sinapse-ai 1.11.3 → 1.12.0

package/CHANGELOG.md

@@ -1,8 +1,37 @@
-## [1.11.3](https://github.com/caioimori/sinapse-ai/compare/1.11.2...1.11.3) (2026-06-19)
+## [1.12.0](https://github.com/caioimori/sinapse-ai/compare/1.11.3...1.12.0) (2026-06-20)
+
+### Features
+
+* **git-hooks:** protected-files guard recusa deleção/untrack de arquivos críticos [Story feat-protected-files-commit-guard] ([#257](https://github.com/caioimori/sinapse-ai/issues/257)) ([ee50168](https://github.com/caioimori/sinapse-ai/commit/ee501688d945591e0759c0f84963c6d44ff34f0e))
 
 ### Bug Fixes
 
-* **chrome-brain:** nao abrir o browser em toda sessao (remove hook SessionStart) ([63824bf](https://github.com/caioimori/sinapse-ai/commit/63824bfcaef491cb4012d966a05f2a3c32d944fe))
+* **activation:** resolve alias de agent id pro arquivo canonico (greeting degradado em 6/12) [Story fix-agent-activation-alias-resolution] ([#256](https://github.com/caioimori/sinapse-ai/issues/256)) ([dffae0c](https://github.com/caioimori/sinapse-ai/commit/dffae0c1680b7ded166a44185a02be1fbb3bedcc))
+* **doctor:** git-hooks usa WARN p/ hook system proprio (era FAIL) ([#240](https://github.com/caioimori/sinapse-ai/issues/240)) ([d112326](https://github.com/caioimori/sinapse-ai/commit/d1123269cbbe12d14fbedd116a1d92f9c2a86925))
+* **ide-sync:** resync mirror .claude + conserta YAML do swarm-orqx ([#244](https://github.com/caioimori/sinapse-ai/issues/244)) ([bdc93b6](https://github.com/caioimori/sinapse-ai/commit/bdc93b6118389a979289505d37a8eec9752d51b1))
+* **registry:** dedup robusto de IDs + ressync service-registry stale [Story fix-registry-dedup-stale] ([#251](https://github.com/caioimori/sinapse-ai/issues/251)) ([e53eac3](https://github.com/caioimori/sinapse-ai/commit/e53eac3e70a53efdda9102399c90c68bb0c6b425))
+* **squad-commercial:** religa roteamento do orqx aos 9 especialistas reais ([#238](https://github.com/caioimori/sinapse-ai/issues/238)) ([6469883](https://github.com/caioimori/sinapse-ai/commit/64698839ad08ee0a045f90257a1b2fafbc2a5ade))
+* **squad-council:** enumera as 56 tasks no squad.yaml (eram nao-descobriveis) ([#242](https://github.com/caioimori/sinapse-ai/issues/242)) ([20320fd](https://github.com/caioimori/sinapse-ai/commit/20320fd2b21312f64de7faa91a8f3a6e7c54d988))
+* **squads:** religa 16 especialistas orfaos nos orqx de 5 squads ([#241](https://github.com/caioimori/sinapse-ai/issues/241)) ([ac7283b](https://github.com/caioimori/sinapse-ai/commit/ac7283bc03a672fbb9568918b80734cd50ca62f0))
+* **test:** corrige semantica do coverageThreshold + sobe piso real do core/ [Story test-coverage-threshold-semantics] ([#255](https://github.com/caioimori/sinapse-ai/issues/255)) ([e9f80ee](https://github.com/caioimori/sinapse-ai/commit/e9f80eeb57758fdb3f5c408e6459ba8b89f59407)), closes [#254](https://github.com/caioimori/sinapse-ai/issues/254) [#254](https://github.com/caioimori/sinapse-ai/issues/254)
+
+### Maintenance
+
+* **ci:** renomeia workflow 'Test' -> 'Post-Merge Smoke & Build Checks' ([#249](https://github.com/caioimori/sinapse-ai/issues/249)) ([a40b0c7](https://github.com/caioimori/sinapse-ai/commit/a40b0c7ca9355a715424858813c02f416e4e87de))
+* **conformance:** assisted-mode default + rebrand instalador legado + remove residuo ES [Story chore-sinapse-conformance] ([#258](https://github.com/caioimori/sinapse-ai/issues/258)) ([3fb88a3](https://github.com/caioimori/sinapse-ai/commit/3fb88a3712d0e44fa53fdc3e984a8c0cf30d265f))
+* **deps:** bump undici dev (6.27.0/7.28.0) p/ corrigir HIGH dev-only ([#243](https://github.com/caioimori/sinapse-ai/issues/243)) ([9940576](https://github.com/caioimori/sinapse-ai/commit/99405767012b5cd06d942a1ed47148e4b9fd93c0))
+* ignora colaborator/ (pasta local de referencia, fora do git e do npm) ([34bc1bc](https://github.com/caioimori/sinapse-ai/commit/34bc1bc07fa9f44df9c8259ace099f5f5a5aedf0))
+* **lint:** autofix triviais (392->44 warns, 0 errors) + ignora colaborator/ ([#245](https://github.com/caioimori/sinapse-ai/issues/245)) ([70c54ae](https://github.com/caioimori/sinapse-ai/commit/70c54ae01403825724f3987e72ce70978c41b074))
+* **lint:** zera os 33 warnings remanescentes (0 errors, 0 warnings) ([#250](https://github.com/caioimori/sinapse-ai/issues/250)) ([0ac779a](https://github.com/caioimori/sinapse-ai/commit/0ac779a7855166e3ab6cae7b74f163a9f2fa5efc))
+* **packaging:** corta node_modules do tarball + higiene de deps runtime ([#239](https://github.com/caioimori/sinapse-ai/issues/239)) ([d36afb0](https://github.com/caioimori/sinapse-ai/commit/d36afb09da96c946ab9f06743306513ff6aa55ce))
+* **pkg:** expoe API programatica (main/module/types/exports) + index.d.ts honesto ([#253](https://github.com/caioimori/sinapse-ai/issues/253)) ([4971413](https://github.com/caioimori/sinapse-ai/commit/4971413b419fe41000c0fbfffe668eaec39cc013))
+* **test:** deleta 22 testes mortos do tools-system (codigo removido v4.31->v2.1) ([#252](https://github.com/caioimori/sinapse-ai/issues/252)) ([8ed5bd6](https://github.com/caioimori/sinapse-ai/commit/8ed5bd61c150e4c25f04fef70d8d60dc9325aeb1))
+* **test:** exclui colaborator/ do jest (local test passa a espelhar CI) ([#248](https://github.com/caioimori/sinapse-ai/issues/248)) ([3eae775](https://github.com/caioimori/sinapse-ai/commit/3eae775298d2686f679fcadbb80994044d974874)), closes [#245](https://github.com/caioimori/sinapse-ai/issues/245)
+
+### Refactoring
+
+* **identity:** SINAPSE canonico — remove dir SNPS/ stale + corrige help ([#246](https://github.com/caioimori/sinapse-ai/issues/246)) ([3a805fa](https://github.com/caioimori/sinapse-ai/commit/3a805fa5366dce9881125521a41e90d6eb4a0e80))
+* **identity:** unifica conteudo do Imperator (snps-orqx desatualizado) ([#247](https://github.com/caioimori/sinapse-ai/issues/247)) ([f52376d](https://github.com/caioimori/sinapse-ai/commit/f52376d040fdfc2c3f3c4f95789249d5cae6f8ef))
 
 # Changelog
 

package/bin/commands/doctor.js

@@ -33,7 +33,7 @@ Exit codes (Story A.3):
   }
 
   const doctorModulePath = path.join(__dirname, '..', '..', '.sinapse-ai', 'core', 'doctor');
-  // eslint-disable-next-line global-require
+   
   const { runDoctorChecks, resolveExitCode } = require(doctorModulePath);
   const result = await runDoctorChecks({
     fix: Boolean(opts.fix),

package/bin/commands/help.js

@@ -31,10 +31,9 @@ function cmdHelp() {
   logger.always(`  ${CYAN}sinapse --continue${NC}           Continua última sessão`);
   logger.always('');
   logger.always(`${BOLD}Agents:${NC}\n`);
-  logger.always(`  Invocação canônica:  ${CYAN}/SNPS:agents:{agent-id}${NC}`);
-  logger.always(`  Exemplo:             ${CYAN}/SNPS:agents:brand-orqx${NC}`);
-  logger.always(`  Master orchestrator: ${CYAN}@snps-orqx${NC} (alias: ${DIM}@sinapse-orqx${NC})`);
-  logger.always(`  ${DIM}Alias /SINAPSE:agents:* preservado até v1.3.0 (deprecação suave).${NC}`);
+  logger.always(`  Invocação canônica:  ${CYAN}/SINAPSE:agents:{agent-id}${NC}`);
+  logger.always(`  Exemplo:             ${CYAN}/SINAPSE:agents:brand-orqx${NC}`);
+  logger.always(`  Master orchestrator: ${CYAN}@sinapse-orqx${NC} (alias: ${DIM}@snps-orqx${NC})`);
   logger.always('');
   logger.always(`${BOLD}Ajuda extra:${NC}\n`);
   logger.always(`  Erros comuns + remediação: ${CYAN}docs/guides/cli-errors.md${NC}`);

package/bin/commands/install.js

@@ -155,7 +155,7 @@ async function cmdInstallGlobal(opts = {}) {
   if (squads.length === 0) {
     logger.error(`${RED}Erro: nenhum diretório de squad encontrado no pacote.${NC}`);
     logger.error(`Tente reinstalar: ${CYAN}npm install -g sinapse-ai${NC}`);
-    logger.error(`Se persistir, abra um issue: https://github.com/caioimori/sinapse-ai/issues`);
+    logger.error('Se persistir, abra um issue: https://github.com/caioimori/sinapse-ai/issues');
     process.exit(1);
   }
 
@@ -275,7 +275,7 @@ async function cmdInstallGlobal(opts = {}) {
     for (const f of fs.readdirSync(CLAUDE_COMMANDS_DIR)) {
       fs.unlinkSync(path.join(CLAUDE_COMMANDS_DIR, f));
     }
-  } catch {}
+  } catch { /* dir may not exist on a fresh install */ }
 
   const sinapseBase = toForwardSlash(SINAPSE_HOME);
   const writtenAgents = new Set();
@@ -622,13 +622,13 @@ function generateCommandMd(agentId, agentName, agentIcon, squadName, squadPath,
     ? `4. Briefing-on-activation check (this agent is an ORCHESTRATOR):
    - If user provided briefing/context with the activation → proceed IMMEDIATELY: absorb → diagnose → plan with phases + agents + handoffs → execute (YOLO). NEVER ask "do you want me to plan?".
    - If bare activation only → await briefing. On receipt, apply same flow automatically.`
-    : `4. HALT and await user input`;
+    : '4. HALT and await user input';
 
   const step6 = isOrchestrator
     ? `6. Briefing-on-activation check (ORCHESTRATOR):
    - If user provided briefing → proceed IMMEDIATELY: absorb → diagnose → plan → execute
    - If bare activation → await briefing, then plan automatically. NEVER ask "do you want me to plan?".`
-    : `6. HALT and await user input`;
+    : '6. HALT and await user input';
 
   // Frontmatter (name + description) is REQUIRED so the file resolves as a Claude Code
   // subagent (@id) — without it, @id matches nothing. The same file doubles as a slash
@@ -754,7 +754,7 @@ See \`.claude/rules/squad-awareness.md\` for the full delegation map.
     try {
       const orqxFile = fs.readdirSync(sAgentsDir).find(f => f.endsWith('-orqx.md'));
       if (orqxFile) orqxName = orqxFile.replace('.md', '');
-    } catch {}
+    } catch { /* fall back to the derived orqx name */ }
     return `| ${s.name} | @${orqxName} | ${s.agents} agents, ${s.tasks} tasks |`;
   }).join('\n');
 
@@ -828,12 +828,12 @@ exec claude --add-dir "${sinapsePathForBash}" --agent sinapse-orqx "$@"
 `;
   const bashPath = path.join(BIN_DIR, 'sinapse');
   fs.writeFileSync(bashPath, bashLauncher);
-  try { fs.chmodSync(bashPath, 0o755); } catch {}
+  try { fs.chmodSync(bashPath, 0o755); } catch { /* chmod is best-effort (no-op on non-POSIX) */ }
   logger.always(`  ${GREEN}OK${NC} ~/bin/sinapse`);
 
   // Windows CMD launcher
   if (IS_WIN) {
-    const cmdLauncher = `@echo off\r\nclaude --add-dir "%USERPROFILE%\\.sinapse" --agent sinapse-orqx %*\r\n`;
+    const cmdLauncher = '@echo off\r\nclaude --add-dir "%USERPROFILE%\\.sinapse" --agent sinapse-orqx %*\r\n';
     fs.writeFileSync(path.join(BIN_DIR, 'sinapse.cmd'), cmdLauncher);
     logger.always(`  ${GREEN}OK${NC} ~/bin/sinapse.cmd`);
   }

package/bin/commands/status.js

@@ -23,9 +23,9 @@ function verifyInstall() {
   const logger = getLogger();
   const checks = [
     [fs.existsSync(SINAPSE_HOME), `${getSquads(SINAPSE_HOME).length} squads in ~/.sinapse/`],
-    [fs.existsSync(CLAUDE_COMMANDS_DIR), `Commands in ~/.claude/commands/SINAPSE/agents/`],
-    [fs.existsSync(path.join(BIN_DIR, 'sinapse')), `Launcher at ~/bin/sinapse`],
-    [fs.existsSync(path.join(SINAPSE_HOME, '.claude', 'rules', 'squad-awareness.md')), `squad-awareness.md`],
+    [fs.existsSync(CLAUDE_COMMANDS_DIR), 'Commands in ~/.claude/commands/SINAPSE/agents/'],
+    [fs.existsSync(path.join(BIN_DIR, 'sinapse')), 'Launcher at ~/bin/sinapse'],
+    [fs.existsSync(path.join(SINAPSE_HOME, '.claude', 'rules', 'squad-awareness.md')), 'squad-awareness.md'],
   ];
 
   for (const [ok, msg] of checks) {

package/bin/modules/chrome-brain-installer.js

@@ -183,7 +183,7 @@ function removeHooks(settingsPath, matchers) {
 function sanitizeChromePath(chromePath) {
   // Validate Chrome path contains only safe characters to prevent shell injection
   const sanitized = chromePath.replace(/\\/g, '/');
-  if (!/^[a-zA-Z0-9\s/\-_.:()\[\]]+$/.test(sanitized)) {
+  if (!/^[a-zA-Z0-9\s/\-_.:()[\]]+$/.test(sanitized)) {
     throw new Error(`Unsafe Chrome path detected: ${chromePath}`);
   }
   return sanitized;
@@ -201,7 +201,7 @@ if command -v taskkill &>/dev/null; then
 elif command -v pgrep &>/dev/null; then
   pgrep -f "user-data-dir=$CHROME_DEBUG_PROFILE" 2>/dev/null | xargs kill 2>/dev/null || true
 fi`
-    : `pgrep -f "user-data-dir=$CHROME_DEBUG_PROFILE" 2>/dev/null | xargs kill 2>/dev/null || true`;
+    : 'pgrep -f "user-data-dir=$CHROME_DEBUG_PROFILE" 2>/dev/null | xargs kill 2>/dev/null || true';
 
   return `#!/bin/bash
 # Chrome Brain — chrome-ensure (auto-launch)
@@ -253,7 +253,7 @@ if command -v taskkill &>/dev/null; then
 elif command -v pgrep &>/dev/null; then
   pgrep -f "user-data-dir=$CHROME_DEBUG_PROFILE" 2>/dev/null | xargs kill 2>/dev/null || true
 fi`
-    : `pgrep -f "user-data-dir=$CHROME_DEBUG_PROFILE" 2>/dev/null | xargs kill 2>/dev/null || true`;
+    : 'pgrep -f "user-data-dir=$CHROME_DEBUG_PROFILE" 2>/dev/null | xargs kill 2>/dev/null || true';
 
   return `#!/bin/bash
 # Chrome Brain — chrome-debug (manual launch)

package/bin/postinstall.js

@@ -485,7 +485,7 @@ function renderFinalSummary(opts = {}) {
   }
   lines.push('');
   if (isGlobal) {
-    lines.push(`Próximo passo:`);
+    lines.push('Próximo passo:');
     lines.push(`  cd ${c.cyan}seu-projeto${c.reset}`);
     lines.push(`  ${c.cyan}sinapse install${c.reset}`);
   } else {

package/bin/sinapse-init.js

@@ -55,17 +55,19 @@ function spawnAsync(command, options = {}) {
   });
 }
 
-// ASCII Art Banner (Clean blocky style like reference image)
-const BANNER = chalk.cyan(`
-  █████╗ ██╗ ██████╗ ███████╗      ███████╗██╗   ██╗██╗     ██╗     ███████╗████████╗ █████╗  ██████╗██╗  ██╗
- ██╔══██╗██║██╔═══██╗██╔════╝      ██╔════╝██║   ██║██║     ██║     ██╔════╝╚══██╔══╝██╔══██╗██╔════╝██║ ██╔╝
- ███████║██║██║   ██║███████╗█████╗█████╗  ██║   ██║██║     ██║     ███████╗   ██║   ███████║██║     █████╔╝
- ██╔══██║██║██║   ██║╚════██║╚════╝██╔══╝  ██║   ██║██║     ██║     ╚════██║   ██║   ██╔══██║██║     ██╔═██╗
- ██║  ██║██║╚██████╔╝███████║      ██║     ╚██████╔╝███████╗███████╗███████║   ██║   ██║  ██║╚██████╗██║  ██╗
- ╚═╝  ╚═╝╚═╝ ╚═════╝ ╚══════╝      ╚═╝      ╚═════╝ ╚══════╝╚══════╝╚══════╝   ╚═╝   ╚═╝  ╚═╝ ╚═════╝╚═╝  ╚═╝
+// ASCII Art Banner — canonical SNPS AI wordmark in white (matches bin/lib/header.js).
+// Kept in sync with the live banner so the legacy fallback installer never shows
+// off-brand art (this banner predated the SINAPSE rebrand).
+const BANNER = chalk.white.bold(`
+ ███████╗███╗   ██╗██████╗ ███████╗     █████╗ ██╗
+ ██╔════╝████╗  ██║██╔══██╗██╔════╝    ██╔══██╗██║
+ ███████╗██╔██╗ ██║██████╔╝███████╗    ███████║██║
+ ╚════██║██║╚██╗██║██╔═══╝ ╚════██║    ██╔══██║██║
+ ███████║██║ ╚████║██║     ███████║    ██║  ██║██║
+ ╚══════╝╚═╝  ╚═══╝╚═╝     ╚══════╝    ╚═╝  ╚═╝╚═╝
 `);
 
-const SUBTITLE = chalk.magenta('Universal AI Agent Framework for Any Domain');
+const SUBTITLE = chalk.dim('Seu copiloto de inteligencia artificial');
 // Read version from package.json dynamically
 const packageJsonVersion = require(path.join(__dirname, '..', 'package.json')).version;
 const VERSION = chalk.yellow(`Installer v${packageJsonVersion}`);

package/bin/sinapse.js

@@ -548,7 +548,7 @@ function findClaudeCliPath() {
   try {
     const npmRoot = execSync('npm root -g', { encoding: 'utf8' }).trim();
     candidates.unshift(path.join(npmRoot, '@anthropic-ai/claude-code/cli.js'));
-  } catch {}
+  } catch { /* npm root -g may be unavailable; fall through to other candidates */ }
   for (const p of candidates) {
     if (fs.existsSync(p)) return p;
   }

package/bin/utils/framework-guard.js

@@ -54,6 +54,7 @@ function globToRegex(glob) {
   pattern = pattern.replace(/\*/g, '[^/]+');
 
   // 4. Restore ** placeholder to any-depth matcher
+  // eslint-disable-next-line no-control-regex -- internal placeholder char (set above), never user input
   pattern = pattern.replace(/\u0000/g, '.+');
 
   // If pattern ends with .+ (was **), match prefix

package/bin/utils/staged-protected-files-guard.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * staged-protected-files-guard — blocks a commit that DELETES (or untracks) a
+ * protected, committed-but-critical framework file.
+ *
+ * Why: on 2026-06-20 a "snapshot migracao notebook" sweep (`git add -A`) untracked
+ * `.sinapse-ai/core/registry/service-registry.json` (the committed registry drift
+ * detector, ~12k lines), bundled it with unrelated work, and pushed it. The
+ * framework-boundary guard is a no-op in contributor mode
+ * (boundary.frameworkProtection=false), so nothing stopped the deletion. This guard
+ * is ALWAYS on and narrowly targets that class of damage — it never touches normal
+ * edits, only the removal of a curated set of protected paths.
+ *
+ * Intentional removal (done in a story) bypasses with: git commit --no-verify
+ *
+ * Self-contained: Node built-ins + `git` only (matches the other lib guards so it
+ * bundles into <hooksDir>/lib/ with no extra deps).
+ */
+
+const { spawnSync } = require('child_process');
+
+// Curated, high-signal list. Keep small to guarantee zero false positives on
+// normal work. These files are committed on purpose and must never be removed by
+// an automated sweep without an explicit story.
+const PROTECTED = ['.sinapse-ai/core/registry/service-registry.json'];
+
+function stagedDeletions() {
+  // --no-renames forces a rename-away of a protected file to surface as a real
+  // deletion (D) of the old path, so moving the file out also trips the guard.
+  const res = spawnSync('git', ['diff', '--cached', '--name-status', '--no-renames'], {
+    encoding: 'utf8',
+  });
+  if (!res || res.status !== 0 || typeof res.stdout !== 'string') return [];
+  const deleted = [];
+  for (const line of res.stdout.split('\n')) {
+    if (!line) continue;
+    const parts = line.split('\t');
+    const status = parts[0];
+    const file = (parts[parts.length - 1] || '').replace(/\\/g, '/');
+    if (status === 'D') deleted.push(file);
+  }
+  return deleted;
+}
+
+const offenders = stagedDeletions().filter((f) => PROTECTED.includes(f));
+
+if (offenders.length > 0) {
+  process.stderr.write(
+    'SINAPSE Protected Files: blocking commit — it deletes/untracks a protected file:\n',
+  );
+  for (const f of offenders) process.stderr.write('  - ' + f + '\n');
+  process.stderr.write(
+    '\nThese files are committed on purpose (e.g. service-registry.json is the registry\n' +
+      'drift detector). They must not be removed by an automated sweep (git add -A) or a\n' +
+      'machine-migration snapshot. If this removal is intentional, do it in a story and\n' +
+      'bypass once with:  git commit --no-verify\n',
+  );
+  process.exit(1);
+}
+
+process.exit(0);

package/package.json

@@ -1,12 +1,23 @@
 {
   "name": "sinapse-ai",
-  "version": "1.11.3",
+  "version": "1.12.0",
   "description": "SINAPSE AI: Framework de orquestracao de IA — 17 squads, 172 agentes especializados",
   "bin": {
     "sinapse": "bin/sinapse.js",
     "sinapse-ai": "bin/cli.js",
     "sinapse-delegate": "bin/sinapse-delegate.js"
   },
+  "main": ".sinapse-ai/index.js",
+  "module": ".sinapse-ai/index.esm.js",
+  "types": ".sinapse-ai/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./.sinapse-ai/index.d.ts",
+      "default": "./.sinapse-ai/index.js"
+    },
+    "./package.json": "./package.json",
+    "./*": "./*"
+  },
   "preferGlobal": false,
   "workspaces": [
     "packages/*"
@@ -16,6 +27,8 @@
     "scripts/",
     "packages/",
     ".sinapse-ai/",
+    "!.sinapse-ai/node_modules",
+    "!**/node_modules/**",
     ".claude/CLAUDE.md",
     ".claude/rules/",
     ".claude/hooks/",
@@ -139,6 +152,7 @@
     "cli-progress": "^3.12.0",
     "commander": "^12.1.0",
     "cross-spawn": "^7.0.6",
+    "diff": "^5.2.0",
     "execa": "^5.1.1",
     "fast-glob": "^3.3.3",
     "fs-extra": "^11.3.2",
@@ -178,6 +192,9 @@
     "url": "https://github.com/caioimori/sinapse-ai/issues"
   },
   "homepage": "https://github.com/caioimori/sinapse-ai#readme",
+  "publishConfig": {
+    "access": "public"
+  },
   "engines": {
     "node": ">=18.0.0",
     "npm": ">=9.0.0"
@@ -216,7 +233,7 @@
     ]
   },
   "overrides": {
-    "diff": "^8.0.3",
+    "diff": "^5.2.0",
     "serialize-javascript": "^7.0.5",
     "picomatch": "^4.0.4",
     "brace-expansion": "^5.0.6",

package/packages/installer/src/index.js

@@ -19,7 +19,7 @@ if (require.main === module) {
   Promise.resolve()
     .then(() => wizard.runWizard())
     .catch((error) => {
-      // eslint-disable-next-line no-console
+       
       console.error('Installer failed:', error && error.message ? error.message : error);
       process.exit(1);
     });

package/packages/installer/src/installer/brownfield-upgrader.js

@@ -287,7 +287,7 @@ async function applyUpgrade(report, sourceDir, targetDir, options = {}) {
             result.mergeWarnings = result.mergeWarnings || [];
             for (const conflict of conflicts) {
               result.mergeWarnings.push(
-                `core-config.yaml: ${conflict.identifier} — ${conflict.reason}`
+                `core-config.yaml: ${conflict.identifier} — ${conflict.reason}`,
               );
             }
           }

package/packages/installer/src/installer/git-hooks-installer.js

@@ -67,6 +67,9 @@ const SCANNER_SOURCES = [
   { from: path.join(BIN_UTILS, 'staged-sql-guard.js'), to: 'staged-sql-guard.js' },
   // --- framework boundary guard (FASE C; respects boundary.frameworkProtection) ---
   { from: path.join(BIN_UTILS, 'framework-guard.js'), to: 'framework-guard.js' },
+  // --- protected-files guard (always-on; blocks deletion/untrack of committed
+  // critical files like service-registry.json — anti git-add-A-sweep) ---
+  { from: path.join(BIN_UTILS, 'staged-protected-files-guard.js'), to: 'staged-protected-files-guard.js' },
 ];
 
 /**
@@ -173,13 +176,15 @@ function copyScannerLib(hooksDir) {
 /**
  * Build the content of the managed `pre-commit` Node hook.
  *
- * The hook runs THREE bundled guards in sequence (each a standalone module
+ * The hook runs FOUR bundled guards in sequence (each a standalone module
  * under ./lib that exits non-zero on a finding), then chains to a pre-existing
  * husky hook:
  *   1. staged-secret-scan.js  — secret/.env/private-key/entropy leak (fail-CLOSED)
  *   2. staged-sql-guard.js     — destructive DDL/DML (DROP/TRUNCATE/DELETE-no-WHERE)
  *   3. framework-guard.js      — L1/L2 boundary (no-op unless boundary
  *                                .frameworkProtection is true in core-config.yaml)
+ *   4. staged-protected-files-guard.js — always-on; blocks deletion/untrack of
+ *                                committed critical files (e.g. service-registry.json)
  *
  * Each guard is spawned as a child Node process (cwd = project root, where git
  * already runs hooks) so it gets the same staged index and reuses its own
@@ -209,13 +214,15 @@ const { spawnSync } = require('child_process');
 const projectRoot = process.cwd();
 const libDir = path.join(__dirname, 'lib');
 
-// --- 1-3. SINAPSE staged guards (each fail-CLOSED) ---------------------------
-// Order: secret scan, then destructive-SQL guard, then framework-boundary guard.
+// --- 1-4. SINAPSE staged guards (each fail-CLOSED) ---------------------------
+// Order: secret scan, destructive-SQL guard, framework-boundary guard, then
+// protected-files guard (always-on anti-sweep; does NOT respect frameworkProtection).
 // framework-guard self-disables when boundary.frameworkProtection is false.
 const GUARDS = [
   { file: 'staged-secret-scan.js', label: 'Secret Scan' },
   { file: 'staged-sql-guard.js',   label: 'SQL Guard' },
   { file: 'framework-guard.js',    label: 'Framework Boundary' },
+  { file: 'staged-protected-files-guard.js', label: 'Protected Files' },
 ];
 
 for (const guard of GUARDS) {

package/packages/installer/src/pro/pro-scaffolder.js

@@ -80,7 +80,7 @@ async function scaffoldProContent(targetDir, proSourceDir, options = {}) {
   // Validate pro source exists
   if (!await fs.pathExists(proSourceDir)) {
     result.errors.push(
-      `Pro package not found at ${proSourceDir}. Run "npm install @sinapse-fullstack/pro" first.`
+      `Pro package not found at ${proSourceDir}. Run "npm install @sinapse-fullstack/pro" first.`,
     );
     return result;
   }
@@ -160,7 +160,7 @@ async function scaffoldProContent(targetDir, proSourceDir, options = {}) {
       result.errors.push(`Rollback errors: ${rollbackResult.errors.join(', ')}`);
     }
     result.warnings.push(
-      `Scaffolding failed: ${error.message}. ${rollbackResult.removed} files cleaned up.`
+      `Scaffolding failed: ${error.message}. ${rollbackResult.removed} files cleaned up.`,
     );
   }
 
@@ -425,7 +425,7 @@ async function installSquadCommands(targetDir) {
       for (const agentFile of agentFiles) {
         await fs.copy(
           path.join(agentsDir, agentFile),
-          path.join(destDir, agentFile)
+          path.join(destDir, agentFile),
         );
         files.push(path.relative(targetDir, path.join(destDir, agentFile)).replace(/\\/g, '/'));
       }

package/packages/installer/src/wizard/ide-config-generator.js

@@ -182,7 +182,7 @@ function generateTemplateVariables(wizardState) {
  * @param {Object} ideConfig - IDE configuration object (optional, for special handling)
  * @returns {Promise<string[]>} List of copied files
  */
-async function copyAgentFiles(projectRoot, agentFolder, ideConfig = null) {
+async function copyAgentFiles(projectRoot, agentFolder, _ideConfig = null) {
   // v4: Agents are in development/agents/ (not root agents/)
   const sourceDir = path.join(__dirname, '..', '..', '..', '..', '.sinapse-ai', 'development', 'agents');
   const targetDir = path.join(projectRoot, agentFolder);

package/packages/installer/src/wizard/index.js

@@ -15,14 +15,9 @@ const { execSync } = require('child_process');
 const { colors } = require('../utils/sinapse-colors');
 const {
   getLanguageQuestion,
-  getUserProfileQuestion,
   getLLMQuestion,
-  getProjectTypeQuestion,
-  getIDEQuestions,
-  getTechPresetQuestion,
 } = require('./questions');
-const { setLanguage, t, tf } = require('./i18n');
-const yaml = require('js-yaml');
+const { setLanguage, t } = require('./i18n');
 const { detectProjectTypeExtended } = require('../detection/detect-project-type');
 const { showWelcome, showCompletion, showCancellation } = require('./feedback');
 const { generateIDEConfigs, showSuccessSummary, copySkillFiles, copyExtraCommandFiles } = require('./ide-config-generator');
@@ -47,38 +42,6 @@ const {
   isLLMRoutingInstalled,
 } = require('../../../../.sinapse-ai/infrastructure/scripts/llm-routing/install-llm-routing');
 
-/**
- * Check for existing user_profile in core-config.yaml (Story 10.2 - Idempotency)
- * Returns the existing profile if found, null otherwise
- *
- * @param {string} targetDir - Target directory to check
- * @returns {Promise<string|null>} Existing user profile or null
- */
-async function getExistingUserProfile(targetDir = process.cwd()) {
-  const coreConfigPath = path.join(targetDir, '.sinapse-ai', 'core-config.yaml');
-
-  try {
-    if (await fse.pathExists(coreConfigPath)) {
-      const content = await fse.readFile(coreConfigPath, 'utf8');
-      const config = yaml.load(content);
-
-      if (config && config.user_profile) {
-        // Validate the value
-        const validProfiles = ['bob', 'advanced'];
-        const normalizedProfile = String(config.user_profile).toLowerCase().trim();
-
-        if (validProfiles.includes(normalizedProfile)) {
-          return normalizedProfile;
-        }
-      }
-    }
-  } catch {
-    // Config doesn't exist or is invalid - will ask for profile
-  }
-
-  return null;
-}
-
 /**
  * Map wizard language code to Claude Code settings.json language name (Story ACT-12)
  * Claude Code uses full language names, not ISO codes.
@@ -369,7 +332,7 @@ function buildAgentTemplate(agentId, squadName, homedir) {
     'ACTIVATION-NOTICE: This command activates an agent from sinapse.',
     '',
     `CRITICAL: Read the agent definition file at \`${agentDefPath}\` to understand your full operating parameters. Then:`,
-    `1. Adopt the persona defined in that file`,
+    '1. Adopt the persona defined in that file',
     `2. Load the squad manifest at \`${squadManifestPath}\` for context`,
     '3. Display a greeting showing your agent name, role, and available commands',
     '4. Briefing-on-activation check (this agent is an ORCHESTRATOR):',
@@ -781,7 +744,7 @@ async function runWizard(options = {}) {
       try {
         await commandValidate({ quiet: true });
         answers.ideSyncValidation = 'pass';
-      } catch (validateError) {
+      } catch {
         answers.ideSyncValidation = 'drift';
       } finally {
         console.log = _origLog;
@@ -879,7 +842,7 @@ async function runWizard(options = {}) {
         projectType: answers.projectType || 'greenfield',
         selectedIDEs: answers.selectedIDEs || [],
         mcpServers: answers.mcpServers || [],
-        userProfile: answers.userProfile || 'advanced', // Story 10.2: User Profile
+        userProfile: answers.userProfile || 'bob', // Assisted-by-default (open-source p/ leigos); advanced é toggle opt-in pós-install
         skipPrompts: options.quiet || false, // Skip prompts in quiet mode
         forceMerge: options.forceMerge, // Story 9.4: Smart Merge support
         noMerge: options.noMerge, // Story 9.4: Smart Merge support

package/scripts/audit-tasks.cjs

@@ -246,7 +246,7 @@ async function main() {
         `${s.avgScore}%`.padEnd(6) +
         String(s.critical).padEnd(6) +
         String(s.warning).padEnd(6) +
-        String(s.passing)
+        String(s.passing),
       );
     }
 

package/scripts/package-synapse.js

@@ -223,7 +223,7 @@ Add to \`.claude/settings.local.json\`:
     "UserPromptSubmit": [
       {
         "type": "command",
-        "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/synapse-engine.cjs\"",
+        "command": "node \\"$CLAUDE_PROJECT_DIR/.claude/hooks/synapse-engine.cjs\\"",
         "timeout": 10
       }
     ]