intentdna 1.5.5 → 1.5.6

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "intentdna",
       "description": "DNA template compilation + runtime enforcement",
-      "version": "1.5.5",
+      "version": "1.5.6",
       "source": "./"
     }
   ]

package/.claude-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "intentdna",
-  "version": "1.5.5",
+  "version": "1.5.6",
   "description": "Declarative policy layer for AI agent governance"
 }

package/dist/runtime/skill-adapter.js

@@ -42,7 +42,7 @@ export function compileWorkflowToSkill(plan, roles, ir, variables) {
         lines.push("</Purpose>");
         lines.push("");
     }
-    // Steps
+    // Steps — each step MUST be executed via Agent() tool call
     const usedRoles = new Set(plan.steps.map((s) => s.role));
     lines.push("<Steps>");
     let stepNumber = 0;
@@ -51,24 +51,44 @@ export function compileWorkflowToSkill(plan, roles, ir, variables) {
         for (const stepId of group.step_ids) {
             stepNumber++;
             const step = plan.steps.find((s) => s.id === stepId);
-            const agent = `@dna-${toKebabCase(step.role)}`;
-            const runIf = step.run_if ? ` (${step.run_if})` : "";
+            const agentType = `dna-${toKebabCase(step.role)}`;
+            const runIf = step.run_if ? `\n   **Condition**: ${step.run_if}` : "";
             const optional = step.optional ? " (optional)" : "";
-            lines.push(`${stepNumber}. **${step.id}** → ${agent}${runIf}${optional}`);
-            lines.push(`   ${step.description}`);
-            if (step.prompt) {
-                lines.push(`   Prompt: ${step.prompt}`);
+            // Build agent prompt: anti-recursion + role identity + task
+            const promptParts = [
+                "Do NOT spawn sub-agents.",
+                `You are the ${agentType} agent.`,
+                step.prompt || step.description,
+            ];
+            const agentPrompt = escapePrompt(promptParts.join(" "));
+            lines.push(`${stepNumber}. **${step.id}**${optional}`);
+            lines.push(`   ${step.description}${runIf}`);
+            lines.push("");
+            lines.push(`   Execute with Agent tool — DO NOT perform this work yourself:`);
+            lines.push(`   \`\`\``);
+            lines.push(`   Agent(`);
+            lines.push(`     subagent_type="${agentType}",`);
+            lines.push(`     prompt="${agentPrompt}"`);
+            lines.push(`   )`);
+            lines.push(`   \`\`\``);
+            lines.push(`   Wait for agent to complete. Read the output before proceeding.`);
+            if (step.handoff?.produces && step.handoff.produces.length > 0) {
+                const artifacts = step.handoff.produces.map(p => p.description).join(", ");
+                lines.push(`   Verify produced artifacts: ${artifacts}`);
             }
+            lines.push("");
         }
     }
     lines.push("</Steps>");
     lines.push("");
-    // Execution Policy — force-complete standard
+    // Execution Policy — force Agent dispatch
     lines.push("<Execution_Policy>");
+    lines.push("- **CRITICAL**: Each step MUST be executed by spawning an Agent using the Agent tool with the specified subagent_type. DO NOT perform any step's work directly in the main session.");
     lines.push("- Use TodoWrite to track each step as pending/in_progress/completed.");
     lines.push("- After completing each step, immediately proceed to the next — do not stop, summarize, or wait for confirmation.");
     lines.push("- If a step fails, mark it as failed in TodoWrite, log the error, and continue to the next non-dependent step.");
     lines.push("- Do not ask the user for permission between steps — the workflow is pre-approved.");
+    lines.push("- Wait for each Agent to complete and read its output before proceeding to the next step.");
     lines.push("</Execution_Policy>");
     lines.push("");
     // Tool_Usage — only if roles have permissions or scope
@@ -232,3 +252,11 @@ export async function removeSkillFiles(outputDir) {
 function escapeYaml(s) {
     return s.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
 }
+/** Escape prompt text for Agent() call template inside markdown code block. */
+function escapePrompt(s) {
+    return s
+        .replace(/\\/g, "\\\\")
+        .replace(/"/g, '\\"')
+        .replace(/`{3,}/g, "` ` `")
+        .replace(/\n/g, "\\n");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "intentdna",
-  "version": "1.5.5",
+  "version": "1.5.6",
   "description": "Intent DNA — Declarative policy layer for AI agent behavior",
   "type": "module",
   "main": "dist/index.js",

package/spec/agent-dispatch-fix.md

@@ -0,0 +1,116 @@
+# Spec: F5 Agent 调度漏洞修复
+
+## 问题（架构级）
+
+DNA 的 skill-adapter.ts 生成的 SKILL.md 用文字提示调度 agent：
+
+```
+1. **scan** → @dna-frw-scanner
+   Prompt: ...
+```
+
+LLM 把这当成建议，选择自己做而非 spawn agent。导致：
+
+- agent_type 为空 → role scope 不生效
+- tool_permissions deny 不生效（scanner 能写文件）
+- review/verify 步骤在主 session 做 → 自己审自己
+- handoff chain 无意义（没有跨 agent artifact 传递）
+- agent MD 文件从未被加载
+- 所有 role-based 治理形同虚设
+
+## 影响范围
+
+**以下交付物全部不生效：**
+
+| 功能 | 依赖 | 当前状态 |
+|------|------|---------|
+| Role scope (read/write 范围) | agent_type 匹配 | 不生效 |
+| tool_permissions deny | agent_type 匹配 | 不生效 |
+| review 步骤只读约束 | investigator agent spawn | 不生效 |
+| verify 步骤独立验证 | 独立 agent context | 不生效 |
+| merge-time scope gate | worktree + agent 隔离 | 不生效 |
+| handoff consumes/produces | 跨 agent artifact | 不生效 |
+| step enforce rules (G4) | workflow state + agent_type | 不生效 |
+| agent MD 文件加载 | agent spawn 时 CC 自动加载 | 从未加载 |
+
+## 根因
+
+OMC 用 Claude Code 原生 `Task(subagent_type=...)` API 强制 spawn agent：
+
+```
+Task(subagent_type="oh-my-claudecode:executor", prompt="implement caching")
+```
+
+这是 API 级调用，LLM 无法绕过。spawn 的 agent 有独立 context、独立 agent_type，hooks 能识别和 enforce。
+
+DNA 的 SKILL.md 只是文字提示，不是 API 调用。
+
+## 修复方案
+
+### skill-adapter.ts 改动
+
+生成的 SKILL.md `<Steps>` 部分从：
+
+```markdown
+1. **scan** → @dna-frw-scanner
+   Prompt: Scan module...
+```
+
+改为：
+
+```markdown
+1. **scan**
+   Execute with Agent tool — DO NOT perform this work in the main session:
+   ```
+   Agent(subagent_type="dna-frw-scanner", prompt="Scan module '$ARGUMENTS' in common/lib/. ...")
+   ```
+   Wait for agent to complete. Read the agent's output before proceeding.
+```
+
+### 关键设计要点
+
+1. **每步必须是 Agent() 调用**，不是文字描述
+2. **明确禁止主 session 做 agent 的工作**："DO NOT perform this work in the main session"
+3. **Agent 输出要读取**：Agent 完成后读取其 output，作为下一步的 handoff
+4. **Agent 工具参数完整**：subagent_type 用 DNA 编译的 agent 名称，prompt 用编译的步骤 prompt
+5. **参考 OMC 的 preamble 模式**：spawn 的 agent 不应再 spawn 子 agent（"Do NOT spawn sub-agents"）
+
+### 生成模板
+
+```typescript
+// skill-adapter.ts — 每个 workflow step 生成：
+function generateStepExecution(step, roleName, prompt) {
+  return `
+### Step: ${step.id}
+
+Execute with Agent tool — DO NOT perform this work yourself:
+
+\`\`\`
+Agent(
+  subagent_type="dna-${toKebabCase(roleName)}",
+  prompt="${escapePrompt(prompt)}"
+)
+\`\`\`
+
+Wait for agent to complete. Read the output.
+${step.handoff?.produces ? `Verify produced artifacts: ${step.handoff.produces.map(p => p.description).join(', ')}` : ''}
+`;
+}
+```
+
+### 验证方式
+
+修复后跑 behavior-lock(home)，检查 trace：
+- agent_type 应该有值（dna-frw-scanner, dna-frw-test-writer）
+- 不应该全是 "-"
+
+## Acceptance Criteria
+
+- [ ] skill-adapter.ts 生成强制 Agent() 调用格式
+- [ ] 每步明确禁止主 session 直接执行
+- [ ] Agent subagent_type 使用编译后的 role 名称
+- [ ] Agent prompt 包含完整步骤 prompt + variables 替换
+- [ ] spawn 的 agent 包含 "Do NOT spawn sub-agents" 约束
+- [ ] handoff produces 在 Agent 完成后验证
+- [ ] 测试：生成的 SKILL.md 包含 Agent() 调用模板
+- [ ] 实战验证：trace 中 agent_type 有值