@dzhechkov/harness-core 0.3.140 → 0.3.141

package/sbom.json

@@ -95,7 +95,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f5baab841b3179512cf72fd12884869719f0a352b9e231a87dfa1b87b772974f"
+          "content": "894c24f39960080ec16a422915bd51b83b8143dd1eee656aa7df94f06014aedb"
         }
       ]
     },
@@ -105,7 +105,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "eb8f01ef67cb90a2d95b18ae1f10bb3ce2dd5855dc297402665a1fa621a8fb65"
+          "content": "da6079c043c3dc3c25b33fd435da0fdef122143ee3c8a3c46e51bd51e6252883"
         }
       ]
     },
@@ -115,7 +115,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f661d868e08152e9e293c83d9914e53c0c2ea52e0afc0ff49d1f8c320017eabd"
+          "content": "57cd32c3f28ee55c776dc4be7eefd5bc1acc4d3d4d8e96917e633cfc5ea7f9cc"
         }
       ]
     },
@@ -125,7 +125,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a994c29d7f265c129dccaf9c0e00b55eb7f6312af8112691035c3889a113668b"
+          "content": "901f14b27b2fc410a66167f9b63f6263b68b516061e71d3cf3c98b207093cf51"
         }
       ]
     },
@@ -209,6 +209,46 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "dist/backlog.d.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "0e6b229ff5dfe8026018173f8bbc13398fe2a88411d9cedc0c4c679d6a1c2fc8"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/backlog.d.ts.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "99520bcd3dc3045df2e678a2be16f925b7f0f858f88ca4cc60526290c8e7c1aa"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/backlog.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "f6c541c38343a7d7ac6e07e5bca60bb0910d83d1fe3c22089b2dae9ba41eadc9"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/backlog.js.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "d211992f2a33bd28a164b19f3e2a9da798ccf679c29e92748742de14d8f009ff"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "dist/benchmark.d.ts",
@@ -1055,7 +1095,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d6a34c903e1dc447559d1cd3188e04fd6da273ce77bd71a916950b3c6cb54bc2"
+          "content": "13e762f63d29519f51214c202498f25171781daaaa5e872bf93504590da14102"
         }
       ]
     },
@@ -1065,7 +1105,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "cbc342e0e3297d90ed033226292aa2bb738cff1b0734b25be0498e4f03c12811"
+          "content": "7145736e767324ee5cc10ad8ffe0b58bc80bd8c186e91fd4693c9bfb350ae4a0"
         }
       ]
     },
@@ -1075,7 +1115,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c72a77f95e4b1cb5f72ea50164c4cccad72b8144cce4083acadb7fcdb144032c"
+          "content": "875624dd956dd81671adc24d896798b5b162f7a1af468a58944e29f0f6ad8347"
         }
       ]
     },
@@ -1085,7 +1125,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "214013193317769bf5934a811ab300d444cd672f247f3b796d9162a286043a3f"
+          "content": "5a8b40115c9b4d9dd815a4b15d61d4fc5da502a1b8a71104743c3ed9e204ce2c"
         }
       ]
     },
@@ -2455,7 +2495,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2bc60f782f3b2f9ee179894b88d8b2b9ff487f286c17f3d3dfd7f0ca0d640ffc"
+          "content": "77d99aef6714a8fbc0246be15425f96c4d9da95c9545de551ee069fc89eb4de2"
         }
       ]
     },
@@ -2465,7 +2505,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2a30a5bd7b8caf0e1cca2587817d25d9b0a366162ca098d5464f9783cdc2311d"
+          "content": "d34550cb15c7b10f2fd7a8009e4517d4e466a4d54e8e81d00ca34dc32a742e7b"
         }
       ]
     },
@@ -2475,7 +2515,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c0d917225ced953324609cb086fff6d6a2f31dead7dad470a31ec5d6bb257a32"
+          "content": "e45ce822673cb271d8e264f471d7ef6644ed5f689cedaf6e58d1aab3f2ebad6c"
         }
       ]
     },
@@ -2485,7 +2525,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "70e3c78890c71f0bb1cdd66bc2f787ead25c88edc130449d71003275e5adf57b"
+          "content": "716f08b502d77bb2be012982c09902207e75c083706a9fa7816b1306d1c0f03b"
         }
       ]
     },
@@ -2535,7 +2575,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "50f62b541c15bbb35dd1e3f795fd35a0724ef7906b6eff1d0954468437296acd"
+          "content": "c1bcc12b49b2181ad41b2bdb9b8869f95c5c34222038bbb1cd34b7c5e997a4f3"
         }
       ]
     },
@@ -2555,7 +2595,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "91f8d26b81e3262bc9e3b4ca357165eaed5d889660ef60f18b63e483009ea44e"
+          "content": "c4585a8bd01f0aaf1c8a0719f4b1a18464ab0a20b305d0c69b07ab21a5e2673c"
         }
       ]
     },
@@ -2579,6 +2619,16 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "src/backlog.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "e5173f2eafa803a5aaf0be03e238b5bc567f876fcb3caed4bae2148173baa998"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "src/benchmark.ts",
@@ -2795,7 +2845,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ed6a797940b4e795eab59ec4cc485a976a8cfd3b0ea2d4cfa0f1d75f485c4b84"
+          "content": "bf307ef27bca0ac2ad6dbb6e8c7301507b042469cacee3a9a183ef1be3e69df7"
         }
       ]
     },
@@ -3135,7 +3185,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9707fa46b1f92cfa75e45c6619e01ef8f74bb5f50a913b778edfe6143d818d8a"
+          "content": "db2d2510d5a9297ed212f117307ad15d0900005797d1ad81aee2b3802114b473"
         }
       ]
     },
@@ -3199,6 +3249,26 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "test/backlog-live.test.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "a10cb51a8e58564c31a8bbe828e4426b388e014b074a9b419c2cbfc1ef08987d"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "test/backlog.test.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "551e107380c9be270770266ebb258495825d942150c12c305345970de7f666b5"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "test/benchmark-s15.test.ts",

package/src/agentdb-index.ts

@@ -160,9 +160,21 @@ export async function indexPatternsToAgentdb(
 /*  READ half (dz-rvf-vector-bridge FR-3): semantic search + id scan   */
 /* ------------------------------------------------------------------ */
 
-/** The dz-owned ReasoningBank task_types (teach mirror + consolidate mirror). */
+/**
+ * The RECALL/search default task_types. Deliberately EXCLUDES `dz-backlog`: `dz recall` (and
+ * feature-adr Step-0) must never surface raw backlog ideas as if they were earned lessons (ADR-005).
+ */
 const DZ_TASK_TYPES = ['dz-teach', 'dz-learning'] as const;
 
+/**
+ * The dz-owned task_types for LIFECYCLE scans (id enumeration + reindex ownership) — a SUPERSET of
+ * the recall default that ALSO owns `dz-backlog` (smart-backlog, ADR-001/005). Reindex must re-embed
+ * these on a model bump (else backlog rows rot in a stale embedding space), and id-scans must see them
+ * (mirror idempotency). Kept SEPARATE from {@link DZ_TASK_TYPES} so ownership never leaks ideas into
+ * lesson recall: search defaults to DZ_TASK_TYPES, lifecycle to DZ_OWNED_TASK_TYPES.
+ */
+export const DZ_OWNED_TASK_TYPES = ['dz-teach', 'dz-learning', 'dz-backlog'] as const;
+
 /** Minimal READONLY better-sqlite3 surface used by the read half. */
 interface ReadonlyDb {
   pragma: (s: string) => void;
@@ -362,7 +374,9 @@ export async function listAgentdbDzIds(
   const { db } = opened;
   try {
     if (!hasDzTables(db)) return { ids: [] };
-    const taskTypes = opts.taskTypes ?? DZ_TASK_TYPES;
+    // LIFECYCLE scan ⇒ the OWNED superset (incl. dz-backlog) so idea ids are visible for mirror
+    // idempotency + `dz vector status`. Recall/search still defaults to the narrower DZ_TASK_TYPES.
+    const taskTypes = opts.taskTypes ?? DZ_OWNED_TASK_TYPES;
     const placeholders = taskTypes.map(() => '?').join(', ');
     const rows = db
       .prepare(`SELECT metadata FROM reasoning_patterns WHERE task_type IN (${placeholders})`)
@@ -380,6 +394,65 @@ export async function listAgentdbDzIds(
   }
 }
 
+/**
+ * Read the rows that ACTUALLY EXIST IN THE STORE for a task_type, as re-indexable {@link AgentdbRow}s
+ * (their stored `approach` text + score/uses/reward/tags/metadata, dzId preserved). This is the correct
+ * source for a REINDEX: a reindex re-embeds what is physically in the store to the new model — reading it
+ * back from the store (not reconstructing from a sidecar file like ideas.jsonl) means an empty/unreadable
+ * sidecar can never leave real store rows un-re-embedded and stale under an advanced manifest (HIGH-G).
+ * Readonly, best-effort ({rows:[]} on absent/unavailable), never throws.
+ */
+export function readAgentdbRowsByTaskType(
+  projectRoot: string,
+  taskType: string,
+  opts: { dbPath?: string } = {},
+): { rows: AgentdbRow[]; error?: string } {
+  const opened = openReadonly(projectRoot, opts.dbPath);
+  if ('absent' in opened) return { rows: [] };
+  if ('error' in opened) return { rows: [], error: opened.error };
+  const { db } = opened;
+  try {
+    if (!hasDzTables(db)) return { rows: [] };
+    const raw = db
+      .prepare('SELECT approach, success_rate, uses, avg_reward, tags, metadata FROM reasoning_patterns WHERE task_type = ?')
+      .all(taskType) as Array<{ approach: string; success_rate: number; uses: number; avg_reward: number; tags: string | null; metadata: string | null }>;
+    const rows: AgentdbRow[] = raw.map((r) => {
+      let metadata: Record<string, unknown> | undefined;
+      if (typeof r.metadata === 'string' && r.metadata !== '') {
+        try {
+          const m = JSON.parse(r.metadata) as unknown;
+          if (m !== null && typeof m === 'object') metadata = m as Record<string, unknown>;
+        } catch {
+          /* drop unparseable metadata */
+        }
+      }
+      let tags: string[] | undefined;
+      if (typeof r.tags === 'string' && r.tags !== '') {
+        try {
+          const t = JSON.parse(r.tags) as unknown;
+          if (Array.isArray(t)) tags = t.filter((x): x is string => typeof x === 'string');
+        } catch {
+          /* drop unparseable tags */
+        }
+      }
+      return {
+        taskType,
+        text: r.approach,
+        score: r.success_rate,
+        uses: r.uses,
+        avgReward: r.avg_reward,
+        ...(tags !== undefined ? { tags } : {}),
+        ...(metadata !== undefined ? { metadata } : {}),
+      };
+    });
+    return { rows };
+  } catch (err) {
+    return { rows: [], error: `row scan failed: ${err instanceof Error ? err.message : String(err)}` };
+  } finally {
+    db.close();
+  }
+}
+
 /* ------------------------------------------------------------------ */
 /*  IMPORT half (dz-vector-harmonize-import M0.4): upsert-by-dzId       */
 /* ------------------------------------------------------------------ */
@@ -437,6 +510,20 @@ export async function importVectorsToAgentdb(
     const { default: Database } = (await import(sqliteUrl)) as { default: new (p: string) => UpsertDb };
     const model = resolveEmbedModel(projectRoot);
     if ('error' in model) return { imported: 0, error: model.error };
+    // MED-C: the store manifest guards the MODEL, but a per-vector guard was missing — a malformed or
+    // TOCTOU vector (wrong length / NaN / ±Infinity) would be stamped compatible. Fail CLOSED and LOUD:
+    // reject the whole batch if any vector's dimensionality ≠ the store dim or any component is non-finite,
+    // so a vector can only enter the store bound to the model+dim the manifest names.
+    for (const row of rows) {
+      if (!(row.vector instanceof Float32Array) || row.vector.length !== model.dim) {
+        return { imported: 0, error: `vector validation failed for ${row.dzId}: length ${row.vector?.length} != store dim ${model.dim}` };
+      }
+      for (let i = 0; i < row.vector.length; i += 1) {
+        if (!Number.isFinite(row.vector[i])) {
+          return { imported: 0, error: `vector validation failed for ${row.dzId}: non-finite component at index ${i}` };
+        }
+      }
+    }
     const dbFile = resolveAgentdbPath(projectRoot, opts.dbPath);
     mkdirSync(dirname(dbFile), { recursive: true }); // better-sqlite3 won't create the parent dir
     const db = new Database(dbFile);
@@ -530,6 +617,62 @@ export function clearAgentdbQuarantine(
   }
 }
 
+/**
+ * DELETE mirrored rows by `metadata.dzId` (pattern + its embedding), optionally scoped to a task_type
+ * set. The write-half of a structured-store removal: when `harmonize --apply` drops ideas from
+ * `ideas.jsonl`, their `dz-backlog` vectors must be pruned too, or a later semantic search matches an
+ * ORPHAN dzId that no longer has a structured record (smart-backlog HIGH-A). Best-effort, same custody
+ * model as {@link clearAgentdbQuarantine} (missing db/deps ⇒ no-op). Never throws.
+ */
+export function deleteAgentdbByDzIds(
+  projectRoot: string,
+  dzIds: readonly string[],
+  opts: { dbPath?: string; taskTypes?: readonly string[] } = {},
+): { deleted: number; error?: string } {
+  if (dzIds.length === 0) return { deleted: 0 };
+  const dbFile = resolveAgentdbPath(projectRoot, opts.dbPath);
+  if (!existsSync(dbFile)) return { deleted: 0 };
+  let Database: new (p: string) => UpsertDb;
+  try {
+    const req = createRequire(join(projectRoot, 'package.json'));
+    Database = req('better-sqlite3') as new (p: string) => UpsertDb;
+  } catch {
+    return { deleted: 0, error: DEPS_MISSING };
+  }
+  try {
+    const db = new Database(dbFile);
+    try {
+      db.pragma('journal_mode = WAL');
+      db.pragma('busy_timeout = 5000');
+      db.exec(REASONING_BANK_SCHEMA);
+      const scope = opts.taskTypes !== undefined && opts.taskTypes.length > 0;
+      const scopeSql = scope ? ` AND task_type IN (${opts.taskTypes!.map(() => '?').join(', ')})` : '';
+      const findIds = db.prepare(`SELECT id FROM reasoning_patterns WHERE json_extract(metadata, '$.dzId') = ?${scopeSql}`) as unknown as {
+        all: (...a: unknown[]) => { id: number }[];
+      };
+      const delEmb = db.prepare('DELETE FROM pattern_embeddings WHERE pattern_id = ?');
+      const delPat = db.prepare('DELETE FROM reasoning_patterns WHERE id = ?');
+      const tx = db.transaction(() => {
+        let deleted = 0;
+        for (const dzId of dzIds) {
+          const rows = scope ? findIds.all(dzId, ...opts.taskTypes!) : findIds.all(dzId);
+          for (const { id } of rows) {
+            delEmb.run(id);
+            delPat.run(id);
+            deleted += 1;
+          }
+        }
+        return deleted;
+      });
+      return { deleted: tx() };
+    } finally {
+      db.close();
+    }
+  } catch (err) {
+    return { deleted: 0, error: `delete by dzId failed: ${err instanceof Error ? err.message : String(err)}` };
+  }
+}
+
 export function bumpAgentdbUses(
   projectRoot: string,
   dzIds: readonly string[],