synabun 1.3.0 → 2.0.0

package/neural-interface/lib/system-restore.js

@@ -0,0 +1,99 @@
+import { createWriteStream, existsSync, mkdirSync, readdirSync, rmSync, statSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { basename, isAbsolute, join, relative, resolve } from 'node:path';
+import { pipeline } from 'node:stream/promises';
+import { isLockOnlyDataFile } from './backup-service.js';
+
+/**
+ * Helpers for POST /api/system/restore{,/preview}.
+ *
+ * The upload used to be buffered by express.raw (1 GB cap) and opened with
+ * AdmZip, so a data home past 1 GB could not be restored from the UI at all.
+ * It now streams to a staging file and is read with backup-zip-reader.
+ */
+
+export function pathIsInside(candidate, parent) {
+  const rel = relative(resolve(parent), resolve(candidate));
+  return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));
+}
+
+const STALE_UPLOAD_MS = 60 * 60 * 1000;
+
+/** Stream the request body to a fresh file under `stagingDir`; returns its path and size. */
+export async function saveRestoreUpload(req, stagingDir) {
+  mkdirSync(stagingDir, { recursive: true });
+  // A restore killed mid-upload never reaches its finally; reclaim its file.
+  for (const name of readdirSync(stagingDir)) {
+    const path = join(stagingDir, name);
+    try { if (Date.now() - statSync(path).mtimeMs > STALE_UPLOAD_MS) rmSync(path, { recursive: true, force: true }); } catch {}
+  }
+  const path = join(stagingDir, `upload-${process.pid}-${Date.now()}-${randomBytes(4).toString('hex')}.zip`);
+  try {
+    await pipeline(req, createWriteStream(path, { flags: 'wx' }));
+  } catch (error) {
+    rmSync(path, { force: true });
+    throw error;
+  }
+  return { path, sizeBytes: statSync(path).size };
+}
+
+export function removeRestoreUpload(upload) {
+  if (upload?.path && existsSync(upload.path)) rmSync(upload.path, { force: true });
+}
+
+/**
+ * Map one archive-relative path (`data/x.json`, `skins/y/skin.css`, …) to the
+ * file it restores. Returns null for paths the mode does not restore and
+ * `{ unsafe: true }` for a path that would escape its root (zip-slip).
+ *
+ * A lock-only file of a data folder (the rules installer's writer lock and
+ * its SQLite side files, backup-service.js) is never restored, whatever the
+ * archive holds: extracting it would rename another file over the one a
+ * running server holds its lock on. The live file is not touched in any way.
+ */
+export function restoreTargetFor(rel, roots) {
+  if (rel === 'claude-settings.json') {
+    return roots.claudeSettings ? { target: resolve(roots.claudeSettings) } : null;
+  }
+  const dataRoots = new Set(['data/', 'mcp-data/']);
+  const mappings = [
+    ['data/', roots.data],
+    ['mcp-data/', roots.mcpData],
+    ['global-skills/', roots.globalSkills],
+    ['global-agents/', roots.globalAgents],
+    ['bundled-skills/', roots.bundledSkills],
+    ['skins/', roots.skins],
+  ];
+  for (const [prefix, root] of mappings) {
+    if (!rel.startsWith(prefix) || rel === prefix) continue;
+    if (!root) return null;
+    const subPath = rel.slice(prefix.length);
+    const target = resolve(root, subPath);
+    if (subPath.includes('\0') || isAbsolute(subPath) || target === resolve(root) || !pathIsInside(target, root)) {
+      return { unsafe: true };
+    }
+    // By the name the write would land on, so `data/x/../rulesets-lock.db` and another letter case count too.
+    if (dataRoots.has(prefix) && isLockOnlyDataFile(basename(target))) return null;
+    return { target };
+  }
+  return null;
+}
+
+/**
+ * Plan every file write for a restore before touching disk, so one unsafe
+ * entry rejects the whole archive instead of half-applying it.
+ */
+export function planRestoreWrites(zip, prefix, roots) {
+  const writes = [];
+  const unsafe = [];
+  const lead = prefix ? `${prefix}/` : '';
+  for (const entry of zip.entries) {
+    if (entry.isDirectory || !entry.name.startsWith(lead)) continue;
+    const rel = entry.name.slice(lead.length);
+    const mapped = restoreTargetFor(rel, roots);
+    if (!mapped) continue;
+    if (mapped.unsafe) unsafe.push(entry.name);
+    else writes.push({ entry, rel, target: mapped.target });
+  }
+  return { writes, unsafe };
+}

package/neural-interface/lib/terminal-env.js

@@ -0,0 +1,86 @@
+// Environment + shell arguments for SynaBun terminals, matching what a native
+// macOS terminal hands its shell: a login shell, a UTF-8 locale, truecolor,
+// and a terminal identity of its own (TERM_PROGRAM) instead of whatever
+// terminal happened to launch the SynaBun server.
+
+import { readFileSync } from 'node:fs';
+import { basename } from 'node:path';
+
+// Identity/session variables that belong to the terminal or IDE the SERVER was
+// started from. Leaking them makes CLIs believe they run inside VS Code, tmux,
+// iTerm2, a nested Claude Code session, etc.
+const STRIP_EXACT = new Set([
+  'TERM_PROGRAM', 'TERM_PROGRAM_VERSION',
+  'CLAUDECODE', 'CLAUDE_CODE_ENTRYPOINT', 'CLAUDE_CODE_SSE_PORT',
+  'TMUX', 'TMUX_PANE', 'STY', 'TERMCAP', 'COLUMNS', 'LINES',
+  'TERM_SESSION_ID', 'LC_TERMINAL', 'LC_TERMINAL_VERSION', 'VTE_VERSION',
+  'WT_SESSION', 'WT_PROFILE_ID',
+  'NODE_CHANNEL_FD', 'NODE_CHANNEL_SERIALIZATION_MODE', 'NODE_UNIQUE_ID',
+]);
+const STRIP_PREFIXES = ['VSCODE_', 'ITERM_', 'KITTY_', 'WEZTERM_', 'GHOSTTY_', 'ALACRITTY_'];
+
+// Shells that accept `-l -c <cmd>` (login + command). tcsh/csh only allow -l
+// as the sole argument, so they keep the plain `-c` wrapper.
+const LOGIN_COMMAND_SHELLS = new Set(['zsh', 'bash', 'sh', 'dash', 'ksh', 'mksh', 'yash', 'fish']);
+
+let _version = null;
+function synabunVersion() {
+  if (_version !== null) return _version;
+  try {
+    _version = String(JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version || '');
+  } catch {
+    _version = '';
+  }
+  return _version;
+}
+
+export function isStrippedTerminalVar(key) {
+  return STRIP_EXACT.has(key) || STRIP_PREFIXES.some(p => key.startsWith(p));
+}
+
+/**
+ * Layering (later wins): cleaned base < terminal identity defaults <
+ * profileEnv (e.g. FORCE_COLOR/TERM for CLI profiles) < extraEnv (loop pins,
+ * CODEX_HOME, ...).
+ */
+export function buildTerminalEnv({
+  base = process.env,
+  profileEnv = {},
+  extraEnv = {},
+  platform = process.platform,
+  version = synabunVersion(),
+  localeFallback = 'en_US.UTF-8',
+} = {}) {
+  const env = {};
+  for (const [k, v] of Object.entries(base || {})) {
+    if (v === undefined || isStrippedTerminalVar(k)) continue;
+    env[k] = v;
+  }
+  env.TERM_PROGRAM = 'SynaBun';
+  if (version) env.TERM_PROGRAM_VERSION = version;
+  env.COLORTERM = 'truecolor';
+  if (platform !== 'win32' && !env.LANG && !env.LC_ALL && !env.LC_CTYPE) {
+    env.LANG = localeFallback;
+  }
+  return { ...env, ...(profileEnv || {}), ...(extraEnv || {}) };
+}
+
+export function shellSupportsLoginCommand(shellPath) {
+  return LOGIN_COMMAND_SHELLS.has(basename(String(shellPath || '')).replace(/\.exe$/i, ''));
+}
+
+/** Interactive shell tab: a login shell, like Terminal.app / iTerm2. */
+export function interactiveShellArgs(platform = process.platform) {
+  return platform === 'win32' ? [] : ['-l'];
+}
+
+/**
+ * CLI tab: run the CLI, then drop into an interactive login shell when it
+ * exits. Login-command shells source the same profile a native terminal would
+ * (PATH from .zprofile, brew shellenv) before the CLI starts.
+ */
+export function cliWrapperArgs(shellPath, cmd, platform = process.platform) {
+  if (platform === 'win32') return ['/k', cmd];
+  if (shellSupportsLoginCommand(shellPath)) return ['-lc', `${cmd}; exec $SHELL -l`];
+  return ['-c', `${cmd}; exec $SHELL`];
+}

package/neural-interface/lib/ui-blob-store.js

@@ -0,0 +1,106 @@
+// ═══════════════════════════════════════════
+// SynaBun Neural Interface — UI Blob Store
+// ═══════════════════════════════════════════
+// Per-entry storage for the fat UI-state keys (rendered transcript snapshots,
+// graph node positions). These used to live inside ui-state.json, which made
+// every state PATCH re-serialize and rewrite multiple megabytes. Here each
+// entry is its own SQLite row, so a streaming session persists only its own
+// ~100-300KB snapshot.
+//
+// Deliberately a SEPARATE database file from memory.db: memory.db is shared
+// cross-process with the MCP server and gets backed up — multi-MB transcript
+// HTML churn would bloat its WAL and backups for no benefit.
+
+import { DatabaseSync } from 'node:sqlite';
+import { dirname } from 'path';
+import { existsSync, mkdirSync } from 'fs';
+
+let db = null;
+let dbPath = null;
+
+export function initBlobStore(path) {
+  dbPath = path;
+  return getBlobDb();
+}
+
+function getBlobDb() {
+  if (!db) {
+    if (!dbPath) throw new Error('ui-blob-store: initBlobStore(path) not called');
+    const dir = dirname(dbPath);
+    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+    db = new DatabaseSync(dbPath);
+    db.exec('PRAGMA journal_mode = WAL');
+    db.exec('PRAGMA busy_timeout = 5000');
+    db.exec(`
+CREATE TABLE IF NOT EXISTS ui_blobs (
+  ns         TEXT NOT NULL,
+  id         TEXT NOT NULL,
+  value      TEXT NOT NULL,
+  updated_at INTEGER NOT NULL,
+  PRIMARY KEY (ns, id)
+);`);
+  }
+  return db;
+}
+
+export function blobGetNamespace(ns) {
+  const d = getBlobDb();
+  const rows = d.prepare('SELECT id, value FROM ui_blobs WHERE ns = ?').all(ns);
+  const out = {};
+  for (const row of rows) {
+    try { out[row.id] = JSON.parse(row.value); } catch { /* skip corrupt row */ }
+  }
+  return out;
+}
+
+export function blobGet(ns, id) {
+  const d = getBlobDb();
+  const row = d.prepare('SELECT value FROM ui_blobs WHERE ns = ? AND id = ?').get(ns, id);
+  if (!row) return null;
+  try { return JSON.parse(row.value); } catch { return null; }
+}
+
+export function blobPut(ns, id, value) {
+  const d = getBlobDb();
+  d.prepare(`
+    INSERT INTO ui_blobs (ns, id, value, updated_at) VALUES (?, ?, ?, ?)
+    ON CONFLICT(ns, id) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at
+  `).run(ns, id, JSON.stringify(value), Date.now());
+}
+
+export function blobDelete(ns, id) {
+  const d = getBlobDb();
+  d.prepare('DELETE FROM ui_blobs WHERE ns = ? AND id = ?').run(ns, id);
+}
+
+export function blobClearNamespace(ns) {
+  const d = getBlobDb();
+  const result = d.prepare('DELETE FROM ui_blobs WHERE ns = ?').run(ns);
+  return Number(result?.changes || 0);
+}
+
+// Evict oldest entries beyond maxEntries and/or beyond maxTotalChars of
+// cumulative value length (newest kept). Returns the evicted ids.
+export function blobPrune(ns, { maxEntries = 0, maxTotalChars = 0 } = {}) {
+  const d = getBlobDb();
+  const rows = d.prepare(
+    'SELECT id, LENGTH(value) AS len FROM ui_blobs WHERE ns = ? ORDER BY updated_at DESC'
+  ).all(ns);
+  const evicted = [];
+  let totalChars = 0;
+  rows.forEach((row, i) => {
+    totalChars += row.len;
+    const overCount = maxEntries > 0 && i >= maxEntries;
+    const overChars = maxTotalChars > 0 && totalChars > maxTotalChars && i > 0;
+    if (overCount || overChars) evicted.push(row.id);
+  });
+  if (evicted.length) {
+    const del = d.prepare('DELETE FROM ui_blobs WHERE ns = ? AND id = ?');
+    for (const id of evicted) del.run(ns, id);
+  }
+  return evicted;
+}
+
+export function closeBlobStore() {
+  if (db) { try { db.close(); } catch {} db = null; }
+}

package/neural-interface/lib/vector-cache.js

@@ -0,0 +1,2 @@
+// Shared implementation; retained for existing imports.
+export { VectorCache } from '../../mcp-server/dist/services/vector-cache.js';

package/neural-interface/lib/virtual-socket.js

@@ -0,0 +1,60 @@
+// ═══════════════════════════════════════════
+// SynaBun — In-process "WebSocket" for reusing socket-bound server handlers
+// ═══════════════════════════════════════════
+//
+// The Claude bridge and the Codex skin handler are written against a `ws`
+// WebSocket: they call send()/ping()/terminate(), read readyState and
+// bufferedAmount, and subscribe to 'message'/'close'/'pong'. The assistant
+// brains drive those handlers from inside the server process, so this object
+// satisfies that surface without any network socket. Outbound packets are
+// delivered to `onSend`; inbound packets are injected with `receive()`.
+
+import { EventEmitter } from 'node:events';
+
+export const OPEN = 1;
+export const CLOSING = 2;
+export const CLOSED = 3;
+
+export function createVirtualSocket({ onSend = () => {}, name = 'virtual' } = {}) {
+  const emitter = new EventEmitter();
+  emitter.setMaxListeners(50);
+  const socket = {
+    name,
+    readyState: OPEN,
+    bufferedAmount: 0,
+    OPEN, CLOSING, CLOSED,
+    send(payload, callback) {
+      if (socket.readyState !== OPEN) { if (typeof callback === 'function') callback(new Error('virtual socket closed')); return; }
+      let packet = payload;
+      if (typeof payload === 'string') { try { packet = JSON.parse(payload); } catch { packet = payload; } }
+      else if (Buffer.isBuffer(payload)) { try { packet = JSON.parse(payload.toString('utf8')); } catch { packet = payload.toString('utf8'); } }
+      try { onSend(packet); } catch {}
+      if (typeof callback === 'function') callback();
+    },
+    /** Inject an inbound message as the connected client would have sent it. */
+    receive(message) {
+      if (socket.readyState !== OPEN) return false;
+      const raw = typeof message === 'string' ? message : JSON.stringify(message);
+      emitter.emit('message', Buffer.from(raw, 'utf8'), false);
+      return true;
+    },
+    ping() { setImmediate(() => { if (socket.readyState === OPEN) emitter.emit('pong'); }); },
+    pong() {},
+    close(code = 1000, reason = '') {
+      if (socket.readyState === CLOSED) return;
+      socket.readyState = CLOSED;
+      emitter.emit('close', code, Buffer.from(String(reason || ''), 'utf8'));
+    },
+    terminate() { socket.close(1006, 'terminated'); },
+    on: (...args) => { emitter.on(...args); return socket; },
+    once: (...args) => { emitter.once(...args); return socket; },
+    off: (...args) => { emitter.off(...args); return socket; },
+    removeListener: (...args) => { emitter.removeListener(...args); return socket; },
+    removeAllListeners: (...args) => { emitter.removeAllListeners(...args); return socket; },
+    addEventListener(type, listener) { emitter.on(type, listener); },
+    removeEventListener(type, listener) { emitter.off(type, listener); },
+    emit: (...args) => emitter.emit(...args),
+    listenerCount: (type) => emitter.listenerCount(type),
+  };
+  return socket;
+}

package/neural-interface/lib/whatsapp/api.js

@@ -0,0 +1,146 @@
+// ═══════════════════════════════════════════
+// SynaBun — WhatsApp Link REST API (/api/whatsapp/*)
+// ═══════════════════════════════════════════
+//
+// Every route answers the person at this computer only: no guests, no
+// tunnel or proxy, a loopback socket and a localhost Host header
+// (lib/http-guards.js), and nothing is cached. Every state-changing route
+// also needs the page's own Origin, a JSON body and X-SynaBun-UI: 1, and
+// refuses agent headers — an agent cannot link, unlink or raise the level.
+// POST /pause is the exception: it only lowers privileges, so agents may
+// call it (a JSON body is still required, which a cross-site page cannot
+// send without a preflight).
+//
+// POST /link and POST /owner/claim answer with NDJSON streamed to the
+// requesting tab alone (one JSON object per line); the QR, the pairing code
+// and the claim code never travel anywhere else. The tab closing the
+// response cancels what it started.
+//
+// Mounted with `app.use('/api/whatsapp', service.router)`; tests mount
+// createWhatsAppApi({ service: fakeOps, port }) directly.
+
+import { Router } from 'express';
+import { AGENT_HEADERS, guestForbidden, noStore, requireJson, requireLocal, requireLocalHost, requireSameOriginJson, sendGuardError, uiOnly } from '../http-guards.js';
+
+/** Open an NDJSON response. → { write(obj), end(obj?), onAbort(fn), closed } */
+export function openNdjsonStream(res) {
+  res.status(200);
+  res.setHeader('Content-Type', 'application/x-ndjson; charset=utf-8');
+  res.setHeader('Cache-Control', 'no-store, no-transform');
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+  res.flushHeaders();
+  res.on('error', () => {});
+  let ended = false;
+  const aborters = new Set();
+  res.on('close', () => {
+    if (ended) return;
+    ended = true;
+    for (const fn of aborters) { try { fn(); } catch {} }
+  });
+  const stream = {
+    write(payload) {
+      if (ended || res.writableEnded || res.destroyed) return false;
+      try { res.write(`${JSON.stringify(payload)}\n`); return true; } catch { return false; }
+    },
+    end(payload) {
+      if (ended) return;
+      if (payload) stream.write(payload);
+      ended = true;
+      try { res.end(); } catch {}
+    },
+    onAbort(fn) { if (typeof fn === 'function') aborters.add(fn); },
+    get closed() { return ended || res.destroyed; },
+  };
+  return stream;
+}
+
+function fail(res, error, log) {
+  const status = Number(error?.status) || 500;
+  const body = { ok: false, code: error?.code || (status >= 500 ? 'INTERNAL' : 'BAD_REQUEST'), error: error?.message || String(error) };
+  if (error?.field) body.field = error.field;
+  if (Number.isFinite(error?.retryAfterMs)) {
+    body.retryAfterMs = Math.max(0, Math.round(error.retryAfterMs));
+    res.set('Retry-After', String(Math.max(1, Math.ceil(body.retryAfterMs / 1000))));
+  }
+  if (Number.isFinite(error?.version)) body.version = error.version;
+  if (status >= 500) log('whatsapp:api-error', body.error);
+  res.status(status).json(body);
+}
+
+/**
+ * @param {object} deps
+ * @param {object} deps.service  the service's ops (status, setup, link, …) — see lib/whatsapp/service.js
+ * @param {(req)=>boolean} [deps.isGuestRequest]
+ * @param {number|(()=>number)} deps.port  the port the page is served from (Host/Origin checks)
+ */
+export function createWhatsAppApi({ service, isGuestRequest = () => false, port = 3344, log = () => {} } = {}) {
+  if (!service) throw new Error('createWhatsAppApi requires the WhatsApp service');
+  const router = Router();
+
+  // The port is read per request, so a server (or a test) that learns it after listen() can pass a function.
+  const portOf = () => (typeof port === 'function' ? port() : port);
+  const built = new Map();
+  const perPort = (name, factory) => (req, res, next) => {
+    const key = `${name}:${portOf()}`;
+    let guard = built.get(key);
+    if (!guard) {
+      try { guard = factory(portOf()); } catch { return sendGuardError(res, 500, 'BAD_PORT', 'The WhatsApp API has no valid port.'); }
+      built.set(key, guard);
+    }
+    return guard(req, res, next);
+  };
+
+  router.use(noStore, guestForbidden(isGuestRequest), requireLocal, perPort('host', requireLocalHost));
+  const mutating = [perPort('origin', requireSameOriginJson), uiOnly];
+
+  const handle = (fn) => async (req, res) => {
+    try {
+      const result = await fn(req, res);
+      if (!res.headersSent) res.json(result ?? { ok: true });
+    } catch (error) {
+      if (res.headersSent) { try { res.end(); } catch {} return; }
+      fail(res, error, log);
+    }
+  };
+  const body = (req) => (req.body && typeof req.body === 'object' && !Array.isArray(req.body) ? req.body : {});
+  const stream = (res) => () => openNdjsonStream(res);
+  const byAgent = (req) => AGENT_HEADERS.some((name) => req.headers?.[name] !== undefined);
+
+  // ── status & setup ─────────────────────────────────────────────────────────
+  router.get('/status', handle(() => service.status()));
+  router.post('/setup', ...mutating, handle((req) => service.setup(body(req))));
+
+  // ── connector ──────────────────────────────────────────────────────────────
+  router.post('/connector/install', ...mutating, handle((req) => service.installConnector(body(req))));
+  router.delete('/connector/install', ...mutating, handle(() => service.cancelInstall()));
+  router.delete('/connector', ...mutating, handle(() => service.removeConnector()));
+  router.get('/connector/log', handle((req) => service.connectorLog({ limit: req.query.limit })));
+
+  // ── linking and the owner (streams go to this tab only) ────────────────────
+  router.post('/link', ...mutating, handle((req, res) => service.link(body(req), stream(res))));
+  router.post('/owner/confirm', ...mutating, handle((req) => service.confirmOwner(body(req))));
+  router.post('/owner/claim', ...mutating, handle((req, res) => service.claimOwner(body(req), stream(res))));
+  router.delete('/owner', ...mutating, handle(() => service.resetOwner()));
+
+  // ── controls ───────────────────────────────────────────────────────────────
+  router.post('/test', ...mutating, handle(() => service.test()));
+  // Pausing only lowers privileges: agents may do it (no Origin / UI header / agent-header checks).
+  router.post('/pause', requireJson, handle((req) => service.pause({ by: byAgent(req) ? 'agent' : 'desktop' })));
+  router.post('/resume', ...mutating, handle(() => service.resume()));
+  router.post('/reconnect', ...mutating, handle(() => service.reconnect()));
+  router.post('/unlink', ...mutating, handle(() => service.unlink()));
+  router.post('/remove', ...mutating, handle((req) => service.remove(body(req))));
+
+  // ── settings, activity, conversation ───────────────────────────────────────
+  router.get('/config', handle(() => service.getConfig()));
+  router.put('/config', ...mutating, handle((req) => service.putConfig(body(req))));
+  router.get('/activity', handle((req) => service.listActivity({ limit: req.query.limit })));
+  router.delete('/activity', ...mutating, handle(() => service.clearActivity()));
+  router.post('/session/new', ...mutating, handle(() => service.newSession()));
+
+  // ── fake transport (SYNABUN_WHATSAPP_FAKE=1 only; otherwise it does not exist) ──
+  router.post('/__fake', (req, res, next) => (service.fakeEnabled?.() ? next() : sendGuardError(res, 404, 'NOT_FOUND', 'Not found')), ...mutating, handle((req) => service.fake(body(req))));
+
+  router.use((req, res) => sendGuardError(res, 404, 'NOT_FOUND', 'Not found'));
+  return router;
+}