intentdna 1.9.0 → 1.9.3

package/dist/mcp/tools-state.js

@@ -4,117 +4,15 @@
  * Tools for reading/writing DNA governance state via MCP:
  *   - dna_status: Overview of DNA state
  *   - dna_workflow_read: Read current workflow state
- *   - dna_workflow_write: Update workflow state
+ *   - dna_workflow_write: Close legacy workflow state
  *   - dna_trace_query: Query legacy diagnostic trace data with filters
  */
 import { resolve } from "node:path";
 import { readWorkflowState, writeWorkflowState, readRuntimeDecisionEvents, readTraces, listSessions } from "../hooks/state.js";
 import { validateRuntimeDecisionEvent } from "../governance/index.js";
-import { loadCompiledIR, loadCompiledIRResult } from "../runtime/plugin-adapter.js";
+import { loadCompiledIR } from "../runtime/plugin-adapter.js";
 import { validateWorkflowRuntimeManifest } from "../runtime/workflow-runtime-manifest.js";
 import { errorResult, textResult } from "./server.js";
-function isStringRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value) &&
-        Object.values(value).every(v => typeof v === "string");
-}
-function sameStringRecord(a, b) {
-    const aKeys = Object.keys(a).sort();
-    const bKeys = Object.keys(b).sort();
-    return aKeys.length === bKeys.length && aKeys.every((key, index) => key === bKeys[index] && a[key] === b[key]);
-}
-const RUNTIME_ARGUMENT_NAMES = ["ARGUMENTS", "arguments", "task_id"];
-function compatibleManifestInputCandidate(binding, candidate) {
-    if (!candidate)
-        return { ignored: [] };
-    const allowed = new Set([...binding.runtime_input_refs, ...RUNTIME_ARGUMENT_NAMES]);
-    const entries = Object.entries(candidate);
-    return {
-        candidate: Object.fromEntries(entries.filter(([name]) => allowed.has(name))),
-        ignored: entries.filter(([name]) => !allowed.has(name)).map(([name]) => name).sort(),
-    };
-}
-async function lookupRuntimeBinding(projectDir, workflow) {
-    const result = await loadCompiledIRResult(resolve(projectDir, ".dna", "compiled", "ir.json"));
-    if (result.status === "missing") {
-        return { status: "error", kind: "invalid_ir", message: "No compiled IR found. Run `dna sync` before starting or continuing this workflow." };
-    }
-    if (result.status === "invalid") {
-        return { status: "error", kind: "invalid_ir", message: `Invalid compiled IR: ${result.reason}. Run \`dna sync\` before starting or continuing this workflow.` };
-    }
-    const compiled = result.compiled;
-    if (!Object.prototype.hasOwnProperty.call(compiled, "workflow_runtime")) {
-        return { status: "legacy", compiledIrHash: compiled.compiled_ir_hash };
-    }
-    if (typeof compiled.compiled_ir_hash !== "string" ||
-        typeof compiled.ir.compiled_ir_hash !== "string" ||
-        compiled.compiled_ir_hash !== compiled.ir.compiled_ir_hash) {
-        return {
-            status: "error",
-            kind: "invalid_ir",
-            message: "Invalid compiled IR: workflow runtime bindings require matching wrapper and IR hashes. Run `dna sync` before starting or continuing this workflow.",
-        };
-    }
-    const validation = validateWorkflowRuntimeManifest(compiled.workflow_runtime, compiled.compiled_ir_hash);
-    if (!validation.valid) {
-        return {
-            status: "error",
-            kind: "invalid_manifest",
-            compiledIrHash: compiled.compiled_ir_hash,
-            message: `Invalid compiled workflow runtime manifest: ${validation.reason}. Run \`dna sync\` before starting or continuing this workflow.`,
-        };
-    }
-    if (!Object.prototype.hasOwnProperty.call(validation.manifest.workflows, workflow)) {
-        return {
-            status: "error",
-            kind: "workflow_missing",
-            compiledIrHash: validation.manifest.compiled_ir_hash,
-            message: `Workflow ${workflow} is not present in the compiled workflow runtime manifest. Run \`dna sync\` to refresh generated runtime artifacts.`,
-        };
-    }
-    const binding = validation.manifest.workflows[workflow];
-    return {
-        status: "found",
-        binding,
-        manifestHash: validation.manifest.manifest_hash,
-        compiledIrHash: validation.manifest.compiled_ir_hash,
-    };
-}
-function normalizeManifestInputs(binding, candidate) {
-    const rawInputs = { ...(candidate ?? {}) };
-    const allowed = new Set([...binding.runtime_input_refs, ...RUNTIME_ARGUMENT_NAMES]);
-    const unexpected = Object.keys(rawInputs).filter((name) => !allowed.has(name));
-    if (unexpected.length > 0) {
-        return { valid: false, message: `Workflow inputs are not declared by the compiled runtime binding: ${unexpected.join(", ")}` };
-    }
-    const argumentValues = RUNTIME_ARGUMENT_NAMES
-        .map((name) => rawInputs[name])
-        .filter((value) => value !== undefined);
-    const distinctArgumentValues = [...new Set(argumentValues)];
-    if (distinctArgumentValues.length > 1) {
-        return { valid: false, message: "ARGUMENTS, arguments, and task_id must identify the same runtime input." };
-    }
-    const argumentValue = distinctArgumentValues[0];
-    if (!binding.requires_arguments && argumentValue !== undefined) {
-        return { valid: true, note: "Ignored legacy argument input for an argument-free workflow." };
-    }
-    if (binding.requires_arguments && (!argumentValue || argumentValue.trim() === "")) {
-        return { valid: false, message: "This workflow requires a non-empty ARGUMENTS input." };
-    }
-    const inputs = {};
-    for (const name of binding.runtime_input_refs) {
-        if (RUNTIME_ARGUMENT_NAMES.includes(name)) {
-            if (argumentValue !== undefined)
-                inputs[name] = argumentValue;
-        }
-        else if (rawInputs[name] !== undefined) {
-            inputs[name] = rawInputs[name];
-        }
-        else {
-            return { valid: false, message: `This workflow requires runtime input ${name}.` };
-        }
-    }
-    return { valid: true, inputs: Object.keys(inputs).length > 0 ? inputs : undefined };
-}
 export function createStateTools(projectDir) {
     return [
         // ── dna_status ────────────────────────────────────────
@@ -207,7 +105,7 @@ export function createStateTools(projectDir) {
         // ── dna_workflow_write ────────────────────────────────
         {
             name: "dna_workflow_write",
-            description: "Update workflow state. Template variables and workflow asset identity are initialized from the compiled runtime manifest.",
+            description: "Close-only compatibility operation for an already-active legacy workflow. New and continuing runs must use the canonical run tools.",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -227,148 +125,22 @@ export function createStateTools(projectDir) {
                 const sessionId = typeof args.session_id === "string" ? args.session_id : undefined;
                 const existing = await readWorkflowState(projectDir, sessionId, 0);
                 const workflow = String(args.workflow);
-                if (existing?.active && existing.workflow !== workflow) {
-                    return errorResult(`Workflow ${existing.workflow} is already active. Deactivate it before starting or writing state for ${workflow}.`);
+                if (args.active !== false) {
+                    return errorResult("dna_workflow_write is close-only after the canonical runtime cutover; use dna_run_start/dna_run_next for executable workflows.");
                 }
-                const sameActiveWorkflow = existing?.active === true && existing.workflow === workflow;
-                const closingWorkflow = args.active === false;
-                if (sameActiveWorkflow && closingWorkflow) {
-                    const state = {
-                        ...existing,
-                        active: false,
-                        current_step: String(args.current_step),
-                        current_role: String(args.current_role),
-                        iteration: typeof args.iteration === "number" ? args.iteration : existing.iteration,
-                    };
-                    await writeWorkflowState(projectDir, state, sessionId);
-                    return textResult(`Workflow state updated: ${state.workflow} step=${state.current_step} role=${state.current_role} iteration=${state.iteration}\n`
-                        + "Terminal deactivation preserved the run's pinned state and ignored replacement runtime bindings.");
+                if (!existing?.active) {
+                    return errorResult("dna_workflow_write is close-only and no active legacy workflow exists for this session.");
                 }
-                const runtimeBinding = await lookupRuntimeBinding(projectDir, workflow);
-                const hasPinnedRuntimeBinding = sameActiveWorkflow &&
-                    existing?.resolved_variables_source === "compiled_manifest" &&
-                    typeof existing.workflow_runtime_manifest_hash === "string" &&
-                    typeof existing.workflow_runtime_compiled_ir_hash === "string";
-                if (runtimeBinding.status === "error" && !hasPinnedRuntimeBinding) {
-                    return errorResult(runtimeBinding.message);
-                }
-                const currentCompiledIrHash = runtimeBinding.compiledIrHash;
-                if (hasPinnedRuntimeBinding &&
-                    currentCompiledIrHash !== existing.workflow_runtime_compiled_ir_hash &&
-                    !closingWorkflow) {
-                    return errorResult("The compiled IR changed during this active workflow. Restart the workflow so one run cannot execute against multiple policy revisions.");
-                }
-                if (args.inputs !== undefined && !isStringRecord(args.inputs)) {
-                    return errorResult("Workflow inputs must be an object whose values are strings.");
-                }
-                const providedInputs = isStringRecord(args.inputs) ? args.inputs : undefined;
-                let inputs;
-                let workflowInputsPinned = sameActiveWorkflow ? existing?.workflow_inputs_pinned : undefined;
-                let workflowAsset;
-                let resolvedVariables;
-                let resolvedVariablesSource;
-                let workflowRuntimeManifestHash;
-                let workflowRuntimeCompiledIrHash;
-                const notes = [];
-                if (hasPinnedRuntimeBinding) {
-                    workflowAsset = existing.workflow_asset;
-                    resolvedVariables = existing.resolved_variables;
-                    resolvedVariablesSource = "compiled_manifest";
-                    workflowRuntimeManifestHash = existing.workflow_runtime_manifest_hash;
-                    workflowRuntimeCompiledIrHash = existing.workflow_runtime_compiled_ir_hash;
-                    workflowInputsPinned = true;
-                    if (providedInputs) {
-                        const normalized = runtimeBinding.status === "found"
-                            ? normalizeManifestInputs(runtimeBinding.binding, providedInputs)
-                            : { valid: true, inputs: providedInputs };
-                        if (!normalized.valid)
-                            return errorResult(normalized.message);
-                        if (!sameStringRecord(existing.inputs ?? {}, normalized.inputs ?? {})) {
-                            return errorResult("Workflow inputs are pinned for an active run and cannot be changed. Finish or restart the workflow to use different inputs.");
-                        }
-                    }
-                    inputs = existing.inputs;
-                    if (args.resolved_variables !== undefined) {
-                        notes.push("Deprecated resolved_variables input ignored; active workflow bindings are pinned.");
-                    }
-                    if (runtimeBinding.status === "found" && runtimeBinding.manifestHash !== workflowRuntimeManifestHash) {
-                        notes.push("A newer compiled workflow runtime manifest exists; this active workflow remains pinned to its start-time bindings.");
-                    }
-                    else if (runtimeBinding.status === "error") {
-                        notes.push("The compiled workflow manifest is invalid or unavailable; this run remains pinned to the same compiled IR revision. Run `dna sync` before the next workflow.");
-                    }
-                    else if (runtimeBinding.status === "legacy") {
-                        notes.push("The compiled runtime manifest is unavailable; this active workflow remains pinned, but `dna sync` is required before the next workflow.");
-                    }
-                }
-                else if (runtimeBinding.status === "found") {
-                    let candidateInputs = providedInputs ?? (sameActiveWorkflow ? existing?.inputs : undefined);
-                    if (sameActiveWorkflow && existing?.resolved_variables_source !== "compiled_manifest") {
-                        const existingCandidate = compatibleManifestInputCandidate(runtimeBinding.binding, existing.inputs);
-                        const providedCandidate = compatibleManifestInputCandidate(runtimeBinding.binding, providedInputs);
-                        const normalizedExisting = normalizeManifestInputs(runtimeBinding.binding, existingCandidate.candidate);
-                        const normalizedProvided = providedInputs
-                            ? normalizeManifestInputs(runtimeBinding.binding, providedCandidate.candidate)
-                            : null;
-                        if (normalizedExisting.valid && normalizedExisting.inputs) {
-                            if (normalizedProvided?.valid && normalizedProvided.inputs &&
-                                !sameStringRecord(normalizedExisting.inputs, normalizedProvided.inputs)) {
-                                return errorResult("Workflow inputs are pinned for an active legacy run and cannot be changed during migration.");
-                            }
-                            candidateInputs = existingCandidate.candidate;
-                        }
-                        else {
-                            candidateInputs = { ...existingCandidate.candidate, ...providedCandidate.candidate };
-                        }
-                        const ignored = [...new Set([...existingCandidate.ignored, ...providedCandidate.ignored])];
-                        if (ignored.length > 0) {
-                            notes.push(`Ignored legacy workflow input metadata during migration: ${ignored.join(", ")}.`);
-                        }
-                    }
-                    const normalizedInputs = normalizeManifestInputs(runtimeBinding.binding, candidateInputs);
-                    if (!normalizedInputs.valid)
-                        return errorResult(normalizedInputs.message);
-                    inputs = normalizedInputs.inputs;
-                    workflowInputsPinned = true;
-                    workflowAsset = runtimeBinding.binding.workflow_asset;
-                    resolvedVariables = runtimeBinding.binding.resolved_variables;
-                    resolvedVariablesSource = "compiled_manifest";
-                    workflowRuntimeManifestHash = runtimeBinding.manifestHash;
-                    workflowRuntimeCompiledIrHash = runtimeBinding.compiledIrHash;
-                    if (normalizedInputs.note)
-                        notes.push(normalizedInputs.note);
-                    if (args.resolved_variables !== undefined) {
-                        notes.push("Deprecated resolved_variables input ignored; compiled workflow runtime manifest is authoritative.");
-                    }
-                    if (sameActiveWorkflow && existing?.resolved_variables_source !== "compiled_manifest") {
-                        notes.push("Legacy workflow state upgraded to compiled workflow runtime bindings.");
-                    }
-                }
-                else {
-                    return errorResult("This project has a legacy compiled IR without deterministic workflow runtime bindings. Run `dna sync` with the upgraded IntentDNA CLI, then retry the workflow. Model-supplied workflow_asset and resolved_variables are not trusted.");
+                if (existing.workflow !== workflow) {
+                    return errorResult(`Legacy workflow ${existing.workflow} is active; close it with the same workflow id before starting a canonical run.`);
                 }
                 const state = {
-                    active: typeof args.active === "boolean" ? args.active : true,
-                    workflow_asset: workflowAsset,
-                    workflow,
-                    current_step: String(args.current_step),
-                    current_role: String(args.current_role),
-                    iteration: typeof args.iteration === "number" ? args.iteration : (sameActiveWorkflow ? existing?.iteration ?? 1 : 1),
-                    session_id: sessionId ?? (sameActiveWorkflow ? existing?.session_id : undefined) ?? "",
-                    started_at: sameActiveWorkflow ? existing.started_at : new Date().toISOString(),
-                    inputs,
-                    resolved_variables: resolvedVariables,
-                    resolved_variables_source: resolvedVariablesSource,
-                    workflow_runtime_manifest_hash: workflowRuntimeManifestHash,
-                    workflow_runtime_compiled_ir_hash: workflowRuntimeCompiledIrHash,
-                    workflow_inputs_pinned: workflowInputsPinned,
-                    completed_artifacts: sameActiveWorkflow ? existing?.completed_artifacts : undefined,
+                    ...existing,
+                    active: false,
                 };
                 await writeWorkflowState(projectDir, state, sessionId);
-                return textResult([
-                    `Workflow state updated: ${state.workflow} step=${state.current_step} role=${state.current_role} iteration=${state.iteration}`,
-                    ...notes,
-                ].join("\n"));
+                return textResult(`Legacy workflow closed: ${state.workflow} step=${state.current_step} role=${state.current_role} iteration=${state.iteration}\n`
+                    + "Existing legacy progress was preserved; no scheduler, handoff, or result authority was transferred to the canonical runtime.");
             },
         },
         // ── dna_trace_query ──────────────────────────────────

package/dist/runtime/artifact-store.d.ts

@@ -0,0 +1,146 @@
+export declare const DIRECTORY_ARTIFACT_SCHEMA_VERSION: "intentdna.directory_artifact.v1";
+export declare const GIT_COMMIT_ARTIFACT_SCHEMA_VERSION: "intentdna.git_commit_artifact.v1";
+export type ArtifactKind = "file" | "directory" | "git_commit";
+export type CapturableArtifactKind = Exclude<ArtifactKind, "git_commit">;
+export interface FileArtifactEntry {
+    readonly kind: "file";
+    readonly path: string;
+    readonly artifact_id: string;
+    readonly size_bytes: number;
+}
+export interface DirectoryArtifactEntry {
+    readonly kind: "directory";
+    readonly path: string;
+}
+export type ArtifactEntry = FileArtifactEntry | DirectoryArtifactEntry;
+export interface FileArtifactObject {
+    readonly artifact_id: string;
+    readonly kind: "file";
+    readonly size_bytes: number;
+}
+export interface DirectoryArtifactObject {
+    readonly artifact_id: string;
+    readonly kind: "directory";
+    readonly size_bytes: number;
+    readonly manifest: readonly ArtifactEntry[];
+}
+export interface GitCommitArtifactObject {
+    readonly artifact_id: string;
+    readonly kind: "git_commit";
+    readonly size_bytes: number;
+    readonly repository_id: string;
+    readonly object_format: "sha1" | "sha256";
+    readonly commit_oid: string;
+}
+export type ArtifactObject = FileArtifactObject | DirectoryArtifactObject | GitCommitArtifactObject;
+export interface ArtifactCaptureRef {
+    readonly capture_id: string;
+    readonly artifact_id: string;
+    readonly artifact_kind: ArtifactKind;
+    readonly run_id: string;
+    readonly activation_id: string;
+    readonly attempt_id: string;
+    readonly output_name: string;
+    readonly source_workspace_id: string;
+    readonly source_path: string;
+    readonly captured_at: string;
+}
+export interface CaptureArtifactRequest {
+    readonly kind: ArtifactKind;
+    readonly workspace_root: string;
+    readonly source_path: string;
+    readonly run_id: string;
+    readonly activation_id: string;
+    readonly attempt_id: string;
+    readonly output_name: string;
+    readonly source_workspace_id: string;
+}
+export interface CaptureArtifactResponse {
+    readonly object: ArtifactObject;
+    readonly capture: ArtifactCaptureRef;
+}
+export interface CaptureExistingArtifactRequest extends ArtifactLocator {
+    readonly run_id: string;
+    readonly activation_id: string;
+    readonly attempt_id: string;
+    readonly output_name: string;
+    readonly source_workspace_id: string;
+    readonly source_path: string;
+}
+export interface ArtifactLocator {
+    readonly artifact_id: string;
+    readonly artifact_kind: ArtifactKind;
+}
+export interface ArtifactStoreOptions {
+    readonly root_directory: string;
+    readonly now?: () => Date;
+    readonly max_file_size_bytes?: number;
+    readonly max_directory_size_bytes?: number;
+    readonly max_directory_entries?: number;
+    readonly max_manifest_size_bytes?: number;
+}
+export interface MaterializeArtifactRequest extends ArtifactLocator {
+    readonly destination_root: string;
+    readonly binding_id: string;
+}
+export interface MaterializedArtifact extends ArtifactLocator {
+    readonly materialized_path: string;
+}
+export type ArtifactStoreErrorCode = "invalid_options" | "invalid_request" | "unsupported_artifact_kind" | "source_not_found" | "source_outside_workspace" | "source_kind_mismatch" | "symlink_not_allowed" | "special_file_not_allowed" | "limit_exceeded" | "source_drift" | "git_repository_invalid" | "git_commit_invalid" | "artifact_not_found" | "artifact_corrupt" | "unsafe_destination" | "materialization_conflict" | "materialization_verification_failed";
+export declare class ArtifactStoreError extends Error {
+    readonly code: ArtifactStoreErrorCode;
+    constructor(code: ArtifactStoreErrorCode, message: string);
+}
+export declare class ArtifactStore {
+    private readonly options;
+    private readonly now;
+    constructor(options: ArtifactStoreOptions);
+    /**
+     * The caller must stop the producer and hold exclusive mutation authority for
+     * the workspace namespace until this promise settles.
+     */
+    capture(request: CaptureArtifactRequest): Promise<CaptureArtifactResponse>;
+    captureExisting(request: CaptureExistingArtifactRequest): Promise<CaptureArtifactResponse>;
+    resolve(locator: ArtifactLocator): Promise<ArtifactObject | null>;
+    require(locator: ArtifactLocator): Promise<ArtifactObject>;
+    readFileBytes(artifactId: string): Promise<Buffer>;
+    readGitCommitBytes(artifactId: string): Promise<Buffer>;
+    verifyGitCommitInWorkspace(locator: ArtifactLocator, workspaceRoot: string): Promise<GitCommitArtifactObject>;
+    verifyGitCommitProducedByAttempt(locator: ArtifactLocator, workspaceRoot: string, baselineCommitOid: string, expectedBranchRef: string | null): Promise<GitCommitArtifactObject>;
+    protected beforeSourceRevalidation(_sourcePath: string, _kind: CapturableArtifactKind): Promise<void>;
+    private ensureLayout;
+    private fileObjectsDirectory;
+    private directoryObjectsDirectory;
+    private gitCommitObjectsDirectory;
+    private temporaryDirectory;
+    private fileObjectPath;
+    private directoryObjectPath;
+    private gitCommitObjectPath;
+    private resolveSource;
+    private assertSourceResolutionStable;
+    private captureGitCommit;
+    private inspectGitCommit;
+    private captureFile;
+    private captureDirectory;
+    private scanDirectory;
+    private signatureMapsEqual;
+    private publishNoReplace;
+    private readFileObject;
+    private readDirectoryObject;
+    private readGitCommitObject;
+}
+export declare class ArtifactMaterializer {
+    private readonly store;
+    constructor(store: ArtifactStore);
+    materialize(request: MaterializeArtifactRequest): Promise<MaterializedArtifact>;
+    /** Reuses an existing target only after verifying the complete immutable artifact. */
+    materializeReplaySafe(request: MaterializeArtifactRequest): Promise<MaterializedArtifact>;
+    private materializeWithExistingTargetPolicy;
+    protected beforePostCopyVerification(_materializedPath: string, _object: ArtifactObject): Promise<void>;
+    private materializeFile;
+    private materializeDirectory;
+    private verifyExistingMaterialization;
+    private verifyMaterializedFile;
+    private verifyMaterializedDirectory;
+}
+export { ArtifactStore as ImmutableArtifactStore };