fix(security): eliminate supply chain risks from npx and shell execution

.aios-core/core-config.yaml

@@ -22,6 +22,56 @@ devLoadAlwaysFiles:
   - docs/framework/coding-standards.md
   - docs/framework/tech-stack.md
   - docs/framework/source-tree.md
+# Per-agent always-load files (loaded during activation)
+# Purpose: rules, project context, boundaries — NOT domain knowledge.
+# Domain-specific knowledge is loaded by tasks when needed.
+agentAlwaysLoadFiles:
+  dev:
+    - docs/framework/coding-standards.md
+    - docs/framework/tech-stack.md
+    - docs/framework/source-tree.md
+  qa:
+    - docs/framework/coding-standards.md
+    - docs/framework/tech-stack.md
+    - docs/framework/source-tree.md
+    - .aios-core/product/data/test-levels-framework.md
+    - .aios-core/product/data/test-priorities-matrix.md
+  architect:
+    - docs/framework/tech-stack.md
+    - docs/framework/source-tree.md
+    - docs/architecture/agent-system-architecture.md
+  devops:
+    - docs/framework/coding-standards.md
+    - docs/framework/source-tree.md
+    - docs/architecture/command-authority-matrix.md
+  pm:
+    - docs/framework/source-tree.md
+    - docs/framework/tech-stack.md
+    - docs/stories/backlog.md
+  po:
+    - docs/framework/source-tree.md
+    - docs/stories/backlog.md
+    - docs/architecture/command-authority-matrix.md
+  sm:
+    - docs/framework/source-tree.md
+    - docs/stories/backlog.md
+    - docs/framework/coding-standards.md
+  analyst:
+    - docs/framework/tech-stack.md
+    - docs/framework/source-tree.md
+  data-engineer:
+    - docs/framework/tech-stack.md
+    - docs/framework/source-tree.md
+  ux-design-expert:
+    - docs/framework/tech-stack.md
+    - docs/framework/source-tree.md
+    - docs/framework/coding-standards.md
+  aios-master:
+    - .aios-core/constitution.md
+    - docs/framework/source-tree.md
+    - docs/architecture/command-authority-matrix.md
+  squad-creator:
+    - docs/framework/source-tree.md
 devLoadAlwaysFilesFallback:
   - docs/pt/framework/coding-standards.md
   - docs/pt/framework/tech-stack.md
@@ -308,8 +358,12 @@ ideSync:
   targets:
     claude-code:
       enabled: true
-      path: .claude/commands/AIOS/agents
-      format: full-markdown-yaml
+      path: .claude/agents
+      format: claude-native-agent
+    claude-skills:
+      enabled: true
+      path: .claude/skills
+      format: claude-agent-skill
     codex:
       enabled: true
       path: .codex/agents
@@ -318,10 +372,14 @@ ideSync:
       enabled: true
       path: .gemini/rules/AIOS/agents
       format: full-markdown-yaml
+    gemini-skills:
+      enabled: true
+      path: packages/gemini-aios-extension/skills
+      format: gemini-agent-skill
     github-copilot:
       enabled: true
       path: .github/agents
-      format: full-markdown-yaml
+      format: github-copilot-native-agent
     cursor:
       enabled: true
       path: .cursor/rules/agents
@@ -330,6 +388,10 @@ ideSync:
       enabled: true
       path: .antigravity/rules/agents
       format: cursor-style
+    claude-commands:
+      enabled: true
+      path: .claude/commands/AIOS/agents
+      format: claude-command-wrapper
   redirects: {}
   validation:
     strictMode: true

.aios-core/core/ids/registry-updater.js

@@ -4,7 +4,12 @@
 const fs = require('fs');
 const path = require('path');
 const yaml = require('js-yaml');
-const lockfile = require('proper-lockfile');
+let properLockfile = null;
+try {
+  properLockfile = require('proper-lockfile');
+} catch {
+  properLockfile = null;
+}
 const { RegistryLoader } = require(path.resolve(__dirname, 'registry-loader.js'));
 const {
   extractEntityId,
@@ -28,6 +33,7 @@ const LOCK_TIMEOUT_MS = 5000;
 const LOCK_RETRY_COUNT = 3;
 const LOCK_RETRY_DELAY_MS = 100;
 const LOCK_STALE_MS = 10000;
+const FALLBACK_LOCK_OWNER = `ids-registry-updater:${process.pid}`;
 
 const WATCH_PATHS = SCAN_CONFIG.map((c) => c.basePath);
 
@@ -458,6 +464,89 @@ class RegistryUpdater {
 
   // ─── Internal: File Locking ──────────────────────────────────────
 
+  _sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+  }
+
+  _isFallbackLockStale() {
+    try {
+      const lockStat = fs.statSync(this._lockFile);
+      return (Date.now() - lockStat.mtimeMs) > LOCK_STALE_MS;
+    } catch (err) {
+      if (err.code === 'ENOENT') return true;
+      throw err;
+    }
+  }
+
+  _removeFallbackLockIfOwned(ownerToken) {
+    try {
+      const raw = fs.readFileSync(this._lockFile, 'utf8');
+      let parsed = null;
+      try {
+        parsed = JSON.parse(raw);
+      } catch {
+        parsed = null;
+      }
+
+      // Only remove if this process owns the lock token.
+      if (parsed && parsed.token && parsed.token !== ownerToken) {
+        return;
+      }
+
+      fs.unlinkSync(this._lockFile);
+    } catch (err) {
+      if (err.code === 'ENOENT') return;
+      throw err;
+    }
+  }
+
+  _removeFallbackStaleLock() {
+    try {
+      fs.unlinkSync(this._lockFile);
+    } catch (err) {
+      if (err.code === 'ENOENT') return;
+      throw err;
+    }
+  }
+
+  async _acquireFallbackLock() {
+    const ownerToken = `${FALLBACK_LOCK_OWNER}:${Date.now()}:${Math.random().toString(36).slice(2, 10)}`;
+
+    for (let attempt = 0; attempt <= LOCK_RETRY_COUNT; attempt++) {
+      try {
+        const payload = {
+          owner: FALLBACK_LOCK_OWNER,
+          pid: process.pid,
+          token: ownerToken,
+          acquiredAt: new Date().toISOString(),
+        };
+
+        fs.writeFileSync(this._lockFile, JSON.stringify(payload), { flag: 'wx', encoding: 'utf8' });
+
+        return async () => {
+          this._removeFallbackLockIfOwned(ownerToken);
+        };
+      } catch (err) {
+        if (err.code !== 'EEXIST') {
+          throw err;
+        }
+
+        if (this._isFallbackLockStale()) {
+          this._removeFallbackStaleLock();
+          continue;
+        }
+
+        if (attempt === LOCK_RETRY_COUNT) {
+          throw new Error(`fallback lock timeout after ${LOCK_RETRY_COUNT + 1} attempts`);
+        }
+
+        await this._sleep(LOCK_RETRY_DELAY_MS);
+      }
+    }
+
+    throw new Error('fallback lock acquisition failed');
+  }
+
   async _withLock(operation) {
     const lockDir = path.dirname(this._lockFile);
     if (!fs.existsSync(lockDir)) {
@@ -470,15 +559,19 @@ class RegistryUpdater {
 
     let release;
     try {
-      release = await lockfile.lock(this._registryPath, {
-        stale: LOCK_STALE_MS,
-        retries: {
-          retries: LOCK_RETRY_COUNT,
-          minTimeout: LOCK_RETRY_DELAY_MS,
-          maxTimeout: LOCK_TIMEOUT_MS,
-        },
-        lockfilePath: this._lockFile,
-      });
+      if (properLockfile && typeof properLockfile.lock === 'function') {
+        release = await properLockfile.lock(this._registryPath, {
+          stale: LOCK_STALE_MS,
+          retries: {
+            retries: LOCK_RETRY_COUNT,
+            minTimeout: LOCK_RETRY_DELAY_MS,
+            maxTimeout: LOCK_TIMEOUT_MS,
+          },
+          lockfilePath: this._lockFile,
+        });
+      } else {
+        release = await this._acquireFallbackLock();
+      }
     } catch (err) {
       throw new Error(`[IDS-Updater] Could not acquire lock: ${err.message}`);
     }

.aios-core/core/manifest/manifest-generator.js

@@ -165,32 +165,34 @@ class ManifestGenerator {
     const errors = [];
 
     try {
-      const files = await fs.readdir(agentsDir);
-      const mdFiles = files.filter(f => f.endsWith('.md'));
+      const entries = await fs.readdir(agentsDir, { withFileTypes: true });
 
-      for (const file of mdFiles) {
+      for (const entry of entries) {
+        if (!entry.isDirectory()) continue;
+        const candidate = path.join(agentsDir, entry.name, `${entry.name}.md`);
         try {
-          const filePath = path.join(agentsDir, file);
-          const content = await fs.readFile(filePath, 'utf8');
+          const content = await fs.readFile(candidate, 'utf8');
           const parsed = parseYAMLFromMarkdown(content);
 
           if (parsed && parsed.agent) {
             const agent = parsed.agent;
             const persona = parsed.persona_profile || parsed.persona || {};
 
             agents.push({
-              id: agent.id || file.replace('.md', ''),
+              id: agent.id || entry.name,
               name: agent.name || 'Unknown',
               archetype: persona.archetype || agent.title || 'Agent',
               icon: agent.icon || '🤖',
               version: this.version,
               status: 'active',
-              file_path: `.aios-core/development/agents/${file}`,
+              file_path: `.aios-core/development/agents/${entry.name}/${entry.name}.md`,
               when_to_use: agent.whenToUse || '',
             });
           }
         } catch (e) {
-          errors.push(`Error parsing ${file}: ${e.message}`);
+          if (e.code !== 'ENOENT') {
+            errors.push(`Error parsing ${entry.name}: ${e.message}`);
+          }
         }
       }
 

.aios-core/core/orchestration/skill-dispatcher.js

@@ -67,7 +67,7 @@ class SkillDispatcher {
 
     /**
      * Mapping from agent IDs to full Skill names
-     * These correspond to files in .claude/commands/AIOS/agents/
+     * These correspond to files in .aios-core/development/agents/
      */
     this.skillMapping = {
       // Core development agents

.aios-core/core/quality-gates/quality-gate-config.yaml

@@ -47,7 +47,7 @@ layer2:
   quinn:
     enabled: true
     autoReview: true
-    agentPath: ".claude/commands/AIOS/agents/qa.md"
+    agentPath: ".aios-core/development/agents/qa/qa.md"
     severity:
       block: ["CRITICAL"]
       warn: ["HIGH", "MEDIUM"]

.aios-core/core/synapse/diagnostics/collectors/hook-collector.js

@@ -1,13 +1,18 @@
 /**
  * Hook Collector — Verifies SYNAPSE hook registration and file integrity.
  *
+ * NOTE: The SYNAPSE UserPromptSubmit hook is DEPRECATED. The skills-first
+ * architecture (CLAUDE.md + agent system prompts + .claude/rules/) provides
+ * equivalent context injection natively. The hook check now reports INFO
+ * instead of FAIL when the hook is not registered.
+ *
  * Checks:
- * - settings.local.json has UserPromptSubmit hook entry
+ * - settings.local.json has UserPromptSubmit hook entry (deprecated, INFO only)
  * - Hook file exists at expected path
  * - Hook file is valid Node.js (can be required)
  *
  * @module core/synapse/diagnostics/collectors/hook-collector
- * @version 1.0.0
+ * @version 1.1.0
  * @created Story SYN-13
  */
 
@@ -25,7 +30,7 @@ const path = require('path');
 function collectHookStatus(projectRoot) {
   const checks = [];
 
-  // Check 1: settings.local.json has hook entry
+  // Check 1: settings.local.json has hook entry (DEPRECATED — INFO only)
   const settingsPath = path.join(projectRoot, '.claude', 'settings.local.json');
   let hasHookRegistered = false;
 
@@ -51,16 +56,16 @@ function collectHookStatus(projectRoot) {
 
       checks.push({
         name: 'Hook registered',
-        status: hasHookRegistered ? 'PASS' : 'FAIL',
+        status: hasHookRegistered ? 'PASS' : 'INFO',
         detail: hasHookRegistered
           ? 'settings.local.json has UserPromptSubmit entry for synapse-engine'
-          : 'No synapse-engine hook found in settings.local.json',
+          : 'DEPRECATED — hook not registered (not required with skills-first architecture)',
       });
     } else {
       checks.push({
         name: 'Hook registered',
-        status: 'FAIL',
-        detail: 'settings.local.json not found',
+        status: 'INFO',
+        detail: 'DEPRECATED — hook not registered (not required with skills-first architecture)',
       });
     }
   } catch (error) {