synabun 2.1.0 → 2.2.1

package/neural-interface/lib/native-loop-runtime.js

@@ -3,7 +3,7 @@ import { storedToolList, toolListRecord, readStoredToolListRecord } from './tool
 import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 
-export const NATIVE_LOOP_PROFILES = new Set(['claude-code', 'codex', 'opencode']);
+export const NATIVE_LOOP_PROFILES = new Set(['claude-code', 'codex', 'opencode', 'antigravity']);
 
 export function isNativeLoopProfile(profile) {
   return NATIVE_LOOP_PROFILES.has(String(profile || ''));
@@ -22,6 +22,7 @@ function cleanDescriptor(record) {
     provider: record.provider,
     providerSessionId: record.providerSessionId || null,
     providerThreadId: record.providerThreadId || null,
+    ...(record.antigravityHome ? { antigravityHome: record.antigravityHome } : {}),
     source: record.source,
     focus: !!record.focus,
     status: record.status,
@@ -53,6 +54,7 @@ function cleanDescriptor(record) {
     // existing consumers (router, sidepanels, schedules) are unaffected.
     runMode: record.runMode || 'loop',
     turnState: record.turnState || null,
+    pending: record.status === 'running' ? (record.pendingRequests || []) : [],
     // What the last turn's result said (task mode: done, blocked or needs_input; the dispatcher's
     // lastResult.status): an idle warm worker whose turn ended asking waits on the user.
     outcome: record.outcome || null,
@@ -184,6 +186,14 @@ export class NativeLoopRuntime {
     return this._emit('sidepanel:run-updated', record, { reason: 'turn-state' });
   }
 
+  /** A live worker's requests, durable for a late attach or page reload. Resolvers stay in the dispatcher. */
+  setPendingRequests(runId, requests) {
+    const record = this.records.get(runId);
+    if (!record) return null;
+    record.pendingRequests = structuredClone(requests || []);
+    return this._emit('sidepanel:run-updated', record, { reason: 'pending-requests' });
+  }
+
   /**
    * Task-mode helper: records what the wrapper's last turn reported ('done' |
    * 'blocked' | 'needs_input', the dispatcher's lastResult.status) and
@@ -224,6 +234,7 @@ export class NativeLoopRuntime {
         record.suspendedAt = record.suspendedAt || iso(this.now());
         record.suspendReason = record.suspendReason || 'server_restart';
         record.turnState = 'suspended';
+        record.pendingRequests = [];
         record.stopping = false;
         this.records.set(record.runId, record);
         this._hold(record);
@@ -314,7 +325,8 @@ export class NativeLoopRuntime {
   }
 
   _writeState(runId, state) {
-    writeJsonAtomic(this._statePath(runId), toolListRecord(state, this.toolListOptions()));
+    const { permissionBroker: _broker, ...stored } = state;
+    writeJsonAtomic(this._statePath(runId), toolListRecord(stored, this.toolListOptions()));
   }
 
   _writeTerminalState(record, patch) {
@@ -344,6 +356,7 @@ export class NativeLoopRuntime {
   _setIdentity(record, identity = {}) {
     const providerSessionId = identity.providerSessionId || identity.sessionId || null;
     const providerThreadId = identity.providerThreadId || identity.threadId || null;
+    const antigravityHome = typeof identity.antigravityHome === "string" && identity.antigravityHome ? identity.antigravityHome : null;
     let changed = false;
     if (providerSessionId && providerSessionId !== record.providerSessionId) {
       record.providerSessionId = providerSessionId;
@@ -353,6 +366,10 @@ export class NativeLoopRuntime {
       record.providerThreadId = providerThreadId;
       changed = true;
     }
+    if (antigravityHome && antigravityHome !== record.antigravityHome) {
+      record.antigravityHome = antigravityHome;
+      changed = true;
+    }
     if (changed) this._emit('sidepanel:run-updated', record, { reason: 'identity' });
     if ((record.providerSessionId || record.providerThreadId) && record._resolveIdentity) {
       record._resolveIdentity(cleanDescriptor(record));
@@ -397,6 +414,7 @@ export class NativeLoopRuntime {
       provider: state.profile,
       providerSessionId: null,
       providerThreadId: null,
+      antigravityHome: typeof state.antigravityHome === "string" && state.antigravityHome ? state.antigravityHome : null,
       source,
       focus,
       status: 'starting',
@@ -544,6 +562,7 @@ export class NativeLoopRuntime {
               runId,
               emit: (event) => this._emitProviderEvent(record, event),
               setTurnState: (turnState) => this.setTurnState(runId, turnState),
+              setPendingRequests: (requests) => this.setPendingRequests(runId, requests),
               setOutcome: (outcome) => this.setOutcome(runId, outcome),
               readState: () => this._readState(runId),
             })
@@ -639,6 +658,7 @@ export class NativeLoopRuntime {
       browserTabId: state.browserTabId || null,
       suspendedAt: null,
       suspendReason: null,
+      ...(typeof state.antigravityHome === "string" && state.antigravityHome ? { antigravityHome: state.antigravityHome } : {}),
       resumes: (Number(record.resumes) || 0) + 1,
       resumedAt: iso(this.now()),
       buildPrompt,
@@ -830,6 +850,7 @@ export class NativeLoopRuntime {
     record.startupAbortController = null;
     record.buildPrompt = null;
     record.wrapAdapter = null;
+    record.pendingRequests = [];
     if (turnState === 'suspended') record.turnState = 'suspended';
     else if (record.turnState && record.turnState !== 'terminal') record.turnState = 'terminal';
   }

package/neural-interface/lib/opencode-native-boundary.js

@@ -2,43 +2,186 @@
 // listen time. This is a capability allowlist, not a generic OpenCode version
 // check: 2.1.4's HTTP/upgrade authentication and stdout password path were
 // inspected and tested. Unknown binaries/command wrappers keep the old guard.
+// 2.2.5 (Homebrew anomalyco/tap/opencode-v2) checked 2026-11-01 against throwaway
+// serves on 127.0.0.1: no password variable → it prints "server password <secret>"
+// on stdout; every /api route (session, config, event, pty, shell, file, mcp, and
+// the new tunnel and pairing) answers 401 without it, both plain and as a
+// WebSocket upgrade, and 200 with it; one listener, bound to 127.0.0.1 only.
+// Non-/api paths serve the static web UI (HTML), as before.
+export const NATIVE_SERVE_VERSIONS = Object.freeze(['2.1.4', '2.2.5']);
+
 export function nativeServeCapability({ version, commandLine = false, passwordFrom } = {}) {
-  return !commandLine && passwordFrom === 'stdout' && /^(?:opencode\s+)?v?2\.1\.4$/.test(String(version || '').trim());
+  const bare = String(version || '').trim().replace(/^opencode\s+/, '').replace(/^v/, '');
+  return !commandLine && passwordFrom === 'stdout' && NATIVE_SERVE_VERSIONS.includes(bare);
+}
+
+// Why a serve is not native-safe, in words that name what to change.
+export function nativeServeReason({ version, commandLine = false, passwordFrom } = {}) {
+  if (commandLine) return 'command-line';
+  if (passwordFrom !== 'stdout') return 'password';
+  return nativeServeCapability({ version, commandLine, passwordFrom }) ? null : 'version';
+}
+
+const BASE = `Native browser WebSockets require authenticated OpenCode ${NATIVE_SERVE_VERSIONS.join(' or ')} serves with private stdout credentials; wait for startup, stop unverified serves or use the verified executable path.`;
+
+const MAX_COMMAND = 200;
+const short = (text, max = MAX_COMMAND) => {
+  const one = String(text ?? '').replace(/\s+/g, ' ').trim();
+  return one.length > max ? `${one.slice(0, max - 1)}…` : one;
+};
+const pidOf = (o) => (Number.isInteger(o?.pid) && o.pid > 0 ? o.pid : null);
+
+// The fields of an offender a caller may see (a route's answer, a dispatch error): what names the serve, never its
+// token or the rest of its record. A command line is shortened.
+export function narrowOffenders(offenders = []) {
+  return (Array.isArray(offenders) ? offenders : []).map((o) => {
+    const out = { reason: String(o?.reason || 'unknown'), pid: pidOf(o), port: Number(o?.port) > 0 ? Number(o.port) : null };
+    if (o?.path) out.path = short(o.path, 400);
+    if (o?.command) out.command = short(o.command, 400);
+    if (o?.version) out.version = String(o.version).trim();
+    if (o?.reason === 'record') { out.kind = o.kind || null; out.claimable = !!o.claimable; }
+    return out;
+  });
 }
 
+function describeOffender(o) {
+  const pid = pidOf(o);
+  const where = [pid ? `pid ${pid}` : null, o.port ? `port ${o.port}` : null].filter(Boolean).join(', ');
+  const what = [o.path || null, o.command ? `command ${short(o.command)}` : null, o.version ? `version ${String(o.version).trim()}` : null].filter(Boolean).join(', ');
+  const head = `OpenCode serve ${where || '(unknown process)'}${what ? ` (${what})` : ''}`;
+  switch (o.reason) {
+    case 'version': return `${head}: this OpenCode version is not one whose authentication SynaBun verified (${NATIVE_SERVE_VERSIONS.join(', ')}); install one of them, or stop this serve (close the OpenCode panel${pid ? ` / end pid ${pid}` : ''})`;
+    case 'command-line': return `${head}: started from the OpenCode command line set in Settings (its version cannot be read); clear it so SynaBun starts the verified executable, or stop this serve`;
+    case 'password': return `${head}: started without a private stdout password`;
+    case 'starting': return `${head}: still starting; try again once OpenCode answers`;
+    case 'untracked-port': return `${head}: answers on a port SynaBun did not start in this run; stop the process listening on port ${o.port}`;
+    case 'record': {
+      const kind = o.kind ? `, kind ${o.kind}` : '';
+      if (o.claimable) return `${head}: left running by an earlier SynaBun that has ended${kind}; it could not be stopped automatically: end ${pid ? `pid ${pid}` : 'that serve'}`;
+      // Not confirmed: the owner may still run, or the OS could not say whether this pid is still that serve (a pid
+      // is reused once its process ends). Never ask the user to end a number that may be another program now.
+      return `${head}: on record from another SynaBun process, or one whose identity the OS could not confirm${kind}. It is unconfirmed${pid ? ` whether pid ${pid} is still this serve (the number may belong to another program by now)` : ''}: check ${pid ? `that pid ${pid}'s command line is the one shown (ps -o command= -p ${pid}; on Windows, Task Manager → Details → Command line column)` : 'the OpenCode serves that are running'} before ending it, or close the other SynaBun`;
+    }
+    default: return `${head}: not verified`;
+  }
+}
+
+export function nativeServeError(offenders = []) {
+  const list = offenders.map(describeOffender);
+  const error = new Error(list.length ? `${BASE} Blocking: ${list.join('; ')}.` : BASE);
+  error.code = 'NATIVE_SERVE_UNVERIFIED';
+  error.offenders = narrowOffenders(offenders);
+  return error;
+}
+
+const nativeContextClosed = () => Object.assign(new Error('The browser closed while SynaBun was checking its OpenCode serves; nothing was attached.'), { code: 'NATIVE_CONTEXT_CLOSED' });
+const nativeAttachAborted = () => Object.assign(new Error('The browser request ended while SynaBun was checking its OpenCode serves; nothing was attached.'), { code: 'NATIVE_ATTACH_ABORTED' });
+const defaultSleep = (ms) => new Promise((done) => { const t = setTimeout(done, ms); t.unref?.(); });
+
 export function createNativeServeBoundary() {
   const processes = new Map();
+  // Every native context that relies on the boundary, attached or still being checked (a reservation): while any is
+  // held, assertLaunch refuses an unverified serve. A context is held from before its check until it closes, its
+  // browser disconnects or its attachment fails.
   const contexts = new Map();
-  const error = () => new Error('Native browser WebSockets require authenticated OpenCode 2.1.4 serves with private stdout credentials; wait for startup, stop unverified serves or use the verified executable path.');
+  function offenders({ ports = [], unverifiedRecords = [] } = {}) {
+    const out = [];
+    const verified = new Set();
+    for (const [proc, e] of processes) {
+      const base = { pid: proc.pid || null, port: e.port, path: e.path || null, version: e.version || null };
+      if (!e.safe) out.push({ ...base, reason: e.reason || 'version' });
+      else if (!e.ready) out.push({ ...base, reason: 'starting' });
+      else verified.add(e.port);
+    }
+    for (const port of ports) {
+      const n = Number(port);
+      if (verified.has(n) || out.some(o => o.port === n)) continue;
+      out.push({ pid: null, port: n, reason: 'untracked-port' });
+    }
+    // A record has the serve's command line (its identity), not a path; never its token.
+    for (const r of unverifiedRecords) out.push({ pid: r?.pid || null, port: r?.port || null, kind: r?.kind || null, command: r?.command || null, claimable: !!r?.claimable, reason: 'record' });
+    return out;
+  }
+  function reserve(context) {
+    const held = contexts.get(context);
+    if (held) return held;
+    const browser = context.browser?.() || null;
+    const release = () => {
+      if (contexts.get(context) !== release) return;
+      contexts.delete(context);
+      context.removeListener('close', release);
+      browser?.removeListener('disconnected', release);
+    };
+    contexts.set(context, release);
+    context.once('close', release);
+    browser?.once('disconnected', release);
+    return release;
+  }
+  function check(state) {
+    const blocking = offenders(state);
+    if (blocking.length) throw nativeServeError(blocking);
+  }
   return {
-    assertLaunch(safe) { if (!safe && contexts.size) throw error(); },
-    track(proc, { port, safe = false }) {
+    offenders,
+    reserve,
+    holds: (context) => contexts.has(context),
+    assertLaunch(safe, info = {}) {
+      if (!safe && contexts.size) {
+        const e = nativeServeError([{ pid: null, port: info.port || null, path: info.path || null, version: info.version || null, reason: info.reason || 'version' }]);
+        e.message = `A native browser is attached, so this unverified OpenCode serve is not started. ${e.message}`;
+        throw e;
+      }
+    },
+    track(proc, { port, safe = false, version = null, path = null, reason = null }) {
       if (!proc || proc.exitCode != null || proc.signalCode != null) return;
-      processes.set(proc, { port: Number(port), safe, ready: false });
+      processes.set(proc, { port: Number(port), safe, ready: false, version, path, reason: safe ? null : (reason || 'version') });
       const release = () => processes.delete(proc);
       proc.once('exit', release);
       proc.once('error', () => { if (!proc.pid) release(); });
     },
     ready(proc) { const entry = processes.get(proc); if (entry) entry.ready = true; },
-    protect(context, { ports, unverifiedRecords = [] }) {
+    // Synchronous: check now, then hold the context. A context already held is returned as it is.
+    protect(context, state) {
       if (contexts.has(context)) return contexts.get(context);
-      const verified = new Set();
-      for (const { port, safe, ready } of processes.values()) {
-        if (!safe || !ready) throw error();
-        verified.add(port);
+      check(state);
+      return reserve(context);
+    },
+    // The context is held (a pending reservation assertLaunch honours) before anything is waited for; then, bounded,
+    // SynaBun repairs what it can: a sweep of the records an ended SynaBun left (started at once, in the background,
+    // waited for at most `sweepMs`) and SynaBun's own verified serves still starting (waited for at most `waitMs`).
+    // Any other blocker refuses at once. `deadline` (an absolute time) and `signal` end the wait early. On every
+    // failure the reservation is released; nothing is cached, so the next attempt reads the live state again.
+    async attach(context, { state, sweep = null, waitMs = 20_000, sweepMs = 10_000, deadline = Infinity, signal = null, pollMs = 250, now = Date.now, sleep = defaultSleep } = {}) {
+      const release = reserve(context);
+      const held = () => contexts.get(context) === release;
+      try {
+        const start = now();
+        const end = Number.isFinite(deadline) ? deadline : Infinity;
+        const waitEnd = Math.min(start + Math.max(0, waitMs), end);
+        const sweepEnd = Math.min(start + Math.max(0, sweepMs), end);
+        let current = state();
+        let sweeping = false;
+        if (sweep && current.unverifiedRecords?.length) {
+          sweeping = true;
+          Promise.resolve().then(sweep).catch(() => {}).finally(() => { sweeping = false; });
+        }
+        for (;;) {
+          if (!held()) throw nativeContextClosed();
+          if (signal?.aborted) throw nativeAttachAborted();
+          const blocking = offenders(current);
+          if (!blocking.length) return release;
+          const t = now();
+          const waitable = (o) => (o.reason === 'starting' && t < waitEnd)
+            || (o.reason === 'record' && o.claimable && sweeping && t < sweepEnd);
+          if (!blocking.every(waitable)) throw nativeServeError(blocking);
+          const until = Math.max(...blocking.map(o => (o.reason === 'starting' ? waitEnd : sweepEnd)));
+          await sleep(Math.max(1, Math.min(pollMs, until - t)));
+          current = state();
+        }
+      } catch (error) {
+        release();
+        throw error;
       }
-      if ([...ports].some(port => !verified.has(Number(port))) || unverifiedRecords.length) throw error();
-      const browser = context.browser();
-      const release = () => {
-        if (contexts.get(context) !== release) return;
-        contexts.delete(context);
-        context.removeListener('close', release);
-        browser.removeListener('disconnected', release);
-      };
-      contexts.set(context, release);
-      context.once('close', release);
-      browser.once('disconnected', release);
-      return release;
     },
   };
 }

package/neural-interface/lib/owner-authority.js

@@ -74,7 +74,7 @@ export const AGENT_CALL_KINDS = Object.freeze(['agent', 'synabun-mcp']);
  */
 export const OWNER_READ_PREFIXES = Object.freeze([...ADMIN_ONLY_PREFIXES.filter((prefix) => prefix !== '/api/hook-'), '/api/git']);
 /** The owner's sockets: a terminal, the agent panels, the Assistant, the browser panel. */
-export const OWNER_SOCKET_PREFIXES = Object.freeze(['/ws/terminal/', '/ws/claude-skin', '/ws/codex-skin', '/ws/opencode-v2', '/ws/assistant/', '/ws/browser/']);
+export const OWNER_SOCKET_PREFIXES = Object.freeze(['/ws/terminal/', '/ws/claude-skin', '/ws/codex-skin', '/ws/opencode-v2', '/ws/antigravity', '/ws/assistant/', '/ws/browser/']);
 /** Sockets that stay open for the app's pages to draw, read-only for a peer the owner's powers are refused to. */
 export const READ_ONLY_SOCKET_PATHS = Object.freeze(['/ws/sync']);
 

package/neural-interface/lib/path-confine.js

@@ -19,13 +19,15 @@ export class PathConfineError extends Error {
 export const SESSION_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 export const isSessionId = (id) => typeof id === 'string' && SESSION_ID_RE.test(id);
 
-const fold = process.platform === 'win32' ? (s) => s.toLowerCase() : (s) => s;
+const foldForPlatform = (platform = process.platform) => (platform === 'win32' ? (s) => s.toLowerCase() : (s) => s);
+const fold = foldForPlatform();
 
 /** True when `target` is below `root` (or is `root` itself, with allowRoot). Lexical: both are resolved first. */
-export function isInside(root, target, { allowRoot = false } = {}) {
+export function isInside(root, target, { allowRoot = false, platform = process.platform } = {}) {
   if (!root || !target) return false;
-  const r = fold(resolve(String(root)));
-  const t = fold(resolve(String(target)));
+  const f = platform === process.platform ? fold : foldForPlatform(platform);
+  const r = f(resolve(String(root)));
+  const t = f(resolve(String(target)));
   if (t === r) return allowRoot;
   return t.startsWith(r.endsWith(sep) ? r : r + sep);
 }
@@ -83,28 +85,29 @@ export function isInsideReal(root, target, { allowRoot = false, fs = realFs } =
  * @param o.projectsDir <config dir>/projects of the account
  * @param o.pathToKey   (projectPath) => the folder name Claude Code uses for it
  */
-export function findSessionTranscript({ sessionId, project = '', projects = [], projectsDir, pathToKey, exists = existsSync, realpath = realpathSync } = {}) {
+export function findSessionTranscript({ sessionId, project = '', projects = [], projectsDir, pathToKey, exists = existsSync, realpath = realpathSync, platform = process.platform } = {}) {
   if (!isSessionId(sessionId)) throw new PathConfineError(400, 'Not a session id');
   if (!projectsDir || typeof pathToKey !== 'function') return null;
+  const foldPath = platform === process.platform ? fold : foldForPlatform(platform);
   const known = (Array.isArray(projects) ? projects : []).filter(p => p?.path);
-  const wanted = typeof project === 'string' && project ? resolve(project) : '';
+  const wanted = typeof project === 'string' && project ? foldPath(resolve(project)) : '';
   let order = known;
   if (wanted) {
-    const named = known.find(p => resolve(p.path) === wanted);
+    const named = known.find(p => foldPath(resolve(p.path)) === wanted);
     if (!named) throw new PathConfineError(400, 'Not a registered project');
     order = [named];
   }
   for (const proj of order) {
     const key = String(pathToKey(proj.path) || '');
     // Claude Code has written the drive letter in both cases on Windows.
-    const keys = [...new Set([key.replace(/^([A-Z])/, m => m.toLowerCase()), key])].filter(isPlainName);
+    const keys = [...new Set([key.replace(/^([A-Z])/, m => m.toLowerCase()), key.replace(/^([a-z])/, m => m.toUpperCase()), key])].filter(isPlainName);
     for (const k of keys) {
       const folder = join(projectsDir, k);
       const candidate = join(folder, `${sessionId}.jsonl`);
       if (!exists(candidate)) continue;
       let realFile; let realFolder;
       try { realFile = realpath(candidate); realFolder = realpath(folder); } catch { continue; }
-      if (!isInside(realFolder, realFile)) continue;
+      if (!isInside(realFolder, realFile, { platform })) continue;
       // `realPath` / `realFolder`: the canonical paths that were just checked.
       // The transcript is read from those (lib/confined-fs.js), not from the
       // name it was found under, which could be swapped for a link afterwards.

package/neural-interface/lib/peer-identity.js

@@ -244,7 +244,11 @@ export const RELAY_NAMES = Object.freeze([
 /** Proxy / tunnel apps found by their bundle (their helpers carry other names). */
 const RELAY_BUNDLE_RE = /\/(?:charles|proxyman|surge(?: mac)?|clashx[^/]*|clash verge|clash for windows|clash nyanpasu|flclash|shadowrocket|shadowsocksx[^/]*|v2rayu|v2rayx|qv2ray|v2rayn|stash|quantumult x|loon|proxifier|mitmproxy|ngrok|tailscale|cloudflare warp)\.app\//i;
 /** The agents whose process trees never hold the owner's authority (argv[0]'s name). */
-export const AGENT_NAMES = Object.freeze(['claude', 'codex', 'opencode', 'gemini', 'cursor-agent', 'aider', 'goose', 'qwen', 'crush']);
+// Antigravity's CLI runs as `antigravity` (the kernel's name for the binary Homebrew links as `agy`). Gemini CLI stays on
+// the list though SynaBun no longer drives it: an agent the user still runs never holds the owner's authority either.
+export const AGENT_NAMES = Object.freeze(['claude', 'codex', 'opencode', 'agy', 'antigravity', 'gemini', 'cursor-agent', 'aider', 'goose', 'qwen', 'crush']);
+/** The agent backend of the Antigravity app and IDE (a `language_server` inside their bundles: Codeium's name, so only by its place). */
+const ANTIGRAVITY_SERVER_RE = /\/antigravity(?: ide)?\.app\/contents\/resources\/(?:app\/extensions\/[^/]+\/)?bin\/language_server/i;
 /** Browsers the owner browses with (their bundle or their network process): never taken for a relay because they
  *  happen to hold a listening socket; an automation flag on them is still refused. */
 const BROWSER_BUNDLE_RE = /\/(?:safari|google chrome(?: beta| dev| canary)?|chromium|firefox(?: developer edition| nightly)?|arc|brave browser(?: beta| nightly)?|microsoft edge(?: beta| dev| canary)?|opera(?: gx)?|vivaldi|orion|zen(?: browser)?|thorium|comet|dia|sigmaos|yandex|duckduckgo|sidekick|wavebox|island)\.app\/|\/synabun\.app\/contents\/(?:macos\/synabun(?:\s|$)|frameworks\/synabun helper)/i;
@@ -275,10 +279,12 @@ export function processKinds({ ucomm = '', comm = '', args = '' } = {}) {
   else if (/(?:^|\s)-juggler(?:-pipe)?(?:\s|$)/.test(la) || /(?:^|\s)--?marionette(?:\s|$)/.test(la)) automation = 'Firefox automation';
 
   let agent = has(AGENT_NAMES);
+  if (agent === 'agy') agent = 'antigravity';
   if (!agent) {
     if (/\/claude\/versions\/[^/\s]+(?:\s|$)/.test(la) || /@anthropic-ai\/claude-code\/cli\.m?js(?:\s|$)/.test(la) || /@anthropic-ai\/claude-agent-sdk[^/\s]*\/claude(?:\s|$)/.test(la)) agent = 'claude';
     else if (/@openai\/codex\/bin\/codex(?:\.js)?(?:\s|$)/.test(la) || /(?:^|\s|\/)codex\s+(?:app-server|exec|mcp(?:-server)?|proto)\b/.test(la)) agent = 'codex';
     else if (/(?:^|\s|\/)opencode\s+serve\b/.test(la)) agent = 'opencode';
+    else if (/(?:^|\s|\/)(?:agy|antigravity)\s+acp\b/.test(la) || ANTIGRAVITY_SERVER_RE.test(c || a)) agent = 'antigravity';
     else if (/@google\/gemini-cli\//.test(la)) agent = 'gemini';
   }
 
@@ -402,6 +408,27 @@ export function isSynabunMcpServer(proc, { roots = [], cwd = null, realpath = nu
   return typeof real === 'string' && targets.has(real);
 }
 
+// ── Processes SynaBun starts for an agent ────────────────────────────────────
+//
+// A command an agent runs through SynaBun (the Antigravity panel's client terminals, lib/antigravity/acp-client-host.js)
+// is a child of this server, not of the agent, so no agent is in its process tree by name. Its pid is registered here
+// while it runs, and a chain that passes through one is an agent's tree. Like the name rule, a command that detaches
+// from its parent (and so from the chain) is not seen.
+const AGENT_PROCESSES = new Map(); // pid -> label
+
+/** A process SynaBun started on an agent's behalf: its tree never holds the owner's authority while it runs. */
+export function registerAgentProcess(pid, label = 'agent command') {
+  if (Number.isInteger(pid) && pid > 1) AGENT_PROCESSES.set(pid, String(label || 'agent command').slice(0, 80));
+}
+/** That process ended (its pid can be reused). */
+export function forgetAgentProcess(pid) {
+  AGENT_PROCESSES.delete(pid);
+}
+/** The registered processes (for tests and diagnostics). */
+export function agentProcesses() {
+  return new Map(AGENT_PROCESSES);
+}
+
 /**
  * Whether the process at the client end of a connection, and its parents, may hold the owner's authority.
  * @param {Array<{pid:number, ppid:number, ucomm:string, comm:string, args:string}>} chain the peer first, then its
@@ -409,9 +436,10 @@ export function isSynabunMcpServer(proc, { roots = [], cwd = null, realpath = nu
  * @param {{ selfPid:number, listening:Set<number>, synabunMcp?:number }} o `synabunMcp`: the peer's pid when it is
  *   SynaBun's own MCP server over HTTP (isSynabunMcpServer): not refused as a relay, refused like an agent's tree
  *   (kind 'synabun-mcp': lib/owner-authority.js takes its pinned calls as an agent's own)
+ *   `agentPids`: processes SynaBun started for an agent (registerAgentProcess), refused like an agent's tree
  * @returns {{ self:boolean, refuse: null | { why:string, kind:string, pid:number, name:string } }}
  */
-export function classifyPeerChain(chain, { selfPid = process.pid, listening = new Set(), synabunMcp = 0 } = {}) {
+export function classifyPeerChain(chain, { selfPid = process.pid, listening = new Set(), synabunMcp = 0, agentPids = AGENT_PROCESSES, debugClient = null } = {}) {
   const list = Array.isArray(chain) ? chain : [];
   if (!list.length) return { self: false, refuse: null };
   if (list[0].pid === selfPid) return { self: true, refuse: null };
@@ -419,12 +447,20 @@ export function classifyPeerChain(chain, { selfPid = process.pid, listening = ne
   const refuse = (p, kind, why) => ({ self: false, refuse: { kind, why, pid: p.pid, name: nameOf(p) } });
   const peerKinds = processKinds(list[0]);
   const mcp = Number(synabunMcp) > 0 && list[0].pid === Number(synabunMcp);
+  let exempted = false;
   for (let i = 0; i < list.length; i++) {
     const p = list[i];
     if (!p || p.pid === selfPid || p.pid <= 1) break; // this server's own ancestry, and launchd, are not the peer's
     const k = i === 0 ? peerKinds : processKinds(p);
-    if (k.automation) return refuse(p, 'automation-browser', `a browser started for automation (${k.automation})`);
+    // Local profiling (SYNABUN_ALLOW_DEBUG_CLIENT, debugClientPolicy): only the remote-debugging flag is forgiven, and
+    // only on the port the policy names; every other rule below still applies to this process and its parents. The
+    // process holds its debug port open itself, so the listener rule is not asked of that one process.
+    const debugOk = !!k.automation && debugClientExempt(p, k, debugClient);
+    if (debugOk) exempted = true;
+    if (k.automation && !debugOk) return refuse(p, 'automation-browser', `a browser started for automation (${k.automation})`);
     if (k.agent) return refuse(p, 'agent', `an AI agent's process tree (${k.agent})`);
+    const startedFor = agentPids?.get?.(p.pid);
+    if (startedFor) return refuse(p, 'agent', `an AI agent's process tree (${startedFor}, started by SynaBun)`);
     if (k.synabun) return refuse(p, 'synabun-instance', 'another SynaBun server');
     if (k.remoteLogin) return refuse(p, 'remote-login', 'a remote login session (sshd)');
     // SynaBun's own MCP server over HTTP relays for its MCP clients by design: not refused as a relay or a listener
@@ -434,12 +470,47 @@ export function classifyPeerChain(chain, { selfPid = process.pid, listening = ne
     // A program that serves TCP itself and calls SynaBun is relaying for whoever reached it (a dev server's proxy,
     // a small SOCKS / HTTP proxy). The owner's browsers are left out of this one rule (their network process, or a
     // browser that holds a socket for its own reasons): their automation flags are what is asked of them.
-    if (i <= 1 && !peerKinds.browser && listening.has(p.pid)) return refuse(p, 'listener', 'a program that also listens for connections (a relay or proxy)');
+    if (i <= 1 && !peerKinds.browser && !debugOk && listening.has(p.pid)) return refuse(p, 'listener', 'a program that also listens for connections (a relay or proxy)');
   }
+  if (exempted && !mcp) return { self: false, refuse: null, debugExempt: true };
   if (mcp) return refuse(list[0], 'synabun-mcp', 'SynaBun\'s own MCP server over HTTP (it calls for whichever MCP client reached it)');
   return { self: false, refuse: null };
 }
 
+// ── Local profiling exemption (off unless the server's own environment asks) ─
+//
+// SYNABUN_ALLOW_DEBUG_CLIENT=1 (any debug port) or =<port> (only --remote-debugging-port=<port>) lets a client process
+// started with --remote-debugging-port hold the owner's authority, so SynaBun's own window can be profiled over CDP.
+// Read from the environment the server was started with only (server.js reads it before DATA_HOME/.env is loaded:
+// never from a file a client can write), loopback peers only (127.0.0.0/8, ::1), and only that flag: a
+// --remote-debugging-pipe, MoreLogin, Playwright WebKit / Firefox automation, agents, relays and every other rule
+// still refuse.
+
+/** The policy from an environment object: { enabled, port } (port null = any). Anything but 1/on/true/yes or a port is off. */
+export function debugClientPolicy(env = process.env) {
+  const raw = String(env?.SYNABUN_ALLOW_DEBUG_CLIENT ?? '').trim().toLowerCase();
+  if (/^(?:1|on|true|yes)$/.test(raw)) return { enabled: true, port: null };
+  if (/^[0-9]{4,5}$/.test(raw) && Number(raw) >= 1024 && Number(raw) <= 65535) return { enabled: true, port: Number(raw) };
+  return { enabled: false, port: null };
+}
+
+/** Whether this process's automation flag is the one the policy forgives. */
+export function debugClientExempt(proc, kinds, policy) {
+  if (!policy?.enabled || kinds?.automation !== 'remote debugging') return false;
+  const la = lower(proc?.args);
+  if (/(?:^|\s)--remote-debugging-pipe(?:[=\s]|$)/.test(la)) return false;
+  // The other automation rules are asked as if the flag were not there: MoreLogin, Playwright, Firefox automation.
+  if (MORELOGIN_PATH_RE.test(String(proc?.comm ?? '')) || lower(proc?.ucomm).trim().startsWith('morelogin')) return false;
+  if (/(?:^|\s)--inspector-pipe(?:\s|$)/.test(la) || /\/pw_run\.sh(?:\s|$)/.test(la) || /(?:^|\s)-juggler(?:-pipe)?(?:\s|$)/.test(la) || /(?:^|\s)--?marionette(?:\s|$)/.test(la)) return false;
+  if (/(?:^|\s)--(?:enable-automation|headless)(?:[=\s]|$)/.test(la)) return false;
+  const ports = [...la.matchAll(/(?:^|\s)--remote-debugging-port(?:=|\s+)([0-9]+)(?=\s|$)/g)].map((m) => Number(m[1]));
+  if (!ports.length) return false;
+  return policy.port == null || ports.every((n) => n === policy.port);
+}
+
+/** Whether a normalized address is loopback. */
+export const isLoopbackAddress = (addr) => /^127\.\d+\.\d+\.\d+$/.test(String(addr || '')) || String(addr || '') === '::1';
+
 /** The environment part of `ps -E` output for one process, given the same process's line without -E. */
 export function envPart(withEnv, plain) {
   const w = String(withEnv ?? '');
@@ -496,8 +567,10 @@ function thisMachineAddresses() {
  *   is told apart from other listening programs (isSynabunMcpServer). None: it is refused as a listener, as any relay.
  * @param {(path:string) => string} [o.realpath] fs.realpathSync (tests inject one).
  */
-export function createPeerIdentity({ platform = process.platform, selfPid = process.pid, run = defaultRun, localAddresses = null, log = () => {}, now = Date.now, disabled = false, synabunRoots = [], realpath = realpathSync } = {}) {
+export function createPeerIdentity({ platform = process.platform, selfPid = process.pid, run = defaultRun, localAddresses = null, log = () => {}, now = Date.now, disabled = false, synabunRoots = [], realpath = realpathSync, debugClient = null } = {}) {
   const supported = platform === 'darwin' && !disabled;
+  const debugPolicy = debugClient?.enabled ? { enabled: true, port: Number.isInteger(debugClient.port) ? debugClient.port : null } : null;
+  if (debugPolicy) { try { log(`[peer-identity] WARNING: SYNABUN_ALLOW_DEBUG_CLIENT is set: a loopback client started with --remote-debugging-port${debugPolicy.port ? `=${debugPolicy.port}` : ''} is taken as the owner (local profiling only; unset it when done)`); } catch { /* logger */ } }
   if (disabled) { try { log('[peer-identity] off (SYNABUN_PEER_IDENTITY=off): the page secret\'s rules from before apply, with no peer lookup'); } catch { /* logger */ } }
   const bySocket = new WeakMap();
   const chains = new Map(); // pid → { at, ucomm, chain }
@@ -649,7 +722,8 @@ export function createPeerIdentity({ platform = process.platform, selfPid = proc
     if (!chain || !chain.length) return { status: 'gone', reason: 'the client process exited before it was identified', pid: row.pid, ms: now() - started };
     let synabunMcp = 0;
     try { synabunMcp = await synabunMcpPid(chain[0], table.listening); } catch { synabunMcp = 0; }
-    const verdict = classifyPeerChain(chain, { selfPid, listening: table.listening, synabunMcp });
+    const verdict = classifyPeerChain(chain, { selfPid, listening: table.listening, synabunMcp, debugClient: isLoopbackAddress(remote) ? debugPolicy : null });
+    if (verdict.debugExempt) note(`debug:${row.pid}`, `[peer-identity] WARNING: accepted a debug client as the owner (pid ${row.pid}, ${row.name || chain[0].ucomm}) under SYNABUN_ALLOW_DEBUG_CLIENT`);
     return { status: 'ok', self: verdict.self, pid: row.pid, name: row.name || chain[0].ucomm, chain, refuse: verdict.refuse, ms: now() - started };
   }
 

package/neural-interface/lib/pty-host/core.js

@@ -19,6 +19,7 @@ import { evaluateFlow } from './flow.js';
 import { EV, OP, HOST_DEFAULTS } from './protocol.js';
 import { createEventLoopMonitor } from '../event-loop-monitor.js';
 import { withPathEnv } from '../augmented-path.js';
+import { killOwnedPty } from './lifetime.js';
 
 const IS_WIN = process.platform === 'win32';
 const IS_LINUX = process.platform === 'linux';
@@ -39,8 +40,14 @@ export function createPtyHostCore({ send, config = {}, pty: injectedPty = null }
   let pty = injectedPty;
   let ptyError = null;
   let shuttingDown = false;
+  let shutdownTimer = null;
 
   const emit = (msg) => { try { send(msg); } catch {} };
+  // Covers process.exit(), including host.js's bounded shutdown, and the
+  // in-process transport. This must be synchronous: exit cannot await PTYs.
+  const onOwnerExit = () => {
+    for (const s of sessions.values()) if (!s.exited) killOwnedPty(s.proc.pid);
+  };
 
   // ── Startup ──
   async function init() {
@@ -65,6 +72,10 @@ export function createPtyHostCore({ send, config = {}, pty: injectedPty = null }
   // ── Spawn ──
   function spawnSession(spec) {
     const { id } = spec;
+    if (shuttingDown) {
+      emit({ t: EV.SPAWN_ERROR, id, message: 'Terminal host is shutting down' });
+      return;
+    }
     if (!id || sessions.has(id)) {
       emit({ t: EV.SPAWN_ERROR, id, message: 'Duplicate or missing session id' });
       return;
@@ -133,6 +144,7 @@ export function createPtyHostCore({ send, config = {}, pty: injectedPty = null }
       graceTimer: null,
       exited: false,
     };
+    if (!sessions.size) process.once('exit', onOwnerExit);
     sessions.set(id, s);
     counters.spawns++;
 
@@ -490,6 +502,11 @@ export function createPtyHostCore({ send, config = {}, pty: injectedPty = null }
     for (const f of s.tempFiles.splice(0)) unlink(f).catch(() => {});
     try { s.model.dispose(); } catch {}
     sessions.delete(s.id);
+    if (!sessions.size) {
+      process.removeListener('exit', onOwnerExit);
+      clearTimeout(shutdownTimer);
+      shutdownTimer = null;
+    }
   }
 
   function killSession(s, signal) {
@@ -571,7 +588,11 @@ export function createPtyHostCore({ send, config = {}, pty: injectedPty = null }
     return out;
   }
 
-  function shutdownAll() {
+  function shutdownAll({ force = false } = {}) {
+    // The server's synchronous exit handler kills itself before later exit
+    // listeners can run. Its killNow() path must reap the PTYs right here.
+    if (force) onOwnerExit();
+    if (shuttingDown) return;
     shuttingDown = true;
     for (const s of sessions.values()) {
       s.draining = true;
@@ -581,6 +602,12 @@ export function createPtyHostCore({ send, config = {}, pty: injectedPty = null }
     for (const s of sessions.values()) {
       for (const c of s.clients) { try { c.ws.close(1001, 'terminal host shutting down'); } catch {} }
     }
+    // HUP can be ignored, or arrive while the macOS helper is attaching.
+    // Bound the grace period in both transports, even if the owner stays up.
+    if (sessions.size) {
+      shutdownTimer = setTimeout(onOwnerExit, 100);
+      shutdownTimer.unref?.();
+    }
   }
 
   function dispose() {

package/neural-interface/lib/pty-host/lifetime.js

@@ -0,0 +1,12 @@
+// node-pty's macOS helper starts a new session before exec. If its host dies
+// before the helper acquires the controlling terminal, closing the master
+// does not hang it up. Kill the known PTY process group as well as its leader.
+// Callers must forget a PID on EXIT: these are owned children, never a sweep
+// of unrelated processes or a list retained across host restarts.
+export function killOwnedPty(pid, { kill = process.kill, platform = process.platform } = {}) {
+  if (!Number.isSafeInteger(pid) || pid <= 1) return;
+  if (platform !== 'win32') {
+    try { kill(-pid, 'SIGKILL'); } catch {}
+  }
+  try { kill(pid, 'SIGKILL'); } catch {}
+}