catalyst-core 0.1.0-canary.9 → 0.2.0-beta.2

package/mcp_v2/tools/knowledge.js

@@ -55,11 +55,20 @@ function fetchRaw(url) {
     })
 }
 
+// Only allow known tag shapes or "main" — guards against a tampered/malformed
+// installed version string being interpolated into the GitHub fetch URL.
+// Covers all observed formats:
+//   v0.1.0, v0.1.0-canary.8, v0.0.3-canary-18, v0.1.0-beta.2
+function sanitizeGithubTag(version) {
+    if (!version) return "main"
+    return /^v\d+\.\d+\.\d+(-[a-zA-Z0-9]+([.-]\d+)?)?$/.test(version) ? version : "main"
+}
+
 // Fetch first available file — used for KB-miss GitHub fallback
 async function fetchFromGithub(files, installedVersion) {
     if (!files || files.length === 0) return null
 
-    const tag = installedVersion || "main"
+    const tag = sanitizeGithubTag(installedVersion)
     const base = `https://raw.githubusercontent.com/tata1mg/catalyst-core/${tag}`
 
     for (const file of files) {
@@ -88,9 +97,13 @@ async function fetchFromGithub(files, installedVersion) {
     return null
 }
 
-// Build FTS5 query string from keywords array — each term ORed, quoted for safety
+// Build FTS5 query string from keywords array — each term ORed, quoted for safety.
+// Strip all FTS5 special characters before quoting so keywords are treated as literals.
 function buildFtsQuery(keywords) {
-    return keywords.map((k) => `"${k.replace(/"/g, "")}"`).join(" OR ")
+    return keywords
+        .map((k) => `"${k.replace(/[^a-zA-Z0-9 _-]/g, " ").trim()}"`)
+        .filter((k) => k.length > 2) // drop empty/whitespace-only terms after stripping
+        .join(" OR ")
 }
 
 function stripGithubFiles(rows) {

package/mcp_v2/tools/sync.js

@@ -1,23 +1,192 @@
 "use strict"
 
+const fs = require("fs")
+const path = require("path")
+const https = require("https")
+const http = require("http")
+const crypto = require("crypto")
+const { URL } = require("url")
+
+const { seedKnowledgeBase } = require("../lib/seed")
+const knowledge = require("./knowledge")
+
+const KB_GITHUB_URL =
+    "https://raw.githubusercontent.com/tata1mg/catalyst-core/main/packages/catalyst-core/mcp_v2/knowledge-base.json"
+const GITHUB_RAW_HOST = "raw.githubusercontent.com"
+const KB_PATH = path.join(__dirname, "..", "knowledge-base.json")
+const KB_MAX_BYTES = 4 * 1024 * 1024
+const MAX_REDIRECTS = 5
+const SOCKET_TIMEOUT_MS = 15_000
+
 let _db
 
 function init(db) {
     _db = db
 }
 
-function handle_sync_catalyst_docs({ force = false } = {}) {
-    const snapshot_count = _db.prepare(`SELECT COUNT(*) as c FROM doc_snapshots`).get()
-    const knowledge_count = _db
-        .prepare(`SELECT COUNT(*) as c FROM framework_knowledge WHERE source = 'sitemap'`)
-        .get()
+function fetchUrl(url, opts = {}) {
+    const { allowedHost = GITHUB_RAW_HOST, maxBytes = KB_MAX_BYTES, redirectsLeft = MAX_REDIRECTS } = opts
+    return new Promise((resolve, reject) => {
+        let parsed
+        try {
+            parsed = new URL(url)
+        } catch {
+            return reject(new Error(`Invalid URL: ${url}`))
+        }
+        if (parsed.hostname !== allowedHost) {
+            return reject(new Error(`Refusing off-host fetch: ${parsed.hostname}`))
+        }
+        if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+            return reject(new Error(`Unsupported protocol: ${parsed.protocol}`))
+        }
+        const mod = parsed.protocol === "https:" ? https : http
+        const req = mod.get(
+            url,
+            { headers: { "User-Agent": "catalyst-mcp/2.0 sync_knowledge_base" } },
+            (res) => {
+                if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+                    res.resume()
+                    if (redirectsLeft <= 0) return reject(new Error("Too many redirects"))
+                    let next
+                    try {
+                        next = new URL(res.headers.location, url).toString()
+                    } catch {
+                        return reject(new Error(`Invalid redirect target: ${res.headers.location}`))
+                    }
+                    return fetchUrl(next, {
+                        allowedHost,
+                        maxBytes,
+                        redirectsLeft: redirectsLeft - 1,
+                    }).then(resolve, reject)
+                }
+                if (res.statusCode !== 200) {
+                    res.resume()
+                    return reject(new Error(`HTTP ${res.statusCode}`))
+                }
+                let bytes = 0
+                const chunks = []
+                res.on("data", (chunk) => {
+                    bytes += chunk.length
+                    if (bytes > maxBytes) {
+                        req.destroy(new Error(`Response exceeded ${maxBytes} bytes`))
+                        return
+                    }
+                    chunks.push(chunk)
+                })
+                res.on("end", () => {
+                    if (bytes > maxBytes) return
+                    resolve(Buffer.concat(chunks).toString("utf8"))
+                })
+                res.on("error", reject)
+            }
+        )
+        req.setTimeout(SOCKET_TIMEOUT_MS, () => {
+            req.destroy(new Error(`Socket idle timeout after ${SOCKET_TIMEOUT_MS}ms`))
+        })
+        req.on("error", reject)
+    })
+}
+
+function contentHash(text) {
+    return crypto.createHash("sha256").update(text).digest("hex").slice(0, 16)
+}
+
+async function syncKnowledgeBaseFromGithub({ force = false } = {}) {
+    let remoteText
+    try {
+        remoteText = await fetchUrl(KB_GITHUB_URL, {
+            allowedHost: GITHUB_RAW_HOST,
+            maxBytes: KB_MAX_BYTES,
+        })
+    } catch (e) {
+        return { kb_changed: false, kb_url: KB_GITHUB_URL, error: `kb_fetch_failed: ${e.message}` }
+    }
+
+    let parsed
+    try {
+        parsed = JSON.parse(remoteText)
+    } catch (e) {
+        return { kb_changed: false, kb_url: KB_GITHUB_URL, error: `kb_invalid_json: ${e.message}` }
+    }
+    if (!Array.isArray(parsed)) {
+        return {
+            kb_changed: false,
+            kb_url: KB_GITHUB_URL,
+            error: "kb_invalid_format: expected JSON array at the top level",
+        }
+    }
+
+    const remoteHash = contentHash(remoteText)
+    let localHash = null
+    if (fs.existsSync(KB_PATH)) {
+        try {
+            localHash = contentHash(fs.readFileSync(KB_PATH, "utf8"))
+        } catch {
+            localHash = null
+        }
+    }
+
+    if (!force && localHash === remoteHash) {
+        return {
+            kb_changed: false,
+            kb_url: KB_GITHUB_URL,
+            kb_hash: remoteHash,
+            message: "knowledge-base.json already in sync with main branch.",
+        }
+    }
+
+    const tmpPath = `${KB_PATH}.tmp.${process.pid}`
+    try {
+        fs.writeFileSync(tmpPath, remoteText)
+        fs.renameSync(tmpPath, KB_PATH)
+    } catch (e) {
+        try {
+            if (fs.existsSync(tmpPath)) fs.unlinkSync(tmpPath)
+        } catch {
+            // ignore cleanup failure
+        }
+        return { kb_changed: false, kb_url: KB_GITHUB_URL, error: `kb_write_failed: ${e.message}` }
+    }
+
+    let counts
+    try {
+        counts = seedKnowledgeBase(_db, KB_PATH)
+        // Rebuild fk_fts so rowids match the freshly-inserted framework_knowledge ids.
+        _db.exec(`DROP TABLE IF EXISTS fk_fts`)
+        knowledge.init(_db)
+    } catch (e) {
+        return {
+            kb_changed: true,
+            kb_url: KB_GITHUB_URL,
+            kb_hash: remoteHash,
+            error: `kb_reseed_failed: ${e.message}`,
+            message: "knowledge-base.json written to disk but DB re-seed failed.",
+        }
+    }
+
+    return {
+        kb_changed: true,
+        kb_url: KB_GITHUB_URL,
+        kb_hash: remoteHash,
+        kb_knowledge_count: counts.knowledgeCount,
+        kb_error_count: counts.errorCount,
+        message: "knowledge-base.json updated from main branch and re-seeded into context.db.",
+    }
+}
+
+async function handle_sync_knowledge_base({ force = false } = {}) {
+    const knowledge_base = await syncKnowledgeBaseFromGithub({ force })
     return {
-        _phase: 6,
+        synced_at: new Date().toISOString(),
         force,
-        existing_snapshots: snapshot_count.c,
-        sitemap_knowledge_rows: knowledge_count.c,
-        message: "Live sync not yet implemented (Phase 6). Run setup.js for initial sync.",
+        knowledge_base,
+        error: knowledge_base.error || null,
+        message:
+            knowledge_base.message ||
+            (knowledge_base.error
+                ? `knowledge-base.json sync failed: ${knowledge_base.error}`
+                : "knowledge-base.json sync complete."),
     }
 }
 
-module.exports = { init, handle_sync_catalyst_docs }
+module.exports = { init, handle_sync_knowledge_base }

package/mcp_v2/tools/tasks.js

@@ -26,6 +26,14 @@ function now() {
     return new Date().toISOString().replace("T", " ").slice(0, 19)
 }
 
+function projectPath(projectRoot, rel) {
+    const normalized = path.normalize(rel)
+    if (path.isAbsolute(normalized) || normalized === ".." || normalized.startsWith(`..${path.sep}`)) {
+        return null
+    }
+    return `${projectRoot}${path.sep}${normalized}`
+}
+
 // ─── Improvement 1: Resolve needs_review inline before plan write ─────────────
 //
 // Reads signal_files from disk for each needs_review task.
@@ -67,7 +75,8 @@ function resolveNeedsReview(task, projectRoot) {
         let nativeBranchFound = false
         for (const f of samplesToCheck) {
             try {
-                const absPath = path.isAbsolute(f) ? f : path.join(projectRoot, f)
+                const absPath = path.isAbsolute(f) ? f : projectPath(projectRoot, f)
+                if (!absPath) continue
                 const content = fs.readFileSync(absPath, "utf8")
                 if (hookRegex && hookRegex.test(content)) {
                     nativeBranchFound = true
@@ -411,12 +420,12 @@ function summarisePlan(plan) {
 // ─── MD file helpers ─────────────────────────────────────────────────────────
 
 function getMdPath(projectRoot, slug) {
-    return path.join(projectRoot, ".mcp_tasks", `${slug}.md`)
+    return `${projectRoot}${path.sep}.mcp_tasks${path.sep}${slug}.md`
 }
 
 function buildUserReviewWarnings(projectRoot) {
     const warnings = []
-    const configPath = path.join(projectRoot, "config", "config.json")
+    const configPath = `${projectRoot}${path.sep}config${path.sep}config.json`
     let config = null
     try {
         config = JSON.parse(fs.readFileSync(configPath, "utf8"))
@@ -463,7 +472,7 @@ function buildUserReviewWarnings(projectRoot) {
 }
 
 function writeMdFile(projectRoot, slug, goal, steps, bareMinimum, userReviewWarnings) {
-    const dir = path.join(projectRoot, ".mcp_tasks")
+    const dir = `${projectRoot}${path.sep}.mcp_tasks`
     if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true })
 
     const mdPath = getMdPath(projectRoot, slug)

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "catalyst-core",
-    "version": "0.1.0-canary.9",
+    "version": "0.2.0-beta.2",
     "main": "dist/index.js",
     "description": "Web framework that provides great performance out of the box",
     "bin": {
@@ -59,11 +59,10 @@
         "@loadable/webpack-plugin": "^5.15.2",
         "@pmmmwh/react-refresh-webpack-plugin": "^0.5.11",
         "@svgr/webpack": "^8.1.0",
-        "@tata1mg/router": "0.0.1-beta.7",
+        "@tata1mg/router": "0.1.0-beta",
         "app-root-path": "^3.1.0",
         "babel-loader": "^9.1.3",
         "babel-plugin-react-compiler": "^19.0.0-beta-decd7b8-20250118",
-        "babel-plugin-transform-react-remove-prop-types": "^0.4.24",
         "body-parser": "^1.20.2",
         "chokidar": "^3.6.0",
         "compression": "^1.7.4",
@@ -81,13 +80,12 @@
         "picocolors": "^1.0.0",
         "postcss-loader": "^7.3.3",
         "postcss-scss": "^4.0.9",
-        "react": "^18.2.0",
+        "react": "19.0.0",
         "react-compiler-runtime": "^19.0.0-beta-decd7b8-20250118",
-        "react-dom": "^18.2.0",
-        "react-redux": "^8.1.3",
+        "react-dom": "19.0.0",
+        "react-redux": "^9.2.0",
         "react-refresh": "^0.14.0",
         "react-router-dom": "^6.16.0",
-        "redux": "^4.2.1",
         "sass": "^1.69.5",
         "sass-loader": "^13.3.2",
         "sass-resources-loader": "^2.2.5",
@@ -97,7 +95,7 @@
         "webpack": "^5.88.2",
         "webpack-bundle-analyzer": "^4.9.1",
         "webpack-cli": "^5.1.4",
-        "webpack-dev-server": "^4.15.2",
+        "webpack-dev-server": "^5.2.4",
         "webpack-merge": "^5.9.0",
         "webpack-node-externals": "^3.0.0",
         "winston": "^3.11.0",
@@ -115,5 +113,19 @@
         "eslint-plugin-risxss": "^2.1.0",
         "eslint-plugin-security": "^3.0.0",
         "prettier": "^3.2.5"
+    },
+    "overrides": {
+        "@loadable/component": {
+            "react": "^16.3.0 || ^17.0.0 || ^18.0.0 || 19.0.0"
+        },
+        "@loadable/server": {
+            "react": "^16.3.0 || ^17.0.0 || ^18.0.0 || 19.0.0"
+        },
+        "uuid": "11.1.1",
+        "file-type": "22.0.1",
+        "imagemin": "9.0.1",
+        "webpack-dev-server": {
+            "http-proxy-middleware": "3.0.7"
+        }
     }
 }