intentdna 1.5.2 → 1.5.3

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "intentdna",
       "description": "DNA template compilation + runtime enforcement",
-      "version": "1.5.2",
+      "version": "1.5.3",
       "source": "./"
     }
   ]

package/.claude-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "intentdna",
-  "version": "1.5.2",
+  "version": "1.5.3",
   "description": "Declarative policy layer for AI agent governance"
 }

package/dist/cli/commands/sync.js

@@ -483,6 +483,8 @@ export async function runSync(opts) {
             if (removed > 0) {
                 process.stderr.write(`Cleaned ${removed} legacy bash hook(s) from ${oldHooksDir}\n`);
             }
+            // G2/G3: Register built-in DNA MCP server in .claude/.mcp.json
+            await registerDNAMCPServer(cwd);
         }
         // Step 3.6: Register hooks in settings.json (bin mode only)
         // Plugin mode: hooks managed by plugin framework — skip settings.json
@@ -680,3 +682,28 @@ async function writeMCPConfig(mcpDeps, mcpJsonPath, variables) {
 function substituteVariables(template, vars) {
     return template.replace(/\{\{(\w+)\}\}/g, (_, key) => vars[key] ?? `{{${key}}}`);
 }
+/**
+ * G2/G3: Register the built-in DNA MCP server (dna-mcp) in .claude/.mcp.json.
+ * Idempotent: only adds if not already present.
+ */
+async function registerDNAMCPServer(cwd) {
+    const mcpJsonPath = resolve(cwd, ".claude", ".mcp.json");
+    let existing = {};
+    try {
+        const raw = await readFile(mcpJsonPath, "utf-8");
+        existing = JSON.parse(raw);
+    }
+    catch { /* doesn't exist yet */ }
+    const mcpServers = (existing.mcpServers ?? {});
+    // Don't overwrite if user already configured it
+    if (mcpServers["intentdna"])
+        return;
+    mcpServers["intentdna"] = {
+        command: "dna-mcp",
+        args: ["--project-dir", cwd],
+    };
+    existing.mcpServers = mcpServers;
+    await mkdir(dirname(mcpJsonPath), { recursive: true });
+    await writeFileAsync(mcpJsonPath, JSON.stringify(existing, null, 2) + "\n", "utf-8");
+    process.stderr.write(`MCP: registered dna-mcp server in ${mcpJsonPath}\n`);
+}

package/dist/compiler/compile.js

@@ -219,6 +219,7 @@ export function compileDNA(activated, cascaded) {
             const wfStepCheckpoints = [];
             const activeRoles = [];
             const handoffChain = [];
+            const stepEnforceRules = [];
             for (const step of wf.steps ?? []) {
                 if (!activeRoles.includes(step.role)) {
                     activeRoles.push(step.role);
@@ -238,6 +239,15 @@ export function compileDNA(activated, cascaded) {
                         consumes: step.handoff.consumes,
                     });
                 }
+                // G4: Collect step enforce rules
+                if (step.enforce) {
+                    stepEnforceRules.push({
+                        step_id: step.id,
+                        read_only: step.enforce.read_only,
+                        relax_after_iteration: step.enforce.relax_after_iteration,
+                        additional_write_paths: step.enforce.additional_write_paths,
+                    });
+                }
             }
             // Derive namespace from workflow key: "ns_wfname" → "ns", "wfname" → ""
             const underscoreIdx = wfKey.indexOf("_");
@@ -248,6 +258,7 @@ export function compileDNA(activated, cascaded) {
                 step_checkpoints: wfStepCheckpoints,
                 active_roles: activeRoles,
                 handoff_chain: handoffChain,
+                step_enforce_rules: stepEnforceRules.length > 0 ? stepEnforceRules : undefined,
             });
         }
     }

package/dist/governance/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Intent DNA — Remote Governance Module
+ *
+ * Architecture reservation for Phase 7 enterprise governance.
+ * Currently exports type definitions only — no runtime implementation.
+ */
+export type { AuditReport, RemoteDNAPolicy, PolicyContent, PolicyScope, PolicyUpdate, GovernanceConfig, GovernanceClient, GovernanceResponse, GovernanceSubscription, } from "./types.js";

package/dist/governance/index.js

@@ -0,0 +1,7 @@
+/**
+ * Intent DNA — Remote Governance Module
+ *
+ * Architecture reservation for Phase 7 enterprise governance.
+ * Currently exports type definitions only — no runtime implementation.
+ */
+export {};

package/dist/governance/types.d.ts

@@ -0,0 +1,135 @@
+/**
+ * Intent DNA — Remote Governance Types
+ *
+ * Architecture reservation for enterprise governance communication.
+ * Phase 7 implementation — current phase only defines interfaces.
+ *
+ * Capabilities:
+ *   - Audit data reporting to central server
+ *   - Enterprise DNA policy pull
+ *   - Policy update push notifications
+ */
+/** Audit report sent from local DNA to governance server */
+export interface AuditReport {
+    /** Report ID (UUID) */
+    report_id: string;
+    /** ISO timestamp */
+    timestamp: string;
+    /** Session that generated the report */
+    session_id: string;
+    /** Project identifier */
+    project_id: string;
+    /** Summary statistics */
+    stats: {
+        total_events: number;
+        blocks: number;
+        warns: number;
+        allows: number;
+    };
+    /** Top blocked tools */
+    top_blocked_tools: Array<{
+        tool: string;
+        count: number;
+    }>;
+    /** Top blocked paths */
+    top_blocked_paths: Array<{
+        path: string;
+        count: number;
+    }>;
+    /** Active DNA template IDs */
+    active_templates: string[];
+    /** IR version in use */
+    ir_version: number;
+}
+/** Enterprise DNA policy pulled from governance server */
+export interface RemoteDNAPolicy {
+    /** Policy ID */
+    policy_id: string;
+    /** Policy version (semver) */
+    version: string;
+    /** When the policy was last updated */
+    updated_at: string;
+    /** Priority level (higher overrides lower) */
+    priority: number;
+    /** The DNA content (can be inlined or a URL reference) */
+    dna: PolicyContent;
+    /** Which projects/teams this policy applies to */
+    scope: PolicyScope;
+    /** Whether this policy is mandatory (cannot be overridden locally) */
+    mandatory: boolean;
+}
+/** Policy content — either inline DNA JSON or a reference */
+export interface PolicyContent {
+    /** Inline DNA JSON */
+    inline?: Record<string, unknown>;
+    /** URL to fetch DNA from */
+    url?: string;
+    /** SHA-256 hash for integrity verification */
+    sha256?: string;
+}
+/** Scope of a policy — which projects/teams it applies to */
+export interface PolicyScope {
+    /** Apply to all projects */
+    all?: boolean;
+    /** Apply to specific project IDs */
+    projects?: string[];
+    /** Apply to specific team names */
+    teams?: string[];
+    /** Apply to projects matching glob patterns */
+    project_patterns?: string[];
+}
+/** Policy update push notification */
+export interface PolicyUpdate {
+    /** Update type */
+    type: "created" | "updated" | "revoked";
+    /** The policy that changed */
+    policy: RemoteDNAPolicy;
+    /** Change description */
+    change_description?: string;
+    /** Whether immediate re-sync is required */
+    requires_resync: boolean;
+}
+/** Configuration for connecting to a governance server */
+export interface GovernanceConfig {
+    /** Server URL */
+    server_url: string;
+    /** Authentication token or API key */
+    auth_token?: string;
+    /** Organization ID */
+    org_id: string;
+    /** Polling interval in seconds (for pull mode) */
+    poll_interval_s?: number;
+    /** Enable push notifications via WebSocket */
+    push_enabled?: boolean;
+    /** TLS certificate path (for mTLS) */
+    tls_cert?: string;
+}
+/** Governance client interface — to be implemented in Phase 7 */
+export interface GovernanceClient {
+    /** Report audit data to the governance server */
+    reportAudit(report: AuditReport): Promise<GovernanceResponse>;
+    /** Pull latest policies from the governance server */
+    pullPolicies(): Promise<RemoteDNAPolicy[]>;
+    /** Subscribe to policy updates (push mode) */
+    subscribePolicyUpdates(callback: (update: PolicyUpdate) => void): Promise<GovernanceSubscription>;
+    /** Check connectivity to the governance server */
+    healthCheck(): Promise<boolean>;
+}
+/** Response from governance server operations */
+export interface GovernanceResponse {
+    /** Whether the operation succeeded */
+    ok: boolean;
+    /** Error message if failed */
+    error?: string;
+    /** Server-side request ID for debugging */
+    request_id?: string;
+}
+/** Subscription handle for push updates */
+export interface GovernanceSubscription {
+    /** Unique subscription ID */
+    id: string;
+    /** Unsubscribe from updates */
+    unsubscribe(): Promise<void>;
+    /** Whether the subscription is active */
+    active: boolean;
+}

package/dist/governance/types.js

@@ -0,0 +1,12 @@
+/**
+ * Intent DNA — Remote Governance Types
+ *
+ * Architecture reservation for enterprise governance communication.
+ * Phase 7 implementation — current phase only defines interfaces.
+ *
+ * Capabilities:
+ *   - Audit data reporting to central server
+ *   - Enterprise DNA policy pull
+ *   - Policy update push notifications
+ */
+export {};

package/dist/hooks/cli.js

@@ -101,6 +101,7 @@ async function main() {
                 workflow: wfState.workflow,
                 current_role: wfState.current_role,
                 completed_artifacts: wfState.completed_artifacts,
+                iteration: wfState.iteration, // G4: pass iteration for state-driven rules
             };
             // Re-run fallback: scan consumed artifact paths on disk so
             // enforceHandoffConsumes can skip blocks for files that already exist.

package/dist/hooks/enforce.d.ts

@@ -28,6 +28,8 @@ export interface EnforceState {
         workflow: string;
         current_role?: string;
         completed_artifacts?: CompletedArtifactEntry[];
+        /** G4: current workflow iteration (for relax_after_iteration rules) */
+        iteration?: number;
     };
     /** Artifact paths that exist on disk — fallback for re-run idempotency.
      *  CLI checks disk, passes paths here so enforce stays pure (no I/O). */

package/dist/hooks/enforce.js

@@ -23,11 +23,21 @@ import { relative, normalize } from "node:path";
  * Optional `roles` parameter provides output_schema enforcement.
  */
 export function enforcePreToolUse(ir, input, state, roles) {
+    // G4 Layer 1: Step enforce rules (state-driven)
+    if (state?.workflowState && ir.workflows_ir) {
+        const stepRuleResult = enforceStepRules(ir, input, state);
+        if (stepRuleResult !== null)
+            return stepRuleResult;
+    }
     // Layer 2: Role scope
     if (input.agent_type && ir.roles_scope_map && ir.roles_scope_map.length > 0) {
-        const result = enforceRoleScope(ir.roles_scope_map, input);
-        if (result)
-            return result;
+        // G4: Check if scope is relaxed by iteration-based rule
+        const relaxed = isStepScopeRelaxed(ir, state);
+        if (!relaxed) {
+            const result = enforceRoleScope(ir.roles_scope_map, input, getStepAdditionalPaths(ir, state));
+            if (result)
+                return result;
+        }
     }
     // Layer 3: Tool filters
     if (ir.tool_filters.length > 0) {
@@ -293,6 +303,53 @@ export function enforceStop(ir, input, workflowState) {
     return blockOutput(`[Intent DNA] Workflow '${workflowState.workflow}' has unmet checkpoints at step '${workflowState.current_step}':\n` +
         messages.map(m => `  - ${m}`).join("\n"));
 }
+// ── G4: State-driven Step Enforcement ─────────────────────
+/** Write tools that step read_only rule should block */
+const ALL_WRITE_TOOLS = new Set(["Edit", "Write", "NotebookEdit", "Bash"]);
+/**
+ * Find the StepEnforceRule for the current step in the active workflow.
+ */
+function findStepRule(ir, state) {
+    if (!state?.workflowState || !ir.workflows_ir)
+        return null;
+    const wf = ir.workflows_ir.find(w => w.workflow_name === state.workflowState.workflow);
+    if (!wf?.step_enforce_rules)
+        return null;
+    return wf.step_enforce_rules.find(r => r.step_id === state.workflowState.current_step) ?? null;
+}
+/**
+ * G4: Enforce step-level rules.
+ * Returns HookOutput if a rule triggers (block for read_only), null to continue.
+ */
+function enforceStepRules(ir, input, state) {
+    const rule = findStepRule(ir, state);
+    if (!rule)
+        return null;
+    // read_only: block all write tools
+    if (rule.read_only && ALL_WRITE_TOOLS.has(input.tool_name)) {
+        return blockOutput(`[Intent DNA] Step '${rule.step_id}' is read-only. Write tool '${input.tool_name}' blocked.`);
+    }
+    return null;
+}
+/**
+ * G4: Check if scope enforcement is relaxed for this step based on iteration.
+ * When iteration >= relax_after_iteration, scope checks are skipped (rescue mode).
+ */
+function isStepScopeRelaxed(ir, state) {
+    const rule = findStepRule(ir, state);
+    if (!rule?.relax_after_iteration)
+        return false;
+    const iteration = state?.workflowState?.iteration ?? 1;
+    return iteration >= rule.relax_after_iteration;
+}
+/**
+ * G4: Get additional write paths granted to the current step.
+ * These extend the role's scope for this specific step only.
+ */
+function getStepAdditionalPaths(ir, state) {
+    const rule = findStepRule(ir, state);
+    return rule?.additional_write_paths ?? [];
+}
 // ── Internal: Layer Enforcement ────────────────────────────
 /**
  * Enforce handoff consumes — verify that the current step's consumed
@@ -344,7 +401,7 @@ export function enforceHandoffProduces(ir, wfState) {
     }
     return null;
 }
-function enforceRoleScope(rolesScopeMap, input) {
+function enforceRoleScope(rolesScopeMap, input, additionalWritePaths = []) {
     if (!input.agent_type)
         return null;
     // Standard write tools: check single file path
@@ -352,7 +409,7 @@ function enforceRoleScope(rolesScopeMap, input) {
         const filePath = extractFilePath(input);
         if (!filePath)
             return null;
-        return checkPathAgainstScope(rolesScopeMap, input, filePath);
+        return checkPathAgainstScope(rolesScopeMap, input, filePath, additionalWritePaths);
     }
     // Bash: extract potential write targets from command
     if (input.tool_name === "Bash") {
@@ -363,7 +420,7 @@ function enforceRoleScope(rolesScopeMap, input) {
         if (writePaths.length === 0)
             return null;
         for (const p of writePaths) {
-            const result = checkPathAgainstScope(rolesScopeMap, input, p);
+            const result = checkPathAgainstScope(rolesScopeMap, input, p, additionalWritePaths);
             if (result)
                 return result;
         }
@@ -372,7 +429,7 @@ function enforceRoleScope(rolesScopeMap, input) {
     return null;
 }
 /** Check a single file path against role scope. Shared by Write tools and Bash. */
-function checkPathAgainstScope(rolesScopeMap, input, filePath) {
+function checkPathAgainstScope(rolesScopeMap, input, filePath, additionalWritePaths = []) {
     const cwd = input.cwd;
     let relativePath = cwd && filePath.startsWith("/") ? relative(cwd, filePath) : filePath;
     // Normalize to resolve traversal (e.g., "src/../../test/x.ts" → "../test/x.ts")
@@ -382,11 +439,15 @@ function checkPathAgainstScope(rolesScopeMap, input, filePath) {
         if (input.agent_type !== agentTypeName)
             continue;
         const writeGlobs = entry.scope.write ?? [];
-        if (writeGlobs.length === 0) {
+        // G4: merge step-specific additional_write_paths
+        const allWriteGlobs = additionalWritePaths.length > 0
+            ? [...writeGlobs, ...additionalWritePaths]
+            : writeGlobs;
+        if (allWriteGlobs.length === 0) {
             return allowOutput(`WARN [Intent DNA]: Role '${entry.role_name}' has no write permission (path: ${filePath}). Merge-time scope gate will filter.`);
         }
-        if (!checkWriteAllowed(relativePath, writeGlobs)) {
-            return allowOutput(`WARN [Intent DNA]: Role '${entry.role_name}' cannot write to '${filePath}' (allowed: ${writeGlobs.join(", ")}). Merge-time scope gate will filter.`);
+        if (!checkWriteAllowed(relativePath, allWriteGlobs)) {
+            return allowOutput(`WARN [Intent DNA]: Role '${entry.role_name}' cannot write to '${filePath}' (allowed: ${allWriteGlobs.join(", ")}). Merge-time scope gate will filter.`);
         }
         return null; // Role matched, write allowed
     }

package/dist/hooks/state.d.ts

@@ -79,19 +79,31 @@ export interface TraceEntry {
     timestamp: string;
 }
 /**
- * Append a trace entry to the daily trace file.
- * With sessionId: `.dna/state/trace/trace-YYYY-MM-DD-{sessionId}.jsonl`
- * Without: `.dna/state/trace/trace-YYYY-MM-DD.jsonl` (backward compat)
+ * Append a trace entry with dual-write strategy:
+ *   1. Always → global trace: `.dna/state/trace/trace-YYYY-MM-DD.jsonl` (merged view)
+ *   2. If sessionId → session-local: `.dna/state/sessions/{id}/trace.jsonl`
+ *
+ * G1: Session isolation — session traces live in the session directory,
+ * global trace provides a unified view across all sessions.
  * Fail-open: never throws.
  */
 export declare function appendTrace(projectDir: string, entry: TraceEntry, sessionId?: string): Promise<void>;
 /**
- * Read trace entries from the last N days.
- * With sessionId: reads only that session's trace files.
- * Without: reads all trace files (merged view).
+ * Read trace entries.
+ *
+ * G1 session isolation:
+ *   - With sessionId: reads from `.dna/state/sessions/{id}/trace.jsonl`
+ *     (falls back to legacy global files with sessionId in name for backward compat)
+ *   - Without sessionId: reads from `.dna/state/trace/trace-{date}.jsonl` (global merged view)
+ *
  * Returns parsed entries sorted by timestamp.
  */
 export declare function readTraces(projectDir: string, days?: number, sessionId?: string): Promise<TraceEntry[]>;
+/**
+ * List active session directories under `.dna/state/sessions/`.
+ * Returns session IDs (directory names).
+ */
+export declare function listSessions(projectDir: string): Promise<string[]>;
 /**
  * Clean up trace files older than retention period.
  * Removes `.dna/state/trace/trace-*.jsonl` files older than TRACE_RETENTION_DAYS.

package/dist/hooks/state.js

@@ -140,48 +140,104 @@ const TRACE_DIR = "trace";
 const MAX_TRACE_SIZE = 10 * 1024 * 1024; // 10MB
 const TRACE_RETENTION_DAYS = 7;
 /**
- * Build trace file name.
- * With session isolation: `trace-{date}-{sessionId}.jsonl`
- * Without: `trace-{date}.jsonl` (backward compat / merged view)
+ * Build global trace file name (merged view, no sessionId).
+ * Legacy files with sessionId in name are still readable for backward compat.
  */
-function traceFileName(date, sessionId) {
-    if (sessionId) {
-        return `trace-${date}-${sessionId}.jsonl`;
-    }
+function globalTraceFileName(date) {
     return `trace-${date}.jsonl`;
 }
 /**
- * Append a trace entry to the daily trace file.
- * With sessionId: `.dna/state/trace/trace-YYYY-MM-DD-{sessionId}.jsonl`
- * Without: `.dna/state/trace/trace-YYYY-MM-DD.jsonl` (backward compat)
+ * Append a trace entry with dual-write strategy:
+ *   1. Always → global trace: `.dna/state/trace/trace-YYYY-MM-DD.jsonl` (merged view)
+ *   2. If sessionId → session-local: `.dna/state/sessions/{id}/trace.jsonl`
+ *
+ * G1: Session isolation — session traces live in the session directory,
+ * global trace provides a unified view across all sessions.
  * Fail-open: never throws.
  */
 export async function appendTrace(projectDir, entry, sessionId) {
     try {
-        const traceDir = join(projectDir, ".dna", "state", TRACE_DIR);
-        await mkdir(traceDir, { recursive: true });
+        const line = JSON.stringify(entry) + "\n";
         const date = entry.timestamp.slice(0, 10);
-        const tracePath = join(traceDir, traceFileName(date, sessionId));
-        // Check file size — rotate if over limit
+        // 1. Global trace (merged view)
+        const globalTraceDir = join(projectDir, ".dna", "state", TRACE_DIR);
+        await mkdir(globalTraceDir, { recursive: true });
+        const globalPath = join(globalTraceDir, globalTraceFileName(date));
         try {
-            const stats = await stat(tracePath);
+            const stats = await stat(globalPath);
             if (stats.size >= MAX_TRACE_SIZE)
-                return; // silently skip if file too large
+                return;
         }
         catch { /* file doesn't exist yet */ }
-        await appendFile(tracePath, JSON.stringify(entry) + "\n", "utf-8");
+        await appendFile(globalPath, line, "utf-8");
+        // 2. Session-local trace (if session isolated)
+        if (sessionId) {
+            const sessionDir = resolveStateDir(projectDir, sessionId);
+            await mkdir(sessionDir, { recursive: true });
+            const sessionTracePath = join(sessionDir, "trace.jsonl");
+            try {
+                const stats = await stat(sessionTracePath);
+                if (stats.size >= MAX_TRACE_SIZE)
+                    return;
+            }
+            catch { /* file doesn't exist yet */ }
+            await appendFile(sessionTracePath, line, "utf-8");
+        }
     }
     catch {
         // Fail-open: trace write failure never affects hook execution
     }
 }
 /**
- * Read trace entries from the last N days.
- * With sessionId: reads only that session's trace files.
- * Without: reads all trace files (merged view).
+ * Read trace entries.
+ *
+ * G1 session isolation:
+ *   - With sessionId: reads from `.dna/state/sessions/{id}/trace.jsonl`
+ *     (falls back to legacy global files with sessionId in name for backward compat)
+ *   - Without sessionId: reads from `.dna/state/trace/trace-{date}.jsonl` (global merged view)
+ *
  * Returns parsed entries sorted by timestamp.
  */
 export async function readTraces(projectDir, days = 1, sessionId) {
+    const entries = [];
+    if (sessionId) {
+        // Session-specific: read from session directory first
+        const sessionDir = resolveStateDir(projectDir, sessionId);
+        const sessionTracePath = join(sessionDir, "trace.jsonl");
+        const sessionEntries = await readTraceFile(sessionTracePath);
+        entries.push(...sessionEntries);
+        // Backward compat: also check legacy files in global trace dir
+        if (entries.length === 0) {
+            const legacyEntries = await readGlobalTraces(projectDir, days, sessionId);
+            entries.push(...legacyEntries);
+        }
+    }
+    else {
+        // Global merged view
+        const globalEntries = await readGlobalTraces(projectDir, days);
+        entries.push(...globalEntries);
+    }
+    return entries.sort((a, b) => a.timestamp.localeCompare(b.timestamp));
+}
+/** Read all entries from a single trace file. */
+async function readTraceFile(filePath) {
+    const entries = [];
+    try {
+        const content = await readFile(filePath, "utf-8");
+        for (const line of content.trim().split("\n")) {
+            if (!line)
+                continue;
+            try {
+                entries.push(JSON.parse(line));
+            }
+            catch { /* skip malformed */ }
+        }
+    }
+    catch { /* file doesn't exist */ }
+    return entries;
+}
+/** Read global trace files from `.dna/state/trace/`. */
+async function readGlobalTraces(projectDir, days, sessionIdFilter) {
     const traceDir = join(projectDir, ".dna", "state", TRACE_DIR);
     const entries = [];
     const cutoff = new Date();
@@ -192,28 +248,20 @@ export async function readTraces(projectDir, days = 1, sessionId) {
         const traceFiles = files
             .filter(f => f.startsWith("trace-") && f.endsWith(".jsonl"))
             .filter(f => {
-            // Extract date from filename: trace-YYYY-MM-DD.jsonl or trace-YYYY-MM-DD-{sessionId}.jsonl
             const fileDate = f.slice(6, 16); // "trace-YYYY-MM-DD..."
             if (fileDate < cutoffDate)
                 return false;
-            // Session filter: only include files for this session (or shared files)
-            if (sessionId) {
-                const suffix = f.slice(16); // "-{sessionId}.jsonl" or ".jsonl"
-                return suffix === `-${sessionId}.jsonl` || suffix === ".jsonl";
+            // Legacy session filter: files with sessionId in name
+            if (sessionIdFilter) {
+                const suffix = f.slice(16);
+                return suffix === `-${sessionIdFilter}.jsonl` || suffix === ".jsonl";
             }
             return true;
         })
             .sort();
         for (const file of traceFiles) {
-            const content = await readFile(join(traceDir, file), "utf-8");
-            for (const line of content.trim().split("\n")) {
-                if (!line)
-                    continue;
-                try {
-                    entries.push(JSON.parse(line));
-                }
-                catch { /* skip malformed */ }
-            }
+            const fileEntries = await readTraceFile(join(traceDir, file));
+            entries.push(...fileEntries);
         }
     }
     catch {
@@ -221,6 +269,29 @@ export async function readTraces(projectDir, days = 1, sessionId) {
     }
     return entries;
 }
+/**
+ * List active session directories under `.dna/state/sessions/`.
+ * Returns session IDs (directory names).
+ */
+export async function listSessions(projectDir) {
+    const sessionsDir = join(projectDir, ".dna", "state", "sessions");
+    try {
+        const entries = await readdir(sessionsDir);
+        const sessions = [];
+        for (const entry of entries) {
+            try {
+                const entryStat = await stat(join(sessionsDir, entry));
+                if (entryStat.isDirectory())
+                    sessions.push(entry);
+            }
+            catch { /* skip */ }
+        }
+        return sessions;
+    }
+    catch {
+        return [];
+    }
+}
 /**
  * Clean up trace files older than retention period.
  * Removes `.dna/state/trace/trace-*.jsonl` files older than TRACE_RETENTION_DAYS.

package/dist/mcp/index.d.ts

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+/**
+ * Intent DNA — MCP Server (`dna-mcp`)
+ *
+ * Claude Code MCP server providing DNA governance tools:
+ *   G2: State management (workflow, trace, status)
+ *   G3: Compile toolchain (compile, validate, sync)
+ *
+ * Usage: dna-mcp [--project-dir <path>]
+ *
+ * Speaks JSON-RPC 2.0 over stdio (MCP protocol).
+ */
+export {};