intentdna 1.9.0 → 1.9.3

package/native/windows-job-keeper/manifest.json

@@ -0,0 +1,33 @@
+{
+  "schema_version": "intentdna.windows_job_keeper_manifest.v1",
+  "protocol_version": "IDNA_WINDOWS_JOB_KEEPER_V1",
+  "source": {
+    "path": "keeper.c",
+    "sha256": "sha256:e93a634bbd5d6216aa35bd409350a3abd9cbf53aad4c314c368b7c3fec0d6f09"
+  },
+  "toolchain": {
+    "name": "zig",
+    "version": "0.16.0",
+    "build_script": {
+      "path": "../../scripts/build-windows-job-keeper.mjs",
+      "sha256": "sha256:973367e4d3c53c9ee725e27dc70fdfcb43ed4d3791968a8ce251691c15ac09e1"
+    },
+    "source_date_epoch": 0,
+    "targets": {
+      "x86_64": "x86_64-windows-gnu",
+      "aarch64": "aarch64-windows-gnu"
+    }
+  },
+  "binaries": {
+    "x86_64": {
+      "path": "bin/x86_64/intentdna-windows-job-keeper.exe",
+      "sha256": "sha256:23ca62d84e2787b9059b960f1ec1318d80c87a9f70bb84a81cc3587f5f8bcb1f",
+      "pe_machine": "0x8664"
+    },
+    "aarch64": {
+      "path": "bin/aarch64/intentdna-windows-job-keeper.exe",
+      "sha256": "sha256:9de5ccdcc75f3edaa02943ce9fbaffa735e44873921569f93e9071e5d9da7402",
+      "pe_machine": "0xaa64"
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "intentdna",
-  "version": "1.9.0",
+  "version": "1.9.3",
   "description": "Intent DNA — Declarative policy layer for AI agent behavior",
   "type": "module",
   "main": "dist/index.js",
@@ -11,9 +11,10 @@
     "dna-mcp": "dist/mcp/index.js"
   },
   "scripts": {
-    "build": "tsc && mkdir -p dist/species dist/templates && cp src/species/*.json dist/species/ && cp src/templates/*.yaml dist/templates/ && node scripts/sync-plugin-version.cjs",
+    "build": "tsc && node scripts/copy-runtime-assets.mjs && node scripts/sync-plugin-version.cjs",
     "dev": "tsc --watch",
     "release:sync-plugin": "node scripts/sync-release-plugin.cjs",
+    "verify:windows-job-keeper": "node scripts/verify-windows-job-keeper.mjs",
     "test": "node --experimental-vm-modules node_modules/.bin/vitest run",
     "test:watch": "node --experimental-vm-modules node_modules/.bin/vitest"
   },
@@ -38,7 +39,10 @@
     "spec",
     ".claude-plugin",
     "hooks",
+    "native/windows-job-keeper",
+    "scripts/build-windows-job-keeper.mjs",
     "scripts/sync-release-plugin.cjs",
+    "scripts/verify-windows-job-keeper.mjs",
     "README.md",
     "LICENSE"
   ],

package/scripts/build-windows-job-keeper.mjs

@@ -0,0 +1,172 @@
+import { mkdir } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "node:child_process";
+
+const targets = Object.freeze({
+  x86_64: "x86_64-windows-gnu",
+  aarch64: "aarch64-windows-gnu",
+});
+
+const MAX_COUNT = 4096;
+const MAX_GRACE_MS = 300_000;
+const ZIG_VERSION = "0.16.0";
+
+function hexUtf8(value) {
+  if (value.includes("\0")) throw new Error("keeper protocol values cannot contain NUL");
+  return Buffer.from(value, "utf8").toString("hex");
+}
+
+export function normalizeWindowsEnvironment(environment) {
+  const entries = Array.isArray(environment)
+    ? environment.map((entry) => {
+      const separator = entry.indexOf("=");
+      if (separator <= 0) throw new Error(`invalid environment entry: ${entry}`);
+      return [entry.slice(0, separator), entry.slice(separator + 1)];
+    })
+    : Object.entries(environment ?? {}).filter((entry) => entry[1] !== undefined);
+  if (entries.length > MAX_COUNT) throw new Error("too many environment entries");
+  const seen = new Set();
+  const normalized = entries.map(([key, value]) => {
+    if (!key || key.includes("=") || key.includes("\0")) {
+      throw new Error(`invalid environment key: ${key}`);
+    }
+    const stringValue = String(value);
+    if (stringValue.includes("\0")) throw new Error(`invalid environment value for ${key}`);
+    const folded = key.toLocaleLowerCase("en-US");
+    if (seen.has(folded)) throw new Error(`duplicate environment key: ${key}`);
+    seen.add(folded);
+    return `${key}=${stringValue}`;
+  });
+  normalized.sort((a, b) => a.localeCompare(b, "en-US", { sensitivity: "base" }));
+  const utf16Length = normalized.reduce((total, entry) => total + entry.length + 1, 1);
+  if (utf16Length > 32767) throw new Error("environment block exceeds 32767 UTF-16 units");
+  return normalized;
+}
+
+export function encodeWindowsKeeperConfig({
+  executable,
+  cwd = "",
+  stdinPath = "",
+  stdoutPath,
+  stderrPath,
+  maxOutputBytes = 16 * 1024 * 1024,
+  mode = "argv",
+  args = [],
+  commandLine,
+  environment,
+  naturalDrainGraceMs = 30_000,
+  forcedDrainGraceMs = 30_000,
+}) {
+  if (!executable || !stdoutPath || !stderrPath) throw new Error("required keeper path missing");
+  if (!Number.isSafeInteger(maxOutputBytes) || maxOutputBytes <= 0) {
+    throw new Error("keeper output limit must be a positive safe integer");
+  }
+  if (!Number.isInteger(naturalDrainGraceMs) || naturalDrainGraceMs < 0 ||
+      naturalDrainGraceMs > MAX_GRACE_MS || !Number.isInteger(forcedDrainGraceMs) ||
+      forcedDrainGraceMs < 0 || forcedDrainGraceMs > MAX_GRACE_MS) {
+    throw new Error("keeper drain grace must be an integer from 0 through 300000");
+  }
+  const lines = [
+    "IDNA_WINDOWS_JOB_KEEPER_V1",
+    `exe:${hexUtf8(executable)}`,
+    `cwd:${hexUtf8(cwd)}`,
+    `stdin:${hexUtf8(stdinPath)}`,
+    `stdout:${hexUtf8(stdoutPath)}`,
+    `stderr:${hexUtf8(stderrPath)}`,
+    `max_output_bytes:${maxOutputBytes}`,
+  ];
+  if (mode === "argv") {
+    if (args.length > MAX_COUNT) throw new Error("too many command arguments");
+    lines.push("mode:argv", `argc:${args.length}`,
+      ...args.map((argument) => `arg:${hexUtf8(String(argument))}`));
+  } else if (mode === "verbatim") {
+    if (!commandLine || commandLine.length > 32766) {
+      throw new Error("verbatim command line must contain 1 through 32766 UTF-16 units");
+    }
+    lines.push("mode:verbatim", `command:${hexUtf8(commandLine)}`);
+  } else {
+    throw new Error(`unsupported command mode: ${mode}`);
+  }
+  const normalizedEnvironment = normalizeWindowsEnvironment(environment);
+  lines.push(`envc:${normalizedEnvironment.length}`,
+    ...normalizedEnvironment.map((entry) => `env:${hexUtf8(entry)}`),
+    `natural_drain_grace_ms:${naturalDrainGraceMs}`,
+    `forced_drain_grace_ms:${forcedDrainGraceMs}`,
+    "end");
+  return `${lines.join("\n")}\n`;
+}
+
+export function quoteWindowsCrtArgument(value) {
+  if (value.length > 0 && !/[\s"]/.test(value)) return value;
+  let output = '"';
+  let backslashes = 0;
+  for (const character of value) {
+    if (character === "\\") {
+      backslashes += 1;
+      continue;
+    }
+    if (character === '"') output += "\\".repeat(backslashes * 2 + 1);
+    else output += "\\".repeat(backslashes);
+    backslashes = 0;
+    output += character;
+  }
+  return `${output}${"\\".repeat(backslashes * 2)}"`;
+}
+
+export function buildCommand({
+  arch = process.env.IDNA_WINDOWS_KEEPER_ARCH ?? "x86_64",
+  zig = process.env.ZIG ?? "zig",
+  output,
+} = {}) {
+  const target = targets[arch];
+  if (!target) throw new Error(`unsupported architecture: ${arch}`);
+  const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+  const source = resolve(root, "native/windows-job-keeper/keeper.c");
+  const destination = resolve(output ?? process.env.IDNA_WINDOWS_KEEPER_OUT ??
+    `build/windows-job-keeper/${arch}/intentdna-windows-job-keeper.exe`);
+  return {
+    command: zig,
+    destination,
+    args: [
+      "cc", "-target", target, "-std=c11", "-Os", "-fno-ident",
+      "-municode", source, "-lbcrypt",
+      "-Wl,--strip-all", "-o", destination,
+    ],
+  };
+}
+
+export function assertZigVersion(version) {
+  if (version !== ZIG_VERSION) {
+    throw new Error(`Windows Job keeper requires Zig ${ZIG_VERSION}, received ${version}`);
+  }
+}
+
+export function verifyZigVersion(zig) {
+  const result = spawnSync(zig, ["version"], { encoding: "utf8" });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    throw new Error(`unable to read Zig version from ${zig}: ${result.stderr.trim()}`);
+  }
+  assertZigVersion(result.stdout.trim());
+}
+
+async function main() {
+  const plan = buildCommand();
+  if (process.argv.includes("--print")) {
+    process.stdout.write(`${JSON.stringify(plan)}\n`);
+    return;
+  }
+  verifyZigVersion(plan.command);
+  await mkdir(dirname(plan.destination), { recursive: true });
+  const result = spawnSync(plan.command, plan.args, { stdio: "inherit", env: {
+    ...process.env,
+    SOURCE_DATE_EPOCH: "0",
+  } });
+  if (result.error) throw result.error;
+  if (result.status !== 0) process.exitCode = result.status ?? 1;
+}
+
+const invoked = process.argv[1] &&
+  resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (invoked) await main();

package/scripts/verify-windows-job-keeper.mjs

@@ -0,0 +1,184 @@
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { dirname, join, posix, resolve, win32 } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const ARCHITECTURES = Object.freeze({
+  x86_64: Object.freeze({
+    nodeArchitecture: "x64",
+    peMachine: "0x8664",
+    target: "x86_64-windows-gnu",
+  }),
+  aarch64: Object.freeze({
+    nodeArchitecture: "arm64",
+    peMachine: "0xaa64",
+    target: "aarch64-windows-gnu",
+  }),
+});
+
+const MANIFEST_PACKAGE_DIRECTORY = "native/windows-job-keeper";
+const TOOLCHAIN = Object.freeze({
+  name: "zig",
+  version: "0.16.0",
+  buildScriptPath: "../../scripts/build-windows-job-keeper.mjs",
+  sourceDateEpoch: 0,
+});
+
+export function sha256(bytes) {
+  return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+}
+
+export function readPeMachine(bytes) {
+  if (!Buffer.isBuffer(bytes) || bytes.length < 64 || bytes[0] !== 0x4d || bytes[1] !== 0x5a) {
+    throw new Error("binary is not a valid PE image: missing MZ header");
+  }
+  const peOffset = bytes.readUInt32LE(0x3c);
+  if (peOffset > bytes.length - 6 || bytes.toString("binary", peOffset, peOffset + 4) !== "PE\u0000\u0000") {
+    throw new Error("binary is not a valid PE image: missing PE header");
+  }
+  return `0x${bytes.readUInt16LE(peOffset + 4).toString(16).padStart(4, "0")}`;
+}
+
+function verifyToolchain(manifest) {
+  const toolchain = manifest.toolchain;
+  if (toolchain.name !== TOOLCHAIN.name || toolchain.version !== TOOLCHAIN.version ||
+      toolchain.source_date_epoch !== TOOLCHAIN.sourceDateEpoch ||
+      toolchain.build_script.path !== TOOLCHAIN.buildScriptPath) {
+    throw new Error("Windows Job keeper toolchain identity mismatch");
+  }
+  for (const [architecture, expected] of Object.entries(ARCHITECTURES)) {
+    if (toolchain.targets[architecture] !== expected.target) {
+      throw new Error(`Windows Job keeper target mismatch for ${architecture}`);
+    }
+  }
+}
+
+export async function verifyReleaseArtifacts(manifest, manifestPath) {
+  verifyToolchain(manifest);
+  const manifestRoot = dirname(resolve(manifestPath));
+  const sourcePath = resolve(manifestRoot, manifest.source.path);
+  if (sha256(await readFile(sourcePath)) !== manifest.source.sha256) {
+    throw new Error(`source SHA-256 mismatch: ${sourcePath}`);
+  }
+  const buildScriptPath = resolve(manifestRoot, manifest.toolchain.build_script.path);
+  if (sha256(await readFile(buildScriptPath)) !== manifest.toolchain.build_script.sha256) {
+    throw new Error(`build script SHA-256 mismatch: ${buildScriptPath}`);
+  }
+  for (const [architecture, expected] of Object.entries(ARCHITECTURES)) {
+    const binary = manifest.binaries[architecture];
+    const path = resolve(manifestRoot, binary.path);
+    const bytes = await readFile(path);
+    if (sha256(bytes) !== binary.sha256) throw new Error(`binary SHA-256 mismatch: ${path}`);
+    const machine = readPeMachine(bytes);
+    if (machine !== expected.peMachine || machine !== binary.pe_machine) {
+      throw new Error(`PE machine mismatch for ${path}: expected ${expected.peMachine}, received ${machine}`);
+    }
+  }
+}
+
+export function requiredNpmPackageFiles(manifest) {
+  return [
+    "native/windows-job-keeper/manifest.json",
+    manifestMemberPackagePath(manifest.source.path),
+    ...Object.keys(ARCHITECTURES).map((architecture) =>
+      manifestMemberPackagePath(manifest.binaries[architecture].path)),
+    manifestMemberPackagePath(manifest.toolchain.build_script.path),
+    "scripts/verify-windows-job-keeper.mjs",
+  ];
+}
+
+function manifestMemberPackagePath(member) {
+  const path = posix.normalize(posix.join(MANIFEST_PACKAGE_DIRECTORY, member));
+  if (path === ".." || path.startsWith("../") || posix.isAbsolute(path)) {
+    throw new Error(`manifest member escapes the npm package: ${member}`);
+  }
+  return path;
+}
+
+export function verifyNpmPackageFileList(manifest, files) {
+  const included = new Set(files);
+  const missing = requiredNpmPackageFiles(manifest).filter((path) => !included.has(path));
+  if (missing.length > 0) throw new Error(`npm package is missing Windows Job keeper files: ${missing.join(", ")}`);
+}
+
+export function npmCliInvocation({
+  environment = process.env,
+  platform = process.platform,
+  nodeExecutable = process.execPath,
+  pathExists = existsSync,
+} = {}) {
+  const npmExecPath = environment.npm_execpath?.trim();
+  if (npmExecPath) {
+    return {
+      command: environment.npm_node_execpath?.trim() || nodeExecutable,
+      args: [npmExecPath],
+    };
+  }
+  if (platform !== "win32") return { command: "npm", args: [] };
+
+  const nodeDirectory = win32.dirname(nodeExecutable);
+  const candidates = [
+    win32.join(nodeDirectory, "node_modules", "npm", "bin", "npm-cli.js"),
+    win32.join(nodeDirectory, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"),
+    ...(environment.npm_config_prefix?.trim()
+      ? [win32.join(environment.npm_config_prefix.trim(), "node_modules", "npm", "bin", "npm-cli.js")]
+      : []),
+    ...(environment.APPDATA?.trim()
+      ? [win32.join(environment.APPDATA.trim(), "npm", "node_modules", "npm", "bin", "npm-cli.js")]
+      : []),
+  ];
+  const npmCliPath = candidates.find((candidate) => pathExists(candidate));
+  if (!npmCliPath) {
+    throw new Error(`unable to resolve npm CLI for Node executable: ${nodeExecutable}`);
+  }
+  return {
+    command: nodeExecutable,
+    args: [npmCliPath],
+  };
+}
+
+export function npmPackFileList(root = repositoryRoot()) {
+  const invocation = npmCliInvocation();
+  const output = execFileSync(invocation.command, [
+    ...invocation.args,
+    "pack",
+    "--dry-run",
+    "--ignore-scripts",
+    "--json",
+  ], {
+    cwd: root,
+    encoding: "utf8",
+  });
+  const result = JSON.parse(output);
+  if (!Array.isArray(result) || result.length !== 1 || !Array.isArray(result[0]?.files)) {
+    throw new Error("npm pack returned an unexpected file list");
+  }
+  return result[0].files.map(({ path }) => path);
+}
+
+export function repositoryRoot() {
+  return resolve(dirname(fileURLToPath(import.meta.url)), "..");
+}
+
+async function main() {
+  const root = repositoryRoot();
+  const manifestPath = resolve(root, "native/windows-job-keeper/manifest.json");
+  const {
+    parseWindowsJobKeeperManifest,
+    resolveWindowsJobKeeperArtifact,
+  } = await import(
+    pathToFileURL(resolve(root, "dist/runtime/windows-job-keeper.js")).href
+  );
+  const manifest = parseWindowsJobKeeperManifest(JSON.parse(await readFile(manifestPath, "utf8")));
+  await verifyReleaseArtifacts(manifest, manifestPath);
+  for (const expected of Object.values(ARCHITECTURES)) {
+    resolveWindowsJobKeeperArtifact({ platform: "win32", architecture: expected.nodeArchitecture });
+  }
+  verifyNpmPackageFileList(manifest, npmPackFileList(root));
+  process.stdout.write("Windows Job keeper artifacts and npm package contents verified.\n");
+}
+
+const invoked = process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (invoked) await main();