@deksden-com/dd-flow-cli 0.4.0 → 0.4.2

package/dist/services/plans.js

@@ -6,15 +6,17 @@ import { parseJsonObject } from "../shared/json.js";
 import { ensureReadableFile } from "../storage/database.js";
 import { appendAudit } from "./audit.js";
 import { persistProtocolState, readProtocolRuntimeState, requireProtocol } from "./protocols.js";
+import { requireProjectByRoot } from "./projects.js";
+import { resolveProjectRoot } from "../storage/paths.js";
 import { writePlanFile } from "../protocol/local-files.js";
 export function setProtocolPlan(context, input) {
-    const protocol = requireProtocol(context, input.protocolId);
+    const protocol = scopedProtocol(context, input.projectRoot, input.protocolId);
     ensureReadableFile(input.file);
     const plan = validatePlan(parseJsonObject(fs.readFileSync(input.file, "utf8"), input.file), protocol.id);
     writePlanFile(protocol.plan_path, plan);
-    context.db.run(`INSERT INTO plans (protocol_id, plan_json, updated_at)
-     VALUES (?, ?, ?)
-     ON CONFLICT(protocol_id) DO UPDATE SET plan_json = excluded.plan_json, updated_at = excluded.updated_at`, [protocol.id, JSON.stringify(plan), context.now()]);
+    context.db.run(`INSERT INTO plans (project_id, protocol_id, plan_json, updated_at)
+     VALUES (?, ?, ?, ?)
+     ON CONFLICT(project_id, protocol_id) DO UPDATE SET plan_json = excluded.plan_json, updated_at = excluded.updated_at`, [protocol.project_id, protocol.id, JSON.stringify(plan), context.now()]);
     updateStatePlanSummary(context, protocol, plan);
     appendAudit(context, {
         protocolId: protocol.id,
@@ -25,8 +27,8 @@ export function setProtocolPlan(context, input) {
     return { ok: true, protocol_id: protocol.id, plan: summarizePlan(plan) };
 }
 export function getPlanStatus(context, input) {
-    const protocol = requireProtocol(context, input.protocolId);
-    const plan = requireStoredPlan(context, protocol.id);
+    const protocol = scopedProtocol(context, input.projectRoot, input.protocolId);
+    const plan = requireStoredPlan(context, protocol.project_id, protocol.id);
     return {
         ok: true,
         protocol_id: protocol.id,
@@ -43,7 +45,7 @@ export function getPlanStatus(context, input) {
     };
 }
 export function startPlanItem(context, input) {
-    return updatePlanItem(context, input.protocolId, input.itemId, (item, plan) => {
+    return updatePlanItem(context, input.projectRoot, input.protocolId, input.itemId, (item, plan) => {
         assertDependenciesClosed(plan, item);
         return {
             ...item,
@@ -53,7 +55,7 @@ export function startPlanItem(context, input) {
     });
 }
 export function completePlanItem(context, input) {
-    return updatePlanItem(context, input.protocolId, input.itemId, (item, plan) => {
+    return updatePlanItem(context, input.projectRoot, input.protocolId, input.itemId, (item, plan) => {
         assertDependenciesClosed(plan, item);
         return {
             ...item,
@@ -64,7 +66,7 @@ export function completePlanItem(context, input) {
     });
 }
 export function blockPlanItem(context, input) {
-    return updatePlanItem(context, input.protocolId, input.itemId, (item) => ({
+    return updatePlanItem(context, input.projectRoot, input.protocolId, input.itemId, (item) => ({
         ...item,
         status: "blocked",
         summary: input.reason,
@@ -73,15 +75,15 @@ export function blockPlanItem(context, input) {
     }));
 }
 export function skipPlanItem(context, input) {
-    return updatePlanItem(context, input.protocolId, input.itemId, (item) => ({
+    return updatePlanItem(context, input.projectRoot, input.protocolId, input.itemId, (item) => ({
         ...item,
         status: "skipped",
         summary: input.reason
     }));
 }
-function updatePlanItem(context, protocolId, itemId, transform) {
-    const protocol = requireProtocol(context, protocolId);
-    const plan = requireStoredPlan(context, protocol.id);
+function updatePlanItem(context, projectRoot, protocolId, itemId, transform) {
+    const protocol = scopedProtocol(context, projectRoot, protocolId);
+    const plan = requireStoredPlan(context, protocol.project_id, protocol.id);
     const item = plan.items.find((candidate) => candidate.id === itemId);
     if (!item) {
         throw new AppError("not_found", `Plan item is not found: ${itemId}`, 1);
@@ -92,9 +94,10 @@ function updatePlanItem(context, protocolId, itemId, transform) {
     };
     const validated = validatePlan(nextPlan, protocol.id);
     writePlanFile(protocol.plan_path, validated);
-    context.db.run("UPDATE plans SET plan_json = ?, updated_at = ? WHERE protocol_id = ?", [
+    context.db.run("UPDATE plans SET plan_json = ?, updated_at = ? WHERE project_id = ? AND protocol_id = ?", [
         JSON.stringify(validated),
         context.now(),
+        protocol.project_id,
         protocol.id
     ]);
     updateStatePlanSummary(context, protocol, validated);
@@ -111,8 +114,12 @@ function updatePlanItem(context, protocolId, itemId, transform) {
     });
     return { ok: true, protocol_id: protocol.id, item: validated.items.find((candidate) => candidate.id === itemId) };
 }
-function requireStoredPlan(context, protocolId) {
-    const row = context.db.get("SELECT plan_json FROM plans WHERE protocol_id = ?", [protocolId]);
+function scopedProtocol(context, projectRoot, protocolId) {
+    const project = requireProjectByRoot(context, resolveProjectRoot(projectRoot));
+    return requireProtocol(context, protocolId, project.id);
+}
+function requireStoredPlan(context, projectId, protocolId) {
+    const row = context.db.get("SELECT plan_json FROM plans WHERE project_id = ? AND protocol_id = ?", [projectId, protocolId]);
     if (!row) {
         throw new AppError("not_found", `Plan is not attached to protocol: ${protocolId}`, 1);
     }

package/dist/services/projects.js

@@ -91,7 +91,7 @@ export function resolveProject(context, input) {
     }
     const details = { input: input.idOrAlias };
     if (!isFullEntityId(input.idOrAlias) && !isShortEntityId(input.idOrAlias)) {
-        details.expected = "Use full id PRJ-NNN-slug, short alias PRJ-NNN, slug, root path, or --root for root-based commands.";
+        details.expected = "Use full id PRJ-<sequence>-slug, short alias PRJ-<sequence>, slug, root path, or --root for root-based commands.";
     }
     throw new AppError("not_found", `Project is not registered: ${input.idOrAlias}`, 1, details);
 }
@@ -108,7 +108,7 @@ export function requireProjectByReference(context, reference) {
     }
     throw new AppError("not_found", `Project is not registered: ${reference}`, 1, {
         input: reference,
-        expected: "Use full id PRJ-NNN-slug, short alias PRJ-NNN, slug, or project root path."
+        expected: "Use full id PRJ-<sequence>-slug, short alias PRJ-<sequence>, slug, or project root path."
     });
 }
 export function migrateProjectIds(context, input) {

package/dist/services/prompts.js

@@ -0,0 +1,322 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { getCliVersionReport } from "./build-info.js";
+import { requireProjectByRoot } from "./projects.js";
+import { requireProtocol } from "./protocols.js";
+import { validatePlan } from "../domain/validation.js";
+import { AppError } from "../shared/errors.js";
+import { parseJsonObject } from "../shared/json.js";
+import { ensureDir, resolveProjectRoot } from "../storage/paths.js";
+const profiles = {
+    code_implementation: {
+        static_files: [".memory-bank/dd-flow/common/worker-session.md", ".memory-bank/dd-flow/workers/code.md"]
+    },
+    documentation: {
+        static_files: [".memory-bank/dd-flow/common/worker-session.md", ".memory-bank/dd-flow/workers/docs.md"]
+    },
+    verification: {
+        static_files: [".memory-bank/dd-flow/common/worker-session.md", ".memory-bank/dd-flow/workers/verify.md"]
+    }
+};
+export function renderWorkerPrompt(context, input) {
+    const projectRoot = resolveProjectRoot(input.projectRoot);
+    const project = requireProjectByRoot(context, projectRoot);
+    const protocol = requireProtocol(context, protocolIdForRun(context, project.id, input.runId), project.id);
+    const run = requireRun(context, project.id, input.runId);
+    const index = parseRunIndex(run.index_json, run.id);
+    const stage = requireStage(index, input.stage, run.id);
+    const workspaceRoot = resolveWorkspace(input.workspaceRoot ?? run.workspace_root, "workspace-root");
+    const recordedWorkspace = resolveWorkspace(index.execution?.workspace_root ?? run.workspace_root, "run workspace");
+    if (workspaceRoot !== recordedWorkspace) {
+        throw new AppError("prompt_runtime_mismatch", "Workspace root does not match the selected RUN", 1, {
+            expected: recordedWorkspace,
+            actual: workspaceRoot,
+            run_id: run.id
+        });
+    }
+    assertGitFacts(workspaceRoot, index.execution?.git, run.id);
+    const plan = input.taskFile ? null : readPlan(protocol.plan_path, protocol.id);
+    const genericTask = input.taskFile ? readWorkerTask(input.taskFile, runHomePath(run), protocol.id) : null;
+    const item = genericTask?.item ?? plan?.items.find((candidate) => candidate.id === input.planItemId);
+    if (!item)
+        throw new AppError("not_found", `Plan item is not found: ${input.planItemId}`, 1);
+    if (!item.execution_context || !item.semantic_spine) {
+        throw new AppError("prompt_context_missing", "Plan item requires execution_context and semantic_spine before prompt rendering", 1, {
+            plan_item_id: item.id
+        });
+    }
+    if (item.execution_context.prompt_profile !== input.profile) {
+        throw new AppError("prompt_profile_mismatch", "Requested profile does not match plan item execution_context", 1, {
+            requested: input.profile,
+            declared: item.execution_context.prompt_profile,
+            plan_item_id: item.id
+        });
+    }
+    const profile = profiles[input.profile];
+    if (!profile)
+        throw new AppError("prompt_profile_unsupported", `Unsupported prompt profile: ${input.profile}`, 2);
+    const staticInputs = profile.static_files.map((file) => readStaticInput(projectRoot, file));
+    const requiredRead = item.execution_context.required_read.map((file) => checkedReference(projectRoot, runHomePath(run), file, "required_read", true));
+    const discoveryBoundary = item.execution_context.discovery_boundary.map((file) => checkedReference(projectRoot, runHomePath(run), file, "discovery_boundary", false));
+    const writeScope = item.execution_context.write_scope.map((file) => checkedReference(projectRoot, undefined, file, "write_scope", false));
+    const runHome = runHomePath(run);
+    const outputDir = path.join(runHome, stage.dir, "subagents", item.id);
+    assertWithin(runHome, outputDir, "output directory");
+    ensureDir(outputDir);
+    const prompt = renderPrompt({
+        item,
+        input,
+        workspaceRoot,
+        requiredRead,
+        discoveryBoundary,
+        writeScope,
+        outputDir,
+        staticInputs,
+        ...(genericTask ? { handoff: genericTask.handoff } : {})
+    });
+    const promptPath = path.join(outputDir, "launch-prompt.md");
+    const stackPath = path.join(outputDir, "prompt-stack.json");
+    const reportPath = path.join(outputDir, "render-report.json");
+    fs.writeFileSync(promptPath, prompt);
+    writeJson(stackPath, {
+        schema_id: "dd-flow/prompt-stack@1",
+        profile: input.profile,
+        protocol_id: protocol.id,
+        run_id: run.id,
+        plan_id: plan?.plan_id ?? null,
+        plan_item_id: input.taskFile ? null : item.id,
+        task_id: input.taskFile ? item.id : null,
+        canon_version: readCanonVersion(projectRoot),
+        renderer_version: getCliVersionReport().cli.version,
+        static_inputs: staticInputs.map(({ path: inputPath, sha256 }) => ({ path: inputPath, sha256 })),
+        validation: { required_read: requiredRead, discovery_boundary: discoveryBoundary, write_scope: writeScope },
+        ...(genericTask ? { task_handoff: genericTask.handoff } : {})
+    });
+    writeJson(reportPath, {
+        schema_id: "dd-flow/prompt-render-report@1",
+        status: "rendered",
+        profile: input.profile,
+        protocol_id: protocol.id,
+        run_id: run.id,
+        plan_item_id: input.taskFile ? null : item.id,
+        task_id: input.taskFile ? item.id : null,
+        stage: input.stage,
+        workspace_root: workspaceRoot,
+        output: { launch_prompt: promptPath, prompt_stack: stackPath },
+        validation: { required_read: requiredRead, discovery_boundary: discoveryBoundary, write_scope: writeScope },
+        ...(genericTask ? { task_handoff: genericTask.handoff } : {})
+    });
+    return {
+        ok: true,
+        schema_id: "dd-flow/prompt-render@1",
+        prompt: { path: promptPath, stack_path: stackPath, report_path: reportPath },
+        profile: input.profile,
+        plan_item_id: input.taskFile ? null : item.id,
+        task_id: input.taskFile ? item.id : null,
+        run_id: run.id
+    };
+}
+function runHomePath(run) {
+    return run.run_home_path ?? path.dirname(run.run_index_path);
+}
+function readWorkerTask(taskFile, runHome, protocolId) {
+    const resolved = path.resolve(taskFile);
+    assertWithin(runHome, resolved, "worker task file");
+    if (!fs.existsSync(resolved))
+        throw new AppError("not_found", "Worker task file is missing", 1, { path: taskFile });
+    const task = parseJsonObject(fs.readFileSync(resolved, "utf8"), resolved);
+    if (task.schema_id !== "dd-flow/worker-task@1" || !task.task || typeof task.task !== "object") {
+        throw new AppError("validation", "Worker task must use dd-flow/worker-task@1 with a task object", 2, { path: taskFile });
+    }
+    const item = validatePlan({
+        schema_version: "0.1.0",
+        plan_id: "worker-task",
+        protocol_id: protocolId,
+        title: "worker task",
+        items: [{ ...task.task, depends_on: [] }]
+    }, protocolId).items[0];
+    return { item, handoff: validateWorkerTaskHandoff(task.handoff, runHome) };
+}
+function validateWorkerTaskHandoff(value, runHome) {
+    if (value === undefined)
+        return { predecessor_reports: [], recovery_attempt_paths: [] };
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new AppError("validation", "Worker task handoff must be an object", 2);
+    }
+    const handoff = value;
+    const reports = handoff.predecessor_reports ?? [];
+    if (!Array.isArray(reports))
+        throw new AppError("validation", "Worker task predecessor_reports must be an array", 2);
+    const predecessor_reports = reports.map((entry, index) => {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+            throw new AppError("validation", `Worker task predecessor_reports[${index}] must be an object`, 2);
+        }
+        const report = entry;
+        if (typeof report.aspect_id !== "string" || report.aspect_id.length === 0) {
+            throw new AppError("validation", `Worker task predecessor_reports[${index}].aspect_id must be a string`, 2);
+        }
+        if (report.verdict !== "accepted" && report.verdict !== "not_applicable") {
+            throw new AppError("validation", `Worker task predecessor_reports[${index}].verdict must be accepted or not_applicable`, 2);
+        }
+        const verdict = report.verdict === "accepted" ? "accepted" : "not_applicable";
+        if (typeof report.report_path !== "string" || report.report_path.length === 0) {
+            throw new AppError("validation", `Worker task predecessor_reports[${index}].report_path must be a string`, 2);
+        }
+        const reportPath = path.resolve(report.report_path);
+        assertWithin(runHome, reportPath, "predecessor report");
+        if (!fs.existsSync(reportPath))
+            throw new AppError("not_found", "Accepted predecessor report is missing", 1, { path: report.report_path });
+        return { aspect_id: report.aspect_id, verdict, report_path: reportPath };
+    });
+    const recovery = handoff.recovery_attempt_paths ?? [];
+    if (!Array.isArray(recovery) || recovery.some((entry) => typeof entry !== "string" || entry.length === 0)) {
+        throw new AppError("validation", "Worker task recovery_attempt_paths must be a string array", 2);
+    }
+    for (const attemptPath of recovery)
+        assertWithin(runHome, path.resolve(attemptPath), "recovery attempt path");
+    if (handoff.acceptance_owner !== undefined && (typeof handoff.acceptance_owner !== "string" || handoff.acceptance_owner.length === 0)) {
+        throw new AppError("validation", "Worker task acceptance_owner must be a string", 2);
+    }
+    return {
+        predecessor_reports,
+        recovery_attempt_paths: recovery.map((attemptPath) => path.resolve(attemptPath)),
+        ...(typeof handoff.acceptance_owner === "string" ? { acceptance_owner: handoff.acceptance_owner } : {})
+    };
+}
+function protocolIdForRun(context, projectId, runId) {
+    const run = requireRun(context, projectId, runId);
+    const subject = parseJsonObject(run.index_json, `run ${run.id}`).subject;
+    if (subject?.type !== "protocol" || typeof subject.id !== "string") {
+        throw new AppError("prompt_run_subject", "Prompt rendering requires a protocol-owned RUN", 1, { run_id: run.id });
+    }
+    return subject.id;
+}
+function requireRun(context, projectId, runId) {
+    const row = context.db.get("SELECT id, project_id, workspace_root, run_index_path, run_home_path, index_json FROM flow_runs WHERE project_id = ? AND (id = ? OR short_id = ?)", [projectId, runId, runId]);
+    if (!row)
+        throw new AppError("not_found", `Run is not found: ${runId}`, 1);
+    return row;
+}
+function parseRunIndex(text, runId) {
+    return parseJsonObject(text, `run ${runId}`);
+}
+function requireStage(index, stageName, runId) {
+    const stage = index.stage_runs?.find((candidate) => candidate.stage === stageName);
+    if (!stage?.dir || stage.status !== "running") {
+        throw new AppError("prompt_stage_unavailable", "Prompt rendering requires an attached running stage", 1, { run_id: runId, stage: stageName });
+    }
+    return { dir: stage.dir };
+}
+function readPlan(planPath, protocolId) {
+    if (!fs.existsSync(planPath))
+        throw new AppError("not_found", `Protocol plan is missing: ${planPath}`, 1);
+    return validatePlan(parseJsonObject(fs.readFileSync(planPath, "utf8"), planPath), protocolId);
+}
+function readStaticInput(projectRoot, relativePath) {
+    checkedReference(projectRoot, undefined, relativePath, "static profile input", true);
+    const absolute = path.resolve(projectRoot, relativePath);
+    const content = fs.readFileSync(absolute, "utf8");
+    return { path: relativePath, content, sha256: hash(content) };
+}
+function checkedReference(projectRoot, runHome, reference, label, mustExist) {
+    const isRunLocal = reference.startsWith("run://");
+    const relativeReference = isRunLocal ? reference.slice("run://".length) : reference;
+    if (isRunLocal && label !== "required_read" && label !== "discovery_boundary") {
+        throw new AppError("prompt_path_unsafe", `${label} cannot use a RUN-local path`, 2, { path: reference });
+    }
+    if (!relativeReference || path.isAbsolute(relativeReference) || relativeReference.split(/[\\/]/).some((part) => part === ".." || part === ".env" || part.startsWith(".env."))) {
+        throw new AppError("prompt_path_unsafe", `${label} contains an unsafe path`, 2, { path: reference });
+    }
+    const root = isRunLocal ? runHome : projectRoot;
+    if (!root)
+        throw new AppError("prompt_path_unsafe", `${label} cannot resolve a RUN-local path`, 2, { path: reference });
+    const absolute = path.resolve(root, relativeReference);
+    assertWithin(root, absolute, label);
+    if (mustExist && !fs.existsSync(absolute)) {
+        throw new AppError("prompt_source_missing", `${label} does not exist`, 1, { path: reference });
+    }
+    return reference;
+}
+function assertWithin(root, candidate, label) {
+    const relative = path.relative(root, candidate);
+    if (relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative)))
+        return;
+    throw new AppError("prompt_path_unsafe", `${label} must stay within its root`, 2, { root, candidate });
+}
+function resolveWorkspace(value, label) {
+    if (!fs.existsSync(value))
+        throw new AppError("prompt_runtime_mismatch", `${label} does not exist`, 1, { path: value });
+    return fs.realpathSync(value);
+}
+function assertGitFacts(workspaceRoot, expected, runId) {
+    if (!expected?.head && !expected?.branch)
+        return;
+    const read = (args) => {
+        const result = spawnSync("git", ["-C", workspaceRoot, ...args.split(" ")], { encoding: "utf8" });
+        return result.status === 0 ? result.stdout.trim() || null : null;
+    };
+    const actual = { branch: read("branch --show-current"), head: read("rev-parse HEAD") };
+    if (actual.branch !== (expected.branch ?? null) || actual.head !== (expected.head ?? null)) {
+        throw new AppError("prompt_runtime_mismatch", "Git branch or head no longer matches the selected RUN", 1, {
+            run_id: runId,
+            expected,
+            actual
+        });
+    }
+}
+function renderPrompt(input) {
+    const { item, handoff, input: command, staticInputs } = input;
+    return [
+        "# Worker Launch Prompt",
+        "",
+        `Profile: \`${command.profile}\``,
+        `Plan item: \`${item.id}\` - ${item.title}`,
+        `Stage: \`${command.stage}\``,
+        "",
+        "## Task",
+        item.summary,
+        "",
+        "## Semantic Spine",
+        `- User outcome: ${item.semantic_spine?.user_outcome ?? "not_applicable"}`,
+        `- Component responsibility: ${item.semantic_spine?.component_responsibility ?? "not_applicable"}`,
+        `- Must preserve: ${(item.semantic_spine?.must_preserve ?? []).join("; ") || "none"}`,
+        `- Non-goals: ${(item.semantic_spine?.non_goals ?? []).join("; ") || "none"}`,
+        `- Acceptance contribution: ${item.semantic_spine?.acceptance_contribution ?? "not_applicable"}`,
+        "",
+        "## Runtime",
+        `- Workspace: \`${input.workspaceRoot}\``,
+        `- Allowed writes: ${input.writeScope.map((value) => `\`${value}\``).join(", ") || "none"}`,
+        `- Checks: ${(item.execution_context?.checks ?? []).map((value) => `\`${value}\``).join(", ") || "none"}`,
+        `- Report directory: \`${input.outputDir}\``,
+        "",
+        "## Required Reads",
+        ...input.requiredRead.map((value) => `- \`${value}\``),
+        "",
+        ...(handoff && (handoff.predecessor_reports.length > 0 || handoff.acceptance_owner)
+            ? [
+                "## Orchestration Handoff",
+                ...(handoff.acceptance_owner ? [`- Acceptance owner: ${handoff.acceptance_owner}`] : []),
+                ...handoff.predecessor_reports.map((report) => `- ${report.aspect_id} (${report.verdict}): \`${report.report_path}\``),
+                ""
+            ]
+            : []),
+        "## Bounded Discovery",
+        ...input.discoveryBoundary.map((value) => `- \`${value}\``),
+        "",
+        "Read the static instructions below before acting. Report the sources actually read and any additions inside the discovery boundary. If an essential source is outside that boundary, stop with a plan question or DEF rather than expanding scope silently.",
+        "",
+        ...staticInputs.flatMap((entry) => [`## Static Input: ${entry.path}`, "", entry.content.trim(), ""])
+    ].join("\n");
+}
+function hash(value) {
+    return crypto.createHash("sha256").update(value).digest("hex");
+}
+function readCanonVersion(projectRoot) {
+    const versionPath = path.join(projectRoot, "VERSION");
+    return fs.existsSync(versionPath) ? fs.readFileSync(versionPath, "utf8").trim() : null;
+}
+function writeJson(file, value) {
+    fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
+}