synabun 2026.4.26 → 2026.4.27

package/neural-interface/server.js

@@ -1546,14 +1546,400 @@ app.put('/api/settings', (req, res) => {
   }
 });
 
-// POST /api/server/restart — Gracefully restart the server process
-app.post('/api/server/restart', (req, res) => {
-  console.log('[server] Restart requested — shutting down in 500ms...');
+// ── Graceful shutdown — kills all spawned children before exiting ──
+//
+// Background: the previous /api/server/restart only ran closeDb() + exit(0),
+// leaving spawned children orphaned (opencode sidecar, agents, _sidecarProcess
+// CLI links, pty terminals, cloudflare tunnel). On Windows those orphans
+// kept file handles inside neural-interface/ open, causing EBUSY errors when
+// `npm i -g synabun@latest` tried to rename the package directory.
+//
+// gracefulShutdown() centralizes shutdown so /api/server/restart,
+// /api/server/shutdown, and the new /api/system/run-update all release
+// children before exiting.
+
+let _shutdownInProgress = false;
+
+async function gracefulShutdown(reason = 'shutdown') {
+  if (_shutdownInProgress) return;
+  _shutdownInProgress = true;
+  console.log(`[server] gracefulShutdown(${reason}) — releasing children...`);
+
+  // 1. opencode sidecar — has its own teardown that handles managed PID + ollama.
+  try { stopOpencodeServer(); } catch (err) { console.warn('  opencode stop err:', err?.message); }
+
+  // 2. Agents in agentRegistry — use platform-native tree kill so descendants die too.
+  try {
+    const isWin = process.platform === 'win32';
+    for (const agent of agentRegistry.values()) {
+      const pid = agent?.process?.pid;
+      if (!pid || agent.status !== 'running') continue;
+      agent._stopped = true;
+      agent.status = 'stopped';
+      try {
+        if (isWin) {
+          spawn('taskkill', ['/pid', String(pid), '/T', '/F'], { shell: true, windowsHide: true });
+        } else {
+          try { process.kill(-pid, 'SIGTERM'); } catch { try { agent.process.kill('SIGTERM'); } catch {} }
+        }
+      } catch {}
+    }
+  } catch (err) { console.warn('  agent kill err:', err?.message); }
+
+  // 3. Save snapshot + DB last so children release file handles before SQLite closes.
+  try { saveSessionSnapshot(); } catch {}
+
+  // 4. Brief grace period so SIGTERM'd children can flush.
+  await new Promise(r => setTimeout(r, 500));
+
+  try { closeDb(); } catch {}
+
+  // 5. Belt-and-suspenders: tree-kill THIS process's descendants on Windows.
+  // Synabun spawns CLI links, pty terminals, cloudflare tunnel etc. that may
+  // not be reachable through the registries above. The taskkill /T flag walks
+  // the process tree and terminates every descendant.
+  //
+  // Do not run this for click-to-update. The updater terminal is deliberately
+  // launched before this server exits; taskkill /T would kill that brand-new
+  // terminal too, which looks like a brief blink and no update on Windows.
+  if (process.platform === 'win32' && reason !== 'run-update') {
+    try {
+      // Use spawn(detached) so taskkill survives our own exit and finishes
+      // killing children even if we exit before it completes.
+      const tk = spawn('taskkill', ['/pid', String(process.pid), '/T'], {
+        shell: true, windowsHide: true, detached: true, stdio: 'ignore',
+      });
+      tk.unref();
+    } catch {}
+  }
+
+  console.log(`[server] gracefulShutdown(${reason}) complete — exiting.`);
+}
+
+// POST /api/server/restart — Gracefully restart the server process.
+// (Caller is expected to launch a new instance externally; we just exit.)
+app.post('/api/server/restart', async (req, res) => {
+  console.log('[server] Restart requested.');
   res.json({ ok: true, message: 'Server restarting...' });
-  setTimeout(() => {
-    closeDb();
+  // Defer so the response flushes before we start tearing down children.
+  setTimeout(async () => {
+    await gracefulShutdown('restart');
     process.exit(0);
-  }, 500);
+  }, 200);
+});
+
+// POST /api/server/shutdown — Graceful shutdown without restart. Used by
+// `npm uninstall synabun` (preuninstall.js) and the in-app updater.
+app.post('/api/server/shutdown', async (req, res) => {
+  console.log('[server] Shutdown requested.');
+  res.json({ ok: true, message: 'Server shutting down...' });
+  setTimeout(async () => {
+    await gracefulShutdown('shutdown');
+    process.exit(0);
+  }, 200);
+});
+
+function shellSingleQuote(s) {
+  return `'${String(s).replace(/'/g, `'\\''`)}'`;
+}
+
+function collectWindowsDescendantPids(rootPid) {
+  if (process.platform !== 'win32' || !rootPid) return [];
+  try {
+    const script = [
+      `$root=${Number(rootPid)}`,
+      '$procs=Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId',
+      '$seen=@{}',
+      '$front=@($root)',
+      '$out=@()',
+      'while ($front.Count -gt 0) {',
+      '  $next=@()',
+      '  foreach ($p in $procs) {',
+      '    if ($front -contains $p.ParentProcessId -and -not $seen.ContainsKey($p.ProcessId)) {',
+      '      $seen[$p.ProcessId]=$true',
+      '      $out += $p.ProcessId',
+      '      $next += $p.ProcessId',
+      '    }',
+      '  }',
+      '  $front=$next',
+      '}',
+      '$out -join ","',
+    ].join('; ');
+    const result = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], {
+      encoding: 'utf8',
+      windowsHide: true,
+      timeout: 5000,
+    });
+    const out = result.status === 0 ? String(result.stdout || '').trim() : '';
+    return out
+      ? out.split(',').map(v => Number(v)).filter(pid => Number.isFinite(pid) && pid > 0 && pid !== rootPid)
+      : [];
+  } catch {
+    return [];
+  }
+}
+
+function cleanupOldUpdaterStages(baseDir) {
+  try {
+    if (!existsSync(baseDir)) return;
+    const cutoff = Date.now() - 7 * 24 * 60 * 60 * 1000;
+    for (const name of readdirSync(baseDir)) {
+      const full = resolve(baseDir, name);
+      try {
+        const st = statSync(full);
+        if (st.isDirectory() && st.mtimeMs < cutoff) rmSync(full, { recursive: true, force: true });
+      } catch {}
+    }
+  } catch {}
+}
+
+function stageSynabunUpdater({ installPlan, serverPid, autoRestart, cleanupPids = [] }) {
+  const sourceUpdater = resolve(PACKAGE_ROOT, 'updater.mjs');
+  if (!existsSync(sourceUpdater)) {
+    throw new Error(`updater.mjs not found at ${sourceUpdater}. SynaBun install may be corrupt - reinstall manually: ${installPlan.displayCommand}`);
+  }
+
+  const stagesRoot = resolve(DATA_HOME, 'data', 'updater');
+  mkdirSync(stagesRoot, { recursive: true });
+  cleanupOldUpdaterStages(stagesRoot);
+
+  const stageDir = resolve(stagesRoot, `${Date.now()}-${randomBytes(4).toString('hex')}`);
+  mkdirSync(stageDir, { recursive: true });
+
+  const stagedUpdater = resolve(stageDir, 'updater.mjs');
+  const payloadPath = resolve(stageDir, 'payload.json');
+  const runnerPath = resolve(stageDir, process.platform === 'win32' ? 'run-update.cmd' : 'run-update.sh');
+  copyFileSync(sourceUpdater, stagedUpdater);
+
+  const payload = {
+    serverPid,
+    autoRestart,
+    installSpec: installPlan.installSpec,
+    displayCommand: installPlan.displayCommand,
+    source: installPlan.source,
+    current: installPlan.current,
+    target: installPlan.target,
+    channel: installPlan.channel,
+    cleanupPids,
+  };
+  writeFileSync(payloadPath, JSON.stringify(payload, null, 2) + '\n', 'utf8');
+
+  if (process.platform === 'win32') {
+    const nodeBin = String(process.execPath || 'node').replace(/"/g, '');
+    writeFileSync(runnerPath, [
+      '@echo off',
+      'setlocal enableextensions',
+      'chcp 65001 >nul 2>&1',
+      'title SynaBun Updater',
+      'cd /d "%~dp0"',
+      'set "EXIT_CODE=0"',
+      `set "NODE_BIN=${nodeBin}"`,
+      'if defined SYNABUN_NODE_BIN set "NODE_BIN=%SYNABUN_NODE_BIN%"',
+      'echo SynaBun Updater starting...',
+      'echo Node:    %NODE_BIN%',
+      'echo Stage:   %~dp0',
+      'echo.',
+      '"%NODE_BIN%" "%~dp0updater.mjs" --payload "%~dp0payload.json" --no-hold',
+      'set "EXIT_CODE=%ERRORLEVEL%"',
+      'echo.',
+      'if "%EXIT_CODE%"=="0" (',
+      '  echo [Update finished. Press any key to close this window.]',
+      ') else (',
+      '  echo [Update exited with code %EXIT_CODE%. Press any key to close this window.]',
+      ')',
+      'pause >nul',
+      'endlocal & exit /b %EXIT_CODE%',
+      '',
+    ].join('\r\n'), 'utf8');
+  } else {
+    const nodeBin = shellSingleQuote(process.execPath);
+    writeFileSync(runnerPath, [
+      '#!/usr/bin/env bash',
+      'set +e',
+      'SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"',
+      'cd "$SCRIPT_DIR" || exit 1',
+      'printf \'\\033]0;SynaBun Updater\\007\' 2>/dev/null || true',
+      'NODE_BIN="${SYNABUN_NODE_BIN:-}"',
+      `if [ -z "$NODE_BIN" ]; then NODE_BIN=${nodeBin}; fi`,
+      '"$NODE_BIN" "$SCRIPT_DIR/updater.mjs" --payload "$SCRIPT_DIR/payload.json" --no-hold',
+      'EXIT_CODE=$?',
+      'echo',
+      'if [ "$EXIT_CODE" = "0" ]; then',
+      '  echo "[Update finished. Press Enter to close this window.]"',
+      'else',
+      '  echo "[Update exited with code $EXIT_CODE. Press Enter to close this window.]"',
+      'fi',
+      'read -r _ || true',
+      'exit "$EXIT_CODE"',
+      '',
+    ].join('\n'), 'utf8');
+    try { chmodSync(runnerPath, 0o755); } catch {}
+  }
+
+  return { stageDir, runnerPath, payloadPath };
+}
+
+// POST /api/system/run-update - click-to-update flow.
+//
+// The updater is staged under DATA_HOME, not PACKAGE_ROOT, before launch. This
+// matters on Windows: a terminal cwd or command line inside node_modules/synabun
+// can lock the directory npm is trying to replace.
+app.post('/api/system/run-update', async (req, res) => {
+  try {
+    // Auto-restart is always on — running the click-to-update flow implies the
+    // user wants the new version live without a manual relaunch step.
+    const autoRestart = true;
+
+    if (!_synabunUpdateCache.checkedAt) {
+      try { await checkSynabunUpdate(); } catch {}
+    }
+    const installPlan = _synabunUpdateCache.installPlan;
+    if (!_synabunUpdateCache.updateAvailable || !installPlan) {
+      return res.status(409).json({ error: 'No SynaBun update is currently available.' });
+    }
+    if (installPlan.canAutoUpdate === false) {
+      return res.status(409).json({
+        error: installPlan.manualHint || `This installation cannot be auto-updated. Open ${installPlan.openUrl || SYNABUN_GITHUB_REPO_URL}`,
+        installPlan,
+        openUrl: installPlan.openUrl || SYNABUN_GITHUB_REPO_URL,
+      });
+    }
+    if (!installPlan.installSpec) {
+      return res.status(500).json({ error: 'SynaBun update plan is missing an npm install target.' });
+    }
+
+    const plat = process.platform;
+    const serverPid = process.pid;
+    const cleanupPids = collectWindowsDescendantPids(serverPid);
+    const staged = stageSynabunUpdater({ installPlan, serverPid, autoRestart, cleanupPids });
+
+    let spawned = null;
+    let launchError = null;
+
+    if (plat === 'win32') {
+      // Use cmd's `start` builtin to spawn a fresh visible console.
+      // Prior implementation used PowerShell + Start-Process -ArgumentList,
+      // which re-quoted the runner path and produced `cmd /k """C:\path\..."""`
+      // — cmd's quote-stripping then mangled it and the new window died before
+      // running anything (visible to users as a brief blink). `cmd /c start ""
+      // /D <dir> <runner>` is the canonical, reliable way to launch a fresh
+      // console window on Windows.
+      try {
+        const comSpec = process.env.ComSpec || 'cmd.exe';
+        spawned = spawn(comSpec, [
+          '/c', 'start',
+          '""',                        // empty title — required when next token is quoted path
+          '/D', staged.stageDir,       // working dir for new console
+          staged.runnerPath,           // batch file to run in new window
+        ], {
+          cwd: staged.stageDir,
+          shell: false,
+          detached: true,
+          stdio: 'ignore',
+          windowsHide: true,           // hides only the wrapper cmd.exe; new console stays visible
+          env: {
+            ...process.env,
+            SYNABUN_NODE_BIN: process.execPath,
+          },
+        });
+      } catch (err) { launchError = err; }
+    } else if (plat === 'darwin') {
+      // Drive Terminal.app via osascript. The shim path may contain spaces;
+      // wrap it in single quotes inside the AppleScript string. AppleScript
+      // string is wrapped in JS double-quote, so we escape JS backslashes
+      // and double-quotes after building the inner shell command.
+      const appleCmd = shellSingleQuote(staged.runnerPath);
+      try {
+        spawned = spawn('osascript', [
+          '-e', 'tell application "Terminal" to activate',
+          '-e', `tell application "Terminal" to do script "${appleCmd.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`,
+        ], { cwd: staged.stageDir, detached: true, stdio: 'ignore' });
+      } catch (err) { launchError = err; }
+    } else {
+      // Linux/BSD/etc — try common terminal emulators in order. Each gets
+      // the shim path as the program to run; the shim itself is a bash
+      // script so we let the terminal exec it directly without bash -c.
+      const quotedRunner = shellSingleQuote(staged.runnerPath);
+      const candidates = [
+        ['x-terminal-emulator', ['-e', staged.runnerPath]],
+        ['gnome-terminal',      ['--', staged.runnerPath]],
+        ['konsole',             ['-e', staged.runnerPath]],
+        ['xfce4-terminal',      ['-e', quotedRunner]],
+        ['mate-terminal',       ['-e', quotedRunner]],
+        ['lxterminal',          ['-e', staged.runnerPath]],
+        ['terminator',          ['-e', quotedRunner]],
+        ['alacritty',           ['-e', staged.runnerPath]],
+        ['kitty',               [staged.runnerPath]],
+        ['wezterm',             ['start', '--', staged.runnerPath]],
+        ['urxvt',               ['-e', staged.runnerPath]],
+        ['xterm',               ['-e', staged.runnerPath]],
+      ];
+      for (const [bin, args] of candidates) {
+        let child = null;
+        try {
+          child = spawn(bin, args, { cwd: staged.stageDir, detached: true, stdio: 'ignore' });
+        } catch {
+          continue;
+        }
+        // spawn() doesn't throw synchronously when bin is missing — it emits
+        // 'error' async (ENOENT). Probe briefly to detect that case before
+        // declaring success and unrefing.
+        const survived = await new Promise((resolveProbe) => {
+          let settled = false;
+          const onErr = () => {
+            if (settled) return;
+            settled = true;
+            child.removeAllListeners('error');
+            resolveProbe(false);
+          };
+          child.once('error', onErr);
+          setTimeout(() => {
+            if (settled) return;
+            settled = true;
+            child.removeAllListeners('error');
+            resolveProbe(true);
+          }, 150);
+        });
+        if (survived) { spawned = child; break; }
+      }
+      if (!spawned) {
+        launchError = new Error(
+          'No supported terminal emulator found (tried: x-terminal-emulator, gnome-terminal, konsole, xfce4-terminal, mate-terminal, lxterminal, terminator, alacritty, kitty, wezterm, urxvt, xterm). ' +
+          `Install one (e.g. \`apt install xterm\`) or run manually: ${installPlan.displayCommand}`
+        );
+      }
+    }
+
+    if (!spawned) {
+      const msg = launchError?.message || `Failed to launch updater terminal on ${plat}`;
+      console.error('[server] run-update launch failed:', msg);
+      return res.status(500).json({ error: msg });
+    }
+
+    // Don't tie our shutdown to the spawned process — it's a long-living
+    // terminal we don't want to wait on.
+    spawned.unref();
+    spawned.on('error', (err) => {
+      // Async ENOENT etc. — log but the response already went out.
+      console.error('[server] updater spawn async error:', err.message);
+    });
+
+    console.log(`[server] Updater terminal launched (${installPlan.displayCommand}, autoRestart=${autoRestart}, stage=${staged.stageDir}). Shutting down...`);
+    res.json({ ok: true, autoRestart, installPlan, stageDir: staged.stageDir, platform: plat });
+
+    // Give the spawned terminal time to fully launch before we tear down
+    // (on Windows `start` returns instantly but the new window takes a
+    // beat to init node; on macOS osascript dispatches AppleScript async).
+    // 1.2s is generous; updater polls our PID anyway so an extra second
+    // here is harmless.
+    setTimeout(async () => {
+      await gracefulShutdown('run-update');
+      process.exit(0);
+    }, 1200);
+  } catch (err) {
+    console.error('[server] run-update error:', err?.message);
+    if (!res.headersSent) res.status(500).json({ error: err.message });
+  }
 });
 
 // POST /api/settings/move-db — Move SQLite database to a new directory
@@ -2170,9 +2556,14 @@ function getClaudeBin() {
       // Might be a bare command in PATH — try which/where
       try {
         const envWithPath = { ...process.env, PATH: getAugmentedPath() };
-        const lookup = process.platform === 'win32'
-          ? execSync(`where "${userCmd}"`, { encoding: 'utf-8', env: envWithPath }).split('\n')[0].trim()
-          : execSync(`which "${userCmd}"`, { encoding: 'utf-8', env: envWithPath }).trim();
+        let lookup;
+        if (process.platform === 'win32') {
+          const lines = execSync(`where "${userCmd}"`, { encoding: 'utf-8', env: envWithPath })
+            .split(/\r?\n/).map(l => l.trim()).filter(Boolean);
+          lookup = lines.find(l => /\.(cmd|exe|bat|ps1)$/i.test(l)) || lines[0];
+        } else {
+          lookup = execSync(`which "${userCmd}"`, { encoding: 'utf-8', env: envWithPath }).trim();
+        }
         if (lookup) { _claudeBinPath = lookup; return _claudeBinPath; }
       } catch {}
     }
@@ -2210,8 +2601,12 @@ function getClaudeBin() {
   // 2. Fall back to global install via which/where (with augmented PATH)
   const envWithPath = { ...process.env, PATH: getAugmentedPath() };
   if (process.platform === 'win32') {
-    try { _claudeBinPath = execSync('where claude', { encoding: 'utf-8', env: envWithPath }).split('\n')[0].trim(); }
-    catch { _claudeBinPath = null; }
+    try {
+      const lines = execSync('where claude', { encoding: 'utf-8', env: envWithPath })
+        .split(/\r?\n/).map(l => l.trim()).filter(Boolean);
+      // Prefer .cmd/.exe/.bat/.ps1 over the bare extensionless shim (which is a sh script Windows can't spawn)
+      _claudeBinPath = lines.find(l => /\.(cmd|exe|bat|ps1)$/i.test(l)) || lines[0] || null;
+    } catch { _claudeBinPath = null; }
   } else {
     try { _claudeBinPath = execSync('which claude', { encoding: 'utf-8', env: envWithPath }).trim(); }
     catch { _claudeBinPath = null; }
@@ -4259,12 +4654,36 @@ function stopOpencodeServer() {
   stopOpencodeSSERelay();
   const managedPid = readOpencodeManagedPid();
   const procPid = _ocpProc?.pid || null;
+  const isWin = process.platform === 'win32';
+
+  // On Windows `process.kill(pid, 'SIGTERM')` is unreliable for non-Node
+  // children (cmd.exe shells, opencode native binaries). Use taskkill /T /F
+  // to walk the process tree and force-terminate every descendant.
+  // This is the recurring source of EBUSY errors during `npm i -g
+  // synabun@latest` — opencode-ai's `serve` process survives parent SynaBun
+  // exit and keeps file handles inside neural-interface/ open.
+  const winKill = (pid) => {
+    try {
+      spawn('taskkill', ['/pid', String(pid), '/T', '/F'], {
+        shell: true, windowsHide: true, stdio: 'ignore',
+      });
+    } catch {}
+  };
+
   if (_ocpProc && !_ocpProc.killed) {
-    try { _ocpProc.kill(); } catch {}
+    if (isWin && procPid) {
+      winKill(procPid);
+    } else {
+      try { _ocpProc.kill(); } catch {}
+    }
     _ocpProc = null;
   }
   if (managedPid && managedPid !== procPid) {
-    signalPids([managedPid], 'SIGTERM');
+    if (isWin) {
+      winKill(managedPid);
+    } else {
+      signalPids([managedPid], 'SIGTERM');
+    }
   }
   clearOpencodeManagedPid();
   _ocpReady = false;
@@ -5412,6 +5831,8 @@ app.post('/api/opencode/mcp', async (req, res) => {
     try { persistMcpToOpencodeConfig(name, mcpConfig); } catch (e) {
       return res.status(500).json({ ok: false, error: `Persist failed: ${e.message}` });
     }
+    // Force-allow the 7 SynaBun memory tools so CLI sessions skip prompts.
+    injectOpenCodeMemoryPerms();
     if (_ocpReady) {
       try { await ocpProxy('POST', '/mcp', { name, config: { type: 'stdio', ...mcpConfig } }); } catch (e) {
         console.warn(`[opencode] Runtime register failed (config persisted): ${e.message}`);
@@ -10073,60 +10494,300 @@ app.post('/api/search/memories', async (req, res) => {
 });
 
 // ═══════════════════════════════════════════
-// NPM UPDATE CHECK
+// SYNABUN UPDATE CHECK (NPM + GITHUB RELEASES)
 // ═══════════════════════════════════════════
+//
+// Checks both the npm registry AND the project's GitHub releases. Alerts
+// when EITHER source is newer than the installed version (catches one-sided
+// publishes — e.g. release tagged on GitHub before npm publish completes).
+
+let _synabunUpdateCache = {
+  current: null,
+  installedChannel: 'stable',    // 'stable' | 'prerelease'
+  npmLatestStable: null,         // dist-tags.latest
+  npmLatestBeta: null,           // dist-tags.beta (or null if absent)
+  npmLatestTag: null,            // dist-tag selected for install
+  npmLatest: null,               // chosen target for installed channel
+  gitLatest: null,               // tag_name from GitHub release matching channel
+  gitLatestRaw: null,            // original GitHub tag, preserving leading v
+  latest: null,                  // newer of (npmLatest, gitLatest) — legacy field
+  npmUpdateAvailable: false,
+  gitUpdateAvailable: false,
+  updateAvailable: false,        // npmUpdateAvailable || gitUpdateAvailable
+  source: null,                  // 'npm' | 'github' | 'both' | null
+  installPlan: null,             // server-owned npm/GitHub action target for click-to-update
+  checkedAt: null,
+  npmError: null,
+  gitError: null,
+};
 
-let _npmUpdateCache = { current: null, latest: null, updateAvailable: false, checkedAt: null };
+const SYNABUN_GITHUB_REPO_URL = 'https://github.com/danilokhury/Synabun';
+
+function isSynabunGitHubRemote(remoteText) {
+  return /github\.com[:/]danilokhury\/Synabun(?:\.git)?(?:[\s)]|$)/i.test(String(remoteText || ''));
+}
+
+function detectSynabunInstallSource() {
+  const normalizedRoot = PACKAGE_ROOT.replace(/\\/g, '/');
+  if (/\/node_modules\/synabun$/i.test(normalizedRoot)) {
+    return { kind: 'npm-global' };
+  }
 
-async function checkNpmUpdate() {
   try {
-    const pkgPath = resolve(PACKAGE_ROOT, 'package.json');
-    const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
-    const current = pkg.version;
-    _npmUpdateCache.current = current;
+    const inside = execSync('git rev-parse --is-inside-work-tree', {
+      cwd: PACKAGE_ROOT,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 2000,
+    }).trim();
+    if (inside === 'true') {
+      let remote = '';
+      let remotes = '';
+      try {
+        remote = execSync('git remote get-url origin', {
+          cwd: PACKAGE_ROOT,
+          encoding: 'utf8',
+          stdio: ['ignore', 'pipe', 'ignore'],
+          timeout: 2000,
+        }).trim();
+      } catch {}
+      try {
+        remotes = execSync('git remote -v', {
+          cwd: PACKAGE_ROOT,
+          encoding: 'utf8',
+          stdio: ['ignore', 'pipe', 'ignore'],
+          timeout: 2000,
+        }).trim();
+      } catch {}
+      if (isSynabunGitHubRemote(`${remote}\n${remotes}`)) {
+        const firstRemote = remote || remotes.split(/\s+/).find(part => isSynabunGitHubRemote(part)) || null;
+        return { kind: 'github-clone', remote: firstRemote };
+      }
+      return { kind: 'git-clone', remote: remote || null };
+    }
+  } catch {}
 
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), 5000);
-    const res = await fetch('https://registry.npmjs.org/synabun/latest', { signal: controller.signal });
-    clearTimeout(timeout);
+  return { kind: 'local' };
+}
+
+function buildSynabunInstallPlan({ current, installedChannel, latest, updateAvailable }) {
+  if (!updateAvailable) return null;
+
+  const installSource = detectSynabunInstallSource();
+  if (installSource.kind !== 'npm-global') {
+    const clonedHint = installSource.kind === 'github-clone'
+      ? 'This SynaBun install is a GitHub checkout. Open the repository to pull or reinstall from the correct source.'
+      : 'This SynaBun install was not detected as npm. Open the repository for the correct update path.';
+    return {
+      source: 'github',
+      installSource: installSource.kind,
+      canAutoUpdate: false,
+      current,
+      target: latest,
+      channel: installedChannel,
+      displayCommand: SYNABUN_GITHUB_REPO_URL,
+      openUrl: SYNABUN_GITHUB_REPO_URL,
+      manualCommand: installSource.kind === 'github-clone' ? 'git pull --ff-only' : null,
+      manualHint: clonedHint,
+      remote: installSource.remote,
+    };
+  }
+
+  const installSpec = 'synabun@latest';
+  return {
+    source: 'npm',
+    installSource: installSource.kind,
+    canAutoUpdate: true,
+    current,
+    target: latest,
+    channel: installedChannel,
+    installSpec,
+    displayCommand: 'npm i -g synabun@latest',
+    npmTag: 'latest',
+  };
+}
 
-    if (!res.ok) throw new Error(`npm registry returned ${res.status}`);
-    const data = await res.json();
-    const latest = data.version;
+async function checkSynabunUpdate() {
+  let current = _synabunUpdateCache.current;
+  try {
+    const pkg = JSON.parse(readFileSync(resolve(PACKAGE_ROOT, 'package.json'), 'utf-8'));
+    current = pkg.version;
+  } catch { /* keep prior current if package.json read fails */ }
+
+  const curParsed = parseSemver(current);
+  // Numeric-only suffix (`2026.4.26-1`) is a post-release iteration, not a
+  // prerelease — keep those on the stable channel. Only true alpha/beta/rc
+  // suffixes flip the channel.
+  const installedChannel = (curParsed?.pre && curParsed.iter == null) ? 'prerelease' : 'stable';
 
-    const cur = current.split('.').map(Number);
-    const lat = latest.split('.').map(Number);
-    const updateAvailable = lat[0] > cur[0]
-      || (lat[0] === cur[0] && lat[1] > cur[1])
-      || (lat[0] === cur[0] && lat[1] === cur[1] && lat[2] > cur[2]);
+  const fetchJsonWithTimeout = async (url, ms = 5000) => {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), ms);
+    try {
+      const res = await fetch(url, {
+        signal: controller.signal,
+        headers: { 'Accept': 'application/json', 'User-Agent': 'synabun-update-check' },
+      });
+      if (!res.ok) throw new Error(`${url} returned ${res.status}`);
+      return await res.json();
+    } finally {
+      clearTimeout(timeout);
+    }
+  };
 
-    _npmUpdateCache = { current, latest, updateAvailable, checkedAt: new Date().toISOString() };
+  // npm: fetch the FULL registry document so we can read every dist-tag
+  // (latest + beta + any future channel). The /latest shorthand only
+  // surfaces dist-tags.latest, which made beta installs invisible.
+  // github: when installed is a prerelease, /releases/latest is wrong
+  // because it skips prereleases — fetch the full list and pick newest.
+  const npmUrl = 'https://registry.npmjs.org/synabun';
+  const githubUrl = installedChannel === 'prerelease'
+    ? 'https://api.github.com/repos/danilokhury/Synabun/releases?per_page=20'
+    : 'https://api.github.com/repos/danilokhury/Synabun/releases/latest';
+
+  const [npmRes, gitRes] = await Promise.allSettled([
+    fetchJsonWithTimeout(npmUrl),
+    fetchJsonWithTimeout(githubUrl),
+  ]);
 
-    if (updateAvailable) {
-      console.log(`  Updates:   v${current} → v${latest} available`);
+  let npmLatestStable = null, npmLatestBeta = null, npmLatestBetaTag = null, npmLatestTag = null;
+  let gitLatest = null, gitLatestRaw = null;
+  let npmError = null, gitError = null;
+
+  if (npmRes.status === 'fulfilled') {
+    const tags = npmRes.value?.['dist-tags'] || {};
+    npmLatestStable = tags.latest || null;
+    for (const tagName of ['beta', 'next', 'rc', 'alpha']) {
+      if (tags[tagName]) {
+        npmLatestBeta = tags[tagName];
+        npmLatestBetaTag = tagName;
+        break;
+      }
+    }
+  } else {
+    npmError = npmRes.reason?.message || 'npm fetch failed';
+  }
+
+  if (gitRes.status === 'fulfilled') {
+    if (Array.isArray(gitRes.value)) {
+      // /releases — pick newest non-draft entry whose tag parses as semver.
+      // For stable channel users we'd skip prereleases, but this branch only
+      // runs for prerelease users (per githubUrl above), so include both.
+      let best = null;
+      for (const r of gitRes.value) {
+        if (r?.draft) continue;
+        const tag = r?.tag_name || r?.name || '';
+        const parsed = parseSemver(tag);
+        if (!parsed) continue;
+        if (!best || compareSemver(parsed, best.parsed) > 0) {
+          best = { tag, parsed };
+        }
+      }
+      gitLatestRaw = best?.tag || null;
+      gitLatest = gitLatestRaw ? gitLatestRaw.replace(/^v\.?/, '') : null;
     } else {
-      console.log(`  Updates:   up to date (v${current})`);
+      // /releases/latest — single object
+      const tag = gitRes.value?.tag_name || gitRes.value?.name || '';
+      gitLatestRaw = tag || null;
+      gitLatest = tag ? tag.replace(/^v\.?/, '') : null;
     }
-  } catch (err) {
-    if (!_npmUpdateCache.current) {
-      try {
-        const pkg = JSON.parse(readFileSync(resolve(PACKAGE_ROOT, 'package.json'), 'utf-8'));
-        _npmUpdateCache.current = pkg.version;
-      } catch {}
+  } else {
+    gitError = gitRes.reason?.message || 'github fetch failed';
+  }
+
+  // Channel-aware npm target:
+  //  - prerelease user: pick whichever of (stable, beta) is newest. Either
+  //    is genuinely "newer than current"; surfacing stable when on beta is
+  //    intentional (some users manually flip back to stable).
+  //  - stable user: only stable. Beta on a stable install would look like
+  //    a downgrade ("2026.4.26 → 2026.4.26-beta.3" via semver = older).
+  let npmLatest = null;
+  if (installedChannel === 'prerelease') {
+    if (npmLatestStable && npmLatestBeta) {
+      if (compareSemver(npmLatestBeta, npmLatestStable) > 0) {
+        npmLatest = npmLatestBeta;
+        npmLatestTag = npmLatestBetaTag;
+      } else {
+        npmLatest = npmLatestStable;
+        npmLatestTag = 'latest';
+      }
+    } else {
+      npmLatest = npmLatestStable || npmLatestBeta;
+      npmLatestTag = npmLatestStable ? 'latest' : npmLatestBetaTag;
     }
-    _npmUpdateCache.checkedAt = new Date().toISOString();
-    console.log(`  Updates:   check failed (${err.message})`);
+  } else {
+    npmLatest = npmLatestStable;
+    npmLatestTag = npmLatest ? 'latest' : null;
+  }
+
+  const npmUpdateAvailable = !!(npmLatest && semverNewer(current, npmLatest));
+  const gitUpdateAvailable = !!(gitLatest && semverNewer(current, gitLatest));
+  const updateAvailable = npmUpdateAvailable || gitUpdateAvailable;
+
+  // Newer of the two (npm vs github) for legacy "latest" display.
+  let latest = null;
+  if (npmLatest && gitLatest) {
+    latest = compareSemver(npmLatest, gitLatest) >= 0 ? npmLatest : gitLatest;
+  } else {
+    latest = npmLatest || gitLatest;
+  }
+
+  let source = null;
+  if (npmUpdateAvailable && gitUpdateAvailable) source = 'both';
+  else if (npmUpdateAvailable)                   source = 'npm';
+  else if (gitUpdateAvailable)                   source = 'github';
+
+  const installPlan = buildSynabunInstallPlan({
+    current,
+    installedChannel,
+    latest,
+    updateAvailable,
+  });
+
+  _synabunUpdateCache = {
+    current,
+    installedChannel,
+    npmLatestStable,
+    npmLatestBeta,
+    npmLatestTag,
+    npmLatest,
+    gitLatest,
+    gitLatestRaw,
+    latest,
+    npmUpdateAvailable,
+    gitUpdateAvailable,
+    updateAvailable,
+    source,
+    installPlan,
+    checkedAt: new Date().toISOString(),
+    npmError,
+    gitError,
+  };
+
+  if (updateAvailable) {
+    console.log(`  Updates:   v${current} → v${latest} (${source}; channel: ${installedChannel})`);
+  } else if (npmError && gitError) {
+    console.log(`  Updates:   check failed (npm: ${npmError}; github: ${gitError})`);
+  } else if (npmError) {
+    console.log(`  Updates:   up to date (v${current}; npm check failed: ${npmError})`);
+  } else if (gitError) {
+    console.log(`  Updates:   up to date (v${current}; github check failed: ${gitError})`);
+  } else {
+    console.log(`  Updates:   up to date (v${current}; channel: ${installedChannel})`);
   }
 }
 
 app.get('/api/system/version', async (req, res) => {
-  if (_npmUpdateCache.checkedAt) {
-    const age = Date.now() - new Date(_npmUpdateCache.checkedAt).getTime();
-    if (age > 6 * 60 * 60 * 1000) {
-      checkNpmUpdate().catch(() => {});
+  const force = req.query.force === '1';
+  if (force || !_synabunUpdateCache.checkedAt) {
+    try { await checkSynabunUpdate(); } catch {}
+  } else {
+    const age = Date.now() - new Date(_synabunUpdateCache.checkedAt).getTime();
+    if (age > 60 * 60 * 1000) {
+      checkSynabunUpdate().catch(() => {});
     }
   }
-  res.json(_npmUpdateCache);
+  res.json(_synabunUpdateCache);
 });
 
 // ═══════════════════════════════════════════
@@ -10142,17 +10803,99 @@ const TOOL_DEFS = [
 
 let _toolVersionCache = { checkedAt: null, tools: {} };
 
+// Backwards-compat helper — returns a "MAJOR.MINOR.PATCH" string (no pre).
+// Kept because legacy callers expect a string for display purposes only.
+// Comparison logic must use parseSemver/compareSemver below to handle
+// prerelease/iteration suffixes correctly.
 function parseVersion(raw) {
-  const m = raw.match(/(\d+\.\d+\.\d+)/);
-  return m ? m[1] : null;
+  const m = String(raw ?? '').match(/(\d+)\.(\d+)\.(\d+)/);
+  return m ? `${m[1]}.${m[2]}.${m[3]}` : null;
+}
+
+// Structured semver parse — handles calver bumps and prerelease tags:
+//   "2026.4.26"          -> { major:2026, minor:4, patch:26, pre:null,    iter:null }
+//   "2026.4.20-2"        -> { major:2026, minor:4, patch:20, pre:"2",     iter:2    }
+//   "2026.4.26-beta.3"   -> { major:2026, minor:4, patch:26, pre:"beta.3", iter:null }
+//   "v1.2.3-rc.1"        -> { major:1, minor:2, patch:3, pre:"rc.1", iter:null }
+//
+// `iter` is set when the suffix is purely numeric (SynaBun's calver iteration
+// scheme: `2026.4.26-1` is the FIRST patch published after `2026.4.26`).
+// Strict semver §9 treats any prerelease suffix as PRE-release (lower than no
+// suffix). SynaBun publishes calver iterations as `latest` on npm, so we need
+// to treat numeric-only suffixes as POST-release iterations instead.
+function parseSemver(raw) {
+  if (raw == null) return null;
+  const s = String(raw).trim().replace(/^v\.?/, '');
+  const m = s.match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?/);
+  if (!m) return null;
+  const pre = m[4] || null;
+  const iter = pre && /^\d+$/.test(pre) ? Number(pre) : null;
+  return {
+    major: +m[1],
+    minor: +m[2],
+    patch: +m[3],
+    pre,
+    iter,
+  };
+}
+
+// Precedence (mix of semver §11 + SynaBun calver-iteration convention):
+//   1.0.0-alpha < 1.0.0-alpha.1 < 1.0.0-beta < 1.0.0-beta.2 < 1.0.0 < 1.0.0-1 < 1.0.0-2
+// Numeric-only suffix = post-release iteration (NEWER than no-suffix release).
+// Mixed/alpha suffix  = prerelease (OLDER than no-suffix release, per semver).
+// Returns negative if a<b, positive if a>b, 0 if equal. Accepts strings or
+// parsed objects.
+function compareSemver(a, b) {
+  const pa = (a && typeof a === 'object' && 'major' in a) ? a : parseSemver(a);
+  const pb = (b && typeof b === 'object' && 'major' in b) ? b : parseSemver(b);
+  if (!pa && !pb) return 0;
+  if (!pa) return -1;
+  if (!pb) return 1;
+  if (pa.major !== pb.major) return pa.major - pb.major;
+  if (pa.minor !== pb.minor) return pa.minor - pb.minor;
+  if (pa.patch !== pb.patch) return pa.patch - pb.patch;
+  // Equal x.y.z. Order from oldest → newest:
+  //   alpha-prerelease  <  no-suffix release  <  numeric iteration
+  if (!pa.pre && !pb.pre) return 0;
+  // Numeric iterations are POST-release: always newer than no-suffix and
+  // newer than alpha prereleases.
+  if (pa.iter != null && pb.iter == null) return  1;
+  if (pa.iter == null && pb.iter != null) return -1;
+  if (pa.iter != null && pb.iter != null) return pa.iter - pb.iter;
+  // Neither side is a numeric iteration. Standard semver §11: no-suffix is
+  // greater than alpha prerelease.
+  if (!pa.pre &&  pb.pre) return  1;
+  if ( pa.pre && !pb.pre) return -1;
+  // Both have alpha-flavoured prerelease — compare identifiers per semver §11.4.
+  const ia = pa.pre.split('.');
+  const ib = pb.pre.split('.');
+  const len = Math.max(ia.length, ib.length);
+  for (let i = 0; i < len; i++) {
+    if (i >= ia.length) return -1; // shorter set has lower precedence
+    if (i >= ib.length) return  1;
+    const xa = ia[i], xb = ib[i];
+    const na = /^\d+$/.test(xa), nb = /^\d+$/.test(xb);
+    if (na && nb) {
+      const da = +xa, db = +xb;
+      if (da !== db) return da - db;
+    } else if (na && !nb) {
+      return -1; // numeric < alphanumeric
+    } else if (!na && nb) {
+      return  1;
+    } else {
+      if (xa !== xb) return xa < xb ? -1 : 1;
+    }
+  }
+  return 0;
 }
 
 function semverNewer(a, b) {
-  if (!a || !b) return false;
-  const pa = a.split('.').map(Number), pb = b.split('.').map(Number);
-  return pb[0] > pa[0]
-    || (pb[0] === pa[0] && pb[1] > pa[1])
-    || (pb[0] === pa[0] && pb[1] === pa[1] && pb[2] > pa[2]);
+  // True iff b is strictly newer than a. Falls back to false if either side
+  // can't be parsed — same defensive contract as the prior implementation.
+  if (a == null || b == null) return false;
+  const pa = parseSemver(a), pb = parseSemver(b);
+  if (!pa || !pb) return false;
+  return compareSemver(pa, pb) < 0;
 }
 
 function resolveBinPath(cmd, env) {
@@ -10176,6 +10919,7 @@ function detectInstallSource(binPath) {
   if (/\/node_modules\//.test(p) || /\/npm\/node_modules\//.test(p)) return 'npm';
   if (p.includes('/opt/homebrew/') || p.includes('/usr/local/cellar/') || /\/homebrew\//.test(p)) return 'brew';
   if (p.includes('/.claude/local/') || p.includes('/anthropicclaude/')) return 'native';
+  if (/\/\.local\/bin\//.test(p)) return 'native';
   if (/\/program files( \(x86\))?\//.test(p) || /\/localappdata\/.*anthropicclaude/.test(p)) return 'native';
   if (p.includes('/winget/') || p.includes('/microsoft/winget/')) return 'winget';
   if (/\/usr\/local\/lib\/node_modules\//.test(p)) return 'npm';
@@ -10304,15 +11048,19 @@ async function checkToolVersions() {
     }
 
     // Nuclear safety net for the recurring claude phantom-version bug:
-    // if the probe returned a known historical bundled version of claude-code,
-    // reject it even if the binary-path detection failed. A real user-global
-    // install of claude is always current (2.1.116+), so seeing 2.1.89 etc.
-    // means we're reading a stale bundle SynaBun shipped in a prior release.
-    if (tool.key === 'claude-code' && installed && KNOWN_STALE_CLAUDE_VERSIONS.has(installed)) {
+    // only reject when binary path detection failed (truly phantom). If we
+    // resolved a path AND it's outside SynaBun's own dirs, trust the version
+    // — Anthropic ships these versions in the native installer too, so a
+    // version-only blacklist hits legit installs at ~/.local/bin/claude.exe.
+    if (
+      tool.key === 'claude-code' &&
+      installed &&
+      KNOWN_STALE_CLAUDE_VERSIONS.has(installed) &&
+      !probedBinPath
+    ) {
       console.warn(
-        `  [version-guard] Rejected claude v${installed} from ${probedBinPath || '(unknown path)'}` +
-        ` — matches known-stale SynaBun bundle. Treating as not installed. ` +
-        `If you actually have this version installed, remove it from KNOWN_STALE_CLAUDE_VERSIONS.`
+        `  [version-guard] Rejected claude v${installed} from (unknown path)` +
+        ` — matches known-stale SynaBun bundle and no binary path could be resolved.`
       );
       installed = null;
     }
@@ -12152,6 +12900,89 @@ const SYNABUN_TOOL_CATEGORIES = [
   },
 ];
 
+// ── Memory-tool permission auto-injection ──
+// On MCP enable for any provider, force-allow the 7 SynaBun memory tools
+// (recall/remember/reflect/forget/memories/restore/sync) so PTY/CLI sessions
+// can use SynaBun memory without per-call permission prompts. Inject-only,
+// never overwrites existing entries. Falls back to project-scoped settings
+// when the user has no global settings file.
+function getMemoryToolKeys() {
+  const cat = SYNABUN_TOOL_CATEGORIES.find(c => c.id === 'memory');
+  return cat ? cat.tools.map(t => t.key) : [];
+}
+
+function injectClaudeMemoryPerms() {
+  const keys = getMemoryToolKeys();
+  const globalPath = getGlobalClaudeSettingsPath();
+
+  if (existsSync(globalPath)) {
+    const settings = readClaudeSettings(globalPath) || {};
+    if (!settings.permissions) settings.permissions = {};
+    if (!Array.isArray(settings.permissions.allow)) settings.permissions.allow = [];
+    const set = new Set(settings.permissions.allow);
+    for (const k of keys) set.add(k);
+    settings.permissions.allow = [...set];
+    writeClaudeSettings(globalPath, settings);
+    return { scope: 'global', paths: [globalPath] };
+  }
+
+  const projects = loadHookProjects();
+  const written = [];
+  for (const p of projects) {
+    if (!p?.path) continue;
+    const projPath = getClaudeSettingsPath(p.path);
+    const s = readClaudeSettings(projPath) || {};
+    if (!s.permissions) s.permissions = {};
+    if (!Array.isArray(s.permissions.allow)) s.permissions.allow = [];
+    const set = new Set(s.permissions.allow);
+    for (const k of keys) set.add(k);
+    s.permissions.allow = [...set];
+    writeClaudeSettings(projPath, s);
+    written.push(projPath);
+  }
+  return { scope: 'project', paths: written };
+}
+
+function injectCodexMemoryPerms() {
+  try {
+    const configPath = join(getHomePath(), '.codex', 'config.toml');
+    if (!existsSync(configPath)) return { scope: 'none', paths: [] };
+    let content = readFileSync(configPath, 'utf-8');
+    if (!tomlHasSection(content, 'mcp_servers.SynaBun')) return { scope: 'none', paths: [] };
+    for (const k of getMemoryToolKeys()) {
+      const shortName = k.replace('mcp__SynaBun__', '');
+      const section = `mcp_servers.SynaBun.tools.${shortName}`;
+      if (!tomlHasSection(content, section)) {
+        content = tomlUpsertSection(content, section, { approval_mode: 'approve' });
+      }
+    }
+    writeFileSync(configPath, content, 'utf-8');
+    return { scope: 'global', paths: [configPath] };
+  } catch (err) {
+    console.error('[memory-perms] Codex inject failed:', err.message);
+    return { scope: 'error', paths: [] };
+  }
+}
+
+function injectOpenCodeMemoryPerms() {
+  try {
+    const configPath = getOpencodeConfigPath();
+    if (!existsSync(configPath)) return { scope: 'none', paths: [] };
+    let cfg = {};
+    try { cfg = JSON.parse(readFileSync(configPath, 'utf8')); } catch {}
+    if (!cfg.permission) cfg.permission = {};
+    if (!cfg.permission.tools || typeof cfg.permission.tools !== 'object') cfg.permission.tools = {};
+    for (const k of getMemoryToolKeys()) {
+      if (!(k in cfg.permission.tools)) cfg.permission.tools[k] = 'allow';
+    }
+    writeFileSync(configPath, JSON.stringify(cfg, null, 2) + '\n', 'utf8');
+    return { scope: 'global', paths: [configPath] };
+  } catch (err) {
+    console.error('[memory-perms] OpenCode inject failed:', err.message);
+    return { scope: 'error', paths: [] };
+  }
+}
+
 function addHookToSettings(settings, onlyEvent, targetProjectPath) {
   if (!settings) settings = {};
   if (!settings.hooks) settings.hooks = {};
@@ -14009,11 +14840,12 @@ app.post('/api/claude-code/mcp', (req, res) => {
     };
     writeFileSync(claudeJsonPath, JSON.stringify(data, null, 2), 'utf-8');
 
-    // Also inject tool permissions into global settings so tools work without prompts
-    const globalSettingsPath = getGlobalClaudeSettingsPath();
-    let globalSettings = readClaudeSettings(globalSettingsPath) || {};
-    ensureSynaBunPermissions(globalSettings);
-    writeClaudeSettings(globalSettingsPath, globalSettings);
+    // Force-allow the 7 SynaBun memory tools so CLI/PTY sessions skip per-call
+    // permission prompts. Writes to ~/.claude/settings.json if present, otherwise
+    // falls back to project-scoped <project>/.claude/settings.json for each
+    // SynaBun-tracked project.
+    const permResult = injectClaudeMemoryPerms();
+    console.log(`[memory-perms] Claude memory tools injected (${permResult.scope}): ${permResult.paths.join(', ')}`);
 
     res.json({ ok: true, message: 'SynaBun MCP registered (HTTP). Restart Claude Code to connect.' });
   } catch (err) {
@@ -14249,6 +15081,9 @@ app.post('/api/setup/gemini/mcp', (req, res) => {
       command: 'node',
       args: [mcpIndexPath],
       env: { DOTENV_PATH: envPath, SYNABUN_DATA_HOME: DATA_HOME, MEMORY_DATA_DIR: resolve(DATA_HOME, 'mcp-data') },
+      // trust:true skips per-tool permission prompts for this MCP server, so CLI
+      // sessions can use SynaBun memory without interactive approval gates.
+      trust: true,
     };
     writeFileSync(settingsPath, JSON.stringify(data, null, 2) + '\n', 'utf-8');
     res.json({ ok: true, message: 'SynaBun MCP registered in Gemini CLI. Restart Gemini to connect.' });
@@ -14302,6 +15137,8 @@ app.post('/api/setup/codex/mcp', (req, res) => {
       env: buildCodexMcpEnv(),
     });
     writeFileSync(configPath, content, 'utf-8');
+    // Force-allow the 7 SynaBun memory tools so CLI sessions skip prompts.
+    injectCodexMemoryPerms();
     res.json({ ok: true, message: 'SynaBun MCP registered in Codex CLI. Restart Codex to connect.' });
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -22378,8 +23215,8 @@ const httpServer = app.listen(PORT, async () => {
     }
   } catch { /* ok */ }
 
-  // Check for npm updates
-  try { await checkNpmUpdate(); } catch {}
+  // Check for SynaBun updates (npm + github releases)
+  try { await checkSynabunUpdate(); } catch {}
 
   // Aggressively prune any stale bundled CLI tools left in our node_modules
   // before the version check runs — defends against `npm install` not auto-
@@ -23152,6 +23989,21 @@ function saveSessionSnapshot() {
 setInterval(saveSessionSnapshot, SESSION_SNAPSHOT_INTERVAL_MS);
 
 // Also try to save on clean shutdown (works with Ctrl+C, not window close)
-process.on('SIGINT', () => { stopOpencodeServer(); saveSessionSnapshot(); process.exit(0); });
-process.on('SIGTERM', () => { stopOpencodeServer(); saveSessionSnapshot(); process.exit(0); });
-process.on('exit', () => { stopOpencodeServer(); saveSessionSnapshot(); });
+// Manual termination paths (Ctrl+C, kill, parent shell exit) all flow through
+// gracefulShutdown — same teardown the in-app restart/shutdown/update paths
+// use. Without this, hand-killed servers still leave orphaned opencode +
+// agent children holding file handles, which blocks `npm i -g synabun`.
+process.on('SIGINT', async () => {
+  console.log('\n[server] SIGINT received.');
+  await gracefulShutdown('sigint');
+  process.exit(0);
+});
+process.on('SIGTERM', async () => {
+  console.log('\n[server] SIGTERM received.');
+  await gracefulShutdown('sigterm');
+  process.exit(0);
+});
+// `exit` fires after process.exit() — only safe for synchronous final tasks.
+// gracefulShutdown is async so we cannot await here; just snapshot + ocp stop
+// best-effort. The async paths above are the primary teardown.
+process.on('exit', () => { try { stopOpencodeServer(); } catch {} try { saveSessionSnapshot(); } catch {} });