@deksden-com/dd-flow-cli 0.9.0-beta.100 → 0.9.0-beta.104

package/dist/services/work-registry.js

@@ -22,6 +22,7 @@ import { publicSessionIdentity } from "./session-identity.js";
 import { activateRecoveryWork, assertRecoveryHookCurrent, assertRunMutationAllowed, assertWorkSettlementAllowed, recoveryGuard, recoveryPromptForWork, settleRecoveryWork } from "./run-recovery.js";
 import { runControlDirective } from "./run-control.js";
 import { prepareError, prepareJsonFile } from "../cli/input-preparation.js";
+import { reviewEnvironmentAllowed, reviewExecutionCopyHash, reviewSourceHash, reviewSourcePaths } from "./review-copy.js";
 const workColumns = "work_id, project_id, run_id, parent_work_id, task, launch_policy, result_schema, payload_json, depends_on_json, status, result, created_at, started_at, updated_at, completed_at";
 export function ensureWorkRegistry(context) { context.db.exec("SELECT 1 FROM works LIMIT 1"); context.db.exec("SELECT 1 FROM work_sessions LIMIT 1"); }
 function ownsPhysicalWorkSession(context, projectId, owner, identity) {
@@ -403,6 +404,8 @@ export function assertWorkLaunchReady(context, id) {
         const ready = context.db.all(`SELECT ${workColumns} FROM works WHERE project_id = ? AND run_id = ? AND status = 'created' ORDER BY created_at, work_id`, [work.project_id, work.run_id]).filter((candidate) => currentStageWorkIds(context, candidate.project_id, candidate.run_id)?.has(candidate.work_id) !== false && isReady(context, candidate)).map((candidate) => ({ work_id: candidate.work_id, start_command: workStartCommand(context, candidate) }));
         throw new AppError("work_not_ready", "Work cannot start until dependencies complete and overlapping planned coordination areas are free", 2, { work_id: id, blockers, ready });
     }
+    if (parsePayload(work)?.read_only === true)
+        assertSharedReviewInput(context, work, requireRun(context, work.project_id, work.run_id));
     return work;
 }
 export function startWork(context, id, input) {
@@ -531,6 +534,9 @@ export function startBoundWork(context, work, run, claimIdentity, hookEventId, s
     const promptPath = path.join(packetDirectory, "prompt.md"), resultPath = path.join(directory, "result.json");
     // The first reviewer freezes shared inputs in the same transaction as its claim.
     const readOnly = parsePayload(work)?.read_only === true;
+    const workerRun = readOnly && context.env.DD_FLOW_READ_ONLY_WORKSPACE
+        ? { ...run, workspace_root: path.resolve(context.env.DD_FLOW_READ_ONLY_WORKSPACE) }
+        : run;
     let fingerprint;
     let binding;
     try {
@@ -547,14 +553,21 @@ export function startBoundWork(context, work, run, claimIdentity, hookEventId, s
                 throw new AppError("work_retry_incomplete", "Complete the interrupted Work retry before starting its next attempt", 1, { work_id: work.work_id });
             const identity = claimIdentity();
             assertRecoveryHookCurrent(context, current.project_id, current.run_id, identity);
+            if (readOnly && !context.env.DD_FLOW_READ_ONLY_WORKSPACE
+                && context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'work_launches'")
+                && context.db.get("SELECT 1 FROM work_launches WHERE work_id = ? AND status IN ('launching','start_requested')", [current.work_id]))
+                throw new AppError("read_only_workspace_unbound", "External reviewer did not inherit its qualified execution workspace", 1, { work_id: current.work_id });
+            const reviewInput = readOnly ? assertSharedReviewInput(context, current, run, generation) : null;
+            const reviewPaths = reviewInput?.run_inputs.filter(item => item.root === "workspace").map(item => item.path) ?? [];
+            const reviewCopy = readOnly && context.env.DD_FLOW_READ_ONLY_WORKSPACE ? boundReviewCopy(context, current, run, identity, context.env.DD_FLOW_READ_ONLY_WORKSPACE, reviewPaths) : null;
             const dependencyResults = parseDependencies(current).map(dependency => context.db.get("SELECT work_id, result FROM works WHERE work_id = ?", [dependency])).filter(Boolean);
             const recovery = recoveryPromptForWork(context, current.work_id);
-            let prompt = renderWorkerPrompt(context, current, run, dependencyResults);
+            let prompt = renderWorkerPrompt(context, current, workerRun, dependencyResults);
             if (recovery)
                 prompt = `${recoveryPrompt(recovery)}\n\n${prompt}`;
             if (readOnly)
-                fingerprint = sharedReviewInput(work, run, true) ?? workspaceFingerprint(run.workspace_root);
-            const workContext = { schema_id: "dd-flow/work-context@1", run_id: current.run_id, work_id: current.work_id, parent_work_id: current.parent_work_id, project_root: run.project_root, workspace_root: run.workspace_root, run_root: requireRunHome(run), depends_on: parseDependencies(current), launch_policy: current.launch_policy, result_schema: current.result_schema, read_only: readOnly, ...(recovery ? { recovery } : {}), ...(readOnly ? { workspace_fingerprint: fingerprint } : {}) };
+                fingerprint = reviewInput?.source_sha256 ?? reviewInput?.workspace_fingerprint ?? legacyReviewFingerprint(current, run) ?? workspaceFingerprint(run.workspace_root);
+            const workContext = { schema_id: "dd-flow/work-context@1", run_id: current.run_id, work_id: current.work_id, parent_work_id: current.parent_work_id, project_root: run.project_root, workspace_root: workerRun.workspace_root, run_root: requireRunHome(run), depends_on: parseDependencies(current), launch_policy: current.launch_policy, result_schema: current.result_schema, read_only: readOnly, ...(recovery ? { recovery } : {}), ...(readOnly ? { workspace_fingerprint: fingerprint, ...(reviewInput ? { review_input: reviewInput } : {}), ...(reviewCopy ? { review_copy: reviewCopy } : {}) } : {}) };
             const contextBytes = `${JSON.stringify(workContext, null, 2)}\n`;
             const response = { ok: true, work_id: current.work_id, work_session_id: linkId, worker_prompt_markdown: prompt, prompt_path: promptPath, ...(recovery ? { recovery } : {}), session_binding: { source: "PreToolUse", session: { harness_id: identity.harness, session_id: identity.nativeSessionId } } };
             const receipt = JSON.stringify({ version: 1, prompt, context: contextBytes, prompt_sha256: sha256(prompt), context_sha256: sha256(contextBytes), response, response_sha256: sha256(JSON.stringify(response)), generation, invocation_id: context.env.DD_FLOW_CURRENT_INVOCATION ?? null });
@@ -756,7 +769,82 @@ export function retryWork(context, id, reason) {
     refreshRunWorkProjection(context, work.project_id, work.run_id);
     return { ok: true, work_id: work.work_id, archived_attempt: path.relative(requireRunHome(run), archive).split(path.sep).join("/"), reason };
 }
-function sharedReviewInput(work, run, initialize = false) {
+export function reviewSourceInputs(context, workId) {
+    const work = requireWork(context, workId);
+    const input = assertSharedReviewInput(context, work, requireRun(context, work.project_id, work.run_id));
+    return input?.run_inputs.filter(item => item.root === "workspace").map(item => item.path) ?? [];
+}
+function reviewInputPath(root, relative) {
+    const resolved = path.resolve(root, relative);
+    const inside = path.relative(root, resolved);
+    if (!relative || path.isAbsolute(relative) || inside === ".." || inside.startsWith(`..${path.sep}`))
+        throw new AppError("review_input_invalid", "Review input path escapes its declared root", 1, { path: relative });
+    if (fs.existsSync(resolved)) {
+        const canonicalInside = path.relative(fs.realpathSync(root), fs.realpathSync(resolved));
+        if (canonicalInside === ".." || canonicalInside.startsWith(`..${path.sep}`))
+            throw new AppError("review_input_invalid", "Review input symlink escapes its declared root", 1, { path: relative });
+    }
+    return resolved;
+}
+function boundReviewCopy(context, work, run, identity, requested, reviewPaths) {
+    const launch = context.db.get("SELECT provider_session_id, profile_json FROM work_launches WHERE work_id = ? AND status IN ('launching','start_requested')", [work.work_id]);
+    const metadata = launch ? JSON.parse(launch.profile_json) : null;
+    const copy = metadata?.review_copy;
+    if (!copy?.root || !copy.sha256 || !copy.source_sha256 || launch?.provider_session_id !== identity.providerSessionId)
+        throw new AppError("read_only_workspace_unbound", "Read-only execution copy has no matching trusted launch", 1, { work_id: work.work_id });
+    const expected = reviewInputPath(requireRunHome(run), copy.root);
+    if (path.resolve(requested) !== expected)
+        throw new AppError("read_only_workspace_unbound", "Read-only execution path differs from the trusted launch", 1, { work_id: work.work_id });
+    const base = reviewWorkspaceBase(context, work);
+    if (reviewSourceHash(run.workspace_root, reviewPaths, base) !== copy.source_sha256)
+        throw new AppError("read_only_input_changed", "Authoritative review workspace changed after the execution copy was made", 2, { work_id: work.work_id });
+    const actual = reviewExecutionCopyHash(expected, run.workspace_root, true, reviewPaths, base);
+    if (actual !== copy.sha256)
+        throw new AppError("read_only_input_changed", "Read-only execution copy changed before Work start", 2, { work_id: work.work_id, expected: copy.sha256, current: actual });
+    return { root: copy.root, sha256: copy.sha256, source_sha256: copy.source_sha256 };
+}
+function assertReviewCopyUnchanged(context, work, run, link) {
+    if (!link)
+        return;
+    const row = context.db.get("SELECT start_receipt_json FROM work_sessions WHERE id = ?", [link.id]);
+    const external = context.db.get("SELECT 1 FROM sqlite_schema WHERE type = 'table' AND name = 'work_launches'")
+        ? context.db.get("SELECT 1 FROM work_launches WHERE work_id = ? LIMIT 1", [work.work_id]) : null;
+    if (!row?.start_receipt_json) {
+        if (external)
+            throw new AppError("read_only_workspace_unbound", "External review has no committed start receipt", 1, { work_id: work.work_id });
+        return;
+    }
+    let copy;
+    let reviewPaths = [];
+    try {
+        const receipt = JSON.parse(row.start_receipt_json);
+        const retained = receipt.context ? JSON.parse(receipt.context) : null;
+        copy = retained?.review_copy;
+        reviewPaths = retained?.review_input?.run_inputs.filter(item => item.root === "workspace").map(item => item.path) ?? [];
+    }
+    catch {
+        throw new AppError("read_only_workspace_unbound", "Review start receipt is malformed", 1, { work_id: work.work_id });
+    }
+    if (!copy) {
+        if (external)
+            throw new AppError("read_only_workspace_unbound", "External review start receipt has no copy binding", 1, { work_id: work.work_id });
+        return;
+    }
+    if (!copy.root || !copy.sha256)
+        throw new AppError("read_only_workspace_unbound", "Review copy receipt is incomplete", 1, { work_id: work.work_id });
+    const base = reviewWorkspaceBase(context, work);
+    const actual = reviewExecutionCopyHash(reviewInputPath(requireRunHome(run), copy.root), run.workspace_root, true, reviewPaths, base);
+    if (actual !== copy.sha256)
+        throw new AppError("read_only_input_changed", "Read-only execution copy changed during review", 2, { work_id: work.work_id, expected: copy.sha256, current: actual });
+    if (copy.source_sha256 && reviewSourceHash(run.workspace_root, reviewPaths, base) !== copy.source_sha256)
+        throw new AppError("read_only_input_changed", "Authoritative review workspace changed during review", 2, { work_id: work.work_id });
+}
+function reviewWorkspaceBase(context, work) {
+    const row = context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [work.project_id, work.run_id]);
+    const base = row && JSON.parse(row.index_json).workspace?.base;
+    return base && base !== "unknown" ? base : "HEAD";
+}
+function legacyReviewFingerprint(work, run) {
     const kind = parsePayload(work)?.kind;
     const relative = kind === "code-review" ? "06-code-review/review-context.json" : kind === "plan-review" ? "04-plan-review/work-context.json" : null;
     if (!relative || !work.parent_work_id)
@@ -765,17 +853,106 @@ function sharedReviewInput(work, run, initialize = false) {
     if (!fs.existsSync(file))
         return null;
     const value = JSON.parse(fs.readFileSync(file, "utf8"));
-    if (value.read_only_input?.parent_work_id !== work.parent_work_id)
+    return value.read_only_input?.version !== 2 && value.read_only_input?.parent_work_id === work.parent_work_id && typeof value.read_only_input.fingerprint === "string" ? value.read_only_input.fingerprint : null;
+}
+function assertSharedReviewInput(context, work, run, generation = recoveryGuard(context, work.project_id, work.run_id)?.generation ?? 0) {
+    const payload = parsePayload(work), kind = payload?.kind;
+    const relative = kind === "code-review" ? "06-code-review/review-context.json" : kind === "plan-review" ? "04-plan-review/work-context.json" : null;
+    if (!relative || !work.parent_work_id)
         return null;
-    if (!value.read_only_input.fingerprint && initialize) {
-        // Called under the Work-start writer reservation, after stage setup has
-        // finished. The first reviewer accepts the input shared by this group.
-        value.read_only_input.fingerprint = workspaceFingerprint(run.workspace_root);
-        const temporary = `${file}.tmp-${crypto.randomUUID()}`;
-        fs.writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`);
-        fs.renameSync(temporary, file);
+    const home = requireRunHome(run), file = path.join(home, relative);
+    if (!fs.existsSync(file))
+        throw new AppError("review_input_missing", "The review stage context is missing", 1, { work_id: work.work_id, file: relative });
+    const value = JSON.parse(fs.readFileSync(file, "utf8"));
+    if (value.read_only_input?.parent_work_id !== work.parent_work_id)
+        throw new AppError("review_input_invalid", "Reviewer belongs to a different review group", 1, { work_id: work.work_id, parent_work_id: work.parent_work_id });
+    const index = JSON.parse(context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [work.project_id, work.run_id]).index_json);
+    const stage = (name) => index.stage_runs?.find(item => item.stage === name);
+    if (value.read_only_input.version !== 2 && value.read_only_input.version !== 3) {
+        if (stage(kind === "plan-review" ? "plan" : "code")?.data_sha256)
+            throw new AppError("review_input_contract_missing", "A new review run cannot downgrade its input contract", 1, { work_id: work.work_id });
+        return null; // Historical receipts retain their original fingerprint contract.
     }
-    return typeof value.read_only_input.fingerprint === "string" ? value.read_only_input.fingerprint : null;
+    const expected = new Map();
+    const add = (root, relativePath, sha) => {
+        if (!/^[a-f0-9]{64}$/.test(sha))
+            throw new AppError("review_input_invalid", "Review input lacks an accepted checksum", 1, { path: relativePath });
+        reviewInputPath(root === "run" ? home : run.workspace_root, relativePath);
+        const key = `${root}:${relativePath}`;
+        if (expected.has(key) && expected.get(key) !== sha)
+            throw new AppError("review_input_invalid", "Review input has conflicting accepted checksums", 1, { path: relativePath });
+        expected.set(key, sha);
+    };
+    const stageReport = (name, relativePath) => {
+        const sha = stage(name)?.data_sha256;
+        if (!sha)
+            throw new AppError("review_input_contract_missing", "Accepted stage report has no committed checksum", 1, { stage: name });
+        add("run", relativePath, sha);
+        const reportFile = reviewInputPath(home, relativePath);
+        if (!fs.existsSync(reportFile) || sha256(fs.readFileSync(reportFile, "utf8")) !== sha)
+            throw new AppError("read_only_input_changed", "Accepted stage report changed before or during review", 2, { path: relativePath, expected: sha });
+        return JSON.parse(fs.readFileSync(reportFile, "utf8"));
+    };
+    if (kind === "plan-review") {
+        const accepted = stageReport("plan", "03-plan/stage-report.json").semantic;
+        if (!accepted?.plan_checksums?.length || !accepted.aspect_map_checksums?.length || !accepted.batch_checksum)
+            throw new AppError("review_input_contract_missing", "Accepted PLAN lacks exact review input checksums", 1);
+        for (const item of accepted.plan_checksums)
+            add("workspace", item.path, item.sha256);
+        for (const item of accepted.aspect_map_checksums)
+            add("run", item.path, item.sha256);
+        add("run", "03-plan/code-work-batch.json", accepted.batch_checksum);
+        if (value.system?.batch_checksum !== accepted.batch_checksum)
+            throw new AppError("read_only_input_changed", "PLAN-REVIEW batch differs from accepted PLAN", 2);
+        const planSet = accepted.plan_checksums.map(item => ({ protocol_id: path.basename(path.dirname(item.path)), path: item.path, sha256: item.sha256 })).sort((a, b) => a.protocol_id.localeCompare(b.protocol_id));
+        if (value.system?.plan_checksum !== sha256(JSON.stringify(planSet)))
+            throw new AppError("read_only_input_changed", "PLAN-REVIEW plan revision differs from accepted PLAN", 2);
+    }
+    else {
+        stageReport("code", "05-code/stage-report.json");
+        if (value.code_report_sha256 !== stage("code")?.data_sha256 || !stage("code-review")?.input_sha256 || !value.review_batch_sha256 || !Array.isArray(value.aspect_map_checksums) || !value.aspect_map_checksums.length
+            || sha256(JSON.stringify({ batch: value.review_batch_sha256, aspect_maps: value.aspect_map_checksums })) !== stage("code-review")?.input_sha256)
+            throw new AppError("review_input_contract_missing", "CODE-REVIEW inputs are not bound to their accepted stage", 1);
+        add("run", "06-code-review/review-work-batch.json", value.review_batch_sha256);
+        for (const item of value.aspect_map_checksums)
+            add("run", item.path, item.sha256);
+        if (value.cycle !== payload?.review_cycle)
+            throw new AppError("review_input_invalid", "CODE-REVIEW cycle differs from its Work", 1);
+    }
+    const runInputs = [...expected].map(([key, sha]) => { const [root, ...parts] = key.split(":"); return { root: root, path: parts.join(":"), sha256: sha }; }).sort((a, b) => `${a.root}:${a.path}`.localeCompare(`${b.root}:${b.path}`));
+    for (const item of runInputs) {
+        const target = reviewInputPath(item.root === "run" ? home : run.workspace_root, item.path);
+        const actual = fs.existsSync(target) ? sha256(fs.readFileSync(target, "utf8")) : null;
+        if (actual !== item.sha256)
+            throw new AppError("read_only_input_changed", "Accepted review input changed", 2, { work_id: work.work_id, root: item.root, path: item.path, expected: item.sha256, current: actual });
+    }
+    const reviewPaths = runInputs.filter(item => item.root === "workspace").map(item => item.path);
+    if (value.read_only_input.version === 3)
+        for (const relative of reviewPaths) {
+            if (!reviewEnvironmentAllowed(relative))
+                throw new AppError("review_input_invalid", "Required review input is excluded from external review", 1, { path: relative });
+        }
+    const base = index.workspace?.base && index.workspace.base !== "unknown" ? index.workspace.base : "HEAD";
+    const selectedPaths = value.read_only_input.version === 3 ? reviewSourcePaths(run.workspace_root, reviewPaths, base) : null;
+    if (selectedPaths && reviewPaths.some(relative => !selectedPaths.includes(relative)))
+        throw new AppError("review_input_invalid", "Required review input is excluded from external review", 1, { work_id: work.work_id });
+    const selectedSource = value.read_only_input.version === 3 ? reviewSourceHash(run.workspace_root, reviewPaths, base) : null;
+    const current = { schema_id: value.read_only_input.version === 3 ? "dd-flow/review-input@3" : "dd-flow/review-input@2", parent_work_id: work.parent_work_id, kind: String(kind), cycle: kind === "code-review" ? String(payload?.review_cycle) : "initial", generation, workspace_fingerprint: selectedSource ?? workspaceFingerprint(run.workspace_root), ...(selectedSource ? { source_policy: "review-inputs@1", source_sha256: selectedSource } : {}), run_inputs: runInputs };
+    const committed = context.db.all("SELECT ws.start_receipt_json FROM work_sessions ws JOIN works w ON w.work_id = ws.work_id WHERE w.project_id = ? AND w.run_id = ? AND w.parent_work_id = ? AND json_extract(w.payload_json, '$.kind') = ? AND ws.start_receipt_json IS NOT NULL ORDER BY ws.created_at, ws.id", [work.project_id, work.run_id, work.parent_work_id, kind]);
+    for (const row of committed) {
+        const receipt = JSON.parse(row.start_receipt_json);
+        if (!receipt.context)
+            continue;
+        const prior = JSON.parse(receipt.context).review_input;
+        if (!prior || prior.cycle !== current.cycle)
+            continue;
+        // Recovery changes the execution owner, not the review revision. A
+        // completed sibling from an older generation still pins this review cycle.
+        if (prior.schema_id !== current.schema_id || JSON.stringify({ ...prior, generation }) !== JSON.stringify(current))
+            throw new AppError("read_only_input_changed", "Reviewer inputs differ from the first committed review start", 2, { work_id: work.work_id, baseline: prior, current });
+        break;
+    }
+    return current;
 }
 async function settle(context, id, status, result, progress, retry) {
     const { work, run, link } = prepareWorkSettlement(context, id, status, result);
@@ -784,13 +961,17 @@ async function settle(context, id, status, result, progress, retry) {
     let coordinationDrift = [];
     const assertReadOnlyInput = () => {
         if (status === "completed" && parsePayload(work)?.read_only === true) {
-            const shared = sharedReviewInput(work, run);
+            assertReviewCopyUnchanged(context, work, run, link);
+            const shared = assertSharedReviewInput(context, work, run);
+            if (shared)
+                return;
+            const legacy = legacyReviewFingerprint(work, run);
             // The final reviewer commits the shared input boundary under the writer
             // reservation. Concurrent finishes cannot both skip this verification.
-            if (shared && context.db.get("SELECT 1 FROM works WHERE project_id = ? AND run_id = ? AND parent_work_id = ? AND work_id <> ? AND status IN ('created','running','paused') AND json_extract(payload_json, '$.read_only') = 1 AND json_extract(payload_json, '$.kind') = ? LIMIT 1", [work.project_id, work.run_id, work.parent_work_id, work.work_id, parsePayload(work)?.kind]))
+            if (legacy && context.db.get("SELECT 1 FROM works WHERE project_id = ? AND run_id = ? AND parent_work_id = ? AND work_id <> ? AND status IN ('created','running','paused') AND json_extract(payload_json, '$.read_only') = 1 AND json_extract(payload_json, '$.kind') = ? LIMIT 1", [work.project_id, work.run_id, work.parent_work_id, work.work_id, parsePayload(work)?.kind]))
                 return;
             const contextFile = link ? path.join(path.dirname(link.prompt_path), "context.json") : "";
-            const baseline = shared ?? (contextFile && fs.existsSync(contextFile) ? JSON.parse(fs.readFileSync(contextFile, "utf8")).workspace_fingerprint : null);
+            const baseline = legacy ?? (contextFile && fs.existsSync(contextFile) ? JSON.parse(fs.readFileSync(contextFile, "utf8")).workspace_fingerprint : null);
             const current = workspaceFingerprint(run.workspace_root);
             if (typeof baseline !== "string" || baseline !== current)
                 throw new AppError("read_only_input_changed", "The workspace changed during read-only Work; its review input is stale (the writer is unknown)", 2, { work_id: work.work_id, baseline, current });
@@ -986,16 +1167,21 @@ export function validateReviewResolutions(workId, assigned, resolutions) {
 function renderWorkerPrompt(context, work, run, dependencies) {
     const command = flowCommand(context);
     const packet = codePacket(work);
+    const readOnly = parsePayload(work)?.read_only === true;
     const resultInputPath = path.join(requireRunHome(run), "works", work.work_id, "result-input.json");
     const finishWorkCommand = managedLifecycleCommand(context, runtimeCommand(context, ["work", "finish", work.work_id, "--result-file", resultInputPath, "--project-root", run.project_root, "--json", "--progress-jsonl"]));
     const failWorkCommand = managedLifecycleCommand(context, runtimeCommand(context, ["work", "fail", shortWorkId(work.work_id), "--reason", "receipt path + exact external or semantic blocker", "--project-root", run.project_root, "--json"]));
     const mergeWork = parsePayload(work)?.kind === "merge";
-    const writeBoundary = mergeWork
-        ? ["MERGE does not own product-code repair. Use only the stage packet's merge apply command; resolve only paths that Git reports as unmerged. Do not edit integration code, tests, documentation or configuration to make a gate pass.", "RUN artifacts are read-only evidence: refer to them with run:// URIs and let dd-flow persist your submitted result."]
-        : [`HARD RULE: project source reads and writes must remain under ${run.workspace_root}.`, "Do not write through project_root, outside workspace_root, into another RUN, or into Git/worktree control data. Do not create, switch, merge or delete branches/worktrees.", "RUN artifacts are read-only evidence: refer to them with run:// URIs and let dd-flow persist your submitted result. Accepted requirements, non-goals and stop_conditions are semantic hard boundaries. planned_write_areas is not."];
-    const completionRepair = mergeWork
-        ? ["A failed integration check is evidence for a source-repair cycle, not permission to repair the integration workspace. Follow the exact merge repair command returned by dd-flow."]
-        : ["Read the failed receipt and its stdout/stderr. Fix project-owned source, migration, test, formatting, or configuration errors in this same Work, then use the returned retry_command with your result. Internal invocation IDs are runtime-owned; do not copy or invent them. Do not invent a cause that does not appear in the retained output."];
+    const writeBoundary = readOnly
+        ? [`Review inputs under workspace_root (${run.workspace_root}) and run_home are read-only. After Work start, work from workspace_root and do not edit project source, PLAN, aspect maps, CODE evidence, or another Work's files.`, "Do not write inside workspace_root, including an isolated review copy. Write only this Work's declared result-input.json and explicitly assigned Work-owned evidence paths under run_home. Report changed or inaccessible review inputs as a blocker; do not repair them."]
+        : mergeWork
+            ? ["MERGE does not own product-code repair. Use only the stage packet's merge apply command; resolve only paths that Git reports as unmerged. Do not edit integration code, tests, documentation or configuration to make a gate pass.", "RUN artifacts are read-only evidence: refer to them with run:// URIs and let dd-flow persist your submitted result."]
+            : [`HARD RULE: project source reads and writes must remain under ${run.workspace_root}.`, "Do not write through project_root, outside workspace_root, into another RUN, or into Git/worktree control data. Do not create, switch, merge or delete branches/worktrees.", "RUN artifacts are read-only evidence: refer to them with run:// URIs and let dd-flow persist your submitted result. Accepted requirements, non-goals and stop_conditions are semantic hard boundaries. planned_write_areas is not."];
+    const completionRepair = readOnly
+        ? ["If Finish reports input drift or an infrastructure failure, report the exact receipt and stop. Do not change the reviewed files to make the check pass."]
+        : mergeWork
+            ? ["A failed integration check is evidence for a source-repair cycle, not permission to repair the integration workspace. Follow the exact merge repair command returned by dd-flow."]
+            : ["Read the failed receipt and its stdout/stderr. Fix project-owned source, migration, test, formatting, or configuration errors in this same Work, then use the returned retry_command with your result. Internal invocation IDs are runtime-owned; do not copy or invent them. Do not invent a cause that does not appear in the retained output."];
     const codeContext = packet ? ["<semantic_spine>", JSON.stringify(packet.semantic_spine, null, 2), "</semantic_spine>", "", ...(packet.repair ? ["<repair_context>", JSON.stringify(packet.repair, null, 2), "Read the failed receipt and its linked stdout/stderr before editing. Preserve the accepted origin context and fix only the evidenced failure.", "</repair_context>", ""] : []), "<accepted_requirements>", JSON.stringify(packet.requirements, null, 2), "</accepted_requirements>", "", "<write_boundary_invariant>", "For a mutation guarded by membership, ownership, authorization or parent lifecycle state, preserve that predicate in the write statement or make guard and write one explicit transaction with the needed lock. A prior read may diagnose an error but never proves a later write remains allowed. Apply this to create, update, delete and parent-state mutations.", "</write_boundary_invariant>", "", "<acceptance_context>", "The criteria below are end-to-end context. Complete this Work's semantic contribution and declared checks; another ordered Work may own a different acceptance surface.", JSON.stringify(packet.acceptance, null, 2), "</acceptance_context>", "", "<required_read>", "These are mandatory starting sources, not a read allowlist. Read any additional project files needed to implement the Work correctly.", ...packet.required_read.map((item) => `- ${resolveRunReferences(item, work.run_id, requireRunHome(run))}`), "</required_read>", "", "<discovery_boundary>", "These are likely discovery areas, not a hard boundary. Expand project-local investigation when required and report material additions.", ...packet.discovery_boundary.map((item) => `- ${item}`), "</discovery_boundary>", "", "<planned_write_areas>", "SOFT COORDINATION HINT ONLY. These paths help the coordinator avoid concurrent collisions. They do not grant or deny write permission and do not limit the files needed for this Work. You may create or change any project file under workspace_root that is necessary and in semantic scope; report every actual changed path.", ...(packet.planned_write_areas.length ? packet.planned_write_areas.map((item) => `- ${item}`) : ["- none predicted; derive the necessary files from the task"]), "</planned_write_areas>", "", ...(packet.provides_checks.length ? ["<provided_checks>", ...packet.provides_checks.map((item) => `- ${item.id}: materialize ${item.command}${item.definition ? ` as ${item.definition}` : ""}; it is not usable until this Work finishes.`), "Update the declared project command or alias before Work finish. The CLI verifies materialization at Work finish. Execution occurs at its declared run_at gate, not necessarily in this Work.", "</provided_checks>", ""] : []), "<verification>", ...packet.checks.map((item) => `- ${item.id} at ${item.run_at}: ${item.command} — ${item.purpose}`), "The CLI executes work-scoped checks and retains their receipts. Report semantic evidence only; do not rerun declared checks manually.", "</verification>", "", "<stop_conditions>", ...packet.stop_conditions.map((item) => `- ${item}`), "</stop_conditions>", ""] : [];
     if (packet)
         codeContext.push("<document_updates>", JSON.stringify(packet.document_updates, null, 2), "Materialize every listed update. dd-flow verifies the resulting file against its PLAN-time baseline.", "</document_updates>", "", "<completion_contract>", "Successful completion requires empty deviations and blockers and every assigned document update in changed_paths. A necessary path outside planned_write_areas is normal coordination drift, not a blocker; include it in changed_paths and continue.", "</completion_contract>", "");

package/dist/services/workspace-files.js

@@ -0,0 +1,83 @@
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { isDeepStrictEqual } from "node:util";
+import { AppError } from "../shared/errors.js";
+import { agyWorkspaceHooks } from "../harness-runtime/lib/agy-hooks.mjs";
+/** Local environment/credential files are never an exported reviewer or EVAL input. */
+export function localEnvironmentAllowed(source) {
+    const name = path.basename(source);
+    return name === ".env.example" || (name !== ".env" && !name.startsWith(".env."));
+}
+/** A damaged/inaccessible repository is not an intentional gitless workspace. */
+export function isGitlessWorkspace(root, result) {
+    if (result.error || result.status !== 128 || !/not a git repository|outside a repository/i.test(result.stderr ?? ""))
+        return false;
+    for (let directory = path.resolve(root);; directory = path.dirname(directory)) {
+        try {
+            fs.lstatSync(path.join(directory, ".git"));
+            return false;
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                return false;
+        }
+        if (path.dirname(directory) === directory)
+            return true;
+    }
+}
+export function workspaceGitFiles(root, args) {
+    const result = spawnSync("git", ["ls-files", "-z", ...args], { cwd: root, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+    if (isGitlessWorkspace(root, result))
+        return null;
+    if (result.status !== 0 || result.error)
+        throw new AppError("workspace_status_failed", "Could not determine workspace file inventory", 1, { workspace_root: root, stderr: result.stderr || null, cause: result.error?.message ?? null });
+    return [...new Set(result.stdout.split("\0").filter(Boolean))];
+}
+/** The exact qualified AGY file is infrastructure only while untracked.
+ * Never write a shared worktree exclude: that would hide a sibling's mixed
+ * user hooks. Snapshots still retain this qualification input. */
+export function ownedWorkspaceHookPath(root, trackedFiles) {
+    const relative = ".agents/hooks.json", file = path.join(root, relative);
+    try {
+        if (!fs.lstatSync(path.dirname(file)).isDirectory() || !fs.lstatSync(file).isFile() || !isDeepStrictEqual(JSON.parse(fs.readFileSync(file, "utf8")), agyWorkspaceHooks()))
+            return null;
+    }
+    catch (error) {
+        if (error.code === "ENOENT" || error instanceof SyntaxError)
+            return null;
+        throw error;
+    }
+    const tracked = trackedFiles ?? workspaceGitFiles(root, ["--cached", "--", relative]) ?? [];
+    return tracked.includes(relative) ? null : relative;
+}
+/** New feature worktrees do not inherit untracked qualified hooks via Git. */
+export function propagateOwnedWorkspaceHooks(sourceRoot, targetRoot) {
+    const relative = ownedWorkspaceHookPath(sourceRoot);
+    if (!relative || path.resolve(sourceRoot) === path.resolve(targetRoot))
+        return null;
+    const target = path.join(targetRoot, relative), directory = path.dirname(target);
+    if (fs.lstatSync(target, { throwIfNoEntry: false }))
+        return null; // User/tracked target wins; daemon checks qualification.
+    if (workspaceGitFiles(targetRoot, ["--cached", "--", relative])?.includes(relative))
+        return null;
+    if (fs.lstatSync(directory, { throwIfNoEntry: false }) && !fs.lstatSync(directory).isDirectory())
+        throw new AppError("workspace_hooks_unqualified", "AGY hook directory is not an owned directory", 1, { path: directory });
+    fs.mkdirSync(directory, { recursive: true });
+    fs.copyFileSync(path.join(sourceRoot, relative), target, fs.constants.COPYFILE_EXCL);
+    fs.chmodSync(target, 0o600);
+    return target;
+}
+/** Ignore only provider-owned service files. Tracked/explicit inputs win;
+ * other ignored and untracked product/task files remain snapshot payload. */
+export function projectServicePathFilter(root, explicitInputs = [], trackedFiles) {
+    const retained = new Set([...(trackedFiles ?? workspaceGitFiles(root, ["--cached"]) ?? []), ...explicitInputs].map(file => path.resolve(root, file)));
+    const branches = new Set();
+    for (const file of retained)
+        for (let directory = path.dirname(file); directory !== path.dirname(directory); directory = path.dirname(directory))
+            branches.add(directory);
+    return file => {
+        const absolute = path.resolve(file), relative = path.relative(root, absolute);
+        return !relative.split(path.sep).includes(".zcode") || retained.has(absolute) || branches.has(absolute);
+    };
+}

package/dist/services/worktrees.js

@@ -9,6 +9,7 @@ import { appendAudit } from "./audit.js";
 import { persistProtocolState, readProtocolRuntimeState, requireProtocol } from "./protocols.js";
 import { requireProjectByRoot } from "./projects.js";
 import { ensureManagedWorktrunk, inspectManagedWorktrunk } from "./tooling.js";
+import { propagateOwnedWorkspaceHooks } from "./workspace-files.js";
 export function planWorktree(context, input) {
     const protocol = scopedProtocol(context, input.projectRoot, input.protocolId);
     const state = readProtocolRuntimeState(context, protocol).state;
@@ -151,7 +152,8 @@ export function bootstrapManagedWorktree(context, input, prepared = prepareManag
             throw new AppError("bootstrap_failed", "Project-owned Worktrunk bootstrap failed", 1, { command: sanitizeCommand(command), result, results });
         }
     }
-    return { status: "succeeded", commands: results };
+    const qualifiedHook = propagateOwnedWorkspaceHooks(prepared.projectRoot, worktreePath);
+    return { status: "succeeded", commands: results, ...(qualifiedHook ? { qualified_hook: qualifiedHook } : {}) };
 }
 export function getWorktreeStatus(context, input) {
     const protocol = scopedProtocol(context, input.projectRoot, input.protocolId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.100",
+  "version": "0.9.0-beta.104",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "bin": {