sinapse-ai 1.9.1 → 1.10.0

package/.sinapse-ai/install-manifest.yaml

@@ -7,7 +7,7 @@
 # - SHA256 hashes for change detection
 # - File types for categorization
 #
-version: 1.9.1
+version: 1.10.0
 generator: scripts/generate-install-manifest.js
 file_count: 1180
 files:

package/AGENTS.md

@@ -23,14 +23,14 @@ These rules are HARD CONSTRAINTS. They apply to every action you take, in any ID
 
 ## Project Context
 
-SINAPSE is a meta-framework that orchestrates AI agents into specialized squads for complex development workflows. It runs inside Claude Code and enforces a formal Constitution with 10 articles governing CLI-first architecture, agent authority, documentation-first development, security, and safe collaboration.
+SINAPSE is a meta-framework that orchestrates AI agents into specialized squads for complex development workflows. It runs inside Claude Code and enforces a formal Constitution with 11 articles governing CLI-first architecture, agent authority, documentation-first development, security, and safe collaboration.
 
 ### Architecture
 
 - **CLI First** -- All intelligence lives in the CLI. Dashboards observe, never control.
 - **4-Layer Boundary** -- L1 (core, immutable) / L2 (templates, extend-only) / L3 (config, mutable) / L4 (runtime, always modify).
 - **Documentation-First** -- No code without a validated story. Pipeline: Epic -> Story -> Validation -> Implementation.
-- **Constitution** -- 10 articles with automatic gates that block violations. See `.sinapse-ai/constitution.md`.
+- **Constitution** -- 11 articles with automatic gates that block violations. See `.sinapse-ai/constitution.md`.
 
 ### Project Structure
 

package/CHANGELOG.md

@@ -1,9 +1,19 @@
-## [1.9.1](https://github.com/caioimori/sinapse-ai/compare/1.9.0...1.9.1) (2026-06-18)
+## [1.10.0](https://github.com/caioimori/sinapse-ai/compare/1.9.1...1.10.0) (2026-06-18)
+
+### Features
+
+* **article-vii:** guarda contagem de artigos da Constitution contra drift ([c010fda](https://github.com/caioimori/sinapse-ai/commit/c010fda484a8d2eb0292ee0c583a60ae1d13a745))
+* **cli:** torna todos os comandos descobriveis no --help + guard de regressao ([1eba7d5](https://github.com/caioimori/sinapse-ai/commit/1eba7d5bb746dd241282e5d33aaa890f52d6d156))
 
 ### Bug Fixes
 
-* **audit:** correções da auditoria adversarial pós-1.9.0 ([3cef25e](https://github.com/caioimori/sinapse-ai/commit/3cef25e4ad6f9fa504f17b556ce16071bb3986ac))
-* **release:** remove @semantic-release/git (branch protegida rejeita push direto na main) ([0c62b90](https://github.com/caioimori/sinapse-ai/commit/0c62b90e8fa64160f2f0cef5b29daef871abe0f7))
+* **install:** reinstall preserva arquivos L3 user-owned (core-config, MEMORY.md) ([b2ab1a5](https://github.com/caioimori/sinapse-ai/commit/b2ab1a56025f12fc9a2123355541eaa41cbbf74b))
+* **security:** corrige 2 vulns moderadas que chegam a quem instala (js-yaml, tar) ([947694b](https://github.com/caioimori/sinapse-ai/commit/947694b8eee3f6ad6da6bb342a73c78fe8ab2658))
+* **security:** elimina interpolacao de shell no setx PATH do install (Windows) ([a4e9cae](https://github.com/caioimori/sinapse-ai/commit/a4e9caeda475b5873169151f811aa1ed92ff8181))
+
+### Documentation
+
+* corrige contagem da Constitution no README (10->11 artigos, 6->7 NON-NEGOTIABLE) ([40713a5](https://github.com/caioimori/sinapse-ai/commit/40713a51dceda3477fd4b33750e4cfe188cff086))
 
 # Changelog
 

package/README.en.md

@@ -33,7 +33,7 @@ Generative AI has a known problem: the more you ask of it, the worse it gets. A
 
 SINAPSE solves this the way human teams solve it: **coordinated specialization**. Instead of one tired generalist, you have 172 agents in 17 squads, each with a defined role, its own knowledge base, and executable tasks. An orchestrator routes your request to whoever actually knows how to solve it -- automatically, without you needing to memorize agent names or commands.
 
-The differential isn't just the quantity of agents. It's **real governance**: 19 active hooks intercept operations at runtime, a Constitution with 10 articles governs the framework, and 6 of those articles are NON-NEGOTIABLE -- violations are blocked before execution, not detected afterwards. **Speed with rigor, without choosing between the two.**
+The differential isn't just the quantity of agents. It's **real governance**: 19 active hooks intercept operations at runtime, a Constitution with 11 articles governs the framework, and 7 of those articles are NON-NEGOTIABLE -- violations are blocked before execution, not detected afterwards. **Speed with rigor, without choosing between the two.**
 
 ---
 
@@ -174,7 +174,7 @@ Deny rules in `.claude/settings.json` enforce this deterministically. **Framewor
 
 ### Constitution
 
-SINAPSE is governed by a formal Constitution with 10 articles and 19 enforcement hooks:
+SINAPSE is governed by a formal Constitution with 11 articles and 19 enforcement hooks:
 
 | Article | Principle | Severity |
 |---------|-----------|----------|
@@ -188,8 +188,9 @@ SINAPSE is governed by a formal Constitution with 10 articles and 19 enforcement
 | VIII | Mandatory Delegation | NON-NEGOTIABLE |
 | IX | Safe Collaboration | NON-NEGOTIABLE |
 | X | Security & Data Protection | NON-NEGOTIABLE |
+| XI | Conservative Default | MUST |
 
-6 articles are NON-NEGOTIABLE -- violations are automatically blocked before execution.
+7 articles are NON-NEGOTIABLE -- violations are automatically blocked before execution.
 
 ---
 

package/README.md

@@ -3,7 +3,7 @@
 [![Node.js](https://img.shields.io/badge/Node.js-%3E%3D18-green.svg)](https://nodejs.org/)
 [![CI](https://github.com/caioimori/sinapse-ai/actions/workflows/ci.yml/badge.svg)](https://github.com/caioimori/sinapse-ai/actions/workflows/ci.yml)
 [![Tests](https://img.shields.io/badge/tests-11014%20passed-success)](https://github.com/caioimori/sinapse-ai/actions/workflows/ci.yml)
-[![Constitution](https://img.shields.io/badge/Constitution-10%20articles-blueviolet)](.sinapse-ai/constitution.md)
+[![Constitution](https://img.shields.io/badge/Constitution-11%20articles-blueviolet)](.sinapse-ai/constitution.md)
 
 ```
  ____  ___ _   _    _    ____  ____  _____
@@ -35,7 +35,7 @@ IA generativa tem um problema conhecido: quanto mais voce pede, pior fica. Um un
 
 SINAPSE resolve isso do jeito que times humanos resolvem: **especializacao coordenada**. Em vez de um generalista cansado, voce tem 172 agentes em 17 squads, cada um com papel definido, knowledge base propria e tasks executaveis. Um orquestrador roteia seu pedido para quem realmente sabe resolver — automaticamente, sem voce precisar decorar agent names ou comandos.
 
-O diferencial nao e apenas quantidade de agentes. E **governanca real**: 13 hooks ativos interceptam operacoes em tempo de execucao, uma Constitution com 10 artigos rege o framework, e 6 desses artigos sao NON-NEGOTIABLE — violacoes sao bloqueadas antes de executar, nao detectadas depois. **Velocidade com rigor, sem escolher entre os dois.**
+O diferencial nao e apenas quantidade de agentes. E **governanca real**: 13 hooks ativos interceptam operacoes em tempo de execucao, uma Constitution com 11 artigos rege o framework, e 7 desses artigos sao NON-NEGOTIABLE — violacoes sao bloqueadas antes de executar, nao detectadas depois. **Velocidade com rigor, sem escolher entre os dois.**
 
 ---
 
@@ -137,8 +137,6 @@ Cada release passa por uma matriz de instalacao de 27 combinacoes (3 OSes x 3 pa
 
 **Sobre Yarn v1 no Windows:** Yarn v1 (Classic) esta em modo manutencao desde 2020, com Yarn v2+ (Berry) como sucessor oficial. A combinacao Windows + Yarn v1 apresenta falhas de resolucao de wrapper que nao compensam investigar por ser ecossistema em declinio. Usuarios Windows em Yarn v1 devem migrar para Yarn v2+ (recomendado) ou usar npm/pnpm. macOS e Linux em Yarn v1 continuam suportados.
 
-Registro completo da decisao e resultados: [docs/audits/install-matrix-2026-04-16.md](docs/audits/install-matrix-2026-04-16.md).
-
 ### "Como atualizar sem perder minhas customizacoes?"
 
 ```bash
@@ -215,7 +213,7 @@ Deny rules em `.claude/settings.json` reforcam isso deterministicamente. **Updat
 
 ### Constitution
 
-O SINAPSE e governado por uma Constitution formal com 10 artigos e 13 hooks de enforcement:
+O SINAPSE e governado por uma Constitution formal com 11 artigos e 13 hooks de enforcement:
 
 | Artigo | Principio | Severidade |
 |--------|-----------|------------|
@@ -229,8 +227,9 @@ O SINAPSE e governado por uma Constitution formal com 10 artigos e 13 hooks de e
 | VIII | Mandatory Delegation | NON-NEGOTIABLE |
 | IX | Safe Collaboration | NON-NEGOTIABLE |
 | X | Security & Data Protection | NON-NEGOTIABLE |
+| XI | Conservative Default | MUST |
 
-6 artigos sao NON-NEGOTIABLE — violacoes sao bloqueadas automaticamente antes de executar.
+7 artigos sao NON-NEGOTIABLE — violacoes sao bloqueadas automaticamente antes de executar.
 
 ---
 

package/bin/commands/install.js

@@ -1,7 +1,7 @@
 // bin/commands/install.js — `sinapse-ai install` (global) command + helpers.
 // Story GA-1.2 — extracted from bin/cli.js.
 
-const { execSync } = require('child_process');
+const { execSync, execFileSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 const { getLogger } = require('../../.sinapse-ai/core/logger');
@@ -893,11 +893,14 @@ function ensurePathWindows() {
       return;
     }
 
-    execSync(`setx PATH "${newPath}"`, { encoding: 'utf8', stdio: 'pipe' });
+    // execFileSync (no shell) — never interpolate the current PATH into a
+    // shell command string. A PATH value containing `"`/`&`/`^` would break
+    // the command or allow injection; passing args as an array avoids it.
+    execFileSync('setx', ['PATH', newPath], { encoding: 'utf8', stdio: 'pipe' });
     logger.always(`  ${GREEN}OK${NC} Added ~/bin to Windows User PATH`);
   } catch {
     try {
-      execSync(`setx PATH "%USERPROFILE%\\bin"`, { encoding: 'utf8', stdio: 'pipe' });
+      execFileSync('setx', ['PATH', '%USERPROFILE%\\bin'], { encoding: 'utf8', stdio: 'pipe' });
       logger.always(`  ${GREEN}OK${NC} Created Windows User PATH with ~/bin`);
     } catch {
       logger.always(`  ${YELLOW}WARN${NC} Could not modify PATH. Add manually: ${BIN_DIR}`);

package/bin/sinapse.js

@@ -73,6 +73,7 @@ USAGE:
   sinapse install                     # Install SINAPSE in current project
   sinapse init <name>                 # Create new project
   sinapse update                      # Update to latest version
+  sinapse uninstall                   # Remove SINAPSE from the project (--keep-data)
   sinapse brand                       # Re-apply SINAPSE branding (after Claude update)
   sinapse validate                    # Validate installation integrity
   sinapse info                        # Show system info
@@ -119,6 +120,25 @@ SERVICE DISCOVERY:
   sinapse workers search "transform" --tags=etl,data
   sinapse workers search "api" --format=json
 
+GENERATE & CREATE:
+  sinapse generate <prd|adr|story|epic|task>  # Generate a document from a template
+  sinapse create <agent|task|workflow>        # Scaffold a new framework component
+
+ORCHESTRATION:
+  sinapse orchestrate <story-id>            # Run the autonomous dev pipeline for a story
+  sinapse orchestrate --status              # Show / --stop / --resume a running pipeline
+  sinapse mode [explore|ask|auto]           # Show or set the agent permission mode (--cycle)
+
+INTELLIGENCE & HEALTH:
+  sinapse health                            # Framework health analytics (--deep for full scan)
+  sinapse graph --deps                      # Dependency & stats dashboard (--format, --watch)
+  sinapse performance                       # Squad & agent performance ranking (--top N)
+  sinapse routing-intel analyze             # Routing intelligence analysis
+
+INTEGRATIONS & LICENSE:
+  sinapse mcp setup                         # Configure global MCP servers (setup/link/status/add)
+  sinapse pro status                        # SINAPSE Pro license (activate/status/deactivate/features)
+
 EXAMPLES:
   # Install in current directory
   npx sinapse-ai@latest

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sinapse-ai",
-  "version": "1.9.1",
+  "version": "1.10.0",
   "description": "SINAPSE AI: Framework de orquestracao de IA — 17 squads, 172 agentes especializados",
   "bin": {
     "sinapse": "bin/sinapse.js",

package/packages/installer/src/installer/sinapse-ai-installer.js

@@ -141,8 +141,29 @@ async function generateVersionJson(options) {
  * @param {boolean} replaceRoot - Whether to replace {root} placeholders
  * @returns {Promise<boolean>} Success status
  */
-async function copyFileWithRootReplacement(sourcePath, destPath, replaceRoot = true) {
+/**
+ * Predicate: is this destination a user-owned L3 file that must survive a
+ * re-install? Matches the boundary contract (core-config.yaml + agent
+ * MEMORY.md are L3 "mutable / user-owned") and the README promise that
+ * re-running install is an idempotent upsert that preserves customizations.
+ * @param {string} destPath - Absolute destination path
+ * @returns {boolean}
+ */
+function isUserOwnedL3(destPath) {
+  const norm = String(destPath).replace(/\\/g, '/');
+  if (norm.endsWith('/.sinapse-ai/core-config.yaml')) return true;
+  if (/\/\.sinapse-ai\/development\/agents\/[^/]+\/MEMORY\.md$/.test(norm)) return true;
+  return false;
+}
+
+async function copyFileWithRootReplacement(sourcePath, destPath, replaceRoot = true, preserveExisting = null) {
   try {
+    // Preserve user-owned L3 files (core-config.yaml, agent MEMORY.md) when they
+    // already exist — a re-install must not silently wipe the user's config.
+    if (preserveExisting && preserveExisting(destPath) && await fs.pathExists(destPath)) {
+      return 'preserved';
+    }
+
     await fs.ensureDir(path.dirname(destPath));
 
     // Check if file needs {root} replacement (.md, .yaml, .yml)
@@ -171,7 +192,7 @@ async function copyFileWithRootReplacement(sourcePath, destPath, replaceRoot = t
  * @param {Function} onProgress - Progress callback
  * @returns {Promise<string[]>} List of copied files (relative paths)
  */
-async function copyDirectoryWithRootReplacement(sourceDir, destDir, onProgress = null) {
+async function copyDirectoryWithRootReplacement(sourceDir, destDir, onProgress = null, preserveExisting = null) {
   const copiedFiles = [];
 
   if (!await fs.pathExists(sourceDir)) {
@@ -193,11 +214,13 @@ async function copyDirectoryWithRootReplacement(sourceDir, destDir, onProgress =
     }
 
     if (item.isDirectory()) {
-      const subFiles = await copyDirectoryWithRootReplacement(sourcePath, destPath, onProgress);
+      const subFiles = await copyDirectoryWithRootReplacement(sourcePath, destPath, onProgress, preserveExisting);
       copiedFiles.push(...subFiles);
     } else {
-      const success = await copyFileWithRootReplacement(sourcePath, destPath);
-      if (success) {
+      const success = await copyFileWithRootReplacement(sourcePath, destPath, true, preserveExisting);
+      // Only count files actually written; 'preserved' (existing user-owned L3)
+      // and false (error) must not inflate the installed-files manifest.
+      if (success === true) {
         copiedFiles.push(path.relative(destDir, destPath));
         if (onProgress) {
           onProgress({ file: item.name, copied: true });
@@ -290,6 +313,7 @@ async function installSinapseCore(options = {}) {
           folderSource,
           folderDest,
           onProgress,
+          isUserOwnedL3,
         );
 
         if (copiedFiles.length > 0) {
@@ -306,8 +330,8 @@ async function installSinapseCore(options = {}) {
 
       if (await fs.pathExists(fileSource)) {
         spinner.text = `Copying ${file}...`;
-        const success = await copyFileWithRootReplacement(fileSource, fileDest);
-        if (success) {
+        const success = await copyFileWithRootReplacement(fileSource, fileDest, true, isUserOwnedL3);
+        if (success === true) {
           result.installedFiles.push(file);
         }
       }
@@ -495,6 +519,7 @@ module.exports = {
   getSinapseCoreSourcePath,
   copyFileWithRootReplacement,
   copyDirectoryWithRootReplacement,
+  isUserOwnedL3,
   generateVersionJson,
   generateFileHashes,
   deliverCodexRootFiles,

package/scripts/validate-article-vii.js

@@ -31,6 +31,29 @@ const path = require('path');
 const { collectCounts } = require('./sync-counts.js');
 
 const ROOT = path.resolve(__dirname, '..');
+const CONSTITUTION = path.join(ROOT, '.sinapse-ai', 'constitution.md');
+
+/**
+ * Count Constitution articles + NON-NEGOTIABLE ones from the canonical source.
+ * Articles are `### <Roman>. <Title>` headings; NON-NEGOTIABLE ones carry the
+ * `(NON-NEGOTIABLE)` marker in the heading. This is what was drifting in the
+ * README ("10 articles" while the constitution had 11) with no guard — now there
+ * is one.
+ * @returns {{articles:number, nonNegotiable:number}}
+ */
+function collectConstitutionCounts() {
+  let articles = 0;
+  let nonNegotiable = 0;
+  try {
+    const md = fs.readFileSync(CONSTITUTION, 'utf8');
+    const headings = md.match(/^###\s+[IVXLC]+\.\s.*$/gm) || [];
+    articles = headings.length;
+    nonNegotiable = headings.filter((h) => /\(NON-NEGOTIABLE\)/.test(h)).length;
+  } catch {
+    // Missing/unreadable constitution → leave zeros; the guards below are no-ops.
+  }
+  return { articles, nonNegotiable };
+}
 
 const TARGETS = [
   { file: 'README.md', label: 'README PT' },
@@ -44,12 +67,14 @@ const TARGETS = [
  * Build the set of expected numeric tokens that MUST appear consistently.
  * Returns an object describing canonical counts and a regex helper.
  */
-function buildExpectations(counts) {
+function buildExpectations(counts, constitution = { articles: 0, nonNegotiable: 0 }) {
   return {
     squads: counts.squads,
     agents: counts.totalAgents,
     orqx: counts.totalOrqx,
     tasks: counts.tasks,
+    articles: constitution.articles,
+    nonNegotiable: constitution.nonNegotiable,
   };
 }
 
@@ -89,6 +114,39 @@ function findDrift(content, expected) {
     }
   }
 
+  // Constitution total articles: "<N> artigos"/"<N> articles" NOT immediately
+  // part of a NON-NEGOTIABLE clause, plus the shields.io badge
+  // "Constitution-<N>%20articles". Guards the exact drift that slipped through
+  // before (README said "10 articles" while the constitution had 11).
+  if (expected.articles) {
+    const artRe = /\b(\d{1,2})\s+(?:artigos|articles)\b(?![^.\n]{0,40}NON-NEGOTIABLE)/gi;
+    for (const m of content.matchAll(artRe)) {
+      const n = parseInt(m[1], 10);
+      if (n !== expected.articles && n >= 5) {
+        findings.push({ kind: 'articles', found: n, expected: expected.articles, snippet: m[0].trim() });
+      }
+    }
+    const badgeRe = /Constitution-(\d{1,2})%20articles/gi;
+    for (const m of content.matchAll(badgeRe)) {
+      const n = parseInt(m[1], 10);
+      if (n !== expected.articles) {
+        findings.push({ kind: 'articles (badge)', found: n, expected: expected.articles, snippet: m[0] });
+      }
+    }
+  }
+
+  // Constitution NON-NEGOTIABLE article count: "<N> (desses|of those) artigos
+  // sao/are NON-NEGOTIABLE".
+  if (expected.nonNegotiable) {
+    const nnRe = /\b(\d{1,2})\s+(?:(?:desses|de|of\s+those)\s+)?(?:artigos|articles)\s+(?:sao|são|are)\s+NON-NEGOTIABLE/gi;
+    for (const m of content.matchAll(nnRe)) {
+      const n = parseInt(m[1], 10);
+      if (n !== expected.nonNegotiable) {
+        findings.push({ kind: 'NON-NEGOTIABLE articles', found: n, expected: expected.nonNegotiable, snippet: m[0].trim() });
+      }
+    }
+  }
+
   return findings;
 }
 
@@ -112,14 +170,17 @@ function main() {
   const fixMode = args.includes('--fix');
 
   const counts = collectCounts();
-  const expected = buildExpectations(counts);
+  const constitution = collectConstitutionCounts();
+  const expected = buildExpectations(counts, constitution);
 
   console.log('Article VII (Metrics Accuracy) — validacao de drift');
   console.log('Numeros canonicos (de .sinapse-ai/constitution.md):');
-  console.log(`  squads  ${expected.squads}`);
-  console.log(`  agentes ${expected.agents}`);
-  console.log(`  orqx    ${expected.orqx}`);
-  console.log(`  tasks   ${expected.tasks}`);
+  console.log(`  squads          ${expected.squads}`);
+  console.log(`  agentes         ${expected.agents}`);
+  console.log(`  orqx            ${expected.orqx}`);
+  console.log(`  tasks           ${expected.tasks}`);
+  console.log(`  artigos         ${expected.articles}`);
+  console.log(`  NON-NEGOTIABLE  ${expected.nonNegotiable}`);
   console.log('');
 
   const allDrifts = [];
@@ -173,4 +234,4 @@ if (require.main === module) {
   main();
 }
 
-module.exports = { findDrift, buildExpectations, TARGETS };
+module.exports = { findDrift, buildExpectations, collectConstitutionCounts, TARGETS };