intentdna 1.4.8 → 1.5.1

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "intentdna",
       "description": "DNA template compilation + runtime enforcement",
-      "version": "1.4.7",
+      "version": "1.4.9",
       "source": "./"
     }
   ]

package/.claude-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "intentdna",
-  "version": "1.4.7",
+  "version": "1.4.9",
   "description": "Declarative policy layer for AI agent governance"
 }

package/dist/cli/commands/init.js

@@ -7,10 +7,12 @@ import { writeFile, readFile, readdir, mkdir, copyFile, access } from "node:fs/p
 import { resolve, dirname, basename } from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseYAML } from "../../schema/yaml-parser.js";
+import { getPackageVersion, sanitizeTemplateName } from "../util/version.js";
 import { validateDNA } from "../../schema/validate.js";
 import { askString, askChoice, askNumber, askYesNo, closePrompt } from "../util/prompt.js";
 const TEMPLATES_DIR = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..", "templates");
 const PROJECT_TEMPLATES_DIR = ".dna/templates";
+const MULTI_CONFIG_DIR = ".dna/configs";
 async function dirExists(path) {
     try {
         await access(path);
@@ -63,18 +65,40 @@ async function listTemplates() {
     return results;
 }
 /**
- * Inject _source_template field after the `type:` line in YAML content.
+ * Inject _source_template and _template_version fields after the namespace/type line in YAML content.
  */
-function injectSourceTemplate(content, templateName) {
-    // Insert after the last top-level field before genes/contexts/roles/etc
+function injectSourceTemplate(content, templateName, version) {
     const marker = /^(namespace:\s*.+)$/m;
     const typeMarker = /^(type:\s*.+)$/m;
     const match = content.match(marker) || content.match(typeMarker);
+    const versionLine = version ? `\n_template_version: "${version}"` : "";
     if (match) {
-        return content.replace(match[0], `${match[0]}\n_source_template: ${templateName}`);
+        return content.replace(match[0], `${match[0]}\n_source_template: ${templateName}${versionLine}`);
+    }
+    return `_source_template: ${templateName}${versionLine}\n${content}`;
+}
+/**
+ * Check namespace collision against existing configs in .dna/configs/.
+ */
+async function checkNamespaceAgainstExisting(namespace, templateName) {
+    if (!namespace)
+        return;
+    try {
+        const files = await readdir(MULTI_CONFIG_DIR);
+        for (const f of files.filter(f => f.endsWith(".yaml") || f.endsWith(".yml"))) {
+            const content = await readFile(resolve(MULTI_CONFIG_DIR, f), "utf-8");
+            const data = parseYAML(content);
+            const existingNs = typeof data.namespace === "string" ? data.namespace : undefined;
+            if (existingNs === namespace && f !== `${templateName}.yaml`) {
+                throw new Error(`Namespace "${namespace}" conflict: already used by ${f}. Each template must have a unique namespace.`);
+            }
+        }
+    }
+    catch (err) {
+        if (err instanceof Error && err.message.includes("conflict"))
+            throw err;
+        // Dir doesn't exist yet — no collision possible
     }
-    // Fallback: prepend
-    return `_source_template: ${templateName}\n${content}`;
 }
 /**
  * Infer template name from a DNA config's id field.
@@ -86,18 +110,31 @@ function inferTemplateName(id) {
     return id.slice("template_".length).replace(/_/g, "-");
 }
 /**
- * Auto-detect the DNA config file path.
+ * Auto-detect DNA config file(s) for upgrade.
+ * Priority: .dna/configs/*.yaml (multi-config) > legacy single-config
  */
-async function autoDetectConfig() {
+async function autoDetectConfigsForUpgrade() {
+    // Priority 1: .dna/configs/*.yaml (multi-config)
+    try {
+        const files = await readdir(MULTI_CONFIG_DIR);
+        const yamls = files
+            .filter(f => f.endsWith(".yaml") || f.endsWith(".yml"))
+            .sort()
+            .map(f => resolve(MULTI_CONFIG_DIR, f));
+        if (yamls.length > 0)
+            return yamls;
+    }
+    catch { /* dir doesn't exist */ }
+    // Fallback: legacy single-config paths
     const candidates = [
         ".dna/config.yaml", ".dna/config.yml", ".dna/config.json",
         ".dna.yaml", ".dna.yml", ".dna.json",
     ];
     for (const name of candidates) {
         if (await dirExists(name))
-            return name;
+            return [name];
     }
-    return null;
+    return [];
 }
 /**
  * Upgrade config from a newer template version while preserving user-filled variables.
@@ -127,8 +164,9 @@ async function upgradeConfig(configPath, templateName) {
     const srcDir = found.source === "project" ? PROJECT_TEMPLATES_DIR : TEMPLATES_DIR;
     const srcPath = resolve(srcDir, `${found.name}.dna.yaml`);
     let newContent = await readFile(srcPath, "utf-8");
-    // 4. Inject _source_template
-    newContent = injectSourceTemplate(newContent, found.name);
+    // 4. Inject _source_template and _template_version
+    const pkgVersion = await getPackageVersion();
+    newContent = injectSourceTemplate(newContent, found.name, pkgVersion ?? undefined);
     // 5. Replace VariableDef entries with user values where they exist
     for (const [key, value] of Object.entries(userVars)) {
         // Match multi-line VariableDef: "key:\n    description: ...\n    default: ..."
@@ -148,27 +186,52 @@ async function upgradeConfig(configPath, templateName) {
     return 0;
 }
 export async function runInit(opts) {
-    // Upgrade mode: update template while preserving user variables
+    // Upgrade mode: update template(s) while preserving user variables
     if (opts.upgrade !== undefined) {
-        const configPath = await autoDetectConfig();
-        if (!configPath) {
+        const configPaths = await autoDetectConfigsForUpgrade();
+        if (configPaths.length === 0) {
             process.stderr.write("No DNA config found. Run `dna init --template <name>` first.\n");
             return 2;
         }
-        let templateName = typeof opts.upgrade === "string" ? opts.upgrade : undefined;
-        // Auto-infer template name if not specified
-        if (!templateName) {
+        // If --upgrade <name> (non-empty string), find the specific config
+        if (typeof opts.upgrade === "string" && opts.upgrade.length > 0) {
+            // Sequential scan to find config by _source_template
+            let targetPath;
+            for (const p of configPaths) {
+                const content = await readFile(p, "utf-8");
+                const data = parseYAML(content);
+                if (data._source_template === opts.upgrade) {
+                    targetPath = p;
+                    break;
+                }
+            }
+            if (!targetPath) {
+                // Try direct template name match on filename
+                targetPath = configPaths.find(p => basename(p).replace(/\.(yaml|yml)$/, "") === opts.upgrade);
+            }
+            if (!targetPath) {
+                process.stderr.write(`Config for template "${opts.upgrade}" not found in: ${configPaths.map(p => basename(p)).join(", ")}\n`);
+                return 2;
+            }
+            return upgradeConfig(targetPath, opts.upgrade);
+        }
+        // --upgrade (no arg): upgrade all configs
+        let exitCode = 0;
+        for (const configPath of configPaths) {
             const content = await readFile(configPath, "utf-8");
             const data = parseYAML(content);
-            templateName = typeof data._source_template === "string"
+            let templateName = typeof data._source_template === "string"
                 ? data._source_template
                 : inferTemplateName(typeof data.id === "string" ? data.id : "") ?? undefined;
+            if (!templateName) {
+                process.stderr.write(`Cannot infer template for ${basename(configPath)}. Skipping.\n`);
+                continue;
+            }
+            const code = await upgradeConfig(configPath, templateName);
+            if (code !== 0)
+                exitCode = code;
         }
-        if (!templateName) {
-            process.stderr.write("Cannot infer template name. Specify it: dna init --upgrade <template-name>\n");
-            return 2;
-        }
-        return upgradeConfig(configPath, templateName);
+        return exitCode;
     }
     // Register mode: copy a template into .dna/templates/ with namespace uniqueness check
     if (opts.register) {
@@ -226,10 +289,17 @@ export async function runInit(opts) {
         const srcDir = found.source === "project" ? PROJECT_TEMPLATES_DIR : TEMPLATES_DIR;
         const srcPath = resolve(srcDir, `${found.name}.dna.yaml`);
         const content = await readFile(srcPath, "utf-8");
-        // Inject _source_template metadata for upgrade tracking
-        const contentWithSource = injectSourceTemplate(content, found.name);
-        const outPath = opts.output || ".dna/config.yaml";
-        // Ensure .dna/ directory exists
+        // Inject _source_template and _template_version metadata for upgrade tracking
+        const pkgVersion = await getPackageVersion();
+        const contentWithSource = injectSourceTemplate(content, found.name, pkgVersion ?? undefined);
+        // Check namespace collision against existing configs
+        const srcData = parseYAML(content);
+        const srcNs = typeof srcData.namespace === "string" ? srcData.namespace : undefined;
+        await checkNamespaceAgainstExisting(srcNs, found.name);
+        // Default output: .dna/configs/<template-name>.yaml (multi-config)
+        const safeName = sanitizeTemplateName(found.name);
+        const outPath = opts.output || resolve(MULTI_CONFIG_DIR, `${safeName}.yaml`);
+        // Ensure output directory exists
         const outDir = resolve(outPath, "..");
         await mkdir(outDir, { recursive: true });
         await writeFile(outPath, contentWithSource, "utf-8");

package/dist/cli/commands/sync.d.ts

@@ -40,4 +40,18 @@ export interface SyncOptions {
  *   → ALSO write settings.json to register dna-hook events
  */
 export declare function detectMode(): Promise<"plugin" | "bin">;
+/**
+ * Auto-detect DNA configs: multi-config (.dna/configs/*.yaml) or legacy single-config.
+ * Returns array of absolute paths.
+ */
+export declare function autoDetectConfigs(): Promise<string[]>;
+/**
+ * Read the current package version from package.json.
+ */
+export { getPackageVersion } from "../util/version.js";
+/**
+ * Check for namespace collisions across multiple config files.
+ * Throws if two configs declare the same namespace.
+ */
+export declare function checkNamespaceCollisions(configPaths: string[]): Promise<void>;
 export declare function runSync(opts: SyncOptions): Promise<number>;

package/dist/cli/commands/sync.js

@@ -10,12 +10,14 @@
  *
  * Targets: claude-md, soul-md, cursorrules, system-prompt
  */
-import { resolve, dirname } from "node:path";
+import { resolve, dirname, basename } from "node:path";
 import { readFile, writeFile as writeFileAsync, stat, mkdir, readdir, unlink, rm } from "node:fs/promises";
 import { createHash } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import { createInterface } from "node:readline";
 import { loadDNA, compileFromFiles } from "../../compiler/index.js";
+import { parseYAML } from "../../schema/yaml-parser.js";
+import { getPackageVersion } from "../util/version.js";
 import { compileToMarkdown, injectIntoFile, removeFromFile } from "../../runtime/markdown.js";
 import { compileAllRolesToAgentMD, writeAgentMDFiles, removeAgentMDFiles } from "../../runtime/agent-md.js";
 import { removeWorkflowScripts } from "../../runtime/workflow-runner.js";
@@ -181,7 +183,7 @@ async function resolveVariables(rawVars, configPath) {
     return resolved;
 }
 /**
- * Auto-detect DNA config file in current directory.
+ * Auto-detect DNA config file in current directory (legacy single-config).
  * Priority: .dna/config.yaml > .dna/config.yml > .dna/config.json > .dna.yaml > .dna.yml > .dna.json
  */
 async function autoDetectDNA() {
@@ -197,6 +199,83 @@ async function autoDetectDNA() {
     }
     return null;
 }
+/**
+ * Auto-detect DNA configs: multi-config (.dna/configs/*.yaml) or legacy single-config.
+ * Returns array of absolute paths.
+ */
+export async function autoDetectConfigs() {
+    const cwd = process.cwd();
+    // Priority 1: .dna/configs/*.yaml (multi-config)
+    const configsDir = resolve(cwd, ".dna", "configs");
+    try {
+        const files = await readdir(configsDir);
+        const yamls = files
+            .filter(f => f.endsWith(".yaml") || f.endsWith(".yml"))
+            .sort()
+            .map(f => resolve(configsDir, f));
+        if (yamls.length > 0)
+            return yamls;
+    }
+    catch { /* dir doesn't exist */ }
+    // Fallback: legacy single-config paths
+    const legacy = await autoDetectDNA();
+    if (legacy)
+        return [legacy];
+    return [];
+}
+/**
+ * Read the current package version from package.json.
+ */
+export { getPackageVersion } from "../util/version.js";
+/**
+ * Check for namespace collisions across multiple config files.
+ * Throws if two configs declare the same namespace.
+ */
+export async function checkNamespaceCollisions(configPaths) {
+    const namespaces = new Map();
+    for (const configPath of configPaths) {
+        try {
+            const content = await readFile(configPath, "utf-8");
+            const data = parseYAML(content);
+            const ns = typeof data.namespace === "string" ? data.namespace : undefined;
+            if (ns) {
+                const file = basename(configPath);
+                if (namespaces.has(ns)) {
+                    throw new Error(`Namespace "${ns}" conflict: ${namespaces.get(ns)} and ${file}. Each template must have a unique namespace.`);
+                }
+                namespaces.set(ns, file);
+            }
+        }
+        catch (err) {
+            if (err instanceof Error && err.message.includes("conflict"))
+                throw err;
+            // Parse error — will be caught later during compilation
+        }
+    }
+}
+/**
+ * Check template versions against current package version.
+ * Prints upgrade suggestions for outdated configs.
+ */
+async function checkTemplateVersions(configPaths) {
+    const pkgVersion = await getPackageVersion();
+    if (!pkgVersion)
+        return;
+    for (const configPath of configPaths) {
+        try {
+            const content = await readFile(configPath, "utf-8");
+            const data = parseYAML(content);
+            const tmplVersion = typeof data._template_version === "string" ? data._template_version : undefined;
+            const tmplName = typeof data._source_template === "string" ? data._source_template : undefined;
+            if (tmplVersion && tmplName && tmplVersion !== pkgVersion) {
+                process.stderr.write(`Template "${tmplName}" has update: ${tmplVersion} → ${pkgVersion}. Run: dna init --upgrade ${tmplName}\n`);
+            }
+        }
+        catch {
+            // Non-critical — skip version check for unparseable files
+        }
+    }
+}
 function resolveSpeciesPath(ref) {
     if (!ref.startsWith("species:"))
         return null;
@@ -253,10 +332,21 @@ async function generateLockFile(lockPath, dnaSources, outputFiles) {
 export async function runSync(opts) {
     // ── Auto-detect mode: zero-config when no files/outputs specified ──
     if (!opts.remove && opts.files.length === 0) {
-        const autoFile = await autoDetectDNA();
-        if (autoFile) {
-            opts.files = [autoFile];
-            process.stderr.write(`Auto-detected: ${autoFile}\n`);
+        const autoFiles = await autoDetectConfigs();
+        if (autoFiles.length > 0) {
+            opts.files = autoFiles;
+            if (autoFiles.length === 1) {
+                process.stderr.write(`Auto-detected: ${autoFiles[0]}\n`);
+            }
+            else {
+                process.stderr.write(`Auto-detected: ${autoFiles.length} config(s) in .dna/configs/\n`);
+            }
+            // Namespace collision check (multi-config)
+            if (autoFiles.length > 1) {
+                await checkNamespaceCollisions(autoFiles);
+            }
+            // Template version check
+            await checkTemplateVersions(autoFiles);
         }
     }
     if (!opts.remove && !opts.inject && !opts.hooksDir && !opts.agentsDir && !opts.workflowDir && !opts.skillsDir && !opts.settingsPath) {
@@ -340,12 +430,15 @@ export async function runSync(opts) {
     try {
         // Track all output file paths for lock file generation
         const trackedOutputs = [];
+        // Step 0: Expand and pre-validate all DNA files before any work
+        // loadDNA() calls validateDNA() internally — validation failures throw here,
+        // before evolve/compile/inject waste any work.
+        const expandedFiles = await expandFiles(opts.files);
+        const loadedDNAs = await Promise.all(expandedFiles.map(loadDNA));
         // Step 1: Evolve if requested
         let epigeneticMarkers = undefined;
         if (opts.evolve) {
-            // Need to know the DNA ID for evolution
-            const expandedFiles = await expandFiles(opts.files);
-            const dnas = await Promise.all(expandedFiles.map(loadDNA));
+            const dnas = loadedDNAs;
             // Use the highest-priority DNA's ID
             const primaryDna = dnas.reduce((a, b) => a.cascade.priority >= b.cascade.priority ? a : b);
             const engine = new EvolutionEngine(opts.storeDir ? { store_dir: opts.storeDir } : undefined);
@@ -356,7 +449,6 @@ export async function runSync(opts) {
             }
         }
         // Step 2: Compile
-        const expandedFiles = await expandFiles(opts.files);
         const ir = await compileFromFiles(expandedFiles, {
             context: opts.context,
             role: opts.role,
@@ -378,7 +470,7 @@ export async function runSync(opts) {
         // Step 3.5: Write compiled IR (needed for both plugin and bin mode)
         {
             const cwd = process.cwd();
-            const dnas = await Promise.all(expandedFiles.map(loadDNA));
+            const dnas = loadedDNAs;
             const cascadedForIR = cascadeDNA(dnas);
             const roles = cascadedForIR.roles;
             const compiled = createCompiledIR(ir, roles);
@@ -413,7 +505,7 @@ export async function runSync(opts) {
             if (staleAgents.length > 0) {
                 process.stderr.write(`Cleaned ${staleAgents.length} stale agent file(s)\n`);
             }
-            const dnas = await Promise.all(expandedFiles.map(loadDNA));
+            const dnas = loadedDNAs;
             const cascaded = cascadeDNA(dnas);
             const roles = cascaded.roles;
             if (Object.keys(roles).length === 0) {
@@ -433,7 +525,7 @@ export async function runSync(opts) {
         }
         // Step 6: Generate workflow script(s)
         if (opts.workflowDir) {
-            const dnas = await Promise.all(expandedFiles.map(loadDNA));
+            const dnas = loadedDNAs;
             const cascadedForWf = cascadeDNA(dnas);
             const workflows = cascadedForWf.workflows;
             if (Object.keys(workflows).length === 0) {
@@ -474,7 +566,7 @@ export async function runSync(opts) {
             if (staleSkills.length > 0) {
                 process.stderr.write(`Cleaned ${staleSkills.length} stale skill dir(s)\n`);
             }
-            const dnas = await Promise.all(expandedFiles.map(loadDNA));
+            const dnas = loadedDNAs;
             const cascadedForSkills = cascadeDNA(dnas);
             const workflows = cascadedForSkills.workflows;
             const roles = cascadedForSkills.roles;
@@ -484,7 +576,7 @@ export async function runSync(opts) {
                 if (d.variables)
                     Object.assign(rawVars, d.variables);
             }
-            const configPath = await autoDetectDNA();
+            const configPath = opts.files.length === 1 ? opts.files[0] : null;
             const variables = await resolveVariables(rawVars, configPath);
             // Step 8: Generate .claude/.mcp.json from MCP dependencies (inside skillsDir block, shares variables)
             {

package/dist/cli/util/version.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Shared CLI utilities for package metadata.
+ */
+/**
+ * Read the current package version from package.json.
+ */
+export declare function getPackageVersion(): Promise<string | null>;
+/**
+ * Sanitize a template name to prevent path traversal.
+ * Strips path separators and parent directory references.
+ */
+export declare function sanitizeTemplateName(name: string): string;

package/dist/cli/util/version.js

@@ -0,0 +1,28 @@
+/**
+ * Shared CLI utilities for package metadata.
+ */
+import { readFile } from "node:fs/promises";
+import { resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+/**
+ * Read the current package version from package.json.
+ */
+export async function getPackageVersion() {
+    try {
+        const thisDir = dirname(fileURLToPath(import.meta.url));
+        const pkgPath = resolve(thisDir, "..", "..", "..", "package.json");
+        const raw = await readFile(pkgPath, "utf-8");
+        const pkg = JSON.parse(raw);
+        return typeof pkg.version === "string" ? pkg.version : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Sanitize a template name to prevent path traversal.
+ * Strips path separators and parent directory references.
+ */
+export function sanitizeTemplateName(name) {
+    return name.replace(/[/\\]/g, "").replace(/\.\./g, "");
+}

package/dist/compiler/cascade.d.ts

@@ -18,6 +18,8 @@ export interface CascadedDNA {
     workflows: Record<string, WorkflowDef>;
     epigenetic_markers: EpigeneticMarker[];
     source_ids: string[];
+    /** Warnings from cascade process (e.g., cross-namespace gene collisions) */
+    warnings?: string[];
 }
 /**
  * Cascade multiple DNA layers into a single merged DNA.

package/dist/compiler/cascade.js

@@ -98,21 +98,37 @@ export function cascadeDNA(layers) {
     // Sort by priority ascending (species first, task last)
     const sorted = [...layers].sort((a, b) => a.cascade.priority - b.cascade.priority);
     const mergedGenes = {};
+    const geneSourceNs = {}; // track which namespace defined each gene
     const mergedContexts = {};
     const mergedRoles = {};
     const mergedWorkflows = {};
     const allMarkers = [];
     const sourceIds = [];
+    const warnings = [];
     for (const dna of sorted) {
         sourceIds.push(dna.id);
         const ns = dna.namespace;
-        // Merge genes
+        // Merge genes (cross-namespace: additive merge + warning)
         for (const [name, gene] of Object.entries(dna.genes)) {
             if (mergedGenes[name]) {
-                mergedGenes[name] = mergeGenes(mergedGenes[name], gene);
+                const existingNs = geneSourceNs[name];
+                if (ns !== existingNs) {
+                    // Different namespaces define same gene — additive codon merge + warning
+                    mergedGenes[name] = {
+                        description: gene.description || mergedGenes[name].description,
+                        codons: [...mergedGenes[name].codons, ...gene.codons],
+                        tags: [...new Set([...(mergedGenes[name].tags ?? []), ...(gene.tags ?? [])])],
+                    };
+                    warnings.push(`Gene "${name}" defined in both ${existingNs ?? "(no namespace)"} and ${ns ?? "(no namespace)"}. Codons merged.`);
+                }
+                else {
+                    // Same namespace — normal cascade (higher priority wins)
+                    mergedGenes[name] = mergeGenes(mergedGenes[name], gene);
+                }
             }
             else {
                 mergedGenes[name] = { ...gene, codons: [...gene.codons] };
+                geneSourceNs[name] = ns;
             }
         }
         // Merge contexts (higher priority replaces entirely)
@@ -147,5 +163,6 @@ export function cascadeDNA(layers) {
         workflows: mergedWorkflows,
         epigenetic_markers: allMarkers,
         source_ids: sourceIds,
+        warnings: warnings.length > 0 ? warnings : undefined,
     };
 }

package/dist/hooks/cli.js

@@ -19,7 +19,7 @@ import { resolve } from "node:path";
 import { randomUUID } from "node:crypto";
 import { readStdin, writeOutput, silentOutput, allowOutput } from "./protocol.js";
 import { enforcePreToolUse, enforcePostToolUse, enforceUserPromptSubmit, enforceSubagentStop, enforcePreCompact, enforceNotification, enforceSessionStart, enforceStop, extractBashWritePaths, } from "./enforce.js";
-import { appendAudit, readWorkflowState, appendTrace, rotateTraces, readTraces } from "./state.js";
+import { appendAudit, readWorkflowState, appendTrace, rotateTraces, readTraces, cleanStaleState } from "./state.js";
 // ── Constants ──────────────────────────────────────────────
 const DEFAULT_IR_PATH = ".dna/compiled/ir.json";
 const VALID_EVENTS = new Set([
@@ -127,7 +127,7 @@ async function main() {
         }, stopContext);
         // Session summary: aggregate block/warn stats from trace
         try {
-            const traces = await readTraces(projectDir, 1);
+            const traces = await readTraces(projectDir, 1, sessionId);
             const summary = computeSummary(traces);
             const summaryText = formatSummary(summary);
             if (summaryText) {
@@ -152,7 +152,7 @@ async function main() {
             decision: stopOutput.continue === false ? "block" : "allow",
             duration_ms: 0,
             timestamp: new Date().toISOString(),
-        }).catch(() => { });
+        }, sessionId).catch(() => { });
         return;
     }
     // Dispatch to enforcement engine with timing
@@ -171,7 +171,7 @@ async function main() {
     // O4: Block pattern recognition — suggest scope expansion on repeated blocks
     if (event === "PreToolUse" && output.continue === false && targetPath) {
         try {
-            const traces = await readTraces(projectDir, 1);
+            const traces = await readTraces(projectDir, 1, sessionId);
             const blockCount = traces.filter(t => t.decision === "block" && t.target_path === targetPath).length;
             if (blockCount >= 2) {
                 output = {
@@ -200,10 +200,11 @@ async function main() {
         target_path: decision !== "allow" ? targetPath : undefined,
         duration_ms: durationMs,
         timestamp: new Date().toISOString(),
-    }).catch(() => { }); // Fail-open
-    // Side effect: rotate traces on SessionStart
+    }, sessionId).catch(() => { }); // Fail-open
+    // Side effect: rotate traces + clean stale state on SessionStart
     if (event === "SessionStart") {
         rotateTraces(projectDir).catch(() => { });
+        cleanStaleState(projectDir).catch(() => { });
     }
     // Side effect: audit log for notifications
     if (event === "Notification" && output.hookSpecificOutput?.additionalContext?.includes("violation")) {
@@ -267,12 +268,17 @@ function dispatch(event, ir, input, state) {
     }
 }
 // ── IR Loading ─────────────────────────────────────────────
+/** Expected IR schema version — must match plugin-adapter.ts */
+const EXPECTED_IR_VERSION = 1;
 async function loadIR(irPath) {
     try {
         const raw = await readFile(irPath, "utf-8");
         const data = JSON.parse(raw);
         // Support both raw IR and wrapped CompiledIRFile format
         if (data.ir_version && data.ir) {
+            if (data.ir_version !== EXPECTED_IR_VERSION) {
+                process.stderr.write(`[Intent DNA] IR version mismatch: file has v${data.ir_version}, expected v${EXPECTED_IR_VERSION}. Run \`dna sync\` to recompile.\n`);
+            }
             return data.ir;
         }
         // Direct ConstraintIR

package/dist/hooks/enforce.js

@@ -383,10 +383,10 @@ function checkPathAgainstScope(rolesScopeMap, input, filePath) {
             continue;
         const writeGlobs = entry.scope.write ?? [];
         if (writeGlobs.length === 0) {
-            return blockOutput(`[Intent DNA]: Role '${entry.role_name}' has no write permission (path: ${filePath})`);
+            return allowOutput(`WARN [Intent DNA]: Role '${entry.role_name}' has no write permission (path: ${filePath}). Merge-time scope gate will filter.`);
         }
         if (!checkWriteAllowed(relativePath, writeGlobs)) {
-            return blockOutput(`[Intent DNA]: Role '${entry.role_name}' cannot write to '${filePath}' (allowed: ${writeGlobs.join(", ")})`);
+            return allowOutput(`WARN [Intent DNA]: Role '${entry.role_name}' cannot write to '${filePath}' (allowed: ${writeGlobs.join(", ")}). Merge-time scope gate will filter.`);
         }
         return null; // Role matched, write allowed
     }

package/dist/hooks/state.d.ts

@@ -62,6 +62,8 @@ export declare function appendCompletedArtifact(projectDir: string, stepId: stri
     type: string;
     path: string;
 }, sessionId?: string): Promise<void>;
+/** Atomic write: write to temp file then rename. */
+export declare function atomicWrite(filePath: string, data: string): Promise<void>;
 /** Trace entry for hook call observability */
 export interface TraceEntry {
     trace_id: string;
@@ -78,17 +80,27 @@ export interface TraceEntry {
 }
 /**
  * Append a trace entry to the daily trace file.
- * File: `.dna/state/trace/trace-YYYY-MM-DD.jsonl`
+ * With sessionId: `.dna/state/trace/trace-YYYY-MM-DD-{sessionId}.jsonl`
+ * Without: `.dna/state/trace/trace-YYYY-MM-DD.jsonl` (backward compat)
  * Fail-open: never throws.
  */
-export declare function appendTrace(projectDir: string, entry: TraceEntry): Promise<void>;
+export declare function appendTrace(projectDir: string, entry: TraceEntry, sessionId?: string): Promise<void>;
 /**
  * Read trace entries from the last N days.
+ * With sessionId: reads only that session's trace files.
+ * Without: reads all trace files (merged view).
  * Returns parsed entries sorted by timestamp.
  */
-export declare function readTraces(projectDir: string, days?: number): Promise<TraceEntry[]>;
+export declare function readTraces(projectDir: string, days?: number, sessionId?: string): Promise<TraceEntry[]>;
 /**
  * Clean up trace files older than retention period.
  * Removes `.dna/state/trace/trace-*.jsonl` files older than TRACE_RETENTION_DAYS.
  */
 export declare function rotateTraces(projectDir: string): Promise<number>;
+/**
+ * Clean up stale state from `.dna/state/sessions/` and root state.
+ * Removes workflow.json files older than DEFAULT_STALENESS_MS (2h).
+ * Called on SessionStart to prevent state accumulation.
+ * Fail-open: never throws.
+ */
+export declare function cleanStaleState(projectDir: string): Promise<number>;