aios-core 4.2.14 → 4.3.0

package/.aios-core/core/synapse/engine.js

@@ -172,6 +172,14 @@ class PipelineMetrics {
 /** Hard pipeline timeout in milliseconds. */
 const PIPELINE_TIMEOUT_MS = 100;
 
+/**
+ * NOG-18: Default active layers (L0-L2 only).
+ * L3-L7 produced 0 rules in NOG-17 audit — disabled for performance.
+ * Set SYNAPSE_LEGACY_MODE=true to re-enable full 8-layer processing.
+ */
+const DEFAULT_ACTIVE_LAYERS = [0, 1, 2];
+const LEGACY_MODE = process.env.SYNAPSE_LEGACY_MODE === 'true';
+
 /**
  * Orchestrates the 8-layer SYNAPSE context injection pipeline.
  *
@@ -229,21 +237,33 @@ class SynapseEngine {
     const metrics = new PipelineMetrics();
     metrics.totalStart = process.hrtime.bigint();
 
-    // 1. Calculate bracket
+    // 1. Calculate bracket (or use fixed layers in non-legacy mode)
     const promptCount = (session && session.prompt_count) || 0;
-    const contextPercent = estimateContextPercent(promptCount);
-    const bracket = calculateBracket(contextPercent);
-    const layerConfig = getActiveLayers(bracket);
-    const tokenBudget = getTokenBudget(bracket);
-
-    // Guard: no layer config (invalid bracket — should not happen)
-    if (!layerConfig) {
-      metrics.totalEnd = process.hrtime.bigint();
-      return { xml: '', metrics: metrics.getSummary() };
+    let contextPercent, bracket, activeLayers, tokenBudget;
+
+    if (LEGACY_MODE) {
+      // Full 8-layer processing with bracket-based filtering
+      contextPercent = estimateContextPercent(promptCount);
+      bracket = calculateBracket(contextPercent);
+      const layerConfig = getActiveLayers(bracket);
+      tokenBudget = getTokenBudget(bracket);
+
+      // Guard: no layer config (invalid bracket — should not happen)
+      if (!layerConfig) {
+        metrics.totalEnd = process.hrtime.bigint();
+        return { xml: '', metrics: metrics.getSummary() };
+      }
+      activeLayers = layerConfig.layers;
+    } else {
+      // NOG-18: Simplified — always load L0-L2, skip bracket calculation.
+      // L3-L7 produced 0 rules (require session context that never exists).
+      // Bracket management replaced by native /compact.
+      contextPercent = estimateContextPercent(promptCount);
+      bracket = calculateBracket(contextPercent);
+      activeLayers = DEFAULT_ACTIVE_LAYERS;
+      tokenBudget = getTokenBudget(bracket);
     }
 
-    const activeLayers = layerConfig.layers;
-
     // 2. Execute layers sequentially
     const results = [];
     const previousLayers = [];
@@ -323,7 +343,7 @@ class SynapseEngine {
       needsHandoffWarning(bracket),
     );
 
-    return { xml, metrics: summary };
+    return { xml, metrics: summary, bracket };
   }
 
   /**

package/.aios-core/core/synapse/runtime/hook-runtime.js

@@ -3,9 +3,34 @@
 const path = require('path');
 const fs = require('fs');
 
+const DEFAULT_STALE_TTL_HOURS = 168; // 7 days
+
+/**
+ * Read stale session TTL from core-config.yaml.
+ * Falls back to DEFAULT_STALE_TTL_HOURS (168h = 7 days).
+ *
+ * @param {string} cwd - Working directory
+ * @returns {number} TTL in hours
+ */
+function getStaleSessionTTL(cwd) {
+  try {
+    const yaml = require('js-yaml');
+    const configPath = path.join(cwd, '.aios-core', 'core-config.yaml');
+    if (!fs.existsSync(configPath)) return DEFAULT_STALE_TTL_HOURS;
+    const config = yaml.load(fs.readFileSync(configPath, 'utf8'));
+    const ttl = config && config.synapse && config.synapse.session && config.synapse.session.staleTTLHours;
+    return typeof ttl === 'number' && ttl > 0 ? ttl : DEFAULT_STALE_TTL_HOURS;
+  } catch (_err) {
+    return DEFAULT_STALE_TTL_HOURS;
+  }
+}
+
 /**
  * Resolve runtime dependencies for Synapse hook execution.
  *
+ * On the first prompt of a session (prompt_count === 0), runs
+ * cleanStaleSessions() fire-and-forget to remove expired sessions.
+ *
  * @param {{cwd?: string, session_id?: string, sessionId?: string}} input
  * @returns {{
  *   engine: import('../engine').SynapseEngine,
@@ -21,7 +46,7 @@ function resolveHookRuntime(input) {
   if (!fs.existsSync(synapsePath)) return null;
 
   try {
-    const { loadSession } = require(
+    const { loadSession, cleanStaleSessions } = require(
       path.join(cwd, '.aios-core', 'core', 'synapse', 'session', 'session-manager.js'),
     );
     const { SynapseEngine } = require(
@@ -32,7 +57,20 @@ function resolveHookRuntime(input) {
     const session = loadSession(sessionId, sessionsDir) || { prompt_count: 0 };
     const engine = new SynapseEngine(synapsePath);
 
-    return { engine, session };
+    // AC3: Run cleanup on first prompt only (fire-and-forget)
+    if (session.prompt_count === 0) {
+      try {
+        const ttlHours = getStaleSessionTTL(cwd);
+        const removed = cleanStaleSessions(sessionsDir, ttlHours);
+        if (removed > 0 && process.env.DEBUG === '1') {
+          console.error(`[hook-runtime] Cleaned ${removed} stale session(s) (TTL: ${ttlHours}h)`);
+        }
+      } catch (_cleanupErr) {
+        // Fire-and-forget: never block hook execution
+      }
+    }
+
+    return { engine, session, sessionId, sessionsDir, cwd };
   } catch (error) {
     if (process.env.DEBUG === '1') {
       console.error(`[hook-runtime] Failed to resolve runtime: ${error.message}`);

package/.aios-core/core/synapse/session/session-manager.js

@@ -17,6 +17,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const { atomicWriteSync } = require('../utils/atomic-write');
 
 const SCHEMA_VERSION = '2.0';
 const DEFAULT_MAX_AGE_HOURS = 24;
@@ -132,7 +133,7 @@ function createSession(sessionId, cwd, sessionsDir) {
   const filePath = resolveSessionFile(sessionId, dir);
 
   try {
-    fs.writeFileSync(filePath, JSON.stringify(session, null, 2), 'utf8');
+    atomicWriteSync(filePath, JSON.stringify(session, null, 2));
   } catch (error) {
     if (error.code === 'EACCES' || error.code === 'EPERM') {
       console.error(`[synapse:session] Error: Permission denied creating session ${sessionId}`);
@@ -227,7 +228,7 @@ function updateSession(sessionId, sessionsDir, updates) {
   const filePath = resolveSessionFile(sessionId, sessionsDir);
 
   try {
-    fs.writeFileSync(filePath, JSON.stringify(session, null, 2), 'utf8');
+    atomicWriteSync(filePath, JSON.stringify(session, null, 2));
   } catch (error) {
     if (error.code === 'EACCES' || error.code === 'EPERM') {
       console.error(`[synapse:session] Error: Permission denied writing session ${sessionId}`);

package/.aios-core/core/synapse/utils/atomic-write.js

@@ -0,0 +1,79 @@
+/**
+ * Atomic Write Utility
+ *
+ * Writes files atomically using write-to-tmp + rename pattern.
+ * Prevents file corruption on unexpected exit (crash, kill, power loss).
+ *
+ * Pattern:
+ *   1. Write data to {filePath}.tmp.{pid}
+ *   2. On Windows: unlink target if exists (rename won't overwrite)
+ *   3. Rename tmp → target (atomic on POSIX, near-atomic on Windows)
+ *   4. On failure: clean up tmp file
+ *
+ * @module core/synapse/utils/atomic-write
+ * @version 1.0.0
+ * @created Story NOG-12 - State Persistence Hardening
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const IS_WINDOWS = process.platform === 'win32';
+
+/**
+ * Write data to a file atomically.
+ *
+ * Writes to a temporary file first, then renames to the target path.
+ * If the process crashes between write and rename, the original file
+ * remains intact and the orphaned .tmp file is harmless.
+ *
+ * @param {string} filePath - Target file path
+ * @param {string} data - Data to write
+ * @param {string} [encoding='utf8'] - File encoding
+ * @throws {Error} If write or rename fails (original file preserved)
+ */
+function atomicWriteSync(filePath, data, encoding = 'utf8') {
+  const tmpPath = `${filePath}.tmp.${process.pid}`;
+
+  try {
+    // Ensure parent directory exists
+    const dir = path.dirname(filePath);
+    if (!fs.existsSync(dir)) {
+      fs.mkdirSync(dir, { recursive: true });
+    }
+
+    // Step 1: Write to temporary file
+    fs.writeFileSync(tmpPath, data, encoding);
+
+    // Step 2: On Windows, unlink target first (rename won't overwrite)
+    if (IS_WINDOWS) {
+      try {
+        fs.unlinkSync(filePath);
+      } catch (err) {
+        if (err.code !== 'ENOENT') {
+          throw err;
+        }
+        // ENOENT = target doesn't exist yet, that's fine
+      }
+    }
+
+    // Step 3: Atomic rename
+    fs.renameSync(tmpPath, filePath);
+  } catch (error) {
+    // Clean up tmp file on failure
+    try {
+      fs.unlinkSync(tmpPath);
+    } catch (_cleanupErr) {
+      // Ignore cleanup errors
+    }
+
+    console.error(`[atomic-write] Failed to write ${filePath}: ${error.message}`);
+    throw error;
+  }
+}
+
+module.exports = {
+  atomicWriteSync,
+};

package/.aios-core/core-config.yaml

@@ -162,6 +162,9 @@ projectStatus:
   statusFile: .aios/project-status.yaml
   maxModifiedFiles: 5
   maxRecentCommits: 2
+synapse:
+  session:
+    staleTTLHours: 168 # 7 days — sessions older than this are cleaned up on first prompt
 agentIdentity:
   greeting:
     preference: auto
@@ -321,7 +324,7 @@ ideSync:
     github-copilot:
       enabled: true
       path: .github/agents
-      format: full-markdown-yaml
+      format: github-copilot
     cursor:
       enabled: true
       path: .cursor/rules/agents
@@ -352,4 +355,34 @@ autoClaude:
     enabled: false
   qa:
     enabled: false
+# Boundary Mapping — Framework-Project Separation (Epic BM)
+# Controls deterministic protection of framework core files via Claude Code deny rules.
+# When frameworkProtection is true (default), .claude/settings.json includes deny rules
+# that block Edit/Write operations on L1/L2 paths listed in 'protected' below.
+# Set to false for framework contributors who need to edit core files directly.
+# NOTE: This flag is read by the installer during settings.json generation.
+# Changing this value alone does NOT add/remove deny rules — re-run the installer.
+# SINGLE SOURCE OF TRUTH: Both pre-commit hook (framework-guard.js) and
+# the installer read protected/exceptions from here. Do NOT hardcode paths elsewhere.
+boundary:
+  frameworkProtection: false # TEMPORARY: TOK-3 contributor mode — re-enable after story
+  # L1/L2 paths — blocked from editing in project mode
+  # Glob syntax: ** matches any depth, * matches single segment
+  protected:
+    - .aios-core/core/**
+    - .aios-core/development/tasks/**
+    - .aios-core/development/templates/**
+    - .aios-core/development/checklists/**
+    - .aios-core/development/workflows/**
+    - .aios-core/infrastructure/**
+    - .aios-core/constitution.md
+    - bin/aios.js
+    - bin/aios-init.js
+  # L3 paths — mutable exceptions (allowed even within .aios-core/)
+  exceptions:
+    - .aios-core/data/**
+    - .aios-core/development/agents/*/MEMORY.md
+    - .aios-core/core/config/schemas/**
+    - .aios-core/core/config/template-overrides.js
+
 # Memory Intelligence System (Epic MIS) configuration placeholder — MIS-2+

package/.aios-core/data/aios-kb.md

@@ -86,7 +86,7 @@ AIOS transforms you into a "Vibe CEO" - directing a team of specialized AI agent
 
 ```bash
 # Interactive installation (recommended)
-npx @synkra/aios-core install
+npx aios-core install
 ```
 
 **Installation Steps**:
@@ -889,7 +889,7 @@ Squads extend AIOS-Method beyond traditional software development into ANY domai
 3. **Install via CLI**:
 
    ```bash
-   npx @synkra/aios-core install
+   npx aios-core install
    # Select "Install squad" option
    ```
 

package/.aios-core/data/capability-detection.js

@@ -0,0 +1,290 @@
+#!/usr/bin/env node
+// =============================================================================
+// AIOS Capability Detection Module
+// =============================================================================
+// Detects Claude Code runtime capabilities for token optimization decisions.
+// Runs at session initialization (not per-turn).
+//
+// Story: TOK-2 (Deferred/Search Capability-Aware Loading)
+// ADR-7: Capability gate por runtime
+//
+// Usage:
+//   node .aios-core/data/capability-detection.js
+//
+// Output:
+//   .aios/runtime-capabilities.json
+// =============================================================================
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+const PROJECT_ROOT = path.resolve(__dirname, '../..');
+const OUTPUT_PATH = path.join(PROJECT_ROOT, '.aios', 'runtime-capabilities.json');
+
+function detectToolSearch() {
+  // Check Claude Code cached features for tool search availability
+  const claudeJsonPath = path.join(os.homedir(), '.claude.json');
+  try {
+    const config = JSON.parse(fs.readFileSync(claudeJsonPath, 'utf8'));
+    const features = config.cachedGrowthBookFeatures || {};
+    return {
+      available: features.tengu_mcp_tool_search === true,
+      source: 'cachedGrowthBookFeatures.tengu_mcp_tool_search',
+      detectionMethod: 'claude-json-feature-flag'
+    };
+  } catch {
+    return {
+      available: false,
+      source: 'detection-failed',
+      detectionMethod: 'claude-json-feature-flag'
+    };
+  }
+}
+
+function detectDeferLoading() {
+  // defer_loading is API-only (Python SDK mcp_toolset), NOT available in Claude Code CLI
+  return {
+    available: false,
+    reason: 'defer_loading is API-only (Python SDK). Not exposed in Claude Code CLI.',
+    source: 'ADR-7 / Codex CRITICO-1'
+  };
+}
+
+function detectProjectMcps() {
+  const mcpJsonPath = path.join(PROJECT_ROOT, '.mcp.json');
+  try {
+    const config = JSON.parse(fs.readFileSync(mcpJsonPath, 'utf8'));
+    const servers = config.mcpServers || {};
+    return Object.entries(servers).map(([name, cfg]) => ({
+      name,
+      type: cfg.type || 'command',
+      scope: 'project',
+      source: '.mcp.json'
+    }));
+  } catch {
+    return [];
+  }
+}
+
+function detectGlobalMcps() {
+  // Docker MCP Gateway catalog
+  const dockerMcpConfigPath = path.join(os.homedir(), '.docker', 'mcp', 'config.yaml');
+  const servers = [];
+
+  try {
+    const content = fs.readFileSync(dockerMcpConfigPath, 'utf8');
+    // Simple YAML top-level key parsing (keys at indent 0 followed by colon)
+    const lines = content.split('\n');
+    for (const line of lines) {
+      const match = line.match(/^([a-zA-Z0-9_-]+):/);
+      if (match) {
+        servers.push({
+          name: match[1],
+          type: 'docker-gateway',
+          scope: 'global',
+          source: '~/.docker/mcp/config.yaml'
+        });
+      }
+    }
+  } catch {
+    // Docker MCP not configured — not an error
+  }
+
+  // Direct MCPs in Claude Code (playwright, etc.)
+  // These are registered via `claude mcp add` at user scope
+  // Detection: check ~/.claude/settings.json or known conventions
+  const settingsPath = path.join(os.homedir(), '.claude', 'settings.json');
+  try {
+    const settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+    if (settings.mcpServers) {
+      for (const [name, cfg] of Object.entries(settings.mcpServers)) {
+        servers.push({
+          name,
+          type: cfg.type || 'command',
+          scope: 'global-settings',
+          source: '~/.claude/settings.json'
+        });
+      }
+    }
+  } catch {
+    // No global settings MCPs
+  }
+
+  return servers;
+}
+
+function detectDockerGateway() {
+  const dockerMcpDir = path.join(os.homedir(), '.docker', 'mcp');
+  const exists = fs.existsSync(dockerMcpDir);
+
+  return {
+    available: exists,
+    configPath: exists ? dockerMcpDir : null,
+    detectionMethod: 'filesystem-check'
+  };
+}
+
+function loadToolRegistry() {
+  const registryPath = path.join(PROJECT_ROOT, '.aios-core', 'data', 'tool-registry.yaml');
+  try {
+    const content = fs.readFileSync(registryPath, 'utf8');
+    // Count tools by tier (simple regex parsing)
+    const tier1 = (content.match(/tier: 1/g) || []).length;
+    const tier2 = (content.match(/tier: 2/g) || []).length;
+    const tier3 = (content.match(/tier: 3/g) || []).length;
+
+    // 2-pass parsing: collect all fields per tool, then classify
+    // (essential: may appear before mcp_server: in YAML)
+    const tools = {};
+    let currentTool = null;
+
+    // Pass 1: collect all fields
+    for (const line of content.split('\n')) {
+      const toolMatch = line.match(/^ {2}([a-zA-Z0-9_-]+):$/);
+      if (toolMatch) {
+        currentTool = toolMatch[1];
+        tools[currentTool] = {};
+        continue;
+      }
+      if (!currentTool) continue;
+
+      const tierMatch = line.match(/^\s+tier:\s*(\d)/);
+      if (tierMatch) { tools[currentTool].tier = parseInt(tierMatch[1]); continue; }
+
+      const mcpMatch = line.match(/^\s+mcp_server:\s*(.+)/);
+      if (mcpMatch) { tools[currentTool].mcpServer = mcpMatch[1].trim(); continue; }
+
+      const essentialMatch = line.match(/^\s+essential:\s*(true|false)/);
+      if (essentialMatch) { tools[currentTool].essential = essentialMatch[1] === 'true'; continue; }
+    }
+
+    // Pass 2: classify Tier 3 tools with essential flag
+    const essential = [];
+    const nonEssential = [];
+    for (const [name, fields] of Object.entries(tools)) {
+      if (fields.tier !== 3 || fields.essential === undefined) continue;
+      const scope = fields.mcpServer === 'project' ? 'project' : 'global';
+      const entry = { name, scope };
+      if (fields.essential) {
+        essential.push(entry);
+      } else {
+        nonEssential.push(entry);
+      }
+    }
+
+    return {
+      available: true,
+      totalTools: tier1 + tier2 + tier3,
+      tier1Count: tier1,
+      tier2Count: tier2,
+      tier3Count: tier3,
+      essential,
+      nonEssential
+    };
+  } catch {
+    return { available: false, totalTools: 0, tier1Count: 0, tier2Count: 0, tier3Count: 0, essential: [], nonEssential: [] };
+  }
+}
+
+function determineStrategy(toolSearch, deferLoading, dockerGateway) {
+  // ADR-7 Strategy Hierarchy:
+  // 1. Best case: Tool Search auto-mode → deferred MCP schemas automatically
+  // 2. Fallback 1: MCP discipline — disable non-essential MCP servers
+  // 3. Fallback 2: CLAUDE.md guidance — instruct to prefer native tools
+
+  if (toolSearch.available) {
+    return {
+      primary: 'tool-search-auto',
+      description: 'Claude Code Tool Search is active. Tier 3 MCP tools are automatically deferred via tool_search.',
+      fallbacks: ['mcp-discipline', 'claudemd-guidance']
+    };
+  }
+
+  if (dockerGateway.available) {
+    return {
+      primary: 'mcp-discipline',
+      description: 'Tool Search not available. Using MCP discipline: disable non-essential servers in .mcp.json.',
+      fallbacks: ['claudemd-guidance']
+    };
+  }
+
+  return {
+    primary: 'claudemd-guidance',
+    description: 'Neither Tool Search nor Docker Gateway available. Using CLAUDE.md guidance for tool selection priority.',
+    fallbacks: []
+  };
+}
+
+function run() {
+  const timestamp = new Date().toISOString();
+
+  const toolSearch = detectToolSearch();
+  const deferLoading = detectDeferLoading();
+  const projectMcps = detectProjectMcps();
+  const globalMcps = detectGlobalMcps();
+  const dockerGateway = detectDockerGateway();
+  const toolRegistry = loadToolRegistry();
+
+  const strategy = determineStrategy(toolSearch, deferLoading, dockerGateway);
+
+  const capabilities = {
+    version: '1.0.0',
+    generatedAt: timestamp,
+    generatedBy: 'capability-detection.js',
+    story: 'TOK-2',
+
+    methodology: {
+      toolSearchLatency: 'Managed internally by Claude Code — not programmatically measurable. Guidance-level enforcement via CLAUDE.md.',
+      mcpCountUnit: 'servers (not individual tools). TOK-1.5 baseline uses tool count (e.g., Apify = 7 tools = 1 server).'
+    },
+
+    runtime: {
+      toolSearch,
+      deferLoading,
+      dockerGateway
+    },
+
+    mcpServers: {
+      project: projectMcps,
+      global: globalMcps,
+      totalCount: projectMcps.length + globalMcps.length,
+      countUnit: 'servers'
+    },
+
+    toolRegistry,
+
+    strategy,
+
+    // Essential/non-essential derived from tool-registry.yaml (single source of truth)
+    essentialServers: toolRegistry.essential.length > 0
+      ? toolRegistry.essential
+      : [{ name: 'nogic', scope: 'project' }, { name: 'code-graph', scope: 'project' }],
+
+    nonEssentialServers: toolRegistry.nonEssential.length > 0
+      ? toolRegistry.nonEssential
+      : []
+  };
+
+  // Ensure output directory exists
+  const outputDir = path.dirname(OUTPUT_PATH);
+  if (!fs.existsSync(outputDir)) {
+    fs.mkdirSync(outputDir, { recursive: true });
+  }
+
+  fs.writeFileSync(OUTPUT_PATH, JSON.stringify(capabilities, null, 2));
+  console.log(`✅ Runtime capabilities detected and saved to ${OUTPUT_PATH}`);
+  console.log(`   Strategy: ${strategy.primary} — ${strategy.description}`);
+  console.log(`   Tool Search: ${toolSearch.available ? 'AVAILABLE' : 'NOT AVAILABLE'}`);
+  console.log(`   MCPs: ${projectMcps.length} project + ${globalMcps.length} global = ${projectMcps.length + globalMcps.length} total`);
+  console.log(`   Tool Registry: ${toolRegistry.totalTools} tools (T1:${toolRegistry.tier1Count} T2:${toolRegistry.tier2Count} T3:${toolRegistry.tier3Count})`);
+
+  return capabilities;
+}
+
+// Execute
+if (require.main === module) {
+  run();
+}
+
+module.exports = { run, detectToolSearch, detectProjectMcps, detectGlobalMcps, detectDockerGateway };