intentdna 1.7.4 → 1.8.0

package/dist/hooks/state.js

@@ -13,6 +13,8 @@ import { readFile, writeFile, rename, mkdir, appendFile, unlink, readdir, stat }
 import { createHash } from "node:crypto";
 import { join, dirname } from "node:path";
 import { CASCADE_LAYER_NAMES, RUNTIME_DECISION_EVENT_SCHEMA_VERSION } from "../governance/index.js";
+// ── Types ──────────────────────────────────────────────────
+export const EVIDENCE_CAPTURE_SCHEMA_VERSION = "intentdna.evidence_capture.v1";
 // ── Constants ──────────────────────────────────────────────
 const WORKFLOW_FILE = "workflow.json";
 const DEFAULT_STALENESS_MS = 2 * 60 * 60 * 1000; // 2 hours
@@ -408,6 +410,7 @@ export async function appendVerifierResult(projectDir, result, sessionId) {
 }
 const TRACE_DIR = "trace";
 const RUNTIME_DECISION_DIR = "runtime-decisions";
+const EVIDENCE_CAPTURE_DIR = join("evidence", "capture");
 const MAX_TRACE_SIZE = 10 * 1024 * 1024; // 10MB
 const TRACE_RETENTION_DAYS = 7;
 /**
@@ -475,15 +478,135 @@ function datedJsonlFileName(prefix, date) {
 function decisionFileName(date) {
     return datedJsonlFileName("runtime-decision", date);
 }
+function evidenceCaptureFileName(date) {
+    return `${date}.jsonl`;
+}
+function privacyDigest(domain, value) {
+    const material = value && value.trim().length > 0 ? value : "unknown";
+    return createHash("sha256")
+        .update(`intentdna.privacy.${domain}\0${material}`)
+        .digest("hex");
+}
+const OPAQUE_REFERENCE = /^(?:(?:[a-z][a-z0-9:-]*:)?sha256:[a-f0-9]{64}|[a-f0-9]{8}-[a-f0-9]{4}-[1-8][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12})$/i;
+const PROJECTED_REFERENCE = /^intentdna-[a-z0-9-]+:sha256:[a-f0-9]{64}$/i;
+const RUNTIME_EVIDENCE_REF_TYPES = new Set(["trace", "audit", "artifact", "verifier", "handoff", "legacy", "unknown", "unsupported"]);
+const CAPTURE_EVIDENCE_REF_TYPES = new Set([...RUNTIME_EVIDENCE_REF_TYPES, "runtime_decision_event", "completion_check", "git_commit"]);
+function projectedValue(domain, value) {
+    const material = value && value.trim().length > 0 ? value : "unknown";
+    if (material === "unknown" || material === "unsupported")
+        return material;
+    if (material.startsWith(`intentdna-${domain}:sha256:`) && PROJECTED_REFERENCE.test(material))
+        return material;
+    return `intentdna-${domain}:sha256:${privacyDigest(domain, material)}`;
+}
+function projectedSessionDirName(sessionId) {
+    return `session-sha256-${privacyDigest("session-dir", sessionId)}`;
+}
+function projectedRuntimeEvidenceRef(ref) {
+    const type = RUNTIME_EVIDENCE_REF_TYPES.has(ref.type) ? ref.type : "unknown";
+    return {
+        type,
+        ref: OPAQUE_REFERENCE.test(ref.ref) ? ref.ref : projectedValue(`c4-evidence-ref-${type}`, ref.ref),
+    };
+}
+function projectedCaptureEvidenceRef(ref) {
+    const type = CAPTURE_EVIDENCE_REF_TYPES.has(ref.type) ? ref.type : "unknown";
+    if (type === "runtime_decision_event" || OPAQUE_REFERENCE.test(ref.ref))
+        return { type, ref: ref.ref };
+    return {
+        type,
+        ref: projectedValue(`c5-evidence-ref-${type}`, ref.ref),
+    };
+}
+function dateFromIso(value) {
+    return typeof value === "string" && /^\d{4}-\d{2}-\d{2}T/.test(value)
+        ? value.slice(0, 10)
+        : new Date().toISOString().slice(0, 10);
+}
+function redactEvidenceCaptureText(value) {
+    return value
+        .replace(/(authorization:\s*Bearer\s+)[^\s'"]+/gi, "$1<redacted>")
+        .replace(/((?:INTENTDNA_API_TOKEN|INTENTDNA_SUPABASE_USER_JWT|SUPABASE_ACCESS_TOKEN|SUPABASE_SERVICE_ROLE_KEY|INTENTDNA_TOKEN_PEPPER|SUPABASE_SECRET_KEYS)=)(?:"[^"]*"|'[^']*'|[^\s'"]+)/gi, "$1<redacted>")
+        .replace(/idna_[A-Za-z0-9_-]+/g, "idna_<redacted>")
+        .replace(/sbp_[A-Za-z0-9_-]+/g, "sbp_<redacted>")
+        .replace(/eyJ[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+){2}/g, "<jwt-redacted>");
+}
+function redactEvidenceCaptureEvent(event) {
+    return {
+        ...event,
+        project_root: projectedValue("c5-project-root", event.project_root),
+        run_id: projectedValue("c5-run-id", event.run_id),
+        summary: projectedValue("c5-summary", redactEvidenceCaptureText(event.summary)),
+        command: event.command ? projectedValue("c5-command", redactEvidenceCaptureText(event.command)) : undefined,
+        retry: event.retry ? { ...event.retry, reason: projectedValue("c5-retry-reason", redactEvidenceCaptureText(event.retry.reason)) } : undefined,
+        manual_intervention: event.manual_intervention
+            ? { ...event.manual_intervention, reason: projectedValue("c5-manual-reason", redactEvidenceCaptureText(event.manual_intervention.reason)) }
+            : undefined,
+        evidence_refs: event.evidence_refs?.map(projectedCaptureEvidenceRef),
+        redaction: "intentdna.c5.persistent_projection.v1",
+    };
+}
+function projectRuntimeDecisionEventForDisk(event) {
+    return {
+        ...event,
+        org_id: projectedValue("c4-org-id", event.org_id),
+        team_id: projectedValue("c4-team-id", event.team_id),
+        user_id: projectedValue("c4-user-id", event.user_id),
+        project_id: projectedValue("c4-project-id", event.project_id),
+        agent_id: projectedValue("c4-agent-id", event.agent_id),
+        agent_role: projectedValue("c4-agent-role", event.agent_role),
+        agent_type: projectedValue("c4-agent-type", event.agent_type),
+        session_agent: projectedValue("c4-session-agent", event.session_agent),
+        cascade_layers: Object.fromEntries(CASCADE_LAYER_NAMES.map((layer) => {
+            const entry = event.cascade_layers[layer];
+            return [layer, {
+                    ...entry,
+                    source_ref: projectedValue(`c4-cascade-${layer}-source-ref`, entry.source_ref),
+                }];
+        })),
+        winning_constraint: {
+            ...event.winning_constraint,
+            provenance_reason: projectedValue("c4-winning-provenance-reason", event.winning_constraint.provenance_reason),
+        },
+        decision_reason: projectedValue("c4-decision-reason", event.decision_reason),
+        harness_runtime_context: {
+            ...event.harness_runtime_context,
+            agent_id: projectedValue("c4-agent-id", event.harness_runtime_context.agent_id),
+            agent_role: projectedValue("c4-agent-role", event.harness_runtime_context.agent_role),
+            agent_type: projectedValue("c4-agent-type", event.harness_runtime_context.agent_type),
+            session_agent: projectedValue("c4-session-agent", event.harness_runtime_context.session_agent),
+        },
+        session_id: projectedValue("c4-session-id", event.session_id),
+        run_id: projectedValue("c4-run-id", event.run_id),
+        step_id: projectedValue("c4-step-id", event.step_id),
+        tool_name: projectedValue("c4-tool-name", event.tool_name),
+        resource_ref: projectedValue("c4-resource-ref", event.resource_ref),
+        evidence_refs: event.evidence_refs.map(projectedRuntimeEvidenceRef),
+    };
+}
+export async function appendEvidenceCaptureEvent(projectDir, event) {
+    try {
+        const sanitized = redactEvidenceCaptureEvent(event);
+        const line = JSON.stringify(sanitized) + "\n";
+        const date = dateFromIso(sanitized.captured_at);
+        const captureDir = join(projectDir, ".dna", EVIDENCE_CAPTURE_DIR);
+        await mkdir(captureDir, { recursive: true });
+        await appendFile(join(captureDir, evidenceCaptureFileName(date)), line, "utf-8");
+    }
+    catch {
+        // Fail-open: evidence capture write failure never affects hook execution
+    }
+}
 export async function appendRuntimeDecisionEvent(projectDir, event, sessionId) {
     try {
-        const line = JSON.stringify(event) + "\n";
+        const projected = projectRuntimeDecisionEventForDisk(event);
+        const line = JSON.stringify(projected) + "\n";
         const date = new Date().toISOString().slice(0, 10);
         const globalDir = join(projectDir, ".dna", "state", RUNTIME_DECISION_DIR);
         await mkdir(globalDir, { recursive: true });
         await appendFile(join(globalDir, decisionFileName(date)), line, "utf-8");
         if (sessionId) {
-            const sessionDir = resolveStateDir(projectDir, sessionId);
+            const sessionDir = resolveStateDir(projectDir, projectedSessionDirName(sessionId));
             await mkdir(sessionDir, { recursive: true });
             await appendFile(join(sessionDir, "runtime-decisions.jsonl"), line, "utf-8");
         }
@@ -572,6 +695,7 @@ function normalizeRuntimeDecisionEvent(value) {
 export async function readRuntimeDecisionEvents(projectDir, days = 1, sessionId) {
     const entries = [];
     if (sessionId) {
+        entries.push(...await readRuntimeDecisionFile(join(resolveStateDir(projectDir, projectedSessionDirName(sessionId)), "runtime-decisions.jsonl")));
         entries.push(...await readRuntimeDecisionFile(join(resolveStateDir(projectDir, sessionId), "runtime-decisions.jsonl")));
     }
     else {

package/dist/index.d.ts

@@ -2,3 +2,6 @@ export * from "./schema/index.js";
 export * from "./compiler/index.js";
 export * from "./runtime/index.js";
 export * from "./governance/index.js";
+export * from "./assets/index.js";
+export * from "./workflow/index.js";
+export * from "./organization/index.js";

package/dist/index.js

@@ -2,3 +2,6 @@ export * from "./schema/index.js";
 export * from "./compiler/index.js";
 export * from "./runtime/index.js";
 export * from "./governance/index.js";
+export * from "./assets/index.js";
+export * from "./workflow/index.js";
+export * from "./organization/index.js";

package/dist/mcp/tools-state.js

@@ -104,6 +104,7 @@ export function createStateTools(projectDir) {
                 type: "object",
                 properties: {
                     workflow: { type: "string", description: "Workflow name" },
+                    workflow_asset: { type: "string", description: "Workflow asset id/name for local evidence attribution" },
                     current_step: { type: "string", description: "Current step ID" },
                     current_role: { type: "string", description: "Current role name" },
                     iteration: { type: "number", description: "Current iteration number" },
@@ -119,6 +120,7 @@ export function createStateTools(projectDir) {
                 const existing = await readWorkflowState(projectDir, sessionId, 0);
                 const state = {
                     active: typeof args.active === "boolean" ? args.active : true,
+                    workflow_asset: typeof args.workflow_asset === "string" ? args.workflow_asset : existing?.workflow_asset,
                     workflow: String(args.workflow),
                     current_step: String(args.current_step),
                     current_role: String(args.current_role),

package/dist/organization/index.d.ts

@@ -0,0 +1,121 @@
+import { type WorkflowAssetSummary } from "../assets/index.js";
+export interface OrganizationProjectAssetBinding {
+    asset: string;
+    status: "planned" | "active" | "paused";
+}
+export type OrganizationProjectAssetStatus = OrganizationProjectAssetBinding["status"];
+export interface OrganizationProject {
+    id: string;
+    name: string;
+    path: string;
+    assets: OrganizationProjectAssetBinding[];
+    syncTargets: string[];
+}
+export interface OrganizationProfile {
+    schema_version: "intentdna.organization.v1";
+    organization: {
+        id: string;
+        name: string;
+    };
+    projects: OrganizationProject[];
+}
+export interface OrganizationProjectReview {
+    id: string;
+    name: string;
+    path: string;
+    configuredAssets: string[];
+    plannedAssets: string[];
+    missingAssets: string[];
+    syncTargets: string[];
+    assetGates: OrganizationProjectAssetGate[];
+}
+export interface OrganizationProjectAssetReviewRef {
+    label: string;
+    path: string;
+    kind: "doc" | "dogfood" | "reference";
+    description?: string;
+}
+export interface OrganizationProjectAssetReviewEvidence {
+    mode: "local_asset_diff_review_evidence";
+    authority: "manager_review_handoff_only";
+    receiptCommand: string;
+    receiptPathHint: string;
+    boundaries: string[];
+}
+export interface OrganizationReview {
+    profilePath: string;
+    profile: OrganizationProfile;
+    totals: {
+        projects: number;
+        declaredAssets: number;
+        configuredAssets: number;
+        missingAssets: number;
+        syncTargets: number;
+        dogfoodEvidenceModules: number;
+        dogfoodEvidencePass: number;
+        dogfoodEvidenceRemaining: number;
+    };
+    projects: OrganizationProjectReview[];
+    nextActions: string[];
+}
+export interface OrganizationProjectAssetGate {
+    asset: string;
+    assetVersion?: string;
+    contentHash?: string;
+    evidencePosture: WorkflowAssetSummary["status"]["evidencePosture"] | "unknown";
+    reviewRefs: OrganizationProjectAssetReviewRef[];
+    reviewEvidence: OrganizationProjectAssetReviewEvidence[];
+    reviewCommand: string;
+    bindingStatus: OrganizationProjectAssetStatus;
+    configured: boolean;
+    configurationPosture: "configured" | "available" | "missing";
+    syncTargets: string[];
+    evidenceGate: "open" | "clear" | "unknown";
+    syncReady: boolean;
+    nextCommand: string;
+    reason: string;
+}
+export interface OrganizationBindResult {
+    path: string;
+    profile: OrganizationProfile;
+    yaml: string;
+    projectId: string;
+    asset: string;
+    status: OrganizationProjectAssetBinding["status"];
+    addedAsset: boolean;
+    addedSyncTargets: string[];
+    guidance: {
+        bindingEffect: string;
+        reviewCommand: string;
+        rolloutCommand: string;
+        replacementBoundary: string;
+    };
+}
+export declare function readOrganizationProfile(options?: {
+    projectDir?: string;
+}): Promise<{
+    path: string;
+    profile?: OrganizationProfile;
+}>;
+export declare function createOrganizationProfile(input: {
+    orgName: string;
+    projectName?: string;
+    asset?: string;
+    syncTarget?: string;
+    projectDir?: string;
+}): Promise<{
+    path: string;
+    profile: OrganizationProfile;
+    yaml: string;
+}>;
+export declare function isOrganizationAssetStatus(value: string): value is OrganizationProjectAssetStatus;
+export declare function bindOrganizationAsset(input: {
+    asset: string;
+    project?: string;
+    status?: string;
+    syncTarget?: string;
+    projectDir?: string;
+}): Promise<OrganizationBindResult | undefined>;
+export declare function reviewOrganization(options?: {
+    projectDir?: string;
+}): Promise<OrganizationReview | undefined>;