Load Sucrase only when a JSX/TSX preview is opened, remove the hand-written transform, and leave subjective render evaluation to the reader while retaining structural fence validation.
Reconciles 17 commits of this session's work (self-alteration tools,
vendored Curry, slash-command dispatch, Windows toolchain/gate fixes)
against origin/main's v1.2.0 sync (Projects/RAG scoping, a new modules/
system for mail and network, in-app updates, the standalone memory
microservice folded into an in-process curator, KDE desktop theme
overhaul). Nine real conflicts, each resolved by hand after reading both
sides' actual diffs rather than picking one side wholesale:
- synapse/tools.py, tests/test_tools.py: origin/main's diff here was
small and clean (read_file/list_files, two new tests) despite git's
diff3 flagging the whole file as one conflict blob -- reset to this
branch's version and hand-spliced their addition in at the same
points they used, rather than trying to reconcile a false 800-line
conflict. Found and fixed a real bug while verifying: _list_files
returned backslash-separated paths on Windows, which don't match the
forward-slash glob patterns the tool's own schema documents.
- synapse/main.py: kept this branch's cue-based standing advertisement
of render_preview/run_snippet (independent of any playbook granting
them) AND adopted origin/main's fix for routed reference playbooks
not bringing their own tools along -- dropping either would have been
a real regression, not just a style difference. Also: the standalone
memory service (port 8001) is gone upstream, so its dead CORS/kill-
target entries were removed; NEXUS_BACKEND_PORT parameterization and
the manage_ollama-conditional kill logic (this branch's remote-Ollama
support) were kept over origin/main's hardcoded equivalents.
- synapse/memory/store.py: kept this branch's _delete_message_vectors
helper (already reused elsewhere, batches to stay under SQLite's
variable limit) over origin/main's inline duplicate of the same fix.
- synapse/nexus_config.py, nexusos_cli/ncp.py: dropped the now-dead
memory-service port/service entries; kept NEXUS_BACKEND_PORT env
override and the manage_ollama-conditional kill-target list.
- CLAUDE.md, README.md: merged both sides' additions, no real conflict.
Found and fixed three more issues while independently verifying the
merged tree, none of them mine or origin/main's alone -- only visible
once both sides actually ran together:
- modules/ (the new mail+network package) was never added to
pyproject.toml's wheel `packages` list OR the sdist's `include`
allowlist, so `from modules.registry import ROUTERS` in main.py would
ImportError on any wheel install. Fixed both; bin/check.sh's
packaging gate now asserts modules/ actually ships. tests/
test_packaging_deps.py's FIRST_PARTY/SHIPPED_PACKAGES sets were
updated to recognize the new package.
- tests/test_mail_creds.py's 0600-mode assertions are POSIX-only --
NTFS has no equivalent permission bits, so os.open(path, 0o600) on
Windows just creates a normal file and stat.S_IMODE reports 0o666
regardless. Made the assertions platform-aware rather than skip real
coverage (the temp-file-cleanup and password round-trip checks in the
same test still run on Windows) or paper over a genuine OS
limitation with a fake pass.
- tests/test_kde_theme.py used bare Path.read_text() in fifteen places;
Windows' default locale encoding (cp1252, not UTF-8) can't decode a
real UTF-8 byte in the QML it reads, and did fail on one of the
fifteen. Fixed all fifteen, not just the one that happened to trip
today, since the other fourteen were equally fragile.
Verified: full bin/check.sh reports OK end-to-end on this Windows
checkout -- pytest (tests + management): 295 passed, 0 failed, 9
skipped; eslint clean; frontend node:test 57/57; PowerShell/shell
parse clean; wheel + sdist pass twine check and now correctly carry
modules/ (60 files, up from 52 pre-merge). synapse.main:app builds
with 74 routes (up from 54 pre-merge, matching the new Projects/mail/
network endpoints).
code_run.py: shutil.which() finding a compiler executable on PATH doesn't
mean it's a usable toolchain on Windows -- rustc's MSVC target also needs
Microsoft's linker, and an MSYS2 gcc/clang driver can remain resolvable after
one of its runtime DLLs has broken. Both cases silently turned every C/C++/
Rust snippet into a compile error while the capability check said "ready".
_compiled_tool() now actually compiles+links a trivial known-good program
per candidate (Windows only; POSIX keeps the cheap which(1) check since
release hosts install compiler packages atomically) and caches the result.
Also fixes the run/compile child environment: HOME/TMPDIR don't control
Windows' real temp/profile resolution (expanduser() reaches the actual user
profile, GetTempPath() falls back to the Windows directory), letting a
snippet escape the scratch directory or fail outright. _child_env() now also
sets TEMP/TMP/USERPROFILE on Windows.
tests/conftest.py (new): isolates curry_store's SQLite singleton into a
per-run temp directory via NEXUS_CURRY_DB before any test module imports
synapse, and cleans it up at session end -- the release gate no longer
writes test constants into the checkout's live data/curry.db. .gitignore
picks up /data/curry.db for whatever still lands there locally.
bin/check.sh: falls back to Promethean/Scripts/python.exe when
Promethean/bin/python doesn't exist, so the gate actually runs on a Windows
venv instead of immediately exiting "no Promethean venv".
Verified independently: 254 passed, 0 failed, 8 skipped (tests + management)
-- the 12 C/C++/Rust toolchain failures present all session are gone. Full
bin/check.sh run end-to-end on this Windows checkout: pytest, eslint,
frontend node:test (57/57), PowerShell/shell parse, and the wheel/sdist
packaging + twine + content checks all report OK.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds synapse/slash_commands.py: a chat message that's nothing but
/tool_name(arg=val, arg=val) dispatches straight through tools.dispatch(),
skipping model selection, RAG/playbook context assembly, and the ask-policy
approval round-trip entirely. A human typing this IS the approval - there's
no one else to ask - so it's a deliberate, reviewed bypass of the approval
step specifically, not of anything a tool validates internally (path
boundaries, size caps, Curry's own sandbox checks all still run). Argument
values parse via ast.literal_eval only: strings/numbers/bools/None/literal
containers, no names, no calls, no attribute access - a malformed or
hostile-looking argument fails to parse rather than executing anything.
Wired into chat_stream_endpoint (main.py) as an early short-circuit, before
any of the RAG/model-selection work that a slash-command doesn't need. Web
needed no changes (it already forwards raw text unchanged); the TUI
previously swallowed every leading "/" locally and never reached the backend
with it, so tui_app.py's _handle_slash now falls through to _start_chat for
anything shaped like a tool call while still handling its own local
meta-commands (/help, /model, /new, ...) exactly as before.
Also finally wires Curry in as ten real tools (curry_declare_constant,
curry_get_constant/_latest, curry_list_constants, curry_retire_constant,
curry_declare_function, curry_get_function, curry_list_functions,
curry_call_function, curry_retire_function) - deferred from the vendoring
pass. The five write/execute ones are ACTION tools in the same
always-ask-regardless-of-global-policy floor as edit_source
(ALWAYS_ASK_ACTION_TOOLS, generalized in tools.py from the old
self_edit-only ALWAYS_ASK_TOOLS so future tool families share one place to
register into). curry_call_function is gated as an action for the same
reason run_snippet is: it executes code, even sandboxed.
Fixed a real bug surfaced while wiring this up: curry_db is a long-lived
singleton holding one sqlite3 connection (unlike NexusOS's own memory store,
which opens/closes a fresh connection per call specifically to dodge this),
and sqlite3 forbids using a connection from a different thread than created
it. That's a non-issue in production (uvicorn's single event-loop thread),
but Starlette's TestClient runs the ASGI app through an anyio portal thread,
so it broke immediately under test. Fixed at the source (curry_core.py,
Curry.__init__) with check_same_thread=False, documented as a second
deliberate vendoring deviation alongside the PR #4 sandbox fix - there was
never real concurrent access here, just an overly strict same-thread
assertion tripping on a thread-identity change with only one logical caller.
Verified: 244 backend tests pass (18 new for the parser + endpoint wiring +
curry tool registration, 4 new for the TUI passthrough); the 12 pre-existing
C/C++/Rust toolchain failures are unrelated and unchanged. Confirmed by hand
over the real HTTP endpoint: successful dispatch, zero tool_request events
(approval bypass working as designed), a format()-dunder exploit attempt
still rejected by the vendored sandbox fix even through the new tool
registration, malformed arguments rejected before ever reaching dispatch,
and an unknown tool name rejected cleanly. Wheel rebuilt and content-checked
(bin/check.sh's gate now also asserts slash_commands.py ships).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Vendors curry_core.py from Athena-Pro/Curry (with the str.format()/format_map()
sandbox-escape fix from https://github.com/Athena-Pro/Curry/pull/4 already
applied) into synapse/, since Curry itself isn't a pip-installable package -
it's meant to be pointed at via a config path, which only works from a source
checkout. Vendoring a single self-contained, stdlib-only file ships it inside
NexusOS's own wheel with no extra dependency to reconcile.
synapse/curry_store.py opens it into a module-level singleton (curry_db) at
import time, the same pattern as memory.store.store and
playbooks.store.playbook_store, and main.py imports it so it's genuinely
initialized at process startup - preloaded, not lazy-on-first-use. Backed by
its own CURRY_DB file (nexus_config.py), separate from memory.db.
NexusOS builds exactly one wheel (py3-none-any, no compiled extensions) -
there is no separate Windows/macOS/Linux artifact; platform differences are
handled by requirement overlays at install time, not by building different
wheels. Verified the same wheel actually carries this correctly: built it,
confirmed twine check passes, confirmed synapse/curry_core.py and
curry_store.py are present in the archive (bin/check.sh's packaging gate now
asserts this too), then installed that exact wheel into a throwaway venv and
round-tripped a declare_constant/get_constant_latest call against it with no
source checkout present - proving "preloaded and ready to be called" holds
from the shipped artifact, not just editable-install execution.
Android/Termux is unaffected by this change in either direction: it already
has a separate, documented, pre-existing blocker in docs/TERMUX.md (no
published Android pydantic-core wheel) that has nothing to do with Curry,
which is pure stdlib and adds no new native/binary dependency.
Scope: preload only, nothing wired into a chat-facing tool yet - no model or
user-authored content reaches declare_function/call_function today.
Verified: 216 backend tests pass (4 new in test_curry_store.py, including a
regression test proving the vendored sandbox fix survived the copy); the 12
pre-existing C/C++/Rust toolchain failures are unrelated and unchanged.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Gives the assistant three new ACTION tools to change its own playbooks,
runtime settings, and (source checkout only) its own source code, all
reusing the existing run_snippet/remember approval framework — but with
a hardcoded floor (self_edit.ALWAYS_ASK_TOOLS) so these three always pause
for per-call human approval regardless of the global action_tool_policy
setting. Flipping that policy for an unrelated tool must never silently
also unlock unattended self-modification.
synapse/self_edit.py is the new module doing the actual work, documented
in the same explicit "here's what is and isn't a security boundary" style
as code_run.py:
- edit_source is confined to settings.project_root via the same
realpath + Path.parents boundary check that just closed a sibling-
directory bypass in /icons/image, plus a denylist of dangerous
subtrees (.git, the venv, node_modules, build output, runtime state).
Gated on settings.source_checkout — refuses cleanly in a wheel
install, where there's no live repo to edit or commit into.
- The model sends full file content, never a diff; the server computes
the diff itself via difflib against what's actually on disk, so a
human reviews ground truth, not a description the model wrote.
- Every applied source edit best-effort commits to git as an audit
trail — independent of, not a substitute for, the approval gate.
- edit_playbook merges instead of replacing (main.py's prior
_persist_playbook did a raw replace, which was only safe because the
frontend form always sent a complete object — unsafe for a tool a
model calls with a partial argument set, so this also fixes that
latent bug). Becoming the active system prompt requires an explicit
make_active flag, never a side effect of an ordinary edit.
- edit_settings reuses the existing _SETTINGS_DEFAULTS allowlist.
The approval UI (Chatbot.jsx) previously rendered a tool call's arguments
as Object.values(args).join(", ") in a single-line badge — unusable for
reviewing a diff. It now renders a real, server-computed preview (diff
for source, before/after for playbook/settings) via a new shared
diff-view.js helper, with a loud banner when a change would become the
active system prompt or touch action_tool_policy/system_prompt. A new
nexus-edit fence (self-edit-langs.js + Markdown.jsx's EditBlock) shows
the same diff after an edit is applied, mirroring nexus-run.
Verified: 212 backend tests pass (29 new in test_self_edit.py; the 12
pre-existing C/C++/Rust toolchain failures are unrelated and unchanged),
57 frontend node:test cases pass (15 new), eslint and vite build clean,
and the full approval-preview render path was exercised against the real
built UI with a mocked SSE stream covering all four preview branches
(source diff, playbook becomes-main, settings policy-change, and a
rejected/failing preview).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
/icons/image used a bare string startswith() against allowed roots, so
a sibling dir like /usr/share/icons_evil would pass as if it were under
/usr/share/icons. Switched to the pathlib parents-based check already
used correctly in icons/compositor.py, plus a regression test.
Also stopped three bare `except Exception: pass` blocks (auto model
select fallback, conversation titling) from swallowing errors silently
- they now log to the existing chat trace helper. Behavior unchanged,
just visible when something's actually failing.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Close SQLite handles safely on Windows, clean orphaned vectors, normalize Ollama endpoints, and surface model errors without leaking reasoning tags.
Co-authored-by: Cursor <cursoragent@cursor.com>
DoS/quota guardrails for the unauthenticated local APIs:
* Body-size middleware rejects oversized requests (Content-Length) before they
are buffered/base64-decoded (NEXUS_MAX_REQUEST_MB, default 32).
* Document upload enforces a decoded-byte cap (NEXUS_MAX_UPLOAD_MB, default 20)
and a PDF page-count cap (NEXUS_MAX_PDF_PAGES, default 500) as backstops for
chunked bodies and pathological files.
* A counter-based in-flight limiter bounds concurrent chats and document
ingests (NEXUS_MAX_CONCURRENT_CHATS/UPLOADS), returning 429 when saturated;
the chat slot is held for the whole SSE stream and released on completion or
client disconnect.
* /models/pull gains an opt-in allowlist (NEXUS_MODEL_ALLOWLIST); empty by
default so behaviour is unchanged, otherwise a bare repo name permits all its
tags.
Co-authored-by: Cursor <cursoragent@cursor.com>
Two tool/agent-layer hardening changes:
* fetch_url now resolves the target host and refuses to connect if any
resolved address is loopback, private (RFC1918/ULA), link-local (incl. the
169.254.169.254 cloud-metadata endpoint), multicast, reserved, or
unspecified. IPv4-mapped IPv6 is unwrapped first, and the guard re-runs on
every redirect hop so a public URL cannot 302 its way to an internal target.
* /chat/approve now requires a single-use token minted when the stream pauses
for approval and delivered only in that stream's tool_request event, compared
in constant time. Previously the pending approval was keyed solely on a
client-supplied conversation_id, so anyone who could enumerate a
conversation_id could approve another client's pending action.
The frontend threads the token from the tool_request event into the approve
call.
Co-authored-by: Cursor <cursoragent@cursor.com>
The Synapse backend and memory service bound 0.0.0.0 with wildcard CORS and no
auth, exposing the full unauthenticated admin/data API to the LAN. Default the
uvicorn bind to 127.0.0.1 (NEXUS_BIND_HOST override), scope CORS to known local
origins instead of "*", and add TrustedHostMiddleware to reject foreign Host
headers (which defeats DNS-rebinding, something same-origin CORS cannot stop).
NEXUS_ALLOWED_HOSTS / NEXUS_ALLOWED_ORIGINS allow opt-in LAN exposure, intended
to be paired with real authentication.
Co-authored-by: Cursor <cursoragent@cursor.com>
Athena
GitNexus · part of the Nexus stack