@lmzhen/dsh-evolution-core 0.3.64 → 0.3.65

package/lib/index.js

@@ -393,7 +393,7 @@ function nodeEvolutionIo(lockAttempts = 40) {
 				} catch {}
 				continue;
 			}
-			if (name.includes(".corrupt")) {
+			if (/\.corrupt(\.\d+)?$/.test(name)) {
 				const corruptPath = join(dir, name);
 				try {
 					const st = await stat(corruptPath);
@@ -576,29 +576,30 @@ function parseUsage(raw) {
 async function loadUsage(root, io = nodeEvolutionIo()) {
 	return parseUsage(await io.readText(usageFile(root)));
 }
-/**
-* Atomic read-modify-write on the usage sidecar (rc.50 P2-2): `task` receives
-* the map parsed from the current on-disk state and may mutate it; the result
-* is persisted inside the same transact so a second process sharing DSH_HOME
-* cannot interleave its RMW and lose a counter update. Callers keep their own
-* single-process serialize chain as the second layer.
-*/
-async function mutateUsage(root, io, task) {
+async function mutateUsage(root, io, task, options = {}) {
 	await transactIo(io, usageFile(root), async (current) => {
 		let shapePreserved = false;
+		let recovered = null;
 		if (current !== null) try {
 			const probe = JSON.parse(current);
 			if (probe === null || Array.isArray(probe) || typeof probe !== "object") shapePreserved = true;
 			else {
 				const record = probe;
-				if (Object.values(record).some((value) => value === null || typeof value !== "object" || Array.isArray(value))) shapePreserved = true;
+				const isMalformed = (value) => value === null || typeof value !== "object" || Array.isArray(value);
 				if (typeof record.version === "number" && record.version > 1) shapePreserved = true;
+				else if (Object.values(record).some(isMalformed)) {
+					const bad = Object.keys(record).filter((key) => isMalformed(record[key]));
+					const corruptPath = `${usageFile(root)}.corrupt`;
+					await io.writeText(corruptPath, current).catch(() => {});
+					recovered = JSON.stringify(Object.fromEntries(Object.entries(record).filter(([, value]) => !isMalformed(value))));
+					options.onQuarantine?.(`usage sidecar ${usageFile(root)} carried ${bad.length} malformed entr${bad.length === 1 ? "y" : "ies"} (${bad.slice(0, 5).join(", ")}); the original bytes were copied to ${corruptPath} and the remaining entries continue to be served`);
+				}
 			}
 		} catch {
 			return current;
 		}
 		if (shapePreserved) return current;
-		const map = parseUsage(current);
+		const map = parseUsage(recovered ?? current);
 		await task(map);
 		return JSON.stringify(Object.fromEntries(map.entries()), null, 2);
 	});
@@ -1976,9 +1977,16 @@ function clampedNumber(value, fallback, opts) {
 * Threat scanning for agent-authored memory and skill content.
 *
 * Ported as a small, dependency-free subset of Hermes Agent's
-* `tools/threat_patterns.py` + hermes-claw `threats.ts`. The policy is the
-* load-bearing part: ANY in-scope hit blocks. Severity and category are
-* metadata for diagnostics only.
+* `tools/threat_patterns.py` + hermes-claw `threats.ts`.
+*
+* Policy (P1-1, v19): a finding either BLOCKS the write or only REPORTS.
+* Blocking is reserved for shapes with no legitimate use in stored knowledge
+* (prompt-injection phrasing, credential exfiltration, the invisible-character
+* smuggling core). Typography and presentation characters that are legitimate
+* in ordinary prose — variation selectors (❤️), zero-width non-joiner, soft
+* hyphen from PDF paste, Arabic letter mark, Mongolian vowel separator — are
+* REPORT findings: they stay visible to operators and tests but never reject a
+* write. Blocking them turned every emoji into a security event.
 */
 const FILLER = String.raw`(?:\w+\s+){0,8}`;
 const PATTERNS = [
@@ -2145,7 +2153,9 @@ const PATTERNS = [
 		regex: /-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/
 	}
 ];
-const ZERO_WIDTH_CHARS = new RegExp(`[\\u00ad\\u034f\\u061c\\u180e\\u200b\\u200c\\u200d\\u2060\\u2061\\u2062\\u2063\\u2064\\u206a-\\u206f\\ufeff\\ufe00-\\ufe0f]|\\u{e0000}-\\u{e007f}`, "u");
+const ZERO_WIDTH_CHARS = new RegExp(`[\\u034f\\u200b\\u2060\\u2061\\u2062\\u2063\\u2064\\u206a-\\u206f\\ufeff\\u{e0000}-\\u{e007f}]`, "u");
+const ZWJ_OUTSIDE_EMOJI = /(?<!\p{Extended_Pictographic})\u200d(?!\p{Extended_Pictographic})/u;
+const TYPOGRAPHY_CHARS = /[\u00ad\u061c\u180e\u200c\ufe00-\ufe0f]/;
 const BIDI_CHARS = /[\u202a-\u202e\u2066-\u2069]/;
 const SCOPE_ORDER = {
 	all: 1,
@@ -2172,11 +2182,17 @@ function scanThreats(text, scope = "strict", maxScanChars = 65536, options = NO_
 	const windowSize = clampedNumber(maxScanChars, 65536, { min: 4097 });
 	const findings = [];
 	const excluded = new Set(options.excludeLabels ?? []);
-	if (ZERO_WIDTH_CHARS.test(text) && !excluded.has("unicode_zero_width")) findings.push({
+	if ((ZERO_WIDTH_CHARS.test(text) || ZWJ_OUTSIDE_EMOJI.test(text)) && !excluded.has("unicode_zero_width")) findings.push({
 		label: "unicode_zero_width",
 		category: "unicode_obfuscation",
 		scope: "all"
 	});
+	if (TYPOGRAPHY_CHARS.test(text) && !excluded.has("unicode_typography")) findings.push({
+		label: "unicode_typography",
+		category: "unicode_obfuscation",
+		scope: "all",
+		severity: "report"
+	});
 	if (BIDI_CHARS.test(text) && !excluded.has("unicode_bidi_override")) findings.push({
 		label: "unicode_bidi_override",
 		category: "unicode_obfuscation",
@@ -2205,11 +2221,13 @@ function scanThreats(text, scope = "strict", maxScanChars = 65536, options = NO_
 	}
 	return findings;
 }
-/** Blocking policy: any hit blocks. `severity` is deliberately not a gate. */
+/** Blocking policy (P1-1, v19): a finding blocks unless it is explicitly
+* `report`-only. Pattern findings carry no severity and therefore block as
+* before. */
 function evaluateThreat(text, scope = "strict", maxScanChars = 65536, options = NO_SCAN_OPTIONS) {
 	const findings = scanThreats(text, scope, maxScanChars, options);
 	return {
-		blocked: findings.length > 0,
+		blocked: findings.some((finding) => finding.severity !== "report"),
 		findings
 	};
 }
@@ -3140,7 +3158,7 @@ const SECRET_PATTERNS = [
 	["jwt", /eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g],
 	["bearer credential", /Bearer[\s]+[a-z0-9._~+/=\-]{16,}/gi]
 ];
-const INLINE_ASSIGNMENT_PATTERN = /* @__PURE__ */ new RegExp("(^|[^\\w-])([\\w-]{0,64}[_\\-])?((?:token|api[_-]?key|secret|password|passwd)(?:[_\\-][\\w-]{0,64})?)\\b([\\s]*[:=][\\s]*)(?:\"([^\"\\r\\n]*)\"|'([^'\\r\\n]*)'|([^\\r\\n]+))", "gi");
+const INLINE_ASSIGNMENT_PATTERN = /* @__PURE__ */ new RegExp("(^|[^\\w-])([\\w-]{0,64}[_\\-])?((?:token|api[_-]?key|secret|password|passwd)(?:[_\\-][\\w-]{0,64})?)\\b([\\t ]*[:=][\\t ]*)([^\\r\\n]+)", "gi");
 /**
 * Mask credential-shaped text before it crosses a session boundary.
 * @param text - the text about to be sent to a model outside this session.
@@ -3836,6 +3854,13 @@ function authoringFeedback(frontmatter) {
 		lines
 	};
 }
+/** A1-15 (v18) / P2-2 (v19): the io layer marks an error `committed: true` when
+* the rename landed and only the directory fsync failed. Every single-file
+* writer must treat that as "written, durability unconfirmed" — never as a
+* plain failure (which a caller would retry, or a two-phase caller roll back). */
+function isCommittedOnly(error) {
+	return error?.committed === true;
+}
 async function listNames(root, io) {
 	const entries = await io.list(root);
 	const names = [];
@@ -4392,6 +4417,7 @@ var SkillLibrary = class {
 			ok: false,
 			message: "Only the foreground (user or the main agent) may pin or unpin skills."
 		};
+		let durabilityWarning = "";
 		const dir = this.dirOf(normalized);
 		const marker = markerPath(dir, "pinned");
 		const existing = await this.io.exists(marker);
@@ -4409,12 +4435,17 @@ var SkillLibrary = class {
 			ok: false,
 			message: `Skill "${normalized}" not found.`
 		};
-		if (pinned) await this.io.writeText(marker, "");
+		if (pinned) try {
+			await this.io.writeText(marker, "");
+		} catch (error) {
+			if (!isCommittedOnly(error)) throw error;
+			durabilityWarning = error instanceof Error ? error.message : String(error);
+		}
 		else await this.io.remove(marker);
 		await this.audit(normalized, pinned ? "pin" : "unpin", null, null, pinned ? "pinned" : "unpinned");
 		return {
 			ok: true,
-			message: pinned ? `Skill "${normalized}" pinned: protected from deletion, background review, and the lifecycle.` : `Skill "${normalized}" unpinned.`,
+			message: `${pinned ? `Skill "${normalized}" pinned: protected from deletion, background review, and the lifecycle.` : `Skill "${normalized}" unpinned.`}${durabilityWarning === "" ? "" : ` (warning: the write landed but the directory fsync failed — durability unconfirmed: ${durabilityWarning})`}`,
 			path: dir
 		};
 	}
@@ -4465,20 +4496,31 @@ var SkillLibrary = class {
 		const createPath = join(dir, "SKILL.md");
 		let existsAtCommit = false;
 		let taskRan = false;
-		if (this.transact) await this.transact(this.io, createPath, (current) => {
-			taskRan = true;
-			if (current !== null) {
-				existsAtCommit = true;
-				return current;
-			}
-			return onDisk;
-		});
+		let createDurabilityWarning = "";
+		if (this.transact) try {
+			await this.transact(this.io, createPath, (current) => {
+				taskRan = true;
+				if (current !== null) {
+					existsAtCommit = true;
+					return current;
+				}
+				return onDisk;
+			});
+		} catch (error) {
+			if (!isCommittedOnly(error)) throw error;
+			createDurabilityWarning = error instanceof Error ? error.message : String(error);
+		}
 		else if (await this.io.exists(createPath)) {
 			taskRan = true;
 			existsAtCommit = true;
 		} else {
 			taskRan = true;
-			await this.io.writeText(createPath, onDisk);
+			try {
+				await this.io.writeText(createPath, onDisk);
+			} catch (error) {
+				if (!isCommittedOnly(error)) throw error;
+				createDurabilityWarning = error instanceof Error ? error.message : String(error);
+			}
 		}
 		if (!taskRan) return {
 			ok: false,
@@ -4497,7 +4539,7 @@ var SkillLibrary = class {
 		});
 		return {
 			ok: true,
-			message: `Skill "${normalized}" created.`,
+			message: `Skill "${normalized}" created.${createDurabilityWarning === "" ? "" : ` (warning: the write landed but the directory fsync failed — durability unconfirmed: ${createDurabilityWarning})`}`,
 			path: dir,
 			...norm.changed ? { normalizedFrontmatterFields: norm.fields } : {}
 		};
@@ -4848,15 +4890,23 @@ var SkillLibrary = class {
 	}
 	/** A1-4 (v18): a manifest-declared name is copied with `join(root, name)`;
 	* only a single, non-traversing path component is safe. Dotfiles
-	* (`.usage.json`) stay allowed — sidecars are legitimately dot-prefixed. */
+	* (`.usage.json`) stay allowed — sidecars are legitimately dot-prefixed.
+	* P2-4 (v19): a non-string entry (`skills: [123]`) is refused structurally
+	* instead of throwing `name.includes is not a function`. */
 	safeSnapshotEntryName(name) {
+		if (typeof name !== "string") return false;
 		return name !== "" && name !== "." && name !== ".." && !name.includes("/") && !name.includes("\\") && basename(name) === name;
 	}
 	/** A1-7 (v18): a root-level lock whose holder is alive must refuse the
 	* restore; a dead residue is swept so a crashed writer cannot block
 	* recovery. A non-lock body shape is left alone (user file). */
 	async refuseLiveLockOrSweep(lockPath, label) {
-		const body = await this.io.readText(lockPath).catch(() => null);
+		let body;
+		try {
+			body = await this.io.readText(lockPath);
+		} catch (error) {
+			throw new Error(`snapshot restore refused: cannot verify ${label} (${error instanceof Error ? error.message : String(error)}); a live writer may hold it`);
+		}
 		if (body === null) return;
 		const match = /^(\d+):[0-9a-f]*$/.exec(body.trim());
 		if (match === null) return;
@@ -5660,13 +5710,19 @@ var SkillLibrary = class {
 	*/
 	async restoreSnapshotIntoRoot(snapshotPath) {
 		const manifest = await this.readSnapshotManifest(snapshotPath);
-		if (manifest === null) {
-			if (await this.io.exists(join(snapshotPath, "manifest.json"))) throw new Error(`snapshot ${snapshotPath} has an unreadable manifest.json; refusing to clear the active tree`);
-		} else {
-			for (const name of [...manifest.skills, ...manifest.sidecars]) if (!this.safeSnapshotEntryName(name)) throw new Error(`snapshot ${snapshotPath} declares an unsafe entry name ${JSON.stringify(name)}; refusing to restore`);
-			if (manifest.skills.length === 0) {
-				if ((await this.io.list(snapshotPath)).some((entry) => entry !== "manifest.json" && entry !== "extras" && entry !== ".archive")) throw new Error(`snapshot ${snapshotPath} declares no skills but contains entries; refusing to clear the active tree`);
-			}
+		if (manifest === null) throw new Error(await this.io.exists(join(snapshotPath, "manifest.json")) ? `snapshot ${snapshotPath} has an unreadable manifest.json; refusing to clear the active tree` : `snapshot ${snapshotPath} has no readable manifest.json; refusing to restore`);
+		for (const name of [...manifest.skills, ...manifest.sidecars]) if (!this.safeSnapshotEntryName(name)) throw new Error(`snapshot ${snapshotPath} declares an unsafe entry name ${JSON.stringify(name)}; refusing to restore`);
+		if (manifest.skills.length === 0) {
+			const snapshotEntries = await this.io.list(snapshotPath);
+			const declared = new Set([
+				"manifest.json",
+				"extras",
+				".archive",
+				...manifest.skills,
+				...manifest.sidecars
+			]);
+			const undeclared = snapshotEntries.filter((entry) => !declared.has(entry));
+			if (undeclared.length > 0) throw new Error(`snapshot ${snapshotPath} declares no skills but contains undeclared entries (${undeclared.join(", ")}); refusing to clear the active tree`);
 		}
 		let rootEntries;
 		try {
@@ -5686,17 +5742,16 @@ var SkillLibrary = class {
 				if (await this.hasWriteLock(dir)) throw new Error(`snapshot restore refused: skill "${entry}" is being written (write lock present); retry once the write completes`);
 			}
 		}
-		const restoresSuppressed = manifest !== null && manifest.sidecars.includes(".curator-suppressed.json");
+		const restoresSuppressed = manifest.sidecars.includes(".curator-suppressed.json");
 		for (const entry of rootEntries) {
 			if (entry === ".archive" || entry === ".backups" || entry === ".mutations.json") continue;
 			if (entry === ".curator-suppressed.json" && restoresSuppressed) continue;
 			if (entry.endsWith(".lock") || entry.endsWith(`.lock.next`)) continue;
 			await this.io.remove(join(this.root, entry));
 		}
-		if (manifest === null) throw new Error(`snapshot ${snapshotPath} has no readable manifest.json; refusing to restore`);
-		else {
-			for (const name of manifest.skills) await this.io.copy(join(snapshotPath, name), join(this.root, name));
-			for (const sidecar of manifest.sidecars) await this.io.copy(join(snapshotPath, sidecar), join(this.root, sidecar));
+		for (const name of manifest.skills) await this.io.copy(join(snapshotPath, name), join(this.root, name));
+		for (const sidecar of manifest.sidecars) await this.io.copy(join(snapshotPath, sidecar), join(this.root, sidecar));
+		{
 			const archiveRoot = join(this.root, ".archive");
 			if (manifest.hasArchive === true) {
 				await this.io.remove(archiveRoot);

package/lib/types/skill-store.d.ts

@@ -412,7 +412,9 @@ export declare class SkillLibrary {
     private sweepLockIfStranded;
     /** A1-4 (v18): a manifest-declared name is copied with `join(root, name)`;
      * only a single, non-traversing path component is safe. Dotfiles
-     * (`.usage.json`) stay allowed — sidecars are legitimately dot-prefixed. */
+     * (`.usage.json`) stay allowed — sidecars are legitimately dot-prefixed.
+     * P2-4 (v19): a non-string entry (`skills: [123]`) is refused structurally
+     * instead of throwing `name.includes is not a function`. */
     private safeSnapshotEntryName;
     /** A1-7 (v18): a root-level lock whose holder is alive must refuse the
      * restore; a dead residue is swept so a crashed writer cannot block

package/lib/types/threats.d.ts

@@ -2,15 +2,25 @@
  * Threat scanning for agent-authored memory and skill content.
  *
  * Ported as a small, dependency-free subset of Hermes Agent's
- * `tools/threat_patterns.py` + hermes-claw `threats.ts`. The policy is the
- * load-bearing part: ANY in-scope hit blocks. Severity and category are
- * metadata for diagnostics only.
+ * `tools/threat_patterns.py` + hermes-claw `threats.ts`.
+ *
+ * Policy (P1-1, v19): a finding either BLOCKS the write or only REPORTS.
+ * Blocking is reserved for shapes with no legitimate use in stored knowledge
+ * (prompt-injection phrasing, credential exfiltration, the invisible-character
+ * smuggling core). Typography and presentation characters that are legitimate
+ * in ordinary prose — variation selectors (❤️), zero-width non-joiner, soft
+ * hyphen from PDF paste, Arabic letter mark, Mongolian vowel separator — are
+ * REPORT findings: they stay visible to operators and tests but never reject a
+ * write. Blocking them turned every emoji into a security event.
  */
 export type ThreatScope = 'all' | 'context' | 'strict';
 export interface ThreatFinding {
     label: string;
     category: string;
     scope: ThreatScope;
+    /** P1-1 (v19): `block` (default) refuses the write; `report` is an audit
+     * trail entry only. Absent means `block`. */
+    severity?: 'block' | 'report';
 }
 /**
  * Optional scan controls. Default behavior (`options` omitted) is unchanged:
@@ -39,7 +49,9 @@ export declare const PATTERN_OVERLAP = 4096;
  * characters (skill files may run to 100,000) is no longer a blind zone.
  */
 export declare function scanThreats(text: string, scope?: ThreatScope, maxScanChars?: number, options?: ScanOptions): ThreatFinding[];
-/** Blocking policy: any hit blocks. `severity` is deliberately not a gate. */
+/** Blocking policy (P1-1, v19): a finding blocks unless it is explicitly
+ * `report`-only. Pattern findings carry no severity and therefore block as
+ * before. */
 export declare function evaluateThreat(text: string, scope?: ThreatScope, maxScanChars?: number, options?: ScanOptions): {
     blocked: boolean;
     findings: ThreatFinding[];

package/lib/types/usage.d.ts

@@ -52,7 +52,13 @@ export declare function loadUsage(root: string, io?: EvolutionIoLike): Promise<U
  * cannot interleave its RMW and lose a counter update. Callers keep their own
  * single-process serialize chain as the second layer.
  */
-export declare function mutateUsage(root: string, io: EvolutionIoLike, task: (map: UsageMap) => void | Promise<void>): Promise<void>;
+export interface UsageMutateOptions {
+    /** P2-9 (v19): called when malformed entries had to be quarantined before the
+     * task could run. The guard preserves bytes AND keeps the facility working;
+     * this callback is how that stays observable. */
+    onQuarantine?: ((message: string) => void) | undefined;
+}
+export declare function mutateUsage(root: string, io: EvolutionIoLike, task: (map: UsageMap) => void | Promise<void>, options?: UsageMutateOptions): Promise<void>;
 /**
  * Curator-owned usage fields (rc.67 K-2): the curator writes ONLY this set —
  * lifecycle state, archive stamp, the six-factor quality pair, and the

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-core",
   "description": "Shared stores, prompts, signals and lifecycle logic for the dsh-evolution plugin family (community build)",
-  "version": "0.3.64",
+  "version": "0.3.65",
   "publishConfig": {
     "access": "public"
   },