform = process.platform) => (platform === 'win32' ? (s) => s.toLowerCase() : (s) => s);
+const fold = foldForPlatform();
 
 /** True when `target` is below `root` (or is `root` itself, with allowRoot). Lexical: both are resolved first. */
-export function isInside(root, target, { allowRoot = false } = {}) {
+export function isInside(root, target, { allowRoot = false, platform = process.platform } = {}) {
   if (!root || !target) return false;
-  const r = fold(resolve(String(root)));
-  const t = fold(resolve(String(target)));
+  const f = platform === process.platform ? fold : foldForPlatform(platform);
+  const r = f(resolve(String(root)));
+  const t = f(resolve(String(target)));
   if (t === r) return allowRoot;
   return t.startsWith(r.endsWith(sep) ? r : r + sep);
 }
@@ -83,28 +85,29 @@ export function isInsideReal(root, target, { allowRoot = false, fs = realFs } =
  * @param o.projectsDir <config dir>/projects of the account
  * @param o.pathToKey   (projectPath) => the folder name Claude Code uses for it
  */
-export function findSessionTranscript({ sessionId, project = '', projects = [], projectsDir, pathToKey, exists = existsSync, realpath = realpathSync } = {}) {
+export function findSessionTranscript({ sessionId, project = '', projects = [], projectsDir, pathToKey, exists = existsSync, realpath = realpathSync, platform = process.platform } = {}) {
   if (!isSessionId(sessionId)) throw new PathConfineError(400, 'Not a session id');
   if (!projectsDir || typeof pathToKey !== 'function') return null;
+  const foldPath = platform === process.platform ? fold : foldForPlatform(platform);
   const known = (Array.isArray(projects) ? projects : []).filter(p => p?.path);
-  const wanted = typeof project === 'string' && project ? resolve(project) : '';
+  const wanted = typeof project === 'string' && project ? foldPath(resolve(project)) : '';
   let order = known;
   if (wanted) {
-    const named = known.find(p => resolve(p.path) === wanted);
+    const named = known.find(p => foldPath(resolve(p.path)) === wanted);
     if (!named) throw new PathConfineError(400, 'Not a registered project');
     order = [named];
   }
   for (const proj of order) {
     const key = String(pathToKey(proj.path) || '');
     // Claude Code has written the drive letter in both cases on Windows.
-    const keys = [...new Set([key.replace(/^([A-Z])/, m => m.toLowerCase()), key])].filter(isPlainName);
+    const keys = [...new Set([key.replace(/^([A-Z])/, m => m.toLowerCase()), key.replace(/^([a-z])/, m => m.toUpperCase()), key])].filter(isPlainName);
     for (const k of keys) {
       const folder = join(projectsDir, k);
       const candidate = join(folder, `${sessionId}.jsonl`);
       if (!exists(candidate)) continue;
       let realFile; let realFolder;
       try { realFile = realpath(candidate); realFolder = realpath(folder); } catch { continue; }
-      if (!isInside(realFolder, realFile)) continue;
+      if (!isInside(realFolder, realFile, { platform })) continue;
       // `realPath` / `realFolder`: the canonical paths that were just checked.
       // The transcript is read from those (lib/confined-fs.js), not from the
       // name it was found under, which could be swapped for a link afterwards.

package/neural-interface/lib/peer-identity.js

@@ -244,7 +244,11 @@ export const RELAY_NAMES = Object.freeze([
 /** Proxy / tunnel apps found by their bundle (their helpers carry other names). */
 const RELAY_BUNDLE_RE = /\/(?:charles|proxyman|surge(?: mac)?|clashx[^/]*|clash verge|clash for windows|clash nyanpasu|flclash|shadowrocket|shadowsocksx[^/]*|v2rayu|v2rayx|qv2ray|v2rayn|stash|quantumult x|loon|proxifier|mitmproxy|ngrok|tailscale|cloudflare warp)\.app\//i;
 /** The agents whose process trees never hold the owner's authority (argv[0]'s name). */
-export const AGENT_NAMES = Object.freeze(['claude', 'codex', 'opencode', 'gemini', 'cursor-agent', 'aider', 'goose', 'qwen', 'crush']);
+// Antigravity's CLI runs as `antigravity` (the kernel's name for the binary Homebrew links as `agy`). Gemini CLI stays on
+// the list though SynaBun no longer drives it: an agent the user still runs never holds the owner's authority either.
+export const AGENT_NAMES = Object.freeze(['claude', 'codex', 'opencode', 'agy', 'antigravity', 'gemini', 'cursor-agent', 'aider', 'goose', 'qwen', 'crush']);
+/** The agent backend of the Antigravity app and IDE (a `language_server` inside their bundles: Codeium's name, so only by its place). */
+const ANTIGRAVITY_SERVER_RE = /\/antigravity(?: ide)?\.app\/contents\/resources\/(?:app\/extensions\/[^/]+\/)?bin\/language_server/i;
 /** Browsers the owner browses with (their bundle or their network process): never taken for a relay because they
  *  happen to hold a listening socket; an automation flag on them is still refused. */
 const BROWSER_BUNDLE_RE = /\/(?:safari|google chrome(?: beta| dev| canary)?|chromium|firefox(?: developer edition| nightly)?|arc|brave browser(?: beta| nightly)?|microsoft edge(?: beta| dev| canary)?|opera(?: gx)?|vivaldi|orion|zen(?: browser)?|thorium|comet|dia|sigmaos|yandex|duckduckgo|sidekick|wavebox|island)\.app\/|\/synabun\.app\/contents\/(?:macos\/synabun(?:\s|$)|frameworks\/synabun helper)/i;
@@ -275,10 +279,12 @@ export function processKinds({ ucomm = '', comm = '', args = '' } = {}) {
   else if (/(?:^|\s)-juggler(?:-pipe)?(?:\s|$)/.test(la) || /(?:^|\s)--?marionette(?:\s|$)/.test(la)) automation = 'Firefox automation';
 
   let agent = has(AGENT_NAMES);
+  if (agent === 'agy') agent = 'antigravity';
   if (!agent) {
     if (/\/claude\/versions\/[^/\s]+(?:\s|$)/.test(la) || /@anthropic-ai\/claude-code\/cli\.m?js(?:\s|$)/.test(la) || /@anthropic-ai\/claude-agent-sdk[^/\s]*\/claude(?:\s|$)/.test(la)) agent = 'claude';
     else if (/@openai\/codex\/bin\/codex(?:\.js)?(?:\s|$)/.test(la) || /(?:^|\s|\/)codex\s+(?:app-server|exec|mcp(?:-server)?|proto)\b/.test(la)) agent = 'codex';
     else if (/(?:^|\s|\/)opencode\s+serve\b/.test(la)) agent = 'opencode';
+    else if (/(?:^|\s|\/)(?:agy|antigravity)\s+acp\b/.test(la) || ANTIGRAVITY_SERVER_RE.test(c || a)) agent = 'antigravity';
     else if (/@google\/gemini-cli\//.test(la)) agent = 'gemini';
   }
 
@@ -402,6 +408,27 @@ export function isSynabunMcpServer(proc, { roots = [], cwd = null, realpath = nu
   return typeof real === 'string' && targets.has(real);
 }
 
+// ── Processes SynaBun starts for an agent ────────────────────────────────────
+//
+// A command an agent runs through SynaBun (the Antigravity panel's client terminals, lib/antigravity/acp-client-host.js)
+// is a child of this server, not of the agent, so no agent is in its process tree by name. Its pid is registered here
+// while it runs, and a chain that passes through one is an agent's tree. Like the name rule, a command that detaches
+// from its parent (and so from the chain) is not seen.
+const AGENT_PROCESSES = new Map(); // pid -> label
+
+/** A process SynaBun started on an agent's behalf: its tree never holds the owner's authority while it runs. */
+export function registerAgentProcess(pid, label = 'agent command') {
+  if (Number.isInteger(pid) && pid > 1) AGENT_PROCESSES.set(pid, String(label || 'agent command').slice(0, 80));
+}
+/** That process ended (its pid can be reused). */
+export function forgetAgentProcess(pid) {
+  AGENT_PROCESSES.delete(pid);
+}
+/** The registered processes (for tests and diagnostics). */
+export function agentProcesses() {
+  return new Map(AGENT_PROCESSES);
+}
+
 /**
  * Whether the process at the client end of a connection, and its parents, may hold the owner's authority.
  * @param {Array<{pid:number, ppid:number, ucomm:string, comm:string, args:string}>} chain the peer first, then its
@@ -409,9 +436,10 @@ export function isSynabunMcpServer(proc, { roots = [], cwd = null, realpath = nu
  * @param {{ selfPid:number, listening:Set<number>, synabunMcp?:number }} o `synabunMcp`: the peer's pid when it is
  *   SynaBun's own MCP server over HTTP (isSynabunMcpServer): not refused as a relay, refused like an agent's tree
  *   (kind 'synabun-mcp': lib/owner-authority.js takes its pinned calls as an agent's own)
+ *   `agentPids`: processes SynaBun started for an agent (registerAgentProcess), refused like an agent's tree
  * @returns {{ self:boolean, refuse: null | { why:string, kind:string, pid:number, name:string } }}
  */
-export function classifyPeerChain(chain, { selfPid = process.pid, listening = new Set(), synabunMcp = 0 } = {}) {
+export function classifyPeerChain(chain, { selfPid = process.pid, listening = new Set(), synabunMcp = 0, agentPids = AGENT_PROCESSES } = {}) {
   const list = Array.isArray(chain) ? chain : [];
   if (!list.length) return { self: false, refuse: null };
   if (list[0].pid === selfPid) return { self: true, refuse: null };
@@ -425,6 +453,8 @@ export function classifyPeerChain(chain, { selfPid = process.pid, listening = ne
     const k = i === 0 ? peerKinds : processKinds(p);
     if (k.automation) return refuse(p, 'automation-browser', `a browser started for automation (${k.automation})`);
     if (k.agent) return refuse(p, 'agent', `an AI agent's process tree (${k.agent})`);
+    const startedFor = agentPids?.get?.(p.pid);
+    if (startedFor) return refuse(p, 'agent', `an AI agent's process tree (${startedFor}, started by SynaBun)`);
     if (k.synabun) return refuse(p, 'synabun-instance', 'another SynaBun server');
     if (k.remoteLogin) return refuse(p, 'remote-login', 'a remote login session (sshd)');
     // SynaBun's own MCP server over HTTP relays for its MCP clients by design: not refused as a relay or a listener

package/neural-interface/lib/pty-host/core.js

@@ -19,6 +19,7 @@ import { evaluateFlow } from './flow.js';
 import { EV, OP, HOST_DEFAULTS } from './protocol.js';
 import { createEventLoopMonitor } from '../event-loop-monitor.js';
 import { withPathEnv } from '../augmented-path.js';
+import { killOwnedPty } from './lifetime.js';
 
 const IS_WIN = process.platform === 'win32';
 const IS_LINUX = process.platform === 'linux';
@@ -39,8 +40,14 @@ export function createPtyHostCore({ send, config = {}, pty: injectedPty = null }
   let pty = injectedPty;
   let ptyError = null;
   let shuttingDown = false;
+  let shutdownTimer = null;
 
   const emit = (msg) => { try { send(msg); } catch {} };
+  // Covers process.exit(), including host.js's bounded shutdown, and the
+  // in-process transport. This must be synchronous: exit cannot await PTYs.
+  const onOwnerExit = () => {
+    for (const s of sessions.values()) if (!s.exited) killOwnedPty(s.proc.pid);
+  };
 
   // ── Startup ──
   async function init() {
@@ -65,6 +72,10 @@ export function createPtyHostCore({ send, config = {}, pty: injectedPty = null }
   // ── Spawn ──
   function spawnSession(spec) {
     const { id } = spec;
+    if (shuttingDown) {
+      emit({ t: EV.SPAWN_ERROR, id, message: 'Terminal host is shutting down' });
+      return;
+    }
     if (!id || sessions.has(id)) {
       emit({ t: EV.SPAWN_ERROR, id, message: 'Duplicate or missing session id' });
       return;
@@ -133,6 +144,7 @@ export function createPtyHostCore({ send, config = {}, pty: injectedPty = null }
       graceTimer: null,
       exited: false,
     };
+    if (!sessions.size) process.once('exit', onOwnerExit);
     sessions.set(id, s);
     counters.spawns++;
 
@@ -490,6 +502,11 @@ export function createPtyHostCore({ send, config = {}, pty: injectedPty = null }
     for (const f of s.tempFiles.splice(0)) unlink(f).catch(() => {});
     try { s.model.dispose(); } catch {}
     sessions.delete(s.id);
+    if (!sessions.size) {
+      process.removeListener('exit', onOwnerExit);
+      clearTimeout(shutdownTimer);
+      shutdownTimer = null;
+    }
   }
 
   function killSession(s, signal) {
@@ -571,7 +588,11 @@ export function createPtyHostCore({ send, config = {}, pty: injectedPty = null }
     return out;
   }
 
-  function shutdownAll() {
+  function shutdownAll({ force = false } = {}) {
+    // The server's synchronous exit handler kills itself before later exit
+    // listeners can run. Its killNow() path must reap the PTYs right here.
+    if (force) onOwnerExit();
+    if (shuttingDown) return;
     shuttingDown = true;
     for (const s of sessions.values()) {
       s.draining = true;
@@ -581,6 +602,12 @@ export function createPtyHostCore({ send, config = {}, pty: injectedPty = null }
     for (const s of sessions.values()) {
       for (const c of s.clients) { try { c.ws.close(1001, 'terminal host shutting down'); } catch {} }
     }
+    // HUP can be ignored, or arrive while the macOS helper is attaching.
+    // Bound the grace period in both transports, even if the owner stays up.
+    if (sessions.size) {
+      shutdownTimer = setTimeout(onOwnerExit, 100);
+      shutdownTimer.unref?.();
+    }
   }
 
   function dispose() {

package/neural-interface/lib/pty-host/lifetime.js

@@ -0,0 +1,12 @@
+// node-pty's macOS helper starts a new session before exec. If its host dies
+// before the helper acquires the controlling terminal, closing the master
+// does not hang it up. Kill the known PTY process group as well as its leader.
+// Callers must forget a PID on EXIT: these are owned children, never a sweep
+// of unrelated processes or a list retained across host restarts.
+export function killOwnedPty(pid, { kill = process.kill, platform = process.platform } = {}) {
+  if (!Number.isSafeInteger(pid) || pid <= 1) return;
+  if (platform !== 'win32') {
+    try { kill(-pid, 'SIGKILL'); } catch {}
+  }
+  try { kill(pid, 'SIGKILL'); } catch {}
+}

package/neural-interface/lib/pty-host/manager.js

@@ -10,6 +10,7 @@ import { fork } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { EV, OP, UPGRADE_HEADER_WHITELIST } from './protocol.js';
 import { createPtyHostCore } from './core.js';
+import { killOwnedPty } from './lifetime.js';
 
 const HOST_PATH = fileURLToPath(new URL('./host.js', import.meta.url));
 const BACKOFF_MS = [0, 1000, 2000, 4000, 8000, 16000, 30000];
@@ -39,6 +40,7 @@ export function createPtyHostManager({
   const handlers = new Map();     // id → { onSpawned, onTap, onResized, onClients, onExit }
   const spawnWaiters = new Map(); // id → waiter
   const preparing = new Map();   // id → operations queued while PATH is read
+  const ptyPids = new Map();     // id → live PTY PID owned by the current host
   const requests = new Map();     // reqId → { resolve, reject, timer }
   let reqSeq = 0;
   let child = null;
@@ -76,6 +78,7 @@ export function createPtyHostManager({
         releaseHeldSockets();
         break;
       case EV.SPAWNED:
+        ptyPids.set(m.id, m.pid);
         try { handlers.get(m.id)?.onSpawned?.(m); } catch (err) { log.warn?.('[pty-host] onSpawned', err?.message); }
         settleSpawn(m.id, null, m);
         break;
@@ -97,6 +100,7 @@ export function createPtyHostManager({
         try { handlers.get(m.id)?.onClients?.(m); } catch {}
         break;
       case EV.EXIT: {
+        ptyPids.delete(m.id);
         const h = handlers.get(m.id);
         handlers.delete(m.id);
         spawnWaiters.delete(m.id);
@@ -150,6 +154,11 @@ export function createPtyHostManager({
   }
 
   function onChildExit(code, signal) {
+    // A SIGKILL cannot run host.js's disconnect/shutdown handlers. In
+    // particular, a macOS helper still attaching its terminal may survive
+    // closing the PTY master. Reap only this host's still-owned children.
+    for (const pid of ptyPids.values()) killOwnedPty(pid);
+    ptyPids.clear();
     child = null;
     ready = false;
     hostPid = null;
@@ -358,8 +367,10 @@ export function createPtyHostManager({
     for (const id of preparing.keys()) settleSpawn(id, new Error('Terminal host is shutting down'));
     preparing.clear();
     if (restartTimer) { clearTimeout(restartTimer); restartTimer = null; }
+    for (const pid of ptyPids.values()) killOwnedPty(pid);
+    ptyPids.clear();
     try { child?.kill('SIGTERM'); } catch {}
-    try { core?.shutdownAll(); } catch {}
+    try { core?.shutdownAll({ force: true }); } catch {}
   }
 
   return {

package/neural-interface/lib/remote-policy.js

@@ -49,7 +49,7 @@ const RANK = Object.freeze({ 'read-only': 0, ask: 1, autonomous: 2 });
 
 /** Brain providers that can hold a remote session at Ask and Autonomous (the in-process hook). */
 export const REMOTE_ENFORCING_PROVIDERS = Object.freeze(['claude-code']);
-const PROVIDER_LABELS = Object.freeze({ 'claude-code': 'Claude', codex: 'Codex', opencode: 'OpenCode' });
+const PROVIDER_LABELS = Object.freeze({ 'claude-code': 'Claude', codex: 'Codex', opencode: 'OpenCode', antigravity: 'Antigravity' });
 export function providerLabel(provider) { return PROVIDER_LABELS[provider] || String(provider || 'this brain'); }
 /** True for a known brain other than Claude: a remote session on it is read-only. */
 export function remoteBrainLimited(provider) {

package/neural-interface/lib/request-gate.js

@@ -96,6 +96,9 @@ export const ADMIN_ONLY_PREFIXES = Object.freeze([
   '/api/project-files',
   '/api/browse-folder',
   '/api/codex/plans',
+  // Antigravity's own conversations and models: each uncached answer starts the owner's `agy` (its side panel
+  // socket is refused to guests too).
+  '/api/antigravity',
   '/api/sidepanel',
   '/api/sidepanel-runs',
   '/api/loop',

package/neural-interface/lib/rulesets/api.js

@@ -41,9 +41,10 @@
 
 import { isRulesetHost, readRulesetManifest, renderCoexistenceSnippet, renderRuleset, RULESET_HOSTS } from './render.js';
 
-// The pre-2.0 `format` names, as the onboarding wizard and Settings still send them.
-const LEGACY_FORMATS = Object.freeze({ claude: 'claude', codex: 'codex', cursor: 'cursor', generic: 'opencode', opencode: 'opencode', gemini: 'gemini' });
-const LEGACY_VERSION_FORMATS = Object.freeze(['claude', 'codex', 'cursor', 'generic', 'gemini']);
+// The pre-2.0 `format` names, as the onboarding wizard and Settings still send them. `gemini` is what a page from
+// before Antigravity replaced Gemini CLI asks for: Antigravity's text, which reads the same files.
+const LEGACY_FORMATS = Object.freeze({ claude: 'claude', codex: 'codex', cursor: 'cursor', generic: 'opencode', opencode: 'opencode', antigravity: 'antigravity', gemini: 'antigravity' });
+const LEGACY_VERSION_FORMATS = Object.freeze(['claude', 'codex', 'cursor', 'generic', 'antigravity']);
 // A copy someone edited, damaged markers, a CLI that is not there: the request was fine, the files said no.
 const REFUSED_STATES = new Set(['not-installed', 'modified', 'conflict', 'error']);
 const REFUSED_CODES = new Set(['REMOVE_INCOMPLETE', 'CHANGED_UNDERNEATH', 'BUSY']);
@@ -133,7 +134,7 @@ export function legacyRulesetPayload(format, { render = renderRuleset } = {}) {
   const name = String(format || 'claude').toLowerCase();
   if (name === 'coexistence') return { ok: true, ruleset: renderCoexistenceSnippet().text, format: name };
   const host = LEGACY_FORMATS[name];
-  if (!host) return { status: 400, error: `Invalid format: ${name}. Use claude, cursor, generic, gemini, codex, or coexistence.` };
+  if (!host) return { status: 400, error: `Invalid format: ${name}. Use claude, cursor, generic, antigravity, codex, or coexistence.` };
   return { ok: true, ruleset: render(host).text, format: name };
 }
 
@@ -155,7 +156,7 @@ export function legacyRulesetVersionsPayload() {
 
 /** The two endpoints the pre-2.0 UI reads. Same shapes as before, served from the renderer. */
 export function registerLegacyRulesetRoutes(app, { render = renderRuleset } = {}) {
-  // Supports ?format=claude (default) | cursor | generic | gemini | codex | coexistence
+  // Supports ?format=claude (default) | cursor | generic | antigravity | codex | coexistence
   app.get('/api/claude-code/ruleset', (req, res) => {
     try {
       const payload = legacyRulesetPayload(req.query.format, { render });

package/neural-interface/lib/rulesets/fs-safe.js

@@ -3,7 +3,7 @@
 // ═══════════════════════════════════════════
 //
 // The rules installer edits files that belong to the user and to other CLIs
-// (~/.codex/AGENTS.md, ~/.gemini/GEMINI.md, OpenCode's opencode.json). These
+// (~/.codex/AGENTS.md, ~/.gemini/config/GEMINI.md, OpenCode's opencode.json). These
 // helpers make each write all-or-nothing, keep a symlinked file a symlink,
 // refuse to write through a link that points at nothing, keep a copy of what
 // was there before, never read a corrupt JSON file as `{}`, and never write