@deksden-com/dd-flow-cli 0.9.0-beta.100 → 0.9.0-beta.103

package/dist/build-info.json

@@ -1,8 +1,8 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.100",
-  "cli_commit": "d7700af4c6d5985d8d6fd762d6d515bf766d8604",
-  "built_at": "2026-09-22T22:32:27.076Z",
+  "cli_version": "0.9.0-beta.103",
+  "cli_commit": "26ffa3e3ac8382c8a83bae2593a91a3e922f10a9",
+  "built_at": "2026-09-25T12:03:44.786Z",
   "built_with_canon": {
     "version": "4.1.1",
     "commit": "678daa038287c948ada5b2d785a6dcc925c7b891",

package/dist/cli/hook-ingress.js

@@ -5,6 +5,7 @@ import { errorRecord, AppError } from "../shared/errors.js";
 import { parseJsonObject } from "../shared/json.js";
 const workerFile = fileURLToPath(import.meta.url);
 const ingressBudgetMs = 20_000; // Native host timeout is 30s; this includes cold module/DB open.
+const { hookBudget, readNativeHookInput } = await import("../harness-runtime/lib/native-hook-command.mjs");
 /** Lightweight entry: unrelated hooks never load the router or open storage. */
 export async function runHookIngress(args) {
     try {
@@ -20,12 +21,8 @@ export async function runHookIngress(args) {
             throw new AppError("usage", "--project-root requires a value", 2);
         if (parsed.options.has("json") && parsed.options.get("json")?.[0] !== "__dd_flow_flag__")
             throw new AppError("usage", "--json does not take a value", 2);
-        let stdin = "";
-        for await (const chunk of process.stdin) {
-            stdin += String(chunk);
-            if (Buffer.byteLength(stdin) > 1_048_576)
-                throw new AppError("native_hook_response_invalid", "Hook input exceeds 1 MiB", 1);
-        }
+        const budget = hookBudget(ingressBudgetMs);
+        const stdin = await readNativeHookInput(process.stdin, budget);
         const payload = parseJsonObject(stdin || "{}", "native hook stdin");
         const command = lifecycleCommandFromPayload(payload);
         if (event !== "PreToolUse" || !command || (parseLifecycleCommand(command).kind === "none" && !continuationCommand(command))) {
@@ -34,7 +31,7 @@ export async function runHookIngress(args) {
         }
         const started = performance.now();
         const { invokeNativeHook } = await import("../harness-runtime/lib/native-hook-command.mjs");
-        const result = await invokeNativeHook({ bin: workerFile, args, payload, home: process.env.DD_FLOW_HOME, timeoutMs: ingressBudgetMs });
+        const result = await invokeNativeHook({ bin: workerFile, args, payload, home: process.env.DD_FLOW_HOME, timeoutMs: budget.remaining("admission") });
         const { timing, ...output } = result;
         process.stderr.write(`${JSON.stringify({ kind: "hook_ingress", total_ms: Math.round(performance.now() - started), ...timing })}\n`);
         process.stdout.write(`${JSON.stringify(output)}\n`);
@@ -49,9 +46,7 @@ export async function runHookIngress(args) {
 // A bounded CLI subprocess, not a detached writer: its successful reply follows COMMIT.
 if (process.argv[1] === workerFile) {
     try {
-        let stdin = "";
-        for await (const chunk of process.stdin)
-            stdin += String(chunk);
+        const stdin = await readNativeHookInput(process.stdin, hookBudget(ingressBudgetMs));
         const payload = parseJsonObject(stdin, "native hook stdin");
         const started = performance.now();
         const { verifyCodexHookDelivery } = await import("../services/codex-hook-delivery.js");

package/dist/harness-runtime/bin/dd-agy.mjs

@@ -1,30 +1,43 @@
 #!/usr/bin/env node
 import { durableDaemonStart, inspectDaemonOperation, interruptDaemonOperation, settleDaemonOperation } from "../lib/daemon-operations.mjs";
 import { readFile } from "node:fs/promises";
-import { invokeNativeHook } from "../lib/native-hook-command.mjs";
+import { randomUUID } from "node:crypto";
+import path from "node:path";
+import { writeJsonAtomic } from "../lib/runner-events.mjs";
+import { hookBudget, invokeNativeHook, readNativeHookInput } from "../lib/native-hook-command.mjs";
 import { doctor } from "../lib/dd-agy.mjs";
-import { callDaemon, serveDaemon, startDaemon, stopDaemon } from "../lib/dd-agy-daemon.mjs";
+import { callDaemon, qualifyAgyHooks, serveDaemon, startDaemon, stopDaemon } from "../lib/dd-agy-daemon.mjs";
 
 function parse(argv) { const positional = [], options = {}; for (let i = 0; i < argv.length; i += 1) { const token = argv[i]; if (!token.startsWith("--")) { positional.push(token); continue; } const key = token.slice(2); if (["json","cancel-tree","tree","no-flow"].includes(key)) options[key] = true; else { if (argv[i + 1] === undefined) throw new Error(`--${key} requires a value`); options[key] = argv[++i]; } } return { positional, options }; }
 const prompt = async options => options["prompt-file"] ? await readFile(options["prompt-file"], "utf8") : options.prompt;
-async function stdin() { let value = ""; process.stdin.setEncoding("utf8"); for await (const chunk of process.stdin) value += chunk; return value; }
 async function hook(options) {
-  const payload = JSON.parse(await stdin() || "{}"), event = options.event;
-  const identity = await callDaemon(options["state-dir"], "hook.observe", { event, payload }, 10_000);
+  const budget = hookBudget(), requestId = randomUUID();
+  const payload = JSON.parse(await readNativeHookInput(process.stdin, budget) || "{}"), event = options.event;
+  try {
+  const observationMs = budget.remaining("observation");
+  const identity = await callDaemon(options["state-dir"], "hook.observe", { event, payload, daemonId: options["daemon-id"], deadlineAt: Date.now() + observationMs }, observationMs, requestId);
   if (identity.stale) return event === "PreToolUse" ? { decision: "deny", reason: "agy_stale_hook" } : {};
   if (event === "PreToolUse" || event === "PostToolUse") {
     const phase = event === "PreToolUse" ? "before" : "after", args = payload.toolCall?.args ?? {};
     const normalized = { schema_id: "dd-flow/agy-tool-event@1", event_id: identity.event_id, phase, daemon_id: identity.daemon_id, conversation_id: payload.conversationId, parent_conversation_id: identity.parent_conversation_id, execution_num: payload.executionNum, step_index: payload.stepIdx, tool: payload.toolCall?.name, input: args, workspace_paths: payload.workspacePaths, transcript_path: payload.transcriptPath, model: payload.modelName, profile: identity.profile, ...(phase === "after" ? { error: payload.error ?? "" } : {}) };
     await invokeNativeHook({ bin: options["dd-flow-bin"] ?? identity.dd_flow_bin,
       args: ["agy", "event", "handle", "--project-root", options["project-root"] ?? identity.project_root, "--json"],
-      payload: normalized, home: options["dd-flow-home"] ?? identity.dd_flow_home });
+      payload: normalized, home: options["dd-flow-home"] ?? identity.dd_flow_home, timeoutMs: budget.remaining("admission", 15_000) });
   }
   return event === "PreToolUse" ? { decision: "allow" } : {};
+  } catch (error) {
+    // A failed socket cannot be used to report its own failure. The daemon
+    // reads only receipts matching request IDs it actually accepted this turn.
+    try { await writeJsonAtomic(path.join(options["state-dir"], "hook-failures", `${requestId}.json`), { request_id: requestId, observed_at: new Date().toISOString(), code: error.code ?? "agy_hook_rejected", message: error.message, details: { ...error.details, effect: "unknown" } }); }
+    catch (storage) { process.stderr.write(`${JSON.stringify({ code: error.code, receipt_error: storage.message })}\n`); }
+    throw error;
+  }
 }
 
 try {
   const { positional, options } = parse(process.argv.slice(2)), [family, command, modifier] = positional; const common = { journal: options.journal, stateDir: options["state-dir"], cwd: options.cwd, bin: options["agy-bin"], provider: options.provider, model: options.model, reasoning: options.reasoning, mode: options.mode, projectRoot: options["project-root"], ddFlowBin: options["dd-flow-bin"], ddFlowHome: options["dd-flow-home"], noFlow: options["no-flow"] === true, timeoutMs: options.timeout ? Number(options.timeout) * 1000 : undefined }; let result;
   if (family === "doctor") result = await doctor(common);
+  else if (family === "hooks" && ["install", "check"].includes(command)) result = await qualifyAgyHooks(common.projectRoot, { stateDir: common.stateDir, install: command === "install" });
   else if (family === "daemon" && command === "start") result = await durableDaemonStart({ ...common, sessionId: options["session-id"], entryPath: process.argv[1] }, startDaemon);
   else if (family === "daemon" && command === "serve") { await serveDaemon(common.stateDir); process.exit(0); }
   else if (family === "daemon" && command === "status") result = await callDaemon(common.stateDir, "daemon.status");
@@ -34,6 +47,6 @@ try {
   else if (family === "daemon" && command === "stop") result = await stopDaemon({ stateDir: common.stateDir, cancelTree: options["cancel-tree"], timeoutMs: common.timeoutMs });
   else if (family === "hook" && command === "handle") { process.stdout.write(`${JSON.stringify(await hook(options))}\n`); process.exit(0); }
   else if (family === "session") { if (command === "fork") throw Object.assign(new Error("Antigravity native headless fork is unsupported; use deterministic_replay"), { code: "agy_headless_fork_unsupported" }); const operation = command === "status" ? "inspect" : command; result = await callDaemon(common.stateDir, `session.${operation}`, { sessionId: options["session-id"], ...(command === "create" || command === "prompt" ? { prompt: await prompt(options) } : {}), tree: options.tree === true }, common.timeoutMs ?? 1_800_000); }
-  else throw new Error("usage: dd-agy doctor | daemon start|status|stop | session create|prompt|inspect|resume|cancel|fork [options] --json");
+  else throw new Error("usage: dd-agy doctor | hooks install|check | daemon start|status|stop | session create|prompt|inspect|resume|cancel|fork [options] --json");
   process.stdout.write(`${JSON.stringify({ ok: true, ...result })}\n`);
 } catch (error) { if (process.argv.includes("hook") && process.argv.includes("handle")) { process.stdout.write(`${JSON.stringify({ decision: "deny", reason: error.code ?? "agy_hook_rejected" })}\n`); process.exit(0); } process.stderr.write(`${JSON.stringify({ ok: false, error: error.message, ...(error.code ? { code: error.code, retryable: error.retryable === true, details: error.details } : {}) })}\n`); process.exit(1); }

package/dist/harness-runtime/bin/dd-droid.mjs

@@ -7,9 +7,9 @@ import path from "node:path";
 import { DROID_CONTRACT, DROID_PROTOCOL, DroidRuntime, droidVersion } from "../lib/dd-droid.mjs";
 import { callDaemon, serveDaemon, startDaemon, stopDaemon } from "../lib/dd-droid-daemon.mjs";
 import { errorRecord } from "../lib/operation-errors.mjs";
+import { hookBudget, readNativeHookInput } from "../lib/native-hook-command.mjs";
 
 function parse(argv) { const positional = [], options = {}; for (let i = 0; i < argv.length; i++) { const word = argv[i]; if (!word.startsWith("--")) { positional.push(word); continue; } const key = word.slice(2); if (["json", "cancel-tree", "tree", "no-flow"].includes(key)) options[key] = true; else { if (argv[i + 1] === undefined) throw new Error(`${word} requires a value`); options[key] = argv[++i]; } } return { positional, options }; }
-async function input() { let text = ""; for await (const chunk of process.stdin) text += chunk; return text; }
 try {
   const { positional: [family, command, modifier], options } = parse(process.argv.slice(2));
   const config = { stateDir: options["state-dir"], sessionId: options["session-id"], cwd: options.cwd, projectRoot: options["project-root"], bin: options["droid-bin"] ?? "droid", entryPath: process.argv[1], journal: options.journal, authHome: options["auth-home"], model: options.model, provider: options.provider, reasoning: options.reasoning, mode: options.mode, ddFlowBin: options["dd-flow-bin"], ddFlowHome: options["dd-flow-home"], noFlow: options["no-flow"] === true, timeoutMs: options.timeout ? Number(options.timeout) * 1_000 : undefined };
@@ -26,7 +26,7 @@ try {
   else if (family === "daemon" && command === "operation" && modifier === "settle") result = await settleDaemonOperation(config.stateDir, options["operation-id"]);
   else if (family === "daemon" && command === "operation") result = await inspectDaemonOperation(config.stateDir, options["operation-id"]);
   else if (family === "daemon" && command === "stop") result = await stopDaemon({ stateDir: config.stateDir, cancelTree: options["cancel-tree"] });
-  else if (family === "hook" && command === "handle") { const payload = JSON.parse(await input()); const eventId = randomUUID(); result = await callDaemon(config.stateDir, "hook.observe", { payload, eventId }, 25_000, eventId); }
+  else if (family === "hook" && command === "handle") { const budget = hookBudget(); const payload = JSON.parse(await readNativeHookInput(process.stdin, budget)); const eventId = randomUUID(); result = await callDaemon(config.stateDir, "hook.observe", { payload, eventId, deadlineAt: budget.deadlineAt }, budget.remaining("observation"), eventId); }
   else if (family === "session") { if (command === "fork") throw new Error("Droid fork is not qualified for this adapter"); const prompt = options["prompt-file"] ? await readFile(options["prompt-file"], "utf8") : options.prompt; result = await callDaemon(config.stateDir, `session.${command === "status" ? "inspect" : command}`, { sessionId: options["session-id"], ...(config.noFlow ? { noFlow: true } : {}), ...(prompt ? { prompt } : {}) }); }
   else throw new Error("usage: dd-droid doctor | daemon start|status|operation|stop | session create|resume|prompt|inspect|cancel");
   process.stdout.write(`${JSON.stringify(family === "hook" ? { ...(result.hookSpecificOutput ? { hookSpecificOutput: result.hookSpecificOutput } : {}), ...(typeof result.continue === "boolean" ? { continue: result.continue } : {}), ...(result.stopReason ? { stopReason: result.stopReason } : {}) } : { ok: true, ...result })}\n`);

package/dist/harness-runtime/bin/dd-grok.mjs

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { durableDaemonStart, inspectDaemonOperation, interruptDaemonOperation, settleDaemonOperation } from "../lib/daemon-operations.mjs";
-import { invokeNativeHook } from "../lib/native-hook-command.mjs";
+import { hookBudget, invokeNativeHook, readNativeHookInput } from "../lib/native-hook-command.mjs";
 import { cancelSession, createSession, doctor, forkSession, inspectSession, promptFromFile, promptSession } from "../lib/dd-grok.mjs";
 import { callDaemon, serveDaemon, startDaemon, stopDaemon } from "../lib/dd-grok-daemon.mjs";
 
 function parse(argv) { const positional = []; const options = {}; for (let index = 0; index < argv.length; index += 1) { const token = argv[index]; if (!token.startsWith("--")) { positional.push(token); continue; } const key = token.slice(2); if (["json", "cancel-tree", "no-flow"].includes(key)) { options[key] = true; continue; } const value = argv[++index]; if (value === undefined) throw new Error(`--${key} requires a value`); options[key] = value; } return { positional, options }; }
 function common(options) { return { bin: options["grok-bin"], journal: options.journal, stateDir: options["state-dir"], cwd: options.cwd, sessionId: options["session-id"], model: options.model, reasoning: options.reasoning, mode: options.mode ?? "bypassPermissions", authPath: options["auth-path"], authMethodId: options["auth-method-id"], ddFlowBin: options["dd-flow-bin"], ddFlowHome: options["dd-flow-home"], projectRoot: options["project-root"], sessionArchive: options["session-archive"], noFlow: options["no-flow"] === true, timeoutMs: options.timeout ? Number(options.timeout) * 1000 : undefined }; }
-async function readStdin() { let value = ""; process.stdin.setEncoding("utf8"); for await (const chunk of process.stdin) value += chunk; return value; }
 async function hook(options) {
-  const stdin = await readStdin(); const payload = JSON.parse(stdin || "{}"); const identity = await callDaemon(options["state-dir"], "hook.resolve", { sessionId: payload.sessionId ?? payload.session_id });
+  const budget = hookBudget();
+  const stdin = await readNativeHookInput(process.stdin, budget); const payload = JSON.parse(stdin || "{}"); const identity = await callDaemon(options["state-dir"], "hook.resolve", { sessionId: payload.sessionId ?? payload.session_id }, budget.remaining("identity"));
   const enriched = { ...payload, _meta: { ...(payload._meta ?? {}), ddGrok: identity } }; const args = ["grok", "event", "handle", "--project-root", options["project-root"], "--json"]; const command = options["dd-flow-bin"];
-  return invokeNativeHook({ bin: command, args, home: options["dd-flow-home"], payload: enriched });
+  return invokeNativeHook({ bin: command, args, home: options["dd-flow-home"], payload: enriched, timeoutMs: budget.remaining("admission", 15_000) });
 }
 
 try {

package/dist/harness-runtime/bin/dd-zcode.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { durableDaemonStart, inspectDaemonOperation, interruptDaemonOperation, settleDaemonOperation } from "../lib/daemon-operations.mjs";
-import { invokeNativeHook } from "../lib/native-hook-command.mjs";
+import { hookBudget, invokeNativeHook, readNativeHookInput } from "../lib/native-hook-command.mjs";
 import { cancelChild, cancelSession, createSession, doctor, forkSession, inspectSession, promptFromFile, promptSession } from "../lib/dd-zcode.mjs";
 import { callDaemon, serveDaemon, startDaemon, stopDaemon } from "../lib/dd-zcode-daemon.mjs";
 
@@ -37,13 +37,13 @@ function common(options) {
   };
 }
 
-async function readStdin() { let value = ""; process.stdin.setEncoding("utf8"); for await (const chunk of process.stdin) value += chunk; return value; }
 async function hook(options) {
-  const payload = JSON.parse((await readStdin()) || "{}");
-  const identity = await callDaemon(options["state-dir"], "hook.resolve", { sessionId: payload.session_id ?? payload.sessionId });
+  const budget = hookBudget();
+  const payload = JSON.parse((await readNativeHookInput(process.stdin, budget)) || "{}");
+  const identity = await callDaemon(options["state-dir"], "hook.resolve", { sessionId: payload.session_id ?? payload.sessionId }, budget.remaining("identity"));
   const command = options["dd-flow-bin"]; const args = ["zcode", "hook", "handle", "--project-root", options["project-root"], "--json"];
 
-  return invokeNativeHook({ bin: command, args, home: options["dd-flow-home"], payload: { ...payload, _meta: { ...(payload._meta ?? {}), ddZcode: identity } } });
+  return invokeNativeHook({ bin: command, args, home: options["dd-flow-home"], timeoutMs: budget.remaining("admission", 15_000), payload: { ...payload, _meta: { ...(payload._meta ?? {}), ddZcode: identity } } });
 }
 
 try {

package/dist/harness-runtime/lib/agy-hooks.d.mts

@@ -0,0 +1 @@
+export function agyWorkspaceHooks(): Record<string, unknown>;

package/dist/harness-runtime/lib/agy-hooks.mjs

@@ -0,0 +1,9 @@
+// Qualified hooks are stable; only the launching process selects its pinned
+// entrypoint and daemon. Keep this document shared with product-file policy.
+export function agyWorkspaceHooks() {
+  const command = '"${DD_AGY_HOOK_NODE:?missing AGY hook binding}" "${DD_AGY_HOOK_ENTRY:?missing AGY hook binding}" hook handle --event __EVENT__ --state-dir "${DD_AGY_STATE_DIR:?missing AGY hook binding}" --daemon-id "${DD_AGY_DAEMON_ID:?missing AGY hook binding}" --json';
+  return { "dd-flow": {
+    PreToolUse: [{ matcher: "^run_command$", hooks: [{ type: "command", command: command.replace("__EVENT__", "PreToolUse"), timeout: 30 }] }],
+    Stop: [{ type: "command", command: command.replace("__EVENT__", "Stop"), timeout: 30 }]
+  } };
+}

package/dist/harness-runtime/lib/daemon-operations.mjs

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { mkdir, readFile, link, unlink, open } from "node:fs/promises";
+import { mkdir, readFile, readdir, link, unlink, open } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import path from "node:path";
 import { hashJson, writeJsonAtomic } from "./runner-events.mjs";
@@ -36,7 +36,18 @@ export async function inspectDaemonOperation(root, id) {
   const requested = await read(path.join(directory, "requested.json"));
   if (!requested) throw Object.assign(new Error("daemon operation is not recorded"), { code: "operation_not_found", details: { operation_id: id } });
   const settlement = await read(path.join(directory, "settlement.json"));
-  return { ...requested, ...(await read(path.join(directory, "result.json")) ?? await read(path.join(directory, "interrupted.json")) ?? await read(path.join(directory, "observation-lost.json")) ?? { state: "running" }), ...(settlement ? { settlement } : {}) };
+  const hookFailures = [];
+  for (const name of await readdir(path.join(directory, "hooks")).catch(error => { if (error.code === "ENOENT") return []; throw error; })) {
+    if (!/^[A-Za-z0-9-]{1,128}\.json$/.test(name)) continue;
+    const binding = await read(path.join(directory, "hooks", name));
+    if (binding?.schema_id !== "dd-flow/hook-request@1" || binding.request_id !== name.slice(0, -5) || binding.operation_id !== id || binding.daemon_id !== requested.daemon_id) continue;
+    const failure = await read(path.join(root, "hook-failures", name));
+    if (failure?.request_id !== binding.request_id || typeof failure.code !== "string" || typeof failure.message !== "string") continue;
+    hookFailures.push({ code: failure.code, message: failure.message, observed_at: failure.observed_at ?? null, details: { ...failure.details, ...binding, effect: "unknown" } });
+  }
+  hookFailures.sort((a, b) => String(a.observed_at ?? "").localeCompare(String(b.observed_at ?? "")));
+  // Admission failure is causal evidence, not proof that the native tree stopped.
+  return { ...requested, ...(await read(path.join(directory, "result.json")) ?? await read(path.join(directory, "interrupted.json")) ?? await read(path.join(directory, "observation-lost.json")) ?? { state: "running" }), ...(settlement ? { settlement } : {}), ...(hookFailures[0] ? { primary_error: hookFailures[0] } : {}) };
 }
 
 /** Retry only the bookkeeping that follows a durable productive receipt.

package/dist/harness-runtime/lib/dd-agy-daemon.d.mts

@@ -0,0 +1,6 @@
+export declare function qualifyAgyHooks(projectRoot: string, options?: { stateDir?: string | null; install?: boolean }): Promise<{
+  hooksSha256: string;
+  workspaceHooksPath: string;
+  workspaceHooksSha256: string;
+  workspaceHooksInstalled: string;
+}>;

package/dist/harness-runtime/lib/dd-agy-daemon.mjs

@@ -4,7 +4,10 @@ import { createHash, randomUUID } from "node:crypto";
 import { appendFile, chmod, lstat, mkdir, open, readFile, realpath, rename, unlink, writeFile } from "node:fs/promises";
 import { spawn } from "node:child_process";
 import net from "node:net";
+import { isDeepStrictEqual } from "node:util";
 import { ObservationClock } from "./observation-clock.mjs";
+import { hookBudget } from "./native-hook-command.mjs";
+import { agyWorkspaceHooks } from "./agy-hooks.mjs";
 import { durableDaemonDispatch } from "./daemon-operations.mjs";
 import path from "node:path";
 import { observeModel } from "./model-observations.mjs";
@@ -25,7 +28,7 @@ async function writeJson(file, value) { const temporary = `${file}.${process.pid
 async function readState(dir) { try { return JSON.parse(await readFile(locations(dir).state, "utf8")); } catch (error) { if (error.code === "ENOENT") return null; throw error; } }
 async function removeSocket(paths) { try { if (!(await lstat(paths.socket)).isSocket()) throw new DaemonError("unsafe_socket", "refusing to replace a non-socket daemon path"); await unlink(paths.socket); } catch (error) { if (error.code !== "ENOENT") throw error; } }
 const shell = value => `'${String(value).replaceAll("'", `'"'"'`)}'`;
-function sanitizedEnv(config) { const env = { ...process.env, TMPDIR: config.temporary }; for (const key of ["GEMINI_API_KEY","GOOGLE_API_KEY","ANTHROPIC_API_KEY","OPENAI_API_KEY"]) delete env[key]; return env; }
+function sanitizedEnv(config) { const env = { ...process.env, TMPDIR: config.temporary, DD_AGY_HOOK_NODE: process.execPath, DD_AGY_HOOK_ENTRY: config.entryPath, DD_AGY_STATE_DIR: config.stateDir, DD_AGY_DAEMON_ID: config.daemonId }; for (const key of ["GEMINI_API_KEY","GOOGLE_API_KEY","ANTHROPIC_API_KEY","OPENAI_API_KEY"]) delete env[key]; return env; }
 function errorPayload(error) { return { code: error.code ?? "operation_failed", message: error.message ?? String(error), retryable: error.retryable === true, ...(error.details === undefined ? {} : { details: error.details }) }; }
 async function forwardUsage(config, sessionId, result, tools, descendants) {
   if (!config.ddFlowBin || !config.projectRoot) return;
@@ -38,39 +41,52 @@ async function forwardUsage(config, sessionId, result, tools, descendants) {
 }
 
 export async function prepare(paths, config) {
+  config.stateDir = paths.dir;
+  config.hookBinding = "environment-v1";
+  const hooks = agyWorkspaceHooks();
   for (const dir of [paths.dir, paths.gemini, paths.runtime, paths.config, paths.temporary]) { await mkdir(dir, { recursive: true, mode: 0o700 }); await chmod(dir, 0o700); }
   if (config.noFlow) {
     // Technical probes still need native settlement, but must not install
     // workspace hooks or forward any lifecycle mutation to dd-flow.
-    const command = `${shell(process.execPath)} ${shell(config.entryPath)} hook handle --event Stop --state-dir ${shell(paths.dir)} --json`;
-    await writeJson(path.join(paths.config, "hooks.json"), { "dd-flow-observer": { Stop: [{ type: "command", command, timeout: 30 }] } });
+    await writeJson(path.join(paths.config, "hooks.json"), { "dd-flow-observer": { Stop: hooks["dd-flow"].Stop } });
     return;
   }
-  const command = `${shell(process.execPath)} ${shell(config.entryPath)} hook handle --event __EVENT__ --state-dir ${shell(paths.dir)} --project-root ${shell(config.projectRoot)} --dd-flow-bin ${shell(config.ddFlowBin)} --dd-flow-home ${shell(config.ddFlowHome)} --json`;
-  const hooks = { "dd-flow": {
-    // Only shell lifecycle commands require trusted pre-execution identity.
-    // PostToolUse only recorded observations; native updates and Stop settle work.
-    PreToolUse: [{ matcher: "^run_command$", hooks: [{ type: "command", command: command.replace("__EVENT__", "PreToolUse"), timeout: 30 }] }],
-    Stop: [{ type: "command", command: command.replace("__EVENT__", "Stop"), timeout: 30 }]
-  } };
+  // Native discovery follows cwd (feature worktree/reviewer clone), while
+  // projectRoot remains the stable lifecycle identity returned to dd-flow.
+  Object.assign(config, await qualifyAgyHooks(config.cwd ?? config.projectRoot, { stateDir: paths.dir }));
+  // Workspace discovery covers root and children without global duplicates.
+  await writeJson(path.join(paths.config, "hooks.json"), {});
+}
+
+export async function qualifyAgyHooks(projectRoot, { stateDir = null, install = false } = {}) {
+  const hooks = agyWorkspaceHooks();
   // Register in workspace discovery before creating any Session: native root
   // and children load these named hook definitions without a global duplicate.
   // Replace our prior handlers, including the obsolete wildcard post hook,
   // without dropping unrelated commands in a shared matcher group.
-  const workspaceConfig = path.join(config.projectRoot, ".agents");
-  await mkdir(workspaceConfig, { recursive: true, mode: 0o700 });
+  const workspaceConfig = path.join(absolute(projectRoot, "--project-root"), ".agents");
   const workspaceHooks = path.join(workspaceConfig, "hooks.json");
-  let existing = {};
+  let existing = {}, existingText = "";
   try {
-    const parsed = JSON.parse(await readFile(workspaceHooks, "utf8"));
+    existingText = await readFile(workspaceHooks, "utf8");
+    const parsed = JSON.parse(existingText);
     if (!parsed || Array.isArray(parsed) || typeof parsed !== "object") throw new Error("not an object");
     existing = parsed;
   } catch (error) {
     if (error.code !== "ENOENT") throw new DaemonError("workspace_hooks_invalid", `cannot install Antigravity lifecycle hooks: ${error.message}`);
+    if (!install) throw new DaemonError("workspace_hooks_unqualified", "Antigravity hooks must be installed during qualification before daemon start", false, { hooks_path: workspaceHooks });
   }
   const isManagedHandler = handler => typeof handler?.command === "string"
-    && handler.command.includes(config.entryPath) && handler.command.includes("hook handle");
+    && ((handler.command.includes("DD_AGY_HOOK_ENTRY") && handler.command.includes(" hook handle --event ") && handler.command.includes("DD_AGY_STATE_DIR")) || /(?:^|\/)dd-agy\.mjs['"]?\s+hook handle/.test(handler.command));
   const events = ["PreToolUse", "PostToolUse", "PreInvocation", "PostInvocation", "Stop"];
+  const existingManaged = Object.entries(existing).flatMap(([name, definition]) => {
+    if (events.includes(name) && Array.isArray(definition)) return definition;
+    if (!definition || typeof definition !== "object" || Array.isArray(definition)) return [];
+    return events.flatMap(event => Array.isArray(definition[event]) ? definition[event] : []);
+  }).flatMap(item => Array.isArray(item?.hooks) ? item.hooks : [item]).filter(handler => isManagedHandler(handler) && handler.command.includes("--state-dir") && !handler.command.includes("DD_AGY_STATE_DIR"));
+  if (existingManaged.some(handler => !stateDir || !handler.command.includes(`--state-dir ${shell(stateDir)}`))) {
+    throw new DaemonError("workspace_hooks_drifted", "qualified Antigravity hook routes to another daemon state directory", false, { hooks_path: workspaceHooks, expected_state_dir: stateDir });
+  }
   const retain = handlers => handlers.flatMap(item => {
     if (!Array.isArray(item?.hooks)) return isManagedHandler(item) ? [] : [item];
     const remaining = item.hooks.filter(handler => !isManagedHandler(handler));
@@ -106,16 +122,19 @@ export async function prepare(paths, config) {
     managed[event] = [...(managed[event] ?? []), ...handlers];
   }
   workspace["dd-flow"] = managed;
-  await writeJson(workspaceHooks, workspace);
-  // Workspace discovery covers root and children. Installing the same handler
-  // globally as well invokes it twice, even under the same hook name.
-  await writeJson(path.join(paths.config, "hooks.json"), {});
-  config.hooksSha256 = createHash("sha256").update(JSON.stringify(hooks)).digest("hex");
-  config.workspaceHooksPath = workspaceHooks;
+  const serializedWorkspace = `${JSON.stringify(workspace, null, 2)}\n`;
+  // Hook installation is a qualification/ownership boundary. Reusing the
+  // qualified command must not rewrite the project file when the pinned engine,
+  // daemon directory or workspace location changes.
+  const installed = isDeepStrictEqual(existing, JSON.parse(serializedWorkspace));
+  if (!installed && !install) throw new DaemonError("workspace_hooks_unqualified", "Antigravity hook definitions differ from the qualified contract", false, { hooks_path: workspaceHooks });
+  if (!installed) { await mkdir(workspaceConfig, { recursive: true, mode: 0o700 }); await writeFile(workspaceHooks, serializedWorkspace, { mode: 0o600 }); }
+  return { hooksSha256: createHash("sha256").update(JSON.stringify(hooks)).digest("hex"), workspaceHooksPath: workspaceHooks,
+    workspaceHooksSha256: createHash("sha256").update(installed ? existingText : serializedWorkspace).digest("hex"), workspaceHooksInstalled: installed ? "qualified_existing" : "qualified_install" };
 }
 
-export async function callDaemon(stateDir, operation, params = {}, timeoutMs = 30_000) {
-  const paths = locations(stateDir), request = { schema_id: REQUEST_SCHEMA, id: process.env.DD_EVAL_OPERATION_ID ?? randomUUID(), operation, params };
+export async function callDaemon(stateDir, operation, params = {}, timeoutMs = 30_000, requestId = null) {
+  const paths = locations(stateDir), request = { schema_id: REQUEST_SCHEMA, id: requestId ?? process.env.DD_EVAL_OPERATION_ID ?? randomUUID(), operation, params };
   return await new Promise((resolve, reject) => {
     const client = net.createConnection(paths.socket); let buffer = "", settled = false, timer, checking = false, lastActivity = Date.now();
     const clock = new ObservationClock({ timeoutMs, onGap: gap => { void appendFile(paths.journal, `${JSON.stringify({ kind: "observation_gap", payload: { ...gap, operation_id: request.id } })}\n`, { mode: 0o600 }).catch(() => {}); } });
@@ -200,7 +219,7 @@ export const stopDaemon = async options => { const timeoutMs = options.timeoutMs
 
 export class Runtime {
   constructor(paths, state) { this.paths = paths; this.state = state; this.config = state.config; this.child = null; this.providerProcess = state.provider_process ?? null; this.providerFinalization = Promise.resolve(); this.buffer = ""; this.init = null; this.readyPromise = null; this.active = null; this.exited = false; this.toolObservations = new ToolObservations(); for (const reason of state.tool_observation_gaps ?? []) this.toolObservations.gaps.add(reason); for (const event of state.tool_observations ?? []) this.toolObservations.add(event); if (state.tool_calls?.length && !state.tool_observations) this.toolObservations.gaps.add("legacy_tools_not_attributed"); this.turnGeneration = state.turn_generation ?? 0; this.descendants = new Map((state.descendants ?? []).map(child => [child.provider_session_id, child])); this.lastResult = state.last_result ?? null; this.sessionObservations = new Map(state.session_observations ?? []); this.startupError = null; this.persisting = Promise.resolve(); this.draining = Promise.resolve(); this.lastActivityAt = state.last_activity_at ?? null; this.usageIngest = null; this.lastProviderEvent = null; }
-  persist(patch = {}) { Object.assign(this.state, patch, { pid: process.pid, updated_at: new Date().toISOString(), last_activity_at: this.lastActivityAt, session_observations: [...this.sessionObservations], tool_observations: [...this.toolObservations.calls.values()], tool_observation_gaps: [...this.toolObservations.gaps], turn_generation: this.turnGeneration, descendants: [...this.descendants.values()], sessions: this.init ? [{ provider_session_id: this.init.conversation_id, root_provider_session_id: this.init.conversation_id, cwd: this.config.cwd }] : [] }); const snapshot = structuredClone(this.state); this.persisting = this.persisting.then(() => writeJson(this.paths.state, snapshot)); for (const processRecord of [this.state.resource_process, this.providerProcess]) if (processRecord?.id && processRecord.lease_token) this.persisting = this.persisting.then(async () => { try { await heartbeatDaemonProcess(this.config, processRecord); } catch {} }); return this.persisting; }
+  persist(patch = {}) { Object.assign(this.state, patch, { pid: process.pid, updated_at: new Date().toISOString(), last_activity_at: this.lastActivityAt, session_observations: [...this.sessionObservations], tool_observations: [...this.toolObservations.calls.values()], tool_observation_gaps: [...this.toolObservations.gaps], turn_generation: this.turnGeneration, descendants: [...this.descendants.values()], sessions: this.init ? [{ provider_session_id: this.init.conversation_id, root_provider_session_id: this.init.conversation_id, cwd: this.config.cwd }] : [] }); const snapshot = structuredClone(this.state); const queued = performance.now(); this.persisting = this.persisting.then(async () => { const started = performance.now(); await writeJson(this.paths.state, snapshot); this.persistTiming = { queue_ms: Math.round(started - queued), write_ms: Math.round(performance.now() - started) }; }); return this.persisting; }
   async journal(kind, payload = {}) { const line = `${JSON.stringify({ schema_id: "dd-agy/daemon-event@1", event_id: randomUUID(), observed_at: new Date().toISOString(), kind, ...payload })}\n`; for (const journal of new Set([this.paths.journal, this.config.journal].filter(Boolean))) { await mkdir(path.dirname(journal), { recursive: true, mode: 0o700 }); await appendFile(journal, line, { mode: 0o600 }); } }
   args(sessionId) { return ["--input-format", "stream-json", "--output-format", "stream-json", "--model", this.config.model, "--effort", this.config.reasoning, "--mode", this.config.mode, "--dangerously-skip-permissions", "--print-timeout", "6h", `--gemini_dir=${this.paths.gemini}`, "--app_data_dir=runtime", ...(sessionId ? ["--conversation", sessionId] : ["--new-project"])]; }
   requireSessionIdentity(requestedId) {
@@ -264,7 +283,7 @@ export class Runtime {
       });
     });
     void this.providerFinalization.catch(() => {});
-    try { await confirmDaemonProcess(this.config, providerProcess, this.child); await this.persist({ provider_process: providerProcess, provider_pid: this.child.pid }); }
+    try { await confirmDaemonProcess(this.config, providerProcess, this.child); await heartbeatDaemonProcess(this.config, providerProcess); await this.persist({ provider_process: providerProcess, provider_pid: this.child.pid }); }
     catch (error) { await cleanupFailedStart(this.config, providerProcess, this.child, error); throw error; }
     finally { allowProviderFinalization(); }
     let readyTimer;
@@ -318,6 +337,7 @@ export class Runtime {
     await this.completePendingTurn();
   }
   async completePendingTurn() {
+    await this.observeHookFailures();
     const current = this.active;
     if (!current?.terminalResult || current.terminalResult !== this.lastResult) return;
     await this.persist({ active_tree: !this.receipt().settled });
@@ -345,6 +365,7 @@ export class Runtime {
     if (!text) throw new DaemonError("prompt_required", "prompt is required");
     await this.start(); await this.draining;
     if (this.active) throw new DaemonError("operation_in_progress", "an Antigravity turn is already running");
+    if (this.state.last_hook_rejection && !this.receipt().settled) throw new DaemonError("tree_not_settled", "Rejected hook does not prove that the prior Antigravity tree stopped", false, { primary_error: this.state.last_hook_rejection });
     if (this.state.unclaimed_activity || (this.lastResult && !this.receipt().settled)) throw new DaemonError("tree_not_settled", "the prior Antigravity agent tree is not fully settled");
     let resolveTurn, rejectTurn;
     const reply = new Promise((resolve, reject) => { resolveTurn = resolve; rejectTurn = reject; });
@@ -353,6 +374,7 @@ export class Runtime {
     const current = { resolve: resolveTurn, reject: rejectTurn, generation: ++this.turnGeneration, operationId, previousError: this.lastResult?.error ?? null };
     // Reserve before persistence so different operation IDs cannot overlap.
     this.active = current;
+    this.hookRequests = new Map();
     const root = this.init?.conversation_id, prior = this.sessionObservations.get(root) ?? {};
     this.sessionObservations.set(root, { ...prior, step_floor: prior.last_step_index ?? null, stop: null, last_hook: null });
     this.lastProviderEvent = null;
@@ -381,17 +403,28 @@ export class Runtime {
     if (child.parent_provider_session_id !== this.init?.conversation_id) throw new DaemonError("agy_child_parent_unqualified", "Nested Antigravity worker is not a direct child of the controlled Session", false, { conversation_id: conversationId, parent_conversation_id: child.parent_provider_session_id });
     return child;
   }
-  async rejectHook(error, event, payload) {
-    const current = this.active;
-    const rejection = { code: error.code ?? "agy_hook_rejected", message: error.message ?? String(error), event, conversation_id: payload.conversationId ?? null, tool: payload.toolCall?.name ?? null, daemon_id: this.config.daemonId, operation_id: current?.operationId ?? null, turn_generation: current?.generation ?? null };
-    try { await this.journal("hook_rejected", { rejection }); await this.persist({ last_hook_rejection: rejection }); }
-    catch (storageError) { if (current && this.active === current) { this.active = null; current.reject(storageError); } throw storageError; }
+  async rejectHook(error, event, payload, current = this.active) {
+    if (current && this.active !== current) return;
+    const rejection = this.state.last_hook_rejection && this.state.last_hook_rejection.turn_generation === current?.generation ? this.state.last_hook_rejection : { code: error.code ?? "agy_hook_rejected", message: error.message ?? String(error), details: error.details, event, conversation_id: payload.conversationId ?? null, tool: payload.toolCall?.name ?? null, daemon_id: this.config.daemonId, operation_id: current?.operationId ?? null, turn_generation: current?.generation ?? null };
+    this.state.last_hook_rejection = rejection;
     if (current && this.active === current) { this.active = null; current.reject(new DaemonError(rejection.code, rejection.message, false, rejection)); }
+    try { await this.journal("hook_rejected", { rejection }); await this.persist({ last_hook_rejection: rejection }); }
+    catch (storageError) { rejection.receipt_error = { code: storageError.code, message: storageError.message }; }
+  }
+  async observeHookFailures() {
+    for (const [requestId, binding] of this.hookRequests ?? []) {
+      if (binding.current !== this.active || !this.active) continue;
+      let failure;
+      try { failure = JSON.parse(await readFile(path.join(this.paths.dir, "hook-failures", `${requestId}.json`), "utf8")); }
+      catch (error) { if (error.code === "ENOENT") continue; failure = { code: "native_hook_receipt_invalid", message: error.message }; }
+      if (failure.request_id !== undefined && failure.request_id !== requestId) continue;
+      await this.rejectHook(Object.assign(new Error(failure.message ?? "Native hook failed"), { code: failure.code, details: failure.details }), binding.event, binding.payload, binding.current);
+    }
   }
-  async observeHook(event, payload) { const conversationId = payload.conversationId ?? this.init?.conversation_id; const child = await this.childForHook(conversationId); const prior = this.sessionObservations.get(conversationId) ?? {}; const execution = Number.isInteger(payload.executionNum) ? payload.executionNum : null; const step = Number.isInteger(payload.stepIdx) ? payload.stepIdx : null; const floor = prior.step_floor; const stale = step !== null && ((Number.isInteger(floor) && step <= floor) || (child && Number.isInteger(prior.last_step_index) && step < prior.last_step_index)); if (stale) { await this.journal("stale_hook", { hook_event: event, conversation_id: conversationId, step_index: step }); return { stale: true }; } const fingerprint = createHash("sha256").update(JSON.stringify({ event, payload })).digest("hex"); if (!stale && prior.last_hook !== fingerprint) this.markActivity(); if (conversationId && !stale) this.sessionObservations.set(conversationId, { ...prior, ...(step !== null ? { last_step_index: Math.max(prior.last_step_index ?? -1, step) } : {}), last_hook: fingerprint, ...(event === "PreToolUse" ? { last_pre_hook: fingerprint } : {}), ...(payload.transcriptPath ? { transcript_path: payload.transcriptPath } : {}), ...(event === "Stop" ? { stop: { fullyIdle: payload.fullyIdle === true, terminationReason: payload.terminationReason ?? null, executionNum: payload.executionNum ?? null } } : {}) }); if (!stale && event === "PreToolUse" && prior.last_pre_hook !== fingerprint) this.childActivity(conversationId); if (child && !stale && event === "Stop" && payload.fullyIdle === true) this.descendants.set(conversationId, { ...this.descendants.get(conversationId), tree_settled: true, settlement_evidence: "child_fully_idle_stop" }); const terminalPending = this.active?.terminalResult === this.lastResult; if (!child && !stale && event === "Stop" && payload.fullyIdle === true && (!this.active || terminalPending) && ["SUCCESS", "ERROR", "CANCELLED"].includes(this.lastResult?.status)) for (const [id, descendant] of this.descendants) if (descendant.status === "unknown") this.descendants.set(id, { ...descendant, status: "settled_by_root", settlement_evidence: "root_fully_idle_stop" }); const parent = child?.parent_provider_session_id ?? null;
+  async observeHook(event, payload, budget = null) { const conversationId = payload.conversationId ?? this.init?.conversation_id; const child = await this.childForHook(conversationId); budget?.remaining("identity"); const prior = this.sessionObservations.get(conversationId) ?? {}; const execution = Number.isInteger(payload.executionNum) ? payload.executionNum : null; const step = Number.isInteger(payload.stepIdx) ? payload.stepIdx : null; const floor = prior.step_floor; const stale = step !== null && ((Number.isInteger(floor) && step <= floor) || (child && Number.isInteger(prior.last_step_index) && step < prior.last_step_index)); if (stale) { await this.journal("stale_hook", { hook_event: event, conversation_id: conversationId, step_index: step }); return { stale: true }; } const fingerprint = createHash("sha256").update(JSON.stringify({ event, payload })).digest("hex"); if (!stale && prior.last_hook !== fingerprint) this.markActivity(); if (conversationId && !stale) this.sessionObservations.set(conversationId, { ...prior, ...(step !== null ? { last_step_index: Math.max(prior.last_step_index ?? -1, step) } : {}), last_hook: fingerprint, ...(event === "PreToolUse" ? { last_pre_hook: fingerprint } : {}), ...(payload.transcriptPath ? { transcript_path: payload.transcriptPath } : {}), ...(event === "Stop" ? { stop: { fullyIdle: payload.fullyIdle === true, terminationReason: payload.terminationReason ?? null, executionNum: payload.executionNum ?? null } } : {}) }); if (!stale && event === "PreToolUse" && prior.last_pre_hook !== fingerprint) this.childActivity(conversationId); if (child && !stale && event === "Stop" && payload.fullyIdle === true) this.descendants.set(conversationId, { ...this.descendants.get(conversationId), tree_settled: true, settlement_evidence: "child_fully_idle_stop" }); const terminalPending = this.active?.terminalResult === this.lastResult; if (!child && !stale && event === "Stop" && payload.fullyIdle === true && (!this.active || terminalPending) && ["SUCCESS", "ERROR", "CANCELLED"].includes(this.lastResult?.status)) for (const [id, descendant] of this.descendants) if (descendant.status === "unknown") this.descendants.set(id, { ...descendant, status: "settled_by_root", settlement_evidence: "root_fully_idle_stop" }); const parent = child?.parent_provider_session_id ?? null;
     const observed = payload.model ? observedProfile(payload) : {};
     await observeModel({ journal: this.config.journal, harness: "antigravity-cli", sessionId: conversationId, parentSessionId: parent, requested: this.config, observed, source: "native.hook", evidence: payload.model ? "configured" : "unavailable", reason: payload.model ? null : "hook_omits_current_model" });
-    const eventId = createHash("sha256").update(JSON.stringify({ daemon: this.config.daemonId, event, conversationId, fully_idle: payload.fullyIdle ?? null, termination_reason: payload.terminationReason ?? null, execution: payload.executionNum ?? null, step: payload.stepIdx ?? null, tool: payload.toolCall?.name ?? null, args: payload.toolCall?.args ?? null })).digest("hex"); await this.persist(); await this.journal("hook", { stale, hook_event: event, event_id: eventId, conversation_id: conversationId, turn_generation: this.turnGeneration, execution_num: execution, step_index: step, termination_reason: payload.terminationReason ?? null, fully_idle: payload.fullyIdle ?? null }); await this.completePendingTurn(); return { event_id: eventId, daemon_id: this.config.daemonId, parent_conversation_id: parent, profile: observed, requested_profile: { provider: this.config.provider, model: this.config.model, reasoning: this.config.reasoning, mode: this.config.mode }, project_root: this.config.projectRoot, dd_flow_bin: this.config.ddFlowBin, dd_flow_home: this.config.ddFlowHome };
+    const eventId = createHash("sha256").update(JSON.stringify({ daemon: this.config.daemonId, event, conversationId, fully_idle: payload.fullyIdle ?? null, termination_reason: payload.terminationReason ?? null, execution: payload.executionNum ?? null, step: payload.stepIdx ?? null, tool: payload.toolCall?.name ?? null, args: payload.toolCall?.args ?? null })).digest("hex"); await this.persist(); await this.journal("hook", { stale, hook_event: event, event_id: eventId, conversation_id: conversationId, turn_generation: this.turnGeneration, execution_num: execution, step_index: step, termination_reason: payload.terminationReason ?? null, fully_idle: payload.fullyIdle ?? null, persistence_timing: this.persistTiming ?? null }); await this.completePendingTurn(); return { event_id: eventId, daemon_id: this.config.daemonId, parent_conversation_id: parent, profile: observed, requested_profile: { provider: this.config.provider, model: this.config.model, reasoning: this.config.reasoning, mode: this.config.mode }, project_root: this.config.projectRoot, dd_flow_bin: this.config.ddFlowBin, dd_flow_home: this.config.ddFlowHome };
   }
   async finalizeProviderForControl() {
     const pending = this.providerFinalization;
@@ -419,7 +452,8 @@ export class Runtime {
 
 export async function serveDaemon(stateDir) {
   const paths = locations(stateDir), state = await readState(paths.dir); if (!state?.config) throw new DaemonError("daemon_state_missing", "Antigravity daemon state is missing");
-  const runtime = new Runtime(paths, state); await removeSocket(paths); const server = net.createServer(socket => { let buffer = ""; socket.setEncoding("utf8"); socket.on("data", chunk => { buffer += chunk; const index = buffer.indexOf("\n"); if (index < 0) return; let request; try { request = JSON.parse(buffer.slice(0, index)); } catch (error) { socket.end(`${JSON.stringify({ schema_id: RESPONSE_SCHEMA, ok: false, error: errorPayload(error) })}\n`); return; } void durableDaemonDispatch(paths.dir, request, () => dispatch(runtime, request), () => dispatch(runtime, { operation: "session.inspect", params: request.params ?? {} })).then(result => socket.end(`${JSON.stringify({ schema_id: RESPONSE_SCHEMA, id: request.id, ok: true, result })}\n`), error => socket.end(`${JSON.stringify({ schema_id: RESPONSE_SCHEMA, id: request.id, ok: false, error: errorPayload(error) })}\n`)); }); }); runtime.server = server;
+  await heartbeatDaemonProcess(state.config, state.resource_process);
+  const runtime = new Runtime(paths, state); await removeSocket(paths); const server = net.createServer(socket => { let buffer = ""; socket.on("error", () => {}); socket.setEncoding("utf8"); socket.on("data", chunk => { buffer += chunk; const index = buffer.indexOf("\n"); if (index < 0) return; let request; try { request = JSON.parse(buffer.slice(0, index)); } catch (error) { socket.end(`${JSON.stringify({ schema_id: RESPONSE_SCHEMA, ok: false, error: errorPayload(error) })}\n`); return; } void durableDaemonDispatch(paths.dir, request, () => dispatch(runtime, request), () => dispatch(runtime, { operation: "session.inspect", params: request.params ?? {} })).then(result => socket.end(`${JSON.stringify({ schema_id: RESPONSE_SCHEMA, id: request.id, ok: true, result })}\n`), error => socket.end(`${JSON.stringify({ schema_id: RESPONSE_SCHEMA, id: request.id, ok: false, error: errorPayload(error) })}\n`)); }); }); runtime.server = server;
   await new Promise((resolve, reject) => { server.once("error", reject); server.listen(paths.socket, resolve); }); await chmod(paths.socket, 0o600);
   try { await runtime.start(state.config.resumeSessionId); runtime.requireSessionIdentity(state.config.resumeSessionId); }
   catch (error) {
@@ -433,15 +467,34 @@ export async function serveDaemon(stateDir) {
 
 async function dispatch(runtime, request) {
   if (request.schema_id !== REQUEST_SCHEMA) throw new DaemonError("daemon_protocol_mismatch", "unsupported dd-agy request schema"); const params = request.params ?? {};
-  if (request.operation === "daemon.status") return { daemon_id: runtime.config.daemonId, shutdown_state: runtime.state.shutdown_state, active_tree: runtime.state.active_tree, last_activity_at: runtime.lastActivityAt, provider_ready: Boolean(runtime.init && !runtime.exited), pid: process.pid, provider_pid: runtime.child?.pid ?? null, versions: runtime.state.versions, config: runtime.config, sessions: runtime.state.sessions ?? [], receipt: runtime.receipt() };
+  if (request.operation === "daemon.status") { await runtime.observeHookFailures(); return { daemon_id: runtime.config.daemonId, shutdown_state: runtime.state.shutdown_state, active_tree: runtime.state.active_tree, active_operation: runtime.active?.operationId ?? null, last_hook_rejection: runtime.state.last_hook_rejection ?? null, last_activity_at: runtime.lastActivityAt, provider_ready: Boolean(runtime.init && !runtime.exited), pid: process.pid, provider_pid: runtime.child?.pid ?? null, versions: runtime.state.versions, config: runtime.config, sessions: runtime.state.sessions ?? [], receipt: runtime.receipt() }; }
   if (request.operation === "session.create") { if (params.sessionId) throw new DaemonError("invalid_create", "create does not accept a Session ID"); if (params.prompt) throw new DaemonError("invalid_create", "create does not execute a prompt; use session.prompt"); await runtime.start(); await runtime.zeroUsage(); return runtime.receipt(); }
   if (request.operation === "session.prompt") { const assertDispatch = captureDispatchGuard(runtime); await runtime.start(params.sessionId ?? null); runtime.requireSessionIdentity(params.sessionId); return await runtime.prompt(params.prompt, assertDispatch, request.id); }
   if (request.operation === "session.inspect") { runtime.requireSessionIdentity(params.sessionId); return runtime.receipt(); }
   if (request.operation === "session.resume") { await runtime.start(params.sessionId ?? runtime.init?.conversation_id ?? null); runtime.requireSessionIdentity(params.sessionId); return runtime.receipt(); }
   if (request.operation === "session.cancel") { runtime.requireSessionIdentity(params.sessionId); return await runtime.cancel(); }
   if (request.operation === "hook.observe") {
-    try { return await runtime.observeHook(params.event, params.payload ?? {}); }
-    catch (error) { await runtime.rejectHook(error, params.event, params.payload ?? {}); throw error; }
+    // Check the process binding before correlating a request with an active
+    // turn. A stale/foreign daemon must not poison an unrelated operation.
+    if (runtime.config.hookBinding === "environment-v1" && params.daemonId !== runtime.config.daemonId) throw new DaemonError("agy_hook_binding_invalid", "Antigravity hook binding does not name this daemon", false, { expected_daemon_id: runtime.config.daemonId, observed_daemon_id: params.daemonId ?? null });
+    const current = runtime.active, budget = hookBudget(25_000, params.deadlineAt);
+    runtime.hookRequests ??= new Map();
+    if (/^[A-Za-z0-9-]{1,128}$/.test(request.id)) runtime.hookRequests.set(request.id, { current, event: params.event, payload: { conversationId: params.payload?.conversationId, toolCall: { name: params.payload?.toolCall?.name } } });
+    try {
+      const result = await budget.run(async () => {
+        if (runtime.hookRequests.has(request.id) && current?.operationId) {
+          const directory = path.join(runtime.paths.dir, "operations", createHash("sha256").update(current.operationId).digest("hex"), "hooks");
+          await mkdir(directory, { recursive: true, mode: 0o700 });
+          await writeJson(path.join(directory, `${request.id}.json`), { schema_id: "dd-flow/hook-request@1", request_id: request.id, daemon_id: runtime.config.daemonId, operation_id: current.operationId, turn_generation: current.generation, event: params.event, conversation_id: params.payload?.conversationId ?? null, tool: params.payload?.toolCall?.name ?? null });
+        }
+        budget.remaining("observation");
+        return await runtime.observeHook(params.event, params.payload ?? {}, budget);
+      }, "observation");
+      await runtime.observeHookFailures(); budget.remaining("observation");
+      if (current && runtime.state.last_hook_rejection?.turn_generation === current.generation) throw Object.assign(new Error(runtime.state.last_hook_rejection.message), runtime.state.last_hook_rejection);
+      return result;
+    }
+    catch (error) { await runtime.rejectHook(error, params.event, params.payload ?? {}, current); throw error; }
   }
   if (request.operation === "daemon.stop") { await runtime.close(params.cancelTree === true); await runtime.persist({ shutdown_state: "clean", active_tree: false }); await runtime.finishResource(); setImmediate(() => runtime.server?.close()); return { stopped: true, clean: true, settled: true, daemon_id: runtime.config.daemonId }; }
   throw new DaemonError("unknown_operation", `unknown dd-agy daemon operation: ${request.operation}`);

package/dist/harness-runtime/lib/dd-codex-daemon.mjs

@@ -9,7 +9,7 @@ import { spawn } from "node:child_process";
 import { waitForSettlement } from "./session-settlement.mjs";
 import { errorRecord } from "./operation-errors.mjs";
 import { CodexBridge, cancelSessionWithBridge, createSessionWithBridge, inspectSessionWithBridge, promptSessionWithBridge, startSessionWithBridge } from "./dd-codex.mjs";
-import { prepareRuntimeOwner, cleanupFailedStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, heartbeatDaemonProcess, registerDaemonProcess, stopProcessGroup } from "./managed-daemon.mjs";
+import { prepareRuntimeOwner, cleanupFailedStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, heartbeatDaemonProcess, registerDaemonProcess, startManagedBridge, stopProcessGroup } from "./managed-daemon.mjs";
 
 const requestSchema = "dd-codex/daemon-request@1";
 const responseSchema = "dd-codex/daemon-response@1";
@@ -89,15 +89,18 @@ export async function startDaemon(options) {
   if (previous?.shutdown_state === "clean") await authorizeRetainedDaemonResume(paths.dir, previous, options.sessionId, config);
   await removeSocket(paths.socket); const resourceProcess = await registerDaemonProcess(config, { kind: "codex-daemon", owner: `codex:${path.basename(paths.dir)}`, operation: `codex-daemon:${path.basename(paths.dir)}`, stdout: paths.log, stderr: paths.log }); const state = { schema_id: stateSchema, daemon_id: randomUUID(), pid: null, cwd: config.cwd, journal: config.journal, config, socket: paths.socket, started_at: new Date().toISOString(), shutdown_state: "starting", sessions: previous?.sessions ?? [], resource_process: resourceProcess }; await writeState(paths.state, state);
   const log = await open(paths.log, "a", 0o600); const child = spawn(process.execPath, [options.entryPath, "daemon", "serve", "--state-dir", paths.dir], { cwd: config.cwd, detached: true, stdio: ["ignore", log.fd, log.fd] }); child.unref(); await log.close();
-  try { await confirmDaemonProcess(config, resourceProcess, child); const deadline = Date.now() + 15_000; while (Date.now() < deadline) { await new Promise((resolve) => setTimeout(resolve, 100)); try { return await callDaemon(paths.dir, "daemon.status", {}, 1_000); } catch (error) { if (!["daemon_not_running", "daemon_timeout"].includes(error.code)) throw error; } } throw Object.assign(new Error("daemon did not become ready"), { code: "daemon_start_failed" }); }
+  try { await confirmDaemonProcess(config, resourceProcess, child); const deadline = Date.now() + 60_000; while (Date.now() < deadline) { await new Promise((resolve) => setTimeout(resolve, 100)); try { return await callDaemon(paths.dir, "daemon.status", {}, 5_000); } catch (error) { if (!["daemon_not_running", "daemon_timeout"].includes(error.code)) throw error; } } throw Object.assign(new Error("daemon did not become ready"), { code: "daemon_start_failed" }); }
   catch (error) { await cleanupFailedStart(config, resourceProcess, child, error); throw error; }
 }
 export async function stopDaemon(options) { const timeoutMs = options.timeoutMs ?? 30_000; return await confirmDaemonStopped(() => callDaemon(options.stateDir, "daemon.stop", { cancelTree: options.cancelTree === true }, timeoutMs), locations(options.stateDir).socket, timeoutMs); }
 
 export async function serveDaemon(stateDir) {
   const paths = locations(stateDir); const state = await readState(paths.state); if (!state || state.schema_id !== stateSchema) throw Object.assign(new Error("daemon state missing"), { code: "daemon_state_missing" });
-  const bridge = new CodexBridge({ ...state.config, env: { ...state.config.env, CODEX_HOME: process.env.CODEX_HOME, DD_FLOW_DAEMON_ID: state.daemon_id, DD_FLOW_CODEX_STATE_DIR: paths.dir } }); await bridge.start(); const sessions = new Set(state.sessions ?? []); let active = null; let server; let persist = Promise.resolve();
-  const save = (patch = {}) => { Object.assign(state, patch, { pid: process.pid, updated_at: new Date().toISOString(), sessions: [...sessions] }); const snapshot = structuredClone(state); persist = persist.then(() => writeState(paths.state, snapshot)).then(() => heartbeatDaemonProcess(snapshot.config, snapshot.resource_process).catch(() => {})); return persist; };
+  const bridge = new CodexBridge({ ...state.config, env: { ...state.config.env, CODEX_HOME: process.env.CODEX_HOME, DD_FLOW_DAEMON_ID: state.daemon_id, DD_FLOW_CODEX_STATE_DIR: paths.dir } }); await startManagedBridge({ config: state.config, state, bridge, kind: "codex-provider", publish: snapshot => writeState(paths.state, snapshot) }); const sessions = new Set(state.sessions ?? []); let active = null; let server; let persist = Promise.resolve();
+  const closeBridge = bridge.close.bind(bridge);
+  bridge.close = async () => { await closeBridge(); await finishDaemonProcess(state.config, state.provider_process, "stopped", "daemon_stopped"); };
+  await heartbeatDaemonProcess(state.config, state.resource_process);
+  const save = (patch = {}) => { Object.assign(state, patch, { pid: process.pid, updated_at: new Date().toISOString(), sessions: [...sessions] }); const snapshot = structuredClone(state); persist = persist.then(() => writeState(paths.state, snapshot)); return persist; };
   const dispatch = async (operation, params) => {
     const assertDispatch = captureDispatchGuard(bridge);
     if (operation === "hook.verify") {

package/dist/harness-runtime/lib/dd-codex.mjs

@@ -62,6 +62,7 @@ export class CodexBridge {
     this.child.on("error", (error) => this.rejectAll(error));
     this.child.on("exit", (code) => this.rejectAll(Object.assign(new Error(`Codex app-server exited ${code}${this.stderr.trim() ? `: ${this.stderr.trim()}` : ""}`), { code: "bridge_exited" })));
     readline.createInterface({ input: this.child.stdout }).on("line", (line) => this.receive(line));
+    if (this.options.onSpawn) await this.options.onSpawn(this.child);
     await this.request("initialize", { clientInfo: { name: "dd-codex", version: "0.1.0" }, capabilities: { optOutNotificationMethods: [], experimentalApi: true } });
   }
 

package/dist/harness-runtime/lib/dd-droid-daemon.mjs

@@ -62,7 +62,7 @@ export async function serveDaemon(stateDir) {
   const dispatch = async request => {
     const params = request.params ?? {}, operation = request.operation;
     if (operation === "daemon.status") { let observationError; try { await runtime.refreshTopology(); } catch (error) { observationError = errorRecord(error); } return { observation_error: observationError ?? null, daemon_id: state.daemon_id, pid: process.pid, config: state.config, shutdown_state: state.shutdown_state, provider_ready: Boolean(runtime.child && !runtime.closed), active_operation: busy, active_tree: Boolean(runtime.active || runtime.workingState !== "idle" || runtime.topologyIncomplete || [...runtime.topology.values()].some(child => !["completed", "cancelled", "failed"].includes(child.status))), sessions: runtime.rootId ? [runtime.rootId] : [], provider_pid: runtime.closed ? null : runtime.child?.pid }; }
-    if (operation === "hook.observe") return await runtime.observeHook(params.payload, params.eventId);
+    if (operation === "hook.observe") return await runtime.observeHook(params.payload, params.eventId, params.deadlineAt);
     if (operation === "session.inspect") return await runtime.inspect(params.sessionId, { ingestUsage: params.noFlow !== true });
     if (operation === "session.cancel") {
       runtime.requireIdentity(params.sessionId); const cleanup = await runtime.closeTree(true); let inspected;