@lmzhen/dsh-evolution-core 0.3.22 → 0.3.23

package/README.md

@@ -41,3 +41,4 @@ across processes.
 ## Known Limitations and Deferred Work
 
 - This package is a library, not a Cordis row; do not mount it as a plugin.
+- 数值配置已在消费方 Config 面钳制（`min 1`/各字段域）；`MemoryStore` 内部对 `limit <= 0` 仍按 unbounded 防御处理——那是库内部防御，不构成"0 = 禁用"的配置语义。

package/lib/index.js

@@ -2532,9 +2532,9 @@ const SECRET_PATTERNS = [
 	["gitlab token", /glpat-[A-Za-z0-9_-]{16,}/g],
 	["slack token", /xox[baprs]-[A-Za-z0-9-]{10,}/g],
 	["jwt", /eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g],
-	["bearer credential", /Bearer [A-Za-z0-9._~+/=\-]{16,}/g]
+	["bearer credential", /Bearer[\s]+[a-z0-9._~+/=\-]{16,}/gi]
 ];
-const INLINE_ASSIGNMENT_PATTERN = /(\b(?:token|api[_-]?key|secret|password|passwd)\b[\s]*[:=][\s]*["']?)([A-Z0-9._~+/=\-]{12,})/gi;
+const INLINE_ASSIGNMENT_PATTERN = /* @__PURE__ */ new RegExp("((?:\\b|[\\w-]+[_\\-])(?:token|api[_-]?key|secret|password|passwd)(?:[_\\-][\\w-]+)?\\b[\\s]*[:=][\\s]*[\"']?)([A-Z0-9._~+/=\\-]{12,})", "gi");
 /**
 * Mask credential-shaped text before it crosses a session boundary.
 * @param text - the text about to be sent to a model outside this session.
@@ -4642,4 +4642,46 @@ function evolutionHome(env = process.env) {
 	return join(evolutionRoot(env), "evolution");
 }
 //#endregion
-export { AUTHORING_DESCRIPTION_BAR, COMBINED_REVIEW_PLAN_PROMPT, COMBINED_REVIEW_PROMPT, COMPLETION_SKILL_REVIEW_PROMPT, CURATOR_DRY_RUN_BANNER, CURATOR_PROMPT, DEFAULT_ARCHIVE_AFTER_DAYS, DEFAULT_CONSOLIDATION_FAILURES, DEFAULT_CURATOR_INTERVAL_HOURS, DEFAULT_HEALTH_THRESHOLDS, DEFAULT_MAX_OPS_PER_PLAN, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_MIN_IDLE_HOURS, DEFAULT_MUTATION_CAP, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_LIMITS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_STALE_AFTER_DAYS, DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS, DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS, DEFAULT_SUBSTANTIVE_MIN_USER_CHARS, DEFAULT_USER_CHAR_LIMIT, DRIFT_MAX_LINE_CHARS, DRIFT_SIGNALS_VERSION, DRIFT_SIGNAL_NOUNS, DSH_AUTHORING_STANDARDS, ENTRY_DELIMITER, EVENT_ARCHIVE_PREFIX, EVENT_LOG_RETAIN_ARCHIVES, EVENT_LOG_ROTATE_AT, EVENT_LOG_VERSION, EVOLUTION_WRITE_TOOLS, EvolutionGateSet, FORBIDDEN_CONTROL_KEYS, HEALTH_STAMP_RE, LOW_QUALITY_THRESHOLD, MAINTAIN_PROMPT, MAX_DESCRIPTION_LENGTH, MAX_RESTRUCTURE_MOVES, MAX_SKILL_CONTENT_CHARS, MAX_SKILL_FILE_BYTES, MAX_SKILL_NAME_LENGTH, MEMORY_REVIEW_PROMPT, MIN_STAMP_BODY_CHARS, MUTATIONS_FILE_VERSION, MemoryStore, PROMPT_BUNDLE, PROMPT_BUNDLE_ID, PROMPT_BUNDLE_VERSION, PROTECTED_BUILTIN_SKILLS, QUALITY_WEIGHTS, RESTRUCTURE_TARGET_RE, SKILLS_GUIDANCE, SKILL_NAME_RE, SKILL_REVIEW_PLAN_PROMPT, SKILL_REVIEW_PROMPT, SNAPSHOT_EXTRA_NAME_RE, SUPPORT_DIRS, SUPPRESSED_FILE_VERSION, SkillLibrary, advanceReview, appendEvolutionEvent, applyCuratorFields, applyCuratorLifecycleFields, applyCuratorMetaFields, assessStructureHealth, authoringFeedback, buildCuratorRunReport, buildLearnPrompt, bumpPatch, bumpUse, bumpView, composePresetComposition, computeDedupGroups, computeDriftSignals, computeLifecycleTransitions, computePrefixClusters, computeQualityScores, computeScopeView, contentHash, createGateSet, duplicateHeadings, emptyRecord, evaluateThreat, eventsFile, evolutionHome, evolutionIoAdapter, evolutionRoot, findDriftSignal, foldCuratorFields, foldTurn, frontmatterBlock, frontmatterYamlUnsafeValues, getRecord, latestActivityAt, lifecycleCandidate, listEventArchives, loadMutations, loadSuppressedNames, loadUsage, makeSerialQueue, markAgentCreated, memoryRoot, missingSupportPointers, mutateUsage, mutationsFile, narrowNameMatches, nodeEvolutionIo, normalizeFrontmatter, normalizeUsageRecord, observeEvent, overlongLines, parseCuratorNominations, parseEvolutionEvents, parseFrontmatter, readEvolutionEvents, readEvolutionTimeline, recordMutation, redactSecrets, relatedSkillNames, renameWithRetry, renderCuratorReportMarkdown, resolveOrigins, resolveSkillsRoot, retainEventArchives, reviewPrompt, saveSuppressedNames, saveUsage, scanContentThreats, scanMemoryThreats, scanThreats, skillsRoot, suppressedFile, transactIo, updateSuppressedNames, usageFile, usageObserved, validateFrontmatter, verifyPromptBundle, yamlPlainScalarNeedsQuotes };
+//#region lib/types/numeric.js
+/**
+* Numeric config clamping for the dsh-evolution plugin family.
+*
+* G3.1 (0.3.23): numeric configuration values are normalised through a single
+* helper so 0 / negative / NaN / ±Infinity / out-of-range all fall back to the
+* package default instead of silently becoming a "disabled" special value or
+* folding as NaN into a computation. A non-finite value (NaN, ±Infinity) is
+* never a legitimate config, so it always falls back. The schema layer (a
+* `.min(1)` clamp on the number schema) is a first-line guard where it can
+* reject invalid values; this helper is the mandatory assembly-time clamp that
+* also catches what schemastery lets through (NaN and +Infinity both pass a
+* bare number schema).
+*
+* The scope here is pure numeric conversion only (no schemastery import), so
+* evolution-core stays free of a schemastery dependency. Per-package Config
+* schemas keep their own `.min()`/`.default()` call sites.
+* @module @lmzhen/dsh-evolution-core
+*/
+/**
+* Clamp a numeric config to the `[min, max]` range.
+*
+* A non-finite value (NaN, ±Infinity), a non-number, or a value outside the
+* inclusive range falls back to `fallback`. When `opts.min >= 1`, 0 and
+* negative values also fall back to `fallback` — a 0 is never treated as a
+* special "disabled" meaning (G3.1 decision). Callers that legitimately allow
+* 0 (e.g. a threshold or a zero-cost weight) pass `{ min: 0 }` or omit the
+* range.
+*
+* @param value - the raw numeric config, possibly `undefined` (absent).
+* @param fallback - the default value to return when the value is invalid.
+* @param opts - optional inclusive lower/upper bound.
+* @returns `value` when it is a finite number within range, else `fallback`.
+*/
+function clampedNumber(value, fallback, opts) {
+	if (typeof value !== "number" || !Number.isFinite(value)) return fallback;
+	const { min, max } = opts ?? {};
+	if (min !== void 0 && value < min) return fallback;
+	if (max !== void 0 && value > max) return fallback;
+	return value;
+}
+//#endregion
+export { AUTHORING_DESCRIPTION_BAR, COMBINED_REVIEW_PLAN_PROMPT, COMBINED_REVIEW_PROMPT, COMPLETION_SKILL_REVIEW_PROMPT, CURATOR_DRY_RUN_BANNER, CURATOR_PROMPT, DEFAULT_ARCHIVE_AFTER_DAYS, DEFAULT_CONSOLIDATION_FAILURES, DEFAULT_CURATOR_INTERVAL_HOURS, DEFAULT_HEALTH_THRESHOLDS, DEFAULT_MAX_OPS_PER_PLAN, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_MIN_IDLE_HOURS, DEFAULT_MUTATION_CAP, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_LIMITS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_STALE_AFTER_DAYS, DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS, DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS, DEFAULT_SUBSTANTIVE_MIN_USER_CHARS, DEFAULT_USER_CHAR_LIMIT, DRIFT_MAX_LINE_CHARS, DRIFT_SIGNALS_VERSION, DRIFT_SIGNAL_NOUNS, DSH_AUTHORING_STANDARDS, ENTRY_DELIMITER, EVENT_ARCHIVE_PREFIX, EVENT_LOG_RETAIN_ARCHIVES, EVENT_LOG_ROTATE_AT, EVENT_LOG_VERSION, EVOLUTION_WRITE_TOOLS, EvolutionGateSet, FORBIDDEN_CONTROL_KEYS, HEALTH_STAMP_RE, LOW_QUALITY_THRESHOLD, MAINTAIN_PROMPT, MAX_DESCRIPTION_LENGTH, MAX_RESTRUCTURE_MOVES, MAX_SKILL_CONTENT_CHARS, MAX_SKILL_FILE_BYTES, MAX_SKILL_NAME_LENGTH, MEMORY_REVIEW_PROMPT, MIN_STAMP_BODY_CHARS, MUTATIONS_FILE_VERSION, MemoryStore, PROMPT_BUNDLE, PROMPT_BUNDLE_ID, PROMPT_BUNDLE_VERSION, PROTECTED_BUILTIN_SKILLS, QUALITY_WEIGHTS, RESTRUCTURE_TARGET_RE, SKILLS_GUIDANCE, SKILL_NAME_RE, SKILL_REVIEW_PLAN_PROMPT, SKILL_REVIEW_PROMPT, SNAPSHOT_EXTRA_NAME_RE, SUPPORT_DIRS, SUPPRESSED_FILE_VERSION, SkillLibrary, advanceReview, appendEvolutionEvent, applyCuratorFields, applyCuratorLifecycleFields, applyCuratorMetaFields, assessStructureHealth, authoringFeedback, buildCuratorRunReport, buildLearnPrompt, bumpPatch, bumpUse, bumpView, clampedNumber, composePresetComposition, computeDedupGroups, computeDriftSignals, computeLifecycleTransitions, computePrefixClusters, computeQualityScores, computeScopeView, contentHash, createGateSet, duplicateHeadings, emptyRecord, evaluateThreat, eventsFile, evolutionHome, evolutionIoAdapter, evolutionRoot, findDriftSignal, foldCuratorFields, foldTurn, frontmatterBlock, frontmatterYamlUnsafeValues, getRecord, latestActivityAt, lifecycleCandidate, listEventArchives, loadMutations, loadSuppressedNames, loadUsage, makeSerialQueue, markAgentCreated, memoryRoot, missingSupportPointers, mutateUsage, mutationsFile, narrowNameMatches, nodeEvolutionIo, normalizeFrontmatter, normalizeUsageRecord, observeEvent, overlongLines, parseCuratorNominations, parseEvolutionEvents, parseFrontmatter, readEvolutionEvents, readEvolutionTimeline, recordMutation, redactSecrets, relatedSkillNames, renameWithRetry, renderCuratorReportMarkdown, resolveOrigins, resolveSkillsRoot, retainEventArchives, reviewPrompt, saveSuppressedNames, saveUsage, scanContentThreats, scanMemoryThreats, scanThreats, skillsRoot, suppressedFile, transactIo, updateSuppressedNames, usageFile, usageObserved, validateFrontmatter, verifyPromptBundle, yamlPlainScalarNeedsQuotes };

package/lib/types/index.d.ts

@@ -28,4 +28,5 @@ export * from './state-store.ts';
 export * from './threats.ts';
 export * from './usage.ts';
 export * from './constants.ts';
+export * from './numeric.ts';
 //# sourceMappingURL=index.d.ts.map

package/lib/types/numeric.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Numeric config clamping for the dsh-evolution plugin family.
+ *
+ * G3.1 (0.3.23): numeric configuration values are normalised through a single
+ * helper so 0 / negative / NaN / ±Infinity / out-of-range all fall back to the
+ * package default instead of silently becoming a "disabled" special value or
+ * folding as NaN into a computation. A non-finite value (NaN, ±Infinity) is
+ * never a legitimate config, so it always falls back. The schema layer (a
+ * `.min(1)` clamp on the number schema) is a first-line guard where it can
+ * reject invalid values; this helper is the mandatory assembly-time clamp that
+ * also catches what schemastery lets through (NaN and +Infinity both pass a
+ * bare number schema).
+ *
+ * The scope here is pure numeric conversion only (no schemastery import), so
+ * evolution-core stays free of a schemastery dependency. Per-package Config
+ * schemas keep their own `.min()`/`.default()` call sites.
+ * @module @lmzhen/dsh-evolution-core
+ */
+/**
+ * Clamp a numeric config to the `[min, max]` range.
+ *
+ * A non-finite value (NaN, ±Infinity), a non-number, or a value outside the
+ * inclusive range falls back to `fallback`. When `opts.min >= 1`, 0 and
+ * negative values also fall back to `fallback` — a 0 is never treated as a
+ * special "disabled" meaning (G3.1 decision). Callers that legitimately allow
+ * 0 (e.g. a threshold or a zero-cost weight) pass `{ min: 0 }` or omit the
+ * range.
+ *
+ * @param value - the raw numeric config, possibly `undefined` (absent).
+ * @param fallback - the default value to return when the value is invalid.
+ * @param opts - optional inclusive lower/upper bound.
+ * @returns `value` when it is a finite number within range, else `fallback`.
+ */
+export declare function clampedNumber(value: number | undefined, fallback: number, opts?: {
+    min?: number;
+    max?: number;
+}): number;
+//# sourceMappingURL=numeric.d.ts.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-core",
   "description": "Shared stores, prompts, signals and lifecycle logic for the dsh-evolution plugin family (community build)",
-  "version": "0.3.22",
+  "version": "0.3.23",
   "publishConfig": {
     "access": "public"
   },