@lmzhen/dsh-evolution-core 0.3.55 → 0.3.57

package/lib/index.js

@@ -311,6 +311,10 @@ function nodeEvolutionIo(lockAttempts = 40) {
 					retryDelay: 100
 				}).catch(async () => {
 					const body = await readFile(lock, "utf8").catch(() => "");
+					if (pendingSelfCleanup.size >= 64) {
+						const oldest = pendingSelfCleanup.keys().next().value;
+						if (oldest !== void 0) pendingSelfCleanup.delete(oldest);
+					}
 					pendingSelfCleanup.set(lock, body);
 				});
 			}
@@ -428,7 +432,7 @@ function nodeEvolutionIo(lockAttempts = 40) {
 		},
 		async rename(path, destination) {
 			await mkdir(dirname(destination), { recursive: true });
-			await rename(path, destination);
+			await renameWithRetry(path, destination);
 		},
 		async copy(path, destination) {
 			await mkdir(dirname(destination), { recursive: true });
@@ -1207,8 +1211,8 @@ async function appendEvolutionEvent(io, path, event, rotateAt = EVENT_LOG_ROTATE
 				return current;
 			}
 		}
-		const nextEvents = await rotateIfDue(io, path, await rotateIfDue(io, path, v1EventRecords(parsedBody), rotateAt), rotateAt);
-		let maxSeq = nextEvents.reduce((max, entry) => Math.max(max, entry.seq), 0);
+		const events = await rotateIfDue(io, path, v1EventRecords(parsedBody), rotateAt);
+		let maxSeq = events.reduce((max, entry) => Math.max(max, entry.seq), 0);
 		if (maxSeq === 0) for (const name of await listEventArchives(io, path)) maxSeq = Math.max(maxSeq, Number.parseInt(name.slice(7, name.length - 5), 10));
 		const record = {
 			...event,
@@ -1218,7 +1222,7 @@ async function appendEvolutionEvent(io, path, event, rotateAt = EVENT_LOG_ROTATE
 		assigned = record.seq;
 		return JSON.stringify({
 			version: 1,
-			events: [...nextEvents, record]
+			events: [...events, record]
 		}, null, 2);
 	});
 	if (assigned === 0) throw new Error(`${refuseMessage || "evolution event log is malformed and was not touched"}: ${path}`);
@@ -1325,6 +1329,28 @@ async function readEvolutionTimeline(io, path) {
 	};
 }
 //#endregion
+//#region lib/types/env.js
+/**
+* Evolution environment-variable reading, single-source (WC, 0.3.56).
+*
+* Every `DSH_EVOLUTION_*` value the PLUGIN code reads goes through this module
+* so the trim/whitelist patterns (v10 P2-12/13) live in exactly one place and
+* the generated env reference can point at one behavior. Configuration-layer
+* reads inside patch YAML `!!js` expressions (session-query path/openAt) stay
+* in the profile config evaluation — they are NOT migrated (they are resolved
+* at cordis config time, not plugin time) but are documented in the README
+* env table.
+*/
+/** Plugin-side DSH_EVOLUTION_* keys (config-layer keys are documented separately). */
+const EVOLUTION_ENV_KEYS = ["DSH_EVOLUTION_ALLOW_ROW_COLLISIONS"];
+const ALLOW_ROW_COLLISIONS = "1";
+/** N-5 escape: `DSH_EVOLUTION_ALLOW_ROW_COLLISIONS=1` downgrades a delta-row
+* collision from fail-loud to warn+keep-both. Any other value (including an
+* EMPTY/whitespace string — a set-but-unset variable) keeps the fail-loud. */
+function allowRowCollisions(env = process.env) {
+	return env.DSH_EVOLUTION_ALLOW_ROW_COLLISIONS === ALLOW_ROW_COLLISIONS;
+}
+//#endregion
 //#region lib/types/prompts.js
 /**
 * Review and curation prompts adapted from Hermes Agent
@@ -2081,14 +2107,15 @@ function scanMemoryThreats(text, maxScanChars = 65536, options = NO_SCAN_OPTIONS
 	const { blocked, findings } = evaluateThreat(text, "strict", maxScanChars, options);
 	if (!blocked) return null;
 	const pattern = findings.find((f) => f.category !== "unicode_obfuscation");
-	if (pattern) return `Blocked by security scan (${pattern.label}). Rephrase without instruction-like language.`;
-	return "Blocked by security scan: invisible or potentially malicious Unicode detected.";
+	const exemptionHint = " A deployment that needs a specific label can exempt it via threatExemptLabels (see the README env/dial reference).";
+	if (pattern) return `Blocked by security scan (${pattern.label}). Rephrase without instruction-like language.${exemptionHint}`;
+	return `Blocked by security scan: invisible or potentially malicious Unicode detected.${exemptionHint}`;
 }
 /** User-facing block message for skill content writes. */
 function scanContentThreats(text, maxScanChars = 65536, options = NO_SCAN_OPTIONS) {
 	const { blocked, findings } = evaluateThreat(text, "strict", maxScanChars, options);
 	if (!blocked) return null;
-	return `Blocked by security scan (${findings[0]?.label ?? "unknown"}). This content appears to contain potentially malicious instructions.`;
+	return `Blocked by security scan (${findings[0]?.label ?? "unknown"}). This content appears to contain potentially malicious instructions. Installations with a known-innocent label can exempt it via threatExemptLabels (README dial reference).`;
 }
 /**
 * V10-03 (P2-18): suffix the SkillLibrary/MemoryStore write gates append to a
@@ -2736,7 +2763,7 @@ async function recordMutation(root, io, record, cap = 500) {
 function composePresetComposition(standardComposition, deltaComposition) {
 	const standardIds = compositionRowIds(standardComposition);
 	const collisions = [...compositionRowIds(deltaComposition)].filter((id) => standardIds.has(id)).sort();
-	if (collisions.length > 0 && process.env.DSH_EVOLUTION_ALLOW_ROW_COLLISIONS !== "1") throw new Error(`evolution preset composition: delta rows collide with runtime standard rows: ${collisions.join(", ")}`);
+	if (collisions.length > 0 && !allowRowCollisions()) throw new Error(`evolution preset composition: delta rows collide with runtime standard rows: ${collisions.join(", ")}`);
 	if (collisions.length > 0) console.warn(`evolution preset composition: warning — delta rows collide with standard rows (${collisions.join(", ")}); keeping both (DSH_EVOLUTION_ALLOW_ROW_COLLISIONS=1)`);
 	return injectCatalogDescriptionCap(`${standardComposition.replace(/\s+$/, "")}\n\n${deltaComposition.trim()}\n`);
 }
@@ -3086,9 +3113,11 @@ function observeEvent(signal, event) {
 		return;
 	}
 	if (event.type === "tool/call") {
+		const data = event.data;
+		if (data === null || typeof data !== "object" || Array.isArray(data)) return;
 		signal.toolCalls += 1;
-		if (event.data.name === "skill") signal.skillSignal = true;
-		if (event.data.name === "skill_manage") signal.skillSignal = true;
+		const name = data.name;
+		if (name === "skill" || name === "skill_manage") signal.skillSignal = true;
 	}
 }
 /** Compute review cadence after `turn/end`. */
@@ -4122,6 +4151,9 @@ var SkillLibrary = class {
 	}
 	async create(name, content, origin = "foreground") {
 		const normalized = name.trim();
+		return await this.serial(() => this.createCore(normalized, content, origin));
+	}
+	async createCore(normalized, content, origin) {
 		const bad = this.badName(normalized);
 		if (bad) return {
 			ok: false,
@@ -4859,9 +4891,10 @@ var SkillLibrary = class {
 	*/
 	async restoreFromArchive(rawName) {
 		const name = rawName.trim();
-		if (!SKILL_NAME_RE.test(name)) return {
+		const bad = this.badName(name);
+		if (bad) return {
 			ok: false,
-			message: `Invalid skill name "${name}". Use lowercase letters, digits, and hyphens.`
+			message: bad
 		};
 		if (await this.io.exists(join(this.dirOf(name), "SKILL.md"))) return {
 			ok: false,
@@ -4990,6 +5023,9 @@ var SkillLibrary = class {
 	}
 	async removeSupportFile(rawName, filePath, origin = "foreground") {
 		const name = rawName.trim();
+		return await this.serial(() => this.removeSupportFileCore(name, filePath, origin));
+	}
+	async removeSupportFileCore(name, filePath, origin) {
 		const badName = this.badName(name);
 		if (badName) return {
 			ok: false,
@@ -5041,36 +5077,41 @@ var SkillLibrary = class {
 		const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
 		let dest = join(backupRoot, `skills-${stamp}`);
 		while (await this.io.exists(dest)) dest = join(backupRoot, `skills-${stamp}-${Math.random().toString(36).slice(2, 8)}`);
-		const names = await listNames(this.root, this.io);
-		await Promise.all(names.map(async (name) => {
-			await this.io.copy(this.dirOf(name), join(dest, name));
-		}));
-		const sidecars = [];
-		for (const sidecar of [usageFile(this.root), suppressedFile(this.root)]) if (await this.io.exists(sidecar)) {
-			const name = basename(sidecar);
-			await this.io.copy(sidecar, join(dest, name));
-			sidecars.push(name);
-		}
-		const archiveRoot = join(this.root, ".archive");
-		let hasArchive = false;
-		if (await this.io.exists(archiveRoot)) {
-			await this.io.copy(archiveRoot, join(dest, ".archive"));
-			hasArchive = true;
+		try {
+			const names = await listNames(this.root, this.io);
+			await Promise.all(names.map(async (name) => {
+				await this.io.copy(this.dirOf(name), join(dest, name));
+			}));
+			const sidecars = [];
+			for (const sidecar of [usageFile(this.root), suppressedFile(this.root)]) if (await this.io.exists(sidecar)) {
+				const name = basename(sidecar);
+				await this.io.copy(sidecar, join(dest, name));
+				sidecars.push(name);
+			}
+			const archiveRoot = join(this.root, ".archive");
+			let hasArchive = false;
+			if (await this.io.exists(archiveRoot)) {
+				await this.io.copy(archiveRoot, join(dest, ".archive"));
+				hasArchive = true;
+			}
+			const validExtras = extras.filter((extra) => SNAPSHOT_EXTRA_NAME_RE.test(extra.name));
+			const extraNames = validExtras.map((extra) => extra.name);
+			await Promise.all(validExtras.map(async (extra) => {
+				await this.io.writeText(join(dest, "extras", extra.name), extra.content);
+			}));
+			await this.io.writeText(join(dest, "manifest.json"), JSON.stringify({
+				reason,
+				createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+				skills: names,
+				sidecars,
+				hasArchive,
+				extras: extraNames
+			}, null, 2));
+			await this.retainSnapshots(5);
+		} catch (error) {
+			await this.io.remove(dest).catch(() => {});
+			throw error;
 		}
-		const validExtras = extras.filter((extra) => SNAPSHOT_EXTRA_NAME_RE.test(extra.name));
-		const extraNames = validExtras.map((extra) => extra.name);
-		await Promise.all(validExtras.map(async (extra) => {
-			await this.io.writeText(join(dest, "extras", extra.name), extra.content);
-		}));
-		await this.io.writeText(join(dest, "manifest.json"), JSON.stringify({
-			reason,
-			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-			skills: names,
-			sidecars,
-			hasArchive,
-			extras: extraNames
-		}, null, 2));
-		await this.retainSnapshots(5);
 		return dest;
 	}
 	/** Read and normalize a snapshot manifest; null when the file is missing or unparsable. */
@@ -5214,4 +5255,4 @@ var SkillLibrary = class {
 	}
 };
 //#endregion
-export { AUTHORING_DESCRIPTION_BAR, COMBINED_REVIEW_PLAN_PROMPT, COMBINED_REVIEW_PROMPT, COMPLETION_SKILL_REVIEW_PROMPT, CURATOR_DRY_RUN_BANNER, CURATOR_PROMPT, DEFAULT_ARCHIVE_AFTER_DAYS, DEFAULT_CONSOLIDATION_FAILURES, DEFAULT_CURATOR_INTERVAL_HOURS, DEFAULT_HEALTH_THRESHOLDS, DEFAULT_MAX_OPS_PER_PLAN, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_MIN_IDLE_HOURS, DEFAULT_MUTATION_CAP, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_LIMITS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_STALE_AFTER_DAYS, DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS, DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS, DEFAULT_SUBSTANTIVE_MIN_USER_CHARS, DEFAULT_USER_CHAR_LIMIT, DRIFT_MAX_LINE_CHARS, DRIFT_SIGNALS_VERSION, DRIFT_SIGNAL_NOUNS, DSH_AUTHORING_STANDARDS, ENTRY_DELIMITER, EVENT_ARCHIVE_PREFIX, EVENT_LOG_RETAIN_ARCHIVES, EVENT_LOG_ROTATE_AT, EVENT_LOG_VERSION, EVOLUTION_WRITE_TOOLS, EvolutionGateSet, FORBIDDEN_CONTROL_KEYS, HEALTH_STAMP_RE, LOW_QUALITY_THRESHOLD, MAINTAIN_OUTPUT_INSTRUCTION, MAINTAIN_PROMPT, MAX_DESCRIPTION_LENGTH, MAX_RESTRUCTURE_MOVES, MAX_SKILL_CONTENT_CHARS, MAX_SKILL_FILE_BYTES, MAX_SKILL_NAME_LENGTH, MEMORY_REVIEW_PROMPT, MIN_STAMP_BODY_CHARS, MUTATIONS_FILE_VERSION, MemoryStore, PATTERN_OVERLAP, PROMPT_BUNDLE, PROMPT_BUNDLE_ID, PROMPT_BUNDLE_VERSION, PROTECTED_BUILTIN_SKILLS, QUALITY_WEIGHTS, RESTRUCTURE_TARGET_RE, SKILLS_GUIDANCE, SKILL_NAME_RE, SKILL_REVIEW_PLAN_PROMPT, SKILL_REVIEW_PROMPT, SNAPSHOT_EXTRA_NAME_RE, SUPPORT_DIRS, SUPPRESSED_FILE_VERSION, SkillLibrary, THREAT_EXEMPT_HINT, advanceReview, appendEvolutionEvent, applyCuratorFields, applyCuratorLifecycleFields, applyCuratorMetaFields, assessStructureHealth, authoringFeedback, buildCuratorRunReport, buildLearnPrompt, bumpPatch, bumpUse, bumpView, clampedNumber, composePresetComposition, computeDedupGroups, computeDriftSignals, computeLifecycleTransitions, computePrefixClusters, computeQualityScores, computeScopeView, contentHash, createGateSet, duplicateHeadings, emptyRecord, evaluateThreat, eventsFile, evolutionHome, evolutionIoAdapter, evolutionRoot, findDriftSignal, foldCuratorFields, foldTurn, frontmatterBlock, frontmatterYamlUnsafeValues, getRecord, latestActivityAt, lifecycleCandidate, listEventArchives, loadMutations, loadSuppressedNames, loadUsage, makeSerialQueue, markAgentCreated, markerEntryName, memoryRoot, missingSupportPointers, mutateUsage, mutationsFile, narrowNameMatches, nodeEvolutionIo, normalizeFrontmatter, normalizeUsageRecord, observeEvent, overlongLines, parseCuratorNominations, parseEvolutionEvents, parseFrontmatter, pendingSelfCleanup, readEvolutionEvents, readEvolutionTimeline, recordMutation, redactSecrets, relatedSkillNames, renameWithRetry, renderCuratorReportMarkdown, resolveOrigins, resolveSkillsRoot, retainEventArchives, reviewPrompt, saveSuppressedNames, saveUsage, scanContentThreats, scanMemoryThreats, scanThreats, skillsRoot, suppressedFile, transactIo, updateSuppressedNames, usageFile, usageObserved, validateFrontmatter, verifyPromptBundle, writeDurableTmp, yamlPlainScalarNeedsQuotes };
+export { AUTHORING_DESCRIPTION_BAR, COMBINED_REVIEW_PLAN_PROMPT, COMBINED_REVIEW_PROMPT, COMPLETION_SKILL_REVIEW_PROMPT, CURATOR_DRY_RUN_BANNER, CURATOR_PROMPT, DEFAULT_ARCHIVE_AFTER_DAYS, DEFAULT_CONSOLIDATION_FAILURES, DEFAULT_CURATOR_INTERVAL_HOURS, DEFAULT_HEALTH_THRESHOLDS, DEFAULT_MAX_OPS_PER_PLAN, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_MIN_IDLE_HOURS, DEFAULT_MUTATION_CAP, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_LIMITS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_STALE_AFTER_DAYS, DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS, DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS, DEFAULT_SUBSTANTIVE_MIN_USER_CHARS, DEFAULT_USER_CHAR_LIMIT, DRIFT_MAX_LINE_CHARS, DRIFT_SIGNALS_VERSION, DRIFT_SIGNAL_NOUNS, DSH_AUTHORING_STANDARDS, ENTRY_DELIMITER, EVENT_ARCHIVE_PREFIX, EVENT_LOG_RETAIN_ARCHIVES, EVENT_LOG_ROTATE_AT, EVENT_LOG_VERSION, EVOLUTION_ENV_KEYS, EVOLUTION_WRITE_TOOLS, EvolutionGateSet, FORBIDDEN_CONTROL_KEYS, HEALTH_STAMP_RE, LOW_QUALITY_THRESHOLD, MAINTAIN_OUTPUT_INSTRUCTION, MAINTAIN_PROMPT, MAX_DESCRIPTION_LENGTH, MAX_RESTRUCTURE_MOVES, MAX_SKILL_CONTENT_CHARS, MAX_SKILL_FILE_BYTES, MAX_SKILL_NAME_LENGTH, MEMORY_REVIEW_PROMPT, MIN_STAMP_BODY_CHARS, MUTATIONS_FILE_VERSION, MemoryStore, PATTERN_OVERLAP, PROMPT_BUNDLE, PROMPT_BUNDLE_ID, PROMPT_BUNDLE_VERSION, PROTECTED_BUILTIN_SKILLS, QUALITY_WEIGHTS, RESTRUCTURE_TARGET_RE, SKILLS_GUIDANCE, SKILL_NAME_RE, SKILL_REVIEW_PLAN_PROMPT, SKILL_REVIEW_PROMPT, SNAPSHOT_EXTRA_NAME_RE, SUPPORT_DIRS, SUPPRESSED_FILE_VERSION, SkillLibrary, THREAT_EXEMPT_HINT, advanceReview, allowRowCollisions, appendEvolutionEvent, applyCuratorFields, applyCuratorLifecycleFields, applyCuratorMetaFields, assessStructureHealth, authoringFeedback, buildCuratorRunReport, buildLearnPrompt, bumpPatch, bumpUse, bumpView, clampedNumber, composePresetComposition, computeDedupGroups, computeDriftSignals, computeLifecycleTransitions, computePrefixClusters, computeQualityScores, computeScopeView, contentHash, createGateSet, duplicateHeadings, emptyRecord, evaluateThreat, eventsFile, evolutionHome, evolutionIoAdapter, evolutionRoot, findDriftSignal, foldCuratorFields, foldTurn, frontmatterBlock, frontmatterYamlUnsafeValues, getRecord, latestActivityAt, lifecycleCandidate, listEventArchives, loadMutations, loadSuppressedNames, loadUsage, makeSerialQueue, markAgentCreated, markerEntryName, memoryRoot, missingSupportPointers, mutateUsage, mutationsFile, narrowNameMatches, nodeEvolutionIo, normalizeFrontmatter, normalizeUsageRecord, observeEvent, overlongLines, parseCuratorNominations, parseEvolutionEvents, parseFrontmatter, pendingSelfCleanup, readEvolutionEvents, readEvolutionTimeline, recordMutation, redactSecrets, relatedSkillNames, renameWithRetry, renderCuratorReportMarkdown, resolveOrigins, resolveSkillsRoot, retainEventArchives, reviewPrompt, saveSuppressedNames, saveUsage, scanContentThreats, scanMemoryThreats, scanThreats, skillsRoot, suppressedFile, transactIo, updateSuppressedNames, usageFile, usageObserved, validateFrontmatter, verifyPromptBundle, writeDurableTmp, yamlPlainScalarNeedsQuotes };

package/lib/types/env.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Evolution environment-variable reading, single-source (WC, 0.3.56).
+ *
+ * Every `DSH_EVOLUTION_*` value the PLUGIN code reads goes through this module
+ * so the trim/whitelist patterns (v10 P2-12/13) live in exactly one place and
+ * the generated env reference can point at one behavior. Configuration-layer
+ * reads inside patch YAML `!!js` expressions (session-query path/openAt) stay
+ * in the profile config evaluation — they are NOT migrated (they are resolved
+ * at cordis config time, not plugin time) but are documented in the README
+ * env table.
+ */
+/** Plugin-side DSH_EVOLUTION_* keys (config-layer keys are documented separately). */
+export declare const EVOLUTION_ENV_KEYS: readonly ["DSH_EVOLUTION_ALLOW_ROW_COLLISIONS"];
+/** N-5 escape: `DSH_EVOLUTION_ALLOW_ROW_COLLISIONS=1` downgrades a delta-row
+ * collision from fail-loud to warn+keep-both. Any other value (including an
+ * EMPTY/whitespace string — a set-but-unset variable) keeps the fail-loud. */
+export declare function allowRowCollisions(env?: NodeJS.ProcessEnv): boolean;
+//# sourceMappingURL=env.d.ts.map

package/lib/types/index.d.ts

@@ -13,6 +13,7 @@ export * from './curator.ts';
 export * from './evolution-events.ts';
 export * from './gates.ts';
 export * from './events.ts';
+export * from './env.ts';
 export * from './io.ts';
 export * from './learn-prompt.ts';
 export * from './memory-store.ts';

package/lib/types/skill-store.d.ts

@@ -321,6 +321,7 @@ export declare class SkillLibrary {
      */
     setPinned(name: string, pinned: boolean, origin?: WriteOrigin): Promise<SkillActionResult>;
     create(name: string, content: string, origin?: WriteOrigin): Promise<SkillActionResult>;
+    private createCore;
     update(rawName: string, content: string, origin?: WriteOrigin): Promise<SkillActionResult>;
     private updateCore;
     patch(rawName: string, oldString: string, newString: string, filePath?: string, replaceAll?: boolean, origin?: WriteOrigin): Promise<SkillActionResult>;
@@ -378,6 +379,7 @@ export declare class SkillLibrary {
     writeSupportFile(rawName: string, filePath: string, content: string, origin?: WriteOrigin): Promise<SkillActionResult>;
     private writeSupportFileCore;
     removeSupportFile(rawName: string, filePath: string, origin?: WriteOrigin): Promise<SkillActionResult>;
+    private removeSupportFileCore;
     /**
      * Snapshot the recoverable skills state: active tree, usage/suppression
      * sidecars, `.archive/` and caller-supplied extras. `extras` are opaque

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-core",
   "description": "Shared stores, prompts, signals and lifecycle logic for the dsh-evolution plugin family (community build)",
-  "version": "0.3.55",
+  "version": "0.3.57",
   "publishConfig": {
     "access": "public"
   },