@deksden-com/dd-flow-cli 0.4.1 → 0.5.0

package/dist/services/memory-permissions.js

@@ -6,47 +6,55 @@ import { AppError } from "../shared/errors.js";
 const schemaId = "dd-flow/memorybank-permissions-preflight@1";
 const flows = ["mb-init", "mb-upgrade", "mb-audit", "mb-fix", "mb-upgrade-review", "custom"];
 const modes = ["read", "write", "repair", "report_only"];
-const maxScannedFiles = 5000;
 export function preflightMemoryPermissions(options) {
     const flow = requireEnum(options.flow, flows, "--flow");
     const mode = requireEnum(options.mode, modes, "--mode");
     const projectRoot = path.resolve(options.root);
     const memoryBank = resolveInside(projectRoot, options.memoryBank);
     const tasks = options.tasks ? resolveInside(projectRoot, options.tasks) : path.join(projectRoot, ".tasks");
+    if (options.targets && options.targets.length === 0) {
+        throw new AppError("validation", "Exact permission preflight requires at least one target", 2);
+    }
     const checks = [];
     const platform = platformInfo(projectRoot);
     checks.push(checkExistingDirectory("project-root-read", projectRoot, "read_existing_file", fs.constants.R_OK));
-    if (flow === "mb-init" && !fs.existsSync(memoryBank)) {
+    if (options.targets) {
+        for (const [index, target] of options.targets.entries()) {
+            checks.push(...checkTarget(`exact-target-${index + 1}`, resolveInside(projectRoot, target.path), target.mode));
+        }
+    }
+    else if (flow === "mb-init" && !fs.existsSync(memoryBank)) {
         checks.push(checkCreateDirectory("memory-bank-create", memoryBank));
     }
     else {
         checks.push(checkExistingDirectory("memory-bank-read", memoryBank, "read_existing_file", fs.constants.R_OK));
         if (mode !== "read") {
             checks.push(checkExistingDirectory("memory-bank-write", memoryBank, "create_file", fs.constants.W_OK | fs.constants.X_OK));
-            checks.push(...checkWritableTree(memoryBank, "memory-bank-existing-file"));
             checks.push(probeDirectory("memory-bank-probe", memoryBank));
         }
     }
-    if (mode === "write" || mode === "repair" || mode === "report_only") {
-        if (fs.existsSync(tasks)) {
-            checks.push(checkExistingDirectory("tasks-write", tasks, "create_file", fs.constants.W_OK | fs.constants.X_OK));
-            checks.push(probeDirectory("tasks-probe", tasks));
+    if (!options.targets) {
+        if (mode === "write" || mode === "repair" || mode === "report_only") {
+            if (fs.existsSync(tasks)) {
+                checks.push(checkExistingDirectory("tasks-write", tasks, "create_file", fs.constants.W_OK | fs.constants.X_OK));
+                checks.push(probeDirectory("tasks-probe", tasks));
+            }
+            else {
+                checks.push(checkCreateDirectory("tasks-create", tasks));
+            }
         }
         else {
-            checks.push(checkCreateDirectory("tasks-create", tasks));
+            checks.push({
+                id: "tasks-read-mode-skipped",
+                severity: "info",
+                path: displayPath(projectRoot, tasks),
+                operation: "create_directory",
+                status: "skipped",
+                reason: "ok",
+                side_effect: "none"
+            });
         }
     }
-    else {
-        checks.push({
-            id: "tasks-read-mode-skipped",
-            severity: "info",
-            path: displayPath(projectRoot, tasks),
-            operation: "create_directory",
-            status: "skipped",
-            reason: "ok",
-            side_effect: "none"
-        });
-    }
     const errors = checks.filter((check) => check.severity === "error" && check.status === "failed").length;
     const warnings = checks.filter((check) => check.severity === "warning").length;
     const ok = errors === 0;
@@ -78,7 +86,32 @@ function requireEnum(value, allowed, label) {
     return value;
 }
 function resolveInside(projectRoot, input) {
-    return path.isAbsolute(input) ? path.resolve(input) : path.resolve(projectRoot, input);
+    const resolvedRoot = path.resolve(projectRoot);
+    const resolved = path.isAbsolute(input) ? path.resolve(input) : path.resolve(resolvedRoot, input);
+    if (resolved !== resolvedRoot && !resolved.startsWith(`${resolvedRoot}${path.sep}`)) {
+        throw new AppError("validation", "Permission target must remain inside project root", 2, { root: resolvedRoot, target: resolved });
+    }
+    const existingPath = nearestExistingPath(resolved);
+    if (existingPath) {
+        const realRoot = fs.realpathSync(resolvedRoot);
+        const realExisting = fs.realpathSync(existingPath);
+        const suffix = path.relative(existingPath, resolved);
+        const realResolved = path.resolve(realExisting, suffix);
+        if (realResolved !== realRoot && !realResolved.startsWith(`${realRoot}${path.sep}`)) {
+            throw new AppError("validation", "Permission target escapes project root through a symlink", 2, { root: realRoot, target: resolved });
+        }
+    }
+    return resolved;
+}
+function nearestExistingPath(target) {
+    let current = target;
+    while (!fs.existsSync(current)) {
+        const parent = path.dirname(current);
+        if (parent === current)
+            return undefined;
+        current = parent;
+    }
+    return current;
 }
 function platformInfo(projectRoot) {
     const user = safeUserInfo();
@@ -132,55 +165,26 @@ function checkCreateDirectory(id, target) {
         return failedCheck(id, target, "create_directory", "not_writable", errorMessage(error), safeStat(parent));
     }
 }
-function checkWritableTree(root, prefix) {
-    if (!fs.existsSync(root))
-        return [];
-    const checks = [];
-    const stack = [root];
-    let scanned = 0;
-    while (stack.length > 0 && scanned < maxScannedFiles) {
-        const current = stack.pop();
-        if (!current)
-            continue;
-        let entries;
-        try {
-            entries = fs.readdirSync(current, { withFileTypes: true });
-        }
-        catch (error) {
-            checks.push(failedCheck(`${prefix}-read-${checks.length + 1}`, current, "read_existing_file", "not_readable", errorMessage(error), safeStat(current)));
-            continue;
-        }
-        for (const entry of entries) {
-            if (entry.name === ".git")
-                continue;
-            const entryPath = path.join(current, entry.name);
-            scanned += 1;
-            if (entry.isDirectory()) {
-                stack.push(entryPath);
-                checks.push(checkExistingDirectory(`${prefix}-dir-${checks.length + 1}`, entryPath, "create_file", fs.constants.W_OK | fs.constants.X_OK));
-            }
-            else if (entry.isFile()) {
-                checks.push(checkExistingFile(`${prefix}-${checks.length + 1}`, entryPath, fs.constants.R_OK | fs.constants.W_OK));
-            }
-            if (scanned >= maxScannedFiles)
-                break;
-        }
+function checkTarget(id, target, mode) {
+    if (!fs.existsSync(target)) {
+        if (mode !== "write")
+            return [failedCheck(id, target, "read_existing_file", "not_found", "Path does not exist")];
+        const parentCheck = checkCreateDirectory(id, target);
+        return parentCheck.status === "passed" ? [parentCheck, probeDirectory(`${id}-probe`, path.dirname(target))] : [parentCheck];
     }
-    if (scanned >= maxScannedFiles) {
-        checks.push({
-            id: `${prefix}-scan-limit`,
-            severity: "warning",
-            path: root,
-            operation: "stat_metadata",
-            status: "warning",
-            reason: "unknown",
-            fs_error: { message: `Stopped after ${maxScannedFiles} filesystem entries` },
-            side_effect: "none"
-        });
+    const stat = safeStat(target);
+    if (!stat)
+        return [failedCheck(id, target, "stat_metadata", "unknown", "Cannot stat permission target")];
+    if (stat.isDirectory()) {
+        const check = checkExistingDirectory(id, target, mode === "write" ? "create_file" : "read_existing_file", mode === "write" ? fs.constants.W_OK | fs.constants.X_OK : fs.constants.R_OK);
+        return mode === "write" && check.status === "passed" ? [check, probeDirectory(`${id}-probe`, target)] : [check];
     }
-    return checks;
+    const check = checkExistingFile(id, target, mode === "write" ? fs.constants.R_OK | fs.constants.W_OK : fs.constants.R_OK, mode === "write" ? "write_existing_file" : "read_existing_file");
+    return mode === "write" && check.status === "passed"
+        ? [check, probeDirectory(`${id}-probe`, path.dirname(target))]
+        : [check];
 }
-function checkExistingFile(id, target, access) {
+function checkExistingFile(id, target, access, operation = "write_existing_file") {
     try {
         const stat = fs.statSync(target);
         const immutable = detectImmutableFlag(target);
@@ -189,10 +193,10 @@ function checkExistingFile(id, target, access) {
         }
         fs.accessSync(target, access);
         const ownerWarning = ownerMismatchWarning(id, target, stat);
-        return ownerWarning ?? passedCheck(id, target, "write_existing_file", stat);
+        return operation === "write_existing_file" ? ownerWarning ?? passedCheck(id, target, operation, stat) : passedCheck(id, target, operation, stat);
     }
     catch (error) {
-        return failedCheck(id, target, "write_existing_file", accessReason(error, access), errorMessage(error), safeStat(target));
+        return failedCheck(id, target, operation, accessReason(error, access), errorMessage(error), safeStat(target));
     }
 }
 function ownerMismatchWarning(id, target, stat) {
@@ -211,9 +215,11 @@ function ownerMismatchWarning(id, target, stat) {
 }
 function probeDirectory(id, target) {
     const probePath = path.join(target, `.dd-flow-permission-probe-${process.pid}-${Date.now()}`);
+    const renamedProbePath = `${probePath}.renamed`;
     try {
         fs.writeFileSync(probePath, "probe\n", { flag: "wx" });
-        fs.unlinkSync(probePath);
+        fs.renameSync(probePath, renamedProbePath);
+        fs.unlinkSync(renamedProbePath);
         return {
             ...metadata(id, target, "create_file", safeStat(target)),
             severity: "info",
@@ -226,6 +232,8 @@ function probeDirectory(id, target) {
         try {
             if (fs.existsSync(probePath))
                 fs.unlinkSync(probePath);
+            if (fs.existsSync(renamedProbePath))
+                fs.unlinkSync(renamedProbePath);
         }
         catch (cleanupError) {
             return {

package/dist/services/plan-runtime.js

@@ -0,0 +1,124 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import { validatePlan } from "../domain/validation.js";
+import { AppError } from "../shared/errors.js";
+import { parseJsonObject } from "../shared/json.js";
+import { refreshRunSessionProjection } from "./run-projection.js";
+export function readCanonicalPlan(planPath, protocolId) {
+    if (!fs.existsSync(planPath) || !fs.statSync(planPath).isFile()) {
+        throw new AppError("not_found", `Canonical protocol plan is missing: ${planPath}`, 1, { plan_path: planPath });
+    }
+    const raw = fs.readFileSync(planPath, "utf8");
+    const value = parseJsonObject(raw, planPath);
+    const plan = validatePlan(value, protocolId);
+    const revisionValue = value.revision;
+    const revision = typeof revisionValue === "number" && Number.isInteger(revisionValue) && revisionValue > 0 ? revisionValue : 1;
+    return { plan, raw, sha256: crypto.createHash("sha256").update(raw).digest("hex"), revision };
+}
+export function boundCanonicalPlan(context, input) {
+    const canonical = readCanonicalPlan(input.planPath, input.protocolId);
+    const binding = context.db.get("SELECT plan_revision, plan_sha256, plan_path FROM plan_bindings WHERE project_id = ? AND protocol_id = ?", [input.projectId, input.protocolId]);
+    if (binding && (binding.plan_revision !== canonical.revision || binding.plan_sha256 !== canonical.sha256)) {
+        throw new AppError("plan_stale", "Canonical plan changed after the runtime binding was created", 1, {
+            protocol_id: input.protocolId,
+            expected_revision: binding.plan_revision,
+            actual_revision: canonical.revision,
+            expected_sha256: binding.plan_sha256,
+            actual_sha256: canonical.sha256,
+            plan_path: input.planPath
+        });
+    }
+    const now = context.now();
+    if (!binding) {
+        context.db.run(`INSERT INTO plan_bindings (project_id, protocol_id, plan_revision, plan_sha256, plan_path, bound_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?)`, [input.projectId, input.protocolId, canonical.revision, canonical.sha256, input.planPath, now, now]);
+    }
+    for (const item of canonical.plan.items) {
+        context.db.run(`INSERT INTO plan_progress
+        (project_id, protocol_id, item_id, plan_revision, plan_sha256, status, summary, evidence_json, block_reason, user_required, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT(project_id, protocol_id, item_id) DO NOTHING`, [
+            input.projectId,
+            input.protocolId,
+            item.id,
+            canonical.revision,
+            canonical.sha256,
+            item.status,
+            item.summary,
+            JSON.stringify(item.evidence),
+            item.block_reason ?? null,
+            item.user_required ? 1 : 0,
+            now
+        ]);
+    }
+    refreshProtocolRuns(context, input.projectId, input.protocolId);
+    return canonical;
+}
+export function planWithProgress(context, input) {
+    const canonical = boundCanonicalPlan(context, input);
+    const rows = context.db.all(`SELECT item_id, plan_revision, plan_sha256, status, summary, evidence_json, block_reason, user_required
+     FROM plan_progress WHERE project_id = ? AND protocol_id = ?`, [input.projectId, input.protocolId]);
+    const progress = new Map(rows.map((row) => [row.item_id, row]));
+    return {
+        canonical,
+        plan: {
+            ...canonical.plan,
+            items: canonical.plan.items.map((item) => mergeProgress(item, progress.get(item.id), canonical))
+        }
+    };
+}
+export function planSummary(context, input) {
+    const { canonical, plan } = planWithProgress(context, input);
+    return {
+        plan_id: plan.plan_id,
+        revision: canonical.revision,
+        sha256: canonical.sha256,
+        total: plan.items.length,
+        done: plan.items.filter((item) => item.status === "done").length,
+        blocked: plan.items.filter((item) => item.status === "blocked").length
+    };
+}
+export function updatePlanProgress(context, input) {
+    const canonical = boundCanonicalPlan(context, input);
+    context.db.run(`UPDATE plan_progress
+     SET plan_revision = ?, plan_sha256 = ?, status = ?, summary = ?, evidence_json = ?, block_reason = ?, user_required = ?, updated_at = ?
+     WHERE project_id = ? AND protocol_id = ? AND item_id = ?`, [
+        canonical.revision,
+        canonical.sha256,
+        input.item.status,
+        input.item.summary,
+        JSON.stringify(input.item.evidence),
+        input.item.block_reason ?? null,
+        input.item.user_required ? 1 : 0,
+        context.now(),
+        input.projectId,
+        input.protocolId,
+        input.item.id
+    ]);
+    refreshProtocolRuns(context, input.projectId, input.protocolId);
+}
+function refreshProtocolRuns(context, projectId, protocolId) {
+    for (const run of context.db.all("SELECT id FROM flow_runs WHERE project_id = ? AND subject_type = 'protocol' AND subject_id = ?", [projectId, protocolId]))
+        refreshRunSessionProjection(context, projectId, run.id);
+}
+function mergeProgress(item, row, canonical) {
+    if (!row || row.plan_revision !== canonical.revision || row.plan_sha256 !== canonical.sha256)
+        return item;
+    let evidence = item.evidence;
+    try {
+        const parsed = JSON.parse(row.evidence_json);
+        if (Array.isArray(parsed) && parsed.every((entry) => typeof entry === "string"))
+            evidence = parsed;
+    }
+    catch {
+        evidence = item.evidence;
+    }
+    return {
+        ...item,
+        status: row.status,
+        summary: row.summary,
+        evidence,
+        ...(row.block_reason ? { block_reason: row.block_reason } : {}),
+        ...(row.user_required ? { user_required: true } : {})
+    };
+}

package/dist/services/plans.js

@@ -1,68 +1,34 @@
-import fs from "node:fs";
 import { schemaVersion } from "../domain/contracts.js";
-import { validatePlan } from "../domain/validation.js";
 import { AppError } from "../shared/errors.js";
-import { parseJsonObject } from "../shared/json.js";
-import { ensureReadableFile } from "../storage/database.js";
 import { appendAudit } from "./audit.js";
 import { persistProtocolState, readProtocolRuntimeState, requireProtocol } from "./protocols.js";
 import { requireProjectByRoot } from "./projects.js";
 import { resolveProjectRoot } from "../storage/paths.js";
-import { writePlanFile } from "../protocol/local-files.js";
-export function setProtocolPlan(context, input) {
-    const protocol = scopedProtocol(context, input.projectRoot, input.protocolId);
-    ensureReadableFile(input.file);
-    const plan = validatePlan(parseJsonObject(fs.readFileSync(input.file, "utf8"), input.file), protocol.id);
-    writePlanFile(protocol.plan_path, plan);
-    context.db.run(`INSERT INTO plans (project_id, protocol_id, plan_json, updated_at)
-     VALUES (?, ?, ?, ?)
-     ON CONFLICT(project_id, protocol_id) DO UPDATE SET plan_json = excluded.plan_json, updated_at = excluded.updated_at`, [protocol.project_id, protocol.id, JSON.stringify(plan), context.now()]);
-    updateStatePlanSummary(context, protocol, plan);
-    appendAudit(context, {
-        protocolId: protocol.id,
-        projectId: protocol.project_id,
-        eventType: "plan.set",
-        payload: { protocol_id: protocol.id, plan_id: plan.plan_id, total: plan.items.length }
-    });
-    return { ok: true, protocol_id: protocol.id, plan: summarizePlan(plan) };
-}
+import { planSummary, planWithProgress, updatePlanProgress } from "./plan-runtime.js";
 export function getPlanStatus(context, input) {
     const protocol = scopedProtocol(context, input.projectRoot, input.protocolId);
-    const plan = requireStoredPlan(context, protocol.project_id, protocol.id);
+    const current = planWithProgress(context, { projectId: protocol.project_id, protocolId: protocol.id, planPath: protocol.plan_path });
     return {
         ok: true,
         protocol_id: protocol.id,
-        plan: summarizePlan(plan),
-        blocked_items: plan.items
+        plan: planSummary(context, { projectId: protocol.project_id, protocolId: protocol.id, planPath: protocol.plan_path }),
+        binding: { revision: current.canonical.revision, sha256: current.canonical.sha256, path: protocol.plan_path },
+        blocked_items: current.plan.items
             .filter((item) => item.status === "blocked")
-            .map((item) => ({
-            id: item.id,
-            title: item.title,
-            reason: item.block_reason ?? "",
-            user_required: item.user_required ?? false
-        })),
-        items: plan.items
+            .map((item) => ({ id: item.id, title: item.title, reason: item.block_reason ?? "", user_required: item.user_required ?? false })),
+        items: current.plan.items
     };
 }
 export function startPlanItem(context, input) {
     return updatePlanItem(context, input.projectRoot, input.protocolId, input.itemId, (item, plan) => {
         assertDependenciesClosed(plan, item);
-        return {
-            ...item,
-            status: "in_progress",
-            summary: item.summary || "Started."
-        };
+        return { ...item, status: "in_progress", summary: item.summary || "Started." };
     });
 }
 export function completePlanItem(context, input) {
     return updatePlanItem(context, input.projectRoot, input.protocolId, input.itemId, (item, plan) => {
         assertDependenciesClosed(plan, item);
-        return {
-            ...item,
-            status: "done",
-            summary: input.summary,
-            evidence: [...new Set([...item.evidence, ...input.evidence])]
-        };
+        return { ...item, status: "done", summary: input.summary, evidence: [...new Set([...item.evidence, ...input.evidence])] };
     });
 }
 export function blockPlanItem(context, input) {
@@ -83,48 +49,28 @@ export function skipPlanItem(context, input) {
 }
 function updatePlanItem(context, projectRoot, protocolId, itemId, transform) {
     const protocol = scopedProtocol(context, projectRoot, protocolId);
-    const plan = requireStoredPlan(context, protocol.project_id, protocol.id);
-    const item = plan.items.find((candidate) => candidate.id === itemId);
-    if (!item) {
+    const current = planWithProgress(context, { projectId: protocol.project_id, protocolId: protocol.id, planPath: protocol.plan_path });
+    const item = current.plan.items.find((candidate) => candidate.id === itemId);
+    if (!item)
         throw new AppError("not_found", `Plan item is not found: ${itemId}`, 1);
+    const nextItem = transform(item, current.plan);
+    updatePlanProgress(context, { projectId: protocol.project_id, protocolId: protocol.id, planPath: protocol.plan_path, item: nextItem });
+    if (nextItem.status === "done") {
+        context.db.run("UPDATE flow_jobs SET status = 'done', finished_at = COALESCE(finished_at, ?), updated_at = ? WHERE project_id = ? AND protocol_id = ? AND plan_item_id = ?", [context.now(), context.now(), protocol.project_id, protocol.id, nextItem.id]);
     }
-    const nextPlan = {
-        ...plan,
-        items: plan.items.map((candidate) => (candidate.id === itemId ? transform(candidate, plan) : candidate))
-    };
-    const validated = validatePlan(nextPlan, protocol.id);
-    writePlanFile(protocol.plan_path, validated);
-    context.db.run("UPDATE plans SET plan_json = ?, updated_at = ? WHERE project_id = ? AND protocol_id = ?", [
-        JSON.stringify(validated),
-        context.now(),
-        protocol.project_id,
-        protocol.id
-    ]);
-    updateStatePlanSummary(context, protocol, validated);
+    updateStatePlanSummary(context, protocol);
     appendAudit(context, {
         protocolId: protocol.id,
         projectId: protocol.project_id,
-        eventType: "plan.item.updated",
-        payload: {
-            protocol_id: protocol.id,
-            item_id: itemId,
-            from: item.status,
-            to: validated.items.find((candidate) => candidate.id === itemId)?.status
-        }
+        eventType: "plan.progress.updated",
+        payload: { protocol_id: protocol.id, item_id: itemId, from: item.status, to: nextItem.status }
     });
-    return { ok: true, protocol_id: protocol.id, item: validated.items.find((candidate) => candidate.id === itemId) };
+    return { ok: true, protocol_id: protocol.id, item: nextItem, plan: planSummary(context, { projectId: protocol.project_id, protocolId: protocol.id, planPath: protocol.plan_path }) };
 }
 function scopedProtocol(context, projectRoot, protocolId) {
     const project = requireProjectByRoot(context, resolveProjectRoot(projectRoot));
     return requireProtocol(context, protocolId, project.id);
 }
-function requireStoredPlan(context, projectId, protocolId) {
-    const row = context.db.get("SELECT plan_json FROM plans WHERE project_id = ? AND protocol_id = ?", [projectId, protocolId]);
-    if (!row) {
-        throw new AppError("not_found", `Plan is not attached to protocol: ${protocolId}`, 1);
-    }
-    return validatePlan(parseJsonObject(row.plan_json, `stored plan for ${protocolId}`), protocolId);
-}
 function assertDependenciesClosed(plan, item) {
     const openDependencies = item.depends_on
         .map((dependencyId) => plan.items.find((candidate) => candidate.id === dependencyId))
@@ -137,20 +83,12 @@ function assertDependenciesClosed(plan, item) {
         });
     }
 }
-function updateStatePlanSummary(context, protocol, plan) {
+function updateStatePlanSummary(context, protocol) {
     const state = readProtocolRuntimeState(context, protocol).state;
     persistProtocolState(context, protocol, {
         ...state,
         schema_version: state.schema_version || schemaVersion,
-        plan: summarizePlan(plan),
+        plan: planSummary(context, { projectId: protocol.project_id, protocolId: protocol.id, planPath: protocol.plan_path }),
         updated_at: context.now()
     });
 }
-function summarizePlan(plan) {
-    return {
-        plan_id: plan.plan_id,
-        total: plan.items.length,
-        done: plan.items.filter((item) => item.status === "done").length,
-        blocked: plan.items.filter((item) => item.status === "blocked").length
-    };
-}

package/dist/services/projects.js

@@ -320,7 +320,8 @@ function projectReferenceTables() {
         "codex_session_bindings",
         "project_config",
         "flow_sessions",
-        "pending_flow_session_bindings",
+        "flow_session_segments",
+        "flow_jobs",
         "codex_hook_events",
         "worktree_records"
     ];

package/dist/services/prompts.js

@@ -5,10 +5,12 @@ import { spawnSync } from "node:child_process";
 import { getCliVersionReport } from "./build-info.js";
 import { requireProjectByRoot } from "./projects.js";
 import { requireProtocol } from "./protocols.js";
-import { validatePlan } from "../domain/validation.js";
+import { validatePlanItem } from "../domain/validation.js";
 import { AppError } from "../shared/errors.js";
 import { parseJsonObject } from "../shared/json.js";
 import { ensureDir, resolveProjectRoot } from "../storage/paths.js";
+import { planWithProgress } from "./plan-runtime.js";
+import { registerFlowJob } from "./sessions.js";
 const profiles = {
     code_implementation: {
         static_files: [".memory-bank/dd-flow/common/worker-session.md", ".memory-bank/dd-flow/workers/code.md"]
@@ -37,8 +39,13 @@ export function renderWorkerPrompt(context, input) {
         });
     }
     assertGitFacts(workspaceRoot, index.execution?.git, run.id);
-    const plan = input.taskFile ? null : readPlan(protocol.plan_path, protocol.id);
-    const genericTask = input.taskFile ? readWorkerTask(input.taskFile, runHomePath(run), protocol.id) : null;
+    const planRuntime = input.taskFile ? null : planWithProgress(context, {
+        projectId: protocol.project_id,
+        protocolId: protocol.id,
+        planPath: protocol.plan_path
+    });
+    const plan = planRuntime?.plan ?? null;
+    const genericTask = input.taskFile ? readWorkerTask(input.taskFile, runHomePath(run)) : null;
     const item = genericTask?.item ?? plan?.items.find((candidate) => candidate.id === input.planItemId);
     if (!item)
         throw new AppError("not_found", `Plan item is not found: ${input.planItemId}`, 1);
@@ -57,6 +64,13 @@ export function renderWorkerPrompt(context, input) {
     const profile = profiles[input.profile];
     if (!profile)
         throw new AppError("prompt_profile_unsupported", `Unsupported prompt profile: ${input.profile}`, 2);
+    const job = registerFlowJob(context, {
+        projectId: protocol.project_id,
+        runId: run.id,
+        protocolId: protocol.id,
+        planItemId: item.id,
+        groupId: item.execution_context.write_scope[0] ?? null
+    });
     const staticInputs = profile.static_files.map((file) => readStaticInput(projectRoot, file));
     const requiredRead = item.execution_context.required_read.map((file) => checkedReference(projectRoot, runHomePath(run), file, "required_read", true));
     const discoveryBoundary = item.execution_context.discovery_boundary.map((file) => checkedReference(projectRoot, runHomePath(run), file, "discovery_boundary", false));
@@ -86,8 +100,10 @@ export function renderWorkerPrompt(context, input) {
         protocol_id: protocol.id,
         run_id: run.id,
         plan_id: plan?.plan_id ?? null,
+        ...(planRuntime ? { plan_revision: planRuntime.canonical.revision, plan_sha256: planRuntime.canonical.sha256 } : {}),
         plan_item_id: input.taskFile ? null : item.id,
         task_id: input.taskFile ? item.id : null,
+        job_id: job.job_id,
         canon_version: readCanonVersion(projectRoot),
         renderer_version: getCliVersionReport().cli.version,
         static_inputs: staticInputs.map(({ path: inputPath, sha256 }) => ({ path: inputPath, sha256 })),
@@ -115,13 +131,14 @@ export function renderWorkerPrompt(context, input) {
         profile: input.profile,
         plan_item_id: input.taskFile ? null : item.id,
         task_id: input.taskFile ? item.id : null,
-        run_id: run.id
+        run_id: run.id,
+        job_id: job.job_id
     };
 }
 function runHomePath(run) {
     return run.run_home_path ?? path.dirname(run.run_index_path);
 }
-function readWorkerTask(taskFile, runHome, protocolId) {
+function readWorkerTask(taskFile, runHome) {
     const resolved = path.resolve(taskFile);
     assertWithin(runHome, resolved, "worker task file");
     if (!fs.existsSync(resolved))
@@ -130,13 +147,7 @@ function readWorkerTask(taskFile, runHome, protocolId) {
     if (task.schema_id !== "dd-flow/worker-task@1" || !task.task || typeof task.task !== "object") {
         throw new AppError("validation", "Worker task must use dd-flow/worker-task@1 with a task object", 2, { path: taskFile });
     }
-    const item = validatePlan({
-        schema_version: "0.1.0",
-        plan_id: "worker-task",
-        protocol_id: protocolId,
-        title: "worker task",
-        items: [{ ...task.task, depends_on: [] }]
-    }, protocolId).items[0];
+    const item = validatePlanItem({ ...task.task, depends_on: [] }, 0);
     return { item, handoff: validateWorkerTaskHandoff(task.handoff, runHome) };
 }
 function validateWorkerTaskHandoff(value, runHome) {
@@ -187,14 +198,13 @@ function validateWorkerTaskHandoff(value, runHome) {
 }
 function protocolIdForRun(context, projectId, runId) {
     const run = requireRun(context, projectId, runId);
-    const subject = parseJsonObject(run.index_json, `run ${run.id}`).subject;
-    if (subject?.type !== "protocol" || typeof subject.id !== "string") {
+    if (run.subject_type !== "protocol") {
         throw new AppError("prompt_run_subject", "Prompt rendering requires a protocol-owned RUN", 1, { run_id: run.id });
     }
-    return subject.id;
+    return run.subject_id;
 }
 function requireRun(context, projectId, runId) {
-    const row = context.db.get("SELECT id, project_id, workspace_root, run_index_path, run_home_path, index_json FROM flow_runs WHERE project_id = ? AND (id = ? OR short_id = ?)", [projectId, runId, runId]);
+    const row = context.db.get("SELECT id, project_id, subject_type, subject_id, workspace_root, run_index_path, run_home_path, index_json FROM flow_runs WHERE project_id = ? AND (id = ? OR short_id = ?)", [projectId, runId, runId]);
     if (!row)
         throw new AppError("not_found", `Run is not found: ${runId}`, 1);
     return row;
@@ -209,11 +219,6 @@ function requireStage(index, stageName, runId) {
     }
     return { dir: stage.dir };
 }
-function readPlan(planPath, protocolId) {
-    if (!fs.existsSync(planPath))
-        throw new AppError("not_found", `Protocol plan is missing: ${planPath}`, 1);
-    return validatePlan(parseJsonObject(fs.readFileSync(planPath, "utf8"), planPath), protocolId);
-}
 function readStaticInput(projectRoot, relativePath) {
     checkedReference(projectRoot, undefined, relativePath, "static profile input", true);
     const absolute = path.resolve(projectRoot, relativePath);