sinapse-ai 1.24.0 → 1.25.1

package/packages/installer/src/installer/sinapse-ai-installer.js

@@ -9,10 +9,29 @@
  */
 
 const fs = require('fs-extra');
+const nativeFs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 const ora = require('ora');
 const { hashFile } = require('./file-hasher');
 
+const NOFOLLOW_READ_FLAGS = nativeFs.constants.O_RDONLY | (nativeFs.constants.O_NOFOLLOW || 0);
+
+async function readRegularFileNoFollow(filePath) {
+  let handle;
+  try {
+    handle = await nativeFs.promises.open(filePath, NOFOLLOW_READ_FLAGS);
+    const stat = await handle.stat();
+    if (!stat.isFile()) return null;
+    return await handle.readFile();
+  } catch (error) {
+    if (['ENOENT', 'ELOOP', 'EISDIR'].includes(error.code)) return null;
+    throw error;
+  } finally {
+    if (handle) await handle.close();
+  }
+}
+
 /**
  * Get the path to the source .sinapse-ai directory in the package
  * @returns {string} Absolute path to .sinapse-ai source
@@ -58,6 +77,86 @@ const ROOT_FILES_TO_COPY = [
   'working-in-the-brownfield.md',
 ];
 
+/** Project-local Codex payloads copied only when Codex support is selected. */
+const CODEX_TOP_LEVEL_DIRS = ['.agents', '.codex'];
+const CLAUDE_SUPPORT_DIRS = ['.claude/hooks', '.claude/rules'];
+
+function getClaudeHookName(command) {
+  const match = String(command || '').replace(/\\/g, '/').match(/\.claude\/hooks\/([^"'\s]+)/);
+  return match ? match[1] : null;
+}
+
+function getClaudeHookRegistrationKey(event, matcher, hookName) {
+  return JSON.stringify([event, matcher ?? null, hookName]);
+}
+
+/** Merge shipped SINAPSE hook registrations without replacing user settings. */
+async function reconcileClaudeHookSettings(packageRoot, targetDir) {
+  const sourcePath = path.join(packageRoot, '.claude', 'settings.json');
+  if (!await fs.pathExists(sourcePath)) return null;
+
+  const targetPath = path.join(targetDir, '.claude', 'settings.local.json');
+  const source = await fs.readJson(sourcePath);
+  let target = {};
+  if (await fs.pathExists(targetPath)) {
+    try {
+      target = await fs.readJson(targetPath);
+    } catch (_error) {
+      // Preserve malformed user settings verbatim. The installer must not turn
+      // a recoverable configuration problem into data loss or a failed install.
+      return null;
+    }
+  }
+  if (!target || typeof target !== 'object' || Array.isArray(target)) return null;
+  if (!target.hooks || typeof target.hooks !== 'object' || Array.isArray(target.hooks)) {
+    target.hooks = {};
+  }
+
+  const existingSettings = [target];
+  const projectSettingsPath = path.join(targetDir, '.claude', 'settings.json');
+  if (await fs.pathExists(projectSettingsPath)) {
+    try {
+      const projectSettings = await fs.readJson(projectSettingsPath);
+      if (projectSettings && typeof projectSettings === 'object' && !Array.isArray(projectSettings)) {
+        existingSettings.push(projectSettings);
+      }
+    } catch (_error) {
+      // An invalid sibling settings file cannot provide reliable registrations;
+      // ignore it while retaining its contents and merge into settings.local.
+    }
+  }
+  const registered = new Set();
+  for (const settings of existingSettings) {
+    for (const [event, groups] of Object.entries(settings.hooks || {})) {
+      for (const group of Array.isArray(groups) ? groups : []) {
+        for (const hook of Array.isArray(group.hooks) ? group.hooks : []) {
+          const hookName = getClaudeHookName(hook.command);
+          if (hookName) registered.add(getClaudeHookRegistrationKey(event, group.matcher, hookName));
+        }
+      }
+    }
+  }
+
+  for (const [event, groups] of Object.entries(source.hooks || {})) {
+    if (!Array.isArray(target.hooks[event])) target.hooks[event] = [];
+    for (const group of groups || []) {
+      for (const hook of group.hooks || []) {
+        const hookName = getClaudeHookName(hook.command);
+        const registrationKey = getClaudeHookRegistrationKey(event, group.matcher, hookName);
+        if (!hookName || registered.has(registrationKey)) continue;
+        const registration = { hooks: [hook] };
+        if (group.matcher) registration.matcher = group.matcher;
+        target.hooks[event].push(registration);
+        registered.add(registrationKey);
+      }
+    }
+  }
+
+  await fs.ensureDir(path.dirname(targetPath));
+  await fs.writeJson(targetPath, target, { spaces: 2 });
+  return path.join('.claude', 'settings.local.json');
+}
+
 /**
  * Replace {root} placeholder in file content
  * @param {string} content - File content
@@ -116,15 +215,31 @@ async function generateVersionJson(options) {
     version,
     installedFiles,
     mode = 'project-development',
+    providers = [],
+    targetDir = path.dirname(targetSinapseCore),
+    providerFiles = [],
+    providerSourceRoot = targetDir,
   } = options;
 
   const fileHashes = await generateFileHashes(targetSinapseCore, installedFiles);
+  const providerFileHashes = {};
+  for (const relativePath of providerFiles) {
+    const sourcePath = path.join(providerSourceRoot, relativePath);
+    const sourceContent = await readRegularFileNoFollow(sourcePath);
+    if (sourceContent !== null) {
+      const installedContent = replaceRootPlaceholder(sourceContent.toString('utf8'));
+      const digest = crypto.createHash('sha256').update(installedContent).digest('hex');
+      providerFileHashes[relativePath.replace(/\\/g, '/')] = `sha256:${digest}`;
+    }
+  }
 
   const versionJson = {
     version,
     installedAt: new Date().toISOString(),
     mode,
+    providers: [...new Set(providers)].sort(),
     fileHashes,
+    providerFileHashes,
     customized: [],
   };
 
@@ -156,6 +271,160 @@ function isUserOwnedL3(destPath) {
   return false;
 }
 
+function getManagedCodexSkillPaths(packageRoot) {
+  const catalog = fs.readJsonSync(path.join(packageRoot, '.codex', 'catalog.json'));
+  return [...new Set([
+    ...(catalog.expectedSkillIds || []),
+    ...(catalog.publicAliasSkillIds || []),
+    catalog.genericAgentSkillId,
+  ].filter(Boolean))]
+    .sort()
+    .map((skillId) => path.posix.join('.agents', 'skills', skillId, 'SKILL.md'));
+}
+
+function createCodexPreservePredicate(targetDir, packageRoot, previousProviderHashes = {}) {
+  const legacyRegistry = fs.readJsonSync(path.join(
+    packageRoot,
+    'packages',
+    'installer',
+    'src',
+    'migrations',
+    'legacy-codex-native-skill-hashes.json',
+  ));
+  return (destPath) => {
+    const normalized = String(destPath).replace(/\\/g, '/');
+    if (normalized.endsWith('/.codex/config.toml') || normalized.endsWith('/.codex/hooks.json')) return true;
+    if (!/\/(?:\.codex|\.agents)\/skills\/[^/]+\/SKILL\.md$/.test(normalized)) return false;
+    if (!fs.existsSync(destPath)) return false;
+    const relativePath = path.relative(targetDir, destPath).replace(/\\/g, '/');
+    const digest = hashFile(destPath);
+    const previous = String(previousProviderHashes[relativePath] || '').replace(/^sha256:/, '');
+    const legacyHashes = legacyRegistry.files[relativePath] || [];
+    return digest !== previous && !legacyHashes.includes(digest);
+  };
+}
+
+async function reconcileLegacyCodexSkills(targetDir, packageRoot) {
+  const catalogPath = path.join(packageRoot, '.codex', 'catalog.json');
+  if (!await fs.pathExists(catalogPath)) return { removed: 0, migrated: 0, quarantined: 0, ambiguous: [] };
+
+  const catalog = await fs.readJson(catalogPath);
+  const managedIds = [...new Set([
+    ...(catalog.expectedSkillIds || []),
+    ...(catalog.publicAliasSkillIds || []),
+    catalog.genericAgentSkillId,
+  ].filter((id) => /^[a-z0-9][a-z0-9-]*$/.test(String(id))))].sort();
+  const result = { removed: 0, migrated: 0, quarantined: 0, ambiguous: [] };
+
+  for (const skillId of managedIds) {
+    const legacyPath = path.join(targetDir, '.codex', 'skills', skillId, 'SKILL.md');
+    if (!await fs.pathExists(legacyPath)) continue;
+    const legacyContent = await readRegularFileNoFollow(legacyPath);
+    if (legacyContent === null) {
+      result.ambiguous.push(path.relative(targetDir, legacyPath));
+      continue;
+    }
+
+    const nativePath = path.join(targetDir, '.agents', 'skills', skillId, 'SKILL.md');
+    if (!await fs.pathExists(nativePath)) {
+      await fs.ensureDir(path.dirname(nativePath));
+      try {
+        await fs.writeFile(nativePath, legacyContent, { flag: 'wx' });
+      } catch (error) {
+        if (error.code === 'EEXIST') {
+          result.ambiguous.push(path.relative(targetDir, legacyPath));
+          continue;
+        }
+        throw error;
+      }
+      await fs.remove(legacyPath);
+      if ((await fs.readdir(path.dirname(legacyPath))).length === 0) {
+        await fs.remove(path.dirname(legacyPath));
+      }
+      result.migrated += 1;
+      continue;
+    }
+
+    const nativeContent = await readRegularFileNoFollow(nativePath);
+    if (nativeContent === null) {
+      result.ambiguous.push(path.relative(targetDir, legacyPath));
+      continue;
+    }
+    if (legacyContent.equals(nativeContent)) {
+      await fs.remove(legacyPath);
+      if ((await fs.readdir(path.dirname(legacyPath))).length === 0) {
+        await fs.remove(path.dirname(legacyPath));
+      }
+      result.removed += 1;
+      continue;
+    }
+
+    const digest = crypto.createHash('sha256').update(legacyContent).digest('hex').slice(0, 12);
+    const quarantinePath = path.join(
+      targetDir,
+      '.sinapse-ai',
+      'migrations',
+      'codex-skills',
+      `${skillId}.${digest}.legacy.md`,
+    );
+    await fs.ensureDir(path.dirname(quarantinePath));
+    try {
+      await fs.writeFile(quarantinePath, legacyContent, { flag: 'wx' });
+    } catch (error) {
+      if (error.code !== 'EEXIST') throw error;
+      const quarantinedContent = await readRegularFileNoFollow(quarantinePath);
+      if (quarantinedContent === null || !quarantinedContent.equals(legacyContent)) {
+        result.ambiguous.push(path.relative(targetDir, legacyPath));
+        continue;
+      }
+    }
+    await fs.remove(legacyPath);
+    if ((await fs.readdir(path.dirname(legacyPath))).length === 0) {
+      await fs.remove(path.dirname(legacyPath));
+    }
+    result.quarantined += 1;
+  }
+
+  return result;
+}
+
+async function reconcileLegacyClaudeAgentCommands(targetDir, packageRoot = path.join(__dirname, '..', '..', '..', '..')) {
+  const legacyDir = path.join(targetDir, '.claude', 'commands', 'SINAPSE', 'agents');
+  const result = { removed: 0, preserved: 0, ambiguous: [] };
+  if (!await fs.pathExists(legacyDir)) return result;
+
+  const registryPath = path.join(
+    packageRoot,
+    'packages',
+    'installer',
+    'src',
+    'migrations',
+    'legacy-claude-agent-command-hashes.json',
+  );
+  const registry = await fs.readJson(registryPath);
+  for (const entry of await fs.readdir(legacyDir, { withFileTypes: true })) {
+    const filePath = path.join(legacyDir, entry.name);
+    if (!entry.isFile()) {
+      result.preserved += 1;
+      result.ambiguous.push(path.relative(targetDir, filePath));
+      continue;
+    }
+    const content = await fs.readFile(filePath);
+    const digest = crypto.createHash('sha256').update(content).digest('hex');
+    const knownHashes = registry.files[entry.name] || [];
+    const isMarked = content.includes(Buffer.from('SINAPSE-MANAGED:claude-command'));
+    if (knownHashes.includes(digest) || isMarked) {
+      await fs.remove(filePath);
+      result.removed += 1;
+    } else {
+      result.preserved += 1;
+      result.ambiguous.push(path.relative(targetDir, filePath));
+    }
+  }
+  if ((await fs.readdir(legacyDir)).length === 0) await fs.remove(legacyDir);
+  return result;
+}
+
 async function copyFileWithRootReplacement(sourcePath, destPath, replaceRoot = true, preserveExisting = null) {
   try {
     // Preserve user-owned L3 files (core-config.yaml, agent MEMORY.md) when they
@@ -232,6 +501,43 @@ async function copyDirectoryWithRootReplacement(sourceDir, destDir, onProgress =
   return copiedFiles;
 }
 
+async function deliverClaudeNativeAdapters(pkgRoot, targetDir, options = {}) {
+  const overwriteManaged = options.overwriteManaged === true;
+  const delivered = { agents: [], skills: [], manifest: null };
+  const sourceAgents = path.join(pkgRoot, '.claude', 'agents');
+  if (await fs.pathExists(sourceAgents)) {
+    for (const file of (await fs.readdir(sourceAgents)).filter((name) => /^sinapse-.+\.md$/.test(name))) {
+      const destination = path.join(targetDir, '.claude', 'agents', file);
+      if (!overwriteManaged && await fs.pathExists(destination)) continue;
+      if (await copyFileWithRootReplacement(path.join(sourceAgents, file), destination, true)) {
+        delivered.agents.push(path.join('.claude', 'agents', file));
+      }
+    }
+  }
+
+  const sourceSkills = path.join(pkgRoot, '.claude', 'skills');
+  if (await fs.pathExists(sourceSkills)) {
+    const entries = await fs.readdir(sourceSkills, { withFileTypes: true });
+    for (const entry of entries.filter((item) => item.isDirectory())) {
+      const source = path.join(sourceSkills, entry.name, 'SKILL.md');
+      if (!await fs.pathExists(source)) continue;
+      const relativePath = path.join('.claude', 'skills', entry.name, 'SKILL.md');
+      const destination = path.join(targetDir, relativePath);
+      if (!overwriteManaged && await fs.pathExists(destination)) continue;
+      if (await copyFileWithRootReplacement(source, destination, true)) delivered.skills.push(relativePath);
+    }
+  }
+  const manifestSource = path.join(pkgRoot, '.claude', 'skill-manifest.json');
+  if (await fs.pathExists(manifestSource)) {
+    const relativePath = path.join('.claude', 'skill-manifest.json');
+    const destination = path.join(targetDir, relativePath);
+    if ((overwriteManaged || !await fs.pathExists(destination)) && await copyFileWithRootReplacement(manifestSource, destination, true)) {
+      delivered.manifest = relativePath;
+    }
+  }
+  return delivered;
+}
+
 /**
  * Codex CLI context files that live at the package ROOT (not under .codex/ or
  * .sinapse-ai/), so the directory-copy loops never reach them. AGENTS.md is the
@@ -278,6 +584,8 @@ async function installSinapseCore(options = {}) {
     targetDir = process.cwd(),
     onProgress = null,
     includeCodex = false,
+    includeClaude = false,
+    overwriteManagedAdapters = false,
   } = options;
 
   const result = {
@@ -292,6 +600,15 @@ async function installSinapseCore(options = {}) {
   try {
     const sourceDir = getSinapseCoreSourcePath();
     const targetSinapseCore = path.join(targetDir, '.sinapse-ai');
+    const previousVersionPath = path.join(targetSinapseCore, 'version.json');
+    let previousProviderHashes = {};
+    if (await fs.pathExists(previousVersionPath)) {
+      try {
+        previousProviderHashes = (await fs.readJson(previousVersionPath)).providerFileHashes || {};
+      } catch (_error) {
+        previousProviderHashes = {};
+      }
+    }
 
     // Check if source exists
     if (!await fs.pathExists(sourceDir)) {
@@ -349,19 +666,45 @@ async function installSinapseCore(options = {}) {
     //              regenerated from squads/ + core by sync-codex-local-first.js.
     const pkgRoot = path.dirname(sourceDir);
     const topLevelDirs = ['squads'];
-    if (includeCodex) topLevelDirs.push('.codex');
+    if (includeCodex) topLevelDirs.push(...CODEX_TOP_LEVEL_DIRS);
+    if (includeClaude) topLevelDirs.push(...CLAUDE_SUPPORT_DIRS);
     for (const dirName of topLevelDirs) {
       const src = path.join(pkgRoot, dirName);
       const dest = path.join(targetDir, dirName);
       if (await fs.pathExists(src)) {
         spinner.text = `Copying ${dirName}...`;
-        const copied = await copyDirectoryWithRootReplacement(src, dest, onProgress);
+        const preserveExisting = dirName === '.codex' || dirName === '.agents'
+          ? createCodexPreservePredicate(targetDir, pkgRoot, previousProviderHashes)
+          : null;
+        const copied = await copyDirectoryWithRootReplacement(
+          src,
+          dest,
+          onProgress,
+          preserveExisting,
+        );
         result.installedFiles.push(...copied.map((f) => path.join(dirName, f)));
         if (dirName === '.codex') result.codexInstalledFiles = copied.length;
+        if (dirName === '.agents') result.codexNativeSkillFiles = copied.length;
         if (dirName === 'squads') result.squadsInstalledFiles = copied.length;
       }
     }
 
+    if (includeClaude) {
+      result.claudeLegacyAgentCommandReconciliation = await reconcileLegacyClaudeAgentCommands(targetDir, pkgRoot);
+      const claude = await deliverClaudeNativeAdapters(pkgRoot, targetDir, { overwriteManaged: overwriteManagedAdapters });
+      result.claudeNativeAgentFiles = claude.agents.length;
+      result.claudeNativeSkillFiles = claude.skills.length;
+      result.installedFiles.push(...claude.agents, ...claude.skills);
+      if (claude.manifest) result.installedFiles.push(claude.manifest);
+      const claudeContextSource = path.join(pkgRoot, '.claude', 'CLAUDE.md');
+      const claudeContextDest = path.join(targetDir, '.claude', 'CLAUDE.md');
+      if (await fs.pathExists(claudeContextSource) && await copyFileWithRootReplacement(claudeContextSource, claudeContextDest, true)) {
+        result.installedFiles.push(path.join('.claude', 'CLAUDE.md'));
+      }
+      const claudeSettings = await reconcileClaudeHookSettings(pkgRoot, targetDir);
+      if (claudeSettings) result.installedFiles.push(claudeSettings);
+    }
+
     // AGENTS.md is the Codex CLI's default context file (Imperator greeting +
     // the full agent roster). It lives at the package ROOT (not under .codex/ or
     // .sinapse-ai/), so neither loop above reaches it. Without it, a Codex user's
@@ -374,6 +717,7 @@ async function installSinapseCore(options = {}) {
         result.installedFiles.push('AGENTS.md');
         result.agentsMdInstalled = true;
       }
+      result.codexLegacySkillReconciliation = await reconcileLegacyCodexSkills(targetDir, pkgRoot);
     }
 
     // Create install manifest
@@ -399,6 +743,10 @@ async function installSinapseCore(options = {}) {
       version: packageVersion,
       installedFiles: result.installedFiles,
       mode: 'project-development',
+      providers: [includeClaude && 'claude-code', includeCodex && 'codex'].filter(Boolean),
+      targetDir,
+      providerFiles: includeCodex ? getManagedCodexSkillPaths(pkgRoot) : [],
+      providerSourceRoot: pkgRoot,
     });
     result.versionInfo = versionInfo;
 
@@ -520,10 +868,19 @@ module.exports = {
   copyFileWithRootReplacement,
   copyDirectoryWithRootReplacement,
   isUserOwnedL3,
+  createCodexPreservePredicate,
+  getManagedCodexSkillPaths,
+  reconcileLegacyCodexSkills,
+  reconcileLegacyClaudeAgentCommands,
   generateVersionJson,
   generateFileHashes,
   deliverCodexRootFiles,
+  deliverClaudeNativeAdapters,
+  getClaudeHookName,
+  reconcileClaudeHookSettings,
   FOLDERS_TO_COPY,
   ROOT_FILES_TO_COPY,
   CODEX_ROOT_FILES,
+  CODEX_TOP_LEVEL_DIRS,
+  CLAUDE_SUPPORT_DIRS,
 };

package/packages/installer/src/migrations/legacy-claude-agent-command-hashes.json

@@ -0,0 +1,36 @@
+{
+  "schemaVersion": 1,
+  "algorithm": "sha256",
+  "files": {
+    "analyst.md": ["795b9209e7bc5bd31a736bb67ee5c0eeb1a95590afd47fb630c81de0dd87c126"],
+    "animations-orqx.md": ["f3cce5c6d75a6a872171593dba8bafeae657488950fad63c89f17e7e193e92e0"],
+    "architect.md": ["d2e8a9b7b4c7582870f08561f482fa6c51a0b347fdcc066bd88bda5575a2052f"],
+    "brand-orqx.md": ["a4afdbd9dc8fd118939be2e07377967a86748310b89c7f59b14818d84fbb10ad"],
+    "cloning-orqx.md": ["134d10224635b9898469d7bb3992f636ecdba375272e3ad1c24eb0215c1a85c0"],
+    "commercial-orqx.md": ["170288942d7c85c28fece5eef0256101eee0699a76a8f28b3e7ec5878d2f0b79"],
+    "content-orqx.md": ["f93bf397c8da352d10b884600ae339979a0c6c5190fb3b21daa1de6d3e7a2e45"],
+    "copy-orqx.md": ["86f70db676af7475d13face6468da78ee05e5c257b506fe484b62c0d1ca9439c"],
+    "council-orqx.md": ["d2ab7fcd71e71677d6fd15ae1565c35fb241e4b9558e79da0e030fc70a81efe4"],
+    "courses-orqx.md": ["236e69533c0155a42dfc762f563455244b71f127ae6459b70ffabad8ba081654"],
+    "cyber-orqx.md": ["8efff68f6e1441df8719b3d743dc27f9e6d0ce6d9f6e7128284a144d5c74ac63"],
+    "data-engineer.md": ["9c9faba56ad0bb8816e76117e0392e0727d8f4aba46413fa053c97d5aaf086bf"],
+    "design-orqx.md": ["e3b10fb943a64916826a11d13e0e57f61cc5e27e8966ea15924cae4e055aad64"],
+    "developer.md": ["b996b501f752b4f049367182d0c2c5a99019fddeab343c840a7da2f8ca1d70a4"],
+    "devops.md": ["18354e8a0e8b39786d48a5d9f8a7e532698e6fe49a65f3243be6a96eb6c73c42"],
+    "finance-orqx.md": ["f4ebeb70b7a0890c491608a00feedd31b9b4a9b872ed02d489b39a99fa01c537"],
+    "growth-orqx.md": ["b0f74d98f40fe384c81a22ab705007e4e40ab9f82bc6c23d2282a05aed17cbdf"],
+    "paidmedia-orqx.md": ["b68b91bc647fa6290c9109d621d98f6567b28967acb9e474cbf399442711c530"],
+    "product-lead.md": ["a62d2f6079b7deabe22d24cd66943375e82fbe9ea389e23bf9a7a9ea2fa55e08"],
+    "product-orqx.md": ["5df3d89096efdc1cabdcfaaf82b14571689d258a495981520ae0a0ea8fa04a92"],
+    "project-lead.md": ["0dd16d04f28c7614c025dadb557aa4b3eeb56c96fda8874afec40b8044db6e2b"],
+    "quality-gate.md": ["ed735180b28c51df2803933009f9b9bc6f5f497ac2b528919a4eed83e0ba1682"],
+    "research-orqx.md": ["9cf3c189b670ee4565329abec1a2c7d208a3013a9dba695208cbe617b4b0984b"],
+    "sinapse-orqx.md": ["36e704406c594a72cbf72eac52bb9ce22a636965a8c86a45c6560e4cc4fb67d6"],
+    "snps-orqx.md": ["0452d5291fd27239c0e6f79064d214c9755234e444daabbcea7cdd5e0f5a544d"],
+    "sprint-lead.md": ["3abfcccefb0e15765549cc54fabb8e398de135532c76f9ef8b16a57220dcac69"],
+    "squad-creator.md": ["1a92aeabebee66782dd906a75844451d3cb0fc0af59f7df266ab4106026ef657"],
+    "storytelling-orqx.md": ["45889421752caaecaff3ccc92d22e333235d675f65710f435b3b7224bbc0e022"],
+    "swarm-orqx.md": ["9eb519069dc7b9a10fd2ca677f4dfbed9ad3f966d0d65b2a73daf67b000b81c0"],
+    "ux-design-expert.md": ["f26f6935b95bd3c5d051a0b0a70394571f47fb1992e26ad17b25033b04f81048"]
+  }
+}

package/packages/installer/src/migrations/legacy-codex-native-skill-hashes.json

@@ -0,0 +1,42 @@
+{
+  "schemaVersion": 1,
+  "algorithm": "sha256",
+  "files": {
+    ".agents/skills/sinapse-agent/SKILL.md": ["122ddfefe2fc23579c54513953f2f8cb7e872708c3c2078aac1a72a5e8a55959"],
+    ".agents/skills/sinapse-analyst/SKILL.md": ["3ff8b42481e23e847ebac3c255ff4437b984c715046e16fb61d0605fa1a5b677"],
+    ".agents/skills/sinapse-animations/SKILL.md": ["78666bb951ea083f1df13d9960ed7cecaef304024cea4392b2fc3022251fdab5"],
+    ".agents/skills/sinapse-architect/SKILL.md": ["05bbbaf7d493918cf4856feddd611b8f2e1f88924e7bba0f6ab9ce83ab7b6718"],
+    ".agents/skills/sinapse-brand/SKILL.md": ["bfbdebaa0e3c9e2668025af01df88841646ea450e4b1e6cb5008ca02258206db"],
+    ".agents/skills/sinapse-claude/SKILL.md": ["85f25d07838fa259cf48338ab526eeb6391c47ddbf10dba44aa6cc35421a90bf"],
+    ".agents/skills/sinapse-cloning/SKILL.md": ["b9e6d9e6c87cb79f261c46b6f6e83fc1d10506bcb920ece4012b07020334dc2a"],
+    ".agents/skills/sinapse-commercial/SKILL.md": ["b26cb18661293ffee078bd555677b7fa201718f1cdedf859dd358ae33b901e1e"],
+    ".agents/skills/sinapse-content/SKILL.md": ["61f4cbb9b9a5de4dde5fbf7b3027898be20fb127a287b19d5955e34a832b3ba3"],
+    ".agents/skills/sinapse-copy/SKILL.md": ["dddf3da31fe8807eb60450ad0dcdd73288ba32470b142d4d1c994277282dd1a2"],
+    ".agents/skills/sinapse-council/SKILL.md": ["6692021c2578524513a5462b7271aa7eda7335961cea5d9d015f7b75f3dfd2a1"],
+    ".agents/skills/sinapse-courses/SKILL.md": ["653a21c66dd78904b53b8924601778f1682db8b879ab5d50320d06452236687d"],
+    ".agents/skills/sinapse-cyber/SKILL.md": ["55c12f9a6f35970b3bf0d6d6ab8208b6348a9390040df1d8d01df108a369b429"],
+    ".agents/skills/sinapse-data-engineer/SKILL.md": ["5c8e31f9cba46f89fffbb5c83fe831725d951f75275b085b51ea48beab0291fa"],
+    ".agents/skills/sinapse-design/SKILL.md": ["3c35efa3e905d636352f5f046d494665ebf9e33f4c896fddcfa112103877a00d"],
+    ".agents/skills/sinapse-dev/SKILL.md": ["a2ff86c33e61efb1085e9388c8f1f6a58389b9dc8b74ecbe83c096b920f114db"],
+    ".agents/skills/sinapse-devops/SKILL.md": ["9cf5ef12999568e292f4e5d302bd61831872a783d6ed9caaca7a1ac247c63c01"],
+    ".agents/skills/sinapse-finance/SKILL.md": ["4b596578bbb950e8513eb96ea62200880c9184989bdfc91c7ecd1370f47b07ab"],
+    ".agents/skills/sinapse-growth/SKILL.md": ["53d32adb439098528925425d4ff86458e8fb2efb3c8fd6b62e8c42de4f06873c"],
+    ".agents/skills/sinapse-loop/SKILL.md": ["e5a33f9235c66e554e67d7668ac5e3255e1b6f9ed026f7bf3be666c169bf396a"],
+    ".agents/skills/sinapse-orqx/SKILL.md": ["b522b867768f4f6cf9151978734611b1482ec6f35cbe8552e9e324c4bb16de50"],
+    ".agents/skills/sinapse-paidmedia/SKILL.md": ["81ae19dae135dcd001703446131989ac51da1a299d8fab59ddc21596b1d462e2"],
+    ".agents/skills/sinapse-pm/SKILL.md": ["ecf406f3a94c48defff97c9ef55410cdf82cfa445b3d1244df0c6dd66543b910"],
+    ".agents/skills/sinapse-po/SKILL.md": ["56693d11a13cf51eb600883d26f232adfb6c0275015a1dfa0fd467387700667f"],
+    ".agents/skills/sinapse-product/SKILL.md": ["50bae9a40dca95287b864a873fe578953b5f361239a3e6c2b70ae2cd38197eb7"],
+    ".agents/skills/sinapse-qa/SKILL.md": ["54ac75619ae2cd28fa820e224abc5fc82163198652ce200d0706aa0734e98509"],
+    ".agents/skills/sinapse-research/SKILL.md": ["ac98bc465c1c975d95d93ffc6a665c41ab679e1885882ab7a91c86501a34d181"],
+    ".agents/skills/sinapse-sm/SKILL.md": ["408556e7cff08d5b84c724e55a3d35e7624e155984edfe697c7a9fe61e60a72f"],
+    ".agents/skills/sinapse-spec-driven/SKILL.md": ["5216b2f651f88263323a07cabec78259036bb4ec23689d312c770cef216b26a1"],
+    ".agents/skills/sinapse-squad-creator/SKILL.md": ["779a93754fb121d8f405667f2d3852faeb8945302129aec74c0d1f6b51f62ed3"],
+    ".agents/skills/sinapse-storytelling/SKILL.md": ["65e2d8719eee6d0221bcfe758144c24575cf00c0aa988b785f98c69fc4982025"],
+    ".agents/skills/sinapse-swarm/SKILL.md": ["8c98e9b1da2cb279ef7fa10ca4e81cb0a230ecdbfda4f890b0b94f1604626f00"],
+    ".agents/skills/sinapse-ux-design-expert/SKILL.md": ["5a1c747c030113b50d98a431bfffc4418e38355cae72f7e5a088ee5bee8bc530"],
+    ".agents/skills/sinapse/SKILL.md": ["fe017c091d1308eb937762ffe25f83518f778a266303cc3f028d0f468df0747f"],
+    ".agents/skills/snps-orqx/SKILL.md": ["24f66470a5721fc086a52eca9907958d091d68c2de0a0b56a42e07e83fe00342"],
+    ".agents/skills/snps/SKILL.md": ["9f9a0972a184a07234948f4e5dd8f7032835be3283608a00c8cbf8bbf68064a3"]
+  }
+}

package/packages/installer/src/updater/index.js

@@ -20,10 +20,29 @@ const fs = require('fs-extra');
 const path = require('path');
 const os = require('os');
 const https = require('https');
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 const { hashFile, hashesMatch } = require('../installer/file-hasher');
 const { PostInstallValidator, formatReport: formatValidationReport } = require('../installer/post-install-validator');
 const { _testing: { installGlobalAgents } } = require('../wizard/index');
+const { installSinapseCore } = require('../installer/sinapse-ai-installer');
+
+function detectInstalledProviders(projectRoot, recordedProviders = []) {
+  if (recordedProviders.length > 0) {
+    return {
+      includeClaude: recordedProviders.includes('claude-code'),
+      includeCodex: recordedProviders.includes('codex'),
+    };
+  }
+  const includeClaude = fs.existsSync(path.join(projectRoot, '.claude', 'skill-manifest.json'));
+  const hasCodexCatalog = fs.existsSync(path.join(projectRoot, '.codex', 'catalog.json'));
+  const hasNativeActivator = fs.existsSync(
+    path.join(projectRoot, '.agents', 'skills', 'sinapse-agent', 'SKILL.md'),
+  );
+  const hasLegacyActivator = fs.existsSync(
+    path.join(projectRoot, '.codex', 'skills', 'sinapse-agent', 'SKILL.md'),
+  );
+  return { includeClaude, includeCodex: hasCodexCatalog && (hasNativeActivator || hasLegacyActivator) };
+}
 
 /**
  * Update status types
@@ -601,20 +620,33 @@ class SINAPSEUpdater {
 
     try {
       // Use npm to update the package
-      const cmd = `npm install sinapse-ai@${targetVersion} --save-exact`;
-      this.log(`Running: ${cmd}`);
+      const packageSpec = `sinapse-ai@${targetVersion}`;
+      this.log(`Running: npm install ${packageSpec} --save-exact`);
 
-      execSync(cmd, {
+      execFileSync(process.platform === 'win32' ? 'npm.cmd' : 'npm', ['install', packageSpec, '--save-exact'], {
         cwd: this.projectRoot,
         stdio: this.options.verbose ? 'inherit' : 'pipe',
         timeout: 120000, // 2 minutes
       });
 
-      result.success = true;
-      result.filesUpdated = 1; // At least package updated
+      const recordedProviders = Array.isArray(this.versionInfo?.providers)
+        ? this.versionInfo.providers
+        : [];
+      const { includeClaude, includeCodex } = detectInstalledProviders(
+        this.projectRoot,
+        recordedProviders,
+      );
+      const delivery = await installSinapseCore({
+        targetDir: this.projectRoot,
+        includeClaude,
+        includeCodex,
+        overwriteManagedAdapters: true,
+      });
+      if (!delivery.success) throw new Error(`Framework payload reconciliation failed: ${delivery.errors.join('; ')}`);
 
-      // TODO: Copy new files from node_modules to .sinapse-ai
-      // preserving customizedFiles
+      result.success = true;
+      result.filesUpdated = 1 + delivery.installedFiles.length;
+      result.codexLegacySkillReconciliation = delivery.codexLegacySkillReconciliation || null;
 
       return result;
     } catch (error) {
@@ -637,6 +669,7 @@ class SINAPSEUpdater {
       installedAt: new Date().toISOString(),
       updatedAt: new Date().toISOString(),
       mode: this.versionInfo?.mode || 'project-development',
+      providers: Array.isArray(this.versionInfo?.providers) ? this.versionInfo.providers : [],
       fileHashes: {}, // Will be populated by file copy
     };
 
@@ -764,14 +797,14 @@ class SINAPSEUpdater {
       const installResult = await installGlobalAgents();
       result.installed = installResult.count;
       if (installResult.errors.length > 0) {
-        console.log(`  Agent install warnings: ${installResult.errors.join(', ')}`);
+        console.log(`  Agent install warnings: ${sanitizeLogText(installResult.errors.join(', '))}`);
       }
 
       result.migrated = true;
       console.log(`  v6 migration complete: ${result.removed} removed, ${result.installed} installed`);
     } catch (error) {
       // Migration errors should not block the update
-      console.log(`  v6 migration warning: ${error.message}`);
+      console.log(`  v6 migration warning: ${sanitizeLogText(error.message)}`);
     }
 
     return result;
@@ -788,13 +821,17 @@ class SINAPSEUpdater {
    */
   log(message) {
     if (this.options.verbose) {
-      // eslint-disable-next-line no-control-regex
-      const sanitized = String(message).replace(/[\x00-\x08\x0B-\x1F\x7F]/g, '');
+      const sanitized = sanitizeLogText(message);
       console.log(`[SINAPSEUpdater] ${sanitized}`);
     }
   }
 }
 
+function sanitizeLogText(value) {
+  // eslint-disable-next-line no-control-regex
+  return String(value).replace(/[\x00-\x1F\x7F\u2028\u2029]/g, ' ');
+}
+
 /**
  * Format update check result for console
  *
@@ -920,5 +957,6 @@ module.exports = {
   FileAction,
   formatCheckResult,
   formatUpdateResult,
+  sanitizeLogText,
+  detectInstalledProviders,
 };
-

package/packages/installer/src/wizard/feedback.js

@@ -22,7 +22,7 @@ const { t } = require('./i18n');
  * Do NOT inline these numbers elsewhere in this file — reference `ECOSYSTEM`
  * so there is exactly one place to update when `sync:counts` changes.
  */
-const ECOSYSTEM = Object.freeze({ squads: 17, agents: 172, tasks: '1,200' });
+const ECOSYSTEM = Object.freeze({ squads: 17, agents: 172, tasks: '1,411' });
 
 /**
  * Create and start a spinner with SINAPSE styling