intentdna 1.7.4 → 1.8.0

package/dist/runtime/claude-sync-target.js

@@ -0,0 +1,280 @@
+import { mkdir, readFile, unlink, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { createCompiledIR, writeCompiledIR } from "./plugin-adapter.js";
+import { compilePluginSettings, detectEnabledEvents, mergeSettingsFile, recommendHookTimeouts } from "./settings-adapter.js";
+import { formatSyncTargetPlanDiagnostics } from "./sync-target-plan.js";
+const LEGACY_BASH_HOOKS = [
+    "dna-pre-tool-use.sh",
+    "dna-post-tool-use.sh",
+    "dna-user-prompt-submit.sh",
+    "dna-subagent-stop.sh",
+    "dna-pre-compact.sh",
+    "dna-notification.sh",
+];
+/**
+ * Remove legacy bash hook scripts written by previous Intent DNA versions.
+ * Only removes files that contain the sentinel comment.
+ */
+export async function removeLegacyBashHooks(hooksDir) {
+    const removed = [];
+    for (const file of LEGACY_BASH_HOOKS) {
+        const path = resolve(hooksDir, file);
+        try {
+            const content = await readFile(path, "utf-8");
+            if (content.includes("intentdna:managed")) {
+                await unlink(path);
+                removed.push(path);
+            }
+        }
+        catch { /* File doesn't exist, skip */ }
+    }
+    return removed;
+}
+function createSettingsHookRegistration(ir, mode, settingsPath) {
+    if (mode !== "bin" || !settingsPath)
+        return undefined;
+    const enabledEvents = detectEnabledEvents(ir);
+    if (enabledEvents.length === 0)
+        return undefined;
+    return {
+        path: settingsPath,
+        enabledEvents,
+        settings: compilePluginSettings(enabledEvents, 10, recommendHookTimeouts(ir)),
+    };
+}
+export function createClaudeCoreSyncTargetPlan(options) {
+    const compiledIR = createCompiledIR(options.ir, options.roles);
+    const compiledIRPath = resolve(options.projectDir, ".dna", "compiled", "ir.json");
+    const legacyHooksDir = resolve(options.projectDir, ".claude", "hooks");
+    const mcpConfigPath = resolve(options.projectDir, ".claude", ".mcp.json");
+    const settingsHookRegistration = createSettingsHookRegistration(options.ir, options.mode, options.settingsPath);
+    const plannedArtifacts = [
+        {
+            artifact: "compiled-ir",
+            outputArtifact: "compiled-ir",
+            kind: "claude_compiled_ir",
+            path: compiledIRPath,
+            ownership: "diagnostic",
+            trackedByLock: true,
+        },
+        {
+            artifact: "mcp-config",
+            outputArtifact: "mcp-config",
+            kind: "claude_builtin_mcp_config",
+            path: mcpConfigPath,
+            ownership: "merge_preserve_user",
+            trackedByLock: false,
+        },
+    ];
+    if (settingsHookRegistration) {
+        plannedArtifacts.push({
+            artifact: "settings-hooks",
+            outputArtifact: "settings-hooks",
+            kind: "claude_settings_hooks",
+            path: settingsHookRegistration.path,
+            ownership: "merge_preserve_user",
+            trackedByLock: true,
+        });
+    }
+    return {
+        target: "claude_code",
+        compiledIR,
+        compiledIRPath,
+        legacyHooksDir,
+        mcpConfigPath,
+        settingsHookRegistration,
+        pluginSkipsSettings: options.mode === "plugin" && !!options.settingsPath,
+        plannedArtifacts,
+        capabilityReport: createClaudeCapabilityReport(plannedArtifacts, options.mode, settingsHookRegistration),
+        evidencePlan: createClaudeEvidencePlan(plannedArtifacts),
+        warnings: [],
+        unsupported: [
+            "native_rollback_or_compensation",
+            "native_logic_equivalence_validation",
+            "sync_time_artifacts_are_not_runtime_enforcement",
+        ],
+    };
+}
+function createClaudeCapabilityReport(plannedArtifacts, mode, settingsHookRegistration) {
+    const artifactPaths = plannedArtifacts.map((artifact) => artifact.path);
+    const settingsPath = settingsHookRegistration?.path;
+    const settingsHookSurface = settingsPath
+        ? [`Claude Code settings hooks: ${settingsPath}`]
+        : mode === "plugin"
+            ? ["Claude Code plugin-managed hooks"]
+            : [];
+    const hookEvidenceRefs = settingsHookRegistration?.enabledEvents.length
+        ? ["claude-settings-hooks"]
+        : mode === "plugin"
+            ? ["claude-plugin-hooks"]
+            : [];
+    const capabilities = {
+        intent_lock: {
+            status: "partial",
+            surfaces: [".dna/compiled/ir.json"],
+            evidenceRefs: ["compiled-ir"],
+            notes: ["Compiled IR preserves prompt directives for Claude Code surfaces, but runtime adherence still requires execution evidence."],
+        },
+        boundary_constraint: {
+            status: settingsHookSurface.length > 0 ? "partial" : "unknown",
+            surfaces: [...settingsHookSurface, ".dna/compiled/ir.json"],
+            evidenceRefs: [...hookEvidenceRefs, "compiled-ir"],
+            notes: ["Claude core sync can register legacy hook surfaces and compiled IR; exact enforcement depends on the active Claude Code harness mode."],
+        },
+        context_control: {
+            status: "partial",
+            surfaces: [".dna/compiled/ir.json"],
+            evidenceRefs: ["compiled-ir"],
+            notes: ["Context requirements are compiled as policy data; dynamic context selection is outside this sync target."],
+        },
+        tool_policy: {
+            status: settingsHookSurface.length > 0 ? "partial" : "unknown",
+            surfaces: [...settingsHookSurface, ".dna/compiled/ir.json"],
+            evidenceRefs: [...hookEvidenceRefs, "compiled-ir"],
+            notes: ["Tool policy can be represented through compiled IR and hook settings, but this planner does not claim full tool-path parity."],
+        },
+        approval_gate: {
+            status: settingsHookSurface.length > 0 ? "partial" : "unknown",
+            surfaces: settingsHookSurface,
+            evidenceRefs: hookEvidenceRefs,
+            notes: ["Approval-like gates depend on configured Claude hook events and remain runtime-specific."],
+        },
+        checkpoint: {
+            status: "partial",
+            surfaces: artifactPaths,
+            evidenceRefs: ["compiled-ir", ...hookEvidenceRefs],
+            notes: ["Checkpoints are represented in compiled IR and hook registration, not as completed runtime proof."],
+        },
+        completion_check: {
+            status: "partial",
+            surfaces: artifactPaths,
+            evidenceRefs: ["compiled-ir", ...hookEvidenceRefs],
+            notes: ["Completion checks require runtime verifier output before they become evidence."],
+        },
+        artifact_handoff: {
+            status: "partial",
+            surfaces: artifactPaths,
+            evidenceRefs: ["compiled-ir", "mcp-config"],
+            notes: ["Generated artifacts and MCP registration provide handoff surfaces while preserving user-owned config by merge."],
+        },
+        isolation: {
+            status: "unknown",
+            surfaces: [],
+            evidenceRefs: [],
+            notes: ["Workflow isolation can be declared in DNA, but Claude core sync planning does not prove runtime isolation."],
+        },
+        dry_run: {
+            status: "supported",
+            surfaces: ["dna sync --dry-run Claude core target plan"],
+            evidenceRefs: ["claude-sync-target-plan"],
+            notes: ["Dry-run reports planned Claude core artifacts, capability posture, and unsupported gaps without writing files."],
+        },
+        rollback_or_compensation: {
+            status: "unsupported",
+            surfaces: [],
+            evidenceRefs: ["native_rollback_or_compensation"],
+            notes: ["Claude core sync has no native rollback or compensation contract for completed side effects."],
+        },
+        trace: {
+            status: "partial",
+            surfaces: artifactPaths,
+            evidenceRefs: ["RuntimeDecisionEvent", "compiled-ir"],
+            notes: ["RuntimeDecisionEvent remains the primary trace contract; sync artifacts are diagnostic context only."],
+        },
+        runtime_decision_evidence: {
+            status: "partial",
+            surfaces: artifactPaths,
+            evidenceRefs: ["RuntimeDecisionEvent", "compiled-ir"],
+            notes: ["Sync-time artifacts must not be upgraded to runtime evidence without RuntimeDecisionEvent provenance."],
+        },
+        logic_equivalence_validation: {
+            status: "unknown",
+            surfaces: ["Workflow verifier specs and external test commands"],
+            evidenceRefs: ["verifier_specs", "RuntimeDecisionEvent"],
+            notes: ["Equivalence validation is workflow-level proof, not a native Claude core sync capability."],
+        },
+    };
+    return {
+        adapter: "claude_code",
+        runtime: "claude_code",
+        capabilities,
+        unsupported: [
+            "native_rollback_or_compensation",
+            "native_logic_equivalence_validation",
+            "sync_time_artifacts_are_not_runtime_enforcement",
+        ],
+    };
+}
+function createClaudeEvidencePlan(plannedArtifacts) {
+    return {
+        primary: "RuntimeDecisionEvent",
+        diagnosticArtifacts: plannedArtifacts.map((artifact) => artifact.path),
+        classification: "diagnostic_only",
+        notes: [
+            "Compiled IR and Claude Code settings are sync-time artifacts; RuntimeDecisionEvent remains the runtime evidence contract.",
+            "Claude Code core target planning preserves user-owned MCP and settings content by merging generated entries.",
+        ],
+    };
+}
+async function registerDNAMCPServer(projectDir) {
+    const mcpJsonPath = resolve(projectDir, ".claude", ".mcp.json");
+    let existing = {};
+    try {
+        const raw = await readFile(mcpJsonPath, "utf-8");
+        existing = JSON.parse(raw);
+    }
+    catch { /* doesn't exist yet */ }
+    const mcpServers = (existing.mcpServers ?? {});
+    if (mcpServers["intentdna"])
+        return { path: mcpJsonPath, registered: false };
+    mcpServers["intentdna"] = {
+        command: "dna-mcp",
+        args: ["--project-dir", projectDir],
+    };
+    existing.mcpServers = mcpServers;
+    await mkdir(dirname(mcpJsonPath), { recursive: true });
+    await writeFile(mcpJsonPath, JSON.stringify(existing, null, 2) + "\n", "utf-8");
+    return { path: mcpJsonPath, registered: true };
+}
+export async function executeClaudeCoreSyncTargetPlan(plan, projectDir) {
+    const messages = [];
+    const writtenIrPath = await writeCompiledIR(projectDir, plan.compiledIR);
+    messages.push(`Wrote compiled IR: ${writtenIrPath}`);
+    const removedLegacyHooks = await removeLegacyBashHooks(plan.legacyHooksDir);
+    if (removedLegacyHooks.length > 0) {
+        messages.push(`Cleaned ${removedLegacyHooks.length} legacy bash hook(s) from ${plan.legacyHooksDir}`);
+    }
+    const mcp = await registerDNAMCPServer(projectDir);
+    if (mcp.registered) {
+        messages.push(`MCP: registered dna-mcp server in ${mcp.path}`);
+    }
+    if (plan.settingsHookRegistration) {
+        await mergeSettingsFile(plan.settingsHookRegistration.settings, plan.settingsHookRegistration.path);
+        messages.push(`Bin mode: registered ${plan.settingsHookRegistration.enabledEvents.length} hook event(s) in ${plan.settingsHookRegistration.path}`);
+    }
+    else if (plan.pluginSkipsSettings) {
+        messages.push("Plugin mode: hooks managed by plugin framework (skipping settings.json)");
+    }
+    return { messages, removedLegacyHooks };
+}
+export function formatClaudeCoreSyncTargetPlanDryRun(plan) {
+    const lines = [
+        `Dry-run: would write compiled IR: ${plan.compiledIRPath}`,
+        `Dry-run: would clean legacy bash hooks in ${plan.legacyHooksDir}`,
+        `Dry-run: would register dna-mcp server in ${plan.mcpConfigPath}`,
+    ];
+    if (plan.settingsHookRegistration) {
+        lines.push(`Dry-run: would register ${plan.settingsHookRegistration.enabledEvents.length} hook event(s) in ${plan.settingsHookRegistration.path}`);
+    }
+    else if (plan.pluginSkipsSettings) {
+        lines.push("Plugin mode: hooks managed by plugin framework (skipping settings.json)");
+    }
+    const capabilityEntries = Object.entries(plan.capabilityReport.capabilities)
+        .sort(([left], [right]) => left.localeCompare(right));
+    lines.push("Claude core capability report:");
+    for (const [capability, entry] of capabilityEntries) {
+        const surfaces = entry.surfaces.length > 0 ? entry.surfaces.join(", ") : "no Claude core sync surface";
+        lines.push(`  - ${capability}: ${entry.status} via ${surfaces}`);
+    }
+    return `${lines.join("\n")}\n${formatSyncTargetPlanDiagnostics(plan)}`;
+}

package/dist/runtime/codex-adapter.d.ts

@@ -0,0 +1,254 @@
+import { type RuntimeDecision, type RuntimeDecisionEvent, type RuntimeEvidenceRef } from "../governance/index.js";
+import type { ConstraintIR } from "../schema/types.js";
+import type { HookOutput } from "../hooks/protocol.js";
+import { type EvidenceCaptureResult, type EvidenceCaptureRetry } from "../hooks/state.js";
+export declare const CODEX_ADAPTER_MINIMUM_VERSION = "0.134.0";
+export declare const CODEX_NATIVE_HOOK_EVENTS: readonly ["SessionStart", "PreToolUse", "PostToolUse", "UserPromptSubmit", "PreCompact", "PostCompact", "Stop"];
+export type CodexNativeHookEvent = typeof CODEX_NATIVE_HOOK_EVENTS[number];
+export type CodexHookInstallMode = "plugin_scoped" | "project_fallback" | "managed" | "none";
+export type CodexAdapterSupportStatus = "supported" | "partial" | "unknown" | "unsupported";
+export type CodexEvidenceClassification = "enterprise_evidence" | "diagnostic_only" | "unsupported";
+export interface CodexCommandHook {
+    type: "command";
+    command: string;
+    timeout?: number;
+    statusMessage?: string;
+}
+export interface CodexHookGroup {
+    matcher?: string;
+    hooks: CodexCommandHook[];
+}
+export interface CodexHooksConfig {
+    hooks: Partial<Record<CodexNativeHookEvent, CodexHookGroup[]>>;
+    state?: Record<string, CodexHookTrustState>;
+}
+export interface CodexHookTrustState {
+    trusted_hash: string;
+}
+export interface CodexRuntimeProbe {
+    executable_path: string | null;
+    version: string | null;
+    minimum_version: string;
+    satisfies_minimum_version: boolean;
+    exec_json_available: boolean;
+    execpolicy_check_available: boolean;
+    output_schema_available: boolean;
+    classification: CodexEvidenceClassification;
+    reason: string;
+}
+export interface CodexInstallModeSemantics {
+    mode: CodexHookInstallMode;
+    writes_plugin_artifacts: boolean;
+    writes_project_fallback: boolean;
+    writes_trust_state: boolean;
+    support_status: CodexAdapterSupportStatus;
+    classification: CodexEvidenceClassification;
+    reason: string;
+}
+export interface CodexTrustVerificationInput {
+    hookInstallMode: CodexHookInstallMode;
+    probe: CodexRuntimeProbe;
+    expectedTrustState: Record<string, CodexHookTrustState>;
+    actualTrustState?: Record<string, CodexHookTrustState>;
+    runtimeExecutionVerified?: boolean;
+    provenanceComplete?: boolean;
+}
+export interface CodexTrustVerification {
+    trusted: boolean;
+    support_status: CodexAdapterSupportStatus;
+    classification: CodexEvidenceClassification;
+    evidence_refs: RuntimeEvidenceRef[];
+    reasons: string[];
+}
+export interface CodexPluginManifest {
+    name: string;
+    version: string;
+    description: string;
+    hooks: string;
+}
+export interface CodexInstructionArtifact {
+    path: string;
+    content: string;
+}
+export interface CodexPolicyMapArtifact {
+    path: string;
+    content: CodexPolicyMap;
+}
+export interface CodexPolicyMapEntry {
+    source: string;
+    codex_surface: string;
+    support_status: CodexAdapterSupportStatus;
+    evidence_ref: string;
+    notes: string[];
+}
+export interface CodexPolicyMap {
+    schema_version: "intentdna.codex_policy_map.v1";
+    generated_at: string;
+    adapter: "codex_cli";
+    entries: CodexPolicyMapEntry[];
+    unsupported: string[];
+}
+export interface CodexAdapterArtifacts {
+    pluginManifest: CodexPluginManifest;
+    pluginHooks: CodexHooksConfig;
+    fallbackHooks: CodexHooksConfig;
+    instruction: CodexInstructionArtifact;
+    policyMap: CodexPolicyMapArtifact;
+    trustState: Record<string, CodexHookTrustState>;
+    evidence: CodexAdapterEvidence;
+}
+export interface CodexAdapterEvidence {
+    schema_version: "intentdna.codex_adapter_evidence.v1";
+    generated_at: string;
+    adapter: "codex_cli";
+    minimum_codex_version: string;
+    hook_install_mode: CodexHookInstallMode;
+    install_mode_semantics: CodexInstallModeSemantics;
+    runtime_probe?: CodexRuntimeProbe;
+    trust_verification?: CodexTrustVerification;
+    dispatcher_command: string;
+    dispatcher_script: string;
+    plugin_hooks_path: string;
+    instruction_path: string;
+    policy_map_path: string;
+    fallback_hooks_path: string;
+    fallback_config_path: string;
+    generated_events: CodexNativeHookEvent[];
+    trust_state: Record<string, CodexHookTrustState>;
+    support_status: Record<string, CodexAdapterSupportStatus>;
+    unsupported: string[];
+    notes: string[];
+}
+export interface CompileCodexAdapterOptions {
+    adapterRoot: string;
+    dispatcherScript: string;
+    dispatcherCommand?: string;
+    nodePath?: string;
+    pluginName?: string;
+    pluginVersion?: string;
+    pluginDescription?: string;
+    pluginHooksPath?: string;
+    instructionPath?: string;
+    policyMapPath?: string;
+    fallbackHooksPath?: string;
+    fallbackConfigPath?: string;
+    hookInstallMode?: CodexHookInstallMode;
+    generatedAt?: string;
+}
+export interface CodexDecisionMappingInput {
+    ir: ConstraintIR;
+    decision: RuntimeDecision;
+    decisionReason: string;
+    hookEvent?: CodexNativeHookEvent | string;
+    hookInstallMode?: CodexHookInstallMode;
+    hookTrusted?: boolean;
+    codexVersion?: string;
+    sessionId?: string;
+    runId?: string;
+    stepId?: string;
+    toolName?: string;
+    actionKind?: string;
+    resourceRef?: string;
+    agentId?: string;
+    agentRole?: string;
+    agentType?: string;
+    sessionAgent?: string;
+    orgId?: string;
+    teamId?: string;
+    userId?: string;
+    projectId?: string;
+    evidenceRefs?: RuntimeEvidenceRef[];
+    eventId?: string;
+    timestamp?: string;
+}
+export interface CodexHookInput {
+    event: CodexNativeHookEvent | "PermissionRequest" | string;
+    session_id?: string;
+    run_id?: string;
+    agent_id?: string;
+    agent_role?: string;
+    agent_type?: string;
+    subagent_id?: string;
+    tool_name?: string;
+    command?: string;
+    cwd?: string;
+    resource_ref?: string;
+    result?: EvidenceCaptureResult;
+    exit_code?: number;
+    duration_ms?: number;
+    retry?: EvidenceCaptureRetry;
+    payload: Record<string, unknown>;
+}
+export interface CodexHookRunnerOptions {
+    ir: ConstraintIR;
+    hookInstallMode: CodexHookInstallMode;
+    hookTrusted: boolean;
+    codexVersion?: string;
+    projectDir: string;
+    sessionId?: string;
+    runId?: string;
+    stepId?: string;
+    orgId?: string;
+    teamId?: string;
+    userId?: string;
+    projectId?: string;
+    workflowAsset?: string;
+    workflowId?: string;
+    timestamp?: string;
+    appendEvent?: boolean;
+}
+export interface CodexHookRunnerResult {
+    output: HookOutput;
+    decision: RuntimeDecision;
+    classification: CodexEvidenceClassification;
+    event?: RuntimeDecisionEvent;
+    reasons: string[];
+}
+export interface CodexExecJsonEvent {
+    raw: Record<string, unknown>;
+}
+export interface CodexDogfoodResult {
+    probe: CodexRuntimeProbe;
+    status: "completed" | "skipped" | "failed" | "timeout";
+    classification: CodexEvidenceClassification;
+    command: string[];
+    events: CodexExecJsonEvent[];
+    stdout: string;
+    stderr: string;
+    reason: string;
+}
+export interface RunCodexDogfoodOptions {
+    projectDir: string;
+    prompt?: string;
+    executablePath?: string;
+    timeoutMs?: number;
+    extraArgs?: string[];
+    env?: NodeJS.ProcessEnv;
+}
+export declare function probeCodexRuntime(options?: {
+    executablePath?: string;
+    envPath?: string;
+}): Promise<CodexRuntimeProbe>;
+export declare function runCodexExecDogfood(options: RunCodexDogfoodOptions): Promise<CodexDogfoodResult>;
+export declare function withCodexDogfoodEvidence(evidence: CodexAdapterEvidence, dogfood: CodexDogfoodResult): CodexAdapterEvidence;
+export declare function codexInstallModeSemantics(mode: CodexHookInstallMode): CodexInstallModeSemantics;
+export declare function buildCodexDispatcherCommand(options: CompileCodexAdapterOptions): string;
+export declare function codexHookTrustedHash(identity: unknown): string;
+export declare function compileCodexPluginManifest(options: CompileCodexAdapterOptions): CodexPluginManifest;
+export declare function compileCodexHooksConfig(options: CompileCodexAdapterOptions): CodexHooksConfig;
+export declare function compileCodexInstructionArtifact(ir: ConstraintIR, options: CompileCodexAdapterOptions): CodexInstructionArtifact;
+export declare function compileCodexPolicyMapArtifact(ir: ConstraintIR, options: CompileCodexAdapterOptions): CodexPolicyMapArtifact;
+export declare function buildCodexHookTrustState(hooksPath: string, hooksConfig: CodexHooksConfig): Record<string, CodexHookTrustState>;
+export declare function verifyCodexHookTrust(input: CodexTrustVerificationInput): CodexTrustVerification;
+export declare function compileCodexAdapterArtifacts(ir: ConstraintIR, options: CompileCodexAdapterOptions): CodexAdapterArtifacts;
+export declare function mergeCodexFallbackHooks(existingContent: string | null | undefined, generated: CodexHooksConfig, dispatcherCommand: string): CodexHooksConfig;
+export declare function removeCodexFallbackHooks(existingContent: string | null | undefined, dispatcherCommand: string): CodexHooksConfig | null;
+export declare function codexTrustStateToml(trustState: Record<string, CodexHookTrustState>): string;
+export declare function mergeCodexTrustStateConfig(existingContent: string | null | undefined, trustState: Record<string, CodexHookTrustState>): string;
+export declare function removeCodexTrustStateConfig(existingContent: string | null | undefined): string;
+export declare function writeCodexAdapterArtifacts(projectDir: string, artifacts: CodexAdapterArtifacts): Promise<string[]>;
+export declare function removeCodexAdapterArtifacts(projectDir: string, dispatcherCommand: string, artifacts?: CodexAdapterArtifacts): Promise<string[]>;
+export declare function appendCodexRuntimeDecisionEvent(projectDir: string, event: RuntimeDecisionEvent, sessionId?: string): Promise<void>;
+export declare function normalizeCodexHookInput(rawInput: unknown, fallbackEvent?: string): CodexHookInput;
+export declare function runCodexHook(rawInput: unknown, options: CodexHookRunnerOptions): Promise<CodexHookRunnerResult>;
+export declare function mapCodexDecisionEvent(input: CodexDecisionMappingInput): RuntimeDecisionEvent;