@deksden-com/dd-flow-cli 0.9.0-beta.100 → 0.9.0-beta.104

package/dist/harness-runtime/lib/dd-zcode.mjs

@@ -188,6 +188,7 @@ export class AcpBridge {
     this.child.on("error", (error) => { error.code ??= "bridge_exited"; this.rejectAll(error); });
     this.child.on("exit", (code) => { const error = new Error(`zcode-acp exited ${code}${this.bridgeStderr.trim() ? `: ${this.bridgeStderr.trim()}` : ""}`); error.code = "bridge_exited"; this.rejectAll(error); });
     readline.createInterface({ input: this.child.stdout }).on("line", (line) => this.receive(line));
+    if (this.options.onSpawn) await this.options.onSpawn(this.child);
     return await this.request("initialize", {
       protocolVersion: 1,
       clientCapabilities: { fs: { readTextFile: false, writeTextFile: false }, elicitation: { form: {} } },
@@ -455,10 +456,47 @@ async function resume(bridge, sessionId, cwd) {
   return sessionId;
 }
 
+/** Ended children are paginated by the native API (20 by default). A partial
+ * directory is never settlement evidence, including during teardown. */
+export async function readZcodeSubagents(bridge, sessionId, timeoutMs = 30_000, retained = false) {
+  const deadline = performance.now() + timeoutMs;
+  const cursors = new Set(), ended = new Map();
+  let first, cursor;
+  for (;;) {
+    const remaining = deadline - performance.now();
+    if (remaining <= 0) fail("ZCode child observation deadline expired", "native_topology_incomplete");
+    const response = await bridge.request(retained ? "zcode/session/retainedSubagents" : "zcode/session/subagents", { sessionId, ...(cursor ? { endedCursor: cursor } : {}) }, remaining);
+    if (retained && response?.sessionId !== sessionId) fail("Retained ZCode child directory has a foreign Session identity", "native_topology_incomplete");
+    const page = retained ? response.topology : response;
+    if (performance.now() >= deadline) fail("ZCode child observation deadline expired", "native_topology_incomplete");
+    if (!page || !Array.isArray(page.running)) fail("ZCode child directory is unavailable", "native_topology_incomplete");
+    if (!first) first = page;
+    if (!page.ended) {
+      if (cursor) fail("ZCode child page omitted ended outcomes", "native_topology_incomplete");
+      return page; // Older qualified bridges expose an unpaginated completed array.
+    }
+    if (!Array.isArray(page.ended.items) || !Number.isSafeInteger(page.ended.total) || page.ended.total < 0
+      || page.revision !== first.revision || page.ended.total !== first.ended.total) fail("ZCode child directory changed or is malformed during pagination", "native_topology_incomplete");
+    for (const child of page.ended.items) {
+      if (typeof child.childSessionId !== "string" || !child.childSessionId) fail("ZCode ended child has no identity", "native_topology_incomplete");
+      const prior = ended.get(child.childSessionId);
+      if (prior && JSON.stringify(prior) !== JSON.stringify(child)) fail("ZCode child pages contain conflicting outcomes", "native_topology_incomplete");
+      ended.set(child.childSessionId, child);
+    }
+    cursor = page.ended.nextCursor;
+    if (!cursor) {
+      if (ended.size !== first.ended.total) fail("ZCode child directory is incomplete", "native_topology_incomplete");
+      return { ...first, ended: { total: first.ended.total, items: [...ended.values()] } };
+    }
+    if (typeof cursor !== "string" || cursors.has(cursor) || !Number.isSafeInteger(first.revision)) fail("ZCode child pagination has no advancing, versioned cursor", "native_topology_incomplete");
+    cursors.add(cursor);
+  }
+}
+
 async function inspect(bridge, sessionId) {
   const [read, subagents] = await Promise.all([
     bridge.request("zcode/session/read", { sessionId }),
-    bridge.request("zcode/session/subagents", { sessionId }),
+    readZcodeSubagents(bridge, sessionId),
   ]);
   let usage = null, usage_observation_error = null;
   try { usage = await readZcodeUsage(bridge, sessionId); }
@@ -521,9 +559,8 @@ export async function observeClosedZcodeTree(bridge, root, retainedChildren = []
       const resident = await bridge.request("zcode/session/resident", { sessionId }, timeout());
       if (resident?.sessionId !== sessionId || typeof resident.resident !== "boolean") throw new Error("Invalid residency identity or state");
       residents.push(resident);
-      const retained = await bridge.request("zcode/session/retainedSubagents", { sessionId }, timeout());
-      const tree = retained?.topology;
-      if (retained?.sessionId !== sessionId || !Array.isArray(tree?.childSessionIds)
+      const tree = await readZcodeSubagents(bridge, sessionId, deadline - performance.now(), true);
+      if (!Array.isArray(tree?.childSessionIds)
         || tree.childSessionIds.some(id => typeof id !== "string" || !id || id === sessionId)
         || !Array.isArray(tree?.running) || !Array.isArray(tree?.ended?.items)
         || !Number.isSafeInteger(tree.ended.total) || tree.ended.total < 0
@@ -562,7 +599,7 @@ async function cancelTree(bridge, sessionId, before, providerSessionId, retained
     await new Promise((resolve) => setTimeout(resolve, 1000));
     const timeout = Math.max(1, deadline - Date.now());
     [after, read] = await Promise.all([
-      bridge.request("zcode/session/subagents", { sessionId }, timeout).catch(error => ({ observation_error: { code: error.code, message: error.message } })),
+      readZcodeSubagents(bridge, sessionId, timeout).catch(error => ({ observation_error: { code: error.code, message: error.message } })),
       bridge.request("zcode/session/read", { sessionId }, timeout).catch(error => ({ observation_error: { code: error.code, message: error.message } })),
     ]);
     root_status = read?.projection?.status ?? read?.session?.status ?? null;
@@ -588,7 +625,7 @@ export async function cancelChildWithBridge(bridge, options) {
   requireJournal(options);
   const identity = await controlledIdentity(bridge, options);
   const childSessionId = text(options.childSessionId, "--child-session-id");
-  const before = await bridge.request("zcode/session/subagents", { sessionId: identity.adapterSessionId });
+  const before = await readZcodeSubagents(bridge, identity.adapterSessionId);
   const child = (before.running ?? []).find((item) => item.childSessionId === childSessionId);
   if (!child) fail(`ZCode has no running child ${childSessionId}`, "child_not_running");
   const taskId = child.taskId ?? child.agentId;
@@ -597,7 +634,7 @@ export async function cancelChildWithBridge(bridge, options) {
   let after = before;
   for (let attempt = 0; attempt < 6; attempt += 1) {
     await new Promise((resolve) => setTimeout(resolve, 1000));
-    after = await bridge.request("zcode/session/subagents", { sessionId: identity.adapterSessionId });
+    after = await readZcodeSubagents(bridge, identity.adapterSessionId);
     if (!(after.running ?? []).some((item) => item.childSessionId === childSessionId)) break;
   }
   if ((after.running ?? []).some((item) => item.childSessionId === childSessionId)) {
@@ -752,22 +789,19 @@ async function forwardUsageBestEffort(options, providerSessionId, usage, toolCal
 }
 
 export function zcodeLifecycleQualification(sha256, bridgeCommit, harnessContract) {
-  // Behavioural evidence: dd-eval production-invocations probes on 2026-09-13
-  // and 2026-09-22. The latter exercised public commands, file-backed JSON,
-  // concurrent children and continuation on bridge contract @2.
-  // Pin both providers of native event identity, not a string in the bundle.
-  // 60af0d3 adds retainedSubagents without changing native event forwarding.
-  const qualifiedTuples = new Map([
-    ["e9f1868c0fdb863537ed910ee3828b9be96b8c2fd805473f63b439e1113266b8", new Set(["e0600fe3c46e215695f257e65aa6f674ced998d8", "60af0d31e13076a313d9770f10aa70f7c94742cf"])],
-    ["500ae84fa2cb8dd74c1264e5f3d3709c004c59b58899f1b0c3e205137a0ef466", new Set(["8c0a893f3c26a0b96cb138acf762db84c800298b", "f4d47b517073f9bdb8d4eba3d0d59ce66c6a2833"])],
-    // ZCode Desktop 3.14.3 retains CLI 0.16.9; the published-engine native probe
-    // passed root, concurrent child, and same-child continuation on this binary.
-    ["b1df2ef3e5bd76c4af3ecb296bc003a10d3f13191a26610bd0ba940feadad529", new Set(["f4d47b517073f9bdb8d4eba3d0d59ce66c6a2833"])],
+  // The native app bundle is an auto-updated runtime.  Its whole-file SHA is
+  // evidence for provenance, not a protocol identity: an unchanged bridge
+  // must not reject every normal ZCode patch release.  The bridge contract is
+  // the compatibility boundary; native event identity is checked by the
+  // lifecycle observer and receipts during the bounded qualification probe.
+  const qualifiedBridgeCommits = new Map([
+    ["e0600fe3c46e215695f257e65aa6f674ced998d8", ZCODE_HARNESS_CONTRACT],
+    ["60af0d31e13076a313d9770f10aa70f7c94742cf", ZCODE_HARNESS_CONTRACT],
+    ["8c0a893f3c26a0b96cb138acf762db84c800298b", ZCODE_HARNESS_CONTRACT],
+    ["f4d47b517073f9bdb8d4eba3d0d59ce66c6a2833", "dd-zcode-harness@2"],
+    ["5a8c89ab716a4b2ccc50df81cb4d204ff5c06368", "dd-zcode-harness@2"],
   ]);
-  const qualified = qualifiedTuples.get(sha256)?.has(bridgeCommit) === true
-    && (bridgeCommit === "f4d47b517073f9bdb8d4eba3d0d59ce66c6a2833"
-      ? harnessContract === "dd-zcode-harness@2"
-      : harnessContract === ZCODE_HARNESS_CONTRACT);
+  const qualified = qualifiedBridgeCommits.get(bridgeCommit) === harnessContract;
   return { status: qualified ? "qualified" : "unqualified", mechanism: "cli-invocation@1", sha256,
     capabilities: qualified ? ["root", "concurrent_children", "child_continuation"] : [],
     native_nested_children: false, reason: qualified ? null : "native_event_contract_unqualified" };
@@ -801,8 +835,11 @@ export async function createSessionWithBridge(bridge, options, initialized) {
   // fact that allocation was already admitted.
   await options.onSessionAliasAllocated?.({ adapter_session_id: created.sessionId, cwd });
   bridge.allocationObservers?.set(created.sessionId, async identity => {
-    if (identity.cwd !== cwd) fail("ZCode allocation workspace mismatch", "session_identity_mismatch");
-    await options.onSessionAllocated?.(identity);
+    // ZCode 0.46.x emits adapter/provider identities on this notification but
+    // does not repeat the workspace. The cwd from session/new is authoritative
+    // for this live bridge; reject only an explicitly conflicting workspace.
+    if (identity.cwd !== undefined && identity.cwd !== cwd) fail("ZCode allocation workspace mismatch", "session_identity_mismatch");
+    await options.onSessionAllocated?.({ ...identity, cwd });
   });
   const resolved = await bridge.request("zcode/session/resolve", { sessionId: created.sessionId });
   const providerSessionId = resolved.providerSessionId;
@@ -918,7 +955,7 @@ export async function cancelSession(options) {
 export async function cancelSessionWithBridge(bridge, options) {
   requireJournal(options);
   const identity = await controlledIdentity(bridge, options);
-  const before = await bridge.request("zcode/session/subagents", { sessionId: identity.adapterSessionId }).catch(error => ({ observation_error: { code: error.code, message: error.message } }));
+  const before = await readZcodeSubagents(bridge, identity.adapterSessionId).catch(error => ({ observation_error: { code: error.code, message: error.message } }));
   return receipt(options, { harness: "zcode-acp", provider_session_id: identity.providerSessionId, adapter_session_id: identity.adapterSessionId, ...await cancelTree(bridge, identity.adapterSessionId, before, identity.providerSessionId, options.knownChildSessionIds) });
 }
 
@@ -931,7 +968,7 @@ export async function forkSessionWithBridge(bridge, options) {
   requireJournal(options);
   if (!options.target || typeof options.target !== "object") fail("explicit --target-json is required");
   const identity = await controlledIdentity(bridge, options);
-  const topology = await bridge.request("zcode/session/subagents", { sessionId: identity.adapterSessionId });
+  const topology = await readZcodeSubagents(bridge, identity.adapterSessionId);
   if ((topology.running ?? []).length) fail("cannot fork while background children are running");
   const result = await bridge.request("session/fork", { sessionId: identity.adapterSessionId, target: options.target });
   if (!result.forkedSessionId) fail("ZCode fork returned no provider Session ID");

package/dist/harness-runtime/lib/delegation-instructions.d.mts

@@ -1,5 +1,5 @@
 export type DelegationWork = { work_id: string; start_command: string; launch_policy?: string };
-export type DelegationInput = { harness: string; stage: string; capacity: number; works?: DelegationWork[] };
+export type DelegationInput = { harness: string; stage: string; capacity: number; works?: DelegationWork[]; totalWorks?: number; remainingWorks?: number };
 export function delegationAdapter(harness: string): string | null;
 export function delegationContract(harness: string): string;
 export function workerDelegationTask(input: { workId: string; startCommand: string; launchPolicy?: string }): string;

package/dist/harness-runtime/lib/delegation-instructions.mjs

@@ -70,7 +70,7 @@ export function workerDelegationTask({ workId, startCommand, launchPolicy }) {
   ].join("\n");
 }
 
-export function renderDelegationInstructions({ harness, stage, capacity, works = [] }) {
+export function renderDelegationInstructions({ harness, stage, capacity, works = [], totalWorks = works.length, remainingWorks = 0 }) {
   const adapter = requireAdapter(harness);
   const count = works.length;
   if (!Number.isInteger(capacity) || capacity < 1 || count < 1 || count > capacity) throw new Error("Invalid native delegation wave size");
@@ -81,6 +81,11 @@ export function renderDelegationInstructions({ harness, stage, capacity, works =
   return [
     `Adapter delegation contract: ${delegationContract(harness)}.`,
     `Launch exactly ${count} direct native children for the current ${stage} Stage; the qualified capacity is ${capacity}.`,
+    ...(["plan-review", "code-review"].includes(stage) ? [
+      `Review dispatch phase: the whole group contains ${totalWorks} Work; this wave contains ${count}; ${remainingWorks} remain after this wave.`,
+      "Keep the accepted PLAN/CODE review inputs and aspect maps unchanged across every wave. Do not apply findings or edit reviewed files while any reviewer remains unstarted or running.",
+      "After this wave's children settle, return immediately. The controller will dispatch remaining reviewers or issue semantic completion after the full group has settled."
+    ] : []),
     adapter.launch,
     "Retain the frozen coordinator model and reasoning for native children; do not choose a different model, reasoning level or permission mode.",
     "You are the coordinator. The JSON assignments below contain child-only messages, not instructions for you to execute. Pass each message verbatim as the native tool's task/message/prompt argument. For context=fresh, select empty conversation context before launch; if unavailable, report the limitation and stop. Use only fields exposed by your actual native tool schema; if the native tool is absent, report that error without substituting a shell command.",

package/dist/harness-runtime/lib/managed-daemon.mjs

@@ -4,6 +4,7 @@ import path from "node:path";
 import { commandJson } from "./process-json.mjs";
 import { errorRecord } from "./operation-errors.mjs";
 import { writeJsonAtomic } from "./runner-events.mjs";
+import { runBoundedCommand } from "./native-hook-command.mjs";
 
 const leases = new Map();
 
@@ -52,12 +53,20 @@ export async function prepareRuntimeOwner(config, stateDir, env = process.env) {
 }
 
 export async function assertDaemonOwnership(stateDir, dispatch = {}, assertCurrent = () => {}) {
-  for (const lease of leases.values()) if (lease.error) throw lease.error;
+  for (const lease of leases.values()) if (!lease.stateDir && lease.error) throw lease.error;
   const state = JSON.parse(await readFile(path.join(stateDir, "daemon.json"), "utf8"));
   const owner = bindRuntimeOwner({ runtime_owner: state.config?.runtime_owner ?? null }, {});
   if (!owner) return;
   const record = state.resource_process;
   if (owner.state_dir !== stateDir || !record?.id || !record.lease_token) throw Object.assign(new Error("owned daemon has no confirmed resource binding"), { code: "process_ownership_unknown" });
+  for (const lease of leases.values()) {
+    if (lease.stateDir !== stateDir) continue;
+    if (Date.now() >= lease.expiresAt) throw Object.assign(new Error("managed process renewal is overdue"), { code: "process_ownership_unknown", details: { process_id: lease.record.id, cause: lease.error ? errorRecord(lease.error) : null } });
+    // A failed renewal is not a lost lease. Reconfirm before productive work;
+    // never dispatch on the old lease merely because it has time remaining.
+    if (lease.error && !lease.lost) await heartbeatDaemonProcess(lease.config, lease.record);
+    if (lease.error) throw lease.error;
+  }
   for (;;) {
     assertCurrent();
     const result = await runtimeProcess(state.config, "admission", { id: record.id, "lease-token": record.lease_token, owner: owner.owner_id, "state-dir": stateDir, "daemon-id": state.daemon_id ?? state.config?.daemonId, ...dispatch });
@@ -156,6 +165,8 @@ export async function runtimeProcess(config, action, options = {}) {
   if (!resourceHome || !ddFlowHome || !ddFlowBin) return null;
   const args = ["runtime", "process", action];
   for (const [key, value] of Object.entries(options)) if (value !== null && value !== undefined) args.push(`--${key}`, String(value));
+  if (action === "heartbeat") return JSON.parse(await runBoundedCommand({ bin: ddFlowBin, args: [...args, "--json"], cwd: config.cwd,
+    env: { ...(config.env ?? {}), DD_FLOW_HOME: ddFlowHome, DD_FLOW_RESOURCE_HOME: resourceHome }, timeoutMs: 15_000, timeoutCode: "process_heartbeat_timeout" }));
   return await commandJson(ddFlowBin, args, {
     cwd: config.cwd,
     env: { ...(config.env ?? {}), DD_FLOW_HOME: ddFlowHome, DD_FLOW_RESOURCE_HOME: resourceHome }
@@ -164,7 +175,7 @@ export async function runtimeProcess(config, action, options = {}) {
 
 export async function registerDaemonProcess(config, input) {
   const owner = bindRuntimeOwner(config);
-  const harness = ({ "codex-daemon": "codex-desktop", "zcode-daemon": "zcode-acp", "grok-daemon": "grok-acp", "agy-daemon": "antigravity-cli", "opencode-daemon": "opencode-server", "droid-daemon": "droid-cli" })[input.kind];
+  const harness = ({ "codex-daemon": "codex-desktop", "codex-provider": "codex-desktop", "zcode-daemon": "zcode-acp", "zcode-provider": "zcode-acp", "grok-daemon": "grok-acp", "grok-provider": "grok-acp", "agy-daemon": "antigravity-cli", "opencode-daemon": "opencode-server", "droid-daemon": "droid-cli" })[input.kind];
   const scope = owner ? { owner: owner.owner_id, "project-id": owner.project_id, run: owner.run_id, work: owner.work_id, role: owner.role, "state-dir": owner.state_dir, "adapter-executable": owner.adapter_executable, ...(owner.budget ? { "budget-json": JSON.stringify(owner.budget), harness } : {}), ...(owner.project_id && owner.run_id || owner.budget ? { "dispatch-barrier": "run-generation@1" } : {}), operation: `${owner.operation_id}:${input.operation ?? input.kind}` } : {};
   const result = await runtimeProcess(config, "register", { ...input, ...scope, "owner-pid": process.pid, "lease-ms": 300_000 });
   return result?.process ? { id: result.process.id, lease_token: result.process.lease_token, kind: input.kind } : null;
@@ -179,11 +190,33 @@ export async function confirmDaemonProcess(config, record, child) {
   await runtimeProcess(config, "confirm", { id: record.id, "lease-token": record.lease_token, pid: child.pid, "process-group-id": child.pid, "owner-pid": record.kind?.endsWith("-daemon") ? child.pid : process.pid, "lease-ms": 300_000 });
 }
 
+/** Provider bridges use a different process group from their daemon. Publish
+ * the exact binding before initialize can start productive provider traffic. */
+export async function startManagedBridge({ config, state, bridge, kind, publish }) {
+  state.pid = process.pid;
+  await publish(state);
+  const provider = config.runtime_owner ? await registerDaemonProcess(config, { kind, owner: config.runtime_owner.owner_id, operation: kind }) : null;
+  bridge.options.onSpawn = async child => {
+    await confirmDaemonProcess(config, provider, child);
+    await heartbeatDaemonProcess(config, provider);
+    state.provider_pid = child.pid;
+    state.provider_process = provider;
+    await publish(state);
+  };
+  try { return await bridge.start(); }
+  catch (error) { await cleanupFailedStart(config, provider, bridge.child, error); throw error; }
+}
+
+export async function closeManagedBridge(config, state, bridge) {
+  await bridge.close();
+  await finishDaemonProcess(config, state.provider_process, "stopped", "daemon_stopped");
+}
+
 export async function heartbeatDaemonProcess(config, record) {
   if (!record?.id || !record.lease_token) return;
   let lease = leases.get(record.id);
   if (!lease) {
-    lease = { pending: null, error: null, timer: null, lost: false };
+    lease = { pending: null, error: null, timer: null, lost: false, expiresAt: Date.now() + 300_000, stateDir: config.runtime_owner?.state_dir, config, record };
     leases.set(record.id, lease);
     lease.timer = setInterval(() => { void heartbeatDaemonProcess(config, record).catch(() => {}); }, 60_000);
     lease.timer.unref();
@@ -198,8 +231,9 @@ export async function heartbeatDaemonProcess(config, record) {
         throw Object.assign(new Error("managed process lease is no longer owned; new productive operations are blocked"), { code: "process_lease_lost", details: { process_id: record.id } });
       }
       lease.error = null;
+      lease.expiresAt = Date.now() + 300_000;
     } catch (cause) {
-      lease.error = cause.code === "process_lease_lost" ? cause : Object.assign(new Error("cannot confirm managed process ownership"), { code: "process_ownership_unknown", cause, details: { process_id: record.id } });
+      lease.error = cause.code === "process_lease_lost" ? cause : Object.assign(new Error("cannot confirm managed process ownership"), { code: "process_ownership_unknown", cause, details: { process_id: record.id, cause: errorRecord(cause) } });
       throw lease.error;
     }
   })();

package/dist/harness-runtime/lib/native-hook-command.mjs

@@ -1,31 +1,105 @@
 import { spawn } from "node:child_process";
+import { reportedFailure } from "./process-json.mjs";
+
+/** Native command hooks have a 30s outer limit; leave room for transport and cleanup. */
+export function hookBudget(timeoutMs = 25_000, deadlineAt = null) {
+  const started = performance.now();
+  const duration = Math.max(0, Math.min(timeoutMs, Number.isFinite(deadlineAt) ? deadlineAt - Date.now() : timeoutMs));
+  const remaining = (phase, maximum = duration) => {
+    const value = duration - (performance.now() - started);
+    if (value <= 0) throw Object.assign(new Error(`Native hook deadline exceeded during ${phase}`), { code: "native_hook_timeout", details: { phase, elapsed_ms: Math.round(performance.now() - started), effect: "unknown" } });
+    return Math.max(1, Math.min(maximum, value));
+  };
+  return { deadlineAt: Date.now() + duration, remaining, async run(action, phase) {
+    const timeoutMs = remaining(phase);
+    let timer;
+    try { return await Promise.race([Promise.resolve().then(action), new Promise((_, reject) => { timer = setTimeout(() => reject(Object.assign(new Error(`Native hook deadline exceeded during ${phase}`), { code: "native_hook_timeout", details: { phase, effect: "unknown" } })), timeoutMs); })]); }
+    finally { clearTimeout(timer); }
+  } };
+}
+
+/** Bound native hook ingress before parsing or opening adapter state. */
+export function readNativeHookInput(stream, budget, maxBytes = 1_048_576) {
+  return new Promise((resolve, reject) => {
+    const chunks = []; let bytes = 0, done = false;
+    const cleanup = () => { clearTimeout(timer); stream.off("data", onData); stream.off("end", onEnd); stream.off("error", onError); };
+    const finish = (error, value) => { if (done) return; done = true; cleanup(); if (error) { stream.destroy(); reject(error); } else resolve(value); };
+    const onData = chunk => {
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      bytes += buffer.length;
+      if (bytes > maxBytes) finish(Object.assign(new Error("Native hook input exceeds 1 MiB"), { code: "native_hook_input_too_large" }));
+      else chunks.push(buffer);
+    };
+    const onEnd = () => finish(null, Buffer.concat(chunks).toString("utf8"));
+    const onError = error => finish(error);
+    let timeoutMs;
+    try { timeoutMs = budget.remaining("input"); } catch (error) { reject(error); return; }
+    const timer = setTimeout(() => finish(Object.assign(new Error("Native hook deadline exceeded during input"), { code: "native_hook_timeout", details: { phase: "input", effect: "unknown" } })), timeoutMs);
+    stream.on("data", onData).once("end", onEnd).once("error", onError);
+    stream.resume();
+  });
+}
+
+export async function terminateCommandTree(child, { platform = process.platform, launch = spawn, timeoutMs = 400 } = {}) {
+  if (!child.pid) return;
+  if (platform !== "win32") { process.kill(-child.pid, "SIGKILL"); return; }
+  // Node's child.kill on Windows only terminates the leader. taskkill is the
+  // native subtree primitive; bound its own lifetime as well as the request.
+  await new Promise((resolve, reject) => {
+    const killer = launch("taskkill", ["/PID", String(child.pid), "/T", "/F"], { windowsHide: true, stdio: "ignore" });
+    let settled = false, timer;
+    const finish = error => { if (settled) return; settled = true; clearTimeout(timer); error ? reject(error) : resolve(); };
+    timer = setTimeout(() => { killer.kill("SIGKILL"); killer.unref(); finish(Object.assign(new Error("Windows subtree cleanup timed out"), { code: "process_cleanup_timeout" })); }, timeoutMs);
+    killer.once("error", finish);
+    killer.once("close", code => finish(code === 0 ? null : Object.assign(new Error(`taskkill exited ${code}`), { code: "process_cleanup_failed" })));
+  });
+}
 
 /** Preserve the native hook protocol across the CLI process boundary. */
-export async function invokeNativeHook({ bin, args, payload, home, timeoutMs = 15_000 }) {
+export async function runBoundedCommand({ bin, args, input = null, cwd, env = {}, timeoutMs = 15_000, timeoutCode = "native_hook_timeout" }) {
+  const started = performance.now();
   const script = /\.[cm]?js$/.test(bin);
   const output = await new Promise((resolve, reject) => {
     const child = spawn(script ? process.execPath : bin, [...(script ? [bin] : []), ...args], {
-      env: { ...process.env, DD_FLOW_HOME: home }, stdio: ["pipe", "pipe", "pipe"]
+      cwd, env: { ...process.env, ...env }, detached: process.platform !== "win32", stdio: ["pipe", "pipe", "pipe"]
     });
-    let stdout = "", stderr = "", failure;
-    const stop = error => { failure ??= error; child.kill("SIGKILL"); };
-    const timer = setTimeout(() => stop(Object.assign(new Error("Native hook admission timed out"), { code: "native_hook_timeout" })), timeoutMs);
+    let stdout = "", stderr = "", failure, cleanupTimer, settled = false, termination;
+    const finish = (error, value) => { if (settled) return; settled = true; clearTimeout(timer); clearTimeout(cleanupTimer); error ? reject(error) : resolve(value); };
+    const stop = error => {
+      if (termination || settled) return;
+      failure ??= error;
+      failure.details = { ...failure.details, elapsed_ms: Math.round(performance.now() - started), effect: "unknown" };
+      termination = terminateCommandTree(child).catch(cleanup => {
+        if (cleanup.code === "ESRCH") return;
+        failure.details.cleanup_error = { code: cleanup.code, message: cleanup.message };
+        failure.details.cleanup_unconfirmed = true;
+        child.kill("SIGKILL");
+      });
+      cleanupTimer ??= setTimeout(() => {
+        failure.details.cleanup_unconfirmed = true;
+        child.stdin.destroy(); child.stdout.destroy(); child.stderr.destroy(); child.unref();
+        finish(failure);
+      }, 500);
+    };
+    const timer = setTimeout(() => stop(Object.assign(new Error("Bounded CLI request timed out"), { code: timeoutCode })), timeoutMs);
     child.stdout.setEncoding("utf8").on("data", chunk => { stdout += chunk; if (stdout.length > 1_048_576) stop(new Error("Native hook response exceeds protocol limit")); });
     child.stderr.setEncoding("utf8").on("data", chunk => { stderr = (stderr + chunk).slice(-65_536); });
     child.stdin.on("error", error => { failure ??= error; });
-    child.on("error", error => { clearTimeout(timer); reject(error); });
+    child.on("error", error => finish(failure ?? error));
     child.on("close", code => {
-      clearTimeout(timer);
-      if (failure) return reject(failure);
+      if (failure) { void (termination ?? Promise.resolve()).then(() => finish(failure)); return; }
       if (code !== 0) {
-        let record;
-        try { record = JSON.parse(stderr.trim()).error; } catch { /* Non-JSON stderr remains diagnostic evidence. */ }
-        return reject(Object.assign(new Error(record?.message ?? (stderr.trim() || "Native hook admission failed")), { code: record?.code ?? "native_hook_failed", details: record?.details }));
+        return finish(reportedFailure(stdout, stderr, "Native hook admission failed", "native_hook_failed"));
       }
-      resolve(stdout);
+      finish(null, stdout);
     });
-    child.stdin.end(`${JSON.stringify(payload)}\n`);
+    child.stdin.end(input);
   });
+  return output;
+}
+
+export async function invokeNativeHook({ bin, args, payload, home, cwd, env, timeoutMs = 15_000 }) {
+  const output = await runBoundedCommand({ bin, args, input: `${JSON.stringify(payload)}\n`, cwd, env: { ...env, DD_FLOW_HOME: home }, timeoutMs });
   let result;
   try { result = JSON.parse(output); } catch { throw Object.assign(new Error("Invalid native hook JSON response"), { code: "native_hook_response_invalid" }); }
   if (result?.ok === false && typeof result.error?.code === "string") throw Object.assign(new Error(result.error.message ?? "Native hook failed"), { code: result.error.code, details: result.error.details });

package/dist/harness-runtime/lib/process-json.mjs

@@ -5,17 +5,18 @@ function failure(message, code) {
   return Object.assign(new Error(message), { code });
 }
 
-function reportedFailure(stdout, stderr, fallback) {
+export function reportedFailure(stdout, stderr, fallback, fallbackCode = "flow_reconciliation_failed") {
   for (const text of [stdout, stderr]) {
     for (const line of [text.trim(), ...text.trim().split(/\n/).reverse()]) {
       try {
         const value = JSON.parse(line);
         const error = value?.error;
         if (typeof error?.code === "string" && error.code) return reportedError(error, fallback);
+        if (typeof value?.code === "string" && value.code) return reportedError({ ...value, message: typeof error === "string" ? error : value.message }, fallback);
       } catch { /* Not a structured CLI error line. */ }
     }
   }
-  return failure(stderr.trim() || stdout.trim() || fallback, "flow_reconciliation_failed");
+  return failure(stderr.trim() || stdout.trim() || fallback, fallbackCode);
 }
 
 function processTarget(executable, args) {

package/dist/services/code-checks.js

@@ -1,4 +1,5 @@
 import crypto from "node:crypto";
+import { isGitlessWorkspace, ownedWorkspaceHookPath, projectServicePathFilter, workspaceGitFiles } from "./workspace-files.js";
 import { spawn, spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
@@ -43,6 +44,28 @@ export function readCodeCheckProfile(workspaceRoot) {
             throw new AppError("invalid_code_check_profile", "An input declaration references an unknown alias", 2, { file, alias });
     return { profile: value, hash: crypto.createHash("sha256").update(bytes).digest("hex"), file };
 }
+/**
+ * Planned aliases are qualification-owned extensions: their provider Work is
+ * expected to materialize them after PLAN.  Freeze the project policy and
+ * existing aliases, while still validating every planned alias definition at
+ * execution time.  Unknown edits and changes to existing policy remain part
+ * of the hash and therefore fail closed.
+ */
+export function codeCheckProfileHash(workspaceRoot, checks = []) {
+    const { profile } = readCodeCheckProfile(workspaceRoot);
+    if (!profile)
+        return null;
+    const planned = new Set(checks.filter(check => check.availability === "planned" && check.command.startsWith("@check/")).map(check => check.command));
+    if (!planned.size)
+        return crypto.createHash("sha256").update(JSON.stringify(profile)).digest("hex");
+    const canonical = {
+        ...profile,
+        aliases: Object.fromEntries(Object.entries(profile.aliases).filter(([alias]) => !planned.has(alias))),
+        ports_by_alias: Object.fromEntries(Object.entries(profile.ports_by_alias ?? {}).filter(([alias]) => !planned.has(alias))),
+        inputs_by_alias: Object.fromEntries(Object.entries(profile.inputs_by_alias ?? {}).filter(([alias]) => !planned.has(alias)))
+    };
+    return crypto.createHash("sha256").update(JSON.stringify(canonical)).digest("hex");
+}
 export function validateCodeCheckCommands(workspaceRoot, commands) {
     const { profile, file } = readCodeCheckProfile(workspaceRoot);
     return commands.map((command) => {
@@ -139,7 +162,8 @@ async function runCodeChecksOwned(context, input, workspaceGateId) {
     const generation = assertRunMutationAllowed(context, input.projectId, input.runId);
     for (const check of input.checks)
         validateCheckDeclaration(input.workspaceRoot, check);
-    const { hash: profileHash, profile } = readCodeCheckProfile(input.workspaceRoot);
+    const { profile } = readCodeCheckProfile(input.workspaceRoot);
+    const profileHash = codeCheckProfileHash(input.workspaceRoot, input.checks);
     if (input.expectedProfileHash !== undefined && input.expectedProfileHash !== profileHash)
         throw new AppError("check_profile_drift", "The frozen check profile differs from the workspace profile", 1, { expected_profile_hash: input.expectedProfileHash, actual_profile_hash: profileHash });
     const checks = input.checks.map((check) => { const ports = profile?.ports_by_alias?.[check.command]; const inputs = profile?.inputs_by_alias?.[check.command]; return { ...check, ...(check.ports || !ports ? {} : { ports }), ...(check.inputs || !inputs ? {} : { inputs }) }; });
@@ -239,7 +263,7 @@ async function runCodeChecksOwned(context, input, workspaceGateId) {
         input.progress?.(`check ${index + 1}/${groups.length} ${status}: ${group.command}`);
     }
     if (receipts.every(receipt => receipt.status === "passed")) {
-        const current = workspaceState(input.workspaceRoot, [input.runHome]), { hash: currentProfileHash } = readCodeCheckProfile(input.workspaceRoot);
+        const current = workspaceState(input.workspaceRoot, [input.runHome]), currentProfileHash = codeCheckProfileHash(input.workspaceRoot, input.checks);
         for (const receipt of receipts) {
             const group = groups.find(candidate => candidate.declarations.some(check => receipt.check_refs.includes(checkRef(check))));
             const currentHash = group ? checkInputHash(input.workspaceRoot, group, currentProfileHash, workspaceInputFingerprint(input.workspaceRoot, current.files, group.inputs, [input.runHome])) : null;
@@ -414,7 +438,7 @@ export function workspaceChangedPaths(root) {
     // A workspace can be intentionally gitless. Keep the same conservative
     // file inventory used for fingerprints instead of making result validation
     // fail before the work contract can report its actual error.
-    if (status.status === 128 && /not a git repository|outside a repository/i.test(status.stderr ?? ""))
+    if (isGitlessWorkspace(root, status))
         return listFiles(root);
     if (status.status !== 0 || status.error)
         throw new AppError("workspace_status_failed", "Could not determine changed workspace paths", 1, { workspace_root: root, stderr: status.stderr || null, cause: status.error?.message ?? null });
@@ -434,7 +458,8 @@ export function workspaceChangedPaths(root) {
             paths.push(normalizeWorkspacePath(root, prior));
         }
     }
-    return [...new Set(paths)].sort();
+    const ownedHook = paths.includes(".agents/hooks.json") ? ownedWorkspaceHookPath(root) : null;
+    return [...new Set(paths)].filter(file => file !== ownedHook).sort();
 }
 /** Ignored machine state cannot be reported as a product change. Tracked paths
  * remain eligible regardless of their directory name. */
@@ -443,15 +468,15 @@ export function ignoredWorkspacePaths(root, paths) {
     if (!normalized.length)
         return [];
     const status = spawnSync("git", ["check-ignore", "-z", "--stdin"], { cwd: root, encoding: "utf8", input: `${normalized.join("\0")}\0`, maxBuffer: 64 * 1024 * 1024 });
-    // Projects may intentionally run without Git (the flow supports a local
-    // workspace identity independently from version control). In that case
-    // there is no ignore database to consult; a declared path is a product
-    // path, not an infrastructure path. Other Git failures remain fail-closed.
-    if (status.status === 128 && /not a git repository|outside a repository/i.test(status.stderr ?? ""))
-        return [];
-    if (![0, 1].includes(status.status ?? -1) || status.error)
+    // The canonical owned hook has one meaning across Git status, check cache
+    // and MERGE, without changing a sibling worktree's shared Git excludes.
+    const gitless = isGitlessWorkspace(root, status);
+    if (!gitless && (![0, 1].includes(status.status ?? -1) || status.error))
         throw new AppError("workspace_ignore_check_failed", "Could not classify reported workspace paths", 1, { workspace_root: root, stderr: status.stderr || null, cause: status.error?.message ?? null });
-    return [...new Set(status.stdout.split("\0").filter(Boolean).map((item) => normalizeWorkspacePath(root, item)))].sort();
+    const ownedHook = normalized.includes(".agents/hooks.json") ? ownedWorkspaceHookPath(root, gitless ? [] : undefined) : null;
+    if (gitless)
+        return ownedHook ? [ownedHook] : [];
+    return [...new Set([...status.stdout.split("\0").filter(Boolean).map((item) => normalizeWorkspacePath(root, item)), ...(ownedHook ? [ownedHook] : [])])].sort();
 }
 export function normalizeWorkspacePath(root, value) {
     if (typeof value !== "string" || !value || value.includes("\0") || path.isAbsolute(value))
@@ -480,11 +505,14 @@ function deduplicate(checks, commands) {
     return [...groups.values()].map(group => ({ ...group, gate: [...group.declarations].map(check => check.run_at).sort()[0], declarations: [...group.declarations].sort((left, right) => checkRef(left).localeCompare(checkRef(right))) }));
 }
 function workspaceState(root, ignoredRoots = []) {
-    const git = spawnSync("git", ["ls-files", "-co", "--exclude-standard", "-z"], { cwd: root, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+    const git = workspaceGitFiles(root, ["-co", "--exclude-standard"]);
     const ignored = ignoredRoots.map(entry => path.resolve(entry));
-    const listing = [...new Set(git.status === 0 ? git.stdout.split("\0").filter(Boolean) : listFiles(root))].sort();
+    const listing = [...new Set(git ?? listFiles(root))].sort();
+    const ownedHook = listing.includes(".agents/hooks.json") ? ownedWorkspaceHookPath(root, git ? undefined : []) : null;
     const files = new Map(), hash = crypto.createHash("sha256");
     for (const relative of listing) {
+        if (relative === ownedHook)
+            continue;
         const file = path.resolve(root, relative);
         if (ignored.some(ignoredRoot => file === ignoredRoot || file.startsWith(`${ignoredRoot}${path.sep}`)))
             continue;
@@ -677,8 +705,17 @@ function collectCheckArtifacts(root, required) {
     const missing = required.filter((relative) => !retained.has(path.normalize(relative)));
     return { complete: missing.length === 0, missing, items };
 }
-function listFiles(root, current = root) { return fs.readdirSync(current, { withFileTypes: true }).flatMap((entry) => { if ([".git", "node_modules"].includes(entry.name))
-    return []; const absolute = path.join(current, entry.name); return entry.isDirectory() ? listFiles(root, absolute) : [path.relative(root, absolute)]; }).sort(); }
+function listFiles(root) {
+    const allowed = projectServicePathFilter(root, [], []);
+    const ownedHook = ownedWorkspaceHookPath(root, []);
+    const visit = (current) => fs.readdirSync(current, { withFileTypes: true }).flatMap(entry => {
+        const absolute = path.join(current, entry.name);
+        if ([".git", "node_modules"].includes(entry.name) || !allowed(absolute))
+            return [];
+        return entry.isDirectory() ? visit(absolute) : [path.relative(root, absolute)];
+    });
+    return visit(root).filter(file => file.split(path.sep).join("/") !== ownedHook).sort();
+}
 export function runCheck(command, cwd, environment, stdout, stderr, heartbeat, onSpawn, renewLease) {
     return new Promise((resolve) => {
         const started = Date.now();