@siduri-x/api 1.0.5 → 2.0.1

package/.turbo/turbo-build.log

@@ -0,0 +1,4 @@
+
+> @siduri-x/api@2.0.1 build /home/zagin/Projects/vxnus-studio/projects/siduri-x/apps/api
+> tsc
+

package/.turbo/turbo-test.log

@@ -0,0 +1,40 @@
+
+> @siduri-x/api@2.0.1 test /home/zagin/Projects/vxnus-studio/projects/siduri-x/apps/api
+> jest --config jest.config.json
+
+PASS src/context-mapper.test.ts (10.14 s)
+PASS src/runtime.test.ts (10.545 s)
+  ● Console
+
+    console.error
+      [SiduriRuntime] Knowledge search failed: E-Teyvat is down
+
+      21 |         extKnowledge && shouldQueryKnowledge && typeof extKnowledge.search === 'function'
+      22 |             ? extKnowledge.search(perceivedText).catch((e) => {
+    > 23 |                 console.error('[SiduriRuntime] Knowledge search failed:', e.message);
+         |                         ^
+      24 |                 subsystemDiagnostics['knowledge'] = `UNAVAILABLE: ${e.message}`;
+      25 |                 return [];
+      26 |             })
+
+      at ../../packages/core/dist/context-retriever.js:23:25
+          at async Promise.all (index 0)
+      at retrieveRuntimeContext (../../packages/core/dist/context-retriever.js:19:78)
+      at SiduriRuntime.processPerception (../../packages/core/dist/runtime.js:253:34)
+      at Object.<anonymous> (src/runtime.test.ts:74:22)
+
+PASS src/index.test.ts (10.888 s)
+PASS src/auth.test.ts
+PASS src/smoke.test.ts
+PASS src/t4-gating.test.ts (11.522 s)
+PASS src/b0-b6.test.ts
+PASS src/t5-experience.test.ts (11.592 s)
+PASS src/t7-release.test.ts (11.335 s)
+PASS src/teach-mode.test.ts
+PASS src/t6-security.test.ts (12.22 s)
+
+Test Suites: 11 passed, 11 total
+Tests:       72 passed, 72 total
+Snapshots:   0 total
+Time:        15.203 s, estimated 16 s
+Ran all test suites.

package/dist/app.d.ts

@@ -1,7 +1,7 @@
 import { Express } from 'express';
 import { SiduriRuntime } from './runtime';
 import { VoiceConfig } from '@siduri-x/voice';
-import { EKnowledgeConfig } from '@siduri-x/knowledge';
+import { EKnowledgeConfig } from '@siduri-x/eknowledge';
 import { OpenRouterVisionConfig } from '@siduri-x/vision';
 import { Live2DAdapterConfig } from '@siduri-x/body';
 import { FixtureObservationOrgan } from '@siduri-x/observation';

package/dist/app.js

@@ -11,9 +11,9 @@ const runtime_1 = require("./runtime");
 const brain_1 = require("@siduri-x/brain");
 const memory_1 = require("@siduri-x/memory");
 const voice_1 = require("@siduri-x/voice");
-const knowledge_1 = require("@siduri-x/knowledge");
+const eknowledge_1 = require("@siduri-x/eknowledge");
 const vision_1 = require("@siduri-x/vision");
-const behavior_1 = require("@siduri-x/behavior");
+const self_1 = require("@siduri-x/self");
 const body_1 = require("@siduri-x/body");
 const hands_1 = require("@siduri-x/hands");
 const ear_1 = require("@siduri-x/ear");
@@ -52,7 +52,7 @@ function createApp(runtimes = new Map()) {
             });
     }
     function createKnowledge(config) {
-        return isDisabled(config) ? undefined : new knowledge_1.EKnowledgeAdapter(config || {});
+        return isDisabled(config) ? undefined : new eknowledge_1.EKnowledgeAdapter(config || {});
     }
     function createVision(config) {
         return isDisabled(config)
@@ -64,7 +64,7 @@ function createApp(runtimes = new Map()) {
             });
     }
     function createBehavior(config) {
-        return isDisabled(config) ? undefined : new behavior_1.ActiveSelfCompiler();
+        return isDisabled(config) ? undefined : new self_1.ActiveSelfCompiler();
     }
     function createBody(config) {
         return isDisabled(config)
@@ -92,16 +92,18 @@ function createApp(runtimes = new Map()) {
             if (runtimes.has(id)) {
                 return res.status(400).json({ error: "Already booted" });
             }
-            const brain = createBrain(config.brain);
-            const memory = new memory_1.PostgresMemoryOrgan({ connectionString: process.env.DATABASE_URL || 'postgresql://postgres:postgres@localhost:5432/siduri' });
-            const voice = createVoice(config.voice);
-            const knowledge = createKnowledge(config.knowledge);
-            const vision = createVision(config.vision);
-            const behavior = createBehavior(config.behavior);
-            const body = createBody(config.body);
-            const hands = createHands(config.hands);
-            const ear = createEar(config.ear);
-            const mouth = createMouth(config.mouth, voice);
+            const organs = config?.organs || {};
+            const brain = createBrain(organs.brain || config?.brain);
+            const memory = new memory_1.SqliteMemoryStore({ dbPath: process.env.STORAGE_PATH || process.env.SQLITE_DB_PATH || 'siduri.sqlite' });
+            const selfRepo = new self_1.SqliteSelfRepository({ dbPath: process.env.STORAGE_PATH || process.env.SQLITE_DB_PATH || 'siduri.sqlite' });
+            const voice = createVoice(organs.voice || config?.voice);
+            const knowledge = createKnowledge(organs.knowledge || config?.knowledge);
+            const vision = createVision(organs.vision || config?.vision);
+            const behavior = createBehavior(organs.behavior || config?.behavior);
+            const body = createBody(organs.body || config?.body);
+            const hands = createHands(organs.hands || config?.hands);
+            const ear = createEar(organs.ear || config?.ear);
+            const mouth = createMouth(organs.mouth || config?.mouth, voice);
             const runtime = new runtime_1.SiduriRuntime(id, config, {
                 brain,
                 memory,
@@ -114,6 +116,8 @@ function createApp(runtimes = new Map()) {
                 ear,
                 mouth,
                 observation: observationOrgan,
+                self: selfRepo,
+                externalKnowledge: knowledge,
             });
             await runtime.initialize();
             runtimes.set(id, runtime);
@@ -162,6 +166,67 @@ function createApp(runtimes = new Map()) {
         });
     });
     app.put('/me', auth_1.requireAuth, (req, res) => res.json({ success: true }));
+    // TEACH MODE ENDPOINTS
+    app.post('/teach/upload-self', auth_1.requireAuth, async (req, res) => {
+        try {
+            const { content } = req.body;
+            if (!content)
+                return res.status(400).json({ error: "Missing content" });
+            const parsed = self_1.SelfPackageParser.parse(content);
+            res.json(parsed);
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
+    app.post('/teach/install-self', auth_1.requireAuth, async (req, res) => {
+        try {
+            const { companionId, manifest, approvedDirectiveIds } = req.body;
+            if (!companionId || !manifest || !Array.isArray(approvedDirectiveIds)) {
+                return res.status(400).json({ error: "Missing required fields" });
+            }
+            if (!manifest.identity || !manifest.identity.name) {
+                return res.status(400).json({ error: "Invalid manifest: missing identity.name" });
+            }
+            const directivesToCommit = manifest.directives?.filter((d) => approvedDirectiveIds.includes(d.id)) || [];
+            for (const d of directivesToCommit) {
+                if (!d || typeof d.directive !== 'string') {
+                    return res.status(400).json({ error: "Invalid directive entry: missing directive string" });
+                }
+                const scan = (0, self_1.scanDirective)(d.directive);
+                if (!scan.safe) {
+                    return res.status(400).json({
+                        error: `Safety check failed for directive: ${scan.reason}`,
+                        directiveId: d.id,
+                        reason: scan.reason,
+                    });
+                }
+            }
+            const repo = new self_1.SqliteSelfRepository({ dbPath: process.env.STORAGE_PATH || process.env.SQLITE_DB_PATH || 'siduri.sqlite' });
+            try {
+                await repo.setIdentity({
+                    companionId,
+                    name: manifest.identity.name,
+                    archetype: manifest.identity.archetype,
+                    version: manifest.version || '1.0.0',
+                    updatedAt: new Date().toISOString(),
+                });
+                if (manifest.personality) {
+                    await repo.setPersonality(companionId, manifest.personality);
+                }
+                if (directivesToCommit.length > 0) {
+                    await repo.commitDirectives(companionId, directivesToCommit);
+                }
+            }
+            finally {
+                repo.close();
+            }
+            res.json({ success: true });
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
     // CHAT (API context boundary validation)
     app.post('/chat', auth_1.attachIdentity, async (req, res) => {
         const { id, message, history } = req.body;
@@ -247,7 +312,9 @@ function createApp(runtimes = new Map()) {
             if (avatarEvent) {
                 res.write(`event: avatar\ndata: ${JSON.stringify(avatarEvent)}\n\n`);
             }
-            const speechText = response.delivery?.text || response.response?.subtitle_en || response.response?.spoken_ja || '';
+            const maxStreamLen = Number(process.env.SIDURI_MAX_RESPONSE_CHARS || 8000);
+            const rawSpeechText = response.delivery?.text || response.response?.subtitle_en || response.response?.spoken_ja || '';
+            const speechText = rawSpeechText.slice(0, maxStreamLen);
             const utterance = {
                 utteranceId: response.response_id || 'utt-stream',
                 companionId,

package/dist/b0-b6.test.js

@@ -41,7 +41,7 @@ describe('T0 B0 & B6 Runtime Proof Suite', () => {
         const config = {
             name: 'NeutralCompanion',
             brain: { provider: 'openrouter' },
-            memory: { provider: 'postgres' },
+            memory: { provider: 'sqlite' },
             knowledge: { provider: 'e-knowledge' },
             behavior: { provider: 'active-self' },
             voice: { provider: 'none' },

package/dist/context-mapper.js

@@ -57,15 +57,25 @@ function mapRequestContext(input, options = {}) {
                 },
             };
         }
+        // Determine server-enforced authentication status
+        const isAuthenticated = input.authenticated !== undefined
+            ? Boolean(input.authenticated)
+            : (actor.authenticated !== undefined ? Boolean(actor.authenticated) : true);
+        const safeCapabilities = isAuthenticated
+            ? (Array.isArray(actor.capabilities) ? actor.capabilities : ['chat'])
+            : ['chat'];
+        const safeRole = isAuthenticated
+            ? actor.authorizationRole
+            : 'viewer';
         const constructed = {
             companionId,
             actor: {
+                ...actor,
                 actorId: actor.actorId,
                 sessionId: actor.sessionId,
-                capabilities: Array.isArray(actor.capabilities) ? actor.capabilities : ['chat'],
-                authenticated: actor.authenticated !== undefined ? Boolean(actor.authenticated) : true,
-                authorizationRole: actor.authorizationRole,
-                ...actor,
+                capabilities: safeCapabilities,
+                authenticated: isAuthenticated,
+                authorizationRole: safeRole,
             },
             conversation: {
                 correlationId,
@@ -73,7 +83,7 @@ function mapRequestContext(input, options = {}) {
                 isLive: rawCtx.conversation?.isLive,
                 ...rawCtx.conversation,
             },
-            source: input.source || rawCtx.source || 'local',
+            source: input.source || rawCtx.source || (isAuthenticated ? 'local' : 'external'),
             subject: rawCtx.subject,
         };
         const validated = (0, core_1.validateRequestContext)(constructed);
@@ -127,25 +137,28 @@ function mapRequestContext(input, options = {}) {
     if (!input.actorId && !input.actor?.actorId) {
         diagnostics.push('anonymous_session_generated');
     }
-    const capabilities = Array.isArray(input.capabilities)
-        ? input.capabilities
-        : Array.isArray(input.actor?.capabilities)
-            ? input.actor.capabilities
-            : ['chat', 'system'];
+    const isAuthenticated = input.authenticated !== undefined ? Boolean(input.authenticated) : true;
+    const capabilities = isAuthenticated
+        ? (Array.isArray(input.capabilities)
+            ? input.capabilities
+            : Array.isArray(input.actor?.capabilities)
+                ? input.actor.capabilities
+                : ['chat', 'system'])
+        : ['chat'];
     const mappedContext = {
         companionId,
         actor: {
             actorId,
             sessionId,
             capabilities,
-            authenticated: input.authenticated !== undefined ? Boolean(input.authenticated) : true,
+            authenticated: isAuthenticated,
             authorizationRole: input.role ? (input.role.toLowerCase() === 'viewer' ? 'viewer' : 'administrator') : undefined,
         },
         conversation: {
             channel: input.channel || input.conversation?.channel || 'direct',
             correlationId,
         },
-        source: input.source || 'local',
+        source: input.source || (isAuthenticated ? 'local' : 'external'),
         subject: input.subject,
     };
     const validated = (0, core_1.validateRequestContext)(mappedContext);

package/dist/context-mapper.test.js

@@ -133,4 +133,29 @@ describe('API Request Context Mapper (Single-Owner, Single-Machine)', () => {
         expect(result.accepted).toBe(true);
         expect(result.context?.conversation.correlationId).toMatch(/^corr-/);
     });
+    test('Overrides forged client actor authentication and caps capabilities on unauthenticated requests', () => {
+        const forgedInput = {
+            companionId: 'companion-a',
+            authenticated: false, // Server detected unauthenticated request
+            source: 'external',
+            context: {
+                actor: {
+                    actorId: 'attacker',
+                    sessionId: 'session-att',
+                    authenticated: true, // Forged
+                    capabilities: ['system:exec', 'bash', 'chat'], // Forged elevated capabilities
+                    authorizationRole: 'OWNER', // Forged role
+                },
+                conversation: {
+                    correlationId: 'corr-forged-1',
+                },
+            },
+        };
+        const result = (0, context_mapper_1.mapRequestContext)(forgedInput);
+        expect(result.accepted).toBe(true);
+        expect(result.context?.actor.authenticated).toBe(false);
+        expect(result.context?.actor.capabilities).toEqual(['chat']);
+        expect(result.context?.actor.authorizationRole).toBe('viewer');
+        expect(result.context?.source).toBe('external');
+    });
 });

package/dist/index.js

@@ -18,6 +18,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.app = exports.createApp = void 0;
+const dotenv_1 = __importDefault(require("dotenv"));
+dotenv_1.default.config();
 const promises_1 = require("node:fs/promises");
 const node_path_1 = __importDefault(require("node:path"));
 const app_1 = require("./app");
@@ -26,9 +28,9 @@ const runtime_1 = require("./runtime");
 const brain_1 = require("@siduri-x/brain");
 const memory_1 = require("@siduri-x/memory");
 const voice_1 = require("@siduri-x/voice");
-const knowledge_1 = require("@siduri-x/knowledge");
+const eknowledge_1 = require("@siduri-x/eknowledge");
 const vision_1 = require("@siduri-x/vision");
-const behavior_1 = require("@siduri-x/behavior");
+const self_1 = require("@siduri-x/self");
 const body_1 = require("@siduri-x/body");
 const observation_1 = require("@siduri-x/observation");
 __exportStar(require("./context-mapper"), exports);
@@ -68,7 +70,7 @@ function createKnowledge(config) {
     if (!config?.packPath && !config?.registryUrl && !config?.baseUrl) {
         return undefined;
     }
-    return new knowledge_1.EKnowledgeAdapter(config || {});
+    return new eknowledge_1.EKnowledgeAdapter(config || {});
 }
 function createVision(config) {
     return isDisabled(config)
@@ -80,7 +82,7 @@ function createVision(config) {
         });
 }
 function createBehavior(config) {
-    return isDisabled(config) ? undefined : new behavior_1.ActiveSelfCompiler();
+    return isDisabled(config) ? undefined : new self_1.ActiveSelfCompiler();
 }
 function createBody(config) {
     return isDisabled(config)
@@ -90,15 +92,7 @@ function createBody(config) {
 function createMemory(config) {
     if (isDisabled(config))
         return undefined;
-    const provider = config?.provider || 'postgres';
-    if (provider === 'in-memory') {
-        return new memory_1.InMemoryMemoryOrgan();
-    }
-    if (provider === 'postgres') {
-        const connectionString = config?.connectionString || process.env.DATABASE_URL || 'postgresql://postgres:postgres@localhost:5432/siduri';
-        return new memory_1.PostgresMemoryOrgan({ connectionString, maxConnections: config?.maxConnections });
-    }
-    return undefined;
+    return new memory_1.SqliteMemoryStore({ dbPath: config?.dbPath || process.env.STORAGE_PATH || process.env.SQLITE_DB_PATH || 'siduri.sqlite' });
 }
 const PORT = process.env.PORT || 3001;
 const defaultCompanionConfig = {
@@ -106,7 +100,7 @@ const defaultCompanionConfig = {
     name: 'Siduri',
     brain: { provider: 'openrouter', model: 'gpt-4o-mini' },
     voice: { provider: 'voicevox', speakerId: 1 },
-    memory: { provider: 'postgres' },
+    memory: { provider: 'sqlite' },
     knowledge: {
         provider: process.env.SIDURI_KNOWLEDGE_PROVIDER || 'e-knowledge',
         packPath: process.env.SIDURI_KNOWLEDGE_PACK || '',
@@ -169,12 +163,23 @@ async function bootDefaultCompanion() {
     const vision = createVision(config.vision);
     const observation = new observation_1.FixtureObservationOrgan(vision ?? { analyze: async () => JSON.stringify({ readings: [] }) });
     instance.setObservationOrgan(observation);
+    const selfRepo = new self_1.SqliteSelfRepository({ dbPath: process.env.STORAGE_PATH || process.env.SQLITE_DB_PATH || 'siduri.sqlite' });
     const behavior = createBehavior(config.behavior);
     const body = createBody(config.body);
     if (memory && typeof memory.runMigrations === 'function') {
         await memory.runMigrations().catch((e) => console.warn("Migrations warning:", e.message));
     }
-    const runtime = new runtime_1.SiduriRuntime('default', config, { brain, memory, voice, knowledge, vision, behavior, body });
+    const runtime = new runtime_1.SiduriRuntime('default', config, {
+        brain,
+        memory,
+        voice,
+        knowledge,
+        vision,
+        behavior,
+        body,
+        self: selfRepo,
+        externalKnowledge: knowledge
+    });
     await runtime.initialize();
     runtimes.set('default', runtime);
     console.log("Default companion booted successfully.");

package/dist/t4-gating.test.js

@@ -54,7 +54,7 @@ describe('T4 Response Gating and Staged Approval Integration Suite', () => {
         const config = {
             name: 'NeutralCompanion',
             brain: { provider: 'openrouter' },
-            memory: { provider: 'postgres' },
+            memory: { provider: 'sqlite' },
             knowledge: { provider: 'e-knowledge' },
             behavior: { provider: 'active-self' },
             voice: { provider: 'voicevox' },

package/dist/t5-experience.test.js

@@ -60,7 +60,7 @@ describe('T5 Experience Event and Output Adapters Suite', () => {
         const config = {
             name: 'NeutralCompanion',
             brain: { provider: 'openrouter' },
-            memory: { provider: 'postgres' },
+            memory: { provider: 'sqlite' },
             knowledge: { provider: 'e-knowledge' },
             behavior: { provider: 'active-self' },
             voice: { provider: 'voicevox' },

package/dist/t6-security.test.js

@@ -6,7 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const supertest_1 = __importDefault(require("supertest"));
 const app_1 = require("./app");
 const runtime_1 = require("./runtime");
-const behavior_1 = require("@siduri-x/behavior");
+const self_1 = require("@siduri-x/self");
 describe('T6 Security & Operations Threat Model Suite', () => {
     let mockBrain;
     let mockMemory;
@@ -34,7 +34,7 @@ describe('T6 Security & Operations Threat Model Suite', () => {
             rejectClaim: jest.fn().mockResolvedValue(undefined),
         };
         mockKnowledge = { search: jest.fn().mockResolvedValue([]) };
-        const behaviorCompiler = new behavior_1.ActiveSelfCompiler();
+        const behaviorCompiler = new self_1.ActiveSelfCompiler();
         mockBehavior = {
             compile: jest.fn().mockImplementation(async (ctx) => behaviorCompiler.compile(ctx)),
         };
@@ -49,7 +49,7 @@ describe('T6 Security & Operations Threat Model Suite', () => {
         const config = {
             name: 'CompanionSec',
             brain: { provider: 'openrouter' },
-            memory: { provider: 'postgres' },
+            memory: { provider: 'sqlite' },
             knowledge: { provider: 'none' },
             behavior: { provider: 'active-self' },
             voice: { provider: 'voicevox' },
@@ -232,6 +232,69 @@ describe('T6 Security & Operations Threat Model Suite', () => {
         expect(actionResults[0].lifecycle).toBe('REJECTED');
         expect(actionResults[0].error).toContain('rejected by policy');
     });
+    test('Action Boundary: ActionPolicyEngine rejects unauthorized approver from approving critical tools', async () => {
+        runtimeA.actionPolicy.registerToolDefinition({
+            name: 'admin/delete_cluster',
+            providerId: 'admin',
+            description: 'Delete cluster',
+            inputSchema: {},
+            riskLevel: 'CRITICAL',
+            allowedRoles: ['administrator'],
+            requiresApproval: true,
+        });
+        const action = {
+            actionId: 'act-crit-1',
+            toolName: 'admin/delete_cluster',
+            parameters: {},
+            context: {
+                companionId: 'companion-a',
+                actor: {
+                    actorId: 'admin-user',
+                    sessionId: 'sess-1',
+                    authorizationRole: 'administrator',
+                    capabilities: ['admin:delete'],
+                    authenticated: true,
+                },
+                conversation: { channel: 'direct', correlationId: 'corr-1' },
+            },
+            executionId: 'exec-crit-1',
+        };
+        // 1. Unapproved action evaluation fails
+        const eval1 = await runtimeA.actionPolicy.evaluateAction(action);
+        expect(eval1.decision.allowed).toBe(false);
+        expect(eval1.decision.decisionCode).toBe('REJECTED_HIGH_RISK_UNAPPROVED');
+        // 2. Viewer attempt to approve is rejected
+        const viewerApproval = await runtimeA.approveAction({
+            executionId: 'exec-crit-1',
+            approverActorId: 'viewer-attacker',
+            approverRole: 'viewer',
+        });
+        expect(viewerApproval.approved).toBe(false);
+        expect(viewerApproval.decisionCode).toBe('REJECTED_UNAUTHORIZED');
+        // 3. Operator attempt to approve administrator tool is rejected (role mismatch)
+        const operatorApproval = await runtimeA.approveAction({
+            executionId: 'exec-crit-1',
+            approverActorId: 'operator-alice',
+            approverRole: 'operator',
+        });
+        expect(operatorApproval.approved).toBe(false);
+        expect(operatorApproval.decisionCode).toBe('REJECTED_ROLE_MISMATCH');
+        // 4. Action evaluation remains denied
+        const evalStillDenied = await runtimeA.actionPolicy.evaluateAction(action);
+        expect(evalStillDenied.decision.allowed).toBe(false);
+        // 5. Authorized administrator approval succeeds
+        const adminApproval = await runtimeA.approveAction({
+            executionId: 'exec-crit-1',
+            approverActorId: 'admin-super',
+            approverRole: 'administrator',
+        });
+        expect(adminApproval.approved).toBe(true);
+        expect(adminApproval.decisionCode).toBe('APPROVED');
+        // 6. Action evaluation now succeeds and issues capability
+        const evalAllowed = await runtimeA.actionPolicy.evaluateAction(action);
+        expect(evalAllowed.decision.allowed).toBe(true);
+        expect(evalAllowed.capability).toBeDefined();
+    });
     test('Adversarial Boundary: Hostile prompt directive in Behavior is quarantined and does not execute tools', async () => {
         // Unsafe directive in memory
         mockMemory.getDirectives.mockResolvedValueOnce([

package/dist/t7-release.test.js

@@ -54,7 +54,7 @@ describe('T7 Release Readiness End-to-End Verification Suite', () => {
         const config = {
             name: 'NeutralCompanion',
             brain: { provider: 'openrouter' },
-            memory: { provider: 'postgres' },
+            memory: { provider: 'sqlite' },
             knowledge: { provider: 'e-knowledge' },
             behavior: { provider: 'active-self' },
             voice: { provider: 'voicevox' },

package/dist/teach-mode.test.d.ts

@@ -0,0 +1 @@
+export {};