catalyst-core 1.0.0 → 1.0.1-canary.2

package/dist/native/iosnativeWebView/CoreLogic/Tests/CatalystCoreLogicTests/FrameworkServerUtilsNativeAITests.swift

@@ -0,0 +1,351 @@
+import XCTest
+import Foundation
+import Network
+@testable import CatalystCoreLogic
+
+/// Loopback tests for the native-AI routes (/ai/stream, /ai/generate) using a stub supplier,
+/// so the transport is covered without any inference library. Mirrors the pattern in
+/// FrameworkServerUtilsLoopbackTests (skip outside CI if the sandbox cannot bind, fail on CI).
+final class FrameworkServerUtilsNativeAITests: XCTestCase {
+
+    private var server: FrameworkServerUtils!
+
+    override func setUp() {
+        super.setUp()
+        server = FrameworkServerUtils.shared
+    }
+
+    override func tearDown() {
+        server.setNativeAiSupplier(nil)
+        server.setNativeSystemPrompt("")
+        server.stopServer()
+        server = nil
+        super.tearDown()
+    }
+
+    // MARK: - Helpers
+
+    private func requireRunningServer() throws {
+        guard server.startServer() else { return try unavailable("startServer() returned false") }
+        let deadline = Date().addingTimeInterval(10)
+        while Date() < deadline {
+            if server.isRunning(), Self.canConnect(port: server.getServerPort()) { return }
+            Thread.sleep(forTimeInterval: 0.02)
+        }
+        try unavailable("not accepting connections")
+    }
+
+    private func unavailable(_ reason: String) throws {
+        if ProcessInfo.processInfo.environment["CI"] != nil {
+            XCTFail("Loopback server unavailable: \(reason)")
+            throw XCTSkip("unavailable")
+        }
+        throw XCTSkip("Loopback server unavailable: \(reason)")
+    }
+
+    private static func canConnect(port: UInt16) -> Bool {
+        let fd = socket(AF_INET, SOCK_STREAM, 0)
+        guard fd != -1 else { return false }
+        defer { close(fd) }
+        var addr = sockaddr_in()
+        addr.sin_family = sa_family_t(AF_INET)
+        addr.sin_port = port.bigEndian
+        addr.sin_addr.s_addr = inet_addr("127.0.0.1")
+        return withUnsafePointer(to: &addr) {
+            $0.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+                connect(fd, $0, socklen_t(MemoryLayout<sockaddr_in>.size))
+            }
+        } == 0
+    }
+
+    private func url(_ path: String) throws -> URL {
+        try XCTUnwrap(URL(string: "http://localhost:\(server.getServerPort())/framework-\(server.getSessionId())/ai/\(path)"))
+    }
+
+    private func post(_ path: String, json: [String: Any]) async throws -> URLRequest {
+        var request = URLRequest(url: try url(path))
+        request.httpMethod = "POST"
+        request.setValue("application/json", forHTTPHeaderField: "Content-Type")
+        request.httpBody = try JSONSerialization.data(withJSONObject: json)
+        return request
+    }
+
+    private func readFrames(_ request: URLRequest) async throws -> (HTTPURLResponse, [[String: Any]]) {
+        let (bytes, response) = try await URLSession.shared.bytes(for: request)
+        var frames: [[String: Any]] = []
+        for try await line in bytes.lines where line.hasPrefix("data: ") {
+            let payload = Data(line.dropFirst(6).utf8)
+            frames.append(try XCTUnwrap(JSONSerialization.jsonObject(with: payload) as? [String: Any]))
+        }
+        return (try XCTUnwrap(response as? HTTPURLResponse), frames)
+    }
+
+    private func stubSupplier(tokens: [String], conversationId: String = "conv-1") -> NativeAISupplier {
+        return { _, _, _ in
+            (conversationId, AsyncThrowingStream { continuation in
+                for token in tokens { continuation.yield(token) }
+                continuation.finish()
+            })
+        }
+    }
+
+    // MARK: - /ai/stream
+
+    func testStream_EmitsConversationIdTokensThenDone() async throws {
+        try requireRunningServer()
+        server.setNativeAiSupplier(stubSupplier(tokens: ["Hel", "lo \"quoted\" / ✓"]))
+
+        let (response, frames) = try await readFrames(try await post("stream", json: ["prompt": "hi"]))
+
+        XCTAssertEqual(response.statusCode, 200)
+        XCTAssertTrue(response.value(forHTTPHeaderField: "Content-Type")?.contains("text/event-stream") ?? false)
+        XCTAssertEqual(frames.count, 4)
+        XCTAssertEqual(frames[0]["conversationId"] as? String, "conv-1")
+        XCTAssertEqual(frames[1]["token"] as? String, "Hel")
+        XCTAssertEqual(frames[2]["token"] as? String, "lo \"quoted\" / ✓")
+        XCTAssertEqual(frames[3]["done"] as? Bool, true)
+    }
+
+    func testStream_PrependsSystemPromptAndForwardsGenConfigAndConversationId() async throws {
+        try requireRunningServer()
+        let seen = LockedBox<(String, [String: Any], String?)?>(nil)
+        server.setNativeSystemPrompt("SYSTEM")
+        server.setNativeAiSupplier { prompt, genConfig, convId in
+            seen.value = (prompt, genConfig, convId)
+            return ("c", AsyncThrowingStream { $0.finish() })
+        }
+
+        _ = try await readFrames(try await post("stream", json: [
+            "prompt": "hello", "genConfig": ["temperature": 0.5], "conversationId": "prev",
+        ]))
+
+        let value = try XCTUnwrap(seen.value)
+        XCTAssertEqual(value.0, "SYSTEM\n\nhello")
+        XCTAssertEqual(value.1["temperature"] as? Double, 0.5)
+        XCTAssertEqual(value.2, "prev")
+    }
+
+    func testStream_NoSupplier_EmitsNotReadyErrorFrame() async throws {
+        try requireRunningServer()
+        let (_, frames) = try await readFrames(try await post("stream", json: ["prompt": "hi"]))
+        XCTAssertEqual(frames.first?["code"] as? String, NativeAIErrorCode.streamNotReady)
+        XCTAssertNotNil(frames.first?["error"] as? String)
+    }
+
+    func testStream_EmptyPrompt_EmitsInvalidRequestFrame() async throws {
+        try requireRunningServer()
+        server.setNativeAiSupplier(stubSupplier(tokens: ["x"]))
+        let (_, frames) = try await readFrames(try await post("stream", json: ["prompt": ""]))
+        XCTAssertEqual(frames.first?["code"] as? String, NativeAIErrorCode.invalidRequestBody)
+    }
+
+    func testStream_SupplierThrows_EmitsErrorFrameWithEngineCode() async throws {
+        try requireRunningServer()
+        server.setNativeAiSupplier { _, _, _ in throw NativeAIError(message: "model exploded", code: "AI-006") }
+        let (_, frames) = try await readFrames(try await post("stream", json: ["prompt": "hi"]))
+        XCTAssertEqual(frames.first?["error"] as? String, "model exploded")
+        XCTAssertEqual(frames.first?["code"] as? String, "AI-006")
+    }
+
+    func testStream_MidStreamFailure_EmitsTokensThenError() async throws {
+        try requireRunningServer()
+        server.setNativeAiSupplier { _, _, _ in
+            ("c", AsyncThrowingStream { continuation in
+                continuation.yield("partial")
+                continuation.finish(throwing: NativeAIError(message: "context window exceeded"))
+            })
+        }
+        let (_, frames) = try await readFrames(try await post("stream", json: ["prompt": "hi"]))
+        XCTAssertEqual(frames.map { $0.keys.sorted().joined(separator: ",") }, ["conversationId", "token", "code,error"])
+    }
+
+    func testStream_TokenArrivingAfterGap_StillDelivered() async throws {
+        // Short gap only: the 30s connection-timeout exemption (cancelConnectionTimeout) is not exercised here.
+        try requireRunningServer()
+        server.setNativeAiSupplier { _, _, _ in
+            ("c", AsyncThrowingStream { continuation in
+                Task<Void, Never> {
+                    try? await Task.sleep(nanoseconds: 300_000_000)
+                    continuation.yield("late")
+                    continuation.finish()
+                }
+            })
+        }
+        let (_, frames) = try await readFrames(try await post("stream", json: ["prompt": "hi"]))
+        XCTAssertEqual(frames.last?["done"] as? Bool, true)
+    }
+
+    func testStream_ClientDisconnect_TerminatesUpstreamStream() async throws {
+        try requireRunningServer()
+        let terminated = expectation(description: "token stream terminated after client disconnect")
+        server.setNativeAiSupplier { _, _, _ in
+            ("c", AsyncThrowingStream { continuation in
+                continuation.onTermination = { _ in terminated.fulfill() }
+                Task<Void, Never> {
+                    while !Task.isCancelled {
+                        if case .terminated = continuation.yield("tick") { break }
+                        try? await Task.sleep(nanoseconds: 20_000_000)
+                    }
+                }
+            })
+        }
+
+        let (bytes, _) = try await URLSession.shared.bytes(for: try await post("stream", json: ["prompt": "hi"]))
+        var iterator = bytes.lines.makeAsyncIterator()
+        _ = try await iterator.next()
+        bytes.task.cancel()
+
+        await fulfillment(of: [terminated], timeout: 10)
+    }
+
+    // MARK: - Body framing
+
+    func testStream_BodyArrivingInSeparateWriteFromHeaders_IsAssembled() async throws {
+        try requireRunningServer()
+        server.setNativeAiSupplier(stubSupplier(tokens: ["ok"]))
+
+        let body = #"{"prompt":"split"}"#
+        let head = "POST /framework-\(server.getSessionId())/ai/stream HTTP/1.1\r\nHost: localhost\r\nContent-Type: application/json\r\nContent-Length: \(body.utf8.count)\r\n\r\n"
+        let reply = try Self.rawExchange(port: server.getServerPort(), writes: [head, body], pauseBetween: 0.2)
+
+        XCTAssertTrue(reply.contains("200 OK"))
+        XCTAssertTrue(reply.contains("\"token\":\"ok\""))
+        XCTAssertTrue(reply.contains("\"done\":true"))
+    }
+
+    func testPost_OversizedContentLength_Returns413() async throws {
+        try requireRunningServer()
+        let head = "POST /framework-\(server.getSessionId())/ai/stream HTTP/1.1\r\nContent-Length: 99999999\r\n\r\n"
+        let reply = try Self.rawExchange(port: server.getServerPort(), writes: [head], pauseBetween: 0)
+        XCTAssertTrue(reply.contains("413"))
+    }
+
+    func testPost_ClientClosesBeforeSendingDeclaredBody_Returns400() async throws {
+        try requireRunningServer()
+        server.setNativeAiSupplier(stubSupplier(tokens: ["must not run"]))
+        let head = "POST /framework-\(server.getSessionId())/ai/stream HTTP/1.1\r\nContent-Length: 50\r\n\r\n"
+        let reply = try Self.rawExchange(
+            port: server.getServerPort(), writes: [head, "{\"prompt\":\"x\"}"], pauseBetween: 0.1, halfCloseAfterWrites: true
+        )
+        XCTAssertTrue(reply.contains("400"))
+        XCTAssertFalse(reply.contains("must not run"))
+    }
+
+    /// Writes each chunk on a plain TCP socket (with a pause between), then reads until the server closes.
+    private static func rawExchange(
+        port: UInt16, writes: [String], pauseBetween: TimeInterval, halfCloseAfterWrites: Bool = false
+    ) throws -> String {
+        let fd = socket(AF_INET, SOCK_STREAM, 0)
+        guard fd != -1 else { throw XCTSkip("socket() failed") }
+        defer { close(fd) }
+        var tv = timeval(tv_sec: 5, tv_usec: 0)
+        setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, socklen_t(MemoryLayout<timeval>.size))
+        var addr = sockaddr_in()
+        addr.sin_family = sa_family_t(AF_INET)
+        addr.sin_port = port.bigEndian
+        addr.sin_addr.s_addr = inet_addr("127.0.0.1")
+        let connected = withUnsafePointer(to: &addr) {
+            $0.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+                connect(fd, $0, socklen_t(MemoryLayout<sockaddr_in>.size))
+            }
+        }
+        guard connected == 0 else { throw XCTSkip("connect() failed") }
+
+        for chunk in writes {
+            _ = chunk.withCString { send(fd, $0, strlen($0), 0) }
+            if pauseBetween > 0 { Thread.sleep(forTimeInterval: pauseBetween) }
+        }
+
+        if halfCloseAfterWrites { shutdown(fd, SHUT_WR) }
+
+        var received = Data()
+        var buffer = [UInt8](repeating: 0, count: 4096)
+        while true {
+            let bytesRead = recv(fd, &buffer, buffer.count, 0)
+            if bytesRead <= 0 { break }
+            received.append(buffer, count: bytesRead)
+        }
+        return String(decoding: received, as: UTF8.self)
+    }
+
+    // MARK: - OPTIONS preflight / generate / URL
+
+    func testPreflight_ReturnsCORSForPost() async throws {
+        try requireRunningServer()
+        var request = URLRequest(url: try url("stream"))
+        request.httpMethod = "OPTIONS"
+        let (_, response) = try await URLSession.shared.data(for: request)
+        let http = try XCTUnwrap(response as? HTTPURLResponse)
+        XCTAssertEqual(http.statusCode, 200)
+        XCTAssertTrue(http.value(forHTTPHeaderField: "Access-Control-Allow-Methods")?.contains("POST") ?? false)
+        XCTAssertNotNil(http.value(forHTTPHeaderField: "Access-Control-Allow-Origin"))
+    }
+
+    func testGenerate_ReturnsAggregatedJSON() async throws {
+        try requireRunningServer()
+        server.setNativeAiSupplier(stubSupplier(tokens: ["a", "b", "c"], conversationId: "g1"))
+
+        let (data, response) = try await URLSession.shared.data(for: try await post("generate", json: ["prompt": "hi"]))
+
+        XCTAssertEqual((response as? HTTPURLResponse)?.statusCode, 200)
+        let json = try XCTUnwrap(JSONSerialization.jsonObject(with: data) as? [String: Any])
+        XCTAssertEqual(json["output"] as? String, "abc")
+        XCTAssertEqual(json["conversationId"] as? String, "g1")
+        XCTAssertEqual(json["tokenCount"] as? Int, 3)
+    }
+
+    func testGenerate_NoSupplier_Returns503() async throws {
+        try requireRunningServer()
+        let (data, response) = try await URLSession.shared.data(for: try await post("generate", json: ["prompt": "hi"]))
+        XCTAssertEqual((response as? HTTPURLResponse)?.statusCode, 503)
+        let json = try XCTUnwrap(JSONSerialization.jsonObject(with: data) as? [String: Any])
+        XCTAssertEqual(json["code"] as? String, NativeAIErrorCode.streamNotReady)
+    }
+
+    // MARK: - Loopback-only AI routes, Content-Length validation
+
+    func testIsLoopbackPeer_AcceptsLocalAddressesOnly() throws {
+        func endpoint(_ host: NWEndpoint.Host) -> NWEndpoint { .hostPort(host: host, port: 5000) }
+        XCTAssertTrue(FrameworkServerUtils.isLoopbackPeer(endpoint(.ipv4(try XCTUnwrap(IPv4Address("127.0.0.1"))))))
+        XCTAssertTrue(FrameworkServerUtils.isLoopbackPeer(endpoint(.ipv6(try XCTUnwrap(IPv6Address("::1"))))))
+        XCTAssertTrue(FrameworkServerUtils.isLoopbackPeer(endpoint(.ipv6(try XCTUnwrap(IPv6Address("::ffff:127.0.0.1"))))))
+        XCTAssertFalse(FrameworkServerUtils.isLoopbackPeer(endpoint(.ipv4(try XCTUnwrap(IPv4Address("192.168.1.20"))))))
+        XCTAssertFalse(FrameworkServerUtils.isLoopbackPeer(endpoint(.ipv6(try XCTUnwrap(IPv6Address("fe80::1"))))))
+        XCTAssertFalse(FrameworkServerUtils.isLoopbackPeer(.unix(path: "/tmp/x")))
+    }
+
+    func testContentLength_ParsesValidAbsentAndRejectsMalformed() {
+        func length(_ headers: String) -> Int?? { .some(FrameworkServerUtils.contentLength(inHeaders: Data(headers.utf8))) }
+        XCTAssertEqual(length("POST / HTTP/1.1\r\nContent-Length: 12"), .some(12))
+        XCTAssertEqual(length("POST / HTTP/1.1\r\ncontent-length:7"), .some(7))
+        XCTAssertEqual(length("GET / HTTP/1.1\r\nHost: x"), .some(0))
+        XCTAssertEqual(length("POST / HTTP/1.1\r\nContent-Length: abc"), .some(nil))
+        XCTAssertEqual(length("POST / HTTP/1.1\r\nContent-Length: -5"), .some(nil))
+    }
+
+    func testPost_MalformedContentLength_Returns400() async throws {
+        try requireRunningServer()
+        let head = "POST /framework-\(server.getSessionId())/ai/stream HTTP/1.1\r\nContent-Length: nope\r\n\r\n"
+        let reply = try Self.rawExchange(port: server.getServerPort(), writes: [head], pauseBetween: 0)
+        XCTAssertTrue(reply.contains("400"))
+    }
+
+    func testNativeAIStreamURL_NilWhenStopped_AndNamesSessionWhenRunning() throws {
+        server.stopServer()
+        XCTAssertNil(server.nativeAIStreamURL())
+        try requireRunningServer()
+        let url = try XCTUnwrap(server.nativeAIStreamURL())
+        XCTAssertTrue(url.hasSuffix("/framework-\(server.getSessionId())/ai/stream"))
+        XCTAssertTrue(url.contains("localhost:\(server.getServerPort())"))
+    }
+}
+
+private final class LockedBox<T>: @unchecked Sendable {
+    private let lock = NSLock()
+    private var stored: T
+    init(_ initial: T) { stored = initial }
+    var value: T {
+        get { lock.lock(); defer { lock.unlock() }; return stored }
+        set { lock.lock(); defer { lock.unlock() }; stored = newValue }
+    }
+}

package/dist/native/iosnativeWebView/CoreLogic/Tests/CatalystCoreLogicTests/NetworkMonitorTests.swift

@@ -33,7 +33,7 @@ final class NetworkMonitorTests: XCTestCase {
     /// Waits for a real NWPath from a fresh, short-lived monitor. Not the
     /// shared NetworkMonitor singleton — an independent NWPathMonitor so
     /// this test doesn't depend on NetworkMonitor's internal state/timing.
-    private func waitForRealPath(timeout: TimeInterval = 5) -> NWPath? {
+    private func waitForRealPath(timeout: TimeInterval = 30) -> NWPath? {
         let monitor = NWPathMonitor()
         let expectation = self.expectation(description: "NWPathMonitor delivered a path")
         var capturedPath: NWPath?
@@ -49,10 +49,21 @@ final class NetworkMonitorTests: XCTestCase {
         return capturedPath
     }
 
-    func testMapPathToStatus_RealPathProducesConsistentIsOnline() throws {
-        guard let path = waitForRealPath() else {
-            throw XCTSkip("No NWPath delivered within timeout — cannot exercise mapPathToStatus without a live path")
+    /// Returns a live path. The wait ends as soon as one arrives, so the generous
+    /// timeout only matters on a starved runner. If none arrives: on CI (`CI` set)
+    /// the test fails, since a silent skip would drop NetworkMonitor coverage and
+    /// make the coverage baseline non-deterministic; elsewhere it skips.
+    private func requireRealPath() throws -> NWPath {
+        if let path = waitForRealPath() { return path }
+        let message = "No NWPath delivered within timeout — cannot exercise mapPathToStatus without a live path"
+        if ProcessInfo.processInfo.environment["CI"] != nil {
+            throw NSError(domain: "NetworkMonitorTests", code: 1, userInfo: [NSLocalizedDescriptionKey: message])
         }
+        throw XCTSkip(message)
+    }
+
+    func testMapPathToStatus_RealPathProducesConsistentIsOnline() throws {
+        let path = try requireRealPath()
 
         let status = NetworkMonitor.mapPathToStatus(path)
 
@@ -61,9 +72,7 @@ final class NetworkMonitorTests: XCTestCase {
     }
 
     func testMapPathToStatus_RealPathTypeMatchesActualInterface() throws {
-        guard let path = waitForRealPath() else {
-            throw XCTSkip("No NWPath delivered within timeout — cannot exercise mapPathToStatus without a live path")
-        }
+        let path = try requireRealPath()
 
         let status = NetworkMonitor.mapPathToStatus(path)
 
@@ -86,9 +95,7 @@ final class NetworkMonitorTests: XCTestCase {
     }
 
     func testMapPathToStatus_IsPureAndDeterministicForSamePath() throws {
-        guard let path = waitForRealPath() else {
-            throw XCTSkip("No NWPath delivered within timeout — cannot exercise mapPathToStatus without a live path")
-        }
+        let path = try requireRealPath()
 
         let first = NetworkMonitor.mapPathToStatus(path)
         let second = NetworkMonitor.mapPathToStatus(path)

package/dist/native/iosnativeWebView/Sources/Core/Plugins/PluginBridge.swift

@@ -56,9 +56,24 @@ final class PluginBridge: NSObject {
         let proxy = WeakScriptMessageHandler(delegate: self)
         userContentController.add(proxy, name: bridgeName)
         messageHandlerProxy = proxy
+        userContentController.addUserScript(Self.pluginManifestScript(pluginToCommands))
         isRegistered = true
     }
 
+    /// Runs before any page script so JS can feature-detect an optional native plugin synchronously
+    /// (WKScriptMessage has no return value): `window.CatalystPlugins["io.catalyst.ai"]` is the plugin's
+    /// command list when it was composed into this build, and undefined otherwise.
+    static func pluginManifestScript(_ pluginToCommands: [String: Set<String>]) -> WKUserScript {
+        let manifest = pluginToCommands.mapValues { $0.sorted() }
+        let json = (try? JSONSerialization.data(withJSONObject: manifest, options: [.sortedKeys]))
+            .flatMap { String(data: $0, encoding: .utf8) } ?? "{}"
+        return WKUserScript(
+            source: "window.CatalystPlugins = \(json);",
+            injectionTime: .atDocumentStart,
+            forMainFrameOnly: true
+        )
+    }
+
     func unregister() {
         guard isRegistered else { return }
         webView?.configuration.userContentController.removeScriptMessageHandler(forName: bridgeName)

package/dist/native/iosnativeWebView/iosnativeWebViewTests/PluginBridgeTests.swift

@@ -19,6 +19,29 @@ final class PluginBridgeTests: XCTestCase {
         bridge.register()
     }
 
+    @MainActor
+    func testRegister_InjectsPluginManifestAtDocumentStart() throws {
+        let scripts = mockWebView.configuration.userContentController.userScripts
+        let manifest = try XCTUnwrap(scripts.first { $0.source.hasPrefix("window.CatalystPlugins = ") })
+        XCTAssertEqual(manifest.injectionTime, .atDocumentStart)
+        XCTAssertTrue(manifest.isForMainFrameOnly)
+    }
+
+    func testPluginManifestScript_ListsPluginsWithSortedCommands() {
+        let script = PluginBridge.pluginManifestScript([
+            "io.catalyst.ai": ["initAI", "clearConversation"],
+            "io.catalyst.device_info": ["getDeviceInfo"],
+        ])
+        XCTAssertEqual(
+            script.source,
+            #"window.CatalystPlugins = {"io.catalyst.ai":["clearConversation","initAI"],"io.catalyst.device_info":["getDeviceInfo"]};"#
+        )
+    }
+
+    func testPluginManifestScript_NoPlugins_DefinesEmptyObject() {
+        XCTAssertEqual(PluginBridge.pluginManifestScript([:]).source, "window.CatalystPlugins = {};")
+    }
+
     @MainActor
     override func tearDown() {
         bridge.unregister()

package/dist/native/pluginComposerIos.js

@@ -406,11 +406,15 @@ enum GeneratedPluginIndex {
 }
 function composeIosPlugins({
   corePluginsRoot,
+  externalPluginRoots = [],
   iosProjectPath,
   pluginConfig,
   log
 }) {
-  const discovered = discoverInternalPlugins(corePluginsRoot, log);
+  // externalPluginRoots: plugin directories shipped by npm packages (e.g. catalyst-ai's
+  // plugins/ai), same manifest format as the internal plugins. They flow through the same
+  // validation/toggle/dependency/entitlement path, so a clash with an internal plugin id fails loudly.
+  const discovered = [...discoverInternalPlugins(corePluginsRoot, log), ...externalPluginRoots.flatMap(root => discoverInternalPlugins(root, log))];
   validatePlugins(discovered);
   const enabled = selectPluginsByConfig(discovered, pluginConfig, log);
   const selected = selectPluginsForPlatform(enabled, "ios", log);

package/dist/server/expressServer.js

@@ -127,6 +127,7 @@ function serveBuildFile(app, buildPath, urlPath, fileName, headers = {}) {
     const filePath = path.join(buildPath, fileName);
     if (!fs.existsSync(filePath)) return next();
     res.set(headers);
+    // nosemgrep: javascript.express.security.audit.express-res-sendfile.express-res-sendfile - filePath is buildPath joined with a hardcoded literal fileName (see serveBuildFile call sites), never request-derived.
     res.sendFile(filePath);
   });
 }

package/mcp_v2/conversion-tasks.json

@@ -10,7 +10,7 @@
             "field: WEBVIEW_CONFIG must be present",
             "field: API_URL must be present"
         ],
-        "fix_guide": "Create config/config.json with: { NODE_SERVER_PORT: 3000, API_URL: 'https://api.example.com', CLIENT_ENV_KEYS: [], PUBLIC_STATIC_ASSET_URL: '', WEBVIEW_CONFIG: { port: 3000, accessControl: { enabled: true, allowedUrls: [] } } }",
+        "fix_guide": "Create config/config.json with: { NODE_SERVER_HOSTNAME: 'localhost', NODE_SERVER_PORT: 3005, BUILD_OUTPUT_PATH: 'build', PUBLIC_STATIC_ASSET_PATH: '/assets/', PUBLIC_STATIC_ASSET_URL: 'http://localhost:3005', API_URL: 'https://api.example.com', CLIENT_ENV_VARIABLES: ['API_URL'], WEBVIEW_CONFIG: { port: 3005, accessControl: { enabled: true, allowedUrls: [] } } }. From 1.0.0, catalyst start/build/serve exit before starting when NODE_SERVER_HOSTNAME, NODE_SERVER_PORT, BUILD_OUTPUT_PATH, PUBLIC_STATIC_ASSET_PATH, PUBLIC_STATIC_ASSET_URL or CLIENT_ENV_VARIABLES is missing. Before 1.0.0, also include WEBPACK_DEV_SERVER_HOSTNAME, WEBPACK_DEV_SERVER_PORT and ANALYZE_BUNDLE. On 1.0.0+ they are no longer read and can be removed.",
         "verify_hint": "Run `npm run start` on Catalyst 0.3.x, or `npm run devServe` on legacy 0.2.x. The server should start without config errors.",
         "depends_on": []
     },
@@ -21,9 +21,10 @@
         "detect_pattern": "package_json_dep",
         "how_to_check": [
             "Catalyst 0.2.x: package.json includes @tata1mg/router and Catalyst router APIs import from it",
-            "Catalyst 0.3.x+: package.json does not include @tata1mg/router and Catalyst router APIs import from catalyst-core"
+            "Catalyst 0.3.x: package.json does not include @tata1mg/router and router APIs import from catalyst-core",
+            "Catalyst 1.0.0+: package.json does not include @tata1mg/router, includes react-router ^7.18.2, and router names import from react-router"
         ],
-        "fix_guide": "Version-specific: for Catalyst 0.2.x install @tata1mg/router and import RouterDataProvider, Outlet, navigation, and data hooks from it. For Catalyst 0.3.x+, remove @tata1mg/router and import those APIs from catalyst-core. Never mix the two router generations.",
+        "fix_guide": "Version-specific: for Catalyst 0.2.x install @tata1mg/router and import RouterDataProvider, Outlet, navigation, and data hooks from it. For Catalyst 0.3.x, remove @tata1mg/router and import those APIs from catalyst-core. For Catalyst 1.0.0+, remove @tata1mg/router, add react-router ^7.18.2, import RouterDataProvider, MetaTag and useCurrentRouteData from catalyst-core, and import Outlet, Link, navigation hooks and every other router name from react-router. Never mix router generations.",
         "verify_hint": "Run the development command for the installed generation. Confirm there are no unresolved router imports, duplicate React-element errors, or blank route outlets.",
         "depends_on": ["T1_CONFIG"]
     },
@@ -68,7 +69,7 @@
             "signal: files with .serverFetcher = or .clientFetcher = (converted pages)",
             "llm judges: is any useEffect+fetch file a page component that needs conversion?"
         ],
-        "fix_guide": "For each page component: remove initial useEffect data loading, attach serverFetcher/clientFetcher statics, and read route data with useCurrentRouteData(). Import the hook from @tata1mg/router on 0.2.x or catalyst-core on 0.3.x+.",
+        "fix_guide": "For each page component: remove initial useEffect data loading, attach serverFetcher/clientFetcher statics, and read route data with useCurrentRouteData(). Import the hook from @tata1mg/router on 0.2.x or catalyst-core on 0.3.x and 1.0.0+.",
         "verify_hint": "Open a migrated page in browser. Open DevTools Network tab — on first load there should be NO XHR/fetch calls for page data (data arrives server-rendered in HTML). View Page Source and confirm the page content (not just a loading skeleton) is present in the raw HTML. If content is missing from source, serverFetcher is not attached or not running.",
         "depends_on": ["T3_ROUTES_FILE"]
     },
@@ -81,7 +82,7 @@
             "file: src/js/routes/utils.js must exist",
             "pattern: RouterDataProvider must be imported and used in utils.js"
         ],
-        "fix_guide": "Create src/js/routes/utils.js using the CCA preparedRoutes pattern. Import RouterDataProvider and MetaTag from @tata1mg/router on 0.2.x or catalyst-core on 0.3.x+. Wrap App and pass routerInitialState plus fetcherArgs when a store is used.",
+        "fix_guide": "Create src/js/routes/utils.js using the CCA preparedRoutes pattern. Import RouterDataProvider and MetaTag from @tata1mg/router on 0.2.x or catalyst-core on 0.3.x and 1.0.0+. Wrap App and pass routerInitialState plus fetcherArgs when a store is used.",
         "verify_hint": "In a page component that uses useCurrentRouteData(), console.log the return value. It should be the data object returned by serverFetcher — not undefined. If undefined, RouterDataProvider is not wrapping the tree or the route entry is missing the component reference.",
         "depends_on": ["T3_ROUTES_FILE"]
     },
@@ -92,10 +93,10 @@
         "detect_pattern": "file_exists + code_pattern",
         "how_to_check": [
             "file: src/js/containers/App/index.js must exist",
-            "pattern: Outlet comes from @tata1mg/router on 0.2.x or catalyst-core on 0.3.x+",
+            "pattern: Outlet comes from @tata1mg/router on 0.2.x, catalyst-core on 0.3.x, or react-router on 1.0.0+",
             "pattern: <Outlet /> must be rendered in the component"
         ],
-        "fix_guide": "Render <Outlet /> where route content belongs. Import it from @tata1mg/router on Catalyst 0.2.x or catalyst-core on 0.3.x+. Keep global layout around the outlet.",
+        "fix_guide": "Render <Outlet /> where route content belongs. Import it from @tata1mg/router on Catalyst 0.2.x, catalyst-core on 0.3.x, or react-router on 1.0.0+ (catalyst-core no longer re-exports it). Keep global layout around the outlet.",
         "verify_hint": "Open the app in browser. Global layout (header, footer, nav) should appear on every page. The area where page content changes should not be blank. If page content area is empty, <Outlet /> is missing or placed incorrectly in the App shell.",
         "depends_on": ["T5_ROUTER_DATA_PROVIDER"]
     },
@@ -125,10 +126,10 @@
             "pattern: client/index.js must call WebBridge.init()",
             "pattern: client/index.js must use hydrateRoot from 'react-dom/client' (not ReactDOM.render or hydrate)",
             "pattern: client/index.js must import clientRouter from 'catalyst-core/router/ClientRouter'",
-            "pattern: RouterProvider comes from @tata1mg/router on 0.2.x or catalyst-core on 0.3.x+",
+            "pattern: RouterProvider comes from @tata1mg/router on 0.2.x, catalyst-core on 0.3.x, or react-router/dom on 1.0.0+",
             "pattern: 0.2.x waits for loadableReady; 0.3.x+ waits for hydrationReady"
         ],
-        "fix_guide": "Use hydrateRoot and initialize WebBridge before hydration. On 0.2.x, import RouterProvider from @tata1mg/router and wait for loadableReady from @loadable/component. On 0.3.x+, import RouterProvider and hydrationReady from catalyst-core, then call hydrationReady().then(() => hydrateRoot(...)). Do not retain @loadable/component in the Vite runtime.",
+        "fix_guide": "Use hydrateRoot and initialize WebBridge before hydration. On 0.2.x, import RouterProvider from @tata1mg/router and wait for loadableReady from @loadable/component. On 0.3.x, import RouterProvider and hydrationReady from catalyst-core. On 1.0.0+, import hydrationReady from catalyst-core and RouterProvider from react-router/dom (not react-router: only the /dom export passes flushSync to the router). Then call hydrationReady().then(() => hydrateRoot(...)). Do not retain @loadable/component in the Vite runtime.",
         "verify_hint": "Open the app in browser. Open DevTools Console — there should be no 'hydrateRoot' mismatch warnings (if there are, server HTML and client render differ). Open DevTools Elements — the #app or #root div should have React content inside it (not empty). Click an interactive element — if nothing responds, hydration failed. Also confirm global styles are applied (CSS loads).",
         "depends_on": ["T6_APP_SHELL"]
     },