synabun 2.1.0 → 2.2.1

package/neural-interface/lib/worker-resume.js

@@ -65,12 +65,15 @@ export function resumeSandboxPlan(current, previous, channelPort) {
  */
 export function resumeRefusal(entry, { now = Date.now(), workLeftMs = Infinity, atShutdown = false, isDirectory = () => true, accountUnusable = () => '' } = {}) {
   if (!entry) return 'the run is not known';
-  if (!['claude-code', 'codex', 'opencode'].includes(entry.provider)) return 'this provider cannot continue after a restart';
+  if (!['claude-code', 'codex', 'opencode', 'antigravity'].includes(entry.provider)) return 'this provider cannot continue after a restart';
   if (entry.confinement?.kind === 'skill-eval') return 'a skill evaluation run is a measurement and starts over instead';
   if (entry.confinement) return 'a skill drafting run is not resumed';
   if (entry.removedAt) return 'the run was removed';
-  if (!(entry.provider === 'codex' ? entry.providerThreadId : entry.providerSessionId)) return `its ${entry.provider === 'codex' ? 'Codex thread' : entry.provider === 'opencode' ? 'OpenCode session' : 'Claude session'} had not started yet`;
+  if (!(entry.provider === 'codex' ? entry.providerThreadId : entry.providerSessionId)) return `its ${entry.provider === 'codex' ? 'Codex thread' : entry.provider === 'opencode' ? 'OpenCode session' : entry.provider === 'antigravity' ? 'Antigravity session' : 'Claude session'} had not started yet`;
   if (entry.provider === 'opencode' && !entry.resumeInfo?.persistentOpenCode) return 'its OpenCode session has no durable run data';
+  // Antigravity keeps the conversation in the run's own home (lib/antigravity/home.js): a run started before homes
+  // existed has its session in the user's own ~/.gemini, which a resume does not use.
+  if (entry.provider === 'antigravity' && !entry.resumeInfo?.antigravityHome) return 'its Antigravity session has no SynaBun home to resume from';
   const resumes = Number(entry.resumes) || 0;
   if (resumes >= MAX_RESUMES) return `it was resumed ${resumes} times already`;
   if (!(workLeftMs > 0)) return entry.maxMinutes ? `its ${entry.maxMinutes} minutes of work time are used up` : 'its work time is used up';
@@ -79,7 +82,8 @@ export function resumeRefusal(entry, { now = Date.now(), workLeftMs = Infinity,
   if (since && now - since > RESUME_WINDOW_MS) return `the server was back ${Math.round((now - since) / 60_000)} minutes later (more than ${Math.round(RESUME_WINDOW_MS / 60_000)})`;
   if (!entry.cwd || !isDirectory(entry.cwd)) return `its working directory is gone (${entry.cwd || 'none'})`;
   let unusable = '';
-  try { unusable = entry.provider === 'opencode' ? '' : String(accountUnusable((entry.provider === 'codex' ? entry.codexAccountId : entry.claudeAccountId) || 'default', entry.provider, entry) || ''); } catch (error) { unusable = error?.message || 'it could not be read'; }
+  // OpenCode and Antigravity sign in inside their own CLI: SynaBun keeps no account of theirs.
+  try { unusable = entry.provider === 'opencode' || entry.provider === 'antigravity' ? '' : String(accountUnusable((entry.provider === 'codex' ? entry.codexAccountId : entry.claudeAccountId) || 'default', entry.provider, entry) || ''); } catch (error) { unusable = error?.message || 'it could not be read'; }
   if (unusable) return `its ${entry.provider === 'codex' ? 'Codex' : 'Claude'} account (${entry.codexAccountId || entry.claudeAccountId || 'default'}) cannot be used: ${unusable}`;
   return null;
 }
@@ -184,7 +188,12 @@ export function processCommandLine(pid, { platform = process.platform, run = exe
  */
 export function isRunCliCommand(command, runId) {
   const text = String(command || '');
-  return !!runId && text.includes(String(runId)) && ((text.includes('--input-format') && text.includes('stream-json')) || (text.includes('app-server') && text.includes('synabun_worker_run=')));
+  return !!runId && text.includes(String(runId)) && (
+    (text.includes('--input-format') && text.includes('stream-json'))
+    || (text.includes('app-server') && text.includes('synabun_worker_run='))
+    // Antigravity: `agy acp --gemini-dir <data home>/runtime/antigravity/homes/run-<run id>-…` (lib/antigravity/home.js).
+    || (/\sacp(?:\s|$)/.test(text) && text.includes('--gemini-dir') && /[\\/]antigravity[\\/]homes[\\/]run-/.test(text))
+  );
 }
 
 /** Windows: end a process and every process it started (taskkill /T /F, as the server's own shutdown does). */

package/neural-interface/lib/worker-sandbox.js

@@ -19,13 +19,32 @@
 //     interface IPs and its hostname — while a different port and the public internet stay open. The earlier
 //     `localhost:<port>` literal did NOT cover [::ffff:127.0.0.1] (a verified full bypass of the whole layer on the
 //     dual-stack listener): Seatbelt's `localhost` resolves to 127.0.0.1 + ::1 only. The host literal must be `*`
-//     or `localhost` (a numeric IP literal is rejected by the parser); `*` is the only form that is address-proof.
+//     or `localhost` (a numeric IP literal, with or without a CIDR suffix, is rejected by the parser: "host must be
+//     * or localhost in network address"); `*` is the only form that is address-proof.
 //     Seatbelt has no port-range syntax (`*:4120-4400` is rejected), so a reserved range is emitted one port a line.
 //   • `(deny file-read* file-write* (subpath "<canonical>"))` blocks reads AND writes under a path; a later
 //     `(allow file-read* file-write* (subpath "<canonical>"))` wins (Seatbelt is last-match-wins within a filter),
 //     so SynaBun's whole data home can be denied and the run's own scratch / cwd / config folder allowed back after
 //     it. Seatbelt matches the RESOLVED path, so every literal must be canonicalised (/tmp is a symlink to
 //     /private/tmp; an un-resolved literal never matches, and an allow-back must resolve the same way as its deny).
+//   • macOS 27 (27.2 / 26B123, confirmed with scratch sandbox-exec probes outside the repo, 2026-11-01): a
+//     `(deny network-outbound (remote ip …))` rule placed textually AFTER an `(allow network-outbound (remote ip
+//     …))` rule silently defeats that allow — even when the deny's port is completely unrelated to the allow's
+//     (e.g. a later `deny *:4096` broke an earlier `allow localhost:9` for a different, unrelated port 9). This
+//     held on every literal form tried (`localhost` and `*` alike), so it is not about the host literal at all —
+//     it is purely textual position. A deny is never undone by what comes after it, and a later allow for one port
+//     never reopens a different, already-denied port — only "deny AFTER allow, different port" misbehaves. A
+//     same-port pair (a broad `*:<port>` allow immediately followed by a narrower `localhost:<port>` deny, the
+//     INTERNET_PORTS local-redeny below) still narrows correctly on 27.2: last-match-wins for an overlapping
+//     filter is unaffected, confirmed by direct probe. The fix is purely about ORDER, so buildWorkerSandboxProfile
+//     emits every plain port/range deny FIRST, then the strict profile's own allow-then-narrow pair for
+//     INTERNET_PORTS, then the worker-channel allow(s) dead last among network-outbound rules — nothing (deny)
+//     ever follows them, on macOS 26 or 27. This does not widen anything: the channel allow keeps the narrow
+//     `localhost:<port>` literal (still local-only on both macOS versions), and the reorder also fixes a second,
+//     previously-undetected collateral regression — the strict profile's own INTERNET_PORTS allow-back (meant to
+//     keep DNS/SSH/HTTP/HTTPS reachable on real remote hosts) was equally defeated by the later control-port and
+//     reserved-range denies that used to sit between it and nothing; a guarded worker in the strict fallback had
+//     silently lost the public internet too.
 //   • The sandbox is inherited by detached / nohup grandchildren, so a worker cannot escape it by backgrounding.
 //   • A same-user `KERN_PROCARGS2` read (ps -E / a tiny C program) CANNOT be blocked by Seatbelt (it is a same-uid
 //     kernel allowance, not a sandbox-governed operation). So a worker inside the sandbox can still read another
@@ -166,6 +185,10 @@ function metadataAncestors(allowPaths, denyPaths) {
  *                               spelling (the IPv4-mapped one included); Seatbelt's `localhost` misses [::ffff:…],
  *                               and mixing `ip6` rules with `localhost` ones silently re-opens IPv4 loopback (verified
  *                               on macOS 26), so this is written as deny-all-then-allow, never as a loopback deny.
+ *                               On macOS 27 a later deny for an unrelated port defeats an earlier allow (see the
+ *                               module header), so every network-outbound ALLOW rule this emits — the strict
+ *                               profile's INTERNET_PORTS allow-back and the channel allow(s) — is placed after
+ *                               every plain port/range deny, with the channel allow(s) last of all.
  * @param {string} [o.note] a short comment line (the run id), for readability in a log.
  * @returns {string} the profile text (ends with a newline).
  */
@@ -177,34 +200,41 @@ export function buildWorkerSandboxProfile({ denyPorts = [], denyLocalPorts = [],
     ? { from: Math.max(1, Number(denyPortRange.from)), to: Math.min(65535, Number(denyPortRange.to)) } : null;
   const denies = [...new Set((denyPaths || []).filter((p) => typeof p === 'string' && p).map(canonicalPath))];
   const allows = [...new Set((allowPaths || []).filter((p) => typeof p === 'string' && p).map(canonicalPath))];
+  const channelPorts = strictLocal ? cleanPorts(strictLocal.allowPorts) : [];
   const lines = ['(version 1)'];
   if (note) lines.push(`; ${String(note).replace(/[\r\n]+/g, ' ').slice(0, 200)}`);
   lines.push('(allow default)');
   if (strictLocal) {
     // Detection failed: nothing local is known to be safe, so nothing local is reachable but the worker channel.
-    // Deny every outbound IP connection, allow the internet's ports back on every host, take them away again on this
-    // computer's own addresses, and allow the channel last (last match wins).
     lines.push('; strict: the relay detection failed for this run, so no local port is reachable but the worker channel');
     lines.push(`(deny network-outbound (remote ip ${sexpr('*:*')}))`);
-    for (const port of INTERNET_PORTS) lines.push(`(allow network-outbound (remote ip ${sexpr(`*:${port}`)}))`);
-    for (const port of INTERNET_PORTS) if (port !== 53) localOnly.add(port); // a local DNS resolver stays reachable
-    for (const port of cleanPorts(strictLocal.allowPorts)) {
-      localOnly.delete(port);
-      lines.push(`(allow network-outbound (remote ip ${sexpr(`localhost:${port}`)}))`);
-    }
   }
-  // The control ports: a worker's own programs may not open them (its MCP tools are the way in). `*:<port>` blocks
-  // the port on every address (127.0.0.1, ::1, [::ffff:127.0.0.1], 0.0.0.0, the LAN IPs, the hostname); the public
-  // internet and every other port stay open.
+  // The control ports and the reserved relay range FIRST, before any allow rule below: on macOS 27 a later deny
+  // here would defeat an earlier allow for an unrelated port (module header). A plain deny is never undone by
+  // what follows it, so their own position relative to each other never matters.
   const seen = new Set();
   for (const port of ports) { seen.add(port); lines.push(`(deny network-outbound (remote ip ${sexpr(`*:${port}`)}))`); }
-  // Local-only denies (an internet port a relay holds here, local SSH): this computer's own addresses, never the internet.
+  // The reserved relay range in full: every isolated OpenCode serve, whether it started before or after this profile.
+  if (range) for (let p = range.from; p <= range.to; p++) { if (!seen.has(p)) { seen.add(p); lines.push(`(deny network-outbound (remote ip ${sexpr(`*:${p}`)}))`); } }
+  if (strictLocal) {
+    // Allow the internet's ports back on every host, then narrow them to this computer's own addresses right
+    // after (same port: last-match-wins narrows it locally, unaffected by the macOS 27 ordering issue above,
+    // which is about an unrelated port's deny, not a same-port narrowing pair).
+    for (const port of INTERNET_PORTS) if (port !== 53) localOnly.add(port); // a local DNS resolver stays reachable
+    for (const port of channelPorts) localOnly.delete(port);
+    for (const port of INTERNET_PORTS) lines.push(`(allow network-outbound (remote ip ${sexpr(`*:${port}`)}))`);
+  }
+  // Local-only denies (an internet port a relay holds here, local SSH): this computer's own addresses, never the
+  // internet. In strict mode these sit right after the INTERNET_PORTS allow-back above (the same-port narrowing
+  // pair); otherwise there is no preceding allow to narrow and the position carries no ordering requirement.
   for (const port of [...new Set([...localOnly, ...ALWAYS_LOCAL_DENY_PORTS])].sort((x, y) => x - y)) {
-    if (strictLocal && cleanPorts(strictLocal.allowPorts).includes(port)) continue;
+    if (channelPorts.includes(port)) continue;
     lines.push(`(deny network-outbound (remote ip ${sexpr(`localhost:${port}`)}))`);
   }
-  // The reserved relay range in full: every isolated OpenCode serve, whether it started before or after this profile.
-  if (range) for (let p = range.from; p <= range.to; p++) { if (!seen.has(p)) { seen.add(p); lines.push(`(deny network-outbound (remote ip ${sexpr(`*:${p}`)}))`); } }
+  // The worker channel, allowed dead last among every network-outbound rule above: on macOS 27 any later deny —
+  // even for a wholly unrelated port — would silently defeat this allow (module header). Kept local-only
+  // (`localhost:<port>`, not `*:<port>`): still unreachable from a remote host on this exact port, on macOS 26 and 27.
+  for (const port of channelPorts) lines.push(`(allow network-outbound (remote ip ${sexpr(`localhost:${port}`)}))`);
   // SynaBun's whole data home (its auth secrets, other runs' task text, the memory DB) and other runtimes' creds:
   // a worker neither reads nor writes them.
   for (const path of denies) lines.push(`(deny file-read* file-write* (subpath ${sexpr(path)}))`);

package/neural-interface/package-lock.json

@@ -1,15 +1,16 @@
 {
   "name": "neural-memory-interface",
-  "version": "2.1.0",
+  "version": "2.2.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "neural-memory-interface",
-      "version": "2.1.0",
+      "version": "2.2.1",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
+        "@agentclientprotocol/sdk": "2.2.0",
         "@anthropic-ai/claude-agent-sdk": "0.3.288",
         "@huggingface/transformers": "^3.0.0",
         "@openai/codex-sdk": "^0.160.0",
@@ -57,6 +58,21 @@
         "node": ">=22.19.0"
       }
     },
+    "node_modules/@agentclientprotocol/sdk": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@agentclientprotocol/sdk/-/sdk-2.2.0.tgz",
+      "integrity": "sha512-o1+eDQVb05yzPY+5v54awHyONU1oeLsbLVavkwrMQaZDuJDh/38pQiXJS4ix4d6QA3Y4bU0lHFRjwg99KKKSaQ==",
+      "license": "Apache-2.0",
+      "peerDependencies": {
+        "@modelcontextprotocol/server": "^2.4.0",
+        "zod": "^3.25.76 || ^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@modelcontextprotocol/server": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/@antfu/install-pkg": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/@antfu/install-pkg/-/install-pkg-2.1.0.tgz",

package/neural-interface/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neural-memory-interface",
-  "version": "2.1.0",
+  "version": "2.2.1",
   "private": true,
   "description": "Private local SynaBun interface for memory visualization and multi-agent workflows",
   "license": "Apache-2.0",
@@ -21,6 +21,7 @@
     "postinstall": "node scripts/rebuild-pty.js && node scripts/build-vendor.mjs"
   },
   "dependencies": {
+    "@agentclientprotocol/sdk": "2.2.0",
     "@anthropic-ai/claude-agent-sdk": "0.3.288",
     "@huggingface/transformers": "^3.0.0",
     "@openai/codex-sdk": "^0.160.0",

package/neural-interface/public/onboarding.html

@@ -1489,7 +1489,7 @@ const wizardState = {
 // `id` is also the host name of the rules API (/api/setup/rules/:host).
 const TOOLS = [
   { id: 'claude',   name: 'Claude Code', api: '/api/claude-code/mcp', configPath: '~/.claude.json' },
-  { id: 'gemini',   name: 'Gemini CLI',  api: '/api/setup/gemini/mcp', configPath: '~/.gemini/settings.json' },
+  { id: 'antigravity', name: 'Antigravity CLI', api: '/api/setup/antigravity/mcp', configPath: '~/.gemini/config/mcp_config.json' },
   { id: 'codex',    name: 'Codex CLI',   api: '/api/setup/codex/mcp',  configPath: '~/.codex/config.toml' },
   { id: 'opencode', name: 'OpenCode',    api: '/api/opencode/mcp',     configPath: '~/.config/opencode/opencode.json' },
 ];

package/neural-interface/public/shared/agent-runtime-options.js

@@ -6,16 +6,36 @@ import { fetchOpencodeProviders, opencodeProviders } from './opencode-providers.
 export const CLI_PROFILES = [
   { id: 'claude-code', label: 'Claude Code', desc: 'Anthropic' },
   { id: 'codex', label: 'Codex CLI', desc: 'OpenAI' },
-  { id: 'gemini', label: 'Gemini CLI', desc: 'Google' },
+  { id: 'antigravity', label: 'Antigravity CLI', desc: 'Google' },
   { id: 'opencode', label: 'OpenCode CLI', desc: 'Multi-provider' },
 ];
 
-const STATIC_MODELS = {
-  gemini: [
-    { id: 'gemini-2.5-pro', label: '2.5 Pro', desc: 'Most capable', tier: 'default' },
-    { id: 'gemini-2.5-flash', label: '2.5 Flash', desc: 'Lightweight' },
-  ],
-};
+// Google Antigravity replaced the Gemini CLI (provider id `gemini` → `antigravity`). What was saved before
+// (a launch profile, a resume tab, a template's CLI or icon) can still say `gemini`: it reads as Antigravity.
+// The server moves its own files the same way (lib/antigravity/migrate-gemini.js).
+export function migrateProviderId(id) { return id === 'gemini' ? 'antigravity' : id; }
+
+// The Gemini CLI's own model ids (gemini-1.x, gemini-2.x) are not Antigravity's: one saved for it reads as
+// none, so Antigravity's default runs (the same rule as isGeminiCliModel in lib/antigravity/migrate-gemini.js).
+const GEMINI_CLI_MODEL_RE = /^gemini-[12](?:[.-]|$)/i;
+export function migrateProviderModel(profileId, model) {
+  return migrateProviderId(profileId) === 'antigravity' && typeof model === 'string' && GEMINI_CLI_MODEL_RE.test(model.trim()) ? null : model;
+}
+
+/** Saved launch records (loop templates, schedules, groups, timers) with a Gemini CLI profile or icon read as Antigravity's. */
+export function migrateLaunchRecords(list) {
+  if (!Array.isArray(list)) return list;
+  return list.map((record) => {
+    if (!record || typeof record !== 'object' || (record.profile !== 'gemini' && record.icon !== 'gemini')) return record;
+    const next = { ...record };
+    if (next.icon === 'gemini') next.icon = migrateProviderId(next.icon);
+    if (next.profile === 'gemini') {
+      next.profile = migrateProviderId(next.profile);
+      if (migrateProviderModel(next.profile, next.model) !== next.model) next.model = null;
+    }
+    return next;
+  });
+}
 
 // Claude Code models are discovered live from the installed CLI via
 // /api/claude/models (see lib/claude-model-catalog.js) — the CLI is the only
@@ -59,6 +79,15 @@ export const EFFORT_LEVELS_BY_PROFILE = {
     { id: 'max', label: 'Max', desc: 'Maximum' },
     { id: 'ultra', label: 'Ultra', desc: 'Maximum, with delegation', tier: 'top' },
   ],
+  // The levels `agy --effort` takes; `off` passes none, so Antigravity uses its own default.
+  antigravity: [
+    { id: 'off', label: 'Default', desc: 'Model default' },
+    { id: 'low', label: 'Low', desc: 'Light' },
+    { id: 'medium', label: 'Med', desc: 'Balanced' },
+    { id: 'high', label: 'High', desc: 'Deep' },
+    { id: 'xhigh', label: 'XHigh', desc: 'Very deep' },
+    { id: 'max', label: 'Max', desc: 'Maximum', tier: 'top' },
+  ],
 };
 
 // One effort vocabulary, lowest first (the server keeps the same table in
@@ -145,14 +174,16 @@ let _opencodeModelsCache = null;
 let _opencodeModelsLoading = null;
 let _claudeModelsCache = null;
 let _claudeModelsLoading = null;
+let _antigravityModelsCache = null;
+let _antigravityModelsLoading = null;
 let _toolCatalog = null;
 const _toolCatalogLoads = new Map();
 const _toolCatalogByCwd = new Map();
 const _toolCatalogAt = new Map();
 let _toolCatalogEpoch = 0;
 
-// The verified Claude and Codex lists are also kept in sessionStorage (this tab only): after a reload the
-// pickers paint from them at once (a list read back is due, so the first load still asks the server).
+// The verified Claude, Codex and Antigravity lists are also kept in sessionStorage (this tab only): after a reload
+// the pickers paint from them at once (a list read back is due, so the first load still asks the server).
 const LIST_STORE_PREFIX = 'synabun:runtime-models:v1:';
 function keepList(key, list) {
   try { if (typeof sessionStorage !== 'undefined') sessionStorage.setItem(LIST_STORE_PREFIX + key, JSON.stringify(list)); } catch { /* full or unavailable */ }
@@ -169,6 +200,8 @@ function keptList(key) {
   if (claude && !_claudeModelsCache) _claudeModelsCache = claude;
   const codex = keptList('codex:default');
   if (codex && !_codexModelsCache.has('default')) _codexModelsCache.set('default', codex);
+  const antigravity = keptList('antigravity');
+  if (antigravity && !_antigravityModelsCache) _antigravityModelsCache = antigravity;
 })();
 
 function localJsonArray(key) {
@@ -538,16 +571,59 @@ export async function fetchClaudeModels(force = false) {
   return _claudeModelsLoading;
 }
 
+// GET /api/antigravity/models answers { models: [{ id, label, description?, default? }], source: 'live' | 'unavailable' }.
+function antigravityModelOption(model) {
+  const id = String(model?.id || '').trim();
+  if (!id) return null;
+  return {
+    id,
+    provider: 'antigravity',
+    cliReady: true,
+    label: String(model.label || id),
+    desc: String(model.description || ''),
+    ...(model.default === true ? { tier: 'default', isDefault: true } : {}),
+  };
+}
+
+// Antigravity's models come only from the installed `agy`: there is no list of SynaBun's own to fall back on,
+// so until it answers the pickers are empty and a launch runs Antigravity's default. A list it gave once is
+// kept through a failed or unavailable answer.
+export async function fetchAntigravityModels(force = false) {
+  if (!force && _antigravityModelsCache?.length && modelListIsFresh('antigravity')) return _antigravityModelsCache;
+  if (_antigravityModelsLoading) return _antigravityModelsLoading;
+  _antigravityModelsLoading = (async () => {
+    try {
+      const resp = await fetch('/api/antigravity/models');
+      const data = await resp.json().catch(() => ({}));
+      const models = resp.ok && data?.source !== 'unavailable' && Array.isArray(data?.models)
+        ? data.models.map(antigravityModelOption).filter(Boolean)
+        : [];
+      if (models.length) {
+        _antigravityModelsCache = models;
+        _modelListAt.set('antigravity', Date.now());
+        keepList('antigravity', models);
+      }
+      return _antigravityModelsCache || [];
+    } catch {
+      return _antigravityModelsCache || [];
+    } finally {
+      _antigravityModelsLoading = null;
+    }
+  })();
+  return _antigravityModelsLoading;
+}
+
 // Profiles whose model list is fetched at runtime rather than baked in. Callers use
 // this to decide whether to kick off an async load and re-render when it lands.
 export function isDynamicModelProfile(profileId) {
-  return profileId === 'opencode' || profileId === 'codex' || profileId === 'claude-code';
+  return profileId === 'opencode' || profileId === 'codex' || profileId === 'claude-code' || profileId === 'antigravity';
 }
 
 export async function ensureModelsForProfile(profileId, force = false, accountId = 'default') {
   if (profileId === 'codex') return fetchCodexModels(force, accountId);
   if (profileId === 'opencode') return fetchOpencodeModels(force);
   if (profileId === 'claude-code') return fetchClaudeModels(force);
+  if (profileId === 'antigravity') return fetchAntigravityModels(force);
   return getModelsForProfile(profileId, accountId);
 }
 
@@ -565,7 +641,8 @@ export function getModelsForProfile(profileId, accountId = 'default') {
   if (profileId === 'codex') return _codexModelsCache.get(String(accountId || 'default')) || [];
   if (profileId === 'opencode') return _opencodeModelsCache || keptOpencodeModels() || [];
   if (profileId === 'claude-code') return _claudeModelsCache || [];
-  return STATIC_MODELS[profileId] || [];
+  if (profileId === 'antigravity') return _antigravityModelsCache || [];
+  return [];
 }
 
 // Live Claude and Codex options are spawn-ready ids. Only legacy Claude options
@@ -678,6 +755,7 @@ export function clearRuntimeOptionCaches() {
   _opencodeModelsCache = null;
   opencodeProviders.invalidate('');
   _claudeModelsCache = null;
+  _antigravityModelsCache = null;
   _modelListAt.clear();
   invalidateToolCatalog(); _toolCatalog = null; _toolCatalogByCwd.clear(); _toolCatalogAt.clear();
   _claudeAccountsCache = null;

package/neural-interface/public/shared/agy/agy-bypass.js

@@ -0,0 +1,47 @@
+// ═══════════════════════════════════════════
+// SynaBun — Antigravity panel: a tab's Bypass (no DOM)
+// ═══════════════════════════════════════════
+//
+// Bypass is a tab's choice, like the Claude Code panel's: off by default, turned on only by the owner in the
+// permissions picker (after one confirm each time), saved with the tab, and stated to the bridge with every session
+// the tab opens (`bypass` on session:new / load / resume) and at once for a running one (session:bypass). The bridge
+// answers each permission request of that session "allow once" itself, except what SynaBun's hard rails refuse
+// (lib/antigravity/bypass.js: the browser policy and the protected folders). A server without the `bypass`
+// capability cannot run it: the pick waits there, shown as unavailable, and the tab asks as before.
+
+export const PERMISSION_DEFAULT = 'default';
+export const PERMISSION_BYPASS = 'bypass';
+
+/** The permissions picker of a tab: its entries, the state the control is styled by and its tooltip. */
+export function bypassControl({ bypass = false, supported = true } = {}, T = (key) => key) {
+  const on = bypass === true;
+  const entries = [
+    { value: PERMISSION_DEFAULT, label: T('permDefault'), title: T('permDefaultHint'), selected: !on },
+    { value: PERMISSION_BYPASS, label: T('permBypass'), title: supported ? T('permBypassHint') : T('permBypassRestart'), selected: on, disabled: !supported && !on },
+  ];
+  if (on && !supported) return { entries, state: 'bypass', waiting: true, title: T('permBypassWaiting') };
+  if (on) return { entries, state: 'bypass', waiting: false, title: T('permBypassOnTitle') };
+  return { entries, state: '', waiting: false, title: supported ? T('permDefaultHint') : T('permBypassRestart') };
+}
+
+/** What a pick in the picker does: { confirm: true } to ask first, { set: boolean } to apply, or null for no change. */
+export function pickPermission(value, { bypass = false, supported = true } = {}) {
+  const want = value === PERMISSION_BYPASS;
+  if (want === (bypass === true)) return null;
+  if (want && !supported) return null;
+  return want ? { confirm: true } : { set: false };
+}
+
+/** A saved tab's Bypass: only a literal true counts (anything else in storage is off). */
+export function restoredBypass(value) {
+  return value === true;
+}
+
+/** A permission:auto event as one transcript row: { severity, text }. */
+export function autoAnswerRow(message, T = (key) => key) {
+  const tool = String(message?.toolCall?.title || message?.toolCall?.kind || T('permTool')).slice(0, 160);
+  if (message?.decision === 'refused') {
+    return { severity: 'error', text: T('permAutoRefused', { tool, reason: String(message.reason || '').slice(0, 400) }) };
+  }
+  return { severity: 'info', text: T('permAutoAllowed', { tool }) };
+}