forked from enderofwings/NexusOS
Merge origin/main (v1.2.0: Projects, modules, in-app updates)
Reconciles 17 commits of this session's work (self-alteration tools, vendored Curry, slash-command dispatch, Windows toolchain/gate fixes) against origin/main's v1.2.0 sync (Projects/RAG scoping, a new modules/ system for mail and network, in-app updates, the standalone memory microservice folded into an in-process curator, KDE desktop theme overhaul). Nine real conflicts, each resolved by hand after reading both sides' actual diffs rather than picking one side wholesale: - synapse/tools.py, tests/test_tools.py: origin/main's diff here was small and clean (read_file/list_files, two new tests) despite git's diff3 flagging the whole file as one conflict blob -- reset to this branch's version and hand-spliced their addition in at the same points they used, rather than trying to reconcile a false 800-line conflict. Found and fixed a real bug while verifying: _list_files returned backslash-separated paths on Windows, which don't match the forward-slash glob patterns the tool's own schema documents. - synapse/main.py: kept this branch's cue-based standing advertisement of render_preview/run_snippet (independent of any playbook granting them) AND adopted origin/main's fix for routed reference playbooks not bringing their own tools along -- dropping either would have been a real regression, not just a style difference. Also: the standalone memory service (port 8001) is gone upstream, so its dead CORS/kill- target entries were removed; NEXUS_BACKEND_PORT parameterization and the manage_ollama-conditional kill logic (this branch's remote-Ollama support) were kept over origin/main's hardcoded equivalents. - synapse/memory/store.py: kept this branch's _delete_message_vectors helper (already reused elsewhere, batches to stay under SQLite's variable limit) over origin/main's inline duplicate of the same fix. - synapse/nexus_config.py, nexusos_cli/ncp.py: dropped the now-dead memory-service port/service entries; kept NEXUS_BACKEND_PORT env override and the manage_ollama-conditional kill-target list. - CLAUDE.md, README.md: merged both sides' additions, no real conflict. Found and fixed three more issues while independently verifying the merged tree, none of them mine or origin/main's alone -- only visible once both sides actually ran together: - modules/ (the new mail+network package) was never added to pyproject.toml's wheel `packages` list OR the sdist's `include` allowlist, so `from modules.registry import ROUTERS` in main.py would ImportError on any wheel install. Fixed both; bin/check.sh's packaging gate now asserts modules/ actually ships. tests/ test_packaging_deps.py's FIRST_PARTY/SHIPPED_PACKAGES sets were updated to recognize the new package. - tests/test_mail_creds.py's 0600-mode assertions are POSIX-only -- NTFS has no equivalent permission bits, so os.open(path, 0o600) on Windows just creates a normal file and stat.S_IMODE reports 0o666 regardless. Made the assertions platform-aware rather than skip real coverage (the temp-file-cleanup and password round-trip checks in the same test still run on Windows) or paper over a genuine OS limitation with a fake pass. - tests/test_kde_theme.py used bare Path.read_text() in fifteen places; Windows' default locale encoding (cp1252, not UTF-8) can't decode a real UTF-8 byte in the QML it reads, and did fail on one of the fifteen. Fixed all fifteen, not just the one that happened to trip today, since the other fourteen were equally fragile. Verified: full bin/check.sh reports OK end-to-end on this Windows checkout -- pytest (tests + management): 295 passed, 0 failed, 9 skipped; eslint clean; frontend node:test 57/57; PowerShell/shell parse clean; wheel + sdist pass twine check and now correctly carry modules/ (60 files, up from 52 pre-merge). synapse.main:app builds with 74 routes (up from 54 pre-merge, matching the new Projects/mail/ network endpoints).
This commit is contained in:
@@ -169,6 +169,73 @@ async def _remember(text: str = "", section: str = "General", **_) -> str:
|
||||
return json.dumps({"saved": text, "section": section or "General"})
|
||||
|
||||
|
||||
# --- Repo file access (read-only, scoped to PROJECT_ROOT) -------------------
|
||||
# Paths never leave the repo: every request is resolve()d and checked against
|
||||
# PROJECT_ROOT, which also kills symlink escapes. _DENIED covers the parts of
|
||||
# the tree that are either secrets, private data, or multi-GB noise. Read-only
|
||||
# counterpart to edit_source's write path (self_edit.py) — a model reading
|
||||
# real source before proposing an edit is the point.
|
||||
_DENIED = {
|
||||
".git", ".env", "Promethean", "node_modules", "models", "ollama",
|
||||
"runtime", "dist", "__pycache__", ".git-credentials",
|
||||
}
|
||||
_READ_MAX = 60_000
|
||||
|
||||
|
||||
def _repo_path(rel: str) -> "tuple[object, str | None]":
|
||||
"""Resolve a repo-relative path. Returns (path, error-string)."""
|
||||
from .nexus_config import PROJECT_ROOT
|
||||
rel = (rel or "").strip().lstrip("/")
|
||||
if not rel:
|
||||
return None, "path is required"
|
||||
target = (PROJECT_ROOT / rel).resolve()
|
||||
if not target.is_relative_to(PROJECT_ROOT):
|
||||
return None, "path escapes the project root"
|
||||
parts = set(target.relative_to(PROJECT_ROOT).parts)
|
||||
if parts & _DENIED or target.name.endswith((".db", ".db.sql", ".pem", ".key")):
|
||||
return None, f"{rel} is not readable"
|
||||
return target, None
|
||||
|
||||
|
||||
async def _read_file(path: str = "", **_) -> str:
|
||||
target, err = _repo_path(path)
|
||||
if err:
|
||||
return json.dumps({"error": err})
|
||||
if not target.is_file():
|
||||
return json.dumps({"error": f"{path} does not exist"})
|
||||
try:
|
||||
text = target.read_text(encoding="utf-8", errors="replace")
|
||||
except OSError as e:
|
||||
return json.dumps({"error": f"cannot read {path}: {e}"})
|
||||
return json.dumps({
|
||||
"path": path,
|
||||
"truncated": len(text) > _READ_MAX,
|
||||
"content": text[:_READ_MAX],
|
||||
})
|
||||
|
||||
|
||||
async def _list_files(pattern: str = "", **_) -> str:
|
||||
"""Glob the repo so the model discovers real paths instead of inventing them."""
|
||||
from .nexus_config import PROJECT_ROOT
|
||||
pattern = (pattern or "**/*.py").strip().lstrip("/")
|
||||
hits = []
|
||||
for f in PROJECT_ROOT.glob(pattern):
|
||||
if not f.is_file():
|
||||
continue
|
||||
rel_posix = f.relative_to(PROJECT_ROOT).as_posix()
|
||||
target, err = _repo_path(rel_posix)
|
||||
if err:
|
||||
continue
|
||||
# .as_posix(), not str(): a bare str() gives backslash-separated paths
|
||||
# on Windows, which don't match the forward-slash patterns this tool's
|
||||
# own schema documents (e.g. "synapse/**/*.py") and that read_file
|
||||
# expects back.
|
||||
hits.append(rel_posix)
|
||||
if len(hits) >= 200:
|
||||
break
|
||||
return json.dumps(sorted(hits))
|
||||
|
||||
|
||||
# Canvas drawing APIs a real visualization must use — resizing width/height alone
|
||||
# clears the buffer and draws nothing (a failure mode small models hit often).
|
||||
_CANVAS_DRAW_APIS = (
|
||||
@@ -1139,6 +1206,35 @@ REGISTRY: dict[str, tuple[dict, Callable[..., Awaitable[str]]]] = {
|
||||
},
|
||||
_list_models,
|
||||
),
|
||||
"read_file": (
|
||||
{
|
||||
"type": "function",
|
||||
"function": {
|
||||
"name": "read_file",
|
||||
"description": "Read a source file from the NexusOS repository. Path is relative to the project root, e.g. 'synapse/main.py'.",
|
||||
"parameters": {
|
||||
"type": "object",
|
||||
"properties": {"path": {"type": "string", "description": "repo-relative file path"}},
|
||||
"required": ["path"],
|
||||
},
|
||||
},
|
||||
},
|
||||
_read_file,
|
||||
),
|
||||
"list_files": (
|
||||
{
|
||||
"type": "function",
|
||||
"function": {
|
||||
"name": "list_files",
|
||||
"description": "List files in the NexusOS repository matching a glob, e.g. 'synapse/**/*.py' or 'interface/web/src/*.jsx'. Use this to find real paths before reading.",
|
||||
"parameters": {
|
||||
"type": "object",
|
||||
"properties": {"pattern": {"type": "string", "description": "glob relative to the project root"}},
|
||||
},
|
||||
},
|
||||
},
|
||||
_list_files,
|
||||
),
|
||||
"search_documents": (
|
||||
{
|
||||
"type": "function",
|
||||
|
||||
Reference in New Issue
Block a user
GitNexus · part of the Nexus stack