sinapse-ai 1.19.2 → 1.20.1

package/packages/installer/src/installer/file-hasher.js

@@ -62,24 +62,29 @@ function removeBOM(content) {
  * @throws {Error} - If file cannot be read
  */
 function hashFile(filePath) {
-  if (!fs.existsSync(filePath)) {
-    throw new Error(`File not found: ${filePath}`);
-  }
-
-  const stats = fs.statSync(filePath);
-  if (stats.isDirectory()) {
-    throw new Error(`Cannot hash directory: ${filePath}`);
+  // SECURITY [TOCTOU]: single read — the hashed bytes are exactly what was
+  // read, with no exists/stat/read window for a concurrent writer to exploit.
+  let raw;
+  try {
+    raw = fs.readFileSync(filePath);
+  } catch (error) {
+    if (error.code === 'ENOENT') {
+      throw new Error(`File not found: ${filePath}`);
+    }
+    if (error.code === 'EISDIR') {
+      throw new Error(`Cannot hash directory: ${filePath}`);
+    }
+    throw error;
   }
 
   let content;
 
   if (isBinaryFile(filePath)) {
     // Binary files: hash raw bytes
-    content = fs.readFileSync(filePath);
+    content = raw;
   } else {
     // Text files: normalize line endings and remove BOM
-    const rawContent = fs.readFileSync(filePath, 'utf8');
-    const withoutBOM = removeBOM(rawContent);
+    const withoutBOM = removeBOM(raw.toString('utf8'));
     const normalized = normalizeLineEndings(withoutBOM);
     content = Buffer.from(normalized, 'utf8');
   }
@@ -96,25 +101,28 @@ function hashFile(filePath) {
  * @throws {Error} - If file cannot be read
  */
 async function hashFileAsync(filePath) {
-  const exists = await fs.pathExists(filePath);
-  if (!exists) {
-    throw new Error(`File not found: ${filePath}`);
-  }
-
-  const stats = await fs.stat(filePath);
-  if (stats.isDirectory()) {
-    throw new Error(`Cannot hash directory: ${filePath}`);
+  // SECURITY [TOCTOU]: single read (see hashFile) — no exists/stat/read window.
+  let raw;
+  try {
+    raw = await fs.readFile(filePath);
+  } catch (error) {
+    if (error.code === 'ENOENT') {
+      throw new Error(`File not found: ${filePath}`);
+    }
+    if (error.code === 'EISDIR') {
+      throw new Error(`Cannot hash directory: ${filePath}`);
+    }
+    throw error;
   }
 
   let content;
 
   if (isBinaryFile(filePath)) {
     // Binary files: hash raw bytes
-    content = await fs.readFile(filePath);
+    content = raw;
   } else {
     // Text files: normalize line endings and remove BOM
-    const rawContent = await fs.readFile(filePath, 'utf8');
-    const withoutBOM = removeBOM(rawContent);
+    const withoutBOM = removeBOM(raw.toString('utf8'));
     const normalized = normalizeLineEndings(withoutBOM);
     content = Buffer.from(normalized, 'utf8');
   }

package/packages/installer/src/installer/manifest-signature.js

@@ -285,82 +285,94 @@ function signatureExists(manifestPath) {
  * @param {Object} [options.publicKey] - Override public key (testing only)
  * @returns {Object} { content: Buffer, verified: boolean, error: string|null }
  */
-function loadAndVerifyManifest(manifestPath, options = {}) {
-  const requireSignature = options.requireSignature !== false;
-  const signaturePath = manifestPath + '.minisig';
-
-  // Check manifest exists
-  if (!fs.existsSync(manifestPath)) {
+/**
+ * Open + fstat + read on a SINGLE file descriptor.
+ *
+ * SECURITY [TOCTOU]: size check (DoS guard) and read happen on the same open
+ * fd, so a concurrent writer cannot swap the file between the check and the
+ * use — the buffer verified downstream is exactly the bytes that were sized.
+ *
+ * @param {string} filePath - File to read
+ * @param {number} maxSize - Maximum allowed size in bytes
+ * @param {string} label - Human label used in error messages (e.g. "Manifest file")
+ * @returns {{content: Buffer|null, error: string|null, missing: boolean}}
+ */
+function readFileCapped(filePath, maxSize, label) {
+  let fd;
+  try {
+    fd = fs.openSync(filePath, 'r');
+  } catch (error) {
     return {
       content: null,
-      verified: false,
-      error: 'Manifest file not found',
+      error: `Cannot read ${label.toLowerCase()}: ${error.message}`,
+      missing: error.code === 'ENOENT',
     };
   }
-
-  // SECURITY [DOS-1]: Check manifest file size BEFORE reading into memory
-  // This prevents DoS attacks via oversized manifest files
-  let manifestStat;
   try {
-    manifestStat = fs.statSync(manifestPath);
+    const stat = fs.fstatSync(fd);
+    if (stat.size > maxSize) {
+      return {
+        content: null,
+        error: `${label} exceeds maximum size (${maxSize} bytes)`,
+        missing: false,
+      };
+    }
+    const content = Buffer.alloc(stat.size);
+    fs.readSync(fd, content, 0, stat.size, 0);
+    return { content, error: null, missing: false };
   } catch (error) {
     return {
       content: null,
-      verified: false,
-      error: `Cannot stat manifest file: ${error.message}`,
+      error: `Cannot read ${label.toLowerCase()}: ${error.message}`,
+      missing: false,
     };
+  } finally {
+    fs.closeSync(fd);
   }
+}
 
-  if (manifestStat.size > SignatureLimits.MAX_MANIFEST_SIZE) {
+function loadAndVerifyManifest(manifestPath, options = {}) {
+  const requireSignature = options.requireSignature !== false;
+  const signaturePath = manifestPath + '.minisig';
+
+  // SECURITY [DOS-1] + [TOCTOU]: size is validated on the same fd that is
+  // read, so the verified buffer cannot be swapped after the check.
+  const manifest = readFileCapped(manifestPath, SignatureLimits.MAX_MANIFEST_SIZE, 'Manifest file');
+  if (manifest.content === null) {
     return {
       content: null,
       verified: false,
-      error: `Manifest file exceeds maximum size (${SignatureLimits.MAX_MANIFEST_SIZE} bytes)`,
+      error: manifest.missing ? 'Manifest file not found' : manifest.error,
     };
   }
 
-  // Check signature exists
-  if (!fs.existsSync(signaturePath)) {
-    if (requireSignature) {
+  // SECURITY [DOS-2] + [TOCTOU]: same single-fd pattern for the signature
+  const signature = readFileCapped(signaturePath, SignatureLimits.MAX_SIGNATURE_SIZE, 'Signature file');
+  if (signature.content === null) {
+    if (signature.missing) {
+      if (requireSignature) {
+        return {
+          content: null,
+          verified: false,
+          error: 'Manifest signature file not found (.minisig)',
+        };
+      }
+      // Allow unsigned in dev mode (requireSignature=false)
       return {
-        content: null,
+        content: manifest.content,
         verified: false,
-        error: 'Manifest signature file not found (.minisig)',
+        error: null,
       };
     }
-    // Allow unsigned in dev mode (requireSignature=false)
-    // Size already validated above
-    return {
-      content: fs.readFileSync(manifestPath),
-      verified: false,
-      error: null,
-    };
-  }
-
-  // SECURITY [DOS-2]: Check signature file size BEFORE reading
-  // Signature files should be small (~200 bytes typical)
-  let signatureStat;
-  try {
-    signatureStat = fs.statSync(signaturePath);
-  } catch (error) {
-    return {
-      content: null,
-      verified: false,
-      error: `Cannot stat signature file: ${error.message}`,
-    };
-  }
-
-  if (signatureStat.size > SignatureLimits.MAX_SIGNATURE_SIZE) {
     return {
       content: null,
       verified: false,
-      error: `Signature file exceeds maximum size (${SignatureLimits.MAX_SIGNATURE_SIZE} bytes)`,
+      error: signature.error,
     };
   }
 
-  // Load files - sizes validated above
-  const manifestContent = fs.readFileSync(manifestPath);
-  const signatureContent = fs.readFileSync(signaturePath, 'utf8');
+  const manifestContent = manifest.content;
+  const signatureContent = signature.content.toString('utf8');
 
   // Verify signature BEFORE any parsing
   const verifyResult = verifyManifestSignature(manifestContent, signatureContent, options);

package/packages/installer/src/installer/post-install-validator.js

@@ -456,21 +456,30 @@ class PostInstallValidator {
     // Development mode: signature not required (NOT for production)
     this.log('WARNING: Signature verification disabled - development mode only');
     try {
-      // SECURITY [DOS-3]: Check file size BEFORE reading into memory
-      const manifestStat = fs.statSync(manifestPath);
-      if (manifestStat.size > SecurityLimits.MAX_MANIFEST_SIZE) {
-        this.issues.push({
-          type: IssueType.INVALID_MANIFEST,
-          severity: Severity.CRITICAL,
-          message: 'Manifest file exceeds maximum size',
-          details: `Size: ${manifestStat.size} bytes, Max: ${SecurityLimits.MAX_MANIFEST_SIZE} bytes`,
-          remediation: 'Use a valid manifest file from the official source',
-          relativePath: null,
-        });
-        return null;
-      }
+      // SECURITY [DOS-3] + [TOCTOU]: fstat + read on the same open fd, so the
+      // size check and the parsed bytes refer to the same file version.
+      const fd = fs.openSync(manifestPath, 'r');
+      let content;
+      try {
+        const manifestStat = fs.fstatSync(fd);
+        if (manifestStat.size > SecurityLimits.MAX_MANIFEST_SIZE) {
+          this.issues.push({
+            type: IssueType.INVALID_MANIFEST,
+            severity: Severity.CRITICAL,
+            message: 'Manifest file exceeds maximum size',
+            details: `Size: ${manifestStat.size} bytes, Max: ${SecurityLimits.MAX_MANIFEST_SIZE} bytes`,
+            remediation: 'Use a valid manifest file from the official source',
+            relativePath: null,
+          });
+          return null;
+        }
 
-      const content = fs.readFileSync(manifestPath, 'utf8');
+        const buf = Buffer.alloc(manifestStat.size);
+        fs.readSync(fd, buf, 0, manifestStat.size, 0);
+        content = buf.toString('utf8');
+      } finally {
+        fs.closeSync(fd);
+      }
       return this.parseManifestContent(content);
     } catch (error) {
       this.issues.push({
@@ -1394,9 +1403,7 @@ class PostInstallValidator {
  */
 function formatReport(report, options = {}) {
   const useColors = options.colors !== false;
-  // Note: detailed option is parsed from CLI but detailed view is handled by caller
-  // eslint-disable-next-line no-unused-vars
-  const detailed = options.detailed === true;
+  // Note: options.detailed is parsed from CLI but the detailed view is handled by the caller
 
   const c = {
     reset: useColors ? '\x1b[0m' : '',

package/packages/installer/src/installer/synapse-runtime-installer.js

@@ -0,0 +1,148 @@
+/**
+ * SYNAPSE Context-Engine Runtime Installer
+ *
+ * Story onda2-p9 (DEC-01 option A) — activates the context engine for every
+ * installed project. The synapse-engine.cjs hook is ALREADY copied + registered
+ * by every install (wizard/ide-config-generator.js HOOKS_TO_COPY + HOOK_EVENT_MAP),
+ * but it dies on an early-return when `<project>/.synapse/` does not exist
+ * (.sinapse-ai/core/synapse/runtime/hook-runtime.js — `if (!fs.existsSync(synapsePath)) return null;`).
+ * This module closes that gap on the CANONICAL install path (install + init)
+ * by generating the `.synapse/` runtime in the target project:
+ *
+ *   .synapse/constitution   — L0 domain (KEY=VALUE), generated from the target's
+ *                             own .sinapse-ai/constitution.md by the EXISTING
+ *                             generator (core/synapse/scripts/generate-constitution.js
+ *                             — reused via main({ projectRoot }), never duplicated)
+ *   .synapse/sessions/      — per-session state (session-manager also auto-creates)
+ *   .synapse/metrics/       — engine injection metrics
+ *
+ * FAIL-OPEN CONTRACT (NON-NEGOTIABLE for this step): any error here must NEVER
+ * break the installation. The function never throws — it returns
+ * { success: false, error } and the caller logs a warning and continues.
+ * This is safe because the hook itself is fail-safe by design: in the absence
+ * of .synapse/ (or of a readable constitution) hook-runtime.js returns null and
+ * NOTHING is injected — the engine simply stays dormant, exactly the pre-P9
+ * behavior. Worst case of a generation failure = status quo ante.
+ *
+ * @module installer/synapse-runtime-installer
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+/**
+ * Relative path (from a project root) to the constitution generator that ships
+ * inside the framework core.
+ * @constant {string[]}
+ */
+const GENERATOR_REL_PATH = [
+  '.sinapse-ai', 'core', 'synapse', 'scripts', 'generate-constitution.js',
+];
+
+/**
+ * Resolve the generate-constitution.js module to use for a given target.
+ *
+ * Preference order:
+ *   1. The TARGET's own copy (installed by installSinapseCore just before this
+ *      step) — version-matched with the .sinapse-ai/ payload the project got.
+ *      In framework-dev mode (target === package root) this IS the source copy.
+ *   2. The package's own copy — fallback for partial copies.
+ *
+ * @param {string} targetDir - Target project root
+ * @returns {string|null} Absolute path to the generator, or null if none found
+ */
+function resolveGeneratorPath(targetDir) {
+  const targetCopy = path.join(targetDir, ...GENERATOR_REL_PATH);
+  if (fs.existsSync(targetCopy)) return targetCopy;
+
+  // packages/installer/src/installer/ → package root
+  const packageCopy = path.join(__dirname, '..', '..', '..', '..', ...GENERATOR_REL_PATH);
+  if (fs.existsSync(packageCopy)) return packageCopy;
+
+  return null;
+}
+
+/**
+ * Generate the `.synapse/` context-engine runtime in the target project.
+ *
+ * Never throws. Silences the generator's own console.log and preserves
+ * process.exitCode (the underlying generator sets exitCode=1 on a miss, which
+ * must not leak into the installer's exit semantics — same protection the
+ * repo-source wrapper scripts/generate-synapse-runtime.js applies).
+ *
+ * @param {Object} [options]
+ * @param {string} [options.targetDir=process.cwd()] - Target project root
+ * @param {string} [options.generatorPath] - Override generator module (tests)
+ * @returns {{success: boolean, articles?: number, rules?: number, outputPath?: string, error?: string, sessionsDir?: string, metricsDir?: string}}
+ */
+function installSynapseRuntime(options = {}) {
+  const { targetDir = process.cwd() } = options;
+  const savedExitCode = process.exitCode;
+  const origLog = console.log;
+  const origError = console.error;
+
+  try {
+    const generatorPath = options.generatorPath || resolveGeneratorPath(targetDir);
+    if (!generatorPath) {
+      return {
+        success: false,
+        error: 'generate-constitution.js not found (target and package copies missing)',
+      };
+    }
+
+    // Silence the generator's console output ("Constitution generated…" /
+    // "Constitution not found…") — the wizard prints its own summary line.
+    console.log = () => {};
+    console.error = () => {};
+
+    let result;
+    try {
+      const { main } = require(generatorPath);
+      if (typeof main !== 'function') {
+        return { success: false, error: 'generator module has no main() export' };
+      }
+      result = main({ projectRoot: targetDir });
+    } finally {
+      console.log = origLog;
+      console.error = origError;
+    }
+
+    if (!result || !result.success) {
+      return {
+        success: false,
+        error: (result && result.error) || 'constitution generation failed',
+      };
+    }
+
+    // sessions/ + metrics/ — mirrors the repo-source .synapse/ layout. The
+    // session-manager also mkdir -p's sessions/ lazily, but creating them here
+    // gives the installed project the complete structure from prompt zero.
+    const sessionsDir = path.join(targetDir, '.synapse', 'sessions');
+    const metricsDir = path.join(targetDir, '.synapse', 'metrics');
+    fs.mkdirSync(sessionsDir, { recursive: true });
+    fs.mkdirSync(metricsDir, { recursive: true });
+
+    return {
+      success: true,
+      articles: result.articles,
+      rules: result.rules,
+      outputPath: result.outputPath,
+      sessionsDir,
+      metricsDir,
+    };
+  } catch (err) {
+    return { success: false, error: (err && err.message) || String(err) };
+  } finally {
+    // The generator sets process.exitCode = 1 on a miss; restore whatever the
+    // installer process had (fail-open: a dormant engine is not an install error).
+    process.exitCode = savedExitCode;
+    console.log = origLog;
+    console.error = origError;
+  }
+}
+
+module.exports = {
+  installSynapseRuntime,
+  resolveGeneratorPath,
+  GENERATOR_REL_PATH,
+};

package/packages/installer/src/merger/parsers/markdown-section-parser.js

@@ -140,8 +140,9 @@ function parseMarkdownSections(content) {
       result.preamble.push(line);
     } else if (currentSection) {
       currentSection.lines.push(line);
-    } else if (!sinapseSection) {
-      // Content after an SINAPSE section but before next section
+    } else {
+      // Content after an SINAPSE section but before next section (sinapseSection
+      // is always null here — the in-section branch above `continue`s).
       // This shouldn't happen in well-formed files, but handle it
       result.preamble.push(line);
     }

package/packages/installer/src/updater/index.js

@@ -780,11 +780,17 @@ class SINAPSEUpdater {
   /**
    * Log if verbose
    *
+   * Messages may interpolate error text or npm registry responses; control
+   * characters (ANSI escapes, CR) are stripped so external data cannot forge
+   * log lines in the user's terminal (CWE-117).
+   *
    * @param {string} message - Message
    */
   log(message) {
     if (this.options.verbose) {
-      console.log(`[SINAPSEUpdater] ${message}`);
+      // eslint-disable-next-line no-control-regex
+      const sanitized = String(message).replace(/[\x00-\x08\x0B-\x1F\x7F]/g, '');
+      console.log(`[SINAPSEUpdater] ${sanitized}`);
     }
   }
 }

package/packages/installer/src/utils/atomic-write.js

@@ -0,0 +1,35 @@
+/**
+ * Atomic write bridge — Onda B2 (AF-20260703)
+ *
+ * Thin pointer to the canonical tmp+rename util in
+ * `.sinapse-ai/core/synapse/utils/atomic-write.js` (ships in the same npm
+ * package as this workspace). Fail-open: if the canonical util can't be
+ * resolved, fall back to a plain write (the pre-hardening behavior) rather
+ * than breaking the installer.
+ *
+ * @module src/utils/atomic-write
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+let _atomicWriteSync = null;
+try {
+  // packages/installer/src/utils → repo/package root is 4 levels up
+  _atomicWriteSync = require(path.join(
+    __dirname, '..', '..', '..', '..',
+    '.sinapse-ai', 'core', 'synapse', 'utils', 'atomic-write',
+  )).atomicWriteSync;
+} catch { /* fallback below */ }
+
+function atomicWriteFileSync(filePath, data, encoding = 'utf8') {
+  if (_atomicWriteSync) {
+    _atomicWriteSync(filePath, data, encoding);
+  } else {
+    fs.writeFileSync(filePath, data, encoding);
+  }
+}
+
+module.exports = { atomicWriteFileSync };