sinapse-ai 1.8.0 → 1.9.1

package/.sinapse-ai/core/doctor/checks/git-hooks.js

@@ -1,55 +1,199 @@
 /**
  * Doctor Check: Git Hooks
  *
- * Validates .husky/pre-commit and .husky/pre-push exist.
+ * Validates that the ACTIVE git hook system is wired and populated. The single
+ * IDE-agnostic security backstop is the managed `core.hooksPath` directory
+ * (`.sinapse-ai/git-hooks/`) containing a `pre-commit` guard. A common failure
+ * mode (the one this check exists to catch): `core.hooksPath` points at
+ * `.sinapse-ai/git-hooks` but that directory is EMPTY/MISSING — so every guard
+ * is silently INERT and secrets/destructive SQL pass at commit time.
+ *
+ * Beyond mere existence, this check also confirms the guard is PLAUSIBLE rather
+ * than a hollow shell:
+ *   1. core.hooksPath actually RESOLVES to the managed dir (.sinapse-ai/git-hooks).
+ *      A hooksPath pointing somewhere else means the framework backstop is not the
+ *      active hook system, even if some pre-commit exists there.
+ *   2. The pre-commit (and any present pre-push) guard is NON-EMPTY. A zero-byte /
+ *      whitespace-only hook file passes existsSync but runs nothing — the same
+ *      INERT trap with a file present to disguise it.
+ *
+ * Verdicts:
+ *   - FAIL: core.hooksPath is set but the dir is missing, has no pre-commit, the
+ *           pre-commit is empty, OR hooksPath resolves outside the managed dir
+ *           (the inert-trap states — security off without anyone noticing).
+ *   - WARN: no core.hooksPath set and no .husky fallback (hooks not installed),
+ *           or pre-push present-but-empty / missing.
+ *   - PASS: managed hooksPath populated with a non-empty pre-commit (and ideally
+ *           pre-push), OR a husky fallback with the expected hooks exists.
  *
  * @module sinapse-ai/doctor/checks/git-hooks
- * @story INS-4.1
+ * @story INS-4.1, E8-SECURITY
  */
 
 const path = require('path');
 const fs = require('fs');
+const { execFileSync } = require('child_process');
 
 const name = 'git-hooks';
 
-const EXPECTED_HOOKS = ['pre-commit', 'pre-push'];
+const MANAGED_HOOKS_DIR = path.join('.sinapse-ai', 'git-hooks');
+const EXPECTED_MANAGED = ['pre-commit', 'pre-push'];
+const EXPECTED_HUSKY = ['pre-commit', 'pre-push'];
+
+/**
+ * Read core.hooksPath from git config (null if unset / not a repo).
+ * @param {string} projectRoot
+ * @returns {string|null}
+ */
+function readHooksPath(projectRoot) {
+  try {
+    const out = execFileSync('git', ['-C', projectRoot, 'config', '--get', 'core.hooksPath'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+    return out || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * True when a hook file exists AND carries real (non-whitespace) content.
+ * A zero-byte / blank hook passes existsSync but executes nothing — the same
+ * INERT trap with a file present to disguise it.
+ * @param {string} hookFile absolute path
+ * @returns {boolean}
+ */
+function hasContent(hookFile) {
+  try {
+    return fs.readFileSync(hookFile, 'utf8').trim().length > 0;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * True when the configured hooksPath resolves to the managed git-hooks dir
+ * (.sinapse-ai/git-hooks), regardless of whether it was given as a relative or
+ * absolute path. If it points elsewhere, the framework backstop is not the
+ * active hook system even if some pre-commit happens to exist there.
+ * @param {string} projectRoot
+ * @param {string} hooksPath value from core.hooksPath
+ * @returns {boolean}
+ */
+function resolvesToManaged(projectRoot, hooksPath) {
+  const resolved = path.resolve(projectRoot, hooksPath);
+  const managed = path.resolve(projectRoot, MANAGED_HOOKS_DIR);
+  return resolved === managed;
+}
 
 async function run(context) {
-  const huskyDir = path.join(context.projectRoot, '.husky');
+  const projectRoot = context.projectRoot;
+  const hooksPath = readHooksPath(projectRoot);
 
-  if (!fs.existsSync(huskyDir)) {
+  // --- Case 1: core.hooksPath is configured -> it MUST be populated ---------
+  if (hooksPath) {
+    const hooksDirAbs = path.resolve(projectRoot, hooksPath);
+    const preCommit = path.join(hooksDirAbs, 'pre-commit');
+
+    if (!fs.existsSync(hooksDirAbs)) {
+      return {
+        check: name,
+        status: 'FAIL',
+        message: `core.hooksPath -> "${hooksPath}" but that directory is MISSING. Git guards are INERT (secret-scan/SQL/boundary do not run). Run the installer to populate it.`,
+        fixCommand: 'sinapse init   # repopulates .sinapse-ai/git-hooks and re-wires core.hooksPath',
+      };
+    }
+
+    // hooksPath points at a real dir, but does it point at OUR managed dir? If it
+    // resolves elsewhere, the framework backstop is not the active hook system.
+    if (!resolvesToManaged(projectRoot, hooksPath)) {
+      return {
+        check: name,
+        status: 'FAIL',
+        message: `core.hooksPath -> "${hooksPath}" resolves OUTSIDE the managed dir (${MANAGED_HOOKS_DIR}). The framework's secret-scan/SQL/boundary guards are not the active hook system. Re-wire core.hooksPath to the managed dir.`,
+        fixCommand: 'sinapse init   # re-wires core.hooksPath to .sinapse-ai/git-hooks',
+      };
+    }
+
+    if (!fs.existsSync(preCommit)) {
+      return {
+        check: name,
+        status: 'FAIL',
+        message: `core.hooksPath -> "${hooksPath}" exists but has NO pre-commit guard. The secret-scan backstop is INERT.`,
+        fixCommand: 'sinapse init   # regenerates the managed pre-commit guard',
+      };
+    }
+
+    // pre-commit exists but is empty/whitespace -> runs nothing -> still INERT.
+    if (!hasContent(preCommit)) {
+      return {
+        check: name,
+        status: 'FAIL',
+        message: `core.hooksPath -> "${hooksPath}" has a pre-commit file but it is EMPTY. The guard executes nothing — secret-scan/SQL/boundary are INERT despite the file being present.`,
+        fixCommand: 'sinapse init   # regenerates the managed pre-commit guard',
+      };
+    }
+
+    // Populated with a plausible (non-empty) pre-commit. Report present hooks,
+    // treating a present-but-empty hook as missing (it does nothing).
+    const present = EXPECTED_MANAGED.filter(
+      (h) => fs.existsSync(path.join(hooksDirAbs, h)) && hasContent(path.join(hooksDirAbs, h)),
+    );
+    const missing = EXPECTED_MANAGED.filter((h) => !present.includes(h));
+
+    if (missing.length === 0) {
+      return {
+        check: name,
+        status: 'PASS',
+        message: `managed git guards active at ${hooksPath} (${present.join(' + ')})`,
+        fixCommand: null,
+      };
+    }
+
+    // pre-commit present and non-empty (security backstop active) but pre-push
+    // missing or empty -> WARN.
     return {
       check: name,
       status: 'WARN',
-      message: '.husky directory not found',
-      fixCommand: 'npx husky init',
+      message: `managed pre-commit active at ${hooksPath}; missing/empty: ${missing.join(', ')}`,
+      fixCommand: 'sinapse init   # writes the missing managed hook(s)',
     };
   }
 
-  const missing = EXPECTED_HOOKS.filter(
-    (hook) => !fs.existsSync(path.join(huskyDir, hook)),
-  );
+  // --- Case 2: no core.hooksPath -> fall back to husky detection ------------
+  const huskyDir = path.join(projectRoot, '.husky');
+  if (!fs.existsSync(huskyDir)) {
+    return {
+      check: name,
+      status: 'FAIL',
+      message: 'No git hook system active: core.hooksPath is unset and .husky/ is absent. Commit-time guards (secret-scan/SQL/boundary) do not run.',
+      fixCommand: 'sinapse init   # installs the managed git guards',
+    };
+  }
 
-  if (missing.length === 0) {
+  const missingHusky = EXPECTED_HUSKY.filter((h) => !fs.existsSync(path.join(huskyDir, h)));
+  if (missingHusky.length === 0) {
     return {
       check: name,
-      status: 'PASS',
-      message: `${EXPECTED_HOOKS.join(' + ')} installed`,
-      fixCommand: null,
+      status: 'WARN',
+      message: 'husky hooks present but core.hooksPath is not set to the managed dir — the framework backstop is not the active hook system. Run the installer to consolidate.',
+      fixCommand: 'sinapse init   # consolidates onto .sinapse-ai/git-hooks via core.hooksPath',
     };
   }
 
   return {
     check: name,
     status: 'WARN',
-    message: `Missing hooks: ${missing.join(', ')}`,
-    fixCommand: 'npx husky init',
+    message: `husky present but missing hooks: ${missingHusky.join(', ')}; managed core.hooksPath not set.`,
+    fixCommand: 'sinapse init',
   };
 }
 
-// Story A.3: git hooks rely on a git repo + husky install. Neither is
-// guaranteed on a fresh global install, so exceptions are treated as WARN.
+// E8-SECURITY: a missing/inert hook dir is now a hard FAIL (the whole point of
+// this check is to catch the silent-INERT trap). But on a fresh global install
+// with no git repo at all, readHooksPath() returns null and we fall to the
+// husky branch; to avoid a false alarm there, thrown exceptions stay WARN.
 const onError = 'warn';
 
 module.exports = { name, run, onError };
-

package/.sinapse-ai/core/events/dashboard-emitter.js

@@ -1,14 +1,20 @@
 /**
  * Dashboard Event Emitter
  *
- * Singleton that emits high-level events to the monitor-server
- * for real-time dashboard observability.
+ * Singleton for high-level orchestration events (agent activation, command
+ * lifecycle, story status, Bob phases). Kept as a stable API consumed by the
+ * orchestrator (dashboard-integration.js, bob-orchestrator.js).
  *
- * Features:
- * - Non-blocking HTTP POST to monitor-server
- * - 500ms timeout (never blocks CLI)
- * - Silent failure with fallback to file
- * - Lazy initialization
+ * Transport status:
+ * - The legacy web monitor server (POST http://localhost:4001/events) was
+ *   ARCHIVED (16/06/2026, Etapa 7 / decisão D6). That server never shipped in
+ *   this repo, so emit() is a SAFE NO-OP by default — it never opens a socket.
+ * - The full event API (emit + emitXxx helpers) is preserved 1:1 so existing
+ *   importers keep working without changes.
+ * - To opt back in to an HTTP sink later, set SINAPSE_MONITOR_URL in the env.
+ *   When set, events POST to that URL (non-blocking, 500ms timeout, silent
+ *   fail, fallback to a local .jsonl file). When unset (the normal case), the
+ *   emitter does nothing — no network, no file writes.
  *
  * @module core/events/dashboard-emitter
  */
@@ -18,7 +24,9 @@ const fs = require('fs-extra');
 const path = require('path');
 const { DashboardEventType } = require('./types');
 
-const MONITOR_SERVER_URL = process.env.SINAPSE_MONITOR_URL || 'http://localhost:4001/events';
+// No default endpoint: the web monitor was archived. The emitter only attempts
+// a POST when SINAPSE_MONITOR_URL is explicitly provided. null => fail-silent no-op.
+const MONITOR_SERVER_URL = process.env.SINAPSE_MONITOR_URL || null;
 const EMIT_TIMEOUT_MS = 500;
 
 /**
@@ -93,6 +101,13 @@ class DashboardEmitter {
   async emit(type, data = {}) {
     if (!this.enabled) return;
 
+    // Web monitor archived (Etapa 7 / D6): with no sink configured, emit() is a
+    // safe no-op. Build nothing, open no sockets, write no files. Opt back in by
+    // setting SINAPSE_MONITOR_URL. This keeps the public API identical for all
+    // callers (dashboard-integration.js, bob-orchestrator.js, tests) while
+    // killing the dead POST to localhost:4001.
+    if (!MONITOR_SERVER_URL) return;
+
     const event = {
       id: randomUUID(),
       type,
@@ -303,11 +318,17 @@ class DashboardEmitter {
   }
 
   /**
-   * POST event to monitor-server with timeout
+   * POST event to an external sink with timeout.
+   * No-op when SINAPSE_MONITOR_URL is unset (the archived web monitor case) —
+   * never opens a socket. Only runs when an endpoint is explicitly configured.
    * @private
    * @param {Object} event
    */
   async _postEvent(event) {
+    // Defense-in-depth: emit() already short-circuits, but guard here too so a
+    // direct call can't resurrect the dead localhost:4001 POST.
+    if (!MONITOR_SERVER_URL) return;
+
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), EMIT_TIMEOUT_MS);
 

package/.sinapse-ai/core/execution/subagent-dispatcher.js

@@ -12,7 +12,7 @@ const EventEmitter = require('events');
 const _path = require('path');
 const { runSafe } = require('../utils/spawn-safe');
 
-// epic: orchestration-consolidation, F2 — resolves any of the 189 agent ids to
+// epic: orchestration-consolidation, F2 — resolves any of the 172 agent ids to
 // its real persona on disk (squads/ + framework agents). Optional: degrades to a
 // generic prompt if the module is missing.
 let SquadAgentResolver;

package/.sinapse-ai/core/synapse/engine.js

@@ -222,6 +222,13 @@ class SynapseEngine {
    * @param {object} [config={}] - Configuration from manifest / caller
    * @param {object} [config.manifest] - Parsed manifest object
    * @param {boolean} [config.devmode] - Enable DEVMODE debug output
+   * @param {Array<object>} [config.layers] - Optional pre-instantiated layer
+   *   instances (dependency injection). When provided, these are used verbatim
+   *   instead of loading + instantiating the L0-L7 modules from disk. Each
+   *   instance must expose `name`, `layer`, and `_safeProcess(context)`. This is
+   *   the seam used by tests to inject isolated mock layers without relying on
+   *   `jest.mock` hoisting or module-cache state. Production never passes this,
+   *   so default behavior is unchanged.
    */
   constructor(synapsePath, config = {}) {
     this.synapsePath = synapsePath;
@@ -233,6 +240,14 @@ class SynapseEngine {
     /** @type {MemoryBridge} Feature-gated MIS consumer (SYN-10) */
     this.memoryBridge = new MemoryBridge();
 
+    // Dependency injection seam: when caller supplies ready layer instances,
+    // use them directly and skip module loading entirely (production default
+    // = no config.layers → identical behavior to before).
+    if (Array.isArray(config.layers)) {
+      this.layers = config.layers.filter(Boolean);
+      return;
+    }
+
     for (const mod of LAYER_MODULES) {
       const LayerClass = loadLayerModule(mod.path);
       if (LayerClass) {

package/.sinapse-ai/core/ui/observability-panel.js

@@ -19,8 +19,50 @@
 
 'use strict';
 
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
 const { PanelRenderer } = require('./panel-renderer');
 
+/**
+ * TTL (seconds) for session-cache entries. Mirrors the read-side contract
+ * shared with the statusline/panel: imperator/specialists older than this
+ * are treated as inactive. 6 hours.
+ * @constant {number}
+ */
+const SESSION_CACHE_TTL_SECONDS = 21600;
+
+/**
+ * Stable 32-bit string hash. MUST stay byte-identical to the implementation
+ * in track-agent.sh and statusline-script.js so all peers resolve the same
+ * per-cwd session-cache file.
+ * @param {string} str - Input string (typically process.cwd()).
+ * @returns {string} Hex hash.
+ */
+function simpleHash(str) {
+  let hash = 0;
+  for (let i = 0; i < str.length; i++) {
+    const char = str.charCodeAt(i);
+    hash = ((hash << 5) - hash) + char;
+    hash |= 0;
+  }
+  return Math.abs(hash).toString(16);
+}
+
+/**
+ * Reads + parses a JSON file, returning null on any failure (fail-open).
+ * @param {string} filePath - Absolute path to the JSON file.
+ * @returns {Object|null} Parsed object or null.
+ */
+function readJsonSafe(filePath) {
+  try {
+    if (!fs.existsSync(filePath)) return null;
+    return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Panel modes
  * @enum {string}
@@ -374,6 +416,202 @@ class ObservabilityPanel {
       ? this.renderer.renderDetailed(this.state)
       : this.renderer.renderMinimal(this.state);
   }
+
+  /**
+   * Live-watches the runtime status sources and drives a panel from them.
+   *
+   * Decision D2 (MERGE): on every tick it reads BOTH the Bob dashboard status
+   * file and the per-cwd session-cache, then maps whichever describes an
+   * active orchestration:
+   *   - If `bob.orchestration.active` → Bob owns the panel (pipeline,
+   *     current_agent, active_terminals from the dashboard).
+   *   - Otherwise → the session-cache drives it (imperator → coordinator,
+   *     TTL-filtered specialists → active terminals).
+   * D7 populates light, state-aware `next_steps` suggestions.
+   *
+   * Reuses the existing render/start/stop loop — it does NOT spin its own
+   * setInterval. Fail-open: any read/parse error leaves prior state intact.
+   *
+   * @param {string} projectRoot - Project root used to locate bob-status.json.
+   * @param {Object} [opts] - Options.
+   * @param {number} [opts.refreshRate=1000] - Refresh interval in ms.
+   * @returns {{ stop: function(): void, panel: ObservabilityPanel }} Handle.
+   */
+  static watchFromStatusFile(projectRoot, { refreshRate = 1000 } = {}) {
+    const panel = new ObservabilityPanel({ refreshRate });
+
+    const bobStatusPath = path.join(
+      projectRoot || process.cwd(),
+      '.sinapse',
+      'dashboard',
+      'bob-status.json',
+    );
+    const sessionCachePath = path.join(
+      os.homedir(),
+      '.claude',
+      'session-cache',
+      `${simpleHash(process.cwd())}.json`,
+    );
+
+    const tick = () => {
+      try {
+        const updates = ObservabilityPanel._buildUpdatesFromSources(
+          bobStatusPath,
+          sessionCachePath,
+        );
+        if (updates) panel.updateState(updates);
+      } catch {
+        // Fail-open: keep last good state.
+      }
+    };
+
+    // Prime once before the loop so the first frame reflects current state.
+    tick();
+    panel.start();
+
+    // Reuse the panel's render loop for tick() too — no second setInterval.
+    const watchInterval = setInterval(tick, refreshRate);
+
+    return {
+      panel,
+      stop() {
+        clearInterval(watchInterval);
+        panel.stop();
+      },
+    };
+  }
+
+  /**
+   * Pure mapper: reads both status sources and returns an updateState() patch.
+   * Bob wins when its orchestration is active (D2 MERGE), else session-cache.
+   *
+   * @param {string} bobStatusPath - Absolute path to bob-status.json.
+   * @param {string} sessionCachePath - Absolute path to the session-cache.
+   * @returns {Object|null} updateState patch, or null when nothing to apply.
+   * @private
+   */
+  static _buildUpdatesFromSources(bobStatusPath, sessionCachePath) {
+    const bob = readJsonSafe(bobStatusPath);
+    const cache = readJsonSafe(sessionCachePath);
+
+    if (bob && bob.orchestration && bob.orchestration.active) {
+      return ObservabilityPanel._mapBob(bob);
+    }
+    return ObservabilityPanel._mapSessionCache(cache);
+  }
+
+  /**
+   * Maps a Bob dashboard status object to an updateState() patch.
+   * @param {Object} bob - Parsed bob-status.json.
+   * @returns {Object} updateState patch.
+   * @private
+   */
+  static _mapBob(bob) {
+    const updates = {};
+
+    if (bob.pipeline) {
+      updates.pipeline = bob.pipeline;
+    }
+
+    if (bob.current_agent) {
+      updates.current_agent = bob.current_agent;
+    }
+
+    const terminals = bob.active_terminals;
+    if (terminals) {
+      const list = Array.isArray(terminals.list)
+        ? terminals.list
+        : (Array.isArray(terminals) ? terminals : []);
+      updates.active_terminals = {
+        list,
+        count: typeof terminals.count === 'number' ? terminals.count : list.length,
+      };
+    }
+
+    updates.next_steps = ObservabilityPanel._suggestNextSteps({
+      imperatorActive: false,
+      specialistNames: (updates.active_terminals?.list || []).map(
+        (t) => t.agent || t.id || t.label,
+      ).filter(Boolean),
+      bobActive: true,
+    });
+
+    return updates;
+  }
+
+  /**
+   * Maps a per-cwd session-cache object to an updateState() patch.
+   * imperator.active → coordinator; TTL-filtered specialists → terminals.
+   * @param {Object|null} cache - Parsed session-cache (v2 shape) or null.
+   * @returns {Object} updateState patch.
+   * @private
+   */
+  static _mapSessionCache(cache) {
+    const nowSec = Math.floor(Date.now() / 1000);
+    const updates = {};
+
+    const imperator = cache && cache.imperator;
+    const imperatorActive = !!(
+      imperator
+      && imperator.active
+      && typeof imperator.ts === 'number'
+      && (nowSec - imperator.ts) <= SESSION_CACHE_TTL_SECONDS
+    );
+
+    const specialists = Array.isArray(cache && cache.specialists)
+      ? cache.specialists.filter(
+        (s) => s
+          && typeof s.ts === 'number'
+          && (nowSec - s.ts) <= SESSION_CACHE_TTL_SECONDS,
+      )
+      : [];
+
+    if (imperatorActive) {
+      updates.current_agent = { id: 'coordinator', name: null, task: null, reason: null };
+    } else {
+      updates.current_agent = { id: null, name: null, task: null, reason: null };
+    }
+
+    updates.active_terminals = {
+      list: specialists.map((s) => ({
+        agent: s.label || s.id,
+        pid: null,
+        task: null,
+      })),
+      count: specialists.length,
+    };
+
+    updates.next_steps = ObservabilityPanel._suggestNextSteps({
+      imperatorActive,
+      specialistNames: specialists.map((s) => s.label || s.id).filter(Boolean),
+      bobActive: false,
+    });
+
+    return updates;
+  }
+
+  /**
+   * D7 — derives light, state-aware next-step suggestions.
+   * @param {Object} ctx - State context.
+   * @param {boolean} ctx.imperatorActive - Coordinator is active.
+   * @param {string[]} ctx.specialistNames - Active specialist labels.
+   * @param {boolean} ctx.bobActive - Bob orchestration is active.
+   * @returns {string[]} Suggestions.
+   * @private
+   */
+  static _suggestNextSteps({ imperatorActive, specialistNames = [], bobActive = false }) {
+    if (specialistNames.length > 0) {
+      return ['Especialistas trabalhando: ' + specialistNames.join(', ')];
+    }
+    if (imperatorActive || bobActive) {
+      return ['Coordenador montando o plano'];
+    }
+    return [
+      'Rode os testes',
+      'Crie/valide a story',
+      'Invoque @sinapse para orquestrar',
+    ];
+  }
 }
 
 /**
@@ -391,5 +629,7 @@ module.exports = {
   PanelMode,
   PipelineStage,
   createDefaultState,
+  simpleHash,
+  SESSION_CACHE_TTL_SECONDS,
 };
 

package/.sinapse-ai/core-config.yaml

@@ -306,26 +306,6 @@ ideSync:
       enabled: true
       path: .codex/agents
       format: full-markdown-yaml
-    gemini:
-      enabled: true
-      path: .gemini/rules/SINAPSE/agents
-      format: full-markdown-yaml
-    github-copilot:
-      enabled: true
-      path: .github/agents
-      format: github-copilot
-    cursor:
-      enabled: true
-      path: .cursor/rules/agents
-      format: condensed-rules
-    antigravity:
-      enabled: true
-      path: .antigravity/rules/agents
-      format: cursor-style
-    kimi:
-      enabled: true
-      path: .kimi/skills
-      format: kimi-skill
   redirects: {}
   validation:
     strictMode: true