@deksden-com/dd-flow-cli 0.4.2 → 0.5.0

package/dist/services/engines.js

@@ -1,7 +1,8 @@
+import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { createRequire } from "node:module";
 import { getCliBuildInfo } from "./build-info.js";
 import { AppError } from "../shared/errors.js";
@@ -34,12 +35,12 @@ export function installCurrentEngine(context, input = {}) {
     const target = engineVersionRoot(context.ddFlowHome, build.package_name, build.version);
     const manifestPath = path.join(target, "engine.json");
     const existing = readManifest(manifestPath);
-    if (existing && !input.force && manifestHealthy(existing)) {
+    if (existing && !input.force && (input.forRouting || manifestHealthy(existing))) {
         return {
             ok: true,
             action: "engine_install",
             changed: false,
-            engine: manifestSummary(existing),
+            ...(input.forRouting ? {} : { engine: manifestSummary(existing) }),
             path: target
         };
     }
@@ -47,12 +48,12 @@ export function installCurrentEngine(context, input = {}) {
     acquireInstallLock(lockDir);
     try {
         const afterLock = readManifest(manifestPath);
-        if (afterLock && !input.force && manifestHealthy(afterLock)) {
+        if (afterLock && !input.force && (input.forRouting || manifestHealthy(afterLock))) {
             return {
                 ok: true,
                 action: "engine_install",
                 changed: false,
-                engine: manifestSummary(afterLock),
+                ...(input.forRouting ? {} : { engine: manifestSummary(afterLock) }),
                 path: target
             };
         }
@@ -64,14 +65,21 @@ export function installCurrentEngine(context, input = {}) {
         copyPackageSnapshot(packageRoot, tmp);
         const manifest = buildManifest(context, build.package_name, build.version, packageRoot, target, tmp);
         fs.writeFileSync(path.join(tmp, "engine.json"), `${JSON.stringify(manifest, null, 2)}\n`);
-        fs.rmSync(target, { recursive: true, force: true });
-        fs.renameSync(tmp, target);
+        const stagedManifest = requireManifest(path.join(tmp, "engine.json"));
+        const stagedDiagnostics = manifestDiagnostics({ ...stagedManifest, package_root: tmp, snapshot_root: tmp }, { checkEntrypoint: !input.forRouting });
+        if (stagedDiagnostics.length > 0) {
+            throw new AppError("engine_install_failed", "Staged dd-flow engine failed its integrity or dependency health check", 1, {
+                diagnostics: stagedDiagnostics,
+                path: tmp
+            });
+        }
+        activateEngineAtomically(tmp, target);
         const installed = requireManifest(path.join(target, "engine.json"));
         return {
             ok: true,
             action: "engine_install",
             changed: true,
-            engine: manifestSummary(installed),
+            ...(input.forRouting ? {} : { engine: manifestSummary(installed) }),
             path: target
         };
     }
@@ -121,8 +129,8 @@ export function doctorEngines(context, input = {}) {
 export function routeArgsThroughEngine(context, args, io, stdin, env, resolvedProjectRoot) {
     if (isEngineMode(env) || isRouterNativeCommand(args))
         return Promise.resolve(null);
-    installCurrentEngine(context);
-    const selection = selectEngine(context, { projectRoot: resolvedProjectRoot ?? resolveOperationProjectRoot(context, args) ?? undefined });
+    installCurrentEngine(context, { forRouting: true });
+    const selection = selectEngine(context, { projectRoot: resolvedProjectRoot ?? resolveOperationProjectRoot(context, args) ?? undefined }, { allowCurrentInProcess: true });
     if (selection.status === "missing") {
         const classification = classifyCliOperation(args, env);
         if (classification.mode === "read_only_diagnostics" || classification.mode === "mb_upgrade") {
@@ -148,7 +156,7 @@ export function engineRoutingMetadata(env) {
         routed_from: env.DD_FLOW_ROUTED_FROM ?? null
     };
 }
-export function selectEngine(context, input) {
+export function selectEngine(context, input, options = {}) {
     const compatibility = readCompatibilityForProject(input.projectRoot);
     const build = getCliBuildInfo();
     const packageName = stringValue(compatibility?.engine?.package_name) ?? build.package_name;
@@ -158,7 +166,11 @@ export function selectEngine(context, input) {
     const manifests = readInstalledManifests(engineStoreRoot(context.ddFlowHome))
         .filter((manifest) => manifest.package_name === packageName)
         .filter((manifest) => satisfiesRange(manifest.package_version, requiredRange))
-        .filter((manifest) => manifestHealthy(manifest))
+        .filter((manifest) => options.allowCurrentInProcess
+        && manifest.package_name === build.package_name
+        && manifest.package_version === build.version
+        ? true
+        : manifestHealthy(manifest))
         .sort((a, b) => compareSemverStrings(b.package_version, a.package_version));
     const selected = manifests[0] ?? null;
     return {
@@ -275,13 +287,13 @@ function buildManifest(context, packageName, version, packageRoot, snapshotRoot,
         },
         integrity: {
             source: "package_snapshot",
-            checksum: fileListChecksum(checksumRoot),
-            mode: "file_list"
+            checksum: engineSnapshotChecksum(checksumRoot),
+            mode: "full_content"
         }
     };
 }
 function copyPackageSnapshot(packageRoot, target) {
-    for (const item of ["dist", "package.json", "README.md", "CHANGELOG.md"]) {
+    for (const item of ["dist", "package.json", "README.md", "CHANGELOG.md", "tools"]) {
         const from = path.join(packageRoot, item);
         if (!fs.existsSync(from))
             continue;
@@ -441,7 +453,7 @@ function readManifest(file) {
 function manifestHealthy(manifest) {
     return manifestDiagnostics(manifest).length === 0;
 }
-function manifestDiagnostics(manifest) {
+function manifestDiagnostics(manifest, options = {}) {
     const diagnostics = [];
     if (manifest.schema_id !== engineManifestSchemaId)
         diagnostics.push("schema_id_mismatch");
@@ -455,6 +467,34 @@ function manifestDiagnostics(manifest) {
         diagnostics.push("entrypoint_outside_snapshot");
     else if (!fs.existsSync(entrypoint))
         diagnostics.push("entrypoint_missing");
+    if (!manifest.integrity || manifest.integrity.mode !== "full_content" || !manifest.integrity.checksum) {
+        diagnostics.push("content_checksum_missing");
+    }
+    else if (fs.existsSync(snapshotRoot)) {
+        try {
+            if (engineSnapshotChecksum(snapshotRoot) !== manifest.integrity.checksum)
+                diagnostics.push("content_checksum_mismatch");
+        }
+        catch {
+            diagnostics.push("snapshot_unreadable");
+        }
+    }
+    if (options.checkEntrypoint !== false && entrypoint && fs.existsSync(entrypoint) && !diagnostics.includes("entrypoint_outside_snapshot")) {
+        const health = spawnSync(process.execPath, [entrypoint, "--version", "--json"], {
+            cwd: snapshotRoot,
+            env: {
+                ...process.env,
+                DD_FLOW_ENGINE_MODE: "1",
+                DD_FLOW_ENGINE_HOME: snapshotRoot,
+                DD_FLOW_ENGINE_HEALTHCHECK: "1"
+            },
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "pipe"],
+            timeout: 15_000
+        });
+        if (health.status !== 0)
+            diagnostics.push("entrypoint_dependency_load_failed");
+    }
     return diagnostics;
 }
 function manifestSummary(manifest) {
@@ -592,10 +632,17 @@ function findPackageRoot(start) {
         current = parent;
     }
 }
-function fileListChecksum(root) {
+export function engineSnapshotChecksum(root) {
     const files = [];
     collectFiles(root, root, files);
-    return Buffer.from(files.sort().join("\n")).toString("base64url");
+    const checksum = crypto.createHash("sha256");
+    for (const file of files.sort()) {
+        checksum.update(file);
+        checksum.update("\0");
+        checksum.update(fs.readFileSync(path.join(root, file)));
+        checksum.update("\0");
+    }
+    return checksum.digest("hex");
 }
 function collectFiles(root, current, files) {
     for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
@@ -608,6 +655,25 @@ function collectFiles(root, current, files) {
             files.push(path.relative(root, full));
     }
 }
+function activateEngineAtomically(staging, target) {
+    const previous = `${target}.previous-${process.pid}-${Date.now()}`;
+    const hadPrevious = fs.existsSync(target);
+    if (hadPrevious)
+        fs.renameSync(target, previous);
+    try {
+        fs.renameSync(staging, target);
+    }
+    catch (error) {
+        if (hadPrevious && !fs.existsSync(target) && fs.existsSync(previous))
+            fs.renameSync(previous, target);
+        throw new AppError("engine_install_failed", "Atomic engine activation failed; previous engine was preserved", 1, {
+            target,
+            cause: String(error)
+        });
+    }
+    if (hadPrevious)
+        fs.rmSync(previous, { recursive: true, force: true });
+}
 function stringValue(value) {
     return typeof value === "string" && value.length > 0 ? value : null;
 }

package/dist/services/hooks.js

@@ -8,10 +8,9 @@ import { parseJsonObject } from "../shared/json.js";
 import { ensureDir, resolveProjectRoot } from "../storage/paths.js";
 import { appendAudit } from "./audit.js";
 import { requireProjectByRoot } from "./projects.js";
-import { activeFlowSessionsForProject, confirmPendingFlowSessionBinding, flowSessionById, flowSessionPayloadFromRegisterCommand, recordPendingFlowSessionBinding, updateFlowSessionContinuation } from "./sessions.js";
+import { activeFlowSessionsForProject, bindObservedFlowSession, flowSessionPayloadFromRegisterCommand, recordFlowSessionObservation } from "./sessions.js";
 const defaultProfileName = "default";
 const maxSanitizedSummaryLength = 1600;
-const stopLoopLimit = 3;
 const sharedEntries = [
     "auth.json",
     "auth.bk",
@@ -266,49 +265,58 @@ export function removeCodexHooks(context, input) {
     return { ok: true, installed: false, target, profile: location.profile, hooks_path: location.hooksPath, backup, had_managed: hadManaged };
 }
 export function handleCodexHook(context, input) {
-    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
     const payload = parseJsonObject(input.stdin || "{}", "codex hook stdin");
     const eventName = input.event || stringValue(payload.hook_event_name) || "Unknown";
+    if (eventName !== "PreToolUse") {
+        return { ok: true, observed: false, reason: "event_not_participating", event: eventName };
+    }
     const sessionId = stringValue(payload.session_id);
     const turnId = stringValue(payload.turn_id);
     const toolName = stringValue(payload.tool_name) ?? toolNameFromPayload(payload);
     const command = commandFromPayload(payload);
+    if (!command)
+        return { ok: true, observed: false, reason: "non_bash_tool" };
+    const flowPayload = flowSessionPayloadFromRegisterCommand(command);
+    if (!flowPayload)
+        return { ok: true, observed: false, reason: "event_not_participating", event: eventName };
+    const project = projectForHook(context, input.projectRoot, stringValue(payload.cwd));
+    if (!project)
+        return { ok: true, observed: false, reason: "unrelated_cwd" };
     const binding = sessionId ? upsertSessionBindingFromPayload(context, project, sessionId, payload) : undefined;
-    const preToolUseDecision = eventName === "PreToolUse" && command
-        ? preToolUseGuard(context, project, sessionId ?? null, payload, command)
-        : undefined;
-    if (eventName === "PreToolUse" && sessionId && command) {
-        recordPendingFlowSessionBinding(context, project, {
-            sessionId,
-            command,
-            cwd: stringValue(payload.cwd),
-            transcriptPath: stringValue(payload.transcript_path),
-            turnId: turnId ?? undefined
-        });
-    }
-    const confirmedFlowSession = eventName === "PostToolUse" && sessionId && toolSucceeded(payload)
-        ? confirmPendingFlowSessionBinding(context, project, { sessionId })
-        : undefined;
-    const existingFlowSession = sessionId ? flowSessionById(context, project.id, sessionId) : undefined;
-    const boundProtocol = eventName === "PostToolUse" && sessionId ? bindProtocolFromToolEvent(context, project, sessionId, payload) : binding;
-    const protocolId = confirmedFlowSession?.protocol_id ?? existingFlowSession?.protocol_id ?? boundProtocol?.protocol_id ?? binding?.protocol_id ?? null;
-    recordHookEvent(context, {
+    const observedSession = bindObservedFlowSession(context, project, flowPayload, sessionId ?? flowPayload.session_id ?? undefined);
+    const effectiveSessionId = observedSession?.session_id ?? sessionId ?? null;
+    const protocolId = observedSession?.protocol_id ?? binding?.protocol_id ?? null;
+    const eventKey = hookEventKey(payload, eventName, toolName, command);
+    const inserted = recordHookEvent(context, {
         projectId: project.id,
         protocolId,
-        sessionId: sessionId ?? null,
+        sessionId: effectiveSessionId,
         turnId: turnId ?? null,
         eventName,
         toolName: toolName ?? null,
         status: "observed",
-        payload
+        payload,
+        eventKey
     });
-    if (eventName === "Stop") {
-        return stopDecision(context, project, sessionId ?? null);
-    }
-    if (preToolUseDecision) {
-        return preToolUseDecision;
+    if (effectiveSessionId) {
+        recordFlowSessionObservation(context, {
+            projectId: project.id,
+            sessionId: effectiveSessionId,
+            runId: observedSession?.run_id ?? null,
+            protocolId,
+            cwd: stringValue(payload.cwd) ?? null,
+            toolName: toolName ?? null,
+            eventKey
+        });
     }
-    return hookContinue(eventName, protocolId);
+    return {
+        ok: true,
+        observed: inserted,
+        duplicate: !inserted,
+        event_key: eventKey,
+        session_id: effectiveSessionId,
+        protocol_id: protocolId
+    };
 }
 export function hookStatusForProject(context, projectId) {
     return context.db.all(`SELECT scope, config_path, content_hash, installed, drift_status, updated_at
@@ -438,13 +446,10 @@ function sharedEntryStatus(sourceHome, targetHome) {
         };
     });
 }
-function expectedHooksConfig(projectRoot) {
+function expectedHooksConfig(_projectRoot) {
     return {
         hooks: {
-            SessionStart: [hookEntry("startup|resume", hookCommand("SessionStart", projectRoot), "dd-flow session binding")],
-            PreToolUse: [hookEntry("Bash", hookCommand("PreToolUse", projectRoot), "dd-flow command guard")],
-            PostToolUse: [hookEntry("Bash", hookCommand("PostToolUse", projectRoot), "dd-flow command observer")],
-            Stop: [{ hooks: [commandHook(hookCommand("Stop", projectRoot), "dd-flow continuation guard")] }]
+            PreToolUse: [hookEntry("Bash", hookCommand("PreToolUse"), "dd-flow runtime observation")]
         }
     };
 }
@@ -454,8 +459,8 @@ function hookEntry(matcher, command, statusMessage) {
 function commandHook(command, statusMessage) {
     return { type: "command", command, timeout: 5, statusMessage };
 }
-function hookCommand(event, projectRoot) {
-    return `dd-flow codex hook handle --event ${event} --project-root ${JSON.stringify(projectRoot)} --json`;
+function hookCommand(event) {
+    return `dd-flow codex hook handle --event ${event} --json`;
 }
 function resolveHookTarget(target) {
     if (!target || target === "isolated") {
@@ -493,7 +498,7 @@ function requireHookLocation(context, project, target, profile) {
 }
 function hookFileStatus(hooksPath, projectRoot) {
     const existing = readJsonIfExists(hooksPath);
-    const installed = existing ? hasExpectedHooks(existing, projectRoot) : false;
+    const installed = existing ? hasExpectedHooks(existing) : false;
     const managed = existing ? hasManagedHooks(existing, projectRoot) : false;
     return {
         installed,
@@ -537,20 +542,20 @@ function removeManagedHooks(existing, projectRoot) {
     }
     return { ...existing, hooks: nextHooks };
 }
-function hasExpectedHooks(existing, projectRoot) {
+function hasExpectedHooks(existing) {
     const commands = collectHookCommands(existing);
-    return expectedCommands(projectRoot).every((command) => commands.includes(command));
+    return expectedCommands().every((command) => commands.includes(command));
 }
 function hasManagedHooks(existing, projectRoot) {
     return collectHookCommands(existing).some((command) => command.includes("dd-flow codex hook handle") &&
-        (command.includes(`--project-root ${JSON.stringify(projectRoot)}`) || command.includes(projectRoot)));
+        (command.includes("--event PreToolUse") || command.includes(`--project-root ${JSON.stringify(projectRoot)}`) || command.includes(projectRoot)));
 }
-function expectedCommands(projectRoot) {
-    return ["SessionStart", "PreToolUse", "PostToolUse", "Stop"].map((event) => hookCommand(event, projectRoot));
+function expectedCommands() {
+    return [hookCommand("PreToolUse")];
 }
 function entryHasManagedCommand(entry, projectRoot) {
     return collectHookCommands(entry).some((command) => command.includes("dd-flow codex hook handle") &&
-        (command.includes(`--project-root ${JSON.stringify(projectRoot)}`) || command.includes(projectRoot)));
+        (command.includes("--event PreToolUse") || command.includes(`--project-root ${JSON.stringify(projectRoot)}`) || command.includes(projectRoot)));
 }
 function collectHookCommands(value) {
     if (Array.isArray(value)) {
@@ -645,213 +650,54 @@ function upsertSessionBindingFromPayload(context, project, sessionId, payload) {
        updated_at = excluded.updated_at`, [sessionId, project.id, cwd, transcriptPath, now, now]);
     return sessionBinding(context, project.id, sessionId);
 }
-function bindProtocolFromToolEvent(context, project, sessionId, payload) {
-    if (!toolSucceeded(payload)) {
-        return sessionBinding(context, project.id, sessionId);
-    }
-    const command = commandFromPayload(payload);
-    const handshakeId = command ? handshakeFromCommand(command) : null;
-    if (!handshakeId) {
-        return sessionBinding(context, project.id, sessionId);
-    }
-    const protocol = context.db.get("SELECT id, handshake_id FROM protocols WHERE project_id = ? AND (handshake_id = ? OR id = ?) ORDER BY updated_at DESC LIMIT 1", [project.id, handshakeId, handshakeId.startsWith("PRT-") ? handshakeId : `PRT-${handshakeId}`]);
-    if (!protocol) {
-        return sessionBinding(context, project.id, sessionId);
-    }
-    context.db.run(`UPDATE codex_session_bindings
-     SET protocol_id = ?, handshake_id = ?, status = 'active', updated_at = ?
-     WHERE project_id = ? AND session_id = ?`, [protocol.id, protocol.handshake_id, context.now(), project.id, sessionId]);
-    appendAudit(context, {
-        protocolId: protocol.id,
-        projectId: project.id,
-        eventType: "codex_session.bound",
-        payload: { project_id: project.id, protocol_id: protocol.id, handshake_id: protocol.handshake_id, session_id: sessionId }
-    });
-    return sessionBinding(context, project.id, sessionId);
-}
 function sessionBinding(context, projectId, sessionId) {
     return context.db.get("SELECT * FROM codex_session_bindings WHERE project_id = ? AND session_id = ?", [projectId, sessionId]);
 }
 function recordHookEvent(context, input) {
+    const existing = context.db.get("SELECT id FROM codex_hook_events WHERE project_id = ? AND event_key = ?", [input.projectId, input.eventKey]);
+    if (existing)
+        return false;
     context.db.run(`INSERT INTO codex_hook_events
-      (project_id, protocol_id, session_id, turn_id, event_name, tool_name, status, sanitized_summary, created_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+      (project_id, protocol_id, session_id, turn_id, event_key, event_name, tool_name, status, sanitized_summary, created_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
         input.projectId,
         input.protocolId,
         input.sessionId,
         input.turnId,
+        input.eventKey,
         input.eventName,
         input.toolName,
         input.status,
         sanitizedSummary(input.payload),
         context.now()
     ]);
+    return true;
 }
-function stopDecision(context, project, sessionId) {
-    if (!sessionId) {
-        return {};
-    }
-    const session = flowSessionById(context, project.id, sessionId);
-    if (!session || ["waiting_user", "blocked", "stopping", "stopped", "closed"].includes(session.status)) {
-        return {};
-    }
-    if (session.protocol_id && protocolAllowsStop(context, project.id, session.protocol_id)) {
-        return {};
-    }
-    if (session.flow_kind === "merge_worker" && session.continuation_policy === "merge_queue") {
-        return stopContinuationDecision(context, project.id, sessionId, `merge-worker:${session.worker_id ?? session.session_id}:${session.next_action ?? "wait-next"}`, `Continue dd-flow merge worker ${session.worker_id ?? session.session_id}: run .memory-bank/dd-flow/merge-start.md and continue dd-flow merge-queue wait-next from the registered merge workspace. Use dd-flow session stop-worker to stop this worker.`, { limit: null });
-    }
-    if (session.flow_kind === "merge_job" && session.continuation_policy === "merge_job") {
-        return stopContinuationDecision(context, project.id, sessionId, `merge-job:${session.protocol_id ?? session.session_id}:${session.next_action ?? "none"}`, `Continue dd-flow merge job ${session.protocol_id ?? ""}: complete merge work, close the protocol, and report terminal state.`);
-    }
-    const nextAction = session.next_action ?? nextActionFromProtocol(context, project.id, session.protocol_id);
-    if (!nextAction || nextAction === "none" || session.continuation_policy === "none") {
-        return {};
-    }
-    return stopContinuationDecision(context, project.id, sessionId, `${session.flow_kind}:${session.protocol_id ?? session.session_id}:${nextAction}`, `Continue dd-flow ${session.flow_kind}${session.protocol_id ? ` ${session.protocol_id}` : ""}: ${nextAction}`);
-}
-function nextActionFromProtocol(context, projectId, protocolId) {
-    if (!protocolId) {
-        return null;
-    }
-    const protocol = context.db.get("SELECT id, status, stage, next_action FROM protocols WHERE project_id = ? AND id = ?", [projectId, protocolId]);
-    if (!protocol) {
-        return null;
-    }
-    if (["waiting_for_user", "blocked", "closed", "cancelled"].includes(protocol.stage) || ["waiting_for_user", "blocked", "closed", "cancelled"].includes(protocol.status)) {
-        return null;
-    }
-    return protocol.next_action;
-}
-function protocolAllowsStop(context, projectId, protocolId) {
-    const protocol = context.db.get("SELECT status, stage FROM protocols WHERE project_id = ? AND id = ?", [projectId, protocolId]);
-    return Boolean(protocol && (["closed", "cancelled"].includes(protocol.status) || ["closed", "cancelled"].includes(protocol.stage)));
-}
-function stopContinuationDecision(context, projectId, sessionId, actionKey, reason, options = {}) {
-    const nextCount = updateFlowSessionContinuation(context, projectId, sessionId, actionKey);
-    const limit = options.limit === undefined ? stopLoopLimit : options.limit;
-    if (limit !== null && nextCount > limit) {
-        return {};
-    }
-    return { decision: "block", reason };
-}
-function preToolUseGuard(context, project, sessionId, payload, command) {
-    const cwd = stringValue(payload.cwd);
-    const blockedTarget = cwd ? selfWorktreeRemovalTarget(command, cwd) : null;
-    if (!blockedTarget) {
-        const roleDecision = mergeRoleGuard(context, project, sessionId, command);
-        if (roleDecision) {
-            return roleDecision;
-        }
+function projectForHook(context, explicitRoot, cwd) {
+    if (explicitRoot)
+        return requireProjectByRoot(context, resolveProjectRoot(explicitRoot));
+    if (!cwd)
         return undefined;
-    }
-    return {
-        decision: "block",
-        reason: `Refusing to remove the current Codex session worktree (${blockedTarget}). Restart or run cleanup from the stable project root or a separate cleanup session.`
-    };
-}
-function mergeRoleGuard(context, project, sessionId, command) {
-    const session = sessionId ? flowSessionById(context, project.id, sessionId) : undefined;
-    const mergeSessionKinds = ["merge_worker", "merge_job"];
-    const isMergeRole = session ? mergeSessionKinds.includes(session.flow_kind) : false;
-    const registerPayload = safeFlowSessionPayloadFromCommand(command);
-    if (registerPayload && mergeSessionKinds.includes(registerPayload.flow_kind)) {
-        if (session && !mergeSessionKinds.includes(session.flow_kind)) {
-            return blockMergeRole("A non-merge Codex session cannot re-register itself as a merge worker/job.");
-        }
-        if (registerPayload.flow_kind === "merge_job" && !claimedMergeJobMatches(context, project.id, registerPayload.protocol_id, registerPayload.worker_id)) {
-            return blockMergeRole("A merge_job session requires an already claimed merge queue job for the same protocol and worker_id.");
-        }
-    }
-    const mergeQueueAction = mergeQueueMutation(command);
-    if (mergeQueueAction) {
-        if (mergeQueueAction === "next" || mergeQueueAction === "wait-next") {
-            return session?.flow_kind === "merge_worker" ? undefined : blockMergeRole("Only a registered merge_worker session may claim or wait for merge queue jobs.");
-        }
-        return session?.flow_kind === "merge_job" ? undefined : blockMergeRole("Only a registered merge_job session may complete or fail a claimed merge queue job.");
-    }
-    if (mergeLaneLockMutation(command)) {
-        return isMergeRole ? undefined : blockMergeRole("Only registered merge sessions may mutate the merge lane lock.");
-    }
-    if (/\bgit\s+merge\b/.test(command)) {
-        return session?.flow_kind === "merge_job" ? undefined : blockMergeRole("Only a registered merge_job session may run git merge.");
-    }
-    return undefined;
-}
-function blockMergeRole(reason) {
-    return { decision: "block", reason };
-}
-function safeFlowSessionPayloadFromCommand(command) {
-    try {
-        return flowSessionPayloadFromRegisterCommand(command);
-    }
-    catch {
-        return undefined;
-    }
-}
-function claimedMergeJobMatches(context, projectId, protocolId, workerId) {
-    if (!protocolId || !workerId) {
-        return false;
-    }
-    const job = context.db.get("SELECT status, claimed_by_session_id FROM merge_queue WHERE project_id = ? AND protocol_id = ?", [projectId, protocolId]);
-    return job?.status === "claimed" && job.claimed_by_session_id === workerId;
-}
-function mergeQueueMutation(command) {
-    const match = command.match(/\bdd-flow\s+merge-queue\s+(next|wait-next|complete|fail)\b/);
-    return match?.[1] ?? null;
-}
-function mergeLaneLockMutation(command) {
-    return /\bdd-flow\s+lane\s+lock\s+(acquire|heartbeat|release|wait|wait-acquire)\b/.test(command) && /(?:--lane(?:\s+|=)(?:"merge"|'merge'|merge)\b)/.test(command);
-}
-function selfWorktreeRemovalTarget(command, cwd) {
-    if (!/\bgit\s+worktree\s+remove\b/.test(command)) {
-        return null;
-    }
-    const cwdPath = normalizePathForGuard(cwd, cwd);
-    for (const target of gitWorktreeRemoveTargets(command)) {
-        const targetPath = normalizePathForGuard(target, cwd);
-        if (cwdPath === targetPath || cwdPath.startsWith(`${targetPath}${path.sep}`)) {
-            return targetPath;
-        }
-    }
-    return null;
-}
-function gitWorktreeRemoveTargets(command) {
-    const targets = [];
-    const pattern = /\bgit\s+worktree\s+remove\b([^;&|]*)/g;
-    for (const match of command.matchAll(pattern)) {
-        const args = shellishTokens(match[1] ?? "");
-        for (const arg of args) {
-            if (arg.startsWith("-")) {
-                continue;
-            }
-            targets.push(arg);
-            break;
-        }
-    }
-    return targets;
-}
-function shellishTokens(input) {
-    const tokens = [];
-    const pattern = /"([^"]*)"|'([^']*)'|(\S+)/g;
-    for (const match of input.matchAll(pattern)) {
-        tokens.push(match[1] ?? match[2] ?? match[3] ?? "");
-    }
-    return tokens.filter((token) => token.length > 0);
-}
-function normalizePathForGuard(value, cwd) {
-    const absolute = path.isAbsolute(value) ? value : path.resolve(cwd, value);
-    try {
-        return fs.realpathSync(absolute);
-    }
-    catch {
-        return path.resolve(absolute);
-    }
-}
-function hookContinue(eventName, protocolId) {
-    void eventName;
-    void protocolId;
-    return {};
+    const candidate = fs.existsSync(cwd) ? fs.realpathSync(cwd) : path.resolve(cwd);
+    const projects = context.db.all("SELECT * FROM projects WHERE status = 'active'");
+    return projects
+        .filter((project) => {
+        const relative = path.relative(project.root, candidate);
+        return relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative));
+    })
+        .sort((left, right) => right.root.length - left.root.length)[0];
+}
+function hookEventKey(payload, eventName, toolName, command) {
+    const explicit = stringValue(payload.event_id) ?? stringValue(payload.delivery_id) ?? stringValue(payload.id);
+    if (explicit)
+        return explicit;
+    return crypto.createHash("sha256").update(JSON.stringify({
+        event: eventName,
+        session: stringValue(payload.session_id),
+        turn: stringValue(payload.turn_id),
+        tool: toolName ?? null,
+        command
+    })).digest("hex");
 }
 function commandFromPayload(payload) {
     const direct = stringValue(payload.command);
@@ -865,18 +711,6 @@ function toolNameFromPayload(payload) {
     const toolInput = objectRecord(payload.tool_input);
     return stringValue(toolInput.name);
 }
-function toolSucceeded(payload) {
-    const response = objectRecord(payload.tool_response);
-    const status = stringValue(payload.status) ?? stringValue(response.status);
-    if (!status) {
-        return true;
-    }
-    return ["success", "succeeded", "ok", "0"].includes(status.toLowerCase());
-}
-function handshakeFromCommand(command) {
-    const match = command.match(/\bdd-flow\s+protocol\s+register\s+([^\s]+)/);
-    return match?.[1] ?? null;
-}
 function sanitizedSummary(payload) {
     const summary = JSON.stringify(sanitizeValue(payload));
     return summary.length > maxSanitizedSummaryLength ? `${summary.slice(0, maxSanitizedSummaryLength)}...` : summary;