aios-core 4.2.14 → 4.3.0

package/.aios-core/infrastructure/scripts/generate-settings-json.js

@@ -0,0 +1,300 @@
+#!/usr/bin/env node
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const yaml = require('js-yaml');
+
+const CORE_CONFIG_FILE = '.aios-core/core-config.yaml';
+const SETTINGS_FILE = '.claude/settings.json';
+const TOOLS = ['Edit', 'Write'];
+
+/**
+ * Validate that a boundary path does not escape the project root via traversal.
+ * Rejects paths containing '..' segments or absolute paths.
+ */
+function validateBoundaryPath(p) {
+  const segments = p.replace(/\\/g, '/').split('/');
+  if (segments.some(function(s) { return s === '..'; })) {
+    throw new Error('Path traversal detected in boundary config: ' + p);
+  }
+  if (path.isAbsolute(p)) {
+    throw new Error('Absolute path not allowed in boundary config: ' + p);
+  }
+}
+
+/**
+ * Read boundary configuration from core-config.yaml.
+ */
+function readBoundaryConfig(projectRoot) {
+  const configPath = path.join(projectRoot, CORE_CONFIG_FILE);
+
+  if (!fs.existsSync(configPath)) {
+    throw new Error(`core-config.yaml not found at ${configPath}`);
+  }
+
+  const content = fs.readFileSync(configPath, 'utf8');
+  const config = yaml.load(content);
+
+  if (!config || !config.boundary) {
+    throw new Error('core-config.yaml missing "boundary" section');
+  }
+
+  const { boundary } = config;
+
+  const result = {
+    frameworkProtection: boundary.frameworkProtection !== false,
+    protected: Array.isArray(boundary.protected) ? boundary.protected : [],
+    exceptions: Array.isArray(boundary.exceptions) ? boundary.exceptions : [],
+  };
+
+  for (const p of result.protected) { validateBoundaryPath(p); }
+  for (const p of result.exceptions) { validateBoundaryPath(p); }
+
+  return result;
+}
+
+/**
+ * Check if an exception path falls within a given directory.
+ */
+function isChildOf(exceptionPath, parentDir) {
+  const clean = exceptionPath.replace(/\/\*\*$/, '');
+  const parts = clean.split('/');
+  const parentParts = parentDir.split('/');
+
+  if (parts.length <= parentParts.length) {
+    return false;
+  }
+
+  for (let i = 0; i < parentParts.length; i++) {
+    if (parts[i] !== parentParts[i]) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+/**
+ * Expand a directory one level deep into subdirectory/** and file entries.
+ * Returns { dirs: [...], files: [...] } sorted separately.
+ */
+function expandOneLevel(dirRelative, projectRoot) {
+  const dirAbsolute = path.join(projectRoot, dirRelative);
+
+  if (!fs.existsSync(dirAbsolute)) {
+    return { dirs: [dirRelative + '/**'], files: [] };
+  }
+
+  const entries = fs.readdirSync(dirAbsolute, { withFileTypes: true });
+  const dirs = [];
+  const files = [];
+
+  for (const entry of entries) {
+    const entryRelative = dirRelative + '/' + entry.name;
+    if (entry.isDirectory()) {
+      dirs.push(entryRelative);
+    } else {
+      files.push(entryRelative);
+    }
+  }
+
+  dirs.sort();
+  files.sort();
+
+  return { dirs, files };
+}
+
+/**
+ * For a subdirectory that has exceptions inside it, expand to individual
+ * file-level deny rules excluding files/dirs covered by exceptions.
+ */
+function expandSubdirWithExceptions(subdirPath, exceptions, projectRoot) {
+  const dirAbsolute = path.join(projectRoot, subdirPath);
+
+  if (!fs.existsSync(dirAbsolute)) {
+    return [subdirPath + '/**'];
+  }
+
+  const entries = fs.readdirSync(dirAbsolute, { withFileTypes: true });
+  const result = [];
+
+  for (const entry of entries) {
+    const entryRelative = subdirPath + '/' + entry.name;
+    const entryGlob = entry.isDirectory() ? entryRelative + '/**' : entryRelative;
+
+    const isCoveredByException = exceptions.some(function(exc) {
+      return exc === entryGlob || exc === entryRelative;
+    });
+
+    if (!isCoveredByException) {
+      result.push(entryGlob);
+    }
+  }
+
+  result.sort();
+  return result;
+}
+
+/**
+ * Expand protected paths according to the specific rules:
+ * - .aios-core/core/** gets expanded one level deep
+ *   - Subdirs with exceptions inside get expanded further (file-level)
+ *   - Order: regular subdirs first (sorted), then root files (sorted),
+ *     then exception-expanded subdirs (sorted) at the end
+ * - All other paths stay as-is (no expansion)
+ */
+function expandProtectedPaths(protectedPaths, exceptions, projectRoot) {
+  const allPaths = [];
+
+  for (const globPath of protectedPaths) {
+    if (globPath === '.aios-core/core/**') {
+      const { dirs, files } = expandOneLevel('.aios-core/core', projectRoot);
+
+      // Separate dirs into regular (no exceptions inside) and special (has exceptions)
+      const regularDirs = [];
+      const specialDirEntries = [];
+
+      for (const dir of dirs) {
+        const relevantExceptions = exceptions.filter(function(exc) {
+          return isChildOf(exc, dir);
+        });
+
+        if (relevantExceptions.length > 0) {
+          // Expand this dir further, excluding exceptions
+          const expanded = expandSubdirWithExceptions(dir, relevantExceptions, projectRoot);
+          specialDirEntries.push(...expanded);
+        } else {
+          regularDirs.push(dir + '/**');
+        }
+      }
+
+      // Order: regular subdirs, then root files, then special-expanded entries
+      allPaths.push(...regularDirs);
+      allPaths.push(...files);
+      allPaths.push(...specialDirEntries);
+    } else {
+      allPaths.push(globPath);
+    }
+  }
+
+  return allPaths;
+}
+
+/**
+ * Keep exception paths as-is (no expansion needed).
+ */
+function expandExceptionPaths(exceptionPaths) {
+  return [...exceptionPaths].sort();
+}
+
+/**
+ * Generate permissions object from boundary config.
+ */
+function generatePermissions(boundary, projectRoot) {
+  if (!boundary.frameworkProtection) {
+    return { deny: [], allow: [] };
+  }
+
+  const denyPaths = expandProtectedPaths(boundary.protected, boundary.exceptions, projectRoot);
+
+  const deny = [];
+  for (const denyPath of denyPaths) {
+    for (const tool of TOOLS) {
+      deny.push(tool + '(' + denyPath + ')');
+    }
+  }
+
+  const allowPaths = expandExceptionPaths(boundary.exceptions);
+
+  const allow = [];
+  for (const allowPath of allowPaths) {
+    for (const tool of TOOLS) {
+      allow.push(tool + '(' + allowPath + ')');
+    }
+  }
+
+  allow.push('Read(.aios-core/**)');
+
+  return { deny, allow };
+}
+
+/**
+ * Write settings.json preserving user sections outside permissions.
+ */
+function writeSettingsJson(projectRoot, permissions) {
+  const claudeDir = path.join(projectRoot, '.claude');
+  const fullSettingsPath = path.join(projectRoot, SETTINGS_FILE);
+
+  if (!fs.existsSync(claudeDir)) {
+    fs.mkdirSync(claudeDir, { recursive: true });
+  }
+
+  let existing = {};
+  if (fs.existsSync(fullSettingsPath)) {
+    try {
+      const content = fs.readFileSync(fullSettingsPath, 'utf8');
+      existing = JSON.parse(content);
+    } catch {
+      console.warn('WARNING: Existing settings.json is invalid JSON, starting fresh.');
+      existing = {};
+    }
+  }
+
+  const updated = { ...existing };
+
+  if (permissions.deny.length > 0 || permissions.allow.length > 0) {
+    updated.permissions = permissions;
+  } else {
+    delete updated.permissions;
+  }
+
+  const newContent = JSON.stringify(updated, null, 2) + '\n';
+
+  if (fs.existsSync(fullSettingsPath)) {
+    const currentContent = fs.readFileSync(fullSettingsPath, 'utf8');
+    if (currentContent === newContent) {
+      console.log('PASS: settings.json already up to date, no changes needed.');
+      return;
+    }
+  }
+
+  fs.writeFileSync(fullSettingsPath, newContent, 'utf8');
+  console.log('PASS: settings.json updated with ' + permissions.deny.length + ' deny rules and ' + permissions.allow.length + ' allow rules.');
+}
+
+/**
+ * Main generator entry point.
+ */
+function generate(projectRoot, configOverride) {
+  const root = projectRoot || process.cwd();
+  const resolvedRoot = path.resolve(root);
+
+  const boundary = configOverride || readBoundaryConfig(resolvedRoot);
+  const permissions = generatePermissions(boundary, resolvedRoot);
+
+  writeSettingsJson(resolvedRoot, permissions);
+}
+
+if (require.main === module) {
+  const projectRoot = process.argv[2] || process.cwd();
+  try {
+    generate(projectRoot);
+  } catch (error) {
+    console.error('ERROR: ' + error.message);
+    process.exit(1);
+  }
+}
+
+module.exports = {
+  generate,
+  validateBoundaryPath,
+  readBoundaryConfig,
+  expandProtectedPaths,
+  expandExceptionPaths,
+  expandOneLevel,
+  expandSubdirWithExceptions,
+  generatePermissions,
+  writeSettingsJson,
+};

package/.aios-core/infrastructure/scripts/git-config-detector.js

@@ -12,6 +12,8 @@
  */
 
 const { execSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
 
 const DEFAULT_CACHE_TTL = 5 * 60 * 1000; // 5 minutes
 const GIT_TIMEOUT = 1000; // 1 second
@@ -113,25 +115,79 @@ class GitConfigDetector {
    * @returns {boolean} True if git repository
    */
   _isGitRepository() {
+    // NOG-18: Replace execSync (~34ms) with synchronous fs check (~0.05ms).
+    // .git/HEAD exists in normal repos AND worktrees (as file or via gitdir link).
     try {
-      const output = execSync('git rev-parse --is-inside-work-tree', {
-        encoding: 'utf8',
-        timeout: GIT_TIMEOUT,
-        stdio: ['pipe', 'pipe', 'ignore'], // Suppress stderr
-      }).trim();
-
-      return output === 'true';
-    } catch (error) {
+      const gitPath = path.join(process.cwd(), '.git');
+      // .git can be a directory (normal repo) or a file (worktree with "gitdir:" pointer)
+      return fs.existsSync(gitPath);
+    } catch {
       return false;
     }
   }
 
   /**
-   * Get current git branch name
+   * Get current git branch name via direct .git/HEAD file read.
+   * Fallback chain: .git/HEAD read → worktree/gitfile resolution → execSync.
    * @private
    * @returns {string|null} Branch name or null
    */
   _getCurrentBranch() {
+    const direct = this._detectBranchDirect();
+    if (direct !== undefined) return direct;
+
+    // Fallback: execSync (slow but reliable)
+    return this._getCurrentBranchExec();
+  }
+
+  /**
+   * Read branch directly from .git/HEAD file (~0.06ms vs ~52ms for execSync).
+   * Handles: normal branch, detached HEAD, worktree/gitfile.
+   * @private
+   * @returns {string|null|undefined} Branch name, null (detached/no-git), or undefined (needs fallback)
+   */
+  _detectBranchDirect() {
+    try {
+      const gitPath = path.join(process.cwd(), '.git');
+      const stat = fs.statSync(gitPath);
+
+      let headPath;
+      if (stat.isFile()) {
+        // Worktree/gitfile: .git is a file with "gitdir: <path>"
+        const gitContent = fs.readFileSync(gitPath, 'utf8').trim();
+        const match = gitContent.match(/^gitdir:\s*(.+)$/);
+        if (!match) return undefined;
+        const gitDir = path.resolve(process.cwd(), match[1]);
+        headPath = path.join(gitDir, 'HEAD');
+      } else {
+        headPath = path.join(gitPath, 'HEAD');
+      }
+
+      const headContent = fs.readFileSync(headPath, 'utf8').trim();
+
+      // Normal branch: "ref: refs/heads/feat/my-branch"
+      const refMatch = headContent.match(/^ref:\s*refs\/heads\/(.+)$/);
+      if (refMatch) return refMatch[1];
+
+      // Detached HEAD: raw commit hash
+      if (/^[0-9a-f]{40}$/.test(headContent)) {
+        return headContent.substring(0, 7) + ' (detached)';
+      }
+
+      return undefined; // Unexpected format — fallback
+    } catch (_err) {
+      // File not found or permission error — could be no .git dir
+      if (_err.code === 'ENOENT') return null;
+      return undefined; // Other error — fallback
+    }
+  }
+
+  /**
+   * Fallback: get branch via execSync (original method).
+   * @private
+   * @returns {string|null} Branch name or null
+   */
+  _getCurrentBranchExec() {
     try {
       const branch = execSync('git branch --show-current', {
         encoding: 'utf8',

package/.aios-core/infrastructure/scripts/ide-sync/index.js

@@ -30,6 +30,7 @@ const { syncGeminiCommands, buildGeminiCommandFiles } = require('./gemini-comman
 const claudeCodeTransformer = require('./transformers/claude-code');
 const cursorTransformer = require('./transformers/cursor');
 const antigravityTransformer = require('./transformers/antigravity');
+const githubCopilotTransformer = require('./transformers/github-copilot');
 
 // ANSI colors for output
 const colors = {
@@ -74,7 +75,7 @@ function loadConfig(projectRoot) {
       'github-copilot': {
         enabled: true,
         path: '.github/agents',
-        format: 'full-markdown-yaml',
+        format: 'github-copilot',
       },
       cursor: {
         enabled: true,
@@ -126,6 +127,7 @@ function getTransformer(format) {
     'full-markdown-yaml': claudeCodeTransformer,
     'condensed-rules': cursorTransformer,
     'cursor-style': antigravityTransformer,
+    'github-copilot': githubCopilotTransformer,
   };
 
   return transformers[format] || claudeCodeTransformer;

package/.aios-core/infrastructure/scripts/ide-sync/transformers/github-copilot.js

@@ -0,0 +1,184 @@
+/**
+ * GitHub Copilot Transformer - YAML frontmatter + condensed markdown
+ * @story 6.19 - IDE Command Auto-Sync System
+ * @issue #138 - Agent files not compatible with GitHub Copilot
+ *
+ * Format: .agent.md files with YAML frontmatter (--- delimiters)
+ * Target: .github/agents/*.agent.md
+ *
+ * GitHub Copilot custom agents require:
+ * - YAML frontmatter with `description` (required), `name`, `tools`
+ * - Markdown body under 30,000 characters
+ * - File extension: .agent.md
+ *
+ * @see https://docs.github.com/en/copilot/reference/custom-agents-configuration
+ */
+
+const { normalizeCommands, getVisibleCommands } = require('../agent-parser');
+
+/**
+ * Transform agent data to GitHub Copilot custom agent format
+ * @param {object} agentData - Parsed agent data from agent-parser
+ * @returns {string} - Transformed content with YAML frontmatter
+ */
+function transform(agentData) {
+  const agent = agentData.agent || {};
+  const persona = agentData.persona_profile || {};
+  const yamlData = agentData.yaml || {};
+  const personaBlock = yamlData.persona || {};
+
+  const id = agent.id || agentData.id;
+  const name = agent.name || id;
+  const title = agent.title || 'AIOS Agent';
+  const icon = agent.icon || '';
+  const description = escapeYamlString(agent.whenToUse || `${title} agent for development tasks`);
+
+  // Build YAML frontmatter
+  const frontmatter = [
+    '---',
+    `name: ${id}`,
+    `description: '${description}'`,
+    `tools: ['read', 'edit', 'search', 'execute']`,
+    '---',
+  ].join('\n');
+
+  // Build markdown body
+  const body = buildMarkdownBody({
+    id,
+    name,
+    title,
+    icon,
+    personaBlock,
+    persona,
+    commands: agentData.commands || [],
+    sections: agentData.sections || {},
+    corePrinciples: yamlData.core_principles,
+    filename: agentData.filename,
+  });
+
+  const content = `${frontmatter}\n\n${body}`;
+
+  // Enforce 30K character limit
+  if (content.length > 30000) {
+    return truncateContent(content, 30000);
+  }
+
+  return content;
+}
+
+/**
+ * Build the markdown body for the Copilot agent prompt
+ * @param {object} params - Agent parameters
+ * @returns {string} - Markdown body
+ */
+function buildMarkdownBody(params) {
+  const { id, name, title, icon, personaBlock, persona, commands, sections, filename } = params;
+
+  const parts = [];
+
+  // Header
+  const headerIcon = icon ? `${icon} ` : '';
+  parts.push(`# ${headerIcon}${name} Agent (@${id})\n`);
+
+  // Role description
+  if (personaBlock.role) {
+    parts.push(`You are an expert ${personaBlock.role}.\n`);
+  } else {
+    parts.push(`You are an expert ${title}.\n`);
+  }
+
+  // Style
+  if (personaBlock.style) {
+    parts.push(`## Style\n\n${personaBlock.style}\n`);
+  }
+
+  // Core principles (may be in persona block or at root level of YAML)
+  const corePrinciples = personaBlock.core_principles || params.corePrinciples;
+  if (corePrinciples && Array.isArray(corePrinciples)) {
+    parts.push('## Core Principles\n');
+    for (const principle of corePrinciples) {
+      // Handle both string and object formats (YAML may parse "KEY: value" as {KEY: value})
+      if (typeof principle === 'string') {
+        parts.push(`- ${principle}`);
+      } else if (typeof principle === 'object' && principle !== null) {
+        const entries = Object.entries(principle);
+        for (const [key, value] of entries) {
+          parts.push(`- ${key}: ${value}`);
+        }
+      }
+    }
+    parts.push('');
+  }
+
+  // Commands reference
+  const allCommands = normalizeCommands(commands);
+  const keyCommands = getVisibleCommands(allCommands, 'key');
+  const quickCommands = getVisibleCommands(allCommands, 'quick');
+  const displayCommands = keyCommands.length > 0 ? keyCommands : quickCommands.slice(0, 10);
+
+  if (displayCommands.length > 0) {
+    parts.push('## Commands\n');
+    parts.push('Use `*` prefix for commands:\n');
+    for (const cmd of displayCommands) {
+      parts.push(`- \`*${cmd.name}\` - ${cmd.description || 'No description'}`);
+    }
+    parts.push('');
+  }
+
+  // Collaboration section (condensed)
+  if (sections.collaboration) {
+    parts.push(`## Collaboration\n\n${sections.collaboration}\n`);
+  }
+
+  // Sync footer
+  parts.push('---');
+  parts.push(`*AIOS Agent - Synced from .aios-core/development/agents/${filename}*`);
+  parts.push('');
+
+  return parts.join('\n');
+}
+
+/**
+ * Escape a string for use as a YAML single-quoted value
+ * Single quotes inside the string must be doubled
+ * @param {string} str - Input string
+ * @returns {string} - Escaped string
+ */
+function escapeYamlString(str) {
+  if (!str) return '';
+  // In YAML single-quoted strings, single quotes are escaped by doubling them
+  return str.replace(/'/g, "''");
+}
+
+/**
+ * Truncate content to fit within character limit while keeping structure valid
+ * @param {string} content - Full content
+ * @param {number} maxChars - Maximum characters
+ * @returns {string} - Truncated content
+ */
+function truncateContent(content, maxChars) {
+  // Find the last complete section before the limit
+  const truncated = content.substring(0, maxChars - 100);
+  const lastNewline = truncated.lastIndexOf('\n\n');
+
+  if (lastNewline > 0) {
+    return truncated.substring(0, lastNewline) + '\n\n---\n*Content truncated to fit 30K limit*\n';
+  }
+  return truncated + '\n\n---\n*Content truncated to fit 30K limit*\n';
+}
+
+/**
+ * Get the target filename for this agent (with .agent.md extension)
+ * @param {object} agentData - Parsed agent data
+ * @returns {string} - Target filename (e.g., "dev.agent.md")
+ */
+function getFilename(agentData) {
+  const id = (agentData.agent && agentData.agent.id) || agentData.id;
+  return `${id}.agent.md`;
+}
+
+module.exports = {
+  transform,
+  getFilename,
+  format: 'github-copilot',
+};

package/.aios-core/infrastructure/scripts/repository-detector.js

@@ -36,11 +36,11 @@ function detectRepositoryContext() {
 
   const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
 
-  // Detect if we're in @synkra/aios-core repo itself
+  // Detect if we're in aios-core repo itself
   const isFrameworkRepo =
     packageJson.name === '@aios/fullstack' ||
-    packageJson.name === '@synkra/aios-core' ||
-    remoteUrl.includes('@synkra/aios-core');
+    packageJson.name === 'aios-core' ||
+    remoteUrl.includes('aios-core');
 
   // Load installation config if exists
   let installConfig = null;