@deksden-com/dd-flow-cli 0.9.0-beta.0 → 0.9.0-beta.7

package/dist/storage/database.js

@@ -1,10 +1,12 @@
 import fs from "node:fs";
 import path from "node:path";
+import crypto from "node:crypto";
 import { createRequire } from "node:module";
 import { ensureDir } from "./paths.js";
 import { AppError } from "../shared/errors.js";
 const require = createRequire(import.meta.url);
 const { DatabaseSync } = require("node:sqlite");
+const resourceDatabases = new Map();
 /** Creates the single Work/Session authority used by a fresh vNext beta runtime. */
 export function ensureVnextWorkStorage(db) {
     const legacy = db.get("SELECT name FROM sqlite_master WHERE type = 'table' AND name IN ('vnext_works', 'vnext_agent_turns', 'flow_agent_turns') LIMIT 1");
@@ -94,7 +96,7 @@ export function getDatabase(ddFlowHome, mode = "initialize") {
     // Internal additive schema changes must be available to every write command.
     // Higher-level Memory Bank migrations remain explicit in services/migrations.
     if (mode !== "read_existing")
-        migrate(db);
+        migrate(db, dbPath);
     if (mode === "read_existing")
         db.exec("PRAGMA query_only = ON");
     db.exec("PRAGMA foreign_keys = ON");
@@ -108,6 +110,72 @@ export function getDatabase(ddFlowHome, mode = "initialize") {
         all: (sql, params = []) => db.prepare(sql).all(...params)
     };
 }
+/**
+ * Opens the small host-wide resource registry.  It is intentionally separate
+ * from a RUN database: a process or a port can outlive the CLI client that
+ * created it, while a RUN database belongs to one flow home.
+ */
+export function getResourceDatabase(resourceHome) {
+    ensureDir(resourceHome);
+    const dbPath = path.join(resourceHome, "runtime.sqlite");
+    const cached = resourceDatabases.get(dbPath);
+    if (cached)
+        return cached;
+    const db = new DatabaseSync(dbPath);
+    configureDatabase(db, "initialize");
+    db.exec("PRAGMA foreign_keys = ON");
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS managed_processes (
+      id TEXT PRIMARY KEY,
+      kind TEXT NOT NULL,
+      pid INTEGER,
+      pid_started_at TEXT,
+      owner_id TEXT NOT NULL,
+      lease_token TEXT NOT NULL,
+      lease_expires_at TEXT NOT NULL,
+      project_id TEXT,
+      run_id TEXT,
+      work_id TEXT,
+      check_id TEXT,
+      operation_id TEXT,
+      stdout_path TEXT,
+      stderr_path TEXT,
+      state TEXT NOT NULL,
+      started_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      finished_at TEXT,
+      termination_reason TEXT,
+      metadata_json TEXT NOT NULL DEFAULT '{}'
+    );
+    CREATE INDEX IF NOT EXISTS idx_managed_processes_lease
+      ON managed_processes(state, lease_expires_at, updated_at);
+    CREATE TABLE IF NOT EXISTS managed_resources (
+      resource_kind TEXT NOT NULL,
+      resource_key TEXT NOT NULL,
+      owner_id TEXT NOT NULL,
+      lease_token TEXT NOT NULL,
+      lease_expires_at TEXT NOT NULL,
+      process_id TEXT,
+      metadata_json TEXT NOT NULL DEFAULT '{}',
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      PRIMARY KEY(resource_kind, resource_key)
+    );
+    CREATE INDEX IF NOT EXISTS idx_managed_resources_lease
+      ON managed_resources(lease_expires_at, updated_at);
+  `);
+    const database = {
+        path: dbPath,
+        writable: true,
+        close: () => { resourceDatabases.delete(dbPath); db.close?.(); },
+        exec: (sql) => db.exec(sql),
+        run: (sql, params = []) => db.prepare(sql).run(...params),
+        get: (sql, params = []) => db.prepare(sql).get(...params),
+        all: (sql, params = []) => db.prepare(sql).all(...params)
+    };
+    resourceDatabases.set(dbPath, database);
+    return database;
+}
 function emptyReadOnlyDatabase(dbPath) {
     return {
         path: dbPath,
@@ -125,7 +193,7 @@ function configureDatabase(db, mode) {
         db.exec("PRAGMA synchronous = NORMAL");
     }
 }
-function migrate(db) {
+function migrate(db, dbPath) {
     db.exec(`
     CREATE TABLE IF NOT EXISTS projects (
       id TEXT PRIMARY KEY,
@@ -351,6 +419,7 @@ function migrate(db) {
       project_id TEXT NOT NULL,
       harness TEXT NOT NULL DEFAULT 'codex-desktop',
       provider_session_id TEXT,
+      provider_parent_session_id TEXT,
       agent_id TEXT,
       parent_id TEXT,
       provider TEXT,
@@ -713,6 +782,7 @@ function migrate(db) {
     ensureColumn(db, "sessions", "metadata_json", "ALTER TABLE sessions ADD COLUMN metadata_json TEXT NOT NULL DEFAULT '{}'");
     ensureColumn(db, "sessions", "run_id", "ALTER TABLE sessions ADD COLUMN run_id TEXT");
     ensureColumn(db, "sessions", "provider_session_id", "ALTER TABLE sessions ADD COLUMN provider_session_id TEXT");
+    ensureColumn(db, "sessions", "provider_parent_session_id", "ALTER TABLE sessions ADD COLUMN provider_parent_session_id TEXT");
     ensureColumn(db, "sessions", "harness", "ALTER TABLE sessions ADD COLUMN harness TEXT NOT NULL DEFAULT 'codex-desktop'");
     ensureColumn(db, "sessions", "agent_id", "ALTER TABLE sessions ADD COLUMN agent_id TEXT");
     ensureColumn(db, "sessions", "provider", "ALTER TABLE sessions ADD COLUMN provider TEXT");
@@ -727,6 +797,7 @@ function migrate(db) {
     ensureColumn(db, "sessions", "plan_item_id", "ALTER TABLE sessions ADD COLUMN plan_item_id TEXT");
     ensureColumn(db, "sessions", "session_kind", "ALTER TABLE sessions ADD COLUMN session_kind TEXT");
     ensureColumn(db, "sessions", "coverage_units_json", "ALTER TABLE sessions ADD COLUMN coverage_units_json TEXT NOT NULL DEFAULT '[]'");
+    migrateSessionStorageKeys(db, dbPath);
     ensureColumn(db, "usage", "cache_read_input_tokens", "ALTER TABLE usage ADD COLUMN cache_read_input_tokens INTEGER");
     ensureColumn(db, "usage", "cache_write_input_tokens", "ALTER TABLE usage ADD COLUMN cache_write_input_tokens INTEGER");
     ensureColumn(db, "usage", "uncached_input_tokens", "ALTER TABLE usage ADD COLUMN uncached_input_tokens INTEGER");
@@ -783,6 +854,58 @@ function migrate(db) {
       ON runs(short_id);
   `);
 }
+/**
+ * Older builds used public or `harness:native` strings as foreign keys.  Move
+ * those keys once to an opaque storage key while preserving the original
+ * native value in provider_session_id.  We deliberately never split a native
+ * value on `:`: rows without a recorded provider ID remain untouched and are
+ * reported by normal preflight instead of guessed.
+ */
+function migrateSessionStorageKeys(db, dbPath) {
+    const rows = db.prepare("SELECT project_id, session_id, harness, provider_session_id, parent_session_id FROM sessions WHERE provider_session_id IS NOT NULL").all();
+    const changed = rows.map((row) => ({ ...row, next: storageSessionKey(row.harness, row.provider_session_id) })).filter((row) => row.session_id !== row.next);
+    if (changed.length === 0)
+        return;
+    // This is the only non-additive storage migration.  `VACUUM INTO` captures
+    // a consistent SQLite snapshot (including WAL state) before keys change.
+    if (dbPath && fs.existsSync(dbPath)) {
+        const backup = `${dbPath}.pre-session-key-v1-${Date.now()}.sqlite`;
+        db.exec(`VACUUM INTO '${backup.replace(/'/g, "''")}'`);
+    }
+    const duplicate = new Set();
+    for (const row of changed) {
+        const key = `${row.project_id}\0${row.next}`;
+        if (duplicate.has(key) || db.prepare("SELECT 1 FROM sessions WHERE project_id = ? AND session_id = ? AND session_id <> ?").get(row.project_id, row.next, row.session_id)) {
+            throw new AppError("session_identity_migration_conflict", "Cannot migrate ambiguous harness/native Session identity", 1, { project_id: row.project_id, harness_id: row.harness, session_id: row.provider_session_id });
+        }
+        duplicate.add(key);
+    }
+    db.exec("BEGIN IMMEDIATE");
+    try {
+        // First update references. Session rows themselves are updated afterwards,
+        // so every dependent row remains resolvable throughout the transaction.
+        for (const row of changed) {
+            db.prepare("UPDATE work_sessions SET session_id = ? WHERE session_id = ? AND work_id IN (SELECT work_id FROM works WHERE project_id = ?)").run(row.next, row.session_id, row.project_id);
+            db.prepare("UPDATE flow_session_segments SET session_id = ? WHERE project_id = ? AND session_id = ?").run(row.next, row.project_id, row.session_id);
+            db.prepare("UPDATE usage SET session_id = ? WHERE project_id = ? AND session_id = ?").run(row.next, row.project_id, row.session_id);
+            const parameters = [row.next, row.project_id, row.session_id];
+            db.prepare("UPDATE hook_events SET session_id = ? WHERE project_id = ? AND session_id = ?").run(...parameters);
+            db.prepare("UPDATE flow_jobs SET worker_session_id = ? WHERE project_id = ? AND worker_session_id = ?").run(...parameters);
+            db.prepare("UPDATE merge_queue SET claimed_by_session_id = ? WHERE project_id = ? AND claimed_by_session_id = ?").run(...parameters);
+            db.prepare("UPDATE sessions SET parent_session_id = ? WHERE project_id = ? AND parent_session_id = ?").run(...parameters);
+            db.prepare("UPDATE sessions SET session_id = ? WHERE project_id = ? AND session_id = ?").run(...parameters);
+        }
+        db.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_sessions_harness_native ON sessions(project_id, harness, provider_session_id) WHERE provider_session_id IS NOT NULL");
+        db.exec("COMMIT");
+    }
+    catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+    }
+}
+function storageSessionKey(harness, native) {
+    return `SES-${crypto.createHash("sha256").update(harness).update("\0").update(native).digest("hex").slice(0, 24)}`;
+}
 function migrateProjectScopedIdentity(db) {
     const protocolColumns = db.prepare("PRAGMA table_info(protocols)").all();
     const legacyGlobalPrimaryKey = protocolColumns.some((column) => column.name === "id" && column.pk === 1)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.0",
+  "version": "0.9.0-beta.7",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "bin": {
@@ -16,6 +16,15 @@
     "node": ">=26.0.0",
     "pnpm": ">=10.0.0"
   },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && node scripts/generate-build-info.mjs && node scripts/copy-assets.mjs",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint . --max-warnings=0",
+    "test": "vitest run",
+    "changeset": "changeset",
+    "version-packages": "changeset version",
+    "release": "pnpm run build && changeset publish"
+  },
   "devDependencies": {
     "@changesets/cli": "^2.31.0",
     "@eslint/js": "^9.39.1",
@@ -34,14 +43,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "license": "MIT",
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json && node scripts/generate-build-info.mjs && node scripts/copy-assets.mjs",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint . --max-warnings=0",
-    "test": "vitest run",
-    "changeset": "changeset",
-    "version-packages": "changeset version",
-    "release": "pnpm run build && changeset publish"
-  }
-}
+  "license": "MIT"
+}

package/tools/audit-runtime-fix-boundaries.mjs

@@ -0,0 +1,96 @@
+// Adversarial acceptance checks, independent of the long CLI fixture suite.
+// Run after building: pnpm build && node tools/audit-runtime-fix-boundaries.mjs
+// Uses only disposable local workspaces; no provider or production DB calls.
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { log } from "node:console";
+import { setTimeout, clearTimeout } from "node:timers";
+import { spawn } from "node:child_process";
+import { once } from "node:events";
+import { createContext } from "../dist/runtime/context.js";
+import { getResourceDatabase } from "../dist/storage/database.js";
+import { checksForRunAt, runCodeChecks, checkReceipts } from "../dist/services/code-checks.js";
+import { claimExpiredManagedProcesses, confirmManagedProcess, finishManagedProcess, managedProcessStatus, reconcileExpiredManagedProcesses, registerManagedProcess, reservePorts } from "../dist/services/managed-processes.js";
+import { selectRepairChecks } from "../dist/services/vnext-code.js";
+
+const results = [];
+const observations = {};
+async function check(name, action) {
+  try { await action(); results.push({ name, passed: true }); }
+  catch (error) { results.push({ name, passed: false, expected: error.expected, actual: error.actual, message: error.message }); }
+}
+const root = fs.mkdtempSync(path.join(os.tmpdir(), "dd-flow-fix-audit-"));
+const resources = path.join(root, "resources");
+const context = createContext({ DD_FLOW_HOME: path.join(root, "flow"), DD_FLOW_RESOURCE_HOME: resources });
+const projectRoot = path.join(root, "project");
+fs.mkdirSync(projectRoot);
+try {
+  const request = {
+    projectId: "PRJ-AUDIT", runId: "RUN-AUDIT", runHome: path.join(root, "run"), workspaceRoot: projectRoot, scope: "aggregate",
+    checks: [{ id: "CHK-AUDIT", command: "sleep 0.05", purpose: "concurrent claim audit", run_at: "code", availability: "available" }]
+  };
+  const calls = await Promise.allSettled([runCodeChecks(context, request), runCodeChecks(context, request)]);
+  const rows = checkReceipts(context, { projectId: request.projectId, runId: request.runId });
+  observations.concurrent = calls.map((call) => call.status === "fulfilled" ? { status: call.status, receipts: call.value.map(({ id, status }) => ({ id, status })) } : { status: call.status, code: call.reason.code });
+  await check("a concurrent caller receives check_in_progress during the spawn window", () => assert.equal(calls.filter((call) => call.status === "rejected" && call.reason.code === "check_in_progress").length, 1));
+  await check("returned and persisted terminal check statuses agree", () => {
+    for (const call of calls.filter((call) => call.status === "fulfilled")) {
+      for (const receipt of call.value) assert.equal(rows.find((row) => row.id === receipt.id)?.status, receipt.status);
+    }
+  });
+
+  const source = { id: "CHK-QUALITY", command: "true", purpose: "aggregate quality gate", run_at: "code", availability: "available" };
+  await check("semantic repair retains an aggregate gate for context but does not run it in a Work", () => assert.deepEqual(checksForRunAt(selectRepairChecks({ semanticChecks: [source] }), "work"), []));
+
+  const record = registerManagedProcess(context, { kind: "audit", ownerId: "audit-owner", leaseMs: -1 });
+  const claimed = claimExpiredManagedProcesses(context, "interrupted-reconciler");
+  await check("orphan cleanup can be reclaimed after a reconciler interruption", () => {
+    assert.ok(claimed.some((item) => item.id === record.id));
+    context.now = () => "2099-01-01T00:00:00.000Z";
+    assert.ok(claimExpiredManagedProcesses(context, "next-reconciler").some((item) => item.id === record.id));
+  });
+  context.now = () => new Date().toISOString();
+  const ownedProcess = registerManagedProcess(context, { kind: "audit", ownerId: "audit-with-port" });
+  const allocation = await reservePorts(context, { ownerId: ownedProcess.owner_id, processId: ownedProcess.id, names: ["api"] });
+  try {
+    finishManagedProcess(context, { id: ownedProcess.id, leaseToken: ownedProcess.lease_token, state: "stopped" });
+    await check("terminal process cleanup also releases its durable port claims", () => {
+      const rows = getResourceDatabase(resources).all("SELECT * FROM managed_resources WHERE process_id = ?", [ownedProcess.id]);
+      assert.equal(rows.length, 0);
+    });
+  } finally { allocation.release(); }
+  await check("orphan reconciliation also terminates the process-owned child tree", async () => {
+    // Both processes belong only to this temporary test. A private process
+    // group makes the finally block able to clean up even a failed assertion.
+    const tree = spawn(process.execPath, ["-e", `const {spawn}=require('node:child_process'); const child=spawn(process.execPath,['-e','setInterval(()=>{},1000)'],{stdio:'ignore'}); console.log(child.pid); setInterval(()=>{},1000);`], { detached: true, stdio: ["ignore", "pipe", "ignore"] });
+    const closed = once(tree, "close");
+    let timer;
+    try {
+      const data = await Promise.race([once(tree.stdout, "data"), new Promise((_, reject) => { timer = setTimeout(() => reject(new Error("test process did not start")), 2000); })]);
+      clearTimeout(timer);
+      const childPid = Number(String(data[0]).trim());
+      assert.ok(Number.isInteger(childPid) && childPid > 0);
+      const record = registerManagedProcess(context, { kind: "audit-tree", ownerId: "audit-tree-owner" });
+      confirmManagedProcess(context, { id: record.id, leaseToken: record.lease_token, pid: tree.pid, processGroupId: tree.pid });
+      getResourceDatabase(resources).run("UPDATE managed_processes SET lease_expires_at = ? WHERE id = ?", ["2000-01-01T00:00:00.000Z", record.id]);
+      await reconcileExpiredManagedProcesses(context, "audit-tree-cleanup", 20);
+      let alive = true;
+      try { process.kill(childPid, 0); } catch { alive = false; }
+      assert.equal(alive, false);
+    } finally {
+      clearTimeout(timer);
+      try { process.kill(-tree.pid, "SIGKILL"); } catch { /* our group has already stopped */ }
+      await closed;
+    }
+  });
+  await check("the check owner reaches a terminal process state on ordinary completion", () => assert.ok(managedProcessStatus(context).filter((item) => item.kind === "check").every((item) => ["stopped", "failed"].includes(item.state))));
+} finally {
+  context.db.close();
+  getResourceDatabase(resources).close();
+  fs.rmSync(root, { recursive: true, force: true });
+}
+log(JSON.stringify({ checks: results.length, passed: results.filter((item) => item.passed).length, results, observations }, null, 2));
+process.exitCode = results.some((item) => !item.passed) ? 1 : 0;