The Synapse backend and memory service bound 0.0.0.0 with wildcard CORS and no
auth, exposing the full unauthenticated admin/data API to the LAN. Default the
uvicorn bind to 127.0.0.1 (NEXUS_BIND_HOST override), scope CORS to known local
origins instead of "*", and add TrustedHostMiddleware to reject foreign Host
headers (which defeats DNS-rebinding, something same-origin CORS cannot stop).
NEXUS_ALLOWED_HOSTS / NEXUS_ALLOWED_ORIGINS allow opt-in LAN exposure, intended
to be paired with real authentication.
Co-authored-by: Cursor <cursoragent@cursor.com>
- install-windows.ps1: warn about a leftover profile-based ncp() that
would shadow ncp.cmd; the "press any key to close" footer now skips
the wait when stdin is redirected (was hanging indefinitely) and
exits cleanly instead of Stop-Process when it owns the window; pulls
nomic-embed-text alongside the chat/memory models.
- management/ncp.py: ncp start / start -b bring Ollama up automatically;
longer timeout + real error message on a slow model warm.
- synapse/nexus_config.py: DEFAULT_EMBED_MODEL, single source of truth
alongside DEFAULT_CHAT_MODEL/DEFAULT_MEMORY_MODEL.
- synapse/ollama_manager.py: is_available() cached instead of spawning a
process per /status poll; is_running() timeout dropped 2s -> 0.5s so a
healthy backend stops reading as dead; embed() reads the new default
instead of a hardcoded string; de-duplicated serve-env setup.
Ported via bin/publish.sh from NexusOS-jon.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
AthenaandCursor
enderofwingsandClaude Sonnet 5
GitNexus · part of the Nexus stack