synabun 2026.4.20-beta.13 → 2026.4.20-beta.14

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 Raw internal changelogs are archived in [changelog/](changelog/).
 
+## 2026-04-21
+
+### Added — Workspace Trust Flow For Windows Git "Dubious Ownership" Repos
+- **New `POST /api/terminal/trust-workspace` endpoint** — In `neural-interface/server.js`, added `detectDubiousOwnership(dir)` helper that probes `git rev-parse --is-inside-work-tree` and matches stderr against `/dubious ownership|safe\.directory/i` (CVE-2022-24765 protection; fires on Windows when the repo is owned by a different SID — external drives, cross-user installs, copied repos). New `normalizeGitPath(dir)` converts backslashes to forward slashes and strips trailing slashes to match the format `git config --add safe.directory` expects. The endpoint validates `path` (non-empty string, no control chars, not `*`/`/`/`\\`, `existsSync` + `isDirectory`), runs `spawnGit(['config', '--global', '--add', 'safe.directory', normalizeGitPath(abs)])`, re-probes to confirm, logs `[git] trusted workspace: <path>`, and returns `{ ok, path, stillDubious }`.
+- **`POST /api/claude-code/integrations` flags dubious workspaces on registration** — The `target === 'project'` branch now calls `detectDubiousOwnership(normalized)` after saving the project to the hook-projects list; when the error fires it adds `dubiousOwnership: true, trustPath: normalizeGitPath(normalized)` to the response JSON. Mac/Linux and healthy Windows installs see no change to response shape.
+- **`promptTrustWorkspace(trustPath)` modal in the file-explorer add-project flow** — In `neural-interface/public/shared/ui-file-explorer.js`, `addProjectFlow()` now reads the integrations response and `await`s a new `promptTrustWorkspace()` modal when `dubiousOwnership` is true. The modal reuses the existing `.fe-modal-overlay` system with a `.fe-trust-modal` amber variant, shows the exact path in a `.fe-trust-path` monospace chip, and offers **Skip** (close, no git change) or **Trust workspace** (POSTs to `/api/terminal/trust-workspace`, toasts the result, closes). The promise resolves either way so the add flow never blocks.
+- **Inline trust row in the onboarding wizard** — In `neural-interface/public/onboarding.html`, the project-add step on `$addBtn` now persists `dubiousOwnership` + `trustPath` fields onto each `wizardState.projects[i]` entry, and `renderProjectList()` appends an amber inline `⚠ Git ownership mismatch — [Trust workspace]` row under the card when flagged. Click POSTs to `/api/terminal/trust-workspace`; on success the row swaps to `✓ Workspace trusted`. Separate from the file-explorer modal because onboarding already has its own card-based flow and shouldn't launch overlay dialogs.
+- **Amber modal styling** — In `neural-interface/public/shared/styles.css`, added `.fe-trust-modal` overrides of `.fe-modal-title` (amber `#ffb74d`) and `.fe-modal-confirm` (warm `rgba(255,183,77,…)`) so the trust dialog is visually distinct from the destructive-red delete modal. New `.fe-trust-path` class styles the monospace path chip with dark background and `word-break: break-all`.
+
+### Fixed — Git UI Silently Disabled On Windows Across Shim / Version / PATH Variants
+- **`git` invocation rewritten to resolve absolute path, then fall back to shell only when needed** — In `neural-interface/server.js`, added `resolveGitPath()` that runs `where git` on Windows / `command -v git` on Unix via `execSync` at first use, caches the result, and prefers `.exe` entries over `.cmd`/`.bat` shims (Scoop, winget) so `spawnSync` can execute git directly without cmd.exe involvement. New `spawnGit(args, opts)` uses the resolved absolute path with no shell on all platforms; only falls back to `shell: true` with per-arg metacharacter quoting when path resolution fails OR the resolved target is a `.cmd`/`.bat` shim. Logs `[git] resolved: <path>` at first use so Windows users can confirm which binary Node is running.
+- **Chained branch-name fallback for old git installs** — `getGitInfo()` and `GET /api/terminal/branches` used `git branch --show-current` which requires git 2.22+ — older Git for Windows builds silently exited non-zero and the branch label disappeared. Added chained fallback: `branch --show-current` → `rev-parse --abbrev-ref HEAD` → `rev-parse --short HEAD`. The `--abbrev-ref` form works on every git version and handles both named branches and detached HEAD (returns literal `"HEAD"`, which the parser treats as "no branch" and escalates to the short SHA).
+- **Plain `git branch` parse replacing `--format=%(refname:short)`** — The branch-list endpoint's `--format=%(refname:short)` arg was prone to cmd.exe variable-expansion mangling on Windows even with double-quoting. Replaced with bare `git branch` and a `line.replace(/^[\s*]+/, '').trim()` parser that strips the current-branch marker and filters out `(HEAD detached …)` lines and rename arrows. Removes the cmd.exe `%(…)` hazard entirely.
+- **All git calls now route through `spawnGit` with unified error logging** — The call sites (`getGitInfo`, `/api/terminal/branches`, `/api/terminal/checkout`, the project-add integration probe) had inconsistent handling — some used raw `execSync`, some `spawnSync` directly. Every git call now goes through `spawnGit(['…'])`, and every failure routes through a new `logGitFailure(where, err)` helper that suppresses the expected "not a git repository" case, deduplicates the "git not found on PATH" warning via `_gitMissingLogged`, and logs everything else with one-line stderr.
+- **Startup `git --version` probe** — Added a `setImmediate(() => spawnGit(['--version']))` at module init that always logs `[git] git version X.Y.Z — OK` or `[git] startup probe FAILED: <reason>. File explorer git UI will be hidden.` — the first diagnostic Windows users should check, since every prior git failure was silently swallowed by the catch blocks.
+- **`windowsHide: true` on every git spawn** — Prevents a momentary cmd.exe console window flash on Windows whenever the file explorer refreshes git status.
+
 ## 2026-04-20
 
 ### Added — Install Toggles For Claude / Gemini / Codex / OpenCode In Onboarding Step 5

package/neural-interface/public/onboarding.html

@@ -2154,15 +2154,58 @@ document.getElementById('buildBtn').addEventListener('click', async () => {
       wizardState.projects.forEach((p, i) => {
         const card = document.createElement('div');
         card.className = 'onboard-project-card';
-        card.style.cssText = 'display:flex;align-items:center;gap:10px;padding:10px 12px;background:rgba(109,213,140,0.06);border:1px solid rgba(109,213,140,0.2);border-radius:8px;font-size:12px';
+        card.style.cssText = 'display:flex;flex-direction:column;gap:8px;padding:10px 12px;background:rgba(109,213,140,0.06);border:1px solid rgba(109,213,140,0.2);border-radius:8px;font-size:12px';
+        const safePath = p.path.replace(/\\/g, '/');
         card.innerHTML = `
-          <svg viewBox="0 0 24 24" style="width:18px;height:18px;fill:none;stroke:rgba(109,213,140,0.8);stroke-width:2;flex-shrink:0"><path d="M22 11.08V12a10 10 0 1 1-5.93-9.14"/><polyline points="22 4 12 14.01 9 11.01"/></svg>
-          <div style="flex:1;min-width:0">
-            <div style="color:var(--t-bright);font-weight:500">${p.label}</div>
-            <div style="color:var(--t-muted);font-size:11px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap" title="${p.path.replace(/\\/g, '/')}">${p.path.replace(/\\/g, '/')}</div>
+          <div style="display:flex;align-items:center;gap:10px">
+            <svg viewBox="0 0 24 24" style="width:18px;height:18px;fill:none;stroke:rgba(109,213,140,0.8);stroke-width:2;flex-shrink:0"><path d="M22 11.08V12a10 10 0 1 1-5.93-9.14"/><polyline points="22 4 12 14.01 9 11.01"/></svg>
+            <div style="flex:1;min-width:0">
+              <div style="color:var(--t-bright);font-weight:500">${p.label}</div>
+              <div style="color:var(--t-muted);font-size:11px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap" title="${safePath}">${safePath}</div>
+            </div>
+            <button class="onboard-project-remove" style="background:none;border:none;color:var(--t-muted);cursor:pointer;font-size:16px;padding:2px 6px;line-height:1;opacity:0.5" title="Remove">&times;</button>
           </div>
-          <button class="onboard-project-remove" style="background:none;border:none;color:var(--t-muted);cursor:pointer;font-size:16px;padding:2px 6px;line-height:1;opacity:0.5" title="Remove">&times;</button>
         `;
+        if (p.dubiousOwnership && !p.trusted) {
+          const trustRow = document.createElement('div');
+          trustRow.className = 'onboard-trust-row';
+          trustRow.style.cssText = 'display:flex;align-items:center;gap:8px;padding:6px 8px;background:rgba(255,183,77,0.08);border:1px solid rgba(255,183,77,0.25);border-radius:6px;font-size:11px;color:rgba(255,204,128,0.9)';
+          trustRow.innerHTML = `
+            <span>&#9888; Git ownership mismatch &mdash; workspace needs to be trusted</span>
+            <button class="onboard-trust-btn" style="margin-left:auto;background:rgba(255,183,77,0.2);border:1px solid rgba(255,183,77,0.35);color:#ffe0b2;padding:4px 10px;border-radius:5px;font-size:11px;cursor:pointer">Trust workspace</button>
+          `;
+          const $btn = trustRow.querySelector('.onboard-trust-btn');
+          $btn.addEventListener('click', async () => {
+            $btn.disabled = true;
+            $btn.textContent = 'Trusting...';
+            try {
+              const r = await fetch('/api/terminal/trust-workspace', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ path: p.trustPath || safePath }),
+              });
+              const d = await r.json();
+              if (d.ok) {
+                p.trusted = true;
+                renderProjectList();
+              } else {
+                $btn.disabled = false;
+                $btn.textContent = 'Trust workspace';
+                $error.textContent = d.error || 'Trust failed';
+              }
+            } catch {
+              $btn.disabled = false;
+              $btn.textContent = 'Trust workspace';
+              $error.textContent = 'Trust failed';
+            }
+          });
+          card.appendChild(trustRow);
+        } else if (p.trusted) {
+          const okRow = document.createElement('div');
+          okRow.style.cssText = 'font-size:11px;color:rgba(109,213,140,0.8)';
+          okRow.textContent = '✓ Workspace trusted';
+          card.appendChild(okRow);
+        }
         card.querySelector('.onboard-project-remove').addEventListener('click', () => {
           wizardState.projects.splice(i, 1);
           renderProjectList();
@@ -2212,15 +2255,16 @@ document.getElementById('buildBtn').addEventListener('click', async () => {
 
     // Register via API
     $addBtn.innerHTML = '<div class="spinner" style="width:14px;height:14px"></div> Registering...';
+    let integData = null;
     try {
       const res = await fetch('/api/claude-code/integrations', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ target: 'project', projectPath: folderPath, label }),
       });
-      const data = await res.json();
-      if (!data.ok) {
-        $error.textContent = data.error || 'Failed to register project.';
+      integData = await res.json();
+      if (!integData.ok) {
+        $error.textContent = integData.error || 'Failed to register project.';
         $addBtn.disabled = false;
         $addBtn.innerHTML = origHTML;
         return;
@@ -2232,7 +2276,12 @@ document.getElementById('buildBtn').addEventListener('click', async () => {
       return;
     }
 
-    wizardState.projects.push({ path: folderPath, label });
+    const projectEntry = { path: folderPath, label };
+    if (integData && integData.dubiousOwnership && integData.trustPath) {
+      projectEntry.dubiousOwnership = true;
+      projectEntry.trustPath = integData.trustPath;
+    }
+    wizardState.projects.push(projectEntry);
     $addBtn.disabled = false;
     $addBtn.innerHTML = origHTML;
     renderProjectList();

package/neural-interface/public/shared/styles.css

@@ -13868,6 +13868,23 @@
   }
   .fe-modal-confirm:hover { background: rgba(229,115,115,0.35); color: #ffab91; }
 
+  /* ── Trust-workspace modal (amber accent, different from destructive red) ── */
+  .fe-trust-modal .fe-modal-title { color: #ffb74d; }
+  .fe-trust-modal .fe-modal-confirm { background: rgba(255,183,77,0.18); color: #ffcc80; }
+  .fe-trust-modal .fe-modal-confirm:hover { background: rgba(255,183,77,0.3); color: #ffe0b2; }
+  .fe-trust-modal .fe-modal-confirm:disabled { opacity: 0.5; cursor: default; }
+  .fe-trust-path {
+    margin-top: 10px;
+    padding: 8px 10px;
+    background: rgba(0,0,0,0.3);
+    border: 1px solid rgba(255,255,255,0.08);
+    border-radius: 6px;
+    font-family: var(--font-mono, ui-monospace, monospace);
+    font-size: 11px;
+    color: rgba(255,255,255,0.6);
+    word-break: break-all;
+  }
+
   /* ── Color palette popup ── */
   .fe-color-palette {
     position: absolute;

package/neural-interface/public/shared/ui-file-explorer.js

@@ -648,7 +648,13 @@ async function addProjectFlow() {
 
     // Register as a project
     const label = data.path.split(/[\\/]/).pop() || data.path;
-    await fetch('/api/claude-code/integrations', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ target: 'project', projectPath: data.path, label }) });
+    const integRes = await fetch('/api/claude-code/integrations', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ target: 'project', projectPath: data.path, label }) });
+    const integData = await integRes.json().catch(() => ({}));
+
+    // Windows git CVE-2022-24765 safe.directory prompt — only fires when server detected the specific error.
+    if (integData && integData.dubiousOwnership && integData.trustPath) {
+      await promptTrustWorkspace(integData.trustPath);
+    }
 
     // Refresh projects list and select the new one
     await fetchProjects();
@@ -665,6 +671,67 @@ async function addProjectFlow() {
   }
 }
 
+function promptTrustWorkspace(trustPath) {
+  return new Promise((resolve) => {
+    const existing = document.getElementById('fe-trust-modal');
+    if (existing) existing.remove();
+
+    const overlay = document.createElement('div');
+    overlay.id = 'fe-trust-modal';
+    overlay.className = 'fe-modal-overlay';
+
+    const modal = document.createElement('div');
+    modal.className = 'fe-modal fe-trust-modal';
+    modal.innerHTML = `
+      <div class="fe-modal-title">Git ownership mismatch</div>
+      <div class="fe-modal-body">
+        Git is refusing to read this workspace because it's owned by a different user account. Trusting it adds the directory to your global <code>safe.directory</code> config so Synabun's git UI can show the branch and changes.
+        <div class="fe-trust-path" id="fe-trust-path"></div>
+      </div>
+      <div class="fe-modal-actions">
+        <button class="fe-modal-btn fe-modal-cancel" id="fe-trust-skip">Skip</button>
+        <button class="fe-modal-btn fe-modal-confirm" id="fe-trust-confirm">Trust workspace</button>
+      </div>
+    `;
+    overlay.appendChild(modal);
+    document.body.appendChild(overlay);
+    modal.querySelector('#fe-trust-path').textContent = trustPath;
+
+    requestAnimationFrame(() => overlay.classList.add('fe-modal-overlay--in'));
+
+    const done = () => {
+      overlay.classList.remove('fe-modal-overlay--in');
+      setTimeout(() => overlay.remove(), 150);
+      document.removeEventListener('keydown', onKey);
+      resolve();
+    };
+    const onKey = (ev) => { if (ev.key === 'Escape') done(); };
+    document.addEventListener('keydown', onKey);
+
+    modal.querySelector('#fe-trust-skip').addEventListener('click', done);
+    overlay.addEventListener('click', (ev) => { if (ev.target === overlay) done(); });
+
+    modal.querySelector('#fe-trust-confirm').addEventListener('click', async () => {
+      const btn = modal.querySelector('#fe-trust-confirm');
+      btn.disabled = true;
+      btn.textContent = 'Trusting...';
+      try {
+        const res = await fetch('/api/terminal/trust-workspace', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ path: trustPath }),
+        });
+        const data = await res.json();
+        if (data.ok) showToast('Workspace trusted');
+        else showToast(data.error || 'Trust failed');
+      } catch {
+        showToast('Trust failed');
+      }
+      done();
+    });
+  });
+}
+
 function initProjectSelector() {
   const btn = $('fe-project-btn');
   const wrap = $('fe-project-selector');
@@ -1704,21 +1771,21 @@ function focusEditorLocation(lineNum, columnNum = 1) {
   syncGutterScroll();
 }
 
-async function openFileEditor(filePath, opts = {}) {
-  try {
-    const normalizedPath = String(filePath || '').replace(/\\/g, '/');
-    const res = await fetch(`/api/file-content?path=${encodeURIComponent(filePath)}`);
-    const data = await res.json();
-    if (!res.ok) {
-      const isOpencodeConfig = normalizedPath.endsWith('/.config/opencode/config.json');
-      const isAllowlistMiss = res.status === 403 && data?.error === 'Path outside registered project roots';
-      if (isOpencodeConfig && isAllowlistMiss) {
-        showToast('Restart Synabun to apply OpenCode config editor support');
-        return;
-      }
-      showToast(data.error || 'Cannot open file');
-      return;
-    }
+async function openFileEditor(filePath, opts = {}) {
+  try {
+    const normalizedPath = String(filePath || '').replace(/\\/g, '/');
+    const res = await fetch(`/api/file-content?path=${encodeURIComponent(filePath)}`);
+    const data = await res.json();
+    if (!res.ok) {
+      const isOpencodeConfig = normalizedPath.endsWith('/.config/opencode/config.json');
+      const isAllowlistMiss = res.status === 403 && data?.error === 'Path outside registered project roots';
+      if (isOpencodeConfig && isAllowlistMiss) {
+        showToast('Restart Synabun to apply OpenCode config editor support');
+        return;
+      }
+      showToast(data.error || 'Cannot open file');
+      return;
+    }
 
     _editorOpen = true;
     _editorFilePath = data.path;

package/neural-interface/server.js

@@ -12755,6 +12755,18 @@ app.post('/api/claude-code/integrations', (req, res) => {
       // Create default category tree for the project (parent + children)
       try { ensureProjectCategories(); } catch {}
 
+      // Probe for git "dubious ownership" — signals the UI to show an explicit trust prompt.
+      // Only relevant on Windows when the project dir is owned by a different SID than the
+      // account running Node (external drives, copied repos, etc.). No-op on Mac/Linux.
+      let dubiousOwnership = false;
+      let trustPath = null;
+      try {
+        if (detectDubiousOwnership(normalized)) {
+          dubiousOwnership = true;
+          trustPath = normalizeGitPath(normalized);
+        }
+      } catch { /* non-critical */ }
+
       // Auto-create greeting config entry for the new project
       try {
         const greetingKey = projectLabel.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '');
@@ -12774,7 +12786,7 @@ app.post('/api/claude-code/integrations', (req, res) => {
         }
       } catch { /* non-critical */ }
 
-      return res.json({ ok: true, message: `Hook enabled for ${basename(normalized)}.` });
+      return res.json({ ok: true, message: `Hook enabled for ${basename(normalized)}.`, dubiousOwnership, trustPath });
     }
 
     res.status(400).json({ error: 'Invalid target. Use "global" or "project".' });
@@ -17156,6 +17168,22 @@ setImmediate(() => {
   }
 });
 
+// Git "dubious ownership" detection — CVE-2022-24765 safety check refuses to operate on
+// repos owned by a different OS user/SID. Common on Windows external drives or repos
+// copied from another machine. Returns true only when git emits the specific error.
+function detectDubiousOwnership(dir) {
+  const r = spawnGit(['rev-parse', '--is-inside-work-tree'], { cwd: dir, timeout: 3000 });
+  if (r.status === 0) return false;
+  const stderr = r.stderr?.toString?.() || '';
+  return /dubious ownership|safe\.directory/i.test(stderr);
+}
+
+// Normalize a filesystem path for `git config --add safe.directory` — forward-slashed
+// absolute path, no trailing slash.
+function normalizeGitPath(dir) {
+  return String(dir).replace(/\\/g, '/').replace(/\/+$/, '');
+}
+
 /** Try to get git status for a directory. Returns { branch, statuses } or null. */
 function getGitInfo(dir) {
   // Check if inside a git work tree (spawnGit for consistent path resolution)
@@ -17353,6 +17381,38 @@ app.get('/api/terminal/branches', (req, res) => {
   }
 });
 
+// Trust a workspace path with git — runs `git config --global --add safe.directory <path>`
+// so git stops refusing to operate on it (CVE-2022-24765 dubious-ownership protection).
+// Triggered by the add-project UI flows when the server detects the dubious-ownership error.
+app.post('/api/terminal/trust-workspace', (req, res) => {
+  const { path: dir } = req.body || {};
+  if (!dir || typeof dir !== 'string') return res.status(400).json({ ok: false, error: 'path required' });
+  if (/[\x00-\x1f]/.test(dir) || dir === '*' || dir === '/' || dir === '\\') {
+    return res.status(400).json({ ok: false, error: 'Invalid path' });
+  }
+  let abs;
+  try {
+    abs = resolve(dir);
+    if (!existsSync(abs)) return res.status(400).json({ ok: false, error: `Directory not found: ${abs}` });
+    if (!statSync(abs).isDirectory()) return res.status(400).json({ ok: false, error: 'Path is not a directory' });
+  } catch (err) {
+    return res.status(400).json({ ok: false, error: err.message });
+  }
+
+  const gitPath = normalizeGitPath(abs);
+  const r = spawnGit(['config', '--global', '--add', 'safe.directory', gitPath]);
+  if (r.status !== 0) {
+    const stderr = r.stderr?.toString?.()?.trim() || r.error?.message || 'git config failed';
+    logGitFailure('config --add safe.directory', r.error || { stderr: r.stderr });
+    return res.status(500).json({ ok: false, error: stderr });
+  }
+
+  // Confirm by re-probing
+  const stillDubious = detectDubiousOwnership(abs);
+  console.log(`[git] trusted workspace: ${gitPath}${stillDubious ? ' (but still flagged — check permissions)' : ''}`);
+  res.json({ ok: true, path: gitPath, stillDubious });
+});
+
 app.post('/api/terminal/checkout', (req, res) => {
   const { path: dir, branch } = req.body;
   if (!dir || !branch) return res.status(400).json({ error: 'path and branch required' });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "synabun",
-  "version": "2026.4.20-beta.13",
+  "version": "2026.4.20-beta.14",
   "description": "Persistent vector memory for AI assistants",
   "license": "Apache-2.0",
   "author": "The SynaBun Authors",