sinapse-ai 1.12.1 → 1.13.0

package/bin/lib/command-generator.js

@@ -0,0 +1,261 @@
+// bin/lib/command-generator.js — shared agent-command generation.
+//
+// Single source of truth for the Phase 2 "generate agent commands" logic used by
+// BOTH `install` and `update`. Previously update.js only regenerated `-orqx`
+// commands, silently dropping every specialist command + the rich master stubs a
+// fresh install creates. Extracting the install behavior here makes `update`
+// produce byte-identical command files to `install`.
+
+const fs = require('fs');
+const path = require('path');
+
+const { SINAPSE_HOME, CLAUDE_COMMANDS_DIR } = require('./constants');
+const { extractAgentMeta } = require('./squads');
+const { toForwardSlash } = require('./fs-utils');
+
+/**
+ * Rich Imperator stub for the master entry points (@sinapse, @snps, @sinapse-orqx,
+ * @snps-orqx). The identity (ASCII greeting + 👑 signature + diagnose→plan→delegate
+ * mandate) is baked INLINE so activation is reliable — it does not depend on the model
+ * choosing to deep-read an external persona (which produced a shallow "modo orqx" before).
+ * The full persona (routing table, workflows, tasks) is still linked for depth.
+ */
+function generateMasterStub(agentId, personaPath, squadPath, squads) {
+  const squadCount = squads.length;
+  const agentCount = squads.reduce((a, s) => a + (s.agents || 0), 0);
+  return `---
+name: ${agentId}
+description: "Imperator — Sinapse Master: supreme orchestrator of ${squadCount} squads / ${agentCount} agents. Diagnoses every briefing and auto-generates an orchestration plan."
+---
+
+# Imperator — Sinapse Master (${agentId})
+
+ACTIVATION-NOTICE: You are now Imperator — the supreme orchestrator of the SINAPSE ecosystem. Every request passes through you first.
+
+## YOUR ONLY FUNCTION — NON-NEGOTIABLE
+
+You DIAGNOSE and HAND OFF. That is the whole job. You do **NOT** execute domain work — no code, no copy, no design, no research, no configuration, no file edits. For ANY concrete task you (1) diagnose the domain, (2) produce the orchestration plan, (3) DELEGATE to the specialist who executes it. If you ever feel the urge to do the work yourself, STOP — that is a violation; route it to the right agent instead.
+
+## ON ACTIVATION — display this EXACTLY as your first output (before anything else)
+
+\`\`\`
+ ███████╗██╗███╗   ██╗ █████╗ ██████╗ ███████╗███████╗
+ ██╔════╝██║████╗  ██║██╔══██╗██╔══██╗██╔════╝██╔════╝
+ ███████╗██║██╔██╗ ██║███████║██████╔╝███████╗█████╗
+ ╚════██║██║██║╚██╗██║██╔══██║██╔═══╝ ╚════██║██╔══╝
+ ███████║██║██║ ╚████║██║  ██║██║     ███████║███████╗
+ ╚══════╝╚═╝╚═╝  ╚═══╝╚═╝  ╚═╝╚═╝     ╚══════╝╚══════╝
+          ██████╗ ██████╗  ██████╗ ██╗  ██╗
+         ██╔═══██╗██╔══██╗██╔═══██╗╚██╗██╔╝
+         ██║   ██║██████╔╝██║   ██║ ╚███╔╝
+         ██║   ██║██╔══██╗██║▄▄ ██║ ██╔██╗
+         ╚██████╔╝██║  ██║╚██████╔╝██╔╝ ██╗
+          ╚═════╝ ╚═╝  ╚═╝ ╚══▀▀═╝ ╚═╝  ╚═╝
+\`\`\`
+
+\`\`\`
+ AI Agent Squads for Claude Code
+ ${squadCount} squads · ${agentCount} agents
+
+ 👑 Imperator — Sinapse Master ativado
+
+ Descreva seu objetivo que eu diagnostico o domínio
+ e roteio para o agente certo.
+
+ Comandos principais:
+ *route {pedido}     — Diagnostica e roteia para a squad certa
+ *plan {iniciativa}  — Desenha um plano de execução multi-squad
+ *status             — Reporta todas as squads e capacidades
+ *onboard            — Tour guiado do ecossistema SINAPSE
+ *help               — Mostra todos os comandos
+\`\`\`
+
+## AFTER THE GREETING — NON-NEGOTIABLE (Imperator's core function)
+
+Check if the user provided a briefing with the activation:
+- **Briefing provided** → proceed IMMEDIATELY: run the Initial State Audit → classify the request → produce an ORCHESTRATION PLAN (phases + squads + specific agents assigned + handoffs) → delegate to the specialists. NEVER ask "do you want me to plan?" — for Imperator the answer is always YES.
+- **Bare activation** → await the briefing, then apply the same flow automatically on receipt.
+
+You diagnose and DELEGATE — never execute domain work yourself. Route simple, well-defined requests directly to @specialist; complex ones to @{domain}-orqx; cross-domain ones by coordinating multiple orchestrators.
+
+## FULL OPERATING PARAMETERS
+
+For your complete persona — the routing table of all squads, the Initial State Audit, the Documentation-First gate, NSN enforcement, and every workflow and task — read and ADOPT:
+\`${personaPath}\`
+Tasks: \`${squadPath}/tasks/\` · Workflows: \`${squadPath}/workflows/\` · Manifest: \`${squadPath}/squad.yaml\`
+
+— Imperator, orchestrating SINAPSE
+`;
+}
+
+function generateCommandMd(agentId, agentName, agentIcon, squadName, squadPath, agentFile) {
+  // Detecta se é orquestrador: id termina em -orqx OU é Imperator (snps-orqx/sinapse-orqx)
+  // ou um dos apelidos curtos do master (sinapse/snps).
+  const isOrchestrator = /-orqx$/.test(agentId) || agentId === 'snps-orqx' || agentId === 'sinapse-orqx' || agentId === 'sinapse' || agentId === 'snps';
+
+  const step4 = isOrchestrator
+    ? `4. Briefing-on-activation check (this agent is an ORCHESTRATOR):
+   - If user provided briefing/context with the activation → proceed IMMEDIATELY: absorb → diagnose → plan with phases + agents + handoffs → execute (YOLO). NEVER ask "do you want me to plan?".
+   - If bare activation only → await briefing. On receipt, apply same flow automatically.`
+    : '4. HALT and await user input';
+
+  const step6 = isOrchestrator
+    ? `6. Briefing-on-activation check (ORCHESTRATOR):
+   - If user provided briefing → proceed IMMEDIATELY: absorb → diagnose → plan → execute
+   - If bare activation → await briefing, then plan automatically. NEVER ask "do you want me to plan?".`
+    : '6. HALT and await user input';
+
+  // Frontmatter (name + description) is REQUIRED so the file resolves as a Claude Code
+  // subagent (@id) — without it, @id matches nothing. The same file doubles as a slash
+  // command (/SINAPSE:agents:id); extra frontmatter is harmless there.
+  const fmDesc = (isOrchestrator
+    ? `${agentName || agentId} — orchestrator for ${squadName}; diagnoses, routes to specialists and auto-generates an orchestration plan`
+    : `${agentName || agentId} — ${squadName} specialist`).replace(/["\n\r]/g, ' ').trim();
+
+  return `---
+name: ${agentId}
+description: "${fmDesc}"
+---
+
+# ${agentId}
+
+ACTIVATION-NOTICE: This command activates an agent from ${squadName}.
+
+CRITICAL: Read the agent definition file at \`${squadPath}/agents/${agentFile}\` to understand your full operating parameters. Then:
+1. Adopt the persona defined in that file (name: ${agentName}, icon: ${agentIcon})
+2. Load the squad manifest at \`${squadPath}/squad.yaml\` for context
+3. Display a greeting showing your agent name, role, and available commands
+${step4}
+
+## Agent Reference
+- **Agent ID:** ${agentId}
+- **Squad:** ${squadName}
+- **Definition:** \`${squadPath}/agents/${agentFile}\`
+- **Squad Manifest:** \`${squadPath}/squad.yaml\`
+- **Tasks:** \`${squadPath}/tasks/\`
+- **Knowledge Bases:** \`${squadPath}/knowledge-base/\`
+- **Workflows:** \`${squadPath}/workflows/\`
+
+## Activation Instructions
+1. Read the full agent definition: \`${squadPath}/agents/${agentFile}\`
+2. Adopt the persona (name, icon, communication style, principles)
+3. Show greeting: "{icon} {name} — {role} ativado"
+4. Show: "Squad: ${squadName} | Invoke: /SINAPSE:agents:${agentId}"
+5. List your key tasks from the agent definition
+${step6}
+
+## How to Execute Tasks
+When the user requests a task:
+1. Find the matching task in \`${squadPath}/tasks/\`
+2. Read the task file completely
+3. Execute following the task checklist step by step
+4. Consult knowledge bases in \`${squadPath}/knowledge-base/\` as needed
+
+## Cross-Squad Handoff
+If the task requires expertise outside this squad:
+1. Identify which squad covers the needed domain
+2. Recommend: /SINAPSE:agents:{appropriate-agent}
+3. Provide handoff context
+`;
+}
+
+/**
+ * Regenerate ALL agent command files into `commandsDir`. This is the exact Phase 2
+ * behavior of a fresh install, shared so `update` produces an identical set:
+ *   1. Clear commandsDir.
+ *   2. Write a command for EVERY agent of every squad (not only -orqx).
+ *   3. Write commands for the sinapse master squad agents.
+ *   4. Overwrite the four master entry points (sinapse-orqx, snps-orqx, sinapse,
+ *      snps) with the rich Imperator stub.
+ *
+ * @param {Object} [deps] - Injectable dependencies (defaults bind to real fs/paths).
+ * @param {string} [deps.sinapseHome] - Root of installed squads (~/.sinapse).
+ * @param {string} [deps.commandsDir] - Target commands dir.
+ * @param {Array}  deps.squads - Squad descriptors ({ name, agents, ... }).
+ * @param {string} [deps.sinapseMasterDest] - Path to the installed sinapse/ master squad.
+ * @returns {{ writtenAgents: Set<string>, totalAgents: number }}
+ */
+function regenerateAgentCommands(deps = {}) {
+  const {
+    sinapseHome = SINAPSE_HOME,
+    commandsDir = CLAUDE_COMMANDS_DIR,
+    squads,
+    sinapseMasterDest = path.join(sinapseHome, 'sinapse'),
+  } = deps;
+
+  if (!Array.isArray(squads)) {
+    throw new Error('regenerateAgentCommands: `squads` array is required');
+  }
+
+  fs.mkdirSync(commandsDir, { recursive: true });
+
+  // Clear old commands (dir may not exist on a fresh install — guarded).
+  try {
+    for (const f of fs.readdirSync(commandsDir)) {
+      fs.unlinkSync(path.join(commandsDir, f));
+    }
+  } catch { /* dir may not exist yet */ }
+
+  const sinapseBase = toForwardSlash(sinapseHome);
+  const writtenAgents = new Set();
+
+  // 1. A command/subagent for EVERY agent (not only -orqx), so every specialist
+  //    is invokable via @agent and /SINAPSE:agents:agent.
+  for (const squad of squads) {
+    const squadPath = `${sinapseBase}/${squad.name}`;
+    const agentsDir = path.join(sinapseHome, squad.name, 'agents');
+    if (!fs.existsSync(agentsDir)) continue;
+
+    const squadAgents = fs.readdirSync(agentsDir).filter(f => f.endsWith('.md'));
+    for (const file of squadAgents) {
+      const agentId = file.replace('.md', '');
+      const meta = extractAgentMeta(path.join(agentsDir, file));
+      const cmdContent = generateCommandMd(agentId, meta.name, meta.icon, squad.name, squadPath, file);
+      fs.writeFileSync(path.join(commandsDir, `${agentId}.md`), cmdContent);
+      writtenAgents.add(file);
+    }
+  }
+
+  // 2. Commands for sinapse/ master squad agents.
+  if (fs.existsSync(sinapseMasterDest)) {
+    const masterAgentsDir = path.join(sinapseMasterDest, 'agents');
+    if (fs.existsSync(masterAgentsDir)) {
+      for (const file of fs.readdirSync(masterAgentsDir).filter(f => f.endsWith('.md'))) {
+        if (writtenAgents.has(file)) continue;
+        const agentId = file.replace('.md', '');
+        const meta = extractAgentMeta(path.join(masterAgentsDir, file));
+        const squadPath = `${sinapseBase}/sinapse`;
+        const cmdContent = generateCommandMd(agentId, meta.name, meta.icon, 'sinapse', squadPath, file);
+        fs.writeFileSync(path.join(commandsDir, `${agentId}.md`), cmdContent);
+        writtenAgents.add(file);
+      }
+    }
+  }
+
+  // 3. Master entry points (@sinapse, @snps, @sinapse-orqx, @snps-orqx) → rich
+  //    Imperator stub. Overwrites the generic command file for the orqx names and
+  //    adds the short aliases the user actually types.
+  if (fs.existsSync(sinapseMasterDest)) {
+    const masterSquadPath = `${sinapseBase}/sinapse`;
+    const masterEntryPoints = [
+      ['sinapse-orqx', 'sinapse-orqx.md'],
+      ['snps-orqx', 'snps-orqx.md'],
+      ['sinapse', 'sinapse-orqx.md'],
+      ['snps', 'snps-orqx.md'],
+    ];
+    for (const [id, personaFile] of masterEntryPoints) {
+      const personaPath = `${masterSquadPath}/agents/${personaFile}`;
+      const stub = generateMasterStub(id, personaPath, masterSquadPath, squads);
+      fs.writeFileSync(path.join(commandsDir, `${id}.md`), stub);
+      writtenAgents.add(`${id}.md`);
+    }
+  }
+
+  return { writtenAgents, totalAgents: writtenAgents.size };
+}
+
+module.exports = {
+  generateCommandMd,
+  generateMasterStub,
+  regenerateAgentCommands,
+};

package/bin/lib/prompts.js

@@ -1,9 +1,8 @@
-// bin/lib/prompts.js — interactive prompts (LLM, grounding, uninstall).
+// bin/lib/prompts.js — interactive prompts (LLM, uninstall).
 // Story GA-1.2 — extracted from bin/cli.js.
 
-const path = require('path');
 const { getLogger } = require('../../.sinapse-ai/core/logger');
-const { ROOT, CYAN, GREEN, BOLD, DIM, YELLOW, NC } = require('./constants');
+const { CYAN, GREEN, BOLD, DIM, YELLOW, NC } = require('./constants');
 const { detectInteractiveMode, warnNonInteractive } = require('./detection');
 
 /**
@@ -53,67 +52,6 @@ async function promptLlmChoice() {
   }
 }
 
-// Story 10.47 — collect optional grounding paths (vault / design system /
-// brand). Empty answers leave the section disabled and the shipped hook
-// stays a no-op. Reuses the multi-signal interactive detector from Story
-// 10.46 so CI / non-TTY runs skip silently with the consolidated warning
-// already emitted by lang/LLM helpers.
-async function promptGroundingSections({ isUpsert = false, reconfigure = false } = {}) {
-  const logger = getLogger();
-  const groundingConfig = require(path.join(
-    ROOT, 'packages', 'installer', 'src', 'wizard', 'grounding-config',
-  ));
-  const existing = groundingConfig.readGroundingConfig();
-  const pending = isUpsert && !reconfigure
-    ? groundingConfig.pendingGroundingSections(existing)
-    : { askVault: true, askDesignSystem: true, askBrand: true };
-
-  if (!pending.askVault && !pending.askDesignSystem && !pending.askBrand) {
-    return existing;
-  }
-
-  if (!detectInteractiveMode()) {
-    warnNonInteractive();
-    // Persist defaults so the file exists with a documented schema even on
-    // headless installs (helps users discover it later via `--reconfigure`).
-    const merged = groundingConfig.buildGroundingFromAnswers({}, existing);
-    groundingConfig.writeGroundingConfig(merged);
-    return merged;
-  }
-
-  const questions = require(path.join(
-    ROOT, 'packages', 'installer', 'src', 'wizard', 'questions',
-  ));
-  const inquirer = require('inquirer');
-
-  const ask = [];
-  if (pending.askVault) ask.push(questions.getVaultGroundingQuestion());
-  if (pending.askDesignSystem) ask.push(questions.getDesignSystemGroundingQuestion());
-  if (pending.askBrand) ask.push(questions.getBrandGroundingQuestion());
-
-  logger.always('');
-  logger.always(`${CYAN}Grounding semantico (opt-in):${NC}`);
-  logger.always(`${DIM}  Pular qualquer pergunta ativa o fallback generico do framework.${NC}`);
-
-  let answers = {};
-  try {
-    answers = await inquirer.prompt(ask);
-  } catch {
-    // Fallback: minimal readline loop if inquirer fails (e.g. exotic shells).
-    const readline = require('readline');
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    const askLine = (msg) => new Promise((resolve) => rl.question(msg, resolve));
-    if (pending.askVault) answers.vaultPath = (await askLine('  Vault path (Enter pra pular): ')).trim();
-    if (pending.askDesignSystem) answers.designSystemPath = (await askLine('  Design system path (Enter pra pular): ')).trim();
-    if (pending.askBrand) answers.brandbookPath = (await askLine('  Brandbook path (Enter pra pular): ')).trim();
-    rl.close();
-  }
-
-  const merged = groundingConfig.buildGroundingFromAnswers(answers, existing);
-  groundingConfig.writeGroundingConfig(merged);
-  return merged;
-}
-
 // Story 10.40 — Confirmation prompt for destructive uninstall.
 // Returns true if user confirmed, false otherwise.
 async function confirmUninstall() {
@@ -130,6 +68,5 @@ async function confirmUninstall() {
 
 module.exports = {
   promptLlmChoice,
-  promptGroundingSections,
   confirmUninstall,
 };

package/bin/modules/chrome-brain-installer.js

@@ -140,7 +140,8 @@ function mergeHooks(settingsPath, hookDefs) {
     const existing = settings.hooks[hookType] || [];
     const newKeys = new Set(hookList.map(h => hookKey(h.matcher, h)));
     // Dedupe by (matcher + command) so SessionStart matcher="" doesn't
-    // collide with other modules' SessionStart hooks (e.g. vault-grounding).
+    // collide with other modules' SessionStart hooks (e.g. another
+    // session-start grounding hook).
     const filtered = existing.filter(e => !newKeys.has(hookKey(e.matcher, e)));
     filtered.push(...hookList);
     settings.hooks[hookType] = filtered;

package/bin/postinstall.js

@@ -340,7 +340,7 @@ function stepCreateRuntimeDirs() {
       fs.mkdirSync(dir, { recursive: true });
     } catch (err) {
       if (err.code === 'EACCES' || err.code === 'EPERM') {
-        warn(`Sem permissão para criar ${path.relative(PROJECT_ROOT, dir)} — SNPS AI vai tentar criar no primeiro uso.`);
+        warn(`Sem permissão para criar ${path.relative(PROJECT_ROOT, dir)} — SINAPSE AI vai tentar criar no primeiro uso.`);
         softFailures += 1;
         continue;
       }
@@ -439,7 +439,7 @@ function stepDoctor() {
  *   Teste:   sinapse doctor
  *   Começar: @sinapse no Claude Code
  *
- *   Docs:    https://sinapse.club
+ *   Docs:    https://github.com/caioimori/sinapse-ai#readme
  *
  * In --verbose mode the caller has already printed detailed step output, so we
  * still render the minimal summary at the end as a recap.
@@ -477,9 +477,9 @@ function renderFinalSummary(opts = {}) {
   const isGlobal = isGlobalInstall();
   const lines = [];
   if (firstRun) {
-    lines.push(`${c.bold}Bem-vindo ao SNPS AI!${c.reset} 🎉`);
+    lines.push(`${c.bold}Bem-vindo ao SINAPSE AI!${c.reset} 🎉`);
   }
-  lines.push(`${c.bold}SNPS AI ${version}${c.reset} instalado ${c.green}✓${c.reset}`);
+  lines.push(`${c.bold}SINAPSE AI ${version}${c.reset} instalado ${c.green}✓${c.reset}`);
   if (!isGlobal) {
     lines.push(`${c.dim}${agents} ${agentsWord} · ${squads} ${squadsWord} ${prontosWord}${c.reset}`);
   }
@@ -493,7 +493,7 @@ function renderFinalSummary(opts = {}) {
     lines.push(`Começar: ${c.cyan}@sinapse${c.reset} no Claude Code`);
   }
   lines.push('');
-  lines.push(`Docs:    ${c.dim}https://sinapse.club${c.reset}`);
+  lines.push(`Docs:    ${c.dim}https://github.com/caioimori/sinapse-ai#readme${c.reset}`);
 
   for (const line of lines) {
     process.stdout.write(`${line}\n`);
@@ -567,7 +567,7 @@ function main(argvOverride) {
     return 0;
   }
 
-  verboseLog(`${c.dim}SNPS AI postinstall — configurando ambiente...${c.reset}`);
+  verboseLog(`${c.dim}SINAPSE AI postinstall — configurando ambiente...${c.reset}`);
 
   const syncIde = stepSyncIde();
   if (syncIde.critical) {

package/docs/getting-started.md

@@ -42,7 +42,6 @@ No prompt do Claude Code ou Codex:
 |---|---|
 | Entender filosofia do framework | [`README.md`](../README.md) |
 | Ver lista completa de agentes | [Agent Reference Guide](agent-reference-guide.md) |
-| Configurar grounding (vault, DS, brand) | [Grounding Setup](guides/grounding-setup.md) |
 | Resolver problema na instalação | [Troubleshooting](troubleshooting.md) |
 | Ver workflow de desenvolvimento | [`docs/sinapse-workflows/`](sinapse-workflows/) |
 | Contribuir | [`CONTRIBUTING.md`](../CONTRIBUTING.md) |

package/docs/pt/getting-started.md

@@ -337,7 +337,7 @@ steps:
 
 ## Conceitos Básicos da Camada de Memória
 
-A camada de memória da SINAPSE (Chrome Brain v3) fornece gerenciamento inteligente de contexto com grounding do Second Brain e recuperação semântica nativa.
+A camada de memória da SINAPSE (Chrome Brain v3) fornece gerenciamento inteligente de contexto com grounding contra seu vault de notas (opcional) e recuperação semântica nativa.
 
 ### Como a Memória Funciona
 

package/docs/security/dependabot-triage.md

@@ -10,22 +10,21 @@ This document applies to `caioimori/sinapse-ai` and covers advisories surfaced b
 - GitHub Dependabot alerts (https://github.com/caioimori/sinapse-ai/security/dependabot)
 - `npm audit` run locally or in CI
 
-## Current state (2026-04-19)
+## Current state (2026-06-21)
 
 ### GitHub Dependabot
 
-Open alerts: **0**. All 12 alerts from the rc.1 era (2026-04-13) have been closed.
+Open alerts: **0**. The 3 `undici` alerts surfaced on 2026-06-21 (#36, #41, #43) were dismissed as `tolerable_risk` with rationale (see below). The earlier `picomatch` / `brace-expansion` advisories are gone — the bundled `npm` tarball advanced to `11.17.0`, which ships patched versions.
 
 ### Local `npm audit` — full dev tree
 
-Two advisories remain surfaced by `npm audit` even after applying root `overrides` in `package.json`:
+One advisory family remains surfaced by `npm audit` even after applying root `overrides` in `package.json`:
 
-| Severity | Package | Advisory | Path |
+| Severity | Package | Advisories | Path |
 |---|---|---|---|
-| HIGH | picomatch@4.0.3 | GHSA-c2c7-rcm5-vvqj (ReDoS via extglob quantifiers) | `semantic-release > @semantic-release/npm > npm > node-gyp > tinyglobby > picomatch` |
-| MODERATE | brace-expansion@5.0.4 | GHSA-f886-m6hf-6m8v (zero-step DoS) | `semantic-release > @semantic-release/npm > npm > minimatch > brace-expansion` |
+| HIGH (aggregate) | undici@6.26.0 | GHSA-p88m-4jfj-68fv, GHSA-g8m3-5g58-fq7m, GHSA-35p6-xmwp-9g52, GHSA-vxpw-j846-p89q | `semantic-release > @semantic-release/npm > npm > node-gyp > undici` |
 
-Both originate from the `npm@11.12.1` tarball that `@semantic-release/npm@13.1.3` bundles. They are frozen inside npm's bundled dependency tree and cannot be replaced via root `overrides` (overrides do not reach into `bundleDependencies`).
+It originates from the `npm@11.17.0` tarball that `@semantic-release/npm@13.1.5` bundles. `npm` reports it literally as *"undici@6.26.0 is a bundled dependency of npm@11.17.0 ... It cannot be fixed automatically."* It is frozen inside npm's bundled dependency tree and cannot be replaced via root `overrides` (overrides do not reach into `bundleDependencies` — verified: a targeted `undici@<6.27.0` override has no effect).
 
 ## Triage decision
 
@@ -33,12 +32,10 @@ Status: **Accepted — tolerable risk.**
 
 Rationale:
 
-1. **Scope:** These packages are transitive dev-only dependencies. They are reached only through `semantic-release`, which runs in CI release automation and never in user-installed code paths. `npm audit --omit=dev --audit-level=high` on the root returns `0 vulns`.
-2. **Reachability:** `node-gyp` is only invoked when building native Node addons during install. Neither picomatch ReDoS nor brace-expansion DoS is reachable from any code path that executes when a user runs `npx sinapse-ai install` or any runtime agent command.
-3. **Shipped package:** `npm pack --dry-run` confirms `semantic-release` and its `node_modules` do not ship to the published `sinapse-ai` tarball (it is `devDependency` only).
-4. **Upstream fix dependency:** The fix lives upstream — a new `npm` tarball that embeds patched picomatch/brace-expansion, followed by a `@semantic-release/npm` bump. Blocked on external release timing; the SINAPSE project cannot accelerate it.
-
-GitHub Dependabot already confirms this judgement: these advisories are NOT surfaced as open alerts at `https://github.com/caioimori/sinapse-ai/security/dependabot`.
+1. **Scope:** `undici` here is a transitive dev-only dependency. It is reached only through `semantic-release`, which runs in CI release automation and never in user-installed code paths. `npm audit --omit=dev --audit-level=high` on the root returns `0 vulns`.
+2. **Reachability:** `node-gyp` invokes `undici` only when downloading Node headers to build native addons during install. None of the undici advisories (header injection, SameSite downgrade, queue poisoning, WebSocket DoS) is reachable from any code path that executes when a user runs `npx sinapse-ai install` or any runtime agent command.
+3. **Shipped package:** `npm pack --dry-run` confirms `semantic-release` and its `node_modules` do not ship to the published `sinapse-ai` tarball (`devDependency` only).
+4. **Upstream fix dependency:** The fix lives upstream — a new `npm` tarball that embeds `undici >= 6.27.0`, followed by a `@semantic-release/npm` bump. Blocked on external release timing; the SINAPSE project cannot accelerate it.
 
 ## CI gate policy
 
@@ -47,7 +44,7 @@ Two-tier audit enforcement in `.github/workflows/ci.yml`:
 1. **Production-dep gate (hard block, Article X Tier 1 #7):**
    `npm audit --omit=dev --audit-level=high` MUST pass — any HIGH or CRITICAL in production dependencies blocks merge.
 2. **Full-tree gate (critical-only):**
-   `npm audit --audit-level=critical` MUST pass — CRITICAL anywhere (incl. dev) blocks merge. HIGH/MODERATE in dev with triage entry in this document is accepted.
+   `npm audit --audit-level=critical` MUST pass — CRITICAL anywhere (incl. dev) blocks merge. HIGH/MODERATE in dev with a triage entry in this document is accepted.
 
 If a new HIGH/MODERATE in dev deps emerges and is not yet in this document, CI does NOT block it (tier 2 only flags critical). The maintainer must review `npm audit` at each RC and either upgrade or add a row below.
 
@@ -55,12 +52,14 @@ If a new HIGH/MODERATE in dev deps emerges and is not yet in this document, CI d
 
 | Advisory | Package | Severity | Reason | Expires |
 |---|---|---|---|---|
-| GHSA-c2c7-rcm5-vvqj | picomatch | HIGH | Bundled inside `npm@11.12.1` within `semantic-release` dev dep. Not reachable from user runtime. Upstream fix pending. | Next GA re-review |
-| GHSA-f886-m6hf-6m8v | brace-expansion | MODERATE | Bundled inside `npm@11.12.1` within `semantic-release` dev dep. Not reachable from user runtime. Upstream fix pending. | Next GA re-review |
+| GHSA-p88m-4jfj-68fv | undici | MODERATE | Bundled inside `npm@11.17.0` within `semantic-release` dev dep. Not reachable from user runtime. Upstream fix pending. | Next GA re-review |
+| GHSA-g8m3-5g58-fq7m | undici | LOW | Bundled inside `npm@11.17.0` within `semantic-release` dev dep. Not reachable from user runtime. Upstream fix pending. | Next GA re-review |
+| GHSA-35p6-xmwp-9g52 | undici | LOW | Bundled inside `npm@11.17.0` within `semantic-release` dev dep. Not reachable from user runtime. Upstream fix pending. | Next GA re-review |
+| GHSA-vxpw-j846-p89q | undici | LOW | WebSocket DoS, surfaced by `npm audit` only. Same bundled-in-npm origin. Not reachable from user runtime. | Next GA re-review |
 
 ## Proactive hardening in place
 
-Even though overrides do not reach the bundled tree, `package.json` carries root `overrides` for `picomatch: ^4.0.4` and `brace-expansion: ^5.0.5`. When upstream `npm` / `@semantic-release/npm` releases a patched tarball, these overrides will ensure the patched versions deduplicate everywhere they can.
+Even though overrides do not reach the bundled tree, `package.json` carries root `overrides` (`diff`, `serialize-javascript`, `picomatch`, `brace-expansion`, `fast-uri`, `ip-address`, `@babel/core`, `js-yaml`). When upstream `npm` / `@semantic-release/npm` releases a tarball with `undici >= 6.27.0`, the advisory clears with no action needed. A defensive `undici` override was evaluated and intentionally NOT added — it has zero effect on a bundled dependency and would be dead config.
 
 ## Review cadence
 
@@ -73,3 +72,4 @@ Even though overrides do not reach the bundled tree, `package.json` carries root
 | Date | Actor | Change |
 |---|---|---|
 | 2026-04-19 | Story 10.34 execution | Triage created. rc.1-era 12 alerts confirmed closed on GitHub. 2 remaining `npm audit` advisories (picomatch + brace-expansion inside bundled npm) accepted as tolerable risk. Root `overrides` added defensively. CI gate hardened with `--omit=dev --audit-level=high` job. |
+| 2026-06-21 | Session audit | npm bundled tarball advanced to `11.17.0` → picomatch + brace-expansion advisories resolved upstream and removed. New `undici@6.26.0` advisory family surfaced (3 Dependabot alerts + 1 audit-only). Confirmed bundled-in-npm and unfixable via overrides; dismissed the 3 Dependabot alerts as `tolerable_risk` and accepted here. Production audit remains `0 vulns`. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sinapse-ai",
-  "version": "1.12.1",
+  "version": "1.13.0",
   "description": "SINAPSE AI: Framework de orquestracao de IA — 17 squads, 172 agentes especializados",
   "bin": {
     "sinapse": "bin/sinapse.js",
@@ -72,6 +72,9 @@
     "!**/tests/**",
     "!**/*.test.js",
     "!**/*.spec.js",
+    "!**/dist/**",
+    "!**/*.map",
+    "!**/*.zip",
     ".sinapse-ai/development/templates/**"
   ],
   "scripts": {
@@ -81,7 +84,7 @@
     "test": "jest",
     "test:watch": "jest --watch",
     "test:coverage": "jest --coverage",
-    "test:health-check": "mocha tests/health-check/**/*.test.js --timeout 30000",
+    "test:health-check": "jest tests/health-check",
     "eval": "node scripts/eval-runner.js",
     "validate:evals": "node scripts/validate-evals.js",
     "validate:schemas": "node scripts/validate-schemas.js",
@@ -133,6 +136,7 @@
     "sync:squad-yaml": "node scripts/sync-squad-yaml-components.js",
     "validate:squad-yaml": "node scripts/sync-squad-yaml-components.js --check",
     "validate:story-meta": "node scripts/validate-story-meta.js",
+    "validate:changelog": "node scripts/validate-changelog-tags.js",
     "validate:squad-orqx": "node scripts/validate-squad-orqx.js",
     "validate:release-readiness": "node scripts/release-readiness.js",
     "manifest:ensure": "node scripts/ensure-manifest.js",
@@ -211,7 +215,6 @@
     "husky": "^9.1.7",
     "jest": "^30.2.0",
     "lint-staged": "^16.1.1",
-    "mocha": "^11.7.5",
     "prettier": "^3.5.3",
     "semantic-release": "^25.0.2",
     "typescript": "^5.9.3"