Merge origin/main (v1.2.0: Projects, modules, in-app updates)

Reconciles 17 commits of this session's work (self-alteration tools,
vendored Curry, slash-command dispatch, Windows toolchain/gate fixes)
against origin/main's v1.2.0 sync (Projects/RAG scoping, a new modules/
system for mail and network, in-app updates, the standalone memory
microservice folded into an in-process curator, KDE desktop theme
overhaul). Nine real conflicts, each resolved by hand after reading both
sides' actual diffs rather than picking one side wholesale:

- synapse/tools.py, tests/test_tools.py: origin/main's diff here was
  small and clean (read_file/list_files, two new tests) despite git's
  diff3 flagging the whole file as one conflict blob -- reset to this
  branch's version and hand-spliced their addition in at the same
  points they used, rather than trying to reconcile a false 800-line
  conflict. Found and fixed a real bug while verifying: _list_files
  returned backslash-separated paths on Windows, which don't match the
  forward-slash glob patterns the tool's own schema documents.
- synapse/main.py: kept this branch's cue-based standing advertisement
  of render_preview/run_snippet (independent of any playbook granting
  them) AND adopted origin/main's fix for routed reference playbooks
  not bringing their own tools along -- dropping either would have been
  a real regression, not just a style difference. Also: the standalone
  memory service (port 8001) is gone upstream, so its dead CORS/kill-
  target entries were removed; NEXUS_BACKEND_PORT parameterization and
  the manage_ollama-conditional kill logic (this branch's remote-Ollama
  support) were kept over origin/main's hardcoded equivalents.
- synapse/memory/store.py: kept this branch's _delete_message_vectors
  helper (already reused elsewhere, batches to stay under SQLite's
  variable limit) over origin/main's inline duplicate of the same fix.
- synapse/nexus_config.py, nexusos_cli/ncp.py: dropped the now-dead
  memory-service port/service entries; kept NEXUS_BACKEND_PORT env
  override and the manage_ollama-conditional kill-target list.
- CLAUDE.md, README.md: merged both sides' additions, no real conflict.

Found and fixed three more issues while independently verifying the
merged tree, none of them mine or origin/main's alone -- only visible
once both sides actually ran together:

- modules/ (the new mail+network package) was never added to
  pyproject.toml's wheel `packages` list OR the sdist's `include`
  allowlist, so `from modules.registry import ROUTERS` in main.py would
  ImportError on any wheel install. Fixed both; bin/check.sh's
  packaging gate now asserts modules/ actually ships. tests/
  test_packaging_deps.py's FIRST_PARTY/SHIPPED_PACKAGES sets were
  updated to recognize the new package.
- tests/test_mail_creds.py's 0600-mode assertions are POSIX-only --
  NTFS has no equivalent permission bits, so os.open(path, 0o600) on
  Windows just creates a normal file and stat.S_IMODE reports 0o666
  regardless. Made the assertions platform-aware rather than skip real
  coverage (the temp-file-cleanup and password round-trip checks in the
  same test still run on Windows) or paper over a genuine OS
  limitation with a fake pass.
- tests/test_kde_theme.py used bare Path.read_text() in fifteen places;
  Windows' default locale encoding (cp1252, not UTF-8) can't decode a
  real UTF-8 byte in the QML it reads, and did fail on one of the
  fifteen. Fixed all fifteen, not just the one that happened to trip
  today, since the other fourteen were equally fragile.

Verified: full bin/check.sh reports OK end-to-end on this Windows
checkout -- pytest (tests + management): 295 passed, 0 failed, 9
skipped; eslint clean; frontend node:test 57/57; PowerShell/shell
parse clean; wheel + sdist pass twine check and now correctly carry
modules/ (60 files, up from 52 pre-merge). synapse.main:app builds
with 74 routes (up from 54 pre-merge, matching the new Projects/mail/
network endpoints).

tests/test_documents.py

@@ -68,6 +68,45 @@ def test_conversation_project_binding():
     assert s.conversation_project("c2") == ""           # unscoped
 
 
+def test_conversations_move_between_projects():
+    # The Projects page lists chats by project_id and moves them with a PATCH;
+    # if all_conversations() drops the column the list is silently empty.
+    s = _store()
+    s.create_conversation("c1", "projX")
+    s.create_conversation("c2")
+    assert {c.id: c.project_id for c in s.all_conversations()} == {"c1": "projX", "c2": ""}
+
+    s.set_conversation_project("c2", "projX")
+    s.set_conversation_project("c1", "")               # removed from the project
+    assert {c.id: c.project_id for c in s.all_conversations()} == {"c1": "", "c2": "projX"}
+
+
+def test_project_instructions_and_scoped_memory():
+    # The chat system prompt takes the project's instructions plus global facts
+    # and this project's facts only — another project's must never leak in.
+    from synapse.memory.store import MemoryItem
+
+    s = _store()
+    p = s.create_project("Roof rebuild")
+    assert s.project_instructions(p["id"]) == ""        # default: no instructions
+    assert s.project_instructions("ghost") == ""        # unknown project
+    assert s.set_project_instructions(p["id"], "answer as a roofer")
+    assert not s.set_project_instructions("ghost", "x")
+    assert s.project_instructions(p["id"]) == "answer as a roofer"
+
+    s.add(MemoryItem(id="g", text="lives in Ohio"))                          # global
+    s.add(MemoryItem(id="a", text="uses metal panels", project_id=p["id"]))  # this project
+    s.add(MemoryItem(id="b", text="prefers Lua", project_id="other"))        # elsewhere
+    in_scope = [m.id for m in s.all() if m.project_id in ("", p["id"])]
+    assert in_scope == ["g", "a"]
+
+    # Deleting a project keeps its chats and facts, unscoped.
+    s.create_conversation("c1", p["id"])
+    s.delete_project(p["id"])
+    assert s.conversation_project("c1") == ""
+    assert s.get("a").project_id == ""
+
+
 def test_conversation_recall_uses_vec_and_matches_brute_force():
     s = _store()
     if not s.vec_enabled:
@@ -233,3 +272,64 @@ def test_extract_text_by_type():
     out = _extract_text("blank.pdf", buf.getvalue())
     assert isinstance(out, str)  # blank page -> "" or whitespace, never raises
     assert PdfReader(io.BytesIO(buf.getvalue())).pages  # sanity: it was a valid PDF
+
+
+def test_delete_conversation_takes_its_embeddings_with_it(tmp_path, monkeypatch):
+    """Stale vectors are inert — the search joins messages — but they still
+    occupy slots in the ANN over-fetch, so recall of the surviving
+    conversations quietly thins out as deleted ones pile up."""
+    import sqlite3
+    from synapse.memory.store import PersistentMemoryStore
+
+    db = tmp_path / "t.db"
+    s = PersistentMemoryStore(db)
+    s.create_conversation("keep", "")
+    s.create_conversation("drop", "")
+    kept = s.add_message("keep", "user", "hello")
+    doomed = s.add_message("drop", "user", "goodbye")
+
+    conn = sqlite3.connect(db)
+    for mid in (kept, doomed):
+        conn.execute(
+            "INSERT OR REPLACE INTO message_vectors (message_id, embedding) VALUES (?, ?)",
+            (mid, "[0.0, 1.0]"),
+        )
+    conn.commit()
+
+    s.delete_conversation("drop")
+
+    left = {r[0] for r in conn.execute("SELECT message_id FROM message_vectors")}
+    assert left == {kept}, left
+
+
+def test_extraction_watermark_is_idempotent(tmp_path):
+    """The curator reads a conversation when it goes idle, so the watermark is
+    what stops a restart (or a second sweep) from re-reading messages and
+    re-saving the facts it already saved."""
+    from synapse.memory.store import PersistentMemoryStore
+
+    s = PersistentMemoryStore(tmp_path / "t.db")
+    s.create_conversation("c", "")
+    s.add_message("c", "user", "i bought a bike")
+    last = s.add_message("c", "assistant", "nice")
+
+    pending, mark = s.pending_extraction("c")
+    assert [m["role"] for m in pending] == ["user", "assistant"]
+    assert mark == last
+
+    s.set_extracted_through("c", mark)
+    assert s.pending_extraction("c") == ([], 0)     # nothing new -> no model call
+
+    s.add_message("c", "user", "a 2019 trek")
+    pending, _ = s.pending_extraction("c")
+    assert [m["content"] for m in pending] == ["a 2019 trek"]   # only the unread tail
+
+
+def test_idle_sweep_only_claims_quiet_conversations(tmp_path):
+    from synapse.memory.store import PersistentMemoryStore
+
+    s = PersistentMemoryStore(tmp_path / "t.db")
+    s.create_conversation("fresh", "")
+    s.add_message("fresh", "user", "still typing")
+    assert s.conversations_awaiting_extraction(3600) == []   # too recent to be "over"
+    assert s.conversations_awaiting_extraction(0) == ["fresh"]

tests/test_kde_theme.py

@@ -0,0 +1,214 @@
+"""Guards for the KDE theme's silent-failure modes.
+
+Every check here corresponds to something that broke without producing an error
+message. They are static reads of the scripts and packages because the failures
+are configuration-shaped -- there is nothing to import and nothing that raises.
+"""
+import json
+import re
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parents[1]
+KDE = REPO / "assets" / "themes" / "KDE"
+INSTALLER = KDE / "install-plasma.sh"
+LNF = KDE / "look-and-feel" / "com.nexusos.desktop"
+ICONS = REPO / "assets" / "themes" / "NexusOS-icons"
+THEME_INSTALLER = REPO / "assets" / "themes" / "install-theme.sh"
+
+
+def test_look_and_feel_is_copied_never_symlinked():
+    """KPackage skips symlinked package directories without a word, so a
+    symlinked Global Theme simply never appears in System Settings."""
+    text = INSTALLER.read_text(encoding="utf-8")
+    assert "cp -rL" in text, "look-and-feel/wallpaper must be copied into place"
+    for line in text.splitlines():
+        if line.strip().startswith("ln -s"):
+            assert "look-and-feel" not in line and "wallpapers" not in line, \
+                f"KPackage package dir must not be symlinked: {line.strip()}"
+
+
+def test_plasmashell_restart_is_detached_from_the_callers_stdout():
+    """The restarted shell outlives the script. Inheriting stdout keeps the
+    caller's pipe open forever, which hangs `ncp restore` after a successful
+    apply."""
+    text = INSTALLER.read_text(encoding="utf-8")
+    restart = [l for l in text.splitlines()
+               if "kstart5 plasmashell" in l and not l.strip().startswith("#")]
+    assert restart, "no plasmashell restart found"
+    for line in restart:
+        assert "setsid" in line, f"restart not detached: {line.strip()}"
+        assert "</dev/null" in line and ">/dev/null" in line, \
+            f"restart still holds the caller's stdio: {line.strip()}"
+
+
+def test_splash_renders_without_the_stage_signal():
+    """A splash gated on `stage == 2` shows a blank coloured screen if that
+    signal never arrives -- what `ksplashqml --test` does."""
+    qml = (LNF / "contents" / "splash" / "Splash.qml").read_text(encoding="utf-8")
+    content = qml[qml.index("id: content"):]
+    body = content[:content.index("OpacityAnimator")]
+    assert "opacity: 0" not in body, "splash content starts invisible"
+    assert "introAnimation" not in qml, "visibility still gated on a stage change"
+
+
+def test_sddm_theme_is_configured_in_exactly_one_place():
+    """boot-branding.sh and install-plasma.sh both deploy the SDDM theme; two
+    different config files meant the setting could disagree with itself."""
+    for script in (INSTALLER, REPO / "bin" / "boot-branding.sh"):
+        text = script.read_text(encoding="utf-8")
+        stray = re.findall(r"/etc/sddm\.conf(?!\.d)", text)
+        assert not stray, f"{script.name} writes bare /etc/sddm.conf; use conf.d"
+
+
+def test_restore_desktop_stage_covers_plasma_as_well_as_xfce():
+    """The desktop stage used to bail out entirely without xfconf-query, so a
+    Plasma box got no theme back from `ncp restore` at all."""
+    text = (REPO / "bin" / "restore-linux.sh").read_text(encoding="utf-8")
+    assert "install-plasma.sh" in text, "restore never invokes the Plasma installer"
+    assert "--no-sddm" in text, "restore should leave SDDM to boot-branding.sh"
+    # The XFCE check must not be able to skip the Plasma branch or the branding.
+    assert "exit 0\nfi\n" not in text.split("desktop stage")[1][:900], \
+        "XFCE guard still exits the whole stage"
+
+
+def test_global_theme_package_is_well_formed():
+    meta = json.loads((LNF / "metadata.json").read_text(encoding="utf-8"))
+    assert meta["KPlugin"]["Id"] == LNF.name, "package Id must match its directory"
+    assert "Plasma/LookAndFeel" in meta["KPlugin"]["ServiceTypes"]
+
+    defaults = (LNF / "contents" / "defaults").read_text(encoding="utf-8")
+    # Every component the Global Theme selects has to exist in the repo.
+    assert "ColorScheme=NexusOS" in defaults
+    assert (KDE / "plasma" / "NexusOS").is_dir()
+    assert (KDE / "aurorae" / "NexusOS").is_dir()
+    assert (KDE / "wallpaper" / "NexusOS" / "metadata.json").is_file()
+    assert "Theme=com.nexusos.desktop" in defaults, "splash not wired to this package"
+
+
+def test_patterned_backgrounds_are_referenced_as_raster_not_svg():
+    """QtSvg is SVG Tiny 1.2 and has no <pattern>, so the brushed-metal and
+    machine-line textures vanish and the gradient renders flat. Every QML that
+    shows that artwork must load the rasterized PNG."""
+    qml_files = [
+        KDE / "sddm" / "NexusOS-QML" / "Main.qml",
+        LNF / "contents" / "splash" / "Splash.qml",
+    ]
+    for f in qml_files:
+        # Only the source: lines -- the comments deliberately mention the SVG,
+        # since that is the file you edit and re-rasterize.
+        sources = [l for l in f.read_text(encoding="utf-8").splitlines()
+                   if "source:" in l and not l.strip().startswith("//")]
+        bg = [l for l in sources if "background" in l]
+        assert bg, f"{f.name} loads no background"
+        for line in bg:
+            assert "background.png" in line, \
+                f"{f.name} loads a patterned SVG through QtSvg: {line.strip()}"
+
+
+def _defaults_sections():
+    """Parse the look-and-feel defaults into {section: {key: value}}."""
+    out, section = {}, None
+    for line in (LNF / "contents" / "defaults").read_text(encoding="utf-8").splitlines():
+        line = line.strip()
+        if line.startswith("["):
+            section = line
+            out[section] = {}
+        elif line and "=" in line and section:
+            k, v = line.split("=", 1)
+            out[section][k] = v
+    return out
+
+
+def test_lock_screen_theme_names_a_look_and_feel_package():
+    """Plasma 5.27 draws the lock screen from a look-and-feel package, and
+    [Greeter]Theme names that package. A bare theme name (the old "NexusOS")
+    is not one, so Plasma falls back to Breeze without saying anything."""
+    greeter = _defaults_sections()["[kscreenlockerrc][Greeter]"]
+    assert greeter["Theme"].endswith(".desktop"), \
+        f"lock theme must be a look-and-feel package id, got {greeter['Theme']!r}"
+
+    installer = INSTALLER.read_text(encoding="utf-8")
+    lock_lines = [l for l in installer.splitlines()
+                  if "kscreenlockerrc" in l and "--key Theme" in l]
+    assert lock_lines, "installer never sets the lock screen theme"
+    for line in lock_lines:
+        assert ".desktop" in line, f"installer sets a non-package lock theme: {line.strip()}"
+
+    # And the lock wallpaper is the raster metal background.
+    assert "background.png" in installer, "lock wallpaper not set to the metal raster"
+
+
+def _index_theme():
+    """Parse index.theme into (header dict, list of declared directories)."""
+    header, section, dirs = {}, None, []
+    for line in (ICONS / "index.theme").read_text(encoding="utf-8").splitlines():
+        line = line.strip()
+        if line.startswith("[") and line != "[Icon Theme]":
+            section = line.strip("[]")
+            dirs.append(section)
+        elif "=" in line and not line.startswith("#") and section is None:
+            k, v = line.split("=", 1)
+            header[k.strip()] = v.strip()
+    return header, dirs
+
+
+def test_every_declared_icon_directory_exists():
+    """index.theme declared 124 directories against 21 real ones, most copied
+    from Papirus. A declared-but-missing directory is dead weight the icon
+    loader walks on every lookup."""
+    _, dirs = _index_theme()
+    missing = [d for d in dirs if not (ICONS / d).is_dir()]
+    assert not missing, f"index.theme declares directories that do not exist: {missing}"
+
+    listed = set(_index_theme()[0].get("Directories", "").split(","))
+    assert listed == set(dirs), "Directories= and the [section] list disagree"
+
+
+def test_icon_theme_inherits_a_recolourable_parent():
+    """Papirus hardcodes its blues, so nothing the colour scheme does can reach
+    them and the un-themed surface stayed blue forever. Breeze's icons carry
+    ColorScheme-* classes that Plasma recolours from the active scheme."""
+    header, _ = _index_theme()
+    parents = [p.strip() for p in header["Inherits"].split(",")]
+    assert not parents[0].lower().startswith("papirus"), \
+        "primary parent cannot recolour from the colour scheme"
+    assert parents[0] == "breeze-dark", f"expected breeze-dark first, got {parents[0]!r}"
+    assert parents[-1] == "hicolor", "hicolor must remain the last-resort fallback"
+
+
+def test_icon_theme_is_installed_where_qt_looks():
+    """~/.icons is the GTK/XFCE legacy path. Qt/KF5 searches XDG data dirs only,
+    so installing there alone meant Plasma never found the theme and every icon
+    fell back to Breeze without a word."""
+    text = THEME_INSTALLER.read_text(encoding="utf-8")
+    links = [l for l in text.splitlines()
+             if l.strip().startswith("link ") and "NexusOS-icons" in l]
+    assert any(".local/share/icons" in l for l in links), \
+        "icon theme is not installed to an XDG data dir; Plasma will not see it"
+    assert any(".icons/NexusOS" in l for l in links), \
+        "dropping ~/.icons would break the XFCE session and GTK apps"
+
+
+def test_inherits_check_reads_only_the_primary_parent():
+    """The installer compared the whole comma-separated Inherits value against a
+    directory name, so a valid multi-parent list warned that an installed
+    fallback was missing."""
+    text = THEME_INSTALLER.read_text(encoding="utf-8")
+    inh = [l for l in text.splitlines() if "INH=" in l and "Inherits" in l]
+    assert inh, "inheritance check not found"
+    assert any("-f1" in l for l in inh), \
+        "inheritance check still treats the whole Inherits list as one theme name"
+
+
+def test_panel_layout_is_portable():
+    """The panel script sets the launcher icon by absolute path. Hardcoding
+    this box's home would give any other clone or user a missing icon, so the
+    path is a placeholder the installer substitutes."""
+    js = (KDE / "panel-layout.js").read_text(encoding="utf-8")
+    assert "/home/" not in js, "panel-layout.js hardcodes a home directory"
+    assert "__NEXUS_ROOT__" in js, "no placeholder for the repo path"
+
+    installer = INSTALLER.read_text(encoding="utf-8")
+    assert "__NEXUS_ROOT__" in installer, "installer never substitutes the repo path"
+    # Rewriting the panel wholesale on every restore would wipe later additions.
+    assert "PANEL_MARKER" in installer, "panel layout is not guarded by a marker"

tests/test_mail.py

@@ -0,0 +1,75 @@
+"""Mail account config — offline (no live IMAP/SMTP)."""
+from modules.mail import backend as mail
+
+
+def test_account_roundtrip_and_password_masking(tmp_path, monkeypatch):
+    monkeypatch.setattr(mail, "_ACCOUNT_FILE", tmp_path / "acct.json")
+
+    assert mail.load_accounts() == []
+
+    pub = mail.save_account(None, {
+        "username": "me@icloud.com",
+        "password": "app-specific-pw",
+        "imap_host": "imap.mail.me.com",
+        "from_addr": "nexus@enderofwings.com",
+    })
+    account_id = pub["id"]
+    # public view exposes a flag, never the secret
+    assert pub["has_password"] is True
+    assert "password" not in pub
+    assert pub["configured"] is True
+    assert mail.is_configured(account_id) is True
+
+    # a blank password on update keeps the stored one (write-only field)
+    mail.save_account(account_id, {"from_name": "Nexus"})
+    assert mail.get_account(account_id)["password"] == "app-specific-pw"
+    assert mail.get_account(account_id)["from_name"] == "Nexus"
+
+    # defaults target iCloud
+    assert mail.get_account(account_id)["smtp_host"] == "smtp.mail.me.com"
+
+
+def test_multiple_accounts_are_independent(tmp_path, monkeypatch):
+    monkeypatch.setattr(mail, "_ACCOUNT_FILE", tmp_path / "acct.json")
+
+    a = mail.save_account(None, {"username": "a@icloud.com", "password": "pw-a", "label": "Personal"})
+    b = mail.save_account(None, {"username": "b@icloud.com", "password": "pw-b", "label": "Work"})
+    assert a["id"] != b["id"]
+
+    accounts = mail.public_accounts()
+    assert {x["id"] for x in accounts} == {a["id"], b["id"]}
+
+    mail.delete_account(a["id"])
+    remaining = mail.public_accounts()
+    assert len(remaining) == 1
+    assert remaining[0]["id"] == b["id"]
+    assert mail.is_configured(a["id"]) is False
+
+
+def test_creds_file_lives_outside_the_db(monkeypatch, tmp_path):
+    # Mail secrets must never ride in memory.db (which bin/sync.py dumps to git).
+    monkeypatch.setattr(mail, "_ACCOUNT_FILE", tmp_path / "acct.json")
+    mail.save_account(None, {"username": "u", "password": "p"})
+    assert (tmp_path / "acct.json").exists()
+    from synapse.memory.store import PersistentMemoryStore
+    assert "password" not in PersistentMemoryStore._SETTINGS_DEFAULTS
+
+
+def test_legacy_single_account_file_migrates(tmp_path, monkeypatch):
+    import json
+    f = tmp_path / "acct.json"
+    f.write_text(json.dumps({
+        "imap_host": "imap.mail.me.com", "imap_port": 993,
+        "smtp_host": "smtp.mail.me.com", "smtp_port": 587,
+        "username": "legacy@icloud.com", "password": "old-pw",
+        "from_addr": "legacy@enderofwings.com", "from_name": "",
+    }))
+    monkeypatch.setattr(mail, "_ACCOUNT_FILE", f)
+
+    accounts = mail.load_accounts()
+    assert len(accounts) == 1
+    assert accounts[0]["username"] == "legacy@icloud.com"
+    assert "id" in accounts[0]
+
+    # migration is persisted — the file is rewritten in list form
+    assert json.loads(f.read_text())["accounts"][0]["username"] == "legacy@icloud.com"

tests/test_mail_creds.py

@@ -0,0 +1,74 @@
+"""Credential handling for the mail module.
+
+Both checks guard fixes for real defects: the account file used to be written at
+the umask and chmodded afterwards, and the IMAP/SMTP connections used to take
+Python's stdlib SSL context, which verifies nothing.
+
+The 0600-mode assertions are POSIX-only: NTFS has no rwx-owner/group/other bit
+model, so os.open(..., 0o600) on Windows creates a normal read-write file and
+stat.S_IMODE reports 0o666 regardless of the mode argument -- Python's mode
+param there only round-trips the read-only *attribute*, not real ACL-based
+per-user access control (that needs pywin32/icacls, out of scope for a local
+single-user app whose own user-profile directory is already the actual access
+boundary on Windows). Skip rather than assert something the OS can't provide.
+"""
+import json
+import os
+import ssl
+import stat
+import sys
+
+import pytest
+
+from modules.mail import backend as mail
+
+_WINDOWS_NO_POSIX_MODE = pytest.mark.skipif(
+    sys.platform == "win32",
+    reason="0600 is a POSIX permission model; NTFS has no equivalent bits to assert on",
+)
+
+
+def test_account_file_is_never_group_or_world_readable(tmp_path, monkeypatch):
+    monkeypatch.setattr(mail, "_ACCOUNT_FILE", tmp_path / "mail_accounts.json")
+    mail._write_accounts([{**mail._DEFAULTS, "id": "abc", "username": "u", "password": "secret"}])
+
+    # The mode assertion only means something on POSIX; the rest of this test
+    # (no temp file left behind, password round-trip) is platform-independent
+    # and must keep running on Windows.
+    if sys.platform != "win32":
+        mode = stat.S_IMODE((tmp_path / "mail_accounts.json").stat().st_mode)
+        assert mode == 0o600, f"account file is {oct(mode)}, expected 0o600"
+    assert not list(tmp_path.glob("*.tmp")), "temp file left behind"
+
+    # The password round-trips to disk but never to the API.
+    assert mail.load_accounts()[0]["password"] == "secret"
+    assert "password" not in mail.public_account(mail.get_account("abc"))
+    assert mail.public_account(mail.get_account("abc"))["has_password"] is True
+    assert json.loads((tmp_path / "mail_accounts.json").read_text())["accounts"]
+
+
+@_WINDOWS_NO_POSIX_MODE
+def test_account_file_is_0600_while_it_is_being_written(tmp_path, monkeypatch):
+    """The old code wrote at the umask and chmodded afterwards, so the file sat
+    world-readable for the length of the write. Assert the handle it is written
+    through is already 0600 -- the pre-fix version never wrote through a handle
+    at all (json.dumps to a string, then write_text), so this fails against it."""
+    monkeypatch.setattr(mail, "_ACCOUNT_FILE", tmp_path / "mail_accounts.json")
+    seen = {}
+    real_dump = mail.json.dump
+
+    def spy(obj, fh, **kw):
+        seen["mode"] = stat.S_IMODE(os.fstat(fh.fileno()).st_mode)
+        return real_dump(obj, fh, **kw)
+
+    monkeypatch.setattr(mail.json, "dump", spy)
+    mail._write_accounts([{**mail._DEFAULTS, "id": "abc", "username": "u", "password": "secret"}])
+
+    assert seen["mode"] == 0o600, f"written through a {oct(seen['mode'])} handle"
+
+
+def test_tls_context_verifies_certificate_and_hostname():
+    # ssl._create_stdlib_context(), the imaplib/smtplib fallback, gives
+    # CERT_NONE + check_hostname False -- which is what this replaced.
+    assert mail._TLS.verify_mode is ssl.CERT_REQUIRED
+    assert mail._TLS.check_hostname is True

tests/test_modules_registry.py

@@ -0,0 +1,22 @@
+"""modules/registry.py auto-discovery — no per-module registration required."""
+from fastapi import APIRouter
+
+from modules.registry import ROUTERS
+
+
+def test_discovers_every_module_with_a_router():
+    prefixes = sorted(r.prefix for r in ROUTERS)
+    assert prefixes == ["/mail", "/network"]
+    assert all(isinstance(r, APIRouter) for r in ROUTERS)
+
+
+def test_folder_without_router_py_is_skipped(tmp_path, monkeypatch):
+    # A module folder that hasn't grown a router.py yet (e.g. mid-scaffold)
+    # must not blow up discovery.
+    import modules.registry as registry
+    (tmp_path / "not_a_module").mkdir()
+    (tmp_path / "not_a_module" / "__init__.py").touch()
+    monkeypatch.setattr(registry, "_MODULES_DIR", tmp_path)
+    # No router.py in the folder, so discovery must skip it without raising
+    # (it never even attempts the import).
+    assert registry._discover() == []

tests/test_network.py

@@ -0,0 +1,80 @@
+"""Network module — offline (no real pings, no real nmcli/NetworkManager calls)."""
+import subprocess
+
+from modules.network import backend as net
+
+
+def test_primary_connection_returns_expected_shape():
+    conn = net.primary_connection()
+    assert set(conn.keys()) == {"interface", "ip", "type"}
+    assert conn["type"] in ("wifi", "ethernet", "offline")
+
+
+def test_vpn_status_unavailable_when_nmcli_missing(monkeypatch):
+    monkeypatch.setattr(net, "_nmcli_available", lambda: False)
+    assert net.vpn_status() == {"available": False}
+
+
+def test_vpn_status_configured_but_disconnected(monkeypatch):
+    monkeypatch.setattr(net, "_nmcli_available", lambda: True)
+    monkeypatch.setattr(net, "_nmcli", lambda *a: "wgs_client:wireguard:disconnected")
+    status = net.vpn_status()
+    assert status == {"available": True, "configured": True, "name": "wgs_client", "connected": False}
+
+
+def test_vpn_status_connected(monkeypatch):
+    monkeypatch.setattr(net, "_nmcli_available", lambda: True)
+    monkeypatch.setattr(net, "_nmcli", lambda *a: "wgs_client:wireguard:activated")
+    status = net.vpn_status()
+    assert status["connected"] is True
+
+
+def test_vpn_toggle_raises_without_a_configured_tunnel(monkeypatch):
+    monkeypatch.setattr(net, "vpn_status", lambda: {"available": True, "configured": False, "name": None, "connected": False})
+    try:
+        net.vpn_toggle(True)
+        assert False, "expected RuntimeError"
+    except RuntimeError:
+        pass
+
+
+def test_target_crud_roundtrip(tmp_path, monkeypatch):
+    monkeypatch.setattr(net, "_TARGETS_FILE", tmp_path / "targets.json")
+
+    assert net.list_targets() == []
+    t = net.add_target("Router", "192.168.50.1")
+    assert t["label"] == "Router" and t["host"] == "192.168.50.1"
+
+    targets = net.list_targets()
+    assert len(targets) == 1
+    assert targets[0]["id"] == t["id"]
+
+    net.delete_target(t["id"])
+    assert net.list_targets() == []
+
+
+def test_ping_parses_latency_on_success(monkeypatch):
+    monkeypatch.setattr(subprocess, "check_output", lambda *a, **k: "64 bytes from 1.1.1.1: icmp_seq=1 ttl=56 time=12.3 ms")
+    result = net.ping("1.1.1.1")
+    assert result["ok"] is True
+    assert result["latency_ms"] == 12.3
+
+
+def test_ping_reports_failure(monkeypatch):
+    def raise_failed(*a, **k):
+        raise subprocess.CalledProcessError(1, "ping")
+    monkeypatch.setattr(subprocess, "check_output", raise_failed)
+    result = net.ping("10.255.255.1")
+    assert result == {"ok": False, "latency_ms": None}
+
+
+def test_ping_targets_merges_target_and_result(tmp_path, monkeypatch):
+    monkeypatch.setattr(net, "_TARGETS_FILE", tmp_path / "targets.json")
+    net.add_target("Router", "192.168.50.1")
+    monkeypatch.setattr(net, "ping", lambda host: {"ok": True, "latency_ms": 5.0})
+
+    results = net.ping_targets()
+    assert len(results) == 1
+    assert results[0]["host"] == "192.168.50.1"
+    assert results[0]["ok"] is True
+    assert results[0]["latency_ms"] == 5.0

tests/test_packaging_deps.py

@@ -15,7 +15,7 @@ from pathlib import Path
 import pytest
 
 ROOT = Path(__file__).resolve().parents[1]
-SHIPPED_PACKAGES = ("synapse", "nexusos_cli")
+SHIPPED_PACKAGES = ("synapse", "nexusos_cli", "modules")
 
 # Import name -> distribution name, where PyPI disagrees with the module.
 DISTRIBUTION_OF = {
@@ -33,7 +33,7 @@ DISTRIBUTION_OF = {
 TRANSITIVE = {"starlette", "socketio", "engineio", "rich"}
 
 # Modules that ship inside this repo.
-FIRST_PARTY = {"synapse", "nexusos_cli", "management", "bin", "tests"}
+FIRST_PARTY = {"synapse", "nexusos_cli", "management", "bin", "tests", "modules"}
 
 
 def _pyproject() -> dict:

tests/test_smoke.py

@@ -19,7 +19,7 @@ from synapse.nexus_config import DEFAULT_CHAT_MODEL, DEFAULT_MEMORY_MODEL
 from synapse.ollama_manager import OllamaManager
 from synapse import ollama_manager
 from synapse.icons.compositor import _is_allowed_path
-from synapse.playbook_manager import PlaybookManager
+from synapse import playbook_manager
 from synapse.playbooks.store import PlaybookFileStore, PlaybookItem
 
 REPO_ROOT = Path(__file__).resolve().parent.parent
@@ -162,9 +162,9 @@ def test_first_playbook_is_the_system_prompt(tmp_path, monkeypatch):
                                     instructions="Answer briefly.", order=0))
     monkeypatch.setattr("synapse.playbook_manager.playbook_store", store)
 
-    assert PlaybookManager.get_main_playbook().id == "main"
-    assert [p.id for p in PlaybookManager.get_context_playbooks()] == ["ctx"]
-    assert PlaybookManager.get_system_prompt() == "Be useful.\n\nAnswer briefly."
+    assert playbook_manager.get_main_playbook().id == "main"
+    assert [p.id for p in playbook_manager.get_context_playbooks()] == ["ctx"]
+    assert playbook_manager.get_system_prompt() == "Be useful.\n\nAnswer briefly."
 
 
 def test_settings_round_trip_over_defaults(tmp_path):
@@ -180,10 +180,10 @@ def test_past_conversations_are_searchable(tmp_path):
     # silently drops the assistant's recall of past chats.
     store = PersistentMemoryStore(tmp_path / "memory.db")
     store.create_conversation("c1")
-    store.add_message("c1", "user", "how do I mount the Wingdrive?")
+    store.add_message("c1", "user", "how do I mount the backup drive?")
     store.add_message("c1", "assistant", "use rsync over ssh")
 
-    assert store.search_conversations("wingdrive")   # case-insensitive substring
+    assert store.search_conversations("BACKUP drive")   # case-insensitive substring
     assert store.search_conversations("nothing here") == []
     assert store.search_conversations("  ") == []
 
@@ -312,10 +312,10 @@ def test_sync_compare_detects_direction(tmp_path):
         # commits but never closes, and Windows refuses to unlink a file that
         # still has an open handle.
         with contextlib.closing(sq.connect(db)) as conn, conn:
+            # updated_at REAL, matching the production schema in store.py. A TEXT
+            # column here hid a real TypeError for months: the comparison in
+            # _extra() ran str-vs-str in the test and str-vs-float in the field.
             conn.executescript(
-                # updated_at REAL, matching the production schema in store.py. A TEXT
-                # column here hid a real TypeError for months: the comparison in
-                # _extra() ran str-vs-str in the test and str-vs-float in the field.
                 "create table conversations (id text primary key, updated_at real not null);"
                 "create table memory (id text primary key);"
             )
@@ -393,6 +393,15 @@ def test_genmon_configs_are_written_with_the_panel_down():
     assert quit_at < copy_at < start_at, "genmon rc copy must happen with the panel stopped"
 
 
+def test_plank_is_actually_launched():
+    """Restoring ~/.config/plank only brings back the dock's launchers - nothing
+    in it starts Plank. The primary-follow watcher is what launches and revives
+    it, so it needs an autostart entry or a fresh box has no dock at all."""
+    desktop = REPO_ROOT / "management" / "autostart" / "plank.desktop"
+    assert "plank-primary-watch.sh" in desktop.read_text()
+    assert "plank.desktop" in (REPO_ROOT / "bin" / "panel" / "install.sh").read_text()
+
+
 _VULKANINFO_IGPU_AND_LLVMPIPE = """\
 Devices:
 ========
@@ -496,32 +505,32 @@ def test_dump_round_trips_a_db_holding_vec_tables(tmp_path):
 def test_curator_drops_fabricated_facts():
     """The curator model invents two classes of fact no prompt wording stopped
     (verified against mistral:7b), and both reached the real memory DB: absence
-    claims read off the existing-memory block ("Jon does not have any pets",
+    claims read off the existing-memory block ("the user does not have any pets",
     which contradicted four cats on file) and specifics lifted from the
-    ASSISTANT's reply ("Jon's main development machine is a MacBook Pro", from
+    ASSISTANT's reply ("the user's main development machine is a MacBook Pro", from
     the user message "What am I developing on?"). Deterministic guard, so it
     holds whatever the model does."""
     from synapse.memory.extractor import _reject_reason
 
     # Absence claims are never facts.
-    assert _reject_reason("Jon does not have any pets", "do i have any pets?")
-    assert _reject_reason("Jon's favorite episode is unknown", "what's my favorite episode?")
-    assert _reject_reason("Jon has not specified an interest", "tell me about stargate")
+    assert _reject_reason("the user does not have any pets", "do i have any pets?")
+    assert _reject_reason("the user's favorite episode is unknown", "what's my favorite episode?")
+    assert _reject_reason("the user has not specified an interest", "tell me about stargate")
 
     # Specifics the user never typed came from the assistant.
-    assert _reject_reason("Jon's main dev machine is a MacBook Pro", "What am I developing on?")
+    assert _reject_reason("the user's main dev machine is a MacBook Pro", "What am I developing on?")
 
     # ...but the same shape grounded in the user's own words must survive.
     assert _reject_reason(
-        "Jon owns a 2000 Ford Ranger with a 3.0L V6",
+        "the user owns a 2000 Ford Ranger with a 3.0L V6",
         "i also have a 2000 Ford Ranger, it's a five-speed with a 3.0L V6") is None
     assert _reject_reason(
-        "Jon has a beagle named Biscuit",
+        "the user has a beagle named Biscuit",
         "i just adopted a dog named Biscuit, he's a beagle") is None
     # A fact carrying no proper nouns or numbers can't be grounding-checked;
     # the prompt owns that case, so the guard must let it through.
     assert _reject_reason(
-        "Jon prefers short answers over long explanations",
+        "the user prefers short answers over long explanations",
         "i really prefer short answers over long explanations") is None
 
 
@@ -636,3 +645,45 @@ def test_preview_iframe_cannot_navigate_to_a_network_url():
     assert "encodeURIComponent(doc)" in markdown
     assert "src={frameUrl}" in markdown
     assert "srcDoc={doc}" not in markdown
+
+
+def test_update_check_reports_behind_and_survives_git_failure(monkeypatch):
+    from synapse import main
+    # Fake git so the test never touches the network. Behind → the remote
+    # VERSION file, not this checkout's, is what the UI advertises.
+    calls = {
+        ("rev-list", "--count", "HEAD..origin/main"): "3",
+        ("show", "origin/main:VERSION"): "9.9.9\n",
+        ("log", "-1", "--format=%h %s", "origin/main"): "abc1234 feat: thing",
+    }
+    monkeypatch.setattr(main, "_git", lambda *a, **kw: calls.get(a, ""))
+    body = TestClient(app).get("/update/check").json()
+    assert body["behind"] == 3 and body["remote_version"] == "9.9.9"
+
+    # An unreachable remote must not 500 the sidebar.
+    def boom(*a, **kw):
+        raise RuntimeError("could not resolve host")
+    monkeypatch.setattr(main, "_git", boom)
+    body = TestClient(app).get("/update/check").json()
+    assert body["behind"] == 0 and "could not resolve host" in body["error"]
+
+
+def test_update_apply_spawns_detached_and_refuses_a_second_run(monkeypatch):
+    import subprocess
+    from synapse import main
+    seen = {}
+
+    def fake_popen(argv, **kw):
+        seen["argv"], seen["kw"] = argv, kw
+        return object()
+
+    monkeypatch.setattr(main, "_update_running", False)
+    monkeypatch.setattr(subprocess, "Popen", fake_popen)
+    client = TestClient(app)
+    assert client.post("/update/apply").json()["started"] is True
+    assert seen["argv"][-2:] == [str(REPO_ROOT / "management" / "ncp.py"), "upgrade"]
+    # Detached, or `ncp upgrade` dies with the backend it is about to stop.
+    assert seen["kw"].get("start_new_session") or seen["kw"].get("creationflags")
+
+    # Double-click must not launch a second pull/rebuild over the first.
+    assert client.post("/update/apply").json()["started"] is False

tests/test_tools.py

@@ -892,3 +892,60 @@ async def _drain_with_messages(manager, model, schemas, user="draw a circle"):
         _run_tool_loop(manager, messages, model, schemas, None, None)
     )
     return statuses, messages
+
+
+def test_read_file_stays_inside_the_repo():
+    """The repo-file tools are the fix for the model inventing paths like
+    `nexus/nlp.py`; the deny-list is what keeps them from reading secrets."""
+    import json
+
+    def read(p):
+        return asyncio.run(tools._read_file(p))
+
+    assert "escapes" in read("../../etc/passwd")
+    # a leading slash is treated as repo-relative, so it lands nowhere real
+    assert "root:" not in read("/etc/passwd")
+    assert "required" in read("")
+    # private data and heavy trees are refused even though they're in-repo
+    for denied in ("synapse/memory/memory.db", ".git/config", "Promethean/pyvenv.cfg"):
+        assert "not readable" in read(denied), denied
+    assert "does not exist" in read("nexus/nlp.py")
+    assert "PROJECT_ROOT" in json.loads(read("synapse/nexus_config.py"))["content"]
+
+
+def test_list_files_globs_the_repo_without_leaking_denied_paths():
+    import json
+
+    hits = json.loads(asyncio.run(tools._list_files("synapse/**/*")))
+    assert "synapse/main.py" in hits
+    assert not [h for h in hits if h.endswith(".db") or "__pycache__" in h], hits
+
+
+def test_routed_reference_playbook_contributes_its_tools(tmp_path, monkeypatch):
+    """A reference playbook routed into the prompt must bring its tools with it.
+    Without this the model reads instructions like "you can read the codebase"
+    while being advertised zero tools — and narrates tool calls it never made."""
+    from synapse.main import _route_playbooks
+    from synapse.playbooks.store import PlaybookFileStore, PlaybookItem
+
+    # Own store, not data/playbooks: the live set is the operator's, and a
+    # published clone ships different playbooks - this asserted on data that
+    # travels with one machine.
+    store = PlaybookFileStore(tmp_path)
+    store.add_playbook(PlaybookItem(id="main", title="Main", goal="g",
+                                    instructions="i", order=0))
+    store.add_playbook(PlaybookItem(id="dev", title="NexusOS Developer", goal="g",
+                                    instructions="You can read the codebase.", order=1,
+                                    tags=["synapse", "backend"],
+                                    tools=["read_file", "list_files"]))
+    monkeypatch.setattr("synapse.playbook_manager.playbook_store", store)
+    import synapse.playbook_manager as pm
+
+    routed = _route_playbooks("why is the memory endpoint in synapse returning 500", pm.get_context_playbooks())
+    names = {pb.title for pb in routed}
+    assert "NexusOS Developer" in names, names
+
+    granted = {t for pb in routed for t in (pb.tools or [])}
+    assert {"read_file", "list_files"} <= granted, granted
+    # none of them are action tools, so they survive the default policy (off)
+    assert tools.schemas_for(sorted(granted), allow_actions=False)