principles-disciple 1.183.0 → 1.184.0

package/dist/service/evolution-worker.d.ts

@@ -53,8 +53,8 @@ export interface EvolutionQueueItem {
     resultRef?: string;
     painEventId?: number;
 }
-import { migrateToV2, isLegacyQueueItem, migrateQueueToV2, LegacyEvolutionQueueItem, DEFAULT_TASK_KIND, DEFAULT_PRIORITY, DEFAULT_MAX_RETRIES, type RawQueueItem } from './queue-migration.js';
-export { migrateToV2, isLegacyQueueItem, migrateQueueToV2, LegacyEvolutionQueueItem, DEFAULT_TASK_KIND, DEFAULT_PRIORITY, DEFAULT_MAX_RETRIES };
+import { migrateToV2, isLegacyQueueItem, migrateQueueToV2, LegacyEvolutionQueueItem, DEFAULT_TASK_KIND, DEFAULT_PRIORITY, DEFAULT_MAX_RETRIES, validateQueueItem, VALID_TASK_KINDS, isValidQueueItem, type RawQueueItem } from './queue-migration.js';
+export { migrateToV2, isLegacyQueueItem, migrateQueueToV2, LegacyEvolutionQueueItem, DEFAULT_TASK_KIND, DEFAULT_PRIORITY, DEFAULT_MAX_RETRIES, validateQueueItem, VALID_TASK_KINDS, isValidQueueItem };
 export type { RawQueueItem };
 export declare function extractEvolutionTaskId(task: string): string | null;
 export declare function purgeStaleFailedTasks(queue: EvolutionQueueItem[], logger: PluginLogger): {

package/dist/service/evolution-worker.js

@@ -11,7 +11,7 @@ import { atomicWriteFileSync } from '../utils/io.js';
 // Re-export queue I/O (extracted to queue-io.ts)
 export { loadEvolutionQueue, saveEvolutionQueue, withQueueLock, acquireQueueLock, requireQueueLock } from './queue-io.js';
 export { EVOLUTION_QUEUE_LOCK_SUFFIX, LOCK_MAX_RETRIES, LOCK_RETRY_DELAY_MS, LOCK_STALE_MS } from './queue-io.js';
-import { saveEvolutionQueue, requireQueueLock } from './queue-io.js';
+import { saveEvolutionQueue, requireQueueLock, loadEvolutionQueue } from './queue-io.js';
 import { WorkflowStore } from './subagent-workflow/workflow-store.js';
 import { PrincipleCompiler } from '../core/principle-compiler/index.js';
 import { loadLedger, updatePrinciple } from '../core/principle-tree-ledger.js';
@@ -58,8 +58,8 @@ import { runWorkflowWatchdog } from './workflow-watchdog.js';
 export { runWorkflowWatchdog };
 let timeoutId = null;
 // ── Queue Migration (extracted to queue-migration.ts) ────────────────────────
-import { migrateToV2, isLegacyQueueItem, migrateQueueToV2, DEFAULT_TASK_KIND, DEFAULT_PRIORITY, DEFAULT_MAX_RETRIES } from './queue-migration.js';
-export { migrateToV2, isLegacyQueueItem, migrateQueueToV2, DEFAULT_TASK_KIND, DEFAULT_PRIORITY, DEFAULT_MAX_RETRIES };
+import { migrateToV2, isLegacyQueueItem, migrateQueueToV2, DEFAULT_TASK_KIND, DEFAULT_PRIORITY, DEFAULT_MAX_RETRIES, validateQueueItem, VALID_TASK_KINDS, isValidQueueItem } from './queue-migration.js';
+export { migrateToV2, isLegacyQueueItem, migrateQueueToV2, DEFAULT_TASK_KIND, DEFAULT_PRIORITY, DEFAULT_MAX_RETRIES, validateQueueItem, VALID_TASK_KINDS, isValidQueueItem };
 // Queue lock constants and requireQueueLock are imported from queue-io.ts
 export function extractEvolutionTaskId(task) {
     if (!task)
@@ -302,30 +302,12 @@ async function processEvolutionQueue(wctx, logger, _eventLog, _api) {
             logger?.info?.(`[PD:EvolutionWorker] Dropped ${beforeLegacyPainDrop - queue.length} legacy pain_diagnosis queue item(s); use PainSignalBridge/pd pain record`);
         }
         // Validate queue items — filter out malformed entries before processing.
-        // Malformed items are logged + skipped; they never crash the evolution cycle.
+        // rc-1/rc-4 (ERR-007): consolidated in validateQueueItem (queue-migration.ts)
+        // so every load path applies the same filter. Malformed items are logged +
+        // skipped; they never crash the evolution cycle.
         const beforeValidation = queue.length;
         queue = queue.filter((item) => {
-            const errors = [];
-            if (!item.id || typeof item.id !== 'string')
-                errors.push('missing/invalid id');
-            if (!item.source || typeof item.source !== 'string')
-                errors.push('missing/invalid source');
-            if (typeof item.score !== 'number')
-                errors.push('missing/invalid score');
-            if (!item.status || typeof item.status !== 'string')
-                errors.push('missing/invalid status');
-            if (!item.taskKind || typeof item.taskKind !== 'string')
-                errors.push('missing/invalid taskKind');
-            else {
-                const validTaskKinds = ['model_eval'];
-                if (!validTaskKinds.includes(item.taskKind)) {
-                    errors.push(`invalid taskKind value '${item.taskKind}' (expected one of: ${validTaskKinds.join(', ')})`);
-                }
-            }
-            if (typeof item.retryCount !== 'number')
-                errors.push('missing/invalid retryCount');
-            if (typeof item.maxRetries !== 'number')
-                errors.push('missing/invalid maxRetries');
+            const errors = validateQueueItem(item);
             if (errors.length > 0) {
                 logger?.warn?.(`[PD:EvolutionWorker] Skipping malformed queue item: ${errors.join(', ')} | ${JSON.stringify(item).slice(0, 200)}`);
                 SystemLogger.log(wctx.workspaceDir, 'QUEUE_ITEM_MALFORMED', `Skipped: ${errors.join(', ')} | id=${item.id || 'N/A'}`);
@@ -361,16 +343,16 @@ export async function registerEvolutionTaskSession(workspaceResolve, taskId, ses
         return false;
     const releaseLock = await requireQueueLock(queuePath, logger, 'registerEvolutionTaskSession');
     try {
-        let rawQueue;
-        try {
-            rawQueue = JSON.parse(fs.readFileSync(queuePath, 'utf8'));
-        }
-        catch (parseErr) {
-            logger?.warn?.(`[PD:EvolutionWorker] Failed to parse EVOLUTION_QUEUE for session registration: ${queuePath} - ${parseErr instanceof Error ? parseErr.message : String(parseErr)}`);
-            return false;
-        }
-        // V2: Migrate queue to current schema
-        const queue = migrateQueueToV2(rawQueue);
+        // loadEvolutionQueue handles JSON parse + migrate + validate (rc-1/rc-4).
+        // Previously this inlined JSON.parse + migrate cast without validating,
+        // so malformed queue items could reach the find() below. Reusing the
+        // shared loader keeps a single chokepoint for queue validation.
+        // Note: loadEvolutionQueue returns core/evolution-types.EvolutionQueueItem,
+        // which saveEvolutionQueue also accepts. We deliberately avoid annotating
+        // with the local EvolutionQueueItem interface (line 87) to prevent the
+        // known type-drift between the two definitions (see follow-up: unify the
+        // three EvolutionQueueItem copies).
+        const queue = loadEvolutionQueue(queuePath);
         const task = queue.find((item) => item.id === taskId && item.status === 'in_progress');
         if (!task) {
             logger?.warn?.(`[PD:EvolutionWorker] Could not find in-progress evolution task ${taskId} for session assignment`);

package/dist/service/queue-io.js

@@ -11,7 +11,7 @@ import { createHash } from 'crypto';
 import { acquireLockAsync, releaseLock as releaseImportedLock } from '../utils/file-lock.js';
 import { atomicWriteFileSync } from '../utils/io.js';
 import { LockUnavailableError } from '../config/errors.js';
-import { migrateQueueToV2 } from './queue-migration.js';
+import { migrateQueueToV2, validateQueueItem } from './queue-migration.js';
 export const EVOLUTION_QUEUE_LOCK_SUFFIX = '.lock';
 export const LOCK_MAX_RETRIES = 50;
 export const LOCK_RETRY_DELAY_MS = 50;
@@ -72,7 +72,19 @@ export function loadEvolutionQueue(queuePath) {
             rawQueue = [];
         }
     }
-    return migrateQueueToV2(rawQueue);
+    // rc-1/rc-4 (ERR-007): every element of the parsed array is untrusted disk
+    // JSON — validate before returning. Malformed items are filtered out and
+    // reported via console.warn (rc-9: no silent drop). This is the single
+    // chokepoint that loadEvolutionQueue callers inherit.
+    const migrated = migrateQueueToV2(rawQueue);
+    return migrated.filter((item) => {
+        const errors = validateQueueItem(item);
+        if (errors.length > 0) {
+            console.warn(`[queue-io] Dropping malformed queue item: ${errors.join(', ')} | id=${item?.id ?? 'N/A'}`);
+            return false;
+        }
+        return true;
+    });
 }
 export function saveEvolutionQueue(queuePath, queue) {
     atomicWriteFileSync(queuePath, JSON.stringify(queue, null, 2));

package/dist/service/queue-migration.d.ts

@@ -81,3 +81,28 @@ export declare function isLegacyQueueItem(item: RawQueueItem): boolean;
  * Returns a new array with all items migrated to V2 format.
  */
 export declare function migrateQueueToV2(queue: RawQueueItem[]): EvolutionQueueItem[];
+/**
+ * Canonical set of valid taskKind values. Single source of truth — mirrors
+ * TaskKind in trajectory-types.ts. Previously the inline validator in
+ * evolution-worker.ts hard-coded `['model_eval']`, which silently rejected
+ * three legitimate taskKind values (pain_diagnosis / sleep_reflection /
+ * keyword_optimization). Keep this in sync with TaskKind.
+ */
+export declare const VALID_TASK_KINDS: readonly TaskKind[];
+/**
+ * Validate a single queue item loaded from untrusted disk JSON.
+ *
+ * Returns an array of human-readable error reasons; an empty array means the
+ * item is valid. Use {@link isValidQueueItem} for a type-guard form.
+ *
+ * This consolidates the inline validation that lived in processEvolutionQueue
+ * (evolution-worker.ts) so every queue load path (loadEvolutionQueue,
+ * registerEvolutionTaskSession) applies the same filter. rc-4 (ERR-007):
+ * array elements from parsed JSON must be element-wise validated.
+ */
+export declare function validateQueueItem(item: unknown): string[];
+/**
+ * Type-guard convenience over {@link validateQueueItem}.
+ * Drops the reason strings (callers that need them should call validateQueueItem).
+ */
+export declare function isValidQueueItem(item: unknown): item is EvolutionQueueItem;

package/dist/service/queue-migration.js

@@ -54,3 +54,60 @@ export function isLegacyQueueItem(item) {
 export function migrateQueueToV2(queue) {
     return queue.map(item => isLegacyQueueItem(item) ? migrateToV2(item) : item);
 }
+// ── Validation (rc-1/rc-2, rc-4: validate array elements from untrusted JSON) ─
+/**
+ * Canonical set of valid taskKind values. Single source of truth — mirrors
+ * TaskKind in trajectory-types.ts. Previously the inline validator in
+ * evolution-worker.ts hard-coded `['model_eval']`, which silently rejected
+ * three legitimate taskKind values (pain_diagnosis / sleep_reflection /
+ * keyword_optimization). Keep this in sync with TaskKind.
+ */
+export const VALID_TASK_KINDS = [
+    'pain_diagnosis',
+    'sleep_reflection',
+    'model_eval',
+    'keyword_optimization',
+];
+/**
+ * Validate a single queue item loaded from untrusted disk JSON.
+ *
+ * Returns an array of human-readable error reasons; an empty array means the
+ * item is valid. Use {@link isValidQueueItem} for a type-guard form.
+ *
+ * This consolidates the inline validation that lived in processEvolutionQueue
+ * (evolution-worker.ts) so every queue load path (loadEvolutionQueue,
+ * registerEvolutionTaskSession) applies the same filter. rc-4 (ERR-007):
+ * array elements from parsed JSON must be element-wise validated.
+ */
+export function validateQueueItem(item) {
+    const errors = [];
+    if (item === null || typeof item !== 'object' || Array.isArray(item)) {
+        return ['item is not an object'];
+    }
+    const it = item;
+    if (!it.id || typeof it.id !== 'string')
+        errors.push('missing/invalid id');
+    if (!it.source || typeof it.source !== 'string')
+        errors.push('missing/invalid source');
+    if (typeof it.score !== 'number')
+        errors.push('missing/invalid score');
+    if (!it.status || typeof it.status !== 'string')
+        errors.push('missing/invalid status');
+    if (!it.taskKind || typeof it.taskKind !== 'string')
+        errors.push('missing/invalid taskKind');
+    else if (!VALID_TASK_KINDS.includes(it.taskKind)) {
+        errors.push(`invalid taskKind value '${it.taskKind}' (expected one of: ${VALID_TASK_KINDS.join(', ')})`);
+    }
+    if (typeof it.retryCount !== 'number')
+        errors.push('missing/invalid retryCount');
+    if (typeof it.maxRetries !== 'number')
+        errors.push('missing/invalid maxRetries');
+    return errors;
+}
+/**
+ * Type-guard convenience over {@link validateQueueItem}.
+ * Drops the reason strings (callers that need them should call validateQueueItem).
+ */
+export function isValidQueueItem(item) {
+    return validateQueueItem(item).length === 0;
+}

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "principles-disciple",
   "name": "Principles Disciple",
   "description": "Evolutionary programming agent framework with strategic guardrails and reflection loops.",
-  "version": "1.183.0",
+  "version": "1.184.0",
   "activation": {
     "onCapabilities": [
       "hook"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "principles-disciple",
-  "version": "1.183.0",
+  "version": "1.184.0",
   "description": "Native OpenClaw plugin for Principles Disciple",
   "type": "module",
   "main": "./dist/index.js",