@deksden-com/dd-flow-cli 0.9.0-beta.103 → 0.9.0-beta.105

package/dist/services/hooks.js

@@ -7,6 +7,7 @@ import { AppError } from "../shared/errors.js";
 import { entityReferenceVariants } from "../shared/entity-references.js";
 import { parseJsonObject } from "../shared/json.js";
 import { canonicalPath, ensureDir, resolveProjectRoot } from "../storage/paths.js";
+import { resolveWorkReference } from "../storage/work-references.js";
 import { appendAudit } from "./audit.js";
 import { prepareTextFile, prepareJsonText, prepareError } from "../cli/input-preparation.js";
 import { nativeSessionIdentity, storageSessionId } from "./session-identity.js";
@@ -549,21 +550,22 @@ function recordZcodeLifecycle(context, input, invocationId) {
     const sessionId = storageSessionId(nativeSessionIdentity("zcode-acp", providerSessionId));
     const parentSessionId = parentProviderSessionId ? storageSessionId(nativeSessionIdentity("zcode-acp", parentProviderSessionId)) : null;
     const observedProfile = objectRecord(ddZcode.observedProfile);
+    const observedCwd = stringValue(hook.cwd) && path.isAbsolute(String(hook.cwd)) ? resolveProjectRoot(String(hook.cwd)) : null;
     let matchKey = lifecycle ? lifecycleMatchKey(lifecycle, expectedRoot) : null;
     const eventNameForReceipt = invocationId ? "ToolCallObserved" : "PreToolUse";
     const persist = (scope) => {
         if (scope)
             matchKey = lifecycleMatchKey(lifecycleFacts(scope.command), expectedRoot, scope);
-        assertHookEventReplay(context, { projectId: project.id, eventKey, harness: "zcode-acp", providerSessionId, parentSessionId, daemonId, sessionId, turnId: null, eventName: eventNameForReceipt, toolName: toolName ?? "Bash", matchKey, cwd: expectedRoot });
-        const payload = { ...hook, session_id: providerSessionId, cwd: expectedRoot, tool_name: toolName ?? "Bash", tool_input: rawInput,
+        assertHookEventReplay(context, { projectId: project.id, eventKey, harness: "zcode-acp", providerSessionId, parentSessionId, daemonId, sessionId, turnId: null, eventName: eventNameForReceipt, toolName: toolName ?? "Bash", matchKey, cwd: observedCwd });
+        const payload = { ...hook, session_id: providerSessionId, cwd: observedCwd, tool_name: toolName ?? "Bash", tool_input: rawInput,
             command, provider: stringValue(observedProfile.provider), model: stringValue(observedProfile.model), reasoning: stringValue(observedProfile.reasoning), mode: stringValue(observedProfile.mode) };
         const inserted = recordHookEvent(context, {
             projectId: project.id, protocolId: null, harness: "zcode-acp", providerSessionId, parentSessionId,
             daemonId, sessionId, agentId: stringValue(hook.agent_id) ?? stringValue(hook.agentId) ?? null, turnId: null,
             eventName: eventNameForReceipt, toolName: toolName ?? "Bash", status: "observed", payload, eventKey, matchKey,
-            transcriptPath: stringValue(hook.transcript_path) ?? null, cwd: expectedRoot
+            transcriptPath: stringValue(hook.transcript_path) ?? null, cwd: observedCwd
         });
-        recordFlowSessionObservation(context, { projectId: project.id, sessionId, cwd: expectedRoot, toolName: toolName ?? "Bash", eventKey });
+        recordFlowSessionObservation(context, { projectId: project.id, sessionId, cwd: observedCwd, toolName: toolName ?? "Bash", eventKey });
         const result = { ok: true, observed: inserted, duplicate: !inserted, event_key: eventKey, harness: "zcode-acp", session: nativeSessionIdentity("zcode-acp", providerSessionId), ...(parentProviderSessionId ? { parent_session: nativeSessionIdentity("zcode-acp", parentProviderSessionId) } : {}), daemon_id: daemonId };
         return { ...result, hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", updatedInput: { ...rawInput, command: rewritten } } };
     };
@@ -602,13 +604,14 @@ export function handleGrokEvent(context, input) {
         return { ok: true, observed: false, reason: "event_not_participating" };
     const bootstrapStageStart = lifecycle?.bootstrapStageStart;
     const expectedRoot = resolveProjectRoot(input.projectRoot);
-    const matchKey = lifecycle ? lifecycleMatchKey(lifecycle, expectedRoot) : null;
+    let matchKey = lifecycle ? lifecycleMatchKey(lifecycle, expectedRoot) : null;
     if (bootstrapStageStart)
         registerProject(context, { root: expectedRoot });
     const project = requireProjectByRoot(context, expectedRoot);
     const meta = objectRecord(hook._meta);
     const ddGrok = objectRecord(meta.ddGrok);
     const observedProfile = objectRecord(ddGrok.observedProfile);
+    const observedCwd = stringValue(hook.cwd) && path.isAbsolute(String(hook.cwd)) ? resolveProjectRoot(String(hook.cwd)) : null;
     const rootProviderSessionId = stringValue(ddGrok.rootProviderSessionId);
     const providerSessionId = stringValue(hook.session_id) ?? stringValue(hook.sessionId);
     if (!rootProviderSessionId || !providerSessionId)
@@ -622,23 +625,35 @@ export function handleGrokEvent(context, input) {
         harness: "grok-acp", providerSessionId, toolUseId: hook.tool_use_id ?? hook.toolUseId ?? null,
         promptId: hook.prompt_id ?? hook.promptId ?? null, command, turn: hook.turn_id ?? hook.turnId ?? null
     })).digest("hex");
-    assertHookEventReplay(context, { projectId: project.id, eventKey, harness: "grok-acp", providerSessionId, parentSessionId, daemonId: daemonId ?? null, sessionId, turnId: stringValue(hook.turn_id) ?? stringValue(hook.turnId) ?? null, eventName: "PreToolUse", toolName: toolName ?? "Bash", matchKey, cwd: expectedRoot });
-    const payload = {
-        ...hook, session_id: providerSessionId, agent_id: agentId, cwd: expectedRoot, tool_name: toolName ?? "Bash", tool_input: rawInput,
-        command, provider: stringValue(observedProfile.provider), model: stringValue(observedProfile.model), reasoning: stringValue(observedProfile.reasoning), mode: stringValue(observedProfile.mode), agent_type: stringValue(hook.subagent_type) ?? stringValue(hook.subagentType)
+    const persist = (scope) => {
+        if (scope)
+            matchKey = lifecycleMatchKey(lifecycleFacts(scope.command), expectedRoot, scope);
+        assertHookEventReplay(context, { projectId: project.id, eventKey, harness: "grok-acp", providerSessionId, parentSessionId, daemonId: daemonId ?? null, sessionId, turnId: stringValue(hook.turn_id) ?? stringValue(hook.turnId) ?? null, eventName: "PreToolUse", toolName: toolName ?? "Bash", matchKey, cwd: observedCwd });
+        const payload = {
+            ...hook, session_id: providerSessionId, agent_id: agentId, cwd: observedCwd, tool_name: toolName ?? "Bash", tool_input: rawInput,
+            command, provider: stringValue(observedProfile.provider), model: stringValue(observedProfile.model), reasoning: stringValue(observedProfile.reasoning), mode: stringValue(observedProfile.mode), agent_type: stringValue(hook.subagent_type) ?? stringValue(hook.subagentType)
+        };
+        const inserted = recordHookEvent(context, {
+            projectId: project.id, protocolId: null, harness: "grok-acp", providerSessionId, parentSessionId,
+            daemonId: daemonId ?? null, sessionId, agentId: agentId ?? null, turnId: stringValue(hook.turn_id) ?? stringValue(hook.turnId) ?? null,
+            eventName: "PreToolUse", toolName: toolName ?? "Bash", status: "observed", payload, eventKey, matchKey, transcriptPath: null, cwd: observedCwd
+        });
+        recordFlowSessionObservation(context, { projectId: project.id, sessionId, cwd: observedCwd, toolName: toolName ?? "Bash", eventKey });
+        return inserted;
     };
-    const inserted = recordHookEvent(context, {
-        projectId: project.id, protocolId: null, harness: "grok-acp", providerSessionId, parentSessionId,
-        daemonId: daemonId ?? null, sessionId, agentId: agentId ?? null, turnId: stringValue(hook.turn_id) ?? stringValue(hook.turnId) ?? null,
-        eventName: "PreToolUse", toolName: toolName ?? "Bash", status: "observed", payload, eventKey, matchKey, transcriptPath: null, cwd: expectedRoot
-    });
-    recordFlowSessionObservation(context, {
-        projectId: project.id, sessionId,
-        cwd: expectedRoot, toolName: toolName ?? "Bash", eventKey
+    const result = (inserted) => ({ ok: true, observed: inserted, duplicate: !inserted, event_key: eventKey, session: nativeSessionIdentity("grok-acp", providerSessionId),
+        ...(isChild ? { parent_session: nativeSessionIdentity("grok-acp", stringValue(ddGrok.parentProviderSessionId) ?? rootProviderSessionId) } : {}), daemon_id: daemonId ?? null });
+    if (!lifecycle)
+        return { ...result(context.db.writeTransaction(() => persist())), hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", updatedInput: { ...rawInput, command: commandWithHookEvent(command, eventKey) } } };
+    let inserted = false;
+    const receipt = observeLifecycleInvocation(context, {
+        command, harness: "grok-acp", projectId: project.id,
+        identity: { daemonId: daemonId ?? "", rootSessionId: rootProviderSessionId, sessionId: providerSessionId, parentSessionId, toolCallId: eventKey },
+        recordReceipt: scope => { inserted = persist(scope); return eventKey; }
     });
-    const result = { ok: true, observed: inserted, duplicate: !inserted, event_key: eventKey, session: nativeSessionIdentity("grok-acp", providerSessionId),
-        ...(isChild ? { parent_session: nativeSessionIdentity("grok-acp", stringValue(ddGrok.parentProviderSessionId) ?? rootProviderSessionId) } : {}), daemon_id: daemonId ?? null };
-    return { ...result, hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", updatedInput: { ...rawInput, command: commandWithHookEvent(command, eventKey) } } };
+    if (receipt.invocationId)
+        return { ...result(inserted), invocation_id: receipt.invocationId, hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", updatedInput: { ...rawInput, command: commandWithHookEvent(command, eventKey) } } };
+    return { ...result(inserted), hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", updatedInput: { ...rawInput, command: commandWithHookEvent(command, eventKey) } } };
 }
 /** Convert a controlled OpenCode tool hook into the shared lifecycle receipt. */
 export function handleOpenCodeEvent(context, input) {
@@ -654,6 +669,65 @@ export function handleDroidEvent(context, input) {
         throw new AppError("unsupported_droid_event_schema", "Unsupported Droid event schema", 1);
     return handleControlledToolEvent(context, input, event, "droid-cli");
 }
+/** Stable project identity is not the native Session's execution workspace. */
+function controlledLifecycleCwd(context, projectRoot, facts, providerSessionId, auxiliary) {
+    if (facts?.bootstrapStageStart)
+        return projectRoot;
+    const project = context.db.get("SELECT id FROM projects WHERE root = ?", [projectRoot]);
+    if (!project)
+        return projectRoot;
+    let work;
+    if (facts?.workId) {
+        try {
+            work = resolveWorkReference(context, facts.workId, { projectId: project.id });
+        }
+        catch (error) {
+            if (!(error instanceof AppError) || !["not_found", "ambiguous_work_alias"].includes(error.code))
+                throw error;
+        }
+    }
+    const reference = work?.run_id ?? facts?.runId ?? auxiliary?.args.options.get("run")?.[0] ?? auxiliary?.args.positional[2];
+    if (!reference)
+        return projectRoot;
+    const run = context.db.get("SELECT id, run_root, workspace_root FROM runs WHERE project_id = ? AND (id = ? OR short_id = ?)", [project.id, reference, reference]);
+    if (!run)
+        return projectRoot; // Hook ingress does not validate a mistyped CLI target.
+    if (work) {
+        // PROTOCOLIZE provisions the feature checkout after its coordinator
+        // Session has launched in the stable project root. Its transition Work
+        // must keep that physical route until the Stage is complete.
+        if (context.db.get("SELECT 1 FROM sqlite_schema WHERE type = 'table' AND name = 'stage_work_memberships'")
+            && context.db.get("SELECT 1 FROM stage_work_memberships WHERE project_id = ? AND run_id = ? AND work_id = ? AND stage IN ('specify','protocolize') LIMIT 1", [project.id, run.id, work.work_id]))
+            return projectRoot;
+        const merge = context.db.get("SELECT target_workspace FROM merge_requests WHERE executor_work_id = ? AND run_id = ?", [work.work_id, run.id]);
+        if (merge)
+            return resolveProjectRoot(merge.target_workspace);
+        if (context.db.get("SELECT 1 FROM sqlite_schema WHERE type = 'table' AND name = 'work_launches'")) {
+            const launch = context.db.get("SELECT provider_session_id, profile_json FROM work_launches WHERE work_id = ? AND status IN ('launching', 'start_requested')", [work.work_id]);
+            if (launch?.provider_session_id === providerSessionId && run.run_root) {
+                const copy = JSON.parse(launch.profile_json).review_copy?.root;
+                if (copy) {
+                    const target = path.resolve(run.run_root, copy);
+                    const relative = path.relative(run.run_root, target);
+                    if (relative === ".." || relative.startsWith(`..${path.sep}`))
+                        throw new AppError("read_only_workspace_unbound", "Review copy escapes its owning RUN", 1);
+                    return resolveProjectRoot(target);
+                }
+            }
+        }
+    }
+    if (facts?.stageName === "specify" || facts?.stageName === "protocolize")
+        return projectRoot;
+    if (facts?.stageName === "merge") {
+        const pending = context.db.all("SELECT target_workspace FROM merge_requests WHERE project_id = ? AND run_id = ? AND status IN ('dispatching','active','action_required') ORDER BY updated_at DESC", [project.id, run.id]);
+        const targets = [...new Set(pending.map(item => resolveProjectRoot(item.target_workspace)))];
+        if (targets.length > 1)
+            throw new AppError("merge_workspace_ambiguous", "Current MERGE requests disagree on the native execution workspace", 1, { run_id: run.id, target_workspaces: targets });
+        if (targets.length === 1)
+            return targets[0];
+    }
+    return resolveProjectRoot(run.workspace_root);
+}
 function handleControlledToolEvent(context, input, event, harness) {
     const agy = harness === "antigravity-cli";
     const droid = harness === "droid-cli";
@@ -676,9 +750,7 @@ function handleControlledToolEvent(context, input, event, harness) {
         throw new AppError(`${errorPrefix}_session_identity_invalid`, `${label} event is missing trusted physical identity`, 1);
     }
     const expectedRoot = resolveProjectRoot(input.projectRoot);
-    if (resolveProjectRoot(directory) !== expectedRoot) {
-        throw new AppError(`${errorPrefix}_directory_mismatch`, `${label} Session directory does not match the controlled workspace`, 1, { expected: expectedRoot, actual: directory });
-    }
+    const observedCwd = resolveProjectRoot(directory);
     if (droid && nativeParentId === providerSessionId)
         throw new AppError("droid_session_identity_invalid", "A Droid Session cannot parent itself", 1);
     const sessionId = storageSessionId(nativeSessionIdentity(harness, providerSessionId));
@@ -690,8 +762,8 @@ function handleControlledToolEvent(context, input, event, harness) {
         const inserted = recordHookEvent(context, {
             projectId: project.id, protocolId: null, harness, providerSessionId, parentSessionId,
             daemonId, sessionId, agentId: stringValue(session.agent_id) ?? null, turnId: stringValue(event.message_id) ?? null,
-            eventName: "PostToolUse", toolName, status: "observed", payload: { session_id: providerSessionId, cwd: expectedRoot, tool_name: toolName, status: objectRecord(event.outcome).status },
-            eventKey: baseKey, matchKey: null, transcriptPath: droid ? stringValue(event.transcript_path) ?? null : null, cwd: expectedRoot
+            eventName: "PostToolUse", toolName, status: "observed", payload: { session_id: providerSessionId, cwd: observedCwd, tool_name: toolName, status: objectRecord(event.outcome).status },
+            eventKey: baseKey, matchKey: null, transcriptPath: droid ? stringValue(event.transcript_path) ?? null : null, cwd: observedCwd
         });
         return { ok: true, observed: inserted, duplicate: !inserted, event_key: baseKey, phase, harness, session: nativeSessionIdentity(harness, providerSessionId), ...(nativeParentId ? { parent_session: nativeSessionIdentity(harness, nativeParentId) } : {}) };
     }
@@ -699,10 +771,15 @@ function handleControlledToolEvent(context, input, event, harness) {
         return { ok: true, observed: false, reason: command ? "non_bash_tool" : "event_not_participating" };
     }
     const lifecycle = lifecycleFacts(command);
-    if (!lifecycle && !continuationCommand(command))
+    const auxiliary = continuationCommand(command);
+    if (!lifecycle && !auxiliary)
         return { ok: true, observed: false, reason: "event_not_participating" };
+    const expectedCwd = controlledLifecycleCwd(context, expectedRoot, lifecycle, providerSessionId, auxiliary);
+    if (observedCwd !== expectedCwd) {
+        throw new AppError(`${errorPrefix}_directory_mismatch`, `${label} ${agy ? "launch route" : "Session directory"} does not match the assigned execution workspace`, 1, { expected: expectedCwd, actual: observedCwd, ...(agy ? { actual_provenance: stringValue(event.cwd_provenance) ?? "unknown" } : {}) });
+    }
     const bootstrapStageStart = lifecycle?.bootstrapStageStart;
-    const matchKey = lifecycle ? lifecycleMatchKey(lifecycle, expectedRoot) : null;
+    let matchKey = lifecycle ? lifecycleMatchKey(lifecycle, expectedRoot) : null;
     if (bootstrapStageStart)
         registerProject(context, { root: expectedRoot });
     const project = requireProjectByRoot(context, expectedRoot);
@@ -713,28 +790,55 @@ function handleControlledToolEvent(context, input, event, harness) {
         }
     }
     const agentId = stringValue(session.agent_id);
-    assertHookEventReplay(context, { projectId: project.id, eventKey: baseKey, harness, providerSessionId, parentSessionId, daemonId, sessionId, turnId: stringValue(event.message_id) ?? null, eventName: "PreToolUse", toolName, matchKey, cwd: expectedRoot });
-    const payload = {
-        session_id: providerSessionId, agent_id: agentId, cwd: expectedRoot, tool_name: toolName, tool_input: rawInput, command,
-        provider: stringValue(profile.provider), model: stringValue(profile.model), reasoning: stringValue(droid ? profile.reasoning : profile.variant),
-        mode: stringValue(droid ? profile.mode : profile.agent), agent_type: stringValue(droid ? profile.agent_type : profile.agent)
+    const persist = (scope) => {
+        if (scope)
+            matchKey = lifecycleMatchKey(lifecycleFacts(scope.command), expectedRoot, scope);
+        assertHookEventReplay(context, { projectId: project.id, eventKey: baseKey, harness, providerSessionId, parentSessionId, daemonId, sessionId, turnId: stringValue(event.message_id) ?? null, eventName: "PreToolUse", toolName, matchKey, cwd: observedCwd });
+        const payload = {
+            session_id: providerSessionId, agent_id: agentId, cwd: observedCwd, tool_name: toolName, tool_input: rawInput, command,
+            ...(agy ? { cwd_provenance: stringValue(event.cwd_provenance) ?? "unknown" } : {}),
+            provider: stringValue(profile.provider), model: stringValue(profile.model), reasoning: stringValue(droid ? profile.reasoning : profile.variant),
+            mode: stringValue(droid ? profile.mode : profile.agent), agent_type: stringValue(droid ? profile.agent_type : profile.agent)
+        };
+        const inserted = recordHookEvent(context, {
+            projectId: project.id, protocolId: null, harness, providerSessionId, parentSessionId,
+            daemonId, sessionId, agentId: agentId ?? null, turnId: stringValue(event.message_id) ?? null, eventName: "PreToolUse", toolName,
+            status: "observed", payload, eventKey: baseKey, matchKey, transcriptPath: droid ? stringValue(event.transcript_path) ?? null : null, cwd: observedCwd
+        });
+        recordFlowSessionObservation(context, { projectId: project.id, sessionId, cwd: observedCwd, toolName, eventKey: baseKey });
+        return inserted;
     };
-    const inserted = recordHookEvent(context, {
-        projectId: project.id, protocolId: null, harness, providerSessionId, parentSessionId,
-        daemonId, sessionId, agentId: agentId ?? null, turnId: stringValue(event.message_id) ?? null, eventName: "PreToolUse", toolName,
-        status: "observed", payload, eventKey: baseKey, matchKey, transcriptPath: droid ? stringValue(event.transcript_path) ?? null : null, cwd: expectedRoot
-    });
-    recordFlowSessionObservation(context, { projectId: project.id, sessionId, cwd: expectedRoot, toolName, eventKey: baseKey });
-    const result = { ok: true, observed: inserted, duplicate: !inserted, event_key: baseKey, phase, harness, session: nativeSessionIdentity(harness, providerSessionId), ...(nativeParentId ? { parent_session: nativeSessionIdentity(harness, nativeParentId) } : {}), daemon_id: daemonId };
-    return agy ? result : { ...result, hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", updatedInput: { ...rawInput, command: commandWithHookEvent(command, baseKey) } } };
+    const result = (inserted) => ({ ok: true, observed: inserted, duplicate: !inserted, event_key: baseKey, phase, harness, session: nativeSessionIdentity(harness, providerSessionId), ...(nativeParentId ? { parent_session: nativeSessionIdentity(harness, nativeParentId) } : {}), daemon_id: daemonId });
+    if (agy && lifecycle) {
+        let inserted = false;
+        const receipt = observeLifecycleInvocation(context, {
+            command, harness, projectId: project.id, identity: { daemonId, rootSessionId: nativeParentId ?? providerSessionId, sessionId: providerSessionId, parentSessionId: nativeParentId ?? null, toolCallId: toolCallId },
+            recordReceipt: scope => { inserted = persist(scope); return baseKey; }
+        });
+        return { ...result(inserted), ...(receipt.invocationId ? { invocation_id: receipt.invocationId } : {}) };
+    }
+    const inserted = context.db.writeTransaction(() => persist());
+    return agy ? result(inserted) : { ...result(inserted), hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", updatedInput: { ...rawInput, command: commandWithHookEvent(command, baseKey) } } };
 }
 /** Convert an Antigravity CLI tool hook into the shared lifecycle receipt. */
 export function handleAgyEvent(context, input) {
     const event = parseJsonObject(input.stdin || "{}", "Antigravity tool event");
     if (event.schema_id !== "dd-flow/agy-tool-event@1")
         throw new AppError("unsupported_agy_event_schema", "Unsupported Antigravity event schema", 1);
-    const workspacePaths = Array.isArray(event.workspace_paths) ? event.workspace_paths : [];
-    const directory = workspacePaths.find((value) => typeof value === "string" && path.isAbsolute(value));
+    // workspacePaths lists available workspaces; its first element is not a
+    // native selected-cwd observation. The daemon's spawn cwd is a separate,
+    // launch-bound route, and the list only corroborates its membership.
+    const workspacePaths = Array.isArray(event.workspace_paths)
+        ? event.workspace_paths.filter((value) => typeof value === "string" && path.isAbsolute(value)) : [];
+    const launchCwd = stringValue(event.launch_cwd);
+    const qualifiedLaunchCwd = launchCwd && path.isAbsolute(launchCwd) ? launchCwd : undefined;
+    const directory = qualifiedLaunchCwd ?? (workspacePaths.length === 1 ? workspacePaths[0] : undefined);
+    if (!directory && workspacePaths.length > 1)
+        throw new AppError("agy_workspace_route_unproven", "Antigravity did not identify the active route among multiple workspaces", 1, { workspace_paths: workspacePaths });
+    if (directory && qualifiedLaunchCwd && workspacePaths.length
+        && !workspacePaths.some(value => resolveProjectRoot(value) === resolveProjectRoot(directory))) {
+        throw new AppError("agy_workspace_route_unproven", "Antigravity launch cwd is absent from the native workspace list", 1, { launch_cwd: directory, workspace_paths: workspacePaths });
+    }
     const providerSessionId = stringValue(event.conversation_id);
     const daemonId = stringValue(event.daemon_id);
     const eventId = stringValue(event.event_id);
@@ -743,6 +847,9 @@ export function handleAgyEvent(context, input) {
         throw new AppError("agy_session_identity_invalid", "Antigravity event is missing trusted physical identity", 1);
     const rawInput = objectRecord(event.input);
     const command = stringValue(rawInput.command) ?? stringValue(rawInput.cmd) ?? stringValue(rawInput.CommandLine);
+    if (command && (lifecycleFacts(command) || continuationCommand(command)) && !qualifiedLaunchCwd) {
+        throw new AppError("agy_workspace_route_unproven", "Managed Antigravity call has no launch-bound execution cwd", 1, { phase: "prepare", effect: "no_effect", recoverable: false, workspace_paths: workspacePaths });
+    }
     const invalidStep = !Number.isSafeInteger(event.step_index) || Number(event.step_index) < 0;
     const invalidExecution = event.execution_num !== undefined && (!Number.isSafeInteger(event.execution_num) || Number(event.execution_num) < 0);
     if (event.phase === "before" && command && (lifecycleFacts(command) || continuationCommand(command)) && (invalidStep || invalidExecution)) {
@@ -753,6 +860,7 @@ export function handleAgyEvent(context, input) {
         daemon_id: daemonId, tool_call_id: eventId, tool: toolName, input: event.input,
         message_id: event.step_index === undefined ? null : String(event.step_index),
         session: { provider_session_id: providerSessionId, parent_provider_session_id: event.parent_conversation_id, directory },
+        cwd_provenance: qualifiedLaunchCwd ? "launch_bound" : "workspace_paths_singleton",
         profile: { provider: objectRecord(event.profile).provider, model: objectRecord(event.profile).model, variant: objectRecord(event.profile).reasoning, agent: objectRecord(event.profile).mode },
         outcome: { status: stringValue(event.error) ? "error" : "completed" }
     };

package/dist/services/lanes.js

@@ -23,14 +23,13 @@ export function prepareLaneLock(context, input, action) {
     const { timeoutSeconds, pollIntervalSeconds } = prepareLaneWaitTiming(input);
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
     const lane = normalizeLane(input.lane);
-    if (input.workspacePath !== undefined)
-        requireMatchingLaneWorkspace(context, project.id, lane, input.workspacePath);
-    else if (["acquire", "wait", "wait-acquire"].includes(action))
+    const workspace = input.workspacePath !== undefined ? requireMatchingLaneWorkspace(context, project.id, lane, input.workspacePath) : undefined;
+    if (input.workspacePath === undefined && ["acquire", "wait", "wait-acquire"].includes(action))
         throw new AppError("validation", "Lane lock requires a workspace path", 2);
     if (action === "acquire" || action === "wait-acquire")
         assertWorkerMayAcquireLaneLock(context, project.id, lane, input.workerId);
     const lock = action === "heartbeat" || action === "release" ? requireOwnedActiveLock(context, project.id, lane, input.workerId, input.leaseToken) : undefined;
-    return { project, lane, ttlSeconds, timeoutSeconds, pollIntervalSeconds, lock };
+    return { project, lane, ttlSeconds, timeoutSeconds, pollIntervalSeconds, lock, workspace };
 }
 export function getLaneStatus(context, input) {
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
@@ -99,7 +98,12 @@ export function checkLaneWorkspace(context, input) {
     };
 }
 export function acquireLaneLock(context, input) {
-    const { project, lane, ttlSeconds } = prepareLaneLock(context, input, "acquire");
+    const prepared = prepareLaneLock(context, input, "acquire");
+    return context.db.writeTransaction(() => acquirePreparedLaneLock(context, input, prepared));
+}
+function acquirePreparedLaneLock(context, input, prepared) {
+    const { project, lane, ttlSeconds } = prepared;
+    assertPreparedLaneLock(context, prepared, input.workerId);
     expireStaleLocks(context, project.id);
     const active = activeLaneLock(context, project.id, lane);
     if (active) {
@@ -141,6 +145,12 @@ export function acquireLaneLock(context, input) {
         ...(expired ? { expired_lock_id: expired.id } : {})
     };
 }
+function assertPreparedLaneLock(context, prepared, workerId) {
+    if (JSON.stringify(laneRecord(context, prepared.project.id, prepared.lane)) !== JSON.stringify(prepared.workspace)
+        || context.db.get("SELECT root FROM projects WHERE id = ?", [prepared.project.id])?.root !== prepared.project.root)
+        throw new AppError("lane_workspace_changed", "Lane registration changed after workspace preparation", 1);
+    assertWorkerMayAcquireLaneLock(context, prepared.project.id, prepared.lane, workerId);
+}
 export function heartbeatLaneLock(context, input) {
     const { project, lock: preparedLock, ttlSeconds } = prepareLaneLock(context, input, "heartbeat");
     const lock = preparedLock;
@@ -524,13 +534,15 @@ function ensureQueuedLaneWaiter(context, input) {
     return waiter;
 }
 function tryAcquireQueuedLaneLock(context, input) {
-    context.db.beginWriteTransaction();
-    try {
+    const prepared = prepareLaneLock(context, input, "wait-acquire");
+    if (prepared.project.id !== input.projectId || prepared.lane !== input.lane)
+        throw new AppError("lane_workspace_changed", "Lane identity changed while waiting", 1);
+    return context.db.writeTransaction(() => {
+        assertPreparedLaneLock(context, prepared, input.workerId);
         expireStaleLocks(context, input.projectId);
         expireStaleWaiters(context, input.projectId);
         const existingLock = activeLaneLock(context, input.projectId, input.lane);
         if (existingLock?.worker_id === input.workerId) {
-            context.db.exec("COMMIT");
             return {
                 acquired: true,
                 payload: {
@@ -548,7 +560,6 @@ function tryAcquireQueuedLaneLock(context, input) {
         }
         const latest = latestLaneWaiterForWorker(context, input.projectId, input.lane, input.workerId);
         if (latest && ["cancelled", "expired"].includes(latest.status) && latest.updated_at >= input.invocationStartedAt) {
-            context.db.exec("COMMIT");
             return {
                 acquired: false,
                 payload: {
@@ -572,14 +583,14 @@ function tryAcquireQueuedLaneLock(context, input) {
         });
         const head = firstQueuedLaneWaiter(context, input.projectId, input.lane);
         if (!existingLock && head?.id === waiter.id) {
-            const lockResult = acquireLaneLock(context, {
+            const lockResult = acquirePreparedLaneLock(context, {
                 projectRoot: input.projectRoot,
                 lane: input.lane,
                 workerId: input.workerId,
                 workspacePath: input.workspacePath,
                 ttlSeconds: input.ttlSeconds,
                 reason: input.reason
-            });
+            }, prepared);
             const now = context.now();
             context.db.run(`UPDATE lane_waiters
          SET status = 'acquired', acquired_at = ?, updated_at = ?
@@ -591,7 +602,6 @@ function tryAcquireQueuedLaneLock(context, input) {
                 reason: input.reason,
                 payload: { project_id: input.projectId, lane: input.lane, worker_id: input.workerId, waiter_id: waiter.id }
             });
-            context.db.exec("COMMIT");
             return {
                 acquired: true,
                 payload: {
@@ -608,7 +618,6 @@ function tryAcquireQueuedLaneLock(context, input) {
             };
         }
         const position = queuedWaiterPosition(context, input.projectId, input.lane, waiter.id);
-        context.db.exec("COMMIT");
         return {
             acquired: false,
             payload: {
@@ -622,11 +631,7 @@ function tryAcquireQueuedLaneLock(context, input) {
                 position
             }
         };
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+    });
 }
 function resolveExistingPath(value) {
     return resolveProjectRoot(value);

package/dist/services/lifecycle-command.js

@@ -160,8 +160,16 @@ function invocationFromSegment(segment, heredoc, wrapped, inheritedEnv) {
             index += 1;
         }
     }
-    const executable = segment.words[index];
-    if (!executable || path.basename(executable) !== "dd-flow" && executable !== "$DD_FLOW_BIN")
+    let executable = segment.words[index];
+    let nodeLauncher = false;
+    let launcher;
+    if (executable && path.basename(executable) === "node"
+        && (path.basename(segment.words[index + 1] ?? "") === "cli.js" || segment.words[index + 1] === "$DD_FLOW_BIN")) {
+        launcher = executable;
+        executable = segment.words[++index];
+        nodeLauncher = true;
+    }
+    if (!executable || path.basename(executable) !== "dd-flow" && executable !== "$DD_FLOW_BIN" && !(nodeLauncher && path.basename(executable) === "cli.js"))
         return null;
     const argv = segment.words.slice(index + 1);
     const operation = lifecycleOperation(argv);
@@ -170,6 +178,7 @@ function invocationFromSegment(segment, heredoc, wrapped, inheritedEnv) {
     return {
         operation,
         executable,
+        ...(launcher ? { launcher } : {}),
         argv,
         env,
         args: parseCommandArgs(argv.slice(operation === "recovery_accept" ? 3 : 2)),