intentdna 1.6.5 → 1.7.0

package/dist/schema/validators/controllers.js

@@ -8,6 +8,12 @@ function isSafeControllerArtifactPath(path) {
         !path.includes("}}") &&
         path.includes("$ARGUMENTS");
 }
+function isSafeGeneratedIdentifier(value) {
+    return /^[A-Za-z0-9_-]+$/.test(value) && !value.includes("..") && !value.includes("/") && !value.includes("\\");
+}
+function isSafeGeneratedDisplayName(value) {
+    return /^[A-Za-z0-9][A-Za-z0-9 _-]*$/.test(value) && !value.includes("..");
+}
 function validateStringList(value, path, errors) {
     if (!Array.isArray(value)) {
         errors.push({ path, message: "must be an array of non-empty strings" });
@@ -69,6 +75,13 @@ export function validateController(controller, roleNames, workflows, path) {
     if (!controller.name) {
         errors.push({ path: `${path}.name`, message: "controller requires 'name'" });
     }
+    else if (!isSafeGeneratedDisplayName(controller.name)) {
+        errors.push({ path: `${path}.name`, message: "controller name must contain only letters, digits, spaces, underscores, and hyphens" });
+    }
+    const controllerKey = path.startsWith("controllers.") ? path.slice("controllers.".length) : "";
+    if (controllerKey && !isSafeGeneratedIdentifier(controllerKey)) {
+        errors.push({ path, message: "controller key must contain only letters, digits, underscores, and hyphens" });
+    }
     const kindMetadata = isSupportedControllerKind(controller.kind)
         ? getControllerKindMetadata(controller.kind)
         : undefined;
@@ -121,6 +134,9 @@ export function validateController(controller, roleNames, workflows, path) {
             if (typeof roleName !== "string" || !roleName) {
                 errors.push({ path: `${path}.roles.${roleKey}`, message: "must be a non-empty role name" });
             }
+            else if (!isSafeGeneratedIdentifier(roleName)) {
+                errors.push({ path: `${path}.roles.${roleKey}`, message: "role name must contain only letters, digits, underscores, and hyphens" });
+            }
             else if (!roleNames.has(roleName)) {
                 errors.push({ path: `${path}.roles.${roleKey}`, message: `references unknown role '${roleName}'` });
             }

package/dist/signals/index.d.ts

@@ -2,12 +2,14 @@ import type { TraceEntry, VerifierResultEntry } from "../hooks/state.js";
 import type { ExecutionOutcome } from "../evolution/types.js";
 export type SignalKind = "trace" | "verifier" | "external";
 export type SignalStatus = "positive" | "negative" | "neutral";
+export type ExternalSignalClassification = "protective" | "friction" | "unknown";
 export interface SignalEvidence {
     target?: string;
     evidence?: string;
     exit_code?: number;
     artifact?: string;
     message?: string;
+    evidence_ref?: string;
 }
 export interface SignalEnvelope {
     id: string;
@@ -19,6 +21,10 @@ export interface SignalEnvelope {
     detail?: string;
     adapter?: string;
     evidence_payload?: SignalEvidence;
+    classification?: ExternalSignalClassification;
+    confidence?: number;
+    mapping_policy?: string;
+    evolution_eligible?: boolean;
 }
 export interface ExternalSignalInput {
     id?: string;
@@ -32,6 +38,10 @@ export interface ExternalSignalInput {
     exit_code?: number;
     artifact?: string;
     message?: string;
+    evidence_ref?: string;
+    classification?: ExternalSignalClassification;
+    confidence?: number;
+    mapping_policy?: string;
 }
 export interface SignalSourceAdapter<T = unknown> {
     name: string;

package/dist/signals/index.js

@@ -1,4 +1,35 @@
 import { extractGeneFromReason } from "../evolution/trace-bridge.js";
+const SAFE_EXTERNAL_GENE = /^[A-Za-z0-9:_-]+$/;
+function hasSafeExternalGene(gene) {
+    return typeof gene === "string" && SAFE_EXTERNAL_GENE.test(gene);
+}
+function hasNonBlankText(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+function isSignalStatus(value) {
+    return value === "positive" || value === "negative" || value === "neutral";
+}
+function isExternalSignalClassification(value) {
+    return value === undefined || value === "protective" || value === "friction" || value === "unknown";
+}
+function hasFiniteConfidence(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 1;
+}
+function hasExternalSignalShape(signal) {
+    return isSignalStatus(signal.status) &&
+        hasNonBlankText(signal.source) &&
+        isExternalSignalClassification(signal.classification) &&
+        (signal.confidence === undefined || hasFiniteConfidence(signal.confidence));
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function asString(value) {
+    return typeof value === "string" ? value : undefined;
+}
+function asNumber(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
 function toSignalEvidence(result) {
     const payload = {
         target: result.target,
@@ -6,23 +37,75 @@ function toSignalEvidence(result) {
         exit_code: result.exit_code,
         artifact: result.artifact,
         message: result.message,
+        evidence_ref: "evidence_ref" in result ? result.evidence_ref : undefined,
     };
     return Object.values(payload).some((value) => value !== undefined) ? payload : undefined;
 }
+function hasExternalSignalInputContract(signal) {
+    return (hasExternalSignalShape(signal) &&
+        hasFiniteConfidence(signal.confidence) &&
+        hasNonBlankText(signal.mapping_policy) &&
+        hasNonBlankText(signal.evidence_ref) &&
+        hasSafeExternalGene(signal.gene));
+}
+function hasExternalSignalEnvelopeContract(signal) {
+    return (isSignalStatus(signal.status) &&
+        hasNonBlankText(signal.source) &&
+        isExternalSignalClassification(signal.classification) &&
+        hasFiniteConfidence(signal.confidence) &&
+        hasNonBlankText(signal.mapping_policy) &&
+        hasNonBlankText(signal.evidence_payload?.evidence_ref) &&
+        hasSafeExternalGene(signal.gene));
+}
 function normalizeExternalSignals(adapterName, payload) {
     const items = Array.isArray(payload) ? payload : [payload];
-    return items.map((item, index) => {
-        const timestamp = item.timestamp ?? new Date().toISOString();
+    return items.map((raw, index) => {
+        const timestamp = isRecord(raw) ? asString(raw.timestamp) ?? new Date().toISOString() : new Date().toISOString();
+        if (!isRecord(raw)) {
+            return {
+                id: `${adapterName}:invalid:${timestamp}:${index}`,
+                kind: "external",
+                status: "neutral",
+                timestamp,
+                source: `${adapterName}.invalid`,
+                adapter: adapterName,
+                classification: "unknown",
+                evolution_eligible: false,
+            };
+        }
+        const item = {
+            id: asString(raw.id),
+            status: raw.status,
+            timestamp,
+            gene: asString(raw.gene),
+            source: asString(raw.source) ?? "",
+            detail: asString(raw.detail),
+            target: asString(raw.target),
+            evidence: asString(raw.evidence),
+            exit_code: asNumber(raw.exit_code),
+            artifact: asString(raw.artifact),
+            message: asString(raw.message),
+            evidence_ref: asString(raw.evidence_ref),
+            classification: raw.classification,
+            confidence: typeof raw.confidence === "number" ? raw.confidence : undefined,
+            mapping_policy: asString(raw.mapping_policy),
+        };
+        const shapeValid = hasExternalSignalShape(item);
+        const complete = hasExternalSignalInputContract(item);
         return {
-            id: item.id ?? `${adapterName}:${item.source}:${timestamp}:${index}`,
+            id: item.id ?? `${adapterName}:${shapeValid ? item.source : "invalid"}:${timestamp}:${index}`,
             kind: "external",
-            status: item.status,
+            status: shapeValid ? item.status : "neutral",
             timestamp,
             gene: item.gene,
-            source: item.source,
+            source: hasNonBlankText(item.source) ? item.source : `${adapterName}.invalid`,
             detail: item.detail ?? item.message ?? item.evidence,
             adapter: adapterName,
             evidence_payload: toSignalEvidence(item),
+            classification: isExternalSignalClassification(item.classification) ? (item.classification ?? "unknown") : "unknown",
+            confidence: hasFiniteConfidence(item.confidence) ? item.confidence : undefined,
+            mapping_policy: item.mapping_policy,
+            evolution_eligible: complete,
         };
     });
 }
@@ -85,6 +168,8 @@ export function signalsToOutcomes(signals, dnaId = "default") {
     for (const signal of signals) {
         if (!signal.gene)
             continue;
+        if (signal.kind === "external" && !hasExternalSignalEnvelopeContract(signal))
+            continue;
         const effect = signal.status === "positive"
             ? "helped"
             : signal.status === "negative"

package/dist/templates/catalog.d.ts

@@ -0,0 +1,19 @@
+export declare const BUILTIN_TEMPLATES_DIR: string;
+export declare const PROJECT_TEMPLATES_DIR = ".dna/templates";
+export interface TemplateCatalogEntry {
+    name: string;
+    path: string;
+    namespace?: string;
+    displayName?: string;
+    version?: string;
+    contentHash: string;
+    source: "builtin" | "project";
+    keywords: readonly string[];
+}
+export declare function calculateTemplateContentHash(content: string): string;
+export declare function listTemplateCatalog(options?: {
+    projectDir?: string;
+}): Promise<TemplateCatalogEntry[]>;
+export declare function findTemplateCatalogEntry(name: string, options?: {
+    projectDir?: string;
+}): Promise<TemplateCatalogEntry | undefined>;

package/dist/templates/catalog.js

@@ -0,0 +1,57 @@
+import { readFile, readdir } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseYAML } from "../schema/yaml-parser.js";
+import { getTemplateMatchMetadata } from "./metadata.js";
+export const BUILTIN_TEMPLATES_DIR = resolve(dirname(fileURLToPath(import.meta.url)), "..", "templates");
+export const PROJECT_TEMPLATES_DIR = ".dna/templates";
+function calculateContentHash(content) {
+    return createHash("sha256").update(content, "utf-8").digest("hex").slice(0, 16);
+}
+async function readTemplateEntry(path, source) {
+    const content = await readFile(path, "utf-8");
+    const data = parseYAML(content);
+    const fileName = path.split("/").pop() ?? path;
+    const name = fileName.replace(/\.dna\.ya?ml$/, "");
+    const matchMetadata = getTemplateMatchMetadata(name);
+    return {
+        name,
+        path,
+        namespace: typeof data.namespace === "string" ? data.namespace : undefined,
+        displayName: typeof data.name === "string" ? data.name : undefined,
+        version: typeof data.version === "string" ? data.version : undefined,
+        contentHash: calculateContentHash(content),
+        source,
+        keywords: matchMetadata?.keywords ?? [],
+    };
+}
+async function collectTemplates(dir, source) {
+    try {
+        const files = await readdir(dir);
+        const templateFiles = files
+            .filter((file) => file.endsWith(".dna.yaml") || file.endsWith(".dna.yml"))
+            .sort();
+        const entries = [];
+        for (const file of templateFiles) {
+            entries.push(await readTemplateEntry(resolve(dir, file), source));
+        }
+        return entries;
+    }
+    catch {
+        return [];
+    }
+}
+export function calculateTemplateContentHash(content) {
+    return calculateContentHash(content);
+}
+export async function listTemplateCatalog(options) {
+    const projectDir = options?.projectDir ?? process.cwd();
+    const builtin = await collectTemplates(BUILTIN_TEMPLATES_DIR, "builtin");
+    const project = await collectTemplates(resolve(projectDir, PROJECT_TEMPLATES_DIR), "project");
+    return [...builtin, ...project];
+}
+export async function findTemplateCatalogEntry(name, options) {
+    const entries = await listTemplateCatalog(options);
+    return entries.find((entry) => entry.name === name || entry.displayName === name || entry.namespace === name);
+}

package/dist/templates/flutter-rewrite.dna.yaml

@@ -335,8 +335,8 @@ controllers:
         - "- MAX_ROUNDS: stop, report max rounds reached and next focus"
       stop_report:
         - "On REQUEST_CHANGES, BLOCKED, or MAX_ROUNDS, output exactly these Chinese sections:"
-        - "结论：state the direct stop trigger, current round, and current commit if one exists."
-        - "为什么停止：explain the workflow principle in plain language; if this is a current-round new red, explain that continuing would build on a bad baseline."
+        - "结论：state the direct stop trigger, current round, and current commit if one exists; cite verifier result_id, trace_id, or ArtifactManifest artifact id."
+        - "为什么停止：explain the workflow principle in plain language; if this is a current-round new red, explain that continuing would build on a bad baseline; prose-only claims are not sufficient."
         - "是否回滚：say whether rollback/revert is recommended. If the commit direction looks wrong or the blast radius is unclear, recommend revert; if the failure is narrow and fixable, recommend fix-forward."
         - "下一步：give one concrete next action. If recommending fix-forward, include a copy-paste single-fix prompt with current commit, exact failure, allowed scope, forbidden actions, verification command, commit expectation, and stop conditions."
       constraints:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "intentdna",
-  "version": "1.6.5",
+  "version": "1.7.0",
   "description": "Intent DNA — Declarative policy layer for AI agent behavior",
   "type": "module",
   "main": "dist/index.js",

package/spec/foundation-hardening.md

@@ -173,5 +173,6 @@ hook 报错时输出人类可读的提示而非 JSON。`dna verify` 输出友好
 
 ### 第三阶段
 - [x] dna sync 自动检测模板版本 + 提示升级
-- [x] MCP server 常驻进程解决冷启动
+- [x] MCP server 常驻进程复用完整 hook runtime + IR cache
+- [ ] Claude settings hook 零进程调度（后续性能优化）
 - [x] 错误信息人类可读