@deksden-com/dd-flow-cli 0.4.2 → 0.5.0

package/dist/services/schema-validation.js

@@ -1,9 +1,65 @@
+import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { Ajv } from "ajv/dist/ajv.js";
 import { normalizeFlowContract } from "../domain/flow-contract.js";
 import { AppError } from "../shared/errors.js";
+export function captureMemoryBankBaseline(input) {
+    const projectRoot = path.resolve(input.projectRoot);
+    const paths = normalizeMemoryBankPaths(projectRoot, input.paths);
+    if (paths.length === 0) {
+        throw new AppError("validation", "Memory Bank baseline requires at least one exact target path", 2);
+    }
+    return {
+        schema_id: "dd-flow/memory-bank-baseline@1",
+        project_root: projectRoot,
+        paths: Object.fromEntries(paths.map((relativePath) => [relativePath, snapshotMemoryBankPath(projectRoot, relativePath)]))
+    };
+}
+export function validateMemoryBankDelta(input) {
+    const projectRoot = path.resolve(input.projectRoot);
+    if (input.baseline.schema_id !== "dd-flow/memory-bank-baseline@1" || path.resolve(input.baseline.project_root) !== projectRoot) {
+        throw new AppError("validation", "Memory Bank baseline does not belong to this project root", 2, {
+            baseline_root: input.baseline.project_root,
+            project_root: projectRoot
+        });
+    }
+    const paths = normalizeMemoryBankPaths(projectRoot, Object.keys(input.baseline.paths));
+    if (paths.length === 0) {
+        throw new AppError("validation", "Memory Bank baseline has no exact target paths", 2);
+    }
+    const after = Object.fromEntries(paths.map((relativePath) => [relativePath, snapshotMemoryBankPath(projectRoot, relativePath)]));
+    const snapshots = paths.map((relativePath) => {
+        const before = input.baseline.paths[relativePath];
+        const current = after[relativePath];
+        if (!before || !current) {
+            throw new AppError("validation", `Memory Bank baseline snapshot is incomplete: ${relativePath}`, 2);
+        }
+        return { relativePath, before, after: current };
+    });
+    const changedSnapshots = snapshots.filter(({ before, after: current }) => !sameMemoryBankSnapshot(before, current));
+    const changed = changedSnapshots.map(({ relativePath }) => relativePath);
+    const added = changedSnapshots.filter(({ before, after: current }) => !before.exists && current.exists).map(({ relativePath }) => relativePath);
+    const removed = changedSnapshots.filter(({ before, after: current }) => before.exists && !current.exists).map(({ relativePath }) => relativePath);
+    const findings = [];
+    for (const { relativePath, after: snapshot } of changedSnapshots) {
+        if (!snapshot.exists) {
+            findings.push({ path: relativePath, severity: "error", code: "deleted_target", message: "Tracked Memory Bank target was deleted" });
+            continue;
+        }
+        findings.push(...validateChangedMemoryFile(projectRoot, relativePath));
+    }
+    return {
+        schema_id: "dd-flow/memory-bank-delta-validation@1",
+        ok: findings.length === 0,
+        project_root: projectRoot,
+        checked_paths: paths,
+        baseline: input.baseline.paths,
+        delta: { changed, added, removed },
+        findings
+    };
+}
 const schemaNamePattern = /^[a-z0-9][a-z0-9-]*$/;
 const mandatoryMbUpgradeReviewAspectIds = [
     "01-goal-and-delivery",
@@ -37,7 +93,7 @@ export function validateSchema(options) {
     }
     const filePath = path.resolve(options.file);
     const data = readJson(filePath, "input file");
-    const schemaResolution = resolveSchema(options, data);
+    const schemaResolution = resolveSchema(options);
     const schema = readJson(schemaResolution.path, "schema");
     const ajv = new Ajv({ allErrors: true, strict: false, validateFormats: false });
     const validate = ajv.compile(schema);
@@ -59,12 +115,8 @@ export function validateSchema(options) {
         errors: []
     };
 }
-function resolveSchema(options, data) {
-    const dataRecord = asRecord(data);
-    const dataSchemaId = dataRecord ? stringValue(dataRecord, "schema_id") : undefined;
-    const fileNames = options.schemaName === "flow-run-index" && dataSchemaId === "dd-flow/flow-run-index@3"
-        ? ["flow-run-index-v3.schema.json", "flow-run-index.schema.json"]
-        : [`${options.schemaName}.schema.json`];
+function resolveSchema(options) {
+    const fileNames = [`${options.schemaName}.schema.json`];
     const projectRoot = path.resolve(options.projectRoot ?? process.cwd());
     const roots = [
         ...(options.schemaDir ? [{ directory: path.resolve(options.schemaDir), source: "schema_dir" }] : []),
@@ -262,6 +314,115 @@ function validateMbSdlcReviewReport(root) {
     });
     return errors;
 }
+function normalizeMemoryBankPaths(projectRoot, inputs) {
+    return [...new Set(inputs.map((input) => {
+            const absolute = resolveMemoryBankPath(projectRoot, input);
+            const relative = path.relative(projectRoot, absolute);
+            if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) {
+                throw new AppError("validation", "Memory Bank target must remain inside project root", 2, { target: input });
+            }
+            return relative;
+        }))].sort();
+}
+function resolveMemoryBankPath(projectRoot, input) {
+    const absolute = path.isAbsolute(input) ? path.resolve(input) : path.resolve(projectRoot, input);
+    const relative = path.relative(projectRoot, absolute);
+    if (relative.startsWith("..") || path.isAbsolute(relative)) {
+        throw new AppError("validation", "Memory Bank target must remain inside project root", 2, { target: input });
+    }
+    const existing = nearestExistingPath(absolute);
+    if (existing) {
+        const realRoot = fs.realpathSync(projectRoot);
+        const realExisting = fs.realpathSync(existing);
+        const realResolved = path.resolve(realExisting, path.relative(existing, absolute));
+        const realRelative = path.relative(realRoot, realResolved);
+        if (realRelative.startsWith("..") || path.isAbsolute(realRelative)) {
+            throw new AppError("validation", "Memory Bank target escapes project root through a symlink", 2, { target: input });
+        }
+    }
+    return absolute;
+}
+function nearestExistingPath(target) {
+    let current = target;
+    while (!fs.existsSync(current)) {
+        const parent = path.dirname(current);
+        if (parent === current)
+            return undefined;
+        current = parent;
+    }
+    return current;
+}
+function snapshotMemoryBankPath(projectRoot, relativePath) {
+    const absolute = resolveMemoryBankPath(projectRoot, relativePath);
+    if (!fs.existsSync(absolute))
+        return { exists: false, bytes: null, sha256: null };
+    let stat;
+    let content;
+    try {
+        stat = fs.statSync(absolute);
+        if (!stat.isFile())
+            throw new Error("target is not a file");
+        content = fs.readFileSync(absolute);
+    }
+    catch (error) {
+        throw new AppError("validation", `Cannot snapshot Memory Bank target: ${relativePath}`, 2, { cause: String(error) });
+    }
+    return {
+        exists: true,
+        bytes: content.byteLength,
+        sha256: crypto.createHash("sha256").update(content).digest("hex")
+    };
+}
+function sameMemoryBankSnapshot(before, after) {
+    return Boolean(before)
+        && before?.exists === after.exists
+        && before?.bytes === after.bytes
+        && before?.sha256 === after.sha256;
+}
+function validateChangedMemoryFile(projectRoot, relativePath) {
+    const absolute = resolveMemoryBankPath(projectRoot, relativePath);
+    let content;
+    try {
+        content = fs.readFileSync(absolute, "utf8");
+    }
+    catch (error) {
+        return [{ path: relativePath, severity: "error", code: "unreadable_target", message: String(error) }];
+    }
+    const findings = [];
+    if (path.extname(relativePath).toLowerCase() === ".json") {
+        try {
+            JSON.parse(content);
+        }
+        catch (error) {
+            findings.push({ path: relativePath, severity: "error", code: "invalid_json", message: String(error) });
+        }
+    }
+    const markdownLinkPattern = /\]\((<[^>]+>|[^)\s]+)(?:\s+["'][^)]*["'])?\)/g;
+    for (const match of content.matchAll(markdownLinkPattern)) {
+        const capturedTarget = match[1];
+        if (!capturedTarget)
+            continue;
+        const rawTarget = capturedTarget.replace(/^<|>$/g, "");
+        if (/^(?:[a-z][a-z0-9+.-]*:|\/\/|#)/i.test(rawTarget))
+            continue;
+        const linkTarget = rawTarget.split(/[?#]/, 1)[0];
+        if (!linkTarget)
+            continue;
+        let resolved;
+        try {
+            const linkedAbsolute = path.resolve(path.dirname(path.join(projectRoot, relativePath)), linkTarget);
+            resolved = resolveMemoryBankPath(projectRoot, path.relative(projectRoot, linkedAbsolute));
+        }
+        catch (error) {
+            findings.push({ path: relativePath, severity: "error", code: "path_escape", message: String(error) });
+            continue;
+        }
+        if (!fs.existsSync(resolved)) {
+            findings.push({ path: relativePath, severity: "error", code: "missing_link", message: `Linked path does not exist: ${linkTarget}` });
+        }
+    }
+    return findings;
+}
 function asRecord(value) {
     return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
 }

package/dist/services/sessions.js

@@ -9,6 +9,58 @@ import { cancelLaneWaitersForWorker } from "./lanes.js";
 import { checkpointSessionUsage } from "./usage.js";
 import { refreshRunSessionProjection } from "./run-projection.js";
 import { appendFlowRunTimelineEvent } from "./runs.js";
+export function recordFlowSessionObservation(context, input) {
+    const duplicate = context.db.get("SELECT id FROM flow_session_segments WHERE project_id = ? AND event_key = ?", [input.projectId, input.eventKey]);
+    if (duplicate)
+        return { changed: false, segment_id: duplicate.id };
+    const open = context.db.get(`SELECT id, run_id, protocol_id FROM flow_session_segments
+     WHERE project_id = ? AND session_id = ? AND ended_at IS NULL ORDER BY started_at DESC, id DESC LIMIT 1`, [input.projectId, input.sessionId]);
+    const now = context.now();
+    const runId = input.runId ?? null;
+    const protocolId = input.protocolId ?? null;
+    if (open && open.run_id === runId && open.protocol_id === protocolId) {
+        return { changed: false, segment_id: open.id };
+    }
+    if (open)
+        context.db.run("UPDATE flow_session_segments SET ended_at = ? WHERE id = ? AND ended_at IS NULL", [now, open.id]);
+    const result = context.db.run(`INSERT INTO flow_session_segments
+      (project_id, session_id, run_id, protocol_id, started_at, ended_at, cwd, tool_name, event_key)
+     VALUES (?, ?, ?, ?, ?, NULL, ?, ?, ?)`, [input.projectId, input.sessionId, runId, protocolId, now, input.cwd ?? null, input.toolName ?? null, input.eventKey]);
+    return { changed: true, segment_id: Number(result.lastInsertRowid) };
+}
+export function bindObservedFlowSession(context, project, payload, sessionId) {
+    if (resolveProjectRoot(payload.project_root) !== project.root) {
+        throw new AppError("project_mismatch", "Observed session payload project_root does not match hook cwd project", 1, {
+            expected: project.root,
+            actual: payload.project_root
+        });
+    }
+    const session = upsertFlowSession(context, project, payload, sessionId);
+    if (session.session_kind !== "orchestrator") {
+        const now = context.now();
+        for (const unit of payload.coverage_units ?? []) {
+            if (!unit.job_id)
+                continue;
+            context.db.run(`UPDATE flow_jobs SET status = 'running', worker_session_id = ?, attempts = attempts + 1, started_at = COALESCE(started_at, ?), updated_at = ?
+         WHERE project_id = ? AND run_id = ? AND job_id = ? AND status IN ('pending', 'failed')`, [session.session_id, now, now, project.id, session.run_id ?? "", unit.job_id]);
+        }
+    }
+    if (session.run_id)
+        refreshRunSessionProjection(context, project.id, session.run_id);
+    return session;
+}
+export function registerFlowJob(context, input) {
+    const jobId = input.jobId ?? `JOB-${input.runId}-${input.planItemId}`.replace(/[^A-Za-z0-9_-]+/g, "-");
+    const now = context.now();
+    context.db.run(`INSERT INTO flow_jobs (job_id, project_id, run_id, protocol_id, plan_item_id, group_id, status, worker_session_id, attempts, last_error, registered_at, updated_at, started_at, finished_at)
+     VALUES (?, ?, ?, ?, ?, ?, 'pending', NULL, 0, NULL, ?, ?, NULL, NULL)
+     ON CONFLICT(project_id, run_id, plan_item_id) DO UPDATE SET protocol_id = excluded.protocol_id, group_id = excluded.group_id, updated_at = excluded.updated_at`, [jobId, input.projectId, input.runId, input.protocolId ?? null, input.planItemId, input.groupId ?? null, now, now]);
+    refreshRunSessionProjection(context, input.projectId, input.runId);
+    return context.db.get("SELECT * FROM flow_jobs WHERE project_id = ? AND run_id = ? AND plan_item_id = ?", [input.projectId, input.runId, input.planItemId]) ?? { job_id: jobId };
+}
+export function flowJobsForRun(context, projectId, runId) {
+    return context.db.all("SELECT * FROM flow_jobs WHERE project_id = ? AND run_id = ? ORDER BY plan_item_id", [projectId, runId]);
+}
 export function registerFlowSession(context, input) {
     const payload = decodeFlowSessionPayload(input);
     const project = requireProjectByRoot(context, resolveProjectRoot(payload.project_root));
@@ -36,12 +88,78 @@ export function registerFlowSession(context, input) {
 }
 export function getFlowSessionStatus(context, input) {
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    const sessions = flowSessionsForProject(context, project.id, {
+        sessionId: input.sessionId,
+        workerId: input.workerId
+    });
     return {
         ok: true,
-        sessions: flowSessionsForProject(context, project.id, {
-            sessionId: input.sessionId,
-            workerId: input.workerId
-        })
+        sessions,
+        coverage: reconcileSessionCoverage(sessions)
+    };
+}
+export function reconcileSessionCoverage(sessions) {
+    const sessionCounts = countValues(sessions.map((session) => session.session_id));
+    const duplicateSessionIds = [...sessionCounts.entries()].filter(([, count]) => count > 1).map(([id]) => id).sort();
+    const invalidSessionIds = [];
+    const parsed = sessions.map((session) => {
+        try {
+            return { session, units: normalizeCoverageUnits(JSON.parse(session.coverage_units_json || "[]")) };
+        }
+        catch {
+            invalidSessionIds.push(session.session_id);
+            return { session, units: [] };
+        }
+    });
+    const orchestrators = parsed.filter(({ session }) => session.session_kind === "orchestrator");
+    const expectedCounts = countValues(orchestrators.flatMap(({ units }) => units.map((unit) => unit.unit_id)));
+    const expectedUnitIds = [...expectedCounts.keys()].sort();
+    const duplicateExpectedUnitIds = [...expectedCounts.entries()].filter(([, count]) => count > 1).map(([id]) => id).sort();
+    const observedOwners = new Map();
+    for (const { session, units } of parsed) {
+        if (session.session_kind === "orchestrator")
+            continue;
+        for (const unit of units) {
+            const owners = observedOwners.get(unit.unit_id) ?? [];
+            owners.push(session.session_id);
+            observedOwners.set(unit.unit_id, owners);
+        }
+    }
+    const observedUnitIds = [...observedOwners.keys()].sort();
+    const missingUnitIds = expectedUnitIds.filter((unitId) => !observedOwners.has(unitId));
+    const duplicateUnitIds = [...observedOwners.entries()].filter(([, owners]) => new Set(owners).size > 1).map(([id]) => id).sort();
+    const diagnostics = [];
+    if (orchestrators.length === 0)
+        diagnostics.push("orchestrator_session_missing");
+    if (orchestrators.length > 1)
+        diagnostics.push("multiple_orchestrator_sessions");
+    if (expectedUnitIds.length === 0)
+        diagnostics.push("expected_worker_units_missing");
+    if (missingUnitIds.length > 0)
+        diagnostics.push("expected_worker_units_unobserved");
+    if (duplicateUnitIds.length > 0 || duplicateExpectedUnitIds.length > 0)
+        diagnostics.push("duplicate_coverage_binding");
+    if (duplicateSessionIds.length > 0)
+        diagnostics.push("duplicate_session_binding");
+    if (invalidSessionIds.length > 0)
+        diagnostics.push("invalid_coverage_units");
+    const unavailable = orchestrators.length === 0 || expectedUnitIds.length === 0 || invalidSessionIds.length > 0;
+    const partial = orchestrators.length !== 1
+        || missingUnitIds.length > 0
+        || duplicateUnitIds.length > 0
+        || duplicateExpectedUnitIds.length > 0
+        || duplicateSessionIds.length > 0;
+    return {
+        status: unavailable ? "unavailable" : partial ? "partial" : "complete",
+        expected_unit_ids: expectedUnitIds,
+        observed_unit_ids: observedUnitIds,
+        missing_unit_ids: missingUnitIds,
+        duplicate_unit_ids: duplicateUnitIds,
+        duplicate_expected_unit_ids: duplicateExpectedUnitIds,
+        duplicate_session_ids: duplicateSessionIds,
+        orchestrator_session_ids: orchestrators.map(({ session }) => session.session_id).sort(),
+        invalid_session_ids: [...new Set(invalidSessionIds)].sort(),
+        diagnostics
     };
 }
 export function stopFlowSession(context, input) {
@@ -126,63 +244,6 @@ export function updateFlowSessionContinuation(context, projectId, sessionId, act
         refreshRunSessionProjection(context, projectId, session.run_id);
     return nextCount;
 }
-export function recordPendingFlowSessionBinding(context, project, input) {
-    const payload = flowSessionPayloadFromRegisterCommand(input.command);
-    if (!payload) {
-        return { recorded: false };
-    }
-    const payloadRoot = resolveProjectRoot(payload.project_root);
-    if (payloadRoot !== project.root) {
-        throw new AppError("project_mismatch", "Session register payload project_root does not match hook project", 1, {
-            expected: project.root,
-            actual: payloadRoot
-        });
-    }
-    const now = context.now();
-    context.db.run(`INSERT INTO pending_flow_session_bindings
-      (session_id, project_id, payload_json, cwd, transcript_path, turn_id, status, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?, 'observed', ?, ?)
-     ON CONFLICT(session_id, project_id) DO UPDATE SET
-       payload_json = excluded.payload_json,
-       cwd = COALESCE(excluded.cwd, cwd),
-       transcript_path = COALESCE(excluded.transcript_path, transcript_path),
-       turn_id = excluded.turn_id,
-       status = 'observed',
-       updated_at = excluded.updated_at`, [
-        input.sessionId,
-        project.id,
-        JSON.stringify(sanitizeSessionPayload(payload)),
-        input.cwd ?? payload.cwd ?? null,
-        input.transcriptPath ?? payload.transcript_path ?? null,
-        input.turnId ?? null,
-        now,
-        now
-    ]);
-    return { recorded: true, payload };
-}
-export function confirmPendingFlowSessionBinding(context, project, input) {
-    const pending = context.db.get("SELECT * FROM pending_flow_session_bindings WHERE project_id = ? AND session_id = ? AND status = 'observed'", [project.id, input.sessionId]);
-    if (!pending) {
-        return undefined;
-    }
-    const payload = normalizeFlowSessionPayload(JSON.parse(pending.payload_json));
-    const session = upsertFlowSession(context, project, {
-        ...payload,
-        cwd: pending.cwd ?? payload.cwd ?? null,
-        transcript_path: pending.transcript_path ?? payload.transcript_path ?? null
-    }, input.sessionId);
-    if (session.run_id)
-        refreshRunSessionProjection(context, project.id, session.run_id);
-    context.db.run(`UPDATE pending_flow_session_bindings SET status = 'confirmed', updated_at = ?
-     WHERE project_id = ? AND session_id = ?`, [context.now(), project.id, input.sessionId]);
-    appendAudit(context, {
-        projectId: project.id,
-        eventType: "flow_session.bound",
-        payload: { project_id: project.id, session_id: input.sessionId, flow_kind: session.flow_kind },
-        ...(session.protocol_id ? { protocolId: session.protocol_id } : {})
-    });
-    return session;
-}
 export function flowSessionPayloadFromRegisterCommand(command) {
     if (!/\bdd-flow\s+session\s+register\b/.test(command)) {
         return undefined;
@@ -320,6 +381,10 @@ function markSessionStopped(context, project, session, reason) {
     context.db.run(`UPDATE flow_sessions
      SET status = 'stopped', stop_reason = ?, updated_at = ?, stopped_at = ?
      WHERE project_id = ? AND session_id = ?`, [reason, now, now, project.id, session.session_id]);
+    if (session.run_id && session.session_kind !== "orchestrator") {
+        context.db.run(`UPDATE flow_jobs SET status = 'pending', worker_session_id = NULL, last_error = ?, updated_at = ?
+       WHERE project_id = ? AND run_id = ? AND worker_session_id = ? AND status = 'running'`, [reason, now, project.id, session.run_id, session.session_id]);
+    }
     if (session.run_id)
         appendFlowRunTimelineEvent(context, project.id, session.run_id, { type: "session_stopped", session_id: session.session_id });
     if (session.run_id)
@@ -374,13 +439,6 @@ function optionFromCommand(command, key) {
     const match = command.match(pattern);
     return match?.[1] ?? match?.[2] ?? match?.[3];
 }
-function sanitizeSessionPayload(payload) {
-    return {
-        ...payload,
-        next_action: redactString(payload.next_action ?? null),
-        metadata: sanitizeValue(payload.metadata ?? {})
-    };
-}
 function sanitizeValue(value) {
     if (Array.isArray(value)) {
         return value.map(sanitizeValue);
@@ -442,6 +500,12 @@ function normalizeCoverageUnits(value) {
         return { unit_id: object.unit_id, group_id: optional("group_id"), job_id: optional("job_id"), kind: optional("kind") };
     });
 }
+function countValues(values) {
+    const counts = new Map();
+    for (const value of values)
+        counts.set(value, (counts.get(value) ?? 0) + 1);
+    return counts;
+}
 function requiredStringField(payload, key) {
     const value = stringField(payload, key, true);
     if (!value) {