@deksden-com/dd-flow-cli 0.7.0 → 0.8.0

package/dist/services/schema-validation.js

@@ -3,6 +3,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { Ajv } from "ajv/dist/ajv.js";
+import { Ajv2020 } from "ajv/dist/2020.js";
 import { normalizeFlowContract } from "../domain/flow-contract.js";
 import { AppError } from "../shared/errors.js";
 import { findRunHome, readRunEngineBinding } from "./run-engine-bindings.js";
@@ -96,8 +97,24 @@ export function validateSchema(options) {
     const data = readJson(filePath, "input file");
     const schemaResolution = resolveSchema(options);
     const schema = readJson(schemaResolution.path, "schema");
-    const ajv = new Ajv({ allErrors: true, strict: false, validateFormats: false });
-    const validate = ajv.compile(schema);
+    // Ajv's default export only carries the draft-07 meta-schema.  New stage
+    // contracts may deliberately use draft 2020-12, so choose the validator
+    // from the declared schema rather than treating that declaration as data.
+    const schemaVersion = asRecord(schema) ? objectValue(asRecord(schema), "$schema") : undefined;
+    const ajv = schemaVersion === "https://json-schema.org/draft/2020-12/schema"
+        ? new Ajv2020({ allErrors: true, strict: false, validateFormats: false })
+        : new Ajv({ allErrors: true, strict: false, validateFormats: false });
+    let validate;
+    try {
+        validate = ajv.compile(schema);
+    }
+    catch (error) {
+        throw new AppError("schema_registry_invalid", "Schema cannot be compiled by the selected JSON Schema validator", 1, {
+            schema: schemaResolution,
+            declared_draft: schemaVersion ?? null,
+            cause: error instanceof Error ? error.message : String(error)
+        });
+    }
     const valid = validate(data);
     const errors = valid ? [] : (validate.errors ?? []).map(formatAjvError);
     const semanticErrors = valid ? validateSemanticSchema(options.schemaName, data) : [];
@@ -169,7 +186,8 @@ function resolveRunBoundSchema(options) {
     const data = readJson(path.resolve(options.file), "input file");
     const root = asRecord(data);
     const run = root ? asRecord(objectValue(root, "run")) : undefined;
-    const runId = run ? objectValue(run, "run_id") : objectValue(root ?? {}, "run_id");
+    const inferredRunId = run ? objectValue(run, "run_id") : objectValue(root ?? {}, "run_id");
+    const runId = options.runId ?? inferredRunId;
     if (typeof runId !== "string")
         return null;
     const projectRoot = path.resolve(options.projectRoot);

package/dist/services/sessions.js

@@ -141,7 +141,7 @@ export function stopMergeWorker(context, input) {
     return { ok: true, stopped_sessions: sessions.length, lock_release, waiter_cancellation };
 }
 export function stoppedMergeWorkerState(context, projectId, workerId) {
-    const latest = context.db.get(`SELECT status, stop_reason FROM flow_sessions
+    const latest = context.db.get(`SELECT status, stop_reason FROM sessions
      WHERE project_id = ? AND worker_id = ? AND flow_kind = 'merge_worker'
      ORDER BY updated_at DESC, rowid DESC LIMIT 1`, [projectId, workerId]);
     return {
@@ -151,21 +151,21 @@ export function stoppedMergeWorkerState(context, projectId, workerId) {
     };
 }
 export function activeFlowSessionsForProject(context, projectId) {
-    return context.db.all(`SELECT * FROM flow_sessions
+    return context.db.all(`SELECT * FROM sessions
      WHERE project_id = ? AND status IN ('pending', 'active', 'waiting_user', 'blocked', 'stopping')
      ORDER BY updated_at DESC`, [projectId]);
 }
 export function flowSessionsForProject(context, projectId, filter = {}) {
     if (filter.sessionId) {
-        return context.db.all("SELECT * FROM flow_sessions WHERE project_id = ? AND session_id = ? ORDER BY updated_at DESC", [projectId, filter.sessionId]);
+        return context.db.all("SELECT * FROM sessions WHERE project_id = ? AND session_id = ? ORDER BY updated_at DESC", [projectId, filter.sessionId]);
     }
     if (filter.workerId) {
-        return context.db.all("SELECT * FROM flow_sessions WHERE project_id = ? AND worker_id = ? ORDER BY updated_at DESC", [projectId, filter.workerId]);
+        return context.db.all("SELECT * FROM sessions WHERE project_id = ? AND worker_id = ? ORDER BY updated_at DESC", [projectId, filter.workerId]);
     }
-    return context.db.all("SELECT * FROM flow_sessions WHERE project_id = ? ORDER BY updated_at DESC", [projectId]);
+    return context.db.all("SELECT * FROM sessions WHERE project_id = ? ORDER BY updated_at DESC", [projectId]);
 }
 export function flowSessionById(context, projectId, sessionId) {
-    return context.db.get("SELECT * FROM flow_sessions WHERE project_id = ? AND session_id = ?", [
+    return context.db.get("SELECT * FROM sessions WHERE project_id = ? AND session_id = ?", [
         projectId,
         sessionId
     ]);
@@ -177,7 +177,7 @@ export function updateFlowSessionContinuation(context, projectId, sessionId, act
     }
     const actionHash = hashString(actionKey);
     const nextCount = session.last_action_hash === actionHash ? session.continuation_count + 1 : 1;
-    context.db.run(`UPDATE flow_sessions
+    context.db.run(`UPDATE sessions
      SET continuation_count = ?, last_action_hash = ?, updated_at = ?
      WHERE project_id = ? AND session_id = ?`, [nextCount, actionHash, context.now(), projectId, sessionId]);
     if (session.run_id)
@@ -200,7 +200,8 @@ export function flowSessionPayloadFromRegisterCommand(command) {
 function flowSessionPayloadFromStageStartCommand(command) {
     const projectRoot = optionFromCommand(command, "project-root");
     const stage = optionFromCommand(command, "stage");
-    const run = command.match(/\bdd-flow\s+stage\s+start\s+([^\s]+)/)?.[1];
+    const rawRun = command.match(/\bdd-flow\s+stage\s+start\s+("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[^\s]+)/)?.[1];
+    const run = rawRun ? shellArgument(rawRun) : undefined;
     if (!projectRoot || !stage || !run || run.startsWith("--"))
         return undefined;
     return {
@@ -248,6 +249,14 @@ function normalizeFlowSessionPayload(payload) {
     const sessionId = stringField(payload, "session_id", false);
     return {
         ...(sessionId ? { session_id: sessionId } : {}),
+        harness: stringField(payload, "harness", false) ?? "codex-desktop",
+        provider_session_id: stringField(payload, "provider_session_id", false) ?? null,
+        agent_id: stringField(payload, "agent_id", false) ?? null,
+        provider: stringField(payload, "provider", false) ?? null,
+        model: stringField(payload, "model", false) ?? null,
+        reasoning: stringField(payload, "reasoning", false) ?? null,
+        mode: stringField(payload, "mode", false) ?? null,
+        agent_type: stringField(payload, "agent_type", false) ?? null,
         project_root: projectRoot,
         flow_kind: flowKind,
         run_id: stringField(payload, "run_id", false) ?? null,
@@ -272,17 +281,28 @@ function upsertFlowSession(context, project, payload, forcedSessionId) {
     const now = context.now();
     const sessionId = forcedSessionId ?? payload.session_id ?? payload.worker_id ?? payload.protocol_id ?? crypto.randomUUID();
     const workspacePath = payload.workspace_path ?? payload.cwd ?? project.root;
-    context.db.run(`INSERT INTO flow_sessions
-      (session_id, project_id, project_root, flow_kind, status, run_id, parent_session_id, role, aspect_id, plan_item_id, session_kind, protocol_id, worker_id, workspace_path,
+    context.db.run(`INSERT INTO sessions
+      (session_id, project_id, harness, provider_session_id, agent_id, provider, model, reasoning, mode, agent_type, project_root, flow_kind, status, run_id, parent_session_id, role, aspect_id, plan_item_id, session_kind, protocol_id, worker_id, workspace_path,
        continuation_policy, current_stage, next_action, last_action_hash, continuation_count, stop_reason,
        transcript_path, cwd, metadata_json, coverage_units_json, created_at, updated_at, stopped_at)
      VALUES (
-       ?, ?, ?, ?, 'active',
+       ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'active',
        ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, 0, NULL,
        ?, ?, ?, ?, ?, ?, NULL
      )
      ON CONFLICT(session_id, project_id) DO UPDATE SET
        project_root = excluded.project_root,
+       harness = CASE
+         WHEN sessions.harness <> 'codex-desktop' AND excluded.harness = 'codex-desktop' THEN sessions.harness
+         ELSE excluded.harness
+       END,
+       provider_session_id = COALESCE(excluded.provider_session_id, provider_session_id),
+       agent_id = COALESCE(excluded.agent_id, agent_id),
+       provider = COALESCE(excluded.provider, provider),
+       model = COALESCE(excluded.model, model),
+       reasoning = COALESCE(excluded.reasoning, reasoning),
+       mode = COALESCE(excluded.mode, mode),
+       agent_type = COALESCE(excluded.agent_type, agent_type),
        flow_kind = excluded.flow_kind,
        status = 'active',
        run_id = excluded.run_id,
@@ -306,6 +326,14 @@ function upsertFlowSession(context, project, payload, forcedSessionId) {
        stopped_at = NULL`, [
         sessionId,
         project.id,
+        payload.harness ?? "codex-desktop",
+        payload.provider_session_id ?? null,
+        payload.agent_id ?? null,
+        payload.provider ?? null,
+        payload.model ?? null,
+        payload.reasoning ?? null,
+        payload.mode ?? null,
+        payload.agent_type ?? null,
         project.root,
         payload.flow_kind,
         payload.run_id ?? null,
@@ -338,7 +366,7 @@ function requireFlowSession(context, projectId, sessionId) {
 }
 function markSessionStopped(context, project, session, reason) {
     const now = context.now();
-    context.db.run(`UPDATE flow_sessions
+    context.db.run(`UPDATE sessions
      SET status = 'stopped', stop_reason = ?, updated_at = ?, stopped_at = ?
      WHERE project_id = ? AND session_id = ?`, [reason, now, now, project.id, session.session_id]);
     if (session.run_id && session.session_kind !== "orchestrator") {
@@ -399,6 +427,17 @@ function optionFromCommand(command, key) {
     const match = command.match(pattern);
     return match?.[1] ?? match?.[2] ?? match?.[3];
 }
+function shellArgument(raw) {
+    if (raw.startsWith('"')) {
+        try {
+            return JSON.parse(raw);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return raw.startsWith("'") ? raw.slice(1, -1) : raw;
+}
 function sanitizeValue(value) {
     if (Array.isArray(value)) {
         return value.map(sanitizeValue);

package/dist/services/stage-blocker.js

@@ -0,0 +1,57 @@
+import { AppError } from "../shared/errors.js";
+import { resolveProjectRoot } from "../storage/paths.js";
+import { requireProjectByRoot } from "./projects.js";
+import { blockFlowRunStage, unblockFlowRunStage } from "./runs.js";
+import { flowCommand } from "./stage-pause.js";
+import { refreshRunWorkProjection } from "./work-registry.js";
+export function blockStageForRuntime(context, input) {
+    const projectRoot = resolveProjectRoot(input.projectRoot);
+    const project = requireProjectByRoot(context, projectRoot);
+    const run = requireRun(context, project.id, input.runId);
+    const work = requireWork(context, project.id, run.id, input.workId);
+    if (work.status !== "running")
+        throw new AppError("invalid_work_state", "Only a running Work can be blocked", 1, { work_id: work.work_id, status: work.status });
+    if (!input.code.trim() || !input.summary.trim())
+        throw new AppError("validation", "stage block requires a code and summary", 2);
+    const state = blockFlowRunStage(context, { ...input, projectRoot });
+    const now = context.now();
+    context.db.run("UPDATE works SET status = 'paused', updated_at = ? WHERE work_id = ? AND status = 'running'", [now, work.work_id]);
+    refreshRunWorkProjection(context, project.id, work.run_id);
+    const resumeCommand = `${flowCommand(context)} stage unblock ${work.run_id} --stage ${input.stage} --work ${work.work_id} --project-root ${JSON.stringify(projectRoot)} --json`;
+    return {
+        ok: true,
+        outcome: "blocked",
+        run_id: work.run_id,
+        stage: input.stage,
+        work_id: work.work_id,
+        blocker: { kind: input.kind, code: input.code, summary: input.summary, retryable: input.retryable },
+        next_action: "repair_external_blocker_then_unblock_same_stage",
+        unblock_command: resumeCommand,
+        state
+    };
+}
+export function unblockStageAfterRuntimeRepair(context, input) {
+    const projectRoot = resolveProjectRoot(input.projectRoot);
+    const project = requireProjectByRoot(context, projectRoot);
+    const run = requireRun(context, project.id, input.runId);
+    const work = requireWork(context, project.id, run.id, input.workId);
+    if (work.status !== "paused")
+        throw new AppError("invalid_work_state", "stage unblock requires its paused Work", 1, { work_id: work.work_id, status: work.status });
+    const state = unblockFlowRunStage(context, { projectRoot, runId: work.run_id, stage: input.stage, workId: work.work_id });
+    const now = context.now();
+    context.db.run("UPDATE works SET status = 'running', updated_at = ? WHERE work_id = ? AND status = 'paused'", [now, work.work_id]);
+    refreshRunWorkProjection(context, project.id, work.run_id);
+    return { ok: true, outcome: "resumed", run_id: work.run_id, stage: input.stage, work_id: work.work_id, next_action: `continue_${input.stage}`, state };
+}
+function requireWork(context, projectId, runId, workId) {
+    const work = context.db.get("SELECT work_id, project_id, run_id, status FROM works WHERE project_id = ? AND run_id = ? AND work_id = ?", [projectId, runId, workId]);
+    if (!work)
+        throw new AppError("not_found", "Work does not belong to this RUN", 1, { run_id: runId, work_id: workId });
+    return work;
+}
+function requireRun(context, projectId, runId) {
+    const rows = context.db.all("SELECT id, short_id FROM runs WHERE project_id = ? AND (id = ? OR short_id = ?)", [projectId, runId, runId]);
+    if (rows.length !== 1)
+        throw new AppError(rows.length ? "ambiguous_alias" : "not_found", rows.length ? "RUN alias is ambiguous" : "RUN is not registered", 1, { run_id: runId });
+    return rows[0];
+}

package/dist/services/stage-context.js

@@ -0,0 +1,90 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { AppError } from "../shared/errors.js";
+import { parseJsonObject } from "../shared/json.js";
+export function loadExternalStageContext(input) {
+    const sourcePath = path.resolve(input.file);
+    if (!fs.existsSync(sourcePath) || !fs.statSync(sourcePath).isFile())
+        throw new AppError("not_found", "Stage context file is missing", 2, { context_file: sourcePath });
+    const bytes = fs.readFileSync(sourcePath);
+    const materializedSha256 = sha256(bytes);
+    if (materializedSha256 !== input.expectedSha256)
+        throw new AppError("context_checksum_mismatch", "Stage context checksum does not match --context-sha256", 2, { context_file: sourcePath, expected_sha256: input.expectedSha256, actual_sha256: materializedSha256 });
+    const value = parseJsonObject(bytes.toString("utf8"), "stage context");
+    validateContext(value, input.stage);
+    return { value, sourcePath, materializedSha256 };
+}
+/** Installs exactly one immutable external context for a stage attempt. */
+export function installExternalStageContext(input) {
+    fs.mkdirSync(input.stageRoot, { recursive: true });
+    const destination = path.join(input.stageRoot, "stage-context.json");
+    if (fs.existsSync(destination)) {
+        const existing = sha256(fs.readFileSync(destination));
+        if (existing !== input.loaded.materializedSha256)
+            throw new AppError("stage_context_replacement", "A different stage context is already installed for this Stage", 2, { stage_context: destination, expected_sha256: input.loaded.materializedSha256, actual_sha256: existing });
+    }
+    else {
+        // The receipt is the hash of the runner-materialized bytes, not of a
+        // convenient reserialization.  Preserve those exact bytes as evidence.
+        const temporary = `${destination}.${process.pid}.tmp`;
+        fs.copyFileSync(input.loaded.sourcePath, temporary);
+        fs.renameSync(temporary, destination);
+    }
+    return {
+        path: destination,
+        materialized_sha256: input.loaded.materializedSha256,
+        semantic_package_sha256: input.loaded.value.semantic_package_sha256 ?? null,
+        context_slice_sha256: input.loaded.value.context_slice_sha256 ?? null
+    };
+}
+/** Install the runner slice and make it visible in the agent packet before a
+ * caller performs its lifecycle transition. */
+export function applyExternalStageContext(input) {
+    if (!input.loaded)
+        return undefined;
+    const installed = installExternalStageContext({ stageRoot: input.stageRoot, loaded: input.loaded });
+    const marker = "<external_stage_context>";
+    const current = fs.existsSync(input.promptPath) ? fs.readFileSync(input.promptPath, "utf8") : "";
+    if (!current.includes(marker)) {
+        fs.writeFileSync(input.promptPath, `${renderExternalStageContext({ loaded: input.loaded, installed })}\n\n${current}`);
+    }
+    return installed;
+}
+export function renderExternalStageContext(input) {
+    const value = input.loaded.value;
+    const sources = value.sources ?? [];
+    const taskInput = value.task_input ?? [];
+    const decisions = value.accepted_decisions ?? [];
+    return [
+        "<external_stage_context>",
+        `- materialized context: ${String(input.installed.path)}`,
+        `- materialized SHA-256: ${input.loaded.materializedSha256}`,
+        `- semantic package SHA-256: ${value.semantic_package_sha256 ?? "not supplied"}`,
+        `- context slice SHA-256: ${value.context_slice_sha256 ?? "not supplied"}`,
+        "</external_stage_context>", "",
+        "<objective>", value.objective, "</objective>", "",
+        "<required_inputs>",
+        ...(taskInput.length ? taskInput.map((item) => `- ${item.role}: ${item.path}`) : ["- No separate task-input file is declared."]),
+        "</required_inputs>", "",
+        "<project_context>",
+        ...(sources.length ? sources.map((item) => `- ${item.role}: ${item.path}${item.required === false ? " (optional)" : ""} — ${item.reason}`) : ["- No extra project sources are declared."]),
+        "</project_context>", "",
+        "<accepted_decisions>",
+        ...(decisions.length ? decisions.map((item) => `- ${typeof item === "string" ? item : `${item.id ? `${item.id}: ` : ""}${item.statement ?? ""}`}`) : ["- No additional accepted decisions."]),
+        "</accepted_decisions>"
+    ].join("\n");
+}
+function validateContext(value, expectedStage) {
+    if (value.schema_id !== "dd-eval/stage-context@1")
+        throw new AppError("validation", "Stage context must use dd-eval/stage-context@1", 2);
+    if (value.stage !== expectedStage)
+        throw new AppError("validation", "Stage context does not match --stage", 2, { expected_stage: expectedStage, context_stage: value.stage });
+    if (!value.objective?.trim())
+        throw new AppError("validation", "Stage context objective is required", 2);
+    for (const source of value.sources ?? []) {
+        if (!source.role?.trim() || !source.path?.trim() || !source.reason?.trim())
+            throw new AppError("validation", "Every stage context source needs role, path and reason", 2);
+    }
+}
+function sha256(value) { return crypto.createHash("sha256").update(value).digest("hex"); }