intentdna 1.5.3 → 1.5.4

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "intentdna",
       "description": "DNA template compilation + runtime enforcement",
-      "version": "1.5.3",
+      "version": "1.5.4",
       "source": "./"
     }
   ]

package/.claude-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "intentdna",
-  "version": "1.5.3",
+  "version": "1.5.4",
   "description": "Declarative policy layer for AI agent governance"
 }

package/dist/cli/commands/sync.d.ts

@@ -54,4 +54,27 @@ export { getPackageVersion } from "../util/version.js";
  * Throws if two configs declare the same namespace.
  */
 export declare function checkNamespaceCollisions(configPaths: string[]): Promise<void>;
+/**
+ * Compare two semver strings. Returns:
+ *   1  if a > b
+ *   0  if a == b
+ *  -1  if a < b
+ * Handles major.minor.patch format. Non-numeric parts are ignored.
+ */
+export declare function compareSemver(a: string, b: string): -1 | 0 | 1;
+/** Info about a single template that has an available upgrade. */
+export interface TemplateUpgradeInfo {
+    configPath: string;
+    templateName: string;
+    currentVersion: string;
+    availableVersion: string;
+}
+/**
+ * Check template versions against current package version.
+ * Returns upgrade info for outdated configs and prints human-readable suggestions.
+ *
+ * U1: Semver-aware comparison — only suggests upgrades when package is strictly newer.
+ * Handles missing _template_version (old configs created before versioning).
+ */
+export declare function checkTemplateVersions(configPaths: string[]): Promise<TemplateUpgradeInfo[]>;
 export declare function runSync(opts: SyncOptions): Promise<number>;

package/dist/cli/commands/sync.js

@@ -253,28 +253,72 @@ export async function checkNamespaceCollisions(configPaths) {
         }
     }
 }
+/**
+ * Compare two semver strings. Returns:
+ *   1  if a > b
+ *   0  if a == b
+ *  -1  if a < b
+ * Handles major.minor.patch format. Non-numeric parts are ignored.
+ */
+export function compareSemver(a, b) {
+    const parse = (v) => v.split(".").map(s => parseInt(s, 10) || 0);
+    const pa = parse(a);
+    const pb = parse(b);
+    const len = Math.max(pa.length, pb.length);
+    for (let i = 0; i < len; i++) {
+        const va = pa[i] ?? 0;
+        const vb = pb[i] ?? 0;
+        if (va > vb)
+            return 1;
+        if (va < vb)
+            return -1;
+    }
+    return 0;
+}
 /**
  * Check template versions against current package version.
- * Prints upgrade suggestions for outdated configs.
+ * Returns upgrade info for outdated configs and prints human-readable suggestions.
+ *
+ * U1: Semver-aware comparison — only suggests upgrades when package is strictly newer.
+ * Handles missing _template_version (old configs created before versioning).
  */
-async function checkTemplateVersions(configPaths) {
+export async function checkTemplateVersions(configPaths) {
     const pkgVersion = await getPackageVersion();
     if (!pkgVersion)
-        return;
+        return [];
+    const upgrades = [];
     for (const configPath of configPaths) {
         try {
             const content = await readFile(configPath, "utf-8");
             const data = parseYAML(content);
             const tmplVersion = typeof data._template_version === "string" ? data._template_version : undefined;
             const tmplName = typeof data._source_template === "string" ? data._source_template : undefined;
-            if (tmplVersion && tmplName && tmplVersion !== pkgVersion) {
-                process.stderr.write(`Template "${tmplName}" has update: ${tmplVersion} → ${pkgVersion}. Run: dna init --upgrade ${tmplName}\n`);
+            if (tmplName && !tmplVersion) {
+                // Old config without version tracking — suggest upgrade
+                upgrades.push({
+                    configPath,
+                    templateName: tmplName,
+                    currentVersion: "unknown",
+                    availableVersion: pkgVersion,
+                });
+                process.stderr.write(`Upgrade available: "${tmplName}" has no version tag. Run: dna init --upgrade ${tmplName}\n`);
+            }
+            else if (tmplVersion && tmplName && compareSemver(pkgVersion, tmplVersion) > 0) {
+                // Package is strictly newer than template — suggest upgrade
+                upgrades.push({
+                    configPath,
+                    templateName: tmplName,
+                    currentVersion: tmplVersion,
+                    availableVersion: pkgVersion,
+                });
+                process.stderr.write(`Upgrade available: "${tmplName}" ${tmplVersion} → ${pkgVersion}. Run: dna init --upgrade ${tmplName}\n`);
             }
         }
         catch {
             // Non-critical — skip version check for unparseable files
         }
     }
+    return upgrades;
 }
 function resolveSpeciesPath(ref) {
     if (!ref.startsWith("species:"))

package/dist/cli/commands/verify.d.ts

@@ -12,6 +12,7 @@
 export interface VerifyOptions {
     lockFile: string;
     stats?: boolean;
+    health?: boolean;
 }
 export interface LockFileEntry {
     sha256: string;
@@ -31,3 +32,13 @@ export declare function sha256(content: string): string;
 export declare function parseLockFile(raw: string): LockFile;
 export declare function verifyLock(lock: LockFile): Promise<VerifyResult[]>;
 export declare function runVerify(opts: VerifyOptions): Promise<number>;
+export interface HealthCheckResult {
+    name: string;
+    status: "pass" | "warn" | "fail";
+    detail: string;
+}
+/**
+ * U3: Comprehensive health report for DNA installation.
+ * Checks IR, configs, templates, hooks, and trace system.
+ */
+export declare function runHealth(): Promise<number>;

package/dist/cli/commands/verify.js

@@ -54,6 +54,10 @@ export async function verifyLock(lock) {
 }
 // ── CLI entry ──────────────────────────────────────────────
 export async function runVerify(opts) {
+    // Handle --health mode
+    if (opts.health) {
+        return runHealth();
+    }
     // Handle --stats mode
     if (opts.stats) {
         return runStats();
@@ -214,3 +218,189 @@ function truncate(s, max) {
         return s;
     return s.slice(0, max - 3) + "...";
 }
+/**
+ * U3: Comprehensive health report for DNA installation.
+ * Checks IR, configs, templates, hooks, and trace system.
+ */
+export async function runHealth() {
+    const cwd = process.cwd();
+    const checks = [];
+    const { resolve } = await import("node:path");
+    const { stat, readFile: rf, readdir } = await import("node:fs/promises");
+    // 1. Check compiled IR
+    const irPath = resolve(cwd, ".dna", "compiled", "ir.json");
+    try {
+        const raw = await rf(irPath, "utf-8");
+        const data = JSON.parse(raw);
+        if (data.ir_version && data.ir) {
+            const age = Date.now() - new Date(data.compiled_at ?? data.ir.compiled_at).getTime();
+            const ageHours = Math.round(age / 3600000);
+            checks.push({
+                name: "Compiled IR",
+                status: "pass",
+                detail: `v${data.ir_version}, compiled ${ageHours}h ago, ${data.ir.source_dna_ids?.length ?? 0} template(s)`,
+            });
+        }
+        else if (data.compiled_at) {
+            checks.push({ name: "Compiled IR", status: "warn", detail: "Legacy format — run `dna sync` to upgrade" });
+        }
+        else {
+            checks.push({ name: "Compiled IR", status: "fail", detail: "Unrecognized format" });
+        }
+    }
+    catch {
+        checks.push({ name: "Compiled IR", status: "fail", detail: "Not found — run `dna sync`" });
+    }
+    // 2. Check DNA config files
+    const { autoDetectConfigs } = await import("./sync.js");
+    const configs = await autoDetectConfigs();
+    if (configs.length > 0) {
+        checks.push({ name: "DNA configs", status: "pass", detail: `${configs.length} config(s) found` });
+    }
+    else {
+        checks.push({ name: "DNA configs", status: "fail", detail: "No config files found — run `dna init --template <name>`" });
+    }
+    // 3. Check config validity
+    if (configs.length > 0) {
+        const { loadDNA } = await import("../../compiler/index.js");
+        let valid = 0;
+        let invalid = 0;
+        const errors = [];
+        for (const configPath of configs) {
+            try {
+                await loadDNA(configPath);
+                valid++;
+            }
+            catch (err) {
+                invalid++;
+                const { basename } = await import("node:path");
+                errors.push(`${basename(configPath)}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+        if (invalid === 0) {
+            checks.push({ name: "Config validity", status: "pass", detail: `${valid} config(s) valid` });
+        }
+        else {
+            checks.push({ name: "Config validity", status: "fail", detail: errors.join("; ") });
+        }
+    }
+    // 4. Check template versions
+    if (configs.length > 0) {
+        const { checkTemplateVersions: checkVersions } = await import("./sync.js");
+        // Suppress stderr output from checkTemplateVersions — we'll report ourselves
+        const origWrite = process.stderr.write;
+        process.stderr.write = (() => true);
+        try {
+            const upgrades = await checkVersions(configs);
+            if (upgrades.length === 0) {
+                checks.push({ name: "Template versions", status: "pass", detail: "All up to date" });
+            }
+            else {
+                const names = upgrades.map(u => `${u.templateName} (${u.currentVersion} → ${u.availableVersion})`);
+                checks.push({ name: "Template versions", status: "warn", detail: `Upgrade available: ${names.join(", ")}` });
+            }
+        }
+        catch {
+            checks.push({ name: "Template versions", status: "warn", detail: "Could not check versions" });
+        }
+        finally {
+            process.stderr.write = origWrite;
+        }
+    }
+    // 5. Check .claude settings or plugin registration
+    const settingsPath = resolve(cwd, ".claude", "settings.json");
+    try {
+        const raw = await rf(settingsPath, "utf-8");
+        const settings = JSON.parse(raw);
+        const hooks = settings.hooks;
+        const hasHooks = hooks && typeof hooks === "object" && Object.keys(hooks).length > 0;
+        if (hasHooks) {
+            const eventCount = Object.keys(hooks).length;
+            checks.push({ name: "Hook registration", status: "pass", detail: `${eventCount} event(s) in settings.json` });
+        }
+        else {
+            checks.push({ name: "Hook registration", status: "warn", detail: "No hooks in settings.json — using plugin mode?" });
+        }
+    }
+    catch {
+        // Check for plugin registration instead
+        const mcpPath = resolve(cwd, ".claude", ".mcp.json");
+        try {
+            const raw = await rf(mcpPath, "utf-8");
+            const mcp = JSON.parse(raw);
+            if (mcp.mcpServers?.intentdna) {
+                checks.push({ name: "MCP server", status: "pass", detail: "dna-mcp registered in .mcp.json" });
+            }
+            else {
+                checks.push({ name: "Hook registration", status: "warn", detail: "No hooks or MCP server found" });
+            }
+        }
+        catch {
+            checks.push({ name: "Hook registration", status: "warn", detail: "No settings.json or .mcp.json — run `dna setup` or `dna sync`" });
+        }
+    }
+    // 6. Check trace system
+    const traceDir = resolve(cwd, ".dna", "state", "trace");
+    try {
+        const files = await readdir(traceDir);
+        const traceFiles = files.filter(f => f.startsWith("trace-") && f.endsWith(".jsonl"));
+        if (traceFiles.length > 0) {
+            // Read latest trace file size
+            const latest = traceFiles.sort().pop();
+            const latestStat = await stat(resolve(traceDir, latest));
+            const sizeKB = Math.round(latestStat.size / 1024);
+            checks.push({ name: "Trace system", status: "pass", detail: `${traceFiles.length} file(s), latest ${sizeKB}KB` });
+        }
+        else {
+            checks.push({ name: "Trace system", status: "warn", detail: "No trace files — hooks not fired yet" });
+        }
+    }
+    catch {
+        checks.push({ name: "Trace system", status: "warn", detail: "No trace directory — will be created on first hook call" });
+    }
+    // 7. Check lock file drift
+    const lockPath = resolve(cwd, ".dna", "lock");
+    try {
+        const raw = await rf(lockPath, "utf-8");
+        const lock = parseLockFile(raw);
+        const results = await verifyLock(lock);
+        const drifted = results.filter(r => r.status !== "match");
+        if (drifted.length === 0) {
+            checks.push({ name: "Output drift", status: "pass", detail: `${results.length} file(s) match lock` });
+        }
+        else {
+            checks.push({ name: "Output drift", status: "warn", detail: `${drifted.length}/${results.length} file(s) drifted — run \`dna sync\`` });
+        }
+    }
+    catch {
+        checks.push({ name: "Output drift", status: "warn", detail: "No lock file — run `dna sync` to generate" });
+    }
+    // ── Format output ──────────────────────────────────────
+    const ICONS = { pass: "ok", warn: "!!", fail: "XX" };
+    process.stderr.write("\nIntent DNA Health Report\n");
+    process.stderr.write("========================\n\n");
+    let hasFailure = false;
+    let hasWarning = false;
+    for (const check of checks) {
+        const icon = ICONS[check.status];
+        const label = check.name.padEnd(20);
+        process.stderr.write(`  [${icon}] ${label} ${check.detail}\n`);
+        if (check.status === "fail")
+            hasFailure = true;
+        if (check.status === "warn")
+            hasWarning = true;
+    }
+    process.stderr.write("\n");
+    if (hasFailure) {
+        process.stderr.write("Status: issues found — see [XX] items above\n");
+        return 1;
+    }
+    else if (hasWarning) {
+        process.stderr.write("Status: healthy with warnings — see [!!] items above\n");
+        return 0;
+    }
+    else {
+        process.stderr.write("Status: all checks passed\n");
+        return 0;
+    }
+}

package/dist/cli/index.js

@@ -58,6 +58,7 @@ Examples:
   dna verify                          Verify synced files against .dna/lock
   dna verify --lock /path/to/.dna/lock
   dna verify --stats                  Show hook call statistics (last 24h)
+  dna verify --health                 Comprehensive health check of DNA installation
   dna import .                  Import existing harness configs into DNA format
   dna run --dna my.dna.json --workflow dev-pipeline --task P5.8
   dna run --dna my.dna.json --workflow dev-pipeline --task P5.8 --dry-run
@@ -126,6 +127,7 @@ async function main() {
                 options: {
                     lock: { type: "string", default: ".dna/lock" },
                     stats: { type: "boolean", default: false },
+                    health: { type: "boolean", default: false },
                 },
                 allowPositionals: true,
                 strict: false,
@@ -134,6 +136,7 @@ async function main() {
             const code = await runVerify({
                 lockFile: verifyValues.lock,
                 stats: verifyValues.stats,
+                health: verifyValues.health,
             });
             process.exit(code);
             break;

package/dist/hooks/cli.js

@@ -278,7 +278,8 @@ async function loadIR(irPath) {
         // Support both raw IR and wrapped CompiledIRFile format
         if (data.ir_version && data.ir) {
             if (data.ir_version !== EXPECTED_IR_VERSION) {
-                process.stderr.write(`[Intent DNA] IR version mismatch: file has v${data.ir_version}, expected v${EXPECTED_IR_VERSION}. Run \`dna sync\` to recompile.\n`);
+                process.stderr.write(`\n  Intent DNA: IR version mismatch (v${data.ir_version} on disk, v${EXPECTED_IR_VERSION} expected)\n` +
+                    `  Fix: run \`dna sync\` to recompile\n\n`);
             }
             return data.ir;
         }
@@ -286,9 +287,21 @@ async function loadIR(irPath) {
         if (data.compiled_at && data.source_dna_ids) {
             return data;
         }
+        process.stderr.write(`\n  Intent DNA: unrecognized IR format at ${irPath}\n` +
+            `  Fix: run \`dna sync\` to regenerate\n\n`);
         return null;
     }
-    catch {
+    catch (err) {
+        // U3: Human-readable error instead of silent failure
+        const isNotFound = err instanceof Error && "code" in err && err.code === "ENOENT";
+        if (isNotFound) {
+            process.stderr.write(`\n  Intent DNA: no compiled IR found at ${irPath}\n` +
+                `  Fix: run \`dna sync\` to compile your DNA config\n\n`);
+        }
+        else {
+            process.stderr.write(`\n  Intent DNA: failed to load IR — ${err instanceof Error ? err.message : String(err)}\n` +
+                `  Fix: run \`dna sync\` to recompile\n\n`);
+        }
         return null;
     }
 }

package/dist/mcp/index.js

@@ -13,6 +13,7 @@
 import { createMCPServer } from "./server.js";
 import { createStateTools } from "./tools-state.js";
 import { createCompileTools } from "./tools-compile.js";
+import { createEnforceTools } from "./tools-enforce.js";
 // Parse args
 const args = process.argv.slice(2);
 let projectDir = process.cwd();
@@ -34,5 +35,6 @@ catch { /* use default */ }
 const tools = [
     ...createStateTools(projectDir),
     ...createCompileTools(projectDir),
+    ...createEnforceTools(projectDir),
 ];
 createMCPServer({ name: "intentdna", version }, tools);

package/dist/mcp/tools-enforce.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Intent DNA — MCP Enforce Tools (U2)
+ *
+ * Provides enforcement via MCP server with in-memory IR cache.
+ * Zero cold-start: IR is loaded once and cached with mtime-based invalidation.
+ *
+ * Tools:
+ *   - dna_enforce: Run enforcement for a hook event (PreToolUse, PostToolUse, etc.)
+ */
+import type { ConstraintIR, RoleDef } from "../schema/types.js";
+import type { ToolDef } from "./server.js";
+/** In-memory IR cache with mtime-based invalidation. */
+export declare class IRCache {
+    private ir;
+    private roles;
+    private lastMtime;
+    private irPath;
+    constructor(projectDir: string);
+    /** Get cached IR, reloading from disk only if file changed. */
+    get(): Promise<{
+        ir: ConstraintIR;
+        roles?: Record<string, RoleDef>;
+    } | null>;
+    /** Invalidate the cache (e.g., after dna sync). */
+    invalidate(): void;
+}
+export declare function createEnforceTools(projectDir: string): ToolDef[];

package/dist/mcp/tools-enforce.js

@@ -0,0 +1,178 @@
+/**
+ * Intent DNA — MCP Enforce Tools (U2)
+ *
+ * Provides enforcement via MCP server with in-memory IR cache.
+ * Zero cold-start: IR is loaded once and cached with mtime-based invalidation.
+ *
+ * Tools:
+ *   - dna_enforce: Run enforcement for a hook event (PreToolUse, PostToolUse, etc.)
+ */
+import { resolve } from "node:path";
+import { stat, readFile } from "node:fs/promises";
+import { enforcePreToolUse, enforcePostToolUse, enforceUserPromptSubmit, enforceSubagentStop, enforcePreCompact, enforceNotification, enforceSessionStart, } from "../hooks/enforce.js";
+import { textResult, errorResult } from "./server.js";
+// ── IR Cache ────────────────────────────────────────────────
+/** In-memory IR cache with mtime-based invalidation. */
+export class IRCache {
+    ir = null;
+    roles = undefined;
+    lastMtime = 0;
+    irPath;
+    constructor(projectDir) {
+        this.irPath = resolve(projectDir, ".dna", "compiled", "ir.json");
+    }
+    /** Get cached IR, reloading from disk only if file changed. */
+    async get() {
+        try {
+            const fileStat = await stat(this.irPath);
+            const mtime = fileStat.mtimeMs;
+            const cachedIR = this.ir;
+            if (cachedIR && mtime === this.lastMtime) {
+                return { ir: cachedIR, roles: this.roles };
+            }
+            // File changed or first load — read from disk
+            const raw = await readFile(this.irPath, "utf-8");
+            const data = JSON.parse(raw);
+            if (data.ir_version && data.ir) {
+                const ir = data.ir;
+                this.ir = ir;
+                this.roles = data.roles;
+                this.lastMtime = mtime;
+                return { ir, roles: this.roles };
+            }
+            // Direct ConstraintIR format (backward compat)
+            if (data.compiled_at && data.source_dna_ids) {
+                const ir = data;
+                this.ir = ir;
+                this.roles = undefined;
+                this.lastMtime = mtime;
+                return { ir };
+            }
+            return null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /** Invalidate the cache (e.g., after dna sync). */
+    invalidate() {
+        this.ir = null;
+        this.roles = undefined;
+        this.lastMtime = 0;
+    }
+}
+const VALID_EVENTS = new Set([
+    "PreToolUse", "PostToolUse", "UserPromptSubmit",
+    "SubagentStop", "PreCompact", "Notification", "SessionStart",
+]);
+function dispatchEnforce(event, ir, input, roles) {
+    switch (event) {
+        case "PreToolUse":
+            return enforcePreToolUse(ir, {
+                tool_name: String(input.tool_name ?? ""),
+                tool_input: (input.tool_input ?? {}),
+                agent_type: typeof input.agent_type === "string" ? input.agent_type : undefined,
+                cwd: typeof input.cwd === "string" ? input.cwd : undefined,
+            }, undefined, roles);
+        case "PostToolUse":
+            return enforcePostToolUse(ir, {
+                tool_name: String(input.tool_name ?? ""),
+                tool_input: (input.tool_input ?? {}),
+                tool_output: typeof input.tool_output === "string" ? input.tool_output : undefined,
+                agent_type: typeof input.agent_type === "string" ? input.agent_type : undefined,
+            });
+        case "UserPromptSubmit":
+            return enforceUserPromptSubmit(ir, {
+                prompt: typeof input.prompt === "string" ? input.prompt : undefined,
+            });
+        case "SubagentStop":
+            return enforceSubagentStop(ir, {
+                agent_name: typeof input.agent_name === "string" ? input.agent_name : undefined,
+                agent_type: typeof input.agent_type === "string" ? input.agent_type : undefined,
+            });
+        case "PreCompact":
+            return enforcePreCompact(ir);
+        case "Notification":
+            return enforceNotification(ir, {
+                title: typeof input.title === "string" ? input.title : undefined,
+                message: typeof input.message === "string" ? input.message : undefined,
+            });
+        case "SessionStart":
+            return enforceSessionStart(ir, {
+                cwd: typeof input.cwd === "string" ? input.cwd : undefined,
+                session_id: typeof input.session_id === "string" ? input.session_id : undefined,
+            });
+        default:
+            return { continue: true, suppressOutput: true };
+    }
+}
+// ── Tool Registration ───────────────────────────────────────
+export function createEnforceTools(projectDir) {
+    const cache = new IRCache(projectDir);
+    return [
+        {
+            name: "dna_enforce",
+            description: "Run DNA enforcement for a hook event. Uses in-memory cached IR for zero cold-start. " +
+                "Returns the same result as the dna-hook binary but without spawning a new process.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    event: {
+                        type: "string",
+                        description: "Hook event type",
+                        enum: [...VALID_EVENTS],
+                    },
+                    input: {
+                        type: "object",
+                        description: "Hook input (same fields as Claude Code passes to hooks via stdin)",
+                    },
+                },
+                required: ["event", "input"],
+            },
+            handler: async (args) => {
+                const event = String(args.event);
+                if (!VALID_EVENTS.has(event)) {
+                    return errorResult(`Invalid event: ${event}. Valid: ${[...VALID_EVENTS].join(", ")}`);
+                }
+                const cached = await cache.get();
+                if (!cached) {
+                    return errorResult("No compiled IR found. Run `dna sync` to compile your DNA config.");
+                }
+                const input = (args.input ?? {});
+                const result = dispatchEnforce(event, cached.ir, input, cached.roles);
+                // Format as human-readable text
+                const lines = [];
+                lines.push(`Decision: ${result.continue ? "allow" : "BLOCK"}`);
+                if (result.reason)
+                    lines.push(`Reason: ${result.reason}`);
+                if (result.hookSpecificOutput?.additionalContext) {
+                    lines.push(`Context: ${result.hookSpecificOutput.additionalContext}`);
+                }
+                return textResult(lines.join("\n"));
+            },
+        },
+        {
+            name: "dna_enforce_cache_status",
+            description: "Check IR cache status — whether IR is loaded, file path, and last load time",
+            inputSchema: { type: "object", properties: {} },
+            handler: async () => {
+                const cached = await cache.get();
+                if (!cached) {
+                    return textResult("IR cache: empty (no compiled IR found at .dna/compiled/ir.json)");
+                }
+                const lines = [
+                    "IR cache: loaded",
+                    `  Templates: ${cached.ir.source_dna_ids.join(", ")}`,
+                    `  Compiled: ${cached.ir.compiled_at}`,
+                    `  Directives: ${cached.ir.prompt_directives.length}`,
+                    `  Gates: ${cached.ir.pre_execution_gates.length}`,
+                    `  Filters: ${cached.ir.tool_filters.length}`,
+                ];
+                if (cached.roles) {
+                    lines.push(`  Roles: ${Object.keys(cached.roles).join(", ")}`);
+                }
+                return textResult(lines.join("\n"));
+            },
+        },
+    ];
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "intentdna",
-  "version": "1.5.3",
+  "version": "1.5.4",
   "description": "Intent DNA — Declarative policy layer for AI agent behavior",
   "type": "module",
   "main": "dist/index.js",

package/spec/foundation-hardening.md

@@ -172,6 +172,6 @@ hook 报错时输出人类可读的提示而非 JSON。`dna verify` 输出友好
 - [x] 远程通信架构预留（接口定义，不实现）
 
 ### 第三阶段
-- [ ] dna sync 自动检测模板版本 + 提示升级
-- [ ] MCP server 常驻进程解决冷启动
-- [ ] 错误信息人类可读
+- [x] dna sync 自动检测模板版本 + 提示升级
+- [x] MCP server 常驻进程解决冷启动
+- [x] 错误信息人类可读