@lmzhen/dsh-evolution-core 0.3.35 → 0.3.37

package/lib/index.js

@@ -423,6 +423,7 @@ function parseUsage(raw) {
 	if (raw === null) return map;
 	try {
 		const parsed = JSON.parse(raw);
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return map;
 		for (const [name, record] of Object.entries(parsed)) map.set(name, normalizeUsageRecord(record));
 	} catch {}
 	return map;
@@ -499,6 +500,10 @@ function foldCuratorFields(disk, curated, stateOwned) {
 		if (stateOwned === void 0 || stateOwned.has(name)) applyCuratorLifecycleFields(diskRecord, record);
 	}
 }
+/** Whole-file usage write (V6-37, 0.3.37): this is the ONE path that bypasses
+* the malformed-defense and the transact lock — prefer `mutateUsage` for any
+* read-modify-write so a concurrent writer cannot lose its update and a
+* malformed sidecar stays recoverable. Kept for fixture/test seeding. */
 async function saveUsage(root, map, io = nodeEvolutionIo()) {
 	const obj = Object.fromEntries(map.entries());
 	await io.writeText(usageFile(root), JSON.stringify(obj, null, 2));
@@ -746,7 +751,8 @@ function buildCuratorRunReport(input) {
 		failed: [...input.failed],
 		...input.consolidated === void 0 ? {} : { consolidated: [...input.consolidated] },
 		...input.snapshotPath === void 0 ? {} : { snapshotPath: input.snapshotPath },
-		...input.llmReviewEnabled === void 0 ? {} : { llmReviewEnabled: input.llmReviewEnabled }
+		...input.llmReviewEnabled === void 0 ? {} : { llmReviewEnabled: input.llmReviewEnabled },
+		...input.nominationsWarnings === void 0 ? {} : { nominationsWarnings: [...input.nominationsWarnings] }
 	};
 }
 /**
@@ -765,7 +771,8 @@ function renderCuratorReportMarkdown(report) {
 		`- **Archived**: ${report.archived.length}`,
 		`- **Failed**: ${report.failed.length}`,
 		...report.snapshotPath === void 0 ? [] : [`- **Snapshot**: ${report.snapshotPath}`],
-		...report.llmReviewEnabled === void 0 ? [] : [`- **llmReview**: ${report.llmReviewEnabled}`]
+		...report.llmReviewEnabled === void 0 ? [] : [`- **llmReview**: ${report.llmReviewEnabled}`],
+		...report.nominationsWarnings === void 0 || report.nominationsWarnings.length === 0 ? [] : [`- **Nomination warnings**: ${report.nominationsWarnings.join("; ")}`]
 	];
 	const section = (title, items) => items.length === 0 ? [] : [
 		"",
@@ -791,10 +798,16 @@ const NOMINATION_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
 function parseCuratorNominations(text) {
 	const prunings = [];
 	const consolidations = [];
+	const warnings = [];
 	let section = null;
 	let currentFrom = "";
 	let currentMode;
 	for (const line of text.split("\n")) {
+		const header = /^\s*(consolidations|prunings)\s*:\s*$/.exec(line);
+		if (header) {
+			section = header[1] === "consolidations" ? "consolidations" : "prunings";
+			continue;
+		}
 		const consolidated = /^\s*-\s*from:\s*([a-z0-9][a-z0-9-]*)\s*$/.exec(line);
 		if (consolidated) {
 			section = "consolidations";
@@ -805,6 +818,7 @@ function parseCuratorNominations(text) {
 		const mode = /^\s*mode:\s*(append|reference)\s*$/.exec(line);
 		if (mode) {
 			if (currentFrom !== "") currentMode = mode[1] === "reference" ? "reference" : "append";
+			else warnings.push(`mode: ${mode[1]} ignored — no preceding "- from:" entry (the consolidation falls back to append)`);
 			continue;
 		}
 		const into = /^\s*into:\s*([a-z0-9][a-z0-9-]*)\s*$/.exec(line);
@@ -821,6 +835,7 @@ function parseCuratorNominations(text) {
 		}
 		const pruned = /^\s*-\s*name:\s*([a-z0-9][a-z0-9-]*)\s*$/.exec(line);
 		if (pruned) {
+			if (section === "consolidations") warnings.push("\"- name:\" inside the consolidations section flips the parse to prunings");
 			section = "prunings";
 			const name = pruned[1];
 			if (name) prunings.push(name);
@@ -829,7 +844,8 @@ function parseCuratorNominations(text) {
 	const valid = (name) => NOMINATION_NAME_RE.test(name);
 	return {
 		prunings: prunings.filter(valid),
-		consolidations: consolidations.filter((item) => valid(item.from) && valid(item.into))
+		consolidations: consolidations.filter((item) => valid(item.from) && valid(item.into)),
+		warnings
 	};
 }
 /**
@@ -864,7 +880,8 @@ function computeScopeView(usage, config, protectedNames, gates) {
 		}
 		const bundled = config.bundledNames?.has(name) === true;
 		const suppressed = gateSet.suppressed.has(name);
-		if (record.pinned || bundled || suppressed || protectedNames?.has(name) === true) protectedSet.add(name);
+		const isBuiltin = PROTECTED_BUILTIN_SKILLS.has(name);
+		if (record.pinned || bundled || suppressed || protectedNames?.has(name) === true || isBuiltin) protectedSet.add(name);
 		if (lifecycleCandidate(name, record, config, bundled, gateSet)) {
 			managed.push(name);
 			if (record.state === "stale" || record.quality_warn === true) watched.push(name);
@@ -1589,6 +1606,24 @@ function buildLearnPrompt(userRequest) {
 	].join("\n");
 }
 //#endregion
+//#region lib/types/serial.js
+/**
+* A process-local serial task queue: each task starts only after the previous
+* one settles (success or failure), so read-modify-write sequences that share
+* one file never interleave inside this process. The durable cross-process
+* serialization layer is the IO backend's transact lock; this chain is the
+* second layer (0.3.17 S2.8, T-1: the shape was duplicated in state-json and
+* memory-files — one factory now).
+*/
+function makeSerialQueue() {
+	let chain = Promise.resolve();
+	return (task) => {
+		const run = chain.then(task, task);
+		chain = run.then(() => void 0, () => void 0);
+		return run;
+	};
+}
+//#endregion
 //#region lib/types/numeric.js
 /**
 * Numeric config clamping for the dsh-evolution plugin family.
@@ -1950,6 +1985,12 @@ var MemoryStore = class {
 	root;
 	maxFailures;
 	io;
+	/** V6-16 (0.3.37): same-process RMW serialization (the SkillLibrary queue) —
+	* on a backend WITHOUT a transact lock two concurrent callers compute on the
+	* same old content and the last rename wins, silently dropping one op's
+	* update. The node backend's cross-process lock already serializes; this
+	* chain covers the no-transact custom backends. */
+	serial = makeSerialQueue();
 	failureCount = 0;
 	lastFailureAt = 0;
 	constructor(options = {}) {
@@ -2056,6 +2097,9 @@ var MemoryStore = class {
 		};
 	}
 	async add(target, facts) {
+		return await this.serial(() => this.addChained(target, facts));
+	}
+	async addChained(target, facts) {
 		if (!facts.trim()) return {
 			ok: false,
 			message: "Content cannot be empty.",
@@ -2161,6 +2205,9 @@ var MemoryStore = class {
 		return render(entries) !== raw;
 	}
 	async applyBatch(target, operations) {
+		return await this.serial(() => this.applyBatchChained(target, operations));
+	}
+	async applyBatchChained(target, operations) {
 		if (operations.length === 0) return {
 			ok: false,
 			message: "operations list is empty.",
@@ -2234,6 +2281,17 @@ var MemoryStore = class {
 				if (!working.some((entry) => stripDatePrefix(entry) === body)) working.push(this.addDatePrefix ? `## ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}\n${body}` : body);
 				continue;
 			}
+			const rawAction = op.action;
+			if (rawAction !== "remove" && rawAction !== "replace") return {
+				result: {
+					ok: false,
+					message: `Operation ${position}: unknown action "${String(rawAction)}" (expected add/remove/replace). No operations were applied.${previewEntries(entries)}`,
+					entries,
+					chars: entries.join(ENTRY_DELIMITER).length,
+					limit: this.limitFor(target)
+				},
+				write: null
+			};
 			const needle = (op.old_text ?? "").trim();
 			if (!needle) return {
 				result: {
@@ -2653,24 +2711,6 @@ function redactSecrets(text) {
 	return out;
 }
 //#endregion
-//#region lib/types/serial.js
-/**
-* A process-local serial task queue: each task starts only after the previous
-* one settles (success or failure), so read-modify-write sequences that share
-* one file never interleave inside this process. The durable cross-process
-* serialization layer is the IO backend's transact lock; this chain is the
-* second layer (0.3.17 S2.8, T-1: the shape was duplicated in state-json and
-* memory-files — one factory now).
-*/
-function makeSerialQueue() {
-	let chain = Promise.resolve();
-	return (task) => {
-		const run = chain.then(task, task);
-		chain = run.then(() => void 0, () => void 0);
-		return run;
-	};
-}
-//#endregion
 //#region lib/types/skill-health.js
 /**
 * Skill structure-health domain (rc.73 A1, 008 design): a SECOND assessment
@@ -2760,6 +2800,7 @@ function observeEvent(signal, event) {
 		return;
 	}
 	if (event.type === "assistant/message") {
+		if (!Array.isArray(event.data.message.content)) return;
 		const text = event.data.message.content.map((block) => block.type === "text" ? block.text : "").join(" ");
 		signal.assistantChars += text.length;
 		return;
@@ -3327,6 +3368,12 @@ function fuzzyIndexOf(content, pattern, from = 0) {
 	}
 	return null;
 }
+/** V6-17 (0.3.37): the fuzzy-patch scan is O(n·m) with no input bound; a
+* non-exact anchor past these budgets would block the event loop (measured
+* ~6s at 20k×20k). Exact matches go through the fast `includes` path and stay
+* allowed regardless of size. */
+const FUZZY_MAX_PATTERN_CHARS = 4096;
+const FUZZY_MAX_WORK = 8e6;
 /** Trim leading whitespace of the first line and trailing whitespace of the last line. */
 function trimPatternBoundaries(pattern) {
 	const from = pattern.search(/\S/);
@@ -3471,6 +3518,10 @@ var SkillLibrary = class {
 			if (next !== null && next !== current) await this.io.writeText(path, next);
 		}
 		const o = outcome;
+		if (o === void 0 || typeof o !== "object" || !Object.prototype.hasOwnProperty.call(o, "write")) return {
+			ok: false,
+			message: "internal error: the write transaction did not invoke the task; no write was performed"
+		};
 		if (o.write !== null && o.audit) await this.audit(o.audit.skillName, o.audit.action, o.audit.before, o.audit.after, o.audit.summary);
 		if (o.write !== null && o.event) this.notifyMutation(o.event);
 		return o.result;
@@ -3863,6 +3914,13 @@ var SkillLibrary = class {
 				},
 				write: null
 			};
+			if (!md.includes(oldString) && (oldString.length > FUZZY_MAX_PATTERN_CHARS || md.length * oldString.length > FUZZY_MAX_WORK)) return {
+				result: {
+					ok: false,
+					message: `old_string too large for fuzzy match (${oldString.length} chars in ${patchLabel}); use update for a full rewrite or a narrower anchor.`
+				},
+				write: null
+			};
 			const patched = fuzzyPatch(md, oldString, newString, replaceAll);
 			if (patched === null) return {
 				result: {
@@ -4502,6 +4560,15 @@ var SkillLibrary = class {
 		};
 		const target = join(dir, ...filePath.replace(/\\/g, "/").split("/").filter(Boolean));
 		return await this.runSingleWrite(target, (current) => {
+			if (current !== null && content.trimEnd() === current.trimEnd()) return {
+				result: {
+					ok: true,
+					message: `Support file "${filePath}" unchanged: the supplied content already matches the current file; nothing written.`,
+					noop: true,
+					path: target
+				},
+				write: null
+			};
 			return {
 				result: {
 					ok: true,

package/lib/types/curator.d.ts

@@ -63,6 +63,8 @@ export interface CuratorRunReport {
     snapshotPath?: string;
     /** Whether the LLM nomination pass was enabled for this run (decision visibility). */
     llmReviewEnabled?: boolean;
+    /** V6-35 (0.3.36): lenient-parse shape notes from the LLM nomination block. */
+    nominationsWarnings?: string[];
 }
 export interface CuratorReportInput {
     runId: string;
@@ -76,6 +78,7 @@ export interface CuratorReportInput {
     consolidated?: readonly CuratorConsolidation[];
     snapshotPath?: string;
     llmReviewEnabled?: boolean;
+    nominationsWarnings?: readonly string[];
 }
 export declare function buildCuratorRunReport(input: CuratorReportInput): CuratorRunReport;
 /**
@@ -97,6 +100,11 @@ export interface CuratorConsolidation {
 export interface CuratorNominations {
     prunings: string[];
     consolidations: CuratorConsolidation[];
+    /** V6-35 (0.3.36): lenient-parse shape notes (an entry the lenient logic
+     * silently dropped or re-routed). Parsing stays lenient — these are advisory
+     * and flow into the run report so the operator sees why a mode or a pruning
+     * went somewhere unexpected. */
+    warnings: string[];
 }
 /**
  * Parse the curator LLM's YAML nomination block (consolidations + prunings).

package/lib/types/memory-store.d.ts

@@ -34,6 +34,12 @@ export declare class MemoryStore {
     readonly root: string;
     private readonly maxFailures;
     private readonly io;
+    /** V6-16 (0.3.37): same-process RMW serialization (the SkillLibrary queue) —
+     * on a backend WITHOUT a transact lock two concurrent callers compute on the
+     * same old content and the last rename wins, silently dropping one op's
+     * update. The node backend's cross-process lock already serializes; this
+     * chain covers the no-transact custom backends. */
+    private readonly serial;
     private failureCount;
     private lastFailureAt;
     constructor(options?: MemoryStoreOptions);
@@ -71,6 +77,7 @@ export declare class MemoryStore {
      */
     private oversizedRefusal;
     add(target: MemoryTarget, facts: string): Promise<MemoryApplyResult>;
+    private addChained;
     /**
      * Single-entry add inside the transaction: shared checks (oversized,
      * drift, threat) and the content computation. `raw` is the locked view
@@ -80,6 +87,7 @@ export declare class MemoryStore {
     /** Canonical-form drift check derived from the locked view (same formula as `detectDrift`, no second read). */
     private driftFromRaw;
     applyBatch(target: MemoryTarget, operations: MemoryOperation[]): Promise<MemoryApplyResult>;
+    private applyBatchChained;
     /** Batch RMW inside the transaction. `write: null` = failure/no-op, disk untouched. */
     private applyBatchCore;
     renderContext(): Promise<string>;

package/lib/types/skill-health.d.ts

@@ -10,8 +10,10 @@
  * `computeQualityScores` (different dimension, different consumers).
  */
 export interface SkillHealthThresholds {
-    /** Soft body limit: body chars at/below stay 'healthy' by size; above ->
-     * 'warn'; >= 2x -> 'needs-restructure'. */
+    /** Soft body limit: a body of `softBodyChars` or MORE -> 'warn'; >= 2x ->
+     * 'needs-restructure'. V6-34 (0.3.37): the doc comment used to claim
+     * "at/below stay healthy" while the engine warns at `>=` — fixed to the
+     * implementation edge (the reason copy said "above"). */
     softBodyChars: number;
     /** Stamp-density ceiling per KB of body text: rc.NN / commit shas / ISO
      * dates per KB at/above this -> 'warn' (log-like content living in the

package/lib/types/usage.d.ts

@@ -73,6 +73,10 @@ export declare function applyCuratorMetaFields(disk: UsageRecord, curated: Usage
  * by a stale snapshot; without it both pairs apply everywhere.
  */
 export declare function foldCuratorFields(disk: UsageMap, curated: UsageMap, stateOwned?: ReadonlySet<string>): void;
+/** Whole-file usage write (V6-37, 0.3.37): this is the ONE path that bypasses
+ * the malformed-defense and the transact lock — prefer `mutateUsage` for any
+ * read-modify-write so a concurrent writer cannot lose its update and a
+ * malformed sidecar stays recoverable. Kept for fixture/test seeding. */
 export declare function saveUsage(root: string, map: UsageMap, io?: EvolutionIoLike): Promise<void>;
 export declare function getRecord(map: UsageMap, name: string): UsageRecord;
 export declare function bumpView(map: UsageMap, name: string, when?: Date): void;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-core",
   "description": "Shared stores, prompts, signals and lifecycle logic for the dsh-evolution plugin family (community build)",
-  "version": "0.3.35",
+  "version": "0.3.37",
   "publishConfig": {
     "access": "public"
   },