intentdna 1.9.3 → 1.9.5

package/dist/runtime/workspace-observation.js

@@ -1,7 +1,7 @@
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { constants, realpathSync } from "node:fs";
-import { lstat, open, readdir, realpath, stat } from "node:fs/promises";
+import { lstat, open, readdir, readlink, realpath } from "node:fs/promises";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 export class WorkspaceObservationError extends Error {
     code;
@@ -12,10 +12,10 @@ export class WorkspaceObservationError extends Error {
     }
 }
 export const DEFAULT_WORKSPACE_OBSERVATION_LIMITS = {
-    max_entries: 100_000,
-    max_bytes: 1_073_741_824,
+    max_entries: 250_000,
+    max_bytes: 8_589_934_592,
     max_depth: 64,
-    max_duration_ms: 30_000,
+    max_duration_ms: 120_000,
 };
 export const WORKSPACE_OBSERVATION_EXCLUDED_PATHS = [
     ".dna/runtime",
@@ -27,8 +27,7 @@ const GIT_EXCLUSION_PATHSPECS = [
     ":(exclude).dna/worktrees/runtime",
     ":(exclude).dna/worktrees/runtime/**",
 ];
-function metadata(value) {
-    const record = value;
+function metadata(record) {
     return {
         dev: String(record.dev),
         ino: String(record.ino),
@@ -38,6 +37,17 @@ function metadata(value) {
         ctime_ns: String(record.ctimeNs),
     };
 }
+function specialFileKind(value) {
+    if (value.isSocket())
+        return "socket";
+    if (value.isFIFO())
+        return "fifo";
+    if (value.isBlockDevice())
+        return "block_device";
+    if (value.isCharacterDevice())
+        return "character_device";
+    return null;
+}
 function sameMetadata(left, right) {
     return JSON.stringify(left) === JSON.stringify(right);
 }
@@ -59,6 +69,29 @@ function git(cwd, args) {
     });
     return { status: result.status, stdout: result.stdout ?? "", stderr: result.stderr ?? "" };
 }
+function sha256Text(value) {
+    return `sha256:${createHash("sha256").update(value, "utf8").digest("hex")}`;
+}
+function gitIgnoreEvidence(root, relativePath) {
+    const result = spawnSync("git", ["check-ignore", "--stdin", "-z", "-v"], {
+        cwd: root,
+        input: `${relativePath}\0`,
+        encoding: "utf8",
+        stdio: ["pipe", "pipe", "pipe"],
+        windowsHide: true,
+    });
+    if (result.status === 1)
+        return null;
+    if (result.status !== 0) {
+        throw new WorkspaceObservationError("verification_failed", result.stderr?.trim() || `cannot inspect Git ignore status for ${relativePath}`);
+    }
+    const stdout = result.stdout ?? "";
+    const fields = stdout.split("\0");
+    if (fields.length !== 5 || fields[3] !== relativePath || fields[4] !== "") {
+        throw new WorkspaceObservationError("verification_failed", `Git returned invalid ignore evidence for ${relativePath}`);
+    }
+    return stdout;
+}
 function gitSnapshot(root) {
     const top = git(root, ["rev-parse", "--show-toplevel"]);
     if (top.status !== 0)
@@ -106,10 +139,12 @@ function validateLimits(input) {
 }
 export function workspaceObservationPolicy(limits) {
     return {
-        schema_version: "intentdna.workspace_observation_policy.v1",
+        schema_version: "intentdna.workspace_observation_policy.v4",
         limits: validateLimits(limits),
         excluded_relative_paths: WORKSPACE_OBSERVATION_EXCLUDED_PATHS,
         git_observation: "head_branch_status_local_config",
+        symlink_observation: "reject_unignored_record_gitignored_target_as_opaque",
+        special_file_observation: "metadata_only_no_open",
     };
 }
 export async function observeWorkspace(request) {
@@ -127,8 +162,13 @@ export async function observeWorkspace(request) {
     const now = request.now_ms ?? Date.now;
     const startedAt = now();
     const digest = createHash("sha256");
+    const policy = workspaceObservationPolicy(limits);
+    digest.update(`policy\0${JSON.stringify(policy)}\0`);
     let entries = 0;
     let bytes = 0;
+    const opaqueExternalDependencies = [];
+    const opaqueChecks = [];
+    const gitBefore = gitSnapshot(root);
     const enforce = (depth) => {
         if (depth > limits.max_depth)
             throw new WorkspaceObservationError("observation_limit_exceeded", "workspace depth limit exceeded");
@@ -144,16 +184,72 @@ export async function observeWorkspace(request) {
     };
     const visit = async (absolutePath, relativePath, depth) => {
         enforce(depth);
-        const beforeStatus = await lstat(absolutePath, { bigint: true });
-        if (beforeStatus.isSymbolicLink()) {
-            throw new WorkspaceObservationError("verification_failed", `symlink is not allowed: ${relativePath}`);
+        let beforeStatus;
+        try {
+            beforeStatus = await lstat(absolutePath, { bigint: true });
+        }
+        catch (error) {
+            throw new WorkspaceObservationError("source_drift", `entry changed before observation: ${relativePath}`, { cause: error });
         }
         entries += 1;
         enforce(depth);
         const before = metadata(beforeStatus);
+        if (beforeStatus.isSymbolicLink()) {
+            if (gitBefore === null) {
+                throw new WorkspaceObservationError("verification_failed", `symlink is not observable: ${relativePath}`);
+            }
+            const ignoreEvidence = gitIgnoreEvidence(root, relativePath);
+            if (ignoreEvidence === null) {
+                throw new WorkspaceObservationError("verification_failed", `symlink is not observable: ${relativePath}`);
+            }
+            let linkTarget;
+            let resolvedTarget;
+            try {
+                linkTarget = await readlink(absolutePath);
+                resolvedTarget = await realpath(absolutePath);
+                await request.hooks?.after_metadata_read?.(relativePath);
+                const afterStatus = await lstat(absolutePath, { bigint: true });
+                const afterTarget = await readlink(absolutePath);
+                if (!afterStatus.isSymbolicLink()
+                    || !sameMetadata(before, metadata(afterStatus))
+                    || afterTarget !== linkTarget) {
+                    throw new WorkspaceObservationError("source_drift", `symlink changed while observing: ${relativePath}`);
+                }
+            }
+            catch (error) {
+                if (error instanceof WorkspaceObservationError)
+                    throw error;
+                throw new WorkspaceObservationError("source_drift", `symlink changed while observing: ${relativePath}`, { cause: error });
+            }
+            const dependency = {
+                kind: "gitignored_symlink_target",
+                relative_path: relativePath,
+                link_target_digest: sha256Text(linkTarget),
+                resolved_target_path_digest: sha256Text(resolvedTarget),
+                git_ignore_evidence_digest: sha256Text(ignoreEvidence),
+            };
+            updateRecord("symlink", relativePath, before);
+            digest.update(`opaque_external_dependency\0${JSON.stringify(dependency)}\0`);
+            opaqueExternalDependencies.push(dependency);
+            opaqueChecks.push({
+                absolute_path: absolutePath,
+                relative_path: relativePath,
+                metadata: before,
+                link_target: linkTarget,
+                resolved_target_path_digest: dependency.resolved_target_path_digest,
+                git_ignore_evidence: ignoreEvidence,
+            });
+            return;
+        }
         if (beforeStatus.isDirectory()) {
             updateRecord("directory", relativePath, before);
-            const names = (await readdir(absolutePath)).sort(canonicalNameOrder);
+            let names;
+            try {
+                names = (await readdir(absolutePath)).sort(canonicalNameOrder);
+            }
+            catch (error) {
+                throw new WorkspaceObservationError("source_drift", `directory changed before read: ${relativePath}`, { cause: error });
+            }
             await request.hooks?.after_directory_read?.(relativePath);
             for (const name of names) {
                 const childRelative = relativePath === "." ? name : `${relativePath}/${name}`;
@@ -161,19 +257,48 @@ export async function observeWorkspace(request) {
                     continue;
                 await visit(join(absolutePath, name), childRelative, depth + 1);
             }
-            const after = metadata(await stat(absolutePath, { bigint: true }));
-            if (!sameMetadata(before, after)) {
+            let afterStatus;
+            try {
+                afterStatus = await lstat(absolutePath, { bigint: true });
+            }
+            catch (error) {
+                throw new WorkspaceObservationError("source_drift", `directory changed while observing: ${relativePath}`, { cause: error });
+            }
+            if (!afterStatus.isDirectory() || !sameMetadata(before, metadata(afterStatus))) {
                 throw new WorkspaceObservationError("source_drift", `directory changed while observing: ${relativePath}`);
             }
             return;
         }
         if (!beforeStatus.isFile()) {
-            throw new WorkspaceObservationError("verification_failed", `special file is not allowed: ${relativePath}`);
+            const kind = specialFileKind(beforeStatus);
+            if (kind === null) {
+                throw new WorkspaceObservationError("verification_failed", `unknown filesystem node is not observable: ${relativePath}`);
+            }
+            let afterStatus;
+            try {
+                await request.hooks?.after_metadata_read?.(relativePath);
+                afterStatus = await lstat(absolutePath, { bigint: true });
+            }
+            catch (error) {
+                throw new WorkspaceObservationError("source_drift", `${kind} changed while observing: ${relativePath}`, { cause: error });
+            }
+            if (specialFileKind(afterStatus) !== kind || !sameMetadata(before, metadata(afterStatus))) {
+                throw new WorkspaceObservationError("source_drift", `${kind} changed while observing: ${relativePath}`);
+            }
+            updateRecord(kind, relativePath, before);
+            return;
         }
         // Node does not expose openat(2), so same-user namespace replacement cannot be
         // eliminated completely. O_NOFOLLOW plus descriptor/path revalidation closes
         // the practical symlink and replacement windows without native code.
-        const handle = await open(absolutePath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        await request.hooks?.after_metadata_read?.(relativePath);
+        let handle;
+        try {
+            handle = await open(absolutePath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        }
+        catch (error) {
+            throw new WorkspaceObservationError("source_drift", `file changed before read: ${relativePath}`, { cause: error });
+        }
         try {
             const descriptorBefore = metadata(await handle.stat({ bigint: true }));
             if (!sameMetadata(before, descriptorBefore)) {
@@ -188,9 +313,17 @@ export async function observeWorkspace(request) {
                 digest.update(buffer);
             }
             digest.update("\0");
-            const descriptorAfter = metadata(await handle.stat({ bigint: true }));
-            const pathAfter = await lstat(absolutePath, { bigint: true });
-            if (pathAfter.isSymbolicLink() || !sameMetadata(before, descriptorAfter) || !sameMetadata(before, metadata(pathAfter))) {
+            await request.hooks?.after_file_read?.(relativePath);
+            let descriptorAfter;
+            let pathAfter;
+            try {
+                descriptorAfter = metadata(await handle.stat({ bigint: true }));
+                pathAfter = await lstat(absolutePath, { bigint: true });
+            }
+            catch (error) {
+                throw new WorkspaceObservationError("source_drift", `file changed while observing: ${relativePath}`, { cause: error });
+            }
+            if (!pathAfter.isFile() || !sameMetadata(before, descriptorAfter) || !sameMetadata(before, metadata(pathAfter))) {
                 throw new WorkspaceObservationError("source_drift", `file changed while observing: ${relativePath}`);
             }
         }
@@ -198,19 +331,44 @@ export async function observeWorkspace(request) {
             await handle.close();
         }
     };
-    const gitBefore = gitSnapshot(root);
     await visit(root, ".", 0);
+    for (const check of opaqueChecks) {
+        try {
+            const status = await lstat(check.absolute_path, { bigint: true });
+            const linkTarget = await readlink(check.absolute_path);
+            const resolvedTarget = await realpath(check.absolute_path);
+            const ignoreEvidence = gitIgnoreEvidence(root, check.relative_path);
+            if (!status.isSymbolicLink()
+                || !sameMetadata(check.metadata, metadata(status))
+                || linkTarget !== check.link_target
+                || sha256Text(resolvedTarget) !== check.resolved_target_path_digest
+                || ignoreEvidence !== check.git_ignore_evidence) {
+                throw new WorkspaceObservationError("source_drift", `opaque external dependency changed while observing: ${check.relative_path}`);
+            }
+        }
+        catch (error) {
+            if (error instanceof WorkspaceObservationError)
+                throw error;
+            throw new WorkspaceObservationError("source_drift", `opaque external dependency changed while observing: ${check.relative_path}`, { cause: error });
+        }
+    }
+    opaqueExternalDependencies.sort((left, right) => canonicalNameOrder(left.relative_path, right.relative_path));
+    digest.update(`scope\0${JSON.stringify({
+        excluded_relative_paths: WORKSPACE_OBSERVATION_EXCLUDED_PATHS,
+        opaque_external_dependencies: opaqueExternalDependencies,
+    })}\0`);
     const gitAfter = gitSnapshot(root);
     if (JSON.stringify(gitBefore) !== JSON.stringify(gitAfter)) {
         throw new WorkspaceObservationError("source_drift", "Git workspace state changed while observing");
     }
     digest.update(`git\0${JSON.stringify(gitAfter)}\0`);
     return {
-        schema_version: "intentdna.workspace_observation.v2",
+        schema_version: "intentdna.workspace_observation.v5",
         observed_digest: `sha256:${digest.digest("hex")}`,
         entry_count: entries,
         byte_count: bytes,
         excluded_relative_paths: WORKSPACE_OBSERVATION_EXCLUDED_PATHS,
+        opaque_external_dependencies: opaqueExternalDependencies,
         git: gitAfter,
     };
 }

package/dist/schema/types.d.ts

@@ -505,6 +505,7 @@ export interface PreExecutionGate {
     action: "block" | "escalate" | "warn";
     message: string;
     source_gene: string;
+    enforcement?: "runtime" | "prompt_only";
     origin?: ConstraintOrigin;
 }
 export interface PostExecutionValidator {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "intentdna",
-  "version": "1.9.3",
+  "version": "1.9.5",
   "description": "Intent DNA — Declarative policy layer for AI agent behavior",
   "type": "module",
   "main": "dist/index.js",