Vendors curry_core.py from Athena-Pro/Curry (with the str.format()/format_map()
sandbox-escape fix from https://github.com/Athena-Pro/Curry/pull/4 already
applied) into synapse/, since Curry itself isn't a pip-installable package -
it's meant to be pointed at via a config path, which only works from a source
checkout. Vendoring a single self-contained, stdlib-only file ships it inside
NexusOS's own wheel with no extra dependency to reconcile.
synapse/curry_store.py opens it into a module-level singleton (curry_db) at
import time, the same pattern as memory.store.store and
playbooks.store.playbook_store, and main.py imports it so it's genuinely
initialized at process startup - preloaded, not lazy-on-first-use. Backed by
its own CURRY_DB file (nexus_config.py), separate from memory.db.
NexusOS builds exactly one wheel (py3-none-any, no compiled extensions) -
there is no separate Windows/macOS/Linux artifact; platform differences are
handled by requirement overlays at install time, not by building different
wheels. Verified the same wheel actually carries this correctly: built it,
confirmed twine check passes, confirmed synapse/curry_core.py and
curry_store.py are present in the archive (bin/check.sh's packaging gate now
asserts this too), then installed that exact wheel into a throwaway venv and
round-tripped a declare_constant/get_constant_latest call against it with no
source checkout present - proving "preloaded and ready to be called" holds
from the shipped artifact, not just editable-install execution.
Android/Termux is unaffected by this change in either direction: it already
has a separate, documented, pre-existing blocker in docs/TERMUX.md (no
published Android pydantic-core wheel) that has nothing to do with Curry,
which is pure stdlib and adds no new native/binary dependency.
Scope: preload only, nothing wired into a chat-facing tool yet - no model or
user-authored content reaches declare_function/call_function today.
Verified: 216 backend tests pass (4 new in test_curry_store.py, including a
regression test proving the vendored sandbox fix survived the copy); the 12
pre-existing C/C++/Rust toolchain failures are unrelated and unchanged.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The CLI shipped from `management/`, which also holds desktop-only pieces (the
Tk control panel, the XFCE panel wiring, the shell wrappers). Packaging that
directory meant the wheel either dragged in tkinter or shipped a broken import.
Split it: `nexusos_cli/` is what the wheel ships and what `nexus`/`ncp`/
`nexusos` dispatch to, `management/` keeps the desktop half.
Alongside the move:
* hatch_build.py decides the interface/web/dist include at build time. dist/
is gitignored, so a static force-include aborts `pip install -e .` on a
fresh clone - before the reader reaches the `npm run build` step. Editable
installs now skip a missing dist; wheels and sdists hard-error naming the
command to run.
* synapse/proc_util.py gives frontend_manager and ncp process inspection and
termination without psutil, which became an optional extra when the wheel
landed. It routes around Windows having no signals, where os.kill(pid, 15)
is an unblockable TerminateProcess rather than a polite request.
* nexusos_cli/monitor.py adds `ncp monitor`, an ASCII dashboard with no curses
or rich dependency so it works in Termux, plain SSH and Windows Terminal.
Collector and renderer are separate so tests feed fixtures, no stack needed.
* tests/test_packaging_deps.py fails the gate when synapse or nexusos_cli
import a distribution pyproject does not declare, and when an optional
dependency is imported at module scope instead of lazily.
* bin/check.sh now builds the wheel, twine-checks it, and asserts the compiled
UI and seed playbooks are actually inside it. A wheel that builds but ships
no dist/ serves a blank page, which only shows up after release.
tests/test_nexus_api.py moves to tests/ with the module it covers.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Separate bind and client addresses, include Ollama's response body in HTTP failures, and strip inline <think> blocks from complete and streamed replies.
Brings the public tree back in line with the development repo after several
weeks of drift caused by a stale publish include list.
New:
- In-app update path: GET /update/check compares the checkout against
origin/main and POST /update/apply runs `ncp upgrade` detached (pull,
rebuild, restart). The sidebar shows the version, checks on click, and
offers an "update available" pill.
- Projects: a project workspace groups chats and RAG documents, with
per-project instructions and document retrieval scoped to the active
project. Replaces the standalone Documents page.
- modules/: auto-discovered feature plugins (mail, network) with their
frontend counterparts and tests.
- Memory curation runs in-process (synapse/memory/curator.py) on the chat
model when a conversation goes idle. The separate memory service on :8001
is gone, along with the launcher lines that started it.
Also: the KDE theme, panel and Promethean terminal assets, the full test
suite, and VERSION 1.2.0.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
DoS/quota guardrails for the unauthenticated local APIs:
* Body-size middleware rejects oversized requests (Content-Length) before they
are buffered/base64-decoded (NEXUS_MAX_REQUEST_MB, default 32).
* Document upload enforces a decoded-byte cap (NEXUS_MAX_UPLOAD_MB, default 20)
and a PDF page-count cap (NEXUS_MAX_PDF_PAGES, default 500) as backstops for
chunked bodies and pathological files.
* A counter-based in-flight limiter bounds concurrent chats and document
ingests (NEXUS_MAX_CONCURRENT_CHATS/UPLOADS), returning 429 when saturated;
the chat slot is held for the whole SSE stream and released on completion or
client disconnect.
* /models/pull gains an opt-in allowlist (NEXUS_MODEL_ALLOWLIST); empty by
default so behaviour is unchanged, otherwise a bare repo name permits all its
tags.
Co-authored-by: Cursor <cursoragent@cursor.com>
The Synapse backend and memory service bound 0.0.0.0 with wildcard CORS and no
auth, exposing the full unauthenticated admin/data API to the LAN. Default the
uvicorn bind to 127.0.0.1 (NEXUS_BIND_HOST override), scope CORS to known local
origins instead of "*", and add TrustedHostMiddleware to reject foreign Host
headers (which defeats DNS-rebinding, something same-origin CORS cannot stop).
NEXUS_ALLOWED_HOSTS / NEXUS_ALLOWED_ORIGINS allow opt-in LAN exposure, intended
to be paired with real authentication.
Co-authored-by: Cursor <cursoragent@cursor.com>
- install-windows.ps1: warn about a leftover profile-based ncp() that
would shadow ncp.cmd; the "press any key to close" footer now skips
the wait when stdin is redirected (was hanging indefinitely) and
exits cleanly instead of Stop-Process when it owns the window; pulls
nomic-embed-text alongside the chat/memory models.
- management/ncp.py: ncp start / start -b bring Ollama up automatically;
longer timeout + real error message on a slow model warm.
- synapse/nexus_config.py: DEFAULT_EMBED_MODEL, single source of truth
alongside DEFAULT_CHAT_MODEL/DEFAULT_MEMORY_MODEL.
- synapse/ollama_manager.py: is_available() cached instead of spawning a
process per /status poll; is_running() timeout dropped 2s -> 0.5s so a
healthy backend stops reading as dead; embed() reads the new default
instead of a hardcoded string; de-duplicated serve-env setup.
Ported via bin/publish.sh from NexusOS-jon.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
AthenaandClaude Sonnet 5
enderofwingsandClaude Sonnet 5
GitNexus · part of the Nexus stack