sinapse-ai 1.6.1 → 1.8.0

package/.sinapse-ai/infrastructure/integrations/ai-providers/claude-provider.js

@@ -7,8 +7,11 @@
  * @see Epic GEMINI-INT - Story 2: AI Provider Factory Pattern
  */
 
-const { spawn, execSync } = require('child_process');
+const { execSync } = require('child_process');
 const { AIProvider } = require('./ai-provider');
+// runSafe (cross-spawn): resolves claude.cmd on Windows and delivers the prompt
+// via stdin/argv — same hardened spawn path used by the SubagentDispatcher.
+const { runSafe } = require('../../../core/utils/spawn-safe');
 
 /**
  * Claude Code provider implementation
@@ -20,7 +23,7 @@ class ClaudeProvider extends AIProvider {
   /**
    * Create a Claude provider
    * @param {Object} [config={}] - Provider configuration
-   * @param {string} [config.model='claude-3-5-sonnet'] - Model to use
+   * @param {string} [config.model] - Model override; omitted → CLI default model
    * @param {number} [config.timeout=300000] - Execution timeout
    * @param {boolean} [config.dangerouslySkipPermissions=false] - Skip permission prompts
    */
@@ -31,7 +34,9 @@ class ClaudeProvider extends AIProvider {
       timeout: config.timeout || 300000,
       maxRetries: config.maxRetries || 3,
       options: {
-        model: config.model || 'claude-3-5-sonnet',
+        // No hardcoded model: stale IDs break the CLI. Only pass --model when
+        // a caller explicitly configures one; otherwise use the CLI's default.
+        model: config.model || null,
         dangerouslySkipPermissions: config.dangerouslySkipPermissions || false,
         ...config,
       },
@@ -82,59 +87,56 @@ class ClaudeProvider extends AIProvider {
       args.push('--model', options.model || this.options.model);
     }
 
-    return new Promise((resolve, reject) => {
-      let stdout = '';
-      let stderr = '';
-
-      // Spawn claude directly without shell interpolation (safer)
-      const child = spawn(this.command, args, {
-        cwd: workingDir,
-        env: { ...process.env, ...options.env },
-        windowsHide: true,
-        stdio: ['pipe', 'pipe', 'pipe'],
-      });
-
-      // Write prompt via stdin to avoid shell injection
-      child.stdin.write(prompt);
-      child.stdin.end();
-
-      const timeoutId = setTimeout(() => {
-        child.kill('SIGTERM');
-        reject(new Error(`Claude execution timed out after ${timeout}ms`));
-      }, timeout);
-
-      child.stdout.on('data', (data) => {
-        stdout += data.toString();
-      });
-
-      child.stderr.on('data', (data) => {
-        stderr += data.toString();
-      });
-
-      child.on('close', (code) => {
-        clearTimeout(timeoutId);
-        const duration = Date.now() - startTime;
-
-        if (code === 0) {
-          resolve({
-            success: true,
-            output: stdout.trim(),
-            metadata: {
-              duration,
-              provider: 'claude',
-              model: options.model || this.options.model,
-            },
-          });
-        } else {
-          reject(new Error(`Claude exited with code ${code}: ${stderr || stdout}`));
-        }
-      });
-
-      child.on('error', (error) => {
-        clearTimeout(timeoutId);
-        reject(new Error(`Claude spawn error: ${error.message}`));
-      });
+    // runSafe: argv-based spawn via cross-spawn (resolves claude.cmd on Windows),
+    // prompt delivered through stdin — shell injection structurally impossible.
+    const result = await runSafe(this.command, args, {
+      cwd: workingDir,
+      env: { ...process.env, ...options.env },
+      timeout,
+      input: prompt,
     });
+
+    const duration = Date.now() - startTime;
+
+    const stdout = (result.stdout || '').trim();
+    const stderr = (result.stderr || '').trim();
+
+    if (result.success) {
+      return {
+        success: true,
+        output: stdout,
+        metadata: {
+          duration,
+          provider: 'claude',
+          model: options.model || this.options.model || 'cli-default',
+        },
+      };
+    }
+
+    if (result.signal) {
+      throw new Error(
+        `Claude killed by signal ${result.signal} (timeout ${timeout}ms?): ${stderr || stdout}`,
+      );
+    }
+
+    // User-environment hooks (SessionEnd etc.) can fail AFTER the model already
+    // printed its full response, poisoning the exit code. In --print mode a
+    // non-empty stdout + hook-related stderr means the work was done — accept it
+    // (with a warning) instead of discarding paid output and retrying.
+    if (stdout.length > 0 && /hook/i.test(stderr)) {
+      return {
+        success: true,
+        output: stdout,
+        metadata: {
+          duration,
+          provider: 'claude',
+          model: options.model || this.options.model || 'cli-default',
+          warning: `non-zero exit (${result.code}) caused by environment hook failure: ${stderr.slice(0, 200)}`,
+        },
+      };
+    }
+
+    throw new Error(`Claude exited with code ${result.code}: ${stderr || stdout}`);
   }
 
   /**

package/.sinapse-ai/infrastructure/integrations/pm-adapters/github-adapter.js

@@ -7,7 +7,7 @@
  * @see Story 3.20 - PM Tool-Agnostic Integration (TR-3.20.3)
  */
 
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 const fs = require('fs');
 const yaml = require('js-yaml');
 const { PMAdapter } = require('../../scripts/pm-adapter');
@@ -293,8 +293,10 @@ class GitHubProjectsAdapter extends PMAdapter {
    * @returns {string} Command output
    */
   _execGH(args) {
-    const command = `gh ${args.join(' ')}`;
-    return execSync(command, { encoding: 'utf8' });
+    // Pass args as an argv array to execFileSync — no shell is spawned, so each
+    // argument is delivered to `gh` verbatim. This prevents shell-metacharacter
+    // injection (e.g. $(...), backticks, ;, &&, |) from story-derived title/body.
+    return execFileSync('gh', args, { encoding: 'utf8' });
   }
 
   /**
@@ -360,8 +362,8 @@ class GitHubProjectsAdapter extends PMAdapter {
 
     const result = this._execGH([
       'issue', 'create',
-      '--title', `"${title}"`,
-      '--body', `"${body.replace(/"/g, '\\"')}"`,
+      '--title', title,
+      '--body', body,
       '--label', labels.join(','),
     ]);
 
@@ -383,8 +385,8 @@ class GitHubProjectsAdapter extends PMAdapter {
 
     this._execGH([
       'issue', 'edit', issueNumber.toString(),
-      '--title', `"${title}"`,
-      '--body', `"${body.replace(/"/g, '\\"')}"`,
+      '--title', title,
+      '--body', body,
     ]);
   }
 }

package/.sinapse-ai/infrastructure/scripts/ide-sync/gemini-commands.js

@@ -0,0 +1,298 @@
+'use strict';
+
+/**
+ * Gemini Commands Sync — generates .gemini/commands/*.toml from parsed agent data.
+ *
+ * Writes one TOML file per agent plus a sinapse-menu.toml launcher.
+ * Called by index.js after agents are parsed; the index.js caller is responsible
+ * for registering this as the Gemini IDE target handler.
+ *
+ * @story 5.1 - IDE Sync Expansion
+ */
+
+const fs = require('fs-extra');
+const path = require('path');
+
+const FALLBACK_DESCRIPTION = 'Agente especializado SINAPSE';
+const MAX_DESCRIPTION_CONTEXT = 120;
+
+const MENU_ORDER = [
+  'sinapse-orqx',
+  'analyst',
+  'architect',
+  'data-engineer',
+  'developer',
+  'devops',
+  'project-lead',
+  'product-lead',
+  'quality-gate',
+  'sprint-lead',
+  'squad-creator',
+  'ux-design-expert',
+];
+
+/**
+ * Strip the sinapse- prefix so the slug is short and readable.
+ * @param {string} agentId
+ * @returns {string}
+ */
+function commandSlugForAgent(agentId) {
+  if (agentId.startsWith('sinapse-')) {
+    return agentId.replace(/^sinapse-/, '');
+  }
+  return agentId;
+}
+
+/**
+ * Return the Gemini slash-command name for an agent.
+ * Example: "developer" → "/sinapse-developer"
+ * @param {string} agentId
+ * @returns {string}
+ */
+function menuCommandName(agentId) {
+  return `/sinapse-${commandSlugForAgent(agentId)}`;
+}
+
+/**
+ * Collapse internal whitespace and trim.
+ * @param {string} text
+ * @returns {string}
+ */
+function normalizeText(text) {
+  if (!text || typeof text !== 'string') return '';
+  return text.replace(/\s+/g, ' ').trim();
+}
+
+/**
+ * Truncate to maxLen characters with an ellipsis.
+ * @param {string} text
+ * @param {number} [maxLen]
+ * @returns {string}
+ */
+function truncateText(text, maxLen = MAX_DESCRIPTION_CONTEXT) {
+  if (!text || text.length <= maxLen) return text;
+  return `${text.slice(0, maxLen - 1).trimEnd()}…`;
+}
+
+/**
+ * Extract a concise one-liner from a whenToUse block.
+ * Drops redirect/negative-guidance sections before truncating.
+ * @param {string} whenToUse
+ * @returns {string}
+ */
+function summarizeWhenToUse(whenToUse) {
+  const normalized = normalizeText(whenToUse);
+  if (!normalized) return '';
+
+  // Drop redirect/negative guidance sections that are useful for routing, not for menu labels.
+  const withoutNegativeSection = normalized.split(/\b(?:NOT\s+for|NÃO\s+para)\b/i)[0].trim();
+  const primary = withoutNegativeSection || normalized;
+
+  // Keep only the first sentence/chunk for concise autocomplete labels.
+  const firstChunk = primary.split(/[.;!?](?:\s|$)/)[0].trim();
+  return truncateText(firstChunk || primary);
+}
+
+/**
+ * Escape a string for embedding inside a TOML double-quoted scalar.
+ * @param {string} text
+ * @returns {string}
+ */
+function escapeTomlString(text) {
+  return String(text || '').replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
+
+/**
+ * Build a human-readable one-liner description for an agent entry.
+ * Prefers title + whenToUse summary; falls back to SINAPSE generic.
+ * @param {object} agent - Parsed agent object from agent-parser
+ * @returns {string}
+ */
+function buildAgentDescription(agent) {
+  const agentData = agent.agent || {};
+  const title = normalizeText(agentData.title);
+  const whenToUseSummary = summarizeWhenToUse(agentData.whenToUse);
+
+  if (title && whenToUseSummary) {
+    return `${title} (${whenToUseSummary})`;
+  }
+  if (title) {
+    return title;
+  }
+  if (whenToUseSummary) {
+    return whenToUseSummary;
+  }
+  return `Ativar agente SINAPSE ${agent.id}`;
+}
+
+/**
+ * Build the activation prompt stored in each agent's TOML file.
+ * References the agent definition at .gemini/rules/SINAPSE/agents/{id}.md.
+ * @param {string} agentId
+ * @returns {string}
+ */
+function buildAgentCommandPrompt(agentId) {
+  return [
+    `Ative o agente ${agentId}:`,
+    `1. Leia a definição completa em .gemini/rules/SINAPSE/agents/${agentId}.md`,
+    '2. Siga as activation-instructions do bloco YAML',
+    `3. Renderize o greeting via: node .sinapse-ai/development/scripts/generate-greeting.js ${agentId}`,
+    '   Se shell nao disponivel, exiba o greeting de persona_profile.communication.greeting_levels.named',
+    '4. Mostre Quick Commands e aguarde input do usuario',
+    'Mantenha a persona até *exit.',
+  ].join('\n');
+}
+
+/**
+ * Build the TOML content for a single agent command file.
+ * @param {string} agentId
+ * @param {string} [description]
+ * @returns {{ filename: string, content: string, agentId: string, description: string }}
+ */
+function buildAgentCommandFile(agentId, description = FALLBACK_DESCRIPTION) {
+  const slug = commandSlugForAgent(agentId);
+
+  const prompt = buildAgentCommandPrompt(agentId);
+  const content = [
+    `description = "${escapeTomlString(description)}"`,
+    'prompt = """',
+    prompt,
+    '"""',
+    '',
+  ].join('\n');
+
+  return {
+    filename: `sinapse-${slug}.toml`,
+    content,
+    agentId,
+    description,
+  };
+}
+
+/**
+ * Build the multi-line prompt that lists all agents in the launcher menu.
+ * @param {Array<{ agentId: string, description: string }>} commandFiles
+ * @returns {string}
+ */
+function buildMenuPrompt(commandFiles) {
+  const lines = [
+    'Você está no launcher SINAPSE para Gemini.',
+    '',
+    'Mostre a lista de agentes abaixo em formato numerado, explicando em 1 linha quando usar cada um:',
+  ];
+
+  let index = 1;
+  for (const commandFile of commandFiles) {
+    lines.push(`${index}. ${menuCommandName(commandFile.agentId)} - ${commandFile.description}`);
+    index += 1;
+  }
+
+  lines.push('');
+  lines.push('No final, peça para o usuário escolher um número ou digitar o comando direto.');
+  return lines.join('\n');
+}
+
+/**
+ * Build the sinapse-menu.toml launcher file that lists all agents.
+ * @param {Array<{ agentId: string, description: string }>} commandFiles
+ * @returns {{ filename: string, content: string }}
+ */
+function buildMenuCommandFile(commandFiles) {
+  const content = [
+    'description = "Menu rápido SINAPSE (lista agentes e orienta qual ativar)"',
+    'prompt = """',
+    buildMenuPrompt(commandFiles),
+    '"""',
+    '',
+  ].join('\n');
+
+  return {
+    filename: 'sinapse-menu.toml',
+    content,
+  };
+}
+
+/**
+ * Resolve the display order for agent IDs.
+ * MENU_ORDER entries come first (in declared order), extras are sorted alphabetically.
+ * @param {string[]} agentIds
+ * @returns {string[]}
+ */
+function resolveAgentOrder(agentIds) {
+  const unique = [...new Set(agentIds)];
+  const known = MENU_ORDER.filter((id) => unique.includes(id));
+  const extra = unique.filter((id) => !MENU_ORDER.includes(id)).sort();
+  return [...known, ...extra];
+}
+
+/**
+ * Build the full set of TOML command files for all valid agents.
+ * Returns an array of { filename, content, agentId, description } entries,
+ * with sinapse-menu.toml prepended as the first item.
+ * @param {object[]} agents - Array of parsed agent objects from agent-parser
+ * @returns {Array<{ filename: string, content: string, agentId: string, description: string }>}
+ */
+function buildGeminiCommandFiles(agents) {
+  const validAgents = agents
+    .filter((agent) => !agent.error)
+    .map((agent) => ({
+      id: agent.id,
+      description: buildAgentDescription(agent),
+    }));
+
+  const ordered = resolveAgentOrder(validAgents.map((agent) => agent.id));
+  const byId = new Map(validAgents.map((agent) => [agent.id, agent]));
+  const files = ordered.map((id) => {
+    const meta = byId.get(id);
+    const description = meta?.description || FALLBACK_DESCRIPTION;
+    return buildAgentCommandFile(id, description);
+  });
+  files.unshift(buildMenuCommandFile(files));
+  return files;
+}
+
+/**
+ * Write all Gemini command TOML files to {projectRoot}/.gemini/commands/.
+ * In dry-run mode the directory is not created and files are not written,
+ * but the return value still lists what would have been written.
+ * @param {object[]} agents - Parsed agents
+ * @param {string} projectRoot - Absolute path to the project root
+ * @param {{ dryRun?: boolean }} [options]
+ * @returns {{ commandsDir: string, files: Array<{ filename: string, path: string, content: string }> }}
+ */
+function syncGeminiCommands(agents, projectRoot, options = {}) {
+  const commandsDir = path.join(projectRoot, '.gemini', 'commands');
+  const files = buildGeminiCommandFiles(agents);
+  const written = [];
+
+  if (!options.dryRun) {
+    fs.ensureDirSync(commandsDir);
+  }
+
+  for (const file of files) {
+    const targetPath = path.join(commandsDir, file.filename);
+    if (!options.dryRun) {
+      fs.writeFileSync(targetPath, file.content, 'utf8');
+    }
+    written.push({
+      filename: path.join('commands', file.filename),
+      path: targetPath,
+      content: file.content,
+    });
+  }
+
+  return { commandsDir, files: written };
+}
+
+module.exports = {
+  FALLBACK_DESCRIPTION,
+  MENU_ORDER,
+  commandSlugForAgent,
+  menuCommandName,
+  buildAgentDescription,
+  summarizeWhenToUse,
+  truncateText,
+  escapeTomlString,
+  buildGeminiCommandFiles,
+  syncGeminiCommands,
+};

package/.sinapse-ai/infrastructure/scripts/ide-sync/index.js

@@ -24,8 +24,14 @@ const yaml = require('js-yaml');
 const { parseAllAgents } = require('./agent-parser');
 const { generateAllRedirects, writeRedirects } = require('./redirect-generator');
 const { validateAllIdes, formatValidationReport } = require('./validator');
+const { syncGeminiCommands, buildGeminiCommandFiles } = require('./gemini-commands');
+
 // Transformers
 const claudeCodeTransformer = require('./transformers/claude-code');
+const cursorTransformer = require('./transformers/cursor');
+const antigravityTransformer = require('./transformers/antigravity');
+const githubCopilotTransformer = require('./transformers/github-copilot');
+const kimiTransformer = require(path.resolve(__dirname, 'transformers', 'kimi'));
 
 // ANSI colors for output
 const colors = {
@@ -62,6 +68,31 @@ function loadConfig(projectRoot) {
         path: '.codex/agents',
         format: 'full-markdown-yaml',
       },
+      gemini: {
+        enabled: true,
+        path: '.gemini/rules/SINAPSE/agents',
+        format: 'full-markdown-yaml',
+      },
+      'github-copilot': {
+        enabled: true,
+        path: '.github/agents',
+        format: 'github-copilot',
+      },
+      cursor: {
+        enabled: true,
+        path: '.cursor/rules/agents',
+        format: 'condensed-rules',
+      },
+      antigravity: {
+        enabled: true,
+        path: '.antigravity/rules/agents',
+        format: 'cursor-style',
+      },
+      kimi: {
+        enabled: true,
+        path: '.kimi/skills',
+        format: 'kimi-skill',
+      },
     },
     redirects: {
       'sinapse-developer': 'sinapse-orqx',
@@ -100,9 +131,54 @@ function loadConfig(projectRoot) {
 function getTransformer(format) {
   const transformers = {
     'full-markdown-yaml': claudeCodeTransformer,
+    'condensed-rules': cursorTransformer,
+    'cursor-style': antigravityTransformer,
+    'github-copilot': githubCopilotTransformer,
+    'kimi-skill': kimiTransformer,
   };
 
-  return transformers[format] || claudeCodeTransformer;
+  const transformer = transformers[format];
+  if (!transformer) {
+    throw new Error(
+      `No transformer registered for format '${format}'. ` +
+        `Register it in getTransformer() before adding a target with this format. ` +
+        `Available formats: ${Object.keys(transformers).join(', ')}`
+    );
+  }
+  return transformer;
+}
+
+/**
+ * Resolve the primary file content for an agent.
+ * Allows IDE-specific transform variants (e.g. transformCommand) when present,
+ * falling back to the standard transform() otherwise.
+ * @param {object} transformer - Transformer module
+ * @param {object} agent - Parsed agent data
+ * @param {string} ideName - IDE name
+ * @returns {string} - Transformed content
+ */
+function transformPrimaryContent(transformer, agent, ideName) {
+  if (ideName === 'claude-code' && typeof transformer.transformCommand === 'function') {
+    return transformer.transformCommand(agent);
+  }
+  return transformer.transform(agent);
+}
+
+/**
+ * Guard against path traversal: returns true only when candidatePath resolves
+ * to a location strictly inside rootDir.
+ * @param {string} rootDir - Allowed root directory
+ * @param {string} candidatePath - Path to validate
+ * @returns {boolean}
+ */
+function isPathInside(rootDir, candidatePath) {
+  const relativePath = path.relative(rootDir, candidatePath);
+  return (
+    relativePath !== '' &&
+    relativePath !== '..' &&
+    !relativePath.startsWith(`..${path.sep}`) &&
+    !path.isAbsolute(relativePath)
+  );
 }
 
 /**
@@ -153,9 +229,30 @@ function syncIde(agents, ideConfig, ideName, projectRoot, options) {
     }
 
     try {
-      const content = transformer.transform(agent);
+      const content = transformPrimaryContent(transformer, agent, ideName);
       const filename = transformer.getFilename(agent);
-      const targetPath = path.join(result.targetDir, filename);
+      const targetRoot = path.resolve(result.targetDir);
+
+      // Kimi format uses subdirectories per skill: <skill-id>/SKILL.md
+      let targetPath;
+      if (ideConfig.format === 'kimi-skill' && transformer.getDirname) {
+        const dirname = transformer.getDirname(agent);
+        const skillDir = path.resolve(targetRoot, dirname);
+        targetPath = path.resolve(skillDir, filename);
+
+        if (!isPathInside(targetRoot, skillDir) || !isPathInside(targetRoot, targetPath)) {
+          throw new Error(`Unsafe Kimi output path for agent '${agent.id}'`);
+        }
+
+        if (!options.dryRun) {
+          fs.ensureDirSync(skillDir);
+        }
+      } else {
+        targetPath = path.resolve(targetRoot, filename);
+        if (!isPathInside(targetRoot, targetPath)) {
+          throw new Error(`Unsafe output path for agent '${agent.id}' in ${ideName}`);
+        }
+      }
 
       if (!options.dryRun) {
         fs.writeFileSync(targetPath, content, 'utf8');
@@ -237,7 +334,13 @@ async function commandSync(options) {
 
     const result = syncIde(agents, ideConfig, ideName, projectRoot, options);
 
-    result.commandFiles = [];
+    // Gemini CLI: also sync slash launcher command files (.gemini/commands/*.toml)
+    if (ideName === 'gemini') {
+      const geminiCommands = syncGeminiCommands(agents, projectRoot, options);
+      result.commandFiles = geminiCommands.files;
+    } else {
+      result.commandFiles = [];
+    }
 
     results.push(result);
 
@@ -339,9 +442,14 @@ async function commandValidate(options) {
       if (agent.error) continue;
 
       try {
-        const content = transformer.transform(agent);
+        const content = transformPrimaryContent(transformer, agent, ideName);
         const filename = transformer.getFilename(agent);
-        expectedFiles.push({ filename, content });
+        // Kimi format stores each skill in <skill-id>/SKILL.md — record nested path
+        const relPath =
+          ideConfig.format === 'kimi-skill' && transformer.getDirname
+            ? path.join(transformer.getDirname(agent), filename)
+            : filename;
+        expectedFiles.push({ filename: relPath, content });
       } catch (error) {
         // Skip agents that fail to transform
       }
@@ -366,6 +474,17 @@ async function commandValidate(options) {
       targetDir: path.join(projectRoot, ideConfig.path),
     };
 
+    // Gemini CLI command launcher files are synced under .gemini/commands/*.toml
+    if (ideName === 'gemini') {
+      const commandFiles = buildGeminiCommandFiles(agents).map((entry) => ({
+        filename: entry.filename,
+        content: entry.content,
+      }));
+      ideConfigs['gemini-commands'] = {
+        expectedFiles: commandFiles,
+        targetDir: path.join(projectRoot, '.gemini', 'commands'),
+      };
+    }
   }
 
   // Validate
@@ -486,6 +605,8 @@ if (require.main === module) {
 module.exports = {
   loadConfig,
   getTransformer,
+  transformPrimaryContent,
+  isPathInside,
   syncIde,
   commandSync,
   commandValidate,