chati-dev 3.1.1 → 3.2.1

package/src/installer/templates.js

@@ -80,15 +80,6 @@ export const PROVIDER_MODEL_MAPS = {
       dev: 'codex', 'qa-implementation': 'codex', devops: 'mini',
     },
   },
-  copilot: {
-    deep: 'claude-sonnet', light: 'claude-sonnet', minimal: 'gpt-5',
-    agents: {
-      orchestrator: 'claude-sonnet', 'greenfield-wu': 'gpt-5', 'brownfield-wu': 'claude-sonnet',
-      brief: 'claude-sonnet', detail: 'claude-sonnet', architect: 'claude-sonnet', ux: 'claude-sonnet',
-      phases: 'claude-sonnet', tasks: 'claude-sonnet', 'qa-planning': 'claude-sonnet',
-      dev: 'claude-sonnet', 'qa-implementation': 'claude-sonnet', devops: 'claude-sonnet',
-    },
-  },
 };
 
 /**
@@ -110,7 +101,6 @@ export function generateConfigYaml(config) {
       claude: { enabled: true, primary: provider === 'claude' },
       gemini: { enabled: provider === 'gemini' || selectedIDEs.includes('gemini-cli'), model_default: 'pro', primary: provider === 'gemini' },
       codex: { enabled: provider === 'codex' || selectedIDEs.includes('codex-cli'), model_default: 'codex', primary: provider === 'codex' },
-      copilot: { enabled: provider === 'copilot' || selectedIDEs.includes('github-copilot'), primary: provider === 'copilot' },
     },
   };
 
@@ -231,54 +221,63 @@ User input: {{args}}
 }
 
 /**
- * Generate GitHub Copilot agent file (.github/agents/chati.md)
- *
- * Copilot CLI uses .github/agents/*.md for custom agents.
- * The user invokes with @chati in the Copilot CLI.
+ * Generate CLAUDE.local.md content (runtime state — auto-gitignored, never committed)
  */
-export function generateCopilotAgent() {
-  return `# Chati.dev Orchestrator
+export function generateClaudeLocalMd() {
+  return `# Chati.dev Runtime State
 
-You are the Chati.dev orchestrator agent for GitHub Copilot CLI.
+## Session Lock
+**Status: INACTIVE** — Type \`/chati\` to activate.
 
-## CRITICAL — Language Override
+<!-- SESSION-LOCK:INACTIVE -->
 
-Read \`.chati/session.yaml\` field \`language\` BEFORE anything else.
-ALL responses MUST be in this language. This overrides any global setting.
+## Current State
+- **Agent**: None (ready to start)
+- **Pipeline**: Pre-start
+- **Mode**: interactive
 
-| Value | Language |
-|-------|----------|
-| \`en\`  | English |
-| \`pt\`  | Portugues |
-| \`es\`  | Espanol |
-| \`fr\`  | Francais |
+## Recent Decisions
+_No decisions yet. Start with /chati._
 
-If session.yaml does not exist or has no language field, default to English.
+---
+_Auto-updated by Chati.dev orchestrator_
+`;
+}
 
-## Load
+/**
+ * Generate Gemini CLI session lock (.gemini/session-lock.md)
+ * Equivalent to CLAUDE.local.md — imported via @import in GEMINI.md.
+ */
+export function generateGeminiSessionLock() {
+  return `# Chati.dev Runtime State
 
-The orchestrator and all agent files are **pre-configured for GitHub Copilot CLI**.
-No translation needed — follow all instructions as written.
+## Session Lock
+**Status: INACTIVE** — Type \`/chati\` to activate.
 
-Read and execute the full orchestrator at \`chati.dev/orchestrator/chati.md\`.
+<!-- SESSION-LOCK:INACTIVE -->
 
-**NEVER create or reference CLAUDE.md, CLAUDE.local.md, or .claude/ directories.**
+## Current State
+- **Agent**: None (ready to start)
+- **Pipeline**: Pre-start
+- **Mode**: interactive
 
-**Context to pass:**
-- \`.chati/session.yaml\` (session state — includes language)
-- \`chati.dev/artifacts/handoffs/\` (latest handoff)
-- \`chati.dev/config.yaml\` (version info)
+## Recent Decisions
+_No decisions yet. Start with /chati._
+
+---
+_Auto-updated by Chati.dev orchestrator_
 `;
 }
 
 /**
- * Generate CLAUDE.local.md content (runtime state — auto-gitignored, never committed)
+ * Generate Codex CLI session lock (AGENTS.override.md)
+ * Codex auto-loads this as an override to AGENTS.md.
  */
-export function generateClaudeLocalMd() {
+export function generateAgentsOverrideMd() {
   return `# Chati.dev Runtime State
 
 ## Session Lock
-**Status: INACTIVE** — Type \`/chati\` to activate.
+**Status: INACTIVE** — Type \`$chati\` to activate.
 
 <!-- SESSION-LOCK:INACTIVE -->
 
@@ -288,9 +287,104 @@ export function generateClaudeLocalMd() {
 - **Mode**: interactive
 
 ## Recent Decisions
-_No decisions yet. Start with /chati._
+_No decisions yet. Start with $chati._
 
 ---
 _Auto-updated by Chati.dev orchestrator_
 `;
 }
+
+/**
+ * Generate Codex CLI constitution guard rules (.codex/rules/constitution-guard.rules)
+ * Starlark execution policy that blocks destructive commands and secret writes.
+ */
+export function generateCodexConstitutionGuardRules() {
+  return `# Chati.dev Constitution Guard — Codex CLI Execution Policy
+# Article XI: Block destructive commands and secret writes
+
+# Destructive commands that require explicit user approval
+deny_commands = [
+    "rm -rf",
+    "git reset --hard",
+    "git push --force",
+    "git push -f",
+    "git clean -fd",
+    "DROP TABLE",
+    "DROP DATABASE",
+    "TRUNCATE TABLE",
+    "chmod 777",
+]
+
+# Patterns that indicate secret/credential writes
+deny_write_patterns = [
+    "API_KEY=",
+    "SECRET_KEY=",
+    "PASSWORD=",
+    "TOKEN=",
+    "PRIVATE_KEY=",
+    "aws_secret_access_key",
+    "-----BEGIN RSA PRIVATE KEY-----",
+    "-----BEGIN OPENSSH PRIVATE KEY-----",
+]
+
+# Files that should never be written to
+deny_write_files = [
+    ".env",
+    ".env.local",
+    ".env.production",
+    "credentials.json",
+    "service-account.json",
+]
+
+# Allow list — these are safe even though they match patterns
+allow_write_files = [
+    ".env.example",
+    ".env.template",
+    ".env.sample",
+]
+`;
+}
+
+/**
+ * Generate Codex CLI read protection rules (.codex/rules/read-protection.rules)
+ * Starlark execution policy that blocks reading sensitive files.
+ */
+export function generateCodexReadProtectionRules() {
+  return `# Chati.dev Read Protection — Codex CLI Execution Policy
+# Article XI: Protect sensitive files from being read
+
+# Files that should never be read
+deny_read_files = [
+    ".env",
+    ".env.local",
+    ".env.production",
+    ".env.staging",
+]
+
+# File extensions that indicate sensitive content
+deny_read_extensions = [
+    ".pem",
+    ".key",
+    ".p12",
+    ".pfx",
+    ".jks",
+]
+
+# Paths that should never be read
+deny_read_paths = [
+    "credentials.json",
+    "service-account.json",
+    ".git/config",
+    ".ssh/",
+    ".aws/credentials",
+    ".npmrc",
+]
+
+# Allow list — these are safe even though they match patterns
+allow_read_files = [
+    ".env.example",
+    ".env.template",
+    ".env.sample",
+]
+`;
+}

package/src/terminal/adapters/index.js

@@ -5,4 +5,3 @@
 export * as claude from './claude-adapter.js';
 export * as gemini from './gemini-adapter.js';
 export * as codex from './codex-adapter.js';
-export * as copilot from './copilot-adapter.js';

package/src/terminal/cli-registry.js

@@ -51,7 +51,7 @@ const PROVIDERS = {
     baseArgs: [],
     modelFlag: '--model',
     stdinSupport: true,
-    hooksSupport: false,
+    hooksSupport: true,
     mcpSupport: true,
     contextFile: 'GEMINI.md',
     modelMap: {
@@ -75,21 +75,6 @@ const PROVIDERS = {
     },
     adapter: adapters.codex,
   },
-  copilot: {
-    name: 'copilot',
-    command: 'copilot',
-    baseArgs: ['-p'],
-    modelFlag: '--model',
-    stdinSupport: true,
-    hooksSupport: false,
-    mcpSupport: true,
-    contextFile: null,
-    modelMap: {
-      'claude-sonnet': 'claude-sonnet-4.5',
-      'gpt-5': 'gpt-5',
-    },
-    adapter: adapters.copilot,
-  },
 };
 
 // ---------------------------------------------------------------------------
@@ -99,7 +84,7 @@ const PROVIDERS = {
 /**
  * Get a provider configuration by name.
  *
- * @param {string} name - Provider name (claude, gemini, codex, copilot)
+ * @param {string} name - Provider name (claude, gemini, codex)
  * @returns {ProviderConfig}
  * @throws {Error} When provider is not found
  */

package/src/terminal/spawner.js

@@ -86,7 +86,7 @@ export function cleanParentEnv(env) {
  * @property {string} agent           - Agent name (e.g. "architect")
  * @property {string} taskId          - Task identifier
  * @property {string} [model]         - LLM model tier name (e.g. opus, pro, codex, claude-sonnet)
- * @property {string} [provider]      - CLI provider name (claude, gemini, codex, copilot)
+ * @property {string} [provider]      - CLI provider name (claude, gemini, codex)
  * @property {string} [prompt]        - Full prompt string (from prompt-builder, piped via stdin)
  * @property {object} [contextPayload] - Context to inject via env var
  * @property {string[]} [writeScope]   - Override write scope

package/src/utils/config-parser.js

@@ -22,7 +22,7 @@ export function parseProviderConfig(projectDir) {
   }
 
   const raw = readFileSync(configPath, 'utf-8');
-  const providers = ['claude', 'gemini', 'codex', 'copilot'];
+  const providers = ['claude', 'gemini', 'codex'];
   const enabled = [];
   let primary = 'claude';
 

package/src/wizard/i18n.js

@@ -24,7 +24,6 @@ const FALLBACK_EN = {
     llm_provider_claude: 'Claude (Anthropic) — Best for structured reasoning',
     llm_provider_gemini: 'Gemini (Google) — 1M token context window',
     llm_provider_codex: 'Codex (OpenAI) — Optimized for code generation',
-    llm_provider_copilot: 'Copilot (GitHub) — Multi-model, GitHub integrated',
     llm_provider_not_installed: '(CLI not detected)',
     llm_provider_label: 'AI Provider',
     will_install: 'Will install:',

package/src/wizard/index.js

@@ -19,7 +19,6 @@ const PROVIDER_TO_IDE = {
   claude: ['claude-code'],
   gemini: ['gemini-cli'],
   codex: ['codex-cli'],
-  copilot: ['github-copilot'],
 };
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -89,7 +88,6 @@ export async function runWizard(targetDir, options = {}) {
       'claude-code': 'Created .claude/commands/ (thin router)',
       'gemini-cli': 'Created .gemini/commands/ (TOML command)',
       'codex-cli': 'Created .agents/skills/chati/ (Codex skill)',
-      'github-copilot': 'Created .github/agents/ (Copilot agent)',
     };
     const commandStep = commandStepMap[primaryIDE] || t('installer.created_commands');
     showStep(commandStep);
@@ -132,7 +130,6 @@ export async function runWizard(targetDir, options = {}) {
 
     // Show quick start — same experience across all providers
     const invokeCmdMap = {
-      'github-copilot': '@chati',
       'codex-cli': '$chati',
     };
     const invokeCmd = invokeCmdMap[primaryIDE] || '/chati';

package/src/wizard/questions.js

@@ -67,7 +67,6 @@ export async function stepLlmProvider() {
     { name: 'claude', label: t('installer.llm_provider_claude') },
     { name: 'gemini', label: t('installer.llm_provider_gemini') },
     { name: 'codex', label: t('installer.llm_provider_codex') },
-    { name: 'copilot', label: t('installer.llm_provider_copilot') },
   ];
 
   // Check availability of each provider
@@ -110,7 +109,7 @@ export async function stepConfirmation(config) {
   const { projectName, projectType, language, llmProvider, selectedMCPs, selectedIDEs } = config;
 
   const langName = SUPPORTED_LANGUAGES.find(l => l.value === language)?.label || language;
-  const providerNames = { claude: 'Claude (Anthropic)', gemini: 'Gemini (Google)', codex: 'Codex (OpenAI)', copilot: 'Copilot (GitHub)' };
+  const providerNames = { claude: 'Claude (Anthropic)', gemini: 'Gemini (Google)', codex: 'Codex (OpenAI)' };
   const providerDisplay = providerNames[llmProvider] || llmProvider;
   const ideNames = (selectedIDEs || ['claude-code'])
     .map(id => IDE_CONFIGS[id]?.name || id)

package/src/terminal/adapters/copilot-adapter.js

@@ -1,28 +0,0 @@
-/**
- * @fileoverview GitHub Copilot CLI adapter.
- *
- * Translates chati.dev spawning config into Copilot CLI
- * command, arguments, and environment variables.
- */
-
-/**
- * Build Copilot CLI command and arguments.
- *
- * @param {import('../spawner.js').SpawnConfig} config
- * @param {import('../cli-registry.js').ProviderConfig} provider
- * @returns {{ command: string, args: string[], stdinPrompt: string|null }}
- */
-export function buildCommand(config, provider) {
-  const args = [...provider.baseArgs];
-
-  if (config.model) {
-    const resolvedModel = provider.modelMap[config.model] || config.model;
-    args.push(provider.modelFlag, resolvedModel);
-  }
-
-  return {
-    command: provider.command,
-    args,
-    stdinPrompt: config.prompt || null,
-  };
-}