synabun 2026.4.25-beta.2 → 2026.4.26-beta

package/CHANGELOG.md

@@ -2,7 +2,7 @@
 
 Raw internal changelogs are archived in [changelog/](changelog/).
 
-## 2026-04-25
+## 2026-04-26.beta-1
 
 ### Added — Dedicated Schedules Studio
 - **Standalone schedule window** — Added `neural-interface/public/shared/ui-schedules-studio.js` and initialized it from both `neural-interface/public/variant/2d/main.js` and `neural-interface/public/variant/3d/main.js`. The new window opens from `automations:open-schedules` and keeps schedule management out of the Automation Studio detail pane.
@@ -57,6 +57,27 @@ Raw internal changelogs are archived in [changelog/](changelog/).
 - **Official install URLs** — `claude-code` → `https://docs.claude.com/en/docs/claude-code/setup`, `codex` → `https://developers.openai.com/codex/cli/`, `opencode` → `https://opencode.ai/docs/`. (`gemini` constants defined for future use; no Gemini sidepanel currently exists.)
 - **Banner styles** — Added `.cp-cli-missing*`, `.cxp-cli-missing*`, `.ocp-cli-missing*` rule sets to `ui-claude-panel.js` style block, `cdx/cdx-styles.js`, and `ocp/ocp-styles.js`. Includes `.cp-cli-blocked` / `.cxp-cli-blocked` / `.ocp-cli-blocked` panel classes for the dimmed input state.
 
+### Fixed — CLI-Not-Installed Banner Hidden After Errors / Broken-Binary Cases (Sidepanels)
+- **Banner relocated to top of messages container** — Was rendered inside `.cxp-empty` / `.cp-empty` / `.ocp-empty`. Once any system message appeared (e.g. `Codex session closed` + `Codex app-server exited before responding to request 1`), the empty-state collapsed and took the banner with it. Banner is now an independent `:first-child` of `#cxp-messages-container`, `#cp-messages-container`, and `.ocp-messages-container` via `container.insertBefore(banner, container.firstChild)`. Stays visible across transcript states. New `ensureCliBannerEl()` / `removeCliBannerEl()` / `refreshCliBanner()` helpers replace the old empty-state-scoped `renderCliMissingBanner` / `refreshCliBanners` in `neural-interface/public/shared/cdx/cdx-panel.js`, `neural-interface/public/shared/ui-claude-panel.js`, and `neural-interface/public/shared/ocp/ocp-panel.js`.
+- **Spawn-failure pattern detection** — Banner only triggered when `/api/system/tool-versions` reported `installed: null`. A broken-but-present binary (e.g. `codex 0.125.0` spawning then exiting immediately) reports a real version, so the banner never showed. Added a per-panel `_cliInstallFailureForced` flag flipped on by WS error patterns:
+  - **Codex** — `applySocketError` in `cdx/cdx-tabs.js` matches `/Codex CLI not found|ENOENT|app-server exited before responding|app-server spawn/i` → dynamic-imports `cdx-panel.js` and calls exported `flagCdxCliInstallFailure()`.
+  - **Claude** — `case 'error'` in WS handler matches `/Claude CLI not found|ENOENT/i` → `flagClaudeCliInstallFailure()`.
+  - **OpenCode** — `onError` callback matches `/opencode.*(not.*found|ENOENT|spawn)|opencode CLI/i` → `flagOcpCliInstallFailure()`.
+  - All three flags clear automatically when the `cli-status` subscriber callback later receives an installed value.
+- **Send-button gate now reads forced flag** — Claude `send()`, Codex `sendPrompt()` (via `.cxp-cli-blocked` panel class read in `syncInputEnabled`), and OpenCode `syncSendButton` / `handleSend` all check `_cliInstalled === null || _cliInstallFailureForced` so a broken-binary install also blocks send.
+- **Banner restyled as sticky alert** — New `.cxp-cli-banner*`, `.cp-cli-banner*`, `.ocp-cli-banner*` rule sets in `cdx/cdx-styles.js`, `ui-claude-panel.js` style block, and `ocp/ocp-styles.js`. Three-column grid (icon, text, actions), orange/amber theme, `flex-shrink: 0`, sits at top of the scroll region with `z-index: 5` so it stays above transcript content.
+
+### Fixed — High Severity npm audit Alerts in Install CLI (Neural Interface)
+- **Playwright SSL cert verification CVE** — `neural-interface/package.json` pinned `playwright` at `1.54.2`, vulnerable to GHSA-7mvr-c777-76hp (browser downloader skipped SSL cert authenticity check). Bumped to `^1.59.1` (non-major) — fixed in `<1.55.1`. `setup.js` install flow no longer prints the high severity warning after `Installing MCP Server dependencies`.
+- **lodash code injection + protobufjs RCE via transitives** — `lodash@4.17.23` (pulled by `archiver` → `archiver-utils@5.0.2`) had high severity GHSA-r5fr-rjxr-66jc (`_.template` import key code injection) plus moderate prototype pollution. `protobufjs@7.5.4` (pulled by `@huggingface/transformers` → `onnxruntime-web@1.22.0-dev.20250409-89f8206ba4`) had critical GHSA-xq3m-2v4x-88gg (arbitrary code execution). Added `overrides` block in `neural-interface/package.json` pinning `lodash: ^4.18.1` and `protobufjs: ^7.5.5` — both within the parents' implicit ranges, no breaking change.
+
+### Fixed — Moderate/High npm audit Alerts in Install CLI (MCP Server)
+- **uuid buffer bounds check CVE** — `mcp-server/package.json` had `uuid@^11.1.0`, vulnerable to GHSA-w5hq-g745-h8pq (missing buffer bounds check in `v3`/`v5`/`v6` when `buf` provided), fixed in `<14.0.0`. Bumped to `^14.0.0` (semver major) — `v4` named export unchanged, `src/tools/remember.ts` and `src/tui.ts` compile cleanly with no source modifications.
+- **hono / @hono/node-server / postcss / vite / protobufjs transitives** — multiple moderate-to-high CVEs in vitest's transitive `vite@8.0.0-8.0.4` (path traversal, `server.fs.deny` bypass, websocket arbitrary file read), `hono@<4.12.14` (cookie validation, path traversal in `toSSG()`, ipRestriction IPv4-mapped IPv6), `@hono/node-server@<1.19.13` (serveStatic repeated-slash bypass), `postcss@<8.5.10` (XSS via unescaped `</style>`), and `protobufjs@<7.5.5`. Added `overrides` block in `mcp-server/package.json` pinning `protobufjs: ^7.5.5`, `hono: ^4.12.14`, `@hono/node-server: ^1.19.13`, `postcss: ^8.5.10`, `vite: ^8.0.10` — patches only, no breaking semver bumps to direct deps.
+
+### Changed — Removed Deprecated `@types/uuid` devDependency
+- **uuid v14 ships own type defs** — removed `@types/uuid: ^10.0.0` from `mcp-server/package.json` devDependencies. npm warned the stub package as deprecated (`This is a stub types definition. uuid provides its own type definitions, so you do not need this installed`). `tsc` build verified — no missing-types errors.
+
 ## 2026-04-24
 
 ### Added — "Continue planning" in OpenCode, Codex, and Claude plan UIs

package/mcp-server/package.json

@@ -24,15 +24,21 @@
     "@modelcontextprotocol/sdk": "^1.12.1",
     "chalk": "^5.6.2",
     "express": "^4.21.0",
-    "uuid": "^11.1.0",
+    "uuid": "^14.0.0",
     "zod": "^3.24.2"
   },
   "devDependencies": {
     "@types/express": "^5.0.0",
     "@types/node": "^22.12.0",
-    "@types/uuid": "^10.0.0",
     "tsx": "^4.19.0",
     "typescript": "^5.9.3",
     "vitest": "^4.1.0"
+  },
+  "overrides": {
+    "protobufjs": "^7.5.5",
+    "hono": "^4.12.14",
+    "@hono/node-server": "^1.19.13",
+    "postcss": "^8.5.10",
+    "vite": "^8.0.10"
   }
 }

package/neural-interface/package.json

@@ -21,8 +21,12 @@
     "express": "^4.21.2",
     "node-html-markdown": "^2.0.0",
     "node-pty": "^1.1.0",
-    "playwright": "1.54.2",
+    "playwright": "^1.59.1",
     "undici": "^8.1.0",
     "ws": "^8.19.0"
+  },
+  "overrides": {
+    "lodash": "^4.18.1",
+    "protobufjs": "^7.5.5"
   }
 }

package/neural-interface/public/shared/cdx/cdx-panel.js

@@ -394,71 +394,79 @@ function startupEmptyText() {
 }
 
 // ── CLI installation status (banner + send-block) ──
-function renderCliMissingBanner(emptyEl) {
-  if (!emptyEl) return;
+let _cliInstallFailureForced = false;
+
+function ensureCliBannerEl() {
+  if (!_panel) return null;
+  const container = panelEl('#cxp-messages-container');
+  if (!container) return null;
+  let banner = container.querySelector(':scope > .cxp-cli-banner');
+  if (banner) return banner;
   const label = getCliLabel('codex');
   const cmd = getCliInstallCommand('codex');
   const url = getCliDocUrl('codex');
-  const statusEl = emptyEl.querySelector('.cxp-empty-status');
-  if (statusEl) statusEl.style.display = 'none';
-  let banner = emptyEl.querySelector('.cxp-cli-missing');
-  if (!banner) {
-    banner = document.createElement('div');
-    banner.className = 'cxp-cli-missing';
-    banner.innerHTML = `
-      <div class="cxp-cli-missing-title">${label} CLI not installed</div>
-      <div class="cxp-cli-missing-body">Run: <code>${cmd}</code></div>
-      <div class="cxp-cli-missing-actions">
-        <a class="cxp-cli-missing-link" href="${url}" target="_blank" rel="noopener noreferrer">Install guide</a>
-        <button class="cxp-cli-missing-recheck" type="button">Re-check</button>
-      </div>
-    `;
-    emptyEl.appendChild(banner);
-    const btn = banner.querySelector('.cxp-cli-missing-recheck');
-    btn?.addEventListener('click', async () => {
-      btn.disabled = true;
-      btn.textContent = 'Checking…';
-      try { await recheckCliStatus('codex'); }
-      finally {
-        if (btn.isConnected) {
-          btn.disabled = false;
-          btn.textContent = 'Re-check';
-        }
+  banner = document.createElement('div');
+  banner.className = 'cxp-cli-banner';
+  banner.innerHTML = `
+    <div class="cxp-cli-banner-icon">!</div>
+    <div class="cxp-cli-banner-text">
+      <div class="cxp-cli-banner-title">${label} CLI not installed</div>
+      <div class="cxp-cli-banner-body">Run <code>${cmd}</code> or follow the install guide.</div>
+    </div>
+    <div class="cxp-cli-banner-actions">
+      <a class="cxp-cli-banner-link" href="${url}" target="_blank" rel="noopener noreferrer">Install guide</a>
+      <button class="cxp-cli-banner-recheck" type="button">Re-check</button>
+    </div>
+  `;
+  container.insertBefore(banner, container.firstChild);
+  const btn = banner.querySelector('.cxp-cli-banner-recheck');
+  btn?.addEventListener('click', async () => {
+    btn.disabled = true;
+    btn.textContent = 'Checking…';
+    try { await recheckCliStatus('codex'); }
+    finally {
+      if (btn.isConnected) {
+        btn.disabled = false;
+        btn.textContent = 'Re-check';
       }
-    });
-  }
+    }
+  });
+  return banner;
 }
 
-function refreshCliBanners() {
+function removeCliBannerEl() {
   if (!_panel) return;
-  const empties = _panel.querySelectorAll('.cxp-empty');
-  if (_cliInstalled === null) {
-    _panel.classList.add('cxp-cli-blocked');
-    for (const el of empties) renderCliMissingBanner(el);
-  } else {
-    _panel.classList.remove('cxp-cli-blocked');
-    for (const el of empties) {
-      const banner = el.querySelector('.cxp-cli-missing');
-      if (banner) banner.remove();
-      const statusEl = el.querySelector('.cxp-empty-status');
-      if (statusEl) statusEl.style.display = '';
-    }
-  }
-  // Re-evaluate send button state with new CLI flag
+  const container = panelEl('#cxp-messages-container');
+  const banner = container?.querySelector(':scope > .cxp-cli-banner');
+  banner?.remove();
+}
+
+function refreshCliBanner() {
+  if (!_panel) return;
+  const missing = _cliInstalled === null || _cliInstallFailureForced;
+  _panel.classList.toggle('cxp-cli-blocked', missing);
+  if (missing) ensureCliBannerEl();
+  else removeCliBannerEl();
   try { syncInputEnabled(); } catch {}
 }
 
 export function isCdxCliInstalled() {
-  return _cliInstalled !== null;
+  return _cliInstalled !== null && !_cliInstallFailureForced;
+}
+
+export function flagCdxCliInstallFailure() {
+  _cliInstallFailureForced = true;
+  refreshCliBanner();
+  recheckCliStatus('codex').catch(() => {});
 }
 
 function ensureCliSubscription() {
   if (_cliUnsub) return;
   _cliUnsub = subscribeCliStatus('codex', (info) => {
     _cliInstalled = info?.installed || null;
-    refreshCliBanners();
+    if (_cliInstalled) _cliInstallFailureForced = false;
+    refreshCliBanner();
   });
-  document.addEventListener('cdx-empty-rebuilt', () => refreshCliBanners());
 }
 
 // ═══════════════════════════════════════════
@@ -497,7 +505,7 @@ function setVisible(nextVisible) {
     loadCurrentProfile();
     loadRecallProfile();
     panelEl('#cxp-input')?.focus();
-    refreshCliBanners();
+    refreshCliBanner();
   } else {
     document.removeEventListener('keydown', _cdxDocEscHandler, { capture: true });
   }

package/neural-interface/public/shared/cdx/cdx-styles.js

@@ -984,36 +984,68 @@ export function injectStyles() {
     .cxp-empty-logo svg { width: 32px; height: 32px; opacity: 0.25; }
     .cxp-empty-name { font-size: 13px; font-weight: 500; color: rgba(255,255,255,0.35); letter-spacing: 0.02em; }
     .cxp-empty-status { font-size: 11px; color: rgba(255,255,255,0.28); line-height: 1.5; min-height: 1em; }
-    .cxp-cli-missing {
-      display: flex; flex-direction: column; align-items: center; gap: 8px;
-      max-width: 320px; padding: 14px 16px; margin-top: 4px;
-      border: 1px solid rgba(255,180,80,0.35); border-radius: 8px;
-      background: rgba(255,180,80,0.06);
-    }
-    .cxp-cli-missing-title {
-      font-size: 12px; font-weight: 600; color: rgba(255,200,120,0.9);
-      letter-spacing: 0.02em;
-    }
-    .cxp-cli-missing-body {
-      font-size: 11px; color: rgba(255,255,255,0.55); text-align: center; line-height: 1.45;
-    }
-    .cxp-cli-missing-body code {
-      display: inline-block; padding: 1px 6px; margin-top: 4px;
-      background: rgba(0,0,0,0.35); border-radius: 4px; font-size: 10.5px;
-      color: rgba(255,255,255,0.75);
+    .cxp-cli-banner {
+      flex-shrink: 0;
+      display: grid;
+      grid-template-columns: auto 1fr auto;
+      gap: 10px;
+      align-items: center;
+      margin: 8px 12px 0;
+      padding: 10px 12px;
+      border: 1px solid rgba(255,180,80,0.45);
+      border-radius: 8px;
+      background: rgba(255,180,80,0.08);
+      color: rgba(255,235,200,0.92);
+      font-size: 11px;
+      line-height: 1.4;
+      position: relative;
+      z-index: 5;
+    }
+    .cxp-cli-banner-icon {
+      width: 22px; height: 22px;
+      display: flex; align-items: center; justify-content: center;
+      border-radius: 50%;
+      background: rgba(255,180,80,0.25);
+      color: rgba(255,210,140,1);
+      font-weight: 700;
+    }
+    .cxp-cli-banner-text { display: flex; flex-direction: column; gap: 2px; min-width: 0; }
+    .cxp-cli-banner-title {
+      font-size: 12px; font-weight: 600;
+      color: rgba(255,210,140,0.95);
+    }
+    .cxp-cli-banner-body {
+      font-size: 11px;
+      color: rgba(255,255,255,0.7);
+      word-break: break-word;
+    }
+    .cxp-cli-banner-body code {
+      padding: 1px 5px;
+      background: rgba(0,0,0,0.35);
+      border-radius: 3px;
+      font-size: 10.5px;
+      color: rgba(255,255,255,0.85);
     }
-    .cxp-cli-missing-actions { display: flex; gap: 8px; margin-top: 4px; }
-    .cxp-cli-missing-link, .cxp-cli-missing-recheck {
+    .cxp-cli-banner-actions { display: flex; gap: 6px; }
+    .cxp-cli-banner-link, .cxp-cli-banner-recheck {
       display: inline-flex; align-items: center; gap: 4px;
-      padding: 5px 10px; font-size: 11px; font-weight: 500;
-      border-radius: 5px; border: 1px solid rgba(255,255,255,0.15);
-      background: rgba(255,255,255,0.04); color: rgba(255,255,255,0.85);
-      text-decoration: none; cursor: pointer; user-select: none;
+      padding: 4px 9px;
+      font-size: 11px;
+      font-weight: 500;
+      border-radius: 4px;
+      border: 1px solid rgba(255,255,255,0.2);
+      background: rgba(255,255,255,0.05);
+      color: rgba(255,255,255,0.9);
+      text-decoration: none;
+      cursor: pointer;
+      user-select: none;
+      font-family: inherit;
     }
-    .cxp-cli-missing-link:hover, .cxp-cli-missing-recheck:hover {
-      background: rgba(255,255,255,0.1); border-color: rgba(255,255,255,0.3);
+    .cxp-cli-banner-link:hover, .cxp-cli-banner-recheck:hover {
+      background: rgba(255,255,255,0.12);
+      border-color: rgba(255,255,255,0.4);
     }
-    .cxp-cli-missing-recheck:disabled { opacity: 0.5; cursor: default; }
+    .cxp-cli-banner-recheck:disabled { opacity: 0.5; cursor: default; }
     .codex-panel.cxp-cli-blocked .cxp-send { opacity: 0.4 !important; cursor: not-allowed !important; }
     .codex-panel.cxp-cli-blocked .cxp-input { opacity: 0.7; }
     .cxp-system {

package/neural-interface/public/shared/cdx/cdx-tabs.js

@@ -552,6 +552,9 @@ function applySocketError(msg) {
   if (_compacting) setCompactingUI(false);
   appendSystem(text, 'error');
   setStatus(text, 'error');
+  if (/Codex CLI not found|ENOENT|app-server exited before responding|app-server spawn/i.test(text)) {
+    import('./cdx-panel.js').then((m) => m.flagCdxCliInstallFailure?.()).catch(() => {});
+  }
   if (msg.requestId) {
     if (_sessionListRequest?.requestId === msg.requestId) {
       _sessionListRequest.reject?.(new Error(text));

package/neural-interface/public/shared/ocp/ocp-panel.js

@@ -910,7 +910,7 @@ async function handleSend() {
   if (!input) return;
   const tab = activeTab();
   if (!tab) return;
-  if (_cliInstalled === null) {
+  if (_cliInstalled === null || _cliInstallFailureForced) {
     setStatus('offline', 'OpenCode CLI not installed. Install it first, then click Re-check.');
     return;
   }
@@ -1013,7 +1013,7 @@ function syncSendButton() {
   const tab = activeTab();
   if (!sendBtn) return;
 
-  const cliBlocked = _cliInstalled === null;
+  const cliBlocked = _cliInstalled === null || _cliInstallFailureForced;
 
   if (cliBlocked) {
     sendBtn.classList.remove('running');
@@ -1521,66 +1521,74 @@ function _ocpDocEscHandler(event) {
 }
 
 // ── CLI installation status (banner + send-block) ──
-function renderCliMissingBanner(emptyEl) {
-  if (!emptyEl) return;
+let _cliInstallFailureForced = false;
+
+function ensureCliBannerEl() {
+  if (!_panel) return null;
+  const container = _panel.querySelector('.ocp-messages-container');
+  if (!container) return null;
+  let banner = container.querySelector(':scope > .ocp-cli-banner');
+  if (banner) return banner;
   const label = getCliLabel('opencode');
   const cmd = getCliInstallCommand('opencode');
   const url = getCliDocUrl('opencode');
-  const hintEl = emptyEl.querySelector('.ocp-empty-hint');
-  if (hintEl) hintEl.style.display = 'none';
-  let banner = emptyEl.querySelector('.ocp-cli-missing');
-  if (!banner) {
-    banner = document.createElement('div');
-    banner.className = 'ocp-cli-missing';
-    banner.innerHTML = `
-      <div class="ocp-cli-missing-title">${label} CLI not installed</div>
-      <div class="ocp-cli-missing-body">Run: <code>${cmd}</code></div>
-      <div class="ocp-cli-missing-actions">
-        <a class="ocp-cli-missing-link" href="${url}" target="_blank" rel="noopener noreferrer">Install guide</a>
-        <button class="ocp-cli-missing-recheck" type="button">Re-check</button>
-      </div>
-    `;
-    emptyEl.appendChild(banner);
-    const btn = banner.querySelector('.ocp-cli-missing-recheck');
-    btn?.addEventListener('click', async () => {
-      btn.disabled = true;
-      btn.textContent = 'Checking…';
-      try { await recheckCliStatus('opencode'); }
-      finally {
-        if (btn.isConnected) {
-          btn.disabled = false;
-          btn.textContent = 'Re-check';
-        }
+  banner = document.createElement('div');
+  banner.className = 'ocp-cli-banner';
+  banner.innerHTML = `
+    <div class="ocp-cli-banner-icon">!</div>
+    <div class="ocp-cli-banner-text">
+      <div class="ocp-cli-banner-title">${label} CLI not installed</div>
+      <div class="ocp-cli-banner-body">Run <code>${cmd}</code> or follow the install guide.</div>
+    </div>
+    <div class="ocp-cli-banner-actions">
+      <a class="ocp-cli-banner-link" href="${url}" target="_blank" rel="noopener noreferrer">Install guide</a>
+      <button class="ocp-cli-banner-recheck" type="button">Re-check</button>
+    </div>
+  `;
+  container.insertBefore(banner, container.firstChild);
+  const btn = banner.querySelector('.ocp-cli-banner-recheck');
+  btn?.addEventListener('click', async () => {
+    btn.disabled = true;
+    btn.textContent = 'Checking…';
+    try { await recheckCliStatus('opencode'); }
+    finally {
+      if (btn.isConnected) {
+        btn.disabled = false;
+        btn.textContent = 'Re-check';
       }
-    });
-  }
+    }
+  });
+  return banner;
 }
 
-function refreshCliBanners() {
+function removeCliBannerEl() {
   if (!_panel) return;
-  const empties = _panel.querySelectorAll('.ocp-empty');
-  if (_cliInstalled === null) {
-    _panel.classList.add('ocp-cli-blocked');
-    for (const el of empties) renderCliMissingBanner(el);
-  } else {
-    _panel.classList.remove('ocp-cli-blocked');
-    for (const el of empties) {
-      const banner = el.querySelector('.ocp-cli-missing');
-      if (banner) banner.remove();
-      const hintEl = el.querySelector('.ocp-empty-hint');
-      if (hintEl) hintEl.style.display = '';
-    }
-  }
+  const banner = _panel.querySelector('.ocp-messages-container > .ocp-cli-banner');
+  banner?.remove();
+}
+
+function refreshCliBanner() {
+  if (!_panel) return;
+  const missing = _cliInstalled === null || _cliInstallFailureForced;
+  _panel.classList.toggle('ocp-cli-blocked', missing);
+  if (missing) ensureCliBannerEl();
+  else removeCliBannerEl();
   syncSendButton();
 }
 
+export function flagOcpCliInstallFailure() {
+  _cliInstallFailureForced = true;
+  refreshCliBanner();
+  recheckCliStatus('opencode').catch(() => {});
+}
+
 function ensureCliSubscription() {
   if (_cliUnsub) return;
   _cliUnsub = subscribeCliStatus('opencode', (info) => {
     _cliInstalled = info?.installed || null;
-    refreshCliBanners();
+    if (_cliInstalled) _cliInstallFailureForced = false;
+    refreshCliBanner();
   });
-  document.addEventListener('ocp-empty-rebuilt', () => refreshCliBanners());
 }
 
 function setVisible(nextVisible) {
@@ -1608,7 +1616,7 @@ function setVisible(nextVisible) {
     if (_curProject) loadBranches(_curProject);
     loadCurrentProfile();
     loadRecallProfile();
-    refreshCliBanners();
+    refreshCliBanner();
   } else {
     document.removeEventListener('keydown', _ocpDocEscHandler, { capture: true });
   }
@@ -1664,6 +1672,9 @@ function wsCallbacks() {
     },
     onError(msg) {
       console.error('[ocp] Error:', msg.message);
+      if (typeof msg.message === 'string' && /opencode.*(not.*found|ENOENT|spawn)|opencode CLI/i.test(msg.message)) {
+        flagOcpCliInstallFailure();
+      }
     },
   };
 }

package/neural-interface/public/shared/ocp/ocp-styles.js

@@ -1521,38 +1521,68 @@ export function injectStyles() {
       stroke: currentColor; fill: none;
       stroke-width: 1; opacity: 0.3;
     }
-    .ocp-cli-missing {
-      display: flex; flex-direction: column; align-items: center; gap: 8px;
-      max-width: 320px; padding: 14px 16px; margin-top: 4px;
-      border: 1px solid rgba(255,180,80,0.35); border-radius: 8px;
-      background: rgba(255,180,80,0.06);
-      color: rgba(255,255,255,0.6);
-    }
-    .ocp-cli-missing-title {
-      font-size: 12px; font-weight: 600; color: rgba(255,200,120,0.9);
-      letter-spacing: 0.02em;
+    .ocp-cli-banner {
+      flex-shrink: 0;
+      display: grid;
+      grid-template-columns: auto 1fr auto;
+      gap: 10px;
+      align-items: center;
+      margin: 8px 12px 0;
+      padding: 10px 12px;
+      border: 1px solid rgba(255,180,80,0.45);
+      border-radius: 8px;
+      background: rgba(255,180,80,0.08);
+      color: rgba(255,235,200,0.92);
+      font-size: 11px;
+      line-height: 1.4;
+      position: relative;
+      z-index: 5;
     }
-    .ocp-cli-missing-body {
-      font-size: 11px; color: rgba(255,255,255,0.55); text-align: center; line-height: 1.45;
+    .ocp-cli-banner-icon {
+      width: 22px; height: 22px;
+      display: flex; align-items: center; justify-content: center;
+      border-radius: 50%;
+      background: rgba(255,180,80,0.25);
+      color: rgba(255,210,140,1);
+      font-weight: 700;
     }
-    .ocp-cli-missing-body code {
-      display: inline-block; padding: 1px 6px; margin-top: 4px;
-      background: rgba(0,0,0,0.35); border-radius: 4px; font-size: 10.5px;
-      color: rgba(255,255,255,0.75);
+    .ocp-cli-banner-text { display: flex; flex-direction: column; gap: 2px; min-width: 0; }
+    .ocp-cli-banner-title {
+      font-size: 12px; font-weight: 600;
+      color: rgba(255,210,140,0.95);
     }
-    .ocp-cli-missing-actions { display: flex; gap: 8px; margin-top: 4px; }
-    .ocp-cli-missing-link, .ocp-cli-missing-recheck {
+    .ocp-cli-banner-body {
+      font-size: 11px;
+      color: rgba(255,255,255,0.7);
+      word-break: break-word;
+    }
+    .ocp-cli-banner-body code {
+      padding: 1px 5px;
+      background: rgba(0,0,0,0.35);
+      border-radius: 3px;
+      font-size: 10.5px;
+      color: rgba(255,255,255,0.85);
+    }
+    .ocp-cli-banner-actions { display: flex; gap: 6px; }
+    .ocp-cli-banner-link, .ocp-cli-banner-recheck {
       display: inline-flex; align-items: center; gap: 4px;
-      padding: 5px 10px; font-size: 11px; font-weight: 500;
-      border-radius: 5px; border: 1px solid rgba(255,255,255,0.15);
-      background: rgba(255,255,255,0.04); color: rgba(255,255,255,0.85);
-      text-decoration: none; cursor: pointer; user-select: none;
+      padding: 4px 9px;
+      font-size: 11px;
+      font-weight: 500;
+      border-radius: 4px;
+      border: 1px solid rgba(255,255,255,0.2);
+      background: rgba(255,255,255,0.05);
+      color: rgba(255,255,255,0.9);
+      text-decoration: none;
+      cursor: pointer;
+      user-select: none;
       font-family: inherit;
     }
-    .ocp-cli-missing-link:hover, .ocp-cli-missing-recheck:hover {
-      background: rgba(255,255,255,0.1); border-color: rgba(255,255,255,0.3);
+    .ocp-cli-banner-link:hover, .ocp-cli-banner-recheck:hover {
+      background: rgba(255,255,255,0.12);
+      border-color: rgba(255,255,255,0.4);
     }
-    .ocp-cli-missing-recheck:disabled { opacity: 0.5; cursor: default; }
+    .ocp-cli-banner-recheck:disabled { opacity: 0.5; cursor: default; }
     .ocp-panel.ocp-cli-blocked .ocp-input { opacity: 0.7; }
 
     /* ── Thinking indicator ── */

package/neural-interface/public/shared/ui-claude-panel.js

@@ -432,38 +432,70 @@ function injectStyles() {
     .cp-messages:has(.msg) .cp-empty,
     .cp-messages:has(.msg-status) .cp-empty { display: none; }
 
-    /* ── CLI-not-installed banner (replaces empty-state hint when claude binary missing) ── */
-    .cp-cli-missing {
-      display: flex; flex-direction: column; align-items: center; gap: 8px;
-      max-width: 320px; padding: 14px 16px; margin-top: 4px;
-      border: 1px solid rgba(255,180,80,0.35); border-radius: 8px;
-      background: rgba(255,180,80,0.06); pointer-events: auto;
-    }
-    .cp-cli-missing-title {
-      font-size: 12px; font-weight: 600; color: rgba(255,200,120,0.9);
-      letter-spacing: 0.02em;
+    /* ── CLI-not-installed banner (sticky top of messages container) ── */
+    .cp-cli-banner {
+      flex-shrink: 0;
+      display: grid;
+      grid-template-columns: auto 1fr auto;
+      gap: 10px;
+      align-items: center;
+      margin: 8px 12px 0;
+      padding: 10px 12px;
+      border: 1px solid rgba(255,180,80,0.45);
+      border-radius: 8px;
+      background: rgba(255,180,80,0.08);
+      color: rgba(255,235,200,0.92);
+      font-size: 11px;
+      line-height: 1.4;
+      pointer-events: auto;
+      position: relative;
+      z-index: 5;
     }
-    .cp-cli-missing-body {
-      font-size: 11px; color: rgba(255,255,255,0.55); text-align: center; line-height: 1.45;
+    .cp-cli-banner-icon {
+      width: 22px; height: 22px;
+      display: flex; align-items: center; justify-content: center;
+      border-radius: 50%;
+      background: rgba(255,180,80,0.25);
+      color: rgba(255,210,140,1);
+      font-weight: 700;
     }
-    .cp-cli-missing-body code {
-      display: inline-block; padding: 1px 6px; margin-top: 4px;
-      background: rgba(0,0,0,0.35); border-radius: 4px; font-size: 10.5px;
-      color: rgba(255,255,255,0.75);
+    .cp-cli-banner-text { display: flex; flex-direction: column; gap: 2px; min-width: 0; }
+    .cp-cli-banner-title {
+      font-size: 12px; font-weight: 600;
+      color: rgba(255,210,140,0.95);
     }
-    .cp-cli-missing-actions { display: flex; gap: 8px; margin-top: 4px; }
-    .cp-cli-missing-link, .cp-cli-missing-recheck {
+    .cp-cli-banner-body {
+      font-size: 11px;
+      color: rgba(255,255,255,0.7);
+      word-break: break-word;
+    }
+    .cp-cli-banner-body code {
+      padding: 1px 5px;
+      background: rgba(0,0,0,0.35);
+      border-radius: 3px;
+      font-size: 10.5px;
+      color: rgba(255,255,255,0.85);
+    }
+    .cp-cli-banner-actions { display: flex; gap: 6px; }
+    .cp-cli-banner-link, .cp-cli-banner-recheck {
       display: inline-flex; align-items: center; gap: 4px;
-      padding: 5px 10px; font-size: 11px; font-weight: 500;
-      border-radius: 5px; border: 1px solid rgba(255,255,255,0.15);
-      background: rgba(255,255,255,0.04); color: rgba(255,255,255,0.85);
-      text-decoration: none; cursor: pointer; user-select: none;
+      padding: 4px 9px;
+      font-size: 11px;
+      font-weight: 500;
+      border-radius: 4px;
+      border: 1px solid rgba(255,255,255,0.2);
+      background: rgba(255,255,255,0.05);
+      color: rgba(255,255,255,0.9);
+      text-decoration: none;
+      cursor: pointer;
+      user-select: none;
+      font-family: inherit;
     }
-    .cp-cli-missing-link:hover, .cp-cli-missing-recheck:hover {
-      background: rgba(255,255,255,0.1); border-color: rgba(255,255,255,0.3);
+    .cp-cli-banner-link:hover, .cp-cli-banner-recheck:hover {
+      background: rgba(255,255,255,0.12);
+      border-color: rgba(255,255,255,0.4);
     }
-    .cp-cli-missing-recheck:disabled { opacity: 0.5; cursor: default; }
-    /* Block send button visually + functionally when CLI missing */
+    .cp-cli-banner-recheck:disabled { opacity: 0.5; cursor: default; }
     .claude-panel.cp-cli-blocked .cp-send { opacity: 0.4 !important; cursor: not-allowed !important; }
     .claude-panel.cp-cli-blocked .cp-input { opacity: 0.7; }
 
@@ -2752,7 +2784,6 @@ function createTab(sessionId = null, label = 'New chat', { autoSwitch = true, id
   msgDiv.innerHTML = `<div class="cp-empty"><div class="cp-empty-logo">${CLAUDE_ICON}</div><span class="cp-empty-name">Claude</span><span class="cp-empty-hint">Send a message to start</span></div>`;
   container.appendChild(msgDiv);
   tab.messagesEl = msgDiv;
-  if (_cliInstalled === null) _renderCliMissingBanner(msgDiv.querySelector('.cp-empty'));
   // Connect WebSocket
   connectTab(tab);
   // Create pill (rendered in shared tray, not inside panel)
@@ -3576,7 +3607,6 @@ async function selectSession(sid, label) {
   const btn = _panel?.querySelector('.cp-session-label');
   if (btn) btn.textContent = tab.label;
   tab.messagesEl.innerHTML = `<div class="cp-empty"><div class="cp-empty-logo">${CLAUDE_ICON}</div><span class="cp-empty-name">Claude</span><span class="cp-empty-hint">Send a message to start</span></div>`;
-  if (_cliInstalled === null) _renderCliMissingBanner(tab.messagesEl.querySelector('.cp-empty'));
   if (sid) {
     loadSessionHistory(sid, tab.messagesEl);
     // Restore session cost from server
@@ -4371,6 +4401,9 @@ function _processTabMsg(tab, msg) {
       if (tab.compacting) { tab.compacting = false; if (tab === activeTab()) _setCompactingUI(false); }
       appendError(tab, msg.message);
       notify('panel', NOTIF_TYPE.ERROR, tab.label || 'Claude Code', { tabId: tab.id });
+      if (typeof msg.message === 'string' && /Claude CLI not found|ENOENT/i.test(msg.message)) {
+        flagClaudeCliInstallFailure();
+      }
       break;
   }
 }
@@ -6586,7 +6619,7 @@ function runSlashCommand(tab, raw) {
 }
 
 function send({ shift = false } = {}) {
-  if (_cliInstalled === null) {
+  if (_cliInstalled === null || _cliInstallFailureForced) {
     notify({ type: NOTIF_TYPE.WARN, title: 'Claude CLI not installed', body: 'Install the Claude Code CLI before sending a message.' });
     return;
   }
@@ -7293,65 +7326,73 @@ function syncReservedWidth() {
 }
 
 // ── CLI installation status (banner + send-block) ──
-function _renderCliMissingBanner(emptyEl) {
-  if (!emptyEl) return;
+let _cliInstallFailureForced = false;
+
+function _ensureCliBannerEl() {
+  if (!_panel) return null;
+  const container = _panel.querySelector('#cp-messages-container');
+  if (!container) return null;
+  let banner = container.querySelector(':scope > .cp-cli-banner');
+  if (banner) return banner;
   const label = getCliLabel('claude-code');
   const cmd = getCliInstallCommand('claude-code');
   const url = getCliDocUrl('claude-code');
-  const hint = emptyEl.querySelector('.cp-empty-hint');
-  if (hint) hint.style.display = 'none';
-  let banner = emptyEl.querySelector('.cp-cli-missing');
-  if (!banner) {
-    banner = document.createElement('div');
-    banner.className = 'cp-cli-missing';
-    banner.innerHTML = `
-      <div class="cp-cli-missing-title">${label} CLI not installed</div>
-      <div class="cp-cli-missing-body">Run: <code>${cmd}</code></div>
-      <div class="cp-cli-missing-actions">
-        <a class="cp-cli-missing-link" href="${url}" target="_blank" rel="noopener noreferrer">Install guide</a>
-        <button class="cp-cli-missing-recheck" type="button">Re-check</button>
-      </div>
-    `;
-    emptyEl.appendChild(banner);
-    const btn = banner.querySelector('.cp-cli-missing-recheck');
-    btn?.addEventListener('click', async () => {
-      btn.disabled = true;
-      btn.textContent = 'Checking…';
-      try { await recheckCliStatus('claude-code'); }
-      finally {
-        if (btn.isConnected) {
-          btn.disabled = false;
-          btn.textContent = 'Re-check';
-        }
+  banner = document.createElement('div');
+  banner.className = 'cp-cli-banner';
+  banner.innerHTML = `
+    <div class="cp-cli-banner-icon">!</div>
+    <div class="cp-cli-banner-text">
+      <div class="cp-cli-banner-title">${label} CLI not installed</div>
+      <div class="cp-cli-banner-body">Run <code>${cmd}</code> or follow the install guide.</div>
+    </div>
+    <div class="cp-cli-banner-actions">
+      <a class="cp-cli-banner-link" href="${url}" target="_blank" rel="noopener noreferrer">Install guide</a>
+      <button class="cp-cli-banner-recheck" type="button">Re-check</button>
+    </div>
+  `;
+  container.insertBefore(banner, container.firstChild);
+  const btn = banner.querySelector('.cp-cli-banner-recheck');
+  btn?.addEventListener('click', async () => {
+    btn.disabled = true;
+    btn.textContent = 'Checking…';
+    try { await recheckCliStatus('claude-code'); }
+    finally {
+      if (btn.isConnected) {
+        btn.disabled = false;
+        btn.textContent = 'Re-check';
       }
-    });
-  }
+    }
+  });
+  return banner;
+}
+
+function _removeCliBannerEl() {
+  if (!_panel) return;
+  const banner = _panel.querySelector('#cp-messages-container > .cp-cli-banner');
+  banner?.remove();
 }
 
 function _refreshCliBanners() {
   if (!_panel) return;
-  const empties = _panel.querySelectorAll('.cp-empty');
-  if (_cliInstalled === null) {
-    _panel.classList.add('cp-cli-blocked');
-    for (const el of empties) _renderCliMissingBanner(el);
-  } else {
-    _panel.classList.remove('cp-cli-blocked');
-    for (const el of empties) {
-      const banner = el.querySelector('.cp-cli-missing');
-      if (banner) banner.remove();
-      const hint = el.querySelector('.cp-empty-hint');
-      if (hint) hint.style.display = '';
-    }
-  }
-  // Re-sync send button state — installed transition should re-enable input drafts
+  const missing = _cliInstalled === null || _cliInstallFailureForced;
+  _panel.classList.toggle('cp-cli-blocked', missing);
+  if (missing) _ensureCliBannerEl();
+  else _removeCliBannerEl();
   const $send = _panel.querySelector('#cp-send');
-  if ($send && _cliInstalled === null) $send.disabled = true;
+  if ($send && missing) $send.disabled = true;
+}
+
+export function flagClaudeCliInstallFailure() {
+  _cliInstallFailureForced = true;
+  _refreshCliBanners();
+  recheckCliStatus('claude-code').catch(() => {});
 }
 
 function _ensureCliSubscription() {
   if (_cliUnsub) return;
   _cliUnsub = subscribeCliStatus('claude-code', (info) => {
     _cliInstalled = info?.installed || null;
+    if (_cliInstalled) _cliInstallFailureForced = false;
     _refreshCliBanners();
   });
 }

package/neural-interface/server.js

@@ -10094,11 +10094,9 @@ async function checkNpmUpdate() {
     const data = await res.json();
     const latest = data.version;
 
-    const cur = current.split('.').map(Number);
-    const lat = latest.split('.').map(Number);
-    const updateAvailable = lat[0] > cur[0]
-      || (lat[0] === cur[0] && lat[1] > cur[1])
-      || (lat[0] === cur[0] && lat[1] === cur[1] && lat[2] > cur[2]);
+    const cleanCur = parseVersion(current) || current;
+    const cleanLat = parseVersion(latest) || latest;
+    const updateAvailable = semverNewer(cleanCur, cleanLat);
 
     _npmUpdateCache = { current, latest, updateAvailable, checkedAt: new Date().toISOString() };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "synabun",
-  "version": "2026.4.25-beta.2",
+  "version": "2026.4.26-beta",
   "description": "Persistent vector memory for AI assistants",
   "license": "Apache-2.0",
   "author": "The SynaBun Authors",