enderofwings/NexusOS
1
0
Fork 1
Code Issues Pull Requests 1 Actions 13 Packages Projects Releases Wiki Activity
79 Commits 5 Branches 0 Tags
9ed29081708938e54ce0c5c07094216340d1f3ee
Commit Graph
8 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Athena 5f67d19e80 fix(packaging): include backend modules in distributions
package / wheel (pull_request) Waiting to run
Details
2026-08-26 08:17:25 -05:00
Athena d579502a5b feat: add portable NexusOS CLI and packaging 2026-08-26 08:11:39 -05:00
Athena 2ebe93b4f7 fix(ollama): normalize hosts, errors, and reasoning output 
Separate bind and client addresses, include Ollama's response body in HTTP failures, and strip inline <think> blocks from complete and streamed replies.
 2026-08-26 03:32:45 -05:00
Athena d56d579755 fix(memory): sweep legacy orphaned message vectors 
Repair vector rows left behind by older databases at store startup. Keep the existing single-statement delete path from main and avoid reintroducing the redundant batched helper.
 2026-08-26 03:32:34 -05:00
Athena c3a7b6eefd fix(sync): close SQLite handles before restore 
Use contextlib.closing for dump, comparison, and restore connections so Windows can unlink the live database immediately after the comparison step.
 2026-08-26 03:32:15 -05:00
AthenaandCursor 4a7451f5f5 feat(security): request-size caps, concurrency limits, model-pull allowlist 
DoS/quota guardrails for the unauthenticated local APIs:

* Body-size middleware rejects oversized requests (Content-Length) before they
  are buffered/base64-decoded (NEXUS_MAX_REQUEST_MB, default 32).
* Document upload enforces a decoded-byte cap (NEXUS_MAX_UPLOAD_MB, default 20)
  and a PDF page-count cap (NEXUS_MAX_PDF_PAGES, default 500) as backstops for
  chunked bodies and pathological files.
* A counter-based in-flight limiter bounds concurrent chats and document
  ingests (NEXUS_MAX_CONCURRENT_CHATS/UPLOADS), returning 429 when saturated;
  the chat slot is held for the whole SSE stream and released on completion or
  client disconnect.
* /models/pull gains an opt-in allowlist (NEXUS_MODEL_ALLOWLIST); empty by
  default so behaviour is unchanged, otherwise a bare repo name permits all its
  tags.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-08-07 09:41:53 -05:00
AthenaandCursor 1f6beed0d2 feat(security): SSRF guard on fetch_url + single-use tool-approval tokens 
Two tool/agent-layer hardening changes:

* fetch_url now resolves the target host and refuses to connect if any
  resolved address is loopback, private (RFC1918/ULA), link-local (incl. the
  169.254.169.254 cloud-metadata endpoint), multicast, reserved, or
  unspecified. IPv4-mapped IPv6 is unwrapped first, and the guard re-runs on
  every redirect hop so a public URL cannot 302 its way to an internal target.

* /chat/approve now requires a single-use token minted when the stream pauses
  for approval and delivered only in that stream's tool_request event, compared
  in constant time. Previously the pending approval was keyed solely on a
  client-supplied conversation_id, so anyone who could enumerate a
  conversation_id could approve another client's pending action.

The frontend threads the token from the tool_request event into the approve
call.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-08-07 09:41:09 -05:00
AthenaandCursor fe12eb1821 feat(security): bind services to loopback with Host + CORS allowlists 
The Synapse backend and memory service bound 0.0.0.0 with wildcard CORS and no
auth, exposing the full unauthenticated admin/data API to the LAN. Default the
uvicorn bind to 127.0.0.1 (NEXUS_BIND_HOST override), scope CORS to known local
origins instead of "*", and add TrustedHostMiddleware to reject foreign Host
headers (which defeats DNS-rebinding, something same-origin CORS cannot stop).

NEXUS_ALLOWED_HOSTS / NEXUS_ALLOWED_ORIGINS allow opt-in LAN exposure, intended
to be paired with real authentication.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-08-07 09:40:12 -05:00