@deksden-com/dd-flow-cli 0.9.0-beta.100 → 0.9.0-beta.103

package/dist/services/eval-snapshots.js

@@ -15,6 +15,7 @@ import { captureRecoveryDatabase, readRecoveryResourceEvidence } from "./recover
 import { resourceHome } from "./managed-processes.js";
 import { codexHomeSharedEntries } from "./hooks.js";
 import { prepareOutputFile } from "../cli/input-preparation.js";
+import { localEnvironmentAllowed, projectServicePathFilter } from "./workspace-files.js";
 /** Capture the only flow boundary which exists before `stage start --bootstrap` creates a RUN. */
 export function prepareEvalBootstrapSnapshot(context, input) {
     const projectRoot = resolveProjectRoot(input.projectRoot);
@@ -38,17 +39,42 @@ export function prepareEvalBootstrapSnapshot(context, input) {
 }
 export function createEvalBootstrapSnapshot(context, input) {
     const { projectRoot, output } = prepareEvalBootstrapSnapshot(context, input);
-    fs.mkdirSync(output, { recursive: true });
-    fs.cpSync(projectRoot, path.join(output, "project"), { recursive: true, verbatimSymlinks: true, filter: snapshotPayloadAllowed });
-    const manifest = {
-        schema_id: "dd-eval/bootstrap-snapshot@1",
-        stage: "specify",
-        project_root: projectRoot,
-        project_sha256: treeHash(path.join(output, "project")),
-        project_git: snapshotProjectGit(projectRoot, output)
-    };
-    writeJson(path.join(output, "bootstrap.json"), manifest);
-    return { ok: true, snapshot: output, ...manifest };
+    const temporary = `${output}.partial-${crypto.randomUUID()}`;
+    const before = bootstrapSourceVersion(projectRoot);
+    try {
+        fs.mkdirSync(temporary, { recursive: true });
+        fs.cpSync(projectRoot, path.join(temporary, "project"), { recursive: true, verbatimSymlinks: true, filter: projectPayloadFilter(projectRoot) });
+        const after = bootstrapSourceVersion(projectRoot);
+        if (before !== after)
+            throw new AppError("snapshot_source_changed", "Bootstrap source changed during snapshot capture", 1, { phase: "bootstrap", recoverable: true });
+        const manifest = {
+            schema_id: "dd-eval/bootstrap-snapshot@1",
+            stage: "specify",
+            project_root: projectRoot,
+            project_sha256: treeHash(path.join(temporary, "project")),
+            project_git: snapshotProjectGit(projectRoot, temporary)
+        };
+        writeJson(path.join(temporary, "bootstrap.json"), manifest);
+        if (after !== bootstrapSourceVersion(projectRoot))
+            throw new AppError("snapshot_source_changed", "Bootstrap source changed while preserving Git evidence", 1, { phase: "bootstrap", recoverable: true });
+        syncSnapshotTree(temporary);
+        fs.renameSync(temporary, output);
+        syncPath(path.dirname(output));
+        return { ok: true, snapshot: output, ...manifest };
+    }
+    catch (error) {
+        fs.rmSync(temporary, { recursive: true, force: true });
+        throw error;
+    }
+}
+function bootstrapSourceVersion(projectRoot) {
+    return JSON.stringify([
+        treeHash(projectRoot, true),
+        treeModesHash(projectRoot, true),
+        git(projectRoot, ["symbolic-ref", "--quiet", "HEAD"]),
+        gitBytes(projectRoot, ["show-ref", "--head"]).toString("base64"),
+        indexEntries(projectRoot).toString("base64")
+    ]);
 }
 /** Restore a pre-RUN project state; `stage start --bootstrap` creates runtime state afterwards. */
 export function prepareEvalBootstrapRestore(input) {
@@ -185,7 +211,7 @@ function captureEvalRunSnapshot(context, input) {
         }
     }
     else
-        copyRuntimeTree(context.ddFlowHome, path.join(output, "runtime"), false, [...databaseFiles, ...codexExclusions]);
+        copyRuntimeTree(context.ddFlowHome, path.join(output, "runtime"), false, [...databaseFiles, ...codexExclusions], grokProviderHomes(context.ddFlowHome));
     // VACUUM INTO is a consistent SQLite read snapshot, including committed WAL
     // pages. Copying the live database and its WAL separately is not atomic.
     const databaseCopy = path.join(output, "runtime", path.relative(context.ddFlowHome, context.db.path));
@@ -217,7 +243,7 @@ function captureEvalRunSnapshot(context, input) {
     fs.cpSync(projectRoot, path.join(output, "project"), {
         recursive: true,
         verbatimSymlinks: true,
-        filter: snapshotPayloadAllowed
+        filter: projectPayloadFilter(projectRoot)
     });
     const projectGit = snapshotProjectGit(projectRoot, output);
     const workspace = snapshotWorkspace(workspaceRoot, projectRoot, output);
@@ -244,6 +270,8 @@ function captureEvalRunSnapshot(context, input) {
         created_at: context.now(),
         runtime_sha256: treeHash(path.join(output, "runtime")),
         project_sha256: treeHash(path.join(output, "project")),
+        project_payload_policy: "service-files@1",
+        ...(!recovery ? { runtime_payload_policy: "flow-evidence@1" } : {}),
         project_git: projectGit,
         workspace,
         payload_modes: { project: treeModesHash(path.join(output, "project")), runtime: treeModesHash(path.join(output, "runtime")), ...(workspace.kind === "git_worktree" ? { workspace: treeModesHash(path.join(output, "workspace")) } : {}) },
@@ -608,7 +636,7 @@ function snapshotWorkspace(workspaceRoot, projectRoot, output) {
     const { branch, baseRef } = prepared;
     const workspace = path.join(output, "workspace");
     const bundle = path.join(output, "workspace.bundle");
-    fs.cpSync(workspaceRoot, workspace, { recursive: true, verbatimSymlinks: true, filter: snapshotPayloadAllowed });
+    fs.cpSync(workspaceRoot, workspace, { recursive: true, verbatimSymlinks: true, filter: projectPayloadFilter(workspaceRoot) });
     runGit(projectRoot, ["bundle", "create", bundle, branch]);
     return { kind: "git_worktree", source_root: workspaceRoot, branch, base_ref: baseRef, sha256: treeHash(workspace), bundle_sha256: fileHash(bundle), ...snapshotIndex(workspaceRoot, output, "workspace") };
 }
@@ -675,7 +703,7 @@ function restoreProjectGit(snapshot, source, projectRoot) {
 const mergeStateFiles = ["MERGE_HEAD", "MERGE_MSG", "MERGE_MODE", "ORIG_HEAD", "AUTO_MERGE"];
 function indexEntries(root) {
     const entries = Buffer.from(gitBytes(root, ["ls-files", "--stage", "-z"])
-        .toString("utf8").split("\0").filter(entry => entry && snapshotEnvironmentAllowed(entry.slice(entry.indexOf("\t") + 1)))
+        .toString("utf8").split("\0").filter(entry => entry && localEnvironmentAllowed(entry.slice(entry.indexOf("\t") + 1)))
         .map(entry => `${entry}\0`).join(""));
     const merge = {};
     for (const name of mergeStateFiles) {
@@ -764,10 +792,11 @@ export function verifyRecoverySnapshot(snapshot, input, checkWorkingState = true
     ];
     verifySnapshotPayload(snapshot, manifest);
     for (const entry of entries) {
+        const allowed = manifest.project_payload_policy === "service-files@1" ? projectPayloadFilter(entry.root) : snapshotPayloadAllowed;
         const expectedModes = manifest.payload_modes?.[entry.name];
-        if (checkWorkingState && expectedModes && treeModesHash(entry.root, true) !== expectedModes)
+        if (checkWorkingState && expectedModes && treeModesHash(entry.root, allowed) !== expectedModes)
             throw new AppError("recovery_workspace_drift", "Executable file modes changed after recovery capture", 1, { payload: entry.name });
-        if (checkWorkingState && (treeHash(entry.root, true) !== entry.hash || git(entry.root, ["rev-parse", "HEAD"]) !== entry.head || git(entry.root, ["symbolic-ref", "--quiet", "--short", "HEAD"]) !== entry.git.branch || (entry.git.index_sha256 && crypto.createHash("sha256").update(entry.git.index_format === "entries@1" ? indexEntries(entry.root) : indexPatch(entry.root)).digest("hex") !== entry.git.index_sha256)))
+        if (checkWorkingState && (treeHash(entry.root, allowed) !== entry.hash || git(entry.root, ["rev-parse", "HEAD"]) !== entry.head || git(entry.root, ["symbolic-ref", "--quiet", "--short", "HEAD"]) !== entry.git.branch || (entry.git.index_sha256 && crypto.createHash("sha256").update(entry.git.index_format === "entries@1" ? indexEntries(entry.root) : indexPatch(entry.root)).digest("hex") !== entry.git.index_sha256)))
             throw new AppError("recovery_workspace_drift", "Working files or Git state changed after recovery capture", 1, { payload: entry.name });
     }
 }
@@ -805,18 +834,48 @@ function runGit(root, args) {
         throw new AppError("snapshot_workspace_restore_failed", "Could not restore feature worktree", 1, { stderr: result.stderr.trim(), args });
 }
 function samePath(left, right) { return path.resolve(left) === path.resolve(right); }
-function snapshotEnvironmentAllowed(source) {
-    const name = path.basename(source);
-    // Public configuration template, not a local environment/credential file.
-    return name === ".env.example" || (name !== ".env" && !name.startsWith(".env."));
-}
 function snapshotPayloadAllowed(source) {
     const name = path.basename(source);
     return ![".git", "node_modules", ".cache", ".npm", ".pnpm-store"].includes(name)
-        && snapshotEnvironmentAllowed(source);
+        && localEnvironmentAllowed(source);
+}
+function projectPayloadFilter(root) {
+    const serviceAllowed = projectServicePathFilter(root);
+    return file => snapshotPayloadAllowed(file) && serviceAllowed(file);
 }
 function runtimePayloadAllowed(source) {
-    return snapshotPayloadAllowed(source) && !["auth.json", "auth.bk", "credentials.json", ".credentials.json", "credentials", ".credentials", "id_rsa", "id_ed25519", "engines", "checkouts"].includes(path.basename(source));
+    return snapshotPayloadAllowed(source) && !["auth.json", "auth.bk", "auth.encrypted", "auth.v2.key", "auth.v2.file", "credentials.json", ".credentials.json", "credentials", ".credentials", "id_rsa", "id_ed25519", "engines", "checkouts"].includes(path.basename(source));
+}
+/** Only a Grok daemon's verified provider root is excluded from flow evidence.
+ * An unrelated directory named grok-home remains ordinary project data. */
+function grokProviderHomes(runtimeRoot) {
+    const homes = [];
+    const visit = (directory) => {
+        for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+            const file = path.join(directory, entry.name);
+            if (entry.isDirectory()) {
+                if (![".git", "node_modules", "grok-home"].includes(entry.name))
+                    visit(file);
+            }
+            else if (entry.isFile() && entry.name === "daemon.json") {
+                let state;
+                try {
+                    state = JSON.parse(fs.readFileSync(file, "utf8"));
+                }
+                catch {
+                    continue;
+                }
+                if (state.schema_id !== "dd-grok/daemon-state@1")
+                    continue;
+                const expected = path.join(directory, "grok-home");
+                if (state.config?.grokHome !== expected || state.config?.ddFlowHome !== runtimeRoot)
+                    throw new AppError("snapshot_native_scope_invalid", "Grok provider home differs from its retained daemon binding", 1, { state_dir: directory });
+                homes.push(expected);
+            }
+        }
+    };
+    visit(runtimeRoot);
+    return homes;
 }
 function sqliteFile(file) {
     if (!fs.existsSync(file) || !fs.statSync(file).isFile())
@@ -830,9 +889,55 @@ function sqliteFile(file) {
         fs.closeSync(descriptor);
     }
 }
+function sqliteIdentifier(value) { return `"${value.replaceAll('"', '""')}"`; }
+function sqliteValue(value) {
+    if (value === null || typeof value === "string" || typeof value === "boolean")
+        return value;
+    if (typeof value === "number")
+        return Number.isFinite(value) ? value : String(value);
+    if (typeof value === "bigint")
+        return `${value}n`;
+    if (Buffer.isBuffer(value))
+        return `blob:${value.toString("base64")}`;
+    if (value instanceof Uint8Array)
+        return `blob:${Buffer.from(value).toString("base64")}`;
+    return String(value);
+}
+/**
+ * SQLite page layout is not semantic identity: VACUUM, checkpoint and a
+ * delete/insert rewrite can change serialized bytes without changing the
+ * logical database. Snapshot only the schema and ordered logical row values.
+ * This intentionally applies to the small set of managed SQLite files, not
+ * to arbitrary provider databases.
+ */
+function sqliteSemanticFingerprint(db, resourceRegistry = false) {
+    db.exec("PRAGMA busy_timeout = 4000");
+    db.exec("BEGIN");
+    try {
+        const schema = db.prepare("SELECT type, name, tbl_name, sql FROM sqlite_schema WHERE name NOT LIKE 'sqlite_%' ORDER BY type, name, tbl_name, sql").all();
+        const tables = schema.filter(row => row.type === "table").map(row => {
+            const columns = db.prepare(`PRAGMA table_info(${sqliteIdentifier(row.name)})`).all()
+                .sort((left, right) => Number(left.cid ?? 0) - Number(right.cid ?? 0))
+                .map(column => ({ name: String(column.name ?? ""), type: String(column.type ?? ""), notnull: Number(column.notnull ?? 0), default: sqliteValue(column.dflt_value ?? null), pk: Number(column.pk ?? 0) }));
+            const names = columns.map(column => column.name);
+            const stableNames = resourceRegistry && row.name === "managed_processes" ? names.filter(name => name !== "lease_expires_at" && name !== "updated_at") : names;
+            const rows = db.prepare(`SELECT * FROM ${sqliteIdentifier(row.name)}`).all()
+                .map(record => stableNames.map(name => [name, sqliteValue(record[name])]))
+                .sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)));
+            return { name: row.name, columns, rows };
+        });
+        return crypto.createHash("sha256").update(JSON.stringify({ schema, tables })).digest("hex");
+    }
+    finally {
+        try {
+            db.exec("ROLLBACK");
+        }
+        catch { /* The read transaction may already have closed on provider error. */ }
+    }
+}
 /** A WAL is copied through its SQLite read snapshot, not as raw bytes. */
-function runtimeSnapshotKind(file, excluded) {
-    if (!runtimePayloadAllowed(file) || excluded.includes(file))
+function runtimeSnapshotKind(file, excluded, providerHomes = []) {
+    if (!runtimePayloadAllowed(file) || providerHomes.some(home => file === home || isInside(home, file)) || excluded.includes(file))
         return "excluded";
     if (fs.lstatSync(file).isFile()) {
         if (/-(?:wal|shm|journal)$/.test(file) && sqliteFile(file.replace(/-(?:wal|shm|journal)$/, "")))
@@ -854,10 +959,11 @@ function snapshotSourceVersion(context, input, retainedDatabases) {
         throw new AppError("not_found", "Snapshot RUN is not registered", 1);
     const entries = new Map();
     const excluded = codexHomeSnapshotExclusions(context, project.id, input.runId);
+    const providerHomes = input.recoveryId === undefined ? grokProviderHomes(context.ddFlowHome) : [];
     const visit = (directory) => {
         for (const entry of fs.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
             const file = path.join(directory, entry.name);
-            const kind = runtimeSnapshotKind(file, excluded);
+            const kind = runtimeSnapshotKind(file, excluded, providerHomes);
             if (kind === "excluded" || kind === "sidecar")
                 continue;
             const key = `runtime/${path.relative(context.ddFlowHome, file)}`;
@@ -869,18 +975,18 @@ function snapshotSourceVersion(context, input, retainedDatabases) {
             else if (stat.isSymbolicLink())
                 entries.set(key, `link:${fs.readlinkSync(file)}`);
             else if (kind === "sqlite") {
-                // Resource heartbeats are copied consistently but are not productive
-                // RUN writers; owner identity is fenced by boundary.verify().
-                if (file === path.join(context.ddFlowHome, "runtime.sqlite")) {
-                    entries.set(key, `resource-sqlite:${stat.dev}:${stat.ino}:${stat.mode & 0o111}`);
-                    continue;
-                }
                 let db = databases.get(file);
                 if (!db) {
                     db = new DatabaseSync(file, { readOnly: true });
                     databases.set(file, db);
                 }
-                entries.set(key, `sqlite:${crypto.createHash("sha256").update(db.serialize()).digest("hex")}:${stat.dev}:${stat.ino}:${stat.mode & 0o111}`);
+                // Resource heartbeats are copied consistently but are not productive
+                // RUN writers; owner identity is fenced by boundary.verify().
+                if (file === path.join(resourceHome(context), "runtime.sqlite")) {
+                    entries.set(key, `resource-sqlite:${sqliteSemanticFingerprint(db, true)}:${stat.mode & 0o111}`);
+                    continue;
+                }
+                entries.set(key, `sqlite:${sqliteSemanticFingerprint(db)}:${stat.mode & 0o111}`);
             }
             else if (stat.isFile())
                 entries.set(key, `file:${crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex")}:${stat.mode & 0o111}`);
@@ -944,7 +1050,7 @@ function codexHomeSnapshotExclusions(context, projectId, runId) {
     return excluded;
 }
 /** Copy a dedicated home or scoped recovery tree, preserving SQLite WAL commits. */
-function copyRuntimeTree(source, destination, scoped = true, excluded = []) {
+function copyRuntimeTree(source, destination, scoped = true, excluded = [], providerHomes = []) {
     if (fs.lstatSync(source).isSymbolicLink())
         throw new AppError("snapshot_runtime_symlink_outside_scope", "Recovery artifact roots must not be symbolic links", 1, { path: source });
     const root = physicalPath(source);
@@ -955,7 +1061,7 @@ function copyRuntimeTree(source, destination, scoped = true, excluded = []) {
     fs.cpSync(source, destination, {
         recursive: true, verbatimSymlinks: true,
         filter: file => {
-            const kind = runtimeSnapshotKind(file, excluded);
+            const kind = runtimeSnapshotKind(file, excluded, providerHomes);
             if (kind === "excluded" || kind === "sidecar")
                 return false;
             const stat = fs.lstatSync(file);
@@ -1057,11 +1163,12 @@ function captureRecoveryAuxiliary(context, captured, input) {
 }
 function treeHash(root, filtered = false) {
     const hash = crypto.createHash("sha256");
+    const allowed = typeof filtered === "function" ? filtered : filtered ? projectPayloadFilter(root) : () => true;
     const visit = (dir, relative) => {
         for (const entry of fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
             const file = path.join(dir, entry.name);
             const rel = path.join(relative, entry.name);
-            if (typeof filtered === "function" ? !filtered(file) : filtered && !snapshotPayloadAllowed(file))
+            if (!allowed(file))
                 continue;
             if (entry.isDirectory())
                 visit(file, rel);
@@ -1080,10 +1187,11 @@ function treeHash(root, filtered = false) {
 }
 function treeModesHash(root, filtered = false) {
     const entries = [];
+    const allowed = typeof filtered === "function" ? filtered : filtered ? projectPayloadFilter(root) : () => true;
     const visit = (directory) => {
         for (const entry of fs.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
             const file = path.join(directory, entry.name);
-            if (typeof filtered === "function" ? !filtered(file) : filtered && !snapshotPayloadAllowed(file))
+            if (!allowed(file))
                 continue;
             if (entry.isDirectory())
                 visit(file);
@@ -1131,6 +1239,8 @@ function readManifest(snapshot) {
     const value = JSON.parse(fs.readFileSync(file, "utf8"));
     if (value.schema_id !== "dd-flow/eval-run-snapshot@5" || !value.run_id || !value.project_root || !value.dd_flow_home || typeof value.purpose !== "string" || !["stage_entry", "candidate", "incomplete", "recovery"].includes(value.purpose) || (value.purpose === "stage_entry" && !value.stage_entry) || (value.purpose !== "stage_entry" && value.stage_entry !== null) || !value.runtime_sha256 || !value.project_sha256 || !value.project_git || !value.workspace)
         throw new AppError("snapshot_invalid", "Snapshot manifest is invalid", 1, { snapshot });
+    if (value.runtime_payload_policy !== undefined && (value.runtime_payload_policy !== "flow-evidence@1" || value.purpose === "recovery"))
+        throw new AppError("snapshot_invalid", "Snapshot runtime payload policy is invalid for its purpose", 1, { snapshot });
     if (!value.project_git.branch || !value.project_git.head || !value.project_git.bundle_sha256)
         throw new AppError("snapshot_invalid", "Snapshot project Git metadata is incomplete", 1, { snapshot });
     if (value.workspace.kind === "git_worktree" && (!value.workspace.branch || !value.workspace.base_ref || !value.workspace.bundle_sha256))

package/dist/services/external-work-launch.js

@@ -1,6 +1,7 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import { spawnSync } from "node:child_process";
 import { ensureWorkLaunchStorage } from "../storage/database.js";
 import { AppError } from "../shared/errors.js";
 import { runtimeBudgetForRun } from "./runtime-budget.js";
@@ -8,9 +9,12 @@ import { adapterSessionId, prepareHarnessFlowExecutable, runHarnessAdapter } fro
 import { harnessRuntimeArguments, resolveHarnessCommand } from "./harness-config.js";
 import { resolveExecutionPolicy, runtimeHarness, validateExecutionOverride } from "./execution-policy.js";
 import { assertRunMutationAllowed } from "./run-recovery.js";
-import { assertWorkLaunchReady, workStartCommand } from "./work-registry.js";
+import { assertWorkLaunchReady, reviewSourceInputs, workStartCommand } from "./work-registry.js";
 import { initCodexHome } from "./hooks.js";
 import { managedInvocationContext } from "./lifecycle-invocations.js";
+import { reviewExecutionCopyHash, reviewSourceFilter, reviewSourceHash, reviewSourcePaths } from "./review-copy.js";
+import { workspaceGitFiles } from "./workspace-files.js";
+import { qualifyAgyHooks } from "../harness-runtime/lib/dd-agy-daemon.mjs";
 /**
  * Creates an external provider root for one already-created Work.  The launch
  * is not a Work claim: only the worker's trusted `work start` hook binds it.
@@ -43,13 +47,34 @@ export async function launchExternalWork(context, input) {
     const resolved = resolveExecutionPolicy({ ddFlowHome: context.ddFlowHome, policy, profiles: snapshot.execution_profile.agent_profiles, ...(stage ? { stage } : {}), ...(override ? { work: override } : {}) });
     if (resolved.delegation.mode !== "external")
         throw new AppError("external_launch_not_selected", "This Work's frozen policy selects native delegation", 2, { work_id: work.work_id });
+    const agyWorker = runtimeHarness(resolved.worker) === "antigravity-cli";
+    if (agyWorker)
+        await qualifyAgyHooks(run.workspace_root);
     const operationId = `OPR-${crypto.randomUUID()}`;
     const root = path.join(run.run_root, "external-launches", operationId);
     const journal = path.join(root, "adapter.events.jsonl");
     fs.mkdirSync(root, { recursive: true });
+    const isolatedWorkspace = isReadOnlyWork(work.payload_json) ? path.join(root, "read-only-workspace") : null;
+    const reviewInputs = isolatedWorkspace ? reviewSourceInputs(context, work.work_id) : [];
+    const reviewBase = snapshot.workspace?.base && snapshot.workspace.base !== "unknown" ? snapshot.workspace.base : "HEAD";
+    let reviewCopy = null;
+    if (isolatedWorkspace) {
+        const allowed = reviewSourceFilter(run.workspace_root, reviewInputs, reviewBase);
+        const before = reviewSourceHash(run.workspace_root, reviewInputs, reviewBase);
+        fs.cpSync(run.workspace_root, isolatedWorkspace, { recursive: true, verbatimSymlinks: true, filter: allowed });
+        if (agyWorker)
+            await qualifyAgyHooks(isolatedWorkspace);
+        const after = reviewSourceHash(run.workspace_root, reviewInputs, reviewBase), copy = reviewExecutionCopyHash(isolatedWorkspace, run.workspace_root, false, reviewInputs, reviewBase);
+        if (before !== after || after !== copy)
+            throw new AppError("read_only_input_changed", "Read-only execution copy differs from its authoritative source", 2, { work_id: work.work_id, before, after, copy });
+        writeReviewGitEvidence(run.workspace_root, isolatedWorkspace, snapshot.workspace?.base, reviewInputs);
+        if (reviewSourceHash(run.workspace_root, reviewInputs, reviewBase) !== after)
+            throw new AppError("read_only_input_changed", "Authoritative review workspace changed while collecting Git evidence", 2, { work_id: work.work_id });
+        reviewCopy = { root: path.relative(run.run_root, isolatedWorkspace).split(path.sep).join("/"), sha256: reviewExecutionCopyHash(isolatedWorkspace, run.workspace_root, true, reviewInputs, reviewBase), source_sha256: after };
+    }
     const now = context.now();
     const flowExecutable = prepareHarnessFlowExecutable(context, root);
-    const env = { ...context.env, DD_FLOW_BIN: flowExecutable, DD_FLOW_INVOCATION_SCOPE: undefined, DD_FLOW_CURRENT_INVOCATION: undefined };
+    const env = { ...context.env, DD_FLOW_BIN: flowExecutable, DD_FLOW_INVOCATION_SCOPE: undefined, DD_FLOW_CURRENT_INVOCATION: undefined, ...(isolatedWorkspace ? { DD_FLOW_READ_ONLY_WORKSPACE: isolatedWorkspace } : {}) };
     // An external Codex root is a fresh thread, so it does not inherit the
     // coordinator's managed PreToolUse hook.  Its first `work start` must emit
     // that hook event to bind the Work to the physical session.
@@ -61,8 +86,8 @@ export async function launchExternalWork(context, input) {
     let runtimeContext = { ...context, env };
     const runtimeOwner = { schema_id: "dd-flow/runtime-owner@1", owner_id: `run:${work.run_id}:work:${work.work_id}`, role: "worker", project_id: work.project_id, run_id: work.run_id, work_id: work.work_id, operation_id: operationId, state_dir: root, dd_flow_home: context.ddFlowHome, dd_flow_bin: flowExecutable, resource_home: context.env.DD_FLOW_RESOURCE_HOME ?? context.ddFlowHome, budget: runtimeBudgetForRun(context, work.project_id, work.run_id) };
     const executable = resolveHarnessCommand(context.ddFlowHome, runtimeHarness(resolved.worker), "adapter");
-    context.db.run("INSERT INTO work_launches (operation_id, work_id, profile_json, profile_hash, status, state_dir, journal_path, provider_session_id, adapter_receipt_json, created_at, updated_at) VALUES (?, ?, ?, ?, 'launching', ?, ?, NULL, NULL, ?, ?)", [operationId, work.work_id, JSON.stringify({ ...resolved, runtime_adapter: { executable, owner: runtimeOwner } }), resolved.profile_hash, root, journal, now, now]);
-    const common = ["--dd-flow-bin", flowExecutable, "--state-dir", root, "--journal", journal, "--cwd", run.workspace_root, "--provider", resolved.worker.provider, "--model", resolved.worker.model, "--reasoning", resolved.worker.reasoning, "--mode", resolved.worker.mode, "--permission", resolved.worker.permission, "--project-root", run.project_root, "--dd-flow-home", context.ddFlowHome, ...harnessRuntimeArguments(context.ddFlowHome, runtimeHarness(resolved.worker)), "--json"];
+    context.db.run("INSERT INTO work_launches (operation_id, work_id, profile_json, profile_hash, status, state_dir, journal_path, provider_session_id, adapter_receipt_json, created_at, updated_at) VALUES (?, ?, ?, ?, 'launching', ?, ?, NULL, NULL, ?, ?)", [operationId, work.work_id, JSON.stringify({ ...resolved, runtime_adapter: { executable, owner: runtimeOwner }, ...(reviewCopy ? { review_copy: reviewCopy } : {}) }), resolved.profile_hash, root, journal, now, now]);
+    const common = ["--dd-flow-bin", flowExecutable, "--state-dir", root, "--journal", journal, "--cwd", isolatedWorkspace ?? run.workspace_root, "--provider", resolved.worker.provider, "--model", resolved.worker.model, "--reasoning", resolved.worker.reasoning, "--mode", resolved.worker.mode, "--permission", resolved.worker.permission, "--project-root", run.project_root, "--dd-flow-home", context.ddFlowHome, ...harnessRuntimeArguments(context.ddFlowHome, runtimeHarness(resolved.worker)), "--json"];
     const evidence = (value) => fs.appendFileSync(journal, `${JSON.stringify({ type: "adapter_call", at: context.now(), ...value })}\n`);
     try {
         const call = (args, timeoutMs) => runHarnessAdapter({ executable, args, env: runtimeContext.env, operationId: `${operationId}:${args[0]}.${args[1]}`, runtimeOwner, ...(timeoutMs ? { timeoutMs } : {}), ...(input.progress ? { progress: input.progress } : {}), onEvidence: evidence });
@@ -78,8 +103,10 @@ export async function launchExternalWork(context, input) {
             projectRoot: run.project_root, runId: work.run_id, generation });
         assertRunMutationAllowed(context, work.project_id, work.run_id, generation);
         assertWorkLaunchReady(context, work.work_id);
+        if (reviewCopy && reviewSourceHash(run.workspace_root, reviewInputs, reviewBase) !== reviewCopy.source_sha256)
+            throw new AppError("read_only_input_changed", "Authoritative review workspace changed after the execution copy was made", 2, { work_id: work.work_id });
         const promptFile = path.join(root, "launch.md");
-        fs.writeFileSync(promptFile, `Start the assigned Work now. Your first tool call must be this exact standalone command:\n\n${workStartCommand(runtimeContext, work)}\n\nUse the packet returned by that command. Do not claim another Work or run this command more than once.\n`);
+        fs.writeFileSync(promptFile, `Start the assigned Work now. Your first tool call must be this exact standalone command:\n\n${workStartCommand(runtimeContext, work)}\n\nUse the packet returned by that command. Do not claim another Work or run this command more than once.${isolatedWorkspace ? `\n\nThe review copy has no .git. Read the captured status/diff or gitless note in ${path.join(isolatedWorkspace, ".dd-flow", "review-evidence")}; do not run Git inside the copy.\n` : "\n"}`);
         const prompted = await call(["session", "prompt", "--session-id", sessionId, "--prompt-file", promptFile, ...common], 45 * 60_000);
         assertRunMutationAllowed(context, work.project_id, work.run_id, generation);
         context.db.run("UPDATE work_launches SET status = 'start_requested', provider_session_id = ?, adapter_receipt_json = ?, updated_at = ? WHERE operation_id = ?", [sessionId, JSON.stringify({ create: created, prompt: prompted }), context.now(), operationId]);
@@ -90,6 +117,24 @@ export async function launchExternalWork(context, input) {
         throw error;
     }
 }
+export function writeReviewGitEvidence(source, copy, base, explicitInputs = []) {
+    const directory = path.join(copy, ".dd-flow", "review-evidence");
+    fs.mkdirSync(directory, { recursive: true });
+    if (workspaceGitFiles(source, ["--cached"]) === null) {
+        fs.writeFileSync(path.join(directory, "gitless.txt"), "Source workspace is not a Git repository. Review the copied files and accepted RUN evidence.\n");
+        return;
+    }
+    if (!base || base === "unknown")
+        throw new AppError("review_git_evidence_missing", "Git review source has no frozen base commit", 1, { workspace_root: source });
+    const paths = (reviewSourcePaths(source, explicitInputs, base) ?? []).map(file => `:(literal)${file}`);
+    for (const [name, args] of [["status.txt", ["status", "--short", "--untracked-files=all"]], ["diff.patch", ["diff", "--no-ext-diff", "--no-renames", "--binary", base]]]) {
+        const result = paths.length ? spawnSync("git", ["-C", source, ...args, "--", ...paths], { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 }) : { status: 0, stdout: "", stderr: "", error: undefined };
+        if (result.status !== 0 || result.error)
+            throw new AppError("review_git_evidence_failed", "Could not collect read-only Git evidence for reviewer", 1, { workspace_root: source, command: name, cause: result.error?.message ?? result.stderr });
+        fs.writeFileSync(path.join(directory, name), result.stdout);
+    }
+    fs.writeFileSync(path.join(directory, "base.txt"), `${base}\n`);
+}
 function workOverride(payload) {
     if (!payload)
         return undefined;
@@ -108,3 +153,13 @@ function workOverride(payload) {
     validateExecutionOverride(execution);
     return execution;
 }
+function isReadOnlyWork(payload) {
+    if (!payload)
+        return false;
+    try {
+        return JSON.parse(payload).read_only === true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/services/prompts.js

@@ -300,6 +300,8 @@ function renderPrompt(input) {
         `- Acceptance contribution: ${item.semantic_spine?.acceptance_contribution ?? "not_applicable"}`,
         "",
         "## Hard Write Boundary",
+        "Before editing, change into the project workspace shown below (cd -- WORKSPACE) or use its absolute path when the tool cannot persist cwd.",
+        "Write only the project workspace and the named report directory; never write another RUN/native home or Git/worktree control data.",
         `- All project writes must stay under: \`${input.workspaceRoot}\``,
         "- Do not write outside this workspace, to another RUN, or into Git/worktree control data.",
         "- Accepted requirements and non-goals remain binding; planned write areas do not.",

package/dist/services/review-copy.js

@@ -0,0 +1,136 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { AppError } from "../shared/errors.js";
+import { ignoredWorkspacePaths } from "./code-checks.js";
+import { localEnvironmentAllowed, ownedWorkspaceHookPath, projectServicePathFilter, workspaceGitFiles } from "./workspace-files.js";
+export function reviewEnvironmentAllowed(file) {
+    return localEnvironmentAllowed(file);
+}
+export function reviewSourcePaths(root, explicitInputs = [], base = "HEAD") {
+    const inventory = workspaceGitFiles(root, ["--cached", "--others", "--exclude-standard"]);
+    if (inventory === null)
+        return null;
+    const serviceAllowed = projectServicePathFilter(root, explicitInputs);
+    const hasBase = base !== "HEAD" || spawnSync("git", ["-C", root, "rev-parse", "--verify", "HEAD"], { encoding: "utf8" }).status === 0;
+    const changes = hasBase ? spawnSync("git", ["-C", root, "diff", "--name-status", "-z", "--find-renames", base, "--"], { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 }) : null;
+    if (changes && (changes.status !== 0 || changes.error))
+        throw new AppError("review_git_evidence_failed", "Could not classify renamed review paths", 1, { workspace_root: root, cause: changes.error?.message ?? changes.stderr });
+    const fields = changes?.stdout.split("\0").filter(Boolean) ?? [], tainted = new Set();
+    for (let index = 0; index < fields.length;) {
+        const status = fields[index++];
+        if (/^[RC]/.test(status)) {
+            const before = fields[index++], after = fields[index++];
+            if (!reviewEnvironmentAllowed(before) || !reviewEnvironmentAllowed(after)) {
+                tainted.add(before);
+                tainted.add(after);
+            }
+        }
+        else
+            index += 1;
+    }
+    return [...new Set([...inventory, ...explicitInputs])]
+        .filter(relative => reviewEnvironmentAllowed(relative) && !tainted.has(relative) && serviceAllowed(path.join(root, relative)))
+        .sort();
+}
+export function reviewSourceFilter(root, explicitInputs = [], base = "HEAD") {
+    const selected = reviewSourcePaths(root, explicitInputs, base);
+    const serviceAllowed = projectServicePathFilter(root, explicitInputs);
+    const retained = new Set(selected?.map(relative => path.resolve(root, relative)) ?? []);
+    const branches = new Set();
+    for (const file of retained)
+        for (let directory = path.dirname(file); directory !== path.dirname(directory); directory = path.dirname(directory))
+            branches.add(directory);
+    return file => {
+        const parts = path.relative(root, file).split(path.sep);
+        if (parts.some(part => [".git", "node_modules", ".dd-flow"].includes(part)) || !reviewEnvironmentAllowed(file))
+            return false;
+        return selected === null ? serviceAllowed(file) : retained.has(path.resolve(file)) || branches.has(path.resolve(file));
+    };
+}
+export function reviewSourceHash(root, explicitInputs = [], base = "HEAD") {
+    const allowed = reviewSourceFilter(root, explicitInputs, base), ownedHook = ownedWorkspaceHookPath(root);
+    return reviewCopyHash(root, file => path.relative(root, file) !== ownedHook && allowed(file));
+}
+/** The copied project has no Git index. Apply the source's exact service-file
+ * policy to it, while retaining only our frozen Git evidence under .dd-flow. */
+export function reviewExecutionCopyHash(copyRoot, sourceRoot, includeEvidence = true, explicitInputs = [], base = "HEAD") {
+    if (ownedWorkspaceHookPath(sourceRoot) && !ownedWorkspaceHookPath(copyRoot))
+        throw new AppError("read_only_input_changed", "Qualified review hook differs between execution copy and source", 2, { copy_root: copyRoot });
+    const sourceAllowed = reviewSourceFilter(sourceRoot, explicitInputs, base);
+    const serviceAllowed = projectServicePathFilter(sourceRoot, explicitInputs);
+    const ownedHook = ownedWorkspaceHookPath(sourceRoot);
+    const verifySelection = (directory) => {
+        for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+            const file = path.join(directory, entry.name), relative = path.relative(copyRoot, file);
+            const parts = relative.split(path.sep);
+            if (parts[0] === ".dd-flow" || parts.some(part => [".git", "node_modules"].includes(part)))
+                continue;
+            if (!reviewEnvironmentAllowed(file))
+                throw new AppError("read_only_input_changed", "Read-only execution copy contains a local environment file", 2, { path: relative });
+            if (!serviceAllowed(path.join(sourceRoot, relative)))
+                continue;
+            if (!sourceAllowed(path.join(sourceRoot, relative)) && ignoredWorkspacePaths(sourceRoot, [relative]).includes(relative.split(path.sep).join("/")))
+                continue;
+            if (!sourceAllowed(path.join(sourceRoot, relative)))
+                throw new AppError("read_only_input_changed", "Read-only execution copy contains an unselected product input", 2, { path: relative });
+            if (entry.isDirectory())
+                verifySelection(file);
+        }
+    };
+    verifySelection(copyRoot);
+    return reviewCopyHash(copyRoot, file => {
+        const relative = path.relative(copyRoot, file);
+        const parts = relative.split(path.sep);
+        if (parts[0] === ".dd-flow")
+            return includeEvidence && (parts.length === 1 || parts[1] === "review-evidence");
+        return relative !== ownedHook && sourceAllowed(path.join(sourceRoot, relative));
+    });
+}
+/** Exact bytes visible in a read-only execution copy, including symlink targets. */
+export function reviewCopyHash(root, allowed = () => true) {
+    const hash = crypto.createHash("sha256");
+    let canonicalRoot;
+    try {
+        canonicalRoot = fs.realpathSync(root);
+    }
+    catch {
+        throw new AppError("read_only_input_changed", "Read-only execution copy is missing", 2, { root });
+    }
+    const visit = (directory) => {
+        for (const entry of fs.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            const file = path.join(directory, entry.name);
+            if (!allowed(file))
+                continue;
+            const relative = path.relative(root, file).split(path.sep).join("/");
+            const stat = fs.lstatSync(file);
+            const record = (kind, value = "") => hash.update(`${JSON.stringify([relative, kind, stat.mode & 0o111, value])}\n`);
+            if (entry.isDirectory()) {
+                record("directory");
+                visit(file);
+                continue;
+            }
+            if (entry.isSymbolicLink()) {
+                const link = fs.readlinkSync(file);
+                let target;
+                try {
+                    target = fs.realpathSync(file);
+                }
+                catch {
+                    throw new AppError("read_only_workspace_escape", "Read-only copy contains an unresolved symlink", 1, { path: relative });
+                }
+                const inside = path.relative(canonicalRoot, target);
+                if (path.isAbsolute(link) || inside === ".." || inside.startsWith(`..${path.sep}`))
+                    throw new AppError("read_only_workspace_escape", "Read-only copy contains a symlink outside its workspace", 1, { path: relative });
+                record("symlink", link);
+            }
+            else if (entry.isFile())
+                record("file", crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex"));
+            else
+                throw new AppError("read_only_workspace_unsupported", "Read-only copy contains an unsupported file type", 1, { path: relative });
+        }
+    };
+    visit(root);
+    return hash.digest("hex");
+}