sinapse-ai 1.7.0 → 1.9.0

package/.sinapse-ai/product/templates/tmpl-view-materialized.sql

@@ -1,134 +1,134 @@
--- Materialized View Template
--- View: :view_name
--- Created: :created_date
--- Author: :author
--- Description: :description
---
--- Materialized views cache query results for performance
--- IMPORTANT: Data is not live - must be refreshed periodically
-
--- =============================================================================
--- BASIC MATERIALIZED VIEW
--- =============================================================================
-
--- Drop existing view if exists
-DROP MATERIALIZED VIEW IF EXISTS :view_name CASCADE;
-
--- Create materialized view
-CREATE MATERIALIZED VIEW :view_name AS
-SELECT
-    t.id,
-    t.name,
-    t.category,
-    t.created_at,
-    -- Aggregations
-    COUNT(r.id) AS related_count,
-    SUM(r.amount) AS total_amount,
-    AVG(r.rating) AS avg_rating,
-    -- Computed columns
-    CASE
-        WHEN t.status = 'active' THEN true
-        ELSE false
-    END AS is_active
-FROM :base_table t
-LEFT JOIN :related_table r ON r.parent_id = t.id
-WHERE t.deleted_at IS NULL
-GROUP BY t.id, t.name, t.category, t.created_at, t.status
--- Store data sorted for efficient access
-WITH DATA;
-
--- =============================================================================
--- INDEXES ON MATERIALIZED VIEW
--- =============================================================================
-
--- Unique index (required for CONCURRENT refresh)
-CREATE UNIQUE INDEX IF NOT EXISTS idx_:view_name_id
-ON :view_name (id);
-
--- Additional indexes for common queries
-CREATE INDEX IF NOT EXISTS idx_:view_name_category
-ON :view_name (category);
-
-CREATE INDEX IF NOT EXISTS idx_:view_name_created_at
-ON :view_name (created_at DESC);
-
--- =============================================================================
--- REFRESH FUNCTION
--- =============================================================================
-
--- Function to refresh the materialized view
-CREATE OR REPLACE FUNCTION refresh_:view_name()
-RETURNS void
-LANGUAGE plpgsql
-SECURITY DEFINER
-AS $$
-BEGIN
-    -- CONCURRENTLY allows queries during refresh (requires unique index)
-    REFRESH MATERIALIZED VIEW CONCURRENTLY :view_name;
-
-    -- Log refresh
-    RAISE NOTICE 'Materialized view :view_name refreshed at %', NOW();
-END;
-$$;
-
--- Grant execute to service role (for scheduled refresh)
-GRANT EXECUTE ON FUNCTION refresh_:view_name() TO service_role;
-
--- =============================================================================
--- SCHEDULED REFRESH (pg_cron)
--- =============================================================================
---
--- If using pg_cron extension (available in Supabase):
---
--- Enable extension (one-time, requires superuser)
--- CREATE EXTENSION IF NOT EXISTS pg_cron;
---
--- Schedule refresh every hour
--- SELECT cron.schedule(
---     'refresh-:view_name',
---     '0 * * * *',  -- Every hour at minute 0
---     $$SELECT refresh_:view_name()$$
--- );
---
--- To remove schedule:
--- SELECT cron.unschedule('refresh-:view_name');
-
--- =============================================================================
--- TRIGGER-BASED REFRESH (Alternative)
--- =============================================================================
-
--- Refresh when base table changes (use with caution - can be slow)
--- CREATE OR REPLACE FUNCTION refresh_:view_name_trigger()
--- RETURNS TRIGGER AS $$
--- BEGIN
---     REFRESH MATERIALIZED VIEW CONCURRENTLY :view_name;
---     RETURN NULL;
--- END;
--- $$ LANGUAGE plpgsql;
---
--- CREATE TRIGGER trigger_refresh_:view_name
--- AFTER INSERT OR UPDATE OR DELETE ON :base_table
--- FOR EACH STATEMENT
--- EXECUTE FUNCTION refresh_:view_name_trigger();
-
--- =============================================================================
--- VIEW METADATA
--- =============================================================================
-
-COMMENT ON MATERIALIZED VIEW :view_name IS ':description. Refresh: hourly or on-demand.';
-
--- =============================================================================
--- USAGE
--- =============================================================================
---
--- Query the view (cached data, very fast):
--- SELECT * FROM :view_name WHERE category = 'example';
---
--- Manual refresh (use during low-traffic periods):
--- REFRESH MATERIALIZED VIEW CONCURRENTLY :view_name;
--- OR
--- SELECT refresh_:view_name();
---
--- Check last refresh time (approximate):
--- SELECT pg_stat_get_last_analyze_time(':view_name'::regclass);
-
+-- Materialized View Template
+-- View: :view_name
+-- Created: :created_date
+-- Author: :author
+-- Description: :description
+--
+-- Materialized views cache query results for performance
+-- IMPORTANT: Data is not live - must be refreshed periodically
+
+-- =============================================================================
+-- BASIC MATERIALIZED VIEW
+-- =============================================================================
+
+-- Drop existing view if exists
+DROP MATERIALIZED VIEW IF EXISTS :view_name CASCADE;
+
+-- Create materialized view
+CREATE MATERIALIZED VIEW :view_name AS
+SELECT
+    t.id,
+    t.name,
+    t.category,
+    t.created_at,
+    -- Aggregations
+    COUNT(r.id) AS related_count,
+    SUM(r.amount) AS total_amount,
+    AVG(r.rating) AS avg_rating,
+    -- Computed columns
+    CASE
+        WHEN t.status = 'active' THEN true
+        ELSE false
+    END AS is_active
+FROM :base_table t
+LEFT JOIN :related_table r ON r.parent_id = t.id
+WHERE t.deleted_at IS NULL
+GROUP BY t.id, t.name, t.category, t.created_at, t.status
+-- Store data sorted for efficient access
+WITH DATA;
+
+-- =============================================================================
+-- INDEXES ON MATERIALIZED VIEW
+-- =============================================================================
+
+-- Unique index (required for CONCURRENT refresh)
+CREATE UNIQUE INDEX IF NOT EXISTS idx_:view_name_id
+ON :view_name (id);
+
+-- Additional indexes for common queries
+CREATE INDEX IF NOT EXISTS idx_:view_name_category
+ON :view_name (category);
+
+CREATE INDEX IF NOT EXISTS idx_:view_name_created_at
+ON :view_name (created_at DESC);
+
+-- =============================================================================
+-- REFRESH FUNCTION
+-- =============================================================================
+
+-- Function to refresh the materialized view
+CREATE OR REPLACE FUNCTION refresh_:view_name()
+RETURNS void
+LANGUAGE plpgsql
+SECURITY DEFINER
+AS $$
+BEGIN
+    -- CONCURRENTLY allows queries during refresh (requires unique index)
+    REFRESH MATERIALIZED VIEW CONCURRENTLY :view_name;
+
+    -- Log refresh
+    RAISE NOTICE 'Materialized view :view_name refreshed at %', NOW();
+END;
+$$;
+
+-- Grant execute to service role (for scheduled refresh)
+GRANT EXECUTE ON FUNCTION refresh_:view_name() TO service_role;
+
+-- =============================================================================
+-- SCHEDULED REFRESH (pg_cron)
+-- =============================================================================
+--
+-- If using pg_cron extension (available in Supabase):
+--
+-- Enable extension (one-time, requires superuser)
+-- CREATE EXTENSION IF NOT EXISTS pg_cron;
+--
+-- Schedule refresh every hour
+-- SELECT cron.schedule(
+--     'refresh-:view_name',
+--     '0 * * * *',  -- Every hour at minute 0
+--     $$SELECT refresh_:view_name()$$
+-- );
+--
+-- To remove schedule:
+-- SELECT cron.unschedule('refresh-:view_name');
+
+-- =============================================================================
+-- TRIGGER-BASED REFRESH (Alternative)
+-- =============================================================================
+
+-- Refresh when base table changes (use with caution - can be slow)
+-- CREATE OR REPLACE FUNCTION refresh_:view_name_trigger()
+-- RETURNS TRIGGER AS $$
+-- BEGIN
+--     REFRESH MATERIALIZED VIEW CONCURRENTLY :view_name;
+--     RETURN NULL;
+-- END;
+-- $$ LANGUAGE plpgsql;
+--
+-- CREATE TRIGGER trigger_refresh_:view_name
+-- AFTER INSERT OR UPDATE OR DELETE ON :base_table
+-- FOR EACH STATEMENT
+-- EXECUTE FUNCTION refresh_:view_name_trigger();
+
+-- =============================================================================
+-- VIEW METADATA
+-- =============================================================================
+
+COMMENT ON MATERIALIZED VIEW :view_name IS ':description. Refresh: hourly or on-demand.';
+
+-- =============================================================================
+-- USAGE
+-- =============================================================================
+--
+-- Query the view (cached data, very fast):
+-- SELECT * FROM :view_name WHERE category = 'example';
+--
+-- Manual refresh (use during low-traffic periods):
+-- REFRESH MATERIALIZED VIEW CONCURRENTLY :view_name;
+-- OR
+-- SELECT refresh_:view_name();
+--
+-- Check last refresh time (approximate):
+-- SELECT pg_stat_get_last_analyze_time(':view_name'::regclass);
+

package/.sinapse-ai/product/templates/tmpl-view.sql

@@ -1,178 +1,178 @@
--- View Template
--- View: :view_name
--- Created: :created_date
--- Author: :author
--- Description: :description
---
--- Views are virtual tables that provide a simplified interface
--- Data is always live (not cached like materialized views)
-
--- =============================================================================
--- BASIC VIEW
--- =============================================================================
-
--- Drop existing view if exists
-DROP VIEW IF EXISTS :view_name CASCADE;
-
--- Create view
-CREATE OR REPLACE VIEW :view_name AS
-SELECT
-    t.id,
-    t.name,
-    t.description,
-    t.status,
-    t.created_at,
-    t.updated_at,
-    -- Related data
-    u.email AS owner_email,
-    u.raw_user_meta_data->>'full_name' AS owner_name,
-    -- Computed columns
-    CASE
-        WHEN t.status = 'active' THEN 'Active'
-        WHEN t.status = 'pending' THEN 'Pending'
-        WHEN t.status = 'archived' THEN 'Archived'
-        ELSE 'Unknown'
-    END AS status_label,
-    -- Age calculation
-    EXTRACT(DAY FROM NOW() - t.created_at) AS days_old
-FROM :base_table t
-LEFT JOIN auth.users u ON u.id = t.user_id
-WHERE t.deleted_at IS NULL;
-
--- =============================================================================
--- VIEW WITH AGGREGATIONS
--- =============================================================================
-
-CREATE OR REPLACE VIEW :view_name_summary AS
-SELECT
-    t.category,
-    COUNT(*) AS total_count,
-    COUNT(*) FILTER (WHERE t.status = 'active') AS active_count,
-    COUNT(*) FILTER (WHERE t.status = 'pending') AS pending_count,
-    MIN(t.created_at) AS earliest,
-    MAX(t.created_at) AS latest,
-    AVG(t.value)::NUMERIC(10,2) AS avg_value
-FROM :base_table t
-WHERE t.deleted_at IS NULL
-GROUP BY t.category;
-
--- =============================================================================
--- VIEW WITH RLS CONSIDERATION
--- =============================================================================
-
--- Views inherit RLS from underlying tables
--- If base table has RLS, view will respect it
---
--- For views that need custom RLS-like behavior,
--- wrap in a SECURITY DEFINER function:
-
-CREATE OR REPLACE FUNCTION get_:view_name_for_user()
-RETURNS TABLE (
-    id UUID,
-    name TEXT,
-    status TEXT,
-    created_at TIMESTAMPTZ
-)
-LANGUAGE plpgsql
-SECURITY INVOKER
-STABLE
-AS $$
-BEGIN
-    RETURN QUERY
-    SELECT
-        v.id,
-        v.name,
-        v.status,
-        v.created_at
-    FROM :view_name v
-    WHERE v.user_id = auth.uid()
-    ORDER BY v.created_at DESC;
-END;
-$$;
-
--- =============================================================================
--- VIEW WITH JOINED DATA
--- =============================================================================
-
-CREATE OR REPLACE VIEW :view_name_detailed AS
-SELECT
-    t.id,
-    t.name,
-    t.status,
-    -- One-to-one relationship
-    d.detail_field,
-    -- One-to-many aggregation
-    (
-        SELECT json_agg(json_build_object(
-            'id', c.id,
-            'name', c.name,
-            'created_at', c.created_at
-        ))
-        FROM :child_table c
-        WHERE c.parent_id = t.id
-    ) AS children,
-    -- Count
-    (
-        SELECT COUNT(*)
-        FROM :child_table c
-        WHERE c.parent_id = t.id
-    ) AS children_count,
-    t.created_at,
-    t.updated_at
-FROM :base_table t
-LEFT JOIN :detail_table d ON d.id = t.detail_id
-WHERE t.deleted_at IS NULL;
-
--- =============================================================================
--- UPDATEABLE VIEW (with INSTEAD OF triggers)
--- =============================================================================
-
--- Simple updateable view (for basic cases)
-CREATE OR REPLACE VIEW :view_name_editable AS
-SELECT
-    id,
-    name,
-    description,
-    status,
-    updated_at
-FROM :base_table
-WHERE deleted_at IS NULL;
-
--- Make it updateable via trigger
-CREATE OR REPLACE FUNCTION :view_name_editable_update()
-RETURNS TRIGGER AS $$
-BEGIN
-    UPDATE :base_table
-    SET
-        name = NEW.name,
-        description = NEW.description,
-        status = NEW.status,
-        updated_at = NOW()
-    WHERE id = NEW.id
-    AND user_id = auth.uid();  -- RLS check
-
-    RETURN NEW;
-END;
-$$ LANGUAGE plpgsql SECURITY DEFINER;
-
-CREATE TRIGGER trigger_:view_name_editable_update
-INSTEAD OF UPDATE ON :view_name_editable
-FOR EACH ROW
-EXECUTE FUNCTION :view_name_editable_update();
-
--- =============================================================================
--- VIEW METADATA
--- =============================================================================
-
-COMMENT ON VIEW :view_name IS ':description';
-
--- =============================================================================
--- PERMISSIONS
--- =============================================================================
-
--- Grant SELECT on view (inherits base table RLS)
-GRANT SELECT ON :view_name TO authenticated;
-
--- For updateable views, also grant UPDATE
--- GRANT UPDATE ON :view_name_editable TO authenticated;
-
+-- View Template
+-- View: :view_name
+-- Created: :created_date
+-- Author: :author
+-- Description: :description
+--
+-- Views are virtual tables that provide a simplified interface
+-- Data is always live (not cached like materialized views)
+
+-- =============================================================================
+-- BASIC VIEW
+-- =============================================================================
+
+-- Drop existing view if exists
+DROP VIEW IF EXISTS :view_name CASCADE;
+
+-- Create view
+CREATE OR REPLACE VIEW :view_name AS
+SELECT
+    t.id,
+    t.name,
+    t.description,
+    t.status,
+    t.created_at,
+    t.updated_at,
+    -- Related data
+    u.email AS owner_email,
+    u.raw_user_meta_data->>'full_name' AS owner_name,
+    -- Computed columns
+    CASE
+        WHEN t.status = 'active' THEN 'Active'
+        WHEN t.status = 'pending' THEN 'Pending'
+        WHEN t.status = 'archived' THEN 'Archived'
+        ELSE 'Unknown'
+    END AS status_label,
+    -- Age calculation
+    EXTRACT(DAY FROM NOW() - t.created_at) AS days_old
+FROM :base_table t
+LEFT JOIN auth.users u ON u.id = t.user_id
+WHERE t.deleted_at IS NULL;
+
+-- =============================================================================
+-- VIEW WITH AGGREGATIONS
+-- =============================================================================
+
+CREATE OR REPLACE VIEW :view_name_summary AS
+SELECT
+    t.category,
+    COUNT(*) AS total_count,
+    COUNT(*) FILTER (WHERE t.status = 'active') AS active_count,
+    COUNT(*) FILTER (WHERE t.status = 'pending') AS pending_count,
+    MIN(t.created_at) AS earliest,
+    MAX(t.created_at) AS latest,
+    AVG(t.value)::NUMERIC(10,2) AS avg_value
+FROM :base_table t
+WHERE t.deleted_at IS NULL
+GROUP BY t.category;
+
+-- =============================================================================
+-- VIEW WITH RLS CONSIDERATION
+-- =============================================================================
+
+-- Views inherit RLS from underlying tables
+-- If base table has RLS, view will respect it
+--
+-- For views that need custom RLS-like behavior,
+-- wrap in a SECURITY DEFINER function:
+
+CREATE OR REPLACE FUNCTION get_:view_name_for_user()
+RETURNS TABLE (
+    id UUID,
+    name TEXT,
+    status TEXT,
+    created_at TIMESTAMPTZ
+)
+LANGUAGE plpgsql
+SECURITY INVOKER
+STABLE
+AS $$
+BEGIN
+    RETURN QUERY
+    SELECT
+        v.id,
+        v.name,
+        v.status,
+        v.created_at
+    FROM :view_name v
+    WHERE v.user_id = auth.uid()
+    ORDER BY v.created_at DESC;
+END;
+$$;
+
+-- =============================================================================
+-- VIEW WITH JOINED DATA
+-- =============================================================================
+
+CREATE OR REPLACE VIEW :view_name_detailed AS
+SELECT
+    t.id,
+    t.name,
+    t.status,
+    -- One-to-one relationship
+    d.detail_field,
+    -- One-to-many aggregation
+    (
+        SELECT json_agg(json_build_object(
+            'id', c.id,
+            'name', c.name,
+            'created_at', c.created_at
+        ))
+        FROM :child_table c
+        WHERE c.parent_id = t.id
+    ) AS children,
+    -- Count
+    (
+        SELECT COUNT(*)
+        FROM :child_table c
+        WHERE c.parent_id = t.id
+    ) AS children_count,
+    t.created_at,
+    t.updated_at
+FROM :base_table t
+LEFT JOIN :detail_table d ON d.id = t.detail_id
+WHERE t.deleted_at IS NULL;
+
+-- =============================================================================
+-- UPDATEABLE VIEW (with INSTEAD OF triggers)
+-- =============================================================================
+
+-- Simple updateable view (for basic cases)
+CREATE OR REPLACE VIEW :view_name_editable AS
+SELECT
+    id,
+    name,
+    description,
+    status,
+    updated_at
+FROM :base_table
+WHERE deleted_at IS NULL;
+
+-- Make it updateable via trigger
+CREATE OR REPLACE FUNCTION :view_name_editable_update()
+RETURNS TRIGGER AS $$
+BEGIN
+    UPDATE :base_table
+    SET
+        name = NEW.name,
+        description = NEW.description,
+        status = NEW.status,
+        updated_at = NOW()
+    WHERE id = NEW.id
+    AND user_id = auth.uid();  -- RLS check
+
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER;
+
+CREATE TRIGGER trigger_:view_name_editable_update
+INSTEAD OF UPDATE ON :view_name_editable
+FOR EACH ROW
+EXECUTE FUNCTION :view_name_editable_update();
+
+-- =============================================================================
+-- VIEW METADATA
+-- =============================================================================
+
+COMMENT ON VIEW :view_name IS ':description';
+
+-- =============================================================================
+-- PERMISSIONS
+-- =============================================================================
+
+-- Grant SELECT on view (inherits base table RLS)
+GRANT SELECT ON :view_name TO authenticated;
+
+-- For updateable views, also grant UPDATE
+-- GRANT UPDATE ON :view_name_editable TO authenticated;
+

package/.sinapse-ai/scripts/pm.sh

@@ -381,24 +381,36 @@ spawn_terminal() {
   # Add agent activation
   agent_cmd="${agent_cmd} --print-only"  # Just for testing, real impl would use actual claude flags
 
+  # SECURITY (SHELL-INJECTION-PM-SH): AGENT/TASK/PARAMS/CONTEXT_FILE come from
+  # CLI args and are interpolated into a command string run by a shell in the
+  # spawned terminal. Escape every interpolated value with `printf %q` so shell
+  # metacharacters (`;`, `$()`, backticks, quotes) cannot break out and execute.
+  local q_agent q_task q_params q_context q_output q_lock
+  printf -v q_agent '%q' "$AGENT"
+  printf -v q_task '%q' "$TASK"
+  printf -v q_params '%q' "$PARAMS"
+  printf -v q_context '%q' "$CONTEXT_FILE"
+  printf -v q_output '%q' "$OUTPUT_FILE"
+  printf -v q_lock '%q' "$LOCK_FILE"
+
   # For now, we'll create a simpler command that demonstrates the concept
   # The actual claude CLI integration will depend on how claude accepts agent/task args
   local full_cmd="echo '=== SINAPSE Agent Session ===' && "
-  full_cmd+="echo 'Agent: ${AGENT}' && "
-  full_cmd+="echo 'Task: ${TASK}' && "
-  [[ -n "$PARAMS" ]] && full_cmd+="echo 'Params: ${PARAMS}' && "
-  [[ -n "$CONTEXT_FILE" ]] && full_cmd+="echo 'Context: ${CONTEXT_FILE}' && "
+  full_cmd+="echo Agent: ${q_agent} && "
+  full_cmd+="echo Task: ${q_task} && "
+  [[ -n "$PARAMS" ]] && full_cmd+="echo Params: ${q_params} && "
+  [[ -n "$CONTEXT_FILE" ]] && full_cmd+="echo Context: ${q_context} && "
   full_cmd+="echo '' && "
 
   # Actual execution would be something like:
   # full_cmd+="${CLAUDE_CMD} @${AGENT} *${TASK} ${PARAMS}"
   # For now, simulate the output
-  full_cmd+="echo 'Executing: @${AGENT} *${TASK} ${PARAMS}' && "
+  full_cmd+="echo Executing: @${q_agent} '*'${q_task} ${q_params} && "
   full_cmd+="echo 'Agent execution would happen here...' && "
   full_cmd+="echo '=== Session Complete ===' "
 
   # Redirect output to file and remove lock when done
-  full_cmd+=" > '${OUTPUT_FILE}' 2>&1; rm -f '${LOCK_FILE}'"
+  full_cmd+=" > ${q_output} 2>&1; rm -f ${q_lock}"
 
   # Spawn based on OS
   case "$os" in