@vxnus/siduri 0.1.5 → 0.1.7

package/dist/builtin-manifests.js

@@ -5,7 +5,7 @@ exports.BUILTIN_ORGAN_MANIFESTS = [
     {
         name: '@siduri-x/behavior',
         organType: 'behavior',
-        version: '1.0.2',
+        version: '1.0.5',
         displayName: 'Behavior (Active Self Directives)',
         description: 'Atomic directive state machine and personality projection compiler',
         entrypoint: './dist/index.js',
@@ -66,7 +66,7 @@ exports.BUILTIN_ORGAN_MANIFESTS = [
     {
         name: '@siduri-x/brain',
         organType: 'brain',
-        version: '1.0.2',
+        version: '1.0.3',
         displayName: 'Brain (Cognition & Planning)',
         description: 'Provider-neutral LLM reasoning, response planning, and proposal generation',
         entrypoint: './dist/index.js',
@@ -272,7 +272,7 @@ exports.BUILTIN_ORGAN_MANIFESTS = [
     {
         name: '@siduri-x/memory',
         organType: 'memory',
-        version: '1.0.2',
+        version: '1.0.3',
         displayName: 'Memory (PostgreSQL FTS Claims)',
         description: 'Relational semantic claims with Full-Text Search and companion isolation',
         entrypoint: './dist/index.js',
@@ -389,7 +389,7 @@ exports.BUILTIN_ORGAN_MANIFESTS = [
     {
         name: '@siduri-x/voice',
         organType: 'voice',
-        version: '1.0.3',
+        version: '1.0.5',
         displayName: 'Voice (VOICEVOX Speech Synthesis)',
         description: 'Queued speech synthesis and audio rendering lifecycle adapter',
         entrypoint: './dist/index.js',

package/dist/clean-machine-e2e.test.js

@@ -13,18 +13,18 @@ describe('Phase 5: Clean-Machine Distribution & E2E Integration Suite', () => {
     const tempPackDir = node_path_1.default.resolve(__dirname, '../temp-packs-e2e');
     const cleanMachineRoot = node_path_1.default.resolve(__dirname, '../temp-clean-machine-e2e');
     const ALL_CANONICAL_PACKAGES = [
-        { filter: '@siduri-x/core', tarName: 'siduri-x-core-1.0.2.tgz', isOrgan: false },
-        { filter: '@siduri-x/brain', tarName: 'siduri-x-brain-1.0.2.tgz', isOrgan: true },
-        { filter: '@siduri-x/memory', tarName: 'siduri-x-memory-1.0.2.tgz', isOrgan: true },
+        { filter: '@siduri-x/core', tarName: 'siduri-x-core-1.0.4.tgz', isOrgan: false },
+        { filter: '@siduri-x/brain', tarName: 'siduri-x-brain-1.0.3.tgz', isOrgan: true },
+        { filter: '@siduri-x/memory', tarName: 'siduri-x-memory-1.0.3.tgz', isOrgan: true },
         { filter: '@siduri-x/knowledge', tarName: 'siduri-x-knowledge-1.0.2.tgz', isOrgan: true },
-        { filter: '@siduri-x/behavior', tarName: 'siduri-x-behavior-1.0.2.tgz', isOrgan: true },
+        { filter: '@siduri-x/behavior', tarName: 'siduri-x-behavior-1.0.5.tgz', isOrgan: true },
         { filter: '@siduri-x/ear', tarName: 'siduri-x-ear-1.0.2.tgz', isOrgan: true },
         { filter: '@siduri-x/vision', tarName: 'siduri-x-vision-1.0.2.tgz', isOrgan: true },
         { filter: '@siduri-x/hands', tarName: 'siduri-x-hands-1.0.2.tgz', isOrgan: true },
         { filter: '@siduri-x/body', tarName: 'siduri-x-body-1.0.4.tgz', isOrgan: true },
-        { filter: '@siduri-x/voice', tarName: 'siduri-x-voice-1.0.3.tgz', isOrgan: true },
+        { filter: '@siduri-x/voice', tarName: 'siduri-x-voice-1.0.5.tgz', isOrgan: true },
         { filter: '@siduri-x/observation', tarName: 'siduri-x-observation-1.0.2.tgz', isOrgan: true },
-        { filter: '@vxnus/siduri', tarName: 'vxnus-siduri-0.1.5.tgz', isOrgan: false },
+        { filter: '@vxnus/siduri', tarName: 'vxnus-siduri-0.1.7.tgz', isOrgan: false },
     ];
     beforeAll(() => {
         // 1. Prepare clean directories
@@ -86,7 +86,7 @@ describe('Phase 5: Clean-Machine Distribution & E2E Integration Suite', () => {
             }
         });
         test('memory organ tarball packages migrations/001_initial_schema.sql', () => {
-            const memoryTarPath = node_path_1.default.join(tempPackDir, 'siduri-x-memory-1.0.2.tgz');
+            const memoryTarPath = node_path_1.default.join(tempPackDir, 'siduri-x-memory-1.0.3.tgz');
             const listing = (0, node_child_process_1.execSync)(`tar -tzf ${memoryTarPath}`, { encoding: 'utf8' });
             expect(listing).toContain('package/migrations/001_initial_schema.sql');
         });
@@ -106,8 +106,8 @@ describe('Phase 5: Clean-Machine Distribution & E2E Integration Suite', () => {
             // Write instance files referencing packed tarballs directly for true clean machine install
             const pkgObj = JSON.parse(files['package.json']);
             pkgObj.dependencies = {
-                '@siduri-x/core': `file:${node_path_1.default.join(tempPackDir, 'siduri-x-core-1.0.2.tgz')}`,
-                '@siduri-x/brain': `file:${node_path_1.default.join(tempPackDir, 'siduri-x-brain-1.0.2.tgz')}`,
+                '@siduri-x/core': `file:${node_path_1.default.join(tempPackDir, 'siduri-x-core-1.0.4.tgz')}`,
+                '@siduri-x/brain': `file:${node_path_1.default.join(tempPackDir, 'siduri-x-brain-1.0.3.tgz')}`,
             };
             node_fs_1.default.writeFileSync(node_path_1.default.join(instanceDir, 'package.json'), JSON.stringify(pkgObj, null, 2) + '\n');
             node_fs_1.default.writeFileSync(node_path_1.default.join(instanceDir, 'siduri.config.json'), files['siduri.config.json']);
@@ -154,8 +154,8 @@ describe('Phase 5: Clean-Machine Distribution & E2E Integration Suite', () => {
             });
             const pkgObj = JSON.parse(files['package.json']);
             pkgObj.dependencies = {
-                '@siduri-x/core': `file:${node_path_1.default.join(tempPackDir, 'siduri-x-core-1.0.2.tgz')}`,
-                '@siduri-x/brain': `file:${node_path_1.default.join(tempPackDir, 'siduri-x-brain-1.0.2.tgz')}`,
+                '@siduri-x/core': `file:${node_path_1.default.join(tempPackDir, 'siduri-x-core-1.0.4.tgz')}`,
+                '@siduri-x/brain': `file:${node_path_1.default.join(tempPackDir, 'siduri-x-brain-1.0.3.tgz')}`,
                 '@siduri-x/hands': `file:${node_path_1.default.join(tempPackDir, 'siduri-x-hands-1.0.2.tgz')}`,
             };
             node_fs_1.default.writeFileSync(node_path_1.default.join(instanceDir, 'package.json'), JSON.stringify(pkgObj, null, 2) + '\n');
@@ -193,9 +193,9 @@ describe('Phase 5: Clean-Machine Distribution & E2E Integration Suite', () => {
             });
             const pkgObj = JSON.parse(files['package.json']);
             pkgObj.dependencies = {
-                '@siduri-x/core': `file:${node_path_1.default.join(tempPackDir, 'siduri-x-core-1.0.2.tgz')}`,
-                '@siduri-x/brain': `file:${node_path_1.default.join(tempPackDir, 'siduri-x-brain-1.0.2.tgz')}`,
-                '@siduri-x/memory': `file:${node_path_1.default.join(tempPackDir, 'siduri-x-memory-1.0.2.tgz')}`,
+                '@siduri-x/core': `file:${node_path_1.default.join(tempPackDir, 'siduri-x-core-1.0.4.tgz')}`,
+                '@siduri-x/brain': `file:${node_path_1.default.join(tempPackDir, 'siduri-x-brain-1.0.3.tgz')}`,
+                '@siduri-x/memory': `file:${node_path_1.default.join(tempPackDir, 'siduri-x-memory-1.0.3.tgz')}`,
             };
             node_fs_1.default.writeFileSync(node_path_1.default.join(instanceDir, 'package.json'), JSON.stringify(pkgObj, null, 2) + '\n');
             node_fs_1.default.writeFileSync(node_path_1.default.join(instanceDir, 'siduri.config.json'), files['siduri.config.json']);

package/dist/configurators/voice.js

@@ -61,10 +61,15 @@ async function configureVoice(_context) {
                 default: 'rmvpe',
             },
             {
-                type: 'input',
-                name: 'baseUrl',
-                message: 'Base TTS Synthesis Engine URL (VOICEVOX):',
-                default: 'http://localhost:50021',
+                type: 'list',
+                name: 'baseTts',
+                message: 'Base TTS Engine for RVC (Generates initial audio):',
+                choices: [
+                    { name: 'Edge-TTS (Cloud API, 0MB)', value: 'edge-tts' },
+                    { name: 'Kokoro TTS (Local, ~80MB)', value: 'kokoro' },
+                    { name: 'Piper TTS (Local, ~20MB)', value: 'piper' },
+                ],
+                default: 'edge-tts',
             },
             {
                 type: 'input',
@@ -75,9 +80,7 @@ async function configureVoice(_context) {
         ]);
         const pitchShift = parseInt(rvcAnswers.pitchShift, 10) || 0;
         const config = {
-            provider: 'voicevox',
-            baseUrl: rvcAnswers.baseUrl.trim(),
-            speakerId: 1,
+            provider: rvcAnswers.baseTts,
             maxQueueDepth: 50,
             rvc: {
                 enabled: true,
@@ -92,11 +95,11 @@ async function configureVoice(_context) {
         };
         const summary = {
             Provider: 'RVC (Custom Voice Model)',
+            'Base TTS': rvcAnswers.baseTts,
             'Model Path': rvcAnswers.modelPath.trim(),
             'Pitch Shift': pitchShift,
             'F0 Method': rvcAnswers.f0Method,
             'RVC Service': rvcAnswers.serviceUrl.trim(),
-            'Base TTS': rvcAnswers.baseUrl.trim(),
         };
         return {
             config,

package/dist/configurators.test.js

@@ -198,6 +198,23 @@ describe('Guided Manifest-Driven Configuration UX Specification Tests', () => {
             expect(result.config.speakerId).toBe(2);
             expect(result.summary?.['Speaker ID']).toBe(2);
         });
+        test('Voice configurator configures RVC with Base TTS Engine', async () => {
+            inquirer_1.default.prompt
+                .mockResolvedValueOnce({ provider: 'rvc' })
+                .mockResolvedValueOnce({
+                modelPath: './assets/voice/sparkle/sparkle.pth',
+                indexPath: './assets/voice/sparkle/sparkle.index',
+                pitchShift: '12',
+                f0Method: 'rmvpe',
+                baseTts: 'edge-tts',
+                serviceUrl: 'http://localhost:50055',
+            });
+            const result = await (0, voice_1.configureVoice)({ companionName: 'Sparkle', manifest: voiceManifest });
+            expect(result.config.provider).toBe('edge-tts');
+            expect(result.config.rvc.enabled).toBe(true);
+            expect(result.config.rvc.pitchShift).toBe(12);
+            expect(result.summary?.['Base TTS']).toBe('edge-tts');
+        });
         test('Body configurator configures Live2D, custom model path, and expression', async () => {
             inquirer_1.default.prompt
                 .mockResolvedValueOnce({ provider: 'live2d' })
@@ -276,7 +293,7 @@ describe('Guided Manifest-Driven Configuration UX Specification Tests', () => {
             expect(files['src/index.js']).toContain("import { OpenRouterBrain } from '@siduri-x/brain'");
             expect(files['src/index.js']).toContain("import { PostgresMemoryOrgan } from '@siduri-x/memory'");
             expect(files['src/index.js']).toContain("import { EKnowledgeAdapter } from '@siduri-x/knowledge'");
-            expect(files['src/index.js']).toContain("import { VoicevoxAdapter } from '@siduri-x/voice'");
+            expect(files['src/index.js']).toContain("import { VoiceAdapter } from '@siduri-x/voice'");
         });
     });
 });

package/dist/generator.js

@@ -68,7 +68,7 @@ function getDefaultConfigForManifest(manifest) {
 function generateInstanceFiles(options) {
     const instanceName = options.name || 'my-siduri';
     const instanceId = options.id || 'default';
-    const coreVersion = options.coreVersion || '^1.0.2';
+    const coreVersion = options.coreVersion || '^1.0.4';
     const manifests = options.selectedManifests;
     const hasMemory = manifests.some((m) => m.organType === 'memory');
     const hasVoice = manifests.some((m) => m.organType === 'voice');
@@ -101,14 +101,6 @@ function generateInstanceFiles(options) {
         ].join('\n'));
         dockerVolumes.push('  postgres_data:');
     }
-    if (isVoicevox) {
-        dockerServices.push([
-            '  voicevox:',
-            '    image: voicevox/voicevox_engine:cpu-latest',
-            '    ports:',
-            '      - "50021:50021"',
-        ].join('\n'));
-    }
     if (hasVoice && voiceConfig?.rvc?.enabled) {
         dockerServices.push([
             '  rvc:',
@@ -218,7 +210,7 @@ function generateInstanceFiles(options) {
         `import { readFile, stat, readdir } from 'node:fs/promises';`,
         `import path from 'node:path';`,
         `import { fileURLToPath } from 'node:url';`,
-        `import { SiduriRuntime } from '@siduri-x/core';`,
+        `import { SiduriRuntime, dispatchCompanionChat } from '@siduri-x/core';`,
     ];
     for (const m of manifests) {
         importLines.push(`import { ${m.factory} } from '${m.name}';`);
@@ -256,14 +248,11 @@ function generateInstanceFiles(options) {
         `  const parsedUrl = new URL(req.url, \`http://\${req.headers.host || 'localhost'}\`);`,
         `  const pathname = parsedUrl.pathname;`,
         '',
-        `  // API: Status & Health Probes`,
+        `  // API: Status & Health Probes (minimal safe operational state, no secrets/credentials/config.organs)`,
         `  if ((pathname === '/health' || pathname === '/api/status') && req.method === 'GET') {`,
         `    res.writeHead(200, { 'Content-Type': 'application/json' });`,
         `    res.end(JSON.stringify({`,
         `      status: 'ok',`,
-        `      name: config.name,`,
-        `      id: config.id,`,
-        `      organs: config.organs,`,
         `      uptime: process.uptime(),`,
         `    }));`,
         `    return;`,
@@ -324,8 +313,35 @@ function generateInstanceFiles(options) {
         '',
         `  // API: Memory Proposal Approval / Rejection`,
         `  if ((pathname === '/memory/proposals/approve' || pathname === '/memory/proposals/reject') && req.method === 'POST') {`,
-        `    res.writeHead(200, { 'Content-Type': 'application/json' });`,
-        `    res.end(JSON.stringify({ success: true, approved: pathname.endsWith('approve') }));`,
+        `    let body = '';`,
+        `    req.on('data', (chunk) => { body += chunk; });`,
+        `    req.on('end', async () => {`,
+        `      try {`,
+        `        const payload = JSON.parse(body || '{}');`,
+        `        const claimId = payload.id || payload.claimId;`,
+        `        if (!claimId) {`,
+        `          res.writeHead(400, { 'Content-Type': 'application/json' });`,
+        `          res.end(JSON.stringify({ error: 'Missing required claim id' }));`,
+        `          return;`,
+        `        }`,
+        `        if (pathname.endsWith('approve')) {`,
+        `          if (typeof memory?.approveClaim === 'function') {`,
+        `            await memory.approveClaim(claimId);`,
+        `          }`,
+        `          res.writeHead(200, { 'Content-Type': 'application/json' });`,
+        `          res.end(JSON.stringify({ approved: true, id: claimId }));`,
+        `        } else {`,
+        `          if (typeof memory?.rejectClaim === 'function') {`,
+        `            await memory.rejectClaim(claimId);`,
+        `          }`,
+        `          res.writeHead(200, { 'Content-Type': 'application/json' });`,
+        `          res.end(JSON.stringify({ rejected: true, id: claimId }));`,
+        `        }`,
+        `      } catch (err) {`,
+        `        res.writeHead(500, { 'Content-Type': 'application/json' });`,
+        `        res.end(JSON.stringify({ error: err.message }));`,
+        `      }`,
+        `    });`,
         `    return;`,
         `  }`,
         '',
@@ -336,43 +352,23 @@ function generateInstanceFiles(options) {
         `    return;`,
         `  }`,
         '',
-        `  // API: Chat interaction (supports both /chat and /api/chat)`,
+        `  // API: Chat interaction (routed through canonical dispatchCompanionChat from @siduri-x/core)`,
         `  if ((pathname === '/chat' || pathname === '/api/chat') && req.method === 'POST') {`,
         `    let body = '';`,
         `    req.on('data', (chunk) => { body += chunk; });`,
         `    req.on('end', async () => {`,
         `      try {`,
         `        const payload = JSON.parse(body || '{}');`,
-        `        const userMessage = payload.message || payload.text || '';`,
-        `        let reply = \`Hello! I received: "\${userMessage}"\`;`,
-        `        let expression = 'neutral';`,
-        `        let audioUrl = undefined;`,
-        '',
-        `        if (typeof brain?.generatePlan === 'function') {`,
-        `          try {`,
-        `            const plan = await brain.generatePlan({ prompt: userMessage });`,
-        `            reply = plan.speech || plan.text || reply;`,
-        `          } catch (err) {`,
-        `            reply = \`Thinking about "\${userMessage}"... (Brain active)\`;`,
-        `          }`,
-        `        }`,
-        '',
-        `        if (typeof voice?.synthesize === 'function') {`,
-        `          try {`,
-        `            const wavData = await voice.synthesize(reply);`,
-        `            const audioId = \`audio_\${Date.now()}\`;`,
-        `            audioCache.set(audioId, wavData);`,
-        `            audioUrl = \`/api/audio/\${audioId}\`;`,
-        `          } catch (e) {}`,
-        `        }`,
-        '',
-        `        if (typeof body?.setExpression === 'function') {`,
-        `          expression = reply.includes('!') ? 'happy' : 'calm';`,
-        `          body.setExpression(expression);`,
-        `        }`,
+        `        const response = await dispatchCompanionChat(runtime, {`,
+        `          id: config.id,`,
+        `          companionId: config.id,`,
+        `          message: payload.message || payload.text || '',`,
+        `          role: payload.role || 'OWNER',`,
+        `          history: Array.isArray(payload.history) ? payload.history : [],`,
+        `        });`,
         '',
         `        res.writeHead(200, { 'Content-Type': 'application/json' });`,
-        `        res.end(JSON.stringify({ reply, text: reply, expression, audioUrl, status: 'ok' }));`,
+        `        res.end(JSON.stringify(response));`,
         `      } catch (err) {`,
         `        res.writeHead(500, { 'Content-Type': 'application/json' });`,
         `        res.end(JSON.stringify({ error: err.message }));`,
@@ -408,32 +404,49 @@ function generateInstanceFiles(options) {
         `    return;`,
         `  }`,
         '',
-        `  // Static files & Next.js apps/web export routing`,
-        `  const decodedPathname = decodeURIComponent(pathname);`,
-        `  const normalizedPath = decodedPathname.replace(/^[/]+|[/]+$/g, '');`,
-        `  const candidatePaths = [`,
-        `    path.join(rootDir, 'public', normalizedPath, 'index.html'),`,
-        `    path.join(rootDir, 'public', normalizedPath + '.html'),`,
-        `    path.join(rootDir, 'public', normalizedPath),`,
-        `    path.join(rootDir, normalizedPath),`,
+        `  // Static files & Next.js apps/web export routing with strict boundary verification`,
+        `  let decodedPathname = pathname;`,
+        `  try {`,
+        `    while (decodedPathname.includes('%')) {`,
+        `      const next = decodeURIComponent(decodedPathname);`,
+        `      if (next === decodedPathname) break;`,
+        `      decodedPathname = next;`,
+        `    }`,
+        `  } catch {`,
+        `    res.writeHead(400, { 'Content-Type': 'text/plain' });`,
+        `    res.end('Bad Request');`,
+        `    return;`,
+        `  }`,
+        `  const normalizedPath = path.normalize(decodedPathname).replace(/^[/\\\\]+/, '');`,
+        `  const canonicalPublicRoot = path.resolve(rootDir, 'public');`,
+        `  const canonicalAssetsRoot = path.resolve(rootDir, 'assets');`,
+        `  const candidatePairs = [`,
+        `    { root: canonicalPublicRoot, target: path.resolve(canonicalPublicRoot, normalizedPath, 'index.html') },`,
+        `    { root: canonicalPublicRoot, target: path.resolve(canonicalPublicRoot, normalizedPath + '.html') },`,
+        `    { root: canonicalPublicRoot, target: path.resolve(canonicalPublicRoot, normalizedPath) },`,
         `  ];`,
         '',
-        `  if (!normalizedPath) {`,
-        `    candidatePaths.unshift(path.join(rootDir, 'public', 'index.html'));`,
+        `  if (!normalizedPath || normalizedPath === '.' || normalizedPath === './') {`,
+        `    candidatePairs.unshift({ root: canonicalPublicRoot, target: path.resolve(canonicalPublicRoot, 'index.html') });`,
         `  }`,
         '',
         `  // Compatibility fallback for legacy /live2d/<modelName>/... -> ./assets/body/<modelName>/...`,
-        `  if (pathname.startsWith('/live2d/')) {`,
-        `    const relativeAssetPath = pathname.slice('/live2d/'.length);`,
-        `    candidatePaths.unshift(path.join(rootDir, 'assets', 'body', relativeAssetPath));`,
-        `    candidatePaths.unshift(path.join(rootDir, 'assets', 'body', 'model', relativeAssetPath));`,
+        `  if (decodedPathname.startsWith('/live2d/')) {`,
+        `    const relativeAssetPath = path.normalize(decodedPathname.slice('/live2d/'.length)).replace(/^[/\\\\]+/, '');`,
+        `    candidatePairs.unshift({ root: canonicalAssetsRoot, target: path.resolve(canonicalAssetsRoot, 'body', relativeAssetPath) });`,
+        `    candidatePairs.unshift({ root: canonicalAssetsRoot, target: path.resolve(canonicalAssetsRoot, 'body', 'model', relativeAssetPath) });`,
         `  }`,
         '',
-        `  for (const candidate of candidatePaths) {`,
+        `  for (const { root, target } of candidatePairs) {`,
         `    try {`,
-        `      const fileStat = await stat(candidate);`,
+        `      // Strict path containment check: target must reside within configured root directory`,
+        `      const relative = path.relative(root, target);`,
+        `      if (relative.startsWith('..') || path.isAbsolute(relative)) {`,
+        `        continue;`,
+        `      }`,
+        `      const fileStat = await stat(target);`,
         `      if (fileStat.isFile()) {`,
-        `        const ext = path.extname(candidate).toLowerCase();`,
+        `        const ext = path.extname(target).toLowerCase();`,
         `        const mimeTypes = {`,
         `          '.html': 'text/html; charset=utf-8',`,
         `          '.js': 'application/javascript; charset=utf-8',`,
@@ -448,7 +461,7 @@ function generateInstanceFiles(options) {
         `          '.moc3': 'application/octet-stream',`,
         `        };`,
         `        const contentType = mimeTypes[ext] || 'application/octet-stream';`,
-        `        const content = await readFile(candidate);`,
+        `        const content = await readFile(target);`,
         `        res.writeHead(200, { 'Content-Type': contentType });`,
         `        res.end(content);`,
         `        return;`,
@@ -461,9 +474,12 @@ function generateInstanceFiles(options) {
         `});`,
         '',
         `const PORT = process.env.PORT || 3000;`,
-        `server.listen(PORT, () => {`,
+        `server.listen(Number(PORT), '127.0.0.1', () => {`,
         `  console.log(\`✓ Siduri [\${config.name}] initialized with [${selectedDisplayNames}].\`);`,
-        `  console.log(\`➜ Web Companion & Memory Console running at: http://localhost:\${PORT}\`);`,
+        `  console.log(\`➜ Web Companion & Memory Console running at: http://127.0.0.1:\${PORT}\`);`,
+        `  if (process.env.PORT === '0') {`,
+        `    server.close();`,
+        `  }`,
         `});`,
         '',
     ].join('\n');
@@ -480,14 +496,12 @@ function generateInstanceFiles(options) {
         '- **Node.js**: `v20.0.0` or higher',
         '- **Environment**: Valid `.env` file (configured from `.env.example`)',
     ];
-    if (hasMemory || isVoicevox) {
+    if (hasMemory) {
         readmeLines.push('- **Local Services (Optional)**: Docker (or standalone alternatives):');
-        if (hasMemory) {
-            readmeLines.push('  - **PostgreSQL**: Required for memory claims & durable state (or use cloud Supabase/Neon)');
-        }
-        if (isVoicevox) {
-            readmeLines.push('  - **VOICEVOX**: Required for voice synthesis (or run the official desktop app from [voicevox.hiroshiba.jp](https://voicevox.hiroshiba.jp/))');
-        }
+        readmeLines.push('  - **PostgreSQL**: Required for memory claims & durable state (or use cloud Supabase/Neon)');
+    }
+    if (isVoicevox) {
+        readmeLines.push('- **VOICEVOX**: Note: The Voicevox engine executable will be securely auto-downloaded at runtime by Siduri if no local URL is provided.');
     }
     readmeLines.push('', '## Getting Started', '', '### 1. Install Dependencies', '```bash', 'npm install', '```', '', '### 2. Configure Environment', '```bash', 'cp .env.example .env', '```', 'Fill in your LLM API key (e.g. `OPENROUTER_API_KEY`) and any other service credentials in `.env`.');
     if (dockerComposeYaml) {

package/dist/generator.test.js

@@ -58,7 +58,7 @@ describe('Instance Generator Composition Invariants (Phase 3)', () => {
             version: '1.0.0',
             displayName: 'Voice (VOICEVOX Speech Synthesis)',
             entrypoint: './dist/index.js',
-            factory: 'VoicevoxAdapter',
+            factory: 'VoiceAdapter',
             configKey: 'voice',
             configSchema: { type: 'object', properties: { provider: { type: 'string' } } },
             environment: [{ name: 'VOICEVOX_URL', default: 'http://localhost:50021' }],
@@ -158,10 +158,10 @@ describe('Instance Generator Composition Invariants (Phase 3)', () => {
         expect(files['README.md']).toContain('assets/body/companion-full');
         expect(files['README.md']).toContain('assets/voice/companion-full');
         expect(files['README.md']).toContain('Prerequisites');
-        // Docker compose generated for memory & voice
+        // Docker compose generated for memory (voicevox is auto-downloaded at runtime)
         expect(files['docker-compose.yml']).toBeDefined();
         expect(files['docker-compose.yml']).toContain('postgres:15');
-        expect(files['docker-compose.yml']).toContain('voicevox/voicevox_engine');
+        expect(files['README.md']).toContain('Voicevox engine executable will be securely auto-downloaded');
         expect(pkg.scripts['services:up']).toBe('docker compose up -d');
         expect(pkg.scripts['services:down']).toBe('docker compose down');
     });
@@ -177,4 +177,21 @@ describe('Instance Generator Composition Invariants (Phase 3)', () => {
         expect(files['public/index.html']).toContain('Memory Console');
         expect(files['public/index.html']).toContain('Companion Chat');
     });
+    test('Generated runtime server template enforces loopback binding, safe health, and path containment', () => {
+        const files = (0, generator_1.generateInstanceFiles)({
+            name: 'secure-companion',
+            selectedManifests: [MOCK_MANIFESTS.brain, MOCK_MANIFESTS.memory],
+        });
+        const srcIndexJs = files['src/index.js'];
+        // 1. Explicit loopback binding 127.0.0.1
+        expect(srcIndexJs).toContain("server.listen(Number(PORT), '127.0.0.1'");
+        expect(srcIndexJs).toContain("http://127.0.0.1:");
+        // 2. Minimal /health endpoint without config.organs or secrets
+        expect(srcIndexJs).toContain("pathname === '/health'");
+        expect(srcIndexJs).not.toContain('organs: config.organs');
+        // 3. Strict path traversal containment
+        expect(srcIndexJs).toContain('relative.startsWith(\'..\')');
+        expect(srcIndexJs).toContain('path.isAbsolute(relative)');
+        expect(srcIndexJs).toContain('decodeURIComponent');
+    });
 });

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { OrganManifest } from './manifest';
-export declare const CLI_VERSION = "0.1.5";
+export declare const CLI_VERSION = "0.1.7";
 export declare const colors: {
     cyan: string;
     dim: string;

package/dist/index.js

@@ -26,7 +26,7 @@ const doctor_1 = require("./doctor");
 const db_1 = require("./db");
 const configurators_1 = require("./configurators");
 const execFile = (0, node_util_1.promisify)(node_child_process_1.execFile);
-exports.CLI_VERSION = '0.1.5';
+exports.CLI_VERSION = '0.1.7';
 exports.colors = {
     cyan: '\u001b[36m',
     dim: '\u001b[2m',

package/dist/release-check.js

@@ -17,18 +17,18 @@ function runReleaseCheck(repoRoot = node_path_1.default.resolve(__dirname, '../.
         node_fs_1.default.rmSync(tempPackDir, { recursive: true, force: true });
     node_fs_1.default.mkdirSync(tempPackDir, { recursive: true });
     const canonicalPackages = [
-        { name: '@siduri-x/core', dir: 'packages/core', isOrgan: false, tarName: 'siduri-x-core-1.0.2.tgz' },
-        { name: '@siduri-x/brain', dir: 'packages/organs/brain', isOrgan: true, tarName: 'siduri-x-brain-1.0.2.tgz' },
-        { name: '@siduri-x/memory', dir: 'packages/organs/memory', isOrgan: true, tarName: 'siduri-x-memory-1.0.2.tgz' },
+        { name: '@siduri-x/core', dir: 'packages/core', isOrgan: false, tarName: 'siduri-x-core-1.0.4.tgz' },
+        { name: '@siduri-x/brain', dir: 'packages/organs/brain', isOrgan: true, tarName: 'siduri-x-brain-1.0.3.tgz' },
+        { name: '@siduri-x/memory', dir: 'packages/organs/memory', isOrgan: true, tarName: 'siduri-x-memory-1.0.3.tgz' },
         { name: '@siduri-x/knowledge', dir: 'packages/organs/knowledge', isOrgan: true, tarName: 'siduri-x-knowledge-1.0.2.tgz' },
-        { name: '@siduri-x/behavior', dir: 'packages/organs/behavior', isOrgan: true, tarName: 'siduri-x-behavior-1.0.2.tgz' },
+        { name: '@siduri-x/behavior', dir: 'packages/organs/behavior', isOrgan: true, tarName: 'siduri-x-behavior-1.0.5.tgz' },
         { name: '@siduri-x/ear', dir: 'packages/organs/ear', isOrgan: true, tarName: 'siduri-x-ear-1.0.2.tgz' },
         { name: '@siduri-x/vision', dir: 'packages/organs/vision', isOrgan: true, tarName: 'siduri-x-vision-1.0.2.tgz' },
         { name: '@siduri-x/hands', dir: 'packages/organs/hands', isOrgan: true, tarName: 'siduri-x-hands-1.0.2.tgz' },
         { name: '@siduri-x/body', dir: 'packages/organs/body', isOrgan: true, tarName: 'siduri-x-body-1.0.4.tgz' },
-        { name: '@siduri-x/voice', dir: 'packages/organs/voice', isOrgan: true, tarName: 'siduri-x-voice-1.0.3.tgz' },
+        { name: '@siduri-x/voice', dir: 'packages/organs/voice', isOrgan: true, tarName: 'siduri-x-voice-1.0.5.tgz' },
         { name: '@siduri-x/observation', dir: 'packages/organs/observation', isOrgan: true, tarName: 'siduri-x-observation-1.0.2.tgz' },
-        { name: '@vxnus/siduri', dir: 'cli', isOrgan: false, tarName: 'vxnus-siduri-0.1.5.tgz' },
+        { name: '@vxnus/siduri', dir: 'cli', isOrgan: false, tarName: 'vxnus-siduri-0.1.7.tgz' },
     ];
     let packagesChecked = 0;
     let tarballsInspected = 0;

package/dist/runtime-parity.test.d.ts

@@ -0,0 +1 @@
+export {};