synabun 2.2.0 → 2.2.1

package/CHANGELOG.md

@@ -1,3 +1,21 @@
+# SynaBun v.2.2.1
+
+2.2.1 is a fix release: shared browser runs work again with MoreLogin, screenshots reach OpenAI models in the Assistant, and the Assistant no longer keeps the CPU busy while a worker runs.
+
+## ✨ New
+
+- **Profiling the app with a debug client** — Developers can set `SYNABUN_ALLOW_DEBUG_CLIENT` to a port when starting SynaBun, so a local browser started with remote debugging on that port can load the app and profile it. It is off unless you set it.
+
+## 🛠 Fixed
+
+- **Shared browser runs refused with an unclear error** — With MoreLogin as the browser, tasks that needed the browser could fail with a generic "unverified OpenCode serve" error even when OpenCode had nothing to do with the task. They now run, and a real refusal names its cause.
+- **Screenshots ignored by OpenAI models in the Assistant** — Screenshots attached with the paperclip or sent from the whiteboard now reach Codex and OpenAI models as images.
+- **High CPU while a worker ran** — The Assistant window used most of a CPU core while a worker was running. It now stays near idle.
+- **Settings showed placeholders for ordinary MCP values** — When hiding secrets in MCP server settings, SynaBun also hid ordinary words such as the project name. Now only real credentials are hidden.
+- **File Explorer git menu hidden under the toolbar** — The branch and commit menu now opens above the top-right toolbar instead of underneath it.
+
+---
+
 # SynaBun v.2.2.0
 
 2.2.0 is a reliability release: it fixes a slow memory buildup in long-running chat panels, makes closing a minimized OpenCode tab actually stop that conversation, and cleans up terminal processes left behind by a crash.

package/README.md

@@ -178,7 +178,7 @@ Everything SynaBun stores is in one folder outside the app: `~/.synabun` on macO
 
 ## Links
 
-- [Changelog](./CHANGELOG.md): what is new in 2.2.0 and before
+- [Changelog](./CHANGELOG.md): what is new in 2.2.1 and before
 - [Security](./SECURITY.md): security model and how to report a vulnerability
 - [Contributing](./CONTRIBUTING.md): bug reports and feature requests are welcome as [issues](https://github.com/danilokhury/Synabun/issues); pull requests are not accepted
 - [Website](https://synabun.ai), [docs](https://synabun.ai/docs) and [blog](https://synabun.ai/blog)

package/mcp-server/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "claude-memory-mcp",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "claude-memory-mcp",
-      "version": "2.2.0",
+      "version": "2.2.1",
       "license": "Apache-2.0",
       "dependencies": {
         "@huggingface/transformers": "^3.0.0",

package/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-memory-mcp",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "private": true,
   "description": "Private MCP server runtime bundled with SynaBun for persistent memory and agent tooling",
   "license": "Apache-2.0",

package/neural-interface/i18n/en.json

@@ -10759,6 +10759,9 @@
       "resume": "Resume",
       "setupTitle": "Computer use setup",
       "checking": "Checking computer use…",
+      "checkFailed": "Could not check computer use",
+      "checkFailedForbidden": "This window is not allowed to read computer use.",
+      "checkFailedTimeout": "The check did not answer in time.",
       "unsupported": "Computer use needs macOS",
       "unsupportedBody": "SynaBun controls the desktop through a small native helper that only runs on a Mac.",
       "setupStart": "Set up computer use",

package/neural-interface/i18n/pt-BR.json

@@ -10705,6 +10705,9 @@
       "resume": "Retomar",
       "setupTitle": "Configuração do uso do computador",
       "checking": "Verificando uso do computador…",
+      "checkFailed": "Não foi possível verificar o uso do computador",
+      "checkFailedForbidden": "Esta janela não tem permissão para ler o uso do computador.",
+      "checkFailedTimeout": "A verificação não respondeu a tempo.",
       "unsupported": "O uso do computador precisa de macOS",
       "unsupportedBody": "O SynaBun controla o desktop por um pequeno auxiliar nativo que só funciona no Mac.",
       "setupStart": "Configurar uso do computador",

package/neural-interface/lib/assistant-brains/codex.js

@@ -181,8 +181,13 @@ export function createCodexBrain({ session, sink, deps = {}, persona = '' } = {}
       queryPlanMode = planMode;
       // "<id>[extended]" = the model at its extended context window (the sidepanel's contextMode).
       const picked = model || brain.model || null;
+      // The Assistant composer uses base64 + mediaType; the Codex skin persists
+      // data URLs as native localImage inputs. Translate at this protocol boundary.
+      const pictures = (Array.isArray(images) ? images : [])
+        .filter((image) => image?.base64)
+        .map((image) => ({ dataUrl: `data:${image.mediaType || 'image/png'};base64,${image.base64}` }));
       sendQuery({
-        prompt: text, images: Array.isArray(images) && images.length ? images : undefined,
+        prompt: text, images: pictures.length ? pictures : undefined,
         cwd: cwd || brain.cwd || deps.PACKAGE_ROOT || undefined, model: picked ? baseModelId(picked) : null, effort: effort || brain.effort || null,
         contextMode: contextVariantOf(picked) === 'extended' ? 'extended' : undefined,
         threadId: threadId || null, autoAccept: approvalMode === 'auto' && !planMode && !remoteReadOnly, planMode,

package/neural-interface/lib/assistant-dispatch.js

@@ -1842,8 +1842,11 @@ export function createAssistantDispatcher({
       const acq = await acquireLoopBrowserAndTab({ requestedBrowserSessionId: entry.requestedBrowserSessionId, terminalSessionId: entry.runId, logTag: 'assistant:browser' });
       if (acq?.error) {
         entry.state = 'failed'; entry.completionReason = 'browser_unavailable'; entry.finishedAt = iso(now()); entry.notes.push(acq.error);
+        // The native serve boundary's refusal keeps its own code and the serves it names, on the run and the error.
+        const boundary = acq.code === 'NATIVE_SERVE_UNVERIFIED' ? { browserCode: acq.code, offenders: Array.isArray(acq.offenders) ? acq.offenders : [] } : null;
+        if (boundary) entry.browserError = boundary;
         emit(entry, 'failed');
-        throw new DispatchError('PROVIDER_UNAVAILABLE', acq.error, { status: 500 });
+        throw new DispatchError('PROVIDER_UNAVAILABLE', acq.error, { status: 500, ...(boundary || {}) });
       }
       browserSessionId = acq.browserSessionId || null;
       browserTabId = acq.browserTabId || null;

package/neural-interface/lib/mcp-external-servers.js

@@ -319,14 +319,38 @@ export async function waitForClaudeMcpScope(q, names, { timeoutMs = 30000 } = {}
   }
   throw Object.assign(new Error('Claude MCP scope could not be enforced before the first turn'), { code: 'MCP_SCOPE_UNENFORCED' });
 }
+/** Values shorter than this are never redacted: a short or common word would be erased from ordinary output. */
+export const MIN_MCP_SECRET_LENGTH = 8;
 export function redactMcpValues(value, values) {
-  if (typeof value === 'string') { for (const secret of [...new Set(values)].filter(Boolean).sort((a, b) => b.length - a.length)) value = value.split(secret).join('[MCP value]'); return value; }
+  if (typeof value === 'string') { for (const secret of [...new Set(values)].filter(item => typeof item === 'string' && item.length >= MIN_MCP_SECRET_LENGTH).sort((a, b) => b.length - a.length)) value = value.split(secret).join('[MCP value]'); return value; }
   if (Array.isArray(value)) return value.map(item => redactMcpValues(item, values));
   if (value && typeof value === 'object') return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, redactMcpValues(item, values)]));
   return value;
 }
 
-export function mcpDefinitionValues(servers) {
+const SECRET_QUERY_NAME = /token|key|secret|auth|pass|pwd|sig|credential|session|code/i;
+/** The secrets a URL carries (userinfo, credential-named query values), never the URL itself. */
+export function urlSecretValues(url) {
+  if (typeof url !== 'string' || !url) return [];
+  let parsed; try { parsed = new URL(url); } catch { return []; }
+  const out = [];
+  for (const part of [parsed.username, parsed.password]) if (part) { out.push(part); try { out.push(decodeURIComponent(part)); } catch {} }
+  for (const [name, value] of parsed.searchParams) if (value && SECRET_QUERY_NAME.test(name)) { out.push(value); out.push(encodeURIComponent(value)); }
+  return out;
+}
+
+/**
+ * The real secrets of MCP server definitions: env / environment and header values, authToken, oauth strings
+ * and the secrets inside a URL. Never command, args, cwd, type or a whole URL, and never SynaBun's own entry
+ * (its headers name the project, terminal and role: ordinary words). `${VAR}` / `{env:VAR}` references are
+ * expanded through `env` when given. Values under MIN_MCP_SECRET_LENGTH are dropped.
+ */
+export function mcpSecretValues(servers, { env = null, exclude = ['SynaBun'] } = {}) {
   const strings = value => typeof value === 'string' ? [value] : Array.isArray(value) ? value.flatMap(strings) : value && typeof value === 'object' ? Object.values(value).flatMap(strings) : [];
-  return [...new Set(Object.values(servers || {}).flatMap(entry => ['command', 'args', 'cwd', 'env', 'environment', 'headers', 'url', 'oauth', 'headersHelper', 'authToken'].flatMap(field => strings(entry[field]))))].filter(Boolean);
+  const expand = value => env ? value.replace(/\{env:([A-Za-z_][A-Za-z0-9_]*)\}|\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (whole, a, b) => env[a || b] ?? whole) : value;
+  const values = Object.entries(servers || {}).filter(([name]) => !exclude.includes(name)).flatMap(([, entry]) => entry && typeof entry === 'object' ? [
+    ...['env', 'environment', 'headers', 'oauth', 'authToken'].flatMap(field => strings(entry[field])).flatMap(value => { const bare = /^(?:Bearer|Basic|Token|Bot)\s+(\S.*)$/i.exec(value); return bare ? [value, bare[1]] : [value]; }),
+    ...urlSecretValues(entry.url),
+  ] : []).map(expand);
+  return [...new Set(values)].filter(value => value.length >= MIN_MCP_SECRET_LENGTH);
 }

package/neural-interface/lib/native-loop-providers.js

@@ -1,7 +1,7 @@
 import { codexWorkerReply, CODEX_QUESTIONS, elicitationReply, openCodeAnswers, workerQuestions } from './worker-question.js';
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { externalServerInventory, selectExternalServers, codexMcpEnabledOverride, referenceClaudeMap, waitForClaudeMcpScope, redactMcpValues, writePrivateMcpConfig, mcpDefinitionValues } from './mcp-external-servers.js';
+import { externalServerInventory, selectExternalServers, codexMcpEnabledOverride, referenceClaudeMap, waitForClaudeMcpScope, redactMcpValues, writePrivateMcpConfig, mcpSecretValues } from './mcp-external-servers.js';
 import { resolveStoredTools, runtimeToolsValue, readDefaultTools } from './tool-lists.js';
 import { waitForSynabunTools, synabunToolsTimeoutText } from './opencode-mcp-ready.js';
 import { config as memoryConfig, detectProject as memoryProject } from '../../mcp-server/dist/config.js';
@@ -864,7 +864,8 @@ export async function createClaudeNativeLoopAdapter(options = {}) {
       if (definition.oauth) privateMcpServers[name].oauth = structuredClone(definition.oauth);
       if (definition.headersHelper) privateMcpServers[name].headersHelper = definition.headersHelper;
     }
-    externalValues = [...Object.values(referenced.env), ...mcpDefinitionValues(definitions)];
+    // Only the external servers' secrets (expanded through the CLI's env); SynaBun's own headers are not secrets.
+    externalValues = mcpSecretValues(definitions, { env });
     externalScopeNames = Object.keys(definitions);
   }
   if (model) queryOptions.model = model;

package/neural-interface/lib/opencode-native-boundary.js

@@ -15,39 +15,173 @@ export function nativeServeCapability({ version, commandLine = false, passwordFr
   return !commandLine && passwordFrom === 'stdout' && NATIVE_SERVE_VERSIONS.includes(bare);
 }
 
+// Why a serve is not native-safe, in words that name what to change.
+export function nativeServeReason({ version, commandLine = false, passwordFrom } = {}) {
+  if (commandLine) return 'command-line';
+  if (passwordFrom !== 'stdout') return 'password';
+  return nativeServeCapability({ version, commandLine, passwordFrom }) ? null : 'version';
+}
+
+const BASE = `Native browser WebSockets require authenticated OpenCode ${NATIVE_SERVE_VERSIONS.join(' or ')} serves with private stdout credentials; wait for startup, stop unverified serves or use the verified executable path.`;
+
+const MAX_COMMAND = 200;
+const short = (text, max = MAX_COMMAND) => {
+  const one = String(text ?? '').replace(/\s+/g, ' ').trim();
+  return one.length > max ? `${one.slice(0, max - 1)}…` : one;
+};
+const pidOf = (o) => (Number.isInteger(o?.pid) && o.pid > 0 ? o.pid : null);
+
+// The fields of an offender a caller may see (a route's answer, a dispatch error): what names the serve, never its
+// token or the rest of its record. A command line is shortened.
+export function narrowOffenders(offenders = []) {
+  return (Array.isArray(offenders) ? offenders : []).map((o) => {
+    const out = { reason: String(o?.reason || 'unknown'), pid: pidOf(o), port: Number(o?.port) > 0 ? Number(o.port) : null };
+    if (o?.path) out.path = short(o.path, 400);
+    if (o?.command) out.command = short(o.command, 400);
+    if (o?.version) out.version = String(o.version).trim();
+    if (o?.reason === 'record') { out.kind = o.kind || null; out.claimable = !!o.claimable; }
+    return out;
+  });
+}
+
+function describeOffender(o) {
+  const pid = pidOf(o);
+  const where = [pid ? `pid ${pid}` : null, o.port ? `port ${o.port}` : null].filter(Boolean).join(', ');
+  const what = [o.path || null, o.command ? `command ${short(o.command)}` : null, o.version ? `version ${String(o.version).trim()}` : null].filter(Boolean).join(', ');
+  const head = `OpenCode serve ${where || '(unknown process)'}${what ? ` (${what})` : ''}`;
+  switch (o.reason) {
+    case 'version': return `${head}: this OpenCode version is not one whose authentication SynaBun verified (${NATIVE_SERVE_VERSIONS.join(', ')}); install one of them, or stop this serve (close the OpenCode panel${pid ? ` / end pid ${pid}` : ''})`;
+    case 'command-line': return `${head}: started from the OpenCode command line set in Settings (its version cannot be read); clear it so SynaBun starts the verified executable, or stop this serve`;
+    case 'password': return `${head}: started without a private stdout password`;
+    case 'starting': return `${head}: still starting; try again once OpenCode answers`;
+    case 'untracked-port': return `${head}: answers on a port SynaBun did not start in this run; stop the process listening on port ${o.port}`;
+    case 'record': {
+      const kind = o.kind ? `, kind ${o.kind}` : '';
+      if (o.claimable) return `${head}: left running by an earlier SynaBun that has ended${kind}; it could not be stopped automatically: end ${pid ? `pid ${pid}` : 'that serve'}`;
+      // Not confirmed: the owner may still run, or the OS could not say whether this pid is still that serve (a pid
+      // is reused once its process ends). Never ask the user to end a number that may be another program now.
+      return `${head}: on record from another SynaBun process, or one whose identity the OS could not confirm${kind}. It is unconfirmed${pid ? ` whether pid ${pid} is still this serve (the number may belong to another program by now)` : ''}: check ${pid ? `that pid ${pid}'s command line is the one shown (ps -o command= -p ${pid}; on Windows, Task Manager → Details → Command line column)` : 'the OpenCode serves that are running'} before ending it, or close the other SynaBun`;
+    }
+    default: return `${head}: not verified`;
+  }
+}
+
+export function nativeServeError(offenders = []) {
+  const list = offenders.map(describeOffender);
+  const error = new Error(list.length ? `${BASE} Blocking: ${list.join('; ')}.` : BASE);
+  error.code = 'NATIVE_SERVE_UNVERIFIED';
+  error.offenders = narrowOffenders(offenders);
+  return error;
+}
+
+const nativeContextClosed = () => Object.assign(new Error('The browser closed while SynaBun was checking its OpenCode serves; nothing was attached.'), { code: 'NATIVE_CONTEXT_CLOSED' });
+const nativeAttachAborted = () => Object.assign(new Error('The browser request ended while SynaBun was checking its OpenCode serves; nothing was attached.'), { code: 'NATIVE_ATTACH_ABORTED' });
+const defaultSleep = (ms) => new Promise((done) => { const t = setTimeout(done, ms); t.unref?.(); });
+
 export function createNativeServeBoundary() {
   const processes = new Map();
+  // Every native context that relies on the boundary, attached or still being checked (a reservation): while any is
+  // held, assertLaunch refuses an unverified serve. A context is held from before its check until it closes, its
+  // browser disconnects or its attachment fails.
   const contexts = new Map();
-  const error = () => new Error(`Native browser WebSockets require authenticated OpenCode ${NATIVE_SERVE_VERSIONS.join(' or ')} serves with private stdout credentials; wait for startup, stop unverified serves or use the verified executable path.`);
+  function offenders({ ports = [], unverifiedRecords = [] } = {}) {
+    const out = [];
+    const verified = new Set();
+    for (const [proc, e] of processes) {
+      const base = { pid: proc.pid || null, port: e.port, path: e.path || null, version: e.version || null };
+      if (!e.safe) out.push({ ...base, reason: e.reason || 'version' });
+      else if (!e.ready) out.push({ ...base, reason: 'starting' });
+      else verified.add(e.port);
+    }
+    for (const port of ports) {
+      const n = Number(port);
+      if (verified.has(n) || out.some(o => o.port === n)) continue;
+      out.push({ pid: null, port: n, reason: 'untracked-port' });
+    }
+    // A record has the serve's command line (its identity), not a path; never its token.
+    for (const r of unverifiedRecords) out.push({ pid: r?.pid || null, port: r?.port || null, kind: r?.kind || null, command: r?.command || null, claimable: !!r?.claimable, reason: 'record' });
+    return out;
+  }
+  function reserve(context) {
+    const held = contexts.get(context);
+    if (held) return held;
+    const browser = context.browser?.() || null;
+    const release = () => {
+      if (contexts.get(context) !== release) return;
+      contexts.delete(context);
+      context.removeListener('close', release);
+      browser?.removeListener('disconnected', release);
+    };
+    contexts.set(context, release);
+    context.once('close', release);
+    browser?.once('disconnected', release);
+    return release;
+  }
+  function check(state) {
+    const blocking = offenders(state);
+    if (blocking.length) throw nativeServeError(blocking);
+  }
   return {
-    assertLaunch(safe) { if (!safe && contexts.size) throw error(); },
-    track(proc, { port, safe = false }) {
+    offenders,
+    reserve,
+    holds: (context) => contexts.has(context),
+    assertLaunch(safe, info = {}) {
+      if (!safe && contexts.size) {
+        const e = nativeServeError([{ pid: null, port: info.port || null, path: info.path || null, version: info.version || null, reason: info.reason || 'version' }]);
+        e.message = `A native browser is attached, so this unverified OpenCode serve is not started. ${e.message}`;
+        throw e;
+      }
+    },
+    track(proc, { port, safe = false, version = null, path = null, reason = null }) {
       if (!proc || proc.exitCode != null || proc.signalCode != null) return;
-      processes.set(proc, { port: Number(port), safe, ready: false });
+      processes.set(proc, { port: Number(port), safe, ready: false, version, path, reason: safe ? null : (reason || 'version') });
       const release = () => processes.delete(proc);
       proc.once('exit', release);
       proc.once('error', () => { if (!proc.pid) release(); });
     },
     ready(proc) { const entry = processes.get(proc); if (entry) entry.ready = true; },
-    protect(context, { ports, unverifiedRecords = [] }) {
+    // Synchronous: check now, then hold the context. A context already held is returned as it is.
+    protect(context, state) {
       if (contexts.has(context)) return contexts.get(context);
-      const verified = new Set();
-      for (const { port, safe, ready } of processes.values()) {
-        if (!safe || !ready) throw error();
-        verified.add(port);
+      check(state);
+      return reserve(context);
+    },
+    // The context is held (a pending reservation assertLaunch honours) before anything is waited for; then, bounded,
+    // SynaBun repairs what it can: a sweep of the records an ended SynaBun left (started at once, in the background,
+    // waited for at most `sweepMs`) and SynaBun's own verified serves still starting (waited for at most `waitMs`).
+    // Any other blocker refuses at once. `deadline` (an absolute time) and `signal` end the wait early. On every
+    // failure the reservation is released; nothing is cached, so the next attempt reads the live state again.
+    async attach(context, { state, sweep = null, waitMs = 20_000, sweepMs = 10_000, deadline = Infinity, signal = null, pollMs = 250, now = Date.now, sleep = defaultSleep } = {}) {
+      const release = reserve(context);
+      const held = () => contexts.get(context) === release;
+      try {
+        const start = now();
+        const end = Number.isFinite(deadline) ? deadline : Infinity;
+        const waitEnd = Math.min(start + Math.max(0, waitMs), end);
+        const sweepEnd = Math.min(start + Math.max(0, sweepMs), end);
+        let current = state();
+        let sweeping = false;
+        if (sweep && current.unverifiedRecords?.length) {
+          sweeping = true;
+          Promise.resolve().then(sweep).catch(() => {}).finally(() => { sweeping = false; });
+        }
+        for (;;) {
+          if (!held()) throw nativeContextClosed();
+          if (signal?.aborted) throw nativeAttachAborted();
+          const blocking = offenders(current);
+          if (!blocking.length) return release;
+          const t = now();
+          const waitable = (o) => (o.reason === 'starting' && t < waitEnd)
+            || (o.reason === 'record' && o.claimable && sweeping && t < sweepEnd);
+          if (!blocking.every(waitable)) throw nativeServeError(blocking);
+          const until = Math.max(...blocking.map(o => (o.reason === 'starting' ? waitEnd : sweepEnd)));
+          await sleep(Math.max(1, Math.min(pollMs, until - t)));
+          current = state();
+        }
+      } catch (error) {
+        release();
+        throw error;
       }
-      if ([...ports].some(port => !verified.has(Number(port))) || unverifiedRecords.length) throw error();
-      const browser = context.browser();
-      const release = () => {
-        if (contexts.get(context) !== release) return;
-        contexts.delete(context);
-        context.removeListener('close', release);
-        browser.removeListener('disconnected', release);
-      };
-      contexts.set(context, release);
-      context.once('close', release);
-      browser.once('disconnected', release);
-      return release;
     },
   };
 }

package/neural-interface/lib/peer-identity.js

@@ -439,7 +439,7 @@ export function agentProcesses() {
  *   `agentPids`: processes SynaBun started for an agent (registerAgentProcess), refused like an agent's tree
  * @returns {{ self:boolean, refuse: null | { why:string, kind:string, pid:number, name:string } }}
  */
-export function classifyPeerChain(chain, { selfPid = process.pid, listening = new Set(), synabunMcp = 0, agentPids = AGENT_PROCESSES } = {}) {
+export function classifyPeerChain(chain, { selfPid = process.pid, listening = new Set(), synabunMcp = 0, agentPids = AGENT_PROCESSES, debugClient = null } = {}) {
   const list = Array.isArray(chain) ? chain : [];
   if (!list.length) return { self: false, refuse: null };
   if (list[0].pid === selfPid) return { self: true, refuse: null };
@@ -447,11 +447,17 @@ export function classifyPeerChain(chain, { selfPid = process.pid, listening = ne
   const refuse = (p, kind, why) => ({ self: false, refuse: { kind, why, pid: p.pid, name: nameOf(p) } });
   const peerKinds = processKinds(list[0]);
   const mcp = Number(synabunMcp) > 0 && list[0].pid === Number(synabunMcp);
+  let exempted = false;
   for (let i = 0; i < list.length; i++) {
     const p = list[i];
     if (!p || p.pid === selfPid || p.pid <= 1) break; // this server's own ancestry, and launchd, are not the peer's
     const k = i === 0 ? peerKinds : processKinds(p);
-    if (k.automation) return refuse(p, 'automation-browser', `a browser started for automation (${k.automation})`);
+    // Local profiling (SYNABUN_ALLOW_DEBUG_CLIENT, debugClientPolicy): only the remote-debugging flag is forgiven, and
+    // only on the port the policy names; every other rule below still applies to this process and its parents. The
+    // process holds its debug port open itself, so the listener rule is not asked of that one process.
+    const debugOk = !!k.automation && debugClientExempt(p, k, debugClient);
+    if (debugOk) exempted = true;
+    if (k.automation && !debugOk) return refuse(p, 'automation-browser', `a browser started for automation (${k.automation})`);
     if (k.agent) return refuse(p, 'agent', `an AI agent's process tree (${k.agent})`);
     const startedFor = agentPids?.get?.(p.pid);
     if (startedFor) return refuse(p, 'agent', `an AI agent's process tree (${startedFor}, started by SynaBun)`);
@@ -464,12 +470,47 @@ export function classifyPeerChain(chain, { selfPid = process.pid, listening = ne
     // A program that serves TCP itself and calls SynaBun is relaying for whoever reached it (a dev server's proxy,
     // a small SOCKS / HTTP proxy). The owner's browsers are left out of this one rule (their network process, or a
     // browser that holds a socket for its own reasons): their automation flags are what is asked of them.
-    if (i <= 1 && !peerKinds.browser && listening.has(p.pid)) return refuse(p, 'listener', 'a program that also listens for connections (a relay or proxy)');
+    if (i <= 1 && !peerKinds.browser && !debugOk && listening.has(p.pid)) return refuse(p, 'listener', 'a program that also listens for connections (a relay or proxy)');
   }
+  if (exempted && !mcp) return { self: false, refuse: null, debugExempt: true };
   if (mcp) return refuse(list[0], 'synabun-mcp', 'SynaBun\'s own MCP server over HTTP (it calls for whichever MCP client reached it)');
   return { self: false, refuse: null };
 }
 
+// ── Local profiling exemption (off unless the server's own environment asks) ─
+//
+// SYNABUN_ALLOW_DEBUG_CLIENT=1 (any debug port) or =<port> (only --remote-debugging-port=<port>) lets a client process
+// started with --remote-debugging-port hold the owner's authority, so SynaBun's own window can be profiled over CDP.
+// Read from the environment the server was started with only (server.js reads it before DATA_HOME/.env is loaded:
+// never from a file a client can write), loopback peers only (127.0.0.0/8, ::1), and only that flag: a
+// --remote-debugging-pipe, MoreLogin, Playwright WebKit / Firefox automation, agents, relays and every other rule
+// still refuse.
+
+/** The policy from an environment object: { enabled, port } (port null = any). Anything but 1/on/true/yes or a port is off. */
+export function debugClientPolicy(env = process.env) {
+  const raw = String(env?.SYNABUN_ALLOW_DEBUG_CLIENT ?? '').trim().toLowerCase();
+  if (/^(?:1|on|true|yes)$/.test(raw)) return { enabled: true, port: null };
+  if (/^[0-9]{4,5}$/.test(raw) && Number(raw) >= 1024 && Number(raw) <= 65535) return { enabled: true, port: Number(raw) };
+  return { enabled: false, port: null };
+}
+
+/** Whether this process's automation flag is the one the policy forgives. */
+export function debugClientExempt(proc, kinds, policy) {
+  if (!policy?.enabled || kinds?.automation !== 'remote debugging') return false;
+  const la = lower(proc?.args);
+  if (/(?:^|\s)--remote-debugging-pipe(?:[=\s]|$)/.test(la)) return false;
+  // The other automation rules are asked as if the flag were not there: MoreLogin, Playwright, Firefox automation.
+  if (MORELOGIN_PATH_RE.test(String(proc?.comm ?? '')) || lower(proc?.ucomm).trim().startsWith('morelogin')) return false;
+  if (/(?:^|\s)--inspector-pipe(?:\s|$)/.test(la) || /\/pw_run\.sh(?:\s|$)/.test(la) || /(?:^|\s)-juggler(?:-pipe)?(?:\s|$)/.test(la) || /(?:^|\s)--?marionette(?:\s|$)/.test(la)) return false;
+  if (/(?:^|\s)--(?:enable-automation|headless)(?:[=\s]|$)/.test(la)) return false;
+  const ports = [...la.matchAll(/(?:^|\s)--remote-debugging-port(?:=|\s+)([0-9]+)(?=\s|$)/g)].map((m) => Number(m[1]));
+  if (!ports.length) return false;
+  return policy.port == null || ports.every((n) => n === policy.port);
+}
+
+/** Whether a normalized address is loopback. */
+export const isLoopbackAddress = (addr) => /^127\.\d+\.\d+\.\d+$/.test(String(addr || '')) || String(addr || '') === '::1';
+
 /** The environment part of `ps -E` output for one process, given the same process's line without -E. */
 export function envPart(withEnv, plain) {
   const w = String(withEnv ?? '');
@@ -526,8 +567,10 @@ function thisMachineAddresses() {
  *   is told apart from other listening programs (isSynabunMcpServer). None: it is refused as a listener, as any relay.
  * @param {(path:string) => string} [o.realpath] fs.realpathSync (tests inject one).
  */
-export function createPeerIdentity({ platform = process.platform, selfPid = process.pid, run = defaultRun, localAddresses = null, log = () => {}, now = Date.now, disabled = false, synabunRoots = [], realpath = realpathSync } = {}) {
+export function createPeerIdentity({ platform = process.platform, selfPid = process.pid, run = defaultRun, localAddresses = null, log = () => {}, now = Date.now, disabled = false, synabunRoots = [], realpath = realpathSync, debugClient = null } = {}) {
   const supported = platform === 'darwin' && !disabled;
+  const debugPolicy = debugClient?.enabled ? { enabled: true, port: Number.isInteger(debugClient.port) ? debugClient.port : null } : null;
+  if (debugPolicy) { try { log(`[peer-identity] WARNING: SYNABUN_ALLOW_DEBUG_CLIENT is set: a loopback client started with --remote-debugging-port${debugPolicy.port ? `=${debugPolicy.port}` : ''} is taken as the owner (local profiling only; unset it when done)`); } catch { /* logger */ } }
   if (disabled) { try { log('[peer-identity] off (SYNABUN_PEER_IDENTITY=off): the page secret\'s rules from before apply, with no peer lookup'); } catch { /* logger */ } }
   const bySocket = new WeakMap();
   const chains = new Map(); // pid → { at, ucomm, chain }
@@ -679,7 +722,8 @@ export function createPeerIdentity({ platform = process.platform, selfPid = proc
     if (!chain || !chain.length) return { status: 'gone', reason: 'the client process exited before it was identified', pid: row.pid, ms: now() - started };
     let synabunMcp = 0;
     try { synabunMcp = await synabunMcpPid(chain[0], table.listening); } catch { synabunMcp = 0; }
-    const verdict = classifyPeerChain(chain, { selfPid, listening: table.listening, synabunMcp });
+    const verdict = classifyPeerChain(chain, { selfPid, listening: table.listening, synabunMcp, debugClient: isLoopbackAddress(remote) ? debugPolicy : null });
+    if (verdict.debugExempt) note(`debug:${row.pid}`, `[peer-identity] WARNING: accepted a debug client as the owner (pid ${row.pid}, ${row.name || chain[0].ucomm}) under SYNABUN_ALLOW_DEBUG_CLIENT`);
     return { status: 'ok', self: verdict.self, pid: row.pid, name: row.name || chain[0].ucomm, chain, refuse: verdict.refuse, ms: now() - started };
   }
 

package/neural-interface/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "neural-memory-interface",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "neural-memory-interface",
-      "version": "2.2.0",
+      "version": "2.2.1",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {

package/neural-interface/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neural-memory-interface",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "private": true,
   "description": "Private local SynaBun interface for memory visualization and multi-agent workflows",
   "license": "Apache-2.0",

package/neural-interface/public/shared/assistant/asst-api.js

@@ -98,8 +98,20 @@ export function escalateAssistantRun(runId, target) {
 
 // ── Desktop (computer use) ───────────────────
 
-export function getDesktopStatus() {
-  return jsonFetch('/api/desktop/status');
+/** How long the status check may take before it counts as failed (the tray must never spin forever). */
+export const DESKTOP_STATUS_TIMEOUT_MS = 10_000;
+
+export async function getDesktopStatus({ timeoutMs = DESKTOP_STATUS_TIMEOUT_MS } = {}) {
+  const ctrl = typeof AbortController === 'function' ? new AbortController() : null;
+  const timer = ctrl ? setTimeout(() => ctrl.abort(), timeoutMs) : null;
+  try {
+    return await jsonFetch('/api/desktop/status', ctrl ? { signal: ctrl.signal } : {});
+  } catch (err) {
+    if (ctrl?.signal.aborted) throw Object.assign(new Error('The status check timed out'), { code: 'TIMEOUT', timedOut: true });
+    throw err;
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
 }
 
 /** step: 'start'|'recheck'|'install_toolchain'|'request_screen'|'request_accessibility'|'open_settings' (+ { pane }). */

package/neural-interface/public/shared/assistant/asst-computer.js

@@ -290,6 +290,14 @@ export function requestDesktopStop(body = { scope: 'all' }) {
 const ICON_COMPUTER = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="4" width="18" height="12" rx="2"/><path d="M8 20h8M12 16v4"/></svg>';
 const ICON_X = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>';
 const POLL_MS = 3000;
+
+/** What a failed status check was: { kind: 'forbidden' | 'timeout' | 'error', message }. */
+export function computerCheckFailure(err) {
+  const message = str(err?.message) || 'The status check failed';
+  if (err?.status === 401 || err?.status === 403 || err?.forbidden) return { kind: 'forbidden', message };
+  if (err?.timedOut || err?.code === 'TIMEOUT' || err?.name === 'AbortError') return { kind: 'timeout', message };
+  return { kind: 'error', message };
+}
 const THUMB_MIN_INTERVAL_MS = 500; // ≤ 2 live-thumbnail updates per second
 
 function el(tag, className, text) {
@@ -411,6 +419,7 @@ export function createComputerPanel(hostEl, hooks = {}) {
     thumbTimer: null,
     thumbPending: null,
     view: '',
+    checkFailed: null,
   };
 
   function isEnabled() { try { return !!hooks.isEnabled?.(); } catch { return false; } }
@@ -575,7 +584,17 @@ export function createComputerPanel(hostEl, hooks = {}) {
     const note = (text) => body.appendChild(el('div', 'asst-computer-tray-note', text));
     const spinner = () => head.insertBefore(el('span', 'asst-spinner'), head.firstChild);
 
-    switch (info.state) {
+    const viewState = info.state === 'loading' && state.checkFailed ? 'check_failed' : info.state;
+    switch (viewState) {
+      case 'check_failed':
+        title.textContent = t('assistant.computer.checkFailed', 'Could not check computer use');
+        note(state.checkFailed.kind === 'forbidden'
+          ? t('assistant.computer.checkFailedForbidden', 'This window is not allowed to read computer use.')
+          : state.checkFailed.kind === 'timeout'
+            ? t('assistant.computer.checkFailedTimeout', 'The check did not answer in time.')
+            : state.checkFailed.message);
+        button(t('assistant.computer.checkAgain', 'Check again'), 'secondary', () => { state.checkFailed = null; render(); refresh().catch(() => {}); }, 'recheck');
+        break;
       case 'loading':
         spinner();
         title.textContent = t('assistant.computer.checking', 'Checking computer use…');
@@ -670,6 +689,7 @@ export function createComputerPanel(hostEl, hooks = {}) {
 
   function applyStatus(status) {
     if (!status || typeof status !== 'object') return;
+    state.checkFailed = null;
     state.status = status;
     state.info = computerSetupState(status);
     if (status.control && typeof status.control === 'object') {
@@ -688,7 +708,9 @@ export function createComputerPanel(hostEl, hooks = {}) {
       if (!state.destroyed) applyStatus(status);
       return status;
     } catch (err) {
-      if (!state.destroyed) { state.error = ''; render(); }
+      // A check that failed is a settled state (Check again), never "Checking…" forever. A status already known
+      // stays on screen; only a tray that never got one shows the failure.
+      if (!state.destroyed) { state.error = ''; state.checkFailed = computerCheckFailure(err); render(); }
       throw err;
     }
   }
@@ -735,6 +757,8 @@ export function createComputerPanel(hostEl, hooks = {}) {
     stop,
     isActive: desktopActive,
     status: () => state.status,
+    /** A status check made elsewhere failed: settle the tray instead of leaving it on "Checking…". */
+    checkFailed(err) { if (state.destroyed || state.status) return; state.checkFailed = computerCheckFailure(err); render(); },
     info: () => state.info,
     destroy() {
       state.destroyed = true;