@deksden-com/dd-flow-cli 0.8.0 → 0.9.0-beta.0

package/dist/services/work-registry.js

@@ -6,11 +6,22 @@ import { findRecentMatchingHookEvent, claimStageStartHookEvent, claimWorkStartHo
 import { validateSchema } from "./schema-validation.js";
 import { resolveProjectRoot, resolveRunReferences, writeJsonAtomic } from "../storage/paths.js";
 import { refreshRunSessionProjection } from "./run-projection.js";
-import { runCodeChecks } from "./code-checks.js";
-import { nextWorkId } from "./ids.js";
+import { readCodeCheckProfile, runCodeChecks } from "./code-checks.js";
+import { nextWorkId, nextWorkIds } from "./ids.js";
 import { appendFlowRunTimelineEvent } from "./runs.js";
+import { flowCommand } from "./stage-pause.js";
 const workColumns = "work_id, project_id, run_id, parent_work_id, task, launch_policy, result_schema, payload_json, depends_on_json, status, result, created_at, started_at, updated_at, completed_at";
 export function ensureWorkRegistry(context) { context.db.exec("SELECT 1 FROM works LIMIT 1"); context.db.exec("SELECT 1 FROM work_sessions LIMIT 1"); }
+export function createChildWork(context, input) {
+    const parent = requireWork(context, input.parentWorkId);
+    if (parent.status !== "running")
+        throw new AppError("invalid_work_state", "Child Work requires a running parent", 2, { parent_work_id: parent.work_id, status: parent.status });
+    const id = nextWorkId(context, parent.project_id, input.slug);
+    const now = context.now();
+    context.db.run(`INSERT INTO works (${workColumns}) VALUES (?, ?, ?, ?, ?, ?, ?, ?, '[]', 'created', NULL, ?, NULL, ?, NULL)`, [id, parent.project_id, parent.run_id, parent.work_id, input.task, input.launchPolicy, input.resultSchema ?? null, input.payload ? JSON.stringify(input.payload) : null, now, now]);
+    refreshRunWorkProjection(context, parent.project_id, parent.run_id);
+    return requireWork(context, id);
+}
 /** Validate a proposed batch before PLAN accepts it, without registering Work. */
 export function validateWorkBatchFile(file) {
     const parsed = readJson(file);
@@ -54,7 +65,8 @@ export function addWorkBatch(context, input) {
     const now = context.now();
     context.db.exec("BEGIN IMMEDIATE");
     try {
-        const ids = new Map(items.map((item) => [item.key, nextWorkId(context, parent.project_id, item.key)]));
+        const allocated = nextWorkIds(context, parent.project_id, items.map((item) => item.key));
+        const ids = new Map(items.map((item, index) => [item.key, allocated[index]]));
         const resolve = (value) => ids.get(value) ?? value;
         const proposed = items.map((item) => ({ ...item, id: ids.get(item.key), parentId: item.parent ? resolve(item.parent) : parent.work_id, dependencies: (item.depends_on ?? []).map(resolve) }));
         assertNoCycles(proposed.map((item) => ({ id: item.id, dependencies: item.dependencies })));
@@ -128,7 +140,13 @@ export function mutateWorkDeps(context, input) {
 export function deleteWork(context, id) { const work = requireWork(context, id); const canonical = work.work_id; if (work.status !== "created" || work.started_at || context.db.get("SELECT 1 FROM works WHERE parent_work_id = ? LIMIT 1", [canonical]) || context.db.get("SELECT 1 FROM works WHERE depends_on_json LIKE ? LIMIT 1", [`%${canonical}%`]))
     throw new AppError("invalid_work_state", "Only an unstarted unreferenced Work may be deleted", 2); context.db.run("DELETE FROM works WHERE work_id = ?", [canonical]); refreshRunWorkProjection(context, work.project_id, work.run_id); return { ok: true, deleted: canonical }; }
 export function shortWorkId(id) { return /^WRK-\d{3,}(?:-|$)/.exec(id)?.[0]?.replace(/-$/, "") ?? id; }
-export function workStartCommand(context, work) { const run = requireRun(context, work.project_id, work.run_id); return `DD_FLOW_HOME=${JSON.stringify(context.ddFlowHome)} dd-flow work start ${work.work_id} --project-root ${JSON.stringify(run.project_root)} --json`; }
+/**
+ * Return the engine-bound command, never a PATH-dependent `dd-flow` token.
+ * Fan-out workers run in independently spawned harnesses where the adapter's
+ * PATH is not inherited; using the shared lifecycle command keeps them on the
+ * same captured runtime as their parent stage.
+ */
+export function workStartCommand(context, work) { const run = requireRun(context, work.project_id, work.run_id); return `${flowCommand(context)} work start ${work.work_id} --project-root ${JSON.stringify(run.project_root)} --json`; }
 export function startWork(context, id, input) {
     ensureWorkRegistry(context);
     const work = requireWork(context, id);
@@ -227,7 +245,7 @@ export function startStageCoordinatorWork(context, input) {
     const run = requireRun(context, work.project_id, work.run_id);
     if (input.projectRoot && resolveProjectRoot(input.projectRoot) !== resolveProjectRoot(run.project_root))
         throw new AppError("project_mismatch", "stage coordinator project root does not match its RUN", 1, { work_id: work.work_id });
-    const identity = claimStageStartHookEvent(context, { projectId: work.project_id, eventKey: input.hookEventId, runId: work.run_id, stage: input.stage, projectRoot: run.project_root });
+    const identity = claimStageStartHookEvent(context, { projectId: work.project_id, eventKey: input.hookEventId, runId: work.run_id, stage: input.stage, projectRoot: run.project_root, ...(input.contextSha256 ? { contextSha256: input.contextSha256 } : {}) });
     const binding = startBoundWork(context, work, run, identity, input.hookEventId);
     const sessionId = String(binding.session_binding.session_id ?? "");
     context.db.run("UPDATE sessions SET current_stage = ?, updated_at = ? WHERE project_id = ? AND session_id = ?", [input.stage, context.now(), work.project_id, sessionId]);
@@ -247,6 +265,8 @@ export function startBoundWork(context, work, run, identity, hookEventId) {
     context.db.exec("BEGIN IMMEDIATE");
     try {
         bindSession(context, work, run, identity, now);
+        if (work.parent_work_id && work.launch_policy === "reuse_allowed")
+            context.db.run("UPDATE work_sessions SET status = 'completed', completed_at = ?, updated_at = ? WHERE session_id = ? AND status = 'running' AND work_id <> ?", [now, now, identity.sessionId, work.work_id]);
         const claimed = context.db.run("UPDATE works SET status = 'running', started_at = ?, updated_at = ? WHERE work_id = ? AND status = 'created'", [now, now, work.work_id]);
         if (claimed.changes !== 1)
             throw new AppError("conflict", "Work was claimed concurrently", 1, { work_id: work.work_id });
@@ -265,6 +285,10 @@ export function startBoundWork(context, work, run, identity, hookEventId) {
     return { ok: true, work_id: work.work_id, work_session_id: linkId, worker_prompt_markdown: prompt, prompt_path: promptPath, session_binding: { source: "PreToolUse", session_id: identity.sessionId } };
 }
 export function finishWork(context, id, result, progress) { return settle(context, id, "completed", result, progress); }
+/** Structured fan-in closes a parent after its Session was handed to a child. */
+export function finishFanInWork(context, id, result) { const work = requireWork(context, id); if (work.status !== "running")
+    throw new AppError("invalid_work_state", "Fan-in Work is not running", 2, { work_id: work.work_id, status: work.status }); if (context.db.get("SELECT 1 FROM works WHERE parent_work_id = ? AND status IN ('created','running') LIMIT 1", [work.work_id]))
+    throw new AppError("active_child_work", "Fan-in Work still has active children", 2, { work_id: work.work_id }); const now = context.now(); context.db.run("UPDATE works SET status = 'completed', result = ?, completed_at = ?, updated_at = ? WHERE work_id = ?", [result, now, now, work.work_id]); context.db.run("UPDATE work_sessions SET status = 'completed', completed_at = COALESCE(completed_at, ?), updated_at = ? WHERE work_id = ? AND status = 'running'", [now, now, work.work_id]); refreshRunWorkProjection(context, work.project_id, work.run_id); appendFlowRunTimelineEvent(context, work.project_id, work.run_id, { type: "work_completed", work_id: work.work_id, fan_in: true }); return { ok: true, work_id: work.work_id, status: "completed", fan_in: true }; }
 export function failWork(context, id, reason) { return settle(context, id, "failed", reason); }
 export function cancelWork(context, id, reason) { return settle(context, id, "cancelled", reason); }
 export function retryWork(context, id, reason) { const work = requireWork(context, id); id = work.work_id; if (work.status !== "failed")
@@ -290,10 +314,14 @@ async function settle(context, id, status, result, progress) {
         validateWorkResult(work, result, run.project_root, run.workspace_root, run.id, link?.result_path ?? null);
         const packet = codePacket(work);
         if (packet) {
+            // CODE packets are projected from a PLAN that already validated this
+            // profile. Check it even when the Work has only raw focused checks, so a
+            // worker cannot complete after downgrading the frozen project contract.
+            readCodeCheckProfile(run.workspace_root);
             coordinationDrift = plannedAreaDrift(packet, result);
             const artifactDir = path.relative(requireRunHome(run), path.dirname(link.result_path));
             receipts = await runCodeChecks(context, { projectId: work.project_id, runId: work.run_id, runHome: requireRunHome(run), workspaceRoot: run.workspace_root, workId: work.work_id, artifactDir, scope: "work", checks: packet.checks.filter((check) => check.run_at === "work"), ...(progress ? { progress } : {}) });
-            const failed = receipts.filter((receipt) => receipt.status === "failed");
+            const failed = receipts.filter((receipt) => receipt.status !== "passed");
             if (failed.length)
                 throw new AppError("work_checks_failed", "Work remains running because required checks failed", 2, { work_id: id, failures: failed, all_receipts: receipts });
         }
@@ -393,7 +421,7 @@ function validateCodeWorkResult(work, value, projectRoot) {
     }
 }
 function renderWorkerPrompt(context, work, run, dependencies, resultPath) {
-    const command = `DD_FLOW_HOME=${JSON.stringify(context.ddFlowHome)} dd-flow`;
+    const command = flowCommand(context);
     const packet = codePacket(work);
     const codeContext = packet ? ["<semantic_spine>", JSON.stringify(packet.semantic_spine, null, 2), "</semantic_spine>", "", ...(packet.repair ? ["<repair_context>", JSON.stringify(packet.repair, null, 2), "Read the failed receipt and its linked stdout/stderr before editing. Preserve the accepted origin context and fix only the evidenced failure.", "</repair_context>", ""] : []), "<accepted_requirements>", JSON.stringify(packet.requirements, null, 2), "</accepted_requirements>", "", "<acceptance_context>", "The criteria below are end-to-end context. Complete this Work's semantic contribution and declared checks; another ordered Work may own a different acceptance surface.", JSON.stringify(packet.acceptance, null, 2), "</acceptance_context>", "", "<required_read>", "These are mandatory starting sources, not a read allowlist. Read any additional project files needed to implement the Work correctly.", ...packet.required_read.map((item) => `- ${resolveRunReferences(item, work.run_id, requireRunHome(run))}`), "</required_read>", "", "<discovery_boundary>", "These are likely discovery areas, not a hard boundary. Expand project-local investigation when required and report material additions.", ...packet.discovery_boundary.map((item) => `- ${item}`), "</discovery_boundary>", "", "<planned_write_areas>", "SOFT COORDINATION HINT ONLY. These paths help the coordinator avoid concurrent collisions. They do not grant or deny write permission and do not limit the files needed for this Work. You may create or change any project file under workspace_root that is necessary and in semantic scope; report every actual changed path.", ...(packet.planned_write_areas.length ? packet.planned_write_areas.map((item) => `- ${item}`) : ["- none predicted; derive the necessary files from the task"]), "</planned_write_areas>", "", ...(packet.provides_checks.length ? ["<provided_checks>", ...packet.provides_checks.map((item) => `- ${item.id}: materialize ${item.command}${item.definition ? ` as ${item.definition}` : ""}; it is not usable until this Work finishes.`), "Update the declared project command or alias before Work finish. The CLI verifies the materialization and then executes the check.", "</provided_checks>", ""] : []), "<verification>", ...packet.checks.map((item) => `- ${item.id} at ${item.run_at}: ${item.command} — ${item.purpose}`), "The CLI executes work-scoped checks and retains their receipts. Report semantic evidence only; do not rerun declared checks manually.", "</verification>", "", "<stop_conditions>", ...packet.stop_conditions.map((item) => `- ${item}`), "</stop_conditions>", ""] : [];
     if (packet)

package/dist/storage/database.js

@@ -58,13 +58,21 @@ export function ensureVnextWorkStorage(db) {
       work_id TEXT,
       scope TEXT NOT NULL,
       declaration_id TEXT NOT NULL,
+      check_refs_json TEXT NOT NULL DEFAULT '[]',
+      gate TEXT NOT NULL DEFAULT 'work',
       command TEXT NOT NULL,
+      input_hash TEXT NOT NULL DEFAULT '',
+      verification_epoch TEXT NOT NULL DEFAULT '',
       status TEXT NOT NULL,
       exit_code INTEGER,
       stdout_path TEXT NOT NULL,
       stderr_path TEXT NOT NULL,
       receipt_path TEXT NOT NULL,
       workspace_fingerprint TEXT NOT NULL,
+      before_fingerprint TEXT NOT NULL DEFAULT '',
+      after_fingerprint TEXT NOT NULL DEFAULT '',
+      profile_hash TEXT,
+      mutation_paths_json TEXT NOT NULL DEFAULT '[]',
       artifacts_json TEXT NOT NULL,
       started_at TEXT NOT NULL,
       finished_at TEXT NOT NULL,
@@ -474,6 +482,56 @@ function migrate(db) {
     CREATE INDEX IF NOT EXISTS idx_check_receipts_run
       ON check_receipts(project_id, run_id, started_at);
 
+    CREATE TABLE IF NOT EXISTS merge_requests (
+      merge_request_id TEXT PRIMARY KEY,
+      project_id TEXT NOT NULL,
+      run_id TEXT NOT NULL,
+      executor_work_id TEXT NOT NULL,
+      protocol_ids_json TEXT NOT NULL,
+      source_workspace TEXT NOT NULL,
+      source_branch TEXT NOT NULL,
+      source_commit TEXT NOT NULL,
+      target_workspace TEXT NOT NULL,
+      target_branch TEXT NOT NULL,
+      enqueue_target_head TEXT,
+      execution_target_head TEXT,
+      integration_commit TEXT,
+      execution_route TEXT NOT NULL,
+      status TEXT NOT NULL,
+      dispatch_owner TEXT,
+      dispatch_lease_token TEXT,
+      dispatch_lease_expires_at TEXT,
+      lock_acquired_at TEXT,
+      checkpoint TEXT NOT NULL DEFAULT 'queued',
+      profile_hash TEXT,
+      adapter_receipt_json TEXT,
+      result_json TEXT,
+      last_error_json TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      completed_at TEXT,
+      FOREIGN KEY(project_id, run_id) REFERENCES runs(project_id, id),
+      FOREIGN KEY(executor_work_id) REFERENCES works(work_id)
+    );
+    CREATE INDEX IF NOT EXISTS idx_merge_requests_fifo
+      ON merge_requests(project_id, status, created_at, merge_request_id);
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_merge_requests_run
+      ON merge_requests(project_id, run_id);
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_merge_requests_active_project
+      ON merge_requests(project_id)
+      WHERE status IN ('active', 'waiting_user', 'action_required', 'recovery_required');
+
+    CREATE TABLE IF NOT EXISTS merge_servers (
+      server_id TEXT PRIMARY KEY,
+      profile_id TEXT NOT NULL,
+      status TEXT NOT NULL,
+      pid INTEGER,
+      started_at TEXT NOT NULL,
+      heartbeat_at TEXT NOT NULL,
+      stopped_at TEXT,
+      journal_path TEXT NOT NULL
+    );
+
     CREATE TABLE IF NOT EXISTS flow_run_flag_mutations (
       project_id TEXT NOT NULL,
       run_id TEXT NOT NULL,
@@ -685,6 +743,14 @@ function migrate(db) {
     ensureColumn(db, "check_receipts", "declaration_id", "ALTER TABLE check_receipts ADD COLUMN declaration_id TEXT NOT NULL DEFAULT 'CHK-LEGACY'");
     ensureColumn(db, "check_receipts", "workspace_fingerprint", "ALTER TABLE check_receipts ADD COLUMN workspace_fingerprint TEXT NOT NULL DEFAULT ''");
     ensureColumn(db, "check_receipts", "artifacts_json", "ALTER TABLE check_receipts ADD COLUMN artifacts_json TEXT NOT NULL DEFAULT '[]'");
+    ensureColumn(db, "check_receipts", "check_refs_json", "ALTER TABLE check_receipts ADD COLUMN check_refs_json TEXT NOT NULL DEFAULT '[]'");
+    ensureColumn(db, "check_receipts", "gate", "ALTER TABLE check_receipts ADD COLUMN gate TEXT NOT NULL DEFAULT 'work'");
+    ensureColumn(db, "check_receipts", "input_hash", "ALTER TABLE check_receipts ADD COLUMN input_hash TEXT NOT NULL DEFAULT ''");
+    ensureColumn(db, "check_receipts", "verification_epoch", "ALTER TABLE check_receipts ADD COLUMN verification_epoch TEXT NOT NULL DEFAULT ''");
+    ensureColumn(db, "check_receipts", "before_fingerprint", "ALTER TABLE check_receipts ADD COLUMN before_fingerprint TEXT NOT NULL DEFAULT ''");
+    ensureColumn(db, "check_receipts", "after_fingerprint", "ALTER TABLE check_receipts ADD COLUMN after_fingerprint TEXT NOT NULL DEFAULT ''");
+    ensureColumn(db, "check_receipts", "profile_hash", "ALTER TABLE check_receipts ADD COLUMN profile_hash TEXT");
+    ensureColumn(db, "check_receipts", "mutation_paths_json", "ALTER TABLE check_receipts ADD COLUMN mutation_paths_json TEXT NOT NULL DEFAULT '[]'");
     ensureColumn(db, "hook_events", "event_key", "ALTER TABLE hook_events ADD COLUMN event_key TEXT");
     ensureColumn(db, "hook_events", "match_key", "ALTER TABLE hook_events ADD COLUMN match_key TEXT");
     ensureColumn(db, "hook_events", "claimed_at", "ALTER TABLE hook_events ADD COLUMN claimed_at TEXT");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.8.0",
+  "version": "0.9.0-beta.0",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "bin": {
@@ -27,6 +27,7 @@
   },
   "dependencies": {
     "ajv": "^8.20.0",
+    "shell-quote": "^1.10.0",
     "smol-toml": "^1.6.1",
     "yaml": "^2.9.0"
   },