@lmzhen/dsh-evolution-review 0.3.70 → 0.3.71

package/lib/index.js

@@ -342,13 +342,10 @@ function apply(ctx, rawConfig = {}) {
 		const io = ctx.get("evolutionIo");
 		if (!io) return hashes;
 		const library = new SkillLibrary(resolveSkillsRoot({ root: rootConfig.root }), evolutionIoAdapter(() => io.provider()));
-		for (const summary of await library.list().catch((error) => {
+		for (const summary of await library.list({ withContent: true }).catch((error) => {
 			ctx.logger.warn(`dsh-evolution-review: skill tree scan failed (${error instanceof Error ? error.message : String(error)}) — pre-run staleness hashes are unavailable; full-content updates will not be drift-checked this review`);
 			return [];
-		})) {
-			const text = await library.read(summary.name).catch(() => null);
-			if (text !== null) hashes.set(summary.name, contentHash(text));
-		}
+		})) if (summary.content !== void 0) hashes.set(summary.name, contentHash(summary.content));
 		return hashes;
 	}
 	async function trySubagentReview(session, agent, kind, signal) {
@@ -559,8 +556,9 @@ function apply(ctx, rawConfig = {}) {
 					...op,
 					evidence: op.evidence
 				};
+				let stageCurrent = null;
 				if ((args.action === "update" || args.action === "edit") && hashLibrary && typeof args.name === "string" && args.name !== "") {
-					const stageCurrent = await hashLibrary.read(args.name).catch(() => null);
+					stageCurrent = await hashLibrary.read(args.name).catch(() => null);
 					if (stageCurrent !== null) args.staged_from_sha256 = contentHash(stageCurrent);
 				}
 				if ((args.action === "write_file" || args.action === "remove_file") && hashLibrary && typeof args.name === "string" && args.name !== "" && typeof args.file_path === "string" && args.file_path !== "") {
@@ -570,7 +568,7 @@ function apply(ctx, rawConfig = {}) {
 				const opName = typeof args.name === "string" ? args.name : "";
 				const hashChecked = (args.action === "update" || args.action === "edit") && opName !== "" && preRunHashes?.has(opName) === true;
 				if (hashChecked) {
-					const live = await hashLibrary?.read(opName).catch(() => null) ?? null;
+					const live = stageCurrent;
 					const preRun = preRunHashes.get(opName);
 					if (live === null || preRun !== void 0 && contentHash(live) !== preRun) {
 						ok = false;
@@ -679,32 +677,14 @@ function apply(ctx, rawConfig = {}) {
 				ok: false,
 				message: `Skill "${name}" is protected by the current policy (protectedSkillNames); autonomous writes are refused.`
 			};
-			if (op.action === "write_file" || op.action === "remove_file") {
-				const expected = op.staged_from_sha256;
-				if (typeof expected === "string" && expected !== "") {
-					const current = await library.readSupportFile(name, op.file_path ?? "").catch(() => void 0);
-					const actual = current === void 0 || current === null ? "absent" : contentHash(current);
-					if (current === void 0 || actual !== expected) return {
-						ok: false,
-						message: `Support file "${op.file_path ?? ""}" of "${name}" changed since this plan was produced — the staged file operation was refused as stale. Re-read the skill tree and produce a fresh plan.`
-					};
-				}
-			}
 			if (op.action === "create") {
 				const created = await library.create(name, op.content ?? "", origin);
 				if (created.ok) await ctx.get("skillUsage")?.markAgentCreated?.(name);
 				return created;
 			}
 			if (op.action === "edit" || op.action === "update") {
-				const expected = op.staged_from_sha256;
-				if (typeof expected === "string" && expected !== "") {
-					const current = await library.read(name).catch(() => null);
-					if (current !== null && contentHash(current) !== expected) return {
-						ok: false,
-						message: `Skill "${name}" changed since this plan was produced — the full-content update was refused as stale. Re-read the skill and produce a fresh plan.`
-					};
-				}
-				const updated = await library.update(name, op.content ?? "", origin);
+				const updated = await library.update(name, op.content ?? "", origin, anchorOf(op));
+				if (updated.stale === true) return staleRefusal(updated, name, op.file_path);
 				if (updated.ok) await ctx.get("skillUsage")?.record?.(name, "patch").catch(() => {});
 				return updated;
 			}
@@ -724,17 +704,14 @@ function apply(ctx, rawConfig = {}) {
 				return archived;
 			}
 			if (op.action === "write_file" || op.action === "remove_file") {
-				const expected = op.staged_from_sha256;
-				if (typeof expected === "string" && expected !== "") {
-					const current = await library.readSupportFile(name, op.file_path ?? "").catch(() => void 0);
-					const actual = current === void 0 || current === null ? "absent" : contentHash(current);
-					if (current === void 0 || actual !== expected) return {
-						ok: false,
-						message: `Support file "${op.file_path ?? ""}" of "${name}" changed since this plan was produced — the staged file operation was refused as stale. Re-read the skill tree and produce a fresh plan.`
-					};
+				const anchor = anchorOf(op);
+				if (op.action === "write_file") {
+					const written = await library.writeSupportFile(name, op.file_path ?? "", op.file_content ?? "", origin, anchor);
+					if (written.stale === true) return staleRefusal(written, name, op.file_path);
+					return written;
 				}
-				if (op.action === "write_file") return await library.writeSupportFile(name, op.file_path ?? "", op.file_content ?? "", origin);
-				const removedSupport = await library.removeSupportFile(name, op.file_path ?? "", origin);
+				const removedSupport = await library.removeSupportFile(name, op.file_path ?? "", origin, anchor);
+				if (removedSupport.stale === true) return staleRefusal(removedSupport, name, op.file_path);
 				if (removedSupport.ok) await ctx.get("skillUsage")?.record?.(name, "patch").catch(() => {});
 				return removedSupport;
 			}
@@ -771,6 +748,43 @@ function shouldCompletionReview(reason, sessionToolCalls, minToolCalls) {
 * `skill_search` discovery pair, so that branch was dead. `skill_manage` has no
 * per-skill read action (its `list`/`review` are whole-library), so a specific
 * skill read through it cannot be tracked — see README Known Limitations. */
+/**
+* v35 C9: the staging anchor of one accepted plan op, in the shape the library
+* verifies against the bytes it reads under the write's own lock. The `absent`
+* sentinel is the same one the tool's staging attaches for a support file that
+* did not exist when the plan was produced.
+* The staged field rides OUTSIDE the plan schema (the staging channel attaches
+* it to the op payload), so it is read defensively rather than typed on SkillOp.
+* @param op - one accepted plan op.
+* @returns the anchor, or `undefined` when the op carries none.
+*/
+function anchorOf(op) {
+	const expected = op.staged_from_sha256;
+	if (typeof expected !== "string" || expected === "") return void 0;
+	return expected === "absent" ? { absent: true } : { sha256: expected };
+}
+/**
+* Translate the library's anchor refusal into this channel's staging wording.
+* The library reports WHICH drift it saw (drift / missing / unverifiable); the
+* vocabulary ("this plan was produced", "produce a fresh plan") is the review
+* channel's. A body op whose skill vanished keeps the historical not-found
+* report: the former lock-free check only refused on a DRIFTED body, so a
+* deleted target fell through to the write's own not-found result.
+* @param result - the library's stale result.
+* @param name - the skill the op targets.
+* @param filePath - the support-file path for file ops; omitted for body ops.
+* @returns the refusal to return from the direct path.
+*/
+function staleRefusal(result, name, filePath) {
+	if (filePath === void 0 && result.anchor === "missing") return {
+		ok: false,
+		message: `Skill "${name}" not found.`
+	};
+	return {
+		ok: false,
+		message: filePath === void 0 ? `Skill "${name}" changed since this plan was produced — the full-content update was refused as stale. Re-read the skill and produce a fresh plan.` : `Support file "${filePath}" of "${name}" changed since this plan was produced — the staged file operation was refused as stale. Re-read the skill tree and produce a fresh plan.`
+	};
+}
 function collectReadSkillNames(session) {
 	const callNames = /* @__PURE__ */ new Map();
 	const okCallIds = /* @__PURE__ */ new Set();

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-review",
   "description": "Background review orchestration (community build)",
-  "version": "0.3.70",
+  "version": "0.3.71",
   "publishConfig": {
     "access": "public"
   },
@@ -31,9 +31,9 @@
   "license": "MIT",
   "dependencies": {
     "@deepseek-ai/schemastery": "^3.18.1",
-    "@lmzhen/dsh-evolution-approval": "^0.3.70",
-    "@lmzhen/dsh-evolution-core": "^0.3.70",
-    "@lmzhen/dsh-evolution-plan-validator": "^0.3.70"
+    "@lmzhen/dsh-evolution-approval": "^0.3.71",
+    "@lmzhen/dsh-evolution-core": "^0.3.71",
+    "@lmzhen/dsh-evolution-plan-validator": "^0.3.71"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
@@ -42,8 +42,8 @@
     "@deepseek-ai/dsh-llm": "^0.1.5-rc.2",
     "@deepseek-ai/dsh-session": "^0.1.5-rc.2",
     "@deepseek-ai/dsh-tools": "^0.1.5-rc.2",
-    "@lmzhen/dsh-evolution-state": "^0.3.70",
-    "@lmzhen/dsh-evolution-policy": "^0.3.70"
+    "@lmzhen/dsh-evolution-state": "^0.3.71",
+    "@lmzhen/dsh-evolution-policy": "^0.3.71"
   },
   "devDependencies": {
     "@deepseek-ai/dsh-agent": "^0.1.5-rc.2",
@@ -54,10 +54,10 @@
     "@deepseek-ai/dsh-session-persistence": "^0.1.5-rc.2",
     "@deepseek-ai/dsh-session-persistence-jsonl": "^0.1.5-rc.2",
     "@deepseek-ai/dsh-tools": "^0.1.5-rc.2",
-    "@lmzhen/dsh-evolution-approval": "^0.3.70",
-    "@lmzhen/dsh-evolution-core": "^0.3.70",
-    "@lmzhen/dsh-evolution-curator": "^0.3.70",
-    "@lmzhen/dsh-evolution-plan-validator": "^0.3.70",
-    "@lmzhen/dsh-evolution-state": "^0.3.70"
+    "@lmzhen/dsh-evolution-approval": "^0.3.71",
+    "@lmzhen/dsh-evolution-core": "^0.3.71",
+    "@lmzhen/dsh-evolution-curator": "^0.3.71",
+    "@lmzhen/dsh-evolution-plan-validator": "^0.3.71",
+    "@lmzhen/dsh-evolution-state": "^0.3.71"
   }
 }