@deksden-com/dd-console 0.0.0-stage → 0.2.0

package/dist/reader-pool.js

@@ -0,0 +1,73 @@
+import { randomBytes } from "node:crypto";
+import { Worker } from "node:worker_threads";
+/** Keeps SQLite and large JSON parsing away from the loopback HTTP event loop. */
+export class ReaderPool {
+    workers;
+    maxQueue;
+    deadlineMs;
+    #slots = [];
+    #queue = [];
+    #nextId = 1;
+    #closed = false;
+    #journalSecret = randomBytes(32);
+    constructor(workers = 2, maxQueue = 32, deadlineMs = 2_000) {
+        this.workers = workers;
+        this.maxQueue = maxQueue;
+        this.deadlineMs = deadlineMs;
+        for (let index = 0; index < workers; index += 1)
+            this.#slots.push(this.spawn());
+    }
+    run(operation, ...args) {
+        if (this.#closed)
+            return Promise.reject(new Error("Reader pool закрыт."));
+        if (this.#queue.length >= this.maxQueue && !this.#slots.some(slot => !slot.job))
+            return Promise.reject(Object.assign(new Error("Очередь локального чтения занята."), { code: "reader_queue_busy" }));
+        return new Promise((resolve, reject) => { this.#queue.push({ id: this.#nextId++, operation, args, resolve: value => resolve(value), reject }); this.dispatch(); });
+    }
+    async close() { this.#closed = true; for (const slot of this.#slots)
+        if (slot.job) {
+            clearTimeout(slot.job.timer);
+            slot.job.reject(new Error("Сервер остановлен."));
+            slot.job = undefined;
+        } await Promise.all(this.#slots.map(slot => slot.worker.terminate())); this.#slots = []; for (const job of this.#queue.splice(0))
+        job.reject(new Error("Сервер остановлен.")); }
+    spawn() {
+        const workerFile = new URL("./reader-worker.js", import.meta.url), inheritedInputType = process.execArgv.some(arg => arg.startsWith("--input-type"));
+        const slot = { worker: inheritedInputType ? new Worker(workerFile, { workerData: { journalSecret: this.#journalSecret }, execArgv: process.execArgv.filter(arg => !arg.startsWith("--input-type")) }) : new Worker(workerFile, { workerData: { journalSecret: this.#journalSecret } }) };
+        slot.worker.on("message", message => { const job = slot.job; if (!job || job.id !== message.id)
+            return; clearTimeout(job.timer); slot.job = undefined; message.error ? job.reject(Object.assign(new Error(message.error), { code: message.code })) : job.resolve(message.value); this.dispatch(); });
+        slot.worker.on("error", error => { if (slot.job) {
+            clearTimeout(slot.job.timer);
+            slot.job.reject(error);
+            slot.job = undefined;
+        } if (!this.#closed)
+            this.replace(slot); });
+        slot.worker.on("exit", code => { if (code !== 0 && !this.#closed)
+            this.replace(slot); });
+        return slot;
+    }
+    dispatch() {
+        for (const slot of this.#slots) {
+            if (slot.job)
+                continue;
+            const job = this.#queue.shift();
+            if (!job)
+                return;
+            slot.job = job;
+            job.timer = setTimeout(() => { if (slot.job !== job)
+                return; slot.job = undefined; job.reject(Object.assign(new Error("Локальное чтение превысило дедлайн."), { code: "reader_deadline" })); void slot.worker.terminate(); this.replace(slot); this.dispatch(); }, this.deadlineMs);
+            slot.worker.postMessage({ id: job.id, operation: job.operation, args: job.args });
+        }
+    }
+    replace(slot) {
+        const index = this.#slots.indexOf(slot);
+        if (index < 0)
+            return;
+        if (slot.job) {
+            clearTimeout(slot.job.timer);
+            slot.job.reject(new Error("Reader worker завершился."));
+        }
+        this.#slots[index] = this.spawn();
+        this.dispatch();
+    }
+}

package/dist/reader-worker.js

@@ -0,0 +1,21 @@
+import { parentPort } from "node:worker_threads";
+import * as readers from "./readers.js";
+const port = parentPort;
+if (!port)
+    throw new Error("reader worker requires a parent port");
+const operations = {
+    flowRuns: readers.flowRuns, flowDetail: readers.flowDetail, flowStageAttempt: readers.flowStageAttempt,
+    flowEvents: readers.flowEvents, flowArtifact: readers.flowArtifact, flowSessionWorks: readers.flowSessionWorks,
+    evalFlowRuns: readers.evalFlowRuns, evalRuns: readers.evalRuns, evalDetail: readers.evalDetail, evalExecutionDetail: readers.evalExecutionDetail, evalEvents: readers.evalEvents,
+};
+port.on("message", async ({ id, operation, args }) => {
+    try {
+        if (!operations[operation])
+            throw new Error("unsupported reader operation");
+        const value = await operations[operation](...args);
+        port.postMessage({ id, value });
+    }
+    catch (error) {
+        port.postMessage({ id, error: error instanceof Error ? error.message : String(error), code: error.code });
+    }
+});

package/dist/readers.js

@@ -0,0 +1,364 @@
+import { DatabaseSync } from "node:sqlite";
+import { readdir, stat } from "node:fs/promises";
+import path from "node:path";
+import { asArray, inside, realpathInside, safeJson, string } from "./util.js";
+import { journalPage } from "./journal.js";
+import { openWithin, readTextWithin } from "./safe-files.js";
+const diagnostic = (code, message, severity = "warning") => ({ code, message, severity });
+// Short read transactions include committed WAL and keep all detail queries at
+// one SQLite revision. Never immutable on a live store; never invoke migrations.
+export const openDb = (file) => {
+    const db = new DatabaseSync(file, { readOnly: true, timeout: 250 });
+    try {
+        db.exec("PRAGMA query_only=ON; BEGIN");
+    }
+    catch (error) {
+        db.close();
+        throw error;
+    }
+    return db;
+};
+const rows = (db, sql, values = []) => db.prepare(sql).all(...values);
+const row = (db, sql, values = []) => db.prepare(sql).get(...values);
+const exists = async (file) => stat(file).then(() => true).catch(() => false);
+const projectedUsage = (value) => { const usage = value, number = (name) => typeof usage?.[name] === "number" ? usage[name] : null; return ["measured", "partial", "unavailable"].includes(String(usage?.status)) ? { status: usage.status, input_tokens: number("input_tokens"), cached_input_tokens: number("cached_input_tokens"), output_tokens: number("output_tokens"), total_tokens: number("total_tokens"), session_count: typeof usage?.session_count === "number" ? usage.session_count : 0 } : undefined; };
+const stageAttempts = (index) => asArray(index.stage_runs).flatMap(item => { const stage = item, name = string(stage.stage), attempt = string(stage.attempt), started_at = string(stage.started_at), completed_at = string(stage.completed_at), elapsed = Date.parse(completed_at ?? "") - Date.parse(started_at ?? ""); return name && attempt ? [{ stage: name, attempt, order: typeof stage.order === "number" ? stage.order : undefined, status: string(stage.status), started_at, updated_at: string(stage.updated_at), completed_at, duration_ms: typeof stage.duration_ms === "number" ? stage.duration_ms : Number.isFinite(elapsed) && elapsed >= 0 ? elapsed : undefined, data_schema_id: string(stage.data_schema_id), usage: projectedUsage(stage.usage) }] : []; });
+const unavailableUsage = () => ({ status: "unavailable", input_tokens: null, cached_input_tokens: null, output_tokens: null, total_tokens: null, session_count: 0 });
+const usageColumns = (db) => rows(db, "PRAGMA table_info(usage)").map(item => item.name);
+const usageRows = (db, projectId, runId) => {
+    if (!row(db, "SELECT 1 FROM sqlite_schema WHERE type='table' AND name='usage'") || !["project_id", "run_id", "session_id", "stage", "stage_attempt", "total_tokens", "input_tokens", "output_tokens", "extraction_status", "turn_attribution"].every(name => usageColumns(db).includes(name)))
+        return [];
+    const cached = usageColumns(db).includes("cache_read_input_tokens") ? "cache_read_input_tokens" : usageColumns(db).includes("cached_input_tokens") ? "cached_input_tokens" : "NULL";
+    return rows(db, `SELECT session_id, stage, stage_attempt, total_tokens, input_tokens, ${cached} AS cached_input_tokens, output_tokens, extraction_status, turn_attribution FROM usage WHERE project_id = ?${runId ? " AND run_id = ?" : ""}`, runId ? [projectId, runId] : [projectId]);
+};
+const usageSummary = (items) => {
+    const measured = items.filter(item => item.turn_attribution === "windowed_work_session" && item.extraction_status === "measured");
+    if (!measured.length)
+        return unavailableUsage();
+    const sum = (key) => measured.some(item => item[key] === null) ? null : measured.reduce((total, item) => total + item[key], 0);
+    const input_tokens = sum("input_tokens"), cached_input_tokens = sum("cached_input_tokens"), output_tokens = sum("output_tokens"), total_tokens = sum("total_tokens");
+    return { status: [input_tokens, cached_input_tokens, output_tokens, total_tokens].every(value => value !== null) ? "measured" : "partial", input_tokens, cached_input_tokens, output_tokens, total_tokens, session_count: new Set(measured.map(item => item.session_id)).size };
+};
+const mergeUsage = (items) => {
+    const present = items.filter(item => item.status !== "unavailable");
+    if (!present.length)
+        return unavailableUsage();
+    const sum = (key) => present.some(item => item[key] === null) ? null : present.reduce((total, item) => total + item[key], 0);
+    const input_tokens = sum("input_tokens"), cached_input_tokens = sum("cached_input_tokens"), output_tokens = sum("output_tokens"), total_tokens = sum("total_tokens");
+    return { status: present.some(item => item.status === "partial") || [input_tokens, cached_input_tokens, output_tokens, total_tokens].some(value => value === null) ? "partial" : "measured", input_tokens, cached_input_tokens, output_tokens, total_tokens, session_count: present.reduce((total, item) => total + item.session_count, 0) };
+};
+async function dbPath(source) {
+    const file = path.join(source.root, "db.sqlite");
+    try {
+        const handle = await openWithin(source.boundary_root ?? source.root, file);
+        handle.close();
+        return file;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return file;
+        throw error;
+    }
+}
+export async function flowRuns(source) {
+    let db;
+    try {
+        const file = await dbPath(source);
+        if (!(await exists(file)))
+            return { runs: [], usage: unavailableUsage(), diagnostics: [diagnostic("flow_store_missing", "Хранилище dd-flow не найдено.", "error")] };
+        db = openDb(file);
+        const tables = rows(db, "SELECT name FROM sqlite_schema WHERE type = 'table' AND name = 'runs'");
+        if (!tables.length)
+            return { runs: [], usage: unavailableUsage(), diagnostics: [diagnostic("flow_store_unsupported", "Хранилище dd-flow не содержит таблицу runs.", "error")] };
+        const list = rows(db, "SELECT id, short_id, project_id, flow_kind, status, verdict, next_action, created_at, updated_at, completed_at, index_json FROM runs ORDER BY updated_at DESC, id DESC");
+        const selected = list.filter(item => !source.allowed_run_id || item.id === source.allowed_run_id);
+        const usage = mergeUsage(selected.map(item => usageSummary(usageRows(db, item.project_id, item.id).filter(entry => entry.stage === null))));
+        return { runs: selected.map(item => {
+                const index = safeJson(item.index_json, {});
+                const stages = asArray(index.stage_runs);
+                const active = stages.find(value => typeof value === "object" && value !== null && value.status === "running");
+                return { origin: "standalone", source_label: source.label, source_id: source.id, project_id: item.project_id, run_id: item.id, short_id: item.short_id, flow_kind: item.flow_kind, status: item.status, verdict: item.verdict, stage: string(active?.stage) ?? string(index.current_stage) ?? null, next_action: item.next_action, created_at: item.created_at, updated_at: item.updated_at, completed_at: item.completed_at };
+            }), usage, diagnostics: [] };
+    }
+    catch (error) {
+        return { runs: [], usage: unavailableUsage(), diagnostics: [diagnostic(error instanceof Error && /no such (column|table)/.test(error.message) ? "flow_store_unsupported" : "flow_read_failed", "Хранилище Flow недоступно или имеет несовместимую схему.", "error")] };
+    }
+    finally {
+        db?.close();
+    }
+}
+export async function flowDetail(source, projectId, runId) {
+    if (source.allowed_run_id && source.allowed_run_id !== runId)
+        return null;
+    let db;
+    try {
+        const file = await dbPath(source);
+        if (!(await exists(file)))
+            return null;
+        db = openDb(file);
+        const run = row(db, "SELECT id, short_id, project_id, flow_kind, status, verdict, next_action, created_at, updated_at, completed_at, index_json FROM runs WHERE project_id = ? AND id = ?", [projectId, runId]);
+        if (!run)
+            return null;
+        const index = safeJson(run.index_json, {});
+        const works = rows(db, "SELECT work_id, parent_work_id, task, status, depends_on_json, created_at, started_at, completed_at, result FROM works WHERE project_id = ? AND run_id = ? ORDER BY created_at, work_id", [projectId, runId]).map(item => ({ id: item.work_id, parent_id: item.parent_work_id, task: item.task, status: item.status, dependencies: safeJson(item.depends_on_json, []), created_at: item.created_at, started_at: item.started_at, completed_at: item.completed_at, result: item.result }));
+        const sessions = rows(db, "SELECT session_id, status, harness, role, model, current_stage, updated_at FROM sessions WHERE project_id = ? AND run_id = ? ORDER BY updated_at DESC", [projectId, runId]).map(item => ({ id: item.session_id, status: item.status, harness: item.harness, role: item.role, model: item.model, stage: item.current_stage, updated_at: item.updated_at }));
+        const checks = rows(db, "SELECT id, status, command, work_id, started_at, finished_at, exit_code FROM check_receipts WHERE project_id = ? AND run_id = ? ORDER BY finished_at DESC", [projectId, runId]);
+        if (row(db, "SELECT 1 FROM sqlite_schema WHERE type='table' AND name='work_sessions'")) {
+            const links = rows(db, "SELECT DISTINCT ws.work_id, ws.session_id FROM work_sessions ws JOIN works w ON w.work_id=ws.work_id JOIN sessions s ON s.session_id=ws.session_id AND s.project_id=w.project_id AND s.run_id=w.run_id WHERE w.project_id=? AND w.run_id=?", [projectId, runId]);
+            for (const work of works)
+                work.session_ids = links.filter(link => link.work_id === work.id).map(link => link.session_id);
+            for (const session of sessions)
+                session.work_ids = links.filter(link => link.session_id === session.id).map(link => link.work_id);
+        }
+        const stages = stageAttempts(index), usage = usageRows(db, projectId, runId), runUsage = usageSummary(usage.filter(item => item.stage === null));
+        for (const session of sessions)
+            session.usage = usageSummary(usage.filter(item => item.stage === null && item.session_id === session.id));
+        for (const stage of stages)
+            stage.usage ??= usageSummary(usage.filter(item => item.stage === stage.stage && item.stage_attempt === stage.attempt));
+        const linkColumns = rows(db, "PRAGMA table_info(work_sessions)").map(item => item.name);
+        if (linkColumns.includes("prompt_path") && linkColumns.includes("result_path")) {
+            const runPath = row(db, "SELECT run_dir FROM runs WHERE project_id=? AND id=?", [projectId, runId]);
+            const bindings = rows(db, "SELECT ws.work_id, ws.prompt_path, ws.result_path FROM work_sessions ws JOIN works w ON w.work_id=ws.work_id WHERE w.project_id=? AND w.run_id=?", [projectId, runId]);
+            for (const stage of stages) {
+                const entry = asArray(index.stage_runs).find(item => item?.stage === stage.stage && item?.attempt === stage.attempt);
+                const directory = runPath && string(entry?.dir) ? path.resolve(runPath.run_dir, string(entry?.dir)) : null;
+                stage.work_ids = directory && inside(runPath.run_dir, directory) ? [...new Set(bindings.filter(binding => [binding.prompt_path, binding.result_path].some(file => file && inside(directory, file))).map(binding => binding.work_id))] : [];
+                stage.check_ids = checks.filter(check => check.work_id && stage.work_ids.includes(check.work_id)).map(check => check.id);
+                for (const work of works.filter(work => stage.work_ids.includes(work.id)))
+                    (work.attempts ??= []).push({ stage: stage.stage, attempt: stage.attempt });
+            }
+        }
+        return { source_id: source.id, project_id: run.project_id, run_id: run.id, short_id: run.short_id, flow_kind: run.flow_kind, status: run.status, verdict: run.verdict, stage: string(index.current_stage) ?? null, next_action: run.next_action, created_at: run.created_at, updated_at: run.updated_at, completed_at: run.completed_at, usage: runUsage, stages, works, sessions, checks, diagnostics: [] };
+    }
+    catch (error) {
+        return { source_id: source.id, project_id: projectId, run_id: runId, status: "unknown", usage: unavailableUsage(), stages: [], works: [], sessions: [], checks: [], diagnostics: [diagnostic("flow_detail_failed", "Не удалось прочитать детали Flow.", "error")] };
+    }
+    finally {
+        db?.close();
+    }
+}
+export async function flowStageAttempt(source, projectId, runId, stage, attempt) { const detail = await flowDetail(source, projectId, runId); return detail?.stages.find(item => item.stage === stage && item.attempt === attempt) ?? null; }
+export async function flowEvents(source, projectId, runId, limit = 50, cursor) {
+    const file = await dbPath(source);
+    const db = openDb(file);
+    let run;
+    try {
+        run = row(db, "SELECT run_dir FROM runs WHERE project_id = ? AND id = ?", [projectId, runId]);
+    }
+    finally {
+        db.close();
+    }
+    if (!run)
+        return null;
+    return journalPage(source.boundary_root ?? source.root, path.join(run.run_dir, "timeline.jsonl"), JSON.stringify([source.id, projectId, runId]), limit, cursor);
+}
+export async function evalEvents(source, evalId, limit = 50, cursor) {
+    const directory = await evalDirectory(source, evalId);
+    return journalPage(source.boundary_root ?? source.root, path.join(directory ?? source.root, "events.jsonl"), JSON.stringify([source.id, evalId]), limit, cursor);
+}
+export async function flowArtifact(source, projectId, runId, checkId, part = "receipt") {
+    const file = await dbPath(source);
+    if (!(await exists(file)))
+        return null;
+    const db = openDb(file);
+    try {
+        const run = row(db, "SELECT run_dir FROM runs WHERE project_id = ? AND id = ?", [projectId, runId]);
+        const check = row(db, "SELECT id, stdout_path, stderr_path, receipt_path FROM check_receipts WHERE project_id = ? AND run_id = ? AND id = ?", [projectId, runId, checkId]);
+        if (!run || !check)
+            return null;
+        const choices = { receipt: check.receipt_path, stdout: check.stdout_path, stderr: check.stderr_path };
+        const candidate = choices[part];
+        if (!candidate || !inside(run.run_dir, candidate))
+            return null;
+        const handle = await openWithin(source.boundary_root ?? source.root, candidate);
+        try {
+            return { id: check.id, part, name: path.basename(candidate), file: candidate, bytes: handle.stat().size };
+        }
+        finally {
+            handle.close();
+        }
+    }
+    catch {
+        return null;
+    }
+    finally {
+        db.close();
+    }
+}
+export async function flowSessionWorks(source, projectId, runId, sessionId) {
+    const file = await dbPath(source);
+    if (!(await exists(file)))
+        return [];
+    let db;
+    try {
+        db = openDb(file);
+        return rows(db, "SELECT w.work_id, w.parent_work_id, w.task, w.status, w.depends_on_json, w.created_at, w.started_at, w.completed_at, w.result FROM works w JOIN work_sessions ws ON ws.work_id = w.work_id WHERE w.project_id = ? AND w.run_id = ? AND ws.session_id = ? ORDER BY w.created_at", [projectId, runId, sessionId]).map(item => ({ id: item.work_id, parent_id: item.parent_work_id, task: item.task, status: item.status, dependencies: safeJson(item.depends_on_json, []), created_at: item.created_at, started_at: item.started_at, completed_at: item.completed_at, result: item.result }));
+    }
+    catch {
+        return [];
+    }
+    finally {
+        db?.close();
+    }
+}
+// Eval has two producer-owned, direct-child namespaces: ordinary runs and
+// derived forks. Do not recurse into either namespace.
+async function runDirectories(root) {
+    const directories = [];
+    for (const namespace of ["runs", "forks"]) {
+        const parent = path.join(root, namespace);
+        try {
+            directories.push(...(await readdir(parent, { withFileTypes: true })).filter(item => item.isDirectory()).map(item => path.join(parent, item.name)));
+        }
+        catch { /* absent namespace */ }
+    }
+    return directories;
+}
+async function evalDirectory(source, evalId) {
+    if (!evalId || path.basename(evalId) !== evalId || [".", ".."].includes(evalId))
+        return null;
+    for (const directory of await runDirectories(source.root)) {
+        if (!(await realpathInside(source.root, directory)))
+            continue;
+        const manifest = await readJsonIf(path.join(directory, "manifest.json"), source.root);
+        if ((string(manifest?.run_id) ?? path.basename(directory)) === evalId)
+            return directory;
+    }
+    return null;
+}
+function derivedFrom(manifest) {
+    const source = manifest.derived_from;
+    if (!source)
+        return undefined;
+    const parent = string(source.source_eval);
+    return { eval_id: parent ? path.basename(parent) : undefined, execution_id: string(source.source_execution), stage: string(asArray(manifest.executions)[0]?.stage), checkpoint_sha256: string(source.checkpoint_sha256) };
+}
+export async function evalRuns(source) {
+    if (!(await exists(path.join(source.root, "runs"))) && !(await exists(path.join(source.root, "forks"))))
+        return { evals: [], diagnostics: [diagnostic("eval_store_missing", "Каталог запусков Eval отсутствует.", "error")] };
+    const dirs = await runDirectories(source.root);
+    const evals = [];
+    const diagnostics = [];
+    for (const dir of dirs) {
+        try {
+            const manifest = safeJson(await readTextWithin(source.root, path.join(dir, "manifest.json")), {});
+            const evalId = string(manifest.run_id) ?? path.basename(dir);
+            const executions = asArray(manifest.executions);
+            const report = await readJsonIf(path.join(dir, "reports", "report.json"), source.root);
+            const observation = await evalObservation(dir, source.root, evalId);
+            evals.push({ source_id: source.id, eval_id: evalId, case_id: string(manifest.case_id), kind: string(manifest.kind), derived_from: derivedFrom(manifest), status: string(observation?.state) ?? string(report?.state) ?? (executions.length ? "unknown" : "planned"), created_at: string(manifest.created_at), updated_at: string(observation?.observed_at) ?? (await stat(path.join(dir, "manifest.json"))).mtime.toISOString(), checkpoint: string(manifest.input_checkpoint?.id), execution_count: executions.length });
+        }
+        catch {
+            diagnostics.push(diagnostic("eval_manifest_invalid", `Не удалось прочитать ${path.basename(dir)}.`, "warning"));
+        }
+    }
+    return { evals: evals.sort((a, b) => (b.updated_at ?? "").localeCompare(a.updated_at ?? "")), diagnostics };
+}
+async function readJsonIf(file, root) {
+    try {
+        const value = JSON.parse(await readTextWithin(root, file));
+        return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function candidateSummary(value) {
+    if (!value)
+        return null;
+    return { outcome: string(value.outcome), frozen_at: string(value.frozen_at), immutable_hash: string(value.immutable_hash), executions: asArray(value.executions).map(item => { const execution = item, failure = execution.failure, recovery = execution.recovery; return { id: string(execution.execution) ?? "unknown", stage: string(execution.stage), outcome: string(execution.outcome), evidence_completeness: string(execution.evidence_completeness), failure_code: string(failure?.code), recovery_id: string(recovery?.recovery_id) }; }) };
+}
+function reportSummary(value) { return value ? { state: string(value.state), run_validity: string(value.run_validity), reliability: string(value.reliability), recovery_count: typeof value.recovery_count === "number" ? value.recovery_count : undefined, execution_count: asArray(value.execution_history).length } : null; }
+async function evalObservation(dir, root, evalId) { const value = await readJsonIf(path.join(dir, "observation.json"), root); return value?.schema_id === "dd-eval/observation@1" && value.run_id === evalId && Number.isSafeInteger(value.last_sequence) && typeof value.state === "string" && typeof value.observed_at === "string" && Number.isFinite(Date.parse(value.observed_at)) ? value : null; }
+export async function evalDetail(source, evalId) {
+    const dir = await evalDirectory(source, evalId);
+    if (!dir || !(await realpathInside(dir, path.join(dir, "manifest.json"))) || !(await exists(path.join(dir, "manifest.json"))))
+        return null;
+    const manifest = safeJson(await readTextWithin(source.root, path.join(dir, "manifest.json")), {});
+    const observation = await evalObservation(dir, source.root, evalId);
+    const observedExecutions = new Map(asArray(observation?.executions).flatMap(item => { const record = item, executionId = string(record.id), state = string(record.state); return executionId && state ? [[executionId, state]] : []; }));
+    const executions = [];
+    const journalResult = await evalEvents(source, evalId, 10);
+    const journal = journalResult.items;
+    for (const raw of asArray(manifest.executions)) {
+        const item = raw, execId = string(item.id) ?? "unknown", executionsRoot = path.join(dir, "executions"), executionRoot = path.join(executionsRoot, execId);
+        const managed = inside(executionsRoot, executionRoot) && await realpathInside(dir, executionRoot) ? await readJsonIf(path.join(executionRoot, "managed-runtime.json"), source.root) : null;
+        let flow = null;
+        if (managed?.schema_id === "dd-eval/managed-runtime@1" && string(managed.run_id) && string(managed.runtime_root) && string(managed.project_root)) {
+            const runtimeRoot = string(managed.runtime_root);
+            const projectRoot = string(managed.project_root);
+            if (await realpathInside(executionRoot, runtimeRoot) && await realpathInside(executionRoot, projectRoot)) {
+                const derived = { id: derivedSourceId(source.id, evalId, execId), kind: "flow", root: runtimeRoot, boundary_root: source.root, allowed_run_id: string(managed.run_id), label: `${evalId}/${execId}`, created_at: "" };
+                const run = (await flowRuns(derived)).runs.find(value => value.run_id === string(managed.run_id));
+                if (run)
+                    flow = { source_id: derived.id, project_id: run.project_id, run_id: run.run_id };
+            }
+        }
+        executions.push({ id: execId, state: observedExecutions.get(execId) ?? string(item.state) ?? "unknown", configured_model: string(item.profile?.model), flow });
+    }
+    const report = await readJsonIf(path.join(dir, "reports", "report.json"), source.root);
+    const candidate = await readJsonIf(path.join(dir, "candidate.json"), source.root);
+    const definition = manifest.definition, profile = manifest.profile, judge = profile?.judge;
+    return { source_id: source.id, eval_id: string(manifest.run_id) ?? evalId, case_id: string(manifest.case_id), kind: string(manifest.kind), derived_from: derivedFrom(manifest), status: string(observation?.state) ?? string(report?.state) ?? "unknown", created_at: string(manifest.created_at), updated_at: string(observation?.observed_at) ?? (await stat(path.join(dir, "manifest.json"))).mtime.toISOString(), checkpoint: string(manifest.input_checkpoint?.id), execution_count: executions.length, manifest: { kind: string(manifest.kind), definition_commit: string(definition?.commit), profile_id: string(profile?.id), judge_enabled: typeof judge?.enabled === "boolean" ? judge.enabled : undefined }, executions, events: journal, candidate: candidateSummary(candidate), report: reportSummary(report), diagnostics: [...journalResult.diagnostics, ...(observation ? [] : [diagnostic("eval_observation_partial", "У исторического Eval нет сохранённой observation-проекции; показаны доступные факты журнала.", "info")])] };
+}
+export async function evalExecutionDetail(source, evalId, executionId) {
+    const detail = await evalDetail(source, evalId), execution = detail?.executions.find(item => item.id === executionId);
+    if (!detail || !execution)
+        return null;
+    const candidate = detail.candidate?.executions.find(item => item.id === executionId) ?? null;
+    return { observed_at: detail.observed_at, execution, candidate, events: detail.events.filter(event => event.execution_id === executionId), diagnostics: detail.diagnostics };
+}
+export const derivedSourceId = (sourceId, evalId, executionId) => `drv.${Buffer.from(JSON.stringify([sourceId, evalId, executionId])).toString("base64url")}`;
+export async function derivedSource(source, evalId, executionId, knownEvalRoot) {
+    if (typeof evalId !== "string" || typeof executionId !== "string" || !evalId || !executionId || path.basename(evalId) !== evalId || path.basename(executionId) !== executionId || [".", ".."].includes(evalId) || [".", ".."].includes(executionId))
+        return null;
+    const evalRoot = knownEvalRoot ?? await evalDirectory(source, evalId);
+    if (!evalRoot || !(await realpathInside(source.root, evalRoot)))
+        return null;
+    const manifest = await readJsonIf(path.join(evalRoot, "manifest.json"), source.root);
+    if ((string(manifest?.run_id) ?? path.basename(evalRoot)) !== evalId)
+        return null;
+    if (!asArray(manifest?.executions).some(item => item && typeof item === "object" && item.id === executionId))
+        return null;
+    const executionsRoot = path.join(evalRoot, "executions"), root = path.join(executionsRoot, executionId);
+    if (!inside(executionsRoot, root) || !(await realpathInside(evalRoot, root)) || !(await realpathInside(executionsRoot, root)))
+        return null;
+    const managed = await readJsonIf(path.join(root, "managed-runtime.json"), source.root);
+    const runtime = string(managed?.runtime_root);
+    const project = string(managed?.project_root);
+    const run = string(managed?.run_id);
+    if (managed?.schema_id !== "dd-eval/managed-runtime@1" || !runtime || !project || !run || !(await realpathInside(root, runtime)) || !(await realpathInside(root, project)))
+        return null;
+    return { id: derivedSourceId(source.id, evalId, executionId), kind: "flow", root: runtime, boundary_root: source.root, allowed_run_id: run, label: `${evalId}/${executionId}`, created_at: "" };
+}
+// Only manifest-declared executions with validated managed-runtime boundaries
+// contribute Flow runs. Never discover arbitrary databases below the Eval home.
+export async function evalFlowRuns(source) {
+    const runs = [], diagnostics = [];
+    const usages = [];
+    let unavailable = 0;
+    for (const dir of await runDirectories(source.root)) {
+        const manifest = await readJsonIf(path.join(dir, "manifest.json"), source.root);
+        if (!manifest)
+            continue;
+        const evalId = string(manifest.run_id) ?? path.basename(dir);
+        for (const raw of asArray(manifest.executions)) {
+            const executionId = raw && typeof raw === "object" ? string(raw.id) : undefined;
+            if (!executionId)
+                continue;
+            const derived = await derivedSource(source, evalId, executionId, dir);
+            if (!derived) {
+                if (await readJsonIf(path.join(dir, "executions", executionId, "managed-runtime.json"), source.root))
+                    unavailable++;
+                continue;
+            }
+            const result = await flowRuns(derived);
+            runs.push(...result.runs.map(run => ({ ...run, origin: "eval", source_label: source.label, eval_source_id: source.id, eval_id: evalId, execution_id: executionId })));
+            usages.push(result.usage);
+            diagnostics.push(...result.diagnostics.map(item => ({ ...item, message: `${evalId}/${executionId}: ${item.message}` })));
+        }
+    }
+    if (unavailable)
+        diagnostics.push(diagnostic("eval_flow_unavailable", `Связанные Flow недоступны у ${unavailable} execution: runtime отсутствует или его связь не прошла проверку.`));
+    return { runs, usage: mergeUsage(usages), diagnostics };
+}

package/dist/safe-files.js

@@ -0,0 +1,80 @@
+import koffi from "koffi";
+import { openSync, closeSync, constants, createReadStream, fstatSync, read as readCallback } from "node:fs";
+import { realpath } from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+import { inside } from "./util.js";
+// Node has no openat API. Walking held directory descriptors prevents a rename
+// or symlink replacement from redirecting a later component outside the root.
+const libc = koffi.load(process.platform === "darwin" ? "/usr/lib/libSystem.B.dylib" : "libc.so.6");
+const openat = libc.func("int openat(int dirfd, const char *pathname, int flags, unsigned int mode)");
+const nativeClose = libc.func("int close(int fd)");
+const read = promisify(readCallback);
+function openComponent(parent, name, directory) {
+    const fd = openat(parent, name, constants.O_RDONLY | (process.platform === "darwin" ? 0x1000000 : 0x80000) | constants.O_NOFOLLOW | constants.O_NONBLOCK | (directory ? constants.O_DIRECTORY : 0), 0);
+    if (fd < 0)
+        throw Object.assign(new Error("Файл отсутствует или находится за границами источника."), { code: koffi.errno() === 2 ? "ENOENT" : "unsafe_path" });
+    return fd;
+}
+export async function openWithin(root, file) {
+    const canonicalRoot = await realpath(root);
+    const resolvedRoot = path.resolve(root);
+    const systemAlias = process.platform === "darwin" && (resolvedRoot.startsWith("/var/") || resolvedRoot.startsWith("/tmp/"));
+    if (canonicalRoot !== resolvedRoot && !systemAlias)
+        throw Object.assign(new Error("Корень источника заменён символической ссылкой."), { code: "unsafe_path" });
+    const candidate = inside(path.resolve(root), path.resolve(file)) ? path.join(canonicalRoot, path.relative(path.resolve(root), path.resolve(file))) : await realpath(file);
+    const relative = path.relative(canonicalRoot, candidate);
+    if (!relative || !inside(canonicalRoot, candidate))
+        throw Object.assign(new Error("Недопустимый путь источника."), { code: "unsafe_path" });
+    const components = [...canonicalRoot.split(path.sep).filter(Boolean), ...relative.split(path.sep)];
+    let fd = openat(process.platform === "darwin" ? -2 : -100, "/", constants.O_RDONLY | constants.O_DIRECTORY | (process.platform === "darwin" ? 0x1000000 : 0x80000), 0);
+    if (fd < 0)
+        throw new Error("Не удалось открыть корень файловой системы.");
+    try {
+        for (let index = 0; index < components.length; index++) {
+            const child = openComponent(fd, components[index], index < components.length - 1);
+            nativeClose(fd);
+            fd = child;
+        }
+        if (!fstatSync(fd).isFile())
+            throw Object.assign(new Error("Источник не является обычным файлом."), { code: "unsafe_path" });
+    }
+    catch (error) {
+        nativeClose(fd);
+        throw error;
+    }
+    // Adopt the pinned file into Node so worker termination also closes it.
+    try {
+        const adopted = openSync(`/dev/fd/${fd}`, constants.O_RDONLY | constants.O_NONBLOCK);
+        nativeClose(fd);
+        fd = adopted;
+    }
+    catch (error) {
+        nativeClose(fd);
+        throw error;
+    }
+    let closed = false;
+    return {
+        fd,
+        stat: () => fstatSync(fd),
+        read: (buffer, position) => read(fd, buffer, 0, buffer.length, position),
+        close: () => { if (!closed) {
+            closed = true;
+            closeSync(fd);
+        } },
+        stream: () => { closed = true; return createReadStream("", { fd, autoClose: true }); },
+    };
+}
+export async function readTextWithin(root, file, maxBytes = 8 * 1024 * 1024) {
+    const handle = await openWithin(root, file);
+    try {
+        const size = handle.stat().size;
+        if (size > maxBytes)
+            throw Object.assign(new Error("JSON превышает допустимый размер."), { code: "file_too_large" });
+        const buffer = Buffer.alloc(size), { bytesRead } = await handle.read(buffer, 0);
+        return buffer.subarray(0, bytesRead).toString("utf8");
+    }
+    finally {
+        handle.close();
+    }
+}