aios-core 4.2.15 → 4.4.0

package/bin/utils/validate-publish.js

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Publish Safety Gate — Submodule + File Count Validation
+ * Story INS-4.10
+ *
+ * Prevents publishing incomplete packages by validating:
+ * 1. pro/ submodule is populated (not empty or uninitialized)
+ * 2. Critical file pro/license/license-api.js exists
+ * 3. Package file count meets minimum threshold (>= 50)
+ *
+ * Exit codes: 0 = PASS, 1 = FAIL
+ * Usage: node bin/utils/validate-publish.js
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { execSync } = require('child_process');
+
+const PROJECT_ROOT = path.join(__dirname, '..', '..');
+const PRO_DIR = path.join(PROJECT_ROOT, 'pro');
+const CRITICAL_FILE = path.join(PRO_DIR, 'license', 'license-api.js');
+const MIN_FILE_COUNT = 50;
+
+// CI environments may not have access to the private pro submodule
+const IS_CI = process.env.CI === 'true' || process.env.GITHUB_ACTIONS === 'true';
+
+let passed = true;
+let fileCount = 0;
+
+// Check 1: pro/ submodule populated
+console.log('--- Publish Safety Gate (INS-4.10) ---\n');
+
+if (!fs.existsSync(PRO_DIR)) {
+  if (IS_CI) {
+    console.log('SKIP: pro/ directory not available (CI — private submodule requires separate access token)');
+  } else {
+    console.error('FAIL: pro/ directory does not exist.');
+    console.error('  Fix: git submodule update --init pro');
+    passed = false;
+  }
+} else {
+  const entries = fs.readdirSync(PRO_DIR).filter(e => e !== '.git');
+  if (entries.length === 0) {
+    if (IS_CI) {
+      console.log('SKIP: pro/ submodule empty (CI — private submodule requires separate access token)');
+    } else {
+      console.error('FAIL: pro/ submodule not initialized (directory is empty).');
+      console.error('  Fix: git submodule update --init pro');
+      passed = false;
+    }
+  } else {
+    console.log(`PASS: pro/ submodule populated (${entries.length} entries)`);
+  }
+}
+
+// Check 2: Critical file exists
+if (!fs.existsSync(CRITICAL_FILE)) {
+  if (IS_CI) {
+    console.log('SKIP: pro/license/license-api.js not available (CI — private submodule)');
+  } else {
+    console.error('FAIL: pro/license/license-api.js not found.');
+    console.error('  This is a critical file required for Pro license validation.');
+    console.error('  Fix: git submodule update --init --recursive pro');
+    passed = false;
+  }
+} else {
+  console.log('PASS: pro/license/license-api.js exists');
+}
+
+// Check 3: File count threshold via npm pack --dry-run
+try {
+  const packOutput = execSync('npm pack --dry-run 2>&1', {
+    encoding: 'utf8',
+    cwd: PROJECT_ROOT,
+    timeout: 30000,
+  });
+  // npm pack --dry-run outputs lines starting with "npm notice" for each file
+  const fileLines = packOutput.split('\n').filter(line =>
+    line.includes('npm notice') && !line.includes('Tarball') && !line.includes('name:') &&
+    !line.includes('version:') && !line.includes('filename:') && !line.includes('package size:') &&
+    !line.includes('unpacked size:') && !line.includes('shasum:') && !line.includes('integrity:') &&
+    !line.includes('total files:')
+  );
+  fileCount = fileLines.length;
+
+  if (fileCount < MIN_FILE_COUNT) {
+    console.error(`FAIL: Package has only ${fileCount} files, expected >= ${MIN_FILE_COUNT}.`);
+    console.error('  Check that all directories in "files" array are populated.');
+    passed = false;
+  } else {
+    console.log(`PASS: Package contains ${fileCount} files (minimum: ${MIN_FILE_COUNT})`);
+  }
+} catch (err) {
+  console.error(`FAIL: npm pack --dry-run failed: ${err.message}`);
+  passed = false;
+}
+
+// Summary
+console.log('');
+if (passed) {
+  console.log(`PUBLISH SAFETY GATE: PASS (${fileCount} files in package)`);
+  process.exit(0);
+} else {
+  console.error('PUBLISH SAFETY GATE: FAIL — publish blocked. Fix issues above before retrying.');
+  process.exit(1);
+}

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "aios-core",
-  "version": "4.2.15",
+  "version": "4.4.0",
   "description": "Synkra AIOS: AI-Orchestrated System for Full Stack Development - Core Framework",
   "bin": {
     "aios": "bin/aios.js",
     "aios-core": "bin/aios.js",
-    "aios-minimal": "bin/aios-minimal.js"
+    "aios-minimal": "bin/aios-minimal.js",
+    "aios-graph": "bin/aios-graph.js"
   },
   "preferGlobal": false,
   "workspaces": [
@@ -61,7 +62,8 @@
     "validate:semantic-lint": "node scripts/semantic-lint.js",
     "manifest:ensure": "node scripts/ensure-manifest.js",
     "sync:ide:cursor": "node .aios-core/infrastructure/scripts/ide-sync/index.js sync --ide cursor",
-    "prepublishOnly": "npm run generate:manifest && npm run validate:manifest",
+    "validate:publish": "node bin/utils/validate-publish.js",
+    "prepublishOnly": "node bin/utils/validate-publish.js && npm run generate:manifest && npm run validate:manifest",
     "prepare": "husky"
   },
   "dependencies": {
@@ -70,6 +72,7 @@
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
     "ansi-to-html": "^0.7.2",
+    "asciichart": "^1.5.25",
     "chalk": "^4.1.2",
     "chokidar": "^3.5.3",
     "cli-progress": "^3.12.0",

package/packages/aios-pro-cli/bin/aios-pro.js

@@ -142,6 +142,7 @@ Commands:
   features             List available pro features
   validate             Force online license revalidation
   recover              Recover lost license key via email
+  reset-password       Reset your password (alias for recover)
   help                 Show this help message
 
 Examples:
@@ -205,6 +206,7 @@ switch (command) {
   }
 
   case 'recover':
+  case 'reset-password':
     recoverLicense().catch((err) => {
       console.error(`\n  Recovery failed: ${err.message}\n`);
       process.exit(1);

package/packages/installer/src/config/templates/core-config-template.js

@@ -170,6 +170,31 @@ function generateCoreConfig(options = {}) {
       maxRecentCommits: 2,
     },
 
+    // Boundary Protection (Epic BM — Boundary Mapping)
+    // frameworkProtection: true enforces deny rules in settings.json for L1-L4 layers
+    boundary: {
+      frameworkProtection: true,
+      // L1/L2 paths — blocked from editing in project mode
+      protected: [
+        '.aios-core/core/**',
+        '.aios-core/development/tasks/**',
+        '.aios-core/development/templates/**',
+        '.aios-core/development/checklists/**',
+        '.aios-core/development/workflows/**',
+        '.aios-core/infrastructure/**',
+        '.aios-core/constitution.md',
+        'bin/aios.js',
+        'bin/aios-init.js',
+      ],
+      // L3 paths — mutable exceptions (allowed even within .aios-core/)
+      exceptions: [
+        '.aios-core/data/**',
+        '.aios-core/development/agents/*/MEMORY.md',
+        '.aios-core/core/config/schemas/**',
+        '.aios-core/core/config/template-overrides.js',
+      ],
+    },
+
     // Agent Identity Configuration
     agentIdentity: {
       greeting: {

package/packages/installer/src/installer/brownfield-upgrader.js

@@ -11,6 +11,7 @@ const path = require('path');
 const yaml = require('js-yaml');
 const semver = require('semver');
 const { hashFile, hashesMatch } = require('./file-hasher');
+const { YamlMerger } = require('../merger/strategies/yaml-merger.js');
 
 /**
  * Upgrade report structure
@@ -257,12 +258,74 @@ async function applyUpgrade(report, sourceDir, targetDir, options = {}) {
     }
   }
 
-  // Skip user-modified files
+  // Handle user-modified files: skip most, but smart-merge core-config.yaml
   for (const file of report.userModifiedFiles) {
-    result.filesSkipped.push({
-      path: file.path,
-      reason: 'User modified - preserving local changes',
-    });
+    if (file.path.endsWith('core-config.yaml')) {
+      // Story INS-4.7: Smart merge for core-config.yaml instead of skipping
+      let backupPath;
+      try {
+        const sourcePath = path.join(sourceDir, file.path);
+        const targetPath = path.join(aiosCoreDir, file.path);
+
+        if (!dryRun && fs.existsSync(sourcePath) && fs.existsSync(targetPath)) {
+          const sourceContent = fs.readFileSync(sourcePath, 'utf8');
+          const targetContent = fs.readFileSync(targetPath, 'utf8');
+
+          // Backup before merge
+          backupPath = `${targetPath}.backup-${Date.now()}`;
+          fs.copyFileSync(targetPath, backupPath);
+
+          const merger = new YamlMerger();
+          const mergeResult = await merger.merge(sourceContent, targetContent);
+
+          // Write merged content
+          fs.writeFileSync(targetPath, mergeResult.content, 'utf8');
+
+          // Log conflict warnings
+          const conflicts = mergeResult.changes.filter(c => c.type === 'conflict');
+          if (conflicts.length > 0) {
+            result.mergeWarnings = result.mergeWarnings || [];
+            for (const conflict of conflicts) {
+              result.mergeWarnings.push(
+                `core-config.yaml: ${conflict.identifier} — ${conflict.reason}`
+              );
+            }
+          }
+
+          result.filesInstalled.push({
+            path: file.path,
+            action: 'merged',
+            stats: mergeResult.stats,
+            backupPath,
+          });
+        } else if (dryRun) {
+          result.filesInstalled.push({ path: file.path, action: 'merge (dry-run)' });
+        } else {
+          result.filesSkipped.push({
+            path: file.path,
+            reason: 'User modified - source or target missing for merge',
+          });
+        }
+      } catch (mergeError) {
+        // Merge failed — restore backup if exists, skip file
+        if (backupPath && fs.existsSync(backupPath)) {
+          try {
+            const targetPath = path.join(aiosCoreDir, file.path);
+            fs.copyFileSync(backupPath, targetPath);
+          } catch { /* restore failed — backup file still available */ }
+        }
+        console.warn(`⚠️  core-config.yaml merge failed: ${mergeError.message}`);
+        result.filesSkipped.push({
+          path: file.path,
+          reason: `Merge failed: ${mergeError.message} — user config preserved`,
+        });
+      }
+    } else {
+      result.filesSkipped.push({
+        path: file.path,
+        reason: 'User modified - preserving local changes',
+      });
+    }
   }
 
   // Note: We don't delete files that were removed from source

package/packages/installer/src/merger/index.js

@@ -8,6 +8,7 @@
  * Supported file types:
  * - .env files: Key-based merge (adds new variables, preserves existing)
  * - .md files: Section-based merge using AIOS-MANAGED markers
+ * - .yaml/.yml files: Deep merge with target-wins (Phase 1 — Story INS-4.7)
  *
  * @module merger
  * @example
@@ -32,6 +33,7 @@ const {
   ReplaceMerger,
   EnvMerger,
   MarkdownMerger,
+  YamlMerger,
 } = require('./strategies/index.js');
 
 // Re-export types and utilities
@@ -62,6 +64,7 @@ module.exports = {
   ReplaceMerger,
   EnvMerger,
   MarkdownMerger,
+  YamlMerger,
 
   // Parsers
   parseEnvFile,

package/packages/installer/src/merger/strategies/index.js

@@ -7,6 +7,7 @@ const path = require('path');
 const { ReplaceMerger } = require('./replace-merger.js');
 const { EnvMerger } = require('./env-merger.js');
 const { MarkdownMerger } = require('./markdown-merger.js');
+const { YamlMerger } = require('./yaml-merger.js');
 
 // Strategy registry - maps file extensions to merger classes
 const strategies = new Map();
@@ -23,6 +24,10 @@ fileNameStrategies.set('.env.example', EnvMerger);
 // Markdown files
 strategies.set('.md', MarkdownMerger);
 
+// YAML files (Story INS-4.7)
+strategies.set('.yaml', YamlMerger);
+strategies.set('.yml', YamlMerger);
+
 /**
  * Register a merge strategy for a file extension
  * @param {string} extension - File extension (e.g., '.md', '.env')
@@ -102,4 +107,5 @@ module.exports = {
   ReplaceMerger,
   EnvMerger,
   MarkdownMerger,
+  YamlMerger,
 };

package/packages/installer/src/merger/strategies/yaml-merger.js

@@ -0,0 +1,181 @@
+/**
+ * @fileoverview Merge strategy for YAML config files (Phase 1)
+ *
+ * Phase 1 rules (target/user always wins):
+ * - New keys in source (not in target) → added to target
+ * - Keys in both with same value → preserved
+ * - Keys in both with different values → target wins (conflict logged)
+ * - Keys in target but not source → kept (deprecated warning)
+ *
+ * @module merger/strategies/yaml-merger
+ * @story INS-4.7
+ */
+
+'use strict';
+
+const yaml = require('js-yaml');
+const { BaseMerger } = require('./base-merger.js');
+const { createMergeResult, createEmptyStats } = require('../types.js');
+
+/**
+ * Merge strategy for YAML configuration files.
+ * Implements Phase 1: add new keys + preserve user values + warn conflicts.
+ * @extends BaseMerger
+ */
+class YamlMerger extends BaseMerger {
+  name = 'yaml';
+
+  /**
+   * Can merge if both contents are valid YAML
+   * @param {string} existingContent - Existing YAML content
+   * @param {string} newContent - New YAML content
+   * @returns {boolean} True if both are parseable YAML
+   */
+  canMerge(existingContent, newContent) {
+    try {
+      yaml.load(existingContent);
+      yaml.load(newContent);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  /**
+   * Merge source (framework) YAML with target (user) YAML.
+   * Target/user values always win on conflict (Phase 1).
+   *
+   * @param {string} sourceContent - Framework YAML content
+   * @param {string} targetContent - User YAML content
+   * @param {import('../types.js').MergeOptions} [options] - Merge options
+   * @returns {Promise<import('../types.js').MergeResult>} Merge result
+   */
+  async merge(sourceContent, targetContent, _options = {}) {
+    const source = yaml.load(sourceContent) || {};
+    const target = yaml.load(targetContent) || {};
+    const stats = createEmptyStats();
+    const changes = [];
+
+    const merged = this._deepMergeTargetWins(source, target, '', stats, changes);
+
+    // Detect deprecated keys (in target but not in source) at top level
+    this._detectDeprecated(source, target, '', stats, changes);
+
+    const content = yaml.dump(merged, {
+      indent: 2,
+      lineWidth: 120,
+      noRefs: true,
+      sortKeys: false,
+    });
+
+    return createMergeResult(content, stats, changes);
+  }
+
+  /**
+   * Deep merge where target (user) values always win.
+   * New keys from source are added; existing keys preserved.
+   *
+   * @param {Object} source - Framework config
+   * @param {Object} target - User config
+   * @param {string} prefix - Key path prefix for change tracking
+   * @param {import('../types.js').MergeStats} stats - Stats accumulator
+   * @param {import('../types.js').MergeChange[]} changes - Changes accumulator
+   * @returns {Object} Merged object
+   * @private
+   */
+  _deepMergeTargetWins(source, target, prefix, stats, changes) {
+    const result = { ...target };
+
+    for (const key of Object.keys(source)) {
+      const fullKey = prefix ? `${prefix}.${key}` : key;
+
+      if (!(key in target)) {
+        // New key from source — add it
+        result[key] = source[key];
+        stats.added++;
+        changes.push({
+          type: 'added',
+          identifier: fullKey,
+          reason: 'New key from framework',
+        });
+      } else if (
+        this._isPlainObject(source[key]) &&
+        this._isPlainObject(target[key])
+      ) {
+        // Both are objects — recurse
+        result[key] = this._deepMergeTargetWins(
+          source[key], target[key], fullKey, stats, changes,
+        );
+      } else if (JSON.stringify(target[key]) !== JSON.stringify(source[key])) {
+        // Conflict: different values — target (user) wins
+        stats.conflicts++;
+        changes.push({
+          type: 'conflict',
+          identifier: fullKey,
+          reason: 'Keeping user value',
+        });
+      } else {
+        // Same value — preserved
+        stats.preserved++;
+        changes.push({
+          type: 'preserved',
+          identifier: fullKey,
+        });
+      }
+    }
+
+    return result;
+  }
+
+  /**
+   * Detect deprecated keys (in target but not in source) recursively.
+   *
+   * @param {Object} source - Framework config
+   * @param {Object} target - User config
+   * @param {string} prefix - Key path prefix
+   * @param {import('../types.js').MergeStats} stats - Stats accumulator
+   * @param {import('../types.js').MergeChange[]} changes - Changes accumulator
+   * @private
+   */
+  _detectDeprecated(source, target, prefix, stats, changes) {
+    for (const key of Object.keys(target)) {
+      const fullKey = prefix ? `${prefix}.${key}` : key;
+
+      if (!(key in source)) {
+        stats.conflicts++;
+        changes.push({
+          type: 'conflict',
+          identifier: fullKey,
+          reason: 'Deprecated key — may be removed in future version',
+        });
+      } else if (
+        this._isPlainObject(source[key]) &&
+        this._isPlainObject(target[key])
+      ) {
+        this._detectDeprecated(source[key], target[key], fullKey, stats, changes);
+      }
+    }
+  }
+
+  /**
+   * Check if value is a plain object (not array, null, etc.)
+   * @param {*} value - Value to check
+   * @returns {boolean}
+   * @private
+   */
+  _isPlainObject(value) {
+    if (value === null || typeof value !== 'object') return false;
+    if (Array.isArray(value)) return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+  }
+
+  /**
+   * @returns {string} Description of this strategy
+   */
+  getDescription() {
+    return 'Merges YAML config files by adding new keys while preserving user values (Phase 1)';
+  }
+}
+
+module.exports = { YamlMerger };

package/packages/installer/src/updater/index.js

@@ -118,7 +118,7 @@ class AIOSUpdater {
         if (!isOnline) {
           result.error = 'You appear to be offline. Please check your internet connection.';
         } else {
-          result.error = 'Package @synkra/aios-core not found on npm registry. This may be a local development installation.';
+          result.error = 'Package aios-core not found on npm registry. This may be a local development installation.';
         }
         return result;
       }
@@ -165,7 +165,7 @@ class AIOSUpdater {
     }
 
     // Fallback to package.json
-    const packageJsonPath = path.join(this.projectRoot, 'node_modules', '@synkra', 'aios-core', 'package.json');
+    const packageJsonPath = path.join(this.projectRoot, 'node_modules', 'aios-core', 'package.json');
     if (fs.existsSync(packageJsonPath)) {
       try {
         const pkg = await fs.readJson(packageJsonPath);
@@ -199,7 +199,7 @@ class AIOSUpdater {
   async getLatestVersion() {
     return new Promise((resolve) => {
       const request = https.get(
-        'https://registry.npmjs.org/@synkra/aios-core/latest',
+        'https://registry.npmjs.org/aios-core/latest',
         { timeout: this.options.timeout },
         (res) => {
           let data = '';
@@ -587,7 +587,7 @@ class AIOSUpdater {
 
     try {
       // Use npm to update the package
-      const cmd = `npm install @synkra/aios-core@${targetVersion} --save-exact`;
+      const cmd = `npm install aios-core@${targetVersion} --save-exact`;
       this.log(`Running: ${cmd}`);
 
       execSync(cmd, {