@neuralis/brain-core 0.3.1 → 0.4.0

package/package.json

@@ -1,8 +1,23 @@
 {
   "name": "@neuralis/brain-core",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "license": "FSL-1.1-ALv2",
   "homepage": "https://docs.neuralisapp.com/brain-core",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/neuralisapp/neuralis.git"
+  },
+  "bugs": {
+    "url": "https://github.com/neuralisapp/neuralis/issues"
+  },
+  "keywords": [
+    "neuralis",
+    "neuralis-package",
+    "vector-search",
+    "rag",
+    "virtual-filesystem",
+    "ai-agents"
+  ],
   "type": "module",
   "publishConfig": {
     "access": "public"
@@ -33,6 +48,18 @@
     "./upgrade/vector-proof": {
       "types": "./dist/scripts/vectorProofV1.d.ts",
       "default": "./dist/scripts/vectorProofV1.js"
+    },
+    "./upgrade/source-root-pair": {
+      "types": "./dist/scripts/sourceRootPairV1.d.ts",
+      "default": "./dist/scripts/sourceRootPairV1.js"
+    },
+    "./upgrade/source-to-folder": {
+      "types": "./dist/scripts/sourceToFolderV1.d.ts",
+      "default": "./dist/scripts/sourceToFolderV1.js"
+    },
+    "./upgrade/source-to-host": {
+      "types": "./dist/scripts/sourceToHostV1.d.ts",
+      "default": "./dist/scripts/sourceToHostV1.js"
     }
   },
   "typesVersions": {
@@ -52,31 +79,29 @@
     "skills",
     "rules",
     "instructions",
-    "docs",
     "team",
     "app"
   ],
   "dependencies": {
     "@codemirror/commands": "^6.11.1",
-    "@codemirror/language": "^6.12.4",
-    "@codemirror/merge": "^6.12.2",
+    "@codemirror/language": "^6.13.1",
+    "@codemirror/merge": "^6.12.3",
     "@codemirror/state": "^6.7.6",
-    "@codemirror/view": "^6.43.13",
-    "@iconify-json/vscode-icons": "^1.2.81",
-    "@iconify/react": "^6.0.2",
-    "@neuralis/package-system": "0.3.1",
-    "@qdrant/js-client-rest": "1.19.0",
+    "@codemirror/view": "^6.43.15",
+    "@iconify-json/vscode-icons": "^1.2.94",
+    "@iconify/react": "^6.0.3",
+    "@neuralis/package-system": "0.4.0",
+    "@qdrant/js-client-rest": "1.20.0",
     "@shikijs/engine-javascript": "^4.4.3",
     "@shikijs/langs": "^4.4.3",
     "@shikijs/themes": "^4.4.3",
     "react-diff-view": "^3.3.3",
-    "shiki": "^4.4.3",
-    "simple-git": "^4.0.2"
+    "shiki": "^4.4.3"
   },
   "peerDependencies": {
     "@aws-sdk/client-s3": "^3.975.0",
     "@aws-sdk/s3-request-presigner": "^3.975.0",
-    "@neuralis/agent-core": "0.3.1",
+    "@neuralis/agent-core": "0.4.0",
     "@tanstack/react-virtual": "^3.13.0",
     "lucide-react": "^1.47.0",
     "react": "^19.0.0",
@@ -113,7 +138,7 @@
     "@types/node": "^26.6.2",
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
-    "jsdom": "^30.1.1",
+    "jsdom": "^30.1.3",
     "typescript": "^7.0.2",
     "vitest": "^5.0.1"
   },
@@ -129,9 +154,6 @@
     "authors": [
       "Neuralis"
     ],
-    "source": {
-      "kind": "neuralis"
-    },
     "runtime": {
       "binding": "embedded",
       "hosted": {
@@ -154,15 +176,15 @@
         ]
       },
       {
-        "id": "local-disk",
-        "kind": "local",
+        "id": "host",
+        "kind": "host",
         "type": "source",
         "transport": "in-process",
-        "name": "Local Disk",
-        "description": "A folder on this machine, mounted into the workspace by absolute path — read, write, search and index its files with the fs_* tools.",
+        "name": "Host folder",
+        "description": "A folder as a source — on this server, or on a paired device through its broker — read, write, search and index its files with the fs_* tools. A device folder is attached only by the device's owner (device.own), every path is clamped by that owner's ceiling, and an offline device serves its indexed text.",
         "icon": "HardDrive",
         "category": "disk",
-        "urlScheme": "local",
+        "urlScheme": "host",
         "defaultScope": "project",
         "scopeSelectable": true,
         "allowedScopes": [
@@ -173,34 +195,73 @@
         "configSchema": {
           "type": "object",
           "additionalProperties": false,
+          "x-neuralis": {
+            "ui": {
+              "summary": "A folder on this server or one of your devices"
+            }
+          },
           "properties": {
             "root": {
               "type": "string",
               "minLength": 1,
-              "description": "Absolute or project-relative path to the directory the agent should see.",
+              "description": "The folder: on this server an absolute or project-relative path; on a device an absolute path ON THAT DEVICE (`/…`, `C:\\…` on Windows; never a UNC share), inside its owner's ceiling.",
               "x-neuralis": {
                 "ui": {
-                  "label": "Root path",
+                  "label": "Folder",
                   "control": "container-path",
-                  "placeholder": "/home/user/my-project"
+                  "placeholder": "/home/user/my-project",
+                  "deviceLabel": "Folder on the device",
+                  "devicePlaceholder": "/home/you/projects",
+                  "devicePlaceholders": {
+                    "win32": "C:\\Users\\you\\projects",
+                    "darwin": "/Users/you/projects",
+                    "linux": "/home/you/projects"
+                  },
+                  "browse": true
                 }
               }
             },
             "hostRoot": {
               "type": "string",
-              "description": "Host-side mirror of the path when running inside a container. Used by `resolveOsUri` so ide_open-style tools surface a usable host path.",
+              "description": "Host-side mirror of the path when running inside a container. Used by `resolveOsUri` so ide_open-style tools surface a usable host path. Never beside `device`.",
               "x-neuralis": {
                 "ui": {
                   "label": "Host mirror path",
                   "control": "host-path",
-                  "optional": true
+                  "optional": true,
+                  "advanced": true,
+                  "placeholder": "auto",
+                  "help": "Derived from the mount; set it only for a folder no mount names (sources.privileged)."
+                }
+              }
+            },
+            "device": {
+              "type": "string",
+              "minLength": 1,
+              "pattern": "^dev_[A-Za-z0-9]+$",
+              "description": "The paired device (`dev_…`, from `neuralis device status`) the folder lives on; absent = this server. Only that device's owner may attach a folder to it, and it never changes after the attach.",
+              "x-neuralis": {
+                "ui": {
+                  "label": "Where",
+                  "control": "select",
+                  "optionsRoute": "sources/devices",
+                  "optional": true,
+                  "emptyLabel": "This server",
+                  "help": "Your computer is not listed? Pair it first: \"Pair this computer…\" in the Neuralis app's tray, or run neuralis device pair on it.",
+                  "transport": true
                 }
               }
             }
           },
           "required": [
             "root"
-          ]
+          ],
+          "not": {
+            "required": [
+              "device",
+              "hostRoot"
+            ]
+          }
         },
         "capabilities": [
           "list",
@@ -269,7 +330,7 @@
             "exec": false
           }
         },
-        "connectorFactory": "./dist/src/connectors/LocalDiskConnector.js#createLocalDiskConnector"
+        "connectorFactory": "./dist/src/connectors/HostConnector.js#createHostConnector"
       },
       {
         "id": "brain-internal",
@@ -315,7 +376,7 @@
     "sources": [
       {
         "source": "data",
-        "kind": "local",
+        "kind": "host",
         "root": "data",
         "scope": "project",
         "seed": "auto",
@@ -376,7 +437,7 @@
       },
       {
         "source": "packages",
-        "kind": "local",
+        "kind": "host",
         "root": "_packages",
         "scope": "project",
         "seed": "auto",
@@ -445,32 +506,55 @@
     ],
     "requires": {
       "providesFeatures": [
-        "drive.read",
-        "drive.write",
-        "drive.search",
-        "drive.sync",
-        "drive.mount",
-        "filesystem.observeScoped",
-        "filesystem.modifyScoped",
         {
-          "id": "drive.mount.privileged",
-          "title": "Attach privileged sources",
-          "description": "Attach, see, and BROWSE high-blast-radius host zones as sources — the App Zone, the Neuralis source tree, and the whole host (`/`). It covers the discovery step too: enumerating a protected zone (or the filesystem root) through `sources/browse` needs it, because you may browse exactly what you would be allowed to attach. No grant below the admin tier (C8) — the seeded `admin` role holds it through its enumerated default grant, `owner` through the `'*'` wildcard; grantable to any custom role. Plain `drive.mount` still attaches ordinary sources."
+          "id": "files.read",
+          "title": "Read files",
+          "description": "Open the Files app and read what the URI policy lets you read: list, read and download files, follow live file events, see source details and the Vector Health counts. Every path is still checked against its source's URI policy."
+        },
+        {
+          "id": "files.write",
+          "title": "Write files",
+          "description": "Create, edit, move, copy, upload and delete files, make folders, and resolve Pending Changes (approve, revert, dismiss), plus the Vector Health clean-up sweep. Every write is still checked against the source's URI policy, and an agent's write can wait for approval."
+        },
+        {
+          "id": "files.search",
+          "title": "Search files",
+          "description": "Search the indexed files (by meaning, keyword or metadata) and grep a folder live. Results stay limited to the paths the URI policy lets you read."
+        },
+        {
+          "id": "sources.sync",
+          "title": "Sync sources",
+          "description": "Start, cancel and inspect a source's sync, and reset or re-index it."
+        },
+        {
+          "id": "sources.mount",
+          "title": "Manage sources",
+          "description": "Add, edit, enable, disable and remove ordinary sources, and browse the folders you could attach. A protected zone (the App Zone, the Neuralis tree, the whole host) also needs sources.privileged; a source on a paired device is attached only by that device's owner, with device.own."
         },
         {
-          "id": "drive.mount.host",
-          "title": "Attach host-plane sources",
-          "description": "Attach or edit a source that resolves OUTSIDE the container, through the operator-provisioned host broker (`host-*://`). Every host-plane root is privileged by construction, so this is required TOGETHER with drive.mount.privileged — a sub-directory is gated exactly like `/`. No grant below the admin tier — the seeded `admin` role holds it through its enumerated default grant, `owner` through the `'*'` wildcard; grantable to any custom role. The operator-owned broker ceiling still clamps what a granted caller can actually reach."
+          "id": "files.readOthers",
+          "title": "Read others' files",
+          "description": "Read another member's or agent's user- or agent-scoped sources in this project, and restart or purge a shared project machine that another user last held. No grant below the admin tier — the seeded `admin` role holds it through its enumerated default grant, `owner` through the `'*'` wildcard; grantable to any custom role."
         },
         {
-          "id": "drive.policy",
+          "id": "files.writeOthers",
+          "title": "Write others' files",
+          "description": "Write to another member's or agent's user- or agent-scoped sources in this project. No grant below the admin tier — the seeded `admin` role holds it through its enumerated default grant, `owner` through the `'*'` wildcard; grantable to any custom role."
+        },
+        {
+          "id": "sources.privileged",
+          "title": "Attach privileged sources",
+          "description": "Attach, see, and BROWSE high-blast-radius host zones as sources — the App Zone, the Neuralis source tree, and the whole host (`/`). It covers the discovery step too: enumerating a protected zone (or the filesystem root) through `sources/browse` needs it, because you may browse exactly what you would be allowed to attach. No grant below the admin tier (C8) — the seeded `admin` role holds it through its enumerated default grant, `owner` through the `'*'` wildcard; grantable to any custom role. Plain `sources.mount` still attaches ordinary sources."
+        },
+        {
+          "id": "sources.policy",
           "title": "Edit URI policies",
           "description": "Edit per-source URI path-access policies (POST /policies/uri). Owner/admin by default; grantable to a custom role."
         },
         {
           "id": "packages.author",
           "title": "Author packages",
-          "description": "Reach the package-authoring affordances (the Packages panel scaffold launcher and the install/build actions). The authoring skill itself is open to every caller; this feature gates the surfaces that act. Distinct from drive.write."
+          "description": "Reach the package-authoring affordances (the Packages panel scaffold launcher and the install/build actions). The authoring skill itself is open to every caller; this feature gates the surfaces that act. Distinct from files.write."
         },
         {
           "id": "packages.registry",
@@ -485,38 +569,37 @@
       ],
       "defaultRoleGrants": {
         "admin": [
-          "drive.read",
-          "drive.write",
-          "drive.search",
-          "drive.sync",
-          "drive.mount",
-          "drive.mount.privileged",
-          "drive.mount.host",
-          "drive.policy",
-          "filesystem.observeScoped",
-          "filesystem.modifyScoped",
+          "files.read",
+          "files.write",
+          "files.search",
+          "sources.sync",
+          "sources.mount",
+          "sources.privileged",
+          "sources.policy",
+          "files.readOthers",
+          "files.writeOthers",
           "packages.author",
           "packages.registry"
         ],
         "manager": [
-          "drive.read",
-          "drive.write",
-          "drive.search",
-          "drive.sync",
-          "drive.mount",
+          "files.read",
+          "files.write",
+          "files.search",
+          "sources.sync",
+          "sources.mount",
           "packages.author",
           "packages.registry"
         ],
         "member": [
-          "drive.read",
-          "drive.search",
+          "files.read",
+          "files.search",
           "packages.registry"
         ],
         "viewer": [
-          "drive.read"
+          "files.read"
         ],
         "newRole": [
-          "drive.read"
+          "files.read"
         ]
       }
     },
@@ -583,7 +666,6 @@
         "description": "Parallel file processing during sync",
         "type": "number",
         "default": 3,
-        "envFallback": "BRAIN_SYNC_CONCURRENCY",
         "category": "brain"
       },
       {
@@ -619,7 +701,7 @@
         "label": "Embedding Request Timeout (ms)",
         "description": "Maximum time for an embedding response including its body. Raise this for slower local servers or large batches; timeout preserves payload indexing.",
         "type": "number",
-        "default": 30000,
+        "default": 120000,
         "category": "brain",
         "min": 1000,
         "max": 600000
@@ -696,7 +778,6 @@
         "description": "Queue-level cap on concurrently RUNNING sync jobs (distinct from Sync Concurrency, the per-file fan-out inside one job). Applies live to the next queue pump.",
         "type": "number",
         "default": 2,
-        "envFallback": "BRAIN_SYNC_MAX_CONCURRENT",
         "category": "brain",
         "min": 1,
         "max": 8
@@ -739,6 +820,34 @@
         "min": 30000,
         "max": 604800000
       },
+      {
+        "key": "brainSyncPollIntervalMs",
+        "label": "Sync Scheduler Interval (ms)",
+        "description": "How often the sync scheduler checks which sources are due (first sync, filter change, reconcile cadence, a device back online). Applies on restart.",
+        "type": "number",
+        "default": 60000,
+        "category": "brain",
+        "min": 5000,
+        "max": 3600000
+      },
+      {
+        "key": "brainSyncBootReconcile",
+        "label": "Sync After Start",
+        "description": "One delta sync of every auto-trigger source shortly after the app starts, so files changed while it was stopped (or left by an interrupted sync) are indexed now instead of at the next reconcile cadence. Runs through the sync queue under Sync Queue Max Jobs. Applies on restart.",
+        "type": "boolean",
+        "default": true,
+        "category": "brain"
+      },
+      {
+        "key": "brainSyncBootReconcileDelayMs",
+        "label": "Sync After Start Delay (ms)",
+        "description": "How long after start the one after-start sync runs, so it does not compete with the first page load. Applies on restart.",
+        "type": "number",
+        "default": 30000,
+        "category": "brain",
+        "min": 0,
+        "max": 600000
+      },
       {
         "key": "vectorChunkTargetChars",
         "label": "Chunk Target Size (chars)",
@@ -819,6 +928,16 @@
         "min": 1000,
         "max": 300000
       },
+      {
+        "key": "brainWatchMaxFolders",
+        "label": "Watcher Folder Budget",
+        "description": "The most folders one source's live watch walks and watches on Linux, on this server and on a device; files cost nothing, and excluded trees such as node_modules and .git are never entered. The budget bounds this watcher's walk and its memory (about 2.5 KB per folder). The kernel's own watch memory is per distinct folder on the machine, shared by every source and host that watches it, and the machine limit (fs.inotify.max_user_watches) is the real floor: past it, or past the budget, the rest of the source is not watched, the Sources panel shows the live state as partial, and changes there arrive through the regular sync reconcile. macOS and Windows watch a whole source with one handle and ignore this value. A device clamps it to its own ceiling (200 000). Applies at the next watcher acquisition.",
+        "type": "number",
+        "default": 200000,
+        "category": "brain",
+        "min": 100,
+        "max": 1000000
+      },
       {
         "key": "brainSyncMaxIndexTextChars",
         "label": "Sync Max Index Text (chars)",
@@ -832,7 +951,7 @@
       {
         "key": "brainGrepContextConcurrency",
         "label": "Grep Context Read Concurrency",
-        "description": "How many context reads a grep search may have in flight at once. Raise it on a fast local disk, lower it when a slow connector (a webtop or host plane) is the bottleneck.",
+        "description": "How many context reads a grep search may have in flight at once. Raise it on a fast local disk, lower it when a slow connector (a webtop or device plane) is the bottleneck.",
         "type": "number",
         "default": 8,
         "category": "brain",
@@ -1000,12 +1119,12 @@
       {
         "key": "brainMaxReadFileMb",
         "label": "Max Read File Size (MB)",
-        "description": "Hard cap on connector file reads — larger files fail with 'File too large' for fs_read and every read-path consumer.",
+        "description": "The one ceiling of a whole-file read, the same for a folder on this server and on a paired device — larger files fail with 'File too large' for fs_read, the Files preview and every read-path consumer. A preview's ranged request (video seeking) moves at most 8 MB per answer whatever this says. Each whole read holds the file in memory once.",
         "type": "number",
-        "default": 20,
+        "default": 100,
         "category": "brain",
         "min": 1,
-        "max": 200
+        "max": 1024
       },
       {
         "key": "inlineImageMaxMb",
@@ -1052,7 +1171,7 @@
         "label": "Content Scan Timeout (ms)",
         "description": "Kill timeout for the grep/rg/git-grep child process behind fs_search grep mode; on timeout the search fails soft with 'Search timed out'.",
         "type": "number",
-        "default": 30000,
+        "default": 120000,
         "category": "brain",
         "min": 1000,
         "max": 300000
@@ -1060,7 +1179,7 @@
       {
         "key": "brainCountCacheTtlMs",
         "label": "File Count Cache TTL (ms)",
-        "description": "Cache TTL for connector file-count walks shown in the sources UI — a fresh walk at most once per TTL per root.",
+        "description": "Cache TTL for connector file-count walks shown in the sources UI — a fresh walk at most once per TTL per root; an older count is shown at once while one walk refreshes it.",
         "type": "number",
         "default": 60000,
         "category": "brain",
@@ -1120,7 +1239,7 @@
       {
         "key": "brainListConnectorConcurrency",
         "label": "List Connector Concurrency",
-        "description": "How many source connectors a single listing walks at once. Higher finishes a multi-source listing sooner; lower is gentler on slow mounts and remote APIs.",
+        "description": "How many source connectors a single listing walks (or counts) at once. Higher finishes a multi-source listing sooner; lower is gentler on slow mounts and remote APIs.",
         "type": "number",
         "default": 4,
         "category": "brain",
@@ -1330,7 +1449,7 @@
         "label": "Git Panel Timeout (ms)",
         "description": "Inactivity cap for the on-demand whole-repo status and branch list behind the git panel. Fails soft to an empty panel.",
         "type": "number",
-        "default": 5000,
+        "default": 15000,
         "category": "brain",
         "min": 1000,
         "max": 60000
@@ -1340,7 +1459,7 @@
         "label": "Git Heavy Timeout (ms)",
         "description": "Inactivity cap for heavy on-demand git readers: per-file diff, commit DAG, blob show. Caps silence, not wall-clock — streaming output resets it.",
         "type": "number",
-        "default": 15000,
+        "default": 60000,
         "category": "brain",
         "min": 2000,
         "max": 120000
@@ -1404,10 +1523,7 @@
             "permissions": {
               "read": true
             },
-            "roles": [
-              "owner",
-              "admin"
-            ],
+            "priority": 2,
             "override": true
           },
           {
@@ -1415,10 +1531,7 @@
             "permissions": {
               "read": true
             },
-            "roles": [
-              "owner",
-              "admin"
-            ],
+            "priority": 2,
             "override": true
           },
           {
@@ -1435,10 +1548,7 @@
               "read": true,
               "write": true
             },
-            "roles": [
-              "owner",
-              "admin"
-            ],
+            "priority": 2,
             "override": true
           }
         ]
@@ -1585,7 +1695,7 @@
         },
         "requires": {
           "features": [
-            "drive.read"
+            "files.read"
           ]
         },
         "notify": {
@@ -1659,7 +1769,7 @@
         },
         "requires": {
           "features": [
-            "drive.read"
+            "files.read"
           ]
         },
         "notify": {
@@ -1736,7 +1846,7 @@
         },
         "requires": {
           "features": [
-            "drive.read"
+            "files.read"
           ]
         },
         "notify": {
@@ -1810,7 +1920,7 @@
         },
         "requires": {
           "features": [
-            "drive.read"
+            "files.read"
           ]
         },
         "notify": {
@@ -1884,7 +1994,7 @@
         },
         "requires": {
           "features": [
-            "drive.read"
+            "files.read"
           ]
         },
         "notify": {
@@ -1949,7 +2059,7 @@
         },
         "requires": {
           "features": [
-            "drive.read"
+            "files.read"
           ]
         },
         "notify": {
@@ -2014,7 +2124,7 @@
         },
         "requires": {
           "features": [
-            "drive.read"
+            "files.read"
           ]
         },
         "notify": {
@@ -2053,7 +2163,7 @@
         },
         "requires": {
           "features": [
-            "drive.read"
+            "files.read"
           ]
         },
         "notify": {
@@ -2115,7 +2225,7 @@
         },
         "requires": {
           "features": [
-            "drive.read"
+            "files.read"
           ]
         },
         "notify": {
@@ -2168,7 +2278,7 @@
         },
         "requires": {
           "features": [
-            "drive.read"
+            "files.read"
           ]
         },
         "notify": {
@@ -2473,7 +2583,7 @@
       }
     ],
     "access": {
-      "trust": "first-party"
+      "trust": "native"
     },
     "app": {
       "module": {
@@ -2501,7 +2611,7 @@
               "filesystem"
             ],
             "features": [
-              "drive.read"
+              "files.read"
             ]
           },
           "layout": {
@@ -2520,6 +2630,7 @@
         {
           "kind": "dock",
           "id": "brain-core.filesystem",
+          "image": "app/shared/filesystem.png",
           "label": "Filesystem",
           "icon": "Folder",
           "color": "#60a5fa",
@@ -2552,20 +2663,6 @@
         }
       ]
     },
-    "resources": [
-      {
-        "uri": "neuralis://brain/welcome",
-        "name": "Brain — Overview & onboarding",
-        "description": "What Brain is, what it can do, tool reference, revert workflow, search modes, and the recommended workflow.",
-        "mimeType": "text/markdown"
-      },
-      {
-        "uri": "neuralis://brain/agent",
-        "name": "Brain Agent — Filesystem & tools for your role",
-        "description": "Role-focused guidance for using the filesystem tools, search modes, modify actions, and revert workflow.",
-        "mimeType": "text/markdown"
-      }
-    ],
     "meta": {
       "hosts": [
         "v1-server",
@@ -2586,6 +2683,7 @@
     "postbuild": "node scripts/copyContracts.mjs",
     "build:ui": "neuralis-build ui",
     "typecheck:app": "tsc -p app/tsconfig.json",
+    "typecheck:test": "tsc -p test/tsconfig.json",
     "test": "vitest run"
   }
 }