sinapse-ai 1.12.2 → 1.13.0

package/docs/security/dependabot-triage.md

@@ -10,22 +10,21 @@ This document applies to `caioimori/sinapse-ai` and covers advisories surfaced b
 - GitHub Dependabot alerts (https://github.com/caioimori/sinapse-ai/security/dependabot)
 - `npm audit` run locally or in CI
 
-## Current state (2026-04-19)
+## Current state (2026-06-21)
 
 ### GitHub Dependabot
 
-Open alerts: **0**. All 12 alerts from the rc.1 era (2026-04-13) have been closed.
+Open alerts: **0**. The 3 `undici` alerts surfaced on 2026-06-21 (#36, #41, #43) were dismissed as `tolerable_risk` with rationale (see below). The earlier `picomatch` / `brace-expansion` advisories are gone — the bundled `npm` tarball advanced to `11.17.0`, which ships patched versions.
 
 ### Local `npm audit` — full dev tree
 
-Two advisories remain surfaced by `npm audit` even after applying root `overrides` in `package.json`:
+One advisory family remains surfaced by `npm audit` even after applying root `overrides` in `package.json`:
 
-| Severity | Package | Advisory | Path |
+| Severity | Package | Advisories | Path |
 |---|---|---|---|
-| HIGH | picomatch@4.0.3 | GHSA-c2c7-rcm5-vvqj (ReDoS via extglob quantifiers) | `semantic-release > @semantic-release/npm > npm > node-gyp > tinyglobby > picomatch` |
-| MODERATE | brace-expansion@5.0.4 | GHSA-f886-m6hf-6m8v (zero-step DoS) | `semantic-release > @semantic-release/npm > npm > minimatch > brace-expansion` |
+| HIGH (aggregate) | undici@6.26.0 | GHSA-p88m-4jfj-68fv, GHSA-g8m3-5g58-fq7m, GHSA-35p6-xmwp-9g52, GHSA-vxpw-j846-p89q | `semantic-release > @semantic-release/npm > npm > node-gyp > undici` |
 
-Both originate from the `npm@11.12.1` tarball that `@semantic-release/npm@13.1.3` bundles. They are frozen inside npm's bundled dependency tree and cannot be replaced via root `overrides` (overrides do not reach into `bundleDependencies`).
+It originates from the `npm@11.17.0` tarball that `@semantic-release/npm@13.1.5` bundles. `npm` reports it literally as *"undici@6.26.0 is a bundled dependency of npm@11.17.0 ... It cannot be fixed automatically."* It is frozen inside npm's bundled dependency tree and cannot be replaced via root `overrides` (overrides do not reach into `bundleDependencies` — verified: a targeted `undici@<6.27.0` override has no effect).
 
 ## Triage decision
 
@@ -33,12 +32,10 @@ Status: **Accepted — tolerable risk.**
 
 Rationale:
 
-1. **Scope:** These packages are transitive dev-only dependencies. They are reached only through `semantic-release`, which runs in CI release automation and never in user-installed code paths. `npm audit --omit=dev --audit-level=high` on the root returns `0 vulns`.
-2. **Reachability:** `node-gyp` is only invoked when building native Node addons during install. Neither picomatch ReDoS nor brace-expansion DoS is reachable from any code path that executes when a user runs `npx sinapse-ai install` or any runtime agent command.
-3. **Shipped package:** `npm pack --dry-run` confirms `semantic-release` and its `node_modules` do not ship to the published `sinapse-ai` tarball (it is `devDependency` only).
-4. **Upstream fix dependency:** The fix lives upstream — a new `npm` tarball that embeds patched picomatch/brace-expansion, followed by a `@semantic-release/npm` bump. Blocked on external release timing; the SINAPSE project cannot accelerate it.
-
-GitHub Dependabot already confirms this judgement: these advisories are NOT surfaced as open alerts at `https://github.com/caioimori/sinapse-ai/security/dependabot`.
+1. **Scope:** `undici` here is a transitive dev-only dependency. It is reached only through `semantic-release`, which runs in CI release automation and never in user-installed code paths. `npm audit --omit=dev --audit-level=high` on the root returns `0 vulns`.
+2. **Reachability:** `node-gyp` invokes `undici` only when downloading Node headers to build native addons during install. None of the undici advisories (header injection, SameSite downgrade, queue poisoning, WebSocket DoS) is reachable from any code path that executes when a user runs `npx sinapse-ai install` or any runtime agent command.
+3. **Shipped package:** `npm pack --dry-run` confirms `semantic-release` and its `node_modules` do not ship to the published `sinapse-ai` tarball (`devDependency` only).
+4. **Upstream fix dependency:** The fix lives upstream — a new `npm` tarball that embeds `undici >= 6.27.0`, followed by a `@semantic-release/npm` bump. Blocked on external release timing; the SINAPSE project cannot accelerate it.
 
 ## CI gate policy
 
@@ -47,7 +44,7 @@ Two-tier audit enforcement in `.github/workflows/ci.yml`:
 1. **Production-dep gate (hard block, Article X Tier 1 #7):**
    `npm audit --omit=dev --audit-level=high` MUST pass — any HIGH or CRITICAL in production dependencies blocks merge.
 2. **Full-tree gate (critical-only):**
-   `npm audit --audit-level=critical` MUST pass — CRITICAL anywhere (incl. dev) blocks merge. HIGH/MODERATE in dev with triage entry in this document is accepted.
+   `npm audit --audit-level=critical` MUST pass — CRITICAL anywhere (incl. dev) blocks merge. HIGH/MODERATE in dev with a triage entry in this document is accepted.
 
 If a new HIGH/MODERATE in dev deps emerges and is not yet in this document, CI does NOT block it (tier 2 only flags critical). The maintainer must review `npm audit` at each RC and either upgrade or add a row below.
 
@@ -55,12 +52,14 @@ If a new HIGH/MODERATE in dev deps emerges and is not yet in this document, CI d
 
 | Advisory | Package | Severity | Reason | Expires |
 |---|---|---|---|---|
-| GHSA-c2c7-rcm5-vvqj | picomatch | HIGH | Bundled inside `npm@11.12.1` within `semantic-release` dev dep. Not reachable from user runtime. Upstream fix pending. | Next GA re-review |
-| GHSA-f886-m6hf-6m8v | brace-expansion | MODERATE | Bundled inside `npm@11.12.1` within `semantic-release` dev dep. Not reachable from user runtime. Upstream fix pending. | Next GA re-review |
+| GHSA-p88m-4jfj-68fv | undici | MODERATE | Bundled inside `npm@11.17.0` within `semantic-release` dev dep. Not reachable from user runtime. Upstream fix pending. | Next GA re-review |
+| GHSA-g8m3-5g58-fq7m | undici | LOW | Bundled inside `npm@11.17.0` within `semantic-release` dev dep. Not reachable from user runtime. Upstream fix pending. | Next GA re-review |
+| GHSA-35p6-xmwp-9g52 | undici | LOW | Bundled inside `npm@11.17.0` within `semantic-release` dev dep. Not reachable from user runtime. Upstream fix pending. | Next GA re-review |
+| GHSA-vxpw-j846-p89q | undici | LOW | WebSocket DoS, surfaced by `npm audit` only. Same bundled-in-npm origin. Not reachable from user runtime. | Next GA re-review |
 
 ## Proactive hardening in place
 
-Even though overrides do not reach the bundled tree, `package.json` carries root `overrides` for `picomatch: ^4.0.4` and `brace-expansion: ^5.0.5`. When upstream `npm` / `@semantic-release/npm` releases a patched tarball, these overrides will ensure the patched versions deduplicate everywhere they can.
+Even though overrides do not reach the bundled tree, `package.json` carries root `overrides` (`diff`, `serialize-javascript`, `picomatch`, `brace-expansion`, `fast-uri`, `ip-address`, `@babel/core`, `js-yaml`). When upstream `npm` / `@semantic-release/npm` releases a tarball with `undici >= 6.27.0`, the advisory clears with no action needed. A defensive `undici` override was evaluated and intentionally NOT added — it has zero effect on a bundled dependency and would be dead config.
 
 ## Review cadence
 
@@ -73,3 +72,4 @@ Even though overrides do not reach the bundled tree, `package.json` carries root
 | Date | Actor | Change |
 |---|---|---|
 | 2026-04-19 | Story 10.34 execution | Triage created. rc.1-era 12 alerts confirmed closed on GitHub. 2 remaining `npm audit` advisories (picomatch + brace-expansion inside bundled npm) accepted as tolerable risk. Root `overrides` added defensively. CI gate hardened with `--omit=dev --audit-level=high` job. |
+| 2026-06-21 | Session audit | npm bundled tarball advanced to `11.17.0` → picomatch + brace-expansion advisories resolved upstream and removed. New `undici@6.26.0` advisory family surfaced (3 Dependabot alerts + 1 audit-only). Confirmed bundled-in-npm and unfixable via overrides; dismissed the 3 Dependabot alerts as `tolerable_risk` and accepted here. Production audit remains `0 vulns`. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sinapse-ai",
-  "version": "1.12.2",
+  "version": "1.13.0",
   "description": "SINAPSE AI: Framework de orquestracao de IA — 17 squads, 172 agentes especializados",
   "bin": {
     "sinapse": "bin/sinapse.js",
@@ -72,6 +72,9 @@
     "!**/tests/**",
     "!**/*.test.js",
     "!**/*.spec.js",
+    "!**/dist/**",
+    "!**/*.map",
+    "!**/*.zip",
     ".sinapse-ai/development/templates/**"
   ],
   "scripts": {
@@ -81,7 +84,7 @@
     "test": "jest",
     "test:watch": "jest --watch",
     "test:coverage": "jest --coverage",
-    "test:health-check": "mocha tests/health-check/**/*.test.js --timeout 30000",
+    "test:health-check": "jest tests/health-check",
     "eval": "node scripts/eval-runner.js",
     "validate:evals": "node scripts/validate-evals.js",
     "validate:schemas": "node scripts/validate-schemas.js",
@@ -133,6 +136,7 @@
     "sync:squad-yaml": "node scripts/sync-squad-yaml-components.js",
     "validate:squad-yaml": "node scripts/sync-squad-yaml-components.js --check",
     "validate:story-meta": "node scripts/validate-story-meta.js",
+    "validate:changelog": "node scripts/validate-changelog-tags.js",
     "validate:squad-orqx": "node scripts/validate-squad-orqx.js",
     "validate:release-readiness": "node scripts/release-readiness.js",
     "manifest:ensure": "node scripts/ensure-manifest.js",
@@ -211,7 +215,6 @@
     "husky": "^9.1.7",
     "jest": "^30.2.0",
     "lint-staged": "^16.1.1",
-    "mocha": "^11.7.5",
     "prettier": "^3.5.3",
     "semantic-release": "^25.0.2",
     "typescript": "^5.9.3"

package/packages/installer/src/wizard/i18n.js

@@ -88,107 +88,6 @@ const TRANSLATIONS = {
     cancelled: 'Installation cancelled.',
     tryAgain: 'Run `npx sinapse-ai init` to try again.',
     continuing: 'Continuing installation...',
-
-    // Pro Installation Wizard (pro-setup.js)
-    proWizardTitle: 'SINAPSE Pro Installation Wizard',
-    proWizardSubtitle: 'Premium Content & Features',
-    proLicenseActivation: 'License Activation',
-    proContentInstallation: 'Pro Content Installation',
-    proVerification: 'Verification',
-    proHowActivate: 'How would you like to activate Pro?',
-    proLoginOrCreate: 'Login or create account (Recommended)',
-    proEnterKey: 'Enter license key (legacy)',
-    proEmailLabel: 'Email:',
-    proEmailRequired: 'Email is required',
-    proEmailInvalid: 'Please enter a valid email address',
-    proVerifyingAccess: 'Verifying your access...',
-    proNoAccess: 'No SINAPSE Pro access found for this email.',
-    proContactSupport: 'If you believe this is an error, please contact support:',
-    proPurchase: 'Purchase Pro: https://pro.sinapse.ai',
-    proEmailNotBuyer: 'Email not found in Pro buyers list.',
-    proAccessConfirmedAccount: 'Pro access confirmed! Account found.',
-    proAccessConfirmedCreate: "Pro access confirmed! Let's create your account.",
-    proPasswordLabel: 'Password:',
-    proPasswordMin: 'Password must be at least {min} characters',
-    proAuthenticating: 'Authenticating...',
-    proAuthSuccess: 'Authenticated successfully.',
-    proEmailNotVerified: 'Email not verified yet. Please check your inbox and click the verification link.',
-    proCheckingEvery: '(Checking every 5 seconds... timeout in 10 minutes)',
-    proEmailVerified: 'Email verified!',
-    proVerificationTimeout: 'Email verification timed out after 10 minutes.',
-    proRunAgain: 'Run the installer again to retry.',
-    proIncorrectPassword: 'Incorrect password. {remaining} attempt(s) remaining.',
-    proMaxAttempts: 'Maximum login attempts reached.',
-    proForgotPassword: 'Forgot your password? Visit https://sinapse-license-server.vercel.app/reset-password',
-    proContactSupportEmail: 'Or open an issue: https://github.com/caioimori/sinapse-ai/issues',
-    proAuthFailed: 'Authentication failed: {message}',
-    proCreateAccount: 'Create your SINAPSE Pro account to get started.',
-    proChoosePassword: 'Choose a password:',
-    proConfirmPassword: 'Confirm password:',
-    proPasswordsNoMatch: 'Passwords do not match',
-    proCreatingAccount: 'Creating account...',
-    proAccountCreated: 'Account created! Verification email sent.',
-    proAccountExists: 'Account already exists. Switching to login...',
-    proAccountFailed: 'Account creation failed: {message}',
-    proCheckEmail: 'Please check your email and click the verification link.',
-    proWaitingVerification: 'Waiting for email verification...',
-    proAfterVerifying: 'After verifying, the installation will continue automatically.',
-    proPressResend: '[Press R to resend verification email]',
-    proVerificationResent: 'Verification email resent.',
-    proCouldNotResend: 'Could not resend: {message}',
-    proRunAgainRetry: 'Run the installer again to retry verification.',
-    proValidatingSubscription: 'Validating Pro subscription...',
-    proSubscriptionConfirmed: 'Pro subscription confirmed! License: {key}',
-    proNoSubscription: 'No active Pro subscription found for this email.',
-    proPurchaseAt: 'Purchase Pro at https://pro.sinapse.ai',
-    proSeatLimit: 'Deactivate another device or upgrade your license.',
-    proAlreadyActivated: 'Pro license already activated for this account.',
-    proActivationFailed: 'Activation failed: {message}',
-    proEnterKeyPrompt: 'Enter your Pro license key:',
-    proKeyRequired: 'License key is required',
-    proKeyInvalid: 'Invalid format. Expected: PRO-XXXX-XXXX-XXXX-XXXX',
-    proKeyValidated: 'License validated: {key}',
-    proModuleNotAvailable: 'Pro license module not available. Ensure @sinapse-fullstack/pro is installed.',
-    proModuleBootstrap: 'Pro license module not found locally. Installing @sinapse-fullstack/pro to bootstrap...',
-    proServerUnreachable: 'License server is unreachable. Check your internet connection and try again.',
-    proVerifyingAccessShort: 'Verifying access...',
-    proAccessConfirmed: 'Pro access confirmed.',
-    proBuyerCheckUnavailable: 'Buyer check unavailable, proceeding with login...',
-    proLoginFailedSignup: 'Login failed, attempting signup...',
-    proAccountCreatedVerify: 'Account created. Verification email sent!',
-    proAccountExistsWrongPw: 'Account exists but the password is incorrect.',
-    proAuthFailedShort: 'Authentication failed.',
-    proValidatingKey: 'Validating license {key}...',
-    proInvalidKey: 'Invalid license key.',
-    proExpiredKey: 'License key has expired.',
-    proMaxActivations: 'Maximum activations reached for this key.',
-    proRateLimited: 'Too many requests. Please wait and try again.',
-    proValidationFailed: 'License validation failed: {message}',
-    proInvalidKeyFormat: 'Invalid key format: {key}. Expected: PRO-XXXX-XXXX-XXXX-XXXX',
-    proScaffolding: 'Scaffolding pro content...',
-    proScaffoldingProgress: 'Scaffolding: {message}',
-    proContentInstalled: 'Pro content installed ({count} files)',
-    proScaffoldFailed: 'Scaffolding failed',
-    proScaffoldError: 'Scaffolding error: {message}',
-    proInitPackageJson: 'Initializing package.json...',
-    proPackageJsonCreated: 'package.json created',
-    proPackageJsonFailed: 'Failed to create package.json',
-    proInstallingPackage: 'Installing @sinapse-fullstack/pro...',
-    proPackageInstalled: 'Pro package installed',
-    proPackageInstallFailed: 'Failed to install Pro package',
-    proScaffolderNotAvailable: 'Pro scaffolder not available. Ensure @sinapse-fullstack/pro is installed.',
-    proFilesInstalled: 'Files installed: {count}',
-    proSquads: 'Squads: {names}',
-    proConfigs: 'Configs: {count} files',
-    proFeaturesUnlocked: 'Features unlocked: {count}',
-    proInstallComplete: 'SINAPSE Pro installation complete!',
-    proNeedHelp: 'Need help? Run: npx sinapse-pro recover',
-    proCISetEnv: 'CI mode: Set SINAPSE_PRO_EMAIL + SINAPSE_PRO_PASSWORD or SINAPSE_PRO_KEY environment variables.',
-    proVerificationFailed: 'Verification failed: {message}',
-    proPackageNotFound: 'Pro package not found after npm install. Check npm output.',
-    proScaffolderNotFound: 'Pro scaffolder module not found.',
-    proNpmInitFailed: 'npm init failed: {message}',
-    proNpmInstallFailed: 'npm install @sinapse-fullstack/pro failed: {message}. Try manually: npm install @sinapse-fullstack/pro',
   },
 
   pt: {
@@ -272,114 +171,14 @@ const TRANSLATIONS = {
     cancelled: 'Instalação cancelada.',
     tryAgain: 'Execute `npx sinapse-ai init` para tentar novamente.',
     continuing: 'Continuando instalação...',
-
-    // Pro Installation Wizard (pro-setup.js)
-    proWizardTitle: 'Assistente de Instalação SINAPSE Pro',
-    proWizardSubtitle: 'Conteúdo e Recursos Premium',
-    proLicenseActivation: 'Ativação de Licença',
-    proContentInstallation: 'Instalação do Conteúdo Pro',
-    proVerification: 'Verificação',
-    proHowActivate: 'Como você gostaria de ativar o Pro?',
-    proLoginOrCreate: 'Login ou criar conta (Recomendado)',
-    proEnterKey: 'Inserir chave de licença (legado)',
-    proEmailLabel: 'Email:',
-    proEmailRequired: 'Email é obrigatório',
-    proEmailInvalid: 'Por favor, insira um endereço de email válido',
-    proVerifyingAccess: 'Verificando seu acesso...',
-    proNoAccess: 'Nenhum acesso SINAPSE Pro encontrado para este email.',
-    proContactSupport: 'Se você acredita que isso é um erro, entre em contato com o suporte:',
-    proPurchase: 'Comprar Pro: https://pro.sinapse.ai',
-    proEmailNotBuyer: 'Email não encontrado na lista de compradores Pro.',
-    proAccessConfirmedAccount: 'Acesso Pro confirmado! Conta encontrada.',
-    proAccessConfirmedCreate: 'Acesso Pro confirmado! Vamos criar sua conta.',
-    proPasswordLabel: 'Senha:',
-    proPasswordMin: 'A senha deve ter pelo menos {min} caracteres',
-    proAuthenticating: 'Autenticando...',
-    proAuthSuccess: 'Autenticado com sucesso.',
-    proEmailNotVerified: 'Email ainda não verificado. Verifique sua caixa de entrada e clique no link de verificação.',
-    proCheckingEvery: '(Verificando a cada 5 segundos... tempo limite de 10 minutos)',
-    proEmailVerified: 'Email verificado!',
-    proVerificationTimeout: 'Verificação de email expirou após 10 minutos.',
-    proRunAgain: 'Execute o instalador novamente para tentar.',
-    proIncorrectPassword: 'Senha incorreta. {remaining} tentativa(s) restante(s).',
-    proMaxAttempts: 'Número máximo de tentativas de login atingido.',
-    proForgotPassword: 'Esqueceu sua senha? Acesse https://sinapse-license-server.vercel.app/reset-password',
-    proContactSupportEmail: 'Ou abra uma issue: https://github.com/caioimori/sinapse-ai/issues',
-    proAuthFailed: 'Falha na autenticação: {message}',
-    proCreateAccount: 'Crie sua conta SINAPSE Pro para começar.',
-    proChoosePassword: 'Escolha uma senha:',
-    proConfirmPassword: 'Confirme a senha:',
-    proPasswordsNoMatch: 'As senhas não correspondem',
-    proCreatingAccount: 'Criando conta...',
-    proAccountCreated: 'Conta criada! Email de verificação enviado.',
-    proAccountExists: 'Conta já existe. Mudando para login...',
-    proAccountFailed: 'Falha ao criar conta: {message}',
-    proCheckEmail: 'Por favor, verifique seu email e clique no link de verificação.',
-    proWaitingVerification: 'Aguardando verificação de email...',
-    proAfterVerifying: 'Após verificar, a instalação continuará automaticamente.',
-    proPressResend: '[Pressione R para reenviar email de verificação]',
-    proVerificationResent: 'Email de verificação reenviado.',
-    proCouldNotResend: 'Não foi possível reenviar: {message}',
-    proRunAgainRetry: 'Execute o instalador novamente para tentar a verificação.',
-    proValidatingSubscription: 'Validando assinatura Pro...',
-    proSubscriptionConfirmed: 'Assinatura Pro confirmada! Licença: {key}',
-    proNoSubscription: 'Nenhuma assinatura Pro ativa encontrada para este email.',
-    proPurchaseAt: 'Compre o Pro em https://pro.sinapse.ai',
-    proSeatLimit: 'Desative outro dispositivo ou faça upgrade da sua licença.',
-    proAlreadyActivated: 'Licença Pro já ativada para esta conta.',
-    proActivationFailed: 'Falha na ativação: {message}',
-    proEnterKeyPrompt: 'Insira sua chave de licença Pro:',
-    proKeyRequired: 'Chave de licença é obrigatória',
-    proKeyInvalid: 'Formato inválido. Esperado: PRO-XXXX-XXXX-XXXX-XXXX',
-    proKeyValidated: 'Licença validada: {key}',
-    proModuleNotAvailable: 'Módulo de licença Pro não disponível. Certifique-se de que @sinapse-fullstack/pro está instalado.',
-    proModuleBootstrap: 'Módulo de licença Pro não encontrado localmente. Instalando @sinapse-fullstack/pro...',
-    proServerUnreachable: 'Servidor de licenças inacessível. Verifique sua conexão com a internet e tente novamente.',
-    proVerifyingAccessShort: 'Verificando acesso...',
-    proAccessConfirmed: 'Acesso Pro confirmado.',
-    proBuyerCheckUnavailable: 'Verificação de comprador indisponível, prosseguindo com login...',
-    proLoginFailedSignup: 'Login falhou, tentando cadastro...',
-    proAccountCreatedVerify: 'Conta criada. Email de verificação enviado!',
-    proAccountExistsWrongPw: 'Conta existe mas a senha está incorreta.',
-    proAuthFailedShort: 'Falha na autenticação.',
-    proValidatingKey: 'Validando licença {key}...',
-    proInvalidKey: 'Chave de licença inválida.',
-    proExpiredKey: 'Chave de licença expirada.',
-    proMaxActivations: 'Número máximo de ativações atingido para esta chave.',
-    proRateLimited: 'Muitas requisições. Aguarde e tente novamente.',
-    proValidationFailed: 'Validação de licença falhou: {message}',
-    proInvalidKeyFormat: 'Formato de chave inválido: {key}. Esperado: PRO-XXXX-XXXX-XXXX-XXXX',
-    proScaffolding: 'Instalando conteúdo pro...',
-    proScaffoldingProgress: 'Instalando: {message}',
-    proContentInstalled: 'Conteúdo Pro instalado ({count} arquivos)',
-    proScaffoldFailed: 'Instalação falhou',
-    proScaffoldError: 'Erro na instalação: {message}',
-    proInitPackageJson: 'Inicializando package.json...',
-    proPackageJsonCreated: 'package.json criado',
-    proPackageJsonFailed: 'Falha ao criar package.json',
-    proInstallingPackage: 'Instalando @sinapse-fullstack/pro...',
-    proPackageInstalled: 'Pacote Pro instalado',
-    proPackageInstallFailed: 'Falha ao instalar pacote Pro',
-    proScaffolderNotAvailable: 'Scaffolder Pro não disponível. Certifique-se de que @sinapse-fullstack/pro está instalado.',
-    proFilesInstalled: 'Arquivos instalados: {count}',
-    proSquads: 'Squads: {names}',
-    proConfigs: 'Configs: {count} arquivos',
-    proFeaturesUnlocked: 'Recursos desbloqueados: {count}',
-    proInstallComplete: 'Instalação do SINAPSE Pro completa!',
-    proNeedHelp: 'Precisa de ajuda? Execute: npx sinapse-pro recover',
-    proCISetEnv: 'Modo CI: Defina as variáveis SINAPSE_PRO_EMAIL + SINAPSE_PRO_PASSWORD ou SINAPSE_PRO_KEY.',
-    proVerificationFailed: 'Verificação falhou: {message}',
-    proPackageNotFound: 'Pacote Pro não encontrado após npm install. Verifique a saída do npm.',
-    proScaffolderNotFound: 'Módulo scaffolder Pro não encontrado.',
-    proNpmInitFailed: 'npm init falhou: {message}',
-    proNpmInstallFailed: 'npm install @sinapse-fullstack/pro falhou: {message}. Tente manualmente: npm install @sinapse-fullstack/pro',
   },
 
   // es: removed — PT-BR hardcoded as default
 };
 
-// Current language (default: English — worldwide product)
-let currentLanguage = 'en';
+// Current language (default: Portuguese — product owner decision). English
+// remains the missing-key fallback inside t() and a selectable choice.
+let currentLanguage = 'pt';
 
 /**
  * Set current language

package/packages/installer/src/wizard/index.js

@@ -457,7 +457,7 @@ async function runWizard(options = {}) {
 
     if (options.quiet) {
       // Quiet mode: Skip all prompts, use defaults
-      const language = options.language || 'en';
+      const language = options.language || 'pt';
       setLanguage(language);
       answers = {
         language,