@deksden-com/dd-flow-cli 0.7.0 → 0.8.0

package/dist/services/cleanup.js

@@ -68,7 +68,7 @@ export function cleanupScan(context, input) {
             action: { kind: "cancel_queue_job", project_id: project.id, protocol_id: job.protocol_id }
         });
     }
-    const staleSessions = context.db.all(`SELECT session_id, protocol_id, workspace_path FROM flow_sessions
+    const staleSessions = context.db.all(`SELECT session_id, protocol_id, workspace_path FROM sessions
      WHERE project_id = ? AND status IN ('pending', 'active', 'waiting_user', 'blocked', 'stopping')
      ORDER BY updated_at ASC, session_id ASC`, [project.id]);
     for (const session of staleSessions) {
@@ -87,7 +87,7 @@ export function cleanupScan(context, input) {
             });
         }
     }
-    const staleRuns = context.db.all(`SELECT id, runtime_path, run_dir, workspace_root FROM flow_runs
+    const staleRuns = context.db.all(`SELECT id, runtime_path, run_dir, workspace_root FROM runs
      WHERE project_id = ? AND status = 'running'
      ORDER BY updated_at ASC, id ASC`, [project.id]);
     for (const run of staleRuns) {
@@ -306,7 +306,7 @@ function applyAction(context, action, reason, force, now) {
         return { kind: action.kind, changed: true, protocol_id: action.protocol_id };
     }
     if (action.kind === "close_flow_session" && action.session_id) {
-        const result = context.db.run(`UPDATE flow_sessions SET status = 'stopped', stop_reason = ?, updated_at = ?, stopped_at = ?
+        const result = context.db.run(`UPDATE sessions SET status = 'stopped', stop_reason = ?, updated_at = ?, stopped_at = ?
        WHERE project_id = ? AND session_id = ? AND status IN ('pending', 'active', 'waiting_user', 'blocked', 'stopping')`, [reason, now, now, action.project_id, action.session_id]);
         if (result.changes !== 1) {
             return { kind: action.kind, changed: false, skipped: true, reason: "already_stopped", session_id: action.session_id };
@@ -321,13 +321,13 @@ function applyAction(context, action, reason, force, now) {
         return { kind: action.kind, changed: true, session_id: action.session_id };
     }
     if (action.kind === "discard_stale_run" && action.run_id) {
-        const run = context.db.get("SELECT status, runtime_path, run_dir, workspace_root, index_json FROM flow_runs WHERE project_id = ? AND id = ?", [action.project_id, action.run_id]);
+        const run = context.db.get("SELECT status, runtime_path, run_dir, workspace_root, index_json FROM runs WHERE project_id = ? AND id = ?", [action.project_id, action.run_id]);
         if (!run) {
             return { kind: action.kind, changed: false, skipped: true, reason: "run_not_found", run_id: action.run_id };
         }
         if (run.status === "discarded") {
             const index = discardedRunIndex(run.index_json, reason, now);
-            context.db.run("UPDATE flow_runs SET verdict = 'discarded', next_action = ?, index_json = ?, updated_at = ?, completed_at = COALESCE(completed_at, ?) WHERE project_id = ? AND id = ?", [reason, JSON.stringify(index), now, now, action.project_id, action.run_id]);
+            context.db.run("UPDATE runs SET verdict = 'discarded', next_action = ?, index_json = ?, updated_at = ?, completed_at = COALESCE(completed_at, ?) WHERE project_id = ? AND id = ?", [reason, JSON.stringify(index), now, now, action.project_id, action.run_id]);
             if (fs.existsSync(run.runtime_path))
                 fs.writeFileSync(run.runtime_path, `${JSON.stringify(index, null, 2)}\n`);
             return { kind: action.kind, changed: true, run_id: action.run_id };
@@ -339,11 +339,11 @@ function applyAction(context, action, reason, force, now) {
             return { kind: action.kind, changed: false, skipped: true, reason: "runtime_or_workspace_reappeared", run_id: action.run_id };
         }
         const index = discardedRunIndex(run.index_json, reason, now);
-        context.db.run(`UPDATE flow_runs SET status = 'discarded', verdict = 'discarded', next_action = ?, index_json = ?, updated_at = ?, completed_at = ?
+        context.db.run(`UPDATE runs SET status = 'discarded', verdict = 'discarded', next_action = ?, index_json = ?, updated_at = ?, completed_at = ?
        WHERE project_id = ? AND id = ? AND status = 'running'`, [reason, JSON.stringify(index), now, now, action.project_id, action.run_id]);
         fs.mkdirSync(run.run_dir, { recursive: true });
         fs.writeFileSync(run.runtime_path, `${JSON.stringify(index, null, 2)}\n`);
-        context.db.run(`UPDATE flow_sessions SET status = 'stopped', stop_reason = ?, updated_at = ?, stopped_at = ?
+        context.db.run(`UPDATE sessions SET status = 'stopped', stop_reason = ?, updated_at = ?, stopped_at = ?
        WHERE project_id = ? AND run_id = ? AND status IN ('pending', 'active', 'waiting_user', 'blocked', 'stopping')`, [reason, now, now, action.project_id, action.run_id]);
         context.db.run("UPDATE flow_session_segments SET ended_at = ? WHERE project_id = ? AND run_id = ? AND ended_at IS NULL", [now, action.project_id, action.run_id]);
         appendAudit(context, {
@@ -398,7 +398,7 @@ function applyAction(context, action, reason, force, now) {
 }
 function discardedRunIndex(indexJson, reason, now) {
     const index = JSON.parse(indexJson);
-    index.schema_id = "dd-flow/flow-run@2";
+    index.schema_id = "dd-flow/flow-run@3";
     index.status = "discarded";
     index.verdict = "discarded";
     index.next_action = reason;

package/dist/services/cli-operation-classifier.js

@@ -70,7 +70,7 @@ function isUpgradeAllowlisted(args) {
         return true;
     if (family === "run" && command === "start")
         return optionValue(args, "flow-kind") === "mb-upgrade";
-    if (family === "stage" && ["start", "finish"].includes(command ?? ""))
+    if (family === "stage" && ["start", "pause", "resume", "finish"].includes(command ?? ""))
         return hasRunBinding(args);
     if (family === "session" && ["status", "register", "stop", "usage"].includes(command ?? ""))
         return hasRunBinding(args);
@@ -101,7 +101,15 @@ function isRouterNative(args) {
         return true;
     if (["engine", "version", "schema"].includes(first))
         return true;
-    return first === "codex" && args[1] === "hook" && args[2] === "handle";
+    return (first === "codex" && args[1] === "hook" && args[2] === "handle")
+        || (first === "zcode" && args[1] === "event" && args[2] === "handle")
+        || (first === "zcode" && args[1] === "usage" && args[2] === "ingest")
+        || (first === "grok" && args[1] === "event" && args[2] === "handle")
+        || (first === "grok" && args[1] === "usage" && args[2] === "ingest")
+        || (first === "opencode" && args[1] === "event" && args[2] === "handle")
+        || (first === "opencode" && args[1] === "usage" && args[2] === "ingest")
+        || (first === "agy" && args[1] === "event" && args[2] === "handle")
+        || (first === "agy" && args[1] === "usage" && args[2] === "ingest");
 }
 function isReadOnlyDiagnostic(family, command, action) {
     if (!family)

package/dist/services/code-checks.js

@@ -0,0 +1,244 @@
+import crypto from "node:crypto";
+import { spawn, spawnSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { AppError } from "../shared/errors.js";
+/**
+ * A local CODE gate must not share a mutable database with another checkout.
+ * The project command consumes this opaque suffix only for its local/test
+ * database target; preview and production-like targets remain unchanged.
+ */
+export function codeExecutionEnvironment(workspaceRoot) {
+    const suffix = crypto.createHash("sha256").update(path.resolve(workspaceRoot)).digest("hex").slice(0, 12);
+    return { ...process.env, DD_FLOW_LOCAL_DATABASE_SUFFIX: suffix };
+}
+export function validateCodeCheckCommands(workspaceRoot, commands) {
+    const file = path.join(workspaceRoot, ".memory-bank", "spec", "engineering", "code-check-profile.json");
+    // Keep one resolved command for every declared check. Two declarations may
+    // deliberately share a command while carrying different acceptance roles.
+    if (!fs.existsSync(file))
+        return [...commands];
+    const profile = JSON.parse(fs.readFileSync(file, "utf8"));
+    if (profile.schema_id !== "dd-flow/code-check-profile@4")
+        throw new AppError("invalid_code_check_profile", "CODE check profile has an unsupported schema", 2, { file, schema_id: profile.schema_id ?? null });
+    const aliases = profile.aliases && typeof profile.aliases === "object" && !Array.isArray(profile.aliases)
+        ? profile.aliases
+        : {};
+    const required = profile.require_alias_for && typeof profile.require_alias_for === "object" && !Array.isArray(profile.require_alias_for)
+        ? profile.require_alias_for
+        : {};
+    return commands.map((command) => {
+        if (command.startsWith("@check/")) {
+            const template = aliases[command];
+            if (typeof template !== "string" || !template.trim())
+                throw new AppError("unknown_code_check_alias", "CODE check alias is not defined by the project profile", 2, { alias: command, file });
+            return command;
+        }
+        for (const [prefix, alias] of Object.entries(required)) {
+            if (command === prefix || command.startsWith(`${prefix} `)) {
+                throw new AppError("raw_code_check_forbidden", "CODE check must use the project alias instead of a raw guarded command", 2, { command, required_alias: String(alias), file });
+            }
+        }
+        return command;
+    });
+}
+export function resolveCodeCheckCommands(workspaceRoot, runId, commands) {
+    const validated = validateCodeCheckCommands(workspaceRoot, commands);
+    const file = path.join(workspaceRoot, ".memory-bank", "spec", "engineering", "code-check-profile.json");
+    if (!fs.existsSync(file))
+        return validated;
+    const profile = JSON.parse(fs.readFileSync(file, "utf8"));
+    const aliases = profile.aliases && typeof profile.aliases === "object" && !Array.isArray(profile.aliases)
+        ? profile.aliases
+        : {};
+    return validated.map((command) => command.startsWith("@check/")
+        ? String(aliases[command]).replaceAll("{run_id}", runId)
+        : command);
+}
+export async function runCodeChecks(context, input) {
+    const receipts = [];
+    for (const check of input.checks)
+        validateCheckDeclaration(input.workspaceRoot, check);
+    const commands = resolveCodeCheckCommands(input.workspaceRoot, input.runId, input.checks.map((check) => check.command));
+    for (let index = 0; index < commands.length; index += 1) {
+        const declaration = input.checks[index];
+        const command = commands[index];
+        const ordinal = (context.db.get("SELECT COUNT(*) AS count FROM check_receipts WHERE work_id IS ? AND run_id = ?", [input.workId ?? null, input.runId])?.count ?? 0) + 1;
+        const localId = `RCP-${String(ordinal).padStart(3, "0")}`;
+        const id = `${input.workId ?? input.runId}/${localId}`;
+        const directory = path.join(input.runHome, input.artifactDir ?? "05-code", "checks", localId);
+        fs.mkdirSync(directory, { recursive: true });
+        const stdoutPath = path.join(directory, "stdout.log");
+        const stderrPath = path.join(directory, "stderr.log");
+        const receiptPath = path.join(directory, "receipt.json");
+        const evidenceDir = path.join(directory, "artifacts");
+        fs.mkdirSync(evidenceDir, { recursive: true });
+        const startedAt = context.now();
+        input.progress?.(`check ${index + 1}/${commands.length} started: ${command}`);
+        const stdout = fs.createWriteStream(stdoutPath);
+        const stderr = fs.createWriteStream(stderrPath);
+        const result = await runCheck(command, input.workspaceRoot, { ...codeExecutionEnvironment(input.workspaceRoot), DD_FLOW_EVIDENCE_DIR: evidenceDir }, stdout, stderr, (elapsed) => {
+            input.progress?.(`check ${index + 1}/${commands.length} still running (${elapsed}s): ${command}`);
+        });
+        await Promise.all([closeStream(stdout), closeStream(stderr)]);
+        const finishedAt = context.now();
+        const exitCode = result.exitCode;
+        const artifacts = collectRequiredArtifacts(evidenceDir, declaration.required_artifacts ?? []);
+        const status = exitCode === 0 && !result.error && artifacts.complete ? "passed" : "failed";
+        if (!artifacts.complete)
+            fs.appendFileSync(stderrPath, `\nmissing required evidence artifacts: ${artifacts.missing.join(", ")}\n`);
+        if (result.error)
+            fs.appendFileSync(stderrPath, `\n${result.error}\n`);
+        const receipt = {
+            id,
+            local_id: localId,
+            declaration_id: declaration.id,
+            scope: input.scope,
+            work_id: input.workId ?? null,
+            command,
+            status,
+            exit_code: exitCode,
+            stdout_path: stdoutPath,
+            stderr_path: stderrPath,
+            receipt_path: receiptPath,
+            workspace_fingerprint: workspaceFingerprint(input.workspaceRoot),
+            artifacts: artifacts.items,
+            started_at: startedAt,
+            finished_at: finishedAt
+        };
+        fs.writeFileSync(receiptPath, `${JSON.stringify(receipt, null, 2)}\n`);
+        context.db.run("INSERT INTO check_receipts (id, project_id, run_id, work_id, scope, declaration_id, command, status, exit_code, stdout_path, stderr_path, receipt_path, workspace_fingerprint, artifacts_json, started_at, finished_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", [id, input.projectId, input.runId, input.workId ?? null, input.scope, declaration.id, command, status, exitCode, stdoutPath, stderrPath, receiptPath, receipt.workspace_fingerprint, JSON.stringify(receipt.artifacts), startedAt, finishedAt]);
+        receipts.push(receipt);
+        input.progress?.(`check ${index + 1}/${commands.length} ${status}: ${command}`);
+    }
+    return receipts;
+}
+export function aggregateCheckDeclarations(workspaceRoot) {
+    const file = path.join(workspaceRoot, ".memory-bank", "spec", "engineering", "code-check-profile.json");
+    if (!fs.existsSync(file))
+        return [];
+    const profile = JSON.parse(fs.readFileSync(file, "utf8"));
+    if (profile.schema_id !== "dd-flow/code-check-profile@4")
+        throw new AppError("invalid_code_check_profile", "CODE check profile has an unsupported schema", 2, { file, schema_id: profile.schema_id ?? null });
+    if (!Array.isArray(profile.aggregate_commands) || !profile.aggregate_commands.every((command) => typeof command === "string" && command.trim()))
+        throw new AppError("invalid_code_check_profile", "aggregate_commands must be an array of commands", 2, { file });
+    return profile.aggregate_commands.map((command, index) => ({ id: `CHK-POLICY-CODE-${String(index + 1).padStart(3, "0")}`, command, purpose: "Mandatory project-wide policy gate.", run_at: "code", availability: "available" }));
+}
+/**
+ * A project-wide gate can observe files owned by more than one CODE Work.
+ * Keep it at the CODE/readiness fan-in, where the engine can create a repair
+ * Work with the failed receipt and the right project-local repair context.
+ */
+export function validateCheckPlacement(workspaceRoot, checks) {
+    const aggregate = new Set(aggregateCheckDeclarations(workspaceRoot).map((check) => check.command));
+    for (const check of checks) {
+        if (check.run_at === "work" && check.availability === "available" && aggregate.has(check.command)) {
+            throw new AppError("aggregate_check_requires_code_gate", "A project aggregate check must run at CODE or readiness, not inside one scoped Work", 2, {
+                check_id: check.id,
+                command: check.command,
+                run_at: check.run_at
+            });
+        }
+    }
+}
+export function checksForRunAt(checks, runAt) {
+    return checks.filter((check) => check.run_at === runAt);
+}
+/** One SSOT for the final CODE gate, reused after CODE-REVIEW repairs. */
+export function finalCodeCheckDeclarations(workspaceRoot, declared) {
+    const selected = [...aggregateCheckDeclarations(workspaceRoot), ...declared.filter((check) => check.run_at === "code" || check.run_at === "readiness")];
+    const unique = new Map();
+    for (const check of selected)
+        if (!unique.has(check.id))
+            unique.set(check.id, check);
+    return [...unique.values()];
+}
+/** Prevent an unchanged failed stage gate from rerunning expensive commands. */
+export function unchangedFinalGateFailures(context, input) {
+    const wanted = new Set(input.declarations.map((check) => check.id));
+    const current = workspaceFingerprint(input.workspaceRoot);
+    const latest = new Map();
+    for (const receipt of checkReceipts(context, { projectId: input.projectId, runId: input.runId }).filter((item) => item.scope === "aggregate" && wanted.has(item.declaration_id)))
+        latest.set(receipt.declaration_id, receipt);
+    return [...latest.values()].filter((receipt) => receipt.status === "failed" && receipt.workspace_fingerprint === current);
+}
+export function validateCheckDeclaration(workspaceRoot, check) {
+    if (check.availability !== "planned") {
+        validateCodeCheckCommands(workspaceRoot, [check.command]);
+        return;
+    }
+    if (!check.command.startsWith("@check/")) {
+        throw new AppError("planned_check_requires_alias", "A planned CODE check must declare a new @check/... alias", 2, { check_id: check.id, command: check.command });
+    }
+    if (!check.definition?.trim()) {
+        throw new AppError("planned_check_definition_missing", "A planned CODE check must declare its exact alias definition", 2, { check_id: check.id, command: check.command });
+    }
+    const file = path.join(workspaceRoot, ".memory-bank", "spec", "engineering", "code-check-profile.json");
+    const profile = fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, "utf8")) : {};
+    const aliases = profile.aliases && typeof profile.aliases === "object" && !Array.isArray(profile.aliases) ? profile.aliases : {};
+    const actual = aliases[check.command];
+    if (typeof actual !== "string")
+        throw new AppError("planned_check_not_materialized", "A planned check alias was not materialized by its provider Work", 2, { check_id: check.id, command: check.command, provider: check.provided_by ?? null });
+    if (check.definition && actual !== check.definition)
+        throw new AppError("planned_check_definition_mismatch", "A planned check alias does not match its declared definition", 2, { check_id: check.id, command: check.command, expected: check.definition, actual });
+}
+function collectRequiredArtifacts(root, required) {
+    const missing = [];
+    const items = required.map((relative) => {
+        if (path.isAbsolute(relative) || relative.split(path.sep).includes(".."))
+            throw new AppError("invalid_evidence_path", "Required evidence paths must be relative to DD_FLOW_EVIDENCE_DIR", 2, { path: relative });
+        const file = path.join(root, relative);
+        if (!fs.existsSync(file) || !fs.statSync(file).isFile()) {
+            missing.push(relative);
+            return null;
+        }
+        return { path: relative, sha256: crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex") };
+    }).filter((item) => item !== null);
+    return { complete: missing.length === 0, missing, items };
+}
+export function workspaceFingerprint(root) {
+    const git = spawnSync("git", ["ls-files", "-co", "--exclude-standard", "-z"], { cwd: root, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+    const listing = git.status === 0 ? git.stdout.split("\0").filter(Boolean).sort() : listFiles(root);
+    const hash = crypto.createHash("sha256");
+    for (const relative of listing) {
+        const file = path.join(root, relative);
+        hash.update(relative).update("\0");
+        hash.update(fs.existsSync(file) && fs.statSync(file).isFile() ? fs.readFileSync(file) : "<missing>");
+        hash.update("\0");
+    }
+    return hash.digest("hex");
+}
+function listFiles(root, current = root) {
+    return fs.readdirSync(current, { withFileTypes: true }).flatMap((entry) => {
+        if ([".git", "node_modules"].includes(entry.name))
+            return [];
+        const absolute = path.join(current, entry.name);
+        return entry.isDirectory() ? listFiles(root, absolute) : [path.relative(root, absolute)];
+    }).sort();
+}
+function runCheck(command, cwd, environment, stdout, stderr, heartbeat) {
+    return new Promise((resolve) => {
+        const started = Date.now();
+        const child = spawn("/bin/sh", ["-lc", command], { cwd, env: environment, stdio: ["ignore", "pipe", "pipe"] });
+        child.stdout.pipe(stdout, { end: false });
+        child.stderr.pipe(stderr, { end: false });
+        const progress = setInterval(() => heartbeat(Math.floor((Date.now() - started) / 1000)), 15_000);
+        let timedOut = false;
+        const timeout = setTimeout(() => { timedOut = true; child.kill("SIGTERM"); }, 15 * 60 * 1000);
+        let error = null;
+        child.once("error", (value) => { error = value.message; });
+        child.once("close", (exitCode, signal) => {
+            clearInterval(progress);
+            clearTimeout(timeout);
+            resolve({ exitCode, error: error ?? (timedOut ? "timed out after 900 seconds" : signal ? `terminated by ${signal}` : null) });
+        });
+    });
+}
+function closeStream(stream) {
+    return new Promise((resolve, reject) => stream.end((error) => error ? reject(error) : resolve()));
+}
+export function checkReceipts(context, input) {
+    const where = input.workId ? "project_id = ? AND run_id = ? AND work_id = ?" : "project_id = ? AND run_id = ?";
+    const params = input.workId ? [input.projectId, input.runId, input.workId] : [input.projectId, input.runId];
+    return context.db.all(`SELECT id, declaration_id, scope, work_id, command, status, exit_code, stdout_path, stderr_path, receipt_path, workspace_fingerprint, artifacts_json, started_at, finished_at FROM check_receipts WHERE ${where} ORDER BY started_at, id`, params).map((receipt) => ({ ...receipt, local_id: receipt.id.slice(receipt.id.lastIndexOf("/") + 1), artifacts: JSON.parse(receipt.artifacts_json) }));
+}

package/dist/services/config.js

@@ -38,7 +38,10 @@ export function setProjectConfigValue(context, project, input) {
     return getProjectConfigStatus(context, project);
 }
 export function readProjectConfig(context, projectId) {
-    migrateLegacyConfig(context, projectId);
+    // Status and dashboard reads intentionally open SQLite read-only. Legacy
+    // cleanup is a write-side concern and must not make those commands fail.
+    if (context.db.writable)
+        migrateLegacyConfig(context, projectId);
     const config = structuredClone(defaultProjectConfig);
     for (const row of configOverrides(context, projectId)) {
         applyConfigValue(config, row.key, JSON.parse(row.value_json));
@@ -139,6 +142,9 @@ function applyConfigValue(config, key, value) {
     }
 }
 function migrateLegacyConfig(context, projectId) {
+    // Handoff is now frozen from project-workspace.json for vNext. Delete the
+    // old runtime override rather than leaving a misleading inert setting.
+    context.db.run("DELETE FROM project_config WHERE project_id = ? AND key = 'execution.stage_handoff'", [projectId]);
     const legacyRows = context.db.all(`SELECT key, value_json, updated_at FROM project_config
      WHERE project_id = ? AND key IN (
        'integrations.cmux.dashboard',

package/dist/services/dashboard.js

@@ -380,7 +380,7 @@ function buildGlobalDashboardData(context, htmlPath) {
             metric("total_projects", activeProjects.length, "known", "projects.status=active"),
             metric("unsupported_projects", unsupportedProjects.filter((project) => project.status === "active").length, "known", "project summaries"),
             metric("active_protocols", projectCards.reduce((sum, card) => sum + Number(card.metrics.active_protocols), 0), "known", "protocols"),
-            metric("running_sessions", projectCards.reduce((sum, card) => sum + Number(card.metrics.sessions), 0), "known", "flow_sessions"),
+            metric("running_sessions", projectCards.reduce((sum, card) => sum + Number(card.metrics.sessions), 0), "known", "sessions"),
             metric("active_locks", projectCards.reduce((sum, card) => sum + Number(card.metrics.locks), 0), "known", "lane_locks"),
             metric("open_defs", projectCards.reduce((sum, card) => sum + Number(card.metrics.open_defs), 0), "known", "protocols.active_def/blockers")
         ],
@@ -578,8 +578,8 @@ function buildProjectDashboardData(context, project, htmlPath) {
             metric("active_locks", locks.filter((lock) => lock.status === "active").length, "known", "lane_locks"),
             metric("queued_waiters", waiters.filter((waiter) => waiter.status === "queued").length, "known", "lane_waiters"),
             metric("open_defs", openDefs, "known", "protocols.active_def/blockers"),
-            metric("running_sessions", sessions.length, "known", "flow_sessions"),
-            metric("review_runs", reviewRuns.length, "known", "flow_runs.flow_kind=mb-sdlc-review|review")
+            metric("running_sessions", sessions.length, "known", "sessions"),
+            metric("review_runs", reviewRuns.length, "known", "runs.flow_kind=mb-sdlc-review|review")
         ],
         lifecycle_summary: lifecycleSummary(activeProtocols),
         resource_summary: resourceSummary(queue, locks, waiters),
@@ -625,7 +625,7 @@ function buildProtocolDashboardData(context, project, protocolId, htmlPath) {
     const queueItem = queueForProject(context, project.id).find((item) => item.protocol_id === protocolId) ?? null;
     const runDiagnostics = protocolRunDiagnostics(context, runtimeProtocol, runtimeState);
     const runs = context.db.all(`SELECT id, short_id, flow_kind, subject_type, subject_id, status, verdict, next_action, run_index_path, index_json, created_at, updated_at, completed_at
-     FROM flow_runs WHERE project_id = ? AND subject_type = 'protocol' AND subject_id = ?
+     FROM runs WHERE project_id = ? AND subject_type = 'protocol' AND subject_id = ?
      ORDER BY updated_at DESC, id DESC`, [project.id, protocolId]);
     const warnings = [...runDiagnostics.diagnostics];
     const canonicalRuns = runs.filter((run) => {
@@ -714,11 +714,11 @@ function buildProtocolDashboardData(context, project, protocolId, htmlPath) {
         run_history: runHistory,
         stage_pipeline: latestStages(runHistory),
         metrics: [
-            metric("runs", canonicalRuns.length, "known", "flow_runs"),
+            metric("runs", canonicalRuns.length, "known", "runs"),
             metric("open_defs", jsonArray(protocol.active_def_json).length, "known", "protocols.active_def_json"),
             metric("blockers", jsonArray(protocol.blockers_json).length, "known", "protocols.blockers_json"),
-            metric("completed_runs", canonicalRuns.filter((run) => run.status === "done").length, "known", "flow_runs"),
-            metric("review_runs", reviewRuns.length, "known", "flow_runs.flow_kind=mb-sdlc-review|review")
+            metric("completed_runs", canonicalRuns.filter((run) => run.status === "done").length, "known", "runs"),
+            metric("review_runs", reviewRuns.length, "known", "runs.flow_kind=mb-sdlc-review|review")
         ],
         warnings
     };
@@ -734,7 +734,7 @@ function renderProjectDashboardMarkdown(context, project, output) {
     const worktrees = context.db.all(`SELECT protocol_id, feature_branch, worktree_path, bootstrap_status, status, updated_at
      FROM worktree_records WHERE project_id = ? ORDER BY updated_at DESC LIMIT 10`, [project.id]);
     const hookEvents = context.db.all(`SELECT protocol_id, session_id, event_name, tool_name, status, sanitized_summary, created_at
-     FROM codex_hook_events WHERE project_id = ? ORDER BY created_at DESC, id DESC LIMIT 10`, [project.id]);
+     FROM hook_events WHERE project_id = ? ORDER BY created_at DESC, id DESC LIMIT 10`, [project.id]);
     const activeDefs = protocols.flatMap((protocol) => jsonArray(protocol.active_def_json).map((entry) => ({ protocol: protocol.id, entry })));
     const blockers = protocols.flatMap((protocol) => jsonArray(protocol.blockers_json).map((entry) => ({ protocol: protocol.id, entry })));
     const activeLocks = locks.filter((lock) => lock.status === "active");
@@ -1053,7 +1053,7 @@ function buildProtocolCard(context, project, protocol, generatePage) {
     const activeDefCount = jsonArray(protocol.active_def_json).length;
     const blockerCount = jsonArray(protocol.blockers_json).length;
     const runs = context.db.all(`SELECT id, short_id, flow_kind, subject_type, subject_id, status, verdict, next_action, run_index_path, index_json, created_at, updated_at, completed_at
-     FROM flow_runs WHERE project_id = ? AND subject_type = 'protocol' AND subject_id = ?
+     FROM runs WHERE project_id = ? AND subject_type = 'protocol' AND subject_id = ?
      ORDER BY updated_at DESC, id DESC`, [project.id, protocol.id]);
     const latestRun = runs.find((run) => isCanonicalRun(run));
     let diagnostics = [];
@@ -1102,7 +1102,7 @@ function buildProtocolCard(context, project, protocol, generatePage) {
 }
 function recentReviewRunsForProject(context, projectId, limit) {
     const runs = context.db.all(`SELECT id, short_id, flow_kind, subject_type, subject_id, status, verdict, next_action, run_index_path, index_json, created_at, updated_at, completed_at
-     FROM flow_runs
+     FROM runs
      WHERE project_id = ? AND flow_kind IN ('mb-sdlc-review', 'review')
      ORDER BY updated_at DESC, id DESC
      LIMIT ?`, [projectId, limit]);
@@ -1110,7 +1110,7 @@ function recentReviewRunsForProject(context, projectId, limit) {
 }
 function recentReviewRunsForProtocol(context, projectId, protocolId, limit) {
     const runs = context.db.all(`SELECT id, short_id, flow_kind, subject_type, subject_id, status, verdict, next_action, run_index_path, index_json, created_at, updated_at, completed_at
-     FROM flow_runs
+     FROM runs
      WHERE project_id = ?
        AND flow_kind IN ('mb-sdlc-review', 'review')
        AND subject_type = 'protocol'
@@ -1258,7 +1258,7 @@ function safeRunIndex(text, warnings, runId) {
 function isCanonicalRun(run) {
     try {
         const parsed = JSON.parse(run.index_json);
-        return parsed?.schema_id === "dd-flow/flow-run@2";
+        return parsed?.schema_id === "dd-flow/flow-run@3";
     }
     catch {
         return false;

package/dist/services/engines.js

@@ -164,7 +164,7 @@ export function routeArgsThroughEngine(context, args, io, stdin, env, resolvedPr
         const entrypoint = resolveManifestEntrypoint(bound.manifest);
         return spawnEngine(bound.manifest, entrypoint, args, io, stdin, env, getCliBuildInfo().version);
     }
-    const selection = selectEngine(context, { projectRoot: resolvedProjectRoot ?? resolveExplicitProjectRoot(args) ?? undefined }, { allowCurrentInProcess: true }, classification);
+    const selection = selectEngine(context, { projectRoot: resolvedProjectRoot ?? resolveExplicitProjectRoot(args) ?? undefined, env }, { allowCurrentInProcess: true }, classification);
     if (selection.status !== "selected") {
         if (classification.mode === "read_only_diagnostics" || (classification.mode === "mb_upgrade" && isUpgradeDiagnostic(args))) {
             return Promise.resolve(null);